diff --git a/CLAUDE.md b/CLAUDE.md
index 17225d41..6d8b4fd9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -102,12 +102,12 @@ A library `libshadowsocks-c` (legacy names `libshadowsocks-libev.*` are kept) is
 ### Source Organization (`src/`)
 
 **Shared by all binaries:**
-- `utils.c` - logging, system utilities, `ss_malloc`/`ss_free`
+- `utils.cpp` - logging, system utilities, `ss_malloc`/`ss_free`
 - `jconf.cpp` / `json.cpp` - JSON config file parsing
 - `netutils.cpp` - network address utilities
 - `cache.cpp` - uthash-based connection cache (UDP relay, AEAD-2022 tables)
-- `udprelay.c` - UDP relay implementation (shared, but uses `#ifdef MODULE_*` for per-binary behavior)
-- `ss_event.c` / `ss_event.h` - event loop API over libuv
+- `udprelay.cpp` - UDP relay implementation (shared, but uses `#ifdef MODULE_*` for per-binary behavior)
+- `ss_event.cpp` / `ss_event.h` - event loop API over libuv
 - `resolv.cpp` - asynchronous DNS via c-ares
 
 **Crypto layer** (behind a common `crypto_t` function-pointer interface):
diff --git a/CONTRIBUTION.md b/CONTRIBUTION.md
index 4f39d86d..082ed9e4 100644
--- a/CONTRIBUTION.md
+++ b/CONTRIBUTION.md
@@ -78,7 +78,7 @@ notices.
 Doxygen 1.9.4 or newer renders HTML and man pages directly from native source
 snippets. Each CLI parser has a `cli-options` snippet containing Doxygen
 `\snippet{doc}` references to its option descriptions. Shared descriptions live
-in `src/utils.c`; command-specific descriptions live beside the parser. The
+in `src/utils.cpp`; command-specific descriptions live beside the parser. The
 `ss-nat` script keeps its snippets in a quoted no-op heredoc so documentation
 cannot execute shell substitutions. Cipher tables are included directly with
 Doxygen code snippets.
diff --git a/cmake/EventLoop.cmake b/cmake/EventLoop.cmake
index f60dd303..9055c296 100644
--- a/cmake/EventLoop.cmake
+++ b/cmake/EventLoop.cmake
@@ -1,4 +1,4 @@
-add_library(ss_ev STATIC ${PROJECT_SOURCE_DIR}/src/ss_event.c)
+add_library(ss_ev STATIC ${PROJECT_SOURCE_DIR}/src/ss_event.cpp)
 target_include_directories(ss_ev PUBLIC ${PROJECT_SOURCE_DIR}/src)
 target_link_libraries(ss_ev PUBLIC ss_uv Threads::Threads ${SS_MATH_LIBRARY} ${CMAKE_DL_LIBS})
 if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
diff --git a/doc/ss-local.md b/doc/ss-local.md
index 2e6a0692..98c7bc20 100644
--- a/doc/ss-local.md
+++ b/doc/ss-local.md
@@ -21,7 +21,7 @@ For more information, check out shadowsocks-libev(8).
 
 Options include all supported platform variants; restrictions are noted below.
 
-\snippet{doc} local.c cli-options
+\snippet{doc} local.cpp cli-options
 
 \section ss_local_example EXAMPLE
 
diff --git a/doc/ss-manager.md b/doc/ss-manager.md
index a67d15cf..63b1dec7 100644
--- a/doc/ss-manager.md
+++ b/doc/ss-manager.md
@@ -24,7 +24,7 @@ section.
 
 Options include all supported platform variants; restrictions are noted below.
 
-\snippet{doc} manager.c cli-options
+\snippet{doc} manager.cpp cli-options
 
 \section ss_manager_protocol PROTOCOL
 
diff --git a/doc/ss-redir.md b/doc/ss-redir.md
index 008d89e6..ecb44f6e 100644
--- a/doc/ss-redir.md
+++ b/doc/ss-redir.md
@@ -23,7 +23,7 @@ For more information, check out shadowsocks-libev(8) and the following
 
 Options include all supported platform variants; restrictions are noted below.
 
-\snippet{doc} redir.c cli-options
+\snippet{doc} redir.cpp cli-options
 
 \section ss_redir_example EXAMPLE
 
diff --git a/doc/ss-server.md b/doc/ss-server.md
index e3eac576..0385837d 100644
--- a/doc/ss-server.md
+++ b/doc/ss-server.md
@@ -21,7 +21,7 @@ For more information, check out shadowsocks-libev(8).
 
 Options include all supported platform variants; restrictions are noted below.
 
-\snippet{doc} server.c cli-options
+\snippet{doc} server.cpp cli-options
 
 \section ss_server_example EXAMPLE
 
diff --git a/doc/ss-tunnel.md b/doc/ss-tunnel.md
index 67897e9b..a78aae93 100644
--- a/doc/ss-tunnel.md
+++ b/doc/ss-tunnel.md
@@ -22,7 +22,7 @@ For more information, check out shadowsocks-libev(8).
 
 Options include all supported platform variants; restrictions are noted below.
 
-\snippet{doc} tunnel.c cli-options
+\snippet{doc} tunnel.cpp cli-options
 
 \section ss_tunnel_example EXAMPLE
 
diff --git a/scripts/no_heap_baseline.txt b/scripts/no_heap_baseline.txt
index 7c7fe012..bc94968b 100644
--- a/scripts/no_heap_baseline.txt
+++ b/scripts/no_heap_baseline.txt
@@ -10,9 +10,17 @@ src/crypto.cpp 4
 src/ipset.cpp 3
 src/jconf.cpp 16
 src/json.cpp 2
+src/local.cpp 16
+src/manager.cpp 14
 src/plugin.cpp 3
 src/process.cpp 26
+src/redir.cpp 15
 src/resolv.cpp 6
 src/rule.cpp 2
+src/server.cpp 17
+src/ss_event.cpp 5
 src/ssurl.cpp 3
 src/stream.cpp 3
+src/tunnel.cpp 14
+src/udprelay.cpp 7
+src/utils.cpp 10
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 74ba2e00..566163ae 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -50,20 +50,20 @@ endif()
 
 set(SS_SHARED_SOURCES
         ppbloom.cpp
-        utils.c
+        utils.cpp
         jconf.cpp
         json.cpp
         netutils.cpp
         )
 if (MINGW)
-set(SS_SHARED_SOURCES ${SS_SHARED_SOURCES} winsock.c)
+set(SS_SHARED_SOURCES ${SS_SHARED_SOURCES} winsock.cpp)
 endif ()
 
 set(LIBSHADOWSOCKS_LIBEV_SOURCE
         ${SS_SHARED_SOURCES}
-        udprelay.c
+        udprelay.cpp
         cache.cpp
-        local.c
+        local.cpp
         resolv.cpp
         ssurl.cpp
         ${SS_CRYPTO_SOURCE}
@@ -78,19 +78,19 @@ set(SS_LOCAL_SOURCE
 
 set(SS_TUNNEL_SOURCE
         ${SS_SHARED_SOURCES}
-        udprelay.c
+        udprelay.cpp
         cache.cpp
-        tunnel.c
+        tunnel.cpp
         ${SS_CRYPTO_SOURCE}
         ${SS_PLUGIN_SOURCE}
         )
 
 set(SS_SERVER_SOURCE
         ${SS_SHARED_SOURCES}
-        udprelay.c
+        udprelay.cpp
         cache.cpp
         resolv.cpp
-        server.c
+        server.cpp
         ${SS_CRYPTO_SOURCE}
         ${SS_PLUGIN_SOURCE}
         ${SS_ACL_SOURCE}
@@ -98,14 +98,14 @@ set(SS_SERVER_SOURCE
 
 set(SS_MANAGER_SOURCE
         ${SS_SHARED_SOURCES}
-        manager.c
+        manager.cpp
         )
 
 set(SS_REDIR_SOURCE
         ${SS_SHARED_SOURCES}
-        udprelay.c
+        udprelay.cpp
         cache.cpp
-        redir.c
+        redir.cpp
         ${SS_CRYPTO_SOURCE}
         ${SS_PLUGIN_SOURCE}
         )
diff --git a/src/core/fixed_map.hpp b/src/core/fixed_map.hpp
index a821e313..bb34462e 100644
--- a/src/core/fixed_map.hpp
+++ b/src/core/fixed_map.hpp
@@ -3,7 +3,7 @@
 #define SS_CORE_FIXED_MAP_HPP
 
 // Fixed-capacity associative containers. Replace uthash (cache.cpp,
-// ss_event.c, manager.c) without any per-entry allocation.
+// ss_event.cpp, manager.cpp) without any per-entry allocation.
 //
 // FixedHashMap<K, V>
 //     Open addressing with linear probing and backward-shift deletion (no
diff --git a/src/local.c b/src/local.cpp
similarity index 95%
rename from src/local.c
rename to src/local.cpp
index fba046d0..a20fa6b9 100644
--- a/src/local.c
+++ b/src/local.cpp
@@ -1,5 +1,5 @@
 /*
- * local.c - Setup a socks5 proxy through remote shadowsocks server
+ * local.cpp - Setup a socks5 proxy through remote shadowsocks server
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
@@ -346,7 +346,7 @@ struct local_dns_query {
 static void local_dns_free(void *data) { ss_free(data); }
 static void local_dns_done(struct sockaddr *address, void *data)
 {
-    struct local_dns_query *query = data;
+    struct local_dns_query *query = (struct local_dns_query *)data;
     server_t *server = query->server;
     if (!server) return;
     server->dns_query = NULL;
@@ -483,7 +483,7 @@ server_handshake(SS_P_ ss_io *w, buffer_t *buf)
             close_and_free_server(SS_A_ server);
             return -1;
         }
-        struct local_dns_query *query = ss_malloc(sizeof(*query));
+        struct local_dns_query *query = (struct local_dns_query *)ss_malloc(sizeof(*query));
         query->server = server;
         query->loop = loop;
         server->dns_query = query;
@@ -1188,13 +1188,13 @@ static remote_t *
 new_remote(int fd, int timeout)
 {
     remote_t *remote;
-    remote = ss_malloc(sizeof(remote_t));
+    remote = (remote_t *)ss_malloc(sizeof(remote_t));
 
     memset(remote, 0, sizeof(remote_t));
 
-    remote->buf      = ss_malloc(sizeof(buffer_t));
-    remote->recv_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->send_ctx = ss_malloc(sizeof(remote_ctx_t));
+    remote->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
+    remote->recv_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->send_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
     balloc(remote->buf, SOCKET_BUF_SIZE);
     memset(remote->recv_ctx, 0, sizeof(remote_ctx_t));
     memset(remote->send_ctx, 0, sizeof(remote_ctx_t));
@@ -1243,14 +1243,14 @@ static server_t *
 new_server(int fd)
 {
     server_t *server;
-    server = ss_malloc(sizeof(server_t));
+    server = (server_t *)ss_malloc(sizeof(server_t));
 
     memset(server, 0, sizeof(server_t));
 
-    server->recv_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->send_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->buf      = ss_malloc(sizeof(buffer_t));
-    server->abuf     = ss_malloc(sizeof(buffer_t));
+    server->recv_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->send_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
+    server->abuf     = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(server->buf, SOCKET_BUF_SIZE);
     balloc(server->abuf, SOCKET_BUF_SIZE);
     memset(server->recv_ctx, 0, sizeof(server_ctx_t));
@@ -1262,8 +1262,8 @@ new_server(int fd)
     server->recv_ctx->server    = server;
     server->send_ctx->server    = server;
 
-    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->e_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
     server->e_ctx->printable_salt = printable_salt;
@@ -1600,63 +1600,63 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
 [cli_long_stat_path] */
 
