fix test

Update ctypes_libsodium.py

.gitignore

@@ -17,6 +17,7 @@ develop-eggs
 pip-log.txt
 
 # Unit test / coverage reports
+htmlcov
 .coverage
 .tox
 

.jenkins.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+
+result=0
+
+function run_test {
+    printf '\e[0;36m'
+    echo "running test: $command $@"
+    printf '\e[0m'
+
+    $command "$@"
+    status=$?
+    if [ $status -ne 0 ]; then
+        printf '\e[0;31m'
+        echo "test failed: $command $@"
+        printf '\e[0m'
+        echo
+        result=1
+    else
+        printf '\e[0;32m'
+        echo OK
+        printf '\e[0m'
+        echo
+    fi
+    return 0
+}
+
+coverage erase
+mkdir tmp
+run_test pep8 .
+run_test pyflakes .
+run_test coverage run tests/nose_plugin.py -v
+run_test python setup.py sdist
+run_test tests/test_daemon.sh
+run_test python tests/test.py --with-coverage -c tests/aes.json
+run_test python tests/test.py --with-coverage -c tests/aes-ctr.json
+run_test python tests/test.py --with-coverage -c tests/aes-cfb1.json
+run_test python tests/test.py --with-coverage -c tests/aes-cfb8.json
+run_test python tests/test.py --with-coverage -c tests/rc4-md5.json
+run_test python tests/test.py --with-coverage -c tests/salsa20.json
+run_test python tests/test.py --with-coverage -c tests/chacha20.json
+run_test python tests/test.py --with-coverage -c tests/salsa20-ctr.json
+run_test python tests/test.py --with-coverage -c tests/table.json
+run_test python tests/test.py --with-coverage -c tests/server-multi-ports.json
+run_test python tests/test.py --with-coverage -s tests/server-multi-passwd.json -c tests/server-multi-passwd-client-side.json
+run_test python tests/test.py --with-coverage -c tests/workers.json
+run_test python tests/test.py --with-coverage -s tests/ipv6.json -c tests/ipv6-client-side.json
+run_test python tests/test.py --with-coverage -b "-m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -q" -a "-m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -vv"
+run_test python tests/test.py --with-coverage -b "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 --workers 1" -a "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 -l 1081 -t 30 -qq -b 127.0.0.1"
+
+if [ -f /proc/sys/net/ipv4/tcp_fastopen ] ; then
+    if [ 3 -eq `cat /proc/sys/net/ipv4/tcp_fastopen` ] ; then
+        # we have to run it twice:
+        # the first time there's no syn cookie
+        # the second time there is syn cookie
+        run_test python tests/test.py --with-coverage -c tests/fastopen.json
+        run_test python tests/test.py --with-coverage -c tests/fastopen.json
+    fi
+fi
+
+run_test tests/test_large_file.sh
+
+run_test tests/test_command.sh
+
+coverage combine && coverage report --include=shadowsocks/*
+rm -rf htmlcov
+rm -rf tmp
+coverage html --include=shadowsocks/*
+
+coverage report --include=shadowsocks/* | tail -n1 | rev | cut -d' ' -f 1 | rev > /tmp/shadowsocks-coverage
+
+exit $result

.travis.yml

@@ -9,29 +9,12 @@ cache:
     - dante-1.4.0
 before_install:
   - sudo apt-get update -qq
-  - sudo apt-get install -qq build-essential libssl-dev swig python-m2crypto python-numpy dnsutils
+  - sudo apt-get install -qq build-essential libssl-dev swig python-m2crypto python-numpy dnsutils iproute nginx bc
+  - sudo dd if=/dev/urandom of=/usr/share/nginx/www/file bs=1M count=10
+  - sudo service nginx restart
   - pip install m2crypto salsa20 pep8 pyflakes nose coverage
   - sudo tests/socksify/install.sh
   - sudo tests/libsodium/install.sh
+  - sudo tests/setup_tc.sh
 script:
-  - pep8 .
-  - pyflakes .
-  - coverage run tests/nose_plugin.py -v
-  - python setup.py sdist
-  - tests/test_daemon.sh
-  - python tests/test.py --with-coverage -c tests/aes.json
-  - python tests/test.py --with-coverage -c tests/aes-ctr.json
-  - python tests/test.py --with-coverage -c tests/aes-cfb1.json
-  - python tests/test.py --with-coverage -c tests/aes-cfb8.json
-  - python tests/test.py --with-coverage -c tests/rc4-md5.json
-  - python tests/test.py --with-coverage -c tests/salsa20.json
-  - python tests/test.py --with-coverage -c tests/chacha20.json
-  - python tests/test.py --with-coverage -c tests/salsa20-ctr.json
-  - python tests/test.py --with-coverage -c tests/table.json
-  - python tests/test.py --with-coverage -c tests/server-multi-ports.json
-  - python tests/test.py --with-coverage -s tests/server-multi-passwd.json -c tests/server-multi-passwd-client-side.json
-  - python tests/test.py --with-coverage -c tests/workers.json
-  - python tests/test.py --with-coverage -s tests/ipv6.json -c tests/ipv6-client-side.json
-  - python tests/test.py --with-coverage -b "-m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388" -a "-m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -l 1081"
-  - python tests/test.py --with-coverage -b "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388" -a "-m aes-256-cfb -k testrc4 -s 127.0.0.1 -p 8388 -l 1081"
-  - coverage combine && coverage report --include=shadowsocks/*
+  - ./.jenkins.sh

CHANGES

@@ -1,3 +1,7 @@
+2.6.1 2014-12-26
+- Fix a problem with TCP Fast Open on local side
+- Fix sometimes daemon_start returns wrong exit status
+
 2.6 2014-12-21
 - Add daemon support
 

README.md

@@ -1,7 +1,9 @@
 shadowsocks
 ===========
 
-[![PyPI version]][PyPI] [![Build Status]][Travis CI] 
+[![PyPI version]][PyPI]
+[![Build Status]][Travis CI]
+[![Coverage Status]][Coverage]
 
 A fast tunnel proxy that helps you bypass firewalls.
 
