nfqws,tpws: fix crash

github: build for Android

.github/workflows/build.yml

@@ -87,15 +87,14 @@ jobs:
           export LDFLAGS="-Os"
 
           # netfilter libs
-          git clone --depth 1 -b libmnl-1.0.5 git://git.netfilter.org/libmnl
-          git clone --depth 1 -b libnfnetlink-1.0.2 git://git.netfilter.org/libnfnetlink
-          git clone --depth 1 -b libnetfilter_queue-1.0.5 git://git.netfilter.org/libnetfilter_queue
+          wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libmnl/libmnl-1.0.5.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libnetfilter_queue/libnetfilter_queue-1.0.5.tar.bz2 | tar -xj
 
           for i in libmnl libnfnetlink libnetfilter_queue ; do
             (
-              cd $i
-              ./autogen.sh && \
-              ./configure --prefix= --host=$TARGET --enable-static --disable-shared && \
+              cd $i-*
+              ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
               make install -j$(nproc) DESTDIR=$DEPS_DIR
             )
             sed -i "s|^prefix=.*|prefix=$DEPS_DIR|g" $DEPS_DIR/lib/pkgconfig/$i.pc
@@ -106,7 +105,7 @@ jobs:
             xargs -I{} wget -qO- https://github.com/madler/zlib/archive/refs/tags/{}.tar.gz | tar -xz
           (
             cd zlib-*
-            ./configure --prefix= --static && \
+            ./configure --prefix= --static
             make install -j$(nproc) DESTDIR=$DEPS_DIR
           )
 
@@ -282,9 +281,77 @@ jobs:
           path: zapret-*.zip
           if-no-files-found: error
 
+  build-android:
+    name: Android ${{ matrix.abi }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - abi: armeabi-v7a
+            target: armv7a-linux-androideabi
+          - abi: arm64-v8a
+            target: aarch64-linux-android
+          - abi: x86
+            target: i686-linux-android
+          - abi: x86_64
+            target: x86_64-linux-android
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: zapret
+
+      - name: Build
+        env:
+          ABI: ${{ matrix.abi }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          DEPS_DIR=$GITHUB_WORKSPACE/deps
+          export TOOLCHAIN=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64
+          export API=21
+          export CC="$TOOLCHAIN/bin/clang --target=$TARGET$API"
+          export AR=$TOOLCHAIN/bin/llvm-ar
+          export AS=$CC
+          export LD=$TOOLCHAIN/bin/ld
+          export RANLIB=$TOOLCHAIN/bin/llvm-ranlib
+          export STRIP=$TOOLCHAIN/bin/llvm-strip
+          export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
+
+          # optimize for size
+          export CFLAGS="-Os -flto=auto"
+          export LDFLAGS="-Os"
+
+          # netfilter libs
+          wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libmnl/libmnl-1.0.5.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libnetfilter_queue/libnetfilter_queue-1.0.5.tar.bz2 | tar -xj
+          patch -p1 -d libnetfilter_queue-* -i ../zapret/.github/workflows/libnetfilter_queue-android.patch
+
+          for i in libmnl libnfnetlink libnetfilter_queue ; do
+            (
+              cd $i-*
+              CFLAGS="$CFLAGS -Wno-implicit-function-declaration" \
+              ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
+              make install -j$(nproc) DESTDIR=$DEPS_DIR
+            )
+            sed -i "s|^prefix=.*|prefix=$DEPS_DIR|g" $DEPS_DIR/lib/pkgconfig/$i.pc
+          done
+
+          # zapret
+          CFLAGS="$CFLAGS -I$DEPS_DIR/include" LDFLAGS="$LDFLAGS -L$DEPS_DIR/lib" \
+          make -C zapret android -j$(nproc)
+          zip zapret-android-$ABI.zip -j zapret/binaries/my/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: zapret-android-${{ matrix.abi }}
+          path: zapret-*.zip
+          if-no-files-found: error
+
   release:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-    needs: [ build-linux, build-windows, build-macos, build-freebsd ]
+    needs: [ build-linux, build-windows, build-macos, build-freebsd, build-android ]
     permissions:
       contents: write
     runs-on: ubuntu-latest
@@ -343,18 +410,22 @@ jobs:
             if [ -d $dir ]; then
               echo "Processing $dir"
               case $dir in
-                *-freebsd-x86_64 ) run_dir freebsd-x64 ;;
-                *-linux-arm )      run_dir arm ;;
-                *-linux-arm64 )    run_dir aarch64 ;;
-                *-linux-mips64 )   run_dir mips64r2-msb ;;
-                *-linux-mipselsf ) run_dir mips32r1-lsb ;;
-                *-linux-mipssf )   run_dir mips32r1-msb ;;
-                *-linux-ppc )      run_dir ppc ;;
-                *-linux-x86 )      run_dir x86 ;;
-                *-linux-x86_64 )   run_dir x86_64 ;;
-                *-mac-x64 )        run_dir mac64 ;;
-                *-win-x86 )        run_dir win32 ;;
-                *-win-x86_64 )     run_dir win64 ;;
+                *-android-arm64-v8a )   run_dir android-aarch64 ;;
+                *-android-armeabi-v7a ) run_dir android-arm ;;
+                *-android-x86 )         run_dir android-x86 ;;
+                *-android-x86_64 )      run_dir android-x86_64 ;;
+                *-freebsd-x86_64 )      run_dir freebsd-x64 ;;
+                *-linux-arm )           run_dir arm ;;
+                *-linux-arm64 )         run_dir aarch64 ;;
+                *-linux-mips64 )        run_dir mips64r2-msb ;;
+                *-linux-mipselsf )      run_dir mips32r1-lsb ;;
+                *-linux-mipssf )        run_dir mips32r1-msb ;;
+                *-linux-ppc )           run_dir ppc ;;
+                *-linux-x86 )           run_dir x86 ;;
+                *-linux-x86_64 )        run_dir x86_64 ;;
+                *-mac-x64 )             run_dir mac64 ;;
+                *-win-x86 )             run_dir win32 ;;
+                *-win-x86_64 )          run_dir win64 ;;
               esac
             fi
           done

.github/workflows/libnetfilter_queue-android.patch

@@ -0,0 +1,41 @@
+--- a/src/extra/pktbuff.c
++++ b/src/extra/pktbuff.c
+@@ -14,7 +14,7 @@
+ #include <string.h> /* for memcpy */
+ #include <stdbool.h>
+ 
+-#include <netinet/if_ether.h>
++#include <linux/if_ether.h>
+ #include <netinet/ip.h>
+ #include <netinet/tcp.h>
+ 
+--- a/src/nlmsg.c
++++ b/src/nlmsg.c
+@@ -21,7 +21,7 @@
+ 
+ #include <linux/netfilter/nfnetlink_queue.h>
+ 
+-#include <libnetfilter_queue/libnetfilter_queue.h>
++// #include <libnetfilter_queue/libnetfilter_queue.h>
+ 
+ #include "internal.h"
+ 
+--- a/src/extra/tcp.c
++++ b/src/extra/tcp.c
+@@ -139,12 +139,16 @@ void nfq_tcp_compute_checksum_ipv6(struc
+  *  (union is compatible to any of its members)
+  *  This means this part of the code is -fstrict-aliasing safe now.
+  */
++#ifndef __ANDROID__
+ union tcp_word_hdr {
+ 	struct tcphdr hdr;
+ 	uint32_t  words[5];
+ };
++#endif
+ 
++#ifndef tcp_flag_word
+ #define tcp_flag_word(tp) ( ((union tcp_word_hdr *)(tp))->words[3])
++#endif
+ 
+ /**
+  * nfq_pkt_snprintf_tcp_hdr - print tcp header into one buffer in a humnan

.gitignore

@@ -1,7 +1,9 @@
 /config
 ip2net/ip2net
 mdig/mdig
+nfq/dvtws
 nfq/nfqws
+nfq/winws.exe
 tpws/tpws
 binaries/my/
 init.d/**/custom

Makefile

@@ -15,6 +15,19 @@ all:	clean
 		done \
 	done
 
+android: clean
+	@mkdir -p "$(TGT)"; \
+	for dir in $(DIRS); do \
+		find "$$dir" -type f  \( -name "*.c" -o -name "*.h" -o -name "*akefile" \) -exec chmod -x {} \; ; \
+		$(MAKE) -C "$$dir" android || exit; \
+		for exe in "$$dir/"*; do \
+			if [ -f "$$exe" ] && [ -x "$$exe" ]; then \
+				mv -f "$$exe" "${TGT}" ; \
+				ln -fs "../${TGT}/$$(basename "$$exe")" "$$exe" ; \
+			fi \
+		done \
+	done
+
 bsd:	clean
 	@mkdir -p "$(TGT)"; \
 	for dir in $(DIRS); do \

blockcheck.sh

@@ -45,7 +45,6 @@ HTTP_PORT=${HTTP_PORT:-80}
 HTTPS_PORT=${HTTPS_PORT:-443}
 QUIC_PORT=${QUIC_PORT:-443}
 UNBLOCKED_DOM=${UNBLOCKED_DOM:-iana.org}
-[ "$CURL_VERBOSE" = 1 ] && CURL_CMD=1
 
 HDRTEMP=/tmp/zapret-hdr.txt
 
@@ -792,7 +791,7 @@ pktws_ipt_prepare()
 			# disable PF to avoid interferences
 			pf_is_avail && pfctl -qd
 			for ip in $3; do
-				IPFW_ADD divert $IPFW_DIVERT_PORT $1 from me to $ip $2 proto ip${IPV} out not diverted not sockarg
+				IPFW_ADD divert $IPFW_DIVERT_PORT $1 from me to $ip $2 proto ip${IPV} out not diverted
 			done
 			;;
 		opf)
@@ -867,7 +866,7 @@ pktws_ipt_prepare_tcp()
 			;;
 		ipfw)
 			for ip in $2; do
-				IPFW_ADD divert $IPFW_DIVERT_PORT tcp from $ip $1 to me proto ip${IPV} tcpflags syn,ack in not diverted not sockarg
+				IPFW_ADD divert $IPFW_DIVERT_PORT tcp from $ip $1 to me proto ip${IPV} tcpflags syn,ack in not diverted
 			done
 			;;
 	esac
@@ -994,7 +993,6 @@ ws_curl_test()
 	# $2 - test function
 	# $3 - domain
 	# $4,$5,$6, ... - ws params
-
 	local code ws_start=$1 testf=$2 dom=$3
 	shift
 	shift
@@ -1013,6 +1011,15 @@ tpws_curl_test()
 	echo - checking tpws $3 $4 $5 $6 $7 $8 $9${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}
 	local ALL_PROXY="socks5://127.0.0.1:$SOCKS_PORT"
 	ws_curl_test tpws_start "$@"${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}
+	local code=$?
+	[ "$code" = 0 ] && {
+		local testf=$1 dom=$2
+		shift; shift;
+		local strategy="$@"
+		strategy_append_extra_tpws
+		report_append "ipv${IPV} $dom $testf : tpws ${WF:+$WF }$strategy"
+	}
+	return $code
 }
 pktws_curl_test()
 {
@@ -1021,7 +1028,26 @@ pktws_curl_test()
 	# $3,$4,$5, ... - nfqws/dvtws params
 	echo - checking $PKTWSD ${WF:+$WF }$3 $4 $5 $6 $7 $8 $9${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}
 	ws_curl_test pktws_start "$@"${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}
+	local code=$?
+	[ "$code" = 0 ] && {
+		local testf=$1 dom=$2
+		shift; shift;
+		local strategy="$@"
+		strategy_append_extra_pktws
+		report_append "ipv${IPV} $dom $testf : $PKTWSD ${WF:+$WF }$strategy"
+	}
+	return $code
 }
+
+strategy_append_extra_pktws()
+{
+	strategy="${strategy:+$strategy${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}}"
+}
+strategy_append_extra_tpws()
+{
+	strategy="${strategy:+$strategy${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}}"
+}
+
 xxxws_curl_test_update()
 {
 	# $1 - xxx_curl_test function
@@ -1073,7 +1099,7 @@ report_strategy()
 		strategy="$(echo "$strategy" | xargs)"
 		echo "!!!!! $1: working strategy found for ipv${IPV} $2 : $3 $strategy !!!!!"
 		echo
-		report_append "ipv${IPV} $2 $1 : $3 ${WF:+$WF }$strategy"
+#		report_append "ipv${IPV} $2 $1 : $3 ${WF:+$WF }$strategy"
 		return 0
 	else
 		echo "$1: $3 strategy for ipv${IPV} $2 not found"
@@ -1088,7 +1114,7 @@ test_has_split()
 }
 test_has_fake()
 {
-	contains "$1" fake
+	[ "$1" = fake ] || starts_with "$1" fake,
 }
 warn_fool()
 {
@@ -1105,25 +1131,34 @@ pktws_curl_test_update_vary()
 	# $4 - desync mode
 	# $5,$6,... - strategy
 
-	local testf=$1 sec=$2 domain=$3 desync=$4 zerofake split fake
+	local testf=$1 sec=$2 domain=$3 desync=$4 proto zerofake= splits= pos fake ret=1
 	
 	shift; shift; shift; shift
 	
-	zerofake=http
-	[ "$sec" = 0 ] || zerofake=tls
-	zerofake="--dpi-desync-fake-$zerofake=0x00000000"
-	
+	proto=http
+	[ "$sec" = 0 ] || proto=tls
+	test_has_fake $desync && zerofake="--dpi-desync-fake-$proto=0x00000000"
+	test_has_split $desync && {
+		splits="method+2 midsld"
+		[ "$sec" = 0 ] || splits="1 midsld 1,midsld"
+	}
 	for fake in '' $zerofake ; do
-		for split in '' '--dpi-desync-split-pos=1' ; do
-			pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" $fake $split && return 0
-			# split-pos=1 is meaningful for DPIs searching for 16 03 in TLS. no reason to apply to http
-			[ "$sec" = 1 ] || break
-			test_has_split $desync || break
-		done
-		test_has_fake $desync || break
+		if [ -n "$splits" ]; then
+			for pos in $splits ; do
+				pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" --dpi-desync-split-pos=$pos $fake && {
+					[ "$SCANLEVEL" = force ] || return 0
+					ret=0
+				}
+			done
+		else
+			pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" $fake && {
+				[ "$SCANLEVEL" = force ] || return 0
+				ret=0
+			}
+		fi
 	done
 
-	return 1
+	return $ret
 }
 
 pktws_check_domain_http_bypass_()
@@ -1132,82 +1167,73 @@ pktws_check_domain_http_bypass_()
 	# $2 - encrypted test : 0 = plain, 1 - encrypted with server reply risk, 2 - encrypted without server reply risk
 	# $3 - domain
 
-	local tests='fake' ret ok ttls s f e desync pos fooling frag sec="$2" delta hostcase
+	local ok ttls s f f2 e desync pos fooling frag sec="$2" delta splits
+	local need_split need_disorder need_fakedsplit need_fakeddisorder need_fake need_wssize
+	local splits_http='method+2 midsld method+2,midsld'
+	local splits_tls='2 1 sniext+1 sniext+4 host+1 midsld 1,midsld 1,sniext+1,host+1,midsld-2,midsld,midsld+2,endhost-1'
 
 	[ "$sec" = 0 ] && {
-		for s in '--hostcase' '--hostspell=hoSt' '--hostnospace' '--domcase'; do
+		for s in '--hostcase' '--hostspell=hoSt' '--hostnospace' '--domcase' '--methodeol'; do
 			pktws_curl_test_update $1 $3 $s
 		done
 	}
 
-	s="--dpi-desync=split2"
-	ok=0
-	pktws_curl_test_update $1 $3 $s
-	ret=$?
-	[ "$ret" = 0 ] && {
-		[ "$SCANLEVEL" = quick ] && return
-		ok=1
-	}
-	[ "$ret" != 0 -o "$SCANLEVEL" = force ] && {
-		if [ "$sec" = 0 ]; then
-			pktws_curl_test_update $1 $3 $s --hostcase && {
-				[ "$SCANLEVEL" = quick ] && return
-				ok=1
-			}
-			for pos in method host; do
-				for hostcase in '' '--hostcase'; do
-					pktws_curl_test_update $1 $3 $s --dpi-desync-split-http-req=$pos $hostcase && {
-						[ "$SCANLEVEL" = quick ] && return
-						ok=1
-					}
-				done
-			done
-		else
-			for pos in sni sniext; do
-				pktws_curl_test_update $1 $3 $s --dpi-desync-split-tls=$pos && {
-					[ "$SCANLEVEL" = quick ] && return
-					ok=1
-				}
-			done
-		fi
-		for pos in 1 3 4 5 10 50; do
-			s="--dpi-desync=split2 --dpi-desync-split-pos=$pos"
-			if pktws_curl_test_update $1 $3 $s; then
-				[ "$SCANLEVEL" = quick ] && return
-				ok=1
-				[ "$SCANLEVEL" = force ] || break
-			elif [ "$sec" = 0 ]; then
-				pktws_curl_test_update $1 $3 $s --hostcase && [ "$SCANLEVEL" = quick ] && return
-			fi
-		done
-	}
-	[ "$ok" = 1 -a "$SCANLEVEL" != force ] || tests="$tests split fake,split2 fake,split"
-
-	pktws_curl_test_update $1 $3 --dpi-desync=disorder2
-	ret=$?
-	[ "$ret" = 0 -a "$SCANLEVEL" = quick ] && return
-	[ "$ret" != 0 -o "$SCANLEVEL" = force ] && {
-	    pktws_curl_test_update $1 $3 --dpi-desync=disorder2 --dpi-desync-split-pos=1
-	    ret=$?
-	    [ "$ret" = 0 -a "$SCANLEVEL" = quick ] && return
-	}
-	[ "$ret" != 0 -o "$SCANLEVEL" = force ] && tests="$tests disorder fake,disorder2 fake,disorder"
-
 	ttls=$(seq -s ' ' $MIN_TTL $MAX_TTL)
+	need_wssize=1
 	for e in '' '--wssize 1:6'; do
+		need_split=
+		need_disorder=
+
 		[ -n "$e" ] && {
 			pktws_curl_test_update $1 $3 $e && [ "$SCANLEVEL" = quick ] && return
-			for desync in split2 disorder2; do
-				pktws_curl_test_update_vary $1 $2 $3 $desync $e && [ "$SCANLEVEL" = quick ] && return
-			done
 		}
-		for desync in $tests; do
+
+		for desync in multisplit multidisorder; do
+			ok=0
+			splits="$splits_http"
+			[ "$sec" = 0 ] || splits="$splits_tls"
+			for pos in $splits; do
+				pktws_curl_test_update $1 $3 --dpi-desync=$desync --dpi-desync-split-pos=$pos $e && {
+					[ "$SCANLEVEL" = quick ] && return
+					ok=1
+					need_wssize=0
+					[ "$SCANLEVEL" = force ] || break
+				}
+			done
+			[ "$ok" = 1 -a "$SCANLEVEL" != force ] || {
+				case $desync in
+					multisplit)
+						need_split=1
+						;;
+					multidisorder)
+						need_disorder=1
+						;;
+				esac
+			}
+		done
+
+		need_fakedsplit=1
+		need_fakeddisorder=1
+		need_fake=1
+		for desync in fake ${need_split:+fakedsplit fake,multisplit fake,fakedsplit} ${need_disorder:+fakeddisorder fake,multidisorder fake,fakeddisorder}; do
+			[ "$need_fake" = 0 ] && test_has_fake "$desync" && continue
+			[ "$need_fakedsplit" = 0 ] && contains "$desync" fakedsplit && continue
+			[ "$need_fakeddisorder" = 0 ] && contains "$desync" fakeddisorder && continue
+			ok=0
 			for ttl in $ttls; do
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-ttl=$ttl $e && {
 					[ "$SCANLEVEL" = quick ] && return
+					ok=1
+					need_wssize=0
 					break
 				}
 			done
+			# only skip tests if TTL succeeded. do not skip if TTL failed but fooling succeeded
+			[ $ok = 1 -a "$SCANLEVEL" != force ] && {
+				[ "$desync" = fake ] && need_fake=0
+				[ "$desync" = fakedsplit ] && need_fakedsplit=0
+				[ "$desync" = fakeddisorder ] && need_fakeddisorder=0
+			}
 			f=
 			[ "$UNAME" = "OpenBSD" ] || f="badsum"
 			f="$f badseq datanoack md5sig"
@@ -1216,37 +1242,68 @@ pktws_check_domain_http_bypass_()
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-fooling=$fooling $e && {
 					warn_fool $fooling
 					[ "$SCANLEVEL" = quick ] && return
+					need_wssize=0
 				}
 			done
 		done
+
 		[ "$IPV" = 6 ] && {
-			f="hopbyhop hopbyhop,split2 hopbyhop,disorder2 destopt destopt,split2 destopt,disorder2"
-			[ -n "$IP6_DEFRAG_DISABLE" ] && f="$f ipfrag1 ipfrag1,split2 ipfrag1,disorder2"
+			f="hopbyhop ${need_split:+hopbyhop,multisplit} ${need_disorder:+hopbyhop,multidisorder} destopt ${need_split:+destopt,multisplit} ${need_disorder:+destopt,multidisorder}"
+			[ -n "$IP6_DEFRAG_DISABLE" ] && f="$f ipfrag1 ${need_split:+ ipfrag1,multisplit} ${need_disorder:+ ipfrag1,multidisorder}"
 			for desync in $f; do
-				pktws_curl_test_update_vary $1 $2 $3 $desync $e && [ "$SCANLEVEL" = quick ] && return
+				pktws_curl_test_update_vary $1 $2 $3 $desync $e && {
+					[ "$SCANLEVEL" = quick ] && return
+					need_wssize=0
+				}
 			done
 		}
 
-		for desync in split2 disorder2; do
-			s="--dpi-desync=$desync"
+		[ "$need_split" = 1 ] && {
+			# relative markers can be anywhere, even in subsequent packets. first packet can be MTU-full.
+			# make additional split pos "10" to guarantee enough space for seqovl and likely to be before midsld,sniext,...
+			# method is always expected in the beginning of the first packet
+			f="method+2 method+2,midsld"
+			[ "$sec" = 0 ] || f="10 10,sniext+1 10,sniext+4 10,midsld"
+			for pos in $f; do
+				pktws_curl_test_update $1 $3 --dpi-desync=multisplit --dpi-desync-split-pos=$pos --dpi-desync-split-seqovl=1 $e && {
+					[ "$SCANLEVEL" = quick ] && return
+					need_wssize=0
+				}
+			done
+			[ "$sec" != 0 ] && pktws_curl_test_update $1 $3 --dpi-desync=multisplit --dpi-desync-split-pos=2 --dpi-desync-split-seqovl=336 --dpi-desync-split-seqovl-pattern="$ZAPRET_BASE/files/fake/tls_clienthello_iana_org.bin" $e && {
+				[ "$SCANLEVEL" = quick ] && return
+				need_wssize=0
+			}
+		}
+		[ "$need_disorder" = 1 ] && {
 			if [ "$sec" = 0 ]; then
-				for pos in method host; do
-					pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=1 --dpi-desync-split-http-req=$pos $e && [ "$SCANLEVEL" = quick ] && return
+				for pos in 'method+1 method+2' 'midsld-1 midsld' 'method+1 method+2,midsld'; do
+					f="$(extract_arg 1 $pos)"
+					f2="$(extract_arg 2 $pos)"
+					pktws_curl_test_update $1 $3 --dpi-desync=multidisorder --dpi-desync-split-pos=$f2 --dpi-desync-split-seqovl=$f $e && {
+						[ "$SCANLEVEL" = quick ] && return
+						need_wssize=0
+					}
 				done
 			else
-				for pos in sni sniext; do
-					pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=1 --dpi-desync-split-tls=$pos $e && [ "$SCANLEVEL" = quick ] && return
+				for pos in '1 2' 'sniext sniext+1' 'sniext+3 sniext+4' 'midsld-1 midsld' '1 2,midsld'; do
+					f=$(extract_arg 1 $pos)
+					f2=$(extract_arg 2 $pos)
+					pktws_curl_test_update $1 $3 --dpi-desync=multidisorder --dpi-desync-split-pos=$f2 --dpi-desync-split-seqovl=$f $e && {
+						[ "$SCANLEVEL" = quick ] && return
+						need_wssize=0
+					}
 				done
 			fi
-			for pos in 2 3 4 5 10 50; do
-				pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=$(($pos - 1)) --dpi-desync-split-pos=$pos $e && [ "$SCANLEVEL" = quick ] && return
-			done
-			[ "$sec" != 0 -a $desync = split2 ] && {
-				pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=336 --dpi-desync-split-seqovl-pattern="$ZAPRET_BASE/files/fake/tls_clienthello_iana_org.bin" $e && [ "$SCANLEVEL" = quick ] && return
-			}
-		done
+		}
 
-		for desync in $tests; do
+		need_fakedsplit=1
+		need_fakeddisorder=1
+		need_fake=1
+		for desync in fake ${need_split:+fakedsplit fake,multisplit fake,fakedsplit} ${need_disorder:+fakeddisorder fake,multidisorder fake,fakeddisorder}; do
+			[ "$need_fake" = 0 ] && test_has_fake "$desync" && continue
+			[ "$need_fakedsplit" = 0 ] && contains "$desync" fakedsplit && continue
+			[ "$need_fakeddisorder" = 0 ] && contains "$desync" fakeddisorder && continue
 			ok=0
 			for delta in 1 2 3 4 5; do
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-ttl=1 --dpi-desync-autottl=$delta $e && ok=1
@@ -1256,18 +1313,25 @@ pktws_check_domain_http_bypass_()
 				echo "WARNING ! although autottl worked it requires testing on multiple domains to find out reliable delta"
 				echo "WARNING ! if a reliable delta cannot be found it's a good idea not to use autottl"
 				[ "$SCANLEVEL" = quick ] && return
+				need_wssize=0
+				[ "$SCANLEVEL" = force ] || {
+					[ "$desync" = fake ] && need_fake=0
+					[ "$desync" = fakedsplit ] && need_fakedsplit=0
+					[ "$desync" = fakeddisorder ] && need_fakeddisorder=0
+				}
 			}			
 		done
 
 		s="http_iana_org.bin"
 		[ "$sec" = 0 ] || s="tls_clienthello_iana_org.bin"
-		for desync in syndata syndata,split2 syndata,disorder2 ; do
+		for desync in syndata ${need_split:+syndata,multisplit} ${need_disorder:+syndata,multidisorder} ; do
 			pktws_curl_test_update_vary $1 $2 $3 $desync $e && [ "$SCANLEVEL" = quick ] && return
 			pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-fake-syndata="$ZAPRET_BASE/files/fake/$s" $e && [ "$SCANLEVEL" = quick ] && return
 		done
 
 		# do not do wssize test for http and TLS 1.3. it's useless
 		[ "$sec" = 1 ] || break
+		[ "$SCANLEVEL" = force -o "$need_wssize" = 1 ] || break
 	done
 }
 pktws_check_domain_http_bypass()
@@ -1278,7 +1342,7 @@ pktws_check_domain_http_bypass()
 
 	local strategy
 	pktws_check_domain_http_bypass_ "$@"
-	strategy="${strategy:+$strategy${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}}"
+	strategy_append_extra_pktws
 	report_strategy $1 $3 $PKTWSD
 }
 
@@ -1323,7 +1387,7 @@ pktws_check_domain_http3_bypass()
 
 	local strategy
 	pktws_check_domain_http3_bypass_ "$@"
-	strategy="${strategy:+$strategy $PKTWS_EXTRA $PKTWS_EXTRA_1 $PKTWS_EXTRA_2 $PKTWS_EXTRA_3 $PKTWS_EXTRA_4 $PKTWS_EXTRA_5 $PKTWS_EXTRA_6 $PKTWS_EXTRA_7 $PKTWS_EXTRA_8 $PKTWS_EXTRA_9}"
+	strategy_append_extra_pktws
 	report_strategy $1 $2 $PKTWSD
 }
 warn_mss()
@@ -1338,50 +1402,58 @@ tpws_check_domain_http_bypass_()
 	# $2 - encrypted test : 0 = plain, 1 - encrypted with server reply risk, 2 - encrypted without server reply risk
 	# $3 - domain
 
-	local s mss s2 s3 pos sec="$2"
+	local s mss s2 s3 oobdis pos sec="$2"
+	local splits_tls='2 1 sniext+1 sniext+4 host+1 midsld 1,midsld 1,sniext+1,host+1,midsld,endhost-1'
+	local splits_http='method+2 midsld method+2,midsld'
+
+	# simulteneous oob and disorder works properly only in linux. other systems retransmit oob byte without URG tcp flag and poison tcp stream.
+	[ "$UNAME" = Linux ] && oobdis='--oob --disorder'
 	if [ "$sec" = 0 ]; then
-		for s in '--hostcase' '--hostspell=hoSt' '--hostdot' '--hosttab' '--hostnospace' '--domcase' \
-			'--hostpad=1024' '--hostpad=2048' '--hostpad=4096' '--hostpad=8192' '--hostpad=16384' ; do
+		for s in '--hostcase' '--hostspell=hoSt' '--hostdot' '--hosttab' '--hostnospace' '--domcase' ; do
 			tpws_curl_test_update $1 $3 $s && [ "$SCANLEVEL" = quick ] && return
 		done
-		for s2 in '' '--oob' '--disorder' '--oob --disorder'; do
-			for s in '--split-http-req=method' '--split-http-req=method --hostcase' '--split-http-req=host' '--split-http-req=host --hostcase' ; do
-				tpws_curl_test_update $1 $3 $s $s2 && [ "$SCANLEVEL" = quick ] && return
+		for s in 1024 2048 4096 8192 16384 ; do
+			tpws_curl_test_update $1 $3 --hostpad=$s && [ "$SCANLEVEL" != force ] && {
+				[ "$SCANLEVEL" = quick ] && return
+				break
+			}
+		done
+		for s2 in '' '--hostcase' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
+			for s in $splits_http ; do
+				tpws_curl_test_update $1 $3 --split-pos=$s $s2 && [ "$SCANLEVEL" != force ] && {
+					[ "$SCANLEVEL" = quick ] && return
+					break
+				}
 			done
 		done
 		for s in  '--methodspace' '--unixeol' '--methodeol'; do
 			tpws_curl_test_update $1 $3 $s && [ "$SCANLEVEL" = quick ] && return
 		done
 	else
+		local need_mss=1
 		for mss in '' 88; do
 			s3=${mss:+--mss=$mss}
-			for s2 in '' '--oob' '--disorder' '--oob --disorder'; do
-				for pos in sni sniext; do
-					s="--split-tls=$pos"
-					tpws_curl_test_update $1 $3 $s $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
-						[ "$SCANLEVEL" = quick ] && return
-						break
-					}
-				done
-				for pos in 1 2 3 4 5 10 50; do
-					s="--split-pos=$pos"
-					tpws_curl_test_update $1 $3 $s $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
+			for s2 in '' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
+				for pos in $splits_tls; do
+					tpws_curl_test_update $1 $3 --split-pos=$pos $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
 						[ "$SCANLEVEL" = quick ] && return
+						need_mss=0
 						break
 					}
 				done
 			done
-			for s2 in '--tlsrec=sni' '--tlsrec=sni --split-tls=sni' '--tlsrec=sni --split-tls=sni --oob' \
-					'--tlsrec=sni --split-tls=sni --disorder' '--tlsrec=sni --split-tls=sni --oob --disorder' \
-					'--tlsrec=sni --split-pos=1' '--tlsrec=sni --split-pos=1 --oob' '--tlsrec=sni --split-pos=1 --disorder' \
-					'--tlsrec=sni --split-pos=1 --oob --disorder'; do
-				tpws_curl_test_update $1 $3 $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
-					[ "$SCANLEVEL" = quick ] && return
-					break
-				}
+			for s in '' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
+				for s2 in '--tlsrec=midsld' '--tlsrec=sniext+1 --split-pos=midsld' '--tlsrec=sniext+4 --split-pos=midsld' '--tlsrec=sniext+1 --split-pos=1,midsld' '--tlsrec=sniext+4 --split-pos=1,midsld' ; do
+					tpws_curl_test_update $1 $3 $s2 $s $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
+						[ "$SCANLEVEL" = quick ] && return
+						need_mss=0
+						break
+					}
+				done
 			done
 			# only linux supports mss
 			[ "$UNAME" = Linux -a "$sec" = 1 ] || break
+			[ "$SCANLEVEL" = force -o "$need_mss" = 1 ] || break
 		done
 	fi
 }
@@ -1393,7 +1465,7 @@ tpws_check_domain_http_bypass()
 
 	local strategy
 	tpws_check_domain_http_bypass_ "$@"
-	strategy="${strategy:+$strategy${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}}"
+	strategy_append_extra_tpws
 	report_strategy $1 $3 tpws
 }
 
@@ -1682,17 +1754,6 @@ ask_params()
 		echo "installed curl version does not support http3 QUIC. tests disabled."
 	fi
 
