The release of the outline-ss-server 1.4 proxy server has been published, utilizing the Shadowsocks protocol to hide traffic characteristics, bypass firewalls, and deceive packet inspection systems. The server is developed by the Outline project, which also provides a set of client applications and a management interface that allows for the quick deployment of multi-user Shadowsocks servers based on outline-ss-server in public cloud environments or on personal hardware, managing them via a web interface, and organizing user access through keys. The code is developed and maintained by Jigsaw, a division of Google created to advance tools for bypassing censorship and promoting free information exchange.
The Outline-ss-server is written in Go and distributed under the Apache 2.0 license. It is based on the proxy code ofserver go-shadowsocks2, created by the Shadowsocks developer community. Recently, the main activity of the Shadowsocks project has been focused on developing a new server in Rust, while the implementation in Go has not been updated for over a year and significantly lags behind in functionality.
The differences between outline-ss-server and go-shadowsocks2 include support for multiple users connecting through a single network port, the ability to open multiple network ports for receiving connections, support for hot restarts and configuration updates without interrupting connections, and built-in monitoring and traffic modification tools based on the prometheus.io platform.
The outline-ss-server also includes protection against attacks related to sending verification requests and replaying traffic. The attack via verification requests aims to determine the presence of a proxy; for example, an attacker may send sets of data of different sizes to the target Shadowsocks server and analyze how much data the server reads before detecting an error and closing the connection. The replay attack is based on intercepting the session between the client and proxy server then attempting to resend the intercepted data to determine the presence of a proxy.
To protect against attacks via verification requests, the outline-ss-server does not terminate the connection or display an error upon receiving incorrect data; instead, it continues to accept information, functioning as a sort of black hole. To safeguard against replay attacks, incoming data from clients is additionally checked for duplicates using checksums stored for the last several thousand handshake sequences (up to 40 thousand, with size set at server startup, consuming 20 bytes of memory per sequence). HMAC authentication codes with 32-bit tags are applied across all server handshake sequences to block repeated responses from the server.
In terms of traffic obfuscation, the Shadowsocks protocol implemented in outline-ss-server is similar to the transport plugin Obfs4 used in the anonymous Tor network. This protocol was developed to bypass traffic censorship systems in China (the 'Great Firewall') and allows for effective concealment of traffic relayed through another server (the traffic is difficult to identify due to the attachment of random obfuscation and simulation of a continuous flow).
SOCKS5 is used as the protocol for proxying requests—on the local system, a proxy supporting SOCKS5 is launched, which tunnels traffic to a remote server that carries out the requests. Traffic between the client and server is placed in an encrypted tunnel (authenticated encryption is supported using AEAD_CHACHA20_POLY1305, AEAD_AES_128_GCM, and AEAD_AES_256_GCM), which is the primary goal of Shadowsocks. It supports the creation of TCP and UDP tunnels, as well as the establishment of arbitrary tunnels not limited to SOCKS5 through the use of plugins resembling transport plugins in Tor.
Source: opennet.ru
