TLS 握手会拉长延迟，但可以缩小

package main

import (
	"context"
	"crypto/tls"
	"fmt"
	"io"
	"net"
	"net/http"
	"net/http/httptest"
	"net/http/httptrace"
	"runtime"
	"strconv"
	"sync"
	"sync/atomic"
	"time"
)

type connectionKey struct{}

func must(err error) {
	if err != nil {
		panic(err)
	}
}

func check(ok bool, message string) {
	if !ok {
		panic(message)
	}
}

func main() {
	var connections atomic.Int64
	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("X-Connection-ID", fmt.Sprint(r.Context().Value(connectionKey{})))
		w.Header().Set("X-Resumed", strconv.FormatBool(r.TLS.DidResume))
		fmt.Fprint(w, "ok")
	}))
	server.Config.ConnContext = func(ctx context.Context, _ net.Conn) context.Context {
		return context.WithValue(ctx, connectionKey{}, connections.Add(1))
	}
	server.TLS = &tls.Config{MinVersion: tls.VersionTLS13, MaxVersion: tls.VersionTLS13}
	server.StartTLS()
	defer server.Close()
	base := server.Client().Transport.(*http.Transport).TLSClientConfig.Clone()
	base.MinVersion, base.MaxVersion = tls.VersionTLS13, tls.VersionTLS13
	check(!base.InsecureSkipVerify, "certificate verification must stay enabled")
	cached := base.Clone()
	cached.ClientSessionCache = tls.NewLRUClientSessionCache(4)
	transport := &http.Transport{TLSClientConfig: cached}
	defer transport.CloseIdleConnections()
	fresh := &http.Transport{TLSClientConfig: base.Clone()}
	defer fresh.CloseIdleConnections()
	probe := func(label string, transport *http.Transport, wantID int64, wantReuse, wantResume bool) {
		started := time.Now()
		var mu sync.Mutex
		var handshakeStarted time.Time
		var handshakeError error
		var observation struct {
			got, starts, done, first int
			reused                   bool
			tlsTime, ttfb            time.Duration
		}
		trace := &httptrace.ClientTrace{
			GotConn: func(info httptrace.GotConnInfo) {
				mu.Lock()
				defer mu.Unlock()
				observation.got++
				observation.reused = info.Reused
			},
			TLSHandshakeStart: func() {
				mu.Lock()
				defer mu.Unlock()
				handshakeStarted = time.Now()
				observation.starts++
			},
			TLSHandshakeDone: func(_ tls.ConnectionState, err error) {
				mu.Lock()
				defer mu.Unlock()
				observation.done++
				observation.tlsTime = time.Since(handshakeStarted)
				handshakeError = err
			},
			GotFirstResponseByte: func() {
				mu.Lock()
				defer mu.Unlock()
				observation.first++
				observation.ttfb = time.Since(started)
			},
		}
		request, err := http.NewRequest(http.MethodGet, server.URL, nil)
		must(err)
		request = request.WithContext(httptrace.WithClientTrace(request.Context(), trace))
		client := &http.Client{Transport: transport, Timeout: 2 * time.Second}
		response, err := client.Do(request)
		must(err)
		body, err := io.ReadAll(response.Body)
		closeError := response.Body.Close()
		must(err)
		must(closeError)
		total := time.Since(started)
		check(response.StatusCode == 200 && string(body) == "ok", "wrong response")
		check(response.Proto == "HTTP/1.1", "fixture requires HTTP/1.1")
		check(response.TLS.Version == tls.VersionTLS13 && len(response.TLS.VerifiedChains) > 0, "verified TLS 1.3 required")
		id, err := strconv.ParseInt(response.Header.Get("X-Connection-ID"), 10, 64)
		must(err)
		check(id == wantID && response.TLS.DidResume == wantResume, "wrong connection or resumption")
		check(response.Header.Get("X-Resumed") == strconv.FormatBool(wantResume), "peers disagree on resumption")
		mu.Lock()
		observed, tlsError := observation, handshakeError
		mu.Unlock()
		must(tlsError)
		wantHandshakes := 1
		if wantReuse {
			wantHandshakes = 0
		}
		check(observed.got == 1 && observed.first == 1 && observed.reused == wantReuse, "wrong request trace")
		check(observed.starts == wantHandshakes && observed.done == wantHandshakes, "wrong handshake count")
		check(total >= observed.ttfb && observed.ttfb > 0, "invalid response timing")
		fmt.Printf("%s: conn=%d reused=%t handshakes=%d connection_resumed=%t tls_us=%d ttfb_us=%d total_us=%d\n",
			label, id, observed.reused, observed.done, response.TLS.DidResume,
			observed.tlsTime.Microseconds(), observed.ttfb.Microseconds(), total.Microseconds())
	}
	probe("cold", transport, 1, false, false)
	probe("reuse", transport, 1, true, false)
	transport.CloseIdleConnections()
	probe("resume", transport, 2, false, true)
	probe("no cache", fresh, 3, false, false)
	check(connections.Load() == 3, "four requests must use three TCP connections")
	fmt.Println("timings are observations, not a speedup or wire-RTT assertion")
	fmt.Println(runtime.Version())
}