C++20 port 3/14: compile crypto, config, DNS, ACL and plugin modules as C++ (#3067)

* Make the crypto, config, DNS and plugin modules compile as C++

Cast allocator and memchr results explicitly, pass mbedtls_operation_t
to mbedtls_cipher_setkey, and declare the two locals in
ss2022_encrypt_first() before the gotos that jump past them. Drop the
unused RESOLV_MODE global that resolv.c defined by accident through an
anonymous enum declaration. Still valid C.

* Raise the test origin's listen backlog

socketserver listens with a backlog of 5. With concurrent connections
through the proxy on a loaded machine (parallel ctest), the backlog
overflows, the kernel resets the origin connection, and the proxy
correctly drops the client, which surfaced as intermittent
alloc_audit_report failures ("getpeername: Invalid argument" in
ss-local, "Connection reset by peer" in ss-server). Reproduced
reliably at 64 concurrent connections; gone with a backlog of 256.

* Compile the crypto, config, DNS, ACL and plugin modules as C++

Rename netutils, jconf, stream, aead, aead2022, aead2022_udp, crypto,
acl, plugin, plugin_disabled and resolv from .c to .cpp without changing
their contents, and update source lists, snippet references, test
comments and debian/copyright.

The Doxygen source list and scripts/check_cli_docs.py now accept either
extension for each module, so the remaining programs can move one at a
time. The new .cpp files are added to the no-heap ratchet baseline.

scripts/check_cli_docs.py

@@ -98,13 +98,21 @@ def documented_options(source_name, sources):
     return result
 
 
+def module_source(sources, module):
+    """Source file name for a program module; modules move from .c to .cpp."""
+    for suffix in ('.c', '.cpp'):
+        if module + suffix in sources:
+            return module + suffix
+    raise ValueError(f"No source file for module {module}")
+
+
 def check(root=ROOT, rendered=None):
     sources = {path.name: path.read_text(encoding='utf-8')
-               for path in (root / 'src').glob('*.c')}
+               for pattern in ('*.c', '*.cpp') for path in (root / 'src').glob(pattern)}
     sources['ss-nat'] = (root / 'src/ss-nat').read_text(encoding='utf-8')
     for module in PROGRAMS:
         program = 'ss-' + module
-        filename = 'ss-nat' if module == 'nat' else module + '.c'
+        filename = 'ss-nat' if module == 'nat' else module_source(sources, module)
         declared = options(sources[filename], shell=module == 'nat')
         documented = documented_options(filename, sources)
         missing = declared.keys() - documented.keys()

scripts/no_heap_baseline.txt

@@ -2,9 +2,17 @@
 # Format: <path> <violations>. check_no_heap.py fails if a file gains
 # violations, and also when it loses some, so the number here always goes
 # down. Remove a file once it is rewritten on the src/core primitives.
+src/aead.cpp 4
+src/aead2022.cpp 3
+src/aead2022_udp.cpp 5
 src/cache.cpp 3
+src/crypto.cpp 4
 src/ipset.cpp 3
+src/jconf.cpp 16
 src/json.cpp 2
+src/plugin.cpp 3
 src/process.cpp 26
+src/resolv.cpp 6
 src/rule.cpp 2
 src/ssurl.cpp 3
+src/stream.cpp 3

scripts/ss-setup.sh

@@ -14,7 +14,7 @@ readonly CONFIG_DIR="/etc/shadowsocks-libev"
 readonly SYSTEMD_UNIT_DIR="/etc/systemd/system"
 readonly SYSTEMD_TEMPLATE="shadowsocks-libev-server@.service"
 
-# AEAD ciphers supported by shadowsocks-libev (from src/aead.c)
+# AEAD ciphers supported by shadowsocks-libev (from src/aead.cpp)
 readonly AEAD_CIPHERS=(
     "chacha20-ietf-poly1305"
     "aes-256-gcm"