From 422faaa29cb896b5af4f79e9170ddd0e533b16f5 Mon Sep 17 00:00:00 2001 From: bol-van Date: Sun, 24 Nov 2024 16:02:51 +0300 Subject: [PATCH] tpws: fixed ipset and hostlist --- tpws/hostlist.c | 79 +++++++++++----- tpws/hostlist.h | 1 + tpws/ipset.c | 59 ++++++++---- tpws/ipset.h | 1 + tpws/pools.c | 12 +-- tpws/tpws.c | 245 +++++++++++++++++++++++++++++++++++------------- 6 files changed, 283 insertions(+), 114 deletions(-) diff --git a/tpws/hostlist.c b/tpws/hostlist.c index 48b3a79..6fbbd7d 100644 --- a/tpws/hostlist.c +++ b/tpws/hostlist.c @@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct) *hostlist = NULL; return false; } - (*ct)++; + if (ct) (*ct)++; } // advance to the next line for (; pfilename); - if (!t) - { - // stat() error - DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename); - return true; - } - if (t==hfile->mod_time) return true; // up to date - StrPoolDestroy(&hfile->hostlist); - if (!AppendHostList(&hfile->hostlist, hfile->filename)) + if (hfile->filename) { + time_t t = file_mod_time(hfile->filename); + if (!t) + { + // stat() error + DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename); + return true; + } + if (t==hfile->mod_time) return true; // up to date StrPoolDestroy(&hfile->hostlist); - return false; + if (!AppendHostList(&hfile->hostlist, hfile->filename)) + { + StrPoolDestroy(&hfile->hostlist); + return false; + } + hfile->mod_time=t; } - hfile->mod_time=t; return true; } static bool LoadHostLists(struct hostlist_files_head *list) @@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con LIST_FOREACH(item, hostlists_exclude, next) { - VPRINT("[%s] exclude ", item->hfile->filename); + VPRINT("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchHostList(item->hfile->hostlist, host)) { if (excluded) *excluded = true; @@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con { LIST_FOREACH(item, hostlists, next) { - VPRINT("[%s] include ", item->hfile->filename); + VPRINT("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchHostList(item->hfile->hostlist, host)) return true; } @@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename) { struct hostlist_file *hfile; - if (!(hfile=hostlist_files_search(hostlists, filename))) - if (!(hfile=hostlist_files_add(hostlists, filename))) + + if (filename) + { + if (!(hfile=hostlist_files_search(hostlists, filename))) + if (!(hfile=hostlist_files_add(hostlists, filename))) + return NULL; + if (!hostlist_collection_search(hl_collection, filename)) + if (!hostlist_collection_add(hl_collection, hfile)) + return NULL; + } + else + { + if (!(hfile=hostlist_files_add(hostlists, NULL))) return NULL; - if (!hostlist_collection_search(hl_collection, filename)) if (!hostlist_collection_add(hl_collection, hfile)) return NULL; + } + return hfile; } struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename) { - if (!file_mod_time(filename)) + if (filename && !file_mod_time(filename)) { DLOG_ERR("cannot access hostlist file '%s'\n",filename); return NULL; @@ -265,15 +285,30 @@ void HostlistsDebug() struct hostlist_item *hl_item; LIST_FOREACH(hfile, ¶ms.hostlists, next) - VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)"); + { + if (hfile->filename) + VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)"); + else + VPRINT("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)"); + } LIST_FOREACH(dpl, ¶ms.desync_profiles, next) { LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next) if (hl_item->hfile!=dpl->dp.hostlist_auto) - VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + { + if (hl_item->hfile->filename) + VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + else + VPRINT("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)"); + } LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next) - VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + { + if (hl_item->hfile->filename) + VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); + else + VPRINT("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)"); + } if (dpl->dp.hostlist_auto) VPRINT("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)"); } diff --git a/tpws/hostlist.h b/tpws/hostlist.h index f49db2d..deedc5c 100644 --- a/tpws/hostlist.h +++ b/tpws/hostlist.h @@ -4,6 +4,7 @@ #include "pools.h" #include "params.h" +bool AppendHostlistItem(strpool **hostlist, char *s); bool AppendHostList(strpool **hostlist, const char *filename); bool LoadAllHostLists(); bool NonEmptyHostlist(strpool **hostlist); diff --git a/tpws/ipset.c b/tpws/ipset.c index 4cce327..266cc3c 100644 --- a/tpws/ipset.c +++ b/tpws/ipset.c @@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct) ipsetDestroy(ips); return false; } - (*ct)++; + if (ct) (*ct)++; } else if (parse_cidr6(cidr,&c6)) { @@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct) ipsetDestroy(ips); return false; } - (*ct)++; + if (ct) (*ct)++; } else DLOG_ERR("bad ip or subnet : %s\n",cidr); @@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct) } +bool AppendIpsetItem(ipset *ips, char *ip) +{ + return addpool(ips,&ip,ip+strlen(ip),NULL); +} + static bool AppendIpset(ipset *ips, const char *filename) { char *p, *e, s[256], *zbuf; @@ -119,21 +124,24 @@ static bool AppendIpset(ipset *ips, const char *filename) static bool LoadIpset(struct ipset_file *hfile) { - time_t t = file_mod_time(hfile->filename); - if (!t) - { - // stat() error - DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename); - return true; - } - if (t==hfile->mod_time) return true; // up to date - ipsetDestroy(&hfile->ipset); - if (!AppendIpset(&hfile->ipset, hfile->filename)) + if (hfile->filename) { + time_t t = file_mod_time(hfile->filename); + if (!t) + { + // stat() error + DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename); + return true; + } + if (t==hfile->mod_time) return true; // up to date ipsetDestroy(&hfile->ipset); - return false; + if (!AppendIpset(&hfile->ipset, hfile->filename)) + { + ipsetDestroy(&hfile->ipset); + return false; + } + hfile->mod_time=t; } - hfile->mod_time=t; return true; } static bool LoadIpsets(struct ipset_files_head *list) @@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip LIST_FOREACH(item, ips_exclude, next) { - VPRINT("[%s] exclude ",item->hfile->filename); + VPRINT("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchIpset(&item->hfile->ipset, ipv4, ipv6)) return false; } @@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip { LIST_FOREACH(item, ips, next) { - VPRINT("[%s] include ",item->hfile->filename); + VPRINT("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed"); if (SearchIpset(&item->hfile->ipset, ipv4, ipv6)) return true; } @@ -244,7 +252,7 @@ static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct } struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename) { - if (!file_mod_time(filename)) + if (filename && !file_mod_time(filename)) { DLOG_ERR("cannot access ipset file '%s'\n",filename); return NULL; @@ -277,13 +285,24 @@ void IpsetsDebug() struct ipset_item *ips_item; LIST_FOREACH(hfile, ¶ms.ipsets, next) - VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset)); + { + if (hfile->filename) + VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset)); + else + VPRINT("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset)); + } LIST_FOREACH(dpl, ¶ms.desync_profiles, next) { LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next) - VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + if (ips_item->hfile->filename) + VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + else + VPRINT("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset)); LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next) - VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + if (ips_item->hfile->filename) + VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); + else + VPRINT("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset)); } } diff --git a/tpws/ipset.h b/tpws/ipset.h index 9852ca6..f283c2f 100644 --- a/tpws/ipset.h +++ b/tpws/ipset.h @@ -9,3 +9,4 @@ bool LoadAllIpsets(); bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6); struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename); void IpsetsDebug(); +bool AppendIpsetItem(ipset *ips, char *ip); diff --git a/tpws/pools.c b/tpws/pools.c index 81a7b80..052e3b3 100644 --- a/tpws/pools.c +++ b/tpws/pools.c @@ -160,7 +160,7 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const struct hostlist_file *entry = malloc(sizeof(struct hostlist_file)); if (entry) { - if (!