net.shadowsocks

Shadowsocks is a small encrypted proxy protocol. A client connects to a Shadowsocks server and says which host and port it wants to reach; the server connects there and carries bytes both ways. Everything after the first byte looks like random data, so there is no handshake to recognise. net.shadowsocks is a client and a server for it written in Salam, with no native library. It is one of the proxy packages built on net.tunnel and can be plugged into the same routers and chains as the others.

The main calls are few. Dial opens a Conn through a server to a target such as example.com:443; Read, Write and Close then work like on any socket. Listen starts a server and Serve or ServeRelay answers clients. Config holds the server address, the cipher method, the password and the optional obfs disguise. Everything else (Buf, Encoder, Decoder, the BLAKE3 and key functions) is the lower level the protocol is built from, public so you can test it or build your own framing.

Quick start

This program starts a server on a free port, connects a client through it to example.com:443 and sends one message. The handler never connects to example.com; it only reads the target the client asked for with TargetOf and echoes the bytes back, so the whole run stays on the loopback interface. Stop wakes the accept loop so that Serve returns, and Destroy frees the server.

import mem
import net.shadowsocks

const PASSWORD := "correct horse"

mut srv := shadowsocks.Server {}
mut seen := ""

func answer(c: shadowsocks.Conn):
    t := shadowsocks.TargetOf(c)
    seen = t.host + ":" + t.port
    buf := mem.Allocate(4096 as u64)
    n := shadowsocks.Read(c, buf, 4096)
    shadowsocks.Write(c, buf, n)
    mem.Free(buf)
    shadowsocks.Close(c)
end

func serve():
    shadowsocks.Serve(srv, (c: shadowsocks.Conn): answer(c) end)
end

func main:
    srv = shadowsocks.Listen(0, "chacha20-ietf-poly1305", PASSWORD)
    println shadowsocks.ServerOk(srv)
    t := spawn(serve)

    cfg := shadowsocks.Config { host = "127.0.0.1", port = shadowsocks.ServerPort(srv), method = "chacha20-ietf-poly1305", password = PASSWORD }
    c := shadowsocks.Dial(cfg, "example.com", 443)
    println shadowsocks.Ok(c)
    shadowsocks.WriteStr(c, "hello through shadowsocks")
    println shadowsocks.ReadStr(c, 4096)
    shadowsocks.Close(c)

    shadowsocks.Stop(srv)
    join(t)
    shadowsocks.Destroy(srv)
    println "server saw", seen
end

A real server uses ServeRelay, which does the forwarding for you: for each client it connects to the requested target and copies bytes in both directions until either side closes. The next example runs a relay in front of a small TCP echo server and sends a message through it.

import mem
import net.tcp
import net.shadowsocks

mut target := tcp.Server {}
mut srv := shadowsocks.Server {}

func echo():
    c := tcp.Accept(target)
    buf := mem.Allocate(4096 as u64)
    n := tcp.ReadBytes(c, buf, 4096)
    tcp.WriteBytes(c, buf, n)
    mem.Free(buf)
    tcp.Close(c)
end

func serve():
    shadowsocks.ServeRelay(srv)
end

func main:
    target = tcp.Bind(0)
    te := spawn(echo)

    srv = shadowsocks.Listen(0, "aes-256-gcm", "relay password")
    ts := spawn(serve)

    cfg := shadowsocks.Config { host = "127.0.0.1", port = shadowsocks.ServerPort(srv), method = "aes-256-gcm", password = "relay password" }
    c := shadowsocks.Dial(cfg, "127.0.0.1", tcp.Port(target))
    shadowsocks.WriteStr(c, "through the relay")
    println shadowsocks.ReadStr(c, 4096)
    shadowsocks.Close(c)

    join(te)
    shadowsocks.Stop(srv)
    join(ts)
    shadowsocks.Destroy(srv)
    tcp.CloseServer(target)
end

The client side is just Dial with a Config. Dial returns at once without waiting for the server: the target address travels in the first encrypted packet together with your first Write. So a wrong password is not reported by Dial; the server drops the connection and your first Read returns 0 or a negative number. Check Ok for a connection that could not even start (an unknown method, or the server not reachable).

