TLS support in vbench

- vbench/dumpurl applications explicitly run without encryption for
  now (config file/command line options should be added).

- configstatus tool uses default encryption which will pick up local
  settings via environment where applicable.

21 files changed, 109 insertions, 80 deletions

diff --git a/vbench/src/apps/dumpurl/dumpurl.cpp b/vbench/src/apps/dumpurl/dumpurl.cpp
index b00a5a286b9..5a0c1ab8e2c 100644
--- a/vbench/src/apps/dumpurl/dumpurl.cpp
+++ b/vbench/src/apps/dumpurl/dumpurl.cpp
@@ -4,6 +4,7 @@
 #include <vbench/http/server_spec.h>
 #include <vbench/http/http_client.h>
 #include <vespa/fastos/app.h>
+#include <vespa/vespalib/net/crypto_engine.h>
 
 using namespace vbench;
 
@@ -33,8 +34,9 @@ App::Main()
         printf("usage: dumpurl <host> <port> <url>\n");
         return -1;
     }
+    auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
     MyHttpHandler myHandler;
-    bool ok = HttpClient::fetch(ServerSpec(_argv[1], atoi(_argv[2])), _argv[3], myHandler);
+    bool ok = HttpClient::fetch(*null_crypto, ServerSpec(_argv[1], atoi(_argv[2])), _argv[3], myHandler);
     return ok ? 0 : 1;
 }
 
diff --git a/vbench/src/tests/app_dumpurl/app_dumpurl_test.cpp b/vbench/src/tests/app_dumpurl/app_dumpurl_test.cpp
index ae37aface73..15453078b35 100644
--- a/vbench/src/tests/app_dumpurl/app_dumpurl_test.cpp
+++ b/vbench/src/tests/app_dumpurl/app_dumpurl_test.cpp
@@ -2,6 +2,7 @@
 #include <vespa/vespalib/testkit/testapp.h>
 #include <vbench/test/all.h>
 #include <vespa/vespalib/util/slaveproc.h>
+#include <vespa/vespalib/net/crypto_engine.h>
 
 using namespace vbench;
 using vespalib::SlaveProc;
@@ -9,6 +10,8 @@ using vespalib::SlaveProc;
 using InputReader = vespalib::InputReader;
 using OutputWriter = vespalib::OutputWriter;
 
+auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
+
 bool endsWith(const Memory &mem, const string &str) {
     return (mem.size < str.size()) ? false
         : (strncmp(mem.data + mem.size - str.size(), str.data(), str.size()) == 0);
@@ -34,7 +37,7 @@ TEST("dumpurl usage") {
 
 TEST_MT_F("run dumpurl", 2, ServerSocket()) {
     if (thread_id == 0) {
-        Stream::UP stream = f1.accept();
+        Stream::UP stream = f1.accept(*null_crypto);
         SimpleBuffer ignore;
         readUntil(*stream, ignore, "\r\n\r\n");
         OutputWriter out(*stream, 256);
diff --git a/vbench/src/tests/app_vbench/.gitignore b/vbench/src/tests/app_vbench/.gitignore
index 0f290bb76ac..37e7b548d05 100644
--- a/vbench/src/tests/app_vbench/.gitignore
+++ b/vbench/src/tests/app_vbench/.gitignore
@@ -1,3 +1,4 @@
+/vbench.cfg.template
 /vbench.cfg
 /vbench.out
 vbench_app_vbench_test_app
diff --git a/vbench/src/tests/app_vbench/CMakeLists.txt b/vbench/src/tests/app_vbench/CMakeLists.txt
index b5ce997c31a..b246fd2f1fd 100644
--- a/vbench/src/tests/app_vbench/CMakeLists.txt
+++ b/vbench/src/tests/app_vbench/CMakeLists.txt
@@ -7,4 +7,4 @@ vespa_add_executable(vbench_app_vbench_test_app TEST
     vbench
 )
 vespa_add_test(NAME vbench_app_vbench_test_app NO_VALGRIND COMMAND vbench_app_vbench_test_app)
-configure_file(vbench.cfg.template vbench.cfg @ONLY)
+configure_file(vbench.cfg.template.template vbench.cfg.template @ONLY)
diff --git a/vbench/src/tests/app_vbench/app_vbench_test.cpp b/vbench/src/tests/app_vbench/app_vbench_test.cpp
index 366fe4ce871..00645045fb3 100644
--- a/vbench/src/tests/app_vbench/app_vbench_test.cpp
+++ b/vbench/src/tests/app_vbench/app_vbench_test.cpp
@@ -2,6 +2,7 @@
 #include <vespa/vespalib/testkit/testapp.h>
 #include <vbench/test/all.h>
 #include <vespa/vespalib/util/slaveproc.h>
+#include <vespa/vespalib/net/crypto_engine.h>
 
 using namespace vbench;
 using vespalib::SlaveProc;
@@ -9,6 +10,8 @@ using vespalib::SlaveProc;
 using InputReader = vespalib::InputReader;
 using OutputWriter = vespalib::OutputWriter;
 
+auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
+
 bool endsWith(const Memory &mem, const string &str) {
     return (mem.size < str.size()) ? false
         : (strncmp(mem.data + mem.size - str.size(), str.data(), str.size()) == 0);
@@ -35,7 +38,7 @@ TEST("vbench usage") {
 TEST_MT_F("run vbench", 2, ServerSocket()) {
     if (thread_id == 0) {
         for (;;) {
-            Stream::UP stream = f1.accept();
+            Stream::UP stream = f1.accept(*null_crypto);
             if (stream.get() == 0) {
                 break;
             }
@@ -51,7 +54,7 @@ TEST_MT_F("run vbench", 2, ServerSocket()) {
         }
     } else {
         std::string out;
-        EXPECT_TRUE(SlaveProc::run(strfmt("sed -i 's/_LOCAL_PORT_/%d/' vbench.cfg", f1.port()).c_str()));
+        EXPECT_TRUE(SlaveProc::run(strfmt("sed 's/_LOCAL_PORT_/%d/' vbench.cfg.template > vbench.cfg", f1.port()).c_str()));
         EXPECT_TRUE(SlaveProc::run("../../apps/vbench/vbench_app run vbench.cfg 2> vbench.out", out));
         fprintf(stderr, "%s\n", out.c_str());
         f1.close();
diff --git a/vbench/src/tests/app_vbench/vbench.cfg.template b/vbench/src/tests/app_vbench/vbench.cfg.template.template
index 950d5151780..950d5151780 100644
--- a/vbench/src/tests/app_vbench/vbench.cfg.template
+++ b/vbench/src/tests/app_vbench/vbench.cfg.template.template
diff --git a/vbench/src/tests/http_client/http_client_test.cpp b/vbench/src/tests/http_client/http_client_test.cpp
index 36e1ca12110..36e04e012a0 100644
--- a/vbench/src/tests/http_client/http_client_test.cpp
+++ b/vbench/src/tests/http_client/http_client_test.cpp
@@ -1,12 +1,15 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 #include <vespa/vespalib/testkit/testapp.h>
 #include <vbench/test/all.h>
+#include <vespa/vespalib/net/crypto_engine.h>
 
 using namespace vbench;
 
 using InputReader = vespalib::InputReader;
 using OutputWriter = vespalib::OutputWriter;
 
+auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
+
 void checkMemory(const string &expect, const Memory &mem) {
     EXPECT_EQUAL(expect, string(mem.data, mem.size));
 }
@@ -41,20 +44,20 @@ TEST_MT_F("verify request", 2, ServerSocket()) {
             out.write("\r\n");
         }
         SimpleBuffer actual;
-        Stream::UP stream = f1.accept();
+        Stream::UP stream = f1.accept(*null_crypto);
         ASSERT_TRUE(stream.get() != 0);
         readUntil(*stream, actual, "\r\n\r\n");
         EXPECT_TRUE(expect == actual);
     } else {
         SimpleHttpResultHandler handler;
-        HttpClient::fetch(ServerSpec("localhost", f1.port()),
+        HttpClient::fetch(*null_crypto, ServerSpec("localhost", f1.port()),
                           "/this/is/the/url", handler);
     }
 }
 
 TEST_MT_F("verify connection close", 2, ServerSocket()) {
     if (thread_id == 0) {
-        Stream::UP stream = f1.accept();
+        Stream::UP stream = f1.accept(*null_crypto);
         SimpleBuffer ignore;
         readUntil(*stream, ignore, "\r\n\r\n");
         OutputWriter out(*stream, 256);
@@ -63,7 +66,7 @@ TEST_MT_F("verify connection close", 2, ServerSocket()) {
         out.write("data");
     } else {
         SimpleHttpResultHandler handler;
-        HttpClient::fetch(ServerSpec("localhost", f1.port()),
+        HttpClient::fetch(*null_crypto, ServerSpec("localhost", f1.port()),
                           "/foo", handler);
         EXPECT_EQUAL(0u, handler.failures().size());
         EXPECT_EQUAL(0u, handler.headers().size());
@@ -73,7 +76,7 @@ TEST_MT_F("verify connection close", 2, ServerSocket()) {
 
