Drastically decreased performance compared to other golang WAFs / caddy / nginx.

[GergelyGombai]

Hey @wi1dcard ,

Do you have any clue what kind of configuration does Subscan run the fingerproxy instancees? I've tried it, but on a server where balooproxy(you might have heard of it) can push 300-400k rps, this limits at around 5k.

Looking forward to your reply.

[wi1dcard]

Short answer, pretty much as the default configuration. I would like to invite @perrornet to share some more info about Subscan production environment.

And there are some benchmarks run in GitHub Actions, for example using wrk: https://github.com/wi1dcard/fingerproxy/actions/runs/12444125548#summary-34744064197.

In GitHub Action's environment, with 2 threads and 10 connections, the echo server (which is a server based on fingerproxy that echoes fingerprints) can handle Requests/sec: 16144.22. And the control group (a simple golang http server) handles Requests/sec: 29650.46. Although there is a huge performance decrease, it is much higher than 5k/s. IMO, in real use cases, with more and more logics in server, this will be more of like a margin effect.

But anyhow, I'm still very curious of other WAF's performance. I would like to improve fingerproxy's performance if there is any chance.

Therefore, if possible, could you please add some other WAFs to benchmark, like you mentioned, balooproxy, etc? That way we can see the performance difference in action, and it will help tuning the configuration.

[GergelyGombai]

Heyo! Thanks for your answer on this.

I just tried the echo server with a digitalocean 2 core AMD droplet. I could do 7200 RPS max, then I tried the normal fingerproxy, pointing it to my own server to avoid DoS-ing someone. It maxed out at 2k RPS.

I'm afraid BalooProxy does not have an echo server that I could make a CI workflow with, but I'm going to test BalooProxy on the same server once I get home, and report back, of course for the "competition" to be fair, I'm going to use the net/http and not the gofiber version of it.

Also thanks in advance to @perrornet if they can provide any additional info on Subscan's fingerproxy stack, it would be much appreciated!

[GergelyGombai]

Update: Apologies, I was only half right! BalooProxy is indeed far far more performant, but not in a way I thought. It looks like I have been testing it wrong, all along. It has 2 "limiting" functions. For one, a fingerprint blacklisting, and for two, a simple ratelimit. With both turned off, I got the same 1-2k RPS result. With either of them turned on, I got 22-24k RPS. It would be nice to see a similar function in fingerproxy. Either one, or both. Unfortunately, I'm not a golang dev, but I'm working on my golang skills slowly haha.

In the meantime, input from the SubScan side would still be highly appreciated!

[perrornet]

@GergelyGombai
Subscan has launched 12 service instances for fingerproxy, with fine-grained resource allocation completed:

CPU: Each instance is allocated between 800m and 2 vCPUs.
Memory: Each instance is configured with 500MB to 8GB of memory

[GergelyGombai]

Thanks for your answer @perrornet .
Could you tell what’s the average, and max Req/s it can handle at total please?