Ciphers

The method is a name from this table. LookupMethod turns a name into a Method and returns one with ok false for a name it does not know. The name chacha20-poly1305 is accepted too, as an alias of chacha20-ietf-poly1305. Old stream ciphers such as rc4-md5 and aes-256-cfb are not supported and never will be: they are broken.

import net.shadowsocks

func show(name: str):
    m := shadowsocks.LookupMethod(name)
    println m.name, m.ok, m.key_len, m.salt_len, m.v2022
end

func main:
    show("aes-128-gcm")
    show("aes-256-gcm")
    show("chacha20-ietf-poly1305")
    show("2022-blake3-aes-128-gcm")
    show("2022-blake3-aes-256-gcm")
    show("2022-blake3-chacha20-poly1305")
    show("rc4-md5")
end

For the first three, the password is any text and the key is derived from it the classic way (BytesToKey, MD5 based), so use a long random password. For the 2022 ciphers the password is the key: it must be the base64 of exactly the key length, for example the output of openssl rand -base64 32. A password of the wrong length makes MakeKey return a Buf with bad set, and Listen or Dial then fail. The 2022 ciphers add replay protection with a timestamp (a request more than 30 seconds off is refused) and a salt cache, and the connection header is authenticated.

What is not there

• Shadowsocks 2022 UDP has its own functions. PackUdp and UnpackUdp are for the classic methods and refuse the three 2022 methods; use PackUdp2022 and UnpackUdp2022, or UdpListen and UdpDial, which pick the right one.
• Several users on one port (the 2022 extensible identity headers) work only with the two AES 2022 methods. The ChaCha 2022 method takes a single key.
• No real server was used to test the interoperability of simple-obfs and of the 2022 TCP stream. They are tested against this package itself and against separate Python reimplementations written from the specifications, not against ssserver, shadowsocks-rust or the real obfs-server. The classic AEAD ciphers are checked against published test vectors. Treat the 2022 methods and the obfuscation as young and test against your own server before relying on them.
• AES is done in software (bitsliced, to avoid timing leaks) and is slow: in the tests here about four to five times slower than ChaCha20. Prefer chacha20-ietf-poly1305.
• The relay has no half close: when one side closes, the whole connection is shut down. A protocol that depends on a client finishing its request with a close and still reading the answer will break.
• No anti probing behaviour: a server that receives a bad first packet closes the connection at once instead of draining it as a real web server would, so a prober can tell it is not one.
• UDP works over IPv4 and IPv6 (client and relay sockets accept both; UdpListenOn("::", port) serves both), and the UDP relay has no replay filter (TCP has one, a salt cache of 100000 entries).
• Only the HTTP and TLS shapes of simple-obfs exist, not the plugin v2ray-plugin or other plugins.

ss:// links and plugin options

Shadowsocks servers are shared as ss:// links. ParseUri reads the SIP002 form ss://base64(method:password)@host:port/?plugin=...#tag, the form with the user info in plain percent encoded text (used by the 2022 ciphers), and the old form where the whole method:password@host:port is base64. It returns a Uri whose ok is true only when the link is well formed and the method is known. FormatUri writes the link back (a 2022 link is written with the method and password in text, the others as base64). ToConfig turns a Uri into a Config that Dial accepts, including the obfuscation options of the plugin.

The plugin text is a plugin name followed by key=value options separated by semicolons, with a backslash to escape a semicolon or equals sign. ParsePlugin splits it into a Plugin and PluginGet and PluginHas read the options. Free it with PluginFree. ToConfig understands the plugin names obfs-local and simple-obfs with the options obfs (http or tls) and obfs-host; any other plugin is ignored, so check u.plugin yourself if you need to refuse it.

import net.shadowsocks

func main:
    u := shadowsocks.ParseUri("ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpzZWNyZXQ@203.0.113.5:8388/?plugin=obfs-local%3Bobfs%3Dtls%3Bobfs-host%3Dcdn.example.com#my%20server")
    println u.ok, u.method, u.password, u.host, u.port, u.tag
    println u.plugin

    p := shadowsocks.ParsePlugin(u.plugin)
    println p.name, shadowsocks.PluginGet(p, "obfs", ""), shadowsocks.PluginHas(p, "obfs-host"), shadowsocks.PluginHas(p, "missing")
    shadowsocks.PluginFree(p)

    cfg := shadowsocks.ToConfig(u)
    println cfg.host, cfg.port, cfg.method, cfg.obfs, cfg.obfs_host

    println shadowsocks.FormatUri(u)
    bad := shadowsocks.ParseUri("ss://not-a-link")
    println bad.ok
end

simple-obfs

simple-obfs hides the first bytes of a Shadowsocks connection inside something that looks like ordinary web traffic, which helps against filters that classify connections by their first packet. Set obfs in the client Config to "http" or "tls", set obfs_host to the host name to show (the Host header or the TLS server name, default www.bing.com), and start the server with ListenObfs and the same mode. Both sides must agree: a server without obfs does not understand an obfs client and the other way round.

