shadowsocks

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 27, 2020 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source
const MaxCapacity = 20_000

MaxCapacity is the largest allowed size of ReplayCache.

Capacities in excess of 20,000 are not recommended, due to the false positive rate of up to 2 * capacity / 2^32 = 1 / 100,000. If larger capacities are desired, the key type should be changed to uint64.

View Source
const ServerSaltMarkLen = 4 // Must be less than or equal to SHA1.Size()

ServerSaltMarkLen is the number of bytes of salt to use as a marker. Increasing this value reduces the false positive rate, but increases the likelihood of salt collisions.

Variables

This section is empty.

Functions

func MakeTestPayload added in v1.0.3

func MakeTestPayload(size int) []byte

MakeTestPayload returns a slice of `size` arbitrary bytes.

func MakeTestSecrets added in v1.1.1

func MakeTestSecrets(n int) []string

MakeTestSecrets returns a slice of `n` test passwords. Not secure!

func NewAddr added in v1.0.6

func NewAddr(address, network string) net.Addr

NewAddr returns a net.Addr that holds an address of the form `host:port` with a domain name or IP as host. Used for SOCKS addressing.

Types

type ChunkReader added in v1.1.5

type ChunkReader interface {
	// ReadChunk reads the next chunk and returns its payload.  The caller must
	// complete its use of the returned buffer before the next call.
	// The buffer is nil iff there is an error.  io.EOF indicates a close.
	ReadChunk() ([]byte, error)
}

ChunkReader is similar to io.Reader, except that it controls its own buffer granularity.

type CipherEntry added in v1.0.3

type CipherEntry struct {
	ID            string
	Cipher        shadowaead.Cipher
	SaltGenerator ServerSaltGenerator
	// contains filtered or unexported fields
}

CipherEntry holds a Cipher with an identifier. The public fields are constant, but lastClientIP is mutable under cipherList.mu.

func MakeCipherEntry added in v1.2.0

func MakeCipherEntry(id string, cipher shadowaead.Cipher, secret string) CipherEntry

MakeCipherEntry constructs a CipherEntry.

type CipherList added in v1.0.3

type CipherList interface {
	// Returns a snapshot of the cipher list optimized for this client IP,
	// and also the number of bytes needed for TCP trial decryption.
	SnapshotForClientIP(clientIP net.IP) (int, []*list.Element)
	MarkUsedByClientIP(e *list.Element, clientIP net.IP)
	// Update replaces the current contents of the CipherList with `contents`,
	// which is a List of *CipherEntry.  Update takes ownership of `contents`,
	// which must not be read or written after this call.
	Update(contents *list.List) error
}

CipherList is a thread-safe collection of CipherEntry elements that allows for snapshotting and moving to front.

func MakeTestCiphers added in v1.0.3

func MakeTestCiphers(secrets []string) (CipherList, error)

MakeTestCiphers creates a CipherList containing one fresh AEAD cipher for each secret in `secrets`.

func NewCipherList added in v1.0.3

func NewCipherList() CipherList

NewCipherList creates an empty CipherList

type Client added in v1.0.6

type Client interface {
	// DialTCP connects to `raddr` over TCP though a Shadowsocks proxy.
	// `laddr` is a local bind address, a local address is automatically chosen if nil.
	// `raddr` has the form `host:port`, where `host` can be a domain name or IP address.
	DialTCP(laddr *net.TCPAddr, raddr string) (onet.DuplexConn, error)

	// ListenUDP relays UDP packets though a Shadowsocks proxy.
	// `laddr` is a local bind address, a local address is automatically chosen if nil.
	ListenUDP(laddr *net.UDPAddr) (net.PacketConn, error)
}

Client is a client for Shadowsocks TCP and UDP connections.

func NewClient added in v1.0.6

func NewClient(host string, port int, password, cipher string) (Client, error)

NewClient creates a client that routes connections to a Shadowsocks proxy listening at `host:port`, with authentication parameters `cipher` (AEAD) and `password`. TODO: add a dialer argument to support proxy chaining and transport changes.

type Reader added in v1.1.0

type Reader interface {
	io.Reader
	io.WriterTo
}

Reader is an io.Reader that also implements io.WriterTo to allow for piping the data without extra allocations and copies.

func NewShadowsocksReader

func NewShadowsocksReader(reader io.Reader, ssCipher shadowaead.Cipher) Reader

NewShadowsocksReader creates a Reader that decrypts the given Reader using the shadowsocks protocol with the given shadowsocks cipher.

type ReplayCache added in v1.0.8

type ReplayCache struct {
	// contains filtered or unexported fields
}

ReplayCache allows us to check whether a handshake salt was used within the last `capacity` handshakes. It requires approximately 20*capacity bytes of memory (as measured by BenchmarkReplayCache_Creation).

