drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2024-11-26 12:10:53 +03:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: drygdryg:78ea379e0f92013042fa92ea30a4a0963f6b95d5
Branches Tags
drygdryg:master
drygdryg:v69.3
drygdryg:v69.2
drygdryg:v69.1
drygdryg:v69
drygdryg:v68
drygdryg:v67
drygdryg:v66
drygdryg:v65
drygdryg:v64
..
compare: drygdryg:feb3dd4d73d6f23098fc27f3810774702a9b0f79
Branches Tags
drygdryg:master
drygdryg:v69.3
drygdryg:v69.2
drygdryg:v69.1
drygdryg:v69
drygdryg:v68
drygdryg:v67
drygdryg:v66
drygdryg:v65
drygdryg:v64

No commits in common. "78ea379e0f92013042fa92ea30a4a0963f6b95d5" and "feb3dd4d73d6f23098fc27f3810774702a9b0f79" have entirely different histories.
78ea379e0f ... feb3dd4d73

19 changed files with 248 additions and 689 deletions
Show Stats Expand all files Collapse all files

17
.github/workflows/build.yml vendored
View File

@ -82,7 +82,9 @@ jobs:
export STRIP=$TARGET-strip
export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
# optimize for size
export CFLAGS="-Os -flto=auto"
export LDFLAGS="-Os"
# netfilter libs
wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
@ -134,7 +136,6 @@ jobs:
- name: Build zapret
run: |
export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
make mac -j$(sysctl -n hw.logicalcpu)
tar -C binaries/my -cJf zapret-mac-x64.tar.xz .
@ -169,7 +170,6 @@ jobs:
TARGET: ${{ matrix.target }}
ARCH: ${{ matrix.arch }}
run: |
export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
settarget $TARGET-freebsd11 make bsd -j$(nproc) || exit 1
tar -C binaries/my -cJf zapret-freebsd-$ARCH.tar.xz .
@ -205,7 +205,6 @@ jobs:
run: |
mkdir -p output
cd zapret
export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
mingw32-make -C ip2net win
mingw32-make -C mdig win
cp -a {ip2net/ip2net,mdig/mdig}.exe ../output
@ -260,7 +259,6 @@ jobs:
shell: C:\cygwin\bin\bash.exe -eo pipefail '{0}'
run: >-
export MAKEFLAGS=-j$(nproc) &&
export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}" &&
cd zapret &&
make -C nfq ${TARGET} &&
cp -a nfq/winws.exe ../output
@ -319,7 +317,9 @@ jobs:
export STRIP=$TOOLCHAIN/bin/llvm-strip
export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
# optimize for size
export CFLAGS="-Os -flto=auto"
export LDFLAGS="-Os"
# netfilter libs
wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
@ -434,13 +434,11 @@ jobs:
- name: Create release bundles
run: |
rm -rf ${{ env.repo_dir }}/.git*
find ${{ env.repo_dir }}/binaries -type f -exec sha256sum {} \; >sha256sum.txt
tar --owner=0 --group=0 -czf ${{ env.repo_dir }}.tar.gz ${{ env.repo_dir }}
zip -qr ${{ env.repo_dir }}.zip ${{ env.repo_dir }}
rm -rf ${{ env.repo_dir }}/tpws ${{ env.repo_dir }}/nfq ${{ env.repo_dir }}/ip2net ${{ env.repo_dir }}/mdig ${{ env.repo_dir }}/docs ${{ env.repo_dir }}/files/huawei
rm -rf ${{ env.repo_dir }}/Makefile ${{ env.repo_dir }}/tpws ${{ env.repo_dir }}/nfq ${{ env.repo_dir }}/ip2net ${{ env.repo_dir }}/mdig ${{ env.repo_dir }}/docs ${{ env.repo_dir }}/files/huawei
rm -rf ${{ env.repo_dir }}/init.d/openrc ${{ env.repo_dir }}/init.d/macos ${{ env.repo_dir }}/init.d/pfsense ${{ env.repo_dir }}/init.d/runit ${{ env.repo_dir }}/init.d/s6 ${{ env.repo_dir }}/init.d/systemd
rm -rf ${{ env.repo_dir }}/binaries/android* -rf ${{ env.repo_dir }}/binaries/win* ${{ env.repo_dir }}/binaries/mac* ${{ env.repo_dir }}/binaries/freebsd*
rm -f ${{ env.repo_dir }}/Makefile ${{ env.repo_dir }}/binaries/x86_64/tpws_wsl.tgz
tar --owner=0 --group=0 -czf ${{ env.repo_dir }}-openwrt-embedded.tar.gz ${{ env.repo_dir }}
- name: Upload release assets
@ -454,4 +452,3 @@ jobs:
files: |
zapret*.tar.gz
zapret*.zip
sha256sum.txt

7
docs/changes.txt
View File

@ -400,10 +400,3 @@ v69.2:
nfqws,tpws: --skip
nfqws: --methodeol
init.d: do not use pgrep in sysv for busybox compat
v69.3
nfqws,tpws: fixed ipsets and hostlists
all progs: version numbers for github, build date/time for self built
repo: light release for openwrt and embedded systems
repo: sha256sum

2
docs/quick_start.md
View File

@ -50,8 +50,6 @@
> образ `squashfs` с помощью `image builder` и перешить этим вариантом роутер.
1. Скачайте последний [tar.gz релиз](https://github.com/bol-van/zapret/releases) в /tmp, распакуйте его, затем удалите архив.
Для openwrt и прошивок используйте вариант `openwrt-embedded`.
Для экономия места в /tmp можно качать через curl в stdout и сразу распаковывать.
2. Убедитесь, что у вас отключены все средства обхода блокировок, в том числе и
сам zapret. Гарантированно уберет zapret скрипт `uninstall_easy.sh`.

10
docs/readme.en.md
View File

@ -1,4 +1,4 @@
# zapret v69.3
# zapret v.69
# SCAMMER WARNING
@ -180,9 +180,7 @@ nfqws takes the following parameters:
--dpi-desync-start=[n|d|s]N ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) greater or equal than N
--dpi-desync-cutoff=[n|d|s]N ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) less than N
--hostlist=<filename> ; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
--hostlist-domains=<domain_list> ; comma separated fixed domain list
--hostlist-exclude=<filename> ; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
--hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list
--hostlist-auto=<filename> ; detect DPI blocks and build hostlist automatically
--hostlist-auto-fail-threshold=<int> ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
--hostlist-auto-fail-time=<int> ; all failed attemps must be within these seconds (default : 60)
@ -195,9 +193,7 @@ nfqws takes the following parameters:
--filter-udp=[~]port1[-port2]|* ; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list supported.
--filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.
--ipset=<filename> ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
--ipset-ip=<ip_list> ; comma separated fixed subnet list
--ipset-exclude=<filename> ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
--ipset-exclude-ip=<ip_list> ; comma separated fixed subnet list
```
### DPI desync attack
@ -675,14 +671,10 @@ tpws is transparent proxy.
--filter-tcp=[~]port1[-port2]|* ; TCP port filter. ~ means negation. comma separated list supported.
--filter-l7=[http|tls|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.
