crypto/x509: defer directory scan when cert bundle provides roots - #80374
crypto/x509: defer directory scan when cert bundle provides roots#80374trivenay wants to merge 1 commit into
Conversation
|
This PR (HEAD: f0a370b) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
|
Message from Gopher Robot: Patch Set 1: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Gopher Robot: Patch Set 1: Congratulations on opening your first change. Thank you for your contribution! Next steps: Most changes in the Go project go through a few rounds of revision. This can be During May-July and Nov-Jan the Go project is in a code freeze, during which Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Naman Trivedi: Patch Set 4: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
f0a370b to
0d07e45
Compare
|
This PR (HEAD: 0d07e45) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
0d07e45 to
da3a3d8
Compare
|
This PR (HEAD: da3a3d8) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
| for _, fi := range fis { | ||
| data, err := os.ReadFile(directory + "/" + fi.Name()) | ||
| if err == nil { | ||
| s.AppendCertsFromPEM(data) |
There was a problem hiding this comment.
This mutates byName, haveSum, and lazyCerts while other goroutines may concurrently read them in findPotentialParents. sync.Once only serializes directory loading; it does not protect those readers, so concurrent certificate verification can race here.
1e6e3f4 to
1942513
Compare
|
This PR (HEAD: 1942513) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
ecdf513 to
881b86d
Compare
|
This PR (HEAD: 881b86d) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
881b86d to
eaf3483
Compare
|
This PR (HEAD: eaf3483) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
6aebe89 to
d79b794
Compare
|
This PR (HEAD: d79b794) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
d79b794 to
2fedffa
Compare
|
This PR (HEAD: 2fedffa) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
2fedffa to
2d61d29
Compare
|
This PR (HEAD: 2d61d29) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
2d61d29 to
fb07c68
Compare
|
This PR (HEAD: fb07c68) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
fb07c68 to
c0a16aa
Compare
|
This PR (HEAD: c0a16aa) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
|
Message from Naman Trivedi: Patch Set 15: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Emmanuel Odeke: Patch Set 15: Commit-Queue+1 (4 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com: Patch Set 15: Dry run: CV is trying the patch. Bot data: {"action":"start","triggered_at":"2026-08-03T19:50:50Z","revision":"e3328fd7164d59dea0570f5d2b3b3d24bd781524"} Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Emmanuel Odeke: Patch Set 15: -Commit-Queue (Performed by <GERRIT_ACCOUNT_60063> on behalf of <GERRIT_ACCOUNT_5137>) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com: Patch Set 15: This CL has passed the run Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com: Patch Set 15: LUCI-TryBot-Result+1 Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
c0a16aa to
86e7c64
Compare
|
This PR (HEAD: 86e7c64) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
|
Message from Naman Trivedi: Patch Set 15: (5 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Emmanuel Odeke: Patch Set 16: Commit-Queue+1 Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com: Patch Set 16: Dry run: CV is trying the patch. Bot data: {"action":"start","triggered_at":"2026-08-03T22:25:03Z","revision":"88445aeb0b7e1c951eb551f3040249afe492effb"} Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Emmanuel Odeke: Patch Set 16: -Commit-Queue (Performed by <GERRIT_ACCOUNT_60063> on behalf of <GERRIT_ACCOUNT_5137>) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com: Patch Set 16: This CL has passed the run Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com: Patch Set 16: LUCI-TryBot-Result+1 Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Naman Trivedi: Patch Set 16: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Daniel McCarney: Patch Set 16: (6 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
|
Message from Naman Trivedi: Patch Set 16: (5 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
86e7c64 to
4912a90
Compare
|
This PR (HEAD: 4912a90) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
On systems where a cert bundle file (e.g. /etc/ssl/certs/ca-certificates.crt) is available and contains root certificates, skip eagerly scanning the default cert directories. On most systems the bundle is a concatenation of the individual certificates in the directory, so scanning reads the same certificates again redundantly. The deferred directories are stored on the CertPool and loaded on demand if a certificate lookup misses during verification. This ensures backward compatibility for setups where a directory contains certificates not present in the bundle. When SSL_CERT_DIR is explicitly set by the user, directories are always scanned eagerly, as the user may be intentionally combining certificates from multiple sources. On Fedora, RHEL, and Amazon Linux 2023 systems, /etc/ssl/certs/ contains ~430-750 entries. After the existing same-directory symlink filter, ~150-253 individual files remain. Reading and parsing these on a CPU-constrained environment (e.g. 128MB AWS Lambda with 0.08 vCPU) costs ~820ms and produces zero new certificates beyond what the bundle already provides. Benchmark on AWS Lambda (128MB, provided.al2023): Before: first TLS call takes ~1510ms After: first TLS call takes ~398ms (74% reduction) The optimization also benefits standard Fedora/RHEL systems: Fedora 39: directory scan reduced from ~11ms to 0ms Amazon Linux 2023: directory scan reduced from ~9ms to 0ms Fixes golang#38869 Updates golang#74613
4912a90 to
2ef4e90
Compare
|
This PR (HEAD: 2ef4e90) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/go/+/799801. Important tips:
|
|
Message from Naman Trivedi: Patch Set 16: (5 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/799801. |
On systems where a cert bundle file (e.g. ca-certificates.crt) is
available and contains root certificates, skip eagerly scanning the
default cert directories. On most systems the bundle is a concatenation
of the individual certificates in the directory, so scanning reads the
same certificates again redundantly.
The deferred directories are stored on the CertPool and loaded on
demand if chain construction using the bundle roots fails. This ensures
backward compatibility for setups where a directory contains
certificates not present in the bundle.
When SSL_CERT_DIR is explicitly set by the user, directories are always
scanned eagerly, as the user may be intentionally combining certificates
from multiple sources.
On Fedora, RHEL, and Amazon Linux 2023 systems, /etc/ssl/certs/
contains 430-750 entries. After the existing same-directory symlink
filter, 150-253 individual files remain. Reading and parsing these on a
CPU-constrained environment (e.g. 128MB container with 0.08 vCPU) costs
~820ms and produces zero new certificates beyond what the bundle already
provides.
On standard Fedora/RHEL systems with full CPU:
Cert loading time reduced from ~12ms to ~3ms
On CPU-constrained systems (e.g. 128MB container with 0.08 vCPU):
Amazon Linux 2023: ~1510ms before, ~398ms after
Updates #38869
Updates #74613