Shadowsocks 生锈
1.21.2
这是shadowsocks的一个端口。
Shadowsocks 是一个快速隧道代理，可以帮助您绕过防火墙。
| 图书馆 | 描述 |
|---|---|
| 影子袜子 | Shadowsocks核心协议 |
| Shadowsocks 服务 | 提供 Shadowsocks 的服务 |
| Shadowsocks-Rust | 运行常见 Shadowsocks 服务的二进制文件 |
相关项目：
sslocal的 GUI，讨论sslocal的 OpenWRT 解决方案，讨论hickory-dns - 使用hickory-resolver作为 DNS 解析器，而不是tokio的内置解析器。
local-http - 允许使用 HTTP 协议进行sslocal
local-http-native-tls - 使用native-tls支持 HTTPS
local-http-rustls - 使用rustls支持 HTTPS
local-tunnel - 允许使用sslocal隧道协议
local-socks4 - 允许对sslocal使用 SOCKS4/4a 协议
local-redir - 允许对sslocal使用 redir（透明代理）协议
local-dns - 允许使用sslocal的 dns 协议，作为 DNS 服务器通过 ACL 规则代理查询本地或远程 DNS 服务器
local-fake-dns - FakeDNS，为特定 IP 池中的每个单独查询分配 IP 地址
local-tun - sslocal的 TUN 接口支持
local-online-config - SIP008在线配置下发
stream-cipher - 启用已弃用的流密码。警告：流密码不安全！
aead-cipher-extra - 启用非标准 AEAD 密码
aead-cipher-2022 - 启用 AEAD-2022 密码 (SIP022)
aead-cipher-2022-extra - 启用 AEAD-2022 额外密码（非标准密码）
该项目使用系统（libc）内存分配器（Rust 的默认值）。但它还允许您按功能使用其他著名的分配器：
jemalloc - 使用 jemalloc 作为全局内存分配器mimalloc - 使用 mi-malloc 作为全局内存分配器tcmalloc - 使用 TCMalloc 作为全局内存分配器。默认情况下，它尝试链接系统范围的 tcmalloc，使用tcmalloc-vendored的源供应商。snmalloc - 使用 snmalloc 作为全局内存分配器rpmalloc - 使用 rpmalloc 作为全局内存分配器从 crates.io 安装：
# Install from crates.io
cargo install shadowsocks-rust然后你可以在$CARGO_HOME/bin中找到sslocal和ssserver 。
对于 macOS 和 Linux，您可以使用 Homebrew 安装它：
brew install shadowsocks-rust # Install from snapstore
snap install shadowsocks-rust
# List services
snap services shadowsocks-rust
# Enable and start shadowsocks-rust.sslocal-daemon snap service
snap start --enable shadowsocks-rust.sslocal-daemon
# Show generated systemd service status
systemctl status snap.shadowsocks-rust.sslocal-daemon.service
# Override generated systemd service (configure startup options)
systemctl edit snap.shadowsocks-rust.sslocal-daemon.service
# # NOTE: you can pass args to sslocal:
# # [Service]
# # ExecStart=
# # ExecStart=/usr/bin/snap run shadowsocks-rust.sslocal-daemon -b "127.0.0.1:1080" --server-url "ss://...."
# Restart generated systemd service to apply changes
systemctl restart snap.shadowsocks-rust.sslocal-daemon.service
# ... and show service status
systemctl status snap.shadowsocks-rust.sslocal-daemon.service在这里下载静态链接版本。
build-windows ：为x86_64-pc-windows-msvc构建build-linux : 为x86_64-unknown-linux-gnu 、Debian 9 (Stretch)、GLIBC 2.18 构建build-docker ：为x86_64-unknown-linux-musl 、 x86_64-pc-windows-gnu构建，...（静态链接）该项目为linux/i386和linux/amd64以及linux/arm64/v8架构提供了 Docker 镜像。
⚠️ 默认情况下，Docker 容器无法访问 IPv6 ：请确保在客户端中禁用 IPv6 路由或启用对 Docker 容器的 IPv6 访问。
Docker 将从我们的 GitHub 包中提取适当架构的镜像。
docker pull ghcr.io/shadowsocks/sslocal-rust:latest
docker pull ghcr.io/shadowsocks/ssserver-rust:latest如果您想自己构建Docker镜像，则需要使用BuildX。
docker buildx build -t shadowsocks/ssserver-rust:latest -t shadowsocks/ssserver-rust:v1.15.2 --target ssserver .
