Skip to content

Commit c1d47f0

Browse files
committed
provide consistent environement to test SSL libraries with 3rd party tool
the idea is to have a script (set of scripts) which build and install environement such we can evaluate SSL performance of different SSL implementations. The initial version supports httpd from apache. The idea is to build desired SSL library and install it to custom location (INSTALL ROOT). Then we build apache and siege client and install it to INSTALL ROOT. The proposed approach uses shell script as it is very lightweight and portable between various *NIX flavours. Reviewed-by: Neil Horman <[email protected]> (Merged from #49)
1 parent af6fc94 commit c1d47f0

File tree

4 files changed

+1936
-0
lines changed

4 files changed

+1936
-0
lines changed

bench-scripts/README.md

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# https performance tests with apache (or nginx)
2+
3+
The scripts here install and configure desired server with OpenSSL [1],
4+
WolfSSL[2], LibreSSL [3], BoringSSL [4] and aws-lc [5]. Script builds
5+
and installs the library to dedicated directory. Each library is built
6+
with its default options which enable/disable features. The script then
7+
uses siege [6] to measure https performance for each library. There are
8+
no command line options everything is controlled using env. variables:
9+
- `BENCH_INSTALL_ROOT` sets the directory under which the SSL libraries
10+
and tools are installed (`/tmp/branch.binaries` by default)
11+
- `BENCH_WORKSPACE_ROOT` sets the workspace directory where libraries and
12+
tools are compiled.
13+
- `BENCH_MAKE_OPTS` command line options for make(1) command
14+
- `BENCH_RESULTS` directory where to save results
15+
(`$BENCH_INSTALL_ROOT/results` by default)
16+
- `BENCH_HTTPS_PORT` port where https test server should listen to
17+
(4430 by default).
18+
- `BENCH_HTTP_PORT` port where http test server should listen to
19+
(8080 by default)
20+
- `BENCH_TEST_TIME` time to run performance test. default value is
21+
5 minutes (5M). See option `-t` in siege manual [7] for details.
22+
- `BENCH_HOST` hostname/ip address where server is listening to
23+
(127.0.0.1 by default)
24+
- `BENCH_CERT_SUBJ` set to `/CN=localhost` by default
25+
- `BENCH_CERT_ALT_SUBJ` set to `subjectAltName=DNS:localhost,IP:127.0.0.1`
26+
by default
27+
The siege client runs in benchmark mode (with option `-b`). It is told to fetch
28+
16 files until `BENCH_TEST_TIME` elapses. The file sizes are 64B, 128B,
29+
256B, ... 4MB.
30+
31+
The libraries the benchmark tests are as follows:
32+
- OpenSSL 3.0, 3.1, ... 3.6, master
33+
- WolfSSL 5.8.2
34+
- BorinSSL master version
35+
- LibreSSL 4.1.0
36+
- aws-lc master version
37+
38+
## Apache
39+
40+
All tests use version 2.4.65 (except wolfssl which must use 2.4.51, however the
41+
apache still does not work with WolfSSL, issue is still being investigated).
42+
The apache server configuration is identical for all SSL libraries. The apache
43+
server is built with mpm worker, event and pre-fork loadable modules. The test
44+
iterates over three server configurations which each uses particular mpm
45+
module. The modules run with their configuration supplied by apache.
46+
47+
The configuration for apache server (httpd.conf) is saved along the results
48+
together with configuration for mod\_ssl. The script does not change any
49+
parameters except adjustments of file paths. Everything runs with
50+
default settings which come with apache installation.
51+
52+
## nginx
53+
54+
All tests use nginx 1.28 (except WolfSSL which uses 1.24). The
55+
`worker_processes` configuration option is st to auto.
56+
Apart from adjusting paths in nginx.conf the script also sets
57+
option `work_process` to auto. Nginx server configuration is
58+
saved along the results for each test.
59+
60+
## Build requirements
61+
62+
Requirements for ubuntu are the following:
63+
- ksh
64+
- gnuplot
65+
- git
66+
- ninja-build
67+
- cmake
68+
- wget
69+
- autoconf
70+
- bzip2
71+
- libpcre2-dev
72+
- libexpat-dev
73+
- golang-go
74+
- zlib1g-dev
75+
- libtool
76+
- g++
77+
78+
[1]: https://www.openssl.org/
79+
80+
[2]: https://www.wolfssl.com/
81+
82+
[3]: https://www.libressl.org/
83+
84+
[4]: https://www.chromium.org/Home/chromium-security/boringssl/
85+
86+
[5]: https://aws.amazon.com/security/opensource/cryptography/
87+
88+
[6]: https://www.joedog.org/siege-home/
89+
90+
[7]: https://www.joedog.org/siege-manual/

0 commit comments

Comments
 (0)