 /* [cli-options]
-\snippet{doc} utils.c cli_short_f
-\snippet{doc} utils.c cli_short_s
-\snippet{doc} utils.c cli_short_p
-\snippet{doc} utils.c cli_short_l
-\snippet{doc} utils.c cli_short_k
-\snippet{doc} utils.c cli_short_t
-\snippet{doc} utils.c cli_short_m
-\snippet{doc} utils.c cli_short_i
-\snippet{doc} utils.c cli_short_c
-\snippet{doc} utils.c cli_short_b
-\snippet{doc} utils.c cli_short_a
-\snippet{doc} utils.c cli_short_n
-\snippet{doc} utils.c cli_short_S
-\snippet{doc} utils.c cli_short_h
-\snippet{doc} utils.c cli_short_u
-\snippet{doc} utils.c cli_short_U
-\snippet{doc} utils.c cli_short_v
-\snippet{doc} utils.c cli_short_V
-\snippet{doc} utils.c cli_short_6
-\snippet{doc} utils.c cli_short_A
-\snippet{doc} local.c cli_long_config
-\snippet{doc} local.c cli_long_cipher
-\snippet{doc} local.c cli_long_timeout
-\snippet{doc} local.c cli_long_user
-\snippet{doc} local.c cli_long_pid_file
-\snippet{doc} local.c cli_long_nofile
-\snippet{doc} local.c cli_long_udp
-\snippet{doc} local.c cli_long_udp_only
-\snippet{doc} local.c cli_long_ipv6_first
-\snippet{doc} local.c cli_long_verbose
-\snippet{doc} local.c cli_long_server
-\snippet{doc} local.c cli_long_server_port
-\snippet{doc} local.c cli_long_listen_address
-\snippet{doc} local.c cli_long_listen_port
-\snippet{doc} local.c cli_long_interface
-\snippet{doc} utils.c cli_long_version
-\snippet{doc} utils.c cli_long_tcp_only
-\snippet{doc} utils.c cli_long_ipv4_first
-\snippet{doc} local.c cli_long_vpn
-\snippet{doc} local.c cli_long_stat_path
-\snippet{doc} utils.c cli_long_reuse_port
-\snippet{doc} utils.c cli_long_tcp_incoming_sndbuf
-\snippet{doc} utils.c cli_long_tcp_incoming_rcvbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_sndbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_rcvbuf
-\snippet{doc} utils.c cli_long_fast_open
-\snippet{doc} utils.c cli_long_no_delay
-\snippet{doc} utils.c cli_long_acl
-\snippet{doc} utils.c cli_long_mtu
-\snippet{doc} utils.c cli_long_mptcp
-\snippet{doc} utils.c cli_long_plugin
-\snippet{doc} utils.c cli_long_plugin_opts
-\snippet{doc} utils.c cli_long_password
-\snippet{doc} utils.c cli_long_key
-\snippet{doc} utils.c cli_long_server_url
-\snippet{doc} utils.c cli_long_printable_salt
-\snippet{doc} utils.c cli_long_help
+\snippet{doc} utils.cpp cli_short_f
+\snippet{doc} utils.cpp cli_short_s
+\snippet{doc} utils.cpp cli_short_p
+\snippet{doc} utils.cpp cli_short_l
+\snippet{doc} utils.cpp cli_short_k
+\snippet{doc} utils.cpp cli_short_t
+\snippet{doc} utils.cpp cli_short_m
+\snippet{doc} utils.cpp cli_short_i
+\snippet{doc} utils.cpp cli_short_c
+\snippet{doc} utils.cpp cli_short_b
+\snippet{doc} utils.cpp cli_short_a
+\snippet{doc} utils.cpp cli_short_n
+\snippet{doc} utils.cpp cli_short_S
+\snippet{doc} utils.cpp cli_short_h
+\snippet{doc} utils.cpp cli_short_u
+\snippet{doc} utils.cpp cli_short_U
+\snippet{doc} utils.cpp cli_short_v
+\snippet{doc} utils.cpp cli_short_V
+\snippet{doc} utils.cpp cli_short_6
+\snippet{doc} utils.cpp cli_short_A
+\snippet{doc} local.cpp cli_long_config
+\snippet{doc} local.cpp cli_long_cipher
+\snippet{doc} local.cpp cli_long_timeout
+\snippet{doc} local.cpp cli_long_user
+\snippet{doc} local.cpp cli_long_pid_file
+\snippet{doc} local.cpp cli_long_nofile
+\snippet{doc} local.cpp cli_long_udp
+\snippet{doc} local.cpp cli_long_udp_only
+\snippet{doc} local.cpp cli_long_ipv6_first
+\snippet{doc} local.cpp cli_long_verbose
+\snippet{doc} local.cpp cli_long_server
+\snippet{doc} local.cpp cli_long_server_port
+\snippet{doc} local.cpp cli_long_listen_address
+\snippet{doc} local.cpp cli_long_listen_port
+\snippet{doc} local.cpp cli_long_interface
+\snippet{doc} utils.cpp cli_long_version
+\snippet{doc} utils.cpp cli_long_tcp_only
+\snippet{doc} utils.cpp cli_long_ipv4_first
+\snippet{doc} local.cpp cli_long_vpn
+\snippet{doc} local.cpp cli_long_stat_path
+\snippet{doc} utils.cpp cli_long_reuse_port
+\snippet{doc} utils.cpp cli_long_tcp_incoming_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_incoming_rcvbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_rcvbuf
+\snippet{doc} utils.cpp cli_long_fast_open
+\snippet{doc} utils.cpp cli_long_no_delay
+\snippet{doc} utils.cpp cli_long_acl
+\snippet{doc} utils.cpp cli_long_mtu
+\snippet{doc} utils.cpp cli_long_mptcp
+\snippet{doc} utils.cpp cli_long_plugin
+\snippet{doc} utils.cpp cli_long_plugin_opts
+\snippet{doc} utils.cpp cli_long_password
+\snippet{doc} utils.cpp cli_long_key
+\snippet{doc} utils.cpp cli_long_server_url
+\snippet{doc} utils.cpp cli_long_printable_salt
+\snippet{doc} utils.cpp cli_long_help
 [cli-options] */
     static struct option long_options[] = {
         { "config", required_argument, NULL, 'c' },
@@ -2071,9 +2071,9 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
         }
         snprintf(tmp_port, 8, "%d", port);
         if (is_ipv6only(remote_addr, remote_num, ipv6first)) {
-            plugin_host = "::1";
+            plugin_host = (char *)"::1";
         } else {
-            plugin_host = "127.0.0.1";
+            plugin_host = (char *)"127.0.0.1";
         }
         plugin_port = tmp_port;
 
@@ -2089,7 +2089,7 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
     }
 
     if (method == NULL) {
-        method = "chacha20-ietf-poly1305";
+        method = (char *)"chacha20-ietf-poly1305";
     }
     if (printable_salt && strcmp(method, "chacha20-ietf-poly1305") != 0
         && strcmp(method, "aes-256-gcm") != 0) {
@@ -2100,7 +2100,7 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
     }
 
     if (timeout == NULL) {
-        timeout = "60";
+        timeout = (char *)"60";
     }
     if (ss_parse_int(timeout, 1, INT_MAX, &timeout_secs) == -1) {
         FATAL("invalid timeout");
@@ -2121,9 +2121,9 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
 
     if (local_addr == NULL) {
         if (is_ipv6only(remote_addr, remote_num, ipv6first)) {
-            local_addr = "::1";
+            local_addr = (char *)"::1";
         } else {
-            local_addr = "127.0.0.1";
+            local_addr = (char *)"127.0.0.1";
         }
     }
 
@@ -2186,7 +2186,7 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
     if (plugin != NULL) {
         int len          = 0;
         size_t buf_size  = 256 * remote_num;
-        char *remote_str = ss_malloc(buf_size);
+        char *remote_str = (char *)ss_malloc(buf_size);
 
         snprintf(remote_str, buf_size, "%s", remote_addr[0].host);
         len = strlen(remote_str);
@@ -2221,7 +2221,7 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
     // Setup proxy context
     listen_ctx_t listen_ctx;
     listen_ctx.remote_num  = 0;
-    listen_ctx.remote_addr = ss_malloc(sizeof(struct sockaddr *) * remote_num);
+    listen_ctx.remote_addr = (struct sockaddr **)ss_malloc(sizeof(struct sockaddr *) * remote_num);
     memset(listen_ctx.remote_addr, 0, sizeof(struct sockaddr *) * remote_num);
     for (i = 0; i < remote_num; i++) {
         char *host = remote_addr[i].host;
@@ -2231,7 +2231,7 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
             host = plugin_host;
             port = plugin_port;
         }
-        struct sockaddr_storage *storage = ss_malloc(sizeof(struct sockaddr_storage));
+        struct sockaddr_storage *storage = (struct sockaddr_storage *)ss_malloc(sizeof(struct sockaddr_storage));
         memset(storage, 0, sizeof(struct sockaddr_storage));
         if (get_sockaddr(host, port, storage, 1, ipv6first) == -1) {
             FATAL("failed to resolve the provided hostname");
@@ -2291,7 +2291,7 @@ Same behavior as `-S`; see that option for details. Short alias: `-S`.
         LOGI("udprelay enabled");
         char *host                       = remote_addr[0].host;
         char *port                       = remote_addr[0].port == NULL ? remote_port : remote_addr[0].port;
-        struct sockaddr_storage *storage = ss_malloc(sizeof(struct sockaddr_storage));
+        struct sockaddr_storage *storage = (struct sockaddr_storage *)ss_malloc(sizeof(struct sockaddr_storage));
         memset(storage, 0, sizeof(struct sockaddr_storage));
         if (get_sockaddr(host, port, storage, 1, ipv6first) == -1) {
             FATAL("failed to resolve the provided hostname");
@@ -2401,7 +2401,7 @@ _start_ss_local_server(profile_t profile, ss_local_callback callback, void *udat
     }
 
     if (local_addr == NULL) {
-        local_addr = "127.0.0.1";
+        local_addr = (char *)"127.0.0.1";
     }
 
 #ifndef __MINGW32__
diff --git a/src/manager.c b/src/manager.cpp
similarity index 92%
rename from src/manager.c
rename to src/manager.cpp
index d5b799c5..7e9494ec 100644
--- a/src/manager.c
+++ b/src/manager.cpp
@@ -1,5 +1,5 @@
 /*
- * server.c - Provide shadowsocks service
+ * server.cpp - Provide shadowsocks service
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
@@ -71,7 +71,7 @@
 #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
 
 int verbose          = 0;
-char *executable     = "ss-server";
+char *executable     = (char *)"ss-server";
 char *working_dir    = NULL;
 size_t working_dir_size = 0;
 
@@ -306,7 +306,7 @@ build_config(char *prefix, struct manager_ctx *manager, struct server *server)
     char *path    = NULL;
     int path_size = strlen(prefix) + strlen(server->port) + 20;
 
-    path = ss_malloc(path_size);
+    path = (char *)ss_malloc(path_size);
     snprintf(path, path_size, "%s/.shadowsocks_%s.conf", prefix, server->port);
     FILE *f = fopen(path, "w+");
     if (f == NULL) {
@@ -391,30 +391,30 @@ start_server_process(struct manager_ctx *manager, struct server *server)
 
     int pid_path_size = strlen(working_dir) + strlen(server->port) + 20;
     int conf_path_size = strlen(working_dir) + strlen(server->port) + 20;
-    pid_path           = ss_malloc(pid_path_size);
-    conf_path          = ss_malloc(conf_path_size);
+    pid_path           = (char *)ss_malloc(pid_path_size);
+    conf_path          = (char *)ss_malloc(conf_path_size);
     snprintf(pid_path, pid_path_size, "%s/.shadowsocks_%d.pid", working_dir, port);
     snprintf(conf_path, conf_path_size, "%s/.shadowsocks_%d.conf", working_dir, port);
 
     argv[0] = NULL;
 
     if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), executable) == -1 ||
-        add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--manager-address") == -1 ||
+        add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--manager-address") == -1 ||
         add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->manager_address) == -1 ||
-        add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-f") == -1 ||
+        add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-f") == -1 ||
         add_server_arg(argv, &argc, ARRAY_SIZE(argv), pid_path) == -1 ||
-        add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-c") == -1 ||
+        add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-c") == -1 ||
         add_server_arg(argv, &argc, ARRAY_SIZE(argv), conf_path) == -1) {
         goto ERROR;
     }
 
     if (manager->acl != NULL &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--acl") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--acl") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->acl) == -1)) {
         goto ERROR;
     }
     if (manager->timeout != NULL &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-t") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-t") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->timeout) == -1)) {
         goto ERROR;
     }
@@ -422,76 +422,76 @@ start_server_process(struct manager_ctx *manager, struct server *server)
 #ifdef HAVE_SETRLIMIT
     if (manager->nofile) {
         snprintf(nofile, sizeof(nofile), "%d", manager->nofile);
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-n") == -1 ||
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-n") == -1 ||
             add_server_arg(argv, &argc, ARRAY_SIZE(argv), nofile) == -1) {
             goto ERROR;
         }
     }
 #endif
     if (manager->user != NULL &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-a") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-a") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->user) == -1)) {
         goto ERROR;
     }
     if (manager->verbose) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-v") == -1) {
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-v") == -1) {
             goto ERROR;
         }
     }
     if (server->mode == NULL && manager->mode == UDP_ONLY) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-U") == -1) {
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-U") == -1) {
             goto ERROR;
         }
     }
     if (server->mode == NULL && manager->mode == TCP_AND_UDP) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-u") == -1) {
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-u") == -1) {
             goto ERROR;
         }
     }
     if (manager->iface &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-i") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-i") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->iface) == -1)) {
         goto ERROR;
     }
     if (server->fast_open[0] == 0 && manager->fast_open) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--fast-open") == -1) {
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--fast-open") == -1) {
             goto ERROR;
         }
     }
     if (server->no_delay[0] == 0 && manager->no_delay) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--no-delay") == -1) {
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--no-delay") == -1) {
             goto ERROR;
         }
     }
     if (manager->ipv6first) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-6") == -1) {
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-6") == -1) {
             goto ERROR;
         }
     }
     if (manager->mtu) {
         snprintf(mtu, sizeof(mtu), "%d", manager->mtu);
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--mtu") == -1 ||
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--mtu") == -1 ||
             add_server_arg(argv, &argc, ARRAY_SIZE(argv), mtu) == -1) {
             goto ERROR;
         }
     }
     if (server->plugin == NULL && manager->plugin &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--plugin") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--plugin") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->plugin) == -1)) {
         goto ERROR;
     }
     if (server->plugin_opts == NULL && manager->plugin_opts &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "--plugin-opts") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"--plugin-opts") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->plugin_opts) == -1)) {
         goto ERROR;
     }
     if (manager->nameservers &&
-        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-d") == -1 ||
+        (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-d") == -1 ||
          add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->nameservers) == -1)) {
         goto ERROR;
     }
     for (int i = 0; i < manager->host_num; i++) {
-        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), "-s") == -1 ||
+        if (add_server_arg(argv, &argc, ARRAY_SIZE(argv), (char *)"-s") == -1 ||
             add_server_arg(argv, &argc, ARRAY_SIZE(argv), manager->hosts[i]) == -1) {
             goto ERROR;
         }
@@ -506,7 +506,8 @@ start_server_process(struct manager_ctx *manager, struct server *server)
         goto ERROR;
     }
 
