节点状态中增加本地防火墙名称

优化WAF日志逻辑
默认记录WAF的条件从检测到攻击改为所有匹配WAF规则集的请求
2022-04-22 14:59:00 +08:00 · 2022-04-21 19:44:19 +08:00 · 2022-04-21 19:02:17 +08:00 · 2022-04-21 18:14:53 +08:00 · 2022-04-21 09:40:20 +08:00 · 2022-04-21 09:40:05 +08:00
82 changed files with 1584 additions and 562 deletions
--- a/build/build.sh
+++ b/build/build.sh
@@ -42,6 +42,11 @@ function build() {
 		mkdir $DIST/configs
 		mkdir $DIST/logs
 		mkdir $DIST/data
+
+		if [ "$TAG" = "plus" ]; then
+			mkdir $DIST/scripts
+			mkdir $DIST/scripts/js
+		fi
 	fi

 	cp $ROOT/configs/api.template.yaml $DIST/configs
--- a/go.mod
+++ b/go.mod
@@ -2,9 +2,7 @@ module github.com/TeaOSLab/EdgeNode

 go 1.15

-replace (
-	github.com/TeaOSLab/EdgeCommon => ../EdgeCommon
-)
+replace github.com/TeaOSLab/EdgeCommon => ../EdgeCommon

 require (
 	github.com/TeaOSLab/EdgeCommon v0.0.0-00010101000000-000000000000
@@ -14,10 +12,12 @@ require (
 	github.com/chai2010/webp v1.1.0 // indirect
 	github.com/dchest/captcha v0.0.0-20200903113550-03f5f0333e1f
 	github.com/fsnotify/fsnotify v1.5.1
+	github.com/go-redis/redis/v8 v8.11.5
 	github.com/golang/protobuf v1.5.2
+	github.com/google/nftables v0.0.0-20220407195405-950e408d48c6
 	github.com/iwind/TeaGo v0.0.0-20220304043459-0dd944a5b475
 	github.com/iwind/gofcgi v0.0.0-20210528023741-a92711d45f11
-	github.com/iwind/gosock v0.0.0-20210722083328-12b2d66abec3
+	github.com/iwind/gosock v0.0.0-20211103081026-ee4652210ca4
 	github.com/iwind/gowebp v0.0.0-20211029040624-7331ecc78ed8
 	github.com/jsummers/gobmp v0.0.0-20151104160322-e2ba15ffa76e // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -28,7 +28,7 @@ require (
 	github.com/shirou/gopsutil/v3 v3.22.2
 	golang.org/x/image v0.0.0-20211028202545-6944b10bf410
 	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
-	golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8
+	golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
 	golang.org/x/text v0.3.7
 	google.golang.org/grpc v1.45.0
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
--- a/go.sum
+++ b/go.sum
@@ -2,6 +2,8 @@ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
+github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/sketches-go v0.0.0-20190923095040-43f19ad77ff7/go.mod h1:Q5DbzQ+3AkgGwymQO7aZFNP7ns2lZKGtvRBzRXfdi60=
 github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
@@ -15,10 +17,17 @@ github.com/biessek/golang-ico v0.0.0-20180326222316-d348d9ea4670/go.mod h1:iRWAF
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/webp v1.1.0 h1:4Ei0/BRroMF9FaXDG2e4OxwFcuW2vcXd+A6tyqTJUQQ=
 github.com/chai2010/webp v1.1.0/go.mod h1:LP12PG5IFmLGHUU26tBiCBKnghxx3toZFwDjOYvd3Ow=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cilium/ebpf v0.5.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.7.0 h1:1k/q3ATgxSXRdrmPfH8d7YK0GfqVsEKZAX9dQZvs56k=
+github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -33,12 +42,16 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/dchest/captcha v0.0.0-20200903113550-03f5f0333e1f h1:q/DpyjJjZs94bziQ7YkBmIlpqbVP7yw179rnzoNVX1M=
 github.com/dchest/captcha v0.0.0-20200903113550-03f5f0333e1f/go.mod h1:QGrK8vMWWHQYQ3QU9bw9Y9OPNfxccGzfb41qjvVeXtY=
 github.com/dgryski/go-rendezvous v0.0.0-20200624174652-8d2f3be8b2d9/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/frankban/quicktest v1.11.3 h1:8sXhOn0uLys67V8EsXLc6eszDs8VXWxL3iRvebPhedY=
+github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI=
@@ -48,8 +61,11 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-redis/redis/v8 v8.0.0-beta.7/go.mod h1:FGJAWDWFht1sQ4qxyJHZZbVyvnVcKQN0E3u5/5lRz+g=
+github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
+github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
 github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -71,22 +87,42 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/nftables v0.0.0-20220407195405-950e408d48c6 h1:btadZscaRmsi/+fOhkyUguRpSnrf6dykNEWxDeUCj9I=
+github.com/google/nftables v0.0.0-20220407195405-950e408d48c6/go.mod h1:0F8on3JWMkm+xahTHItkiu/E1SPqMd0TOxNweQv8ptE=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/iwind/TeaGo v0.0.0-20220304043459-0dd944a5b475 h1:EseyfFaQOjWanGiby9KMw7PjDBMg/95tLDgIw/ns0Cw=
 github.com/iwind/TeaGo v0.0.0-20220304043459-0dd944a5b475/go.mod h1:HRHK0zoC/og3c9/hKosD9yYVMTnnzm3PgXUdhRYHaLc=
 github.com/iwind/gofcgi v0.0.0-20210528023741-a92711d45f11 h1:DaQjoWZhLNxjhIXedVg4/vFEtHkZhK4IjIwsWdyzBLg=
 github.com/iwind/gofcgi v0.0.0-20210528023741-a92711d45f11/go.mod h1:JtbX20untAjUVjZs1ZBtq80f5rJWvwtQNRL6EnuYRnY=
 github.com/iwind/gosock v0.0.0-20210722083328-12b2d66abec3 h1:aBSonas7vFcgTj9u96/bWGILGv1ZbUSTLiOzcI1ZT6c=
 github.com/iwind/gosock v0.0.0-20210722083328-12b2d66abec3/go.mod h1:H5Q7SXwbx3a97ecJkaS2sD77gspzE7HFUafBO0peEyA=
+github.com/iwind/gosock v0.0.0-20211103081026-ee4652210ca4 h1:VWGsCqTzObdlbf7UUE3oceIpcEKi4C/YBUszQXk118A=
+github.com/iwind/gosock v0.0.0-20211103081026-ee4652210ca4/go.mod h1:H5Q7SXwbx3a97ecJkaS2sD77gspzE7HFUafBO0peEyA=
 github.com/iwind/gowebp v0.0.0-20211029040624-7331ecc78ed8 h1:AojsHz9Es9B3He2MQQxeRq3TyD//o9huxUo7r1wh44g=
 github.com/iwind/gowebp v0.0.0-20211029040624-7331ecc78ed8/go.mod h1:QJBY2txYhLMzwLO29iB5ujDJ3s3V7DsZ582nw4Ss+tM=
+github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 h1:uhL5Gw7BINiiPAo24A2sxkcDI0Jt/sqp1v5xQCniEFA=
+github.com/josharian/native v0.0.0-20200817173448-b6b71def0850/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
+github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
+github.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=
+github.com/jsimonetti/rtnetlink v0.0.0-20201216134343-bde56ed16391/go.mod h1:cR77jAZG3Y3bsb8hF6fHJbFoyFukLFOkQ98S0pQz3xw=
+github.com/jsimonetti/rtnetlink v0.0.0-20201220180245-69540ac93943/go.mod h1:z4c53zj6Eex712ROyh8WI0ihysb5j2ROyV42iNogmAs=
+github.com/jsimonetti/rtnetlink v0.0.0-20210122163228-8d122574c736/go.mod h1:ZXpIyOK59ZnN7J0BV99cZUPmsqDRZ3eq5X+st7u/oSA=
+github.com/jsimonetti/rtnetlink v0.0.0-20210212075122-66c871082f2b/go.mod h1:8w9Rh8m+aHZIG69YPGGem1i5VzoyRC8nw2kA8B+ik5U=
+github.com/jsimonetti/rtnetlink v0.0.0-20210525051524-4cc836578190/go.mod h1:NmKSdU4VGSiv1bMsdqNALI4RSvvjtz65tTMCnD05qLo=
+github.com/jsimonetti/rtnetlink v0.0.0-20211022192332-93da33804786 h1:N527AHMa793TP5z5GNAn/VLPzlc0ewzWdeP/25gDfgQ=
+github.com/jsimonetti/rtnetlink v0.0.0-20211022192332-93da33804786/go.mod h1:v4hqbTdfQngbVSZJVWUhGE/lbTFf9jb+ygmNUDQMuOs=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jsummers/gobmp v0.0.0-20151104160322-e2ba15ffa76e h1:LvL4XsI70QxOGHed6yhQtAU34Kx3Qq2wwBzGFKY8zKk=
 github.com/jsummers/gobmp v0.0.0-20151104160322-e2ba15ffa76e/go.mod h1:kLgvv7o6UM+0QSf0QjAse3wReFDsb9qbZJdfexWlrQw=
@@ -101,6 +137,27 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/mattn/go-sqlite3 v1.14.9 h1:10HX2Td0ocZpYEjhilsuo6WWtUqttj2Kb0KtD86/KYA=
 github.com/mattn/go-sqlite3 v1.14.9/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mdlayher/ethtool v0.0.0-20210210192532-2b88debcdd43/go.mod h1:+t7E0lkKfbBsebllff1xdTmyJt8lH37niI6kwFk9OTo=
+github.com/mdlayher/ethtool v0.0.0-20211028163843-288d040e9d60 h1:tHdB+hQRHU10CfcK0furo6rSNgZ38JT8uPh70c/pFD8=
+github.com/mdlayher/ethtool v0.0.0-20211028163843-288d040e9d60/go.mod h1:aYbhishWc4Ai3I2U4Gaa2n3kHWSwzme6EsG/46HRQbE=
+github.com/mdlayher/genetlink v1.0.0 h1:OoHN1OdyEIkScEmRgxLEe2M9U8ClMytqA5niynLtfj0=
+github.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=
+github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
+github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
+github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
+github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=
+github.com/mdlayher/netlink v1.2.0/go.mod h1:kwVW1io0AZy9A1E2YYgaD4Cj+C+GPkU6klXCMzIJ9p8=
+github.com/mdlayher/netlink v1.2.1/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
+github.com/mdlayher/netlink v1.2.2-0.20210123213345-5cc92139ae3e/go.mod h1:bacnNlfhqHqqLo4WsYeXSqfyXkInQ9JneWI68v1KwSU=
+github.com/mdlayher/netlink v1.3.0/go.mod h1:xK/BssKuwcRXHrtN04UBkwQ6dY9VviGGuriDdoPSWys=
+github.com/mdlayher/netlink v1.4.0/go.mod h1:dRJi5IABcZpBD2A3D0Mv/AiX8I9uDEu5oGkAVrekmf8=
+github.com/mdlayher/netlink v1.4.1/go.mod h1:e4/KuJ+s8UhfUpO9z00/fDZZmhSrs+oxyqAS9cNgn6Q=
+github.com/mdlayher/netlink v1.4.2 h1:3sbnJWe/LETovA7yRZIX3f9McVOWV3OySH6iIBxiFfI=
+github.com/mdlayher/netlink v1.4.2/go.mod h1:13VaingaArGUTUxFLf/iEovKxXji32JAtF858jZYEug=
+github.com/mdlayher/socket v0.0.0-20210307095302-262dc9984e00/go.mod h1:GAFlyu4/XV68LkQKYzKhIo/WW7j3Zi0YRAz/BOoanUc=
+github.com/mdlayher/socket v0.0.0-20211007213009-516dcbdf0267/go.mod h1:nFZ1EtZYK8Gi/k6QNu7z7CgO20i/4ExeQswwWuPmG/g=
+github.com/mdlayher/socket v0.0.0-20211102153432-57e3fa563ecb h1:2dC7L10LmTqlyMVzFJ00qM25lqESg9Z4u3GuEXN5iHY=
+github.com/mdlayher/socket v0.0.0-20211102153432-57e3fa563ecb/go.mod h1:nFZ1EtZYK8Gi/k6QNu7z7CgO20i/4ExeQswwWuPmG/g=
 github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=
 github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -109,13 +166,23 @@ github.com/mssola/user_agent v0.5.3 h1:lBRPML9mdFuIZgI2cmlQ+atbpJdLdeVl2IDodjBR5
 github.com/mssola/user_agent v0.5.3/go.mod h1:TTPno8LPY3wAIEKRpAtkdMT0f8SE24pLRGPahjCH4uw=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/ginkgo/v2 v2.0.0 h1:CcuG/HvWNkkaqCUpJifQY8z7qEMBJya6aLPx6ftGyjQ=
+github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.18.1 h1:M1GfJqGRrBrrGGsbxzV5dqM2U2ApXefZCQpkukxYRLE=
+github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
 github.com/opentracing/opentracing-go v1.1.1-0.20190913142402-a7454ce5950e/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pires/go-proxyproto v0.6.1 h1:EBupykFmo22SDjv4fQVQd2J9NOoLPmyZA/15ldOGkPw=
 github.com/pires/go-proxyproto v0.6.1/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
@@ -139,6 +206,11 @@ github.com/tklauser/go-sysconf v0.3.9 h1:JeUVdAOWhhxVcU6Eqr/ATFHgXk/mmiItdKeJPev
 github.com/tklauser/go-sysconf v0.3.9/go.mod h1:11DU/5sG7UexIrp/O6g35hrWzu0JxlwQ3LSFUzyeuhs=
 github.com/tklauser/numcpus v0.3.0 h1:ILuRUQBtssgnxw0XXIjKUC56fgnOrFoQQ/4+DeU2biQ=
 github.com/tklauser/numcpus v0.3.0/go.mod h1:yFGUr7TUHQRAhyqBcEg0Ge34zDBAsIvJJcyE6boqnA8=
+github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc h1:R83G5ikgLMxrBvLh22JhdfI8K6YXEPHx5P03Uu3DRs4=
+github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.opentelemetry.io/otel v0.7.0/go.mod h1:aZMyHG5TqDOXEgH2tyLiXSUKly1jT3yqE9PmrzIeCdo=
@@ -159,6 +231,10 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.1 h1:OJxoQ/rynoF0dcCdI7cLPktw/hR2cueqYfjm43oqK38=
+golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -167,11 +243,28 @@ golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211020060615-d418f374d309/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211201190559-0a0e4e1bb54c/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f h1:oA4XRj0qtSt8Yo1Zms0CUlsT3KG69V2UGQWPBxujDmc=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -180,35 +273,61 @@ golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201118182958-a01c418693c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201218084310-7d0127a74742/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210110051926-789bb1bd4061/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210123111255-9b0068b26619/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210816074244-15123e1e1f71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9 h1:nhht2DYV/Sn3qOayu8lM+cU1ii9sTLUeBQwQQfUHtrs=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8 h1:OH54vjqzRWmbJ62fjuhxy7AxFFgoHN0/DPc/UrL8cAs=
 golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad h1:ntjMns5wyP/fN65tdBD4g8J5w8n015+iIIs9rtjXkY0=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -223,7 +342,14 @@ golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo=
+golang.org/x/tools v0.1.8 h1:P1HhGGuLW4aAclzjtmJdf0mJOjVUZUzOTqkAkWL+l6w=
+golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
@@ -235,8 +361,6 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20191009194640-548a555dbc03/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20220303160752-862486edd9cc h1:fb/ViRpv3ln/LvbqZtTpoOd1YQDNH12gaGZreoSFovE=
-google.golang.org/genproto v0.0.0-20220303160752-862486edd9cc/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
 google.golang.org/genproto v0.0.0-20220317150908-0efb43f6373e h1:fNKDNuUyC4WH+inqDMpfXDdfvwfYILbsX+oskGZ8hxg=
 google.golang.org/genproto v0.0.0-20220317150908-0efb43f6373e/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -246,8 +370,6 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.44.0 h1:weqSxi/TMs1SqFRMHCtBgXRs8k3X39QIDEZ0pRcttUg=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0 h1:NEpgUqV3Z+ZjkqMsxMg11IaDrXY4RY6CQukSGK0uI1M=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -269,6 +391,7 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -276,8 +399,14 @@ gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.2.1/go.mod h1:lPVVZ2BS5TfnjLyizF7o7hv7j9/L+8cZY2hLyjP9cGY=
+honnef.co/go/tools v0.2.2 h1:MNh1AVMyVX23VUHE2O27jm6lNj3vjO5DexS4A1xvnzk=
+honnef.co/go/tools v0.2.2/go.mod h1:lPVVZ2BS5TfnjLyizF7o7hv7j9/L+8cZY2hLyjP9cGY=
+rogchap.com/v8go v0.7.0/go.mod h1:MxgP3pL2MW4dpme/72QRs8sgNMmM0pRc8DPhcuLWPAs=
--- a/internal/apps/app_cmd.go
+++ b/internal/apps/app_cmd.go
@@ -213,7 +213,16 @@ func (this *AppCmd) runStop() {
 		return
 	}

-	_, _ = this.sock.Send(&gosock.Command{Code: "stop"})
+	// 从systemd中停止
+	if runtime.GOOS == "linux" {
+		systemctl, _ := exec.LookPath("systemctl")
+		if len(systemctl) > 0 {
+			_ = exec.Command(systemctl, "stop", teaconst.SystemdServiceName).Run()
+		}
+	}
+
+	// 如果仍在运行，则发送停止指令
+	_, _ = this.sock.SendTimeout(&gosock.Command{Code: "stop"}, 1*time.Second)

 	fmt.Println(this.product+" stopped ok, pid:", types.String(pid))
 }
--- a/internal/apps/log_writer.go
+++ b/internal/apps/log_writer.go
@@ -1,10 +1,12 @@
 package apps

 import (
+	"github.com/TeaOSLab/EdgeNode/internal/goman"
+	"github.com/TeaOSLab/EdgeNode/internal/utils"
+	"github.com/TeaOSLab/EdgeNode/internal/utils/sizes"
 	"github.com/iwind/TeaGo/Tea"
 	"github.com/iwind/TeaGo/files"
-	"github.com/iwind/TeaGo/logs"
-	"github.com/iwind/TeaGo/utils/time"
+	timeutil "github.com/iwind/TeaGo/utils/time"
 	"log"
 	"os"
 	"runtime"
@@ -13,27 +15,55 @@ import (
 )

 type LogWriter struct {
-	fileAppender *files.Appender
+	fp *os.File
+	c  chan string
 }

 func (this *LogWriter) Init() {
 	// 创建目录
-	dir := files.NewFile(Tea.LogDir())
+	var dir = files.NewFile(Tea.LogDir())
 	if !dir.Exists() {
 		err := dir.Mkdir()
 		if err != nil {
-			log.Println("[error]" + err.Error())
+			log.Println("[LOG]create log dir failed: " + err.Error())
 		}
 	}

-	logFile := files.NewFile(Tea.LogFile("run.log"))
-
 	// 打开要写入的日志文件
-	appender, err := logFile.Appender()
+	var logPath = Tea.LogFile("run.log")
+	fp, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
 	if err != nil {
-		logs.Error(err)
+		log.Println("[LOG]open log file failed: " + err.Error())
 	} else {
-		this.fileAppender = appender
+		this.fp = fp
+	}
+
+	this.c = make(chan string, 1024)
+
+	// 异步写入文件
+	var maxFileSize = 2 * sizes.G // 文件最大尺寸，超出此尺寸则清空
+	if fp != nil {
+		goman.New(func() {
+			var totalSize int64 = 0
+			stat, err := fp.Stat()
+			if err == nil {
+				totalSize = stat.Size()
+			}
+
+			for message := range this.c {
+				totalSize += int64(len(message))
+				_, err := fp.WriteString(timeutil.Format("Y/m/d H:i:s ") + message + "\n")
+				if err != nil {
+					log.Println("[LOG]write log failed: " + err.Error())
+				} else {
+					// 如果太大则Truncate
+					if totalSize > maxFileSize {
+						_ = fp.Truncate(0)
+						totalSize = 0
+					}
+				}
+			}
+		})
 	}
 }

@@ -48,7 +78,7 @@ func (this *LogWriter) Write(message string) {
 			var ok bool
 			_, file, line, ok = runtime.Caller(callDepth)
 			if ok {
-				file = this.packagePath(file)
+				file = utils.RemoveWorkspace(this.packagePath(file))
 			}
 		}

@@ -59,18 +89,15 @@ func (this *LogWriter) Write(message string) {
 		}
 	}

-	if this.fileAppender != nil {
-		_, err := this.fileAppender.AppendString(timeutil.Format("Y/m/d H:i:s ") + message + "\n")
-		if err != nil {
-			log.Println("[error]" + err.Error())
-		}
-	}
+	this.c <- message
 }

 func (this *LogWriter) Close() {
-	if this.fileAppender != nil {
-		_ = this.fileAppender.Close()
+	if this.fp != nil {
+		_ = this.fp.Close()
 	}
+
+	close(this.c)
 }

 func (this *LogWriter) packagePath(path string) string {
--- a/internal/caches/errors.go
+++ b/internal/caches/errors.go
@@ -12,6 +12,7 @@ var (
 	ErrEntityTooLarge     = errors.New("entity too large")
 	ErrWritingUnavailable = errors.New("writing unavailable")
 	ErrWritingQueueFull   = errors.New("writing queue full")
+	ErrTooManyOpenFiles   = errors.New("too many open files")
 )

