rustle 1.0.0 is out

rustle 1.0.0 is released. It is a forward proxy written in Rust, with one goal from the start: to be faster than every open-source proxy, first on one core, then on several. This post says what is in 1.0.0, what it protects you from by default, and what is still missing. The full list is in the changelog.

What it does

One binary speaks four ways to be a proxy:

• HTTP/1.1, as a forward proxy and with CONNECT tunnels, with connections kept alive to the servers it talks to;
• HTTPS, to encrypt the connection between your clients and the proxy, with HTTP/2 negotiated when the client asks for it;
• SOCKS5, for TCP and for UDP, which is what lets QUIC and DNS traffic go through it;
• WebSocket, on the plain HTTP path.

Towards the servers, rustle always speaks plain HTTP/1.1; an HTTPS destination goes through as an opaque tunnel. On Linux, big transfers are handed to the kernel with splice, and kernel TLS is available as an opt-in. How that works, and what it costs, is in the first post.

What it refuses

The defaults are the safe ones, once rustle init has generated a key for you:

• A key is required. Several keys can be valid at once, which allows rotating them without downtime.
• An address is banned after 5 wrong keys in 1 minute, for 15 minutes.
• An allowlist of clients (IPs and CIDRs) closes the connection before any byte is read.
• Private destinations are refused: loopback, private ranges, link-local addresses (including the cloud metadata address) and others. The check is made on the address a name resolves to, so a public name that points inside your network is refused too.
• Hostile clients are cut off: a client that sends its request head too slowly is dropped after 10 seconds, and ambiguous requests meant to smuggle a second request are rejected.

Be careful with one thing: with no key in the configuration, the proxy is an open relay. rustle check warns about it; rustle run does not. And on the plain port and on SOCKS5, the key travels in clear text, so expose those only on a trusted network and use the HTTPS port over the Internet. The security guide covers this in detail.

How you run it

curl -fsSL https://raw.githubusercontent.com/EdouardCourty/rustle/main/install.sh | sh
rustle init
rustle run

The installer checks the SHA-256 of what it downloads. The commands you will use next are rustle check to validate a configuration, rustle reload to apply a new one without dropping connections, rustle service to install it as a systemd or launchd service, and rustle update to move to a new release. A renewed certificate, new keys and new limits apply to new connections on a reload; a few settings, such as the listening address, need a restart, and reload tells you which. Getting started goes through the first steps.

It runs on Linux (x86_64 and aarch64, with glibc 2.35 or newer) and on macOS. On macOS everything works, but without splice, kernel TLS and core pinning.

What it does not do

• API keys are the only authentication. There are no user accounts, quotas or LDAP.
• No HTTP/3 to the proxy itself. QUIC works through SOCKS5.
• Upgrade is supported for WebSocket only, from HTTP/1.1 clients.
• Pipelined requests are answered one at a time, and Expect: 100-continue is not fully supported.
• No Windows, and no musl (Alpine).

The maintainers also keep a list of open work: measuring TLS, HTTP/2 and tunnels on several cores, finding out why kernel TLS is slower than the TLS in the program, and making the HTTP/2 path cheaper. It is a list of what is open, not a promise of dates.

The numbers

On one core, with authentication on, rustle served about 55k requests per second for a 1 KB response, 2.6 times as many as 3proxy, the next proxy. It held 25,000 idle tunnels in 95 MB, and went to about 440k requests per second on eight cores. These come with conditions, and the conditions are as important as the numbers: read how we measured them, and the full results.