Merge pull request #909 from iBug/pkg

chore: Create /etc/gost directory with package manager
chore(gost): bump github.com/go-gost/x to v0.19.5
2026-10-08 20:15:46 +00:00 · 2026-10-07 02:31:08 +00:00 · 2026-10-03 23:38:53 +08:00 · 2026-10-03 16:27:05 +08:00 · 2026-09-24 10:32:53 +08:00 · 2026-09-22 22:06:55 +08:00
19 changed files with 913 additions and 131 deletions
@@ -32,7 +32,7 @@ _testmain.go
 *.bak

 cmd/gost/gost
-gost
+/gost
 snap

 *.pem
@@ -1,3 +1,5 @@
+version: 2
+
 # This is an example .goreleaser.yml file with some sensible defaults.
 # Make sure to check the documentation at https://goreleaser.com
 before:
@@ -7,7 +9,8 @@ before:
    # you may remove this if you don't need go generate
    # - go generate ./...
 builds:
-  - env:
+  - id: gost
+    env:
      - CGO_ENABLED=0
    main: ./cmd/gost
    targets:
@@ -38,6 +41,16 @@ builds:
      - android_arm64
    ldflags:
      - "-s -w -X 'main.version={{ .Tag }}'"
+  - id: gost-packages
+    env:
+      - CGO_ENABLED=0
+    main: ./cmd/gost
+    targets:
+      - linux_amd64
+      - linux_amd64_v3
+      - linux_arm64
+    ldflags:
+      - "-s -w -X 'main.version={{ .Tag }}'"

 upx:
  - # UPX compression. Disabled by default (see #863): upx --best/--lzma/--brute
@@ -46,18 +59,53 @@ upx:
    enabled: false

 archives:
-  - format: tar.gz
+  - ids:
+      - gost
+    formats:
+      - tar.gz
    builds_info:
      group: root
      owner: root
    # use zip for windows archives
    format_overrides:
    - goos: windows
-      format: zip
+      formats:
+        - zip
+
+nfpms:
+  - id: packages
+    package_name: gost
+    ids:
+      - gost-packages
+    vendor: go-gost
+    homepage: https://gost.run/
+    maintainer: go-gost contributors
+    description: GO Simple Tunnel
+    license: MIT
+    formats:
+      - deb
+      - rpm
+    bindir: /usr/bin
+    contents:
+      - src: gost.service
+        dst: /usr/lib/systemd/system/gost.service
+      - src: README.md
+        dst: /usr/share/doc/gost/README.md
+      - src: README_en.md
+        dst: /usr/share/doc/gost/README_en.md
+      - src: LICENSE
+        dst: /usr/share/doc/gost/LICENSE
+      - src: gost.yml
+        dst: /usr/share/doc/gost/examples/gost.yml
+      - dst: /etc/gost
+        type: dir
+        file_info:
+          mode: 0755
+
 checksum:
  name_template: 'checksums.txt'
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  version_template: "{{ incpatch .Version }}-next"
 changelog:
  sort: asc
  filters:
@@ -54,6 +54,22 @@ GOST作为隧道有三种主要使用方式。

 [https://github.com/go-gost/gost/releases](https://github.com/go-gost/gost/releases)

+### 系统包（DEB/RPM）
+
+从 [Releases](https://github.com/go-gost/gost/releases) 下载对应架构的安装包（`amd64`、`amd64v3`、`arm64`）：
+
+```bash
+# Debian/Ubuntu
+sudo apt install ./gost_<version>_linux_amd64.deb
+
+# RHEL/Fedora
+sudo dnf install ./gost_<version>_linux_amd64.rpm
+```
+
+`amd64v3` 包需要支持 AVX2 的 CPU（x86-64-v3），否则请使用 `amd64`。
+
+安装包附带 systemd 服务，但不会自动启用：先创建 `/etc/gost/gost.yml`（示例见 `/usr/share/doc/gost/examples/gost.yml`），再执行 `sudo systemctl enable --now gost`。未提供配置文件时该服务会被跳过，而不是报错。
+
 ### 安装脚本

 ```bash
@@ -54,6 +54,22 @@ Use tunnel and intranet penetration to expose local services behind NAT or firew

 [https://github.com/go-gost/gost/releases](https://github.com/go-gost/gost/releases)

+### Packages (DEB/RPM)
+
+Download the package for your architecture from the [releases page](https://github.com/go-gost/gost/releases) (`amd64`, `amd64v3`, `arm64`):
+
+```bash
+# Debian/Ubuntu
+sudo apt install ./gost_<version>_linux_amd64.deb
+
+# RHEL/Fedora
+sudo dnf install ./gost_<version>_linux_amd64.rpm
+```
+
+The `amd64v3` package requires an AVX2-capable CPU (x86-64-v3); use `amd64` otherwise.
+
+The packages ship a systemd service, but it is not enabled automatically: create `/etc/gost/gost.yml` first (see `/usr/share/doc/gost/examples/gost.yml`), then run `sudo systemctl enable --now gost`. Without a config file the service is skipped rather than failing.
