moesocks 1.0.0.41 → 1.0.0.42
raw patch · 6 files changed
+35/−351 lines, 6 files
Files
- README.md +30/−43
- moesocks-bento.nix +0/−114
- moesocks.cabal +2/−4
- moesocks.nix +0/−188
- src/Network/MoeSocks/Options.hs +1/−0
- src/Network/MoeSocks/TCP.hs +2/−2
README.md view
@@ -3,7 +3,7 @@ A SOCKS5 proxy using the client / server architecture. -MoeSocks is compatible with [ss] at the protocal and most of the configuration level.+MoeSocks is mostly compatible with [shadowsocks]. Installation ============@@ -63,52 +63,35 @@ moesocks --help -* Not tested in `OSX`, but it should just work.--System wide proxy for NixOS-===========================--* Add `moesocks.nix` and `moesocks-bento.nix` to `/etc/nixos` -* Modify the following and add it to `configuration.nix`:-- imports = [ ./moesocks-bento.nix ];- - networking.moesocks-bento =- {- enable = true;- remote = "my-server";- remotePort = 8388;- password = "birthday!";- };- Features ======== -* SOCKS5 proxy service-* TCP port forwarding-* UDP port forwarding, for example to tunnel DNS request: `-U 5300:8.8.8.8:53`-* SOCKS5 service on local can be turned off-* Understand `ss`' configuration file+* SOCKS5 proxy service, tested with GFW.+* TCP port forwarding.+* UDP port forwarding, for example to tunnel DNS request: `-U 5300:8.8.8.8:53`.+* SOCKS5 service on local can be turned off.+* Understand `shadowsocks`' json configuration file. -Know issues-===========+Known issues+============ * UDP over SOCKS5 is not implemented.-* TCP bind over SOCKS5 is not implemented-* More then 2 times slower then the original Python implementation (measured at- 20M/s vs 43M/s on an Intel P8800, using the AES-256-CFB method, in software- AES).-* Currently only works on Unix.+* TCP bind over SOCKS5 is not implemented.+* A bit slower then the Python implementation.+* Only works on Unix. +Tips+====+ TCP Fast Open (TFO)-====================+------------------- -## Benefit of using [TFO]+### Benefit of using [TFO] TFO can bypass the TCP three-way handshake in successive connections, thus reducing latency. -## Enable TFO in your OS runtime.+### Enable TFO in your OS runtime. On Linux 3.7+, to check the availability of TFO: @@ -118,26 +101,31 @@ echo 3 > /proc/sys/net/ipv4/tcp_fastopen -## Enable TFO in MoeSocks+### Enable TFO in MoeSocks TFO can be turned on by adding a `"fastOpen":true` field in `config.json` or adding a `--fast-open` argument in the command line. -## Verify+### Verify Use `tcpdump` on the `remotePort`, check for that `SYN` should start to carry payload. An example command is: tcpdump port 8388 -i any -X -v+ +TCP BBR+------- +Using tcp-bbr as the congestion control algorithm should dramatically increase your bandwith in most cases. + Credits ======= -* [ss] greatly inspired MoeSocks.-* [ss-haskell] another implementation of ss in Haskell, also greatly inspired- MoeSocks. Much of the understanding of the internal of ss was gained by- reading ss-haskell.+* [shadowsocks] greatly inspired MoeSocks.+* [shadowsocks-haskell] another implementation of shadowsocks in Haskell, also greatly inspired+ MoeSocks. Much of the understanding of the internal of shadowsocks was gained by+ reading shadowsocks-haskell. License =======@@ -156,11 +144,10 @@ See the License for the specific language governing permissions and limitations under the License. -[ss]:https://github.com/shadowsocks/shadowsocks-[ss-haskell]:https://github.com/rnons/shadowsocks-haskell+[shadowsocks]:https://github.com/shadowsocks/shadowsocks+[shadowsocks-haskell]:https://github.com/rnons/shadowsocks-haskell [Nix]:https://nixos.org/nix/ [config.json]:https://raw.githubusercontent.com/nfjinjing/moesocks/master/config.json-[#10590]:https://ghc.haskell.org/trac/ghc/ticket/10590 [TFO]:https://en.wikipedia.org/wiki/TCP_Fast_Open [ECN]:https://en.wikipedia.org/wiki/Explicit_Congestion_Notification
