feat: Support ShadowTLS v2 as Shadowsocks plugin #330

3andero · 2023-01-09T20:57:57Z

implement shadow-tls as a shadowsocks plugin.

Introduction

With the implementation, a shadow-tls proxy could be defined as:

- name: stls
  type: ss
  server: [REDACTED]
  port: 443
  cipher: chacha20-ietf-poly1305
  password: [SHADOWSOCKS_PASSWORD]
  plugin: shadow-tls
  plugin-opts:
    host: "cloud.tencent.com"
    password: [SHADOW_TLS_PASSWORD]

where server is the address of your shadowsocks server, host is the domain name that you want to disguise as, [SHADOWSOCKS_PASSWORD] is the password of the ss-server and [SHADOW_TLS_PASSWORD] is the password of shadow-tls itself.

You can refer to shadow-tls for server side setups. The idea is straightforward though.
To make the above config work, here's what you need to do on your server:

start the shadow-tls server (e.g., on 443):

./shadow-tls-x86_64-unknown-linux-musl server --server 127.0.0.1:24000 --tls cloud.tencent.com:443 --password [SHADOW_TLS_PASSWORD] --listen 0.0.0.0:443

start the shadowsocks server (e.g., on 24000)

ss-server -s 127.0.0.1 -p 24000 -m chacha20-ietf-poly1305 -k [SHADOWSOCKS_PASSWORD]

done

Discussion

There were a few choices I made for my implementation:

the plugin-opts:host doesn't seem to matter at all. You can provide an incorrect one but it still works. Technically I could have removed this entry but since shadow-tls requires this in its client config, I decided to keep it for consistency.
The shadow-tls client needs to do a tls handshake with the server. For this part I just reused the StreamConn from trojan (see https://github.com/MetaCubeX/Clash.Meta/blob/7e05d5c34975e0335b578b2e30ee7f735344583d/transport/shadowtls/shadowtls.go#L111-L115). I believe this will make it easier to modify tls fingerprint for shadow-tls once we adopt utls for trojan.
I fixed a bug in trojan (it didn't do handshake properly because of a typo).

…site function

add permissions for systemctl services clash-dashboard change to updated one

Update README.md

# Conflicts: # rules/provider/classical_strategy.go

Alpha

Update README.md

Update flake.nix hash

not yet tested

transport/shadowtls/shadowtls.go

transport/trojan/trojan.go

H1JK · 2023-01-10T02:24:53Z

transport/shadowtls/shadowtls.go

+	buf.Write(hashVal)
+	buf.Write(b)
+	_, err := s.Conn.Write(buf.Bytes())
+	return len(b), err


May this return a wrong number when some errors occured and no bytes are written?

Make sense. I actually copied this from https://github.com/MetaCubeX/Clash.Meta/blob/3645fbf16161b12e2c2a762155be56130868e901/transport/simple-obfs/tls.go#L98-L113
I guess I'll fix them altogether.

Wait, there's still a bug. I'll fix it right away

Is it possible that Conn.Write doesn't write all the buffer? I wrote based on the assumption that it's possible but that might look too defensive & verbose anyway.

The docs said a writer must return an error if n < len(buf). I'll clean those retries up.

transport/shadowtls/shadowtls.go

1. constant naming 2. import format 3. remove ephemeral trojan instance and add it as a shadowsocks struct field 4. incorrect numOfBytesWritten in ShadowTls::write and obfs::tls::write 5. incomplete write in ShadowTls::write and obfs::tls::write

H1JK · 2023-01-10T06:18:43Z

transport/shadowtls/shadowtls.go

+	buf.Write(b)
+	remain := buf.Len()
+	for remain > 0 {
+		n, err := s.Conn.Write(buf.Bytes())


Do you mean n, err := s.Conn.Write(buf.Bytes()[buf.Len()-remain:])?
btw, I prefer this:

// start from L123 buf.Write(b) n, err := s.Conn.Write(buf.Bytes()) if frontHeadroom := tlsHeaderLen + len(hashVal); n > frontHeadroom { return n - frontHeadroom, err } return 0, err

Do you mean n, err := s.Conn.Write(buf.Bytes()[buf.Len()-remain:])?

im outdated sry

Thanks for pointing it out. I've made some change since this version.
The docs said a writer must return an error if n < len(buf).
I kinda suspect if it's worth it to return the exact number of bytes written since we'll return an error anyways.
Another reason I would prefer just return 0 is that once we have a partially written packet, the connection is poisoned.
For example, suppose the packet is 100 bytes long and we only write 50 bytes. The next call to write could try to write the remaining 50 bytes, but write will treat it as next packet (and add header (0x17...) to it). The server would take this as the remaining 50 bytes (it doesn't know that actually comes with a header & it expects 100 bytes) then the connection has doomed to be closed.
So in this case simply returning a 0, err would probably enough.

im outdated sry

LOL no worries at all!