--ipset=<filename> ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
--ipset-ip=<ip_list> ; comma separated fixed subnet list
--ipset-exclude=<filename> ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
--ipset-exclude-ip=<ip_list> ; comma separated fixed subnet list
--hostlist=<filename> ; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
--hostlist-domains=<domain_list> ; comma separated fixed domain list
--hostlist-exclude=<filename> ; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
--hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list
--hostlist-auto=<filename> ; detect DPI blocks and build hostlist automatically
--hostlist-auto-fail-threshold=<int> ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
--hostlist-auto-fail-time=<int> ; all failed attemps must be within these seconds (default : 60)

10
docs/readme.md
View File

@ -1,4 +1,4 @@
# zapret v69.3
# zapret v.69
# ВНИМАНИЕ, остерегайтесь мошенников
@ -211,9 +211,7 @@ dvtws, собираемый из тех же исходников (см. [док
; список может быть запакован в gzip. формат автоматически распознается и разжимается
; списков может быть множество. пустой общий лист = его отсутствие
; хосты извлекаются из Host: хедера обычных http запросов и из SNI в TLS ClientHello.
--hostlist-domains=<domain_list> ; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
--hostlist-exclude=<filename> ; не применять дурение к доменам из листа. может быть множество листов. схема аналогична include листам.
--hostlist-exclude-domains=<domain_list> ; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
--hostlist-auto=<filename> ; обнаруживать автоматически блокировки и заполнять автоматический hostlist (требует перенаправления входящего трафика)
--hostlist-auto-fail-threshold=<int> ; сколько раз нужно обнаружить ситуацию, похожую на блокировку, чтобы добавить хост в лист (по умолчанию: 3)
--hostlist-auto-fail-time=<int> ; все эти ситуации должны быть в пределах указанного количества секунд (по умолчанию: 60)
@ -226,9 +224,7 @@ dvtws, собираемый из тех же исходников (см. [док
--filter-udp=[~]port1[-port2]|* ; фильтр портов udp для текущей стратегии. ~ означает инверсию. установка фильтра udp и неустановка фильтра tcp запрещает tcp. поддерживается список через запятую.
--filter-l7=[http|tls|quic|wireguard|dht|unknown] ; фильтр протокола L6-L7. поддерживается несколько значений через запятую.
--ipset=<filename> ; включающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
--ipset-ip=<ip_list> ; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
--ipset-exclude=<filename> ; исключающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
--ipset-exclude-ip=<ip_list> ; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
```
`--debug` позволяет выводить подробный лог действий на консоль, в syslog или в файл. Может быть важен порядок следования
@ -826,9 +822,7 @@ tpws - это transparent proxy.
; список может быть запакован в gzip. формат автоматически распознается и разжимается
; списков может быть множество. пустой общий лист = его отсутствие
; хосты извлекаются из Host: хедера обычных http запросов и из SNI в TLS ClientHello.
--hostlist-domains=<domain_list> ; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
--hostlist-exclude=<filename> ; не применять дурение к доменам из листа. может быть множество листов. схема аналогична include листам.
--hostlist-exclude-domains=<domain_list>; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
--hostlist-auto=<filename> ; обнаруживать автоматически блокировки и заполнять автоматический hostlist (требует перенаправления входящего трафика)
--hostlist-auto-fail-threshold=<int> ; сколько раз нужно обнаружить ситуацию, похожую на блокировку, чтобы добавить хост в лист (по умолчанию: 3)
--hostlist-auto-fail-time=<int> ; все эти ситуации должны быть в пределах указанного количества секунд (по умолчанию: 60)
@ -839,9 +833,7 @@ tpws - это transparent proxy.
--filter-tcp=[~]port1[-port2]|* ; фильтр портов tcp для текущей стратегии. ~ означает инверсию. поддерживается список через запятую.
--filter-l7=[http|tls|quic|wireguard|dht|unknown] ; фильтр протокола L6-L7. поддерживается несколько значений через запятую.
--ipset=<filename> ; включающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
--ipset-ip=<ip_list> ; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
--ipset-exclude=<filename> ; исключающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
--ipset-exclude-ip=<ip_list> ; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
```
### TCP СЕГМЕНТАЦИЯ В TPWS

11
ip2net/ip2net.c
View File

@ -192,7 +192,7 @@ static void ip6_and(const struct in6_addr * restrict a, const struct in6_addr *
static void rtrim(char *s)
{
if (s)
for (char *p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'); p--) *p = '\0';
for (char *p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r'); p--) *p = '\0';
}
@ -217,14 +217,6 @@ static void exithelp(void)
exit(1);
}
#define STRINGIFY(x) #x
#define TOSTRING(x) STRINGIFY(x)
#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
#else
#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
#endif
static void parse_params(int argc, char *argv[])
{
int option_index = 0;
@ -253,7 +245,6 @@ static void parse_params(int argc, char *argv[])
{
case 0:
case 1:
PRINT_VER;
exithelp();
break;
case 2:

12
mdig/mdig.c
View File

@ -35,7 +35,7 @@
static void trimstr(char *s)
{
char *p;
for (p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'); p--) *p = '\0';
for (p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r'); p--) *p = '\0';
}
static const char* eai_str(int r)
@ -458,15 +458,6 @@ static void exithelp(void)
);
exit(1);
}
#define STRINGIFY(x) #x
#define TOSTRING(x) STRINGIFY(x)
#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
#else
#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
#endif
int main(int argc, char **argv)
{
int r, v, option_index = 0;
@ -496,7 +487,6 @@ int main(int argc, char **argv)
switch (option_index)
{
case 0: /* help */
PRINT_VER;
exithelp();
break;
case 1: /* threads */

43
nfq/hostlist.c
View File

@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
*hostlist = NULL;
return false;
}
if (ct) (*ct)++;
(*ct)++;
}
// advance to the next line
for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@ -32,11 +32,6 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
return true;
}
bool AppendHostlistItem(strpool **hostlist, char *s)
{
return addpool(hostlist,&s,s+strlen(s),NULL);
}
bool AppendHostList(strpool **hostlist, const char *filename)
{
char *p, *e, s[256], *zbuf;
@ -102,8 +97,6 @@ bool AppendHostList(strpool **hostlist, const char *filename)
}
static bool LoadHostList(struct hostlist_file *hfile)
{
if (hfile->filename)
{
time_t t = file_mod_time(hfile->filename);
if (!t)
@ -120,7 +113,6 @@ static bool LoadHostList(struct hostlist_file *hfile)
return false;
}
hfile->mod_time=t;
}
return true;
}
static bool LoadHostLists(struct hostlist_files_head *list)
