PR #2424 review comment fix: supported_aead_ciphers_tag_size was not updated
when sm4-128-gcm was added, causing chacha20-ietf-poly1305 and xchacha20-ietf-poly1305
to receive a zero tag size, breaking AEAD encryption/decryption.
Migrate from autotools to cmake plugin, upgrade base from core18 to
core22, point source to local git repo instead of stale v3.3.5 tarball,
update PCRE3 to PCRE2, and update runtime library packages for Ubuntu
22.04.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Modernize build instructions to focus on CMake (the sole build system),
remove outdated autotools/backports references, and add documentation
for the ss-setup interactive TUI tool and the ss-nat transparent proxy
helper script with practical usage examples.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WITH_STATIC defaults to ON in CMakeLists.txt but CI was explicitly
disabling it. Remove -DWITH_STATIC=OFF so the static targets are
also built and linked, catching issues like the c-ares static
library rename (#3024).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
c-ares >= 1.27 renamed the static library from libcares.a to
libcares_static.a. Search for both names so the static build works
on older distros (libcares.a) and newer ones (libcares_static.a).
Fixes#3024
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The idx-tracking optimization in aead_decrypt skipped memmove when
partial AEAD chunks spanned multiple calls, but never compacted the
dead space before idx. This caused the chunk buffer to grow
proportionally to total data transferred (~10 MB growth per 10 MB
transferred), tripping the stress test memory leak threshold.
Compact residual data to the front when appending new ciphertext,
keeping the buffer bounded to the size of the residual plus new data.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add bswap_data() to swap buffer pointers instead of copying, replace
brealloc+memcpy with pointer swaps in aead and stream codecs, add
in-place fast paths for non-Salsa20 stream ciphers, and use index
tracking instead of memmove in aead_decrypt chunked reassembly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add tests/test_deb_build.sh with four phases:
1. Build .deb packages via dpkg-buildpackage
2. Verify all three packages contain expected files (binaries, man
pages, shared library, headers, pkg-config)
3. Install packages and resolve dependencies
4. Smoke-test installed binaries, ldconfig, and headers
Add a Linux-only CI step in build.yml to run the test.
Statically link the bundled submodule libraries (libcork, libipset,
libbloom) into all targets instead of building them as shared libs.
These are vendored code built from git submodules, not system
libraries, so static linking is correct and eliminates
dpkg-shlibdeps warnings about missing .so files.
Pass -DWITH_STATIC=OFF in debian/rules since debian build-depends
only provide shared library dev packages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Boot a minimal Alpine Linux guest in QEMU with iptables, ss-redir, and
ss-nat to verify the full transparent proxy chain: iptables REDIRECT →
ss-redir → ss-server (host) → internet. The host-built ss-redir binary
and its shared library dependencies are copied into the Alpine rootfs,
avoiding static linking issues. Uses QEMU user-mode networking with KVM
acceleration when available. Linux-only CI step with 8-minute timeout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Interactive whiptail/dialog TUI for server/client config generation,
systemd service management, SIP003 plugin installation, and ss:// URI
output. Includes 131 bash unit tests covering all utility functions
(validation, JSON generation, URI encoding, config round-trip parsing).
Tests run in CTest and as a dedicated GitHub Actions step.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Modernize build: switch to CMake, add unit tests, fix man pages
Remove autotools (configure.ac, Makefile.am, m4/, autogen.sh) and make
CMake the sole build system. Enhance CMake with proper Find modules for
MbedTLS, libsodium, PCRE, and c-ares with version/feature detection.
Add support for connmarktos, nftables, stack protector, and MinGW.
Add 10 unit test suites (CTest) covering base64, buffer, cache, crypto,
jconf, json, netutils, ppbloom, rule, and utils modules. Add a Python
stress test measuring bandwidth per cipher with memory leak detection.
Fix man page typos ("Resovle" -> "Resolve"), document missing TCP buffer
options, fix ss-manager duplicate --executable entry, add example section
to ss-tunnel, and document --workdir and --nftables-sets options.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Migrate from PCRE to PCRE2
Replace legacy PCRE (libpcre3) with PCRE2 (libpcre2-8). PCRE1 has been
end-of-life since 2021.
- src/rule.h: use pcre2_code and pcre2_match_data types
- src/rule.c: pcre_compile -> pcre2_compile, pcre_exec -> pcre2_match,
pcre_free -> pcre2_code_free, with proper error message retrieval
- cmake/FindPCRE.cmake -> cmake/FindPCRE2.cmake: find libpcre2-8 via
pkg-config, pcre2-config, or manual search
- Update all CMakeLists.txt, config.h.cmake, configure.cmake, README.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update Dockerfiles: use CMake build and pcre2-dev
The alpine Dockerfile still used autotools (autogen.sh/configure) which
were removed. Switch to cmake build and replace pcre-dev with pcre2-dev.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Docker build: disable tests and remove git dep
The tests/ directory is excluded by .dockerignore, so pass
-DBUILD_TESTING=OFF to cmake. Submodules are already checked out
by actions/checkout, no need for git inside the container.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Docker build: disable static libs (not available in alpine)
Alpine's mbedtls-dev only provides shared libraries. Disable static
build since Docker only needs shared binaries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Rewrite GitHub Actions: build and test directly on runner
Replace Docker-based CI with direct cmake build on ubuntu-latest and
macos-latest. Install dependencies via apt/brew, build with cmake,
run unit tests with ctest.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix CI: use mbedtls@3 on macOS, disable static build
- macOS: brew's mbedtls is now v4 (incompatible), use mbedtls@3
- Disable static build since CI runners lack static lib packages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix test build on Linux: add stdint.h and link libm
- test_ppbloom.c: add missing #include <stdint.h> for uint8_t
- test_json: link against libm for pow() used in json.c
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix test_ppbloom link: add libm for bloom's log()
On Linux, libbloom uses log() which requires explicit -lm linkage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Linux build: link libm for test_buffer and test_crypto, fix warnings
Both test_buffer and test_crypto link libbloom.so which uses log() from
libm. Also fix unused variable warnings in test_json.c that would fail
with -Werror.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Linux build: link libm for test_jconf (json.c uses pow)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* CI: add unit test and stress test steps to GitHub Actions
Split the Test step into separate "Unit tests" (ctest) and "Stress test"
(stress_test.py with 10MB transfer across all AEAD ciphers) steps for
better visibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed integer overflows can happen in three distinct places. This
fixes it so an error happens when an overflow is observed.
Signed-off-by: David Korczynski <david@adalogics.com>
221: You should jump this section and install them from distribution repository instead. -> You should jump to this section and install them from the distribution repository instead.
FIX#7
ref shadowsocks/shadowsocks-rust#855
When receiving UDP packets from remote servers, Redir will have to
create transparent sockets to bind() on those target addresses and then
relay data back to the local client. Target addresses may be IPv4 or
IPv6 addresses, so we may have to create that transprent sockets based
on the target addresses' family.
The most simpliest and easiest way is to always create IPv6 sockets and
converts IPv4 binding addresses and peer addresses to IPv4-mapped-IPv6.
copilot-swe-agent[bot]
notsure2
dependabot[bot]
Max Lv
Andy Ye
Hillwood Yang
Pain
mesher2024
Ayu
David Korczynski
Lu jicongandZxl hhyccc
Wen Sun
GVerso
Bill Zhong
Michael
rickyrick2002
nishans08
DDoSolitary
Maxim Galaganov
zonyitoo
Chen Shaoju