幂等代理

Rust编写，内置幂等性支持的反向代理服务器。

概述

幂等代理是一个用Rust编写的反向代理服务，具有内置的幂等性支持。

在特定时间段内，如果有多个带有相同幂等性键的请求到达，则只将第一个请求转发到目标服务。响应被缓存到Redis中，后续请求将查询Redis以检索和返回第一个请求的响应。

该服务可用于代理HTTPS出呼，用于ICP信封，使其能够与任何Web2 http服务集成。它支持隐藏秘密信息、访问控制、只返回必要的头信息，并且对于JSON或CBOR数据，允许基于JSON Mask进行响应过滤，只返回所需字段，从而在ICP信封中节省周期消耗。

功能

• 内置幂等性支持的反向代理
• JSON响应过滤
• 访问控制
• 响应头过滤
• HTTPS支持
• 作为Cloudflare Worker运行
• Docker镜像

部署

以开发模式运行代理

运行代理

# docker run --name redis -d -p 6379:6379 redis:latest # optional redis
cargo run -p idempotent-proxy-server

构建和运行AWS Nitro Enclave镜像

设置主机机器

https://docs.marlin.org/learn/oyster/core-concepts/networking/outgoing

wget -O vsock-to-ip-transparent http://public.artifacts.marlin.pro/projects/enclaves/vsock-to-ip-transparent_v1.0.0_linux_amd64
chmod +x vsock-to-ip-transparent
./vsock-to-ip-transparent --vsock-addr 3:1200

https://docs.marlin.org/learn/oyster/core-concepts/networking/incoming

iptables规则

# route incoming packets on port 80 to the transparent proxy
iptables -A PREROUTING -t nat -p tcp --dport 80 -i ens5 -j REDIRECT --to-port 1200
# route incoming packets on port 443 to the transparent proxy
iptables -A PREROUTING -t nat -p tcp --dport 443 -i ens5 -j REDIRECT --to-port 1200
# route incoming packets on port 1025:65535 to the transparent proxy
iptables -A PREROUTING -t nat -p tcp --dport 1025:65535 -i ens5 -j REDIRECT --to-port 1200

wget -O port-to-vsock-transparent http://public.artifacts.marlin.pro/projects/enclaves/port-to-vsock-transparent_v1.0.0_linux_amd64
chmod +x port-to-vsock-transparent
./port-to-vsock-transparent --vsock 88 --ip-addr 0.0.0.0:1200

构建和运行enclave

以下步骤应在基于AWS Nitro的实例上运行。

https://docs.aws.amazon.com/enclaves/latest/user/getting-started.html

sudo nitro-cli build-enclave --docker-uri ghcr.io/ldclabs/idempotent-proxy_enclave_amd64:latest --output-file idempotent-proxy_enclave_amd64.eif
# Start building the Enclave Image...
# Using the locally available Docker image...
# Enclave Image successfully created.
# {
#   "Measurements": {
#     "HashAlgorithm": "Sha384 { ... }",
#     "PCR0": "bbfe317cdaba604e1364fbd254150ce25516d83e31a87f8b3d8acb163286f57f51d8b3f6b2a482ac209b758334d996d9",
#     "PCR1": "4b4d5b3661b3efc12920900c80e126e4ce783c522de6c02a2a5bf7af3a2b9327b86776f188e4be1c1c404a129dbda493",
#     "PCR2": "9ea2080d6e6bd61f03a62357a1cbbae278b070db5df6b1fe5c57821ff249b77add0f95dab0a5beec7aa6ef6735f27b14"
#   }
# }
sudo nitro-cli run-enclave --cpu-count 2 --memory 512 --enclave-cid 88 --eif-path idempotent-proxy_enclave_amd64.eif --debug-mode
# Started enclave with enclave-cid: 88, memory: 512 MiB, cpu-ids: [1, 3]
# {
#   "EnclaveName": "idempotent-proxy_enclave_amd64",
#   "EnclaveID": "i-056e1ab9a31cd77a0-enc190ca7263013fd3",
#   "ProcessID": 21493,
#   "EnclaveCID": 88,
#   "NumberOfCPUs": 2,
#   "CPUIDs": [
#     1,
#     3
#   ],
#   "MemoryMiB": 512
# }
sudo nitro-cli describe-enclaves
sudo nitro-cli console --enclave-id i-056e1ab9a31cd77a0-enc190ca7263013fd3
sudo nitro-cli terminate-enclave --enclave-id i-056e1ab9a31cd77a0-enc190ca7263013fd3

发起请求

curl -v -X POST \
  --url http://YOUR_HOST/ \
  --header 'content-type: application/json' \
  --header 'x-forwarded-host: cloudflare-eth.com' \
  --header 'idempotency-key: key_001' \
  --data '{
	  "id": 1,
    "jsonrpc": "2.0",
    "method": "eth_getBlockByNumber",
    "params": ["latest", false]
}'

许可证

版权 © 2024 LDC Labs.

ldclabs/idempotent-proxy 采用MIT许可证。有关完整的许可证文本，请参阅LICENSE。