@@ -56,8 +58,7 @@ Example:
         "password":"mypassword",
         "timeout":300,
         "method":"aes-256-cfb",
-        "fast_open": false,
-        "workers": 1
+        "fast_open": false
     }
 
 Explanation of the fields:
@@ -74,43 +75,36 @@ Explanation of the fields:
 | fast_open     | use [TCP_FASTOPEN], true / false                |
 | workers       | number of workers, available on Unix/Linux      |
 
-Run `ssserver -c /etc/shadowsocks.json` on your server. To run it in the
-background, use [Supervisor].
+On your server:
 
-On your client machine, use the same configuration as your server, and
-start your client.
+To run in the foreground:
 
-If you use Chrome, it's recommended to use [SwitchySharp]. Change the proxy 
-settings to
+    ssserver -c /etc/shadowsocks.json
 
-    protocol: socks5
-    hostname: 127.0.0.1
-    port:     your local_port
+To run in the background:
 
-If you can't install [SwitchySharp], you can launch Chrome with the following
-arguments to force Chrome to use the proxy:
+    ssserver -c /etc/shadowsocks.json -d start
+    ssserver -c /etc/shadowsocks.json -d stop
 
-    Chrome.exe --proxy-server="socks5://127.0.0.1:1080" --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE localhost"
+On your client machine, use the same configuration as your server. Check the
+README of your client for more information.
 
-If you can't even download Chrome, find a friend to download a
-[Chrome Standalone] installer for you.
+Command Line Options
+--------------------
 
-Command line args
-------------------
-
-You can use args to override settings from `config.json`.
+Check the options via `-h`.You can use args to override settings from
+`config.json`.
 
     sslocal -s server_name -p server_port -l local_port -k password -m bf-cfb
     ssserver -p server_port -k password -m bf-cfb --workers 2
-    ssserver -c /etc/shadowsocks/config.json
+    ssserver -c /etc/shadowsocks/config.json -d start --pid-file=/tmp/shadowsocks.pid
+    ssserver -c /etc/shadowsocks/config.json -d stop --pid-file=/tmp/shadowsocks.pid
 
-List all available args with `-h`.
-
-Wiki
-----
+Documentation
+-------------
 
 You can find all the documentation in the wiki:
-https://github.com/clowwindy/shadowsocks/wiki
+https://github.com/shadowsocks/shadowsocks/wiki
 
 License
 -------
@@ -124,24 +118,23 @@ Bugs and Issues
 * [Mailing list]
 
 
-[Android]:           https://github.com/clowwindy/shadowsocks/wiki/Ports-and-Clients#android
-[Build Status]:      https://img.shields.io/travis/clowwindy/shadowsocks/master.svg?style=flat
-[Chinese Readme]:    https://github.com/clowwindy/shadowsocks/wiki/Shadowsocks-%E4%BD%BF%E7%94%A8%E8%AF%B4%E6%98%8E
-[Chrome Standalone]: https://support.google.com/installer/answer/126299
+[Android]:           https://github.com/shadowsocks/shadowsocks/wiki/Ports-and-Clients#android
+[Build Status]:      https://img.shields.io/travis/shadowsocks/shadowsocks/master.svg?style=flat
+[Chinese Readme]:    https://github.com/shadowsocks/shadowsocks/wiki/Shadowsocks-%E4%BD%BF%E7%94%A8%E8%AF%B4%E6%98%8E
+[Coverage Status]:   http://192.81.132.184/result/shadowsocks
+[Coverage]:          http://192.81.132.184/job/Shadowsocks/ws/htmlcov/index.html
 [Debian sid]:        https://packages.debian.org/unstable/python/shadowsocks
 [the package]:       https://pypi.python.org/pypi/shadowsocks
-[Encryption]:        https://github.com/clowwindy/shadowsocks/wiki/Encryption
+[Encryption]:        https://github.com/shadowsocks/shadowsocks/wiki/Encryption
 [iOS]:               https://github.com/shadowsocks/shadowsocks-iOS/wiki/Help
-[Issue Tracker]:     https://github.com/clowwindy/shadowsocks/issues?state=open
+[Issue Tracker]:     https://github.com/shadowsocks/shadowsocks/issues?state=open
 [Mailing list]:      http://groups.google.com/group/shadowsocks
 [OpenSSL for Windows]: http://slproweb.com/products/Win32OpenSSL.html
-[OpenWRT]:           https://github.com/clowwindy/shadowsocks/wiki/Ports-and-Clients#openwrt
+[OpenWRT]:           https://github.com/shadowsocks/shadowsocks/wiki/Ports-and-Clients#openwrt
 [OS X]:              https://github.com/shadowsocks/shadowsocks-iOS/wiki/Shadowsocks-for-OSX-Help
 [PyPI]:              https://pypi.python.org/pypi/shadowsocks
 [PyPI version]:      https://img.shields.io/pypi/v/shadowsocks.svg?style=flat
-[Supervisor]:        https://github.com/clowwindy/shadowsocks/wiki/Configure-Shadowsocks-with-Supervisor
-[TCP_FASTOPEN]:      https://github.com/clowwindy/shadowsocks/wiki/TCP-Fast-Open
-[Travis CI]:         https://travis-ci.org/clowwindy/shadowsocks
-[Troubleshooting]:   https://github.com/clowwindy/shadowsocks/wiki/Troubleshooting
-[SwitchySharp]:      https://chrome.google.com/webstore/detail/proxy-switchysharp/dpplabbmogkhghncfbfdeeokoefdjegm
-[Windows]:           https://github.com/clowwindy/shadowsocks/wiki/Ports-and-Clients#windows
+[TCP_FASTOPEN]:      https://github.com/shadowsocks/shadowsocks/wiki/TCP-Fast-Open
+[Travis CI]:         https://travis-ci.org/shadowsocks/shadowsocks
+[Troubleshooting]:   https://github.com/shadowsocks/shadowsocks/wiki/Troubleshooting
+[Windows]:           https://github.com/shadowsocks/shadowsocks/wiki/Ports-and-Clients#windows

README.rst

@@ -1,11 +1,11 @@
 shadowsocks
 ===========
 
-|PyPI version| |Build Status|
+|PyPI version| |Build Status| |Coverage Status|
 
 A fast tunnel proxy that helps you bypass firewalls.
 
