Merge 92ba6b439e into 8324c04a41

github: minor

.github/issue_template.md

@@ -0,0 +1,10 @@
+1. Здесь не место для вопросов, касающихся компьютерной грамотности и навыков использования ОС
+2. Здесь не место для вопросов "у меня не работает" без технических подробностей
+3. Здесь не место для вопросов "как мне открыть ютуб" или "что писать в ..."
+4. Здесь не место для обсуждения сборок
+5. Вирусов здесь нет. У вас либо чья-то сборка, либо ваш антивирус давно пора отправить на покой. Не согласны - удаляйте софт.
+
+Все означенное обсуждать в дискуссиях или на форумах.
+При нарушении будет закрываться или конвертироваться в дискуссии.
+Issue только для обсуждения проблем самого софта. Неработа стратегии или ваше неумение настроить - это ваша проблема, а не проблема софта.
+

.github/workflows/build.yml

@@ -82,20 +82,16 @@ jobs:
           export STRIP=$TARGET-strip
           export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
 
-          # optimize for size
-          export CFLAGS="-Os -flto=auto"
-          export LDFLAGS="-Os"
-
           # netfilter libs
-          git clone --depth 1 -b libmnl-1.0.5 git://git.netfilter.org/libmnl
-          git clone --depth 1 -b libnfnetlink-1.0.2 git://git.netfilter.org/libnfnetlink
-          git clone --depth 1 -b libnetfilter_queue-1.0.5 git://git.netfilter.org/libnetfilter_queue
+          wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libmnl/libmnl-1.0.5.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libnetfilter_queue/libnetfilter_queue-1.0.5.tar.bz2 | tar -xj
 
           for i in libmnl libnfnetlink libnetfilter_queue ; do
             (
-              cd $i
-              ./autogen.sh && \
-              ./configure --prefix= --host=$TARGET --enable-static --disable-shared && \
+              cd $i-*
+              CFLAGS="-Os -flto=auto" \
+              ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
               make install -j$(nproc) DESTDIR=$DEPS_DIR
             )
             sed -i "s|^prefix=.*|prefix=$DEPS_DIR|g" $DEPS_DIR/lib/pkgconfig/$i.pc
@@ -106,7 +102,8 @@ jobs:
             xargs -I{} wget -qO- https://github.com/madler/zlib/archive/refs/tags/{}.tar.gz | tar -xz
           (
             cd zlib-*
-            ./configure --prefix= --static && \
+            CFLAGS="-Os -flto=auto" \
+            ./configure --prefix= --static
             make install -j$(nproc) DESTDIR=$DEPS_DIR
           )
 
@@ -116,8 +113,8 @@ jobs:
           install -Dm644 -t $DEPS_DIR/include/sys /usr/include/x86_64-linux-gnu/sys/queue.h /usr/include/sys/capability.h
 
           # zapret
-          CFLAGS="$CFLAGS -static-libgcc -static -I$DEPS_DIR/include" \
-          LDFLAGS="$LDFLAGS -L$DEPS_DIR/lib" \
+          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include" \
+          LDFLAGS="-L$DEPS_DIR/lib" \
           make -C zapret -j$(nproc)
           tar -C zapret/binaries/my -cJf zapret-linux-$ARCH.tar.xz .
 
@@ -137,6 +134,7 @@ jobs:
 
       - name: Build zapret
         run: |
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
           make mac -j$(sysctl -n hw.logicalcpu)
           tar -C binaries/my -cJf zapret-mac-x64.tar.xz .
 
@@ -171,7 +169,8 @@ jobs:
           TARGET: ${{ matrix.target }}
           ARCH: ${{ matrix.arch }}
         run: |
-          settarget $TARGET-freebsd11 make bsd -j$(nproc) || exit 1
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
+          settarget $TARGET-freebsd11 make bsd -j$(nproc)
           tar -C binaries/my -cJf zapret-freebsd-$ARCH.tar.xz .
 
       - name: Upload artifacts
@@ -204,6 +203,7 @@ jobs:
       - name: Build ip2net, mdig
         shell: msys2 {0}
         run: |
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
           mkdir -p output
           cd zapret
           mingw32-make -C ip2net win
@@ -260,6 +260,7 @@ jobs:
         shell: C:\cygwin\bin\bash.exe -eo pipefail '{0}'
         run: >-
           export MAKEFLAGS=-j$(nproc) &&
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}" &&
           cd zapret &&
           make -C nfq ${TARGET} &&
           cp -a nfq/winws.exe ../output
@@ -282,9 +283,74 @@ jobs:
           path: zapret-*.zip
           if-no-files-found: error
 
+  build-android:
+    name: Android ${{ matrix.abi }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - abi: armeabi-v7a
+            target: armv7a-linux-androideabi
+          - abi: arm64-v8a
+            target: aarch64-linux-android
+          - abi: x86
+            target: i686-linux-android
+          - abi: x86_64
+            target: x86_64-linux-android
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: zapret
+
+      - name: Build
+        env:
+          ABI: ${{ matrix.abi }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          DEPS_DIR=$GITHUB_WORKSPACE/deps
+          export TOOLCHAIN=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64
+          export API=21
+          export CC="$TOOLCHAIN/bin/clang --target=$TARGET$API"
+          export AR=$TOOLCHAIN/bin/llvm-ar
+          export AS=$CC
+          export LD=$TOOLCHAIN/bin/ld
+          export RANLIB=$TOOLCHAIN/bin/llvm-ranlib
+          export STRIP=$TOOLCHAIN/bin/llvm-strip
+          export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
+
+          # netfilter libs
+          wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libmnl/libmnl-1.0.5.tar.bz2 | tar -xj
+          wget -qO- https://www.netfilter.org/pub/libnetfilter_queue/libnetfilter_queue-1.0.5.tar.bz2 | tar -xj
+          patch -p1 -d libnetfilter_queue-* -i ../zapret/.github/workflows/libnetfilter_queue-android.patch
+
+          for i in libmnl libnfnetlink libnetfilter_queue ; do
+            (
+              cd $i-*
+              CFLAGS="-Os -flto=auto -Wno-implicit-function-declaration" \
+              ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
+              make install -j$(nproc) DESTDIR=$DEPS_DIR
+            )
+            sed -i "s|^prefix=.*|prefix=$DEPS_DIR|g" $DEPS_DIR/lib/pkgconfig/$i.pc
+          done
+
+          # zapret
+          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -I$DEPS_DIR/include" \
+          LDFLAGS="-L$DEPS_DIR/lib" \
+          make -C zapret android -j$(nproc)
+          zip zapret-android-$ABI.zip -j zapret/binaries/my/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: zapret-android-${{ matrix.abi }}
+          path: zapret-*.zip
+          if-no-files-found: error
+
   release:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-    needs: [ build-linux, build-windows, build-macos, build-freebsd ]
+    needs: [ build-linux, build-windows, build-macos, build-freebsd, build-android ]
     permissions:
       contents: write
     runs-on: ubuntu-latest
@@ -343,6 +409,10 @@ jobs:
             if [ -d $dir ]; then
               echo "Processing $dir"
               case $dir in
+                *-android-arm64-v8a )   run_dir android-aarch64 ;;
+                *-android-armeabi-v7a ) run_dir android-arm ;;
+                *-android-x86 )         run_dir android-x86 ;;
+                *-android-x86_64 )      run_dir android-x86_64 ;;
                 *-freebsd-x86_64 )      run_dir freebsd-x64 ;;
                 *-linux-arm )           run_dir arm ;;
                 *-linux-arm64 )         run_dir aarch64 ;;
@@ -363,8 +433,16 @@ jobs:
       - name: Create release bundles
         run: |
           rm -rf ${{ env.repo_dir }}/.git*
-          tar -czf ${{ env.repo_dir }}.tar.gz ${{ env.repo_dir }}
+          find ${{ env.repo_dir }}/binaries -type f -exec sha256sum {} \; >sha256sum.txt
+          tar --owner=0 --group=0 -czf ${{ env.repo_dir }}.tar.gz ${{ env.repo_dir }}
           zip -qr ${{ env.repo_dir }}.zip ${{ env.repo_dir }}
+          (
+            cd ${{ env.repo_dir }}
+            rm -rf binaries/{android*,freebsd*,mac*,win*,x86_64/tpws_wsl.tgz} \
+                   init.d/{openrc,macos,pfsense,runit,s6,systemd} \
+                   tpws nfq ip2net mdig docs files/huawei Makefile
+          )
+          tar --owner=0 --group=0 -czf ${{ env.repo_dir }}-openwrt-embedded.tar.gz ${{ env.repo_dir }}
 
       - name: Upload release assets
         uses: softprops/action-gh-release@v2
@@ -377,3 +455,4 @@ jobs:
           files: |
             zapret*.tar.gz
             zapret*.zip
+            sha256sum.txt

.github/workflows/libnetfilter_queue-android.patch

@@ -0,0 +1,41 @@
+--- a/src/extra/pktbuff.c
++++ b/src/extra/pktbuff.c
+@@ -14,7 +14,7 @@
+ #include <string.h> /* for memcpy */
+ #include <stdbool.h>
+ 
+-#include <netinet/if_ether.h>
++#include <linux/if_ether.h>
+ #include <netinet/ip.h>
+ #include <netinet/tcp.h>
+ 
+--- a/src/nlmsg.c
++++ b/src/nlmsg.c
+@@ -21,7 +21,7 @@
+ 
+ #include <linux/netfilter/nfnetlink_queue.h>
+ 
+-#include <libnetfilter_queue/libnetfilter_queue.h>
++// #include <libnetfilter_queue/libnetfilter_queue.h>
+ 
+ #include "internal.h"
+ 
+--- a/src/extra/tcp.c
++++ b/src/extra/tcp.c
+@@ -139,12 +139,16 @@ void nfq_tcp_compute_checksum_ipv6(struc
+  *  (union is compatible to any of its members)
+  *  This means this part of the code is -fstrict-aliasing safe now.
+  */
++#ifndef __ANDROID__
+ union tcp_word_hdr {
+ 	struct tcphdr hdr;
+ 	uint32_t  words[5];
+ };
++#endif
+ 
++#ifndef tcp_flag_word
+ #define tcp_flag_word(tp) ( ((union tcp_word_hdr *)(tp))->words[3])
++#endif
+ 
+ /**
+  * nfq_pkt_snprintf_tcp_hdr - print tcp header into one buffer in a humnan

.gitignore

@@ -1,7 +1,9 @@
 /config
 ip2net/ip2net
 mdig/mdig
+nfq/dvtws
 nfq/nfqws
+nfq/winws.exe
 tpws/tpws
 binaries/my/
 init.d/**/custom

Makefile

@@ -15,6 +15,19 @@ all:	clean
 		done \
 	done
 
+android: clean
+	@mkdir -p "$(TGT)"; \
+	for dir in $(DIRS); do \
+		find "$$dir" -type f  \( -name "*.c" -o -name "*.h" -o -name "*akefile" \) -exec chmod -x {} \; ; \
+		$(MAKE) -C "$$dir" android || exit; \
+		for exe in "$$dir/"*; do \
+			if [ -f "$$exe" ] && [ -x "$$exe" ]; then \
+				mv -f "$$exe" "${TGT}" ; \
+				ln -fs "../${TGT}/$$(basename "$$exe")" "$$exe" ; \
+			fi \
+		done \
+	done
+
 bsd:	clean
 	@mkdir -p "$(TGT)"; \
 	for dir in $(DIRS); do \

blockcheck.sh

@@ -45,7 +45,6 @@ HTTP_PORT=${HTTP_PORT:-80}
 HTTPS_PORT=${HTTPS_PORT:-443}
 QUIC_PORT=${QUIC_PORT:-443}
 UNBLOCKED_DOM=${UNBLOCKED_DOM:-iana.org}
-[ "$CURL_VERBOSE" = 1 ] && CURL_CMD=1
 
 HDRTEMP=/tmp/zapret-hdr.txt
 
@@ -792,7 +791,7 @@ pktws_ipt_prepare()
 			# disable PF to avoid interferences
 			pf_is_avail && pfctl -qd
 			for ip in $3; do
-				IPFW_ADD divert $IPFW_DIVERT_PORT $1 from me to $ip $2 proto ip${IPV} out not diverted not sockarg
+				IPFW_ADD divert $IPFW_DIVERT_PORT $1 from me to $ip $2 proto ip${IPV} out not diverted
 			done
 			;;
 		opf)
@@ -867,7 +866,7 @@ pktws_ipt_prepare_tcp()
 			;;
 		ipfw)
 			for ip in $2; do
-				IPFW_ADD divert $IPFW_DIVERT_PORT tcp from $ip $1 to me proto ip${IPV} tcpflags syn,ack in not diverted not sockarg
+				IPFW_ADD divert $IPFW_DIVERT_PORT tcp from $ip $1 to me proto ip${IPV} tcpflags syn,ack in not diverted
 			done
 			;;
 	esac
@@ -994,7 +993,6 @@ ws_curl_test()
 	# $2 - test function
 	# $3 - domain
 	# $4,$5,$6, ... - ws params
-
 	local code ws_start=$1 testf=$2 dom=$3
 	shift
 	shift
@@ -1013,6 +1011,14 @@ tpws_curl_test()
 	echo - checking tpws $3 $4 $5 $6 $7 $8 $9${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}
 	local ALL_PROXY="socks5://127.0.0.1:$SOCKS_PORT"
 	ws_curl_test tpws_start "$@"${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}
+	local testf=$1 dom=$2 strategy code=$?
+	[ "$code" = 0 ] && {
+		shift; shift;
+		strategy="$@"
+		strategy_append_extra_tpws
+		report_append "ipv${IPV} $dom $testf : tpws ${WF:+$WF }$strategy"
+	}
+	return $code
 }
 pktws_curl_test()
 {
@@ -1021,7 +1027,25 @@ pktws_curl_test()
 	# $3,$4,$5, ... - nfqws/dvtws params
 	echo - checking $PKTWSD ${WF:+$WF }$3 $4 $5 $6 $7 $8 $9${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}
 	ws_curl_test pktws_start "$@"${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}
+	local testf=$1 dom=$2 strategy code=$?
+	[ "$code" = 0 ] && {
+		shift; shift;
+		strategy="$@"
+		strategy_append_extra_pktws
+		report_append "ipv${IPV} $dom $testf : $PKTWSD ${WF:+$WF }$strategy"
 	}
+	return $code
+}
+
+strategy_append_extra_pktws()
+{
+	strategy="${strategy:+$strategy${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}}"
+}
+strategy_append_extra_tpws()
+{
+	strategy="${strategy:+$strategy${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}}"
+}
+
 xxxws_curl_test_update()
 {
 	# $1 - xxx_curl_test function
@@ -1073,7 +1097,7 @@ report_strategy()
 		strategy="$(echo "$strategy" | xargs)"
 		echo "!!!!! $1: working strategy found for ipv${IPV} $2 : $3 $strategy !!!!!"
 		echo
-		report_append "ipv${IPV} $2 $1 : $3 ${WF:+$WF }$strategy"
+#		report_append "ipv${IPV} $2 $1 : $3 ${WF:+$WF }$strategy"
 		return 0
 	else
 		echo "$1: $3 strategy for ipv${IPV} $2 not found"
@@ -1086,9 +1110,13 @@ test_has_split()
 {
 	contains "$1" split || contains "$1" disorder
 }
+test_has_fakedsplit()
+{
+	contains "$1" fakedsplit || contains "$1" fakeddisorder
+}
 test_has_fake()
 {
-	contains "$1" fake
+	[ "$1" = fake ] || starts_with "$1" fake,
 }
 warn_fool()
 {
@@ -1105,25 +1133,37 @@ pktws_curl_test_update_vary()
 	# $4 - desync mode
 	# $5,$6,... - strategy
 
-	local testf=$1 sec=$2 domain=$3 desync=$4 zerofake split fake
+	local testf=$1 sec=$2 domain=$3 desync=$4 proto zerofake= splits= pos fake ret=1
 	
 	shift; shift; shift; shift
 	
-	zerofake=http
-	[ "$sec" = 0 ] || zerofake=tls
-	zerofake="--dpi-desync-fake-$zerofake=0x00000000"
-	
+	proto=http
+	[ "$sec" = 0 ] || proto=tls
+	test_has_fake $desync && zerofake="--dpi-desync-fake-$proto=0x00000000"
+	if test_has_fakedsplit $desync ; then
+		splits="method+2 midsld"
+		[ "$sec" = 0 ] || splits="1 midsld"
+	elif test_has_split $desync ; then
+		splits="method+2 midsld"
+		[ "$sec" = 0 ] || splits="1 midsld 1,midsld"
+	fi
 	for fake in '' $zerofake ; do
-		for split in '' '--dpi-desync-split-pos=1' ; do
-			pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" $fake $split && return 0
-			# split-pos=1 is meaningful for DPIs searching for 16 03 in TLS. no reason to apply to http
-			[ "$sec" = 1 ] || break
-			test_has_split $desync || break
+		if [ -n "$splits" ]; then
+			for pos in $splits ; do
+				pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" --dpi-desync-split-pos=$pos $fake && {
+					[ "$SCANLEVEL" = force ] || return 0
+					ret=0
+				}
 			done
-		test_has_fake $desync || break
+		else
+			pktws_curl_test_update $testf $domain --dpi-desync=$desync "$@" $fake && {
+				[ "$SCANLEVEL" = force ] || return 0
+				ret=0
+			}
+		fi
 	done
 
-	return 1
+	return $ret
 }
 
 pktws_check_domain_http_bypass_()
@@ -1132,82 +1172,73 @@ pktws_check_domain_http_bypass_()
 	# $2 - encrypted test : 0 = plain, 1 - encrypted with server reply risk, 2 - encrypted without server reply risk
 	# $3 - domain
 
-	local tests='fake' ret ok ttls s f e desync pos fooling frag sec="$2" delta hostcase
+	local ok ttls s f f2 e desync pos fooling frag sec="$2" delta splits
+	local need_split need_disorder need_fakedsplit need_fakeddisorder need_fake need_wssize
+	local splits_http='method+2 midsld method+2,midsld'
+	local splits_tls='2 1 sniext+1 sniext+4 host+1 midsld 1,midsld 1,sniext+1,host+1,midsld-2,midsld,midsld+2,endhost-1'
 
 	[ "$sec" = 0 ] && {
-		for s in '--hostcase' '--hostspell=hoSt' '--hostnospace' '--domcase'; do
+		for s in '--hostcase' '--hostspell=hoSt' '--hostnospace' '--domcase' '--methodeol'; do
 			pktws_curl_test_update $1 $3 $s
 		done
 	}
 
-	s="--dpi-desync=split2"
-	ok=0
-	pktws_curl_test_update $1 $3 $s
-	ret=$?
-	[ "$ret" = 0 ] && {
-		[ "$SCANLEVEL" = quick ] && return
-		ok=1
-	}
-	[ "$ret" != 0 -o "$SCANLEVEL" = force ] && {
-		if [ "$sec" = 0 ]; then
-			pktws_curl_test_update $1 $3 $s --hostcase && {
-				[ "$SCANLEVEL" = quick ] && return
-				ok=1
-			}
-			for pos in method host; do
-				for hostcase in '' '--hostcase'; do
-					pktws_curl_test_update $1 $3 $s --dpi-desync-split-http-req=$pos $hostcase && {
-						[ "$SCANLEVEL" = quick ] && return
-						ok=1
-					}
-				done
-			done
-		else
-			for pos in sni sniext; do
-				pktws_curl_test_update $1 $3 $s --dpi-desync-split-tls=$pos && {
-					[ "$SCANLEVEL" = quick ] && return
-					ok=1
-				}
-			done
-		fi
-		for pos in 1 3 4 5 10 50; do
-			s="--dpi-desync=split2 --dpi-desync-split-pos=$pos"
-			if pktws_curl_test_update $1 $3 $s; then
-				[ "$SCANLEVEL" = quick ] && return
-				ok=1
-				[ "$SCANLEVEL" = force ] || break
-			elif [ "$sec" = 0 ]; then
-				pktws_curl_test_update $1 $3 $s --hostcase && [ "$SCANLEVEL" = quick ] && return
-			fi
-		done
-	}
-	[ "$ok" = 1 -a "$SCANLEVEL" != force ] || tests="$tests split fake,split2 fake,split"
-
-	pktws_curl_test_update $1 $3 --dpi-desync=disorder2
-	ret=$?
-	[ "$ret" = 0 -a "$SCANLEVEL" = quick ] && return
-	[ "$ret" != 0 -o "$SCANLEVEL" = force ] && {
-	    pktws_curl_test_update $1 $3 --dpi-desync=disorder2 --dpi-desync-split-pos=1
-	    ret=$?
-	    [ "$ret" = 0 -a "$SCANLEVEL" = quick ] && return
-	}
-	[ "$ret" != 0 -o "$SCANLEVEL" = force ] && tests="$tests disorder fake,disorder2 fake,disorder"
-
 	ttls=$(seq -s ' ' $MIN_TTL $MAX_TTL)
+	need_wssize=1
 	for e in '' '--wssize 1:6'; do
+		need_split=
+		need_disorder=
+
 		[ -n "$e" ] && {
 			pktws_curl_test_update $1 $3 $e && [ "$SCANLEVEL" = quick ] && return
-			for desync in split2 disorder2; do
-				pktws_curl_test_update_vary $1 $2 $3 $desync $e && [ "$SCANLEVEL" = quick ] && return
-			done
 		}
-		for desync in $tests; do
+
+		for desync in multisplit multidisorder; do
+			ok=0
+			splits="$splits_http"
+			[ "$sec" = 0 ] || splits="$splits_tls"
+			for pos in $splits; do
+				pktws_curl_test_update $1 $3 --dpi-desync=$desync --dpi-desync-split-pos=$pos $e && {
+					[ "$SCANLEVEL" = quick ] && return
+					ok=1
+					need_wssize=0
+					[ "$SCANLEVEL" = force ] || break
+				}
+			done
+			[ "$ok" = 1 -a "$SCANLEVEL" != force ] || {
+				case $desync in
+					multisplit)
+						need_split=1
+						;;
+					multidisorder)
+						need_disorder=1
+						;;
+				esac
+			}
+		done
+
+		need_fakedsplit=1
+		need_fakeddisorder=1
+		need_fake=1
+		for desync in fake ${need_split:+fakedsplit fake,multisplit fake,fakedsplit} ${need_disorder:+fakeddisorder fake,multidisorder fake,fakeddisorder}; do
+			[ "$need_fake" = 0 ] && test_has_fake "$desync" && continue
+			[ "$need_fakedsplit" = 0 ] && contains "$desync" fakedsplit && continue
+			[ "$need_fakeddisorder" = 0 ] && contains "$desync" fakeddisorder && continue
+			ok=0
 			for ttl in $ttls; do
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-ttl=$ttl $e && {
 					[ "$SCANLEVEL" = quick ] && return
+					ok=1
+					need_wssize=0
 					break
 				}
 			done
+			# only skip tests if TTL succeeded. do not skip if TTL failed but fooling succeeded
+			[ $ok = 1 -a "$SCANLEVEL" != force ] && {
+				[ "$desync" = fake ] && need_fake=0
+				[ "$desync" = fakedsplit ] && need_fakedsplit=0
+				[ "$desync" = fakeddisorder ] && need_fakeddisorder=0
+			}
 			f=
 			[ "$UNAME" = "OpenBSD" ] || f="badsum"
 			f="$f badseq datanoack md5sig"
@@ -1216,37 +1247,68 @@ pktws_check_domain_http_bypass_()
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-fooling=$fooling $e && {
 					warn_fool $fooling
 					[ "$SCANLEVEL" = quick ] && return
+					need_wssize=0
 				}
 			done
 		done
+
 		[ "$IPV" = 6 ] && {
-			f="hopbyhop hopbyhop,split2 hopbyhop,disorder2 destopt destopt,split2 destopt,disorder2"
-			[ -n "$IP6_DEFRAG_DISABLE" ] && f="$f ipfrag1 ipfrag1,split2 ipfrag1,disorder2"
+			f="hopbyhop ${need_split:+hopbyhop,multisplit} ${need_disorder:+hopbyhop,multidisorder} destopt ${need_split:+destopt,multisplit} ${need_disorder:+destopt,multidisorder}"
+			[ -n "$IP6_DEFRAG_DISABLE" ] && f="$f ipfrag1 ${need_split:+ ipfrag1,multisplit} ${need_disorder:+ ipfrag1,multidisorder}"
 			for desync in $f; do
-				pktws_curl_test_update_vary $1 $2 $3 $desync $e && [ "$SCANLEVEL" = quick ] && return
+				pktws_curl_test_update_vary $1 $2 $3 $desync $e && {
+					[ "$SCANLEVEL" = quick ] && return
+					need_wssize=0
+				}
 			done
 		}
 
