From 8e1a0e78d1a0c0ed616d3f8d7f3b6e78e5e6168e Mon Sep 17 00:00:00 2001
From: Jonas Berlin <xkr47@outerspace.dyndns.org>
Date: Mon, 28 Oct 2024 11:22:46 +0200
Subject: [PATCH 01/69] feat: Promote `rpxy-lib/sticky-cookie` to top-level
 feature

.. and fix compile warnings when disabled
---
 rpxy-bin/Cargo.toml                                 | 13 ++++++-------
 .../src/backend/load_balance/load_balance_main.rs   |  2 --
 rpxy-lib/src/backend/load_balance/mod.rs            |  2 ++
 rpxy-lib/src/message_handler/handler_main.rs        |  4 ++--
 rpxy-lib/src/message_handler/utils_headers.rs       |  4 +++-
 5 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 50173fe..aa0b7b7 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -13,10 +13,10 @@ publish.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [features]
-# default = ["http3-quinn", "cache", "rustls-backend", "acme", "post-quantum"]
-# default = ["http3-s2n", "cache", "rustls-backend", "acme", "post-quantum"]
-default = ["http3-quinn", "cache", "rustls-backend", "acme"]
-# default = ["http3-s2n", "cache", "rustls-backend", "acme"]
+# default = ["http3-quinn", "cache", "rustls-backend", "acme", "sticky-cookie", "post-quantum"]
+# default = ["http3-s2n", "cache", "rustls-backend", "acme", "sticky-cookie", "post-quantum"]
+default = ["http3-quinn", "cache", "rustls-backend", "acme", "sticky-cookie"]
+# default = ["http3-s2n", "cache", "rustls-backend", "acme", "sticky-cookie"]
 http3-quinn = ["rpxy-lib/http3-quinn"]
 http3-s2n = ["rpxy-lib/http3-s2n"]
 native-tls-backend = ["rpxy-lib/native-tls-backend"]
@@ -25,11 +25,10 @@ webpki-roots = ["rpxy-lib/webpki-roots"]
 cache = ["rpxy-lib/cache"]
 acme = ["rpxy-lib/acme", "rpxy-acme"]
 post-quantum = ["rpxy-lib/post-quantum"]
+sticky-cookie = ["rpxy-lib/sticky-cookie"]
 
 [dependencies]
-rpxy-lib = { path = "../rpxy-lib/", default-features = false, features = [
-  "sticky-cookie",
-] }
+rpxy-lib = { path = "../rpxy-lib/", default-features = false }
 
 mimalloc = { version = "*", default-features = false }
 anyhow = "1.0.91"
diff --git a/rpxy-lib/src/backend/load_balance/load_balance_main.rs b/rpxy-lib/src/backend/load_balance/load_balance_main.rs
index 0b3eff8..9cce980 100644
--- a/rpxy-lib/src/backend/load_balance/load_balance_main.rs
+++ b/rpxy-lib/src/backend/load_balance/load_balance_main.rs
@@ -131,6 +131,4 @@ impl LoadBalance {
 pub struct LoadBalanceContext {
   #[cfg(feature = "sticky-cookie")]
   pub sticky_cookie: StickyCookie,
-  #[cfg(not(feature = "sticky-cookie"))]
-  pub sticky_cookie: (),
 }
diff --git a/rpxy-lib/src/backend/load_balance/mod.rs b/rpxy-lib/src/backend/load_balance/mod.rs
index 38d312b..c32ca65 100644
--- a/rpxy-lib/src/backend/load_balance/mod.rs
+++ b/rpxy-lib/src/backend/load_balance/mod.rs
@@ -4,6 +4,7 @@ mod load_balance_sticky;
 #[cfg(feature = "sticky-cookie")]
 mod sticky_cookie;
 
+#[cfg(feature = "sticky-cookie")]
 use super::upstream::Upstream;
 use thiserror::Error;
 
@@ -16,6 +17,7 @@ pub use load_balance_sticky::LoadBalanceStickyBuilder;
 pub use sticky_cookie::{StickyCookie, StickyCookieValue};
 
 /// Result type for load balancing
+#[cfg(feature = "sticky-cookie")]
 type LoadBalanceResult<T> = std::result::Result<T, LoadBalanceError>;
 /// Describes things that can go wrong in the Load Balance
 #[derive(Debug, Error)]
diff --git a/rpxy-lib/src/message_handler/handler_main.rs b/rpxy-lib/src/message_handler/handler_main.rs
index 4b324df..2b803a8 100644
--- a/rpxy-lib/src/message_handler/handler_main.rs
+++ b/rpxy-lib/src/message_handler/handler_main.rs
@@ -6,7 +6,7 @@ use super::{
   utils_request::InspectParseHost,
 };
 use crate::{
-  backend::{BackendAppManager, LoadBalanceContext},
+  backend::BackendAppManager,
   error::*,
   forwarder::{ForwardRequest, Forwarder},
   globals::Globals,
@@ -25,7 +25,7 @@ use tokio::io::copy_bidirectional;
 /// Context object to handle sticky cookies at HTTP message handler
 pub(super) struct HandlerContext {
   #[cfg(feature = "sticky-cookie")]
-  pub(super) context_lb: Option<LoadBalanceContext>,
+  pub(super) context_lb: Option<crate::backend::LoadBalanceContext>,
   #[cfg(not(feature = "sticky-cookie"))]
   pub(super) context_lb: Option<()>,
 }
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index d058f88..afe6463 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -3,7 +3,7 @@ use crate::{
   backend::{UpstreamCandidates, UpstreamOption},
   log::*,
 };
-use anyhow::{anyhow, ensure, Result};
+use anyhow::{anyhow, Result};
 use bytes::BufMut;
 use http::{header, HeaderMap, HeaderName, HeaderValue, Uri};
 use std::{borrow::Cow, net::SocketAddr};
@@ -22,6 +22,8 @@ pub(super) fn takeout_sticky_cookie_lb_context(
   headers: &mut HeaderMap,
   expected_cookie_name: &str,
 ) -> Result<Option<LoadBalanceContext>> {
+  use anyhow::ensure;
+
   let mut headers_clone = headers.clone();
 
   match headers_clone.entry(header::COOKIE) {

From bbba70f47c0afc3dc5b4c2e50483e4f847e5e5aa Mon Sep 17 00:00:00 2001
From: Lyamc <lyamcwitherow@gmail.com>
Date: Sat, 12 Apr 2025 14:54:31 -0600
Subject: [PATCH 02/69] Update .gitmodules to use HTTPS instead of SSH

---
 .gitmodules | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.gitmodules b/.gitmodules
index a8c5d14..b2635b4 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,10 +1,10 @@
 [submodule "submodules/rusty-http-cache-semantics"]
-	path = submodules/rusty-http-cache-semantics
-	url = git@github.com:junkurihara/rusty-http-cache-semantics.git
+        path = submodules/rusty-http-cache-semantics
+        url = https://github.com/junkurihara/rusty-http-cache-semantics.git
 [submodule "submodules/rustls-acme"]
-	path = submodules/rustls-acme
-	url = git@github.com:junkurihara/rustls-acme.git
+        path = submodules/rustls-acme
+        url = https://github.com/junkurihara/rustls-acme.git
 [submodule "submodules/s2n-quic"]
-	path = submodules/s2n-quic
-	url = git@github.com:junkurihara/s2n-quic.git
-	branch = rustls-pq
+        path = submodules/s2n-quic
+        url = https://github.com/junkurihara/s2n-quic.git
+        branch = rustls-pq

From 7438f70381b3ee1b385b840bdf750084c8d5fad2 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Thu, 1 May 2025 09:43:43 +0900
Subject: [PATCH 03/69] deps

---
 Cargo.lock          | 36 ++++++++++++++++++------------------
 rpxy-lib/Cargo.toml |  2 +-
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a81530c..1efc653 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1032,9 +1032,9 @@ checksum = "74721d007512d0cb3338cd20f0654ac913920061a4c4d0d8708edb3f2a698c0c"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.2"
+version = "0.15.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
 dependencies = [
  "allocator-api2",
  "equivalent",
@@ -1747,9 +1747,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.107"
+version = "0.9.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8288979acd84749c744a9014b4382d42b8f7b2592847b5afb2ed29e5d16ede07"
+checksum = "e145e1651e858e820e4860f7b9c5e169bc1d8ce1c86043be79fa7b7634821847"
 dependencies = [
  "cc",
  "libc",
@@ -1914,9 +1914,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.11"
+version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "541d0f57c6ec747a90738a52741d3221f7960e8ac2f0ff4b1a63680e033b4ab5"
+checksum = "ee4e529991f949c5e25755532370b8af5d114acae52326361d68d47af64aa842"
 dependencies = [
  "cfg_aliases",
  "libc",
@@ -2233,9 +2233,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.5"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d97817398dd4bb2e6da002002db259209759911da105da92bec29ccb12cf58bf"
+checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
 dependencies = [
  "bitflags",
  "errno",
@@ -2641,9 +2641,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -2727,9 +2727,9 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2745,7 +2745,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.3.2",
  "once_cell",
- "rustix 1.0.5",
+ "rustix 1.0.7",
  "windows-sys 0.59.0",
 ]
 
@@ -2755,7 +2755,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45c6481c4829e4cc63825e62c49186a34538b7b2750b73b266581ffb612fb5ed"
 dependencies = [
- "rustix 1.0.5",
+ "rustix 1.0.7",
  "windows-sys 0.59.0",
 ]
 
@@ -3238,18 +3238,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "0.26.9"
+version = "0.26.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180d2741b6115c3d906577e6533ad89472d48d96df00270fccb78233073d77f7"
+checksum = "c99403924bc5f23afefc319b8ac67ed0e50669f6e52a413314cccb1fdbc93ba0"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.9"
+version = "0.26.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29aad86cec885cafd03e8305fd727c418e970a521322c91688414d5b8efba16b"
+checksum = "37493cadf42a2a939ed404698ded7fb378bf301b5011f973361779a3a74f8c93"
 dependencies = [
  "rustls-pki-types",
 ]
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 8cfad09..7e96bd4 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -109,7 +109,7 @@ socket2 = { version = "0.5.9", features = ["all"], optional = true }
 # cache
 http-cache-semantics = { path = "../submodules/rusty-http-cache-semantics", default-features = false, optional = true }
 lru = { version = "0.14.0", optional = true }
-sha2 = { version = "0.10.8", default-features = false, optional = true }
+sha2 = { version = "0.10.9", default-features = false, optional = true }
 
 # cookie handling for sticky cookie
 chrono = { version = "0.4.41", default-features = false, features = [

From 67e78041b416b4688afdf4e9617e1dc84fe9e65a Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 6 May 2025 23:51:04 +0900
Subject: [PATCH 04/69] deps

---
 Cargo.lock            | 74 +++++++++++++++++++++++++++----------------
 rpxy-acme/Cargo.toml  |  6 ++--
 rpxy-bin/Cargo.toml   |  2 +-
 rpxy-certs/Cargo.toml |  6 ++--
 rpxy-lib/Cargo.toml   |  4 +--
 5 files changed, 55 insertions(+), 37 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1efc653..8bae735 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -275,7 +275,7 @@ dependencies = [
  "log",
  "rustls-pki-types",
  "thiserror 1.0.69",
- "webpki-roots",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -406,9 +406,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.20"
+version = "1.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04da6a0d40b948dfc4fa8f5bbf402b0fc1a64a28dbf7d12ffd683550f2c1b63a"
+checksum = "8691782945451c1c383942c4874dbe63814f61cb57ef773cda2972682b7bb3c0"
 dependencies = [
  "jobserver",
  "libc",
@@ -978,9 +978,9 @@ checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "h2"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75249d144030531f8dee69fe9cea04d3edf809a017ae445e2abdff6629e86633"
+checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1172,7 +1172,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -1492,9 +1492,9 @@ dependencies = [
 
 [[package]]
 name = "libm"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9627da5196e5d8ed0b0495e61e518847578da83483c37288316d9b2e03a7f72"
+checksum = "a25169bd5913a4b437588a7e3d127cd6e90127b60e0ffbd834a38f1599e016b8"
 
 [[package]]
 name = "libmimalloc-sys"
@@ -2246,9 +2246,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.26"
+version = "0.23.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df51b5869f3a441595eac5e8ff14d486ff285f7b8c0df8770e49c3b56351f0f0"
+checksum = "730944ca083c1c233a75c09f199e973ca499344a2b7ba9e755c457e86fb4a321"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -2280,7 +2280,7 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror 2.0.12",
- "webpki-roots",
+ "webpki-roots 0.26.11",
  "x509-parser",
 ]
 
@@ -2316,9 +2316,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4937d110d34408e9e5ad30ba0b0ca3b6a8a390f8db3636db60144ac4fa792750"
+checksum = "19787cda76408ec5404443dc8b31795c87cd8fec49762dc75fa727740d34acc1"
 dependencies = [
  "core-foundation 0.10.0",
  "core-foundation-sys",
@@ -2331,7 +2331,7 @@ dependencies = [
  "rustls-webpki",
  "security-framework 3.2.0",
  "security-framework-sys",
- "webpki-root-certs",
+ "webpki-root-certs 0.26.11",
  "windows-sys 0.59.0",
 ]
 
@@ -2352,9 +2352,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.1"
+version = "0.103.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fef8b8769aaccf73098557a87cd1816b4f9c7c16811c9c77142aa695c16f2c03"
+checksum = "7149975849f1abb3832b246010ef62ccc80d3a76169517ada7188252b9cfb437"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -2513,9 +2513,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls"
-version = "0.3.17"
+version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a05886fe90b529c7ffef6b8b5542e26e21e3b0e66612673395c7ecedde0e30"
+checksum = "e1c2355bbfcccc93a61d56a8e8b8a22325a5c68b693ddeba904a5aa293cc66c8"
 dependencies = [
  "errno",
  "hex",
@@ -2526,9 +2526,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls-sys"
-version = "0.3.17"
+version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c69b480e275a5c3016307c589f2f71bbf9ea21c102e7ce3c19316d908bf0c21f"
+checksum = "65818edc12b815a4b2140a6a031f6e5fe3a59b31c28d7f01835b9aa38654f81f"
 dependencies = [
  "aws-lc-rs",
  "cc",
@@ -2867,9 +2867,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.44.2"
+version = "1.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
+checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
 dependencies = [
  "backtrace",
  "bytes",
@@ -3238,18 +3238,36 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "0.26.10"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c99403924bc5f23afefc319b8ac67ed0e50669f6e52a413314cccb1fdbc93ba0"
+checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
+dependencies = [
+ "webpki-root-certs 1.0.0",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a83f7e1a9f8712695c03eabe9ed3fbca0feff0152f33f12593e5a6303cb1a4"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.10"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37493cadf42a2a939ed404698ded7fb378bf301b5011f973361779a3a74f8c93"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.0",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2853738d1cc4f2da3a225c18ec6c3721abb31961096e9dbf5ab35fa88b19cfdb"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -3506,9 +3524,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.7.7"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb8234a863ea0e8cd7284fcdd4f145233eb00fee02bbdd9861aec44e6477bc5"
+checksum = "d9fb597c990f03753e08d3c29efbfcf2019a003b4bf4ba19225c158e1549f0f3"
 dependencies = [
  "memchr",
 ]
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index f33fd19..a10395a 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -24,15 +24,15 @@ aws-lc-rs = { version = "1.13.0", default-features = false, features = [
   "aws-lc-sys",
 ] }
 blocking = "1.6.1"
-rustls = { version = "0.23.26", default-features = false, features = [
+rustls = { version = "0.23.27", default-features = false, features = [
   "std",
   "aws_lc_rs",
 ] }
-rustls-platform-verifier = { version = "0.5.2" }
+rustls-platform-verifier = { version = "0.5.3" }
 rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, features = [
   "aws-lc-rs",
 ] }
 rustls-post-quantum = { version = "0.2.2", optional = true }
-tokio = { version = "1.44.2", default-features = false }
+tokio = { version = "1.45.0", default-features = false }
 tokio-util = { version = "0.7.15", default-features = false }
 tokio-stream = { version = "0.1.17", default-features = false }
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 16c6916..6e52772 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -35,7 +35,7 @@ libmimalloc-sys = { version = "=0.1.40" }
 anyhow = "1.0.98"
 ahash = "0.8.11"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }
-tokio = { version = "1.44.2", default-features = false, features = [
+tokio = { version = "1.45.0", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index 2bad8fc..712d31a 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -22,12 +22,12 @@ derive_builder = { version = "0.20.2" }
 thiserror = { version = "2.0.12" }
 hot_reload = { version = "0.1.9" }
 async-trait = { version = "0.1.88" }
-rustls = { version = "0.23.26", default-features = false, features = [
+rustls = { version = "0.23.27", default-features = false, features = [
   "std",
   "aws_lc_rs",
 ] }
 rustls-pemfile = { version = "2.2.0" }
-rustls-webpki = { version = "0.103.1", default-features = false, features = [
+rustls-webpki = { version = "0.103.2", default-features = false, features = [
   "std",
   "aws-lc-rs",
 ] }
@@ -35,7 +35,7 @@ rustls-post-quantum = { version = "0.2.2", optional = true }
 x509-parser = { version = "0.17.0" }
 
 [dev-dependencies]
-tokio = { version = "1.44.2", default-features = false, features = [
+tokio = { version = "1.45.0", default-features = false, features = [
   "rt-multi-thread",
   "macros",
 ] }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 7e96bd4..f7520a4 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -41,7 +41,7 @@ ahash = "0.8.11"
 bytes = "1.10.1"
 derive_builder = "0.20.2"
 futures = { version = "0.3.31", features = ["alloc", "async-await"] }
-tokio = { version = "1.44.2", default-features = false, features = [
+tokio = { version = "1.45.0", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",
@@ -80,7 +80,7 @@ hyper-rustls = { version = "0.27.5", default-features = false, features = [
 # tls and cert management for server
 rpxy-certs = { path = "../rpxy-certs/", default-features = false }
 hot_reload = "0.1.9"
-rustls = { version = "0.23.26", default-features = false }
+rustls = { version = "0.23.27", default-features = false }
 rustls-post-quantum = { version = "0.2.2", optional = true }
 tokio-rustls = { version = "0.26.2", features = ["early-data"] }
 

From 9e743b0dca4fbb24d301572ac17288f93e4f60c8 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 7 May 2025 11:22:30 +0900
Subject: [PATCH 05/69] wip: h3-0.0.8

---
 Cargo.lock                     | 24 +++++++++++++++++++-----
 rpxy-lib/Cargo.toml            |  4 ++--
 rpxy-lib/src/error.rs          |  7 +++++--
 rpxy-lib/src/proxy/proxy_h3.rs | 15 ++++++++++-----
 4 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 8bae735..46120eb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1000,6 +1000,20 @@ name = "h3"
 version = "0.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dfb059a4f28a66f186ed16ad912d142f490676acba59353831d7cb45a96b0d3"
+dependencies = [
+ "bytes",
+ "fastrand",
+ "futures-util",
+ "http",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "h3"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10872b55cfb02a821b69dc7cf8dc6a71d6af25eb9a79662bec4a9d016056b3be"
 dependencies = [
  "bytes",
  "fastrand",
@@ -1012,13 +1026,13 @@ dependencies = [
 
 [[package]]
 name = "h3-quinn"
-version = "0.0.9"
+version = "0.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d482318ae94198fc8e3cbb0b7ba3099c865d744e6ec7c62039ca7b6b6c66fbf"
+checksum = "8b2e732c8d91a74731663ac8479ab505042fbf547b9a207213ab7fbcbfc4f8b4"
 dependencies = [
  "bytes",
  "futures",
- "h3",
+ "h3 0.0.8",
  "quinn",
  "tokio",
  "tokio-util",
@@ -2159,7 +2173,7 @@ dependencies = [
  "futures",
  "futures-channel",
  "futures-util",
- "h3",
+ "h3 0.0.8",
  "h3-quinn",
  "hot_reload",
  "http",
@@ -2443,7 +2457,7 @@ version = "0.1.0"
 dependencies = [
  "bytes",
  "futures",
- "h3",
+ "h3 0.0.7",
  "s2n-quic",
  "tracing",
 ]
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index f7520a4..6b1c76d 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -92,8 +92,8 @@ tracing = { version = "0.1.41" }
 
 # http/3
 quinn = { version = "0.11.7", optional = true }
-h3 = { version = "0.0.7", features = ["tracing"], optional = true }
-h3-quinn = { version = "0.0.9", optional = true }
+h3 = { version = "0.0.8", features = ["tracing"], optional = true }
+h3-quinn = { version = "0.0.10", optional = true }
 s2n-quic = { version = "1.57.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
   "provider-tls-rustls",
 ], optional = true }
diff --git a/rpxy-lib/src/error.rs b/rpxy-lib/src/error.rs
index 20470ed..4554cb7 100644
--- a/rpxy-lib/src/error.rs
+++ b/rpxy-lib/src/error.rs
@@ -37,8 +37,11 @@ pub enum RpxyError {
 
   // http/3 errors
   #[cfg(any(feature = "http3-quinn", feature = "http3-s2n"))]
-  #[error("H3 error: {0}")]
-  H3Error(#[from] h3::Error),
+  #[error("h3 connection error: {0}")]
+  H3ConnectionError(#[from] h3::error::ConnectionError),
+  #[cfg(any(feature = "http3-quinn", feature = "http3-s2n"))]
+  #[error("h3 connection error: {0}")]
+  H3StreamError(#[from] h3::error::StreamError),
   // #[cfg(feature = "http3-s2n")]
   // #[error("H3 error: {0}")]
   // H3Error(#[from] s2n_quic_h3::h3::Error),
diff --git a/rpxy-lib/src/proxy/proxy_h3.rs b/rpxy-lib/src/proxy/proxy_h3.rs
index 3d5143f..acfe07d 100644
--- a/rpxy-lib/src/proxy/proxy_h3.rs
+++ b/rpxy-lib/src/proxy/proxy_h3.rs
@@ -49,12 +49,17 @@ where
         }
         Err(e) => {
           warn!("HTTP/3 error on accept incoming connection: {}", e);
-          match e.get_error_level() {
-            h3::error::ErrorLevel::ConnectionError => break,
-            h3::error::ErrorLevel::StreamError => continue,
-          }
+          break;
         }
-        Ok(Some((req, stream))) => {
+        // Ok(Some((req, stream))) => {
+        Ok(Some(req_resolver)) => {
+          let (req, stream) = match req_resolver.resolve_request().await {
+            Ok((req, stream)) => (req, stream),
+            Err(e) => {
+              warn!("HTTP/3 error on resolve request in stream: {}", e);
+              continue;
+            }
+          };
           // We consider the connection count separately from the stream count.
           // Max clients for h1/h2 = max 'stream' for h3.
           let request_count = self.globals.request_count.clone();

From df3792f87f97a69e1d074f3a8884dbd43fcf9593 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 7 May 2025 12:33:58 +0900
Subject: [PATCH 06/69] deps: h3-0.0.8

---
 Cargo.lock          | 20 +++-----------------
 rpxy-bin/Cargo.toml |  4 ++--
 submodules/s2n-quic |  2 +-
 3 files changed, 6 insertions(+), 20 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 46120eb..e0ab8a1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -995,20 +995,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "h3"
-version = "0.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfb059a4f28a66f186ed16ad912d142f490676acba59353831d7cb45a96b0d3"
-dependencies = [
- "bytes",
- "fastrand",
- "futures-util",
- "http",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "h3"
 version = "0.0.8"
@@ -1032,7 +1018,7 @@ checksum = "8b2e732c8d91a74731663ac8479ab505042fbf547b9a207213ab7fbcbfc4f8b4"
 dependencies = [
  "bytes",
  "futures",
- "h3 0.0.8",
+ "h3",
  "quinn",
  "tokio",
  "tokio-util",
@@ -2173,7 +2159,7 @@ dependencies = [
  "futures",
  "futures-channel",
  "futures-util",
- "h3 0.0.8",
+ "h3",
  "h3-quinn",
  "hot_reload",
  "http",
@@ -2457,7 +2443,7 @@ version = "0.1.0"
 dependencies = [
  "bytes",
  "futures",
- "h3 0.0.7",
+ "h3",
  "s2n-quic",
  "tracing",
 ]
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 6e52772..911aadb 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -13,8 +13,8 @@ publish.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [features]
-default = ["http3-quinn", "cache", "rustls-backend", "acme", "post-quantum"]
-# default = ["http3-s2n", "cache", "rustls-backend", "acme", "post-quantum"]
+# default = ["http3-quinn", "cache", "rustls-backend", "acme", "post-quantum"]
+default = ["http3-s2n", "cache", "rustls-backend", "acme", "post-quantum"]
 http3-quinn = ["rpxy-lib/http3-quinn"]
 http3-s2n = ["rpxy-lib/http3-s2n"]
 native-tls-backend = ["rpxy-lib/native-tls-backend"]
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index f9d0c4f..4ef7425 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit f9d0c4feb83160b6fe66fe34da76c443fc2b381c
+Subproject commit 4ef74256bcf8d04e218d88bb72856da332d3e8c2

From 500ab56c10b5dd581e94b97f8e969f1480d7852e Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 7 May 2025 12:37:24 +0900
Subject: [PATCH 07/69] fix default

---
 rpxy-bin/Cargo.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 911aadb..6e52772 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -13,8 +13,8 @@ publish.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [features]
-# default = ["http3-quinn", "cache", "rustls-backend", "acme", "post-quantum"]
-default = ["http3-s2n", "cache", "rustls-backend", "acme", "post-quantum"]
+default = ["http3-quinn", "cache", "rustls-backend", "acme", "post-quantum"]
+# default = ["http3-s2n", "cache", "rustls-backend", "acme", "post-quantum"]
 http3-quinn = ["rpxy-lib/http3-quinn"]
 http3-s2n = ["rpxy-lib/http3-s2n"]
 native-tls-backend = ["rpxy-lib/native-tls-backend"]

From 50442376887cf277f5793a9994e1e6cfad801f20 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 7 May 2025 18:59:38 +0900
Subject: [PATCH 08/69] deps

---
 Cargo.lock          | 12 ++++++------
 submodules/s2n-quic |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e0ab8a1..a5a0f29 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -316,9 +316,9 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.74"
+version = "0.3.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
 dependencies = [
  "addr2line",
  "cfg-if",
@@ -1492,9 +1492,9 @@ dependencies = [
 
 [[package]]
 name = "libm"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a25169bd5913a4b437588a7e3d127cd6e90127b60e0ffbd834a38f1599e016b8"
+checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 
 [[package]]
 name = "libmimalloc-sys"
@@ -3524,9 +3524,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9fb597c990f03753e08d3c29efbfcf2019a003b4bf4ba19225c158e1549f0f3"
+checksum = "c06928c8748d81b05c9be96aad92e1b6ff01833332f281e8cfca3be4b35fc9ec"
 dependencies = [
  "memchr",
 ]
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index 4ef7425..a4e601d 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit 4ef74256bcf8d04e218d88bb72856da332d3e8c2
+Subproject commit a4e601db45c1de09a088ca3c021e73c32760dfb7

From 669e2bf00b2f8c35312373c9423536f17d004129 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 7 May 2025 20:01:03 +0900
Subject: [PATCH 09/69] chore: refactor dockerfile-slim

---
 docker/Dockerfile-slim | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docker/Dockerfile-slim b/docker/Dockerfile-slim
index b58a408..b0ef5b1 100644
--- a/docker/Dockerfile-slim
+++ b/docker/Dockerfile-slim
@@ -5,7 +5,7 @@ LABEL maintainer="Jun Kurihara"
 
 ARG TARGETARCH
 ARG CARGO_FEATURES
-ENV CARGO_FEATURES ${CARGO_FEATURES}
+ENV CARGO_FEATURES=${CARGO_FEATURES}
 
 RUN if [ $TARGETARCH = "amd64" ]; then \
   echo "x86_64" > /arch; \
@@ -22,7 +22,7 @@ WORKDIR /tmp
 
 COPY . /tmp/
 
-ENV RUSTFLAGS "-C link-arg=-s"
+ENV RUSTFLAGS="-C link-arg=-s"
 
 RUN echo "Building rpxy from source" && \
   cargo update && \
@@ -34,7 +34,7 @@ RUN echo "Building rpxy from source" && \
 FROM --platform=$TARGETPLATFORM alpine:latest AS runner
 LABEL maintainer="Jun Kurihara"
 
-ENV RUNTIME_DEPS logrotate ca-certificates su-exec
+ENV RUNTIME_DEPS="logrotate ca-certificates su-exec"
 
 RUN apk add --no-cache ${RUNTIME_DEPS} && \
   update-ca-certificates && \

From b558c882f3f2c7fb8dc458c90f38d86906252967 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 May 2025 22:05:39 +0000
Subject: [PATCH 10/69] chore(deps): bump ahash from 0.8.11 to 0.8.12

Bumps [ahash](https://github.com/tkaitchuck/ahash) from 0.8.11 to 0.8.12.
- [Release notes](https://github.com/tkaitchuck/ahash/releases)
- [Commits](https://github.com/tkaitchuck/ahash/commits)

---
updated-dependencies:
- dependency-name: ahash
  dependency-version: 0.8.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock            | 38 +++++++++-----------------------------
 rpxy-acme/Cargo.toml  |  2 +-
 rpxy-bin/Cargo.toml   |  2 +-
 rpxy-certs/Cargo.toml |  2 +-
 rpxy-lib/Cargo.toml   |  2 +-
 5 files changed, 13 insertions(+), 33 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a5a0f29..9bf59ab 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -19,15 +19,15 @@ checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
 [[package]]
 name = "ahash"
-version = "0.8.11"
+version = "0.8.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
  "cfg-if",
- "getrandom 0.2.16",
+ "getrandom 0.3.2",
  "once_cell",
  "version_check",
- "zerocopy 0.7.35",
+ "zerocopy",
 ]
 
 [[package]]
@@ -1842,7 +1842,7 @@ version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
- "zerocopy 0.8.25",
+ "zerocopy",
 ]
 
 [[package]]
@@ -2380,7 +2380,7 @@ version = "0.57.0"
 dependencies = [
  "byteorder",
  "bytes",
- "zerocopy 0.8.25",
+ "zerocopy",
 ]
 
 [[package]]
@@ -2402,7 +2402,7 @@ dependencies = [
  "s2n-quic-tls-default",
  "s2n-quic-transport",
  "tokio",
- "zerocopy 0.8.25",
+ "zerocopy",
  "zeroize",
 ]
 
@@ -2422,7 +2422,7 @@ dependencies = [
  "pin-project-lite",
  "s2n-codec",
  "subtle",
- "zerocopy 0.8.25",
+ "zerocopy",
 ]
 
 [[package]]
@@ -3602,33 +3602,13 @@ dependencies = [
  "synstructure",
 ]
 
-[[package]]
-name = "zerocopy"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
-dependencies = [
- "zerocopy-derive 0.7.35",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.8.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb"
 dependencies = [
- "zerocopy-derive 0.8.25",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "zerocopy-derive",
 ]
 
 [[package]]
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index a10395a..cb7a5a2 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -15,7 +15,7 @@ post-quantum = ["rustls-post-quantum"]
 
 [dependencies]
 url = { version = "2.5.4" }
-ahash = "0.8.11"
+ahash = "0.8.12"
 thiserror = "2.0.12"
 tracing = "0.1.41"
 async-trait = "0.1.88"
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 6e52772..a99de63 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -33,7 +33,7 @@ rpxy-lib = { path = "../rpxy-lib/", default-features = false, features = [
 mimalloc = { version = "=0.1.44", default-features = false }
 libmimalloc-sys = { version = "=0.1.40" }
 anyhow = "1.0.98"
-ahash = "0.8.11"
+ahash = "0.8.12"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }
 tokio = { version = "1.45.0", default-features = false, features = [
   "net",
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index 712d31a..90b15e6 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -16,7 +16,7 @@ post-quantum = ["rustls-post-quantum"]
 http3 = []
 
 [dependencies]
-ahash = { version = "0.8.11" }
+ahash = { version = "0.8.12" }
 tracing = { version = "0.1.41" }
 derive_builder = { version = "0.20.2" }
 thiserror = { version = "2.0.12" }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 6b1c76d..3b14531 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -37,7 +37,7 @@ post-quantum = [
 
 [dependencies]
 rand = "0.9.1"
-ahash = "0.8.11"
+ahash = "0.8.12"
 bytes = "1.10.1"
 derive_builder = "0.20.2"
 futures = { version = "0.3.31", features = ["alloc", "async-await"] }

From bbde3ff4f3826deaff113a1e9dba70df4dd06637 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 8 May 2025 22:05:50 +0000
Subject: [PATCH 11/69] chore(deps): bump aws-lc-rs from 1.13.0 to 1.13.1

Bumps [aws-lc-rs](https://github.com/aws/aws-lc-rs) from 1.13.0 to 1.13.1.
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](https://github.com/aws/aws-lc-rs/compare/v1.13.0...v1.13.1)

---
updated-dependencies:
- dependency-name: aws-lc-rs
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock           | 8 ++++----
 rpxy-acme/Cargo.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a5a0f29..914c3e2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -292,9 +292,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b756939cb2f8dc900aa6dcd505e6e2428e9cae7ff7b028c49e3946efa70878"
+checksum = "93fcc8f365936c834db5514fc45aee5b1202d677e6b40e48468aaaa8183ca8c7"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -303,9 +303,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.28.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa9b6986f250236c27e5a204062434a773a13243d2ffc2955f37bdba4c5c6a1"
+checksum = "61b1d86e7705efe1be1b569bab41d4fa1e14e220b60a160f78de2db687add079"
 dependencies = [
  "bindgen",
  "cc",
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index a10395a..73c44d9 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -20,7 +20,7 @@ thiserror = "2.0.12"
 tracing = "0.1.41"
 async-trait = "0.1.88"
 base64 = "0.22.1"
-aws-lc-rs = { version = "1.13.0", default-features = false, features = [
+aws-lc-rs = { version = "1.13.1", default-features = false, features = [
   "aws-lc-sys",
 ] }
 blocking = "1.6.1"

From 31b6817e2328c240d359fe7f10c4c804247d8585 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 9 May 2025 11:39:51 +0900
Subject: [PATCH 12/69] deps: s2n-quic

---
 Cargo.lock          | 171 +++++++++++++++++++-------------------------
 rpxy-lib/Cargo.toml |   6 +-
 submodules/s2n-quic |   2 +-
 3 files changed, 78 insertions(+), 101 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ca8f3c2..0ee23d9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1237,21 +1237,22 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "1.5.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
 dependencies = [
  "displaydoc",
+ "potential_utf",
  "yoke",
  "zerofrom",
  "zerovec",
 ]
 
 [[package]]
-name = "icu_locid"
-version = "1.5.0"
+name = "icu_locale_core"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1260,31 +1261,11 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "icu_locid_transform"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
-dependencies = [
- "displaydoc",
- "icu_locid",
- "icu_locid_transform_data",
- "icu_provider",
- "tinystr",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locid_transform_data"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
-
 [[package]]
 name = "icu_normalizer"
-version = "1.5.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
 dependencies = [
  "displaydoc",
  "icu_collections",
@@ -1292,67 +1273,54 @@ dependencies = [
  "icu_properties",
  "icu_provider",
  "smallvec",
- "utf16_iter",
- "utf8_iter",
- "write16",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_normalizer_data"
-version = "1.5.1"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
+checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
 
 [[package]]
 name = "icu_properties"
-version = "1.5.1"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
+checksum = "2549ca8c7241c82f59c80ba2a6f415d931c5b58d24fb8412caa1a1f02c49139a"
 dependencies = [
  "displaydoc",
  "icu_collections",
- "icu_locid_transform",
+ "icu_locale_core",
  "icu_properties_data",
  "icu_provider",
- "tinystr",
+ "potential_utf",
+ "zerotrie",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_properties_data"
-version = "1.5.1"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
+checksum = "8197e866e47b68f8f7d95249e172903bec06004b18b2937f1095d40a0c57de04"
 
 [[package]]
 name = "icu_provider"
-version = "1.5.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
 dependencies = [
  "displaydoc",
- "icu_locid",
- "icu_provider_macros",
+ "icu_locale_core",
  "stable_deref_trait",
  "tinystr",
  "writeable",
  "yoke",
  "zerofrom",
+ "zerotrie",
  "zerovec",
 ]
 
-[[package]]
-name = "icu_provider_macros"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -1372,9 +1340,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -1520,9 +1488,9 @@ checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
 
 [[package]]
 name = "litemap"
-version = "0.7.5"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
+checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
 