-	IGNORE_CA=0
-	CURL_OPT=
-	[ $ENABLE_HTTPS_TLS13 = 1 -o $ENABLE_HTTPS_TLS12 = 1 ] && {
-		echo
-		echo "on limited systems like openwrt CA certificates might not be installed to preserve space"
-		echo "in such a case curl cannot verify server certificate and you should either install ca-bundle or disable verification"
-		echo "however disabling verification will break https check if ISP does MitM attack and substitutes server certificate"
-		ask_yes_no_var IGNORE_CA "do not verify server certificate"
-		[ "$IGNORE_CA" = 1 ] && CURL_OPT=-k
-	}
-
 	echo
 	echo "sometimes ISPs use multiple DPIs or load balancing. bypass strategies may work unstable."
 	printf "how many times to repeat each test (default: 1) : "

common/base.sh

@@ -60,11 +60,22 @@ starts_with()
 	esac
 	return 1
 }
+extract_arg()
+{
+	# $1 - arg number
+	# $2,$3,... - args
+        local n=$1
+        while [ -n "$1" ]; do
+                shift
+                [ $n -eq 1 ] && { echo "$1"; return 0; }
+                n=$(($n-1))
+        done
+        return 1
+}
 find_str_in_list()
 {
 	# $1 - string
 	# $2 - space separated values
-
 	local v
 	[ -n "$1" ] && {
 		for v in $2; do

common/installer.sh

@@ -190,6 +190,7 @@ check_system()
 
 	get_fwtype
 	OPENWRT_FW3=
+	OPENWRT_FW4=
 
 	local info
 	UNAME=$(uname)
@@ -201,27 +202,35 @@ check_system()
 		# some distros include systemctl without systemd
 		if [ -d "$SYSTEMD_DIR" ] && [ -x "$SYSTEMCTL" ] && [ "$INIT" = "systemd" ]; then
 			SYSTEM=systemd
-		elif [ -f "/etc/openwrt_release" ] && exists opkg && exists uci && [ "$INIT" = "procd" ] ; then
-		{
+		elif [ -f "/etc/openwrt_release" ] && exists opkg || exists apk && exists uci && [ "$INIT" = "procd" ] ; then
 			SYSTEM=openwrt
+			OPENWRT_PACKAGER=opkg
+			OPENWRT_PACKAGER_INSTALL="opkg install"
+			OPENWRT_PACKAGER_UPDATE="opkg update"
+			exists apk && {
+				OPENWRT_PACKAGER=apk
+				OPENWRT_PACKAGER_INSTALL="apk add"
+				OPENWRT_PACKAGER_UPDATE=
+			}
+			info="package manager $OPENWRT_PACKAGER\n"
 			if openwrt_fw3 ; then
 				OPENWRT_FW3=1
-				info="openwrt firewall uses fw3"
+				info="${info}firewall fw3"
 				if is_ipt_flow_offload_avail; then
 					info="$info. hardware flow offloading requires iptables."
 				else
 					info="$info. flow offloading unavailable."
 				fi
 			elif openwrt_fw4; then
-				info="openwrt firewall uses fw4. flow offloading requires nftables."
+				OPENWRT_FW4=1
+				info="${info}firewall fw4. flow offloading requires nftables."
 			fi
-		}
 		elif openrc_test; then
 			SYSTEM=openrc
 		else
 			echo system is not either systemd, openrc or openwrt based
 			echo easy installer can set up config settings but can\'t configure auto start
-			echo you have to do it manually. check readme.txt for manual setup info.
+			echo you have to do it manually. check readme.md for manual setup info.
 			if [ -n "$1" ] || ask_yes_no N "do you want to continue"; then
 			    SYSTEM=linux
 			else
@@ -232,11 +241,11 @@ check_system()
 	elif [ "$UNAME" = "Darwin" ]; then
 		SYSTEM=macos
 	else
-		echo easy installer only supports Linux and MacOS. check readme.txt for supported systems and manual setup info.
+		echo easy installer only supports Linux and MacOS. check readme.md for supported systems and manual setup info.
 		exitp 5
 	fi
 	echo system is based on $SYSTEM
-	[ -n "$info" ] && echo $info
+	[ -n "$info" ] && printf "${info}\n"
 }
 
 get_free_space_mb()
@@ -420,14 +429,21 @@ check_kmod()
 }
 check_package_exists_openwrt()
 {
-	[ -n "$(opkg list $1)" ]
+	[ -n "$($OPENWRT_PACKAGER list $1)" ]
 }
 check_package_openwrt()
 {
-	[ -n "$(opkg list-installed $1)" ] && return 0
-	local what="$(opkg whatprovides $1 | tail -n +2 | head -n 1)"
-	[ -n "$what" ] || return 1
-	[ -n "$(opkg list-installed $what)" ]
+	case $OPENWRT_PACKAGER in
+		opkg)
+			[ -n "$(opkg list-installed $1)" ] && return 0
+			local what="$(opkg whatprovides $1 | tail -n +2 | head -n 1)"
+			[ -n "$what" ] || return 1
+			[ -n "$(opkg list-installed $what)" ]
+			;;
+		apk)
+			apk info -e $1
+			;;
+	esac
 }
 check_packages_openwrt()
 {
@@ -516,9 +532,8 @@ restart_openwrt_firewall()
 
 	local FW=fw4
 	[ -n "$OPENWRT_FW3" ] && FW=fw3
-	$FW -q restart || {
+	exists $FW && $FW -q restart || {
 		echo could not restart firewall $FW
-		exitp 30
 	}
 }
 remove_openwrt_firewall()
@@ -684,7 +699,23 @@ check_prerequisites_linux()
 
 removable_pkgs_openwrt()
 {
-	PKGS="iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra ip6tables-mod-nat ip6tables-extra kmod-nft-queue gzip coreutils-sort coreutils-sleep curl"
+	local pkg PKGS2
+	[ -n "$OPENWRT_FW4" ] && PKGS2="$PKGS2 iptables-zz-legacy iptables ip6tables-zz-legacy ip6tables"
+	[ -n "$OPENWRT_FW3" ] && PKGS2="$PKGS2 nftables-json nftables-nojson nftables"
+	PKGS=
+	for pkg in $PKGS2; do
+		check_package_exists_openwrt $pkg && PKGS="${PKGS:+$PKGS }$pkg"
+	done
+	PKGS="ipset iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra ip6tables-mod-nat ip6tables-extra kmod-nft-queue gzip coreutils-sort coreutils-sleep curl $PKGS"
+}
+
+openwrt_fix_broken_apk_uninstall_scripts()
+{
+	# at least in early snapshots with apk removing gnu gzip, sort, ... does not restore links to busybox
+	# system may become unusable
+	exists sort || { echo fixing missing sort; ln -fs /bin/busybox /usr/bin/sort; }
+	exists gzip || { echo fixing missing gzip; ln -fs /bin/busybox /bin/gzip; }
+	exists sleep || { echo fixing missing sleep; ln -fs /bin/busybox /bin/sleep; }
 }
 
 remove_extra_pkgs_openwrt()
@@ -693,19 +724,32 @@ remove_extra_pkgs_openwrt()
 	echo \* remove dependencies
 	removable_pkgs_openwrt
 	echo these packages may have been installed by install_easy.sh : $PKGS
-	ask_yes_no N "do you want to remove them" && opkg remove --autoremove $PKGS
+	ask_yes_no N "do you want to remove them" && {
+		case $OPENWRT_PACKAGER in
+			opkg)
+				opkg remove --autoremove $PKGS
+				;;
+			apk)
+				apk del $PKGS
+				openwrt_fix_broken_apk_uninstall_scripts
+				;;
+		esac
+	}
 }
 
 check_prerequisites_openwrt()
 {
 	echo \* checking prerequisites
 
-	local PKGS="curl" UPD=0
+	local PKGS="curl" UPD=0 local pkg_iptables
 
 	case "$FWTYPE" in
 		iptables)
-			PKGS="$PKGS ipset iptables iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra"
-			[ "$DISABLE_IPV6" != "1" ] && PKGS="$PKGS ip6tables ip6tables-mod-nat ip6tables-extra"
+			pkg_iptables=iptables
+			check_package_exists_openwrt iptables-zz-legacy && pkg_iptables=iptables-zz-legacy
+			PKGS="$PKGS ipset $pkg_iptables iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra"
+			check_package_exists_openwrt ip6tables-zz-legacy && pkg_iptables=ip6tables-zz-legacy
+			[ "$DISABLE_IPV6" = 1 ] || PKGS="$PKGS $pkg_iptables ip6tables-mod-nat ip6tables-extra"
 			;;
 		nftables)
 			PKGS="$PKGS nftables kmod-nft-nat kmod-nft-offload kmod-nft-queue"
@@ -717,9 +761,9 @@ check_prerequisites_openwrt()
 	else
 		echo \* installing prerequisites
 
-		opkg update
+		$OPENWRT_PACKAGER_UPDATE
 		UPD=1
-		opkg install $PKGS || {
+		$OPENWRT_PACKAGER_INSTALL $PKGS || {
 			echo could not install prerequisites
 			exitp 6
 		}
@@ -732,10 +776,10 @@ check_prerequisites_openwrt()
 		echo installer can install GNU gzip but it requires about 100 Kb space
 		if ask_yes_no N "do you want to install GNU gzip"; then
 			[ "$UPD" = "0" ] && {
-				opkg update
+				$OPENWRT_PACKAGER_UPDATE
 				UPD=1
 			}
-			opkg install --force-overwrite gzip
+			$OPENWRT_PACKAGER_INSTALL --force-overwrite gzip
 		fi
 	}
 	is_linked_to_busybox sort && {
@@ -745,10 +789,10 @@ check_prerequisites_openwrt()
 		echo installer can install GNU sort but it requires about 100 Kb space
 		if ask_yes_no N "do you want to install GNU sort"; then
 			[ "$UPD" = "0" ] && {
-				opkg update
+				$OPENWRT_PACKAGER_UPDATE
 				UPD=1
 			}
-			opkg install --force-overwrite coreutils-sort
+			$OPENWRT_PACKAGER_INSTALL --force-overwrite coreutils-sort
 		fi
 	}
 	[ "$FSLEEP" = 0 ] && is_linked_to_busybox sleep && {
@@ -757,10 +801,10 @@ check_prerequisites_openwrt()
 		echo if you want to speed up blockcheck install coreutils-sleep. it requires about 40 Kb space
 		if ask_yes_no N "do you want to install COREUTILS sleep"; then
 			[ "$UPD" = "0" ] && {
-				opkg update
+				$OPENWRT_PACKAGER_UPDATE
 				UPD=1
 			}
-			opkg install --force-overwrite coreutils-sleep
+			$OPENWRT_PACKAGER_INSTALL --force-overwrite coreutils-sleep
 			fsleep_setup
 		fi
 	}

common/linux_iphelper.sh

@@ -125,3 +125,13 @@ resolve_lower_devices()
 		}
 	}
 }
+
+default_route_interfaces6()
+{
+	sed -nre 's/^00000000000000000000000000000000 00 [0-9a-f]{32} [0-9a-f]{2} [0-9a-f]{32} [0-9a-f]{8} [0-9a-f]{8} [0-9a-f]{8} [0-9a-f]{8} +(.*)$/\1/p' /proc/net/ipv6_route | grep -v '^lo$' | sort -u | xargs
+}
+
+default_route_interfaces4()
+{
+	sed -nre 's/^([^\t]+)\t00000000\t[0-9A-F]{8}\t[0-9A-F]{4}\t[0-9]+\t[0-9]+\t[0-9]+\t00000000.*$/\1/p' /proc/net/route | sort -u | xargs
+}

config.default

@@ -55,7 +55,7 @@ TPPORT_SOCKS=987
 # <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
 TPWS_SOCKS_OPT="
 --filter-tcp=80 --methodeol <HOSTLIST> --new
---filter-tcp=443 --split-tls=sni --disorder <HOSTLIST>
+--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>
 "
 
 TPWS_ENABLE=0
@@ -65,7 +65,7 @@ TPWS_PORTS=80,443
 # <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
 TPWS_OPT="
 --filter-tcp=80 --methodeol <HOSTLIST> --new
---filter-tcp=443 --split-tls=sni --disorder <HOSTLIST>
+--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>
 "
 
 NFQWS_ENABLE=0
@@ -89,8 +89,8 @@ NFQWS_UDP_PKT_IN=0
 # hostlist markers are replaced to empty string if MODE_FILTER does not satisfy
 # <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
 NFQWS_OPT="
---filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
---filter-tcp=443 --dpi-desync=fake,disorder2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
+--filter-tcp=80 --dpi-desync=fake,multisplit --dpi-desync-split-pos=method+2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
+--filter-tcp=443 --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=badseq,md5sig <HOSTLIST> --new
 --filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=6 <HOSTLIST_NOAUTO>
 "
 

docs/LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2016-2021 bol-van
+Copyright (c) 2016-2024 bol-van
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

docs/bsd.en.md

@@ -100,7 +100,7 @@ Later you will add ipfw commands to `/etc/rc.firewall.my` to be reapplied after
 You can also run zapret daemons from there. Start them with `--daemon` options, for example
 ```
 pkill ^dvtws$
-/opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=split2
+/opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 To restart firewall and daemons run : `/etc/rc.d/ipfw restart`
@@ -157,7 +157,7 @@ ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0
 # required for autottl mode only
 ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in not diverted not sockarg recv em0
-/opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+/opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 Process only table zapret with the exception of table nozapret:
@@ -167,7 +167,7 @@ ipfw add 100 allow tcp from me to table\(nozapret\) 80,443
 ipfw add 100 divert 989 tcp from any to table\(zapret\) 80,443 out not diverted not sockarg xmit em0
 # required for autottl mode only
 ipfw add 100 divert 989 tcp from table\(zapret\) 80,443 to any tcpflags syn,ack in not diverted not sockarg recv em0
-/opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+/opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 Reinjection loop avoidance. FreeBSD artificially ignores sockarg for ipv6 in
@@ -245,7 +245,7 @@ sysctl net.inet6.ip6.pfil.inbound=ipfw,pf
 ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0
 pkill ^dvtws$
-dvtws --daemon --port 989 --dpi-desync=split2
+dvtws --daemon --port 989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 
 # required for newer pfsense versions (2.6.0 tested) to return ipfw to functional state
 pfctl -d ; pfctl -e
@@ -280,7 +280,7 @@ Autostart `/usr/local/etc/rc.d/zapret.sh`:
 ```
 pfctl -a zapret -f /etc/zapret.anchor
 pkill ^tpws$
-tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-http-req=method --split-pos=2
+tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-pos=2
 ```
 
 After reboot check that anchor is created and referred from the main ruleset:
@@ -342,7 +342,7 @@ pass out quick on em0 proto tcp to   port {80,443} divert-packet port 989
 Then:
 ```
 pfctl -f /etc/pf.conf
-./dvtws --port=989 --dpi-desync=split2
+./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 `dwtws` only for table zapret with the exception of table nozapret :
@@ -375,7 +375,7 @@ pass out quick on em0 inet6 proto tcp to   <zapret6-user> port {80,443} divert-p
 Then:
 ```
 pfctl -f /etc/pf.conf
-./dvtws --port=989 --dpi-desync=split2
+./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 divert-packet automatically adds the reverse rule. By default also incoming

docs/bsd.md

@@ -143,7 +143,7 @@ $ ipfw -q -f flush
 zapret, добавив в параметры `--daemon`. Например так:
 ```sh
 $ pkill ^dvtws$
-$ /opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=split2
+$ /opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 Для перезапуска фаервола и демонов достаточно будет сделать:
@@ -209,7 +209,7 @@ $ ipfw delete 100
 $ ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted xmit em0
 # required for autottl mode only
 $ ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in not diverted recv em0
-$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 #### Трафик только на таблицу zapret, за исключением таблицы nozapret
@@ -220,7 +220,7 @@ $ ipfw add 100 allow tcp from me to table\(nozapret\) 80,443
 $ ipfw add 100 divert 989 tcp from any to table\(zapret\) 80,443 out not diverted not sockarg xmit em0
 # required for autottl mode only
 $ ipfw add 100 divert 989 tcp from table\(zapret\) 80,443 to any tcpflags syn,ack in not diverted not sockarg recv em0
-$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 
@@ -317,7 +317,7 @@ sysctl net.inet6.ip6.pfil.inbound=ipfw,pf
 ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted xmit em0
 pkill ^dvtws$
-dvtws --daemon --port 989 --dpi-desync=split2
+dvtws --daemon --port 989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 
 # required for newer pfsense versions (2.6.0 tested) to return ipfw to functional state
 pfctl -d ; pfctl -e
@@ -357,7 +357,7 @@ rdr pass on em1 inet6 proto tcp to port {80,443} -> fe80::20c:29ff:5ae3:4821 por
 ```sh
 $ pfctl -a zapret -f /etc/zapret.anchor
 $ pkill ^tpws$
-$ tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-http-req=method --split-pos=2
+$ tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-pos=2
 ```
 
 4. После перезагрузки проверьте, что правила создались:
@@ -424,7 +424,7 @@ pass out quick on em0 proto tcp to   port {80,443} divert-packet port 989 no sta
 
 ```sh
 $ pfctl -f /etc/pf.conf
-$ ./dvtws --port=989 --dpi-desync=split2
+$ ./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 #### Трафик только на таблицу zapret, за исключением таблицы nozapret
@@ -456,7 +456,7 @@ pass out quick on em0 inet6 proto tcp to   <zapret6-user> port {80,443} divert-p
 
 ```sh
 $ pfctl -f /etc/pf.conf
-$ ./dvtws --port=989 --dpi-desync=split2
+$ ./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 

docs/bsdfw.txt

@@ -70,7 +70,7 @@ pass in  quick on em0 proto tcp from port {80,443} flags SA/SA divert-packet por
 pass in  quick on em0 proto tcp from port {80,443} no state
 pass out quick on em0 proto tcp to   port {80,443} divert-packet port 989 no state
 pfctl -f /etc/pf.conf
-./dvtws --port=989 --dpi-desync=split2
+./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 
 ; dvtws with table limitations : to zapret,zapret6 but not to nozapret,nozapret6
 ; reload tables : pfctl -f /etc/pf.conf

docs/changes.txt

@@ -363,3 +363,40 @@ nfqws,tpws: use alternate $ sign for $<config_file>
 repo: binaries removed from repo. git actions binaries build in releases.
 uninstall_easy.sh: offer to remove dependencies in openwrt
 install_easy.sh: allow to download lists in autohostlist filter mode
+
+v69:
+
+nfqws, tpws: multisplit/multidisorder support.
+nfqws: name change split->fakedsplit, disorder->fakeddisorder. compat : old names are synonyms
+nfqws: --dpi-desync-split-http-req, --dpi-desync-split-tls deprecated. compat : these parameters add split point to multisplit.
+nfqws: --dpi-desync=split2|disorder2 deprecated. compat: they are now synonyms for multisplit/multidisorder
+nfqws: cancel seqovl if MTU is exceeded (linux only). cancel seqovl for disorder if seqovl>=first_part_size.
+nfqws: fixed splits in multiple TLS segments.
+tpws: --split-http-req,--split-tls deprecated. compat : these parameters add split point to multisplit.
+tpws: --tlsrec now takes pos markers. compat : old names are converted to pos markers
+tpws: --tlsrec-pos deprecated. compat : sets absolute pos marker
+nfqws,tpws: chown autohostlist, autohostlist debug log and debug log files after options parse
+nfqws,tpws: set EXEDIR env var to use in @config (won't work for stadalone winws without /bin/sh)
+dvtws: set random/increasing ip_id value in generated packets
+mdig: fixed parsing of DNS reply in windows (stdin is opened as text, not binary)
+tpws: support compile for android NDK api level >= 21 (Android 5.0)
+tpws: --fix-seg segmentation fixer
+repo: build for android NDK api level 21 (Android 5.0)
+install_easy: support for APK package manager in openwrt
+blockcheck: removed ignore CA question
+blockcheck: removed IGNORE_CA, CURL_VERBOSE
+blockcheck: added CURL_OPT
+blockcheck: new strategies support
+blockcheck: test sequence rework
+blockcheck: view all working strategies in summary
+
+v69.1:
+
+init.d: keenetic udp fix custom
+tpws: fixed incorrect hostlist checks
+
+v69.2:
+
+nfqws,tpws: --skip
+nfqws: --methodeol
+init.d: do not use pgrep in sysv for busybox compat

docs/compile/build_howto_openwrt.txt

@@ -1,21 +1,57 @@
-How to compile native programs for use in openwrt
--------------------------------------------------
-
-1) Download latest SDK for your platform from https://downloads.openwrt.org
-
-   curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxvf -
-   cd openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64
-
-2) ./scripts/feeds update -a
-   ./scripts/feeds install -a
-
-3) cp -R /opt/zapret/docs/compile/openwrt/. .
-   cp -R /opt/zapret/tpws package/zapret/tpws
-   cp -R /opt/zapret/nfq package/zapret/nfqws
-   cp -R /opt/zapret/mdig package/zapret/mdig
-   cp -R /opt/zapret/ip2net package/zapret/ip2net
-
-4) make package/{tpws,nfqws,mdig,ip2net}/compile
-
-5) find bin -name tpws*.ipk
-   #take your tpws*.ipk , nfqws*.ipk , ip2net*.ipk, mdig*.ipk from there
+How to compile native programs for use in openwrt
+-------------------------------------------------
+
+1) Install required packages to the host system :
+
+debian,ubuntu : apt install build-essential patch libncurses-dev python3-distutils unzip gawk wget git
+fedora: dnf install make patch gcc g++ ncurses-devel git perl
+
+Other packages may be required on your distribution. Look for the errors.
+
+2) Download latest SDK for your target platform from https://downloads.openwrt.org
+
+examples :
+
+curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxvf -
+cd openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64
+
+curl -o - https://downloads.openwrt.org/snapshots/targets/x86/64/openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64.tar.zst | tar --zstd -xvf -
+cd openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64
+
+3) Install required libs
+
+./scripts/feeds update base packages
+./scripts/feeds install libnetfilter-queue zlib libcap
+
+4) Prepare openwrt package definitions
+
+cp -R /opt/zapret/docs/compile/openwrt/. .
+cp -R /opt/zapret/tpws package/zapret/tpws
+cp -R /opt/zapret/nfq package/zapret/nfqws
+cp -R /opt/zapret/mdig package/zapret/mdig
+cp -R /opt/zapret/ip2net package/zapret/ip2net
+rm -f package/zapret/tpws/tpws/tpws package/zapret/nfqws/nfq/nfqws package/zapret/mdig/mdig/mdig package/zapret/ip2net/ip2net/ip2net
+
+5) Prepare .config
+
+make defconfig
+
+If you only need bins without packages comment 'CONFIG_AUTOREMOVE=y' line in .config
+
+6) Compile
+
+dynamic build : make package/{tpws,nfqws,mdig,ip2net}/compile
+static build :  make CFLAGS=-static package/{tpws,nfqws,mdig,ip2net}/compile
+
+7) Get result
+
+executables only : build_dir/target/<progname>
+ipk or apk packages : bin/packages/*/base
+
+8) Installating to openwrt to use with zapret
+
+zapret with or without binaries should be already installed in /opt/zapret.
+Install ipk's or apk's with all compiled progs using opkg or apk.
+Bins are placed to /opt/zapret/binaries/my.
+Or copy binaries there manually and set chmod 755 to them.
+Run install_bin.sh or install_easy.sh. They will use bins in 'my' folder.

docs/compile/build_howto_unix.txt

@@ -0,0 +1,16 @@
+debian,ubuntu :
+
+apt install make gcc zlib1g-dev libcap-dev libnetfilter-queue-dev
+make -C /opt/zapret
+
+FreeBSD :
+
+make -C /opt/zapret
+
+OpenBSD :
+
+make -C /opt/zapret bsd
+
+MacOS :
+
+make -C /opt/zapret mac

docs/compile/build_howto_windows.txt

@@ -0,0 +1,29 @@
+Windows x64
+
+1) Download latest cygwin for windows 7
+
+curl -O https://www.cygwin.com/setup-x86_64.exe
+setup-x86_64.exe --allow-unsupported-windows --no-verify --site http://ctm.crouchingtigerhiddenfruitbat.org/pub/cygwin/circa/64bit/2024/01/30/231215
+
+2) During setup install packages : make gcc-core zlib-devel
+
+3) Run Cygwin.bat
+
+4) cd to %ZAPRET_BASE%/nfq
+
+cd C:/Users/user/Downloads/zapret/nfq
+
+5) Compile
+
+make cygwin64
+
+use winws.exe
+
+6) Take windivert.dll and windivert64.sys here : https://reqrypt.org/download
+Choose version 2.2.2 for Windows 10 and 2.2.0 for Windows 7.
+
+7) Copy cygwin1.dll, winws.exe, windivert.dll and windivert64.sys to one folder.
+
+8) Run winws.exe from cmd.exe running as administrator.
+winws will not run from cygwin shell with cygwin1.dll copy in it's folder.
+winws will not run without cygwin1.dll outside of cygwin shell.

docs/compile/openwrt/package/zapret/ip2net/Makefile

@@ -24,8 +24,8 @@ define Build/Compile
 endef
 
 define Package/ip2net/install
-	$(INSTALL_DIR) $(1)/opt/zapret/ip2net
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip2net $(1)/opt/zapret/ip2net
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip2net $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,ip2net))

docs/compile/openwrt/package/zapret/ip2net/readme.txt

@@ -1 +1 @@
-Copy "ip2net" folder here !
+Copy "ip2net" folder here !

docs/compile/openwrt/package/zapret/mdig/Makefile

@@ -24,8 +24,8 @@ define Build/Compile
 endef
 
 define Package/mdig/install
-	$(INSTALL_DIR) $(1)/opt/zapret/mdig
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mdig $(1)/opt/zapret/mdig
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mdig $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,mdig))

docs/compile/openwrt/package/zapret/mdig/readme.txt

@@ -1 +1 @@
-Copy "mdig" folder here !
+Copy "mdig" folder here !

docs/compile/openwrt/package/zapret/nfqws/Makefile

@@ -25,8 +25,8 @@ define Build/Compile
 endef
 
 define Package/nfqws/install
-	$(INSTALL_DIR) $(1)/opt/zapret/nfq
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/nfqws $(1)/opt/zapret/nfq
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/nfqws $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,nfqws))

docs/compile/openwrt/package/zapret/nfqws/readme.txt

@@ -1 +1 @@
-Copy "nfq" folder here !
+Copy "nfq" folder here !

docs/compile/openwrt/package/zapret/tpws/Makefile

@@ -25,8 +25,8 @@ define Build/Compile
 endef
 
 define Package/tpws/install
-	$(INSTALL_DIR) $(1)/opt/zapret/tpws
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tpws $(1)/opt/zapret/tpws
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tpws $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,tpws))

docs/compile/openwrt/package/zapret/tpws/readme.txt

@@ -1 +1 @@
-Copy "tpws" folder here !
+Copy "tpws" folder here !

docs/iptables.txt

@@ -12,7 +12,7 @@ iptables -t mangle -I POSTROUTING -p udp --dport 443 -m mark ! --mark 0x40000000
 # auto hostlist with avoiding wrong ACK numbers in RST,ACK packets sent by russian DPI
 sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1 
 iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:12 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-iptables -t mangle -I PREROUTING -p tcp -m multiport --sports 80,443 -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+iptables -t mangle -I PREROUTING -p tcp -m multiport --sports 80,443 -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:3 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
 
 
 For TPROXY :

docs/nftables.txt

@@ -19,8 +19,8 @@ For dpi desync attack :
 nft delete table inet ztest
 nft create table inet ztest
 nft add chain inet ztest post "{type filter hook postrouting priority mangle;}"
-nft add rule inet ztest post meta mark and 0x40000000 == 0 tcp dport "{80,443}" ct original packets 1-12 queue num 200 bypass
-nft add rule inet ztest post meta mark and 0x40000000 == 0 udp dport 443 ct original packets 1-12 queue num 200 bypass
+nft add rule inet ztest post meta mark and 0x40000000 == 0 tcp dport "{80,443}" ct original packets 1-6 queue num 200 bypass
+nft add rule inet ztest post meta mark and 0x40000000 == 0 udp dport 443 ct original packets 1-6 queue num 200 bypass
 
 # auto hostlist with avoiding wrong ACK numbers in RST,ACK packets sent by russian DPI
 sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1 

docs/quick_start.md

@@ -213,7 +213,7 @@
    > Если используются методы нулевой фазы десинхронизации (`--mss`,
    > `--wssize`, `--dpi-desync=syndata`) и режим фильтрации `hostlist`, то все
    > параметры, относящиеся к этим методам, следует помещать в отдельные
-   > профили мульистратегии, которые получат управление до определения имени
+   > профили мультистратегии, которые получат управление до определения имени
    > хоста. Необходимо понимать алгоритм работы мультистратегий. Самым надежным
    > вариантом будет дублирование этих параметров на 2 профиля. Какой-нибудь
    > сработает в зависимости от параметра `MODE_FILTER`.
@@ -235,6 +235,13 @@
 8. На все остальные вопросы `install_easy.sh` отвечайте согласно выводимой
    аннотации.
 
+9. Удалите директорию из /tmp, откуда производилась установка.
+
+## Полное удаление
+
+1. Прогоните `/opt/zapret/uninstall_easy.sh`.
+2. Cогласитесь на удаление зависимостей в openwrt.
+3. Удалите каталог `/opt/zapret`.
 
 ## Итог
 Это минимальная инструкция, чтобы быстро сориентироваться с чего начать.

docs/quick_start_windows.md

@@ -47,6 +47,14 @@ _"Совсем ничего не могу, все очень сложно, да
 
 Не помогла _"таблетка"_ ? Это вовсе не значит, что ничего не получится. Но придется делать по нормальному.
 
