membphis commented on PR #14144: URL: https://github.com/apache/apisix/pull/14144#issuecomment-6623018375
@AlinsRan, I completed independent local before/after validation against base `6205e4a568106eea8277f61ae6ef942bbff62d97` and PR head `ef847a69815acb003cfa8fceddbe8cdeab4c931f`. ### Regression results - Before: all three existing forward-auth suites passed, 81/81 assertions. - After: all four forward-auth suites passed, 138/138 assertions, including the new 57-assertion suite. - The runtime's FFI client passed nine additional suites, 309/309 assertions, covering stateful requests, streaming/truncated bodies, TLS, request/response headers, validation, keepalive contracts and the resolver hook. The tested Lua binding is byte-identical to the runtime's bundled file. - Source inspection confirmed request-owned C cleanup and connection-pool separation by address, TLS mode, verification, SNI and trusted CA. The plugin reads the complete response before returning a connection to the pool. The deliberately unresolvable-domain cases ran in an outbound-network-isolated namespace, because this host's transparent DNS can synthesize answers. Positive DNS behavior was additionally exercised through a local DNS server in the performance fixture. ### Performance results | Metric | Before | After | Change | | --- | ---: | ---: | ---: | | Requests/sec | 8,768 | 12,147 | +38.5% | | Worker CPU per request | 113.61 us | 82.02 us | -27.8% | | Lua allocation per request | 16,121 B | 11,720 B | -27.3% | Throughput improved in all eight paired runs. The fixture forwards 16 request headers and copies 15 auth response headers, uses an auth hostname and keepalive pool 128, and validates those headers at the mock services. Each revision uses a fresh gateway, one worker pinned to a physical core, a separate mock-service core, wrk with one thread and 100 connections, a one-second warm-up and a five-second measurement. The table contains medians of eight interleaved pairs. CPU comes from worker process counters; allocation uses three 2,000-request samples with GC paused during that measurement. Wire counters also matched: 100 protected requests produced exactly 100 auth calls on both revisions, with zero DNS queries after warming the cache. Each fresh worker made one cold DNS query on both revisions. No extra per-request auth or warm-cache DNS calls were introduced. One non-blocking documentation correction: the stateful C client builds requests with `Connection: keep-alive` even when the plugin's `keepalive` is false; the plugin then closes the socket after reading the response. The PR description and docs currently say it sends `Connection: close` in that case. Connection-close behavior itself passed the regression tests. No merge-blocking issue was found for this PR. Runtime: CI-pinned APISIX runtime 1.4.2, with its package checksum verified against the repository installer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