-`中文说明 <https://github.com/clowwindy/shadowsocks/wiki/Shadowsocks-%E4%BD%BF%E7%94%A8%E8%AF%B4%E6%98%8E>`__
+`中文说明 <https://github.com/shadowsocks/shadowsocks/wiki/Shadowsocks-%E4%BD%BF%E7%94%A8%E8%AF%B4%E6%98%8E>`__
 
 Install
 -------
@@ -16,12 +16,12 @@ server.
 Client
 ~~~~~~
 
--  `Windows <https://github.com/clowwindy/shadowsocks/wiki/Ports-and-Clients#windows>`__
+-  `Windows <https://github.com/shadowsocks/shadowsocks/wiki/Ports-and-Clients#windows>`__
    / `OS
    X <https://github.com/shadowsocks/shadowsocks-iOS/wiki/Shadowsocks-for-OSX-Help>`__
--  `Android <https://github.com/clowwindy/shadowsocks/wiki/Ports-and-Clients#android>`__
+-  `Android <https://github.com/shadowsocks/shadowsocks/wiki/Ports-and-Clients#android>`__
    / `iOS <https://github.com/shadowsocks/shadowsocks-iOS/wiki/Help>`__
--  `OpenWRT <https://github.com/clowwindy/shadowsocks/wiki/Ports-and-Clients#openwrt>`__
+-  `OpenWRT <https://github.com/shadowsocks/shadowsocks/wiki/Ports-and-Clients#openwrt>`__
 
 Server
 ~~~~~~
@@ -50,9 +50,10 @@ CentOS:
 Windows:
 ^^^^^^^^
 
-Download OpenSSL for Windows and install. Then install shadowsocks via
-easy\_install and pip as Linux. If you don't know how to use them, you
-can directly download `the
+Download `OpenSSL for
+Windows <http://slproweb.com/products/Win32OpenSSL.html>`__ and install.
+Then install shadowsocks via easy\_install and pip as Linux. If you
+don't know how to use them, you can directly download `the
 package <https://pypi.python.org/pypi/shadowsocks>`__, and use
 ``python shadowsocks/server.py`` instead of ``ssserver`` command below.
 
@@ -71,82 +72,69 @@ On your server create a config file ``/etc/shadowsocks.json``. Example:
         "password":"mypassword",
         "timeout":300,
         "method":"aes-256-cfb",
-        "fast_open": false,
-        "workers": 1
+        "fast_open": false
     }
 
 Explanation of the fields:
 
-+------------------+---------------------------------------------------------------------------------------------------------+
-| Name             | Explanation                                                                                             |
-+==================+=========================================================================================================+
-| server           | the address your server listens                                                                         |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| server\_port     | server port                                                                                             |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| local\_address   | the address your local listens                                                                          |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| local\_port      | local port                                                                                              |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| password         | password used for encryption                                                                            |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| timeout          | in seconds                                                                                              |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| method           | default: "aes-256-cfb", see `Encryption <https://github.com/clowwindy/shadowsocks/wiki/Encryption>`__   |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| fast\_open       | use `TCP\_FASTOPEN <https://github.com/clowwindy/shadowsocks/wiki/TCP-Fast-Open>`__, true / false       |
-+------------------+---------------------------------------------------------------------------------------------------------+
-| workers          | number of workers, available on Unix/Linux                                                              |
-+------------------+---------------------------------------------------------------------------------------------------------+
++------------------+-----------------------------------------------------------------------------------------------------------+
+| Name             | Explanation                                                                                               |
++==================+===========================================================================================================+
+| server           | the address your server listens                                                                           |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| server\_port     | server port                                                                                               |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| local\_address   | the address your local listens                                                                            |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| local\_port      | local port                                                                                                |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| password         | password used for encryption                                                                              |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| timeout          | in seconds                                                                                                |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| method           | default: "aes-256-cfb", see `Encryption <https://github.com/shadowsocks/shadowsocks/wiki/Encryption>`__   |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| fast\_open       | use `TCP\_FASTOPEN <https://github.com/shadowsocks/shadowsocks/wiki/TCP-Fast-Open>`__, true / false       |
++------------------+-----------------------------------------------------------------------------------------------------------+
+| workers          | number of workers, available on Unix/Linux                                                                |
++------------------+-----------------------------------------------------------------------------------------------------------+
 
-Run ``ssserver -c /etc/shadowsocks.json`` on your server. To run it in
-the background, use
-`Supervisor <https://github.com/clowwindy/shadowsocks/wiki/Configure-Shadowsocks-with-Supervisor>`__.
+On your server:
 
-On your client machine, use the same configuration as your server, and
-start your client.
-
-If you use Chrome, it's recommended to use
-`SwitchySharp <https://chrome.google.com/webstore/detail/proxy-switchysharp/dpplabbmogkhghncfbfdeeokoefdjegm>`__.
-Change the proxy settings to
+To run in the foreground:
 
 ::
 
-    protocol: socks5
-    hostname: 127.0.0.1
-    port:     your local_port
+    ssserver -c /etc/shadowsocks.json
 
-If you can't install
-`SwitchySharp <https://chrome.google.com/webstore/detail/proxy-switchysharp/dpplabbmogkhghncfbfdeeokoefdjegm>`__,
-you can launch Chrome with the following arguments to force Chrome to
-use the proxy:
+To run in the background:
 
 ::
 
-    Chrome.exe --proxy-server="socks5://127.0.0.1:1080" --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE localhost"
+    ssserver -c /etc/shadowsocks.json -d start
+    ssserver -c /etc/shadowsocks.json -d stop
 
-If you can't even download Chrome, find a friend to download a `Chrome
-Standalone <https://support.google.com/installer/answer/126299>`__
-installer for you.
+On your client machine, use the same configuration as your server. Check
+the README of your client for more information.
 
-Command line args
------------------
+Command Line Options
+--------------------
 
-You can use args to override settings from ``config.json``.
+Check the options via ``-h``.You can use args to override settings from
+``config.json``.
 