+## НЕ ПОМОГЛО, КАК ТЕПЕРЬ ЭТО УДАЛИТЬ
+
+Если вы не устанавливали zapret как службу или запланированную задачу (а это требует редактирования cmd файлов),
+достаточно закрыть окно с winws и запустить windivert_delete.cmd.
+Альтернатива - перезагрузить компьютер.
+После чего можно удалить папку с zapret. На этом деинсталляция закончена.
+Если же вы устанавливали zapret как службу, то вы наверняка знаете как ее удалить.
+
 ## РЕШЕНИЕ "КАК ПОЛОЖЕНО"
 
 1) Скачайте и распакуйте архив https://github.com/bol-van/zapret-win-bundle/archive/refs/heads/master.zip.

docs/wireguard/010-wg-mod.patch

@@ -1,133 +0,0 @@
-Index: WireGuard-0.0.20190123/src/cookie.c
-===================================================================
---- WireGuard-0.0.20190123.orig/src/cookie.c
-+++ WireGuard-0.0.20190123/src/cookie.c
-@@ -193,6 +193,8 @@ void wg_cookie_message_create(struct mes
- 	xchacha20poly1305_encrypt(dst->encrypted_cookie, cookie, COOKIE_LEN,
- 				  macs->mac1, COOKIE_LEN, dst->nonce,
- 				  checker->cookie_encryption_key);
-+        // MOD : randomize trash
-+	dst->header.trash = gen_trash();
- }
- 
- void wg_cookie_message_consume(struct message_handshake_cookie *src,
-Index: WireGuard-0.0.20190123/src/messages.h
-===================================================================
---- WireGuard-0.0.20190123.orig/src/messages.h
-+++ WireGuard-0.0.20190123/src/messages.h
-@@ -53,23 +53,41 @@ enum limits {
- 	MAX_QUEUED_PACKETS = 1024 /* TODO: replace this with DQL */
- };
- 
-+/*
- enum message_type {
--	MESSAGE_INVALID = 0,
--	MESSAGE_HANDSHAKE_INITIATION = 1,
--	MESSAGE_HANDSHAKE_RESPONSE = 2,
--	MESSAGE_HANDSHAKE_COOKIE = 3,
--	MESSAGE_DATA = 4
-+    MESSAGE_INVALID = 0,
-+    MESSAGE_HANDSHAKE_INITIATION = 1,
-+    MESSAGE_HANDSHAKE_RESPONSE = 2,
-+    MESSAGE_HANDSHAKE_COOKIE = 3,
-+    MESSAGE_DATA = 4
- };
-+*/
-+
-+// MOD : message type
-+enum message_type {
-+    MESSAGE_INVALID = 0xE319CCD0,
-+    MESSAGE_HANDSHAKE_INITIATION = 0x48ADE198,
-+    MESSAGE_HANDSHAKE_RESPONSE = 0xFCA6A8F3,
-+    MESSAGE_HANDSHAKE_COOKIE = 0x64A3BB18,
-+    MESSAGE_DATA = 0x391820AA
-+};
-+
-+// MOD : generate fast trash without true RNG
-+__le32 gen_trash(void);
- 
- struct message_header {
--	/* The actual layout of this that we want is:
--	 * u8 type
--	 * u8 reserved_zero[3]
--	 *
--	 * But it turns out that by encoding this as little endian,
--	 * we achieve the same thing, and it makes checking faster.
--	 */
--	__le32 type;
-+    /* The actual layout of this that we want is:
-+     * u8 type
-+     * u8 reserved_zero[3]
-+     *
-+     * But it turns out that by encoding this as little endian,
-+     * we achieve the same thing, and it makes checking faster.
-+     */
-+
-+    // MOD : trash field to change message size and add 4 byte offset to all fields
-+    __le32 trash;
-+
-+    __le32 type;
- };
- 
- struct message_macs {
-Index: WireGuard-0.0.20190123/src/noise.c
-===================================================================
---- WireGuard-0.0.20190123.orig/src/noise.c
-+++ WireGuard-0.0.20190123/src/noise.c
-@@ -17,6 +17,24 @@
- #include <linux/highmem.h>
- #include <crypto/algapi.h>
- 
-+
-+// MOD : trash generator
-+__le32 gtrash = 0;
-+__le32 gen_trash(void)
-+{
-+    if (gtrash)
-+	gtrash = gtrash*1103515243 + 12345;
-+    else
-+	// first value is true random
-+	get_random_bytes_wait(&gtrash, sizeof(gtrash));
-+    return gtrash;
-+}
-+
- /* This implements Noise_IKpsk2:
-  *
-  * <- s
-@@ -515,6 +533,10 @@ wg_noise_handshake_create_initiation(str
- 		&handshake->entry);
- 
- 	handshake->state = HANDSHAKE_CREATED_INITIATION;
-+
-+	// MOD : randomize trash
-+        dst->header.trash = gen_trash();
-+
- 	ret = true;
- 
- out:
-@@ -655,6 +677,10 @@ bool wg_noise_handshake_create_response(
- 		&handshake->entry);
- 
- 	handshake->state = HANDSHAKE_CREATED_RESPONSE;
-+
-+        // MOD : randomize trash
-+        dst->header.trash = gen_trash();
-+
- 	ret = true;
- 
- out:
-Index: WireGuard-0.0.20190123/src/send.c
-===================================================================
---- WireGuard-0.0.20190123.orig/src/send.c
-+++ WireGuard-0.0.20190123/src/send.c
-@@ -200,6 +200,10 @@ static bool encrypt_packet(struct sk_buf
- 	header->header.type = cpu_to_le32(MESSAGE_DATA);
- 	header->key_idx = keypair->remote_index;
- 	header->counter = cpu_to_le64(PACKET_CB(skb)->nonce);
-+
-+        // MOD : randomize trash
-+	header->header.trash = gen_trash();
-+
- 	pskb_put(skb, trailer, trailer_len);
- 
- 	/* Now we can encrypt the scattergather segments */

docs/wireguard/wireguard-mod.txt

@@ -1,250 +0,0 @@
-!!! Эта инструкция написана еще до включения wireguard в ядро linux.
-!!! Процесс сборки для in-tree модулей отличается.
-!!! Цель данного чтива - дать идею для программистов как можно исправить исходники wireguard
-!!! для преодоления DPI. Автор не преследует цели поддерживать готовые патчи для актуальных версий.
-!!! Вместо патчинга гораздо проще использовать навесное решение ipobfs.
-
-Посвящено возможной блокировке в РФ VPN протоколов через DPI.
-Предпосылками являются последние законодательные акты и во всю сочащиеся "секретные" записки.
-В РФ разрабатываются и готовятся к применению более продвинутые решения по блокировке трафика.
-Вполне вероятно будут резать стандартные VPN протоколы. Нам надо быть к этому готовыми.
-
-Один из возможных и перспективных путей решения данного вопроса - кустомная модификация
-исходников VPN с целью незначительного изменения протокола, ломающего стандартные модули обнаружения в DPI.
-Это относительно сложно, доступно только для гиков.
-Никто не будет разрабатывать специальные модули обнаружения в DPI, если только кто-то не сделает простое и
-удобное решение для всех, и его станут широко применять. Но это маловероятно, и даже если и так,
-то всегда можно модифицировать протокол чуток по другому. Делать моды для DPI несравненно дольше
-и дороже, чем клепать на коленке изменения протокола для wireguard.
-
-
-ЗАМЕЧЕНИЕ : альтернативой модификации конечного софта для VPN является использование "навесных"
-обфускаторов. см : https://github.com/bol-van/ipobfs
-
-
-Рассмотрю что нам надо пропатчить в wireguard. Модифицированный wireguard проверен на виртуалках
-с десктопным linux, он работает, сообщения в wireshark действительно не вписываются в стандартный
-протокол и не опознаются.
-
-Wireguard протокол очень простой. Все сообщения описаны в messages.h
-Поставим себе целью сделать 2 простые модификации :
-1) Добавим в начало всех сообщений немного мусора, чтобы изменить размер сообщений и смещения полей
-2) Изменим коды типов сообщений
-Этого может быть вполне достаточно для обмана DPI
-
---messages.h--------------------------
-/*
-enum message_type {
-	MESSAGE_INVALID = 0,
-	MESSAGE_HANDSHAKE_INITIATION = 1,
-	MESSAGE_HANDSHAKE_RESPONSE = 2,
-	MESSAGE_HANDSHAKE_COOKIE = 3,
-	MESSAGE_DATA = 4
-};
-*/
-
-// MOD : message type
-enum message_type {
-	MESSAGE_INVALID = 0xE319CCD0,
-	MESSAGE_HANDSHAKE_INITIATION = 0x48ADE198,
-	MESSAGE_HANDSHAKE_RESPONSE = 0xFCA6A8F3,
-	MESSAGE_HANDSHAKE_COOKIE = 0x64A3BB18,
-	MESSAGE_DATA = 0x391820AA
-};
-
-// MOD : generate fast trash without true RNG
-__le32 gen_trash(void);
-
-struct message_header {
-	/* The actual layout of this that we want is:
-	 * u8 type
-	 * u8 reserved_zero[3]
-	 *
-	 * But it turns out that by encoding this as little endian,
-	 * we achieve the same thing, and it makes checking faster.
-	 */
-
-	// MOD : trash field to change message size and add 4 byte offset to all fields
-	__le32 trash;
-
-	__le32 type;
-};
---------------------------------------
-
-Напишем функцию для генерации trash. Функция должна быть быстрая, важно не замедлить скорость.
-Мы не расчитываем, что нас будут специально ловить, иначе бы пришлось делать полноценный обфускатор.
-Задача лишь сломать стандартный модуль обнаружения протокола wireguard. Потому истинная рандомность
-trash не важна.
-Но все же немного "трэша" не повредит. Гонки между тредами так же пофигистичны. Это же трэш.
-
---noise.c-----------------------------
-// MOD : trash generator
-__le32 gtrash = 0;
-__le32 gen_trash(void)
-{
-	if (gtrash)
-		gtrash = gtrash*1103515243 + 12345;
-	else
-		// first value is true random
-		get_random_bytes_wait(&gtrash, sizeof(gtrash));
-	return gtrash;
-}
---------------------------------------
-
-Теперь осталось найти все места, где создаются сообщения и внести туда заполнение поля trash.
-Сообщений всего 4. Их можно найти по присваиванию полю type одного из значений enum message_type.
-
-2 места в noise.c в функциях wg_noise_handshake_create_initiation и wg_noise_handshake_create_response,
-1 место в cookie.c в функции wg_cookie_message_create
-Дописываем в конец инициализации структуры сообщения :
-
---------------------------------------
-	// MOD : randomize trash
-	dst->header.trash = gen_trash();
---------------------------------------
-
-и 1 место в send.c в функции encrypt_packet
-
---------------------------------------
-	// MOD : randomize trash
-	header->header.trash = gen_trash();
---------------------------------------
-
-
-Вот и весь патчинг. Полный patch (версия wireguard 0.0.20190123) лежит в 010-wg-mod.patch.
-Патчинг кода - самое простое. Для десктопного linux дальше все просто.
-Пересобираем через make, устанавливаем через make install, перегружаем
-модуль wireguard, перезапускаем интерфейсы, и все готово.
-
-Настоящий геморой начнется когда вы это попытаетесь засунуть на роутер под openwrt.
-Одна из больших проблем linux - отсутствие совместимости драйверов на уровне бинариков.
-Поэтому собирать необходимо в точности под вашу версию ядра и в точности под его .config.
-Вам придется либо полностью самостоятельно собирать всю прошивку, либо найти SDK в точности
-от вашей версии прошивки для вашей архитектуры и собрать модуль с помощью этого SDK.
-Последний вариант более легкий.
-Для сборки вам понадобится система на linux x86_64. Ее можно установить в виртуалке.
-Теоретически можно пользоваться WSL из win10, но на практике там очень медленное I/O,
-по крайней мере на старых версиях win10. Безумно медленное. Будете собирать вечность.
-Может в новых win10 что-то и улучшили, но я бы сразу расчитывал на полноценный linux.
-
-Находим здесь вашу версию : https://downloads.openwrt.org/
-Скачиваем файл openwrt-sdk-*.tar.xz или lede-sdk-*.tar.xz
-Например : https://downloads.openwrt.org/releases/18.06.2/targets/ar71xx/generic/openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64.tar.xz
-Если ваша версия непонятна или стара, то проще будет найти последнюю прошивку и перешить роутер.
-Распаковываем SDK. Следующими командами можно собрать оригинальный вариант wireguard :
-
-# scripts/feeds update -a
-# scripts/feeds install -a
-# make defconfig
-# make -j 4 package/wireguard/compile
-
-Сборка будет довольно долгой. Ведь придется подтащить ядро, собрать его, собрать зависимости.
-"-j 4" означает использовать 4 потока. Впишите вместо 4 количество доступных cpu cores.
-
-Получим следующие файлы :
-
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/bin/targets/ar71xx/generic/packages/kmod-wireguard_4.9.152+0.0.20190123-1_mips_24kc.ipk
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/bin/packages/mips_24kc/base/wireguard-tools_0.0.20190123-1_mips_24kc.ipk
-
-Но это будет оригинальный wireguard. Нам нужен патченый.
-Установим quilt и mc для нормального редактора вместо vim :
-
-# sudo apt-get update
-# sudo apt-get install quilt mc
-
-# make package/wireguard/clean
-# make package/wireguard/prepare V=s QUILT=1
-
-
-Сорцы приготовлены для сборки в :
- openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/src
-
-# cd build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/src
-# quilt push -a
-# quilt new 010-wg-mod.patch
-# export EDITOR=mcedit
-
-Далее будет открываться редактор mcedit, в который нужно вносить изменения в каждый файл :
-
-# quilt edit messages.h
-# quilt edit cookie.c
-# quilt edit noise.c
-# quilt edit send.c
-# quilt diff
-# quilt refresh
-
-Получили файл патча в :
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/patches/010-wg-mod.patch
-
-Выходим в корень SDK.
-
-# make package/wireguard/compile V=99
-
-Если не было ошибок, то получили измененные ipk.
-Патч можно зафиксировать в описании пакета :
-
-# make package/wireguard/update
-
-Получим :
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/feeds/base/package/network/services/wireguard/patches/010-wg-mod.patch
-При последующей очистке и пересборке он будет автоматом применяться.
-
-
-АЛЬТЕРНАТИВА : можно не возиться с quilt.
-сделайте
-# make package/wireguard/clean
-# make package/wireguard/prepare
-и напрямую модифицируйте или копируйте файлы в 
- openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/src
-затем
-# make package/wireguard/compile
-
-Если нужно поменять версию wireguard, то идите в
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/feeds/base/package/network/services/wireguard/Makefile
-поменяйте там версию в PKG_VERSION на последнюю из : https://git.zx2c4.com/WireGuard
-скачайте tar.xz с этой версией , вычислите его sha256sum, впишите в PKG_HASH
-
-1 раз где-нибудь пропатчите файлы последней версии wireguard в текстовом редакторе, скопируйте в build_dir,
-сделайте версию для openwrt. эти же файлы скопируйте на ваш сервер с десктопным linux, сделайте там make / make install
-
-Но имейте в виду, что build_dir - локация для временных файлов.
-make clean оттуда все снесет, включая ваши модификации. Модифицированные файлы лучше сохранить отдельно,
-чтобы потом было легко скопировать обратно.
-
-Полученные ipk копируем на роутер в /tmp, устанавливаем через
-# cd /tmp
-# rm -r /tmp/opkg-lists
-# opkg install *.ipk
-Если требует зависимостей, то
-# opkg update
-# opkg install .... <зависимости>
-# rm -r /tmp/opkg-lists
-# opkg install *.ipk
-
-В /tmp/opkg-lists opkg хранит кэш списка пакетов. Если попытаться установить файл ipk, и такой же пакет
-найдется в репозитории, opkg будет устанавливать из репозитория. А нам это не надо.
-
-# rmmod wireguard
-# kmodloader
-# dmesg | tail
-должны увидеть что-то вроде :
-[8985.415490] wireguard: WireGuard 0.0.20190123 loaded. See www.wireguard.com for information.
-[8985.424178] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
-значит модуль загрузился
-
-Могут понадобиться ключи opkg --force-reinstall, --force-depends.
---force-depends поможет при несоответствии hash версии ядра. То есть версия x.x.x та же самая, но hash конфигурации разный.
-При несоответствии x.x.x вы что-то делаете не так, работать это не будет.
-Например : 4.14.56-1-b1186491495127cc6ff81d29c00a91fc, 4.14.56-1-3f8a21a63974cfb7ee67e41f2d4b805d
-Это свидетельствует о несоответствии .config ядра при сборке прошивки и в SDK.
-Если несоответствие легкое, то может все прокатить, но при более серьезной разнице в .config модуль может не загрузиться
-или вызвать стабильные или хаотические падения ядра и перезагрузки (включая вариант беcконечной перезагрузки - bootloop).
-Так что перед --force-depends убедитесь, что знаете как лечится такая ситуация, и не стоит это делать при отсутствии физического
-доступа к девайсу.
-
-Когда поднимите линк, и вдруг ничего не будет работать, то посмотрите в wireshark udp пакеты
-на порт endpoint. Они не должны начинаться с 0,1,2,3,4. В первых 4 байтах должен быть рандом,
-в следующих 4 байтах - значения из измененного enum message_type. Если пакет все еще начинается с 0..4,
-значит модуль wireguard оригинальный, что-то не собралось, не скопировалось, не перезапустилось.
-В противном случае должен подняться линк, пинги ходить. Значит вы победили, поздравляю.
-Регулятору будет намного сложнее поймать ваш VPN.

docs/wireguard_iproute_openwrt.txt

@@ -236,7 +236,7 @@ config rule
 
 --- Подготовка zapret ---
 
-Выполните install_easy.sh. Он настроит режим обхода DPI. Если обход DPI не нужен - выберите MODE=filter.
+Выполните install_easy.sh. Он настроит режим обхода DPI. Если обход DPI не нужен - не включайте tpws и nfqws.
 Так же инсталятор заресолвит домены из ipset/zapret-hosts-user-ipban.txt и внесет крон-джоб для периодического обновления ip.
 
 Если вы используете в своих правилах ipset zapret, то он ресолвится и обновляется только, если выбран режим фильтрации обхода DPI по ipset.

init.d/sysv/custom.d.examples/10-keenetic-udp-fix

@@ -0,0 +1,22 @@
+# This script fixes keenetic issue with nfqws generated udp packets
+# Keenetic uses proprietary ndmmark and does not masquerade without this mark
+# If not masqueraded packets go to WAN with LAN IP and get dropped by ISP
+
+# It's advised to set IFACE_WAN in config
+
+zapret_custom_firewall()
+{
+	# $1 - 1 - add, 0 - stop
+
+	local wan wanif rule
+
+	[ "$DISABLE_IPV4" = "1" ] || {
+		# use IFACE_WAN if defined. if not - search for interfaces with default route.
+		wanif=${IFACE_WAN:-$(sed -nre 's/^([^\t]+)\t00000000\t[0-9A-F]{8}\t[0-9A-F]{4}\t[0-9]+\t[0-9]+\t[0-9]+\t00000000.*$/\1/p' /proc/net/route | sort -u | xargs)}
+		for wan in $wanif; do
+			rule="-o $wan -p udp -m mark --mark $DESYNC_MARK/$DESYNC_MARK"
+			ipt_print_op $1 "$rule" "keenetic udp fix"
+			ipt_add_del $1 POSTROUTING -t nat $rule -j MASQUERADE
+		done
+	}
+}

init.d/sysv/functions

@@ -167,22 +167,24 @@ run_daemon()
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
 
 	local DAEMONBASE="$(basename "$2")"
-	local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
+	local PID= PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
 	echo "Starting daemon $1: $2 $3"
-	if exists start-stop-daemon ; then
-		start-stop-daemon -S -p "$PIDFILE" -m -b -x "$2" -- $3
+
+	[ -f "$PIDFILE" ] && {
+		read PID <"$PIDFILE"
+		[ -d "/proc/$PID" ] || PID=
+	}
+
+	if [ -n "$PID" ]; then
+		echo already running
 	else
-		if [ -f "$PIDFILE" ] && pgrep -F "$PIDFILE" "$DAEMONBASE" >/dev/null; then
-			echo already running
+		"$2" $3 >/dev/null &
+		PID=$!
+		if [ -n "$PID" ]; then
+			echo $PID >$PIDFILE
 		else
-			"$2" $3 >/dev/null 2>/dev/null &
-			PID=$!
-			if [ -n "$PID" ]; then
-				echo $PID >$PIDFILE
-			else
-				echo could not start daemon $1 : $2 $3
-				false
-			fi
+			echo could not start daemon $1 : $2 $3
+			false
 		fi
 	fi
 }
@@ -192,18 +194,14 @@ stop_daemon()
 	# $2 - daemon
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
 	local DAEMONBASE="$(basename "$2")"
-	local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
+	local PID PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
 	echo "Stopping daemon $1: $2"
-	if exists start-stop-daemon ; then
-		start-stop-daemon -K -p "$PIDFILE" -x "$2"
+	if [ -f "$PIDFILE" ]; then
+		read PID <"$PIDFILE"
+		kill $PID
+		rm -f "$PIDFILE"
 	else
-		if [ -f "$PIDFILE" ]; then
-			read PID <"$PIDFILE"
-			kill $PID
-			rm -f "$PIDFILE"
-		else
-			echo no pidfile : $PIDFILE
-		fi
+		echo no pidfile : $PIDFILE
 	fi
 }
 do_daemon()

install_bin.sh

@@ -25,7 +25,11 @@ check_dir()
 				# find does not use its own shell exec
 				# it uses execvp(). in musl libc it does not call shell, in glibc it DOES call /bin/sh
 				# that's why prefer bash or zsh if present. otherwise it's our last chance
-				out=$(echo 0.0.0.0 | find "$dir" -maxdepth 1 -name ip2net -exec {} \; 2>/dev/null)
+				local FIND=find
+				if ! exists find && exists busybox; then
+					FIND="busybox find"
+				fi
+				out=$(echo 0.0.0.0 | $FIND "$dir" -maxdepth 1 -name ip2net -exec {} \; 2>/dev/null)
 			fi
 			[ -n "$out" ]
 		else

install_easy.sh

@@ -549,7 +549,7 @@ service_install_systemd()
 
 	if [ -w "$SYSTEMD_SYSTEM_DIR" ] ; then
 		rm -f "$INIT_SCRIPT"
-		ln -fs "$EXEDIR/init.d/systemd/zapret.service" "$SYSTEMD_SYSTEM_DIR"
+		cp -f "$EXEDIR/init.d/systemd/zapret.service" "$SYSTEMD_SYSTEM_DIR"
 		"$SYSTEMCTL" daemon-reload
 		"$SYSTEMCTL" enable zapret || {
 			echo could not enable systemd service
@@ -567,8 +567,8 @@ timer_install_systemd()
 	if [ -w "$SYSTEMD_SYSTEM_DIR" ] ; then
 		"$SYSTEMCTL" disable zapret-list-update.timer
 		"$SYSTEMCTL" stop zapret-list-update.timer
-		ln -fs "$EXEDIR/init.d/systemd/zapret-list-update.service" "$SYSTEMD_SYSTEM_DIR"
-		ln -fs "$EXEDIR/init.d/systemd/zapret-list-update.timer" "$SYSTEMD_SYSTEM_DIR"
+		cp -f "$EXEDIR/init.d/systemd/zapret-list-update.service" "$SYSTEMD_SYSTEM_DIR"
+		cp -f "$EXEDIR/init.d/systemd/zapret-list-update.timer" "$SYSTEMD_SYSTEM_DIR"
 		"$SYSTEMCTL" daemon-reload
 		"$SYSTEMCTL" enable zapret-list-update.timer || {
 			echo could not enable zapret-list-update.timer

ip2net/Makefile

@@ -1,5 +1,5 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os -flto=auto
 CFLAGS_BSD = -Wno-address-of-packed-member
 CFLAGS_WIN = -static
 LIBS = 
@@ -9,7 +9,9 @@ SRC_FILES = ip2net.c qsort.c
 all: ip2net
 
 ip2net: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+android: ip2net
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)

mdig/Makefile

@@ -1,15 +1,19 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os
 CFLAGS_BSD = -Wno-address-of-packed-member
 CFLAGS_WIN = -static
 LIBS = -lpthread
+LIBS_ANDROID =
 LIBS_WIN = -lws2_32
 SRC_FILES = *.c
 
 all: mdig
 
 mdig: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+android: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_ANDROID)
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)

mdig/mdig.c

@@ -12,7 +12,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <stdbool.h>
-#include <unistd.h>
 #include <pthread.h>
 #include <getopt.h>
 #ifdef _WIN32
@@ -21,7 +20,9 @@
 #include <winsock2.h>
 #include <ws2ipdef.h>
 #include <ws2tcpip.h>
+#include <fcntl.h>
 #else
+#include <unistd.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
 #include <netinet/in.h>
@@ -364,6 +365,9 @@ int dns_make_query(const char *dom, char family)
 		fprintf(stderr, "could not make DNS query\n");
 		return 1;
 	}
+#ifdef _WIN32
+	_setmode(_fileno(stdout), _O_BINARY);
+#endif
 	if (fwrite(q,l,1,stdout)!=1)
 	{
 		fprintf(stderr, "could not write DNS query blob to stdout\n");
@@ -420,8 +424,11 @@ bool dns_parse_print(const uint8_t *a, size_t len)
 }
 int dns_parse_query()
 {
-	uint8_t a[1500];
+	uint8_t a[8192];
 	size_t l;
+#ifdef _WIN32
+	_setmode(_fileno(stdin), _O_BINARY);
+#endif
 	l = fread(a,1,sizeof(a),stdin);
 	if (!l || !feof(stdin))
 	{

nfq/BSDmakefile

@@ -1,12 +1,12 @@
 CC ?= cc
-CFLAGS += -std=gnu99 -s -O3 -Wno-address-of-packed-member
+CFLAGS += -std=gnu99 -s -Os -Wno-address-of-packed-member -flto=auto
 LIBS = -lz
 SRC_FILES = *.c crypto/*.c
 
 all: dvtws
 
 dvtws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS)
 
 clean:
 	rm -f dvtws

nfq/Makefile

@@ -1,11 +1,10 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os -flto=auto
 CFLAGS_BSD = -Wno-address-of-packed-member
-CFLAGS_MAC = -mmacosx-version-min=10.8
 CFLAGS_CYGWIN = -Wno-address-of-packed-member -static
 LIBS_LINUX = -lnetfilter_queue -lnfnetlink -lz
 LIBS_BSD = -lz
-LIBS_CYGWIN = -lz -Lwindows/windivert -Iwindows -lwlanapi -lole32 -loleaut32 -luuid
+LIBS_CYGWIN = -lz -Lwindows/windivert -Iwindows -lwlanapi -lole32 -loleaut32
 LIBS_CYGWIN32 = -lwindivert32
 LIBS_CYGWIN64 = -lwindivert64
 RES_CYGWIN32 = windows/res/32/winmanifest.o windows/res/32/winicon.o
@@ -15,7 +14,9 @@ SRC_FILES = *.c crypto/*.c
 all: nfqws
 
 nfqws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+
+android: nfqws
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS_BSD)

nfq/conntrack.c

@@ -12,29 +12,6 @@ static void ut_oom_recover(void *elem)
 	oom = true;
 }
 
-const char *l7proto_str(t_l7proto l7)
-{
-	switch(l7)
-	{
-		case HTTP: return "http";
-		case TLS: return "tls";
-		case QUIC: return "quic";
-		case WIREGUARD: return "wireguard";
-		case DHT: return "dht";
-		default: return "unknown";
-	}
-}
-bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
-{
-	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
-		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
-		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
-		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
-		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
-		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
-}
-
-
 static const char *connstate_s[]={"SYN","ESTABLISHED","FIN"};
 
 static void connswap(const t_conn *c, t_conn *c2)

nfq/conntrack.h

@@ -4,8 +4,6 @@
 // this conntrack is not bullet-proof
 // its designed to satisfy dpi desync needs only
 
-#include "packet_queue.h"
-
 #include <stdbool.h>
 #include <stdint.h>
 #include <ctype.h>
@@ -19,6 +17,8 @@
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 
+#include "packet_queue.h"
+#include "protocol.h"
 
 //#define HASH_BLOOM 20
 #define HASH_NONFATAL_OOM 1
@@ -53,16 +53,6 @@ typedef struct {
 // FIN - FIN or RST received
 typedef enum {SYN=0, ESTABLISHED, FIN} t_connstate;
 
-typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
-#define L7_PROTO_HTTP		0x00000001
-#define L7_PROTO_TLS		0x00000002
-#define L7_PROTO_QUIC		0x00000004
-#define L7_PROTO_WIREGUARD	0x00000008
-#define L7_PROTO_DHT		0x00000010
-#define L7_PROTO_UNKNOWN	0x80000000
-const char *l7proto_str(t_l7proto l7);
-bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
-
 typedef struct
 {
 	bool bCheckDone, bCheckResult, bCheckExcluded; // hostlist check result cache

nfq/darkmagic.c

@@ -163,7 +163,7 @@ static void fill_udphdr(struct udphdr *udp, uint16_t nsport, uint16_t ndport, ui
 	udp->uh_sum = 0;
 }
 
-static void fill_iphdr(struct ip *ip, const struct in_addr *src, const struct in_addr *dst, uint16_t pktlen, uint8_t proto, uint8_t ttl, uint8_t tos)
+static void fill_iphdr(struct ip *ip, const struct in_addr *src, const struct in_addr *dst, uint16_t pktlen, uint8_t proto, uint8_t ttl, uint8_t tos, uint16_t ip_id)
 {
 	ip->ip_tos = tos;
 	ip->ip_sum = 0;
@@ -171,7 +171,7 @@ static void fill_iphdr(struct ip *ip, const struct in_addr *src, const struct in
 	ip->ip_v = 4;
 	ip->ip_hl = 5;
 	ip->ip_len = htons(pktlen);
-	ip->ip_id = 0;
+	ip->ip_id = ip_id;
 	ip->ip_ttl = ttl;
 	ip->ip_p = proto;
 	ip->ip_src = *src;
@@ -196,6 +196,7 @@ bool prepare_tcp_segment4(
 	uint32_t *timestamps,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -211,7 +212,7 @@ bool prepare_tcp_segment4(
 	struct tcphdr *tcp = (struct tcphdr*)(ip+1);
 	uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen;
 
-	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, ttl, tos);
+	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, ttl, tos, ip_id);
 	fill_tcphdr(tcp,fooling,tcp_flags,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len);
 
 	memcpy(payload,data,len);
@@ -314,7 +315,9 @@ bool prepare_tcp_segment(
 	uint8_t scale_factor,
 	uint32_t *timestamps,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -322,7 +325,7 @@ bool prepare_tcp_segment(
 	uint8_t *buf, size_t *buflen)
 {
 	return (src->sa_family==AF_INET && dst->sa_family==AF_INET) ?
-		prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,tos,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :
+		prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,tos,ip_id,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :
 		(src->sa_family==AF_INET6 && dst->sa_family==AF_INET6) ?
 		prepare_tcp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,tcp_flags,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,flow_label,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :
 		false;
@@ -334,6 +337,7 @@ bool prepare_udp_segment4(
 	const struct sockaddr_in *src, const struct sockaddr_in *dst,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -357,7 +361,7 @@ bool prepare_udp_segment4(
 	uint8_t *payload = (uint8_t*)(udp+1);
 
 
-	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_UDP, ttl, tos);
+	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_UDP, ttl, tos, ip_id);
 	fill_udphdr(udp, src->sin_port, dst->sin_port, datalen);
 
 	memcpy(payload,data,len);
@@ -463,7 +467,9 @@ bool prepare_udp_segment6(
 bool prepare_udp_segment(
 	const struct sockaddr *src, const struct sockaddr *dst,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -471,7 +477,7 @@ bool prepare_udp_segment(
 	uint8_t *buf, size_t *buflen)
 {
 	return (src->sa_family==AF_INET && dst->sa_family==AF_INET) ?
-		prepare_udp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,ttl,tos,fooling,padding,padding_size,padlen,data,len,buf,buflen) :
+		prepare_udp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,ttl,tos,ip_id,fooling,padding,padding_size,padlen,data,len,buf,buflen) :
 		(src->sa_family==AF_INET6 && dst->sa_family==AF_INET6) ?
 		prepare_udp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,ttl,flow_label,fooling,padding,padding_size,padlen,data,len,buf,buflen) :
 		false;
@@ -869,60 +875,49 @@ void proto_skip_ipv6(uint8_t **data, size_t *len, uint8_t *proto_type, uint8_t *
 	// we have garbage
 }
 
-void proto_dissect_l3l4(
-	uint8_t *data, size_t len,
-	struct ip **ip, struct ip6_hdr **ip6,
-	uint8_t *proto,
-	struct tcphdr **tcp,
-	struct udphdr **udp,
-	size_t *transport_len,
-	uint8_t **data_payload, size_t *len_payload)
+void proto_dissect_l3l4(uint8_t *data, size_t len,struct dissect *dis)
 {
-	*ip = NULL;
-	*ip6 = NULL;
-	*proto = 0;
-	*tcp = NULL;
-	*transport_len = 0;
-	*udp = NULL;
-	*data_payload = NULL;
-	*len_payload = 0;
-	
+	memset(dis,0,sizeof(*dis));
+
+	dis->data_pkt = data;
+	dis->len_pkt = len;
+
 	if (proto_check_ipv4(data, len))
 	{
-		*ip = (struct ip *) data;
-		*proto = (*ip)->ip_p;
+		dis->ip = (struct ip *) data;
+		dis->proto = dis->ip->ip_p;
 		proto_skip_ipv4(&data, &len);
 	}
 	else if (proto_check_ipv6(data, len))
 	{
-		*ip6 = (struct ip6_hdr *) data;
-		proto_skip_ipv6(&data, &len, proto, NULL);
+		dis->ip6 = (struct ip6_hdr *) data;
+		proto_skip_ipv6(&data, &len, &dis->proto, NULL);
 	}
 	else
 	{
 		return;
 	}
 
-	if (*proto==IPPROTO_TCP && proto_check_tcp(data, len))
+	if (dis->proto==IPPROTO_TCP && proto_check_tcp(data, len))
 	{
-		*tcp = (struct tcphdr *) data;
-		*transport_len = len;
+		dis->tcp = (struct tcphdr *) data;
+		dis->transport_len = len;
 
 		proto_skip_tcp(&data, &len);
 
-		*data_payload = data;
-		*len_payload = len;
+		dis->data_payload = data;
+		dis->len_payload = len;
 
 	}
-	else if (*proto==IPPROTO_UDP && proto_check_udp(data, len))
+	else if (dis->proto==IPPROTO_UDP && proto_check_udp(data, len))
 	{
-		*udp = (struct udphdr *) data;
-		*transport_len = len;
-		
+		dis->udp = (struct udphdr *) data;
+		dis->transport_len = len;
+
 		proto_skip_udp(&data, &len);
 
-		*data_payload = data;
-		*len_payload = len;
+		dis->data_payload = data;
+		dis->len_payload = len;
 	}
 }
 
@@ -1882,3 +1877,34 @@ void verdict_udp_csum_fix(uint8_t verdict, struct udphdr *udphdr, size_t transpo
 			udp_fix_checksum(udphdr,transport_len,ip,ip6hdr);
 	}
 }
+
+void dbgprint_socket_buffers(int fd)
+{
+	if (params.debug)
+	{
+		int v;
+		socklen_t sz;
+		sz = sizeof(int);
+		if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz))
+			DLOG("fd=%d SO_RCVBUF=%d\n", fd, v);
+			sz = sizeof(int);
+		if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz))
+			DLOG("fd=%d SO_SNDBUF=%d\n", fd, v);
+	}
+}
+bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
+{
+	DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf);
+	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0)
+	{
+		DLOG_PERROR("setsockopt (SO_RCVBUF)");
+		return false;
+	}
+	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0)
+	{
+		DLOG_PERROR("setsockopt (SO_SNDBUF)");
+		return false;
+	}
+	dbgprint_socket_buffers(fd);
+	return true;
+}

nfq/darkmagic.h

@@ -22,6 +22,7 @@
 #endif
 
 #ifdef __CYGWIN__
+#define INITGUID
 #include "windivert/windivert.h"
 #endif
 
@@ -60,6 +61,7 @@ uint32_t net16_add(uint16_t netorder_value, uint16_t cpuorder_increment);
 #define VERDICT_NOCSUM	4
 
 #define IP4_TOS(ip_header) (ip_header ? ip_header->ip_tos : 0)
+#define IP4_IP_ID(ip_header) (ip_header ? ip_header->ip_id : 0)
 #define IP6_FLOW(ip6_header) (ip6_header ? ip6_header->ip6_ctlun.ip6_un1.ip6_un1_flow : 0)
 
 // seq and wsize have network byte order
@@ -72,6 +74,7 @@ bool prepare_tcp_segment4(
 	uint32_t *timestamps,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -99,7 +102,9 @@ bool prepare_tcp_segment(
 	uint8_t scale_factor,
 	uint32_t *timestamps,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -111,6 +116,7 @@ bool prepare_udp_segment4(
 	const struct sockaddr_in *src, const struct sockaddr_in *dst,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -128,7 +134,9 @@ bool prepare_udp_segment6(
 bool prepare_udp_segment(
 	const struct sockaddr *src, const struct sockaddr *dst,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -210,14 +218,20 @@ bool proto_check_tcp(const uint8_t *data, size_t len);
 void proto_skip_tcp(uint8_t **data, size_t *len);
 bool proto_check_udp(const uint8_t *data, size_t len);
 void proto_skip_udp(uint8_t **data, size_t *len);
-void proto_dissect_l3l4(
-	uint8_t *data, size_t len,
-	struct ip **ip, struct ip6_hdr **ip6,
-	uint8_t *proto,
-	struct tcphdr **tcp,
-	struct udphdr **udp,
-	size_t *transport_len,
-	uint8_t **data_payload, size_t *len_payload);
+struct dissect
+{
+	uint8_t *data_pkt;
+	size_t len_pkt;
+	struct ip *ip;
+	struct ip6_hdr *ip6;
+	uint8_t proto;
+	struct tcphdr *tcp;
+	struct udphdr *udp;
+	size_t transport_len;
+	uint8_t *data_payload;
+	size_t len_payload;
+};
+void proto_dissect_l3l4(uint8_t *data, size_t len,struct dissect *dis);
 
 bool tcp_synack_segment(const struct tcphdr *tcphdr);
 bool tcp_syn_segment(const struct tcphdr *tcphdr);
@@ -241,3 +255,6 @@ void do_nat(bool bOutbound, struct ip *ip, struct ip6_hdr *ip6, struct tcphdr *t
 
 void verdict_tcp_csum_fix(uint8_t verdict, struct tcphdr *tcphdr, size_t transport_len, struct ip *ip, struct ip6_hdr *ip6hdr);
 void verdict_udp_csum_fix(uint8_t verdict, struct udphdr *udphdr, size_t transport_len, struct ip *ip, struct ip6_hdr *ip6hdr);
+
+void dbgprint_socket_buffers(int fd);
+bool set_socket_buffers(int fd, int rcvbuf, int sndbuf);

nfq/desync.h

@@ -28,10 +28,10 @@ enum dpi_desync_mode {
 	DESYNC_RSTACK,
 	DESYNC_SYNACK,
 	DESYNC_SYNDATA,
-	DESYNC_DISORDER,
-	DESYNC_DISORDER2,
-	DESYNC_SPLIT,
-	DESYNC_SPLIT2,
+	DESYNC_FAKEDSPLIT,
+	DESYNC_FAKEDDISORDER,
+	DESYNC_MULTISPLIT,
+	DESYNC_MULTIDISORDER,
 	DESYNC_IPFRAG2,
 	DESYNC_HOPBYHOP,
 	DESYNC_DESTOPT,

nfq/helpers.c

@@ -5,11 +5,31 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <stdlib.h>
 #include <ctype.h>
 #include <sys/stat.h>
 #include <libgen.h>
 