 // CapacityError 容量错误
@@ -36,7 +37,8 @@ func CanIgnoreErr(err error) bool {
 	if err == ErrFileIsWriting ||
 		err == ErrEntityTooLarge ||
 		err == ErrWritingUnavailable ||
-		err == ErrWritingQueueFull {
+		err == ErrWritingQueueFull ||
+		err == ErrTooManyOpenFiles {
 		return true
 	}
 	_, ok := err.(*CapacityError)
--- a/internal/caches/list_file_db.go
+++ b/internal/caches/list_file_db.go
@@ -58,6 +58,7 @@ func (this *FileListDB) Open(dbPath string) error {
 	writeDB.SetMaxOpenConns(1)

 	// TODO 耗时过长，暂时不整理数据库
+	// TODO 需要根据行数来判断是否VACUUM
 	/**_, err = db.Exec("VACUUM")
 	if err != nil {
 		return err
@@ -109,7 +110,7 @@ func (this *FileListDB) Init() error {
 	this.total = total

 	// 常用语句
-	this.existsByHashStmt, err = this.readDB.Prepare(`SELECT "expiredAt" FROM "` + this.itemsTableName + `" WHERE "hash"=? AND expiredAt>? LIMIT 1`)
+	this.existsByHashStmt, err = this.readDB.Prepare(`SELECT "expiredAt" FROM "` + this.itemsTableName + `" INDEXED BY "hash" WHERE "hash"=? AND expiredAt>? LIMIT 1`)
 	if err != nil {
 		return err
 	}
@@ -354,7 +355,7 @@ func (this *FileListDB) Close() error {
 func (this *FileListDB) initTables(times int) error {
 	{
 		// expiredAt - 过期时间，用来判断有无过期
-		// staleAt - 陈旧最大时间，用来清理缓存
+		// staleAt - 过时缓存最大时间，用来清理缓存
 		_, err := this.writeDB.Exec(`CREATE TABLE IF NOT EXISTS "` + this.itemsTableName + `" (
  "id" integer NOT NULL PRIMARY KEY AUTOINCREMENT,
  "hash" varchar(32),
@@ -370,15 +371,9 @@ func (this *FileListDB) initTables(times int) error {
  "serverId" integer
 );

-CREATE INDEX IF NOT EXISTS "createdAt"
-ON "` + this.itemsTableName + `" (
-  "createdAt" ASC
-);
-
-CREATE INDEX IF NOT EXISTS "expiredAt"
-ON "` + this.itemsTableName + `" (
-  "expiredAt" ASC
-);
+DROP INDEX IF EXISTS "createdAt";
+DROP INDEX IF EXISTS "expiredAt";
+DROP INDEX IF EXISTS "serverId";

 CREATE INDEX IF NOT EXISTS "staleAt"
 ON "` + this.itemsTableName + `" (
@@ -389,11 +384,6 @@ CREATE UNIQUE INDEX IF NOT EXISTS "hash"
 ON "` + this.itemsTableName + `" (
  "hash" ASC
 );
-
-CREATE INDEX IF NOT EXISTS "serverId"
-ON "` + this.itemsTableName + `" (
-  "serverId" ASC
-);
 `)

 		if err != nil {
--- a/internal/caches/manager.go
+++ b/internal/caches/manager.go
@@ -61,7 +61,7 @@ func (this *Manager) UpdatePolicies(newPolicies []*serverconfigs.HTTPCachePolicy
 	// 停止旧有的
 	for _, oldPolicy := range this.policyMap {
 		if !lists.ContainsInt64(newPolicyIds, oldPolicy.Id) {
-			remotelogs.Error("CACHE", "remove policy "+strconv.FormatInt(oldPolicy.Id, 10))
+			remotelogs.Println("CACHE", "remove policy "+strconv.FormatInt(oldPolicy.Id, 10))
 			delete(this.policyMap, oldPolicy.Id)
 			storage, ok := this.storageMap[oldPolicy.Id]
 			if ok {
--- a/internal/caches/max_open_files.go
+++ b/internal/caches/max_open_files.go
@@ -0,0 +1,98 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package caches
+
+import (
+	teaconst "github.com/TeaOSLab/EdgeNode/internal/const"
+	"github.com/TeaOSLab/EdgeNode/internal/goman"
+	"sync/atomic"
+	"time"
+)
+
+const (
+	minOpenFilesValue int32 = 2
+	maxOpenFilesValue int32 = 65535
+
+	modeSlow int32 = 1
+	modeFast int32 = 2
+)
+
+// MaxOpenFiles max open files manager
+type MaxOpenFiles struct {
+	step         int32
+	maxOpenFiles int32
+	ptr          *int32
+	ticker       *time.Ticker
+	mode         int32
+
+	lastOpens    int32
+	currentOpens int32
+}
+
+func NewMaxOpenFiles(step int32) *MaxOpenFiles {
+	if step <= 0 {
+		step = 2
+	}
+	var f = &MaxOpenFiles{
+		step:         step,
+		maxOpenFiles: 2,
+	}
+	if teaconst.DiskIsFast {
+		f.maxOpenFiles = 32
+	}
+	f.ptr = &f.maxOpenFiles
+	f.ticker = time.NewTicker(1 * time.Second)
+	f.init()
+	return f
+}
+
+func (this *MaxOpenFiles) init() {
+	goman.New(func() {
+		for range this.ticker.C {
+			var mod = atomic.LoadInt32(&this.mode)
+			switch mod {
+			case modeSlow:
+				// we decrease more quickly, with more steps
+				if atomic.AddInt32(this.ptr, -this.step*2) <= 0 {
+					atomic.StoreInt32(this.ptr, minOpenFilesValue)
+				}
+			case modeFast:
+				// we increase only when file opens increases
+				var currentOpens = atomic.LoadInt32(&this.currentOpens)
+				if currentOpens > this.lastOpens {
+					if atomic.AddInt32(this.ptr, this.step) >= maxOpenFilesValue {
+						atomic.StoreInt32(this.ptr, maxOpenFilesValue)
+					}
+				}
+				this.lastOpens = currentOpens
+				atomic.StoreInt32(&this.currentOpens, 0)
+			}
+
+			// reset mod
+			atomic.StoreInt32(&this.mode, 0)
+		}
+	})
+}
+
+func (this *MaxOpenFiles) Fast() {
+	if atomic.LoadInt32(&this.mode) == 0 {
+		this.mode = modeFast
+	}
+	atomic.AddInt32(&this.currentOpens, 1)
+}
+
+func (this *MaxOpenFiles) Slow() {
+	atomic.StoreInt32(&this.mode, modeSlow)
+}
+
+func (this *MaxOpenFiles) Max() int32 {
+	if atomic.LoadInt32(&this.mode) == modeSlow {
+		return 0
+	}
+
+	var v = atomic.LoadInt32(this.ptr)
+	if v <= minOpenFilesValue {
+		return minOpenFilesValue
+	}
+	return v
+}
--- a/internal/caches/max_open_files_test.go
+++ b/internal/caches/max_open_files_test.go
@@ -0,0 +1,28 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved. Official site: https://goedge.cn .
+
+package caches_test
+
+import (
+	"github.com/TeaOSLab/EdgeNode/internal/caches"
+	"testing"
+	"time"
+)
+
+func TestNewMaxOpenFiles(t *testing.T) {
+	var maxOpenFiles = caches.NewMaxOpenFiles(2)
+	maxOpenFiles.Fast()
+	t.Log(maxOpenFiles.Max())
+
+	maxOpenFiles.Fast()
+	time.Sleep(1 * time.Second)
+	t.Log(maxOpenFiles.Max())
+
+	maxOpenFiles.Slow()
+	t.Log(maxOpenFiles.Max())
+
+	maxOpenFiles.Slow()
+	t.Log(maxOpenFiles.Max())
+
+	maxOpenFiles.Slow()
+	t.Log(maxOpenFiles.Max())
+}
--- a/internal/caches/open_file.go
+++ b/internal/caches/open_file.go
@@ -14,11 +14,12 @@ type OpenFile struct {
 	version int64
 }

-func NewOpenFile(fp *os.File, meta []byte, header []byte) *OpenFile {
+func NewOpenFile(fp *os.File, meta []byte, header []byte, version int64) *OpenFile {
 	return &OpenFile{
-		fp:     fp,
-		meta:   meta,
-		header: header,
+		fp:      fp,
+		meta:    meta,
+		header:  header,
+		version: version,
 	}
 }

--- a/internal/caches/open_file_cache.go
+++ b/internal/caches/open_file_cache.go
@@ -9,6 +9,7 @@ import (
 	"github.com/iwind/TeaGo/logs"
 	"github.com/iwind/TeaGo/types"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"time"
 )
@@ -43,7 +44,7 @@ func NewOpenFileCache(maxSize int) (*OpenFileCache, error) {

 	goman.New(func() {
 		for event := range watcher.Events {
-			if event.Op&fsnotify.Chmod != fsnotify.Chmod {
+			if runtime.GOOS == "linux" || event.Op&fsnotify.Chmod != fsnotify.Chmod {
 				cache.Close(event.Name)
 			}
 		}
@@ -77,6 +78,7 @@ func (this *OpenFileCache) Put(filename string, file *OpenFile) {
 	} else {
 		_ = this.watcher.Add(filename)
 		pool = NewOpenFilePool(filename)
+		pool.version = file.version
 		this.poolMap[filename] = pool
 		success = pool.Put(file)
 	}
--- a/internal/caches/open_file_pool.go
+++ b/internal/caches/open_file_pool.go
@@ -45,7 +45,7 @@ func (this *OpenFilePool) Get() (*OpenFile, bool) {
 }

 func (this *OpenFilePool) Put(file *OpenFile) bool {
-	if file.version > 0 && file.version != this.version {
+	if this.version > 0 && file.version > 0 && file.version != this.version {
 		_ = file.Close()
 		return false
 	}
--- a/internal/caches/open_file_pool_test.go
+++ b/internal/caches/open_file_pool_test.go
@@ -11,7 +11,7 @@ func TestOpenFilePool_Get(t *testing.T) {
 	var pool = caches.NewOpenFilePool("a")
 	t.Log(pool.Filename())
 	t.Log(pool.Get())
-	t.Log(pool.Put(caches.NewOpenFile(nil, nil, []byte{})))
+	t.Log(pool.Put(caches.NewOpenFile(nil, nil, nil, 0)))
 	t.Log(pool.Get())
 	t.Log(pool.Get())
 }
--- a/internal/caches/reader_file.go
+++ b/internal/caches/reader_file.go
@@ -67,17 +67,17 @@ func (this *FileReader) InitAutoDiscard(autoDiscard bool) error {

 	this.expiresAt = int64(binary.BigEndian.Uint32(buf[:SizeExpiresAt]))

-	status := types.Int(string(buf[SizeExpiresAt : SizeExpiresAt+SizeStatus]))
+	status := types.Int(string(buf[OffsetStatus : OffsetStatus+SizeStatus]))
 	if status < 100 || status > 999 {
 		return errors.New("invalid status")
 	}
 	this.status = status

 	// URL
-	urlLength := binary.BigEndian.Uint32(buf[SizeExpiresAt+SizeStatus : SizeExpiresAt+SizeStatus+SizeURLLength])
+	urlLength := binary.BigEndian.Uint32(buf[OffsetURLLength : OffsetURLLength+SizeURLLength])

 	// header
-	headerSize := int(binary.BigEndian.Uint32(buf[SizeExpiresAt+SizeStatus+SizeURLLength : SizeExpiresAt+SizeStatus+SizeURLLength+SizeHeaderLength]))
+	headerSize := int(binary.BigEndian.Uint32(buf[OffsetHeaderLength : OffsetHeaderLength+SizeHeaderLength]))
 	if headerSize == 0 {
 		return nil
 	}
@@ -86,7 +86,7 @@ func (this *FileReader) InitAutoDiscard(autoDiscard bool) error {

 	// body
 	this.bodyOffset = this.headerOffset + int64(headerSize)
-	bodySize := int(binary.BigEndian.Uint64(buf[SizeExpiresAt+SizeStatus+SizeURLLength+SizeHeaderLength : SizeExpiresAt+SizeStatus+SizeURLLength+SizeHeaderLength+SizeBodyLength]))
+	bodySize := int(binary.BigEndian.Uint64(buf[OffsetBodyLength : OffsetBodyLength+SizeBodyLength]))
 	if bodySize == 0 {
 		isOk = true
 		return nil
@@ -338,6 +338,11 @@ func (this *FileReader) ContainsRange(r rangeutils.Range) (r2 rangeutils.Range,
 	return r, true
 }

+// FP 原始的文件句柄
+func (this *FileReader) FP() *os.File {
+	return this.fp
+}
+
 func (this *FileReader) Close() error {
 	if this.openFileCache != nil {
 		if this.isClosed {
@@ -348,7 +353,9 @@ func (this *FileReader) Close() error {
 		if this.openFile != nil {
 			this.openFileCache.Put(this.fp.Name(), this.openFile)
 		} else {
-			this.openFileCache.Put(this.fp.Name(), NewOpenFile(this.fp, this.meta, this.header))
+			var cacheMeta = make([]byte, len(this.meta))
+			copy(cacheMeta, this.meta)
+			this.openFileCache.Put(this.fp.Name(), NewOpenFile(this.fp, cacheMeta, this.header, this.LastModified()))
 		}
 		return nil
 	}
@@ -367,5 +374,12 @@ func (this *FileReader) readToBuff(fp *os.File, buf []byte) (ok bool, err error)
 func (this *FileReader) discard() error {
 	_ = this.fp.Close()
 	this.isClosed = true
+
+	// close open file cache
+	if this.openFileCache != nil {
+		this.openFileCache.Close(this.fp.Name())
+	}
+
+	// remove file
 	return os.Remove(this.fp.Name())
 }
--- a/internal/caches/reader_memory.go
+++ b/internal/caches/reader_memory.go
@@ -25,7 +25,7 @@ func (this *MemoryReader) TypeName() string {
 }

 func (this *MemoryReader) ExpiresAt() int64 {
-	return this.item.ExpiredAt
+	return this.item.ExpiresAt
 }

 func (this *MemoryReader) Status() int {
--- a/internal/caches/reader_memory_test.go
+++ b/internal/caches/reader_memory_test.go
@@ -4,7 +4,7 @@ import "testing"

 func TestMemoryReader_Header(t *testing.T) {
 	item := &MemoryItem{
-		ExpiredAt:   0,
+		ExpiresAt:   0,
 		HeaderValue: []byte("0123456789"),
 		BodyValue:   nil,
 		Status:      2000,
@@ -22,7 +22,7 @@ func TestMemoryReader_Header(t *testing.T) {

 func TestMemoryReader_Body(t *testing.T) {
 	item := &MemoryItem{
-		ExpiredAt:   0,
+		ExpiresAt:   0,
 		HeaderValue: nil,
 		BodyValue:   []byte("0123456789"),
 		Status:      2000,
@@ -40,7 +40,7 @@ func TestMemoryReader_Body(t *testing.T) {

 func TestMemoryReader_Body_Range(t *testing.T) {
 	item := &MemoryItem{
-		ExpiredAt:   0,
+		ExpiresAt:   0,
 		HeaderValue: nil,
 		BodyValue:   []byte("0123456789"),
 		Status:      2000,
--- a/internal/caches/storage_file.go
+++ b/internal/caches/storage_file.go
@@ -37,13 +37,19 @@ import (
 )

 const (
-	SizeExpiresAt    = 4
-	SizeStatus       = 3
-	SizeURLLength    = 4
-	SizeHeaderLength = 4
-	SizeBodyLength   = 8
+	SizeExpiresAt      = 4
+	OffsetExpiresAt    = 0
+	SizeStatus         = 3
+	OffsetStatus       = SizeExpiresAt
+	SizeURLLength      = 4
+	OffsetURLLength    = OffsetStatus + SizeStatus
+	SizeHeaderLength   = 4
+	OffsetHeaderLength = OffsetURLLength + SizeURLLength
+	SizeBodyLength     = 8
+	OffsetBodyLength   = OffsetHeaderLength + SizeHeaderLength

-	SizeMeta = SizeExpiresAt + SizeStatus + SizeURLLength + SizeHeaderLength + SizeBodyLength
+	SizeMeta  = SizeExpiresAt + SizeStatus + SizeURLLength + SizeHeaderLength + SizeBodyLength
+	OffsetKey = SizeMeta
 )

 const (
@@ -51,11 +57,16 @@ const (
 	HotItemSize                    = 1024         // 热点数据数量
 	HotItemLifeSeconds       int64 = 3600         // 热点数据生命周期
 	FileToMemoryMaxSize            = 32 * sizes.M // 可以从文件写入到内存的最大文件尺寸
+	FileTmpSuffix                  = ".tmp"
 )

 var sharedWritingFileKeyMap = map[string]zero.Zero{} // key => bool
 var sharedWritingFileKeyLocker = sync.Mutex{}

+var maxOpenFiles = NewMaxOpenFiles(2)
+
+const maxOpenFilesSlowCost = 500 * time.Microsecond // 0.5ms
+
 // FileStorage 文件缓存
 //   文件结构：
 //    [expires time] | [ status ] | [url length] | [header length] | [body length] | [url] [header data] [body data]
@@ -245,7 +256,7 @@ func (this *FileStorage) Init() error {
 		var count = stat.Count
 		var size = stat.Size

-		cost := time.Since(before).Seconds() * 1000
+		var cost = time.Since(before).Seconds() * 1000
 		sizeMB := strconv.FormatInt(size, 10) + " Bytes"
 		if size > 1*sizes.G {
 			sizeMB = fmt.Sprintf("%.3f G", float64(size)/float64(sizes.G))
@@ -369,7 +380,16 @@ func (this *FileStorage) openReader(key string, allowMemory bool, useStale bool,
 }

 // OpenWriter 打开缓存文件等待写入
-func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, size int64, maxSize int64, isPartial bool) (Writer, error) {
+func (this *FileStorage) OpenWriter(key string, expiresAt int64, status int, size int64, maxSize int64, isPartial bool) (Writer, error) {
+	return this.openWriter(key, expiresAt, status, size, maxSize, isPartial, false)
+}
+
+// OpenFlushWriter 打开从其他媒介直接刷入的写入器
+func (this *FileStorage) OpenFlushWriter(key string, expiresAt int64, status int) (Writer, error) {
+	return this.openWriter(key, expiresAt, status, -1, -1, false, true)
+}
+
+func (this *FileStorage) openWriter(key string, expiredAt int64, status int, size int64, maxSize int64, isPartial bool, isFlushing bool) (Writer, error) {
 	// 是否正在退出
 	if teaconst.IsQuiting {
 		return nil, ErrWritingUnavailable
@@ -387,7 +407,7 @@ func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, siz
 		maxMemorySize = maxSize
 	}
 	var memoryStorage = this.memoryStorage
-	if !isPartial && memoryStorage != nil && ((size > 0 && size < maxMemorySize) || size < 0) {
+	if !isFlushing && !isPartial && memoryStorage != nil && ((size > 0 && size < maxMemorySize) || size < 0) {
 		writer, err := memoryStorage.OpenWriter(key, expiredAt, status, size, maxMemorySize, false)
 		if err == nil {
 			return writer, nil
@@ -407,6 +427,12 @@ func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, siz
 		sharedWritingFileKeyLocker.Unlock()
 		return nil, ErrFileIsWriting
 	}
+
+	if len(sharedWritingFileKeyMap) >= int(maxOpenFiles.Max()) {
+		sharedWritingFileKeyLocker.Unlock()
+		return nil, ErrTooManyOpenFiles
+	}
+
 	sharedWritingFileKeyMap[key] = zero.New()
 	sharedWritingFileKeyLocker.Unlock()
 	defer func() {
@@ -431,6 +457,8 @@ func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, siz
 	}

 	var hash = stringutil.Md5(key)
+
+	// TODO 可以只stat一次
 	var dir = this.options.Dir + "/p" + strconv.FormatInt(this.policy.Id, 10) + "/" + hash[:2] + "/" + hash[2:4]
 	_, err = os.Stat(dir)
 	if err != nil {
@@ -446,12 +474,27 @@ func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, siz
 	// 检查缓存是否已经生成
 	var cachePathName = dir + "/" + hash
 	var cachePath = cachePathName + ".cache"
+
+	// 关闭OpenFileCache
+	var openFileCache = this.openFileCache
+	if openFileCache != nil {
+		openFileCache.Close(cachePath)
+	}
+
 	stat, err := os.Stat(cachePath)
 	if err == nil && time.Now().Sub(stat.ModTime()) <= 1*time.Second {
 		// 防止并发连续写入
 		return nil, ErrFileIsWriting
 	}
-	var tmpPath = cachePath + ".tmp"
+	var tmpPath = cachePath
+	var existsFile = false
+	if stat != nil {
+		existsFile = true
+
+		// 如果已经存在，则增加一个.tmp后缀，防止读写冲突
+		tmpPath += FileTmpSuffix
+	}
+
 	if isPartial {
 		tmpPath = cachePathName + ".cache"
 	}
@@ -482,10 +525,20 @@ func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, siz
 		}
 	}

