shadowsocks/shadowsocks-rust

This system is a high-performance, cross-platform Shadowsocks proxy client and server implementation written in Rust. It provides a unified service binary that manages local proxying (via SOCKS, HTTP, DNS, TUN, and transparent redirection) and remote server relaying, supporting multiple encryption protocols including the modern AEAD-2022 standard. The system features advanced network capabilities such as multi-hop proxy chaining, server load balancing based on latency, and comprehensive access control lists, while offering extensive deployment options across Linux, macOS, Windows, and containerized environments.

49 changes.

The project underwent a major architectural overhaul, rewriting the core Rust library to modernize the stack with serde, Hickory-DNS, and AEAD-2022 support. The codebase was reorganized into dedicated crates, introducing a unified service binary, transparent proxying, and comprehensive plugin support. This period also established robust cross-platform deployment via Debian packaging and expanded protocol coverage with SOCKS4/5, HTTP, and DNS relay features.

21 changes.

This period focused on rewriting the core networking layer to support advanced TCP features like Fast Open and Multipath-TCP across Linux, BSD, and Windows platforms. It also introduced comprehensive service management capabilities, including unified launchers, Kubernetes and Docker deployment support, and enhanced security measures such as replay attack protection and SELinux policies.

The local redirection subsystem now supports packet filtering on BSD-based systems (macOS, iOS, FreeBSD, and OpenBSD). This change introduces a new \bsd\_pf\ module that implements a \PacketFilter\ interface to interact with the OS-level \pf\ firewall via \/dev/pf\. It includes platform-specific bindgen headers for \pfvar\ structures and enables NAT lookups (specifically TCP \natlook\) to correctly resolve the final destination address for redirected connections, ensuring the proxy can handle traffic routed through the system firewall on these platforms.

crates/shadowsocks-service/src/local/redir/sys/unix · high confidence

Users can now install Shadowsocks-rust via Homebrew. The new formula builds version 1.17.2 from source, installs a default configuration file to /usr/local/etc, and provides a launchd service for running the local proxy.

homebrew · high confidence

This change introduces a dedicated SELinux policy module (shadowsocks) that allows the Shadowsocks service to run in a confined domain rather than the default unconfined state. The module defines specific file contexts for the executable, configuration files, and systemd unit files, and grants the service only the necessary permissions for network access, configuration reading, and system monitoring. This enhances security by enforcing the principle of least privilege and providing an audit trail for access attempts.

selinux · high confidence

Users can now connect to the shadowsocks service using the SOCKS4 or SOCKS4a protocol. This change introduces a new local server handler that accepts SOCKS4 handshakes, supports TCP CONNECT commands (while rejecting BIND), and routes traffic through the configured proxy servers or bypasses them if no servers are available, enabling compatibility with applications that only support the older SOCKS4 standard.

crates/shadowsocks-service/src/local/socks/server/socks4 · high confidence

The \src/daemonize/daemonize\ module now includes a local implementation of the \daemonize\ library, providing types and logic to spawn system daemons. This adds support for configuring user/group privileges, PID file management, working directories, and standard I/O redirection (including /dev/null and custom files), allowing the application to run as a background service with proper resource handling.

src/daemonize/daemonize · high confidence

The security module now includes a replay attack protector that uses a Bloom filter-based mechanism (PingPongBloom) to detect and prevent nonce reuse, addressing potential replay vulnerabilities. This protection is enabled via the \security-replay-attack-detect\ feature flag and is specifically integrated with the AEAD-2022 cipher suite, where it works alongside timestamp-based validation to reject duplicate nonces within the valid time window. The implementation uses configurable Bloom filter parameters for server and client modes, borrowing design values from shadowsocks-libev to balance memory usage and false positive rates.

crates/shadowsocks/src/security · high confidence

A new Python script (genacl\_proxy\_gfw\_bypass\_china\_ip.py) has been added to the acl directory. This tool fetches the GFW translated blacklist and the China IP list from external sources, merges them with configurable custom bypass and proxy lists (including IPv6 private subnets), and outputs a structured ACL file (shadowsocks.acl) with sections for proxy\_all, proxy\_list, and bypass\_list.

acl · high confidence

A new documentation file (.cursor/rules/shadowsocks-rust-orientation.mdc) has been added to provide developers with a structural overview of the shadowsocks-rust project. This guide details the Rust toolchain requirements (Edition 2024, MSRV 1.91), the dependency hierarchy between the root, service, and core crates, and the specific roles of key modules such as TCP/UDP relays, local/server binaries, and TUN support. It serves as a reference for navigating the codebase, identifying high-signal paths for performance tuning, and understanding feature gating for various binaries like sslocal and ssserver.

