Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable use of async for the KMIP signer? #684

Open
ximon18 opened this issue Oct 6, 2021 · 2 comments
Open

Enable use of async for the KMIP signer? #684

ximon18 opened this issue Oct 6, 2021 · 2 comments
Labels
hsm Relates to adding HSM support to Krill

Comments

@ximon18
Copy link
Member

ximon18 commented Oct 6, 2021

In the walking skeleton while the functional test is running and Krill is configured to use only KMIP with a local PyKMIP server, the Krill UI and API are unresponsive (though the metrics endpoint responds just fine).

As the KMIP signer makes sends requests to the erver via TCP+TLS it may benefit from using async Rust code instead of sync Rust code, so Krill via its Tokio framework can be busy doing something else instead of one or more of its threads being stuck waiting for the request to be sent to and the response to be received from the HSM.

However, there are a couple of problems with this:

  1. This won't help PKCS#11 signers for which the backend is actually not local but remote but this is abstracted away by the PKCS#11 library that is loaded. The Rust PKCS#11 craqte (https://crates.io/crates/pkcs11/) that I used for the Krill HSM prototype work does not support async and i wonder whether the PKCS#11 interface even makes it possible to support async as a function like C_GenerateKeyPair has no async counterpart that I can see and so the client code is forced to wait for completion of the call. One could place the functiona calls via the PKCS#11 interface in a separate thread to prevent blocking the main Tokio async handling threads perhaps.

  2. The Signer trait is sync only and Krill both uses it and depends on it because it calls rpki-rs crate functions which take Signer arguments as input.

@ximon18 ximon18 added the hsm Relates to adding HSM support to Krill label Oct 6, 2021
@ximon18
Copy link
Member Author

ximon18 commented Oct 6, 2021

See: NLnetLabs/rpki-rs#161

@timbru
Copy link
Contributor

timbru commented Dec 6, 2021

We should also review the code and see if there are things that could be batched for background processing instead, so that users don't need to wait - especially wrt PKCS#11 which may mean that certain thing just cannot be done as async.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
hsm Relates to adding HSM support to Krill
Projects
Development

No branches or pull requests

2 participants