mirror of
https://github.com/shadowsocks/shadowsocks-libev.git
synced 2026-10-28 03:33:42 +00:00
Max Lv
@@ -2,11 +2,11 @@
|
||||
|
||||
## Intro
|
||||
|
||||
[Shadowsocks-libev](http://shadowsocks.org) is a lightweight secured SOCKS5
|
||||
[Shadowsocks-libev](http://shadowsocks.org) is a lightweight secured SOCKS5
|
||||
proxy for embedded devices and low-end boxes.
|
||||
|
||||
It is a port of [Shadowsocks](https://github.com/shadowsocks/shadowsocks)
|
||||
created by [@clowwindy](https://github.com/clowwindy), which is maintained by
|
||||
It is a port of [Shadowsocks](https://github.com/shadowsocks/shadowsocks)
|
||||
created by [@clowwindy](https://github.com/clowwindy), which is maintained by
|
||||
[@madeye](https://github.com/madeye) and [@linusyang](https://github.com/linusyang).
|
||||
|
||||
Current version: 2.4.3 | [Changelog](debian/changelog)
|
||||
@@ -16,24 +16,76 @@ Travis CI: [ and
|
||||
[libev](http://software.schmorp.de/pkg/libev.html) and
|
||||
[OpenSSL](http://www.openssl.org/) or [PolarSSL](https://polarssl.org/).
|
||||
The use of [mbedTLS](https://tls.mbed.org/) is added but still for testing, and
|
||||
it is not officially supported yet.
|
||||
|
||||
In normal usage, the memory footprint is about 600KB and the CPU utilization is
|
||||
no more than 5% on a low-end router (Buffalo WHR-G300N V2 with a 400MHz MIPS CPU,
|
||||
In normal usage, the memory footprint is about 600KB and the CPU utilization is
|
||||
no more than 5% on a low-end router (Buffalo WHR-G300N V2 with a 400MHz MIPS CPU,
|
||||
32MB memory and 4MB flash).
|
||||
|
||||
For a full list of feature comparison between different versions of shadowsocks,
|
||||
refer to the [Wiki page](https://github.com/shadowsocks/shadowsocks/wiki/Feature-Comparison-across-Different-Versions).
|
||||
|
||||
|
||||
## Installation
|
||||
|
||||
**Notes about PolarSSL**
|
||||
### Distribution-specific guide
|
||||
|
||||
* The default crypto library is OpenSSL. To build against PolarSSL,
|
||||
specify `--with-crypto-library=polarssl` and `--with-polarssl=/path/to/polarssl`
|
||||
when running `./configure`.
|
||||
* PolarSSL __1.2.5 or newer__ is required. Currently, PolarSSL does __NOT__ support
|
||||
- [Debian & Ubuntu](#debian--ubuntu)
|
||||
+ [Install from repository](#install-from-repository)
|
||||
+ [Build deb package from source](#build-deb-package-from-source)
|
||||
+ [Configure and start the service](#configure-and-start-the-service)
|
||||
- [Fedora & RHEL](#fedora--rhel)
|
||||
+ [Install from repository](#install-from-repository-1)
|
||||
- [Archlinux](#archlinux)
|
||||
- [Directly build and install on UNIX-like system](#linux)
|
||||
- [FreeBSD](#freebsd)
|
||||
- [OpenWRT](#openwrt)
|
||||
- [OS X](#os-x)
|
||||
- [Windows](#windows)
|
||||
|
||||
* * *
|
||||
|
||||
### Pre-build configure guide
|
||||
|
||||
For a complete list of avaliable configure-time option,
|
||||
try `configure --help`.
|
||||
|
||||
#### Using alternative crypto library
|
||||
|
||||
There are three crypto libraries available:
|
||||
|
||||
- OpenSSL (**default**)
|
||||
- PolarSSL
|
||||
- mbedTLS (__NOT__ officially supported)
|
||||
|
||||
##### PolarSSL
|
||||
|
||||
To build against PolarSSL, specify `--with-crypto-library=polarssl`
|
||||
and `--with-polarssl=/path/to/polarssl` when running `./configure`.
