Cloudflare has released the Pingora 0.7 framework, designed for developing secure high-performance network services in Rust. For over two years, proxies built with Pingora have been used in the Cloudflare content delivery network instead of nginx, handling more than 40 million requests per second. The code is written in Rust and published under the Apache 2.0 license.
Key features of Pingora:
- Support for HTTP/1 and HTTP/2 (with plans for HTTP/3), as well as the ability to create services that use their protocols or UDP/TCP.
- Support for multithreaded request processing in asynchronous mode.
- The ability to attach callback handlers and filters to manage various stages of request processing, as well as to modify, redirect, block, and log requests and responses.
- gRPC and WebSocket proxying.
- Pluggable load balancers.
- Ability to change configuration without restarting.
- Support for updating application code without dropping connections.
- Tools for failover load switching.
- Integration with various monitoring and logging systems (Syslog, Prometheus, Sentry, OpenTelemetry).
- Support for TLS encryption (using OpenSSL, BoringSSL, or Rustls).
- Pre-built Rust packages for creating HTTP proxies, working with network protocols, parsing HTTP headers, traffic accounting and limiting, load balancing, working with a distributed hash table Ketama, maintaining an in-memory cache, and asynchronous processing of timeouts.
Among the changes in the new version:
- The SslDigest structure has been updated to include an 'extension' field, and the TlsAccept trait now features a handshake_complete_callback handler, allowing arbitrary application-specific data to be attached to the TLS connection. An example is provided to show how to use this capability to create server, which reads information from the client certificate and returns it in the HTTP response.
- A ConnectionFilter trait has been added to filter TCP connections prior to the TLS parameter negotiation stage, which helps conserve resources by dropping connections early.
- Support for Virtual L4 Streams has been added, allowing the integration of custom network protocol implementations into the pingora-proxy.
- The verify_cert and verify_hostname options can now be used in configurations with rustls.
- Access to the HttpProxy structure has been permitted for external crate packages to override request proxying logic.
- Background handlers for sub-requests can now be allocated separately from the main session handler.
- The ability to track the size of HTTP1 and HTTP2 request bodies, as well as proxy operation metrics, has been provided.
- The option to create custom sessions for encapsulated HTTP traffic has been added.
- Restrictions have been placed on using versions of the lru library (0.16.3 or newer) due to a vulnerability in the IterMut iterator implementation, which could lead to crashes due to borrow checker violations.
Source: opennet.ru