Yes, you are right.

H1JK

LGTM. @cubemaze how do you think?

This branch is now a little mess so please use squash when merge.

Reminder: This PR implements ShadowTLS v2 only.

3andero · 2023-01-10T06:45:08Z

This branch is now a little mess so please use squash when merge.

For Sure

3andero · 2023-01-10T07:14:41Z

It seems that something's wrong with the CI. Is there anything I could do? I'll wait and merge once I get approved from @cubemaze and the CI fixed

H1JK · 2023-01-10T07:17:51Z

It seems that something's wrong with the CI. Is there anything I could do? I'll wait and merge once I get approved from @cubemaze and the CI fixed

You can ignore that error since PR workflow has no permission to operate delete and upload to releases. The build was succeed, that's enough.

wwqgtxx · 2023-01-10T07:19:40Z

LGTM.

3andero · 2023-01-10T07:20:37Z

It seems that something's wrong with the CI. Is there anything I could do? I'll wait and merge once I get approved from @cubemaze and the CI fixed

You can ignore that error since PR workflow has no permission to operate delete and upload to releases. The build was succeed, that's enough.

Thanks for letting me know! I'll be AFK for a couple of hours. Feel free to leave me messages and I'll respond later. It's a pleasure to work with you guys. I'm happy to update my implementation once ShadowTLS updates correspondingly.

H1JK · 2023-01-11T01:15:45Z

Is it possible for us to invent a share link format for shadow-tls plugin (following SIP002)?

Then it would be much easier for clients to import shadowsocks proxies with shadow-tls, and also good for our converter.

msshn · 2023-02-20T11:32:20Z

Thanks for your great work, do you have any plan for ShadowTLS V3 ?

wwqgtxx · 2023-02-20T11:33:57Z

@msshn Coming soon, just waiting.

hiddify-com · 2023-03-05T07:34:48Z

great thanks would you please add v3 too?

