Re: NSS non-blocking mode and long computations

2009-10-22 Thread Ambroz Bizjak
On Oct 22, 10:32 pm, Wan-Teh Chang wrote: > I'm wondering if your server is spending some of the 100 ms in > checking the revocation status of the client certificate.  Did > you enable OCSP checking? No, haven't configured any OCSP server. I went through the handshake with a debugger and found th

Re: NSS non-blocking mode and long computations

2009-10-22 Thread Wan-Teh Chang
On Thu, Oct 22, 2009 at 12:09 PM, Ambroz Bizjak wrote: > > My program is acting as a server which requires client authentication. I'm wondering if your server is spending some of the 100 ms in checking the revocation status of the client certificate. Did you enable OCSP checking? Wan-Teh -- de

Re: Error 126 : NSS_Initialize Failed While adding certificate using certutil

2009-10-22 Thread Nelson B Bolyard
On 2009-10-20 21:11 PDT, ashwani saxena wrote: > The objective is to build latest NSS/ NSPR/c-SDK so that "certutil" > command can be used to create cert8.db file to add certificate into > that. I built the following modules using MozillaBuild 1.4 on Windows > platform. > > 1.Drectory - c-sdk - m

Re: NSS non-blocking mode and long computations

2009-10-22 Thread Ambroz Bizjak
On Oct 22, 7:22 pm, Nelson B Bolyard wrote: > What kind of system? What CPU? What clock speed? What memory speed? > > Are you doing client authentication with a client certificate? > Are you using Diffie-Hellman Ephemeral cipher suites? > 100ms is indeed a long time if you're not. The system is

Re: NSS non-blocking mode and long computations

2009-10-22 Thread Ian G
On 22/10/2009 19:22, Nelson B Bolyard wrote: As my program is single-threaded (built on a reactor), A reactor? What's that? http://en.wikipedia.org/wiki/Reactor_pattern (nuclear? :) more like a substation :) iang -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org http

Re: How to "log out" of SDR?

2009-10-22 Thread Nelson B Bolyard
On 2009-10-22 07:59 PDT, Neil wrote: > Neil wrote: > >> Neil wrote: >> >>> I also notice that checkPassword(""); logs out if there was a >>> password. Can this behaviour be relied on, or should I call >>> logoutSimple() too? >> To answer my own question, nsPK11Token::CheckPassword calls >> PK11

Re: NSS non-blocking mode and long computations

2009-10-22 Thread Nelson B Bolyard
On 2009-10-22 05:50 PDT, Ambroz Bizjak wrote: > Hi, > I'm using NSS in non-blocking mode. To perform a handshake on a SSL > socket, I use SSL_ForceHandshake (if it returns PR_WOULD_BLOCK_ERROR I > retry when the SSL socket becomes readable). It works, but I've > noticed that SSL_ForceHandshake some

Re: How to "log out" of SDR?

2009-10-22 Thread Neil
Neil wrote: Neil wrote: I also notice that checkPassword(""); logs out if there was a password. Can this behaviour be relied on, or should I call logoutSimple() too? To answer my own question, nsPK11Token::CheckPassword calls PK11_CheckUserPassword which is documented as logging out if the

NSS non-blocking mode and long computations

2009-10-22 Thread Ambroz Bizjak
Hi, I'm using NSS in non-blocking mode. To perform a handshake on a SSL socket, I use SSL_ForceHandshake (if it returns PR_WOULD_BLOCK_ERROR I retry when the SSL socket becomes readable). It works, but I've noticed that SSL_ForceHandshake sometimes takes a long time to return (around 100 ms). I sup