-	writer, err := os.OpenFile(tmpPath, os.O_CREATE|os.O_WRONLY, 0666)
+	var flags = os.O_CREATE | os.O_WRONLY
+	if isNewCreated && existsFile {
+		flags |= os.O_TRUNC
+	}
+	var before = time.Now()
+	writer, err := os.OpenFile(tmpPath, flags, 0666)
 	if err != nil {
 		return nil, err
 	}
+	if time.Since(before) >= maxOpenFilesSlowCost {
+		maxOpenFiles.Slow()
+	} else {
+		maxOpenFiles.Fast()
+	}

 	var removeOnFailure = true
 	defer func() {
@@ -510,60 +563,29 @@ func (this *FileStorage) OpenWriter(key string, expiredAt int64, status int, siz
 	}

 	if isNewCreated {
-		err = writer.Truncate(0)
-		if err != nil {
-			return nil, err
-		}
-
 		// 写入过期时间
-		bytes4 := make([]byte, 4)
-		{
-			binary.BigEndian.PutUint32(bytes4, uint32(expiredAt))
-			_, err = writer.Write(bytes4)
-			if err != nil {
-				return nil, err
-			}
-		}
+		var metaBytes = make([]byte, SizeMeta+len(key))
+		binary.BigEndian.PutUint32(metaBytes[OffsetExpiresAt:], uint32(expiredAt))

 		// 写入状态码
 		if status > 999 || status < 100 {
 			status = 200
 		}
-		_, err = writer.WriteString(strconv.Itoa(status))
-		if err != nil {
-			return nil, err
-		}
+		copy(metaBytes[OffsetStatus:], strconv.Itoa(status))

 		// 写入URL长度
-		{
-			binary.BigEndian.PutUint32(bytes4, uint32(len(key)))
-			_, err = writer.Write(bytes4)
-			if err != nil {
-				return nil, err
-			}
-		}
+		binary.BigEndian.PutUint32(metaBytes[OffsetURLLength:], uint32(len(key)))

 		// 写入Header Length
-		{
-			binary.BigEndian.PutUint32(bytes4, uint32(0))
-			_, err = writer.Write(bytes4)
-			if err != nil {
-				return nil, err
-			}
-		}
+		binary.BigEndian.PutUint32(metaBytes[OffsetHeaderLength:], uint32(0))

 		// 写入Body Length
-		{
-			b := make([]byte, SizeBodyLength)
-			binary.BigEndian.PutUint64(b, uint64(0))
-			_, err = writer.Write(b)
-			if err != nil {
-				return nil, err
-			}
-		}
+		binary.BigEndian.PutUint64(metaBytes[OffsetBodyLength:], uint64(0))

 		// 写入URL
-		_, err = writer.WriteString(key)
+		copy(metaBytes[OffsetKey:], key)
+
+		_, err = writer.Write(metaBytes)
 		if err != nil {
 			return nil, err
 		}
@@ -785,8 +807,9 @@ func (this *FileStorage) Stop() {

 	_ = this.list.Close()

-	if this.openFileCache != nil {
-		this.openFileCache.CloseAll()
+	var openFileCache = this.openFileCache
+	if openFileCache != nil {
+		openFileCache.CloseAll()
 	}

 	this.ignoreKeys.Reset()
@@ -811,6 +834,14 @@ func (this *FileStorage) IgnoreKey(key string) {
 	this.ignoreKeys.Push(key)
 }

+// CanSendfile 是否支持Sendfile
+func (this *FileStorage) CanSendfile() bool {
+	if this.options == nil {
+		return false
+	}
+	return this.options.EnableSendfile
+}
+
 // 绝对路径
 func (this *FileStorage) dir() string {
 	return this.options.Dir + "/p" + strconv.FormatInt(this.policy.Id, 10) + "/"
@@ -1178,12 +1209,21 @@ func (this *FileStorage) increaseHit(key string, hash string, reader Reader) {

 // 删除缓存文件
 func (this *FileStorage) removeCacheFile(path string) error {
+	var openFileCache = this.openFileCache
+	if openFileCache != nil {
+		openFileCache.Close(path)
+	}
+
 	var err = os.Remove(path)
 	if err == nil || os.IsNotExist(err) {
 		err = nil

 		// 删除Partial相关
-		_ = os.Remove(partialRangesFilePath(path))
+		var partialPath = partialRangesFilePath(path)
+		if openFileCache != nil {
+			openFileCache.Close(partialPath)
+		}
+		_ = os.Remove(partialPath)
 	}
 	return err
 }
--- a/internal/caches/storage_interface.go
+++ b/internal/caches/storage_interface.go
@@ -14,7 +14,10 @@ type StorageInterface interface {

 	// OpenWriter 打开缓存写入器等待写入
 	// size 和 maxSize 可能为-1
-	OpenWriter(key string, expiredAt int64, status int, size int64, maxSize int64, isPartial bool) (Writer, error)
+	OpenWriter(key string, expiresAt int64, status int, size int64, maxSize int64, isPartial bool) (Writer, error)
+
+	// OpenFlushWriter 打开从其他媒介直接刷入的写入器
+	OpenFlushWriter(key string, expiresAt int64, status int) (Writer, error)

 	// Delete 删除某个键值对应的缓存
 	Delete(key string) error
@@ -51,4 +54,7 @@ type StorageInterface interface {

 	// IgnoreKey 忽略某个Key，即不缓存某个Key
 	IgnoreKey(key string)
+
+	// CanSendfile 是否支持Sendfile
+	CanSendfile() bool
 }
--- a/internal/caches/storage_memory.go
+++ b/internal/caches/storage_memory.go
@@ -23,7 +23,7 @@ import (
 )

 type MemoryItem struct {
-	ExpiredAt   int64
+	ExpiresAt   int64
 	HeaderValue []byte
 	BodyValue   []byte
 	Status      int
@@ -32,7 +32,7 @@ type MemoryItem struct {
 }

 func (this *MemoryItem) IsExpired() bool {
-	return this.ExpiredAt < utils.UnixTime()
+	return this.ExpiresAt < utils.UnixTime()
 }

 type MemoryStorage struct {
@@ -118,7 +118,7 @@ func (this *MemoryStorage) OpenReader(key string, useStale bool, isPartial bool)
 		return nil, ErrNotFound
 	}

-	if useStale || (item.ExpiredAt > utils.UnixTime()) {
+	if useStale || (item.ExpiresAt > utils.UnixTime()) {
 		reader := NewMemoryReader(item)
 		err := reader.Init()
 		if err != nil {
@@ -160,7 +160,12 @@ func (this *MemoryStorage) OpenWriter(key string, expiredAt int64, status int, s
 	return this.openWriter(key, expiredAt, status, size, maxSize, true)
 }

-func (this *MemoryStorage) openWriter(key string, expiredAt int64, status int, size int64, maxSize int64, isDirty bool) (Writer, error) {
+// OpenFlushWriter 打开从其他媒介直接刷入的写入器
+func (this *MemoryStorage) OpenFlushWriter(key string, expiresAt int64, status int) (Writer, error) {
+	return this.openWriter(key, expiresAt, status, -1, -1, true)
+}
+
+func (this *MemoryStorage) openWriter(key string, expiresAt int64, status int, size int64, maxSize int64, isDirty bool) (Writer, error) {
 	// 待写入队列是否已满
 	if isDirty &&
 		this.parentStorage != nil &&
@@ -215,7 +220,7 @@ func (this *MemoryStorage) openWriter(key string, expiredAt int64, status int, s
 	}

 	isWriting = true
-	return NewMemoryWriter(this, key, expiredAt, status, isDirty, maxSize, func() {
+	return NewMemoryWriter(this, key, expiresAt, status, isDirty, maxSize, func() {
 		this.locker.Lock()
 		delete(this.writingKeyMap, key)
 		this.locker.Unlock()
@@ -347,6 +352,11 @@ func (this *MemoryStorage) IgnoreKey(key string) {
 	this.ignoreKeys.Push(key)
 }

+// CanSendfile 是否支持Sendfile
+func (this *MemoryStorage) CanSendfile() bool {
+	return false
+}
+
 // 计算Key Hash
 func (this *MemoryStorage) hash(key string) uint64 {
 	return xxhash.Sum64String(key)
@@ -466,7 +476,7 @@ func (this *MemoryStorage) flushItem(key string) {
 		return
 	}

-	writer, err := this.parentStorage.OpenWriter(key, item.ExpiredAt, item.Status, -1, -1, false)
+	writer, err := this.parentStorage.OpenFlushWriter(key, item.ExpiresAt, item.Status)
 	if err != nil {
 		if !CanIgnoreErr(err) {
 			remotelogs.Error("CACHE", "flush items failed: open writer failed: "+err.Error())
@@ -498,7 +508,7 @@ func (this *MemoryStorage) flushItem(key string) {
 	this.parentStorage.AddToList(&Item{
 		Type:       writer.ItemType(),
 		Key:        key,
-		ExpiredAt:  item.ExpiredAt,
+		ExpiredAt:  item.ExpiresAt,
 		HeaderSize: writer.HeaderSize(),
 		BodySize:   writer.BodySize(),
 	})
--- a/internal/caches/writer_file.go
+++ b/internal/caches/writer_file.go
@@ -127,8 +127,8 @@ func (this *FileWriter) Close() error {
 	err = this.rawWriter.Close()
 	if err != nil {
 		_ = os.Remove(path)
-	} else {
-		err = os.Rename(path, strings.Replace(path, ".tmp", "", 1))
+	} else if strings.HasSuffix(path, FileTmpSuffix) {
+		err = os.Rename(path, strings.Replace(path, FileTmpSuffix, "", 1))
 		if err != nil {
 			_ = os.Remove(path)
 		}
--- a/internal/caches/writer_memory.go
+++ b/internal/caches/writer_memory.go
@@ -30,7 +30,7 @@ func NewMemoryWriter(memoryStorage *MemoryStorage, key string, expiredAt int64,
 		key:       key,
 		expiredAt: expiredAt,
 		item: &MemoryItem{
-			ExpiredAt:  expiredAt,
+			ExpiresAt:  expiredAt,
 			ModifiedAt: time.Now().Unix(),
 			Status:     status,
 		},
--- a/internal/const/const.go
+++ b/internal/const/const.go
@@ -1,7 +1,7 @@
 package teaconst

 const (
-	Version = "0.4.5"
+	Version = "0.4.7"

 	ProductName = "Edge Node"
 	ProcessName = "edge-node"
--- a/internal/const/vars.go
+++ b/internal/const/vars.go
@@ -17,4 +17,6 @@ var (

 	IsQuiting    = false // 是否正在退出
 	EnableDBStat = false // 是否开启本地数据库统计
+
+	DiskIsFast = false // 是否为高速硬盘
 )
--- a/internal/encrypt/method.go
+++ b/internal/encrypt/method.go
@@ -1,12 +1,12 @@
 package encrypt

 type MethodInterface interface {
-	// 初始化
+	// Init 初始化
 	Init(key []byte, iv []byte) error

-	// 加密
+	// Encrypt 加密
 	Encrypt(src []byte) (dst []byte, err error)

-	// 解密
+	// Decrypt 解密
 	Decrypt(dst []byte) (src []byte, err error)
 }
--- a/internal/errors/error.go
+++ b/internal/errors/error.go
@@ -2,6 +2,7 @@ package errors

 import (
 	"errors"
+	"github.com/TeaOSLab/EdgeNode/internal/utils"
 	"path/filepath"
 	"runtime"
 	"strconv"
@@ -15,7 +16,7 @@ type errorObj struct {
 }

 func (this *errorObj) Error() string {
-	s := this.err.Error() + "\n  " + this.file
+	s := this.err.Error() + "\n  " + utils.RemoveWorkspace(this.file)
 	if len(this.funcName) > 0 {
 		s += ":" + this.funcName + "()"
 	}
@@ -23,7 +24,7 @@ func (this *errorObj) Error() string {
 	return s
 }

-// 新错误
+// New 新错误
 func New(errText string) error {
 	ptr, file, line, ok := runtime.Caller(1)
 	funcName := ""
@@ -39,7 +40,7 @@ func New(errText string) error {
 	}
 }

-// 包装已有错误
+// Wrap 包装已有错误
 func Wrap(err error) error {
 	if err == nil {
 		return nil
--- a/internal/firewalls/.gitignore
+++ b/internal/firewalls/.gitignore
@@ -0,0 +1 @@
+firewall_nftables_test.go
--- a/internal/firewalls/firewall.go
+++ b/internal/firewalls/firewall.go
@@ -1,10 +1,13 @@
 // Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+//go:build !plus
+// +build !plus

 package firewalls

 import (
 	"github.com/TeaOSLab/EdgeNode/internal/events"
 	"github.com/TeaOSLab/EdgeNode/internal/remotelogs"
+	"runtime"
 )

 var currentFirewall FirewallInterface
@@ -13,9 +16,7 @@ var currentFirewall FirewallInterface
 func init() {
 	events.On(events.EventLoaded, func() {
 		var firewall = Firewall()
-		if firewall.Name() == "mock" {
-			remotelogs.Warn("FIREWALL", "'firewalld' on this system should be enabled to block attackers more effectively")
-		} else {
+		if firewall.Name() != "mock" {
 			remotelogs.Println("FIREWALL", "found local firewall '"+firewall.Name()+"'")
 		}
 	})
@@ -28,7 +29,7 @@ func Firewall() FirewallInterface {
 	}

 	// firewalld
-	{
+	if runtime.GOOS == "linux" {
 		var firewalld = NewFirewalld()
 		if firewalld.IsReady() {
 			currentFirewall = firewalld
--- a/internal/firewalls/firewall_firewalld.go
+++ b/internal/firewalls/firewall_firewalld.go
@@ -27,6 +27,8 @@ func NewFirewalld() *Firewalld {
 		err := cmd.Run()
 		if err == nil {
 			firewalld.exe = path
+			// TODO check firewalld status with 'firewall-cmd --state' (running or not running),
+			//      but we should recover the state when firewalld state changes, maybe check it every minutes
 			firewalld.isReady = true
 			firewalld.init()
 		}
@@ -58,6 +60,11 @@ func (this *Firewalld) IsReady() bool {
 	return this.isReady
 }

+// IsMock 是否为模拟
+func (this *Firewalld) IsMock() bool {
+	return false
+}
+
 func (this *Firewalld) AllowPort(port int, protocol string) error {
 	if !this.isReady {
 		return nil
--- a/internal/firewalls/firewall_interface.go
+++ b/internal/firewalls/firewall_interface.go
@@ -10,6 +10,9 @@ type FirewallInterface interface {
 	// IsReady 是否已准备被调用
 	IsReady() bool

+	// IsMock 是否为模拟
+	IsMock() bool
+
 	// AllowPort 允许端口
 	AllowPort(port int, protocol string) error

--- a/internal/firewalls/firewall_mock.go
+++ b/internal/firewalls/firewall_mock.go
@@ -20,6 +20,11 @@ func (this *MockFirewall) IsReady() bool {
 	return true
 }

+// IsMock 是否为模拟
+func (this *MockFirewall) IsMock() bool {
+	return true
+}
+
 // AllowPort 允许端口
 func (this *MockFirewall) AllowPort(port int, protocol string) error {
 	_ = port
--- a/internal/iplibrary/ip2Region.go
+++ b/internal/iplibrary/ip2Region.go
@@ -99,7 +99,7 @@ func (this *IP2Region) MemorySearch(ipStr string) (ipInfo *IpInfo, err error) {
 		}
 	}
 	if dataPtr == 0 {
-		return nil, errors.New("not found")
+		return nil, nil
 	}

 	dataLen := (dataPtr >> 24) & 0xFF
--- a/internal/iplibrary/ip_item.go
+++ b/internal/iplibrary/ip_item.go
@@ -13,7 +13,7 @@ const (
 // IPItem IP条目
 type IPItem struct {
 	Type       string `json:"type"`
-	Id         int64  `json:"id"`
+	Id         uint64 `json:"id"`
 	IPFrom     uint64 `json:"ipFrom"`
 	IPTo       uint64 `json:"ipTo"`
 	ExpiredAt  int64  `json:"expiredAt"`
--- a/internal/iplibrary/ip_list.go
+++ b/internal/iplibrary/ip_list.go
@@ -13,9 +13,9 @@ var GlobalWhiteIPList = NewIPList()
 // IPList IP名单
 // TODO IP名单可以分片关闭，这样让每一片的数据量减少，查询更快
 type IPList struct {
-	itemsMap    map[int64]*IPItem // id => item
+	itemsMap    map[uint64]*IPItem // id => item
 	sortedItems []*IPItem
-	allItemsMap map[int64]*IPItem // id => item
+	allItemsMap map[uint64]*IPItem // id => item

 	expireList *expires.List

@@ -24,12 +24,12 @@ type IPList struct {

 func NewIPList() *IPList {
 	list := &IPList{
-		itemsMap:    map[int64]*IPItem{},
-		allItemsMap: map[int64]*IPItem{},
+		itemsMap:    map[uint64]*IPItem{},
+		allItemsMap: map[uint64]*IPItem{},
 	}

 	expireList := expires.NewList()
-	expireList.OnGC(func(itemId int64) {
+	expireList.OnGC(func(itemId uint64) {
 		list.Delete(itemId)
 	})
 	list.expireList = expireList
@@ -51,7 +51,7 @@ func (this *IPList) Sort() {
 	this.locker.Unlock()
 }

-func (this *IPList) Delete(itemId int64) {
+func (this *IPList) Delete(itemId uint64) {
 	this.locker.Lock()
 	this.deleteItem(itemId)
 	this.locker.Unlock()
@@ -198,7 +198,7 @@ func (this *IPList) lookupIP(ip uint64) *IPItem {

 // 在不加锁的情况下删除某个Item
 // 将会被别的方法引用，切记不能加锁
-func (this *IPList) deleteItem(itemId int64) {
+func (this *IPList) deleteItem(itemId uint64) {
 	_, ok := this.itemsMap[itemId]
 	if !ok {
 		return
--- a/internal/iplibrary/manager_ip_list.go
+++ b/internal/iplibrary/manager_ip_list.go
@@ -149,6 +149,10 @@ func (this *IPListManager) fetch() (hasNext bool, err error) {
 		Size:    this.pageSize,
 	})
 	if err != nil {
+		if rpc.IsConnError(err) {
+			remotelogs.Warn("IP_LIST_MANAGER", "rpc connection error: "+err.Error())
+			return false, nil
+		}
 		return false, err
 	}
 	items := itemsResp.IpItems
@@ -209,7 +213,7 @@ func (this *IPListManager) processItems(items []*pb.IPItem, fromRemote bool) {
 		changedLists[list] = zero.New()

 		if item.IsDeleted {
-			list.Delete(item.Id)
+			list.Delete(uint64(item.Id))

 			// 从WAF名单中删除
 			waf.SharedIPBlackList.RemoveIP(item.IpFrom, item.ServerId, fromRemote)
@@ -223,7 +227,7 @@ func (this *IPListManager) processItems(items []*pb.IPItem, fromRemote bool) {
 		}

 		list.AddDelay(&IPItem{
-			Id:         item.Id,
+			Id:         uint64(item.Id),
 			Type:       item.Type,
 			IPFrom:     utils.IP2Long(item.IpFrom),
 			IPTo:       utils.IP2Long(item.IpTo),
--- a/internal/metrics/stat.go
+++ b/internal/metrics/stat.go
@@ -3,9 +3,9 @@
 package metrics

 import (
-	"encoding/json"
-	"github.com/cespare/xxhash"
+	"github.com/TeaOSLab/EdgeNode/internal/utils/fnv"
 	"strconv"
+	"strings"
 )

 type Stat struct {
@@ -17,6 +17,6 @@ type Stat struct {
 }

 func SumStat(serverId int64, keys []string, time string, version int32, itemId int64) string {
-	keysData, _ := json.Marshal(keys)
-	return strconv.FormatUint(xxhash.Sum64String(strconv.FormatInt(serverId, 10)+"@"+string(keysData)+"@"+time+"@"+strconv.Itoa(int(version))+"@"+strconv.FormatInt(itemId, 10)), 10)
+	keysData := strings.Join(keys, "$EDGE$")
+	return strconv.FormatUint(fnv.HashString(strconv.FormatInt(serverId, 10)+"@"+keysData+"@"+time+"@"+strconv.Itoa(int(version))+"@"+strconv.FormatInt(itemId, 10)), 10)
 }
--- a/internal/nodes/client_conn_traffic.go
+++ b/internal/nodes/client_conn_traffic.go
@@ -20,20 +20,21 @@ func init() {
 		goman.New(func() {
 			for range ticker.C {
 				// 加入到数据队列中
-				if teaconst.InTrafficBytes > 0 {
+				var inBytes = atomic.LoadUint64(&teaconst.InTrafficBytes)
+				atomic.StoreUint64(&teaconst.InTrafficBytes, 0) // 重置数据
+				if inBytes > 0 {
 					monitor.SharedValueQueue.Add(nodeconfigs.NodeValueItemTrafficIn, maps.Map{
-						"total": teaconst.InTrafficBytes,
-					})
-				}
-				if teaconst.OutTrafficBytes > 0 {
-					monitor.SharedValueQueue.Add(nodeconfigs.NodeValueItemTrafficOut, maps.Map{
-						"total": teaconst.OutTrafficBytes,
+						"total": inBytes,
 					})
 				}

-				// 重置数据
-				atomic.StoreUint64(&teaconst.InTrafficBytes, 0)
-				atomic.StoreUint64(&teaconst.OutTrafficBytes, 0)
+				var outBytes = atomic.LoadUint64(&teaconst.OutTrafficBytes)
+				atomic.StoreUint64(&teaconst.OutTrafficBytes, 0) // 重置数据
+				if outBytes > 0 {
+					monitor.SharedValueQueue.Add(nodeconfigs.NodeValueItemTrafficOut, maps.Map{
+						"total": outBytes,
+					})
+				}
 			}
 		})
 	})
--- a/internal/nodes/http_client_pool.go
+++ b/internal/nodes/http_client_pool.go
@@ -29,7 +29,7 @@ type HTTPClientPool struct {

