mirror of
https://github.com/shadowsocks/shadowsocks-libev.git
synced 2026-11-03 00:13:42 +00:00
Max LvandClaude Opus 4.6
7bb250739e
* Modernize build: switch to CMake, add unit tests, fix man pages
Remove autotools (configure.ac, Makefile.am, m4/, autogen.sh) and make
CMake the sole build system. Enhance CMake with proper Find modules for
MbedTLS, libsodium, PCRE, and c-ares with version/feature detection.
Add support for connmarktos, nftables, stack protector, and MinGW.
Add 10 unit test suites (CTest) covering base64, buffer, cache, crypto,
jconf, json, netutils, ppbloom, rule, and utils modules. Add a Python
stress test measuring bandwidth per cipher with memory leak detection.
Fix man page typos ("Resovle" -> "Resolve"), document missing TCP buffer
options, fix ss-manager duplicate --executable entry, add example section
to ss-tunnel, and document --workdir and --nftables-sets options.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Migrate from PCRE to PCRE2
Replace legacy PCRE (libpcre3) with PCRE2 (libpcre2-8). PCRE1 has been
end-of-life since 2021.
- src/rule.h: use pcre2_code and pcre2_match_data types
- src/rule.c: pcre_compile -> pcre2_compile, pcre_exec -> pcre2_match,
pcre_free -> pcre2_code_free, with proper error message retrieval
- cmake/FindPCRE.cmake -> cmake/FindPCRE2.cmake: find libpcre2-8 via
pkg-config, pcre2-config, or manual search
- Update all CMakeLists.txt, config.h.cmake, configure.cmake, README.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update Dockerfiles: use CMake build and pcre2-dev
The alpine Dockerfile still used autotools (autogen.sh/configure) which
were removed. Switch to cmake build and replace pcre-dev with pcre2-dev.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Docker build: disable tests and remove git dep
The tests/ directory is excluded by .dockerignore, so pass
-DBUILD_TESTING=OFF to cmake. Submodules are already checked out
by actions/checkout, no need for git inside the container.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Docker build: disable static libs (not available in alpine)
Alpine's mbedtls-dev only provides shared libraries. Disable static
build since Docker only needs shared binaries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Rewrite GitHub Actions: build and test directly on runner
Replace Docker-based CI with direct cmake build on ubuntu-latest and
macos-latest. Install dependencies via apt/brew, build with cmake,
run unit tests with ctest.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix CI: use mbedtls@3 on macOS, disable static build
- macOS: brew's mbedtls is now v4 (incompatible), use mbedtls@3
- Disable static build since CI runners lack static lib packages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix test build on Linux: add stdint.h and link libm
- test_ppbloom.c: add missing #include <stdint.h> for uint8_t
- test_json: link against libm for pow() used in json.c
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix test_ppbloom link: add libm for bloom's log()
On Linux, libbloom uses log() which requires explicit -lm linkage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Linux build: link libm for test_buffer and test_crypto, fix warnings
Both test_buffer and test_crypto link libbloom.so which uses log() from
libm. Also fix unused variable warnings in test_json.c that would fail
with -Werror.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix Linux build: link libm for test_jconf (json.c uses pow)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* CI: add unit test and stress test steps to GitHub Actions
Split the Test step into separate "Unit tests" (ctest) and "Stress test"
(stress_test.py with 10MB transfer across all AEAD ciphers) steps for
better visibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
194 lines
5.0 KiB
Plaintext
194 lines
5.0 KiB
Plaintext
ss-redir(1)
|
|
===========
|
|
|
|
NAME
|
|
----
|
|
ss-redir - shadowsocks client as transparent proxy, libev port
|
|
|
|
SYNOPSIS
|
|
--------
|
|
*ss-redir*
|
|
[-uUv6] [-h|--help]
|
|
[-s <server_host>] [-p <server_port>] [-l <local_port>]
|
|
[-k <password>] [-m <encrypt_method>] [-f <pid_file>]
|
|
[-t <timeout>] [-c <config_file>] [-b <local_address>]
|
|
[-a <user_name>] [-n <nofile>] [--mtu <MTU>] [--no-delay]
|
|
[--plugin <plugin_name>] [--plugin-opts <plugin_options>]
|
|
[--password <password>] [--key <key_in_base64>]
|
|
|
|
DESCRIPTION
|
|
-----------
|
|
*Shadowsocks-libev* is a lightweight and secure socks5 proxy.
|
|
It is a port of the original shadowsocks created by clowwindy.
|
|
*Shadowsocks-libev* is written in pure C and takes advantage of libev to
|
|
achieve both high performance and low resource consumption.
|
|
|
|
*Shadowsocks-libev* consists of five components.
|
|
`ss-redir`(1) works as a transparent proxy on local machines to proxy TCP
|
|
traffic and requires netfilter's NAT module.
|
|
For more information, check out `shadowsocks-libev`(8) and the following
|
|
'EXAMPLE' section.
|
|
|
|
OPTIONS
|
|
-------
|
|
-s <server_host>::
|
|
Set the server's hostname or IP.
|
|
|
|
-p <server_port>::
|
|
Set the server's port number.
|
|
|
|
-l <local_port>::
|
|
Set the local port number.
|
|
|
|
-k <password>::
|
|
--password <password>::
|
|
Set the password. The server and the client should use the same password.
|
|
|
|
--key <key_in_base64>::
|
|
Set the key directly. The key should be encoded with URL-safe Base64.
