winws build fix

use enum for option indices

.gitattributes

@@ -1,5 +1,3 @@
 * text=auto eol=lf
-binaries/win64/readme.txt eol=crlf
-binaries/win32/readme.txt eol=crlf
 *.cmd eol=crlf
 *.bat eol=crlf

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/issue-warning.md

@@ -0,0 +1,19 @@
+---
+name: bugs
+about: do not write lame questions
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+1. Здесь не место для вопросов, касающихся компьютерной грамотности и навыков использования ОС
+2. Здесь не место для вопросов "у меня не работает" без технических подробностей
+3. Здесь не место для вопросов "как мне открыть ютуб", "что писать в ...", "перестало открываться".
+4. Здесь не место для обсуждения сборок
+5. Вирусов здесь нет. У вас либо чья-то сборка, либо ваш антивирус давно пора отправить на покой. Антивирусы в основном жалуются на upx и windivert, которые убраны НЕ будут. upx - это паковщик для сокращения требуемого места на openwrt, windivert - замена iptables для windows, потенциальный инструмент хакера или компонент зловредной программы, но сам по себе вирусом не является. Не согласны - удаляйте софт. За агрессивные наезды "почему автор распространяет вирусы" молча схватите бан.
+
+Все означенное обсуждать в дискуссиях или на форумах.
+При нарушении будет закрываться или конвертироваться в дискуссии.
+Issue только для обсуждения проблем самого софта. Неработа стратегии или ваше неумение настроить - это ваша проблема, а не проблема софта.
+Однокнопочные решения дают только сборщики, поэтому "открытие сайта" не является функцией программы, и нет смысла жаловаться, что он не открывается. Но можно это обсудить в дискуссиях. Не захламляйте issues !

.github/issue_template.md

@@ -1,10 +0,0 @@
-1. Здесь не место для вопросов, касающихся компьютерной грамотности и навыков использования ОС
-2. Здесь не место для вопросов "у меня не работает" без технических подробностей
-3. Здесь не место для вопросов "как мне открыть ютуб" или "что писать в ..."
-4. Здесь не место для обсуждения сборок
-5. Вирусов здесь нет. У вас либо чья-то сборка, либо ваш антивирус давно пора отправить на покой. Не согласны - удаляйте софт.
-
-Все означенное обсуждать в дискуссиях или на форумах.
-При нарушении будет закрываться или конвертироваться в дискуссии.
-Issue только для обсуждения проблем самого софта. Неработа стратегии или ваше неумение настроить - это ваша проблема, а не проблема софта.
-

.github/workflows/build.yml

@@ -52,6 +52,13 @@ jobs:
             tool: i586-unknown-linux-musl
           - arch: x86_64
             tool: x86_64-unknown-linux-musl
+          - arch: lexra
+            tool: mips-linux
+            dir: rsdk-4.6.4-5281-EB-3.10-0.9.33-m32ub-20141001
+            env:
+              CFLAGS: '-march=5281'
+              LDFLAGS: '-lgcc_eh'
+            repo: 'bol-van/build'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -60,18 +67,31 @@ jobs:
 
       - name: Set up build tools
         env:
-          REPO: 'spvkgn/musl-cross'
+          ARCH: ${{ matrix.arch }}
           TOOL: ${{ matrix.tool }}
+          REPO: ${{ matrix.arch == 'lexra' && matrix.repo || 'spvkgn/musl-cross' }}
+          DIR: ${{ matrix.arch == 'lexra' && matrix.dir || matrix.tool }}
         run: |
-          sudo apt update -qq && sudo apt install -y libcap-dev
+          if [[ "$ARCH" == lexra ]]; then
+            sudo dpkg --add-architecture i386
+            sudo apt update -qq
+            sudo apt install -y libcap-dev libc6:i386 zlib1g:i386
+            URL=https://github.com/$REPO/raw/refs/heads/master/$DIR.txz
+          else
+            sudo apt update -qq
+            sudo apt install -y libcap-dev
+            URL=https://github.com/$REPO/releases/download/latest/$TOOL.tar.xz
+          fi
           mkdir -p $HOME/tools
-          wget -qO- https://github.com/$REPO/releases/download/latest/$TOOL.tar.xz | tar -C $HOME/tools -xJ || exit 1
-          [ -d "$HOME/tools/$TOOL/bin" ] && echo "$HOME/tools/$TOOL/bin" >> $GITHUB_PATH
+          wget -qO- $URL | tar -C $HOME/tools -xJ || exit 1
+          [[ -d "$HOME/tools/$DIR/bin" ]] && echo "$HOME/tools/$DIR/bin" >> $GITHUB_PATH
 
       - name: Build
         env:
           ARCH: ${{ matrix.arch }}
           TARGET: ${{ matrix.tool }}
+          CFLAGS: ${{ matrix.env.CFLAGS != '' && matrix.env.CFLAGS || null }}
+          LDFLAGS: ${{ matrix.env.LDFLAGS != '' && matrix.env.LDFLAGS || null }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           DEPS_DIR=$GITHUB_WORKSPACE/deps
@@ -81,6 +101,7 @@ jobs:
           export NM=$TARGET-nm
           export STRIP=$TARGET-strip
           export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
+          export STAGING_DIR=$RUNNER_TEMP
 
           # netfilter libs
           wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
@@ -90,7 +111,7 @@ jobs:
           for i in libmnl libnfnetlink libnetfilter_queue ; do
             (
               cd $i-*
-              CFLAGS="-Os -flto=auto" \
+              CFLAGS="-Os -flto=auto $CFLAGS" \
               ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
               make install -j$(nproc) DESTDIR=$DEPS_DIR
             )
@@ -102,7 +123,7 @@ jobs:
             xargs -I{} wget -qO- https://github.com/madler/zlib/archive/refs/tags/{}.tar.gz | tar -xz
           (
             cd zlib-*
-            CFLAGS="-Os -flto=auto" \
+            CFLAGS="-Os -flto=auto $CFLAGS" \
             ./configure --prefix= --static
             make install -j$(nproc) DESTDIR=$DEPS_DIR
           )
@@ -113,8 +134,8 @@ jobs:
           install -Dm644 -t $DEPS_DIR/include/sys /usr/include/x86_64-linux-gnu/sys/queue.h /usr/include/sys/capability.h
 
           # zapret
-          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include" \
-          LDFLAGS="-L$DEPS_DIR/lib" \
+          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include $CFLAGS" \
+          LDFLAGS="-L$DEPS_DIR/lib $LDFLAGS" \
           make -C zapret -j$(nproc)
           tar -C zapret/binaries/my -cJf zapret-linux-$ARCH.tar.xz .
 
@@ -306,11 +327,12 @@ jobs:
       - name: Build
         env:
           ABI: ${{ matrix.abi }}
+          API: 21
           TARGET: ${{ matrix.target }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           DEPS_DIR=$GITHUB_WORKSPACE/deps
           export TOOLCHAIN=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64
-          export API=21
           export CC="$TOOLCHAIN/bin/clang --target=$TARGET$API"
           export AR=$TOOLCHAIN/bin/llvm-ar
           export AS=$CC
@@ -339,6 +361,12 @@ jobs:
           CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -I$DEPS_DIR/include" \
           LDFLAGS="-L$DEPS_DIR/lib" \
           make -C zapret android -j$(nproc)
+
+          # strip unwanted ELF sections to prevent warnings on old Android versions
+          gh api repos/termux/termux-elf-cleaner/releases/latest --jq '.tag_name' |\
+            xargs -I{} wget -O elf-cleaner https://github.com/termux/termux-elf-cleaner/releases/download/{}/termux-elf-cleaner
+          chmod +x elf-cleaner
+          ./elf-cleaner --api-level $API zapret/binaries/my/*
           zip zapret-android-$ABI.zip -j zapret/binaries/my/*
 
       - name: Upload artifacts
@@ -373,6 +401,7 @@ jobs:
         uses: crazy-max/ghaction-upx@v3
         with:
           install-only: true
+          version: v4.2.4
 
       - name: Prepare binaries
         shell: bash
@@ -390,7 +419,7 @@ jobs:
                   if [[ $dir == *-linux-x86_64 ]]; then
                     tar -C $dir -czvf $dir/tpws_wsl.tgz tpws
                     run_upx $dir/*
-                  elif [[ $dir =~ linux ]] && [[ $dir != *-linux-mips64 ]]; then
+                  elif [[ $dir =~ linux ]] && [[ $dir != *-linux-mips64 ]] && [[ $dir != *-linux-lexra ]]; then
                     run_upx $dir/*
                   fi
                   ;;
@@ -422,6 +451,7 @@ jobs:
                 *-linux-ppc )           run_dir ppc ;;
                 *-linux-x86 )           run_dir x86 ;;
                 *-linux-x86_64 )        run_dir x86_64 ;;
+                *-linux-lexra )         run_dir lexra ;;
                 *-mac-x64 )             run_dir mac64 ;;
                 *-win-x86 )             run_dir win32 ;;
                 *-win-x86_64 )          run_dir win64 ;;

.gitignore

@@ -4,9 +4,9 @@ mdig/mdig
 nfq/dvtws
 nfq/nfqws
 nfq/winws.exe
+nfq/WinDivert*
 tpws/tpws
 binaries/my/
-init.d/**/custom
 ipset/zapret-ip*.txt
 ipset/zapret-ip*.gz
 ipset/zapret-hosts*.txt

Makefile

@@ -15,6 +15,19 @@ all:	clean
 		done \
 	done
 
+systemd: clean
+	@mkdir -p "$(TGT)"; \
+	for dir in $(DIRS); do \
+		find "$$dir" -type f  \( -name "*.c" -o -name "*.h" -o -name "*akefile" \) -exec chmod -x {} \; ; \
+		$(MAKE) -C "$$dir" systemd || exit; \
+		for exe in "$$dir/"*; do \
+			if [ -f "$$exe" ] && [ -x "$$exe" ]; then \
+				mv -f "$$exe" "${TGT}" ; \
+				ln -fs "../${TGT}/$$(basename "$$exe")" "$$exe" ; \
+			fi \
+		done \
+	done
+
 android: clean
 	@mkdir -p "$(TGT)"; \
 	for dir in $(DIRS); do \

blockcheck.sh

@@ -23,6 +23,7 @@ CURL=${CURL:-curl}
 . "$ZAPRET_BASE/common/fwtype.sh"
 . "$ZAPRET_BASE/common/virt.sh"
 
+DOMAINS_DEFAULT=${DOMAINS_DEFAULT:-rutracker.org}
 QNUM=${QNUM:-59780}
 SOCKS_PORT=${SOCKS_PORT:-1993}
 TPWS_UID=${TPWS_UID:-1}
@@ -35,9 +36,9 @@ MDIG=${MDIG:-${ZAPRET_BASE}/mdig/mdig}
 DESYNC_MARK=0x10000000
 IPFW_RULE_NUM=${IPFW_RULE_NUM:-1}
 IPFW_DIVERT_PORT=${IPFW_DIVERT_PORT:-59780}
-DOMAINS=${DOMAINS:-rutracker.org}
 CURL_MAX_TIME=${CURL_MAX_TIME:-2}
 CURL_MAX_TIME_QUIC=${CURL_MAX_TIME_QUIC:-$CURL_MAX_TIME}
+CURL_MAX_TIME_DOH=${CURL_MAX_TIME_DOH:-2}
 MIN_TTL=${MIN_TTL:-1}
 MAX_TTL=${MAX_TTL:-12}
 USER_AGENT=${USER_AGENT:-Mozilla}
@@ -45,8 +46,9 @@ HTTP_PORT=${HTTP_PORT:-80}
 HTTPS_PORT=${HTTPS_PORT:-443}
 QUIC_PORT=${QUIC_PORT:-443}
 UNBLOCKED_DOM=${UNBLOCKED_DOM:-iana.org}
+PARALLEL_OUT=/tmp/zapret_parallel
 
-HDRTEMP=/tmp/zapret-hdr.txt
+HDRTEMP=/tmp/zapret-hdr
 
 NFT_TABLE=blockcheck
 
@@ -77,9 +79,11 @@ exitp()
 {
 	local A
 
-	echo
-	echo press enter to continue
-	read A
+	[ "$BATCH" = 1 ] || {
+		echo
+		echo press enter to continue
+		read A
+	}
 	exit $1
 }
 
@@ -212,7 +216,7 @@ doh_resolve()
 	# $1 - ip version 4/6
 	# $2 - hostname
 	# $3 - doh server URL. use $DOH_SERVER if empty
-	$MDIG --family=$1 --dns-make-query=$2 | curl -s --data-binary @- -H "Content-Type: application/dns-message" "${3:-$DOH_SERVER}" | $MDIG --dns-parse-query
+	$MDIG --family=$1 --dns-make-query=$2 | $CURL --max-time $CURL_MAX_TIME_DOH -s --data-binary @- -H "Content-Type: application/dns-message" "${3:-$DOH_SERVER}" | $MDIG --dns-parse-query
 }
 doh_find_working()
 {
@@ -337,12 +341,19 @@ netcat_test()
 	}
 }
 
+tpws_can_fix_seg()
+{
+	# fix-seg requires kernel 4.6+
+	"$TPWS" --port 1 --dry-run --fix-seg >/dev/null 2>/dev/null
+}
+
 check_system()
 {
 	echo \* checking system
 
 	UNAME=$(uname)
 	SUBSYS=
+	FIX_SEG=
 	local s
 
 	# can be passed FWTYPE=iptables to override default nftables preference
@@ -350,6 +361,14 @@ check_system()
 		Linux)
 			PKTWS="$NFQWS"
 			PKTWSD=nfqws
+			if [ -x "$TPWS" ] ; then
+				if tpws_can_fix_seg ; then
+					echo tpws supports --fix-seg on this system
+					FIX_SEG='--fix-seg'
+				else
+					echo tpws does not support --fix-seg on this system
+				fi
+			fi
 			linux_fwtype
 			[ "$FWTYPE" = iptables -o "$FWTYPE" = nftables ] || {
 				echo firewall type $FWTYPE not supported in $UNAME
@@ -560,7 +579,7 @@ curl_supports_tls13()
 	[ $? = 2 ] && return 1
 	# curl can have tlsv1.3 key present but ssl library without TLS 1.3 support
 	# this is online test because there's no other way to trigger library incompatibility case
-	$CURL --tlsv1.3 --max-time $CURL_MAX_TIME -Is -o /dev/null https://iana.org 2>/dev/null
+	$CURL --tlsv1.3 --max-time 1 -Is -o /dev/null https://iana.org 2>/dev/null
 	r=$?
 	[ $r != 4 -a $r != 35 ]
 }
@@ -651,28 +670,28 @@ curl_test_http()
 	# $3 - subst ip
 	# $4 - "detail" - detail info
 
-	local code loc
-	curl_probe $1 $2 $HTTP_PORT "$3" -SsD "$HDRTEMP" -A "$USER_AGENT" --max-time $CURL_MAX_TIME $CURL_OPT "http://$2" -o /dev/null 2>&1 || {
+	local code loc hdrt="${HDRTEMP}_${!:-$$}.txt"
+	curl_probe $1 $2 $HTTP_PORT "$3" -SsD "$hdrt" -A "$USER_AGENT" --max-time $CURL_MAX_TIME $CURL_OPT "http://$2" -o /dev/null 2>&1 || {
 		code=$?
-		rm -f "$HDRTEMP"
+		rm -f "$hdrt"
 		return $code
 	}
 	if [ "$4" = "detail" ] ; then
-		head -n 1 "$HDRTEMP"
-		grep "^[lL]ocation:" "$HDRTEMP"
+		head -n 1 "$hdrt"
+		grep "^[lL]ocation:" "$hdrt"
 	else
-		code=$(hdrfile_http_code "$HDRTEMP")
+		code=$(hdrfile_http_code "$hdrt")
 		[ "$code" = 301 -o "$code" = 302 -o "$code" = 307 -o "$code" = 308 ] && {
-			loc=$(hdrfile_location "$HDRTEMP")
+			loc=$(hdrfile_location "$hdrt")
 			echo "$loc" | grep -qE "^https?://.*$2(/|$)" ||
 			echo "$loc" | grep -vqE '^https?://' || {
 				echo suspicious redirection $code to : $loc
-				rm -f "$HDRTEMP"
+				rm -f "$hdrt"
 				return 254
 			}
 		}
 	fi
-	rm -f "$HDRTEMP"
+	rm -f "$hdrt"
 	[ "$code" = 400 ] && {
 		# this can often happen if the server receives fake packets it should not receive
 		echo http code $code. likely the server receives fakes.
@@ -964,18 +983,38 @@ curl_test()
 	# $2 - domain
 	# $3 - subst ip
 	# $4 - param of test function
-	local code=0 n=0
+	local code=0 n=0 p pids
 
-	while [ $n -lt $REPEATS ]; do
-		n=$(($n+1))
-		[ $REPEATS -gt 1 ] && printf "[attempt $n] "
-		if $1 "$IPV" $2 $3 "$4" ; then
-			[ $REPEATS -gt 1 ] && echo 'AVAILABLE'
-		else
-			code=$?
-			[ "$SCANLEVEL" = quick ] && break
-		fi
-	done
+	if [ "$PARALLEL" = 1 ]; then
+		rm -f "${PARALLEL_OUT}"*
+		for n in $(seq -s ' ' 1 $REPEATS); do
+			$1 "$IPV" $2 $3 "$4" >"${PARALLEL_OUT}_$n" &
+			pids="${pids:+$pids }$!"
+		done
+		n=1
+		for p in $pids; do
+			[ $REPEATS -gt 1 ] && printf "[attempt $n] "
+			if wait $p; then
+				[ $REPEATS -gt 1 ] && echo 'AVAILABLE'
+			else
+				code=$?
+				cat "${PARALLEL_OUT}_$n"
+			fi
+			n=$(($n+1))
+		done
+		rm -f "${PARALLEL_OUT}"*
+	else
+		while [ $n -lt $REPEATS ]; do
+			n=$(($n+1))
+			[ $REPEATS -gt 1 ] && printf "[attempt $n] "
+			if $1 "$IPV" $2 $3 "$4" ; then
+				[ $REPEATS -gt 1 ] && echo 'AVAILABLE'
+			else
+				code=$?
+				[ "$SCANLEVEL" = quick ] && break
+			fi
+		done
+	fi
 	[ "$4" = detail ] || {
 		if [ $code = 254 ]; then
 			echo "UNAVAILABLE"
@@ -1121,7 +1160,10 @@ test_has_fake()
 warn_fool()
 {
 	case "$1" in
-		md5sig) echo 'WARNING ! although md5sig fooling worked it will not work on all sites. it typically works only on linux servers.' ;;
+		md5sig) echo 'WARNING ! although md5sig fooling worked it will not work on all sites. it typically works only on linux servers.'
+			[ "$2" = "fakedsplit" -o "$2" = "fakeddisorder" ] && \
+				echo "WARNING ! fakedsplit/fakeddisorder with md5sig fooling and low split position causes MTU overflow with multi-segment TLS (kyber)"
+			;;
 		datanoack) echo 'WARNING ! although datanoack fooling worked it may break NAT and may only work with external IP. Additionally it may require nftables to work correctly.' ;;
 	esac
 }
@@ -1133,13 +1175,16 @@ pktws_curl_test_update_vary()
 	# $4 - desync mode
 	# $5,$6,... - strategy
 
-	local testf=$1 sec=$2 domain=$3 desync=$4 proto zerofake= splits= pos fake ret=1
+	local testf=$1 sec=$2 domain=$3 desync=$4 proto zerofake= tlsmod= splits= pos fake ret=1
 	
 	shift; shift; shift; shift
 	
 	proto=http
 	[ "$sec" = 0 ] || proto=tls
-	test_has_fake $desync && zerofake="--dpi-desync-fake-$proto=0x00000000"
+	test_has_fake $desync && {
+		zerofake="--dpi-desync-fake-$proto=0x00000000"
+		[ "$sec" = 0 ] || tlsmod="--dpi-desync-fake-tls-mod=rnd,dupsid,rndsni,padencap"
+	}
 	if test_has_fakedsplit $desync ; then
 		splits="method+2 midsld"
 		[ "$sec" = 0 ] || splits="1 midsld"
@@ -1147,7 +1192,7 @@ pktws_curl_test_update_vary()
 		splits="method+2 midsld"
 		[ "$sec" = 0 ] || splits="1 midsld 1,midsld"
 	fi
-	for fake in '' $zerofake ; do
+	for fake in '' $zerofake $tlsmod ; do
 		if [ -n "$splits" ]; then
 			for pos in $splits ; do
 				pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" --dpi-desync-split-pos=$pos $fake && {
@@ -1245,7 +1290,7 @@ pktws_check_domain_http_bypass_()
 			[ "$IPV" = 6 ] && f="$f hopbyhop hopbyhop2"
 			for fooling in $f; do
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-fooling=$fooling $e && {
-					warn_fool $fooling
+					warn_fool $fooling $desync
 					[ "$SCANLEVEL" = quick ] && return
 					need_wssize=0
 				}
@@ -1400,6 +1445,11 @@ warn_mss()
 	[ -n "$1" ] && echo 'WARNING ! although mss worked it may not work on all sites and will likely cause significant slowdown. it may only be required for TLS1.2, not TLS1.3'
 	return 0
 }
+fix_seg()
+{
+	# $1 - split-pos
+	[ -n "$FIX_SEG" ] && contains "$1" , && echo "$FIX_SEG"
+}
 
 tpws_check_domain_http_bypass_()
 {
@@ -1425,7 +1475,7 @@ tpws_check_domain_http_bypass_()
 		done
 		for s2 in '' '--hostcase' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
 			for s in $splits_http ; do
-				tpws_curl_test_update $1 $3 --split-pos=$s $s2 && [ "$SCANLEVEL" != force ] && {
+				tpws_curl_test_update $1 $3 --split-pos=$s $(fix_seg $s) $s2 && [ "$SCANLEVEL" != force ] && {
 					[ "$SCANLEVEL" = quick ] && return
 					break
 				}
@@ -1440,7 +1490,7 @@ tpws_check_domain_http_bypass_()
 			s3=${mss:+--mss=$mss}
 			for s2 in '' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
 				for pos in $splits_tls; do
-					tpws_curl_test_update $1 $3 --split-pos=$pos $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
+					tpws_curl_test_update $1 $3 --split-pos=$pos $(fix_seg $pos) $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
 						[ "$SCANLEVEL" = quick ] && return
 						need_mss=0
 						break
@@ -1448,7 +1498,7 @@ tpws_check_domain_http_bypass_()
 				done
 			done
 			for s in '' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
-				for s2 in '--tlsrec=midsld' '--tlsrec=sniext+1 --split-pos=midsld' '--tlsrec=sniext+4 --split-pos=midsld' '--tlsrec=sniext+1 --split-pos=1,midsld' '--tlsrec=sniext+4 --split-pos=1,midsld' ; do
+				for s2 in '--tlsrec=midsld' '--tlsrec=sniext+1 --split-pos=midsld' '--tlsrec=sniext+4 --split-pos=midsld' "--tlsrec=sniext+1 --split-pos=1,midsld $FIX_SEG" "--tlsrec=sniext+4 --split-pos=1,midsld $FIX_SEG" ; do
 					tpws_curl_test_update $1 $3 $s2 $s $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
 						[ "$SCANLEVEL" = quick ] && return
 						need_mss=0
@@ -1551,7 +1601,7 @@ check_domain_http_tcp()
 
 	check_domain_prolog $1 $2 $4 || return
 
-	check_dpi_ip_block $1 $4
+	[ "$SKIP_IPBLOCK" = 1 ] || check_dpi_ip_block $1 $4
 
 	[ "$SKIP_TPWS" = 1 ] || {
 		echo
@@ -1597,22 +1647,22 @@ check_domain_http_udp()
 check_domain_http()
 {
 	# $1 - domain
-	check_domain_http_tcp curl_test_http 80 0 $1
+	check_domain_http_tcp curl_test_http $HTTP_PORT 0 $1
 }
 check_domain_https_tls12()
 {
 	# $1 - domain
-	check_domain_http_tcp curl_test_https_tls12 443 1 $1
+	check_domain_http_tcp curl_test_https_tls12 $HTTPS_PORT 1 $1
 }
 check_domain_https_tls13()
 {
 	# $1 - domain
-	check_domain_http_tcp curl_test_https_tls13 443 2 $1
+	check_domain_http_tcp curl_test_https_tls13 $HTTPS_PORT 2 $1
 }
 check_domain_http3()
 {
 	# $1 - domain
-	check_domain_http_udp curl_test_http3 443 $1
+	check_domain_http_udp curl_test_http3 $QUIC_PORT $1
 }
 
 configure_ip_version()
@@ -1707,76 +1757,119 @@ ask_params()
 		exitp 1
 	}
 
-
-	echo "specify domain(s) to test. multiple domains are space separated."
-	printf "domain(s) (default: $DOMAINS) : "
 	local dom
-	read dom
-	[ -n "$dom" ] && DOMAINS="$dom"
+	[ -n "$DOMAINS" ] || {
+		DOMAINS="$DOMAINS_DEFAULT"
+		[ "$BATCH" = 1 ] || {
+			echo "specify domain(s) to test. multiple domains are space separated."
+			printf "domain(s) (default: $DOMAINS) : "
+			read dom
+			[ -n "$dom" ] && DOMAINS="$dom"
+		}
+	}
 
 	local IPVS_def=4
-	# yandex public dns
-	pingtest 6 2a02:6b8::feed:0ff && IPVS_def=46
-	printf "ip protocol version(s) - 4, 6 or 46 for both (default: $IPVS_def) : "
-	read IPVS
-	[ -n "$IPVS" ] || IPVS=$IPVS_def
-	[ "$IPVS" = 4 -o "$IPVS" = 6 -o "$IPVS" = 46 ] || {
-		echo 'invalid ip version(s). should be 4, 6 or 46.'
-		exitp 1
+	[ -n "$IPVS" ] || {
+		# yandex public dns
+		pingtest 6 2a02:6b8::feed:0ff && IPVS_def=46
+		[ "$BATCH" = 1 ] || {
+			printf "ip protocol version(s) - 4, 6 or 46 for both (default: $IPVS_def) : "
+			read IPVS
+		}
+		[ -n "$IPVS" ] || IPVS=$IPVS_def
+		[ "$IPVS" = 4 -o "$IPVS" = 6 -o "$IPVS" = 46 ] || {
+			echo 'invalid ip version(s). should be 4, 6 or 46.'
+			exitp 1
+		}
 	}
 	[ "$IPVS" = 46 ] && IPVS="4 6"
 
 	configure_curl_opt
 
-	ENABLE_HTTP=1
-	echo
-	ask_yes_no_var ENABLE_HTTP "check http"
-
-	ENABLE_HTTPS_TLS12=1
-	echo
-	ask_yes_no_var ENABLE_HTTPS_TLS12 "check https tls 1.2"
-
-	ENABLE_HTTPS_TLS13=0
-	echo
-	if [ -n "$TLS13" ]; then
-		echo "TLS 1.3 uses encrypted ServerHello. DPI cannot check domain name in server response."
-		echo "This can allow more bypass strategies to work."
-		echo "What works for TLS 1.2 will also work for TLS 1.3 but not vice versa."
-		echo "Most sites nowadays support TLS 1.3 but not all. If you can't find a strategy for TLS 1.2 use this test."
-		echo "TLS 1.3 only strategy is better than nothing."
-		ask_yes_no_var ENABLE_HTTPS_TLS13 "check https tls 1.3"
-	else
-		echo "installed curl version does not support TLS 1.3 . tests disabled."
-	fi
-
-	ENABLE_HTTP3=0
-	echo
-	if [ -n "$HTTP3" ]; then
-		echo "make sure target domain(s) support QUIC or result will be negative in any case"
-		ENABLE_HTTP3=1
-		ask_yes_no_var ENABLE_HTTP3 "check http3 QUIC"
-	else
-		echo "installed curl version does not support http3 QUIC. tests disabled."
-	fi
-
-	echo
-	echo "sometimes ISPs use multiple DPIs or load balancing. bypass strategies may work unstable."
-	printf "how many times to repeat each test (default: 1) : "
-	read REPEATS
-	REPEATS=$((0+${REPEATS:-1}))
-	[ "$REPEATS" = 0 ] && {
-		echo invalid repeat count
-		exitp 1
+	[ -n "$ENABLE_HTTP" ] || {
+		ENABLE_HTTP=1
+		[ "$BATCH" = 1 ] || {
+			echo
+			ask_yes_no_var ENABLE_HTTP "check http"
+		}
 	}
 
