0d61d63e7e
Fixes #24447
This factory type, which is really more a data holder/connection producer
per connection instance, creates, if using https, a new certificate_credentials
on every instance. Which when used by S3 client is per client and
scheduling groups.
Which eventually means that we will do a set_system_trust + "cold" handshake
for every tls connection created this way.
This will cause both IO and cold/expensive certificate checking -> possible
stalls/wasted CPU. Since the credentials object in question is literally a
"just trust system", it could very well be shared across the shard.
This PR adds a thread local static cached credentials object and uses this
instead. Could consider moving this to seastar, but maybe this is too much.
Closes scylladb/scylladb#24448
(cherry picked from commit 80feb8b676)
Closes scylladb/scylladb#24461
21 lines
643 B
C++
21 lines
643 B
C++
/*
|
|
* SPDX-License-Identifier: LicenseRef-ScyllaDB-Source-Available-1.0
|
|
*/
|
|
|
|
/*
|
|
* Copyright (C) 2025-present ScyllaDB
|
|
*/
|
|
|
|
#include "http.hh"
|
|
|
|
future<shared_ptr<tls::certificate_credentials>> utils::http::dns_connection_factory::system_trust_credentials() {
|
|
static shared_ptr<tls::certificate_credentials> system_trust_credentials;
|
|
if (!system_trust_credentials) {
|
|
// can race, and overwrite the object. that is fine.
|
|
auto cred = make_shared<tls::certificate_credentials>();
|
|
co_await cred->set_system_trust();
|
|
system_trust_credentials = std::move(cred);
|
|
}
|
|
co_return system_trust_credentials;
|
|
}
|