SIP022 requires that in a request header, either initial payload or
padding MUST be present. When the first payload is empty (e.g. handshake
triggered by an empty write for server-first protocols), the client
could pick padding 0 with probability 1/901, generating a header that
servers MUST reject per the spec, causing ~1/901 handshakes to fail
against ssserver built from the same crate.
Pick the padding size from 1..=AEAD2022_MAX_PADDING_SIZE instead.
fix#2184
* systemd: Use network-online.target for server
Fixes#2186
ss-server needs to wait for the network to be up to be able to bind to non-wildcard IPs. Interface is configured at `network-online.target` but not at `network.target`.
ss-local unit is kept the same, with `After=network.target` for proper ordering at shutdown - unit is stopped before network is shutdown.
* systemd unit: improvements
`exec` is [recommended](https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Type=).
Add `NoNewPriviledges` which has been used in [Arch packaging](https://gitlab.archlinux.org/archlinux/packaging/packages/shadowsocks-rust/-/blob/main/shadowsocks-rust-server%40.service?ref_type=heads).
Add `CAP_NET_ADMIN` in ss-local which is needed for TUN mode.
Removed `CAP_NET_BIND_SERVICE` from ss-local. Do you really need to bind to priviledged port in *client*?
Debian unit left un-hardened. I'm not sure why it's different from the other ss-server unit.
EncryptedWriter.poll_write_encrypted keeps the encrypted buffer and its
on-wire offset across Poll::Pending, but returned the length of the
buffer passed on the *retried* call instead of the plaintext length that
was actually assembled into the pending frame.
Tokio's copy/copy_bidirectional may append freshly read data to the
input slice while the writer is Pending, so the reported count could
exceed what was actually encrypted and sent, silently dropping the
appended bytes.
Fixes#2175
smoltcp 0.13 (PR smoltcp-rs/smoltcp#1106) made automatic ICMP echo
replies opt-in via the "auto-icmp-echo-reply" feature flag. It is only
part of smoltcp's default features, which this crate disables with
default-features = false. Since the smoltcp 0.13 upgrade, the Tun local
silently drops ICMP Echo Requests and no longer responds to ping.
Fixes#2178
- Replace catch-all arm in OutboundProxyStream::try_into_tcp with
explicit cfg-gated variant arms, fixing unreachable_patterns warning
when local-http features are disabled
- Gate utils module behind local/server features, fixing dead_code
warning for ServerHandle when neither module is compiled
Add a dedicated config option for
inbound (listener) UDP sockets, instead of reusing the outbound option.
- SSConfig / SSServerExtConfig: new
JSON field (global + per-server)
- Config / ServerInstanceConfig: new field, defaults to false
- server/manager/local: accept_opts.udp.allow_fragmentation now sourced
from the inbound option; per-server override split into inbound/outbound
- README: document the new option in both JSON examples
- tests/udp.rs: fix unused import of AcceptOpts on non-Linux platforms
`net/sys/unix/bsd/mod.rs` already routes macos, ios, watchos and tvos
to `bsd/macos.rs`, and that module unconditionally imports
`net::udp::{BatchRecvMessage, BatchSendMessage}`. But the nine cfg
gates in `net/udp.rs` list only macos and ios among the Apple
platforms, so on watchos and tvos those items are configured out while
the importer is still compiled -- E0432, the crate does not build.
Add watchos and tvos to the nine gates so the two lists agree.
ty
Klaaktu
renovate[bot]
peng weikang
gengjiawen