+
 ### install script

 ```bash
@@ -21,6 +21,7 @@ import (
 	"github.com/go-gost/x/config/parsing/parser"
 	xmetrics "github.com/go-gost/x/metrics"
 	metrics "github.com/go-gost/x/metrics/service"
+	xplugin "github.com/go-gost/x/plugin"
 	"github.com/go-gost/x/registry"
 	"github.com/judwhite/go-svc"
 )
@@ -191,6 +192,8 @@ func (p *program) Stop() error {
 		logger.Default().Debug("service @profiling shutdown")
 	}

+	xplugin.Shutdown()
+
 	return nil
 }

@@ -1,5 +1,5 @@
 package main

 var (
-	version = "3.3.0"
+	version = "3.3.1"
 )
@@ -4,7 +4,7 @@ go 1.26.3

 require (
 	github.com/go-gost/core v0.6.1
-	github.com/go-gost/x v0.16.0
+	github.com/go-gost/x v0.19.5
 	github.com/judwhite/go-svc v1.2.1
 	github.com/moby/moby/client v0.4.0
 	github.com/stretchr/testify v1.11.1
@@ -17,8 +17,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
-	github.com/andybalholm/brotli v1.0.6 // indirect
-	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
+	github.com/andybalholm/brotli v1.2.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bytedance/gopkg v0.1.3 // indirect
 	github.com/bytedance/sonic v1.15.0 // indirect
@@ -49,7 +48,7 @@ require (
 	github.com/go-gost/go-shadowsocks2 v0.1.4 // indirect
 	github.com/go-gost/gosocks4 v0.1.0 // indirect
 	github.com/go-gost/gosocks5 v0.5.0 // indirect
-	github.com/go-gost/plugin v0.5.0 // indirect
+	github.com/go-gost/plugin v0.8.1 // indirect
 	github.com/go-gost/quic-dissector v0.1.0 // indirect
 	github.com/go-gost/relay v0.7.0 // indirect
 	github.com/go-gost/tls-dissector v0.3.1 // indirect
@@ -70,35 +69,34 @@ require (
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
-	github.com/gravitational/trace v1.1.16-0.20220114165159-14a9a7dd6aaf // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.19.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/klauspost/reedsolomon v1.11.8 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
+	github.com/klauspost/reedsolomon v1.12.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/miekg/dns v1.1.61 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/go-archive v0.3.0 // indirect
 	github.com/moby/moby/api v1.54.1 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
-	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/sequential v0.7.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.2 // indirect
 	github.com/pion/dtls/v3 v3.1.4 // indirect
 	github.com/pion/logging v0.2.4 // indirect
 	github.com/pion/transport/v4 v4.0.1 // indirect
@@ -106,10 +104,10 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/prometheus/client_golang v1.19.1 // indirect
-	github.com/prometheus/client_model v0.6.0 // indirect
-	github.com/prometheus/common v0.48.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/prometheus/client_golang v1.21.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.60.0 // indirect
 	github.com/quic-go/webtransport-go v0.11.1 // indirect
@@ -118,10 +116,9 @@ require (
 	github.com/rs/xid v1.3.0 // indirect
 	github.com/sagikazarmark/locafero v0.4.0 // indirect
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
-	github.com/shadowsocks/go-shadowsocks2 v0.1.6-0.20241020092332-e1fe9ea73740 // indirect
 	github.com/shirou/gopsutil/v3 v3.24.5 // indirect
 	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
-	github.com/shoenig/go-m1cpu v0.1.6 // indirect
+	github.com/shoenig/go-m1cpu v0.2.1 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
@@ -130,8 +127,6 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.19.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/templexxx/cpu v0.1.1 // indirect
-	github.com/templexxx/xorsimd v0.4.3 // indirect
 	github.com/tidwall/gjson v1.19.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
@@ -143,37 +138,35 @@ require (
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	github.com/vulcand/predicate v1.2.0 // indirect
 	github.com/xjasonlyu/tun2socks/v2 v2.6.0 // indirect
-	github.com/xtaci/kcp-go/v5 v5.6.5 // indirect
-	github.com/xtaci/smux v1.5.31 // indirect
+	github.com/xtaci/kcp-go/v5 v5.6.72 // indirect
+	github.com/xtaci/smux v1.5.57 // indirect
 	github.com/xtaci/tcpraw v1.2.25 // indirect
 	github.com/yl2chen/cidranger v1.0.2 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zalando/go-keyring v0.2.4 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.7.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/arch v0.22.0 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/exp v0.0.0-20241210194714-1829a127f884 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260723215102-3fe39f3c1018 // indirect
-	google.golang.org/grpc v1.82.1 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
@@ -12,10 +12,8 @@ github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAu
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
-github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
-github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
-github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
-github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtnceM=
+github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
@@ -66,7 +64,6 @@ github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnD
 github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
 github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -91,16 +88,16 @@ github.com/go-gost/gosocks4 v0.1.0 h1:eAzev6qw4fzkFQKC9uCHLVNnnPdHyqCggbnfNN80Pm
 github.com/go-gost/gosocks4 v0.1.0/go.mod h1:hzVjwijJuZR1pp3GqpTj+AKcSGrx68RlWTrQMFMYBP0=
 github.com/go-gost/gosocks5 v0.5.0 h1:YE37l1MJwde8diIQdynStqogMotG5enoTdborhA5yic=
 github.com/go-gost/gosocks5 v0.5.0/go.mod h1:1G6I7HP7VFVxveGkoK8mnprnJqSqJjdcASKsdUn4Pp4=
-github.com/go-gost/plugin v0.5.0 h1:zK3Ezcv+z6bz6aUhaFZcZiJc42w44ohybzrj5tnWzcM=
-github.com/go-gost/plugin v0.5.0/go.mod h1:oN23l+yGDCIP9G3KnDl/I/0zVGOobZUDCB2Z5yYYXts=
+github.com/go-gost/plugin v0.8.1 h1:mZpLbzRZosHocaiZ4dYYqX8waLiavy/rsEWwqx5aluo=
+github.com/go-gost/plugin v0.8.1/go.mod h1:48pqi8/zS5OhEEoFETYZCqu2sR59DX3QxG5SjGmPWcU=
 github.com/go-gost/quic-dissector v0.1.0 h1:zOaw2XjKxMf6vVC1z4BHDKGHbCs4zrYU1Rxaz5d0TQU=
 github.com/go-gost/quic-dissector v0.1.0/go.mod h1:ar+I40Izq9ZT2k/aNnLFGEMvdeSOBLLKxhF/i3FSnQQ=
 github.com/go-gost/relay v0.7.0 h1:J8e3Sba6DtBJQotXY5j5EaZNWwtv6Z9CoCFQsnrHNcE=
 github.com/go-gost/relay v0.7.0/go.mod h1:Dku0f5sfjOClrZFiDmQUrYYJ4uof7rnkCUBfsl0PSAI=
 github.com/go-gost/tls-dissector v0.3.1 h1:gvOteWog5pjY/HCpc8l+gngmSi8Q6zl5rRrfK8gwRKA=
 github.com/go-gost/tls-dissector v0.3.1/go.mod h1:vGfog053fIm93iXBtvmVzMQqEJo5YwbbNaPNVDjbiOc=
-github.com/go-gost/x v0.16.0 h1:u7m/B1e9YOQPOrUJUZ9U81b4dUg1ROcM0qUiwSE3Esg=
-github.com/go-gost/x v0.16.0/go.mod h1:vijIgcAGgzfKhvPaV4NlPaoKX/C1C/8a3Zp1Yjjrok4=
+github.com/go-gost/x v0.19.5 h1:brbvQ6Pkq2pMr7k+IQvKB8dDdkt1D2IhURaVZZ5sicw=
+github.com/go-gost/x v0.19.5/go.mod h1:YknNANia9Jzp5/TgPzGN6tcVir0WbapexBOird+4s0U=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -159,36 +156,34 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gravitational/trace v1.1.16-0.20220114165159-14a9a7dd6aaf h1:C1GPyPJrOlJlIrcaBBiBpDsqZena2Ks8spa5xZqr1XQ=
-github.com/gravitational/trace v1.1.16-0.20220114165159-14a9a7dd6aaf/go.mod h1:zXqxTI6jXDdKnlf8s+nT+3c8LrwUEy3yNpO4XJL90lA=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
-github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/judwhite/go-svc v1.2.1 h1:a7fsJzYUa33sfDJRF2N/WXhA+LonCEEY8BJb1tuS5tA=