docker buildx build -t shadowsocks/sslocal-rust:latest -t shadowsocks/sslocal-rust:v1.15.2 --target sslocal . 您需要将配置文件挂载到容器中，并创建外部端口映射以供容器连接到它。
docker run --name sslocal-rust
--restart always
-p 1080:1080/tcp
-v /path/to/config.json:/etc/shadowsocks-rust/config.json
-dit ghcr.io/shadowsocks/sslocal-rust:latest
docker run --name ssserver-rust
--restart always
-p 8388:8388/tcp
-p 8388:8388/udp
-v /path/to/config.json:/etc/shadowsocks-rust/config.json
-dit ghcr.io/shadowsocks/ssserver-rust:latest该项目提供了用于部署到 Kubernetes 的 yaml 清单。
您可以利用 k8s 服务将流量暴露到外部，例如 LoadBalancer 或 NodePort，与固定主机或端口相比，它们获得更细粒度的流量。
对于更有趣的用例，您可以使用 Ingress（Istio、nginx 等），它将匹配的流量与真实的 Web 服务一起路由到 Shadowsocks。
kubectl kubectl apply -f https://github.com/shadowsocks/shadowsocks-rust/raw/master/k8s/shadowsocks-rust.yaml
您可以通过编辑名为shadowsocks-rust的ConfigMap来更改配置。
要进行更细粒度的控制，请使用helm 。
helm helm install my-release k8s/chart -f my-values.yaml
以下是您可以更改的常见默认值：
# This is the shadowsocks config which will be mount to /etc/shadowocks-rust.
# You can put arbitrary yaml here, and it will be translated to json before mounting.
servers :
- server : " :: "
server_port : 8388
service_port : 80 # the k8s service port, default to server_port
password : mypassword
method : aes-256-gcm
fast_open : true
mode : tcp_and_udp
# plugin: v2ray-plugin
# plugin_opts: server;tls;host=github.com
# Whether to download v2ray and xray plugin.
downloadPlugins : false
# Name of the ConfigMap with config.json configuration for shadowsocks-rust.
configMapName : " "
service :
# Change to LoadBalancer if you are behind a cloud provider like aws, gce, or tke.
type : ClusterIP
# Bind shadowsocks port port to host, i.e., we can use host:port to access shawdowsocks server.
hostPort : false
replicaCount : 1
image :
repository : ghcr.io/shadowsocks/ssserver-rust
pullPolicy : IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag : " latest "使用货物来建造。注意： RAM >= 2GiB
cargo build --release然后sslocal和ssserver将出现在./target/(debug|release)/中，其工作方式与官方 ShadowSocks 实现中的两个二进制文件类似。
make install TARGET=release然后sslocal 、 ssserver 、 ssmanager和ssurl将被安装到/usr/local/bin （变量 PREFIX）。
对于Windows用户，如果您在构建过程中遇到任何问题，请在#102中查看并讨论。
如果您正在针对当前的 CPU 平台进行构建（例如，在个人计算机上构建并运行），建议设置target-cpu=native功能，让rustc为运行编译器的 CPU 生成和优化代码。
export RUSTFLAGS= " -C target-cpu=native "要求：
./build/build-release然后sslocal , ssserver , ssmanager和ssurl将被打包在
./build/shadowsocks-${VERSION}-stable.x86_64-unknown-linux-musl.tar.xz./build/shadowsocks-${VERSION}-stable.x86_64-pc-windows-gnu.zip阅读Cargo.toml了解更多详细信息。
使用以下命令为特定加密方法（示例中的aes-128-gcm ）生成安全密码：
ssservice genkey -m " aes-128-gcm "创建 ShadowSocks 的配置文件。例子
{
"server" : "my_server_ip" ,
"server_port" : 8388 ,
"password" : "rwQc8qPXVsRpGx3uW+Y3Lj4Y42yF9Bs0xg1pmx8/+bo=" ,
"method" : "aes-256-gcm" ,
// ONLY FOR `sslocal`
// Delete these lines if you are running `ssserver` or `ssmanager`
"local_address" : "127.0.0.1" ,