wwqgtxx · 2023-03-05T07:36:29Z

@hiddify1 @msshn baaf509

adlyq and others added 23 commits June 9, 2022 14:18

fix: group filter touch provider

0a4570b

fix: 规则匹配默认策略组返回错误

eea9a12

refactor: clear linkname,reduce cycle dependencies,transport init geo…

a5acd3a

…site function

fix: leak dns when domain in hosts list

7d04904

Update README.md

d1decb8

add permissions for systemctl services clash-dashboard change to updated one

Merge pull request #94 from bash99/Meta

691cf1d

Update README.md

Merge branch 'Beta' into Meta

10d2d14

# Conflicts: # rules/provider/classical_strategy.go

Merge pull request #173 from MetaCubeX/Alpha

0703d6c

Alpha

Merge pull request #174 from MetaCubeX/Alpha

33abbdf

Alpha

Merge branch 'Alpha' into Beta

3a8eb72

Merge branch 'Beta' into Meta

5987f8e

Merge branch 'Alpha' into Beta

c7aa164

Merge branch 'Beta' into Meta

2ad84f4

chore: update github action

f968d0c

chore: update dependencies

9e20f9c

Update README.md

dfbe098

Merge pull request #282 from tdjnodj/Meta

667f42d

Update README.md

Merge remote-tracking branch 'origin/Alpha' into Beta

3b76a8b

Merge remote-tracking branch 'origin/Beta' into Meta

fa73b0f

fix: update flake.nix hash

a1d0f22

Merge pull request #327 from Rasphino/Meta

3645fbf

Update flake.nix hash

feat: impl shadow-tls as a shadowsocks plugin

7c5d137

not yet tested

fix: several bugs

7e05d5c

H1JK reviewed Jan 10, 2023

View reviewed changes

transport/shadowtls/shadowtls.go Outdated Show resolved Hide resolved

H1JK reviewed Jan 10, 2023

View reviewed changes

transport/trojan/trojan.go Outdated Show resolved Hide resolved

H1JK reviewed Jan 10, 2023

View reviewed changes

H1JK linked an issue Jan 10, 2023 that may be closed by this pull request

Proposal: Adding Shadow-TLS support #329

Closed

wwqgtxx changed the base branch from Meta to Alpha January 10, 2023 05:06

fix: several comments

bedc240

1. constant naming 2. import format 3. remove ephemeral trojan instance and add it as a shadowsocks struct field 4. incorrect numOfBytesWritten in ShadowTls::write and obfs::tls::write 5. incomplete write in ShadowTls::write and obfs::tls::write

3andero requested a review from H1JK January 10, 2023 05:53

3andero added 2 commits January 9, 2023 22:04

fix: hot fix

81011a2

fix: clean up

5badbea

H1JK reviewed Jan 10, 2023

View reviewed changes

H1JK approved these changes Jan 10, 2023

View reviewed changes

H1JK changed the title ~~Impl shadow tls~~ feat: Support ShadowTLS v2 as Shadowsocks plugin Jan 10, 2023

wwqgtxx requested review from wwqgtxx and stitchrs January 10, 2023 07:17

wwqgtxx approved these changes Jan 10, 2023

View reviewed changes

stitchrs approved these changes Jan 10, 2023

View reviewed changes

stitchrs merged this pull request into MetaCubeX:Alpha Jan 10, 2023

stitchrs pushed a commit that referenced this pull request Jan 10, 2023

feat: Support ShadowTLS v2 as Shadowsocks plugin (#330)

51f9b34

This was referenced Jan 15, 2023

希望出一个安卓版 ihciah/shadow-tls#25

Open

Which client is supported ihciah/shadow-tls#56

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Support ShadowTLS v2 as Shadowsocks plugin #330

feat: Support ShadowTLS v2 as Shadowsocks plugin #330

3andero commented Jan 9, 2023 •

edited

Loading

H1JK Jan 10, 2023

3andero Jan 10, 2023

3andero Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023

3andero Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023

H1JK Jan 10, 2023 •

edited

Loading

H1JK Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023 •

edited

Loading

H1JK Jan 10, 2023

H1JK left a comment •

edited

Loading

3andero commented Jan 10, 2023

3andero commented Jan 10, 2023

H1JK commented Jan 10, 2023

wwqgtxx commented Jan 10, 2023

3andero commented Jan 10, 2023

H1JK commented Jan 11, 2023

msshn commented Feb 20, 2023

wwqgtxx commented Feb 20, 2023

hiddify-com commented Mar 5, 2023

wwqgtxx commented Mar 5, 2023

feat: Support ShadowTLS v2 as Shadowsocks plugin #330

feat: Support ShadowTLS v2 as Shadowsocks plugin #330

Conversation

3andero commented Jan 9, 2023 • edited Loading

Introduction

Discussion

H1JK Jan 10, 2023

Choose a reason for hiding this comment

3andero Jan 10, 2023

Choose a reason for hiding this comment

3andero Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

3andero Jan 10, 2023

Choose a reason for hiding this comment

3andero Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

3andero Jan 10, 2023

Choose a reason for hiding this comment

H1JK Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

H1JK Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

3andero Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

3andero Jan 10, 2023 • edited Loading

Choose a reason for hiding this comment

H1JK Jan 10, 2023

Choose a reason for hiding this comment

H1JK left a comment • edited Loading

Choose a reason for hiding this comment

3andero commented Jan 10, 2023

3andero commented Jan 10, 2023

H1JK commented Jan 10, 2023

wwqgtxx commented Jan 10, 2023

3andero commented Jan 10, 2023

H1JK commented Jan 11, 2023

msshn commented Feb 20, 2023

wwqgtxx commented Feb 20, 2023

hiddify-com commented Mar 5, 2023

wwqgtxx commented Mar 5, 2023

3andero commented Jan 9, 2023 •

edited

Loading

3andero Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023 •

edited

Loading

H1JK Jan 10, 2023 •

edited

Loading

H1JK Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023 •

edited

Loading

3andero Jan 10, 2023 •

edited

Loading

H1JK left a comment •

edited

Loading