Subject: [BugDB] Performance issue (PR#723)

From: [email-masked]
Date: Sat, 22 Jun 2002 01:49:12 +0200 (MET DST)

Full_Name: Denis Almeida Vieira Junior
Version: 2.8.9
OS: Solaris 2.7
Submission from: (NULL) (200.221.27.122)

Hey there.

I've been detecting some performance problems, since the version 2.8.6.
Today, I'm testing with Apache 1.3.26 + mod_ssl 2.8.9 and openssl 0.9.6d.

The configuration "Apache 1.3.22 + mod_ssl 2.8.5 + openssl 0.9.6b" and lower,
works fine.

So, here is the problem:

Case 1) - "Apache 1.3.22 + mod_ssl 2.8.5 + openssl 0.9.6b".
"Working fine, but apache vulnerable (chunk vuln) and (zlib problems).

configuration: export CFLAGS='-DHARD_SERVER_LIMIT=8192'; ./configure
--with-apache=../apache_1.3.22
--with-ssl=../../openssl-0.9.6b  --disable-rule=DEV_RANDOM --disable-rule=EXPAT
--disable-rule=IRIXN32 --disable-rule=IRIXNIS --disable-rule=WANTHSREGEX
--enable-module=most --enable-module=mmap_static --enable-shared=ssl
--enable-shared=max
--prefix=/opt/apache1322

This case works fine. I stressed the server, with 150 threads, and the loadav
was considerably
(~4).

Case 2) - "Apache 1.3.26 + mod_ssl 2.8.9 + openssl 0.9.6d".
The perfect situation. No chunk exploit or zlib problems.

configuration: export CFLAGS='-DHARD_SERVER_LIMIT=8192'; ./configure
--with-apache=../apache_1.3.26
--with-ssl=../../openssl-0.9.6d  --disable-rule=DEV_RANDOM --disable-rule=EXPAT
--disable-rule=IRIXN32 --disable-rule=IRIXNIS --disable-rule=WANTHSREGEX
--enable-module=most --enable-module=mmap_static --enable-shared=ssl
--enable-shared=max
--prefix=/opt/apache1326

This case unveils the performance issue. And the same happens with any version
newer than the
case 1. The same stress situation, under this condition, same config httpd.conf
file, the server
works on a ~40 loadav.

In this case 2, I opened a new test, under the same conditions, but the
compilation of the
OpenSSL. I tried the "./config no-threads no-idea -fPIC" configuration and
compilation options.
This caused a different behavior. I mean, it took a little while (~3 minutes),
to the loadav get
high, and after a few minutes, it got worse... the loadav reached ~60...
Without the "no-threads no-idea -fPIC" options at the openSSL compilation, the
high loadav is
instantaneous.

I can bring any information you need to debug this problem. Just let me know
what do you need.
I really need a help here. I have problems upgrading my servers because the
performance issue,
and I need to, to fix the chunk and zlib problems.

Any help would be gladly appreciated.

B. Regards.

Denis.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Thomas Binder <[email-masked]>
Date: Mon, 24 Jun 2002 10:52:29 +0200

Hi!

On Sat, Jun 22, 2002 at 01:49:12AM +0200, [email-masked] wrote:
> This caused a different behavior. I mean, it took a little while
> (~3 minutes), to the loadav get high, and after a few minutes,
> it got worse... the loadav reached ~60... Without the
> "no-threads no-idea -fPIC" options at the openSSL compilation,
> the high loadav is instantaneous.
> 
> I can bring any information you need to debug this problem. Just
> let me know what do you need.

What kind of random seed do you use? As far as I know, IRIX has no
/dev/random (nor /dev/urandom), so I might be a good idea to
install prngd and let SSLRandomSeed point to its socket (using
egd:/path/to/socket)

This might already solve your problem.

Ciao

Thomas

---

From: "Denis A.V.Jr." <[email-masked]>
Date: 25 Jun 2002 20:08:20 -0300

Hi Thomas,

I'll try that and send the results to the list.

thank you

-- 
Denis A.V.Jr. - [email-masked]
Systems Engineer - ICQ 2524962
Universo Online

perl -e 'print "computers are like air-conditioners: they stop working
when you open windows ", pack("c*",hex
"3A",sqrt(2025),(unpack(c,"=")-20),10);'

---

From: "Denis A.V.Jr." <[email-masked]>
Date: 28 Jun 2002 18:21:11 -0300

Hi,

I tried with the prngd and exactly the same problem appeared.
=(

Regards

---

From: Marc Buetikofer <[email-masked]>
Date: Tue, 2 Jul 2002 09:31:28 +0200 (MEST)

Hi,

Is it possible for to return a static page to a browser if an SSL
handshake failed? I have in mind the situation, when e.g. a 56-bit Browser
tries to hanshake with an Apache that requires 128 bits.
I could not find any directive in the documentation.

Thanks for help!!

 Marc