diff --git a/CLAUDE.md b/CLAUDE.md
index 8347cb7a..17225d41 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -103,23 +103,23 @@ A library `libshadowsocks-c` (legacy names `libshadowsocks-libev.*` are kept) is
 
 **Shared by all binaries:**
 - `utils.c` - logging, system utilities, `ss_malloc`/`ss_free`
-- `jconf.c` / `json.cpp` - JSON config file parsing
-- `netutils.c` - network address utilities
+- `jconf.cpp` / `json.cpp` - JSON config file parsing
+- `netutils.cpp` - network address utilities
 - `cache.cpp` - uthash-based connection cache (UDP relay, AEAD-2022 tables)
 - `udprelay.c` - UDP relay implementation (shared, but uses `#ifdef MODULE_*` for per-binary behavior)
 - `ss_event.c` / `ss_event.h` - event loop API over libuv
-- `resolv.c` - asynchronous DNS via c-ares
+- `resolv.cpp` - asynchronous DNS via c-ares
 
 **Crypto layer** (behind a common `crypto_t` function-pointer interface):
-- `crypto.c` / `crypto.h` - crypto initialization, key derivation (HKDF), `buffer_t` management
-- `stream.c` - legacy stream ciphers
-- `aead.c` - AEAD ciphers (AES-GCM via Mbed TLS/libsodium, ChaCha20-Poly1305 via libsodium)
-- `aead2022.c` / `aead2022_udp.c` - Shadowsocks 2022 (SIP022), BLAKE3 from `src/blake3`
+- `crypto.cpp` / `crypto.h` - crypto initialization, key derivation (HKDF), `buffer_t` management
+- `stream.cpp` - legacy stream ciphers
+- `aead.cpp` - AEAD ciphers (AES-GCM via Mbed TLS/libsodium, ChaCha20-Poly1305 via libsodium)
+- `aead2022.cpp` / `aead2022_udp.cpp` - Shadowsocks 2022 (SIP022), BLAKE3 from `src/blake3`
 - `ppbloom.cpp` - ping-pong bloom filter for salt replay detection (`third_party/bloom`)
 
-**ACL:** `acl.c` / `rule.cpp` / `ipset.cpp` - IP prefix sets and PCRE2/literal domain rules.
+**ACL:** `acl.cpp` / `rule.cpp` / `ipset.cpp` - IP prefix sets and PCRE2/literal domain rules.
 
-**Plugins:** `plugin.c` / `process.cpp` - SIP003 plugin subprocess management.
+**Plugins:** `plugin.cpp` / `process.cpp` - SIP003 plugin subprocess management.
 
 **C++ core:** `src/core/*.hpp` - header-only ownership and allocation primitives (pools, handles, fixed
 buffers, arena, fixed hash map/LRU, intrusive list, bounded heap). See `docs/cpp-core.md`.
diff --git a/debian/copyright b/debian/copyright
index 148d692f..7074f1a4 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -49,7 +49,7 @@ Files: src/json.cpp src/json.h
 Copyright: 2012-2014, James McLaughlin et al.
 License: BSD-2-clause
 
-Files: src/resolv.c src/resolv.h
+Files: src/resolv.cpp src/resolv.h
 Copyright: 2011-2014, Dustin Lundquist <dustin@null-ptr.net>
 License: BSD-2-clause
 
diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
index 6b3d0dce..a49bdac7 100644
--- a/doc/CMakeLists.txt
+++ b/doc/CMakeLists.txt
@@ -16,7 +16,12 @@ foreach(name IN LISTS DOC_NAMES)
 endforeach()
 set(DOC_SOURCES)
 foreach(name local server tunnel redir manager utils aead stream)
-    list(APPEND DOC_SOURCES "${PROJECT_SOURCE_DIR}/src/${name}.c")
+    # Modules are moving from C to C++ one at a time.
+    if(EXISTS "${PROJECT_SOURCE_DIR}/src/${name}.cpp")
+        list(APPEND DOC_SOURCES "${PROJECT_SOURCE_DIR}/src/${name}.cpp")
+    else()
+        list(APPEND DOC_SOURCES "${PROJECT_SOURCE_DIR}/src/${name}.c")
+    endif()
 endforeach()
 list(APPEND DOC_SOURCES "${PROJECT_SOURCE_DIR}/src/ss-nat")
 
diff --git a/scripts/check_cli_docs.py b/scripts/check_cli_docs.py
index c87a196d..75575d58 100644
--- a/scripts/check_cli_docs.py
+++ b/scripts/check_cli_docs.py
@@ -98,13 +98,21 @@ def documented_options(source_name, sources):
     return result
 
