Cloudflare has released the Pingora 0.6 framework, designed for developing secure, high-performance network services in Rust. The proxy built using Pingora has been in use for over two years in Cloudflare's content delivery network, replacing nginx and handling over 40 million requests per second. The code is written in Rust and is published under the Apache 2.0 license.
Key features of Pingora:
- Support for HTTP/1 and HTTP/2 (with plans for HTTP/3), as well as the ability to create services that use their protocols or UDP/TCP.
- Support for multithreaded request processing in asynchronous mode.
- The ability to attach callback handlers and filters to manage various stages of request processing, as well as to modify, redirect, block, and log requests and responses.
- gRPC and WebSocket proxying.
- Pluggable load balancers.
- Ability to change configuration without restarting.
- Support for updating application code without dropping connections.
- Tools for failover load switching.
- Integration with various monitoring and logging systems (Syslog, Prometheus, Sentry, OpenTelemetry).
- Support for TLS encryption (using OpenSSL, BoringSSL, or Rustls).
- Pre-built Rust packages for creating HTTP proxies, working with network protocols, parsing HTTP headers, traffic accounting and limiting, load balancing, working with a distributed hash table Ketama, maintaining an in-memory cache, and asynchronous processing of timeouts.
Among the changes in the new version:
- During shutdown, it ensures that the names of runtime components are logged to simplify diagnosing issues caused by the absence of runtime components that lead to delays during shutdown.
- Phase execution tracking has been included server, information that may be useful for monitoring or ensuring fault tolerance. When the execution phase changes, an ExecutionPhase message is generated that can be intercepted via the API Server::watch_execution_phase.
- Compressed dictionaries are allowed to be stored in memory.
- The implementation of the http server and http proxy has added HttpServerOptions and H2Options directives.
- Protection against the MadeYouReset attack has been implemented, which allows denial of service through HTTP/2 control frame manipulation.
Source: opennet.ru
