goshadowsocks2

README

go-shadowsocks2

A fresh implementation of Shadowsocks in Go.

GoDoc at https://godoc.org/github.com/shadowsocks/go-shadowsocks2/

Features

• SOCKS5 proxy with UDP Associate
• Support for Netfilter TCP redirect (IPv6 should work but not tested)
• UDP tunneling (e.g. relay DNS packets)
• TCP tunneling (e.g. benchmark with iperf3)
• SIP003 plugins

Install

Pre-built binaries for common platforms are available at https://github.com/shadowsocks/go-shadowsocks2/releases

Install from source

go get -u -v github.com/shadowsocks/go-shadowsocks2

Basic Usage

Server

Start a server listening on port 8488 using AEAD_CHACHA20_POLY1305 AEAD cipher with password your-password.

go-shadowsocks2 -s 'ss://AEAD_CHACHA20_POLY1305:your-password@:8488' -verbose

Client

Start a client connecting to the above server. The client listens on port 1080 for incoming SOCKS5 connections, and tunnels both UDP and TCP on port 8053 and port 8054 to 8.8.8.8:53 and 8.8.4.4:53 respectively.

go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' \
    -verbose -socks :1080 -u -udptun :8053=8.8.8.8:53,:8054=8.8.4.4:53 \
                             -tcptun :8053=8.8.8.8:53,:8054=8.8.4.4:53

Replace [server_address] with the server's public address.

Advanced Usage

Netfilter TCP redirect (Linux only)

The client offers -redir and -redir6 (for IPv6) options to handle TCP connections redirected by Netfilter on Linux. The feature works similar to ss-redir from shadowsocks-libev.

Start a client listening on port 1082 for redirected TCP connections and port 1083 for redirected TCP IPv6 connections.

go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' -redir :1082 -redir6 :1083

TCP tunneling

The client offers -tcptun [local_addr]:[local_port]=[remote_addr]:[remote_port] option to tunnel TCP. For example it can be used to proxy iperf3 for benchmarking.

Start iperf3 on the same machine with the server.

iperf3 -s

By default iperf3 listens on port 5201.

Start a client on the same machine with the server. The client listens on port 1090 for incoming connections and tunnels to localhost:5201 where iperf3 is listening.

go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' -tcptun :1090=localhost:5201

Start iperf3 client to connect to the tunneld port instead

iperf3 -c localhost -p 1090

SIP003 Plugins (Experimental)

Both client and server support SIP003 plugins. Use -plugin and -plugin-opts parameters to enable.

Client:

go-shadowsocks2 -c 'ss://AEAD_CHACHA20_POLY1305:your-password@[server_address]:8488' \
    -verbose -socks :1080 -u -plugin v2ray

Server:

go-shadowsocks2 -s 'ss://AEAD_CHACHA20_POLY1305:your-password@:8488' -verbose \
    -plugin v2ray -plugin-opts "server"

Note:

It will look for the plugin in the current directory first, then $PATH.

UDP connections will not be affected by SIP003.

Design Principles

The code base strives to

• be idiomatic Go and well organized;
• use fewer external dependences as reasonably possible;
• only include proven modern ciphers;

Documentation

Index

• Constants
• Variables
• func KillPlugin()
• func Redir6Local(addr, server string, shadow func(net.Conn) net.Conn)
• func RedirLocal(addr, server string, shadow func(net.Conn) net.Conn)
• func SocksLocal(addr, server string, shadow func(net.Conn) net.Conn)
• func StartPlugin(plugin, pluginOpts, ssAddr string, isServer bool) (newAddr string, err error)
• func TcpLocal(addr, server string, shadow func(net.Conn) net.Conn, ...)
• func TcpTun(addr, server, target string, shadow func(net.Conn) net.Conn)
• func UdpLocal(laddr, server, target string, shadow func(net.PacketConn) net.PacketConn)
• func UdpSocksLocal(laddr, server string, shadow func(net.PacketConn) net.PacketConn)
• type TcpPort
  • func NewTcpPort(addr string, shadow func(net.Conn) net.Conn) *TcpPort
  • func (tp *TcpPort) CloseRemote()
  • func (tp *TcpPort) StartRemote()
• type UdpPort
  • func NewUdpPort(addr string, shadow func(net.PacketConn) net.PacketConn) *UdpPort
  • func (up *UdpPort) CloseRemote()
  • func (up *UdpPort) StartRemote()

Constants

const (
	SO_ORIGINAL_DST      = 80 // from linux/include/uapi/linux/netfilter_ipv4.h
	IP6T_SO_ORIGINAL_DST = 80 // from linux/include/uapi/linux/netfilter_ipv6/ip6_tables.h
)

const GETSOCKOPT = syscall.SYS_GETSOCKOPT

Variables

var Config struct {
	Verbose    bool
	UDPTimeout time.Duration
}

Functions

func KillPlugin

func KillPlugin()

func Redir6Local

func Redir6Local(addr, server string, shadow func(net.Conn) net.Conn)

Listen on addr for netfilter redirected TCP IPv6 connections.

func RedirLocal

func RedirLocal(addr, server string, shadow func(net.Conn) net.Conn)

Listen on addr for netfilter redirected TCP connections

func SocksLocal

func SocksLocal(addr, server string, shadow func(net.Conn) net.Conn)

Create a SOCKS server listening on addr and proxy to server.

func StartPlugin

func StartPlugin(plugin, pluginOpts, ssAddr string, isServer bool) (newAddr string, err error)

func TcpLocal

func TcpLocal(addr, server string, shadow func(net.Conn) net.Conn, getAddr func(net.Conn) (socks.Addr, error))

Listen on addr and proxy to server to reach target from getAddr.

func TcpTun

func TcpTun(addr, server, target string, shadow func(net.Conn) net.Conn)

Create a TCP tunnel from addr to target via server.

func UdpLocal

func UdpLocal(laddr, server, target string, shadow func(net.PacketConn) net.PacketConn)

Listen on laddr for UDP packets, encrypt and send to server to reach target.

func UdpSocksLocal

func UdpSocksLocal(laddr, server string, shadow func(net.PacketConn) net.PacketConn)

Listen on laddr for Socks5 UDP packets, encrypt and send to server to reach target.

Types

type TcpPort

type TcpPort struct {
	// contains filtered or unexported fields
}

func NewTcpPort

func NewTcpPort(addr string, shadow func(net.Conn) net.Conn) *TcpPort

func (*TcpPort) CloseRemote

func (tp *TcpPort) CloseRemote()

func (*TcpPort) StartRemote

func (tp *TcpPort) StartRemote()

type UdpPort

type UdpPort struct {
	// contains filtered or unexported fields
}

func NewUdpPort

func NewUdpPort(addr string, shadow func(net.PacketConn) net.PacketConn) *UdpPort

func (*UdpPort) CloseRemote

func (up *UdpPort) CloseRemote()

func (*UdpPort) StartRemote

func (up *UdpPort) StartRemote()