Documentation
¶
Overview ¶
Package shadowsocks implements a Shadowsocks AEAD proxy server for anzu-proxy, supporting the AEAD_CHACHA20_POLY1305 and AEAD_AES_256_GCM cipher suites as specified in:
https://shadowsocks.org/doc/aead.html
Wire format (TCP):
[salt (32 B)] [encrypted chunks...] Each encrypted chunk: [2-byte payload length, AEAD-sealed] [payload, AEAD-sealed]
The session subkey is derived with HKDF-SHA1:
subkey = HKDF-SHA1(key=password, salt=salt, info="ss-subkey", len=keySize)
Authentication is password-only (no UserStore). A wrong password or any ciphertext error causes a silent close with no reply — this is the Shadowsocks anti-probing requirement.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher holds the parameters for one AEAD cipher suite.
func NewCipher ¶
NewCipher returns a Cipher for the given suite name. Accepted names (case-insensitive):
"AEAD_CHACHA20_POLY1305" / "chacha20-ietf-poly1305" "AEAD_AES_256_GCM" / "aes-256-gcm"
func (*Cipher) DeriveSubkey ¶
DeriveSubkey derives the per-session subkey from the shared password and the per-connection random salt using HKDF-SHA1 as specified by the Shadowsocks AEAD standard.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler manages a single Shadowsocks client connection.
Protocol flow:
- Read salt (cipher.SaltSize() bytes) from client — plaintext
- Derive session subkey: HKDF-SHA1(password, salt, "ss-subkey")
- Wrap connection in AEAD reader; decrypt SOCKS5-style address header
- Dial the target via netutil.DialTarget (respects upstream proxy + SSRF)
- Relay bidirectionally: client→target (via AEAD reader), target→client (via a new aeadWriter with its own fresh salt)
Any error before the relay starts is surfaced as a return value but produces NO reply to the client — Shadowsocks anti-probing requirement.
func NewHandler ¶
NewHandler creates a Handler for one accepted connection.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the Shadowsocks AEAD proxy server. It runs a TCP listener (for the stream relay) and a UDP socket (for the datagram relay) on the same address and port.
func (*Server) ServeListener ¶
ServeListener is used by tests that pre-bind their own TCP listener. It binds the UDP socket on the same address automatically.
Source Files