.cursor · high confidence

The local TCP networking layer now automatically determines whether to route traffic through the shadowsocks proxy or connect directly, based on configured bypass rules. This is implemented via new \AutoProxyClientStream\ and \AutoProxyIo\ components in the local service, which check target addresses against bypass lists before establishing connections, and also integrates with the fake-DNS feature to correctly map and handle addresses.

crates/shadowsocks-service/src/local/net/tcp · high confidence

The local HTTP proxy listener has been refactored into a new module (crates/shadowsocks-service/src/local/http) that now supports HTTP Basic authentication. Users can configure allowed usernames and passwords in the configuration file under the 'basic' section, and the server will enforce these credentials via the Proxy-Authorization header before forwarding requests. The implementation includes a dedicated HTTP client with connection caching, a service handler for processing proxy requests (including CONNECT tunneling), and utilities for header management and host resolution.

crates/shadowsocks-service/src/local/http · high confidence

Added the UDP relay implementation for the local redir (transparent proxy) server. This change introduces a new module that manages UDP associations, handles inbound socket caching, and ensures correct address family conversion (including IPv4-mapped-IPv6 handling) when sending responses back to clients. It provides the core logic for forwarding UDP traffic through the proxy in redir mode, leveraging platform-specific socket options and IP stack capability checks.

crates/shadowsocks-service/src/local/redir/udprelay · high confidence

This change introduces the complete Debian packaging infrastructure for the shadowsocks-rust project, enabling users to build and install the software as a native Debian package. The package includes a default systemd service unit for the server component, along with templated service units for custom client and server instances. It provides a default configuration file, an init script for compatibility, and maintainer scripts that automatically generate a secure password and set necessary capabilities during installation. The build rules are configured to produce a release binary, and the package metadata defines dependencies on standard build tools and runtime libraries.

debian · high confidence

The plugin module has been introduced to handle external proxy plugins, implementing the SIP003 standard and adding support for SIP003u (UDP mode). This change adds the core \Plugin\ struct to manage subprocess lifecycle, including starting the plugin process regardless of the running mode, waiting for it to become ready via TCP connection checks, and ensuring proper termination on drop. It also provides specific command builders for \obfsproxy\ (using standalone mode with argument assembly) and standard shadowsocks plugins (using environment variables like \SS\_REMOTE\_HOST\), enabling users to configure and run external obfuscation or transformation proxies.

crates/shadowsocks/src/plugin · high confidence

The repository is initialized with core build and deployment infrastructure, including a Dockerfile for multi-architecture builds (i386, amd64, arm64) using Alpine Linux and musl-cross toolchains, alongside configuration for Travis CI, AppVeyor, and cross-compilation via Cross.toml. The project structure is established with a Makefile, Cargo workspace configuration, and dependency management tools like cargo-deny and Renovate. Documentation is added via a comprehensive README covering installation methods (crates.io, Homebrew, Snap, Docker, Kubernetes) and feature flags, while the MIT License is applied.

(repo-wide) · high confidence

Adds a new Helm chart (version 0.1.0) for deploying shadowsocks-rust to Kubernetes, including templates for Deployment, Service, ConfigMap, and optional HorizontalPodAutoscaler. The chart supports configurable service types (ClusterIP, NodePort, LoadBalancer), custom annotations on services and service accounts, and optional init containers to automatically download v2ray and xray plugins. It defaults to the ghcr.io/shadowsocks/ssserver-rust image (tagged 'latest') and provides a test-connection hook to verify connectivity.

k8s · high confidence

The local service now includes a new load balancing module that actively probes servers to select the best one based on latency and failure rates. This module, located in \crates/shadowsocks-service/src/local/loadbalancing\, introduces \PingBalancer\ which tracks per-server statistics (median latency, fail rate, and Median Absolute Deviation) to calculate a quality score. It supports configurable check intervals, maximum RTT timeouts, and allows users to customize server weights for both TCP and UDP modes. The implementation ensures that the best server is chosen dynamically, with fallback logic for when no valid servers are available, and integrates with the service context to manage server identification and connection options.

crates/shadowsocks-service/src/local/loadbalancing · high confidence

Adds the core TCP redirect server logic for the local shadowsocks service, enabling transparent proxying on platforms that support socket redirection. The new \RedirTcpServer\ binds to a specified address and port, extracts the original destination address from incoming connections, and handles IPv4-mapped IPv6 addresses for dual-stack compatibility. It routes traffic through the configured server balancer, establishing tunnels to remote servers or bypassing them based on ACL rules, and logs the listening status upon startup.

crates/shadowsocks-service/src/local/redir/tcprelay · high confidence

A new \src/vparser\ module has been added to centralize command-line argument parsing and validation. This module provides specific parsers for server addresses, IP addresses, socket addresses, manager addresses, cipher kinds, and redir types, ensuring consistent error handling and user feedback for invalid inputs across the application's CLI interface.

src/vparser · high confidence

Added a new local Fake DNS service that listens for DNS queries and maps requested domain names to local private network addresses (IPv4 and IPv6). The server persists these mappings in a RocksDB database, allowing the local proxy to translate requests using these fake IPs back to the original domain names. This feature is designed to work in conjunction with local redirect (local-redir) and TUN (local-tun) modes to improve DNS privacy and prevent leaks.