@ -210,7 +202,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
LIST_FOREACH(item, hostlists_exclude, next)
{
DLOG("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
DLOG("[%s] exclude ", item->hfile->filename);
if (SearchHostList(item->hfile->hostlist, host))
{
if (excluded) *excluded = true;
@ -222,7 +214,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
{
LIST_FOREACH(item, hostlists, next)
{
DLOG("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
DLOG("[%s] include ", item->hfile->filename);
if (SearchHostList(item->hfile->hostlist, host))
return true;
}
@ -243,29 +235,17 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
{
struct hostlist_file *hfile;
if (filename)
{
if (!(hfile=hostlist_files_search(hostlists, filename)))
if (!(hfile=hostlist_files_add(hostlists, filename)))
return NULL;
if (!hostlist_collection_search(hl_collection, filename))
if (!hostlist_collection_add(hl_collection, hfile))
return NULL;
}
else
{
if (!(hfile=hostlist_files_add(hostlists, NULL)))
return NULL;
if (!hostlist_collection_add(hl_collection, hfile))
return NULL;
}
return hfile;
}
struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
{
if (filename && !file_mod_time(filename))
if (!file_mod_time(filename))
{
DLOG_ERR("cannot access hostlist file '%s'\n",filename);
return NULL;
@ -285,30 +265,15 @@ void HostlistsDebug()
struct hostlist_item *hl_item;
LIST_FOREACH(hfile, &params.hostlists, next)
{
if (hfile->filename)
DLOG("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
else
DLOG("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
}
LIST_FOREACH(dpl, &params.desync_profiles, next)
{
LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
if (hl_item->hfile!=dpl->dp.hostlist_auto)
{
if (hl_item->hfile->filename)
DLOG("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
else
DLOG("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
}
LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
{
if (hl_item->hfile->filename)
DLOG("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
else
DLOG("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
}
if (dpl->dp.hostlist_auto)
DLOG("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
}

1
nfq/hostlist.h
View File

@ -4,7 +4,6 @@
#include "pools.h"
#include "params.h"
bool AppendHostlistItem(strpool **hostlist, char *s);
bool AppendHostList(strpool **hostlist, const char *filename);
bool LoadAllHostLists();
bool NonEmptyHostlist(strpool **hostlist);

39
nfq/ipset.c
View File

@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
ipsetDestroy(ips);
return false;
}
if (ct) (*ct)++;
(*ct)++;
}
else if (parse_cidr6(cidr,&c6))
{
@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
ipsetDestroy(ips);
return false;
}
if (ct) (*ct)++;
(*ct)++;
}
else
DLOG_ERR("bad ip or subnet : %s\n",cidr);
@ -53,11 +53,6 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
}
bool AppendIpsetItem(ipset *ips, char *ip)
{
return addpool(ips,&ip,ip+strlen(ip),NULL);
}
static bool AppendIpset(ipset *ips, const char *filename)
{
char *p, *e, s[256], *zbuf;
@ -123,8 +118,6 @@ static bool AppendIpset(ipset *ips, const char *filename)
}
static bool LoadIpset(struct ipset_file *hfile)
{
if (hfile->filename)
{
time_t t = file_mod_time(hfile->filename);
if (!t)
@ -141,7 +134,6 @@ static bool LoadIpset(struct ipset_file *hfile)
return false;
}
hfile->mod_time=t;
}
return true;
}
static bool LoadIpsets(struct ipset_files_head *list)
@ -213,7 +205,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
LIST_FOREACH(item, ips_exclude, next)
{
DLOG("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
DLOG("[%s] exclude ",item->hfile->filename);
if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
return false;
}
@ -222,7 +214,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
{
LIST_FOREACH(item, ips, next)
{
DLOG("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
DLOG("[%s] include ",item->hfile->filename);
if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
return true;
}
@ -242,27 +234,17 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename)
{
struct ipset_file *hfile;
if (filename)
{
if (!(hfile=ipset_files_search(ipsets, filename)))
if (!(hfile=ipset_files_add(ipsets, filename)))
return NULL;
if (!ipset_collection_search(ips_collection, filename))
if (!ipset_collection_add(ips_collection, hfile))
return NULL;
}
else
{
if (!(hfile=ipset_files_add(ipsets, NULL)))
return NULL;
if (!ipset_collection_add(ips_collection, hfile))
return NULL;
}
return hfile;
}
struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
{
if (filename && !file_mod_time(filename))
if (!file_mod_time(filename))
{
DLOG_ERR("cannot access ipset file '%s'\n",filename);
return NULL;
@ -295,24 +277,13 @@ void IpsetsDebug()
struct ipset_item *ips_item;
LIST_FOREACH(hfile, &params.ipsets, next)
{
if (hfile->filename)
DLOG("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
else
DLOG("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
}
LIST_FOREACH(dpl, &params.desync_profiles, next)
{
LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
if (ips_item->hfile->filename)
DLOG("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
else
DLOG("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
if (ips_item->hfile->filename)
DLOG("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
else
DLOG("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
}
}

1
nfq/ipset.h
View File

@ -9,4 +9,3 @@ bool LoadAllIpsets();
bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
void IpsetsDebug();
bool AppendIpsetItem(ipset *ips, char *ip);

221
nfq/nfqws.c
View File

@ -836,47 +836,6 @@ static bool parse_split_pos_list(char *opt, struct proto_pos *splits, int splits
if (p) return false; // too much splits
return true;
}
static bool parse_domain_list(char *opt, strpool **pp)
{
char *e,*p,c;
for (p=opt ; p ; )
{
if ((e = strchr(p,',')))
{
c=*e;
*e=0;
}
if (*p && !AppendHostlistItem(pp,p)) return false;
if (e) *e++=c;
p = e;
}
return true;
}
static bool parse_ip_list(char *opt, ipset *pp)
{
char *e,*p,c;
for (p=opt ; p ; )
{
if ((e = strchr(p,',')))
{
c=*e;
*e=0;
}
if (*p && !AppendIpsetItem(pp,p)) return false;
if (e) *e++=c;
p = e;
}
return true;
}
static void split_compat(struct desync_profile *dp)
{
if (!dp->split_count)
@ -1067,14 +1026,10 @@ static void exithelp(void)
" --filter-udp=[~]port1[-port2]|*\t\t; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list allowed.\n"
" --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.\n"
" --ipset=<filename>\t\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
" --ipset-ip=<ip_list>\t\t\t\t; comma separated fixed subnet list\n"
" --ipset-exclude=<filename>\t\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
" --ipset-exclude-ip=<ip_list>\t\t\t; comma separated fixed subnet list\n"
"\nHOSTLIST FILTER:\n"
" --hostlist=<filename>\t\t\t\t; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-domains=<domain_list>\t\t; comma separated fixed domain list\n"
