drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-05-24 22:32:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

autottl, datanoack, oob, postnat

Browse Source
This commit is contained in:
bol-van
2024-03-02 17:53:37 +03:00
parent 2157fed592
commit 8a161f1f49
48 changed files with 597 additions and 249 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nfq/conntrack.h
View File

@@ -66,6 +66,8 @@ typedef struct
bool req_seq_start_present, req_seq_present;
uint32_t req_seq_start,req_seq_end; // sequence interval of the request (to track retransmissions)
uint8_t autottl;
bool b_cutoff; // mark for deletion
bool b_wssize_cutoff, b_desync_cutoff;

63
nfq/darkmagic.c
View File

@@ -59,13 +59,14 @@ uint8_t tcp_find_scale_factor(const struct tcphdr *tcp)
// n prefix (nsport, nwsize) means network byte order
static void fill_tcphdr(
struct tcphdr *tcp, uint8_t fooling, uint8_t tcp_flags,
struct tcphdr *tcp, uint32_t fooling, uint8_t tcp_flags,
uint32_t nseq, uint32_t nack_seq,
uint16_t nsport, uint16_t ndport,
uint16_t nwsize, uint8_t scale_factor,
uint32_t *timestamps,
uint32_t badseq_increment,
uint32_t badseq_ack_increment)
uint32_t badseq_ack_increment,
uint16_t data_len)
{
char *tcpopt = (char*)(tcp+1);
uint8_t t=0;
@@ -84,6 +85,8 @@ static void fill_tcphdr(
tcp->th_ack = nack_seq;
}
tcp->th_off = 5;
if ((fooling & FOOL_DATANOACK) && !(tcp_flags & (TH_SYN|TH_RST)) && data_len)
tcp_flags &= ~TH_ACK;
*((uint8_t*)tcp+13)= tcp_flags;
tcp->th_win = nwsize;
if (fooling & FOOL_MD5SIG)
@@ -115,7 +118,7 @@ static void fill_tcphdr(
tcp->th_off += t>>2;
tcp->th_sum = 0;
}
static uint16_t tcpopt_len(uint8_t fooling, const uint32_t *timestamps, uint8_t scale_factor)
static uint16_t tcpopt_len(uint32_t fooling, const uint32_t *timestamps, uint8_t scale_factor)
{
uint16_t t=0;
if (fooling & FOOL_MD5SIG) t=18;
@@ -163,7 +166,7 @@ bool prepare_tcp_segment4(
uint8_t scale_factor,
uint32_t *timestamps,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
uint32_t badseq_increment,
uint32_t badseq_ack_increment,
const void *data, uint16_t len,
@@ -179,7 +182,7 @@ bool prepare_tcp_segment4(
uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen;
fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, ttl);
fill_tcphdr(tcp,fooling,tcp_flags,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment);
fill_tcphdr(tcp,fooling,tcp_flags,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len);
memcpy(payload,data,len);
tcp4_fix_checksum(tcp,ip_payload_len,&ip->ip_src,&ip->ip_dst);
@@ -197,7 +200,7 @@ bool prepare_tcp_segment6(
uint8_t scale_factor,
uint32_t *timestamps,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
uint32_t badseq_increment,
uint32_t badseq_ack_increment,
const void *data, uint16_t len,
@@ -262,7 +265,7 @@ bool prepare_tcp_segment6(
uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen;
fill_ip6hdr(ip6, &src->sin6_addr, &dst->sin6_addr, ip_payload_len, proto, ttl);