_crates/shadowsocks-service/src/local/fake\dns · high confidence

The \shadowsocks-service\ crate now includes a new \manager\ module (\src/manager/mod.rs\ and \server.rs\) that implements the Shadowsocks Manager server. This component allows administrators to manage multiple relay servers through a centralized interface, supporting features such as per-server configuration, ACL integration, DNS resolution, and UDP association management. The implementation exposes a \ManagerBuilder\ for constructing the service and handles the lifecycle of server instances, including flow statistics and standalone mode support on Unix systems.

crates/shadowsocks-service/src/manager · high confidence

The Linux-specific networking layer has been updated to include a new \TcpStream\ implementation that wraps both standard TCP and TCP Fast Open (TFO) connections via the \tokio-tfo\ crate. This change enables users to leverage TFO for reduced connection latency when enabled in options, and adds support for Multipath-TCP (MPTCP) connections on Linux systems. Additionally, the module now configures the TFO queue length to 1024 to match standard backlog settings and applies Linux-specific socket options like \SO\_MARK\ and \SO\_BINDTODEVICE\ during connection setup.

crates/shadowsocks/src/net/sys/unix/linux · high confidence

Added a new Dockerfile (Dockerfile.v2ray) that builds upon the shadowsocks-ssserver-rust image, automatically downloads and installs the latest v2ray-plugin binary, and configures the container to run as a non-root user with a custom entrypoint script. Additionally, a new Dockerfile for Linux cross-compilation (docker/linux-cross/Dockerfile) was introduced to set up a build environment with necessary development tools like build-essential, cmake, and clang-8.

docker · high confidence

The \crates/shadowsocks/src/manager\ module now exposes a dedicated client and listener interface for the Shadowsocks Manager protocol, enabling centralized management of multiple relay servers. The \ManagerClient\ provides async methods (\add\, \list\, \ping\, \remove\, \stat\) to communicate with a manager service, while \ManagerListener\ allows a server to bind and accept management requests. The underlying \ManagerDatagram\ abstraction supports both UDP sockets and Unix domain sockets (on Unix systems), handling serialization and deserialization of protocol messages (such as \AddRequest\, \RemoveRequest\, and \ListResponse\) via JSON.

crates/shadowsocks/src/manager · high confidence

Added configuration files to support deployment on OpenWrt and macOS. The OpenWrt setup includes a Python script to generate IPsets from APNIC data, shell scripts for iptables/iptables6 mixed and TPROXY firewall rules, and a procd init script that manages the shadowsocks service with optional jail confinement and capability handling. A macOS launchd plist is also provided to run the client as a background service.

configs · high confidence

The local DNS module has been refactored to introduce a dedicated DNS relay server that supports both local and remote (proxied) DNS upstreams. This change adds a \DnsClientCache\ to reuse connections and improve performance, a \DnsResolver\ that queries both A and AAAA records simultaneously, and a \DnsBuilder\ to construct the relay server. The implementation supports TCP, UDP, and Unix Domain Socket (on Unix systems) for local DNS, and proxies remote DNS queries through the Shadowsocks connection. It also includes specific support for macOS launchd activated sockets.

crates/shadowsocks-service/src/local/dns · high confidence

Added a new local tunnel server component in \crates/shadowsocks-service/src/local/tunnel\ that allows forwarding TCP and UDP traffic to a specified destination address. This feature introduces \TunnelBuilder\ to configure the tunnel, supporting independent TCP/UDP modes, UDP association management (expiry and capacity), and macOS launchd socket activation. The implementation includes dedicated TCP and UDP relay handlers that utilize the existing load balancer for server selection and establish direct or proxied tunnels to the target address.

crates/shadowsocks-service/src/local/tunnel · high confidence

The \crates/shadowsocks-service/src/net\ module has been introduced, providing core networking utilities for the service. This includes \FlowStat\ for tracking transmitted and received byte counts, along with \MonProxySocket\ and \MonProxyStream\ wrappers that automatically update these statistics on UDP and TCP operations respectively. The module also adds \ProxyHttpStream\ to handle HTTP/HTTPS transport with TLS support (via native-tls or rustls), \PacketWindowFilter\ for replay protection on UDP packets, and \launch\_activate\_socket\ helpers to support macOS launchd-activated sockets. Additionally, utility functions for IPv4-mapped IPv6 conversion and stream handling are included.

crates/shadowsocks-service/src/net · high confidence

Added a new local server component for transparent proxying, exposing \Redir\ and \RedirBuilder\ types. This allows users to configure and run a local server that intercepts traffic using platform-specific redirection mechanisms (TCP and UDP), with support for independent mode settings, UDP association management, and custom socket options like \SO\_MARK\ on Linux.

