Rename the project to shadowsocks-c while retaining ss-* commands, the embedding ABI, and legacy library/package lookup compatibility.
Replace libev with bundled libuv for IOCP/kqueue event backends, expand asynchronous runtime DNS coverage, and add actionlint/Ruff with strict clang-tidy failure handling. Validate native platforms, static builds, packaging, interoperability, sanitizers, and canonical/legacy consumers.
All 22 hosted checks pass at reviewed head a8493250eb.
Bundle pinned offline dependencies, remove libcork/libipset and submodule requirements, and add portable runtime helpers with relocatable static/shared library installations.
Add Clang static build validation for Linux/musl, macOS and Windows, real TCP/UDP and SIP003 interoperability coverage, and recorded performance tradeoffs. All 21 hosted checks pass at the reviewed PR head 8d504e6218.
crypto_init() initializes the nonce bloom filter on every call, so a test
that builds a crypto_t per case has to tear it down per case as well.
Freeing only once at the end leaked a pair of filters for every crypto_t
after the first, which the valgrind memcheck job caught.
test_crypto.c already frees it alongside each crypto_t; do the same here
by folding it into the local free_crypto() helper.
shadowsocks-rust takes a whole server definition as a URL; libev could
only be given the pieces separately, so importing a server meant taking a
URL apart by hand. ss-local now accepts --server-url and reads the
address, port, cipher, password and SIP003 plugin from it.
Both encodings are handled: the SIP002 form with the userinfo in
base64url, and the older form where the whole body is one base64 blob.
The userinfo is also accepted in the clear, because that is what
shadowsocks-rust's `ssurl` emits for the 2022 ciphers, whose base64
pre-shared keys it percent-encodes instead. IPv6 literals, a trailing
slash, the plugin query and the '#' tag are all covered.
Options given later on the command line still win, since they are applied
as getopt reaches them.
ssurl.c sits with the ss-local sources rather than the shared ones: it
depends on base64.c, which ss-manager does not link.
The tests include URLs copied verbatim from `ssurl --encode` output, so
the parser is pinned against what another implementation really produces
rather than only against my reading of the spec. Verified end to end by
pointing ss-local at a rust-generated URL and proxying through their
ssserver.
A cipher can round-trip perfectly against our own implementation and
still be wrong: header layout, padding rules, and nonce ordering are only
pinned down by talking to another implementation. This drives ss-local
against rust's ssserver and rust's sslocal against ss-server, over a
local origin server so it needs no network access.
Covers the three SIP022 methods plus aes-256-gcm, so a regression in the
legacy path shows up here too. Skips itself when shadowsocks-rust or the
built binaries are absent, so it is safe to run anywhere.
shadowsocks-rust has supported the 2022 edition for years while libev was
stuck on the 2017 AEAD construction, the largest functional gap between
the two implementations. This adds the three SIP022 methods:
2022-blake3-aes-128-gcm
2022-blake3-aes-256-gcm
2022-blake3-chacha20-poly1305
TCP uses BLAKE3 derive_key for session subkeys, standalone header chunks
carrying a type byte and timestamp, request padding, and a response header
echoing the request salt. Replay protection uses an exact-match salt pool
with 60s retention rather than the bloom filter, which SIP022 forbids
because false positives are unacceptable there.
UDP is session-based: an AES-ECB separate header for the AES methods and a
merged XChaCha20-Poly1305 construction for ChaCha, with a per-session
sliding window replay filter. Servers must route by client session ID,
which is only known after decryption, so the crypto layer owns the
server-side session table and hands the session back to udprelay for the
reply path.
The 2022 code lives in aead2022.c and aead2022_udp.c so aead.c keeps its
current size, with aead_internal.h carrying what they share. BLAKE3 is
vendored (portable backend only) as its own build target.
Keys are base64 pre-shared keys of exactly the cipher's key size; per
SIP022 a password is never stretched into a key.
Verified interoperable in both directions against shadowsocks-rust 1.24.0
for all three ciphers over TCP and UDP, including an 8MB transfer checked
by digest, plus unit tests for header framing, partial delivery, tamper
detection, and UDP replay rejection.
Add tests/test_deb_build.sh with four phases:
1. Build .deb packages via dpkg-buildpackage
2. Verify all three packages contain expected files (binaries, man
pages, shared library, headers, pkg-config)
3. Install packages and resolve dependencies
4. Smoke-test installed binaries, ldconfig, and headers
Add a Linux-only CI step in build.yml to run the test.
Statically link the bundled submodule libraries (libcork, libipset,
libbloom) into all targets instead of building them as shared libs.
These are vendored code built from git submodules, not system
libraries, so static linking is correct and eliminates
dpkg-shlibdeps warnings about missing .so files.
