服务网格中基于Wasm的插件安全隔离与性能开销评估

service-mesh-wasm-demo/
├── Cargo.toml
├── .cargo/
│   └── config.toml
├── src/
│   ├── lib.rs
│   └── memory_allocator.rs
├── envoy/
│   └── envoy.yaml
├── tests/
│   ├── benchmark.py
│   └── functional_test.sh
├── Dockerfile
├── run.sh
└── Makefile

[package]
name = "header-modifier-filter"
version = "0.1.0"
edition = "2021"
publish = false

[lib]
crate-type = ["cdylib"] # 编译为动态库，供Wasm运行时链接

[dependencies]
proxy-wasm = "0.3"
log = "0.4"
wee_alloc = { version = "0.4", optional = true } # 可选的轻量级分配器，用于控制Wasm内存

[features]
default = ["wee_alloc"] # 默认启用 wee_alloc

[profile.release]
opt-level = 'z'          # 优化级别为最小体积
lto = true              # 链接时优化
codegen-units = 1
panic = 'abort'         # 发生panic时直接终止，减少代码体积

[build]
target = "wasm32-unknown-unknown"

[unstable]
build-std = ["std", "panic_abort"] # 使用 panic_abort 替换 panic_unwind，减少体积

//! 可选：提供一个替代的全局内存分配器以减小Wasm模块体积。

#[cfg(feature = "wee_alloc")]
#[global_allocator]
static ALLOC: wee_alloc::WeeAlloc = wee_alloc::WeeAlloc::INIT;

// 如果不使用 `wee_alloc`，则使用系统的默认分配器。

use log::info;
use proxy_wasm::traits::*;
use proxy_wasm::types::*;

// 导入可选的内存分配器模块
mod memory_allocator;

// 定义根上下文。在Wasm VM初始化时创建。
struct HttpHeadersRoot;

impl Context for HttpHeadersRoot {}
impl RootContext for HttpHeadersRoot {
    // 创建新的HTTP上下文实例。
    fn create_http_context(&self, _context_id: u32) -> Option<Box<dyn HttpContext>> {
        Some(Box::new(HttpHeadersFilter {}))
    }
    fn get_type(&self) -> Option<ContextType> {
        Some(ContextType::HttpContext)
    }
}

// 定义HTTP过滤器上下文。
struct HttpHeadersFilter;

impl Context for HttpHeadersFilter {}

impl HttpContext for HttpHeadersFilter {
    // 在处理HTTP请求头时被调用。
    fn on_http_request_headers(&mut self, _num_headers: usize, _end_of_stream: bool) -> Action {
        info!("Wasm: Adding custom header 'X-Wasm-Processed' to request.");
        // 添加一个自定义的请求头
        self.add_http_request_header("X-Wasm-Processed", "Yes");
        // 也可以删除或修改现有的请求头
        // self.set_http_request_header("User-Agent", Some("My-Wasm-Proxy"));
        Action::Continue
    }

    // 可选：在处理HTTP响应头时被调用。
    // fn on_http_response_headers(&mut self, _num_headers: usize, _end_of_stream: bool) -> Action {
    //     self.add_http_response_header("X-Wasm-Processed-Response", "Yes");
    //     Action::Continue
    // }
}

// 这是必需的入口点。proxy-wasm SDK 需要一个名为 `_start` 的全局构造函数。
#[no_mangle]
pub fn _start() {
    proxy_wasm::set_log_level(LogLevel::Info); // 设置日志级别
    proxy_wasm::set_root_context(|_| -> Box<dyn RootContext> { Box::new(HttpHeadersRoot) });
}

static_resources:
  listeners:

  - name: main_listener
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 10000
    filter_chains:

    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:

            - name: local_service
              domains: ["*"]
              routes:

              - match:
                  prefix: "/"
                route:
                  cluster: mock_service
          http_filters:
          # 这是我们的Wasm过滤器

