Bug-fix-only libev port of shadowsocks. Future development moved to shadowsocks-rust
Bug-fix-only libev port of shadowsocks. Future development moved to shadowsocks-rust
Shadowsocks-libev is a lightweight secured SOCKS5 proxy for embedded devices and low-end boxes.
It is a port of Shadowsocks created by @clowwindy, and maintained by @madeye and @linusyang.
Current version: 3.3.6 | Changelog
Shadowsocks-libev is written in pure C and depends on libev. It's designed to be a lightweight implementation of shadowsocks protocol, in order to keep the resource usage as low as possible.
For a full list of feature comparison between different versions of shadowsocks, refer to the Wiki page.
Snap is the recommended way to install the latest binaries.
Stable channel:
sudo snap install shadowsocks-libev
Edge channel:
sudo snap install shadowsocks-libev --edge
shadowsocks-libev uses CMake as its sole build system. Start by pulling submodules:
git submodule update --init --recursive
Then build:
mkdir -p build && cd build
cmake ..
make
sudo make install
To run unit tests:
cd build
ctest --output-on-failure
For a complete list of available options, run cmake -LH from a build directory.
Commonly used options:
-DWITH_EMBEDDED_SRC=OFF
ON
Use system libcork/libipset/libbloom instead of bundled submodules
-DWITH_DOC_MAN=OFF
ON
Skip man page generation (removes asciidoc/xmlto dependency)
-DBUILD_TESTING=OFF
ON
Disable unit tests
-DENABLE_CONNMARKTOS=ON
OFF
Linux netfilter conntrack QoS support
-DENABLE_NFTABLES=ON
OFF
nftables firewall integration
On macOS, if libraries are installed via Homebrew, specify paths:
cmake .. -DCMAKE_PREFIX_PATH="/usr/local/opt/mbedtls;/usr/local/opt/libsodium"
Shadowsocks-libev is available in the official repository for following distributions:
sudo apt update
sudo apt install shadowsocks-libev
You can build shadowsocks-libev and all its dependencies by script:
mkdir -p ~/build-area/
cp ./scripts/build_deb.sh ~/build-area/
cd ~/build-area
./build_deb.sh
For older systems, building .deb packages is not supported.
Please try to build and install directly from source. See the Linux section below.
# Edit the configuration file
sudo vim /etc/shadowsocks-libev/config.json
# Edit the default configuration for debian
sudo vim /etc/default/shadowsocks-libev
# Start the service
sudo /etc/init.d/shadowsocks-libev start # for sysvinit, or
sudo systemctl start shadowsocks-libev # for systemd
Supported distributions:
If you are using CentOS 7, you need to install these prerequirements to build from source code:
yum install epel-release -y
yum install gcc gettext autoconf libtool automake make pcre-devel asciidoc xmlto c-ares-devel libev-devel libsodium-devel mbedtls-devel -y
sudo pacman -S shadowsocks-libev
Please refer to downstream PKGBUILD script for extra modifications and distribution-specific bugs.
nix-env -iA nixos.shadowsocks-libev
nix-env -iA nixpkgs.shadowsocks-libev
In general, you need the following build dependencies:
If your system is too old to provide libmbedtls and libsodium (>= 1.0.4), you will need to either install those libraries manually or upgrade your system.
Install build dependencies for your distribution:
# Debian / Ubuntu
sudo apt-get install --no-install-recommends build-essential cmake pkg-config \
libpcre2-dev libev-dev libc-ares-dev libmbedtls-dev libsodium-dev \
asciidoc xmlto
# CentOS / Fedora / RHEL
sudo yum install gcc cmake make pkg-config pcre2-devel c-ares-devel \
libev-devel libsodium-devel mbedtls-devel asciidoc xmlto
# Arch
sudo pacman -S gcc cmake make pkg-config pcre2 c-ares libev libsodium mbedtls \
asciidoc xmlto
Then build and install:
git submodule update --init --recursive
mkdir -p build && cd build
cmake ..
make
sudo make install
Shadowsocks-libev is available in FreeBSD Ports Collection. You can install it in either way, pkg or ports.
pkg (recommended)
pkg install shadowsocks-libev
ports
cd /usr/ports/net/shadowsocks-libev
make install
Edit your config.json file. By default, it's located in /usr/local/etc/shadowsocks-libev.