-    pid_t pid = fork();
+    pid_t pid;
+    pid = fork();
     if (pid == -1) {
         ERROR("fork");
         goto ERROR;
@@ -599,7 +600,7 @@ get_server(char *buf, int len)
         return NULL;
     }
 
-    struct server *server = ss_malloc(sizeof(struct server));
+    struct server *server = (struct server *)ss_malloc(sizeof(struct server));
     memset(server, 0, sizeof(struct server));
     int valid = 1;
     if (obj->type == json_object) {
@@ -883,7 +884,7 @@ kill_server(char *prefix, char *pid_file)
 {
     char *path = NULL;
     int path_size = strlen(prefix) + strlen(pid_file) + 2;
-    path = ss_malloc(path_size);
+    path = (char *)ss_malloc(path_size);
     snprintf(path, path_size, "%s/%s", prefix, pid_file);
     FILE *f = fopen(path, "r");
     if (f == NULL) {
@@ -904,7 +905,7 @@ stop_server(char *prefix, char *port)
 {
     char *path = NULL;
     int path_size = strlen(prefix) + strlen(port) + 20;
-    path = ss_malloc(path_size);
+    path = (char *)ss_malloc(path_size);
     snprintf(path, path_size, "%s/.shadowsocks_%s.pid", prefix, port);
     FILE *f = fopen(path, "r");
     if (f == NULL) {
@@ -1001,12 +1002,12 @@ manager_recv_cb(SS_P_ ss_io *w, int revents)
         int msg_len;
 
         if (ret == -1) {
-            msg     = "port is not available";
+            msg     = (char *)"port is not available";
             msg_len = 21;
             destroy_server(server);
             ss_free(server);
         } else {
-            msg     = "ok";
+            msg     = (char *)"ok";
             msg_len = 2;
         }
 
@@ -1347,51 +1348,51 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
 [cli_long_nameserver] */
 
 /* [cli-options]
-\snippet{doc} utils.c cli_short_f
-\snippet{doc} manager.c cli_short_s
-\snippet{doc} utils.c cli_short_k
-\snippet{doc} utils.c cli_short_t
-\snippet{doc} utils.c cli_short_m
-\snippet{doc} manager.c cli_short_c
-\snippet{doc} utils.c cli_short_i
-\snippet{doc} utils.c cli_short_d
-\snippet{doc} utils.c cli_short_a
-\snippet{doc} utils.c cli_short_n
-\snippet{doc} utils.c cli_short_D
-\snippet{doc} utils.c cli_short_6
-\snippet{doc} utils.c cli_short_h
-\snippet{doc} utils.c cli_short_u
-\snippet{doc} utils.c cli_short_U
-\snippet{doc} utils.c cli_short_v
-\snippet{doc} utils.c cli_short_A
-\snippet{doc} manager.c cli_long_config
-\snippet{doc} manager.c cli_long_cipher
-\snippet{doc} manager.c cli_long_timeout
-\snippet{doc} manager.c cli_long_user
-\snippet{doc} manager.c cli_long_pid_file
-\snippet{doc} manager.c cli_long_nofile
-\snippet{doc} manager.c cli_long_udp
-\snippet{doc} manager.c cli_long_udp_only
-\snippet{doc} manager.c cli_long_ipv6_first
-\snippet{doc} manager.c cli_long_verbose
-\snippet{doc} manager.c cli_long_listen_address
-\snippet{doc} manager.c cli_long_interface
-\snippet{doc} manager.c cli_long_nameserver
-\snippet{doc} utils.c cli_long_version
-\snippet{doc} utils.c cli_long_tcp_only
-\snippet{doc} utils.c cli_long_ipv4_first
-\snippet{doc} utils.c cli_long_fast_open
-\snippet{doc} utils.c cli_long_no_delay
-\snippet{doc} utils.c cli_long_reuse_port
-\snippet{doc} utils.c cli_long_acl
-\snippet{doc} utils.c cli_long_manager_address
-\snippet{doc} utils.c cli_long_executable
-\snippet{doc} utils.c cli_long_mtu
-\snippet{doc} utils.c cli_long_plugin
-\snippet{doc} utils.c cli_long_plugin_opts
-\snippet{doc} utils.c cli_long_password
-\snippet{doc} utils.c cli_long_workdir
-\snippet{doc} utils.c cli_long_help
+\snippet{doc} utils.cpp cli_short_f
+\snippet{doc} manager.cpp cli_short_s
+\snippet{doc} utils.cpp cli_short_k
+\snippet{doc} utils.cpp cli_short_t
+\snippet{doc} utils.cpp cli_short_m
+\snippet{doc} manager.cpp cli_short_c
+\snippet{doc} utils.cpp cli_short_i
+\snippet{doc} utils.cpp cli_short_d
+\snippet{doc} utils.cpp cli_short_a
+\snippet{doc} utils.cpp cli_short_n
+\snippet{doc} utils.cpp cli_short_D
+\snippet{doc} utils.cpp cli_short_6
+\snippet{doc} utils.cpp cli_short_h
+\snippet{doc} utils.cpp cli_short_u
+\snippet{doc} utils.cpp cli_short_U
+\snippet{doc} utils.cpp cli_short_v
+\snippet{doc} utils.cpp cli_short_A
+\snippet{doc} manager.cpp cli_long_config
+\snippet{doc} manager.cpp cli_long_cipher
+\snippet{doc} manager.cpp cli_long_timeout
+\snippet{doc} manager.cpp cli_long_user
+\snippet{doc} manager.cpp cli_long_pid_file
+\snippet{doc} manager.cpp cli_long_nofile
+\snippet{doc} manager.cpp cli_long_udp
+\snippet{doc} manager.cpp cli_long_udp_only
+\snippet{doc} manager.cpp cli_long_ipv6_first
+\snippet{doc} manager.cpp cli_long_verbose
+\snippet{doc} manager.cpp cli_long_listen_address
+\snippet{doc} manager.cpp cli_long_interface
+\snippet{doc} manager.cpp cli_long_nameserver
+\snippet{doc} utils.cpp cli_long_version
+\snippet{doc} utils.cpp cli_long_tcp_only
+\snippet{doc} utils.cpp cli_long_ipv4_first
+\snippet{doc} utils.cpp cli_long_fast_open
+\snippet{doc} utils.cpp cli_long_no_delay
+\snippet{doc} utils.cpp cli_long_reuse_port
+\snippet{doc} utils.cpp cli_long_acl
+\snippet{doc} utils.cpp cli_long_manager_address
+\snippet{doc} utils.cpp cli_long_executable
+\snippet{doc} utils.cpp cli_long_mtu
+\snippet{doc} utils.cpp cli_long_plugin
+\snippet{doc} utils.cpp cli_long_plugin_opts
+\snippet{doc} utils.cpp cli_long_password
+\snippet{doc} utils.cpp cli_long_workdir
+\snippet{doc} utils.cpp cli_long_help
 [cli-options] */
     static struct option long_options[] = {
         { "config", required_argument, NULL, 'c' },
@@ -1623,15 +1624,15 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
     }
 
     if (server_num == 0) {
-        server_host[server_num++] = "0.0.0.0";
+        server_host[server_num++] = (char *)"0.0.0.0";
     }
 
     if (method == NULL) {
-        method = "table";
+        method = (char *)"table";
     }
 
     if (timeout == NULL) {
-        timeout = "60";
+        timeout = (char *)"60";
     }
     if (ss_parse_int(timeout, 1, INT_MAX, &timeout_secs) == -1) {
         FATAL("invalid timeout");
@@ -1678,15 +1679,15 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
         // If home dir is still not defined or set to nologin/nonexistent, fall back to /tmp
         if (workdir == NULL || strlen(workdir) == 0 || strstr(workdir, "nologin") || 
             strstr(workdir, "nonexistent") || strcmp(workdir, "/") == 0) {
-            workdir = "/tmp";
+            workdir = (char *)"/tmp";
         }
 
         working_dir_size = strlen(workdir) + 15;
-        working_dir      = ss_malloc(working_dir_size);
+        working_dir      = (char *)ss_malloc(working_dir_size);
         snprintf(working_dir, working_dir_size, "%s/.shadowsocks", workdir);
     } else {
         working_dir_size = strlen(workdir) + 2;
-        working_dir      = ss_malloc(working_dir_size);
+        working_dir      = (char *)ss_malloc(working_dir_size);
         snprintf(working_dir, working_dir_size, "%s", workdir);
     }
     if (working_dir == NULL) {
@@ -1703,7 +1704,7 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
 
     if (manager_address == NULL) {
         size_t manager_address_size = strlen(workdir) + 20;
-        manager_address = ss_malloc(manager_address_size);
+        manager_address = (char *)ss_malloc(manager_address_size);
         snprintf(manager_address, manager_address_size, "%s/.ss-manager.socks", workdir);
         LOGI("using the default manager address: %s", manager_address);
     }
@@ -1773,7 +1774,7 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
 
     if (conf != NULL) {
         for (i = 0; i < conf->port_password_num; i++) {
-            struct server *server = ss_malloc(sizeof(struct server));
+            struct server *server = (struct server *)ss_malloc(sizeof(struct server));
             memset(server, 0, sizeof(struct server));
             if (copy_port(server->port, sizeof(server->port),
                           conf->port_password[i].port,
diff --git a/src/redir.c b/src/redir.cpp
similarity index 93%
rename from src/redir.c
rename to src/redir.cpp
index b5309d00..d6920cac 100644
--- a/src/redir.c
+++ b/src/redir.cpp
@@ -1,5 +1,5 @@
 /*
- * redir.c - Provide a transparent TCP proxy through remote shadowsocks
+ * redir.cpp - Provide a transparent TCP proxy through remote shadowsocks
  *           server
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
@@ -118,7 +118,7 @@ getdestaddr(int fd, struct sockaddr_storage *destaddr)
     int error         = 0;
 
     if (tcp_tproxy) {
-        error = getsockname(fd, (void *)destaddr, &socklen);
+        error = getsockname(fd, (struct sockaddr *)destaddr, &socklen);
     } else {
         error = getsockopt(fd, SOL_IPV6, IP6T_SO_ORIGINAL_DST, destaddr, &socklen);
         if (error) { // Didn't find a proper way to detect IP version.
@@ -622,12 +622,12 @@ remote_send_cb(SS_P_ ss_io *w, int revents)
 static remote_t *
 new_remote(int fd, int timeout)
 {
-    remote_t *remote = ss_malloc(sizeof(remote_t));
+    remote_t *remote = (remote_t *)ss_malloc(sizeof(remote_t));
     memset(remote, 0, sizeof(remote_t));
 
-    remote->recv_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->send_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->buf      = ss_malloc(sizeof(buffer_t));
+    remote->recv_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->send_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(remote->buf, SOCKET_BUF_SIZE);
     memset(remote->recv_ctx, 0, sizeof(remote_ctx_t));
     memset(remote->send_ctx, 0, sizeof(remote_ctx_t));
@@ -675,12 +675,12 @@ close_and_free_remote(SS_P_ remote_t *remote)
 static server_t *
 new_server(int fd)
 {
-    server_t *server = ss_malloc(sizeof(server_t));
+    server_t *server = (server_t *)ss_malloc(sizeof(server_t));
     memset(server, 0, sizeof(server_t));
 
-    server->recv_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->send_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->buf      = ss_malloc(sizeof(buffer_t));
+    server->recv_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->send_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(server->buf, SOCKET_BUF_SIZE);
     memset(server->recv_ctx, 0, sizeof(server_ctx_t));
     memset(server->send_ctx, 0, sizeof(server_ctx_t));
@@ -690,8 +690,8 @@ new_server(int fd)
     server->send_ctx->server    = server;
     server->send_ctx->connected = 0;
 
-    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->e_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
     cipher_ctx_pair(server->e_ctx, server->d_ctx);
@@ -1003,56 +1003,56 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
 [cli_long_tproxy] */
 