(entry->filename = strdup(filename))) + if (filename && !(entry->filename = strdup(filename))) { free(entry); return false; @@ -192,7 +192,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co LIST_FOREACH(hfile, head, next) { - if (!strcmp(hfile->filename,filename)) + if (hfile->filename && !strcmp(hfile->filename,filename)) return hfile; } return NULL; @@ -223,7 +223,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head LIST_FOREACH(item, head, next) { - if (!strcmp(item->hfile->filename,filename)) + if (item->hfile->filename && !strcmp(item->hfile->filename,filename)) return item; } return NULL; @@ -369,7 +369,7 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi struct ipset_file *entry = malloc(sizeof(struct ipset_file)); if (entry) { - if (!(entry->filename = strdup(filename))) + if (filename && !(entry->filename = strdup(filename))) { free(entry); return false; @@ -401,7 +401,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char LIST_FOREACH(hfile, head, next) { - if (!strcmp(hfile->filename,filename)) + if (hfile->filename && !strcmp(hfile->filename,filename)) return hfile; } return NULL; @@ -432,7 +432,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c LIST_FOREACH(item, head, next) { - if (!strcmp(item->hfile->filename,filename)) + if (item->hfile->filename && !strcmp(item->hfile->filename,filename)) return item; } return NULL; diff --git a/tpws/tpws.c b/tpws/tpws.c index 46bbb8d..1a913f8 100644 --- a/tpws/tpws.c +++ b/tpws/tpws.c @@ -182,10 +182,14 @@ static void exithelp(void) " --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n" " --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n" " --ipset=\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n" + " --ipset-ip=\t\t\t; comma separated fixed ip list\n" " --ipset-exclude=\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n" + " --ipset-exclude-ip=\t\t; comma separated fixed ip list\n" "\nHOSTLIST FILTER:\n" " --hostlist=\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" + " --hostlist-domains=\t; comma separated fixed domain list\n" " --hostlist-exclude=\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" + " --hostlist-exclude-domains= ; comma separated fixed domain list\n" " --hostlist-auto=\t\t; detect DPI blocks and build hostlist automatically\n" " --hostlist-auto-fail-threshold=\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n" " --hostlist-auto-fail-time=\t; all failed attemps must be within these seconds (default : %d)\n" @@ -484,6 +488,46 @@ static bool parse_pf_list(char *opt, struct port_filters_head *pfl) return true; } +static bool parse_domain_list(char *opt, strpool **pp) +{ + char *e,*p,c; + + for (p=opt ; p ; ) + { + if ((e = strchr(p,','))) + { + c=*e; + *e=0; + } + + if (*p && !AppendHostlistItem(pp,p)) return false; + + if (e) *e++=c; + p = e; + } + return true; +} + +static bool parse_ip_list(char *opt, ipset *pp) +{ + char *e,*p,c; + + for (p=opt ; p ; ) + { + if ((e = strchr(p,','))) + { + c=*e; + *e=0; + } + + if (*p && !AppendIpsetItem(pp,p)) return false; + + if (e) *e++=c; + p = e; + } + return true; +} + #if !defined( __OpenBSD__) && !defined(__ANDROID__) // no static to not allow optimizer to inline this func (save stack) void config_from_file(const char *filename) @@ -526,6 +570,8 @@ void parse_params(int argc, char *argv[]) int option_index = 0; int v, i; bool bSkip=false; + struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL; + struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL; memset(¶ms, 0, sizeof(params)); params.maxconn = DEFAULT_MAX_CONN; @@ -611,46 +657,50 @@ void parse_params(int argc, char *argv[]) { "tlsrec",required_argument,0,0 },// optidx=34 { "tlsrec-pos",required_argument,0,0 },// optidx=35 { "hostlist",required_argument,0,0 },// optidx=36 - { "hostlist-exclude",required_argument,0,0 },// optidx=37 - { "hostlist-auto",required_argument,0,0}, // optidx=38 - { "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=39 - { "hostlist-auto-fail-time",required_argument,0,0}, // optidx=40 - { "hostlist-auto-debug",required_argument,0,0}, // optidx=41 - { "pidfile",required_argument,0,0 },// optidx=42 - { "debug",optional_argument,0,0 },// optidx=43 - { "debug-level",required_argument,0,0 },// optidx=44 - { "local-rcvbuf",required_argument,0,0 },// optidx=45 - { "local-sndbuf",required_argument,0,0 },// optidx=46 - { "remote-rcvbuf",required_argument,0,0 },// optidx=47 - { "remote-sndbuf",required_argument,0,0 },// optidx=48 - { "socks",no_argument,0,0 },// optidx=40 - { "no-resolve",no_argument,0,0 },// optidx=50 - { "resolver-threads",required_argument,0,0 },// optidx=51 - { "skip-nodelay",no_argument,0,0 },// optidx=52 - { "tamper-start",required_argument,0,0 },// optidx=53 - { "tamper-cutoff",required_argument,0,0 },// optidx=54 - { "connect-bind-addr",required_argument,0,0 },// optidx=55 + { "hostlist-domains",required_argument,0,0 },// optidx=37 + { "hostlist-exclude",required_argument,0,0 },// optidx=38 + { "hostlist-exclude-domains",required_argument,0,0 },// optidx=39 + { "hostlist-auto",required_argument,0,0}, // optidx=40 + { "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=41 + { "hostlist-auto-fail-time",required_argument,0,0}, // optidx=42 + { "hostlist-auto-debug",required_argument,0,0}, // optidx=43 + { "pidfile",required_argument,0,0 },// optidx=44 + { "debug",optional_argument,0,0 },// optidx=45 + { "debug-level",required_argument,0,0 },// optidx=46 + { "local-rcvbuf",required_argument,0,0 },// optidx=47 + { "local-sndbuf",required_argument,0,0 },// optidx=48 + { "remote-rcvbuf",required_argument,0,0 },// optidx=49 + { "remote-sndbuf",required_argument,0,0 },// optidx=50 + { "socks",no_argument,0,0 },// optidx=51 + { "no-resolve",no_argument,0,0 },// optidx=52 + { "resolver-threads",required_argument,0,0 },// optidx=53 + { "skip-nodelay",no_argument,0,0 },// optidx=54 + { "tamper-start",required_argument,0,0 },// optidx=55 + { "tamper-cutoff",required_argument,0,0 },// optidx=56 + { "connect-bind-addr",required_argument,0,0 },// optidx=57 - { "new",no_argument,0,0 }, // optidx=56 - { "skip",no_argument,0,0 }, // optidx=57 - { "filter-l3",required_argument,0,0 }, // optidx=58 - { "filter-tcp",required_argument,0,0 }, // optidx=59 - { "filter-l7",required_argument,0,0 }, // optidx=60 - { "ipset",required_argument,0,0 }, // optidx=61 - { "ipset-exclude",required_argument,0,0 }, // optidx=62 + { "new",no_argument,0,0 }, // optidx=58 + { "skip",no_argument,0,0 }, // optidx=59 + { "filter-l3",required_argument,0,0 }, // optidx=60 + { "filter-tcp",required_argument,0,0 }, // optidx=61 + { "filter-l7",required_argument,0,0 }, // optidx=62 + { "ipset",required_argument,0,0 }, // optidx=63 + { "ipset-ip",required_argument,0,0 }, // optidx=64 + { "ipset-exclude",required_argument,0,0 }, // optidx=65 + { "ipset-exclude-ip",required_argument,0,0 }, // optidx=66 #if defined(__FreeBSD__) - { "enable-pf",no_argument,0,0 },// optidx=62 + { "enable-pf",no_argument,0,0 },// optidx=67 #elif defined(__APPLE__) - { "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63 - { "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64 + { "local-tcp-user-timeout",required_argument,0,0 }, // optidx=67 + { "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=68 #elif defined(__linux__) - { "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63 - { "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64 - { "mss",required_argument,0,0 }, // optidx=65 - { "fix-seg",optional_argument,0,0 }, // optidx=66 + { "local-tcp-user-timeout",required_argument,0,0 }, // optidx=67 + { "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=68 + { "mss",required_argument,0,0 }, // optidx=69 + { "fix-seg",optional_argument,0,0 }, // optidx=70 #ifdef SPLICE_PRESENT - { "nosplice",no_argument,0,0 }, // optidx=67 + { "nosplice",no_argument,0,0 }, // optidx=71 #endif #endif { "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility @@ -948,6 +998,7 @@ void parse_params(int argc, char *argv[]) params.tamper = true; break; case 36: /* hostlist */ + if (bSkip) break; if (!RegisterHostlist(dp, false, optarg)) { DLOG_ERR("failed to register hostlist '%s'\n", optarg); @@ -955,7 +1006,22 @@ void parse_params(int argc, char *argv[]) } params.tamper = true; break; - case 37: /* hostlist-exclude */ + case 37: /* hostlist-domains */ + if (bSkip) break; + if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL))) + { + DLOG_ERR("failed to register anonymous hostlist\n"); + exit_clean(1); + } + if (!parse_domain_list(optarg, &anon_hl->hostlist)) + { + DLOG_ERR("failed to add domains to anonymous hostlist\n"); + exit_clean(1); + } + params.tamper = true; + break; + case 38: /* hostlist-exclude */ + if (bSkip) break; if (!RegisterHostlist(dp, true, optarg)) { DLOG_ERR("failed to register hostlist '%s'\n", optarg); @@ -963,7 +1029,22 @@ void parse_params(int argc, char *argv[]) } params.tamper = true; break; - case 38: /* hostlist-auto */ + case 39: /* hostlist-exclude-domains */ + if (bSkip) break; + if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL))) + { + DLOG_ERR("failed to register anonymous hostlist\n"); + exit_clean(1); + } + if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist)) + { + DLOG_ERR("failed to add domains to anonymous hostlist\n"); + exit_clean(1); + } + params.tamper = true; + break; + case 40: /* hostlist-auto */ + if (bSkip) break; if (dp->hostlist_auto) { DLOG_ERR("only one auto hostlist per profile is supported\n"); @@ -991,7 +1072,7 @@ void parse_params(int argc, char *argv[]) } params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice. break; - case 39: /* hostlist-auto-fail-threshold */ + case 41: /* hostlist-auto-fail-threshold */ dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg); if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20) { @@ -999,7 +1080,7 @@ void parse_params(int argc, char *argv[]) exit_clean(1); } break; - case 40: /* hostlist-auto-fail-time */ + case 42: /* hostlist-auto-fail-time */ dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg); if (dp->hostlist_auto_fail_time<1) { @@ -1007,7 +1088,7 @@ void parse_params(int argc, char *argv[]) exit_clean(1); } break; - case 41: /* hostlist-auto-debug */ + case 43: /* hostlist-auto-debug */ { FILE *F = fopen(optarg,"a+t"); if (!F) @@ -1020,11 +1101,11 @@ void parse_params(int argc, char *argv[]) params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0'; } break; - case 42: /* pidfile */ + case 44: /* pidfile */ strncpy(params.pidfile,optarg,sizeof(params.pidfile)); params.pidfile[sizeof(params.pidfile)-1]='\0'; break; - case 43: /* debug */ + case 45: /* debug */ if (optarg) { if (*optarg=='@') @@ -1058,44 +1139,44 @@ void parse_params(int argc, char *argv[]) params.debug_target = LOG_TARGET_CONSOLE; } break; - case 44: /* debug-level */ + case 46: /* debug-level */ params.debug = atoi(optarg); break; - case 45: /* local-rcvbuf */ + case 47: /* local-rcvbuf */ #ifdef __linux__ params.local_rcvbuf = atoi(optarg)/2; #else params.local_rcvbuf = atoi(optarg); #endif break; - case 46: /* local-sndbuf */ + case 48: /* local-sndbuf */ #ifdef __linux__ params.local_sndbuf = atoi(optarg)/2; #else params.local_sndbuf = atoi(optarg); #endif break; - case 47: /* remote-rcvbuf */ + case 49: /* remote-rcvbuf */ #ifdef __linux__ params.remote_rcvbuf = atoi(optarg)/2; #else params.remote_rcvbuf = atoi(optarg); #endif break; - case 48: /* remote-sndbuf */ + case 50: /* remote-sndbuf */ #ifdef __linux__ params.remote_sndbuf = atoi(optarg)/2; #else params.remote_sndbuf = atoi(optarg); #endif break; - case 49: /* socks */ + case 51: /* socks */ params.proxy_type = CONN_TYPE_SOCKS; break; - case 50: /* no-resolve */ + case 52: /* no-resolve */ params.no_resolve = true; break; - case 51: /* resolver-threads */ + case 53: /* resolver-threads */ params.resolver_threads = atoi(optarg); if (params.resolver_threads<1 || params.resolver_threads>300) { @@ -1103,10 +1184,10 @@ void parse_params(int argc, char *argv[]) exit_clean(1); } break; - case 52: /* skip-nodelay */ + case 