fill_tcphdr(tcp,fooling,tcp_flags,nseq,nack_seq,src->sin6_port,dst->sin6_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment);
fill_tcphdr(tcp,fooling,tcp_flags,nseq,nack_seq,src->sin6_port,dst->sin6_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len);
memcpy(payload,data,len);
tcp6_fix_checksum(tcp,transport_payload_len,&ip6->ip6_src,&ip6->ip6_dst);
@@ -280,7 +283,7 @@ bool prepare_tcp_segment(
uint8_t scale_factor,
uint32_t *timestamps,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
uint32_t badseq_increment,
uint32_t badseq_ack_increment,
const void *data, uint16_t len,
@@ -298,7 +301,7 @@ bool prepare_tcp_segment(
bool prepare_udp_segment4(
const struct sockaddr_in *src, const struct sockaddr_in *dst,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
const uint8_t *padding, size_t padding_size,
int padlen,
const void *data, uint16_t len,
@@ -338,7 +341,7 @@ bool prepare_udp_segment4(
bool prepare_udp_segment6(
const struct sockaddr_in6 *src, const struct sockaddr_in6 *dst,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
const uint8_t *padding, size_t padding_size,
int padlen,
const void *data, uint16_t len,
@@ -426,7 +429,7 @@ bool prepare_udp_segment6(
bool prepare_udp_segment(
const struct sockaddr *src, const struct sockaddr *dst,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
const uint8_t *padding, size_t padding_size,
int padlen,
const void *data, uint16_t len,
@@ -674,11 +677,11 @@ static void str_ip(char *s, size_t s_len, const struct ip *ip)
char ss[35],s_proto[16];
str_srcdst_ip(ss,sizeof(ss),&ip->ip_src,&ip->ip_dst);
str_proto_name(s_proto,sizeof(s_proto),ip->ip_p);
snprintf(s,s_len,"%s proto=%s",ss,s_proto);
snprintf(s,s_len,"%s proto=%s ttl=%u",ss,s_proto,ip->ip_ttl);
}
void print_ip(const struct ip *ip)
{
char s[64];
char s[66];
str_ip(s,sizeof(s),ip);
printf("%s",s);
}
@@ -695,7 +698,7 @@ static void str_ip6hdr(char *s, size_t s_len, const struct ip6_hdr *ip6hdr, uint
char ss[83],s_proto[16];
str_srcdst_ip6(ss,sizeof(ss),&ip6hdr->ip6_src,&ip6hdr->ip6_dst);
str_proto_name(s_proto,sizeof(s_proto),proto);
snprintf(s,s_len,"%s proto=%s",ss,s_proto);
snprintf(s,s_len,"%s proto=%s ttl=%u",ss,s_proto,ip6hdr->ip6_hlim);
}
void print_ip6hdr(const struct ip6_hdr *ip6hdr, uint8_t proto)
{
@@ -1170,3 +1173,35 @@ nofix:
}
return true;
}
// return guessed fake ttl value. 0 means unsuccessfull, should not perform autottl fooling
// ttl = TTL of incoming packet
uint8_t autottl_guess(uint8_t ttl, const autottl *attl)
{
uint8_t orig, path, fake;
// 18.65.168.125 ( cloudfront ) 255
// 157.254.246.178 128
// 1.1.1.1 64
// guess original ttl. consider path lengths less than 32 hops
if (ttl>223)
orig=255;
else if (ttl<128 && ttl>96)
orig=128;
else if (ttl<64 && ttl>32)
orig=64;
else
return 0;
path = orig - ttl;
if (path <=attl->delta) return 0;
fake = path - attl->delta;
if (fake<attl->min) fake=attl->min;
else if (fake>attl->max) fake=attl->max;
if (fake>=path) return 0;
return fake;
}