-		for desync in split2 disorder2; do
-			s="--dpi-desync=$desync"
+		[ "$need_split" = 1 ] && {
+			# relative markers can be anywhere, even in subsequent packets. first packet can be MTU-full.
+			# make additional split pos "10" to guarantee enough space for seqovl and likely to be before midsld,sniext,...
+			# method is always expected in the beginning of the first packet
+			f="method+2 method+2,midsld"
+			[ "$sec" = 0 ] || f="10 10,sniext+1 10,sniext+4 10,midsld"
+			for pos in $f; do
+				pktws_curl_test_update $1 $3 --dpi-desync=multisplit --dpi-desync-split-pos=$pos --dpi-desync-split-seqovl=1 $e && {
+					[ "$SCANLEVEL" = quick ] && return
+					need_wssize=0
+				}
+			done
+			[ "$sec" != 0 ] && pktws_curl_test_update $1 $3 --dpi-desync=multisplit --dpi-desync-split-pos=2 --dpi-desync-split-seqovl=336 --dpi-desync-split-seqovl-pattern="$ZAPRET_BASE/files/fake/tls_clienthello_iana_org.bin" $e && {
+				[ "$SCANLEVEL" = quick ] && return
+				need_wssize=0
+			}
+		}
+		[ "$need_disorder" = 1 ] && {
 			if [ "$sec" = 0 ]; then
-				for pos in method host; do
-					pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=1 --dpi-desync-split-http-req=$pos $e && [ "$SCANLEVEL" = quick ] && return
+				for pos in 'method+1 method+2' 'midsld-1 midsld' 'method+1 method+2,midsld'; do
+					f="$(extract_arg 1 $pos)"
+					f2="$(extract_arg 2 $pos)"
+					pktws_curl_test_update $1 $3 --dpi-desync=multidisorder --dpi-desync-split-pos=$f2 --dpi-desync-split-seqovl=$f $e && {
+						[ "$SCANLEVEL" = quick ] && return
+						need_wssize=0
+					}
 				done
 			else
-				for pos in sni sniext; do
-					pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=1 --dpi-desync-split-tls=$pos $e && [ "$SCANLEVEL" = quick ] && return
-				done
-			fi
-			for pos in 2 3 4 5 10 50; do
-				pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=$(($pos - 1)) --dpi-desync-split-pos=$pos $e && [ "$SCANLEVEL" = quick ] && return
-			done
-			[ "$sec" != 0 -a $desync = split2 ] && {
-				pktws_curl_test_update $1 $3 $s --dpi-desync-split-seqovl=336 --dpi-desync-split-seqovl-pattern="$ZAPRET_BASE/files/fake/tls_clienthello_iana_org.bin" $e && [ "$SCANLEVEL" = quick ] && return
+				for pos in '1 2' 'sniext sniext+1' 'sniext+3 sniext+4' 'midsld-1 midsld' '1 2,midsld'; do
+					f=$(extract_arg 1 $pos)
+					f2=$(extract_arg 2 $pos)
+					pktws_curl_test_update $1 $3 --dpi-desync=multidisorder --dpi-desync-split-pos=$f2 --dpi-desync-split-seqovl=$f $e && {
+						[ "$SCANLEVEL" = quick ] && return
+						need_wssize=0
 					}
 				done
+			fi
+		}
 
-		for desync in $tests; do
+		need_fakedsplit=1
+		need_fakeddisorder=1
+		need_fake=1
+		for desync in fake ${need_split:+fakedsplit fake,multisplit fake,fakedsplit} ${need_disorder:+fakeddisorder fake,multidisorder fake,fakeddisorder}; do
+			[ "$need_fake" = 0 ] && test_has_fake "$desync" && continue
+			[ "$need_fakedsplit" = 0 ] && contains "$desync" fakedsplit && continue
+			[ "$need_fakeddisorder" = 0 ] && contains "$desync" fakeddisorder && continue
 			ok=0
 			for delta in 1 2 3 4 5; do
 				pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-ttl=1 --dpi-desync-autottl=$delta $e && ok=1
@@ -1256,18 +1318,25 @@ pktws_check_domain_http_bypass_()
 				echo "WARNING ! although autottl worked it requires testing on multiple domains to find out reliable delta"
 				echo "WARNING ! if a reliable delta cannot be found it's a good idea not to use autottl"
 				[ "$SCANLEVEL" = quick ] && return
+				need_wssize=0
+				[ "$SCANLEVEL" = force ] || {
+					[ "$desync" = fake ] && need_fake=0
+					[ "$desync" = fakedsplit ] && need_fakedsplit=0
+					[ "$desync" = fakeddisorder ] && need_fakeddisorder=0
+				}
 			}			
 		done
 
 		s="http_iana_org.bin"
 		[ "$sec" = 0 ] || s="tls_clienthello_iana_org.bin"
-		for desync in syndata syndata,split2 syndata,disorder2 ; do
+		for desync in syndata ${need_split:+syndata,multisplit} ${need_disorder:+syndata,multidisorder} ; do
 			pktws_curl_test_update_vary $1 $2 $3 $desync $e && [ "$SCANLEVEL" = quick ] && return
 			pktws_curl_test_update_vary $1 $2 $3 $desync --dpi-desync-fake-syndata="$ZAPRET_BASE/files/fake/$s" $e && [ "$SCANLEVEL" = quick ] && return
 		done
 
 		# do not do wssize test for http and TLS 1.3. it's useless
 		[ "$sec" = 1 ] || break
+		[ "$SCANLEVEL" = force -o "$need_wssize" = 1 ] || break
 	done
 }
 pktws_check_domain_http_bypass()
@@ -1278,7 +1347,7 @@ pktws_check_domain_http_bypass()
 
 	local strategy
 	pktws_check_domain_http_bypass_ "$@"
-	strategy="${strategy:+$strategy${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}}"
+	strategy_append_extra_pktws
 	report_strategy $1 $3 $PKTWSD
 }
 
@@ -1323,7 +1392,7 @@ pktws_check_domain_http3_bypass()
 
 	local strategy
 	pktws_check_domain_http3_bypass_ "$@"
-	strategy="${strategy:+$strategy $PKTWS_EXTRA $PKTWS_EXTRA_1 $PKTWS_EXTRA_2 $PKTWS_EXTRA_3 $PKTWS_EXTRA_4 $PKTWS_EXTRA_5 $PKTWS_EXTRA_6 $PKTWS_EXTRA_7 $PKTWS_EXTRA_8 $PKTWS_EXTRA_9}"
+	strategy_append_extra_pktws
 	report_strategy $1 $2 $PKTWSD
 }
 warn_mss()
@@ -1338,50 +1407,58 @@ tpws_check_domain_http_bypass_()
 	# $2 - encrypted test : 0 = plain, 1 - encrypted with server reply risk, 2 - encrypted without server reply risk
 	# $3 - domain
 
-	local s mss s2 s3 pos sec="$2"
+	local s mss s2 s3 oobdis pos sec="$2"
+	local splits_tls='2 1 sniext+1 sniext+4 host+1 midsld 1,midsld 1,sniext+1,host+1,midsld,endhost-1'
+	local splits_http='method+2 midsld method+2,midsld'
+
+	# simulteneous oob and disorder works properly only in linux. other systems retransmit oob byte without URG tcp flag and poison tcp stream.
+	[ "$UNAME" = Linux ] && oobdis='--oob --disorder'
 	if [ "$sec" = 0 ]; then
-		for s in '--hostcase' '--hostspell=hoSt' '--hostdot' '--hosttab' '--hostnospace' '--domcase' \
-			'--hostpad=1024' '--hostpad=2048' '--hostpad=4096' '--hostpad=8192' '--hostpad=16384' ; do
+		for s in '--hostcase' '--hostspell=hoSt' '--hostdot' '--hosttab' '--hostnospace' '--domcase' ; do
 			tpws_curl_test_update $1 $3 $s && [ "$SCANLEVEL" = quick ] && return
 		done
-		for s2 in '' '--oob' '--disorder' '--oob --disorder'; do
-			for s in '--split-http-req=method' '--split-http-req=method --hostcase' '--split-http-req=host' '--split-http-req=host --hostcase' ; do
-				tpws_curl_test_update $1 $3 $s $s2 && [ "$SCANLEVEL" = quick ] && return
+		for s in 1024 2048 4096 8192 16384 ; do
+			tpws_curl_test_update $1 $3 --hostpad=$s && [ "$SCANLEVEL" != force ] && {
+				[ "$SCANLEVEL" = quick ] && return
+				break
+			}
+		done
+		for s2 in '' '--hostcase' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
+			for s in $splits_http ; do
+				tpws_curl_test_update $1 $3 --split-pos=$s $s2 && [ "$SCANLEVEL" != force ] && {
+					[ "$SCANLEVEL" = quick ] && return
+					break
+				}
 			done
 		done
 		for s in  '--methodspace' '--unixeol' '--methodeol'; do
 			tpws_curl_test_update $1 $3 $s && [ "$SCANLEVEL" = quick ] && return
 		done
 	else
+		local need_mss=1
 		for mss in '' 88; do
 			s3=${mss:+--mss=$mss}
-			for s2 in '' '--oob' '--disorder' '--oob --disorder'; do
-				for pos in sni sniext; do
-					s="--split-tls=$pos"
-					tpws_curl_test_update $1 $3 $s $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
-						[ "$SCANLEVEL" = quick ] && return
-						break
-					}
-				done
-				for pos in 1 2 3 4 5 10 50; do
-					s="--split-pos=$pos"
-					tpws_curl_test_update $1 $3 $s $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
+			for s2 in '' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
+				for pos in $splits_tls; do
+					tpws_curl_test_update $1 $3 --split-pos=$pos $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
 						[ "$SCANLEVEL" = quick ] && return
+						need_mss=0
 						break
 					}
 				done
 			done
-			for s2 in '--tlsrec=sni' '--tlsrec=sni --split-tls=sni' '--tlsrec=sni --split-tls=sni --oob' \
-					'--tlsrec=sni --split-tls=sni --disorder' '--tlsrec=sni --split-tls=sni --oob --disorder' \
-					'--tlsrec=sni --split-pos=1' '--tlsrec=sni --split-pos=1 --oob' '--tlsrec=sni --split-pos=1 --disorder' \
-					'--tlsrec=sni --split-pos=1 --oob --disorder'; do
-				tpws_curl_test_update $1 $3 $s2 $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
+			for s in '' '--oob' '--disorder' ${oobdis:+"$oobdis"}; do
+				for s2 in '--tlsrec=midsld' '--tlsrec=sniext+1 --split-pos=midsld' '--tlsrec=sniext+4 --split-pos=midsld' '--tlsrec=sniext+1 --split-pos=1,midsld' '--tlsrec=sniext+4 --split-pos=1,midsld' ; do
+					tpws_curl_test_update $1 $3 $s2 $s $s3 && warn_mss $s3 && [ "$SCANLEVEL" != force ] && {
 						[ "$SCANLEVEL" = quick ] && return
+						need_mss=0
 						break
 					}
 				done
+			done
 			# only linux supports mss
 			[ "$UNAME" = Linux -a "$sec" = 1 ] || break
+			[ "$SCANLEVEL" = force -o "$need_mss" = 1 ] || break
 		done
 	fi
 }
@@ -1393,7 +1470,7 @@ tpws_check_domain_http_bypass()
 
 	local strategy
 	tpws_check_domain_http_bypass_ "$@"
-	strategy="${strategy:+$strategy${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}}"
+	strategy_append_extra_tpws
 	report_strategy $1 $3 tpws
 }
 
@@ -1682,17 +1759,6 @@ ask_params()
 		echo "installed curl version does not support http3 QUIC. tests disabled."
 	fi
 
-	IGNORE_CA=0
-	CURL_OPT=
-	[ $ENABLE_HTTPS_TLS13 = 1 -o $ENABLE_HTTPS_TLS12 = 1 ] && {
-		echo
-		echo "on limited systems like openwrt CA certificates might not be installed to preserve space"
-		echo "in such a case curl cannot verify server certificate and you should either install ca-bundle or disable verification"
-		echo "however disabling verification will break https check if ISP does MitM attack and substitutes server certificate"
-		ask_yes_no_var IGNORE_CA "do not verify server certificate"
-		[ "$IGNORE_CA" = 1 ] && CURL_OPT=-k
-	}
-
 	echo
 	echo "sometimes ISPs use multiple DPIs or load balancing. bypass strategies may work unstable."
 	printf "how many times to repeat each test (default: 1) : "

common/base.sh

@@ -60,11 +60,22 @@ starts_with()
 	esac
 	return 1
 }
+extract_arg()
+{
+	# $1 - arg number
+	# $2,$3,... - args
+        local n=$1
+        while [ -n "$1" ]; do
+                shift
+                [ $n -eq 1 ] && { echo "$1"; return 0; }
+                n=$(($n-1))
+        done
+        return 1
+}
 find_str_in_list()
 {
 	# $1 - string
 	# $2 - space separated values
-
 	local v
 	[ -n "$1" ] && {
 		for v in $2; do

common/installer.sh

@@ -140,7 +140,7 @@ echo_var()
 	eval v="\$$1"
 	if find_str_in_list $1 "$EDITVAR_NEWLINE_VARS"; then
 		echo "$1=\""
-		echo "$v\"" | sed "s/$EDITVAR_NEWLINE_DELIMETER /$EDITVAR_NEWLINE_DELIMETER\n/g"
+		echo "$v\"" | tr '\n' ' ' | tr -d '\r' | sed -e 's/^ *//' -e 's/ *$//' -e "s/$EDITVAR_NEWLINE_DELIMETER /$EDITVAR_NEWLINE_DELIMETER\n/g"
 	else
 		if contains "$v" " "; then
 			echo $1=\"$v\"
@@ -170,6 +170,7 @@ list_vars()
 		echo_var $1
 		shift
 	done
+	echo
 }
 
 openrc_test()
@@ -190,6 +191,7 @@ check_system()
 
 	get_fwtype
 	OPENWRT_FW3=
+	OPENWRT_FW4=
 
 	local info
 	UNAME=$(uname)
@@ -201,27 +203,35 @@ check_system()
 		# some distros include systemctl without systemd
 		if [ -d "$SYSTEMD_DIR" ] && [ -x "$SYSTEMCTL" ] && [ "$INIT" = "systemd" ]; then
 			SYSTEM=systemd
-		elif [ -f "/etc/openwrt_release" ] && exists opkg && exists uci && [ "$INIT" = "procd" ] ; then
-		{
+		elif [ -f "/etc/openwrt_release" ] && exists opkg || exists apk && exists uci && [ "$INIT" = "procd" ] ; then
 			SYSTEM=openwrt
+			OPENWRT_PACKAGER=opkg
+			OPENWRT_PACKAGER_INSTALL="opkg install"
+			OPENWRT_PACKAGER_UPDATE="opkg update"
+			exists apk && {
+				OPENWRT_PACKAGER=apk
+				OPENWRT_PACKAGER_INSTALL="apk add"
+				OPENWRT_PACKAGER_UPDATE=
+			}
+			info="package manager $OPENWRT_PACKAGER\n"
 			if openwrt_fw3 ; then
 				OPENWRT_FW3=1
-				info="openwrt firewall uses fw3"
+				info="${info}firewall fw3"
 				if is_ipt_flow_offload_avail; then
 					info="$info. hardware flow offloading requires iptables."
 				else
 					info="$info. flow offloading unavailable."
 				fi
 			elif openwrt_fw4; then
-				info="openwrt firewall uses fw4. flow offloading requires nftables."
+				OPENWRT_FW4=1
+				info="${info}firewall fw4. flow offloading requires nftables."
 			fi
-		}
 		elif openrc_test; then
 			SYSTEM=openrc
 		else
 			echo system is not either systemd, openrc or openwrt based
 			echo easy installer can set up config settings but can\'t configure auto start
-			echo you have to do it manually. check readme.txt for manual setup info.
+			echo you have to do it manually. check readme.md for manual setup info.
 			if [ -n "$1" ] || ask_yes_no N "do you want to continue"; then
 			    SYSTEM=linux
 			else
@@ -232,11 +242,11 @@ check_system()
 	elif [ "$UNAME" = "Darwin" ]; then
 		SYSTEM=macos
 	else
-		echo easy installer only supports Linux and MacOS. check readme.txt for supported systems and manual setup info.
+		echo easy installer only supports Linux and MacOS. check readme.md for supported systems and manual setup info.
 		exitp 5
 	fi
 	echo system is based on $SYSTEM
-	[ -n "$info" ] && echo $info
+	[ -n "$info" ] && printf "${info}\n"
 }
 
 get_free_space_mb()
@@ -420,14 +430,21 @@ check_kmod()
 }
 check_package_exists_openwrt()
 {
-	[ -n "$(opkg list $1)" ]
+	[ -n "$($OPENWRT_PACKAGER list $1)" ]
 }
 check_package_openwrt()
 {
+	case $OPENWRT_PACKAGER in
+		opkg)
 			[ -n "$(opkg list-installed $1)" ] && return 0
 			local what="$(opkg whatprovides $1 | tail -n +2 | head -n 1)"
 			[ -n "$what" ] || return 1
 			[ -n "$(opkg list-installed $what)" ]
+			;;
+		apk)
+			apk info -e $1
+			;;
+	esac
 }
 check_packages_openwrt()
 {
@@ -516,9 +533,8 @@ restart_openwrt_firewall()
 
 	local FW=fw4
 	[ -n "$OPENWRT_FW3" ] && FW=fw3
-	$FW -q restart || {
+	exists $FW && $FW -q restart || {
 		echo could not restart firewall $FW
-		exitp 30
 	}
 }
 remove_openwrt_firewall()
@@ -684,7 +700,23 @@ check_prerequisites_linux()
 
 removable_pkgs_openwrt()
 {
-	PKGS="iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra ip6tables-mod-nat ip6tables-extra kmod-nft-queue gzip coreutils-sort coreutils-sleep curl"
+	local pkg PKGS2
+	[ -n "$OPENWRT_FW4" ] && PKGS2="$PKGS2 iptables-zz-legacy iptables ip6tables-zz-legacy ip6tables"
+	[ -n "$OPENWRT_FW3" ] && PKGS2="$PKGS2 nftables-json nftables-nojson nftables"
+	PKGS=
+	for pkg in $PKGS2; do
+		check_package_exists_openwrt $pkg && PKGS="${PKGS:+$PKGS }$pkg"
+	done
+	PKGS="ipset iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra ip6tables-mod-nat ip6tables-extra kmod-nft-queue gzip coreutils-sort coreutils-sleep curl $PKGS"
+}
+
+openwrt_fix_broken_apk_uninstall_scripts()
+{
+	# at least in early snapshots with apk removing gnu gzip, sort, ... does not restore links to busybox
+	# system may become unusable
+	exists sort || { echo fixing missing sort; ln -fs /bin/busybox /usr/bin/sort; }
+	exists gzip || { echo fixing missing gzip; ln -fs /bin/busybox /bin/gzip; }
+	exists sleep || { echo fixing missing sleep; ln -fs /bin/busybox /bin/sleep; }
 }
 
 remove_extra_pkgs_openwrt()
@@ -693,19 +725,32 @@ remove_extra_pkgs_openwrt()
 	echo \* remove dependencies
 	removable_pkgs_openwrt
 	echo these packages may have been installed by install_easy.sh : $PKGS
-	ask_yes_no N "do you want to remove them" && opkg remove --autoremove $PKGS
+	ask_yes_no N "do you want to remove them" && {
+		case $OPENWRT_PACKAGER in
+			opkg)
+				opkg remove --autoremove $PKGS
+				;;
+			apk)
+				apk del $PKGS
+				openwrt_fix_broken_apk_uninstall_scripts
+				;;
+		esac
+	}
 }
 
 check_prerequisites_openwrt()
 {
 	echo \* checking prerequisites
 
-	local PKGS="curl" UPD=0
+	local PKGS="curl" UPD=0 local pkg_iptables
 
 	case "$FWTYPE" in
 		iptables)
-			PKGS="$PKGS ipset iptables iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra"
-			[ "$DISABLE_IPV6" != "1" ] && PKGS="$PKGS ip6tables ip6tables-mod-nat ip6tables-extra"
+			pkg_iptables=iptables
+			check_package_exists_openwrt iptables-zz-legacy && pkg_iptables=iptables-zz-legacy
+			PKGS="$PKGS ipset $pkg_iptables iptables-mod-extra iptables-mod-nfqueue iptables-mod-filter iptables-mod-ipopt iptables-mod-conntrack-extra"
+			check_package_exists_openwrt ip6tables-zz-legacy && pkg_iptables=ip6tables-zz-legacy
+			[ "$DISABLE_IPV6" = 1 ] || PKGS="$PKGS $pkg_iptables ip6tables-mod-nat ip6tables-extra"
 			;;
 		nftables)
 			PKGS="$PKGS nftables kmod-nft-nat kmod-nft-offload kmod-nft-queue"
@@ -717,9 +762,9 @@ check_prerequisites_openwrt()
 	else
 		echo \* installing prerequisites
 
