bench(proxy): introduce TLS-based Hyper proxy benchmark

[RealHinome]

Create a Criterion-based benchmark to evaluate proxy performance under HTTP/1.1 and HTTP/2.

The benchmark currently measures:

• Request lifecycle through the proxy:
  • TLS handshake
  • ALPN negotiation (HTTP/1.1 vs HTTP/2)
  • Hyper client/server request execution
  • Response collection overhead
• Comparative performance between:
  • HTTP/1.1 sequential request handling
  • HTTP/2 multiplexed streams under varying concurrency levels

TODO:

• Enable persistent connection reuse (HTTP/1.1 keep-alive, HTTP/2 single long-lived connection)
• Separate proxy layers (isolate TLS cost vs HTTP parsing vs routing logic)
• Add metrics decomposition

[RealHinome]

In hindsight, I don't think it's worth implementing the rest of the TODOs right now. The rest of the benchmarks will handle it more cleanly, like your acl.rs. The benchmark therefore measures the TLS proxy under different loads and with multiple protocols. I added the Default trait to ACLHir and ACLRules to create empty rules more quickly. Just in case, I left an empty_acl function to quickly modify ACL creation if that didn't suit you, but using the trait remains idiomatic and standard practice.

[RealHinome]

The failure is not caused by the benchmark (which succeeds, as seen on the bench CI). It fails due to a Nix test interaction with hello.corp.example.com and 127.0.0.1:8080. You should probably add a wait_until_succeeds in the portail-identity-aware-upstream test script (around default.nix#L644) to wait until the proxy has fully established its internaltunnel before running the assertion.

[rlahfa-dinum]

The failure is not caused by the benchmark (which succeeds, as seen on the bench CI). It fails due to a Nix test interaction with hello.corp.example.com and 127.0.0.1:8080. You should probably add a wait_until_succeeds in the portail-identity-aware-upstream test script (around default.nix#L644) to wait until the proxy has fully established its internaltunnel before running the assertion.

Can you send a PR to fix that? Thanks.

[RealHinome]

Hey @rlahfa-dinum! Can you trigger the workflows? Thanks.
I've merged the main branch. I've also facilitated the addition of h3 protocol for later.