 
+def module_source(sources, module):
+    """Source file name for a program module; modules move from .c to .cpp."""
+    for suffix in ('.c', '.cpp'):
+        if module + suffix in sources:
+            return module + suffix
+    raise ValueError(f"No source file for module {module}")
+
+
 def check(root=ROOT, rendered=None):
     sources = {path.name: path.read_text(encoding='utf-8')
-               for path in (root / 'src').glob('*.c')}
+               for pattern in ('*.c', '*.cpp') for path in (root / 'src').glob(pattern)}
     sources['ss-nat'] = (root / 'src/ss-nat').read_text(encoding='utf-8')
     for module in PROGRAMS:
         program = 'ss-' + module
-        filename = 'ss-nat' if module == 'nat' else module + '.c'
+        filename = 'ss-nat' if module == 'nat' else module_source(sources, module)
         declared = options(sources[filename], shell=module == 'nat')
         documented = documented_options(filename, sources)
         missing = declared.keys() - documented.keys()
diff --git a/scripts/no_heap_baseline.txt b/scripts/no_heap_baseline.txt
index 6cedf8e0..7c7fe012 100644
--- a/scripts/no_heap_baseline.txt
+++ b/scripts/no_heap_baseline.txt
@@ -2,9 +2,17 @@
 # Format: <path> <violations>. check_no_heap.py fails if a file gains
 # violations, and also when it loses some, so the number here always goes
 # down. Remove a file once it is rewritten on the src/core primitives.
+src/aead.cpp 4
+src/aead2022.cpp 3
+src/aead2022_udp.cpp 5
 src/cache.cpp 3
+src/crypto.cpp 4
 src/ipset.cpp 3
+src/jconf.cpp 16
 src/json.cpp 2
+src/plugin.cpp 3
 src/process.cpp 26
+src/resolv.cpp 6
 src/rule.cpp 2
 src/ssurl.cpp 3
+src/stream.cpp 3
diff --git a/scripts/ss-setup.sh b/scripts/ss-setup.sh
index 72fdaf41..4726018f 100755
--- a/scripts/ss-setup.sh
+++ b/scripts/ss-setup.sh
@@ -14,7 +14,7 @@ readonly CONFIG_DIR="/etc/shadowsocks-libev"
 readonly SYSTEMD_UNIT_DIR="/etc/systemd/system"
 readonly SYSTEMD_TEMPLATE="shadowsocks-libev-server@.service"
 
-# AEAD ciphers supported by shadowsocks-libev (from src/aead.c)
+# AEAD ciphers supported by shadowsocks-libev (from src/aead.cpp)
 readonly AEAD_CIPHERS=(
     "chacha20-ietf-poly1305"
     "aes-256-gcm"
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index fe150898..74ba2e00 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -9,16 +9,16 @@ endif ()
 
 
 set(SS_ACL_SOURCE
-        acl.c
+        acl.cpp
         ipset.cpp
         rule.cpp
         )
 
 set(SS_CRYPTO_SOURCE
-        crypto.c
-        aead.c
-        aead2022.c
-        aead2022_udp.c
+        crypto.cpp
+        aead.cpp
+        aead2022.cpp
+        aead2022_udp.cpp
         base64.cpp
         )
 
@@ -40,20 +40,20 @@ target_compile_options(blake3 PRIVATE -Wno-error -Wno-unused-function)
 set_target_properties(blake3 PROPERTIES POSITION_INDEPENDENT_CODE ON)
 
 if(SS_ENABLE_LEGACY)
-    list(APPEND SS_CRYPTO_SOURCE stream.c)
+    list(APPEND SS_CRYPTO_SOURCE stream.cpp)
 endif()
 if(SS_ENABLE_PLUGINS)
-    set(SS_PLUGIN_SOURCE plugin.c process.cpp)
+    set(SS_PLUGIN_SOURCE plugin.cpp process.cpp)
 else()
-    set(SS_PLUGIN_SOURCE plugin_disabled.c)
+    set(SS_PLUGIN_SOURCE plugin_disabled.cpp)
 endif()
 