-		opkg update
+		$OPENWRT_PACKAGER_UPDATE
 		UPD=1
-		opkg install $PKGS || {
+		$OPENWRT_PACKAGER_INSTALL $PKGS || {
 			echo could not install prerequisites
 			exitp 6
 		}
@@ -732,10 +777,10 @@ check_prerequisites_openwrt()
 		echo installer can install GNU gzip but it requires about 100 Kb space
 		if ask_yes_no N "do you want to install GNU gzip"; then
 			[ "$UPD" = "0" ] && {
-				opkg update
+				$OPENWRT_PACKAGER_UPDATE
 				UPD=1
 			}
-			opkg install --force-overwrite gzip
+			$OPENWRT_PACKAGER_INSTALL --force-overwrite gzip
 		fi
 	}
 	is_linked_to_busybox sort && {
@@ -745,10 +790,10 @@ check_prerequisites_openwrt()
 		echo installer can install GNU sort but it requires about 100 Kb space
 		if ask_yes_no N "do you want to install GNU sort"; then
 			[ "$UPD" = "0" ] && {
-				opkg update
+				$OPENWRT_PACKAGER_UPDATE
 				UPD=1
 			}
-			opkg install --force-overwrite coreutils-sort
+			$OPENWRT_PACKAGER_INSTALL --force-overwrite coreutils-sort
 		fi
 	}
 	[ "$FSLEEP" = 0 ] && is_linked_to_busybox sleep && {
@@ -757,10 +802,10 @@ check_prerequisites_openwrt()
 		echo if you want to speed up blockcheck install coreutils-sleep. it requires about 40 Kb space
 		if ask_yes_no N "do you want to install COREUTILS sleep"; then
 			[ "$UPD" = "0" ] && {
-				opkg update
+				$OPENWRT_PACKAGER_UPDATE
 				UPD=1
 			}
-			opkg install --force-overwrite coreutils-sleep
+			$OPENWRT_PACKAGER_INSTALL --force-overwrite coreutils-sleep
 			fsleep_setup
 		fi
 	}
@@ -793,3 +838,37 @@ select_fwtype()
 	echo select firewall type :
 	ask_list FWTYPE "iptables nftables" "$FWTYPE" && write_config_var FWTYPE
 }
+
+dry_run_tpws_()
+{
+	local TPWS="$ZAPRET_BASE/tpws/tpws"
+	echo verifying tpws options
+	"$TPWS" --dry-run "$@"
+}
+dry_run_nfqws_()
+{
+	local NFQWS="$ZAPRET_BASE/nfq/nfqws"
+	echo verifying nfqws options
+	"$NFQWS" --dry-run "$@"
+}
+dry_run_tpws()
+{
+	[ "$TPWS_ENABLE" = 1 ] || return 0
+	local opt="$TPWS_OPT" port=${TPPORT_SOCKS:-988}
+	filter_apply_hostlist_target opt
+	dry_run_tpws_ --port=$port $opt
+}
+dry_run_tpws_socks()
+{
+	[ "$TPWS_SOCKS_ENABLE" = 1 ] || return 0
+	local opt="$TPWS_SOCKS_OPT" port=${TPPORT:-987}
+	filter_apply_hostlist_target opt
+	dry_run_tpws_ --port=$port --socks $opt
+}
+dry_run_nfqws()
+{
+	[ "$NFQWS_ENABLE" = 1 ] || return 0
+	local opt="$NFQWS_OPT" qn=${QNUM:-200}
+	filter_apply_hostlist_target opt
+	dry_run_nfqws_ --qnum=$qn $opt
+}

common/linux_iphelper.sh

@@ -125,3 +125,13 @@ resolve_lower_devices()
 		}
 	}
 }
+
+default_route_interfaces6()
+{
+	sed -nre 's/^00000000000000000000000000000000 00 [0-9a-f]{32} [0-9a-f]{2} [0-9a-f]{32} [0-9a-f]{8} [0-9a-f]{8} [0-9a-f]{8} [0-9a-f]{8} +(.*)$/\1/p' /proc/net/ipv6_route | grep -v '^lo$' | sort -u | xargs
+}
+
+default_route_interfaces4()
+{
+	sed -nre 's/^([^\t]+)\t00000000\t[0-9A-F]{8}\t[0-9A-F]{4}\t[0-9]+\t[0-9]+\t[0-9]+\t00000000.*$/\1/p' /proc/net/route | sort -u | xargs
+}

config.default

@@ -55,7 +55,7 @@ TPPORT_SOCKS=987
 # <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
 TPWS_SOCKS_OPT="
 --filter-tcp=80 --methodeol <HOSTLIST> --new
---filter-tcp=443 --split-tls=sni --disorder <HOSTLIST>
+--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>
 "
 
 TPWS_ENABLE=0
@@ -65,7 +65,7 @@ TPWS_PORTS=80,443
 # <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
 TPWS_OPT="
 --filter-tcp=80 --methodeol <HOSTLIST> --new
---filter-tcp=443 --split-tls=sni --disorder <HOSTLIST>
+--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>
 "
 
 NFQWS_ENABLE=0
@@ -89,8 +89,8 @@ NFQWS_UDP_PKT_IN=0
 # hostlist markers are replaced to empty string if MODE_FILTER does not satisfy
 # <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
 NFQWS_OPT="
---filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
---filter-tcp=443 --dpi-desync=fake,disorder2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
+--filter-tcp=80 --dpi-desync=fake,multisplit --dpi-desync-split-pos=method+2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
+--filter-tcp=443 --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=badseq,md5sig <HOSTLIST> --new
 --filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=6 <HOSTLIST_NOAUTO>
 "
 

docs/LICENSE.txt

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2016-2021 bol-van
+Copyright (c) 2016-2024 bol-van
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

docs/bsd.en.md

@@ -100,7 +100,7 @@ Later you will add ipfw commands to `/etc/rc.firewall.my` to be reapplied after
 You can also run zapret daemons from there. Start them with `--daemon` options, for example
 ```
 pkill ^dvtws$
-/opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=split2
+/opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 To restart firewall and daemons run : `/etc/rc.d/ipfw restart`
@@ -157,7 +157,7 @@ ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0
 # required for autottl mode only
 ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in not diverted not sockarg recv em0
-/opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+/opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 Process only table zapret with the exception of table nozapret:
@@ -167,7 +167,7 @@ ipfw add 100 allow tcp from me to table\(nozapret\) 80,443
 ipfw add 100 divert 989 tcp from any to table\(zapret\) 80,443 out not diverted not sockarg xmit em0
 # required for autottl mode only
 ipfw add 100 divert 989 tcp from table\(zapret\) 80,443 to any tcpflags syn,ack in not diverted not sockarg recv em0
-/opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+/opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 Reinjection loop avoidance. FreeBSD artificially ignores sockarg for ipv6 in
@@ -245,7 +245,7 @@ sysctl net.inet6.ip6.pfil.inbound=ipfw,pf
 ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0
 pkill ^dvtws$
-dvtws --daemon --port 989 --dpi-desync=split2
+dvtws --daemon --port 989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 
 # required for newer pfsense versions (2.6.0 tested) to return ipfw to functional state
 pfctl -d ; pfctl -e
@@ -280,7 +280,7 @@ Autostart `/usr/local/etc/rc.d/zapret.sh`:
 ```
 pfctl -a zapret -f /etc/zapret.anchor
 pkill ^tpws$
-tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-http-req=method --split-pos=2
+tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-pos=2
 ```
 
 After reboot check that anchor is created and referred from the main ruleset:
@@ -342,7 +342,7 @@ pass out quick on em0 proto tcp to   port {80,443} divert-packet port 989
 Then:
 ```
 pfctl -f /etc/pf.conf
-./dvtws --port=989 --dpi-desync=split2
+./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 `dwtws` only for table zapret with the exception of table nozapret :
@@ -375,7 +375,7 @@ pass out quick on em0 inet6 proto tcp to   <zapret6-user> port {80,443} divert-p
 Then:
 ```
 pfctl -f /etc/pf.conf
-./dvtws --port=989 --dpi-desync=split2
+./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 divert-packet automatically adds the reverse rule. By default also incoming

docs/bsd.md

@@ -143,7 +143,7 @@ $ ipfw -q -f flush
 zapret, добавив в параметры `--daemon`. Например так:
 ```sh
 $ pkill ^dvtws$
-$ /opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=split2
+$ /opt/zapret/nfq/dvtws --port=989 --daemon --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 Для перезапуска фаервола и демонов достаточно будет сделать:
@@ -209,7 +209,7 @@ $ ipfw delete 100
 $ ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted xmit em0
 # required for autottl mode only
 $ ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in not diverted recv em0
-$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 #### Трафик только на таблицу zapret, за исключением таблицы nozapret
@@ -220,7 +220,7 @@ $ ipfw add 100 allow tcp from me to table\(nozapret\) 80,443
 $ ipfw add 100 divert 989 tcp from any to table\(zapret\) 80,443 out not diverted not sockarg xmit em0
 # required for autottl mode only
 $ ipfw add 100 divert 989 tcp from table\(zapret\) 80,443 to any tcpflags syn,ack in not diverted not sockarg recv em0
-$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=split2
+$ /opt/zapret/nfq/dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 
@@ -317,7 +317,7 @@ sysctl net.inet6.ip6.pfil.inbound=ipfw,pf
 ipfw delete 100
 ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted xmit em0
 pkill ^dvtws$
-dvtws --daemon --port 989 --dpi-desync=split2
+dvtws --daemon --port 989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 
 # required for newer pfsense versions (2.6.0 tested) to return ipfw to functional state
 pfctl -d ; pfctl -e
@@ -357,7 +357,7 @@ rdr pass on em1 inet6 proto tcp to port {80,443} -> fe80::20c:29ff:5ae3:4821 por
 ```sh
 $ pfctl -a zapret -f /etc/zapret.anchor
 $ pkill ^tpws$
-$ tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-http-req=method --split-pos=2
+$ tpws --daemon --port=988 --enable-pf --bind-addr=127.0.0.1 --bind-iface6=em1 --bind-linklocal=force --split-pos=2
 ```
 
 4. После перезагрузки проверьте, что правила создались:
@@ -424,7 +424,7 @@ pass out quick on em0 proto tcp to   port {80,443} divert-packet port 989 no sta
 
 ```sh
 $ pfctl -f /etc/pf.conf
-$ ./dvtws --port=989 --dpi-desync=split2
+$ ./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 #### Трафик только на таблицу zapret, за исключением таблицы nozapret
@@ -456,7 +456,7 @@ pass out quick on em0 inet6 proto tcp to   <zapret6-user> port {80,443} divert-p
 
 ```sh
 $ pfctl -f /etc/pf.conf
-$ ./dvtws --port=989 --dpi-desync=split2
+$ ./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 ```
 
 

docs/bsdfw.txt

@@ -70,7 +70,7 @@ pass in  quick on em0 proto tcp from port {80,443} flags SA/SA divert-packet por
 pass in  quick on em0 proto tcp from port {80,443} no state
 pass out quick on em0 proto tcp to   port {80,443} divert-packet port 989 no state
 pfctl -f /etc/pf.conf
-./dvtws --port=989 --dpi-desync=split2
+./dvtws --port=989 --dpi-desync=multisplit --dpi-desync-split-pos=2
 
 ; dvtws with table limitations : to zapret,zapret6 but not to nozapret,nozapret6
 ; reload tables : pfctl -f /etc/pf.conf

docs/changes.txt

@@ -363,3 +363,57 @@ nfqws,tpws: use alternate $ sign for $<config_file>
 repo: binaries removed from repo. git actions binaries build in releases.
 uninstall_easy.sh: offer to remove dependencies in openwrt
 install_easy.sh: allow to download lists in autohostlist filter mode
+
+v69:
+
+nfqws, tpws: multisplit/multidisorder support.
+nfqws: name change split->fakedsplit, disorder->fakeddisorder. compat : old names are synonyms
+nfqws: --dpi-desync-split-http-req, --dpi-desync-split-tls deprecated. compat : these parameters add split point to multisplit.
+nfqws: --dpi-desync=split2|disorder2 deprecated. compat: they are now synonyms for multisplit/multidisorder
+nfqws: cancel seqovl if MTU is exceeded (linux only). cancel seqovl for disorder if seqovl>=first_part_size.
+nfqws: fixed splits in multiple TLS segments.
+tpws: --split-http-req,--split-tls deprecated. compat : these parameters add split point to multisplit.
+tpws: --tlsrec now takes pos markers. compat : old names are converted to pos markers
+tpws: --tlsrec-pos deprecated. compat : sets absolute pos marker
+nfqws,tpws: chown autohostlist, autohostlist debug log and debug log files after options parse
+nfqws,tpws: set EXEDIR env var to use in @config (won't work for stadalone winws without /bin/sh)
+dvtws: set random/increasing ip_id value in generated packets
+mdig: fixed parsing of DNS reply in windows (stdin is opened as text, not binary)
+tpws: support compile for android NDK api level >= 21 (Android 5.0)
+tpws: --fix-seg segmentation fixer
+repo: build for android NDK api level 21 (Android 5.0)
+install_easy: support for APK package manager in openwrt
+blockcheck: removed ignore CA question
+blockcheck: removed IGNORE_CA, CURL_VERBOSE
+blockcheck: added CURL_OPT
+blockcheck: new strategies support
+blockcheck: test sequence rework
+blockcheck: view all working strategies in summary
+
+v69.1:
+
+init.d: keenetic udp fix custom
+tpws: fixed incorrect hostlist checks
+
+v69.2:
+
+nfqws,tpws: --skip
+nfqws: --methodeol
+init.d: do not use pgrep in sysv for busybox compat
+
+v69.3
+
+nfqws,tpws: fixed ipsets and hostlists
+all progs: version numbers for github, build date/time for self built
+repo: light release for openwrt and embedded systems
+repo: sha256sum
+
+v69.4
+
+nfqws: fakedsplit/fakeddisorder fakes for both split segments
+nfqws: --dpi-desync-fakedsplit-pattern
+
+v69.5
+
+nfqws,tpws: --dry-run
+install_easy: check tpws and nfqws options validity

docs/compile/build_howto_openwrt.txt

@@ -1,21 +1,57 @@
 How to compile native programs for use in openwrt
 -------------------------------------------------
 
-1) Download latest SDK for your platform from https://downloads.openwrt.org
+1) Install required packages to the host system :
+
+debian,ubuntu : apt install build-essential patch libncurses-dev python3-distutils unzip gawk wget git
+fedora: dnf install make patch gcc g++ ncurses-devel git perl
+
+Other packages may be required on your distribution. Look for the errors.
+
+2) Download latest SDK for your target platform from https://downloads.openwrt.org
+
+examples :
 
 curl -o - https://downloads.openwrt.org/releases/23.05.5/targets/x86/64/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz | tar -Jxvf -
 cd openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64
 
-2) ./scripts/feeds update -a
-   ./scripts/feeds install -a
+curl -o - https://downloads.openwrt.org/snapshots/targets/x86/64/openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64.tar.zst | tar --zstd -xvf -
+cd openwrt-sdk-x86-64_gcc-13.3.0_musl.Linux-x86_64
 
-3) cp -R /opt/zapret/docs/compile/openwrt/. .
+3) Install required libs
+
+./scripts/feeds update base packages
+./scripts/feeds install libnetfilter-queue zlib libcap
+
+4) Prepare openwrt package definitions
+
+cp -R /opt/zapret/docs/compile/openwrt/. .
 cp -R /opt/zapret/tpws package/zapret/tpws
 cp -R /opt/zapret/nfq package/zapret/nfqws
 cp -R /opt/zapret/mdig package/zapret/mdig
 cp -R /opt/zapret/ip2net package/zapret/ip2net
+rm -f package/zapret/tpws/tpws/tpws package/zapret/nfqws/nfq/nfqws package/zapret/mdig/mdig/mdig package/zapret/ip2net/ip2net/ip2net
 
-4) make package/{tpws,nfqws,mdig,ip2net}/compile
+5) Prepare .config
 
-5) find bin -name tpws*.ipk
-   #take your tpws*.ipk , nfqws*.ipk , ip2net*.ipk, mdig*.ipk from there
+make defconfig
+
+If you only need bins without packages comment 'CONFIG_AUTOREMOVE=y' line in .config
+
+6) Compile
+
+dynamic build : make package/{tpws,nfqws,mdig,ip2net}/compile
+static build :  make CFLAGS=-static package/{tpws,nfqws,mdig,ip2net}/compile
+
+7) Get result
+
+executables only : build_dir/target/<progname>
+ipk or apk packages : bin/packages/*/base
+
+8) Installating to openwrt to use with zapret
+
+zapret with or without binaries should be already installed in /opt/zapret.
+Install ipk's or apk's with all compiled progs using opkg or apk.
+Bins are placed to /opt/zapret/binaries/my.
+Or copy binaries there manually and set chmod 755 to them.
+Run install_bin.sh or install_easy.sh. They will use bins in 'my' folder.

docs/compile/build_howto_unix.txt

@@ -0,0 +1,16 @@
+debian,ubuntu :
+
+apt install make gcc zlib1g-dev libcap-dev libnetfilter-queue-dev
+make -C /opt/zapret
+
+FreeBSD :
+
+make -C /opt/zapret
+
+OpenBSD :
+
+make -C /opt/zapret bsd
+
+MacOS :
+
+make -C /opt/zapret mac

docs/compile/build_howto_windows.txt

@@ -0,0 +1,29 @@
+Windows x64
+
+1) Download latest cygwin for windows 7
+
+curl -O https://www.cygwin.com/setup-x86_64.exe
+setup-x86_64.exe --allow-unsupported-windows --no-verify --site http://ctm.crouchingtigerhiddenfruitbat.org/pub/cygwin/circa/64bit/2024/01/30/231215
+
+2) During setup install packages : make gcc-core zlib-devel
+
+3) Run Cygwin.bat
+
+4) cd to %ZAPRET_BASE%/nfq
+
+cd C:/Users/user/Downloads/zapret/nfq
+
+5) Compile
+
+make cygwin64
+
+use winws.exe
+
+6) Take windivert.dll and windivert64.sys here : https://reqrypt.org/download
+Choose version 2.2.2 for Windows 10 and 2.2.0 for Windows 7.
+
+7) Copy cygwin1.dll, winws.exe, windivert.dll and windivert64.sys to one folder.
+
+8) Run winws.exe from cmd.exe running as administrator.
+winws will not run from cygwin shell with cygwin1.dll copy in it's folder.
+winws will not run without cygwin1.dll outside of cygwin shell.

docs/compile/openwrt/package/zapret/ip2net/Makefile

@@ -24,8 +24,8 @@ define Build/Compile
 endef
 
 define Package/ip2net/install
-	$(INSTALL_DIR) $(1)/opt/zapret/ip2net
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip2net $(1)/opt/zapret/ip2net
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ip2net $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,ip2net))

docs/compile/openwrt/package/zapret/mdig/Makefile

@@ -24,8 +24,8 @@ define Build/Compile
 endef
 
 define Package/mdig/install
-	$(INSTALL_DIR) $(1)/opt/zapret/mdig
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mdig $(1)/opt/zapret/mdig
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/mdig $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,mdig))

docs/compile/openwrt/package/zapret/nfqws/Makefile

@@ -25,8 +25,8 @@ define Build/Compile
 endef
 
 define Package/nfqws/install
-	$(INSTALL_DIR) $(1)/opt/zapret/nfq
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/nfqws $(1)/opt/zapret/nfq
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/nfqws $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,nfqws))

docs/compile/openwrt/package/zapret/tpws/Makefile

@@ -25,8 +25,8 @@ define Build/Compile
 endef
 
 define Package/tpws/install
-	$(INSTALL_DIR) $(1)/opt/zapret/tpws
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tpws $(1)/opt/zapret/tpws
+	$(INSTALL_DIR) $(1)/opt/zapret/binaries/my
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tpws $(1)/opt/zapret/binaries/my
 endef
 
 $(eval $(call BuildPackage,tpws))

docs/iptables.txt

@@ -12,7 +12,7 @@ iptables -t mangle -I POSTROUTING -p udp --dport 443 -m mark ! --mark 0x40000000
 # auto hostlist with avoiding wrong ACK numbers in RST,ACK packets sent by russian DPI
 sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1 
 iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:12 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-iptables -t mangle -I PREROUTING -p tcp -m multiport --sports 80,443 -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+iptables -t mangle -I PREROUTING -p tcp -m multiport --sports 80,443 -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:3 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
 
 
 For TPROXY :

docs/nftables.txt

@@ -19,8 +19,8 @@ For dpi desync attack :
 nft delete table inet ztest
 nft create table inet ztest
 nft add chain inet ztest post "{type filter hook postrouting priority mangle;}"
-nft add rule inet ztest post meta mark and 0x40000000 == 0 tcp dport "{80,443}" ct original packets 1-12 queue num 200 bypass
-nft add rule inet ztest post meta mark and 0x40000000 == 0 udp dport 443 ct original packets 1-12 queue num 200 bypass
+nft add rule inet ztest post meta mark and 0x40000000 == 0 tcp dport "{80,443}" ct original packets 1-6 queue num 200 bypass
+nft add rule inet ztest post meta mark and 0x40000000 == 0 udp dport 443 ct original packets 1-6 queue num 200 bypass
 
 # auto hostlist with avoiding wrong ACK numbers in RST,ACK packets sent by russian DPI
 sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1 

docs/quick_start.md

@@ -50,6 +50,8 @@
 > образ `squashfs` с помощью `image builder` и перешить этим вариантом роутер.
 
