mirror of
https://github.com/shadowsocks/shadowsocks-libev.git
synced 2026-10-18 03:26:48 +00:00
Max Lv
8cc58cea95
shadowsocks-rust takes a whole server definition as a URL; libev could only be given the pieces separately, so importing a server meant taking a URL apart by hand. ss-local now accepts --server-url and reads the address, port, cipher, password and SIP003 plugin from it. Both encodings are handled: the SIP002 form with the userinfo in base64url, and the older form where the whole body is one base64 blob. The userinfo is also accepted in the clear, because that is what shadowsocks-rust's `ssurl` emits for the 2022 ciphers, whose base64 pre-shared keys it percent-encodes instead. IPv6 literals, a trailing slash, the plugin query and the '#' tag are all covered. Options given later on the command line still win, since they are applied as getopt reaches them. ssurl.c sits with the ss-local sources rather than the shared ones: it depends on base64.c, which ss-manager does not link. The tests include URLs copied verbatim from `ssurl --encode` output, so the parser is pinned against what another implementation really produces rather than only against my reading of the spec. Verified end to end by pointing ss-local at a rust-generated URL and proxying through their ssserver.
194 lines
5.1 KiB
Plaintext
194 lines
5.1 KiB
Plaintext
ss-local(1)
|
|
===========
|
|
|
|
NAME
|
|
----
|
|
ss-local - shadowsocks client as socks5 proxy, libev port
|
|
|
|
SYNOPSIS
|
|
--------
|
|
*ss-local*
|
|
[-uv6] [-h|--help]
|
|
[-s <server_host>] [-p <server_port>] [-l <local_port>]
|
|
[-k <password>] [-m <encrypt_method>] [-f <pid_file>]
|
|
[-t <timeout>] [-c <config_file>] [-i <interface>]
|
|
[-a <user_name>] [-b <local_address>] [-n <nofile>]
|
|
[--fast-open] [--reuse-port] [--acl <acl_config>]
|
|
[--mtu <MTU>] [--no-delay]
|
|
[--plugin <plugin_name>] [--plugin-opts <plugin_options>]
|
|
[--password <password>] [--key <key_in_base64>]
|
|
[--server-url <ss_url>]
|
|
|
|
DESCRIPTION
|
|
-----------
|
|
*Shadowsocks-libev* is a lightweight and secure socks5 proxy.
|
|
It is a port of the original shadowsocks created by clowwindy.
|
|
*Shadowsocks-libev* is written in pure C and takes advantage of libev to
|
|
achieve both high performance and low resource consumption.
|
|
|
|
*Shadowsocks-libev* consists of five components. `ss-local`(1) works as a standard
|
|
socks5 proxy on local machines to proxy TCP traffic.
|
|
For more information, check out `shadowsocks-libev`(8).
|
|
|
|
OPTIONS
|
|
-------
|
|
|
|
-s <server_host>::
|
|
Set the server's hostname or IP.
|
|
|
|
-p <server_port>::
|
|
Set the server's port number.
|
|
|
|
-l <local_port>::
|
|
Set the local port number.
|
|
|
|
-k <password>::
|
|
--password <password>::
|
|
Set the password. The server and the client should use the same password.
|
|
|
|
--key <key_in_base64>::
|
|
Set the key directly. The key should be encoded with URL-safe Base64.
|
|
|
|
--server-url <ss_url>::
|
|
Take the server address, port, cipher, password and any SIP003 plugin
|
|
from a single 'ss://' URL, as produced by most clients and by
|
|
*shadowsocks-rust*'s `ssurl`. Both the SIP002 form
|
|
('ss://base64(method:password)@host:port/?plugin=...#tag') and the older
|
|
'ss://base64(method:password@host:port)' form are accepted. Options given
|
|
later on the command line override the values taken from the URL.
|
|
|
|
-m <encrypt_method>::
|
|
Set the cipher.
|
|
+
|
|
*Shadowsocks-libev* accepts 22 different ciphers:
|
|
+
|
|
2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm,
|
|
2022-blake3-chacha20-poly1305,
|
|
aes-128-gcm, aes-192-gcm, aes-256-gcm,
|
|
rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb,
|
|
aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb,
|
|
camellia-128-cfb, camellia-192-cfb, camellia-256-cfb,
|
|
chacha20-ietf-poly1305, xchacha20-ietf-poly1305,
|
|
salsa20, chacha20 and chacha20-ietf.