 github.com/judwhite/go-svc v1.2.1/go.mod h1:mo/P2JNX8C07ywpP9YtO2gnBgnUiFTHqtsZekJrUuTk=
 github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
 github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/klauspost/reedsolomon v1.11.8 h1:s8RpUW5TK4hjr+djiOpbZJB4ksx+TdYbRH7vHQpwPOY=
-github.com/klauspost/reedsolomon v1.11.8/go.mod h1:4bXRN+cVzMdml6ti7qLouuYi32KHJ5MGv0Qd8a47h6A=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/reedsolomon v1.12.0 h1:I5FEp3xSwVCcEh3F5A7dofEfhXdF/bWhQWPH+XwBFno=
+github.com/klauspost/reedsolomon v1.12.0/go.mod h1:EPLZJeh4l27pUGC3aXOjheaoh1I9yut7xTURiW3LQ9Y=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/miekg/dns v1.1.61 h1:nLxbwF3XxhwVSm8g9Dghm9MHPaUZuqhPiGL+675ZmEs=
 github.com/miekg/dns v1.1.61/go.mod h1:mnAarhS3nWaW+NVP2wTkYVIZyHNJ098SJZUki3eykwQ=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -197,18 +192,18 @@ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyua
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
-github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/go-archive v0.3.0 h1:nos4BtzzUIqB406BgQnWGMI4qib9BZ8XUHU+ucv/n1c=
+github.com/moby/go-archive v0.3.0/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
 github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4=
 github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
 github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
 github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
-github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8=
+github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -218,6 +213,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
@@ -230,8 +227,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.2 h1:M2fKKbmyvI+hGId/D0W64qDBMVhJnNR10O5gIbMc//Q=
+github.com/pelletier/go-toml/v2 v2.4.2/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pion/dtls/v3 v3.1.4 h1:QhvtMflMfu9Kf0RcDC5BJBle4caPskByrKQR6uuYqpY=
 github.com/pion/dtls/v3 v3.1.4/go.mod h1:cr/qotLISUw/9C1m83ZPNZtj9WnXkYLpfCptPqbkInc=
 github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
@@ -247,15 +244,15 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
-github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
+github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
+github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
-github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
-github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
-github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -276,17 +273,14 @@ github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6ke
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
 github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
 github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
-github.com/shadowsocks/go-shadowsocks2 v0.1.6-0.20241020092332-e1fe9ea73740 h1:XdDrN8rtxdgW3TLn7pAuobI9PhPMbf6Geu9nvFzXn2E=
-github.com/shadowsocks/go-shadowsocks2 v0.1.6-0.20241020092332-e1fe9ea73740/go.mod h1:Oqfn/ykzqjeX00+7IuPyR7wGYgOzld0Tni6djgElacI=
 github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
 github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
 github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
 github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
-github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
-github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
-github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
-github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
-github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/shoenig/go-m1cpu v0.2.1 h1:yqRB4fvOge2+FyRXFkXqsyMoqPazv14Yyy+iyccT2E4=
+github.com/shoenig/go-m1cpu v0.2.1/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
+github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
+github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
@@ -307,11 +301,8 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -320,10 +311,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/templexxx/cpu v0.1.1 h1:isxHaxBXpYFWnk2DReuKkigaZyrjs2+9ypIdGP4h+HI=
-github.com/templexxx/cpu v0.1.1/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
-github.com/templexxx/xorsimd v0.4.3 h1:9AQTFHd7Bhk3dIT7Al2XeBX5DWOvsUPZCuhyAtNbHjU=
-github.com/templexxx/xorsimd v0.4.3/go.mod h1:oZQcD6RFDisW2Am58dSAGwwL6rHjbzrlu25VDqfWkQg=
 github.com/testcontainers/testcontainers-go v0.42.0 h1:He3IhTzTZOygSXLJPMX7n44XtK+qhjat1nI9cneBbUY=
 github.com/testcontainers/testcontainers-go v0.42.0/go.mod h1:vZjdY1YmUA1qEForxOIOazfsrdyORJAbhi0bp8plN30=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
@@ -350,18 +337,18 @@ github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54/go.mod h1:tw
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/vulcand/predicate v1.2.0 h1:uFsW1gcnnR7R+QTID+FVcs0sSYlIGntoGOTb3rQJt50=
-github.com/vulcand/predicate v1.2.0/go.mod h1:VipoNYXny6c8N381zGUWkjuuNHiRbeAZhE7Qm9c+2GA=
 github.com/xjasonlyu/tun2socks/v2 v2.6.0 h1:gI9saJT3XgH4e6v9jBuHRLwK7l3aN9YFWec/SsDTDx4=
 github.com/xjasonlyu/tun2socks/v2 v2.6.0/go.mod h1:35AwqxIxnMkfBfT0UJ1Lku7PZm2ZiZJ8sxHyp0gt1yw=
-github.com/xtaci/kcp-go/v5 v5.6.5 h1:oxGZNobj3OddrLzwdJYnR/waNgwrL98u02u0DWNHE3k=
-github.com/xtaci/kcp-go/v5 v5.6.5/go.mod h1:Qy3Zf2tWTdFdEs0E8JvhrX+39r5UDZoYac8anvud7/Q=
+github.com/xtaci/kcp-go/v5 v5.6.72 h1:FLaQPalgpufJYQRk0OK+gErEhXGLUPjv6FSRPrFR8Lk=
+github.com/xtaci/kcp-go/v5 v5.6.72/go.mod h1:9O3D8WR+cyyUjGiTILYfg17vn72otWuXK2AFfqIe6CM=
 github.com/xtaci/lossyconn v0.0.0-20190602105132-8df528c0c9ae h1:J0GxkO96kL4WF+AIT3M4mfUVinOCPgf2uUWYFUzN0sM=
 github.com/xtaci/lossyconn v0.0.0-20190602105132-8df528c0c9ae/go.mod h1:gXtu8J62kEgmN++bm9BVICuT/e8yiLI2KFobd/TRFsE=
-github.com/xtaci/smux v1.5.31 h1:3ha7sHtH46h85Iv7MfQogxasuRt1KPRhoFB3S4rmHgU=
-github.com/xtaci/smux v1.5.31/go.mod h1:OMlQbT5vcgl2gb49mFkYo6SMf+zP3rcjcwQz7ZU7IGY=
+github.com/xtaci/smux v1.5.57 h1:N72VbGoSYxgcm6mPOYX0QzEZNVD3UI/JlVvAtXF+WrY=
+github.com/xtaci/smux v1.5.57/go.mod h1:IGQ9QYrBphmb/4aTnLEcJby0TNr3NV+OslIOMrX825Q=
 github.com/xtaci/tcpraw v1.2.25 h1:VDlqo0op17JeXBM6e2G9ocCNLOJcw9mZbobMbJjo0vk=
 github.com/xtaci/tcpraw v1.2.25/go.mod h1:dKyZ2V75s0cZ7cbgJYdxPvms7af0joIeOyx1GgJQbLk=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yl2chen/cidranger v1.0.2 h1:lbOWZVCG1tCRX4u24kuM1Tb4nHqWkDxwLdoS+SevawU=
 github.com/yl2chen/cidranger v1.0.2/go.mod h1:9U1yz7WPYDwf0vpNWFaeRh0bjwz5RVgRy/9UEQfHl0g=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
@@ -374,22 +361,22 @@ github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
 github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
-go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+go.mongodb.org/mongo-driver/v2 v2.7.0 h1:RO+zqavD2/GCL3cxOMyZhx6R9Irzr8/6gsoqx5tcY/c=
+go.mongodb.org/mongo-driver/v2 v2.7.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -400,9 +387,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20241210194714-1829a127f884 h1:Y/Mj/94zIQQGHVSv1tTtQBDaQaJe62U9bkDZKKyhPCU=
 golang.org/x/exp v0.0.0-20241210194714-1829a127f884/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
@@ -411,8 +397,8 @@ golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvx
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -420,9 +406,8 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -433,32 +418,30 @@ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
@@ -476,10 +459,9 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260723215102-3fe39f3c1018/go.