 // NewHTTPClientPool 获取新对象
 func NewHTTPClientPool() *HTTPClientPool {
-	pool := &HTTPClientPool{
+	var pool = &HTTPClientPool{
 		clientExpiredDuration: 3600 * time.Second,
 		clientsMap:            map[string]*HTTPClient{},
 	}
@@ -42,12 +42,16 @@ func NewHTTPClientPool() *HTTPClientPool {
 }

 // Client 根据地址获取客户端
-func (this *HTTPClientPool) Client(req *HTTPRequest, origin *serverconfigs.OriginConfig, originAddr string, proxyProtocol *serverconfigs.ProxyProtocolConfig, followRedirects bool) (rawClient *http.Client, err error) {
+func (this *HTTPClientPool) Client(req *HTTPRequest,
+	origin *serverconfigs.OriginConfig,
+	originAddr string,
+	proxyProtocol *serverconfigs.ProxyProtocolConfig,
+	followRedirects bool) (rawClient *http.Client, err error) {
 	if origin.Addr == nil {
 		return nil, errors.New("origin addr should not be empty (originId:" + strconv.FormatInt(origin.Id, 10) + ")")
 	}

-	key := origin.UniqueKey() + "@" + originAddr
+	var key = origin.UniqueKey() + "@" + originAddr

 	this.locker.Lock()
 	defer this.locker.Unlock()
@@ -58,11 +62,11 @@ func (this *HTTPClientPool) Client(req *HTTPRequest, origin *serverconfigs.Origi
 		return client.RawClient(), nil
 	}

-	maxConnections := origin.MaxConns
-	connectionTimeout := origin.ConnTimeoutDuration()
-	readTimeout := origin.ReadTimeoutDuration()
-	idleTimeout := origin.IdleTimeoutDuration()
-	idleConns := origin.MaxIdleConns
+	var maxConnections = origin.MaxConns
+	var connectionTimeout = origin.ConnTimeoutDuration()
+	var readTimeout = origin.ReadTimeoutDuration()
+	var idleTimeout = origin.IdleTimeoutDuration()
+	var idleConns = origin.MaxIdleConns

 	// 超时时间
 	if connectionTimeout <= 0 {
@@ -73,7 +77,7 @@ func (this *HTTPClientPool) Client(req *HTTPRequest, origin *serverconfigs.Origi
 		idleTimeout = 2 * time.Minute
 	}

-	numberCPU := runtime.NumCPU()
+	var numberCPU = runtime.NumCPU()
 	if numberCPU < 8 {
 		numberCPU = 8
 	}
@@ -138,11 +142,12 @@ func (this *HTTPClientPool) Client(req *HTTPRequest, origin *serverconfigs.Origi
 	rawClient = &http.Client{
 		Timeout:   readTimeout,
 		Transport: transport,
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+		CheckRedirect: func(targetReq *http.Request, via []*http.Request) error {
+			// 是否跟随
 			if followRedirects {
 				var schemeIsSame = true
 				for _, r := range via {
-					if r.URL.Scheme != req.URL.Scheme {
+					if r.URL.Scheme != targetReq.URL.Scheme {
 						schemeIsSame = false
 						break
 					}
@@ -163,7 +168,7 @@ func (this *HTTPClientPool) Client(req *HTTPRequest, origin *serverconfigs.Origi

 // 清理不使用的Client
 func (this *HTTPClientPool) cleanClients() {
-	ticker := time.NewTicker(this.clientExpiredDuration)
+	var ticker = time.NewTicker(this.clientExpiredDuration)
 	for range ticker.C {
 		currentAt := time.Now().Unix()

@@ -181,11 +186,11 @@ func (this *HTTPClientPool) cleanClients() {
 // 支持TOA
 func (this *HTTPClientPool) handleTOA(req *HTTPRequest, ctx context.Context, network string, originAddr string, connectionTimeout time.Duration) (net.Conn, error) {
 	// TODO 每个服务读取自身所属集群的TOA设置
-	toaConfig := sharedTOAManager.Config()
+	var toaConfig = sharedTOAManager.Config()
 	if toaConfig != nil && toaConfig.IsOn {
-		retries := 3
+		var retries = 3
 		for i := 1; i <= retries; i++ {
-			port := int(toaConfig.RandLocalPort())
+			var port = int(toaConfig.RandLocalPort())
 			// TODO 思考是否支持X-Real-IP/X-Forwarded-IP
 			err := sharedTOAManager.SendMsg("add:" + strconv.Itoa(port) + ":" + req.requestRemoteAddr(true))
 			if err != nil {
@@ -223,7 +228,7 @@ func (this *HTTPClientPool) handlePROXYProtocol(conn net.Conn, req *HTTPRequest,
 		if reqConn != nil {
 			destAddr = reqConn.(net.Conn).LocalAddr()
 		}
-		header := proxyproto.Header{
+		var header = proxyproto.Header{
 			Version:           byte(proxyProtocol.Version),
 			Command:           proxyproto.PROXY,
 			TransportProtocol: transportProtocol,
--- a/internal/nodes/http_request.go
+++ b/internal/nodes/http_request.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
+	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
 	teaconst "github.com/TeaOSLab/EdgeNode/internal/const"
 	"github.com/TeaOSLab/EdgeNode/internal/iplibrary"
@@ -47,6 +48,13 @@ type HTTPRequest struct {
 	IsHTTP     bool
 	IsHTTPS    bool

+	// 共享参数
+	nodeConfig *nodeconfigs.NodeConfig
+
+	// ln request
+	isLnRequest  bool
+	lnRemoteAddr string
+
 	// 内部参数
 	isSubRequest         bool
 	writer               *HTTPWriter
@@ -85,7 +93,8 @@ type HTTPRequest struct {

 	logAttrs map[string]string

-	disableLog bool // 此请求中关闭Log
+	disableLog bool // 是否在当前请求中关闭Log
+	forceLog   bool // 是否强制记录日志

 	// script相关操作
 	isDone bool
@@ -145,6 +154,9 @@ func (this *HTTPRequest) Do() {
 		return
 	}

+	// 是否为低级别节点
+	this.isLnRequest = this.checkLnRequest()
+
 	// 回调事件
 	this.onInit()
 	if this.writer.isFinished {
@@ -152,58 +164,60 @@ func (this *HTTPRequest) Do() {
 		return
 	}

-	// 特殊URL处理
-	if len(this.rawURI) > 1 && this.rawURI[1] == '.' {
-		// ACME
-		// TODO 需要配置是否启用ACME检测
-		if strings.HasPrefix(this.rawURI, "/.well-known/acme-challenge/") {
-			this.doACME()
+	if !this.isLnRequest {
+		// 特殊URL处理
+		if len(this.rawURI) > 1 && this.rawURI[1] == '.' {
+			// ACME
+			// TODO 需要配置是否启用ACME检测
+			if strings.HasPrefix(this.rawURI, "/.well-known/acme-challenge/") {
+				this.doACME()
+				this.doEnd()
+				return
+			}
+		}
+
+		// 套餐
+		if this.ReqServer.UserPlan != nil && !this.ReqServer.UserPlan.IsAvailable() {
+			this.doPlanExpires()
 			this.doEnd()
 			return
 		}
-	}

-	// 套餐
-	if this.ReqServer.UserPlan != nil && !this.ReqServer.UserPlan.IsAvailable() {
-		this.doPlanExpires()
-		this.doEnd()
-		return
-	}
-
-	// 流量限制
-	if this.ReqServer.TrafficLimit != nil && this.ReqServer.TrafficLimit.IsOn && !this.ReqServer.TrafficLimit.IsEmpty() && this.ReqServer.TrafficLimitStatus != nil && this.ReqServer.TrafficLimitStatus.IsValid() {
-		this.doTrafficLimit()
-		this.doEnd()
-		return
-	}
-
-	// WAF
-	if this.web.FirewallRef != nil && this.web.FirewallRef.IsOn {
-		if this.doWAFRequest() {
+		// 流量限制
+		if this.ReqServer.TrafficLimit != nil && this.ReqServer.TrafficLimit.IsOn && !this.ReqServer.TrafficLimit.IsEmpty() && this.ReqServer.TrafficLimitStatus != nil && this.ReqServer.TrafficLimitStatus.IsValid() {
+			this.doTrafficLimit()
 			this.doEnd()
 			return
 		}
-	}

-	// 访问控制
-	if !this.isSubRequest && this.web.Auth != nil && this.web.Auth.IsOn {
-		if this.doAuth() {
-			this.doEnd()
-			return
+		// WAF
+		if this.web.FirewallRef != nil && this.web.FirewallRef.IsOn {
+			if this.doWAFRequest() {
+				this.doEnd()
+				return
+			}
 		}
-	}

-	// 自动跳转到HTTPS
-	if this.IsHTTP && this.web.RedirectToHttps != nil && this.web.RedirectToHttps.IsOn {
-		if this.doRedirectToHTTPS(this.web.RedirectToHttps) {
-			this.doEnd()
-			return
+		// 访问控制
+		if !this.isSubRequest && this.web.Auth != nil && this.web.Auth.IsOn {
+			if this.doAuth() {
+				this.doEnd()
+				return
+			}
 		}
-	}

-	// Compression
-	if this.web.Compression != nil && this.web.Compression.IsOn && this.web.Compression.Level > 0 {
-		this.writer.SetCompression(this.web.Compression)
+		// 自动跳转到HTTPS
+		if this.IsHTTP && this.web.RedirectToHttps != nil && this.web.RedirectToHttps.IsOn {
+			if this.doRedirectToHTTPS(this.web.RedirectToHttps) {
+				this.doEnd()
+				return
+			}
+		}
+
+		// Compression
+		if this.web.Compression != nil && this.web.Compression.IsOn && this.web.Compression.Level > 0 {
+			this.writer.SetCompression(this.web.Compression)
+		}
 	}

 	// 开始调用
@@ -218,49 +232,60 @@ func (this *HTTPRequest) Do() {

 // 开始调用
 func (this *HTTPRequest) doBegin() {
-	// 处理request limit
-	if this.web.RequestLimit != nil &&
-		this.web.RequestLimit.IsOn {
-		if this.doRequestLimit() {
+	if !this.isLnRequest {
+		// 处理request limit
+		if this.web.RequestLimit != nil &&
+			this.web.RequestLimit.IsOn {
+			if this.doRequestLimit() {
+				return
+			}
+		}
+
+		// 处理requestBody
+		if this.RawReq.ContentLength > 0 &&
+			this.web.AccessLogRef != nil &&
+			this.web.AccessLogRef.IsOn &&
+			this.web.AccessLogRef.ContainsField(serverconfigs.HTTPAccessLogFieldRequestBody) {
+			var err error
+			this.requestBodyData, err = ioutil.ReadAll(io.LimitReader(this.RawReq.Body, AccessLogMaxRequestBodySize))
+			if err != nil {
+				this.write50x(err, http.StatusBadGateway, false)
+				return
+			}
+			this.RawReq.Body = ioutil.NopCloser(io.MultiReader(bytes.NewBuffer(this.requestBodyData), this.RawReq.Body))
+		}
+
+		// 处理健康检查
+		var isHealthCheck = false
+		var healthCheckKey = this.RawReq.Header.Get(serverconfigs.HealthCheckHeaderName)
+		if len(healthCheckKey) > 0 {
+			if this.doHealthCheck(healthCheckKey, &isHealthCheck) {
+				return
+			}
+		}
+
+		// UAM
+		if !isHealthCheck && this.ReqServer.UAM != nil && this.ReqServer.UAM.IsOn {
+			if this.doUAM() {
+				this.doEnd()
+				return
+			}
+		}
+
+		// 跳转
+		if len(this.web.HostRedirects) > 0 {
+			if this.doHostRedirect() {
+				return
+			}
+		}
+
+		// 临时关闭页面
+		if this.web.Shutdown != nil && this.web.Shutdown.IsOn {
+			this.doShutdown()
 			return
 		}
 	}

-	// 处理requestBody
-	if this.RawReq.ContentLength > 0 &&
-		this.web.AccessLogRef != nil &&
-		this.web.AccessLogRef.IsOn &&
-		this.web.AccessLogRef.ContainsField(serverconfigs.HTTPAccessLogFieldRequestBody) {
-		var err error
-		this.requestBodyData, err = ioutil.ReadAll(io.LimitReader(this.RawReq.Body, AccessLogMaxRequestBodySize))
-		if err != nil {
-			this.write50x(err, http.StatusBadGateway, false)
-			return
-		}
-		this.RawReq.Body = ioutil.NopCloser(io.MultiReader(bytes.NewBuffer(this.requestBodyData), this.RawReq.Body))
-	}
-
-	// 处理健康检查
-	var healthCheckKey = this.RawReq.Header.Get(serverconfigs.HealthCheckHeaderName)
-	if len(healthCheckKey) > 0 {
-		if this.doHealthCheck(healthCheckKey) {
-			return
-		}
-	}
-
-	// 跳转
-	if len(this.web.HostRedirects) > 0 {
-		if this.doHostRedirect() {
-			return
-		}
-	}
-
-	// 临时关闭页面
-	if this.web.Shutdown != nil && this.web.Shutdown.IsOn {
-		this.doShutdown()
-		return
-	}
-
 	// 缓存
 	if this.web.Cache != nil && this.web.Cache.IsOn {
 		if this.doCacheRead(false) {
@@ -268,30 +293,32 @@ func (this *HTTPRequest) doBegin() {
 		}
 	}

-	// 重写规则
-	if this.rewriteRule != nil {
-		if this.doRewrite() {
-			return
-		}
-	}
-
-	// Fastcgi
-	if this.web.FastcgiRef != nil && this.web.FastcgiRef.IsOn && len(this.web.FastcgiList) > 0 {
-		if this.doFastcgi() {
-			return
-		}
-	}
-
-	// root
-	if this.web.Root != nil && this.web.Root.IsOn {
-		// 如果处理成功，则终止请求的处理
-		if this.doRoot() {
-			return
+	if !this.isLnRequest {
+		// 重写规则
+		if this.rewriteRule != nil {
+			if this.doRewrite() {
+				return
+			}
 		}

-		// 如果明确设置了终止，则也会自动终止
-		if this.web.Root.IsBreak {
-			return
+		// Fastcgi
+		if this.web.FastcgiRef != nil && this.web.FastcgiRef.IsOn && len(this.web.FastcgiList) > 0 {
+			if this.doFastcgi() {
+				return
+			}
+		}
+
+		// root
+		if this.web.Root != nil && this.web.Root.IsOn {
+			// 如果处理成功，则终止请求的处理
+			if this.doRoot() {
+				return
+			}
+
+			// 如果明确设置了终止，则也会自动终止
+			if this.web.Root.IsBreak {
+				return
+			}
 		}
 	}

@@ -312,17 +339,23 @@ func (this *HTTPRequest) doEnd() {

 	// 流量统计
 	// TODO 增加是否开启开关
-	// TODO 增加Header统计，考虑从Conn中读取
 	if this.ReqServer != nil {
+		var countCached int64 = 0
+		var cachedBytes int64 = 0
+
+		var countAttacks int64 = 0
+		var attackBytes int64 = 0
+
 		if this.isCached {
-			stats.SharedTrafficStatManager.Add(this.ReqServer.Id, this.ReqHost, this.writer.SentBodyBytes(), this.writer.SentBodyBytes(), 1, 1, 0, 0, this.ReqServer.ShouldCheckTrafficLimit(), this.ReqServer.PlanId())
-		} else {
-			if this.isAttack {
-				stats.SharedTrafficStatManager.Add(this.ReqServer.Id, this.ReqHost, this.writer.SentBodyBytes(), 0, 1, 0, 1, this.writer.SentBodyBytes(), this.ReqServer.ShouldCheckTrafficLimit(), this.ReqServer.PlanId())
-			} else {
-				stats.SharedTrafficStatManager.Add(this.ReqServer.Id, this.ReqHost, this.writer.SentBodyBytes(), 0, 1, 0, 0, 0, this.ReqServer.ShouldCheckTrafficLimit(), this.ReqServer.PlanId())
-			}
+			countCached = 1
+			cachedBytes = this.writer.SentBodyBytes() + this.writer.SentHeaderBytes()
 		}
+		if this.isAttack {
+			countAttacks = 1
+			attackBytes = this.CalculateSize()
+		}
+
+		stats.SharedTrafficStatManager.Add(this.ReqServer.Id, this.ReqHost, this.writer.SentBodyBytes()+this.writer.SentHeaderBytes(), cachedBytes, 1, countCached, countAttacks, attackBytes, this.ReqServer.ShouldCheckTrafficLimit(), this.ReqServer.PlanId())
 	}

 	// 指标
@@ -468,7 +501,10 @@ func (this *HTTPRequest) configureWeb(web *serverconfigs.HTTPWebConfig, isTop bo
 	// request scripts
 	if web.RequestScripts != nil {
 		if this.web.RequestScripts == nil {
-			this.web.RequestScripts = web.RequestScripts
+			this.web.RequestScripts = &serverconfigs.HTTPRequestScriptsConfig{
+				InitGroup:    web.RequestScripts.InitGroup,
+				RequestGroup: web.RequestScripts.RequestGroup,
+			} // 不要直接赋值，需要复制，防止在运行时被修改
 		} else {
 			if web.RequestScripts.InitGroup != nil && (web.RequestScripts.InitGroup.IsPrior || isTop) {
 				if this.web.RequestScripts == nil {
@@ -791,9 +827,9 @@ func (this *HTTPRequest) Format(source string) string {
 		if prefix == "node" {
 			switch suffix {
 			case "id":
-				return strconv.FormatInt(sharedNodeConfig.Id, 10)
+				return strconv.FormatInt(this.nodeConfig.Id, 10)
 			case "name":
-				return sharedNodeConfig.Name
+				return this.nodeConfig.Name
 			case "role":
 				return teaconst.Role
 			}
@@ -952,13 +988,13 @@ func (this *HTTPRequest) Format(source string) string {
 		if prefix == "product" {
 			switch suffix {
 			case "name":
-				if sharedNodeConfig.ProductConfig != nil && len(sharedNodeConfig.ProductConfig.Name) > 0 {
-					return sharedNodeConfig.ProductConfig.Name
+				if this.nodeConfig.ProductConfig != nil && len(this.nodeConfig.ProductConfig.Name) > 0 {
+					return this.nodeConfig.ProductConfig.Name
 				}
 				return teaconst.GlobalProductName
 			case "version":
-				if sharedNodeConfig.ProductConfig != nil && len(sharedNodeConfig.ProductConfig.Version) > 0 {
-					return sharedNodeConfig.ProductConfig.Version
+				if this.nodeConfig.ProductConfig != nil && len(this.nodeConfig.ProductConfig.Version) > 0 {
+					return this.nodeConfig.ProductConfig.Version
 				}
 				return teaconst.Version
 			}
@@ -977,6 +1013,10 @@ func (this *HTTPRequest) addVarMapping(varMapping map[string]string) {

 // 获取请求的客户端地址
 func (this *HTTPRequest) requestRemoteAddr(supportVar bool) string {
+	if len(this.lnRemoteAddr) > 0 {
+		return this.lnRemoteAddr
+	}
+
 	if supportVar && len(this.remoteAddr) > 0 {
 		return this.remoteAddr
 	}
@@ -1278,6 +1318,28 @@ func (this *HTTPRequest) ContentLength() int64 {
 	return this.RawReq.ContentLength
 }

+// CalculateSize 计算当前请求的尺寸（预估）
+func (this *HTTPRequest) CalculateSize() (size int64) {
+	// Get /xxx HTTP/1.1
+	size += int64(len(this.RawReq.Method)) + 1
+	size += int64(len(this.RawReq.URL.String())) + 1
+	size += int64(len(this.RawReq.Proto)) + 1
+	for k, v := range this.RawReq.Header {
+		for _, v1 := range v {
+			size += int64(len(k) + 2 /** : **/ + len(v1) + 1)
+		}
+	}
+
+	size += 1 /** \r\n **/
+
+	if this.RawReq.ContentLength > 0 {
+		size += this.RawReq.ContentLength
+	} else if len(this.requestBodyData) > 0 {
+		size += int64(len(this.requestBodyData))
+	}
+	return size
+}
+
 // Method 请求方法
 func (this *HTTPRequest) Method() string {
 	return this.RawReq.Method
@@ -1496,7 +1558,7 @@ func (this *HTTPRequest) fixRequestHeader(header http.Header) {

 // 处理自定义Response Header
 func (this *HTTPRequest) processResponseHeaders(statusCode int) {
-	responseHeader := this.writer.Header()
+	var responseHeader = this.writer.Header()

 	// 删除/添加/替换Header
 	// TODO 实现AddTrailers
@@ -1584,6 +1646,9 @@ func (this *HTTPRequest) addError(err error) {

 // 计算合适的buffer size
 func (this *HTTPRequest) bytePool(contentLength int64) *utils.BytePool {
+	if contentLength < 0 {
+		return utils.BytePool16k
+	}
 	if contentLength < 8192 { // 8K
 		return utils.BytePool1k
 	}
--- a/internal/nodes/http_request_cache.go
+++ b/internal/nodes/http_request_cache.go
@@ -203,20 +203,35 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {
 		webPIsEnabled = true
 	}