 ::
 
     sslocal -s server_name -p server_port -l local_port -k password -m bf-cfb
     ssserver -p server_port -k password -m bf-cfb --workers 2
-    ssserver -c /etc/shadowsocks/config.json
+    ssserver -c /etc/shadowsocks/config.json -d start --pid-file=/tmp/shadowsocks.pid
+    ssserver -c /etc/shadowsocks/config.json -d stop --pid-file=/tmp/shadowsocks.pid
 
-List all available args with ``-h``.
-
-Wiki
-----
+Documentation
+-------------
 
 You can find all the documentation in the wiki:
-https://github.com/clowwindy/shadowsocks/wiki
+https://github.com/shadowsocks/shadowsocks/wiki
 
 License
 -------
@@ -156,12 +144,14 @@ MIT
 Bugs and Issues
 ---------------
 
--  `Troubleshooting <https://github.com/clowwindy/shadowsocks/wiki/Troubleshooting>`__
+-  `Troubleshooting <https://github.com/shadowsocks/shadowsocks/wiki/Troubleshooting>`__
 -  `Issue
-   Tracker <https://github.com/clowwindy/shadowsocks/issues?state=open>`__
+   Tracker <https://github.com/shadowsocks/shadowsocks/issues?state=open>`__
 -  `Mailing list <http://groups.google.com/group/shadowsocks>`__
 
 .. |PyPI version| image:: https://img.shields.io/pypi/v/shadowsocks.svg?style=flat
    :target: https://pypi.python.org/pypi/shadowsocks
-.. |Build Status| image:: https://img.shields.io/travis/clowwindy/shadowsocks/master.svg?style=flat
-   :target: https://travis-ci.org/clowwindy/shadowsocks
+.. |Build Status| image:: https://img.shields.io/travis/shadowsocks/shadowsocks/master.svg?style=flat
+   :target: https://travis-ci.org/shadowsocks/shadowsocks
+.. |Coverage Status| image:: http://192.81.132.184/result/shadowsocks
+   :target: http://192.81.132.184/job/Shadowsocks/ws/htmlcov/index.html

setup.py

@@ -7,12 +7,12 @@ with codecs.open('README.rst', encoding='utf-8') as f:
 
 setup(
     name="shadowsocks",
-    version="2.6",
+    version="2.6.1",
     license='MIT',
     description="A fast tunnel proxy that help you get through firewalls",
     author='clowwindy',
     author_email='clowwindy42@gmail.com',
-    url='https://github.com/clowwindy/shadowsocks',
+    url='https://github.com/shadowsocks/shadowsocks',
     packages=['shadowsocks', 'shadowsocks.crypto'],
     package_data={
         'shadowsocks': ['README.rst', 'LICENSE']

shadowsocks/crypto/ctypes_libsodium.py

@@ -27,7 +27,7 @@ import logging
 from ctypes import CDLL, c_char_p, c_int, c_ulonglong, byref, \
     create_string_buffer, c_void_p
 
-__all__ = ['ciphers']
+__all__ = ['ciphers', 'auths']
 
 libsodium = None
 loaded = False
@@ -42,7 +42,7 @@ def load_libsodium():
     global loaded, libsodium, buf
 
     from ctypes.util import find_library
-    for p in ('sodium',):
+    for p in ('sodium', 'libsodium'):
         libsodium_path = find_library(p)
         if libsodium_path:
             break
@@ -62,6 +62,14 @@ def load_libsodium():
                                                         c_char_p, c_ulonglong,
                                                         c_char_p)
 
+    libsodium.crypto_onetimeauth.restype = c_int
+    libsodium.crypto_onetimeauth.argtypes = (c_void_p, c_char_p,
+                                             c_ulonglong, c_char_p)
+
+    libsodium.crypto_onetimeauth_verify.restype = c_int
+    libsodium.crypto_onetimeauth_verify.argtypes = (c_char_p, c_char_p,
+                                                    c_ulonglong, c_char_p)
+
     libsodium.sodium_init()
 
     buf = create_string_buffer(buf_size)
@@ -106,11 +114,32 @@ class Salsa20Crypto(object):
         return buf.raw[padding:padding + l]
 
 
+class Poly1305(object):
+    @staticmethod
+    def auth(method, key, data):
+        if not loaded:
+            load_libsodium()
+        tag_buf = create_string_buffer(16)
+        libsodium.crypto_onetimeauth(byref(tag_buf), data, len(data), key)
+        return tag_buf.raw
+
+    @staticmethod
+    def verify(method, key, data, tag):
+        if not loaded:
+            load_libsodium()
+        r = libsodium.crypto_onetimeauth_verify(tag, data, len(data), key)
+        return r == 0
+
+
 ciphers = {
     b'salsa20': (32, 8, Salsa20Crypto),
     b'chacha20': (32, 8, Salsa20Crypto),
 }
 
+auths = {
+    b'poly1305': (32, 16, Poly1305)
+}
+
 
 def test_salsa20():
     from shadowsocks.crypto import util

shadowsocks/crypto/hmac.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python
+
+# Copyright (c) 2014 clowwindy
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+from __future__ import absolute_import, division, print_function, \
+    with_statement
+
+import hmac
+import hashlib
+
+from shadowsocks import common
+
+__all__ = ['auths']
+
+
+class HMAC(object):
+    @staticmethod
+    def auth(method, key, data):
+        digest = common.to_str(method.replace(b'hmac-', b''))
+        return hmac.new(key, data, getattr(hashlib, digest)).digest()
+
+    @staticmethod
+    def verify(method, key, data, tag):
+        digest = common.to_str(method.replace(b'hmac-', b''))
+        t = hmac.new(key, data, getattr(hashlib, digest)).digest()
+        if hasattr(hmac, 'compare_digest'):
+            return hmac.compare_digest(t, tag)
+        else:
+            return _time_independent_equals(t, tag)
+
+
+# from tornado
+def _time_independent_equals(a, b):
+    if len(a) != len(b):
+        return False
+    result = 0
+    if type(a[0]) is int:  # python3 byte strings
+        for x, y in zip(a, b):
+            result |= x ^ y
+    else:  # python2
+        for x, y in zip(a, b):
+            result |= ord(x) ^ ord(y)
+    return result == 0
+
+
+auths = {
+    b'hmac-md5': (32, 16, HMAC),
+    b'hmac-sha256': (32, 32, HMAC),
+}

