-
Notifications
You must be signed in to change notification settings - Fork 0
EN Security
DNSCrypt component supply-chain traffic follows the same DNS privacy boundary: GitHub release API, archive, signature and redirect hosts are resolved with Cloudflare DoH over Shadowsocks with Google DoH fallback, then connected through the active local SOCKS5 tunnel. Component installation/update does not intentionally use the Windows/system resolver for these hosts.
Do not publish an exploitable vulnerability, credentials or private proxy configuration in a public issue.
Use GitHub private vulnerability reporting when available. Otherwise open the smallest safe public report possible, mark it as security-related, and omit sensitive values.
A useful report includes:
- affected version/commit;
- Windows version/build;
- whether User Mode, Admin Mode or Game Mode is involved;
- reproduction steps;
- sanitized logs.
Remove passwords, server addresses, subscription URLs, PAC secrets, tokens and full private configuration before sharing diagnostics.
Changes deserve additional review when they touch:
- settings rollback, schema changes or file-storage durability;
- startup executable copying and HKCU Run registration;
- NetworkService embedding/materialization;
- SHA-256 verification, extraction mutex or helper guard handle;
- UAC/elevation and named-pipe authentication/version handshake;
- WinDivert installation/runtime cleanup, pinned runtime hashes and FLOW/NETWORK ownership mapping;
- application self-update download/checksum/version validation, staged-updater digest/handle protection, temporary updater handoff, rollback, UAC and cleanup;
- release supply-chain gates: serviced .NET SDK/runtime baseline, fail-closed NuGet vulnerability audit and final EXE version verification;
- fragmented-packet handling and mandatory fail-closed DNSCrypt enforcement;
- active DNSCrypt runtimes disable plaintext bootstrap/system-DNS fallback; Automatic mode must resolve and pin a concrete resolver set from the signed catalog after applying DNSSEC, no-log, unfiltered and address-family constraints; resolver geography comes only from endpoint-IP GeoIP;
- SIP003 catalog downloads, ZIP/TAR extraction and managed plugin storage;
- SIP003 executable discovery/launch;
- secret display/import behavior.
User Mode must remain usable without extracting or launching the elevated NetworkService helper.
Application self-update is fail-closed. It accepts only the canonical GitHub release ZIP and matching SHA-256 sidecar from this repository, verifies the ZIP contains exactly one root Shadowsocks.exe, and validates the payload version. The source process hashes the staged updater, holds it open without write/delete sharing across process creation/UAC, and passes the expected digest through the internal handoff; the updater verifies its own staged image again before touching the installed product. It then waits for the old PID, preserves a rollback copy while replacing the target, and starts the installed new copy; only that installed copy removes the updater transaction. If Start with Windows launched the LocalAppData copy, the update target is the recorded original product EXE rather than the startup copy. Eligibility uses the higher of the startup-copy version and primary FileVersion, and updater mode performs a final target FileVersion check immediately before replacement; equal-version and downgrade payloads are rejected fail-closed.
Release restore is also fail-closed: NU1900-NU1904 are release-blocking when NuGetAudit=true, so either a known vulnerability or an unavailable vulnerability feed prevents packaging. Release builds require .NET SDK 10.0.303 or newer (the .NET 10.0.11 servicing baseline), and packaging verifies the final Shadowsocks.exe FileVersion against the requested release version.
Product settings belong in %LOCALAPPDATA%\Shadowsocks\settings.json in normal mode or the Clean Mode Temp session. Mutable data never belongs beside the release EXE. Registry writes are reserved for explicit Windows integration such as autostart/protocol/system-proxy behavior.
Managed SIP003 plugins are third-party executables. Background network updates are restricted to trusted built-in repository mappings; manual archives never auto-update and arbitrary repository URLs are not accepted. Downloads and extraction are bounded, archive names must reject traversal/rooted/Windows alternate-data-stream forms, and TAR links/special entries are rejected. When GitHub publishes a SHA-256 asset digest it is verified before package promotion. If both installed and candidate release tags parse as versions, a lower candidate is rejected to prevent downgrade. Updates stage below the active storage root and use rollback-safe replacement; an orphaned backup left by an interrupted swap is recovered on the next plugin-storage read. Mutable files never move beside Shadowsocks.exe.
This repository provides a client application. It does not operate proxy servers. Provider availability, account access, server-side configuration and third-party service policy are outside the client security scope.
Shadowsocks Reborn refreshes the signed DNSCrypt resolver catalog itself instead of allowing dnscrypt-proxy to bootstrap remote source hostnames. Cloudflare DoH (1.1.1.1, TLS/SNI cloudflare-dns.com) is the primary resolver and Google DoH (8.8.8.8, TLS/SNI dns.google) is the fallback; both DoH HTTPS connections are opened through the active local Shadowsocks SOCKS5 listener. The HTTPS download of public-resolvers.md and .minisig also travels through Shadowsocks after the source hostname is resolved by that DoH path.
The downloaded pair is size-bounded and verified with the pinned DNSCrypt public Minisign key before publication. dnscrypt-proxy then receives only the local authenticated cache with urls = [], bootstrap_resolvers = [] and ignore_system_dns = true. If refresh is temporarily unavailable, an existing valid signed cache may continue to be used; without a valid cache the operation fails closed and the previous DNS mode is retained.