Merge pull request w910820618#2 from shadowsocks/master

Update fork

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/build.yml

@@ -0,0 +1,12 @@
+name: Build and test
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/setup-go@v1
+      with:
+        go-version: 1.15
+    - uses: actions/checkout@v2
+    - run: make -j all
+    - run: make -j test

.github/workflows/release.yml

@@ -0,0 +1,16 @@
+name: Build and release
+on: 
+  release:
+    types: [published]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v1
+        with:
+          go-version: 1.15
+      - run: make -j upload
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_RELEASE_UPLOAD_URL: ${{ github.event.release.upload_url }}

Dockerfile

@@ -0,0 +1,20 @@
+FROM golang:1.15.0-alpine3.12 AS builder
+
+ENV GO111MODULE on
+ENV GOPROXY https://goproxy.cn
+
+RUN apk upgrade \
+    && apk add git \
+    && go get github.com/shadowsocks/go-shadowsocks2
+
+FROM alpine:3.12 AS dist
+
+LABEL maintainer="mritd <mritd@linux.com>"
+
+RUN apk upgrade \
+    && apk add tzdata \
+    && rm -rf /var/cache/apk/*
+
+COPY --from=builder /go/bin/go-shadowsocks2 /usr/bin/shadowsocks
+
+ENTRYPOINT ["shadowsocks"]

Makefile

@@ -3,7 +3,7 @@ BINDIR=bin
 GOBUILD=CGO_ENABLED=0 go build -ldflags '-w -s'
 # The -w and -s flags reduce binary sizes by excluding unnecessary symbols and debug info
 
-all: linux macos win64
+all: linux macos win64 win32
 
 linux:
 	GOARCH=amd64 GOOS=linux $(GOBUILD) -o $(BINDIR)/$(NAME)-$@
@@ -14,11 +14,39 @@ macos:
 win64:
 	GOARCH=amd64 GOOS=windows $(GOBUILD) -o $(BINDIR)/$(NAME)-$@.exe
 
-releases: linux macos win64
+win32:
+	GOARCH=386 GOOS=windows $(GOBUILD) -o $(BINDIR)/$(NAME)-$@.exe
+
+
+test: test-linux test-macos test-win64 test-win32
+
+test-linux:
+	GOARCH=amd64 GOOS=linux go test
+
+test-macos:
+	GOARCH=amd64 GOOS=darwin go test
+
+test-win64:
+	GOARCH=amd64 GOOS=windows go test
+
+test-win32:
+	GOARCH=386 GOOS=windows go test
+
+releases: linux macos win64 win32
 	chmod +x $(BINDIR)/$(NAME)-*
 	gzip $(BINDIR)/$(NAME)-linux
 	gzip $(BINDIR)/$(NAME)-macos
+	zip -m -j $(BINDIR)/$(NAME)-win32.zip $(BINDIR)/$(NAME)-win32.exe
 	zip -m -j $(BINDIR)/$(NAME)-win64.zip $(BINDIR)/$(NAME)-win64.exe
 
 clean:
-	rm $(BINDIR)/*
+	rm $(BINDIR)/*
+
+# Remove trailing {} from the release upload url
+GITHUB_UPLOAD_URL=$(shell echo $${GITHUB_RELEASE_UPLOAD_URL%\{*})
+
+upload: releases
+	curl -H "Authorization: token $(GITHUB_TOKEN)" -H "Content-Type: application/gzip" --data-binary @$(BINDIR)/$(NAME)-linux.gz  "$(GITHUB_UPLOAD_URL)?name=$(NAME)-linux.gz"
+	curl -H "Authorization: token $(GITHUB_TOKEN)" -H "Content-Type: application/gzip" --data-binary @$(BINDIR)/$(NAME)-macos.gz  "$(GITHUB_UPLOAD_URL)?name=$(NAME)-macos.gz"
+	curl -H "Authorization: token $(GITHUB_TOKEN)" -H "Content-Type: application/zip"  --data-binary @$(BINDIR)/$(NAME)-win64.zip "$(GITHUB_UPLOAD_URL)?name=$(NAME)-win64.zip"
+	curl -H "Authorization: token $(GITHUB_TOKEN)" -H "Content-Type: application/zip"  --data-binary @$(BINDIR)/$(NAME)-win32.zip "$(GITHUB_UPLOAD_URL)?name=$(NAME)-win32.zip"

README.md

@@ -4,15 +4,18 @@ A fresh implementation of Shadowsocks in Go.
 