-	// 检查压缩缓存
+	// 检查WebP压缩缓存
+	if webPIsEnabled && !isPartialRequest && !isHeadMethod && reader == nil {
+		if this.web.Compression != nil && this.web.Compression.IsOn {
+			_, encoding, ok := this.web.Compression.MatchAcceptEncoding(this.RawReq.Header.Get("Accept-Encoding"))
+			if ok {
+				reader, _ = storage.OpenReader(key+caches.SuffixWebP+caches.SuffixCompression+encoding, useStale, false)
+				if reader != nil {
+					tags = append(tags, "webp", encoding)
+				}
+			}
+		}
+	}
+
+	// 检查WebP
+	if webPIsEnabled && !isPartialRequest &&
+		!isHeadMethod &&
+		reader == nil {
+		reader, _ = storage.OpenReader(key+caches.SuffixWebP, useStale, false)
+		if reader != nil {
+			this.writer.cacheReaderSuffix = caches.SuffixWebP
+			tags = append(tags, "webp")
+		}
+	}
+
+	// 检查普通压缩缓存
 	if !isPartialRequest && !isHeadMethod && reader == nil {
 		if this.web.Compression != nil && this.web.Compression.IsOn {
 			_, encoding, ok := this.web.Compression.MatchAcceptEncoding(this.RawReq.Header.Get("Accept-Encoding"))
 			if ok {
-				// 检查支持WebP的压缩缓存
-				if webPIsEnabled {
-					reader, _ = storage.OpenReader(key+caches.SuffixWebP+caches.SuffixCompression+encoding, useStale, false)
-					if reader != nil {
-						tags = append(tags, "webp", encoding)
-					}
-				}
-
-				// 检查普通压缩缓存
 				if reader == nil {
 					reader, _ = storage.OpenReader(key+caches.SuffixCompression+encoding, useStale, false)
 					if reader != nil {
@@ -227,18 +242,6 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {
 		}
 	}

-	// 检查WebP
-	if !isPartialRequest &&
-		!isHeadMethod &&
-		reader == nil &&
-		webPIsEnabled {
-		reader, _ = storage.OpenReader(key+caches.SuffixWebP, useStale, false)
-		if reader != nil {
-			this.writer.cacheReaderSuffix = caches.SuffixWebP
-			tags = append(tags, "webp")
-		}
-	}
-
 	// 检查正常的文件
 	var isPartialCache = false
 	var partialRanges []rangeutils.Range
@@ -304,6 +307,7 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {

 	// 读取Header
 	var headerBuf = []byte{}
+	this.writer.SetSentHeaderBytes(reader.HeaderSize())
 	err = reader.ReadHeader(buf, func(n int) (goNext bool, err error) {
 		headerBuf = append(headerBuf, buf[:n]...)
 		for {
@@ -375,7 +379,7 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {
 	}

 	// 支持 If-None-Match
-	if !isPartialCache && len(eTag) > 0 && this.requestHeader("If-None-Match") == eTag {
+	if !this.isLnRequest && !isPartialCache && len(eTag) > 0 && this.requestHeader("If-None-Match") == eTag {
 		// 自定义Header
 		this.processResponseHeaders(http.StatusNotModified)
 		this.writer.WriteHeader(http.StatusNotModified)
@@ -386,7 +390,7 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {
 	}

 	// 支持 If-Modified-Since
-	if !isPartialCache && len(modifiedTime) > 0 && this.requestHeader("If-Modified-Since") == modifiedTime {
+	if !this.isLnRequest && !isPartialCache && len(modifiedTime) > 0 && this.requestHeader("If-Modified-Since") == modifiedTime {
 		// 自定义Header
 		this.processResponseHeaders(http.StatusNotModified)
 		this.writer.WriteHeader(http.StatusNotModified)
@@ -399,6 +403,11 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {
 	this.processResponseHeaders(reader.Status())
 	this.addExpiresHeader(reader.ExpiresAt())

+	// 返回上级节点过期时间
+	if this.isLnRequest {
+		respHeader.Set(LNExpiresHeader, types.String(reader.ExpiresAt()))
+	}
+
 	// 输出Body
 	if this.RawReq.Method == http.MethodHead {
 		this.writer.WriteHeader(reader.Status())
@@ -529,11 +538,22 @@ func (this *HTTPRequest) doCacheRead(useStale bool) (shouldStop bool) {
 				return true
 			}
 		} else { // 没有Range
-			var resp = &http.Response{Body: reader}
+			var resp = &http.Response{
+				Body:          reader,
+				ContentLength: reader.BodySize(),
+			}
 			this.writer.Prepare(resp, fileSize, reader.Status(), false)
 			this.writer.WriteHeader(reader.Status())

-			_, err = io.CopyBuffer(this.writer, resp.Body, buf)
+			if storage.CanSendfile() {
+				if fp, canSendFile := this.writer.canSendfile(); canSendFile {
+					this.writer.sentBodyBytes, err = io.CopyBuffer(this.writer.rawWriter, fp, buf)
+				} else {
+					_, err = io.CopyBuffer(this.writer, resp.Body, buf)
+				}
+			} else {
+				_, err = io.CopyBuffer(this.writer, resp.Body, buf)
+			}
 			if err == io.EOF {
 				err = nil
 			}
--- a/internal/nodes/http_request_health_check.go
+++ b/internal/nodes/http_request_health_check.go
@@ -9,7 +9,7 @@ import (
 )

 // 健康检查
-func (this *HTTPRequest) doHealthCheck(key string) (stop bool) {
+func (this *HTTPRequest) doHealthCheck(key string, isHealthCheck *bool) (stop bool) {
 	this.tags = append(this.tags, "healthCheck")

 	this.RawReq.Header.Del(serverconfigs.HealthCheckHeaderName)
@@ -19,6 +19,7 @@ func (this *HTTPRequest) doHealthCheck(key string) (stop bool) {
 		remotelogs.Error("HTTP_REQUEST_HEALTH_CHECK", "decode key failed: "+err.Error())
 		return
 	}
+	*isHealthCheck = true

 	if data.GetBool("onlyBasicRequest") {
 		return true
--- a/internal/nodes/http_request_ln.go
+++ b/internal/nodes/http_request_ln.go
@@ -0,0 +1,21 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+//go:build !plus
+// +build !plus
+
+package nodes
+
+import (
+	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
+)
+
+const (
+	LNExpiresHeader = "X-Edge-Ln-Expires"
+)
+
+func (this *HTTPRequest) checkLnRequest() bool {
+	return false
+}
+
+func (this *HTTPRequest) getLnOrigin() *serverconfigs.OriginConfig {
+	return nil
+}
--- a/internal/nodes/http_request_log.go
+++ b/internal/nodes/http_request_log.go
@@ -14,85 +14,88 @@ const (

 // 日志
 func (this *HTTPRequest) log() {
-	if this.disableLog {
-		return
+	var ref *serverconfigs.HTTPAccessLogRef
+	if !this.forceLog {
+		if this.disableLog {
+			return
+		}
+
+		// 计算请求时间
+		this.requestCost = time.Since(this.requestFromTime).Seconds()
+
+		ref = this.web.AccessLogRef
+		if ref == nil {
+			ref = serverconfigs.DefaultHTTPAccessLogRef
+		}
+		if !ref.IsOn {
+			return
+		}
+
+		if !ref.Match(this.writer.StatusCode()) {
+			return
+		}
+
+		if ref.FirewallOnly && this.firewallPolicyId == 0 {
+			return
+		}
+
+		// 是否记录499
+		if !ref.EnableClientClosed && this.writer.StatusCode() == 499 {
+			return
+		}
 	}

-	// 计算请求时间
-	this.requestCost = time.Since(this.requestFromTime).Seconds()
-
-	ref := this.web.AccessLogRef
-	if ref == nil {
-		ref = serverconfigs.DefaultHTTPAccessLogRef
-	}
-	if !ref.IsOn {
-		return
-	}
-
-	if !ref.Match(this.writer.StatusCode()) {
-		return
-	}
-
-	if ref.FirewallOnly && this.firewallPolicyId == 0 {
-		return
-	}
-
-	// 是否记录499
-	if !ref.EnableClientClosed && this.writer.StatusCode() == 499 {
-		return
-	}
-
-	addr := this.RawReq.RemoteAddr
-	index := strings.LastIndex(addr, ":")
+	var addr = this.RawReq.RemoteAddr
+	var index = strings.LastIndex(addr, ":")
 	if index > 0 {
 		addr = addr[:index]
 	}

 	// 请求Cookie
-	cookies := map[string]string{}
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldCookie) {
+	var cookies = map[string]string{}
+	if ref == nil || ref.ContainsField(serverconfigs.HTTPAccessLogFieldCookie) {
 		for _, cookie := range this.RawReq.Cookies() {
 			cookies[cookie.Name] = cookie.Value
 		}
 	}

 	// 请求Header
-	pbReqHeader := map[string]*pb.Strings{}
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldHeader) {
+	var pbReqHeader = map[string]*pb.Strings{}
+	if ref == nil || ref.ContainsField(serverconfigs.HTTPAccessLogFieldHeader) {
 		for k, v := range this.RawReq.Header {
 			pbReqHeader[k] = &pb.Strings{Values: v}
 		}
 	}

 	// 响应Header
-	pbResHeader := map[string]*pb.Strings{}
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldSentHeader) {
+	var pbResHeader = map[string]*pb.Strings{}
+	if ref == nil || ref.ContainsField(serverconfigs.HTTPAccessLogFieldSentHeader) {
 		for k, v := range this.writer.Header() {
 			pbResHeader[k] = &pb.Strings{Values: v}
 		}
 	}

 	// 参数列表
-	queryString := ""
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldArg) {
+	var queryString = ""
+	if ref == nil || ref.ContainsField(serverconfigs.HTTPAccessLogFieldArg) {
 		queryString = this.requestQueryString()
 	}

 	// 浏览器
-	userAgent := ""
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldUserAgent) || ref.ContainsField(serverconfigs.HTTPAccessLogFieldExtend) {
+	var userAgent = ""
+	if ref == nil || ref.ContainsField(serverconfigs.HTTPAccessLogFieldUserAgent) || ref.ContainsField(serverconfigs.HTTPAccessLogFieldExtend) {
 		userAgent = this.RawReq.UserAgent()
 	}

 	// 请求来源
-	referer := ""
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldReferer) {
+	var referer = ""
+	if ref == nil || ref.ContainsField(serverconfigs.HTTPAccessLogFieldReferer) {
 		referer = this.RawReq.Referer()
 	}

-	accessLog := &pb.HTTPAccessLog{
+	var accessLog = &pb.HTTPAccessLog{
 		RequestId:       this.requestId,
-		NodeId:          sharedNodeConfig.Id,
+		NodeId:          this.nodeConfig.Id,
 		ServerId:        this.ReqServer.Id,
 		RemoteAddr:      this.requestRemoteAddr(true),
 		RawRemoteAddr:   addr,
@@ -146,7 +149,8 @@ func (this *HTTPRequest) log() {
 	}

 	// 请求Body
-	if ref.ContainsField(serverconfigs.HTTPAccessLogFieldRequestBody) {
+	// TODO 考虑在被攻击时记录攻击的requestBody（如果requestBody匹配规则的话），但要考虑请求尺寸、数据库容量，避免因为日志而导致服务不稳定
+	if ref != nil && ref.ContainsField(serverconfigs.HTTPAccessLogFieldRequestBody) {
 		accessLog.RequestBody = this.requestBodyData

 		if len(accessLog.RequestBody) > AccessLogMaxRequestBodySize {
@@ -154,7 +158,7 @@ func (this *HTTPRequest) log() {
 		}
 	}

-	// TODO 记录匹配的 locationId和rewriteId
+	// TODO 记录匹配的 locationId和rewriteId，非必要需求

 	sharedHTTPAccessLogQueue.Push(accessLog)
 }
--- a/internal/nodes/http_request_reverse_proxy.go
+++ b/internal/nodes/http_request_reverse_proxy.go
@@ -36,22 +36,40 @@ func (this *HTTPRequest) doReverseProxy() {
 	requestCall.Request = this.RawReq
 	requestCall.Formatter = this.Format
 	requestCall.Domain = this.ReqHost
-	var origin = this.reverseProxy.NextOrigin(requestCall)
-	requestCall.CallResponseCallbacks(this.writer)
+
+	var origin *serverconfigs.OriginConfig
+
+	// 二级节点
+	if this.cacheRef != nil {
+		origin = this.getLnOrigin()
+		if origin != nil {
+			// 强制变更原来访问的域名
+			requestHost = this.ReqHost
+		}
+	}
+
+	// 自定义源站
 	if origin == nil {
-		err := errors.New(this.URL() + ": no available origin sites for reverse proxy")
-		remotelogs.ServerError(this.ReqServer.Id, "HTTP_REQUEST_REVERSE_PROXY", err.Error(), "", nil)
-		this.write50x(err, http.StatusBadGateway, true)
-		return
+		origin = this.reverseProxy.NextOrigin(requestCall)
+		requestCall.CallResponseCallbacks(this.writer)
+		if origin == nil {
+			err := errors.New(this.URL() + ": no available origin sites for reverse proxy")
+			remotelogs.ServerError(this.ReqServer.Id, "HTTP_REQUEST_REVERSE_PROXY", err.Error(), "", nil)
+			this.write50x(err, http.StatusBadGateway, true)
+			return
+		}
+
+		if len(origin.StripPrefix) > 0 {
+			stripPrefix = origin.StripPrefix
+		}
+		if len(origin.RequestURI) > 0 {
+			requestURI = origin.RequestURI
+			requestURIHasVariables = origin.RequestURIHasVariables()
+		}
 	}
+
 	this.origin = origin // 设置全局变量是为了日志等处理
-	if len(origin.StripPrefix) > 0 {
-		stripPrefix = origin.StripPrefix
-	}
-	if len(origin.RequestURI) > 0 {
-		requestURI = origin.RequestURI
-		requestURIHasVariables = origin.RequestURIHasVariables()
-	}
+
 	if len(origin.RequestHost) > 0 {
 		requestHost = origin.RequestHost
 		requestHostHasVariables = origin.RequestHostHasVariables()
@@ -161,7 +179,7 @@ func (this *HTTPRequest) doReverseProxy() {
 	// 获取请求客户端
 	client, err := SharedHTTPClientPool.Client(this, origin, originAddr, this.reverseProxy.ProxyProtocol, this.reverseProxy.FollowRedirects)
 	if err != nil {
-		remotelogs.Error("HTTP_REQUEST_REVERSE_PROXY", err.Error())
+		remotelogs.Error("HTTP_REQUEST_REVERSE_PROXY", this.URL()+": "+err.Error())
 		this.write50x(err, http.StatusBadGateway, true)
 		return
 	}
@@ -195,7 +213,7 @@ func (this *HTTPRequest) doReverseProxy() {
 				this.write50x(err, http.StatusBadGateway, true)
 			}
 			if httpErr.Err != io.EOF {
-				remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", this.RawReq.URL.String()+"': "+err.Error())
+				remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", this.URL()+": "+err.Error())
 			}
 		} else {
 			// 是否为客户端方面的错误
@@ -234,7 +252,7 @@ func (this *HTTPRequest) doReverseProxy() {
 		if this.doWAFResponse(resp) {
 			err = resp.Body.Close()
 			if err != nil {
-				remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", err.Error())
+				remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", this.URL()+": "+err.Error())
 			}
 			return
 		}
@@ -244,7 +262,7 @@ func (this *HTTPRequest) doReverseProxy() {
 	if len(this.web.Pages) > 0 && this.doPage(resp.StatusCode) {
 		err = resp.Body.Close()
 		if err != nil {
-			remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", err.Error())
+			remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", this.URL()+": "+err.Error())
 		}
 		return
 	}
@@ -261,6 +279,22 @@ func (this *HTTPRequest) doReverseProxy() {
 		}
 	}

+	// 替换Location中的源站地址
+	var locationHeader = resp.Header.Get("Location")
+	if len(locationHeader) > 0 {
+		locationURL, err := url.Parse(locationHeader)
+		if err == nil && (locationURL.Host == originAddr || strings.HasPrefix(originAddr, locationURL.Host+":")) {
+			locationURL.Host = this.ReqHost
+			if this.IsHTTP {
+				locationURL.Scheme = "http"
+			} else if this.IsHTTPS {
+				locationURL.Scheme = "https"
+			}
+
+			resp.Header.Set("Location", locationURL.String())
+		}
+	}
+
 	// 响应Header
 	this.writer.AddHeaders(resp.Header)
 	this.processResponseHeaders(resp.StatusCode)
@@ -309,13 +343,13 @@ func (this *HTTPRequest) doReverseProxy() {
 	var closeErr = resp.Body.Close()
 	if closeErr != nil {
 		if !this.canIgnore(closeErr) {
-			remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", closeErr.Error())
+			remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", this.URL()+": "+closeErr.Error())
 		}
 	}

 	if err != nil && err != io.EOF {
 		if !this.canIgnore(err) {
-			remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", err.Error())
+			remotelogs.Warn("HTTP_REQUEST_REVERSE_PROXY", this.URL()+": "+err.Error())
 			this.addError(err)
 		}
 	}
--- a/internal/nodes/http_request_shutdown.go
+++ b/internal/nodes/http_request_shutdown.go
@@ -17,12 +17,13 @@ func (this *HTTPRequest) doShutdown() {
 		return
 	}

-	if urlPrefixRegexp.MatchString(shutdown.URL) { // URL
-		this.doURL(http.MethodGet, shutdown.URL, "", shutdown.Status, true)
-		return
-	}
-
 	if len(shutdown.BodyType) == 0 || shutdown.BodyType == shared.BodyTypeURL {
+		// URL
+		if urlPrefixRegexp.MatchString(shutdown.URL) {
+			this.doURL(http.MethodGet, shutdown.URL, "", shutdown.Status, true)
+			return
+		}
+
 		// URL为空，则显示文本
 		if len(shutdown.URL) == 0 {
 			// 自定义响应Headers
--- a/internal/nodes/http_request_test.go
+++ b/internal/nodes/http_request_test.go
@@ -8,7 +8,7 @@ import (
 )

 func TestHTTPRequest_RedirectToHTTPS(t *testing.T) {
-	a := assert.NewAssertion(t)
+	var a = assert.NewAssertion(t)
 	{
 		req := &HTTPRequest{
 			ReqServer: &serverconfigs.ServerConfig{
@@ -47,4 +47,5 @@ func TestHTTPRequest_Memory(t *testing.T) {
 	var stat2 = &runtime.MemStats{}
 	runtime.ReadMemStats(stat2)
 	t.Log((stat2.HeapInuse-stat1.HeapInuse)/1024/1024, "MB,")
+	t.Log(len(requests))
 }
--- a/internal/nodes/http_request_uam.go
+++ b/internal/nodes/http_request_uam.go
@@ -0,0 +1,10 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+//go:build !plus
+// +build !plus
+
+package nodes
+
+// UAM
+func (this *HTTPRequest) doUAM() (block bool) {
+	return false
+}
--- a/internal/nodes/http_request_waf.go
+++ b/internal/nodes/http_request_waf.go
@@ -24,7 +24,7 @@ func (this *HTTPRequest) doWAFRequest() (blocked bool) {
 	var remoteAddr = this.requestRemoteAddr(true)

 	// 检查是否为白名单直连
-	if !Tea.IsTesting() && sharedNodeConfig.IPIsAutoAllowed(remoteAddr) {
+	if !Tea.IsTesting() && this.nodeConfig.IPIsAutoAllowed(remoteAddr) {
 		return
 	}

@@ -53,9 +53,11 @@ func (this *HTTPRequest) doWAFRequest() (blocked bool) {
 		return true
 	}

+	var forceLog = this.ReqServer.HTTPFirewallPolicy != nil && this.ReqServer.HTTPFirewallPolicy.IsOn && this.ReqServer.HTTPFirewallPolicy.Log != nil && this.ReqServer.HTTPFirewallPolicy.Log.IsOn
+
 	// 当前服务的独立设置
 	if this.web.FirewallPolicy != nil && this.web.FirewallPolicy.IsOn {
-		blocked, breakChecking := this.checkWAFRequest(this.web.FirewallPolicy)
+		blocked, breakChecking := this.checkWAFRequest(this.web.FirewallPolicy, forceLog)
 		if blocked {
 			return true
 		}
@@ -66,7 +68,7 @@ func (this *HTTPRequest) doWAFRequest() (blocked bool) {

 	// 公用的防火墙设置
 	if this.ReqServer.HTTPFirewallPolicy != nil && this.ReqServer.HTTPFirewallPolicy.IsOn {
-		blocked, breakChecking := this.checkWAFRequest(this.ReqServer.HTTPFirewallPolicy)
+		blocked, breakChecking := this.checkWAFRequest(this.ReqServer.HTTPFirewallPolicy, forceLog)
 		if blocked {
 			return true
 		}
@@ -78,7 +80,7 @@ func (this *HTTPRequest) doWAFRequest() (blocked bool) {
 	return
 }

-func (this *HTTPRequest) checkWAFRequest(firewallPolicy *firewallconfigs.HTTPFirewallPolicy) (blocked bool, breakChecking bool) {
+func (this *HTTPRequest) checkWAFRequest(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, forceLog bool) (blocked bool, breakChecking bool) {
 	// 检查配置是否为空
 	if firewallPolicy == nil || !firewallPolicy.IsOn || firewallPolicy.Inbound == nil || !firewallPolicy.Inbound.IsOn || firewallPolicy.Mode == firewallconfigs.FirewallModeBypass {
 		return
@@ -206,6 +208,10 @@ func (this *HTTPRequest) checkWAFRequest(firewallPolicy *firewallconfigs.HTTPFir
 	}

 	if ruleSet != nil {
+		if forceLog {
+			this.forceLog = true
+		}
+
 		if ruleSet.HasSpecialActions() {
 			this.firewallPolicyId = firewallPolicy.Id
 			this.firewallRuleGroupId = types.Int64(ruleGroup.Id)
@@ -232,8 +238,9 @@ func (this *HTTPRequest) doWAFResponse(resp *http.Response) (blocked bool) {
 	}

