mirror of
https://github.com/shadowsocks/shadowsocks-libev.git
synced 2026-10-20 21:43:41 +00:00
Max Lv
46791234c0
shadowsocks-rust has supported the 2022 edition for years while libev was stuck on the 2017 AEAD construction, the largest functional gap between the two implementations. This adds the three SIP022 methods: 2022-blake3-aes-128-gcm 2022-blake3-aes-256-gcm 2022-blake3-chacha20-poly1305 TCP uses BLAKE3 derive_key for session subkeys, standalone header chunks carrying a type byte and timestamp, request padding, and a response header echoing the request salt. Replay protection uses an exact-match salt pool with 60s retention rather than the bloom filter, which SIP022 forbids because false positives are unacceptable there. UDP is session-based: an AES-ECB separate header for the AES methods and a merged XChaCha20-Poly1305 construction for ChaCha, with a per-session sliding window replay filter. Servers must route by client session ID, which is only known after decryption, so the crypto layer owns the server-side session table and hands the session back to udprelay for the reply path. The 2022 code lives in aead2022.c and aead2022_udp.c so aead.c keeps its current size, with aead_internal.h carrying what they share. BLAKE3 is vendored (portable backend only) as its own build target. Keys are base64 pre-shared keys of exactly the cipher's key size; per SIP022 a password is never stretched into a key. Verified interoperable in both directions against shadowsocks-rust 1.24.0 for all three ciphers over TCP and UDP, including an 8MB transfer checked by digest, plus unit tests for header framing, partial delivery, tamper detection, and UDP replay rejection.
184 lines
4.8 KiB
Plaintext
184 lines
4.8 KiB
Plaintext
ss-tunnel(1)
|
|
============
|
|
|
|
NAME
|
|
----
|
|
ss-tunnel - shadowsocks tools for local port forwarding, libev port
|
|
|
|
SYNOPSIS
|
|
--------
|
|
*ss-tunnel*
|
|
[-uUv6] [-h|--help]
|
|
[-s <server_host>] [-p <server_port>] [-l <local_port>]
|
|
[-k <password>] [-m <encrypt_method>] [-f <pid_file>]
|
|
[-t <timeout>] [-c <config_file>] [-i <interface>]
|
|
[-b <local_address>] [-a <user_name>] [-n <nofile>]
|
|
[-L addr:port] [--mtu <MTU>] [--mptcp] [--reuse-port] [--no-delay]
|
|
[--plugin <plugin_name>] [--plugin-opts <plugin_options>]
|
|
[--key <key_in_base64>]
|
|
|
|
DESCRIPTION
|
|
-----------
|
|
*Shadowsocks-libev* is a lightweight and secure socks5 proxy.
|
|
It is a port of the original shadowsocks created by clowwindy.
|
|
*Shadowsocks-libev* is written in pure C and takes advantage of libev to
|
|
achieve both high performance and low resource consumption.
|
|
|
|
*Shadowsocks-libev* consists of five components.
|
|
`ss-tunnel`(1) is a tool for local port forwarding.
|
|
See 'OPTIONS' section for special option needed by `ss-tunnel`(1).
|
|
For more information, check out `shadowsocks-libev`(8).
|
|
|
|
OPTIONS
|
|
-------
|
|
-s <server_host>::
|
|
Set the server's hostname or IP.
|
|
|
|
-p <server_port>::
|
|
Set the server's port number.
|
|
|
|
-l <local_port>::
|
|
Set the local port number.
|
|
|
|
-k <password>::
|
|
--password <password>::
|
|
Set the password. The server and the client should use the same password.
|
|
|
|
--key <key_in_base64>::
|
|
Set the key directly. The key should be encoded with URL-safe Base64.
|
|
|
|
-m <encrypt_method>::
|
|
Set the cipher.
|
|
+
|
|
*Shadowsocks-libev* accepts 22 different ciphers:
|
|
+
|
|
2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm,
|
|
2022-blake3-chacha20-poly1305,
|
|
aes-128-gcm, aes-192-gcm, aes-256-gcm,
|
|
rc4-md5, aes-128-cfb, aes-192-cfb, aes-256-cfb,
|
|
aes-128-ctr, aes-192-ctr, aes-256-ctr, bf-cfb,
|
|
camellia-128-cfb, camellia-192-cfb, camellia-256-cfb,
|
|
chacha20-ietf-poly1305, xchacha20-ietf-poly1305,
|
|
salsa20, chacha20 and chacha20-ietf.
|
|
+
|
|
The default cipher is 'chacha20-ietf-poly1305'.