" --hostlist-exclude=<filename>\t\t\t; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-exclude-domains=<domain_list>\t; comma separated fixed domain list\n"
" --hostlist-auto=<filename>\t\t\t; detect DPI blocks and build hostlist automatically\n"
" --hostlist-auto-fail-threshold=<int>\t\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
" --hostlist-auto-fail-time=<int>\t\t; all failed attemps must be within these seconds (default : %d)\n"
@ -1173,14 +1128,6 @@ void config_from_file(const char *filename)
}
#endif
#define STRINGIFY(x) #x
#define TOSTRING(x) STRINGIFY(x)
#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
#else
#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
#endif
int main(int argc, char **argv)
{
set_env_exedir(argv[0]);
@ -1196,8 +1143,6 @@ int main(int argc, char **argv)
int option_index = 0;
bool daemon = false, bSkip = false;
char pidfile[256];
struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL;
struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL;
#ifdef __CYGWIN__
char windivert_filter[8192], wf_pf_tcp_src[256], wf_pf_tcp_dst[256], wf_pf_udp_src[256], wf_pf_udp_dst[256], wf_save_file[256];
bool wf_ipv4=true, wf_ipv6=true;
@ -1209,8 +1154,6 @@ int main(int argc, char **argv)
srandom(time(NULL));
mask_from_preflen6_prepare();
PRINT_VER;
memset(&params, 0, sizeof(params));
*pidfile = 0;
@ -1325,37 +1268,33 @@ int main(int argc, char **argv)
{"dpi-desync-cutoff",required_argument,0,0},// optidx=44
{"dpi-desync-start",required_argument,0,0},// optidx=45
{"hostlist",required_argument,0,0}, // optidx=46
{"hostlist-domains",required_argument,0,0},// optidx=47
{"hostlist-exclude",required_argument,0,0}, // optidx=48
{"hostlist-exclude-domains",required_argument,0,0},// optidx=49
{"hostlist-auto",required_argument,0,0}, // optidx=50
{"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=51
{"hostlist-auto-fail-time",required_argument,0,0}, // optidx=52
{"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=53
{"hostlist-auto-debug",required_argument,0,0}, // optidx=54
{"new",no_argument,0,0}, // optidx=55
{"skip",no_argument,0,0}, // optidx=56
{"filter-l3",required_argument,0,0}, // optidx=57
{"filter-tcp",required_argument,0,0}, // optidx=58
{"filter-udp",required_argument,0,0}, // optidx=59
{"filter-l7",required_argument,0,0}, // optidx=60
{"ipset",required_argument,0,0}, // optidx=61
{"ipset-ip",required_argument,0,0}, // optidx=62
{"ipset-exclude",required_argument,0,0},// optidx=63
{"ipset-exclude-ip",required_argument,0,0}, // optidx=64
{"hostlist-exclude",required_argument,0,0}, // optidx=47
{"hostlist-auto",required_argument,0,0}, // optidx=48
{"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=49
{"hostlist-auto-fail-time",required_argument,0,0}, // optidx=50
{"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=51
{"hostlist-auto-debug",required_argument,0,0}, // optidx=52
{"new",no_argument,0,0}, // optidx=53
{"skip",no_argument,0,0}, // optidx=54
{"filter-l3",required_argument,0,0}, // optidx=55
{"filter-tcp",required_argument,0,0}, // optidx=56
{"filter-udp",required_argument,0,0}, // optidx=57
{"filter-l7",required_argument,0,0}, // optidx=58
{"ipset",required_argument,0,0}, // optidx=59
{"ipset-exclude",required_argument,0,0},// optidx=60
#ifdef __linux__
{"bind-fix4",no_argument,0,0}, // optidx=65
{"bind-fix6",no_argument,0,0}, // optidx=66
{"bind-fix4",no_argument,0,0}, // optidx=61
{"bind-fix6",no_argument,0,0}, // optidx=62
#elif defined(__CYGWIN__)
{"wf-iface",required_argument,0,0}, // optidx=65
{"wf-l3",required_argument,0,0}, // optidx=66
{"wf-tcp",required_argument,0,0}, // optidx=67
{"wf-udp",required_argument,0,0}, // optidx=68
{"wf-raw",required_argument,0,0}, // optidx=69
{"wf-save",required_argument,0,0}, // optidx=70
{"ssid-filter",required_argument,0,0}, // optidx=71
{"nlm-filter",required_argument,0,0}, // optidx=72
{"nlm-list",optional_argument,0,0}, // optidx=73
{"wf-iface",required_argument,0,0}, // optidx=61
{"wf-l3",required_argument,0,0}, // optidx=62
{"wf-tcp",required_argument,0,0}, // optidx=63
{"wf-udp",required_argument,0,0}, // optidx=64
{"wf-raw",required_argument,0,0}, // optidx=65
{"wf-save",required_argument,0,0}, // optidx=66
{"ssid-filter",required_argument,0,0}, // optidx=67
{"nlm-filter",required_argument,0,0}, // optidx=68
{"nlm-list",optional_argument,0,0}, // optidx=69
#endif
{NULL,0,NULL,0}
};
@ -1796,49 +1735,20 @@ int main(int argc, char **argv)
}
break;
case 46: /* hostlist */
if (bSkip) break;
if (!RegisterHostlist(dp, false, optarg))
{
DLOG_ERR("failed to register hostlist '%s'\n", optarg);
exit_clean(1);
}
break;
case 47: /* hostlist-domains */
if (bSkip) break;
if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
{
DLOG_ERR("failed to register anonymous hostlist\n");
exit_clean(1);
}
if (!parse_domain_list(optarg, &anon_hl->hostlist))
{
DLOG_ERR("failed to add domains to anonymous hostlist\n");
exit_clean(1);
}
break;
case 48: /* hostlist-exclude */
if (bSkip) break;
case 47: /* hostlist-exclude */
if (!RegisterHostlist(dp, true, optarg))
{
DLOG_ERR("failed to register hostlist '%s'\n", optarg);
exit_clean(1);
}
break;
case 49: /* hostlist-exclude-domains */
if (bSkip) break;
if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
{
DLOG_ERR("failed to register anonymous hostlist\n");
exit_clean(1);
}
if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist))
{
DLOG_ERR("failed to add domains to anonymous hostlist\n");
exit_clean(1);
}
break;
case 50: /* hostlist-auto */
if (bSkip) break;
case 48: /* hostlist-auto */
if (dp->hostlist_auto)
{
DLOG_ERR("only one auto hostlist per profile is supported\n");
@ -1865,7 +1775,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 51: /* hostlist-auto-fail-threshold */
case 49: /* hostlist-auto-fail-threshold */
dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
{
@ -1873,7 +1783,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 52: /* hostlist-auto-fail-time */
case 50: /* hostlist-auto-fail-time */
dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_time<1)
{
@ -1881,7 +1791,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 53: /* hostlist-auto-retrans-threshold */
case 51: /* hostlist-auto-retrans-threshold */
dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10)
{
@ -1889,7 +1799,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 54: /* hostlist-auto-debug */
case 52: /* hostlist-auto-debug */
{
FILE *F = fopen(optarg,"a+t");
if (!F)
@ -1903,7 +1813,7 @@ int main(int argc, char **argv)
}
break;
case 55: /* new */
case 53: /* new */
if (bSkip)
{
dp_clear(dp);
@ -1921,21 +1831,19 @@ int main(int argc, char **argv)
dp = &dpl->dp;
dp->n = ++desync_profile_count;
}
anon_hl = anon_hl_exclude = NULL;
anon_ips = anon_ips_exclude = NULL;
break;
case 56: /* skip */
case 54: /* skip */
bSkip = true;
break;
case 57: /* filter-l3 */
case 55: /* filter-l3 */
if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
{
DLOG_ERR("bad value for --filter-l3\n");
exit_clean(1);
}
break;
case 58: /* filter-tcp */
case 56: /* filter-tcp */
if (!parse_pf_list(optarg,&dp->pf_tcp))
{
DLOG_ERR("Invalid port filter : %s\n",optarg);
@ -1945,7 +1853,7 @@ int main(int argc, char **argv)
if (!port_filters_deny_if_empty(&dp->pf_udp))
exit_clean(1);
break;
case 59: /* filter-udp */
case 57: /* filter-udp */
if (!parse_pf_list(optarg,&dp->pf_udp))
{
DLOG_ERR("Invalid port filter : %s\n",optarg);
@ -1955,80 +1863,53 @@ int main(int argc, char **argv)
if (!port_filters_deny_if_empty(&dp->pf_tcp))
exit_clean(1);
break;
case 60: /* filter-l7 */
case 58: /* filter-l7 */
if (!parse_l7_list(optarg,&dp->filter_l7))
{
DLOG_ERR("Invalid l7 filter : %s\n",optarg);
exit_clean(1);
}
break;
case 61: /* ipset */
if (bSkip) break;
case 59: /* ipset */
if (!RegisterIpset(dp, false, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
exit_clean(1);
}
break;
case 62: /* ipset-ip */
if (bSkip) break;
if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
{
DLOG_ERR("failed to register anonymous ipset\n");
exit_clean(1);
}
if (!parse_ip_list(optarg, &anon_ips->ipset))
{
DLOG_ERR("failed to add subnets to anonymous ipset\n");
exit_clean(1);
}
break;
case 63: /* ipset-exclude */
if (bSkip) break;
case 60: /* ipset-exclude */
if (!RegisterIpset(dp, true, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
exit_clean(1);
}
break;
case 64: /* ipset-exclude-ip */
if (bSkip) break;
if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
{
DLOG_ERR("failed to register anonymous ipset\n");
exit_clean(1);
}
if (!parse_ip_list(optarg, &anon_ips_exclude->ipset))
{
DLOG_ERR("failed to add subnets to anonymous ipset\n");
exit_clean(1);
}
break;
#ifdef __linux__
case 65: /* bind-fix4 */
case 61: /* bind-fix4 */
params.bind_fix4 = true;
break;
case 66: /* bind-fix6 */
case 62: /* bind-fix6 */
params.bind_fix6 = true;
break;
#elif defined(__CYGWIN__)
case 65: /* wf-iface */
case 61: /* wf-iface */
if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
{
DLOG_ERR("bad value for --wf-iface\n");
exit_clean(1);
}
break;
case 66: /* wf-l3 */
case 62: /* wf-l3 */
if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
{
DLOG_ERR("bad value for --wf-l3\n");
exit_clean(1);
}
break;
case 67: /* wf-tcp */
case 63: /* wf-tcp */
hash_wf_tcp=hash_jen(optarg,strlen(optarg));
if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
@ -2037,7 +1918,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 68: /* wf-udp */
case 64: /* wf-udp */
hash_wf_udp=hash_jen(optarg,strlen(optarg));
if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
@ -2046,7 +1927,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 69: /* wf-raw */
case 65: /* wf-raw */
hash_wf_raw=hash_jen(optarg,strlen(optarg));
if (optarg[0]=='@')
{
@ -2060,11 +1941,11 @@ int main(int argc, char **argv)
windivert_filter[sizeof(windivert_filter) - 1] = '\0';
}
break;
case 70: /* wf-save */
case 66: /* wf-save */
strncpy(wf_save_file, optarg, sizeof(wf_save_file));
wf_save_file[sizeof(wf_save_file) - 1] = '\0';
break;
case 71: /* ssid-filter */
case 67: /* ssid-filter */
hash_ssid_filter=hash_jen(optarg,strlen(optarg));
{
char *e,*p = optarg;
@ -2082,7 +1963,7 @@ int main(int argc, char **argv)
}
}
break;
case 72: /* nlm-filter */
case 68: /* nlm-filter */
hash_nlm_filter=hash_jen(optarg,strlen(optarg));
{
char *e,*p = optarg;
@ -2100,7 +1981,7 @@ int main(int argc, char **argv)
}
}
break;
case 73: /* nlm-list */
case 69: /* nlm-list */
if (!nlm_list(optarg && !strcmp(optarg,"all")))
{
DLOG_ERR("could not get list of NLM networks\n");

18
nfq/pools.c
View File

@ -159,17 +159,12 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const
{
struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
if (entry)
{
if (filename)
{
if (!(entry->filename = strdup(filename)))
{
free(entry);
return false;
}
}
else
entry->filename = NULL;
entry->mod_time=0;
entry->hostlist = NULL;
LIST_INSERT_HEAD(head, entry, next);
@ -197,7 +192,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
LIST_FOREACH(hfile, head, next)
{
if (hfile->filename && !strcmp(hfile->filename,filename))
if (!strcmp(hfile->filename,filename))
return hfile;
}
return NULL;
@ -228,7 +223,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
LIST_FOREACH(item, head, next)
{
if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
if (!strcmp(item->hfile->filename,filename))
return item;
}
return NULL;
@ -373,17 +368,12 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
{
struct ipset_file *entry = malloc(sizeof(struct ipset_file));
if (entry)
{
if (filename)
{
if (!(entry->filename = strdup(filename)))
{
free(entry);
return false;
}
}
else
entry->filename = NULL;
entry->mod_time=0;
memset(&entry->ipset,0,sizeof(entry->ipset));
LIST_INSERT_HEAD(head, entry, next);
@ -411,7 +401,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
LIST_FOREACH(hfile, head, next)
{
if (hfile->filename && !strcmp(hfile->filename,filename))
if (!strcmp(hfile->filename,filename))
return hfile;
}
return NULL;
@ -442,7 +432,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
LIST_FOREACH(item, head, next)
{
if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
if (!strcmp(item->hfile->filename,filename))
return item;
}
return NULL;

43
tpws/hostlist.c
View File

@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
*hostlist = NULL;
return false;
}
if (ct) (*ct)++;
(*ct)++;
}
// advance to the next line
for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@ -32,11 +32,6 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
return true;
}
bool AppendHostlistItem(strpool **hostlist, char *s)
{
return addpool(hostlist,&s,s+strlen(s),NULL);
}
bool AppendHostList(strpool **hostlist, const char *filename)
{
char *p, *e, s[256], *zbuf;
@ -102,8 +97,6 @@ bool AppendHostList(strpool **hostlist, const char *filename)
}
static bool LoadHostList(struct hostlist_file *hfile)
{
if (hfile->filename)
{
time_t t = file_mod_time(hfile->filename);
if (!t)
@ -120,7 +113,6 @@ static bool LoadHostList(struct hostlist_file *hfile)
return false;
}
hfile->mod_time=t;
}
return true;
}
static bool LoadHostLists(struct hostlist_files_head *list)
@ -210,7 +202,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
LIST_FOREACH(item, hostlists_exclude, next)
{
VPRINT("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
VPRINT("[%s] exclude ", item->hfile->filename);
if (SearchHostList(item->hfile->hostlist, host))
{
if (excluded) *excluded = true;
@ -222,7 +214,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
{
LIST_FOREACH(item, hostlists, next)
{
VPRINT("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
VPRINT("[%s] include ", item->hfile->filename);
if (SearchHostList(item->hfile->hostlist, host))
return true;
}
@ -243,29 +235,17 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
{
struct hostlist_file *hfile;
if (filename)
{
if (!(hfile=hostlist_files_search(hostlists, filename)))
if (!(hfile=hostlist_files_add(hostlists, filename)))
return NULL;
if (!hostlist_collection_search(hl_collection, filename))