"local_port" : 1080
}配置文件的详细解释可以在shadowsocks的文档中找到。 （原始项目的链接，不再维护！）
⚠️ 对于 snap 安装，配置文件很可能位于/var/snap/shadowsocks-rust/common/etc/shadowsocks-rust/config.json中（参见 #621 / #1146）
在shadowsocks-rust中，我们还有一种扩展的配置文件格式，它能够定义多个服务器。您还可以禁用单个服务器。
{
"servers" : [
{
"server" : "127.0.0.1" ,
"server_port" : 8388 ,
"password" : "rwQc8qPXVsRpGx3uW+Y3Lj4Y42yF9Bs0xg1pmx8/+bo=" ,
"method" : "aes-256-gcm" ,
"timeout" : 7200
} ,
{
"server" : "127.0.0.1" ,
"server_port" : 8389 ,
"password" : "/dliNXn5V4jg6vBW4MnC1I8Jljg9x7vSihmk6UZpRBM=" ,
"method" : "chacha20-ietf-poly1305"
} ,
{
"disabled" : true ,
"server" : "eg.disable.me" ,
"server_port" : 8390 ,
"password" : "mGvbWWay8ueP9IHnV5F1uWGN2BRToiVCAWJmWOTLU24=" ,
"method" : "chacha20-ietf-poly1305"
}
] ,
// ONLY FOR `sslocal`
// Delete these lines if you are running `ssserver` or `ssmanager`
"local_port" : 1080 ,
"local_address" : "127.0.0.1"
} sslocal自动选择具有最低延迟和最高可用性的最佳服务器。
使用以下命令启动 Shadowsocks 客户端和服务器：
sslocal -c config.json
ssserver -c config.json如果你用 Cargo 构建它：
cargo run --bin sslocal -- -c config.json
cargo run --bin ssserver -- -c config.json使用-h列出所有可用参数。
使用配置文件启动本地客户端
# Read local client configuration from file
sslocal -c /path/to/shadowsocks.json # Pass all parameters via command line
sslocal -b " 127.0.0.1:1080 " -s " [::1]:8388 " -m " aes-256-gcm " -k " hello-kitty " --plugin " v2ray-plugin " --plugin-opts " server;tls;host=github.com "
# Pass server with SIP002 URL
sslocal -b " 127.0.0.1:1080 " --server-url " ss://[email protected]:8388/?plugin=v2ray-plugin%3Bserver%3Btls%3Bhost%3Dgithub.com "sslocal -b " 127.0.0.1:3128 " --protocol http -s " [::1]:8388 " -m " aes-256-gcm " -k " hello-kitty "所有参数与 Socks5 客户端相同，除了--protocol http 。
# Set 127.0.0.1:8080 as the target for forwarding to
sslocal --protocol tunnel -b " 127.0.0.1:3128 " -f " 127.0.0.1:8080 " -s " [::1]:8388 " -m " aes-256-gcm " -k " hello-kitty "--protocol tunnel启用本地客户端隧道模式-f "127.0.0.1:8080设置隧道目标地址注意：目前仅支持
iptables目标REDIRECT和TPROXY ）pf ），例如 OS X 10.10+、FreeBSD，... sslocal -b " 127.0.0.1:60080 " --protocol redir -s " [::1]:8388 " -m " aes-256-gcm " -k " hello-kitty " --tcp-redir " redirect " --udp-redir " tproxy "将具有iptables配置的连接重定向到sslocal正在侦听的端口。
--protocol redir启用本地客户端 Redir 模式--tcp-redir将 TCP 模式设置为REDIRECT (Linux)--udp-redir将 UDP 模式设置为TPROXY (Linux)注意：目前仅支持
创建名为tun0的 Tun 接口
ip tuntap add mode tun tun0
ifconfig tun0 inet 10.255.0.1 netmask 255.255.255.0 up使用--protocol tun启动sslocal并绑定到tun0
sslocal --protocol tun -s " [::1]:8388 " -m " aes-256-gcm " -k " hello-kitty " --outbound-bind-interface lo0 --tun-interface-name tun0sslocal --protocol tun -s " [::1]:8388 " -m " aes-256-gcm " -k " hello-kitty " --outbound-bind-interface lo0 --tun-interface-address 10.255.0.1/24它将创建一个地址为10.255.0.1和网络掩码255.255.255.0的 Tun 接口。
从Wintun下载wintun.dll ，并将其放置在shadowsocks可运行二进制文件所在的文件夹中，或者放置在系统PATH中。
