Switches the cryptographic backend so that ring is no longer pulled
into shadowsocks-rust on any supported target.
* shadowsocks-crypto: use the new aws-lc-rs backend in place of
the ring feature
* tokio-rustls: select the aws_lc_rs provider instead of ring.
* hickory-resolver: use tls-aws-lc-rs, https-aws-lc-rs and
h3-aws-lc-rs in place of the *-ring variants.
The only remaining ring path in the dependency tree is via quinn-proto on
wasm32-unknown-unknown, which aws-lc-rs cannot target and which
shadowsocks does not support.
Phase 2 of the outbound proxy refactor. The new
OutboundProxyDatagram type implements DatagramSocket / DatagramSend /
DatagramReceive on top of a freshly-bound local UDP socket plus one
SOCKS5 UDP ASSOCIATE per chain hop. Each datagram on the wire carries
N nested UdpAssociateHeader frames (one per hop), the inner-most one
addressing the ss-server's UDP external endpoint.
Per-hop control connections are built by reusing the existing TCP
chain builder (connect_chain_for_udp_associate) so all of the
shadowsocks DNS resolver / ConnectOpts behaviour still applies.
Integration:
* OutboundProxyClient::associate_udp + supports_udp().
* OutboundProxyClient::supports_udp() returns true iff every hop is
SOCKS5; HTTP/HTTPS hops cannot transport UDP and downgrade the
whole chain to 'unsupported'.
* local::net::udp::association::create_proxied_socket dispatches
based on supports_udp(): when true the per-association socket is
ProxySocket<OutboundProxyDatagram> wrapping the chained datagram;
otherwise we keep the previous direct ProxySocket<ShadowUdpSocket>.
* When the chain is configured but unable to relay UDP, sslocal /
ssserver emit a single startup WARN ('UDP traffic will bypass the
chain') instead of failing — runtime traffic transparently falls
back to a direct connection to the ss-server.
OutboundProxyStream gains try_into_tcp() so SOCKS5-only chains can
recover the bare TcpStream as keep-alive control connections —
Sync-friendly storage required because the HTTP CONNECT variant
internally holds a hyper::upgrade::Upgraded which is !Sync.
Replace the previous parallel outbound proxy implementations
(net::outbound_proxy + local::net::tcp::outbound_proxy) with a single
self-contained module at net::outbound, exposing OutboundProxyClient,
OutboundProxyStream, Socks5Auth, HttpProxyAuth and a TcpDialer trait.
Highlights:
* OutboundProxyStream is now a closed-set enum (Bypassed / Https / Http)
with statically-dispatched poll_* — no more Box<dyn ProxyStream>. The
HTTPS variant boxes its inner OutboundProxyStream solely to break the
recursive type instantiation required by the TLS libraries; this is
not dynamic dispatch.
* HTTP CONNECT client is rebuilt on top of hyper::client::conn::http1
+ hyper::upgrade. The hand-rolled status-line parser (which could
drop bytes that arrived in the same read() as the header terminator,
did not handle 100-Continue, etc.) is gone.
* Auth parameters are now strongly typed:
Socks5Auth::{None, UsernamePassword{..}}
HttpProxyAuth::{None, Basic{..}}
Both enums are #[non_exhaustive] for forward compatibility.
* AutoProxyClientStream's ProxiedViaChain variant is folded back into a
single Proxied(ProxyClientStream<MonProxyStream<OutboundTransport>>)
variant, with OutboundTransport = Direct(TcpStream) | Chained(...).
* ServiceContext (both server and local) now caches an
Arc<OutboundProxyClient> built once at set_outbound_proxies time
instead of re-parsing the chain on every connection.
* The standalone Socks5TcpClient / Socks5UdpClient implementations
previously duplicated across net::socks5_client and
local::socks::client::socks5 are unified into the latter location;
net::outbound::socks5 only keeps the chain-friendly Socks5Negotiator.
* When UDP is enabled but the configured chain contains a non-SOCKS5
hop, sslocal/ssserver emits a single startup warning. Phase 2 will
add UDP relay support for SOCKS5-only chains.
BREAKING CHANGE: the following items have moved or been removed:
* crate::net::outbound_proxy — removed; use crate::net::OutboundProxyClient
* crate::net::http_connect::HttpConnectClient — moved to
crate::net::HttpConnectClient (only available with the local-http feature)
* crate::net::Socks5TcpClient (the chain-mixing wrapper) — split: the
pure SOCKS5 client is now crate::local::socks::client::socks5::Socks5TcpClient;
the in-band negotiator is crate::net::Socks5Negotiator
* crate::local::net::tcp::outbound_proxy — removed
* ServiceContext::outbound_proxies() — replaced by outbound_client()
returning Option<&Arc<OutboundProxyClient>>
After an AEAD2022 handshake with a ServerUserManager, the authenticated
user's raw key is available inside DecryptedReader but not reachable
from the public API. Expose it via:
CryptoStream::user_key() -> Option<&[u8]>
ProxyServerStream::user_key() -> Option<&[u8]>
This lets callers (e.g. clash-rs) identify which multi-user identity
was authenticated without having to manually peek and re-derive the
identity subkey via BLAKE3 + AES-256-ECB before the handshake.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Extract HttpConnectClient to dedicated http_connect.rs module
- Add conduct_handshake_and_connect method to Socks5TcpClient for stream-based SOCKS5 negotiation
- Refactor outbound_proxy to use Socks5TcpClient and HttpConnectClient methods instead of direct protocol implementation
- Update module exports in net/mod.rs
- Move HTTP CONNECT logic to shared outbound_proxy helper module
- Simplify Socks5TcpClient to only handle SOCKS5 protocol, remove OutboundProxyAuth dependency
- Extract proxy chain utilities into separate net/outbound_proxy.rs with HTTP/HTTPS support
- Add UDP mode warnings in local and server startup when proxy chain is configured
- Share ProxyStream trait between modules for better code organization
- Gate HTTPS proxy support with feature flags (local-http-native-tls or local-http-rustls)
renovate[bot]andzonyitoo
Linus Färnstrand
Alessandro Riva
Yuwei BaandCopilot
Fan Yang
Pain
dependabot[bot]
Aaron Chen