 1. Скачайте последний [tar.gz релиз](https://github.com/bol-van/zapret/releases) в /tmp, распакуйте его, затем удалите архив.
+   Для openwrt и прошивок используйте вариант `openwrt-embedded`.
+   Для экономия места в /tmp можно качать через curl в stdout и сразу распаковывать.
 
 2. Убедитесь, что у вас отключены все средства обхода блокировок, в том числе и
    сам zapret. Гарантированно уберет zapret скрипт `uninstall_easy.sh`.
@@ -213,7 +215,7 @@
    > Если используются методы нулевой фазы десинхронизации (`--mss`,
    > `--wssize`, `--dpi-desync=syndata`) и режим фильтрации `hostlist`, то все
    > параметры, относящиеся к этим методам, следует помещать в отдельные
-   > профили мульистратегии, которые получат управление до определения имени
+   > профили мультистратегии, которые получат управление до определения имени
    > хоста. Необходимо понимать алгоритм работы мультистратегий. Самым надежным
    > вариантом будет дублирование этих параметров на 2 профиля. Какой-нибудь
    > сработает в зависимости от параметра `MODE_FILTER`.
@@ -235,6 +237,13 @@
 8. На все остальные вопросы `install_easy.sh` отвечайте согласно выводимой
    аннотации.
 
+9. Удалите директорию из /tmp, откуда производилась установка.
+
+## Полное удаление
+
+1. Прогоните `/opt/zapret/uninstall_easy.sh`.
+2. Cогласитесь на удаление зависимостей в openwrt.
+3. Удалите каталог `/opt/zapret`.
 
 ## Итог
 Это минимальная инструкция, чтобы быстро сориентироваться с чего начать.

docs/quick_start_windows.md

@@ -47,6 +47,14 @@ _"Совсем ничего не могу, все очень сложно, да
 
 Не помогла _"таблетка"_ ? Это вовсе не значит, что ничего не получится. Но придется делать по нормальному.
 
+## НЕ ПОМОГЛО, КАК ТЕПЕРЬ ЭТО УДАЛИТЬ
+
+Если вы не устанавливали zapret как службу или запланированную задачу (а это требует редактирования cmd файлов),
+достаточно закрыть окно с winws и запустить windivert_delete.cmd.
+Альтернатива - перезагрузить компьютер.
+После чего можно удалить папку с zapret. На этом деинсталляция закончена.
+Если же вы устанавливали zapret как службу, то вы наверняка знаете как ее удалить.
+
 ## РЕШЕНИЕ "КАК ПОЛОЖЕНО"
 
 1) Скачайте и распакуйте архив https://github.com/bol-van/zapret-win-bundle/archive/refs/heads/master.zip.

docs/readme.en.md

@@ -1,4 +1,9 @@
-# zapret v.67
+# zapret v69.5
+
+# SCAMMER WARNING
+
+This software is free and open source under [MIT license](./LICENSE.txt).
+If anyone demands you to download this software only from their webpage, telegram channel, forces you to delete links, videos, makes copyright claims, you are dealing with scammers.
 
 # Multilanguage/Мультиязычный README
 ___
@@ -10,22 +15,33 @@ ___
 - [What is it for](#what-is-it-for)
 - [How it works](#how-it-works)
 - [How to put this into practice in the linux system](#how-to-put-this-into-practice-in-the-linux-system)
-- [ip6tables](#ip6tables)
-- [nftables](#nftables)
 - [When it will not work](#when-it-will-not-work)
 - [nfqws](#nfqws)
   - [DPI desync attack](#dpi-desync-attack)
-  - [DPI desync combos](#dpi-desync-combos)
-  - [SYNACK mode](#synack-mode)
+  - [Fakes](#fakes)
+  - [TCP segmentation](#tcp-segmentation)
+  - [Sequence numbers overlap](#sequence-numbers-overlap)
+  - [ipv6 specific modes](#ipv6-specific-modes)
+  - [Server reply reaction](#server-reply-reaction)
   - [SYNDATA mode](#syndata-mode)
-  - [Virtual Machines](#virtual-machines)
+  - [DPI desync combos](#dpi-desync-combos)
   - [CONNTRACK](#conntrack)
   - [Reassemble](#reassemble)
   - [UDP support](#udp-support)
   - [IP fragmentation](#ip-fragmentation)
-  - [multiple strategies](#multiple-strategies)
+  - [Multiple strategies](#multiple-strategies)
+  - [Virtual machines](#virtual-machines)
+  - [IPTABLES for nfqws](#iptables-for-nfqws)
+  - [NFTABLES for nfqws](#nftables-for-nfqws)
 - [tpws](#tpws)
-  - [multiple strategies](#multiple-strategies-1)
+  - [TCP segmentation in tpws](#tcp-segmentation-in-tpws)
+  - [TLSREC](#tlsrec)
+  - [MSS](#mss)
+  - [Other tamper options](#other-tamper-options)
+  - [Supplementary options](#supplementary-options)
+  - [Multiple strategies](#multiple-strategies-1)
+  - [IPTABLES for tpws](#iptables-for-tpws)
+  - [NFTABLES for tpws](#nftables-for-tpws)
 - [Ways to get a list of blocked IP](#ways-to-get-a-list-of-blocked-ip)
 - [Domain name filtering](#domain-name-filtering)
 - [**autohostlist** mode](#autohostlist-mode)
@@ -94,94 +110,9 @@ deal with its consequences.
 2. Modification of the TCP connection at the stream level. Implemented through a proxy or transparent proxy.
 3. Modification of TCP connection at the packet level. Implemented through the NFQUEUE handler and raw sockets.
 
-For options 2 and 3, tpws and nfqws programs are implemented, respectively.
+For options 2 and 3, **tpws** and **nfqws** programs are implemented, respectively.
 You need to run them with the necessary parameters and redirect certain traffic with iptables or nftables.
 
-To redirect a TCP connection to a transparent proxy, the following commands are used:
-
-forwarded traffic :
-`iptables -t nat -I PREROUTING -i <internal_interface> -p tcp --dport 80 -j DNAT --to 127.0.0.127:988`
-
-outgoing traffic :
-`iptables -t nat -I OUTPUT -o <external_interface> -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to 127.0.0.127:988`
-
-DNAT on localhost works in the OUTPUT chain, but does not work in the PREROUTING chain without enabling the route_localnet parameter:
-
-`sysctl -w net.ipv4.conf.<internal_interface>.route_localnet=1`
-
-You can use `-j REDIRECT --to-port 988` instead of DNAT, but in this case the transparent proxy process 
-should listen on the ip address of the incoming interface or on all addresses. Listen all - not good
-in terms of security. Listening one (local) is possible, but automated scripts will have to recognize it,
-then dynamically enter it into the command. In any case, additional efforts are required.
-Using route_localnet can also introduce some security risks. You make available from internal_interface everything
-bound to `127.0.0.0/8`. Services are usually bound to `127.0.0.1`. Its possible to deny input to `127.0.0.1` from all interfaces except lo
-or bind tpws to any other IP from `127.0.0.0/8` range, for example to `127.0.0.127`, and allow incomings only to that IP :
-
-```
-iptables -A INPUT ! -i lo -d 127.0.0.127 -j ACCEPT
-iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
-```
-
-Owner filter is necessary to prevent recursive redirection of connections from tpws itself.
-tpws must be started under OS user `tpws`.
-
-NFQUEUE redirection of the outgoing traffic and forwarded traffic going towards the external interface,
-can be done with the following commands:
-
-`iptables -t mangle -I POSTROUTING -o <external_interface> -p tcp --dport 80 -j NFQUEUE --queue-num 200 --queue-bypass`
-
-In order not to touch the traffic to unblocked addresses, you can take a list of blocked hosts, resolve it
-into IP addresses and put them to ipset 'zapret', then add a filter to the command:
-
-`iptables -t mangle -I POSTROUTING -o <external_interface> -p tcp --dport 80 -m set --match-set zapret dst -j NFQUEUE --queue-num 200 --queue-bypass`
-
-Some DPIs catch only the first http request, ignoring subsequent requests in a keep-alive session.
-Then we can reduce CPU load, refusing to process unnecessary packets.
-
-`iptables -t mangle -I POSTROUTING -o <external_interface> -p tcp --dport 80 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -m set --match-set zapret dst -j NFQUEUE --queue-num 200 --queue-bypass`
-
-Mark filter does not allow nfqws-generated packets to enter the queue again.
-Its necessary to use this filter when also using `connbytes`. Without it packet ordering can be changed breaking the whole idea.
-Also if there's huge packet send from nfqws it may deadlock without mark filter.
-
-Some attacks require redirection of incoming packets :
-
-`iptables -t mangle -I PREROUTING -i <external_interface> -p tcp --sport 80 -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:6 -m set --match-set zapret src -j NFQUEUE --queue-num 200 --queue-bypass`
-
-Incoming packets are filtered by incoming interface, source port and IP. This is opposite to the direct rule.
-
-Some techniques that break NAT are possible only with nftables.
-
-
-## ip6tables
-
-ip6tables work almost exactly the same way as ipv4, but there are a number of important nuances.
-In DNAT, you should take the address --to in square brackets. For example :
-
- `ip6tables -t nat -I OUTPUT -o <external_interface> -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to [::1]:988`
-
-The route_localnet parameter does not exist for ipv6.
-DNAT to localhost (:: 1) is possible only in the OUTPUT chain.
-In the PREROUTING DNAT chain, it is possible to any global address or to the link local address of the same interface
-the packet came from.
-NFQUEUE works without changes.
-
-
-## nftables
-
-nftables are fine except one very big problem.
-nft requires tons of RAM to load large nf sets (ip lists) with subnets/intervals. Most of the home routers can't afford that.
-For example, even a 256 Mb system can't load a 100K ip list. nft process will OOM.
-nf sets do not support overlapping intervals and that's why nft process applies very RAM consuming algorithm to merge intervals so they don't overlap.
-There're equivalents to iptables for all other functions. Interface and protocol anonymous sets allow not to write multiple similar rules.
-Flow offloading is built-in into new linux kernels and nft versions.
-
-nft version `1.0.2` or higher is recommended. But the higher is version the better.
-
-Some techniques can be fully used only with nftables. It's not possible to queue packets after NAT in iptables.
-This limits techniques that break NAT.
-
-
 ## When it will not work
 
 * If DNS server returns false responses. ISP can return false IP addresses or not return anything
@@ -200,6 +131,7 @@ nfqws takes the following parameters:
  @<config_file>					; read file for options. must be the only argument. other options are ignored.
 