 [[package]]
 name = "log"
@@ -1830,6 +1798,15 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "potential_utf"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5a7c30837279ca13e7c867e9e40053bc68740f988cb07f7ca6df43cc734b585"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -2307,11 +2284,12 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c"
+checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
 dependencies = [
  "web-time",
+ "zeroize",
 ]
 
 [[package]]
@@ -2376,7 +2354,7 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "s2n-codec"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "byteorder",
  "bytes",
@@ -2385,7 +2363,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic"
-version = "1.57.0"
+version = "1.58.0"
 dependencies = [
  "bytes",
  "cfg-if",
@@ -2408,7 +2386,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-core"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "atomic-waker",
  "byteorder",
@@ -2427,7 +2405,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-crypto"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "aws-lc-rs",
  "cfg-if",
@@ -2450,7 +2428,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-platform"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "cfg-if",
  "futures",
@@ -2463,7 +2441,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-rustls"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "bytes",
  "rustls",
@@ -2476,7 +2454,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "bytes",
  "errno",
@@ -2489,7 +2467,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls-default"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "s2n-quic-rustls",
  "s2n-quic-tls",
@@ -2497,7 +2475,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-transport"
-version = "0.57.0"
+version = "0.58.0"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -2513,9 +2491,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls"
-version = "0.3.18"
+version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1c2355bbfcccc93a61d56a8e8b8a22325a5c68b693ddeba904a5aa293cc66c8"
+checksum = "821c6c037686bbc60273f3c4af20012eecbe5e9b1c4ac3d7f766a1f2464681bf"
 dependencies = [
  "errno",
  "hex",
@@ -2526,9 +2504,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls-sys"
-version = "0.3.18"
+version = "0.3.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65818edc12b815a4b2140a6a031f6e5fe3a59b31c28d7f01835b9aa38654f81f"
+checksum = "6a755df740916e2fc0aaf99c6fc0e519028702a75bff018b6b55a735eada406a"
 dependencies = [
  "aws-lc-rs",
  "cc",
@@ -2842,9 +2820,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.7.6"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -3092,12 +3070,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "utf16_iter"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -3540,17 +3512,11 @@ dependencies = [
  "bitflags",
 ]
 
-[[package]]
-name = "write16"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
-
 [[package]]
 name = "writeable"
-version = "0.5.5"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
 
 [[package]]
 name = "x509-parser"
@@ -3580,9 +3546,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.7.5"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
+checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
 dependencies = [
  "serde",
  "stable_deref_trait",
@@ -3592,9 +3558,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.7.5"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
+checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3664,10 +3630,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "zerovec"
-version = "0.10.4"
+name = "zerotrie"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -3676,9 +3653,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.10.3"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 3b14531..5d0b400 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -94,11 +94,11 @@ tracing = { version = "0.1.41" }
 quinn = { version = "0.11.7", optional = true }
 h3 = { version = "0.0.8", features = ["tracing"], optional = true }
 h3-quinn = { version = "0.0.10", optional = true }
-s2n-quic = { version = "1.57.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
+s2n-quic = { version = "1.58.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
   "provider-tls-rustls",
 ], optional = true }
-s2n-quic-core = { version = "0.57.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
-s2n-quic-rustls = { version = "0.57.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
+s2n-quic-core = { version = "0.58.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
+s2n-quic-rustls = { version = "0.58.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
 s2n-quic-h3 = { path = "../submodules/s2n-quic/quic/s2n-quic-h3/", features = [
   "tracing",
 ], optional = true }
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index a4e601d..3e9b3f2 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit a4e601db45c1de09a088ca3c021e73c32760dfb7
+Subproject commit 3e9b3f2f499626acbf1d697aa8f58095b6585ce3

From 80d980541e0762ec29cdc743f295f9985df7231d Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 12 May 2025 00:46:38 +0900
Subject: [PATCH 13/69] deps

---
 Cargo.lock            | 69 +++++++++++++++++++++++++++++++++++--------
 rpxy-bin/Cargo.toml   |  4 +--
 rpxy-certs/Cargo.toml |  2 +-
 rpxy-lib/Cargo.toml   |  2 +-
 4 files changed, 61 insertions(+), 16 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0ee23d9..eda3fd1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -392,6 +392,12 @@ version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
 
+[[package]]
+name = "bytemuck"
+version = "1.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9134a6ef01ce4b366b50689c94f82c14bc72bc5d0386829828a2e2752ef7958c"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -468,18 +474,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.37"
+version = "4.5.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eccb054f56cbd38340b380d4a8e69ef1f02f1af43db2f0cc817a4774d80ae071"
+checksum = "ed93b9805f8ba930df42c2590f05453d5ec36cbb85d018868a5b24d31f6ac000"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.37"
+version = "4.5.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efd9466fac8543255d3b1fcad4762c5e116ffe808c8a3043d4263cd4fd4862a2"
+checksum = "379026ff283facf611b0ea629334361c4211d1b12ee01024eec1591133b04120"
 dependencies = [
  "anstream",
  "anstyle",
@@ -755,6 +761,18 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "fastbloom"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27cea6e7f512d43b098939ff4d5a5d6fe3db07971e1d05176fe26c642d33f5b8"
+dependencies = [
+ "getrandom 0.3.2",
+ "rand 0.9.1",
+ "siphasher",
+ "wide",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -1507,6 +1525,12 @@ dependencies = [
  "hashbrown",
 ]
 
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "matchers"
 version = "0.1.0"
@@ -1849,9 +1873,9 @@ checksum = "1190fd18ae6ce9e137184f207593877e70f39b015040156b1e05081cdfe3733a"
 
 [[package]]
 name = "quinn"
-version = "0.11.7"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3bd15a6f2967aef83887dcb9fec0014580467e33720d073560cf015a5683012"
+checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -1870,12 +1894,14 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.11"
+version = "0.11.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcbafbbdbb0f638fe3f35f3c56739f77a8a1d070cb25603226c83339b391472b"
+checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
 dependencies = [
  "bytes",
+ "fastbloom",
  "getrandom 0.3.2",
+ "lru-slab",
  "rand 0.9.1",
  "ring",
  "rustc-hash 2.1.1",
@@ -2330,9 +2356,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.2"
+version = "0.103.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7149975849f1abb3832b246010ef62ccc80d3a76169517ada7188252b9cfb437"
+checksum = "e4a72fe2bcf7a6ac6fd7d0b9e5cb68aeb7d4c0a0271730218b3e92d43b4eb435"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -2513,6 +2539,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "safe_arch"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b02de82ddbe1b636e6170c21be622223aea188ef2e139be0a5b219ec215323"
+dependencies = [
+ "bytemuck",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -2589,9 +2624,9 @@ dependencies = [
 
 [[package]]
 name = "serde_ignored"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "566da67d80e92e009728b3731ff0e5360cb181432b8ca73ea30bb1d170700d76"
+checksum = "b516445dac1e3535b6d658a7b528d771153dfb272ed4180ca4617a20550365ff"
 dependencies = [
  "serde",
 ]
@@ -3256,6 +3291,16 @@ dependencies = [
  "rustix 0.38.44",
 ]
 
+[[package]]
+name = "wide"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b5576b9a81633f3e8df296ce0063042a73507636cbe956c61133dd7034ab22"
+dependencies = [
+ "bytemuck",
+ "safe_arch",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index a99de63..a0664ac 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -47,10 +47,10 @@ async-trait = "0.1.88"
 futures-util = { version = "0.3.31", default-features = false }
 
 # config
-clap = { version = "4.5.37", features = ["std", "cargo", "wrap_help"] }
+clap = { version = "4.5.38", features = ["std", "cargo", "wrap_help"] }
 toml = { version = "0.8.22", default-features = false, features = ["parse"] }
 hot_reload = "0.1.9"
-serde_ignored = "0.1.11"
+serde_ignored = "0.1.12"
 
 # logging
 tracing = { version = "0.1.41" }
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index 90b15e6..3ccbc19 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -27,7 +27,7 @@ rustls = { version = "0.23.27", default-features = false, features = [
   "aws_lc_rs",
 ] }
 rustls-pemfile = { version = "2.2.0" }
-rustls-webpki = { version = "0.103.2", default-features = false, features = [
+rustls-webpki = { version = "0.103.3", default-features = false, features = [
   "std",
   "aws-lc-rs",
 ] }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 5d0b400..2457bfc 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -91,7 +91,7 @@ rpxy-acme = { path = "../rpxy-acme/", default-features = false, optional = true
 tracing = { version = "0.1.41" }
 
 # http/3
-quinn = { version = "0.11.7", optional = true }
+quinn = { version = "0.11.8", optional = true }
 h3 = { version = "0.0.8", features = ["tracing"], optional = true }
 h3-quinn = { version = "0.0.10", optional = true }
 s2n-quic = { version = "1.58.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [

From 102b4964dc0d05cebe9a6f40449aab3d8d400ea1 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 13 May 2025 14:50:22 +0900
Subject: [PATCH 14/69] deps

---
 submodules/s2n-quic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index 3e9b3f2..6af2c33 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit 3e9b3f2f499626acbf1d697aa8f58095b6585ce3
+Subproject commit 6af2c33b89f5dc6a314e2b2bb957225853ceb4d1

From 4761439338861dfd662c24d36d24989f75431846 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 13 May 2025 19:28:48 +0900
Subject: [PATCH 15/69] refactor

---
 Cargo.lock                                    | 96 +++++++++++++++----
 rpxy-bin/src/error.rs                         |  2 +-
 rpxy-certs/src/server_crypto.rs               |  2 +-
 rpxy-lib/src/backend/backend_main.rs          |  2 +-
 .../backend/load_balance/load_balance_main.rs |  2 +-
 .../load_balance/load_balance_sticky.rs       |  4 +-
 rpxy-lib/src/backend/load_balance/mod.rs      |  2 +-
 .../src/backend/load_balance/sticky_cookie.rs |  7 +-
 rpxy-lib/src/backend/upstream.rs              |  4 +-
 rpxy-lib/src/forwarder/cache/mod.rs           |  2 +-
 rpxy-lib/src/forwarder/client.rs              |  4 +-
 rpxy-lib/src/hyper_ext/body_incoming_like.rs  |  2 +-
 rpxy-lib/src/hyper_ext/body_type.rs           |  2 +-
 rpxy-lib/src/hyper_ext/mod.rs                 |  2 +-
 rpxy-lib/src/hyper_ext/watch.rs               |  2 +-
 .../src/message_handler/canonical_address.rs  |  5 +-
 .../src/message_handler/synthetic_response.rs |  2 +-
 rpxy-lib/src/message_handler/utils_headers.rs |  4 +-
 rpxy-lib/src/message_handler/utils_request.rs |  4 +-
 rpxy-lib/src/proxy/proxy_main.rs              |  2 +-
 20 files changed, 104 insertions(+), 48 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index eda3fd1..da1d618 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -24,7 +24,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
  "cfg-if",
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
  "once_cell",
  "version_check",
  "zerocopy",
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.21"
+version = "1.2.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8691782945451c1c383942c4874dbe63814f61cb57ef773cda2972682b7bb3c0"
+checksum = "32db95edf998450acc7881c932f94cd9b05c87b4b2599e8bab064753da4acfd1"
 dependencies = [
  "jobserver",
  "libc",
@@ -767,7 +767,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27cea6e7f512d43b098939ff4d5a5d6fe3db07971e1d05176fe26c642d33f5b8"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
  "rand 0.9.1",
  "siphasher",
  "wide",
@@ -970,9 +970,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -1434,7 +1434,7 @@ version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
  "libc",
 ]
 
@@ -1468,12 +1468,12 @@ checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
 name = "libloading"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
+checksum = "6a793df0d7afeac54f95b471d3af7f0d4fb975699f972341a4b76988d49cdf0c"
 dependencies = [
  "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.53.0",
 ]
 
 [[package]]
@@ -1900,7 +1900,7 @@ checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
 dependencies = [
  "bytes",
  "fastbloom",
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
  "lru-slab",
  "rand 0.9.1",
  "ring",
@@ -2002,7 +2002,7 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
 ]
 
 [[package]]
@@ -2751,12 +2751,12 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.19.1"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
+checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
 dependencies = [
  "fastrand",
- "getrandom 0.3.2",
+ "getrandom 0.3.3",
  "once_cell",
  "rustix 1.0.7",
  "windows-sys 0.59.0",
@@ -3442,13 +3442,29 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm",
+ "windows_i686_gnullvm 0.52.6",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
+dependencies = [
+ "windows_aarch64_gnullvm 0.53.0",
+ "windows_aarch64_msvc 0.53.0",
+ "windows_i686_gnu 0.53.0",
+ "windows_i686_gnullvm 0.53.0",
+ "windows_i686_msvc 0.53.0",
+ "windows_x86_64_gnu 0.53.0",
+ "windows_x86_64_gnullvm 0.53.0",
+ "windows_x86_64_msvc 0.53.0",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
@@ -3461,6 +3477,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -3473,6 +3495,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -3485,12 +3513,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -3503,6 +3543,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -3515,6 +3561,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -3527,6 +3579,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -3539,6 +3597,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+
 [[package]]
 name = "winnow"
 version = "0.7.10"
diff --git a/rpxy-bin/src/error.rs b/rpxy-bin/src/error.rs
index 9751fb5..adb0969 100644
--- a/rpxy-bin/src/error.rs
+++ b/rpxy-bin/src/error.rs
@@ -1,2 +1,2 @@
 #[allow(unused)]
-pub use anyhow::{anyhow, bail, ensure, Context};
+pub use anyhow::{Context, anyhow, bail, ensure};
diff --git a/rpxy-certs/src/server_crypto.rs b/rpxy-certs/src/server_crypto.rs
index 9a15c5a..a3282cc 100644
--- a/rpxy-certs/src/server_crypto.rs
+++ b/rpxy-certs/src/server_crypto.rs
@@ -1,9 +1,9 @@
 use crate::{certs::SingleServerCertsKeys, error::*, log::*};
 use ahash::HashMap;
 use rustls::{
+  RootCertStore, ServerConfig,
   crypto::CryptoProvider,
   server::{ResolvesServerCertUsingSni, WebPkiClientVerifier},
-  RootCertStore, ServerConfig,
 };
 use std::sync::Arc;
 
diff --git a/rpxy-lib/src/backend/backend_main.rs b/rpxy-lib/src/backend/backend_main.rs
index 1ac49cb..af05704 100644
--- a/rpxy-lib/src/backend/backend_main.rs
+++ b/rpxy-lib/src/backend/backend_main.rs
@@ -1,8 +1,8 @@
 use crate::{
+  AppConfig, AppConfigList,
   error::*,
   log::*,
   name_exp::{ByteName, ServerName},
-  AppConfig, AppConfigList,
 };
 use ahash::HashMap;
 use derive_builder::Builder;
diff --git a/rpxy-lib/src/backend/load_balance/load_balance_main.rs b/rpxy-lib/src/backend/load_balance/load_balance_main.rs
index 0db21dd..6d14572 100644
--- a/rpxy-lib/src/backend/load_balance/load_balance_main.rs
+++ b/rpxy-lib/src/backend/load_balance/load_balance_main.rs
@@ -7,8 +7,8 @@ pub use super::{
 use derive_builder::Builder;
 use rand::Rng;
 use std::sync::{
-  atomic::{AtomicUsize, Ordering},
   Arc,
+  atomic::{AtomicUsize, Ordering},
 };
 
 /// Constants to specify a load balance option
diff --git a/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs b/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs
index 46ac74e..93fc2ba 100644
--- a/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs
+++ b/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs
@@ -1,7 +1,7 @@
 use super::{
+  Upstream,
   load_balance_main::{LoadBalanceContext, LoadBalanceWithPointer, PointerToUpstream},
   sticky_cookie::StickyCookieConfig,
-  Upstream,
 };
 use crate::{constants::STICKY_COOKIE_NAME, log::*};
 use ahash::HashMap;
@@ -9,8 +9,8 @@ use derive_builder::Builder;
 use std::{
   borrow::Cow,
   sync::{
-    atomic::{AtomicUsize, Ordering},
     Arc,
+    atomic::{AtomicUsize, Ordering},
   },
 };
 
diff --git a/rpxy-lib/src/backend/load_balance/mod.rs b/rpxy-lib/src/backend/load_balance/mod.rs
index 38d312b..b77f72c 100644
--- a/rpxy-lib/src/backend/load_balance/mod.rs
+++ b/rpxy-lib/src/backend/load_balance/mod.rs
@@ -8,7 +8,7 @@ use super::upstream::Upstream;
 use thiserror::Error;
 
 pub use load_balance_main::{
-  load_balance_options, LoadBalance, LoadBalanceContext, LoadBalanceRandomBuilder, LoadBalanceRoundRobinBuilder,
+  LoadBalance, LoadBalanceContext, LoadBalanceRandomBuilder, LoadBalanceRoundRobinBuilder, load_balance_options,
 };
 #[cfg(feature = "sticky-cookie")]
 pub use load_balance_sticky::LoadBalanceStickyBuilder;
diff --git a/rpxy-lib/src/backend/load_balance/sticky_cookie.rs b/rpxy-lib/src/backend/load_balance/sticky_cookie.rs
index 28572b5..cad603c 100644
--- a/rpxy-lib/src/backend/load_balance/sticky_cookie.rs
+++ b/rpxy-lib/src/backend/load_balance/sticky_cookie.rs
@@ -91,12 +91,7 @@ impl<'a> StickyCookieBuilder {
     self
   }
   /// Set the meta information of sticky cookie
-  pub fn info(
-    &mut self,
-    domain: impl Into<Cow<'a, str>>,
-    path: impl Into<Cow<'a, str>>,
-    duration_secs: i64,
-  ) -> &mut Self {
+  pub fn info(&mut self, domain: impl Into<Cow<'a, str>>, path: impl Into<Cow<'a, str>>, duration_secs: i64) -> &mut Self {
     let info = StickyCookieInfoBuilder::default()
       .domain(domain)
       .path(path)
diff --git a/rpxy-lib/src/backend/upstream.rs b/rpxy-lib/src/backend/upstream.rs
index 353db99..4699b5b 100644
--- a/rpxy-lib/src/backend/upstream.rs
+++ b/rpxy-lib/src/backend/upstream.rs
@@ -1,7 +1,7 @@
 #[cfg(feature = "sticky-cookie")]
 use super::load_balance::LoadBalanceStickyBuilder;
 use super::load_balance::{
-  load_balance_options as lb_opts, LoadBalance, LoadBalanceContext, LoadBalanceRandomBuilder, LoadBalanceRoundRobinBuilder,
+  LoadBalance, LoadBalanceContext, LoadBalanceRandomBuilder, LoadBalanceRoundRobinBuilder, load_balance_options as lb_opts,
 };
 // use super::{BytesName, LbContext, PathNameBytesExp, UpstreamOption};
 use super::upstream_opts::UpstreamOption;
@@ -13,7 +13,7 @@ use crate::{
 };
 use ahash::{HashMap, HashSet};
 #[cfg(feature = "sticky-cookie")]
-use base64::{engine::general_purpose, Engine as _};
+use base64::{Engine as _, engine::general_purpose};
 use derive_builder::Builder;
 #[cfg(feature = "sticky-cookie")]
 use sha2::{Digest, Sha256};
diff --git a/rpxy-lib/src/forwarder/cache/mod.rs b/rpxy-lib/src/forwarder/cache/mod.rs
index 076eaa3..8856bc0 100644
--- a/rpxy-lib/src/forwarder/cache/mod.rs
+++ b/rpxy-lib/src/forwarder/cache/mod.rs
@@ -2,4 +2,4 @@ mod cache_error;
 mod cache_main;
 
 pub use cache_error::CacheError;
-pub(crate) use cache_main::{get_policy_if_cacheable, RpxyCache};
+pub(crate) use cache_main::{RpxyCache, get_policy_if_cacheable};
diff --git a/rpxy-lib/src/forwarder/client.rs b/rpxy-lib/src/forwarder/client.rs
index 292be06..45597bc 100644
--- a/rpxy-lib/src/forwarder/client.rs
+++ b/rpxy-lib/src/forwarder/client.rs
@@ -9,13 +9,13 @@ use async_trait::async_trait;
 use http::{Request, Response, Version};
 use hyper::body::{Body, Incoming};
 use hyper_util::client::legacy::{
-  connect::{Connect, HttpConnector},
   Client,
+  connect::{Connect, HttpConnector},
 };
 use std::sync::Arc;
 
 #[cfg(feature = "cache")]
-use super::cache::{get_policy_if_cacheable, RpxyCache};
+use super::cache::{RpxyCache, get_policy_if_cacheable};
 
 #[async_trait]
 /// Definition of the forwarder that simply forward requests from downstream client to upstream app servers.
diff --git a/rpxy-lib/src/hyper_ext/body_incoming_like.rs b/rpxy-lib/src/hyper_ext/body_incoming_like.rs
index 1a86409..844b0bd 100644
--- a/rpxy-lib/src/hyper_ext/body_incoming_like.rs
+++ b/rpxy-lib/src/hyper_ext/body_incoming_like.rs
@@ -1,7 +1,7 @@
 use super::watch;
 use crate::error::*;
 use futures_channel::{mpsc, oneshot};
-use futures_util::{stream::FusedStream, Future, Stream};
+use futures_util::{Future, Stream, stream::FusedStream};
 use http::HeaderMap;
 use hyper::body::{Body, Bytes, Frame, SizeHint};
 use std::{
diff --git a/rpxy-lib/src/hyper_ext/body_type.rs b/rpxy-lib/src/hyper_ext/body_type.rs
index ca44756..5d39fb4 100644
--- a/rpxy-lib/src/hyper_ext/body_type.rs
+++ b/rpxy-lib/src/hyper_ext/body_type.rs
@@ -1,7 +1,7 @@
 use super::body::IncomingLike;
 use crate::error::RpxyError;
 use futures::channel::mpsc::UnboundedReceiver;
-use http_body_util::{combinators, BodyExt, Empty, Full, StreamBody};
+use http_body_util::{BodyExt, Empty, Full, StreamBody, combinators};
 use hyper::body::{Body, Bytes, Frame, Incoming};
 use std::pin::Pin;
 
diff --git a/rpxy-lib/src/hyper_ext/mod.rs b/rpxy-lib/src/hyper_ext/mod.rs
index a4c5196..4f68cc5 100644
--- a/rpxy-lib/src/hyper_ext/mod.rs
+++ b/rpxy-lib/src/hyper_ext/mod.rs
@@ -12,5 +12,5 @@ pub(crate) mod rt {
 #[allow(unused)]
 pub(crate) mod body {
   pub(crate) use super::body_incoming_like::IncomingLike;
-  pub(crate) use super::body_type::{empty, full, BoxBody, RequestBody, ResponseBody, UnboundedStreamBody};
+  pub(crate) use super::body_type::{BoxBody, RequestBody, ResponseBody, UnboundedStreamBody, empty, full};
 }
diff --git a/rpxy-lib/src/hyper_ext/watch.rs b/rpxy-lib/src/hyper_ext/watch.rs
index d5e1c7e..14f5650 100644
--- a/rpxy-lib/src/hyper_ext/watch.rs
+++ b/rpxy-lib/src/hyper_ext/watch.rs
@@ -7,8 +7,8 @@
 
 use futures_util::task::AtomicWaker;
 use std::sync::{
-  atomic::{AtomicUsize, Ordering},
   Arc,
+  atomic::{AtomicUsize, Ordering},
 };
 use std::task;
 
diff --git a/rpxy-lib/src/message_handler/canonical_address.rs b/rpxy-lib/src/message_handler/canonical_address.rs
index 32dad78..d29177d 100644
--- a/rpxy-lib/src/message_handler/canonical_address.rs
+++ b/rpxy-lib/src/message_handler/canonical_address.rs
@@ -44,10 +44,7 @@ mod tests {
   }
   #[test]
   fn ipv6_to_canonical() {
-    let socket = SocketAddr::new(
-      IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0xdead, 0xbeef)),
-      8080,
-    );
+    let socket = SocketAddr::new(IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0xdead, 0xbeef)), 8080);
     assert_eq!(socket.to_canonical(), socket);
   }
   #[test]
diff --git a/rpxy-lib/src/message_handler/synthetic_response.rs b/rpxy-lib/src/message_handler/synthetic_response.rs
index a955a2d..41ee4c3 100644
--- a/rpxy-lib/src/message_handler/synthetic_response.rs
+++ b/rpxy-lib/src/message_handler/synthetic_response.rs
@@ -1,7 +1,7 @@
 use super::http_result::{HttpError, HttpResult};
 use crate::{
   error::*,
-  hyper_ext::body::{empty, ResponseBody},
+  hyper_ext::body::{ResponseBody, empty},
   name_exp::ServerName,
 };
 use http::{Request, Response, StatusCode, Uri};
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index 1fa3c99..cfcadba 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -3,9 +3,9 @@ use crate::{
   backend::{UpstreamCandidates, UpstreamOption},
   log::*,
 };
-use anyhow::{anyhow, ensure, Result};
+use anyhow::{Result, anyhow, ensure};
 use bytes::BufMut;
-use http::{header, HeaderMap, HeaderName, HeaderValue, Uri};
+use http::{HeaderMap, HeaderName, HeaderValue, Uri, header};
 use std::{borrow::Cow, net::SocketAddr};
 
 #[cfg(feature = "sticky-cookie")]
diff --git a/rpxy-lib/src/message_handler/utils_request.rs b/rpxy-lib/src/message_handler/utils_request.rs
index 0a0a77c..98acdc0 100644
--- a/rpxy-lib/src/message_handler/utils_request.rs
+++ b/rpxy-lib/src/message_handler/utils_request.rs
@@ -2,8 +2,8 @@ use crate::{
   backend::{Upstream, UpstreamCandidates, UpstreamOption},
   log::*,
 };
-use anyhow::{anyhow, ensure, Result};
-use http::{header, uri::Scheme, Request, Version};
+use anyhow::{Result, anyhow, ensure};
+use http::{Request, Version, header, uri::Scheme};
 
 /// Trait defining parser of hostname
 /// Inspect and extract hostname from either the request HOST header or request line
diff --git a/rpxy-lib/src/proxy/proxy_main.rs b/rpxy-lib/src/proxy/proxy_main.rs
index 5244ecf..cfc8b6e 100644
--- a/rpxy-lib/src/proxy/proxy_main.rs
+++ b/rpxy-lib/src/proxy/proxy_main.rs
@@ -11,7 +11,7 @@ use crate::{
   message_handler::HttpMessageHandler,
   name_exp::ServerName,
 };
-use futures::{select, FutureExt};
+use futures::{FutureExt, select};
 use http::{Request, Response};
 use hyper::{
   body::Incoming,

From 57c1fd9e7e4df48983ebe97dd9ed4d198073940e Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 14 May 2025 13:28:28 +0900
Subject: [PATCH 16/69] deps

---
 submodules/s2n-quic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index 6af2c33..30b2a32 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit 6af2c33b89f5dc6a314e2b2bb957225853ceb4d1
+Subproject commit 30b2a3229e0ddf66c7370687e63b1739fbebc542

From 47016b6d84cd062d53ba66375154bf7bfa8a645d Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Thu, 15 May 2025 10:16:28 +0900
Subject: [PATCH 17/69] deps

---
 submodules/s2n-quic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index 30b2a32..a7880b8 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit 30b2a3229e0ddf66c7370687e63b1739fbebc542
+Subproject commit a7880b898663d35bbbf307f53b61fe9d691db2bc

From 1da0d77309cad5606c4ef807c4f76c4064fd58e8 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 16 May 2025 16:31:58 +0900
Subject: [PATCH 18/69] refactor

---
 rpxy-lib/src/backend/backend_main.rs |  1 +
 rpxy-lib/src/proxy/proxy_h3.rs       |  4 +-
 rpxy-lib/src/proxy/proxy_main.rs     | 85 ++++++++++++++--------------
 rpxy-lib/src/proxy/socket.rs         | 17 +++---
 4 files changed, 56 insertions(+), 51 deletions(-)

diff --git a/rpxy-lib/src/backend/backend_main.rs b/rpxy-lib/src/backend/backend_main.rs
index af05704..5524956 100644
--- a/rpxy-lib/src/backend/backend_main.rs
+++ b/rpxy-lib/src/backend/backend_main.rs
@@ -26,6 +26,7 @@ pub struct BackendApp {
   pub https_redirection: Option<bool>,
   /// tls settings: mutual TLS is enabled
   #[builder(default)]
+  #[allow(unused)]
   pub mutual_tls: Option<bool>,
 }
 impl<'a> BackendAppBuilder {
diff --git a/rpxy-lib/src/proxy/proxy_h3.rs b/rpxy-lib/src/proxy/proxy_h3.rs
index acfe07d..1eed0c5 100644
--- a/rpxy-lib/src/proxy/proxy_h3.rs
+++ b/rpxy-lib/src/proxy/proxy_h3.rs
@@ -68,7 +68,7 @@ where
             h3_conn.shutdown(0).await?;
             break;
           }
-          debug!("Request incoming: current # {}", request_count.current());
+          trace!("Request incoming: current # {}", request_count.current());
 
           let self_inner = self.clone();
           let tls_server_name_inner = tls_server_name.clone();
@@ -82,7 +82,7 @@ where
               warn!("HTTP/3 error on serve stream: {}", e);
             }
             request_count.decrement();
-            debug!("Request processed: current # {}", request_count.current());
+            trace!("Request processed: current # {}", request_count.current());
           });
         }
       }
diff --git a/rpxy-lib/src/proxy/proxy_main.rs b/rpxy-lib/src/proxy/proxy_main.rs
index cfc8b6e..b858072 100644
--- a/rpxy-lib/src/proxy/proxy_main.rs
+++ b/rpxy-lib/src/proxy/proxy_main.rs
@@ -80,7 +80,7 @@ where
       request_count.decrement();
       return;
     }
-    debug!("Request incoming: current # {}", request_count.current());
+    trace!("Request incoming: current # {}", request_count.current());
 
     let server_clone = self.connection_builder.clone();
     let message_handler_clone = self.message_handler.clone();
@@ -110,7 +110,7 @@ where
       }
 
       request_count.decrement();
-      debug!("Request processed: current # {}", request_count.current());
+      trace!("Request processed: current # {}", request_count.current());
     });
   }
 
@@ -131,52 +131,55 @@ where
 
   /// Start with TLS (HTTPS)
   pub(super) async fn start_with_tls(&self, cancel_token: CancellationToken) -> RpxyResult<()> {
+    // By default, TLS listener is spawned
+    let join_handle_tls = self.globals.runtime_handle.spawn({
+      let self_clone = self.clone();
+      let cancel_token = cancel_token.clone();
+      async move {
+        select! {
+          _ = self_clone.tls_listener_service().fuse() => {
+            error!("TCP proxy service for TLS exited");
+            cancel_token.cancel();
+          },
+          _ = cancel_token.cancelled().fuse() => {
+            debug!("Cancel token is called for TLS listener");
+          }
+        }
+      }
+    });
+
     #[cfg(not(any(feature = "http3-quinn", feature = "http3-s2n")))]
     {
-      self.tls_listener_service().await?;
-      error!("TCP proxy service for TLS exited");
+      let _ = join_handle_tls.await;
       Ok(())
     }
+
     #[cfg(any(feature = "http3-quinn", feature = "http3-s2n"))]
     {
-      if self.globals.proxy_config.http3 {
-        let jh_tls = self.globals.runtime_handle.spawn({
-          let self_clone = self.clone();
-          let cancel_token = cancel_token.clone();
-          async move {
-            select! {
-              _ = self_clone.tls_listener_service().fuse() => {
-                error!("TCP proxy service for TLS exited");
-                cancel_token.cancel();
-              },
-              _ = cancel_token.cancelled().fuse() => {
-                debug!("Cancel token is called for TLS listener");
-              }
-            }
-          }
-        });
-        let jh_h3 = self.globals.runtime_handle.spawn({
-          let self_clone = self.clone();
-          async move {
-            select! {
-              _ = self_clone.h3_listener_service().fuse() => {
-                error!("UDP proxy service for QUIC exited");
-                cancel_token.cancel();
-              },
-              _ = cancel_token.cancelled().fuse() => {
-                debug!("Cancel token is called for QUIC listener");
-              }
-            }
-          }
-        });
-        let _ = futures::future::join(jh_tls, jh_h3).await;
-
-        Ok(())
-      } else {
-        self.tls_listener_service().await?;
-        error!("TCP proxy service for TLS exited");
-        Ok(())
+      // If HTTP/3 is not enabled, wait for TLS listener to finish
+      if !self.globals.proxy_config.http3 {
+        let _ = join_handle_tls.await;
+        return Ok(());
       }
+
+      // If HTTP/3 is enabled, spawn a task to handle HTTP/3 connections
+      let join_handle_h3 = self.globals.runtime_handle.spawn({
+        let self_clone = self.clone();
+        async move {
+          select! {
+            _ = self_clone.h3_listener_service().fuse() => {
+              error!("UDP proxy service for QUIC exited");
+              cancel_token.cancel();
+            },
+            _ = cancel_token.cancelled().fuse() => {
+              debug!("Cancel token is called for QUIC listener");
+            }
+          }
+        }
+      });
+      let _ = futures::future::join(join_handle_tls, join_handle_h3).await;
+
+      Ok(())
     }
   }
 
diff --git a/rpxy-lib/src/proxy/socket.rs b/rpxy-lib/src/proxy/socket.rs
index 322b42b..fbb810d 100644
--- a/rpxy-lib/src/proxy/socket.rs
+++ b/rpxy-lib/src/proxy/socket.rs
@@ -16,10 +16,12 @@ pub(super) fn bind_tcp_socket(listening_on: &SocketAddr) -> RpxyResult<TcpSocket
   }?;
   tcp_socket.set_reuseaddr(true)?;
   tcp_socket.set_reuseport(true)?;
-  if let Err(e) = tcp_socket.bind(*listening_on) {
+
+  tcp_socket.bind(*listening_on).map_err(|e| {
     error!("Failed to bind TCP socket: {}", e);
-    return Err(RpxyError::Io(e));
-  };
+    RpxyError::Io(e)
+  })?;
+
   Ok(tcp_socket)
 }
 
@@ -36,11 +38,10 @@ pub(super) fn bind_udp_socket(listening_on: &SocketAddr) -> RpxyResult<UdpSocket
   socket.set_reuse_port(true)?;
   socket.set_nonblocking(true)?; // This was made true inside quinn. so this line isn't necessary here. but just in case.
 
