Cloudflare has announced the release of the source code for the Pingora framework, designed for the development of secure, high-performance network services and programmable network systems using Rust. The framework is well-tested and is already in use in high-load systems— a proxy built on it has been operational in the Cloudflare content delivery network for over a year, handling more than 40 million requests per second. The code is written in Rust and released under the Apache 2.0 license.
Pingora can be used for multithreaded request processing in asynchronous mode, supports HTTP/1 and HTTP/2 (with plans for HTTP/3), gRPC and WebSocket proxying, pluggable load balancers, configuration changes without restarting, code updates without breaking connections, failover load switching strategy, integration with various monitoring and logging systems (Syslog, Prometheus, Sentry, OpenTelemetry). Pingora also supports TLS encryption, implemented as a layer above the C libraries OpenSSL and BoringSSL.
Ready-to-use Rust packages are provided for creating HTTP proxies, working with network protocols, parsing HTTP headers, traffic accounting and throttling, load balancing, handling a distributed hash table Ketama, maintaining an in-memory cache, and asynchronously processing timeouts. In addition to HTTP, services can be created that use their own protocols or UDP/TCP.
The key priority of the project is ensuring security— to minimize the likelihood of memory-related errors, the Rust language was chosen for development. Significant attention is also given to efficiency, performance, and scalability. For example, when creating proxies and load balancers based on Pingora, there is a possibility to attach callback handlers and filters that allow management of various stages of request processing, as well as modifying, redirecting, blocking, and logging requests and responses.servers and load balancers based on Pingora allow for the attachment of callback handlers and filters that enable control over various stages of request processing, as well as modifying, redirecting, blocking, and logging requests and responses.
In partnership with ISRG (Internet Security Research Group), the founder of the Let’s Encrypt project that promotes the development of technologies to enhance internet security, an inverse proxy called River based on Pingora will be created, designed for use in critical components. of network infrastructureThe River code will be written in Rust and distributed under the Apache 2.0 license. Development will begin in the second quarter of 2024. The project is currently in the design and architecture definition stage and is being developed under the guidance of James Munns from the Rust Embedded Working Group.
The main purpose of the River project is to implement a proxy capable of relaying client requests to backend servers, terminating incoming TLS connections, and routing, modifying, and filtering requests according to specified rules. Notable features of River include a multithreaded request processing model, which allows for more efficient reuse of connections compared to proxies like nginx. To extend the proxy's functionality and create filters, it will support modules compiled in WebAssembly format (development can use any programming languages that can compile to WASM). The configuration format is planned to be as simple and familiar as possible.
Source: opennet.ru