− moesocks-bento.nix
@@ -1,114 +0,0 @@-{ config, pkgs, lib, ... }:--with lib;--let- cfg = config.networking.moesocks-bento-; in--{- imports = [ ./moesocks.nix ]--; options =- {- networking.moesocks-bento =- { enable = mkEnableOption "moesocks bento proxy suite"-- ; socks5ProxyPort = mkOption- { type = types.int- ; default = 1080- ; description = "port for the SOCKS5 proxy server"- ; }-- ; httpProxyPort = mkOption- { type = types.int- ; default = 8118- ; description = "port for the HTTP proxy server"- ; }-- ; dnsPort = mkOption- { type = types.int- ; default = 5300- ; description = "port for tunneling DNS"- ; }-- ; remote = mkOption- { type = types.str- ; default = ""- ; description = "moesocks remote address"- ; }-- ; local = mkOption- { type = types.str- ; default = "[::1]"- ; description = "local address"- ; }-- ; remotePort = mkOption- { type = types.int- ; default = 8388- ; description = "moesocks remote port"- ; }-- ; remoteDNS = mkOption- { type = types.str- ; default = "8.8.8.8"- ; description = "remote DNS address"- ; }-- ; password = mkOption- { type = types.str- ; default = ""- ; description = "moesocks password"- ; }- ; }- ; }--; config = mkIf cfg.enable- { assertions =- [- { assertion = cfg.remote != ""- ; message = "moesocks' remote address must be set"- ; }- ]-- ; boot.kernel.sysctl."net.ipv4.tcp_fastopen" = 3-- ; services.nscd.enable = pkgs.lib.mkForce false-- ; services.moesocks =- { enable = true- ; udp = [ "${toString cfg.dnsPort}:${cfg.remoteDNS}:53" ]- ; remote = cfg.remote- ; remotePort = cfg.remotePort- ; localPort = cfg.socks5ProxyPort- ; password = cfg.password- ; fastOpen = true- ; }-- ; networking =- { proxy.default = "socks5://${cfg.local}:${toString cfg.socks5ProxyPort}"- ; dhcpcd.extraConfig =- ''- nooption domain_name_servers- nohook resolv.conf- ''- ; }-- ; services.privoxy =- { enable = true- ; listenAddress = "${cfg.local}:${toString cfg.httpProxyPort}"- ; extraConfig = "forward-socks5 / ${cfg.local}:${toString cfg.socks5ProxyPort} ."- ; }-- ; services.dnsmasq =- let dnsmasqHost = removeSuffix "]" (removePrefix "[" cfg.local)- ; in-- { enable = true- ; servers = [ "${dnsmasqHost}#${toString cfg.dnsPort}" ]- ; }-- ; }--; }
moesocks.cabal view
@@ -1,6 +1,6 @@ name: moesocks category: Network-version: 1.0.0.41+version: 1.0.0.42 license: Apache-2.0 synopsis: A functional firewall killer description: A SOCKS5 proxy using the client / server architecture.@@ -11,13 +11,11 @@ build-type: Simple cabal-version: >=1.10 copyright: Copyright (C) 2015 Jinjing Wang-tested-with: GHC == 7.10.3+tested-with: GHC == 8.0.2 extra-doc-files: README.md , CHANGELOG.md- , moesocks.nix- , moesocks-bento.nix source-repository head type: git
− moesocks.nix
@@ -1,188 +0,0 @@-{ config, pkgs, lib, ... }:--with lib;--let- cfg = config.services.moesocks;- configFile = pkgs.writeText "moesocks.json" (builtins.toJSON cfg);- localIPs =- [- "0.0.0.0/8"- "10.0.0.0/8"- "100.64.0.0/10"- "127.0.0.0/8"- "169.254.0.0/16"- "172.16.0.0/12"- "192.0.0.0/24"- "192.0.2.0/24"- "192.88.99.0/24"- "192.168.0.0/16"- "198.18.0.0/15"- "198.51.100.0/24"- "203.0.113.0/24"- "224.0.0.0/4"- "240.0.0.0/4"- "255.255.255.255/32"- "::/128"- "::1/128"- "::ffff:0:0/96,"- "100::/64"- "64:ff9b::/96"- "2001::/32"- "2001:10::/28"- "2001:20::/28"- "2001:db8::/32"- "2002::/16"- "fc00::/7"- "fe80::/10"- "ff00::/8"- ];-in--{ options =- { services.moesocks =- { enable = mkEnableOption "moesocks SOCKS5 proxy server";-- verbose = mkOption {- type = types.bool;- default = false;- description = "Turn on logging";- };-- role = mkOption {- type = types.str;- default = "local";- description = "Tell moesocks to run as local or remote";- };-- tcp = mkOption {- type = types.listOf types.str;- default = [];- example = [ "5300:8.8.8.8:53" ];- description =- ''- Specify that the given TCP port on the local(client)- host is to be forwarded to the given host and port on- the remote side.