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -0,0 +1,46 @@
+[Unit]
+Description=GO Simple Tunnel
+Documentation=https://gost.run/
+After=network-online.target nss-lookup.target
+ConditionPathExists=/etc/gost/gost.yml
+
+[Service]
+Type=simple
+WorkingDirectory=/run/gost
+ExecStart=/usr/bin/gost -C /etc/gost/gost.yml
+ExecReload=/bin/kill -SIGHUP $MAINPID
+
+DynamicUser=yes
+ConfigurationDirectory=gost
+RuntimeDirectory=gost
+LogsDirectory=gost
+TimeoutStopSec=5s
+Restart=on-failure
+RestartSec=1s
+
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+
+PrivateTmp=yes
+PrivateDevices=no
+ProtectSystem=full
+ProtectHostname=yes
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+
+SystemCallFilter=~@privileged @mount @debug @cpu-emulation @obsolete
+SystemCallFilter=@chown
+SystemCallErrorNumber=EPERM
+SystemCallArchitectures=native
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,135 @@
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/suite"
+	"github.com/testcontainers/testcontainers-go"
+)
+
+// QUICSuite covers the QUIC listener/dialer pair (listener type: quic, dialer
+// type: quic) with the cipherKey obfuscation enabled. It uses the canonical
+// GOST chaining pattern: a client container exposes a plain HTTP proxy that
+// tunnels through a quic chain to a quic server (HTTP over QUIC).
+type QUICSuite struct {
+	suite.Suite
+	ctx    context.Context
+	echoC  testcontainers.Container
+	echoIP string
+}
+
+func (s *QUICSuite) SetupSuite() {
+	s.ctx = context.Background()
+
+	s.T().Logf("start tcp echo container...")
+	echoC, err := RunEchoContainer(s.ctx, SharedNetworkName)
+	s.Require().NoError(err)
+	s.echoC = echoC
+
+	echoIP, err := echoC.ContainerIP(s.ctx)
+	s.Require().NoError(err)
+	s.echoIP = echoIP
+}
+
+func (s *QUICSuite) TearDownSuite() {
+	if s.echoC != nil {
+		s.echoC.Terminate(s.ctx)
+	}
+}
+
+// startChain brings up a quic server (alias "quic-server", cipherKey enabled,
+// http handler) and a client container that chains to it through a quic
+// dialer. The client exposes port 8080 for curl.
+func (s *QUICSuite) startChain() (testcontainers.Container, testcontainers.Container) {
+	s.T().Helper()
+
+	serverC, err := RunGostContainerWithOptions(s.ctx, SharedNetworkName,
+		"testdata/quic/server.yaml", []string{"quic-server"}, []string{"18843/udp"})
+	s.Require().NoError(err)
+
+	rendered, err := RenderConfig("testdata/quic/client.yaml", ConfigData{ServerAddr: "quic-server:18843"})
+	s.Require().NoError(err)
+	s.T().Cleanup(func() { os.Remove(rendered) })
+
+	clientC, err := RunGostContainerWithPorts(s.ctx, SharedNetworkName, rendered, "8080/tcp")
+	s.Require().NoError(err)
+
+	return serverC, clientC
+}
+
+// curlEcho runs curl through the client's local http proxy and returns the
+// exit code plus the captured body.
+func (s *QUICSuite) curlEcho(clientC testcontainers.Container) (int, string) {
+	s.T().Helper()
+	cmd := []string{"curl", "-s", "--max-time", "20", "-x", "http://127.0.0.1:8080",
+		fmt.Sprintf("http://%s:5678/", s.echoIP)}
+	code, out, _ := clientC.Exec(s.ctx, cmd)
+	body, _ := io.ReadAll(out)
+	return code, string(body)
+}
+
+// sendInvalidDatagram sends a single malformed (non-encrypted) UDP datagram to
+// the quic server's listener, reproducing the issue's repro packet.
+func (s *QUICSuite) sendInvalidDatagram(clientC testcontainers.Container) {
+	s.T().Helper()
+	cmd := []string{"python3", "-c",
+		"import socket; s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.sendto(b\"x\", (\"quic-server\", 18843))"}
+	code, out, err := clientC.Exec(s.ctx, cmd)
+	s.Require().NoError(err)
+	if code != 0 {
+		b, _ := io.ReadAll(out)
+		s.T().Fatalf("send invalid datagram failed (%d): %s", code, string(b))
+	}
+}
+
+// TestQUICForwardCipherKeySurvivesInvalidDatagram verifies that a malformed
+// UDP datagram does not close the shared QUIC transport (go-gost/x#125).
+//
+// With the bug, cipherConn.ReadFrom returned the decrypt error straight to
+// quic-go, which treats any packet-socket error as fatal and closes the shared
+// transport: a single invalid datagram kills the listener and correct clients
+// subsequently time out. With the fix the invalid datagram is discarded and
+// the listener keeps serving.