 set(SS_SHARED_SOURCES
         ppbloom.cpp
         utils.c
-        jconf.c
+        jconf.cpp
         json.cpp
-        netutils.c
+        netutils.cpp
         )
 if (MINGW)
 set(SS_SHARED_SOURCES ${SS_SHARED_SOURCES} winsock.c)
@@ -64,7 +64,7 @@ set(LIBSHADOWSOCKS_LIBEV_SOURCE
         udprelay.c
         cache.cpp
         local.c
-        resolv.c
+        resolv.cpp
         ssurl.cpp
         ${SS_CRYPTO_SOURCE}
         ${SS_PLUGIN_SOURCE}
@@ -89,7 +89,7 @@ set(SS_SERVER_SOURCE
         ${SS_SHARED_SOURCES}
         udprelay.c
         cache.cpp
-        resolv.c
+        resolv.cpp
         server.c
         ${SS_CRYPTO_SOURCE}
         ${SS_PLUGIN_SOURCE}
diff --git a/src/acl.c b/src/acl.cpp
similarity index 100%
rename from src/acl.c
rename to src/acl.cpp
diff --git a/src/aead.c b/src/aead.cpp
similarity index 98%
rename from src/aead.c
rename to src/aead.cpp
index 832a840e..881d24de 100644
--- a/src/aead.c
+++ b/src/aead.cpp
@@ -335,7 +335,7 @@ aead_cipher_ctx_set_key(cipher_ctx_t *cipher_ctx, int enc)
         return;
     }
     if (mbedtls_cipher_setkey(cipher_ctx->evp, cipher_ctx->skey,
-                              cipher_ctx->cipher->key_len * 8, enc) != 0) {
+                              cipher_ctx->cipher->key_len * 8, (mbedtls_operation_t)enc) != 0) {
         FATAL("Cannot set mbed TLS cipher key");
     }
     if (mbedtls_cipher_reset(cipher_ctx->evp) != 0) {
@@ -360,11 +360,11 @@ aead_cipher_ctx_init(cipher_ctx_t *cipher_ctx, int method, int enc)
     const cipher_kt_t *cipher = aead_get_cipher_type(method);
 
     if (method == AES256GCM && crypto_aead_aes256gcm_is_available()) {
-        cipher_ctx->aes256gcm_ctx = ss_aligned_malloc(sizeof(aes256gcm_ctx));
+        cipher_ctx->aes256gcm_ctx = (aes256gcm_ctx *)ss_aligned_malloc(sizeof(aes256gcm_ctx));
         memset(cipher_ctx->aes256gcm_ctx, 0, sizeof(aes256gcm_ctx));
     } else {
         cipher_ctx->aes256gcm_ctx = NULL;
-        cipher_ctx->evp           = ss_malloc(sizeof(cipher_evp_t));
+        cipher_ctx->evp           = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
         memset(cipher_ctx->evp, 0, sizeof(cipher_evp_t));
         cipher_evp_t *evp = cipher_ctx->evp;
         mbedtls_cipher_init(evp);
diff --git a/src/aead2022.c b/src/aead2022.cpp
similarity index 98%
rename from src/aead2022.c
rename to src/aead2022.cpp
index a28be2d7..5d7381c3 100644
--- a/src/aead2022.c
+++ b/src/aead2022.cpp
@@ -246,7 +246,7 @@ ss2022_build_req_varhdr(const uint8_t *first, size_t first_len,
     }
 
     size_t total = addr_len + 2 + pad_len + payload_len;
-    uint8_t *buf = ss_malloc(total);
+    uint8_t *buf = (uint8_t *)ss_malloc(total);
 
     memcpy(buf, first, addr_len);
     store16_be(buf + addr_len, pad_len);
@@ -277,6 +277,8 @@ ss2022_emit_header(cipher_ctx_t *ctx, buffer_t *out, size_t *out_len,
     size_t body_len   = 0;
     int body_owned    = 0;
     int rc            = CRYPTO_ERROR;
+    size_t o;
+    int n;
 
     if (ctx->role == CRYPTO_ROLE_CLIENT) {
         if (ss2022_build_req_varhdr(first, first_len, &body, &body_len)
@@ -322,9 +324,9 @@ ss2022_emit_header(cipher_ctx_t *ctx, buffer_t *out, size_t *out_len,
              + body_len + SS2022_TAG_LEN, capacity);
 
     memcpy(out->data, ctx->salt, salt_len);
-    size_t o = salt_len;
+    o = salt_len;
 
-    int n = ss2022_seal(ctx, (uint8_t *)out->data + o, fixed, fixed_len);
+    n = ss2022_seal(ctx, (uint8_t *)out->data + o, fixed, fixed_len);
     if (n < 0)
         goto done;
     o += n;
@@ -595,7 +597,7 @@ ss2022_tcp_decrypt(buffer_t *ciphertext, cipher_ctx_t *ctx, size_t capacity)
             return CRYPTO_NEED_MORE;
         }
 