  --debug=0|1
+ --dry-run                                      ; verify parameters and exit with code 0 if successful
  --qnum=<nfqueue_number>
  --daemon                                       ; daemonize
  --pidfile=<filename>                           ; write pid to file
@@ -215,7 +147,8 @@ nfqws takes the following parameters:
  --hostspell                                    ; exact spelling of "Host" header. must be 4 chars. default is "host"
  --hostnospace                                  ; remove space after Host: and add it to User-Agent: to preserve packet size
  --domcase                                      ; mix domain case : Host: TeSt.cOm
- --dpi-desync=[<mode0>,]<mode>[,<mode2>]        ; try to desync dpi state. modes : synack fake fakeknown rst rstack hopbyhop destopt ipfrag1 disorder disorder2 split split2 ipfrag2 udplen tamper
+ --methodeol					; add '\n' before method and remove space after Host:
+ --dpi-desync=[<mode0>,]<mode>[,<mode2>]        ; try to desync dpi state. modes : synack fake fakeknown rst rstack hopbyhop destopt ipfrag1 multisplit multidisorder fakedsplit fakeddisorder ipfrag2 udplen tamper
  --dpi-desync-fwmark=<int|0xHEX>                ; override fwmark for desync packet. default = 0x40000000 (1073741824)
  --dpi-desync-ttl=<int>                         ; set ttl for desync packet
  --dpi-desync-ttl6=<int>                        ; set ipv6 hop limit for desync packet. by default ttl value is used.
@@ -224,11 +157,13 @@ nfqws takes the following parameters:
  --dpi-desync-fooling=<mode>[,<mode>]           ; can use multiple comma separated values. modes : none md5sig ts badseq badsum datanoack hopbyhop hopbyhop2
  --dpi-desync-repeats=<N>                       ; send every desync packet N times
  --dpi-desync-skip-nosni=0|1                    ; 1(default)=do not act on ClientHello without SNI (ESNI ?)
- --dpi-desync-split-pos=<1..9216>               ; data payload split position
- --dpi-desync-split-http-req=method|host        ; split at specified logical part of plain http request
- --dpi-desync-split-tls=sni|sniext              ; split at specified logical part of TLS ClientHello
- --dpi-desync-split-seqovl=<int>                ; use sequence overlap before first sent original split segment
+ --dpi-desync-split-pos=N|-N|marker+N|marker-N  ; comma separated list of split positions
+                                                ; markers: method,host,endhost,sld,endsld,midsld,sniext
+                                                ; full list is only used by multisplit and multidisorder
+                                                ; fakedsplit/fakeddisorder use first l7-protocol-compatible parameter if present, first abs value otherwise
+ --dpi-desync-split-seqovl=N|-N|marker+N|marker-N ; use sequence overlap before first sent original split segment
  --dpi-desync-split-seqovl-pattern=<filename>|0xHEX ; pattern for the fake part of overlap
+ --dpi-desync-fakedsplit-pattern=<filename>|0xHEX ; fake pattern for fakedsplit/fakeddisorder
  --dpi-desync-ipfrag-pos-tcp=<8..9216>          ; ip frag position starting from the transport header. multiple of 8, default 8.
  --dpi-desync-ipfrag-pos-udp=<8..9216>          ; ip frag position starting from the transport header. multiple of 8, default 32.
  --dpi-desync-badseq-increment=<int|0xHEX>      ; badseq fooling seq signed increment. default -10000
@@ -247,39 +182,41 @@ nfqws takes the following parameters:
  --dpi-desync-start=[n|d|s]N                    ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) greater or equal than N
  --dpi-desync-cutoff=[n|d|s]N                   ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) less than N
  --hostlist=<filename>                          ; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-domains=<domain_list>               ; comma separated fixed domain list
  --hostlist-exclude=<filename>                  ; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-exclude-domains=<domain_list>       ; comma separated fixed domain list
  --hostlist-auto=<filename>                     ; detect DPI blocks and build hostlist automatically
  --hostlist-auto-fail-threshold=<int>           ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
  --hostlist-auto-fail-time=<int>                ; all failed attemps must be within these seconds (default : 60)
  --hostlist-auto-retrans-threshold=<int>        ; how many request retransmissions cause attempt to fail (default : 3)
  --hostlist-auto-debug=<logfile>        	; debug auto hostlist positives
- --new                                          ; begin new strategy
+ --new                                          ; begin new strategy (new profile)
+ --skip                                         ; do not use this profile
  --filter-l3=ipv4|ipv6                          ; L3 protocol filter. multiple comma separated values allowed.
  --filter-tcp=[~]port1[-port2]|*                ; TCP port filter. ~ means negation. setting tcp and not setting udp filter denies udp. comma separated list supported.
  --filter-udp=[~]port1[-port2]|*                ; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list supported.
  --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.
  --ipset=<filename>                             ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-ip=<ip_list>                           ; comma separated fixed subnet list
  --ipset-exclude=<filename>                     ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-exclude-ip=<ip_list>                   ; comma separated fixed subnet list
 ```
 
-The manipulation parameters can be combined in any way.
-
-WARNING. `--wsize` parameter is now not used anymore in scripts. TCP split can be achieved using DPI desync attack.
-
 ### DPI desync attack
 
-After completion of the tcp 3-way handshake, the first data packet from the client goes.
-It usually has `GET / ...` or TLS ClientHello. We drop this packet, replacing with something else.
-It can be a fake version with another harmless but valid http or https request (`fake`), tcp reset packet (`rst`,`rstack`),
-split into 2 segments original packet with fake segment in the middle (`split`).
-`fakeknown` sends fake only in response to known application protocol.
-In articles these attack have names **TCB desynchronization** and **TCB teardown**.
-Fake packet must reach DPI, but do not reach the destination server.
-The following means are available: set a low TTL, send a packet with bad checksum,
-add tcp option **MD5 signature**. All of them have their own disadvantages :
+The idea is to take original message, modify it, add additional fake information in such a way that the server OS accepts original data only
+but DPI cannot recostruct original message or sees what it cannot identify as a prohibited request.
 
-* md5sig does not work on all servers
-* badsum doesn't work if your device is behind NAT which does not pass invalid packets.
+There's a set of instruments to achieve that goal.
+It can be fake packets that reach DPI but do not reach server or get rejected by server, TCP segmentation or IP fragmentation.
+There're attacks based on TCP sequence numbers. Methods can be combined in many ways.
+
+### Fakes
+
+Fakes are separate generated by nfqws packets carrying false information for DPI. They must either not reach the server or be rejected by it. Otherwise TCP connection or data stream would be broken. There're multiple ways to solve this task.
+
+* **md5sig** does not work on all servers
+* **badsum** doesn't work if your device is behind NAT which does not pass invalid packets.
   The most common Linux NAT router configuration does not pass them. Most home routers are Linux based.
   The default sysctl configuration `net.netfilter.nf_conntrack_checksum=1` causes contrack to verify tcp and udp checksums
   and set INVALID state for packets with invalid checksum.
@@ -294,25 +231,25 @@ add tcp option **MD5 signature**. All of them have their own disadvantages :
   This behavior was observed on a Mediatek MT7621 based device.
   Tried to modify mediatek ethernet driver with no luck, likely hardware enforced limitation.
   However the device allowed to send badsum packets, problem only existed for passthrough traffic from clients.
-* badseq packets will be dropped by server, but DPI also can ignore them.
+* **badseq** packets will be dropped by server, but DPI also can ignore them.
   default badseq increment is set to -10000 because some DPIs drop packets outside of the small tcp window.
   But this also can cause troubles when `--dpi-desync-any-protocol` is enabled.
   To be 100% sure fake packet cannot fit to server tcp window consider setting badseq increment to 0x80000000
-* TTL looks like the best option, but it requires special tuning for each ISP. If DPI is further than local ISP websites
+* **TTL** looks like the best option, but it requires special tuning for each ISP. If DPI is further than local ISP websites
   you can cut access to them. Manual IP exclude list is required. Its possible to use md5sig with ttl.
   This way you cant hurt anything, but good chances it will help to open local ISP websites.
   If automatic solution cannot be found then use `zapret-hosts-user-exclude.txt`.
   Some router stock firmwares fix outgoing TTL. Without switching this option off TTL fooling will not work.
-* `hopbyhop` is ipv6 only. This fooling adds empty extension header `hop-by-hop options` or two headers in case of `hopbyhop2`.
+* **hopbyhop** is ipv6 only. This fooling adds empty extension header `hop-by-hop options` or two headers in case of `hopbyhop2`.
   Packets with two hop-by-hop headers violate RFC and discarded by all operating systems.
   All OS accept packets with one hop-by-hop header.
   Some ISPs/operators drop ipv6 packets with hop-by-hop options. Fakes will not be processed by the server either because
   ISP drops them or because there are two same headers.
   DPIs may still anaylize packets with one or two hop-by-hop headers.
-* `datanoack` sends tcp fakes without ACK flag. Servers do not accept this but DPI may accept.
+* **datanoack** sends tcp fakes without ACK flag. Servers do not accept this but DPI may accept.
   This mode may break NAT and may not work with iptables if masquerade is used, even from the router itself.
   Works with nftables properly. Likely requires external IP address (some ISPs pass these packets through their NAT).
-* `autottl` tries to automatically guess TTL value that allows DPI to receive fakes and does not allow them to reach the server.
+* **autottl** tries to automatically guess TTL value that allows DPI to receive fakes and does not allow them to reach the server.
   This tech relies on well known TTL values used by OS : 64,128,255. nfqws takes first incoming packet (YES, you need to redirect it too),
   guesses path length and decreases by `delta` value (default 1). If resulting value is outside the range (min,max - default 3,20)
   then its normalized to min or max. If the path shorter than the value then autottl fails and falls back to the fixed value.
@@ -322,42 +259,53 @@ add tcp option **MD5 signature**. All of them have their own disadvantages :
 
 `--dpi-desync-fooling` takes multiple comma separated values.
 
-For fake,rst,rstack modes original packet is sent after the fake.
 
-Disorder mode splits original packet and sends packets in the following order :
-1. 2nd segment
-2. fake 1st segment, data filled with zeroes
-3. 1st segment
-4. fake 1st segment, data filled with zeroes (2nd copy)
+### TCP segmentation
 
-Original packet is always dropped. `--dpi-desync-split-pos` sets split position (default 2).
-If position is higher than packet length, pos=1 is used.
-This sequence is designed to make reconstruction of critical message as difficult as possible.
-Fake segments may not be required to bypass some DPIs, but can potentially help if more sophisticated reconstruction
-algorithms are used.
-Mode `disorder2` disables sending of fake segments.
+ * `multisplit`. split request at specified in `--dpi-desync-split-pos` positions
+ * `multidisorder`. same as `multisplit` but send in reverse order
+ * `fakedsplit`. split request into 2 segments adding fakes in the middle of them : fake 1st segment, 1st segment, fake 1st segment, fake 2nd segment, 2nd segment, fake 2nd segment
+ * `fakeddisorder`. same as `fakedsplit` but with another order : fake 2nd segment, 2nd segment, fake 2nd segment, fake 1st segment, 1st segment, fake 1st segment
 
-Split mode is very similar to disorder but without segment reordering :
+Positions are defined by markers.
 
-1. fake 1st segment, data filled with zeroes
-2. 1st segment
-3. fake 1st segment, data filled with zeroes (2nd copy)
-4. 2nd segment
+* **Absolute positive marker** - numeric offset inside one packet or group of packets starting from the start
+* **Absolute negative marker** - numeric offset inside one packet or group of packets starting from the next byte after the end
+* **Relative marker** - positive or negative offset relative to a logical position within a packet or group of packets
 
-Mode `split2` disables sending of fake segments. It can be used as a faster alternative to --wsize.
+Relative positions :
 
-In `disorder2` and `split2` modes no fake packets are sent, so ttl and fooling options are not required.
+* **method** - HTTP method start ('GET', 'POST', 'HEAD', ...). Method is usually always at position 0 but can shift because of `--methodeol` fooling. If fooled position can become 1 or 2.
+* **host** - hostname start in a known protocol (http, TLS)
+* **endhost** - the byte next to the last hostname's byte
+* **sld** - second level domain start in the hostname
+* **endsld** - the byte next to the last SLD byte
+* **midsld** - middle of SLD
+* **sniext** - start of the data field in the SNI TLS extension. Any extension has 2-byte type and length fields followed by data field.
 
-`seqovl` adds to the first sent original segment (1st for split, 2nd for disorder) seqovl bytes to the beginning and decreases
-sequence number.
-In `split2` mode this creates partially in-window packet. OS receives only in-window part.
-In `disorder2` mode OS receives fake and real part of the second segment but does not pass received data to the socket until first
-segment is received. First segment overwrites fake part of the second segment. Then OS passes original data to the socket.
+Marker list example : `100,midsld,sniext+1,endhost-2,-10`.
+
+When splitting all markers are resolved to absolute offsets. If a relative position is absent in the current protocol its dropped. Then all resolved offsets are normalized to the current packet offset in multi packet group (multi-packet TLS with kyber, for example). Positions outside of the current packet are dropped. Remaining positions are sorted and deduplicated.
+
+In `multisplit`or `multidisorder` case split is cancelled if no position remained.
+
+`fakedsplit` и `fakeddisorder` use only one split position. It's searched from the  `--dpi-desync-split-pos` list by a special alorightm.
+First relative markers are searched. If no suitable found absolute markers are searched. If nothing found position 1 is used.
+
+For example, `--dpi-desync-split-pos=method+2,midsld,5` means `method+2` for http, `midsld` for TLS and 5 for others.
+
+### Sequence numbers overlap
+
+`seqovl` adds to one of the original segment `seqovl` bytes to the beginning and decreases sequence number. For `split` - to the first segment, for `disorder` - to the beginning of the penultimate segment sent (second in the original sequence).
+
+In `split` mode this creates partially in-window packet. OS receives only in-window part.
+In `disorder` mode OS receives fake and real part of the second segment but does not pass received data to the socket until first segment is received. First segment overwrites fake part of the second segment. Then OS passes original data to the socket.
 All unix OS except Solaris preserve last received data. This is not the case for Windows servers and `disorder` with `seqovl` will not work.
-Disorder requires `seqovl` to be less than `split_pos`. Either statically defined or automatically calculated.
-Otherwise desync is not possible and will not happen.
+Disorder requires `seqovl` to be less than split position. Otherwise `seqovl` is not possible and will be cancelled.
 Method allows to avoid separate fakes. Fakes and real data are mixed.
 
+### ipv6 specific modes
+
 `hopbyhop`, `destopt` and `ipfrag1` desync modes (they're not the same as `hopbyhop` fooling !) are ipv6 only. One `hop-by-hop`,
 `destination options` or `fragment` header is added to all desynced packets.
 Extra header increases packet size and can't be applied to the maximum size packets.
@@ -365,91 +313,36 @@ If it's not possible to send modified packet original one will be sent.
 The idea here is that DPI sees 0 in the next header field of the main ipv6 header and does not
 walk through the extension header chain until transport header is found.
 `hopbyhop`, `destopt`, `ipfrag1` modes can be used with any second phase mode except `ipfrag1+ipfrag2`.
-For example, `hopbyhop,split2` means split original tcp packet into 2 pieces and add hop-by-hop header to both.
+For example, `hopbyhop,multisplit` means split original tcp packet into several pieces and add hop-by-hop header to each.
 With `hopbyhop,ipfrag2` header sequence will be : `ipv6,hop-by-hop,fragment,tcp/udp`.
 `ipfrag1` mode may not always work without special preparations. See "IP Fragmentation" notices.
 
-There are DPIs that analyze responses from the server, particularly the certificate from the ServerHello
-that contain domain name(s). The ClientHello delivery confirmation is an ACK packet from the server
-with ACK sequence number corresponding to the length of the ClientHello+1.
+### Server reply reaction
+
+There are DPIs that analyze responses from the server, particularly the certificate from the ServerHello that contain domain name(s). The ClientHello delivery confirmation is an ACK packet from the server with ACK sequence number corresponding to the length of the ClientHello+1.
 In the disorder variant, a selective acknowledgement (SACK) usually arrives first, then a full ACK.
 If, instead of ACK or SACK, there is an RST packet with minimal delay, DPI cuts you off at the request stage.
-If the RST is after a full ACK after a delay of about ping to the server, then probably DPI acts
-on the server response. The DPI may be satisfied with good ClientHello and stop monitoring the TCP session
-without checking ServerHello. Then you were lucky. 'fake' option could work.
-If it does not stop monitoring and persistently checks the ServerHello, --wssize parameter may help (see CONNTRACK).
+If the RST is after a full ACK after a delay of about ping to the server, then probably DPI acts on the server response. The DPI may be satisfied with good ClientHello and stop monitoring the TCP session without checking ServerHello. Then you were lucky. 'fake' option could work.
+If it does not stop monitoring and persistently checks the ServerHello, --wssize parameter may help (see [CONNTRACK](#conntrack)).
 Otherwise it is hardly possible to overcome this without the help of the server.
 The best solution is to enable TLS 1.3 support on the server. TLS 1.3 sends the server certificate in encrypted form.
 This is recommendation to all admins of blocked sites. Enable TLS 1.3. You will give more opportunities to overcome DPI.
 
-Hosts are extracted from plain http request Host: header and SNI of ClientHello TLS message.
-Subdomains are applied automatically. gzip lists are supported.
-
-iptables for performing the attack on the first packet :
-
-`iptables -t mangle -I POSTROUTING -o <external_interface> -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass`
-
-This is good if DPI does not track all requests in http keep-alive session.
-If it does, then pass all outgoing packets for http and only first data packet for https :
-
-```
-iptables -t mangle -I POSTROUTING -o <external_interface> -p tcp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-iptables -t mangle -I POSTROUTING -o <external_interface> -p tcp --dport 80 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
-```
-
-mark is needed to keep away generated packets from NFQUEUE. nfqws sets fwmark when it sends generated packets.
-nfqws can internally filter marked packets. but when connbytes filter is used without mark filter
-packet ordering can be changed breaking the whole idea of desync attack.
-
-### DPI desync combos
-
-dpi-desync parameter takes up to 3 comma separated arguments.
-zero phase means tcp connection establishement (before sending data payload). Mode can be `synack`.
-Hostlist filter is not applicable to the zero phase.
-Next phases work on packets with data payload.
-1st phase mode can be `fake`,`rst`,`rstack`, 2nd phase mode - `disorder`,`disorder2`,`split`,`split2`,`ipfrag2`.
-Can be useful for ISPs with more than one DPI.
-
-### SYNACK mode
-
-In geneva docs it's called **TCP turnaround**. Attempt to make the DPI believe the roles of client and server are reversed.
-
-!!! This mode breaks NAT operation and can be used only if there's no NAT between the attacker's device and the DPI !
-
-In linux it's required to remove standard firewall rule dropping INVALID packets in the OUTPUT chain,
-for example : `-A OUTPUT -m state --state INVALID -j DROP`
-
-In openwrt it's possible to disable the rule for both FORWARD and OUTPUT chains in /etc/config/firewall :
-```
-config zone
-	option name 'wan'
-	.........
-	option masq_allow_invalid '1'
-```
-Unfortunately there's no OUTPUT only switch. It's not desired to remove the rule from the FORWARD chain.
-Add the following lines to `/etc/firewall.user` :
-
-```
-iptables -D zone_wan_output -m comment --comment '!fw3' -j zone_wan_dest_ACCEPT
-ip6tables -D zone_wan_output -m comment --comment '!fw3' -j zone_wan_dest_ACCEPT
-```
-
-then `/etc/init.d/firewall restart`
-
-Otherwise raw sending SYN,ACK frame will cause error stopping the further processing.
-If you realize you don't need the synack mode it's highly suggested to restore drop INVALID rule.
-
 ### SYNDATA mode
 
 Normally SYNs come without data payload. If it's present it's ignored by all major OS if TCP fast open (TFO) is not involved, but may not be ignored by DPI.
 Original connections with TFO are not touched because otherwise they would be definitely broken.
 Without extra parameter payload is 16 zero bytes.
 
-### Virtual Machines
+### DPI desync combos
 
-Most of nfqws packet magic does not work from VMs powered by virtualbox and vmware when network is NATed.
-Hypervisor forcibly changes ttl and does not forward fake packets.
-Set up bridge networking.
+`--dpi-desync` takes up to 3 comma separated modes.
+
+* 0 phase modes work during the connection establishement : `synack`, `syndata` `--wsize`, `--wssize`. [hostlist](((#multiple-strategies))) filters are not applicable.
+* In the 1st phase fakes are sent before original data  : `fake`, `rst`, `rstack`.
+* In the 2nd phase original data is sent in a modified way (for example `fakedsplit` or `ipfrag2`).
+
+Modes must be specified in phase ascending order.
 
 ### CONNTRACK
 
@@ -535,11 +428,7 @@ If nfqws receives a partial ClientHello it begins reassemble session. Packets ar
 Then they go through desync using fully reassembled message.
 On any error reassemble is cancelled and all delayed packets are sent immediately without desync.
 
-There is special support for all tcp split options for multi segment TLS. Split position is treated
-as message-oriented, not packet oriented. For example, if your client sends TLS ClientHello with size 2000
-and SNI is at 1700, desync mode is fake,split2, then fake is sent first, then original first segment
-and the last splitted segment. 3 segments total.
-
+There is special support for all tcp split options for multi segment TLS. Split position is treated as message-oriented, not packet oriented. For example, if your client sends TLS ClientHello with size 2000 and SNI is at 1700, desync mode is `fake,multisplit`, then fake is sent first, then original first segment and the last splitted segment. 3 segments total.
 
 ### UDP support
 
@@ -619,9 +508,9 @@ nfqws sees packets with internal network source address. If fragmented NAT does
 This results in attempt to send packets to internet with internal IP address.
 You need to use nftables instead with hook priority 101 or higher.
 
-### multiple strategies
+### Multiple strategies
 
-`nfqws` can apply different strategies to different requests. It's done with multiple desync profiles.
+**nfqws** can apply different strategies to different requests. It's done with multiple desync profiles.
 Profiles are delimited by the `--new` parameter. First profile is created automatically and does not require `--new`.
 Each profile has a filter. By default it's empty and profile matches any packet.
 Filter can have hard parameters : ip version, ipset and tcp/udp port range.
@@ -637,7 +526,7 @@ Otherwise verification goes to the next profile.
 It's possible that before knowing L7 and hostname connection is served by one profile and after
 this information is revealed it's switched to another profile.
 If you use 0-phase desync methods think carefully what can happen during strategy switch.
-Use `--debug` logging to understand better what `nfqws` does.
+Use `--debug` logging to understand better what **nfqws** does.
 
 Profiles are numbered from 1 to N. There's last empty profile in the chain numbered 0.
 It's used when no filter matched.
@@ -649,6 +538,99 @@ This way you may never unblock all resources and only confuse yourself.
 IMPORTANT : user-mode ipset implementation was not designed as a kernel version replacement. Kernel version is much more effective.
 It's for the systems that lack ipset support : Windows and Linux without nftables and ipset kernel modules (Android, for example).
 
+### Virtual machines
+
+Most of nfqws packet magic does not work from VMs powered by virtualbox and vmware when network is NATed.
+Hypervisor forcibly changes TTL and does not forward fake packets.
+Set up bridge networking.
+
+### IPTABLES for nfqws
+
+This is the common way to redirect some traffic to nfqws :
+
+```
+iptables -t mangle -I POSTROUTING -o <wan_interface> -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+```
+
+This variant works if DPI is stateful and does not track all packets separately in search for "bad requests". If it's stateless you have to redirect all outgoing plain http packets.
+
+```
+iptables -t mangle -I POSTROUTING -o <wan_interface> -p tcp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+iptables -t mangle -I POSTROUTING -o <wan_interface> -p tcp --dport 80 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+```
+
+mark bit is used to prevent loops. **nfqws** sets this mark in each injected packet.
+It's also necessary for correct injected packet ordering and for deadlock prevention.
+
+`autottl` requires incoming `SYN,ACK` packet or first reply packet (it's usually the same). 
+
+`autohostlist` needs incoming `RST` and `http redirect`.
+
+It's possible to build tcp flags and u32 based filter but connbytes is easier.
+
+`
+iptables -t mangle -I PREROUTING -i <wan_interface> -p tcp -m multiport --sports 80,443 -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:3 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+`
+
+For QUIC :
+
+```
+iptables -t mangle -I POSTROUTING -o <wan_interface> -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num 200 --queue-bypass
+```
+
+6 packets cover possible retransmissions of quic initials and feed `autohostlist` mode.
+
+### NFTABLES for nfqws
+
+This is the start configuration :
+
+```
+IFACE_WAN=wan
+
+nft create table inet ztest
+
+nft add chain inet ztest post "{type filter hook postrouting priority mangle;}"
+nft add rule inet ztest post oifname $IFACE_WAN meta mark and 0x40000000 == 0 tcp dport "{80,443}" ct original packets 1-6 queue num 200 bypass
+nft add rule inet ztest post oifname $IFACE_WAN meta mark and 0x40000000 == 0 udp dport 443 ct original packets 1-6 queue num 200 bypass
+
+# auto hostlist with avoiding wrong ACK numbers in RST,ACK packets sent by russian DPI
+sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1 
+nft add chain inet ztest pre "{type filter hook prerouting priority filter;}"
+nft add rule inet ztest pre iifname $IFACE_WAN tcp sport "{80,443}" ct reply packets 1-3 queue num 200 bypass
+```
+
+To engage `datanoack` or `ipfrag` for passthrough traffic special POSTNAT configuration is required. Generated packets must be marked as **notrack** in the early stage to avoid being invalidated by linux conntrack.
+
+```
+IFACE_WAN=wan
+
+nft create table inet ztest
+
+nft add chain inet ztest postnat "{type filter hook postrouting priority srcnat+1;}"
+nft add rule inet ztest postnat oifname $IFACE_WAN meta mark and 0x40000000 == 0 tcp dport "{80,443}" ct original packets 1-6 queue num 200 bypass
+nft add rule inet ztest postnat oifname $IFACE_WAN meta mark and 0x40000000 == 0 udp dport 443 ct original packets 1-6 queue num 200 bypass
+
+nft add chain inet ztest predefrag "{type filter hook output priority -401;}"
+nft add rule inet ztest predefrag "mark & 0x40000000 != 0x00000000 notrack"
+```
+
+Delete nftable :
+
+```
+nft delete table inet ztest
+```
+
+### Flow offloading
+
+If your device supports flow offloading (hardware acceleration) iptables and nftables may not work. With offloading enabled packets bypass standard netfilter flow. It must be either disabled or selectively controlled.
+
+Newer linux kernels have software flow offloading (SFO). The story is the same with SFO.
+
+In `iptables` flow offloading is controlled by openwrt proprietary extension `FLOWOFFLOAD`. Newer `nftables` implement built-in offloading support.
+
+Flow offloading does not interfere with **tpws** and `OUTPUT` traffic. It only breaks nfqws that fools `FORWARD` traffic.
+
+
 ## tpws
 
 tpws is transparent proxy.
@@ -658,6 +640,7 @@ tpws is transparent proxy.
 
  --debug=0|1|2|syslog|@<filename>        ; 1 and 2 means log to console and set debug level. for other targets use --debug-level.
  --debug-level=0|1|2                     ; specify debug level for syslog and @<filename>
+ --dry-run                               ; verify parameters and exit with code 0 if successful
  --bind-addr=<v4_addr>|<v6_addr>         ; for v6 link locals append %interface_name : fe80::1%br-lan
  --bind-iface4=<interface_name>          ; bind to the first ipv4 addr of interface
  --bind-iface6=<interface_name>          ; bind to the first ipv6 addr of interface
@@ -681,6 +664,7 @@ tpws is transparent proxy.
  --skip-nodelay                          ; do not set TCP_NODELAY for outgoing connections. incompatible with split.
  --local-tcp-user-timeout=<seconds>      ; set tcp user timeout for local leg (default : 10, 0 = system default)
  --remote-tcp-user-timeout=<seconds>     ; set tcp user timeout for remote leg (default : 20, 0 = system default)
+ --fix-seg=<int>                         ; recover failed TCP segmentation at the cost of slowdown. wait up to N msec.
  --no-resolve                            ; disable socks5 remote dns
  --resolver-threads=<int>                ; number of resolver worker threads
  --maxconn=<max_connections>             ; max number of local legs
@@ -688,24 +672,28 @@ tpws is transparent proxy.
                                          ; its worth to make a reserve with 1.5 multiplier. by default maxfiles is (X*connections)*1.5+16
  --max-orphan-time=<sec>                 ; if local leg sends something and closes and remote leg is still connecting then cancel connection attempt after N seconds
 
- --new                          ; begin new strategy
+ --new                                   ; begin new strategy (new profile)
+ --skip                                  ; do not use this profile
  --filter-l3=ipv4|ipv6                   ; L3 protocol filter. multiple comma separated values allowed.
  --filter-tcp=[~]port1[-port2]|*         ; TCP port filter. ~ means negation. comma separated list supported.
  --filter-l7=[http|tls|unknown]          ; L6-L7 protocol filter. multiple comma separated values allowed.
  --ipset=<filename>                      ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-ip=<ip_list>                    ; comma separated fixed subnet list
  --ipset-exclude=<filename>              ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-exclude-ip=<ip_list>            ; comma separated fixed subnet list
 
  --hostlist=<filename>                   ; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-domains=<domain_list>        ; comma separated fixed domain list
  --hostlist-exclude=<filename>           ; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list
  --hostlist-auto=<filename>              ; detect DPI blocks and build hostlist automatically
  --hostlist-auto-fail-threshold=<int>    ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
  --hostlist-auto-fail-time=<int>         ; all failed attemps must be within these seconds (default : 60)
  --hostlist-auto-debug=<logfile>         ; debug auto hostlist positives
 
- --split-http-req=method|host	; split http request at specified logical position.
- --split-tls=sni|sniext         ; split at specified logical part of TLS ClientHello
- --split-pos=<numeric_offset>   ; split at specified pos. split-http-req takes precedence over split-pos for http reqs.
- --split-any-protocol		; split not only http and https
+ --split-pos=N|-N|marker+N|marker-N      ; comma separated list of split positions
+                                         ; markers: method,host,endhost,sld,endsld,midsld,sniext  
+ --split-any-protocol                    ; split not only http and TLS
  --disorder[=http|tls]                   ; when splitting simulate sending second fragment first
  --oob[=http|tls]                        ; when splitting send out of band byte. default is HEX 0x00.
  --oob-data=<char>|0xHEX                 ; override default 0x00 OOB byte.
@@ -719,10 +707,9 @@ tpws is transparent proxy.
  --methodspace                           ; add extra space after method
  --methodeol                             ; add end-of-line before method
  --unixeol                               ; replace 0D0A to 0A
- --tlsrec=sni|sniext            ; make 2 TLS records. split at specified logical part. don't split if SNI is not present.
+ --tlsrec=N|-N|marker+N|marker-N         ; make 2 TLS records. split at specified logical part. don't split if SNI is not present.
  --tlsrec-pos=<pos>                      ; make 2 TLS records. split at specified pos
  --mss=<int>                             ; set client MSS. forces server to split messages but significantly decreases speed !
- --mss-pf=[~]port1[-port2]      ; MSS port filter. ~ means negation
  --tamper-start=[n]<pos>                 ; start tampering only from specified outbound stream position. byte pos or block number ('n'). default is 0.
  --tamper-cutoff=[n]<pos>                ; do not tamper anymore after specified outbound stream position. byte pos or block number ('n'). default is unlimited.
  --daemon                                ; daemonize
@@ -731,13 +718,49 @@ tpws is transparent proxy.
  --uid=uid[:gid]                         ; drop root privs
 ```
 
-The manipulation parameters can be combined in any way.
+### TCP segmentation in tpws
 
-`split-http-req` takes precedence over split-pos for http reqs.
+**tpws** like **nfqws** supports multiple splits. Split [markers](#tcp-segmentation) are specified in `--split-pos` parameter.
 
-split-pos works by default only on http and TLS ClientHello. use `--split-any-protocol` to act on any packet
+On the socket level there's no guaranteed way to force OS to send pieces of data in separate packets. OS has a send buffer for each socket. If `TCP_NODELAY` socket option is enabled and send buffer is empty OS will likely send data immediately. If send buffer is not empty OS will coalesce it with new data and send in one packet if possible.
 