if (!hostlist_collection_add(hl_collection, hfile))
return NULL;
}
else
{
if (!(hfile=hostlist_files_add(hostlists, NULL)))
return NULL;
if (!hostlist_collection_add(hl_collection, hfile))
return NULL;
}
return hfile;
}
struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
{
if (filename && !file_mod_time(filename))
if (!file_mod_time(filename))
{
DLOG_ERR("cannot access hostlist file '%s'\n",filename);
return NULL;
@ -285,30 +265,15 @@ void HostlistsDebug()
struct hostlist_item *hl_item;
LIST_FOREACH(hfile, &params.hostlists, next)
{
if (hfile->filename)
VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
else
VPRINT("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
}
LIST_FOREACH(dpl, &params.desync_profiles, next)
{
LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
if (hl_item->hfile!=dpl->dp.hostlist_auto)
{
if (hl_item->hfile->filename)
VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
else
VPRINT("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
}
LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
{
if (hl_item->hfile->filename)
VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
else
VPRINT("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
}
if (dpl->dp.hostlist_auto)
VPRINT("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
}

1
tpws/hostlist.h
View File

@ -4,7 +4,6 @@
#include "pools.h"
#include "params.h"
bool AppendHostlistItem(strpool **hostlist, char *s);
bool AppendHostList(strpool **hostlist, const char *filename);
bool LoadAllHostLists();
bool NonEmptyHostlist(strpool **hostlist);

39
tpws/ipset.c
View File

@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
ipsetDestroy(ips);
return false;
}
if (ct) (*ct)++;
(*ct)++;
}
else if (parse_cidr6(cidr,&c6))
{
@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
ipsetDestroy(ips);
return false;
}
if (ct) (*ct)++;
(*ct)++;
}
else
DLOG_ERR("bad ip or subnet : %s\n",cidr);
@ -53,11 +53,6 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
}
bool AppendIpsetItem(ipset *ips, char *ip)
{
return addpool(ips,&ip,ip+strlen(ip),NULL);
}
static bool AppendIpset(ipset *ips, const char *filename)
{
char *p, *e, s[256], *zbuf;
@ -123,8 +118,6 @@ static bool AppendIpset(ipset *ips, const char *filename)
}
static bool LoadIpset(struct ipset_file *hfile)
{
if (hfile->filename)
{
time_t t = file_mod_time(hfile->filename);
if (!t)
@ -141,7 +134,6 @@ static bool LoadIpset(struct ipset_file *hfile)
return false;
}
hfile->mod_time=t;
}
return true;
}
static bool LoadIpsets(struct ipset_files_head *list)
@ -213,7 +205,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
LIST_FOREACH(item, ips_exclude, next)
{
VPRINT("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
VPRINT("[%s] exclude ",item->hfile->filename);
if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
return false;
}
@ -222,7 +214,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
{
LIST_FOREACH(item, ips, next)
{
VPRINT("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
VPRINT("[%s] include ",item->hfile->filename);
if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
return true;
}
@ -242,27 +234,17 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename)
{
struct ipset_file *hfile;
if (filename)
{
if (!(hfile=ipset_files_search(ipsets, filename)))
if (!(hfile=ipset_files_add(ipsets, filename)))
return NULL;
if (!ipset_collection_search(ips_collection, filename))
if (!ipset_collection_add(ips_collection, hfile))
return NULL;
}
else
{
if (!(hfile=ipset_files_add(ipsets, NULL)))
return NULL;
if (!ipset_collection_add(ips_collection, hfile))
return NULL;
}
return hfile;
}
struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
{
if (filename && !file_mod_time(filename))
if (!file_mod_time(filename))
{
DLOG_ERR("cannot access ipset file '%s'\n",filename);
return NULL;
@ -295,24 +277,13 @@ void IpsetsDebug()
struct ipset_item *ips_item;
LIST_FOREACH(hfile, &params.ipsets, next)
{
if (hfile->filename)
VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
else
VPRINT("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
}
LIST_FOREACH(dpl, &params.desync_profiles, next)
{
LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
if (ips_item->hfile->filename)
VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
else
VPRINT("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
if (ips_item->hfile->filename)
VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
else
VPRINT("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
}
}

1
tpws/ipset.h
View File

@ -9,4 +9,3 @@ bool LoadAllIpsets();
bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
void IpsetsDebug();
bool AppendIpsetItem(ipset *ips, char *ip);

19
tpws/pools.c
View File

@ -154,21 +154,17 @@ void strlist_destroy(struct str_list_head *head)
struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const char *filename)
{
struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
if (entry)
{
if (filename)
{
if (!(entry->filename = strdup(filename)))
{
free(entry);
return false;
}
}
else
entry->filename = NULL;
entry->mod_time=0;
entry->hostlist = NULL;
LIST_INSERT_HEAD(head, entry, next);
@ -196,7 +192,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
LIST_FOREACH(hfile, head, next)
{
if (hfile->filename && !strcmp(hfile->filename,filename))
if (!strcmp(hfile->filename,filename))
return hfile;
}
return NULL;
@ -227,7 +223,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
LIST_FOREACH(item, head, next)
{
if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
if (!strcmp(item->hfile->filename,filename))
return item;
}
return NULL;
@ -372,17 +368,12 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
{
struct ipset_file *entry = malloc(sizeof(struct ipset_file));
if (entry)
{
if (filename)
{
if (!(entry->filename = strdup(filename)))
{
free(entry);
return false;
}
}
else
entry->filename = NULL;
entry->mod_time=0;
memset(&entry->ipset,0,sizeof(entry->ipset));
LIST_INSERT_HEAD(head, entry, next);
@ -410,7 +401,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
LIST_FOREACH(hfile, head, next)
{
if (hfile->filename && !strcmp(hfile->filename,filename))
if (!strcmp(hfile->filename,filename))
return hfile;
}
return NULL;
@ -441,7 +432,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
LIST_FOREACH(item, head, next)
{
if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
if (!strcmp(item->hfile->filename,filename))
return item;
}
return NULL;

256
tpws/tpws.c
View File

@ -182,14 +182,10 @@ static void exithelp(void)
" --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n"
" --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n"
" --ipset=<filename>\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
" --ipset-ip=<ip_list>\t\t\t; comma separated fixed subnet list\n"
" --ipset-exclude=<filename>\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
" --ipset-exclude-ip=<ip_list>\t\t; comma separated fixed subnet list\n"
"\nHOSTLIST FILTER:\n"