-        uint8_t *body = ss_malloc(want);
+        uint8_t *body = (uint8_t *)ss_malloc(want);
         int n = ss2022_open(ctx, body,
                             (uint8_t *)chunk->data + chunk->idx, need);
         if (n < 0) {
diff --git a/src/aead2022_udp.c b/src/aead2022_udp.cpp
similarity index 98%
rename from src/aead2022_udp.c
rename to src/aead2022_udp.cpp
index 394f510e..71a76b4f 100644
--- a/src/aead2022_udp.c
+++ b/src/aead2022_udp.cpp
@@ -179,7 +179,7 @@ window_update(ss2022_udp_session_t *s, uint64_t id)
 static ss2022_udp_session_t *
 session_new(cipher_t *cipher)
 {
-    ss2022_udp_session_t *s = ss_malloc(sizeof(ss2022_udp_session_t));
+    ss2022_udp_session_t *s = (ss2022_udp_session_t *)ss_malloc(sizeof(ss2022_udp_session_t));
     memset(s, 0, sizeof(ss2022_udp_session_t));
     s->cipher = cipher;
     return s;
@@ -285,7 +285,7 @@ body_seal(const cipher_t *cipher, const uint8_t *key,
     tmp_ctx.cipher = &tmp_cipher;
 
     /* Reuse the shared one-shot helper with an mbedTLS GCM context. */
-    tmp_ctx.evp = ss_malloc(sizeof(cipher_evp_t));
+    tmp_ctx.evp = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
     memset(tmp_ctx.evp, 0, sizeof(cipher_evp_t));
     mbedtls_cipher_init(tmp_ctx.evp);
     const cipher_kt_t *kt = mbedtls_cipher_info_from_string(
@@ -327,7 +327,7 @@ body_open(const cipher_t *cipher, const uint8_t *key,
     memset(&tmp_ctx, 0, sizeof(tmp_ctx));
     tmp_ctx.cipher = &tmp_cipher;
 
-    tmp_ctx.evp = ss_malloc(sizeof(cipher_evp_t));
+    tmp_ctx.evp = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
     memset(tmp_ctx.evp, 0, sizeof(cipher_evp_t));
     mbedtls_cipher_init(tmp_ctx.evp);
     const cipher_kt_t *kt = mbedtls_cipher_info_from_string(
@@ -377,7 +377,7 @@ aead_2022_encrypt_udp(buffer_t *plaintext, cipher_t *cipher, size_t capacity,
     size_t hdr_len = SS2022_UDP_MIN_HDR + extra;
     size_t body_len = hdr_len + plaintext->len;
 
-    uint8_t *body = ss_malloc(body_len);
+    uint8_t *body = (uint8_t *)ss_malloc(body_len);
     size_t o      = 0;
 
     body[o++] = is_server ? SS2022_UDP_TYPE_SERVER : SS2022_UDP_TYPE_CLIENT;
@@ -407,7 +407,7 @@ aead_2022_encrypt_udp(buffer_t *plaintext, cipher_t *cipher, size_t capacity,
          * main header || payload)
          */
         size_t merged_len = SS2022_UDP_SEP_HDR_LEN + body_len;
-        uint8_t *merged   = ss_malloc(merged_len);
+        uint8_t *merged   = (uint8_t *)ss_malloc(merged_len);
         memcpy(merged, s->tx_session_id, SS2022_SESSION_ID_LEN);
         store64_be(merged + SS2022_SESSION_ID_LEN, s->tx_packet_id);
         memcpy(merged + SS2022_UDP_SEP_HDR_LEN, body, body_len);
diff --git a/src/aead_internal.h b/src/aead_internal.h
index b3be0dcb..80985b3a 100644
--- a/src/aead_internal.h
+++ b/src/aead_internal.h
@@ -1,5 +1,5 @@
 /*
- * aead_internal.h - Internal interface shared by aead.c and aead2022.c
+ * aead_internal.h - Internal interface shared by aead.cpp and aead2022.cpp
  *
  * Copyright (C) 2013 - 2026, Max Lv <max.c.lv@gmail.com>
  *
@@ -54,7 +54,7 @@ is_aead_2022(int method)
            || method == CHACHA20POLY1305IETF2022;
 }
 