 TEST_MT_F("verify content length", 2, ServerSocket()) {
     if (thread_id == 0) {
-        Stream::UP stream = f1.accept();
+        Stream::UP stream = f1.accept(*null_crypto);
         SimpleBuffer ignore;
         readUntil(*stream, ignore, "\r\n\r\n");
         OutputWriter out(*stream, 256);
@@ -83,7 +86,7 @@ TEST_MT_F("verify content length", 2, ServerSocket()) {
         out.write("data");
     } else {
         SimpleHttpResultHandler handler;
-        HttpClient::fetch(ServerSpec("localhost", f1.port()),
+        HttpClient::fetch(*null_crypto, ServerSpec("localhost", f1.port()),
                           "/foo", handler);
         EXPECT_EQUAL(0u, handler.failures().size());
         EXPECT_EQUAL(1u, handler.headers().size());
@@ -93,7 +96,7 @@ TEST_MT_F("verify content length", 2, ServerSocket()) {
 
 TEST_MT_F("verify chunked encoding", 2, ServerSocket()) {
     if (thread_id == 0) {
-        Stream::UP stream = f1.accept();
+        Stream::UP stream = f1.accept(*null_crypto);
         SimpleBuffer ignore;
         readUntil(*stream, ignore, "\r\n\r\n");
         OutputWriter out(*stream, 256);
@@ -108,7 +111,7 @@ TEST_MT_F("verify chunked encoding", 2, ServerSocket()) {
         out.write("\r\n");
     } else {
         SimpleHttpResultHandler handler;
-        HttpClient::fetch(ServerSpec("localhost", f1.port()),
+        HttpClient::fetch(*null_crypto, ServerSpec("localhost", f1.port()),
                           "/foo", handler);
         if (handler.failures().size() > 0) {
             fprintf(stderr, "failure: %s\n", handler.failures()[0].c_str());
diff --git a/vbench/src/tests/http_connection/http_connection_test.cpp b/vbench/src/tests/http_connection/http_connection_test.cpp
index 0776c5e212c..e3044978b2b 100644
--- a/vbench/src/tests/http_connection/http_connection_test.cpp
+++ b/vbench/src/tests/http_connection/http_connection_test.cpp
@@ -1,13 +1,16 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 #include <vespa/vespalib/testkit/testapp.h>
 #include <vbench/test/all.h>
+#include <vespa/vespalib/net/crypto_engine.h>
 
 using namespace vbench;
 
+auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
+
 TEST("http connection") {
     ServerSocket serverSocket;
-    HttpConnection client(ServerSpec("localhost", serverSocket.port()));
-    Stream::UP server = serverSocket.accept();
+    HttpConnection client(*null_crypto, ServerSpec("localhost", serverSocket.port()));
+    Stream::UP server = serverSocket.accept(*null_crypto);
     EXPECT_TRUE(client.fresh());
     EXPECT_EQUAL("localhost", client.server().host);
     EXPECT_FALSE(client.mayReuse(0.1)); // still fresh
diff --git a/vbench/src/tests/http_connection_pool/http_connection_pool_test.cpp b/vbench/src/tests/http_connection_pool/http_connection_pool_test.cpp
index 1c36cb6891f..c0c5982d22b 100644
--- a/vbench/src/tests/http_connection_pool/http_connection_pool_test.cpp
+++ b/vbench/src/tests/http_connection_pool/http_connection_pool_test.cpp
@@ -2,17 +2,20 @@
 #include <vespa/vespalib/testkit/testapp.h>
 #include <vbench/test/all.h>
 #include <vespa/vespalib/util/sync.h>
+#include <vespa/vespalib/net/crypto_engine.h>
 
 using namespace vbench;
 using vespalib::CountDownLatch;
 
+auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
+
 TEST_MT_F("http connection pool", 2, ServerSocket()) {
     if (thread_id == 0) {
-        for (; f1.accept().get() != 0; ) {}
+        for (; f1.accept(*null_crypto).get() != 0; ) {}
     } else {
         Timer timer;
         HttpConnection::UP conn;
-        HttpConnectionPool pool(timer);
+        HttpConnectionPool pool(null_crypto, timer);
         conn = pool.getConnection(ServerSpec("localhost", f1.port()));
         EXPECT_TRUE(conn.get() != 0);
         pool.putConnection(std::move(conn));
@@ -28,11 +31,11 @@ TEST_MT_F("http connection pool", 2, ServerSocket()) {
     }
 }
 
-TEST_MT_FFFF("stress http connection pool", 256, ServerSocket(), Timer(), HttpConnectionPool(f2),
+TEST_MT_FFFF("stress http connection pool", 256, ServerSocket(), Timer(), HttpConnectionPool(null_crypto, f2),
              CountDownLatch(num_threads-2))
 {
     if (thread_id == 0) {
-        for (; f1.accept().get() != 0; ) {}
+        for (; f1.accept(*null_crypto).get() != 0; ) {}
     } else {
         while (f2.sample() < 5.0) {
             HttpConnection::UP conn = f3.getConnection(ServerSpec("localhost", f1.port()));
diff --git a/vbench/src/tests/socket/socket_test.cpp b/vbench/src/tests/socket/socket_test.cpp
index 609191fc596..8623c946c84 100644
--- a/vbench/src/tests/socket/socket_test.cpp
+++ b/vbench/src/tests/socket/socket_test.cpp
@@ -1,9 +1,15 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 #include <vespa/vespalib/testkit/testapp.h>
 #include <vbench/test/all.h>
+#include <vespa/vespalib/net/crypto_engine.h>
+#include <vespa/vespalib/net/tls/tls_crypto_engine.h>
+#include <vespa/vespalib/test/make_tls_options_for_testing.h>
 
 using namespace vbench;
 
+auto null_crypto = std::make_shared<vespalib::NullCryptoEngine>();
+auto tls_crypto = std::make_shared<vespalib::TlsCryptoEngine>(vespalib::test::make_tls_options_for_testing());
+
 using OutputWriter = vespalib::OutputWriter;
 
 const size_t numLines = 100;
@@ -32,43 +38,32 @@ struct Agent {
     }
 };
 
-struct Client : public Agent, public vespalib::Runnable {
-    Client(Stream::UP s) : Agent(std::move(s)) {}
-    void run() override {
-        TEST_THREAD("client");
-        write("client-");
-        read("server-");
-    }
-};
-
-struct Server : public Agent, public vespalib::Runnable {
-    Server(Stream::UP s) : Agent(std::move(s)) {}
-    void run() override {
-        TEST_THREAD("server");
-        read("client-");
-        write("server-");
-    }
-};
-
-TEST("socket") {
-    ServerSocket serverSocket;
-    Client client(Stream::UP(new Socket("localhost", serverSocket.port())));
-    Server server(serverSocket.accept());
-    vespalib::Thread clientThread(client);
-    vespalib::Thread serverThread(server);
-    clientThread.start();
-    serverThread.start();
-    clientThread.join();
-    serverThread.join();
-    {
-        server.socket.reset();
+void verify_socket(CryptoEngine &crypto, ServerSocket &server_socket, size_t thread_id) {
+    if (thread_id == 0) { // client
+        Agent client(std::make_unique<Socket>(crypto, "localhost", server_socket.port()));
+        client.write("client-");
+        client.read("server-");
+        TEST_BARRIER();   // #1
         LineReader reader(*client.socket);
         string line;
         EXPECT_FALSE(reader.readLine(line));
         EXPECT_TRUE(line.empty());
         EXPECT_TRUE(client.socket->eof());
         EXPECT_FALSE(client.socket->tainted());
+    } else {              // server
+        Agent server(server_socket.accept(crypto));
+        server.read("client-");
+        server.write("server-");
+        TEST_BARRIER();   // #1
     }
 }
 
+TEST_MT_F("socket", 2, ServerSocket()) {
+    TEST_DO(verify_socket(*null_crypto, f1, thread_id));
+}
+
+TEST_MT_F("secure socket", 2, ServerSocket()) {
+    TEST_DO(verify_socket(*tls_crypto, f1, thread_id));
+}
+
 TEST_MAIN() { TEST_RUN_ALL(); }
diff --git a/vbench/src/vbench/core/socket.cpp b/vbench/src/vbench/core/socket.cpp
index ed51e758a23..a11e03c5b22 100644
--- a/vbench/src/vbench/core/socket.cpp
+++ b/vbench/src/vbench/core/socket.cpp
@@ -9,14 +9,17 @@ namespace vbench {
 namespace {
 
 vespalib::SocketHandle connect(const string &host, int port) {
-    return vespalib::SocketSpec::from_host_port(host, port).client_address().connect();
+    auto tweak = [](vespalib::SocketHandle &handle) {
+        return handle.set_nodelay(true);
+    };
+    return vespalib::SocketSpec::from_host_port(host, port).client_address().connect(tweak);
 }
 