-tpws can bind to multiple interfaces and IP addresses (up to 32).
+In practice outside of massive transmissions it's usually enough to enable `TCP_NODELAY` and use separate `send()` calls to force custom TCP segmentation. But if there're too many split segments Linux can combined some pieces and break desired behaviour. BSD and Windows are more predictable in this case. That's why it's not recommended to use too many splits. Tests revealed that 8+ can become problematic.
+
+Since linux kernel 4.6 **tpws** can recognize TCP segmentation failures and warn about them. `--fix-seg` can fix segmentation failures at the cost of some slowdown. It waits for several msec until all previous data is sent. This breaks async processing model and slows down every other connection going through **tpws**. Thus it's not recommended on highly loaded systems. But can be compromise for home systems.
+
+If you're attempting to split massive transmission with `--split-any-protocol` option it will definitely cause massive segmentation failures. Do not do that without `--tamper-start` and `--tamper-cutoff` limiters.
+
+**tpws** works on socket level and receives in one shot long requests (TLS with kyber) that should normally require several TCP packets. It tampers entire received block without knowing how much packets it will take. OS will do additional segmenation to meet MTU.
+
+`--disorder` sends every odd packet with TTL=1. Server receives even packets fastly. Then client OS retransmits odd packets with normal TTL and server receives them. In case of 6 segments server and DPI will see them in this order : `2 4 6 1 3 5`. This way of disorder causes some delays. Default retransmission timeout in Linux is 200 ms.
+
+`--oob` sends one out-of-band byte in the end of the first split segment.
+
+`--oob` and `--disorder` can be combined only in Linux. Others OS do not handle this correctly.
+
+### TLSREC
+
+`--tlsrec` allow to split TLS ClientHello into 2 TLS records in one TCP segment. It accepts single pos marker.
+
+`--tlsrec` breaks significant number of sites. Crypto libraries on servers usually accept fine modified ClientHello but middleboxes such as CDNs and ddos guards - not always. Use of `--tlsrec` without filters is discouraged.
+
+### MSS
+
+`--mss` sets TCP_MAXSEG socket option. Client sets this value in MSS TCP option in the SYN packet.
+Server replies with it's own MSS in SYN,ACK packet. Usually servers lower their packet sizes but they still don't fit to supplied MSS. The greater MSS client sets the bigger server's packets will be.
+If it's enough to split TLS 1.2 ServerHello, it may fool DPI that checks certificate domain name.
+This scheme may significantly lower speed. Hostlist filter is possible only in socks mode if client uses remote resolving (firefox `network.proxy.socks_remote_dns`).
+`--mss` is not required for TLS1.3. If TLS1.3 is negotiable then MSS make things only worse. Use only if nothing better is available. Works only in Linux, not BSD or MacOS.
+
+### Other tamper options
+
+`--hostpad=<bytes>` adds padding headers before `Host:` with specified number of bytes. If `<bytes>` is too large headers are split by 2K. Padding more that 64K is not supported and not accepted by http servers.
+
+It's useful against stateful DPI's that reassemble only limited amount of data. Increase padding `<bytes>` until website works. If minimum working `<bytes>` is close to MTU then it's likely DPI is not reassembling packets. Then it's better to use regular split instead of `--hostpad`.
+
+### Supplementary options
+
+**tpws** can bind to multiple interfaces and IP addresses (up to 32).
 
 Port number is always the same.
 
@@ -773,44 +796,83 @@ To bind to a specific ip when its interface may not be configured yet do : `--bi
 
 It's possible to bind to any nonexistent address in transparent mode but in socks mode address must exist.
 
-In socks proxy mode no additional system privileges are required. Connections to local IPs of the system where tpws runs are prohibited.
+In socks proxy mode no additional system privileges are required. Connections to local IPs of the system where **tpws** runs are prohibited.
 tpws supports remote dns resolving (curl : `--socks5-hostname`  firefox : `socks_remote_dns=true`) , but does it in blocking mode.
 
-tpws uses async sockets for all activities. Domain names are resolved in multi threaded pool.
+**tpws** uses async sockets for all activities. Domain names are resolved in multi threaded pool.
 Resolving does not freeze other connections. But if there're too many requests resolving delays may increase.
 Number of resolver threads is choosen automatically proportinally to `--maxconn` and can be overriden using `--resolver-threads`.
 To disable hostname resolve use `--no-resolve` option.
 
-`--disorder` is an additional flag to any split option.
-It tries to simulate `--disorder2` option of `nfqws` using standard socket API without the need of additional privileges.
-This works fine in Linux and MacOS but unexpectedly in FreeBSD and OpenBSD
-(system sends second fragment then the whole packet instead of the first fragment).
+### Multiple strategies
 
-`--tlsrec` and `--tlsrec-pos` allow to split TLS ClientHello into 2 TLS records in one TCP segment.
-`--tlsrec=sni` splits between 1st and 2nd chars of the hostname. No split occurs if SNI is not present.
-`--tlsrec-pos` splits at specified position. If TLS data block size is too small pos=1 is applied.
-`--tlsrec` can be combined with `--split-pos` and `--disorder`.
-`--tlsrec` breaks significant number of sites. Crypto libraries on end servers usually accept fine modified ClientHello
-but middleboxes such as CDNs and ddos guards - not always.
-Use of `--tlsrec` without filters is discouraged.
-
-`--mss` sets TCP_MAXSEG socket option. Client sets this value in MSS TCP option in the SYN packet.
-Server replies with it's own MSS in SYN,ACK packet. Usually servers lower their packet sizes but they still don't
-fit to supplied MSS. The greater MSS client sets the bigger server's packets will be.
-If it's enough to split TLS 1.2 ServerHello, it may fool DPI that checks certificate domain name.
-This scheme may significantly lower speed. Hostlist filter is possible only in socks mode if client uses remote resolving (firefox `network.proxy.socks_remote_dns`).
-`--mss` is not required for TLS1.3. If TLS1.3 is negotiable then MSS make things only worse.
-Use only if nothing better is available. Works only in Linux, not BSD or MacOS.
-
-### multiple strategies
-
-`tpws` supports multiple strategies as well. They work mostly like with `nfqws` with minimal differences.
-`filter-udp` is absent because `tpws` does not support udp. 0-phase desync methods (`--mss`) can work with hostlist in socks modes with remote hostname resolve.
+**tpws** like **nfqws** supports multiple strategies. They work mostly like with **nfqws** with minimal differences.
+`filter-udp` is absent because **tpws** does not support udp. 0-phase desync methods (`--mss`) can work with hostlist in socks modes with remote hostname resolve.
 This is the point where you have to plan profiles carefully. If you use `--mss` and hostlist filters, behaviour can be different depending on remote resolve feature enabled or not.
 Use `--mss` both in hostlist profile and profile without hostlist.
 Use `curl --socks5` and `curl --socks5-hostname` to issue two kinds of proxy queries.
 See `--debug` output to test your setup.
 
+### IPTABLES for tpws
+
+Use the following rules to redirect TCP connections to 'tpws' :
+```
+iptables -t nat -I OUTPUT -o <wan_interface> -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to 127.0.0.127:988
+iptables -t nat -I PREROUTING -i <lan_interface> -p tcp --dport 80 -j DNAT --to 127.0.0.127:988
+```
+
+First rule redirects outgoing from the same system traffic, second redirects passthrough traffic.
+
+DNAT to localhost works only in the **OUTPUT** chain and does not work in the **PREROUTING** chain without setting this sysctl :
+
+`sysctl -w net.ipv4.conf.<lan_interface>.route_localnet=1`
+
+It's also possible to use `-j REDIRECT --to-port 988` instead of DNAT but in the latter case transparent proxy must listen on all IP addresses or on a LAN interface address. It's not too good to listen on all IP and it's not trivial to get specific IP in a shell script. `route_localnet` has it's own security impact if not protected by additional rules. You open `127.0.0.0/8` subnet to the net.
+
+This is how to open only single `127.0.0.127` address :
+```
+iptables -A INPUT ! -i lo -d 127.0.0.127 -j ACCEPT
+iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
+```
+
+Owner filter is required to avoid redirection loops. **tpws** must be run with `--user tpws` parameter.
+
+ip6tables work almost the same with minor differences. ipv6 addresses should be enclosed in square brackets :
+```
+ip6tables -t nat -I OUTPUT -o <wan_interface> -p tcp --dport 80 -m owner ! --uid-owner tpws -j DNAT --to [::1]:988
+```
+
+There's no `route_localnet` for ipv6. DNAT to localhost (`::1`) is possible only in **OUTPUT** chain. In **PREROUTING** chain DNAT is possible to any global address or link local address of the interface where packet came from.
+
+### NFTABLES for tpws
+
+Base nftables scheme :
+```
+IFACE_WAN=wan
+IFACE_LAN=br-lan
+
+sysctl -w net.ipv4.conf.$IFACE_LAN.route_localnet=1
+
+nft create table inet ztest
+
+nft create chain inet ztest localnet_protect
+nft add rule inet ztest localnet_protect ip daddr 127.0.0.127 return
+nft add rule inet ztest localnet_protect ip daddr 127.0.0.0/8 drop
+nft create chain inet ztest input "{type filter hook input priority filter - 1;}"
+nft add rule inet ztest input iif != "lo" jump localnet_protect
+
+nft create chain inet ztest dnat_output "{type nat hook output priority dstnat;}"
+nft add rule inet ztest dnat_output meta skuid != tpws oifname $IFACE_WAN tcp dport { 80, 443 } dnat ip to 127.0.0.127:988
+nft create chain inet ztest dnat_pre "{type nat hook prerouting priority dstnat;}"
+nft add rule inet ztest dnat_pre meta iifname $IFACE_LAN tcp dport { 80, 443 } dnat ip to 127.0.0.127:988
+```
+
+Delete nftable :
+```
+nft delete table inet ztest
+```
+
+
 ## Ways to get a list of blocked IP
 
 nftables can't work with ipsets. Native nf sets require lots of RAM to load large ip lists with subnets and intervals.
@@ -878,8 +940,8 @@ LISTS_RELOAD=-  disables reloading ip list backend.
 
 ## Domain name filtering
 
-An alternative to ipset is to use tpws or nfqws with a list(s) of domains.
-Both `tpws` and `nfqws` take any number of include (`--hostlist`) and exclude (`--hostlist-exclude`) domain lists.
+An alternative to ipset is to use **tpws** or **nfqws** with a list(s) of domains.
+Both **tpws** and **nfqws** take any number of include (`--hostlist`) and exclude (`--hostlist-exclude`) domain lists.
 All lists of the same type are combined internally leaving only 2 lists : include and exclude.
 
 Exclude list is checked first. Fooling is cancelled if domain belongs to exclude list.
@@ -896,13 +958,13 @@ and 1 exclude list
 
 `ipset/zapret-hosts-users-exclude.txt.gz` or `ipset/zapret-hosts-users-exclude.txt`
 
-If `MODE_FILTER=hostlist` all present lists are passed to `nfqws` or `tpws`.
+If `MODE_FILTER=hostlist` all present lists are passed to **nfqws** or **tpws**.
 If all include lists are empty it works like no include lists exist at all.
 If you need "all except" mode you dont have to delete zapret-hosts-users.txt. Just make it empty.
 
 Subdomains auto apply. For example, "ru" in the list affects "*.ru" .
 
-tpws and nfqws automatically reload lists if their modification date is changed.
+**tpws** and **nfqws** automatically reload lists if their modification date is changed.
 
 When filtering by domain name, daemons should run without filtering by ipset.
 When using large regulator lists estimate the amount of RAM on the router !
@@ -918,7 +980,7 @@ In case of nfqws it's required to redirect both incoming and outgoing traffic to
 It's strongly recommended to use connbytes filter or nfqws will process gigabytes of incoming traffic.
 For the same reason it's not recommended to use autohostlist mode in BSDs. BSDs do not support connbytes or similar mechanism.
 
-nfqws и tpws detect the folowing situations :
+**nfqws** и **tpws** detect the folowing situations :
 1) [nfqws] Multiple retransmissions of the first request inside a TCP session having host.
 2) [nfqws,tpws] RST in response to the first request.
 3) [nfqws,tpws] HTTP redirect in response to the first http request with 2nd level domain diferent from the original.
@@ -964,11 +1026,11 @@ On openwrt by default `nftables` is selected on `firewall4` based systems.
 `FWTYPE=iptables`
 
 With `nftables` post-NAT scheme is used by default. It allows more DPI attacks on forwarded traffic.
-It's possible to use `iptables`-like pre-NAT scheme. `nfqws` will see client source IPs and display them in logs.
+It's possible to use `iptables`-like pre-NAT scheme. **nfqws** will see client source IPs and display them in logs.
 
 `#POSTNAT=0`
 
-There'are 3 standard options configured separately and independently : `tpws-socks`, `tpws`, `nfqws`.
+There'are 3 standard options configured separately and independently : `tpws-socks`, **tpws**, **nfqws**.
 They can be used alone or combined. Custom scripts in `init.d/{sysv,openwrt,macos}/custom.d` are always applied.
 
 `tpws-socks` requires daemon parameter configuration but does not require traffic interception.
@@ -987,45 +1049,45 @@ Don't use `<HOSTLIST>` in highly specialized profiles. Use your own filter or ho
 If any other profile adds something this profile accepts the change automatically.
 
 
-`tpws` socks proxy mode switch
+**tpws** socks proxy mode switch
 
 `TPWS_SOCKS_ENABLE=0`
 
-Listening tcp port for `tpws` proxy mode.
+Listening tcp port for **tpws** proxy mode.
 
 `TPPORT_SOCKS=987`
 
-`tpws` socks mode parameters
+**tpws** socks mode parameters
 
 ```
 TPWS_SOCKS_OPT="
 --filter-tcp=80 --methodeol <HOSTLIST> --new
---filter-tcp=443 --split-tls=sni --disorder <HOSTLIST>
+--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>"
 "
 ```
 
-`tpws` transparent mode switch
+**tpws** transparent mode switch
 
 `TPWS_ENABLE=0`
 
-`tpws` transparent mode target ports
+**tpws** transparent mode target ports
 
 `TPWS_PORTS=80,443`
 
-`tpws` transparent mode parameters
+**tpws** transparent mode parameters
 
 ```
 TPWS_OPT="
 --filter-tcp=80 --methodeol <HOSTLIST> --new
---filter-tcp=443 --split-tls=sni --disorder <HOSTLIST>
+--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>"
 "
 ```
 
-`nfqws` enable switch
+**nfqws** enable switch
 
 `NFQWS_ENABLE=0`
 
-`nfqws` port targets for `connbytes`-limited interception. `connbytes` allows to intercept only starting packets from connections.
+**nfqws** port targets for `connbytes`-limited interception. `connbytes` allows to intercept only starting packets from connections.
 This is more effective kernel-mode alternative to `nfqws --dpi-desync-cutoff=nX`.
 
 ```
@@ -1053,12 +1115,12 @@ It's advised also to remove these ports from `connbytes`-limited interception li
 #NFQWS_PORTS_UDP_KEEPALIVE=
 ```
 
-`nfqws` parameters
+**nfqws** parameters
 
 ```
 NFQWS_OPT="
---filter-tcp=80 --dpi-desync=fake,split2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
---filter-tcp=443 --dpi-desync=fake,disorder2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
+--filter-tcp=80 --dpi-desync=fake,multisplit --dpi-desync-split-pos=method+2 --dpi-desync-fooling=md5sig <HOSTLIST> --new
+--filter-tcp=443 --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-fooling=badseq,md5sig <HOSTLIST> --new
 --filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=6 <HOSTLIST_NOAUTO>
 "
 ```
@@ -1276,33 +1338,29 @@ For low storage openwrt see `init.d/openwrt-minimal`.
 
 ### Android
 
-Its not possible to use nfqws and tpws in transparent proxy mode without root privileges.
-Without root tpws can run in --socks mode.
+Its not possible to use **nfqws** and **tpws** in transparent proxy mode without root privileges. Without root **tpws** can run in `--socks` mode.
 
-Android has NFQUEUE and nfqws should work.
+Android has NFQUEUE and **nfqws** should work.
 
-There's no ipset support unless you run custom kernel. In common case task of bringing up ipset
-on android is ranging from "not easy" to "almost impossible", unless you find working kernel
-image for your device.
+There's no `ipset` support unless you run custom kernel. In common case task of bringing up `ipset` on android is ranging from "not easy" to "almost impossible", unless you find working kernel image for your device.
 
-Android does not use /etc/passwd, `tpws --user` won't work. There's replacement.
-Use numeric uids in `--uid` option.
-Its recommended to use gid 3003 (AID_INET), otherwise tpws will not have inet access.
+Although linux binaries work it's recommended to use Android specific ones. They have no problems with user names, local time, DNS, ...
+Its recommended to use gid 3003 (AID_INET), otherwise **tpws** will not have inet access.
 
 Example : `--uid 1:3003`
 
 In iptables use : `! --uid-owner 1` instead of `! --uid-owner tpws`.
 
-Nfqws should be executed with `--uid 1`. Otherwise on some devices or firmwares kernel may partially hang. Looks like processes with certain uids can be suspended. With buggy chineese cellular interface driver this can lead to device hang.
+**nfqws** should be executed with `--uid 1`. Otherwise on some devices or firmwares kernel may partially hang. Looks like processes with certain uids can be suspended. With buggy chineese cellular interface driver this can lead to device hang.
 
-Write your own shell script with iptables and tpws, run it using your root manager.
+Write your own shell script with iptables and **tpws**, run it using your root manager.
 Autorun scripts are here :
 
 magisk  : `/data/adb/service.d`
 
 supersu : `/system/su.d`
 
-How to run tpws on root-less android.
+How to run **tpws** on root-less android.
 You can't write to `/system`, `/data`, can't run from sd card.
 Selinux prevents running executables in `/data/local/tmp` from apps.
 Use adb and adb shell.
@@ -1336,7 +1394,7 @@ You will need :
  * root shell access. true sh shell, not microtik-like console
  * startup hook
  * r/w partition to store binaries and startup script with executable permission (+x)
- * tpws can be run almost anywhere but nfqws require kernel support for NFQUEUE. Its missing in most firmwares.
+ * **tpws** can be run almost anywhere but **nfqws** require kernel support for NFQUEUE. Its missing in most firmwares.
  * too old 2.6 kernels are unsupported and can cause errors. newer 2.6 kernels are OK.
 If binaries crash with segfault (rare but happens on some kernels) try to unpack upx like this : upx -d tpws.
 

docs/windows.en.md

@@ -101,10 +101,11 @@ There are several options :
 Replace these 2 files in every location they are present.
 In `zapret-win-bundle` they are in `zapret-winws` и `blockcheck/zapret/nfq` folders.
 However this option still requires 10+ year old patch that enables SHA256 signatures.
+If you're using win bundle you can simply run `win7\install_win7.cmd`
 
-2. [Hack ESU](https://hackandpwn.com/windows-7-esu-patching)
+3. [Hack ESU](https://hackandpwn.com/windows-7-esu-patching)
 
-3. Use `UpdatePack7R2` from simplix : https://blog.simplix.info
+4. Use `UpdatePack7R2` from simplix : https://blog.simplix.info
 If you are in Russia or Belarus temporary change region in Control Panel.
 
 ### blockcheck

docs/windows.md

@@ -159,6 +159,7 @@ _windivert 2.2.2-A_, который идет в поставке zapret.
 и заменить эти 2 файла.
 В [zapret-win-bundle](https://github.com/bol-van/zapret-win-bundle) есть отдельных 2 места, где находится **winws** : [_zapret-winws_](https://github.com/bol-van/zapret-win-bundle/tree/master/zapret-winws) и [_blockcheck/zapret/nfq_](https://github.com/bol-van/zapret-win-bundle/tree/master/blockcheck).
 Надо менять в обоих местах.
+Альтернативный вариант при использовании win bundle - запустить `win7\install_win7.cmd`
 
 > [!NOTE]
 > Этот вариант проверен и должен работать. Тем не менее патч 10 летней давности, который включает SHA256 сигнатуры, все еще необходим.