25
nfq/darkmagic.h
View File

@@ -24,6 +24,7 @@ uint32_t net16_add(uint16_t netorder_value, uint16_t cpuorder_increment);
#define FOOL_HOPBYHOP2 0x20
#define FOOL_DESTOPT 0x40
#define FOOL_IPFRAG1 0x80
#define FOOL_DATANOACK 0x100
#define SCALE_NONE ((uint8_t)-1)
@@ -36,7 +37,7 @@ bool prepare_tcp_segment4(
uint8_t scale_factor,
uint32_t *timestamps,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
uint32_t badseq_increment,
uint32_t badseq_ack_increment,
const void *data, uint16_t len,
@@ -49,7 +50,7 @@ bool prepare_tcp_segment6(
uint8_t scale_factor,
uint32_t *timestamps,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
uint32_t badseq_increment,
uint32_t badseq_ack_increment,
const void *data, uint16_t len,
@@ -62,7 +63,7 @@ bool prepare_tcp_segment(
uint8_t scale_factor,
uint32_t *timestamps,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
uint32_t badseq_increment,
uint32_t badseq_ack_increment,
const void *data, uint16_t len,
@@ -72,7 +73,7 @@ bool prepare_tcp_segment(
bool prepare_udp_segment4(
const struct sockaddr_in *src, const struct sockaddr_in *dst,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
const uint8_t *padding, size_t padding_size,
int padlen,
const void *data, uint16_t len,
@@ -80,7 +81,7 @@ bool prepare_udp_segment4(
bool prepare_udp_segment6(
const struct sockaddr_in6 *src, const struct sockaddr_in6 *dst,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
const uint8_t *padding, size_t padding_size,
int padlen,
const void *data, uint16_t len,
@@ -88,7 +89,7 @@ bool prepare_udp_segment6(
bool prepare_udp_segment(
const struct sockaddr *src, const struct sockaddr *dst,
uint8_t ttl,
uint8_t fooling,
uint32_t fooling,
const uint8_t *padding, size_t padding_size,
int padlen,
const void *data, uint16_t len,
@@ -149,3 +150,15 @@ bool tcp_ack_segment(const struct tcphdr *tcphdr);
// scale_factor=SCALE_NONE - do not change
void tcp_rewrite_wscale(struct tcphdr *tcp, uint8_t scale_factor);
void tcp_rewrite_winsize(struct tcphdr *tcp, uint16_t winsize, uint8_t scale_factor);
typedef struct
{
uint8_t delta, min, max;
} autottl;
#define AUTOTTL_DEFAULT_DELTA 1
#define AUTOTTL_DEFAULT_MIN 3
#define AUTOTTL_DEFAULT_MAX 20
#define AUTOTTL_ENABLED(a) (!!(a).delta)
#define AUTOTTL_SET_DEFAULT(a) {(a).delta=AUTOTTL_DEFAULT_DELTA; (a).min=AUTOTTL_DEFAULT_MIN; (a).max=AUTOTTL_DEFAULT_MAX;}
uint8_t autottl_guess(uint8_t ttl, const autottl *attl);

22
nfq/desync.c
View File

@@ -333,6 +333,7 @@ packet_process_result dpi_desync_tcp_packet(uint32_t fwmark, const char *ifout,
uint32_t *timestamps;
if (!!ip == !!ip6hdr) return res; // one and only one must be present
ttl_orig = ip ? ip->ip_ttl : ip6hdr->ip6_ctlun.ip6_un1.ip6_un1_hlim;
ConntrackPoolPurge(&params.conntrack);
if (ConntrackPoolFeed(&params.conntrack, ip, ip6hdr, tcphdr, NULL, len_payload, &ctrack, &bReverse))
@@ -349,6 +350,19 @@ packet_process_result dpi_desync_tcp_packet(uint32_t fwmark, const char *ifout,
if (bReverse)
{
if (ctrack && !ctrack->autottl && ctrack->pcounter_reply==1)
{
autottl *attl = ip ? &params.desync_autottl : &params.desync_autottl6;
if (AUTOTTL_ENABLED(*attl))
{
ctrack->autottl = autottl_guess(ttl_orig, attl);
if (ctrack->autottl)
DLOG("autottl: guessed %u\n",ctrack->autottl)
else
DLOG("autottl: could not guess\n")
}
}
// process reply packets for auto hostlist mode
// by looking at RSTs or HTTP replies we decide whether original request looks like DPI blocked
// we only process first-sequence replies. do not react to subsequent redirects or RSTs
@@ -415,9 +429,7 @@ packet_process_result dpi_desync_tcp_packet(uint32_t fwmark, const char *ifout,
if (params.desync_mode0!=DESYNC_NONE || params.desync_mode!=DESYNC_NONE) // save some cpu
{
ttl_orig = ip ? ip->ip_ttl : ip6hdr->ip6_ctlun.ip6_un1.ip6_un1_hlim;
if (ip6hdr) ttl_fake = params.desync_ttl6 ? params.desync_ttl6 : ttl_orig;
else ttl_fake = params.desync_ttl ? params.desync_ttl : ttl_orig;
ttl_fake = (ctrack && ctrack->autottl) ? ctrack->autottl : (ip6hdr ? (params.desync_ttl6 ? params.desync_ttl6 : ttl_orig) : (params.desync_ttl ? params.desync_ttl : ttl_orig));
flags_orig = *((uint8_t*)tcphdr+13);
scale_factor = tcp_find_scale_factor(tcphdr);
timestamps = tcp_find_timestamps(tcphdr);
@@ -628,7 +640,7 @@ packet_process_result dpi_desync_tcp_packet(uint32_t fwmark, const char *ifout,
}
enum dpi_desync_mode desync_mode = params.desync_mode;
uint8_t fooling_orig = FOOL_NONE;
uint32_t fooling_orig = FOOL_NONE;
bool b;
pkt1_len = sizeof(pkt1);
@@ -1026,7 +1038,7 @@ packet_process_result dpi_desync_udp_packet(uint32_t fwmark, const char *ifout,
}
enum dpi_desync_mode desync_mode = params.desync_mode;
uint8_t fooling_orig = FOOL_NONE;
uint32_t fooling_orig = FOOL_NONE;
ttl_orig = ip ? ip->ip_ttl : ip6hdr->ip6_ctlun.ip6_un1.ip6_un1_hlim;
if (ip6hdr) ttl_fake = params.desync_ttl6 ? params.desync_ttl6 : ttl_orig;

