AlinsRan opened a new pull request, #14144:
URL: https://github.com/apache/apisix/pull/14144
### Description
forward-auth makes one HTTP request to the authorization service for every
request it protects, and `lua-resty-http` runs that exchange in Lua. On a route
that forwards many request headers and copies many response headers, this
transport is most of the plugin's cost.
#13778 moved ai-proxy to `ngx_http_ffi_client`, which ships with the pinned
APISIX-Runtime, and added `apisix/utils/http.lua` as the one place that selects
the client. This PR does the same for forward-auth:
- **`plugin_attr.forward-auth.http_client`** selects the client:
`ngx_http_ffi_client` (default) or `lua-resty-http`. It is read on the first
request and validated with `http_client.client_schema`. A client that cannot be
loaded fails the auth request (`status_on_error`, or `allow_degradation`); the
plugin never switches clients silently.
- **One code path for both clients.** forward-auth now runs what
`request_uri` did, on the object API both clients share: `connect`, `request`
(with `preread_body`, so the C client reads the whole body in the same resume),
`read_body`, then `set_keepalive` or `close`. Host names go through
`core.resolver.parse_domain` for both clients, via `set_resolver`.
- `conf.uri` is parsed once per conf. Scheme-relative URIs (`//host/path`)
are parsed per request, because they take the scheme of the current request.
- A failed `set_keepalive` is logged at info level: the response has already
been read, and the C client reports a peer's `Connection: close` this way.
- No schema change.
#### Behavior differences with `ngx_http_ffi_client`
| | lua-resty-http | ngx_http_ffi_client |
|---|---|---|
| `Connection` sent to the auth service | none | `keep-alive` (`close` with
`keepalive: false`) |
| `Content-Length` on a GET auth request | none | `0` |
| default `User-Agent` | `lua-resty-http/...` | none |
| `timeout` while reading the response | per receive | one budget for the
whole response |
| error when the auth service closes without a response | `closed` |
`upstream closed before complete response` |
| error for CR/LF in a header value | `invalid characters found in header
value` | `invalid request header` |
Both error cases still return `status_on_error`. `http_client:
lua-resty-http` restores the previous behavior. The differences are documented
in the plugin docs.
#### Tests
- `t/plugin/forward-auth4.t` (new) runs against an auth service that reports
what it received:
- default client: IP and host name endpoints, query string, `Host`,
response headers copied upstream (case-insensitive, repeated, cleared when
missing), deny with `client_headers`, POST body, connection reuse, `keepalive:
false`, timeout, DNS failure;
- HTTPS with `ssl_verify: false`, and a rejected untrusted certificate
with `ssl_verify: true`;
- a scheme-relative URI requested over HTTP, then HTTPS, then both again;
- `http_client: lua-resty-http`, an unknown client name, and an
unavailable `ngx_http_ffi_client`.
- `forward-auth.t` TEST 11 and 16 accept both error texts; the GET branch of
the auth function in `forward-auth2.t` accepts `Content-Length: 0`.
- `forward-auth.t`, `forward-auth2.t` and `forward-auth3.t` pass with either
client.
#### Benchmark
One worker pinned to one core, forward-auth forwarding 16 request headers
and copying 15 response headers, auth URI by host name, `keepalive_pool` 128,
mocks that respond without delay, wrk with 100 connections, 5 interleaved
rounds of 30 s with a fresh gateway per run: throughput rose by 27.3% and
per-request CPU fell from 93.0 µs to 73.0 µs. No run logged an error or warning.
#### Which issue(s) this PR fixes:
N/A
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