-#include "params.h"
+int unique_size_t(size_t *pu, int ct)
+{
+	int i, j, u;
+	for (i = j = 0; j < ct; i++)
+	{
+		u = pu[j++];
+		for (; j < ct && pu[j] == u; j++);
+		pu[i] = u;
+	}
+	return i;
+}
+static int cmp_size_t(const void * a, const void * b)
+{
+	return *(size_t*)a < *(size_t*)b ? -1 : *(size_t*)a > *(size_t*)b;
+}
+void qsort_size_t(size_t *array,size_t ct)
+{
+	qsort(array,ct,sizeof(*array),cmp_size_t);
+}
+
 
 void rtrim(char *s)
 {
@@ -43,22 +63,6 @@ char *strncasestr(const char *s, const char *find, size_t slen)
 	return (char *)s;
 }
 
-void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
-{
-	size_t k;
-	bool bcut = false;
-	if (size > limit)
-	{
-		size = limit;
-		bcut = true;
-	}
-	if (!size) return;
-	for (k = 0; k < size; k++) DLOG("%02X ", data[k]);
-	DLOG(bcut ? "... : " : ": ");
-	for (k = 0; k < size; k++) DLOG("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
-	if (bcut) DLOG(" ...");
-}
-
 
 bool load_file(const char *filename, void *buffer, size_t *buffer_size)
 {
@@ -199,38 +203,6 @@ uint16_t saport(const struct sockaddr *sa)
 		     sa->sa_family==AF_INET6 ? ((struct sockaddr_in6*)sa)->sin6_port : 0);
 }
 
-void dbgprint_socket_buffers(int fd)
-{
-	if (params.debug)
-	{
-		int v;
-		socklen_t sz;
-		sz = sizeof(int);
-		if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz))
-			DLOG("fd=%d SO_RCVBUF=%d\n", fd, v);
-			sz = sizeof(int);
-		if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz))
-			DLOG("fd=%d SO_SNDBUF=%d\n", fd, v);
-	}
-}
-bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
-{
-	DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf);
-	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0)
-	{
-		DLOG_PERROR("setsockopt (SO_RCVBUF)");
-		close(fd);
-		return false;
-	}
-	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0)
-	{
-		DLOG_PERROR("setsockopt (SO_SNDBUF)");
-		close(fd);
-		return false;
-	}
-	dbgprint_socket_buffers(fd);
-	return true;
-}
 
 uint64_t pntoh64(const void *p)
 {
@@ -395,14 +367,14 @@ void fill_random_az09(uint8_t *p,size_t sz)
 	}
 }
 
-bool cd_to_exe_dir(const char *argv0)
+bool set_env_exedir(const char *argv0)
 {
 	char *s,*d;
 	bool bOK=false;
 	if ((s = strdup(argv0)))
 	{
 		if ((d = dirname(s)))
-			bOK = !chdir(d);
+			setenv("EXEDIR",s,1);
 		free(s);
 	}
 	return bOK;

nfq/helpers.h

@@ -17,11 +17,13 @@ typedef union
 	char _align[32];		// force 16-byte alignment for ip6_and int128 ops
 } sockaddr_in46;
 
+int unique_size_t(size_t *pu, int ct);
+void qsort_size_t(size_t *array,size_t ct);
+
 void rtrim(char *s);
 void replace_char(char *s, char from, char to);
 char *strncasestr(const char *s,const char *find, size_t slen);
 
-void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);
 bool load_file(const char *filename,void *buffer,size_t *buffer_size);
 bool load_file_nonempty(const char *filename,void *buffer,size_t *buffer_size);
 bool save_file(const char *filename, const void *buffer, size_t buffer_size);
@@ -37,9 +39,6 @@ uint16_t saport(const struct sockaddr *sa);
 
 bool seq_within(uint32_t s, uint32_t s1, uint32_t s2);
 
-void dbgprint_socket_buffers(int fd);
-bool set_socket_buffers(int fd, int rcvbuf, int sndbuf);
-
 uint64_t pntoh64(const void *p);
 void phton64(uint8_t *p, uint64_t v);
 
@@ -76,7 +75,7 @@ void fill_random_bytes(uint8_t *p,size_t sz);
 void fill_random_az(uint8_t *p,size_t sz);
 void fill_random_az09(uint8_t *p,size_t sz);
 
-bool cd_to_exe_dir(const char *argv0);
+bool set_env_exedir(const char *argv0);
 
 
 struct cidr4

nfq/nfqws.c

@@ -552,7 +552,7 @@ static bool parse_ws_scale_factor(char *s, uint16_t *wsize, uint8_t *wscale)
 
 
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 static void cleanup_args()
 {
 	wordfree(&params.wexp);
@@ -561,7 +561,7 @@ static void cleanup_args()
 
 static void cleanup_params(void)
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	cleanup_args();
 #endif
 
@@ -673,10 +673,7 @@ static bool parse_l7_list(char *opt, uint32_t *l7)
 			*l7 |= L7_PROTO_UNKNOWN;
 		else return false;
 
-		if (e)
-		{
-			*e++=c;
-		}
+		if (e) *e++=c;
 		p = e;
 	}
 	return true;
@@ -723,15 +720,151 @@ static bool wf_make_l3(char *opt, bool *ipv4, bool *ipv6)
 			*ipv6 = true;
 		else return false;
 
-		if (e)
-		{
-			*e++=c;
-		}
+		if (e) *e++=c;
 		p = e;
 	}
 	return true;
 }
 
+static bool parse_httpreqpos(const char *s, struct proto_pos *sp)
+{
+	if (!strcmp(s, "method"))
+	{
+		sp->marker = PM_HTTP_METHOD;
+		sp->pos=2;
+	}
+	else if (!strcmp(s, "host"))
+	{
+		sp->marker = PM_HOST;
+		sp->pos=1;
+	}
+	else
+		return false;
+	return true;
+}
+static bool parse_tlspos(const char *s, struct proto_pos *sp)
+{
+	if (!strcmp(s, "sni"))
+	{
+		sp->marker = PM_HOST;
+		sp->pos=1;
+	}
+	else if (!strcmp(s, "sniext"))
+	{
+		sp->marker = PM_SNI_EXT;
+		sp->pos=1;
+	}
+	else if (!strcmp(s, "snisld"))
+	{
+		sp->marker = PM_HOST_MIDSLD;
+		sp->pos=0;
+	}
+	else
+		return false;
+	return true;
+}
+
+static bool parse_int16(const char *p, int16_t *v)
+{
+	if (*p=='+' || *p=='-' || *p>='0' && *p<='9')
+	{
+		int i = atoi(p);
+		*v = (int16_t)i;
+		return *v==i; // check overflow
+	}
+	return false;
+}
+static bool parse_posmarker(const char *opt, uint8_t *posmarker)
+{
+	if (!strcmp(opt,"host"))
+		*posmarker = PM_HOST;
+	else if (!strcmp(opt,"endhost"))
+		*posmarker = PM_HOST_END;
+	else if (!strcmp(opt,"sld"))
+		*posmarker = PM_HOST_SLD;
+	else if (!strcmp(opt,"midsld"))
+		*posmarker = PM_HOST_MIDSLD;
+	else if (!strcmp(opt,"endsld"))
+		*posmarker = PM_HOST_ENDSLD;
+	else if (!strcmp(opt,"method"))
+		*posmarker = PM_HTTP_METHOD;
+	else if (!strcmp(opt,"sniext"))
+		*posmarker = PM_SNI_EXT;
+	else
+		return false;
+	return true;
+}
+static bool parse_split_pos(char *opt, struct proto_pos *split)
+{
+	if (parse_int16(opt,&split->pos))
+	{
+		split->marker = PM_ABS;
+		return !!split->pos;
+	}
+	else
+	{
+		char c,*p=opt;
+		bool b;
+
+		for (; *opt && *opt!='+' && *opt!='-'; opt++);
+		c=*opt; *opt=0;
+		b=parse_posmarker(p,&split->marker);
+		*opt=c;
+		if (!b) return false;
+		if (*opt)
+			return parse_int16(opt,&split->pos);
+		else
+			split->pos = 0;
+	}
+	return true;
+}
+static bool parse_split_pos_list(char *opt, struct proto_pos *splits, int splits_size, int *split_count)
+{
+	char c,*e,*p;
+
+	for (p=opt, *split_count=0 ; p && *split_count<splits_size ; (*split_count)++)
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+		if (!parse_split_pos(p,splits+*split_count)) return false;
+		if (e) *e++=c;
+		p = e;
+	}
+	if (p) return false; // too much splits
+	return true;
+}
+static void split_compat(struct desync_profile *dp)
+{
+	if (!dp->split_count)
+	{
+		dp->splits[dp->split_count].marker = PM_ABS;
+		dp->splits[dp->split_count].pos = 2;
+		dp->split_count++;
+	}
+	if ((dp->seqovl.marker!=PM_ABS || dp->seqovl.pos<0) && (dp->desync_mode==DESYNC_FAKEDSPLIT || dp->desync_mode==DESYNC_MULTISPLIT || dp->desync_mode2==DESYNC_FAKEDSPLIT || dp->desync_mode2==DESYNC_MULTISPLIT))
+	{
+		DLOG_ERR("split seqovl supports only absolute positive positions\n");
+		exit_clean(1);
+	}
+}
+
+static void SplitDebug(void)
+{
+	struct desync_profile_list *dpl;
+	const struct desync_profile *dp;
+	LIST_FOREACH(dpl, &params.desync_profiles, next)
+	{
+		dp = &dpl->dp;
+		for(int x=0;x<dp->split_count;x++)
+			DLOG("profile %d multisplit %s %d\n",dp->n,posmarker_name(dp->splits[x].marker),dp->splits[x].pos);
+		if (!PROTO_POS_EMPTY(&dp->seqovl)) DLOG("profile %d seqovl %s %d\n",dp->n,posmarker_name(dp->seqovl.marker),dp->seqovl.pos);
+	}
+}
+
+
 #ifdef __CYGWIN__
 static bool wf_make_pf(char *opt, const char *l4, const char *portname, char *buf, size_t len)
 {
@@ -757,10 +890,7 @@ static bool wf_make_pf(char *opt, const char *l4, const char *portname, char *bu
 		if (n) strncat(buf," or ",len-strlen(buf)-1);
 		strncat(buf, s1, len-strlen(buf)-1);
 
-		if (e)
-		{
-			*e++=c;
-		}
+		if (e) *e++=c;
 		p = e;
 	}
 	strncat(buf, ")", len-strlen(buf)-1);
@@ -855,7 +985,7 @@ static unsigned int hash_jen(const void *data,unsigned int len)
 static void exithelp(void)
 {
 	printf(
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 		" @<config_file>|$<config_file>\t\t\t; read file for options. must be the only argument. other options are ignored.\n\n"
 #endif
 		" --debug=0|1|syslog|@<filename>\n"
@@ -890,6 +1020,7 @@ static void exithelp(void)
 #endif
 		"\nMULTI-STRATEGY:\n"
 		" --new\t\t\t\t\t\t; begin new strategy\n"
+		" --skip\t\t\t\t\t\t; do not use this strategy\n"
 		" --filter-l3=ipv4|ipv6\t\t\t\t; L3 protocol filter. multiple comma separated values allowed.\n"
 		" --filter-tcp=[~]port1[-port2]|*\t\t; TCP port filter. ~ means negation. setting tcp and not setting udp filter denies udp. comma separated list allowed.\n"
 		" --filter-udp=[~]port1[-port2]|*\t\t; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list allowed.\n"
@@ -912,7 +1043,10 @@ static void exithelp(void)
 		" --hostspell\t\t\t\t\t; exact spelling of \"Host\" header. must be 4 chars. default is \"host\"\n"
 		" --hostnospace\t\t\t\t\t; remove space after Host: and add it to User-Agent: to preserve packet size\n"
 		" --domcase\t\t\t\t\t; mix domain case : Host: TeSt.cOm\n"
-		" --dpi-desync=[<mode0>,]<mode>[,<mode2>]\t; try to desync dpi state. modes : synack syndata fake fakeknown rst rstack hopbyhop destopt ipfrag1 disorder disorder2 split split2 ipfrag2 udplen tamper\n"
+		" --methodeol\t\t\t\t\t; add '\\n' before method and remove space from Host:\n"
+		" --dpi-desync=[<mode0>,]<mode>[,<mode2>]\t; try to desync dpi state. modes :\n"
+		"\t\t\t\t\t\t; synack syndata fake fakeknown rst rstack hopbyhop destopt ipfrag1\n"
+		"\t\t\t\t\t\t; multisplit multidisorder fakedsplit fakeddisorder ipfrag2 udplen tamper\n"
 #ifdef __linux__
 		" --dpi-desync-fwmark=<int|0xHEX>\t\t; override fwmark for desync packet. default = 0x%08X (%u)\n"
 #elif defined(SO_USER_COOKIE)
@@ -924,11 +1058,12 @@ static void exithelp(void)
 		" --dpi-desync-autottl6=[<delta>[:<min>[-<max>]]] ; overrides --dpi-desync-autottl for ipv6 only\n"
 		" --dpi-desync-fooling=<mode>[,<mode>]\t\t; can use multiple comma separated values. modes : none md5sig ts badseq badsum datanoack hopbyhop hopbyhop2\n"
 		" --dpi-desync-repeats=<N>\t\t\t; send every desync packet N times\n"
-		" --dpi-desync-skip-nosni=0|1\t\t\t; 1(default)=do not act on ClientHello without SNI (ESNI ?)\n"
-		" --dpi-desync-split-pos=<1..%u>\t\t; data payload split position\n"
-		" --dpi-desync-split-http-req=method|host\t; split at specified logical part of plain http request\n"
-		" --dpi-desync-split-tls=sni|sniext\t\t; split at specified logical part of TLS ClientHello\n"
-		" --dpi-desync-split-seqovl=<int>\t\t; use sequence overlap before first sent original split segment\n"
+		" --dpi-desync-skip-nosni=0|1\t\t\t; 1(default)=do not act on ClientHello without SNI\n"
+		" --dpi-desync-split-pos=N|-N|marker+N|marker-N\t; comma separated list of split positions\n"
+		"\t\t\t\t\t\t; markers: method,host,endhost,sld,endsld,midsld,sniext\n"
+		"\t\t\t\t\t\t; full list is only used by multisplit and multidisorder\n"
+		"\t\t\t\t\t\t; fakedsplit/fakeddisorder use first l7-protocol-compatible parameter if present, first abs value otherwise\n"
+		" --dpi-desync-split-seqovl=N|-N|marker+N|marker-N ; use sequence overlap before first sent original split segment\n"
 		" --dpi-desync-split-seqovl-pattern=<filename>|0xHEX ; pattern for the fake part of overlap\n"
 		" --dpi-desync-ipfrag-pos-tcp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n"
 		" --dpi-desync-ipfrag-pos-udp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n"
@@ -953,7 +1088,6 @@ static void exithelp(void)
 		DPI_DESYNC_FWMARK_DEFAULT,DPI_DESYNC_FWMARK_DEFAULT,
 #endif
 		AUTOTTL_DEFAULT_DELTA,AUTOTTL_DEFAULT_MIN,AUTOTTL_DEFAULT_MAX,
-		DPI_DESYNC_MAX_FAKE_LEN,
 		DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_UDP_DEFAULT,
 		DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_TCP_DEFAULT,
 		BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT,
@@ -967,28 +1101,7 @@ static void exithelp_clean(void)
 	exithelp();
 }
 
-bool parse_httpreqpos(const char *s, enum httpreqpos *pos)
-{
-	if (!strcmp(s, "method"))
-		*pos = httpreqpos_method;
-	else if (!strcmp(s, "host"))
-		*pos = httpreqpos_host;
-	else
-		return false;
-	return true;
-}
-bool parse_tlspos(const char *s, enum tlspos *pos)
-{
-	if (!strcmp(s, "sni"))
-		*pos = tlspos_sni;
-	else if (!strcmp(s, "sniext"))
-		*pos = tlspos_sniext;
-	else
-		return false;
-	return true;
-}
-
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 // no static to not allow optimizer to inline this func (save stack)
 void config_from_file(const char *filename)
 {
@@ -1017,6 +1130,8 @@ void config_from_file(const char *filename)
 
 int main(int argc, char **argv)
 {
+	set_env_exedir(argv[0]);
+
 #ifdef __CYGWIN__
 	if (service_run(argc, argv))
 	{
@@ -1026,7 +1141,7 @@ int main(int argc, char **argv)
 #endif
 	int result, v;
 	int option_index = 0;
-	bool daemon = false;
+	bool daemon = false, bSkip = false;
 	char pidfile[256];
 #ifdef __CYGWIN__
 	char windivert_filter[8192], wf_pf_tcp_src[256], wf_pf_tcp_dst[256], wf_pf_udp_src[256], wf_pf_udp_dst[256], wf_save_file[256];
@@ -1079,7 +1194,7 @@ int main(int argc, char **argv)
 	}
 #endif
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	if (argc>=2 && (argv[1][0]=='@' || argv[1][0]=='$'))
 	{
 		config_from_file(argv[1]+1);
@@ -1114,70 +1229,72 @@ int main(int argc, char **argv)
 		{"hostspell",required_argument,0,0},	// optidx=11
 		{"hostnospace",no_argument,0,0},	// optidx=12
 		{"domcase",no_argument,0,0 },		// optidx=13
-		{"dpi-desync",required_argument,0,0},		// optidx=14
+		{"methodeol",no_argument,0,0 },		// optidx=14
+		{"dpi-desync",required_argument,0,0},		// optidx=15
 #ifdef __linux__
-		{"dpi-desync-fwmark",required_argument,0,0},	// optidx=15
+		{"dpi-desync-fwmark",required_argument,0,0},	// optidx=16
 #elif defined(SO_USER_COOKIE)
-		{"dpi-desync-sockarg",required_argument,0,0},	// optidx=15
+		{"dpi-desync-sockarg",required_argument,0,0},	// optidx=16
 #else
-		{"disabled_argument_4",no_argument,0,0},	// optidx=15
+		{"disabled_argument_4",no_argument,0,0},	// optidx=16
 #endif
-		{"dpi-desync-ttl",required_argument,0,0},	// optidx=16
-		{"dpi-desync-ttl6",required_argument,0,0},	// optidx=17
-		{"dpi-desync-autottl",optional_argument,0,0},	// optidx=18
-		{"dpi-desync-autottl6",optional_argument,0,0},	// optidx=19
-		{"dpi-desync-fooling",required_argument,0,0},	// optidx=20
-		{"dpi-desync-repeats",required_argument,0,0},	// optidx=21
-		{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=22
-		{"dpi-desync-split-pos",required_argument,0,0},// optidx=23
-		{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=24
-		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=25
-		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=26
-		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=27
-		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=28
-		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=29
-		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=30
-		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=31
-		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=32
-		{"dpi-desync-fake-http",required_argument,0,0},// optidx=33
-		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=34
-		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=35
-		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=36
-		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=37
-		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=38
-		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=39
-		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=40
-		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=41
-		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=42
-		{"dpi-desync-cutoff",required_argument,0,0},// optidx=43
-		{"dpi-desync-start",required_argument,0,0},// optidx=43
-		{"hostlist",required_argument,0,0},		// optidx=44
-		{"hostlist-exclude",required_argument,0,0},	// optidx=45
-		{"hostlist-auto",required_argument,0,0},	// optidx=46
-		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=48
-		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=49
-		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=50
-		{"hostlist-auto-debug",required_argument,0,0},	// optidx=51
-		{"new",no_argument,0,0},	// optidx=52
-		{"filter-l3",required_argument,0,0},	// optidx=53
-		{"filter-tcp",required_argument,0,0},	// optidx=54
-		{"filter-udp",required_argument,0,0},	// optidx=55
-		{"filter-l7",required_argument,0,0},	// optidx=56
-		{"ipset",required_argument,0,0},	// optidx=57
-		{"ipset-exclude",required_argument,0,0},// optidx=58
+		{"dpi-desync-ttl",required_argument,0,0},	// optidx=17
+		{"dpi-desync-ttl6",required_argument,0,0},	// optidx=18
+		{"dpi-desync-autottl",optional_argument,0,0},	// optidx=19
+		{"dpi-desync-autottl6",optional_argument,0,0},	// optidx=20
+		{"dpi-desync-fooling",required_argument,0,0},	// optidx=21
+		{"dpi-desync-repeats",required_argument,0,0},	// optidx=22
+		{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=23
+		{"dpi-desync-split-pos",required_argument,0,0},// optidx=24
+		{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=25
+		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=26
+		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=27
+		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=28
+		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=29
+		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=30
+		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=31
+		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=32
+		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=33
+		{"dpi-desync-fake-http",required_argument,0,0},// optidx=34
+		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=35
+		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=36
+		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=37
+		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=38
+		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=39
+		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=40
+		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=41
+		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=42
+		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=43
+		{"dpi-desync-cutoff",required_argument,0,0},// optidx=44
+		{"dpi-desync-start",required_argument,0,0},// optidx=45
+		{"hostlist",required_argument,0,0},		// optidx=46
+		{"hostlist-exclude",required_argument,0,0},	// optidx=47
+		{"hostlist-auto",required_argument,0,0},	// optidx=48
+		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=49
+		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=50
+		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=51
+		{"hostlist-auto-debug",required_argument,0,0},	// optidx=52
+		{"new",no_argument,0,0},	// optidx=53
+		{"skip",no_argument,0,0},	// optidx=54
+		{"filter-l3",required_argument,0,0},	// optidx=55
+		{"filter-tcp",required_argument,0,0},	// optidx=56
+		{"filter-udp",required_argument,0,0},	// optidx=57
+		{"filter-l7",required_argument,0,0},	// optidx=58
+		{"ipset",required_argument,0,0},	// optidx=59
+		{"ipset-exclude",required_argument,0,0},// optidx=60
 #ifdef __linux__
-		{"bind-fix4",no_argument,0,0},		// optidx=59
-		{"bind-fix6",no_argument,0,0},		// optidx=60
+		{"bind-fix4",no_argument,0,0},		// optidx=61
+		{"bind-fix6",no_argument,0,0},		// optidx=62
 #elif defined(__CYGWIN__)
-		{"wf-iface",required_argument,0,0},	// optidx=59
-		{"wf-l3",required_argument,0,0},	// optidx=60
-		{"wf-tcp",required_argument,0,0},	// optidx=61
-		{"wf-udp",required_argument,0,0},	// optidx=62
-		{"wf-raw",required_argument,0,0},	// optidx=63
-		{"wf-save",required_argument,0,0},	// optidx=64
-		{"ssid-filter",required_argument,0,0},	// optidx=65
-		{"nlm-filter",required_argument,0,0},	// optidx=66
-		{"nlm-list",optional_argument,0,0},	// optidx=67
+		{"wf-iface",required_argument,0,0},	// optidx=61
+		{"wf-l3",required_argument,0,0},	// optidx=62
+		{"wf-tcp",required_argument,0,0},	// optidx=63
+		{"wf-udp",required_argument,0,0},	// optidx=64
+		{"wf-raw",required_argument,0,0},	// optidx=65
+		{"wf-save",required_argument,0,0},	// optidx=66
+		{"ssid-filter",required_argument,0,0},	// optidx=67
+		{"nlm-filter",required_argument,0,0},	// optidx=68
+		{"nlm-list",optional_argument,0,0},	// optidx=69
 #endif
 		{NULL,0,NULL,0}
 	};
@@ -1200,10 +1317,6 @@ int main(int argc, char **argv)
 						fprintf(stderr, "cannot create %s\n", params.debug_logfile);
 						exit_clean(1);
 					}
-#ifndef __CYGWIN__
-					if (params.droproot && chown(params.debug_logfile, params.uid, -1))
-						fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
-#endif
 					params.debug = true;
 					params.debug_target = LOG_TARGET_FILE;
 				}
@@ -1313,12 +1426,25 @@ int main(int argc, char **argv)
 			memcpy(dp->hostspell, optarg, 4);
 			break;
 		case 12: /* hostnospace */
+			if (dp->methodeol)
+			{
+				DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
+				exit_clean(1);
+			}
 			dp->hostnospace = true;
 			break;
 		case 13: /* domcase */
 			dp->domcase = true;
 			break;
-		case 14: /* dpi-desync */
+		case 14: /* methodeol */
+			if (dp->hostnospace)
+			{
+				DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
+				exit_clean(1);
+			}
+			dp->methodeol = true;
+			break;
+		case 15: /* dpi-desync */
 			{
 				char *mode=optarg,*mode2,*mode3;
 				mode2 = mode ? strchr(mode,',') : NULL;
@@ -1364,7 +1490,7 @@ int main(int argc, char **argv)
 			}
 			break;
 #ifndef __CYGWIN__
-		case 15: /* dpi-desync-fwmark/dpi-desync-sockarg */
+		case 16: /* dpi-desync-fwmark/dpi-desync-sockarg */
 #if defined(__linux__) || defined(SO_USER_COOKIE)
 			params.desync_fwmark = 0;
 			if (sscanf(optarg, "0x%X", &params.desync_fwmark)<=0) sscanf(optarg, "%u", &params.desync_fwmark);
@@ -1379,27 +1505,27 @@ int main(int argc, char **argv)
 #endif
 			break;
 #endif
-		case 16: /* dpi-desync-ttl */
+		case 17: /* dpi-desync-ttl */
 			dp->desync_ttl = (uint8_t)atoi(optarg);
 			break;
-		case 17: /* dpi-desync-ttl6 */
+		case 18: /* dpi-desync-ttl6 */
 			dp->desync_ttl6 = (uint8_t)atoi(optarg);
 			break;
-		case 18: /* dpi-desync-autottl */
+		case 19: /* dpi-desync-autottl */
 			if (!parse_autottl(optarg, &dp->desync_autottl))
 			{
 				DLOG_ERR("dpi-desync-autottl value error\n");
 				exit_clean(1);
 			}
 			break;
-		case 19: /* dpi-desync-autottl6 */
+		case 20: /* dpi-desync-autottl6 */
 			if (!parse_autottl(optarg, &dp->desync_autottl6))
 			{
 				DLOG_ERR("dpi-desync-autottl6 value error\n");
 				exit_clean(1);
 			}
 			break;
-		case 20: /* dpi-desync-fooling */
+		case 21: /* dpi-desync-fooling */
 			{
 				char *e,*p = optarg;
 				while (p)
@@ -1434,45 +1560,71 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 21: /* dpi-desync-repeats */
+		case 22: /* dpi-desync-repeats */
 			if (sscanf(optarg,"%u",&dp->desync_repeats)<1 || !dp->desync_repeats || dp->desync_repeats>20)
 			{
 				DLOG_ERR("dpi-desync-repeats must be within 1..20\n");
 				exit_clean(1);
 			}
 			break;
-		case 22: /* dpi-desync-skip-nosni */
+		case 23: /* dpi-desync-skip-nosni */
 			dp->desync_skip_nosni = !optarg || atoi(optarg);
 			break;
-		case 23: /* dpi-desync-split-pos */
-			if (sscanf(optarg,"%u",&dp->desync_split_pos)<1 || dp->desync_split_pos<1)
+		case 24: /* dpi-desync-split-pos */
 			{
-				DLOG_ERR("dpi-desync-split-pos is not valid\n");
-				exit_clean(1);
+				int ct;
+				if (!parse_split_pos_list(optarg,dp->splits+dp->split_count,MAX_SPLITS-dp->split_count,&ct))
+				{
+					DLOG_ERR("could not parse split pos list or too much positions (before parsing - %u, max - %u) : %s\n",dp->split_count,MAX_SPLITS,optarg);
+					exit_clean(1);
+				}
+				dp->split_count += ct;
 			}
 			break;
-		case 24: /* dpi-desync-split-http-req */
-			if (!parse_httpreqpos(optarg, &dp->desync_split_http_req))
+		case 25: /* dpi-desync-split-http-req */
+			// obsolete arg
+			DLOG_CONDUP("WARNING ! --dpi-desync-split-http-req is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
+			if (dp->split_count>=MAX_SPLITS)
+			{
+				DLOG_ERR("Too much splits. max splits: %u\n",MAX_SPLITS);
+				exit_clean(1);
+			}
+			if (!parse_httpreqpos(optarg, dp->splits + dp->split_count))
 			{
 				DLOG_ERR("Invalid argument for dpi-desync-split-http-req\n");
 				exit_clean(1);
 			}
+			dp->split_count++;
 			break;
-		case 25: /* dpi-desync-split-tls */
-			if (!parse_tlspos(optarg, &dp->desync_split_tls))
+		case 26: /* dpi-desync-split-tls */
+			// obsolete arg
+			DLOG_CONDUP("WARNING ! --dpi-desync-split-tls is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
+			if (dp->split_count>=MAX_SPLITS)
+			{
+				DLOG_ERR("Too much splits. max splits: %u\n",MAX_SPLITS);
+				exit_clean(1);
+			}
+			if (!parse_tlspos(optarg, dp->splits + dp->split_count))
 			{
 				DLOG_ERR("Invalid argument for dpi-desync-split-tls\n");
 				exit_clean(1);
 			}
+			dp->split_count++;
 			break;
-		case 26: /* dpi-desync-split-seqovl */
-			if (sscanf(optarg,"%u",&dp->desync_seqovl)<1)
+		case 27: /* dpi-desync-split-seqovl */
+			if (!strcmp(optarg,"0"))
 			{
-				DLOG_ERR("dpi-desync-split-seqovl is not valid\n");
+				// allow zero = disable seqovl
+				dp->seqovl.marker=PM_ABS;
+				dp->seqovl.pos=0;
+			}
+			else if (!parse_split_pos(optarg, &dp->seqovl))
+			{
+				DLOG_ERR("Invalid argument for dpi-desync-split-seqovl\n");
 				exit_clean(1);
 			}
 			break;
-		case 27: /* dpi-desync-split-seqovl-pattern */
+		case 28: /* dpi-desync-split-seqovl-pattern */
 			{
 				char buf[sizeof(dp->seqovl_pattern)];
 				size_t sz=sizeof(buf);
@@ -1480,7 +1632,7 @@ int main(int argc, char **argv)
 				fill_pattern(dp->seqovl_pattern,sizeof(dp->seqovl_pattern),buf,sz);
 			}
 			break;
-		case 28: /* dpi-desync-ipfrag-pos-tcp */
+		case 29: /* dpi-desync-ipfrag-pos-tcp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_tcp)<1 || dp->desync_ipfrag_pos_tcp<1 || dp->desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1492,7 +1644,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 29: /* dpi-desync-ipfrag-pos-udp */
+		case 30: /* dpi-desync-ipfrag-pos-udp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_udp)<1 || dp->desync_ipfrag_pos_udp<1 || dp->desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1504,63 +1656,63 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 30: /* dpi-desync-badseq-increments */
+		case 31: /* dpi-desync-badseq-increments */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment))
 			{
 				DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 31: /* dpi-desync-badack-increment */
+		case 32: /* dpi-desync-badack-increment */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment))
 			{
 				DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 32: /* dpi-desync-any-protocol */
+		case 33: /* dpi-desync-any-protocol */
 			dp->desync_any_proto = !optarg || atoi(optarg);
 			break;
-		case 33: /* dpi-desync-fake-http */
+		case 34: /* dpi-desync-fake-http */
 			dp->fake_http_size = sizeof(dp->fake_http);
 			load_file_or_exit(optarg,dp->fake_http,&dp->fake_http_size);
 			break;
-		case 34: /* dpi-desync-fake-tls */
+		case 35: /* dpi-desync-fake-tls */
 			dp->fake_tls_size = sizeof(dp->fake_tls);
 			load_file_or_exit(optarg,dp->fake_tls,&dp->fake_tls_size);
 			break;
-		case 35: /* dpi-desync-fake-unknown */
+		case 36: /* dpi-desync-fake-unknown */
 			dp->fake_unknown_size = sizeof(dp->fake_unknown);
 			load_file_or_exit(optarg,dp->fake_unknown,&dp->fake_unknown_size);
 			break;
-		case 36: /* dpi-desync-fake-syndata */
+		case 37: /* dpi-desync-fake-syndata */
 			dp->fake_syndata_size = sizeof(dp->fake_syndata);
 			load_file_or_exit(optarg,dp->fake_syndata,&dp->fake_syndata_size);
 			break;
-		case 37: /* dpi-desync-fake-quic */
+		case 38: /* dpi-desync-fake-quic */
 			dp->fake_quic_size = sizeof(dp->fake_quic);
 			load_file_or_exit(optarg,dp->fake_quic,&dp->fake_quic_size);
 			break;
-		case 38: /* dpi-desync-fake-wireguard */
+		case 39: /* dpi-desync-fake-wireguard */
 			dp->fake_wg_size = sizeof(dp->fake_wg);
 			load_file_or_exit(optarg,dp->fake_wg,&dp->fake_wg_size);
 			break;
-		case 39: /* dpi-desync-fake-dht */
+		case 40: /* dpi-desync-fake-dht */
 			dp->fake_dht_size = sizeof(dp->fake_dht);
 			load_file_or_exit(optarg,dp->fake_dht,&dp->fake_dht_size);
 			break;
-		case 40: /* dpi-desync-fake-unknown-udp */
+		case 41: /* dpi-desync-fake-unknown-udp */
 			dp->fake_unknown_udp_size = sizeof(dp->fake_unknown_udp);
 			load_file_or_exit(optarg,dp->fake_unknown_udp,&dp->fake_unknown_udp_size);
 			break;
-		case 41: /* dpi-desync-udplen-increment */
+		case 42: /* dpi-desync-udplen-increment */
 			if (sscanf(optarg,"%d",&dp->udplen_increment)<1 || dp->udplen_increment>0x7FFF || dp->udplen_increment<-0x8000)
 			{
 				DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
 				exit_clean(1);
 			}
 			break;
-		case 42: /* dpi-desync-udplen-pattern */
+		case 43: /* dpi-desync-udplen-pattern */
 			{
 				char buf[sizeof(dp->udplen_pattern)];
 				size_t sz=sizeof(buf);
@@ -1568,35 +1720,35 @@ int main(int argc, char **argv)
 				fill_pattern(dp->udplen_pattern,sizeof(dp->udplen_pattern),buf,sz);
 			}
 			break;
-		case 43: /* desync-cutoff */
+		case 44: /* desync-cutoff */
 			if (!parse_cutoff(optarg, &dp->desync_cutoff, &dp->desync_cutoff_mode))
 			{
 				DLOG_ERR("invalid desync-cutoff value\n");
 				exit_clean(1);
 			}
 			break;
-		case 44: /* desync-start */
+		case 45: /* desync-start */
 			if (!parse_cutoff(optarg, &dp->desync_start, &dp->desync_start_mode))
 			{
 				DLOG_ERR("invalid desync-start value\n");
 				exit_clean(1);
 			}
 			break;
-		case 45: /* hostlist */
+		case 46: /* hostlist */
 			if (!RegisterHostlist(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-		case 46: /* hostlist-exclude */
+		case 47: /* hostlist-exclude */
 			if (!RegisterHostlist(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-		case 47: /* hostlist-auto */
+		case 48: /* hostlist-auto */
 			if (dp->hostlist_auto)
 			{
 				DLOG_ERR("only one auto hostlist per profile is supported\n");
@@ -1616,10 +1768,6 @@ int main(int argc, char **argv)
 					DLOG_ERR("gzipped auto hostlists are not supported\n");
 					exit_clean(1);
 				}
-#ifndef __CYGWIN__
-				if (params.droproot && chown(optarg, params.uid, -1))
-					DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg);
-#endif
 			}
 			if (!(dp->hostlist_auto=RegisterHostlist(dp, false, optarg)))
 			{
@@ -1627,7 +1775,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 48: /* hostlist-auto-fail-threshold */
+		case 49: /* hostlist-auto-fail-threshold */
 			dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
 			{
@@ -1635,7 +1783,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 49: /* hostlist-auto-fail-time */
+		case 50: /* hostlist-auto-fail-time */
 			dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_time<1)
 			{
@@ -1643,7 +1791,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 50: /* hostlist-auto-retrans-threshold */
+		case 51: /* hostlist-auto-retrans-threshold */
 			dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10)
 			{
@@ -1651,7 +1799,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 51: /* hostlist-auto-debug */
+		case 52: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -1660,32 +1808,42 @@ int main(int argc, char **argv)
 					exit_clean(1);
 				}
 				fclose(F);
-#ifndef __CYGWIN__
-				if (params.droproot && chown(optarg, params.uid, -1))
-					DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg);
-#endif
 				strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog));
 				params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
 			}
 			break;
 
-		case 52: /* new */
-			if (!(dpl = dp_list_add(&params.desync_profiles)))
+		case 53: /* new */
+			if (bSkip)
 			{
-				DLOG_ERR("desync_profile_add: out of memory\n");
-				exit_clean(1);
+				dp_clear(dp);
+				dp_init(dp);
+				dp->n = desync_profile_count;
+				bSkip = false;
+			}
+			else
+			{
+				if (!(dpl = dp_list_add(&params.desync_profiles)))
+				{
+					DLOG_ERR("desync_profile_add: out of memory\n");
+					exit_clean(1);
+				}
+				dp = &dpl->dp;
+				dp->n = ++desync_profile_count;
 			}
-			dp = &dpl->dp;
-			dp->n = ++desync_profile_count;
 			break;
-		case 53: /* filter-l3 */
+		case 54: /* skip */
+			bSkip = true;
+			break;
+
+		case 55: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 54: /* filter-tcp */
+		case 56: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -1695,7 +1853,7 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_udp))
 				exit_clean(1);
 			break;
-		case 55: /* filter-udp */
+		case 57: /* filter-udp */
 			if (!parse_pf_list(optarg,&dp->pf_udp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -1705,21 +1863,21 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_tcp))
 				exit_clean(1);
 			break;
-		case 56: /* filter-l7 */
+		case 58: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 57: /* ipset */
+		case 59: /* ipset */
 			if (!RegisterIpset(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-		case 58: /* ipset-exclude */
+		case 60: /* ipset-exclude */
 			if (!RegisterIpset(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1730,28 +1888,28 @@ int main(int argc, char **argv)
 
 
 #ifdef __linux__
-		case 59: /* bind-fix4 */
+		case 61: /* bind-fix4 */
 			params.bind_fix4 = true;
 			break;
-		case 60: /* bind-fix6 */
+		case 62: /* bind-fix6 */
 			params.bind_fix6 = true;
 			break;
 #elif defined(__CYGWIN__)
-		case 59: /* wf-iface */
+		case 61: /* wf-iface */
 			if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
 			{
 				DLOG_ERR("bad value for --wf-iface\n");
 				exit_clean(1);
 			}
 			break;
-		case 60: /* wf-l3 */
+		case 62: /* wf-l3 */
 			if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
 			{
 				DLOG_ERR("bad value for --wf-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 61: /* wf-tcp */
+		case 63: /* wf-tcp */
 			hash_wf_tcp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
 				!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
@@ -1760,7 +1918,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 62: /* wf-udp */
+		case 64: /* wf-udp */
 			hash_wf_udp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
 				!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
@@ -1769,7 +1927,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 63: /* wf-raw */
+		case 65: /* wf-raw */
 			hash_wf_raw=hash_jen(optarg,strlen(optarg));
 			if (optarg[0]=='@')
 			{
@@ -1783,11 +1941,11 @@ int main(int argc, char **argv)
 				windivert_filter[sizeof(windivert_filter) - 1] = '\0';
 			}
 			break;
-		case 64: /* wf-save */
+		case 66: /* wf-save */
 			strncpy(wf_save_file, optarg, sizeof(wf_save_file));
 			wf_save_file[sizeof(wf_save_file) - 1] = '\0';
 			break;
-		case 65: /* ssid-filter */
+		case 67: /* ssid-filter */
 			hash_ssid_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -1805,7 +1963,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 66: /* nlm-filter */
+		case 68: /* nlm-filter */
 			hash_nlm_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -1823,7 +1981,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 67: /* nlm-list */
+		case 69: /* nlm-list */
 			if (!nlm_list(optarg && !strcmp(optarg,"all")))
 			{
 				DLOG_ERR("could not get list of NLM networks\n");
@@ -1834,9 +1992,15 @@ int main(int argc, char **argv)
 #endif
 		}
 	}
+	if (bSkip)
+	{
+		LIST_REMOVE(dpl,next);
+		dp_entry_destroy(dpl);
+		desync_profile_count--;
+	}
 
 	// do not need args from file anymore
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	cleanup_args();
 #endif
 	argv=NULL; argc=0;
@@ -1907,6 +2071,12 @@ int main(int argc, char **argv)
 
 	DLOG_CONDUP("we have %d user defined desync profile(s) and default low priority profile 0\n",desync_profile_count);
 	
+#ifndef __CYGWIN__
+	if (params.debug_target == LOG_TARGET_FILE && params.droproot && chown(params.debug_logfile, params.uid, -1))
+		fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
+	if (params.droproot && *params.hostlist_auto_debuglog && chown(params.hostlist_auto_debuglog, params.uid, -1))
+		DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", params.hostlist_auto_debuglog);
+#endif
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		dp = &dpl->dp;
@@ -1917,8 +2087,11 @@ int main(int argc, char **argv)
 			DLOG("[profile %d] autottl ipv4 %u:%u-%u\n",dp->n,dp->desync_autottl.delta,dp->desync_autottl.min,dp->desync_autottl.max);
 		if (AUTOTTL_ENABLED(dp->desync_autottl6))
 			DLOG("[profile %d] autottl ipv6 %u:%u-%u\n",dp->n,dp->desync_autottl6.delta,dp->desync_autottl6.min,dp->desync_autottl6.max);
-		if (dp->desync_split_tls==tlspos_none && dp->desync_split_pos) dp->desync_split_tls=tlspos_pos;
-		if (dp->desync_split_http_req==httpreqpos_none && dp->desync_split_pos) dp->desync_split_http_req=httpreqpos_pos;
+		split_compat(dp);
+#ifndef __CYGWIN__
+		if (params.droproot && dp->hostlist_auto && chown(dp->hostlist_auto->filename, params.uid, -1))
+			DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", dp->hostlist_auto->filename);
+#endif
 	}
 
 	if (!LoadAllHostLists())
@@ -1935,6 +2108,9 @@ int main(int argc, char **argv)
 	DLOG("\nlists summary:\n");
 	HostlistsDebug();
 	IpsetsDebug();
+
+	DLOG("\nsplits summary:\n");
+	SplitDebug();
 	DLOG("\n");
 
 	if (daemon) daemonize();

nfq/params.c

@@ -154,47 +154,65 @@ int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
 		return 0;
 }
 
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
+{
+	size_t k;
+	bool bcut = false;
+	if (size > limit)
+	{
+		size = limit;
+		bcut = true;
+	}
+	if (!size) return;
+	for (k = 0; k < size; k++) DLOG("%02X ", data[k]);
+	DLOG(bcut ? "... : " : ": ");
+	for (k = 0; k < size; k++) DLOG("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
+	if (bcut) DLOG(" ...");
+}
 
+void dp_init(struct desync_profile *dp)
+{
+	LIST_INIT(&dp->hl_collection);
+	LIST_INIT(&dp->hl_collection_exclude);
+	LIST_INIT(&dp->ips_collection);
+	LIST_INIT(&dp->ips_collection_exclude);
+	LIST_INIT(&dp->pf_tcp);
+	LIST_INIT(&dp->pf_udp);
+
+	memcpy(dp->hostspell, "host", 4); // default hostspell
+	dp->desync_skip_nosni = true;
+	dp->desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
+	dp->desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
+	dp->desync_repeats = 1;
+	dp->fake_tls_size = sizeof(fake_tls_clienthello_default);
+	memcpy(dp->fake_tls,fake_tls_clienthello_default,dp->fake_tls_size);
+	randomize_default_tls_payload(dp->fake_tls);
+	dp->fake_http_size = strlen(fake_http_request_default);
+	memcpy(dp->fake_http,fake_http_request_default,dp->fake_http_size);
+	dp->fake_quic_size = 620; // must be 601+ for TSPU hack
+	dp->fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
+	dp->fake_wg_size = 64;
+	dp->fake_dht_size = 64;
+	dp->fake_unknown_size = 256;
+	dp->fake_syndata_size = 16;
+	dp->fake_unknown_udp_size = 64;
+	dp->wscale=-1; // default - dont change scale factor (client)
+	dp->desync_ttl6 = 0xFF; // unused
+	dp->desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
+	dp->desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
+	dp->wssize_cutoff_mode = dp->desync_start_mode = dp->desync_cutoff_mode = 'n'; // packet number by default
+	dp->udplen_increment = UDPLEN_INCREMENT_DEFAULT;
+	dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
+	dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+	dp->hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
+	dp->filter_ipv4 = dp->filter_ipv6 = true;
+}
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 {
 	struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
 	if (!entry) return NULL;
 	
-	LIST_INIT(&entry->dp.hl_collection);
-	LIST_INIT(&entry->dp.hl_collection_exclude);
-	LIST_INIT(&entry->dp.ips_collection);
-	LIST_INIT(&entry->dp.ips_collection_exclude);
-	LIST_INIT(&entry->dp.pf_tcp);
-	LIST_INIT(&entry->dp.pf_udp);
-
-	memcpy(entry->dp.hostspell, "host", 4); // default hostspell
-	entry->dp.desync_skip_nosni = true;
-	entry->dp.desync_split_pos = 2;
-	entry->dp.desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
-	entry->dp.desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
-	entry->dp.desync_repeats = 1;
-	entry->dp.fake_tls_size = sizeof(fake_tls_clienthello_default);
-	memcpy(entry->dp.fake_tls,fake_tls_clienthello_default,entry->dp.fake_tls_size);
-	randomize_default_tls_payload(entry->dp.fake_tls);
-	entry->dp.fake_http_size = strlen(fake_http_request_default);
-	memcpy(entry->dp.fake_http,fake_http_request_default,entry->dp.fake_http_size);
-	entry->dp.fake_quic_size = 620; // must be 601+ for TSPU hack
-	entry->dp.fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
-	entry->dp.fake_wg_size = 64;
-	entry->dp.fake_dht_size = 64;
-	entry->dp.fake_unknown_size = 256;
-	entry->dp.fake_syndata_size = 16;
-	entry->dp.fake_unknown_udp_size = 64;
-	entry->dp.wscale=-1; // default - dont change scale factor (client)
-	entry->dp.desync_ttl6 = 0xFF; // unused
-	entry->dp.desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
-	entry->dp.desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
-	entry->dp.wssize_cutoff_mode = entry->dp.desync_start_mode = entry->dp.desync_cutoff_mode = 'n'; // packet number by default
-	entry->dp.udplen_increment = UDPLEN_INCREMENT_DEFAULT;
-	entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
-	entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
-	entry->dp.hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
-	entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
+	dp_init(&entry->dp);
 
 	// add to the tail
 	struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
@@ -208,15 +226,24 @@ struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 
 	return entry;
 }
-static void dp_entry_destroy(struct desync_profile_list *entry)
+static void dp_clear_dynamic(struct desync_profile *dp)
 {
-	hostlist_collection_destroy(&entry->dp.hl_collection);
-	hostlist_collection_destroy(&entry->dp.hl_collection_exclude);
-	ipset_collection_destroy(&entry->dp.ips_collection);
-	ipset_collection_destroy(&entry->dp.ips_collection_exclude);
-	port_filters_destroy(&entry->dp.pf_tcp);
-	port_filters_destroy(&entry->dp.pf_udp);
-	HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
+	hostlist_collection_destroy(&dp->hl_collection);
+	hostlist_collection_destroy(&dp->hl_collection_exclude);
+	ipset_collection_destroy(&dp->ips_collection);
+	ipset_collection_destroy(&dp->ips_collection_exclude);
+	port_filters_destroy(&dp->pf_tcp);
+	port_filters_destroy(&dp->pf_udp);
+	HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
+}
+void dp_clear(struct desync_profile *dp)
+{
+	dp_clear_dynamic(dp);
+	memset(dp,0,sizeof(*dp));
+}
+void dp_entry_destroy(struct desync_profile_list *entry)
+{
+	dp_clear_dynamic(&entry->dp);
 	free(entry);
 }
 void dp_list_destroy(struct desync_profile_list_head *head)

nfq/params.h

@@ -14,7 +14,7 @@
 #include <stdio.h>
 #include <time.h>
 #include <sys/queue.h>
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 #include <wordexp.h>
 #endif
 
@@ -38,6 +38,8 @@
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 #define	HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT	3
 
+#define MAX_SPLITS	64
+
 enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
 
 struct desync_profile
@@ -49,13 +51,17 @@ struct desync_profile
 	char wssize_cutoff_mode; // n - packets, d - data packets, s - relative sequence
 	unsigned int wssize_cutoff;
 
-	bool hostcase, hostnospace, domcase;
+	bool hostcase, hostnospace, domcase, methodeol;
 	char hostspell[4];
 	enum dpi_desync_mode desync_mode0,desync_mode,desync_mode2;
 	bool desync_retrans,desync_skip_nosni,desync_any_proto;
-	unsigned int desync_repeats,desync_split_pos,desync_seqovl,desync_ipfrag_pos_tcp,desync_ipfrag_pos_udp;
-	enum httpreqpos desync_split_http_req;
-	enum tlspos desync_split_tls;
+	unsigned int desync_repeats,desync_ipfrag_pos_tcp,desync_ipfrag_pos_udp;
+
+	// multisplit
+	struct proto_pos splits[MAX_SPLITS];
+	int split_count;
+	struct proto_pos seqovl;
+
 	char desync_start_mode, desync_cutoff_mode; // n - packets, d - data packets, s - relative sequence
 	unsigned int desync_start, desync_cutoff;
 	uint8_t desync_ttl, desync_ttl6;
@@ -93,12 +99,15 @@ struct desync_profile_list {
 };
 LIST_HEAD(desync_profile_list_head, desync_profile_list);
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
+void dp_entry_destroy(struct desync_profile_list *entry);
 void dp_list_destroy(struct desync_profile_list_head *head);
 bool dp_list_have_autohostlist(struct desync_profile_list_head *head);
+void dp_init(struct desync_profile *dp);
+void dp_clear(struct desync_profile *dp);
 
 struct params_s
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	wordexp_t wexp; // for file based config
 #endif
 
@@ -143,3 +152,4 @@ int DLOG_ERR(const char *format, ...);
 int DLOG_PERROR(const char *s);
 int DLOG_CONDUP(const char *format, ...);
 int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);

nfq/protocol.c

@@ -7,6 +7,150 @@
 #include <arpa/inet.h>
 #include <string.h>
 
+// find N level domain
+static bool FindNLD(const uint8_t *dom, size_t dlen, int level, const uint8_t **p, size_t *len)
+{
+	int i;
+	const uint8_t *p1,*p2;
+	for (i=1,p2=dom+dlen;i<level;i++)
+	{
+		for (p2--; p2>dom && *p2!='.'; p2--);
+		if (p2<=dom) return false;
+	}
+	for (p1=p2-1 ; p1>dom && *p1!='.'; p1--);
+	if (*p1=='.') p1++;
+	if (p) *p = p1;
+	if (len) *len = p2-p1;
+	return true;
+}
+
+const char *l7proto_str(t_l7proto l7)
+{
+	switch(l7)
+	{
+		case HTTP: return "http";
+		case TLS: return "tls";
+		case QUIC: return "quic";
+		case WIREGUARD: return "wireguard";
+		case DHT: return "dht";
+		default: return "unknown";
+	}
+}
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
+{
+	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
+		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
+		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
+		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
+		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
+		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
+}
+
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+bool IsHostMarker(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			return true;
+		default:
+			return false;
+	}
+}
+const char *posmarker_name(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_ABS: return "abs";
+		case PM_HOST: return "host";
+		case PM_HOST_END: return "endhost";
+		case PM_HOST_SLD: return "sld";
+		case PM_HOST_MIDSLD: return "midsld";
+		case PM_HOST_ENDSLD: return "endsld";
+		case PM_HTTP_METHOD: return "method";
+		case PM_SNI_EXT: return "sniext";
+		default: return "?";
+	}
+}
+
+static size_t CheckPos(size_t sz, ssize_t offset)
+{
+	return (offset>=0 && offset<sz) ? offset : 0;
+}
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
+{
+	ssize_t offset;
+	switch(posmarker)
+	{
+		case PM_ABS:
+			offset = (pos<0) ? sz+pos : pos;
+			return CheckPos(sz,offset);
+		default:
+			return 0;
+	}
+}
+static size_t HostPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz, size_t offset_host, size_t len_host)
+{
+	ssize_t offset;
+	const uint8_t *p;
+	size_t slen;
+
+	switch(posmarker)
+	{
+		case PM_HOST:
+			offset = offset_host+pos;
+			break;
+		case PM_HOST_END:
+			offset = offset_host+len_host+pos;
+			break;
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (((offset_host+len_host)<=sz) && FindNLD(data+offset_host,len_host,2,&p,&slen))
+				offset = (posmarker==PM_HOST_SLD ? p-data : posmarker==PM_HOST_ENDSLD ? p-data+slen : slen==1 ? p+1-data : p+slen/2-data) + pos;
+			else
+				offset = 0;
+			break;
+	}
+	return CheckPos(sz,offset);
+}
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp)
+{
+	switch(l7proto)
+	{
+		case HTTP:
+			return HttpPos(sp->marker, sp->pos, data, sz);
+		case TLS:
+			return TLSPos(sp->marker, sp->pos, data, sz);
+		default:
+			return AnyProtoPos(sp->marker, sp->pos, data, sz);
+	}
+}
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count)
+{
+	int i,j;
+	for(i=j=0;i<split_count;i++)
+	{
+		pos[j] = ResolvePos(data,sz,l7proto,splits+i);
+		if (pos[j]) j++;
+	}
+	qsort_size_t(pos, j);
+	j=unique_size_t(pos, j);
+	*pos_count=j;
+}
+
+
 const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
 const char *HttpMethod(const uint8_t *data, size_t len)
 {
@@ -116,17 +260,6 @@ bool HttpExtractHost(const uint8_t *data, size_t len, char *host, size_t len_hos
 {
 	return HttpExtractHeader(data, len, "\nHost:", host, len_host);
 }
-const char *HttpFind2ndLevelDomain(const char *host)
-{
-	const char *p=NULL;
-	if (*host)
-	{
-		for (p = host + strlen(host)-1; p>host && *p!='.'; p--);
-		if (*p=='.') for (p--; p>host && *p!='.'; p--);
-		if (*p=='.') p++;
-	}
-	return p;
-}
 // DPI redirects are global redirects to another domain
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host)
 {
@@ -157,45 +290,56 @@ bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *
 	// somethinkg like : censor.net
 	
 	// extract 2nd level domains
+	const char *dhost, *drhost;
+	if (!FindNLD((uint8_t*)host,strlen(host),2,(const uint8_t**)&dhost,NULL) || !FindNLD((uint8_t*)redirect_host,strlen(redirect_host),2,(const uint8_t**)&drhost,NULL))
+		return false;
 
-	const char *dhost = HttpFind2ndLevelDomain(host);
-	const char *drhost = HttpFind2ndLevelDomain(redirect_host);
-	
+	// compare 2nd level domains		
 	return strcasecmp(dhost, drhost)!=0;
 }
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz)
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
-	const uint8_t *method, *host=NULL;
+	const uint8_t *method, *host=NULL, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
 	int i;
 	
-	switch(tpos_type)
+	switch(posmarker)
 	{
-		case httpreqpos_method:
+		case PM_HTTP_METHOD:
 			// recognize some tpws pre-applied hacks
-			method=http;
+			method=data;
 			if (sz<10) break;
 			if (*method=='\n' || *method=='\r') method++;
 			if (*method=='\n' || *method=='\r') method++;
-			for (i=0;i<7;i++) if (*method>='A' && *method<='Z') method++;
-			if (i<3 || *method!=' ') break;
-			return method-http-1;
-		case httpreqpos_host:
-			if (HttpFindHostConst(&host,http,sz) && (host-http+7)<sz)
+			for (p=method,i=0;i<7;i++) if (*p>='A' && *p<='Z') p++;
+			if (i<3 || *p!=' ') break;
+			return CheckPos(sz,method-data+pos);
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (HttpFindHostConst(&host,data,sz) && (host-data+7)<sz)
 			{
 				host+=5;
-				if (*host==' ') host++;
-				return host-http;
+				if (*host==' ' || *host=='\t') host++;
+				offset_host = host-data;
+				if (posmarker!=PM_HOST)
+					for (len_host=0; (offset_host+len_host)<sz && data[offset_host+len_host]!='\r' && data[offset_host+len_host]!='\n'; len_host++);
+				else
+					len_host = 0;
+				return HostPos(posmarker,pos,data,sz,offset_host,len_host);
 			}
 			break;
-		case httpreqpos_pos:
-			break;
 		default:
-			return 0;
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
-	return hpos_pos<sz ? hpos_pos : 0;
+	return 0;
 }
 
 
+
 uint16_t TLSRecordDataLen(const uint8_t *data)
 {
 	return pntoh16(data + 3);
@@ -305,15 +449,24 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 	if (reclen<len) len=reclen; // correct len if it has more data than the first tls record has
 	return TLSFindExtInHandshake(data + 5, len - 5, type, ext, len_ext, bPartialIsOK);
 }
+static bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen)
+{
+	// u16	data+0 - name list length
+	// u8	data+2 - server name type. 0=host_name
+	// u16	data+3 - server name length
+	if (*elen < 5 || (*ext)[2] != 0) return false;
+	*slen = pntoh16(*ext + 3);
+	*ext += 5; *elen -= 5;
+	return *slen <= *elen;
+}
 static bool TLSExtractHostFromExt(const uint8_t *ext, size_t elen, char *host, size_t len_host)
 {
 	// u16	data+0 - name list length
 	// u8	data+2 - server name type. 0=host_name
 	// u16	data+3 - server name length
-	if (elen < 5 || ext[2] != 0) return false;
-	size_t slen = pntoh16(ext + 3);
-	ext += 5; elen -= 5;
-	if (slen < elen) return false;
+	size_t slen;
+	if (!TLSAdvanceToHostInSNI(&ext,&elen,&slen))
+		return false;
 	if (host && len_host)
 	{
 		if (slen >= len_host) slen = len_host - 1;
@@ -338,21 +491,39 @@ bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *hos
 	if (!TLSFindExtInHandshake(data, len, 0, &ext, &elen, bPartialIsOK)) return false;
 	return TLSExtractHostFromExt(ext, elen, host, len_host);
 }
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type)
+
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
 	size_t elen;
-	const uint8_t *ext;
-	switch(tpos_type)
+	const uint8_t *ext, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
+
+	switch(posmarker)
 	{
-		case tlspos_sni:
-		case tlspos_sniext:
-			if (TLSFindExt(tls,sz,0,&ext,&elen,false))
-				return (tpos_type==tlspos_sni) ? ext-tls+6 : ext-tls+1;
-			// fall through
-		case tlspos_pos:
-			return tpos_pos<sz ? tpos_pos : 0;
-		default:
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+		case PM_SNI_EXT:
+			if (TLSFindExt(data,sz,0,&ext,&elen,false))
+			{
+				if (posmarker==PM_SNI_EXT)
+				{
+					return CheckPos(sz,ext-data+pos);
+				}
+				else
+				{
+					if (!TLSAdvanceToHostInSNI(&ext,&elen,&len_host))
+						return 0;
+					offset_host = ext-data;
+					return HostPos(posmarker,pos,data,sz,offset_host,len_host);
+				}
+			}
 			return 0;
+		default:
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
 }
 
@@ -699,6 +870,7 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 	return found;
 }
 
+/*
 bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello)
 {
 	if (bIsCryptoHello) *bIsCryptoHello=false;
@@ -718,8 +890,9 @@ bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host
 	if (!IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len)) return false;
 	if (bIsCryptoHello) *bIsCryptoHello=true;
 
-	return TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, len_host, true);
+	return TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, len_host, NULL, true);
 }
+*/
 
 bool IsQUICInitial(const uint8_t *data, size_t len)
 {

nfq/protocol.h

@@ -7,6 +7,39 @@
 #include "crypto/aes-gcm.h"
 #include "helpers.h"
 
+typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
+#define L7_PROTO_HTTP		0x00000001
+#define L7_PROTO_TLS		0x00000002
+#define L7_PROTO_QUIC		0x00000004
+#define L7_PROTO_WIREGUARD	0x00000008
+#define L7_PROTO_DHT		0x00000010
+#define L7_PROTO_UNKNOWN	0x80000000
+const char *l7proto_str(t_l7proto l7);
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
+
+// pos markers
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+struct proto_pos
+{
+	int16_t pos;
+	uint8_t marker;
+};
+#define PROTO_POS_EMPTY(sp) ((sp)->marker==PM_ABS && (sp)->pos==0)
+bool IsHostMarker(uint8_t posmarker);
+const char *posmarker_name(uint8_t posmarker);
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp);
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count);
+
 extern const char *http_methods[9];
 const char *HttpMethod(const uint8_t *data, size_t len);
 bool IsHttp(const uint8_t *data, size_t len);
@@ -21,8 +54,6 @@ const char *HttpFind2ndLevelDomain(const char *host);
 int HttpReplyCode(const uint8_t *data, size_t len);
 // must be pre-checked by IsHttpReply
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host);
-enum httpreqpos { httpreqpos_none = 0, httpreqpos_method, httpreqpos_host, httpreqpos_pos };
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz);
 
 uint16_t TLSRecordDataLen(const uint8_t *data);
 size_t TLSRecordLen(const uint8_t *data);
@@ -35,8 +66,6 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
 bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
 bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
-enum tlspos { tlspos_none = 0, tlspos_sni, tlspos_sniext, tlspos_pos };
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type);
 
 bool IsWireguardHandshakeInitiation(const uint8_t *data, size_t len);
 bool IsDhtD1(const uint8_t *data, size_t len);
@@ -56,4 +85,4 @@ bool QUICExtractDCID(const uint8_t *data, size_t len, quic_cid_t *cid);
 
 bool QUICDecryptInitial(const uint8_t *data, size_t data_len, uint8_t *clean, size_t *clean_len);
 bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len);
-bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello);
+//bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello);

tpws/BSDmakefile

@@ -1,12 +1,12 @@
 CC ?= cc
-CFLAGS += -std=gnu99 -s -O3
+CFLAGS += -std=gnu99 -s -Os -flto=auto
 LIBS = -lz -lpthread
 SRC_FILES = *.c
 
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -Iepoll-shim/include -o $@ $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
 
 clean:
 	rm -f tpws *.o

tpws/Makefile

@@ -1,13 +1,18 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os -flto=auto
 CFLAGS_BSD = -Wno-address-of-packed-member
 LIBS = -lz -lpthread
+LIBS_ANDROID = -lz
 SRC_FILES = *.c
+SRC_FILES_ANDROID = $(SRC_FILES) andr/*.c
 