 /* [cli-options]
-\snippet{doc} utils.c cli_short_f
-\snippet{doc} utils.c cli_short_s
-\snippet{doc} utils.c cli_short_p
-\snippet{doc} utils.c cli_short_l
-\snippet{doc} utils.c cli_short_k
-\snippet{doc} utils.c cli_short_t
-\snippet{doc} utils.c cli_short_m
-\snippet{doc} utils.c cli_short_c
-\snippet{doc} utils.c cli_short_b
-\snippet{doc} utils.c cli_short_a
-\snippet{doc} utils.c cli_short_n
-\snippet{doc} utils.c cli_short_h
-\snippet{doc} redir.c cli_short_u
-\snippet{doc} utils.c cli_short_U
-\snippet{doc} utils.c cli_short_T
-\snippet{doc} utils.c cli_short_v
-\snippet{doc} utils.c cli_short_6
-\snippet{doc} utils.c cli_short_A
-\snippet{doc} redir.c cli_long_config
-\snippet{doc} redir.c cli_long_cipher
-\snippet{doc} redir.c cli_long_timeout
-\snippet{doc} redir.c cli_long_user
-\snippet{doc} redir.c cli_long_pid_file
-\snippet{doc} redir.c cli_long_nofile
-\snippet{doc} redir.c cli_long_udp
-\snippet{doc} redir.c cli_long_udp_only
-\snippet{doc} redir.c cli_long_ipv6_first
-\snippet{doc} redir.c cli_long_verbose
-\snippet{doc} redir.c cli_long_server
-\snippet{doc} redir.c cli_long_server_port
-\snippet{doc} redir.c cli_long_listen_address
-\snippet{doc} redir.c cli_long_listen_port
-\snippet{doc} redir.c cli_long_tproxy
-\snippet{doc} utils.c cli_long_version
-\snippet{doc} utils.c cli_long_tcp_only
-\snippet{doc} utils.c cli_long_ipv4_first
-\snippet{doc} utils.c cli_long_fast_open
-\snippet{doc} utils.c cli_long_mtu
-\snippet{doc} utils.c cli_long_mptcp
-\snippet{doc} utils.c cli_long_plugin
-\snippet{doc} utils.c cli_long_plugin_opts
-\snippet{doc} utils.c cli_long_reuse_port
-\snippet{doc} utils.c cli_long_tcp_incoming_sndbuf
-\snippet{doc} utils.c cli_long_tcp_incoming_rcvbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_sndbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_rcvbuf
-\snippet{doc} utils.c cli_long_no_delay
-\snippet{doc} utils.c cli_long_password
-\snippet{doc} utils.c cli_long_key
-\snippet{doc} utils.c cli_long_help
+\snippet{doc} utils.cpp cli_short_f
+\snippet{doc} utils.cpp cli_short_s
+\snippet{doc} utils.cpp cli_short_p
+\snippet{doc} utils.cpp cli_short_l
+\snippet{doc} utils.cpp cli_short_k
+\snippet{doc} utils.cpp cli_short_t
+\snippet{doc} utils.cpp cli_short_m
+\snippet{doc} utils.cpp cli_short_c
+\snippet{doc} utils.cpp cli_short_b
+\snippet{doc} utils.cpp cli_short_a
+\snippet{doc} utils.cpp cli_short_n
+\snippet{doc} utils.cpp cli_short_h
+\snippet{doc} redir.cpp cli_short_u
+\snippet{doc} utils.cpp cli_short_U
+\snippet{doc} utils.cpp cli_short_T
+\snippet{doc} utils.cpp cli_short_v
+\snippet{doc} utils.cpp cli_short_6
+\snippet{doc} utils.cpp cli_short_A
+\snippet{doc} redir.cpp cli_long_config
+\snippet{doc} redir.cpp cli_long_cipher
+\snippet{doc} redir.cpp cli_long_timeout
+\snippet{doc} redir.cpp cli_long_user
+\snippet{doc} redir.cpp cli_long_pid_file
+\snippet{doc} redir.cpp cli_long_nofile
+\snippet{doc} redir.cpp cli_long_udp
+\snippet{doc} redir.cpp cli_long_udp_only
+\snippet{doc} redir.cpp cli_long_ipv6_first
+\snippet{doc} redir.cpp cli_long_verbose
+\snippet{doc} redir.cpp cli_long_server
+\snippet{doc} redir.cpp cli_long_server_port
+\snippet{doc} redir.cpp cli_long_listen_address
+\snippet{doc} redir.cpp cli_long_listen_port
+\snippet{doc} redir.cpp cli_long_tproxy
+\snippet{doc} utils.cpp cli_long_version
+\snippet{doc} utils.cpp cli_long_tcp_only
+\snippet{doc} utils.cpp cli_long_ipv4_first
+\snippet{doc} utils.cpp cli_long_fast_open
+\snippet{doc} utils.cpp cli_long_mtu
+\snippet{doc} utils.cpp cli_long_mptcp
+\snippet{doc} utils.cpp cli_long_plugin
+\snippet{doc} utils.cpp cli_long_plugin_opts
+\snippet{doc} utils.cpp cli_long_reuse_port
+\snippet{doc} utils.cpp cli_long_tcp_incoming_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_incoming_rcvbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_rcvbuf
+\snippet{doc} utils.cpp cli_long_no_delay
+\snippet{doc} utils.cpp cli_long_password
+\snippet{doc} utils.cpp cli_long_key
+\snippet{doc} utils.cpp cli_long_help
 [cli-options] */
     static struct option long_options[] = {
         { "config", required_argument, NULL, 'c' },
@@ -1366,9 +1366,9 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
         }
         snprintf(tmp_port, 8, "%d", port);
         if (is_ipv6only(remote_addr, remote_num, ipv6first)) {
-            plugin_host = "::1";
+            plugin_host = (char *)"::1";
         } else {
-            plugin_host = "127.0.0.1";
+            plugin_host = (char *)"127.0.0.1";
         }
         plugin_port = tmp_port;
 
@@ -1376,11 +1376,11 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
     }
 
     if (method == NULL) {
-        method = "chacha20-ietf-poly1305";
+        method = (char *)"chacha20-ietf-poly1305";
     }
 
     if (timeout == NULL) {
-        timeout = "600";
+        timeout = (char *)"600";
     }
     if (ss_parse_int(timeout, 1, INT_MAX, &timeout_secs) == -1) {
         FATAL("invalid timeout");
@@ -1401,9 +1401,9 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
 
     if (local_addr == NULL) {
         if (is_ipv6only(remote_addr, remote_num, ipv6first)) {
-            local_addr = "::1";
+            local_addr = (char *)"::1";
         } else {
-            local_addr = "127.0.0.1";
+            local_addr = (char *)"127.0.0.1";
         }
     }
 
@@ -1464,7 +1464,7 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
     if (plugin != NULL) {
         int len          = 0;
         size_t buf_size  = 256 * remote_num;
-        char *remote_str = ss_malloc(buf_size);
+        char *remote_str = (char *)ss_malloc(buf_size);
 
         snprintf(remote_str, buf_size, "%s", remote_addr[0].host);
         len = strlen(remote_str);
@@ -1500,7 +1500,7 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
     struct listen_ctx listen_ctx;
     memset(&listen_ctx, 0, sizeof(struct listen_ctx));
     listen_ctx.remote_num  = remote_num;
-    listen_ctx.remote_addr = ss_malloc(sizeof(struct sockaddr *) * remote_num);
+    listen_ctx.remote_addr = (struct sockaddr **)ss_malloc(sizeof(struct sockaddr *) * remote_num);
     memset(listen_ctx.remote_addr, 0, sizeof(struct sockaddr *) * remote_num);
     for (i = 0; i < remote_num; i++) {
         char *host = remote_addr[i].host;
@@ -1510,7 +1510,7 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
             host = plugin_host;
             port = plugin_port;
         }
-        struct sockaddr_storage *storage = ss_malloc(sizeof(struct sockaddr_storage));
+        struct sockaddr_storage *storage = (struct sockaddr_storage *)ss_malloc(sizeof(struct sockaddr_storage));
         memset(storage, 0, sizeof(struct sockaddr_storage));
         if (get_sockaddr(host, port, storage, 1, ipv6first) == -1) {
             FATAL("failed to resolve the provided hostname");
@@ -1556,7 +1556,7 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
             LOGI("UDP relay enabled");
             char *host                       = remote_addr[0].host;
             char *port                       = remote_addr[0].port == NULL ? remote_port : remote_addr[0].port;
-            struct sockaddr_storage *storage = ss_malloc(sizeof(struct sockaddr_storage));
+            struct sockaddr_storage *storage = (struct sockaddr_storage *)ss_malloc(sizeof(struct sockaddr_storage));
             memset(storage, 0, sizeof(struct sockaddr_storage));
             if (get_sockaddr(host, port, storage, 1, ipv6first) == -1) {
                 FATAL("failed to resolve the provided hostname");
@@ -1576,7 +1576,7 @@ Same behavior as `-T`; see that option for details. Short alias: `-T`.
         // Handle additionals TOS/DSCP listening ports
         if (dscp_num > 0) {
             listen_ctx_current      = (listen_ctx_t *)ss_malloc(sizeof(listen_ctx_t));
-            listen_ctx_current      = memcpy(listen_ctx_current, &listen_ctx, sizeof(listen_ctx_t));
+            listen_ctx_current      = (listen_ctx_t *)memcpy(listen_ctx_current, &listen_ctx, sizeof(listen_ctx_t));
             local_port              = dscp[dscp_num - 1].port;
             listen_ctx_current->tos = dscp[dscp_num - 1].dscp << 2;
         }
diff --git a/src/server.c b/src/server.cpp
similarity index 95%
rename from src/server.c
rename to src/server.cpp
index a5ee7bb5..e12d97c8 100644
--- a/src/server.c
+++ b/src/server.cpp
@@ -1,5 +1,5 @@
 /*
- * server.c - Provide shadowsocks service
+ * server.cpp - Provide shadowsocks service
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
@@ -177,7 +177,7 @@ static void stat_resolved(struct sockaddr *address, void *data)
     int fd = ss_socket(address->sa_family, SOCK_DGRAM, 0);
     if (fd == -1) return;
     setnonblocking(fd);
-    const char *message = data;
+    const char *message = (const char *)data;
     size_t length = strlen(message) + 1;
     if (sendto(fd, message, length, 0, address, get_sockaddr_len(address)) != (ssize_t)length)
         ERROR("stat_sendto");
@@ -1209,7 +1209,7 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
         } else {
             ss_io_stop(SS_A_ & server_recv_ctx->io);
 
-            query_t *query = ss_malloc(sizeof(query_t));
+            query_t *query = (query_t *)ss_malloc(sizeof(query_t));
             memset(query, 0, sizeof(query_t));
             query->server = server;
             server->query = query;
@@ -1569,12 +1569,12 @@ new_remote(int fd)
         LOGI("new connection to remote, %d opened remote connections", remote_conn);
     }
 
-    remote_t *remote = ss_malloc(sizeof(remote_t));
+    remote_t *remote = (remote_t *)ss_malloc(sizeof(remote_t));
     memset(remote, 0, sizeof(remote_t));
 
-    remote->recv_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->send_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->buf      = ss_malloc(sizeof(buffer_t));
+    remote->recv_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->send_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(remote->buf, SOCKET_BUF_SIZE);
     memset(remote->recv_ctx, 0, sizeof(remote_ctx_t));
     memset(remote->send_ctx, 0, sizeof(remote_ctx_t));
@@ -1630,13 +1630,13 @@ new_server(int fd, listen_ctx_t *listener)
     }
 
     server_t *server;
-    server = ss_malloc(sizeof(server_t));
+    server = (server_t *)ss_malloc(sizeof(server_t));
 
     memset(server, 0, sizeof(server_t));
 
-    server->recv_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->send_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->buf      = ss_malloc(sizeof(buffer_t));
+    server->recv_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->send_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
     memset(server->recv_ctx, 0, sizeof(server_ctx_t));
     memset(server->send_ctx, 0, sizeof(server_ctx_t));
     balloc(server->buf, SOCKET_BUF_SIZE);
@@ -1651,8 +1651,8 @@ new_server(int fd, listen_ctx_t *listener)
     server->listen_ctx          = listener;
     server->remote              = NULL;
 
-    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->e_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
     cipher_ctx_pair(server->e_ctx, server->d_ctx);
@@ -1929,59 +1929,59 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
 [cli_long_nameserver] */
 