+//
+// Sequence: baseline forward works -> malformed datagram -> forward still works.
+func (s *QUICSuite) TestQUICForwardCipherKeySurvivesInvalidDatagram() {
+	serverC, clientC := s.startChain()
+	defer serverC.Terminate(s.ctx)
+	defer clientC.Terminate(s.ctx)
+
+	// Baseline: a valid QUIC forward must work before we poke the listener.
+	code, body := s.curlEcho(clientC)
+	if code != 0 || !strings.Contains(body, "hello-gost") {
+		s.dump("quic-baseline logs", clientC, serverC)
+	}
+	s.Require().Equal(0, code, "baseline QUIC forward should work")
+	s.Require().Contains(body, "hello-gost")
+
+	// Send one malformed UDP datagram to the quic listener's cipher socket.
+	s.sendInvalidDatagram(clientC)
+
+	// The listener must still be alive: a fresh QUIC forward must succeed.
+	code, body = s.curlEcho(clientC)
+	if code != 0 || !strings.Contains(body, "hello-gost") {
+		s.dump("quic-after-invalid logs", clientC, serverC)
+	}
+	s.Require().Equal(0, code,
+		"QUIC forward should still work after an invalid datagram (issue #125)")
+	s.Require().Contains(body, "hello-gost",
+		"listener must not close on an invalid datagram (issue #125)")
+}
+
+func (s *QUICSuite) dump(label string, cs ...testcontainers.Container) {
+	for _, c := range cs {
+		DumpLogs(s.T(), s.ctx, fmt.Sprintf("%s: %s", label, c.GetContainerID()), c)
+	}
+}
+
+func TestQUICSuite(t *testing.T) {
+	suite.Run(t, new(QUICSuite))
+}
@@ -0,0 +1,139 @@
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/suite"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+// RedSniffingWhitelistSuite reproduces go-gost/gost#899: whitelist bypass +
+// sniffing on a transparent (red) proxy.
+//
+// Inside a single privileged container, iptables redirects all outbound TCP to
+// the gost red service, so the handler sees the original destination IP via
+// SO_ORIGINAL_DST. The whitelist contains only a domain (the docker network
+// alias "https-echo"); a bare destination IP is never in it. On a broken build
+// (go-gost/x@fe394a8, x >= v0.13.12) the pre-sniffing bypass check on the
+// destination IP rejects every connection before SNI sniffing runs, making the
+// domain whitelist dead. The fix skips that check in whitelist mode and lets
+// the sniffer match the SNI host. This suite also asserts the security
+// property the skip must not weaken: a non-whitelisted SNI is still rejected.
+type RedSniffingWhitelistSuite struct {
+	suite.Suite
+	ctx        context.Context
+	httpsEchoC testcontainers.Container
+	gostC      testcontainers.Container
+}
+
+// redirectRules are installed in the gost container before gost starts:
+// loopback traffic (incl. Docker's embedded DNS) and gost's own marked sockets
+// are exempt; every other TCP packet is redirected to the red service.
+const redirectRules = `
+iptables -t nat -A OUTPUT -m addrtype --dst-type LOCAL -j RETURN
+iptables -t nat -A OUTPUT -m mark --mark 114514 -j RETURN
+iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 12345
+`
+
+func (s *RedSniffingWhitelistSuite) SetupSuite() {
+	s.ctx = context.Background()
+
+	echoC, err := RunHTTPSEchoContainer(s.ctx, SharedNetworkName)
+	s.Require().NoError(err)
+	s.httpsEchoC = echoC
+
+	req := testcontainers.ContainerRequest{
+		FromDockerfile: testcontainers.FromDockerfile{
+			Context:    ".",
+			Dockerfile: "Dockerfile",
+			Repo:       "gost-e2e",
+			Tag:        "latest",
+			KeepImage:  true,
+			BuildOptionsModifier: func(opts *client.ImageBuildOptions) {
+				opts.NetworkMode = "host"
+			},
+		},
+		Networks: []string{SharedNetworkName},
+		CapAdd:   []string{"NET_ADMIN"},
+		Files: []testcontainers.ContainerFile{
+			{HostFilePath: GostBinPath, ContainerFilePath: "/bin/gost", FileMode: 0755},
+			{HostFilePath: "testdata/red_sniffing/whitelist.yaml", ContainerFilePath: "/config.yaml", FileMode: 0644},
+		},
+		Cmd:        []string{"sh", "-c", redirectRules + "\nexec /bin/gost -C /config.yaml"},
+		WaitingFor: wait.ForLog("listening on"),
+	}
+
+	gostC, err := testcontainers.GenericContainer(s.ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	s.Require().NoError(err)
+	s.gostC = gostC
+}
+
+func (s *RedSniffingWhitelistSuite) TearDownSuite() {
+	if s.gostC != nil {
+		s.gostC.Terminate(s.ctx)
+	}
+	if s.httpsEchoC != nil {
+		s.httpsEchoC.Terminate(s.ctx)
+	}
+}
+
+// TestWhitelistedDomainViaSNI is the gost#899 golden path: curl to a domain in
+// the whitelist should be forwarded because the sniffer matches its SNI. The
+// kernel redirects the outbound TCP to the red service, which must not reject
+// the bare destination IP before sniffing. Retries tolerate startup timing.
+func (s *RedSniffingWhitelistSuite) TestWhitelistedDomainViaSNI() {
+	s.T().Helper()
+	cmd := []string{"sh", "-c", `
+for i in $(seq 1 30); do
+  body=$(curl -ks --max-time 5 https://https-echo:8443/ 2>/dev/null)
+  echo "$body" | grep -q hello-gost && { echo "$body"; exit 0; }
+  sleep 1
+done
+echo "$body"`}
+	_, out, err := s.gostC.Exec(s.ctx, cmd)
+	s.Require().NoError(err)
+	body, _ := io.ReadAll(out)
+
+	if !strings.Contains(string(body), "hello-gost") {
+		DumpLogs(s.T(), s.ctx, "gost-red logs", s.gostC)
+	}
+	s.Require().Contains(string(body), "hello-gost",
+		"whitelisted domain must be forwarded via SNI, not rejected on the bare IP")
+}
+
+// TestNonWhitelistedHostRejected verifies that skipping the pre-sniffing check
+// in whitelist mode does not weaken the whitelist: a connection whose sniffed
+// SNI is not allowlisted must still be rejected. curl connects to the same
+// echo IP but with a different SNI, so only the SNI can drive the decision.
