* feat(acl): add AclHandle to swap ACL rules atomically at runtime
AccessControl is immutable after loading, and ServiceContext used to store
it directly, so rules were frozen for the lifetime of the process.
Wrap the active rules in an ArcSwap-based AclHandle. Readers take a cheap
Arc snapshot which stays valid across a swap, enabling hot-reloading
without interrupting the service. reload() re-parses the retained file
path and only swaps the new rules in when parsing succeeds.
* feat(local): hot-reload the global ACL file through ServiceContext
Store the ACL as an AclHandle in ServiceContext. set_acl keeps its
signature and wraps the rules in a handle; cloned contexts share it, so
every listener sees the same swappable rules. acl() now returns an
Arc<AccessControl> snapshot instead of a reference, which cannot be
preserved across an atomic swap.
ServiceContext::reload_acl() re-reads the ACL file, swaps the new rules
in atomically and clears the DNS relay's reverse-lookup cache, which
caches decisions derived from the old rules. On failure the previous
rules stay active.
Server keeps the global context and exposes acl_reload_context() so
embedders can trigger reloads. Contexts with a private ACL keep their
own handle and are not covered by the global reload.
* feat(local): reload the ACL file on SIGUSR2 in sslocal
sslocal already reloads its server list from the config file on SIGUSR1.
Add a second reload trigger on SIGUSR2 for the ACL file, so routing
rules can be updated without restarting the process or interrupting
established connections.
Like the SIGUSR1 reloader, the task is Unix-only and compiles away on
Windows. ssservice's local mode shares this module and inherits it.
Document both signals in the README and cover the reload with an
integration test that verifies new connections are routed by the new
rules after each reload.
* refactor(acl): address review feedback for ACL hot-reload
- Rename `AclHandle` to `AccessControlHandle`, aligning the name with `AccessControl`
- Rename `Server::acl_reload_context` to `Server::context`, so the shared global context can be reused for other runtime operations
- Fold reload logging into `AccessControlHandle::reload`, keeping `ServiceContext::reload_acl` thin
- Record the config file and the ACL file as absolute paths at load time, so both SIGUSR1 and SIGUSR2 reloads keep working after daemonizing (which `chdir`s to `/`); symlinks are deliberately preserved by resolving with cwd instead of canonicalizing
* refactor(local): drop needless pending() in the non-Unix ACL reload task stub
The task may complete immediately: the main loop already tolerates early task exit, mirroring the existing Windows behavior of the SIGUSR1 reload task. This also releases the ServiceContext clone right away instead of holding it forever.
---------
Co-authored-by: ty <zonyitoo@gmail.com>
* [POC] basic implementation of TCP redirecting tun (#581)
* [POC] basic implementation of UDP redirection of Tun
* build with action
* add configuration interface for tun
* refine document and command line options
* outbound-bind-addr instead of reusing local_address for outbound sockets
* support customizing udp expiry and capacity
* make clippy happy
* fixed build error for Android
* add docs
* make a customized AsyncFd with the released tun crate
* TUN_INTERFACE_NAME to_owned directly
* ignore accept errors for tcp tun
* tun supports Android only on master branch
* android doesnt support setting IFF_NO_PI
* set route for macos automatically when creating tun
* set route for macos directly with PF_ROUTE
* Linux-like uses ETH_P_IP and ETH_P_IPV6
* use tun on crates.io and ignores Android support temporary
* update dependencies
* manage UDP associations with LFU
- DNS associations could be evicted firstly then others like HTTP/3
* UDP redir caches inbound non-local socket
- Optimization: prevent creating new sockets for the same remotes
* updated libc to v0.2.94 for unified TCP options
* make clippy happy
* Pin lfu-cache to v1.2.1 for edward-shen/lfu-cache#2
* UDP target should cache with expiration 1hrs
* UDP tunnel test with an echo server
- CI crashes occasionally because of 8.8.8.8:53 doesn't respond
ref #452
- adding `mode` in `locals` and `servers` extended format`
redir and tunnel supports customizing UDP binding address by `udp_addr`
BREAKING CHANGES:
- `sslocal` and `ssserver` command line option `-u` and `-U` can only
control mode of command line specified local or server instance`
ref #452
- support `locals` in configuration file, running multiple local server
instance simultaneously
- support `unix://` in `dns` configuration
BREAKING CHANGE:
- `sslocal`'s `--dns-addr` is now only available in Android
- shadowsocks-service's `Config` struct have lots of changes
* upgrade to tokio v1.0
- removed tokio::prelude
- upgrade hyper to v0.14, tokio-rustls to v0.22
still working on migrating trust-dns-* and tokio-native-tls
ref #354
* tokio v1.0 removed with_poll
fix#355, ref #354
* removed CTRL-BREAK signal handler
ref #354
* fixes compliation error, add missing return
fixes#355
* allow setting SO_SNDBUF and SO_RCVBUF for sockets
ref #352
* completely removed unix socket based DNS resolving
ref shadowsocks/shadowsocks-android#2622
* fix build issue on Windows
* fixed uds poll_write loop, fixed udp outbound loopback check
ref #355
* disable default trust-dns resolver for andorid, macos, ios
This commit also:
- Optimized resolve() logging with elapsed time
- updated tokio-native-tls
* local-dns removed from default features
