Nginx QAT

README.md

@@ -39,6 +39,8 @@ We aim to provide a dynamic resource where users can find the latest optimizatio
   - [Java](software/java/README.md)
   - [Kafka](software/kafka/README.md)
   - [MySQL & PostgreSQL](software/mysql-postgresql/README.md)
+  - [NGINX](software/nginx/README.md)
+      - [NGINX QAT](software/nginx/QAT/README.md)
   - [NumPy](software/numpy/README.md)
   - [R (Rlang / Rstats)](software/R/README.md)
   - [scikit-learn](software/scikit-learn/README.md)

software/nginx/QAT/supporting_files/connection_test.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# For use with intel/asynch_mode_nginx, which is licensed under the
+# BSD 3-Clause License.
+# See https://github.com/intel/asynch_mode_nginx/blob/master/LICENSE
+
+######################################
+############# USER INPUT #############
+######################################
+ip_address="$1"
+_time=10
+clients=200
+port=443
+cipher=AES128-SHA
+######################################
+############# USER INPUT #############
+######################################
+
+helpAndError () {
+        echo "This script is used to run the ConnectionsPerSecond(CPS) testing HTTPS."
+        echo "To use this script: ./connection_test.sh <ip_address>"
+        echo "To do a dry-run, use the emulation flag:"
+        echo "./connection_test.sh <ip_address> --emulation"
+        exit 0
+}
+
+# Check for h flag or no command line args
+if [[ -z $ip_address || $@ == *-h* || $@ == *--help* ]]; then
+        helpAndError
+fi
+
+# Check for emulation flag
+emulation=0
+if [[ $@ == **emulation** ]]
+then
+        emulation=1
+
+fi
+
+# cmd1 is the first part of the commandline and cmd2 is the second part
+# The total commandline will be cmd1 + $ip_address:$port + cmd2
+cmd1="openssl s_time -connect"
+cmd2="-new -cipher $cipher -time $_time"
+
+# Print out variables to check
+printf " IP Addresses:                  $ip_address\n"
+printf " Time:                          $_time\n"
+printf " Clients:                       $clients\n"
+printf " Port:                          $port\n"
+printf " Cipher:                        $cipher\n"
+
+# Remove previous .test files
+rm -rf ./.test_*
+
+# Get starttime
+starttime=$(date +%s)
+
+# Kick off the tests after checking for emulation
+if [[ $emulation -eq 1 ]]
+then
+        for (( i = 0; i < ${clients}; i++ )); do
+                printf "$cmd1 $ip_address:$(($port)) $cmd2 > .test_$(($port))_$i &\n"
+        done
+        exit 0
+else
+        for (( i = 0; i < ${clients}; i++ )); do
+        $cmd1 $ip_address:$(($port)) $cmd2 > .test_$(($port))_$i &
+        done
+fi
+
+waitstarttime=$(date +%s)
+
+# wait until all processes complete
+# The clients are child processes of this script, so wait returns once every
+# one of them has exited.
+wait
+
+sumTotal=$(cat ./.test_$(($port))* | awk '(/^[0-9]* connections in [0-9]* real/){ total += $1/$4 } END {print total}')
+printf "Connections per second:      $sumTotal CPS\n"
+printf "Finished in %d seconds (%d seconds waiting for procs to start)\n" $(($(date +%s) - $starttime)) $(($waitstarttime - $starttime))
+rm -rf ./.test_*
+

