drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2024-11-29 21:40:52 +03:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: drygdryg:9c8662b25e16e51a7d2dc5fba9328eccb8c08a32
Branches Tags
drygdryg:master
drygdryg:v69.3
drygdryg:v69.2
drygdryg:v69.1
drygdryg:v69
drygdryg:v68
drygdryg:v67
drygdryg:v66
drygdryg:v65
drygdryg:v64
..
compare: drygdryg:033043bdc03cf97dc17dedccc420e7fb08f94670
Branches Tags
drygdryg:master
drygdryg:v69.3
drygdryg:v69.2
drygdryg:v69.1
drygdryg:v69
drygdryg:v68
drygdryg:v67
drygdryg:v66
drygdryg:v65
drygdryg:v64

No commits in common. "9c8662b25e16e51a7d2dc5fba9328eccb8c08a32" and "033043bdc03cf97dc17dedccc420e7fb08f94670" have entirely different histories.
9c8662b25e ... 033043bdc0

14 changed files with 240 additions and 367 deletions
Show Stats Expand all files Collapse all files

2
blockcheck.sh
View File

@ -1173,7 +1173,7 @@ pktws_check_domain_http_bypass_()
local splits_tls='2 1 sniext+1 sniext+4 host+1 midsld 1,midsld 1,sniext+1,host+1,midsld-2,midsld,midsld+2,endhost-1'
[ "$sec" = 0 ] && {
for s in '--hostcase' '--hostspell=hoSt' '--hostnospace' '--domcase' '--methodeol'; do
for s in '--hostcase' '--hostspell=hoSt' '--hostnospace' '--domcase'; do
pktws_curl_test_update $1 $3 $s
done
}

11
docs/changes.txt
View File

@ -389,14 +389,3 @@ blockcheck: added CURL_OPT
blockcheck: new strategies support
blockcheck: test sequence rework
blockcheck: view all working strategies in summary
v69.1:
init.d: keenetic udp fix custom
tpws: fixed incorrect hostlist checks
v69.2:
nfqws,tpws: --skip
nfqws: --methodeol
init.d: do not use pgrep in sysv for busybox compat

9
docs/readme.en.md
View File

@ -146,7 +146,6 @@ nfqws takes the following parameters:
--hostspell ; exact spelling of "Host" header. must be 4 chars. default is "host"
--hostnospace ; remove space after Host: and add it to User-Agent: to preserve packet size
--domcase ; mix domain case : Host: TeSt.cOm
--methodeol ; add '\n' before method and remove space after Host:
--dpi-desync=[<mode0>,]<mode>[,<mode2>] ; try to desync dpi state. modes : synack fake fakeknown rst rstack hopbyhop destopt ipfrag1 multisplit multidisorder fakedsplit fakeddisorder ipfrag2 udplen tamper
--dpi-desync-fwmark=<int|0xHEX> ; override fwmark for desync packet. default = 0x40000000 (1073741824)
--dpi-desync-ttl=<int> ; set ttl for desync packet
@ -186,8 +185,7 @@ nfqws takes the following parameters:
--hostlist-auto-fail-time=<int> ; all failed attemps must be within these seconds (default : 60)
--hostlist-auto-retrans-threshold=<int> ; how many request retransmissions cause attempt to fail (default : 3)
--hostlist-auto-debug=<logfile> ; debug auto hostlist positives
--new ; begin new strategy (new profile)
--skip ; do not use this profile
--new ; begin new strategy
--filter-l3=ipv4|ipv6 ; L3 protocol filter. multiple comma separated values allowed.
--filter-tcp=[~]port1[-port2]|* ; TCP port filter. ~ means negation. setting tcp and not setting udp filter denies udp. comma separated list supported.
--filter-udp=[~]port1[-port2]|* ; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list supported.
@ -269,7 +267,7 @@ Positions are defined by markers.
Relative positions :
* **method** - HTTP method start ('GET', 'POST', 'HEAD', ...). Method is usually always at position 0 but can shift because of `--methodeol` fooling. If fooled position can become 1 or 2.
* **method** - HTTP method start ('GET', 'POST', 'HEAD', ...). Method is usually always at position 0 but also supported `--methodeol` fooling by **tpws**. If fooled position can become 1 or 2.
* **host** - hostname start in a known protocol (http, TLS)
* **endhost** - the byte next to the last hostname's byte
* **sld** - second level domain start in the hostname
@ -665,8 +663,7 @@ tpws is transparent proxy.
; its worth to make a reserve with 1.5 multiplier. by default maxfiles is (X*connections)*1.5+16
--max-orphan-time=<sec> ; if local leg sends something and closes and remote leg is still connecting then cancel connection attempt after N seconds
--new ; begin new strategy (new profile)
--skip ; do not use this profile
--new ; begin new strategy
--filter-l3=ipv4|ipv6 ; L3 protocol filter. multiple comma separated values allowed.
--filter-tcp=[~]port1[-port2]|* ; TCP port filter. ~ means negation. comma separated list supported.
--filter-l7=[http|tls|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.

