mirror of
https://github.com/shadowsocks/shadowsocks-libev.git
synced 2026-10-21 14:33:55 +00:00
Max LvandClaude
553cdc7945
Add `ss-local --printable-salt` / `"printable_salt": true`, disabled by default. For each outgoing TCP salt it picks a prefix length uniformly from 6-12 bytes and samples those bytes as printable ASCII (0x20-0x7e) immediately before key derivation. The salt stays 32 bytes with no framing or markers, so the wire format is unchanged and any stock server interoperates. Only chacha20-ietf-poly1305 and aes-256-gcm are accepted; other ciphers fail at startup. UDP, server responses, and AEAD-2022 are untouched. Crypto unit tests cover length distribution, empty first writes, exact framing overhead, salt-tail preservation, byte-at-a-time decryption, tampering and replay rejection. CLI tests check local-only exposure and cipher rejection via flag, config key and bad config type. interop.py gains --printable-salt and --server-bin for independent stock servers. docs/printable-salt.md records the design, entropy bound, fingerprint caveats and route-experiment procedure; docs/encoding-experiments.md and tests/experiments/ hold the Base85/lowpop85/TLS outer-transport prototypes. docs/measurements/printable-salt-2026-09-23/ archives the sanitized results of the aborted field trials. Co-authored-by: Claude <noreply@anthropic.com>
34 lines
1.2 KiB
Plaintext
34 lines
1.2 KiB
Plaintext
_ss_local()
|
|
{
|
|
local cur prev opts ciphers
|
|
opts='-s -p -l -k -m -a -f -t -c -n -i -b -u -U -v -h --reuse-port --fast-open --acl --mtu --mptcp --no-delay --printable-salt --key --plugin --plugin-opts --help'
|
|
ciphers='rc4-md5 aes-128-gcm aes-192-gcm aes-256-gcm aes-128-cfb aes-192-cfb aes-256-cfb aes-128-ctr aes-192-ctr aes-256-ctr camellia-128-cfb camellia-192-cfb camellia-256-cfb bf-cfb chacha20-ietf-poly1305 xchacha20-ietf-poly1305 salsa20 chacha20 chacha20-ietf'
|
|
cur=${COMP_WORDS[COMP_CWORD]}
|
|
prev="${COMP_WORDS[COMP_CWORD-1]}"
|
|
case "$prev" in
|
|
-f|-c|--acl)
|
|
_filedir || COMPREPLY=( $(compgen -o plusdirs -f ${cur}) )
|
|
;;
|
|
-s|-b)
|
|
_known_hosts_real -- "${cur}" || OMPREPLY=( $(compgen -A hostname -- ${cur}) )
|
|
;;
|
|
-m)
|
|
COMPREPLY=( $(compgen -W "$ciphers" -- ${cur}) )
|
|
;;
|
|
-a)
|
|
_allowed_users || COMPREPLY=( $(compgen -u -- ${cur}) )
|
|
;;
|
|
-p|-l|-k|-t|-n|--mtu|--key|--plugin|--plugin-opts)
|
|
;;
|
|
-i)
|
|
_available_interfaces -a || true
|
|
;;
|
|
*)
|
|
COMPREPLY+=( $(compgen -W "${opts}" -- ${cur}) )
|
|
;;
|
|
esac
|
|
return 0
|
|
}
|
|
|
|
complete -F _ss_local ss-local
|