yolozoloo/varnish-encrypto

This is backend ssl encryption for open source varnish

varnish-encrypto's Issues

Write extensive documentation

1. Address what it solves
2. How the connection pooling improves latency.
3. How to run this code.
4. Benchmark between directly hitting backend with TLS and proxying through varnish encrypto with connection pooling.

CLI parameter for tuning

Currently thread pool size and other parameters are not tunable or configurable from CLI.

Close backend and client socket after client closes their end of connection

At the moment when client goes away connection socket pertinent to that client is in CLOSE_WAIT state. In this case both client and backend sockets should be closed

Listen on unix socket

Currently we are listening on TCP sockets on the client side. Communication with client can be boosted with talking over Unix socket.

Create backend connection pooling

Currently there is no backend connection pooling. Renegotiating TLS handshake for every request is very expensive. This overhead can be remediated by connection pooling

Ssl_read hits buffer limit

When the response content length is over 16384 bytes, the response fails because ssl_read's buffer can only accomodate up to 16384bytes.

Create a ringbuffer to call send only once

Currently in function.hpp we use SSL_read to read from the backend. The problem is that the TLS buffer is only 16kbs and for big pages, there will be many iterations to read all the TLS records from the backend. Since we are calling send on every TLS record we are calling a system call many times just to serve a single page. This anti-pattern should be avoided by using a ring buffer.