 	// 当前服务的独立设置
+	var forceLog = this.ReqServer.HTTPFirewallPolicy != nil && this.ReqServer.HTTPFirewallPolicy.IsOn && this.ReqServer.HTTPFirewallPolicy.Log != nil && this.ReqServer.HTTPFirewallPolicy.Log.IsOn
 	if this.web.FirewallPolicy != nil && this.web.FirewallPolicy.IsOn {
-		blocked := this.checkWAFResponse(this.web.FirewallPolicy, resp)
+		blocked := this.checkWAFResponse(this.web.FirewallPolicy, resp, forceLog)
 		if blocked {
 			return true
 		}
@@ -241,7 +248,7 @@ func (this *HTTPRequest) doWAFResponse(resp *http.Response) (blocked bool) {

 	// 公用的防火墙设置
 	if this.ReqServer.HTTPFirewallPolicy != nil && this.ReqServer.HTTPFirewallPolicy.IsOn {
-		blocked := this.checkWAFResponse(this.ReqServer.HTTPFirewallPolicy, resp)
+		blocked := this.checkWAFResponse(this.ReqServer.HTTPFirewallPolicy, resp, forceLog)
 		if blocked {
 			return true
 		}
@@ -249,7 +256,7 @@ func (this *HTTPRequest) doWAFResponse(resp *http.Response) (blocked bool) {
 	return
 }

-func (this *HTTPRequest) checkWAFResponse(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, resp *http.Response) (blocked bool) {
+func (this *HTTPRequest) checkWAFResponse(firewallPolicy *firewallconfigs.HTTPFirewallPolicy, resp *http.Response, forceLog bool) (blocked bool) {
 	if firewallPolicy == nil || !firewallPolicy.IsOn || !firewallPolicy.Outbound.IsOn || firewallPolicy.Mode == firewallconfigs.FirewallModeBypass {
 		return
 	}
@@ -268,6 +275,10 @@ func (this *HTTPRequest) checkWAFResponse(firewallPolicy *firewallconfigs.HTTPFi
 	}

 	if ruleSet != nil {
+		if forceLog {
+			this.forceLog = true
+		}
+
 		if ruleSet.HasSpecialActions() {
 			this.firewallPolicyId = firewallPolicy.Id
 			this.firewallRuleGroupId = types.Int64(ruleGroup.Id)
--- a/internal/nodes/http_writer.go
+++ b/internal/nodes/http_writer.go
@@ -6,6 +6,7 @@ import (
 	"bufio"
 	"bytes"
 	"errors"
+	"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
 	"github.com/TeaOSLab/EdgeCommon/pkg/serverconfigs"
 	"github.com/TeaOSLab/EdgeNode/internal/caches"
 	"github.com/TeaOSLab/EdgeNode/internal/compressions"
@@ -58,8 +59,9 @@ type HTTPWriter struct {

 	size int64

-	statusCode    int
-	sentBodyBytes int64
+	statusCode      int
+	sentBodyBytes   int64
+	sentHeaderBytes int64

 	isOk       bool // 是否完全成功
 	isFinished bool // 是否已完成
@@ -281,12 +283,28 @@ func (this *HTTPWriter) PrepareCache(resp *http.Response, size int64) {
 		}
 	}

-	var expiredAt = utils.UnixTime() + life
+	var expiresAt = utils.UnixTime() + life
+
+	if this.req.isLnRequest {
+		// 返回上级节点过期时间
+		this.SetHeader(LNExpiresHeader, []string{types.String(expiresAt)})
+	} else {
+		var expiresHeader = this.Header().Get(LNExpiresHeader)
+		if len(expiresHeader) > 0 {
+			this.Header().Del(LNExpiresHeader)
+
+			var expiresHeaderInt64 = types.Int64(expiresHeader)
+			if expiresHeaderInt64 > 0 {
+				expiresAt = expiresHeaderInt64
+			}
+		}
+	}
+
 	var cacheKey = this.req.cacheKey
 	if this.isPartial {
 		cacheKey += caches.SuffixPartial
 	}
-	cacheWriter, err := storage.OpenWriter(cacheKey, expiredAt, this.StatusCode(), size, cacheRef.MaxSizeBytes(), this.isPartial)
+	cacheWriter, err := storage.OpenWriter(cacheKey, expiresAt, this.StatusCode(), size, cacheRef.MaxSizeBytes(), this.isPartial)
 	if err != nil {
 		if err == caches.ErrEntityTooLarge && addStatusHeader {
 			this.Header().Set("X-Cache", "BYPASS, entity too large")
@@ -295,6 +313,8 @@ func (this *HTTPWriter) PrepareCache(resp *http.Response, size int64) {
 		if !caches.CanIgnoreErr(err) {
 			remotelogs.Error("HTTP_WRITER", "write cache failed: "+err.Error())
 		}
+
+		this.Header().Set("X-Cache", "BYPASS, too many requests")
 		return
 	}
 	this.cacheWriter = cacheWriter
@@ -442,6 +462,30 @@ func (this *HTTPWriter) PrepareWebP(resp *http.Response, size int64) {
 		return
 	}

+	// 集群配置
+	var policy = this.req.nodeConfig.FindWebPImagePolicyWithClusterId(this.req.ReqServer.ClusterId)
+	if policy == nil {
+		policy = nodeconfigs.DefaultWebPImagePolicy
+	}
+	if !policy.IsOn {
+		return
+	}
+
+	// 只有在开启了缓存之后，才会转换，防止占用的系统资源过高
+	if policy.RequireCache && this.req.cacheRef == nil {
+		return
+	}
+
+	// 限制最小和最大尺寸
+	// TODO 需要将reader修改为LimitReader
+	if resp.ContentLength == 0 {
+		return
+	}
+
+	if resp.ContentLength > 0 && (resp.ContentLength < policy.MinLengthBytes() || (policy.MaxLengthBytes() > 0 && resp.ContentLength > policy.MaxLengthBytes())) {
+		return
+	}
+
 	var contentType = this.GetHeader("Content-Type")

 	if this.req.web != nil &&
@@ -692,6 +736,23 @@ func (this *HTTPWriter) SentBodyBytes() int64 {
 	return this.sentBodyBytes
 }

+// SentHeaderBytes 计算发送的Header字节数
+func (this *HTTPWriter) SentHeaderBytes() int64 {
+	if this.sentHeaderBytes > 0 {
+		return this.sentHeaderBytes
+	}
+	for k, v := range this.Header() {
+		for _, v1 := range v {
+			this.sentHeaderBytes += int64(len(k) + 2 + len(v1) + 1)
+		}
+	}
+	return this.sentHeaderBytes
+}
+
+func (this *HTTPWriter) SetSentHeaderBytes(sentHeaderBytes int64) {
+	this.sentHeaderBytes = sentHeaderBytes
+}
+
 // WriteHeader 写入状态码
 func (this *HTTPWriter) WriteHeader(statusCode int) {
 	if this.rawWriter != nil {
@@ -740,6 +801,27 @@ func (this *HTTPWriter) SendFile(status int, path string) (int64, error) {
 	return written, nil
 }

+// SendResp 发送响应对象
+func (this *HTTPWriter) SendResp(resp *http.Response) (int64, error) {
+	this.isFinished = true
+
+	for k, v := range resp.Header {
+		this.SetHeader(k, v)
+	}
+	this.WriteHeader(resp.StatusCode)
+	var bufPool = this.req.bytePool(resp.ContentLength)
+	var buf = bufPool.Get()
+	defer bufPool.Put(buf)
+
+	return io.CopyBuffer(this, resp.Body, buf)
+}
+
+// Redirect 跳转
+func (this *HTTPWriter) Redirect(status int, url string) {
+	http.Redirect(this.rawWriter, this.req.RawReq, url, status)
+	this.isFinished = true
+}
+
 // StatusCode 读取状态码
 func (this *HTTPWriter) StatusCode() int {
 	if this.statusCode == 0 {
@@ -994,7 +1076,9 @@ func (this *HTTPWriter) Close() {
 		}
 	}

-	this.sentBodyBytes = this.counterWriter.TotalBytes()
+	if this.sentBodyBytes == 0 {
+		this.sentBodyBytes = this.counterWriter.TotalBytes()
+	}
 }

 // Hijack Hijack
--- a/internal/nodes/http_writer_ext.go
+++ b/internal/nodes/http_writer_ext.go
@@ -0,0 +1,13 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+//go:build !plus
+// +build !plus
+
+package nodes
+
+import (
+	"os"
+)
+
+func (this *HTTPWriter) canSendfile() (*os.File, bool) {
+	return nil, false
+}
--- a/internal/nodes/listener_http.go
+++ b/internal/nodes/listener_http.go
@@ -134,7 +134,7 @@ func (this *HTTPListener) Reload(group *serverconfigs.ServerAddressGroup) {
 // ServerHTTP 处理HTTP请求
 func (this *HTTPListener) ServeHTTP(rawWriter http.ResponseWriter, rawReq *http.Request) {
 	// 域名
-	reqHost := rawReq.Host
+	var reqHost = rawReq.Host

 	// TLS域名
 	if this.isIP(reqHost) {
@@ -214,6 +214,8 @@ func (this *HTTPListener) ServeHTTP(rawWriter http.ResponseWriter, rawReq *http.
 		ServerAddr: this.addr,
 		IsHTTP:     this.isHTTP,
 		IsHTTPS:    this.isHTTPS,
+
+		nodeConfig: sharedNodeConfig,
 	}
 	req.Do()
 }
--- a/internal/nodes/listener_udp.go
+++ b/internal/nodes/listener_udp.go
@@ -24,6 +24,8 @@ type UDPListener struct {
 	connTicker *utils.Ticker

 	reverseProxy *serverconfigs.ReverseProxyConfig
+
+	isClosed bool
 }

 func (this *UDPListener) Serve() error {
@@ -46,7 +48,18 @@ func (this *UDPListener) Serve() error {

 	var buffer = make([]byte, 4*1024)
 	for {
-		n, addr, _ := this.Listener.ReadFrom(buffer)
+		if this.isClosed {
+			return nil
+		}
+
+		n, addr, err := this.Listener.ReadFrom(buffer)
+		if err != nil {
+			if this.isClosed {
+				return nil
+			}
+			return err
+		}
+
 		if n > 0 {
 			this.connLocker.Lock()
 			conn, ok := this.connMap[addr.String()]
@@ -76,6 +89,8 @@ func (this *UDPListener) Serve() error {
 }

 func (this *UDPListener) Close() error {
+	this.isClosed = true
+
 	if this.connTicker != nil {
 		this.connTicker.Stop()
 	}
--- a/internal/nodes/node.go
+++ b/internal/nodes/node.go
@@ -111,6 +111,9 @@ func (this *Node) Start() {
 		return
 	}

+	// 检查硬盘类型
+	this.checkDisk()
+
 	// 读取API配置
 	err = this.syncConfig(0)
 	if err != nil {
@@ -333,6 +336,47 @@ func (this *Node) loop() error {
 			goman.New(func() {
 				sharedUpgradeManager.Start()
 			})
+		case "scriptsChanged":
+			err = this.reloadCommonScripts()
+			if err != nil {
+				return errors.New("reload common scripts failed: " + err.Error())
+			}
+
+			// 修改为已同步
+			_, err = rpcClient.NodeTaskRPC().ReportNodeTaskDone(nodeCtx, &pb.ReportNodeTaskDoneRequest{
+				NodeTaskId: task.Id,
+				IsOk:       true,
+				Error:      "",
+			})
+			if err != nil {
+				return err
+			}
+		case "nodeLevelChanged":
+			levelInfoResp, err := rpcClient.NodeRPC().FindNodeLevelInfo(nodeCtx, &pb.FindNodeLevelInfoRequest{})
+			if err != nil {
+				return err
+			}
+
+			sharedNodeConfig.Level = levelInfoResp.Level
+
+			var parentNodes = map[int64][]*nodeconfigs.ParentNodeConfig{}
+			if len(levelInfoResp.ParentNodesMapJSON) > 0 {
+				err = json.Unmarshal(levelInfoResp.ParentNodesMapJSON, &parentNodes)
+				if err != nil {
+					return errors.New("decode level info failed: " + err.Error())
+				}
+			}
+			sharedNodeConfig.ParentNodes = parentNodes
+
+			// 修改为已同步
+			_, err = rpcClient.NodeTaskRPC().ReportNodeTaskDone(nodeCtx, &pb.ReportNodeTaskDoneRequest{
+				NodeTaskId: task.Id,
+				IsOk:       true,
+				Error:      "",
+			})
+			if err != nil {
+				return err
+			}
 		}
 	}

@@ -493,42 +537,7 @@ func (this *Node) startSyncTimer() {
 					continue
 				}
 			case <-serverChangeTicker.C: // 服务变化
-				this.locker.Lock()
-				if len(this.updatingServerMap) > 0 {
-					var updatingServerMap = this.updatingServerMap
-					this.updatingServerMap = map[int64]*serverconfigs.ServerConfig{}
-					newNodeConfig, err := nodeconfigs.CloneNodeConfig(sharedNodeConfig)
-					if err != nil {
-						remotelogs.Error("NODE", "apply server config error: "+err.Error())
-						continue
-					}
-					for serverId, serverConfig := range updatingServerMap {
-						if serverConfig != nil {
-							newNodeConfig.AddServer(serverConfig)
-						} else {
-							newNodeConfig.RemoveServer(serverId)
-						}
-					}
-
-					err, serverErrors := newNodeConfig.Init()
-					if err != nil {
-						remotelogs.Error("NODE", "apply server config error: "+err.Error())
-						continue
-					}
-					if len(serverErrors) > 0 {
-						for _, serverErr := range serverErrors {
-							remotelogs.ServerError(serverErr.Id, "NODE", serverErr.Message, nodeconfigs.NodeLogTypeServerConfigInitFailed, maps.Map{})
-						}
-					}
-
-					this.onReload(newNodeConfig)
-
-					err = sharedListenerManager.Start(newNodeConfig)
-					if err != nil {
-						remotelogs.Error("NODE", "apply server config error: "+err.Error())
-					}
-				}
-				this.locker.Unlock()
+				this.reloadServer()
 			case <-nodeTaskNotify: // 有新的更新任务
 				err := this.loop()
 				if err != nil {
@@ -870,3 +879,62 @@ func (this *Node) onReload(config *nodeconfigs.NodeConfig) {
 		teaconst.GlobalProductName = config.ProductConfig.Name
 	}
 }
+
+// reload server config
+func (this *Node) reloadServer() {
+	this.locker.Lock()
+	defer this.locker.Unlock()
+
+	if len(this.updatingServerMap) > 0 {
+		var updatingServerMap = this.updatingServerMap
+		this.updatingServerMap = map[int64]*serverconfigs.ServerConfig{}
+		newNodeConfig, err := nodeconfigs.CloneNodeConfig(sharedNodeConfig)
+		if err != nil {
+			remotelogs.Error("NODE", "apply server config error: "+err.Error())
+			return
+		}
+		for serverId, serverConfig := range updatingServerMap {
+			if serverConfig != nil {
+				newNodeConfig.AddServer(serverConfig)
+			} else {
+				newNodeConfig.RemoveServer(serverId)
+			}
+		}
+
+		err, serverErrors := newNodeConfig.Init()
+		if err != nil {
+			remotelogs.Error("NODE", "apply server config error: "+err.Error())
+			return
+		}
+		if len(serverErrors) > 0 {
+			for _, serverErr := range serverErrors {
+				remotelogs.ServerError(serverErr.Id, "NODE", serverErr.Message, nodeconfigs.NodeLogTypeServerConfigInitFailed, maps.Map{})
+			}
+		}
+
+		this.onReload(newNodeConfig)
+
+		err = sharedListenerManager.Start(newNodeConfig)
+		if err != nil {
+			remotelogs.Error("NODE", "apply server config error: "+err.Error())
+		}
+	}
+}
+
+func (this *Node) checkDisk() {
+	if runtime.GOOS == "linux" {
+		for _, path := range []string{
+			"/sys/block/vda/queue/rotational",
+			"/sys/block/sda/queue/rotational",
+		} {
+			data, err := ioutil.ReadFile(path)
+			if err != nil {
+				continue
+			}
+			if string(data) == "0" {
+				teaconst.DiskIsFast = true
+			}
+			break
+		}
+	}
+}
--- a/internal/nodes/node_ext.go
+++ b/internal/nodes/node_ext.go
@@ -0,0 +1,9 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+//go:build !script
+// +build !script
+
+package nodes
+
+func (this *Node) reloadCommonScripts() error {
+	return nil
+}
--- a/internal/nodes/node_status_executor.go
+++ b/internal/nodes/node_status_executor.go
@@ -7,6 +7,7 @@ import (
 	"github.com/TeaOSLab/EdgeNode/internal/caches"
 	teaconst "github.com/TeaOSLab/EdgeNode/internal/const"
 	"github.com/TeaOSLab/EdgeNode/internal/events"
+	"github.com/TeaOSLab/EdgeNode/internal/firewalls"
 	"github.com/TeaOSLab/EdgeNode/internal/monitor"
 	"github.com/TeaOSLab/EdgeNode/internal/remotelogs"
 	"github.com/TeaOSLab/EdgeNode/internal/rpc"
@@ -62,7 +63,7 @@ func (this *NodeStatusExecutor) update() {
 	var tr = trackers.Begin("UPLOAD_NODE_STATUS")
 	defer tr.End()

-	status := &nodeconfigs.NodeStatus{}
+	var status = &nodeconfigs.NodeStatus{}
 	status.BuildVersion = teaconst.Version
 	status.BuildVersionCode = utils.VersionToLong(teaconst.Version)
 	status.OS = runtime.GOOS
@@ -74,6 +75,10 @@ func (this *NodeStatusExecutor) update() {
 	status.CacheTotalMemorySize = caches.SharedManager.TotalMemorySize()
 	status.TrafficInBytes = teaconst.InTrafficBytes
 	status.TrafficOutBytes = teaconst.OutTrafficBytes
+	var localFirewall = firewalls.Firewall()
+	if localFirewall != nil && !localFirewall.IsMock() {
+		status.LocalFirewallName = localFirewall.Name()
+	}

 	// 记录监控数据
 	monitor.SharedValueQueue.Add(nodeconfigs.NodeValueItemConnections, maps.Map{
@@ -148,6 +153,7 @@ func (this *NodeStatusExecutor) updateCPU(status *nodeconfigs.NodeStatus) {
 	// 记录监控数据
 	monitor.SharedValueQueue.Add(nodeconfigs.NodeValueItemCPU, maps.Map{
 		"usage": status.CPUUsage,
+		"cores": runtime.NumCPU(),
 	})

 	if this.cpuLogicalCount == 0 && this.cpuPhysicalCount == 0 {
--- a/internal/nodes/origin_state_manager.go
+++ b/internal/nodes/origin_state_manager.go
@@ -124,9 +124,10 @@ func (this *OriginStateManager) Loop() error {

 // Fail 添加失败的源站
 func (this *OriginStateManager) Fail(origin *serverconfigs.OriginConfig, reverseProxy *serverconfigs.ReverseProxyConfig, callback func()) {
-	if origin == nil {
+	if origin == nil || origin.Id <= 0 {
 		return
 	}
+
 	this.locker.Lock()
 	state, ok := this.stateMap[origin.Id]
 	var timestamp = time.Now().Unix()
@@ -164,7 +165,7 @@ func (this *OriginStateManager) Fail(origin *serverconfigs.OriginConfig, reverse

 // Success 添加成功的源站
 func (this *OriginStateManager) Success(origin *serverconfigs.OriginConfig, callback func()) {
-	if origin == nil {
+	if origin == nil || origin.Id <= 0 {
 		return
 	}

@@ -182,6 +183,10 @@ func (this *OriginStateManager) Success(origin *serverconfigs.OriginConfig, call

 // IsAvailable 检查是否正常
 func (this *OriginStateManager) IsAvailable(originId int64) bool {
+	if originId <= 0 {
+		return true
+	}
+
 	this.locker.RLock()
 	_, ok := this.stateMap[originId]
 	this.locker.RUnlock()
--- a/internal/nodes/task_ocsp_update.go
+++ b/internal/nodes/task_ocsp_update.go
@@ -60,7 +60,7 @@ func (this *OCSPUpdateTask) Loop() error {
 		return err
 	}

-	resp, err := rpcClient.SSLCertService().ListUpdatedSSLCertOCSP(rpcClient.Context(), &pb.ListUpdatedSSLCertOCSPRequest{
+	resp, err := rpcClient.SSLCertRPC().ListUpdatedSSLCertOCSP(rpcClient.Context(), &pb.ListUpdatedSSLCertOCSPRequest{
 		Version: this.version,
 		Size:    100,
 	})
--- a/internal/re/regexp.go
+++ b/internal/re/regexp.go
@@ -3,9 +3,11 @@
 package re

 import (
+	"github.com/iwind/TeaGo/types"
 	"regexp"
 	"regexp/syntax"
 	"strings"
+	"sync/atomic"
 )

 var prefixReg = regexp.MustCompile(`^\(\?([\w\s]+)\)`) // (?x)
@@ -13,6 +15,8 @@ var prefixReg2 = regexp.MustCompile(`^\(\?([\w\s]*:)`) // (?x: ...
 var braceZeroReg = regexp.MustCompile(`^{\s*0*\s*}`)   // {0}
 var braceZeroReg2 = regexp.MustCompile(`^{\s*0*\s*,`)  // {0, x}