-	echo
-	echo quick    - scan as fast as possible to reveal any working strategy
-	echo standard - do investigation what works on your DPI
-	echo force    - scan maximum despite of result
-	SCANLEVEL=${SCANLEVEL:-standard}
-	ask_list SCANLEVEL "quick standard force" "$SCANLEVEL"
-	# disable tpws checks by default in quick mode
-	[ "$SCANLEVEL" = quick -a -z "$SKIP_TPWS" -a "$UNAME" != Darwin ] && SKIP_TPWS=1
+	[ -n "$ENABLE_HTTPS_TLS12" ] || {
+		ENABLE_HTTPS_TLS12=1
+		[ "$BATCH" = 1 ] || {
+			echo
+			ask_yes_no_var ENABLE_HTTPS_TLS12 "check https tls 1.2"
+		}
+	}
+
+	[ -n "$ENABLE_HTTPS_TLS13" ] || {
+		ENABLE_HTTPS_TLS13=0
+		if [ -n "$TLS13" ]; then
+			[ "$BATCH" = 1 ] || {
+				echo
+				echo "TLS 1.3 uses encrypted ServerHello. DPI cannot check domain name in server response."
+				echo "This can allow more bypass strategies to work."
+				echo "What works for TLS 1.2 will also work for TLS 1.3 but not vice versa."
+				echo "Most sites nowadays support TLS 1.3 but not all. If you can't find a strategy for TLS 1.2 use this test."
+				echo "TLS 1.3 only strategy is better than nothing."
+				ask_yes_no_var ENABLE_HTTPS_TLS13 "check https tls 1.3"
+			}
+		else
+			echo
+			echo "installed curl version does not support TLS 1.3 . tests disabled."
+		fi
+	}
+
+	[ -n "$ENABLE_HTTP3" ] || {
+		ENABLE_HTTP3=0
+		if [ -n "$HTTP3" ]; then
+			ENABLE_HTTP3=1
+			[ "$BATCH" = 1 ] || {
+				echo
+				echo "make sure target domain(s) support QUIC or result will be negative in any case"
+				ask_yes_no_var ENABLE_HTTP3 "check http3 QUIC"
+			}
+		else
+			echo
+			echo "installed curl version does not support http3 QUIC. tests disabled."
+		fi
+	}
+
+	[ -n "$REPEATS" ] || {
+		[ "$BATCH" = 1 ] || {
+			echo
+			echo "sometimes ISPs use multiple DPIs or load balancing. bypass strategies may work unstable."
+			printf "how many times to repeat each test (default: 1) : "
+			read REPEATS
+		}
+		REPEATS=$((0+${REPEATS:-1}))
+		[ "$REPEATS" = 0 ] && {
+			echo invalid repeat count
+			exitp 1
+		}
+	}
+	[ -z "$PARALLEL" -a $REPEATS -gt 1 ] && {
+		PARALLEL=0
+		[ "$BATCH" = 1 ] || {
+			echo
+			echo "parallel scan can greatly increase speed but may also trigger DDoS protection and cause false result"
+			ask_yes_no_var PARALLEL "enable parallel scan"
+		}
+	}
+	PARALLEL=${PARALLEL:-0}
+
+	[ -n "$SCANLEVEL" ] || {
+		SCANLEVEL=standard
+		[ "$BATCH" = 1 ] || {
+			echo
+			echo quick    - scan as fast as possible to reveal any working strategy
+			echo standard - do investigation what works on your DPI
+			echo force    - scan maximum despite of result
+			ask_list SCANLEVEL "quick standard force" "$SCANLEVEL"
+			# disable tpws checks by default in quick mode
+			[ "$SCANLEVEL" = quick -a -z "$SKIP_TPWS" -a "$UNAME" != Darwin ] && SKIP_TPWS=1
+		}
+	}
 
 	echo
 
@@ -1981,14 +2074,15 @@ check_dns()
 unprepare_all()
 {
 	# make sure we are not in a middle state that impacts connectivity
-	rm -f "$HDRTEMP"
-	[ -n "$IPV" ] && {
-		pktws_ipt_unprepare_tcp 80
-		pktws_ipt_unprepare_tcp 443
-		pktws_ipt_unprepare_udp 443
-	}
 	ws_kill
+	wait
+	[ -n "$IPV" ] && {
+		pktws_ipt_unprepare_tcp $HTTP_PORT
+		pktws_ipt_unprepare_tcp $HTTPS_PORT
+		pktws_ipt_unprepare_udp $QUIC_PORT
+	}
 	cleanup
+	rm -f "${HDRTEMP}"* "${PARALLEL_OUT}"*
 }
 sigint()
 {
@@ -2034,10 +2128,10 @@ for dom in $DOMAINS; do
 	for IPV in $IPVS; do
 		configure_ip_version
 		[ "$ENABLE_HTTP" = 1 ] && {
-			check_domain_port_block $dom $HTTP_PORT
+			[ "$SKIP_IPBLOCK" = 1 ] || check_domain_port_block $dom $HTTP_PORT
 			check_domain_http $dom
 		}
-		[ "$ENABLE_HTTPS_TLS12" = 1 -o "$ENABLE_HTTPS_TLS13" = 1 ] && check_domain_port_block $dom $HTTPS_PORT
+		[ "$ENABLE_HTTPS_TLS12" = 1 -o "$ENABLE_HTTPS_TLS13" = 1 ] && [ "$SKIP_IPBLOCK" != 1 ] && check_domain_port_block $dom $HTTPS_PORT
 		[ "$ENABLE_HTTPS_TLS12" = 1 ] && check_domain_https_tls12 $dom
 		[ "$ENABLE_HTTPS_TLS13" = 1 ] && check_domain_https_tls13 $dom
 		[ "$ENABLE_HTTP3" = 1 ] && check_domain_http3 $dom

common/base.sh

@@ -241,7 +241,7 @@ fix_sbin_path()
 # it can calculate floating point expr
 calc()
 {
-	awk "BEGIN { print $*}";
+	LC_ALL=C awk "BEGIN { print $*}";
 }
 
 fsleep_setup()
@@ -318,18 +318,27 @@ setup_md5()
 	exists $MD5 || MD5=md5
 }
 
+setup_random()
+{
+	[ -n "$RCUT" ] && return
+	RCUT="cut -c 1-17"
+	# some shells can operate with 32 bit signed int
+	[ $((0x100000000)) = 0 ] && RCUT="cut -c 1-9"
+}
+
 random()
 {
 	# $1 - min, $2 - max
 	local r rs
 	setup_md5
+	setup_random
 	if [ -c /dev/urandom ]; then
 		read rs </dev/urandom
 	else
 		rs="$RANDOM$RANDOM$(date)"
 	fi
 	# shells use signed int64
-	r=1$(echo $rs | $MD5 | sed 's/[^0-9]//g' | cut -c 1-17)
+	r=1$(echo $rs | $MD5 | sed 's/[^0-9]//g' | $RCUT)
 	echo $(( ($r % ($2-$1+1)) + $1 ))
 }
 

common/custom.sh

@@ -3,6 +3,8 @@ custom_runner()
 	# $1 - function name
 	# $2+ - params
 
+	[ "$DISABLE_CUSTOM" = 1 ] && return 0
+
 	local n script FUNC=$1
 
 	shift

common/installer.sh

@@ -1,4 +1,4 @@
-readonly GET_LIST_PREFIX=/ipset/get_
+GET_LIST_PREFIX=/ipset/get_
 
 SYSTEMD_DIR=/lib/systemd
 [ -d "$SYSTEMD_DIR" ] || SYSTEMD_DIR=/usr/lib/systemd
@@ -140,7 +140,7 @@ echo_var()
 	eval v="\$$1"
 	if find_str_in_list $1 "$EDITVAR_NEWLINE_VARS"; then
 		echo "$1=\""
-		echo "$v\"" | sed "s/$EDITVAR_NEWLINE_DELIMETER /$EDITVAR_NEWLINE_DELIMETER\n/g"
+		echo "$v\"" | tr '\n' ' ' | tr -d '\r' | sed -e 's/^ *//' -e 's/ *$//' -e "s/$EDITVAR_NEWLINE_DELIMETER /$EDITVAR_NEWLINE_DELIMETER\n/g"
 	else
 		if contains "$v" " "; then
 			echo $1=\"$v\"
@@ -170,6 +170,7 @@ list_vars()
 		echo_var $1
 		shift
 	done
+	echo
 }
 
 openrc_test()
@@ -616,11 +617,17 @@ write_config_var()
 	replace_var_def $1 "$M" "$ZAPRET_CONFIG"
 }
 
+no_prereq_exit()
+{
+	echo could not install prerequisites
+	exitp 6
+}
 check_prerequisites_linux()
 {
 	echo \* checking prerequisites
 
 	local s cmd PKGS UTILS req="curl curl"
+	local APTGET DNF YUM PACMAN ZYPPER EOPKG APK
 	case "$FWTYPE" in
 		iptables)
 			req="$req iptables iptables ip6tables iptables ipset ipset"
@@ -649,6 +656,7 @@ check_prerequisites_linux()
 		echo packages required : $PKGS
 
 		APTGET=$(whichq apt-get)
+		DNF=$(whichq dnf)
 		YUM=$(whichq yum)
 		PACMAN=$(whichq pacman)
 		ZYPPER=$(whichq zypper)
@@ -656,39 +664,23 @@ check_prerequisites_linux()
 		APK=$(whichq apk)
 		if [ -x "$APTGET" ] ; then
 			"$APTGET" update
-			"$APTGET" install -y --no-install-recommends $PKGS dnsutils || {
-				echo could not install prerequisites
-				exitp 6
-			}
+			"$APTGET" install -y --no-install-recommends $PKGS dnsutils || no_prereq_exit
+		elif [ -x "$DNF" ] ; then
+			"$DNF" -y install $PKGS || no_prereq_exit
 		elif [ -x "$YUM" ] ; then
-			"$YUM" -y install $PKGS || {
-				echo could not install prerequisites
-				exitp 6
-			}
+			"$YUM" -y install $PKGS || no_prereq_exit
 		elif [ -x "$PACMAN" ] ; then
 			"$PACMAN" -Syy
-			"$PACMAN" --noconfirm -S $PKGS || {
-				echo could not install prerequisites
-				exitp 6
-			}
+			"$PACMAN" --noconfirm -S $PKGS || no_prereq_exit
 		elif [ -x "$ZYPPER" ] ; then
-			"$ZYPPER" --non-interactive install $PKGS || {
-				echo could not install prerequisites
-				exitp 6
-			}
+			"$ZYPPER" --non-interactive install $PKGS || no_prereq_exit
 		elif [ -x "$EOPKG" ] ; then
-			"$EOPKG" -y install $PKGS || {
-				echo could not install prerequisites
-				exitp 6
-			}
+			"$EOPKG" -y install $PKGS || no_prereq_exit
 		elif [ -x "$APK" ] ; then
 			"$APK" update
 			# for alpine
 			[ "$FWTYPE" = iptables ] && [ -n "$($APK list ip6tables)" ] && PKGS="$PKGS ip6tables"
-			"$APK" add $PKGS || {
-				echo could not install prerequisites
-				exitp 6
-			}
+			"$APK" add $PKGS || no_prereq_exit
 		else
 			echo supported package manager not found
 			echo you must manually install : $UTILS
@@ -837,3 +829,37 @@ select_fwtype()
 	echo select firewall type :
 	ask_list FWTYPE "iptables nftables" "$FWTYPE" && write_config_var FWTYPE
 }
+
+dry_run_tpws_()
+{
+	local TPWS="$ZAPRET_BASE/tpws/tpws"
+	echo verifying tpws options
+	"$TPWS" --dry-run "$@"
+}
+dry_run_nfqws_()
+{
+	local NFQWS="$ZAPRET_BASE/nfq/nfqws"
+	echo verifying nfqws options
+	"$NFQWS" --dry-run "$@"
+}
+dry_run_tpws()
+{
+	[ "$TPWS_ENABLE" = 1 ] || return 0
+	local opt="$TPWS_OPT" port=${TPPORT_SOCKS:-988}
+	filter_apply_hostlist_target opt
+	dry_run_tpws_ --port=$port $opt
+}
+dry_run_tpws_socks()
+{
+	[ "$TPWS_SOCKS_ENABLE" = 1 ] || return 0
+	local opt="$TPWS_SOCKS_OPT" port=${TPPORT:-987}
+	filter_apply_hostlist_target opt
+	dry_run_tpws_ --port=$port --socks $opt
+}
+dry_run_nfqws()
+{
+	[ "$NFQWS_ENABLE" = 1 ] || return 0
+	local opt="$NFQWS_OPT" qn=${QNUM:-200}
+	filter_apply_hostlist_target opt
+	dry_run_nfqws_ --qnum=$qn $opt
+}

common/ipt.sh

@@ -1,5 +1,9 @@
 std_ports
-readonly ipt_connbytes="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes"
+ipt_connbytes="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes"
+IPSET_EXCLUDE="-m set ! --match-set nozapret"
+IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
+IPBAN_EXCLUDE="-m set ! --match-set ipban"
+IPBAN_EXCLUDE6="-m set ! --match-set ipban6"
 
 ipt()
 {
@@ -132,7 +136,7 @@ _fw_tpws4()
 
 		ipt_print_op $1 "$2" "tpws (port $3)"
 
-		rule="$2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3"
+		rule="$2 $IPSET_EXCLUDE dst $IPBAN_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3"
 		for i in $4 ; do
 			ipt_add_del $1 PREROUTING -t nat -i $i $rule
 	 	done
@@ -160,7 +164,7 @@ _fw_tpws6()
 
 		ipt_print_op $1 "$2" "tpws (port $3)" 6
 
-		rule="$2 $IPSET_EXCLUDE6 dst"
+		rule="$2 $IPSET_EXCLUDE6 dst $IPBAN_EXCLUDE6 dst"
 		for i in $4 ; do
 			_dnat6_target $i DNAT6
 			[ -n "$DNAT6" -a "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $i $rule -j DNAT --to [$DNAT6]:$3
@@ -349,27 +353,37 @@ ipt_do_nfqws_in_out()
 	}
 }
 
-zapret_do_firewall_standard_rules_ipt()
+zapret_do_firewall_standard_tpws_rules_ipt()
 {
 	# $1 - 1 - add, 0 - del
 
 	local f4 f6
 
-	[ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] &&
-	{
+	[ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] && {
 		f4="-p tcp -m multiport --dports $TPWS_PORTS_IPT"
 		f6=$f4
 		filter_apply_ipset_target f4 f6
 		fw_tpws $1 "$f4" "$f6" $TPPORT
 	}
-	[ "$NFQWS_ENABLE" = 1 ] &&
-	{
+}
+zapret_do_firewall_standard_nfqws_rules_ipt()
+{
+	# $1 - 1 - add, 0 - del
+
+	[ "$NFQWS_ENABLE" = 1 ] && {
 		ipt_do_nfqws_in_out $1 tcp "$NFQWS_PORTS_TCP_IPT" "$NFQWS_TCP_PKT_OUT" "$NFQWS_TCP_PKT_IN"
 		ipt_do_nfqws_in_out $1 tcp "$NFQWS_PORTS_TCP_KEEPALIVE_IPT" keepalive "$NFQWS_TCP_PKT_IN"
 		ipt_do_nfqws_in_out $1 udp "$NFQWS_PORTS_UDP_IPT" "$NFQWS_UDP_PKT_OUT" "$NFQWS_UDP_PKT_IN"
 		ipt_do_nfqws_in_out $1 udp "$NFQWS_PORTS_UDP_KEEPALIVE_IPT" keepalive "$NFQWS_UDP_PKT_IN"
 	}
 }
+zapret_do_firewall_standard_rules_ipt()
+{
+	# $1 - 1 - add, 0 - del
+
+	zapret_do_firewall_standard_tpws_rules_ipt $1
+	zapret_do_firewall_standard_nfqws_rules_ipt $1
+}
 
 zapret_do_firewall_rules_ipt()
 {

common/linux_daemons.sh

@@ -0,0 +1,55 @@
+standard_mode_tpws_socks()
+{
+	# $1 - 1 - run, 0 - stop
+	local opt
+	[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
+		opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT"
+		filter_apply_hostlist_target opt
+		do_tpws_socks $1 2 "$opt"
+	}
+}
+standard_mode_tpws()
+{
+	# $1 - 1 - run, 0 - stop
+	local opt
+	[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && {
+		opt="--port=$TPPORT $TPWS_OPT"
+		filter_apply_hostlist_target opt
+		do_tpws $1 1 "$opt"
+	}
+}
+standard_mode_nfqws()
+{
+	# $1 - 1 - run, 0 - stop
+	local opt
+	[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$NFQWS_OPT" && {
+		opt="--qnum=$QNUM $NFQWS_OPT"
+		filter_apply_hostlist_target opt
+		do_nfqws $1 3 "$opt"
+	}
+}
+standard_mode_daemons()
+{
+	# $1 - 1 - run, 0 - stop
+
+	standard_mode_tpws_socks $1
+	standard_mode_tpws $1
+	standard_mode_nfqws $1
+}
+zapret_do_daemons()
+{
+	# $1 - 1 - run, 0 - stop
+
+	standard_mode_daemons $1
+	custom_runner zapret_custom_daemons $1
+
+	return 0
+}
+zapret_run_daemons()
+{
+	zapret_do_daemons 1 "$@"
+}
+zapret_stop_daemons()
+{
+	zapret_do_daemons 0 "$@"
+}

common/linux_iphelper.sh

@@ -4,6 +4,8 @@
 # PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr
 # not a good idea to expose tpws to the world (bind to ::)
 
+# max wait time for the link local ipv6 on the LAN interface
+LINKLOCAL_WAIT_SEC=${LINKLOCAL_WAIT_SEC:-5}
 
 get_ipv6_linklocal()
 {

common/list.sh

@@ -1,5 +1,5 @@
-readonly HOSTLIST_MARKER="<HOSTLIST>"
-readonly HOSTLIST_NOAUTO_MARKER="<HOSTLIST_NOAUTO>"
+HOSTLIST_MARKER="<HOSTLIST>"
+HOSTLIST_NOAUTO_MARKER="<HOSTLIST_NOAUTO>"
 
 find_hostlists()
 {

common/nft.sh

@@ -1,5 +1,5 @@
 [ -n "$ZAPRET_NFT_TABLE" ] || ZAPRET_NFT_TABLE=zapret
-readonly nft_connbytes="ct original packets"
+nft_connbytes="ct original packets"
 
 # required for : nft -f -
 create_dev_stdin
@@ -263,28 +263,6 @@ nft_add_flow_offload_exemption()
 	[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || nft_add_rule flow_offload oifname @wanif6 $2 ip6 daddr != @nozapret6 return comment \"$3\"
 }
 
-nft_hw_offload_supported()
-{
-	# $1,$2,... - interface names
-	local devices res=1
-	make_quoted_comma_list devices "$@"
-	[ -n "$devices" ] && devices="devices={$devices};"
-	nft add table ${ZAPRET_NFT_TABLE}_test && nft add flowtable ${ZAPRET_NFT_TABLE}_test ft "{ flags offload; $devices }" 2>/dev/null && res=0
-	nft delete table ${ZAPRET_NFT_TABLE}_test 2>/dev/null
-	return $res
-}
-
-nft_hw_offload_find_supported()
-{
-	# $1,$2,... - interface names
-	local supported_list
-	while [ -n "$1" ]; do
-		nft_hw_offload_supported "$1" && append_separator_list supported_list ' ' '' "$1"
-		shift
-	done
-	echo $supported_list
-}
-
 nft_apply_flow_offloading()
 {
 	# ft can be absent
@@ -370,17 +348,15 @@ flush set inet $ZAPRET_NFT_TABLE lanif"
 			nft_create_or_update_flowtable 'offload' 2>/dev/null
 			# then add elements. some of them can cause error because unsupported
 			for i in $ALLDEVS; do
-				if nft_hw_offload_supported $i; then
-					nft_create_or_update_flowtable 'offload' $i
-				else
-					# bridge members must be added instead of the bridge itself
-					# some members may not support hw offload. example : lan1 lan2 lan3 support, wlan0 wlan1 - not
-					devs=$(resolve_lower_devices $i)
-					for j in $devs; do
-						# do not display error if addition failed
-						nft_create_or_update_flowtable 'offload' $j 2>/dev/null
-					done
-				fi
+				# first try to add interface itself
+				nft_create_or_update_flowtable 'offload' $i 2>/dev/null
+				# bridge members must be added instead of the bridge itself
+				# some members may not support hw offload. example : lan1 lan2 lan3 support, wlan0 wlan1 - not
+				devs=$(resolve_lower_devices $i)
+				for j in $devs; do
+					# do not display error if addition failed
+					nft_create_or_update_flowtable 'offload' $j 2>/dev/null
+				done
 			done
 			;;
 	esac
@@ -411,8 +387,8 @@ _nft_fw_tpws4()
 	[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || {
 		local filter="$1" port="$2"
 		nft_print_op "$filter" "tpws (port $2)" 4
-		nft_insert_rule dnat_output skuid != $WS_USER ${3:+oifname @wanif }$filter ip daddr != @nozapret $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
-		nft_insert_rule dnat_pre iifname @lanif $filter ip daddr != @nozapret $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
+		nft_insert_rule dnat_output skuid != $WS_USER ${3:+oifname @wanif }$filter ip daddr != @nozapret ip daddr != @ipban $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
+		nft_insert_rule dnat_pre iifname @lanif $filter ip daddr != @nozapret ip daddr != @ipban $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
 		prepare_route_localnet
 	}
 }
@@ -426,9 +402,9 @@ _nft_fw_tpws6()
 	[ "$DISABLE_IPV6" = "1" -o -z "$1" ] || {
 		local filter="$1" port="$2" DNAT6 i
 		nft_print_op "$filter" "tpws (port $port)" 6
-		nft_insert_rule dnat_output skuid != $WS_USER ${4:+oifname @wanif6 }$filter ip6 daddr != @nozapret6 $FW_EXTRA_POST dnat ip6 to [::1]:$port
+		nft_insert_rule dnat_output skuid != $WS_USER ${4:+oifname @wanif6 }$filter ip6 daddr != @nozapret6 ip6 daddr != @ipban6 $FW_EXTRA_POST dnat ip6 to [::1]:$port
 		[ -n "$3" ] && {
-			nft_insert_rule dnat_pre $filter ip6 daddr != @nozapret6 $FW_EXTRA_POST dnat ip6 to iifname map @link_local:$port
+			nft_insert_rule dnat_pre $filter ip6 daddr != @nozapret6 ip6 daddr != @ipban6 $FW_EXTRA_POST dnat ip6 to iifname map @link_local:$port
 			for i in $3; do
 				_dnat6_target $i DNAT6
 				# can be multiple tpws processes on different ports
@@ -640,25 +616,31 @@ nft_apply_nfqws_in_out()
 	}
 }
 
-zapret_apply_firewall_standard_rules_nft()
+zapret_apply_firewall_standard_tpws_rules_nft()
 {
 	local f4 f6
 
-	[ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] &&
-	{
+	[ "$TPWS_ENABLE" = 1 -a -n "$TPWS_PORTS" ] && {
 		f4="tcp dport {$TPWS_PORTS}"
 		f6=$f4
 		nft_filter_apply_ipset_target f4 f6
 		nft_fw_tpws "$f4" "$f6" $TPPORT
 	}
-	[ "$NFQWS_ENABLE" = 1 ] &&
-	{
+}
+zapret_apply_firewall_standard_nfqws_rules_nft()
+{
+	[ "$NFQWS_ENABLE" = 1 ] && {
 		nft_apply_nfqws_in_out tcp "$NFQWS_PORTS_TCP" "$NFQWS_TCP_PKT_OUT" "$NFQWS_TCP_PKT_IN"
 		nft_apply_nfqws_in_out tcp "$NFQWS_PORTS_TCP_KEEPALIVE" keepalive "$NFQWS_TCP_PKT_IN"
 		nft_apply_nfqws_in_out udp "$NFQWS_PORTS_UDP" "$NFQWS_UDP_PKT_OUT" "$NFQWS_UDP_PKT_IN"
 		nft_apply_nfqws_in_out udp "$NFQWS_PORTS_UDP_KEEPALIVE" keepalive "$NFQWS_UDP_PKT_IN"
 	}
 }
+zapret_apply_firewall_standard_rules_nft()
+{
+	zapret_apply_firewall_standard_tpws_rules_nft
+	zapret_apply_firewall_standard_nfqws_rules_nft
+}
 
 zapret_apply_firewall_rules_nft()
 {

config.default

@@ -97,7 +97,7 @@ NFQWS_OPT="
 # none,ipset,hostlist,autohostlist
 MODE_FILTER=none
 
-# openwrt only : donttouch,none,software,hardware
+# donttouch,none,software,hardware
 FLOWOFFLOAD=donttouch
 
 # openwrt: specify networks to be treated as LAN. default is "lan"

docs/changes.txt

@@ -410,5 +410,74 @@ repo: sha256sum
 
 v69.4
 
-nfqws : fakedsplit/fakeddisorder fakes for both split segments
-nfqws : --dpi-desync-fakedsplit-pattern
+nfqws: fakedsplit/fakeddisorder fakes for both split segments
+nfqws: --dpi-desync-fakedsplit-pattern
+
+v69.5
+
+nfqws,tpws: --dry-run
+install_easy: check tpws and nfqws options validity
+
+v69.6
+
+nfqws: set NETLINK_NO_ENOBUFS to fix possible nfq recv errors
+init.d: unify custom scripts for linux
+init.d: new custom scripts : 20-fw-extra, 50-wg4all
+
+v69.7
+
+nfqws,tpws: --comment
+nfqws: trash flood warning
+winws: exclude empty outgoing ack packets in windivert filter
+
+v69.8
+
+winws: accept empty outgoing RST and FIN packets for conntrack needs
+repo: lexra build
+
+v69.9
+
+init.d: exclude ipban from tpws redirection
+macos: fix install_easy
+macos: fix national decimal separator in sleep
+ipset: scripts maintenance
+
+v70
+
+blockcheck: override all dialog questions and enable batch mode
+blockcheck: parallel attempts
+nfqws: weaken wireguard initiation recognition. use len=148 and data[0]=1 signature
+nfqws: apply split+seqovl only to the first reasm fragment
+install_easy: dnf packager support
+nfqws,tpws: hostlist/ipset track not only file mod time but also file size
+nfqws,tpws,ipset: return lists reload on HUP
+nfqws,blockcheck: --dpi-desync-fake-tls-mod
+
+v70.1
+
+nfqws: --dpi-desync-fake-tls-mod=dupsid
+nfqws,tpws: test accessibility of list files after privs drop
+nfqws,tpws: --version
+
+v70.4
+
+nfqws,tpws: ^ prefix in hostlist to disable subdomain matches
+nfqws,tpws: optional systemd notify support. compile using 'make systemd'
+nfqws,tpws: systemd instance templates for nfqws and tpws
+nfqws,tpws: separate droproot from dropcaps
+tpws: detect WSL 1 and warn about non-working options
+
+v70.5
+
+nfqws: multiple --dpi-desync-fake-xxx
+nfqws: support of inter-packet fragmented QUIC CRYPTO
+
+v70.6
+
+nfqws: detect Discord Voice IP discovery packets
+nfqws: detect STUN message packets
+nfqws: change SNI to specified value tls mod : --dpi-desync-fake-tls-mod sni=<sni>
+nfqws: update default TLS ClientHello fake. firefox 136.0.4 finger, no kyber, SNI=microsoft.com
+nfqws: multiple mods for multiple TLS fakes
+init.d: remove 50-discord
+blockcheck: use tpws --fix-seg on linux for multiple splits

docs/compile/build_howto_openwrt.txt

@@ -12,10 +12,10 @@ Other packages may be required on your distribution. Look for the errors.
 
 examples :
 
-curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxvf -
+curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxv
 cd openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64
 
-curl -o - https://downloads.openwrt.org/snapshots/targets/x86/64/openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64.tar.zst | tar --zstd -xvf -
+curl -o - https://downloads.openwrt.org/snapshots/targets/x86/64/openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64.tar.zst | tar --zstd -xv
 cd openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64
 