|
|
+
|
|
The default cipher is 'chacha20-ietf-poly1305'.
|
|
+
|
|
The '2022-blake3-*' ciphers implement Shadowsocks 2022 (SIP022) and are
|
|
the recommended choice: they provide full replay protection and
|
|
session-based UDP relay. They require a base64-encoded pre-shared key of
|
|
exactly the cipher's key size (16 bytes for 2022-blake3-aes-128-gcm, 32
|
|
bytes for the others) given with *-k*; passwords are not accepted and are
|
|
never stretched into a key. Generate one with `openssl rand -base64 32`.
|
|
+
|
|
If built with PolarSSL or custom OpenSSL libraries, some of
|
|
these ciphers may not work.
|
|
|
|
-a <user_name>::
|
|
Run as a specific user.
|
|
|
|
-f <pid_file>::
|
|
Start shadowsocks as a daemon with specific pid file.
|
|
|
|
-t <timeout>::
|
|
Set the socket timeout in seconds. The default value is 60.
|
|
|
|
-c <config_file>::
|
|
Use a configuration file.
|
|
+
|
|
Refer to `shadowsocks-libev`(8) 'CONFIG FILE' section for more details.
|
|
|
|
-n <number>::
|
|
Specify max number of open files.
|
|
+
|
|
Only available on Linux.
|
|
|
|
-i <interface>::
|
|
Send traffic through specific network interface.
|
|
+
|
|
For example, there are three interfaces in your device,
|
|
which is lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2).
|
|
Meanwhile, you configure `ss-local` to listen on 0.0.0.0:8388 and bind to eth1.
|
|
That results the traffic go out through eth1, but not lo nor eth0.
|
|
This option is useful to control traffic in multi-interface environment.
|
|
|
|
-b <local_address>::
|
|
Specify the local address to use while this client is making outbound
|
|
connections to the server.
|
|
|
|
-u::
|
|
Enable UDP relay.
|
|
|
|
-U::
|
|
Enable UDP relay and disable TCP relay.
|
|
|
|
-6::
|
|
Resolve hostname to IPv6 address first.
|
|
|
|
--fast-open::
|
|
Enable TCP fast open.
|
|
+
|
|
Only available with Linux kernel > 3.7.0.
|
|
|
|
--reuse-port::
|
|
Enable port reuse.
|
|
+
|
|
Only available with Linux kernel > 3.9.0.
|
|
|
|
--acl <acl_config>::
|
|
Enable ACL (Access Control List) and specify config file.
|
|
|
|
--mtu <MTU>::
|
|
Specify the MTU of your network interface.
|
|
|
|
--mptcp::
|
|
Enable Multipath TCP.
|
|
+
|
|
Only available with MPTCP enabled Linux kernel.
|
|
|
|
--no-delay::
|
|
Enable TCP_NODELAY.
|
|
|
|
--tcp-incoming-sndbuf <size>::
|
|
Set TCP send buffer size for incoming connections.
|
|
|
|
--tcp-incoming-rcvbuf <size>::
|
|
Set TCP receive buffer size for incoming connections.
|
|
|
|
--tcp-outgoing-sndbuf <size>::
|
|
Set TCP send buffer size for outgoing connections.
|
|
|
|
--tcp-outgoing-rcvbuf <size>::
|
|
Set TCP receive buffer size for outgoing connections.
|
|
|
|
--plugin <plugin_name>::
|
|
Enable SIP003 plugin. (Experimental)
|
|
|
|
--plugin-opts <plugin_options>::
|
|
Set SIP003 plugin options. (Experimental)
|
|
|
|
-v::
|
|
Enable verbose mode.
|
|
|
|
-h|--help::
|
|
Print help message.
|
|
|
|
EXAMPLE
|
|
-------
|
|
`ss-local`(1) can be started from command line and run in foreground.
|
|
Here is an example:
|
|
....
|
|
# Start ss-local with given parameters
|
|
ss-local -s example.com -p 12345 -l 1080 -k foobar -m aes-256-cfb
|
|
....
|
|
|
|
SEE ALSO
|
|
--------
|
|
`ss-server`(1),
|
|
`ss-tunnel`(1),
|
|
`ss-redir`(1),
|
|
`ss-manager`(1),
|
|
`shadowsocks-libev`(8),
|
|
`iptables`(8),
|
|
/etc/shadowsocks-libev/config.json
|
|
|