-  if let Err(e) = socket.bind(&(*listening_on).into()) {
+  socket.bind(&(*listening_on).into()).map_err(|e| {
     error!("Failed to bind UDP socket: {}", e);
-    return Err(RpxyError::Io(e));
-  };
-  let udp_socket: UdpSocket = socket.into();
+    RpxyError::Io(e)
+  })?;
 
-  Ok(udp_socket)
+  Ok(socket.into())
 }

From 45f3d64adc14177e08607eba9221d6ac95d5237d Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 16 May 2025 16:33:12 +0900
Subject: [PATCH 19/69] chore: lock

---
 Cargo.lock | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index da1d618..459df62 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -360,9 +360,9 @@ dependencies = [
 
 [[package]]
 name = "bitflags"
-version = "2.9.0"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
+checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
 
 [[package]]
 name = "block-buffer"
@@ -732,9 +732,9 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.11"
+version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
+checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
 dependencies = [
  "libc",
  "windows-sys 0.59.0",
@@ -3334,9 +3334,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-core"
-version = "0.61.0"
+version = "0.61.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+checksum = "46ec44dc15085cea82cf9c78f85a9114c463a369786585ad2882d1ff0b0acf40"
 dependencies = [
  "windows-implement",
  "windows-interface",
@@ -3375,18 +3375,18 @@ checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
 
 [[package]]
 name = "windows-result"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252"
+checksum = "4b895b5356fc36103d0f64dd1e94dfa7ac5633f1c9dd6e80fe9ec4adef69e09d"
 dependencies = [
  "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.4.0"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+checksum = "2a7ab927b2637c19b3dbe0965e75d8f2d30bdd697a1516191cad2ec4df8fb28a"
 dependencies = [
  "windows-link",
 ]

From a412eb08d6d6f653a938f4d07a99d2c95a3c6475 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 16 May 2025 17:31:06 +0900
Subject: [PATCH 20/69] chore: submodule

---
 submodules/s2n-quic | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index a7880b8..250347d 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit a7880b898663d35bbbf307f53b61fe9d691db2bc
+Subproject commit 250347d34e8841a8958437f7c461513d157e1957

From 2705db6b91b69674c3ae5c514931deff8f37b5ac Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 16 May 2025 18:27:02 +0900
Subject: [PATCH 21/69] refactor handler_main

---
 rpxy-lib/src/lib.rs                          |  6 +--
 rpxy-lib/src/message_handler/handler_main.rs | 54 ++++++++++----------
 2 files changed, 27 insertions(+), 33 deletions(-)

diff --git a/rpxy-lib/src/lib.rs b/rpxy-lib/src/lib.rs
index 72ddbd3..77c5b93 100644
--- a/rpxy-lib/src/lib.rs
+++ b/rpxy-lib/src/lib.rs
@@ -180,9 +180,5 @@ pub async fn entrypoint(
     }
   });
   // returns the first error as the representative error
-  if let Some(e) = errs.next() {
-    return Err(e);
-  }
-
-  Ok(())
+  errs.next().map_or(Ok(()), |e| Err(e))
 }
diff --git a/rpxy-lib/src/message_handler/handler_main.rs b/rpxy-lib/src/message_handler/handler_main.rs
index 9496e6a..920e55c 100644
--- a/rpxy-lib/src/message_handler/handler_main.rs
+++ b/rpxy-lib/src/message_handler/handler_main.rs
@@ -107,9 +107,11 @@ where
     let backend_app = match self.app_manager.apps.get(&server_name) {
       Some(backend_app) => backend_app,
       None => {
-        let Some(default_server_name) = &self.app_manager.default_server_name else {
-          return Err(HttpError::NoMatchingBackendApp);
-        };
+        let default_server_name = self
+          .app_manager
+          .default_server_name
+          .as_ref()
+          .ok_or(HttpError::NoMatchingBackendApp)?;
         debug!("Serving by default app");
         self.app_manager.apps.get(default_server_name).unwrap()
       }
@@ -131,9 +133,7 @@ where
     // Find reverse proxy for given path and choose one of upstream host
     // Longest prefix match
     let path = req.uri().path();
-    let Some(upstream_candidates) = backend_app.path_manager.get(path) else {
-      return Err(HttpError::NoUpstreamCandidates);
-    };
+    let upstream_candidates = backend_app.path_manager.get(path).ok_or(HttpError::NoUpstreamCandidates)?;
 
     // Upgrade in request header
     let upgrade_in_request = extract_upgrade(req.headers());
@@ -147,19 +147,17 @@ where
     let req_on_upgrade = hyper::upgrade::on(&mut req);
 
     // Build request from destination information
-    let _context = match self.generate_request_forwarded(
-      &client_addr,
-      &listen_addr,
-      &mut req,
-      &upgrade_in_request,
-      upstream_candidates,
-      tls_enabled,
-    ) {
-      Err(e) => {
-        return Err(HttpError::FailedToGenerateUpstreamRequest(e.to_string()));
-      }
-      Ok(v) => v,
-    };
+    let _context = self
+      .generate_request_forwarded(
+        &client_addr,
+        &listen_addr,
+        &mut req,
+        &upgrade_in_request,
+        upstream_candidates,
+        tls_enabled,
+      )
+      .map_err(|e| HttpError::FailedToGenerateUpstreamRequest(e.to_string()))?;
+
     debug!(
       "Request to be forwarded: [uri {}, method: {}, version {:?}, headers {:?}]",
       req.uri(),
@@ -173,12 +171,12 @@ where
 
     //////////////
     // Forward request to a chosen backend
-    let mut res_backend = match self.forwarder.request(req).await {
-      Ok(v) => v,
-      Err(e) => {
-        return Err(HttpError::FailedToGetResponseFromBackend(e.to_string()));
-      }
-    };
+    let mut res_backend = self
+      .forwarder
+      .request(req)
+      .await
+      .map_err(|e| HttpError::FailedToGetResponseFromBackend(e.to_string()))?;
+
     //////////////
     // Process reverse proxy context generated during the forwarding request generation.
     #[cfg(feature = "sticky-cookie")]
@@ -191,9 +189,9 @@ where
 
     if res_backend.status() != StatusCode::SWITCHING_PROTOCOLS {
       // Generate response to client
-      if let Err(e) = self.generate_response_forwarded(&mut res_backend, backend_app) {
-        return Err(HttpError::FailedToGenerateDownstreamResponse(e.to_string()));
-      }
+      self
+        .generate_response_forwarded(&mut res_backend, backend_app)
+        .map_err(|e| HttpError::FailedToGenerateDownstreamResponse(e.to_string()))?;
       return Ok(res_backend);
     }
 

From e259e0b58897258d98fdb7504a1cbcbd7c5b37db Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 16 May 2025 19:30:51 +0900
Subject: [PATCH 22/69] refactor

---
 .../load_balance/load_balance_sticky.rs       | 17 ++++----
 rpxy-lib/src/backend/upstream.rs              | 40 +++++++++----------
 rpxy-lib/src/forwarder/cache/cache_main.rs    | 16 ++++----
 .../handler_manipulate_messages.rs            | 24 +++++------
 rpxy-lib/src/message_handler/utils_headers.rs | 15 +++----
 5 files changed, 52 insertions(+), 60 deletions(-)

diff --git a/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs b/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs
index 93fc2ba..4282312 100644
--- a/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs
+++ b/rpxy-lib/src/backend/load_balance/load_balance_sticky.rs
@@ -112,13 +112,16 @@ impl LoadBalanceWithPointer for LoadBalanceSticky {
       }
       Some(context) => {
         let server_id = &context.sticky_cookie.value.value;
-        if let Some(server_index) = self.get_server_index_from_id(server_id) {
-          debug!("Valid sticky cookie: id={}, index={}", server_id, server_index);
-          server_index
-        } else {
-          debug!("Invalid sticky cookie: id={}", server_id);
-          self.simple_increment_ptr()
-        }
+        self.get_server_index_from_id(server_id).map_or_else(
+          || {
+            debug!("Invalid sticky cookie: id={}", server_id);
+            self.simple_increment_ptr()
+          },
+          |server_index| {
+            debug!("Valid sticky cookie: id={}, index={}", server_id, server_index);
+            server_index
+          },
+        )
       }
     };
 
diff --git a/rpxy-lib/src/backend/upstream.rs b/rpxy-lib/src/backend/upstream.rs
index 4699b5b..9760d58 100644
--- a/rpxy-lib/src/backend/upstream.rs
+++ b/rpxy-lib/src/backend/upstream.rs
@@ -72,27 +72,22 @@ impl PathManager {
       .inner
       .iter()
       .filter(|(route_bytes, _)| {
-        match path_name.starts_with(route_bytes) {
-          true => {
-            route_bytes.len() == 1 // route = '/', i.e., default
-              || match path_name.get(route_bytes.len()) {
-                None => true, // exact case
-                Some(p) => p == &b'/', // sub-path case
-              }
-          }
-          _ => false,
+        path_name.starts_with(route_bytes) && {
+          route_bytes.len() == 1 // route = '/', i.e., default
+            || path_name.get(route_bytes.len()).map_or(
+              true, // exact case
+              |p| p == &b'/'
+            ) // sub-path case
         }
       })
       .max_by_key(|(route_bytes, _)| route_bytes.len());
-    if let Some((path, u)) = matched_upstream {
+    matched_upstream.map(|(path, u)| {
       debug!(
         "Found upstream: {:?}",
         path.try_into().unwrap_or_else(|_| "<none>".to_string())
       );
-      Some(u)
-    } else {
-      None
-    }
+      u
+    })
   }
 }
 
@@ -211,14 +206,15 @@ impl UpstreamCandidatesBuilder {
   }
   /// Set the activated upstream options defined in [[UpstreamOption]]
   pub fn options(&mut self, v: &Option<Vec<String>>) -> &mut Self {
-    let opts = if let Some(opts) = v {
-      opts
-        .iter()
-        .filter_map(|str| UpstreamOption::try_from(str.as_str()).ok())
-        .collect::<HashSet<UpstreamOption>>()
-    } else {
-      Default::default()
-    };
+    let opts = v.as_ref().map_or_else(
+      || Default::default(),
+      |opts| {
+        opts
+          .iter()
+          .filter_map(|str| UpstreamOption::try_from(str.as_str()).ok())
+          .collect::<HashSet<UpstreamOption>>()
+      },
+    );
     self.options = Some(opts);
     self
   }
diff --git a/rpxy-lib/src/forwarder/cache/cache_main.rs b/rpxy-lib/src/forwarder/cache/cache_main.rs
index 37e1fa9..784000f 100644
--- a/rpxy-lib/src/forwarder/cache/cache_main.rs
+++ b/rpxy-lib/src/forwarder/cache/cache_main.rs
@@ -185,9 +185,7 @@ impl RpxyCache {
     let cache_key = derive_cache_key_from_uri(req.uri());
 
     // First check cache chance
-    let Ok(Some(cached_object)) = self.inner.get(&cache_key) else {
-      return None;
-    };
+    let cached_object = self.inner.get(&cache_key).ok()??;
 
     // Secondly check the cache freshness as an HTTP message
     let now = SystemTime::now();
@@ -451,10 +449,10 @@ impl LruCacheManager {
 
   /// Push an entry
   fn push(&self, cache_key: &str, cache_object: &CacheObject) -> CacheResult<Option<(String, CacheObject)>> {
-    let Ok(mut lock) = self.inner.lock() else {
+    let mut lock = self.inner.lock().map_err(|_| {
       error!("Failed to acquire mutex lock for writing cache entry");
-      return Err(CacheError::FailedToAcquiredMutexLockForCache);
-    };
+      CacheError::FailedToAcquiredMutexLockForCache
+    })?;
     let res = Ok(lock.push(cache_key.to_string(), cache_object.clone()));
     // This may be inconsistent with the actual number of entries
     self.cnt.store(lock.len(), Ordering::Relaxed);
@@ -463,10 +461,10 @@ impl LruCacheManager {
 
   /// Get an entry
   fn get(&self, cache_key: &str) -> CacheResult<Option<CacheObject>> {
-    let Ok(mut lock) = self.inner.lock() else {
+    let mut lock = self.inner.lock().map_err(|_| {
       error!("Mutex can't be locked for checking cache entry");
-      return Err(CacheError::FailedToAcquiredMutexLockForCheck);
-    };
+      CacheError::FailedToAcquiredMutexLockForCheck
+    })?;
     let Some(cached_object) = lock.get(cache_key) else {
       return Ok(None);
     };
diff --git a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
index 680c6ee..dc58486 100644
--- a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
+++ b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
@@ -70,13 +70,15 @@ where
 
     // Add te: trailer if contained in original request
     let contains_te_trailers = {
-      if let Some(te) = req.headers().get(header::TE) {
-        te.as_bytes()
-          .split(|v| v == &b',' || v == &b' ')
-          .any(|x| x == "trailers".as_bytes())
-      } else {
-        false
-      }
+      req
+        .headers()
+        .get(header::TE)
+        .map(|te| {
+          te.as_bytes()
+            .split(|v| v == &b',' || v == &b' ')
+            .any(|x| x == "trailers".as_bytes())
+        })
+        .unwrap_or(false)
     };
 
     let original_uri = req.uri().to_string();
@@ -136,11 +138,7 @@ where
     let new_uri = Uri::builder()
       .scheme(upstream_chosen.uri.scheme().unwrap().as_str())
       .authority(upstream_chosen.uri.authority().unwrap().as_str());
-    let org_pq = match req.uri().path_and_query() {
-      Some(pq) => pq.to_string(),
-      None => "/".to_string(),
-    }
-    .into_bytes();
+    let org_pq = req.uri().path_and_query().map(|pq| pq.as_str()).unwrap_or("/").as_bytes();
 
     // replace some parts of path if opt_replace_path is enabled for chosen upstream
     let new_pq = match &upstream_candidates.replace_path {
@@ -155,7 +153,7 @@ where
         new_pq.extend_from_slice(&org_pq[matched_path.len()..]);
         new_pq
       }
-      None => org_pq,
+      None => org_pq.to_vec(),
     };
     *req.uri_mut() = new_uri.path_and_query(new_pq).build()?;
 
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index cfcadba..cab6e01 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -236,10 +236,9 @@ pub(super) fn add_forwarding_header(
 pub(super) fn remove_connection_header(headers: &mut HeaderMap) {
   if let Some(values) = headers.get(header::CONNECTION) {
     if let Ok(v) = values.clone().to_str() {
-      for m in v.split(',') {
-        if !m.is_empty() {
-          headers.remove(m.trim());
-        }
+      let keys = v.split(',').map(|m| m.trim()).filter(|m| !m.is_empty());
+      for m in keys {
+        headers.remove(m);
       }
     }
   }
@@ -274,11 +273,9 @@ pub(super) fn extract_upgrade(headers: &HeaderMap) -> Option<String> {
       .split(',')
       .any(|w| w.trim().eq_ignore_ascii_case(header::UPGRADE.as_str()))
     {
-      if let Some(u) = headers.get(header::UPGRADE) {
-        if let Ok(m) = u.to_str() {
-          debug!("Upgrade in request header: {}", m);
-          return Some(m.to_owned());
-        }
+      if let Some(Ok(m)) = headers.get(header::UPGRADE).map(|u| u.to_str()) {
+        debug!("Upgrade in request header: {}", m);
+        return Some(m.to_owned());
       }
     }
   }

From 71f7ef2d77aee219072b6af063024f913da14416 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 17 May 2025 04:17:50 +0900
Subject: [PATCH 23/69] bench

---
 README.md                |  2 +-
 bench/Caddyfile          |  4 +++
 bench/README.md          | 71 +++++++++++++++++++---------------------
 bench/docker-compose.yml |  6 ++--
 bench/nginx.conf         |  5 ++-
 submodules/s2n-quic      |  2 +-
 6 files changed, 46 insertions(+), 44 deletions(-)

diff --git a/README.md b/README.md
index e114859..70b3dba 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ Supported features are summarized as follows:
 
 [^sanitization]: By default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line). We should note that NGINX doesn't guarantee such a consistency by default. To this end, you have to add `if` statement in the configuration file in NGINX.
 
- This project is still *work-in-progress*. But it is already working in some production environments and serves a number of domain names. Furthermore it *significantly outperforms* NGINX and Caddy, e.g., *1.5x faster than NGINX*, in the setting of a very simple HTTP reverse-proxy scenario (See [`bench`](./bench/) directory).
+ This project is still *work-in-progress*. But it is already working in some production environments and serves a number of domain names. Furthermore it *significantly outperforms* NGINX and Caddy, e.g., *30% or more faster than NGINX*, in the setting of a very simple HTTP reverse-proxy scenario (See [`bench`](./bench/) directory).
 
 ## Installing/Building an Executable Binary of `rpxy`
 
diff --git a/bench/Caddyfile b/bench/Caddyfile
index 3ba1fa2..d12b122 100644
--- a/bench/Caddyfile
+++ b/bench/Caddyfile
@@ -2,9 +2,13 @@
   auto_https off
 }
 
+
 :80 {
 
 	# Proxy everything else to Rocket
 	reverse_proxy backend-nginx
+  log {
+    level ERROR
+  }
 
 }
diff --git a/bench/README.md b/bench/README.md
index 55ca4dd..f75b978 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -8,44 +8,41 @@ $ rewrk -c 512 -t 4 -d 15s -h http://localhost:8080 --pct
 
 ## Tests on `linux/arm64/v8`
 
-Done at Jul. 15, 2023
+Done at May. 17, 2025
 
 ### Environment
 
-- `rpxy` commit id: `1da7e5bfb77d1ce4ee8d6cfc59b1c725556fc192`
-- Docker Desktop 4.21.1 (114176)
+- `rpxy` commit id: `e259e0b58897258d98fdb7504a1cbcbd7c5b37db`
+- Docker Desktop 4.41.2 (191736)
 - ReWrk 0.3.2
-- Macbook Pro '14 (2021, M1 Max, 64GB RAM)
+- MacBook Pro '14 (2021, M1 Max, 64GB RAM)
 
 The docker images of `nginx` and `caddy` for `linux/arm64/v8` are pulled from the official registry.
 
 ### Result for `rpxy`, `nginx` and `caddy`
 
-```
-----------------------------
+```bash
 Benchmark on rpxy
 Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8080 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    19.64ms  8.85ms   0.67ms   113.22ms
+    10.62ms  4.47ms   0.47ms   73.01ms
   Requests:
-    Total: 390078  Req/Sec: 26011.25
+    Total: 720148  Req/Sec: 48025.92
   Transfer:
-    Total: 304.85 MB Transfer Rate: 20.33 MB/Sec
+    Total: 563.85 MB Transfer Rate: 37.60 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |     79.24ms     |
-|       99%       |     54.28ms     |
-|       95%       |     42.50ms     |
-|       90%       |     37.82ms     |
-|       75%       |     31.54ms     |
-|       50%       |     26.37ms     |
+|      99.9%      |     54.78ms     |
+|       99%       |     35.86ms     |
+|       95%       |     23.09ms     |
+|       90%       |     19.82ms     |
+|       75%       |     16.14ms     |
+|       50%       |     13.54ms     |
 + --------------- + --------------- +
 
-721 Errors: error shutting down connection: Socket is not connected (os error 57)
-
 sleep 3 secs
 ----------------------------
 Benchmark on nginx
@@ -53,23 +50,23 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8090 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    33.26ms  15.18ms  1.40ms   118.94ms
+    14.55ms  13.05ms  0.57ms   255.24ms
   Requests:
-    Total: 230268  Req/Sec: 15356.08
+    Total: 525866  Req/Sec: 35073.37
   Transfer:
-    Total: 186.77 MB Transfer Rate: 12.46 MB/Sec
+    Total: 427.78 MB Transfer Rate: 28.53 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |     99.91ms     |
-|       99%       |     83.74ms     |
-|       95%       |     70.67ms     |
-|       90%       |     64.03ms     |
-|       75%       |     54.32ms     |
-|       50%       |     45.19ms     |
+|      99.9%      |    235.17ms     |
+|       99%       |     91.77ms     |
+|       95%       |     48.86ms     |
+|       90%       |     39.08ms     |
+|       75%       |     28.78ms     |
+|       50%       |     21.77ms     |
 + --------------- + --------------- +
 
-677 Errors: error shutting down connection: Socket is not connected (os error 57)
+227 Errors: connection closed
 
 sleep 3 secs
 ----------------------------
@@ -78,23 +75,21 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8100 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    48.51ms  50.74ms  0.34ms   554.58ms
+    70.44ms  220.19ms  0.67ms   4140.08ms
   Requests:
-    Total: 157239  Req/Sec: 10485.98
+    Total:  79980  Req/Sec: 5334.74
   Transfer:
-    Total: 125.99 MB Transfer Rate: 8.40 MB/Sec
+    Total: 64.45 MB Transfer Rate: 4.30 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |    473.82ms     |
-|       99%       |    307.16ms     |
-|       95%       |    212.28ms     |
-|       90%       |    169.05ms     |
-|       75%       |    115.92ms     |
-|       50%       |     80.24ms     |
+|      99.9%      |    3550.19ms    |
+|       99%       |    1847.80ms    |
+|       95%       |    672.82ms     |
+|       90%       |    440.34ms     |
+|       75%       |    224.81ms     |
+|       50%       |    128.79ms     |
 + --------------- + --------------- +
-
-708 Errors: error shutting down connection: Socket is not connected (os error 57)
 ```
 
 ## Results on `linux/amd64`
diff --git a/bench/docker-compose.yml b/bench/docker-compose.yml
index 7b2b043..aaf800d 100644
--- a/bench/docker-compose.yml
+++ b/bench/docker-compose.yml
@@ -28,7 +28,7 @@ services:
       dockerfile: docker/Dockerfile
     restart: unless-stopped
     environment:
-      - LOG_LEVEL=info
+      - LOG_LEVEL=error # almost nolog
       - LOG_TO_FILE=false
     ports:
       - 127.0.0.1:8080:8080
@@ -47,7 +47,7 @@ services:
     tty: false
     privileged: true
     volumes:
-      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro # set as almost nolog
       - /var/run/docker.sock:/tmp/docker.sock:ro
     logging:
       options:
@@ -64,7 +64,7 @@ services:
     restart: unless-stopped
     tty: false
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro # set as almost no log
     networks:
       bench-nw:
 
diff --git a/bench/nginx.conf b/bench/nginx.conf
index 0ef89e3..b05910a 100644
--- a/bench/nginx.conf
+++ b/bench/nginx.conf
@@ -31,11 +31,14 @@
 #                  '"$request" $status $body_bytes_sent '
 #                  '"$http_referer" "$http_user_agent" '
 #                  '"$upstream_addr"';
-# access_log off;
+access_log off;
+
 # 		ssl_protocols TLSv1.2 TLSv1.3;
 # 		ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
 # 		ssl_prefer_server_ciphers off;
 # error_log /dev/stderr;
+error_log   /dev/null crit;
+
 # resolver 127.0.0.11;
 # # HTTP 1.1 support
 # proxy_http_version 1.1;
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index 250347d..f48dc68 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit 250347d34e8841a8958437f7c461513d157e1957
+Subproject commit f48dc6846fc363ab668441ff5a471fc27199bb55

From a5ed7c9b92a45cec7d66d01d892c27d180a61915 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 17 May 2025 04:32:41 +0900
Subject: [PATCH 24/69] retest with m4 pro

---
 README.md       |  2 +-
 bench/README.md | 58 ++++++++++++++++++++++++-------------------------
 2 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/README.md b/README.md
index 70b3dba..92fdb9b 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ Supported features are summarized as follows:
 
 [^sanitization]: By default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line). We should note that NGINX doesn't guarantee such a consistency by default. To this end, you have to add `if` statement in the configuration file in NGINX.
 
- This project is still *work-in-progress*. But it is already working in some production environments and serves a number of domain names. Furthermore it *significantly outperforms* NGINX and Caddy, e.g., *30% or more faster than NGINX*, in the setting of a very simple HTTP reverse-proxy scenario (See [`bench`](./bench/) directory).
+ This project is still *work-in-progress*. But it is already working in some production environments and serves a number of domain names. Furthermore it *significantly outperforms* NGINX and Caddy, e.g., *30% ~ 60% or more faster than NGINX*, in the setting of a very simple HTTP reverse-proxy scenario (See [`bench`](./bench/) directory).
 
 ## Installing/Building an Executable Binary of `rpxy`
 
diff --git a/bench/README.md b/bench/README.md
index f75b978..a713931 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -15,7 +15,7 @@ Done at May. 17, 2025
 - `rpxy` commit id: `e259e0b58897258d98fdb7504a1cbcbd7c5b37db`
 - Docker Desktop 4.41.2 (191736)
 - ReWrk 0.3.2
-- MacBook Pro '14 (2021, M1 Max, 64GB RAM)
+- Mac mini (2024, M4 Pro, 64GB RAM)
 
 The docker images of `nginx` and `caddy` for `linux/arm64/v8` are pulled from the official registry.
 
@@ -27,20 +27,20 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8080 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    10.62ms  4.47ms   0.47ms   73.01ms
+    6.90ms   3.42ms   0.78ms   80.26ms
   Requests:
-    Total: 720148  Req/Sec: 48025.92
+    Total: 1107885 Req/Sec: 73866.03
   Transfer:
-    Total: 563.85 MB Transfer Rate: 37.60 MB/Sec
+    Total: 867.44 MB Transfer Rate: 57.83 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |     54.78ms     |
-|       99%       |     35.86ms     |
-|       95%       |     23.09ms     |
-|       90%       |     19.82ms     |
-|       75%       |     16.14ms     |
-|       50%       |     13.54ms     |
+|      99.9%      |     49.76ms     |
+|       99%       |     29.57ms     |
+|       95%       |     15.78ms     |
+|       90%       |     13.05ms     |
+|       75%       |     10.41ms     |
+|       50%       |     8.72ms      |
 + --------------- + --------------- +
 
 sleep 3 secs
@@ -50,23 +50,23 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8090 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    14.55ms  13.05ms  0.57ms   255.24ms
+    11.65ms  14.04ms  0.40ms   205.93ms
   Requests:
-    Total: 525866  Req/Sec: 35073.37
+    Total: 654978  Req/Sec: 43666.56
   Transfer:
-    Total: 427.78 MB Transfer Rate: 28.53 MB/Sec
+    Total: 532.81 MB Transfer Rate: 35.52 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |    235.17ms     |
-|       99%       |     91.77ms     |
-|       95%       |     48.86ms     |
-|       90%       |     39.08ms     |
-|       75%       |     28.78ms     |
-|       50%       |     21.77ms     |
+|      99.9%      |    151.00ms     |
+|       99%       |    102.80ms     |
+|       95%       |     62.44ms     |
+|       90%       |     42.98ms     |
+|       75%       |     26.44ms     |
+|       50%       |     18.25ms     |
 + --------------- + --------------- +
 
-227 Errors: connection closed
+512 Errors: connection closed
 
 sleep 3 secs
 ----------------------------
@@ -75,20 +75,20 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8100 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    70.44ms  220.19ms  0.67ms   4140.08ms
+    77.54ms  368.11ms  0.37ms   6770.73ms
   Requests:
-    Total:  79980  Req/Sec: 5334.74
+    Total:  86963  Req/Sec: 5798.35
   Transfer:
-    Total: 64.45 MB Transfer Rate: 4.30 MB/Sec
+    Total: 70.00 MB Transfer Rate: 4.67 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |    3550.19ms    |
-|       99%       |    1847.80ms    |
-|       95%       |    672.82ms     |
-|       90%       |    440.34ms     |
-|       75%       |    224.81ms     |
-|       50%       |    128.79ms     |
+|      99.9%      |    5789.65ms    |
+|       99%       |    3407.02ms    |
+|       95%       |    1022.31ms    |
+|       90%       |    608.17ms     |
+|       75%       |    281.95ms     |
+|       50%       |    149.29ms     |
 + --------------- + --------------- +
 ```
 

From 4905d6a66298d9c60097642089e087c3f9a22d34 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 19 May 2025 15:21:07 +0900
Subject: [PATCH 25/69] refactor

---
 rpxy-bin/src/log.rs | 56 ++++++++++++++++++---------------------------
 1 file changed, 22 insertions(+), 34 deletions(-)

diff --git a/rpxy-bin/src/log.rs b/rpxy-bin/src/log.rs
index 151c94b..d194eb4 100644
--- a/rpxy-bin/src/log.rs
+++ b/rpxy-bin/src/log.rs
@@ -1,7 +1,7 @@
 use crate::constants::{ACCESS_LOG_FILE, SYSTEM_LOG_FILE};
 use rpxy_lib::log_event_names;
 use std::str::FromStr;
-use tracing_subscriber::{fmt, prelude::*};
+use tracing_subscriber::{filter::filter_fn, fmt, prelude::*};
 
 #[allow(unused)]
 pub use tracing::{debug, error, info, warn};
@@ -12,20 +12,16 @@ pub fn init_logger(log_dir_path: Option<&str>) {
   let level = tracing::Level::from_str(level_string.as_str()).unwrap_or(tracing::Level::INFO);
 
   match log_dir_path {
-    None => {
-      // log to stdout
-      init_stdio_logger(level);
-    }
-    Some(log_dir_path) => {
-      // log to files
-      println!("Activate logging to files: {log_dir_path}");
-      init_file_logger(level, log_dir_path);
-    }
+    // log to stdout
+    None => init_stdio_logger(level),
+    // log to files
+    Some(log_dir_path) => init_file_logger(level, log_dir_path),
   }
 }
 
-/// file logging TODO:
+/// file logging
 fn init_file_logger(level: tracing::Level, log_dir_path: &str) {
+  println!("Activate logging to files: {log_dir_path}");
   let log_dir_path = std::path::PathBuf::from(log_dir_path);
   // create the directory if it does not exist
   if !log_dir_path.exists() {
@@ -63,12 +59,8 @@ fn init_file_logger(level: tracing::Level, log_dir_path: &str) {
   let reg = reg.with(
     system_log_base
       .with_writer(system_log)
-      .with_filter(tracing_subscriber::filter::filter_fn(move |metadata| {
-        (metadata
-          .target()
-          .starts_with(env!("CARGO_PKG_NAME").replace('-', "_").as_str())
-          && metadata.name() != log_event_names::ACCESS_LOG
-          && metadata.level() <= &level)
+      .with_filter(filter_fn(move |metadata| {
+        (is_cargo_pkg(metadata) && metadata.name() != log_event_names::ACCESS_LOG && metadata.level() <= &level)
           || metadata.level() <= &tracing::Level::WARN.min(level)
       })),
   );
@@ -85,12 +77,8 @@ fn init_stdio_logger(level: tracing::Level) {
     let stdio_layer = stdio_layer
       .with_target(false)
       .compact()
-      .with_filter(tracing_subscriber::filter::filter_fn(move |metadata| {
-        (metadata
-          .target()
-          .starts_with(env!("CARGO_PKG_NAME").replace('-', "_").as_str())
-          && metadata.level() <= &level)
-          || metadata.level() <= &tracing::Level::WARN.min(level)
+      .with_filter(filter_fn(move |metadata| {
+        (is_cargo_pkg(metadata) && metadata.level() <= &level) || metadata.level() <= &tracing::Level::WARN.min(level)
       }));
     tracing_subscriber::registry().with(stdio_layer).init();
   } else {
@@ -101,12 +89,8 @@ fn init_stdio_logger(level: tracing::Level) {
       .with_thread_names(true)
       .with_target(true)
       .compact()
-      .with_filter(tracing_subscriber::filter::filter_fn(move |metadata| {
-        (metadata
-          .target()
-          .starts_with(env!("CARGO_PKG_NAME").replace('-', "_").as_str())
-          && metadata.level() <= &level)
-          || metadata.level() <= &tracing::Level::INFO.min(level)
+      .with_filter(filter_fn(move |metadata| {
+        (is_cargo_pkg(metadata) && metadata.level() <= &level) || metadata.level() <= &tracing::Level::INFO.min(level)
       }));
     tracing_subscriber::registry().with(stdio_layer).init();
   };
@@ -116,11 +100,7 @@ fn init_stdio_logger(level: tracing::Level) {
 struct AccessLogFilter;
 impl<S> tracing_subscriber::layer::Filter<S> for AccessLogFilter {
   fn enabled(&self, metadata: &tracing::Metadata<'_>, _: &tracing_subscriber::layer::Context<'_, S>) -> bool {
-    metadata
-      .target()
-      .starts_with(env!("CARGO_PKG_NAME").replace('-', "_").as_str())
-      && metadata.name().contains(log_event_names::ACCESS_LOG)
-      && metadata.level() <= &tracing::Level::INFO
+    is_cargo_pkg(metadata) && metadata.name().contains(log_event_names::ACCESS_LOG) && metadata.level() <= &tracing::Level::INFO
   }
 }
 
@@ -137,3 +117,11 @@ where
     .open(path)
     .expect("Failed to open the log file")
 }
+
+#[inline]
+/// Mached with cargo package name with `_` instead of `-`
+fn is_cargo_pkg(metadata: &tracing::Metadata<'_>) -> bool {
+  metadata
+    .target()
+    .starts_with(env!("CARGO_PKG_NAME").replace('-', "_").as_str())
+}

From b3959233a5054c2f3b2931e53ac602d903295a5f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 19 May 2025 22:20:37 +0000
Subject: [PATCH 26/69] chore(deps): bump hyper-util from 0.1.11 to 0.1.12

Bumps [hyper-util](https://github.com/hyperium/hyper-util) from 0.1.11 to 0.1.12.
- [Release notes](https://github.com/hyperium/hyper-util/releases)
- [Changelog](https://github.com/hyperium/hyper-util/blob/master/CHANGELOG.md)
- [Commits](https://github.com/hyperium/hyper-util/compare/v0.1.11...v0.1.12)

---
updated-dependencies:
- dependency-name: hyper-util
  dependency-version: 0.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 4 ++--
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 459df62..44ae3e4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1211,9 +1211,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497bbc33a26fdd4af9ed9c70d63f61cf56a938375fbb32df34db9b1cd6d643f2"
+checksum = "cf9f1e950e0d9d1d3c47184416723cf29c0d1f93bd8cccf37e4beb6b44f31710"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 2457bfc..72b3541 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -61,7 +61,7 @@ thiserror = "2.0.12"
 http = "1.3.1"
 http-body-util = "0.1.3"
 hyper = { version = "1.6.0", default-features = false }
-hyper-util = { version = "0.1.11", features = ["full"] }
+hyper-util = { version = "0.1.12", features = ["full"] }
 futures-util = { version = "0.3.31", default-features = false }
 futures-channel = { version = "0.3.31", default-features = false }
 

From 8b10a182fc00baef47395dae31d6b76fcca52e52 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 20 May 2025 12:00:30 +0900
Subject: [PATCH 27/69] lock

---
 Cargo.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 44ae3e4..3103f71 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.22"
+version = "1.2.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32db95edf998450acc7881c932f94cd9b05c87b4b2599e8bab064753da4acfd1"
+checksum = "5f4ac86a9e5bc1e2b3449ab9d7d3a6a405e3d1bb28d7b9be8614f55846ae3766"
 dependencies = [
  "jobserver",
  "libc",
@@ -1302,9 +1302,9 @@ checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
 
 [[package]]
 name = "icu_properties"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2549ca8c7241c82f59c80ba2a6f415d931c5b58d24fb8412caa1a1f02c49139a"
+checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
 dependencies = [
  "displaydoc",
  "icu_collections",
@@ -1318,9 +1318,9 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8197e866e47b68f8f7d95249e172903bec06004b18b2937f1095d40a0c57de04"
+checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
 
 [[package]]
 name = "icu_provider"
@@ -3334,9 +3334,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-core"
-version = "0.61.1"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46ec44dc15085cea82cf9c78f85a9114c463a369786585ad2882d1ff0b0acf40"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
  "windows-implement",
  "windows-interface",
@@ -3375,18 +3375,18 @@ checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
 
 [[package]]
 name = "windows-result"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b895b5356fc36103d0f64dd1e94dfa7ac5633f1c9dd6e80fe9ec4adef69e09d"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
  "windows-link",
 ]
 
 [[package]]
 name = "windows-strings"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a7ab927b2637c19b3dbe0965e75d8f2d30bdd697a1516191cad2ec4df8fb28a"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
 dependencies = [
  "windows-link",
 ]

From f3e5c478f198f501f503fb03f942021fa3784189 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 20 May 2025 21:09:20 +0900
Subject: [PATCH 28/69] refactor

---
 rpxy-bin/src/config/parse.rs | 136 ++++++++++++++++-------------------
 rpxy-bin/src/config/toml.rs  |  82 ++++++++++++++++++++-
 rpxy-bin/src/constants.rs    |   5 +-
 rpxy-bin/src/log.rs          | 105 ++++++++++++++-------------
 rpxy-bin/src/main.rs         |   3 +-
 5 files changed, 200 insertions(+), 131 deletions(-)

diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs
index 219abb1..d139354 100644
--- a/rpxy-bin/src/config/parse.rs
+++ b/rpxy-bin/src/config/parse.rs
@@ -4,18 +4,26 @@ use ahash::HashMap;
 use clap::Arg;
 use hot_reload::{ReloaderReceiver, ReloaderService};
 use rpxy_certs::{CryptoFileSourceBuilder, CryptoReloader, ServerCryptoBase, build_cert_reloader};
-use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig};
+use rpxy_lib::{AppConfigList, ProxyConfig};
 
 #[cfg(feature = "acme")]
 use rpxy_acme::{ACME_DIR_URL, ACME_REGISTRY_PATH, AcmeManager};
 
-/// Parsed options
+/// Parsed options from CLI
+/// Options for configuring the application.
+///
+/// # Fields
+/// - `config_file_path`: Path to the configuration file.
+/// - `log_dir_path`: Optional path to the log directory.
 pub struct Opts {
   pub config_file_path: String,
   pub log_dir_path: Option<String>,
 }
 
-/// Parse arg values passed from cli
+/// Parses command-line arguments into an [`Opts`](rpxy-bin/src/config/parse.rs:13) struct.
+///
+/// Returns a populated [`Opts`](rpxy-bin/src/config/parse.rs:13) on success, or an error if parsing fails.
+/// Expects a required `--config` argument and an optional `--log-dir` argument.
 pub fn parse_opts() -> Result<Opts, anyhow::Error> {
   let _ = include_str!("../../Cargo.toml");
   let options = clap::command!()
@@ -36,7 +44,6 @@ pub fn parse_opts() -> Result<Opts, anyhow::Error> {
     );
   let matches = options.get_matches();
 
-  ///////////////////////////////////
   let config_file_path = matches.get_one::<String>("config_file").unwrap().to_owned();
   let log_dir_path = matches.get_one::<String>("log_dir").map(|v| v.to_owned());
 