-/* Low-level one-shot AEAD operations implemented in aead.c */
+/* Low-level one-shot AEAD operations implemented in aead.cpp */
 int aead_cipher_encrypt(cipher_ctx_t *cipher_ctx,
                         uint8_t *c, size_t *clen,
                         uint8_t *m, size_t mlen,
@@ -67,7 +67,7 @@ int aead_cipher_decrypt(cipher_ctx_t *cipher_ctx,
                         uint8_t *n, uint8_t *k);
 void aead_cipher_ctx_set_key(cipher_ctx_t *cipher_ctx, int enc);
 
-/* AEAD-2022 pieces implemented in aead2022.c */
+/* AEAD-2022 pieces implemented in aead2022.cpp */
 int aead_get_role(void);
 void ss2022_derive_subkey(const uint8_t *key, size_t key_len,
                           const uint8_t *salt, size_t salt_len,
diff --git a/src/crypto.c b/src/crypto.cpp
similarity index 99%
rename from src/crypto.c
rename to src/crypto.cpp
index 523faca9..70111ce1 100644
--- a/src/crypto.c
+++ b/src/crypto.cpp
@@ -47,7 +47,7 @@ int
 balloc(buffer_t *ptr, size_t capacity)
 {
     sodium_memzero(ptr, sizeof(buffer_t));
-    ptr->data     = ss_malloc(capacity);
+    ptr->data     = (char *)ss_malloc(capacity);
     ptr->capacity = capacity;
     return capacity;
 }
@@ -59,7 +59,7 @@ brealloc(buffer_t *ptr, size_t len, size_t capacity)
         return -1;
     size_t real_capacity = max(len, capacity);
     if (ptr->capacity < real_capacity) {
-        ptr->data     = ss_realloc(ptr->data, real_capacity);
+        ptr->data     = (char *)ss_realloc(ptr->data, real_capacity);
         ptr->capacity = real_capacity;
     }
     return real_capacity;
diff --git a/src/jconf.c b/src/jconf.cpp
similarity index 99%
rename from src/jconf.c
rename to src/jconf.cpp
index 0a5d6fbc..b7bf0392 100644
--- a/src/jconf.c
+++ b/src/jconf.cpp
@@ -283,7 +283,7 @@ read_jconf(const char *file)
         FATAL("Too large config file.");
     }
 
-    buf = ss_malloc(pos + 1);
+    buf = (char *)ss_malloc(pos + 1);
     if (buf == NULL) {
         FATAL("No enough memory.");
     }
diff --git a/src/netutils.c b/src/netutils.cpp
similarity index 99%
rename from src/netutils.c
rename to src/netutils.cpp
index 4b75b58c..afb4c903 100644
--- a/src/netutils.c
+++ b/src/netutils.cpp
@@ -312,7 +312,7 @@ validate_hostname(const char *hostname, const int hostname_len)
     const char *label = hostname;
     while (label < hostname_end) {
         size_t label_len = hostname_end - label;
-        const char *next_dot = memchr(label, '.', label_len);
+        const char *next_dot = (const char *)memchr(label, '.', label_len);
         if (next_dot != NULL)
             label_len = next_dot - label;
 
diff --git a/src/plugin.c b/src/plugin.cpp
similarity index 99%
rename from src/plugin.c
rename to src/plugin.cpp
index d1aaacb7..0080ccbe 100644
--- a/src/plugin.c
+++ b/src/plugin.cpp
@@ -137,7 +137,7 @@ start_obfsproxy(const char *plugin,
     ss_process_arg(sub, "--data-dir");
     buf_size = 20 + strlen(plugin) + strlen(remote_host)
                + strlen(remote_port) + strlen(local_host) + strlen(local_port);
-    buf = ss_malloc(buf_size);
+    buf = (char *)ss_malloc(buf_size);
     snprintf(buf, buf_size, TEMPDIR "%s_%s:%s_%s:%s", plugin,
              remote_host, remote_port, local_host, local_port);
     ss_process_arg(sub, buf);
diff --git a/src/plugin_disabled.c b/src/plugin_disabled.cpp
similarity index 100%
rename from src/plugin_disabled.c
rename to src/plugin_disabled.cpp
diff --git a/src/resolv.c b/src/resolv.cpp
similarity index 95%
rename from src/resolv.c
rename to src/resolv.cpp
index 5c6a7bf8..cc6350a6 100644
--- a/src/resolv.c
+++ b/src/resolv.cpp
@@ -94,7 +94,7 @@ static struct ss_loop *default_loop;
 enum {
     MODE_IPV4_FIRST = 0,
     MODE_IPV6_FIRST = 1
-} RESOLV_MODE;
+};
 
 static int resolv_mode = MODE_IPV4_FIRST;
 