crates/shadowsocks-service/src/local/redir · high confidence

The UDP relay module for local transparent proxying now includes dedicated, platform-specific socket handling for FreeBSD, Linux, macOS, and OpenBSD. This change introduces native support for dual-stack listeners, SO\_REUSEPORT, and platform-specific socket options (such as IP\_TRANSPARENT on Linux, BINDANY on FreeBSD/OpenBSD, and PF natlook on macOS) to correctly capture original destination addresses and route responses. For unsupported Unix-like platforms, the module now provides a stub that explicitly reports that UDP transparent proxying is not available, rather than failing silently or using generic fallbacks.

crates/shadowsocks-service/src/local/redir/udprelay/sys/unix · high confidence

The local SOCKS server now supports RFC1929 username/password authentication. Users can configure allowed credentials via a JSON5 configuration file, which the server loads to validate incoming SOCKS5 connections requiring authentication.

crates/shadowsocks-service/src/local/socks · high confidence

The local SOCKS server now uses dedicated, self-contained TCP and UDP client implementations to connect to upstream SOCKS4 and SOCKS5 proxies. This change introduces standalone clients that handle their own connection establishment and protocol negotiation, allowing the local service to chain through external SOCKS proxies. Users can now route local SOCKS traffic through upstream SOCKS4 or SOCKS5 servers, with support for both TCP forwarding and UDP association (including explicit authentication where supported).

crates/shadowsocks-service/src/local/socks/client · high confidence

The outbound proxy implementation has been refactored into a unified \OutboundProxyClient\ that manages chains of SOCKS5, HTTP, and HTTPS hops. This change introduces native support for multi-hop UDP relaying through SOCKS5-only chains, allowing UDP traffic to traverse multiple proxy servers by nesting SOCKS5 UDP headers. The HTTP CONNECT client has been replaced with a \hyper\-based implementation to ensure robust handling of HTTP responses and connection upgrades. Additionally, authentication for both SOCKS5 and HTTP proxies is now handled via dedicated, extensible enums (\Socks5Auth\ and \HttpProxyAuth\), replacing previous ad-hoc parameter patterns.

crates/shadowsocks-service/src/net/outbound · high confidence

The service entry point has been restructured into a unified launcher (\src/service\) that consolidates local, server, and manager modes. This change introduces a cross-platform signal monitor (\src/monitor\) that ensures graceful shutdown on Unix (SIGTERM/SIGINT) and Windows (Ctrl-C), while providing a new \genkey\ utility to generate encryption keys via the command line. The launchers now use a consistent CLI argument structure via Clap, supporting features like outbound proxy chaining for servers and configurable UDP associate addresses for local clients.

src/service · high confidence

macOS users can now activate sockets via launchd, allowing the service to receive connections from the system launch daemon rather than binding to a port directly. This is implemented in the new \crates/shadowsocks-service/src/sys\ module, which adds platform-specific handling for macOS (including the \launch\_activate\_socket\ FFI call) and Unix systems (including \set\_nofile\ for resource limits).

crates/shadowsocks-service/src/sys · high confidence

The \src/bin/local.rs\ and \src/bin/server.rs\ files have been deleted. These files previously served as the command-line entry points for the local client and server components, utilizing the deprecated \getopts\ crate and early Rust \extern crate\ syntax. Their removal indicates that the standalone binary interfaces for these components are no longer maintained in this location, likely having been migrated to a different crate, module, or build configuration.

src/bin · high confidence

The TCP relay implementation has been restructured into distinct modules for each encryption protocol: \aead.rs\ for the legacy AEAD protocol, \aead\_2022.rs\ for the new AEAD-2022 protocol, and \stream.rs\ for stream ciphers. These modules now encapsulate their own packet I/O logic, including dedicated \DecryptedReader\ and \EncryptedWriter\ wrappers, protocol-specific error types, and header parsing (e.g., AEAD-2022 headers with timestamps and padding). A new \crypto\_io.rs\ module provides a unified interface that dispatches to the correct protocol implementation based on the cipher category, while \proxy\_stream/protocol/\ defines versioned header structures (v1 for Stream/AEAD, v2 for AEAD-2022). This change isolates protocol logic, making it easier to maintain and extend individual cipher implementations without affecting others.

crates/shadowsocks/src/relay/tcprelay · high confidence

The local network utilities have been reorganized into a new \crates/shadowsocks-service/src/local/net\ module. This change introduces a public API exposing \AutoProxyIo\ and \AutoProxyClientStream\ for TCP handling, along with \UdpAssociationManager\ and \UdpInboundWrite\ for UDP management, effectively centralizing these components for better code structure.