To enable shadowsocks-libev, add the following rc variable to your /etc/rc.conf file:
shadowsocks_libev_enable="YES"
Start the Shadowsocks server:
service shadowsocks_libev start
By default, shadowsocks-libev is running as a server in FreeBSD. If you would like to start shadowsocks-libev in client mode, you can modify the rc script (/usr/local/etc/rc.d/shadowsocks_libev) manually.
# modify the following line from "ss-server" to "ss-local"
command="/usr/local/bin/ss-local"
Note that is simply a workaround, each time you upgrade the port your changes will be overwritten by the new version.
The OpenWRT project is maintained here: openwrt-shadowsocks.
For OS X, use Homebrew to install or build.
Install Homebrew:
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
Install shadowsocks-libev:
brew install shadowsocks-libev
To build Windows native binaries, the recommended method is to use Docker:
On Windows: double-click make.bat in docker\mingw
On Unix-like system:
cd shadowsocks-libev/docker/mingw
make
A tarball with 32-bit and 64-bit binaries will be generated in the same directory.
You could also manually use MinGW-w64 compilers to build in Unix-like shell (MSYS2/Cygwin), or cross-compile on Unix-like systems (Linux/MacOS). Please refer to build scripts in docker/mingw.
Currently you need to use a patched libev library for MinGW:
Notice that TCP Fast Open (TFO) is only available on Windows 10, 1607 or later version (precisely, build >= 14393). If you are using 1709 (build 16299) or later version, you also need to run the following command in PowerShell/Command Prompt as Administrator and reboot to use TFO properly:
netsh int tcp set global fastopenfallback=disabled
As you expect, simply pull the image and run.
docker pull shadowsocks/shadowsocks-libev
docker run -e PASSWORD=<password> -p<server-port>:8388 -p<server-port>:8388/udp -d shadowsocks/shadowsocks-libev
More information about the image can be found here.
For a detailed and complete list of all supported arguments, you may refer to the man pages of the applications, respectively.
ss-[local|redir|server|tunnel|manager]
-s <server_host> Host name or IP address of your remote server.
-p <server_port> Port number of your remote server.
-l <local_port> Port number of your local server.
-k <password> Password of your remote server.
-m <encrypt_method> Encrypt method:
2022-blake3-aes-128-gcm,
2022-blake3-aes-256-gcm,
2022-blake3-chacha20-poly1305,
rc4-md5,
aes-128-gcm, aes-192-gcm, aes-256-gcm,
aes-128-cfb, aes-192-cfb, aes-256-cfb,
aes-128-ctr, aes-192-ctr, aes-256-ctr,
camellia-128-cfb, camellia-192-cfb,
camellia-256-cfb, bf-cfb,
chacha20-ietf-poly1305,
xchacha20-ietf-poly1305,
salsa20, chacha20 and chacha20-ietf.
The default cipher is chacha20-ietf-poly1305.
The 2022-blake3-* ciphers implement
Shadowsocks 2022 (SIP022) and are the
recommended choice. They take a
base64-encoded pre-shared key of exactly
the cipher's key size via -k, not a
password: generate one with
`openssl rand -base64 32` (or 16 for
2022-blake3-aes-128-gcm).
[--server-url <ss_url>] Take the server address, port, cipher,
password and SIP003 plugin from a single
ss:// URL (SIP002 or the legacy form).
ss-local only. Options given later on the
command line override the URL's values.
[-a <user>] Run as another user.
[-f <pid_file>] The file path to store pid.
[-t <timeout>] Socket timeout in seconds.
[-c <config_file>] The path to config file.
[-n <number>] Max number of open files.
[-i <interface>] Network interface to bind.
(not available in redir mode)
[-b <local_address>] Local address to bind.
For servers: Specify the local address to use
while this server is making outbound
connections to remote servers on behalf of the
clients.
For clients: Specify the local address to use