mirror of
https://github.com/shadowsocks/shadowsocks-libev.git
synced 2026-10-20 13:03:50 +00:00
Max Lv
46791234c0
shadowsocks-rust has supported the 2022 edition for years while libev was stuck on the 2017 AEAD construction, the largest functional gap between the two implementations. This adds the three SIP022 methods: 2022-blake3-aes-128-gcm 2022-blake3-aes-256-gcm 2022-blake3-chacha20-poly1305 TCP uses BLAKE3 derive_key for session subkeys, standalone header chunks carrying a type byte and timestamp, request padding, and a response header echoing the request salt. Replay protection uses an exact-match salt pool with 60s retention rather than the bloom filter, which SIP022 forbids because false positives are unacceptable there. UDP is session-based: an AES-ECB separate header for the AES methods and a merged XChaCha20-Poly1305 construction for ChaCha, with a per-session sliding window replay filter. Servers must route by client session ID, which is only known after decryption, so the crypto layer owns the server-side session table and hands the session back to udprelay for the reply path. The 2022 code lives in aead2022.c and aead2022_udp.c so aead.c keeps its current size, with aead_internal.h carrying what they share. BLAKE3 is vendored (portable backend only) as its own build target. Keys are base64 pre-shared keys of exactly the cipher's key size; per SIP022 a password is never stretched into a key. Verified interoperable in both directions against shadowsocks-rust 1.24.0 for all three ciphers over TCP and UDP, including an 8MB transfer checked by digest, plus unit tests for header framing, partial delivery, tamper detection, and UDP replay rejection.
209 lines
5.5 KiB
Plaintext
209 lines
5.5 KiB
Plaintext
ss-server(1)
|
|
============
|
|
|
|
NAME
|
|
----
|
|
ss-server - shadowsocks server, libev port
|
|
|
|
SYNOPSIS
|
|
--------
|
|
*ss-server*
|
|
[-uUv] [-h|--help]
|
|
[-s <server_host>] [-p <server_port>] [-l <local_port>]
|
|
[-k <password>] [-m <encrypt_method>] [-f <pid_file>]
|
|
[-t <timeout>] [-c <config_file>] [-i <interface>]
|
|
[-a <user_name>] [-d <addr>] [-n <nofile>]
|
|
[-b <local_address>] [--fast-open] [--reuse-port]
|
|
[--mptcp] [--acl <acl_config>] [--mtu <MTU>] [--no-delay]
|
|
[--manager-address <path_to_unix_domain>]
|
|
[--plugin <plugin_name>] [--plugin-opts <plugin_options>]
|
|
[--password <password>] [--key <key_in_base64>]
|
|
|
|
DESCRIPTION
|
|
-----------
|
|
*Shadowsocks-libev* is a lightweight and secure socks5 proxy.
|
|
It is a port of the original shadowsocks created by clowwindy.
|
|
*Shadowsocks-libev* is written in pure C and takes advantage of libev to
|
|
achieve both high performance and low resource consumption.
|
|
|
|
*Shadowsocks-libev* consists of five components.
|
|
`ss-server`(1) runs on a remote server to provide secured tunnel service.
|
|
For more information, check out `shadowsocks-libev`(8).
|
|
|
|
OPTIONS
|
|
-------
|
|
-s <server_host>::
|
|
Set the server's hostname or IP.
|
|
|
|
-p <server_port>::
|
|
Set the server's port number.
|
|
|
|
-k <password>::
|
|
--password <password>::
|
|
Set the password. The server and the client should use the same password.
|
|
|
|
--key <key_in_base64>::
|
|
Set the key directly. The key should be encoded with URL-safe Base64.
|
|
|
|
-m <encrypt_method>::
|
|
Set the cipher.
|
|
+
|
|
*Shadowsocks-libev* accepts 22 different ciphers:
|
|
+
|
|
2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm,
|
|
2022-blake3-chacha20-poly1305,
|
|
aes-128-gcm, aes-192-gcm, aes-256-gcm,
|
|
rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb,
|
|
aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb,
|
|
camellia-128-cfb, camellia-192-cfb, camellia-256-cfb,
|
|
chacha20-ietf-poly1305, xchacha20-ietf-poly1305,
|
|
salsa20, chacha20 and chacha20-ietf.
|
|
+
|
|
The '2022-blake3-*' ciphers implement Shadowsocks 2022 (SIP022) and are
|
|
the recommended choice: they provide full replay protection and
|
|
session-based UDP relay. They require a base64-encoded pre-shared key of
|
|
exactly the cipher's key size (16 bytes for 2022-blake3-aes-128-gcm, 32
|
|
bytes for the others) given with *-k*; passwords are not accepted and are
|
|
never stretched into a key. Generate one with `openssl rand -base64 32`.
|
|
+
|
|
If built with PolarSSL or custom OpenSSL libraries, some of
|
|
these ciphers may not work.