docs/wireguard/010-wg-mod.patch

@@ -1,133 +0,0 @@
-Index: WireGuard-0.0.20190123/src/cookie.c
-===================================================================
---- WireGuard-0.0.20190123.orig/src/cookie.c
-+++ WireGuard-0.0.20190123/src/cookie.c
-@@ -193,6 +193,8 @@ void wg_cookie_message_create(struct mes
- 	xchacha20poly1305_encrypt(dst->encrypted_cookie, cookie, COOKIE_LEN,
- 				  macs->mac1, COOKIE_LEN, dst->nonce,
- 				  checker->cookie_encryption_key);
-+        // MOD : randomize trash
-+	dst->header.trash = gen_trash();
- }
- 
- void wg_cookie_message_consume(struct message_handshake_cookie *src,
-Index: WireGuard-0.0.20190123/src/messages.h
-===================================================================
---- WireGuard-0.0.20190123.orig/src/messages.h
-+++ WireGuard-0.0.20190123/src/messages.h
-@@ -53,23 +53,41 @@ enum limits {
- 	MAX_QUEUED_PACKETS = 1024 /* TODO: replace this with DQL */
- };
- 
-+/*
- enum message_type {
--	MESSAGE_INVALID = 0,
--	MESSAGE_HANDSHAKE_INITIATION = 1,
--	MESSAGE_HANDSHAKE_RESPONSE = 2,
--	MESSAGE_HANDSHAKE_COOKIE = 3,
--	MESSAGE_DATA = 4
-+    MESSAGE_INVALID = 0,
-+    MESSAGE_HANDSHAKE_INITIATION = 1,
-+    MESSAGE_HANDSHAKE_RESPONSE = 2,
-+    MESSAGE_HANDSHAKE_COOKIE = 3,
-+    MESSAGE_DATA = 4
- };
-+*/
-+
-+// MOD : message type
-+enum message_type {
-+    MESSAGE_INVALID = 0xE319CCD0,
-+    MESSAGE_HANDSHAKE_INITIATION = 0x48ADE198,
-+    MESSAGE_HANDSHAKE_RESPONSE = 0xFCA6A8F3,
-+    MESSAGE_HANDSHAKE_COOKIE = 0x64A3BB18,
-+    MESSAGE_DATA = 0x391820AA
-+};
-+
-+// MOD : generate fast trash without true RNG
-+__le32 gen_trash(void);
- 
- struct message_header {
--	/* The actual layout of this that we want is:
--	 * u8 type
--	 * u8 reserved_zero[3]
--	 *
--	 * But it turns out that by encoding this as little endian,
--	 * we achieve the same thing, and it makes checking faster.
--	 */
--	__le32 type;
-+    /* The actual layout of this that we want is:
-+     * u8 type
-+     * u8 reserved_zero[3]
-+     *
-+     * But it turns out that by encoding this as little endian,
-+     * we achieve the same thing, and it makes checking faster.
-+     */
-+
-+    // MOD : trash field to change message size and add 4 byte offset to all fields
-+    __le32 trash;
-+
-+    __le32 type;
- };
- 
- struct message_macs {
-Index: WireGuard-0.0.20190123/src/noise.c
-===================================================================
---- WireGuard-0.0.20190123.orig/src/noise.c
-+++ WireGuard-0.0.20190123/src/noise.c
-@@ -17,6 +17,24 @@
- #include <linux/highmem.h>
- #include <crypto/algapi.h>
- 
-+
-+// MOD : trash generator
-+__le32 gtrash = 0;
-+__le32 gen_trash(void)
-+{
-+    if (gtrash)
-+	gtrash = gtrash*1103515243 + 12345;
-+    else
-+	// first value is true random
-+	get_random_bytes_wait(&gtrash, sizeof(gtrash));
-+    return gtrash;
-+}
-+
- /* This implements Noise_IKpsk2:
-  *
-  * <- s
-@@ -515,6 +533,10 @@ wg_noise_handshake_create_initiation(str
- 		&handshake->entry);
- 
- 	handshake->state = HANDSHAKE_CREATED_INITIATION;
-+
-+	// MOD : randomize trash
-+        dst->header.trash = gen_trash();
-+
- 	ret = true;
- 
- out:
-@@ -655,6 +677,10 @@ bool wg_noise_handshake_create_response(
- 		&handshake->entry);
- 
- 	handshake->state = HANDSHAKE_CREATED_RESPONSE;
-+
-+        // MOD : randomize trash
-+        dst->header.trash = gen_trash();
-+
- 	ret = true;
- 
- out:
-Index: WireGuard-0.0.20190123/src/send.c
-===================================================================
---- WireGuard-0.0.20190123.orig/src/send.c
-+++ WireGuard-0.0.20190123/src/send.c
-@@ -200,6 +200,10 @@ static bool encrypt_packet(struct sk_buf
- 	header->header.type = cpu_to_le32(MESSAGE_DATA);
- 	header->key_idx = keypair->remote_index;
- 	header->counter = cpu_to_le64(PACKET_CB(skb)->nonce);
-+
-+        // MOD : randomize trash
-+	header->header.trash = gen_trash();
-+
- 	pskb_put(skb, trailer, trailer_len);
- 
- 	/* Now we can encrypt the scattergather segments */

docs/wireguard/wireguard-mod.txt

@@ -1,250 +0,0 @@
-!!! Эта инструкция написана еще до включения wireguard в ядро linux.
-!!! Процесс сборки для in-tree модулей отличается.
-!!! Цель данного чтива - дать идею для программистов как можно исправить исходники wireguard
-!!! для преодоления DPI. Автор не преследует цели поддерживать готовые патчи для актуальных версий.
-!!! Вместо патчинга гораздо проще использовать навесное решение ipobfs.
-
-Посвящено возможной блокировке в РФ VPN протоколов через DPI.
-Предпосылками являются последние законодательные акты и во всю сочащиеся "секретные" записки.
-В РФ разрабатываются и готовятся к применению более продвинутые решения по блокировке трафика.
-Вполне вероятно будут резать стандартные VPN протоколы. Нам надо быть к этому готовыми.
-
-Один из возможных и перспективных путей решения данного вопроса - кустомная модификация
-исходников VPN с целью незначительного изменения протокола, ломающего стандартные модули обнаружения в DPI.
-Это относительно сложно, доступно только для гиков.
-Никто не будет разрабатывать специальные модули обнаружения в DPI, если только кто-то не сделает простое и
-удобное решение для всех, и его станут широко применять. Но это маловероятно, и даже если и так,
-то всегда можно модифицировать протокол чуток по другому. Делать моды для DPI несравненно дольше
-и дороже, чем клепать на коленке изменения протокола для wireguard.
-
-
-ЗАМЕЧЕНИЕ : альтернативой модификации конечного софта для VPN является использование "навесных"
-обфускаторов. см : https://github.com/bol-van/ipobfs
-
-
-Рассмотрю что нам надо пропатчить в wireguard. Модифицированный wireguard проверен на виртуалках
-с десктопным linux, он работает, сообщения в wireshark действительно не вписываются в стандартный
-протокол и не опознаются.
-
-Wireguard протокол очень простой. Все сообщения описаны в messages.h
-Поставим себе целью сделать 2 простые модификации :
-1) Добавим в начало всех сообщений немного мусора, чтобы изменить размер сообщений и смещения полей
-2) Изменим коды типов сообщений
-Этого может быть вполне достаточно для обмана DPI
-
---messages.h--------------------------
-/*
-enum message_type {
-	MESSAGE_INVALID = 0,
-	MESSAGE_HANDSHAKE_INITIATION = 1,
-	MESSAGE_HANDSHAKE_RESPONSE = 2,
-	MESSAGE_HANDSHAKE_COOKIE = 3,
-	MESSAGE_DATA = 4
-};
-*/
-
-// MOD : message type
-enum message_type {
-	MESSAGE_INVALID = 0xE319CCD0,
-	MESSAGE_HANDSHAKE_INITIATION = 0x48ADE198,
-	MESSAGE_HANDSHAKE_RESPONSE = 0xFCA6A8F3,
-	MESSAGE_HANDSHAKE_COOKIE = 0x64A3BB18,
-	MESSAGE_DATA = 0x391820AA
-};
-
-// MOD : generate fast trash without true RNG
-__le32 gen_trash(void);
-
-struct message_header {
-	/* The actual layout of this that we want is:
-	 * u8 type
-	 * u8 reserved_zero[3]
-	 *
-	 * But it turns out that by encoding this as little endian,
-	 * we achieve the same thing, and it makes checking faster.
-	 */
-
-	// MOD : trash field to change message size and add 4 byte offset to all fields
-	__le32 trash;
-
-	__le32 type;
-};
---------------------------------------
-
-Напишем функцию для генерации trash. Функция должна быть быстрая, важно не замедлить скорость.
-Мы не расчитываем, что нас будут специально ловить, иначе бы пришлось делать полноценный обфускатор.
-Задача лишь сломать стандартный модуль обнаружения протокола wireguard. Потому истинная рандомность
-trash не важна.
-Но все же немного "трэша" не повредит. Гонки между тредами так же пофигистичны. Это же трэш.
-
---noise.c-----------------------------
-// MOD : trash generator
-__le32 gtrash = 0;
-__le32 gen_trash(void)
-{
-	if (gtrash)
-		gtrash = gtrash*1103515243 + 12345;
-	else
-		// first value is true random
-		get_random_bytes_wait(&gtrash, sizeof(gtrash));
-	return gtrash;
-}
---------------------------------------
-
-Теперь осталось найти все места, где создаются сообщения и внести туда заполнение поля trash.
-Сообщений всего 4. Их можно найти по присваиванию полю type одного из значений enum message_type.
-
-2 места в noise.c в функциях wg_noise_handshake_create_initiation и wg_noise_handshake_create_response,
-1 место в cookie.c в функции wg_cookie_message_create
-Дописываем в конец инициализации структуры сообщения :
-
---------------------------------------
-	// MOD : randomize trash
-	dst->header.trash = gen_trash();
---------------------------------------
-
-и 1 место в send.c в функции encrypt_packet
-
---------------------------------------
-	// MOD : randomize trash
-	header->header.trash = gen_trash();
---------------------------------------
-
-
-Вот и весь патчинг. Полный patch (версия wireguard 0.0.20190123) лежит в 010-wg-mod.patch.
-Патчинг кода - самое простое. Для десктопного linux дальше все просто.
-Пересобираем через make, устанавливаем через make install, перегружаем
-модуль wireguard, перезапускаем интерфейсы, и все готово.
-
-Настоящий геморой начнется когда вы это попытаетесь засунуть на роутер под openwrt.
-Одна из больших проблем linux - отсутствие совместимости драйверов на уровне бинариков.
-Поэтому собирать необходимо в точности под вашу версию ядра и в точности под его .config.
-Вам придется либо полностью самостоятельно собирать всю прошивку, либо найти SDK в точности
-от вашей версии прошивки для вашей архитектуры и собрать модуль с помощью этого SDK.
-Последний вариант более легкий.
-Для сборки вам понадобится система на linux x86_64. Ее можно установить в виртуалке.
-Теоретически можно пользоваться WSL из win10, но на практике там очень медленное I/O,
-по крайней мере на старых версиях win10. Безумно медленное. Будете собирать вечность.
-Может в новых win10 что-то и улучшили, но я бы сразу расчитывал на полноценный linux.
-
-Находим здесь вашу версию : https://downloads.openwrt.org/
-Скачиваем файл openwrt-sdk-*.tar.xz или lede-sdk-*.tar.xz
-Например : https://downloads.openwrt.org/releases/18.06.2/targets/ar71xx/generic/openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64.tar.xz
-Если ваша версия непонятна или стара, то проще будет найти последнюю прошивку и перешить роутер.
-Распаковываем SDK. Следующими командами можно собрать оригинальный вариант wireguard :
-
-# scripts/feeds update -a
-# scripts/feeds install -a
-# make defconfig
-# make -j 4 package/wireguard/compile
-
-Сборка будет довольно долгой. Ведь придется подтащить ядро, собрать его, собрать зависимости.
-"-j 4" означает использовать 4 потока. Впишите вместо 4 количество доступных cpu cores.
-
-Получим следующие файлы :
-
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/bin/targets/ar71xx/generic/packages/kmod-wireguard_4.9.152+0.0.20190123-1_mips_24kc.ipk
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/bin/packages/mips_24kc/base/wireguard-tools_0.0.20190123-1_mips_24kc.ipk
-
-Но это будет оригинальный wireguard. Нам нужен патченый.
-Установим quilt и mc для нормального редактора вместо vim :
-
-# sudo apt-get update
-# sudo apt-get install quilt mc
-
-# make package/wireguard/clean
-# make package/wireguard/prepare V=s QUILT=1
-
-
-Сорцы приготовлены для сборки в :
- openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/src
-
-# cd build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/src
-# quilt push -a
-# quilt new 010-wg-mod.patch
-# export EDITOR=mcedit
-
-Далее будет открываться редактор mcedit, в который нужно вносить изменения в каждый файл :
-
-# quilt edit messages.h
-# quilt edit cookie.c
-# quilt edit noise.c
-# quilt edit send.c
-# quilt diff
-# quilt refresh
-
-Получили файл патча в :
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/patches/010-wg-mod.patch
-
-Выходим в корень SDK.
-
-# make package/wireguard/compile V=99
-
-Если не было ошибок, то получили измененные ipk.
-Патч можно зафиксировать в описании пакета :
-
-# make package/wireguard/update
-
-Получим :
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/feeds/base/package/network/services/wireguard/patches/010-wg-mod.patch
-При последующей очистке и пересборке он будет автоматом применяться.
-
-
-АЛЬТЕРНАТИВА : можно не возиться с quilt.
-сделайте
-# make package/wireguard/clean
-# make package/wireguard/prepare
-и напрямую модифицируйте или копируйте файлы в 
- openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ar71xx_generic/WireGuard-0.0.20190123/src
-затем
-# make package/wireguard/compile
-
-Если нужно поменять версию wireguard, то идите в
-openwrt-sdk-18.06.2-ar71xx-generic_gcc-7.3.0_musl.Linux-x86_64/feeds/base/package/network/services/wireguard/Makefile
-поменяйте там версию в PKG_VERSION на последнюю из : https://git.zx2c4.com/WireGuard
-скачайте tar.xz с этой версией , вычислите его sha256sum, впишите в PKG_HASH
-
-1 раз где-нибудь пропатчите файлы последней версии wireguard в текстовом редакторе, скопируйте в build_dir,
-сделайте версию для openwrt. эти же файлы скопируйте на ваш сервер с десктопным linux, сделайте там make / make install
-
-Но имейте в виду, что build_dir - локация для временных файлов.
-make clean оттуда все снесет, включая ваши модификации. Модифицированные файлы лучше сохранить отдельно,
-чтобы потом было легко скопировать обратно.
-
-Полученные ipk копируем на роутер в /tmp, устанавливаем через
-# cd /tmp
-# rm -r /tmp/opkg-lists
-# opkg install *.ipk
-Если требует зависимостей, то
-# opkg update
-# opkg install .... <зависимости>
-# rm -r /tmp/opkg-lists
-# opkg install *.ipk
-
-В /tmp/opkg-lists opkg хранит кэш списка пакетов. Если попытаться установить файл ipk, и такой же пакет
-найдется в репозитории, opkg будет устанавливать из репозитория. А нам это не надо.
-
-# rmmod wireguard
-# kmodloader
-# dmesg | tail
-должны увидеть что-то вроде :
-[8985.415490] wireguard: WireGuard 0.0.20190123 loaded. See www.wireguard.com for information.
-[8985.424178] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
-значит модуль загрузился
-
-Могут понадобиться ключи opkg --force-reinstall, --force-depends.
---force-depends поможет при несоответствии hash версии ядра. То есть версия x.x.x та же самая, но hash конфигурации разный.
-При несоответствии x.x.x вы что-то делаете не так, работать это не будет.
-Например : 4.14.56-1-b1186491495127cc6ff81d29c00a91fc, 4.14.56-1-3f8a21a63974cfb7ee67e41f2d4b805d
-Это свидетельствует о несоответствии .config ядра при сборке прошивки и в SDK.
-Если несоответствие легкое, то может все прокатить, но при более серьезной разнице в .config модуль может не загрузиться
-или вызвать стабильные или хаотические падения ядра и перезагрузки (включая вариант беcконечной перезагрузки - bootloop).
-Так что перед --force-depends убедитесь, что знаете как лечится такая ситуация, и не стоит это делать при отсутствии физического
-доступа к девайсу.
-
-Когда поднимите линк, и вдруг ничего не будет работать, то посмотрите в wireshark udp пакеты
-на порт endpoint. Они не должны начинаться с 0,1,2,3,4. В первых 4 байтах должен быть рандом,
-в следующих 4 байтах - значения из измененного enum message_type. Если пакет все еще начинается с 0..4,
-значит модуль wireguard оригинальный, что-то не собралось, не скопировалось, не перезапустилось.
-В противном случае должен подняться линк, пинги ходить. Значит вы победили, поздравляю.
-Регулятору будет намного сложнее поймать ваш VPN.

docs/wireguard_iproute_openwrt.txt

@@ -236,7 +236,7 @@ config rule
 
 --- Подготовка zapret ---
 
-Выполните install_easy.sh. Он настроит режим обхода DPI. Если обход DPI не нужен - выберите MODE=filter.
+Выполните install_easy.sh. Он настроит режим обхода DPI. Если обход DPI не нужен - не включайте tpws и nfqws.
 Так же инсталятор заресолвит домены из ipset/zapret-hosts-user-ipban.txt и внесет крон-джоб для периодического обновления ip.
 
 Если вы используете в своих правилах ipset zapret, то он ресолвится и обновляется только, если выбран режим фильтрации обхода DPI по ipset.

init.d/sysv/custom.d.examples/10-keenetic-udp-fix

@@ -0,0 +1,22 @@
+# This script fixes keenetic issue with nfqws generated udp packets
+# Keenetic uses proprietary ndmmark and does not masquerade without this mark
+# If not masqueraded packets go to WAN with LAN IP and get dropped by ISP
+
+# It's advised to set IFACE_WAN in config
+
+zapret_custom_firewall()
+{
+	# $1 - 1 - add, 0 - stop
+
+	local wan wanif rule
+
+	[ "$DISABLE_IPV4" = "1" ] || {
+		# use IFACE_WAN if defined. if not - search for interfaces with default route.
+		wanif=${IFACE_WAN:-$(sed -nre 's/^([^\t]+)\t00000000\t[0-9A-F]{8}\t[0-9A-F]{4}\t[0-9]+\t[0-9]+\t[0-9]+\t00000000.*$/\1/p' /proc/net/route | sort -u | xargs)}
+		for wan in $wanif; do
+			rule="-o $wan -p udp -m mark --mark $DESYNC_MARK/$DESYNC_MARK"
+			ipt_print_op $1 "$rule" "keenetic udp fix"
+			ipt_add_del $1 POSTROUTING -t nat $rule -j MASQUERADE
+		done
+	}
+}

init.d/sysv/functions

@@ -102,7 +102,7 @@ dnat6_target()
 }
 set_route_localnet()
 {
-	_set_route_localnet $1 "$IFACE_LAN"
+	_set_route_localnet $1 $IFACE_LAN
 }
 
 fw_nfqws_post4()
@@ -167,15 +167,18 @@ run_daemon()
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
 
 	local DAEMONBASE="$(basename "$2")"
-	local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
+	local PID= PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
 	echo "Starting daemon $1: $2 $3"
-	if exists start-stop-daemon ; then
-		start-stop-daemon -S -p "$PIDFILE" -m -b -x "$2" -- $3
-	else
-		if [ -f "$PIDFILE" ] && pgrep -F "$PIDFILE" "$DAEMONBASE" >/dev/null; then
+
+	[ -f "$PIDFILE" ] && {
+		read PID <"$PIDFILE"
+		[ -d "/proc/$PID" ] || PID=
+	}
+
+	if [ -n "$PID" ]; then
 		echo already running
 	else
-			"$2" $3 >/dev/null 2>/dev/null &
+		"$2" $3 >/dev/null &
 		PID=$!
 		if [ -n "$PID" ]; then
 			echo $PID >$PIDFILE
@@ -184,7 +187,6 @@ run_daemon()
 			false
 		fi
 	fi
-	fi
 }
 stop_daemon()
 {
@@ -192,11 +194,8 @@ stop_daemon()
 	# $2 - daemon
 	# use $PIDDIR/$DAEMONBASE$1.pid as pidfile
 	local DAEMONBASE="$(basename "$2")"
-	local PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
+	local PID PIDFILE=$PIDDIR/$DAEMONBASE$1.pid
 	echo "Stopping daemon $1: $2"
-	if exists start-stop-daemon ; then
-		start-stop-daemon -K -p "$PIDFILE" -x "$2"
-	else
 	if [ -f "$PIDFILE" ]; then
 		read PID <"$PIDFILE"
 		kill $PID
@@ -204,7 +203,6 @@ stop_daemon()
 	else
 		echo no pidfile : $PIDFILE
 	fi
-	fi
 }
 do_daemon()
 {

install_bin.sh

@@ -25,7 +25,11 @@ check_dir()
 				# find does not use its own shell exec
 				# it uses execvp(). in musl libc it does not call shell, in glibc it DOES call /bin/sh
 				# that's why prefer bash or zsh if present. otherwise it's our last chance
-				out=$(echo 0.0.0.0 | find "$dir" -maxdepth 1 -name ip2net -exec {} \; 2>/dev/null)
+				local FIND=find
+				if ! exists find && exists busybox; then
+					FIND="busybox find"
+				fi
+				out=$(echo 0.0.0.0 | $FIND "$dir" -maxdepth 1 -name ip2net -exec {} \; 2>/dev/null)
 			fi
 			[ -n "$out" ]
 		else
@@ -64,7 +68,7 @@ case $UNAME in
 		;;
 	CYGWIN*)
 		UNAME=CYGWIN
-		ARCHLIST="win64"
+		ARCHLIST="win64 win32"
 		PKTWS=winws
 		;;
 	*)

install_easy.sh

@@ -26,6 +26,7 @@ IPSET_DIR="$ZAPRET_BASE/ipset"
 . "$ZAPRET_BASE/common/ipt.sh"
 . "$ZAPRET_BASE/common/installer.sh"
 . "$ZAPRET_BASE/common/virt.sh"
+. "$ZAPRET_BASE/common/list.sh"
 
 GET_LIST="$IPSET_DIR/get_config.sh"
 
