rst_stream select branch

.bleep

@@ -1 +1 @@
-5a1cf681f7e2691687623b60387a88076493015f
+faf3f5b20af8cf4f1c8038ba48d44880674ca9ec

.cargo/audit.toml

@@ -1,7 +1,12 @@
+# Advisories against rustls-webpki 0.101.7, pulled in transitively by
+# aws-sdk-s3-transfer-manager through the legacy rustls 0.21 chain used by
+# dial9's worker-s3 feature. No patch exists in 0.101.x; not reachable in
+# our usage because this is TLS client use only and does not parse CRLs.
+# Remove once the upstream aws-s3-transfer-manager-rs fix ships.
+
 [advisories]
 ignore = [
-    # This came from the prometheus crate's protobuf encoder.
-    # We don't use the protobuf encoder, only the text one.
-    # https://rustsec.org/advisories/RUSTSEC-2024-0437
-    "RUSTSEC-2024-0437",
+    "RUSTSEC-2026-0098", # rustls-webpki: URI name constraints incorrectly accepted
+    "RUSTSEC-2026-0099", # rustls-webpki: name constraints accepted for wildcard certs
+    "RUSTSEC-2026-0104", # rustls-webpki: reachable panic in CRL parsing
 ]

.github/workflows/build.yml

@@ -38,12 +38,17 @@ jobs:
       - name: Run cargo fmt
         run: cargo fmt --all -- --check
 
+      - name: Run cargo check
+        run: cargo check --workspace
+
       - name: Run cargo test
+        if: matrix.toolchain != '1.84.0'
         run: cargo test --verbose --lib --bins --tests --no-fail-fast
 
       # Need to run doc tests separately.
       # (https://github.com/rust-lang/cargo/issues/6669)
       - name: Run cargo doc test
+        if: matrix.toolchain != '1.84.0'
         run: cargo test --verbose --doc
 
       - name: Run cargo clippy

.github/workflows/semgrep.yml

@@ -1,24 +1,30 @@
+name: Semgrep OSS scan
 on:
   pull_request: {}
+  push:
+    branches: [main, master]
   workflow_dispatch: {}
-  push: 
-    branches:
-      - main
-      - master
   schedule:
-    - cron: '0 0 * * *'
-name: Semgrep config
+    - cron: '0 0 15 * *'
+concurrency:
+  group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   semgrep:
-    name: semgrep/ci
-    runs-on: ubuntu-latest
-    env:
-      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      SEMGREP_URL: https://cloudflare.semgrep.dev
-      SEMGREP_APP_URL: https://cloudflare.semgrep.dev
-      SEMGREP_VERSION_CHECK_URL: https://cloudflare.semgrep.dev/api/check-version
-    container:
-      image: returntocorp/semgrep
+    name: semgrep-oss
+    runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v4
-      - run: semgrep ci
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+      - id: cache-semgrep
+        uses: actions/cache@v5
+        with:
+          path: ~/.local
+          key: semgrep-1.160.0-${{ runner.os }}
+      - if: steps.cache-semgrep.outputs.cache-hit != 'true'
+        run: pip install --user semgrep==1.160.0
+      - run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - run: semgrep scan --config=auto

.gitignore

@@ -5,4 +5,5 @@ dhat-heap.json
 .vscode
 .idea
 .cover
-bleeper.user.toml
+bleeper.user.toml
+.DS_Store

Cargo.toml

@@ -25,6 +25,7 @@ members = [
     "pingora-ketama",
     "pingora-load-balancing",
     "pingora-memory-cache",
+    "pingora-prometheus",
     "tinyufo",
 ]
 
@@ -38,10 +39,14 @@ bytes = "1.0"
 derivative = "2.2.0"
 http = "1"
 log = "0.4"
+futures = "0.3"
 h2 = ">=0.4.11"
 once_cell = "1"
 lru = "0.16.3"
 ahash = ">=0.8.9"
 
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }
+
 [profile.bench]
 debug = true

docs/quick_start.md

@@ -19,7 +19,8 @@ cargo new load_balancer
 In your project's `cargo.toml` file add the following to your dependencies
 ```
 async-trait="0.1"
-pingora = { version = "0.3", features = [ "lb" ] }
+pingora = { version = "0.8.0", features = ["openssl", "lb"] }
+
 ```
 
 ### Create a pingora server
@@ -321,4 +322,4 @@ The full code for this example is available in this repository under
 Other examples that you may find helpful are also available here
 
