Quarkus TLS Performance with InputStream

[werpat]

Following up on #46677 I have been stumbled on / investigated on another throughput related bottleneck. This time specifically tied to HTTPS/TLS when reading the streamed POST body as InputStream.

While I am aware that HTTPS/TLS increases load and may lower throughput, it is factor 30 slower than with HTTP, which seems unreasonable slow to me.
In our testsytem we measured:

• ~600-700MiB/s for plain HTTP on loopback
• ~20MiB/s for HTTPS on loopback
• ~400MiB/s when offloading TLS to nginx in a docker container running on the same machine

So clearly the crypto computing by itself should not be the problem.

These numbers and tests are taken and done with https://github.com/werpat/quarkus-tls-inputstreamtest/

In further tests I also used the tcnative binding for netty and configured it to use the openssl library as tls engine via HttpServerOptionsCustomizer and setting the SslEngineOption to OpenSSLEngineOptions.

With this setting I was able to achive ~210MiB/s which is enough for my case even though it is still half the value of offloading tls to nginx and reverse proxying. Perhaps there is a deeper problem here i dont see or just unavoidable overhead comming with java+tls - I dont know.

Nevertheless would it maybe make sense to offer this simple setting solution via Quarkus config setting similar to quarkus.vertx.prefer-native-transport. For example quarkus.vertx.use-native-openssl ?

[cescoffier]

it's coming as part of the PQC work: #53076.

[werpat]

Thats cool! Thanks for pointing it out. I did not find it while searching for anything similar - probably because I focused on the performance aspect not the setting itself.

[gsmet]

@werpat would you be able to profile your system under load with AsyncProfiler? It might show up interesting stuff.

[werpat]

I profiled it with async-profiler while doing my tests and created a flamegraph for with and without using openssl - both are in my test git repository
http://htmlpreview.github.io/?https://github.com/werpat/quarkus-tls-inputstreamtest/blob/main/flamegraph.html
https://htmlpreview.github.io/?https://github.com/werpat/quarkus-tls-inputstreamtest/blob/main/flamegraph-native.html

I did not create a profile of plain http yet, but I can do so if it's of interest.