mirrors/shadowsocks-libev
0
0 Fork 0
mirror of https://github.com/shadowsocks/shadowsocks-libev.git synced 2026-10-28 10:44:43 +08:00
Code Activity
Files
3728a993a7ffa052ff4cd7f50223446bc85e97d8
shadowsocks-libev/CMakeLists.txt
T
Max Lv 98915c7828 Build as C11 and remove input-sized VLAs from key parsing 
crypto_parse_key sized a stack array from strlen() of the key given on
the command line or in the config file, so a long enough key string
overflowed the stack before any validation ran. Only the first key_len
bytes were ever used, and base64_decode already stops at the size it is
given, so a fixed MAX_KEY_LENGTH buffer is enough. crypto_parse_psk
needs one byte of slack to tell an over-long key from an exact-size one.

The two "here is a valid key instead" error paths were identical; they
are now one helper, which also drops the last input-sized VLA.

Switch the standard from gnu99 to C11 via CMAKE_C_STANDARD rather than a
hand-written -std flag, so CMake picks the right spelling per compiler.
2026-08-19 18:24:33 +08:00

243 lines
8.6 KiB
CMake
Raw Blame History

cmake_minimum_required(VERSION 3.10)
set(PROJECT_NAME shadowsocks-libev)
set(RELEASE_DATE 2026-02-09)
set(PROJECT_VERSION "3.3.6")
set(PROJECT_DESC "a lightweight secured socks5 proxy")
set(PROJECT_URL "https://shadowsocks.org")
set(PROJECT_ISSUES_URL "https://github.com/shadowsocks/shadowsocks-libev")
project(${PROJECT_NAME} VERSION ${PROJECT_VERSION})
include(GNUInstallDirs)
# Compilation database for clang-tidy and other tooling
set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
# C11 with GNU extensions. _GNU_SOURCE stays for the glibc-specific
# interfaces used by the Linux-only modules (ss-redir, connmark/nftables).
set(CMAKE_C_STANDARD 11)
set(CMAKE_C_STANDARD_REQUIRED ON)
set(CMAKE_C_EXTENSIONS ON)
# Note: -Werror is applied per-target in src/CMakeLists.txt to avoid
# breaking bundled submodules (libcork, libipset, libbloom)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_GNU_SOURCE")
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -g -O2 -Wall -Wno-deprecated-declarations -fno-strict-aliasing")
option(ENABLE_SANITIZERS "Build with AddressSanitizer and UndefinedBehaviorSanitizer" OFF)
if (ENABLE_SANITIZERS)
set(SANITIZER_FLAGS "-fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer")
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SANITIZER_FLAGS}")
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${SANITIZER_FLAGS}")
message(STATUS "Sanitizers enabled (ASan + UBSan)")
endif ()
option(ENABLE_COVERAGE "Build with coverage instrumentation (gcov)" OFF)
if (ENABLE_COVERAGE)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O0 --coverage")
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} --coverage")
set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} --coverage")
message(STATUS "Coverage instrumentation enabled")
endif ()
set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${PROJECT_BINARY_DIR}/lib)
set(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${PROJECT_BINARY_DIR}/lib)
set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${PROJECT_BINARY_DIR}/bin)
set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} ${PROJECT_SOURCE_DIR}/cmake)
set(RUNTIME_SHARED_OUTPUT_DIRECTORY ${PROJECT_BINARY_DIR}/shared/bin)
set(CMAKE_MACOSX_RPATH TRUE)
set(CMAKE_POSITION_INDEPENDENT_CODE ON)
if (NOT CMAKE_BUILD_TYPE)
set(CMAKE_BUILD_TYPE Debug)
endif ()
# Detect linux
if (UNIX AND NOT APPLE)
set(LINUX TRUE)
endif ()
message(STATUS "Running cmake version ${CMAKE_VERSION}")
option(WITH_STATIC "build with static libraries." ON)
option(WITH_EMBEDDED_SRC "build with embedded libcork, libipset, and libbloom source." ON)
option(ENABLE_CONNMARKTOS "Enable saved connmark to IP TOS QoS feature" OFF)
option(ENABLE_NFTABLES "Report malicious IP to nftables" OFF)
# When choose to not use embedded libcork, libipset and libbloom, use libs shipped by system
if (NOT WITH_EMBEDDED_SRC)
set(USE_SYSTEM_SHARED_LIB TRUE)
endif ()
# Find dependencies via Find modules
find_package(PCRE2 REQUIRED)
find_package(MbedTLS REQUIRED)
find_package(Sodium REQUIRED)
find_package(Cares REQUIRED)
# Connmarktos support
if(ENABLE_CONNMARKTOS)
if(NOT LINUX)
message(FATAL_ERROR "connmarktos is only supported on Linux")
endif()
find_library(NETFILTER_CONNTRACK_LIB netfilter_conntrack)
find_library(NFNETLINK_LIB nfnetlink)
if(NOT NETFILTER_CONNTRACK_LIB)
message(FATAL_ERROR "--enable-connmarktos specified but libnetfilter_conntrack not found")
endif()
set(USE_NFCONNTRACK_TOS 1)
message(STATUS "Connmarktos enabled")
endif()
