support TFO on Linux, FreeBSD, macOS and Windows

- ref #184

Author: zonyitoo

.github/workflows/build-and-test.yml

@@ -30,10 +30,16 @@ jobs:
           profile: minimal
       - name: Build & Test (Default)
         run: cargo test --verbose --no-fail-fast
+      - name: Build & Test (Default) - shadowsocks
+        run: cargo test --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --no-fail-fast
       - name: Build & Test (--no-default-features)
         run: cargo test --verbose --no-default-features --no-fail-fast
+      - name: Build & Test (--no-default-features) - shadowsocks
+        run: cargo test --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --no-default-features --no-fail-fast
       - name: Build with All Features Enabled
-        run: cargo build --verbose --features "local-redir local-dns dns-over-tls dns-over-https stream-cipher"
+        run: cargo build --verbose --features "local-dns dns-over-tls dns-over-https stream-cipher"
+      - name: Build with All Features Enabled - shadowsocks
+        run: cargo build --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --features "stream-cipher"
 
   build-windows:
     runs-on: windows-latest
@@ -53,10 +59,16 @@ jobs:
           profile: minimal
       - name: Build & Test (Default)
         run: cargo test --verbose --no-fail-fast
+      - name: Build & Test (Default) - shadowsocks
+        run: cargo test --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --no-fail-fast
       - name: Build & Test (--no-default-features)
         run: cargo test --verbose --no-default-features --no-fail-fast
+      - name: Build & Test (--no-default-features) - shadowsocks
+        run: cargo test --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --no-default-features --no-fail-fast
       - name: Build with All Features Enabled
         run: cargo build --verbose --features "local-dns dns-over-tls dns-over-https stream-cipher"
+      - name: Build with All Features Enabled - shadowsocks
+        run: cargo build --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --features "stream-cipher"
 
   build-macos:
     runs-on: macos-latest
@@ -81,7 +93,13 @@ jobs:
           profile: minimal
       - name: Build & Test (Default)
         run: cargo test --verbose --no-fail-fast
+      - name: Build & Test (Default) - shadowsocks
+        run: cargo test --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --no-fail-fast
       - name: Build & Test (--no-default-features)
         run: cargo test --verbose --no-default-features --no-fail-fast
+      - name: Build & Test (--no-default-features) - shadowsocks
+        run: cargo test --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --no-default-features --no-fail-fast
       - name: Build with All Features Enabled
-        run: cargo build --verbose --features "local-redir local-dns dns-over-tls dns-over-https stream-cipher"
+        run: cargo build --verbose --features "local-dns dns-over-tls dns-over-https stream-cipher"
+      - name: Build with All Features Enabled - shadowsocks
+        run: cargo build --manifest-path ./crates/shadowsocks/Cargo.toml --verbose --features "stream-cipher"

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "shadowsocks-rust"
-version = "1.10.5"
+version = "1.11.0"
 authors = ["Shadowsocks Contributors"]
 description = "shadowsocks is a fast tunnel proxy that helps you bypass firewalls."
 repository = "https://github.com/shadowsocks/shadowsocks-rust"
@@ -132,3 +132,6 @@ byteorder = "1.3"
 env_logger = "0.8"
 byte_string = "1.0"
 tokio = { version = "1", features = ["net", "time", "macros", "io-util"]}
+
+[patch.crates-io]
+tokio = { git = "https://github.com/tokio-rs/tokio.git", features = ["full"] }

Cargo.toml

@@ -66,11 +66,11 @@ fn main() {
             (@arg DNS: --dns +takes_value "DNS nameservers, formatted like [(tcp|udp)://]host[:port][,host[:port]]..., or unix:///path/to/dns, or predefined keys like \"google\", \"cloudflare\"")
 
             (@arg TCP_NO_DELAY: --("tcp-no-delay") !takes_value alias("no-delay") "Set TCP_NODELAY option for socket")
+            (@arg TCP_FAST_OPEN: --("tcp-fast-open") !takes_value alias("fast-open") "Enable TCP Fast Open (TFO)")
 
             (@arg UDP_TIMEOUT: --("udp-timeout") +takes_value {validator::validate_u64} "Timeout seconds for UDP relay")
             (@arg UDP_MAX_ASSOCIATIONS: --("udp-max-associations") +takes_value {validator::validate_u64} "Maximum associations to be kept simultaneously for UDP relay")
 