5
docs/readme.md
View File

@ -175,7 +175,6 @@ dvtws, собираемый из тех же исходников (см. [док
--ctrack-timeouts=S:E:F[:U] ; таймауты внутреннего conntrack в состояниях SYN, ESTABLISHED, FIN, таймаут udp. по умолчанию 60:300:60:60
--hostcase ; менять регистр заголовка "Host:" по умолчанию на "host:".
--hostnospace ; убрать пробел после "Host:" и переместить его в конец значения "User-Agent:" для сохранения длины пакета
--methodeol ; добавить перевод строки в unix стиле ('\n') перед методом и убрать пробел из Host: : "GET / ... Host: domain.com" => "\nGET / ... Host:domain.com"
--hostspell=HoST ; точное написание заголовка Host (можно "HOST" или "HoSt"). автоматом включает --hostcase
--domcase ; домен после Host: сделать таким : TeSt.cOm
--dpi-desync=[<mode0>,]<mode>[,<mode2] ; атака по десинхронизации DPI. mode : synack syndata fake fakeknown rst rstack hopbyhop destopt ipfrag1 multisplit multidisorder fakedsplit fakeddisorder ipfrag2 udplen tamper
@ -218,7 +217,6 @@ dvtws, собираемый из тех же исходников (см. [док
--hostlist-auto-retrans-threshold=<int> ; сколько ретрансмиссий запроса считать блокировкой (по умолчанию: 3)
--hostlist-auto-debug=<logfile> ; лог положительных решений по autohostlist. позволяет разобраться почему там появляются хосты.
--new ; начало новой стратегии (новый профиль)
--skip ; не использовать этот профиль . полезно для временной деактивации профиля без удаления параметров.
--filter-l3=ipv4|ipv6 ; фильтр версии ip для текущей стратегии
--filter-tcp=[~]port1[-port2]|* ; фильтр портов tcp для текущей стратегии. ~ означает инверсию. установка фильтра tcp и неустановка фильтра udp запрещает udp. поддерживается список через запятую.
--filter-udp=[~]port1[-port2]|* ; фильтр портов udp для текущей стратегии. ~ означает инверсию. установка фильтра udp и неустановка фильтра tcp запрещает tcp. поддерживается список через запятую.
@ -325,7 +323,7 @@ dvtws, собираемый из тех же исходников (см. [док
Относительные позиции :
* **method** - начало метода HTTP ('GET', 'POST', 'HEAD', ...). Метод обычно всегда находится на позиции 0, но может сместиться из-за `--methodeol`. Тогда позиция может стать 1 или 2.
* **method** - начало метода HTTP ('GET', 'POST', 'HEAD', ...). Метод обычно всегда находится на позиции 0, но поддерживается и нахождение метода после дурение методом `--methodeol` от tpws. Тогда позиция может стать 1 или 2.
* **host** - начало имени хоста в известном протоколе (http, TLS)
* **endhost** - байт, следующий за последним байтом имени хоста
* **sld** - начало домена 2 уровня в имени хоста
@ -828,7 +826,6 @@ tpws - это transparent proxy.
--hostlist-auto-fail-time=<int> ; все эти ситуации должны быть в пределах указанного количества секунд (по умолчанию: 60)
--hostlist-auto-debug=<logfile> ; лог положительных решений по autohostlist. позволяет разобраться почему там появляются хосты.
--new ; начало новой стратегии (новый профиль)
--skip ; не использовать этот профиль . полезно для временной деактивации профиля без удаления параметров.
--filter-l3=ipv4|ipv6 ; фильтр версии ip для текущей стратегии
--filter-tcp=[~]port1[-port2]|* ; фильтр портов tcp для текущей стратегии. ~ означает инверсию. поддерживается список через запятую.
--filter-l7=[http|tls|quic|wireguard|dht|unknown] ; фильтр протокола L6-L7. поддерживается несколько значений через запятую.

26
init.d/sysv/functions
View File

@ -167,15 +167,9 @@ run_daemon()
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
local DAEMONBASE="$(basename "$2")"
local PID= PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
echo "Starting daemon $1: $2 $3"
[ -f "$PIDFILE" ] && {
read PID <"$PIDFILE"
[ -d "/proc/$PID" ] || PID=
}
if [ -n "$PID" ]; then
if [ -f "$PIDFILE" ] && pgrep -F "$PIDFILE" "$DAEMONBASE" >/dev/null; then
echo already running
else
"$2" $3 >/dev/null &
@ -194,14 +188,18 @@ stop_daemon()
# $2 - daemon
# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
local DAEMONBASE="$(basename "$2")"
local PID PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
echo "Stopping daemon $1: $2"
if [ -f "$PIDFILE" ]; then
read PID <"$PIDFILE"
kill $PID
rm -f "$PIDFILE"
if exists start-stop-daemon ; then
start-stop-daemon -K -p "$PIDFILE" -x "$2"
else
echo no pidfile : $PIDFILE
if [ -f "$PIDFILE" ]; then
read PID <"$PIDFILE"
kill $PID
rm -f "$PIDFILE"
else
echo no pidfile : $PIDFILE
fi
fi
}
do_daemon()

4
nfq/Makefile
View File

@ -1,6 +1,6 @@
CC ?= gcc
CFLAGS += -std=gnu99 -Os -flto=auto
CFLAGS_BSD = -Wno-address-of-packed-member
CFLAGS += -std=gnu99 -Os
CFLAGS_BSD = -Wno-address-of-packed-member -flto=auto
CFLAGS_CYGWIN = -Wno-address-of-packed-member -static
LIBS_LINUX = -lnetfilter_queue -lnfnetlink -lz
LIBS_BSD = -lz

39
nfq/desync.c
View File

@ -1082,7 +1082,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
}
ttl_fake = (ctrack_replay && ctrack_replay->autottl) ? ctrack_replay->autottl : (dis->ip6 ? (dp->desync_ttl6 ? dp->desync_ttl6 : ttl_orig) : (dp->desync_ttl ? dp->desync_ttl : ttl_orig));
if ((l7proto == HTTP) && (dp->hostcase || dp->hostnospace || dp->domcase || dp->methodeol) && HttpFindHost(&phost,dis->data_payload,dis->len_payload))
if ((l7proto == HTTP) && (dp->hostcase || dp->hostnospace || dp->domcase) && HttpFindHost(&phost,dis->data_payload,dis->len_payload))
{
if (dp->hostcase)
{
@ -1098,40 +1098,23 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
verdict=VERDICT_MODIFY;
}
uint8_t *pua;
if (dp->hostnospace)
if (dp->hostnospace &&
(pua = (uint8_t*)memmem(dis->data_payload, dis->len_payload, "\r\nUser-Agent: ", 14)) &&
(pua = (uint8_t*)memmem(pua + 1, dis->len_payload - (pua - dis->data_payload) - 1, "\r\n", 2)))
{
if ((pua = (uint8_t*)memmem(dis->data_payload, dis->len_payload, "\r\nUser-Agent: ", 14)) &&
(pua = (uint8_t*)memmem(pua + 1, dis->len_payload - (pua - dis->data_payload) - 1, "\r\n", 2)))
DLOG("removing space after Host: and adding it to User-Agent:\n");
if (pua > phost)
{
DLOG("removing space after Host: and adding it to User-Agent:\n");
if (pua > phost)
{
memmove(phost + 5, phost + 6, pua - phost - 6);
pua[-1]=' ';
}
else
{
memmove(pua + 1, pua, phost - pua + 5);
*pua = ' ';
}
verdict=VERDICT_MODIFY;
memmove(phost + 5, phost + 6, pua - phost - 6);
pua[-1]=' ';
}
else
DLOG("cannot do hostnospace because valid User-Agent: not found\n");
}
else if (dp->methodeol)
{
if (phost[5]==' ' || phost[5]=='\t')
{
DLOG("removing space after Host: and adding '\\n' before method\n");
memmove(dis->data_payload+1,dis->data_payload,phost-dis->data_payload+5);
dis->data_payload[0]='\n';
verdict=VERDICT_MODIFY;
memmove(pua + 1, pua, phost - pua + 5);
*pua = ' ';
}
else
DLOG("cannot do methodeol because there's no space or tab after Host:\n");
verdict=VERDICT_MODIFY;
}
}
if (dp->desync_mode==DESYNC_NONE)