• http: the first client packet is sent as an HTTP request with a WebSocket upgrade header, the server answers with a 101 Switching Protocols, and after that the data flows as is.
• tls: the first client packet is a fake TLS ClientHello carrying the data in a session ticket extension and the server name you chose, the server answers with a fake ServerHello, and the rest is wrapped in TLS application data records.

This is camouflage, not encryption: the Shadowsocks cipher underneath still protects the data. The fake handshake is simple and a determined censor can fingerprint it; it also does not make the connection look like a real site to an active prober. ObfsMode turns the names into the constants OBFS_NONE, OBFS_HTTP and OBFS_TLS, and ObfsInit, ObfsWrap, ObfsUnwrap and ObfsFree expose the framing for your own use.

import mem
import net.shadowsocks

mut srv := shadowsocks.Server {}

func answer(c: shadowsocks.Conn):
    buf := mem.Allocate(4096 as u64)
    n := shadowsocks.Read(c, buf, 4096)
    shadowsocks.Write(c, buf, n)
    mem.Free(buf)
    shadowsocks.Close(c)
end

func serve():
    shadowsocks.Serve(srv, (c: shadowsocks.Conn): answer(c) end)
end

func main:
    srv = shadowsocks.ListenObfs(0, "chacha20-ietf-poly1305", "pw", "http")
    t := spawn(serve)

    cfg := shadowsocks.Config { host = "127.0.0.1", port = shadowsocks.ServerPort(srv), method = "chacha20-ietf-poly1305", password = "pw", obfs = "http", obfs_host = "cdn.example.com" }
    c := shadowsocks.Dial(cfg, "example.com", 80)
    shadowsocks.WriteStr(c, "inside an http disguise")
    println shadowsocks.ReadStr(c, 4096)
    shadowsocks.Close(c)

    shadowsocks.Stop(srv)
    join(t)
    shadowsocks.Destroy(srv)
end

The UDP relay

Shadowsocks carries UDP too, for DNS and for games, one encrypted datagram at a time: the packet holds a random salt, the target address and the payload, sealed as a whole. UdpListen starts a relay on a UDP port; UdpServe loops until UdpStop is called, and UdpStep handles one packet and returns 1 when it did, so you can drive it yourself. The relay keeps one outgoing socket per client and forgets a client after 60 seconds of silence. On the client, UdpDial makes a UdpClient, UdpSend sends a payload to a target through the relay and UdpRecv returns the next reply and who it came from; UdpSetTimeout bounds the wait. UDP also works with the three 2022 ciphers (SIP022): the client picks a random session ID, numbers its packets, and the first 16 bytes of each datagram are that header encrypted on its own (AES-ECB for the AES methods, an XChaCha20-Poly1305 nonce for the ChaCha one). Packets carry a timestamp that must be within 30 seconds, and the relay drops any packet ID it has already seen in a 64 packet window. The classic methods get a salt filter on the relay, so a recorded datagram is answered once. UDP targets must be IPv4 or domain names.

import mem
import str
import net.udp
import net.shadowsocks

mut echo_sock := udp.Socket {}
mut relay := shadowsocks.UdpServer {}

func echo():
    buf := mem.Allocate(2000 as u64)
    mut host := ""
    mut port := 0
    n := udp.ReceiveBytes(echo_sock, buf, 2000, host, port)
    udp.SendBytes(echo_sock, host, port, buf, n)
    mem.Free(buf)
end

func serve():
    shadowsocks.UdpServe(relay)
end

func main:
    echo_sock = udp.Bind(0)
    relay = shadowsocks.UdpListen(0, "chacha20-ietf-poly1305", "udp password")
    te := spawn(echo)
    ts := spawn(serve)

    cfg := shadowsocks.Config { host = "127.0.0.1", port = shadowsocks.UdpServerPort(relay), method = "chacha20-ietf-poly1305", password = "udp password" }
    c := shadowsocks.UdpDial(cfg)
    shadowsocks.UdpSetTimeout(c, 3000)
    shadowsocks.UdpSend(c, "127.0.0.1", udp.Port(echo_sock), "ping" as void*, 4)

    buf := mem.AllocateZeroed(2000 as u64)
    mut from := shadowsocks.Target {}
    n := shadowsocks.UdpRecv(c, buf, 1999, from)
    println str.Substr(buf as str, 0, n), from.host, from.port == udp.Port(echo_sock)

    mem.Free(buf)
    join(te)
    shadowsocks.UdpStop(relay)
    join(ts)
    shadowsocks.UdpClose(c)
    shadowsocks.UdpDestroy(relay)
    udp.Close(echo_sock)
end