-
             (@arg INBOUND_SEND_BUFFER_SIZE: --("inbound-send-buffer-size") +takes_value {validator::validate_u32} "Set inbound sockets' SO_SNDBUF option")
             (@arg INBOUND_RECV_BUFFER_SIZE: --("inbound-recv-buffer-size") +takes_value {validator::validate_u32} "Set inbound sockets' SO_RCVBUF option")
             (@arg OUTBOUND_SEND_BUFFER_SIZE: --("outbound-send-buffer-size") +takes_value {validator::validate_u32} "Set outbound sockets' SO_SNDBUF option")
@@ -346,6 +346,10 @@ fn main() {
             config.no_delay = true;
         }
 
+        if matches.is_present("TCP_FAST_OPEN") {
+            config.fast_open = true;
+        }
+
         #[cfg(any(target_os = "linux", target_os = "android"))]
         if let Some(mark) = matches.value_of("OUTBOUND_FWMARK") {
             config.outbound_fwmark = Some(mark.parse::<u32>().expect("an unsigned integer for `outbound-fwmark`"));

bin/sslocal.rs

@@ -51,7 +51,6 @@ fn main() {
             (@arg BIND_ADDR: -b --("bind-addr") +takes_value {validator::validate_ip_addr} "Bind address, outbound socket will bind this address")
             (@arg SERVER_HOST: -s --("server-host") +takes_value "Host name or IP address of your remote server")
 
-
             (@arg MANAGER_ADDRESS: --("manager-address") +takes_value {validator::validate_manager_addr} "ShadowSocks Manager (ssmgr) address, could be ip:port, domain:port or /path/to/unix.sock")
             (@arg ENCRYPT_METHOD: -m --("encrypt-method") +takes_value possible_values(available_ciphers()) "Default encryption method")
             (@arg TIMEOUT: --timeout +takes_value {validator::validate_u64} "Default timeout seconds for TCP relay")
@@ -60,6 +59,7 @@ fn main() {
             (@arg DNS: --dns +takes_value "DNS nameservers, formatted like [(tcp|udp)://]host[:port][,host[:port]]..., or unix:///path/to/dns, or predefined keys like \"google\", \"cloudflare\"")
 
             (@arg TCP_NO_DELAY: --("tcp-no-delay") !takes_value alias("no-delay") "Set TCP_NODELAY option for socket")
+            (@arg TCP_FAST_OPEN: --("tcp-fast-open") !takes_value alias("fast-open") "Enable TCP Fast Open (TFO)")
 
             (@arg UDP_TIMEOUT: --("udp-timeout") +takes_value {validator::validate_u64} "Timeout seconds for UDP relay")
             (@arg UDP_MAX_ASSOCIATIONS: --("udp-max-associations") +takes_value {validator::validate_u64} "Maximum associations to be kept simultaneously for UDP relay")
@@ -154,6 +154,10 @@ fn main() {
             config.no_delay = true;
         }
 
+        if matches.is_present("TCP_FAST_OPEN") {
+            config.fast_open = true;
+        }
+
         #[cfg(any(target_os = "linux", target_os = "android"))]
         if let Some(mark) = matches.value_of("OUTBOUND_FWMARK") {
             config.outbound_fwmark = Some(mark.parse::<u32>().expect("an unsigned integer for `outbound-fwmark`"));

bin/ssmanager.rs

@@ -61,6 +61,7 @@ fn main() {
             (@arg DNS: --dns +takes_value "DNS nameservers, formatted like [(tcp|udp)://]host[:port][,host[:port]]..., or unix:///path/to/dns, or predefined keys like \"google\", \"cloudflare\"")
 
             (@arg TCP_NO_DELAY: --("tcp-no-delay") !takes_value alias("no-delay") "Set TCP_NODELAY option for socket")
+            (@arg TCP_FAST_OPEN: --("tcp-fast-open") !takes_value alias("fast-open") "Enable TCP Fast Open (TFO)")
 
             (@arg UDP_TIMEOUT: --("udp-timeout") +takes_value {validator::validate_u64} "Timeout seconds for UDP relay")
             (@arg UDP_MAX_ASSOCIATIONS: --("udp-max-associations") +takes_value {validator::validate_u64} "Maximum associations to be kept simultaneously for UDP relay")
@@ -194,6 +195,10 @@ fn main() {
             config.no_delay = true;
         }
 
+        if matches.is_present("TCP_FAST_OPEN") {
+            config.fast_open = true;
+        }
+
         #[cfg(any(target_os = "linux", target_os = "android"))]
         if let Some(mark) = matches.value_of("OUTBOUND_FWMARK") {
             config.outbound_fwmark = Some(mark.parse::<u32>().expect("an unsigned integer for `outbound-fwmark`"));

bin/ssserver.rs

@@ -1,6 +1,6 @@
 [package]
 name = "shadowsocks-service"
-version = "1.10.4"
+version = "1.11.0"
 authors = ["Shadowsocks Contributors"]
 description = "shadowsocks is a fast tunnel proxy that helps you bypass firewalls."
 repository = "https://github.com/shadowsocks/shadowsocks-rust"

crates/shadowsocks-service/Cargo.toml

@@ -41,8 +41,8 @@
 //!
 //! These defined server will be used with a load balancing algorithm.
 
