Improve certstorage example

examples/goproxy-certstorage/README.md

@@ -1,5 +1,13 @@
-# certstorage
+# In-memory storage for temporary certificates
 
-## use certstorage 
+By default goproxy will generate TLS certificate for every request. Generating
+certificates is computationally expensive, so this leads to performance issues
+when there are many requests to the same host.
 
-## this could make https proxy faster
+Certificates storage allows the reuse of certificates.
+
+`SimpleCertStorage` - simple implementation, easy to read.
+
+`OptimizedCertStore` - has per-host locks to avoid situation, when multiple
+concurrent requests to a host without ready to use certificate will generate
+the same certificate multiple times.

examples/goproxy-certstorage/optimized_storage.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"crypto/tls"
+	"sync"
+)
+
+type OptimizedCertStore struct {
+	certs map[string]*tls.Certificate
+	locks map[string]*sync.Mutex
+	sync.Mutex
+}
+
+func NewOptimizedCertStore() *OptimizedCertStore {
+	return &OptimizedCertStore{
+		certs: map[string]*tls.Certificate{},
+		locks: map[string]*sync.Mutex{},
+	}
+}
+
+func (s *OptimizedCertStore) Fetch(host string, genCert func() (*tls.Certificate, error)) (*tls.Certificate, error) {
+	hostLock := s.hostLock(host)
+	hostLock.Lock()
+	defer hostLock.Unlock()
+
+	cert, ok := s.certs[host]
+	var err error
+	if !ok {
+		cert, err = genCert()
+		if err != nil {
+			return nil, err
+		}
+		s.certs[host] = cert
+	}
+	return cert, nil
+}
+
+func (s *OptimizedCertStore) hostLock(host string) *sync.Mutex {
+	s.Lock()
+	defer s.Unlock()
+
+	lock, ok := s.locks[host]
+	if !ok {
+		lock = &sync.Mutex{}
+		s.locks[host] = lock
+	}
+	return lock
+}

examples/goproxy-certstorage/storage.go → examples/goproxy-certstorage/simple_storage.go

@@ -5,11 +5,15 @@ import (
 	"sync"
 )
 
-type CertStorage struct {
+type SimpleCertStorage struct {
 	certs sync.Map
 }
 
-func (tcs *CertStorage) Fetch(hostname string, gen func() (*tls.Certificate, error)) (*tls.Certificate, error) {
+func NewSimpleCertStorage() *SimpleCertStorage {
+	return &SimpleCertStorage{}
+}
+
+func (tcs *SimpleCertStorage) Fetch(hostname string, gen func() (*tls.Certificate, error)) (*tls.Certificate, error) {
 	var cert tls.Certificate
 	icert, ok := tcs.certs.Load(hostname)
 	if ok {
@@ -25,10 +29,3 @@ func (tcs *CertStorage) Fetch(hostname string, gen func() (*tls.Certificate, err
 	}
 	return &cert, nil
 }
-
-func NewCertStorage() *CertStorage {
-	tcs := &CertStorage{}
-	tcs.certs = sync.Map{}
-
-	return tcs
-}