 /* [cli-options]
-\snippet{doc} utils.c cli_short_f
-\snippet{doc} server.c cli_short_s
-\snippet{doc} server.c cli_short_p
-\snippet{doc} utils.c cli_short_k
-\snippet{doc} utils.c cli_short_t
-\snippet{doc} utils.c cli_short_m
-\snippet{doc} server.c cli_short_b
-\snippet{doc} utils.c cli_short_c
-\snippet{doc} utils.c cli_short_i
-\snippet{doc} utils.c cli_short_d
-\snippet{doc} utils.c cli_short_a
-\snippet{doc} utils.c cli_short_n
-\snippet{doc} utils.c cli_short_h
-\snippet{doc} utils.c cli_short_u
-\snippet{doc} utils.c cli_short_U
-\snippet{doc} utils.c cli_short_v
-\snippet{doc} utils.c cli_short_6
-\snippet{doc} utils.c cli_short_A
-\snippet{doc} server.c cli_long_config
-\snippet{doc} server.c cli_long_cipher
-\snippet{doc} server.c cli_long_timeout
-\snippet{doc} server.c cli_long_user
-\snippet{doc} server.c cli_long_pid_file
-\snippet{doc} server.c cli_long_nofile
-\snippet{doc} server.c cli_long_udp
-\snippet{doc} server.c cli_long_udp_only
-\snippet{doc} server.c cli_long_ipv6_first
-\snippet{doc} server.c cli_long_verbose
-\snippet{doc} server.c cli_long_listen_address
-\snippet{doc} server.c cli_long_listen_port
-\snippet{doc} server.c cli_long_outbound_address
-\snippet{doc} server.c cli_long_interface
-\snippet{doc} server.c cli_long_nameserver
-\snippet{doc} utils.c cli_long_version
-\snippet{doc} utils.c cli_long_tcp_only
-\snippet{doc} utils.c cli_long_ipv4_first
-\snippet{doc} utils.c cli_long_fast_open
-\snippet{doc} utils.c cli_long_reuse_port
-\snippet{doc} utils.c cli_long_tcp_incoming_sndbuf
-\snippet{doc} utils.c cli_long_tcp_incoming_rcvbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_sndbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_rcvbuf
-\snippet{doc} utils.c cli_long_no_delay
-\snippet{doc} utils.c cli_long_acl
-\snippet{doc} utils.c cli_long_manager_address
-\snippet{doc} utils.c cli_long_mtu
-\snippet{doc} utils.c cli_long_help
-\snippet{doc} utils.c cli_long_plugin
-\snippet{doc} utils.c cli_long_plugin_opts
-\snippet{doc} utils.c cli_long_password
-\snippet{doc} utils.c cli_long_key
-\snippet{doc} utils.c cli_long_mptcp
-\snippet{doc} utils.c cli_long_nftables_sets
+\snippet{doc} utils.cpp cli_short_f
+\snippet{doc} server.cpp cli_short_s
+\snippet{doc} server.cpp cli_short_p
+\snippet{doc} utils.cpp cli_short_k
+\snippet{doc} utils.cpp cli_short_t
+\snippet{doc} utils.cpp cli_short_m
+\snippet{doc} server.cpp cli_short_b
+\snippet{doc} utils.cpp cli_short_c
+\snippet{doc} utils.cpp cli_short_i
+\snippet{doc} utils.cpp cli_short_d
+\snippet{doc} utils.cpp cli_short_a
+\snippet{doc} utils.cpp cli_short_n
+\snippet{doc} utils.cpp cli_short_h
+\snippet{doc} utils.cpp cli_short_u
+\snippet{doc} utils.cpp cli_short_U
+\snippet{doc} utils.cpp cli_short_v
+\snippet{doc} utils.cpp cli_short_6
+\snippet{doc} utils.cpp cli_short_A
+\snippet{doc} server.cpp cli_long_config
+\snippet{doc} server.cpp cli_long_cipher
+\snippet{doc} server.cpp cli_long_timeout
+\snippet{doc} server.cpp cli_long_user
+\snippet{doc} server.cpp cli_long_pid_file
+\snippet{doc} server.cpp cli_long_nofile
+\snippet{doc} server.cpp cli_long_udp
+\snippet{doc} server.cpp cli_long_udp_only
+\snippet{doc} server.cpp cli_long_ipv6_first
+\snippet{doc} server.cpp cli_long_verbose
+\snippet{doc} server.cpp cli_long_listen_address
+\snippet{doc} server.cpp cli_long_listen_port
+\snippet{doc} server.cpp cli_long_outbound_address
+\snippet{doc} server.cpp cli_long_interface
+\snippet{doc} server.cpp cli_long_nameserver
+\snippet{doc} utils.cpp cli_long_version
+\snippet{doc} utils.cpp cli_long_tcp_only
+\snippet{doc} utils.cpp cli_long_ipv4_first
+\snippet{doc} utils.cpp cli_long_fast_open
+\snippet{doc} utils.cpp cli_long_reuse_port
+\snippet{doc} utils.cpp cli_long_tcp_incoming_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_incoming_rcvbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_rcvbuf
+\snippet{doc} utils.cpp cli_long_no_delay
+\snippet{doc} utils.cpp cli_long_acl
+\snippet{doc} utils.cpp cli_long_manager_address
+\snippet{doc} utils.cpp cli_long_mtu
+\snippet{doc} utils.cpp cli_long_help
+\snippet{doc} utils.cpp cli_long_plugin
+\snippet{doc} utils.cpp cli_long_plugin_opts
+\snippet{doc} utils.cpp cli_long_password
+\snippet{doc} utils.cpp cli_long_key
+\snippet{doc} utils.cpp cli_long_mptcp
+\snippet{doc} utils.cpp cli_long_nftables_sets
 [cli-options] */
     static struct option long_options[] = {
         { "config", required_argument, NULL, 'c' },
@@ -2325,7 +2325,7 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
     }
 
     if (server_num == 0) {
-        server_addr[server_num++].host = "0.0.0.0";
+        server_addr[server_num++].host = (char *)"0.0.0.0";
     }
 
     if (server_num == 0 || server_port == NULL
@@ -2335,9 +2335,9 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
     }
 
     if (is_ipv6only(server_addr, server_num, ipv6first)) {
-        plugin_host = "::1";
+        plugin_host = (char *)"::1";
     } else {
-        plugin_host = "127.0.0.1";
+        plugin_host = (char *)"127.0.0.1";
     }
 
     remote_port = server_port;
@@ -2365,11 +2365,11 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
     }
 
     if (method == NULL) {
-        method = "chacha20-ietf-poly1305";
+        method = (char *)"chacha20-ietf-poly1305";
     }
 
     if (timeout == NULL) {
-        timeout = "60";
+        timeout = (char *)"60";
     }
     if (ss_parse_int(timeout, 1, INT_MAX, &timeout_secs) == -1) {
         FATAL("invalid timeout");
@@ -2490,7 +2490,7 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
     if (plugin != NULL) {
         int len          = 0;
         size_t buf_size  = 256 * server_num;
-        char *server_str = ss_malloc(buf_size);
+        char *server_str = (char *)ss_malloc(buf_size);
 
         snprintf(server_str, buf_size, "%s", server_addr[0].host);
         len = strlen(server_str);
@@ -2511,8 +2511,9 @@ Same behavior as `-d`; see that option for details. Short alias: `-d`.
         }
     }
 
-    // initialize listen context
-    listen_ctx_t listen_ctx_list[server_num];
+    // initialize listen context (server_num never exceeds MAX_REMOTE_NUM, the
+    // size of server_addr)
+    listen_ctx_t listen_ctx_list[MAX_REMOTE_NUM];
 
     // bind to each interface
     if (mode != UDP_ONLY) {
diff --git a/src/ss_event.c b/src/ss_event.cpp
similarity index 87%
rename from src/ss_event.c
rename to src/ss_event.cpp
index 5ff2b7bc..2d33c1a5 100644
--- a/src/ss_event.c
+++ b/src/ss_event.cpp
@@ -6,6 +6,7 @@
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 
 struct poll_state {
     uv_poll_t handle;
@@ -60,7 +61,7 @@ const char *ss_backend_name(void)
 struct ss_loop *ss_loop_new(unsigned flags)
 {
     (void)flags;
-    struct ss_loop *loop = allocate(sizeof(*loop));
+    struct ss_loop *loop = (struct ss_loop *)allocate(sizeof(*loop));
     if (uv_loop_init(&loop->native)) { free(loop); return NULL; }
     return loop;
 }
@@ -112,10 +113,13 @@ static void polled(uv_poll_t *handle, int status, int events)
     size_t count = 0;
     for (ss_io *w = state->watchers; w; w = w->next) count++;
     struct pending local[8];
-    struct pending *pending = count > 8 ? allocate(count * sizeof(*pending)) : local;
+    struct pending *pending = count > 8 ? (struct pending *)allocate(count * sizeof(*pending)) : local;
     size_t n = 0;
-    for (ss_io *w = state->watchers; w; w = w->next)
-        pending[n++] = (struct pending){w, w->generation};
+    for (ss_io *w = state->watchers; w; w = w->next) {
+        pending[n].watcher    = w;
+        pending[n].generation = w->generation;
+        n++;
+    }
     /* A callback can stop/free itself or another watcher, or reuse its memory.
      * Revalidate both membership and generation before dereferencing it. */
     for (size_t i = 0; i < count; i++) {
@@ -140,7 +144,10 @@ static void update_poll(struct poll_state *state)
 }
 void ss_io_init(ss_io *w, void (*cb)(struct ss_loop *, ss_io *, int), int fd, int events)
 {
-    *w = (ss_io){.fd = fd, .events = events, .cb = cb};
+    memset(w, 0, sizeof(*w));
+    w->fd     = fd;
+    w->events = events;
+    w->cb     = cb;
 }
 void ss_io_set(ss_io *w, int fd, int events)
 {
@@ -153,7 +160,7 @@ void ss_io_start(struct ss_loop *loop, ss_io *w)
     struct poll_state *state;
     HASH_FIND_INT(loop->polls, &w->fd, state);
     if (!state) {
-        state = allocate(sizeof(*state));
+        state = (struct poll_state *)allocate(sizeof(*state));
         state->fd = w->fd; state->loop = loop;
 #ifdef _WIN32
         checked(uv_poll_init_socket(&loop->native, &state->handle, (SOCKET)(unsigned int)w->fd));
@@ -171,7 +178,7 @@ void ss_io_start(struct ss_loop *loop, ss_io *w)
 }
 void ss_io_stop(struct ss_loop *loop, ss_io *w)
 {
-    struct poll_state *state = w->backend;
+    struct poll_state *state = (struct poll_state *)w->backend;
     if (!state) return;
     assert(state->loop == loop);
     ss_io **item = &state->watchers;
@@ -198,7 +205,10 @@ static void timed(uv_timer_t *handle)
 }
 void ss_timer_init(ss_timer *w, void (*cb)(struct ss_loop *, ss_timer *, int), double after, double repeat)
 {
-    *w = (ss_timer){.after = after, .repeat = repeat, .cb = cb};
+    memset(w, 0, sizeof(*w));
+    w->after  = after;
+    w->repeat = repeat;
+    w->cb     = cb;
 }
 void ss_timer_set(ss_timer *w, double after, double repeat)
 {
@@ -207,7 +217,7 @@ void ss_timer_set(ss_timer *w, double after, double repeat)
 void ss_timer_start(struct ss_loop *loop, ss_timer *w)
 {
     if (w->backend) return;
-    struct timer_state *state = allocate(sizeof(*state));
+    struct timer_state *state = (struct timer_state *)allocate(sizeof(*state));
     state->loop = loop; state->watcher = w;
     checked(uv_timer_init(&loop->native, &state->handle));
     w->backend = state;
@@ -217,7 +227,7 @@ void ss_timer_start(struct ss_loop *loop, ss_timer *w)
 void ss_timer_stop(struct ss_loop *loop, ss_timer *w)
 {
     (void)loop;
-    struct timer_state *state = w->backend;
+    struct timer_state *state = (struct timer_state *)w->backend;
     if (!state) return;
     w->backend = NULL;
     checked(uv_timer_stop(&state->handle));
@@ -240,7 +250,9 @@ static void signaled(uv_signal_t *handle, int signum)
 }
 void ss_signal_init(ss_signal *w, void (*cb)(struct ss_loop *, ss_signal *, int), int signum)
 {
-    *w = (ss_signal){.signum = signum, .cb = cb};
+    memset(w, 0, sizeof(*w));
+    w->signum = signum;
+    w->cb     = cb;
 }
 void ss_signal_start(struct ss_loop *loop, ss_signal *w)
 {
@@ -249,7 +261,7 @@ void ss_signal_start(struct ss_loop *loop, ss_signal *w)
     /* Windows has no SIGTERM delivery; process termination is an OS operation. */
     if (w->signum == SIGTERM) return;
 #endif
-    struct signal_state *state = allocate(sizeof(*state));
+    struct signal_state *state = (struct signal_state *)allocate(sizeof(*state));
     state->loop = loop; state->watcher = w;
     checked(uv_signal_init(&loop->native, &state->handle));
     checked(uv_signal_start(&state->handle, signaled, w->signum));
@@ -258,7 +270,7 @@ void ss_signal_start(struct ss_loop *loop, ss_signal *w)
 void ss_signal_stop(struct ss_loop *loop, ss_signal *w)
 {
     (void)loop;
-    struct signal_state *state = w->backend;
+    struct signal_state *state = (struct signal_state *)w->backend;
     if (!state) return;
     w->backend = NULL;
     checked(uv_signal_stop(&state->handle));
diff --git a/src/tunnel.c b/src/tunnel.cpp
similarity index 93%
rename from src/tunnel.c
rename to src/tunnel.cpp
index 48c01c05..4015a7ee 100644
--- a/src/tunnel.c
+++ b/src/tunnel.cpp
@@ -1,5 +1,5 @@
 /*
- * tunnel.c - Setup a local port forwarding through remote shadowsocks server
+ * tunnel.cpp - Setup a local port forwarding through remote shadowsocks server
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
@@ -645,12 +645,12 @@ remote_send_cb(SS_P_ ss_io *w, int revents)
 static remote_t *
 new_remote(int fd, int timeout)
 {
-    remote_t *remote = ss_malloc(sizeof(remote_t));
+    remote_t *remote = (remote_t *)ss_malloc(sizeof(remote_t));
     memset(remote, 0, sizeof(remote_t));
 