-#[cfg(any(target_os = "linux", target_os = "android", target_os = "macos", target_os = "ios"))]
-use std::ffi::OsString;
+#[cfg(any(unix, features = "local-flow-stat"))]
+use std::path::PathBuf;
 use std::{
     convert::{From, Infallible},
     default::Default,
@@ -51,7 +51,7 @@ use std::{
     io::Read,
     net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6},
     option::Option,
-    path::{Path, PathBuf},
+    path::Path,
     str::FromStr,
     string::ToString,
     time::Duration,
@@ -128,6 +128,8 @@ struct SSConfig {
     nofile: Option<u64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     ipv6_first: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    fast_open: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Default)]
@@ -718,6 +720,8 @@ pub struct Config {
 
     /// Set `TCP_NODELAY` socket option
     pub no_delay: bool,
+    /// Set `TCP_FASTOPEN` socket option
+    pub fast_open: bool,
     /// `RLIMIT_NOFILE` option for *nix systems
     #[cfg(all(unix, not(target_os = "android")))]
     pub nofile: Option<u64>,
@@ -727,7 +731,7 @@ pub struct Config {
     pub outbound_fwmark: Option<u32>,
     /// Set `SO_BINDTODEVICE` socket option for outbound sockets
     #[cfg(any(target_os = "linux", target_os = "android", target_os = "macos", target_os = "ios"))]
-    pub outbound_bind_interface: Option<OsString>,
+    pub outbound_bind_interface: Option<String>,
     /// Path to protect callback unix address, only for Android
     #[cfg(target_os = "android")]
     pub outbound_vpn_protect_path: Option<PathBuf>,
@@ -831,6 +835,7 @@ impl Config {
             ipv6_first: false,
 
             no_delay: false,
+            fast_open: false,
             #[cfg(all(unix, not(target_os = "android")))]
             nofile: None,
 
@@ -1278,6 +1283,11 @@ impl Config {
             nconfig.no_delay = b;
         }
 
+        // TCP fast open
+        if let Some(b) = config.fast_open {
+            nconfig.fast_open = b;
+        }
+
         // UDP
         nconfig.udp_timeout = config.udp_timeout.map(Duration::from_secs);
 
@@ -1764,6 +1774,10 @@ impl fmt::Display for Config {
             jconf.no_delay = Some(self.no_delay);
         }
 
+        if self.fast_open {
+            jconf.fast_open = Some(self.fast_open);
+        }
+
         match self.dns {
             DnsConfig::System => {}
             #[cfg(feature = "trust-dns")]

crates/shadowsocks-service/src/config.rs

@@ -18,7 +18,7 @@ use shadowsocks::{
 use tokio::net::UnixStream;
 use tokio::{
     io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt},
-    net::{TcpStream, UdpSocket},
+    net::UdpSocket,
     time,
 };
 use trust_dns_resolver::proto::{
@@ -31,7 +31,7 @@ use crate::net::{FlowStat, MonProxySocket, MonProxyStream};
 /// Collection of various DNS connections
 pub enum DnsClient {
     TcpLocal {
-        stream: TcpStream,
+        stream: ShadowTcpStream,
     },
     UdpLocal {
         socket: UdpSocket,
@@ -42,7 +42,7 @@ pub enum DnsClient {
         stream: UnixStream,
     },
     TcpRemote {
-        stream: ProxyClientStream<MonProxyStream<TcpStream>>,
+        stream: ProxyClientStream<MonProxyStream<ShadowTcpStream>>,
     },
     UdpRemote {
         socket: MonProxySocket,
@@ -53,7 +53,7 @@ pub enum DnsClient {
 impl DnsClient {
     /// Connect to local provided TCP DNS server
     pub async fn connect_tcp_local(ns: SocketAddr, connect_opts: &ConnectOpts) -> io::Result<DnsClient> {
-        let stream = ShadowTcpStream::connect_with_opts(&ns, connect_opts).await?.into();
+        let stream = ShadowTcpStream::connect_with_opts(&ns, connect_opts).await?;
         Ok(DnsClient::TcpLocal { stream })
     }