277
nfq/nfqws.c
View File

@ -1020,7 +1020,6 @@ static void exithelp(void)
#endif
"\nMULTI-STRATEGY:\n"
" --new\t\t\t\t\t\t; begin new strategy\n"
" --skip\t\t\t\t\t\t; do not use this strategy\n"
" --filter-l3=ipv4|ipv6\t\t\t\t; L3 protocol filter. multiple comma separated values allowed.\n"
" --filter-tcp=[~]port1[-port2]|*\t\t; TCP port filter. ~ means negation. setting tcp and not setting udp filter denies udp. comma separated list allowed.\n"
" --filter-udp=[~]port1[-port2]|*\t\t; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list allowed.\n"
@ -1043,7 +1042,6 @@ static void exithelp(void)
" --hostspell\t\t\t\t\t; exact spelling of \"Host\" header. must be 4 chars. default is \"host\"\n"
" --hostnospace\t\t\t\t\t; remove space after Host: and add it to User-Agent: to preserve packet size\n"
" --domcase\t\t\t\t\t; mix domain case : Host: TeSt.cOm\n"
" --methodeol\t\t\t\t\t; add '\\n' before method and remove space from Host:\n"
" --dpi-desync=[<mode0>,]<mode>[,<mode2>]\t; try to desync dpi state. modes :\n"
"\t\t\t\t\t\t; synack syndata fake fakeknown rst rstack hopbyhop destopt ipfrag1\n"
"\t\t\t\t\t\t; multisplit multidisorder fakedsplit fakeddisorder ipfrag2 udplen tamper\n"
@ -1141,7 +1139,7 @@ int main(int argc, char **argv)
#endif
int result, v;
int option_index = 0;
bool daemon = false, bSkip = false;
bool daemon = false;
char pidfile[256];
#ifdef __CYGWIN__
char windivert_filter[8192], wf_pf_tcp_src[256], wf_pf_tcp_dst[256], wf_pf_udp_src[256], wf_pf_udp_dst[256], wf_save_file[256];
@ -1229,72 +1227,70 @@ int main(int argc, char **argv)
{"hostspell",required_argument,0,0}, // optidx=11
{"hostnospace",no_argument,0,0}, // optidx=12
{"domcase",no_argument,0,0 }, // optidx=13
{"methodeol",no_argument,0,0 }, // optidx=14
{"dpi-desync",required_argument,0,0}, // optidx=15
{"dpi-desync",required_argument,0,0}, // optidx=14
#ifdef __linux__
{"dpi-desync-fwmark",required_argument,0,0}, // optidx=16
{"dpi-desync-fwmark",required_argument,0,0}, // optidx=15
#elif defined(SO_USER_COOKIE)
{"dpi-desync-sockarg",required_argument,0,0}, // optidx=16
{"dpi-desync-sockarg",required_argument,0,0}, // optidx=15
#else
{"disabled_argument_4",no_argument,0,0}, // optidx=16
{"disabled_argument_4",no_argument,0,0}, // optidx=15
#endif
{"dpi-desync-ttl",required_argument,0,0}, // optidx=17
{"dpi-desync-ttl6",required_argument,0,0}, // optidx=18
{"dpi-desync-autottl",optional_argument,0,0}, // optidx=19
{"dpi-desync-autottl6",optional_argument,0,0}, // optidx=20
{"dpi-desync-fooling",required_argument,0,0}, // optidx=21
{"dpi-desync-repeats",required_argument,0,0}, // optidx=22
{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=23
{"dpi-desync-split-pos",required_argument,0,0},// optidx=24
{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=25
{"dpi-desync-split-tls",required_argument,0,0 },// optidx=26
{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=27
{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=28
{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=29
{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=30
{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=31
{"dpi-desync-badack-increment",required_argument,0,0},// optidx=32
{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=33
{"dpi-desync-fake-http",required_argument,0,0},// optidx=34
{"dpi-desync-fake-tls",required_argument,0,0},// optidx=35
{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=36
{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=37
{"dpi-desync-fake-quic",required_argument,0,0},// optidx=38
{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=39
{"dpi-desync-fake-dht",required_argument,0,0},// optidx=40
{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=41
{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=42
{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=43
{"dpi-desync-cutoff",required_argument,0,0},// optidx=44
{"dpi-desync-start",required_argument,0,0},// optidx=45
{"hostlist",required_argument,0,0}, // optidx=46
{"hostlist-exclude",required_argument,0,0}, // optidx=47
{"hostlist-auto",required_argument,0,0}, // optidx=48
{"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=49
{"hostlist-auto-fail-time",required_argument,0,0}, // optidx=50
{"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=51
{"hostlist-auto-debug",required_argument,0,0}, // optidx=52
{"new",no_argument,0,0}, // optidx=53
{"skip",no_argument,0,0}, // optidx=54
{"filter-l3",required_argument,0,0}, // optidx=55
{"filter-tcp",required_argument,0,0}, // optidx=56
{"filter-udp",required_argument,0,0}, // optidx=57
{"filter-l7",required_argument,0,0}, // optidx=58
{"ipset",required_argument,0,0}, // optidx=59
{"ipset-exclude",required_argument,0,0},// optidx=60
{"dpi-desync-ttl",required_argument,0,0}, // optidx=16
{"dpi-desync-ttl6",required_argument,0,0}, // optidx=17
{"dpi-desync-autottl",optional_argument,0,0}, // optidx=18
{"dpi-desync-autottl6",optional_argument,0,0}, // optidx=19
{"dpi-desync-fooling",required_argument,0,0}, // optidx=20
{"dpi-desync-repeats",required_argument,0,0}, // optidx=21
{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=22
{"dpi-desync-split-pos",required_argument,0,0},// optidx=23