@@ -46,63 +53,45 @@ pub fn parse_opts() -> Result<Opts, anyhow::Error> {
   })
 }
 
-pub fn build_settings(config: &ConfigToml) -> std::result::Result<(ProxyConfig, AppConfigList), anyhow::Error> {
-  // build proxy config
-  let proxy_config: ProxyConfig = config.try_into()?;
+use super::toml::ConfigTomlExt;
 
-  // backend_apps
-  let apps = config.apps.clone().ok_or(anyhow!("Missing application spec"))?;
-
-  // assertions for all backend apps
-  ensure!(!apps.0.is_empty(), "Wrong application spec.");
-  // if only https_port is specified, tls must be configured for all apps
-  if proxy_config.http_port.is_none() {
-    ensure!(
-      apps.0.iter().all(|(_, app)| app.tls.is_some()),
-      "Some apps serves only plaintext HTTP"
-    );
-  }
-  // https redirection port must be configured only when both http_port and https_port are configured.
-  if proxy_config.https_redirection_port.is_some() {
-    ensure!(
-      proxy_config.https_port.is_some() && proxy_config.http_port.is_some(),
-      "https_redirection_port can be specified only when both http_port and https_port are specified"
-    );
-  }
-  // https redirection can be configured if both ports are active
-  if !(proxy_config.https_port.is_some() && proxy_config.http_port.is_some()) {
-    ensure!(
-      apps.0.iter().all(|(_, app)| {
-        if let Some(tls) = app.tls.as_ref() {
-          tls.https_redirection.is_none()
-        } else {
-          true
-        }
-      }),
-      "https_redirection can be specified only when both http_port and https_port are specified"
-    );
-  }
-
-  // build applications
-  let mut app_config_list_inner = Vec::<AppConfig>::new();
-
-  for (app_name, app) in apps.0.iter() {
-    let _server_name_string = app.server_name.as_ref().ok_or(anyhow!("No server name"))?;
-    let registered_app_name = app_name.to_ascii_lowercase();
-    let app_config = app.build_app_config(&registered_app_name)?;
-    app_config_list_inner.push(app_config);
-  }
-
-  let app_config_list = AppConfigList {
-    inner: app_config_list_inner,
-    default_app: config.default_app.clone().map(|v| v.to_ascii_lowercase()), // default backend application for plaintext http requests
-  };
-
-  Ok((proxy_config, app_config_list))
+/// Build proxy and app settings from config using ConfigTomlExt
+pub fn build_settings(config: &ConfigToml) -> Result<(ProxyConfig, AppConfigList), anyhow::Error> {
+  config.validate_and_build_settings()
 }
 
 /* ----------------------- */
+
+/// Helper to build a CryptoFileSource for an app, handling ACME if enabled
+#[cfg(feature = "acme")]
+fn build_tls_for_app_acme(
+  tls: &mut super::toml::TlsOption,
+  acme_option: &Option<super::toml::AcmeOption>,
+  server_name: &str,
+  acme_registry_path: &str,
+  acme_dir_url: &str,
+) -> Result<(), anyhow::Error> {
+  if let Some(true) = tls.acme {
+    ensure!(acme_option.is_some() && tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none());
+    let subdir = format!("{}/{}", acme_registry_path, server_name.to_ascii_lowercase());
+    let file_name =
+      rpxy_acme::DirCache::cached_cert_file_name(&[server_name.to_ascii_lowercase()], acme_dir_url.to_ascii_lowercase());
+    let cert_path = format!("{}/{}", subdir, file_name);
+    tls.tls_cert_key_path = Some(cert_path.clone());
+    tls.tls_cert_path = Some(cert_path);
+  }
+  Ok(())
+}
+
 /// Build cert map
+/// Builds the certificate manager for TLS applications.
+///
+/// # Arguments
+/// * `config` - Reference to the parsed configuration.
+///
+/// # Returns
+/// Returns an option containing a tuple of certificate reloader service and receiver, or `None` if TLS is not enabled.
+/// Returns an error if configuration is invalid or required fields are missing.
 pub async fn build_cert_manager(
   config: &ConfigToml,
 ) -> Result<
@@ -139,19 +128,9 @@ pub async fn build_cert_manager(
       ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some());
 
       #[cfg(feature = "acme")]
-      let tls = {
-        let mut tls = tls.clone();
-        if let Some(true) = tls.acme {
-          ensure!(acme_option.is_some() && tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none());
-          // Both of tls_cert_key_path and tls_cert_path must be the same for ACME since it's a single file
-          let subdir = format!("{}/{}", acme_registry_path, server_name.to_ascii_lowercase());
-          let file_name =
-            rpxy_acme::DirCache::cached_cert_file_name(&[server_name.to_ascii_lowercase()], acme_dir_url.to_ascii_lowercase());
-          tls.tls_cert_key_path = Some(format!("{}/{}", subdir, file_name));
-          tls.tls_cert_path = Some(format!("{}/{}", subdir, file_name));
-        }
-        tls
-      };
+      let mut tls = tls.clone();
+      #[cfg(feature = "acme")]
+      build_tls_for_app_acme(&mut tls, &acme_option, server_name, acme_registry_path, acme_dir_url)?;
 
       let crypto_file_source = CryptoFileSourceBuilder::default()
         .tls_cert_path(tls.tls_cert_path.as_ref().unwrap())
@@ -168,24 +147,31 @@ pub async fn build_cert_manager(
 /* ----------------------- */
 #[cfg(feature = "acme")]
 /// Build acme manager
+/// Builds the ACME manager for automatic certificate management (enabled with the `acme` feature).
+///
+/// # Arguments
+/// * `config` - Reference to the parsed configuration.
+/// * `runtime_handle` - Tokio runtime handle for async operations.
+///
+/// # Returns
+/// Returns an option containing an [`AcmeManager`](rpxy-bin/src/config/parse.rs:153) if ACME is configured, or `None` otherwise.
+/// Returns an error if configuration is invalid or required fields are missing.
 pub async fn build_acme_manager(
   config: &ConfigToml,
   runtime_handle: tokio::runtime::Handle,
 ) -> Result<Option<AcmeManager>, anyhow::Error> {
   let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone());
-  if acme_option.is_none() {
+  let Some(acme_option) = acme_option else {
     return Ok(None);
-  }
-  let acme_option = acme_option.unwrap();
+  };
 
-  let domains = config
+  let domains: Vec<String> = config
     .apps
     .as_ref()
     .unwrap()
     .0
     .values()
     .filter_map(|app| {
-      //
       if let Some(tls) = app.tls.as_ref() {
         if let Some(true) = tls.acme {
           return Some(app.server_name.as_ref().unwrap().to_owned());
@@ -193,7 +179,7 @@ pub async fn build_acme_manager(
       }
       None
     })
-    .collect::<Vec<_>>();
+    .collect();
 
   if domains.is_empty() {
     return Ok(None);
diff --git a/rpxy-bin/src/config/toml.rs b/rpxy-bin/src/config/toml.rs
index b65db91..09c4353 100644
--- a/rpxy-bin/src/config/toml.rs
+++ b/rpxy-bin/src/config/toml.rs
@@ -4,12 +4,25 @@ use crate::{
   log::warn,
 };
 use ahash::HashMap;
-use rpxy_lib::{AppConfig, ProxyConfig, ReverseProxyConfig, TlsConfig, UpstreamUri, reexports::Uri};
+use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig, ReverseProxyConfig, TlsConfig, UpstreamUri, reexports::Uri};
 use serde::Deserialize;
 use std::{fs, net::SocketAddr};
 use tokio::time::Duration;
 
 #[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)]
+/// Main configuration structure parsed from the TOML file.
+///
+/// # Fields
+/// - `listen_port`: Optional TCP port for HTTP.
+/// - `listen_port_tls`: Optional TCP port for HTTPS/TLS.
+/// - `listen_ipv6`: Enable IPv6 listening.
+/// - `https_redirection_port`: Optional port for HTTP to HTTPS redirection.
+/// - `tcp_listen_backlog`: Optional TCP backlog size.
+/// - `max_concurrent_streams`: Optional max concurrent streams.
+/// - `max_clients`: Optional max client connections.
+/// - `apps`: Optional application definitions.
+/// - `default_app`: Optional default application name.
+/// - `experimental`: Optional experimental features.
 pub struct ConfigToml {
   pub listen_port: Option<u16>,
   pub listen_port_tls: Option<u16>,
@@ -23,8 +36,75 @@ pub struct ConfigToml {
   pub experimental: Option<Experimental>,
 }
 
+/// Extension trait for config validation and building
+pub trait ConfigTomlExt {
+  fn validate_and_build_settings(&self) -> Result<(ProxyConfig, AppConfigList), anyhow::Error>;
+}
+
+impl ConfigTomlExt for ConfigToml {
+  fn validate_and_build_settings(&self) -> Result<(ProxyConfig, AppConfigList), anyhow::Error> {
+    let proxy_config: ProxyConfig = self.try_into()?;
+    let apps = self.apps.as_ref().ok_or(anyhow!("Missing application spec"))?;
+
+    // Ensure at least one app is defined
+    ensure!(!apps.0.is_empty(), "Wrong application spec.");
+
+    // Helper: all apps have TLS
+    let all_apps_have_tls = apps.0.values().all(|app| app.tls.is_some());
+
+    // Helper: all apps have https_redirection unset
+    let all_apps_no_https_redirection = apps.0.values().all(|app| {
+      if let Some(tls) = app.tls.as_ref() {
+        tls.https_redirection.is_none()
+      } else {
+        true
+      }
+    });
+
+    if proxy_config.http_port.is_none() {
+      ensure!(all_apps_have_tls, "Some apps serve only plaintext HTTP");
+    }
+    if proxy_config.https_redirection_port.is_some() {
+      ensure!(
+        proxy_config.https_port.is_some() && proxy_config.http_port.is_some(),
+        "https_redirection_port can be specified only when both http_port and https_port are specified"
+      );
+    }
+    if !(proxy_config.https_port.is_some() && proxy_config.http_port.is_some()) {
+      ensure!(
+        all_apps_no_https_redirection,
+        "https_redirection can be specified only when both http_port and https_port are specified"
+      );
+    }
+
+    // Build AppConfigList
+    let mut app_config_list_inner = Vec::<AppConfig>::new();
+    for (app_name, app) in apps.0.iter() {
+      let _server_name_string = app.server_name.as_ref().ok_or(anyhow!("No server name"))?;
+      let registered_app_name = app_name.to_ascii_lowercase();
+      let app_config = app.build_app_config(&registered_app_name)?;
+      app_config_list_inner.push(app_config);
+    }
+    let app_config_list = AppConfigList {
+      inner: app_config_list_inner,
+      default_app: self.default_app.clone().map(|v| v.to_ascii_lowercase()),
+    };
+
+    Ok((proxy_config, app_config_list))
+  }
+}
+
 #[cfg(any(feature = "http3-quinn", feature = "http3-s2n"))]
 #[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)]
+/// HTTP/3 protocol options for server configuration.
+///
+/// # Fields
+/// - `alt_svc_max_age`: Optional max age for Alt-Svc header.
+/// - `request_max_body_size`: Optional maximum request body size.
+/// - `max_concurrent_connections`: Optional maximum concurrent connections.
+/// - `max_concurrent_bidistream`: Optional maximum concurrent bidirectional streams.
+/// - `max_concurrent_unistream`: Optional maximum concurrent unidirectional streams.
+/// - `max_idle_timeout`: Optional maximum idle timeout in milliseconds.
 pub struct Http3Option {
   pub alt_svc_max_age: Option<u32>,
   pub request_max_body_size: Option<usize>,
diff --git a/rpxy-bin/src/constants.rs b/rpxy-bin/src/constants.rs
index 889f7d5..51d3f8d 100644
--- a/rpxy-bin/src/constants.rs
+++ b/rpxy-bin/src/constants.rs
@@ -1,9 +1,12 @@
+/// Default IPv4 listen addresses for the server.
 pub const LISTEN_ADDRESSES_V4: &[&str] = &["0.0.0.0"];
+/// Default IPv6 listen addresses for the server.
 pub const LISTEN_ADDRESSES_V6: &[&str] = &["[::]"];
+/// Delay in seconds before reloading the configuration after changes.
 pub const CONFIG_WATCH_DELAY_SECS: u32 = 15;
 
 #[cfg(feature = "cache")]
-// Cache directory
+/// Directory path for cache storage (enabled with "cache" feature).
 pub const CACHE_DIR: &str = "./cache";
 
 pub(crate) const ACCESS_LOG_FILE: &str = "access.log";
diff --git a/rpxy-bin/src/log.rs b/rpxy-bin/src/log.rs
index d194eb4..29e1993 100644
--- a/rpxy-bin/src/log.rs
+++ b/rpxy-bin/src/log.rs
@@ -8,92 +8,92 @@ pub use tracing::{debug, error, info, warn};
 
 /// Initialize the logger with the RUST_LOG environment variable.
 pub fn init_logger(log_dir_path: Option<&str>) {
-  let level_string = std::env::var("RUST_LOG").unwrap_or_else(|_| "info".to_string());
-  let level = tracing::Level::from_str(level_string.as_str()).unwrap_or(tracing::Level::INFO);
+  let level = std::env::var("RUST_LOG")
+    .ok()
+    .and_then(|s| tracing::Level::from_str(&s).ok())
+    .unwrap_or(tracing::Level::INFO);
 
   match log_dir_path {
-    // log to stdout
     None => init_stdio_logger(level),
-    // log to files
-    Some(log_dir_path) => init_file_logger(level, log_dir_path),
+    Some(path) => init_file_logger(level, path),
   }
 }
 
 /// file logging
 fn init_file_logger(level: tracing::Level, log_dir_path: &str) {
-  println!("Activate logging to files: {log_dir_path}");
-  let log_dir_path = std::path::PathBuf::from(log_dir_path);
-  // create the directory if it does not exist
-  if !log_dir_path.exists() {
-    println!("Directory does not exist, creating: {}", log_dir_path.display());
-    std::fs::create_dir_all(&log_dir_path).expect("Failed to create log directory");
+  println!("Activate logging to files: {}", log_dir_path);
+  let log_dir = std::path::Path::new(log_dir_path);
+
+  if !log_dir.exists() {
+    println!("Directory does not exist, creating: {}", log_dir.display());
+    std::fs::create_dir_all(log_dir).expect("Failed to create log directory");
   }
-  let access_log_path = log_dir_path.join(ACCESS_LOG_FILE);
-  let system_log_path = log_dir_path.join(SYSTEM_LOG_FILE);
+
+  let access_log_path = log_dir.join(ACCESS_LOG_FILE);
+  let system_log_path = log_dir.join(SYSTEM_LOG_FILE);
+
   println!("Access log: {}", access_log_path.display());
   println!("System and error log: {}", system_log_path.display());
 
   let access_log = open_log_file(&access_log_path);
   let system_log = open_log_file(&system_log_path);
 
-  let reg = tracing_subscriber::registry();
-
-  let access_log_base = fmt::layer()
+  let access_layer = fmt::layer()
     .with_line_number(false)
     .with_thread_ids(false)
     .with_thread_names(false)
     .with_target(false)
     .with_level(false)
     .compact()
-    .with_ansi(false);
-  let reg = reg.with(access_log_base.with_writer(access_log).with_filter(AccessLogFilter));
+    .with_ansi(false)
+    .with_writer(access_log)
+    .with_filter(AccessLogFilter);
 
-  let system_log_base = fmt::layer()
+  let system_layer = fmt::layer()
     .with_line_number(false)
     .with_thread_ids(false)
     .with_thread_names(false)
     .with_target(false)
-    .with_level(true) // with level for system log
+    .with_level(true)
     .compact()
-    .with_ansi(false);
-  let reg = reg.with(
-    system_log_base
-      .with_writer(system_log)
-      .with_filter(filter_fn(move |metadata| {
-        (is_cargo_pkg(metadata) && metadata.name() != log_event_names::ACCESS_LOG && metadata.level() <= &level)
-          || metadata.level() <= &tracing::Level::WARN.min(level)
-      })),
-  );
+    .with_ansi(false)
+    .with_writer(system_log)
+    .with_filter(filter_fn(move |metadata| {
+      (is_cargo_pkg(metadata) && metadata.name() != log_event_names::ACCESS_LOG && metadata.level() <= &level)
+        || metadata.level() <= &tracing::Level::WARN.min(level)
+    }));
 
-  reg.init();
+  tracing_subscriber::registry().with(access_layer).with(system_layer).init();
 }
 
 /// stdio logging
 fn init_stdio_logger(level: tracing::Level) {
-  // This limits the logger to emits only this crate with any level above RUST_LOG, for included crates it will emit only ERROR (in prod)/INFO (in dev) or above level.
-  let stdio_layer = fmt::layer().with_level(true).with_thread_ids(false);
-  if level <= tracing::Level::INFO {
-    // in normal deployment environment
-    let stdio_layer = stdio_layer
-      .with_target(false)
-      .compact()
-      .with_filter(filter_fn(move |metadata| {
-        (is_cargo_pkg(metadata) && metadata.level() <= &level) || metadata.level() <= &tracing::Level::WARN.min(level)
-      }));
-    tracing_subscriber::registry().with(stdio_layer).init();
-  } else {
-    // debugging
-    let stdio_layer = stdio_layer
+  // This limits the logger to emit only this crate with any level above RUST_LOG,
+  // for included crates it will emit only ERROR (in prod)/INFO (in dev) or above level.
+  let base_layer = fmt::layer().with_level(true).with_thread_ids(false);
+
+  let debug = level > tracing::Level::INFO;
+  let filter = filter_fn(move |metadata| {
+    if debug {
+      (is_cargo_pkg(metadata) && metadata.level() <= &level) || metadata.level() <= &tracing::Level::INFO.min(level)
+    } else {
+      (is_cargo_pkg(metadata) && metadata.level() <= &level) || metadata.level() <= &tracing::Level::WARN.min(level)
+    }
+  });
+
+  let stdio_layer = if debug {
+    base_layer
       .with_line_number(true)
       .with_target(true)
       .with_thread_names(true)
       .with_target(true)
       .compact()
-      .with_filter(filter_fn(move |metadata| {
-        (is_cargo_pkg(metadata) && metadata.level() <= &level) || metadata.level() <= &tracing::Level::INFO.min(level)
-      }));
-    tracing_subscriber::registry().with(stdio_layer).init();
+      .with_filter(filter)
+  } else {
+    base_layer.with_target(false).compact().with_filter(filter)
   };
+
+  tracing_subscriber::registry().with(stdio_layer).init();
 }
 
 /// Access log filter
@@ -110,7 +110,7 @@ fn open_log_file<P>(path: P) -> std::fs::File
 where
   P: AsRef<std::path::Path>,
 {
-  // crate a file if it does not exist
+  // create a file if it does not exist
   std::fs::OpenOptions::new()
     .create(true)
     .append(true)
@@ -119,9 +119,8 @@ where
 }
 
 #[inline]
-/// Mached with cargo package name with `_` instead of `-`
+/// Matches cargo package name with `_` instead of `-`
 fn is_cargo_pkg(metadata: &tracing::Metadata<'_>) -> bool {
-  metadata
-    .target()
-    .starts_with(env!("CARGO_PKG_NAME").replace('-', "_").as_str())
+  let pkg_name = env!("CARGO_PKG_NAME").replace('-', "_");
+  metadata.target().starts_with(&pkg_name)
 }
diff --git a/rpxy-bin/src/main.rs b/rpxy-bin/src/main.rs
index 822037d..860a804 100644
--- a/rpxy-bin/src/main.rs
+++ b/rpxy-bin/src/main.rs
@@ -71,6 +71,7 @@ struct RpxyService {
 }
 
 impl RpxyService {
+  /// Create a new RpxyService from config and runtime handle.
   async fn new(config_toml: &ConfigToml, runtime_handle: tokio::runtime::Handle) -> Result<Self, anyhow::Error> {
     let (proxy_conf, app_conf) = build_settings(config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?;
 
@@ -80,7 +81,7 @@ impl RpxyService {
       .map(|(s, r)| (Some(Arc::new(s)), Some(r)))
       .unwrap_or((None, None));
 
-    Ok(RpxyService {
+    Ok(Self {
       runtime_handle: runtime_handle.clone(),
       proxy_conf,
       app_conf,

From e0ab2d85fb17ba4d6036fbae2a10374a02fd4f64 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 20 May 2025 22:04:03 +0900
Subject: [PATCH 29/69] nits: refactor

---
 rpxy-bin/src/config/parse.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs
index d139354..aa10795 100644
--- a/rpxy-bin/src/config/parse.rs
+++ b/rpxy-bin/src/config/parse.rs
@@ -1,4 +1,4 @@
-use super::toml::ConfigToml;
+use super::toml::{ConfigToml, ConfigTomlExt};
 use crate::error::{anyhow, ensure};
 use ahash::HashMap;
 use clap::Arg;
@@ -53,8 +53,6 @@ pub fn parse_opts() -> Result<Opts, anyhow::Error> {
   })
 }
 
-use super::toml::ConfigTomlExt;
-
 /// Build proxy and app settings from config using ConfigTomlExt
 pub fn build_settings(config: &ConfigToml) -> Result<(ProxyConfig, AppConfigList), anyhow::Error> {
   config.validate_and_build_settings()

From 5f7772d95704c5733fe113f133b120300104e7c4 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 20 May 2025 22:33:06 +0900
Subject: [PATCH 30/69] bench: updated all bench

---
 bench/README.md                | 123 +++++++++++++++------------------
 bench/docker-compose.amd64.yml |   9 ++-
 bench/docker-compose.yml       |   1 -
 bench/sozu-config.toml         |   2 +-
 4 files changed, 61 insertions(+), 74 deletions(-)

diff --git a/bench/README.md b/bench/README.md
index a713931..e14bec8 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -3,7 +3,7 @@
 This test simply measures the performance of several reverse proxy through HTTP/1.1 by the following command using [`rewrk`](https://github.com/lnx-search/rewrk).
 
 ```sh:
-$ rewrk -c 512 -t 4 -d 15s -h http://localhost:8080 --pct
+rewrk -c 512 -t 4 -d 15s -h http://localhost:8080 --pct
 ```
 
 ## Tests on `linux/arm64/v8`
@@ -94,12 +94,12 @@ Benchmarking 512 connections @ http://localhost:8100 for 15 second(s)
 
 ## Results on `linux/amd64`
 
-Done at Jul. 24, 2023
+Done at May 20, 2025
 
 ### Environment
 
 - `rpxy` commit id: `7c0945a5124418aa9a1024568c1989bb77cf312f`
-- Docker Desktop 4.21.1 (114176)
+- Docker Desktop 4.41.2 (192736)
 - ReWrk 0.3.2 and Wrk 0.4.2
 - iMac '27 (2020, 10-Core Intel Core i9, 128GB RAM)
 
@@ -107,8 +107,8 @@ The docker images of `nginx` and `caddy` for `linux/amd64` were pulled from the
 
 Also, when `Sozu` is configured as an HTTP reverse proxy, it cannot handle HTTP request messages emit from `ReWrk` due to hostname parsing errors though it can correctly handle messages dispatched from `curl` and browsers. So, we additionally test using [`Wrk`](https://github.com/wg/wrk) to examine `Sozu` with the following command.
 
-```sh:
-$ wrk -c 512 -t 4 -d 15s http://localhost:8110
+```bash
+wrk -c 512 -t 4 -d 15s http://localhost:8110
 ```
 
 <!-- ```
@@ -119,7 +119,7 @@ ERROR  Error connecting to backend: Could not get cluster id from request: Host
 
 #### With ReWrk for `rpxy`, `nginx` and `caddy`
 
-```
+```bash
 ----------------------------
 Benchmark [x86_64] with ReWrk
 ----------------------------
@@ -128,24 +128,22 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8080 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    20.37ms  8.95ms   1.63ms   160.27ms
+    15.75ms  6.75ms   1.75ms   124.25ms
   Requests:
-    Total: 376345  Req/Sec: 25095.19
+    Total: 486635  Req/Sec: 32445.33
   Transfer:
-    Total: 295.61 MB Transfer Rate: 19.71 MB/Sec
+    Total: 381.02 MB Transfer Rate: 25.40 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |    112.50ms     |
-|       99%       |     61.33ms     |
-|       95%       |     44.26ms     |
-|       90%       |     38.74ms     |
-|       75%       |     32.00ms     |
-|       50%       |     26.82ms     |
+|      99.9%      |     91.91ms     |
+|       99%       |     55.53ms     |
+|       95%       |     34.87ms     |
+|       90%       |     29.55ms     |
+|       75%       |     23.99ms     |
+|       50%       |     20.17ms     |
 + --------------- + --------------- +
 
-626 Errors: error shutting down connection: Socket is not connected (os error 57)
-
 sleep 3 secs
 ----------------------------
 Benchmark on nginx
@@ -153,24 +151,22 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8090 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    23.45ms  12.42ms  1.18ms   154.44ms
+    24.02ms  15.84ms  1.31ms   207.97ms
   Requests:
-    Total: 326685  Req/Sec: 21784.73
+    Total: 318516  Req/Sec: 21236.67
   Transfer:
-    Total: 265.22 MB Transfer Rate: 17.69 MB/Sec
+    Total: 259.11 MB Transfer Rate: 17.28 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |     96.85ms     |
-|       99%       |     73.93ms     |
-|       95%       |     57.57ms     |
-|       90%       |     50.36ms     |
-|       75%       |     40.57ms     |
-|       50%       |     32.70ms     |
+|      99.9%      |    135.56ms     |
+|       99%       |     92.59ms     |
+|       95%       |     68.54ms     |
+|       90%       |     58.75ms     |
+|       75%       |     45.88ms     |
+|       50%       |     35.64ms     |
 + --------------- + --------------- +
 
-657 Errors: error shutting down connection: Socket is not connected (os error 57)
-
 sleep 3 secs
 ----------------------------
 Benchmark on caddy
@@ -178,30 +174,26 @@ Beginning round 1...
 Benchmarking 512 connections @ http://localhost:8100 for 15 second(s)
   Latencies:
     Avg      Stdev    Min      Max
-    45.71ms  50.47ms  0.88ms   908.49ms
+    74.60ms  181.26ms  0.94ms   2723.20ms
   Requests:
-    Total: 166917  Req/Sec: 11129.80
+    Total: 101893  Req/Sec: 6792.16
   Transfer:
-    Total: 133.77 MB Transfer Rate: 8.92 MB/Sec
+    Total: 82.03 MB Transfer Rate: 5.47 MB/Sec
 + --------------- + --------------- +
 |   Percentile    |   Avg Latency   |
 + --------------- + --------------- +
-|      99.9%      |    608.92ms     |
-|       99%       |    351.18ms     |
-|       95%       |    210.56ms     |
-|       90%       |    162.68ms     |
-|       75%       |    106.97ms     |
-|       50%       |     73.90ms     |
+|      99.9%      |    2232.12ms    |
+|       99%       |    1517.73ms    |
+|       95%       |    624.63ms     |
+|       90%       |    406.69ms     |
+|       75%       |    222.42ms     |
+|       50%       |    133.46ms     |
 + --------------- + --------------- +
-
-646 Errors: error shutting down connection: Socket is not connected (os error 57)
-
-sleep 3 secs
 ```
 
 #### With Wrk for `rpxy`, `nginx`, `caddy` and `sozu`
 
-```
+```bash
 ----------------------------
 Benchmark [x86_64] with Wrk
 ----------------------------
@@ -209,12 +201,11 @@ Benchmark on rpxy
 Running 15s test @ http://localhost:8080
   4 threads and 512 connections
   Thread Stats   Avg      Stdev     Max   +/- Stdev
-    Latency    18.68ms    8.09ms 122.64ms   74.03%
-    Req/Sec     6.95k   815.23     8.45k    83.83%
-  414819 requests in 15.01s, 326.37MB read
-  Socket errors: connect 0, read 608, write 0, timeout 0
-Requests/sec:  27627.79
-Transfer/sec:     21.74MB
+    Latency    15.65ms    6.94ms 104.73ms   81.28%
+    Req/Sec     8.36k     0.90k    9.90k    77.83%
+  499550 requests in 15.02s, 391.14MB read
+Requests/sec:  33267.61
+Transfer/sec:     26.05MB
 
 sleep 3 secs
 ----------------------------
@@ -222,12 +213,11 @@ Benchmark on nginx
 Running 15s test @ http://localhost:8090
   4 threads and 512 connections
   Thread Stats   Avg      Stdev     Max   +/- Stdev
-    Latency    23.34ms   13.80ms 126.06ms   74.66%
-    Req/Sec     5.71k   607.41     7.07k    73.17%
-  341127 requests in 15.03s, 277.50MB read
-  Socket errors: connect 0, read 641, write 0, timeout 0
-Requests/sec:  22701.54
-Transfer/sec:     18.47MB
+    Latency    24.26ms   15.29ms 167.43ms   73.34%
+    Req/Sec     5.53k   493.14     6.91k    69.67%
+  330569 requests in 15.02s, 268.91MB read
+Requests/sec:  22014.96
+Transfer/sec:     17.91MB
 
 sleep 3 secs
 ----------------------------
@@ -235,13 +225,13 @@ Benchmark on caddy
 Running 15s test @ http://localhost:8100
   4 threads and 512 connections
   Thread Stats   Avg      Stdev     Max   +/- Stdev
-    Latency    54.19ms   55.63ms 674.53ms   88.55%
-    Req/Sec     2.92k     1.40k    5.57k    56.17%
-  174748 requests in 15.03s, 140.61MB read
-  Socket errors: connect 0, read 660, write 0, timeout 0
-  Non-2xx or 3xx responses: 70
-Requests/sec:  11624.63
-Transfer/sec:      9.35MB
+    Latency   212.89ms  300.23ms   1.99s    86.56%
+    Req/Sec     1.31k     1.64k    5.72k    78.79%
+  67749 requests in 15.04s, 51.97MB read
+  Socket errors: connect 0, read 0, write 0, timeout 222
+  Non-2xx or 3xx responses: 3686
+Requests/sec:   4505.12
+Transfer/sec:      3.46MB
 