Several users on one 2022 server

An AES 2022 server can serve many users, each with their own key. Give the server its own key as the password, then call AddUser (UdpAddUser for UDP) once per user key. A client connects with the password serverkey:userkey: it sends an identity header that names its user without revealing the key, and the server picks that user's key for the session. ChainOf, EihSeal and EihOpen are the pieces underneath. The ChaCha 2022 method has no identity headers, so it takes a single key. ListenOn and UdpListenOn bind to one address instead of every interface, for example 127.0.0.1. When a handshake fails the server keeps the socket open for a random 1.5 to 4.5 seconds and reads what is sent before closing, so a probe cannot tell a refusal from a slow server. Relay passes a half close in both directions: when one side stops sending, the other side is told and can still answer.

Running over a tunnel.Stream

The client normally dials its server with TCP, but DialOver takes any tunnel.Stream instead: a WebSocket, a TLS connection, the output of another proxy hop, or a stream you made. The server side has AcceptOver. In both cases the Shadowsocks layer treats the stream as the wire, so you can put Shadowsocks inside a transport from net.transport, or behind a proxy chain from net.tunnel. AsStream does the opposite: it wraps a Conn as a tunnel.Stream, so a Shadowsocks connection can be handed to anything that takes a stream, such as a router outbound or another protocol layer.

import mem
import sync
import net.tcp
import net.tunnel
import net.shadowsocks

mut port := 0
mut ready := sync.NewWaitGroup()

func server():
    carrier := tcp.Bind(0)
    port = tcp.Port(carrier)
    srv := shadowsocks.Listen(0, "aes-128-gcm", "inner")
    sync.Done(ready)
    raw := tcp.Accept(carrier)
    c := shadowsocks.AcceptOver(srv, tunnel.TcpStream { conn = raw })
    if shadowsocks.Ok(c):
        buf := mem.Allocate(4096 as u64)
        n := shadowsocks.Read(c, buf, 4096)
        shadowsocks.Write(c, buf, n)
        mem.Free(buf)
        shadowsocks.Close(c)
    end
    shadowsocks.Destroy(srv)
    tcp.CloseServer(carrier)
end

func main:
    sync.Add(ready, 1 as i64)
    t := spawn(server)
    sync.Wait(ready)

    link := tunnel.TcpStream { conn = tcp.Dial("127.0.0.1", port) }
    cfg := shadowsocks.Config { method = "aes-128-gcm", password = "inner" }
    c := shadowsocks.DialOver(link, cfg, "example.com", 443)
    shadowsocks.WriteStr(c, "any stream will do")
    println shadowsocks.ReadStr(c, 4096)

    s := shadowsocks.AsStream(c)
    println s.Ok()
    shadowsocks.Close(c)
    join(t)
end

The framing layer

The bottom of the package is public. An Encoder seals a byte stream into length prefixed AEAD chunks (EmitSalt first, then EncodeStream); a Decoder takes in the bytes as they arrive with Feed and returns the plaintext with NextChunk, or all at once with DecodeAll. EncodeTarget and ParseTarget write and read the address header (ATYP_IPV4, ATYP_DOMAIN, ATYP_IPV6), and PackUdp and UnpackUdp do the same for one datagram. Buf is the growable byte buffer all of them use: you own it, free it with BufFree and wipe key material with BufWipe first. This is how the protocol is tested against known vectors, and how you can write a custom front end.

The example under Buf below runs a whole round trip: it seals a stream and opens it again, writes and reads an address header, and packs and unpacks one UDP datagram.

Practical notes for Iran

These are tips for people building tools for networks with heavy filtering. They come from how the protocol works, not from tests against any particular ISP, and what works changes from month to month.