+func (s *RedSniffingWhitelistSuite) TestNonWhitelistedHostRejected() {
+	s.T().Helper()
+	ip, err := s.httpsEchoC.ContainerIP(s.ctx)
+	s.Require().NoError(err)
+
+	cmd := []string{"sh", "-c", fmt.Sprintf(
+		"curl -ks --resolve other.test:8443:%s --max-time 5 https://other.test:8443/ 2>&1", ip)}
+	code, _, err := s.gostC.Exec(s.ctx, cmd)
+	s.Require().NoError(err)
+	s.Require().NotZero(code,
+		"curl to a non-whitelisted SNI should fail; got exit %d", code)
+
+	logs, err := s.gostC.Logs(s.ctx)
+	s.Require().NoError(err)
+	defer logs.Close()
+	logBody, _ := io.ReadAll(logs)
+	s.Require().Contains(string(logBody), "bypass:",
+		"gost should log a bypass decision for the non-whitelisted SNI")
+}
+
+func TestRedSniffingWhitelistSuite(t *testing.T) {
+	suite.Run(t, new(RedSniffingWhitelistSuite))
+}
@@ -0,0 +1,147 @@
+package e2e
+
+import (
+	"context"
+	"io"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"github.com/testcontainers/testcontainers-go"
+)
+
+// RUDPBindSuite reproduces go-gost/gost#911: concurrent UDP source sockets
+// sharing ONE reverse UDP tunnel over a relay server.
+//
+// Topology (all three gost processes plus a UDP echo server):
+//
+//	UDP source sockets (N) -> client udp service -> relay server
+//	  -> reverse-bound UDP port -> host rudp listener (ONE shared stream)
+//	  -> udp-echo
+//
+// A datagram frame is written to that shared stream as three separate Write
+// calls (RSV/FRAG, SOCKS5 address, payload). Before the fix, with N endpoints
+// writing concurrently, frames interleaved between those calls: replies came
+// back corrupted, and a torn frame left half a header in the stream, which the
+// far end read as "unexpected EOF" and answered by tearing down and rebinding
+// the whole reverse tunnel every second.
+//
+// The host is the side that binds the tunnel, so its log is where a reset
+// shows up as "unexpected EOF, retrying in 1s" followed by a rebind.
+type RUDPBindSuite struct {
+	suite.Suite
+	ctx     context.Context
+	udpC    testcontainers.Container
+	serverC testcontainers.Container
+	hostC   testcontainers.Container
+	clientC testcontainers.Container
+}
+
+func (s *RUDPBindSuite) SetupSuite() {
+	s.ctx = context.Background()
+
+	udpC, err := RunUDPEchoContainer(s.ctx, SharedNetworkName)
+	s.Require().NoError(err)
+	s.udpC = udpC
+
+	serverC, err := RunGostContainerWithOptions(s.ctx, SharedNetworkName,
+		"testdata/rudpbind/server.yaml", []string{"gost-server"}, []string{"8430/tcp"})
+	s.Require().NoError(err)
+	s.serverC = serverC
+
+	// The host's rudp listener opens no local port, so it exposes a dummy TCP
+	// port (service-1) purely for the readiness wait.
+	hostC, err := RunGostContainerWithOptions(s.ctx, SharedNetworkName,
+		"testdata/rudpbind/host.yaml", []string{"gost-host"}, []string{"8431/tcp"})
+	s.Require().NoError(err)
+	s.hostC = hostC
+
+	clientC, err := RunGostContainerWithFiles(s.ctx, SharedNetworkName,
+		"testdata/rudpbind/client.yaml",
+		[]testcontainers.ContainerFile{
+			{HostFilePath: "scripts/udp_rudp_concurrent.py", ContainerFilePath: "/scripts/udp_rudp_concurrent.py", FileMode: 0644},
+		})
+	s.Require().NoError(err)
+	s.clientC = clientC
+
+	// The reverse tunnel binds remotely on first traffic, not at startup.
+	up := assert.Eventually(s.T(), func() bool {
+		out := s.sendConcurrent(1, 1)
+		if !strings.Contains(out, "PASS") {
+			s.T().Logf("waiting for tunnel, sender said:\n%s", out)
+		}
+		return out != "" && strings.Contains(out, "PASS")
+	}, 30*time.Second, time.Second, "reverse UDP tunnel never came up")
+	if !up {
+		DumpLogs(s.T(), s.ctx, "host logs", s.hostC)
+		DumpLogs(s.T(), s.ctx, "server logs", s.serverC)
+		DumpLogs(s.T(), s.ctx, "client logs", s.clientC)
+		s.FailNow("reverse UDP tunnel never came up")
+	}
+}
+
+func (s *RUDPBindSuite) TearDownSuite() {
+	for _, c := range []testcontainers.Container{s.clientC, s.hostC, s.serverC, s.udpC} {
+		if c != nil {
+			c.Terminate(s.ctx)
+		}
+	}
+}
+
+// sendConcurrent runs the concurrent sender inside the client container and
+// returns its combined stdout+stderr.
+func (s *RUDPBindSuite) sendConcurrent(endpoints, seconds int) string {
+	cmd := []string{
+		"python3", "/scripts/udp_rudp_concurrent.py",
+		// The client service listens in this same container, so loopback is the
+		// correct target — no network alias needed for the sender.
+		"127.0.0.1", "8432",
+		strconv.Itoa(endpoints), strconv.Itoa(seconds),
+	}
+	_, out, err := s.clientC.Exec(s.ctx, cmd)
+	if err != nil {
+		return ""
+	}
+	var sb strings.Builder
+	buf := make([]byte, 4096)
+	for {
+		n, err := out.Read(buf)
+		sb.Write(buf[:n])
+		if err != nil {
+			break
+		}
+	}
+	return sb.String()
+}
+
+// TestConcurrentEndpointsShareTunnel is the regression assertion: several UDP
+// source sockets sharing one reverse tunnel must each get their own datagrams
+// back unchanged, and the tunnel must not be rebuilt underneath them.
+func (s *RUDPBindSuite) TestConcurrentEndpointsShareTunnel() {
+	out := s.sendConcurrent(4, 8)
+	s.T().Logf("concurrent send:\n%s", out)
+
+	if strings.Contains(out, "FAIL") {
+		DumpLogs(s.T(), s.ctx, "host logs", s.hostC)
+		DumpLogs(s.T(), s.ctx, "server logs", s.serverC)
+	}
+	s.Require().Contains(out, "PASS", "concurrent endpoints over one reverse tunnel failed:\n%s", out)
+
+	// Belt and braces: the host log is where the reset appears directly.