 } // namespace vbench::<unnamed>
 
 constexpr size_t READ_SIZE = 32768;
 
-Socket::Socket(vespalib::SocketHandle socket)
+Socket::Socket(SyncCryptoSocket::UP socket)
     : _socket(std::move(socket)),
       _input(),
       _output(),
@@ -25,28 +28,32 @@ Socket::Socket(vespalib::SocketHandle socket)
 {
 }
 
-Socket::Socket(const string &host, int port)
-    : _socket(connect(host, port)),
+Socket::Socket(CryptoEngine &crypto, const string &host, int port)
+    : _socket(SyncCryptoSocket::create(crypto, connect(host, port), false)),
       _input(),
       _output(),
       _taint(),
       _eof(false)
 {
-    if (!_socket.valid() || !_socket.set_linger(false, 0)) {
+    if (!_socket) {
         _taint.reset(strfmt("socket connect failed: host: %s, port: %d",
                             host.c_str(), port));
-        _socket.reset();
     }
 }
 
-Socket::~Socket() { }
+Socket::~Socket()
+{
+    if (_socket) {
+        _socket->half_close();
+    }
+}
 
 Memory
 Socket::obtain()
 {
     if ((_input.get().size == 0) && !_eof && !_taint) {
         WritableMemory buf = _input.reserve(READ_SIZE);
-        ssize_t res = _socket.read(buf.data, buf.size);
+        ssize_t res = _socket->read(buf.data, buf.size);
         if (res > 0) {
             _input.commit(res);
         } else if (res < 0) {
@@ -77,7 +84,7 @@ Socket::commit(size_t bytes)
     _output.commit(bytes);
     while ((_output.get().size > 0) && !_taint) {
         Memory buf = _output.obtain();
-        ssize_t res = _socket.write(buf.data, buf.size);
+        ssize_t res = _socket->write(buf.data, buf.size);
         if (res > 0) {
             _output.evict(res);
         } else {
diff --git a/vbench/src/vbench/core/socket.h b/vbench/src/vbench/core/socket.h
index 029d07b28fe..337384776c2 100644
--- a/vbench/src/vbench/core/socket.h
+++ b/vbench/src/vbench/core/socket.h
@@ -7,6 +7,8 @@
 #include <vespa/vespalib/data/simple_buffer.h>
 #include <vespa/vespalib/net/socket_handle.h>
 #include <vespa/vespalib/net/server_socket.h>
+#include <vespa/vespalib/net/crypto_engine.h>
+#include <vespa/vespalib/net/sync_crypto_socket.h>
 #include <memory>
 
 namespace vbench {
@@ -16,19 +18,21 @@ using Memory = vespalib::Memory;
 using Output = vespalib::Output;
 using SimpleBuffer = vespalib::SimpleBuffer;
 using WritableMemory = vespalib::WritableMemory;
+using CryptoEngine = vespalib::CryptoEngine;
+using SyncCryptoSocket = vespalib::SyncCryptoSocket;
 
 class Socket : public Stream
 {
 private:
-    vespalib::SocketHandle _socket;
+    SyncCryptoSocket::UP   _socket;
     SimpleBuffer           _input;
     SimpleBuffer           _output;
     Taint                  _taint;
     bool                   _eof;
 