|
||||
|
||||
* PolarSSL __1.2.5 or newer__ is required. Currently, PolarSSL does __NOT__ support
|
||||
CAST5-CFB, DES-CFB, IDEA-CFB, RC2-CFB and SEED-CFB.
|
||||
* RC4 is only support by PolarSSL __1.3.0 or above__.
|
||||
|
||||
##### mbedTLS
|
||||
To build against mbedTLS, specify `--with-crypto-library=mbedtls`
|
||||
and `--with-mbedtls=/path/to/mbedtls` when running `./configure`.
|
||||
|
||||
Please not that we do **NOT** officially support mbedTLS right now,
|
||||
and you should use it at your own risk.
|
||||
|
||||
Windows users will need extra work when compiling mbedTLS library,
|
||||
see [this issue](https://github.com/shadowsocks/shadowsocks-libev/issues/422) for detail info.
|
||||
|
||||
#### Using shared library from system
|
||||
|
||||
Please specify `--enable-system-shared-lib`. This will replace the bundled
|
||||
`libev`, `libsodium` and `libudns` with the corresponding libraries installed
|
||||
in the system during compilation and linking.
|
||||
|
||||
### Debian & Ubuntu
|
||||
|
||||
#### Install from repository
|
||||
@@ -82,7 +134,7 @@ Please follow the instructions on [Debian Backports](http://backports.debian.org
|
||||
This also means that you can only install those built packages on systems that have
|
||||
`init-system-helpers` installed.
|
||||
|
||||
Otherwise, try to build and install directly from source. See the **Linux**
|
||||
Otherwise, try to build and install directly from source. See the [Linux](#linux)
|
||||
section below.
|
||||
|
||||
``` bash
|
||||
@@ -144,11 +196,12 @@ su -c 'yum install shadowsocks-libev'
|
||||
sudo pacman -S shadowsocks-libev
|
||||
```
|
||||
|
||||
Please refer to downstream `PKGBUILD` file for any extra modifications.
|
||||
Please refer to downstream [PKGBUILD](https://projects.archlinux.org/svntogit/community.git/tree/trunk?h=packages/shadowsocks-libev)
|
||||
script for extra modifications and distribution-specific bugs.
|
||||
|
||||
### Linux
|
||||
|
||||
For Unix-like systems, especially Debian-based systems,
|
||||
For Unix-like systems, especially Debian-based systems,
|
||||
e.g. Ubuntu, Debian or Linux Mint, you can build the binary like this:
|
||||
|
||||
```bash
|
||||
@@ -181,13 +234,16 @@ service shadowsocks_libev start
|
||||
|
||||
### OpenWRT
|
||||
|
||||
**Note**: You may want to use [openwrt-shadowsocks](https://github.com/shadowsocks/openwrt-shadowsocks)
|
||||
, which is developed specifically for OpenWRT.
|
||||
|
||||
```bash
|
||||
# At OpenWRT build root
|
||||
pushd package
|
||||
git clone https://github.com/shadowsocks/shadowsocks-libev.git
|
||||
popd
|
||||
|
||||
# Enable shadowsocks-libev in network category
|
||||
# Enable shadowsocks-libev in network category
|
||||
make menuconfig
|
||||
|
||||
# Optional
|
||||
@@ -237,7 +293,7 @@ make lib WINDOWS=1
|
||||
make install DESTDIR="$HOME/prebuilt"
|
||||
```
|
||||
|
||||
Then, build the binary using the commands below, and all `.exe` files
|
||||
Then, build the binary using the commands below, and all `.exe` files
|
||||
will be built at `$HOME/ss/bin`:
|
||||
|
||||
#### OpenSSL
|
||||
@@ -256,6 +312,9 @@ make && make install
|
||||
|
||||
## Usage
|
||||
|
||||
For a detailed and complete list of all supported arguments, you may refer to the
|
||||
man pages of the applications, respectively.
