Max LvandClaude 90ea095efe Fix findings from the security audit ...

Remote:
- TCP: handshake/connect deadlines follow --timeout instead of a 24h
  minimum, so idle sockets can no longer fill the connection pool.
- ACL: IPv4-mapped IPv6 addresses are matched against the IPv4 lists.
- UDP server now enforces the peer ACL and the outbound block list.
- ACL loading fails closed on bad files or invalid entries.
- TCP half-close is relayed instead of tearing the connection down.
- AEAD-2022 UDP sessions are created only after timestamp/replay checks.

ss-manager:
- Owner-only conf files (deleted on remove), 0600 control socket,
  umask 022, safe working directory, loopback-only IP addresses,
  per-user sender check on Linux, plugins only over the UNIX socket.
- Port canonicalisation, list() overflow, add/remove waits for the
  server, stale pid files can't signal unrelated processes.

Also: plugins drop to --user, daemonize readiness/pid file handling,
resolver cancellation, replay-filter fail-closed, key wiping, spec
strictness in AEAD/2022 parsing, JSON surrogate validation, ss:// plugin
name checks, embedding API state reset, Android protect_socket replies.

Adds tests/test_server_acl.py and tests/test_half_close.py and extends
the manager, ACL, AEAD-2022 and ssurl tests.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-10-27 16:30:19 +08:00

..

CMakeLists.txt

C++20 port 15/15: remove the stream ciphers (#3079)

2026-10-15 10:15:53 +08:00

Doxyfile.in

C++20 port 14/14: remove the C shims, report, fixes (#3077)

2026-10-15 10:11:56 +08:00

index.md

Accept combined server endpoints with strict IPv6 parsing

2026-09-13 07:15:28 +08:00

shadowsocks-c.md

C++20 port 15/15: remove the stream ciphers (#3079)

2026-10-15 10:15:53 +08:00

ss-local.md

C++20 port 4/14: compile the event loop, UDP relay and programs as C++ (#3068)

2026-10-15 09:53:31 +08:00

ss-manager.md

Fix findings from the security audit

2026-10-27 16:30:19 +08:00

ss-nat.md

Publish native Doxygen documentation with GitHub Pages

2026-09-12 14:46:42 +08:00

ss-redir.md

C++20 port 4/14: compile the event loop, UDP relay and programs as C++ (#3068)

2026-10-15 09:53:31 +08:00

ss-server.md

C++20 port 4/14: compile the event loop, UDP relay and programs as C++ (#3068)

2026-10-15 09:53:31 +08:00

ss-tunnel.md

C++20 port 4/14: compile the event loop, UDP relay and programs as C++ (#3068)

2026-10-15 09:53:31 +08:00