sslocal -- protocol tun - s " [::1]:8388 " - m " aes-256-gcm " - k " hello-kitty " -- outbound - bind - interface " Ethernet 0 " -- tun - interface - name " shadowsocks "通过启用--features "winservice"来编译它（不包含在默认构建中）：
cargo build --release --bin " sswinservice " --features " winservice "将其安装为 Windows 服务 (PowerShell)：
New-Service - Name " shadowsocks-local-service " ` - DisplayName " Shadowsocks Local Service " ` - BinaryPathName "sswinservice.exe local -c local_config.json "
还有其他方法可以将sswinservice安装为 Windows 服务，例如sc命令。
您可能已经注意到， -BinaryPathName不仅包含sswinservice.exe ，还包含local -c local_config.json 。这些命令行参数将作为Windows服务启动时的默认参数。您还可以使用自定义参数启动服务。
从微软的文档中了解更多信息。
sswinservice的参数的工作方式与ssservice完全相同。它支持local 、 server和manager命令。
# Read server configuration from file
ssserver -c /path/to/shadowsocks.json
# Pass all parameters via command line
ssserver -s " [::]:8388 " -m " aes-256-gcm " -k " hello-kitty " --plugin " v2ray-plugin " --plugin-opts " server;tls;host=github.com "支持的管理多用户 API：
add - 启动服务器实例remove - 删除现有的服务器实例list - 列出所有当前正在运行的服务器ping - 列出所有服务器的统计数据注意：不支持stat命令。因为服务器与管理器本身运行在同一进程中。
# Start it just with --manager-address command line parameter
ssmanager --manager-address " 127.0.0.1:6100 "
# For *nix system, manager can bind to unix socket address
ssmanager --manager-address " /tmp/shadowsocks-manager.sock "
# You can also provide a configuration file
#
# `manager_address` key must be provided in the configuration file
ssmanager -c /path/to/shadowsocks.json
# Create one server by UDP
echo ' add: {"server_port":8388,"password":"hello-kitty"} ' | nc -u ' 127.0.0.1 ' ' 6100 '
# Close one server by unix socket
echo ' remove: {"server_port":8388} ' | nc -Uu ' /tmp/shadowsocks-manager.sock '对于管理器 UI，请查看 Shadowsocks-manager 项目中的更多详细信息。
配置示例：
{
// Required option
// Address that ssmanager is listening on
"manager_address" : "127.0.0.1" ,
"manager_port" : 6100 ,
// Or bind to a Unix Domain Socket
"manager_address" : "/tmp/shadowsocks-manager.sock" ,
"servers" : [
// These servers will be started automatically when ssmanager is started
] ,
// Outbound socket binds to this IP address
// For choosing different network interface on the same machine
"local_address" : "xxx.xxx.xxx.xxx" ,
// Other options that may be passed directly to new servers
} {
// LOCAL: Listen address. This is exactly the same as `locals[0]`
// SERVER: Bind address for remote sockets, mostly used for choosing interface
// Don't set it if you don't know what's this for.
"local_address" : "127.0.0.1" ,
"local_port" : 1080 ,
// Extended multiple local configuration
"locals" : [
{
// Basic configuration, a SOCKS5 local server
"local_address" : "127.0.0.1" ,
"local_port" : 1080 ,
// OPTIONAL. Setting the `mode` for this specific local server instance.
// If not set, it will derive from the outer `mode`
"mode" : "tcp_and_udp" ,
// OPTIONAL. Authentication configuration file
// Configuration file document could be found in the next section.
