From 561eebe170d02047e92141fa04b70313beb2ac0b Mon Sep 17 00:00:00 2001
From: Amber Brown <hawkowl@atleastfornow.net>
Date: Tue, 19 Feb 2019 16:18:05 +1100
Subject: [PATCH 1/3] fix to use makeContext so that we don't need to rebuild
 the certificateoptions each time

---
 synapse/crypto/context_factory.py | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py
index 85f2848fb..49cbc7098 100644
--- a/synapse/crypto/context_factory.py
+++ b/synapse/crypto/context_factory.py
@@ -1,4 +1,5 @@
 # Copyright 2014-2016 OpenMarket Ltd
+# Copyright 2019 New Vector Ltd
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
 import logging
 
 from zope.interface import implementer
@@ -105,9 +107,7 @@ class ClientTLSOptions(object):
             self._hostnameBytes = _idnaBytes(hostname)
             self._sendSNI = True
 
-        ctx.set_info_callback(
-            _tolerateErrors(self._identityVerifyingInfoCallback)
-        )
+        ctx.set_info_callback(_tolerateErrors(self._identityVerifyingInfoCallback))
 
     def clientConnectionForTLS(self, tlsProtocol):
         context = self._ctx
@@ -128,10 +128,8 @@ class ClientTLSOptionsFactory(object):
 
     def __init__(self, config):
         # We don't use config options yet
-        pass
+        self._options = CertificateOptions(verify=False)
 
     def get_options(self, host):
-        return ClientTLSOptions(
-            host,
-            CertificateOptions(verify=False).getContext()
-        )
+        # Use _makeContext so that we get a fresh OpenSSL CTX each time.
+        return ClientTLSOptions(host, self._options._makeContext())

From 2b2466f78bafe1d7083d32f1495f20746159b470 Mon Sep 17 00:00:00 2001
From: Amber Brown <hawkowl@atleastfornow.net>
Date: Tue, 19 Feb 2019 16:18:48 +1100
Subject: [PATCH 2/3] changelog

---
 changelog.d/4674.misc | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/4674.misc

diff --git a/changelog.d/4674.misc b/changelog.d/4674.misc
new file mode 100644
index 000000000..84630bb20
--- /dev/null
+++ b/changelog.d/4674.misc
@@ -0,0 +1 @@
+Reduce the overhead of creating outbound federation connections over TLS by caching the TLS client options.

From 107aeb6915927a4278290dd3bdc5e01497a0dce0 Mon Sep 17 00:00:00 2001
From: Richard van der Hoff <richard@matrix.org>
Date: Tue, 19 Feb 2019 10:18:48 +0000
Subject: [PATCH 3/3] misc->feature

---
 changelog.d/{4674.misc => 4674.feature} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename changelog.d/{4674.misc => 4674.feature} (100%)

diff --git a/changelog.d/4674.misc b/changelog.d/4674.feature
similarity index 100%
rename from changelog.d/4674.misc
rename to changelog.d/4674.feature