172
nfq/nfqws.c
View File

@@ -540,7 +540,9 @@ static void exithelp(void)
#endif
" --dpi-desync-ttl=<int>\t\t\t\t; set ttl for desync packet\n"
" --dpi-desync-ttl6=<int>\t\t\t; set ipv6 hop limit for desync packet. by default ttl value is used.\n"
" --dpi-desync-fooling=<mode>[,<mode>]\t\t; can use multiple comma separated values. modes : none md5sig ts badseq badsum hopbyhop hopbyhop2\n"
" --dpi-desync-autottl=[<delta>[:<min>[-<max>]]]\t; auto ttl mode for both ipv4 and ipv6. default: %u:%u-%u\n"
" --dpi-desync-autottl6=[<delta>[:<min>[-<max>]]] ; overrides --dpi-desync-autottl for ipv6 only\n"
" --dpi-desync-fooling=<mode>[,<mode>]\t\t; can use multiple comma separated values. modes : none md5sig ts badseq badsum datanoack hopbyhop hopbyhop2\n"
#ifdef __linux__
" --dpi-desync-retrans=0|1\t\t\t; 0(default)=reinject original data packet after fake 1=drop original data packet to force its retransmission\n"
#endif
@@ -573,6 +575,7 @@ static void exithelp(void)
#if defined(__linux__) || defined(SO_USER_COOKIE)
DPI_DESYNC_FWMARK_DEFAULT,DPI_DESYNC_FWMARK_DEFAULT,
#endif
AUTOTTL_DEFAULT_DELTA,AUTOTTL_DEFAULT_MIN,AUTOTTL_DEFAULT_MAX,
DPI_DESYNC_MAX_FAKE_LEN,
DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_UDP_DEFAULT,
DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_TCP_DEFAULT,
@@ -643,6 +646,31 @@ static void load_file_or_exit(const char *filename, void *buf, size_t *size)
}
}
bool parse_autottl(const char *s, autottl *t)
{
unsigned int delta,min,max;
AUTOTTL_SET_DEFAULT(*t);
if (s)
{
max = t->max;
switch (sscanf(s,"%u:%u-%u",&delta,&min,&max))
{
case 3:
if (delta && !max || max>255) return false;
t->max=(uint8_t)max;
case 2:
if (delta && !min || min>255 || min>max) return false;
t->min=(uint8_t)min;
case 1:
if (delta>255) return false;
t->delta=(uint8_t)delta;
break;
default:
return false;
}
}
return true;
}
int main(int argc, char **argv)
{
@@ -727,37 +755,39 @@ int main(int argc, char **argv)
#endif
{"dpi-desync-ttl",required_argument,0,0}, // optidx=16
{"dpi-desync-ttl6",required_argument,0,0}, // optidx=17
{"dpi-desync-fooling",required_argument,0,0}, // optidx=18
{"dpi-desync-retrans",optional_argument,0,0}, // optidx=19
{"dpi-desync-repeats",required_argument,0,0}, // optidx=20
{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=21
{"dpi-desync-split-pos",required_argument,0,0},// optidx=22
{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=23
{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=24
{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=25
{"dpi-desync-badack-increment",required_argument,0,0},// optidx=26
{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=27
{"dpi-desync-fake-http",required_argument,0,0},// optidx=28
{"dpi-desync-fake-tls",required_argument,0,0},// optidx=29
{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=30
{"dpi-desync-fake-quic",required_argument,0,0},// optidx=31
{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=32
{"dpi-desync-fake-dht",required_argument,0,0},// optidx=33
{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=34
{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=35
{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=36
{"dpi-desync-cutoff",required_argument,0,0},// optidx=37
{"hostlist",required_argument,0,0}, // optidx=38
{"hostlist-exclude",required_argument,0,0}, // optidx=39
{"hostlist-auto",required_argument,0,0}, // optidx=40
{"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=41
{"hostlist-auto-fail-time",required_argument,0,0}, // optidx=42
{"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=43
{"hostlist-auto-debug",required_argument,0,0}, // optidx=44
{"dpi-desync-autottl",optional_argument,0,0}, // optidx=18