 public:
-    Socket(vespalib::SocketHandle socket);
-    Socket(const string &host, int port);
+    Socket(SyncCryptoSocket::UP socket);
+    Socket(CryptoEngine &crypto, const string &host, int port);
     ~Socket();
     bool eof() const override { return _eof; }
     Memory obtain() override;
@@ -42,10 +46,10 @@ struct ServerSocket {
     vespalib::ServerSocket server_socket;
     ServerSocket() : server_socket(0) {}
     int port() const { return server_socket.address().port(); }
-    Stream::UP accept() {
+    Stream::UP accept(CryptoEngine &crypto) {
         vespalib::SocketHandle handle = server_socket.accept();
         if (handle.valid()) {
-            return std::make_unique<Socket>(std::move(handle));
+            return std::make_unique<Socket>(SyncCryptoSocket::create(crypto, std::move(handle), true));
         } else {
             return Stream::UP();
         }
diff --git a/vbench/src/vbench/http/http_client.cpp b/vbench/src/vbench/http/http_client.cpp
index 18603b4531a..3d13b7431de 100644
--- a/vbench/src/vbench/http/http_client.cpp
+++ b/vbench/src/vbench/http/http_client.cpp
@@ -180,11 +180,11 @@ HttpClient::readContent()
 }
 
 bool
-HttpClient::perform()
+HttpClient::perform(CryptoEngine &crypto)
 {
     writeRequest();
     if (!_conn->fresh() && (_conn->stream().obtain().size == 0)) {
-        _conn.reset(new HttpConnection(_conn->server()));
+        _conn.reset(new HttpConnection(crypto, _conn->server()));
         writeRequest();
     }
     return (readStatus() && readHeaders() && readContent());
diff --git a/vbench/src/vbench/http/http_client.h b/vbench/src/vbench/http/http_client.h
index f2ee5dcbd0d..77a53057740 100644
--- a/vbench/src/vbench/http/http_client.h
+++ b/vbench/src/vbench/http/http_client.h
@@ -56,22 +56,22 @@ private:
     bool readChunkSize(bool first, size_t &size);
     bool skipTrailers();
     bool readContent();
-    bool perform();
+    bool perform(CryptoEngine &crypto);
 
 public:
     ~HttpClient();
-    static bool fetch(const ServerSpec &server, const string &url,
+    static bool fetch(CryptoEngine &crypto, const ServerSpec &server, const string &url,
                       HttpResultHandler &handler)
     {
-        HttpClient client(HttpConnection::UP(new HttpConnection(server)), url, handler);
-        return client.perform();
+        HttpClient client(HttpConnection::UP(new HttpConnection(crypto, server)), url, handler);
+        return client.perform(crypto);
     }
     static bool fetch(HttpConnectionPool &pool,
                       const ServerSpec &server, const string &url,
                       HttpResultHandler &handler)
     {
         HttpClient client(pool.getConnection(server), url, handler);
-        if (client.perform()) {
+        if (client.perform(pool.crypto())) {
             if (client.serverKeepAlive()) {
                 pool.putConnection(std::move(client._conn));
             }
diff --git a/vbench/src/vbench/http/http_connection.cpp b/vbench/src/vbench/http/http_connection.cpp
index b95c2be4332..610e24f3c74 100644
--- a/vbench/src/vbench/http/http_connection.cpp
+++ b/vbench/src/vbench/http/http_connection.cpp
@@ -4,9 +4,9 @@
 
 namespace vbench {
 
-HttpConnection::HttpConnection(const ServerSpec &s)
+HttpConnection::HttpConnection(CryptoEngine &crypto, const ServerSpec &s)
     : _server(s),
-      _socket(s.host, s.port),
+      _socket(crypto, s.host, s.port),
       _lastUsed(-1000.0)
 {
 }
diff --git a/vbench/src/vbench/http/http_connection.h b/vbench/src/vbench/http/http_connection.h
index 92d8ac30796..b2742c3e0fd 100644
--- a/vbench/src/vbench/http/http_connection.h
+++ b/vbench/src/vbench/http/http_connection.h
@@ -23,7 +23,7 @@ private:
 public:
     typedef std::unique_ptr<HttpConnection> UP;
 
-    HttpConnection(const ServerSpec &server);
+    HttpConnection(CryptoEngine &crypto, const ServerSpec &server);
     bool fresh() const { return (_lastUsed < 0); }
     const ServerSpec &server() const { return _server; }
     Stream &stream() { return _socket; }
diff --git a/vbench/src/vbench/http/http_connection_pool.cpp b/vbench/src/vbench/http/http_connection_pool.cpp
index abd8181ad96..ffe6518e374 100644
--- a/vbench/src/vbench/http/http_connection_pool.cpp
+++ b/vbench/src/vbench/http/http_connection_pool.cpp
@@ -4,10 +4,11 @@
 