 [pingora-proxy/examples/](../pingora-proxy/examples/)
-[pingora/examples](../pingora/examples/)
+[pingora/examples](../pingora/examples/)

docs/user_guide/conf.md

@@ -23,12 +23,91 @@ group: webusers
 | threads | number of threads per service | number |
 | user | the user the pingora server should be run under after daemonization | string |
 | group | the group the pingora server should be run under after daemonization | string |
+| working_directory | the working directory for the daemonized process | string |
 | client_bind_to_ipv4 | source IPv4 addresses to bind to when connecting to server | list of string |
 | client_bind_to_ipv6 | source IPv6 addresses to bind to when connecting to server| list of string |
 | ca_file | The path to the root CA file | string |
 | s2n_config_cache_size | The maximum number of unique s2n configs to cache. A value of 0 disables the cache. Default: 10 (s2n-tls only) | number |
 | work_stealing | Enable work stealing runtime (default true). See Pingora runtime (WIP) section for more info | bool |
-| upstream_keepalive_pool_size | The number of total connections to keep in the connection pool | number |
+| runtime_enable_alt_timer | Enable Tokio's experimental alternative timer on work-stealing service runtimes. Requires building with `--cfg tokio_unstable`. Ignored when `work_stealing` is disabled. Default: `false` | bool |
+| fast_timeout_to_tokio_threshold_seconds | Timeout durations greater than this value use Tokio's native timeout instead of Pingora's fast timeout. Default: `900`. Set to `null` to disable the Tokio fallback. | number |
+| runtime_metrics_poll_time_histogram | Enable Tokio poll-time histograms on service runtimes. Requires building with `--cfg tokio_unstable`; adds two timestamp reads to every task poll. Default: `false` | bool |
+| runtime_metrics_poll_time_histogram_scale | Bucket scale for Tokio poll-time histograms. Valid values: `linear`, `log`. Ignored unless `runtime_metrics_poll_time_histogram` is enabled. | string |
+| runtime_metrics_poll_time_histogram_resolution_micros | Width of the first Tokio poll-time histogram bucket in microseconds. Must be greater than 0. Ignored unless `runtime_metrics_poll_time_histogram` is enabled. | number |
+| runtime_metrics_poll_time_histogram_buckets | Number of Tokio poll-time histogram buckets. Must be greater than 0 and at most 1024. Memory usage scales with runtimes × workers × buckets. Ignored unless `runtime_metrics_poll_time_histogram` is enabled. | number |
+| upstream_keepalive_pool_size | The number of idle upstream connections to keep per tokio worker. The pool's effective ceiling is `upstream_keepalive_pool_size × threads`. Eviction is globally consistent across workers. | number |
+| daemon_wait_for_ready | When `true` and `daemon` is `true`, the parent process waits for the daemon to signal readiness (via `SIGUSR1`) before exiting. This causes systemd to delay sending `SIGQUIT` to the old process until the new instance is fully bootstrapped. Default: `false` | bool |
+| daemon_ready_timeout_seconds | How long (in seconds) the parent waits for the daemon to signal readiness when `daemon_wait_for_ready` is `true`. If the daemon does not signal in time the parent exits with a non-zero code, causing systemd to abort the reload. Default: `600` | number |
+| daemon_notify_timeout_seconds | How long (in seconds) the daemon retries sending `SIGUSR1` to the parent when the attempt fails with a permission error. This covers the brief window after the fork where the parent has not yet dropped its UID to match the daemon. Default: `60` | number |
+
+## dial9
+
+dial9 Tokio runtime telemetry is configured programmatically, not through
+the YAML configuration file. This avoids applying experimental telemetry to
+every service runtime and lets services provide non-serializable options such
+as a pre-built S3 client.
+
+dial9 is only available when Pingora is built with the `dial9` feature and
+`--cfg tokio_unstable`. Services can override the global runtime options with
+`runtime_opts_override()`:
+
+```rust
+use pingora::server::{Dial9RuntimeOpts, RuntimeOpts};
+use pingora::services::Service;
+
+struct MyService;
+
+impl Service for MyService {
+    fn name(&self) -> &str {
+        "my-service"
+    }
+
+    fn runtime_opts_override(&self, global: &RuntimeOpts) -> Option<RuntimeOpts> {
+        let mut opts = global.clone();
+        opts.dial9 = Some(
+            Dial9RuntimeOpts::new("/var/lib/pingora/dial9/my-service/trace.bin")
+                .with_max_file_size(100 * 1024 * 1024)
+                .with_max_total_size(512 * 1024 * 1024),
+        );
+        Some(opts)
+    }
+}
+```
+
+When built with the `dial9-worker-s3` feature, sealed trace segments can also
+be uploaded to an S3-compatible bucket:
+
+```rust
+use pingora::server::{Dial9RuntimeOpts, Dial9S3UploadOpts, RuntimeOpts};
+use pingora::services::Service;
+
+struct MyService {
+    s3_client: aws_sdk_s3::Client,
+}
+
+impl Service for MyService {
+    fn name(&self) -> &str {
+        "my-service"
+    }
+
+    fn runtime_opts_override(&self, global: &RuntimeOpts) -> Option<RuntimeOpts> {
+        let mut opts = global.clone();
+        opts.dial9 = Some(
+            Dial9RuntimeOpts::new("/var/lib/pingora/dial9/my-service/trace.bin")
+                .with_s3_upload(
+                    Dial9S3UploadOpts::new("my-trace-bucket", "my-service")
+                        .with_prefix("traces/my-service")
+                        .with_region("us-east-1")
+                        .with_client(self.s3_client.clone()),
+                ),
+        );
+        Some(opts)
+    }
+}
+```
+
+The S3 client is optional. When omitted, dial9 uses the AWS SDK default
+configuration chain and its bucket-region detection.
 