{"dpi-desync-autottl6",optional_argument,0,0}, // optidx=19
{"dpi-desync-fooling",required_argument,0,0}, // optidx=20
{"dpi-desync-retrans",optional_argument,0,0}, // optidx=21
{"dpi-desync-repeats",required_argument,0,0}, // optidx=22
{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=23
{"dpi-desync-split-pos",required_argument,0,0},// optidx=24
{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=25
{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=26
{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=27
{"dpi-desync-badack-increment",required_argument,0,0},// optidx=28
{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=29
{"dpi-desync-fake-http",required_argument,0,0},// optidx=30
{"dpi-desync-fake-tls",required_argument,0,0},// optidx=31
{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=32
{"dpi-desync-fake-quic",required_argument,0,0},// optidx=33
{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=34
{"dpi-desync-fake-dht",required_argument,0,0},// optidx=35
{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=36
{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=37
{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=38
{"dpi-desync-cutoff",required_argument,0,0},// optidx=39
{"hostlist",required_argument,0,0}, // optidx=40
{"hostlist-exclude",required_argument,0,0}, // optidx=41
{"hostlist-auto",required_argument,0,0}, // optidx=42
{"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=43
{"hostlist-auto-fail-time",required_argument,0,0}, // optidx=44
{"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=45
{"hostlist-auto-debug",required_argument,0,0}, // optidx=46
#ifdef __linux__
{"bind-fix4",no_argument,0,0}, // optidx=45
{"bind-fix6",no_argument,0,0}, // optidx=46
{"bind-fix4",no_argument,0,0}, // optidx=47
{"bind-fix6",no_argument,0,0}, // optidx=48
#endif
{NULL,0,NULL,0}
};
@@ -924,7 +954,21 @@ int main(int argc, char **argv)
case 17: /* dpi-desync-ttl6 */
params.desync_ttl6 = (uint8_t)atoi(optarg);
break;
case 18: /* dpi-desync-fooling */
case 18: /* dpi-desync-autottl */
if (!parse_autottl(optarg, &params.desync_autottl))
{
fprintf(stderr, "dpi-desync-autottl value error\n");
exit_clean(1);
}
break;
case 19: /* dpi-desync-autottl6 */
if (!parse_autottl(optarg, &params.desync_autottl6))
{
fprintf(stderr, "dpi-desync-autottl6 value error\n");
exit_clean(1);
}
break;
case 20: /* dpi-desync-fooling */
{
char *e,*p = optarg;
while (p)
@@ -944,20 +988,22 @@ int main(int argc, char **argv)
}
else if (!strcmp(p,"badseq"))
params.desync_fooling_mode |= FOOL_BADSEQ;
else if (!strcmp(p,"datanoack"))
params.desync_fooling_mode |= FOOL_DATANOACK;
else if (!strcmp(p,"hopbyhop"))
params.desync_fooling_mode |= FOOL_HOPBYHOP;
else if (!strcmp(p,"hopbyhop2"))
params.desync_fooling_mode |= FOOL_HOPBYHOP2;
else if (strcmp(p,"none"))
{
fprintf(stderr, "dpi-desync-fooling allowed values : none,md5sig,ts,badseq,badsum,hopbyhop,hopbyhop2\n");
fprintf(stderr, "dpi-desync-fooling allowed values : none,md5sig,ts,badseq,badsum,datanoack,hopbyhop,hopbyhop2\n");
exit_clean(1);
}
p = e;
}
}
break;
case 19: /* dpi-desync-retrans */
case 21: /* dpi-desync-retrans */
#ifdef __linux__
params.desync_retrans = !optarg || atoi(optarg);
#else
@@ -965,24 +1011,24 @@ int main(int argc, char **argv)
exit_clean(1);
#endif
break;
case 20: /* dpi-desync-repeats */
case 22: /* dpi-desync-repeats */
if (sscanf(optarg,"%u",&params.desync_repeats)<1 || !params.desync_repeats || params.desync_repeats>20)
{
fprintf(stderr, "dpi-desync-repeats must be within 1..20\n");
exit_clean(1);
}
break;
case 21: /* dpi-desync-skip-nosni */
case 23: /* dpi-desync-skip-nosni */
params.desync_skip_nosni = !optarg || atoi(optarg);
break;
