Multi-threading support with object pool #7
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains a potential fix for issue #2.
In short,
CertServer
property in CertPolicyBase and CertExitBase is not thread-safe and it appears thatVerifyRequest
andNotify
methods are called by CA asynchronously, which results in exception and CA service crash.I've expressed my concerns about possible fixes that would:
This PR comes with a object pool of
CertServerModule
instances. The idea is inspired by Microsoft CLM policy module. Pool size is fixed and have some limits. Upper size limit is 63. At any given time, no more than 63 threads (or requests) can be processed in parallel. If there are more parallel calls, they are put in queue until any currently running thread finish. Entire pool is pre-created during policy module initialization, so extra resources are allocated only once.I think it should greatly improve policy module performance over single-threded (with locks on single
CertServerModule
instance). However, due to the way how previous approach was implemented, it is not possible to fix race condition issue without introducing breaking change. These changes include:CertPolicyBase.VerifyRequest(String, Int32, Int32, Int32)
andCertExitBase.Notify(ExitEvents, Int32)
methods (that implement required interface) are no longer virtual and do not allow override.CertPolicyBase.VerifyRequest(CertServerModule, PolicyModuleAction, Boolean)
andCertExitBase.Notify(CertServerModule, ExitEvents, Int32)
respectively, where first parameter provides a thread-safe instance ofCertServerModule
.This framework automatically acquire (and wait if necessary) and return object to the pool.