89 lines
4.8 KiB
Markdown
89 lines
4.8 KiB
Markdown
# RustProxy 0.34.0 DEV — 1,040-byte response, OPT3
|
|
|
|
## Scope
|
|
|
|
Primary: uncached reverse proxy, HTTP/1.1 keep-alive, 1,040-byte body,
|
|
no compression, ACL/security/logging/analytics/counters fully operational.
|
|
Goal: ~100,000 RPS and >=80% of nginx on the **same isolated host**.
|
|
Secondary: local Web Server/static files, measured independently.
|
|
**Version remains exactly 0.34.0**; existing configuration and defaults are
|
|
unchanged; no functions, checks or logs are disabled.
|
|
|
|
## New code optimizations (relative to OPT2-FIX1)
|
|
|
|
1. `src/acl.rs` / `src/proxy/cache_helpers.rs`: borrow ordinary validated
|
|
routing paths using `Cow<str>` during immutable route selection. Calls
|
|
with escaped (`%xx`) or repeated separators still use the original strict
|
|
allocator/decoder. Invalid control bytes, dot segments, UTF-8 and ambiguous
|
|
encodings remain rejected; the original wire path is not rewritten.
|
|
2. `src/proxy/forward_entry.rs` plus cache/Web Service call sites: retain the
|
|
original `http::Uri` value so normal paths can remain borrowed during the
|
|
entire mutable forwarding/rewrite operation. Cache-refresh tasks that need
|
|
ownership still allocate explicitly and hold their own `String`.
|
|
3. `src/forwarding.rs`: a **direct, untrusted** TCP peer now obtains the same
|
|
seven forwarding headers without allocating hop-chain `Vec` structures.
|
|
Trust chains and the configured `trust_forwarded_proto` logic use the
|
|
unchanged full parser. IPv4/IPv6 RFC 7239 formatting and true listener
|
|
port/scheme are preserved; untrusted spoofed values are still ignored.
|
|
4. `src/proxy/forward_entry.rs`: when effective client IP is identical to
|
|
the transport peer, reuse the IP stored by observation. No redundant
|
|
`IpAddr::to_string()` and no per-exchange mutex write. Different/trusted or
|
|
IPv4-mapped addresses are still stored in canonical form.
|
|
5. `src/proxy/headers.rs`: plain single-valued `Connection: keep-alive`
|
|
avoids the temporary `Vec<HeaderName>` while all standard hop-by-hop fields
|
|
are removed; comma-separated, repeated and complex Connection fields keep
|
|
the original removal parser to prevent nominated-header leaks.
|
|
6. `src/proxy/request_id.rs`: preserve SHA-256, CSPRNG, per-process sequence,
|
|
unpredictable 64-char hexadecimal IDs and wire headers, but write the hex
|
|
digits into one preallocated byte buffer before UTF-8 verification.
|
|
7. `src/cache/stats.rs`: select the most frequent `cache_disabled` reason
|
|
counter directly. The same exact atomic totals, reason labels, 4096-domain
|
|
limit and reset behavior are retained.
|
|
|
|
The changes avoid repeated work in common cases; no numerical throughput
|
|
benefit has been measured for this new source. In particular, no cache, log,
|
|
metrics, retry or auth feature was switched off for a synthetic benchmark.
|
|
|
|
## Evidence and known limits
|
|
|
|
- Provided newly compiled *OPT2-FIX1* executable SHA-256:
|
|
`6037e98d059672b716f2e1411976bf305cac927901a6f6662d8b703829ff8196`.
|
|
- PASS **89** HTTP proxy/policy/cache black-box assertions, zero failures,
|
|
testing that supplied executable, **not** the new OPT3 code.
|
|
- Source checks, migration/upgrade checks and ZIP checks are separate
|
|
static/offline verification; they are not equivalent to cargo/test/live.
|
|
- A single interrupted diagnostic A/B sample at c=64, 3 s, same idle=64,
|
|
gave older binary 33,752 RPS and OPT2-FIX1 binary 33,556 RPS, zero failed
|
|
requests; do **not** infer a true performance difference from one sample.
|
|
- NOT RUN here: `cargo check`, `cargo test`, rebuilt OPT3 integration tests,
|
|
post-build A/B RPS, long soaking, real TLS/H2/H3 compatibility and 80%-of-nginx
|
|
acceptance. No Rust toolchain is available in this editing container.
|
|
- Resource/latency trade-offs (including log/analytics drops, RSS/FDs) require
|
|
the same measured and pinned server/peer/generator CPU sets for before/after.
|
|
|
|
## Rebuild and measure
|
|
|
|
From the unpacked `RustProxy/` directory:
|
|
|
|
```bash
|
|
./dev.sh check
|
|
CARGO_INCREMENTAL=0 ./dev.sh test
|
|
bash dev.sh
|
|
python3 scripts/performance/regression.py \
|
|
--binary new=/ABSOLUTE/PATH/NEW/rust-proxy --out /tmp/rustproxy-opt3-http
|
|
python3 scripts/performance/ab_1kb_dev.py \
|
|
--binary before=/ABSOLUTE/PATH/OPT2FIX1/rust-proxy \
|
|
--binary after=/ABSOLUTE/PATH/OPT3/rust-proxy \
|
|
--nginx /usr/sbin/nginx --ab /usr/bin/ab \
|
|
--out /tmp/rustproxy-opt3-1kb --concurrency 16,64 \
|
|
--duration 5 --repeats 3 --workers 4 --max-idle 64
|
|
```
|
|
|
|
For an acceptance-grade evaluation, run the `scripts/performance/benchmark.py`
|
|
paired before/after/nginx test with separate pinned CPU sets, a verified origin
|
|
and 30-second runs repeated 7 times. Report median and p95/p99 latency,
|
|
errors, CPU, RSS, file descriptors, dropped log/analytics events, and all HTTP
|
|
status/body hashes. Retest TLS/H2/H3/WebSocket, auth, cache semantics and
|
|
connection/backpressure limits. Compare the **rebuilt** OPT3 binary against
|
|
OPT2-FIX1 at exactly the same listener/backend settings and compiler profile.
|