" --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-domains=<domain_list>\t; comma separated fixed domain list\n"
" --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list\n"
" --hostlist-auto=<filename>\t\t; detect DPI blocks and build hostlist automatically\n"
" --hostlist-auto-fail-threshold=<int>\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
" --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n"
@ -488,46 +484,6 @@ static bool parse_pf_list(char *opt, struct port_filters_head *pfl)
return true;
}
static bool parse_domain_list(char *opt, strpool **pp)
{
char *e,*p,c;
for (p=opt ; p ; )
{
if ((e = strchr(p,',')))
{
c=*e;
*e=0;
}
if (*p && !AppendHostlistItem(pp,p)) return false;
if (e) *e++=c;
p = e;
}
return true;
}
static bool parse_ip_list(char *opt, ipset *pp)
{
char *e,*p,c;
for (p=opt ; p ; )
{
if ((e = strchr(p,',')))
{
c=*e;
*e=0;
}
if (*p && !AppendIpsetItem(pp,p)) return false;
if (e) *e++=c;
p = e;
}
return true;
}
#if !defined( __OpenBSD__) && !defined(__ANDROID__)
// no static to not allow optimizer to inline this func (save stack)
void config_from_file(const char *filename)
@ -570,8 +526,6 @@ void parse_params(int argc, char *argv[])
int option_index = 0;
int v, i;
bool bSkip=false;
struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL;
struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL;
memset(&params, 0, sizeof(params));
params.maxconn = DEFAULT_MAX_CONN;
@ -657,50 +611,46 @@ void parse_params(int argc, char *argv[])
{ "tlsrec",required_argument,0,0 },// optidx=34
{ "tlsrec-pos",required_argument,0,0 },// optidx=35
{ "hostlist",required_argument,0,0 },// optidx=36
{ "hostlist-domains",required_argument,0,0 },// optidx=37
{ "hostlist-exclude",required_argument,0,0 },// optidx=38
{ "hostlist-exclude-domains",required_argument,0,0 },// optidx=39
{ "hostlist-auto",required_argument,0,0}, // optidx=40
{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=41
{ "hostlist-auto-fail-time",required_argument,0,0}, // optidx=42
{ "hostlist-auto-debug",required_argument,0,0}, // optidx=43
{ "pidfile",required_argument,0,0 },// optidx=44
{ "debug",optional_argument,0,0 },// optidx=45
{ "debug-level",required_argument,0,0 },// optidx=46
{ "local-rcvbuf",required_argument,0,0 },// optidx=47
{ "local-sndbuf",required_argument,0,0 },// optidx=48
{ "remote-rcvbuf",required_argument,0,0 },// optidx=49
{ "remote-sndbuf",required_argument,0,0 },// optidx=50
{ "socks",no_argument,0,0 },// optidx=51
{ "no-resolve",no_argument,0,0 },// optidx=52
{ "resolver-threads",required_argument,0,0 },// optidx=53
{ "skip-nodelay",no_argument,0,0 },// optidx=54
{ "tamper-start",required_argument,0,0 },// optidx=55
{ "tamper-cutoff",required_argument,0,0 },// optidx=56
{ "connect-bind-addr",required_argument,0,0 },// optidx=57
{ "hostlist-exclude",required_argument,0,0 },// optidx=37
{ "hostlist-auto",required_argument,0,0}, // optidx=38
{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=39
{ "hostlist-auto-fail-time",required_argument,0,0}, // optidx=40
{ "hostlist-auto-debug",required_argument,0,0}, // optidx=41
{ "pidfile",required_argument,0,0 },// optidx=42
{ "debug",optional_argument,0,0 },// optidx=43
{ "debug-level",required_argument,0,0 },// optidx=44
{ "local-rcvbuf",required_argument,0,0 },// optidx=45
{ "local-sndbuf",required_argument,0,0 },// optidx=46
{ "remote-rcvbuf",required_argument,0,0 },// optidx=47
{ "remote-sndbuf",required_argument,0,0 },// optidx=48
{ "socks",no_argument,0,0 },// optidx=40
{ "no-resolve",no_argument,0,0 },// optidx=50
{ "resolver-threads",required_argument,0,0 },// optidx=51
{ "skip-nodelay",no_argument,0,0 },// optidx=52
{ "tamper-start",required_argument,0,0 },// optidx=53
{ "tamper-cutoff",required_argument,0,0 },// optidx=54
{ "connect-bind-addr",required_argument,0,0 },// optidx=55
{ "new",no_argument,0,0 }, // optidx=58
{ "skip",no_argument,0,0 }, // optidx=59
{ "filter-l3",required_argument,0,0 }, // optidx=60
{ "filter-tcp",required_argument,0,0 }, // optidx=61
{ "filter-l7",required_argument,0,0 }, // optidx=62
{ "ipset",required_argument,0,0 }, // optidx=63
{ "ipset-ip",required_argument,0,0 }, // optidx=64
{ "ipset-exclude",required_argument,0,0 }, // optidx=65
{ "ipset-exclude-ip",required_argument,0,0 }, // optidx=66
{ "new",no_argument,0,0 }, // optidx=56
{ "skip",no_argument,0,0 }, // optidx=57
{ "filter-l3",required_argument,0,0 }, // optidx=58
{ "filter-tcp",required_argument,0,0 }, // optidx=59
{ "filter-l7",required_argument,0,0 }, // optidx=60
{ "ipset",required_argument,0,0 }, // optidx=61
{ "ipset-exclude",required_argument,0,0 }, // optidx=62
#if defined(__FreeBSD__)
{ "enable-pf",no_argument,0,0 },// optidx=67
{ "enable-pf",no_argument,0,0 },// optidx=62
#elif defined(__APPLE__)
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=67
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=68
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64
#elif defined(__linux__)
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=67
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=68
{ "mss",required_argument,0,0 }, // optidx=69
{ "fix-seg",optional_argument,0,0 }, // optidx=70
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64
{ "mss",required_argument,0,0 }, // optidx=65
{ "fix-seg",optional_argument,0,0 }, // optidx=66
#ifdef SPLICE_PRESENT
{ "nosplice",no_argument,0,0 }, // optidx=71
{ "nosplice",no_argument,0,0 }, // optidx=67
#endif
#endif
{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@ -998,7 +948,6 @@ void parse_params(int argc, char *argv[])
params.tamper = true;
break;
case 36: /* hostlist */
if (bSkip) break;
if (!RegisterHostlist(dp, false, optarg))
{
DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@ -1006,22 +955,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper = true;
break;
case 37: /* hostlist-domains */
if (bSkip) break;
if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
{
DLOG_ERR("failed to register anonymous hostlist\n");
exit_clean(1);
}
if (!parse_domain_list(optarg, &anon_hl->hostlist))
{
DLOG_ERR("failed to add domains to anonymous hostlist\n");
exit_clean(1);
}
params.tamper = true;
break;
case 38: /* hostlist-exclude */
if (bSkip) break;
case 37: /* hostlist-exclude */
if (!RegisterHostlist(dp, true, optarg))
{
DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@ -1029,22 +963,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper = true;
break;
case 39: /* hostlist-exclude-domains */
if (bSkip) break;
if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
{
DLOG_ERR("failed to register anonymous hostlist\n");
exit_clean(1);
}
if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist))
{
DLOG_ERR("failed to add domains to anonymous hostlist\n");
exit_clean(1);
}
params.tamper = true;
break;
case 40: /* hostlist-auto */
if (bSkip) break;
case 38: /* hostlist-auto */
if (dp->hostlist_auto)
{
DLOG_ERR("only one auto hostlist per profile is supported\n");
@ -1072,7 +991,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice.
