v1.7.5 — Blazing first connect: cold-cache fix, cert pre-warm, public benchmark
The first impression scenario ("open sberbank.ru") no longer races a
cold cache: Janus now keeps the warm path warm and measures itself.
FIXES
- InMemoryCertCache used try_read/try_write: under contention a read
returned a false miss and an insert silently dropped its entry.
Browsers fire several parallel CONNECTs at a new domain, so the cache
stayed cold and certificates regenerated on every attempt. The map
now uses blocking locks; a regression test hammers the cache with
concurrent readers while inserting and demands the entry survives.
- Literal whitelist domains are pre-warmed at startup and on every hot
reload (src/proxy/prewarm.rs) — certificate generation is off the
browser critical path. Wildcard patterns cannot be pre-warmed: the
leaf must match the SNI the browser actually sends.
- Debug eprintln noise removed from the MITM path (Noiseless principle).
- An upstream-first reorder was reverted after the integration suite
rejected it: an untrusted upstream now fails INSIDE the client HTTPS
session instead of resetting the browser TLS handshake.
BENCHMARKS (public, speed only — output carries no machine data)
- tests/perf/bench_perf_test.rs: cold vs warm tunnel latency and warm
worst case through the real proxy core against mock TLS upstreams.
- scripts/bench.sh: debug binary by default, --release to switch,
--build, --rounds N, --json for robots, --baseline to refresh the
committed baseline; --quiet for clean stdout.
- Baseline (debug, 20 rounds): cold CONNECT 110ms, warm average 29ms,
warm worst 32ms — committed as reports/perf/baseline.json so future
changes compare against numbers, not vibes.