case 22: /* dpi-desync-split-pos */
case 24: /* dpi-desync-split-pos */
if (sscanf(optarg,"%u",&params.desync_split_pos)<1 || params.desync_split_pos<1 || params.desync_split_pos>DPI_DESYNC_MAX_FAKE_LEN)
{
fprintf(stderr, "dpi-desync-split-pos must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
exit_clean(1);
}
break;
case 23: /* dpi-desync-ipfrag-pos-tcp */
case 25: /* dpi-desync-ipfrag-pos-tcp */
if (sscanf(optarg,"%u",&params.desync_ipfrag_pos_tcp)<1 || params.desync_ipfrag_pos_tcp<1 || params.desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
{
fprintf(stderr, "dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -994,7 +1040,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 24: /* dpi-desync-ipfrag-pos-udp */
case 26: /* dpi-desync-ipfrag-pos-udp */
if (sscanf(optarg,"%u",&params.desync_ipfrag_pos_udp)<1 || params.desync_ipfrag_pos_udp<1 || params.desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
{
fprintf(stderr, "dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1006,59 +1052,59 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 25: /* dpi-desync-badseq-increments */
case 27: /* dpi-desync-badseq-increments */
if (!parse_badseq_increment(optarg,&params.desync_badseq_increment))
{
fprintf(stderr, "dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
exit_clean(1);
}
break;
case 26: /* dpi-desync-badack-increment */
case 28: /* dpi-desync-badack-increment */
if (!parse_badseq_increment(optarg,&params.desync_badseq_ack_increment))
{
fprintf(stderr, "dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
exit_clean(1);
}
break;
case 27: /* dpi-desync-any-protocol */
case 29: /* dpi-desync-any-protocol */
params.desync_any_proto = !optarg || atoi(optarg);
break;
case 28: /* dpi-desync-fake-http */
case 30: /* dpi-desync-fake-http */
params.fake_http_size = sizeof(params.fake_http);
load_file_or_exit(optarg,params.fake_http,&params.fake_http_size);
break;
case 29: /* dpi-desync-fake-tls */
case 31: /* dpi-desync-fake-tls */
params.fake_tls_size = sizeof(params.fake_tls);
load_file_or_exit(optarg,params.fake_tls,&params.fake_tls_size);
break;
case 30: /* dpi-desync-fake-unknown */
case 32: /* dpi-desync-fake-unknown */
params.fake_unknown_size = sizeof(params.fake_unknown);
load_file_or_exit(optarg,params.fake_unknown,&params.fake_unknown_size);
break;
case 31: /* dpi-desync-fake-quic */
case 33: /* dpi-desync-fake-quic */
params.fake_quic_size = sizeof(params.fake_quic);
load_file_or_exit(optarg,params.fake_quic,&params.fake_quic_size);
break;
case 32: /* dpi-desync-fake-wireguard */
case 34: /* dpi-desync-fake-wireguard */
params.fake_wg_size = sizeof(params.fake_wg);
load_file_or_exit(optarg,params.fake_wg,&params.fake_wg_size);
break;
case 33: /* dpi-desync-fake-dht */
case 35: /* dpi-desync-fake-dht */
params.fake_dht_size = sizeof(params.fake_dht);
load_file_or_exit(optarg,params.fake_dht,&params.fake_dht_size);
break;
case 34: /* dpi-desync-fake-unknown-udp */
case 36: /* dpi-desync-fake-unknown-udp */
params.fake_unknown_udp_size = sizeof(params.fake_unknown_udp);
load_file_or_exit(optarg,params.fake_unknown_udp,&params.fake_unknown_udp_size);
break;
case 35: /* dpi-desync-udplen-increment */
case 37: /* dpi-desync-udplen-increment */
if (sscanf(optarg,"%d",&params.udplen_increment)<1 || params.udplen_increment>0x7FFF || params.udplen_increment<-0x8000)
{
fprintf(stderr, "dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
exit_clean(1);
}
break;
case 36: /* dpi-desync-udplen-pattern */
case 38: /* dpi-desync-udplen-pattern */
{
char buf[sizeof(params.udplen_pattern)];
size_t sz=sizeof(buf);
@@ -1066,28 +1112,28 @@ int main(int argc, char **argv)
fill_pattern(params.udplen_pattern,sizeof(params.udplen_pattern),buf,sz);
