mirror of
https://github.com/bol-van/zapret.git
synced 2024-11-26 12:10:53 +03:00
Compare commits
3 Commits
5a82874624
...
28797184e4
Author | SHA1 | Date | |
---|---|---|---|
|
28797184e4 | ||
|
08238664cd | ||
|
187affb844 |
@ -1,21 +1,21 @@
|
||||
How to compile native programs for use in openwrt
|
||||
-------------------------------------------------
|
||||
|
||||
1) Download latest SDK for your platform from https://downloads.openwrt.org
|
||||
|
||||
curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxvf -
|
||||
cd openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64
|
||||
|
||||
2) ./scripts/feeds update -a
|
||||
./scripts/feeds install -a
|
||||
|
||||
3) cp -R /opt/zapret/docs/compile/openwrt/. .
|
||||
cp -R /opt/zapret/tpws package/zapret/tpws
|
||||
cp -R /opt/zapret/nfq package/zapret/nfqws
|
||||
cp -R /opt/zapret/mdig package/zapret/mdig
|
||||
cp -R /opt/zapret/ip2net package/zapret/ip2net
|
||||
|
||||
4) make package/{tpws,nfqws,mdig,ip2net}/compile
|
||||
|
||||
5) find bin -name tpws*.ipk
|
||||
#take your tpws*.ipk , nfqws*.ipk , ip2net*.ipk, mdig*.ipk from there
|
||||
How to compile native programs for use in openwrt
|
||||
-------------------------------------------------
|
||||
|
||||
1) Download latest SDK for your platform from https://downloads.openwrt.org
|
||||
|
||||
curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxvf -
|
||||
cd openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64
|
||||
|
||||
2) ./scripts/feeds update -a
|
||||
./scripts/feeds install -a
|
||||
|
||||
3) cp -R /opt/zapret/docs/compile/openwrt/. .
|
||||
cp -R /opt/zapret/tpws package/zapret/tpws
|
||||
cp -R /opt/zapret/nfq package/zapret/nfqws
|
||||
cp -R /opt/zapret/mdig package/zapret/mdig
|
||||
cp -R /opt/zapret/ip2net package/zapret/ip2net
|
||||
|
||||
4) make package/{tpws,nfqws,mdig,ip2net}/compile
|
||||
|
||||
5) find bin -name tpws*.ipk
|
||||
#take your tpws*.ipk , nfqws*.ipk , ip2net*.ipk, mdig*.ipk from there
|
||||
|
@ -24,8 +24,8 @@ define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/ip2net/install
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/ip2net
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip2net $(1)/opt/zapret/ip2net
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip2net $(1)/opt/zapret/binaries/my
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,ip2net))
|
||||
|
@ -1 +1 @@
|
||||
Copy "ip2net" folder here !
|
||||
Copy "ip2net" folder here !
|
||||
|
@ -24,8 +24,8 @@ define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/mdig/install
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/mdig
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/mdig $(1)/opt/zapret/mdig
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/mdig $(1)/opt/zapret/binaries/my
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,mdig))
|
||||
|
@ -1 +1 @@
|
||||
Copy "mdig" folder here !
|
||||
Copy "mdig" folder here !
|
||||
|
@ -25,8 +25,8 @@ define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/nfqws/install
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/nfq
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/nfqws $(1)/opt/zapret/nfq
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/nfqws $(1)/opt/zapret/binaries/my
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,nfqws))
|
||||
|
@ -1 +1 @@
|
||||
Copy "nfq" folder here !
|
||||
Copy "nfq" folder here !
|
||||
|
@ -25,8 +25,8 @@ define Build/Compile
|
||||
endef
|
||||
|
||||
define Package/tpws/install
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/tpws
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/tpws $(1)/opt/zapret/tpws
|
||||
$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/tpws $(1)/opt/zapret/binaries/my
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,tpws))
|
||||
|
@ -1 +1 @@
|
||||
Copy "tpws" folder here !
|
||||
Copy "tpws" folder here !
