diff --git a/crates/shadowsocks/src/context.rs b/crates/shadowsocks/src/context.rs
index 08cae4707635..21c707bb5a0f 100644
--- a/crates/shadowsocks/src/context.rs
+++ b/crates/shadowsocks/src/context.rs
@@ -13,6 +13,7 @@ use crate::{
 };
 
 /// Service context
+#[derive(Debug)]
 pub struct Context {
     // Protector against replay attack
     // The actual replay detection behavior is implemented in ReplayProtector
diff --git a/crates/shadowsocks/src/dns_resolver/resolver.rs b/crates/shadowsocks/src/dns_resolver/resolver.rs
index d2ee79919b5f..da0020044424 100644
--- a/crates/shadowsocks/src/dns_resolver/resolver.rs
+++ b/crates/shadowsocks/src/dns_resolver/resolver.rs
@@ -38,6 +38,7 @@ pub trait DnsResolve {
 }
 
 #[cfg(feature = "hickory-dns")]
+#[derive(Debug)]
 pub struct HickoryDnsSystemResolver {
     resolver: ArcSwap<HickoryDnsResolver>,
     #[cfg_attr(any(windows, target_os = "android"), allow(dead_code))]
diff --git a/crates/shadowsocks/src/manager/datagram.rs b/crates/shadowsocks/src/manager/datagram.rs
index 05131d9ecd4a..06106f1af720 100644
--- a/crates/shadowsocks/src/manager/datagram.rs
+++ b/crates/shadowsocks/src/manager/datagram.rs
@@ -46,6 +46,7 @@ impl fmt::Display for ManagerSocketAddr {
 /// Datagram socket for manager
 ///
 /// For *nix system, this is a wrapper for both UDP socket and Unix socket
+#[derive(Debug)]
 pub enum ManagerDatagram {
     UdpDatagram(UdpSocket),
     #[cfg(unix)]
diff --git a/crates/shadowsocks/src/manager/listener.rs b/crates/shadowsocks/src/manager/listener.rs
index 004d82f2bec3..6f79d9d60b09 100644
--- a/crates/shadowsocks/src/manager/listener.rs
+++ b/crates/shadowsocks/src/manager/listener.rs
@@ -13,6 +13,7 @@ use super::{
 };
 
 /// Manager server Listener
+#[derive(Debug)]
 pub struct ManagerListener {
     socket: ManagerDatagram,
 }
diff --git a/crates/shadowsocks/src/net/tcp.rs b/crates/shadowsocks/src/net/tcp.rs
index 97708ae7ebfc..66b797a66106 100644
--- a/crates/shadowsocks/src/net/tcp.rs
+++ b/crates/shadowsocks/src/net/tcp.rs
@@ -121,6 +121,7 @@ impl AsyncWrite for TcpStream {
 }
 
 /// `TcpListener` for accepting inbound connections
+#[derive(Debug)]
 pub struct TcpListener {
     inner: TokioTcpListener,
     accept_opts: AcceptOpts,
diff --git a/crates/shadowsocks/src/net/udp.rs b/crates/shadowsocks/src/net/udp.rs
index 2512be801ee3..3a8acc2d44b4 100644
--- a/crates/shadowsocks/src/net/udp.rs
+++ b/crates/shadowsocks/src/net/udp.rs
@@ -85,6 +85,7 @@ fn make_mtu_error(packet_size: usize, mtu: usize) -> io::Error {
 }
 
 /// Wrappers for outbound `UdpSocket`
+#[derive(Debug)]
 #[pin_project]
 pub struct UdpSocket {
     #[pin]
diff --git a/crates/shadowsocks/src/plugin/mod.rs b/crates/shadowsocks/src/plugin/mod.rs
index b55f7c0b83a2..379052f7c3bb 100644
--- a/crates/shadowsocks/src/plugin/mod.rs
+++ b/crates/shadowsocks/src/plugin/mod.rs
@@ -58,6 +58,7 @@ pub enum PluginMode {
 }
 
