ShadowSocks

Recent Commits

• Max Lv(22 Oct 26)

  chore: fix clippy 1.95 lints (io_other_error, collapsible_match, large_enum_variant)

• Max Lv(22 Oct 26)

  fix(relay): bound idle time of half-closed TCP tunnels With a SIP003 plugin, every proxied connection is a loopback connection from sslocal to the plugin. After the client half-closes, sslocal shuts down its write side and waits for EOF from the plugin. Many plugins (simple-obfs, v2ray-plugin, kcptun/smux, ...) never close their side, so the socket stays in FIN_WAIT_2 forever (tcp_fin_timeout only applies to orphaned sockets, keepalive is answered by the live plugin), leaking an ephemeral port and fd per connection until local ports are exhausted. - CopyBidirectional now fails with TimedOut if the remaining direction stays idle for HALF_CLOSE_IDLE_TIMEOUT (60s) after the other direction has been shut down. The timer restarts on every transferred byte, so long downloads after a half-close keep working. - Plugin::wait_started no longer spins on connect(), and rejects a self-connected socket (src == dst) that would otherwise be mistaken for a started plugin.

• renovate[bot](11 Oct 26)

  chore(deps): update rust crate serde_json to v1.0.154

• renovate[bot](11 Oct 26)

  chore(deps): update rust crate serde_json to v1.0.152

• renovate[bot](10 Oct 26)

  chore(deps): update rust crate zstd to v0.14.2

• renovate[bot](09 Oct 26)

  chore(deps): update rust crate zstd to v0.14.1

• renovate[bot](07 Oct 26)

  chore(deps): update rust crate hyper to v1.12.0

• renovate[bot](03 Oct 26)

  chore(deps): update rust crate tokio to v1.53.2

• renovate[bot](02 Oct 26)

  chore(deps): update rust crate libc to v0.2.190

• renovate[bot](02 Oct 26)

  chore(deps): update rust crate snmalloc-rs to v0.7.6

• renovate[bot](02 Oct 26)

  chore(deps): update rust docker tag to v1.99.0

• Qiu Yuzhou(29 Sept 26)

  feat(local): hot-reload the ACL file at runtime via SIGUSR2 (#2183) * feat(acl): add AclHandle to swap ACL rules atomically at runtime AccessControl is immutable after loading, and ServiceContext used to store it directly, so rules were frozen for the lifetime of the process. Wrap the active rules in an ArcSwap-based AclHandle. Readers take a cheap Arc snapshot which stays valid across a swap, enabling hot-reloading without interrupting the service. reload() re-parses the retained file path and only swaps the new rules in when parsing succeeds. * feat(local): hot-reload the global ACL file through ServiceContext Store the ACL as an AclHandle in ServiceContext. set_acl keeps its signature and wraps the rules in a handle; cloned contexts share it, so every listener sees the same swappable rules. acl() now returns an Arc<AccessControl> snapshot instead of a reference, which cannot be preserved across an atomic swap. ServiceContext::reload_acl() re-reads the ACL file, swaps the new rules in atomically and clears the DNS relay's reverse-lookup cache, which caches decisions derived from the old rules. On failure the previous rules stay active. Server keeps the global context and exposes acl_reload_context() so embedders can trigger reloads. Contexts with a private ACL keep their own handle and are not covered by the global reload. * feat(local): reload the ACL file on SIGUSR2 in sslocal sslocal already reloads its server list from the config file on SIGUSR1. Add a second reload trigger on SIGUSR2 for the ACL file, so routing rules can be updated without restarting the process or interrupting established connections. Like the SIGUSR1 reloader, the task is Unix-only and compiles away on Windows. ssservice's local mode shares this module and inherits it. Document both signals in the README and cover the reload with an integration test that verifies new connections are routed by the new rules after each reload. * refactor(acl): address review feedback for ACL hot-reload - Rename `AclHandle` to `AccessControlHandle`, aligning the name with `AccessControl` - Rename `Server::acl_reload_context` to `Server::context`, so the shared global context can be reused for other runtime operations - Fold reload logging into `AccessControlHandle::reload`, keeping `ServiceContext::reload_acl` thin - Record the config file and the ACL file as absolute paths at load time, so both SIGUSR1 and SIGUSR2 reloads keep working after daemonizing (which `chdir`s to `/`); symlinks are deliberately preserved by resolving with cwd instead of canonicalizing * refactor(local): drop needless pending() in the non-Unix ACL reload task stub The task may complete immediately: the main loop already tolerates early task exit, mirroring the existing Windows behavior of the SIGUSR1 reload task. This also releases the ServiceContext clone right away instead of holding it forever. --------- Co-authored-by: ty <[email protected]>