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+android: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LDFLAGS) $(LIBS_ANDROID)
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)

tpws/andr/_musl_license.txt

@@ -0,0 +1,26 @@
+Code in this dir is taken from musl libc to support old android versions <7.0
+
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright <20> 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------

tpws/andr/getifaddrs.c

@@ -0,0 +1,216 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <ifaddrs.h>
+#include <syscall.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include "netlink.h"
+
+#define IFADDRS_HASH_SIZE 64
+
+/* getifaddrs() reports hardware addresses with PF_PACKET that implies
+ * struct sockaddr_ll.  But e.g. Infiniband socket address length is
+ * longer than sockaddr_ll.ssl_addr[8] can hold. Use this hack struct
+ * to extend ssl_addr - callers should be able to still use it. */
+struct sockaddr_ll_hack {
+	unsigned short sll_family, sll_protocol;
+	int sll_ifindex;
+	unsigned short sll_hatype;
+	unsigned char sll_pkttype, sll_halen;
+	unsigned char sll_addr[24];
+};
+
+union sockany {
+	struct sockaddr sa;
+	struct sockaddr_ll_hack ll;
+	struct sockaddr_in v4;
+	struct sockaddr_in6 v6;
+};
+
+struct ifaddrs_storage {
+	struct ifaddrs ifa;
+	struct ifaddrs_storage *hash_next;
+	union sockany addr, netmask, ifu;
+	unsigned int index;
+	char name[IFNAMSIZ+1];
+};
+
+struct ifaddrs_ctx {
+	struct ifaddrs *first;
+	struct ifaddrs *last;
+	struct ifaddrs_storage *hash[IFADDRS_HASH_SIZE];
+};
+
+void freeifaddrs(struct ifaddrs *ifp)
+{
+	struct ifaddrs *n;
+	while (ifp) {
+		n = ifp->ifa_next;
+		free(ifp);
+		ifp = n;
+	}
+}
+
+static void copy_addr(struct sockaddr **r, int af, union sockany *sa, void *addr, size_t addrlen, int ifindex)
+{
+	uint8_t *dst;
+	int len;
+
+	switch (af) {
+	case AF_INET:
+		dst = (uint8_t*) &sa->v4.sin_addr;
+		len = 4;
+		break;
+	case AF_INET6:
+		dst = (uint8_t*) &sa->v6.sin6_addr;
+		len = 16;
+		if (IN6_IS_ADDR_LINKLOCAL(addr) || IN6_IS_ADDR_MC_LINKLOCAL(addr))
+			sa->v6.sin6_scope_id = ifindex;
+		break;
+	default:
+		return;
+	}
+	if (addrlen < len) return;
+	sa->sa.sa_family = af;
+	memcpy(dst, addr, len);
+	*r = &sa->sa;
+}
+
+static void gen_netmask(struct sockaddr **r, int af, union sockany *sa, int prefixlen)
+{
+	uint8_t addr[16] = {0};
+	int i;
+
+	if (prefixlen > 8*sizeof(addr)) prefixlen = 8*sizeof(addr);
+	i = prefixlen / 8;
+	memset(addr, 0xff, i);
+	if (i < sizeof(addr)) addr[i++] = 0xff << (8 - (prefixlen % 8));
+	copy_addr(r, af, sa, addr, sizeof(addr), 0);
+}
+
+static void copy_lladdr(struct sockaddr **r, union sockany *sa, void *addr, size_t addrlen, int ifindex, unsigned short hatype)
+{
+	if (addrlen > sizeof(sa->ll.sll_addr)) return;
+	sa->ll.sll_family = AF_PACKET;
+	sa->ll.sll_ifindex = ifindex;
+	sa->ll.sll_hatype = hatype;
+	sa->ll.sll_halen = addrlen;
+	memcpy(sa->ll.sll_addr, addr, addrlen);
+	*r = &sa->sa;
+}
+
+static int netlink_msg_to_ifaddr(void *pctx, struct nlmsghdr *h)
+{
+	struct ifaddrs_ctx *ctx = pctx;
+	struct ifaddrs_storage *ifs, *ifs0;
+	struct ifinfomsg *ifi = NLMSG_DATA(h);
+	struct ifaddrmsg *ifa = NLMSG_DATA(h);
+	struct rtattr *rta;
+	int stats_len = 0;
+
+	if (h->nlmsg_type == RTM_NEWLINK) {
+		for (rta = NLMSG_RTA(h, sizeof(*ifi)); NLMSG_RTAOK(rta, h); rta = RTA_NEXT(rta)) {
+			if (rta->rta_type != IFLA_STATS) continue;
+			stats_len = RTA_DATALEN(rta);
+			break;
+		}
+	} else {
+		for (ifs0 = ctx->hash[ifa->ifa_index % IFADDRS_HASH_SIZE]; ifs0; ifs0 = ifs0->hash_next)
+			if (ifs0->index == ifa->ifa_index)
+				break;
+		if (!ifs0) return 0;
+	}
+
+	ifs = calloc(1, sizeof(struct ifaddrs_storage) + stats_len);
+	if (ifs == 0) return -1;
+
+	if (h->nlmsg_type == RTM_NEWLINK) {
+		ifs->index = ifi->ifi_index;
+		ifs->ifa.ifa_flags = ifi->ifi_flags;
+
+		for (rta = NLMSG_RTA(h, sizeof(*ifi)); NLMSG_RTAOK(rta, h); rta = RTA_NEXT(rta)) {
+			switch (rta->rta_type) {
+			case IFLA_IFNAME:
+				if (RTA_DATALEN(rta) < sizeof(ifs->name)) {
+					memcpy(ifs->name, RTA_DATA(rta), RTA_DATALEN(rta));
+					ifs->ifa.ifa_name = ifs->name;
+				}
+				break;
+			case IFLA_ADDRESS:
+				copy_lladdr(&ifs->ifa.ifa_addr, &ifs->addr, RTA_DATA(rta), RTA_DATALEN(rta), ifi->ifi_index, ifi->ifi_type);
+				break;
+			case IFLA_BROADCAST:
+				copy_lladdr(&ifs->ifa.ifa_broadaddr, &ifs->ifu, RTA_DATA(rta), RTA_DATALEN(rta), ifi->ifi_index, ifi->ifi_type);
+				break;
+			case IFLA_STATS:
+				ifs->ifa.ifa_data = (void*)(ifs+1);
+				memcpy(ifs->ifa.ifa_data, RTA_DATA(rta), RTA_DATALEN(rta));
+				break;
+			}
+		}
+		if (ifs->ifa.ifa_name) {
+			unsigned int bucket = ifs->index % IFADDRS_HASH_SIZE;
+			ifs->hash_next = ctx->hash[bucket];
+			ctx->hash[bucket] = ifs;
+		}
+	} else {
+		ifs->ifa.ifa_name = ifs0->ifa.ifa_name;
+		ifs->ifa.ifa_flags = ifs0->ifa.ifa_flags;
+		for (rta = NLMSG_RTA(h, sizeof(*ifa)); NLMSG_RTAOK(rta, h); rta = RTA_NEXT(rta)) {
+			switch (rta->rta_type) {
+			case IFA_ADDRESS:
+				/* If ifa_addr is already set we, received an IFA_LOCAL before
+				 * so treat this as destination address */
+				if (ifs->ifa.ifa_addr)
+					copy_addr(&ifs->ifa.ifa_dstaddr, ifa->ifa_family, &ifs->ifu, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				else
+					copy_addr(&ifs->ifa.ifa_addr, ifa->ifa_family, &ifs->addr, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				break;
+			case IFA_BROADCAST:
+				copy_addr(&ifs->ifa.ifa_broadaddr, ifa->ifa_family, &ifs->ifu, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				break;
+			case IFA_LOCAL:
+				/* If ifa_addr is set and we get IFA_LOCAL, assume we have
+				 * a point-to-point network. Move address to correct field. */
+				if (ifs->ifa.ifa_addr) {
+					ifs->ifu = ifs->addr;
+					ifs->ifa.ifa_dstaddr = &ifs->ifu.sa;
+					memset(&ifs->addr, 0, sizeof(ifs->addr));
+				}
+				copy_addr(&ifs->ifa.ifa_addr, ifa->ifa_family, &ifs->addr, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				break;
+			case IFA_LABEL:
+				if (RTA_DATALEN(rta) < sizeof(ifs->name)) {
+					memcpy(ifs->name, RTA_DATA(rta), RTA_DATALEN(rta));
+					ifs->ifa.ifa_name = ifs->name;
+				}
+				break;
+			}
+		}
+		if (ifs->ifa.ifa_addr)
+			gen_netmask(&ifs->ifa.ifa_netmask, ifa->ifa_family, &ifs->netmask, ifa->ifa_prefixlen);
+	}
+
+	if (ifs->ifa.ifa_name) {
+		if (!ctx->first) ctx->first = &ifs->ifa;
+		if (ctx->last) ctx->last->ifa_next = &ifs->ifa;
+		ctx->last = &ifs->ifa;
+	} else {
+		free(ifs);
+	}
+	return 0;
+}
+
+int getifaddrs(struct ifaddrs **ifap)
+{
+	struct ifaddrs_ctx _ctx, *ctx = &_ctx;
+	int r;
+	memset(ctx, 0, sizeof *ctx);
+	r = __rtnetlink_enumerate(AF_UNSPEC, AF_UNSPEC, netlink_msg_to_ifaddr, ctx);
+	if (r == 0) *ifap = ctx->first;
+	else freeifaddrs(ctx->first);
+	return r;
+}

tpws/andr/ifaddrs.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include <ifaddrs.h>
+
+#if __ANDROID_API__ < 24
+void freeifaddrs(struct ifaddrs *);
+int getifaddrs(struct ifaddrs **);
+#endif

tpws/andr/netlink.c

@@ -0,0 +1,54 @@
+#include <errno.h>
+#include <string.h>
+#include <syscall.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "netlink.h"
+
+static int __netlink_enumerate(int fd, unsigned int seq, int type, int af,
+	int (*cb)(void *ctx, struct nlmsghdr *h), void *ctx)
+{
+	struct nlmsghdr *h;
+	union {
+		uint8_t buf[8192];
+		struct {
+			struct nlmsghdr nlh;
+			struct rtgenmsg g;
+		} req;
+		struct nlmsghdr reply;
+	} u;
+	int r, ret;
+
+	memset(&u.req, 0, sizeof(u.req));
+	u.req.nlh.nlmsg_len = sizeof(u.req);
+	u.req.nlh.nlmsg_type = type;
+	u.req.nlh.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST;
+	u.req.nlh.nlmsg_seq = seq;
+	u.req.g.rtgen_family = af;
+	r = send(fd, &u.req, sizeof(u.req), 0);
+	if (r < 0) return r;
+
+	while (1) {
+		r = recv(fd, u.buf, sizeof(u.buf), MSG_DONTWAIT);
+		if (r <= 0) return -1;
+		for (h = &u.reply; NLMSG_OK(h, (void*)&u.buf[r]); h = NLMSG_NEXT(h)) {
+			if (h->nlmsg_type == NLMSG_DONE) return 0;
+			if (h->nlmsg_type == NLMSG_ERROR) return -1;
+			ret = cb(ctx, h);
+			if (ret) return ret;
+		}
+	}
+}
+
+int __rtnetlink_enumerate(int link_af, int addr_af, int (*cb)(void *ctx, struct nlmsghdr *h), void *ctx)
+{
+	int fd, r;
+
+	fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE);
+	if (fd < 0) return -1;
+	r = __netlink_enumerate(fd, 1, RTM_GETLINK, link_af, cb, ctx);
+	if (!r) r = __netlink_enumerate(fd, 2, RTM_GETADDR, addr_af, cb, ctx);
+	close(fd);
+	return r;
+}

tpws/andr/netlink.h

@@ -0,0 +1,94 @@
+#include <stdint.h>
+
+/* linux/netlink.h */
+
+#define NETLINK_ROUTE 0
+
+struct nlmsghdr {
+	uint32_t	nlmsg_len;
+	uint16_t	nlmsg_type;
+	uint16_t	nlmsg_flags;
+	uint32_t	nlmsg_seq;
+	uint32_t	nlmsg_pid;
+};
+
+#define NLM_F_REQUEST	1
+#define NLM_F_MULTI	2
+#define NLM_F_ACK	4
+
+#define NLM_F_ROOT	0x100
+#define NLM_F_MATCH	0x200
+#define NLM_F_ATOMIC	0x400
+#define NLM_F_DUMP	(NLM_F_ROOT|NLM_F_MATCH)
+
+#define NLMSG_NOOP	0x1
+#define NLMSG_ERROR	0x2
+#define NLMSG_DONE	0x3
+#define NLMSG_OVERRUN	0x4
+
+/* linux/rtnetlink.h */
+
+#define RTM_NEWLINK	16
+#define RTM_GETLINK	18
+#define RTM_NEWADDR	20
+#define RTM_GETADDR	22
+
+struct rtattr {
+	unsigned short	rta_len;
+	unsigned short	rta_type;
+};
+
+struct rtgenmsg {
+	unsigned char	rtgen_family;
+};
+
+struct ifinfomsg {
+	unsigned char	ifi_family;
+	unsigned char	__ifi_pad;
+	unsigned short	ifi_type;
+	int		ifi_index;
+	unsigned	ifi_flags;
+	unsigned	ifi_change;
+};
+
+/* linux/if_link.h */
+
+#define IFLA_ADDRESS	1
+#define IFLA_BROADCAST	2
+#define IFLA_IFNAME	3
+#define IFLA_STATS	7
+
+/* linux/if_addr.h */
+
+struct ifaddrmsg {
+	uint8_t		ifa_family;
+	uint8_t		ifa_prefixlen;
+	uint8_t		ifa_flags;
+	uint8_t		ifa_scope;
+	uint32_t	ifa_index;
+};
+
+#define IFA_ADDRESS	1
+#define IFA_LOCAL	2
+#define IFA_LABEL	3
+#define IFA_BROADCAST	4
+
+/* musl */
+
+#define NETLINK_ALIGN(len)	(((len)+3) & ~3)
+#define NLMSG_DATA(nlh)		((void*)((char*)(nlh)+sizeof(struct nlmsghdr)))
+#define NLMSG_DATALEN(nlh)	((nlh)->nlmsg_len-sizeof(struct nlmsghdr))
+#define NLMSG_DATAEND(nlh)	((char*)(nlh)+(nlh)->nlmsg_len)
+#define NLMSG_NEXT(nlh)		(struct nlmsghdr*)((char*)(nlh)+NETLINK_ALIGN((nlh)->nlmsg_len))
+#define NLMSG_OK(nlh,end)	((char*)(end)-(char*)(nlh) >= sizeof(struct nlmsghdr))
+
+#define RTA_DATA(rta)		((void*)((char*)(rta)+sizeof(struct rtattr)))
+#define RTA_DATALEN(rta)	((rta)->rta_len-sizeof(struct rtattr))
+#define RTA_DATAEND(rta)	((char*)(rta)+(rta)->rta_len)
+#define RTA_NEXT(rta)		(struct rtattr*)((char*)(rta)+NETLINK_ALIGN((rta)->rta_len))
+#define RTA_OK(rta,end)		((char*)(end)-(char*)(rta) >= sizeof(struct rtattr))
+
+#define NLMSG_RTA(nlh,len)	((void*)((char*)(nlh)+sizeof(struct nlmsghdr)+NETLINK_ALIGN(len)))
+#define NLMSG_RTAOK(rta,nlh)	RTA_OK(rta,NLMSG_DATAEND(nlh))
+
+int __rtnetlink_enumerate(int link_af, int addr_af, int (*cb)(void *ctx, struct nlmsghdr *h), void *ctx);

tpws/helpers.c

@@ -1,15 +1,49 @@
 #define _GNU_SOURCE
 
-#include "helpers.h"
 #include <stdio.h>
 #include <string.h>
+#include <stdlib.h>
 #include <ctype.h>
 #include <errno.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
-#include <ifaddrs.h>
 #include <time.h>
 #include <sys/stat.h>
+#include <libgen.h>
+#include <unistd.h>
+
+#ifdef __linux__
+#include <linux/tcp.h>
+#endif
+
+#ifdef __ANDROID__
+#include "andr/ifaddrs.h"
+#else
+#include <ifaddrs.h>
+#endif
+
+#include "helpers.h"
+
+int unique_size_t(size_t *pu, int ct)
+{
+	int i, j, u;
+	for (i = j = 0; j < ct; i++)
+	{
+		u = pu[j++];
+		for (; j < ct && pu[j] == u; j++);
+		pu[i] = u;
+	}
+	return i;
+}
+static int cmp_size_t(const void * a, const void * b)
+{
+	return *(size_t*)a < *(size_t*)b ? -1 : *(size_t*)a > *(size_t*)b;
+}
+void qsort_size_t(size_t *array, size_t ct)
+{
+	qsort(array, ct, sizeof(*array), cmp_size_t);
+}
+
 
 void rtrim(char *s)
 {
@@ -19,10 +53,10 @@ void rtrim(char *s)
 
 void replace_char(char *s, char from, char to)
 {
-	for(;*s;s++) if (*s==from) *s=to;
+	for (; *s; s++) if (*s == from) *s = to;
 }
 
-char *strncasestr(const char *s,const char *find, size_t slen)
+char *strncasestr(const char *s, const char *find, size_t slen)
 {
 	char c, sc;
 	size_t len;
@@ -63,9 +97,9 @@ bool load_file(const char *filename, void *buffer, size_t *buffer_size)
 
 bool append_to_list_file(const char *filename, const char *s)
 {
-	FILE *F = fopen(filename,"at");
+	FILE *F = fopen(filename, "at");
 	if (!F) return false;
-	bool bOK = fprintf(F,"%s\n",s)>0;
+	bool bOK = fprintf(F, "%s\n", s) > 0;
 	fclose(F);
 	return bOK;
 }
@@ -73,7 +107,7 @@ bool append_to_list_file(const char *filename, const char *s)
 void ntop46(const struct sockaddr *sa, char *str, size_t len)
 {
 	if (!len) return;
-	*str=0;
+	*str = 0;
 	switch (sa->sa_family)
 	{
 	case AF_INET:
@@ -83,50 +117,50 @@ void ntop46(const struct sockaddr *sa, char *str, size_t len)
 		inet_ntop(sa->sa_family, &((struct sockaddr_in6*)sa)->sin6_addr, str, len);
 		break;
 	default:
-		snprintf(str,len,"UNKNOWN_FAMILY_%d",sa->sa_family);
+		snprintf(str, len, "UNKNOWN_FAMILY_%d", sa->sa_family);
 	}
 }
 void ntop46_port(const struct sockaddr *sa, char *str, size_t len)
 {
 	char ip[40];
-	ntop46(sa,ip,sizeof(ip));
+	ntop46(sa, ip, sizeof(ip));
 	switch (sa->sa_family)
 	{
 	case AF_INET:
-		snprintf(str,len,"%s:%u",ip,ntohs(((struct sockaddr_in*)sa)->sin_port));
+		snprintf(str, len, "%s:%u", ip, ntohs(((struct sockaddr_in*)sa)->sin_port));
 		break;
 	case AF_INET6:
-		snprintf(str,len,"[%s]:%u",ip,ntohs(((struct sockaddr_in6*)sa)->sin6_port));
+		snprintf(str, len, "[%s]:%u", ip, ntohs(((struct sockaddr_in6*)sa)->sin6_port));
 		break;
 	default:
-		snprintf(str,len,"%s",ip);
+		snprintf(str, len, "%s", ip);
 	}
 }
 void print_sockaddr(const struct sockaddr *sa)
 {
 	char ip_port[48];
 
-	ntop46_port(sa,ip_port,sizeof(ip_port));
-	printf("%s",ip_port);
+	ntop46_port(sa, ip_port, sizeof(ip_port));
+	printf("%s", ip_port);
 }
 
 // -1 = error,  0 = not local, 1 = local
 bool check_local_ip(const struct sockaddr *saddr)
 {
-	struct ifaddrs *addrs,*a;
+	struct ifaddrs *addrs, *a;
 
 	if (is_localnet(saddr))
 		return true;
 
-	if (getifaddrs(&addrs)<0) return false;
-	a  = addrs;
+	if (getifaddrs(&addrs) < 0) return false;
+	a = addrs;
 
-	bool bres=false;
+	bool bres = false;
 	while (a)
 	{
-		if (a->ifa_addr && sacmp(a->ifa_addr,saddr))
+		if (a->ifa_addr && sacmp(a->ifa_addr, saddr))
 		{
-			bres=true;
+			bres = true;
 			break;
 		}
 		a = a->ifa_next;
@@ -148,7 +182,7 @@ void print_addrinfo(const struct addrinfo *ai)
 			break;
 		case AF_INET6:
 			if (inet_ntop(ai->ai_family, &((struct sockaddr_in6*)ai->ai_addr)->sin6_addr, str, sizeof(str)))
-				printf( "%s\n", str);
+				printf("%s\n", str);
 			break;
 		}
 		ai = ai->ai_next;
@@ -160,23 +194,23 @@ void print_addrinfo(const struct addrinfo *ai)
 bool saismapped(const struct sockaddr_in6 *sa)
 {
 	// ::ffff:1.2.3.4
-	return !memcmp(sa->sin6_addr.s6_addr,"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff",12);
+	return !memcmp(sa->sin6_addr.s6_addr, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff", 12);
 }
-bool samappedcmp(const struct sockaddr_in *sa1,const struct sockaddr_in6 *sa2)
+bool samappedcmp(const struct sockaddr_in *sa1, const struct sockaddr_in6 *sa2)
 {
-	return saismapped(sa2) && !memcmp(sa2->sin6_addr.s6_addr+12,&sa1->sin_addr.s_addr,4);
+	return saismapped(sa2) && !memcmp(sa2->sin6_addr.s6_addr + 12, &sa1->sin_addr.s_addr, 4);
 }
-bool sacmp(const struct sockaddr *sa1,const struct sockaddr *sa2)
+bool sacmp(const struct sockaddr *sa1, const struct sockaddr *sa2)
 {
-	return (sa1->sa_family==AF_INET && sa2->sa_family==AF_INET && !memcmp(&((struct sockaddr_in*)sa1)->sin_addr,&((struct sockaddr_in*)sa2)->sin_addr,sizeof(struct in_addr))) ||
-		(sa1->sa_family==AF_INET6 && sa2->sa_family==AF_INET6 && !memcmp(&((struct sockaddr_in6*)sa1)->sin6_addr,&((struct sockaddr_in6*)sa2)->sin6_addr,sizeof(struct in6_addr))) ||
-		(sa1->sa_family==AF_INET && sa2->sa_family==AF_INET6 && samappedcmp((struct sockaddr_in*)sa1,(struct sockaddr_in6*)sa2)) ||
-		(sa1->sa_family==AF_INET6 && sa2->sa_family==AF_INET && samappedcmp((struct sockaddr_in*)sa2,(struct sockaddr_in6*)sa1));
+	return (sa1->sa_family == AF_INET && sa2->sa_family == AF_INET && !memcmp(&((struct sockaddr_in*)sa1)->sin_addr, &((struct sockaddr_in*)sa2)->sin_addr, sizeof(struct in_addr))) ||
+		(sa1->sa_family == AF_INET6 && sa2->sa_family == AF_INET6 && !memcmp(&((struct sockaddr_in6*)sa1)->sin6_addr, &((struct sockaddr_in6*)sa2)->sin6_addr, sizeof(struct in6_addr))) ||
+		(sa1->sa_family == AF_INET && sa2->sa_family == AF_INET6 && samappedcmp((struct sockaddr_in*)sa1, (struct sockaddr_in6*)sa2)) ||
+		(sa1->sa_family == AF_INET6 && sa2->sa_family == AF_INET && samappedcmp((struct sockaddr_in*)sa2, (struct sockaddr_in6*)sa1));
 }
 uint16_t saport(const struct sockaddr *sa)
 {
-	return htons(sa->sa_family==AF_INET ? ((struct sockaddr_in*)sa)->sin_port :
-		     sa->sa_family==AF_INET6 ? ((struct sockaddr_in6*)sa)->sin6_port : 0);
+	return htons(sa->sa_family == AF_INET ? ((struct sockaddr_in*)sa)->sin_port :
+		sa->sa_family == AF_INET6 ? ((struct sockaddr_in6*)sa)->sin6_port : 0);
 }
 bool saconvmapped(struct sockaddr_storage *a)
 {
@@ -194,16 +228,16 @@ bool saconvmapped(struct sockaddr_storage *a)
 
 void sacopy(struct sockaddr_storage *sa_dest, const struct sockaddr *sa)
 {
-	switch(sa->sa_family)
+	switch (sa->sa_family)
 	{
-		case AF_INET:
-			memcpy(sa_dest,sa,sizeof(struct sockaddr_in));
-			break;
-		case AF_INET6:
-			memcpy(sa_dest,sa,sizeof(struct sockaddr_in6));
-			break;
-		default:
-			sa_dest->ss_family = 0;
+	case AF_INET:
+		memcpy(sa_dest, sa, sizeof(struct sockaddr_in));
+		break;
+	case AF_INET6:
+		memcpy(sa_dest, sa, sizeof(struct sockaddr_in6));
+		break;
+	default:
+		sa_dest->ss_family = 0;
 	}
 }
 void sa46copy(sockaddr_in46 *sa_dest, const struct sockaddr *sa)
@@ -214,17 +248,17 @@ void sa46copy(sockaddr_in46 *sa_dest, const struct sockaddr *sa)
 bool is_localnet(const struct sockaddr *a)
 {
 	// match 127.0.0.0/8, 0.0.0.0, ::1, ::0, :ffff:127.0.0.0/104, :ffff:0.0.0.0
-	return (a->sa_family==AF_INET && (IN_LOOPBACK(ntohl(((struct sockaddr_in *)a)->sin_addr.s_addr)) ||
-					    INADDR_ANY == ntohl((((struct sockaddr_in *)a)->sin_addr.s_addr)))) ||
-		(a->sa_family==AF_INET6 && (IN6_IS_ADDR_LOOPBACK(&((struct sockaddr_in6 *)a)->sin6_addr) ||
-					    IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6 *)a)->sin6_addr) ||
-					    (IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)a)->sin6_addr) && (IN_LOOPBACK(ntohl(IN6_EXTRACT_MAP4(((struct sockaddr_in6*)a)->sin6_addr.s6_addr))) ||
-					    INADDR_ANY == ntohl(IN6_EXTRACT_MAP4(((struct sockaddr_in6*)a)->sin6_addr.s6_addr))))));
+	return (a->sa_family == AF_INET && (IN_LOOPBACK(ntohl(((struct sockaddr_in *)a)->sin_addr.s_addr)) ||
+		INADDR_ANY == ntohl((((struct sockaddr_in *)a)->sin_addr.s_addr)))) ||
+		(a->sa_family == AF_INET6 && (IN6_IS_ADDR_LOOPBACK(&((struct sockaddr_in6 *)a)->sin6_addr) ||
+			IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6 *)a)->sin6_addr) ||
+			(IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)a)->sin6_addr) && (IN_LOOPBACK(ntohl(IN6_EXTRACT_MAP4(((struct sockaddr_in6*)a)->sin6_addr.s6_addr))) ||
+				INADDR_ANY == ntohl(IN6_EXTRACT_MAP4(((struct sockaddr_in6*)a)->sin6_addr.s6_addr))))));
 }
 bool is_linklocal(const struct sockaddr_in6 *a)
 {
 	// fe80::/10
-	return a->sin6_addr.s6_addr[0]==0xFE && (a->sin6_addr.s6_addr[1] & 0xC0)==0x80;
+	return a->sin6_addr.s6_addr[0] == 0xFE && (a->sin6_addr.s6_addr[1] & 0xC0) == 0x80;
 }
 bool is_private6(const struct sockaddr_in6* a)
 {
@@ -236,23 +270,23 @@ bool is_private6(const struct sockaddr_in6* a)
 
 bool set_keepalive(int fd)
 {
-	int yes=1;
-	return setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &yes, sizeof(int))!=-1;
+	int yes = 1;
+	return setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &yes, sizeof(int)) != -1;
 }
 bool set_ttl(int fd, int ttl)
 {
-	return setsockopt(fd, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl))!=-1;
+	return setsockopt(fd, IPPROTO_IP, IP_TTL, &ttl, sizeof(ttl)) != -1;
 }
 bool set_hl(int fd, int hl)
 {
-	return setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hl, sizeof(hl))!=-1;
+	return setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &hl, sizeof(hl)) != -1;
 }
 bool set_ttl_hl(int fd, int ttl)
 {
-	bool b1,b2;
+	bool b1, b2;
 	// try to set both but one may fail if family is wrong
-	b1=set_ttl(fd, ttl);
-	b2=set_hl(fd, ttl);
+	b1 = set_ttl(fd, ttl);
+	b2 = set_hl(fd, ttl);
 	return b1 || b2;
 }
 int get_so_error(int fd)
@@ -260,8 +294,8 @@ int get_so_error(int fd)
 	// getsockopt(SO_ERROR) clears error
 	int errn;
 	socklen_t optlen = sizeof(errn);
-	if(getsockopt(fd, SOL_SOCKET, SO_ERROR, &errn, &optlen) == -1)
-		errn=errno;
+	if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &errn, &optlen) == -1)
+		errn = errno;
 	return errn;
 }
 
@@ -271,53 +305,53 @@ int fprint_localtime(FILE *F)
 	time_t now;
 
 	time(&now);
-	localtime_r(&now,&t);
+	localtime_r(&now, &t);
 	return fprintf(F, "%02d.%02d.%04d %02d:%02d:%02d", t.tm_mday, t.tm_mon + 1, t.tm_year + 1900, t.tm_hour, t.tm_min, t.tm_sec);
 }
 
 time_t file_mod_time(const char *filename)
 {
 	struct stat st;
-	return stat(filename,&st)==-1 ? 0 : st.st_mtime;
+	return stat(filename, &st) == -1 ? 0 : st.st_mtime;
 }
 
 bool pf_in_range(uint16_t port, const port_filter *pf)
 {
-	return port && (((!pf->from && !pf->to) || (port>=pf->from && port<=pf->to)) ^ pf->neg);
+	return port && (((!pf->from && !pf->to) || (port >= pf->from && port <= pf->to)) ^ pf->neg);
 }
 bool pf_parse(const char *s, port_filter *pf)
 {
-	unsigned int v1,v2;
+	unsigned int v1, v2;
 	char c;
 
 	if (!s) return false;
-	if (*s=='*' && s[1]==0)
+	if (*s == '*' && s[1] == 0)
 	{
-		pf->from=1; pf->to=0xFFFF;
+		pf->from = 1; pf->to = 0xFFFF;
 		return true;
 	}
-	if (*s=='~')
+	if (*s == '~')
 	{
-		pf->neg=true;
+		pf->neg = true;
 		s++;
 	}
 	else
-		pf->neg=false;
-	if (sscanf(s,"%u-%u%c",&v1,&v2,&c)==2)
+		pf->neg = false;
+	if (sscanf(s, "%u-%u%c", &v1, &v2, &c) == 2)
 	{
-		if (v1>65535 || v2>65535 || v1>v2) return false;
-		pf->from=(uint16_t)v1;
-		pf->to=(uint16_t)v2;
+		if (v1 > 65535 || v2 > 65535 || v1 > v2) return false;
+		pf->from = (uint16_t)v1;
+		pf->to = (uint16_t)v2;
 	}
-	else if (sscanf(s,"%u%c",&v1,&c)==1)
+	else if (sscanf(s, "%u%c", &v1, &c) == 1)
 	{
-		if (v1>65535) return false;
-		pf->to=pf->from=(uint16_t)v1;
+		if (v1 > 65535) return false;
+		pf->to = pf->from = (uint16_t)v1;
 	}
 	else
 		return false;
 	// deny all case
-	if (!pf->from && !pf->to) pf->neg=true;
+	if (!pf->from && !pf->to) pf->neg = true;
 	return true;
 }
 bool pf_is_empty(const port_filter *pf)
@@ -326,26 +360,40 @@ bool pf_is_empty(const port_filter *pf)
 }
 
 
+bool set_env_exedir(const char *argv0)
+{
+	char *s, *d;
+	bool bOK = false;
+	if ((s = strdup(argv0)))
+	{
+		if ((d = dirname(s)))
+			setenv("EXEDIR", s, 1);
+		free(s);
+	}
+	return bOK;
+}
+
+
 static void mask_from_preflen6_make(uint8_t plen, struct in6_addr *a)
 {
 	if (plen >= 128)
-		memset(a->s6_addr,0xFF,16);
+		memset(a->s6_addr, 0xFF, 16);
 	else
 	{
 		uint8_t n = plen >> 3;
-		memset(a->s6_addr,0xFF,n);
-		memset(a->s6_addr+n,0x00,16-n);
+		memset(a->s6_addr, 0xFF, n);
+		memset(a->s6_addr + n, 0x00, 16 - n);
 		a->s6_addr[n] = (uint8_t)(0xFF00 >> (plen & 7));
 	}
 }
 struct in6_addr ip6_mask[129];
 void mask_from_preflen6_prepare(void)
 {
-	for (int plen=0;plen<=128;plen++) mask_from_preflen6_make(plen, ip6_mask+plen);
+	for (int plen = 0; plen <= 128; plen++) mask_from_preflen6_make(plen, ip6_mask + plen);
 }
 
 #if defined(__GNUC__) && !defined(__llvm__)
-__attribute__((optimize ("no-strict-aliasing")))
+__attribute__((optimize("no-strict-aliasing")))
 #endif
 void ip6_and(const struct in6_addr * restrict a, const struct in6_addr * restrict b, struct in6_addr * restrict result)
 {
@@ -357,64 +405,135 @@ void ip6_and(const struct in6_addr * restrict a, const struct in6_addr * restric
 void str_cidr4(char *s, size_t s_len, const struct cidr4 *cidr)
 {
 	char s_ip[16];
-	*s_ip=0;
+	*s_ip = 0;
 	inet_ntop(AF_INET, &cidr->addr, s_ip, sizeof(s_ip));
-	snprintf(s,s_len,cidr->preflen<32 ? "%s/%u" : "%s", s_ip, cidr->preflen);
+	snprintf(s, s_len, cidr->preflen < 32 ? "%s/%u" : "%s", s_ip, cidr->preflen);
 }
 void print_cidr4(const struct cidr4 *cidr)
 {
 	char s[19];
-	str_cidr4(s,sizeof(s),cidr);
-	printf("%s",s);
+	str_cidr4(s, sizeof(s), cidr);
+	printf("%s", s);
 }
 void str_cidr6(char *s, size_t s_len, const struct cidr6 *cidr)
 {
 	char s_ip[40];
-	*s_ip=0;
+	*s_ip = 0;
 	inet_ntop(AF_INET6, &cidr->addr, s_ip, sizeof(s_ip));
-	snprintf(s,s_len,cidr->preflen<128 ? "%s/%u" : "%s", s_ip, cidr->preflen);
+	snprintf(s, s_len, cidr->preflen < 128 ? "%s/%u" : "%s", s_ip, cidr->preflen);
 }
 void print_cidr6(const struct cidr6 *cidr)
 {
 	char s[44];
-	str_cidr6(s,sizeof(s),cidr);
-	printf("%s",s);
+	str_cidr6(s, sizeof(s), cidr);
+	printf("%s", s);
 }
 bool parse_cidr4(char *s, struct cidr4 *cidr)
 {
-	char *p,d;
+	char *p, d;
 	bool b;
 	unsigned int plen;
 
 	if ((p = strchr(s, '/')))
 	{
-		if (sscanf(p + 1, "%u", &plen)!=1 || plen>32)
+		if (sscanf(p + 1, "%u", &plen) != 1 || plen > 32)
 			return false;
 		cidr->preflen = (uint8_t)plen;
-		d=*p; *p=0; // backup char
+		d = *p; *p = 0; // backup char
 	}
 	else
 		cidr->preflen = 32;
-	b = (inet_pton(AF_INET, s, &cidr->addr)==1);
-	if (p) *p=d; // restore char
+	b = (inet_pton(AF_INET, s, &cidr->addr) == 1);
+	if (p) *p = d; // restore char
 	return b;
 }
 bool parse_cidr6(char *s, struct cidr6 *cidr)
 {
-	char *p,d;
+	char *p, d;
 	bool b;
 	unsigned int plen;
 
 	if ((p = strchr(s, '/')))
 	{
-		if (sscanf(p + 1, "%u", &plen)!=1 || plen>128)
+		if (sscanf(p + 1, "%u", &plen) != 1 || plen > 128)
 			return false;
 		cidr->preflen = (uint8_t)plen;
-		d=*p; *p=0; // backup char
+		d = *p; *p = 0; // backup char
 	}
 	else
 		cidr->preflen = 128;
-	b = (inet_pton(AF_INET6, s, &cidr->addr)==1);
-	if (p) *p=d; // restore char
+	b = (inet_pton(AF_INET6, s, &cidr->addr) == 1);
+	if (p) *p = d; // restore char
 	return b;
 }
+
+
+void msleep(unsigned int ms)
+{
+	struct timespec time = {
+		 .tv_nsec = (ms % 1000) * 1000000,
+		 .tv_sec = ms / 1000
+	};
+	nanosleep(&time, 0);
+}
+
+#ifdef __linux__
+bool socket_supports_notsent()
+{
+	int sfd;
+	struct tcp_info tcpi;
+
+	sfd = socket(AF_INET,SOCK_STREAM,0);
+	if (sfd<0) return false;
+
+	socklen_t ts = sizeof(tcpi);
+	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)
+	{
+		close(sfd);
+		return false;
+	}
+	close(sfd);
+
+	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi.tcpi_state + sizeof(tcpi.tcpi_notsent_bytes));
+}
+bool socket_has_notsent(int sfd)
+{
+	struct tcp_info tcpi;
+	socklen_t ts = sizeof(tcpi);
+
+	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)
+		return false;
+	if (tcpi.tcpi_state != 1) // TCP_ESTABLISHED
+		return false;
+	size_t s = (char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi + sizeof(tcpi.tcpi_notsent_bytes);
+	if (ts < s)
+		// old structure version
+		return false;
+	return !!tcpi.tcpi_notsent_bytes;
+}
+bool socket_wait_notsent(int sfd, unsigned int delay_ms, unsigned int *wasted_ms)
+{
+	struct timespec tres;
+	unsigned int mtick;
+
+	if (wasted_ms) *wasted_ms=0;
+	if (!socket_has_notsent(sfd)) return true;
+
+	if (clock_getres(CLOCK_MONOTONIC,&tres))
+	{
+		tres.tv_nsec = 10000000;
+		tres.tv_sec = 0;
+	}
+	mtick = (unsigned int)(tres.tv_sec*1000) + (unsigned int)(tres.tv_nsec/1000000);
+	if (mtick<1) mtick=1;
+	for(;;)
+	{
+		msleep(mtick);
+		if (wasted_ms) *wasted_ms+=mtick;
+		if (!socket_has_notsent(sfd)) return true;
+		if (delay_ms<=mtick) break;
+		delay_ms-=mtick;
+	}
+	return false;
+}
+#endif

tpws/helpers.h

@@ -15,6 +15,9 @@ typedef union
 	struct sockaddr_in6 sa6;	// size 28
 } sockaddr_in46;
 