-    remote->recv_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->send_ctx = ss_malloc(sizeof(remote_ctx_t));
-    remote->buf      = ss_malloc(sizeof(buffer_t));
+    remote->recv_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->send_ctx = (struct remote_ctx *)ss_malloc(sizeof(remote_ctx_t));
+    remote->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(remote->buf, SOCKET_BUF_SIZE);
     memset(remote->recv_ctx, 0, sizeof(remote_ctx_t));
     memset(remote->send_ctx, 0, sizeof(remote_ctx_t));
@@ -698,12 +698,12 @@ close_and_free_remote(SS_P_ remote_t *remote)
 static server_t *
 new_server(int fd)
 {
-    server_t *server = ss_malloc(sizeof(server_t));
+    server_t *server = (server_t *)ss_malloc(sizeof(server_t));
     memset(server, 0, sizeof(server_t));
 
-    server->recv_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->send_ctx = ss_malloc(sizeof(server_ctx_t));
-    server->buf      = ss_malloc(sizeof(buffer_t));
+    server->recv_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->send_ctx = (struct server_ctx *)ss_malloc(sizeof(server_ctx_t));
+    server->buf      = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(server->buf, SOCKET_BUF_SIZE);
     memset(server->recv_ctx, 0, sizeof(server_ctx_t));
     memset(server->send_ctx, 0, sizeof(server_ctx_t));
@@ -713,8 +713,8 @@ new_server(int fd)
     server->send_ctx->server    = server;
     server->send_ctx->connected = 0;
 
-    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->e_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = (cipher_ctx_t *)ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
     cipher_ctx_pair(server->e_ctx, server->d_ctx);
@@ -1043,60 +1043,60 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
 [cli_long_vpn] */
 
 /* [cli-options]
-\snippet{doc} utils.c cli_short_f
-\snippet{doc} utils.c cli_short_s
-\snippet{doc} utils.c cli_short_p
-\snippet{doc} utils.c cli_short_l
-\snippet{doc} utils.c cli_short_k
-\snippet{doc} utils.c cli_short_t
-\snippet{doc} utils.c cli_short_m
-\snippet{doc} utils.c cli_short_i
-\snippet{doc} utils.c cli_short_c
-\snippet{doc} utils.c cli_short_b
-\snippet{doc} utils.c cli_short_L
-\snippet{doc} utils.c cli_short_a
-\snippet{doc} utils.c cli_short_n
-\snippet{doc} utils.c cli_short_h
-\snippet{doc} utils.c cli_short_u
-\snippet{doc} utils.c cli_short_U
-\snippet{doc} utils.c cli_short_v
-\snippet{doc} utils.c cli_short_V
-\snippet{doc} utils.c cli_short_6
-\snippet{doc} utils.c cli_short_A
-\snippet{doc} tunnel.c cli_long_config
-\snippet{doc} tunnel.c cli_long_cipher
-\snippet{doc} tunnel.c cli_long_timeout
-\snippet{doc} tunnel.c cli_long_user
-\snippet{doc} tunnel.c cli_long_pid_file
-\snippet{doc} tunnel.c cli_long_nofile
-\snippet{doc} tunnel.c cli_long_udp
-\snippet{doc} tunnel.c cli_long_udp_only
-\snippet{doc} tunnel.c cli_long_ipv6_first
-\snippet{doc} tunnel.c cli_long_verbose
-\snippet{doc} tunnel.c cli_long_server
-\snippet{doc} tunnel.c cli_long_server_port
-\snippet{doc} tunnel.c cli_long_listen_address
-\snippet{doc} tunnel.c cli_long_listen_port
-\snippet{doc} tunnel.c cli_long_interface
-\snippet{doc} tunnel.c cli_long_destination
-\snippet{doc} utils.c cli_long_version
-\snippet{doc} utils.c cli_long_tcp_only
-\snippet{doc} utils.c cli_long_ipv4_first
-\snippet{doc} tunnel.c cli_long_vpn
-\snippet{doc} utils.c cli_long_fast_open
-\snippet{doc} utils.c cli_long_mtu
-\snippet{doc} utils.c cli_long_no_delay
-\snippet{doc} utils.c cli_long_mptcp
-\snippet{doc} utils.c cli_long_plugin
-\snippet{doc} utils.c cli_long_plugin_opts
-\snippet{doc} utils.c cli_long_reuse_port
-\snippet{doc} utils.c cli_long_tcp_incoming_sndbuf
-\snippet{doc} utils.c cli_long_tcp_incoming_rcvbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_sndbuf
-\snippet{doc} utils.c cli_long_tcp_outgoing_rcvbuf
-\snippet{doc} utils.c cli_long_password
-\snippet{doc} utils.c cli_long_key
-\snippet{doc} utils.c cli_long_help
+\snippet{doc} utils.cpp cli_short_f
+\snippet{doc} utils.cpp cli_short_s
+\snippet{doc} utils.cpp cli_short_p
+\snippet{doc} utils.cpp cli_short_l
+\snippet{doc} utils.cpp cli_short_k
+\snippet{doc} utils.cpp cli_short_t
+\snippet{doc} utils.cpp cli_short_m
+\snippet{doc} utils.cpp cli_short_i
+\snippet{doc} utils.cpp cli_short_c
+\snippet{doc} utils.cpp cli_short_b
+\snippet{doc} utils.cpp cli_short_L
+\snippet{doc} utils.cpp cli_short_a
+\snippet{doc} utils.cpp cli_short_n
+\snippet{doc} utils.cpp cli_short_h
+\snippet{doc} utils.cpp cli_short_u
+\snippet{doc} utils.cpp cli_short_U
+\snippet{doc} utils.cpp cli_short_v
+\snippet{doc} utils.cpp cli_short_V
+\snippet{doc} utils.cpp cli_short_6
+\snippet{doc} utils.cpp cli_short_A
+\snippet{doc} tunnel.cpp cli_long_config
+\snippet{doc} tunnel.cpp cli_long_cipher
+\snippet{doc} tunnel.cpp cli_long_timeout
+\snippet{doc} tunnel.cpp cli_long_user
+\snippet{doc} tunnel.cpp cli_long_pid_file
+\snippet{doc} tunnel.cpp cli_long_nofile
+\snippet{doc} tunnel.cpp cli_long_udp
+\snippet{doc} tunnel.cpp cli_long_udp_only
+\snippet{doc} tunnel.cpp cli_long_ipv6_first
+\snippet{doc} tunnel.cpp cli_long_verbose
+\snippet{doc} tunnel.cpp cli_long_server
+\snippet{doc} tunnel.cpp cli_long_server_port
+\snippet{doc} tunnel.cpp cli_long_listen_address
+\snippet{doc} tunnel.cpp cli_long_listen_port
+\snippet{doc} tunnel.cpp cli_long_interface
+\snippet{doc} tunnel.cpp cli_long_destination
+\snippet{doc} utils.cpp cli_long_version
+\snippet{doc} utils.cpp cli_long_tcp_only
+\snippet{doc} utils.cpp cli_long_ipv4_first
+\snippet{doc} tunnel.cpp cli_long_vpn
+\snippet{doc} utils.cpp cli_long_fast_open
+\snippet{doc} utils.cpp cli_long_mtu
+\snippet{doc} utils.cpp cli_long_no_delay
+\snippet{doc} utils.cpp cli_long_mptcp
+\snippet{doc} utils.cpp cli_long_plugin
+\snippet{doc} utils.cpp cli_long_plugin_opts
+\snippet{doc} utils.cpp cli_long_reuse_port
+\snippet{doc} utils.cpp cli_long_tcp_incoming_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_incoming_rcvbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_sndbuf
+\snippet{doc} utils.cpp cli_long_tcp_outgoing_rcvbuf
+\snippet{doc} utils.cpp cli_long_password
+\snippet{doc} utils.cpp cli_long_key
+\snippet{doc} utils.cpp cli_long_help
 [cli-options] */
     static struct option long_options[] = {
         { "config", required_argument, NULL, 'c' },
@@ -1461,9 +1461,9 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
         }
         snprintf(tmp_port, 8, "%d", port);
         if (is_ipv6only(remote_addr, remote_num, ipv6first)) {
-            plugin_host = "::1";
+            plugin_host = (char *)"::1";
         } else {
-            plugin_host = "127.0.0.1";
+            plugin_host = (char *)"127.0.0.1";
         }
         plugin_port = tmp_port;
 
@@ -1479,11 +1479,11 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
     }
 
     if (method == NULL) {
-        method = "chacha20-ietf-poly1305";
+        method = (char *)"chacha20-ietf-poly1305";
     }
 
     if (timeout == NULL) {
-        timeout = "60";
+        timeout = (char *)"60";
     }
     if (ss_parse_int(timeout, 1, INT_MAX, &timeout_secs) == -1) {
         FATAL("invalid timeout");
@@ -1504,9 +1504,9 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
 
     if (local_addr == NULL) {
         if (is_ipv6only(remote_addr, remote_num, ipv6first)) {
-            local_addr = "::1";
+            local_addr = (char *)"::1";
         } else {
-            local_addr = "127.0.0.1";
+            local_addr = (char *)"127.0.0.1";
         }
     }
 
@@ -1575,7 +1575,7 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
     if (plugin != NULL) {
         int len          = 0;
         size_t buf_size  = 256 * remote_num;
-        char *remote_str = ss_malloc(buf_size);
+        char *remote_str = (char *)ss_malloc(buf_size);
 
         snprintf(remote_str, buf_size, "%s", remote_addr[0].host);
         len = strlen(remote_str);
@@ -1621,7 +1621,7 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
     memset(&listen_ctx, 0, sizeof(struct listen_ctx));
     listen_ctx.tunnel_addr = tunnel_addr;
     listen_ctx.remote_num  = remote_num;
-    listen_ctx.remote_addr = ss_malloc(sizeof(struct sockaddr *) * remote_num);
+    listen_ctx.remote_addr = (struct sockaddr **)ss_malloc(sizeof(struct sockaddr *) * remote_num);
     memset(listen_ctx.remote_addr, 0, sizeof(struct sockaddr *) * remote_num);
     for (i = 0; i < remote_num; i++) {
         char *host = remote_addr[i].host;
@@ -1630,7 +1630,7 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
             host = plugin_host;
             port = plugin_port;
         }
-        struct sockaddr_storage *storage = ss_malloc(sizeof(struct sockaddr_storage));
+        struct sockaddr_storage *storage = (struct sockaddr_storage *)ss_malloc(sizeof(struct sockaddr_storage));
         memset(storage, 0, sizeof(struct sockaddr_storage));
         if (get_sockaddr(host, port, storage, 1, ipv6first) == -1) {
             FATAL("failed to resolve the provided hostname");
@@ -1671,7 +1671,7 @@ Same behavior as `-V`; see that option for details. Short alias: `-V`.
         LOGI("UDP relay enabled");
         char *host                       = remote_addr[0].host;
         char *port                       = remote_addr[0].port == NULL ? remote_port : remote_addr[0].port;
-        struct sockaddr_storage *storage = ss_malloc(sizeof(struct sockaddr_storage));
+        struct sockaddr_storage *storage = (struct sockaddr_storage *)ss_malloc(sizeof(struct sockaddr_storage));
         memset(storage, 0, sizeof(struct sockaddr_storage));
         if (get_sockaddr(host, port, storage, 1, ipv6first) == -1) {
             FATAL("failed to resolve the provided hostname");
diff --git a/src/udprelay.c b/src/udprelay.cpp
similarity index 93%
rename from src/udprelay.c
rename to src/udprelay.cpp
index 62417391..f4b0b90b 100644
--- a/src/udprelay.c
+++ b/src/udprelay.cpp
@@ -1,5 +1,5 @@
 /*
- * udprelay.c - Setup UDP relay for both client and server
+ * udprelay.cpp - Setup UDP relay for both client and server
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
@@ -580,7 +580,7 @@ create_server_socket(const char *host, const char *port)
 remote_ctx_t *
 new_remote(int fd, server_ctx_t *server_ctx)
 {
-    remote_ctx_t *ctx = ss_malloc(sizeof(remote_ctx_t));
+    remote_ctx_t *ctx = (remote_ctx_t *)ss_malloc(sizeof(remote_ctx_t));
     memset(ctx, 0, sizeof(remote_ctx_t));
 
     ctx->fd         = fd;
@@ -597,7 +597,7 @@ new_remote(int fd, server_ctx_t *server_ctx)
 server_ctx_t *
 new_server_ctx(int fd)
 {
-    server_ctx_t *ctx = ss_malloc(sizeof(server_ctx_t));
+    server_ctx_t *ctx = (server_ctx_t *)ss_malloc(sizeof(server_ctx_t));
     memset(ctx, 0, sizeof(server_ctx_t));
 
     ctx->fd = fd;
@@ -611,9 +611,9 @@ new_server_ctx(int fd)
 struct query_ctx *
 new_query_ctx(char *buf, size_t len)
 {
-    struct query_ctx *ctx = ss_malloc(sizeof(struct query_ctx));
+    struct query_ctx *ctx = (struct query_ctx *)ss_malloc(sizeof(struct query_ctx));
     memset(ctx, 0, sizeof(struct query_ctx));
-    ctx->buf = ss_malloc(sizeof(buffer_t));
+    ctx->buf = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(ctx->buf, len);
     memcpy(ctx->buf->data, buf, len);
     ctx->buf->len = len;
@@ -809,7 +809,7 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
     socklen_t src_addr_len = sizeof(struct sockaddr_storage);
     memset(&src_addr, 0, src_addr_len);
 
