December 2023 Summaries

The data plane is a crucial component in modern cloud architectures, responsible for the actual processing of data that is farmed out by the control plane to accomplish some task for the distributed system. In cloud networking, it handles the movement of data packets within and between cloud environments, executing routing decisions provided by the control plane and managing data flow across the network's physical and virtual infrastructure with high efficiency and speed. The data plane also encompasses various other functions critical to network performance, including traffic filtering, load balancing at the packet level, and QoS management. Additionally, it plays a key role in database as a service systems, running the actual database engine software that stores and processes underlying data, and analytics systems, processing vast amounts of operational data stored across various OLAP or Data Warehouse systems. The security of the data plane is also essential to protect against data breaches and unauthorized access, employing techniques such as encryption, intrusion detection systems, authentication, and authorization. Overall, the data plane is an integral part of modern cloud architecture, making it essential for the smooth operation and reliability of cloud distributed systems.

ngrok has introduced a User Agent Filter module that allows users to filter traffic destined for upstream services based on the value of the HTTP <code>user-agent</code> request header. A User Agent is any application that can interact with another application on behalf of an end user, including applications, bots, and command line tools. The `user-agent` HTTP header includes information about the application making the request, such as its type, operating system, software vendor name, and software version. Filtering based on the UA string allows users to exclude bots and crawlers from gaining access to their service without modifying their application code. The User Agent Filter module uses regular expression rules to match the value against a list of `allow` and `deny` rules, allowing users to control access to their services by blocking or allowing specific user agents. Users can define these rules in various ways, including through the ngrok agent configuration file, SDKs, or the Ingress Controller for Kubernetes.

Ngrok recently revamped its firewall system, introducing the Firewall Next-Generation (FWNG) to enhance global infrastructure protection and customer security. This new system aggregates network telemetry data from various sources, such as the NetObserv eBPF Agent and application metrics, at a centralized control plane rather than within individual regions, enabling a consistent global traffic policy application. By doing so, ngrok can efficiently track and mitigate distributed network attacks and maintain rate limits across all regions, ensuring a synchronized response to threats. The Firewall Toolkit, developed to facilitate this process, leverages Google's nftables Go library to ergonomically create and update network policies, with plans to incorporate eBPF filters for enhanced performance. Ngrok has made the Firewall Toolkit open-source, inviting the community to contribute as it continues to refine and expand its firewall capabilities.

Ngrok-python is an open-source SDK designed to seamlessly integrate secure ingress into Python applications, allowing developers to serve apps through ngrok's global network with minimal configuration. By packaging the ngrok agent as a Python library, it simplifies complex network setups, eliminating the need for reverse proxies and load balancers. This SDK enhances security by blocking unauthorized requests at the edge and provides multiple traffic forwarding options to accommodate various frameworks and environments. Ngrok-python's high-level abstraction alleviates the burden of managing low-level networking components, enabling developers to focus on core functionalities while ensuring performance, security, and resilience. It offers easy installation via pip, supports standard Python logging, and integrates smoothly with popular frameworks like AIOHTTP, Flask, and Uvicorn. The library's design and features have been validated through collaboration with open-source communities, exemplified by its integration with the Stable Diffusion Web UI.

Ngrok-javascript is a newly introduced, open-source Node.js library designed to streamline the process of adding secure ingress to JavaScript and TypeScript applications. It allows developers to expose their services to the internet with a single line of code, avoiding the complexities of managing traditional network components like IPs, NATs, and load balancers. By utilizing ngrok's global ingress network, developers can establish secure, persistent connections that block unauthorized requests, thus maintaining high security and control without delving into low-level networking intricacies. This library supports portability across various environments, eliminating the need for separate ingress configurations and sidecar processes, thereby simplifying application deployment across platforms like AWS, Kubernetes, and even local machines. Designed for seamless integration into the JavaScript and TypeScript ecosystems, ngrok-javascript can be easily installed via npm and offers out-of-the-box support for popular frameworks and logging tools, making it an efficient solution for developers seeking to focus on core business logic while ensuring high performance and resilience.