Re:Shutting down FTP services
by comex on Saturday January 28, 2017 @10:18PM
(#13511752)
Unfortunately, these days crypto really is a mandatory feature, and sendfile doesn't work with TLS anyway. (IMO it should - secure communication should be an OS-level service rather than requiring each application to figure it out, just like the OS provides TCP rather than requiring each application to implement reliable connections - but that's another story.)
[ Parent
| on HN ]
Hmmm. sendfile is great because it lets the kernel arrange for DMA straight from disk to the network card, in addition to bypassing context switches and copies to and from userspace buffers. If the kernel gains an SSL stack (the encrypted version of the file is going to be different for each connection), you can't DMA and you'll need to make copies into kernelspace buffers to do the encryption on. Is skipping the context switch enough to make a meaningful performance different?
Yes. And I believe Solaris was the first to discover this. Here's a paper Netflix put out covering their first attempt. Measurable gains, hopefully more coming in the future.
https://openconnect.netflix.com/publications/asiabsd_2015_tl...
edit: check this post first
If you do it that way you could add hardware encryption support to the network card and be back to using DMA.
Oh, that's fascinating and awesome! Thanks for the links.
> Is skipping the context switch enough to make a meaningful performance different?
Only in (very) high-bandwidth cases and (maybe!) for low-power cases. For most things it's just added complexity for no benefit.