|
|
|
|
-a <user_name>::
|
|
Run as a specific user.
|
|
|
|
-f <pid_file>::
|
|
Start shadowsocks as a daemon with specific pid file.
|
|
|
|
-t <timeout>::
|
|
Set the socket timeout in seconds. The default value is 60.
|
|
|
|
-c <config_file>::
|
|
Use a configuration file.
|
|
+
|
|
Refer to `shadowsocks-libev`(8) 'CONFIG FILE' section for more details.
|
|
|
|
-n <number>::
|
|
Specify max number of open files.
|
|
+
|
|
Only available on Linux.
|
|
|
|
-i <interface>::
|
|
Send traffic through specific network interface.
|
|
+
|
|
For example, there are three interfaces in your device,
|
|
which is lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2).
|
|
Meanwhile, you configure `ss-server` to listen on 0.0.0.0:8388 and bind to eth1.
|
|
That results the traffic go out through eth1, but not lo nor eth0.
|
|
This option is useful to control traffic in multi-interface environment.
|
|
|
|
-b <local_address>::
|
|
Specify the local address to use while this server is making outbound
|
|
connections to remote servers on behalf of the clients.
|
|
|
|
-u::
|
|
Enable UDP relay.
|
|
|
|
-U::
|
|
Enable UDP relay and disable TCP relay.
|
|
|
|
-6::
|
|
Resolve hostname to IPv6 address first.
|
|
|
|
-d <addr>::
|
|
Setup name servers for internal DNS resolver (libc-ares).
|
|
The default server is fetched from '/etc/resolv.conf'.
|
|
|
|
--fast-open::
|
|
Enable TCP fast open.
|
|
+
|
|
Only available with Linux kernel > 3.7.0.
|
|
|
|
--reuse-port::
|
|
Enable port reuse.
|
|
+
|
|
Only available with Linux kernel > 3.9.0.
|
|
|
|
--no-delay::
|
|
Enable TCP_NODELAY.
|
|
|
|
--tcp-incoming-sndbuf <size>::
|
|
Set TCP send buffer size for incoming connections.
|
|
|
|
--tcp-incoming-rcvbuf <size>::
|
|
Set TCP receive buffer size for incoming connections.
|
|
|
|
--tcp-outgoing-sndbuf <size>::
|
|
Set TCP send buffer size for outgoing connections.
|
|
|
|
--tcp-outgoing-rcvbuf <size>::
|
|
Set TCP receive buffer size for outgoing connections.
|
|
|
|
--acl <acl_config>::
|
|
Enable ACL (Access Control List) and specify config file.
|
|
|
|
--manager-address <path_to_unix_domain>::
|
|
Specify UNIX domain socket address for the communication between ss-manager(1) and ss-server(1).
|
|
+
|
|
Only available in server and manager mode.
|
|
|
|
--mtu <MTU>::
|
|
Specify the MTU of your network interface.
|
|
|
|
--mptcp::
|
|
Enable Multipath TCP.
|
|
+
|
|
Only available with MPTCP enabled Linux kernel.
|
|
|
|
--plugin <plugin_name>::
|
|
Enable SIP003 plugin. (Experimental)
|
|
|
|
--plugin-opts <plugin_options>::
|
|
Set SIP003 plugin options. (Experimental)
|
|
|
|
-v::
|
|
Enable verbose mode.
|
|
|
|
-h|--help::
|
|
Print help message.
|
|
|
|
EXAMPLE
|
|
-------
|
|
It is recommended to use a config file when starting `ss-server`(1).
|
|
|
|
The config file is written in JSON and is easy to edit.
|
|
Check out the 'SEE ALSO' section for the default path of config file.
|
|
|
|
....
|
|
# Start the ss-server
|
|
ss-server -c /etc/shadowsocks-libev/config.json
|
|
....
|
|
|
|
INCOMPATIBILITY
|
|
---------------
|
|
The config file of `shadowsocks-libev`(8) is slightly different from original
|
|
shadowsocks.
|
|
|
|
In order to listen to both IPv4/IPv6 address, use the following grammar in
|
|
your config json file:
|
|
....
|
|
{
|
|
"server":["::0","0.0.0.0"],
|
|
...
|
|
}
|
|
....
|
|
|
|
`ss-server`(1) also does not understand "port_password" field in config file.
|
|
If you want to start up multiple server instances with a single config file,
|
|
please try ss-manager tool. See `ss-manager`(8) for details.
|
|
|
|
SEE ALSO
|
|
--------
|
|
`ss-local`(1),
|
|
`ss-tunnel`(1),
|
|
`ss-redir`(1),
|
|
`ss-manager`(1),
|
|
`shadowsocks-libev`(8),
|
|
`iptables`(8),
|
|
/etc/shadowsocks-libev/config.json
|