+int unique_size_t(size_t *pu, int ct);
+void qsort_size_t(size_t *array,size_t ct);
+
 void rtrim(char *s);
 void replace_char(char *s, char from, char to);
 char *strncasestr(const char *s,const char *find, size_t slen);
@@ -70,6 +73,8 @@ bool pf_in_range(uint16_t port, const port_filter *pf);
 bool pf_parse(const char *s, port_filter *pf);
 bool pf_is_empty(const port_filter *pf);
 
+bool set_env_exedir(const char *argv0);
+
 #ifndef IN_LOOPBACK
 #define IN_LOOPBACK(a)          ((((uint32_t) (a)) & 0xff000000) == 0x7f000000)
 #endif
@@ -112,3 +117,10 @@ static inline const struct in6_addr *mask_from_preflen6(uint8_t preflen)
 {
 	return ip6_mask+preflen;
 }
+
+void msleep(unsigned int ms);
+#ifdef __linux__
+bool socket_supports_notsent();
+bool socket_has_notsent(int sfd);
+bool socket_wait_notsent(int sfd, unsigned int delay_ms, unsigned int *wasted_ms);
+#endif

tpws/params.c

@@ -139,22 +139,42 @@ int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
 		return 0;
 }
 
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
+{
+	size_t k;
+	bool bcut = false;
+	if (size > limit)
+	{
+		size = limit;
+		bcut = true;
+	}
+	if (!size) return;
+	for (k = 0; k < size; k++) VPRINT("%02X ", data[k]);
+	VPRINT(bcut ? "... : " : ": ");
+	for (k = 0; k < size; k++) VPRINT("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
+	if (bcut) VPRINT(" ...");
+}
+
+void dp_init(struct desync_profile *dp)
+{
+	LIST_INIT(&dp->hl_collection);
+	LIST_INIT(&dp->hl_collection_exclude);
+	LIST_INIT(&dp->ips_collection);
+	LIST_INIT(&dp->ips_collection_exclude);
+	LIST_INIT(&dp->pf_tcp);
+
+	dp->filter_ipv4 = dp->filter_ipv6 = true;
+	memcpy(dp->hostspell, "host", 4); // default hostspell
+	dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
+	dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+}
 
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 {
 	struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
 	if (!entry) return NULL;
 
-	LIST_INIT(&entry->dp.hl_collection);
-	LIST_INIT(&entry->dp.hl_collection_exclude);
-	LIST_INIT(&entry->dp.ips_collection);
-	LIST_INIT(&entry->dp.ips_collection_exclude);
-	LIST_INIT(&entry->dp.pf_tcp);
-
-	entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
-	memcpy(entry->dp.hostspell, "host", 4); // default hostspell
-	entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
-	entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+	dp_init(&entry->dp);
 
 	// add to the tail
 	struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
@@ -168,14 +188,23 @@ struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 
 	return entry;
 }
-static void dp_entry_destroy(struct desync_profile_list *entry)
+static void dp_clear_dynamic(struct desync_profile *dp)
 {
-	hostlist_collection_destroy(&entry->dp.hl_collection);
-	hostlist_collection_destroy(&entry->dp.hl_collection_exclude);
-	ipset_collection_destroy(&entry->dp.ips_collection);
-	ipset_collection_destroy(&entry->dp.ips_collection_exclude);
-	port_filters_destroy(&entry->dp.pf_tcp);
-	HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
+	hostlist_collection_destroy(&dp->hl_collection);
+	hostlist_collection_destroy(&dp->hl_collection_exclude);
+	ipset_collection_destroy(&dp->ips_collection);
+	ipset_collection_destroy(&dp->ips_collection_exclude);
+	port_filters_destroy(&dp->pf_tcp);
+	HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
+}
+void dp_clear(struct desync_profile *dp)
+{
+	dp_clear_dynamic(dp);
+	memset(dp,0,sizeof(*dp));
+}
+void dp_entry_destroy(struct desync_profile_list *entry)
+{
+	dp_clear_dynamic(&entry->dp);
 	free(entry);
 }
 void dp_list_destroy(struct desync_profile_list_head *head)

tpws/params.h

@@ -6,7 +6,7 @@
 #include <sys/param.h>
 #include <sys/queue.h>
 #include <time.h>
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 #include <wordexp.h>
 #endif
 
@@ -18,6 +18,8 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 
+#define FIX_SEG_DEFAULT_MAX_WAIT		30
+
 enum bindll { unwanted=0, no, prefer, force };
 
 #define MAX_BINDS	32
@@ -29,6 +31,8 @@ struct bind_s
 	int bind_wait_ifup,bind_wait_ip,bind_wait_ip_ll;
 };
 
+#define MAX_SPLITS	16
+
 enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
 
 struct desync_profile
@@ -38,16 +42,16 @@ struct desync_profile
 	bool hostcase, hostdot, hosttab, hostnospace, methodspace, methodeol, unixeol, domcase;
 	int hostpad;
 	char hostspell[4];
-	enum httpreqpos split_http_req;
-	enum tlspos tlsrec;
-	int tlsrec_pos;
-	enum tlspos split_tls;
 	bool split_any_protocol;
-	int split_pos;
 	bool disorder, disorder_http, disorder_tls;
 	bool oob, oob_http, oob_tls;
 	uint8_t oob_byte;
 
+	// multisplit
+	struct proto_pos splits[MAX_SPLITS];
+	int split_count;
+	struct proto_pos tlsrec;
+
 	int mss;
 
 	bool tamper_start_n,tamper_cutoff_n;
@@ -79,11 +83,14 @@ struct desync_profile_list {
 };
 LIST_HEAD(desync_profile_list_head, desync_profile_list);
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
+void dp_entry_destroy(struct desync_profile_list *entry);
 void dp_list_destroy(struct desync_profile_list_head *head);
+void dp_init(struct desync_profile *dp);
+void dp_clear(struct desync_profile *dp);
 
 struct params_s
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	wordexp_t wexp; // for file based config
 #endif
 
@@ -100,12 +107,14 @@ struct params_s
 	char connect_bind6_ifname[IF_NAMESIZE];
 
 	uint8_t proxy_type;
+	unsigned int fix_seg;
+	bool fix_seg_avail;
 	bool no_resolve;
 	bool skip_nodelay;
 	bool droproot;
+	bool daemon;
 	uid_t uid;
 	gid_t gid;
-	bool daemon;
 	char pidfile[256];
 	int maxconn,resolver_threads,maxfiles,max_orphan_time;
 	int local_rcvbuf,local_sndbuf,remote_rcvbuf,remote_sndbuf;
@@ -140,6 +149,7 @@ int DLOG_CONDUP(const char *format, ...);
 int DLOG_ERR(const char *format, ...);
 int DLOG_PERROR(const char *s);
 int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);
 
 #define VPRINT(format, ...) DLOG(format, 1, ##__VA_ARGS__)
 #define DBGPRINT(format, ...) DLOG(format, 2, ##__VA_ARGS__)

tpws/protocol.c

@@ -7,6 +7,149 @@
 #include <arpa/inet.h>
 #include <string.h>
 
+// find N level domain
+static bool FindNLD(const uint8_t *dom, size_t dlen, int level, const uint8_t **p, size_t *len)
+{
+	int i;
+	const uint8_t *p1,*p2;
+	for (i=1,p2=dom+dlen;i<level;i++)
+	{
+		for (p2--; p2>dom && *p2!='.'; p2--);
+		if (p2<=dom) return false;
+	}
+	for (p1=p2-1 ; p1>dom && *p1!='.'; p1--);
+	if (*p1=='.') p1++;
+	if (p) *p = p1;
+	if (len) *len = p2-p1;
+	return true;
+}
+
+const char *l7proto_str(t_l7proto l7)
+{
+	switch(l7)
+	{
+		case HTTP: return "http";
+		case TLS: return "tls";
+		case QUIC: return "quic";
+		case WIREGUARD: return "wireguard";
+		case DHT: return "dht";
+		default: return "unknown";
+	}
+}
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
+{
+	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
+		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
+		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
+		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
+		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
+		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
+}
+
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+bool IsHostMarker(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			return true;
+		default:
+			return false;
+	}
+}
+const char *posmarker_name(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_ABS: return "abs";
+		case PM_HOST: return "host";
+		case PM_HOST_END: return "endhost";
+		case PM_HOST_SLD: return "sld";
+		case PM_HOST_MIDSLD: return "midsld";
+		case PM_HOST_ENDSLD: return "endsld";
+		case PM_HTTP_METHOD: return "method";
+		case PM_SNI_EXT: return "sniext";
+		default: return "?";
+	}
+}
+
+static size_t CheckPos(size_t sz, ssize_t offset)
+{
+	return (offset>=0 && offset<sz) ? offset : 0;
+}
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
+{
+	ssize_t offset;
+	switch(posmarker)
+	{
+		case PM_ABS:
+			offset = (pos<0) ? sz+pos : pos;
+			return CheckPos(sz,offset);
+		default:
+			return 0;
+	}
+}
+static size_t HostPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz, size_t offset_host, size_t len_host)
+{
+	ssize_t offset;
+	const uint8_t *p;
+	size_t slen;
+
+	switch(posmarker)
+	{
+		case PM_HOST:
+			offset = offset_host+pos;
+			break;
+		case PM_HOST_END:
+			offset = offset_host+len_host+pos;
+			break;
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (((offset_host+len_host)<=sz) && FindNLD(data+offset_host,len_host,2,&p,&slen))
+				offset = (posmarker==PM_HOST_SLD ? p-data : posmarker==PM_HOST_ENDSLD ? p-data+slen : slen==1 ? p+1-data : p+slen/2-data) + pos;
+			else
+				offset = 0;
+			break;
+	}
+	return CheckPos(sz,offset);
+}
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp)
+{
+	switch(l7proto)
+	{
+		case HTTP:
+			return HttpPos(sp->marker, sp->pos, data, sz);
+		case TLS:
+			return TLSPos(sp->marker, sp->pos, data, sz);
+		default:
+			return AnyProtoPos(sp->marker, sp->pos, data, sz);
+	}
+}
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count)
+{
+	int i,j;
+	for(i=j=0;i<split_count;i++)
+	{
+		pos[j] = ResolvePos(data,sz,l7proto,splits+i);
+		if (pos[j]) j++;
+	}
+	qsort_size_t(pos, j);
+	j=unique_size_t(pos, j);
+	*pos_count=j;
+}
+
 
 const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
 const char *HttpMethod(const uint8_t *data, size_t len)
@@ -116,17 +259,6 @@ bool HttpExtractHost(const uint8_t *data, size_t len, char *host, size_t len_hos
 {
 	return HttpExtractHeader(data, len, "\nHost:", host, len_host);
 }
-const char *HttpFind2ndLevelDomain(const char *host)
-{
-	const char *p=NULL;
-	if (*host)
-	{
-		for (p = host + strlen(host)-1; p>host && *p!='.'; p--);
-		if (*p=='.') for (p--; p>host && *p!='.'; p--);
-		if (*p=='.') p++;
-	}
-	return p;
-}
 // DPI redirects are global redirects to another domain
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host)
 {
@@ -157,42 +289,52 @@ bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *
 	// somethinkg like : censor.net
 	
 	// extract 2nd level domains
+	const char *dhost, *drhost;
+	if (!FindNLD((uint8_t*)host,strlen(host),2,(const uint8_t**)&dhost,NULL) || !FindNLD((uint8_t*)redirect_host,strlen(redirect_host),2,(const uint8_t**)&drhost,NULL))
+		return false;
 
-	const char *dhost = HttpFind2ndLevelDomain(host);
-	const char *drhost = HttpFind2ndLevelDomain(redirect_host);
-	
+	// compare 2nd level domains		
 	return strcasecmp(dhost, drhost)!=0;
 }
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz)
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
-	const uint8_t *method, *host=NULL;
+	const uint8_t *method, *host=NULL, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
 	int i;
 	
-	switch(tpos_type)
+	switch(posmarker)
 	{
-		case httpreqpos_method:
+		case PM_HTTP_METHOD:
 			// recognize some tpws pre-applied hacks
-			method=http;
+			method=data;
 			if (sz<10) break;
 			if (*method=='\n' || *method=='\r') method++;
 			if (*method=='\n' || *method=='\r') method++;
-			for (i=0;i<7;i++) if (*method>='A' && *method<='Z') method++;
-			if (i<3 || *method!=' ') break;
-			return method-http-1;
-		case httpreqpos_host:
-			if (HttpFindHostConst(&host,http,sz) && (host-http+7)<sz)
+			for (p=method,i=0;i<7;i++) if (*p>='A' && *p<='Z') p++;
+			if (i<3 || *p!=' ') break;
+			return CheckPos(sz,method-data+pos);
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (HttpFindHostConst(&host,data,sz) && (host-data+7)<sz)
 			{
 				host+=5;
-				if (*host==' ') host++;
-				return host-http;
+				if (*host==' ' || *host=='\t') host++;
+				offset_host = host-data;
+				if (posmarker!=PM_HOST)
+					for (len_host=0; (offset_host+len_host)<sz && data[offset_host+len_host]!='\r' && data[offset_host+len_host]!='\n'; len_host++);
+				else
+					len_host = 0;
+				return HostPos(posmarker,pos,data,sz,offset_host,len_host);
 			}
 			break;
-		case httpreqpos_pos:
-			break;
 		default:
-			return 0;
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
-	return hpos_pos<sz ? hpos_pos : 0;
+	return 0;
 }
 
 
@@ -295,15 +437,24 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 	if (reclen<len) len=reclen; // correct len if it has more data than the first tls record has
 	return TLSFindExtInHandshake(data + 5, len - 5, type, ext, len_ext, bPartialIsOK);
 }
+static bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen)
+{
+	// u16	data+0 - name list length
+	// u8	data+2 - server name type. 0=host_name
+	// u16	data+3 - server name length
+	if (*elen < 5 || (*ext)[2] != 0) return false;
+	*slen = pntoh16(*ext + 3);
+	*ext += 5; *elen -= 5;
+	return *slen <= *elen;
+}
 static bool TLSExtractHostFromExt(const uint8_t *ext, size_t elen, char *host, size_t len_host)
 {
 	// u16	data+0 - name list length
 	// u8	data+2 - server name type. 0=host_name
 	// u16	data+3 - server name length
-	if (elen < 5 || ext[2] != 0) return false;
-	size_t slen = pntoh16(ext + 3);
-	ext += 5; elen -= 5;
-	if (slen < elen) return false;
+	size_t slen;
+	if (!TLSAdvanceToHostInSNI(&ext,&elen,&slen))
+		return false;
 	if (host && len_host)
 	{
 		if (slen >= len_host) slen = len_host - 1;
@@ -328,20 +479,55 @@ bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *hos
 	if (!TLSFindExtInHandshake(data, len, 0, &ext, &elen, bPartialIsOK)) return false;
 	return TLSExtractHostFromExt(ext, elen, host, len_host);
 }
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type)
+
+// find N level domain in SNI
+static bool TLSHelloFindNLDInSNI(const uint8_t *ext, size_t elen, int level, const uint8_t **p, size_t *len)
+{
+	size_t slen;
+	return TLSAdvanceToHostInSNI(&ext,&elen,&slen) && FindNLD(ext,slen,level,p,len);
+}
+// find the middle of second level domain (SLD) in SNI ext : www.sobaka.ru => aka.ru
+// return false if SNI ext is bad or SLD is not found
+static bool TLSHelloFindMiddleOfSLDInSNI(const uint8_t *ext, size_t elen, const uint8_t **p)
+{
+	size_t len;
+	if (!TLSHelloFindNLDInSNI(ext,elen,2,p,&len))
+		return false;
+	// in case of one letter SLD (x.com) we split at '.' to prevent appearance of the whole SLD
+	*p = (len==1) ? *p+1 : *p+len/2;
+	return true;
+}
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
 	size_t elen;
-	const uint8_t *ext;
-	switch(tpos_type)
+	const uint8_t *ext, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
+
+	switch(posmarker)
 	{
-		case tlspos_sni:
-		case tlspos_sniext:
-			if (TLSFindExt(tls,sz,0,&ext,&elen,false))
-				return (tpos_type==tlspos_sni) ? ext-tls+6 : ext-tls+1;
-			// fall through
-		case tlspos_pos:
-			return tpos_pos<sz ? tpos_pos : 0;
-		default:
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+		case PM_SNI_EXT:
+			if (TLSFindExt(data,sz,0,&ext,&elen,false))
+			{
+				if (posmarker==PM_SNI_EXT)
+				{
+					return CheckPos(sz,ext-data+pos);
+				}
+				else
+				{
+					if (!TLSAdvanceToHostInSNI(&ext,&elen,&len_host))
+						return 0;
+					offset_host = ext-data;
+					return HostPos(posmarker,pos,data,sz,offset_host,len_host);
+				}
+			}
 			return 0;
+		default:
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
 }

tpws/protocol.h

@@ -4,6 +4,40 @@
 #include <stdint.h>
 #include <stdbool.h>
 
+typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
+#define L7_PROTO_HTTP		0x00000001
+#define L7_PROTO_TLS		0x00000002
+#define L7_PROTO_QUIC		0x00000004
+#define L7_PROTO_WIREGUARD	0x00000008
+#define L7_PROTO_DHT		0x00000010
+#define L7_PROTO_UNKNOWN	0x80000000
+const char *l7proto_str(t_l7proto l7);
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
+
+// pos markers
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+struct proto_pos
+{
+	int16_t pos;
+	uint8_t marker;
+};
+#define PROTO_POS_EMPTY(sp) ((sp)->marker==PM_ABS && (sp)->pos==0)
+bool IsHostMarker(uint8_t posmarker);
+const char *posmarker_name(uint8_t posmarker);
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp);
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count);
+
+
 extern const char *http_methods[9];
 const char *HttpMethod(const uint8_t *data, size_t len);
 bool IsHttp(const uint8_t *data, size_t len);
@@ -18,8 +52,6 @@ const char *HttpFind2ndLevelDomain(const char *host);
 int HttpReplyCode(const uint8_t *data, size_t len);
 // must be pre-checked by IsHttpReply
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host);
-enum httpreqpos { httpreqpos_none = 0, httpreqpos_method, httpreqpos_host, httpreqpos_pos };
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz);
 
 uint16_t TLSRecordDataLen(const uint8_t *data);
 size_t TLSRecordLen(const uint8_t *data);
@@ -29,5 +61,3 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
 bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
 bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
-enum tlspos { tlspos_none = 0, tlspos_sni, tlspos_sniext, tlspos_pos };
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type);

tpws/resolver.c

@@ -221,7 +221,7 @@ bool resolver_init(int threads, int fd_signal_pipe)
 	if (pthread_attr_init(&attr)) goto ex;
 	// set minimum thread stack size
 
-	if (pthread_attr_setstacksize(&attr,PTHREAD_STACK_MIN>20480 ? PTHREAD_STACK_MIN : 20480))
+	if (pthread_attr_setstacksize(&attr,PTHREAD_STACK_MIN>32768 ? PTHREAD_STACK_MIN : 32768))
 	{
 		pthread_attr_destroy(&attr);
 		goto ex;

tpws/tamper.c

@@ -8,20 +8,11 @@
 #include "protocol.h"
 #include "helpers.h"
 
-const char *l7proto_str(t_l7proto l7)
+#define PKTDATA_MAXDUMP 32
+
+void packet_debug(const uint8_t *data, size_t sz)
 {
-	switch(l7)
-	{
-		case HTTP: return "http";
-		case TLS: return "tls";
-		default: return "unknown";
-	}
-}
-static bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
-{
-	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
-		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
-		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS));
+	hexdump_limited_dlog(data, sz, PKTDATA_MAXDUMP); VPRINT("\n");
 }
 
 static bool dp_match(struct desync_profile *dp, const struct sockaddr *dest, const char *hostname, t_l7proto l7proto)
@@ -87,11 +78,10 @@ void apply_desync_profile(t_ctrack *ctrack, const struct sockaddr *dest)
 
 
 // segment buffer has at least 5 extra bytes to extend data block
-void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *split_pos, uint8_t *split_flags)
+void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *multisplit_pos, int *multisplit_count, uint8_t *split_flags)
 {
 	uint8_t *p, *pp, *pHost = NULL;
-	size_t method_len = 0, pos;
-	size_t tpos, spos;
+	size_t method_len = 0, pos, tpos, orig_size=*size;
 	const char *method;
 	bool bHaveHost = false;
 	char *pc, Host[256];
@@ -116,8 +106,8 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 		return;
 	}
 
-	*split_pos=0;
-	*split_flags=0;
+	if (multisplit_count) *multisplit_count=0;
+	if (split_flags) *split_flags=0;
 
 	if ((method = HttpMethod(segment,*size)))
 	{
@@ -150,11 +140,6 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 
 	if (bHaveHost)
 		VPRINT("request hostname: %s\n", Host);
-	if (ctrack->b_not_act)
-	{
-		VPRINT("Not acting on this request\n");
-		return;
-	}
 
 	bool bDiscoveredL7 = ctrack->l7proto==UNKNOWN && l7proto!=UNKNOWN;
 	if (bDiscoveredL7)
@@ -179,21 +164,28 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 		struct desync_profile *dp_prev = ctrack->dp;
 		apply_desync_profile(ctrack, dest);
 		if (ctrack->dp!=dp_prev)
-			VPRINT("desync profile changed by revealed l7 protocol or hostname !\n");
-	}
-
-	if (bDiscoveredHostname && ctrack->dp->hostlist_auto)
-	{
-		bool bHostExcluded;
-		if (!HostlistCheck(ctrack->dp, Host, &bHostExcluded, false))
 		{
-			ctrack->b_ah_check = !bHostExcluded;
-			VPRINT("Not acting on this request\n");
-			ctrack->b_not_act = true;
-			return;
+			VPRINT("desync profile changed by revealed l7 protocol or hostname !\n");
+			ctrack->b_host_checked = ctrack->b_ah_check = false;
 		}
 	}
 
+	if (l7proto!=UNKNOWN && ctrack->dp->hostlist_auto)
+	{
+		if (bHaveHost && !ctrack->b_host_checked)
+		{
+			bool bHostExcluded;
+			ctrack->b_host_matches = HostlistCheck(ctrack->dp, Host, &bHostExcluded, false);
+			ctrack->b_host_checked = true;
+			if (!ctrack->b_host_matches)
+				ctrack->b_ah_check = !bHostExcluded;
+		}
+		if (!ctrack->b_host_matches)
+		{
+			VPRINT("Not acting on this request\n");
+			return;
+		}
+	}
 	switch(l7proto)
 	{
 		case HTTP:
@@ -325,22 +317,27 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 					pHost = NULL; // invalidate
 				}
 			}
-			*split_pos = HttpPos(ctrack->dp->split_http_req, ctrack->dp->split_pos, segment, *size);
-			if (ctrack->dp->disorder_http) *split_flags |= SPLIT_FLAG_DISORDER;
-			if (ctrack->dp->oob_http) *split_flags |= SPLIT_FLAG_OOB;
+			if (multisplit_pos) ResolveMultiPos(segment, *size, l7proto, ctrack->dp->splits, ctrack->dp->split_count, multisplit_pos, multisplit_count);
+			if (split_flags)
+			{
+				if (ctrack->dp->disorder_http) *split_flags |= SPLIT_FLAG_DISORDER;
+				if (ctrack->dp->oob_http) *split_flags |= SPLIT_FLAG_OOB;
+			}
 			break;
 
 		case TLS:
-			spos = TLSPos(ctrack->dp->split_tls, ctrack->dp->split_pos, segment, *size, 0);
+			if (multisplit_pos) ResolveMultiPos(segment, *size, l7proto, ctrack->dp->splits, ctrack->dp->split_count, multisplit_pos, multisplit_count);
 			if ((5+*size)<=segment_buffer_size)
 			{
-				tpos = TLSPos(ctrack->dp->tlsrec, ctrack->dp->tlsrec_pos+5, segment, *size, 0);
+				tpos = ResolvePos(segment, *size, l7proto, &ctrack->dp->tlsrec);
 				if (tpos>5)
 				{
 					// construct 2 TLS records from one
 					uint16_t l = pntoh16(segment+3); // length
 					if (l>=2)
 					{
+						int i;
+						size_t dlen;
 						// length is checked in IsTLSClientHello and cannot exceed buffer size
 						if ((tpos-5)>=l) tpos=5+1;
 						VPRINT("making 2 TLS records at pos %zu\n",tpos);
@@ -351,27 +348,45 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 						phton16(segment+tpos+3,l-(tpos-5));
 						phton16(segment+3,tpos-5);
 						*size += 5;
-						// split pos present and it is not before tlsrec split. increase split pos by tlsrec header size (5 bytes)
-						if (spos && spos>=tpos) spos+=5;
+						VPRINT("-2nd TLS record: ");
+						dlen = tpos<16 ? tpos : 16;
+						packet_debug(segment+tpos-dlen,dlen);
+						VPRINT("+2nd TLS record: ");
+						packet_debug(segment+tpos,*size-tpos);
+						// fix split positions after tlsrec. increase split pos by tlsrec header size (5 bytes)
+						if (multisplit_pos)
+							for(i=0;i<*multisplit_count;i++)
+								if (multisplit_pos[i]>tpos) multisplit_pos[i]+=5;
 					}
 				}
 			}
-
-			if (spos && spos < *size)
-				*split_pos = spos;
-
-			if (ctrack->dp->disorder_tls) *split_flags |= SPLIT_FLAG_DISORDER;
-			if (ctrack->dp->oob_tls) *split_flags |= SPLIT_FLAG_OOB;
-			
+			if (split_flags)
+			{
+				if (ctrack->dp->disorder_tls) *split_flags |= SPLIT_FLAG_DISORDER;
+				if (ctrack->dp->oob_tls) *split_flags |= SPLIT_FLAG_OOB;
+			}
 			break;
 
 		default:
-			if (ctrack->dp->split_any_protocol && ctrack->dp->split_pos < *size)
-				*split_pos = ctrack->dp->split_pos;
+			if (multisplit_pos && ctrack->dp->split_any_protocol)
+				ResolveMultiPos(segment, *size, l7proto, ctrack->dp->splits, ctrack->dp->split_count, multisplit_pos, multisplit_count);
+	}
+
+	if (split_flags)
+	{
+		if (ctrack->dp->disorder) *split_flags |= SPLIT_FLAG_DISORDER;
+		if (ctrack->dp->oob) *split_flags |= SPLIT_FLAG_OOB;
+	}
+	if (orig_size!=*size)
+	{
+		VPRINT("segment size changed: %zu -> %zu\n", orig_size, *size);
+	}
+	if (params.debug && multisplit_count && *multisplit_count)
+	{
+		VPRINT("multisplit pos: ");
+		for (int i=0;i<*multisplit_count;i++) VPRINT("%zu ",multisplit_pos[i]);
+		VPRINT("\n");
 	}
-		
-	if (ctrack->dp->disorder) *split_flags |= SPLIT_FLAG_DISORDER;
-	if (ctrack->dp->oob) *split_flags |= SPLIT_FLAG_OOB;
 }
 
 static void auto_hostlist_reset_fail_counter(struct desync_profile *dp, const char *hostname, const char *client_ip_port, t_l7proto l7proto)

tpws/tamper.h

@@ -9,28 +9,23 @@
 #define SPLIT_FLAG_DISORDER	0x01
 #define SPLIT_FLAG_OOB		0x02
 
-typedef enum {UNKNOWN=0, HTTP, TLS} t_l7proto;
-#define L7_PROTO_HTTP	1
-#define L7_PROTO_TLS	2
-#define L7_PROTO_UNKNOWN 0x80000000
-const char *l7proto_str(t_l7proto l7);
-
 typedef struct
 {
 	// common state
 	t_l7proto l7proto;
 	bool bTamperInCutoff;
-	bool b_ah_check;
-	bool b_not_act;
+	bool b_host_checked,b_host_matches,b_ah_check;
 	char *hostname;
 	struct desync_profile *dp;		// desync profile cache
 } t_ctrack;
 
 void apply_desync_profile(t_ctrack *ctrack, const struct sockaddr *dest);
 
-void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *split_pos, uint8_t *split_flags);
+void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *multisplit_pos, int *multisplit_count, uint8_t *split_flags);
 void tamper_in(t_ctrack *ctrack, const struct sockaddr *client, uint8_t *segment,size_t segment_buffer_size,size_t *size);
 // connection reset by remote leg
 void rst_in(t_ctrack *ctrack, const struct sockaddr *client);
 // local leg closed connection (timeout waiting response ?)
 void hup_out(t_ctrack *ctrack, const struct sockaddr *client);
+
+void packet_debug(const uint8_t *data, size_t sz);

tpws/tpws.c

@@ -7,7 +7,6 @@
 #include <netinet/in.h>
 #include <netinet/ip.h>
 #include <net/if.h>
-#include <ifaddrs.h>
 #include <netdb.h>
 #include <unistd.h>
 #include <arpa/inet.h>
@@ -25,6 +24,12 @@
 #include <time.h>
 #include <syslog.h>
 
+#ifdef __ANDROID__
+#include "andr/ifaddrs.h"
+#else
+#include <ifaddrs.h>
+#endif
+
 #include "tpws.h"
 
 #ifdef BSD
@@ -122,7 +127,7 @@ static int get_default_ttl(void)
 static void exithelp(void)
 {
 	printf(
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 		" @<config_file>|$<config_file>\t\t; read file for options. must be the only argument. other options are ignored.\n\n"
 #endif
 		" --bind-addr=<v4_addr>|<v6_addr>\t; for v6 link locals append %%interface_name\n"
@@ -164,11 +169,15 @@ static void exithelp(void)
 		" --uid=uid[:gid]\t\t\t; drop root privs\n"
 #if defined(__FreeBSD__)
 		" --enable-pf\t\t\t\t; enable PF redirector support. required in FreeBSD when used with PF firewall.\n"
+#endif
+#if defined(__linux__)
+		" --fix-seg=<int>\t\t\t; fix segmentation failures at the cost of possible slowdown. wait up to N msec (default %u)\n"
 #endif
 		" --debug=0|1|2|syslog|@<filename>\t; 1 and 2 means log to console and set debug level. for other targets use --debug-level.\n"
 		" --debug-level=0|1|2\t\t\t; specify debug level\n"
 		"\nMULTI-STRATEGY:\n"
 		" --new\t\t\t\t\t; begin new strategy\n"
+		" --skip\t\t\t\t\t; do not use this strategy\n"
 		" --filter-l3=ipv4|ipv6\t\t\t; L3 protocol filter. multiple comma separated values allowed.\n"
 		" --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n"
 		" --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n"
@@ -182,10 +191,9 @@ static void exithelp(void)
 		" --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n"
 		" --hostlist-auto-debug=<logfile>\t; debug auto hostlist positives\n"
 		"\nTAMPER:\n"
-		" --split-http-req=method|host\t\t; split at specified logical part of plain http request\n"
-		" --split-tls=sni|sniext\t\t\t; split at specified logical part of TLS ClientHello\n"
-		" --split-pos=<numeric_offset>\t\t; split at specified pos. split-http-req or split-tls take precedence for http.\n"
-		" --split-any-protocol\t\t\t; split not only http and https\n"
+		" --split-pos=N|-N|marker+N|marker-N\t; comma separated list of split positions\n"
+		"\t\t\t\t\t; markers: method,host,endhost,sld,endsld,midsld,sniext\n"
+		" --split-any-protocol\t\t\t; split not only http and TLS\n"
 #if defined(BSD) && !defined(__APPLE__)
 		" --disorder[=http|tls]\t\t\t; when splitting simulate sending second fragment first (BSD sends entire message instead of first fragment, this is not good)\n"
 #else
@@ -203,8 +211,7 @@ static void exithelp(void)
 		" --methodspace\t\t\t\t; add extra space after method\n"
 		" --methodeol\t\t\t\t; add end-of-line before method\n"
 		" --unixeol\t\t\t\t; replace 0D0A to 0A\n"
-		" --tlsrec=sni|sniext\t\t\t; make 2 TLS records. split at specified logical part. don't split if SNI is not present\n"
-		" --tlsrec-pos=<pos>\t\t\t; make 2 TLS records. split at specified pos\n"
+		" --tlsrec=N|-N|marker+N|marker-N\t; make 2 TLS records. split records at specified position.\n"
 #ifdef __linux__
 		" --mss=<int>\t\t\t\t; set client MSS. forces server to split messages but significantly decreases speed !\n"
 #endif
@@ -212,12 +219,15 @@ static void exithelp(void)
 		" --tamper-cutoff=[n]<pos>\t\t; do not tamper anymore after specified outbound stream position. default is unlimited.\n",
 #if defined(__linux__) || defined(__APPLE__)
 		DEFAULT_TCP_USER_TIMEOUT_LOCAL,DEFAULT_TCP_USER_TIMEOUT_REMOTE,
+#endif
+#ifdef __linux__
+		FIX_SEG_DEFAULT_MAX_WAIT,
 #endif
 		HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT, HOSTLIST_AUTO_FAIL_TIME_DEFAULT
 	);
 	exit(1);
 }
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 static void cleanup_args()
 {
 	wordfree(&params.wexp);
@@ -225,7 +235,7 @@ static void cleanup_args()
 #endif
 static void cleanup_params(void)
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	cleanup_args();
 #endif
 
