cargo build --release --bin "sswinservice" --features "winservice"

将安装为 Windows 服务（PowerShell）

New-Service -Name "shadowsocks-local-service" `
            -DisplayName "Shadowsocks Local Service" `
            -BinaryPathName "<Path\to>\sswinservice.exe local -c <Path\to>\local_config.json"

还有其他方法可以将 sswinservice 作为 Windows 服务安装，例如 sc 命令。

如您所注意到的，-BinaryPathName 不仅包含 sswinservice.exe，还包括 local -c local_config.json。这些命令行参数将在 Windows 服务启动时用作默认参数。您也可以使用自定义参数启动服务。

更多请参阅 Microsoft 的文档。

sswinservice 的参数与 ssservice 完全相同。它支持 local、server 和 manager 子命令。

服务器

# Read server configuration from file
ssserver -c /path/to/shadowsocks.json

# Pass all parameters via command line
ssserver -s "[::]:8388" -m "aes-256-gcm" -k "hello-kitty" --plugin "v2ray-plugin" --plugin-opts "server;tls;host=github.com"

服务器管理器

支持的 管理多个用户 API

• add - 启动服务器实例
• remove - 删除现有服务器实例
• list - 列出所有当前运行的服务器
• ping - 列出所有服务器的统计数据

注意：不支持 stat 命令。因为服务器与管理者本身在同一进程中运行。

# Start it just with --manager-address command line parameter
ssmanager --manager-address "127.0.0.1:6100"

# For *nix system, manager can bind to unix socket address
ssmanager --manager-address "/tmp/shadowsocks-manager.sock"

# You can also provide a configuration file
#
# `manager_address` key must be provided in the configuration file
ssmanager -c /path/to/shadowsocks.json

# Create one server by UDP
echo 'add: {"server_port":8388,"password":"hello-kitty"}' | nc -u '127.0.0.1' '6100'

# Close one server by unix socket
echo 'remove: {"server_port":8388}' | nc -Uu '/tmp/shadowsocks-manager.sock'

对于管理者UI，更多详细信息请查看 shadowsocks-manager 项目。

示例配置

{
    // Required option
    // Address that ssmanager is listening on
    "manager_address": "127.0.0.1",
    "manager_port": 6100,

    // Or bind to a Unix Domain Socket
    "manager_address": "/tmp/shadowsocks-manager.sock",

    "servers": [
        // These servers will be started automatically when ssmanager is started
    ],

    // Outbound socket binds to this IP address
    // For choosing different network interface on the same machine
    "local_address": "xxx.xxx.xxx.xxx",

    // Other options that may be passed directly to new servers
}

配置

{
    // LOCAL: Listen address. This is exactly the same as `locals[0]`
    // SERVER: Bind address for remote sockets, mostly used for choosing interface
    //         Don't set it if you don't know what's this for.
    "local_address": "127.0.0.1",
    "local_port": 1080,