          - name: envoy.filters.http.wasm
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
              config:
                # VM配置：指定Wasm模块来源和运行时。
                vm_config:
                  runtime: "envoy.wasm.runtime.v8" # 使用V8引擎
                  code:
                    local:
                      filename: "/etc/envoy/header_modifier_filter.wasm" # Wasm模块在容器内的路径
                  allow_precompiled: true
                configuration:
                  "@type": type.googleapis.com/google.protobuf.StringValue
                  value: |
                    {"config_key": "config_value"} # 可以传递给Wasm模块的配置

          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:

  - name: mock_service
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: mock_service
      endpoints:

      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: httpbin.org # 使用一个真实的测试服务
                port_value: 80
admin:
  access_log_path: "/dev/null"
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 9901

FROM envoyproxy/envoy:dev-latest AS envoy

FROM rust:1.75-slim AS builder
WORKDIR /build
RUN apt-get update && apt-get install -y \
    clang \
    lld \
    && rm -rf /var/lib/apt/lists/*
COPY Cargo.toml Cargo.lock ./
COPY src ./src
COPY .cargo ./.cargo
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/build/target \
    cargo build --target wasm32-unknown-unknown --release
# 编译后的wasm文件位于 /build/target/wasm32-unknown-unknown/release/header_modifier_filter.wasm

FROM envoyproxy/envoy:dev-latest
COPY --from=builder /build/target/wasm32-unknown-unknown/release/header_modifier_filter.wasm /etc/envoy/
COPY envoy/envoy.yaml /etc/envoy/
CMD ["envoy", "-c", "/etc/envoy/envoy.yaml", "--concurrency", "2"]

#!/usr/bin/env python3
"""
性能基准测试脚本：测量通过Wasm代理的请求延迟。
"""
import asyncio
import aiohttp
import time
import statistics
import argparse
from urllib.parse import urljoin

async def make_request(session, url):
    """发起单个HTTP请求并返回延迟（秒）。"""
    start = time.perf_counter()
    try:
        async with session.get(url) as resp:
            await resp.read()  # 确保读取完整响应体
            latency = time.perf_counter() - start
            # 可选：检查响应头是否包含Wasm添加的标记
            # if 'X-Wasm-Processed' in resp.headers:
            #     print(f"Request processed by Wasm: {resp.headers['X-Wasm-Processed']}")
            return latency, True
    except Exception as e:
        print(f"Request failed: {e}")
        return time.perf_counter() - start, False

async def run_benchmark(target_url, num_requests, concurrency):
    """运行基准测试，返回成功请求的延迟列表。"""
    connector = aiohttp.TCPConnector(limit=concurrency)
    timeout = aiohttp.ClientTimeout(total=30)
    async with aiohttp.ClientSession(connector=connector, timeout=timeout) as session:
        tasks = []
        for _ in range(num_requests):
            task = asyncio.create_task(make_request(session, target_url))
            tasks.append(task)

        results = await asyncio.gather(*tasks)
        latencies = [lat for lat, success in results if success]
        failures = sum(1 for _, success in results if not success)
        return latencies, failures

def analyze_latencies(latencies):
    """分析延迟数据，计算平均值、P99等。"""
    if not latencies:
        return {}
    latencies_ms = [l * 1000 for l in latencies]  # 转换为毫秒
    latencies_ms.sort()
    return {
        'count': len(latencies_ms),
        'mean_ms': statistics.mean(latencies_ms),
        'p50_ms': latencies_ms[int(len(latencies_ms) * 0.5)],
        'p90_ms': latencies_ms[int(len(latencies_ms) * 0.9)],
        'p99_ms': latencies_ms[int(len(latencies_ms) * 0.99)],
        'max_ms': max(latencies_ms),
        'min_ms': min(latencies_ms),
    }

async def main():
    parser = argparse.ArgumentParser(description='Run performance benchmark.')
    parser.add_argument('--url', default='http://localhost:10000/headers',
                        help='Target URL (default: http://localhost:10000/headers)')
    parser.add_argument('-n', '--requests', type=int, default=1000,
                        help='Total number of requests (default: 1000)')
    parser.add_argument('-c', '--concurrency', type=int, default=50,
                        help='Concurrency level (default: 50)')
    args = parser.parse_args()

