Bug: Shadowsocks is not SOCKS5

[wolph]

TLDR: The documentation says that shadowsocks takes care of SOCKS5 support. It does not

As explained by the Shadowsocks site, the protocol is loosely based on SOCKS5 but it certainly is no SOCKS5: https://shadowsocks.org/en/spec/Protocol.html

To test:

 curl --proxy socks5h://localhost:8388 -vvv google.com

[wolph]

To add SOCKS5 support I would suggest Privoxy :)

[wolph]

Actually... even when using proxychains it's not working with a roughly stock configuration. I think the shadowsocks server might simply be broken.

# docker run --name surfshark --rm --cap-add=NET_ADMIN -e VPNSP=surfshark -p 8888:8888/tcp -p 8388:8388/tcp -p 8388:8388/udp -p 8001:8000/tcp -e EXTRA_SUBNETS='192.168.0.0/24,127.0.0.0/8' -e TINYPROXY=on -e SHADOWSOCKS=on -e SHADOWSOCKS_LOG=on -e REGION='Netherlands Amsterdam' qmcgaw/private-internet-access:latest

# proxychains curl -vvv ifconfig.me                    
ProxyChains-3.1 (http://proxychains.sf.net)
*   Trying 216.239.38.21:80...
* TCP_NODELAY set
|D-chain|-<>-127.0.0.1:8388-<><>-216.239.38.21:80-<--timeout
* Immediate connect fail for 216.239.38.21: Connection refused
*   Trying 216.239.36.21:80...
* TCP_NODELAY set
|D-chain|-<>-127.0.0.1:8388-<><>-216.239.36.21:80-<--timeout
* Immediate connect fail for 216.239.36.21: Connection refused
*   Trying 216.239.34.21:80...
* TCP_NODELAY set
|D-chain|-<>-127.0.0.1:8388-<><>-216.239.34.21:80-<--timeout
* Immediate connect fail for 216.239.34.21: Connection refused
*   Trying 216.239.32.21:80...
* TCP_NODELAY set
|D-chain|-<>-127.0.0.1:8388-<><>-216.239.32.21:80-<--timeout
* Immediate connect fail for 216.239.32.21: Connection refused
* Closing connection 0
curl: (7) Couldn't connect to server

proxychains config:

[ProxyList]
socks5 127.0.0.1 8388

When using this config it does work:

[ProxyList]
http 127.0.0.1 8888

[qdm12]

Indeed thanks! Also see #234 to support that feature.

[wolph]

Excellent! That would make it a lot more versatile.

[wolph]

@qdm12 regarding the test with proxychains though... am I doing something wrong or is the current shadowsocks implementation broken?

[qdm12]

It's simply because shadowsocks is not a socks5 proxy (my bad). I even coded it from scratch for gluetun, I should had updated the documentation 😄 Anyway, it uses the socks5 protocol but adds an extra stream encryption layer on top. So with a socks5 client it will just reject you because you don't have the encryption nor the password to connect. Let me know, maybe I'm missing something out.

[wolph]

The thing is... the example from the Shadowsocks wiki shows exactly this example: https://github.com/shadowsocks/shadowsocks/wiki/Using-Shadowsocks-with-Command-Line-Tools

So I would expect it to work.

[qdm12]

Interesting. Although that wiki page has nothing about encryption nor password, which confuses me now 😕

[wolph]

Perhaps the wiki is just wrong. Can't say I've ever used shadowsocks beyond a random test so I'm not sure what to expect

[qdm12]

It seems to work with different Shadowsocks client, so my guess is it's fine. (although initially it was eating all your CPU but that's another silly story of mine haha!). I'd however be curious to run the same command in a socks5 proxy without encryption.

[wolph]

It must be due to proxychains not using encrypted connections in that case

[qdm12]

@wolph I believe it works, see my comment with steps how to reproduce. Maybe you are mistaking the Shadowsocks server listening port (usually 8388) with the Shadowsocks client listening port (usually 1080).

Proxychains seems to work for SOCKS5 proxies, not Shadowsocks. The Shadowsocks client exposes a SOCKS5 proxy server on port 1080 though. I'm about to start work on a SOCKS5 proxy built-in gluetun, so you should be able to use that directly with proxychains in the future... although careful, SOCKS5 IS NOT encrypted vs Shadowsocks.