80feb8b676
Fixes #24447 This factory type, which is really more a data holder/connection producer per connection instance, creates, if using https, a new certificate_credentials on every instance. Which when used by S3 client is per client and scheduling groups. Which eventually means that we will do a set_system_trust + "cold" handshake for every tls connection created this way. This will cause both IO and cold/expensive certificate checking -> possible stalls/wasted CPU. Since the credentials object in question is literally a "just trust system", it could very well be shared across the shard. This PR adds a thread local static cached credentials object and uses this instead. Could consider moving this to seastar, but maybe this is too much. Closes scylladb/scylladb#24448
21 lines
643 B
C++
21 lines
643 B
C++
/*
|
|
* SPDX-License-Identifier: LicenseRef-ScyllaDB-Source-Available-1.0
|
|
*/
|
|
|
|
/*
|
|
* Copyright (C) 2025-present ScyllaDB
|
|
*/
|
|
|
|
#include "http.hh"
|
|
|
|
future<shared_ptr<tls::certificate_credentials>> utils::http::dns_connection_factory::system_trust_credentials() {
|
|
static shared_ptr<tls::certificate_credentials> system_trust_credentials;
|
|
if (!system_trust_credentials) {
|
|
// can race, and overwrite the object. that is fine.
|
|
auto cred = make_shared<tls::certificate_credentials>();
|
|
co_await cred->set_system_trust();
|
|
system_trust_credentials = std::move(cred);
|
|
}
|
|
co_return system_trust_credentials;
|
|
}
|