Cloudflare has released version 0.4 of the Pingora framework, designed for developing secure high-performance network services in Rust. A proxy built using Pingora has been running on the Cloudflare content delivery network for over two years instead of nginx, processing more than 40 million requests per second. The code is written in Rust and is published under the Apache 2.0 license.
Key features of Pingora:
- Support for HTTP/1 and HTTP/2 (with plans for HTTP/3), as well as the ability to create services that use their protocols or UDP/TCP.
- Support for multithreaded request processing in asynchronous mode.
- The ability to attach callback handlers and filters to manage various stages of request processing, as well as to modify, redirect, block, and log requests and responses.
- gRPC and WebSocket proxying.
- Pluggable load balancers.
- Ability to change configuration without restarting.
- Support for updating application code without dropping connections.
- Tools for failover load switching.
- Integration with various monitoring and logging systems (Syslog, Prometheus, Sentry, OpenTelemetry).
- Support for TLS encryption (using OpenSSL, BoringSSL, or Rustls).
- Pre-built Rust packages for creating HTTP proxies, working with network protocols, parsing HTTP headers, traffic accounting and limiting, load balancing, working with a distributed hash table Ketama, maintaining an in-memory cache, and asynchronous processing of timeouts.
Among the changes in the new version:
- Initial support for the Rustls cryptographic library, which uses cryptographic providers based on the aws-lc-rs and ring libraries built on BoringSSL.
- Experimental support for the Windows platform.
- Dummy TLS mode, which can be used in situations where a real implementation of TLS is not feasible.
- Support for the gRPC-web module to translate gRPC-web client requests into server gRPC requests.
- Support for handling H2C (HTTP/2 over clear TCP, without encryption) and HTTP/1 on a single network port.
- Ability to attach custom implementations of the connect() function to alter behavior during the establishment of network connections, such as setting additional socket options or simulating errors during testing.
- Ability to ignore informational responses when proxying, such as responses with the 'Expect: 100-continue' header.
- Support for decompressing responses compressed with gzip.
- Backend state tracking implemented for monitoring purposes.
- Ability to bind to a range of local ports.
Source: opennet.ru