• Pick ChaCha20. Use chacha20-ietf-poly1305 unless the other end only offers something else. It is the fastest cipher here by a wide margin, and the security is the same as AES-GCM. Choose a 2022 method only when your server also speaks it and you can test it end to end; it has the best design (replay protection, authenticated header) but the least interoperability testing.
• Use a long random password for the classic methods, at least 20 characters from a password generator. Short passwords can be guessed offline from a captured connection.
• Do not rely on plain Shadowsocks alone. Pure random looking traffic on an unusual port is itself a signal, and the lack of an anti probing reply makes it easier to confirm. Put it on port 443, behind a transport that looks like a web site (a WebSocket over TLS, with DialOver and AcceptOver), or use simple-obfs with tls and a host name that is allowed and common on that network.
• Use the tunnel router. net.tunnel has routing rules with an Iran preset: domestic sites go direct and the rest goes through the proxy, so the local network is not slowed down and domestic sites do not see a foreign address. Make a Shadowsocks outbound from a Config, wrap it as a stream with AsStream where a dialer wants a stream, and let the router choose. For a local SOCKS or HTTP entry point see net.socks and net.httpproxy.
• Resolve names remotely. Pass the host name to Dial and let the server resolve it; do not resolve it locally first, or the lookup leaks. When a local lookup is unavoidable, net.doh sends it over HTTPS.
• Keep sharing safe. A link carries the password in clear text apart from base64: send it over a private channel, and do not publish servers you want to keep alive.

Types

struct SaltFilter

import net.shadowsocks

func main:
    mut f := shadowsocks.NewSaltFilter(1000)
    a := "salt number one, 32 bytes long.."
    b := "salt number two, 32 bytes long.."
    println f.cap, shadowsocks.FilterSeen(f, a as void*, 32)
    println shadowsocks.FilterCheck(f, a as void*, 32), shadowsocks.FilterSeen(f, a as void*, 32)
    println shadowsocks.FilterCheck(f, a as void*, 32), shadowsocks.FilterCheck(f, b as void*, 32)
    println f.cur.size(), f.old.size()
    shadowsocks.FilterFree(f)
end

struct KeyChain

import mem
import net.shadowsocks

func main:
    println shadowsocks.EIH_LEN, shadowsocks.IDENTITY_CONTEXT

    m := shadowsocks.LookupMethod("2022-blake3-aes-128-gcm")
    mut chain := shadowsocks.ChainOf(m, "AAECAwQFBgcICQoLDA0ODw==:EBESExQVFhcYGRobHB0eHw==")
    println chain.ok, chain.count, chain.key_len, chain.keys.len
    println shadowsocks.BufToHex(shadowsocks.Buf { p = shadowsocks.ChainKey(chain, 1), len = 16, cap = 16 })
    bad := shadowsocks.ChainOf(m, "not a key")
    println bad.ok, bad.count

    ipsk := shadowsocks.ChainKey(chain, 0)
    upsk := shadowsocks.ChainKey(chain, 1)
    h := mem.AllocateZeroed(16 as u64)
    shadowsocks.IdentityHash(upsk, m.key_len, h)
    println shadowsocks.HexOf(h, 16)

    salt := mem.AllocateZeroed(16 as u64)
    ik := mem.AllocateZeroed(16 as u64)
    shadowsocks.IdentityKey(ipsk, m.key_len, salt, m.salt_len, ik)
    println shadowsocks.HexOf(ik, 16)

    block := mem.AllocateZeroed(16 as u64)
    println shadowsocks.EihSeal(ipsk, m.key_len, salt, m.salt_len, upsk, block)
    println shadowsocks.HexOf(block, 16)
    opened := mem.AllocateZeroed(16 as u64)
    println shadowsocks.EihOpen(ipsk, m.key_len, salt, m.salt_len, block, opened)
    println shadowsocks.HexOf(opened, 16) == shadowsocks.HexOf(h, 16)

    shadowsocks.ChainFree(chain)
    println chain.ok, chain.count
    mem.Free(h)
    mem.Free(salt)
    mem.Free(ik)
    mem.Free(block)
    mem.Free(opened)
end

struct Config

struct ConnState

struct Conn

struct UdpSession

import net.shadowsocks

func main:
    m := shadowsocks.LookupMethod("2022-blake3-aes-128-gcm")
    println m.ok, m.v2022, m.key_len
    mut key := shadowsocks.MakeKey(m, "AAECAwQFBgcICQoLDA0ODw==")
    println key.len

    mut client := shadowsocks.NewUdpSession()
    mut server := shadowsocks.UdpSession {}
    println client.sid != 0, server.any

    mut packet := shadowsocks.NewBuf(256)
    println shadowsocks.PackUdp2022(m, key.p, key.p, shadowsocks.Buf {}, 0, client, true, "10.0.0.7", 53, "query" as void*, 5, packet), packet.len > 60