 3) Install required libs
@@ -48,7 +48,7 @@ static build :  make CFLAGS=-static package/{tpws,nfqws,mdig,ip2net}/compile
 executables only : build_dir/target/<progname>
 ipk or apk packages : bin/packages/*/base
 
-8) Installating to openwrt to use with zapret
+8) Installing to openwrt to use with zapret
 
 zapret with or without binaries should be already installed in /opt/zapret.
 Install ipk's or apk's with all compiled progs using opkg or apk.

docs/compile/build_howto_unix.txt

@@ -1,7 +1,7 @@
 debian,ubuntu :
 
-apt install make gcc zlib1g-dev libcap-dev libnetfilter-queue-dev
-make -C /opt/zapret
+apt install make gcc zlib1g-dev libcap-dev libnetfilter-queue-dev libsystemd-dev
+make -C /opt/zapret systemd
 
 FreeBSD :
 

docs/quick_start.md

@@ -2,8 +2,8 @@
 
 > [!CAUTION]  
 > Не пишите в issue вопросы типа "как скопировать файл", "как скачать", "как
-> запустить", ... То есть все , что касается базовых навыков обращения с ОС
-> linux. Эти вопросы будут закрывать сразу. Если у вас подобные вопросы
+> запустить" и т.п. То есть все, что касается базовых навыков обращения с ОС
+> Linux. Эти вопросы будут закрывать сразу. Если у вас подобные вопросы
 > возникают, рекомендую не использовать данный софт или искать помощь где-то в
 > другом месте. То же самое могу сказать тем, кто хочет нажать 1 кнопку, чтобы
 > все заработало, и совсем не хочет читать и изучать. Увы, такое не подвезли и
@@ -89,14 +89,15 @@
    >
    > Проверить работает ли этот вариант можно так:
    > ```sh
-   > $ dig -p 53 @77.88.8.88 rutracker.org dig -p 1253 @77.88.8.88 rutracker.org
+   > $ dig -p 53 @77.88.8.88 rutracker.org
+   > $ dig -p 1253 @77.88.8.88 rutracker.org
    > ```
    >
    > Если DNS действительно подменяется, и ответ на эти 2 команды разный,
    > значит метод вероятно работает.
    >
    > В openwrt DNS на нестандартном порту можно прописать в `/etc/config/dhcp`
-   > таким способом :
+   > таким способом:
    >
    > ```
    > config dnsmasq
@@ -158,12 +159,12 @@
    >
    > Далее, имея понимание что работает на http, https, quic нужно
    > сконструировать параметры запуска `tpws` и/или `nfqws` с использованием
-   > мультистратегии. Как работают мультистратегии описано в readme.txt.
+   > мультистратегии. Как работают мультистратегии описано в [readme.md](./readme.md#множественные-стратегии).
    >
    > Если кратко, то обычно параметры конструируются так:
    > ```sh
    > "--filter-udp=443 'параметры для quic' <HOSTLIST_NOAUTO> --new
-   > --filter-tcp=80,443 'обьединенные параметры для http и https' <HOSTLIST>"
+   > --filter-tcp=80,443 'объединенные параметры для http и https' <HOSTLIST>"
    > ```
    >
    > Или так:
@@ -193,7 +194,7 @@
    > "--filter-l3=ipv4 --filter-udp=443 lпараметры для quic ipv4' <HOSTLIST_NOAUTO> --new
    > --filter-l3=ipv4 --filter-tcp=80 'параметры для http ipv4' <HOSTLIST> --new
    > --filter-l3=ipv4 --filter-tcp=443 'параметры для https ipv4' <HOSTLIST> --new
-   > --filter-l3=ipv6 --filter-udp=443 "параметры для quic ipv6" <HOSTLIST_NOAUTO> --new
+   > --filter-l3=ipv6 --filter-udp=443 'параметры для quic ipv6' <HOSTLIST_NOAUTO> --new
    > --filter-l3=ipv6 --filter-tcp=80 'параметры для http ipv6' <HOSTLIST> --new
    > --filter-l3=ipv6 --filter-tcp=443 'параметры для https ipv6' <HOSTLIST>"
    > ```

docs/quick_start_windows.md

@@ -59,7 +59,7 @@ _"Совсем ничего не могу, все очень сложно, да
 
 1) Скачайте и распакуйте архив https://github.com/bol-van/zapret-win-bundle/archive/refs/heads/master.zip.
 
-2) Если у вас Windows 7 x64, читайте [docs/windows.md](./windows.md). Без описанной там подготовки может не работать.
+2) Если у вас Windows 7 x64, однократно запустите `win7/install_win7.cmd`. Батник заменит файлы windivert на совместимую с Windows 7 версию.
 
 > [!WARNING]  
 > Для 32-битных систем Windows нет готового полного варианта.
@@ -123,7 +123,7 @@ blockcheck перейдет в этом случае на **DoH** _(DNS over HTT
    > она стабильна, на третьих полный хаос, и проще отказаться.
    >
    > Далее, имея понимание что работает на http, https, quic, нужно сконструировать параметры запуска winws
-   > с использованием мультистратегии. Как работают мультистратегии описано в [readme.md](./readme.md).
+   > с использованием мультистратегии. Как работают мультистратегии описано в [readme.md](./readme.md#множественные-стратегии).
    >
    > Прежде всего вам нужно собрать фильтр перехватываемого трафика. Это делается через параметры
    > `--wf-l3`, `--wf-tcp`, `--wf-udp`.

docs/readme.en.md

@@ -1,4 +1,4 @@
-# zapret v69.4
+# zapret v70.6
 
 # SCAMMER WARNING
 
@@ -19,6 +19,7 @@ ___
 - [nfqws](#nfqws)
   - [DPI desync attack](#dpi-desync-attack)
   - [Fakes](#fakes)
+  - [Fake mods](#fake-mods)
   - [TCP segmentation](#tcp-segmentation)
   - [Sequence numbers overlap](#sequence-numbers-overlap)
   - [ipv6 specific modes](#ipv6-specific-modes)
@@ -119,7 +120,7 @@ You need to run them with the necessary parameters and redirect certain traffic
 when blocked domains are queried. If this is the case change DNS to public ones, such as 8.8.8.8 or 1.1.1.1.Sometimes ISP hijacks queries to any DNS server. Dnscrypt or dns-over-tls help.
 * If blocking is done by IP.
 * If a connection passes through a filter capable of reconstructing a TCP connection, and which
-follows all standards. For example, we are routed to squid. Connection goes through the full OS tcpip stack, fragmentation disappears immediately as a means of circumvention. Squid is correct, it will find everything as it should, it is useless to deceive him. BUT. Only small providers can afford using squid, since it is very resource intensive. Large companies usually use DPI, which is designed for much greater bandwidth.
+follows all standards. For example, we are routed to squid. Connection goes through the full OS tcpip stack. This project targets DPI only, not full OS stack and not server applications.
 
 ## nfqws
 
@@ -131,6 +132,9 @@ nfqws takes the following parameters:
  @<config_file>					; read file for options. must be the only argument. other options are ignored.
 
  --debug=0|1
+ --dry-run                                      ; verify parameters and exit with code 0 if successful
+ --version                                      ; print version and exit
+ --comment                                      ; any text (ignored)
  --qnum=<nfqueue_number>
  --daemon                                       ; daemonize
  --pidfile=<filename>                           ; write pid to file
@@ -170,31 +174,34 @@ nfqws takes the following parameters:
  --dpi-desync-any-protocol=0|1                  ; 0(default)=desync only http and tls  1=desync any nonempty data packet
  --dpi-desync-fake-http=<filename>|0xHEX        ; file containing fake http request
  --dpi-desync-fake-tls=<filename>|0xHEX         ; file containing fake TLS ClientHello (for https)
+ --dpi-desync-fake-tls-mod=mod[,mod]            ; comma separated list of TLS fake mods. available mods : none,rnd,rndsni,sni=<sni>,dupsid,padencap
  --dpi-desync-fake-unknown=<filename>|0xHEX     ; file containing unknown protocol fake payload
  --dpi-desync-fake-syndata=<filename>|0xHEX     ; file containing SYN data payload
  --dpi-desync-fake-quic=<filename>|0xHEX        ; file containing fake QUIC Initial
  --dpi-desync-fake-wireguard=<filename>|0xHEX   ; file containing fake wireguard handshake initiation
  --dpi-desync-fake-dht=<filename>|0xHEX         ; file containing fake DHT (d1..e)
+ --dpi-desync-fake-discord=<filename>|0xHEX     ; file containing fake Discord voice connection initiation packet (IP Discovery)
+ --dpi-desync-fake-stun=<filename>|0xHEX        ; file containing fake STUN message
  --dpi-desync-fake-unknown-udp=<filename>|0xHEX ; file containing unknown udp protocol fake payload
  --dpi-desync-udplen-increment=<int>            ; increase or decrease udp packet length by N bytes (default 2). negative values decrease length.
  --dpi-desync-udplen-pattern=<filename>|0xHEX   ; udp tail fill pattern
  --dpi-desync-start=[n|d|s]N                    ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) greater or equal than N
  --dpi-desync-cutoff=[n|d|s]N                   ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) less than N
- --hostlist=<filename>                          ; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist=<filename>                          ; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply if not prefixed with `^`, gzip supported, multiple hostlists allowed)
  --hostlist-domains=<domain_list>               ; comma separated fixed domain list
- --hostlist-exclude=<filename>                  ; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-exclude=<filename>                  ; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply if not prefixed with `^`, gzip supported, multiple hostlists allowed)
  --hostlist-exclude-domains=<domain_list>       ; comma separated fixed domain list
  --hostlist-auto=<filename>                     ; detect DPI blocks and build hostlist automatically
  --hostlist-auto-fail-threshold=<int>           ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
  --hostlist-auto-fail-time=<int>                ; all failed attemps must be within these seconds (default : 60)
  --hostlist-auto-retrans-threshold=<int>        ; how many request retransmissions cause attempt to fail (default : 3)
- --hostlist-auto-debug=<logfile>        	; debug auto hostlist positives
+ --hostlist-auto-debug=<logfile>                ; debug auto hostlist positives
  --new                                          ; begin new strategy (new profile)
  --skip                                         ; do not use this profile
  --filter-l3=ipv4|ipv6                          ; L3 protocol filter. multiple comma separated values allowed.
  --filter-tcp=[~]port1[-port2]|*                ; TCP port filter. ~ means negation. setting tcp and not setting udp filter denies udp. comma separated list supported.
  --filter-udp=[~]port1[-port2]|*                ; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list supported.
- --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.
+ --filter-l7=<proto>                            ; L6-L7 protocol filter. multiple comma separated values allowed. proto: http tls quic wireguard dht discord stun unknown
  --ipset=<filename>                             ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
  --ipset-ip=<ip_list>                           ; comma separated fixed subnet list
  --ipset-exclude=<filename>                     ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
@@ -214,7 +221,9 @@ There're attacks based on TCP sequence numbers. Methods can be combined in many
 
 Fakes are separate generated by nfqws packets carrying false information for DPI. They must either not reach the server or be rejected by it. Otherwise TCP connection or data stream would be broken. There're multiple ways to solve this task.
 
-* **md5sig** does not work on all servers
+* **md5sig** does not work on all servers. It typically works only on Linux servers. MD5 tcp option requires additional space in TCP header
+  and can cause MTU overflow during fakedsplit/fakeddisorder on low positions when multisegment query (TLS kyber) is transmitted.
+  `nfqws` cannot redistribute data between original TCP segments. The error displayed is 'message too long'.
 * **badsum** doesn't work if your device is behind NAT which does not pass invalid packets.
   The most common Linux NAT router configuration does not pass them. Most home routers are Linux based.
   The default sysctl configuration `net.netfilter.nf_conntrack_checksum=1` causes contrack to verify tcp and udp checksums
@@ -259,6 +268,37 @@ Fakes are separate generated by nfqws packets carrying false information for DPI
 `--dpi-desync-fooling` takes multiple comma separated values.
 
 
+Multiple parameters `--dpi-desync-fake-???` are supported except for the `--dpi-desync-fake-syndata`.
+Fakes are sent in the specified order. `--dpi-desync-repeats` resends each fake.
+Resulting order would be : `fake1 fake1 fake1 fake2 fake2 fake2 fake3 fake3 fake3 .....`
+
+
+### FAKE mods
+
+**nfqws** has built-in TLS fake. It can be customized with `--dpi-desync-fake-tls` option.
+Customized fake data can be anything - valid TLS Client Hello or arbitrary data.
+It's possible to use TLS Client Hello with any fingerprint and any SNI.
+
+**nfqws** can do some modifications of valid TLS Client Hello fakes in runtime with `--dpi-desync-fake-tls-mod` option.
+
+ * `none`. Do not do any mods.
+ * `rnd`. Randomize `random` and `session id` fields. Applied on every request.
+ * `rndsni`. Randomize SNI. If SNI >=7 symbols random SLD is applied with known TLD. Otherwise filled with random symbols. Applied only once at startup.
+ * `dupsid`. Copy `session ID` from original TLS Client Hello. Takes precedence over `rnd`. Applied on every request.
+ * `sni=<sni>`. Set specified SNI value. Changes TLS fake length, fixes lengths in TLS structure. Applied once at startup before `rndsni`.
+ * `padencap`. Padding extension is extended by original TLS Client Hello size (including multi packet variation with kyber). Padding extension is added to the end if not present, otherwise it must be the last extension. All lengths are increased. Fake size is not changed. Can be useful if DPI does not analyze sequence numbers properly. Applied on every request.
+
+By default if custom fake is not defined `rnd,rndsni,dupsid` mods are applied. If defined - `none`.
+This behaviour is compatible with previous versions with addition of `dupsid`.
+
+If multiple TLS fakes are present each one takes the last mod.
+If a mod is specified after fake it replaces previous mod.
+This way it's possible to use different mods for every TLS fake.
+
+If a mod is set to non-TLS fake it causes error. Use `--dpi-desync-fake-tls-mod=none'.
+
+Example : `--dpi-desync-fake-tls=iana_org.bin --dpi-desync-fake-tls-mod=rndsni --dpi-desync-fake-tls=0xaabbccdd --dpi-desync-fake-tls-mod=none'
+
 ### TCP segmentation
 
  * `multisplit`. split request at specified in `--dpi-desync-split-pos` positions
@@ -441,7 +481,7 @@ This option can resist DPIs that track outgoing UDP packet sizes.
 Requires that application protocol does not depend on udp payload size.
 
 QUIC initial packets are recognized. Decryption and hostname extraction is supported so `--hostlist` parameter will work.
-Wireguard handshake initiation and DHT packets are also recognized.
+Wireguard handshake initiation, DHT, STUN and [Discord Voice IP Discovery](https://discord.com/developers/docs/topics/voice-connections#ip-discovery) packets are also recognized.
 For other protocols desync use `--dpi-desync-any-protocol`.
 
 Conntrack supports udp. `--dpi-desync-cutoff` will work. UDP conntrack timeout can be set in the 4th parameter of `--ctrack-timeouts`.
@@ -639,6 +679,8 @@ tpws is transparent proxy.
 
  --debug=0|1|2|syslog|@<filename>        ; 1 and 2 means log to console and set debug level. for other targets use --debug-level.
  --debug-level=0|1|2                     ; specify debug level for syslog and @<filename>
+ --dry-run                               ; verify parameters and exit with code 0 if successful
+ --version                                      ; print version and exit
  --bind-addr=<v4_addr>|<v6_addr>         ; for v6 link locals append %interface_name : fe80::1%br-lan
  --bind-iface4=<interface_name>          ; bind to the first ipv4 addr of interface
  --bind-iface6=<interface_name>          ; bind to the first ipv6 addr of interface
@@ -680,9 +722,9 @@ tpws is transparent proxy.
  --ipset-exclude=<filename>              ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
  --ipset-exclude-ip=<ip_list>            ; comma separated fixed subnet list
 
- --hostlist=<filename>                   ; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist=<filename>                   ; only act on hosts in the list (one host per line, subdomains auto apply if not prefixed with '^', gzip supported, multiple hostlists allowed)
  --hostlist-domains=<domain_list>        ; comma separated fixed domain list
- --hostlist-exclude=<filename>           ; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-exclude=<filename>           ; do not act on hosts in the list (one host per line, subdomains auto apply if not prefixed with '^', gzip supported, multiple hostlists allowed)
  --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list
  --hostlist-auto=<filename>              ; detect DPI blocks and build hostlist automatically
  --hostlist-auto-fail-threshold=<int>    ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
@@ -961,8 +1003,10 @@ If all include lists are empty it works like no include lists exist at all.
 If you need "all except" mode you dont have to delete zapret-hosts-users.txt. Just make it empty.
 
 Subdomains auto apply. For example, "ru" in the list affects "*.ru" .
+`^` prefix symbol disables subdomain match.
 
-**tpws** and **nfqws** automatically reload lists if their modification date is changed.
+**tpws** and **nfqws** automatically reload lists if their modification time or file size is changed.
+HUP signal forcibly reloads all lists.
 
 When filtering by domain name, daemons should run without filtering by ipset.
 When using large regulator lists estimate the amount of RAM on the router !
@@ -1407,12 +1451,8 @@ If this is the case then run another script in background and add some delay the
 
 Are welcome here :
 
-<img src=https://cdn-icons-png.flaticon.com/16/14446/14446252.png alt="USDT" style="vertical-align: middle;"/> USDT
-```
-0x3d52Ce15B7Be734c53fc9526ECbAB8267b63d66E
-```
+USDT `0x3d52Ce15B7Be734c53fc9526ECbAB8267b63d66E`
 
-<img src=https://cdn-icons-png.flaticon.com/16/5968/5968260.png  alt="USDT" style="vertical-align: middle;"/> BTC
-```
-bc1qhqew3mrvp47uk2vevt5sctp7p2x9m7m5kkchve
-```
+BTC  `bc1qhqew3mrvp47uk2vevt5sctp7p2x9m7m5kkchve`
+
+ETH  `0x3d52Ce15B7Be734c53fc9526ECbAB8267b63d66E`

docs/windows.en.md

@@ -101,10 +101,11 @@ There are several options :
 Replace these 2 files in every location they are present.
 In `zapret-win-bundle` they are in `zapret-winws` и `blockcheck/zapret/nfq` folders.
 However this option still requires 10+ year old patch that enables SHA256 signatures.
+If you're using win bundle you can simply run `win7\install_win7.cmd`
 
-2. [Hack ESU](https://hackandpwn.com/windows-7-esu-patching)
+3. [Hack ESU](https://hackandpwn.com/windows-7-esu-patching)
 
-3. Use `UpdatePack7R2` from simplix : https://blog.simplix.info
+4. Use `UpdatePack7R2` from simplix : https://blog.simplix.info
 If you are in Russia or Belarus temporary change region in Control Panel.
 
 ### blockcheck

docs/windows.md

@@ -159,6 +159,7 @@ _windivert 2.2.2-A_, который идет в поставке zapret.
 и заменить эти 2 файла.
 В [zapret-win-bundle](https://github.com/bol-van/zapret-win-bundle) есть отдельных 2 места, где находится **winws** : [_zapret-winws_](https://github.com/bol-van/zapret-win-bundle/tree/master/zapret-winws) и [_blockcheck/zapret/nfq_](https://github.com/bol-van/zapret-win-bundle/tree/master/blockcheck).
 Надо менять в обоих местах.
+Альтернативный вариант при использовании win bundle - запустить `win7\install_win7.cmd`
 
 > [!NOTE]
 > Этот вариант проверен и должен работать. Тем не менее патч 10 летней давности, который включает SHA256 сигнатуры, все еще необходим.

init.d/custom.d.examples.linux/20-fw-extra

@@ -0,0 +1,66 @@
+# this custom script runs standard mode with extra firewall rules
+
+# config: use TPWS_ENABLE_OVERRIDE, NFQWS_ENABLE_OVERRIDE to enable standard mode daemons
+# standard and override switches cannot be enabled simultaneously !
+
+TPWS_ENABLE_OVERRIDE=${TPWS_ENABLE_OVERRIDE:-0}
+NFQWS_ENABLE_OVERRIDE=${NFQWS_ENABLE_OVERRIDE:-0}
+
+# config: some if these values must be set in config. not setting any of these makes this script meaningless.
+# pre vars put ipt/nft code to the rule beginning
+#FW_EXTRA_PRE_TPWS_IPT=
+#FW_EXTRA_PRE_TPWS_NFT=
+#FW_EXTRA_PRE_NFQWS_IPT="-m mark --mark 0x10000000/0x10000000"
+#FW_EXTRA_PRE_NFQWS_NFT="mark and 0x10000000 != 0"
+# post vars put ipt/nft code to the rule end
+#FW_EXTRA_POST_TPWS_IPT=
+#FW_EXTRA_POST_TPWS_NFT=
+#FW_EXTRA_POST_NFQWS_IPT=
+#FW_EXTRA_POST_NFQWS_NFT=
+
+check_std_intersect()
+{
+	[ "$TPWS_ENABLE_OVERRIDE" = 1 -a "$TPWS_ENABLE" = 1 ] && {
+		echo "ERROR ! both TPWS_ENABLE_OVERRIDE and TPWS_ENABLE are enabled"
+		return 1
+	}
+	[ "$NFQWS_ENABLE_OVERRIDE" = 1 -a "$NFQWS_ENABLE" = 1 ] && {
+		echo "ERROR ! both NFQWS_ENABLE_OVERRIDE and NFQWS_ENABLE are enabled"
+		return 1
+	}
+	return 0
+}
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - add, 0 - stop
+
+	check_std_intersect || return
+
+	local TPWS_SOCKS_ENABLE=0 TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE
+	standard_mode_daemons "$1"
+}
+zapret_custom_firewall()
+{
+        # $1 - 1 - run, 0 - stop
+
+	check_std_intersect || return
+
+	local FW_EXTRA_PRE FW_EXTRA_POST TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE
+	FW_EXTRA_PRE="$FW_EXTRA_PRE_TPWS_IPT" FW_EXTRA_POST="$FW_EXTRA_POST_TPWS_IPT"
+	zapret_do_firewall_standard_tpws_rules_ipt $1
+	FW_EXTRA_PRE="$FW_EXTRA_PRE_NFQWS_IPT" FW_EXTRA_POST="$FW_EXTRA_POST_NFQWS_IPT"
+	zapret_do_firewall_standard_nfqws_rules_ipt $1
+}
+zapret_custom_firewall_nft()
+{
+        # stop logic is not required
+
+	check_std_intersect || return
+
+	local FW_EXTRA_PRE FW_EXTRA_POST TPWS_ENABLE=$TPWS_ENABLE_OVERRIDE NFQWS_ENABLE=$NFQWS_ENABLE_OVERRIDE
+	FW_EXTRA_PRE="$FW_EXTRA_PRE_TPWS_NFT" FW_EXTRA_POST="$FW_EXTRA_POST_TPWS_NFT"
+	zapret_apply_firewall_standard_tpws_rules_nft
+	FW_EXTRA_PRE="$FW_EXTRA_PRE_NFQWS_NFT" FW_EXTRA_POST="$FW_EXTRA_POST_NFQWS_NFT"
+	zapret_apply_firewall_standard_nfqws_rules_nft
+}

init.d/custom.d.examples.linux/50-dht4all

@@ -8,9 +8,9 @@ alloc_qnum QNUM_DHT4ALL
 
 zapret_custom_daemons()
 {
-        # stop logic is managed by procd
+	# $1 - 1 - add, 0 - stop
 
-        local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
+        local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_DESYNC_DHT"
 	do_nfqws $1 $DNUM_DHT4ALL "$opt"
 }
 zapret_custom_firewall()

init.d/custom.d.examples.linux/50-nfqws-ipset

@@ -0,0 +1,74 @@
+# this custom script demonstrates how to launch extra nfqws instance limited by ipset. ipv4 only.
+
+# can override in config :
+NFQWS_OPT_DESYNC_NFQWS_MY1="${NFQWS_OPT_DESYNC_NFQWS_MY1:---dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol}"
+NFQWS_MY1_PORTS=${NFQWS_MY1_PORTS:-6000-6009}
+NFQWS_MY1_SUBNETS="${NFQWS_MY1_SUBNETS:-34.0.48.0/21 34.0.56.0/23 34.0.59.0/24 34.0.60.0/24 34.0.62.0/23}"
+
+alloc_dnum DNUM_NFQWS_MY1
+alloc_qnum QNUM_NFQWS_MY1
+NFQWS_MY1_SET_NAME=my1nfqws4
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - run, 0 - stop
+
+	local opt="--qnum=$QNUM_NFQWS_MY1 $NFQWS_OPT_DESYNC_NFQWS_MY1"
+	do_nfqws $1 $DNUM_NFQWS_MY1 "$opt"
+}
+
+zapret_custom_firewall()
+{
+	# $1 - 1 - run, 0 - stop
+
+	local f
+	local first_packets_only="$ipt_connbytes 1:3"
+	local NFQWS_MY1_PORTS_IPT=$(replace_char - : $NFQWS_MY1_PORTS)
+	local dest_set="-m set --match-set $NFQWS_MY1_SET_NAME dst"
+	local subnet
+
+	local DISABLE_IPV6=1
+
+	[ "$1" = 1 ] && {
+		ipset create $NFQWS_MY1_SET_NAME hash:net hashsize 8192 maxelem 4096 2>/dev/null
+		ipset flush $NFQWS_MY1_SET_NAME
+		for subnet in $NFQWS_MY1_SUBNETS; do
+			echo add $NFQWS_MY1_SET_NAME $subnet
+		done | ipset -! restore
+	}
+
+	f="-p udp -m multiport --dports $NFQWS_MY1_PORTS_IPT"
+	fw_nfqws_post $1 "$f $first_packets_only $dest_set" "" $QNUM_NFQWS_MY1
+
+	[ "$1" = 1 ] || {
+		ipset destroy $NFQWS_MY1_SET_NAME 2>/dev/null
+	}
+}
+
+zapret_custom_firewall_nft()
+{
+	# stop logic is not required
+
+	local f
+	local first_packets_only="$nft_connbytes 1-3"
+	local dest_set="ip daddr @$NFQWS_MY1_SET_NAME"
+	local subnets
+
+	local DISABLE_IPV6=1
+
+	make_comma_list subnets $NFQWS_MY1_SUBNETS
+	nft_create_set $NFQWS_MY1_SET_NAME "type ipv4_addr; size 4096; auto-merge; flags interval;"
+	nft_flush_set $NFQWS_MY1_SET_NAME
+	nft_add_set_element $NFQWS_MY1_SET_NAME "$subnets"
+
+	f="udp dport {$NFQWS_MY1_PORTS}"
+	nft_fw_nfqws_post "$f $first_packets_only $dest_set" "" $QNUM_NFQWS_MY1
+}
+
+zapret_custom_firewall_nft_flush()
+{
+	# this function is called after all nft fw rules are deleted
+	# however sets are not deleted. it's desired to clear sets here.
+
+	nft_del_set $NFQWS_MY1_SET_NAME 2>/dev/null
+}