    // Extended multiple local configuration
    "locals": [
        {
            // Basic configuration, a SOCKS5 local server
            "local_address": "127.0.0.1",
            "local_port": 1080,
            // OPTIONAL. Setting the `mode` for this specific local server instance.
            // If not set, it will derive from the outer `mode`
            "mode": "tcp_and_udp",
            // OPTIONAL. Authentication configuration file
            // Configuration file document could be found in the next section.
            "socks5_auth_config_path": "/path/to/auth.json",
            // OPTIONAL. Instance specific ACL
            "acl": "/path/to/acl/file.acl",
            // OPTIONAL. macOS launchd activate socket
            "launchd_tcp_socket_name": "TCPListener",
            "launchd_udp_socket_name": "UDPListener"
        },
        {
            // SOCKS5, SOCKS4/4a local server
            "protocol": "socks",
            // Listen address
            "local_address": "127.0.0.1",
            "local_port": 1081,
            // OPTIONAL. Enables UDP relay
            "mode": "tcp_and_udp",
            // OPTIONAL. Customizing the UDP's binding address. Depending on `mode`, if
            // - TCP is enabled, then SOCKS5's UDP Association command will return this address
            // - UDP is enabled, then SOCKS5's UDP server will listen to this address.
            "local_udp_address": "127.0.0.1",
            "local_udp_port": 2081,
            // OPTIONAL. macOS launchd activate socket
            "launchd_tcp_socket_name": "TCPListener",
            "launchd_udp_socket_name": "UDPListener"
        },
        {
            // Tunnel local server (feature = "local-tunnel")
            "protocol": "tunnel",
            // Listen address
            "local_address": "127.0.0.1",
            "local_port": 5353,
            // Forward address, the target of this tunnel
            // In this example, this will build a `127.0.0.1:5353` -> `8.8.8.8:53` tunnel
            "forward_address": "8.8.8.8",
            "forward_port": 53,
            // OPTIONAL. Customizing whether to start TCP and UDP tunnel
            "mode": "tcp_only",
            // OPTIONAL. macOS launchd activate socket
            "launchd_tcp_socket_name": "TCPListener",
            "launchd_udp_socket_name": "UDPListener"
        },
        {
            // HTTP local server (feature = "local-http")
            "protocol": "http",
            // Listen address
            "local_address": "127.0.0.1",
            "local_port": 3128,
            // OPTIONAL. macOS launchd activate socket
            "launchd_tcp_socket_name": "TCPListener"
        },
        {
            // DNS local server (feature = "local-dns")
            // This DNS works like China-DNS, it will send requests to `local_dns` and `remote_dns` and choose by ACL rules
            "protocol": "dns",
            // Listen address
            "local_address": "127.0.0.1",
            "local_port": 53,
            // OPTIONAL. DNS local server uses `tcp_and_udp` mode by default
            "mode": "udp_only",
            // Local DNS address, DNS queries will be sent directly to this address
            "local_dns_address": "114.114.114.114",
            // OPTIONAL. Local DNS's port, 53 by default
            "local_dns_port": 53,
            // Remote DNS address, DNS queries will be sent through ssserver to this address
            "remote_dns_address": "8.8.8.8",
            // OPTIONAL. Remote DNS's port, 53 by default
            "remote_dns_port": 53,
            // OPTIONAL. dns client cache size for fetching dns queries.
            "client_cache_size": 5,
            // OPTIONAL. macOS launchd activate socket
            "launchd_tcp_socket_name": "TCPListener",
            "launchd_udp_socket_name": "UDPListener"
        },
        {
            // Tun local server (feature = "local-tun")
            "protocol": "tun",
            // Tun interface name
            "tun_interface_name": "tun0",
            // Tun interface address
            //
            // It has to be a host address in CIDR form
            "tun_interface_address": "10.255.0.1/24"
        },
        {
            // Transparent Proxy (redir) local server (feature = "local-redir")
            "protocol": "redir",
            // OPTIONAL: TCP type, may be different between platforms
            // Linux/Android: redirect (default), tproxy
            // FreeBSD/OpenBSD: pf (default), ipfw
            // NetBSD/macOS/Solaris: pf (default), ipfw
            "tcp_redir": "tproxy",
            // OPTIONAL: UDP type, may be different between platforms
            // Linux/Android: tproxy (default)
            // FreeBSD/OpenBSD: pf (default)
            "udp_redir": "tproxy"
        },
        {
            // FakeDNS local server (feature = "local-fake-dns")
            // FakeDNS is a DNS server that allocates an IPv4 / IPv6 address in a specific pool for each queries.
            // Subsequence requests from the other local interfaces that the target addresses includes those allocated IP addresses,
            // will be substituted back to their original domain name addresses.
            // This feature is useful mostly for transparent proxy, which will allow the proxied domain names to be resolved remotely.
            "protocol": "fake-dns",
            // Listen address
            "local_address": "127.0.0.1",
            "local_port": 10053,
            // IPv4 address pool (for A records)
            "fake_dns_ipv4_network": "10.255.0.0/16",
            // IPv6 address pool (for AAAA records)
            "fake_dns_ipv6_network": "fdf2:e786:ab40:9d2f::/64",
            // Persistent storage for all allocated DNS records
            "fake_dns_database_path": "/var/shadowsocks/fakedns.db",
            // OPTIONAL: Record expire duration in seconds, 10s by default
            "fake_dns_record_expire_duration": 10
        }
    ],

