* Fix findings from the security audit
Remote:
- TCP: handshake/connect deadlines follow --timeout instead of a 24h
minimum, so idle sockets can no longer fill the connection pool.
- ACL: IPv4-mapped IPv6 addresses are matched against the IPv4 lists.
- UDP server now enforces the peer ACL and the outbound block list.
- ACL loading fails closed on bad files or invalid entries.
- TCP half-close is relayed instead of tearing the connection down.
- AEAD-2022 UDP sessions are created only after timestamp/replay checks.
ss-manager:
- Owner-only conf files (deleted on remove), 0600 control socket,
umask 022, safe working directory, loopback-only IP addresses,
per-user sender check on Linux, plugins only over the UNIX socket.
- Port canonicalisation, list() overflow, add/remove waits for the
server, stale pid files can't signal unrelated processes.
Also: plugins drop to --user, daemonize readiness/pid file handling,
resolver cancellation, replay-filter fail-closed, key wiping, spec
strictness in AEAD/2022 parsing, JSON surrogate validation, ss:// plugin
name checks, embedding API state reset, Android protect_socket replies.
Adds tests/test_server_acl.py and tests/test_half_close.py and extends
the manager, ACL, AEAD-2022 and ssurl tests.
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix CI on Ubuntu 26.04 runners; use string_view over raw string pointers
- Define _GLIBCXX_NO_ASSERTIONS: libstdc++ 15 enables assertions at -O0,
which pulls __glibcxx_assert_fail (C++ runtime) into the programs.
- test_redir_qemu: boot the guest with -cpu max so the runner's glibc
loader runs under TCG.
- find_program: std::string_view PATH splitting into a fixed buffer, no
heap and no null snprintf destination (GCC -Wformat-truncation).
- manager: parse /proc/net/udp numbers with strtoul (cert-err34-c);
walk /proc/<pid>/cmdline with std::string_view.
- ssurl: sanitise the tag through std::span.
Co-Authored-By: Claude <noreply@anthropic.com>
* coverage: tolerate gcov 15 lambda inconsistencies in lcov 2
Co-Authored-By: Claude <noreply@anthropic.com>
* resolver: replace init's cleanup lambda with a member; lcov --list ignores inconsistent
gcov 15 marks the lambda as not hit while its lines are, which lcov 2
rejects.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Rename test_jconf.c to test_jconf_cpp.cpp
* Parse the config file on arenas
read_jconf now reads the file and builds the JSON tree in a scratch arena
that is released before it returns, and copies the parsed strings into one
process-lifetime arena instead of a malloc per string. parse_addr and the
config parser share one address splitter.
Port test_jconf to C++ and cover every field copied out of the parse tree,
a re-read, and the densest file the size limit accepts.
* tests: rename remaining C unit tests to .cpp (no content changes)
* tests: port remaining C unit tests to the C++ test harness
Convert acl, acl_literal, aead2022, base64, buffer, cache (legacy
reference), crypto, ipset, ipset_reference, json, netutils, ppbloom,
process, ref, ssurl and utils tests to test_helpers.hpp. ctest names are
unchanged; every assertion is kept. Build the ported sources with the
strict C++ warning set.
* Run clang-tidy on every ported test
The test regex skipped file names with digits (test_aead2022_cpp.cpp,
test_base64_cpp.cpp); include them, fix the two optional accesses it then
reports, and build test_jconf with the strict warning set.
* docs: per-connection RSS on Linux against the C relay
* test_jconf: check read_jconf results before using them