|
||||
|
174
nfq/desync.c
174
nfq/desync.c
@ -1,5 +1,8 @@
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <string.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "desync.h"
|
||||
#include "protocol.h"
|
||||
#include "params.h"
|
||||
@ -8,9 +11,6 @@
|
||||
#include "ipset.h"
|
||||
#include "conntrack.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
|
||||
const char *fake_http_request_default = "GET / HTTP/1.1\r\nHost: www.iana.org\r\n"
|
||||
"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0\r\n"
|
||||
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\n"
|
||||
@ -1273,22 +1273,65 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
|
||||
case DESYNC_MULTISPLIT:
|
||||
if (multisplit_count)
|
||||
{
|
||||
size_t from,to;
|
||||
uint8_t ovlseg[DPI_DESYNC_MAX_FAKE_LEN+100], *seg;
|
||||
size_t seg_len,from,to;
|
||||
unsigned int seqovl;
|
||||
for (i=0,from=0 ; i<=multisplit_count ; i++)
|
||||
{
|
||||
to = i==multisplit_count ? dis->len_payload : multisplit_pos[i];
|
||||
|
||||
pkt1_len = sizeof(pkt1);
|
||||
if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig,
|
||||
net32_add(dis->tcp->th_seq,from), dis->tcp->th_ack,
|
||||
dis->tcp->th_win, scale_factor, timestamps,ttl_orig,IP4_TOS(dis->ip),IP6_FLOW(dis->ip6),
|
||||
fooling_orig,0,0,
|
||||
dis->data_payload+from, to-from, pkt1, &pkt1_len))
|
||||
return verdict;
|
||||
DLOG("sending multisplit part %d %zu-%zu len=%zu : ",i+1,from,to-1,to-from);
|
||||
hexdump_limited_dlog(dis->data_payload+from,to-from,PKTDATA_MAXDUMP); DLOG("\n");
|
||||
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
|
||||
return verdict;
|
||||
// do seqovl only to the first packet
|
||||
// otherwise it's prone to race condition on server side
|
||||
// what happens first : server pushes socket buffer to process or another packet with seqovl arrives
|
||||
seqovl = i==0 ? dp->desync_seqovl : 0;
|
||||
#ifdef __linux__
|
||||
// only linux return error if MTU is exceeded
|
||||
for(;;seqovl=0)
|
||||
{
|
||||
#endif
|
||||
if (seqovl)
|
||||
{
|
||||
seg_len = to-from+seqovl;
|
||||
if (seg_len>sizeof(ovlseg))
|
||||
{
|
||||
DLOG("seqovl is too large");
|
||||
return verdict;
|
||||
}
|
||||
fill_pattern(ovlseg,seqovl,dp->seqovl_pattern,sizeof(dp->seqovl_pattern));
|
||||
memcpy(ovlseg+seqovl,dis->data_payload+from,to-from);
|
||||
seg = ovlseg;
|
||||
}
|
||||
else
|
||||
{
|
||||
seqovl = 0;
|
||||
seg = dis->data_payload+from;
|
||||
seg_len = to-from;
|
||||
}
|
||||
|
||||
pkt1_len = sizeof(pkt1);
|
||||
if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig,
|
||||
net32_add(dis->tcp->th_seq,from-seqovl), dis->tcp->th_ack,
|
||||
dis->tcp->th_win, scale_factor, timestamps,ttl_orig,IP4_TOS(dis->ip),IP6_FLOW(dis->ip6),
|
||||
fooling_orig,0,0,
|
||||
seg, seg_len, pkt1, &pkt1_len))
|
||||
return verdict;
|
||||
DLOG("sending multisplit part %d %zu-%zu len=%zu seqovl=%u : ",i+1,from,to-1,to-from,seqovl);
|
||||
hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n");
|
||||
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
|
||||
{
|
||||
#ifdef __linux__
|
||||
if (errno==EMSGSIZE && seqovl)
|
||||
{
|
||||
DLOG("MTU exceeded. cancelling seqovl.\n");
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
return verdict;
|
||||
}
|
||||
#ifdef __linux__
|
||||
break;
|
||||
}
|
||||
#endif
|
||||
|
||||
from = to;
|
||||
}
|
||||
@ -1298,20 +1341,44 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
|
||||
case DESYNC_MULTIDISORDER:
|
||||
if (multisplit_count)
|
||||
{
|
||||
size_t from,to;
|
||||
uint8_t ovlseg[DPI_DESYNC_MAX_FAKE_LEN+100], *seg;
|
||||
size_t seg_len,from,to;
|
||||
unsigned int seqovl;
|
||||
for (i=multisplit_count-1,to=dis->len_payload ; i>=-1 ; i--)
|
||||
{
|
||||
from = i>=0 ? multisplit_pos[i] : 0;
|
||||
|
||||
seg = dis->data_payload+from;
|
||||
seg_len = to-from;
|
||||
seqovl = 0;
|
||||
if (i>=0 && dp->desync_seqovl)
|
||||
{
|
||||
if (dp->desync_seqovl>=from)
|
||||
DLOG("seqovl>=split_pos (%u>=%zu). cancelling seqovl for part %d.\n",dp->desync_seqovl,from,i+2);
|
||||
else
|
||||
{
|
||||
seqovl = dp->desync_seqovl;
|
||||
seg_len = to-from+seqovl;
|
||||
if (seg_len>sizeof(ovlseg))
|
||||
{
|
||||
DLOG("seqovl is too large");
|
||||
return verdict;
|
||||
}
|
||||
