Do not sign every request for streaming RPC with safe endpoints #942

New Issue

Open

opened 2024-01-30 11:50:49 +00:00 by fyrchik · 3 comments

fyrchik commented

2024-01-30 11:50:49 +00:00

Owner

If we connect to some endpoint with TLS enabled, there is no need to authenticate every single message.
This works for both client- and server-side streams.

For example, in tree.GetChildren or object.Search the amount of responses scales linearly with the number of objects in container. Signing and verification introduce latency on each operations in stream, which could contribute a noticeable value to the total operation cost.

However, if TLS is enabled, then we could authenticate once (should be easy, but not trivial, think about replay attacks). Even disabling signature checking in trusted environment (localhost endpoint) can provide benefits, as the setup with s3/node being on one physical server is common.

Ideally, we could somehow extract FrostFS identity from the client certificate, but this is much more intrusive.

If we connect to some endpoint with TLS enabled, there is no need to authenticate every single message. This works for both client- and server-side streams. For example, in `tree.GetChildren` or `object.Search` the amount of responses scales linearly with the number of objects in container. Signing and verification introduce latency on each operations in stream, which could contribute a noticeable value to the total operation cost. However, if TLS is enabled, then we could authenticate once (should be easy, but not trivial, think about replay attacks). Even disabling signature checking in trusted environment (localhost endpoint) can provide benefits, as the setup with s3/node being on one physical server is common. Ideally, we could somehow extract FrostFS identity from the client certificate, but this is much more intrusive.

fyrchik added the

discussion

frostfs-node

perfomance

labels 2024-01-30 11:50:49 +00:00

fyrchik commented

2024-01-30 11:54:09 +00:00

Poster

Owner

tree.GetOpLog is another useful case, which can speed up tree synchronization.

`tree.GetOpLog` is another useful case, which can speed up tree synchronization.

fyrchik commented

2024-01-31 14:22:46 +00:00

Poster

Owner

Another option is to make client responsible for disabling signatures
Though this won't work for client-side streams.

Another option is to make client responsible for disabling signatures Though this won't work for client-side streams.

realloc commented

2024-02-08 17:57:33 +00:00

Owner

We could also significantly reduce CPU load by avoiding the need to sign each request-response in a series of HEAD requests during replication from the same node in the same TLS connection.

fyrchik added this to the vNext milestone 2024-02-12 06:24:33 +00:00