Following on from Have a good REST and save a fortune in CPU. The post gives some guidance on reducing the costs of using Liberty based servers from a Python program.
Certificate set up
I used certificate authentication from Linux to z/OS. I used
- A certificate defined on Linux using Openssl.
- I sent the Linux CA certificate to z/OS and imported it to the TRUST keyring.
- I created a certificate on z/OS and installed it into the KEY keyring.
- I exported the z/OS CA, sent it to Linux, and created a file called tempca.pem.
Python set up
Define the names of the user certificate private key, and certificate
cf=”colinpaicesECp256r1.pem”
kf=”colinpaicesECp256r1.key.pem”
cpcert=(cf,kf)
Define the name of the certificate for validating the server’s certificate
v=’tempca.pem’
Set up a cookie jar to hold the cookies sent down from the server
jar = requests.cookies.RequestsCookieJar()
Define the URL and request
Define the headers
import base64
useridPassword = base64.b64encode(b’colin:passworm’)
my_header = {
‘Content-Type’: ‘application/json’,
‘Authorization’: useridPassword,
‘ibm-mq-rest-csrf-token’ : ‘ ‘
}
An example flow of two requests, using two connections
For example using python
s = requests
response1 = s.get(geturl,headers=my_header,verify=v,cookies=jar,cert=cpcert)
response2 = s.get(geturl,headers=my_header,verify=v,cookies=jar,cert=cpcert)
creates two session, each has a TLS handshake, issue a request, get a response and end.
An example of two requests using one session
For example using python
s = requests.Session()
response1 = s.get(geturl,headers=my_header,verify=v,cookies=jar,cert=cpcert1)
response2 = s.get(geturl,headers=my_header,verify=v,cookies=jar,cert=cpcert2)
The initial request has one expensive TLS handshake, the second request reuses the session.
Reusing this session means there was only one expensive Client Hello,Server Hello exchange for the whole conversation.
Even though the second request specified a different set of certificates, the certificates from when the session was established, using cpcert1 were used. (No surprise here as the certificates are only used when the session is established).
For the authentication, in both cases the first requests received a cookie with the LtpaToken2 cookie in it.
When this was passed up on successive requests, the userid information from the first request was used.
What is the difference?
I ran a workload of a single thread doing 200 requests. The ratios are important, not the absolute values.
| Shared session | One session per requests | |
| TCP flows to server | 1 | 11 |
| CPU cost | 1 | 5 |
| Elapsed time | 1 | 6 |
ColinPaice 