fill_pattern(ovlseg,seqovl,dp->seqovl_pattern,sizeof(dp->seqovl_pattern));
|
||||
memcpy(ovlseg+seqovl,dis->data_payload+from,to-from);
|
||||
seg = ovlseg;
|
||||
}
|
||||
}
|
||||
|
||||
pkt1_len = sizeof(pkt1);
|
||||
if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig,
|
||||
net32_add(dis->tcp->th_seq,from), dis->tcp->th_ack,
|
||||
net32_add(dis->tcp->th_seq,from-seqovl), dis->tcp->th_ack,
|
||||
dis->tcp->th_win, scale_factor, timestamps,ttl_orig,IP4_TOS(dis->ip),IP6_FLOW(dis->ip6),
|
||||
fooling_orig,0,0,
|
||||
dis->data_payload+from, to-from, pkt1, &pkt1_len))
|
||||
seg, seg_len, pkt1, &pkt1_len))
|
||||
return verdict;
|
||||
DLOG("sending multisplit part %d %zu-%zu len=%zu : ",i+2,from,to-1,to-from);
|
||||
hexdump_limited_dlog(dis->data_payload+from,to-from,PKTDATA_MAXDUMP); DLOG("\n");
|
||||
DLOG("sending multisplit part %d %zu-%zu len=%zu seqovl=%u : ",i+2,from,to-1,to-from,seqovl);
|
||||
hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n");
|
||||
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
|
||||
return verdict;
|
||||
|
||||
@ -1423,34 +1490,53 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
|
||||
return verdict;
|
||||
}
|
||||
|
||||
if (dp->desync_seqovl)
|
||||
unsigned int seqovl = dp->desync_seqovl;
|
||||
#ifdef __linux__
|
||||
// only linux return error if MTU is exceeded
|
||||
for(;;seqovl=0)
|
||||
{
|
||||
seg_len = split_pos+dp->desync_seqovl;
|
||||
if (seg_len>sizeof(ovlseg))
|
||||
#endif
|
||||
if (seqovl)
|
||||
{
|
||||
DLOG("seqovl is too large");
|
||||
seg_len = split_pos+seqovl;
|
||||
if (seg_len>sizeof(ovlseg))
|
||||
{
|
||||
DLOG("seqovl is too large");
|
||||
return verdict;
|
||||
}
|
||||
fill_pattern(ovlseg,seqovl,dp->seqovl_pattern,sizeof(dp->seqovl_pattern));
|
||||
memcpy(ovlseg+seqovl,dis->data_payload,split_pos);
|
||||
seg = ovlseg;
|
||||
}
|
||||
else
|
||||
{
|
||||
seg = dis->data_payload;
|
||||
seg_len = split_pos;
|
||||
}
|
||||
|
||||
pkt1_len = sizeof(pkt1);
|
||||
if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq,-seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
|
||||
ttl_orig,IP4_TOS(dis->ip),IP6_FLOW(dis->ip6),
|
||||
fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
|
||||
seg, seg_len, pkt1, &pkt1_len))
|
||||
return verdict;
|
||||
DLOG("sending 1st tcp segment 0-%zu len=%zu seqovl=%u : ",split_pos-1, split_pos, seqovl);
|
||||
hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n");
|
||||
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
|
||||
{
|
||||
#ifdef __linux__
|
||||
if (errno==EMSGSIZE && seqovl)
|
||||
{
|
||||
DLOG("MTU exceeded. cancelling seqovl.\n");
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
return verdict;
|
||||
}
|
||||
fill_pattern(ovlseg,dp->desync_seqovl,dp->seqovl_pattern,sizeof(dp->seqovl_pattern));
|
||||
memcpy(ovlseg+dp->desync_seqovl,dis->data_payload,split_pos);
|
||||
seg = ovlseg;
|
||||
#ifdef __linux__
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
seg = dis->data_payload;
|
||||
seg_len = split_pos;
|
||||
}
|
||||
|
||||
pkt1_len = sizeof(pkt1);
|
||||
if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq,-dp->desync_seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
|
||||
ttl_orig,IP4_TOS(dis->ip),IP6_FLOW(dis->ip6),
|
||||
fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
|
||||
seg, seg_len, pkt1, &pkt1_len))
|
||||
return verdict;
|
||||
DLOG("sending 1st tcp segment 0-%zu len=%zu seqovl=%u : ",split_pos-1, split_pos, dp->desync_seqovl);
|
||||
hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n");
|
||||
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
|
||||
return verdict;
|
||||
#endif
|
||||
|
||||
if (desync_mode==DESYNC_FAKEDSPLIT)
|
||||
{
|
||||
@ -1524,6 +1610,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
|
||||
|
||||
if (bFake)
|
||||
{
|
||||
// if we are here original message was not sent in any form
|
||||
// allowing system to pass the message to queue can result in unpredicted send order
|
||||
DLOG("reinjecting original packet. len=%zu len_payload=%zu\n", dis->len_pkt, dis->len_payload);
|
||||
verdict_tcp_csum_fix(verdict, dis->tcp, dis->transport_len, dis->ip, dis->ip6);
|
||||
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , dis->data_pkt, dis->len_pkt))
|
||||
|
Loading…
Reference in New Issue
Block a user