aws / s2n-tls

An implementation of the TLS/SSL protocols
https://aws.github.io/s2n-tls/usage-guide/
Apache License 2.0
4.53k stars 707 forks source link

fix: don't iterate over certs if not validating certs #4797

Closed lrstewart closed 1 month ago

lrstewart commented 1 month ago

Description of changes:

Fix a performance regression for customers with a very large number of certificates.

Testing:

Added a unit test.

Adding a benchmark test for this would currently be difficult, because our benchmark tests use Rust. The Rust bindings currently don't support multiple certificates of the same type (see the description of https://github.com/aws/s2n-tls/pull/3860), so can only load 3 cert chains. However, a customer who uses 10k certificates has tested this fix and verified that it fixes the performance regression. I also verified it locally with perf.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.