|
|
+
|
|
The '2022-blake3-*' ciphers implement Shadowsocks 2022 (SIP022) and are
|
|
the recommended choice: they provide full replay protection and
|
|
session-based UDP relay. They require a base64-encoded pre-shared key of
|
|
exactly the cipher's key size (16 bytes for 2022-blake3-aes-128-gcm, 32
|
|
bytes for the others) given with *-k*; passwords are not accepted and are
|
|
never stretched into a key. Generate one with `openssl rand -base64 32`.
|
|
+
|
|
If built with PolarSSL or custom OpenSSL libraries, some of
|
|
these ciphers may not work.
|
|
|
|
-a <user_name>::
|
|
Run as a specific user.
|
|
|
|
-f <pid_file>::
|
|
Start shadowsocks as a daemon with specific pid file.
|
|
|
|
-t <timeout>::
|
|
Set the socket timeout in seconds. The default value is 60.
|
|
|
|
-c <config_file>::
|
|
Use a configuration file.
|
|
+
|
|
Refer to `shadowsocks-libev`(8) 'CONFIG FILE' section for more details.
|
|
|
|
-n <number>::
|
|
Specify max number of open files.
|
|
+
|
|
Only available on Linux.
|
|
|
|
-i <interface>::
|
|
Send traffic through specific network interface.
|
|
+
|
|
For example, there are three interfaces in your device,
|
|
which is lo (127.0.0.1), eth0 (192.168.0.1) and eth1 (192.168.0.2).
|
|
Meanwhile, you configure `ss-tunnel` to listen on 0.0.0.0:8388 and bind to eth1.
|
|
That results the traffic go out through eth1, but not lo nor eth0.
|
|
This option is useful to control traffic in multi-interface environment.
|
|
|
|
-b <local_address>::
|
|
Specify the local address to use while this client is making outbound
|
|
connections to the server.
|
|
|
|
-u::
|
|
Enable UDP relay.
|
|
|
|
-U::
|
|
Enable UDP relay and disable TCP relay.
|
|
|
|
-6::
|
|
Resolve hostname to IPv6 address first.
|
|
|
|
-L <addr:port>::
|
|
Specify destination server address and port for local port forwarding.
|
|
+
|
|
Only used and available in tunnel mode.
|
|
|
|
--mtu <MTU>::
|
|
Specify the MTU of your network interface.
|
|
|
|
--mptcp::
|
|
Enable Multipath TCP.
|
|
+
|
|
Only available with MPTCP enabled Linux kernel.
|
|
|
|
--reuse-port::
|
|
Enable port reuse.
|
|
+
|
|
Only available with Linux kernel > 3.9.0.
|
|
|
|
--no-delay::
|
|
Enable TCP_NODELAY.
|
|
|
|
--tcp-incoming-sndbuf <size>::
|
|
Set TCP send buffer size for incoming connections.
|
|
|
|
--tcp-incoming-rcvbuf <size>::
|
|
Set TCP receive buffer size for incoming connections.
|
|
|
|
--tcp-outgoing-sndbuf <size>::
|
|
Set TCP send buffer size for outgoing connections.
|
|
|
|
--tcp-outgoing-rcvbuf <size>::
|
|
Set TCP receive buffer size for outgoing connections.
|
|
|
|
--plugin <plugin_name>::
|
|
Enable SIP003 plugin. (Experimental)
|
|
|
|
--plugin-opts <plugin_options>::
|
|
Set SIP003 plugin options. (Experimental)
|
|
|
|
-v::
|
|
Enable verbose mode.
|
|
|
|
-h|--help::
|
|
Print help message.
|
|
|
|
EXAMPLE
|
|
-------
|
|
`ss-tunnel`(1) can be used to forward DNS queries to a remote DNS server
|
|
through the shadowsocks tunnel. Here is an example:
|
|
|
|
....
|
|
# Forward local UDP port 5353 to 8.8.8.8:53 through the ss-server
|
|
ss-tunnel -s example.com -p 12345 -l 5353 -k foobar -m aes-256-cfb -L 8.8.8.8:53 -u
|
|
|
|
# Then configure your system to use 127.0.0.1:5353 as the DNS server
|
|
dig @127.0.0.1 -p 5353 www.google.com
|
|
....
|
|
|
|
SEE ALSO
|
|
--------
|
|
`ss-local`(1),
|
|
`ss-server`(1),
|
|
`ss-redir`(1),
|
|
`ss-manager`(1),
|
|
`shadowsocks-libev`(8),
|
|
`iptables`(8),
|
|
/etc/shadowsocks-libev/config.json
|