* fix rustc version with rust-toolchain
* Bump bytes from 0.6.0 to 1.0.0
* add dependabot badge
* indirectly depend on trust_dns_proto via trust_dns_resolver
* auto reconnect if udp sendto failed
* recreate proxied socket if recv() returns failure
* increase score precision to 0.0001
* example of log4rs configuration
* PingBalancer instance shouldn't kill probing task when dropping
- Probing task should be controlled by the internal shared state
* switch to trust-dns main for latest tokio 1.0 support
* Refactored and separate library into crates
- shadowsocks: the core feature of shadowsocks
- shadowsocks-service: library for building shadowsocks services
- dns, http, redir, socks, tunnel
- load balancer
- shadowsocks-rust: release binaries
fix#347
* unified DnsResolver implementation
* unified local service common parameters into ServiceContext
- ServiceContext is common parameters shared between all local
implementations
- Completely removed https local support
* add #292 reply attack protection
* migrated redir local server
* support customizing outbound socket bind address
* manager outbound socket should accepts connect_opts
* republic local implementations
* socks5 udp server should always listen to client address
* socks4 controlled by local-socks4 feature
* socks4 also obey mode configuration
* socks server tcp cannot be disable. add support of udp-bind-addr parameter
* add udp-bind-addr for customizing udp-relay bind-addr
* local-dns infra, support customizing resolver
* fully implements DNS relay server
* support binding to specific interface on Linux-like platform
* tcp cannot be disabled in socks
* enable local-flow-stat
* fixed windows build
* fixed android specific warnings and compile errors
* allow udp_only mode in socks5
* dns relay listens to both TCP and UDP, mode controls outbound upstreams
* dns relay retries twice if request failed
* doc
* fix DnsClient typo
* fix stream EncryptWriter bug
* allow disable logging output
updated dependencies
* add readme
* refine doc
* remove depending on trust-dns-client
* socks4/4a client
* allow socks5 udp_only mode, fixes compile warning
* create standalone socks5 UDP relay server
- socks5 UDP association full cone (NAT2)
* server udp relay supports full cone (NAT2)
* acl moved to crate root
* redir udp relay support full cone (NAT2)
* standard socks5 udp test must use tcp_and_udp mode
* set server context fields with pub APIs
* udp_max_associations and udp_timeout default value set in Config
* local dns resolver retry with fixed attempts
* max_udp_association keeps unlimited by default
* fixed logging binary name
* pops first exited future result for local and server
* update reverse target index cache
* fix ProxyClientStreamWriteHalf that allows sending empty buffers
ref #232
* remove unused import when socks4 is disabled
* make balancer become a globally shared object
* print plugin exit status
* control local, server, manager services in features
- shadowsocks-core is a library contains all necessary functions for
running shadowsocks
- shadowsocks is a binary crate that ships end-user products
ref #326
- Renamed local-dns-relay feature to local-dns
- sslocal DNS relay cmd options become --dns-addr --local-dns-addr --remote-dns-addr
- sslocal accepts --protocol dns to start standalone DNS resolver
- Hide local-tunnel specific configuration fields if feature disabled
* Socks5 library, main tcp relay implementation migrated with async/await
* UDP relay local migrated to async/await
* UDP relay server migrated to async/await
* Migrated UDP DNS to async/await, follows tokio-process
* Removed unused uses, add dyn keyword for TraitObjects
* [#151] Uses dl.google.com/generate_204 to check connection latency
* Make sslocal/ssserver TCP relay work successfully, disabled UDP and DNS relay temporary
* Handshake before performing actual read & write
* Wraps timeout logic into a Connection<S> struct
* Make UDP relay work again
* Local uses copy directly
* Completely removed unused ssdns
* Fixed test
* Uses tokio::main macro for main entrance
* Fixed a missing use in local.rs
* Updated travis openssl to 1.1.0L
* Windows signal
* Migrated tokio 0.2 release with std::future support
fix#173
* fixed windows monitor build
* Uses tokio on crates.io
* ctrl_c is a Future
* Run tests with single tokio runtime
* Uses spawn_blocking only with threaded runtime
* Killing all detached Tasks if server is exited
* Updated version to v1.8.0
* Removed unused pin-project
* Uses dns resolver built in tokio
* Explicitly uses threaded scheduler by default
* Reverted, it is threaded scheduler by default
* Updated bytes to v0.5
* Updated many dependencies
* Add a tunnel app (#175)
It can be used to benchmark.
Usage:
sstunnel -v -s 127.0.0.1:8488 -m plain -k password -b 127.0.0.1:1090 -f 127.0.0.1:5201
"-f xxx" : the target/forwad address xxx
* Removed unused remote-dns config field (ssdns is removed)
* Separated TCP local tunneling to its own module
* Implements FromStr for Address
* Fixed typo
* Add tunnel unit test
* Updated tokio to v0.2.2, fixed basic scheduler bug
* Removed Connection, uses try_timeout instead. Revert back to use 8K buffer
* Revert "Removed Connection, uses try_timeout instead. Revert back to use 8K buffer"
This reverts commit 82f698e520.
* Uses Delay instead of Timeout
* Delay doesnt return io::Result
* Revert "Delay doesnt return io::Result"
This reverts commit 74dc294d16.
* Fixed bug, Connection timeout should be shared between read & write operations
Qiu Yuzhouandty
Aaron Chen
Integral
Li Xiaobin
ty
luozijun