@@ -207,7 +207,7 @@ resolv_start(const char *hostname, uint16_t port,
     /*
      * Wrap c-ares's call back in our own
      */
-    struct resolv_query *query = ss_malloc(sizeof(struct resolv_query));
+    struct resolv_query *query = (struct resolv_query *)ss_malloc(sizeof(struct resolv_query));
 
     memset(query, 0, sizeof(struct resolv_query));
 
@@ -254,7 +254,7 @@ dns_query_v4_cb(void *arg, int status, int timeouts, struct hostent *he)
         n++;
 
     if (n > 0) {
-        struct sockaddr **new_responses = ss_realloc(query->responses,
+        struct sockaddr **new_responses = (struct sockaddr **)ss_realloc(query->responses,
                                                      (query->response_count + n)
                                                      * sizeof(struct sockaddr *));
 
@@ -264,7 +264,7 @@ dns_query_v4_cb(void *arg, int status, int timeouts, struct hostent *he)
             query->responses = new_responses;
 
             for (i = 0; i < n; i++) {
-                struct sockaddr_in *sa = ss_malloc(sizeof(struct sockaddr_in));
+                struct sockaddr_in *sa = (struct sockaddr_in *)ss_malloc(sizeof(struct sockaddr_in));
                 memset(sa, 0, sizeof(struct sockaddr_in));
                 sa->sin_family = AF_INET;
                 sa->sin_port   = query->port;
@@ -316,7 +316,7 @@ dns_query_v6_cb(void *arg, int status, int timeouts, struct hostent *he)
         n++;
 
     if (n > 0) {
-        struct sockaddr **new_responses = ss_realloc(query->responses,
+        struct sockaddr **new_responses = (struct sockaddr **)ss_realloc(query->responses,
                                                      (query->response_count + n)
                                                      * sizeof(struct sockaddr *));
 
@@ -326,7 +326,7 @@ dns_query_v6_cb(void *arg, int status, int timeouts, struct hostent *he)
             query->responses = new_responses;
 
             for (i = 0; i < n; i++) {
-                struct sockaddr_in6 *sa = ss_malloc(sizeof(struct sockaddr_in6));
+                struct sockaddr_in6 *sa = (struct sockaddr_in6 *)ss_malloc(sizeof(struct sockaddr_in6));
                 memset(sa, 0, sizeof(struct sockaddr_in6));
                 sa->sin6_family = AF_INET6;
                 sa->sin6_port   = query->port;
@@ -472,7 +472,7 @@ resolv_sock_state_cb(void *data, ares_socket_t s, int read, int write)
         return;
     }
     if (!node) {
-        node = ss_malloc(sizeof(*node));
+        node = (struct resolv_io *)ss_malloc(sizeof(*node));
         node->next = NULL;
         *entry = node;
         ss_io_init(&node->io, resolv_sock_cb, (int)s, events);
diff --git a/src/stream.c b/src/stream.cpp
similarity index 99%
rename from src/stream.c
rename to src/stream.cpp
index fda194e2..7e221ba0 100644
--- a/src/stream.c
+++ b/src/stream.cpp
@@ -211,7 +211,7 @@ stream_cipher_ctx_init(cipher_ctx_t *ctx, int method, int enc)
     const char *ciphername    = supported_stream_ciphers[method];
     const cipher_kt_t *cipher = stream_get_cipher_type(method);
 
-    ctx->evp = ss_malloc(sizeof(cipher_evp_t));
+    ctx->evp = (cipher_evp_t *)ss_malloc(sizeof(cipher_evp_t));
     memset(ctx->evp, 0, sizeof(cipher_evp_t));
     cipher_evp_t *evp = ctx->evp;
 
@@ -274,7 +274,7 @@ cipher_ctx_set_nonce(cipher_ctx_t *cipher_ctx, uint8_t *nonce, size_t nonce_len,
         LOGE("cipher_ctx_set_nonce(): Cipher context is null");
         return;
     }
-    if (mbedtls_cipher_setkey(evp, true_key, cipher->key_len * 8, enc) != 0) {
+    if (mbedtls_cipher_setkey(evp, true_key, cipher->key_len * 8, (mbedtls_operation_t)enc) != 0) {
         mbedtls_cipher_free(evp);
         FATAL("Cannot set mbed TLS cipher key");
     }
diff --git a/src/utils.c b/src/utils.c
index de010054..b6f95f9c 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -364,11 +364,11 @@ later on the command line override the values taken from the URL.
 Set the cipher. The default is `chacha20-ietf-poly1305`.
 