 /// A shadowsocks SIP004 Plugin
+#[derive(Debug)]
 pub struct Plugin {
     process: Child,
     local_addr: SocketAddr,
diff --git a/crates/shadowsocks/src/relay/tcprelay/aead.rs b/crates/shadowsocks/src/relay/tcprelay/aead.rs
index 1d4e5a22b91d..9fd19c739ed9 100644
--- a/crates/shadowsocks/src/relay/tcprelay/aead.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/aead.rs
@@ -80,6 +80,7 @@ impl From<ProtocolError> for io::Error {
     }
 }
 
+#[derive(Debug)]
 enum DecryptReadState {
     WaitSalt { key: Bytes },
     ReadLength,
@@ -320,6 +321,7 @@ impl DecryptedReader {
     }
 }
 
+#[derive(Debug)]
 enum EncryptWriteState {
     AssemblePacket,
     Writing { pos: usize },
diff --git a/crates/shadowsocks/src/relay/tcprelay/crypto_io.rs b/crates/shadowsocks/src/relay/tcprelay/crypto_io.rs
index 701503d3f3cf..f375517b4398 100644
--- a/crates/shadowsocks/src/relay/tcprelay/crypto_io.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/crypto_io.rs
@@ -1,7 +1,7 @@
 //! IO facilities for TCP relay
 
 use std::{
-    io,
+    fmt, io,
     marker::Unpin,
     pin::Pin,
     sync::Arc,
@@ -313,6 +313,15 @@ pub struct CryptoStream<S> {
     has_handshaked: bool,
 }
 
+impl<S> fmt::Debug for CryptoStream<S> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("CryptoStream")
+            .field("method", &self.method)
+            .field("has_handshaked", &self.has_handshaked)
+            .finish()
+    }
+}
+
 impl<S> CryptoStream<S> {
     /// Create a new CryptoStream with the underlying stream connection
     pub fn from_stream(
diff --git a/crates/shadowsocks/src/relay/tcprelay/proxy_listener.rs b/crates/shadowsocks/src/relay/tcprelay/proxy_listener.rs
index 055393c27ae3..9cac931e736f 100644
--- a/crates/shadowsocks/src/relay/tcprelay/proxy_listener.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/proxy_listener.rs
@@ -17,6 +17,7 @@ use crate::{
 };
 
 /// A TCP listener for accepting shadowsocks' client connection
+#[derive(Debug)]
 pub struct ProxyListener {
     listener: TcpListener,
     method: CipherKind,
diff --git a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/client.rs b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/client.rs
index 953815ea27bb..ef5f0102cc9f 100644
--- a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/client.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/client.rs
@@ -30,12 +30,14 @@ use crate::{
     },
 };
 
+#[derive(Debug)]
 enum ProxyClientStreamWriteState {
     Connect(Address),
     Connecting(BytesMut),
     Connected,
 }
 
+#[derive(Debug)]
 enum ProxyClientStreamReadState {
     #[cfg(feature = "aead-cipher-2022")]
     CheckRequestNonce,
@@ -43,6 +45,7 @@ enum ProxyClientStreamReadState {
 }
 
 /// A stream for sending / receiving data stream from remote server via shadowsocks' proxy server
+#[derive(Debug)]
 #[pin_project]
 pub struct ProxyClientStream<S> {
     #[pin]
diff --git a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/mod.rs b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/mod.rs
index 55e8b2a76360..9a300c129960 100644
--- a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/mod.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/mod.rs
@@ -18,6 +18,7 @@ pub mod v1;
 #[cfg(feature = "aead-cipher-2022")]
 pub mod v2;
 
+#[derive(Debug)]
 pub enum TcpRequestHeader {
     Stream(StreamTcpRequestHeader),
     #[cfg(feature = "aead-cipher-2022")]
@@ -74,6 +75,7 @@ impl TcpRequestHeader {
     }
 }
 
+#[derive(Debug)]
 pub enum TcpRequestHeaderRef<'a> {
     Stream(StreamTcpRequestHeaderRef<'a>),
     #[cfg(feature = "aead-cipher-2022")]
diff --git a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v1.rs b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v1.rs
index 17b9b3648bdf..7c002923e512 100644
--- a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v1.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v1.rs
@@ -7,6 +7,7 @@ use tokio::io::AsyncRead;
 
 use crate::relay::socks5::Address;
 