    // Server configuration
    // listen on :: for dual stack support, no need add [] around.
    "server": "::",
    // Change to use your custom port number
    "server_port": 8388,
    "method": "aes-256-gcm",
    "password": "your-password",
    "plugin": "v2ray-plugin",
    "plugin_opts": "mode=quic;host=github.com",
    "plugin_args": [
        // Each line is an argument passed to "plugin"
        "--verbose"
    ],
    "plugin_mode": "tcp_and_udp", // SIP003u, default is "tcp_only"
    // Server: TCP socket timeout in seconds.
    // Client: TCP connection timeout in seconds.
    // Omit this field if you don't have specific needs.
    "timeout": 7200,

    // Extended multiple server configuration
    // LOCAL: Choosing the best server to connect dynamically
    // SERVER: Creating multiple servers in one process
    "servers": [
        {
            // Fields are the same as the single server's configuration

            // Individual servers can be disabled
            // "disabled": true,
            "address": "0.0.0.0",
            "port": 8389,
            "method": "aes-256-gcm",
            "password": "your-password",
            "plugin": "...",
            "plugin_opts": "...",
            "plugin_args": [],
            "plugin_mode": "...",
            "timeout": 7200,

            // Customized weight for local server's balancer
            //
            // Weight must be in [0, 1], default is 1.0.
            // The higher weight, the server may rank higher.
            "tcp_weight": 1.0,
            "udp_weight": 1.0,

            // OPTIONAL. Instance specific ACL
            "acl": "/path/to/acl/file.acl",
        },
        {
            // Same key as basic format "server" and "server_port"
            "server": "0.0.0.0",
            "server_port": 8388,
            "method": "chacha20-ietf-poly1305",
            // Read the actual password from environment variable PASSWORD_FROM_ENV
            "password": "${PASSWORD_FROM_ENV}"
        },
        {
            // AEAD-2022
            "server": "::",
            "server_port": 8390,
            "method": "2022-blake3-aes-256-gcm",
            "password": "3SYJ/f8nmVuzKvKglykRQDSgg10e/ADilkdRWrrY9HU=",
            // For Server (OPTIONAL)
            // Support multiple users with Extensible Identity Header
            // https://github.com/Shadowsocks-NET/shadowsocks-specs/blob/main/2022-2-shadowsocks-2022-extensible-identity-headers.md
            "users": [
                {
                    "name": "username",
                    // User's password must have the same length as server's password
                    "password": "4w0GKJ9U3Ox7CIXGU4A3LDQAqP6qrp/tUi/ilpOR9p4="
                }
            ],
            // For Client (OPTIONAL)
            // If EIH enabled, then "password" should have the following format: iPSK:iPSK:iPSK:uPSK
            // - iPSK is one of the middle relay servers' PSK, for the last `ssserver`, it must be server's PSK ("password")
            // - uPSK is the user's PSK ("password")
            // Example:
            // "password": "3SYJ/f8nmVuzKvKglykRQDSgg10e/ADilkdRWrrY9HU=:4w0GKJ9U3Ox7CIXGU4A3LDQAqP6qrp/tUi/ilpOR9p4="
        }
    ],

    // Global configurations for UDP associations
    "udp_timeout": 300, // Timeout for UDP associations (in seconds), 5 minutes by default
    "udp_max_associations": 512, // Maximum UDP associations to be kept in one server, unlimited by default

    // Options for Manager
    "manager_address": "127.0.0.1", // Could be a path to UNIX socket, /tmp/shadowsocks-manager.sock
    "manager_port": 5300, // Not needed for UNIX socket

