Bundle pinned offline dependencies, remove libcork/libipset and submodule requirements, and add portable runtime helpers with relocatable static/shared library installations.
Add Clang static build validation for Linux/musl, macOS and Windows, real TCP/UDP and SIP003 interoperability coverage, and recorded performance tradeoffs. All 21 hosted checks pass at the reviewed PR head 8d504e6218.
shadowsocks-rust has supported the 2022 edition for years while libev was
stuck on the 2017 AEAD construction, the largest functional gap between
the two implementations. This adds the three SIP022 methods:
2022-blake3-aes-128-gcm
2022-blake3-aes-256-gcm
2022-blake3-chacha20-poly1305
TCP uses BLAKE3 derive_key for session subkeys, standalone header chunks
carrying a type byte and timestamp, request padding, and a response header
echoing the request salt. Replay protection uses an exact-match salt pool
with 60s retention rather than the bloom filter, which SIP022 forbids
because false positives are unacceptable there.
UDP is session-based: an AES-ECB separate header for the AES methods and a
merged XChaCha20-Poly1305 construction for ChaCha, with a per-session
sliding window replay filter. Servers must route by client session ID,
which is only known after decryption, so the crypto layer owns the
server-side session table and hands the session back to udprelay for the
reply path.
The 2022 code lives in aead2022.c and aead2022_udp.c so aead.c keeps its
current size, with aead_internal.h carrying what they share. BLAKE3 is
vendored (portable backend only) as its own build target.
Keys are base64 pre-shared keys of exactly the cipher's key size; per
SIP022 a password is never stretched into a key.
Verified interoperable in both directions against shadowsocks-rust 1.24.0
for all three ciphers over TCP and UDP, including an 8MB transfer checked
by digest, plus unit tests for header framing, partial delivery, tamper
detection, and UDP replay rejection.
The idx-tracking optimization in aead_decrypt skipped memmove when
partial AEAD chunks spanned multiple calls, but never compacted the
dead space before idx. This caused the chunk buffer to grow
proportionally to total data transferred (~10 MB growth per 10 MB
transferred), tripping the stress test memory leak threshold.
Compact residual data to the front when appending new ciphertext,
keeping the buffer bounded to the size of the residual plus new data.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add bswap_data() to swap buffer pointers instead of copying, replace
brealloc+memcpy with pointer swaps in aead and stream codecs, add
in-place fast paths for non-Salsa20 stream ciphers, and use index
tracking instead of memmove in aead_decrypt chunked reassembly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* format with .uncrustify.cfg
format with .uncrustify.cfg
* format with .uncrustify.cfg
* format with .uncrustify.cfg exclude json.* base64.* uthash.h
* format with .uncrustify.cfg exclude json.* base64.* uthash.h
* Add Ping-Pong bloom filter
* Refine bloom filter insertion
* Reduce the error rate to 0.00001
* Avoid alignment issue in murmurhash2
* Fix a memory leak
* Fix build on non-GPU targets
* Detect get_current_dir_name in configure
* Update README.md
* Remove redudant bfree()
* Reduce the memory usage for local client
* Fix#1275
* Refine #1275
* Use IP when bypassing SNI domains
* Also apply replay detector on UDP traffic
* Update deb build script
Now build script is able to auto detect system and choose libraries
necessary to build.
Also update the README accordingly.
* Update build script to enable jessie/stretch etc
Also include a few cleanup that simplified pkg installation from
backports repository.
This is useful when checking connection issues, and can be used to
check broken random number generator and replay attacks.
Signed-off-by: Syrone Wong <wong.syrone@gmail.com>
Max Lv
Ayu
Lu jicongandZxl hhyccc
babarosaM33
Chinsyo
edsgerlin
Yegor Ievlev
Linus Yang
星野ハジメ
Syrone Wong
Dijkstra