+#[derive(Debug)]
 pub struct StreamTcpRequestHeader {
     pub addr: Address,
 }
@@ -27,6 +28,7 @@ impl StreamTcpRequestHeader {
     }
 }
 
+#[derive(Debug)]
 pub struct StreamTcpRequestHeaderRef<'a> {
     pub addr: &'a Address,
 }
diff --git a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v2.rs b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v2.rs
index 5b45fec34bcf..469488d5b4f5 100644
--- a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v2.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/protocol/v2.rs
@@ -66,6 +66,7 @@ impl Aead2022TcpRequestHeader {
     }
 }
 
+#[derive(Debug)]
 pub struct Aead2022TcpRequestHeaderRef<'a> {
     pub addr: &'a Address,
     pub padding_size: u16,
diff --git a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/server.rs b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/server.rs
index 374d9d3ce468..784f39e478dd 100644
--- a/crates/shadowsocks/src/relay/tcprelay/proxy_stream/server.rs
+++ b/crates/shadowsocks/src/relay/tcprelay/proxy_stream/server.rs
@@ -25,6 +25,7 @@ use crate::{
     },
 };
 
+#[derive(Debug)]
 enum ProxyServerStreamWriteState {
     #[cfg(feature = "aead-cipher-2022")]
     PrepareHeader(Option<std::task::Waker>),
@@ -32,6 +33,7 @@ enum ProxyServerStreamWriteState {
 }
 
 /// A stream for communicating with shadowsocks' proxy client
+#[derive(Debug)]
 #[pin_project]
 pub struct ProxyServerStream<S> {
     #[pin]
diff --git a/crates/shadowsocks/src/relay/udprelay/proxy_socket.rs b/crates/shadowsocks/src/relay/udprelay/proxy_socket.rs
index 4cf7d7fc7e60..5fdc647d85fa 100644
--- a/crates/shadowsocks/src/relay/udprelay/proxy_socket.rs
+++ b/crates/shadowsocks/src/relay/udprelay/proxy_socket.rs
@@ -69,6 +69,7 @@ impl From<ProxySocketError> for io::Error {
 pub type ProxySocketResult<T> = Result<T, ProxySocketError>;
 
 /// UDP client for communicating with ShadowSocks' server
+#[derive(Debug)]
 pub struct ProxySocket {
     socket_type: UdpSocketType,
     socket: ShadowUdpSocket,
diff --git a/crates/shadowsocks/src/security/replay/mod.rs b/crates/shadowsocks/src/security/replay/mod.rs
index 968f8d7b0082..baf5d1933603 100644
--- a/crates/shadowsocks/src/security/replay/mod.rs
+++ b/crates/shadowsocks/src/security/replay/mod.rs
@@ -1,3 +1,5 @@
+use std::fmt;
+
 #[cfg(feature = "aead-cipher-2022")]
 use std::time::Duration;
 
@@ -29,6 +31,12 @@ pub struct ReplayProtector {
     nonce_set: spin::Mutex<LruCache<Vec<u8>, ()>>,
 }
 
+impl fmt::Debug for ReplayProtector {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.debug_struct("ReplayProtector").finish()
+    }
+}
+
 impl ReplayProtector {
     /// Create a new ReplayProtector
     #[allow(unused_variables)]
diff --git a/crates/shadowsocks/src/security/replay/ppbloom.rs b/crates/shadowsocks/src/security/replay/ppbloom.rs
index cf0be9c82c22..50490ccba7a9 100644
--- a/crates/shadowsocks/src/security/replay/ppbloom.rs
+++ b/crates/shadowsocks/src/security/replay/ppbloom.rs
@@ -27,6 +27,7 @@ const BF_ERROR_RATE_FOR_CLIENT: f64 = 1e-15;
 //
 // It contains 2 bloom filters and each one holds 1/2 entries.
 // Use them as a ring buffer.
+#[derive(Debug)]
 pub struct PingPongBloom {
     blooms: [Bloom<[u8]>; 2],
     bloom_count: [usize; 2],