 ## Extension
 Any unknown settings will be ignored. This allows extending the conf file to add and pass user defined settings. See User defined configuration section.

docs/user_guide/modify_filter.md

@@ -123,8 +123,7 @@ impl ProxyHttp for MyGateway {
 
 fn main() {
    ...
-    let mut prometheus_service_http =
-        pingora::services::listening::Service::prometheus_http_service();
+    let mut prometheus_service_http = pingora_prometheus::prometheus_http_service();
     prometheus_service_http.add_tcp("127.0.0.1:6192");
     my_server.add_service(prometheus_service_http);
 

docs/user_guide/phase.md

@@ -29,7 +29,8 @@ Pingora-proxy allows users to insert arbitrary logic into the life of a request.
     upstream_request_filter --> request_body_filter;
     request_body_filter --> SendReq{{IO: send request to upstream}};
     SendReq-->RecvResp{{IO: read response from upstream}};
-    RecvResp-->upstream_response_filter-->response_filter-->upstream_response_body_filter-->response_body_filter-->logging-->endreq("request done");
+    RecvResp-.feature: adjust_upstream_modules.->adjust_upstream_modules;
+    adjust_upstream_modules-->upstream_response_filter-->response_filter-->upstream_response_body_filter-->response_body_filter-->logging-->endreq("request done");
 
     fail_to_connect --can retry-->upstream_peer;
     fail_to_connect --can't retry-->fail_to_proxy--send error response-->logging;
@@ -92,6 +93,11 @@ If the error is not retry-able, the request will end.
 ### `upstream_request_filter()`
 This phase is to modify requests before sending to upstream.
 
+### `adjust_upstream_modules()` _(feature: `adjust_upstream_modules`)_
+This phase is triggered when the upstream response header arrives, before upstream modules (such as `upstream_compression`) process it.
+
+Use this to configure upstream module behavior based on the response header, e.g. setting a dictionary for dictionary-based content encoding. The response header is provided as an immutable reference; to modify the response header itself, use `upstream_response_filter()` instead.
+
 ### `upstream_response_filter()/upstream_response_body_filter()/upstream_response_trailer_filter()`
 This phase is triggered after an upstream response header/body/trailer is received.
 
@@ -129,6 +135,13 @@ This is also not a phase, but another callback.
 
 `fail_to_proxy()` errors are automatically logged in the error log, but users may not be interested in every error. For example, downstream errors are logged if the client disconnects early, but these errors can become noisy if users are mainly interested in observing upstream issues. This callback can inspect the error and returns true or false. If true, the error will not be written to the log.
 
+### `suppress_proxy_warn_log()`
+This is also not a phase, but another callback.
+
+This experimental callback can suppress proxy warning logs that do not reach `fail_to_proxy()`, such as retryable proxy upstream failures and downstream errors ignored while cache fill continues. The callback receives a `ProxyWarnLogContext` so users can distinguish these warning contexts. Final proxy errors are still handled by `suppress_error_log()`.
+
+This API may change or be removed until indicated otherwise. Suppressing retry warning logs can remove the only per-retry audit record, so users should provide alternative observability, such as metrics or logs from this hook.
+
 ### Cache filters
 