+	hostLogs, err := s.hostC.Logs(s.ctx)
+	if err == nil {
+		body, readErr := io.ReadAll(hostLogs)
+		hostLogs.Close()
+		if readErr == nil {
+			s.Require().NotContains(string(body), "unexpected EOF",
+				"reverse tunnel was torn down while endpoints were sending")
+		}
+	}
+}
+
+func TestRUDPBindSuite(t *testing.T) {
+	suite.Run(t, new(RUDPBindSuite))
+}
@@ -0,0 +1,105 @@
+"""Concurrent UDP sender for the gost#911 reverse-tunnel regression test.
+
+Each socket is an independent source endpoint sharing ONE reverse tunnel
+stream. Every datagram is a run of its own endpoint id, so a reply that does
+not match the id byte exactly is a frame corrupted by an interleaved writer
+rather than plain loss.
+
+Usage: udp_rudp_concurrent.py <host> <port> <count> <duration_seconds>
+"""
+
+import socket
+import sys
+import threading
+import time
+
+
+def main():
+    host = sys.argv[1]
+    port = int(sys.argv[2])
+    count = int(sys.argv[3])
+    duration = float(sys.argv[4])
+
+    payload_len = 1200
+    end = time.monotonic() + duration
+    results = {}
+    lock = threading.Lock()
+
+    def endpoint(endpoint_id):
+        payload = bytes([endpoint_id]) * payload_len
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.bind(("0.0.0.0", 0))
+        sock.settimeout(0.2)
+
+        sent = received = damaged = 0
+        largest_gap = 0.0
+        last = time.monotonic()
+
+        while time.monotonic() < end:
+            try:
+                sock.sendto(payload, (host, port))
+                sent += 1
+            except OSError:
+                pass
+            while True:
+                try:
+                    data, _ = sock.recvfrom(65535)
+                except socket.timeout:
+                    break
+                except OSError:
+                    break
+                received += 1
+                if data != payload:
+                    damaged += 1
+                now = time.monotonic()
+                largest_gap = max(largest_gap, now - last)
+                last = now
+
+        largest_gap = max(largest_gap, time.monotonic() - last)
+        with lock:
+            results[endpoint_id] = (sent, received, damaged, round(largest_gap, 3))
+        sock.close()
+
+    threads = [
+        threading.Thread(target=endpoint, args=(i + 1,)) for i in range(count)
+    ]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    failures = []
+    for endpoint_id in sorted(results):
+        sent, received, damaged, gap = results[endpoint_id]
+        loss_pct = 100.0 * (1.0 - received / sent) if sent else 100.0
+        print(
+            f"endpoint {endpoint_id}: sent={sent} received={received} "
+            f"damaged={damaged} loss={loss_pct:.1f}% max_gap={gap}"
+        )
+        # Unsent datagrams are outside our control (the UDP socket's own
+        # buffer); anything that comes BACK must be byte-identical.
+        if damaged:
+            failures.append(
+                f"endpoint {endpoint_id}: {damaged} datagram(s) came back "
+                f"corrupted — frames interleaved on the shared tunnel stream"
+            )
+        # A torn frame makes the far end read io.ErrUnexpectedEOF, which
+        # rebuilds the whole reverse tunnel. That shows up as a receive gap of
+        # seconds, not milliseconds.
+        if gap >= 1.0:
+            failures.append(
+                f"endpoint {endpoint_id}: {gap}s receive gap — the reverse "
+                f"tunnel was torn down and rebound under active traffic"
+            )
+
+    if failures:
+        for f in failures:
+            print(f"FAIL: {f}", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"PASS: {count} concurrent endpoints, no corruption, no tunnel reset")
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,22 @@
+services:
+- name: http-proxy
+  addr: :8080
+  handler:
+    type: http
+    chain: quic-chain
+  listener:
+    type: tcp
+
+chains:
+- name: quic-chain
+  hops:
+  - name: hop-0
+    nodes:
+    - name: node-0
+      addr: {{.ServerAddr}}
+      connector:
+        type: http
+      dialer:
+        type: quic
+        metadata:
+          cipherKey: 0123456789abcdef0123456789abcdef
@@ -0,0 +1,9 @@
+services:
+- name: quic-http
+  addr: :18843
+  handler:
+    type: http
+  listener:
+    type: quic
+    metadata:
+      cipherKey: 0123456789abcdef0123456789abcdef
@@ -0,0 +1,27 @@
+# gost#899: whitelist bypass + sniffing on a transparent (red) proxy.
+# The whitelist contains only a domain ("https-echo", the docker network alias
+# of the HTTPS echo container). A bare destination IP is never in it, so on a
+# broken build the pre-sniffing IP bypass check rejects every connection
+# before SNI sniffing can match the host. The fix skips that check in
+# whitelist mode and lets the sniffer drive the decision from the SNI.
+log:
+  level: debug
+services:
+  - name: transparent-egress
+    addr: ":12345"
+    bypass: allowlist
+    metadata:
+      so_mark: 114514
+    handler:
+      type: red
+      metadata:
+        sniffing: true
+        sniffing.timeout: 5s
+        sniffing.fallback: true
+    listener:
+      type: red
+bypasses:
+  - name: allowlist
+    whitelist: true
+    matchers:
+      - https-echo
@@ -0,0 +1,34 @@
+# Internal client behind NAT for gost#911: a UDP forward service that sends all
+# traffic to the port the host bound through the reverse tunnel.
+#
+# The forwarder target is gost-server:8432 — that is where the reverse tunnel is
+# actually bound (the host's rudp listener asked the relay server to bind it, so
+# the port lives on the relay server, not on the host). Datagrams go there and
+# are carried back to the internal host over the one shared tunnel stream.
+services:
+  - name: service-0
+    addr: ":8432"
+    handler:
+      type: udp
+    listener:
+      type: udp
+      metadata:
+        keepalive: true
+        ttl: 5m
+    forwarder:
+      nodes:
+        - name: tunnel
+          addr: gost-server:8432
+
+chains:
+  - name: chain-0
+    hops:
+      - nodes:
+        - addr: gost-server:8430
+          connector:
+            type: relay
+          dialer:
+            type: tcp
+
+log:
+  level: debug
@@ -0,0 +1,44 @@
+# Internal host behind NAT for gost#911: binds a reverse UDP tunnel (rudp)
+# through the relay server and forwards it to the local UDP echo server.
+#
+# The rudp listener opens no local port — it binds the UDP port remotely through
+# the chain. service-1 is a dummy TCP listener purely so the e2e harness has a
+# stable port to wait on for container readiness.