init.d/custom.d.examples.linux/50-tpws-ipset

@@ -0,0 +1,89 @@
+# this custom script demonstrates how to launch extra tpws instance limited by ipset
+
+# can override in config :
+TPWS_MY1_OPT="${TPWS_MY1_OPT:---oob --split-pos=midsld}"
+TPWS_MY1_PORTS=${TPWS_MY1_PORTS:-$TPWS_PORTS}
+TPWS_MY1_SUBNETS4="${TPWS_MY1_SUBNETS4:-142.250.0.0/15 64.233.160.0/19 172.217.0.0/16 173.194.0.0/16 108.177.0.0/17 74.125.0.0/16 209.85.128.0/17 216.58.192.0/19}"
+TPWS_MY1_SUBNETS6="${TPWS_MY1_SUBNETS6:-2607:F8B0::/32 2a00:1450:4000::/37}"
+
+TPWS_MY1_IPSET_SIZE=${TPWS_MY1_IPSET_SIZE:-4096}
+TPWS_MY1_IPSET_OPT="${TPWS_MY1_IPSET_OPT:-hash:net hashsize 8192 maxelem $TPWS_MY1_IPSET_SIZE}"
+
+alloc_dnum DNUM_TPWS_MY1
+alloc_tpws_port PORT_TPWS_MY1
+TPWS_MY1_NAME4=my1tpws4
+TPWS_MY1_NAME6=my1tpws6
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - run, 0 - stop
+
+	local opt="--port=$PORT_TPWS_MY1 $TPWS_MY1_OPT"
+	do_tpws $1 $DNUM_TPWS_MY1 "$opt"
+}
+
+zapret_custom_firewall()
+{
+	# $1 - 1 - run, 0 - stop
+
+	local f4 f6 subnet
+	local PORTS_IPT=$(replace_char - : $TPWS_MY1_PORTS)
+	local dest_set="-m set --match-set $TPWS_MY1_NAME4 dst"
+
+	[ "$1" = 1 -a "$DISABLE_IPV4" != 1 ] && {
+		ipset create $TPWS_MY1_NAME4 $TPWS_MY1_IPSET_OPT family inet 2>/dev/null
+		ipset flush $TPWS_MY1_NAME4
+		for subnet in $TPWS_MY1_SUBNETS4; do
+			echo add $TPWS_MY1_NAME4 $subnet
+		done | ipset -! restore
+	}
+	[ "$1" = 1 -a "$DISABLE_IPV6" != 1 ] && {
+		ipset create $TPWS_MY1_NAME6 $TPWS_MY1_IPSET_OPT family inet6 2>/dev/null
+		ipset flush $TPWS_MY1_NAME6
+		for subnet in $TPWS_MY1_SUBNETS6; do
+			echo add $TPWS_MY1_NAME6 $subnet
+		done | ipset -! restore
+	}
+
+	f4="-p tcp -m multiport --dports $PORTS_IPT -m set --match-set"
+	f6="$f4 $TPWS_MY1_NAME6 dst"
+	f4="$f4 $TPWS_MY1_NAME4 dst"
+	fw_tpws $1 "$f4" "$f6" $PORT_TPWS_MY1
+
+	[ "$1" = 1 ] || {
+		ipset destroy $TPWS_MY1_NAME4 2>/dev/null
+		ipset destroy $TPWS_MY1_NAME6 2>/dev/null
+	}
+}
+
+zapret_custom_firewall_nft()
+{
+	local f4 f6 subnet
+
+	[ "$DISABLE_IPV4" != 1 ] && {
+	        make_comma_list subnets $TPWS_MY1_SUBNETS4
+		nft_create_set $TPWS_MY1_NAME4 "type ipv4_addr; size $TPWS_MY1_IPSET_SIZE; auto-merge; flags interval;"
+		nft_flush_set $TPWS_MY1_NAME4
+		nft_add_set_element $TPWS_MY1_NAME4 "$subnets"
+	}
+	[ "$DISABLE_IPV6" != 1 ] && {
+	        make_comma_list subnets $TPWS_MY1_SUBNETS6
+		nft_create_set $TPWS_MY1_NAME6 "type ipv6_addr; size $TPWS_MY1_IPSET_SIZE; auto-merge; flags interval;"
+		nft_flush_set $TPWS_MY1_NAME6
+		nft_add_set_element $TPWS_MY1_NAME6 "$subnets"
+	}
+
+	f4="tcp dport {$TPWS_MY1_PORTS}"
+	f6="$f4 ip6 daddr @$TPWS_MY1_NAME6"
+	f4="$f4 ip daddr @$TPWS_MY1_NAME4"
+	nft_fw_tpws "$f4" "$f6" $PORT_TPWS_MY1
+}
+
+zapret_custom_firewall_nft_flush()
+{
+	# this function is called after all nft fw rules are deleted
+	# however sets are not deleted. it's desired to clear sets here.
+
+	nft_del_set $TPWS_MY1_NAME4 2>/dev/null
+	nft_del_set $TPWS_MY1_NAME6 2>/dev/null
+}

init.d/custom.d.examples.linux/50-wg4all

@@ -0,0 +1,30 @@
+# this custom script runs desync to all wireguard handshake initiation packets
+
+# can override in config :
+NFQWS_OPT_DESYNC_WG="${NFQWS_OPT_DESYNC_WG:---dpi-desync=fake}"
+
+alloc_dnum DNUM_WG4ALL
+alloc_qnum QNUM_WG4ALL
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - add, 0 - stop
+
+        local opt="--qnum=$QNUM_WG4ALL $NFQWS_OPT_DESYNC_WG"
+	do_nfqws $1 $DNUM_WG4ALL "$opt"
+}
+# size = 156 (8 udp header + 148 payload) && payload starts with 0x01000000
+zapret_custom_firewall()
+{
+        # $1 - 1 - run, 0 - stop
+
+        local f='-p udp -m u32 --u32'
+        fw_nfqws_post $1 "$f 0>>22&0x3C@4>>16=0x9c&&0>>22&0x3C@8=0x01000000" "$f 44>>16=0x9c&&48=0x01000000" $QNUM_WG4ALL
+}
+zapret_custom_firewall_nft()
+{
+        # stop logic is not required
+
+        local f="udp length 156 @th,64,32 0x01000000"
+        nft_fw_nfqws_post "$f" "$f" $QNUM_WG4ALL
+}

init.d/openwrt/custom.d.examples/50-dht4all

@@ -1,38 +0,0 @@
-# this custom script runs desync to DHT packets with udp payload length 101..399 , without ipset/hostlist filtering
-
-# can override in config :
-NFQWS_OPT_DESYNC_DHT="${NFQWS_OPT_DESYNC_DHT:---dpi-desync=tamper}"
-
-alloc_dnum DNUM_DHT4ALL
-alloc_qnum QNUM_DHT4ALL
-
-zapret_custom_daemons()
-{
-        # stop logic is managed by procd
-
-        local opt="--qnum=$QNUM_DHT4ALL $NFQWS_OPT_BASE $NFQWS_OPT_DESYNC_DHT"
-	run_daemon $DNUM_DHT4ALL $NFQWS "$opt"
-}
-zapret_custom_firewall()
-{
-        # $1 - 1 - run, 0 - stop
-
-        local f uf4 uf6
-        local first_packet_only="$ipt_connbytes 1:1"
-
-        f='-p udp -m length --length 109:407 -m u32 --u32'
-	uf4='0>>22&0x3C@8>>16=0x6431'
-	uf6='48>>16=0x6431'
-        fw_nfqws_post $1 "$f $uf4 $first_packet_only"  "$f $uf6 $first_packet_only" $QNUM_DHT4ALL
-
-}
-zapret_custom_firewall_nft()
-{
-        # stop logic is not required
-
-        local f
-        local first_packet_only="$nft_connbytes 1"
-
-        f="meta length 109-407 meta l4proto udp @th,64,16 0x6431"
-        nft_fw_nfqws_post "$f $first_packet_only" "$f $first_packet_only" $QNUM_DHT4ALL
-}

init.d/openwrt/functions

@@ -10,6 +10,7 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
 . "$ZAPRET_BASE/common/ipt.sh"
 . "$ZAPRET_BASE/common/nft.sh"
 . "$ZAPRET_BASE/common/linux_fw.sh"
+. "$ZAPRET_BASE/common/linux_daemons.sh"
 . "$ZAPRET_BASE/common/list.sh"
 . "$ZAPRET_BASE/common/custom.sh"
 CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt"
@@ -24,15 +25,8 @@ CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt"
 
 TPWS_LOCALHOST4=127.0.0.127
 
-# max wait time for the link local ipv6 on the LAN interface
-LINKLOCAL_WAIT_SEC=5
-
 IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
 
-IPSET_EXCLUDE="-m set ! --match-set nozapret"
-IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
-
-
 # can be multiple ipv6 outgoing interfaces
 # uplink from isp, tunnelbroker, vpn, ...
 # want them all. who knows what's the real one that blocks sites

init.d/openwrt/zapret

@@ -81,6 +81,10 @@ run_tpws()
 	}
 	run_daemon $1 "$TPWS" "$OPT $2"
 }
+do_tpws()
+{
+	[ "$1" = 0 ] || { shift; run_tpws "$@"; }
+}
 run_tpws_socks()
 {
 	[ "$DISABLE_IPV4" = "1" ] && [ "$DISABLE_IPV6" = "1" ] && return 0
@@ -90,13 +94,10 @@ run_tpws_socks()
 	tpws_apply_socks_binds opt
 	run_daemon $1 "$TPWS" "$opt $2"
 }
-
-stop_tpws()
+do_tpws_socks()
 {
-	stop_daemon $1 "$TPWS"
+	[ "$1" = 0 ] || { shift; run_tpws_socks "$@"; }
 }
-
-
 tpws_apply_socks_binds()
 {
 	local o
@@ -105,39 +106,27 @@ tpws_apply_socks_binds()
 	[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-addr=::1"
 	
 	for lan in $OPENWRT_LAN; do
-	    network_get_device DEVICE $lan
-	    [ -n "$DEVICE" ] || continue
-	    [ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$DEVICE $TPWS_WAIT"
-	    [ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$DEVICE --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
+		network_get_device DEVICE $lan
+		[ -n "$DEVICE" ] || continue
+		[ "$DISABLE_IPV4" = "1" ] || o="$o --bind-iface4=$DEVICE $TPWS_WAIT"
+		[ "$DISABLE_IPV6" = "1" ] || o="$o --bind-iface6=$DEVICE --bind-linklocal=unwanted $TPWS_WAIT_SOCKS6"
 	done
 	eval $1="\"\$$1 $o\""
 }
 
-
-standard_mode_daemons()
+run_nfqws()
 {
-	local opt
-	[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$TPWS_OPT" && {
-		opt="--port=$TPPORT $TPWS_OPT"
-		filter_apply_hostlist_target opt
-		run_tpws 1 "$opt"
-	}
-	[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
-		opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT"
-		filter_apply_hostlist_target opt
-		run_tpws_socks 2 "$opt"
-	}
-	[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options 1 "$NFQWS_OPT" && {
-		opt="--qnum=$QNUM $NFQWS_OPT_BASE $NFQWS_OPT"
-		filter_apply_hostlist_target opt
-		run_daemon 3 "$NFQWS" "$opt"
-	}
+	run_daemon $1 "$NFQWS" "$NFQWS_OPT_BASE $2"
+}
+do_nfqws()
+{
+	[ "$1" = 0 ] || { shift; run_nfqws "$@"; }
 }
 
 start_daemons_procd()
 {
-	standard_mode_daemons
-	custom_runner zapret_custom_daemons
+	standard_mode_daemons 1
+	custom_runner zapret_custom_daemons 1
 
 	return 0
 }

init.d/pfsense/zapret.sh

@@ -21,4 +21,4 @@ pfctl -d ; pfctl -e
 ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg
 pkill ^dvtws$
-dvtws --daemon --port 989 --dpi-desync=split2
+dvtws --daemon --port 989 --dpi-desync=multisplit

init.d/systemd/nfqws@.service

@@ -0,0 +1,65 @@
+# Example systemd service unit for nfqws. Adjust for your installation.
+
+# WARNING ! This unit requires to compile nfqws using `make systemd`
+# WARNING ! This makefile target enabled special systemd notify support.
+
+# PREPARE
+# install build depends
+# make -C /opt/zapret systemd
+# cp nfqws@service /lib/systemd/system
+# systemctl daemon-reload
+
+# MANAGE INSTANCE
+# prepare /etc/zapret/nfqws1.conf with nfqws parameters
+# systemctl start nfqws@nfqws1
+# systemctl status nfqws@nfqws1
+# systemctl restart nfqws@nfqws1
+# systemctl enable nfqws@nfqws1
+# systemctl disable nfqws@nfqws1
+# systemctl stop nfqws@nfqws1
+
+# DELETE
+# rm /lib/systemd/system/nfqws@.service
+# systemctl daemon-reload
+
+
+[Unit]
+After=network.target
+
+[Service]
+Type=notify
+Restart=on-failure
+
+ExecSearchPath=/opt/zapret/binaries/my
+ExecStart=nfqws @${CONFIG_DIR}/${INSTANCE}.conf
+Environment=CONFIG_DIR=/etc/zapret
+Environment=INSTANCE=%i
+
+RestrictAddressFamilies=AF_NETLINK AF_UNIX AF_INET6 AF_INET
+
+LockPersonality=true
+MemoryDenyWriteExecute=true
+PrivateDevices=true
+PrivateMounts=true
+PrivateTmp=true
+ProcSubset=pid
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProtectSystem=full
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@resources
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

init.d/systemd/tpws@.service

@@ -0,0 +1,63 @@
+# Example systemd service unit for tpws. Adjust for your installation.
+
+# WARNING ! This unit requires to compile tpws using `make systemd`
+# WARNING ! This makefile target enabled special systemd notify support.
+
+# PREPARE
+# install build depends
+# make -C /opt/zapret systemd
+# cp tpws@service /lib/systemd/system
+# systemctl daemon-reload
+
+# MANAGE INSTANCE
+# prepare /etc/zapret/tpws1.conf with tpws parameters
+# systemctl start tpws@tpws1
+# systemctl status tpws@tpws1
+# systemctl restart tpws@tpws1
+# systemctl enable tpws@tpws1
+# systemctl disable tpws@tpws1
+# systemctl stop tpws@tpws1
+
+# DELETE
+# rm /lib/systemd/system/tpws@.service
+# systemctl daemon-reload
+
+
+[Unit]
+After=network.target
+
+[Service]
+Type=notify
+Restart=on-failure
+
+ExecSearchPath=/opt/zapret/binaries/my
+ExecStart=tpws @${CONFIG_DIR}/${INSTANCE}.conf
+Environment=CONFIG_DIR=/etc/zapret
+Environment=INSTANCE=%i
+
+RestrictAddressFamilies=AF_NETLINK AF_UNIX AF_INET6 AF_INET
+
+LockPersonality=true
+MemoryDenyWriteExecute=true
+PrivateDevices=true
+PrivateMounts=true
+PrivateTmp=true
+ProcSubset=pid
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectProc=invisible
+ProtectSystem=full
+RemoveIPC=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

init.d/sysv/functions

@@ -10,6 +10,7 @@ ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
 . "$ZAPRET_BASE/common/ipt.sh"
 . "$ZAPRET_BASE/common/nft.sh"
 . "$ZAPRET_BASE/common/linux_fw.sh"
+. "$ZAPRET_BASE/common/linux_daemons.sh"
 . "$ZAPRET_BASE/common/list.sh"
 . "$ZAPRET_BASE/common/custom.sh"
 CUSTOM_DIR="$ZAPRET_RW/init.d/sysv"
@@ -89,13 +90,6 @@ TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
 # first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case
 TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3"
 
-# max wait time for the link local ipv6 on the LAN interface
-LINKLOCAL_WAIT_SEC=5
-
-IPSET_EXCLUDE="-m set ! --match-set nozapret"
-IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
-
-
 dnat6_target()
 {
 	_dnat6_target "$@"
@@ -275,45 +269,3 @@ create_ipset()
 	echo "Creating ip list table (firewall type $FWTYPE)"
 	"$IPSET_CR" "$@"
 }
-
-
-standard_mode_daemons()
-{
-	# $1 - 1 - run, 0 - stop
-
-	local opt
-
-	[ "$TPWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$TPWS_OPT" && {
-		opt="--port=$TPPORT $TPWS_OPT"
-		filter_apply_hostlist_target opt
-		do_tpws $1 1 "$opt"
-	}
-	[ "$TPWS_SOCKS_ENABLE" = 1 ] && {
-		opt="--port=$TPPORT_SOCKS $TPWS_SOCKS_OPT"
-		filter_apply_hostlist_target opt
-		do_tpws_socks $1 2 "$opt"
-	}
-	[ "$NFQWS_ENABLE" = 1 ] && check_bad_ws_options $1 "$NFQWS_OPT" && {
-		opt="--qnum=$QNUM $NFQWS_OPT"
-		filter_apply_hostlist_target opt
-		do_nfqws $1 3 "$opt"
-	}
-}
-
-zapret_do_daemons()
-{
-	# $1 - 1 - run, 0 - stop
-
-	standard_mode_daemons $1
-	custom_runner zapret_custom_daemons $1
-
-	return 0
-}
-zapret_run_daemons()
-{
-	zapret_do_daemons 1 "$@"
-}
-zapret_stop_daemons()
-{
-	zapret_do_daemons 0 "$@"
-}

init.d/sysv/zapret

@@ -74,8 +74,7 @@ case "$1" in
 		;;
 		
   *)
-	N=/etc/init.d/$NAME
-	echo "Usage: $N {start|stop|restart|start-fw|stop-fw|restart-fw|start-daemons|stop-daemons|restart-daemons|reload-ifsets|list-ifsets|list-table}" >&2
+	echo "Usage: $SCRIPT {start|stop|restart|start-fw|stop-fw|restart-fw|start-daemons|stop-daemons|restart-daemons|reload-ifsets|list-ifsets|list-table}" >&2
 	exit 1
 	;;
 esac

install_bin.sh

@@ -56,7 +56,7 @@ UNAME=$(uname)
 unset PKTWS
 case $UNAME in
 	Linux)
-		ARCHLIST="my x86_64 x86 aarch64 arm mips64r2-msb mips32r1-lsb mips32r1-msb ppc"
+		ARCHLIST="my x86_64 x86 aarch64 arm mips64r2-msb mips32r1-lsb mips32r1-msb lexra ppc"
 		PKTWS=nfqws
 		;;
 	Darwin)

install_easy.sh

@@ -26,6 +26,7 @@ IPSET_DIR="$ZAPRET_BASE/ipset"
 . "$ZAPRET_BASE/common/ipt.sh"
 . "$ZAPRET_BASE/common/installer.sh"
 . "$ZAPRET_BASE/common/virt.sh"
+. "$ZAPRET_BASE/common/list.sh"
 
 GET_LIST="$IPSET_DIR/get_config.sh"
 
@@ -68,8 +69,15 @@ check_bins()
 		echo found architecture "\"$arch\""
 	elif [ -f "$EXEDIR/Makefile" ] && exists make; then
 		echo trying to compile
-		[ "$SYSTEM" = "macos" ] && make_target=mac
-		make -C "$EXEDIR" $make_target || {
+		case $SYSTEM in
+			macos)
+				make_target=mac
+				;;
+			systemd)
+				make_target=systemd
+				;;
+		esac
+		CFLAGS="-march=native ${CFLAGS}" make -C "$EXEDIR" $make_target || {
 			echo could not compile
 			make -C "$EXEDIR" clean
 			exitp 8
@@ -115,6 +123,30 @@ ws_opt_validate()
 	}
 	return 0
 }
+tpws_opt_validate()
+{
+	ws_opt_validate "$1" || return 1
+	dry_run_tpws || {
+		echo invalid tpws options
+		return 1
+	}
+}
+tpws_socks_opt_validate()
+{
+	# --ipset allowed here
+	dry_run_tpws_socks || {
+		echo invalid tpws options
+		return 1
+	}
+}
+nfqws_opt_validate()
+{
+	ws_opt_validate "$1" || return 1
+	dry_run_nfqws || {
+		echo invalid nfqws options
+		return 1
+	}
+}
 
 select_mode_group()
 {
@@ -162,18 +194,17 @@ select_mode_group()
 select_mode_tpws_socks()
 {
 	local EDITVAR_NEWLINE_DELIMETER="--new" EDITVAR_NEWLINE_VARS="TPWS_SOCKS_OPT"
-	# --ipset allowed here
-	select_mode_group TPWS_SOCKS_ENABLE "enable tpws socks mode on port $TPPORT_SOCKS ?" "TPPORT_SOCKS TPWS_SOCKS_OPT"
+	select_mode_group TPWS_SOCKS_ENABLE "enable tpws socks mode on port $TPPORT_SOCKS ?" "TPPORT_SOCKS TPWS_SOCKS_OPT" tpws_socks_opt_validate TPWS_SOCKS_OPT
 }
 select_mode_tpws()
 {
 	local EDITVAR_NEWLINE_DELIMETER="--new" EDITVAR_NEWLINE_VARS="TPWS_OPT"
-	select_mode_group TPWS_ENABLE "enable tpws transparent mode ?" "TPWS_PORTS TPWS_OPT" ws_opt_validate TPWS_OPT
+	select_mode_group TPWS_ENABLE "enable tpws transparent mode ?" "TPWS_PORTS TPWS_OPT" tpws_opt_validate TPWS_OPT
 }
 select_mode_nfqws()
 {
 	local EDITVAR_NEWLINE_DELIMETER="--new" EDITVAR_NEWLINE_VARS="NFQWS_OPT"
-	select_mode_group NFQWS_ENABLE "enable nfqws ?" "NFQWS_PORTS_TCP NFQWS_PORTS_UDP NFQWS_TCP_PKT_OUT NFQWS_TCP_PKT_IN NFQWS_UDP_PKT_OUT NFQWS_UDP_PKT_IN NFQWS_PORTS_TCP_KEEPALIVE NFQWS_PORTS_UDP_KEEPALIVE NFQWS_OPT" ws_opt_validate NFQWS_OPT
+	select_mode_group NFQWS_ENABLE "enable nfqws ?" "NFQWS_PORTS_TCP NFQWS_PORTS_UDP NFQWS_TCP_PKT_OUT NFQWS_TCP_PKT_IN NFQWS_UDP_PKT_OUT NFQWS_UDP_PKT_IN NFQWS_PORTS_TCP_KEEPALIVE NFQWS_PORTS_UDP_KEEPALIVE NFQWS_OPT" nfqws_opt_validate NFQWS_OPT
 }
 
 select_mode_mode()
@@ -268,7 +299,7 @@ ask_config_tmpdir()
 		echo default tmpfs has size of 50% RAM
 		echo "RAM  : $(get_ram_mb) Mb"
 		echo "DISK : $(get_free_space_mb) Mb"
-		echo select temp file location 
+		echo select temp file location
 		[ -z "$TMPDIR" ] && TMPDIR=/tmp
 		ask_list TMPDIR "/tmp $EXEDIR/tmp" && {
 		    [ "$TMPDIR" = "/tmp" ] && TMPDIR=
@@ -364,13 +395,13 @@ copy_openwrt()
 	local ARCH="$(get_bin_arch)"
 	local BINDIR="$1/binaries/$ARCH"
 	local file
-	
+
 	[ -d "$2" ] || mkdir -p "$2"
 
 	mkdir "$2/tpws" "$2/nfq" "$2/ip2net" "$2/mdig" "$2/binaries" "$2/binaries/$ARCH" "$2/init.d" "$2/tmp" "$2/files"
 	cp -R "$1/files/fake" "$2/files"
 	cp -R "$1/common" "$1/ipset" "$2"
-	cp -R "$1/init.d/openwrt" "$2/init.d"
+	cp -R "$1/init.d/openwrt" "$1/init.d/custom.d.examples.linux" "$2/init.d"
 	cp "$1/config" "$1/config.default" "$1/install_easy.sh" "$1/uninstall_easy.sh" "$1/install_bin.sh" "$1/install_prereq.sh" "$1/blockcheck.sh" "$2"
 	cp "$BINDIR/tpws" "$BINDIR/nfqws" "$BINDIR/ip2net" "$BINDIR/mdig" "$2/binaries/$ARCH"
 }
@@ -458,7 +489,7 @@ _restore_settings()
 		[ -z "$f" -o "$f" = "/" ] && continue
 
 		[ -f "/tmp/zapret-bkp-$i" ] && {
-			mv -f "/tmp/zapret-bkp-$i" "$ZAPRET_TARGET/$f" || rm -f "/tmp/zapret-bkp-$i" 
+			mv -f "/tmp/zapret-bkp-$i" "$ZAPRET_TARGET/$f" || rm -f "/tmp/zapret-bkp-$i"
 		}
 		[ -d "/tmp/zapret-bkp-$i" ] && {
 			[ -d "$ZAPRET_TARGET/$f" ] && rm -r "$ZAPRET_TARGET/$f"
@@ -700,7 +731,7 @@ install_linux()
 	crontab_del_quiet
 	# desktop system. more likely up at daytime
 	crontab_add 10 22
-	
+
 	echo
 	echo '!!! WARNING. YOUR SETUP IS INCOMPLETE !!!'
 	echo you must manually add to auto start : $INIT_SCRIPT_SRC start
@@ -748,7 +779,6 @@ deoffload_openwrt_firewall()
 	else
 		echo system wide software flow offloading disabled. ok
 	fi
-			
 }
 
 

ip2net/Makefile

@@ -9,22 +9,24 @@ SRC_FILES = ip2net.c qsort.c
 all: ip2net
 
 ip2net: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LIBS) $(LDFLAGS)
+
+systemd: ip2net
 
 android: ip2net
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2neta $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2netx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2neta $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS) $(LDFLAGS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2netx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS) $(LDFLAGS)
 	strip ip2neta ip2netx
 	lipo -create -output ip2net ip2netx ip2neta
 	rm -f ip2netx ip2neta
 
 win: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS_WIN)
+	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o ip2net $(SRC_FILES) $(LIBS_WIN) $(LDFLAGS)
 
 clean:
 	rm -f ip2net *.o

ip2net/ip2net.c

@@ -225,6 +225,28 @@ static void exithelp(void)
 #define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
 #endif
 
+enum opt_indices {
+	IDX_HELP,
+	IDX_H,
+	IDX_4,
+	IDX_6,
+	IDX_PREFIX_LENGTH,
+	IDX_V4_THRESHOLD,
+	IDX_V6_THRESHOLD,
+	IDX_LAST,
+};
+
+static const struct option long_options[] = {
+	[IDX_HELP] = {"help", no_argument, 0, 0},
+	[IDX_H] = {"h", no_argument, 0, 0},
+	[IDX_4] = {"4", no_argument, 0, 0},
+	[IDX_6] = {"6", no_argument, 0, 0},
+	[IDX_PREFIX_LENGTH] = {"prefix-length", required_argument, 0, 0},
+	[IDX_V4_THRESHOLD] = {"v4-threshold", required_argument, 0, 0},
+	[IDX_V6_THRESHOLD] = {"v6-threshold", required_argument, 0, 0},
+	[IDX_LAST] = {NULL, 0, NULL, 0},
+};
+
 static void parse_params(int argc, char *argv[])
 {
 	int option_index = 0;
@@ -236,33 +258,23 @@ static void parse_params(int argc, char *argv[])
 	params.pctdiv = DEFAULT_PCTDIV;
 	params.v6_threshold = DEFAULT_V6_THRESHOLD;
 
-	const struct option long_options[] = {
-		{ "help",no_argument,0,0 },// optidx=0
-		{ "h",no_argument,0,0 },// optidx=1
-		{ "4",no_argument,0,0 },// optidx=2
-		{ "6",no_argument,0,0 },// optidx=3
-		{ "prefix-length",required_argument,0,0 },// optidx=4
-		{ "v4-threshold",required_argument,0,0 },// optidx=5
-		{ "v6-threshold",required_argument,0,0 },// optidx=6
-		{ NULL,0,NULL,0 }
-	};
 	while ((v = getopt_long_only(argc, argv, "", long_options, &option_index)) != -1)
 	{
 		if (v) exithelp();
 		switch (option_index)
 		{
-		case 0:
-		case 1:
+		case IDX_HELP:
+		case IDX_H:
 			PRINT_VER;
 			exithelp();
 			break;
-		case 2:
+		case IDX_4:
 			params.ipv6 = false;
 			break;
-		case 3:
+		case IDX_6:
 			params.ipv6 = true;
 			break;
-		case 4:
+		case IDX_PREFIX_LENGTH:
 			i = sscanf(optarg,"%u-%u",&plen1,&plen2);
 			if (i == 1) plen2 = plen1;
 			if (i<=0 || plen2<plen1 || !plen1 || !plen2)
@@ -271,7 +283,7 @@ static void parse_params(int argc, char *argv[])
 				exit(1);
 			}
 			break;
-		case 5:
+		case IDX_V4_THRESHOLD:
 			i = sscanf(optarg, "%u/%u", &params.pctmult, &params.pctdiv);
 			if (i!=2 || params.pctdiv<2 || params.pctmult<1 || params.pctmult>=params.pctdiv)
 			{
@@ -279,7 +291,7 @@ static void parse_params(int argc, char *argv[])
 				exit(1);
 			}
 			break;
-		case 6:
+		case IDX_V6_THRESHOLD:
 			i = sscanf(optarg, "%u", &params.v6_threshold);
 			if (i != 1 || params.v6_threshold<1)
 			{

ipset/antifilter.helper

@@ -7,7 +7,7 @@ get_antifilter()
  [ "$DISABLE_IPV4" != "1" ] && {
   curl --fail --max-time 150 --connect-timeout 20 --max-filesize 41943040 -k -L "$1" | cut_local >"$ZIPLISTTMP" &&
   {
-   dlsize=$(LANG=C wc -c "$ZIPLISTTMP" | xargs | cut -f 1 -d ' ')
+   dlsize=$(LC_ALL=C LANG=C wc -c "$ZIPLISTTMP" | xargs | cut -f 1 -d ' ')
    if [ $dlsize -lt 102400 ]; then
     echo list file is too small. can be bad.
     exit 2

ipset/def.sh

@@ -5,7 +5,7 @@ ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"}
 ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
 IPSET_RW_DIR="$ZAPRET_RW/ipset"
 