Pass -DWITH_STATIC=OFF in debian/rules since debian build-depends
only provide shared library dev packages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Boot a minimal Alpine Linux guest in QEMU with iptables, ss-redir, and
ss-nat to verify the full transparent proxy chain: iptables REDIRECT →
ss-redir → ss-server (host) → internet. The host-built ss-redir binary
and its shared library dependencies are copied into the Alpine rootfs,
avoiding static linking issues. Uses QEMU user-mode networking with KVM
acceleration when available. Linux-only CI step with 8-minute timeout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Interactive whiptail/dialog TUI for server/client config generation,
systemd service management, SIP003 plugin installation, and ss:// URI
output. Includes 131 bash unit tests covering all utility functions
(validation, JSON generation, URI encoding, config round-trip parsing).
Tests run in CTest and as a dedicated GitHub Actions step.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Modernize build: switch to CMake, add unit tests, fix man pages
Remove autotools (configure.ac, Makefile.am, m4/, autogen.sh) and make
CMake the sole build system. Enhance CMake with proper Find modules for
MbedTLS, libsodium, PCRE, and c-ares with version/feature detection.
Add support for connmarktos, nftables, stack protector, and MinGW.
Add 10 unit test suites (CTest) covering base64, buffer, cache, crypto,
jconf, json, netutils, ppbloom, rule, and utils modules. Add a Python
stress test measuring bandwidth per cipher with memory leak detection.
Fix man page typos ("Resovle" -> "Resolve"), document missing TCP buffer
options, fix ss-manager duplicate --executable entry, add example section
to ss-tunnel, and document --workdir and --nftables-sets options.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Migrate from PCRE to PCRE2
Replace legacy PCRE (libpcre3) with PCRE2 (libpcre2-8). PCRE1 has been
end-of-life since 2021.
- src/rule.h: use pcre2_code and pcre2_match_data types
- src/rule.c: pcre_compile -> pcre2_compile, pcre_exec -> pcre2_match,
pcre_free -> pcre2_code_free, with proper error message retrieval
- cmake/FindPCRE.cmake -> cmake/FindPCRE2.cmake: find libpcre2-8 via
pkg-config, pcre2-config, or manual search
- Update all CMakeLists.txt, config.h.cmake, configure.cmake, README.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update Dockerfiles: use CMake build and pcre2-dev
The alpine Dockerfile still used autotools (autogen.sh/configure) which
were removed. Switch to cmake build and replace pcre-dev with pcre2-dev.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Docker build: disable tests and remove git dep
The tests/ directory is excluded by .dockerignore, so pass
-DBUILD_TESTING=OFF to cmake. Submodules are already checked out
by actions/checkout, no need for git inside the container.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Docker build: disable static libs (not available in alpine)
Alpine's mbedtls-dev only provides shared libraries. Disable static
build since Docker only needs shared binaries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Rewrite GitHub Actions: build and test directly on runner
Replace Docker-based CI with direct cmake build on ubuntu-latest and
macos-latest. Install dependencies via apt/brew, build with cmake,
run unit tests with ctest.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix CI: use mbedtls@3 on macOS, disable static build
- macOS: brew's mbedtls is now v4 (incompatible), use mbedtls@3
- Disable static build since CI runners lack static lib packages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix test build on Linux: add stdint.h and link libm
- test_ppbloom.c: add missing #include <stdint.h> for uint8_t
- test_json: link against libm for pow() used in json.c
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix test_ppbloom link: add libm for bloom's log()
On Linux, libbloom uses log() which requires explicit -lm linkage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Linux build: link libm for test_buffer and test_crypto, fix warnings
Both test_buffer and test_crypto link libbloom.so which uses log() from
libm. Also fix unused variable warnings in test_json.c that would fail
with -Werror.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Linux build: link libm for test_jconf (json.c uses pow)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* CI: add unit test and stress test steps to GitHub Actions
Split the Test step into separate "Unit tests" (ctest) and "Stress test"
(stress_test.py with 10MB transfer across all AEAD ciphers) steps for
better visibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Currently the test script assumes the returned web page is always encoded in UTF-8, which might not be the case. It is likely that the real encoding is `ISO-8859-1` and that running the script under python3 will raise error:
```
<
{ [11931 bytes data]
100 11923 0 11923 0 0 184k 0 --:--:-- --:--:-- --:--:-- 187k
Traceback (most recent call last):
File "tests/test.py", line 106, in <module>
line = str(line, 'utf8')
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xa0 in position 1105: invalid start byte
```
This pull request makes no assumption on the returned data and send the raw output to stderr as `bytes`. This should allow the test script to finish successfully when `tests/test.py` is run by python3.
shadowsocks-libev doesn't support connecting through an upstream HTTP
proxy, so if the test environment requires that then there's nothing we can
do. (In future it might be possible to set up a local server to avoid this
problem.)
Max Lv
Andy Ye
Pain
Boyuan Yang
Colin Watson
Roger Shimizu
Roger Shimizu