break;
case 41: /* hostlist-auto-fail-threshold */
case 39: /* hostlist-auto-fail-threshold */
dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
{
@ -1080,7 +999,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 42: /* hostlist-auto-fail-time */
case 40: /* hostlist-auto-fail-time */
dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_time<1)
{
@ -1088,7 +1007,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 43: /* hostlist-auto-debug */
case 41: /* hostlist-auto-debug */
{
FILE *F = fopen(optarg,"a+t");
if (!F)
@ -1101,11 +1020,11 @@ void parse_params(int argc, char *argv[])
params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
}
break;
case 44: /* pidfile */
case 42: /* pidfile */
strncpy(params.pidfile,optarg,sizeof(params.pidfile));
params.pidfile[sizeof(params.pidfile)-1]='\0';
break;
case 45: /* debug */
case 43: /* debug */
if (optarg)
{
if (*optarg=='@')
@ -1139,44 +1058,44 @@ void parse_params(int argc, char *argv[])
params.debug_target = LOG_TARGET_CONSOLE;
}
break;
case 46: /* debug-level */
case 44: /* debug-level */
params.debug = atoi(optarg);
break;
case 47: /* local-rcvbuf */
case 45: /* local-rcvbuf */
#ifdef __linux__
params.local_rcvbuf = atoi(optarg)/2;
#else
params.local_rcvbuf = atoi(optarg);
#endif
break;
case 48: /* local-sndbuf */
case 46: /* local-sndbuf */
#ifdef __linux__
params.local_sndbuf = atoi(optarg)/2;
#else
params.local_sndbuf = atoi(optarg);
#endif
break;
case 49: /* remote-rcvbuf */
case 47: /* remote-rcvbuf */
#ifdef __linux__
params.remote_rcvbuf = atoi(optarg)/2;
#else
params.remote_rcvbuf = atoi(optarg);
#endif
break;
case 50: /* remote-sndbuf */
case 48: /* remote-sndbuf */
#ifdef __linux__
params.remote_sndbuf = atoi(optarg)/2;
#else
params.remote_sndbuf = atoi(optarg);
#endif
break;
case 51: /* socks */
case 49: /* socks */
params.proxy_type = CONN_TYPE_SOCKS;
break;
case 52: /* no-resolve */
case 50: /* no-resolve */
params.no_resolve = true;
break;
case 53: /* resolver-threads */
case 51: /* resolver-threads */
params.resolver_threads = atoi(optarg);
if (params.resolver_threads<1 || params.resolver_threads>300)
{
@ -1184,10 +1103,10 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 54: /* skip-nodelay */
case 52: /* skip-nodelay */
params.skip_nodelay = true;
break;
case 55: /* tamper-start */
case 53: /* tamper-start */
{
const char *p=optarg;
if (*p=='n')
@ -1201,7 +1120,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper_lim = true;
break;
case 56: /* tamper-cutoff */
case 54: /* tamper-cutoff */
{
const char *p=optarg;
if (*p=='n')
@ -1215,7 +1134,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper_lim = true;
break;
case 57: /* connect-bind-addr */
case 55: /* connect-bind-addr */
{
char *p = strchr(optarg,'%');
if (p) *p++=0;
@ -1243,7 +1162,7 @@ void parse_params(int argc, char *argv[])
break;
case 58: /* new */
case 56: /* new */
if (bSkip)
{
dp_clear(dp);
@ -1261,35 +1180,32 @@ void parse_params(int argc, char *argv[])
dp = &dpl->dp;
dp->n = ++desync_profile_count;
}
anon_hl = anon_hl_exclude = NULL;
anon_ips = anon_ips_exclude = NULL;
break;
case 59: /* skip */
case 57: /* skip */
bSkip = true;
break;
case 60: /* filter-l3 */
case 58: /* filter-l3 */
if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
{
DLOG_ERR("bad value for --filter-l3\n");
exit_clean(1);
}
break;
case 61: /* filter-tcp */
case 59: /* filter-tcp */
if (!parse_pf_list(optarg,&dp->pf_tcp))
{
DLOG_ERR("Invalid port filter : %s\n",optarg);
exit_clean(1);
}
break;
case 62: /* filter-l7 */
case 60: /* filter-l7 */
if (!parse_l7_list(optarg,&dp->filter_l7))
{
DLOG_ERR("Invalid l7 filter : %s\n",optarg);
exit_clean(1);
}
break;
case 63: /* ipset */
if (bSkip) break;
case 61: /* ipset */
if (!RegisterIpset(dp, false, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1297,22 +1213,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper = true;
break;
case 64: /* ipset-ip */
if (bSkip) break;
if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
{
DLOG_ERR("failed to register anonymous ipset\n");
exit_clean(1);
}
if (!parse_ip_list(optarg, &anon_ips->ipset))
{
DLOG_ERR("failed to add subnets to anonymous ipset\n");
exit_clean(1);
}
params.tamper = true;
break;
case 65: /* ipset-exclude */
if (bSkip) break;
case 62: /* ipset-exclude */
if (!RegisterIpset(dp, true, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1320,27 +1221,13 @@ void parse_params(int argc, char *argv[])
}
params.tamper = true;
break;
case 66: /* ipset-exclude-ip */
if (bSkip) break;
if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
{
DLOG_ERR("failed to register anonymous ipset\n");
exit_clean(1);
}
if (!parse_ip_list(optarg, &anon_ips_exclude->ipset))
{
DLOG_ERR("failed to add subnets to anonymous ipset\n");
exit_clean(1);
}
params.tamper = true;
break;
#if defined(__FreeBSD__)
case 67: /* enable-pf */
case 63: /* enable-pf */
params.pf_enable = true;
break;
#elif defined(__linux__) || defined(__APPLE__)
case 67: /* local-tcp-user-timeout */
case 63: /* local-tcp-user-timeout */
params.tcp_user_timeout_local = atoi(optarg);
if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
{
@ -1348,7 +1235,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 68: /* remote-tcp-user-timeout */
case 64: /* remote-tcp-user-timeout */
params.tcp_user_timeout_remote = atoi(optarg);
if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
{
@ -1359,7 +1246,7 @@ void parse_params(int argc, char *argv[])
#endif
#if defined(__linux__)
case 69: /* mss */
case 65: /* mss */
// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
dp->mss = atoi(optarg);
if (dp->mss<88 || dp->mss>32767)
@ -1368,7 +1255,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 70: /* fix-seg */
case 66: /* fix-seg */
if (!params.fix_seg_avail)
{
DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
@ -1388,7 +1275,7 @@ void parse_params(int argc, char *argv[])
params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
break;
#ifdef SPLICE_PRESENT
case 71: /* nosplice */
case 67: /* nosplice */
params.nosplice = true;
break;
#endif
@ -1612,15 +1499,6 @@ struct salisten_s
int bind_wait_ip_left; // how much seconds left from bind_wait_ip
};
static const char *bindll_s[] = { "unwanted","no","prefer","force" };
#define STRINGIFY(x) #x
#define TOSTRING(x) STRINGIFY(x)
#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
#else
#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
#endif
int main(int argc, char *argv[])
{
int i, listen_fd[MAX_BINDS], yes = 1, retval = 0, if_index, exit_v=EXIT_FAILURE;
@ -1631,8 +1509,6 @@ int main(int argc, char *argv[])
srand(time(NULL));
mask_from_preflen6_prepare();
PRINT_VER;
parse_params(argc, argv);
argv=NULL; argc=0;