|
|
|
|
-m <encrypt_method>::
|
|
Set the cipher.
|
|
+
|
|
*Shadowsocks-libev* accepts 19 different ciphers:
|
|
+
|
|
aes-128-gcm, aes-192-gcm, aes-256-gcm,
|
|
rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb,
|
|
aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb,
|
|
camellia-128-cfb, camellia-192-cfb, camellia-256-cfb,
|
|
chacha20-ietf-poly1305, xchacha20-ietf-poly1305,
|
|
salsa20, chacha20 and chacha20-ietf.
|
|
+
|
|
The default cipher is 'chacha20-ietf-poly1305'.
|
|
+
|
|
If built with PolarSSL or custom OpenSSL libraries, some of
|
|
these ciphers may not work.
|
|
|
|
-a <user_name>::
|
|
Run as a specific user.
|
|
|
|
-f <pid_file>::
|
|
Start shadowsocks as a daemon with specific pid file.
|
|
|
|
-t <timeout>::
|
|
Set the socket timeout in seconds. The default value is 60.
|
|
|
|
-c <config_file>::
|
|
Use a configuration file.
|
|
+
|
|
Refer to `shadowsocks-libev`(8) 'CONFIG FILE' section for more details.
|
|
|
|
-n <number>::
|
|
Specify max number of open files.
|
|
+
|
|
Only available on Linux.
|
|
|
|
-b <local_address>::
|
|
Specify the local address to use while this client is making outbound
|
|
connections to the server.
|
|
|
|
-u::
|
|
Enable UDP relay.
|
|
+
|
|
TPROXY is required in redir mode. You may need root permission.
|
|
|
|
-U::
|
|
Enable UDP relay and disable TCP relay.
|
|
|
|
-T::
|
|
Use tproxy instead of redirect. (for tcp)
|
|
|
|
-6::
|
|
Resolve hostname to IPv6 address first.
|
|
|
|
--mtu <MTU>::
|
|
Specify the MTU of your network interface.
|
|
|
|
--mptcp::
|
|
Enable Multipath TCP.
|
|
+
|
|
Only available with MPTCP enabled Linux kernel.
|
|
|
|
--reuse-port::
|
|
Enable port reuse.
|
|
+
|
|
Only available with Linux kernel > 3.9.0.
|
|
|
|
--no-delay::
|
|
Enable TCP_NODELAY.
|
|
|
|
--tcp-incoming-sndbuf <size>::
|
|
Set TCP send buffer size for incoming connections.
|
|
|
|
--tcp-incoming-rcvbuf <size>::
|
|
Set TCP receive buffer size for incoming connections.
|
|
|
|
--tcp-outgoing-sndbuf <size>::
|
|
Set TCP send buffer size for outgoing connections.
|
|
|
|
--tcp-outgoing-rcvbuf <size>::
|
|
Set TCP receive buffer size for outgoing connections.
|
|
|
|
--plugin <plugin_name>::
|
|
Enable SIP003 plugin. (Experimental)
|
|
|
|
--plugin-opts <plugin_options>::
|
|
Set SIP003 plugin options. (Experimental)
|
|
|
|
-v::
|
|
Enable verbose mode.
|
|
|
|
-h|--help::
|
|
Print help message.
|
|
|
|
EXAMPLE
|
|
-------
|
|
ss-redir requires netfilter's NAT function. Here is an example:
|
|
|
|
....
|
|
# Create new chain
|
|
iptables -t nat -N SHADOWSOCKS
|
|
iptables -t mangle -N SHADOWSOCKS
|
|
|
|
# Ignore your shadowsocks server's addresses
|
|
# It's very IMPORTANT, just be careful.
|
|
iptables -t nat -A SHADOWSOCKS -d 123.123.123.123 -j RETURN
|
|
|
|
# Ignore LANs and any other addresses you'd like to bypass the proxy
|
|
# See Wikipedia and RFC5735 for full list of reserved networks.
|
|
# See ashi009/bestroutetb for a highly optimized CHN route list.
|
|
iptables -t nat -A SHADOWSOCKS -d 0.0.0.0/8 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 10.0.0.0/8 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 127.0.0.0/8 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 169.254.0.0/16 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 172.16.0.0/12 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 192.168.0.0/16 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 224.0.0.0/4 -j RETURN
|
|
iptables -t nat -A SHADOWSOCKS -d 240.0.0.0/4 -j RETURN
|
|
|
|
# Anything else should be redirected to shadowsocks's local port
|
|
iptables -t nat -A SHADOWSOCKS -p tcp -j REDIRECT --to-ports 12345
|
|
|
|
# Add any UDP rules
|
|
ip route add local default dev lo table 100
|
|
ip rule add fwmark 1 lookup 100
|
|
iptables -t mangle -A SHADOWSOCKS -p udp --dport 53 -j TPROXY --on-port 12345 --tproxy-mark 0x01/0x01
|
|
|
|
# Apply the rules
|
|
iptables -t nat -A PREROUTING -p tcp -j SHADOWSOCKS
|
|
iptables -t mangle -A PREROUTING -j SHADOWSOCKS
|
|
|
|
# Start the shadowsocks-redir
|
|
ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid
|
|
....
|
|
|
|
SEE ALSO
|
|
--------
|
|
`ss-local`(1),
|
|
`ss-server`(1),
|
|
`ss-tunnel`(1),
|
|
`ss-manager`(1),
|
|
`shadowsocks-libev`(8),
|
|
`iptables`(8),
|
|
/etc/shadowsocks-libev/config.json
|