    mut sid := 0 as i64
    println shadowsocks.Udp2022Peek(m, key.p, packet.p, packet.len, sid), sid == client.sid

    mut target := shadowsocks.Target {}
    mut body := shadowsocks.NewBuf(64)
    println shadowsocks.UnpackUdp2022(m, key.p, key.p, 0, false, packet.p, packet.len, server, target, body), target.host, target.port, shadowsocks.BufToStr(body)
    println server.peer == client.sid, server.last

    println shadowsocks.SessionAccept(server, 5), shadowsocks.SessionAccept(server, 5), shadowsocks.SessionAccept(server, 3), server.top, server.any

    mut chain := shadowsocks.ChainOf(m, "AAECAwQFBgcICQoLDA0ODw==:EBESExQVFhcYGRobHB0eHw==")
    ipsk := shadowsocks.ChainKey(chain, 0)
    upsk := shadowsocks.ChainKey(chain, 1)
    mut multi := shadowsocks.UdpSession { sid = 7 as i64 }
    mut wire := shadowsocks.NewBuf(256)
    println shadowsocks.PackUdp2022(m, upsk, ipsk, chain.keys, 1, multi, true, "10.0.0.8", 443, "hello" as void*, 5, wire)
    mut who := shadowsocks.NewBuf(16)
    who.len = 16
    println shadowsocks.Udp2022Identity(m, ipsk, wire.p, wire.len, who.p)
    mut expected := shadowsocks.NewBuf(16)
    expected.len = 16
    shadowsocks.IdentityHash(upsk, m.key_len, expected.p)
    println shadowsocks.BufToHex(who) == shadowsocks.BufToHex(expected)
    mut seen := shadowsocks.UdpSession {}
    mut inner := shadowsocks.NewBuf(64)
    println shadowsocks.UnpackUdp2022(m, upsk, ipsk, shadowsocks.EIH_LEN, false, wire.p, wire.len, seen, target, inner), shadowsocks.BufToStr(inner)
    shadowsocks.BufFree(wire)
    shadowsocks.BufFree(who)
    shadowsocks.BufFree(expected)
    shadowsocks.BufFree(inner)
    shadowsocks.ChainFree(chain)

    shadowsocks.BufFree(packet)
    shadowsocks.BufFree(body)
    shadowsocks.BufWipe(key)
    shadowsocks.BufFree(key)
end

struct Plugin

struct Uri

struct Obfs

struct Target

import net.shadowsocks

func main:
    m := shadowsocks.LookupMethod("chacha20-ietf-poly1305")
    mut key := shadowsocks.MakeKey(m, "codec password")

    mut enc := shadowsocks.NewEncoderRandom(m, key.p)
    mut wire := shadowsocks.NewBuf(256)
    shadowsocks.EmitSalt(enc, wire)
    shadowsocks.EncodeStream(enc, "hello codec" as void*, 11, wire)
    println "wire bytes", wire.len, "salt", m.salt_len, "overhead", wire.len - 11 - m.salt_len

    mut dec := shadowsocks.NewDecoder(m, key.p)
    mut plain := shadowsocks.NewBuf(64)
    println shadowsocks.DecodeAll(dec, wire.p, wire.len, plain), shadowsocks.BufToStr(plain)

    mut head := shadowsocks.NewBuf(64)
    println shadowsocks.EncodeTarget("example.com", 8443, head), head.len, shadowsocks.BufToHex(head)
    mut t := shadowsocks.Target {}
    used := shadowsocks.ParseTarget(head.p, head.len, t)
    println used, t.host, t.port

    mut packet := shadowsocks.NewBuf(128)
    println shadowsocks.PackUdp(m, key.p, "10.0.0.7", 53, "query" as void*, 5, packet), packet.len
    mut got := shadowsocks.Target {}
    mut body := shadowsocks.NewBuf(64)
    println shadowsocks.UnpackUdp(m, key.p, packet.p, packet.len, got, body), got.host, got.port, shadowsocks.BufToStr(body)

    shadowsocks.EncoderFree(enc)
    shadowsocks.DecoderFree(dec)
    shadowsocks.BufFree(wire)
    shadowsocks.BufFree(plain)
    shadowsocks.BufFree(head)
    shadowsocks.BufFree(packet)
    shadowsocks.BufFree(body)
    shadowsocks.BufWipe(key)
    shadowsocks.BufFree(key)
end