}
break;
case 37: /* desync-cutoff */
case 39: /* desync-cutoff */
if (!parse_cutoff(optarg, &params.desync_cutoff, &params.desync_cutoff_mode))
{
fprintf(stderr, "invalid desync-cutoff value\n");
exit_clean(1);
}
break;
case 38: /* hostlist */
case 40: /* hostlist */
if (!strlist_add(&params.hostlist_files, optarg))
{
fprintf(stderr, "strlist_add failed\n");
exit_clean(1);
}
break;
case 39: /* hostlist-exclude */
case 41: /* hostlist-exclude */
if (!strlist_add(&params.hostlist_exclude_files, optarg))
{
fprintf(stderr, "strlist_add failed\n");
exit_clean(1);
}
break;
case 40: /* hostlist-auto */
case 42: /* hostlist-auto */
if (*params.hostlist_auto_filename)
{
fprintf(stderr, "only one auto hostlist is supported\n");
@@ -1118,7 +1164,7 @@ int main(int argc, char **argv)
strncpy(params.hostlist_auto_filename, optarg, sizeof(params.hostlist_auto_filename));
params.hostlist_auto_filename[sizeof(params.hostlist_auto_filename) - 1] = '\0';
break;
case 41: /* hostlist-auto-fail-threshold */
case 43: /* hostlist-auto-fail-threshold */
params.hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (params.hostlist_auto_fail_threshold<1 || params.hostlist_auto_fail_threshold>20)
{
@@ -1126,7 +1172,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 42: /* hostlist-auto-fail-time */
case 44: /* hostlist-auto-fail-time */
params.hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (params.hostlist_auto_fail_time<1)
{
@@ -1134,7 +1180,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 43: /* hostlist-auto-retrans-threshold */
case 45: /* hostlist-auto-retrans-threshold */
params.hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
if (params.hostlist_auto_retrans_threshold<2 || params.hostlist_auto_retrans_threshold>10)
{
@@ -1142,7 +1188,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 44: /* hostlist-auto-debug */
case 46: /* hostlist-auto-debug */
{
FILE *F = fopen(optarg,"a+t");
if (!F)
@@ -1158,10 +1204,10 @@ int main(int argc, char **argv)
}
break;
#ifdef __linux__
case 45: /* bind-fix4 */
case 47: /* bind-fix4 */
params.bind_fix4 = true;
break;
case 46: /* bind-fix6 */
case 48: /* bind-fix6 */
params.bind_fix6 = true;
break;
#endif
@@ -1169,6 +1215,12 @@ int main(int argc, char **argv)
}
// not specified - use desync_ttl value instead
if (params.desync_ttl6 == 0xFF) params.desync_ttl6=params.desync_ttl;
if (!AUTOTTL_ENABLED(params.desync_autottl6)) params.desync_autottl6 = params.desync_autottl;
if (AUTOTTL_ENABLED(params.desync_autottl))
DLOG("autottl ipv4 %u:%u-%u\n",params.desync_autottl.delta,params.desync_autottl.min,params.desync_autottl.max)
if (AUTOTTL_ENABLED(params.desync_autottl6))
DLOG("autottl ipv6 %u:%u-%u\n",params.desync_autottl6.delta,params.desync_autottl6.min,params.desync_autottl6.max)
#ifdef BSD
if (!params.port)
{

6
nfq/params.h
View File

@@ -27,11 +27,10 @@
#define UDPLEN_INCREMENT_DEFAULT 2
#define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT 2
#define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT 3
#define HOSTLIST_AUTO_FAIL_TIME_DEFAULT 60
#define HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT 3
struct params_s
{
bool debug;
@@ -53,7 +52,8 @@ struct params_s
char desync_cutoff_mode; // n - packets, d - data packets, s - relative sequence
unsigned int desync_cutoff;
uint8_t desync_ttl, desync_ttl6;
uint8_t desync_fooling_mode;
autottl desync_autottl, desync_autottl6;
uint32_t desync_fooling_mode;
uint32_t desync_fwmark; // unused in BSD
uint32_t desync_badseq_increment, desync_badseq_ack_increment;
uint8_t fake_http[1432],fake_tls[1432],fake_quic[1472],fake_wg[1472],fake_dht[1472],fake_unknown[1432],fake_unknown_udp[1472], udplen_pattern[1472];