shadowsocks/daemon.py

@@ -37,7 +37,7 @@ from shadowsocks import common
 def daemon_exec(config):
     if 'daemon' in config:
         if os.name != 'posix':
-            raise Exception('daemon mode is only supported in unix')
+            raise Exception('daemon mode is only supported on Unix')
         command = config['daemon']
         if not command:
             command = 'start'
@@ -100,19 +100,21 @@ def freopen(f, mode, stream):
 
 
 def daemon_start(pid_file, log_file):
-    # fork only once because we are sure parent will exit
-    pid = os.fork()
-    assert pid != -1
 
     def handle_exit(signum, _):
         if signum == signal.SIGTERM:
             sys.exit(0)
         sys.exit(1)
 
+    signal.signal(signal.SIGINT, handle_exit)
+    signal.signal(signal.SIGTERM, handle_exit)
+
+    # fork only once because we are sure parent will exit
+    pid = os.fork()
+    assert pid != -1
+
     if pid > 0:
         # parent waits for its child
-        signal.signal(signal.SIGINT, handle_exit)
-        signal.signal(signal.SIGTERM, handle_exit)
         time.sleep(5)
         sys.exit(0)
 
@@ -123,6 +125,9 @@ def daemon_start(pid_file, log_file):
         os.kill(ppid, signal.SIGINT)
         sys.exit(1)
 
+    os.setsid()
+    signal.signal(signal.SIG_IGN, signal.SIGHUP)
+
     print('started')
     os.kill(ppid, signal.SIGTERM)
 
@@ -132,7 +137,6 @@ def daemon_start(pid_file, log_file):
         freopen(log_file, 'a', sys.stderr)
     except IOError as e:
         logging.error(e)
-        os.kill(ppid, signal.SIGINT)
         sys.exit(1)
 
 

shadowsocks/encrypt.py

@@ -29,17 +29,23 @@ import hashlib
 import logging
 
 from shadowsocks.crypto import m2, rc4_md5, salsa20_ctr,\
-    ctypes_openssl, ctypes_libsodium, table
+    ctypes_openssl, ctypes_libsodium, table, hmac
+from shadowsocks import common
 
 
-method_supported = {}
-method_supported.update(rc4_md5.ciphers)
-method_supported.update(salsa20_ctr.ciphers)
-method_supported.update(ctypes_openssl.ciphers)
-method_supported.update(ctypes_libsodium.ciphers)
+ciphers_supported = {}
+ciphers_supported.update(rc4_md5.ciphers)
+ciphers_supported.update(salsa20_ctr.ciphers)
+ciphers_supported.update(ctypes_openssl.ciphers)
+ciphers_supported.update(ctypes_libsodium.ciphers)
 # let M2Crypto override ctypes_openssl
-method_supported.update(m2.ciphers)
-method_supported.update(table.ciphers)
+ciphers_supported.update(m2.ciphers)
+ciphers_supported.update(table.ciphers)
+
+
+auths_supported = {}
+auths_supported.update(hmac.auths)
+auths_supported.update(ctypes_libsodium.auths)
 
 
 def random_string(length):
@@ -50,22 +56,14 @@ def random_string(length):
         return os.urandom(length)
 
 
-cached_keys = {}
-
-
-def try_cipher(key, method=None):
+def try_cipher(key, method=None, auth=None):
     Encryptor(key, method)
+    auth_create(b'test', key, b'test', auth)
 
 
 def EVP_BytesToKey(password, key_len, iv_len):
     # equivalent to OpenSSL's EVP_BytesToKey() with count 1
     # so that we make the same key and iv as nodejs version
-    if hasattr(password, 'encode'):
-        password = password.encode('utf-8')
-    cached_key = '%s-%d-%d' % (password, key_len, iv_len)
-    r = cached_keys.get(cached_key, None)
-    if r:
-        return r
     m = []
     i = 0
     while len(b''.join(m)) < (key_len + iv_len):
@@ -79,7 +77,6 @@ def EVP_BytesToKey(password, key_len, iv_len):
     ms = b''.join(m)
     key = ms[:key_len]
     iv = ms[key_len:key_len + iv_len]
-    cached_keys[cached_key] = (key, iv)
     return key, iv
 
 
@@ -102,15 +99,14 @@ class Encryptor(object):
 
     def get_method_info(self, method):
         method = method.lower()
-        m = method_supported.get(method)
+        m = ciphers_supported.get(method)
         return m
 
     def iv_len(self):
         return len(self.cipher_iv)
 
     def get_cipher(self, password, method, op, iv):
-        if hasattr(password, 'encode'):
-            password = password.encode('utf-8')
+        password = common.to_bytes(password)
         m = self._method_info
         if m[0] > 0:
             key, iv_ = EVP_BytesToKey(password, m[0], m[1])
@@ -150,7 +146,8 @@ class Encryptor(object):
 def encrypt_all(password, method, op, data):
     result = []
     method = method.lower()
-    (key_len, iv_len, m) = method_supported[method]
+    password = common.to_bytes(password)
+    (key_len, iv_len, m) = ciphers_supported[method]
     if key_len > 0:
         key, _ = EVP_BytesToKey(password, key_len, iv_len)
     else:
@@ -166,6 +163,42 @@ def encrypt_all(password, method, op, data):
     return b''.join(result)
 
 
+def auth_create(data, password, iv, method):
+    if method is None:
+        return data
+    # prepend hmac to data
+    password = common.to_bytes(password)
+    method = method.lower()
+    method_info = auths_supported.get(method)
+    if not method_info:
+        logging.error('method %s not supported' % method)
+        sys.exit(1)
+    key_len, tag_len, m = method_info
+    key, _ = EVP_BytesToKey(password + iv, key_len, 0)
+    tag = m.auth(method, key, data)
+    return tag + data
+
+
+def auth_open(data, password, iv, method):
+    if not method:
+        return data
+    # verify hmac and remove the hmac or return None
+    password = common.to_bytes(password)
+    method = method.lower()
+    method_info = auths_supported.get(method)
+    if not method_info:
+        logging.error('method %s not supported' % method)
+        sys.exit(1)
+    key_len, tag_len, m = method_info
+    key, _ = EVP_BytesToKey(password + iv, key_len, 0)
+    if len(data) <= tag_len:
+        return None
+    result = data[tag_len:]
+    if not m.verify(method, key, result, data[:tag_len]):
+        return None
+    return result
+
+
 CIPHERS_TO_TEST = [
     b'aes-128-cfb',
     b'aes-256-cfb',
@@ -175,6 +208,13 @@ CIPHERS_TO_TEST = [
     b'table',
 ]
 
+AUTHS_TO_TEST = [
+    None,
+    b'hmac-md5',
+    b'hmac-sha256',
+    b'poly1305',
+]
+
 
 def test_encryptor():
     from os import urandom
@@ -198,6 +238,22 @@ def test_encrypt_all():
         assert plain == plain2
 
 
+def test_auth():
+    from os import urandom
+    plain = urandom(10240)
+    for method in AUTHS_TO_TEST:
+        logging.warn(method)
+        boxed = auth_create(plain, b'key', b'iv', method)
+        unboxed = auth_open(boxed, b'key', b'iv', method)
+        assert plain == unboxed
+        if method is not None:
+            b = common.ord(boxed[0])
+            b ^= 1
+            attack = common.chr(b) + boxed[1:]
+            assert auth_open(attack, b'key', b'iv', method) is None
+
+
 if __name__ == '__main__':
     test_encrypt_all()
     test_encryptor()
+    test_auth()

shadowsocks/local.py

@@ -49,7 +49,7 @@ def main():
 
     utils.print_shadowsocks()
 
-    encrypt.try_cipher(config['password'], config['method'])
+    encrypt.try_cipher(config['password'], config['method'], config['auth'])
 
     try:
         logging.info("starting local at %s:%d" %
@@ -68,6 +68,11 @@ def main():
             tcp_server.close(next_tick=True)
             udp_server.close(next_tick=True)
         signal.signal(getattr(signal, 'SIGQUIT', signal.SIGTERM), handler)
+
+        def int_handler(signum, _):
+            sys.exit(1)
+        signal.signal(signal.SIGINT, int_handler)
+
         loop.run()
     except (KeyboardInterrupt, IOError, OSError) as e:
         logging.error(e)

shadowsocks/server.py

@@ -57,7 +57,7 @@ def main():
         else:
             config['port_password'][str(server_port)] = config['password']
 
-    encrypt.try_cipher(config['password'], config['method'])
+    encrypt.try_cipher(config['password'], config['method'], config['auth'])
     tcp_servers = []
     udp_servers = []
     dns_resolver = asyncdns.DNSResolver()
@@ -77,6 +77,11 @@ def main():
                      tcp_servers + udp_servers))
         signal.signal(getattr(signal, 'SIGQUIT', signal.SIGTERM),
                       child_handler)
+
+        def int_handler(signum, _):
+            sys.exit(1)
+        signal.signal(signal.SIGINT, int_handler)
+
         try:
             loop = eventloop.EventLoop()
             dns_resolver.add_to_loop(loop)
@@ -113,6 +118,7 @@ def main():
                     sys.exit()
                 signal.signal(signal.SIGTERM, handler)
                 signal.signal(signal.SIGQUIT, handler)
+                signal.signal(signal.SIGINT, handler)
 
                 # master
                 for a_tcp_server in tcp_servers:

shadowsocks/tcprelay.py

@@ -241,19 +241,18 @@ class TCPRelayHandler(object):
                     self._create_remote_socket(self._chosen_server[0],
                                                self._chosen_server[1])
                 self._loop.add(remote_sock, eventloop.POLL_ERR)
-                data = b''.join(self._data_to_write_to_local)
+                data = b''.join(self._data_to_write_to_remote)
                 l = len(data)
                 s = remote_sock.sendto(data, MSG_FASTOPEN, self._chosen_server)
                 if s < l:
                     data = data[s:]
-                    self._data_to_write_to_local = [data]
-                    self._update_stream(STREAM_UP, WAIT_STATUS_READWRITING)
+                    self._data_to_write_to_remote = [data]
                 else:
-                    self._data_to_write_to_local = []
-                    self._update_stream(STREAM_UP, WAIT_STATUS_READING)
-                    self._stage = STAGE_STREAM
+                    self._data_to_write_to_remote = []
+                self._update_stream(STREAM_UP, WAIT_STATUS_READWRITING)
             except (OSError, IOError) as e:
                 if eventloop.errno_from_exception(e) == errno.EINPROGRESS:
+                    # in this case data is not sent at all
                     self._update_stream(STREAM_UP, WAIT_STATUS_READWRITING)
                 elif eventloop.errno_from_exception(e) == errno.ENOTCONN:
                     logging.error('fast open not supported on this OS')

shadowsocks/utils.py

@@ -29,7 +29,7 @@ import json
 import sys
 import getopt
 import logging
-from shadowsocks.common import to_bytes
+from shadowsocks.common import to_bytes, to_str
 