"socks5_auth_config_path" : "/path/to/auth.json" ,
// OPTIONAL. Instance specific ACL
"acl" : "/path/to/acl/file.acl" ,
// OPTIONAL. macOS launchd activate socket
"launchd_tcp_socket_name" : "TCPListener" ,
"launchd_udp_socket_name" : "UDPListener"
} ,
{
// SOCKS5, SOCKS4/4a local server
"protocol" : "socks" ,
// Listen address
"local_address" : "127.0.0.1" ,
"local_port" : 1081 ,
// OPTIONAL. Enables UDP relay
"mode" : "tcp_and_udp" ,
// OPTIONAL. Customizing the UDP's binding address. Depending on `mode`, if
// - TCP is enabled, then SOCKS5's UDP Association command will return this address
// - UDP is enabled, then SOCKS5's UDP server will listen to this address.
"local_udp_address" : "127.0.0.1" ,
"local_udp_port" : 2081 ,
// OPTIONAL. macOS launchd activate socket
"launchd_tcp_socket_name" : "TCPListener" ,
"launchd_udp_socket_name" : "UDPListener"
} ,
{
// Tunnel local server (feature = "local-tunnel")
"protocol" : "tunnel" ,
// Listen address
"local_address" : "127.0.0.1" ,
"local_port" : 5353 ,
// Forward address, the target of this tunnel
// In this example, this will build a `127.0.0.1:5353` -> `8.8.8.8:53` tunnel
"forward_address" : "8.8.8.8" ,
"forward_port" : 53 ,
// OPTIONAL. Customizing whether to start TCP and UDP tunnel
"mode" : "tcp_only" ,
// OPTIONAL. macOS launchd activate socket
"launchd_tcp_socket_name" : "TCPListener" ,
"launchd_udp_socket_name" : "UDPListener"
} ,
{
// HTTP local server (feature = "local-http")
"protocol" : "http" ,
// Listen address
"local_address" : "127.0.0.1" ,
"local_port" : 3128 ,
// OPTIONAL. macOS launchd activate socket
"launchd_tcp_socket_name" : "TCPListener"
} ,
{
// DNS local server (feature = "local-dns")
// This DNS works like China-DNS, it will send requests to `local_dns` and `remote_dns` and choose by ACL rules
"protocol" : "dns" ,
// Listen address
"local_address" : "127.0.0.1" ,
"local_port" : 53 ,
// OPTIONAL. DNS local server uses `tcp_and_udp` mode by default
"mode" : "udp_only" ,
// Local DNS address, DNS queries will be sent directly to this address
"local_dns_address" : "114.114.114.114" ,
// OPTIONAL. Local DNS's port, 53 by default
"local_dns_port" : 53 ,
// Remote DNS address, DNS queries will be sent through ssserver to this address
"remote_dns_address" : "8.8.8.8" ,
// OPTIONAL. Remote DNS's port, 53 by default
"remote_dns_port" : 53 ,
// OPTIONAL. dns client cache size for fetching dns queries.
"client_cache_size" : 5 ,
// OPTIONAL. macOS launchd activate socket
"launchd_tcp_socket_name" : "TCPListener" ,
"launchd_udp_socket_name" : "UDPListener"
} ,
{
// Tun local server (feature = "local-tun")
"protocol" : "tun" ,
// Tun interface name
"tun_interface_name" : "tun0" ,
// Tun interface address
//
// It has to be a host address in CIDR form
"tun_interface_address" : "10.255.0.1/24"
} ,
{
// Transparent Proxy (redir) local server (feature = "local-redir")
"protocol" : "redir" ,
// OPTIONAL: TCP type, may be different between platforms
// Linux/Android: redirect (default), tproxy
// FreeBSD/OpenBSD: pf (default), ipfw
// NetBSD/macOS/Solaris: pf (default), ipfw
"tcp_redir" : "tproxy" ,
// OPTIONAL: UDP type, may be different between platforms
// Linux/Android: tproxy (default)
// FreeBSD/OpenBSD: pf (default)
"udp_redir" : "tproxy"
} ,
{
// FakeDNS local server (feature = "local-fake-dns")
// FakeDNS is a DNS server that allocates an IPv4 / IPv6 address in a specific pool for each queries.