 sleep 3 secs
 ----------------------------
@@ -249,10 +239,9 @@ Benchmark on sozu
 Running 15s test @ http://localhost:8110
   4 threads and 512 connections
   Thread Stats   Avg      Stdev     Max   +/- Stdev
-    Latency    19.78ms    4.89ms  98.09ms   76.88%
-    Req/Sec     6.49k   824.75     8.11k    76.17%
-  387744 requests in 15.02s, 329.11MB read
-  Socket errors: connect 0, read 647, write 0, timeout 0
-Requests/sec:  25821.93
-Transfer/sec:     21.92MB
+    Latency    34.68ms    6.30ms  90.21ms   72.49%
+    Req/Sec     3.69k   397.85     5.08k    73.00%
+  220655 requests in 15.01s, 187.29MB read
+Requests/sec:  14699.17
+Transfer/sec:     12.48MB
 ```
diff --git a/bench/docker-compose.amd64.yml b/bench/docker-compose.amd64.yml
index a440138..d2e2f6e 100644
--- a/bench/docker-compose.amd64.yml
+++ b/bench/docker-compose.amd64.yml
@@ -1,4 +1,3 @@
-version: "3"
 services:
   nginx:
     image: nginx:alpine
@@ -28,7 +27,7 @@ services:
       dockerfile: docker/Dockerfile
     restart: unless-stopped
     environment:
-      - LOG_LEVEL=info
+      - LOG_LEVEL=error # almost nolog
       - LOG_TO_FILE=false
     ports:
       - 127.0.0.1:8080:8080
@@ -47,7 +46,7 @@ services:
     tty: false
     privileged: true
     volumes:
-      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro # set as almost nolog
       - /var/run/docker.sock:/tmp/docker.sock:ro
     logging:
       options:
@@ -64,7 +63,7 @@ services:
     restart: unless-stopped
     tty: false
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro # set as almost no log
     networks:
       bench-nw:
 
@@ -82,7 +81,7 @@ services:
         max-size: "10m"
         max-file: "3"
     volumes:
-      - ./sozu-config.toml:/etc/sozu/config.toml
+      - ./sozu-config.toml:/etc/sozu/config.toml # set as almost nolog
     networks:
       bench-nw:
 
diff --git a/bench/docker-compose.yml b/bench/docker-compose.yml
index aaf800d..7314416 100644
--- a/bench/docker-compose.yml
+++ b/bench/docker-compose.yml
@@ -1,4 +1,3 @@
-version: "3"
 services:
   nginx:
     image: nginx:alpine
diff --git a/bench/sozu-config.toml b/bench/sozu-config.toml
index ab76515..dbf00e0 100644
--- a/bench/sozu-config.toml
+++ b/bench/sozu-config.toml
@@ -1,4 +1,4 @@
-log_level = "info"
+log_level = "error"
 log_target = "stdout"
 max_connections = 512
 activate_listeners = true

From 73ad9dec4d599acc8f1b6e8e87b4d2f703e0e240 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 20 May 2025 22:40:02 +0900
Subject: [PATCH 31/69] [ci skip] fix commit id in bench

---
 bench/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bench/README.md b/bench/README.md
index e14bec8..5307c2b 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -98,7 +98,7 @@ Done at May 20, 2025
 
 ### Environment
 
-- `rpxy` commit id: `7c0945a5124418aa9a1024568c1989bb77cf312f`
+- `rpxy` commit id: `e259e0b58897258d98fdb7504a1cbcbd7c5b37db`
 - Docker Desktop 4.41.2 (192736)
 - ReWrk 0.3.2 and Wrk 0.4.2
 - iMac '27 (2020, 10-Core Intel Core i9, 128GB RAM)

From 886aa74d6c77db0ff0496fde670dd5daf609bc6f Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 20 May 2025 22:50:54 +0900
Subject: [PATCH 32/69] chore: refactor

---
 rpxy-lib/src/forwarder/cache/cache_main.rs | 53 +++++++++++++---------
 rpxy-lib/src/forwarder/client.rs           | 12 ++---
 2 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/rpxy-lib/src/forwarder/cache/cache_main.rs b/rpxy-lib/src/forwarder/cache/cache_main.rs
index 784000f..88c1201 100644
--- a/rpxy-lib/src/forwarder/cache/cache_main.rs
+++ b/rpxy-lib/src/forwarder/cache/cache_main.rs
@@ -52,21 +52,30 @@ impl RpxyCache {
     if !globals.proxy_config.cache_enabled {
       return None;
     }
-    let cache_dir = globals.proxy_config.cache_dir.as_ref().unwrap();
+    let cache_dir = match globals.proxy_config.cache_dir.as_ref() {
+      Some(dir) => dir,
+      None => {
+        warn!("Cache directory not set in proxy config");
+        return None;
+      }
+    };
     let file_store = FileStore::new(&globals.runtime_handle).await;
     let inner = LruCacheManager::new(globals.proxy_config.cache_max_entry);
 
     let max_each_size = globals.proxy_config.cache_max_each_size;
     let mut max_each_size_on_memory = globals.proxy_config.cache_max_each_size_on_memory;
     if max_each_size < max_each_size_on_memory {
-      warn!("Maximum size of on memory cache per entry must be smaller than or equal to the maximum of each file cache");
+      warn!("Maximum size of on-memory cache per entry must be smaller than or equal to the maximum of each file cache");
       max_each_size_on_memory = max_each_size;
     }
 
     if let Err(e) = fs::remove_dir_all(cache_dir).await {
       warn!("Failed to clean up the cache dir: {e}");
-    };
-    fs::create_dir_all(&cache_dir).await.unwrap();
+    }
+    if let Err(e) = fs::create_dir_all(&cache_dir).await {
+      error!("Failed to create cache dir: {e}");
+      return None;
+    }
 
     Some(Self {
       file_store,
@@ -256,20 +265,19 @@ impl FileStore {
     let inner = self.inner.read().await;
     inner.cnt
   }
-  /// Create a temporary file cache
+  /// Create a temporary file cache, returns error if file cannot be created or written
   async fn create(&mut self, cache_object: &CacheObject, body_bytes: &Bytes) -> CacheResult<()> {
     let mut inner = self.inner.write().await;
     inner.create(cache_object, body_bytes).await
   }
-  /// Evict a temporary file cache
+  /// Evict a temporary file cache, logs warning if removal fails
   async fn evict(&self, path: impl AsRef<Path>) {
-    // Acquire the write lock
     let mut inner = self.inner.write().await;
     if let Err(e) = inner.remove(path).await {
       warn!("Eviction failed during file object removal: {:?}", e);
-    };
+    }
   }
-  /// Read a temporary file cache
+  /// Read a temporary file cache, returns error if file cannot be opened or hash mismatches
   async fn read(&self, path: impl AsRef<Path> + Send + Sync + 'static, hash: &Bytes) -> CacheResult<UnboundedStreamBody> {
     let inner = self.inner.read().await;
     inner.read(path, hash).await
@@ -305,15 +313,15 @@ impl FileStoreInner {
         return Err(CacheError::InvalidCacheTarget);
       }
     };
-    let Ok(mut file) = File::create(&cache_filepath).await else {
-      return Err(CacheError::FailedToCreateFileCache);
-    };
+    let mut file = File::create(&cache_filepath)
+      .await
+      .map_err(|_| CacheError::FailedToCreateFileCache)?;
     let mut bytes_clone = body_bytes.clone();
     while bytes_clone.has_remaining() {
-      if let Err(e) = file.write_buf(&mut bytes_clone).await {
+      file.write_buf(&mut bytes_clone).await.map_err(|e| {
         error!("Failed to write file cache: {e}");
-        return Err(CacheError::FailedToWriteFileCache);
-      };
+        CacheError::FailedToWriteFileCache
+      })?;
     }
     self.cnt += 1;
     Ok(())
@@ -435,11 +443,14 @@ impl LruCacheManager {
     self.cnt.load(Ordering::Relaxed)
   }
 
-  /// Evict an entry
+  /// Evict an entry from the LRU cache, logs error if mutex cannot be acquired
   fn evict(&self, cache_key: &str) -> Option<(String, CacheObject)> {
-    let Ok(mut lock) = self.inner.lock() else {
-      error!("Mutex can't be locked to evict a cache entry");
-      return None;
+    let mut lock = match self.inner.lock() {
+      Ok(lock) => lock,
+      Err(_) => {
+        error!("Mutex can't be locked to evict a cache entry");
+        return None;
+      }
     };
     let res = lock.pop_entry(cache_key);
     // This may be inconsistent with the actual number of entries
@@ -447,7 +458,7 @@ impl LruCacheManager {
     res
   }
 
-  /// Push an entry
+  /// Push an entry into the LRU cache, returns error if mutex cannot be acquired
   fn push(&self, cache_key: &str, cache_object: &CacheObject) -> CacheResult<Option<(String, CacheObject)>> {
     let mut lock = self.inner.lock().map_err(|_| {
       error!("Failed to acquire mutex lock for writing cache entry");
@@ -459,7 +470,7 @@ impl LruCacheManager {
     res
   }
 
-  /// Get an entry
+  /// Get an entry from the LRU cache, returns error if mutex cannot be acquired
   fn get(&self, cache_key: &str) -> CacheResult<Option<CacheObject>> {
     let mut lock = self.inner.lock().map_err(|_| {
       error!("Mutex can't be locked for checking cache entry");
diff --git a/rpxy-lib/src/forwarder/client.rs b/rpxy-lib/src/forwarder/client.rs
index 45597bc..0e3c6cb 100644
--- a/rpxy-lib/src/forwarder/client.rs
+++ b/rpxy-lib/src/forwarder/client.rs
@@ -126,9 +126,9 @@ where
     warn!(
       "
 --------------------------------------------------------------------------------------------------
-Request forwarder is working without TLS support!!!
-We recommend to use this just for testing.
-Please enable native-tls-backend or rustls-backend feature to enable TLS support.
+Request forwarder is working without TLS support!
+This mode is intended for testing only.
+Enable 'native-tls-backend' or 'rustls-backend' feature for TLS support.
 --------------------------------------------------------------------------------------------------"
     );
     let executor = LocalExecutor::new(_globals.runtime_handle.clone());
@@ -159,7 +159,7 @@ where
   /// Build forwarder
   pub async fn try_new(_globals: &Arc<Globals>) -> RpxyResult<Self> {
     // build hyper client with hyper-tls
-    info!("Native TLS support is enabled for the connection to backend applications");
+    info!("Native TLS support enabled for backend connections (native-tls)");
     let executor = LocalExecutor::new(_globals.runtime_handle.clone());
 
     let try_build_connector = |alpns: &[&str]| {
@@ -209,14 +209,14 @@ where
     #[cfg(feature = "webpki-roots")]
     let builder_h2 = hyper_rustls::HttpsConnectorBuilder::new().with_webpki_roots();
     #[cfg(feature = "webpki-roots")]
-    info!("Mozilla WebPKI root certs with rustls is used for the connection to backend applications");
+    info!("Rustls backend: Mozilla WebPKI root certs used for backend connections");
 
     #[cfg(not(feature = "webpki-roots"))]
     let builder = hyper_rustls::HttpsConnectorBuilder::new().with_platform_verifier();
     #[cfg(not(feature = "webpki-roots"))]
     let builder_h2 = hyper_rustls::HttpsConnectorBuilder::new().with_platform_verifier();
     #[cfg(not(feature = "webpki-roots"))]
-    info!("Platform verifier with rustls is used for the connection to backend applications");
+    info!("Rustls backend: Platform verifier used for backend connections");
 
     let mut http = HttpConnector::new();
     http.enforce_http(false);

From e60e5f68a182fd204c65ce779f79fc28247fe4c8 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 21 May 2025 19:07:29 +0900
Subject: [PATCH 33/69] chore: update permissions for actions

---
 .github/dependabot.yml               | 23 -----------------------
 .github/workflows/ci.yml             |  3 +++
 .github/workflows/release.yml        | 10 ++++++++++
 .github/workflows/release_docker.yml |  8 ++++++++
 .github/workflows/shift_left.yml     |  2 ++
 5 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e39c88b..812dd50 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,3 @@
-# Basic dependabot.yml file with
-# minimum configuration for two package managers
-
 version: 2
 updates:
   # Enable version updates for cargo
@@ -9,26 +6,6 @@ updates:
     schedule:
       interval: "daily"
 
-  - package-ecosystem: "cargo"
-    directory: "/rpxy-bin"
-    schedule:
-      interval: "daily"
-
-  - package-ecosystem: "cargo"
-    directory: "/rpxy-lib"
-    schedule:
-      interval: "daily"
-
-  - package-ecosystem: "cargo"
-    directory: "/rpxy-certs"
-    schedule:
-      interval: "daily"
-
-  - package-ecosystem: "cargo"
-    directory: "/rpxy-acme"
-    schedule:
-      interval: "daily"
-
   # Enable version updates for Docker
   - package-ecosystem: "docker"
     directory: "/docker"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d9c9478..ec06f55 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     types: [synchronize, opened]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c0dca6..d2d0517 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,10 @@ on:
 
 jobs:
   on-success:
+    permissions:
+      contents: read
+      packages: read
+
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' }} || ${{ github.event_name == 'repositry_dispatch' }}
     strategy:
@@ -98,12 +102,18 @@ jobs:
           path: "/tmp/${{ steps.set-env.outputs.target_name }}"
 
   on-failure:
+    permissions:
+      contents: read
+
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'failure' }}
     steps:
       - run: echo 'The release triggering workflows failed'
 
   release:
+    permissions:
+      contents: write
+
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'repository_dispatch' }}
     needs: on-success
diff --git a/.github/workflows/release_docker.yml b/.github/workflows/release_docker.yml
index 9ebc053..57fe7fd 100644
--- a/.github/workflows/release_docker.yml
+++ b/.github/workflows/release_docker.yml
@@ -16,6 +16,10 @@ env:
 
 jobs:
   build_and_push:
+    permissions:
+      contents: read
+      packages: write
+
     runs-on: ubuntu-22.04
     if: ${{ github.event_name == 'push' }} || ${{ github.event_name == 'pull_request' && github.event.pull_request.merged == true }}
     strategy:
@@ -199,6 +203,10 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
   dispatch_release_event:
+    permissions:
+      contents: write
+      actions: write
+
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref == 'develop' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.merged == true }}
     needs: build_and_push
diff --git a/.github/workflows/shift_left.yml b/.github/workflows/shift_left.yml
index 48e0c18..c8a4fa4 100644
--- a/.github/workflows/shift_left.yml
+++ b/.github/workflows/shift_left.yml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   Scan-Build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

From 462954057e5a8f8a5025e9c0d19c3cae061385ef Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 23 May 2025 22:22:17 +0000
Subject: [PATCH 34/69] chore(deps): bump hyper-rustls from 0.27.5 to 0.27.6

Bumps [hyper-rustls](https://github.com/rustls/hyper-rustls) from 0.27.5 to 0.27.6.
- [Release notes](https://github.com/rustls/hyper-rustls/releases)
- [Commits](https://github.com/rustls/hyper-rustls/compare/v/0.27.5...v/0.27.6)

---
updated-dependencies:
- dependency-name: hyper-rustls
  dependency-version: 0.27.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 7 +++----
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3103f71..3875602 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1176,11 +1176,10 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.5"
+version = "0.27.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
+checksum = "03a01595e11bdcec50946522c32dde3fc6914743000a68b93000965f2f02406d"
 dependencies = [
- "futures-util",
  "http",
  "hyper",
  "hyper-util",
@@ -1190,7 +1189,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 0.26.11",
+ "webpki-roots 1.0.0",
 ]
 
 [[package]]
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 72b3541..7a1c0f3 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -70,7 +70,7 @@ hyper-tls = { version = "0.6.0", features = [
   "alpn",
   "vendored",
 ], optional = true }
-hyper-rustls = { version = "0.27.5", default-features = false, features = [
+hyper-rustls = { version = "0.27.6", default-features = false, features = [
   "aws-lc-rs",
   "http1",
   "http2",

From dd80f687608d4a941154951d8092560c2a3911ed Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 26 May 2025 12:47:45 +0900
Subject: [PATCH 35/69] chore: deps

---
 Cargo.lock            | 4 ++--
 rpxy-acme/Cargo.toml  | 2 +-
 rpxy-bin/Cargo.toml   | 2 +-
 rpxy-certs/Cargo.toml | 2 +-
 rpxy-lib/Cargo.toml   | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3875602..88efd12 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2879,9 +2879,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
 dependencies = [
  "backtrace",
  "bytes",
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index 6c0b23e..837d010 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -33,6 +33,6 @@ rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, f
   "aws-lc-rs",
 ] }
 rustls-post-quantum = { version = "0.2.2", optional = true }
-tokio = { version = "1.45.0", default-features = false }
+tokio = { version = "1.45.1", default-features = false }
 tokio-util = { version = "0.7.15", default-features = false }
 tokio-stream = { version = "0.1.17", default-features = false }
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index a0664ac..6b51337 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -35,7 +35,7 @@ libmimalloc-sys = { version = "=0.1.40" }
 anyhow = "1.0.98"
 ahash = "0.8.12"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }
-tokio = { version = "1.45.0", default-features = false, features = [
+tokio = { version = "1.45.1", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index 3ccbc19..a41d957 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -35,7 +35,7 @@ rustls-post-quantum = { version = "0.2.2", optional = true }
 x509-parser = { version = "0.17.0" }
 
 [dev-dependencies]
-tokio = { version = "1.45.0", default-features = false, features = [
+tokio = { version = "1.45.1", default-features = false, features = [
   "rt-multi-thread",
   "macros",
 ] }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 7a1c0f3..f47a748 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -41,7 +41,7 @@ ahash = "0.8.12"
 bytes = "1.10.1"
 derive_builder = "0.20.2"
 futures = { version = "0.3.31", features = ["alloc", "async-await"] }
-tokio = { version = "1.45.0", default-features = false, features = [
+tokio = { version = "1.45.1", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",

From 83a8fa22599a8a6a4455c211ce7ae2a94bf63c52 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 26 May 2025 13:18:40 +0900
Subject: [PATCH 36/69] fmt

---
 rpxy-lib/src/count.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rpxy-lib/src/count.rs b/rpxy-lib/src/count.rs
index 2ca4028..7debe79 100644
--- a/rpxy-lib/src/count.rs
+++ b/rpxy-lib/src/count.rs
@@ -1,6 +1,6 @@
 use std::sync::{
-  atomic::{AtomicUsize, Ordering},
   Arc,
+  atomic::{AtomicUsize, Ordering},
 };
 
 #[derive(Debug, Clone, Default)]

From a66585002e6111c77a496aa982f905ef82f8d6e1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 26 May 2025 22:31:57 +0000
Subject: [PATCH 37/69] chore(deps): bump socket2 from 0.5.9 to 0.5.10

Bumps [socket2](https://github.com/rust-lang/socket2) from 0.5.9 to 0.5.10.
- [Release notes](https://github.com/rust-lang/socket2/releases)
- [Changelog](https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/socket2/commits)

---
updated-dependencies:
- dependency-name: socket2
  dependency-version: 0.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 4 ++--
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 88efd12..b66436d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2700,9 +2700,9 @@ checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
 
 [[package]]
 name = "socket2"
-version = "0.5.9"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index f47a748..e98d803 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -104,7 +104,7 @@ s2n-quic-h3 = { path = "../submodules/s2n-quic/quic/s2n-quic-h3/", features = [
 ], optional = true }
 ##########
 # for UDP socket wit SO_REUSEADDR when h3 with quinn
-socket2 = { version = "0.5.9", features = ["all"], optional = true }
+socket2 = { version = "0.5.10", features = ["all"], optional = true }
 
 # cache
 http-cache-semantics = { path = "../submodules/rusty-http-cache-semantics", default-features = false, optional = true }

From 075ca9544ab79c1ff3a9b57068665f6bde23eff4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 27 May 2025 22:59:10 +0000
Subject: [PATCH 38/69] chore(deps): bump clap from 4.5.38 to 4.5.39

Bumps [clap](https://github.com/clap-rs/clap) from 4.5.38 to 4.5.39.
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.38...clap_complete-v4.5.39)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.5.39
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 8 ++++----
 rpxy-bin/Cargo.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b66436d..f2b94a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -474,18 +474,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.38"
+version = "4.5.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed93b9805f8ba930df42c2590f05453d5ec36cbb85d018868a5b24d31f6ac000"
+checksum = "fd60e63e9be68e5fb56422e397cf9baddded06dae1d2e523401542383bc72a9f"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.38"
+version = "4.5.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "379026ff283facf611b0ea629334361c4211d1b12ee01024eec1591133b04120"
+checksum = "89cc6392a1f72bbeb820d71f32108f61fdaf18bc526e1d23954168a67759ef51"
 dependencies = [
  "anstream",
  "anstyle",
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 6b51337..5e07d0e 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -47,7 +47,7 @@ async-trait = "0.1.88"
 futures-util = { version = "0.3.31", default-features = false }
 
 # config
-clap = { version = "4.5.38", features = ["std", "cargo", "wrap_help"] }
+clap = { version = "4.5.39", features = ["std", "cargo", "wrap_help"] }
 toml = { version = "0.8.22", default-features = false, features = ["parse"] }
 hot_reload = "0.1.9"
 serde_ignored = "0.1.12"

From ac78d9cfabe2222e95e6d2cc05c06eeca48cf500 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 27 May 2025 22:59:26 +0000
Subject: [PATCH 39/69] chore(deps): bump hyper-util from 0.1.12 to 0.1.13

Bumps [hyper-util](https://github.com/hyperium/hyper-util) from 0.1.12 to 0.1.13.
- [Release notes](https://github.com/hyperium/hyper-util/releases)
- [Changelog](https://github.com/hyperium/hyper-util/blob/master/CHANGELOG.md)
- [Commits](https://github.com/hyperium/hyper-util/compare/v0.1.12...v0.1.13)

---
updated-dependencies:
- dependency-name: hyper-util
  dependency-version: 0.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 5 +++--
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b66436d..d44cdd4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1210,12 +1210,13 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9f1e950e0d9d1d3c47184416723cf29c0d1f93bd8cccf37e4beb6b44f31710"
+checksum = "b1c293b6b3d21eca78250dc7dbebd6b9210ec5530e038cbfe0661b5c47ab06e8"
 dependencies = [
  "bytes",
  "futures-channel",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index e98d803..4b97463 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -61,7 +61,7 @@ thiserror = "2.0.12"
 http = "1.3.1"
 http-body-util = "0.1.3"
 hyper = { version = "1.6.0", default-features = false }
-hyper-util = { version = "0.1.12", features = ["full"] }
+hyper-util = { version = "0.1.13", features = ["full"] }
 futures-util = { version = "0.3.31", default-features = false }
 futures-channel = { version = "0.3.31", default-features = false }
 

From ff5d0144054fd288a9c5209422cb39ff1d990192 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 30 May 2025 10:13:01 +0900
Subject: [PATCH 40/69] deps: s2n-quic

---
 Cargo.lock          | 90 ++++++++++++++++++++++++---------------------
 rpxy-lib/Cargo.toml |  6 +--
 submodules/s2n-quic |  2 +-
 3 files changed, 52 insertions(+), 46 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d9df853..e4e705a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -101,12 +101,12 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.7"
+version = "3.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
+checksum = "6680de5231bd6ee4c6191b8a1325daa282b415391ec9d3a37bd34f2060dc73fa"
 dependencies = [
  "anstyle",
- "once_cell",
+ "once_cell_polyfill",
  "windows-sys 0.59.0",
 ]
 
@@ -182,9 +182,9 @@ dependencies = [
 
 [[package]]
 name = "async-io"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a2b323ccce0a1d90b449fd71f2a06ca7faa7c54c2751f06c9bd851fc061059"
+checksum = "1237c0ae75a0f3765f58910ff9cdd0a12eeb39ab2f4c7de23262f337f0aacbb3"
 dependencies = [
  "async-lock",
  "cfg-if",
@@ -193,7 +193,7 @@ dependencies = [
  "futures-lite",
  "parking",
  "polling",
- "rustix 0.38.44",
+ "rustix 1.0.7",
  "slab",
  "tracing",
  "windows-sys 0.59.0",
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.23"
+version = "1.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f4ac86a9e5bc1e2b3449ab9d7d3a6a405e3d1bb28d7b9be8614f55846ae3766"
+checksum = "16595d3be041c03b09d08d0858631facccee9221e579704070e6e9e4915d3bc7"
 dependencies = [
  "jobserver",
  "libc",
@@ -546,9 +546,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1061,9 +1061,9 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.4.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+checksum = "f154ce46856750ed433c8649605bf7ed2de3bc35fd9d2a9f30cddd873c80cb08"
 
 [[package]]
 name = "hex"
@@ -1468,9 +1468,9 @@ checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
 name = "libloading"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a793df0d7afeac54f95b471d3af7f0d4fb975699f972341a4b76988d49cdf0c"
+checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
 dependencies = [
  "cfg-if",
  "windows-targets 0.53.0",
@@ -1581,13 +1581,13 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1697,10 +1697,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
-name = "openssl"
-version = "0.10.72"
+name = "once_cell_polyfill"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fedfea7d58a1f73118430a55da6a286e7b044961736ce96a16a17068ea25e5da"
+checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
+
+[[package]]
+name = "openssl"
+version = "0.10.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -1739,9 +1745,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.108"
+version = "0.9.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e145e1651e858e820e4860f7b9c5e169bc1d8ce1c86043be79fa7b7634821847"
+checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
 dependencies = [
  "cc",
  "libc",
@@ -1809,15 +1815,15 @@ checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
 name = "polling"
-version = "3.7.4"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a604568c3202727d1507653cb121dbd627a58684eb09a820fd746bee38b4442f"
+checksum = "b53a684391ad002dd6a596ceb6c74fd004fdce75f4be2e3f615068abbea5fd50"
 dependencies = [
  "cfg-if",
  "concurrent-queue",
  "hermit-abi",
  "pin-project-lite",
- "rustix 0.38.44",
+ "rustix 1.0.7",
  "tracing",
  "windows-sys 0.59.0",
 ]
@@ -2324,7 +2330,7 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19787cda76408ec5404443dc8b31795c87cd8fec49762dc75fa727740d34acc1"
 dependencies = [
- "core-foundation 0.10.0",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "jni",
  "log",
@@ -2368,9 +2374,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.20"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
+checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
 
 [[package]]
 name = "ryu"
@@ -2380,7 +2386,7 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "s2n-codec"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "byteorder",
  "bytes",
@@ -2389,7 +2395,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic"
-version = "1.58.0"
+version = "1.59.0"
 dependencies = [
  "bytes",
  "cfg-if",
@@ -2412,7 +2418,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-core"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "atomic-waker",
  "byteorder",
@@ -2431,7 +2437,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-crypto"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "aws-lc-rs",
  "cfg-if",
@@ -2454,7 +2460,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-platform"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "cfg-if",
  "futures",
@@ -2467,7 +2473,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-rustls"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "bytes",
  "rustls",
@@ -2480,7 +2486,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "bytes",
  "errno",
@@ -2493,7 +2499,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls-default"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "s2n-quic-rustls",
  "s2n-quic-tls",
@@ -2501,7 +2507,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-transport"
-version = "0.58.0"
+version = "0.59.0"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -2517,9 +2523,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "821c6c037686bbc60273f3c4af20012eecbe5e9b1c4ac3d7f766a1f2464681bf"
+checksum = "6c5b886e605d71d8e78e37c7f6195887112f4c9d0a3269057f6447d3dae99908"
 dependencies = [
  "errno",
  "hex",
@@ -2530,9 +2536,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls-sys"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a755df740916e2fc0aaf99c6fc0e519028702a75bff018b6b55a735eada406a"
+checksum = "753c5eb4a0632b275ee3c503b0a108b2430b429566c86501f311f67cf579b35f"
 dependencies = [
  "aws-lc-rs",
  "cc",
@@ -2586,7 +2592,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316"
 dependencies = [
  "bitflags",
- "core-foundation 0.10.0",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 4b97463..8cf0a10 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -94,11 +94,11 @@ tracing = { version = "0.1.41" }
 quinn = { version = "0.11.8", optional = true }
 h3 = { version = "0.0.8", features = ["tracing"], optional = true }
 h3-quinn = { version = "0.0.10", optional = true }
-s2n-quic = { version = "1.58.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
+s2n-quic = { version = "1.59.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
   "provider-tls-rustls",
 ], optional = true }
-s2n-quic-core = { version = "0.58.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
-s2n-quic-rustls = { version = "0.58.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
+s2n-quic-core = { version = "0.59.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
+s2n-quic-rustls = { version = "0.59.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
 s2n-quic-h3 = { path = "../submodules/s2n-quic/quic/s2n-quic-h3/", features = [
   "tracing",
 ], optional = true }
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index f48dc68..b2e9eac 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit f48dc6846fc363ab668441ff5a471fc27199bb55
+Subproject commit b2e9eac31c1b620d2fd0aa40753ca965a1ec1269

From 8915568fdd5a0252077422674497d407eab39f1c Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 30 May 2025 10:40:19 +0900
Subject: [PATCH 41/69] update Jenkinsfile

---
 .build/Jenkinsfile | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/.build/Jenkinsfile b/.build/Jenkinsfile
index e34c5fb..2fa7b2d 100644
--- a/.build/Jenkinsfile
+++ b/.build/Jenkinsfile
@@ -37,9 +37,6 @@ pipeline {
 
                     dir('rust-rpxy') {
                         sh """
-                        # Update submodule URLs to HTTPS (allows cloning without SSH keys)
-                        sed -i 's|git@github.com:|https://github.com/|g' .gitmodules
-
                         # Initialize and update submodules
                         git submodule update --init
                         """
@@ -59,7 +56,7 @@ pipeline {
 
                         // Build the binary
                         sh 'cargo build --release'
-                    
+
                         // Prepare and stash files
                         sh """
                             # Move binary to workspace root for easier access
@@ -81,7 +78,7 @@ pipeline {
                     stash includes: "${BINARY_NAME}.spec", name: "rpm-files"
                     stash includes: "rpxy.service, config.toml", name: "service-file"
                     stash includes: "LICENSE, README.md", name: "docs"
-                        
+
                     // Archive the binary as an artifact
                     archiveArtifacts artifacts: "${BINARY_NAME}", allowEmptyArchive: false, fingerprint: true
                 }

From 629c6e73e954fc5ae9afabdc64a564956e9fcec6 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 3 Jun 2025 13:20:02 +0900
Subject: [PATCH 42/69] deps: rustls-platform-verifier-0.6, and refactor

---
 Cargo.lock               | 43 ++++++++++++++++++++++++++++++----------
 rpxy-acme/Cargo.toml     |  7 +++++--
 rpxy-acme/src/error.rs   |  3 +++
 rpxy-acme/src/manager.rs | 26 +++++++++++++++++++-----
 4 files changed, 61 insertions(+), 18 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e4e705a..211a466 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.24"
+version = "1.2.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16595d3be041c03b09d08d0858631facccee9221e579704070e6e9e4915d3bc7"
+checksum = "d0fc897dc1e865cc67c0e05a836d9d3f1df3cbe442aa4a9473b18e12624a4951"
 dependencies = [
  "jobserver",
  "libc",
@@ -1185,7 +1185,7 @@ dependencies = [
  "hyper-util",
  "rustls",
  "rustls-pki-types",
- "rustls-platform-verifier",
+ "rustls-platform-verifier 0.5.3",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -1854,9 +1854,9 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.32"
+version = "0.2.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "664ec5419c51e34154eec046ebcba56312d5a2fc3b09a06da188e1ad21afadf6"
+checksum = "9dee91521343f4c5c6a63edd65e54f31f5c92fe8978c40a4282f8372194c6a7d"
 dependencies = [
  "proc-macro2",
  "syn",
@@ -1913,7 +1913,7 @@ dependencies = [
  "rustc-hash 2.1.1",
  "rustls",
  "rustls-pki-types",
- "rustls-platform-verifier",
+ "rustls-platform-verifier 0.5.3",
  "slab",
  "thiserror 2.0.12",
  "tinyvec",
@@ -2126,7 +2126,7 @@ dependencies = [
  "blocking",
  "rustls",
  "rustls-acme",
- "rustls-platform-verifier",
+ "rustls-platform-verifier 0.6.0",
  "rustls-post-quantum",
  "thiserror 2.0.12",
  "tokio",
@@ -2345,6 +2345,27 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eda84358ed17f1f354cf4b1909ad346e6c7bc2513e8c40eb08e0157aa13a9070"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework 3.2.0",
+ "security-framework-sys",
+ "webpki-root-certs 1.0.0",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "rustls-platform-verifier-android"
 version = "0.1.1"
@@ -2523,9 +2544,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls"
-version = "0.3.20"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c5b886e605d71d8e78e37c7f6195887112f4c9d0a3269057f6447d3dae99908"
+checksum = "23c23a50f9733440df3a1e8c94d71026b02e5080395f080f4f66d1fecc2fca86"
 dependencies = [
  "errno",
  "hex",
@@ -2536,9 +2557,9 @@ dependencies = [
 
 [[package]]
 name = "s2n-tls-sys"
-version = "0.3.20"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "753c5eb4a0632b275ee3c503b0a108b2430b429566c86501f311f67cf579b35f"
+checksum = "00d42ff433e7a1267cc7105ee1aa8f8785473cee48376ddbb13e2d9f23e2291d"
 dependencies = [
  "aws-lc-rs",
  "cc",
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index 837d010..cae1048 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -28,11 +28,14 @@ rustls = { version = "0.23.27", default-features = false, features = [
   "std",
   "aws_lc_rs",
 ] }
-rustls-platform-verifier = { version = "0.5.3" }
+rustls-platform-verifier = { version = "0.6.0" }
 rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, features = [
   "aws-lc-rs",
 ] }
 rustls-post-quantum = { version = "0.2.2", optional = true }
-tokio = { version = "1.45.1", default-features = false }
+tokio = { version = "1.45.1", default-features = false, features = [
+  "rt",
+  "macros",
+] }
 tokio-util = { version = "0.7.15", default-features = false }
 tokio-stream = { version = "0.1.17", default-features = false }
diff --git a/rpxy-acme/src/error.rs b/rpxy-acme/src/error.rs
index 08133c5..cbf5e1d 100644
--- a/rpxy-acme/src/error.rs
+++ b/rpxy-acme/src/error.rs
@@ -12,4 +12,7 @@ pub enum RpxyAcmeError {
   /// IO error
   #[error("IO error: {0}")]
   Io(#[from] std::io::Error),
+  /// TLS client configuration error
+  #[error("TLS client configuration error: {0}")]
+  TlsClientConfig(String),
 }
diff --git a/rpxy-acme/src/manager.rs b/rpxy-acme/src/manager.rs
index 73b786d..8380140 100644
--- a/rpxy-acme/src/manager.rs
+++ b/rpxy-acme/src/manager.rs
@@ -79,11 +79,7 @@ impl AcmeManager {
     &self,
     cancel_token: tokio_util::sync::CancellationToken,
   ) -> (Vec<tokio::task::JoinHandle<()>>, HashMap<String, Arc<ServerConfig>>) {
-    let rustls_client_config = rustls::ClientConfig::builder()
-      .dangerous() // The `Verifier` we're using is actually safe
-      .with_custom_certificate_verifier(Arc::new(rustls_platform_verifier::Verifier::new()))
-      .with_no_client_auth();
-    let rustls_client_config = Arc::new(rustls_client_config);
+    let rustls_client_config = Self::create_tls_client_config().expect("Failed to create TLS client configuration for ACME");
 
     let mut server_configs_for_challenge: HashMap<String, Arc<ServerConfig>> = HashMap::default();
     let join_handles = self
@@ -127,6 +123,26 @@ impl AcmeManager {
 
     (join_handles, server_configs_for_challenge)
   }
+
+  /// Creates a TLS client configuration with platform certificate verification.
+  ///
+  /// This configuration uses the system's certificate store for verification,
+  /// which is appropriate for ACME certificate validation.
+  fn create_tls_client_config() -> Result<Arc<rustls::ClientConfig>, RpxyAcmeError> {
+    let crypto_provider = rustls::crypto::CryptoProvider::get_default().ok_or(RpxyAcmeError::TlsClientConfig(
+      "No default crypto provider available".to_string(),
+    ))?;
+
+    let verifier = rustls_platform_verifier::Verifier::new(crypto_provider.clone())
+      .map_err(|e| RpxyAcmeError::TlsClientConfig(format!("Failed to create certificate verifier: {}", e)))?;
+
+    let client_config = rustls::ClientConfig::builder()
+      .dangerous() // Safe: using platform certificate verifier
+      .with_custom_certificate_verifier(Arc::new(verifier))
+      .with_no_client_auth();
+
+    Ok(Arc::new(client_config))
+  }
 }
 
 #[cfg(test)]

From a52f74c434e829885996ef10f9111c45d1fa72aa Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 3 Jun 2025 14:59:37 +0900
Subject: [PATCH 43/69] refactor

---
 rpxy-bin/Cargo.toml                           | 18 ++++++++++++++++--
 rpxy-lib/src/message_handler/handler_main.rs  |  7 ++-----
 rpxy-lib/src/message_handler/utils_headers.rs |  6 ++----
 3 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index dfff39f..fe48b48 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -13,8 +13,22 @@ publish.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [features]
-default = ["http3-quinn", "cache", "rustls-backend", "sticky-cookie", "acme", "post-quantum"]
-# default = ["http3-s2n", "cache", "rustls-backend", "sticky-cookie", "acme", "post-quantum"]
+default = [
+  "http3-quinn",
+  "cache",
+  "rustls-backend",
+  "sticky-cookie",
+  "acme",
+  "post-quantum",
+]
+# default = [
+#   "http3-s2n",
+#   "cache",
+#   "rustls-backend",
+#   "sticky-cookie",
+#   "acme",
+#   "post-quantum",
+# ]
 http3-quinn = ["rpxy-lib/http3-quinn"]
 http3-s2n = ["rpxy-lib/http3-s2n"]
 native-tls-backend = ["rpxy-lib/native-tls-backend"]
diff --git a/rpxy-lib/src/message_handler/handler_main.rs b/rpxy-lib/src/message_handler/handler_main.rs
index 1b3663e..d4fd53c 100644
--- a/rpxy-lib/src/message_handler/handler_main.rs
+++ b/rpxy-lib/src/message_handler/handler_main.rs
@@ -6,7 +6,7 @@ use super::{
   utils_request::InspectParseHost,
 };
 use crate::{
-  backend::BackendAppManager,
+  backend::{BackendAppManager, LoadBalanceContext},
   error::*,
   forwarder::{ForwardRequest, Forwarder},
   globals::Globals,
@@ -24,10 +24,7 @@ use tokio::io::copy_bidirectional;
 #[derive(Debug)]
 /// Context object to handle sticky cookies at HTTP message handler
 pub(super) struct HandlerContext {
-  #[cfg(feature = "sticky-cookie")]
-  pub(super) context_lb: Option<crate::backend::LoadBalanceContext>,
-  #[cfg(not(feature = "sticky-cookie"))]
-  pub(super) context_lb: Option<()>,
+  pub(super) context_lb: Option<LoadBalanceContext>,
 }
 
 #[derive(Clone, Builder)]
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index 354fa6e..fe351d9 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -3,7 +3,7 @@ use crate::{
   backend::{UpstreamCandidates, UpstreamOption},
   log::*,
 };
-use anyhow::{Result, anyhow, ensure};
+use anyhow::{Result, anyhow};
 use bytes::BufMut;
 use http::{HeaderMap, HeaderName, HeaderValue, Uri, header};
 use std::{borrow::Cow, net::SocketAddr};
@@ -22,8 +22,6 @@ pub(super) fn takeout_sticky_cookie_lb_context(
   headers: &mut HeaderMap,
   expected_cookie_name: &str,
 ) -> Result<Option<LoadBalanceContext>> {
-  use anyhow::ensure;
-
   let mut headers_clone = headers.clone();
 
   match headers_clone.entry(header::COOKIE) {
@@ -37,7 +35,7 @@ pub(super) fn takeout_sticky_cookie_lb_context(
       if sticky_cookies.is_empty() {
         return Ok(None);
       }
-      ensure!(sticky_cookies.len() == 1, "Invalid cookie: Multiple sticky cookie values");
+      anyhow::ensure!(sticky_cookies.len() == 1, "Invalid cookie: Multiple sticky cookie values");
 
       let cookies_passed_to_upstream = without_sticky_cookies.join("; ");
       let cookie_passed_to_lb = sticky_cookies.first().unwrap();

From 28832d58746d1fe95aad2ed0e135416b270894da Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 3 Jun 2025 15:30:39 +0900
Subject: [PATCH 44/69] chore: refactor

---
 rpxy-lib/src/backend/backend_main.rs | 33 +++++++++++++++-------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/rpxy-lib/src/backend/backend_main.rs b/rpxy-lib/src/backend/backend_main.rs
index 5524956..64ffb92 100644
--- a/rpxy-lib/src/backend/backend_main.rs
+++ b/rpxy-lib/src/backend/backend_main.rs
@@ -85,24 +85,27 @@ impl TryFrom<&AppConfigList> for BackendAppManager {
     }
 
     // default backend application for plaintext http requests
-    if let Some(default_app_name) = &config_list.default_app {
-      let default_server_name = manager
-        .apps
-        .iter()
-        .filter(|(_k, v)| &v.app_name == default_app_name)
-        .map(|(_, v)| v.server_name.clone())
-        .collect::<Vec<_>>();
+    let Some(default_app_name) = &config_list.default_app else {
+      return Ok(manager);
+    };
 
-      if !default_server_name.is_empty() {
-        info!(
-          "Serving plaintext http for requests to unconfigured server_name by app {} (server_name: {}).",
-          &default_app_name,
-          (&default_server_name[0]).try_into().unwrap_or_else(|_| "".to_string())
-        );
+    let default_server_name = manager
+      .apps
+      .iter()
+      .filter(|(_k, v)| &v.app_name == default_app_name)
+      .map(|(_, v)| v.server_name.clone())
+      .collect::<Vec<_>>();
 
-        manager.default_server_name = Some(default_server_name[0].clone());
-      }
+    if !default_server_name.is_empty() {
+      info!(
+        "Serving plaintext http for requests to unconfigured server_name by app {} (server_name: {}).",
+        &default_app_name,
+        (&default_server_name[0]).try_into().unwrap_or_else(|_| "".to_string())
+      );
+
+      manager.default_server_name = Some(default_server_name[0].clone());
     }
+
     Ok(manager)
   }
 }

From 869b1b23b449a04507f9d6114356c11f31944622 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 3 Jun 2025 15:56:53 +0900
Subject: [PATCH 45/69] [ci skip] update README.md

---
 README.md | 118 +++++++++++++++++++++++++++---------------------------
 1 file changed, 59 insertions(+), 59 deletions(-)

diff --git a/README.md b/README.md
index 92fdb9b..21ddf1a 100644
--- a/README.md
+++ b/README.md
@@ -13,20 +13,20 @@
 
 ## Introduction
 
-`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in Rust [^pure_rust]. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections.
+`rpxy` [ahr-pik-see] is a simple and lightweight reverse-proxy implementation with additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in Rust [^pure_rust]. `rpxy` routes multiple hostnames to appropriate backend application servers while serving TLS connections.
 
-[^pure_rust]: Doubtfully can be claimed to be written in pure Rust since current `rpxy` is based on `aws-lc-rs` for cryptographic operations.
+[^pure_rust]: It is questionable whether this can be claimed to be written in pure Rust since the current `rpxy` is based on `aws-lc-rs` for cryptographic operations.
 
-Supported features are summarized as follows:
+The supported features are summarized as follows:
 
-- Supported HTTP(S) protocols: HTTP/1.1, HTTP/2 and brand-new HTTP/3 [^h3lib]
+- Supported HTTP(S) protocols: HTTP/1.1, HTTP/2, and the brand-new HTTP/3 [^h3lib]
 - gRPC is also supported
 - Serving multiple domain names with TLS termination
 - Mutual TLS authentication with client certificates
 - Automated certificate issuance and renewal via TLS-ALPN-01 ACME protocol [^acme]
 - Post-quantum key exchange for TLS/QUIC [^kyber]
-- TLS connection sanitization to avoid the domain fronting [^sanitization]
-- Load balancing with round-robin, random, and sticky session
+- TLS connection sanitization to avoid domain fronting [^sanitization]
+- Load balancing with round-robin, random, and sticky sessions
 - and more...
 
 [^h3lib]: HTTP/3 is enabled thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3). HTTP/3 libraries are mutually exclusive. You need to explicitly specify `s2n-quic` with `--no-default-features` flag. Also note that if you build `rpxy` with `s2n-quic`, then it requires `openssl` just for building the package.
@@ -35,9 +35,9 @@ Supported features are summarized as follows:
 
 [^kyber]: `rpxy` supports the hybridized post-quantum key exchange [`X25519MLKEM768`](https://www.ietf.org/archive/id/draft-kwiatkowski-tls-ecdhe-mlkem-02.html)[^kyber] for TLS/QUIC incoming and outgoing initiation thanks to [`rustls-post-quantum`](https://docs.rs/rustls-post-quantum/latest/rustls_post_quantum/). This is already a default feature.  Also note that `X25519MLKEM768` is still a draft version yet this is widely used on the Internet.
 
-[^sanitization]: By default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line). We should note that NGINX doesn't guarantee such a consistency by default. To this end, you have to add `if` statement in the configuration file in NGINX.
+[^sanitization]: By default, `rpxy` provides *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always maintains consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line). We should note that NGINX doesn't guarantee such consistency by default. To achieve this, you have to add an `if` statement in the NGINX configuration file.
 
- This project is still *work-in-progress*. But it is already working in some production environments and serves a number of domain names. Furthermore it *significantly outperforms* NGINX and Caddy, e.g., *30% ~ 60% or more faster than NGINX*, in the setting of a very simple HTTP reverse-proxy scenario (See [`bench`](./bench/) directory).
+This project is still *work-in-progress*. However, it is already working in some production environments and serves a number of domain names. Furthermore, it *significantly outperforms* NGINX and Caddy, e.g., *30% ~ 60% or more faster than NGINX*, in very simple HTTP reverse-proxy scenarios (See [`bench`](./bench/) directory).
 
 ## Installing/Building an Executable Binary of `rpxy`
 
@@ -60,15 +60,15 @@ You can build an executable binary yourself by checking out this Git repository.
 % cargo build --no-default-features --features http3-s2n --release
 ```
 
-Then you have an executive binary `rust-rpxy/target/release/rpxy`.
+Then you have an executable binary `rust-rpxy/target/release/rpxy`.
 