crates/shadowsocks-service/src/local/net · high confidence

The \shadowsocks-service\ source code has been reorganized into a dedicated Rust crate, separating the core service logic from the binary implementations. This change introduces a new \config.rs\ module that handles both standard and extended JSON configuration formats, including support for multiple servers and load balancing. It also adds a \ServerHandle\ utility in \utils.rs\ to manage server task lifecycles and introduces \OutboundProxy\ configuration structures to allow routing server traffic through external SOCKS5, HTTP, or HTTPS proxies.

crates/shadowsocks-service/src · high confidence

The Access Control List (ACL) engine in shadowsocks-service now ignores rules containing non-ASCII characters and restricts domain name matching to ASCII and lowercase characters only. This change ensures that regex, set, and tree-based domain rules behave consistently by disabling unicode matching, which prevents unexpected matches on internationalized domain names (IDN) and improves security by avoiding ambiguity in rule evaluation.

crates/shadowsocks-service/src/acl · high confidence

The local redirection subsystem now exposes a \set\_ipv6\_only\ function that configures the \IPV6\_V6ONLY\ socket option. This change ensures that IPv6 sockets are strictly bound to IPv6 addresses, preventing dual-stack behavior where IPv4-mapped IPv6 addresses might be accepted. The implementation is platform-specific, utilizing \std::os::unix::io::AsFd\ on Unix systems and \std::os::windows::io::AsSocket\ on Windows, both leveraging the \socket2::SockRef\ abstraction for consistent socket manipulation.

crates/shadowsocks-service/src/local/redir/sys · high confidence

The networking layer now automatically probes the host's IP stack capabilities at startup to determine support for IPv4, IPv6, and IPv4-mapped-IPv6 addresses. This enables the system to correctly handle binding and connecting when using IPv4-mapped IPv6 addresses, ensuring that dual-stack sockets are configured with the appropriate \IPV6\_V6ONLY\ settings. Users benefit from improved compatibility on systems where IPv4-mapped IPv6 support varies, as the library now adapts its socket behavior based on actual OS capabilities rather than assuming uniform support.

crates/shadowsocks/src/net/sys · high confidence

The DNS resolution layer now supports the Hickory-DNS resolver (rebranded from Trust-DNS) for system and custom DNS configurations, allowing users to specify a DNS cache size via the new \dns\_cache\_size\ option. The system resolver can be forced to use the built-in fallback via the \SS\_SYSTEM\_DNS\_RESOLVER\_FORCE\_BUILTIN\ environment variable, and the resolver initialization now passes outbound socket configuration options to ensure consistent network behavior.

crates/shadowsocks-service/src/dns · high confidence

The shadowsocks core library has been restructured into distinct modules (config, context, security) to improve maintainability. A key behavioral change enforces strict replay attack detection for AEAD-2022 ciphers: the system now automatically overrides any user-configured policy to 'Reject' for these ciphers, ensuring that duplicate nonces are treated as errors rather than warnings or ignored events. Additionally, the configuration system now supports per-server mode settings (TCP/UDP) and integrates the Hickory-DNS resolver for asynchronous DNS resolution.

crates/shadowsocks/src · high confidence

The DNS resolver module has been refactored to use the Hickory-DNS library (formerly Trust-DNS) as the primary resolver implementation. This change introduces a custom runtime provider that integrates with Shadowsocks' connection options, enabling EDNS0 for handling large DNS records and configuring the IP lookup strategy to retrieve both IPv4 and IPv6 addresses simultaneously. Additionally, the \lookup\_then\_connect\ macro implements a Happy Eyeballs connection strategy (following RFC6555 with a 300ms delay) to optimize connection attempts across address families, and on Linux/BSD/macOS systems, the resolver now automatically reloads \/etc/resolv.conf\ when it changes.

_crates/shadowsocks/src/dns\resolver · high confidence

The application now uses the tracing-subscriber framework for its default console logging instead of the previous log4rs implementation. This change enables more granular, per-writer configuration for console, file, and (on Unix) syslog outputs, allows disabling ANSI color codes when stdout is not a terminal, and supports configuring log levels and formats via the RUST\_LOG environment variable or structured config files. The legacy log4rs path remains available for file-based configuration but emits a deprecation warning.

src/logging · high confidence

The core library has been completely rewritten to modernize the stack and improve stability. The old, experimental relay logic (tcprelay, udprelay) and legacy serialization (rust-serialize) have been removed and replaced with a robust configuration system using serde and json5, supporting standard XDG and system directories. A new error handling module (ShadowsocksError) provides structured exit codes for failures. System-level capabilities are now centralized in a new sys module, which automatically adjusts the open file descriptor limit (RLIMIT\_NOFILE) on Unix systems and supports dropping privileges to run as a specific user. Additionally, a new allocator module allows users to select high-performance memory allocators (jemalloc, tcmalloc, mimalloc, snmalloc, rpmalloc) via feature flags, and password input is now handled securely via environment variables or TTY prompts.