-. "$ZAPRET_CONFIG"
+[ -f "$ZAPRET_CONFIG" ] && . "$ZAPRET_CONFIG"
 . "$ZAPRET_BASE/common/base.sh"
 
 [ -z "$TMPDIR" ] && TMPDIR=/tmp
@@ -141,6 +141,18 @@ zzsize()
   printf 0
  fi
 }
+zzcopy()
+{
+ local is_gz=0
+ zztest "$1" && is_gz=1
+ if [ "$GZIP_LISTS" = 1 -a $is_gz = 1 ]; then
+  cp "$1" "${2}.gz"
+ elif [ "$GZIP_LISTS" != 1 -a $is_gz != 1 ]; then
+  cp "$1" "$2"
+ else
+  zzcat "$1" | zz "$2"
+ fi
+}
 
 digger()
 {
@@ -255,3 +267,17 @@ getipban()
  _get_ipban
  return 0
 }
+
+hup_zapret_daemons()
+{
+ echo forcing zapret daemons to reload their hostlist
+ if exists killall; then
+  killall -HUP tpws nfqws dvtws 2>/dev/null
+ elif exists pkill; then
+  pkill -HUP ^tpws$
+  pkill -HUP ^nfqws$
+  pkill -HUP ^dvtws$
+ else
+  echo no mass killer available ! cant HUP zapret daemons
+ fi
+}

ipset/get_antizapret_domains.sh

@@ -21,7 +21,7 @@ curl -H "Accept-Encoding: gzip" -k --fail --max-time 600 --connect-timeout 5 --r
  exit 2
 }
 
-dlsize=$(LANG=C wc -c "$ZDOM" | xargs | cut -f 1 -d ' ')
+dlsize=$(LC_ALL=C LANG=C wc -c "$ZDOM" | xargs | cut -f 1 -d ' ')
 if test $dlsize -lt 102400; then
  echo list file is too small. can be bad.
  exit 2
@@ -31,4 +31,6 @@ sort -u "$ZDOM" | zz "$ZHOSTLIST"
 
 rm -f "$ZDOM"
 
+hup_zapret_daemons
+
 exit 0

ipset/get_config.sh

@@ -4,7 +4,7 @@
 IPSET_DIR="$(dirname "$0")"
 IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
 
-. "$IPSET_DIR/../config"
+[ -f "$IPSET_DIR/../config" ] && . "$IPSET_DIR/../config"
 
 [ -z "$GETLIST" ] && GETLIST=get_ipban.sh
 [ -x "$IPSET_DIR/$GETLIST" ] && exec "$IPSET_DIR/$GETLIST"

ipset/get_reestr_hostlist.sh

@@ -5,9 +5,9 @@ IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
 
 . "$IPSET_DIR/def.sh"
 
-ZREESTR="$TMPDIR/zapret.txt"
+ZREESTR="$TMPDIR/zapret.txt.gz"
 IPB="$TMPDIR/ipb.txt"
-ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv
+ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv.gz
 
 dl_checked()
 {
@@ -21,7 +21,7 @@ dl_checked()
    echo list download failed : $1
    return 2
   }
-  dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    return 2
@@ -31,11 +31,11 @@ dl_checked()
 
 reestr_list()
 {
- LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
+ LC_ALL=C LANG=C gunzip -c "$ZREESTR" | cut -s -f2 -d';' | LC_ALL=C  LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
 }
 reestr_extract_ip()
 {
- LANG=C nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' "$ZREESTR" | LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
+ LC_ALL=C LANG=C gunzip -c | nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' | LC_ALL=C  LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
 }
 
 ipban_fin()
@@ -58,6 +58,8 @@ rm -f "$ZREESTR"
 [ "$DISABLE_IPV6" != "1" ] && $AWK '/^([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}($|(\/[0-9]{2,3}$))/' "$IPB" | cut_local6 | ip2net6 | zz "$ZIPLIST_IPBAN6"
 rm -f "$IPB"
 
+hup_zapret_daemons
+
 ipban_fin
 
 exit 0

ipset/get_reestr_preresolved.sh

@@ -24,12 +24,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/get_reestr_preresolved_smart.sh

@@ -24,12 +24,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/get_reestr_resolvable_domains.sh

@@ -23,17 +23,19 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 
 dl "$URL" "$ZHOSTLIST" 65536 67108864
 
+hup_zapret_daemons
+
 [ "$DISABLE_IPV4" != "1" ] && dl "$IPB4" "$ZIPLIST_IPBAN" 8192 1048576
 [ "$DISABLE_IPV6" != "1" ] && dl "$IPB6" "$ZIPLIST_IPBAN6" 128 1048576
 

ipset/get_reestr_resolve.sh

@@ -5,12 +5,12 @@ IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
 
 . "$IPSET_DIR/def.sh"
 
-ZREESTR="$TMPDIR/zapret.txt"
+ZREESTR="$TMPDIR/zapret.txt.gz"
 ZDIG="$TMPDIR/zapret-dig.txt"
 IPB="$TMPDIR/ipb.txt"
 ZIPLISTTMP="$TMPDIR/zapret-ip.txt"
 #ZURL=https://reestr.rublacklist.net/api/current
-ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv
+ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv.gz
 
 dl_checked()
 {
@@ -24,7 +24,7 @@ dl_checked()
    echo list download failed : $1
    return 2
   }
-  dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    return 2
@@ -34,11 +34,11 @@ dl_checked()
 
 reestr_list()
 {
- LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p'
+ LC_ALL=C LANG=C gunzip -c "$ZREESTR" | cut -s -f2 -d';' | LC_ALL=C LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
 }
 reestr_extract_ip()
 {
- LANG=C nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' "$ZREESTR" | LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
+ LC_ALL=C LANG=C gunzip -c | nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' | LC_ALL=C LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
 }
 
 getuser && {

ipset/get_refilter_domains.sh

@@ -20,12 +20,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | tr -d '\015' | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 
@@ -37,4 +37,6 @@ getipban || FAIL=1
 
 dl "$URL" "$ZHOSTLIST" 32768 4194304
 
+hup_zapret_daemons
+
 exit 0

ipset/get_refilter_ipsum.sh

@@ -20,13 +20,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  # remove DOS EOL \r
-  zzcat "$TMPLIST" | tr -d '\015' | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/zapret-hosts-user-exclude.txt.default

@@ -1,6 +1,8 @@
+127.0.0.0/8
 10.0.0.0/8
 172.16.0.0/12
 192.168.0.0/16
 169.254.0.0/16
+::1
 fc00::/7
 fe80::/10

mdig/Makefile

@@ -10,23 +10,25 @@ SRC_FILES = *.c
 all: mdig
 
 mdig: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LIBS) $(LDFLAGS)
+
+systemd: mdig
 
 android: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_ANDROID)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LIBS_ANDROID) $(LDFLAGS)
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdiga $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdigx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdiga $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdigx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
 	strip mdiga mdigx
 	lipo -create -output mdig mdigx mdiga
 	rm -f mdigx mdiga
 
 win: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_WIN)
+	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o mdig $(SRC_FILES) $(LIBS_WIN) $(LDFLAGS)
 
 clean:
 	rm -f mdig *.o

mdig/mdig.c

@@ -467,25 +467,38 @@ static void exithelp(void)
 #define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
 #endif
 
+enum opt_indices {
+	IDX_HELP,
+	IDX_THREADS,
+	IDX_FAMILY,
+	IDX_VERBOSE,
+	IDX_STATS,
+	IDX_LOG_RESOLVED,
+	IDX_LOG_FAILED,
+	IDX_DNS_MAKE_QUERY,
+	IDX_DNS_PARSE_QUERY,
+	IDX_LAST,
+};
+
+static const struct option long_options[] = {
+	[IDX_HELP] = {"help", no_argument, 0, 0},
+	[IDX_THREADS] = {"threads", required_argument, 0, 0},
+	[IDX_FAMILY] = {"family", required_argument, 0, 0},
+	[IDX_VERBOSE] = {"verbose", no_argument, 0, 0},
+	[IDX_STATS] = {"stats", required_argument, 0, 0},
+	[IDX_LOG_RESOLVED] = {"log-resolved", required_argument, 0, 0},
+	[IDX_LOG_FAILED] = {"log-failed", required_argument, 0, 0},
+	[IDX_DNS_MAKE_QUERY] = {"dns-make-query", required_argument, 0, 0},
+	[IDX_DNS_PARSE_QUERY] = {"dns-parse-query", no_argument, 0, 0},
+	[IDX_LAST] = {NULL, 0, NULL, 0},
+};
+
 int main(int argc, char **argv)
 {
 	int r, v, option_index = 0;
 	char fn1[256],fn2[256];
 	char dom[256];
 
-	static const struct option long_options[] = {
-			{"help",no_argument,0,0},			// optidx=0
-			{"threads",required_argument,0,0},		// optidx=1
-			{"family",required_argument,0,0},		// optidx=2
-			{"verbose",no_argument,0,0},			// optidx=3
-			{"stats",required_argument,0,0},		// optidx=4
-			{"log-resolved",required_argument,0,0},		// optidx=5
-			{"log-failed",required_argument,0,0},		// optidx=6
-			{"dns-make-query",required_argument,0,0},	// optidx=7
-			{"dns-parse-query",no_argument,0,0},		// optidx=8
-			{NULL,0,NULL,0}
-	};
-
 	memset(&glob, 0, sizeof(glob));
 	*fn1 = *fn2 = *dom = 0;
 	glob.family = FAMILY4;
@@ -495,11 +508,11 @@ int main(int argc, char **argv)
 		if (v) exithelp();
 		switch (option_index)
 		{
-		case 0: /* help */
+		case IDX_HELP:
 			PRINT_VER;
 			exithelp();
 			break;
-		case 1: /* threads */
+		case IDX_THREADS:
 			glob.threads = optarg ? atoi(optarg) : 0;
 			if (glob.threads <= 0 || glob.threads > 100)
 			{
@@ -507,7 +520,7 @@ int main(int argc, char **argv)
 				return 1;
 			}
 			break;
-		case 2: /* family */
+		case IDX_FAMILY:
 			if (!strcmp(optarg, "4"))
 				glob.family = FAMILY4;
 			else if (!strcmp(optarg, "6"))
@@ -520,25 +533,25 @@ int main(int argc, char **argv)
 				return 1;
 			}
 			break;
-		case 3: /* verbose */
+		case IDX_VERBOSE:
 			glob.verbose = '\1';
 			break;
-		case 4: /* stats */
+		case IDX_STATS:
 			glob.stats_every = optarg ? atoi(optarg) : 0;
 			break;
-		case 5: /* log-resolved */
+		case IDX_LOG_RESOLVED:
 			strncpy(fn1,optarg,sizeof(fn1));
 			fn1[sizeof(fn1)-1] = 0;
 			break;
-		case 6: /* log-failed */
+		case IDX_LOG_FAILED:
 			strncpy(fn2,optarg,sizeof(fn2));
 			fn2[sizeof(fn2)-1] = 0;
 			break;
-		case 7: /* dns-make-query */
+		case IDX_DNS_MAKE_QUERY:
 			strncpy(dom,optarg,sizeof(dom));
 			dom[sizeof(dom)-1] = 0;
 			break;
-		case 8: /* dns-parse-query */
+		case IDX_DNS_PARSE_QUERY:
 			return dns_parse_query();
 		}
 	}

nfq/BSDmakefile

@@ -6,7 +6,7 @@ SRC_FILES = *.c crypto/*.c
 all: dvtws
 
 dvtws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 clean:
 	rm -f dvtws

nfq/Makefile

@@ -1,8 +1,10 @@
 CC ?= gcc
 CFLAGS += -std=gnu99 -Os -flto=auto
+CFLAGS_SYSTEMD = -DUSE_SYSTEMD
 CFLAGS_BSD = -Wno-address-of-packed-member
 CFLAGS_CYGWIN = -Wno-address-of-packed-member -static
 LIBS_LINUX = -lnetfilter_queue -lnfnetlink -lz
+LIBS_SYSTEMD = -lsystemd
 LIBS_BSD = -lz
 LIBS_CYGWIN = -lz -Lwindows/windivert -Iwindows -lwlanapi -lole32 -loleaut32
 LIBS_CYGWIN32 = -lwindivert32
@@ -14,24 +16,27 @@ SRC_FILES = *.c crypto/*.c
 all: nfqws
 
 nfqws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LIBS_LINUX) $(LDFLAGS)
+
+systemd: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) $(CFLAGS_SYSTEMD) -o nfqws $(SRC_FILES) $(LIBS_LINUX) $(LIBS_SYSTEMD) $(LDFLAGS)
 
 android: nfqws
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS_BSD)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LIBS_BSD) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
 	strip dvtwsa dvtwsx
 	lipo -create -output dvtws dvtwsx dvtwsa
 	rm -f dvtwsx dvtwsa
 
 cygwin64:
-	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) $(LIBS_CYGWIN64) $(RES_CYGWIN64)
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LIBS_CYGWIN) $(LIBS_CYGWIN64) $(RES_CYGWIN64) $(LDFLAGS)
 cygwin32:
-	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) $(LIBS_CYGWIN32) $(RES_CYGWIN32)
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LIBS_CYGWIN) $(LIBS_CYGWIN32) $(RES_CYGWIN32) $(LDFLAGS)
 cygwin: cygwin64
 
 clean:

nfq/conntrack.c

@@ -27,11 +27,8 @@ static void connswap(const t_conn *c, t_conn *c2)
 
 void ConntrackClearHostname(t_ctrack *track)
 {
-	if (track->hostname)
-	{
-		free(track->hostname);
-		track->hostname = NULL;
-	}
+	free(track->hostname);
+	track->hostname = NULL;
 }
 static void ConntrackClearTrack(t_ctrack *track)
 {
@@ -349,11 +346,8 @@ void ConntrackPoolDump(const t_conntrack *p)
 
 void ReasmClear(t_reassemble *reasm)
 {
-	if (reasm->packet)
-	{
-		free(reasm->packet);
-		reasm->packet = NULL;
-	}
+	free(reasm->packet);
+	reasm->packet = NULL;
 	reasm->size = reasm->size_present = 0;
 }
 bool ReasmInit(t_reassemble *reasm, size_t size_requested, uint32_t seq_start)

nfq/darkmagic.c

@@ -1747,7 +1747,9 @@ nofix:
 	bytes = sendto(sock, data, len, 0, (struct sockaddr*)&dst2, salen);
 	if (bytes==-1)
 	{
-		DLOG_PERROR("rawsend: sendto");
+		char s[40];
+		snprintf(s,sizeof(s),"rawsend: sendto (%zu)",len);
+		DLOG_PERROR(s);
 		return false;
 	}
 	return true;

nfq/desync.c

@@ -16,72 +16,72 @@ const char *fake_http_request_default = "GET / HTTP/1.1\r\nHost: www.iana.org\r\
                                         "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\n"
                                         "Accept-Encoding: gzip, deflate, br\r\n\r\n";
 
-// random : +11 size 32
-// random : +44 size 32
-// sni : gatech.edu +125 size 11
-const uint8_t fake_tls_clienthello_default[648] = {
-0x16,0x03,0x01,0x02,0x83,0x01,0x00,0x02,0x7f,0x03,0x03,0x98,0xfb,0x69,0x1d,0x31,
-0x66,0xc4,0xd8,0x07,0x25,0x2b,0x74,0x47,0x01,0x44,0x09,0x08,0xcf,0x13,0x67,0xe0,
-0x46,0x19,0x1f,0xcb,0xee,0xe6,0x8e,0x33,0xb9,0x91,0xa0,0x20,0xf2,0xed,0x56,0x73,
-0xa4,0x0a,0xce,0xa6,0xad,0xd2,0xfd,0x71,0xb8,0xb9,0xfd,0x06,0x0e,0xdd,0xf0,0x57,
-0x37,0x7d,0x96,0xb5,0x80,0x6e,0x54,0xe2,0x15,0xce,0x5f,0xff,0x00,0x22,0x13,0x01,
-0x13,0x03,0x13,0x02,0xc0,0x2b,0xc0,0x2f,0xcc,0xa9,0xcc,0xa8,0xc0,0x2c,0xc0,0x30,
-0xc0,0x0a,0xc0,0x09,0xc0,0x13,0xc0,0x14,0x00,0x9c,0x00,0x9d,0x00,0x2f,0x00,0x35,
-0x01,0x00,0x02,0x14,0x00,0x00,0x00,0x0f,0x00,0x0d,0x00,0x00,0x0a,0x67,0x61,0x74,
-0x65,0x63,0x68,0x2e,0x65,0x64,0x75,0x00,0x17,0x00,0x00,0xff,0x01,0x00,0x01,0x00,
-0x00,0x0a,0x00,0x0e,0x00,0x0c,0x00,0x1d,0x00,0x17,0x00,0x18,0x00,0x19,0x01,0x00,
-0x01,0x01,0x00,0x0b,0x00,0x02,0x01,0x00,0x00,0x10,0x00,0x0e,0x00,0x0c,0x02,0x68,
-0x32,0x08,0x68,0x74,0x74,0x70,0x2f,0x31,0x2e,0x31,0x00,0x05,0x00,0x05,0x01,0x00,
-0x00,0x00,0x00,0x00,0x22,0x00,0x0a,0x00,0x08,0x04,0x03,0x05,0x03,0x06,0x03,0x02,
-0x03,0x00,0x33,0x00,0x6b,0x00,0x69,0x00,0x1d,0x00,0x20,0x72,0xe5,0xce,0x58,0x31,
-0x3c,0x08,0xaa,0x2f,0xa8,0x40,0xe7,0x7a,0xdf,0x46,0x5b,0x63,0x62,0xc7,0xfa,0x49,
-0x18,0xac,0xa1,0x00,0x7c,0x42,0xc5,0x02,0x94,0x5c,0x44,0x00,0x17,0x00,0x41,0x04,
-0x8f,0x3e,0x5f,0xd4,0x7f,0x37,0x47,0xd3,0x33,0x70,0x38,0x7f,0x11,0x35,0xc1,0x55,
-0x8a,0x6c,0xc7,0x5a,0xd4,0xf7,0x31,0xbb,0x9e,0xee,0xd1,0x8f,0x74,0xdd,0x9b,0xbb,
-0x91,0xa1,0x72,0xda,0xeb,0xf6,0xc6,0x82,0x84,0xfe,0xb7,0xfd,0x7b,0xe1,0x9f,0xd2,
-0xb9,0x3e,0x83,0xa6,0x9c,0xac,0x81,0xe2,0x00,0xd5,0x19,0x55,0x91,0xa7,0x0c,0x29,
-0x00,0x2b,0x00,0x05,0x04,0x03,0x04,0x03,0x03,0x00,0x0d,0x00,0x18,0x00,0x16,0x04,
-0x03,0x05,0x03,0x06,0x03,0x08,0x04,0x08,0x05,0x08,0x06,0x04,0x01,0x05,0x01,0x06,
-0x01,0x02,0x03,0x02,0x01,0x00,0x1c,0x00,0x02,0x40,0x01,0xfe,0x0d,0x01,0x19,0x00,
-0x00,0x01,0x00,0x01,0xfe,0x00,0x20,0xae,0x8b,0x30,0x3c,0xf0,0xa9,0x0d,0xa1,0x69,
-0x95,0xb8,0xe2,0xed,0x08,0x6d,0x48,0xdf,0xf7,0x5b,0x9d,0x66,0xef,0x15,0x97,0xbc,
-0x2c,0x99,0x91,0x12,0x7a,0x35,0xd0,0x00,0xef,0xb1,0x8d,0xff,0x61,0x57,0x52,0xef,
-0xd6,0xea,0xbf,0xf3,0x6d,0x78,0x14,0x38,0xff,0xeb,0x58,0xe8,0x9d,0x59,0x4b,0xd5,
-0x9f,0x59,0x12,0xf9,0x03,0x9a,0x20,0x37,0x85,0x77,0xb1,0x4c,0xd8,0xef,0xa6,0xc8,
-0x54,0x8d,0x07,0x27,0x95,0xce,0xd5,0x37,0x4d,0x69,0x18,0xd4,0xfd,0x5e,0xdf,0x64,
-0xcc,0x10,0x2f,0x7f,0x0e,0xc9,0xfd,0xd4,0xd0,0x18,0x61,0x1b,0x57,0x8f,0x41,0x7f,
-0x6f,0x4f,0x5c,0xad,0x04,0xc6,0x5e,0x74,0x54,0x87,0xba,0x28,0xe6,0x11,0x0b,0x9d,
-0x3f,0x0b,0x6d,0xf4,0x2d,0xfc,0x31,0x4e,0xfd,0x49,0xe7,0x15,0x96,0xaf,0xee,0x9a,
-0x48,0x1b,0xae,0x5e,0x7c,0x20,0xbe,0xb4,0xec,0x68,0xb6,0x74,0x22,0xa0,0xec,0xff,
-0x19,0x96,0xe4,0x10,0x8f,0x3c,0x91,0x88,0xa1,0xcc,0x78,0xef,0x4e,0x0e,0xe3,0xb6,
-0x57,0x8c,0x33,0xef,0xaa,0xb0,0x1d,0x45,0x1c,0x02,0x4c,0xe2,0x80,0x30,0xe8,0x48,
-0x7a,0x09,0x71,0x94,0x7c,0xb6,0x75,0x81,0x1c,0xae,0xe3,0x3f,0xde,0xea,0x2b,0x45,
-0xcc,0xe3,0x64,0x09,0xf7,0x60,0x26,0x0c,0x7d,0xad,0x55,0x65,0xb6,0xf5,0x85,0x04,
-0x64,0x2f,0x97,0xd0,0x6a,0x06,0x36,0xcd,0x25,0xda,0x51,0xab,0xd6,0xf7,0x5e,0xeb,
-0xd4,0x03,0x39,0xa4,0xc4,0x2a,0x9c,0x17,0xe8,0xb0,0x9f,0xc0,0xd3,0x8c,0x76,0xdd,
-0xa1,0x0b,0x76,0x9f,0x23,0xfa,0xed,0xfb,0xd7,0x78,0x0f,0x00,0xf7,0x45,0x03,0x04,
-0x84,0x66,0x6b,0xec,0xc7,0xed,0xbc,0xe4
+// SNI - www.microsoft.com
+const uint8_t fake_tls_clienthello_default[680] = {
+  0x16, 0x03, 0x01, 0x02, 0xa3, 0x01, 0x00, 0x02, 0x9f, 0x03, 0x03, 0x41,
+  0x88, 0x82, 0x2d, 0x4f, 0xfd, 0x81, 0x48, 0x9e, 0xe7, 0x90, 0x65, 0x1f,
+  0xba, 0x05, 0x7b, 0xff, 0xa7, 0x5a, 0xf9, 0x5b, 0x8a, 0x8f, 0x45, 0x8b,
+  0x41, 0xf0, 0x3d, 0x1b, 0xdd, 0xe3, 0xf8, 0x20, 0x9b, 0x23, 0xa5, 0xd2,
+  0x21, 0x1e, 0x9f, 0xe7, 0x85, 0x6c, 0xfc, 0x61, 0x80, 0x3a, 0x3f, 0xba,
+  0xb9, 0x60, 0xba, 0xb3, 0x0e, 0x98, 0x27, 0x6c, 0xf7, 0x38, 0x28, 0x65,
+  0x80, 0x5d, 0x40, 0x38, 0x00, 0x22, 0x13, 0x01, 0x13, 0x03, 0x13, 0x02,
+  0xc0, 0x2b, 0xc0, 0x2f, 0xcc, 0xa9, 0xcc, 0xa8, 0xc0, 0x2c, 0xc0, 0x30,
+  0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x13, 0xc0, 0x14, 0x00, 0x9c, 0x00, 0x9d,
+  0x00, 0x2f, 0x00, 0x35, 0x01, 0x00, 0x02, 0x34, 0x00, 0x00, 0x00, 0x16,
+  0x00, 0x14, 0x00, 0x00, 0x11, 0x77, 0x77, 0x77, 0x2e, 0x6d, 0x69, 0x63,
+  0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x00, 0x17,
+  0x00, 0x00, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00, 0x0e, 0x00,
+  0x0c, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x01, 0x00, 0x01,
+  0x01, 0x00, 0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00,
+  0x10, 0x00, 0x0e, 0x00, 0x0c, 0x02, 0x68, 0x32, 0x08, 0x68, 0x74, 0x74,
+  0x70, 0x2f, 0x31, 0x2e, 0x31, 0x00, 0x05, 0x00, 0x05, 0x01, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x22, 0x00, 0x0a, 0x00, 0x08, 0x04, 0x03, 0x05, 0x03,
+  0x06, 0x03, 0x02, 0x03, 0x00, 0x12, 0x00, 0x00, 0x00, 0x33, 0x00, 0x6b,
+  0x00, 0x69, 0x00, 0x1d, 0x00, 0x20, 0x69, 0x15, 0x16, 0x29, 0x6d, 0xad,
+  0xd5, 0x68, 0x88, 0x27, 0x2f, 0xde, 0xaf, 0xac, 0x3c, 0x4c, 0xa4, 0xe4,
+  0xd8, 0xc8, 0xfb, 0x41, 0x87, 0xf4, 0x76, 0x4e, 0x0e, 0xfa, 0x64, 0xc4,
+  0xe9, 0x29, 0x00, 0x17, 0x00, 0x41, 0x04, 0xfe, 0x62, 0xb9, 0x08, 0xc8,
+  0xc3, 0x2a, 0xb9, 0x87, 0x37, 0x84, 0x42, 0x6b, 0x5c, 0xcd, 0xc9, 0xca,
+  0x62, 0x38, 0xd3, 0xd9, 0x99, 0x8a, 0xc4, 0x2d, 0xc6, 0xd0, 0xa3, 0x60,
+  0xb2, 0x12, 0x54, 0x41, 0x8e, 0x52, 0x5e, 0xe3, 0xab, 0xf9, 0xc2, 0x07,
+  0x81, 0xdc, 0xf8, 0xf2, 0x6a, 0x91, 0x40, 0x2f, 0xcb, 0xa4, 0xff, 0x6f,
+  0x24, 0xc7, 0x4d, 0x77, 0x77, 0x2d, 0x6f, 0xe0, 0x77, 0xaa, 0x92, 0x00,
+  0x2b, 0x00, 0x05, 0x04, 0x03, 0x04, 0x03, 0x03, 0x00, 0x0d, 0x00, 0x18,
+  0x00, 0x16, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x08, 0x04, 0x08, 0x05,
+  0x08, 0x06, 0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x03, 0x02, 0x01,
+  0x00, 0x2d, 0x00, 0x02, 0x01, 0x01, 0x00, 0x1c, 0x00, 0x02, 0x40, 0x01,
+  0x00, 0x1b, 0x00, 0x07, 0x06, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0xfe,
+  0x0d, 0x01, 0x19, 0x00, 0x00, 0x01, 0x00, 0x03, 0x21, 0x00, 0x20, 0x62,
+  0xe8, 0x83, 0xd8, 0x97, 0x05, 0x8a, 0xbe, 0xa1, 0xf2, 0x63, 0x4e, 0xce,
+  0x93, 0x84, 0x8e, 0xcf, 0xe7, 0xdd, 0xb2, 0xe4, 0x87, 0x06, 0xac, 0x11,
+  0x19, 0xbe, 0x0e, 0x71, 0x87, 0xf1, 0xa6, 0x00, 0xef, 0xd8, 0x6b, 0x27,
+  0x5e, 0xc0, 0xa7, 0x5d, 0x42, 0x4e, 0x8c, 0xdc, 0xf3, 0x9f, 0x1c, 0x51,
+  0x62, 0xef, 0xff, 0x5b, 0xed, 0xc8, 0xfd, 0xee, 0x6f, 0xbb, 0x88, 0x9b,
+  0xb1, 0x30, 0x9c, 0x66, 0x42, 0xab, 0x0f, 0x66, 0x89, 0x18, 0x8b, 0x11,
+  0xc1, 0x6d, 0xe7, 0x2a, 0xeb, 0x96, 0x3b, 0x7f, 0x52, 0x78, 0xdb, 0xf8,
+  0x6d, 0x04, 0xf7, 0x95, 0x1a, 0xa8, 0xf0, 0x64, 0x52, 0x07, 0x39, 0xf0,
+  0xa8, 0x1d, 0x0d, 0x16, 0x36, 0xb7, 0x18, 0x0e, 0xc8, 0x44, 0x27, 0xfe,
+  0xf3, 0x31, 0xf0, 0xde, 0x8c, 0x74, 0xf5, 0xa1, 0xd8, 0x8f, 0x6f, 0x45,
+  0x97, 0x69, 0x79, 0x5e, 0x2e, 0xd4, 0xb0, 0x2c, 0x0c, 0x1a, 0x6f, 0xcc,
+  0xce, 0x90, 0xc7, 0xdd, 0xc6, 0x60, 0x95, 0xf3, 0xc2, 0x19, 0xde, 0x50,
+  0x80, 0xbf, 0xde, 0xf2, 0x25, 0x63, 0x15, 0x26, 0x63, 0x09, 0x1f, 0xc5,
+  0xdf, 0x32, 0xf5, 0xea, 0x9c, 0xd2, 0xff, 0x99, 0x4e, 0x67, 0xa2, 0xe5,
+  0x1a, 0x94, 0x85, 0xe3, 0xdf, 0x36, 0xa5, 0x83, 0x4b, 0x0a, 0x1c, 0xaf,
+  0xd7, 0x48, 0xc9, 0x4b, 0x8a, 0x27, 0xdd, 0x58, 0x7f, 0x95, 0xf2, 0x6b,
+  0xde, 0x2b, 0x12, 0xd3, 0xec, 0x4d, 0x69, 0x37, 0x9c, 0x13, 0x9b, 0x16,
+  0xb0, 0x45, 0x52, 0x38, 0x77, 0x69, 0xef, 0xaa, 0x65, 0x19, 0xbc, 0xc2,
+  0x93, 0x4d, 0xb0, 0x1b, 0x7f, 0x5b, 0x41, 0xff, 0xaf, 0xba, 0x50, 0x51,
+  0xc3, 0xf1, 0x27, 0x09, 0x25, 0xf5, 0x60, 0x90, 0x09, 0xb1, 0xe5, 0xc0,
+  0xc7, 0x42, 0x78, 0x54, 0x3b, 0x23, 0x19, 0x7d, 0x8e, 0x72, 0x13, 0xb4,
+  0xd3, 0xcd, 0x63, 0xb6, 0xc4, 0x4a, 0x28, 0x3d, 0x45, 0x3e, 0x8b, 0xdb,
+  0x84, 0x4f, 0x78, 0x64, 0x30, 0x69, 0xe2, 0x1b
 };
 
