From ab6e49381fdcc18e88e7f6f1c881334cd04e4ba9 Mon Sep 17 00:00:00 2001 From: Max Lv Date: Wed, 19 Aug 2026 18:15:24 +0800 Subject: [PATCH] Accept the standard base64 alphabet when decoding keys The decode table only mapped the URL-safe alphabet, so '+' and '/' were rejected as invalid characters. Keys are commonly generated with `openssl rand -base64`, which emits standard base64, and shadowsocks-rust accepts either form; a key containing '+' or '/' was refused outright while the same key worked elsewhere. Map both alphabets. The affected table entries previously decoded as "invalid", so no input that used to decode changes meaning. --- src/base64.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/base64.c b/src/base64.c index 52247fc6..cc3f01de 100644 --- a/src/base64.c +++ b/src/base64.c @@ -34,9 +34,15 @@ #include "base64.h" /* ---------------- private code */ +/* + * Decoding table indexed by (c - 43). It accepts both the standard alphabet + * ('+' and '/') and the URL-safe one ('-' and '_'), since keys are quoted + * from tools using either: `openssl rand -base64` emits standard base64, + * while shadowsocks configs have traditionally used the URL-safe form. + */ static const uint8_t map2[] = { - 0xff, 0xff, 0x3e, 0xff, 0xff, 0x34, 0x35, 0x36, + 0x3e, 0xff, 0x3e, 0xff, 0x3f, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,