 ### Package Installation for Linux (RPM/DEB)
 
-You can find the Jenkins CI/CD build scripts for `rpxy` in the [./build](./.build) directory.
+You can find the Jenkins CI/CD build scripts for `rpxy` in the [./.build](./.build) directory.
 
 Prebuilt packages for Linux RPM and DEB are available at [https://rpxy.gamerboy59.dev](https://rpxy.gamerboy59.dev), provided by [@Gamerboy59](https://github.com/Gamerboy59).
 
-Note that we do not have an option of installation via [`crates.io`](https://crates.io/), i.e., `cargo install`, at this point since some dependencies are not published yet. Alternatively, you can use docker image (see below) as the easiest way for `amd64` environment.
+Note that we do not have an installation option via [`crates.io`](https://crates.io/), i.e., `cargo install`, at this point since some dependencies are not yet published. Alternatively, you can use the docker image (see below) as the easiest way for `amd64` environments.
 
 ## Usage
 
@@ -80,9 +80,9 @@ You can run `rpxy` with a configuration file like
 % ./target/release/rpxy --config config.toml
 ```
 
-`rpxy` tracks the change of `config.toml` in the real-time manner and apply the change immediately without restarting the process.
+`rpxy` tracks changes to `config.toml` in real-time and applies changes immediately without restarting the process.
 
-The full help messages are given follows.
+The full help message is as follows.
 
 ```bash:
 usage: rpxy [OPTIONS] --config <FILE>
@@ -116,8 +116,8 @@ server_name = 'app1.example.com'
 reverse_proxy = [{ upstream = [{ location = 'app1.local:8080' }] }]
 ```
 
-In the above setting, `rpxy` listens on port 80 (TCP) and serves incoming cleartext HTTP request including a `app1.example.com` in its HOST header or URL in its Request line.
-For example, request messages like the followings.
+In the above setting, `rpxy` listens on port 80 (TCP) and serves incoming cleartext HTTP requests that include `app1.example.com` in their HOST header or URL in their Request line.
+For example, request messages like the following.
 
 ```http
 GET http://app1.example.com/path/to HTTP/1.1\r\n
@@ -130,9 +130,9 @@ GET /path/to HTTP/1.1\r\n
 HOST: app1.example.com\r\n
 ```
 
-Otherwise, say, a request to `other.example.com` is simply rejected with the status code `40x`.
+Otherwise, a request to `other.example.com` is simply rejected with status code `40x`.
 
-If you want to host multiple and distinct domain names in a single IP address/port, simply create multiple `app."<app_name>"` entries in config file like
+If you want to host multiple distinct domain names on a single IP address/port, simply create multiple `app."<app_name>"` entries in the config file like
 
 ```toml
 default_app = "app1"
@@ -146,11 +146,11 @@ server_name = "app2.example.org"
 #...
 ```
 
-Here we note that by specifying `default_app` entry, *HTTP* requests will be served by the specified application if HOST header or URL in Request line doesn't match any `server_name`s in `reverse_proxy` entries. For HTTPS requests, it will be rejected since the secure connection cannot be established for the unknown server name.
+Note that by specifying a `default_app` entry, *HTTP* requests will be served by the specified application if the HOST header or URL in the Request line doesn't match any `server_name`s in `reverse_proxy` entries. For HTTPS requests, it will be rejected since a secure connection cannot be established for an unknown server name.
 
 #### HTTPS to Backend Application
 
-The request message will be routed to the backend application specified with the domain name `app1.localdomain:8080` or IP address over cleartext HTTP. If the backend channel needs to serve TLS like forwarding to `https://app1.localdomain:8080`, you need to enable a `tls` option for the location.
+The request message will be routed to the backend application specified with the domain name `app1.localdomain:8080` or IP address over cleartext HTTP. If the backend channel needs to serve TLS, like forwarding to `https://app1.localdomain:8080`, you need to enable the `tls` option for the location.
 
 ```toml
 revese_proxy = [
@@ -160,7 +160,7 @@ revese_proxy = [
 
 #### Load Balancing
 
-You can specify multiple backend locations in the `reverse_proxy` array for *load-balancing* with an appropriate `load_balance` option. Currently it works in the manner of round-robin, in the random fashion, or round-robin with *session-persistance* using cookie. if `load_balance` is not specified, the first backend location is always chosen.
+You can specify multiple backend locations in the `reverse_proxy` array for *load-balancing* with an appropriate `load_balance` option. Currently it works in a round-robin manner, randomly, or round-robin with *session-persistence* using cookies. If `load_balance` is not specified, the first backend location is always chosen.
 
 ```toml
 [apps."app_name"]
@@ -174,7 +174,7 @@ load_balance = 'round_robin' # or 'random' or 'sticky'
 
 ### Second Step: Terminating TLS
 
-First of all, you need to specify a port `listen_port_tls` listening the HTTPS traffic, separately from HTTP port (`listen_port`). Then, serving an HTTPS endpoint can be easily done for your desired application just by specifying TLS certificates and private keys in PEM files.
+First of all, you need to specify a port `listen_port_tls` listening for HTTPS traffic, separately from the HTTP port (`listen_port`). Then, serving an HTTPS endpoint can be easily done for your desired application by simply specifying TLS certificates and private keys in PEM files.
 
 ```toml
 listen_port = 80
@@ -186,23 +186,23 @@ tls = { tls_cert_path = 'server.crt',  tls_cert_key_path = 'server.key' }
 reverse_proxy = [{ upstream = [{ location = 'app1.local:8080' }] }]
 ```
 
-In the above setting, both cleartext HTTP requests to port 80 and ciphertext HTTPS requests to port 443 are routed to the backend `app1.local:8080` in the same fashion. If you don't need to serve cleartext requests, just remove `listen_port = 80` and specify only `listen_port_tls = 443`.
+In the above setting, both cleartext HTTP requests to port 80 and encrypted HTTPS requests to port 443 are routed to the backend `app1.local:8080` in the same manner. If you don't need to serve cleartext requests, just remove `listen_port = 80` and specify only `listen_port_tls = 443`.
 
-We should note that the private key specified by `tls_cert_key_path` must be *in PKCS8 format*. (See TIPS to convert PKCS1 formatted private key to PKCS8 one.)
+Note that the private key specified by `tls_cert_key_path` must be *in PKCS8 format*. (See TIPS to convert PKCS1 formatted private keys to PKCS8 format.)
 
 #### Redirecting Cleartext HTTP Requests to HTTPS
 
-In the current Web, we believe it is common to serve everything through HTTPS rather than HTTP, and hence *https redirection* is often used for HTTP requests. When you specify both `listen_port` and `listen_port_tls`, you can enable an option of such  redirection by making `https_redirection` true.
+In the current Web, it is common to serve everything through HTTPS rather than HTTP, and hence *HTTPS redirection* is often used for HTTP requests. When you specify both `listen_port` and `listen_port_tls`, you can enable such redirection by setting `https_redirection` to true.
 
 ```toml
 tls = { https_redirection = true, tls_cert_path = 'server.crt', tls_cert_key_path = 'server.key' }
 ```
 
-If it is true, `rpxy` returns the status code `301` to the cleartext request with new location `https://<requested_host>/<requested_query_and_path>` served over TLS.
+If it is true, `rpxy` returns status code `301` to the cleartext request with the new location `https://<requested_host>/<requested_query_and_path>` served over TLS.
 
 ### Third Step: More Flexible Routing Based on URL Path
 
-`rpxy` can serves, of course, routes requests to multiple backend destination according to the path information. The routing information can be specified for each application (`server_name`) as follows.
+`rpxy` can, of course, route requests to multiple backend destinations according to path information. The routing information can be specified for each application (`server_name`) as follows.
 
 ```toml
 listen_port_tls = 443
@@ -230,15 +230,15 @@ upstream = [
 ]
 ```
 
-In the above example, a request to `https://app1.example.com/path/to?query=ok` matches the second `reverse_proxy` entry in the longest-prefix-matching manner, and will be routed to `path.backend.local` with preserving path and query information, i.e., served as `http://path.backend.local/path/to?query=ok`.
+In the above example, a request to `https://app1.example.com/path/to?query=ok` matches the second `reverse_proxy` entry in a longest-prefix-matching manner, and will be routed to `path.backend.local` while preserving path and query information, i.e., served as `http://path.backend.local/path/to?query=ok`.
 
-On the other hand, a request to `https://app1.example.com/path/another/xx?query=ng` matching the third entry is routed with *being rewritten its path information* specified by `replace_path` option. Namely, the matched `/path/another` part is rewritten with `/path`, and it is served as `http://another.backend.local/path/xx?query=ng`.
+On the other hand, a request to `https://app1.example.com/path/another/xx?query=ng` matching the third entry is routed with *its path information being rewritten* as specified by the `replace_path` option. Namely, the matched `/path/another` part is rewritten to `/path`, and it is served as `http://another.backend.local/path/xx?query=ng`.
 
-Requests that doesn't match any paths will be routed by the first entry that doesn't have the `path` option, which means the *default destination*. In other words, unless every `reverse_proxy` entry has an explicit `path` option, `rpxy` rejects requests that don't match any paths.
+Requests that don't match any paths will be routed by the first entry that doesn't have the `path` option, which serves as the *default destination*. In other words, unless every `reverse_proxy` entry has an explicit `path` option, `rpxy` rejects requests that don't match any paths.
 
 #### Simple Path-based Routing
 
-This path-based routing option would be enough in many cases. For example, you can serve multiple applications with one domain by specifying unique path to each application. More specifically, see an example below.
+This path-based routing option would be sufficient in many cases. For example, you can serve multiple applications with one domain by specifying a unique path for each application. More specifically, see the example below.
 
 ```toml
 [apps.app]
@@ -261,25 +261,25 @@ replace_path = '/'
 upstream = [ { location = 'subapp3.local' } ]
 ```
 
-This example configuration explains a very frequent situation of path-based routing. When a request to `app.example.com/subappN` routes to `sbappN.local` by replacing a path part `/subappN` to `/`.
+This example configuration demonstrates a very common path-based routing situation. When a request to `app.example.com/subappN` is routed to `subappN.local` by replacing the path part `/subappN` with `/`.
 
 ## More Options
 
-Since it is currently a work-in-progress project, we are frequently adding new options. We first add new option entries in the `config-example.toml` as examples. So please refer to it for up-to-date options. We will prepare a comprehensive documentation for all options.
+Since this is currently a work-in-progress project, we are frequently adding new options. We first add new option entries in `config-example.toml` as examples. Please refer to it for up-to-date options. We will prepare comprehensive documentation for all options.
 
 ## Using Docker Image
 
-You can also use `docker` image hosted on [Docker Hub](https://hub.docker.com/r/jqtype/rpxy) and [GitHub Container Registry](https://github.com/junkurihara/rust-rpxy/pkgs/container/rust-rpxy) instead of directly executing the binary. See [`./docker`](./docker/README.md) directory for more details.
+You can also use the `docker` image hosted on [Docker Hub](https://hub.docker.com/r/jqtype/rpxy) and [GitHub Container Registry](https://github.com/junkurihara/rust-rpxy/pkgs/container/rust-rpxy) instead of directly executing the binary. See the [`./docker`](./docker/README.md) directory for more details.
 
 ## Example
 
-[`./bench`](./bench/) directory could be a very simple example of configuration of `rpxy`. This can also be an example of an example of docker use case.
+The [`./bench`](./bench/) directory contains a very simple example of `rpxy` configuration. This can also serve as an example of a docker use case.
 
 ## Experimental Features and Caveats
 
 ### HTTP/3
 
-`rpxy` can serves HTTP/3 requests thanks to `quinn`, `s2n-quic` and `hyperium/h3`. To enable this experimental feature, add an entry `experimental.h3` in your `config.toml` like follows. Any values in the entry like `alt_svc_max_age` are optional.
+`rpxy` can serve HTTP/3 requests thanks to `quinn`, `s2n-quic` and `hyperium/h3`. To enable this experimental feature, add an entry `experimental.h3` in your `config.toml` as follows. Any values in the entry like `alt_svc_max_age` are optional.
 
 ```toml
 [experimental.h3]
@@ -301,7 +301,7 @@ server_name = 'localhost' # Domain name
 tls = { https_redirection = true, tls_cert_path = './server.crt', tls_cert_key_path = './server.key', client_ca_cert_path = './client_cert.ca.crt' }
 ```
 
- However, currently we have a limitation on HTTP/3 support for applications that enables client authentication. If an application is set with client authentication, HTTP/3 doesn't work for the application.
+However, currently we have a limitation on HTTP/3 support for applications that enable client authentication. If an application is configured with client authentication, HTTP/3 doesn't work for that application.
 
 ### Hybrid Caching Feature with Temporary File and On-Memory Cache
 
@@ -316,11 +316,11 @@ max_cache_each_size = 65535          # optional. default is 64k
 max_cache_each_size_on_memory = 4096 # optional. default is 4k if 0, it is always file cache.
 ```
 
-A *storable* (in the context of an HTTP message) response is stored if its size is less than or equal to `max_cache_each_size` in bytes. If it is also less than or equal to `max_cache_each_size_on_memory`, it is stored as an on-memory object. Otherwise, it is stored as a temporary file. Note that `max_cache_each_size` must be larger or equal to `max_cache_each_size_on_memory`. Also note that once `rpxy` restarts or the config is updated, the cache is totally eliminated not only from the on-memory table but also from the file system.
+A *storable* (in the context of an HTTP message) response is stored if its size is less than or equal to `max_cache_each_size` in bytes. If it is also less than or equal to `max_cache_each_size_on_memory`, it is stored as an in-memory object. Otherwise, it is stored as a temporary file. Note that `max_cache_each_size` must be greater than or equal to `max_cache_each_size_on_memory`. Also note that once `rpxy` restarts or the config is updated, the cache is completely eliminated not only from the in-memory table but also from the file system.
 
-### Automated Certificate Issuance and Renewal via TLS-ALPN-01 ACME protocol
+### Automated Certificate Issuance and Renewal via TLS-ALPN-01 ACME Protocol
 
-This is a brand-new feature and maybe still unstable. Thanks to the [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme), the automatic issuance and renewal of certificates are finally available in `rpxy`. To enable this feature, you need to specify the following entries in `config.toml`.
+This is a brand-new feature and may still be unstable. Thanks to [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme), automatic issuance and renewal of certificates are finally available in `rpxy`. To enable this feature, you need to specify the following entries in `config.toml`.
 
 ```toml
 # ACME enabled domain name.
@@ -342,13 +342,13 @@ email = "test@example.com"
 registry_path = "./acme_registry"       # optional. default is "./acme_registry" relative to the current working directory
 ```
 
-The above configuration is common to all ACME enabled domains. Note that the https port must be open to the public to verify the domain ownership.
+The above configuration is common to all ACME-enabled domains. Note that the HTTPS port must be open to the public to verify domain ownership.
 
 ## TIPS
 
-### Set custom port for HTTPS redirection
+### Set Custom Port for HTTPS Redirection
 
-Consider a case where `rpxy` is running on a container. Then when the container manager maps port A (e.g., 80/443) of the host to port B (e.g., 8080/8443) of the container for http and https, `rpxy` must be configured with port B for `listen_port` and `listen_port_tls`. However, when you want to set `http_redirection=true` for some backend apps, `rpxy` issues the redirection response 301 with the port B by default, which is not accessible from the outside of the container. To avoid this, you can set a custom port for the redirection response by specifying `https_redirection_port` in `config.toml`. In this case, port A should be set for `https_redirection_port`, then the redirection response 301 will be issued with the port A.
+Consider a case where `rpxy` is running in a container. When the container manager maps port A (e.g., 80/443) of the host to port B (e.g., 8080/8443) of the container for HTTP and HTTPS, `rpxy` must be configured with port B for `listen_port` and `listen_port_tls`. However, when you want to set `https_redirection=true` for some backend apps, `rpxy` issues redirection response 301 with port B by default, which is not accessible from outside the container. To avoid this, you can set a custom port for the redirection response by specifying `https_redirection_port` in `config.toml`. In this case, port A should be set for `https_redirection_port`, then redirection response 301 will be issued with port A.
 
 ```toml
 listen_port = 8080
@@ -356,25 +356,25 @@ listen_port_tls = 8443
 https_redirection_port = 443
 ```
 
-### Using Private Key Issued by Let's Encrypt
+### Using Private Keys Issued by Let's Encrypt
 
-If you obtain certificates and private keys from [Let's Encrypt](https://letsencrypt.org/), you have PKCS1-formatted private keys. So you need to convert such retrieved private keys into PKCS8 format to use in `rpxy`.
+If you obtain certificates and private keys from [Let's Encrypt](https://letsencrypt.org/), you have PKCS1-formatted private keys. You need to convert such retrieved private keys into PKCS8 format to use them in `rpxy`.
 
-The easiest way is to use `openssl` by
+The easiest way is to use `openssl`:
 
 ```bash
 % openssl pkcs8 -topk8 -nocrypt \
-    -in yoru_domain_from_le.key \
+    -in your_domain_from_le.key \
     -inform PEM \
     -out your_domain_pkcs8.key.pem \
     -outform PEM
 ```
 
-### Client Authentication using Client Certificate Signed by Your Own Root CA
+### Client Authentication Using Client Certificates Signed by Your Own Root CA
 
-First, you need to prepare a CA certificate used to verify client certificate. If you do not have one, you can generate CA key and certificate by OpenSSL commands as follows. *Note that `rustls` accepts X509v3 certificates and reject SHA-1, and that `rpxy` relys on Version 3 extension fields of `KeyID`s of `Subject Key Identifier` and `Authority Key Identifier`.*
+First, you need to prepare a CA certificate used to verify client certificates. If you do not have one, you can generate a CA key and certificate using OpenSSL commands as follows. *Note that `rustls` accepts X509v3 certificates and rejects SHA-1, and that `rpxy` relies on Version 3 extension fields of `KeyID`s of `Subject Key Identifier` and `Authority Key Identifier`.*
 
-1. Generate CA key of `secp256v1`, CSR, and then generate CA certificate that will be set for `tls.client_ca_cert_path` for each server app in `config.toml`.
+1. Generate a CA key of `secp256v1`, CSR, and then generate a CA certificate that will be set for `tls.client_ca_cert_path` for each server app in `config.toml`.
 
   ```bash
   % openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out client.ca.key
@@ -393,7 +393,7 @@ First, you need to prepare a CA certificate used to verify client certificate. I
   % openssl x509 -req -days 3650 -sha256 -in client.ca.csr -signkey client.ca.key -out client.ca.crt -extfile client.ca.ext
   ```
 
-2. Generate a client key of `secp256v1` and certificate signed by CA key.
+2. Generate a client key of `secp256v1` and certificate signed by the CA key.
 
   ```bash
   % openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out client.key
@@ -412,32 +412,32 @@ First, you need to prepare a CA certificate used to verify client certificate. I
   % openssl x509 -req -days 365 -sha256 -in client.csr -CA client.ca.crt -CAkey client.ca.key -CAcreateserial -out client.crt -extfile client.ext
   ```
 
-  Now you have a client key `client.key` and certificate `client.crt` (version 3). `pfx` (`p12`) file can be retrieved as
+  Now you have a client key `client.key` and certificate `client.crt` (version 3). A `pfx` (`p12`) file can be generated as follows:
 
   ```bash
   % openssl pkcs12 -export -inkey client.key -in client.crt -certfile client.ca.crt -out client.pfx
   ```
 
-  Note that on MacOS, a `pfx` generated by `OpenSSL 3.0.6` cannot be imported to MacOS KeyChain Access. We generated the sample `pfx` using `LibreSSL 2.8.3` instead `OpenSSL`.
+  Note that on macOS, a `pfx` generated by `OpenSSL 3.0.6` cannot be imported to macOS Keychain Access. We generated the sample `pfx` using `LibreSSL 2.8.3` instead of `OpenSSL`.
 
-  All of sample certificate files are found in `./example-certs/` directory.
+  All sample certificate files can be found in the `./example-certs/` directory.
 
-### (Work Around) Deployment on Ubuntu 22.04LTS using docker behind `ufw`
+### (Work Around) Deployment on Ubuntu 22.04 LTS Using Docker Behind `ufw`
 
-Basically, docker automatically manage your iptables if you use the port-mapping option, i.e., `--publish` for `docker run` or `ports` in `docker-compose.yml`. This means you do not need to manually expose your port, e.g., 443 TCP/UDP for HTTPS, using `ufw`-like management command.
+Basically, Docker automatically manages your iptables if you use the port-mapping option, i.e., `--publish` for `docker run` or `ports` in `docker-compose.yml`. This means you do not need to manually expose your port, e.g., 443 TCP/UDP for HTTPS, using `ufw`-like management commands.
 
-However, we found that if you want to use the brand-new UDP-based protocol, HTTP/3, on `rpxy`, you need to explicitly expose your HTTPS port by using `ufw`-like command.
+However, we found that if you want to use the brand-new UDP-based protocol, HTTP/3, on `rpxy`, you need to explicitly expose your HTTPS port using `ufw`-like commands.
 
 ```bash
 % sudo ufw allow 443
 % sudo ufw enable
 ```
 
-Your docker container can receive only TCP-based connection, i.e., HTTP/2 or before, unless you manually manage the port. We see that this is weird and expect that it is a kind of bug (of docker? ubuntu? or something else?). But at least for Ubuntu 22.04LTS, you need to handle it as above.
+Your Docker container can receive only TCP-based connections, i.e., HTTP/2 or earlier, unless you manually manage the port. We see that this is strange and expect that it is some kind of bug (of Docker? Ubuntu? or something else?). But at least for Ubuntu 22.04 LTS, you need to handle it as described above.
 
-### Managing `rpxy` via web interface
+### Managing `rpxy` via Web Interface
 
-Check a third party project [`Gamerboy59/rpxy-webui`](https://github.com/Gamerboy59/rpxy-webui) to manage `rpxy` via web interface.
+Check the third-party project [`Gamerboy59/rpxy-webui`](https://github.com/Gamerboy59/rpxy-webui) to manage `rpxy` via a web interface.
 
 ### Other TIPS
 

From f905244287d24d1d8eef69c6e6e0a68f5dec49d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Jun 2025 22:43:55 +0000
Subject: [PATCH 46/69] chore(deps): bump hyper-util from 0.1.13 to 0.1.14

Bumps [hyper-util](https://github.com/hyperium/hyper-util) from 0.1.13 to 0.1.14.
- [Release notes](https://github.com/hyperium/hyper-util/releases)
- [Changelog](https://github.com/hyperium/hyper-util/blob/master/CHANGELOG.md)
- [Commits](https://github.com/hyperium/hyper-util/compare/v0.1.13...v0.1.14)

---
updated-dependencies:
- dependency-name: hyper-util
  dependency-version: 0.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 4 ++--
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 211a466..32afa6a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1210,9 +1210,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.13"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c293b6b3d21eca78250dc7dbebd6b9210ec5530e038cbfe0661b5c47ab06e8"
+checksum = "dc2fdfdbff08affe55bb779f33b053aa1fe5dd5b54c257343c17edfa55711bdb"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 8cf0a10..fc43b06 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -61,7 +61,7 @@ thiserror = "2.0.12"
 http = "1.3.1"
 http-body-util = "0.1.3"
 hyper = { version = "1.6.0", default-features = false }
-hyper-util = { version = "0.1.13", features = ["full"] }
+hyper-util = { version = "0.1.14", features = ["full"] }
 futures-util = { version = "0.3.31", default-features = false }
 futures-channel = { version = "0.3.31", default-features = false }
 

From 17a033a333b511e94d37e4da688a3f21b97ea528 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 7 Jun 2025 10:02:49 +0900
Subject: [PATCH 47/69] chore: deps

---
 Cargo.lock          | 70 ++++++++++++++++++++++-----------------------
 rpxy-bin/Cargo.toml |  2 +-
 rpxy-lib/Cargo.toml |  2 +-
 3 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 32afa6a..6c8fdf5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -62,9 +62,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.18"
+version = "0.6.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -77,33 +77,33 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
 dependencies = [
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.8"
+version = "3.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6680de5231bd6ee4c6191b8a1325daa282b415391ec9d3a37bd34f2060dc73fa"
+checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
@@ -388,9 +388,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.17.0"
+version = "3.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
+checksum = "793db76d6187cd04dff33004d8e6c9cc4e05cd330500379d2394209271b4aeee"
 
 [[package]]
 name = "bytemuck"
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.25"
+version = "1.2.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0fc897dc1e865cc67c0e05a836d9d3f1df3cbe442aa4a9473b18e12624a4951"
+checksum = "956a5e21988b87f372569b66183b78babf23ebc2e744b733e4350a752c4dafac"
 dependencies = [
  "jobserver",
  "libc",
@@ -511,9 +511,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
 [[package]]
 name = "combine"
@@ -1044,9 +1044,9 @@ dependencies = [
 
 [[package]]
 name = "hash_hasher"
-version = "2.0.3"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74721d007512d0cb3338cd20f0654ac913920061a4c4d0d8708edb3f2a698c0c"
+checksum = "1b4b9ebce26001bad2e6366295f64e381c1e9c479109202149b9e15e154973e9"
 
 [[package]]
 name = "hashbrown"
@@ -1176,16 +1176,16 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.6"
+version = "0.27.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03a01595e11bdcec50946522c32dde3fc6914743000a68b93000965f2f02406d"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
 dependencies = [
  "http",
  "hyper",
  "hyper-util",
  "rustls",
  "rustls-pki-types",
- "rustls-platform-verifier 0.5.3",
+ "rustls-platform-verifier 0.6.0",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -2672,9 +2672,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.8"
+version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
 dependencies = [
  "serde",
 ]
@@ -2722,9 +2722,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
@@ -2991,9 +2991,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.22"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ae329d1f08c4d17a59bed7ff5b5a769d062e64a62d34a3261b219e62cd5aae"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -3003,18 +3003,18 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.9"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da5db5a963e24bc68be8b17b6fa82814bb22ee8660f192bb182771d498f09a3"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.26"
+version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "310068873db2c5b3e7659d2cc35d21855dbafa50d1ce336397c666e3cb08137e"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
  "indexmap",
  "serde",
@@ -3043,9 +3043,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+checksum = "1b1ffbcf9c6f6b99d386e7444eb608ba646ae452a36b39737deb9663b610f662"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3054,9 +3054,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.33"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
 dependencies = [
  "once_cell",
  "valuable",
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index fe48b48..5f29c47 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -61,7 +61,7 @@ futures-util = { version = "0.3.31", default-features = false }
 
 # config
 clap = { version = "4.5.39", features = ["std", "cargo", "wrap_help"] }
-toml = { version = "0.8.22", default-features = false, features = ["parse"] }
+toml = { version = "0.8.23", default-features = false, features = ["parse"] }
 hot_reload = "0.1.9"
 serde_ignored = "0.1.12"
 
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index fc43b06..9f694c2 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -70,7 +70,7 @@ hyper-tls = { version = "0.6.0", features = [
   "alpn",
   "vendored",
 ], optional = true }
-hyper-rustls = { version = "0.27.6", default-features = false, features = [
+hyper-rustls = { version = "0.27.7", default-features = false, features = [
   "aws-lc-rs",
   "http1",
   "http2",

From 16769e1d546b401fc60cffd82348f337f16b08a5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Jun 2025 23:07:24 +0000
Subject: [PATCH 48/69] chore(deps): bump clap from 4.5.39 to 4.5.40

Bumps [clap](https://github.com/clap-rs/clap) from 4.5.39 to 4.5.40.
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.39...clap_complete-v4.5.40)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.5.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 8 ++++----
 rpxy-bin/Cargo.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6c8fdf5..1fe998f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -474,18 +474,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.39"
+version = "4.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd60e63e9be68e5fb56422e397cf9baddded06dae1d2e523401542383bc72a9f"
+checksum = "40b6887a1d8685cebccf115538db5c0efe625ccac9696ad45c409d96566e910f"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.39"
+version = "4.5.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89cc6392a1f72bbeb820d71f32108f61fdaf18bc526e1d23954168a67759ef51"
+checksum = "e0c66c08ce9f0c698cbce5c0279d0bb6ac936d8674174fe48f736533b964f59e"
 dependencies = [
  "anstream",
  "anstyle",
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 5f29c47..e22b8e1 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -60,7 +60,7 @@ async-trait = "0.1.88"
 futures-util = { version = "0.3.31", default-features = false }
 
 # config
-clap = { version = "4.5.39", features = ["std", "cargo", "wrap_help"] }
+clap = { version = "4.5.40", features = ["std", "cargo", "wrap_help"] }
 toml = { version = "0.8.23", default-features = false, features = ["parse"] }
 hot_reload = "0.1.9"
 serde_ignored = "0.1.12"

From 806c2aaaaeb425978c2a4aa282841435c99a540d Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 11 Jun 2025 22:03:03 +0900
Subject: [PATCH 49/69] chore: update

---
 Cargo.lock                            | 44 +++++++++++++--------------
 submodules/rusty-http-cache-semantics |  2 +-
 2 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1fe998f..9746005 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "adler2"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "ahash"
@@ -394,9 +394,9 @@ checksum = "793db76d6187cd04dff33004d8e6c9cc4e05cd330500379d2394209271b4aeee"
 
 [[package]]
 name = "bytemuck"
-version = "1.23.0"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9134a6ef01ce4b366b50689c94f82c14bc72bc5d0386829828a2e2752ef7958c"
+checksum = "5c76a5792e44e4abe34d3abf15636779261d45a7450612059293d1d2cfc63422"
 
 [[package]]
 name = "byteorder"
@@ -438,9 +438,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 
 [[package]]
 name = "cfg_aliases"
@@ -496,9 +496,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
 
 [[package]]
 name = "cmake"
@@ -964,7 +964,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
@@ -1050,9 +1050,9 @@ checksum = "1b4b9ebce26001bad2e6366295f64e381c1e9c479109202149b9e15e154973e9"
 
 [[package]]
 name = "hashbrown"
-version = "0.15.3"
+version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84b26c544d002229e640969970a2e74021aadf6e2f96372b9c58eff97de08eb3"
+checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
 dependencies = [
  "allocator-api2",
  "equivalent",
@@ -1572,9 +1572,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
 dependencies = [
  "adler2",
 ]
@@ -1586,7 +1586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "windows-sys 0.59.0",
 ]
 
@@ -2202,9 +2202,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
 
 [[package]]
 name = "rustc-hash"
@@ -2756,9 +2756,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.101"
+version = "2.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce2b7fc941b3a24138a0a7cf8e858bfc6a992e7978a068a5c760deb0ed43caf"
+checksum = "f6397daf94fa90f058bd0fd88429dd9e5738999cca8d701813c80723add80462"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3189,9 +3189,9 @@ checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasi"
@@ -3632,9 +3632,9 @@ checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
 
 [[package]]
 name = "winnow"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06928c8748d81b05c9be96aad92e1b6ff01833332f281e8cfca3be4b35fc9ec"
+checksum = "74c7b26e3480b707944fc872477815d29a8e429d2f93a1ce000f5fa84a15cbcd"
 dependencies = [
  "memchr",
 ]
diff --git a/submodules/rusty-http-cache-semantics b/submodules/rusty-http-cache-semantics
index 2500716..e5069f9 160000
--- a/submodules/rusty-http-cache-semantics
+++ b/submodules/rusty-http-cache-semantics
@@ -1 +1 @@
-Subproject commit 2500716b70bd6e548cdf690188ded7afe6726330
+Subproject commit e5069f9dbb9db846b29d6dafa4a0186c930cf906

From 7363241c48e05422fa03ac67964465a10a6a91ec Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 17 Jun 2025 11:28:49 +0900
Subject: [PATCH 50/69] chore: deps

---
 Cargo.lock            | 58 ++++++++++++++++++++-----------------------
 rpxy-acme/Cargo.toml  |  2 +-
 rpxy-bin/Cargo.toml   |  5 ++--
 rpxy-certs/Cargo.toml |  2 +-
 rpxy-lib/Cargo.toml   |  2 +-
 5 files changed, 32 insertions(+), 37 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9746005..eb5a823 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.26"
+version = "1.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "956a5e21988b87f372569b66183b78babf23ebc2e744b733e4350a752c4dafac"
+checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
 dependencies = [
  "jobserver",
  "libc",
@@ -1061,9 +1061,9 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f154ce46856750ed433c8649605bf7ed2de3bc35fd9d2a9f30cddd873c80cb08"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
 [[package]]
 name = "hex"
@@ -1462,9 +1462,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.173"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "d8cfeafaffdbc32176b64fb251369d52ea9f0a8fbc6f8759edffef7b525d64bb"
 
 [[package]]
 name = "libloading"
@@ -1473,7 +1473,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
 dependencies = [
  "cfg-if",
- "windows-targets 0.53.0",
+ "windows-targets 0.53.2",
 ]
 
 [[package]]
@@ -1484,9 +1484,9 @@ checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 
 [[package]]
 name = "libmimalloc-sys"
-version = "0.1.40"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07d0e07885d6a754b9c7993f2625187ad694ee985d60f23355ff0e7077261502"
+checksum = "bf88cd67e9de251c1781dbe2f641a1a3ad66eaae831b8a2c38fbdc5ddae16d4d"
 dependencies = [
  "cc",
  "libc",
@@ -1542,9 +1542,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "memoffset"
@@ -1557,9 +1557,9 @@ dependencies = [
 