 namespace vbench {
 
-HttpConnectionPool::HttpConnectionPool(Timer &timer)
+HttpConnectionPool::HttpConnectionPool(CryptoEngine::SP crypto, Timer &timer)
     : _lock(),
       _map(),
       _store(),
+      _crypto(std::move(crypto)),
       _timer(timer)
 {
 }
@@ -32,7 +33,7 @@ HttpConnectionPool::getConnection(const ServerSpec &server)
         queue.pop();
         return ret;
     }
-    return HttpConnection::UP(new HttpConnection(server));
+    return HttpConnection::UP(new HttpConnection(*_crypto, server));
 }
 
 void
diff --git a/vbench/src/vbench/http/http_connection_pool.h b/vbench/src/vbench/http/http_connection_pool.h
index cdc97104938..919eceb1fef 100644
--- a/vbench/src/vbench/http/http_connection_pool.h
+++ b/vbench/src/vbench/http/http_connection_pool.h
@@ -24,11 +24,13 @@ private:
     vespalib::Lock     _lock;
     Map                _map;
     std::vector<Queue> _store;
+    CryptoEngine::SP   _crypto;
     Timer             &_timer;
 
 public:
-    HttpConnectionPool(Timer &timer);
+    HttpConnectionPool(CryptoEngine::SP crypto, Timer &timer);
     ~HttpConnectionPool();
+    CryptoEngine &crypto() { return *_crypto; }
     HttpConnection::UP getConnection(const ServerSpec &server);
     void putConnection(HttpConnection::UP conn);
 };
diff --git a/vbench/src/vbench/vbench/request_scheduler.cpp b/vbench/src/vbench/vbench/request_scheduler.cpp
index ed9958cd798..40e0632e07c 100644
--- a/vbench/src/vbench/vbench/request_scheduler.cpp
+++ b/vbench/src/vbench/vbench/request_scheduler.cpp
@@ -22,14 +22,14 @@ RequestScheduler::run()
     }
 }
 
-RequestScheduler::RequestScheduler(Handler<Request> &next, size_t numWorkers)
+RequestScheduler::RequestScheduler(CryptoEngine::SP crypto, Handler<Request> &next, size_t numWorkers)
     : _timer(),
       _proxy(next),
       _queue(10.0, 0.020),
       _droppedTagger(_proxy),
       _dispatcher(_droppedTagger),
       _thread(*this),
-      _connectionPool(_timer),
+      _connectionPool(std::move(crypto), _timer),
       _workers()
 {
     for (size_t i = 0; i < numWorkers; ++i) {
diff --git a/vbench/src/vbench/vbench/request_scheduler.h b/vbench/src/vbench/vbench/request_scheduler.h
index fb9d951d272..f7f4a542d6f 100644
--- a/vbench/src/vbench/vbench/request_scheduler.h
+++ b/vbench/src/vbench/vbench/request_scheduler.h
@@ -34,7 +34,7 @@ private:
     void run() override;
 public:
     typedef std::unique_ptr<RequestScheduler> UP;
-    RequestScheduler(Handler<Request> &next, size_t numWorkers);
+    RequestScheduler(CryptoEngine::SP crypto, Handler<Request> &next, size_t numWorkers);
     void abort();
     void handle(Request::UP request) override;
     void start() override;
diff --git a/vbench/src/vbench/vbench/vbench.cpp b/vbench/src/vbench/vbench/vbench.cpp
index 463f12c041c..35e638ba3af 100644
--- a/vbench/src/vbench/vbench/vbench.cpp
+++ b/vbench/src/vbench/vbench/vbench.cpp
@@ -11,6 +11,7 @@ VBench::VBench(const vespalib::Slime &cfg)
       _inputs(),
       _taint()
 {
+    CryptoEngine::SP crypto = std::make_shared<vespalib::NullCryptoEngine>();
     _analyzers.push_back(Analyzer::UP(new RequestSink()));
     vespalib::slime::Inspector &analyzers = cfg.get()["analyze"];
     for (size_t i = analyzers.children(); i-- > 0; ) {
@@ -19,7 +20,8 @@ VBench::VBench(const vespalib::Slime &cfg)
             _analyzers.push_back(Analyzer::UP(obj.release()));
         }
     }
-    _scheduler.reset(new RequestScheduler(*_analyzers.back(),
+    _scheduler.reset(new RequestScheduler(crypto,
+                                          *_analyzers.back(),
                                           cfg.get()["http_threads"].asLong()));
     vespalib::slime::Inspector &inputs = cfg.get()["inputs"];
     for (size_t i = inputs.children(); i-- > 0; ) {