-    buffer_t *buf = ss_malloc(sizeof(buffer_t));
+    buffer_t *buf = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(buf, buf_size);
 
     // recv
@@ -829,7 +829,8 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
     buf->len = r;
 
 #ifdef MODULE_LOCAL
-    int err = server_ctx->crypto->decrypt_udp != NULL
+    int err;
+    err = server_ctx->crypto->decrypt_udp != NULL
               ? server_ctx->crypto->decrypt_udp(buf, server_ctx->crypto->cipher,
                                                 buf_size, &remote_ctx->udp_session)
               : server_ctx->crypto->decrypt_all(buf, server_ctx->crypto->cipher, buf_size);
@@ -843,14 +844,16 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
 #ifdef MODULE_REDIR
     struct sockaddr_storage dst_addr;
     memset(&dst_addr, 0, sizeof(struct sockaddr_storage));
-    int len = parse_udprelay_header(buf->data, buf->len, NULL, NULL, &dst_addr);
+    int len;
+    len = parse_udprelay_header(buf->data, buf->len, NULL, NULL, &dst_addr);
 
     if (dst_addr.ss_family != AF_INET && dst_addr.ss_family != AF_INET6) {
         LOGI("[udp] ss-redir does not support domain name");
         goto CLEAN_UP;
     }
 #else
-    int len = parse_udprelay_header(buf->data, buf->len, NULL, NULL, NULL);
+    int len;
+    len = parse_udprelay_header(buf->data, buf->len, NULL, NULL, NULL);
 #endif
 
     if (len == 0) {
@@ -883,7 +886,8 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
 
     // Reconstruct UDP response header
     char addr_header[MAX_ADDR_HEADER_SIZE];
-    int addr_header_len = construct_udprelay_header(&src_addr, addr_header);
+    int addr_header_len;
+    addr_header_len = construct_udprelay_header(&src_addr, addr_header);
 
     // Construct packet
     brealloc(buf, buf->len + addr_header_len, buf_size);
@@ -891,7 +895,8 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
     memcpy(buf->data, addr_header, addr_header_len);
     buf->len += addr_header_len;
 
-    int err = server_ctx->crypto->encrypt_udp != NULL
+    int err;
+    err = server_ctx->crypto->encrypt_udp != NULL
               ? server_ctx->crypto->encrypt_udp(buf, server_ctx->crypto->cipher,
                                                 buf_size, &remote_ctx->udp_session)
               : server_ctx->crypto->encrypt_all(buf, server_ctx->crypto->cipher, buf_size);
@@ -912,14 +917,17 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
 #ifdef MODULE_REDIR
     convert_ipv4_mapped_ipv6(&dst_addr);
 
-    size_t remote_dst_addr_len = get_sockaddr_len((struct sockaddr *)&dst_addr);
+    size_t remote_dst_addr_len;
+    remote_dst_addr_len = get_sockaddr_len((struct sockaddr *)&dst_addr);
 
-    int src_fd = ss_socket(AF_INET6, SOCK_DGRAM, 0);
+    int src_fd;
+    src_fd = ss_socket(AF_INET6, SOCK_DGRAM, 0);
     if (src_fd < 0) {
         ERROR("[udp] remote_recv_socket");
         goto CLEAN_UP;
     }
-    int opt = 1;
+    int opt;
+    opt = 1;
     if (ss_setsockopt(src_fd, SOL_IPV6, IPV6_TRANSPARENT, &opt, sizeof(opt))) {
         ERROR("[udp] remote_recv_setsockopt");
         ss_socket_close(src_fd);
@@ -937,8 +945,10 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
     }
 #ifdef IP_TOS
     // Set QoS flag
-    int tos = 46 << 2;
-    int rc = ss_setsockopt(src_fd, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
+    int tos;
+    tos = 46 << 2;
+    int rc;
+    rc = ss_setsockopt(src_fd, IPPROTO_IP, IP_TOS, &tos, sizeof(tos));
     if (rc < 0 && ss_socket_error() != ENOPROTOOPT) {
         LOGE("setting ipv4 dscp failed: %d", ss_socket_error());
     }
@@ -959,9 +969,11 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
     memcpy(&mapped_src_addr, &remote_ctx->src_addr, sizeof(remote_ctx->src_addr));
     convert_ipv4_mapped_ipv6(&mapped_src_addr);
 
-    size_t remote_src_addr_len = get_sockaddr_len((struct sockaddr *)&mapped_src_addr);
+    size_t remote_src_addr_len;
+    remote_src_addr_len = get_sockaddr_len((struct sockaddr *)&mapped_src_addr);
 
-    int s = sendto(src_fd, buf->data, buf->len, 0,
+    int s;
+    s = sendto(src_fd, buf->data, buf->len, 0,
                    (struct sockaddr *)&mapped_src_addr, remote_src_addr_len);
     if (s == -1 && !(ss_socket_error() == EAGAIN || ss_socket_error() == EWOULDBLOCK)) {
         ERROR("[udp] remote_recv_sendto");
@@ -971,9 +983,11 @@ remote_recv_cb(SS_P_ ss_io *w, int revents)
     ss_socket_close(src_fd);
 
 #else
-    size_t remote_src_addr_len = get_sockaddr_len((struct sockaddr *)&remote_ctx->src_addr);
+    size_t remote_src_addr_len;
+    remote_src_addr_len = get_sockaddr_len((struct sockaddr *)&remote_ctx->src_addr);
 
-    int s = sendto(server_ctx->fd, buf->data, buf->len, 0,
+    int s;
+    s = sendto(server_ctx->fd, buf->data, buf->len, 0,
                    (struct sockaddr *)&remote_ctx->src_addr, remote_src_addr_len);
     if (s == -1 && !(ss_socket_error() == EAGAIN || ss_socket_error() == EWOULDBLOCK)) {
         ERROR("[udp] remote_recv_sendto");
@@ -999,7 +1013,7 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
     struct sockaddr_storage src_addr;
     memset(&src_addr, 0, sizeof(struct sockaddr_storage));
 
-    buffer_t *buf = ss_malloc(sizeof(buffer_t));
+    buffer_t *buf = (buffer_t *)ss_malloc(sizeof(buffer_t));
     balloc(buf, buf_size);
 
     socklen_t src_addr_len = sizeof(struct sockaddr_storage);
@@ -1069,8 +1083,10 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
      * decryption, so the crypto layer resolves the session itself and hands
      * it back here to be attached to the relay context.
      */
-    void *udp_session = NULL;
-    int err = server_ctx->crypto->decrypt_udp != NULL
+    void *udp_session;
+    udp_session = NULL;
+    int err;
+    err = server_ctx->crypto->decrypt_udp != NULL
               ? server_ctx->crypto->decrypt_udp(buf, server_ctx->crypto->cipher,
                                                 buf_size, &udp_session)
               : server_ctx->crypto->decrypt_all(buf, server_ctx->crypto->cipher, buf_size);
@@ -1091,7 +1107,8 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
         LOGE("[udp] invalid SOCKS5 UDP header");
         goto CLEAN_UP;
     }
-    uint8_t frag = *(uint8_t *)(buf->data + 2);
+    uint8_t frag;
+    frag = *(uint8_t *)(buf->data + 2);
     offset += 3;
 #endif
 #endif
@@ -1136,8 +1153,10 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
      */
 
 #ifdef MODULE_REDIR
-    char addr_header[MAX_ADDR_HEADER_SIZE] = { 0 };
-    int addr_header_len                    = construct_udprelay_header(&dst_addr, addr_header);
+    char addr_header[MAX_ADDR_HEADER_SIZE];
+    memset(addr_header, 0, sizeof(addr_header));
+    int addr_header_len;
+    addr_header_len = construct_udprelay_header(&dst_addr, addr_header);
 
     if (addr_header_len == 0) {
         LOGE("[udp] failed to parse tproxy addr");
@@ -1152,16 +1171,22 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
 
 #elif MODULE_TUNNEL
 
-    char addr_header[MAX_ADDR_HEADER_SIZE] = { 0 };
-    char *host                             = server_ctx->tunnel_addr.host;
-    char *port                             = server_ctx->tunnel_addr.port;
-    uint16_t port_num                      = 0;
+    char addr_header[MAX_ADDR_HEADER_SIZE];
+    memset(addr_header, 0, sizeof(addr_header));
+    char *host;
+    host = server_ctx->tunnel_addr.host;
+    char *port;
+    port = server_ctx->tunnel_addr.port;
+    uint16_t port_num;
+    port_num = 0;
     if (ss_parse_uint16_port(port, &port_num) == -1) {
         LOGE("[udp] invalid tunnel port");
         goto CLEAN_UP;
     }
-    uint16_t port_net_num                  = htons(port_num);
-    int addr_header_len                    = 0;
+    uint16_t port_net_num;
+    port_net_num = htons(port_num);
+    int addr_header_len;
+    addr_header_len = 0;
 
     struct ss_ip ip;
     if (ss_ip_init(&ip, host) != -1) {
@@ -1217,12 +1242,15 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
 
 #else
 
-    char host[MAX_HOSTNAME_LEN] = { 0 };
-    char port[MAX_PORT_STR_LEN] = { 0 };
+    char host[MAX_HOSTNAME_LEN];
+    char port[MAX_PORT_STR_LEN];
+    memset(host, 0, sizeof(host));
+    memset(port, 0, sizeof(port));
     struct sockaddr_storage dst_addr;
     memset(&dst_addr, 0, sizeof(struct sockaddr_storage));
 
-    int addr_header_len = parse_udprelay_header(buf->data + offset, buf->len - offset,
+    int addr_header_len;
+    addr_header_len = parse_udprelay_header(buf->data + offset, buf->len - offset,
                                                 host, port, &dst_addr);
     if (addr_header_len == 0) {
         // error in parse header
@@ -1231,15 +1259,18 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
 
 #endif
 
+    char *key;
 #ifdef MODULE_LOCAL
-    char *key = hash_key(server_ctx->remote_addr->sa_family, &src_addr);
+    key = hash_key(server_ctx->remote_addr->sa_family, &src_addr);
 #else
-    char *key = hash_key(dst_addr.ss_family, &src_addr);
+    key = hash_key(dst_addr.ss_family, &src_addr);
 #endif
 
-    struct cache *conn_cache = server_ctx->conn_cache;
+    struct cache *conn_cache;
+    conn_cache = server_ctx->conn_cache;
 
-    remote_ctx_t *remote_ctx = NULL;
+    remote_ctx_t *remote_ctx;
+    remote_ctx = NULL;
     cache_lookup(conn_cache, key, HASH_KEY_LEN, (void *)&remote_ctx);
 
     if (remote_ctx != NULL) {
@@ -1290,8 +1321,10 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
     }
 #endif
 
-    const struct sockaddr *remote_addr = server_ctx->remote_addr;
-    const int remote_addr_len          = server_ctx->remote_addr_len;
+    const struct sockaddr *remote_addr;
+    int remote_addr_len;
+    remote_addr     = server_ctx->remote_addr;
+    remote_addr_len = server_ctx->remote_addr_len;
 
     if (remote_ctx == NULL) {
         // Bind to any port
@@ -1354,7 +1387,8 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
         memmove(buf->data, buf->data + offset, buf->len);
     }
 
-    int err = server_ctx->crypto->encrypt_udp != NULL
+    int err;
+    err = server_ctx->crypto->encrypt_udp != NULL
               ? server_ctx->crypto->encrypt_udp(buf, server_ctx->crypto->cipher,
                                                 buf_size, &remote_ctx->udp_session)
               : server_ctx->crypto->encrypt_all(buf, server_ctx->crypto->cipher, buf_size);
@@ -1370,7 +1404,8 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
         }
     }
 
-    int s = sendto(remote_ctx->fd, buf->data, buf->len, 0, remote_addr, remote_addr_len);
+    int s;
+    s = sendto(remote_ctx->fd, buf->data, buf->len, 0, remote_addr, remote_addr_len);
 
     if (s == -1) {
         ERROR("[udp] server_recv_sendto");
@@ -1378,10 +1413,13 @@ server_recv_cb(SS_P_ ss_io *w, int revents)
 
 #else
 
-    int cache_hit  = 0;
-    int need_query = 0;
+    int cache_hit;
+    cache_hit = 0;
+    int need_query;
+    need_query = 0;
 
