Add SOCKS5 password protection for local proxy interface (RFC 1929)

[Copilot]

Any app on the device can use the local SOCKS5 proxy (default port 1080) without authentication, enabling unauthorized traffic routing and potential VPN IP leakage. This adds optional RFC 1929 username/password authentication to the local SOCKS5 interface.

How it works

• User sets a SOCKS5 proxy password in global settings (empty = no auth, preserving existing behavior)
• ss-local is configured with a socks5_auth_config_path pointing to a generated auth config file (username: shadowsocks, password: user-configured)
• tun2socks receives --username/--password so VPN mode continues to work transparently
• Auth config file is written at service start and deleted at shutdown

Changes

• Constants.kt / DataStore.kt: socksPassword key and property backed by publicStore
• ProxyInstance.kt: Writes socks5_auth JSON config file and adds socks5_auth_config_path to the local SOCKS5 listener config when password is set; cleans up on shutdown
• VpnService.kt: Passes --username shadowsocks --password <pwd> to tun2socks when password is set
• pref_global.xml / pref_main.xml: EditTextPreference (password dialog) for the new setting
• GlobalSettingsPreferenceFragment.kt / MainPreferenceFragment.kt: Password preference disabled while service is running

Auth config format written to socks5_auth

{
  "password": {
    "users": [{ "user_name": "shadowsocks", "password": "<user-configured>" }]
  }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.foojay.io
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Xmx64m -Xms64m -Dorg.gradle.appname=gradlew -classpath \"\" -jar /home/REDACTED/work/shadowsocks-android/shadowsocks-android/gradle/wrapper/gradle-wrapper.jar :core:compileDebugKotlin /main/java/com/g--norc /main/java/com/g--noprofile /main/java/com/github/shadowsocks/tv/App.kt rc/s�� /src/test/java/com/github/shadowsocks/plugin/PluginOptionsTest.kt /src/main/java/com/github/shadowsocks/plugin/Utils.kt /src/main/java/com/github/shadowsocks/plugin/AlertDialogFragment.kt /src/main/java/cgit /src/main/java/cls-files /src/main/java/c--exclude-standard /src/main/java/c--others (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Xmx64m -Xms64m -Dorg.gradle.appname=gradlew -classpath \"\" -jar /home/REDACTED/work/shadowsocks-android/shadowsocks-android/gradle/wrapper/gradle-wrapper.jar :core:compileDebugKotlin -Porg.gradle.java.installations.auto-provision=false om/github/shadowsocks/plugin/HelpCallback.kt om/github/shadowsocks/plugin/PluginContract.kt om/g�� om/github/shadowsocks/plugin/PluginOptions.kt om/github/shadowsocks/plugin/HelpActivity.kt /src/main/res/values-ru/strings.xml /src/main/res/vaiptables /src/main/res/va-w /src/main/res/va-t /src/main/res/vasecurity (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Xmx64m -Xms64m -Dorg.gradle.appname=gradlew -classpath \"\" -jar /home/REDACTED/work/shadowsocks-android/shadowsocks-android/gradle/wrapper/gradle-wrapper.jar :core:compileDebugKotlin --no-daemon -Dorg.gradle.java.home=/usr/lib/jvm/temurin-17-jdk-amd64 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)