|
||||
|
||||
```
|
||||
ss-[local|redir|server|tunnel]
|
||||
|
||||
@@ -271,7 +330,8 @@ make && make install
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb,
|
||||
bf-cfb, camellia-128-cfb, camellia-192-cfb,
|
||||
camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb,
|
||||
rc2-cfb, seed-cfb, salsa20 and chacha20
|
||||
rc2-cfb, seed-cfb, salsa20 ,chacha20 and
|
||||
chacha20-ietf
|
||||
|
||||
[-f <pid_file>] the file path to store pid
|
||||
|
||||
@@ -317,7 +377,7 @@ make && make install
|
||||
|
||||
notes:
|
||||
|
||||
ss-redir provides a transparent proxy function and only works on the
|
||||
ss-redir provides a transparent proxy function and only works on the
|
||||
Linux platform with iptables.
|
||||
|
||||
```
|
||||
@@ -329,7 +389,7 @@ The latest shadowsocks-libev has provided a *redir* mode. You can configure your
|
||||
# Create new chain
|
||||
root@Wrt:~# iptables -t nat -N SHADOWSOCKS
|
||||
root@Wrt:~# iptables -t mangle -N SHADOWSOCKS
|
||||
|
||||
|
||||
# Ignore your shadowsocks server's addresses
|
||||
# It's very IMPORTANT, just be careful.
|
||||
root@Wrt:~# iptables -t nat -A SHADOWSOCKS -d 123.123.123.123 -j RETURN
|
||||
@@ -353,7 +413,7 @@ The latest shadowsocks-libev has provided a *redir* mode. You can configure your
|
||||
root@Wrt:~# ip rule add fwmark 0x01/0x01 table 100
|
||||
root@Wrt:~# ip route add local 0.0.0.0/0 dev lo table 100
|
||||
root@Wrt:~# iptables -t mangle -A SHADOWSOCKS -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01
|
||||
|
||||
|
||||
# Apply the rules
|
||||
root@Wrt:~# iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS
|
||||
root@Wrt:~# iptables -t mangle -A PREROUTING -j SHADOWSOCKS
|
||||
|
||||
@@ -71,10 +71,10 @@ Set the password. The server and the client should use the same password.
|
||||
.B \-m \fIencrypt_method\fP
|
||||
Set the cipher.
|
||||
|
||||
Shadowsocks accepts 16 different ciphers: table, rc4, rc4-md5,
|
||||
\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
|
||||
camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
|
||||
seed-cfb, salsa20 and chacha20. The default cipher is \fItable\fP.
|
||||
seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
|
||||
|
||||
If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
|
||||
not work.
|
||||
@@ -88,6 +88,11 @@ Set the socket timeout in seconds. The default value is 10.
|
||||
.B \-c \fIconfig_file\fP
|
||||
Use a configuration file.
|
||||
.TP
|
||||
.B \-n \fInofile\fP
|
||||
Specify max number of open files.
|
||||
|
||||
Only available on Linux.
|
||||
.TP
|
||||
.B \-i \fIinterface\fP
|
||||
Specify network interface to bind.
|
||||
|
||||
|
||||
+8
-3
@@ -35,7 +35,7 @@ ss-local \- shadowsocks client as socks5 proxy, libev port
|
||||
[\fB\-s\fR \fIserver_host\fR] [\fB\-p\fR \fIserver_port\fR] [\fB\-l\fR \fIlocal_port\fR]
|
||||
[\fB\-k\fR \fIpassword\fR] [\fB\-m\fR \fIencrypt_method\fR] [\fB\-f\fR \fIpid_file\fR] [\fB\-t\fR \fItimeout\fR]
|
||||
[\fB\-c\fR \fIconfig_file\fR] [\fB\-b\fR \fIinterface\fR] [\fB\-a\fR \fIuser_name\fR]
|
||||
[\fB\-\-fast\-open\fR] [\fB\-\-acl\fR \fIacl_config\fR]
|
||||
[\fB\-n\fR \fInofile\fR] [\fB\-\-fast\-open\fR] [\fB\-\-acl\fR \fIacl_config\fR]
|
||||
|
||||
.SH DESCRIPTION
|
||||
\*(Me is a lightweight and secure socks5 proxy. It is a port of the original
|
||||
@@ -62,10 +62,10 @@ Set the password. The server and the client should use the same password.
|
||||
.B \-m \fIencrypt_method\fP
|
||||
Set the cipher.
|
||||
|
||||
Shadowsocks accepts 16 different ciphers: table, rc4, rc4-md5,
|
||||
\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
|
||||
camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
|
||||
seed-cfb, salsa20 and chacha20. The default cipher is \fItable\fP.
|
||||
seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
|
||||
|
||||
If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
|
||||
not work.
|
||||
@@ -79,6 +79,11 @@ Set the socket timeout in seconds. The default value is 10.
|
||||
.B \-c \fIconfig_file\fP
|
||||
Use a configuration file.
|
||||
.TP
|
||||
.B \-n \fInofile\fP
|
||||
Specify max number of open files.
|
||||
|
||||
Only avaliable on Linux.
|
||||
.TP
|
||||
.B \-i \fIinterface\fP
|
||||
Specify network interface to bind.
|
||||
.TP
|
||||
|
||||
+3
-3
@@ -67,10 +67,10 @@ Set the password. The server and the client should use the same password.
|
||||
.B \-m \fIencrypt_method\fP
|
||||
Set the cipher.
|
||||
|
||||
Shadowsocks accepts 16 different ciphers: table, rc4, rc4-md5,
|
||||
\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
|
||||
camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
|
||||
seed-cfb, salsa20 and chacha20. The default cipher is \fItable\fP.
|
||||
seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
|
||||
|
||||
If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
|
||||
not work.
|
||||
@@ -150,7 +150,7 @@ $(which ss-server) -s example.com -m aes-256-cfb -c /path/to/config.json
|
||||
|
||||
# Connect to the socket. Using netcat-openbsd as an example.
|
||||
# You should use scripts or other programs for further management.
|
||||
nc -Uu /tmp/ss.socket
|
||||
nc -Uu /tmp/manager.sock
|
||||
|
||||
After that, you may communicate with \*(Ma(1) as described above in the
|
||||
\fBPROTOCOL\fR section.
|
||||
|
||||
+8
-3
@@ -35,7 +35,7 @@ ss-redir \- shadowsocks client as transparent proxy, libev port
|
||||
[\fB\-s\fR \fIserver_host\fR] [\fB\-p\fR \fIserver_port\fR] [\fB\-l\fR \fIlocal_port\fR]
|
||||
[\fB\-k\fR \fIpassword\fR] [\fB\-m\fR \fIencrypt_method\fR] [\fB\-f\fR \fIpid_file\fR]
|
||||
[\fB\-t\fR \fItimeout\fR] [\fB\-c\fR \fIconfig_file\fR] [\fB\-b\fR \fIlocal_address\fR]
|
||||
[\fB\-a\fR \fIuser_name\fR]
|
||||
[\fB\-a\fR \fIuser_name\fR] [\fB\-n\fR \fInofile\fR]
|
||||
|
||||
.SH DESCRIPTION
|
||||
\*(Me is a lightweight and secure socks5 proxy. It is a port of the original
|
||||
@@ -64,10 +64,10 @@ Set the password. The server and the client should use the same password.
|
||||
.B \-m \fIencrypt_method\fP
|
||||
Set the cipher.
|
||||
|
||||
Shadowsocks accepts 16 different ciphers: table, rc4, rc4-md5,
|
||||
\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
|
||||
camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
|
||||
seed-cfb, salsa20 and chacha20. The default cipher is \fItable\fP.
|
||||
seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
|
||||
|
||||
If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
|
||||
not work.
|
||||
@@ -81,6 +81,11 @@ Set the socket timeout in seconds. The default value is 10.
|
||||
.B \-c \fIconfig_file\fP
|
||||
Use a configuration file.
|
||||
.TP
|
||||
.B \-n \fInofile\fP
|
||||
Specify max number of open files.
|
||||
|
||||
Only avaliable on Linux.
|
||||
.TP
|
||||
.B \-b \fIlocal_address\fP
|
||||
Specify local address to bind.
|
||||
.TP
|
||||
|
||||
+8
-3
@@ -35,7 +35,7 @@ ss-server \- shadowsocks server, libev port
|
||||
[\fB\-s\fR \fIserver_host\fR] [\fB\-p\fR \fIserver_port\fR] [\fB\-l\fR \fIlocal_port\fR]
|
||||
[\fB\-k\fR \fIpassword\fR] [\fB\-m\fR \fIencrypt_method\fR] [\fB\-f\fR \fIpid_file\fR]
|
||||
[\fB\-t\fR \fItimeout\fR] [\fB\-c\fR \fIconfig_file\fR] [\fB\-i\fR \fIinterface\fR]
|
||||
[\fB\-a\fR \fIuser_name\fR] [\fB\-d\fR \fIaddr\fR]
|
||||
[\fB\-a\fR \fIuser_name\fR] [\fB\-d\fR \fIaddr\fR] [\fB\-n\fR \fInofile\fR]
|
||||
[\fB\-\-fast\-open\fR] [\fB\-\-acl\fR \fIacl_config\fR]
|
||||
[\fB\-\-manager\-address\fR \fIpath_to_unix_domain\fR]
|
||||
|
||||
@@ -64,10 +64,10 @@ Set the password. The server and the client should use the same password.
|
||||
.B \-m \fIencrypt_method\fP
|
||||
Set the cipher.
|
||||
|
||||
Shadowsocks accepts 16 different ciphers: table, rc4, rc4-md5,
|
||||
\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
|
||||
camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
|
||||
seed-cfb, salsa20 and chacha20. The default cipher is \fItable\fP.
|
||||
seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
|
||||
|
||||
If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
|
||||
not work.
|
||||
@@ -81,6 +81,11 @@ Set the socket timeout in seconds. The default value is 10.
|
||||
.B \-c \fIconfig_file\fP
|
||||
Use a configuration file.
|
||||
.TP
|
||||
.B \-n \fInofile\fP
|
||||
Specify max number of open files.
|
||||
|
||||
Only avaliable on Linux.
|
||||
.TP
|
||||
.B \-i \fIinterface\fP
|
||||
Specify network interface to bind.
|
||||
.TP
|
||||
|
||||
+8
-3
@@ -35,7 +35,7 @@ ss-tunnel \- shadowsocks tools for local port forwarding, libev port
|
||||
[\fB\-s\fR \fIserver_host\fR] [\fB\-p\fR \fIserver_port\fR] [\fB\-l\fR \fIlocal_port\fR]
|
||||
[\fB\-k\fR \fIpassword\fR] [\fB\-m\fR \fIencrypt_method\fR] [\fB\-f\fR \fIpid_file\fR]
|
||||
[\fB\-t\fR \fItimeout\fR] [\fB\-c\fR \fIconfig_file\fR] [\fB\-i\fR \fIinterface\fR]
|
||||
[\fB\-b\fR \fIlocal_addr\fR] [\fB\-a\fR \fIuser_name\fR]
|
||||
[\fB\-b\fR \fIlocal_addr\fR] [\fB\-a\fR \fIuser_name\fR] [\fB\-n\fR \fInofile\fR]
|
||||
[\fB\-L\fR \fIaddr\fR:\fIport\fR]
|
||||
|
||||
.SH DESCRIPTION
|
||||
@@ -64,10 +64,10 @@ Set the password. The server and the client should use the same password.
|
||||
.B \-m \fIencrypt_method\fP
|
||||
Set the cipher.
|
||||
|
||||
Shadowsocks accepts 16 different ciphers: table, rc4, rc4-md5,
|
||||
\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
|
||||
aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
|
||||
camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
|
||||
seed-cfb, salsa20 and chacha20. The default cipher is \fItable\fP.
|
||||
seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
|
||||
|
||||
If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
|
||||
not work.
|
||||
@@ -81,6 +81,11 @@ Set the socket timeout in seconds. The default value is 10.
|
||||
.B \-c \fIconfig_file\fP
|
||||
Use a configuration file.
|
||||
.TP
|
||||
.B \-n \fInofile\fP
|
||||
Specify max number of open files.
|
||||
|
||||
Only avaliable on Linux.
|
||||
.TP
|
||||
.B \-i \fIinterface\fP
|
||||
Specify network interface to bind.
|
||||
.TP
|
||||
|
||||
Reference in New Issue
Block a user