 AEAD cipher names from the source (availability depends on the build):
-\snippet aead.c cli-aead-ciphers
+\snippet aead.cpp cli-aead-ciphers
 
 Legacy stream cipher names recognized by the source (disabled in minimal builds;
 some require backend support):
-\snippet stream.c cli-stream-ciphers
+\snippet stream.cpp cli-stream-ciphers
 
 The `2022-blake3-*` ciphers implement Shadowsocks 2022 (SIP022). They require
 a base64-encoded pre-shared key supplied with `--key` or `--password` (*-k*): 16 bytes for
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 49145de9..7b0befa8 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -117,7 +117,7 @@ set(TEST_NETUTILS_LIBS
     ss_cares
 )
 ss_add_test(test_netutils
-    "test_netutils.c;${PROJECT_SOURCE_DIR}/src/netutils.c;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_netutils.c;${PROJECT_SOURCE_DIR}/src/netutils.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
     "${TEST_NETUTILS_LIBS}")
 
 # test_cache - expiration uses a platform monotonic clock
@@ -145,7 +145,7 @@ ss_add_test(test_rule
 # test_acl - ACL precedence and prefix matching
 set(TEST_ACL_LIBS ${TEST_RULE_LIBS})
 ss_add_test(test_acl
-    "test_acl.c;${PROJECT_SOURCE_DIR}/src/acl.c;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_acl.c;${PROJECT_SOURCE_DIR}/src/acl.cpp;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
     "${TEST_ACL_LIBS}")
 
 endif()
@@ -157,17 +157,17 @@ set(TEST_JCONF_LIBS
     ss_cares
 )
 ss_add_test(test_jconf
-    "test_jconf.c;${PROJECT_SOURCE_DIR}/src/jconf.c;${PROJECT_SOURCE_DIR}/src/json.cpp;${PROJECT_SOURCE_DIR}/src/utils.c;${PROJECT_SOURCE_DIR}/src/netutils.c"
+    "test_jconf.c;${PROJECT_SOURCE_DIR}/src/jconf.cpp;${PROJECT_SOURCE_DIR}/src/json.cpp;${PROJECT_SOURCE_DIR}/src/utils.c;${PROJECT_SOURCE_DIR}/src/netutils.cpp"
     "${TEST_JCONF_LIBS};${SS_MATH_LIBRARY}")
 
 # Crypto sources shared by the tests that link the crypto layer. The AEAD-2022
 # ciphers pull in BLAKE3 (linked as the `blake3` target) and the session-based
-# UDP codec, so they must be built together with crypto.c.
+# UDP codec, so they must be built together with crypto.cpp.
 set(SS_CRYPTO_TEST_SOURCES
-    ${PROJECT_SOURCE_DIR}/src/crypto.c
-    ${PROJECT_SOURCE_DIR}/src/aead.c
-    ${PROJECT_SOURCE_DIR}/src/aead2022.c
-    ${PROJECT_SOURCE_DIR}/src/aead2022_udp.c
+    ${PROJECT_SOURCE_DIR}/src/crypto.cpp
+    ${PROJECT_SOURCE_DIR}/src/aead.cpp
+    ${PROJECT_SOURCE_DIR}/src/aead2022.cpp
+    ${PROJECT_SOURCE_DIR}/src/aead2022_udp.cpp
     ${PROJECT_SOURCE_DIR}/src/ppbloom.cpp
     ${PROJECT_SOURCE_DIR}/src/cache.cpp
     ${PROJECT_SOURCE_DIR}/src/base64.cpp
@@ -175,10 +175,10 @@ set(SS_CRYPTO_TEST_SOURCES
 )
 
 if(SS_ENABLE_LEGACY)
-    list(APPEND SS_CRYPTO_TEST_SOURCES ${PROJECT_SOURCE_DIR}/src/stream.c)
+    list(APPEND SS_CRYPTO_TEST_SOURCES ${PROJECT_SOURCE_DIR}/src/stream.cpp)
 endif()
 