{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=24
{"dpi-desync-split-tls",required_argument,0,0 },// optidx=25
{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=26
{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=27
{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=28
{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=29
{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=30
{"dpi-desync-badack-increment",required_argument,0,0},// optidx=31
{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=32
{"dpi-desync-fake-http",required_argument,0,0},// optidx=33
{"dpi-desync-fake-tls",required_argument,0,0},// optidx=34
{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=35
{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=36
{"dpi-desync-fake-quic",required_argument,0,0},// optidx=37
{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=38
{"dpi-desync-fake-dht",required_argument,0,0},// optidx=39
{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=40
{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=41
{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=42
{"dpi-desync-cutoff",required_argument,0,0},// optidx=43
{"dpi-desync-start",required_argument,0,0},// optidx=43
{"hostlist",required_argument,0,0}, // optidx=44
{"hostlist-exclude",required_argument,0,0}, // optidx=45
{"hostlist-auto",required_argument,0,0}, // optidx=46
{"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=48
{"hostlist-auto-fail-time",required_argument,0,0}, // optidx=49
{"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=50
{"hostlist-auto-debug",required_argument,0,0}, // optidx=51
{"new",no_argument,0,0}, // optidx=52
{"filter-l3",required_argument,0,0}, // optidx=53
{"filter-tcp",required_argument,0,0}, // optidx=54
{"filter-udp",required_argument,0,0}, // optidx=55
{"filter-l7",required_argument,0,0}, // optidx=56
{"ipset",required_argument,0,0}, // optidx=57
{"ipset-exclude",required_argument,0,0},// optidx=58
#ifdef __linux__
{"bind-fix4",no_argument,0,0}, // optidx=61
{"bind-fix6",no_argument,0,0}, // optidx=62
{"bind-fix4",no_argument,0,0}, // optidx=59
{"bind-fix6",no_argument,0,0}, // optidx=60
#elif defined(__CYGWIN__)
{"wf-iface",required_argument,0,0}, // optidx=61
{"wf-l3",required_argument,0,0}, // optidx=62
{"wf-tcp",required_argument,0,0}, // optidx=63
{"wf-udp",required_argument,0,0}, // optidx=64
{"wf-raw",required_argument,0,0}, // optidx=65
{"wf-save",required_argument,0,0}, // optidx=66
{"ssid-filter",required_argument,0,0}, // optidx=67
{"nlm-filter",required_argument,0,0}, // optidx=68
{"nlm-list",optional_argument,0,0}, // optidx=69
{"wf-iface",required_argument,0,0}, // optidx=59
{"wf-l3",required_argument,0,0}, // optidx=60
{"wf-tcp",required_argument,0,0}, // optidx=61
{"wf-udp",required_argument,0,0}, // optidx=62
{"wf-raw",required_argument,0,0}, // optidx=63
{"wf-save",required_argument,0,0}, // optidx=64
{"ssid-filter",required_argument,0,0}, // optidx=65
{"nlm-filter",required_argument,0,0}, // optidx=66
{"nlm-list",optional_argument,0,0}, // optidx=67
#endif
{NULL,0,NULL,0}
};
@ -1426,25 +1422,12 @@ int main(int argc, char **argv)
memcpy(dp->hostspell, optarg, 4);
break;
case 12: /* hostnospace */
if (dp->methodeol)
{
DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
exit_clean(1);
}
dp->hostnospace = true;
break;
case 13: /* domcase */
dp->domcase = true;
break;
case 14: /* methodeol */
if (dp->hostnospace)
{
DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
exit_clean(1);
}
dp->methodeol = true;
break;
case 15: /* dpi-desync */
case 14: /* dpi-desync */
{
char *mode=optarg,*mode2,*mode3;
mode2 = mode ? strchr(mode,',') : NULL;
@ -1490,7 +1473,7 @@ int main(int argc, char **argv)
}
break;
#ifndef __CYGWIN__
case 16: /* dpi-desync-fwmark/dpi-desync-sockarg */
case 15: /* dpi-desync-fwmark/dpi-desync-sockarg */
#if defined(__linux__) || defined(SO_USER_COOKIE)
params.desync_fwmark = 0;
if (sscanf(optarg, "0x%X", &params.desync_fwmark)<=0) sscanf(optarg, "%u", &params.desync_fwmark);
@ -1505,27 +1488,27 @@ int main(int argc, char **argv)
#endif
break;
#endif
case 17: /* dpi-desync-ttl */
case 16: /* dpi-desync-ttl */
dp->desync_ttl = (uint8_t)atoi(optarg);
break;
case 18: /* dpi-desync-ttl6 */
case 17: /* dpi-desync-ttl6 */
dp->desync_ttl6 = (uint8_t)atoi(optarg);
break;
case 19: /* dpi-desync-autottl */
case 18: /* dpi-desync-autottl */
if (!parse_autottl(optarg, &dp->desync_autottl))
{
DLOG_ERR("dpi-desync-autottl value error\n");
exit_clean(1);
}
break;
case 20: /* dpi-desync-autottl6 */
case 19: /* dpi-desync-autottl6 */
if (!parse_autottl(optarg, &dp->desync_autottl6))
{
DLOG_ERR("dpi-desync-autottl6 value error\n");
exit_clean(1);
}
break;
case 21: /* dpi-desync-fooling */
case 20: /* dpi-desync-fooling */
{
char *e,*p = optarg;
while (p)
@ -1560,17 +1543,17 @@ int main(int argc, char **argv)
}
}
break;
case 22: /* dpi-desync-repeats */
case 21: /* dpi-desync-repeats */
if (sscanf(optarg,"%u",&dp->desync_repeats)<1 || !dp->desync_repeats || dp->desync_repeats>20)
{
DLOG_ERR("dpi-desync-repeats must be within 1..20\n");
exit_clean(1);
}
break;
case 23: /* dpi-desync-skip-nosni */
case 22: /* dpi-desync-skip-nosni */
dp->desync_skip_nosni = !optarg || atoi(optarg);
