Source code

A Cargo workspace of five crates, one of which is the load balancer and the rest of which exist to serve it. Released under a BSD 2-clause licence.

The repository

gitlab.hacking.hu/szabolcs/sslb3

Open on GitLab

shell

git clone https://gitlab.hacking.hu/szabolcs/sslb3.git
cd sslb3
cargo build --release

How the workspace is laid out

Crate	What it is
sslb3	The load balancer. Listeners, TLS, the HTTP module, balancing, health checks, affinity, intrusion detection, the Lua runtime, the admin API, and the statistics page.
sslb3-api	The admin API contract as Rust types, shared by the balancer and anything that configures it — so the two cannot disagree about the shape of a request.
sslb3-ingress-controller	The Kubernetes controller. Watches Ingress, L4Ingress, Service, EndpointSlice and Secret, and configures the balancer over loopback.
sslb3-netlink-helper	The privileged half of the kernel fast path. Programs nftables and IPVS; the only component that holds CAP_NET_ADMIN. Linux only, by nature.
sslb3-wrk	A load generator, used for the benchmarks. Its own crate because a benchmark you cannot reproduce is an anecdote.

The layering is worth knowing when reading any of it: the engine is complete on its own and is configured by a file. The ingress controller is a layer over it, never a dependency of it, and the netlink helper is an optional accelerator with a complete fallback. Nothing in the engine knows Kubernetes exists.

Documentation in the repository

Longer-form reasoning lives next to the code rather than only here:

doc/fast-path.md	The kernel fast path in full
doc/http-module.md	Why HTTP is parsed in Rust rather than handed to a script
doc/intrusion-detection.md	What the detector watches for, and what it does about it
doc/lua-api.md	The scripting API
doc/windows-port.md	The Windows assessment and its open questions
crates/sslb3-api/doc/openapi.yaml	The admin API, as OpenAPI
crates/*/systemd/	Hardened systemd units for a bare-metal install, each with its own README

etc/sslb-sample.conf is the reference for every setting, with the reasoning beside each one. It is a more reliable source than any page here.

Contributing

Issues and pull requests are welcome. Two things make a change easy for me to accept:

shell

cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all

My house style, if it helps: comments explain why, not what. A comment that restates the line above it is noise, and a decision with a real trade-off in it deserves a sentence about what the alternative was and why it lost. Several of the subtler parts of this codebase are commented that way because I got them wrong the first time.

Licence

BSD 2-clause. Use it, ship it, fork it — keep the notice. The full text.