-static const char * tld[]={"com","org","net","edu","gov","biz"};
-void randomize_default_tls_payload(uint8_t *p)
-{
-	fill_random_bytes(p+11,32);
-	fill_random_bytes(p+44,32);
-	fill_random_az(p+125,1);
-	fill_random_az09(p+126,5);
-	memcpy(p+132,tld[random()%(sizeof(tld)/sizeof(*tld))],3);
-}
-
 #define PKTDATA_MAXDUMP 32
 #define IP_MAXDUMP 80
 
-static uint8_t zeropkt[DPI_DESYNC_MAX_FAKE_LEN];
-
-void desync_init(void)
-{
-	memset(zeropkt, 0, sizeof(zeropkt));
-}
+#define TCP_MAX_REASM 16384
+#define UDP_MAX_REASM 16384
 
 bool desync_valid_zero_stage(enum dpi_desync_mode mode)
 {
@@ -364,17 +364,18 @@ static void auto_hostlist_failed(struct desync_profile *dp, const char *hostname
 		{
 			DLOG("auto hostlist (profile %d) : adding %s to %s\n", dp->n, hostname, dp->hostlist_auto->filename);
 			HOSTLIST_DEBUGLOG_APPEND("%s : profile %d : client %s : proto %s : adding to %s", hostname, dp->n, client_ip_port, l7proto_str(l7proto), dp->hostlist_auto->filename);
-			if (!StrPoolAddStr(&dp->hostlist_auto->hostlist, hostname))
+			if (!HostlistPoolAddStr(&dp->hostlist_auto->hostlist, hostname, 0))
 			{
 				DLOG_ERR("StrPoolAddStr out of memory\n");
 				return;
 			}
 			if (!append_to_list_file(dp->hostlist_auto->filename, hostname))
 			{
-				DLOG_PERROR("write to auto hostlist:");
+				DLOG_PERROR("write to auto hostlist");
 				return;
 			}
-			dp->hostlist_auto->mod_time = file_mod_time(dp->hostlist_auto->filename);
+			if (!file_mod_signature(dp->hostlist_auto->filename, &dp->hostlist_auto->mod_sig))
+				DLOG_PERROR("file_mod_signature");
 		}
 		else
 		{
@@ -619,6 +620,61 @@ static uint16_t IP4_IP_ID_FIX(const struct ip *ip)
 #endif
 
 
+// fake_mod buffer must at least sizeof(desync_profile->fake_tls)
+// size does not change
+// return : true - altered, false - not altered
+static bool runtime_tls_mod(int fake_n,const struct fake_tls_mod_cache *modcache, const struct fake_tls_mod *tls_mod, const uint8_t *fake_data, size_t fake_data_size, const uint8_t *payload, size_t payload_len, uint8_t *fake_mod)
+{
+	bool b=false;
+	if (modcache) // it's filled only if it's TLS
+	{
+		if (tls_mod->mod & FAKE_TLS_MOD_PADENCAP)
+		{
+			size_t sz_rec = pntoh16(fake_data+3) + payload_len;
+			size_t sz_handshake = pntoh24(fake_data+6) + payload_len;
+			size_t sz_ext = pntoh16(fake_data+modcache->extlen_offset) + payload_len;
+			size_t sz_pad = pntoh16(fake_data+modcache->padlen_offset) + payload_len;
+			if ((sz_rec & ~0xFFFF) || (sz_handshake & ~0xFFFFFF) || (sz_ext & ~0xFFFF) || (sz_pad & ~0xFFFF))
+				DLOG("fake[%d] cannot apply padencap tls mod. length overflow.\n", fake_n);
+			else
+			{
+				memcpy(fake_mod,fake_data,fake_data_size);
+				phton16(fake_mod+3,(uint16_t)sz_rec);
+				phton24(fake_mod+6,(uint32_t)sz_handshake);
+				phton16(fake_mod+modcache->extlen_offset,(uint16_t)sz_ext);
+				phton16(fake_mod+modcache->padlen_offset,(uint16_t)sz_pad);
+				b=true;
+				DLOG("fake[%d] applied padencap tls mod. sizes increased by %zu bytes.\n", fake_n, payload_len);
+			}
+		}
+		if (tls_mod->mod & FAKE_TLS_MOD_RND)
+		{
+			if (!b)	memcpy(fake_mod,fake_data,fake_data_size);
+			fill_random_bytes(fake_mod+11,32); // random
+			fill_random_bytes(fake_mod+44,fake_mod[43]); // session id
+			b=true;
+			DLOG("fake[%d] applied rnd tls mod\n", fake_n);
+		}
+		if (tls_mod->mod & FAKE_TLS_MOD_DUP_SID)
+		{
+			if (payload_len<44)
+				DLOG("fake[%d] cannot apply dupsid tls mod. data payload is too short.\n",fake_n);
+			else if (fake_data[43]!=payload[43])
+				DLOG("fake[%d] cannot apply dupsid tls mod. fake and orig session id length mismatch.\n",fake_n);
+			else if (payload_len<(44+payload[43]))
+				DLOG("fake[%d] cannot apply dupsid tls mod. data payload is not valid.\n",fake_n);
+			else
+			{
+				if (!b)	memcpy(fake_mod,fake_data,fake_data_size);
+				memcpy(fake_mod+44,payload+44,fake_mod[43]); // session id
+				b=true;
+				DLOG("fake[%d] applied dupsid tls mod\n", fake_n);
+			}
+		}
+	}
+	return b;
+}
+
 static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint32_t fwmark, const char *ifout, struct dissect *dis)
 {
 	uint8_t verdict=VERDICT_PASS;
@@ -849,8 +905,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 
 	if (!(dis->tcp->th_flags & TH_SYN) && dis->len_payload)
 	{
-		const uint8_t *fake;
-		size_t fake_size;
+		struct blob_collection_head *fake;
+
 		char host[256];
 		bool bHaveHost=false;
 		uint8_t *p, *phost=NULL;
@@ -920,7 +976,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 					!(ctrack->req_seq_finalized && seq_within(ctrack->seq_last, ctrack->req_seq_start, ctrack->req_seq_end)))
 				{
 					// do not reconstruct unexpected large payload (they are feeding garbage ?)
-					if (!reasm_orig_start(ctrack,IPPROTO_TCP,TLSRecordLen(dis->data_payload),16384,dis->data_payload,dis->len_payload))
+					if (!reasm_orig_start(ctrack,IPPROTO_TCP,TLSRecordLen(dis->data_payload),TCP_MAX_REASM,dis->data_payload,dis->len_payload))
 					{
 						reasm_orig_cancel(ctrack);
 						return verdict;
@@ -1151,16 +1207,13 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 		switch(l7proto)
 		{
 			case HTTP:
-				fake = dp->fake_http;
-				fake_size = dp->fake_http_size;
+				fake = &dp->fake_http;
 				break;
 			case TLS:
-				fake = dp->fake_tls;
-				fake_size = dp->fake_tls_size;
+				fake = &dp->fake_tls;
 				break;
 			default:
-				fake = dp->fake_unknown;
-				fake_size = dp->fake_unknown_size;
+				fake = &dp->fake_unknown;
 				break;
 		}
 		if (dp->desync_mode==DESYNC_MULTISPLIT || dp->desync_mode==DESYNC_MULTIDISORDER || dp->desync_mode2==DESYNC_MULTISPLIT || dp->desync_mode2==DESYNC_MULTIDISORDER)
@@ -1241,13 +1294,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 		else
 			seqovl_pos = 0;
 
-		// we do not need reasm buffer anymore
-		reasm_orig_cancel(ctrack);
-		rdata_payload=NULL;
-
 		uint32_t fooling_orig = FOOL_NONE;
 		bool bFake = false;
-		pkt1_len = sizeof(pkt1);
 		switch(dp->desync_mode)
 		{
 			case DESYNC_FAKE_KNOWN:
@@ -1259,28 +1307,69 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 				}
 			case DESYNC_FAKE:
 				if (reasm_offset) break;
-				if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
-					ttl_fake,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),
-					dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
-					fake, fake_size, pkt1, &pkt1_len))
+
 				{
-					return verdict;
+					struct blob_item *fake_item;
+					uint8_t *fake_data;
+					uint8_t fake_data_buf[FAKE_MAX_TCP];
+					int n=0;
+
+					ip_id = IP4_IP_ID_FIX(dis->ip);
+
+					LIST_FOREACH(fake_item, fake, next)
+					{
+						n++;
+						switch(l7proto)
+						{
+							case TLS:
+								if ((fake_item->size <= sizeof(fake_data_buf)) &&
+									runtime_tls_mod(n,(struct fake_tls_mod_cache *)fake_item->extra,(struct fake_tls_mod *)fake_item->extra2, fake_item->data, fake_item->size, rdata_payload, rlen_payload, fake_data_buf))
+								{
+									fake_data = fake_data_buf;
+									break;
+								}
+							default:
+								fake_data = fake_item->data;
+						}
+						pkt1_len = sizeof(pkt1);
+						if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
+							ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
+							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
+							fake_data, fake_item->size, pkt1, &pkt1_len))
+						{
+							reasm_orig_cancel(ctrack);
+							return verdict;
+						}
+						DLOG("sending fake[%d] : ", n);
+						hexdump_limited_dlog(fake_data,fake_item->size,PKTDATA_MAXDUMP); DLOG("\n");
+						if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
+						{
+							reasm_orig_cancel(ctrack);
+							return verdict;
+						}
+						ip_id=IP4_IP_ID_NEXT(ip_id);
+					}
 				}
-				DLOG("sending fake : ");
-				hexdump_limited_dlog(fake,fake_size,PKTDATA_MAXDUMP); DLOG("\n");
 				bFake = true;
 				break;
 			case DESYNC_RST:
 			case DESYNC_RSTACK:
 				if (reasm_offset) break;
+				pkt1_len = sizeof(pkt1);
 				if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_RST | (dp->desync_mode==DESYNC_RSTACK ? TH_ACK:0), dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
 					ttl_fake,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),
 					dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
 					NULL, 0, pkt1, &pkt1_len))
 				{
+					reasm_orig_cancel(ctrack);
 					return verdict;
 				}
 				DLOG("sending fake RST/RSTACK\n");
+				if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
+				{
+					reasm_orig_cancel(ctrack);
+					return verdict;
+				}
 				bFake = true;
 				break;
 			case DESYNC_HOPBYHOP:
@@ -1291,8 +1380,12 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 					(!split_pos && (dp->desync_mode2==DESYNC_FAKEDSPLIT || dp->desync_mode2==DESYNC_FAKEDDISORDER)) ||
 					(!multisplit_count && (dp->desync_mode2==DESYNC_MULTISPLIT || dp->desync_mode2==DESYNC_MULTIDISORDER))))
 				{
+					reasm_orig_cancel(ctrack);
+					rdata_payload=NULL;
+
+					pkt1_len = sizeof(pkt1);
 					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
-						ttl_orig,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),
+						ttl_orig,0,0,IP6_FLOW(dis->ip6),
 						fooling_orig,0,0,
 						dis->data_payload, dis->len_payload, pkt1, &pkt1_len))
 					{
@@ -1309,11 +1402,9 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 				break;
 		}
 
-		if (bFake)
-		{
-			if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
-				return verdict;
-		}
+		// we do not need reasm buffer anymore
+		reasm_orig_cancel(ctrack);
+		rdata_payload=NULL;
 
 		enum dpi_desync_mode desync_mode = dp->desync_mode2==DESYNC_NONE ? dp->desync_mode : dp->desync_mode2;
 		switch(desync_mode)
@@ -1334,7 +1425,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 						// do seqovl only to the first packet
 						// otherwise it's prone to race condition on server side
 						// what happens first : server pushes socket buffer to process or another packet with seqovl arrives
-						seqovl = i==0 ? seqovl_pos : 0;
+						seqovl = (i==0 && reasm_offset==0) ? seqovl_pos : 0;
 #ifdef __linux__
 // only linux return error if MTU is exceeded
 						for(;;seqovl=0)
@@ -1580,7 +1671,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
 						return verdict;
 
-					unsigned int seqovl = seqovl_pos;
+					unsigned int seqovl = reasm_offset ? 0 : seqovl_pos;
 #ifdef __linux__
 // only linux return error if MTU is exceeded
 					for(;;seqovl=0)
@@ -1843,8 +1934,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 
 	if (dis->len_payload)
 	{
-		const uint8_t *fake;
-		size_t fake_size;
+		struct blob_collection_head *fake;
 		char host[256];
 		bool bHaveHost=false;
 		uint16_t ip_id;
@@ -1885,29 +1975,82 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 						return verdict; // cannot be first packet
 					}
 				}
-
-				uint8_t defrag[16384];
+				uint8_t defrag[UDP_MAX_REASM];
 				size_t hello_offset, hello_len, defrag_len = sizeof(defrag);
-				if (QUICDefragCrypto(pclean,clean_len,defrag,&defrag_len))
+				bool bFull;
+				if (QUICDefragCrypto(pclean,clean_len,defrag,&defrag_len,&bFull))
 				{
-					bool bIsHello = IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len);
-					bool bReqFull = bIsHello ? IsTLSHandshakeFull(defrag+hello_offset,hello_len) : false;
-
-					DLOG(bIsHello ? bReqFull ? "packet contains full TLS ClientHello\n" : "packet contains partial TLS ClientHello\n" : "packet does not contain TLS ClientHello\n");
-
-					if (ctrack)
+					if (bFull)
 					{
-						if (bIsHello && !bReqFull && ReasmIsEmpty(&ctrack->reasm_orig))
+						DLOG("QUIC initial contains CRYPTO with full fragment coverage\n");
+
+						bool bIsHello = IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len);
+						bool bReqFull = bIsHello ? IsTLSHandshakeFull(defrag+hello_offset,hello_len) : false;
+
+						DLOG(bIsHello ? bReqFull ? "packet contains full TLS ClientHello\n" : "packet contains partial TLS ClientHello\n" : "packet does not contain TLS ClientHello\n");
+
+						if (ctrack)
 						{
-							// preallocate max buffer to avoid reallocs that cause memory copy
-							if (!reasm_orig_start(ctrack,IPPROTO_UDP,16384,16384,clean,clean_len))
+							if (bIsHello && !bReqFull && ReasmIsEmpty(&ctrack->reasm_orig))
+							{
+								// preallocate max buffer to avoid reallocs that cause memory copy
+								if (!reasm_orig_start(ctrack,IPPROTO_UDP,UDP_MAX_REASM,UDP_MAX_REASM,clean,clean_len))
+								{
+									reasm_orig_cancel(ctrack);
+									return verdict;
+								}
+							}
+							if (!ReasmIsEmpty(&ctrack->reasm_orig))
+							{
+								verdict_udp_csum_fix(verdict, dis->udp, dis->transport_len, dis->ip, dis->ip6);
+								if (rawpacket_queue(&ctrack->delayed, &dst, desync_fwmark, ifout, dis->data_pkt, dis->len_pkt, dis->len_payload))
+								{
+									DLOG("DELAY desync until reasm is complete (#%u)\n", rawpacket_queue_count(&ctrack->delayed));
+								}
+								else
+								{
+									DLOG_ERR("rawpacket_queue failed !\n");
+									reasm_orig_cancel(ctrack);
+									return verdict;
+								}
+								if (bReqFull)
+								{
+									replay_queue(&ctrack->delayed);
+									reasm_orig_fin(ctrack);
+								}
+								return ct_new_postnat_fix_udp(ctrack, dis->ip, dis->ip6, dis->udp, &dis->len_pkt);
+							}
+						}
+
+						if (bIsHello)
+						{
+							bHaveHost = TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, sizeof(host), TLS_PARTIALS_ENABLE);
+							if (!bHaveHost && dp->desync_skip_nosni)
 							{
 								reasm_orig_cancel(ctrack);
+								DLOG("not applying tampering to QUIC ClientHello without hostname in the SNI\n");
 								return verdict;
 							}
 						}
-						if (!ReasmIsEmpty(&ctrack->reasm_orig))
+						else
 						{
+							if (!quic_reasm_cancel(ctrack,"QUIC initial without ClientHello")) return verdict;
+						}
+					}
+					else
+					{
+						DLOG("QUIC initial contains CRYPTO with partial fragment coverage\n");
+						if (ctrack)
+						{
+							if (ReasmIsEmpty(&ctrack->reasm_orig))
+							{
+								// preallocate max buffer to avoid reallocs that cause memory copy
+								if (!reasm_orig_start(ctrack,IPPROTO_UDP,UDP_MAX_REASM,UDP_MAX_REASM,clean,clean_len))
+								{
+									reasm_orig_cancel(ctrack);
+									return verdict;
+								}
+							}
 							verdict_udp_csum_fix(verdict, dis->udp, dis->transport_len, dis->ip, dis->ip6);
 							if (rawpacket_queue(&ctrack->delayed, &dst, desync_fwmark, ifout, dis->data_pkt, dis->len_pkt, dis->len_payload))
 							{
@@ -1919,28 +2062,9 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 								reasm_orig_cancel(ctrack);
 								return verdict;
 							}
-							if (bReqFull)
-							{
-								replay_queue(&ctrack->delayed);
-								reasm_orig_fin(ctrack);
-							}
 							return ct_new_postnat_fix_udp(ctrack, dis->ip, dis->ip6, dis->udp, &dis->len_pkt);
 						}
-					}
-			
-					if (bIsHello)
-					{
-						bHaveHost = TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, sizeof(host), TLS_PARTIALS_ENABLE);
-						if (!bHaveHost && dp->desync_skip_nosni)
-						{
-							reasm_orig_cancel(ctrack);
-							DLOG("not applying tampering to QUIC ClientHello without hostname in the SNI\n");
-							return verdict;
-						}
-					}
-					else
-					{
-						if (!quic_reasm_cancel(ctrack,"QUIC initial without ClientHello")) return verdict;
+						if (!quic_reasm_cancel(ctrack,"QUIC initial fragmented CRYPTO")) return verdict;
 					}
 				}
 				else
@@ -1959,7 +2083,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 		{
 			// received payload without host. it means we are out of the request retransmission phase. stop counter
 			ctrack_stop_retrans_counter(ctrack);
-			
+
 			reasm_orig_cancel(ctrack);
 
 			if (IsWireguardHandshakeInitiation(dis->data_payload,dis->len_payload))
@@ -1974,6 +2098,18 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 				l7proto = DHT;
 				if (ctrack && ctrack->l7proto==UNKNOWN) ctrack->l7proto = l7proto;
 			}
+			else if (IsDiscordIpDiscoveryRequest(dis->data_payload,dis->len_payload))
+			{
+				DLOG("packet contains discord voice IP discovery\n");
+				l7proto = DISCORD;
+				if (ctrack && ctrack->l7proto==UNKNOWN) ctrack->l7proto = l7proto;
+			}
+			else if (IsStunMessage(dis->data_payload,dis->len_payload))
+			{
+				DLOG("packet contains STUN message\n");
+				l7proto = STUN;
+				if (ctrack && ctrack->l7proto==UNKNOWN) ctrack->l7proto = l7proto;
+			}
 			else
 			{
 				if (!dp->desync_any_proto)
@@ -2078,20 +2214,22 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 		switch(l7proto)
 		{
 			case QUIC:
-				fake = dp->fake_quic;
-				fake_size = dp->fake_quic_size;
+				fake = &dp->fake_quic;
 				break;
 			case WIREGUARD:
-				fake = dp->fake_wg;
-				fake_size = dp->fake_wg_size;
+				fake = &dp->fake_wg;
 				break;
 			case DHT:
-				fake = dp->fake_dht;
-				fake_size = dp->fake_dht_size;
+				fake = &dp->fake_dht;
+				break;
+			case DISCORD:
+				fake = &dp->fake_discord;
+				break;
+			case STUN:
+				fake = &dp->fake_stun;
 				break;
 			default:
-				fake = dp->fake_unknown_udp;
-				fake_size = dp->fake_unknown_udp_size;
+				fake = &dp->fake_unknown_udp;
 				break;
 		}
 
@@ -2108,7 +2246,6 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 		}
 
 		bool bFake = false;
-		pkt1_len = sizeof(pkt1);
 		switch(dp->desync_mode)
 		{
 			case DESYNC_FAKE_KNOWN:
@@ -2118,12 +2255,30 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 					break;
 				}
 			case DESYNC_FAKE:
-				if (!prepare_udp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, ttl_fake, IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6), dp->desync_fooling_mode, NULL, 0, 0, fake, fake_size, pkt1, &pkt1_len))
-					return verdict;
-				DLOG("sending fake : ");
-				hexdump_limited_dlog(fake,fake_size,PKTDATA_MAXDUMP); DLOG("\n");
-				if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
-					return verdict;
+				{
+					struct blob_item *fake_item;
+					int n=0;
+
+					ip_id = IP4_IP_ID_FIX(dis->ip);
+
+					LIST_FOREACH(fake_item, fake, next)
+					{
+						n++;
+						pkt1_len = sizeof(pkt1);
+						if (!prepare_udp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst,
+							ttl_fake, IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
+							dp->desync_fooling_mode, NULL, 0, 0,
+							fake_item->data, fake_item->size, pkt1, &pkt1_len))
+						{
+							return verdict;
+						}
+						DLOG("sending fake[%d] : ", n);
+						hexdump_limited_dlog(fake_item->data,fake_item->size,PKTDATA_MAXDUMP); DLOG("\n");
+						if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
+							return verdict;
+						ip_id=IP4_IP_ID_NEXT(ip_id);
+					}
+				}
 				bFake = true;
 				break;
 			case DESYNC_HOPBYHOP:
@@ -2132,9 +2287,9 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
 				fooling_orig = (dp->desync_mode==DESYNC_HOPBYHOP) ? FOOL_HOPBYHOP : (dp->desync_mode==DESYNC_DESTOPT) ? FOOL_DESTOPT : FOOL_IPFRAG1;
 				if (dis->ip6 && (dp->desync_mode2==DESYNC_NONE || !desync_valid_second_stage_udp(dp->desync_mode2)))
 				{
+					pkt1_len = sizeof(pkt1);
 					if (!prepare_udp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst,
-						ttl_orig,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),
-						fooling_orig,NULL,0,0,
+						ttl_orig,0,0,IP6_FLOW(dis->ip6),fooling_orig,NULL,0,0,
 						dis->data_payload, dis->len_payload, pkt1, &pkt1_len))
 					{
 						return verdict;

nfq/desync.h

@@ -41,7 +41,7 @@ enum dpi_desync_mode {
 };
 
 extern const char *fake_http_request_default;
-extern const uint8_t fake_tls_clienthello_default[648];
+extern const uint8_t fake_tls_clienthello_default[680];
 void randomize_default_tls_payload(uint8_t *p);
 
 enum dpi_desync_mode desync_mode_from_string(const char *s);
@@ -52,5 +52,4 @@ bool desync_valid_second_stage(enum dpi_desync_mode mode);
 bool desync_valid_second_stage_tcp(enum dpi_desync_mode mode);
 bool desync_valid_second_stage_udp(enum dpi_desync_mode mode);
 
-void desync_init(void);
 uint8_t dpi_desync_packet(uint32_t fwmark, const char *ifout, uint8_t *data_pkt, size_t *len_pkt);

nfq/gzip.c

@@ -65,11 +65,8 @@ int z_readfile(FILE *F, char **buf, size_t *size)
 
 zerr:
 	inflateEnd(&zs);
-	if (*buf)
-	{
-		free(*buf);
-		*buf = NULL;
-	}
+	free(*buf);
+	*buf = NULL;
 	return r;
 }
 

nfq/helpers.c

@@ -9,6 +9,7 @@
 #include <ctype.h>
 #include <sys/stat.h>
 #include <libgen.h>
+#include <fcntl.h>
 
 int unique_size_t(size_t *pu, int ct)
 {
@@ -300,6 +301,29 @@ time_t file_mod_time(const char *filename)
 	struct stat st;
 	return stat(filename,&st)==-1 ? 0 : st.st_mtime;
 }
+bool file_mod_signature(const char *filename, file_mod_sig *ms)
+{
+	struct stat st;
+	if (stat(filename,&st)==-1)
+	{
+		FILE_MOD_RESET(ms);
+		return false;
+	}
+	ms->mod_time=st.st_mtime;
+	ms->size=st.st_size;
+	return true;
+}
+
+bool file_open_test(const char *filename, int flags)
+{
+	int fd = open(filename,flags);
+	if (fd>=0)
+	{
+		close(fd);
+		return true;
+	}
+	return false;
+}
 
 bool pf_in_range(uint16_t port, const port_filter *pf)
 {
@@ -367,6 +391,12 @@ void fill_random_az09(uint8_t *p,size_t sz)
 	}
 }
 