break;
case 24: /* dpi-desync-split-pos */
case 23: /* dpi-desync-split-pos */
{
int ct;
if (!parse_split_pos_list(optarg,dp->splits+dp->split_count,MAX_SPLITS-dp->split_count,&ct))
@ -1581,7 +1564,7 @@ int main(int argc, char **argv)
dp->split_count += ct;
}
break;
case 25: /* dpi-desync-split-http-req */
case 24: /* dpi-desync-split-http-req */
// obsolete arg
DLOG_CONDUP("WARNING ! --dpi-desync-split-http-req is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
if (dp->split_count>=MAX_SPLITS)
@ -1596,7 +1579,7 @@ int main(int argc, char **argv)
}
dp->split_count++;
break;
case 26: /* dpi-desync-split-tls */
case 25: /* dpi-desync-split-tls */
// obsolete arg
DLOG_CONDUP("WARNING ! --dpi-desync-split-tls is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
if (dp->split_count>=MAX_SPLITS)
@ -1611,7 +1594,7 @@ int main(int argc, char **argv)
}
dp->split_count++;
break;
case 27: /* dpi-desync-split-seqovl */
case 26: /* dpi-desync-split-seqovl */
if (!strcmp(optarg,"0"))
{
// allow zero = disable seqovl
@ -1624,7 +1607,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 28: /* dpi-desync-split-seqovl-pattern */
case 27: /* dpi-desync-split-seqovl-pattern */
{
char buf[sizeof(dp->seqovl_pattern)];
size_t sz=sizeof(buf);
@ -1632,7 +1615,7 @@ int main(int argc, char **argv)
fill_pattern(dp->seqovl_pattern,sizeof(dp->seqovl_pattern),buf,sz);
}
break;
case 29: /* dpi-desync-ipfrag-pos-tcp */
case 28: /* dpi-desync-ipfrag-pos-tcp */
if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_tcp)<1 || dp->desync_ipfrag_pos_tcp<1 || dp->desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
{
DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@ -1644,7 +1627,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 30: /* dpi-desync-ipfrag-pos-udp */
case 29: /* dpi-desync-ipfrag-pos-udp */
if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_udp)<1 || dp->desync_ipfrag_pos_udp<1 || dp->desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
{
DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@ -1656,63 +1639,63 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 31: /* dpi-desync-badseq-increments */
case 30: /* dpi-desync-badseq-increments */
if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment))
{
DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
exit_clean(1);
}
break;
case 32: /* dpi-desync-badack-increment */
case 31: /* dpi-desync-badack-increment */
if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment))
{
DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
exit_clean(1);
}
break;
case 33: /* dpi-desync-any-protocol */
case 32: /* dpi-desync-any-protocol */
dp->desync_any_proto = !optarg || atoi(optarg);
break;
case 34: /* dpi-desync-fake-http */
case 33: /* dpi-desync-fake-http */
dp->fake_http_size = sizeof(dp->fake_http);
load_file_or_exit(optarg,dp->fake_http,&dp->fake_http_size);
break;
case 35: /* dpi-desync-fake-tls */
case 34: /* dpi-desync-fake-tls */
dp->fake_tls_size = sizeof(dp->fake_tls);
load_file_or_exit(optarg,dp->fake_tls,&dp->fake_tls_size);
break;
case 36: /* dpi-desync-fake-unknown */
case 35: /* dpi-desync-fake-unknown */
dp->fake_unknown_size = sizeof(dp->fake_unknown);
load_file_or_exit(optarg,dp->fake_unknown,&dp->fake_unknown_size);
break;
case 37: /* dpi-desync-fake-syndata */
case 36: /* dpi-desync-fake-syndata */
dp->fake_syndata_size = sizeof(dp->fake_syndata);
load_file_or_exit(optarg,dp->fake_syndata,&dp->fake_syndata_size);
break;
case 38: /* dpi-desync-fake-quic */
case 37: /* dpi-desync-fake-quic */
dp->fake_quic_size = sizeof(dp->fake_quic);
load_file_or_exit(optarg,dp->fake_quic,&dp->fake_quic_size);
break;
case 39: /* dpi-desync-fake-wireguard */
case 38: /* dpi-desync-fake-wireguard */
dp->fake_wg_size = sizeof(dp->fake_wg);
load_file_or_exit(optarg,dp->fake_wg,&dp->fake_wg_size);
break;
case 40: /* dpi-desync-fake-dht */
case 39: /* dpi-desync-fake-dht */
dp->fake_dht_size = sizeof(dp->fake_dht);
load_file_or_exit(optarg,dp->fake_dht,&dp->fake_dht_size);
break;
case 41: /* dpi-desync-fake-unknown-udp */
case 40: /* dpi-desync-fake-unknown-udp */
dp->fake_unknown_udp_size = sizeof(dp->fake_unknown_udp);
load_file_or_exit(optarg,dp->fake_unknown_udp,&dp->fake_unknown_udp_size);
break;
case 42: /* dpi-desync-udplen-increment */
case 41: /* dpi-desync-udplen-increment */
if (sscanf(optarg,"%d",&dp->udplen_increment)<1 || dp->udplen_increment>0x7FFF || dp->udplen_increment<-0x8000)
{
DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
exit_clean(1);
}
break;
case 43: /* dpi-desync-udplen-pattern */
case 42: /* dpi-desync-udplen-pattern */
{
char buf[sizeof(dp->udplen_pattern)];
size_t sz=sizeof(buf);
@ -1720,35 +1703,35 @@ int main(int argc, char **argv)
fill_pattern(dp->udplen_pattern,sizeof(dp->udplen_pattern),buf,sz);
}
break;
case 44: /* desync-cutoff */
case 43: /* desync-cutoff */
if (!parse_cutoff(optarg, &dp->desync_cutoff, &dp->desync_cutoff_mode))
{
DLOG_ERR("invalid desync-cutoff value\n");
exit_clean(1);
}
break;
case 45: /* desync-start */
case 44: /* desync-start */
if (!parse_cutoff(optarg, &dp->desync_start, &dp->desync_start_mode))
{
DLOG_ERR("invalid desync-start value\n");
exit_clean(1);
}
break;
case 46: /* hostlist */
case 45: /* hostlist */
if (!RegisterHostlist(dp, false, optarg))
{
DLOG_ERR("failed to register hostlist '%s'\n", optarg);
exit_clean(1);
}
break;
case 47: /* hostlist-exclude */
case 46: /* hostlist-exclude */
if (!RegisterHostlist(dp, true, optarg))
{
DLOG_ERR("failed to register hostlist '%s'\n", optarg);
exit_clean(1);
}
break;
case 48: /* hostlist-auto */
case 47: /* hostlist-auto */
if (dp->hostlist_auto)
{
DLOG_ERR("only one auto hostlist per profile is supported\n");
@ -1775,7 +1758,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 49: /* hostlist-auto-fail-threshold */
case 48: /* hostlist-auto-fail-threshold */
dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
{
@ -1783,7 +1766,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 50: /* hostlist-auto-fail-time */
case 49: /* hostlist-auto-fail-time */
dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_time<1)
{
@ -1791,7 +1774,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 51: /* hostlist-auto-retrans-threshold */
case 50: /* hostlist-auto-retrans-threshold */
dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10)
{
@ -1799,7 +1782,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 52: /* hostlist-auto-debug */
case 51: /* hostlist-auto-debug */
{
FILE *F = fopen(optarg,"a+t");
if (!F)
@ -1813,37 +1796,23 @@ int main(int argc, char **argv)
}
break;
case 53: /* new */
if (bSkip)
case 52: /* new */
if (!(dpl = dp_list_add(&params.desync_profiles)))
{
dp_clear(dp);
dp_init(dp);
dp->n = desync_profile_count;
bSkip = false;
}
else
{
if (!(dpl = dp_list_add(&params.desync_profiles)))
{
DLOG_ERR("desync_profile_add: out of memory\n");
exit_clean(1);
}
dp = &dpl->dp;
dp->n = ++desync_profile_count;
DLOG_ERR("desync_profile_add: out of memory\n");
exit_clean(1);
}
dp = &dpl->dp;
dp->n = ++desync_profile_count;
break;
case 54: /* skip */
bSkip = true;
break;
case 55: /* filter-l3 */
case 53: /* filter-l3 */
if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
{
DLOG_ERR("bad value for --filter-l3\n");
exit_clean(1);
}
break;
case 56: /* filter-tcp */
case 54: /* filter-tcp */
if (!parse_pf_list(optarg,&dp->pf_tcp))
{
DLOG_ERR("Invalid port filter : %s\n",optarg);
@ -1853,7 +1822,7 @@ int main(int argc, char **argv)
if (!port_filters_deny_if_empty(&dp->pf_udp))
exit_clean(1);
break;
case 57: /* filter-udp */
case 55: /* filter-udp */
if (!parse_pf_list(optarg,&dp->pf_udp))
{
DLOG_ERR("Invalid port filter : %s\n",optarg);
@ -1863,21 +1832,21 @@ int main(int argc, char **argv)
if (!port_filters_deny_if_empty(&dp->pf_tcp))
exit_clean(1);
break;
case 58: /* filter-l7 */
case 56: /* filter-l7 */
if (!parse_l7_list(optarg,&dp->filter_l7))
{
DLOG_ERR("Invalid l7 filter : %s\n",optarg);
exit_clean(1);
}
break;
case 59: /* ipset */
case 57: /* ipset */
if (!RegisterIpset(dp, false, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
exit_clean(1);
}
break;
case 60: /* ipset-exclude */
case 58: /* ipset-exclude */
if (!RegisterIpset(dp, true, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1888,28 +1857,28 @@ int main(int argc, char **argv)
#ifdef __linux__
case 61: /* bind-fix4 */
case 59: /* bind-fix4 */
params.bind_fix4 = true;
break;
case 62: /* bind-fix6 */
case 60: /* bind-fix6 */
params.bind_fix6 = true;
break;
#elif defined(__CYGWIN__)
case 61: /* wf-iface */
case 59: /* wf-iface */
if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
{
DLOG_ERR("bad value for --wf-iface\n");
exit_clean(1);
}
break;
case 62: /* wf-l3 */
case 60: /* wf-l3 */
if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
{
DLOG_ERR("bad value for --wf-l3\n");
exit_clean(1);
}
break;
case 63: /* wf-tcp */
case 61: /* wf-tcp */
hash_wf_tcp=hash_jen(optarg,strlen(optarg));
if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
@ -1918,7 +1887,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 64: /* wf-udp */
case 62: /* wf-udp */
hash_wf_udp=hash_jen(optarg,strlen(optarg));
if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
@ -1927,7 +1896,7 @@ int main(int argc, char **argv)
exit_clean(1);
}
break;
case 65: /* wf-raw */
case 63: /* wf-raw */
hash_wf_raw=hash_jen(optarg,strlen(optarg));
if (optarg[0]=='@')
{
@ -1941,11 +1910,11 @@ int main(int argc, char **argv)
windivert_filter[sizeof(windivert_filter) - 1] = '\0';
}
break;
case 66: /* wf-save */
case 64: /* wf-save */
strncpy(wf_save_file, optarg, sizeof(wf_save_file));
wf_save_file[sizeof(wf_save_file) - 1] = '\0';
break;
case 67: /* ssid-filter */
case 65: /* ssid-filter */
hash_ssid_filter=hash_jen(optarg,strlen(optarg));
{
char *e,*p = optarg;
@ -1963,7 +1932,7 @@ int main(int argc, char **argv)
}
}
break;
case 68: /* nlm-filter */
case 66: /* nlm-filter */
hash_nlm_filter=hash_jen(optarg,strlen(optarg));
{
char *e,*p = optarg;
@ -1981,7 +1950,7 @@ int main(int argc, char **argv)
}
}
break;
case 69: /* nlm-list */
case 67: /* nlm-list */
if (!nlm_list(optarg && !strcmp(optarg,"all")))
{
DLOG_ERR("could not get list of NLM networks\n");
@ -1992,12 +1961,6 @@ int main(int argc, char **argv)
#endif
}
}
if (bSkip)
{
LIST_REMOVE(dpl,next);
dp_entry_destroy(dpl);
desync_profile_count--;
}
// do not need args from file anymore
#if !defined( __OpenBSD__) && !defined(__ANDROID__)