 To be documented

docs/user_guide/phase_chart.md

@@ -14,7 +14,8 @@ Pingora proxy phases without caching
     upstream_request_filter --> request_body_filter;
     request_body_filter --> SendReq{{IO: send request to upstream}};
     SendReq-->RecvResp{{IO: read response from upstream}};
-    RecvResp-->upstream_response_filter-->response_filter-->upstream_response_body_filter-->response_body_filter-->logging-->endreq("request done");
+    RecvResp-.feature: adjust_upstream_modules.->adjust_upstream_modules;
+    adjust_upstream_modules-->upstream_response_filter-->response_filter-->upstream_response_body_filter-->response_body_filter-->logging-->endreq("request done");
 
     fail_to_connect --can retry-->upstream_peer;
     fail_to_connect --can't retry-->fail_to_proxy--send error response-->logging;

docs/user_guide/prom.md

@@ -1,10 +1,21 @@
 # Prometheus
 
-Pingora has a built-in prometheus HTTP metric server for scraping.
+The [`pingora-prometheus`](https://docs.rs/pingora-prometheus) crate provides a
+Prometheus HTTP metrics server for scraping.
+
+## Adding the Dependency
+
+Add `pingora-prometheus` to your `Cargo.toml`:
+
+```toml
+pingora-prometheus = "0.8.0"
+```
+
+## Setting up a Prometheus Metrics Endpoint
 
 ```rust
     ...
-    let mut prometheus_service_http = Service::prometheus_http_service();
+    let mut prometheus_service_http = pingora_prometheus::prometheus_http_service();
     prometheus_service_http.add_tcp("0.0.0.0:1234");
     my_server.add_service(prometheus_service_http);
     my_server.run_forever();

docs/user_guide/rate_limiter.md

@@ -5,8 +5,8 @@ Pingora provides a crate `pingora-limits` which provides a simple and easy to us
 1. Add the following dependencies to your `Cargo.toml`:
    ```toml
    async-trait="0.1"
-   pingora = { version = "0.3", features = [ "lb" ] }
-   pingora-limits = "0.3.0"
+   pingora = { version = "0.8", features = [ "lb", "openssl" ] }
+   pingora-limits = "0.8.0"
    once_cell = "1.19.0"
    ```
 2. Declare a global rate limiter map to store the rate limiter for each client. In this example, we use `appid`.
@@ -20,6 +20,7 @@ Pingora provides a crate `pingora-limits` which provides a simple and easy to us
 ```rust
 use async_trait::async_trait;
 use once_cell::sync::Lazy;
+use pingora::http::ResponseHeader;
 use pingora::prelude::*;
 use pingora_limits::rate::Rate;
 use std::sync::Arc;

pingora-boringssl/src/ext.rs

@@ -146,6 +146,20 @@ pub fn clear_error_stack() {
     let _ = ErrorStack::get();
 }
 
+/// Export keying material from a TLS connection
+///
+/// Derives keying material for application use in accordance with RFC 5705.
+///
+/// See [SSL_export_keying_material](https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_export_keying_material).
+pub fn ssl_export_keying_material(
+    ssl: &SslRef,
+    out: &mut [u8],
+    label: &str,
+    context: Option<&[u8]>,
+) -> Result<(), ErrorStack> {
+    ssl.export_keying_material(out, label, context)
+}
+
 /// Create a new [Ssl] from &[SslAcceptor]
 ///
 /// This function is needed because [Ssl::new()] doesn't take `&SslContextRef` like openssl-rs

pingora-cache/Cargo.toml

@@ -37,8 +37,8 @@ httpdate = "1.0.2"
 log = { workspace = true }
 async-trait = { workspace = true }
 parking_lot = "0.12"
-cf-rustracing = "1.0"
-cf-rustracing-jaeger = "1.0"
+cf-rustracing = { version = "1.0", optional = true }
+cf-rustracing-jaeger = { version = "1.0", optional = true }
 rmp = "0.8.14"
 tokio = { workspace = true }
 lru = { workspace = true }
@@ -49,11 +49,13 @@ strum = { version = "0.26", features = ["derive"] }
 rand = "0.8"
 
 [dev-dependencies]
+cf-rustracing = "1.0"
+cf-rustracing-jaeger = "1.0"
 tokio-test = "0.4"
 tokio = { workspace = true, features = ["fs"] }
 env_logger = "0.11"
 dhat = "0"
-futures = "0.3"
+futures = { workspace = true }
 
 [[bench]]
 name = "simple_lru_memory"
@@ -73,3 +75,4 @@ openssl = ["pingora-core/openssl"]
 boringssl = ["pingora-core/boringssl"]
 rustls = ["pingora-core/rustls"]
 s2n = ["pingora-core/s2n"]
+trace = ["dep:cf-rustracing", "dep:cf-rustracing-jaeger"]