+void set_console_io_buffering(void)
+{
+	setvbuf(stdout, NULL, _IOLBF, 0);
+	setvbuf(stderr, NULL, _IOLBF, 0);
+}
+
 bool set_env_exedir(const char *argv0)
 {
 	char *s,*d;

nfq/helpers.h

@@ -51,6 +51,14 @@ static inline void phton16(uint8_t *p, uint16_t v) {
 	p[0] = (uint8_t)(v >> 8);
 	p[1] = v & 0xFF;
 }
+static inline uint32_t pntoh24(const uint8_t *p) {
+	return ((uint32_t)p[0] << 16) | ((uint32_t)p[1] << 8) | (uint32_t)p[2];
+}
+static inline void phton24(uint8_t *p, uint32_t v) {
+	p[0] = (uint8_t)(v>>16);
+	p[1] = (uint8_t)(v>>8);
+	p[2] = (uint8_t)v;
+}
 static inline uint32_t pntoh32(const uint8_t *p) {
 	return ((uint32_t)p[0] << 24) | ((uint32_t)p[1] << 16) | ((uint32_t)p[2] << 8) | (uint32_t)p[3];
 }
@@ -60,7 +68,16 @@ void fill_pattern(uint8_t *buf,size_t bufsize,const void *pattern,size_t patsize
 
 int fprint_localtime(FILE *F);
 
+typedef struct
+{
+	time_t mod_time;
+	off_t size;
+} file_mod_sig;
+#define FILE_MOD_COMPARE(ms1,ms2) (((ms1)->mod_time==(ms2)->mod_time) && ((ms1)->size==(ms2)->size))
+#define FILE_MOD_RESET(ms) memset(ms,0,sizeof(file_mod_sig))
+bool file_mod_signature(const char *filename, file_mod_sig *ms);
 time_t file_mod_time(const char *filename);
+bool file_open_test(const char *filename, int flags);
 
 typedef struct
 {
@@ -75,6 +92,7 @@ void fill_random_bytes(uint8_t *p,size_t sz);
 void fill_random_az(uint8_t *p,size_t sz);
 void fill_random_az09(uint8_t *p,size_t sz);
 
+void set_console_io_buffering(void);
 bool set_env_exedir(const char *argv0);
 
 

nfq/hostlist.c

@@ -4,7 +4,7 @@
 #include "helpers.h"
 
 // inplace tolower() and add to pool
-static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
+static bool addpool(hostlist_pool **hostlist, char **s, const char *end, int *ct)
 {
 	char *p=*s;
 
@@ -17,10 +17,16 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	else
 	{
 		// advance until eol lowering all chars
-		for (; p<end && *p && *p!='\r' && *p != '\n'; p++) *p=tolower(*p);
-		if (!StrPoolAddStrLen(hostlist, *s, p-*s))
+		uint32_t flags = 0;
+		if (*p=='^')
 		{
-			StrPoolDestroy(hostlist);
+			p = ++(*s);
+			flags |= HOSTLIST_POOL_FLAG_STRICT_MATCH;
+		}
+		for (; p<end && *p && *p!='\r' && *p != '\n'; p++) *p=tolower(*p);
+		if (!HostlistPoolAddStrLen(hostlist, *s, p-*s, flags))
+		{
+			HostlistPoolDestroy(hostlist);
 			*hostlist = NULL;
 			return false;
 		}
@@ -32,12 +38,12 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	return true;
 }
 
-bool AppendHostlistItem(strpool **hostlist, char *s)
+bool AppendHostlistItem(hostlist_pool **hostlist, char *s)
 {
 	return addpool(hostlist,&s,s+strlen(s),NULL);
 }
 
-bool AppendHostList(strpool **hostlist, const char *filename)
+bool AppendHostList(hostlist_pool **hostlist, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
 	size_t zsize;
@@ -105,21 +111,22 @@ static bool LoadHostList(struct hostlist_file *hfile)
 {
 	if (hfile->filename)
 	{
-		time_t t = file_mod_time(hfile->filename);
-		if (!t)
+		file_mod_sig fsig;
+		if (!file_mod_signature(hfile->filename, &fsig))
 		{
 			// stat() error
+			DLOG_PERROR("file_mod_signature");
 			DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
 			return true;
 		}
-		if (t==hfile->mod_time) return true; // up to date
-		StrPoolDestroy(&hfile->hostlist);
+		if (FILE_MOD_COMPARE(&hfile->mod_sig,&fsig)) return true; // up to date
+		HostlistPoolDestroy(&hfile->hostlist);
 		if (!AppendHostList(&hfile->hostlist, hfile->filename))
 		{
-			StrPoolDestroy(&hfile->hostlist);
+			HostlistPoolDestroy(&hfile->hostlist);
 			return false;
 		}
-		hfile->mod_time=t;
+		hfile->mod_sig=fsig;
 	}
 	return true;
 }
@@ -137,10 +144,10 @@ static bool LoadHostLists(struct hostlist_files_head *list)
 	return bres;
 }
 
-bool NonEmptyHostlist(strpool **hostlist)
+bool NonEmptyHostlist(hostlist_pool **hostlist)
 {
 	// add impossible hostname if the list is empty
-	return *hostlist ? true : StrPoolAddStrLen(hostlist, "@&()", 4);
+	return *hostlist ? true : HostlistPoolAddStrLen(hostlist, "@&()", 4, 0);
 }
 
 static void MakeAutolistsNonEmpty()
@@ -163,19 +170,34 @@ bool LoadAllHostLists()
 
 
 
-static bool SearchHostList(strpool *hostlist, const char *host)
+static bool SearchHostList(hostlist_pool *hostlist, const char *host)
 {
 	if (hostlist)
 	{
 		const char *p = host;
-		bool bInHostList;
+		const struct hostlist_pool *hp;
+		bool bHostFull=true;
 		while (p)
 		{
-			bInHostList = StrPoolCheckStr(hostlist, p);
-			DLOG("hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative");
-			if (bInHostList) return true;
+			DLOG("hostlist check for %s : ", p);
+			hp = HostlistPoolGetStr(hostlist, p);
+			if (hp)
+			{
+				if ((hp->flags & HOSTLIST_POOL_FLAG_STRICT_MATCH) && !bHostFull)
+				{
+					DLOG("negative : strict_mismatch : %s != %s\n", p, host);
+				}
+				else
+				{
+					DLOG("positive\n");
+					return true;
+				}
+			}
+			else
+				DLOG("negative\n");
 			p = strchr(p, '.');
 			if (p) p++;
+			bHostFull = false;
 		}
 	}
 	return false;

nfq/hostlist.h

@@ -4,12 +4,14 @@
 #include "pools.h"
 #include "params.h"
 
-bool AppendHostlistItem(strpool **hostlist, char *s);
-bool AppendHostList(strpool **hostlist, const char *filename);
+bool AppendHostlistItem(hostlist_pool **hostlist, char *s);
+bool AppendHostList(hostlist_pool **hostlist, const char *filename);
 bool LoadAllHostLists();
-bool NonEmptyHostlist(strpool **hostlist);
+bool NonEmptyHostlist(hostlist_pool **hostlist);
 // return : true = apply fooling, false = do not apply
 bool HostlistCheck(const struct desync_profile *dp,const char *host, bool *excluded, bool bSkipReloadCheck);
 struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename);
 bool HostlistsReloadCheckForProfile(const struct desync_profile *dp);
 void HostlistsDebug();
+
+#define ResetAllHostlistsModTime() hostlist_files_reset_modtime(&params.hostlists)

nfq/ipset.c

@@ -126,21 +126,22 @@ static bool LoadIpset(struct ipset_file *hfile)
 {
 	if (hfile->filename)
 	{
-		time_t t = file_mod_time(hfile->filename);
-		if (!t)
+		file_mod_sig fsig;
+		if (!file_mod_signature(hfile->filename, &fsig))
 		{
 			// stat() error
+			DLOG_PERROR("file_mod_signature");
 			DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
 			return true;
 		}
-			if (t==hfile->mod_time) return true; // up to date
+		if (FILE_MOD_COMPARE(&hfile->mod_sig,&fsig)) return true; // up to date
 		ipsetDestroy(&hfile->ipset);
 		if (!AppendIpset(&hfile->ipset, hfile->filename))
 		{
 			ipsetDestroy(&hfile->ipset);
 			return false;
 		}
-		hfile->mod_time=t;
+		hfile->mod_sig=fsig;
 	}
 	return true;
 }

nfq/ipset.h

@@ -10,3 +10,5 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
 void IpsetsDebug();
 bool AppendIpsetItem(ipset *ips, char *ip);
+
+#define ResetAllIpsetModTime() ipset_files_reset_modtime(&params.ipsets)

nfq/params.c

@@ -65,6 +65,7 @@ static int DLOG_VA(const char *format, int syslog_priority, bool condup, va_list
 	{
 		va_copy(args2,args);
 		DLOG_CON(format,syslog_priority,args2);
+		va_end(args2);
 	}
 	if (params.debug)
 	{
@@ -184,18 +185,7 @@ void dp_init(struct desync_profile *dp)
 	dp->desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
 	dp->desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
 	dp->desync_repeats = 1;
-	dp->fake_tls_size = sizeof(fake_tls_clienthello_default);
-	memcpy(dp->fake_tls,fake_tls_clienthello_default,dp->fake_tls_size);
-	randomize_default_tls_payload(dp->fake_tls);
-	dp->fake_http_size = strlen(fake_http_request_default);
-	memcpy(dp->fake_http,fake_http_request_default,dp->fake_http_size);
-	dp->fake_quic_size = 620; // must be 601+ for TSPU hack
-	dp->fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
-	dp->fake_wg_size = 64;
-	dp->fake_dht_size = 64;
-	dp->fake_unknown_size = 256;
 	dp->fake_syndata_size = 16;
-	dp->fake_unknown_udp_size = 64;
 	dp->wscale=-1; // default - dont change scale factor (client)
 	dp->desync_ttl6 = 0xFF; // unused
 	dp->desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
@@ -207,11 +197,50 @@ void dp_init(struct desync_profile *dp)
 	dp->hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
 	dp->filter_ipv4 = dp->filter_ipv6 = true;
 }
+bool dp_fake_defaults(struct desync_profile *dp)
+{
+	struct blob_item *item;
+	if (blob_collection_empty(&dp->fake_http))
+		if (!blob_collection_add_blob(&dp->fake_http,fake_http_request_default,strlen(fake_http_request_default),0))
+			return false;
+	if (blob_collection_empty(&dp->fake_tls))
+	{
+		if (!(item=blob_collection_add_blob(&dp->fake_tls,fake_tls_clienthello_default,sizeof(fake_tls_clienthello_default),4+sizeof(((struct fake_tls_mod*)0)->sni))))
+			return false;
+		if (!(item->extra2 = malloc(sizeof(struct fake_tls_mod))))
+			return false;
+		*(struct fake_tls_mod*)item->extra2 = dp->tls_mod_last;
+	}
+	if (blob_collection_empty(&dp->fake_unknown))
+	{
+		if (!(item=blob_collection_add_blob(&dp->fake_unknown,NULL,256,0)))
+			return false;
+		memset(item->data,0,item->size);
+	}
+	if (blob_collection_empty(&dp->fake_quic))
+	{
+		if (!(item=blob_collection_add_blob(&dp->fake_quic,NULL,620,0)))
+			return false;
+		memset(item->data,0,item->size);
+		item->data[0] = 0x40;
+	}
+	struct blob_collection_head **fake,*fakes_z64[] = {&dp->fake_wg, &dp->fake_dht, &dp->fake_discord, &dp->fake_stun, &dp->fake_unknown_udp,NULL};
+	for(fake=fakes_z64;*fake;fake++)
+	{
+		if (blob_collection_empty(*fake))
+		{
+			if (!(item=blob_collection_add_blob(*fake,NULL,64,0)))
+				return false;
+			memset(item->data,0,item->size);
+		}
+	}
+	return true;
+}
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 {
 	struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
 	if (!entry) return NULL;
-	
+
 	dp_init(&entry->dp);
 
 	// add to the tail
@@ -235,6 +264,8 @@ static void dp_clear_dynamic(struct desync_profile *dp)
 	port_filters_destroy(&dp->pf_tcp);
 	port_filters_destroy(&dp->pf_udp);
 	HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
+	struct blob_collection_head **fake,*fakes[] = {&dp->fake_http, &dp->fake_tls, &dp->fake_unknown, &dp->fake_unknown_udp, &dp->fake_quic, &dp->fake_wg, &dp->fake_dht, &dp->fake_discord, &dp->fake_stun, NULL};
+	for(fake=fakes;*fake;fake++) blob_collection_destroy(*fake);
 }
 void dp_clear(struct desync_profile *dp)
 {

nfq/params.h

@@ -20,8 +20,6 @@
 
 #define TLS_PARTIALS_ENABLE	true
 
-#define Q_RCVBUF	(128*1024)	// in bytes
-#define Q_SNDBUF	(64*1024)	// in bytes
 #define RAW_SNDBUF	(64*1024)	// in bytes
 
 #define Q_MAXLEN	1024		// in packets
@@ -40,8 +38,30 @@
 
 #define MAX_SPLITS	64
 
+#define FAKE_TLS_MOD_SAVE_MASK		0x0F
+#define FAKE_TLS_MOD_SET		0x01
+#define FAKE_TLS_MOD_CUSTOM_FAKE	0x02
+#define FAKE_TLS_MOD_RND		0x10
+#define FAKE_TLS_MOD_DUP_SID		0x20
+#define FAKE_TLS_MOD_RND_SNI		0x40
+#define FAKE_TLS_MOD_SNI		0x80
+#define FAKE_TLS_MOD_PADENCAP		0x100
+
+#define FAKE_MAX_TCP	1460
+#define FAKE_MAX_UDP	1472
+
 enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
 
+struct fake_tls_mod_cache
+{
+	size_t extlen_offset, padlen_offset;
+};
+struct fake_tls_mod
+{
+	char sni[64];
+	uint32_t mod;
+};
+
 struct desync_profile
 {
 	int n;	// number of the profile
@@ -68,9 +88,14 @@ struct desync_profile
 	autottl desync_autottl, desync_autottl6;
 	uint32_t desync_fooling_mode;
 	uint32_t desync_badseq_increment, desync_badseq_ack_increment;
-	uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460],fsplit_pattern[1460];
-	uint8_t fake_unknown_udp[1472],udplen_pattern[1472],fake_quic[1472],fake_wg[1472],fake_dht[1472];
-	size_t fake_http_size,fake_tls_size,fake_quic_size,fake_wg_size,fake_dht_size,fake_unknown_size,fake_syndata_size,fake_unknown_udp_size;
+
+	struct blob_collection_head fake_http,fake_tls,fake_unknown,fake_unknown_udp,fake_quic,fake_wg,fake_dht,fake_discord,fake_stun;
+	uint8_t fake_syndata[FAKE_MAX_TCP],seqovl_pattern[FAKE_MAX_TCP],fsplit_pattern[FAKE_MAX_TCP],udplen_pattern[FAKE_MAX_UDP];
+	size_t fake_syndata_size;
+
+	struct fake_tls_mod tls_mod_last;
+	struct blob_item *tls_fake_last;
+
 	int udplen_increment;
 
 	bool filter_ipv4,filter_ipv6;
@@ -103,6 +128,7 @@ void dp_entry_destroy(struct desync_profile_list *entry);
 void dp_list_destroy(struct desync_profile_list_head *head);
 bool dp_list_have_autohostlist(struct desync_profile_list_head *head);
 void dp_init(struct desync_profile *dp);
+bool dp_fake_defaults(struct desync_profile *dp);
 void dp_clear(struct desync_profile *dp);
 
 struct params_s

nfq/pools.c

@@ -31,6 +31,9 @@
 		free(elem); \
 		return false; \
 	}
+#define ADD_HOSTLIST_POOL(etype, ppool, keystr, keystr_len, flg) \
+	ADD_STR_POOL(etype,ppool,keystr,keystr_len); \
+	elem->flags = flg;
 
 
 #undef uthash_nonfatal_oom
@@ -42,27 +45,31 @@ static void ut_oom_recover(void *elem)
 }
 
 // for not zero terminated strings
-bool StrPoolAddStrLen(strpool **pp, const char *s, size_t slen)
+bool HostlistPoolAddStrLen(hostlist_pool **pp, const char *s, size_t slen, uint32_t flags)
 {
-	ADD_STR_POOL(strpool, pp, s, slen)
+	ADD_HOSTLIST_POOL(hostlist_pool, pp, s, slen, flags)
 	return true;
 }
 // for zero terminated strings
-bool StrPoolAddStr(strpool **pp, const char *s)
+bool HostlistPoolAddStr(hostlist_pool **pp, const char *s, uint32_t flags)
 {
-	return StrPoolAddStrLen(pp, s, strlen(s));
+	return HostlistPoolAddStrLen(pp, s, strlen(s), flags);
 }
 
-bool StrPoolCheckStr(strpool *p, const char *s)
+hostlist_pool *HostlistPoolGetStr(hostlist_pool *p, const char *s)
 {
-	strpool *elem;
+	hostlist_pool *elem;
 	HASH_FIND_STR(p, s, elem);
-	return elem != NULL;
+	return elem;
+}
+bool HostlistPoolCheckStr(hostlist_pool *p, const char *s)
+{
+	return !!HostlistPoolGetStr(p,s);
 }
 
-void StrPoolDestroy(strpool **pp)
+void HostlistPoolDestroy(hostlist_pool **pp)
 {
-	DESTROY_STR_POOL(strpool, pp)
+	DESTROY_STR_POOL(hostlist_pool, pp)
 }
 
 
@@ -139,7 +146,7 @@ bool strlist_add(struct str_list_head *head, const char *filename)
 }
 static void strlist_entry_destroy(struct str_list *entry)
 {
-	if (entry->str)	free(entry->str);
+	free(entry->str);
 	free(entry);
 }
 void strlist_destroy(struct str_list_head *head)
@@ -154,7 +161,6 @@ void strlist_destroy(struct str_list_head *head)
 
 
 
-
 struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const char *filename)
 {
 	struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
@@ -170,7 +176,7 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const
 		}
 		else
 			entry->filename = NULL;
-		entry->mod_time = 0;
+		FILE_MOD_RESET(&entry->mod_sig);
 		entry->hostlist = NULL;
 		LIST_INSERT_HEAD(head, entry, next);
 	}
@@ -178,8 +184,8 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const
 }
 static void hostlist_files_entry_destroy(struct hostlist_file *entry)
 {
-	if (entry->filename) free(entry->filename);
-	StrPoolDestroy(&entry->hostlist);
+	free(entry->filename);
+	HostlistPoolDestroy(&entry->hostlist);
 	free(entry);
 }
 void hostlist_files_destroy(struct hostlist_files_head *head)
@@ -202,6 +208,13 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
 	}
 	return NULL;
 }
+void hostlist_files_reset_modtime(struct hostlist_files_head *list)
+{
+	struct hostlist_file *hfile;
+
+	LIST_FOREACH(hfile, list, next)
+		FILE_MOD_RESET(&hfile->mod_sig);
+}
 
 struct hostlist_item *hostlist_collection_add(struct hostlist_collection_head *head, struct hostlist_file *hfile)
 {
@@ -384,7 +397,7 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
 		}
 		else
 			entry->filename = NULL;
-		entry->mod_time = 0;
+		FILE_MOD_RESET(&entry->mod_sig);
 		memset(&entry->ipset,0,sizeof(entry->ipset));
 		LIST_INSERT_HEAD(head, entry, next);
 	}
@@ -392,7 +405,7 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
 }
 static void ipset_files_entry_destroy(struct ipset_file *entry)
 {
-	if (entry->filename) free(entry->filename);
+	free(entry->filename);
 	ipsetDestroy(&entry->ipset);
 	free(entry);
 }
@@ -416,6 +429,13 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
 	}
 	return NULL;
 }
+void ipset_files_reset_modtime(struct ipset_files_head *list)
+{
+	struct ipset_file *hfile;
+
+	LIST_FOREACH(hfile, list, next)
+		FILE_MOD_RESET(&hfile->mod_sig);
+}
 
 struct ipset_item *ipset_collection_add(struct ipset_collection_head *head, struct ipset_file *hfile)
 {
@@ -497,3 +517,65 @@ bool port_filters_deny_if_empty(struct port_filters_head *head)
 	if (LIST_FIRST(head)) return true;
 	return pf_parse("0",&pf) && port_filter_add(head,&pf);
 }
+
+
+		
+struct blob_item *blob_collection_add(struct blob_collection_head *head)
+{
+	struct blob_item *entry = calloc(1,sizeof(struct blob_item));
+	if (entry)
+	{
+		// insert to the end
+		struct blob_item *itemc,*iteml=LIST_FIRST(head);
+		if (iteml)
+		{
+			while ((itemc=LIST_NEXT(iteml,next))) iteml = itemc;
+			LIST_INSERT_AFTER(iteml, entry, next);
+		}
+		else
+			LIST_INSERT_HEAD(head, entry, next);
+	}
+	return entry;
+}
+struct blob_item *blob_collection_add_blob(struct blob_collection_head *head, const void *data, size_t size, size_t size_reserve)
+{
+	struct blob_item *entry = calloc(1,sizeof(struct blob_item));
+	if (!entry) return NULL;
+	if (!(entry->data = malloc(size+size_reserve))) 
+	{
+		free(entry);
+		return NULL;
+	}
+	if (data) memcpy(entry->data,data,size);
+	entry->size = size;
+	entry->size_buf = size+size_reserve;
+	
+	// insert to the end
+	struct blob_item *itemc,*iteml=LIST_FIRST(head);
+	if (iteml)
+	{
+		while ((itemc=LIST_NEXT(iteml,next))) iteml = itemc;
+		LIST_INSERT_AFTER(iteml, entry, next);
+	}
+	else
+		LIST_INSERT_HEAD(head, entry, next);
+
+	return entry;
+}
+
+void blob_collection_destroy(struct blob_collection_head *head)
+{
+	struct blob_item *entry;
+	while ((entry = LIST_FIRST(head)))
+	{
+		LIST_REMOVE(entry, next);
+		free(entry->extra);
+		free(entry->extra2);
+		free(entry->data);
+		free(entry);
+	}
+}
+bool blob_collection_empty(const struct blob_collection_head *head)
+{
+	return !LIST_FIRST(head);
+}

nfq/pools.h

@@ -12,15 +12,18 @@
 #define HASH_FUNCTION HASH_BER
 #include "uthash.h"
 
-typedef struct strpool {
-    char *str;		/* key */
-    UT_hash_handle hh;	/* makes this structure hashable */
-} strpool;
+#define HOSTLIST_POOL_FLAG_STRICT_MATCH		1
 
-void StrPoolDestroy(strpool **pp);
-bool StrPoolAddStr(strpool **pp,const char *s);
-bool StrPoolAddStrLen(strpool **pp,const char *s,size_t slen);
-bool StrPoolCheckStr(strpool *p,const char *s);
+typedef struct hostlist_pool {
+	char *str;		/* key */
+	uint32_t flags;		/* custom data */
+	UT_hash_handle hh;	/* makes this structure hashable */
+} hostlist_pool;
+
+void HostlistPoolDestroy(hostlist_pool **pp);
+bool HostlistPoolAddStr(hostlist_pool **pp, const char *s, uint32_t flags);
+bool HostlistPoolAddStrLen(hostlist_pool **pp, const char *s, size_t slen, uint32_t flags);
+hostlist_pool *HostlistPoolGetStr(hostlist_pool *p, const char *s);
 
 struct str_list {
 	char *str;
@@ -29,10 +32,10 @@ struct str_list {
 LIST_HEAD(str_list_head, str_list);
 
 typedef struct hostfail_pool {
-    char *str;		/* key */
-    int counter;	/* value */
-    time_t expire;	/* when to expire record (unixtime) */
-    UT_hash_handle hh;	/* makes this structure hashable */
+	char *str;		/* key */
+	int counter;	/* value */
+	time_t expire;	/* when to expire record (unixtime) */
+	UT_hash_handle hh;	/* makes this structure hashable */
 } hostfail_pool;
 
 void HostFailPoolDestroy(hostfail_pool **pp);
@@ -50,8 +53,8 @@ void strlist_destroy(struct str_list_head *head);
 
 struct hostlist_file {
 	char *filename;
-	time_t mod_time;
-	strpool *hostlist;
+	file_mod_sig mod_sig;
+	hostlist_pool *hostlist;
 	LIST_ENTRY(hostlist_file) next;
 };
 LIST_HEAD(hostlist_files_head, hostlist_file);
@@ -59,6 +62,7 @@ LIST_HEAD(hostlist_files_head, hostlist_file);
 struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const char *filename);
 void hostlist_files_destroy(struct hostlist_files_head *head);
 struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, const char *filename);
+void hostlist_files_reset_modtime(struct hostlist_files_head *list);
 
 struct hostlist_item {
 	struct hostlist_file *hfile;
@@ -111,7 +115,7 @@ void ipsetPrint(ipset *ipset);
 
 struct ipset_file {
 	char *filename;
-	time_t mod_time;
+	file_mod_sig mod_sig;
 	ipset ipset;
 	LIST_ENTRY(ipset_file) next;
 };
@@ -120,6 +124,7 @@ LIST_HEAD(ipset_files_head, ipset_file);
 struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *filename);
 void ipset_files_destroy(struct ipset_files_head *head);
 struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char *filename);
+void ipset_files_reset_modtime(struct ipset_files_head *list);
 
 struct ipset_item {
 	struct ipset_file *hfile;
@@ -141,3 +146,18 @@ bool port_filter_add(struct port_filters_head *head, const port_filter *pf);
 void port_filters_destroy(struct port_filters_head *head);
 bool port_filters_in_range(const struct port_filters_head *head, uint16_t port);
 bool port_filters_deny_if_empty(struct port_filters_head *head);
+
+
+struct blob_item {
+	uint8_t *data;	// main data blob
+	size_t size;	// main data blob size
+	size_t size_buf;// main data blob allocated size
+	void *extra;	// any data without size
+	void *extra2;	// any data without size
+	LIST_ENTRY(blob_item) next;
+};
+LIST_HEAD(blob_collection_head, blob_item);
+struct blob_item *blob_collection_add(struct blob_collection_head *head);
+struct blob_item *blob_collection_add_blob(struct blob_collection_head *head, const void *data, size_t size, size_t size_reserve);
+void blob_collection_destroy(struct blob_collection_head *head);
+bool blob_collection_empty(const struct blob_collection_head *head);

nfq/protocol.c

@@ -2,6 +2,8 @@
 
 #include "protocol.h"
 #include "helpers.h"
+#include "params.h"
+
 #include <string.h>
 #include <ctype.h>
 #include <arpa/inet.h>
@@ -33,6 +35,8 @@ const char *l7proto_str(t_l7proto l7)
 		case QUIC: return "quic";
 		case WIREGUARD: return "wireguard";
 		case DHT: return "dht";
+		case DISCORD: return "discord";
+		case STUN: return "stun";
 		default: return "unknown";
 	}
 }
@@ -43,7 +47,9 @@ bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
 		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
 		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
 		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
-		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
+		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT)) ||
+		(l7proto==DISCORD && (filter_l7 & L7_PROTO_DISCORD)) ||
+		(l7proto==STUN && (filter_l7 & L7_PROTO_STUN));
 }
 
 #define PM_ABS		0
@@ -151,7 +157,7 @@ void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const st
 }
 
 
-const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
+const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS ","PUT /","DELETE /","CONNECT ","TRACE /",NULL };
 const char *HttpMethod(const uint8_t *data, size_t len)
 {
 	const char **method;
@@ -371,6 +377,46 @@ bool IsTLSHandshakeFull(const uint8_t *data, size_t len)
 }
 
 
+bool TLSFindExtLenOffsetInHandshake(const uint8_t *data, size_t len, size_t *off)
+{
+	// +0
+	// u8	HandshakeType: ClientHello
+	// u24	Length
+	// u16	Version
+	// c[32] random
+	// u8	SessionIDLength
+	//	<SessionID>
+	// u16	CipherSuitesLength
+	//	<CipherSuites>
+	// u8	CompressionMethodsLength
+	//	<CompressionMethods>
+	// u16	ExtensionsLength
+
+	size_t l;
+
+	l = 1 + 3 + 2 + 32;
+	// SessionIDLength
+	if (len < (l + 1)) return false;
+	l += data[l] + 1;
+	// CipherSuitesLength
+	if (len < (l + 2)) return false;
+	l += pntoh16(data + l) + 2;
+	// CompressionMethodsLength
+	if (len < (l + 1)) return false;
+	l += data[l] + 1;
+	// ExtensionsLength
+	if (len < (l + 2)) return false;
+	*off = l;
+	return true;
+}
+bool TLSFindExtLen(const uint8_t *data, size_t len, size_t *off)
+{
+	if (!TLSFindExtLenOffsetInHandshake(data+5,len-5,off))
+		return false;
+	*off+=5;
+	return true;
+}
+
 // bPartialIsOK=true - accept partial packets not containing the whole TLS message
 bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK)
 {
@@ -391,18 +437,7 @@ bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const
 
 	if (!bPartialIsOK && !IsTLSHandshakeFull(data,len)) return false;
 
