Alawn/shadowsocks-libev
1
0
Fork 0
mirror of https://github.com/shadowsocks/shadowsocks-libev.git synced 2026-10-31 14:33:50 +00:00
Code Releases Activity

Fix findings from the security audit

Browse Source 
Remote:
- TCP: handshake/connect deadlines follow --timeout instead of a 24h
  minimum, so idle sockets can no longer fill the connection pool.
- ACL: IPv4-mapped IPv6 addresses are matched against the IPv4 lists.
- UDP server now enforces the peer ACL and the outbound block list.
- ACL loading fails closed on bad files or invalid entries.
- TCP half-close is relayed instead of tearing the connection down.
- AEAD-2022 UDP sessions are created only after timestamp/replay checks.

ss-manager:
- Owner-only conf files (deleted on remove), 0600 control socket,
  umask 022, safe working directory, loopback-only IP addresses,
  per-user sender check on Linux, plugins only over the UNIX socket.
- Port canonicalisation, list() overflow, add/remove waits for the
  server, stale pid files can't signal unrelated processes.

Also: plugins drop to --user, daemonize readiness/pid file handling,
resolver cancellation, replay-filter fail-closed, key wiping, spec
strictness in AEAD/2022 parsing, JSON surrogate validation, ss:// plugin
name checks, embedding API state reset, Android protect_socket replies.