 
 VERBOSE_LEVEL = 5
@@ -73,7 +73,7 @@ def check_config(config):
         logging.warn('warning: local set to listen on 0.0.0.0, it\'s not safe')
     if config.get('server', '') in [b'127.0.0.1', b'localhost']:
         logging.warn('warning: server set to listen on %s:%s, are you sure?' %
-                     (config['server'], config['server_port']))
+                     (to_str(config['server']), config['server_port']))
     if (config.get('method', '') or '').lower() == b'table':
         logging.warn('warning: table is not safe; please use a safer cipher, '
                      'like AES-256-CFB')
@@ -173,6 +173,7 @@ def get_config(is_local):
 
     config['password'] = config.get('password', '')
     config['method'] = config.get('method', 'aes-256-cfb')
+    config['auth'] = config.get('auth', None)
     config['port_password'] = config.get('port_password', None)
     config['timeout'] = int(config.get('timeout', 300))
     config['fast_open'] = config.get('fast_open', False)

tests/assert.sh

@@ -0,0 +1,148 @@
+#!/bin/bash
+# assert.sh 1.0 - bash unit testing framework
+# Copyright (C) 2009, 2010, 2011, 2012 Robert Lehmann
+#
+# http://github.com/lehmannro/assert.sh
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published
+# by the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+export DISCOVERONLY=${DISCOVERONLY:-}
+export DEBUG=${DEBUG:-}
+export STOP=${STOP:-}
+export INVARIANT=${INVARIANT:-}
+export CONTINUE=${CONTINUE:-}
+
+args="$(getopt -n "$0" -l \
+    verbose,help,stop,discover,invariant,continue vhxdic $*)" \
+|| exit -1
+for arg in $args; do
+    case "$arg" in
+        -h)
+            echo "$0 [-vxidc]" \
+                "[--verbose] [--stop] [--invariant] [--discover] [--continue]"
+            echo "`sed 's/./ /g' <<< "$0"` [-h] [--help]"
+            exit 0;;
+        --help)
+            cat <<EOF
+Usage: $0 [options]
+Language-agnostic unit tests for subprocesses.
+
+Options:
+  -v, --verbose    generate output for every individual test case
+  -x, --stop       stop running tests after the first failure
+  -i, --invariant  do not measure timings to remain invariant between runs
+  -d, --discover   collect test suites only, do not run any tests
+  -c, --continue   do not modify exit code to test suite status
+  -h               show brief usage information and exit
+  --help           show this help message and exit
+EOF
+            exit 0;;
+        -v|--verbose)
+            DEBUG=1;;
+        -x|--stop)
+            STOP=1;;
+        -i|--invariant)
+            INVARIANT=1;;
+        -d|--discover)
+            DISCOVERONLY=1;;
+        -c|--continue)
+            CONTINUE=1;;
+    esac
+done
+
+printf -v _indent "\n\t" # local format helper
+
+_assert_reset() {
+    tests_ran=0
+    tests_failed=0
+    tests_errors=()
+    tests_starttime="$(date +%s.%N)" # seconds_since_epoch.nanoseconds
+}
+
+assert_end() {
+    # assert_end [suite ..]
+    tests_endtime="$(date +%s.%N)"
+    tests="$tests_ran ${*:+$* }tests"
+    [[ -n "$DISCOVERONLY" ]] && echo "collected $tests." && _assert_reset && return
+    [[ -n "$DEBUG" ]] && echo
+    [[ -z "$INVARIANT" ]] && report_time=" in $(bc \
+        <<< "${tests_endtime%.N} - ${tests_starttime%.N}" \
+        | sed -e 's/\.\([0-9]\{0,3\}\)[0-9]*/.\1/' -e 's/^\./0./')s" \
+        || report_time=
+
+    if [[ "$tests_failed" -eq 0 ]]; then
+        echo "all $tests passed$report_time."
+    else
+        for error in "${tests_errors[@]}"; do echo "$error"; done
+        echo "$tests_failed of $tests failed$report_time."
+    fi
+    tests_failed_previous=$tests_failed
+    [[ $tests_failed -gt 0 ]] && tests_suite_status=1
+    _assert_reset
+    return $tests_failed_previous
+}
+
+assert() {
+    # assert <command> <expected stdout> [stdin]
+    (( tests_ran++ )) || :
+    [[ -n "$DISCOVERONLY" ]] && return || true
+    # printf required for formatting
+    printf -v expected "x${2:-}" # x required to overwrite older results
+    result="$(eval 2>/dev/null $1 <<< ${3:-})" || true
+    # Note: $expected is already decorated
+    if [[ "x$result" == "$expected" ]]; then
+        [[ -n "$DEBUG" ]] && echo -n . || true
+        return
+    fi
+    result="$(sed -e :a -e '$!N;s/\n/\\n/;ta' <<< "$result")"
+    [[ -z "$result" ]] && result="nothing" || result="\"$result\""
+    [[ -z "$2" ]] && expected="nothing" || expected="\"$2\""
+    _assert_fail "expected $expected${_indent}got $result" "$1" "$3"
+}
+
+assert_raises() {
+    # assert_raises <command> <expected code> [stdin]
+    (( tests_ran++ )) || :
+    [[ -n "$DISCOVERONLY" ]] && return || true
+    status=0
+    (eval $1 <<< ${3:-}) > /dev/null 2>&1 || status=$?
+    expected=${2:-0}
+    if [[ "$status" -eq "$expected" ]]; then
+        [[ -n "$DEBUG" ]] && echo -n . || true
+        return
+    fi
+    _assert_fail "program terminated with code $status instead of $expected" "$1" "$3"
+}
+
+_assert_fail() {
+    # _assert_fail <failure> <command> <stdin>
+    [[ -n "$DEBUG" ]] && echo -n X
+    report="test #$tests_ran \"$2${3:+ <<< $3}\" failed:${_indent}$1"
+    if [[ -n "$STOP" ]]; then
+        [[ -n "$DEBUG" ]] && echo
+        echo "$report"
+        exit 1
+    fi
+    tests_errors[$tests_failed]="$report"
+    (( tests_failed++ )) || :
+}
+
+_assert_reset
+: ${tests_suite_status:=0}  # remember if any of the tests failed so far
+_assert_cleanup() {
+    local status=$?
+    # modify exit code if it's not already non-zero
+    [[ $status -eq 0 && -z $CONTINUE ]] && exit $tests_suite_status
+}
+trap _assert_cleanup EXIT

tests/coverage_server.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python
+
+if __name__ == '__main__':
+    import tornado.ioloop
+    import tornado.web
+    import urllib
+
+    class MainHandler(tornado.web.RequestHandler):
+        def get(self, project):
+            try:
+                with open('/tmp/%s-coverage' % project, 'rb') as f:
+                    coverage = f.read().strip()
+                    n = int(coverage.strip('%'))
+                    if n > 80:
+                        color = 'brightgreen'
+                    else:
+                        color = 'yellow'
+                    self.redirect(('https://img.shields.io/badge/'
+                                   'coverage-%s-%s.svg'
+                                   '?style=flat') %
+                                  (urllib.quote(coverage), color))
+            except IOError:
+                raise tornado.web.HTTPError(404)
+
+    application = tornado.web.Application([
+        (r"/([a-zA-Z0-9\-_]+)", MainHandler),
+    ])
+
+    if __name__ == "__main__":
+        application.listen(8888, address='127.0.0.1')
+        tornado.ioloop.IOLoop.instance().start()