src · high confidence

The BSD-specific networking layer has been rewritten to provide native TCP stream handling for FreeBSD and macOS, replacing the previous generic fallback. This implementation adds support for TCP Fast Open (TFO) via the \tokio-tfo\ crate and introduces basic Multipath-TCP (MPTCP) connectivity on macOS using the \connectx\ API. Additionally, FreeBSD builds now support \SO\_USER\_COOKIE\ for mark-based routing, and both platforms correctly handle TFO's \EINPROGRESS\ state during the initial write.

crates/shadowsocks/src/net/sys/unix/bsd · high confidence

The build system now includes dedicated shell and PowerShell scripts (build-host-release, build-host-release.ps1, build-release) to streamline local and cross-compilation, handling target-specific packaging (ZIP for Windows, tar.xz for Unix) and checksum generation. Additionally, a new shim script (netbsd-getentropy-shim.sh) resolves a missing symbol issue for NetBSD 9 cross-compilation by providing a getentropy implementation via sysctl.

build · high confidence

The local online configuration service (SIP008) has been updated to automatically decompress server responses using gzip, deflate, Brotli, and zstd encodings, improving compatibility with servers that compress their configuration payloads. Additionally, the service now strictly validates the HTTP response status code (requiring 200 OK) and enforces the standard Content-Type header (application/json; charset=utf-8), issuing warnings or errors if these standards are not met.

_crates/shadowsocks-service/src/local/online\config · high confidence

The local TCP and UDP relay implementations now use conditional compilation to expose platform-specific modules. On Unix systems, the Unix-specific relay logic is used, while on Windows, the Windows-specific logic is applied. For UDP relay on unsupported platforms, a compile-time error is now generated, ensuring that the service fails clearly during build rather than at runtime.

crates/shadowsocks-service/src/local/redir/tcprelay/sys, crates/shadowsocks-service/src/local/redir/udprelay/sys · high confidence

The TCP relay logic has been reorganized into a new \proxy\_stream\ module, introducing \ProxyClientStream\ and \ProxyServerStream\ to handle encrypted TCP connections. This change implements the AEAD-2022 protocol, adding specific state management for nonce checking on the client side and header preparation on the server side. The server stream now enforces AEAD-2022 security requirements by rejecting connections that lack required padding in the first data chunk, and exposes the authenticated user key for multi-user scenarios.

_crates/shadowsocks/src/relay/tcprelay/proxy\stream · high confidence

The UDP relay logic has been restructured into distinct, feature-gated modules for each encryption protocol: \stream\ (legacy stream ciphers), \aead\ (AEAD-2020), and \aead\_2022\ (AEAD-2022). A new \crypto\_io\ module centralizes the dispatch logic, routing encryption and decryption calls to the appropriate protocol handler based on the configured cipher. The \compat\ module introduces \DatagramSocket\, \DatagramSend\, and \DatagramReceive\ traits to abstract UDP I/O, while \proxy\_socket.rs\ implements the \ProxySocket\ client/server that manages session control data and identity keys. This change isolates protocol-specific packet formatting and cipher operations, making the UDP relay easier to maintain and extend.

crates/shadowsocks/src/relay/udprelay · high confidence

The local server implementation has been restructured to use a new \ServiceContext\ for managing shared state (such as DNS resolvers, ACLs, and connection options) and a builder pattern for individual local server types (Socks, Http, Dns, Tun, etc.). This change introduces a unified client for outbound proxy chains, allowing users to configure outbound proxies more flexibly, and adds support for bypassing local DNS queries for server domain names. The refactoring also standardizes TCP keep-alive timeouts and improves the handling of UDP associations and flow statistics within the local service.

crates/shadowsocks-service/src/local · high confidence

The network implementation in \crates/shadowsocks/src/net\ has been restructured to use explicit configuration structs (\TcpSocketOpts\, \UdpSocketOpts\, \ConnectOpts\, \AcceptOpts\) for socket creation and connection. This change introduces support for advanced socket options including TCP Fast Open, Multipath-TCP, configurable buffer sizes, keep-alive intervals, and interface binding. It also adds platform-specific features such as Android VPN socket protection, FreeBSD \SO\_USER\_COOKIE\, and macOS \IP\_BOUND\_IF\. UDP handling now supports MTU-based packet rejection, IP fragmentation control, and batch send/recv operations on supported platforms.

crates/shadowsocks/src/net · high confidence

The \src/daemonize\ module has been rewritten to remove the dependency on the unmaintained \daemonize\ crate. The new implementation provides a custom \daemonize\ function for Unix systems that redirects stdout and stderr to /dev/null, sets the working directory, and optionally writes a PID file, mirroring the behavior of shadowsocks-libev. This change improves maintainability and stability for users running the server on Unix-like operating systems.