- '';- };-- udp = mkOption {- type = types.listOf types.str;- default = [];- example = [ "5300:8.8.8.8:53" ];- description =- ''- Specify that the given UDP port on the local(client)- host is to be forwarded to the given host and port on- the remote side.- '';- };-- disableSOCKS5 = mkOption {- type = types.bool;- default = false;- description =- ''- Do not start a SOCKS5 server on local. It can be- useful to run moesocks only as a secure tunnel- '';- };-- forbiddenIP = mkOption {- type = types.listOf types.str;- default = localIPs;- description = "IP list declared invalid as destinations";- };-- remote = mkOption {- type = types.str;- default = "::";- description = "remote address";- };-- remotePort = mkOption {- type = types.int;- default = 8388;- description = "remote port";- };-- local = mkOption {- type = types.str;- # Default to listening on an IPv6 localhost address since otherwise- # initial start of moesocks will mysteriously fail.- default = "::1";- description = "local address";- };-- localPort = mkOption {- type = types.int;- default = 1080;- description = "local port";- };-- timeout = mkOption {- type = types.int;- default = 3600;- description = "timeout connection in seconds";- };-- password = mkOption {- type = types.str;- default = "";- description = "password";- };-- method = mkOption {- type = types.str;- default = "aes-256-cfb";- description = "encryption method";- };-- fastOpen = mkOption {- type = types.bool;- default = false;- description = "Use TCP_FASTOPEN, requires Linux 3.7+";- };- };- };-- config = mkIf cfg.enable {-- assertions =- [- { assertion = cfg.password != "";- message = "moesocks' password must be set";- }- ];-- users.extraUsers = singleton {- name = "moesocks";- # uid = config.ids.uids.moesocks;- uid = 2000;- description = "moesocks user";- };-- systemd.services.moesocks =- { wantedBy = [ "multi-user.target" ];- after = [ "network.target" ];- description = "moesocks SOCKS5 proxy server";- serviceConfig =- { User = "moesocks";- ExecStart =- concatStringsSep " "- (splitString "\n"- ''- ${pkgs.haskellPackages.moesocks}/bin/moesocks- ${optionalString (cfg.verbose) "-v"}- -r ${cfg.role}- ${optionalString (cfg.tcp != []) "-T '${concatStringsSep " " cfg.tcp}'"}- ${optionalString (cfg.udp != []) "-U '${concatStringsSep " " cfg.udp}'"}- ${optionalString (cfg.disableSOCKS5) "--disable-socks5"}- -c ${configFile}- ''- );- };- };- };-}
src/Network/MoeSocks/Options.hs view
@@ -19,6 +19,7 @@ import qualified Options.Applicative as O import Data.Attoparsec.Text (Parser, takeWhile, char, decimal, skipSpace, parseOnly, many', choice)+import Data.Monoid ((<>)) textOption :: O.Mod O.OptionFields String -> O.Parser Text textOption x = strOption x <&> review _Text
src/Network/MoeSocks/TCP.hs view
@@ -30,8 +30,8 @@ -> IO () local_SOCKS5_RequestHandler aEnv aRemoteHost aRemotePort _ (aSocket,_) = do (_partialBytesAfterGreeting, _r) <-- parseSocket "clientGreeting" mempty identityCipher- greetingParser aSocket+ parseSocket "clientGreeting" mempty identityCipher+ greetingParser aSocket when (not - _No_authentication `elem` (_r ^. authenticationMethods)) - throwIO - ParseException