struct Buf

struct Encoder

struct Decoder

struct ServerState

import net.shadowsocks

func main:
    server := shadowsocks.ListenOn("::1", 0, "aes-256-gcm", "secret", "")
    println shadowsocks.ServerOk(server), server.st.host
    shadowsocks.Stop(server)
    shadowsocks.Destroy(server)
end

struct Server

struct Method

struct UdpClient

struct UdpServer

Constants and variables

const IDENTITY_CONTEXT: str = "shadowsocks 2022 identity subkey"

const EIH_LEN: i32 = 16

const MAX_CHUNK: i32 = 16383

const TAG_LEN: i32 = 16

Functions

func NewSaltFilter(cap: int): SaltFilter

func FilterSeen(f &: SaltFilter, salt: void*, n: int): bool

func FilterCheck(f &: SaltFilter, salt: void*, n: int): bool

func FilterFree(f &: SaltFilter)

func MakeKey(m: Method, password: str): Buf

func ChainOf(m: Method, password: str): KeyChain

func ChainKey(c: KeyChain, i: int): void*

func ChainFree(c &: KeyChain)

func IdentityHash(psk: void*, klen: int, out16: void*)

func IdentityKey(ipsk: void*, klen: int, salt: void*, slen: int, out: void*)

func EihSeal(ipsk: void*, klen: int, salt: void*, slen: int, next_psk: void*, out16: void*): bool

func EihOpen(ipsk: void*, klen: int, salt: void*, slen: int, block16: void*, out_hash16: void*): bool

func Ok(c: Conn): bool

func TargetOf(c: Conn): Target

func Write(c: Conn, data: void*, n: int): int

func WriteStr(c: Conn, s: str): int

func Read(c: Conn, buf: void*, max: int): int

func ReadStr(c: Conn, max: int): str

func Close(c: Conn)

func Shutdown(c: Conn)

func Dial(cfg: Config, target_host: str, target_port: int): Conn

func DialOver(s: dyn tunnel.Stream, cfg: Config, target_host: str, target_port: int): Conn

func AsStream(c: Conn): dyn tunnel.Stream

func NewUdpSession(): UdpSession

func SessionAccept(s &: UdpSession, pid: i64): bool

func PackUdp2022(m: Method, ukey: void*, hdr_key: void*, eih: Buf, eih_n: int, s &: UdpSession, client: bool, host: str, port: int, data: void*, n: int, out &: Buf): bool

func Udp2022Peek(m: Method, hdr_key: void*, p: void*, n: int, sid &: i64): bool

func UnpackUdp2022(m: Method, ukey: void*, hdr_key: void*, skip: int, client: bool, p: void*, n: int, s &: UdpSession, t &: Target, out &: Buf): bool

func Udp2022Identity(m: Method, ipsk: void*, p: void*, n: int, out_hash16: void*): bool

func ParseUri(text: str): Uri

func FormatUri(u: Uri): str

func ParsePlugin(text: str): Plugin

func PluginGet(p: Plugin, key: str, fallback: str): str

func PluginHas(p: Plugin, key: str): bool

func PluginFree(p: Plugin)

func ToConfig(u: Uri): Config

func ObfsWrap(o &: Obfs, p: void*, n: int, out &: Buf)

func ObfsUnwrap(o &: Obfs, p: void*, n: int, out &: Buf): int

func ObfsInit(mode: int, server: bool, host: str): Obfs

func ObfsFree(o &: Obfs)

func ObfsMode(name: str): int

func EncodeTarget(host: str, port: int, out &: Buf): bool

func ParseTarget(p: void*, n: int, t &: Target): int

func BufAt(b: Buf, off: int): void*

func PtrAt(p: void*, off: int): void*

func NewBuf(cap0: int): Buf

func BufFree(b &: Buf)

func BufWipe(b &: Buf)

func BufReserve(b &: Buf, extra: int)

func BufAppend(b &: Buf, src: void*, n: int)

func BufAppendByte(b &: Buf, v: int)

func BufAppendStr(b &: Buf, s: str)

func BufConsume(b &: Buf, n: int)

func BufToStr(b: Buf): str

func BufToHex(b: Buf): str

func HexOf(p: void*, n: int): str

func BufFromHex(hex: str): Buf

func NewEncoder(m: Method, master: void*, salt: void*): Encoder

func NewEncoderRandom(m: Method, master: void*): Encoder

func EncoderFree(e &: Encoder)