// Subsequence requests from the other local interfaces that the target addresses includes those allocated IP addresses,
// will be substituted back to their original domain name addresses.
// This feature is useful mostly for transparent proxy, which will allow the proxied domain names to be resolved remotely.
"protocol" : "fake-dns" ,
// Listen address
"local_address" : "127.0.0.1" ,
"local_port" : 10053 ,
// IPv4 address pool (for A records)
"fake_dns_ipv4_network" : "10.255.0.0/16" ,
// IPv6 address pool (for AAAA records)
"fake_dns_ipv6_network" : "fdf2:e786:ab40:9d2f::/64" ,
// Persistent storage for all allocated DNS records
"fake_dns_database_path" : "/var/shadowsocks/fakedns.db" ,
// OPTIONAL: Record expire duration in seconds, 10s by default
"fake_dns_record_expire_duration" : 10
}
] ,
// Server configuration
// listen on :: for dual stack support, no need add [] around.
"server" : "::" ,
// Change to use your custom port number
"server_port" : 8388 ,
"method" : "aes-256-gcm" ,
"password" : "your-password" ,
"plugin" : "v2ray-plugin" ,
"plugin_opts" : "mode=quic;host=github.com" ,
"plugin_args" : [
// Each line is an argument passed to "plugin"
"--verbose"
] ,
"plugin_mode" : "tcp_and_udp" , // SIP003u, default is "tcp_only"
// Server: TCP socket timeout in seconds.
// Client: TCP connection timeout in seconds.
// Omit this field if you don't have specific needs.
"timeout" : 7200 ,
// Extended multiple server configuration
// LOCAL: Choosing the best server to connect dynamically
// SERVER: Creating multiple servers in one process
"servers" : [
{
// Fields are the same as the single server's configuration
// Individual servers can be disabled
// "disabled": true,
"address" : "0.0.0.0" ,
"port" : 8389 ,
"method" : "aes-256-gcm" ,
"password" : "your-password" ,
"plugin" : "..." ,
"plugin_opts" : "..." ,
"plugin_args" : [ ] ,
"plugin_mode" : "..." ,
"timeout" : 7200 ,
// Customized weight for local server's balancer
//
// Weight must be in [0, 1], default is 1.0.
// The higher weight, the server may rank higher.
"tcp_weight" : 1.0 ,
"udp_weight" : 1.0 ,
// OPTIONAL. Instance specific ACL
"acl" : "/path/to/acl/file.acl" ,
} ,
{
// Same key as basic format "server" and "server_port"
"server" : "0.0.0.0" ,
"server_port" : 8388 ,
"method" : "chacha20-ietf-poly1305" ,
// Read the actual password from environment variable PASSWORD_FROM_ENV
"password" : "${PASSWORD_FROM_ENV}"
} ,
{
// AEAD-2022
"server" : "::" ,
"server_port" : 8390 ,
"method" : "2022-blake3-aes-256-gcm" ,
"password" : "3SYJ/f8nmVuzKvKglykRQDSgg10e/ADilkdRWrrY9HU=" ,
// For Server (OPTIONAL)
// Support multiple users with Extensible Identity Header
// https://github.com/Shadowsocks-NET/shadowsocks-specs/blob/main/2022-2-shadowsocks-2022-extensible-identity-headers.md
"users" : [
{
"name" : "username" ,
// User's password must have the same length as server's password
"password" : "4w0GKJ9U3Ox7CIXGU4A3LDQAqP6qrp/tUi/ilpOR9p4="
}
] ,
// For Client (OPTIONAL)
// If EIH enabled, then "password" should have the following format: iPSK:iPSK:iPSK:uPSK
// - iPSK is one of the middle relay servers' PSK, for the last `ssserver`, it must be server's PSK ("password")
// - uPSK is the user's PSK ("password")
// Example:
// "password": "3SYJ/f8nmVuzKvKglykRQDSgg10e/ADilkdRWrrY9HU=:4w0GKJ9U3Ox7CIXGU4A3LDQAqP6qrp/tUi/ilpOR9p4="
}
] ,
// Global configurations for UDP associations
"udp_timeout" : 300 , // Timeout for UDP associations (in seconds), 5 minutes by default
"udp_max_associations" : 512 , // Maximum UDP associations to be kept in one server, unlimited by default
// Options for Manager
"manager_address" : "127.0.0.1" , // Could be a path to UNIX socket, /tmp/shadowsocks-manager.sock
"manager_port" : 5300 , // Not needed for UNIX socket
// DNS server's address for resolving domain names
// For *NIX and Windows, it uses system's configuration by default
//
// Value could be IP address of DNS server, for example, "8.8.8.8".
