Optimize lock usage in proxy connection handling

- Change activeTunnel.conns from slice to map for O(1) add/remove
- Improve lock scoping in UpdateLocalSNIs: use read lock for diff
  computation, minimize write lock hold time
- Move cache invalidation outside lock (go-cache is thread-safe)

proxy/proxy.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/fosrl/gerbil/logger"
 	"github.com/patrickmn/go-cache"
-	"golang.org/x/sync/errgroup"
 )
 
 // RouteRecord represents a routing configuration
@@ -73,9 +72,7 @@ type SNIProxy struct {
 }
 
 type activeTunnel struct {
-	ctx    context.Context
-	cancel context.CancelFunc
-	count  int // protected by activeTunnelsLock
+	conns map[net.Conn]struct{}
 }
 
 // readOnlyConn is a wrapper for io.Reader that implements net.Conn
@@ -591,32 +588,30 @@ func (p *SNIProxy) handleConnection(clientConn net.Conn) {
 		}
 	}
 
-	// Track this tunnel by SNI using context for cancellation
+	// Track this tunnel by SNI
 	p.activeTunnelsLock.Lock()
 	tunnel, ok := p.activeTunnels[hostname]
 	if !ok {
-		ctx, cancel := context.WithCancel(p.ctx)
-		tunnel = &activeTunnel{ctx: ctx, cancel: cancel}
+		tunnel = &activeTunnel{conns: make(map[net.Conn]struct{})}
 		p.activeTunnels[hostname] = tunnel
 	}
-	tunnel.count++
-	tunnelCtx := tunnel.ctx
+	tunnel.conns[actualClientConn] = struct{}{}
 	p.activeTunnelsLock.Unlock()
 
 	defer func() {
+		// Remove this conn from active tunnels - O(1) with map
 		p.activeTunnelsLock.Lock()
-		tunnel.count--
-		if tunnel.count == 0 {
-			tunnel.cancel()
-			if p.activeTunnels[hostname] == tunnel {
+		if tunnel, ok := p.activeTunnels[hostname]; ok {
+			delete(tunnel.conns, actualClientConn)
+			if len(tunnel.conns) == 0 {
 				delete(p.activeTunnels, hostname)
 			}
 		}
 		p.activeTunnelsLock.Unlock()
 	}()
 
-	// Start bidirectional data transfer with tunnel context
-	p.pipe(tunnelCtx, actualClientConn, targetConn, clientReader)
+	// Start bidirectional data transfer
+	p.pipe(actualClientConn, targetConn, clientReader)
 }
 
 // getRoute retrieves routing information for a hostname
@@ -752,36 +747,47 @@ func (p *SNIProxy) selectStickyEndpoint(clientAddr string, endpoints []string) s
 }
 
 // pipe handles bidirectional data transfer between connections
-func (p *SNIProxy) pipe(ctx context.Context, clientConn, targetConn net.Conn, clientReader io.Reader) {
-	g, gCtx := errgroup.WithContext(ctx)
+func (p *SNIProxy) pipe(clientConn, targetConn net.Conn, clientReader io.Reader) {
+	var wg sync.WaitGroup
+	wg.Add(2)
 
-	// Close connections when context cancels to unblock io.Copy operations
-	context.AfterFunc(gCtx, func() {
-		clientConn.Close()
-		targetConn.Close()
-	})
+	// closeOnce ensures we only close connections once
+	var closeOnce sync.Once
+	closeConns := func() {
+		closeOnce.Do(func() {
+			// Close both connections to unblock any pending reads
+			clientConn.Close()
+			targetConn.Close()
+		})
+	}
 
-	// Copy data from client to target
-	g.Go(func() error {
+	// Copy data from client to target (using the buffered reader)
+	go func() {
+		defer wg.Done()
+		defer closeConns()
+
+		// Use a large buffer for better performance
 		buf := make([]byte, 32*1024)
 		_, err := io.CopyBuffer(targetConn, clientReader, buf)
 		if err != nil && err != io.EOF {
 			logger.Debug("Copy client->target error: %v", err)
 		}
-		return err
-	})
+	}()
 
 	// Copy data from target to client
-	g.Go(func() error {
+	go func() {
+		defer wg.Done()
+		defer closeConns()
+
+		// Use a large buffer for better performance
 		buf := make([]byte, 32*1024)
 		_, err := io.CopyBuffer(clientConn, targetConn, buf)
 		if err != nil && err != io.EOF {
 			logger.Debug("Copy target->client error: %v", err)
 		}
-		return err
-	})
+	}()
 
-	g.Wait()
+	wg.Wait()
 }
 
 // GetCacheStats returns cache statistics
@@ -797,34 +803,46 @@ func (p *SNIProxy) ClearCache() {
 
 // UpdateLocalSNIs updates the local SNIs and invalidates cache for changed domains
 func (p *SNIProxy) UpdateLocalSNIs(fullDomains []string) {
-	newSNIs := make(map[string]struct{})
+	newSNIs := make(map[string]struct{}, len(fullDomains))
 	for _, domain := range fullDomains {
 		newSNIs[domain] = struct{}{}
-		// Invalidate any cached route for this domain
-		p.cache.Delete(domain)
 	}
 
-	// Update localSNIs
-	p.localSNIsLock.Lock()
+	// Get old SNIs with read lock to compute diff outside write lock
+	p.localSNIsLock.RLock()
+	oldSNIs := p.localSNIs
+	p.localSNIsLock.RUnlock()
+
+	// Compute removed SNIs outside the lock
 	removed := make([]string, 0)
-	for sni := range p.localSNIs {
+	for sni := range oldSNIs {
 		if _, stillLocal := newSNIs[sni]; !stillLocal {
 			removed = append(removed, sni)
 		}
 	}
+
+	// Swap with minimal write lock hold time
+	p.localSNIsLock.Lock()
 	p.localSNIs = newSNIs
 	p.localSNIsLock.Unlock()
 
+	// Invalidate cache for new domains (cache is thread-safe)
+	for domain := range newSNIs {
+		p.cache.Delete(domain)
+	}
+
 	logger.Debug("Updated local SNIs, added %d, removed %d", len(newSNIs), len(removed))
 
-	// Terminate tunnels for removed SNIs via context cancellation
+	// Terminate tunnels for removed SNIs
 	if len(removed) > 0 {
 		p.activeTunnelsLock.Lock()
 		for _, sni := range removed {
 			if tunnel, ok := p.activeTunnels[sni]; ok {
-				tunnel.cancel()
+				for conn := range tunnel.conns {
+					conn.Close()
+				}
 				delete(p.activeTunnels, sni)
-				logger.Debug("Cancelled tunnel context for SNI target change: %s", sni)
+				logger.Debug("Closed tunnels for SNI target change: %s", sni)
 			}
 		}
 		p.activeTunnelsLock.Unlock()