src/daemonize · high confidence

The SOCKS local server implementation has been restructured into a modular architecture with dedicated builder types (SocksBuilder, SocksTcpServerBuilder, Socks5UdpServerBuilder) that allow fine-grained configuration of UDP association addresses, expiry durations, capacity limits, and authentication settings. This change introduces support for configurable UDP associate addresses, macOS launchd socket activation, and HTTP Basic authentication (when enabled), while maintaining backward compatibility with existing SOCKS4/5 and SOCKS5-UDP functionality.

crates/shadowsocks-service/src/local/socks/server · high confidence

The SOCKS5 local server module now supports RFC1929 Username/Password authentication during the handshake phase, rejecting connections that fail credential verification. The UDP relay component actively converts IPv4-mapped IPv6 addresses to standard IPv4 when sending responses to clients, ensuring compatibility with dual-stack listeners. Additionally, the server includes an association manager that automatically cleans up expired UDP associations and respects configurable time-to-live and capacity limits.

crates/shadowsocks-service/src/local/socks/server/socks5 · high confidence

The relay module now includes a full implementation of the SOCKS5 protocol (RFC1928), exposing address handling and command/reply enums for proxy operations. Additionally, the AEAD-2022 cipher logic has been updated to ensure that empty initial payloads are padded with a non-zero random size (1–900 bytes), preventing protocol violations where servers might reject zero-length padding.

crates/shadowsocks/src/relay · high confidence

The server module now introduces a \ServiceContext\ to hold shared state (ACL, flow stats, DNS resolver) and a \ServerBuilder\ that allows per-server-instance configuration of outbound options (such as bind address, interface, and UDP fragmentation) and outbound proxy chains. This enables users to configure distinct network behaviors and proxy routing for each server entry in the configuration file, rather than applying a single global set of options to all servers.

crates/shadowsocks-service/src/server · high confidence

The local TCP redirect implementation has been refactored into platform-specific modules (Linux, BSD, and a stub for unsupported systems) to enable dual-stack socket binding. On both Linux and BSD platforms, the service now attempts to bind IPv6 sockets with the IPV6\_V6ONLY option disabled, allowing a single listener to accept connections on both IPv4 and IPv6 addresses. If dual-stack binding fails, the system falls back to standard single-stack binding. This change ensures that transparent proxy listeners work correctly on dual-stack networks without requiring separate IPv4 and IPv6 configurations.

crates/shadowsocks-service/src/local/redir/tcprelay/sys/unix · high confidence

The local TUN service has been refactored to use the smoltcp user-space network stack instead of the previous implementation. This change introduces a new virtual device layer that routes packets through smoltcp, enabling better handling of TCP and UDP traffic, including support for IPv4-mapped-IPv6 conversion, ICMP echo replies, and configurable congestion control. A fake TUN implementation is provided for unsupported platforms to ensure compilation compatibility.

crates/shadowsocks-service/src/local/tun · high confidence

The local UDP relay logic has been consolidated into a new \UdpAssociationManager\ that handles association lifecycle, keep-alive, and packet routing. A key behavioral change is that UDP traffic now routes through a configured outbound SOCKS5 proxy chain when the outbound client supports UDP, whereas previously it likely bypassed such chains or used a different mechanism. The implementation also integrates with the fake-DNS feature to resolve addresses when enabled, and manages associations using an LRU cache with configurable TTL and capacity.

crates/shadowsocks-service/src/local/net/udp · high confidence

The project now provides a unified \ssservice\ binary that consolidates local, server, and manager functionalities under a single executable with subcommands, while also introducing a dedicated \ssurl\ utility for encoding/decoding ShadowSocks URLs (including QR code generation and Outline support) and a new \sswinservice\ binary that allows running Shadowsocks as a native Windows Service. The previous separate \sslocal\, \ssserver\, and \ssmanager\ binaries are replaced by the unified \ssservice\ (which can also be invoked via symlinks for backward compatibility), streamlining deployment and management across platforms.

bin · high confidence

The Unix networking layer has been restructured into platform-specific modules (Linux, BSD, and others) to handle OS differences more cleanly. For UDP traffic, the system now supports disabling IP fragmentation on supported platforms to improve security and compatibility, and inbound sockets can be configured to respect IPv6-only settings. TCP connections now apply keep-alive settings (including interval on supported platforms) and buffer sizes consistently after connection or acceptance. Additionally, Unix Domain Sockets now support sending and receiving file descriptors between processes, enabling advanced inter-process communication features.

crates/shadowsocks/src/net/sys/unix · high confidence

The Windows implementation for TCP transparent proxying has been removed. Attempting to use this feature on Windows will now result in an 'InvalidInput' error indicating that TCP transparent proxy is not supported, rather than potentially failing silently or behaving unexpectedly.

crates/shadowsocks-service/src/local/redir/tcprelay/sys/windows · high confidence

The Windows-specific UDP redir socket implementation now returns 'unimplemented' errors for all operations (listen, bind, send, receive). This indicates that UDP transparent proxy functionality is not supported on Windows and will fail at runtime if attempted, rather than causing compilation errors or undefined behavior.