# Nftables support
if(ENABLE_NFTABLES)
if(NOT LINUX)
message(FATAL_ERROR "nftables is only supported on Linux")
endif()
find_library(MNL_LIB mnl)
find_library(NFTNL_LIB nftnl)
if(NOT MNL_LIB OR NOT NFTNL_LIB)
message(FATAL_ERROR "--enable-nftables specified but libmnl or libnftnl not found")
endif()
set(USE_NFTABLES 1)
message(STATUS "Nftables enabled")
endif()
# Run platform tests
include(${PROJECT_SOURCE_DIR}/cmake/configure.cmake)
configure_file(${PROJECT_SOURCE_DIR}/cmake/config.h.cmake ${PROJECT_BINARY_DIR}/src/config.h)
add_definitions(-I${PROJECT_BINARY_DIR}/src)
add_definitions(-DHAVE_CONFIG_H)
# pkg-config
configure_file(
${PROJECT_SOURCE_DIR}/cmake/shadowsocks-libev.pc.cmake
${PROJECT_BINARY_DIR}/pkgconfig/shadowsocks-libev.pc
@ONLY
)
install(FILES
${PROJECT_BINARY_DIR}/pkgconfig/shadowsocks-libev.pc
DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
)
if (WITH_EMBEDDED_SRC)
# We need libcork,libipset headers
include_directories(libcork/include)
include_directories(libipset/include)
include_directories(libbloom/murmur2)
include_directories(libbloom)
set(LIBCORK_SOURCE
libcork/src/libcork/cli/commands.c
libcork/src/libcork/core/allocator.c
libcork/src/libcork/core/error.c
libcork/src/libcork/core/gc.c
libcork/src/libcork/core/hash.c
libcork/src/libcork/core/ip-address.c
libcork/src/libcork/core/mempool.c
libcork/src/libcork/core/timestamp.c
libcork/src/libcork/core/u128.c
libcork/src/libcork/core/version.c
libcork/src/libcork/ds/array.c
libcork/src/libcork/ds/bitset.c
libcork/src/libcork/ds/buffer.c
libcork/src/libcork/ds/dllist.c
libcork/src/libcork/ds/file-stream.c
libcork/src/libcork/ds/hash-table.c
libcork/src/libcork/ds/managed-buffer.c
libcork/src/libcork/ds/ring-buffer.c
libcork/src/libcork/ds/slice.c
libcork/src/libcork/posix/directory-walker.c
libcork/src/libcork/posix/env.c
libcork/src/libcork/posix/exec.c
libcork/src/libcork/posix/files.c
libcork/src/libcork/posix/process.c
libcork/src/libcork/pthreads/thread.c
)
if (NOT MINGW)
set(LIBCORK_SOURCE ${LIBCORK_SOURCE} libcork/src/libcork/posix/subprocess.c)
else ()
set(LIBCORK_SOURCE ${LIBCORK_SOURCE} libcork/src/libcork/posix/mingw.c)
endif ()
add_library(cork STATIC ${LIBCORK_SOURCE})
target_compile_definitions(cork PUBLIC -DCORK_API=CORK_LOCAL)
if (MINGW)
target_link_libraries(cork ws2_32)
endif ()
set(LIBIPSET_SOURCE
libipset/src/libipset/general.c
libipset/src/libipset/bdd/assignments.c
libipset/src/libipset/bdd/basics.c
libipset/src/libipset/bdd/bdd-iterator.c
libipset/src/libipset/bdd/expanded.c
libipset/src/libipset/bdd/reachable.c
libipset/src/libipset/bdd/read.c
libipset/src/libipset/bdd/write.c
libipset/src/libipset/map/allocation.c
libipset/src/libipset/map/inspection.c
libipset/src/libipset/map/ipv4_map.c
libipset/src/libipset/map/ipv6_map.c
libipset/src/libipset/map/storage.c
libipset/src/libipset/set/allocation.c
libipset/src/libipset/set/inspection.c
libipset/src/libipset/set/ipv4_set.c
libipset/src/libipset/set/ipv6_set.c
libipset/src/libipset/set/iterator.c
libipset/src/libipset/set/storage.c
)
add_library(ipset STATIC ${LIBIPSET_SOURCE})
set(LIBBLOOM_SOURCE
libbloom/bloom.c
libbloom/murmur2/MurmurHash2.c
)
add_library(bloom STATIC ${LIBBLOOM_SOURCE})
target_link_libraries(ipset cork bloom)
endif ()
add_subdirectory(src)
add_subdirectory(doc)
# Testing
include(CTest)
if(BUILD_TESTING)
add_subdirectory(tests)
endif()
# Coverage report (requires ENABLE_COVERAGE=ON, lcov and genhtml)
# Usage: make coverage (after running ctest / integration tests)
if (ENABLE_COVERAGE)
find_program(LCOV_EXECUTABLE lcov)
find_program(GENHTML_EXECUTABLE genhtml)
if (LCOV_EXECUTABLE AND GENHTML_EXECUTABLE)
add_custom_target(coverage
COMMAND ${LCOV_EXECUTABLE} --capture --directory ${PROJECT_BINARY_DIR}
--output-file ${PROJECT_BINARY_DIR}/coverage.info
--include ${PROJECT_SOURCE_DIR}/src/*
--ignore-errors mismatch,unused,empty,gcov
COMMAND ${LCOV_EXECUTABLE} --list ${PROJECT_BINARY_DIR}/coverage.info
COMMAND ${GENHTML_EXECUTABLE} ${PROJECT_BINARY_DIR}/coverage.info
--output-directory ${PROJECT_BINARY_DIR}/coverage-html
COMMAND ${CMAKE_COMMAND} -E echo "Coverage report: ${PROJECT_BINARY_DIR}/coverage-html/index.html"
WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
VERBATIM
)
else ()
message(WARNING "lcov/genhtml not found - 'coverage' target unavailable")
endif ()
endif ()
# Install ss-nat on Linux
if(LINUX)
install(PROGRAMS src/ss-nat DESTINATION ${CMAKE_INSTALL_BINDIR})
endif()
# Install ss-setup TUI tool
install(PROGRAMS scripts/ss-setup.sh DESTINATION ${CMAKE_INSTALL_BINDIR} RENAME ss-setup)
View Git Blame Copy Permalink