func SealFrame(e &: Encoder, pt: void*, n: int, out &: Buf)

func EmitSalt(e &: Encoder, out &: Buf)

func EncodeStream(e &: Encoder, data: void*, n: int, out &: Buf)

func NewDecoder(m: Method, master: void*): Decoder

func DecoderFree(d &: Decoder)

func Feed(d &: Decoder, data: void*, n: int)

func TakeSalt(d &: Decoder): bool

func TakeFrame(d &: Decoder, n: int, out &: Buf): int

func NextChunk(d &: Decoder, out &: Buf): int

func DecodeAll(d &: Decoder, data: void*, n: int, out &: Buf): bool

func Listen(port: int, method: str, password: str): Server

func ListenOn(host: str, port: int, method: str, password: str, obfs: str): Server

import net.shadowsocks

func main:
    method := "2022-blake3-aes-128-gcm"
    ipsk := "AAECAwQFBgcICQoLDA0ODw=="
    server := shadowsocks.ListenOn("127.0.0.1", 0, method, ipsk, "")
    println shadowsocks.ServerOk(server), shadowsocks.ServerPort(server) > 0
    println shadowsocks.AddUser(server, "alice", "EBESExQVFhcYGRobHB0eHw==")
    println shadowsocks.AddUser(server, "bob", "ICEiIyQlJicoKSorLC0uLw==")
    println shadowsocks.AddUser(server, "bad", "short")
    println server.st.user_n, server.st.users.has("x"), server.st.user_names.size()
    shadowsocks.Destroy(server)

    classic := shadowsocks.ListenOn("127.0.0.1", 0, "chacha20-ietf-poly1305", "password", "")
    println shadowsocks.AddUser(classic, "carol", "password")
    shadowsocks.Destroy(classic)

    mut relay := shadowsocks.UdpListenOn("127.0.0.1", 0, method, ipsk)
    println relay.ok, shadowsocks.UdpServerPort(relay) > 0
    println shadowsocks.UdpAddUser(relay, "EBESExQVFhcYGRobHB0eHw==")
    println shadowsocks.UdpAddUser(relay, "short")
    println relay.user_n, relay.users.size(), relay.sess.size()
    shadowsocks.UdpDestroy(relay)
end

func ListenObfs(port: int, method: str, password: str, obfs: str): Server

func AddUser(s: Server, name: str, password: str): bool

func ServerOk(s: Server): bool

func ServerPort(s: Server): int

func Accept(s: Server): Conn

func AcceptOver(s: Server, io: dyn tunnel.Stream): Conn

func Relay(c: Conn)

func Serve(s: Server, handler: func(Conn))

func ServeRelay(s: Server)

func Stop(s: Server)

func Destroy(s: Server)

func LookupMethod(name: str): Method

func BytesToKey(password: str, klen: int, out: void*)

func HkdfSha1(key: void*, klen: int, salt: void*, slen: int, info: str, out: void*, olen: int)

func SessionSubkey(m: Method, master: void*, salt: void*, out: void*)

func RandomSalt(m: Method, out: void*)

func PasswordKey(m: Method, password: str): Buf

func PackUdp(m: Method, key: void*, host: str, port: int, data: void*, n: int, out &: Buf): bool

func UnpackUdp(m: Method, key: void*, p: void*, n: int, t &: Target, out &: Buf): bool

func UdpDial(cfg: Config): UdpClient

func UdpSend(c: UdpClient, host: str, port: int, data: void*, n: int): bool

func UdpRecv(c: UdpClient, buf: void*, max: int, from &: Target): int

func UdpSetTimeout(c: UdpClient, millis: int)

func UdpClose(c: UdpClient)

func UdpListen(port: int, method: str, password: str): UdpServer

func UdpListenOn(host: str, port: int, method: str, password: str): UdpServer

func UdpAddUser(s &: UdpServer, password: str): bool

func UdpServerPort(s: UdpServer): int

func UdpStep(s &: UdpServer): int

func UdpServe(s &: UdpServer)

func UdpStop(s: UdpServer)

func UdpDestroy(s &: UdpServer)

func Blake3Hash(p: void*, n: int, out: void*, outlen: int)

func Blake3KeyedHash(key32: void*, p: void*, n: int, out: void*, outlen: int)

func Blake3DeriveKey(context: str, p: void*, n: int, out: void*, outlen: int)

func Blake3SessionKey(psk: void*, klen: int, salt: void*, slen: int, out: void*)