-# test_buffer - needs sodium and mbedtls for crypto.c buffer functions
+# test_buffer - needs sodium and mbedtls for crypto.cpp buffer functions
 ss_add_test(test_buffer
     "test_buffer.c;${SS_CRYPTO_TEST_SOURCES}"
     "ss_sodium;;ss_mbedcrypto;ss_ev;${TEST_PPBLOOM_LIBS};blake3;${SS_MATH_LIBRARY}")
@@ -229,7 +229,7 @@ ss_add_test(test_process
 set_tests_properties(test_process PROPERTIES TIMEOUT 20)
 
 ss_add_test(test_resolv
-    "test_resolv.c;${PROJECT_SOURCE_DIR}/src/resolv.c;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_resolv.c;${PROJECT_SOURCE_DIR}/src/resolv.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
     "ss_ev;ss_cares;ss_sodium")
 set_tests_properties(test_resolv PROPERTIES TIMEOUT 20)
 
@@ -238,13 +238,13 @@ if(SS_ENABLE_REGEX)
     list(APPEND TEST_LITERAL_LIBS ss_pcre2)
 endif()
 ss_add_test(test_acl_literal
-    "test_acl_literal.c;${PROJECT_SOURCE_DIR}/src/acl.c;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_acl_literal.c;${PROJECT_SOURCE_DIR}/src/acl.cpp;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
     "${TEST_LITERAL_LIBS}")
 
 ss_add_test(test_event "test_event.c" "ss_ev")
 set_tests_properties(test_event PROPERTIES TIMEOUT 30)
 ss_add_test(test_resolv_async
-    "test_resolv_async.c;${PROJECT_SOURCE_DIR}/src/resolv.c;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_resolv_async.c;${PROJECT_SOURCE_DIR}/src/resolv.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
     "ss_ev;ss_cares;ss_sodium")
 set_tests_properties(test_resolv_async PROPERTIES TIMEOUT 30)
 
diff --git a/tests/interop.py b/tests/interop.py
index 7b7efb48..a03da926 100644
--- a/tests/interop.py
+++ b/tests/interop.py
@@ -34,6 +34,10 @@ class UDPHandler(socketserver.BaseRequestHandler):
 
 class TCPOrigin(socketserver.ThreadingTCPServer):
     daemon_threads = True
+    # socketserver's default listen backlog is 5. Concurrent connections
+    # through the proxy overflow it on a loaded machine; the kernel then
+    # resets the origin connection, which looks like a proxy failure.
+    request_queue_size = 256
 
 
 class UDPOrigin(socketserver.ThreadingUDPServer):
diff --git a/tests/test_aead2022.c b/tests/test_aead2022.c
index 4a106b1b..9ea21c75 100644
--- a/tests/test_aead2022.c
+++ b/tests/test_aead2022.c
@@ -19,7 +19,7 @@ int verbose = 0;
 #include "utils.h"
 #include "blake3/blake3.h"
 
-/* Provide nonce_cache symbol needed by crypto.c */
+/* Provide nonce_cache symbol needed by crypto.cpp */
 struct cache *nonce_cache = NULL;
 
 /* 32-byte and 16-byte PSKs in base64 */
diff --git a/tests/test_buffer.c b/tests/test_buffer.c
index e021df76..dd80f217 100644
--- a/tests/test_buffer.c
+++ b/tests/test_buffer.c
@@ -10,7 +10,7 @@ int verbose = 0;
 
 #include "crypto.h"
 
-/* Provide nonce_cache symbol needed by crypto.c */
+/* Provide nonce_cache symbol needed by crypto.cpp */
 struct cache *nonce_cache = NULL;
 
 static void
diff --git a/tests/test_crypto.c b/tests/test_crypto.c
index e0a4ad71..476fc525 100644
--- a/tests/test_crypto.c
+++ b/tests/test_crypto.c
@@ -13,7 +13,7 @@ int verbose = 0;
 #include "ppbloom.h"
 #include "utils.h"
 
-/* Provide nonce_cache symbol needed by crypto.c */
+/* Provide nonce_cache symbol needed by crypto.cpp */
 struct cache *nonce_cache = NULL;
 
 static void
@@ -366,7 +366,7 @@ main(void)
 
 #if SS_ENABLE_LEGACY
     /* mbedTLS-backed ciphers and libsodium-backed ciphers use different
-     * code paths in stream.c, so cover both. */
+     * code paths in stream.cpp, so cover both. */
     test_stream_multi_segment_roundtrip("aes-256-cfb");
     test_stream_multi_segment_roundtrip("aes-256-ctr");
     test_stream_multi_segment_roundtrip("camellia-128-cfb");