crates/shadowsocks-service/src/local/redir/udprelay/sys/windows · high confidence

The Windows networking implementation has been rewritten to support TCP Fast Open (TFO) via the tokio-tfo crate, allowing faster connection establishment when enabled. It now supports binding outbound UDP and TCP traffic to specific network interfaces using adapter names or indices, leveraging a cached adapter index system for performance. The code also integrates the windows-sys crate for low-level WinSock operations and handles socket options like IP fragmentation and unicast interface selection correctly for both IPv4 and IPv6.

crates/shadowsocks/src/net/sys/windows · high confidence

Added integration tests for DNS, HTTP, Socks4/5, UDP, and tunnel protocols; Added integration tests for TCP, UDP, and TFO relay tunnels.

Updated Rust dependencies including serde\_json, blake3, once\_cell, openssl, sysexits, clap, tracing-subscriber, base64, url, reqwest, hyper, async-trait, nix, rustls-native-certs, lru\_time\_cache, json5, arc-swap, tower, thiserror, xdg, http-body-util, webpki-roots, env\_logger, time, and idna.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 65 → 70 (+5.5)
• Rubric changed (rubric-2026.09.8 → rubric-2026.09.17) — scores are not directly comparable.

• Code Health 83 → 83 (+0.0)
• Architecture 99 → 84 (-14.6)
• Maturity 70 → 70 (+0.0)
• Readiness 73 → 79 (+6.6)
• Security 51 → 62 (+10.9)
• Performance 100 (new)

• Duplicated block (4–16 lines × 3) (crates/shadowsocks/src/relay/tcprelay/aead.rs)
• Near-duplicate member pair (40 shared lines) (crates/shadowsocks/src/relay/tcprelay/aead.rs)

• Ambiguous constructor variants. new takes a generic key K, while with_encoded_key takes a str. It is unclear if new expects raw bytes or encoded strings, leading to potential misuse. The existence of with_encoded_key suggests new might not handle string encoding, but the naming doesn't make this distinction clear.
• Confusingly similar method names with different signatures. send_to and send_to_manager both send data, but take different target types (ManagerSocketAddr vs ManagerAddr) and one takes a Context. This suggests send_to_manager is a higher-level wrapper, but the naming is not distinct enough to prevent confusion.
• Duplicate intent with divergent naming and scope. ServerType and ConfigType appear to represent the same conceptual enum (Local/Server/Manager/etc.), but are split across two modules with different method signatures. ServerType only has is_local/is_server, while ConfigType has is_manager/is_online_config as well. This forces users to import two different types for similar checks.
• Duplicated block (19 lines × 2) (crates/shadowsocks/src/relay/tcprelay/aead.rs)
• Duplicated block (8 lines × 3) (crates/shadowsocks/src/relay/tcprelay/aead.rs)
• Inconsistent naming for cloning/copying operations. clone_identity_hash and clone_identity_keys use the verb clone for returning owned data, whereas Rust idioms typically use to_owned() or just rely on the type system. More importantly, ServerUser has clone_identity_hash but ServerConfig has clone_identity_keys. The naming is inconsistent between the two types (hash vs keys).
• Off the main sequence: shadowsocks
• Redundant accessors for the same underlying data. key() and password() likely return the same secret material (one as bytes, one as string). export_password() is a third variant. This creates confusion about which method to use for serialization vs internal use.
• Redundant methods with unclear distinction. get_user_by_hash and clone_user_by_hash both return ServerUser. In Rust, get usually implies borrowing or returning a reference, but here both return owned ServerUser. The distinction between 'get' and 'clone' is semantically weak if the return type is identical.
• Split crates/shadowsocks
• Split crates/shadowsocks-service

• 13 commits — 8 feature/other, 5 fixes

• (root) — 9 commits
• crates/shadowsocks — 2 commits
• crates/shadowsocks-service — 1 commit
• debian/shadowsocks-rust-local@.service — 1 commit

• fix: fix(local-tun): enable smoltcp "auto-icmp-echo-reply" feature to reply ICMP Echo Request
• fix: fix(relay): pick non-zero AEAD-2022 padding size for empty first payload
• fix: fix(tcprelay): report actual plaintext length when retrying after Pending
• fix: fix: RUSTSEC-2026-0285
• fix: fix: updated chacha20 to v0.10.2, v0.10.1 yanked
• change: chore(deps): update rust crate bloomfilter to v3.0.2
• change: chore(deps): update rust crate cfg-if to v1.0.5
• change: chore(deps): update rust crate clap to v4.6.7
• change: chore(deps): update rust crate rand to v0.10.3
• change: chore(deps): update rust crate sendfd to v0.4.5
• change: chore(deps): update rust crate thiserror to v2.0.21
• change: chore(deps): update rust crate tokio-rustls to v0.26.6
• change: systemd unit improvements (#2187)

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

shadowsocks/shadowsocks-rust was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.