The nil and zero values represent a cache with capacity 0, i.e. no cache.

func NewReplayCache added in v1.0.8

func NewReplayCache(capacity int) ReplayCache

NewReplayCache returns a fresh ReplayCache that promises to remember at least the most recent `capacity` handshakes.

func (*ReplayCache) Add added in v1.0.8

func (c *ReplayCache) Add(id string, salt []byte) bool

Add a handshake with this key ID and salt to the cache. Returns false if it is already present.

type SaltGenerator added in v1.2.0

type SaltGenerator interface {
	// Returns a new salt
	GetSalt(salt []byte) error
}

SaltGenerator generates unique salts to use in Shadowsocks connections.

type ServerSaltGenerator added in v1.2.0

type ServerSaltGenerator interface {
	SaltGenerator
	// IsServerSalt returns true if the salt was created by this generator
	// and is marked as server-originated.
	IsServerSalt(salt []byte) bool
}

ServerSaltGenerator offers the ability to check if a salt was marked as server-originated.

var RandomSaltGenerator ServerSaltGenerator = randomSaltGenerator{}

RandomSaltGenerator is a basic SaltGenerator.

func NewServerSaltGenerator added in v1.2.0

func NewServerSaltGenerator(secret string) ServerSaltGenerator

NewServerSaltGenerator returns a SaltGenerator whose output is apparently random, but is secretly marked as being issued by the server. This is useful to prevent the server from accepting its own output in a reflection attack.

type TCPService

type TCPService interface {
	// Serve adopts the listener, which will be closed before Serve returns.  Serve returns an error unless Stop() was called.
	Serve(listener *net.TCPListener) error
	// Stop closes the listener but does not interfere with existing connections.
	Stop() error
	// GracefulStop calls Stop(), and then blocks until all resources have been cleaned up.
	GracefulStop() error
}

TCPService is a Shadowsocks TCP service that can be started and stopped.

func NewTCPService

func NewTCPService(ciphers CipherList, replayCache *ReplayCache, m metrics.ShadowsocksMetrics, timeout time.Duration) TCPService

NewTCPService creates a TCPService `replayCache` is a pointer to SSServer.replayCache, to share the cache among all ports.

type UDPService

type UDPService interface {
	// Serve adopts the clientConn, and will not return until it is closed by Stop().
	Serve(clientConn net.PacketConn) error
	// Stop closes the clientConn and prevents further forwarding of packets.
	Stop() error
	// GracefulStop calls Stop(), and then blocks until all resources have been cleaned up.
	GracefulStop() error
}

UDPService is a running UDP shadowsocks proxy that can be stopped.

func NewUDPService

func NewUDPService(natTimeout time.Duration, cipherList CipherList, m metrics.ShadowsocksMetrics) UDPService

NewUDPService creates a UDPService

type Writer added in v1.1.0

type Writer struct {
	// contains filtered or unexported fields
}

Writer is an io.Writer that also implements io.ReaderFrom to allow for piping the data without extra allocations and copies. The LazyWrite and Flush methods allow a header to be added but delayed until the first write, for concatenation. All methods except Flush must be called from a single thread.

func NewShadowsocksWriter

func NewShadowsocksWriter(writer io.Writer, ssCipher shadowaead.Cipher) *Writer

NewShadowsocksWriter creates a Writer that encrypts the given Writer using the shadowsocks protocol with the given shadowsocks cipher.

func (*Writer) Flush added in v1.1.8

func (sw *Writer) Flush() error

Flush sends the pending data, if any. This method is thread-safe.

func (*Writer) LazyWrite added in v1.1.8

func (sw *Writer) LazyWrite(p []byte) (int, error)

LazyWrite queues p to be written, but doesn't send it until Flush() is called, a non-lazy write is made, or the buffer is filled.

func (*Writer) ReadFrom added in v1.2.0

func (sw *Writer) ReadFrom(r io.Reader) (int64, error)

ReadFrom implements the io.ReaderFrom interface.

func (*Writer) SetSaltGenerator added in v1.2.0

func (sw *Writer) SetSaltGenerator(saltGenerator SaltGenerator)

SetSaltGenerator sets the salt generator to be used. Must be called before the first write.

func (*Writer) Write added in v1.2.0

func (sw *Writer) Write(p []byte) (int, error)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL