Golang中x/net/http2实现反向代理与HTTP2连接池的探讨

在Go的HTTP/2反向代理场景中，确实存在代理与后端服务器之间默认只维持单个HTTP/2连接的问题。这是由于HTTP/2规范要求单个主机使用一个连接进行多路复用。对于大文件传输场景，这确实可能成为瓶颈。

以下是几种解决方案：

1. 使用HTTP/1.1连接池（简单方案）

将代理与服务器之间的连接降级为HTTP/1.1，利用现有的连接池机制：

package main

import (
	"crypto/tls"
	"net/http"
	"net/http/httputil"
	"net/url"
	"time"
)

func main() {
	target, _ := url.Parse("https://backend-server:443")
	
	proxy := httputil.NewSingleHostReverseProxy(target)
	
	// 使用HTTP/1.1 Transport，启用连接池
	tr := &http.Transport{
		MaxIdleConns:        100,
		MaxIdleConnsPerHost: 100,
		MaxConnsPerHost:     100,
		IdleConnTimeout:     90 * time.Second,
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
		},
		// 强制使用HTTP/1.1
		ForceAttemptHTTP2: false,
	}
	
	proxy.Transport = tr
	
	// 启动代理服务器
	http.ListenAndServeTLS(":8443", "cert.pem", "key.pem", proxy)
}

2. 实现HTTP/2连接池（高级方案）

需要自定义Transport来管理多个HTTP/2连接：

package main

import (
	"context"
	"crypto/tls"
	"fmt"
	"net"
	"net/http"
	"net/http/httputil"
	"net/url"
	"sync"
	"time"
	
	"golang.org/x/net/http2"
)

type HTTP2ConnectionPool struct {
	target     *url.URL
	tlsConfig  *tls.Config
	mu         sync.RWMutex
	transports []*http2.Transport
	index      int
	maxConns   int
}

func NewHTTP2ConnectionPool(target *url.URL, maxConns int) *HTTP2ConnectionPool {
	pool := &HTTP2ConnectionPool{
		target:   target,
		maxConns: maxConns,
		tlsConfig: &tls.Config{
			InsecureSkipVerify: true,
		},
	}
	
	// 初始化多个HTTP/2 Transport
	for i := 0; i < maxConns; i++ {
		tr := &http2.Transport{
			TLSClientConfig: pool.tlsConfig,
			DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
				// 自定义Dialer，可以添加连接超时等配置
				dialer := &tls.Dialer{
					Config: cfg,
				}
				return dialer.DialContext(ctx, network, addr)
			},
			// 调整连接设置
			MaxReadFrameSize:     1 << 20, // 1MB
			IdleConnTimeout:      90 * time.Second,
			PingTimeout:          15 * time.Second,
		}
		pool.transports = append(pool.transports, tr)
	}
	
	return pool
}

func (p *HTTP2ConnectionPool) RoundTrip(req *http.Request) (*http.Response, error) {
	p.mu.Lock()
	tr := p.transports[p.index]
	p.index = (p.index + 1) % len(p.transports)
	p.mu.Unlock()
	
	// 克隆请求，避免修改原始请求
	req = req.Clone(req.Context())
	req.URL.Scheme = p.target.Scheme
	req.URL.Host = p.target.Host
	
	return tr.RoundTrip(req)
}

func main() {
	target, _ := url.Parse("https://backend-server:443")
	
	// 创建HTTP/2连接池，例如维护10个连接
	pool := NewHTTP2ConnectionPool(target, 10)
	
	proxy := &httputil.ReverseProxy{
		Director: func(req *http.Request) {
			req.URL.Scheme = target.Scheme
			req.URL.Host = target.Host
			req.Host = target.Host
		},
		Transport: pool,
		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
			fmt.Printf("Proxy error: %v\n", err)
			http.Error(w, "Bad gateway", http.StatusBadGateway)
		},
	}
	
	server := &http.Server{
		Addr:    ":8443",
		Handler: proxy,
	}
	
	// 启动HTTP/2服务器
	server.ListenAndServeTLS("cert.pem", "key.pem")
}

3. 使用多个后端主机（分布式方案）

如果可能，使用多个后端服务器地址：

package main

import (
	"crypto/tls"
	"math/rand"
	"net/http"
	"net/http/httputil"
	"net/url"
	"sync"
	"time"
)

type MultiHostReverseProxy struct {
	backends []*url.URL
	proxies  []*httputil.ReverseProxy
	mu       sync.RWMutex
}

func NewMultiHostReverseProxy(backendURLs []string) *MultiHostReverseProxy {
	m := &MultiHostReverseProxy{}
	
	for _, u := range backendURLs {
		backend, _ := url.Parse(u)
		m.backends = append(m.backends, backend)
		
		proxy := httputil.NewSingleHostReverseProxy(backend)
		proxy.Transport = &http.Transport{
			TLSClientConfig: &tls.Config{
				InsecureSkipVerify: true,
			},
			MaxIdleConnsPerHost: 100,
			MaxConnsPerHost:     100,
		}
		m.proxies = append(m.proxies, proxy)
	}
	
	return m
}

func (m *MultiHostReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	m.mu.RLock()
	index := rand.Intn(len(m.proxies))
	proxy := m.proxies[index]
	m.mu.RUnlock()
	
	proxy.ServeHTTP(w, r)
}

func main() {
	// 多个后端服务器地址（可以是同一服务器的不同端口）
	backends := []string{
		"https://backend-server:443",
		"https://backend-server:444",
		"https://backend-server:445",
	}
	
	proxy := NewMultiHostReverseProxy(backends)
	
	// 初始化随机种子
	rand.Seed(time.Now().UnixNano())
	
	http.ListenAndServeTLS(":8443", "cert.pem", "key.pem", proxy)
}

4. 调整HTTP/2传输参数

优化现有的HTTP/2 Transport配置：

package main

import (
	"context"
	"crypto/tls"
	"net"
	"net/http"
	"net/http/httputil"
	"net/url"
	"time"
	
	"golang.org/x/net/http2"
)

func main() {
	target, _ := url.Parse("https://backend-server:443")
	
	proxy := httputil.NewSingleHostReverseProxy(target)
	
	// 自定义HTTP/2 Transport
	tr := &http2.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
		},
		DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
			dialer := &net.Dialer{
				Timeout:   30 * time.Second,
				KeepAlive: 30 * time.Second,
			}
			return tls.DialWithDialer(dialer, network, addr, cfg)
		},
		// 调整关键参数
		MaxReadFrameSize:     1 << 20,     // 1MB帧大小
		IdleConnTimeout:      90 * time.Second,
		PingTimeout:          15 * time.Second,
		WriteBufferSize:      1 << 20,     // 1MB写缓冲区
		ReadBufferSize:       1 << 20,     // 1MB读缓冲区
		AllowHTTP:           false,
		DisableCompression:  false,
	}
	
	proxy.Transport = tr
	
	// 配置服务器端HTTP/2
	server := &http.Server{
		Addr:    ":8443",
		Handler: proxy,
	}
	
	// 启用服务器端HTTP/2
	http2.ConfigureServer(server, &http2.Server{
		MaxConcurrentStreams: 250,
		MaxReadFrameSize:     1 << 20,
		IdleTimeout:          120 * time.Second,
	})
	
	server.ListenAndServeTLS("cert.pem", "key.pem")
}

对于9MB大文件传输场景，建议优先考虑方案1（HTTP/1.1连接池），因为HTTP/1.1的连接池机制已经成熟稳定。如果必须使用HTTP/2，方案2的自定义连接池可以解决单连接瓶颈问题。