From c5e8788013a37afe54ea1c2b7c03395cccc663cf Mon Sep 17 00:00:00 2001 From: Max Lv Date: Mon, 9 Feb 2026 09:15:12 +0800 Subject: [PATCH] Bump version to 3.3.6 Co-Authored-By: Claude Opus 4.6 --- CLAUDE.md | 124 ++++++++++++++++++++++++++++++++++++++++++++ CMakeLists.txt | 4 +- README.md | 2 +- README_pt_BR.md | 2 +- debian/changelog | 7 +++ snap/snapcraft.yaml | 2 +- 6 files changed, 136 insertions(+), 5 deletions(-) create mode 100644 CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 00000000..d5157865 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,124 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Project Overview + +shadowsocks-libev is a lightweight SOCKS5 proxy written in pure C. Version 3.3.6, licensed under GPLv3. + +## Build Commands + +### CMake (sole build system) + +```bash +git submodule update --init --recursive +mkdir -p build && cd build +cmake .. +make +sudo make install +``` + +On macOS, CMake should auto-detect library paths. If needed, specify paths: +```bash +cmake .. -DCMAKE_PREFIX_PATH="/usr/local/opt/mbedtls;/usr/local/opt/libsodium" +``` + +CMake outputs binaries to `build/bin/` (static) and `build/shared/bin/` (shared). + +### Build Dependencies + +- cmake (>= 3.2), a C compiler (gcc or clang), pkg-config +- libmbedtls, libsodium (>= 1.0.4), libpcre3, libev, libc-ares +- asciidoc + xmlto (documentation only) + +### CMake Options + +- `-DWITH_EMBEDDED_SRC=OFF`: use system libcork/libipset/libbloom instead of bundled submodules +- `-DWITH_DOC_MAN=OFF`: skip man page generation +- `-DENABLE_CONNMARKTOS=ON`: Linux netfilter conntrack QoS support +- `-DENABLE_NFTABLES=ON`: nftables firewall integration +- `-DDISABLE_SSP=ON`: disable stack protector +- `-DBUILD_TESTING=OFF`: disable unit tests + +## Testing + +### Unit Tests (CTest) + +```bash +cd build +ctest --output-on-failure +``` + +10 unit test modules cover: base64, buffer, crypto, json, jconf, cache, ppbloom, rule, netutils, utils. + +### Integration Tests + +Integration tests use Python and require `curl` and `dig` to be available: +```bash +bash tests/test.sh +``` + +The test harness (`tests/test.py`) starts ss-server, ss-local, and ss-tunnel locally, then runs curl through the SOCKS5 proxy and dig through the tunnel. Each test config in `tests/*.json` exercises a different cipher. + +Run a single cipher test: +```bash +python tests/test.py --bin build/bin/ -c tests/aes-gcm.json +``` + +## Code Formatting + +Uses **uncrustify** with the config at `.uncrustify.cfg`. Key settings: 4-space indent, no tabs, 120-column width, K&R brace style (braces on same line). + +## Architecture + +### Binaries (all in `src/`) + +Each binary is compiled with a module define that controls conditional compilation: + +| Binary | Define | Purpose | +|---|---|---| +| `ss-local` | `MODULE_LOCAL` | SOCKS5 client proxy | +| `ss-server` | `MODULE_REMOTE` | Server-side proxy | +| `ss-tunnel` | `MODULE_TUNNEL` | Port forwarding tunnel (implies `MODULE_LOCAL`) | +| `ss-redir` | `MODULE_REDIR` | Transparent proxy via iptables (Linux only, implies `MODULE_LOCAL`) | +| `ss-manager` | `MODULE_MANAGER` | Multi-server manager daemon | + +A shared library `libshadowsocks-libev` is also built from the ss-local sources with `-DLIB_ONLY`. Its public API is in `src/shadowsocks.h`. + +### Source Organization (`src/`) + +**Shared by all binaries:** +- `utils.c` - logging, system utilities +- `jconf.c` / `json.c` - JSON config file parsing +- `netutils.c` - network address utilities +- `cache.c` - hash-based LRU connection cache +- `udprelay.c` - UDP relay implementation (shared, but uses `#ifdef MODULE_*` for per-binary behavior) + +**Crypto layer** (two parallel implementations behind a common `crypto_t` interface): +- `crypto.c` / `crypto.h` - crypto initialization, key derivation (HKDF), buffer management. Defines `crypto_t` with function pointers for encrypt/decrypt. +- `stream.c` - stream cipher implementation (CFB mode via mbedTLS) +- `aead.c` - AEAD cipher implementation (AES-GCM via mbedTLS, ChaCha20-Poly1305 via libsodium) +- `ppbloom.c` - ping-pong bloom filter for nonce replay detection + +**ACL (Access Control Lists):** +- `acl.c` / `rule.c` - IP/domain-based routing rules using libipset + +**Plugin support:** +- `plugin.c` - SIP003 plugin subprocess management + +### Bundled Submodules + +Three git submodules in the repo root (can be replaced with system libs via `-DWITH_EMBEDDED_SRC=OFF`): +- `libcork/` - data structures (dllist, hash-table, buffers) +- `libipset/` - IP set operations for ACL +- `libbloom/` - bloom filter implementation + +### Event Loop + +All binaries use **libev** for async I/O. The connection lifecycle follows stages defined in `src/common.h`: `STAGE_INIT` -> `STAGE_HANDSHAKE` -> `STAGE_RESOLVE` -> `STAGE_STREAM` -> `STAGE_STOP`. Each binary defines its own `listen_ctx_t`, `server_t`, and `remote_t` structs (note: "server" in `local.h` means the local-side connection, "remote" means the ss-server side). + +### Compiler Flags + +Default flags from `CMakeLists.txt`: `-g -O2 -Wall -Werror -Wno-deprecated-declarations -fno-strict-aliasing -std=gnu99 -D_GNU_SOURCE` + +The `-Werror` flag means all warnings are errors - new code must compile warning-free. diff --git a/CMakeLists.txt b/CMakeLists.txt index 3616039b..52ff13e2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,8 +1,8 @@ cmake_minimum_required(VERSION 3.5) set(PROJECT_NAME shadowsocks-libev) -set(RELEASE_DATE 2020-09-15) -set(PROJECT_VERSION "3.3.5") +set(RELEASE_DATE 2026-02-09) +set(PROJECT_VERSION "3.3.6") set(PROJECT_DESC "a lightweight secured socks5 proxy") set(PROJECT_URL "https://shadowsocks.org") set(PROJECT_ISSUES_URL "https://github.com/shadowsocks/shadowsocks-libev") diff --git a/README.md b/README.md index 327a9592..ca045471 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ It is a port of [Shadowsocks](https://github.com/shadowsocks/shadowsocks) created by [@clowwindy](https://github.com/clowwindy), and maintained by [@madeye](https://github.com/madeye) and [@linusyang](https://github.com/linusyang). -Current version: 3.3.5 | [Changelog](debian/changelog) +Current version: 3.3.6 | [Changelog](debian/changelog) ## Features diff --git a/README_pt_BR.md b/README_pt_BR.md index e9dd1a13..790abb55 100644 --- a/README_pt_BR.md +++ b/README_pt_BR.md @@ -11,7 +11,7 @@ proxy para dispositivos embutidos e caixas de baixo custo. criado por [@clowwindy](https://github.com/clowwindy) e mantido por [@madeye](https://github.com/madeye) e [@linusyang](https://github.com/linusyang). -Versão atual: 3.3.5 | [Changelog](debian/changelog) +Versão atual: 3.3.6 | [Changelog](debian/changelog) ## Características diff --git a/debian/changelog b/debian/changelog index 0c5dd097..ab4ccf86 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +shadowsocks-libev (3.3.6-1) unstable; urgency=medium + + * Reduce memory copies in crypto encrypt/decrypt paths. + * Fix unbounded buffer growth in aead_decrypt chunk reassembly. + + -- Max Lv Sun, 09 Feb 2026 08:00:00 +0800 + shadowsocks-libev (3.3.5-1) unstable; urgency=medium * Remove the SNI proxy function. diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml index 49b687fd..89fbed79 100644 --- a/snap/snapcraft.yaml +++ b/snap/snapcraft.yaml @@ -1,6 +1,6 @@ base: core18 name: shadowsocks-libev -version: 3.3.5-1 +version: 3.3.6-1 summary: libev port of shadowsocks description: | Shadowsocks-libev is a lightweight and secure SOCKS5 proxy for embedded