@@ -276,27 +286,131 @@ void save_default_ttl(void)
 	}
 }
 
-bool parse_httpreqpos(const char *s, enum httpreqpos *pos)
+static bool parse_httpreqpos(const char *s, struct proto_pos *sp)
 {
 	if (!strcmp(s, "method"))
-		*pos = httpreqpos_method;
+	{
+		sp->marker = PM_HTTP_METHOD;
+		sp->pos=2;
+	}
 	else if (!strcmp(s, "host"))
-		*pos = httpreqpos_host;
+	{
+		sp->marker = PM_HOST;
+		sp->pos=1;
+	}
 	else
 		return false;
 	return true;
 }
-bool parse_tlspos(const char *s, enum tlspos *pos)
+static bool parse_tlspos(const char *s, struct proto_pos *sp)
 {
 	if (!strcmp(s, "sni"))
-		*pos = tlspos_sni;
+	{
+		sp->marker = PM_HOST;
+		sp->pos=1;
+	}
 	else if (!strcmp(s, "sniext"))
-		*pos = tlspos_sniext;
+	{
+		sp->marker = PM_SNI_EXT;
+		sp->pos=1;
+	}
+	else if (!strcmp(s, "snisld"))
+	{
+		sp->marker = PM_HOST_MIDSLD;
+		sp->pos=0;
+	}
 	else
 		return false;
 	return true;
 }
 
+static bool parse_int16(const char *p, int16_t *v)
+{
+	if (*p=='+' || *p=='-' || *p>='0' && *p<='9')
+	{
+		int i = atoi(p);
+		*v = (int16_t)i;
+		return *v==i; // check overflow
+	}
+	return false;
+}
+static bool parse_posmarker(const char *opt, uint8_t *posmarker)
+{
+	if (!strcmp(opt,"host"))
+		*posmarker = PM_HOST;
+	else if (!strcmp(opt,"endhost"))
+		*posmarker = PM_HOST_END;
+	else if (!strcmp(opt,"sld"))
+		*posmarker = PM_HOST_SLD;
+	else if (!strcmp(opt,"midsld"))
+		*posmarker = PM_HOST_MIDSLD;
+	else if (!strcmp(opt,"endsld"))
+		*posmarker = PM_HOST_ENDSLD;
+	else if (!strcmp(opt,"method"))
+		*posmarker = PM_HTTP_METHOD;
+	else if (!strcmp(opt,"sniext"))
+		*posmarker = PM_SNI_EXT;
+	else
+		return false;
+	return true;
+}
+static bool parse_split_pos(char *opt, struct proto_pos *split)
+{
+	if (parse_int16(opt,&split->pos))
+	{
+		split->marker = PM_ABS;
+		return !!split->pos;
+	}
+	else
+	{
+		char c,*p=opt;
+		bool b;
+
+		for (; *opt && *opt!='+' && *opt!='-'; opt++);
+		c=*opt; *opt=0;
+		b=parse_posmarker(p,&split->marker);
+		*opt=c;
+		if (!b) return false;
+		if (*opt)
+			return parse_int16(opt,&split->pos);
+		else
+			split->pos = 0;
+	}
+	return true;
+}
+static bool parse_split_pos_list(char *opt, struct proto_pos *splits, int splits_size, int *split_count)
+{
+	char c,*e,*p;
+
+	for (p=opt, *split_count=0 ; p && *split_count<splits_size ; (*split_count)++)
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+		if (!parse_split_pos(p,splits+*split_count)) return false;
+		if (e) *e++=c;
+		p = e;
+	}
+	if (p) return false; // too much splits
+	return true;
+}
+static void SplitDebug(void)
+{
+	struct desync_profile_list *dpl;
+	const struct desync_profile *dp;
+	int x;
+	LIST_FOREACH(dpl, &params.desync_profiles, next)
+	{
+		dp = &dpl->dp;
+		for(x=0;x<dp->split_count;x++)
+			VPRINT("profile %d multisplit %s %d\n",dp->n,posmarker_name(dp->splits[x].marker),dp->splits[x].pos);
+		if (!PROTO_POS_EMPTY(&dp->tlsrec))
+			VPRINT("profile %d tlsrec %s %d\n",dp->n,posmarker_name(dp->tlsrec.marker),dp->tlsrec.pos);
+	}
+}
+
 static bool wf_make_l3(char *opt, bool *ipv4, bool *ipv6)
 {
 	char *e,*p,c;
@@ -370,7 +484,7 @@ static bool parse_pf_list(char *opt, struct port_filters_head *pfl)
 	return true;
 }
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 // no static to not allow optimizer to inline this func (save stack)
 void config_from_file(const char *filename)
 {
@@ -397,10 +511,21 @@ void config_from_file(const char *filename)
 }
 #endif
 
+#ifndef __linux__
+static bool check_oob_disorder(const struct desync_profile *dp)
+{
+	return !(
+		dp->oob && (dp->disorder || dp->disorder_http || dp->disorder_tls) ||
+		dp->oob_http && (dp->disorder || dp->disorder_http) ||
+		dp->oob_tls && (dp->disorder || dp->disorder_tls));
+}
+#endif
+
 void parse_params(int argc, char *argv[])
 {
 	int option_index = 0;
 	int v, i;
+	bool bSkip=false;
 
 	memset(&params, 0, sizeof(params));
 	params.maxconn = DEFAULT_MAX_CONN;
@@ -415,6 +540,10 @@ void parse_params(int argc, char *argv[])
 	params.pf_enable = true; // OpenBSD and MacOS have no other choice
 #endif
 
+#ifdef __linux__
+	params.fix_seg_avail = socket_supports_notsent();
+#endif
+
 	LIST_INIT(&params.hostlists);
 	LIST_INIT(&params.ipsets);
 
@@ -435,7 +564,7 @@ void parse_params(int argc, char *argv[])
 	dp = &dpl->dp;
 	dp->n = ++desync_profile_count;
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	if (argc>=2 && (argv[1][0]=='@' || argv[1][0]=='$'))
 	{
 		config_from_file(argv[1]+1);
@@ -503,23 +632,25 @@ void parse_params(int argc, char *argv[])
 		{ "connect-bind-addr",required_argument,0,0 },// optidx=55
 
 		{ "new",no_argument,0,0 },				// optidx=56
-		{ "filter-l3",required_argument,0,0 },			// optidx=57
-		{ "filter-tcp",required_argument,0,0 },			// optidx=58
-		{ "filter-l7",required_argument,0,0 },			// optidx=59
-		{ "ipset",required_argument,0,0 },			// optidx=60
-		{ "ipset-exclude",required_argument,0,0 },		// optidx=61
+		{ "skip",no_argument,0,0 },				// optidx=57
+		{ "filter-l3",required_argument,0,0 },			// optidx=58
+		{ "filter-tcp",required_argument,0,0 },			// optidx=59
+		{ "filter-l7",required_argument,0,0 },			// optidx=60
+		{ "ipset",required_argument,0,0 },			// optidx=61
+		{ "ipset-exclude",required_argument,0,0 },		// optidx=62
 
 #if defined(__FreeBSD__)
 		{ "enable-pf",no_argument,0,0 },// optidx=62
 #elif defined(__APPLE__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=62
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=63
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=63
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=64
 #elif defined(__linux__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=62
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=63
-		{ "mss",required_argument,0,0 },			// optidx=64
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=63
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=64
+		{ "mss",required_argument,0,0 },			// optidx=65
+		{ "fix-seg",optional_argument,0,0 },			// optidx=66
 #ifdef SPLICE_PRESENT
-		{ "nosplice",no_argument,0,0 },				// optidx=65
+		{ "nosplice",no_argument,0,0 },				// optidx=67
 #endif
 #endif
 		{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@@ -680,29 +811,45 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 23: /* split-http-req */
-			if (!parse_httpreqpos(optarg, &dp->split_http_req))
+			DLOG_CONDUP("WARNING ! --split-http-req is deprecated. use --split-pos with markers.\n",MAX_SPLITS);
+			if (dp->split_count>=MAX_SPLITS)
+			{
+				DLOG_ERR("Too much splits. max splits: %u\n",MAX_SPLITS);
+				exit_clean(1);
+			}
+			if (!parse_httpreqpos(optarg, dp->splits + dp->split_count))
 			{
 				DLOG_ERR("Invalid argument for split-http-req\n");
 				exit_clean(1);
 			}
+			dp->split_count++;
 			params.tamper = true;
 			break;
 		case 24: /* split-tls */
-			if (!parse_tlspos(optarg, &dp->split_tls))
+			// obsolete arg
+			DLOG_CONDUP("WARNING ! --split-tls is deprecated. use --split-pos with markers.\n",MAX_SPLITS);
+			if (dp->split_count>=MAX_SPLITS)
+			{
+				DLOG_ERR("Too much splits. max splits: %u\n",MAX_SPLITS);
+				exit_clean(1);
+			}
+			if (!parse_tlspos(optarg, dp->splits + dp->split_count))
 			{
 				DLOG_ERR("Invalid argument for split-tls\n");
 				exit_clean(1);
 			}
+			dp->split_count++;
 			params.tamper = true;
 			break;
 		case 25: /* split-pos */
-			i = atoi(optarg);
-			if (i>0)
-				dp->split_pos = i;
-			else
 			{
-				DLOG_ERR("Invalid argument for split-pos\n");
-				exit_clean(1);
+				int ct;
+				if (!parse_split_pos_list(optarg,dp->splits+dp->split_count,MAX_SPLITS-dp->split_count,&ct))
+				{
+					DLOG_ERR("could not parse split pos list or too much positions (before parsing - %u, max - %u) : %s\n",dp->split_count,MAX_SPLITS,optarg);
+					exit_clean(1);
+				}
+				dp->split_count += ct;
 			}
 			params.tamper = true;
 			break;
@@ -722,7 +869,13 @@ void parse_params(int argc, char *argv[])
 			}
 			else
 				dp->disorder = true;
-			save_default_ttl();
+#ifndef __linux__
+			if (!check_oob_disorder(dp))
+			{
+				DLOG_ERR("--oob and --disorder work simultaneously only in linux. in this system it's guaranteed to fail.\n");
+				exit_clean(1);
+			}
+#endif
 			break;
 		case 28: /* oob */
 			if (optarg)
@@ -737,6 +890,13 @@ void parse_params(int argc, char *argv[])
 			}
 			else
 				dp->oob = true;
+#ifndef __linux__
+			if (!check_oob_disorder(dp))
+			{
+				DLOG_ERR("--oob and --disorder work simultaneously only in linux. in this system it's guaranteed to fail.\n");
+				exit_clean(1);
+			}
+#endif
 			break;
 		case 29: /* oob-data */
 			{
@@ -768,7 +928,7 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 34: /* tlsrec */
-			if (!parse_tlspos(optarg, &dp->tlsrec))
+			if (!parse_split_pos(optarg, &dp->tlsrec) && !parse_tlspos(optarg, &dp->tlsrec))
 			{
 				DLOG_ERR("Invalid argument for tlsrec\n");
 				exit_clean(1);
@@ -776,9 +936,11 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 35: /* tlsrec-pos */
-			if ((dp->tlsrec_pos = atoi(optarg))>0)
-				dp->tlsrec = tlspos_pos;
-			else
+			// obsolete arg
+			i = atoi(optarg);
+			dp->tlsrec.marker = PM_ABS;
+			dp->tlsrec.pos = (int16_t)i;
+			if (!dp->tlsrec.pos || i!=dp->tlsrec.pos)
 			{
 				DLOG_ERR("Invalid argument for tlsrec-pos\n");
 				exit_clean(1);
@@ -821,8 +983,6 @@ void parse_params(int argc, char *argv[])
 					DLOG_ERR("gzipped auto hostlists are not supported\n");
 					exit_clean(1);
 				}
-				if (params.droproot && chown(optarg, params.uid, -1))
-					DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg);
 			}
 			if (!(dp->hostlist_auto=RegisterHostlist(dp, false, optarg)))
 			{
@@ -856,8 +1016,6 @@ void parse_params(int argc, char *argv[])
 					exit_clean(1);
 				}
 				fclose(F);
-				if (params.droproot && chown(optarg, params.uid, -1))
-					DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg);
 				strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog));
 				params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
 			}
@@ -879,8 +1037,6 @@ void parse_params(int argc, char *argv[])
 						fprintf(stderr, "cannot create %s\n", params.debug_logfile);
 						exit_clean(1);
 					}
-					if (params.droproot && chown(params.debug_logfile, params.uid, -1))
-						fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
 					if (!params.debug) params.debug = 1;
 					params.debug_target = LOG_TARGET_FILE;
 				}
@@ -1007,36 +1163,49 @@ void parse_params(int argc, char *argv[])
 
 
 		case 56: /* new */
-			if (!(dpl = dp_list_add(&params.desync_profiles)))
+			if (bSkip)
 			{
-				DLOG_ERR("desync_profile_add: out of memory\n");
-				exit_clean(1);
+				dp_clear(dp);
+				dp_init(dp);
+				dp->n = desync_profile_count;
+				bSkip = false;
+			}
+			else
+			{
+				if (!(dpl = dp_list_add(&params.desync_profiles)))
+				{
+					DLOG_ERR("desync_profile_add: out of memory\n");
+					exit_clean(1);
+				}
+				dp = &dpl->dp;
+				dp->n = ++desync_profile_count;
 			}
-			dp = &dpl->dp;
-			dp->n = ++desync_profile_count;
 			break;
-		case 57: /* filter-l3 */
+		case 57: /* skip */
+			bSkip = true;
+			break;
+		case 58: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 58: /* filter-tcp */
+		case 59: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 59: /* filter-l7 */
+		case 60: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 60: /* ipset */
+		case 61: /* ipset */
 			if (!RegisterIpset(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1044,7 +1213,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 61: /* ipset-exclude */
+		case 62: /* ipset-exclude */
 			if (!RegisterIpset(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1052,13 +1221,13 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-			
+
 #if defined(__FreeBSD__)
-		case 62: /* enable-pf */
+		case 63: /* enable-pf */
 			params.pf_enable = true;
 			break;
 #elif defined(__linux__) || defined(__APPLE__)
-		case 62: /* local-tcp-user-timeout */
+		case 63: /* local-tcp-user-timeout */
 			params.tcp_user_timeout_local = atoi(optarg);
 			if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
 			{
@@ -1066,7 +1235,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 63: /* remote-tcp-user-timeout */
+		case 64: /* remote-tcp-user-timeout */
 			params.tcp_user_timeout_remote = atoi(optarg);
 			if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
 			{
@@ -1077,7 +1246,7 @@ void parse_params(int argc, char *argv[])
 #endif
 
 #if defined(__linux__)
-		case 64: /* mss */
+		case 65: /* mss */
 			// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
 			dp->mss = atoi(optarg);
 			if (dp->mss<88 || dp->mss>32767)
@@ -1086,14 +1255,40 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
+		case 66: /* fix-seg */
+			if (!params.fix_seg_avail)
+			{
+				DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
+				exit_clean(1);
+			}
+			if (optarg)
+			{
+				i = atoi(optarg);
+				if (i < 0 || i > 1000)
+				{
+					DLOG_ERR("fix_seg value must be within 0..1000\n");
+					exit_clean(1);
+				}
+				params.fix_seg = i;
+			}
+			else
+				params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
+			break;
 #ifdef SPLICE_PRESENT
-		case 65: /* nosplice */
+		case 67: /* nosplice */
 			params.nosplice = true;
 			break;
 #endif
 #endif
 		}
 	}
+	if (bSkip)
+	{
+		LIST_REMOVE(dpl,next);
+		dp_entry_destroy(dpl);
+		desync_profile_count--;
+	}
+
 	if (!params.bind_wait_only && !params.port)
 	{
 		DLOG_ERR("Need port number\n");
@@ -1115,16 +1310,21 @@ void parse_params(int argc, char *argv[])
 
 	DLOG_CONDUP("we have %d user defined desync profile(s) and default low priority profile 0\n",desync_profile_count);
 
+	save_default_ttl();
+	if (params.debug_target == LOG_TARGET_FILE && params.droproot && chown(params.debug_logfile, params.uid, -1))
+		fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
+	if (params.droproot && *params.hostlist_auto_debuglog && chown(params.hostlist_auto_debuglog, params.uid, -1))
+		DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", params.hostlist_auto_debuglog);
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		dp = &dpl->dp;
-		if (dp->split_tls==tlspos_none && dp->split_pos) dp->split_tls=tlspos_pos;
-		if (dp->split_http_req==httpreqpos_none && dp->split_pos) dp->split_http_req=httpreqpos_pos;
-		if (params.skip_nodelay && (dp->split_tls || dp->split_http_req || dp->split_pos))
+		if (params.skip_nodelay && dp->split_count)
 		{
 			DLOG_ERR("Cannot split with --skip-nodelay\n");
 			exit_clean(1);
 		}
+		if (params.droproot && dp->hostlist_auto && chown(dp->hostlist_auto->filename, params.uid, -1))
+			DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", dp->hostlist_auto->filename);
 	}
 
 	if (!LoadAllHostLists())
@@ -1141,9 +1341,12 @@ void parse_params(int argc, char *argv[])
 	VPRINT("\nlists summary:\n");
 	HostlistsDebug();
 	IpsetsDebug();
+
+	VPRINT("\nsplits summary:\n");
+	SplitDebug();
 	VPRINT("\n");
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	// do not need args from file anymore
 	cleanup_args();
 #endif
@@ -1302,6 +1505,7 @@ int main(int argc, char *argv[])
 	struct salisten_s list[MAX_BINDS];
 	char ip_port[48];
 
+	set_env_exedir(argv[0]);
 	srand(time(NULL));
 	mask_from_preflen6_prepare();
 

tpws/tpws_conn.c

@@ -24,7 +24,6 @@
 #include "helpers.h"
 #include "hostlist.h"
 
-
 // keep separate legs counter. counting every time thousands of legs can consume cpu
 static int legs_local, legs_remote;
 /*
@@ -93,25 +92,37 @@ static bool socks_send_rep_errno(uint8_t ver, int fd, int errn)
 }
 
 
+static bool cork(int fd, int enable)
+{
+#ifdef __linux__
+	int e = errno;
+	if (setsockopt(fd, SOL_TCP, TCP_CORK, &enable, sizeof(enable))<0)
+	{
+		DLOG_PERROR("setsockopt (TCP_CORK)");
+		errno = e;
+		return false;
+	}
+	errno = e;
+#endif
+	return true;
+}
+
 ssize_t send_with_ttl(int fd, const void *buf, size_t len, int flags, int ttl)
 {
- 	ssize_t wr;
+	ssize_t wr;
 
-	if (ttl)
+	if (!params.skip_nodelay)
 	{
+		int ttl_apply = ttl ? ttl : params.ttl_default;
 		DBGPRINT("send_with_ttl %d fd=%d\n",ttl,fd);
-		if (!set_ttl_hl(fd, ttl))
+		if (!set_ttl_hl(fd, ttl_apply))
 			//DLOG_ERR("could not set ttl %d to fd=%d\n",ttl,fd);
-			DLOG_ERR("could not set ttl %d to fd=%d\n",ttl,fd);
+			DLOG_ERR("could not set ttl %d to fd=%d\n",ttl_apply,fd);
+		cork(fd,true);
 	}
 	wr = send(fd, buf, len, flags);
-	if (ttl)
-	{
-		int e=errno;
-		if (!set_ttl_hl(fd, params.ttl_default))
-			DLOG_ERR("could not set ttl %d to fd=%d\n",params.ttl_default,fd);
-		errno=e;
-	}
+	if (!params.skip_nodelay)
+		cork(fd,false);
 	return wr;
 }
 
@@ -308,19 +319,18 @@ bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
 	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) <0)
 	{
 		DLOG_PERROR("setsockopt (SO_RCVBUF)");
-		close(fd);
 		return false;
 	}
 	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) <0)
 	{
 		DLOG_PERROR("setsockopt (SO_SNDBUF)");
-		close(fd);
 		return false;
 	}
 	dbgprint_socket_buffers(fd);
 	return true;
 }
 
+
 static bool proxy_remote_conn_ack(tproxy_conn_t *conn, int sock_err)
 {
 	// if proxy mode acknowledge connection request
@@ -393,7 +403,10 @@ static int connect_remote(const struct sockaddr *remote_addr, int mss)
 		return -1;
 	}
 	if (!set_socket_buffers(remote_fd, params.remote_rcvbuf, params.remote_sndbuf))
+	{
+		close(remote_fd);
 		return -1;
+	}
 	if (!set_keepalive(remote_fd))
 	{
 		DLOG_PERROR("set_keepalive");
@@ -466,6 +479,33 @@ static int connect_remote(const struct sockaddr *remote_addr, int mss)
 	return remote_fd;
 }
 
+static bool connect_remote_conn(tproxy_conn_t *conn)
+{
+	int mss=0;
+
+	apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
+
+	if (conn->track.dp && conn->track.dp->mss)
+	{
+		mss = conn->track.dp->mss;
+		if (conn->track.dp->hostlist_auto)
+		{
+			if (conn->track.hostname)
+			{
+				bool bHostExcluded;
+				conn->track.b_host_matches = HostlistCheck(conn->track.dp, conn->track.hostname, &bHostExcluded, false);
+				conn->track.b_host_checked = true;
+				if (!conn->track.b_host_matches)
+				{
+					conn->track.b_ah_check = !bHostExcluded;
+					mss = 0;
+				}
+			}
+		}
+	}
+
+	return (conn->partner->fd = connect_remote((struct sockaddr *)&conn->dest, mss))>=0;
+}
 
 //Free resources occupied by this connection
 static void free_conn(tproxy_conn_t *conn)
@@ -623,9 +663,7 @@ static tproxy_conn_t* add_tcp_connection(int efd, struct tailhead *conn_list,int
 		conn->partner->client = conn->client;
 		conn->partner->dest = conn->dest;
 
-		apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
-
-		if ((conn->partner->fd = connect_remote((struct sockaddr *)&orig_dst, conn->track.dp ? conn->track.dp->mss : 0)) < 0)
+		if (!connect_remote_conn(conn))
 		{
 			DLOG_ERR("Failed to connect\n");
 			free_conn(conn->partner);
@@ -798,14 +836,6 @@ static bool proxy_mode_connect_remote(tproxy_conn_t *conn, struct tailhead *conn
 		return false;
 	}
 
-	apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
-
-	if ((remote_fd = connect_remote((struct sockaddr *)&conn->dest, conn->track.dp ? conn->track.dp->mss : 0)) < 0)
-	{
-		DLOG_ERR("socks failed to connect (1) errno=%d\n", errno);
-		socks_send_rep_errno(conn->socks_ver, conn->fd, errno);
-		return false;
-	}
 	if (!(conn->partner = new_conn(remote_fd, true)))
 	{
 		close(remote_fd);
@@ -817,6 +847,15 @@ static bool proxy_mode_connect_remote(tproxy_conn_t *conn, struct tailhead *conn
 	conn->partner->efd = conn->efd;
 	conn->partner->client = conn->client;
 	conn->partner->dest = conn->dest;
+
+	if (!connect_remote_conn(conn))
+	{
+		free_conn(conn->partner); conn->partner = NULL;
+		DLOG_ERR("socks failed to connect (1) errno=%d\n", errno);
+		socks_send_rep_errno(conn->socks_ver, conn->fd, errno);
+		return false;
+	}
+
 	if (!epoll_set(conn->partner, EPOLLOUT))
 	{
 		DLOG_ERR("socks epoll_set error %d\n", errno);
@@ -1068,9 +1107,9 @@ static bool in_tamper_out_range(tproxy_conn_t *conn)
 		 
 }
 
-static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_size, size_t *segment_size, size_t *split_pos, uint8_t *split_flags)
+static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_size, size_t *segment_size, size_t *multisplit_pos, int *multisplit_count, uint8_t *split_flags)
 {
-	*split_pos=0;
+	if (multisplit_count) *multisplit_count=0;
 	if (params.tamper)
 	{
 		if (conn->remote)
@@ -1081,32 +1120,48 @@ static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_
 		else
 		{
 			if (in_tamper_out_range(conn))
-				tamper_out(&conn->track,(struct sockaddr*)&conn->dest,segment,segment_buffer_size,segment_size,split_pos,split_flags);
+				tamper_out(&conn->track,(struct sockaddr*)&conn->dest,segment,segment_buffer_size,segment_size,multisplit_pos,multisplit_count,split_flags);
 		}
 	}
 }
 
 // buffer must have at least one extra byte for OOB
-static ssize_t send_or_buffer_oob(send_buffer_t *sb, int fd, uint8_t *buf, size_t len, int ttl, bool oob, uint8_t oob_byte)
+static ssize_t send_oob(int fd, uint8_t *buf, size_t len, int ttl, bool oob, uint8_t oob_byte)
 {
 	ssize_t wr;
 	if (oob)
 	{
-		VPRINT("Sending OOB byte %02X\n", oob_byte);
 		uint8_t oob_save;
 		oob_save = buf[len];
 		buf[len] = oob_byte;
-		wr = send_or_buffer(sb, fd, buf, len+1, MSG_OOB, ttl);
+		wr = send_with_ttl(fd, buf, len+1, MSG_OOB, ttl);
 		buf[len] = oob_save;
+		if (wr<0 && errno==EAGAIN) wr=0;
 	}
 	else
-		wr = send_or_buffer(sb, fd, buf, len, 0, ttl);
+		wr = send_with_ttl(fd, buf, len, 0, ttl);
 	return wr;
 }
 
 
+static unsigned int segfail_count=0;
+static time_t segfail_report_time=0;
+static void report_segfail(void)
+{
+	time_t now = time(NULL);
+	segfail_count++;
+	if (now==segfail_report_time)
+		VPRINT("WARNING ! segmentation failed. total fails : %u\n", segfail_count);
+	else
+	{
+		DLOG_ERR("WARNING ! segmentation failed. total fails : %u\n", segfail_count);
+		segfail_report_time = now;
+	}
+}
+
 #define RD_BLOCK_SIZE 65536
 #define MAX_WASTE (1024*1024)
+
 static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32_t evt)
 {
 	int numbytes;
@@ -1186,36 +1241,71 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
 #endif
 		{
 			// incoming data from local leg
-			uint8_t buf[RD_BLOCK_SIZE + 5];
+			uint8_t buf[RD_BLOCK_SIZE + 6];
 
 			rd = recv(conn->fd, buf, RD_BLOCK_SIZE, MSG_DONTWAIT);
 			DBGPRINT("recv fd=%d rd=%zd err=%d\n",conn->fd, rd,errno);
 			if (rd<0 && errno==EAGAIN) rd=0;
 			if (rd>0)
 			{
-				size_t split_pos;
+				size_t multisplit_pos[MAX_SPLITS];
+				int multisplit_count;
+
 				uint8_t split_flags;
 
 				bs = rd;
 
 				// tamper needs to know stream position of the block start
-				tamper(conn, buf, sizeof(buf), &bs, &split_pos, &split_flags);
+				tamper(conn, buf, sizeof(buf), &bs, multisplit_pos, &multisplit_count, &split_flags);
 				// increase after tamper
 				conn->tnrd++;
 				conn->trd+=rd;
 
-				if (split_pos && bs<sizeof(buf) && split_pos<sizeof(buf))
+				if (multisplit_count)
 				{
-					VPRINT("Splitting at pos %zu%s\n", split_pos, (split_flags & SPLIT_FLAG_DISORDER) ? " with disorder" : "");
-
-					wr = send_or_buffer_oob(conn->partner->wr_buf, conn->partner->fd, buf, split_pos, !!(split_flags & SPLIT_FLAG_DISORDER), !!(split_flags & SPLIT_FLAG_OOB), conn->track.dp ? conn->track.dp->oob_byte : 0);
-					DBGPRINT("send_or_buffer(1) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
-					if (wr >= 0)
+					ssize_t from,to,len;
+					int i;
+					bool bApplyDisorder, bApplyOOB;
+					for (i=0,from=0;i<=multisplit_count;i++)
 					{
+						to = i==multisplit_count ? bs : multisplit_pos[i];
+
+						bApplyDisorder = !(i & 1) && i<multisplit_count && (split_flags & SPLIT_FLAG_DISORDER);
+						bApplyOOB = i==0 && (split_flags & SPLIT_FLAG_OOB);
+						len = to-from;
+#ifdef __linux__
+						if (params.fix_seg_avail)
+						{
+							if (params.fix_seg)
+							{
+								unsigned int wasted;
+								bool bWaitOK = socket_wait_notsent(conn->partner->fd, params.fix_seg, &wasted);
+								if (wasted)
+									VPRINT("WARNING ! wasted %u ms to fix segmenation\n", wasted);
+								if (!bWaitOK)
+									report_segfail();
+							}
+							else
+							{
+								if (socket_has_notsent(conn->partner->fd))
+									report_segfail();
+							}
+						}
+#endif
+						VPRINT("Sending multisplit part %d %zd-%zd (len %zd)%s%s : ", i+1, from, to, len, bApplyDisorder ? " with disorder" : "", bApplyOOB ? " with OOB" : "");
+						packet_debug(buf+from,len);
+						wr = send_oob(conn->partner->fd, buf+from, len, bApplyDisorder, bApplyOOB, conn->track.dp ? conn->track.dp->oob_byte : 0);
+						if (wr<0) break;
 						conn->partner->twr += wr;
-						wr = send_or_buffer(conn->partner->wr_buf + 1, conn->partner->fd, buf + split_pos, bs - split_pos, 0, 0);
-						DBGPRINT("send_or_buffer(2) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
-						if (wr>0) conn->partner->twr += wr;
+						if (wr<len)
+						{
+							from+=wr;
+							VPRINT("Cannot send part %d immediately. only %zd bytes were sent (%zd left in segment). cancelling split.\n", i+1, wr, bs-from);
+							wr = send_or_buffer(conn->partner->wr_buf, conn->partner->fd, buf+from, bs-from, 0, 0);
+							if (wr>0) conn->partner->twr += wr;
+							break;
+						}
+						from = to;
 					}
 				}
 				else
@@ -1279,7 +1369,7 @@ static bool read_all_and_buffer(tproxy_conn_t *conn, int buffer_number)
 		DBGPRINT("read_all_and_buffer(%d) numbytes=%d\n",buffer_number,numbytes);
 		if (numbytes>0)
 		{
-			if (send_buffer_create(conn->partner->wr_buf+buffer_number, NULL, numbytes, 5, 0, 0))
+			if (send_buffer_create(conn->partner->wr_buf+buffer_number, NULL, numbytes, 6, 0, 0))
 			{
 				ssize_t rd = recv(conn->fd, conn->partner->wr_buf[buffer_number].data, numbytes, MSG_DONTWAIT);
 				if (rd>0)
@@ -1289,10 +1379,7 @@ static bool read_all_and_buffer(tproxy_conn_t *conn, int buffer_number)
 
 					conn->partner->bFlowOut = true;
 
-					size_t split_pos;
-					uint8_t split_flags;
-
-					tamper(conn, conn->partner->wr_buf[buffer_number].data, numbytes+5, &conn->partner->wr_buf[buffer_number].len, &split_pos, &split_flags);
+					tamper(conn, conn->partner->wr_buf[buffer_number].data, numbytes+6, &conn->partner->wr_buf[buffer_number].len, NULL, NULL, NULL);
 
 					if (epoll_update_flow(conn->partner))
 						return true;
@@ -1369,7 +1456,7 @@ static bool handle_resolve_pipe(tproxy_conn_t **conn, struct tailhead *conn_list
 	else if (rd!=sizeof(void*))
 	{
 		// partial pointer read is FATAL. in any case it will cause pointer corruption and coredump
-		DLOG_ERR("resolve_pipe not full read %zu\n",rd);
+		DLOG_ERR("resolve_pipe not full read %zd\n",rd);
 		exit(1000);
 	}
 	b = resolve_complete(ri, conn_list);
@@ -1591,7 +1678,6 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
 						}
 						else
 						{
-
 							DBGPRINT("conn fd=%d has no unsent\n", conn->fd);
 							conn->bFlowIn = false;
 							epoll_update_flow(conn);