-    char *addr_header = buf->data + offset;
+    char *addr_header;
+    addr_header = buf->data + offset;
 
     if (buf->len - addr_header_len > packet_size) {
         if (verbose) {
diff --git a/src/utils.c b/src/utils.cpp
similarity index 99%
rename from src/utils.c
rename to src/utils.cpp
index b6f95f9c..24052734 100644
--- a/src/utils.c
+++ b/src/utils.cpp
@@ -1,5 +1,5 @@
 /*
- * utils.c - Misc utilities
+ * utils.cpp - Misc utilities
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
@@ -860,7 +860,7 @@ get_default_conf(void)
     // If not, fall back to the system-wide config.
     return sysconf;
 #else
-    return "config.json";
+    return (char *)"config.json";
 #endif
 }
 
diff --git a/src/utils.h b/src/utils.h
index a582a6de..1ffe1801 100644
--- a/src/utils.h
+++ b/src/utils.h
@@ -207,7 +207,7 @@ extern int use_syslog;
 #endif
 #define ERROR(s) ss_error(s)
 
-// Implemented in winsock.c
+// Implemented in winsock.cpp
 void ss_error(const char *s);
 void ss_color_info(void);
 void ss_color_error(void);
diff --git a/src/winsock.c b/src/winsock.cpp
similarity index 99%
rename from src/winsock.c
rename to src/winsock.cpp
index ef6e7cb5..c0997030 100644
--- a/src/winsock.c
+++ b/src/winsock.cpp
@@ -1,5 +1,5 @@
 /*
- * winsock.c - Windows socket compatibility layer
+ * winsock.cpp - Windows socket compatibility layer
  *
  * Copyright (C) 2013 - 2019, Max Lv <max.c.lv@gmail.com>
  *
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 7b0befa8..d6aeb456 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -20,8 +20,8 @@ endif()
 
 # Helper function to add a unit test
 function(ss_add_test name sources libs)
-    if(WIN32 AND "${sources}" MATCHES "utils.c")
-        list(APPEND sources ${PROJECT_SOURCE_DIR}/src/winsock.c)
+    if(WIN32 AND "${sources}" MATCHES "utils.cpp")
+        list(APPEND sources ${PROJECT_SOURCE_DIR}/src/winsock.cpp)
     endif()
     add_executable(${name} ${sources})
     target_compile_definitions(${name} PRIVATE -DHAVE_CONFIG_H)
@@ -95,9 +95,9 @@ ss_add_test(test_base64
     "test_base64.c;${PROJECT_SOURCE_DIR}/src/base64.cpp"
     "")
 
-# test_utils - needs sodium (for ss_malloc -> uses sodium in utils.c)
+# test_utils - needs sodium (for ss_malloc -> uses sodium in utils.cpp)
 ss_add_test(test_utils
-    "test_utils.c;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_utils.c;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_sodium")
 
 # test_json - standalone json parser
@@ -107,7 +107,7 @@ ss_add_test(test_json
 
 # test_ssurl - ss:// URI parsing (SIP002 and legacy)
 ss_add_test(test_ssurl
-    "test_ssurl.c;${PROJECT_SOURCE_DIR}/src/ssurl.cpp;${PROJECT_SOURCE_DIR}/src/base64.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_ssurl.c;${PROJECT_SOURCE_DIR}/src/ssurl.cpp;${PROJECT_SOURCE_DIR}/src/base64.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_sodium")
 
 # test_netutils - address parsing and resolver integration
@@ -117,19 +117,19 @@ set(TEST_NETUTILS_LIBS
     ss_cares
 )
 ss_add_test(test_netutils
-    "test_netutils.c;${PROJECT_SOURCE_DIR}/src/netutils.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_netutils.c;${PROJECT_SOURCE_DIR}/src/netutils.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "${TEST_NETUTILS_LIBS}")
 
 # test_cache - expiration uses a platform monotonic clock
 ss_add_test(test_cache
-    "test_cache.c;${PROJECT_SOURCE_DIR}/src/cache.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_cache.c;${PROJECT_SOURCE_DIR}/src/cache.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_sodium")
 
 # test_ppbloom - needs bloom
 set(TEST_PPBLOOM_LIBS "")
 list(APPEND TEST_PPBLOOM_LIBS bloom)
 ss_add_test(test_ppbloom
-    "test_ppbloom.c;${PROJECT_SOURCE_DIR}/src/ppbloom.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_ppbloom.c;${PROJECT_SOURCE_DIR}/src/ppbloom.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "${TEST_PPBLOOM_LIBS};ss_sodium;${SS_MATH_LIBRARY}")
 
 if(SS_ENABLE_REGEX)
@@ -139,13 +139,13 @@ set(TEST_RULE_LIBS
     ss_sodium
 )
 ss_add_test(test_rule
-    "test_rule.c;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_rule.c;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "${TEST_RULE_LIBS}")
 
 # test_acl - ACL precedence and prefix matching
 set(TEST_ACL_LIBS ${TEST_RULE_LIBS})
 ss_add_test(test_acl
-    "test_acl.c;${PROJECT_SOURCE_DIR}/src/acl.cpp;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_acl.c;${PROJECT_SOURCE_DIR}/src/acl.cpp;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "${TEST_ACL_LIBS}")
 
 endif()
@@ -157,7 +157,7 @@ set(TEST_JCONF_LIBS
     ss_cares
 )
 ss_add_test(test_jconf
-    "test_jconf.c;${PROJECT_SOURCE_DIR}/src/jconf.cpp;${PROJECT_SOURCE_DIR}/src/json.cpp;${PROJECT_SOURCE_DIR}/src/utils.c;${PROJECT_SOURCE_DIR}/src/netutils.cpp"
+    "test_jconf.c;${PROJECT_SOURCE_DIR}/src/jconf.cpp;${PROJECT_SOURCE_DIR}/src/json.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp;${PROJECT_SOURCE_DIR}/src/netutils.cpp"
     "${TEST_JCONF_LIBS};${SS_MATH_LIBRARY}")
 
 # Crypto sources shared by the tests that link the crypto layer. The AEAD-2022
@@ -171,7 +171,7 @@ set(SS_CRYPTO_TEST_SOURCES
     ${PROJECT_SOURCE_DIR}/src/ppbloom.cpp
     ${PROJECT_SOURCE_DIR}/src/cache.cpp
     ${PROJECT_SOURCE_DIR}/src/base64.cpp
-    ${PROJECT_SOURCE_DIR}/src/utils.c
+    ${PROJECT_SOURCE_DIR}/src/utils.cpp
 )
 
 if(SS_ENABLE_LEGACY)
@@ -220,16 +220,16 @@ add_test(NAME test_ss_setup
 set_tests_properties(test_ss_setup PROPERTIES LABELS "integration")
 
 ss_add_test(test_ipset
-    "test_ipset.c;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_ipset.c;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_sodium")
 
 ss_add_test(test_process
-    "test_process.c;${PROJECT_SOURCE_DIR}/src/process.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_process.c;${PROJECT_SOURCE_DIR}/src/process.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_sodium")
 set_tests_properties(test_process PROPERTIES TIMEOUT 20)
 
 ss_add_test(test_resolv
-    "test_resolv.c;${PROJECT_SOURCE_DIR}/src/resolv.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_resolv.c;${PROJECT_SOURCE_DIR}/src/resolv.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_ev;ss_cares;ss_sodium")
 set_tests_properties(test_resolv PROPERTIES TIMEOUT 20)
 
@@ -238,13 +238,13 @@ if(SS_ENABLE_REGEX)
     list(APPEND TEST_LITERAL_LIBS ss_pcre2)
 endif()
 ss_add_test(test_acl_literal
-    "test_acl_literal.c;${PROJECT_SOURCE_DIR}/src/acl.cpp;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_acl_literal.c;${PROJECT_SOURCE_DIR}/src/acl.cpp;${PROJECT_SOURCE_DIR}/src/ipset.cpp;${PROJECT_SOURCE_DIR}/src/rule.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "${TEST_LITERAL_LIBS}")
 
 ss_add_test(test_event "test_event.c" "ss_ev")
 set_tests_properties(test_event PROPERTIES TIMEOUT 30)
 ss_add_test(test_resolv_async
-    "test_resolv_async.c;${PROJECT_SOURCE_DIR}/src/resolv.cpp;${PROJECT_SOURCE_DIR}/src/utils.c"
+    "test_resolv_async.c;${PROJECT_SOURCE_DIR}/src/resolv.cpp;${PROJECT_SOURCE_DIR}/src/utils.cpp"
     "ss_ev;ss_cares;ss_sodium")
 set_tests_properties(test_resolv_async PROPERTIES TIMEOUT 30)
 
diff --git a/tests/test_cli_docs.py b/tests/test_cli_docs.py
index 8b0032c3..eab32687 100644
--- a/tests/test_cli_docs.py
+++ b/tests/test_cli_docs.py
@@ -19,7 +19,7 @@ class CliDocsTests(unittest.TestCase):
         self.root = Path(self.temp.name)
         (self.root / 'src').mkdir()
         (self.root / 'doc').mkdir()
-        for name in ('local.c', 'server.c', 'tunnel.c', 'redir.c', 'manager.c', 'utils.c', 'ss-nat'):
+        for name in ('local.cpp', 'server.cpp', 'tunnel.cpp', 'redir.cpp', 'manager.cpp', 'utils.cpp', 'ss-nat'):
             shutil.copyfile(ROOT / 'src' / name, self.root / 'src' / name)
         for path in (ROOT / 'doc').glob('*.md'):
             shutil.copyfile(path, self.root / 'doc' / path.name)
@@ -33,32 +33,32 @@ class CliDocsTests(unittest.TestCase):
     def test_current_documentation_matches_all_variants(self):
         DOCS.check(self.root)
         sources = {p.name: p.read_text(encoding='utf-8') for p in (self.root / 'src').iterdir()}
-        local = DOCS.documented_options('local.c', sources)
+        local = DOCS.documented_options('local.cpp', sources)
         self.assertIn('-S', local)
         self.assertIn('-V', local)
-        self.assertIn('--nftables-sets', DOCS.documented_options('server.c', sources))
+        self.assertIn('--nftables-sets', DOCS.documented_options('server.cpp', sources))
         self.assertIn('-I', DOCS.documented_options('ss-nat', sources))
-        self.assertNotIn('-p', DOCS.documented_options('manager.c', sources))
+        self.assertNotIn('-p', DOCS.documented_options('manager.cpp', sources))
 
     def test_new_option_requires_documentation(self):
-        self.change('src/local.c', '"reuse-port",', '"new-option",')
+        self.change('src/local.cpp', '"reuse-port",', '"new-option",')
         with self.assertRaisesRegex(ValueError, 'missing documentation.*new-option'):
             DOCS.check(self.root)
 
     def test_argument_arity_is_checked(self):
-        self.change('src/local.c', '"reuse-port",  no_argument',
+        self.change('src/local.cpp', '"reuse-port",  no_argument',
                     '"reuse-port",  required_argument')
         with self.assertRaisesRegex(ValueError, 'argument mismatch.*reuse-port'):
             DOCS.check(self.root)
 
     def test_unknown_parser_syntax_fails_closed(self):
-        self.change('src/local.c', '"reuse-port",  no_argument',
+        self.change('src/local.cpp', '"reuse-port",  no_argument',
                     '"reuse-port",  optional_argument')
         with self.assertRaisesRegex(ValueError, 'Unsupported long_options'):
             DOCS.check(self.root)
 
     def test_nonliteral_short_options_fail_closed(self):
-        self.change('src/local.c', '":f:s:p:l:k:t:m:i:c:b:a:n:huUv6A"', 'SHORT_OPTIONS')
+        self.change('src/local.cpp', '":f:s:p:l:k:t:m:i:c:b:a:n:huUv6A"', 'SHORT_OPTIONS')
         with self.assertRaisesRegex(ValueError, 'literal getopt_long'):
             DOCS.check(self.root)
 
@@ -68,17 +68,17 @@ class CliDocsTests(unittest.TestCase):
             DOCS.check(self.root)
 
     def test_missing_snippet_is_rejected(self):
-        self.change('src/local.c', 'utils.c cli_long_reuse_port', 'utils.c missing_snippet')
+        self.change('src/local.cpp', 'utils.cpp cli_long_reuse_port', 'utils.cpp missing_snippet')
         with self.assertRaisesRegex(ValueError, 'Missing snippet'):
             DOCS.check(self.root)
 
     def test_duplicate_option_is_rejected(self):
-        self.change('src/local.c', 'utils.c cli_long_reuse_port', 'utils.c cli_short_f')
+        self.change('src/local.cpp', 'utils.cpp cli_long_reuse_port', 'utils.cpp cli_short_f')
         with self.assertRaisesRegex(ValueError, 'Duplicate documented option'):
             DOCS.check(self.root)
 
     def test_manual_must_include_parser_options(self):
-        self.change('doc/ss-local.md', 'local.c cli-options', 'local.c missing-options')
+        self.change('doc/ss-local.md', 'local.cpp cli-options', 'local.cpp missing-options')
         with self.assertRaisesRegex(ValueError, 'manual must include'):
             DOCS.check(self.root)