 [[package]]
 name = "mimalloc"
-version = "0.1.44"
+version = "0.1.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99585191385958383e13f6b822e6b6d8d9cf928e7d286ceb092da92b43c87bc1"
+checksum = "b1791cbe101e95af5764f06f20f6760521f7158f69dbf9d6baf941ee1bf6bc40"
 dependencies = [
  "libmimalloc-sys",
 ]
@@ -1854,9 +1854,9 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.33"
+version = "0.2.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dee91521343f4c5c6a63edd65e54f31f5c92fe8978c40a4282f8372194c6a7d"
+checksum = "6837b9e10d61f45f987d50808f83d1ee3d206c66acf650c3e4ae2e1f6ddedf55"
 dependencies = [
  "proc-macro2",
  "syn",
@@ -2255,9 +2255,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.27"
+version = "0.23.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "730944ca083c1c233a75c09f199e973ca499344a2b7ba9e755c457e86fb4a321"
+checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -2713,12 +2713,9 @@ checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
 
 [[package]]
 name = "smallvec"
@@ -2756,9 +2753,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.102"
+version = "2.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6397daf94fa90f058bd0fd88429dd9e5738999cca8d701813c80723add80462"
+checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2841,12 +2838,11 @@ dependencies = [
 
 [[package]]
 name = "thread_local"
-version = "1.1.8"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
 dependencies = [
  "cfg-if",
- "once_cell",
 ]
 
 [[package]]
@@ -3396,9 +3392,9 @@ dependencies = [
 
 [[package]]
 name = "windows-link"
-version = "0.1.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
 [[package]]
 name = "windows-result"
@@ -3478,9 +3474,9 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.53.0"
+version = "0.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
+checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
 dependencies = [
  "windows_aarch64_gnullvm 0.53.0",
  "windows_aarch64_msvc 0.53.0",
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index cae1048..9e1484f 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -24,7 +24,7 @@ aws-lc-rs = { version = "1.13.1", default-features = false, features = [
   "aws-lc-sys",
 ] }
 blocking = "1.6.1"
-rustls = { version = "0.23.27", default-features = false, features = [
+rustls = { version = "0.23.28", default-features = false, features = [
   "std",
   "aws_lc_rs",
 ] }
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index e22b8e1..7ceaef4 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -42,9 +42,8 @@ sticky-cookie = ["rpxy-lib/sticky-cookie"]
 [dependencies]
 rpxy-lib = { path = "../rpxy-lib/", default-features = false }
 
-# TODO: pin mimalloc due to compilation failure by musl
-mimalloc = { version = "=0.1.44", default-features = false }
-libmimalloc-sys = { version = "=0.1.40" }
+mimalloc = { version = "0.1.47", default-features = false }
+libmimalloc-sys = { version = "0.1.43" }
 anyhow = "1.0.98"
 ahash = "0.8.12"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index a41d957..00f0384 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -22,7 +22,7 @@ derive_builder = { version = "0.20.2" }
 thiserror = { version = "2.0.12" }
 hot_reload = { version = "0.1.9" }
 async-trait = { version = "0.1.88" }
-rustls = { version = "0.23.27", default-features = false, features = [
+rustls = { version = "0.23.28", default-features = false, features = [
   "std",
   "aws_lc_rs",
 ] }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 9f694c2..bfb1f02 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -80,7 +80,7 @@ hyper-rustls = { version = "0.27.7", default-features = false, features = [
 # tls and cert management for server
 rpxy-certs = { path = "../rpxy-certs/", default-features = false }
 hot_reload = "0.1.9"
-rustls = { version = "0.23.27", default-features = false }
+rustls = { version = "0.23.28", default-features = false }
 rustls-post-quantum = { version = "0.2.2", optional = true }
 tokio-rustls = { version = "0.26.2", features = ["early-data"] }
 

From 38c4b48ce9b2d9537be4961ca2b1c28383a80ed9 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Tue, 24 Jun 2025 00:17:09 +0900
Subject: [PATCH 51/69] lock

---
 Cargo.lock | 71 ++++++++++++++++++++++++++++++------------------------
 1 file changed, 40 insertions(+), 31 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index eb5a823..53e8729 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -286,9 +286,9 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "aws-lc-rs"
@@ -732,12 +732,12 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
-version = "0.3.12"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
+checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1189,7 +1189,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.0",
+ "webpki-roots 1.0.1",
 ]
 
 [[package]]
@@ -1462,9 +1462,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.173"
+version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8cfeafaffdbc32176b64fb251369d52ea9f0a8fbc6f8759edffef7b525d64bb"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 
 [[package]]
 name = "libloading"
@@ -1854,9 +1854,9 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.34"
+version = "0.2.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6837b9e10d61f45f987d50808f83d1ee3d206c66acf650c3e4ae2e1f6ddedf55"
+checksum = "061c1221631e079b26479d25bbf2275bfe5917ae8419cd7e34f13bfc2aa7539a"
 dependencies = [
  "proc-macro2",
  "syn",
@@ -1923,9 +1923,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.12"
+version = "0.5.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee4e529991f949c5e25755532370b8af5d114acae52326361d68d47af64aa842"
+checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970"
 dependencies = [
  "cfg_aliases",
  "libc",
@@ -1946,9 +1946,9 @@ dependencies = [
 
 [[package]]
 name = "r-efi"
-version = "5.2.0"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "rand"
@@ -2362,7 +2362,7 @@ dependencies = [
  "rustls-webpki",
  "security-framework 3.2.0",
  "security-framework-sys",
- "webpki-root-certs 1.0.0",
+ "webpki-root-certs 1.0.1",
  "windows-sys 0.59.0",
 ]
 
@@ -2753,9 +2753,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.103"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3039,9 +3039,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.29"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1ffbcf9c6f6b99d386e7444eb608ba646ae452a36b39737deb9663b610f662"
+checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3272,14 +3272,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
 dependencies = [
- "webpki-root-certs 1.0.0",
+ "webpki-root-certs 1.0.1",
 ]
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a83f7e1a9f8712695c03eabe9ed3fbca0feff0152f33f12593e5a6303cb1a4"
+checksum = "86138b15b2b7d561bc4469e77027b8dd005a43dc502e9031d1f5afc8ce1f280e"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -3290,14 +3290,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.0",
+ "webpki-roots 1.0.1",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2853738d1cc4f2da3a225c18ec6c3721abb31961096e9dbf5ab35fa88b19cfdb"
+checksum = "8782dd5a41a24eed3a4f40b606249b3e236ca61adf1f25ea4d45c73de122b502"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -3316,9 +3316,9 @@ dependencies = [
 
 [[package]]
 name = "wide"
-version = "0.7.32"
+version = "0.7.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41b5576b9a81633f3e8df296ce0063042a73507636cbe956c61133dd7034ab22"
+checksum = "0ce5da8ecb62bcd8ec8b7ea19f69a51275e91299be594ea5cc6ef7819e16cd03"
 dependencies = [
  "bytemuck",
  "safe_arch",
@@ -3441,6 +3441,15 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.2",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.42.2"
@@ -3702,18 +3711,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.25"
+version = "0.8.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb"
+checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.25"
+version = "0.8.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28a6e20d751156648aa063f3800b706ee209a32c0b4d9f24be3d980b01be55ef"
+checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
 dependencies = [
  "proc-macro2",
  "quote",

From 0cf7c0b7d8333d2dab46edac665ce00fbf21ccc4 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Thu, 26 Jun 2025 13:49:52 +0900
Subject: [PATCH 52/69] chore: submodule deps

---
 Cargo.lock          | 22 +++++++++++-----------
 rpxy-lib/Cargo.toml |  6 +++---
 submodules/s2n-quic |  2 +-
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 53e8729..e600861 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -388,9 +388,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.18.1"
+version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db76d6187cd04dff33004d8e6c9cc4e05cd330500379d2394209271b4aeee"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
 [[package]]
 name = "bytemuck"
@@ -2407,7 +2407,7 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "s2n-codec"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "byteorder",
  "bytes",
@@ -2416,7 +2416,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic"
-version = "1.59.0"
+version = "1.60.0"
 dependencies = [
  "bytes",
  "cfg-if",
@@ -2439,7 +2439,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-core"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "atomic-waker",
  "byteorder",
@@ -2458,7 +2458,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-crypto"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "aws-lc-rs",
  "cfg-if",
@@ -2481,7 +2481,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-platform"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "cfg-if",
  "futures",
@@ -2494,7 +2494,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-rustls"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "bytes",
  "rustls",
@@ -2507,7 +2507,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "bytes",
  "errno",
@@ -2520,7 +2520,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls-default"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "s2n-quic-rustls",
  "s2n-quic-tls",
@@ -2528,7 +2528,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-transport"
-version = "0.59.0"
+version = "0.60.0"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index bfb1f02..5eaa046 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -94,11 +94,11 @@ tracing = { version = "0.1.41" }
 quinn = { version = "0.11.8", optional = true }
 h3 = { version = "0.0.8", features = ["tracing"], optional = true }
 h3-quinn = { version = "0.0.10", optional = true }
-s2n-quic = { version = "1.59.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
+s2n-quic = { version = "1.60.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
   "provider-tls-rustls",
 ], optional = true }
-s2n-quic-core = { version = "0.59.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
-s2n-quic-rustls = { version = "0.59.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
+s2n-quic-core = { version = "0.60.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
+s2n-quic-rustls = { version = "0.60.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
 s2n-quic-h3 = { path = "../submodules/s2n-quic/quic/s2n-quic-h3/", features = [
   "tracing",
 ], optional = true }
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index b2e9eac..dea532a 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit b2e9eac31c1b620d2fd0aa40753ca965a1ec1269
+Subproject commit dea532a941388832c08bf8e5fb32b7615a9ba928

From f942efc321fd42a9b8fa79d936a4d662458059f0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Jun 2025 22:54:31 +0000
Subject: [PATCH 53/69] chore(deps): bump lru from 0.14.0 to 0.15.0

Bumps [lru](https://github.com/jeromefroe/lru-rs) from 0.14.0 to 0.15.0.
- [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jeromefroe/lru-rs/compare/0.14.0...0.15.0)

---
updated-dependencies:
- dependency-name: lru
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 4 ++--
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e600861..3baf76d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1518,9 +1518,9 @@ checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "lru"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f8cc7106155f10bdf99a6f379688f543ad6596a415375b36a59a054ceda1198"
+checksum = "0281c2e25e62316a5c9d98f2d2e9e95a37841afdaf4383c177dbb5c1dfab0568"
 dependencies = [
  "hashbrown",
 ]
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 5eaa046..90af737 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -108,7 +108,7 @@ socket2 = { version = "0.5.10", features = ["all"], optional = true }
 
 # cache
 http-cache-semantics = { path = "../submodules/rusty-http-cache-semantics", default-features = false, optional = true }
-lru = { version = "0.14.0", optional = true }
+lru = { version = "0.15.0", optional = true }
 sha2 = { version = "0.10.9", default-features = false, optional = true }
 
 # cookie handling for sticky cookie

From 4c1c1afc30637599062a8fbeb080daf68dad9954 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 30 Jun 2025 13:51:03 +0900
Subject: [PATCH 54/69] lock

---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3baf76d..03d2cfd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1368,9 +1368,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 dependencies = [
  "equivalent",
  "hashbrown",

From 254b5c1bb14a94f508cf93851641651fc9030d9b Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 30 Jun 2025 17:37:06 +0900
Subject: [PATCH 55/69] chore: refactor rpxy-certs

---
 rpxy-certs/src/certs.rs         |   4 +-
 rpxy-certs/src/crypto_source.rs | 109 +++++++++++++++-----------------
 2 files changed, 52 insertions(+), 61 deletions(-)

diff --git a/rpxy-certs/src/certs.rs b/rpxy-certs/src/certs.rs
index 18927a2..56d062a 100644
--- a/rpxy-certs/src/certs.rs
+++ b/rpxy-certs/src/certs.rs
@@ -75,9 +75,7 @@ impl SingleServerCertsKeys {
   /* ------------------------------------------------ */
   /// Parse the client CA certificates and return a hashmap of pairs of a subject key identifier (key) and a trust anchor (value)
   pub fn rustls_client_certs_trust_anchors(&self) -> Result<TrustAnchors, RpxyCertError> {
-    let Some(certs) = self.client_ca_certs.as_ref() else {
-      return Err(RpxyCertError::NoClientCert);
-    };
+    let certs = self.client_ca_certs.as_ref().ok_or(RpxyCertError::NoClientCert)?;
     let certs = certs.iter().map(|c| Certificate::from(c.to_vec())).collect::<Vec<_>>();
 
     let trust_anchors = certs
diff --git a/rpxy-certs/src/crypto_source.rs b/rpxy-certs/src/crypto_source.rs
index c204fbb..330b8bc 100644
--- a/rpxy-certs/src/crypto_source.rs
+++ b/rpxy-certs/src/crypto_source.rs
@@ -80,77 +80,70 @@ fn read_certs_and_keys(
 ) -> Result<SingleServerCertsKeys, RpxyCertError> {
   debug!("Read TLS server certificates and private key");
 
+  // ------------------------
   // certificates
-  let raw_certs = {
-    let mut reader = BufReader::new(File::open(cert_path).map_err(|e| {
+  let mut reader = BufReader::new(File::open(cert_path).map_err(|e| {
+    io::Error::new(
+      e.kind(),
+      format!("Unable to load the certificates [{}]: {e}", cert_path.display()),
+    )
+  })?);
+  let raw_certs = rustls_pemfile::certs(&mut reader)
+    .collect::<Result<Vec<_>, _>>()
+    .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the certificates"))?;
+
+  // ------------------------
+  // private keys
+  let mut encoded_keys = vec![];
+  File::open(cert_key_path)
+    .map_err(|e| {
       io::Error::new(
         e.kind(),
-        format!("Unable to load the certificates [{}]: {e}", cert_path.display()),
+        format!("Unable to load the certificate keys [{}]: {e}", cert_key_path.display()),
       )
-    })?);
-    rustls_pemfile::certs(&mut reader)
-      .collect::<Result<Vec<_>, _>>()
-      .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the certificates"))?
-  };
-
-  // private keys
-  let raw_cert_keys = {
-    let encoded_keys = {
-      let mut encoded_keys = vec![];
-      File::open(cert_key_path)
-        .map_err(|e| {
-          io::Error::new(
-            e.kind(),
-            format!("Unable to load the certificate keys [{}]: {e}", cert_key_path.display()),
-          )
-        })?
-        .read_to_end(&mut encoded_keys)?;
-      encoded_keys
-    };
-    let mut reader = Cursor::new(encoded_keys);
-    let pkcs8_keys = rustls_pemfile::pkcs8_private_keys(&mut reader)
-      .map(|v| v.map(rustls::pki_types::PrivateKeyDer::Pkcs8))
-      .collect::<Result<Vec<_>, _>>()
-      .map_err(|_| {
-        io::Error::new(
-          io::ErrorKind::InvalidInput,
-          "Unable to parse the certificates private keys (PKCS8)",
-        )
-      })?;
-    reader.set_position(0);
-    let mut rsa_keys = rustls_pemfile::rsa_private_keys(&mut reader)
-      .map(|v| v.map(rustls::pki_types::PrivateKeyDer::Pkcs1))
-      .collect::<Result<Vec<_>, _>>()?;
-    let mut keys = pkcs8_keys;
-    keys.append(&mut rsa_keys);
-    if keys.is_empty() {
-      return Err(RpxyCertError::IoError(io::Error::new(
+    })?
+    .read_to_end(&mut encoded_keys)?;
+  let mut reader = Cursor::new(encoded_keys);
+  let pkcs8_keys = rustls_pemfile::pkcs8_private_keys(&mut reader)
+    .map(|v| v.map(rustls::pki_types::PrivateKeyDer::Pkcs8))
+    .collect::<Result<Vec<_>, _>>()
+    .map_err(|_| {
+      io::Error::new(
         io::ErrorKind::InvalidInput,
-        "No private keys found - Make sure that they are in PKCS#8/PEM format",
-      )));
-    }
-    keys
-  };
+        "Unable to parse the certificates private keys (PKCS8)",
+      )
+    })?;
+  reader.set_position(0);
+  let mut rsa_keys = rustls_pemfile::rsa_private_keys(&mut reader)
+    .map(|v| v.map(rustls::pki_types::PrivateKeyDer::Pkcs1))
+    .collect::<Result<Vec<_>, _>>()?;
+  let mut raw_cert_keys = pkcs8_keys;
+  raw_cert_keys.append(&mut rsa_keys);
+  if raw_cert_keys.is_empty() {
+    return Err(RpxyCertError::IoError(io::Error::new(
+      io::ErrorKind::InvalidInput,
+      "No private keys found - Make sure that they are in PKCS#8/PEM format",
+    )));
+  }
 
+  // ------------------------
   // client ca certificates
-  let client_ca_certs = if let Some(path) = client_ca_cert_path {
-    debug!("Read CA certificates for client authentication");
-    // Reads client certificate and returns client
-    let certs = {
-      let mut reader = BufReader::new(File::open(path).map_err(|e| {
+  let client_ca_certs = client_ca_cert_path
+    .map(|path| {
+      debug!("Read CA certificates for client authentication");
+      // Reads client certificate and returns client
+      let inner = File::open(path).map_err(|e| {
         io::Error::new(
           e.kind(),
           format!("Unable to load the client certificates [{}]: {e}", path.display()),
         )
-      })?);
+      })?;
+      let mut reader = BufReader::new(inner);
       rustls_pemfile::certs(&mut reader)
         .collect::<Result<Vec<_>, _>>()
-        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the client certificates"))?
-    };
-    Some(certs)
-  } else {
-    None
-  };
+        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the client certificates"))
+    })
+    .transpose()?;
 
   Ok(SingleServerCertsKeys::new(
     &raw_certs,

From 0d4234b62091f5fe3239a416b3958773d10c01d6 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 30 Jun 2025 18:26:56 +0900
Subject: [PATCH 56/69] chore: deps hot_reload

---
 Cargo.lock                             | 12 ++++++------
 Cargo.toml                             |  2 +-
 rpxy-bin/Cargo.toml                    |  2 +-
 rpxy-bin/src/main.rs                   |  5 ++---
 rpxy-certs/Cargo.toml                  |  2 +-
 rpxy-certs/src/lib.rs                  |  5 ++---
 rpxy-lib/Cargo.toml                    |  2 +-
 rpxy-lib/src/proxy/proxy_main.rs       |  2 +-
 rpxy-lib/src/proxy/proxy_quic_quinn.rs |  2 +-
 rpxy-lib/src/proxy/proxy_quic_s2n.rs   |  2 +-
 10 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 03d2cfd..655fbfb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1088,9 +1088,9 @@ dependencies = [
 
 [[package]]
 name = "hot_reload"
-version = "0.1.9"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c6b9b663cacaa5655b282218152476f7d38f6dc29b0d9b93a7f5fd73209b6a"
+checksum = "469bdabdc9436358811cd8fa2d35b3a0fc60534aca57979b931b9f5f9551ce16"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2093,7 +2093,7 @@ dependencies = [
 
 [[package]]
 name = "rpxy"
-version = "0.10.0"
+version = "0.10.1"
 dependencies = [
  "ahash",
  "anyhow",
@@ -2117,7 +2117,7 @@ dependencies = [
 
 [[package]]
 name = "rpxy-acme"
-version = "0.10.0"
+version = "0.10.1"
 dependencies = [
  "ahash",
  "async-trait",
@@ -2138,7 +2138,7 @@ dependencies = [
 
 [[package]]
 name = "rpxy-certs"
-version = "0.10.0"
+version = "0.10.1"
 dependencies = [
  "ahash",
  "async-trait",
@@ -2156,7 +2156,7 @@ dependencies = [
 
 [[package]]
 name = "rpxy-lib"
-version = "0.10.0"
+version = "0.10.1"
 dependencies = [
  "ahash",
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index 211fce7..9b7841f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace.package]
-version = "0.10.0"
+version = "0.10.1"
 authors = ["Jun Kurihara"]
 homepage = "https://github.com/junkurihara/rust-rpxy"
 repository = "https://github.com/junkurihara/rust-rpxy"
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 7ceaef4..da5925d 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -61,7 +61,7 @@ futures-util = { version = "0.3.31", default-features = false }
 # config
 clap = { version = "4.5.40", features = ["std", "cargo", "wrap_help"] }
 toml = { version = "0.8.23", default-features = false, features = ["parse"] }
-hot_reload = "0.1.9"
+hot_reload = "0.2.0"
 serde_ignored = "0.1.12"
 
 # logging
diff --git a/rpxy-bin/src/main.rs b/rpxy-bin/src/main.rs
index 860a804..1419bc7 100644
--- a/rpxy-bin/src/main.rs
+++ b/rpxy-bin/src/main.rs
@@ -33,10 +33,9 @@ fn main() {
 
     init_logger(parsed_opts.log_dir_path.as_deref());
 
-    let (config_service, config_rx) = ReloaderService::<ConfigTomlReloader, ConfigToml, String>::new(
+    let (config_service, config_rx) = ReloaderService::<ConfigTomlReloader, ConfigToml, String>::with_delay(
       &parsed_opts.config_file_path,
       CONFIG_WATCH_DELAY_SECS,
-      false,
     )
     .await
     .unwrap();
@@ -256,7 +255,7 @@ async fn rpxy_service(
       }
       /* ---------- */
       _ = config_rx.changed() => {
-        let Some(new_config_toml) = config_rx.borrow().clone() else {
+        let Some(new_config_toml) = config_rx.get() else {
           error!("Something wrong in config reloader receiver");
           return Err(anyhow!("Something wrong in config reloader receiver"));
         };
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index 00f0384..e89c3fc 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -20,7 +20,7 @@ ahash = { version = "0.8.12" }
 tracing = { version = "0.1.41" }
 derive_builder = { version = "0.20.2" }
 thiserror = { version = "2.0.12" }
-hot_reload = { version = "0.1.9" }
+hot_reload = { version = "0.2.0" }
 async-trait = { version = "0.1.88" }
 rustls = { version = "0.23.28", default-features = false, features = [
   "std",
diff --git a/rpxy-certs/src/lib.rs b/rpxy-certs/src/lib.rs
index 2cc29bd..9abdfc4 100644
--- a/rpxy-certs/src/lib.rs
+++ b/rpxy-certs/src/lib.rs
@@ -27,8 +27,6 @@ pub use crate::{
 // Constants
 /// Default delay in seconds to watch certificates
 const DEFAULT_CERTS_WATCH_DELAY_SECS: u32 = 60;
-/// Load certificates only when updated
-const LOAD_CERTS_ONLY_WHEN_UPDATED: bool = true;
 
 /// Result type inner of certificate reloader service
 type ReloaderServiceResultInner = (
@@ -62,6 +60,7 @@ where
   let certs_watch_period = certs_watch_period.unwrap_or(DEFAULT_CERTS_WATCH_DELAY_SECS);
 
   let (cert_reloader_service, cert_reloader_rx) =
-    ReloaderService::<CryptoReloader, ServerCryptoBase>::new(&source, certs_watch_period, !LOAD_CERTS_ONLY_WHEN_UPDATED).await?;
+    ReloaderService::<CryptoReloader, ServerCryptoBase>::with_delay(&source, certs_watch_period).await?;
+
   Ok((cert_reloader_service, cert_reloader_rx))
 }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 90af737..790bcab 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -79,7 +79,7 @@ hyper-rustls = { version = "0.27.7", default-features = false, features = [
 
 # tls and cert management for server
 rpxy-certs = { path = "../rpxy-certs/", default-features = false }
-hot_reload = "0.1.9"
+hot_reload = "0.2.0"
 rustls = { version = "0.23.28", default-features = false }
 rustls-post-quantum = { version = "0.2.2", optional = true }
 tokio-rustls = { version = "0.26.2", features = ["early-data"] }
diff --git a/rpxy-lib/src/proxy/proxy_main.rs b/rpxy-lib/src/proxy/proxy_main.rs
index b858072..e2c977f 100644
--- a/rpxy-lib/src/proxy/proxy_main.rs
+++ b/rpxy-lib/src/proxy/proxy_main.rs
@@ -313,7 +313,7 @@ where
             error!("Reloader is broken");
             break;
           }
-          let server_crypto_base = server_crypto_rx.borrow().clone().unwrap();
+          let server_crypto_base = server_crypto_rx.get().unwrap();
           let Some(server_config): Option<Arc<ServerCrypto>> = (&server_crypto_base).try_into().ok() else {
             error!("Failed to update server crypto");
             break;
diff --git a/rpxy-lib/src/proxy/proxy_quic_quinn.rs b/rpxy-lib/src/proxy/proxy_quic_quinn.rs
index 4fd4c38..f2cd6a0 100644
--- a/rpxy-lib/src/proxy/proxy_quic_quinn.rs
+++ b/rpxy-lib/src/proxy/proxy_quic_quinn.rs
@@ -102,7 +102,7 @@ where
             error!("Reloader is broken");
             break;
           }
-          let cert_keys_map = server_crypto_rx.borrow().clone().unwrap();
+          let cert_keys_map = server_crypto_rx.get().unwrap();
 
           server_crypto = (&cert_keys_map).try_into().ok();
           let Some(inner) = server_crypto.clone() else {
diff --git a/rpxy-lib/src/proxy/proxy_quic_s2n.rs b/rpxy-lib/src/proxy/proxy_quic_s2n.rs
index 70659dd..85d438a 100644
--- a/rpxy-lib/src/proxy/proxy_quic_s2n.rs
+++ b/rpxy-lib/src/proxy/proxy_quic_s2n.rs
@@ -52,7 +52,7 @@ where
 
   /// Receive server crypto from reloader
   fn receive_server_crypto(&self, server_crypto_rx: ReloaderReceiver<ServerCryptoBase>) -> RpxyResult<s2n_quic_rustls::Server> {
-    let cert_keys_map = server_crypto_rx.borrow().clone().ok_or_else(|| {
+    let cert_keys_map = server_crypto_rx.get().ok_or_else(|| {
       error!("Reloader is broken");
       RpxyError::CertificateReloadError(anyhow!("Reloader is broken").into())
     })?;

From 1f0ed386b7916c9e3b6791fc268d40ff496160ee Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Mon, 30 Jun 2025 23:35:05 +0900
Subject: [PATCH 57/69] chore: refactor

---
 Cargo.lock          | 1 -
 rpxy-bin/Cargo.toml | 1 -
 2 files changed, 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 655fbfb..85a2d45 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2101,7 +2101,6 @@ dependencies = [
  "clap",
  "futures-util",
  "hot_reload",
- "libmimalloc-sys",
  "mimalloc",
  "rpxy-acme",
  "rpxy-certs",
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index da5925d..dfc7ae1 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -43,7 +43,6 @@ sticky-cookie = ["rpxy-lib/sticky-cookie"]
 rpxy-lib = { path = "../rpxy-lib/", default-features = false }
 
 mimalloc = { version = "0.1.47", default-features = false }
-libmimalloc-sys = { version = "0.1.43" }
 anyhow = "1.0.98"
 ahash = "0.8.12"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }

From 2d07e0ce152d619cd66c566671b369ea043ef77a Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Wed, 2 Jul 2025 13:18:26 +0900
Subject: [PATCH 58/69] chore: deps

---
 Cargo.lock          | 26 +++++++++++++-------------
 rpxy-lib/Cargo.toml |  6 +++---
 submodules/s2n-quic |  2 +-
 3 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 85a2d45..a191177 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -996,9 +996,9 @@ checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "h2"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
+checksum = "17da50a276f1e01e0ba6c029e47b7100754904ee8a278f886546e98575380785"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1736,9 +1736,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-src"
-version = "300.5.0+3.5.0"
+version = "300.5.1+3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f"
+checksum = "735230c832b28c000e3bc117119e6466a663ec73506bc0a9907ea4187508e42a"
 dependencies = [
  "cc",
 ]
@@ -2406,7 +2406,7 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "s2n-codec"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "byteorder",
  "bytes",
@@ -2415,7 +2415,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic"
-version = "1.60.0"
+version = "1.61.0"
 dependencies = [
  "bytes",
  "cfg-if",
@@ -2438,7 +2438,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-core"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "atomic-waker",
  "byteorder",
@@ -2457,7 +2457,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-crypto"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "aws-lc-rs",
  "cfg-if",
@@ -2480,7 +2480,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-platform"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "cfg-if",
  "futures",
@@ -2493,7 +2493,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-rustls"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "bytes",
  "rustls",
@@ -2506,7 +2506,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "bytes",
  "errno",
@@ -2519,7 +2519,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-tls-default"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "s2n-quic-rustls",
  "s2n-quic-tls",
@@ -2527,7 +2527,7 @@ dependencies = [
 
 [[package]]
 name = "s2n-quic-transport"
-version = "0.60.0"
+version = "0.61.0"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index 790bcab..eb886c0 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -94,11 +94,11 @@ tracing = { version = "0.1.41" }
 quinn = { version = "0.11.8", optional = true }
 h3 = { version = "0.0.8", features = ["tracing"], optional = true }
 h3-quinn = { version = "0.0.10", optional = true }
-s2n-quic = { version = "1.60.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
+s2n-quic = { version = "1.61.0", path = "../submodules/s2n-quic/quic/s2n-quic/", default-features = false, features = [
   "provider-tls-rustls",
 ], optional = true }
-s2n-quic-core = { version = "0.60.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
-s2n-quic-rustls = { version = "0.60.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
+s2n-quic-core = { version = "0.61.0", path = "../submodules/s2n-quic/quic/s2n-quic-core", default-features = false, optional = true }
+s2n-quic-rustls = { version = "0.61.0", path = "../submodules/s2n-quic/quic/s2n-quic-rustls", optional = true }
 s2n-quic-h3 = { path = "../submodules/s2n-quic/quic/s2n-quic-h3/", features = [
   "tracing",
 ], optional = true }
diff --git a/submodules/s2n-quic b/submodules/s2n-quic
index dea532a..814e034 160000
--- a/submodules/s2n-quic
+++ b/submodules/s2n-quic
@@ -1 +1 @@
-Subproject commit dea532a941388832c08bf8e5fb32b7615a9ba928
+Subproject commit 814e0348b5ee3aa72083a722c34d7446c91cfc69

From ef8878d1b548607cb96d4e83884037a2c6b89553 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 2 Jul 2025 22:33:59 +0000
Subject: [PATCH 59/69] chore(deps): bump tokio from 1.45.1 to 1.46.0

Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.45.1 to 1.46.0.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.45.1...tokio-1.46.0)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock            | 17 +++++++++++++++--
 rpxy-acme/Cargo.toml  |  2 +-
 rpxy-bin/Cargo.toml   |  2 +-
 rpxy-certs/Cargo.toml |  2 +-
 rpxy-lib/Cargo.toml   |  2 +-
 5 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a191177..38e0a14 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1385,6 +1385,17 @@ dependencies = [
  "memoffset",
 ]
 
+[[package]]
+name = "io-uring"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b86e202f00093dcba4275d4636b93ef9dd75d025ae560d2521b45ea28ab49013"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.1"
@@ -2902,15 +2913,17 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.45.1"
+version = "1.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
+checksum = "1140bb80481756a8cbe10541f37433b459c5aa1e727b4c020fbfebdc25bf3ec4"
 dependencies = [
  "backtrace",
  "bytes",
+ "io-uring",
  "libc",
  "mio",
  "pin-project-lite",
+ "slab",
  "socket2",
  "tokio-macros",
  "windows-sys 0.52.0",
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index 9e1484f..8e92ce5 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -33,7 +33,7 @@ rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, f
   "aws-lc-rs",
 ] }
 rustls-post-quantum = { version = "0.2.2", optional = true }
-tokio = { version = "1.45.1", default-features = false, features = [
+tokio = { version = "1.46.0", default-features = false, features = [
   "rt",
   "macros",
 ] }
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index dfc7ae1..861b73b 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -46,7 +46,7 @@ mimalloc = { version = "0.1.47", default-features = false }
 anyhow = "1.0.98"
 ahash = "0.8.12"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }
-tokio = { version = "1.45.1", default-features = false, features = [
+tokio = { version = "1.46.0", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index e89c3fc..111d56d 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -35,7 +35,7 @@ rustls-post-quantum = { version = "0.2.2", optional = true }
 x509-parser = { version = "0.17.0" }
 
 [dev-dependencies]
-tokio = { version = "1.45.1", default-features = false, features = [
+tokio = { version = "1.46.0", default-features = false, features = [
   "rt-multi-thread",
   "macros",
 ] }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index eb886c0..c5dd1d8 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -41,7 +41,7 @@ ahash = "0.8.12"
 bytes = "1.10.1"
 derive_builder = "0.20.2"
 futures = { version = "0.3.31", features = ["alloc", "async-await"] }
-tokio = { version = "1.45.1", default-features = false, features = [
+tokio = { version = "1.46.0", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",

From bba5b2892b2f75933c0ac5a96d50addb962eaee6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 3 Jul 2025 22:58:28 +0000
Subject: [PATCH 60/69] chore(deps): bump lru from 0.15.0 to 0.16.0

Bumps [lru](https://github.com/jeromefroe/lru-rs) from 0.15.0 to 0.16.0.
- [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jeromefroe/lru-rs/compare/0.15.0...0.16.0)

---
updated-dependencies:
- dependency-name: lru
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock          | 4 ++--
 rpxy-lib/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 38e0a14..5f4b506 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1529,9 +1529,9 @@ checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "lru"
-version = "0.15.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0281c2e25e62316a5c9d98f2d2e9e95a37841afdaf4383c177dbb5c1dfab0568"
+checksum = "86ea4e65087ff52f3862caff188d489f1fab49a0cb09e01b2e3f1a617b10aaed"
 dependencies = [
  "hashbrown",
 ]
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index c5dd1d8..bd31295 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -108,7 +108,7 @@ socket2 = { version = "0.5.10", features = ["all"], optional = true }
 
 # cache
 http-cache-semantics = { path = "../submodules/rusty-http-cache-semantics", default-features = false, optional = true }
-lru = { version = "0.15.0", optional = true }
+lru = { version = "0.16.0", optional = true }
 sha2 = { version = "0.10.9", default-features = false, optional = true }
 
 # cookie handling for sticky cookie

From 6e7f432aeca28a759c087d17adecb8969f0189e5 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 4 Jul 2025 13:45:27 +0900
Subject: [PATCH 61/69] lock

---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5f4b506..9d0e811 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -157,9 +157,9 @@ dependencies = [
 
 [[package]]
 name = "async-channel"
-version = "2.3.1"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89b47800b0be77592da0afd425cc03468052844aff33b84e33cc696f64e77b6a"
+checksum = "16c74e56284d2188cabb6ad99603d1ace887a5d7e7b695d01b728155ed9ed427"
 dependencies = [
  "concurrent-queue",
  "event-listener-strategy",

From a73321cb2790a9c5da97b616c67ebb27281e4aea Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 4 Jul 2025 17:10:24 +0900
Subject: [PATCH 62/69] initial support forwarded header

---
 .gitignore                                    |   1 +
 rpxy-lib/src/backend/upstream_opts.rs         |   3 +
 .../handler_manipulate_messages.rs            |   4 +-
 rpxy-lib/src/message_handler/utils_headers.rs | 140 +++++++++++++++++-
 4 files changed, 142 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 20b6fd3..6febdfa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .vscode
 .private
+.tmp
 docker/log
 docker/cache
 docker/config
diff --git a/rpxy-lib/src/backend/upstream_opts.rs b/rpxy-lib/src/backend/upstream_opts.rs
index 68309ca..90ec7de 100644
--- a/rpxy-lib/src/backend/upstream_opts.rs
+++ b/rpxy-lib/src/backend/upstream_opts.rs
@@ -13,6 +13,8 @@ pub enum UpstreamOption {
   ForceHttp11Upstream,
   /// Force HTTP/2 upstream
   ForceHttp2Upstream,
+  /// Add RFC 7239 Forwarded header
+  ForwardedHeader,
   // TODO: Adds more options for heder override
 }
 impl TryFrom<&str> for UpstreamOption {
@@ -24,6 +26,7 @@ impl TryFrom<&str> for UpstreamOption {
       "upgrade_insecure_requests" => Ok(Self::UpgradeInsecureRequests),
       "force_http11_upstream" => Ok(Self::ForceHttp11Upstream),
       "force_http2_upstream" => Ok(Self::ForceHttp2Upstream),
+      "forwarded_header" => Ok(Self::ForwardedHeader),
       _ => Err(RpxyError::UnsupportedUpstreamOption),
     }
   }
diff --git a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
index dc58486..1f925e2 100644
--- a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
+++ b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
@@ -87,7 +87,7 @@ where
     remove_connection_header(headers);
     // delete hop headers including header.connection
     remove_hop_header(headers);
-    // X-Forwarded-For
+    // X-Forwarded-For (and Forwarded if exists)
     add_forwarding_header(headers, client_addr, listen_addr, tls_enabled, &original_uri)?;
 