// DNS client will automatically request port 53 with both TCP and UDP protocol.
//
// - system, uses system provided API (`getaddrinfo` on *NIX)
//
// It also allows some pre-defined well-known public DNS servers:
// - google (TCP, UDP)
// - cloudflare (TCP, UDP)
// - cloudflare_tls (TLS), enable by feature "dns-over-tls"
// - cloudflare_https (HTTPS), enable by feature "dns-over-https"
// - quad9 (TCP, UDP)
// - quad9_tls (TLS), enable by feature "dns-over-tls"
//
// The field is only effective if feature "hickory-dns" is enabled.
"dns" : "google" ,
// Configure `cache_size` for "hickory-dns" ResolverOpts. Set to "0" to disable DNS cache.
"dns_cache_size" : 0 ,
// Mode, could be one of the
// - tcp_only
// - tcp_and_udp
// - udp_only
"mode" : "tcp_only" ,
// TCP_NODELAY
"no_delay" : false ,
// Enables `SO_KEEPALIVE` and set `TCP_KEEPIDLE`, `TCP_KEEPINTVL` to the specified seconds
"keep_alive" : 15 ,
// Soft and Hard limit of file descriptors on *NIX systems
"nofile" : 10240 ,
// Try to resolve domain name to IPv6 (AAAA) addresses first
"ipv6_first" : false ,
// Set IPV6_V6ONLY for all IPv6 listener sockets
// Only valid for locals and servers listening on `::`
"ipv6_only" : false ,
// Outbound socket options
// Linux Only (SO_MARK)
"outbound_fwmark" : 255 ,
// FreeBSD only (SO_USER_COOKIE)
"outbound_user_cookie" : 255 ,
// `SO_BINDTODEVICE` (Linux), `IP_BOUND_IF` (BSD), `IP_UNICAST_IF` (Windows) socket option for outbound sockets
"outbound_bind_interface" : "eth1" ,
// Outbound socket bind() to this IP (choose a specific interface)
"outbound_bind_addr" : "11.22.33.44" ,
// Balancer customization
"balancer" : {
// MAX Round-Trip-Time (RTT) of servers
// The timeout seconds of each individual checks
"max_server_rtt" : 5 ,
// Interval seconds between each check
"check_interval" : 10 ,
// Interval seconds between each check for the best server
// Optional. Specify to enable shorter checking interval for the best server only.