tests/setup_tc.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+DEV=lo
+PORT=8388
+DELAY=100ms
+
+type tc 2> /dev/null && (
+    tc qdisc add dev $DEV root handle 1: htb
+    tc class add dev $DEV parent 1: classid 1:1 htb rate 2mbps
+    tc class add dev $DEV parent 1:1 classid 1:6 htb rate 2mbps ceil 1mbps prio 0
+    tc filter add dev $DEV parent 1:0 prio 0 protocol ip handle 6 fw flowid 1:6
+
+    tc filter add dev $DEV parent 1:0 protocol ip u32 match ip dport $PORT 0xffff flowid 1:6
+    tc filter add dev $DEV parent 1:0 protocol ip u32 match ip sport $PORT 0xffff flowid 1:6
+
+    tc qdisc show dev lo
+)
+

tests/test.py

@@ -138,7 +138,7 @@ try:
 finally:
     for p in [p1, p2]:
         try:
-            os.kill(p.pid, signal.SIGQUIT)
+            os.kill(p.pid, signal.SIGINT)
             os.waitpid(p.pid, 0)
         except OSError:
             pass

tests/test_command.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+. tests/assert.sh
+
+PYTHON="coverage run -a -p"
+LOCAL="$PYTHON shadowsocks/local.py"
+SERVER="$PYTHON shadowsocks/server.py"
+
+assert "$LOCAL 2>&1 | grep ERROR" "ERROR: config not specified"
+assert "$LOCAL 2>&1 | grep usage | cut -d: -f1" "usage"
+
+assert "$SERVER 2>&1 | grep ERROR" "ERROR: config not specified"
+assert "$SERVER 2>&1 | grep usage | cut -d: -f1" "usage"
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d start | grep WARNING |  awk -F\"WARNING\" '{print \$2}'" "  warning: server set to listen on 127.0.0.1:8388, are you sure?"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k testrc4 -s 0.0.0.0 -p 8388 -t10 -d start | grep WARNING |  awk -F\"WARNING\" '{print \$2}'" "  warning: your timeout 10 seems too short"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k testrc4 -s 0.0.0.0 -p 8388 -t1000 -d start | grep WARNING |  awk -F\"WARNING\" '{print \$2}'" "  warning: your timeout 1000 seems too long"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4 -k testrc4 -s 0.0.0.0 -p 8388 -d start | grep WARNING |  awk -F\"WARNING\" '{print \$2}'" "  warning: RC4 is not safe; please use a safer cipher, like AES-256-CFB"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -k mypassword -s 0.0.0.0 -p 8388 -d start | grep ERROR |  awk -F\"ERROR\" '{print \$2}'" "    DON'T USE DEFAULT PASSWORD! Please change it in your config.json!"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -p 8388 -k testrc4 -d start | grep ERROR |  awk -F\"ERROR\" '{print \$2}'" ": server addr not specified"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$LOCAL 2>&1 -m rc4-md5 -p 8388 -s 0.0.0.0 -d start | grep ERROR |  awk -F\"ERROR\" '{print \$2}'" ": password not specified"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+assert "$SERVER 2>&1 -m rc4-md5 -p 8388 -s 0.0.0.0 -d start | grep ERROR |  awk -F\"ERROR\" '{print \$2}'" ": password or port_password not specified"
+$LOCAL 2>/dev/null 1>/dev/null -m rc4-md5 -k testrc4 -s 127.0.0.1 -p 8388 -d stop
+
+
+assert_end command

tests/test_daemon.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-function test {
+function run_test {
     expected=$1
     shift
     echo "running test: $command $@"
@@ -20,23 +20,24 @@ do
 
 command="coverage run -p -a shadowsocks/$module.py"
 
-test 0 -c tests/aes.json -d stop --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
+mkdir -p tmp
 
-test 0 -c tests/aes.json -d start --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 0 -c tests/aes.json -d stop --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
 
-test 0 -c tests/aes.json -d start --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 1 -c tests/aes.json -d start --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 0 -c tests/aes.json -d stop --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
 
-test 0 -c tests/aes.json -d start --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 0 -c tests/aes.json -d restart --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 0 -c tests/aes.json -d stop --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 1 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
 
-test 0 -c tests/aes.json -d restart --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 0 -c tests/aes.json -d stop --pid-file /tmp/shadowsocks.pid --log-file /tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d start --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d restart --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
 
-test 1 -c tests/aes.json -d start --pid-file /tmp/not_exist/shadowsocks.pid --log-file /tmp/shadowsocks.log
-test 1 -c tests/aes.json -d start --pid-file /tmp/shadowsocks.pid --log-file /tmp/not_exist/shadowsocks.log
+run_test 0 -c tests/aes.json -d restart --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+run_test 0 -c tests/aes.json -d stop --pid-file tmp/shadowsocks.pid --log-file tmp/shadowsocks.log
+
+run_test 1 -c tests/aes.json -d start --pid-file tmp/not_exist/shadowsocks.pid --log-file tmp/shadowsocks.log
 
 done

tests/test_large_file.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+PYTHON="coverage run -p -a"
+URL=http://127.0.0.1/file
+
+mkdir -p tmp
+
+$PYTHON shadowsocks/local.py -c tests/aes.json &
+LOCAL=$!
+
+$PYTHON shadowsocks/server.py -c tests/aes.json &
+SERVER=$!
+
+sleep 3
+
+time curl -o tmp/expected $URL
+time curl -o tmp/result --socks5-hostname 127.0.0.1:1081 $URL
+
+kill -s SIGINT $LOCAL
+kill -s SIGINT $SERVER
+
+sleep 2
+
+diff tmp/expected tmp/result || exit 1