 GoDoc at https://godoc.org/github.com/shadowsocks/go-shadowsocks2/
 
-[![Build Status](https://travis-ci.org/shadowsocks/go-shadowsocks2.svg?branch=master)](https://travis-ci.org/shadowsocks/go-shadowsocks2)
+![Build and test](https://github.com/shadowsocks/go-shadowsocks2/workflows/Build%20and%20test/badge.svg)
 
 
 ## Features
 
 - [x] SOCKS5 proxy with UDP Associate
-- [x] Support for Netfilter TCP redirect (IPv6 should work but not tested)
+- [x] Support for Netfilter TCP redirect on Linux (IPv6 should work but not tested)
+- [x] Support for Packet Filter TCP redirect on MacOS/Darwin (IPv4 only)
 - [x] UDP tunneling (e.g. relay DNS packets)
 - [x] TCP tunneling (e.g. benchmark with iperf3)
+- [x] SIP003 plugins
+- [x] Replay attack mitigation
 
 
 ## Install
@@ -33,7 +36,7 @@ go get -u -v github.com/shadowsocks/go-shadowsocks2
 Start a server listening on port 8488 using `AEAD_CHACHA20_POLY1305` AEAD cipher with password `your-password`.
 
 ```sh
-shadowsocks2 -s 'ss://AEAD_CHACHA20_POLY1305:your-password@:8488' -verbose
+go-shadowsocks2 -s 'ss://AEAD_CHACHA20_POLY1305:your-password@:8488' -verbose
 ```
 
 
@@ -44,7 +47,7 @@ connections, and tunnels both UDP and TCP on port 8053 and port 8054 to 8.8.8.8:
 respectively. 
 
 ```sh
-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' \
+go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' \
     -verbose -socks :1080 -u -udptun :8053=8.8.8.8:53,:8054=8.8.4.4:53 \
                              -tcptun :8053=8.8.8.8:53,:8054=8.8.4.4:53
 ```
@@ -55,7 +58,7 @@ Replace `[server_address]` with the server's public address.
 ## Advanced Usage
 
 
-### Netfilter TCP redirect (Linux only)
+### Netfilter TCP redirect on Linux
 
 The client offers `-redir` and `-redir6` (for IPv6) options to handle TCP connections 
 redirected by Netfilter on Linux. The feature works similar to `ss-redir` from `shadowsocks-libev`.
@@ -65,7 +68,7 @@ Start a client listening on port 1082 for redirected TCP connections and port 10
 TCP IPv6 connections.
 
 ```sh
-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' -redir :1082 -redir6 :1083
+go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' -redir :1082 -redir6 :1083
 ```
 
 
@@ -86,7 +89,7 @@ Start a client on the same machine with the server. The client listens on port 1
 and tunnels to localhost:5201 where iperf3 is listening.
 
 ```sh
-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' -tcptun :1090=localhost:5201
+go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' -tcptun :1090=localhost:5201
 ```
 
 Start iperf3 client to connect to the tunneld port instead
@@ -95,6 +98,42 @@ Start iperf3 client to connect to the tunneld port instead
 iperf3 -c localhost -p 1090
 ```
 
+### SIP003 Plugins (Experimental)
+
+Both client and server support SIP003 plugins.
+Use `-plugin` and `-plugin-opts` parameters to enable.
+
+Client:
+
+```sh
+go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' \
+    -verbose -socks :1080 -u -plugin v2ray
+```
+Server:
+
+```sh
+go-shadowsocks2 -s 'ss://AEAD_CHACHA20_POLY1305:your-password@:8488' -verbose \
+    -plugin v2ray -plugin-opts "server"
+```
+Note:
+
+It will look for the plugin in the current directory first, then `$PATH`.
+
+UDP connections will not be affected by SIP003.
+
+### Replay Attack Mitigation
+
+By default a [Bloom filter](https://en.wikipedia.org/wiki/Bloom_filter) is deployed to defend against [replay attacks](https://en.wikipedia.org/wiki/Replay_attack).
+Use the following environment variables to fine-tune the mechanism:
+
+- `SHADOWSOCKS_SF_CAPACITY`: Number of recent connections to track. Default `1e6` (one million). Setting it to 0 disables the feature.
+- `SHADOWSOCKS_SF_FPR`: False positive rate of the Bloom filter. Default `1e-6` (0.0001%). This should be enough for most cases.
+- `SHADOWSOCKS_SF_SLOT`: The Bloom filter is divided into a number (default `10`) of slots. When the Bloom filter is full, the
+  oldest slot will be cleared for recycling. In general you should not change this number unless you understand what you are doing.
+
+```sh
+SHADOWSOCKS_SF_CAPACITY=1e6 SHADOWSOCKS_SF_FPR=1e-6 SHADOWSOCKS_SF_SLOT=10 go-shadowsocks2 ...
+```
 
 ## Design Principles