97
nfq/params.c
View File

@ -170,49 +170,45 @@ void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
if (bcut) DLOG(" ...");
}
void dp_init(struct desync_profile *dp)
{
LIST_INIT(&dp->hl_collection);
LIST_INIT(&dp->hl_collection_exclude);
LIST_INIT(&dp->ips_collection);
LIST_INIT(&dp->ips_collection_exclude);
LIST_INIT(&dp->pf_tcp);
LIST_INIT(&dp->pf_udp);
memcpy(dp->hostspell, "host", 4); // default hostspell
dp->desync_skip_nosni = true;
dp->desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
dp->desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
dp->desync_repeats = 1;
dp->fake_tls_size = sizeof(fake_tls_clienthello_default);
memcpy(dp->fake_tls,fake_tls_clienthello_default,dp->fake_tls_size);
randomize_default_tls_payload(dp->fake_tls);
dp->fake_http_size = strlen(fake_http_request_default);
memcpy(dp->fake_http,fake_http_request_default,dp->fake_http_size);
dp->fake_quic_size = 620; // must be 601+ for TSPU hack
dp->fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
dp->fake_wg_size = 64;
dp->fake_dht_size = 64;
dp->fake_unknown_size = 256;
dp->fake_syndata_size = 16;
dp->fake_unknown_udp_size = 64;
dp->wscale=-1; // default - dont change scale factor (client)
dp->desync_ttl6 = 0xFF; // unused
dp->desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
dp->desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
dp->wssize_cutoff_mode = dp->desync_start_mode = dp->desync_cutoff_mode = 'n'; // packet number by default
dp->udplen_increment = UDPLEN_INCREMENT_DEFAULT;
dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
dp->hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
dp->filter_ipv4 = dp->filter_ipv6 = true;
}
struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
{
struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
if (!entry) return NULL;
dp_init(&entry->dp);
LIST_INIT(&entry->dp.hl_collection);
LIST_INIT(&entry->dp.hl_collection_exclude);
LIST_INIT(&entry->dp.ips_collection);
LIST_INIT(&entry->dp.ips_collection_exclude);
LIST_INIT(&entry->dp.pf_tcp);
LIST_INIT(&entry->dp.pf_udp);
memcpy(entry->dp.hostspell, "host", 4); // default hostspell
entry->dp.desync_skip_nosni = true;
entry->dp.desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
entry->dp.desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
entry->dp.desync_repeats = 1;
entry->dp.fake_tls_size = sizeof(fake_tls_clienthello_default);
memcpy(entry->dp.fake_tls,fake_tls_clienthello_default,entry->dp.fake_tls_size);
randomize_default_tls_payload(entry->dp.fake_tls);
entry->dp.fake_http_size = strlen(fake_http_request_default);
memcpy(entry->dp.fake_http,fake_http_request_default,entry->dp.fake_http_size);
entry->dp.fake_quic_size = 620; // must be 601+ for TSPU hack
entry->dp.fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
entry->dp.fake_wg_size = 64;
entry->dp.fake_dht_size = 64;
entry->dp.fake_unknown_size = 256;
entry->dp.fake_syndata_size = 16;
entry->dp.fake_unknown_udp_size = 64;
entry->dp.wscale=-1; // default - dont change scale factor (client)
entry->dp.desync_ttl6 = 0xFF; // unused
entry->dp.desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
entry->dp.desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
entry->dp.wssize_cutoff_mode = entry->dp.desync_start_mode = entry->dp.desync_cutoff_mode = 'n'; // packet number by default
entry->dp.udplen_increment = UDPLEN_INCREMENT_DEFAULT;
entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
entry->dp.hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
// add to the tail
struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
@ -226,24 +222,15 @@ struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
return entry;
}
static void dp_clear_dynamic(struct desync_profile *dp)
static void dp_entry_destroy(struct desync_profile_list *entry)
{
hostlist_collection_destroy(&dp->hl_collection);
hostlist_collection_destroy(&dp->hl_collection_exclude);
ipset_collection_destroy(&dp->ips_collection);
ipset_collection_destroy(&dp->ips_collection_exclude);
port_filters_destroy(&dp->pf_tcp);
port_filters_destroy(&dp->pf_udp);
HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
}
void dp_clear(struct desync_profile *dp)
{
dp_clear_dynamic(dp);
memset(dp,0,sizeof(*dp));
}
void dp_entry_destroy(struct desync_profile_list *entry)
{
dp_clear_dynamic(&entry->dp);
hostlist_collection_destroy(&entry->dp.hl_collection);
hostlist_collection_destroy(&entry->dp.hl_collection_exclude);
ipset_collection_destroy(&entry->dp.ips_collection);
ipset_collection_destroy(&entry->dp.ips_collection_exclude);
port_filters_destroy(&entry->dp.pf_tcp);
port_filters_destroy(&entry->dp.pf_udp);
HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
free(entry);
}
void dp_list_destroy(struct desync_profile_list_head *head)

5
nfq/params.h
View File

@ -51,7 +51,7 @@ struct desync_profile
char wssize_cutoff_mode; // n - packets, d - data packets, s - relative sequence
unsigned int wssize_cutoff;
bool hostcase, hostnospace, domcase, methodeol;
bool hostcase, hostnospace, domcase;
char hostspell[4];
enum dpi_desync_mode desync_mode0,desync_mode,desync_mode2;
bool desync_retrans,desync_skip_nosni,desync_any_proto;
@ -99,11 +99,8 @@ struct desync_profile_list {
};
LIST_HEAD(desync_profile_list_head, desync_profile_list);
struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
void dp_entry_destroy(struct desync_profile_list *entry);
void dp_list_destroy(struct desync_profile_list_head *head);
bool dp_list_have_autohostlist(struct desync_profile_list_head *head);
void dp_init(struct desync_profile *dp);
void dp_clear(struct desync_profile *dp);
struct params_s
{

47
tpws/params.c
View File

@ -155,26 +155,22 @@ void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
if (bcut) VPRINT(" ...");
}
void dp_init(struct desync_profile *dp)
{
LIST_INIT(&dp->hl_collection);
LIST_INIT(&dp->hl_collection_exclude);
LIST_INIT(&dp->ips_collection);
LIST_INIT(&dp->ips_collection_exclude);
LIST_INIT(&dp->pf_tcp);
dp->filter_ipv4 = dp->filter_ipv6 = true;
memcpy(dp->hostspell, "host", 4); // default hostspell
dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
}
struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
{
struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
if (!entry) return NULL;
dp_init(&entry->dp);
LIST_INIT(&entry->dp.hl_collection);
LIST_INIT(&entry->dp.hl_collection_exclude);
LIST_INIT(&entry->dp.ips_collection);
LIST_INIT(&entry->dp.ips_collection_exclude);
LIST_INIT(&entry->dp.pf_tcp);
entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
memcpy(entry->dp.hostspell, "host", 4); // default hostspell
entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
// add to the tail
struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
@ -188,23 +184,14 @@ struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
return entry;
}
static void dp_clear_dynamic(struct desync_profile *dp)
static void dp_entry_destroy(struct desync_profile_list *entry)
{
hostlist_collection_destroy(&dp->hl_collection);
hostlist_collection_destroy(&dp->hl_collection_exclude);
ipset_collection_destroy(&dp->ips_collection);
ipset_collection_destroy(&dp->ips_collection_exclude);
port_filters_destroy(&dp->pf_tcp);
HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
}
void dp_clear(struct desync_profile *dp)
{
dp_clear_dynamic(dp);
memset(dp,0,sizeof(*dp));
}
void dp_entry_destroy(struct desync_profile_list *entry)
{
dp_clear_dynamic(&entry->dp);
hostlist_collection_destroy(&entry->dp.hl_collection);
hostlist_collection_destroy(&entry->dp.hl_collection_exclude);
ipset_collection_destroy(&entry->dp.ips_collection);
ipset_collection_destroy(&entry->dp.ips_collection_exclude);
port_filters_destroy(&entry->dp.pf_tcp);
HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
free(entry);
}
void dp_list_destroy(struct desync_profile_list_head *head)