     // Add te: trailer if te_trailer
@@ -126,7 +126,7 @@ where
 
     // apply upstream-specific headers given in upstream_option
     let headers = req.headers_mut();
-    // apply upstream options to header
+    // apply upstream options to header, after X-Forwarded-For is added
     apply_upstream_options_to_header(headers, &upstream_chosen.uri, upstream_candidates)?;
 
     // update uri in request
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index fe351d9..f6efac2 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -96,6 +96,7 @@ fn override_host_header(headers: &mut HeaderMap, upstream_base_uri: &Uri) -> Res
 }
 
 /// Apply options to request header, which are specified in the configuration
+/// This function is called after almost all other headers has been set and updated.
 pub(super) fn apply_upstream_options_to_header(
   headers: &mut HeaderMap,
   upstream_base_uri: &Uri,
@@ -117,6 +118,22 @@ pub(super) fn apply_upstream_options_to_header(
           .entry(header::UPGRADE_INSECURE_REQUESTS)
           .or_insert(HeaderValue::from_bytes(b"1").unwrap());
       }
+      UpstreamOption::ForwardedHeader => {
+        // This is called after X-Forwarded-For is added
+        // Generate RFC 7239 Forwarded header
+        let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("unknown");
+        let tls = upstream_base_uri.scheme_str() == Some("https");
+
+        match generate_forwarded_header(headers, tls, host) {
+          Ok(forwarded_value) => {
+            add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;
+          }
+          Err(e) => {
+            // Log warning but don't fail the request if Forwarded generation fails
+            warn!("Failed to generate Forwarded header: {}", e);
+          }
+        }
+      }
       _ => (),
     }
   }
@@ -194,7 +211,9 @@ pub(super) fn make_cookie_single_line(headers: &mut HeaderMap) -> Result<()> {
   Ok(())
 }
 
-/// Add forwarding headers like `x-forwarded-for`.
+/// Add or update forwarding headers like `x-forwarded-for`.
+/// If only `forwarded` header exists, it will update `x-forwarded-for` with the proxy chain.
+/// If both `x-forwarded-for` and `forwarded` headers exist, it will update `x-forwarded-for` first and then add `forwarded` header.
 pub(super) fn add_forwarding_header(
   headers: &mut HeaderMap,
   client_addr: &SocketAddr,
@@ -202,10 +221,40 @@ pub(super) fn add_forwarding_header(
   tls: bool,
   uri_str: &str,
 ) -> Result<()> {
-  // default process
-  // optional process defined by upstream_option is applied in fn apply_upstream_options
   let canonical_client_addr = client_addr.to_canonical().ip().to_string();
-  append_header_entry_with_comma(headers, "x-forwarded-for", &canonical_client_addr)?;
+  let has_forwarded = headers.contains_key("forwarded");
+  let has_xff = headers.contains_key("x-forwarded-for");
+
+  // Handle incoming Forwarded header (Case 2: only Forwarded exists)
+  if has_forwarded && !has_xff {
+    // Extract proxy chain from Forwarded header and update X-Forwarded-For for consistency
+    update_xff_from_forwarded(headers, client_addr)?;
+  } else {
+    // Case 1: only X-Forwarded-For exists, or Case 3: both exist (conservative: use X-Forwarded-For)
+    // TODO: In future PR, implement proper RFC 7239 precedence
+    // where Forwarded header should take priority over X-Forwarded-For
+    // This requires careful testing to ensure no breaking changes
+    append_header_entry_with_comma(headers, "x-forwarded-for", &canonical_client_addr)?;
+  }
+
+  // IMPORTANT: If Forwarded header exists, always update it for consistency
+  // This ensures headers remain consistent even when forwarded_header upstream option is not specified
+  if has_forwarded {
+    let host = headers
+      .get(header::HOST)
+      .and_then(|h| h.to_str().ok())
+      .unwrap_or("unknown");
+    
+    match generate_forwarded_header(headers, tls, host) {
+      Ok(forwarded_value) => {
+        add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;
+      }
+      Err(e) => {
+        // Log warning but don't fail the request if Forwarded generation fails
+        warn!("Failed to update existing Forwarded header for consistency: {}", e);
+      }
+    }
+  }
 
   // Single line cookie header
   // TODO: This should be only for HTTP/1.1. For 2+, this can be multi-lined.
@@ -232,6 +281,89 @@ pub(super) fn add_forwarding_header(
   Ok(())
 }
 
+/// Extract proxy chain from existing Forwarded header
+fn extract_forwarded_chain(headers: &HeaderMap) -> Vec<String> {
+  headers
+    .get("forwarded")
+    .and_then(|h| h.to_str().ok())
+    .map(|forwarded_str| {
+      // Parse Forwarded header entries (comma-separated)
+      forwarded_str
+        .split(',')
+        .flat_map(|entry| entry.split(';'))
+        .map(str::trim)
+        .filter_map(|param| param.strip_prefix("for="))
+        .map(|for_value| {
+          // Remove quotes from IPv6 addresses for consistency with X-Forwarded-For
+          if let Some(ipv6) = for_value.strip_prefix("\"[").and_then(|s| s.strip_suffix("]\"")) {
+            ipv6.to_string()
+          } else {
+            for_value.to_string()
+          }
+        })
+        .collect()
+    })
+    .unwrap_or_default()
+}
+
+/// Update X-Forwarded-For with proxy chain from Forwarded header for consistency
+fn update_xff_from_forwarded(headers: &mut HeaderMap, client_addr: &SocketAddr) -> Result<()> {
+  let forwarded_chain = extract_forwarded_chain(headers);
+
+  if !forwarded_chain.is_empty() {
+    // Replace X-Forwarded-For with the chain from Forwarded header
+    headers.remove("x-forwarded-for");
+    for ip in forwarded_chain {
+      append_header_entry_with_comma(headers, "x-forwarded-for", &ip)?;
+    }
+  }
+
+  // Append current client IP (standard behavior)
+  let canonical_client_addr = client_addr.to_canonical().ip().to_string();
+  append_header_entry_with_comma(headers, "x-forwarded-for", &canonical_client_addr)?;
+
+  Ok(())
+}
+
+/// Generate RFC 7239 Forwarded header from X-Forwarded-For
+/// This function assumes that the X-Forwarded-For header is present and well-formed.
+fn generate_forwarded_header(headers: &HeaderMap, tls: bool, host: &str) -> Result<String> {
+  let for_values = headers
+    .get("x-forwarded-for")
+    .and_then(|h| h.to_str().ok())
+    .map(|xff_str| {
+      xff_str
+        .split(',')
+        .map(str::trim)
+        .filter(|ip| !ip.is_empty())
+        .map(|ip| {
+          // Format IP according to RFC 7239 (quote IPv6)
+          if ip.contains(':') {
+            format!("\"[{}]\"", ip)
+          } else {
+            ip.to_string()
+          }
+        })
+        .collect::<Vec<_>>()
+        .join(",for=")
+    })
+    .unwrap_or_default();
+
+  if for_values.is_empty() {
+    return Err(anyhow!("No X-Forwarded-For header found for Forwarded generation"));
+  }
+
+  // Build forwarded header value
+  let forwarded_value = format!(
+    "for={};proto={};host={}",
+    for_values,
+    if tls { "https" } else { "http" },
+    host
+  );
+
+  Ok(forwarded_value)
+}
+
 /// Remove connection header
 pub(super) fn remove_connection_header(headers: &mut HeaderMap) {
   if let Some(values) = headers.get(header::CONNECTION) {

From 03bfd466bf0b1ce5598d706d45012872d7e525a1 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Fri, 4 Jul 2025 17:58:41 +0900
Subject: [PATCH 63/69] wip: still bug for forwarde-host param

---
 CHANGELOG.md                                         |  4 ++++
 config-example.toml                                  |  1 +
 .../message_handler/handler_manipulate_messages.rs   | 12 ++++++++++++
 rpxy-lib/src/message_handler/utils_headers.rs        |  8 +++-----
 4 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a76b24d..d7a06b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## 0.10.1 or 0.11.0 (Unreleased)
 
+### Improvement
+
+- Feat: Support `Forwarded` header in addition to `X-Forwarded-For` header. This is to support the standard forwarding header for reverse proxy applications (RFC 7239). Use the `forwarded_header` upstream option to enable this feature.
+
 ## 0.10.0
 
 ### Important Changes
diff --git a/config-example.toml b/config-example.toml
index 8ed7621..8e08318 100644
--- a/config-example.toml
+++ b/config-example.toml
@@ -84,6 +84,7 @@ upstream_options = [
   "upgrade_insecure_requests",
   "force_http11_upstream",
   "set_upstream_host",         # overwrite HOST value with upstream hostname (like www.yahoo.com)
+  "forwarded_header" # add Forwarded header
 ]
 ######################################################################
 
diff --git a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
index 1f925e2..9f74fe8 100644
--- a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
+++ b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
@@ -98,6 +98,18 @@ where
     // by default, add "host" header of original server_name if not exist
     if req.headers().get(header::HOST).is_none() {
       let org_host = req.uri().host().ok_or_else(|| anyhow!("Invalid request"))?.to_owned();
+      // Omit port 80 if !tls_enabled, omit port 443 if tls_enabled
+      let org_host = req
+        .uri()
+        .port_u16()
+        .map(|port| {
+          if (tls_enabled && port == 443) || (!tls_enabled && port == 80) {
+            org_host.clone()
+          } else {
+            format!("{}:{}", org_host, port)
+          }
+        })
+        .unwrap_or(org_host);
       req.headers_mut().insert(header::HOST, HeaderValue::from_str(&org_host)?);
     };
 
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index f6efac2..61a1d50 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -121,6 +121,7 @@ pub(super) fn apply_upstream_options_to_header(
       UpstreamOption::ForwardedHeader => {
         // This is called after X-Forwarded-For is added
         // Generate RFC 7239 Forwarded header
+        // TODO: host is generated from x-original-uri
         let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("unknown");
         let tls = upstream_base_uri.scheme_str() == Some("https");
 
@@ -240,11 +241,8 @@ pub(super) fn add_forwarding_header(
   // IMPORTANT: If Forwarded header exists, always update it for consistency
   // This ensures headers remain consistent even when forwarded_header upstream option is not specified
   if has_forwarded {
-    let host = headers
-      .get(header::HOST)
-      .and_then(|h| h.to_str().ok())
-      .unwrap_or("unknown");
-    
+    let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("unknown");
+
     match generate_forwarded_header(headers, tls, host) {
       Ok(forwarded_value) => {
         add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;

From 5c9bb200e02a48c008d02fb0d1589e619a1158ba Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 5 Jul 2025 00:26:15 +0900
Subject: [PATCH 64/69] feat: implement forwarded header handling

---
 config-example.toml                           |  4 +--
 .../handler_manipulate_messages.rs            | 16 ++--------
 rpxy-lib/src/message_handler/utils_headers.rs | 32 +++++++++++++------
 3 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/config-example.toml b/config-example.toml
index 8e08318..e1c71cd 100644
--- a/config-example.toml
+++ b/config-example.toml
@@ -83,8 +83,8 @@ load_balance = "random" # or "round_robin" or "sticky" (sticky session) or "none
 upstream_options = [
   "upgrade_insecure_requests",
   "force_http11_upstream",
-  "set_upstream_host",         # overwrite HOST value with upstream hostname (like www.yahoo.com)
-  "forwarded_header" # add Forwarded header
+  "set_upstream_host",        # overwrite HOST value with upstream hostname (like www.yahoo.com)
+  "forwarded_header"          # add Forwarded header (by default, this is not added. However, if the incoming request has Forwarded header, it would be preserved and updated)
 ]
 ######################################################################
 
diff --git a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
index 9f74fe8..08227f7 100644
--- a/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
+++ b/rpxy-lib/src/message_handler/handler_manipulate_messages.rs
@@ -81,7 +81,7 @@ where
         .unwrap_or(false)
     };
 
-    let original_uri = req.uri().to_string();
+    let original_uri = req.uri().clone();
     let headers = req.headers_mut();
     // delete headers specified in header.connection
     remove_connection_header(headers);
@@ -98,18 +98,6 @@ where
     // by default, add "host" header of original server_name if not exist
     if req.headers().get(header::HOST).is_none() {
       let org_host = req.uri().host().ok_or_else(|| anyhow!("Invalid request"))?.to_owned();
-      // Omit port 80 if !tls_enabled, omit port 443 if tls_enabled
-      let org_host = req
-        .uri()
-        .port_u16()
-        .map(|port| {
-          if (tls_enabled && port == 443) || (!tls_enabled && port == 80) {
-            org_host.clone()
-          } else {
-            format!("{}:{}", org_host, port)
-          }
-        })
-        .unwrap_or(org_host);
       req.headers_mut().insert(header::HOST, HeaderValue::from_str(&org_host)?);
     };
 
@@ -139,7 +127,7 @@ where
     // apply upstream-specific headers given in upstream_option
     let headers = req.headers_mut();
     // apply upstream options to header, after X-Forwarded-For is added
-    apply_upstream_options_to_header(headers, &upstream_chosen.uri, upstream_candidates)?;
+    apply_upstream_options_to_header(headers, &upstream_chosen.uri, upstream_candidates, &original_uri)?;
 
     // update uri in request
     ensure!(
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index 61a1d50..7f84494 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -102,6 +102,7 @@ pub(super) fn apply_upstream_options_to_header(
   upstream_base_uri: &Uri,
   // _client_addr: &SocketAddr,
   upstream: &UpstreamCandidates,
+  original_uri: &Uri,
 ) -> Result<()> {
   for opt in upstream.options.iter() {
     match opt {
@@ -121,11 +122,9 @@ pub(super) fn apply_upstream_options_to_header(
       UpstreamOption::ForwardedHeader => {
         // This is called after X-Forwarded-For is added
         // Generate RFC 7239 Forwarded header
-        // TODO: host is generated from x-original-uri
-        let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("unknown");
         let tls = upstream_base_uri.scheme_str() == Some("https");
 
-        match generate_forwarded_header(headers, tls, host) {
+        match generate_forwarded_header(headers, tls, original_uri) {
           Ok(forwarded_value) => {
             add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;
           }
@@ -220,7 +219,7 @@ pub(super) fn add_forwarding_header(
   client_addr: &SocketAddr,
   listen_addr: &SocketAddr,
   tls: bool,
-  uri_str: &str,
+  original_uri: &Uri,
 ) -> Result<()> {
   let canonical_client_addr = client_addr.to_canonical().ip().to_string();
   let has_forwarded = headers.contains_key("forwarded");
@@ -241,9 +240,7 @@ pub(super) fn add_forwarding_header(
   // IMPORTANT: If Forwarded header exists, always update it for consistency
   // This ensures headers remain consistent even when forwarded_header upstream option is not specified
   if has_forwarded {
-    let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).unwrap_or("unknown");
-
-    match generate_forwarded_header(headers, tls, host) {
+    match generate_forwarded_header(headers, tls, original_uri) {
       Ok(forwarded_value) => {
         add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;
       }
@@ -272,7 +269,7 @@ pub(super) fn add_forwarding_header(
   // x-forwarded-ssl
   add_header_entry_overwrite_if_exist(headers, "x-forwarded-ssl", if tls { "on" } else { "off" })?;
   // x-original-uri
-  add_header_entry_overwrite_if_exist(headers, "x-original-uri", uri_str.to_string())?;
+  add_header_entry_overwrite_if_exist(headers, "x-original-uri", original_uri.to_string())?;
   // proxy
   add_header_entry_overwrite_if_exist(headers, "proxy", "")?;
 
@@ -325,7 +322,7 @@ fn update_xff_from_forwarded(headers: &mut HeaderMap, client_addr: &SocketAddr)
 
 /// Generate RFC 7239 Forwarded header from X-Forwarded-For
 /// This function assumes that the X-Forwarded-For header is present and well-formed.
-fn generate_forwarded_header(headers: &HeaderMap, tls: bool, host: &str) -> Result<String> {
+fn generate_forwarded_header(headers: &HeaderMap, tls: bool, original_uri: &Uri) -> Result<String> {
   let for_values = headers
     .get("x-forwarded-for")
     .and_then(|h| h.to_str().ok())
@@ -356,12 +353,27 @@ fn generate_forwarded_header(headers: &HeaderMap, tls: bool, host: &str) -> Resu
     "for={};proto={};host={}",
     for_values,
     if tls { "https" } else { "http" },
-    host
+    host_from_uri(original_uri)?
   );
 
   Ok(forwarded_value)
 }
 
+#[inline]
+/// Extract host from URI
+fn host_from_uri(uri: &Uri) -> Result<String> {
+  uri
+    .host()
+    .map(|host| {
+      if let Some(port) = uri.port_u16() {
+        format!("{}:{}", host, port)
+      } else {
+        host.to_string()
+      }
+    })
+    .ok_or_else(|| anyhow!("No host found in URI"))
+}
+
 /// Remove connection header
 pub(super) fn remove_connection_header(headers: &mut HeaderMap) {
   if let Some(values) = headers.get(header::CONNECTION) {

From 8e61098753e32c8a0f50edbd8733589f971d4d25 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 5 Jul 2025 00:34:41 +0900
Subject: [PATCH 65/69] update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d7a06b8..c26304c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Improvement
 
 - Feat: Support `Forwarded` header in addition to `X-Forwarded-For` header. This is to support the standard forwarding header for reverse proxy applications (RFC 7239). Use the `forwarded_header` upstream option to enable this feature.
+  By default, it is not appended to the outgoing header. However, if the incoming request has the forwarded header, it would be preserved and updated simultaneously with `x-forwarded-for` header. if both forwarded and x-forwarded-for headers exists (and they are inconsistent), x-forwarded-for is prioritized. This means that x-forwarded-for is first updated and it is then copied (overridden) to `for` param of forwarded header.
 
 ## 0.10.0
 

From 3eb1a9e11821358d5f679854eaa8edd7fbd66233 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 4 Jul 2025 22:18:20 +0000
Subject: [PATCH 66/69] chore(deps): bump tokio from 1.46.0 to 1.46.1

Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.46.0 to 1.46.1.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.46.0...tokio-1.46.1)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.46.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock            | 4 ++--
 rpxy-acme/Cargo.toml  | 2 +-
 rpxy-bin/Cargo.toml   | 2 +-
 rpxy-certs/Cargo.toml | 2 +-
 rpxy-lib/Cargo.toml   | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9d0e811..73075d2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2913,9 +2913,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.46.0"
+version = "1.46.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1140bb80481756a8cbe10541f37433b459c5aa1e727b4c020fbfebdc25bf3ec4"
+checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
 dependencies = [
  "backtrace",
  "bytes",
diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml
index 8e92ce5..5cca92e 100644
--- a/rpxy-acme/Cargo.toml
+++ b/rpxy-acme/Cargo.toml
@@ -33,7 +33,7 @@ rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, f
   "aws-lc-rs",
 ] }
 rustls-post-quantum = { version = "0.2.2", optional = true }
-tokio = { version = "1.46.0", default-features = false, features = [
+tokio = { version = "1.46.1", default-features = false, features = [
   "rt",
   "macros",
 ] }
diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml
index 861b73b..59a92bd 100644
--- a/rpxy-bin/Cargo.toml
+++ b/rpxy-bin/Cargo.toml
@@ -46,7 +46,7 @@ mimalloc = { version = "0.1.47", default-features = false }
 anyhow = "1.0.98"
 ahash = "0.8.12"
 serde = { version = "1.0.219", default-features = false, features = ["derive"] }
-tokio = { version = "1.46.0", default-features = false, features = [
+tokio = { version = "1.46.1", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",
diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml
index 111d56d..712c21c 100644
--- a/rpxy-certs/Cargo.toml
+++ b/rpxy-certs/Cargo.toml
@@ -35,7 +35,7 @@ rustls-post-quantum = { version = "0.2.2", optional = true }
 x509-parser = { version = "0.17.0" }
 
 [dev-dependencies]
-tokio = { version = "1.46.0", default-features = false, features = [
+tokio = { version = "1.46.1", default-features = false, features = [
   "rt-multi-thread",
   "macros",
 ] }
diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml
index bd31295..55109d8 100644
--- a/rpxy-lib/Cargo.toml
+++ b/rpxy-lib/Cargo.toml
@@ -41,7 +41,7 @@ ahash = "0.8.12"
 bytes = "1.10.1"
 derive_builder = "0.20.2"
 futures = { version = "0.3.31", features = ["alloc", "async-await"] }
-tokio = { version = "1.46.0", default-features = false, features = [
+tokio = { version = "1.46.1", default-features = false, features = [
   "net",
   "rt-multi-thread",
   "time",

From ba06d8d4ebfcc510f2af421ce9d489233059d4b3 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 5 Jul 2025 12:08:13 +0900
Subject: [PATCH 67/69] refactor

---
 rpxy-lib/src/message_handler/utils_headers.rs | 37 +++++++++++--------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index 7f84494..c4a0b75 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -12,6 +12,13 @@ use std::{borrow::Cow, net::SocketAddr};
 use crate::backend::{LoadBalanceContext, StickyCookie, StickyCookieValue};
 // use crate::backend::{UpstreamGroup, UpstreamOption};
 
+const X_FORWARDED_FOR: &str = "x-forwarded-for";
+const X_FORWARDED_PROTO: &str = "x-forwarded-proto";
+const X_FORWARDED_PORT: &str = "x-forwarded-port";
+const X_FORWARDED_SSL: &str = "x-forwarded-ssl";
+const X_ORIGINAL_URI: &str = "x-original-uri";
+const X_REAL_IP: &str = "x-real-ip";
+
 // ////////////////////////////////////////////////////
 // // Functions to manipulate headers
 #[cfg(feature = "sticky-cookie")]
@@ -126,7 +133,7 @@ pub(super) fn apply_upstream_options_to_header(
 
         match generate_forwarded_header(headers, tls, original_uri) {
           Ok(forwarded_value) => {
-            add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;
+            add_header_entry_overwrite_if_exist(headers, header::FORWARDED.as_str(), forwarded_value)?;
           }
           Err(e) => {
             // Log warning but don't fail the request if Forwarded generation fails
@@ -222,8 +229,8 @@ pub(super) fn add_forwarding_header(
   original_uri: &Uri,
 ) -> Result<()> {
   let canonical_client_addr = client_addr.to_canonical().ip().to_string();
-  let has_forwarded = headers.contains_key("forwarded");
-  let has_xff = headers.contains_key("x-forwarded-for");
+  let has_forwarded = headers.contains_key(header::FORWARDED);
+  let has_xff = headers.contains_key(X_FORWARDED_FOR);
 
   // Handle incoming Forwarded header (Case 2: only Forwarded exists)
   if has_forwarded && !has_xff {
@@ -234,7 +241,7 @@ pub(super) fn add_forwarding_header(
     // TODO: In future PR, implement proper RFC 7239 precedence
     // where Forwarded header should take priority over X-Forwarded-For
     // This requires careful testing to ensure no breaking changes
-    append_header_entry_with_comma(headers, "x-forwarded-for", &canonical_client_addr)?;
+    append_header_entry_with_comma(headers, X_FORWARDED_FOR, &canonical_client_addr)?;
   }
 
   // IMPORTANT: If Forwarded header exists, always update it for consistency
@@ -242,7 +249,7 @@ pub(super) fn add_forwarding_header(
   if has_forwarded {
     match generate_forwarded_header(headers, tls, original_uri) {
       Ok(forwarded_value) => {
-        add_header_entry_overwrite_if_exist(headers, "forwarded", forwarded_value)?;
+        add_header_entry_overwrite_if_exist(headers, header::FORWARDED.as_str(), forwarded_value)?;
       }
       Err(e) => {
         // Log warning but don't fail the request if Forwarded generation fails
@@ -258,18 +265,18 @@ pub(super) fn add_forwarding_header(
   /////////// As Nginx
   // If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
   // scheme used to connect to this server
-  add_header_entry_if_not_exist(headers, "x-forwarded-proto", if tls { "https" } else { "http" })?;
+  add_header_entry_if_not_exist(headers, X_FORWARDED_PROTO, if tls { "https" } else { "http" })?;
   // If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
   // server port the client connected to
-  add_header_entry_if_not_exist(headers, "x-forwarded-port", listen_addr.port().to_string())?;
+  add_header_entry_if_not_exist(headers, X_FORWARDED_PORT, listen_addr.port().to_string())?;
 
   /////////// As Nginx-Proxy
   // x-real-ip
-  add_header_entry_overwrite_if_exist(headers, "x-real-ip", canonical_client_addr)?;
+  add_header_entry_overwrite_if_exist(headers, X_REAL_IP, canonical_client_addr)?;
   // x-forwarded-ssl
-  add_header_entry_overwrite_if_exist(headers, "x-forwarded-ssl", if tls { "on" } else { "off" })?;
+  add_header_entry_overwrite_if_exist(headers, X_FORWARDED_SSL, if tls { "on" } else { "off" })?;
   // x-original-uri
-  add_header_entry_overwrite_if_exist(headers, "x-original-uri", original_uri.to_string())?;
+  add_header_entry_overwrite_if_exist(headers, X_ORIGINAL_URI, original_uri.to_string())?;
   // proxy
   add_header_entry_overwrite_if_exist(headers, "proxy", "")?;
 
@@ -279,7 +286,7 @@ pub(super) fn add_forwarding_header(
 /// Extract proxy chain from existing Forwarded header
 fn extract_forwarded_chain(headers: &HeaderMap) -> Vec<String> {
   headers
-    .get("forwarded")
+    .get(header::FORWARDED)
     .and_then(|h| h.to_str().ok())
     .map(|forwarded_str| {
       // Parse Forwarded header entries (comma-separated)
@@ -307,15 +314,15 @@ fn update_xff_from_forwarded(headers: &mut HeaderMap, client_addr: &SocketAddr)
 
   if !forwarded_chain.is_empty() {
     // Replace X-Forwarded-For with the chain from Forwarded header
-    headers.remove("x-forwarded-for");
+    headers.remove(X_FORWARDED_FOR);
     for ip in forwarded_chain {
-      append_header_entry_with_comma(headers, "x-forwarded-for", &ip)?;
+      append_header_entry_with_comma(headers, X_FORWARDED_FOR, &ip)?;
     }
   }
 
   // Append current client IP (standard behavior)
   let canonical_client_addr = client_addr.to_canonical().ip().to_string();
-  append_header_entry_with_comma(headers, "x-forwarded-for", &canonical_client_addr)?;
+  append_header_entry_with_comma(headers, X_FORWARDED_FOR, &canonical_client_addr)?;
 
   Ok(())
 }
@@ -324,7 +331,7 @@ fn update_xff_from_forwarded(headers: &mut HeaderMap, client_addr: &SocketAddr)
 /// This function assumes that the X-Forwarded-For header is present and well-formed.
 fn generate_forwarded_header(headers: &HeaderMap, tls: bool, original_uri: &Uri) -> Result<String> {
   let for_values = headers
-    .get("x-forwarded-for")
+    .get(X_FORWARDED_FOR)
     .and_then(|h| h.to_str().ok())
     .map(|xff_str| {
       xff_str

From 42464d1d49f0cf281721751766957ec63a59ecd0 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 5 Jul 2025 13:21:20 +0900
Subject: [PATCH 68/69] simplified http_log internal routine

---
 rpxy-lib/src/message_handler/http_log.rs      | 91 ++++++++++++++++---
 rpxy-lib/src/message_handler/utils_headers.rs | 31 ++++---
 2 files changed, 94 insertions(+), 28 deletions(-)

diff --git a/rpxy-lib/src/message_handler/http_log.rs b/rpxy-lib/src/message_handler/http_log.rs
index 40d13cc..5ae302e 100644
--- a/rpxy-lib/src/message_handler/http_log.rs
+++ b/rpxy-lib/src/message_handler/http_log.rs
@@ -1,5 +1,5 @@
 use super::canonical_address::ToCanonical;
-use crate::log::*;
+use crate::{log::*, message_handler::utils_headers};
 use http::header;
 use std::net::SocketAddr;
 
@@ -12,10 +12,11 @@ pub struct HttpMessageLog {
   pub host: String,
   pub p_and_q: String,
   pub version: http::Version,
-  pub uri_scheme: String,
-  pub uri_host: String,
+  pub scheme: String,
+  pub path: String,
   pub ua: String,
   pub xff: String,
+  pub forwarded: String,
   pub status: String,
   pub upstream: String,
 }
@@ -29,17 +30,21 @@ impl<T> From<&http::Request<T>> for HttpMessageLog {
         .map_or_else(|| "", |s| s.to_str().unwrap_or(""))
         .to_string()
     };
+    let host =
+      utils_headers::host_from_uri_or_host_header(req.uri(), req.headers().get(header::HOST).cloned()).unwrap_or_default();
+
     Self {
       // tls_server_name: "".to_string(),
       client_addr: "".to_string(),
       method: req.method().to_string(),
-      host: header_mapper(header::HOST),
+      host,
       p_and_q: req.uri().path_and_query().map_or_else(|| "", |v| v.as_str()).to_string(),
       version: req.version(),
-      uri_scheme: req.uri().scheme_str().unwrap_or("").to_string(),
-      uri_host: req.uri().host().unwrap_or("").to_string(),
+      scheme: req.uri().scheme_str().unwrap_or("").to_string(),
+      path: req.uri().path().to_string(),
       ua: header_mapper(header::USER_AGENT),
       xff: header_mapper(header::HeaderName::from_static("x-forwarded-for")),
+      forwarded: header_mapper(header::FORWARDED),
       status: "".to_string(),
       upstream: "".to_string(),
     }
@@ -48,26 +53,29 @@ impl<T> From<&http::Request<T>> for HttpMessageLog {
 
 impl std::fmt::Display for HttpMessageLog {
   fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    let forwarded_part = if !self.forwarded.is_empty() {
+      format!(" \"{}\"", self.forwarded)
+    } else {
+      "".to_string()
+    };
+
     write!(
       f,
-      "{} <- {} -- {} {} {:?} -- {} -- {} \"{}\", \"{}\" \"{}\"",
-      if !self.host.is_empty() {
-        self.host.as_str()
-      } else {
-        self.uri_host.as_str()
-      },
+      "{} <- {} -- {} {} {:?} -- {} -- {} \"{}\", \"{}\"{} \"{}\"",
+      self.host,
       self.client_addr,
       self.method,
       self.p_and_q,
       self.version,
       self.status,
-      if !self.uri_scheme.is_empty() && !self.uri_host.is_empty() {
-        format!("{}://{}", self.uri_scheme, self.uri_host)
+      if !self.scheme.is_empty() && !self.host.is_empty() {
+        format!("{}://{}{}", self.scheme, self.host, self.path)
       } else {
-        "".to_string()
+        self.path.clone()
       },
       self.ua,
       self.xff,
+      forwarded_part,
       self.upstream
     )
   }
@@ -102,3 +110,56 @@ impl HttpMessageLog {
     );
   }
 }
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use http::{Method, Version};
+
+  #[test]
+  fn test_log_format_without_forwarded() {
+    let log = HttpMessageLog {
+      client_addr: "192.168.1.1:8080".to_string(),
+      method: Method::GET.to_string(),
+      host: "example.com".to_string(),
+      p_and_q: "/path?query=value".to_string(),
+      version: Version::HTTP_11,
+      scheme: "https".to_string(),
+      path: "/path".to_string(),
+      ua: "Mozilla/5.0".to_string(),
+      xff: "10.0.0.1".to_string(),
+      forwarded: "".to_string(),
+      status: "200".to_string(),
+      upstream: "https://backend.example.com".to_string(),
+    };
+
+    let formatted = format!("{}", log);
+    assert!(!formatted.contains(" \"\""));
+    assert!(formatted.contains("\"Mozilla/5.0\", \"10.0.0.1\" \"https://backend.example.com\""));
+  }
+
+  #[test]
+  fn test_log_format_with_forwarded() {
+    let log = HttpMessageLog {
+      client_addr: "192.168.1.1:8080".to_string(),
+      method: Method::GET.to_string(),
+      host: "example.com".to_string(),
+      p_and_q: "/path?query=value".to_string(),
+      version: Version::HTTP_11,
+      scheme: "https".to_string(),
+      path: "/path".to_string(),
+      ua: "Mozilla/5.0".to_string(),
+      xff: "10.0.0.1".to_string(),
+      forwarded: "for=192.0.2.60;proto=http;by=203.0.113.43".to_string(),
+      status: "200".to_string(),
+      upstream: "https://backend.example.com".to_string(),
+    };
+
+    let formatted = format!("{}", log);
+    assert!(formatted.contains(" \"for=192.0.2.60;proto=http;by=203.0.113.43\""));
+    assert!(
+      formatted
+        .contains("\"Mozilla/5.0\", \"10.0.0.1\" \"for=192.0.2.60;proto=http;by=203.0.113.43\" \"https://backend.example.com\"")
+    );
+  }
+}
diff --git a/rpxy-lib/src/message_handler/utils_headers.rs b/rpxy-lib/src/message_handler/utils_headers.rs
index c4a0b75..ddc68ba 100644
--- a/rpxy-lib/src/message_handler/utils_headers.rs
+++ b/rpxy-lib/src/message_handler/utils_headers.rs
@@ -360,25 +360,30 @@ fn generate_forwarded_header(headers: &HeaderMap, tls: bool, original_uri: &Uri)
     "for={};proto={};host={}",
     for_values,
     if tls { "https" } else { "http" },
-    host_from_uri(original_uri)?
+    host_from_uri_or_host_header(original_uri, headers.get(header::HOST).cloned())?
   );
 
   Ok(forwarded_value)
 }
 
-#[inline]
 /// Extract host from URI
-fn host_from_uri(uri: &Uri) -> Result<String> {
-  uri
-    .host()
-    .map(|host| {
-      if let Some(port) = uri.port_u16() {
-        format!("{}:{}", host, port)
-      } else {
-        host.to_string()
-      }
-    })
-    .ok_or_else(|| anyhow!("No host found in URI"))
+pub(super) fn host_from_uri_or_host_header(uri: &Uri, host_header_value: Option<header::HeaderValue>) -> Result<String> {
+  // Prioritize uri host over host header
+  let uri_host = uri.host().map(|host| {
+    if let Some(port) = uri.port_u16() {
+      format!("{}:{}", host, port)
+    } else {
+      host.to_string()
+    }
+  });
+  if let Some(host) = uri_host {
+    return Ok(host);
+  }
+  // If uri host is not available, use host header
+  host_header_value
+    .map(|h| h.to_str().map(|s| s.to_string()))
+    .transpose()?
+    .ok_or_else(|| anyhow!("No host found in URI or Host header"))
 }
 
 /// Remove connection header

From e04f8b36f864a36f7575e009c83c517a31091409 Mon Sep 17 00:00:00 2001
From: Jun Kurihara <junkurihara@users.noreply.github.com>
Date: Sat, 5 Jul 2025 13:31:35 +0900
Subject: [PATCH 69/69] update changelog for 0.10.1

---
 CHANGELOG.md | 6 +++++-
 Cargo.lock   | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c26304c..9909283 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,15 @@
 # CHANGELOG
 
-## 0.10.1 or 0.11.0 (Unreleased)
+## 0.10.2 or 0.11.0 (Unreleased)
+
+## 0.10.1
 
 ### Improvement
 
 - Feat: Support `Forwarded` header in addition to `X-Forwarded-For` header. This is to support the standard forwarding header for reverse proxy applications (RFC 7239). Use the `forwarded_header` upstream option to enable this feature.
   By default, it is not appended to the outgoing header. However, if the incoming request has the forwarded header, it would be preserved and updated simultaneously with `x-forwarded-for` header. if both forwarded and x-forwarded-for headers exists (and they are inconsistent), x-forwarded-for is prioritized. This means that x-forwarded-for is first updated and it is then copied (overridden) to `for` param of forwarded header.
+- Refactor: lots of minor improvements
+- Deps
 
 ## 0.10.0
 
diff --git a/Cargo.lock b/Cargo.lock
index 73075d2..3a12577 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -412,9 +412,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.27"
+version = "1.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
+checksum = "4ad45f4f74e4e20eaa392913b7b33a7091c87e59628f4dd27888205ad888843c"
 dependencies = [
  "jobserver",
  "libc",