Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for any ACL file (RFC) #2525

Open
Mygod opened this issue May 13, 2020 · 1 comment
Open

Support for any ACL file (RFC) #2525

Mygod opened this issue May 13, 2020 · 1 comment

Comments

@Mygod
Copy link
Contributor

Mygod commented May 13, 2020

After 857fb55, the only special case this repo does for ACL file is to add bypass LAN routes:

when (profile.route) {
Acl.ALL, Acl.BYPASS_CHN, Acl.CUSTOM_RULES -> {
builder.addRoute("0.0.0.0", 0)
if (profile.ipv6) builder.addRoute("::", 0)
}
else -> {
resources.getStringArray(R.array.bypass_private_route).forEach {
val subnet = Subnet.fromString(it)!!
builder.addRoute(subnet.address.hostAddress, subnet.prefixSize)
}
builder.addRoute(PRIVATE_VLAN4_ROUTER, 32)
// https://issuetracker.google.com/issues/149636790
if (profile.ipv6) builder.addRoute("2000::", 3)
}
}

Unfortunately, this is known to be buggy on Android 10, so maybe we can remove this optimization as well.

Assuming we remove this, shadowsocks-android now essentially treats all ACL files virtually the same, so it makes sense now to allow the user to completely customize ACL. Here is my proposal for improved customizable ACL.

Better maintainability

There are currently a lot of redundancy in the acl files. We can allow all ACL files to import each other, e.g. bypass-china.acl could be simply:

[proxy_all]

#IMPORT_URL https://host/path/to/gfwlist.acl

[bypass_list]
# China IP blocks here...

Host reachable anywhere

Currently we host ACL files on shadowsocks.org, which is inaccessible from China. We can get around this issue by using GitHub or other CDNs, e.g. https://cdn.jsdelivr.net/gh/shadowsocks/shadowsocks-acl@v2/gfwlist.acl.

Remove ACL GUI editor

I think GUI editor is currently a rarely used feature. We should replace it with just a list of ACL urls, much like subscriptions. Built-in ACL will also use this format, but with a built-in offline cache.

(maybe GUI editor makes more sense if it is a web editor)

Fixes #2385. Any comments? @madeye

@madeye
Copy link
Contributor

madeye commented May 14, 2020

Yeah, look good to me.

@Mygod Mygod mentioned this issue Jul 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants