Split the Test step into separate "Unit tests" (ctest) and "Stress test"
(stress_test.py with 10MB transfer across all AEAD ciphers) steps for
better visibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Both test_buffer and test_crypto link libbloom.so which uses log() from
libm. Also fix unused variable warnings in test_json.c that would fail
with -Werror.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- test_ppbloom.c: add missing #include <stdint.h> for uint8_t
- test_json: link against libm for pow() used in json.c
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- macOS: brew's mbedtls is now v4 (incompatible), use mbedtls@3
- Disable static build since CI runners lack static lib packages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace Docker-based CI with direct cmake build on ubuntu-latest and
macos-latest. Install dependencies via apt/brew, build with cmake,
run unit tests with ctest.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Alpine's mbedtls-dev only provides shared libraries. Disable static
build since Docker only needs shared binaries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The tests/ directory is excluded by .dockerignore, so pass
-DBUILD_TESTING=OFF to cmake. Submodules are already checked out
by actions/checkout, no need for git inside the container.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The alpine Dockerfile still used autotools (autogen.sh/configure) which
were removed. Switch to cmake build and replace pcre-dev with pcre2-dev.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace legacy PCRE (libpcre3) with PCRE2 (libpcre2-8). PCRE1 has been
end-of-life since 2021.
- src/rule.h: use pcre2_code and pcre2_match_data types
- src/rule.c: pcre_compile -> pcre2_compile, pcre_exec -> pcre2_match,
pcre_free -> pcre2_code_free, with proper error message retrieval
- cmake/FindPCRE.cmake -> cmake/FindPCRE2.cmake: find libpcre2-8 via
pkg-config, pcre2-config, or manual search
- Update all CMakeLists.txt, config.h.cmake, configure.cmake, README.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove autotools (configure.ac, Makefile.am, m4/, autogen.sh) and make
CMake the sole build system. Enhance CMake with proper Find modules for
MbedTLS, libsodium, PCRE, and c-ares with version/feature detection.
Add support for connmarktos, nftables, stack protector, and MinGW.
Add 10 unit test suites (CTest) covering base64, buffer, cache, crypto,
jconf, json, netutils, ppbloom, rule, and utils modules. Add a Python
stress test measuring bandwidth per cipher with memory leak detection.
Fix man page typos ("Resovle" -> "Resolve"), document missing TCP buffer
options, fix ss-manager duplicate --executable entry, add example section
to ss-tunnel, and document --workdir and --nftables-sets options.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed integer overflows can happen in three distinct places. This
fixes it so an error happens when an overflow is observed.
Signed-off-by: David Korczynski <david@adalogics.com>
221: You should jump this section and install them from distribution repository instead. -> You should jump to this section and install them from the distribution repository instead.
FIX#7
ref shadowsocks/shadowsocks-rust#855
When receiving UDP packets from remote servers, Redir will have to
create transparent sockets to bind() on those target addresses and then
relay data back to the local client. Target addresses may be IPv4 or
IPv6 addresses, so we may have to create that transprent sockets based
on the target addresses' family.
The most simpliest and easiest way is to always create IPv6 sockets and
converts IPv4 binding addresses and peer addresses to IPv4-mapped-IPv6.
Set {listen,server}_sock to -1 when needed as already done in
src/manager.c by commit ecf1fcc845 to
avoid the following build failure:
local.c: In function 'create_and_bind':
local.c:218:12: error: 'listen_sock' may be used uninitialized in this function [-Werror=maybe-uninitialized]
218 | return listen_sock;
| ^~~~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/27471a878ff52a972ac087d534e44fb0c50808f6
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
This confused me, and looking at the issues, it has confused other people as well. [1](https://github.com/shadowsocks/shadowsocks-libev/issues/2758)
I'm not sure if we can automate it though, e.g. in `autogen.sh`. Because some people might want to build with a modified version of the libraries.
Perhaps we could automatically fetch the submodules IF we see they are empty...
Anyway, for now, we can at least document this step.
The change is to support the 'fail2ban' feature. Instead of
blocking IPs by server itself, server just add malicious IPs
to specified sets of nftables. So admin can configure rules
to deal with those IPs.
Notes: cap_net_admin capability is required.
Example configuration:
# nft add table ip fail2ban
# nft add chain ip fail2ban input { type filter hook input priority 0 \; }
# nft add set ip fail2ban badips { type ipv4_addr \; flags dynamic, timeout \; timeout 1h \; }
# nft add rule ip fail2ban input ip saddr @badips drop
# ss-server -c config.json --nftables-sets badips
There is a race condition between shadowsocks-libev.service and
systemd-resolved.service after reboot/on boot. The shadowsocks
service tries to start before the dns service is started properly
and fails showing the corresponding errors in the logs.
Max LvandClaude Opus 4.6
David Korczynski
Lu jicongandZxl hhyccc
GVerso
Bill Zhong
Michael
rickyrick2002
nishans08
vndroid
DDoSolitary
Maxim Galaganov
zonyitoo
Chen Shaoju
Tristan Schmelcher
Alexandre ABRIOUX
Fabrice Fontaine
Paul "Joey" Clark
Max Lv
Gilles Depeyrot
Aven
Max Lv
lixingcong
abner_bob
dependabot[bot]
Maxim Shpak