+var lastId uint64
+
 type Regexp struct {
 	exp       string
 	rawRegexp *regexp.Regexp
@@ -21,6 +25,9 @@ type Regexp struct {
 	isCaseInsensitive bool
 	keywords          []string
 	keywordsMap       RuneMap
+
+	id       uint64
+	idString string
 }

 func MustCompile(exp string) *Regexp {
@@ -50,6 +57,9 @@ func NewRegexp(rawRegexp *regexp.Regexp) *Regexp {
 }

 func (this *Regexp) init() {
+	this.id = atomic.AddUint64(&lastId, 1)
+	this.idString = "re:" + types.String(this.id)
+
 	if len(this.exp) == 0 {
 		return
 	}
@@ -202,6 +212,10 @@ func (this *Regexp) ParseKeywords(exp string) (keywords []string) {
 	return
 }

+func (this *Regexp) IdString() string {
+	return this.idString
+}
+
 func (this *Regexp) parseKeyword(subExp string) (result []rune) {
 	if len(subExp) == 0 {
 		return nil
--- a/internal/rpc/rpc_client.go
+++ b/internal/rpc/rpc_client.go
@@ -135,11 +135,11 @@ func (this *RPCClient) MetricStatRPC() pb.MetricStatServiceClient {
 	return pb.NewMetricStatServiceClient(this.pickConn())
 }

-func (this *RPCClient) FirewallService() pb.FirewallServiceClient {
+func (this *RPCClient) FirewallRPC() pb.FirewallServiceClient {
 	return pb.NewFirewallServiceClient(this.pickConn())
 }

-func (this *RPCClient) SSLCertService() pb.SSLCertServiceClient {
+func (this *RPCClient) SSLCertRPC() pb.SSLCertServiceClient {
 	return pb.NewSSLCertServiceClient(this.pickConn())
 }

--- a/internal/rpc/rpc_utils.go
+++ b/internal/rpc/rpc_utils.go
@@ -4,6 +4,7 @@ import (
 	"github.com/TeaOSLab/EdgeNode/internal/configs"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"strings"
 	"sync"
 )

@@ -41,7 +42,12 @@ func IsConnError(err error) bool {
 	// 检查是否为连接错误
 	statusErr, ok := status.FromError(err)
 	if ok {
-		return statusErr.Code() == codes.Unavailable
+		var errorCode = statusErr.Code()
+		return errorCode == codes.Unavailable || errorCode == codes.Canceled
+	}
+
+	if strings.Contains(err.Error(), "code = Canceled") {
+		return true
 	}

 	return false
--- a/internal/stats/traffic_stat_manager.go
+++ b/internal/stats/traffic_stat_manager.go
@@ -101,7 +101,7 @@ func (this *TrafficStatManager) Add(serverId int64, domain string, bytes int64,

 	this.totalRequests++

-	timestamp := utils.FloorUnixTime(300)
+	var timestamp = utils.FloorUnixTime(300)
 	key := strconv.FormatInt(timestamp, 10) + strconv.FormatInt(serverId, 10)
 	this.locker.Lock()

--- a/internal/ttlcache/cache.go
+++ b/internal/ttlcache/cache.go
@@ -24,13 +24,13 @@ type Cache struct {
 }

 func NewCache(opt ...OptionInterface) *Cache {
-	var countPieces = 128
-	var maxItems = 2_000_000
+	var countPieces = 256
+	var maxItems = 1_000_000

 	var totalMemory = utils.SystemMemoryGB()
 	if totalMemory < 2 {
 		// 我们限制内存过小的服务能够使用的数量
-		maxItems = 1_000_000
+		maxItems = 500_000
 	} else {
 		var delta = totalMemory / 8
 		if delta > 0 {
@@ -54,7 +54,7 @@ func NewCache(opt ...OptionInterface) *Cache {
 		}
 	}

-	cache := &Cache{
+	var cache = &Cache{
 		countPieces: uint64(countPieces),
 		maxItems:    maxItems,
 	}
--- a/internal/ttlcache/cache_test.go
+++ b/internal/ttlcache/cache_test.go
@@ -1,16 +1,20 @@
 package ttlcache

 import (
+	"github.com/TeaOSLab/EdgeNode/internal/utils"
 	"github.com/TeaOSLab/EdgeNode/internal/utils/testutils"
+	"github.com/iwind/TeaGo/assert"
 	"github.com/iwind/TeaGo/rands"
+	"github.com/iwind/TeaGo/types"
 	"runtime"
 	"strconv"
+	"sync/atomic"
 	"testing"
 	"time"
 )

 func TestNewCache(t *testing.T) {
-	cache := NewCache()
+	var cache = NewCache()
 	cache.Write("a", 1, time.Now().Unix()+3600)
 	cache.Write("b", 2, time.Now().Unix()+3601)
 	cache.Write("a", 1, time.Now().Unix()+3602)
@@ -23,10 +27,10 @@ func TestNewCache(t *testing.T) {
 			}
 		}
 	}
-	t.Log(cache.Read("a"))
+	t.Log("a:", cache.Read("a"))
 	time.Sleep(2 * time.Second)
-	t.Log(cache.Read("d"))
-	t.Log(cache.Count(), "items")
+	t.Log("d:", cache.Read("d")) // should be nil
+	t.Log("left:", cache.Count(), "items")
 }

 func TestCache_Memory(t *testing.T) {
@@ -40,7 +44,7 @@ func TestCache_Memory(t *testing.T) {

 	t.Log(cache.Count())

-	time.Sleep(1 * time.Second)
+	time.Sleep(10 * time.Second)
 	for i := 0; i < count; i++ {
 		if i%2 == 0 {
 			cache.Delete("a" + strconv.Itoa(i))
@@ -50,27 +54,29 @@ func TestCache_Memory(t *testing.T) {
 	t.Log(cache.Count())

 	cache.Count()
-}

-func BenchmarkCache_Add(b *testing.B) {
-	runtime.GOMAXPROCS(1)
-
-	cache := NewCache()
-	for i := 0; i < b.N; i++ {
-		cache.Write(strconv.Itoa(i), i, time.Now().Unix()+int64(i%1024))
-	}
+	time.Sleep(10 * time.Second)
 }

 func TestCache_IncreaseInt64(t *testing.T) {
+	var a = assert.NewAssertion(t)
+
 	var cache = NewCache()
+	var unixTime = time.Now().Unix()

 	{
-		cache.IncreaseInt64("a", 1, time.Now().Unix()+3600)
-		t.Log(cache.Read("a"))
+		cache.IncreaseInt64("a", 1, unixTime+3600)
+		var item = cache.Read("a")
+		t.Log(item)
+		a.IsTrue(item.Value == int64(1))
+		a.IsTrue(item.expiredAt == unixTime+3600)
 	}
 	{
-		cache.IncreaseInt64("a", 1, time.Now().Unix()+3600+1)
-		t.Log(cache.Read("a"))
+		cache.IncreaseInt64("a", 1, unixTime+3600+1)
+		var item = cache.Read("a")
+		t.Log(item)
+		a.IsTrue(item.Value == int64(2))
+		a.IsTrue(item.expiredAt == unixTime+3600+1)
 	}
 	{
 		cache.Write("b", 1, time.Now().Unix()+3600+2)
@@ -124,11 +130,16 @@ func TestCache_GC(t *testing.T) {
 	for i := 0; i < 20; i++ {
 		cache.GC()
 		t.Log("items:", cache.Count())
+
+		if cache.Count() == 0 {
+			break
+		}
 		time.Sleep(1 * time.Second)
 	}

 	t.Log("now:", time.Now().Unix())
 	for _, p := range cache.pieces {
+		t.Log("expire list:", p.expiresList.Count(), p.expiresList)
 		for k, v := range p.m {
 			t.Log(k, v.Value, v.expiredAt)
 		}
@@ -138,12 +149,12 @@ func TestCache_GC(t *testing.T) {
 func TestCache_GC2(t *testing.T) {
 	runtime.GOMAXPROCS(1)

-	cache1 := NewCache(NewPiecesOption(32))
+	var cache1 = NewCache(NewPiecesOption(32))
 	for i := 0; i < 1_000_000; i++ {
 		cache1.Write(strconv.Itoa(i), i, time.Now().Unix()+int64(rands.Int(0, 10)))
 	}

-	cache2 := NewCache(NewPiecesOption(5))
+	var cache2 = NewCache(NewPiecesOption(5))
 	for i := 0; i < 1_000_000; i++ {
 		cache2.Write(strconv.Itoa(i), i, time.Now().Unix()+int64(rands.Int(0, 10)))
 	}
@@ -153,3 +164,83 @@ func TestCache_GC2(t *testing.T) {
 		time.Sleep(1 * time.Second)
 	}
 }
+
+func TestCacheDestroy(t *testing.T) {
+	var cache = NewCache()
+	t.Log("count:", SharedManager.Count())
+	cache.Destroy()
+	t.Log("count:", SharedManager.Count())
+}
+
+func BenchmarkNewCache(b *testing.B) {
+	runtime.GOMAXPROCS(1)
+
+	var cache = NewCache(NewPiecesOption(128))
+	for i := 0; i < 2_000_000; i++ {
+		cache.Write(strconv.Itoa(i), i, time.Now().Unix()+int64(rands.Int(10, 100)))
+	}
+	b.Log("start reading ...")
+
+	b.ResetTimer()
+
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			cache.Read(strconv.Itoa(rands.Int(0, 999999)))
+		}
+	})
+}
+
+func BenchmarkCache_Add(b *testing.B) {
+	runtime.GOMAXPROCS(1)
+
+	var cache = NewCache()
+	for i := 0; i < b.N; i++ {
+		cache.Write(strconv.Itoa(i), i, utils.UnixTime()+int64(i%1024))
+	}
+}
+
+func BenchmarkCache_Add_Parallel(b *testing.B) {
+	runtime.GOMAXPROCS(1)
+
+	var cache = NewCache()
+	var i int64
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			var j = atomic.AddInt64(&i, 1)
+			cache.Write(types.String(j), j, utils.UnixTime()+i%1024)
+		}
+	})
+}
+
+func BenchmarkNewCacheGC(b *testing.B) {
+	runtime.GOMAXPROCS(1)
+
+	var cache = NewCache(NewPiecesOption(1024))
+	for i := 0; i < 3_000_000; i++ {
+		cache.Write(strconv.Itoa(i), i, time.Now().Unix()+int64(rands.Int(0, 100)))
+	}
+	//b.Log(cache.pieces[0].Count())
+
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			cache.GC()
+		}
+	})
+}
+
+func BenchmarkNewCacheClean(b *testing.B) {
+	runtime.GOMAXPROCS(1)
+
+	var cache = NewCache(NewPiecesOption(128))
+	for i := 0; i < 3_000_000; i++ {
+		cache.Write(strconv.Itoa(i), i, time.Now().Unix()+int64(rands.Int(10, 100)))
+	}
+
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			cache.Clean()
+		}
+	})
+}
--- a/internal/ttlcache/manager.go
+++ b/internal/ttlcache/manager.go
@@ -20,7 +20,7 @@ type Manager struct {

 func NewManager() *Manager {
 	var manager = &Manager{
-		ticker:   time.NewTicker(3 * time.Second),
+		ticker:   time.NewTicker(2 * time.Second),
 		cacheMap: map[*Cache]zero.Zero{},
 	}

@@ -52,3 +52,9 @@ func (this *Manager) Remove(cache *Cache) {
 	delete(this.cacheMap, cache)
 	this.locker.Unlock()
 }
+
+func (this *Manager) Count() int {
+	this.locker.Lock()
+	defer this.locker.Unlock()
+	return len(this.cacheMap)
+}
--- a/internal/ttlcache/piece.go
+++ b/internal/ttlcache/piece.go
@@ -2,36 +2,40 @@ package ttlcache

 import (
 	"github.com/TeaOSLab/EdgeNode/internal/utils"
+	"github.com/TeaOSLab/EdgeNode/internal/utils/expires"
 	"github.com/iwind/TeaGo/types"
 	"sync"
 	"time"
 )

 type Piece struct {
-	m        map[uint64]*Item
-	maxItems int
+	m           map[uint64]*Item
+	expiresList *expires.List
+	maxItems    int
+	lastGCTime  int64

 	locker sync.RWMutex
 }

 func NewPiece(maxItems int) *Piece {
-	return &Piece{m: map[uint64]*Item{}, maxItems: maxItems}
+	return &Piece{
+		m:           map[uint64]*Item{},
+		expiresList: expires.NewSingletonList(),
+		maxItems:    maxItems,
+	}
 }

 func (this *Piece) Add(key uint64, item *Item) (ok bool) {
 	this.locker.Lock()
 	if len(this.m) >= this.maxItems {
-		// 尝试先删除过期的
-		this.gcWithoutLocker()
-
-		// 仍然是满的就跳过
-		if len(this.m) >= this.maxItems {
-			this.locker.Unlock()
-			return
-		}
+		this.locker.Unlock()
+		return
 	}
 	this.m[key] = item
 	this.locker.Unlock()
+
+	this.expiresList.Add(key, item.expiredAt)
+
 	return true
 }

@@ -42,6 +46,7 @@ func (this *Piece) IncreaseInt64(key uint64, delta int64, expiredAt int64) (resu
 		result = types.Int64(item.Value) + delta
 		item.Value = result
 		item.expiredAt = expiredAt
+		this.expiresList.Add(key, expiredAt)
 	} else {
 		if len(this.m) < this.maxItems {
 			result = delta
@@ -49,13 +54,17 @@ func (this *Piece) IncreaseInt64(key uint64, delta int64, expiredAt int64) (resu
 				Value:     delta,
 				expiredAt: expiredAt,
 			}
+			this.expiresList.Add(key, expiredAt)
 		}
 	}
 	this.locker.Unlock()
+
 	return
 }

 func (this *Piece) Delete(key uint64) {
+	this.expiresList.Remove(key)
+
 	this.locker.Lock()
 	delete(this.m, key)
 	this.locker.Unlock()
@@ -80,29 +89,48 @@ func (this *Piece) Count() (count int) {
 }

 func (this *Piece) GC() {
-	this.locker.Lock()
-	this.gcWithoutLocker()
-	this.locker.Unlock()
+	var currentTime = time.Now().Unix()
+	if this.lastGCTime == 0 {
+		this.lastGCTime = currentTime - 3600
+	}
+
+	var min = this.lastGCTime
+	var max = currentTime
+	if min > max {
+		// 过去的时间比现在大，则从这一秒重新开始
+		min = max
+	}
+
+	for i := min; i <= max; i++ {
+		var itemMap = this.expiresList.GC(i)
+		if len(itemMap) > 0 {
+			this.gcItemMap(itemMap)
+		}
+	}
+
+	this.lastGCTime = currentTime
 }

 func (this *Piece) Clean() {
 	this.locker.Lock()
 	this.m = map[uint64]*Item{}
 	this.locker.Unlock()
+
+	this.expiresList.Clean()
 }

 func (this *Piece) Destroy() {
 	this.locker.Lock()
 	this.m = nil
 	this.locker.Unlock()
+
+	this.expiresList.Clean()
 }

-// 不加锁的gc
-func (this *Piece) gcWithoutLocker() {
-	timestamp := time.Now().Unix()
-	for k, item := range this.m {
-		if item.expiredAt <= timestamp {
-			delete(this.m, k)
-		}
+func (this *Piece) gcItemMap(itemMap expires.ItemMap) {
+	this.locker.Lock()
+	for key := range itemMap {
+		delete(this.m, key)
 	}
+	this.locker.Unlock()
 }
--- a/internal/utils/dbs/db.go
+++ b/internal/utils/dbs/db.go
@@ -31,6 +31,10 @@ func (this *DB) EnableStat(b bool) {
 	this.enableStat = b
 }

+func (this *DB) Begin() (*sql.Tx, error) {
+	return this.rawDB.Begin()
+}
+
 func (this *DB) Prepare(query string) (*Stmt, error) {
 	stmt, err := this.rawDB.Prepare(query)
 	if err != nil {
--- a/internal/utils/expires/list.go
+++ b/internal/utils/expires/list.go
@@ -5,21 +5,24 @@ import (
 	"sync"
 )

-type ItemMap = map[int64]zero.Zero
+type ItemMap = map[uint64]zero.Zero

 type List struct {
 	expireMap map[int64]ItemMap // expires timestamp => map[id]ItemMap
-	itemsMap  map[int64]int64   // itemId => timestamp
+	itemsMap  map[uint64]int64  // itemId => timestamp

 	locker sync.Mutex

-	gcCallback func(itemId int64)
+	gcCallback      func(itemId uint64)
+	gcBatchCallback func(itemIds ItemMap)
+
+	lastTimestamp int64
 }

 func NewList() *List {
 	var list = &List{
 		expireMap: map[int64]ItemMap{},
-		itemsMap:  map[int64]int64{},
+		itemsMap:  map[uint64]int64{},
 	}

 	SharedManager.Add(list)
@@ -27,12 +30,25 @@ func NewList() *List {
 	return list
 }

+func NewSingletonList() *List {
+	var list = &List{
+		expireMap: map[int64]ItemMap{},
+		itemsMap:  map[uint64]int64{},
+	}
+
+	return list
+}
+
 // Add 添加条目
 // 如果条目已经存在，则覆盖
-func (this *List) Add(itemId int64, expiresAt int64) {
+func (this *List) Add(itemId uint64, expiresAt int64) {
 	this.locker.Lock()
 	defer this.locker.Unlock()

+	if this.lastTimestamp == 0 || this.lastTimestamp > expiresAt {
+		this.lastTimestamp = expiresAt
+	}
+
 	// 是否已经存在
 	oldExpiresAt, ok := this.itemsMap[itemId]
 	if ok {
@@ -55,34 +71,61 @@ func (this *List) Add(itemId int64, expiresAt int64) {
 	this.itemsMap[itemId] = expiresAt
 }

-func (this *List) Remove(itemId int64) {
+func (this *List) Remove(itemId uint64) {
 	this.locker.Lock()
 	defer this.locker.Unlock()
 	this.removeItem(itemId)
 }

-func (this *List) GC(timestamp int64, callback func(itemId int64)) {
+func (this *List) GC(timestamp int64) ItemMap {
+	if this.lastTimestamp > timestamp+1 {
+		return nil
+	}
 	this.locker.Lock()
 	var itemMap = this.gcItems(timestamp)
 	if len(itemMap) == 0 {
 		this.locker.Unlock()
-		return
+		return itemMap
 	}
 	this.locker.Unlock()

-	if callback != nil {
+	if this.gcCallback != nil {
 		for itemId := range itemMap {
-			callback(itemId)
+			this.gcCallback(itemId)
 		}
 	}
+	if this.gcBatchCallback != nil {
+		this.gcBatchCallback(itemMap)
+	}
+
+	return itemMap
 }

-func (this *List) OnGC(callback func(itemId int64)) *List {
+func (this *List) Clean() {
+	this.locker.Lock()
+	this.itemsMap = map[uint64]int64{}
+	this.expireMap = map[int64]ItemMap{}
+	this.locker.Unlock()
+}
+
+func (this *List) Count() int {
+	this.locker.Lock()
+	var count = len(this.itemsMap)
+	this.locker.Unlock()
+	return count
+}
+
+func (this *List) OnGC(callback func(itemId uint64)) *List {
 	this.gcCallback = callback
 	return this
 }

-func (this *List) removeItem(itemId int64) {
+func (this *List) OnGCBatch(callback func(itemMap ItemMap)) *List {
+	this.gcBatchCallback = callback
+	return this
+}
+
+func (this *List) removeItem(itemId uint64) {
 	expiresAt, ok := this.itemsMap[itemId]
 	if !ok {
 		return
--- a/internal/utils/expires/list_test.go
+++ b/internal/utils/expires/list_test.go
@@ -1,6 +1,7 @@
 package expires

 import (
+	"github.com/TeaOSLab/EdgeNode/internal/utils"
 	"github.com/iwind/TeaGo/assert"
 	"github.com/iwind/TeaGo/logs"
 	timeutil "github.com/iwind/TeaGo/utils/time"
@@ -50,13 +51,34 @@ func TestList_Remove(t *testing.T) {
 }

 func TestList_GC(t *testing.T) {
+	var unixTime = time.Now().Unix()
+	t.Log("unixTime:", unixTime)
+
+	var list = NewList()
+	list.Add(1, unixTime+1)
+	list.Add(2, unixTime+1)
+	list.Add(3, unixTime+2)
+	list.OnGC(func(itemId uint64) {
+		t.Log("gc:", itemId)
+	})
+	t.Log("last unixTime:", list.lastTimestamp)
+	list.GC(time.Now().Unix() + 2)
+	logs.PrintAsJSON(list.expireMap, t)
+	logs.PrintAsJSON(list.itemsMap, t)
+
+	t.Log(list.Count())
+}
+
+func TestList_GC_Batch(t *testing.T) {
 	list := NewList()
 	list.Add(1, time.Now().Unix()+1)
 	list.Add(2, time.Now().Unix()+1)
 	list.Add(3, time.Now().Unix()+2)
-	list.GC(time.Now().Unix()+2, func(itemId int64) {
-		t.Log("gc:", itemId)
+	list.Add(4, time.Now().Unix()+2)
+	list.OnGCBatch(func(itemMap ItemMap) {
+		t.Log("gc:", itemMap)
 	})
+	list.GC(time.Now().Unix() + 2)
 	logs.PrintAsJSON(list.expireMap, t)
 	logs.PrintAsJSON(list.itemsMap, t)
 }
@@ -72,7 +94,7 @@ func TestList_Start_GC(t *testing.T) {
 	list.Add(7, time.Now().Unix()+6)
 	list.Add(8, time.Now().Unix()+6)