    // DNS server's address for resolving domain names
    // For *NIX and Windows, it uses system's configuration by default
    //
    // Value could be IP address of DNS server, for example, "8.8.8.8".
    // DNS client will automatically request port 53 with both TCP and UDP protocol.
    //
    // - system, uses system provided API (`getaddrinfo` on *NIX)
    //
    // It also allows some pre-defined well-known public DNS servers:
    // - google (TCP, UDP)
    // - cloudflare (TCP, UDP)
    // - cloudflare_tls (TLS), enable by feature "dns-over-tls"
    // - cloudflare_https (HTTPS), enable by feature "dns-over-https"
    // - quad9 (TCP, UDP)
    // - quad9_tls (TLS), enable by feature "dns-over-tls"
    //
    // The field is only effective if feature "hickory-dns" is enabled.
    "dns": "google",
    // Configure `cache_size` for "hickory-dns" ResolverOpts. Set to "0" to disable DNS cache.
    "dns_cache_size": 0,

    // Mode, could be one of the
    // - tcp_only
    // - tcp_and_udp
    // - udp_only
    "mode": "tcp_only",

    // TCP_NODELAY
    "no_delay": false,

    // Enables `SO_KEEPALIVE` and set `TCP_KEEPIDLE`, `TCP_KEEPINTVL` to the specified seconds
    "keep_alive": 15,

    // Soft and Hard limit of file descriptors on *NIX systems
    "nofile": 10240,

    // Try to resolve domain name to IPv6 (AAAA) addresses first
    "ipv6_first": false,
    // Set IPV6_V6ONLY for all IPv6 listener sockets
    // Only valid for locals and servers listening on `::`
    "ipv6_only": false,

    // Outbound socket options
    // Linux Only (SO_MARK)
    "outbound_fwmark": 255,
    // FreeBSD only (SO_USER_COOKIE)
    "outbound_user_cookie": 255,
    // `SO_BINDTODEVICE` (Linux), `IP_BOUND_IF` (BSD), `IP_UNICAST_IF` (Windows) socket option for outbound sockets
    "outbound_bind_interface": "eth1",
    // Outbound socket bind() to this IP (choose a specific interface)
    "outbound_bind_addr": "11.22.33.44",

    // Balancer customization
    "balancer": {
        // MAX Round-Trip-Time (RTT) of servers
        // The timeout seconds of each individual checks
        "max_server_rtt": 5,
        // Interval seconds between each check
        "check_interval": 10,
        // Interval seconds between each check for the best server
        // Optional. Specify to enable shorter checking interval for the best server only.
        "check_best_interval": 5
    },

    // SIP008 Online Configuration Delivery
    // https://shadowsocks.org/doc/sip008.html
    "online_config": {
        "config_url": "https://path-to-online-sip008-configuration",
        // Optional. Seconds between each update to config_url. Default to 3600s
        "update_interval": 3600
    },

    // Service configurations
    // Logger configuration
    "log": {
        // Equivalent to `-v` command line option
        "level": 1,
        "format": {
            // Euiqvalent to `--log-without-time`
            "without_time": false,
        },
        // Equivalent to `--log-config`
        // More detail could be found in https://crates.io/crates/log4rs
        "config_path": "/path/to/log4rs/config.yaml"
    },
    // Runtime configuration
    "runtime": {
        // single_thread or multi_thread
        "mode": "multi_thread",
        // Worker threads that are used in multi-thread runtime
        "worker_count": 10
    }
}

SOCKS5 认证配置

配置文件由 socks5_auth_config_path 在 locals 中设置。

{
    // Password/Username Authentication (RFC1929)
    "password": {
        "users": [
            {
                "user_name": "USERNAME in UTF-8",
                "password": "PASSWORD in UTF-8"
            }
        ]
    }
}

环境变量

• SS_SERVER_PASSWORD：从命令行参数（--server-addr）创建的服务器的默认密码
• SS_SYSTEM_DNS_RESOLVER_FORCE_BUILTIN：强制使用系统的内置 DNS 解析器（在 *NIX 中的 getaddrinfo）

支持的加密算法

AEAD 2022 加密算法

• 2022-blake3-aes-128-gcm，2022-blake3-aes-256-gcm
• 2022-blake3-chacha20-poly1305，2022-blake3-chacha8-poly1305

这些加密算法要求 "password" 必须是具有与加密算法密钥大小相同长度的 Base64 字符串。建议使用 ssservice genkey -m "METHOD_NAME" 生成一个安全且安全的密钥。