3
tpws/params.h
View File

@ -83,10 +83,7 @@ struct desync_profile_list {
};
LIST_HEAD(desync_profile_list_head, desync_profile_list);
struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
void dp_entry_destroy(struct desync_profile_list *entry);
void dp_list_destroy(struct desync_profile_list_head *head);
void dp_init(struct desync_profile *dp);
void dp_clear(struct desync_profile *dp);
struct params_s
{

79
tpws/tpws.c
View File

@ -177,7 +177,6 @@ static void exithelp(void)
" --debug-level=0|1|2\t\t\t; specify debug level\n"
"\nMULTI-STRATEGY:\n"
" --new\t\t\t\t\t; begin new strategy\n"
" --skip\t\t\t\t\t; do not use this strategy\n"
" --filter-l3=ipv4|ipv6\t\t\t; L3 protocol filter. multiple comma separated values allowed.\n"
" --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n"
" --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n"
@ -525,7 +524,6 @@ void parse_params(int argc, char *argv[])
{
int option_index = 0;
int v, i;
bool bSkip=false;
memset(&params, 0, sizeof(params));
params.maxconn = DEFAULT_MAX_CONN;
@ -632,25 +630,24 @@ void parse_params(int argc, char *argv[])
{ "connect-bind-addr",required_argument,0,0 },// optidx=55
{ "new",no_argument,0,0 }, // optidx=56
{ "skip",no_argument,0,0 }, // optidx=57
{ "filter-l3",required_argument,0,0 }, // optidx=58
{ "filter-tcp",required_argument,0,0 }, // optidx=59
{ "filter-l7",required_argument,0,0 }, // optidx=60
{ "ipset",required_argument,0,0 }, // optidx=61
{ "ipset-exclude",required_argument,0,0 }, // optidx=62
{ "filter-l3",required_argument,0,0 }, // optidx=57
{ "filter-tcp",required_argument,0,0 }, // optidx=58
{ "filter-l7",required_argument,0,0 }, // optidx=59
{ "ipset",required_argument,0,0 }, // optidx=60
{ "ipset-exclude",required_argument,0,0 }, // optidx=61
#if defined(__FreeBSD__)
{ "enable-pf",no_argument,0,0 },// optidx=62
#elif defined(__APPLE__)
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=62
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=63
#elif defined(__linux__)
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64
{ "mss",required_argument,0,0 }, // optidx=65
{ "fix-seg",optional_argument,0,0 }, // optidx=66
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=62
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=63
{ "mss",required_argument,0,0 }, // optidx=64
{ "fix-seg",optional_argument,0,0 }, // optidx=65
#ifdef SPLICE_PRESENT
{ "nosplice",no_argument,0,0 }, // optidx=67
{ "nosplice",no_argument,0,0 }, // optidx=66
#endif
#endif
{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@ -1163,49 +1160,36 @@ void parse_params(int argc, char *argv[])
case 56: /* new */
if (bSkip)
if (!(dpl = dp_list_add(&params.desync_profiles)))
{
dp_clear(dp);
dp_init(dp);
dp->n = desync_profile_count;
bSkip = false;
}
else
{
if (!(dpl = dp_list_add(&params.desync_profiles)))
{
DLOG_ERR("desync_profile_add: out of memory\n");
exit_clean(1);
}
dp = &dpl->dp;
dp->n = ++desync_profile_count;
DLOG_ERR("desync_profile_add: out of memory\n");
exit_clean(1);
}
dp = &dpl->dp;
dp->n = ++desync_profile_count;
break;
case 57: /* skip */
bSkip = true;
break;
case 58: /* filter-l3 */
case 57: /* filter-l3 */
if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
{
DLOG_ERR("bad value for --filter-l3\n");
exit_clean(1);
}
break;
case 59: /* filter-tcp */
case 58: /* filter-tcp */
if (!parse_pf_list(optarg,&dp->pf_tcp))
{
DLOG_ERR("Invalid port filter : %s\n",optarg);
exit_clean(1);
}
break;
case 60: /* filter-l7 */
case 59: /* filter-l7 */
if (!parse_l7_list(optarg,&dp->filter_l7))
{
DLOG_ERR("Invalid l7 filter : %s\n",optarg);
exit_clean(1);
}
break;
case 61: /* ipset */
case 60: /* ipset */
if (!RegisterIpset(dp, false, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1213,7 +1197,7 @@ void parse_params(int argc, char *argv[])
}
params.tamper = true;
break;
case 62: /* ipset-exclude */
case 61: /* ipset-exclude */
if (!RegisterIpset(dp, true, optarg))
{
DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1223,11 +1207,11 @@ void parse_params(int argc, char *argv[])
break;
#if defined(__FreeBSD__)
case 63: /* enable-pf */
case 62: /* enable-pf */
params.pf_enable = true;
break;
#elif defined(__linux__) || defined(__APPLE__)
case 63: /* local-tcp-user-timeout */
case 62: /* local-tcp-user-timeout */
params.tcp_user_timeout_local = atoi(optarg);
if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
{
@ -1235,7 +1219,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 64: /* remote-tcp-user-timeout */
case 63: /* remote-tcp-user-timeout */
params.tcp_user_timeout_remote = atoi(optarg);
if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
{
@ -1246,7 +1230,7 @@ void parse_params(int argc, char *argv[])
#endif
#if defined(__linux__)
case 65: /* mss */
case 64: /* mss */
// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
dp->mss = atoi(optarg);
if (dp->mss<88 || dp->mss>32767)
@ -1255,7 +1239,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1);
}
break;
case 66: /* fix-seg */
case 65: /* fix-seg */
if (!params.fix_seg_avail)
{
DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
@ -1275,20 +1259,13 @@ void parse_params(int argc, char *argv[])
params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
break;
#ifdef SPLICE_PRESENT
case 67: /* nosplice */
case 66: /* nosplice */
params.nosplice = true;
break;
#endif
#endif
}
}
if (bSkip)
{
LIST_REMOVE(dpl,next);
dp_entry_destroy(dpl);
desync_profile_count--;
}
if (!params.bind_wait_only && !params.port)
{
DLOG_ERR("Need port number\n");

3
tpws/tpws_conn.c
View File

@ -485,7 +485,7 @@ static bool connect_remote_conn(tproxy_conn_t *conn)
apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
if (conn->track.dp && conn->track.dp->mss)
if (conn->track.dp)
{
mss = conn->track.dp->mss;
if (conn->track.dp->hostlist_auto)
@ -836,6 +836,7 @@ static bool proxy_mode_connect_remote(tproxy_conn_t *conn, struct tailhead *conn
return false;
}
if (!(conn->partner = new_conn(remote_fd, true)))
{
close(remote_fd);