software/nginx/QAT/supporting_files/nginx_with_qat.conf

@@ -0,0 +1,66 @@
+# Based on the configuration samples in intel/asynch_mode_nginx, which is
+# licensed under the BSD 3-Clause License.
+# See https://github.com/intel/asynch_mode_nginx/blob/master/LICENSE
+
+# NGINX.CONF with QAT (for GNR with QAT test case)
+
+worker_processes  48;
+error_log  logs/error.log;
+pid        logs/nginx.pid;
+worker_rlimit_nofile 102400;
+
+load_module modules/ngx_http_qatzip_filter_module.so;
+load_module modules/ngx_ssl_engine_qat_module.so;
+
+events {
+    use epoll;
+    worker_connections 102400;
+    accept_mutex off;
+}
+
+# Enable QAT engine in heuristic mode.
+ssl_engine {
+    use_engine qatengine;
+    default_algorithms ALL;
+    #default_algorithms RSA,EC,DH,DSA;
+    qat_engine {
+        qat_offload_mode async;
+        qat_notify_mode poll;
+        qat_poll_mode heuristic;
+        qat_sw_fallback off;
+    }
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    gzip on;
+    gzip_min_length     128;
+    gzip_comp_level     1;
+    gzip_types  text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+    gzip_vary            on;
+    gzip_disable        "msie6";
+    gzip_http_version   1.0;
+
+    qatzip_sw failover;
+    qatzip_min_length 128;
+    qatzip_comp_level 9;
+    qatzip_buffers 16 8k;
+    qatzip_types text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml application/octet-stream image/jpeg;
+    qatzip_chunk_size   64k;
+    qatzip_stream_size  256k;
+    qatzip_sw_threshold 256;
+
+# HTTPS server
+    #
+    server {
+        listen       443 ssl asynch;
+        server_name  localhost;
+
+        ssl_protocols       TLSv1.2;
+
+        ssl_certificate      /usr/local/nginx_qat_module/certs/server.crt;
+        ssl_certificate_key  /usr/local/nginx_qat_module/certs/server.key;
+        access_log off;
+    }
+}

software/nginx/QAT/supporting_files/nginx_without_qat.conf

@@ -0,0 +1,44 @@
+# Based on the configuration samples in intel/asynch_mode_nginx, which is
+# licensed under the BSD 3-Clause License.
+# See https://github.com/intel/asynch_mode_nginx/blob/master/LICENSE
+
+worker_processes  48;
+error_log  logs/error.log;
+pid        logs/nginx.pid;
+worker_rlimit_nofile 102400;
+
+#load_module modules/ngx_http_qatzip_filter_module.so;
+#load_module modules/ngx_ssl_engine_qat_module.so;
+
+events {
+    use epoll;
+    worker_connections 102400;
+    accept_mutex off;
+}
+
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    gzip on;
+    gzip_min_length     128;
+    gzip_comp_level     1;
+    gzip_types  text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
+    gzip_vary            on;
+    gzip_disable        "msie6";
+    gzip_http_version   1.0;
+
+
+# HTTPS server
+    #
+    server {
+        listen       443 ssl asynch;
+        server_name  localhost;
+
+        ssl_protocols       TLSv1.2;
+
+        ssl_certificate      /usr/local/nginx_qat_module/certs/server.crt;
+        ssl_certificate_key  /usr/local/nginx_qat_module/certs/server.key;
+        access_log off;
+    }
+}

software/nginx/README.md

@@ -0,0 +1,17 @@
+# NGINX Optimization Guides
+
+This section contains optimization guides for [NGINX](https://nginx.org/) on Intel hardware.
+
+NGINX is the world's most popular webserver.  It is free and open source software, distributed under the terms of a simplified 2-clause BSD-like license.  Because a web tier spends much of its time on TLS handshakes and on compressing responses, it benefits from offloading that cryptography and compression work off the CPU cores and onto dedicated accelerators.
+
+## Available Guides
+
+| Guide | Description |
+| --- | --- |
+| [NGINX with Intel® QAT](QAT/README.md) | Offload TLS handshake cryptography and compression to Intel® QuickAssist Technology (Intel® QAT) using async-mode-nginx, including hardware and software prerequisites, configuration, and Connections Per Second (CPS) benchmark results. |
+
+## References
+
+asynch_mode_nginx: https://github.com/intel/asynch_mode_nginx
+
+NGINX: https://nginx.org/