"check_best_interval" : 5
} ,
// SIP008 Online Configuration Delivery
// https://shadowsocks.org/doc/sip008.html
"online_config" : {
"config_url" : "https://path-to-online-sip008-configuration" ,
// Optional. Seconds between each update to config_url. Default to 3600s
"update_interval" : 3600
} ,
// Service configurations
// Logger configuration
"log" : {
// Equivalent to `-v` command line option
"level" : 1 ,
"format" : {
// Euiqvalent to `--log-without-time`
"without_time" : false ,
} ,
// Equivalent to `--log-config`
// More detail could be found in https://crates.io/crates/log4rs
"config_path" : "/path/to/log4rs/config.yaml"
} ,
// Runtime configuration
"runtime" : {
// single_thread or multi_thread
"mode" : "multi_thread" ,
// Worker threads that are used in multi-thread runtime
"worker_count" : 10
}
}配置文件由locals中的socks5_auth_config_path设置。
{
// Password/Username Authentication (RFC1929)
"password" : {
"users" : [
{
"user_name" : "USERNAME in UTF-8" ,
"password" : "PASSWORD in UTF-8"
}
]
}
}SS_SERVER_PASSWORD ：从命令行参数 ( --server-addr ) 创建的服务器的默认密码SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN ： "system" DNS 解析器强制使用系统的内置（*NIX 中的getaddrinfo ） 2022-blake3-aes-128-gcm , 2022-blake3-aes-256-gcm2022-blake3-chacha20-poly1305 , 2022-blake3-chacha8-poly1305这些密码要求"password"是 Base64 密钥字符串，其长度与密码的密钥大小完全相同。建议使用ssservice genkey -m "METHOD_NAME"生成安全的密钥。
chacha20-ietf-poly1305aes-128-gcm , aes-256-gcmplain或none （无加密，仅用于调试或与确保传输安全的插件一起使用）tableaes-128-cfb 、 aes-128-cfb1 、 aes-128-cfb8 、 aes-128-cfb128aes-192-cfb 、 aes-192-cfb1 、 aes-192-cfb8 、 aes-192-cfb128aes-256-cfb 、 aes-256-cfb1 、 aes-256-cfb8 、 aes-256-cfb128aes-128-ctraes-192-ctraes-256-ctrcamellia-128-cfb , camellia-128-cfb1 , camellia-128-cfb8 , camellia-128-cfb128camellia-192-cfb , camellia-192-cfb1 , camellia-192-cfb8 , camellia-192-cfb128camellia-256-cfb , camellia-256-cfb1 , camellia-256-cfb8 , camellia-256-cfb128rc4-md5chacha20-ietfsslocal 、 ssserver和ssmanager支持 ACL 文件，其语法类似于 Shadowsocks-libev。一些例子可以在这里找到。
sslocal ， ssredir ，...）[bypass_all] - ACL 在BlackList模式下运行。绕过所有不符合任何规则的地址。[proxy_all] - ACL 在WhiteList模式下运行。代理所有不符合任何规则的地址。[bypass_list] - 直接连接的规则[proxy_list] - 通过代理连接的规则ssserver )[reject_all] - ACL 在BlackList模式下运行。拒绝所有不符合任何规则的客户端。[accept_all] - ACL 在WhiteList模式下运行。接受所有不符合任何规则的客户端。[white_list] - 接受客户的规则[black_list] - 拒绝客户的规则[outbound_block_list] - 阻止出站地址的规则。 # SERVERS
# For ssserver, accepts requests from all clients by default
[accept_all]
# Blocks these clients
[black_list]
1.2.3.4
127.0.0.1/8
# Disallow these outbound addresses
[outbound_block_list]
127.0.0.1/8
::1
# Using regular expression
^[a-z]{5}.baidu.com
# Match exactly
|baidu.com
# Match with subdomains
||google.com
# An internationalized domain name should be converted to punycode
# |☃-⌘.com - WRONG
|xn----dqo34k.com
# ||джpумлатест.bрфa - WRONG
||xn--p-8sbkgc5ag7bhce.xn--ba-lmcq
# CLIENTS
# For sslocal, ..., bypasses all targets by default
[bypass_all]
# Proxy these addresses
[proxy_list]
||google.com
8.8.8.8ssurl用于编码和解码 ShadowSocks URL (SIP002)。例子： ss://[email protected]:8388/?plugin=obfs-local%3Bobfs%3Dhttp%3Bobfs-host%3Dwww.baidu.com
它支持以下功能：
libcrypto （等待可接受的 Rust 加密库实现） rustc进行构建crypto2阻止）麻省理工学院许可证 (MIT)
版权所有 (c) 2014 钟宇涛
特此免费授予获得本软件和相关文档文件（“软件”）副本的任何人不受限制地使用本软件，包括但不限于使用、复制、修改、合并的权利、发布、分发、再许可和/或销售软件的副本，并允许向其提供软件的人员这样做，但须满足以下条件：
上述版权声明和本许可声明应包含在本软件的所有副本或主要部分中。
本软件按“原样”提供，不提供任何明示或暗示的保证，包括但不限于适销性、特定用途的适用性和不侵权的保证。在任何情况下，作者或版权持有者均不对因本软件或本软件中的使用或其他交易而产生或与之相关的任何索赔、损害或其他责任负责，无论是合同、侵权行为还是其他行为。软件。