-	list.OnGC(func(itemId int64) {
+	list.OnGC(func(itemId uint64) {
 		t.Log("gc:", itemId, timeutil.Format("H:i:s"))
 		time.Sleep(2 * time.Second)
 	})
@@ -87,17 +109,18 @@ func TestList_Start_GC(t *testing.T) {
 func TestList_ManyItems(t *testing.T) {
 	list := NewList()
 	for i := 0; i < 1_000; i++ {
-		list.Add(int64(i), time.Now().Unix())
+		list.Add(uint64(i), time.Now().Unix())
 	}
 	for i := 0; i < 1_000; i++ {
-		list.Add(int64(i), time.Now().Unix()+1)
+		list.Add(uint64(i), time.Now().Unix()+1)
 	}

 	now := time.Now()
 	count := 0
-	list.GC(time.Now().Unix()+1, func(itemId int64) {
+	list.OnGC(func(itemId uint64) {
 		count++
 	})
+	list.GC(time.Now().Unix() + 1)
 	t.Log("gc", count, "items")
 	t.Log(time.Now().Sub(now))
 }
@@ -171,15 +194,23 @@ func BenchmarkList_GC(b *testing.B) {

 	var lists = []*List{}

-	for i := 0; i < 100; i++ {
-		lists = append(lists, NewList())
+	for m := 0; m < 1_000; m++ {
+		var list = NewList()
+		for j := 0; j < 10_000; j++ {
+			list.Add(uint64(j), utils.UnixTime()+100)
+		}
+		lists = append(lists, list)
 	}

+	b.ResetTimer()
+
 	var timestamp = time.Now().Unix()

-	for i := 0; i < b.N; i++ {
-		for _, list := range lists {
-			list.GC(timestamp, nil)
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			for _, list := range lists {
+				list.GC(timestamp)
+			}
 		}
-	}
+	})
 }
--- a/internal/utils/expires/manager.go
+++ b/internal/utils/expires/manager.go
@@ -31,31 +31,32 @@ func NewManager() *Manager {
 func (this *Manager) init() {
 	var lastTimestamp = int64(0)
 	for range this.ticker.C {
-		timestamp := time.Now().Unix()
+		var currentTime = time.Now().Unix()
 		if lastTimestamp == 0 {
-			lastTimestamp = timestamp - 3600
+			lastTimestamp = currentTime - 3600
 		}

-		if timestamp >= lastTimestamp {
-			for i := lastTimestamp; i <= timestamp; i++ {
+		if currentTime >= lastTimestamp {
+			for i := lastTimestamp; i <= currentTime; i++ {
 				this.locker.Lock()
 				for list := range this.listMap {
-					list.GC(i, list.gcCallback)
+					list.GC(i)
 				}
 				this.locker.Unlock()
 			}
 		} else {
-			for i := timestamp; i <= lastTimestamp; i++ {
+			// 如果过去的时间比现在大，则从这一秒重新开始
+			for i := currentTime; i <= currentTime; i++ {
 				this.locker.Lock()
 				for list := range this.listMap {
-					list.GC(i, list.gcCallback)
+					list.GC(i)
 				}
 				this.locker.Unlock()
 			}
 		}

 		// 这样做是为了防止系统时钟突变
-		lastTimestamp = timestamp
+		lastTimestamp = currentTime
 	}
 }

--- a/internal/utils/sets/set_fixed_test.go
+++ b/internal/utils/sets/set_fixed_test.go
@@ -5,6 +5,7 @@ package setutils_test
 import (
 	setutils "github.com/TeaOSLab/EdgeNode/internal/utils/sets"
 	"github.com/iwind/TeaGo/assert"
+	"github.com/iwind/TeaGo/rands"
 	"testing"
 )

@@ -45,13 +46,17 @@ func TestFixedSet_Reset(t *testing.T) {
 }

 func BenchmarkFixedSet_Has(b *testing.B) {
-	var count = 100_000
+	var count = 1_000_000
 	var set = setutils.NewFixedSet(count)
 	for i := 0; i < count; i++ {
 		set.Push(i)
 	}

-	for i := 0; i < b.N; i++ {
-		set.Has(i)
-	}
+	b.ResetTimer()
+
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			set.Has(rands.Int(0, 100_000))
+		}
+	})
 }
--- a/internal/utils/workspace.go
+++ b/internal/utils/workspace.go
@@ -0,0 +1,15 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package utils
+
+import "regexp"
+
+var workspaceReg = regexp.MustCompile(`/Edge[A-Z]\w+/`)
+
+func RemoveWorkspace(path string) string {
+	var indexes = workspaceReg.FindAllStringIndex(path, -1)
+	if len(indexes) > 0 {
+		return path[indexes[len(indexes)-1][0]:]
+	}
+	return path
+}
--- a/internal/utils/writers/writer_bytes_counter.go
+++ b/internal/utils/writers/writer_bytes_counter.go
@@ -13,6 +13,10 @@ func NewBytesCounterWriter(rawWriter io.Writer) *BytesCounterWriter {
 	return &BytesCounterWriter{writer: rawWriter}
 }

+func (this *BytesCounterWriter) RawWriter() io.Writer {
+	return this.writer
+}
+
 func (this *BytesCounterWriter) Write(p []byte) (n int, err error) {
 	n, err = this.writer.Write(p)
 	this.count += int64(n)
--- a/internal/waf/action_notify.go
+++ b/internal/waf/action_notify.go
@@ -34,7 +34,7 @@ func init() {
 			}

 			for task := range notifyChan {
-				_, err = rpcClient.FirewallService().NotifyHTTPFirewallEvent(rpcClient.Context(), &pb.NotifyHTTPFirewallEventRequest{
+				_, err = rpcClient.FirewallRPC().NotifyHTTPFirewallEvent(rpcClient.Context(), &pb.NotifyHTTPFirewallEventRequest{
 					ServerId:                task.ServerId,
 					HttpFirewallPolicyId:    task.HttpFirewallPolicyId,
 					HttpFirewallRuleGroupId: task.HttpFirewallRuleGroupId,
--- a/internal/waf/checkpoints/cc2.go
+++ b/internal/waf/checkpoints/cc2.go
@@ -11,7 +11,7 @@ import (
 	"time"
 )

-var ccCache = ttlcache.NewCache(ttlcache.NewPiecesOption(32))
+var ccCache = ttlcache.NewCache()

 // CC2Checkpoint 新的CC
 type CC2Checkpoint struct {
--- a/internal/waf/checkpoints/request_all.go
+++ b/internal/waf/checkpoints/request_all.go
@@ -2,6 +2,7 @@ package checkpoints

 import (
 	"github.com/TeaOSLab/EdgeNode/internal/waf/requests"
+	"github.com/TeaOSLab/EdgeNode/internal/waf/utils"
 	"github.com/iwind/TeaGo/maps"
 )

@@ -28,7 +29,7 @@ func (this *RequestAllCheckpoint) RequestValue(req requests.Request, param strin

 		var bodyData = req.WAFGetCacheBody()
 		if len(bodyData) == 0 {
-			data, err := req.WAFReadBody(int64(32 * 1024 * 1024)) // read 32m bytes
+			data, err := req.WAFReadBody(utils.MaxBodySize) // read body
 			if err != nil {
 				return "", err, nil
 			}
--- a/internal/waf/checkpoints/request_body.go
+++ b/internal/waf/checkpoints/request_body.go
@@ -2,6 +2,7 @@ package checkpoints

 import (
 	"github.com/TeaOSLab/EdgeNode/internal/waf/requests"
+	"github.com/TeaOSLab/EdgeNode/internal/waf/utils"
 	"github.com/iwind/TeaGo/maps"
 )

@@ -23,7 +24,7 @@ func (this *RequestBodyCheckpoint) RequestValue(req requests.Request, param stri

 	var bodyData = req.WAFGetCacheBody()
 	if len(bodyData) == 0 {
-		data, err := req.WAFReadBody(int64(32 * 1024 * 1024)) // read 32m bytes
+		data, err := req.WAFReadBody(utils.MaxBodySize) // read body
 		if err != nil {
 			return "", err, nil
 		}
--- a/internal/waf/checkpoints/request_form_arg.go
+++ b/internal/waf/checkpoints/request_form_arg.go
@@ -2,6 +2,7 @@ package checkpoints

 import (
 	"github.com/TeaOSLab/EdgeNode/internal/waf/requests"
+	"github.com/TeaOSLab/EdgeNode/internal/waf/utils"
 	"github.com/iwind/TeaGo/maps"
 	"net/url"
 )
@@ -24,7 +25,7 @@ func (this *RequestFormArgCheckpoint) RequestValue(req requests.Request, param s

 	var bodyData = req.WAFGetCacheBody()
 	if len(bodyData) == 0 {
-		data, err := req.WAFReadBody(int64(32 * 1024 * 1024)) // read 32m bytes
+		data, err := req.WAFReadBody(utils.MaxBodySize) // read body
 		if err != nil {
 			return "", err, nil
 		}
--- a/internal/waf/checkpoints/request_json_arg.go
+++ b/internal/waf/checkpoints/request_json_arg.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"github.com/TeaOSLab/EdgeNode/internal/utils"
 	"github.com/TeaOSLab/EdgeNode/internal/waf/requests"
+	wafutils "github.com/TeaOSLab/EdgeNode/internal/waf/utils"
 	"github.com/iwind/TeaGo/maps"
 	"strings"
 )
@@ -16,7 +17,7 @@ type RequestJSONArgCheckpoint struct {
 func (this *RequestJSONArgCheckpoint) RequestValue(req requests.Request, param string, options maps.Map) (value interface{}, sysErr error, userErr error) {
 	var bodyData = req.WAFGetCacheBody()
 	if len(bodyData) == 0 {
-		data, err := req.WAFReadBody(int64(32 * 1024 * 1024)) // read 32m bytes
+		data, err := req.WAFReadBody(wafutils.MaxBodySize) // read body
 		if err != nil {
 			return "", err, nil
 		}
--- a/internal/waf/checkpoints/request_upload.go
+++ b/internal/waf/checkpoints/request_upload.go
@@ -3,6 +3,7 @@ package checkpoints
 import (
 	"bytes"
 	"github.com/TeaOSLab/EdgeNode/internal/waf/requests"
+	"github.com/TeaOSLab/EdgeNode/internal/waf/utils"
 	"github.com/iwind/TeaGo/lists"
 	"github.com/iwind/TeaGo/maps"
 	"io/ioutil"
@@ -38,7 +39,7 @@ func (this *RequestUploadCheckpoint) RequestValue(req requests.Request, param st
 	if req.WAFRaw().MultipartForm == nil {
 		var bodyData = req.WAFGetCacheBody()
 		if len(bodyData) == 0 {
-			data, err := req.WAFReadBody(32 * 1024 * 1024)
+			data, err := req.WAFReadBody(utils.MaxBodySize)
 			if err != nil {
 				sysErr = err
 				return
@@ -51,7 +52,7 @@ func (this *RequestUploadCheckpoint) RequestValue(req requests.Request, param st
 		oldBody := req.WAFRaw().Body
 		req.WAFRaw().Body = ioutil.NopCloser(bytes.NewBuffer(bodyData))

-		err := req.WAFRaw().ParseMultipartForm(32 * 1024 * 1024)
+		err := req.WAFRaw().ParseMultipartForm(utils.MaxBodySize)

 		// 还原
 		req.WAFRaw().Body = oldBody
--- a/internal/waf/ip_list.go
+++ b/internal/waf/ip_list.go
@@ -27,26 +27,26 @@ const IPTypeAll = "*"
 // IPList IP列表管理
 type IPList struct {
 	expireList *expires.List
-	ipMap      map[string]int64 // ip => id
-	idMap      map[int64]string // id => ip
+	ipMap      map[string]uint64 // ip => id
+	idMap      map[uint64]string // id => ip
 	listType   IPListType

-	id     int64
+	id     uint64
 	locker sync.RWMutex
 }

 // NewIPList 获取新对象
 func NewIPList(listType IPListType) *IPList {
 	var list = &IPList{
-		ipMap:    map[string]int64{},
-		idMap:    map[int64]string{},
+		ipMap:    map[string]uint64{},
+		idMap:    map[uint64]string{},
 		listType: listType,
 	}

 	e := expires.NewList()
 	list.expireList = e

-	e.OnGC(func(itemId int64) {
+	e.OnGC(func(itemId uint64) {
 		list.remove(itemId)
 	})

@@ -150,7 +150,7 @@ func (this *IPList) RemoveIP(ip string, serverId int64, shouldExecute bool) {
 	}
 }

-func (this *IPList) remove(id int64) {
+func (this *IPList) remove(id uint64) {
 	this.locker.Lock()
 	ip, ok := this.idMap[id]
 	if ok {
@@ -163,6 +163,6 @@ func (this *IPList) remove(id int64) {
 	this.locker.Unlock()
 }

-func (this *IPList) nextId() int64 {
-	return atomic.AddInt64(&this.id, 1)
+func (this *IPList) nextId() uint64 {
+	return atomic.AddUint64(&this.id, 1)
 }
--- a/internal/waf/utils/consts.go
+++ b/internal/waf/utils/consts.go
@@ -0,0 +1,9 @@
+// Copyright 2022 Liuxiangchao iwind.liu@gmail.com. All rights reserved.
+
+package utils
+
+import "github.com/TeaOSLab/EdgeNode/internal/utils/sizes"
+
+const (
+	MaxBodySize = 4 * sizes.M
+)
--- a/internal/waf/utils/utils.go
+++ b/internal/waf/utils/utils.go
@@ -1,7 +1,6 @@
 package utils

 import (
-	"fmt"
 	"github.com/TeaOSLab/EdgeNode/internal/re"
 	"github.com/TeaOSLab/EdgeNode/internal/ttlcache"
 	"github.com/cespare/xxhash"
@@ -19,13 +18,13 @@ func MatchStringCache(regex *re.Regexp, s string) bool {
 		return regex.MatchString(s)
 	}

-	hash := xxhash.Sum64String(s)
-	key := fmt.Sprintf("%p_", regex) + strconv.FormatUint(hash, 10)
-	item := cache.Read(key)
+	var hash = xxhash.Sum64String(s)
+	var key = regex.IdString() + "@" + strconv.FormatUint(hash, 10)
+	var item = cache.Read(key)
 	if item != nil {
 		return types.Int8(item.Value) == 1
 	}
-	b := regex.MatchString(s)
+	var b = regex.MatchString(s)
 	if b {
 		cache.Write(key, 1, time.Now().Unix()+1800)
 	} else {
@@ -41,16 +40,16 @@ func MatchBytesCache(regex *re.Regexp, byteSlice []byte) bool {
 		return regex.Match(byteSlice)
 	}

-	hash := xxhash.Sum64(byteSlice)
-	key := fmt.Sprintf("%p_", regex) + strconv.FormatUint(hash, 10)
-	item := cache.Read(key)
+	var hash = xxhash.Sum64(byteSlice)
+	var key = regex.IdString() + "@" + strconv.FormatUint(hash, 10)
+	var item = cache.Read(key)
 	if item != nil {
 		return types.Int8(item.Value) == 1
 	}
 	if item != nil {
 		return types.Int8(item.Value) == 1
 	}
-	b := regex.Match(byteSlice)
+	var b = regex.Match(byteSlice)
 	if b {
 		cache.Write(key, 1, time.Now().Unix()+1800)
 	} else {
Author	SHA1	Message	Date
刘祥超	1d33284b2e	节点状态中增加本地防火墙名称	2022-04-22 14:59:00 +08:00
刘祥超	09ec4507be	优化WAF日志逻辑	2022-04-21 19:44:19 +08:00
刘祥超	a15f0e3051	默认记录WAF的条件从检测到攻击改为所有匹配WAF规则集的请求	2022-04-21 19:02:17 +08:00
刘祥超	67b982c67a	节点状态记录是否检查到本地防火墙	2022-04-21 18:14:53 +08:00
刘祥超	5e1f8f305c	调整默认缓存容量	2022-04-21 09:40:20 +08:00
刘祥超	adfdd5f1b6	强制记录攻击日志	2022-04-21 09:40:05 +08:00
刘祥超	553deda20b	优化代码	2022-04-20 20:05:16 +08:00
刘祥超	7225cef18e	修正文件缓存“慢”打开文件耗时阈值	2022-04-20 18:41:53 +08:00
刘祥超	0e5aef923d	文件缓存增加自动限速/提升本地缓存数据库写入和查询速度	2022-04-20 18:23:26 +08:00
刘祥超	5c54a47587	优化节点停止逻辑	2022-04-20 10:32:40 +08:00
刘祥超	6c294d0282	更新相关库	2022-04-20 10:22:25 +08:00
刘祥超	d6eec0fa52	去除错误提示中的程序文件名中的Workspace目录	2022-04-18 16:31:48 +08:00
刘祥超	9c79152efe	修复UDP服务端口变化时导致的死循环	2022-04-18 15:39:42 +08:00
刘祥超	8765f3a0c6	修复服务配置变化可能导致的死锁	2022-04-18 15:39:02 +08:00
刘祥超	8272fe7fa5	优化缓存相关代码	2022-04-15 14:23:06 +08:00
刘祥超	1636ef8891	优化缓存相关代码	2022-04-14 10:25:34 +08:00
刘祥超	ed0c562b2e	优化缓存相关代码	2022-04-14 09:36:02 +08:00
刘祥超	08a307d8d8	优化代码	2022-04-13 19:24:23 +08:00
刘祥超	5e2bf493b2	优化代码	2022-04-12 21:43:19 +08:00
刘祥超	065dda1dbf	优化基准测试	2022-04-10 21:21:45 +08:00
刘祥超	715e79c3e1	优化代码	2022-04-10 18:46:44 +08:00
刘祥超	2490d6f9d8	优化本地日志	2022-04-10 15:54:30 +08:00
刘祥超	8c4e7129f3	如果Header中Location字段含有跟源站一样的地址，则自动修改为当前域名	2022-04-09 20:37:05 +08:00
刘祥超	3f621c5af0	优化ttlcache	2022-04-09 18:49:52 +08:00
刘祥超	dba9c2c47d	优化ttlcache	2022-04-09 18:44:51 +08:00
刘祥超	ded2f98cce	优化ttlcache	2022-04-09 18:28:22 +08:00
刘祥超	02469f2886	增加基准测试	2022-04-09 10:02:09 +08:00
刘祥超	2121ebe2e0	优化代码	2022-04-08 16:11:05 +08:00
刘祥超	51b9ce6f48	修改个别错误级别	2022-04-08 15:25:53 +08:00
刘祥超	bed19bf844	优化代码/CPU监控信息增加CPU逻辑核数	2022-04-07 09:45:55 +08:00
刘祥超	20a77021f6	将RPC Canceled错误级别调整为警告	2022-04-07 09:45:27 +08:00
刘祥超	c5d061dbe2	优化代码	2022-04-05 15:10:32 +08:00
刘祥超	bd9c8b3d0e	保存L2节点数据时同时记录缓存时间	2022-04-05 11:00:55 +08:00
刘祥超	221d7e6434	缓存文件实现Sendfile	2022-04-04 19:45:57 +08:00
刘祥超	a59007a249	优化代码	2022-04-04 18:25:54 +08:00
刘祥超	6998d3468b	优化代码/商业版支持L2节点	2022-04-04 12:06:53 +08:00
刘祥超	d7ec36b12c	修改一处日志级别	2022-04-02 15:34:00 +08:00
刘祥超	79f4db5a6c	response body buffer默认改为16k	2022-04-02 10:41:02 +08:00
刘祥超	048c6f213b	集群可以设置WebP策略	2022-04-01 16:18:15 +08:00
刘祥超	59faf95885	限制WebP可转换的最大长度为128M（非ChunkEncoding下）	2022-03-31 16:30:15 +08:00
刘祥超	7b0b9ac3b4	只有满足缓存条件的图片内容才会被转换	2022-03-31 16:22:23 +08:00
刘祥超	f7ed942779	修复临时关闭页面内容切换到HTML无法使用的问题	2022-03-31 15:17:30 +08:00
刘祥超	6e6be5d8d1	优化OpenFileCache fsnotify事件	2022-03-31 13:30:52 +08:00
刘祥超	221d00b450	修复OpenFileCache可能无法更新的Bug	2022-03-31 11:47:31 +08:00
刘祥超	9689baccf7	修复编译386时可能出现的错误	2022-03-30 22:53:06 +08:00
刘祥超	21de83d31e	反向代理错误增加URL显示	2022-03-30 17:31:47 +08:00
刘祥超	f925d86107	商业版增加UAM功能	2022-03-29 21:24:57 +08:00
刘祥超	db6e20ba37	支持路由定义请求脚本	2022-03-26 22:03:40 +08:00
刘祥超	33a8bae7c5	服务相关流量统计增加Header	2022-03-26 12:29:34 +08:00
刘祥超	b243d6c92e	攻击流量统计使用上行流量	2022-03-26 12:16:25 +08:00
刘祥超	050dd02fa5	优化编译脚本	2022-03-26 11:47:25 +08:00
刘祥超	e5b44ce178	优化代码	2022-03-25 14:11:34 +08:00
刘祥超	f6a983e683	HttpWriter暴露两个方法/默认Buffer为4K	2022-03-24 21:42:03 +08:00
刘祥超	99227bb4f2	IP找不到不再提示错误	2022-03-24 21:41:32 +08:00
刘祥超	d1ea67581e	版本号改为0.4.7	2022-03-23 14:44:43 +08:00