TLS Connect/Disconnect Performance Boost With WolfSSL

I was able to get a (seemingly) significant TLS connect/disconnect performance boost with WolfSSL on non-x86 64bit platforms/compiler combinations.

Here are the numbers, in seconds per 100 localhost connect/disconnects:

• before: 4.501205
• after: 1.308058

That’s 3x+!

From a 2-line change!

What Did I Change?

WolfSSL’s Wolfcrypt library has certain optimizations for various modern platforms. More specifically, it has certain big number operations implemented to make use of compiler support for _uint128_t. It tried to detect that using various configure techniques and falls back to the most portable, but least optimized code that runs on all platforms. Note that this is not even using the assembler versions of these routines! Just plain old C optimizations. The two files are using mutually exclusive #ifdefs that will turn this or the other code on, depending on the support found.

FWIW, I’ve found the diff between these two files very entertaining!

The MariaDB server needs to compile the library with cmake. And this is not entirely supported by WolfSSL, at least not to the extent needed. Thus, we run our own WolfSSL configuration substrate. And that was missing a check for _uint128_t! So the generic code was used. After adding the appropriate check, the compilation started using the optimized code.

Here’s How I’ve Tested

I did some performance testing on the main MariaDB server branch as follows:

• Got a fresh main tree
• Compiled in a before directory with cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DENABLE_GCOV=OFF -DCMAKE_C_FLAGS=-fno-color-diagnostics -DCMAKE_CXX_FLAGS=-fno-color-diagnostics -DCMAKE_COLOR_MAKEFILE=OFF -DCMAKE_VERBOSE_MAKEFILE=OFF -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DMYSQL_MAINTAINER_MODE=OFF -DPLUGIN_ARCHIVE=NO -DPLUGIN_MROONGA=NO -DPLUGIN_CONNECT=NO -DPLUGIN_SPIDER=NO -DPLUGIN_ROCKSDB=NO -DPLUGIN_OQGRAPH=NO -DPLUGIN_TOKUDB=NO -DWITH_ASAN=OFF -DWITH_MSAN=OFF -DWITH_UBSAN=OFF -DWITH_SAFEMALLOC=ON -DWITH_MARIABACKUP=ON -DWITH_EMBEDDED_SERVER=OFF -DWITH_UNIT_TESTS=OFF -DWITH_WSREP=OFF -DWITHOUT_DYNAMIC_PLUGINS=0 -DWITH_SSL=bundled -DWITH_PCRE=bundled -DWITH_GENERATED_DOCS=yes -DPLUGIN_HANDLERSOCKET=NO -DWITH_ZLIB=bundled
• Applied my path (see the jira)
• Compiled with the same flags in an after directory
• Initialized the server in both directories with mysql_install_db using the same arguments
• Created a user account for my testing in both before and after as follows:
  create user u1@localhost identified by 'u1' require SSL;
• Compiled the following test driver against libmariadb:

#include <stdio.h>
#include <stdlib.h>
#include <sys/time.h>
#include <mysql.h>

double get_time(void) {
    struct timeval tv;
    gettimeofday(&tv, NULL);
    return tv.tv_sec + tv.tv_usec / 1000000.0;
}

int main(void) {
    MYSQL *dbh;
    double start = get_time();

    for (int i = 0; i < 100; i++) {
        dbh = mysql_init(NULL);
        if (!dbh) {
            fprintf(stderr, "mysql_init failed\n");
            return 1;
        }


        /* Enable SSL (required) */
        if(mysql_ssl_set(dbh, NULL, NULL, NULL,
		  NULL, NULL) != 0) {
            fprintf(stderr, "mysql_options(SSL) failed\n");
            mysql_close(dbh);
            return 1;
        }
        if (!mysql_real_connect(dbh,
                                "127.0.0.1",
                                "u1",
                                "u1",
                                NULL,          /* database name */
                                20202,
                                NULL,          /* unix socket */
                                0)) {          /* client flags */
            fprintf(stderr, "connect failed: %s\n", mysql_error(dbh));
            mysql_close(dbh);
            return 1;
        }

        mysql_close(dbh);
    }

    printf("%.6f\n", get_time() - start);
    return 0;
}

• Run against the before and after servers (same TCP port 20202), got:
  • before: 4.501205
  • after: 1.308058

This is on the following computer:

$system_profiler SPHardwareDataType
Hardware:

    Hardware Overview:

      Model Name: MacBook Pro
      Model Identifier: Mac16,8
      Model Number: MX2J3D/A
      Chip: Apple M4 Pro
      Total Number of Cores: 14 (10 Performance and 4 Efficiency)
      Memory: 24 GB
      System Firmware Version: 20457.41.3
      OS Loader Version: 20457.41.3
$sw_vers
ProductName: macOS
ProductVersion: 27.2.1
BuildVersion: 26B131
$cc --version
Apple clang version 21.0.0 (clang-2100.4.1.1)
Target: arm64-apple-darwin27.2.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin

Note that this has only been seen on Apple Silicon based MacOSX. On that platform wolfSSL is compiled without assembly optimizations.

Conclusion

Sometimes, significant performance improvements come from surprisingly small changes. By enabling an existing WolfSSL optimization through a simple configuration fix, I reduced TLS connection and disconnection time by more than 3x in my tests on Apple Silicon.

While these results are currently limited to this platform, they highlight the importance of making sure underlying libraries take full advantage of the hardware they run on.

It’s another reminder that improving MariaDB Server performance isn’t always about major architectural changes. Sometimes, just two lines can make a big difference!

Thank you for using MariaDB!