54: /* skip-nodelay */ params.skip_nodelay = true; break; - case 53: /* tamper-start */ + case 55: /* tamper-start */ { const char *p=optarg; if (*p=='n') @@ -1120,7 +1201,7 @@ void parse_params(int argc, char *argv[]) } params.tamper_lim = true; break; - case 54: /* tamper-cutoff */ + case 56: /* tamper-cutoff */ { const char *p=optarg; if (*p=='n') @@ -1134,7 +1215,7 @@ void parse_params(int argc, char *argv[]) } params.tamper_lim = true; break; - case 55: /* connect-bind-addr */ + case 57: /* connect-bind-addr */ { char *p = strchr(optarg,'%'); if (p) *p++=0; @@ -1162,7 +1243,7 @@ void parse_params(int argc, char *argv[]) break; - case 56: /* new */ + case 58: /* new */ if (bSkip) { dp_clear(dp); @@ -1180,32 +1261,35 @@ void parse_params(int argc, char *argv[]) dp = &dpl->dp; dp->n = ++desync_profile_count; } + anon_hl = anon_hl_exclude = NULL; + anon_ips = anon_ips_exclude = NULL; break; - case 57: /* skip */ + case 59: /* skip */ bSkip = true; break; - case 58: /* filter-l3 */ + case 60: /* filter-l3 */ if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6)) { DLOG_ERR("bad value for --filter-l3\n"); exit_clean(1); } break; - case 59: /* filter-tcp */ + case 61: /* filter-tcp */ if (!parse_pf_list(optarg,&dp->pf_tcp)) { DLOG_ERR("Invalid port filter : %s\n",optarg); exit_clean(1); } break; - case 60: /* filter-l7 */ + case 62: /* filter-l7 */ if (!parse_l7_list(optarg,&dp->filter_l7)) { DLOG_ERR("Invalid l7 filter : %s\n",optarg); exit_clean(1); } break; - case 61: /* ipset */ + case 63: /* ipset */ + if (bSkip) break; if (!RegisterIpset(dp, false, optarg)) { DLOG_ERR("failed to register ipset '%s'\n", optarg); @@ -1213,7 +1297,22 @@ void parse_params(int argc, char *argv[]) } params.tamper = true; break; - case 62: /* ipset-exclude */ + case 64: /* ipset-ip */ + if (bSkip) break; + if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL))) + { + DLOG_ERR("failed to register anonymous ipset\n"); + exit_clean(1); + } + if (!parse_ip_list(optarg, &anon_ips->ipset)) + { + DLOG_ERR("failed to add subnets to anonymous ipset\n"); + exit_clean(1); + } + params.tamper = true; + break; + case 65: /* ipset-exclude */ + if (bSkip) break; if (!RegisterIpset(dp, true, optarg)) { DLOG_ERR("failed to register ipset '%s'\n", optarg); @@ -1221,13 +1320,27 @@ void parse_params(int argc, char *argv[]) } params.tamper = true; break; + case 66: /* ipset-exclude-ip */ + if (bSkip) break; + if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL))) + { + DLOG_ERR("failed to register anonymous ipset\n"); + exit_clean(1); + } + if (!parse_ip_list(optarg, &anon_ips_exclude->ipset)) + { + DLOG_ERR("failed to add subnets to anonymous ipset\n"); + exit_clean(1); + } + params.tamper = true; + break; #if defined(__FreeBSD__) - case 63: /* enable-pf */ + case 67: /* enable-pf */ params.pf_enable = true; break; #elif defined(__linux__) || defined(__APPLE__) - case 63: /* local-tcp-user-timeout */ + case 67: /* local-tcp-user-timeout */ params.tcp_user_timeout_local = atoi(optarg); if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400) { @@ -1235,7 +1348,7 @@ void parse_params(int argc, char *argv[]) exit_clean(1); } break; - case 64: /* remote-tcp-user-timeout */ + case 68: /* remote-tcp-user-timeout */ params.tcp_user_timeout_remote = atoi(optarg); if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400) { @@ -1246,7 +1359,7 @@ void parse_params(int argc, char *argv[]) #endif #if defined(__linux__) - case 65: /* mss */ + case 69: /* mss */ // this option does not work in any BSD and MacOS. OS may accept but it changes nothing dp->mss = atoi(optarg); if (dp->mss<88 || dp->mss>32767) @@ -1255,7 +1368,7 @@ void parse_params(int argc, char *argv[]) exit_clean(1); } break; - case 66: /* fix-seg */ + case 70: /* fix-seg */ if (!params.fix_seg_avail) { DLOG_ERR("--fix-seg is supported since kernel 4.6\n"); @@ -1275,7 +1388,7 @@ void parse_params(int argc, char *argv[]) params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT; break; #ifdef SPLICE_PRESENT - case 67: /* nosplice */ + case 71: /* nosplice */ params.nosplice = true; break; #endif