+services:
+  - name: service-0
+    addr: "0.0.0.0:8432"
+    handler:
+      type: rudp
+    listener:
+      type: rudp
+      chain: chain-0
+      metadata:
+        ttl: 5m
+    forwarder:
+      nodes:
+        - name: echo
+          addr: udp-echo:5679
+
+  # Dummy TCP service on a fixed port: the rudp reverse-tunnel listener binds
+  # remotely through the chain and opens no local port, so this gives the e2e
+  # harness a stable port to wait on. Nothing ever targets it — the harness
+  # only opens and immediately closes the connection.
+  - name: service-1
+    addr: ":8431"
+    handler:
+      type: tcp
+    listener:
+      type: tcp
+
+chains:
+  - name: chain-0
+    hops:
+      - nodes:
+        - addr: gost-server:8430
+          connector:
+            type: relay
+          dialer:
+            type: tcp
+
+log:
+  level: debug
@@ -0,0 +1,16 @@
+# Public-facing relay server for gost#911: allows UDP BIND so an internal host
+# can bind a reverse UDP tunnel through it. The host asks the server to bind
+# the tunnel's UDP port, so that port lives here — on the relay server, not on
+# the host behind NAT.
+services:
+  - name: service-0
+    addr: ":8430"
+    handler:
+      type: relay
+      metadata:
+        bind: true
+    listener:
+      type: tcp
+
+log:
+  level: debug
Author	SHA1	Message	Date
ginuerzh	0793f4730f	Merge pull request #909 from iBug/pkg chore: Create /etc/gost directory with package manager	2026-10-07 02:31:08 +00:00
ginuerzh	11220b15bb	chore(gost): bump github.com/go-gost/x to v0.19.5	2026-10-03 23:38:53 +08:00
ginuerzh	d7656ef3de	tests/e2e: concurrent UDP endpoints must share a reverse tunnel intact Covers gost#911 at the wire level: four UDP source sockets send through one RUDP reverse tunnel bound on a relay server, and every datagram must come back byte-identical to its own endpoint. A frame torn by an interleaved writer shows up twice — as a corrupted payload, and as the torn frame leaving half a header in the stream, which the far end reads as "unexpected EOF" and answers by rebuilding the whole tunnel. So the suite asserts both: no endpoint sees a corrupted datagram, and no endpoint sees a receive gap long enough to be a teardown and rebind. Verified against a binary built before the fix (4 endpoints, 35% loss, 1.4s gaps, suite fails) and after it (0% loss, no corruption, 0.2s gaps, passes).	2026-10-03 16:27:05 +08:00
iBug	7a220c6cd7	chore: Create /etc/gost directory with package manager	2026-09-24 10:32:53 +08:00
iBug	e9fab95872	Add back SystemCallFilter=@chown (#907 ) Otherwise lumberjack will fail to rotate log files Ref: https://github.com/natefinch/lumberjack/pull/43/changes#diff-7a80b3353ee34c4b79751e1e47e5010af54e82f393aa112770a4d1a731e70ba2R480	2026-09-22 22:06:55 +08:00
ginuerzh	97bb57230c	docs: document DEB/RPM installation Covers the amd64v3 vs amd64 choice — both packages declare Architecture: amd64, so the file name is the only way to tell them apart — and the fact that the packaged systemd service stays inactive until /etc/gost/gost.yml is created.	2026-09-21 21:23:33 +08:00
ginuerzh	bb45b12809	fix(release): use DynamicUser for gost.service systemd-analyze verify warns "Special user nobody configured, this is not safe!": nobody is a shared account, so any other service running as it can read and write /run/gost. DynamicUser= gives the unit its own transient identity, named gost, without adding a static user to the package. Verified under a real systemd: the unit starts, binds :80 through the ambient capabilities, runs as the dynamic user, and is skipped rather than failed when /etc/gost/gost.yml is absent.	2026-09-21 21:15:33 +08:00
ginuerzh	c4e789e2df	fix(release): pin capability bounding set in gost.service CapabilityBoundingSet= was dropped when CAP_NET_ADMIN was added for TUN, which leaves the bounding set unrestricted. Pin it to the capabilities the unit actually needs. Restore ~@privileged as well: TUN uses ioctl(TUNSETIFF) and netlink, neither of which is in that group.	2026-09-21 21:03:43 +08:00
iBug	2a6ba4df85	Add DEB and RPM packages for easier installation (#906 ) * Add systemd service file * Add DEB and RPM packages for amd64, amd64v3 and arm64 architectures * Remove GOMEMLIMIT from systemd service * Fix packaged systemd service defaults	2026-09-21 21:01:26 +08:00
ginuerzh	ece7770ad7	chore(gost): bump github.com/go-gost/x to v0.17.2	2026-09-13 21:12:53 +08:00
ginuerzh	eb66804ec8	chore(gost): bump github.com/go-gost/x to v0.17.1	2026-09-12 12:12:22 +08:00
ginuerzh	a20999046b	chore(gost): bump github.com/go-gost/x to v0.17.0	2026-09-12 10:16:16 +08:00
Igor Kuzmenkov	fe0982b2e4	fix: update go-m1cpu for macOS arm64 (#903 )	2026-09-12 10:06:30 +08:00
ginuerzh	36cc266257	chore: anchor gost gitignore rule to repo root The bare 'gost' pattern also matched the cmd/gost/ directory, forcing -f to stage tracked files under it.	2026-09-07 17:46:21 +08:00
ginuerzh	074af1b175	program: shut down plugin subprocesses on stop	2026-09-07 17:42:44 +08:00
ginuerzh	ee61f28688	test(e2e): add QUIC cipherKey invalid-datagram regression Add an e2e suite covering go-gost/x#125: a malformed UDP datagram sent to a cipherKey-enabled QUIC listener must not close the shared transport. Uses the canonical http-over-quic chaining pattern and verifies the forward still works after the invalid datagram. Also bumps go.mod/go.sum (plugin v0.6.1, otel, x/net, etc.).	2026-09-07 14:53:36 +08:00
ginuerzh	27ac16439e	bump to v3.3.1, x v0.16.1	2026-08-31 22:54:26 +08:00
ginuerzh	d778c031eb	test(e2e): transparent whitelist bypass + sniffing (gost#899) Reproduce the regression where a domain-only whitelist bypass on a red (transparent) proxy rejected every connection: the pre-sniffing bypass check ran against the bare destination IP, which is never in a domain whitelist, before SNI sniffing could match. A privileged container redirects outbound TCP to the red service; asserts an allowlisted SNI is forwarded (hello-gost) and a non-allowlisted SNI is rejected.	2026-08-31 22:35:03 +08:00