AEAD 加密算法

• chacha20-ietf-poly1305
• aes-128-gcm，aes-256-gcm

流加密算法

• plain 或 none（不加密，仅用于调试或与确保传输安全的插件一起使用）

ACL

sslocal，ssserver 和 ssmanager 支持类似于 shadowsocks-libev 的 ACL 文件语法。一些示例可以在 这里 找到。

可用部分

• 对于本地服务器（sslocal，ssredir，...）
  • 模式
    • [bypass_all] - ACL 在 BlackList 模式下运行。跳过所有不符合任何规则地址。
    • [proxy_all] - ACL在WhiteList模式下运行。代理所有未匹配任何规则的地址。
  • 规则
    • [bypass_list] - 直接连接的规则
    • [proxy_list] - 通过代理连接的规则
• 对于远程服务器（ssserver）
  • 模式
    • [reject_all] - ACL在BlackList模式下运行。拒绝所有未匹配任何规则的客户端。
    • [accept_all] - ACL在WhiteList模式下运行。接受所有未匹配任何规则的客户端。
  • 规则
    • [white_list] - 接受客户端的规则
    • [black_list] - 拒绝客户端的规则
    • [outbound_block_list] - 阻塞出站地址的规则

示例

# SERVERS
# For ssserver, accepts requests from all clients by default
[accept_all]

# Blocks these clients
[black_list]
1.2.3.4
127.0.0.1/8

# Disallow these outbound addresses
[outbound_block_list]
127.0.0.1/8
::1
# Using regular expression
^[a-z]{5}\.baidu\.com
# Match exactly
|baidu.com
# Match with subdomains
||google.com
# An internationalized domain name should be converted to punycode
# |☃-⌘.com - WRONG
|xn----dqo34k.com
# ||джpумлатест.bрфa - WRONG
||xn--p-8sbkgc5ag7bhce.xn--ba-lmcq

# CLIENTS
# For sslocal, ..., bypasses all targets by default
[bypass_all]

# Proxy these addresses
[proxy_list]
||google.com
8.8.8.8

有用工具

1. ssurl用于编码和解码ShadowSocks URL（SIP002）。示例

ss://[email protected]:8388/?plugin=obfs-local%3Bobfs%3Dhttp%3Bobfs-host%3Dwww.baidu.com

注意

它支持以下功能

• SOCKS5 CONNECT命令
• SOCKS5 UDP ASSOCIATE命令（部分）
• SOCKS4/4a CONNECT命令
• 各种加密算法
• 负载均衡（多个服务器）和服务器延迟检查
• SIP004 AEAD加密
• SIP003 插件
• SIP003u 支持UDP的插件
• SIP002 扩展ss URL
• SIP022 2022 AEAD加密
• HTTP代理支持（RFC 7230 和 CONNECT）
• 防御重放攻击，shadowsocks/shadowsocks-org#44
• 管理API，支持管理多个用户
• ACL（访问控制列表）
• 支持HTTP/HTTPS代理协议

待办事项

• 文档
• 扩展配置格式
• 改进的日志格式（等待新官方日志crate）
• 在不依赖于libcrypto的情况下支持更多加密算法（等待可接受的Rust加密库实现）
• Windows支持。
• 使用稳定的rustc构建（由crypto2阻塞）。
• 支持HTTP代理协议
• AEAD加密。 （在SIP004中提出，仍在讨论中）
• 基于延迟选择服务器 #152

许可证

MIT许可证（MIT）

版权所有（c）2014 Y. T. CHUNG

在此特此授予任何获得此软件及其相关文档副本（“软件”）的人免费处理软件的权利，包括但不限于使用、复制、修改、合并、发布、分发、再许可和/或出售软件副本，并允许向软件提供方提供软件的人这样做，但受以下条件的约束

上述版权声明和本许可声明应包含在软件的所有副本或实质性部分中。

软件按“原样”提供，不提供任何形式的保证，无论是明示的、暗示的还是法定的，包括但不限于适销性、特定用途适用性和非侵权性保证。在任何情况下，作者或版权所有者不对任何索赔、损害或其他责任负责，无论其是基于合同、侵权或其他原因，是否由软件本身、软件的使用或其他与软件相关的操作引起。

随时间推移的Star-gazers