    print(f"Starting benchmark...")
    print(f"  Target: {args.url}")
    print(f"  Requests: {args.requests}, Concurrency: {args.concurrency}")

    warmup_url = urljoin(args.url, '/get')  # 使用另一个端点预热
    print("Warming up...")
    await run_benchmark(warmup_url, 100, 10)

    print("Running main benchmark...")
    start_time = time.time()
    latencies, failures = await run_benchmark(args.url, args.requests, args.concurrency)
    total_time = time.time() - start_time

    stats = analyze_latencies(latencies)
    if stats:
        print(f"\n--- Results ---")
        print(f"Total time: {total_time:.2f}s")
        print(f"Successful requests: {stats['count']}")
        print(f"Failed requests: {failures}")
        print(f"Requests/sec: {stats['count'] / total_time:.2f}")
        print(f"Latency (ms):")
        print(f"  Average: {stats['mean_ms']:.2f}")
        print(f"  50th (p50): {stats['p50_ms']:.2f}")
        print(f"  90th (p90): {stats['p90_ms']:.2f}")
        print(f"  99th (p99): {stats['p99_ms']:.2f}")
        print(f"  Min: {stats['min_ms']:.2f}")
        print(f"  Max: {stats['max_ms']:.2f}")
    else:
        print("No successful requests recorded.")

if __name__ == '__main__':
    asyncio.run(main())

#!/bin/bash
set -e

echo "1. Building the Rust WebAssembly module..."
# 确保目标存在
rustup target add wasm32-unknown-unknown
# 使用 release 配置构建以优化体积和性能
cargo build --target wasm32-unknown-unknown --release
echo "Build complete. Wasm module: ./target/wasm32-unknown-unknown/release/header_modifier_filter.wasm"

echo -e "\n2. Building Docker image (envoy-wasm-demo)..."
docker build -t envoy-wasm-demo .

echo -e "\n3. Stopping any existing container..."
docker stop envoy-wasm-demo-container 2>/dev/null || true
docker rm envoy-wasm-demo-container 2>/dev/null || true

echo -e "\n4. Starting Envoy container..."
docker run -d \
  --name envoy-wasm-demo-container \
  -p 10000:10000 \
  -p 9901:9901 \
  envoy-wasm-demo
echo "Envoy is running on http://localhost:10000"
echo "Envoy Admin interface on http://localhost:9901"

echo -e "\n5. Waiting for Envoy to be ready..."
sleep 5

echo -e "\n6. Performing a functional test..."
echo "Sending request to Envoy proxy..."
curl -s -v "http://localhost:10000/headers" 2>&1 | grep -E "< HTTP|< X-Wasm-Processed" | head -5
echo ""
echo "If you see 'X-Wasm-Processed: Yes' above, the Wasm filter is working!"

echo -e "\n7. Instructions for performance test:"
echo "   Run: python3 tests/benchmark.py --url http://localhost:10000/headers -n 2000 -c 100"
echo "   Or use 'wrk': wrk -t4 -c100 -d30s http://localhost:10000/headers"

# 假设项目已存在于当前目录
cd service-mesh-wasm-demo

# 为 run.sh 添加执行权限
chmod +x run.sh
# 执行脚本，它将完成构建、打包和运行
./run.sh

# 1. 构建Wasm模块
cargo build --target wasm32-unknown-unknown --release

# 2. 构建Docker镜像
docker build -t envoy-wasm-demo .

# 3. 运行容器
docker run -d --name envoy-wasm -p 10000:10000 -p 9901:9901 envoy-wasm-demo

# 4. 验证服务是否运行
curl -v http://localhost:10000/headers

curl -s -v "http://localhost:10000/headers" 2>&1 | grep -E "X-Wasm-Processed"

# 安装Python依赖（如果需要）
pip install aiohttp

# 运行基准测试，发送2000个请求，并发100
python3 tests/benchmark.py --url http://localhost:10000/headers -n 2000 -c 100