• ty(29 Sept 26)

  fix(relay): pick non-zero AEAD-2022 padding size for empty first payload SIP022 requires that in a request header, either initial payload or padding MUST be present. When the first payload is empty (e.g. handshake triggered by an empty write for server-first protocols), the client could pick padding 0 with probability 1/901, generating a header that servers MUST reject per the spec, causing ~1/901 handshakes to fail against ssserver built from the same crate. Pick the padding size from 1..=AEAD2022_MAX_PADDING_SIZE instead. fix #2184

• Klaaktu(29 Sept 26)

  systemd unit improvements (#2187) * systemd: Use network-online.target for server Fixes #2186 ss-server needs to wait for the network to be up to be able to bind to non-wildcard IPs. Interface is configured at `network-online.target` but not at `network.target`. ss-local unit is kept the same, with `After=network.target` for proper ordering at shutdown - unit is stopped before network is shutdown. * systemd unit: improvements `exec` is [recommended](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Type=). Add `NoNewPriviledges` which has been used in [Arch packaging](https://gitlab.archlinux.org/archlinux/packaging/packages/shadowsocks-rust/-/blob/main/shadowsocks-rust-server%40.service?ref_type=heads). Add `CAP_NET_ADMIN` in ss-local which is needed for TUN mode. Removed `CAP_NET_BIND_SERVICE` from ss-local. Do you really need to bind to priviledged port in *client*? Debian unit left un-hardened. I'm not sure why it's different from the other ss-server unit.

• renovate[bot](28 Sept 26)

  chore(deps): update rust crate tokio-rustls to v0.26.6

• renovate[bot](27 Sept 26)

  chore(deps): update rust crate sendfd to v0.4.5

• renovate[bot](25 Sept 26)

  chore(deps): update rust crate rand to v0.10.3

• renovate[bot](25 Sept 26)

  chore(deps): update rust crate clap to v4.6.7

• renovate[bot](25 Sept 26)

  chore(deps): update rust crate bloomfilter to v3.0.2

• renovate[bot](25 Sept 26)

  chore(deps): update rust crate thiserror to v2.0.21

• renovate[bot](25 Sept 26)

  chore(deps): update rust crate cfg-if to v1.0.5

• ty(25 Sept 26)

  fix: RUSTSEC-2026-0285

• ty(25 Sept 26)

  fix(tcprelay): report actual plaintext length when retrying after Pending EncryptedWriter.poll_write_encrypted keeps the encrypted buffer and its on-wire offset across Poll::Pending, but returned the length of the buffer passed on the *retried* call instead of the plaintext length that was actually assembled into the pending frame. Tokio's copy/copy_bidirectional may append freshly read data to the input slice while the writer is Pending, so the reported count could exceed what was actually encrypted and sent, silently dropping the appended bytes. Fixes #2175

• ty(25 Sept 26)

  fix: updated chacha20 to v0.10.2, v0.10.1 yanked

• ty(25 Sept 26)

  fix(local-tun): enable smoltcp "auto-icmp-echo-reply" feature to reply ICMP Echo Request smoltcp 0.13 (PR smoltcp-rs/smoltcp#1106) made automatic ICMP echo replies opt-in via the "auto-icmp-echo-reply" feature flag. It is only part of smoltcp's default features, which this crate disables with default-features = false. Since the smoltcp 0.13 upgrade, the Tun local silently drops ICMP Echo Requests and no longer responds to ping. Fixes #2178

• renovate[bot](11 Sept 26)

  chore(deps): update rust crate hickory-resolver to v0.26.3 (#2173) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• renovate[bot](09 Sept 26)

  chore(deps): update rust docker tag to v1.98.1

• renovate[bot](09 Sept 26)

  chore(deps): update rust crate reqwest to v0.13.5

• renovate[bot](06 Sept 26)

  chore(deps): update rust crate ipnet to v2.12.2

• renovate[bot](04 Sept 26)

  fix(deps): update rust crate zstd to 0.14