Adds tests/test_server_acl.py and tests/test_half_close.py and extends
the manager, ACL, AEAD-2022 and ssurl tests.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Max Lv
2026-10-27 16:30:19 +08:00
co-authored by Claude
parent db861130d7
commit 90ea095efe
43 changed files with 1560 additions and 247 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_acl_cpp.cpp
+71 -31
View File
@@ -1,8 +1,9 @@
// SPDX-License-Identifier: GPL-3.0-or-later
// ACL file parsing (src/acl.cpp): invalid rules are discarded, valid ones
// still match.
// ACL file parsing (src/acl.cpp): an invalid entry fails the whole load,
// valid ones match, and IPv4-mapped addresses meet the IPv4 rules.
#include <cstdio>
#include <cstdlib>
#include <initializer_list>
#include "acl.h"
#include "test_helpers.h"
@@ -14,27 +15,73 @@ int verbose = 0;
namespace {
void test_invalid_regex_is_not_installed()
// Writes `body` to a temporary ACL file and loads it.
int load_acl(const char *body)
{
char path[4096];
FILE *f = test_tempfile(path, sizeof(path));
SS_CHECK(f != nullptr);
std::fprintf(f, "[black_list]\n");
std::fprintf(f, "[invalid\n");
std::fprintf(f, "^blocked\\.example$\n");
std::fprintf(f, "[outbound_block_list]\n");
std::fprintf(f, "[also-invalid\n");
std::fprintf(f, "^outbound\\.example$\n");
std::fputs(body, f);
std::fclose(f);
int rc = init_acl(path);
std::remove(path);
return rc;
}
SS_CHECK(init_acl(path) == 0);
void test_invalid_regex_fails_the_load()
{
// An unusable rule must not silently drop out of a block list: the
// whole file is refused and nothing stays installed.
SS_CHECK(load_acl("[black_list]\n[invalid\n^blocked\\.example$\n") == -1);
SS_CHECK(acl_match_host("blocked.example") == 0);
SS_CHECK(load_acl("[outbound_block_list]\n^outbound\\.example$\n[also-invalid\n") == -1);
SS_CHECK(outbound_block_match_host("outbound.example") == 0);
SS_CHECK(get_acl_mode() == BLACK_LIST);
SS_CHECK(load_acl("[black_list]\n^blocked\\.example$\n[outbound_block_list]\n^outbound\\.example$\n") == 0);
SS_CHECK(acl_match_host("does-not-crash.example") == 0);
SS_CHECK(acl_match_host("blocked.example") == 1);
SS_CHECK(outbound_block_match_host("does-not-crash.example") == 0);
SS_CHECK(outbound_block_match_host("outbound.example") == 1);
free_acl();
}
std::remove(path);
void test_reload_starts_from_nothing()
{
SS_CHECK(load_acl("[reject_all]\n[white_list]\n1.1.1.1\n") == 0);
SS_CHECK(get_acl_mode() == WHITE_LIST);
SS_CHECK(load_acl("[black_list]\n2.2.2.2\n") == 0);
SS_CHECK(get_acl_mode() == BLACK_LIST);
SS_CHECK(acl_match_host("1.1.1.1") == 0);
SS_CHECK(acl_match_host("2.2.2.2") == 1);
free_acl();
}
void test_rules_ignore_case_and_trailing_dot()
{
SS_CHECK(load_acl("[outbound_block_list]\n(^|\\.)localhost$\nfull:internal.example\n") == 0);
SS_CHECK(outbound_block_match_host("LOCALHOST") == 1);
SS_CHECK(outbound_block_match_host("localhost.") == 1);
SS_CHECK(outbound_block_match_host("Internal.Example.") == 1);
SS_CHECK(outbound_block_match_host("example") == 0);
free_acl();
}
void test_ipv4_mapped_addresses_match_ipv4_rules()
{
SS_CHECK(load_acl("[outbound_block_list]\n127.0.0.0/8\n169.254.169.254\n::ffff:10.0.0.0/104\n") == 0);
SS_CHECK(outbound_block_match_host("127.0.0.1") == 1);
SS_CHECK(outbound_block_match_host("::ffff:127.0.0.1") == 1);
SS_CHECK(outbound_block_match_host("::FFFF:169.254.169.254") == 1);
SS_CHECK(outbound_block_match_host("10.1.2.3") == 1); // from the mapped /104
SS_CHECK(outbound_block_match_host("::ffff:10.1.2.3") == 1);
SS_CHECK(outbound_block_match_host("::ffff:8.8.8.8") == 0);
SS_CHECK(outbound_block_match_host("::1") == 0);
free_acl();
SS_CHECK(load_acl("[black_list]\n203.0.113.0/24\n") == 0);
SS_CHECK(acl_match_host("::ffff:203.0.113.7") == 1); // a v4 client on a dual-stack socket
free_acl();
}
void test_long_acl_line_is_discarded()
@@ -57,36 +104,29 @@ void test_long_acl_line_is_discarded()
std::remove(path);
}
void test_invalid_cidr_is_discarded()
void test_invalid_cidr_fails_the_load()
{
char path[4096];
FILE *f = test_tempfile(path, sizeof(path));
SS_CHECK(f != nullptr);
std::fprintf(f, "[black_list]\n");
std::fprintf(f, "1.2.3.0/999\n");
std::fprintf(f, "2.2.2.2/-1\n");
std::fprintf(f, "3.3.3.3/abc\n");
std::fprintf(f, "4.4.4.0/24\n");
std::fprintf(f, "^path/with/slash\\.example$\n");
std::fclose(f);
SS_CHECK(init_acl(path) == 0);
SS_CHECK(acl_match_host("1.2.3.1") == 0);
SS_CHECK(acl_match_host("2.2.2.2") == 0);
SS_CHECK(acl_match_host("3.3.3.3") == 0);
for (const char *line : { "1.2.3.0/999\n", "2.2.2.2/-1\n", "3.3.3.3/abc\n", "::1/129\n", "::ffff:1.2.3.4/64\n" }) {
char body[64];
std::snprintf(body, sizeof(body), "[black_list]\n4.4.4.0/24\n%s", line);
SS_CHECK(load_acl(body) == -1);
SS_CHECK(acl_match_host("4.4.4.8") == 0);
}
SS_CHECK(load_acl("[black_list]\n4.4.4.0/24\n^path/with/slash\\.example$\n") == 0);
SS_CHECK(acl_match_host("4.4.4.8") == 1);
SS_CHECK(acl_match_host("path/with/slash.example") == 1);
free_acl();
std::remove(path);
}
} // namespace
int main()
{
SS_RUN(test_invalid_regex_is_not_installed);
SS_RUN(test_invalid_regex_fails_the_load);
SS_RUN(test_reload_starts_from_nothing);
SS_RUN(test_rules_ignore_case_and_trailing_dot);
SS_RUN(test_ipv4_mapped_addresses_match_ipv4_rules);
SS_RUN(test_long_acl_line_is_discarded);
SS_RUN(test_invalid_cidr_is_discarded);
SS_RUN(test_invalid_cidr_fails_the_load);
return 0;
}