-	l = 1 + 3 + 2 + 32;
-	// SessionIDLength
-	if (len < (l + 1)) return false;
-	l += data[l] + 1;
-	// CipherSuitesLength
-	if (len < (l + 2)) return false;
-	l += pntoh16(data + l) + 2;
-	// CompressionMethodsLength
-	if (len < (l + 1)) return false;
-	l += data[l] + 1;
-	// ExtensionsLength
-	if (len < (l + 2)) return false;
+	if (!TLSFindExtLenOffsetInHandshake(data,len,&l)) return false;
 
 	data += l; len -= l;
 	l = pntoh16(data);
@@ -449,7 +484,7 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 	if (reclen<len) len=reclen; // correct len if it has more data than the first tls record has
 	return TLSFindExtInHandshake(data + 5, len - 5, type, ext, len_ext, bPartialIsOK);
 }
-static bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen)
+bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen)
 {
 	// u16	data+0 - name list length
 	// u8	data+2 - server name type. 0=host_name
@@ -507,7 +542,7 @@ size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 		case PM_HOST_MIDSLD:
 		case PM_HOST_ENDSLD:
 		case PM_SNI_EXT:
-			if (TLSFindExt(data,sz,0,&ext,&elen,false))
+			if (TLSFindExt(data,sz,0,&ext,&elen,TLS_PARTIALS_ENABLE))
 			{
 				if (posmarker==PM_SNI_EXT)
 				{
@@ -813,7 +848,16 @@ bool QUICDecryptInitial(const uint8_t *data, size_t data_len, uint8_t *clean, si
 	return !memcmp(data + pn_offset + pkn_len + cryptlen, atag, 16);
 }
 
-bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len)
+struct range64
+{
+	uint64_t offset,len;
+};
+#define MAX_DEFRAG_PIECES	128
+static int cmp_range64(const void * a, const void * b)
+{
+	return (((struct range64*)a)->offset < ((struct range64*)b)->offset) ? -1 : (((struct range64*)a)->offset > ((struct range64*)b)->offset) ? 1 : 0;
+}
+bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len, bool *bFull)
 {
 	// Crypto frame can be split into multiple chunks
 	// chromium randomly splits it and pads with zero/one bytes to force support the standard
@@ -822,13 +866,15 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 	if (*defrag_len<10) return false;
 	uint8_t *defrag_data = defrag+10;
 	size_t defrag_data_len = *defrag_len-10;
-
 	uint8_t ft;
 	uint64_t offset,sz,szmax=0,zeropos=0,pos=0;
 	bool found=false;
+	struct range64 ranges[MAX_DEFRAG_PIECES];
+	int i,range=0;
 
 	while(pos<clean_len)
 	{
+		// frame type
 		ft = clean[pos];
 		pos++;
 		if (ft>1) // 00 - padding, 01 - ping
@@ -836,6 +882,7 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 			if (ft!=6) return false; // dont want to know all possible frame type formats
 
 			if (pos>=clean_len) return false;
+			if (range>=MAX_DEFRAG_PIECES) return false;
 
 			if ((pos+tvb_get_size(clean[pos])>=clean_len)) return false;
 			pos += tvb_get_varint(clean+pos, &offset);
@@ -844,7 +891,7 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 			pos += tvb_get_varint(clean+pos, &sz);
 			if ((pos+sz)>clean_len) return false;
 
-			if ((offset+sz)>defrag_data_len) return false;
+			if ((offset+sz)>defrag_data_len) return false; // defrag buf overflow
 			if (zeropos < offset)
 				// make sure no uninitialized gaps exist in case of not full fragment coverage
 				memset(defrag_data+zeropos,0,offset-zeropos);
@@ -855,6 +902,10 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 
 			found=true;
 			pos+=sz;
+
+			ranges[range].offset = offset;
+			ranges[range].len = sz;
+			range++;
 		}
 	}
 	if (found)
@@ -866,6 +917,23 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 		phton64(defrag+2,szmax);
 		defrag[2] |= 0xC0; // 64 bit value
 		*defrag_len = (size_t)(szmax+10);
+
+		qsort(ranges, range, sizeof(*ranges), cmp_range64);
+
+		//for(i=0 ; i<range ; i++)
+		//	printf("RANGE %zu len %zu\n",ranges[i].offset,ranges[i].len);
+
+		for(i=0,offset=0,*bFull=true ; i<range ; i++)
+		{
+			if (ranges[i].offset!=offset)
+			{
+				*bFull = false;
+				break;
+			}
+			offset += ranges[i].len;
+		}
+
+		//printf("bFull=%u\n",*bFull);
 	}
 	return found;
 }
@@ -936,9 +1004,24 @@ bool IsQUICInitial(const uint8_t *data, size_t len)
 
 bool IsWireguardHandshakeInitiation(const uint8_t *data, size_t len)
 {
-    return len==148 && data[0]==1 && data[1]==0 && data[2]==0 && data[3]==0;
+    return len==148 && data[0]==1;
 }
 bool IsDhtD1(const uint8_t *data, size_t len)
 {
 	return len>=7 && data[0]=='d' && data[1]=='1' && data[len-1]=='e';
 }
+bool IsDiscordIpDiscoveryRequest(const uint8_t *data, size_t len)
+{
+	return len==74 &&
+		data[0]==0 && data[1]==1 &&
+		data[2]==0 && data[3]==70 &&
+		data[8]==0 && memcmp(&data[8],&data[9],63)==0; // address is not set in requests
+}
+bool IsStunMessage(const uint8_t *data, size_t len)
+{
+	return len>=20 && // header size
+		(data[0]&0xC0)==0 && // 2 most significant bits must be zeroes
+		(data[3]&0b11)==0 && // length must be a multiple of 4
+		ntohl(*(uint32_t*)(&data[4]))==0x2112A442 && // magic cookie
+		ntohs(*(uint16_t*)(&data[2]))==len-20;
+}

nfq/protocol.h

@@ -7,12 +7,14 @@
 #include "crypto/aes-gcm.h"
 #include "helpers.h"
 
-typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
+typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT, DISCORD, STUN} t_l7proto;
 #define L7_PROTO_HTTP		0x00000001
 #define L7_PROTO_TLS		0x00000002
 #define L7_PROTO_QUIC		0x00000004
 #define L7_PROTO_WIREGUARD	0x00000008
 #define L7_PROTO_DHT		0x00000010
+#define L7_PROTO_DISCORD	0x00000020
+#define L7_PROTO_STUN		0x00000040
 #define L7_PROTO_UNKNOWN	0x80000000
 const char *l7proto_str(t_l7proto l7);
 bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
@@ -62,6 +64,9 @@ bool IsTLSClientHello(const uint8_t *data, size_t len, bool bPartialIsOK);
 size_t TLSHandshakeLen(const uint8_t *data);
 bool IsTLSHandshakeClientHello(const uint8_t *data, size_t len);
 bool IsTLSHandshakeFull(const uint8_t *data, size_t len);
+bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen);
+bool TLSFindExtLen(const uint8_t *data, size_t len, size_t *off);
+bool TLSFindExtLenOffsetInHandshake(const uint8_t *data, size_t len, size_t *off);
 bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
 bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
 bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
@@ -69,6 +74,8 @@ bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *hos
 
 bool IsWireguardHandshakeInitiation(const uint8_t *data, size_t len);
 bool IsDhtD1(const uint8_t *data, size_t len);
+bool IsDiscordIpDiscoveryRequest(const uint8_t *data, size_t len);
+bool IsStunMessage(const uint8_t *data, size_t len);
 
 #define QUIC_MAX_CID_LENGTH  20
 typedef struct quic_cid {
@@ -84,5 +91,6 @@ uint8_t QUICDraftVersion(uint32_t version);
 bool QUICExtractDCID(const uint8_t *data, size_t len, quic_cid_t *cid);
 
 bool QUICDecryptInitial(const uint8_t *data, size_t data_len, uint8_t *clean, size_t *clean_len);
-bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len);
+// returns true if crypto frames were found . bFull = true if crypto frame fragments have full coverage
+bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len, bool *bFull);
 //bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello);

nfq/sec.c

@@ -88,10 +88,6 @@ SYS_symlinkat,
 SYS_link,
 #endif
 SYS_linkat,
-#ifdef SYS_pkey_mprotect
-SYS_pkey_mprotect,
-#endif
-SYS_mprotect,
 SYS_truncate,
 #ifdef SYS_truncate64
 SYS_truncate64,
@@ -291,7 +287,7 @@ bool can_drop_root(void)
 {
 #ifdef __linux__
 	// has some caps
-	return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID)|(1<<CAP_SETPCAP));
+	return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID));
 #else
 	// effective root
 	return !geteuid();
@@ -323,11 +319,7 @@ bool droproot(uid_t uid, gid_t gid)
 		DLOG_PERROR("setuid");
 		return false;
 	}
-#ifdef __linux__
-	return dropcaps();
-#else
 	return true;
-#endif
 }
 
 void print_id(void)

tpws/BSDmakefile

@@ -6,7 +6,7 @@ SRC_FILES = *.c
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 
 clean:
 	rm -f tpws *.o

tpws/Makefile

@@ -1,7 +1,9 @@
 CC ?= gcc
 CFLAGS += -std=gnu99 -Os -flto=auto
+CFLAGS_SYSTEMD = -DUSE_SYSTEMD
 CFLAGS_BSD = -Wno-address-of-packed-member
 LIBS = -lz -lpthread
+LIBS_SYSTEMD = -lsystemd
 LIBS_ANDROID = -lz
 SRC_FILES = *.c
 SRC_FILES_ANDROID = $(SRC_FILES) andr/*.c
@@ -9,17 +11,20 @@ SRC_FILES_ANDROID = $(SRC_FILES) andr/*.c
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LIBS) $(LDFLAGS)
+
+systemd: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) $(CFLAGS_SYSTEMD) -o tpws $(SRC_FILES) $(LIBS) $(LIBS_SYSTEMD) $(LDFLAGS)
 
 android: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LDFLAGS) $(LIBS_ANDROID)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LIBS_ANDROID) $(LDFLAGS)
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsa -target arm64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsx -target x86_64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsa -target arm64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsx -target x86_64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 	strip tpwsa tpwsx
 	lipo -create -output tpws tpwsx tpwsa
 	rm -f tpwsx tpwsa

tpws/gzip.c

@@ -65,11 +65,8 @@ int z_readfile(FILE *F, char **buf, size_t *size)
 
 zerr:
 	inflateEnd(&zs);
-	if (*buf)
-	{
-		free(*buf);
-		*buf = NULL;
-	}
+	free(*buf);
+	*buf = NULL;
 	return r;
 }
 

tpws/helpers.c

@@ -11,10 +11,7 @@
 #include <sys/stat.h>
 #include <libgen.h>
 #include <unistd.h>
-
-#ifdef __linux__
-#include <linux/tcp.h>
-#endif
+#include <fcntl.h>
 
 #ifdef __ANDROID__
 #include "andr/ifaddrs.h"
@@ -23,6 +20,10 @@
 #endif
 
 #include "helpers.h"
+#ifdef __linux__
+#include <linux/tcp.h>
+#endif
+#include "linux_compat.h"
 
 int unique_size_t(size_t *pu, int ct)
 {
@@ -77,6 +78,13 @@ char *strncasestr(const char *s, const char *find, size_t slen)
 	return (char *)s;
 }
 
+bool str_ends_with(const char *s, const char *suffix)
+{
+    size_t slen = strlen(s);
+    size_t suffix_len = strlen(suffix);
+    return suffix_len <= slen && !strcmp(s + slen - suffix_len, suffix);
+}
+
 bool load_file(const char *filename, void *buffer, size_t *buffer_size)
 {
 	FILE *F;
@@ -314,6 +322,29 @@ time_t file_mod_time(const char *filename)
 	struct stat st;
 	return stat(filename, &st) == -1 ? 0 : st.st_mtime;
 }
+bool file_mod_signature(const char *filename, file_mod_sig *ms)
+{
+	struct stat st;
+	if (stat(filename,&st)==-1)
+	{
+		FILE_MOD_RESET(ms);
+		return false;
+	}
+	ms->mod_time=st.st_mtime;
+	ms->size=st.st_size;
+	return true;
+}
+
+bool file_open_test(const char *filename, int flags)
+{
+	int fd = open(filename,flags);
+	if (fd>=0)
+	{
+		close(fd);
+		return true;
+	}
+	return false;
+}
 
 bool pf_in_range(uint16_t port, const port_filter *pf)
 {
@@ -359,6 +390,11 @@ bool pf_is_empty(const port_filter *pf)
 	return !pf->neg && !pf->from && !pf->to;
 }
 
+void set_console_io_buffering(void)
+{
+	setvbuf(stdout, NULL, _IOLBF, 0);
+	setvbuf(stderr, NULL, _IOLBF, 0);
+}
 
 bool set_env_exedir(const char *argv0)
 {
@@ -481,7 +517,7 @@ void msleep(unsigned int ms)
 bool socket_supports_notsent()
 {
 	int sfd;
-	struct tcp_info tcpi;
+	struct tcp_info_new tcpi;
 
 	sfd = socket(AF_INET,SOCK_STREAM,0);
 	if (sfd<0) return false;
@@ -494,11 +530,11 @@ bool socket_supports_notsent()
 	}
 	close(sfd);
 
-	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi.tcpi_state + sizeof(tcpi.tcpi_notsent_bytes));
+	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi + sizeof(tcpi.tcpi_notsent_bytes));
 }
 bool socket_has_notsent(int sfd)
 {
-	struct tcp_info tcpi;
+	struct tcp_info_new tcpi;
 	socklen_t ts = sizeof(tcpi);
 
 	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)
@@ -536,4 +572,20 @@ bool socket_wait_notsent(int sfd, unsigned int delay_ms, unsigned int *wasted_ms
 	}
 	return false;
 }
+
+int is_wsl(void)
+{
+  struct utsname buf;
+  if (uname(&buf) != 0)
+    return -1;
+
+  if (strcmp(buf.sysname, "Linux") != 0)
+    return 0;
+  if (str_ends_with(buf.release, "microsoft-standard-WSL2"))
+    return 2;
+  if (str_ends_with(buf.release, "-Microsoft"))
+    return 1;
+
+  return 0;
+}
 #endif

tpws/helpers.h

@@ -7,6 +7,7 @@
 #include <netdb.h>
 #include <stdio.h>
 #include <time.h>
+#include <sys/utsname.h>
 
 // this saves memory. sockaddr_storage is larger than required. it can be 128 bytes. sockaddr_in6 is 28 bytes.
 typedef union
@@ -22,6 +23,8 @@ void rtrim(char *s);
 void replace_char(char *s, char from, char to);
 char *strncasestr(const char *s,const char *find, size_t slen);
 
+bool str_ends_with(const char *s, const char *suffix);
+
 bool load_file(const char *filename,void *buffer,size_t *buffer_size);
 bool append_to_list_file(const char *filename, const char *s);
 
@@ -62,7 +65,16 @@ static inline void phton16(uint8_t *p, uint16_t v) {
 
 int fprint_localtime(FILE *F);
 
+typedef struct
+{
+	time_t mod_time;
+	off_t size;
+} file_mod_sig;
+#define FILE_MOD_COMPARE(ms1,ms2) (((ms1)->mod_time==(ms2)->mod_time) && ((ms1)->size==(ms2)->size))
+#define FILE_MOD_RESET(ms) memset(ms,0,sizeof(file_mod_sig))
+bool file_mod_signature(const char *filename, file_mod_sig *ms);
 time_t file_mod_time(const char *filename);
+bool file_open_test(const char *filename, int flags);
 
 typedef struct
 {
@@ -73,6 +85,7 @@ bool pf_in_range(uint16_t port, const port_filter *pf);
 bool pf_parse(const char *s, port_filter *pf);
 bool pf_is_empty(const port_filter *pf);
 
+void set_console_io_buffering(void);
 bool set_env_exedir(const char *argv0);
 
 #ifndef IN_LOOPBACK
@@ -123,4 +136,6 @@ void msleep(unsigned int ms);
 bool socket_supports_notsent();
 bool socket_has_notsent(int sfd);
 bool socket_wait_notsent(int sfd, unsigned int delay_ms, unsigned int *wasted_ms);
+
+int is_wsl();
 #endif

tpws/hostlist.c

@@ -4,7 +4,7 @@
 #include "helpers.h"
 
 // inplace tolower() and add to pool
-static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
+static bool addpool(hostlist_pool **hostlist, char **s, const char *end, int *ct)
 {
 	char *p=*s;
 
@@ -17,10 +17,16 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	else
 	{
 		// advance until eol lowering all chars
-		for (; p<end && *p && *p!='\r' && *p != '\n'; p++) *p=tolower(*p);
-		if (!StrPoolAddStrLen(hostlist, *s, p-*s))
+		uint32_t flags = 0;
+		if (*p=='^')
 		{
-			StrPoolDestroy(hostlist);
+			p = ++(*s);
+			flags |= HOSTLIST_POOL_FLAG_STRICT_MATCH;
+		}
+		for (; p<end && *p && *p!='\r' && *p != '\n'; p++) *p=tolower(*p);
+		if (!HostlistPoolAddStrLen(hostlist, *s, p-*s, flags))
+		{
+			HostlistPoolDestroy(hostlist);
 			*hostlist = NULL;
 			return false;
 		}
@@ -32,12 +38,12 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	return true;
 }
 
-bool AppendHostlistItem(strpool **hostlist, char *s)
+bool AppendHostlistItem(hostlist_pool **hostlist, char *s)
 {
 	return addpool(hostlist,&s,s+strlen(s),NULL);
 }
 
-bool AppendHostList(strpool **hostlist, const char *filename)
+bool AppendHostList(hostlist_pool **hostlist, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
 	size_t zsize;
@@ -105,21 +111,22 @@ static bool LoadHostList(struct hostlist_file *hfile)
 {
 	if (hfile->filename)
 	{
-		time_t t = file_mod_time(hfile->filename);
-		if (!t)
+		file_mod_sig fsig;
+		if (!file_mod_signature(hfile->filename, &fsig))
 		{
 			// stat() error
+			DLOG_PERROR("file_mod_signature");
 			DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
 			return true;
 		}
-		if (t==hfile->mod_time) return true; // up to date
-		StrPoolDestroy(&hfile->hostlist);
+		if (FILE_MOD_COMPARE(&hfile->mod_sig,&fsig)) return true; // up to date
+		HostlistPoolDestroy(&hfile->hostlist);
 		if (!AppendHostList(&hfile->hostlist, hfile->filename))
 		{
-			StrPoolDestroy(&hfile->hostlist);
+			HostlistPoolDestroy(&hfile->hostlist);
 			return false;
 		}
-		hfile->mod_time=t;
+		hfile->mod_sig=fsig;
 	}
 	return true;
 }
@@ -137,10 +144,10 @@ static bool LoadHostLists(struct hostlist_files_head *list)
 	return bres;
 }
 
-bool NonEmptyHostlist(strpool **hostlist)
+bool NonEmptyHostlist(hostlist_pool **hostlist)
 {
 	// add impossible hostname if the list is empty
-	return *hostlist ? true : StrPoolAddStrLen(hostlist, "@&()", 4);
+	return *hostlist ? true : HostlistPoolAddStrLen(hostlist, "@&()", 4, 0);
 }
 
 static void MakeAutolistsNonEmpty()
@@ -163,19 +170,34 @@ bool LoadAllHostLists()
 
 
 
-static bool SearchHostList(strpool *hostlist, const char *host)
+static bool SearchHostList(hostlist_pool *hostlist, const char *host)
 {
 	if (hostlist)
 	{
 		const char *p = host;
-		bool bInHostList;
+		const struct hostlist_pool *hp;
+		bool bHostFull=true;
 		while (p)
 		{
-			bInHostList = StrPoolCheckStr(hostlist, p);
-			VPRINT("hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative");
-			if (bInHostList) return true;
+			VPRINT("hostlist check for %s : ", p);
+			hp = HostlistPoolGetStr(hostlist, p);
+			if (hp)
+			{
+				if ((hp->flags & HOSTLIST_POOL_FLAG_STRICT_MATCH) && !bHostFull)
+				{
+					VPRINT("negative : strict_mismatch : %s != %s\n", p, host);
+				}
+				else
+				{
+					VPRINT("positive\n");
+					return true;
+				}
+			}
+			else
+				VPRINT("negative\n");
 			p = strchr(p, '.');
 			if (p) p++;
+			bHostFull = false;
 		}
 	}
 	return false;

tpws/hostlist.h

@@ -4,12 +4,14 @@
 #include "pools.h"
 #include "params.h"
 
-bool AppendHostlistItem(strpool **hostlist, char *s);
-bool AppendHostList(strpool **hostlist, const char *filename);
+bool AppendHostlistItem(hostlist_pool **hostlist, char *s);
+bool AppendHostList(hostlist_pool **hostlist, const char *filename);
 bool LoadAllHostLists();
-bool NonEmptyHostlist(strpool **hostlist);
+bool NonEmptyHostlist(hostlist_pool **hostlist);
 // return : true = apply fooling, false = do not apply
 bool HostlistCheck(const struct desync_profile *dp,const char *host, bool *excluded, bool bSkipReloadCheck);
 struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename);
 bool HostlistsReloadCheckForProfile(const struct desync_profile *dp);
 void HostlistsDebug();
+
+#define ResetAllHostlistsModTime() hostlist_files_reset_modtime(&params.hostlists)

tpws/ipset.c

@@ -126,21 +126,22 @@ static bool LoadIpset(struct ipset_file *hfile)
 {
 	if (hfile->filename)
 	{
-		time_t t = file_mod_time(hfile->filename);
-		if (!t)
+		file_mod_sig fsig;
+		if (!file_mod_signature(hfile->filename, &fsig))
 		{
 			// stat() error
+			DLOG_PERROR("file_mod_signature");
 			DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
 			return true;
 		}
-			if (t==hfile->mod_time) return true; // up to date
+		if (FILE_MOD_COMPARE(&hfile->mod_sig,&fsig)) return true; // up to date
 		ipsetDestroy(&hfile->ipset);
 		if (!AppendIpset(&hfile->ipset, hfile->filename))
 		{
 			ipsetDestroy(&hfile->ipset);
 			return false;
 		}
-		hfile->mod_time=t;
+		hfile->mod_sig=fsig;
 	}
 	return true;
 }

tpws/ipset.h

@@ -10,3 +10,5 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
 void IpsetsDebug();
 bool AppendIpsetItem(ipset *ips, char *ip);
+
+#define ResetAllIpsetModTime() ipset_files_reset_modtime(&params.ipsets)

tpws/linux_compat.h

@@ -0,0 +1,111 @@
+#ifdef __linux__
+
+#include <linux/types.h>
+
+#ifndef TCP_USER_TIMEOUT
+#define TCP_USER_TIMEOUT 18
+#endif
+
+#ifndef IP6T_SO_ORIGINAL_DST
+ #define IP6T_SO_ORIGINAL_DST 80
+#endif
+
+#ifndef PR_SET_NO_NEW_PRIVS
+ #define PR_SET_NO_NEW_PRIVS	38
+#endif
+
+// workaround for old headers
+
+struct tcp_info_new {
+	__u8    tcpi_state;
+	__u8    tcpi_ca_state;
+	__u8    tcpi_retransmits;
+	__u8    tcpi_probes;
+	__u8    tcpi_backoff;
+	__u8    tcpi_options;
+	__u8    tcpi_snd_wscale : 4, tcpi_rcv_wscale : 4;
+	__u8    tcpi_delivery_rate_app_limited : 1, tcpi_fastopen_client_fail : 2;
+
+	__u32   tcpi_rto;
+	__u32   tcpi_ato;
+	__u32   tcpi_snd_mss;
+	__u32   tcpi_rcv_mss;
+
+	__u32   tcpi_unacked;
+	__u32   tcpi_sacked;
+	__u32   tcpi_lost;
+	__u32   tcpi_retrans;
+	__u32   tcpi_fackets;
+
+	/* Times. */
+	__u32   tcpi_last_data_sent;
+	__u32   tcpi_last_ack_sent;     /* Not remembered, sorry. */
+	__u32   tcpi_last_data_recv;
+	__u32   tcpi_last_ack_recv;
+
+	/* Metrics. */
+	__u32   tcpi_pmtu;
+	__u32   tcpi_rcv_ssthresh;
+	__u32   tcpi_rtt;
+	__u32   tcpi_rttvar;
+	__u32   tcpi_snd_ssthresh;
+	__u32   tcpi_snd_cwnd;
+	__u32   tcpi_advmss;
+	__u32   tcpi_reordering;
+
+	__u32   tcpi_rcv_rtt;
+	__u32   tcpi_rcv_space;
+
+	__u32   tcpi_total_retrans;
+
+	__u64   tcpi_pacing_rate;
+	__u64   tcpi_max_pacing_rate;
+	__u64   tcpi_bytes_acked;    /* RFC4898 tcpEStatsAppHCThruOctetsAcked */
+	__u64   tcpi_bytes_received; /* RFC4898 tcpEStatsAppHCThruOctetsReceived */
+	__u32   tcpi_segs_out;       /* RFC4898 tcpEStatsPerfSegsOut */
+	__u32   tcpi_segs_in;        /* RFC4898 tcpEStatsPerfSegsIn */
+
+	__u32   tcpi_notsent_bytes;
+	__u32   tcpi_min_rtt;
+	__u32   tcpi_data_segs_in;      /* RFC4898 tcpEStatsDataSegsIn */
+	__u32   tcpi_data_segs_out;     /* RFC4898 tcpEStatsDataSegsOut */
+
+	__u64   tcpi_delivery_rate;
+
+	__u64   tcpi_busy_time;      /* Time (usec) busy sending data */
+	__u64   tcpi_rwnd_limited;   /* Time (usec) limited by receive window */
+	__u64   tcpi_sndbuf_limited; /* Time (usec) limited by send buffer */
+
+	__u32   tcpi_delivered;
+	__u32   tcpi_delivered_ce;
+
+	__u64   tcpi_bytes_sent;     /* RFC4898 tcpEStatsPerfHCDataOctetsOut */
+	__u64   tcpi_bytes_retrans;  /* RFC4898 tcpEStatsPerfOctetsRetrans */
+	__u32   tcpi_dsack_dups;     /* RFC4898 tcpEStatsStackDSACKDups */
+	__u32   tcpi_reord_seen;     /* reordering events seen */
+
+	__u32   tcpi_rcv_ooopack;    /* Out-of-order packets received */
+
+	__u32   tcpi_snd_wnd;        /* peer's advertised receive window after
+								  * scaling (bytes)
+								  */
+	__u32   tcpi_rcv_wnd;        /* local advertised receive window after
+								  * scaling (bytes)
+								  */
+
+	__u32   tcpi_rehash;         /* PLB or timeout triggered rehash attempts */
+
+	__u16   tcpi_total_rto; /* Total number of RTO timeouts, including
+							 * SYN/SYN-ACK and recurring timeouts.
+							 */
+	__u16   tcpi_total_rto_recoveries;      /* Total number of RTO
+											 * recoveries, including any
+											 * unfinished recovery.
+											 */
+	__u32   tcpi_total_rto_time;    /* Total time spent in RTO recoveries
+									 * in milliseconds, including any
+									 * unfinished recovery.
+									 */
+};
+
+#endif

tpws/params.c

@@ -50,6 +50,7 @@ static int DLOG_VA(const char *format, int syslog_priority, bool condup, int lev
 	{
 		va_copy(args2,args);
 		DLOG_CON(format,syslog_priority,args2);
+		va_end(args2);
 	}
 	if (params.debug>=level)
 	{

tpws/params.h

@@ -18,7 +18,7 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 
-#define FIX_SEG_DEFAULT_MAX_WAIT		30
+#define FIX_SEG_DEFAULT_MAX_WAIT		50
 
 enum bindll { unwanted=0, no, prefer, force };