diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ A SOCKS5 proxy using the client / server architecture. -MoeSocks is compatible with [ss] at the protocal and most of the configuration level. +MoeSocks is mostly compatible with [shadowsocks]. Installation ============ @@ -63,52 +63,35 @@ moesocks --help -* Not tested in `OSX`, but it should just work. - -System wide proxy for NixOS -=========================== - -* Add `moesocks.nix` and `moesocks-bento.nix` to `/etc/nixos` -* Modify the following and add it to `configuration.nix`: - - imports = [ ./moesocks-bento.nix ]; - - networking.moesocks-bento = - { - enable = true; - remote = "my-server"; - remotePort = 8388; - password = "birthday!"; - }; - Features ======== -* SOCKS5 proxy service -* TCP port forwarding -* UDP port forwarding, for example to tunnel DNS request: `-U 5300:8.8.8.8:53` -* SOCKS5 service on local can be turned off -* Understand `ss`' configuration file +* SOCKS5 proxy service, tested with GFW. +* TCP port forwarding. +* UDP port forwarding, for example to tunnel DNS request: `-U 5300:8.8.8.8:53`. +* SOCKS5 service on local can be turned off. +* Understand `shadowsocks`' json configuration file. -Know issues -=========== +Known issues +============ * UDP over SOCKS5 is not implemented. -* TCP bind over SOCKS5 is not implemented -* More then 2 times slower then the original Python implementation (measured at - 20M/s vs 43M/s on an Intel P8800, using the AES-256-CFB method, in software - AES). -* Currently only works on Unix. +* TCP bind over SOCKS5 is not implemented. +* A bit slower then the Python implementation. +* Only works on Unix. +Tips +==== + TCP Fast Open (TFO) -==================== +------------------- -## Benefit of using [TFO] +### Benefit of using [TFO] TFO can bypass the TCP three-way handshake in successive connections, thus reducing latency. -## Enable TFO in your OS runtime. +### Enable TFO in your OS runtime. On Linux 3.7+, to check the availability of TFO: @@ -118,26 +101,31 @@ echo 3 > /proc/sys/net/ipv4/tcp_fastopen -## Enable TFO in MoeSocks +### Enable TFO in MoeSocks TFO can be turned on by adding a `"fastOpen":true` field in `config.json` or adding a `--fast-open` argument in the command line. -## Verify +### Verify Use `tcpdump` on the `remotePort`, check for that `SYN` should start to carry payload. An example command is: tcpdump port 8388 -i any -X -v + +TCP BBR +------- +Using tcp-bbr as the congestion control algorithm should dramatically increase your bandwith in most cases. + Credits ======= -* [ss] greatly inspired MoeSocks. -* [ss-haskell] another implementation of ss in Haskell, also greatly inspired - MoeSocks. Much of the understanding of the internal of ss was gained by - reading ss-haskell. +* [shadowsocks] greatly inspired MoeSocks. +* [shadowsocks-haskell] another implementation of shadowsocks in Haskell, also greatly inspired + MoeSocks. Much of the understanding of the internal of shadowsocks was gained by + reading shadowsocks-haskell. License ======= @@ -156,11 +144,10 @@ See the License for the specific language governing permissions and limitations under the License. -[ss]:https://github.com/shadowsocks/shadowsocks -[ss-haskell]:https://github.com/rnons/shadowsocks-haskell +[shadowsocks]:https://github.com/shadowsocks/shadowsocks +[shadowsocks-haskell]:https://github.com/rnons/shadowsocks-haskell [Nix]:https://nixos.org/nix/ [config.json]:https://raw.githubusercontent.com/nfjinjing/moesocks/master/config.json -[#10590]:https://ghc.haskell.org/trac/ghc/ticket/10590 [TFO]:https://en.wikipedia.org/wiki/TCP_Fast_Open [ECN]:https://en.wikipedia.org/wiki/Explicit_Congestion_Notification diff --git a/moesocks-bento.nix b/moesocks-bento.nix deleted file mode 100644 --- a/moesocks-bento.nix +++ /dev/null @@ -1,114 +0,0 @@ -{ config, pkgs, lib, ... }: - -with lib; - -let - cfg = config.networking.moesocks-bento -; in - -{ - imports = [ ./moesocks.nix ] - -; options = - { - networking.moesocks-bento = - { enable = mkEnableOption "moesocks bento proxy suite" - - ; socks5ProxyPort = mkOption - { type = types.int - ; default = 1080 - ; description = "port for the SOCKS5 proxy server" - ; } - - ; httpProxyPort = mkOption - { type = types.int - ; default = 8118 - ; description = "port for the HTTP proxy server" - ; } - - ; dnsPort = mkOption - { type = types.int - ; default = 5300 - ; description = "port for tunneling DNS" - ; } - - ; remote = mkOption - { type = types.str - ; default = "" - ; description = "moesocks remote address" - ; } - - ; local = mkOption - { type = types.str - ; default = "[::1]" - ; description = "local address" - ; } - - ; remotePort = mkOption - { type = types.int - ; default = 8388 - ; description = "moesocks remote port" - ; } - - ; remoteDNS = mkOption - { type = types.str - ; default = "8.8.8.8" - ; description = "remote DNS address" - ; } - - ; password = mkOption - { type = types.str - ; default = "" - ; description = "moesocks password" - ; } - ; } - ; } - -; config = mkIf cfg.enable - { assertions = - [ - { assertion = cfg.remote != "" - ; message = "moesocks' remote address must be set" - ; } - ] - - ; boot.kernel.sysctl."net.ipv4.tcp_fastopen" = 3 - - ; services.nscd.enable = pkgs.lib.mkForce false - - ; services.moesocks = - { enable = true - ; udp = [ "${toString cfg.dnsPort}:${cfg.remoteDNS}:53" ] - ; remote = cfg.remote - ; remotePort = cfg.remotePort - ; localPort = cfg.socks5ProxyPort - ; password = cfg.password - ; fastOpen = true - ; } - - ; networking = - { proxy.default = "socks5://${cfg.local}:${toString cfg.socks5ProxyPort}" - ; dhcpcd.extraConfig = - '' - nooption domain_name_servers - nohook resolv.conf - '' - ; } - - ; services.privoxy = - { enable = true - ; listenAddress = "${cfg.local}:${toString cfg.httpProxyPort}" - ; extraConfig = "forward-socks5 / ${cfg.local}:${toString cfg.socks5ProxyPort} ." - ; } - - ; services.dnsmasq = - let dnsmasqHost = removeSuffix "]" (removePrefix "[" cfg.local) - ; in - - { enable = true - ; servers = [ "${dnsmasqHost}#${toString cfg.dnsPort}" ] - ; } - - ; } - -; } diff --git a/moesocks.cabal b/moesocks.cabal --- a/moesocks.cabal +++ b/moesocks.cabal @@ -1,6 +1,6 @@ name: moesocks category: Network -version: 1.0.0.41 +version: 1.0.0.42 license: Apache-2.0 synopsis: A functional firewall killer description: A SOCKS5 proxy using the client / server architecture. @@ -11,13 +11,11 @@ build-type: Simple cabal-version: >=1.10 copyright: Copyright (C) 2015 Jinjing Wang -tested-with: GHC == 7.10.3 +tested-with: GHC == 8.0.2 extra-doc-files: README.md , CHANGELOG.md - , moesocks.nix - , moesocks-bento.nix source-repository head type: git diff --git a/moesocks.nix b/moesocks.nix deleted file mode 100644 --- a/moesocks.nix +++ /dev/null @@ -1,188 +0,0 @@ -{ config, pkgs, lib, ... }: - -with lib; - -let - cfg = config.services.moesocks; - configFile = pkgs.writeText "moesocks.json" (builtins.toJSON cfg); - localIPs = - [ - "0.0.0.0/8" - "10.0.0.0/8" - "100.64.0.0/10" - "127.0.0.0/8" - "169.254.0.0/16" - "172.16.0.0/12" - "192.0.0.0/24" - "192.0.2.0/24" - "192.88.99.0/24" - "192.168.0.0/16" - "198.18.0.0/15" - "198.51.100.0/24" - "203.0.113.0/24" - "224.0.0.0/4" - "240.0.0.0/4" - "255.255.255.255/32" - "::/128" - "::1/128" - "::ffff:0:0/96," - "100::/64" - "64:ff9b::/96" - "2001::/32" - "2001:10::/28" - "2001:20::/28" - "2001:db8::/32" - "2002::/16" - "fc00::/7" - "fe80::/10" - "ff00::/8" - ]; -in - -{ options = - { services.moesocks = - { enable = mkEnableOption "moesocks SOCKS5 proxy server"; - - verbose = mkOption { - type = types.bool; - default = false; - description = "Turn on logging"; - }; - - role = mkOption { - type = types.str; - default = "local"; - description = "Tell moesocks to run as local or remote"; - }; - - tcp = mkOption { - type = types.listOf types.str; - default = []; - example = [ "5300:8.8.8.8:53" ]; - description = - '' - Specify that the given TCP port on the local(client) - host is to be forwarded to the given host and port on - the remote side. - ''; - }; - - udp = mkOption { - type = types.listOf types.str; - default = []; - example = [ "5300:8.8.8.8:53" ]; - description = - '' - Specify that the given UDP port on the local(client) - host is to be forwarded to the given host and port on - the remote side. - ''; - }; - - disableSOCKS5 = mkOption { - type = types.bool; - default = false; - description = - '' - Do not start a SOCKS5 server on local. It can be - useful to run moesocks only as a secure tunnel - ''; - }; - - forbiddenIP = mkOption { - type = types.listOf types.str; - default = localIPs; - description = "IP list declared invalid as destinations"; - }; - - remote = mkOption { - type = types.str; - default = "::"; - description = "remote address"; - }; - - remotePort = mkOption { - type = types.int; - default = 8388; - description = "remote port"; - }; - - local = mkOption { - type = types.str; - # Default to listening on an IPv6 localhost address since otherwise - # initial start of moesocks will mysteriously fail. - default = "::1"; - description = "local address"; - }; - - localPort = mkOption { - type = types.int; - default = 1080; - description = "local port"; - }; - - timeout = mkOption { - type = types.int; - default = 3600; - description = "timeout connection in seconds"; - }; - - password = mkOption { - type = types.str; - default = ""; - description = "password"; - }; - - method = mkOption { - type = types.str; - default = "aes-256-cfb"; - description = "encryption method"; - }; - - fastOpen = mkOption { - type = types.bool; - default = false; - description = "Use TCP_FASTOPEN, requires Linux 3.7+"; - }; - }; - }; - - config = mkIf cfg.enable { - - assertions = - [ - { assertion = cfg.password != ""; - message = "moesocks' password must be set"; - } - ]; - - users.extraUsers = singleton { - name = "moesocks"; - # uid = config.ids.uids.moesocks; - uid = 2000; - description = "moesocks user"; - }; - - systemd.services.moesocks = - { wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - description = "moesocks SOCKS5 proxy server"; - serviceConfig = - { User = "moesocks"; - ExecStart = - concatStringsSep " " - (splitString "\n" - '' - ${pkgs.haskellPackages.moesocks}/bin/moesocks - ${optionalString (cfg.verbose) "-v"} - -r ${cfg.role} - ${optionalString (cfg.tcp != []) "-T '${concatStringsSep " " cfg.tcp}'"} - ${optionalString (cfg.udp != []) "-U '${concatStringsSep " " cfg.udp}'"} - ${optionalString (cfg.disableSOCKS5) "--disable-socks5"} - -c ${configFile} - '' - ); - }; - }; - }; -} diff --git a/src/Network/MoeSocks/Options.hs b/src/Network/MoeSocks/Options.hs --- a/src/Network/MoeSocks/Options.hs +++ b/src/Network/MoeSocks/Options.hs @@ -19,6 +19,7 @@ import qualified Options.Applicative as O import Data.Attoparsec.Text (Parser, takeWhile, char, decimal, skipSpace, parseOnly, many', choice) +import Data.Monoid ((<>)) textOption :: O.Mod O.OptionFields String -> O.Parser Text textOption x = strOption x <&> review _Text diff --git a/src/Network/MoeSocks/TCP.hs b/src/Network/MoeSocks/TCP.hs --- a/src/Network/MoeSocks/TCP.hs +++ b/src/Network/MoeSocks/TCP.hs @@ -30,8 +30,8 @@ -> IO () local_SOCKS5_RequestHandler aEnv aRemoteHost aRemotePort _ (aSocket,_) = do (_partialBytesAfterGreeting, _r) <- - parseSocket "clientGreeting" mempty identityCipher - greetingParser aSocket + parseSocket "clientGreeting" mempty identityCipher + greetingParser aSocket when (not - _No_authentication `elem` (_r ^. authenticationMethods)) - throwIO - ParseException