@@ -115,6 +116,30 @@ ws_opt_validate()
 	}
 	return 0
 }
+tpws_opt_validate()
+{
+	ws_opt_validate "$1" || return 1
+	dry_run_tpws || {
+		echo invalid tpws options
+		return 1
+	}
+}
+tpws_socks_opt_validate()
+{
+	# --ipset allowed here
+	dry_run_tpws_socks || {
+		echo invalid tpws options
+		return 1
+	}
+}
+nfqws_opt_validate()
+{
+	ws_opt_validate "$1" || return 1
+	dry_run_nfqws || {
+		echo invalid nfqws options
+		return 1
+	}
+}
 
 select_mode_group()
 {
@@ -162,18 +187,17 @@ select_mode_group()
 select_mode_tpws_socks()
 {
 	local EDITVAR_NEWLINE_DELIMETER="--new" EDITVAR_NEWLINE_VARS="TPWS_SOCKS_OPT"
-	# --ipset allowed here
-	select_mode_group TPWS_SOCKS_ENABLE "enable tpws socks mode on port $TPPORT_SOCKS ?" "TPPORT_SOCKS TPWS_SOCKS_OPT"
+	select_mode_group TPWS_SOCKS_ENABLE "enable tpws socks mode on port $TPPORT_SOCKS ?" "TPPORT_SOCKS TPWS_SOCKS_OPT" tpws_socks_opt_validate TPWS_SOCKS_OPT
 }
 select_mode_tpws()
 {
 	local EDITVAR_NEWLINE_DELIMETER="--new" EDITVAR_NEWLINE_VARS="TPWS_OPT"
-	select_mode_group TPWS_ENABLE "enable tpws transparent mode ?" "TPWS_PORTS TPWS_OPT" ws_opt_validate TPWS_OPT
+	select_mode_group TPWS_ENABLE "enable tpws transparent mode ?" "TPWS_PORTS TPWS_OPT" tpws_opt_validate TPWS_OPT
 }
 select_mode_nfqws()
 {
 	local EDITVAR_NEWLINE_DELIMETER="--new" EDITVAR_NEWLINE_VARS="NFQWS_OPT"
-	select_mode_group NFQWS_ENABLE "enable nfqws ?" "NFQWS_PORTS_TCP NFQWS_PORTS_UDP NFQWS_TCP_PKT_OUT NFQWS_TCP_PKT_IN NFQWS_UDP_PKT_OUT NFQWS_UDP_PKT_IN NFQWS_PORTS_TCP_KEEPALIVE NFQWS_PORTS_UDP_KEEPALIVE NFQWS_OPT" ws_opt_validate NFQWS_OPT
+	select_mode_group NFQWS_ENABLE "enable nfqws ?" "NFQWS_PORTS_TCP NFQWS_PORTS_UDP NFQWS_TCP_PKT_OUT NFQWS_TCP_PKT_IN NFQWS_UDP_PKT_OUT NFQWS_UDP_PKT_IN NFQWS_PORTS_TCP_KEEPALIVE NFQWS_PORTS_UDP_KEEPALIVE NFQWS_OPT" nfqws_opt_validate NFQWS_OPT
 }
 
 select_mode_mode()
@@ -549,7 +573,7 @@ service_install_systemd()
 
 	if [ -w "$SYSTEMD_SYSTEM_DIR" ] ; then
 		rm -f "$INIT_SCRIPT"
-		ln -fs "$EXEDIR/init.d/systemd/zapret.service" "$SYSTEMD_SYSTEM_DIR"
+		cp -f "$EXEDIR/init.d/systemd/zapret.service" "$SYSTEMD_SYSTEM_DIR"
 		"$SYSTEMCTL" daemon-reload
 		"$SYSTEMCTL" enable zapret || {
 			echo could not enable systemd service
@@ -567,8 +591,8 @@ timer_install_systemd()
 	if [ -w "$SYSTEMD_SYSTEM_DIR" ] ; then
 		"$SYSTEMCTL" disable zapret-list-update.timer
 		"$SYSTEMCTL" stop zapret-list-update.timer
-		ln -fs "$EXEDIR/init.d/systemd/zapret-list-update.service" "$SYSTEMD_SYSTEM_DIR"
-		ln -fs "$EXEDIR/init.d/systemd/zapret-list-update.timer" "$SYSTEMD_SYSTEM_DIR"
+		cp -f "$EXEDIR/init.d/systemd/zapret-list-update.service" "$SYSTEMD_SYSTEM_DIR"
+		cp -f "$EXEDIR/init.d/systemd/zapret-list-update.timer" "$SYSTEMD_SYSTEM_DIR"
 		"$SYSTEMCTL" daemon-reload
 		"$SYSTEMCTL" enable zapret-list-update.timer || {
 			echo could not enable zapret-list-update.timer

ip2net/Makefile

@@ -1,5 +1,5 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os -flto=auto
 CFLAGS_BSD = -Wno-address-of-packed-member
 CFLAGS_WIN = -static
 LIBS = 
@@ -9,7 +9,9 @@ SRC_FILES = ip2net.c qsort.c
 all: ip2net
 
 ip2net: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+android: ip2net
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)

ip2net/ip2net.c

@@ -192,7 +192,7 @@ static void ip6_and(const struct in6_addr * restrict a, const struct in6_addr *
 static void rtrim(char *s)
 {
 	if (s)
-		for (char *p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r'); p--) *p = '\0';
+		for (char *p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'); p--) *p = '\0';
 }
 
 
@@ -217,6 +217,14 @@ static void exithelp(void)
 	exit(1);
 }
 
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 static void parse_params(int argc, char *argv[])
 {
 	int option_index = 0;
@@ -245,6 +253,7 @@ static void parse_params(int argc, char *argv[])
 		{
 		case 0:
 		case 1:
+			PRINT_VER;
 			exithelp();
 			break;
 		case 2:

ipset/get_antifilter_domains.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+IPSET_DIR="$(dirname "$0")"
+IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
+
+. "$IPSET_DIR/def.sh"
+
+TMPLIST="$TMPDIR/list.txt"
+
+URL="https://antifilter.download/list/domains.lst"
+
+dl()
+{
+  # $1 - url
+  # $2 - file
+  # $3 - minsize
+  # $4 - maxsize
+  curl -L -H "Accept-Encoding: gzip" -k --fail --max-time 60 --connect-timeout 10 --retry 4 --max-filesize 251658240 -o "$TMPLIST" "$1" ||
+  {
+   echo list download failed : $1
+   exit 2
+  }
+  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  if test $dlsize -lt $3; then
+   echo list is too small : $dlsize bytes. can be bad.
+   exit 2
+  fi
+  zzcat "$TMPLIST" | tr -d '\015' | zz "$2"
+  rm -f "$TMPLIST"
+}
+
+# useful in case ipban set is used in custom scripts
+FAIL=
+getipban || FAIL=1
+"$IPSET_DIR/create_ipset.sh"
+[ -n "$FAIL" ] && exit
+
+dl "$URL" "$ZHOSTLIST" 32768 4194304
+
+exit 0

mdig/Makefile

@@ -1,15 +1,19 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os
 CFLAGS_BSD = -Wno-address-of-packed-member
 CFLAGS_WIN = -static
 LIBS = -lpthread
+LIBS_ANDROID =
 LIBS_WIN = -lws2_32
 SRC_FILES = *.c
 
 all: mdig
 
 mdig: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+android: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_ANDROID)
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)

mdig/mdig.c

@@ -12,7 +12,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <stdbool.h>
-#include <unistd.h>
 #include <pthread.h>
 #include <getopt.h>
 #ifdef _WIN32
@@ -21,7 +20,9 @@
 #include <winsock2.h>
 #include <ws2ipdef.h>
 #include <ws2tcpip.h>
+#include <fcntl.h>
 #else
+#include <unistd.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
 #include <netinet/in.h>
@@ -34,7 +35,7 @@
 static void trimstr(char *s)
 {
 	char *p;
-	for (p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r'); p--) *p = '\0';
+	for (p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'); p--) *p = '\0';
 }
 
 static const char* eai_str(int r)
@@ -364,6 +365,9 @@ int dns_make_query(const char *dom, char family)
 		fprintf(stderr, "could not make DNS query\n");
 		return 1;
 	}
+#ifdef _WIN32
+	_setmode(_fileno(stdout), _O_BINARY);
+#endif
 	if (fwrite(q,l,1,stdout)!=1)
 	{
 		fprintf(stderr, "could not write DNS query blob to stdout\n");
@@ -420,8 +424,11 @@ bool dns_parse_print(const uint8_t *a, size_t len)
 }
 int dns_parse_query()
 {
-	uint8_t a[1500];
+	uint8_t a[8192];
 	size_t l;
+#ifdef _WIN32
+	_setmode(_fileno(stdin), _O_BINARY);
+#endif
 	l = fread(a,1,sizeof(a),stdin);
 	if (!l || !feof(stdin))
 	{
@@ -451,6 +458,15 @@ static void exithelp(void)
 	);
 	exit(1);
 }
+
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 int main(int argc, char **argv)
 {
 	int r, v, option_index = 0;
@@ -480,6 +496,7 @@ int main(int argc, char **argv)
 		switch (option_index)
 		{
 		case 0: /* help */
+			PRINT_VER;
 			exithelp();
 			break;
 		case 1: /* threads */

nfq/BSDmakefile

@@ -1,12 +1,12 @@
 CC ?= cc
-CFLAGS += -std=gnu99 -s -O3 -Wno-address-of-packed-member
+CFLAGS += -std=gnu99 -s -Os -Wno-address-of-packed-member -flto=auto
 LIBS = -lz
 SRC_FILES = *.c crypto/*.c
 
 all: dvtws
 
 dvtws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS)
 
 clean:
 	rm -f dvtws

nfq/Makefile

@@ -1,11 +1,10 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os -flto=auto
 CFLAGS_BSD = -Wno-address-of-packed-member
-CFLAGS_MAC = -mmacosx-version-min=10.8
 CFLAGS_CYGWIN = -Wno-address-of-packed-member -static
 LIBS_LINUX = -lnetfilter_queue -lnfnetlink -lz
 LIBS_BSD = -lz
-LIBS_CYGWIN = -lz -Lwindows/windivert -Iwindows -lwlanapi -lole32 -loleaut32 -luuid
+LIBS_CYGWIN = -lz -Lwindows/windivert -Iwindows -lwlanapi -lole32 -loleaut32
 LIBS_CYGWIN32 = -lwindivert32
 LIBS_CYGWIN64 = -lwindivert64
 RES_CYGWIN32 = windows/res/32/winmanifest.o windows/res/32/winicon.o
@@ -15,7 +14,9 @@ SRC_FILES = *.c crypto/*.c
 all: nfqws
 
 nfqws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+
+android: nfqws
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS_BSD)

nfq/conntrack.c

@@ -12,29 +12,6 @@ static void ut_oom_recover(void *elem)
 	oom = true;
 }
 
-const char *l7proto_str(t_l7proto l7)
-{
-	switch(l7)
-	{
-		case HTTP: return "http";
-		case TLS: return "tls";
-		case QUIC: return "quic";
-		case WIREGUARD: return "wireguard";
-		case DHT: return "dht";
-		default: return "unknown";
-	}
-}
-bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
-{
-	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
-		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
-		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
-		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
-		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
-		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
-}
-
-
 static const char *connstate_s[]={"SYN","ESTABLISHED","FIN"};
 
 static void connswap(const t_conn *c, t_conn *c2)

nfq/conntrack.h

@@ -4,8 +4,6 @@
 // this conntrack is not bullet-proof
 // its designed to satisfy dpi desync needs only
 
-#include "packet_queue.h"
-
 #include <stdbool.h>
 #include <stdint.h>
 #include <ctype.h>
@@ -19,6 +17,8 @@
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 
+#include "packet_queue.h"
+#include "protocol.h"
 
 //#define HASH_BLOOM 20
 #define HASH_NONFATAL_OOM 1
@@ -53,16 +53,6 @@ typedef struct {
 // FIN - FIN or RST received
 typedef enum {SYN=0, ESTABLISHED, FIN} t_connstate;
 
-typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
-#define L7_PROTO_HTTP		0x00000001
-#define L7_PROTO_TLS		0x00000002
-#define L7_PROTO_QUIC		0x00000004
-#define L7_PROTO_WIREGUARD	0x00000008
-#define L7_PROTO_DHT		0x00000010
-#define L7_PROTO_UNKNOWN	0x80000000
-const char *l7proto_str(t_l7proto l7);
-bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
-
 typedef struct
 {
 	bool bCheckDone, bCheckResult, bCheckExcluded; // hostlist check result cache

nfq/darkmagic.c

@@ -163,7 +163,7 @@ static void fill_udphdr(struct udphdr *udp, uint16_t nsport, uint16_t ndport, ui
 	udp->uh_sum = 0;
 }
 
-static void fill_iphdr(struct ip *ip, const struct in_addr *src, const struct in_addr *dst, uint16_t pktlen, uint8_t proto, uint8_t ttl, uint8_t tos)
+static void fill_iphdr(struct ip *ip, const struct in_addr *src, const struct in_addr *dst, uint16_t pktlen, uint8_t proto, uint8_t ttl, uint8_t tos, uint16_t ip_id)
 {
 	ip->ip_tos = tos;
 	ip->ip_sum = 0;
@@ -171,7 +171,7 @@ static void fill_iphdr(struct ip *ip, const struct in_addr *src, const struct in
 	ip->ip_v = 4;
 	ip->ip_hl = 5;
 	ip->ip_len = htons(pktlen);
-	ip->ip_id = 0;
+	ip->ip_id = ip_id;
 	ip->ip_ttl = ttl;
 	ip->ip_p = proto;
 	ip->ip_src = *src;
@@ -196,6 +196,7 @@ bool prepare_tcp_segment4(
 	uint32_t *timestamps,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -211,7 +212,7 @@ bool prepare_tcp_segment4(
 	struct tcphdr *tcp = (struct tcphdr*)(ip+1);
 	uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen;
 
-	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, ttl, tos);
+	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, ttl, tos, ip_id);
 	fill_tcphdr(tcp,fooling,tcp_flags,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len);
 
 	memcpy(payload,data,len);
@@ -314,7 +315,9 @@ bool prepare_tcp_segment(
 	uint8_t scale_factor,
 	uint32_t *timestamps,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -322,7 +325,7 @@ bool prepare_tcp_segment(
 	uint8_t *buf, size_t *buflen)
 {
 	return (src->sa_family==AF_INET && dst->sa_family==AF_INET) ?
-		prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,tos,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :
+		prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,tos,ip_id,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :
 		(src->sa_family==AF_INET6 && dst->sa_family==AF_INET6) ?
 		prepare_tcp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,tcp_flags,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,flow_label,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :
 		false;
@@ -334,6 +337,7 @@ bool prepare_udp_segment4(
 	const struct sockaddr_in *src, const struct sockaddr_in *dst,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -357,7 +361,7 @@ bool prepare_udp_segment4(
 	uint8_t *payload = (uint8_t*)(udp+1);
 
 
-	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_UDP, ttl, tos);
+	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_UDP, ttl, tos, ip_id);
 	fill_udphdr(udp, src->sin_port, dst->sin_port, datalen);
 
 	memcpy(payload,data,len);
@@ -463,7 +467,9 @@ bool prepare_udp_segment6(
 bool prepare_udp_segment(
 	const struct sockaddr *src, const struct sockaddr *dst,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -471,7 +477,7 @@ bool prepare_udp_segment(
 	uint8_t *buf, size_t *buflen)
 {
 	return (src->sa_family==AF_INET && dst->sa_family==AF_INET) ?
-		prepare_udp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,ttl,tos,fooling,padding,padding_size,padlen,data,len,buf,buflen) :
+		prepare_udp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,ttl,tos,ip_id,fooling,padding,padding_size,padlen,data,len,buf,buflen) :
 		(src->sa_family==AF_INET6 && dst->sa_family==AF_INET6) ?
 		prepare_udp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,ttl,flow_label,fooling,padding,padding_size,padlen,data,len,buf,buflen) :
 		false;
@@ -869,60 +875,49 @@ void proto_skip_ipv6(uint8_t **data, size_t *len, uint8_t *proto_type, uint8_t *
 	// we have garbage
 }
 
-void proto_dissect_l3l4(
-	uint8_t *data, size_t len,
-	struct ip **ip, struct ip6_hdr **ip6,
-	uint8_t *proto,
-	struct tcphdr **tcp,
-	struct udphdr **udp,
-	size_t *transport_len,
-	uint8_t **data_payload, size_t *len_payload)
+void proto_dissect_l3l4(uint8_t *data, size_t len,struct dissect *dis)
 {
-	*ip = NULL;
-	*ip6 = NULL;
-	*proto = 0;
-	*tcp = NULL;
-	*transport_len = 0;
-	*udp = NULL;
-	*data_payload = NULL;
-	*len_payload = 0;
+	memset(dis,0,sizeof(*dis));
+
+	dis->data_pkt = data;
+	dis->len_pkt = len;
 
 	if (proto_check_ipv4(data, len))
 	{
-		*ip = (struct ip *) data;
-		*proto = (*ip)->ip_p;
+		dis->ip = (struct ip *) data;
+		dis->proto = dis->ip->ip_p;
 		proto_skip_ipv4(&data, &len);
 	}
 	else if (proto_check_ipv6(data, len))
 	{
-		*ip6 = (struct ip6_hdr *) data;
-		proto_skip_ipv6(&data, &len, proto, NULL);
+		dis->ip6 = (struct ip6_hdr *) data;
+		proto_skip_ipv6(&data, &len, &dis->proto, NULL);
 	}
 	else
 	{
 		return;
 	}
 
-	if (*proto==IPPROTO_TCP && proto_check_tcp(data, len))
+	if (dis->proto==IPPROTO_TCP && proto_check_tcp(data, len))
 	{
-		*tcp = (struct tcphdr *) data;
-		*transport_len = len;
+		dis->tcp = (struct tcphdr *) data;
+		dis->transport_len = len;
 
 		proto_skip_tcp(&data, &len);
 
-		*data_payload = data;
-		*len_payload = len;
+		dis->data_payload = data;
+		dis->len_payload = len;
 
 	}
-	else if (*proto==IPPROTO_UDP && proto_check_udp(data, len))
+	else if (dis->proto==IPPROTO_UDP && proto_check_udp(data, len))
 	{
-		*udp = (struct udphdr *) data;
-		*transport_len = len;
+		dis->udp = (struct udphdr *) data;
+		dis->transport_len = len;
 
 		proto_skip_udp(&data, &len);
 
-		*data_payload = data;
-		*len_payload = len;
+		dis->data_payload = data;
+		dis->len_payload = len;
 	}
 }
 
@@ -1882,3 +1877,34 @@ void verdict_udp_csum_fix(uint8_t verdict, struct udphdr *udphdr, size_t transpo
 			udp_fix_checksum(udphdr,transport_len,ip,ip6hdr);
 	}
 }
+
+void dbgprint_socket_buffers(int fd)
+{
+	if (params.debug)
+	{
+		int v;
+		socklen_t sz;
+		sz = sizeof(int);
+		if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz))
+			DLOG("fd=%d SO_RCVBUF=%d\n", fd, v);
+			sz = sizeof(int);
+		if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz))
+			DLOG("fd=%d SO_SNDBUF=%d\n", fd, v);
+	}
+}
+bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
+{
+	DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf);
+	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0)
+	{
+		DLOG_PERROR("setsockopt (SO_RCVBUF)");
+		return false;
+	}
+	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0)
+	{
+		DLOG_PERROR("setsockopt (SO_SNDBUF)");
+		return false;
+	}
+	dbgprint_socket_buffers(fd);
+	return true;
+}

nfq/darkmagic.h

@@ -22,6 +22,7 @@
 #endif
 
 #ifdef __CYGWIN__
+#define INITGUID
 #include "windivert/windivert.h"
 #endif
 
@@ -60,6 +61,7 @@ uint32_t net16_add(uint16_t netorder_value, uint16_t cpuorder_increment);
 #define VERDICT_NOCSUM	4
 
 #define IP4_TOS(ip_header) (ip_header ? ip_header->ip_tos : 0)
+#define IP4_IP_ID(ip_header) (ip_header ? ip_header->ip_id : 0)
 #define IP6_FLOW(ip6_header) (ip6_header ? ip6_header->ip6_ctlun.ip6_un1.ip6_un1_flow : 0)
 
 // seq and wsize have network byte order
@@ -72,6 +74,7 @@ bool prepare_tcp_segment4(
 	uint32_t *timestamps,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -99,7 +102,9 @@ bool prepare_tcp_segment(
 	uint8_t scale_factor,
 	uint32_t *timestamps,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	uint32_t badseq_increment,
 	uint32_t badseq_ack_increment,
@@ -111,6 +116,7 @@ bool prepare_udp_segment4(
 	const struct sockaddr_in *src, const struct sockaddr_in *dst,
 	uint8_t ttl,
 	uint8_t tos,
+	uint16_t ip_id,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -128,7 +134,9 @@ bool prepare_udp_segment6(
 bool prepare_udp_segment(
 	const struct sockaddr *src, const struct sockaddr *dst,
 	uint8_t ttl,
-	uint8_t tos, uint32_t flow_label,
+	uint8_t tos,
+	uint16_t ip_id,
+	uint32_t flow_label,
 	uint32_t fooling,
 	const uint8_t *padding, size_t padding_size,
 	int padlen,
@@ -210,14 +218,20 @@ bool proto_check_tcp(const uint8_t *data, size_t len);
 void proto_skip_tcp(uint8_t **data, size_t *len);
 bool proto_check_udp(const uint8_t *data, size_t len);
 void proto_skip_udp(uint8_t **data, size_t *len);
-void proto_dissect_l3l4(
-	uint8_t *data, size_t len,
-	struct ip **ip, struct ip6_hdr **ip6,
-	uint8_t *proto,
-	struct tcphdr **tcp,
-	struct udphdr **udp,
-	size_t *transport_len,
-	uint8_t **data_payload, size_t *len_payload);
+struct dissect
+{
+	uint8_t *data_pkt;
+	size_t len_pkt;
+	struct ip *ip;
+	struct ip6_hdr *ip6;
+	uint8_t proto;
+	struct tcphdr *tcp;
+	struct udphdr *udp;
+	size_t transport_len;
+	uint8_t *data_payload;
+	size_t len_payload;
+};
+void proto_dissect_l3l4(uint8_t *data, size_t len,struct dissect *dis);
 
 bool tcp_synack_segment(const struct tcphdr *tcphdr);
 bool tcp_syn_segment(const struct tcphdr *tcphdr);
@@ -241,3 +255,6 @@ void do_nat(bool bOutbound, struct ip *ip, struct ip6_hdr *ip6, struct tcphdr *t
 
 void verdict_tcp_csum_fix(uint8_t verdict, struct tcphdr *tcphdr, size_t transport_len, struct ip *ip, struct ip6_hdr *ip6hdr);
 void verdict_udp_csum_fix(uint8_t verdict, struct udphdr *udphdr, size_t transport_len, struct ip *ip, struct ip6_hdr *ip6hdr);
+
+void dbgprint_socket_buffers(int fd);
+bool set_socket_buffers(int fd, int rcvbuf, int sndbuf);

nfq/desync.h

@@ -28,10 +28,10 @@ enum dpi_desync_mode {
 	DESYNC_RSTACK,
 	DESYNC_SYNACK,
 	DESYNC_SYNDATA,
-	DESYNC_DISORDER,
-	DESYNC_DISORDER2,
-	DESYNC_SPLIT,
-	DESYNC_SPLIT2,
+	DESYNC_FAKEDSPLIT,
+	DESYNC_FAKEDDISORDER,
+	DESYNC_MULTISPLIT,
+	DESYNC_MULTIDISORDER,
 	DESYNC_IPFRAG2,
 	DESYNC_HOPBYHOP,
 	DESYNC_DESTOPT,

nfq/helpers.c

@@ -5,11 +5,31 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <stdlib.h>
 #include <ctype.h>
 #include <sys/stat.h>
 #include <libgen.h>
 
-#include "params.h"
+int unique_size_t(size_t *pu, int ct)
+{
+	int i, j, u;
+	for (i = j = 0; j < ct; i++)
+	{
+		u = pu[j++];
+		for (; j < ct && pu[j] == u; j++);
+		pu[i] = u;
+	}
+	return i;
+}
+static int cmp_size_t(const void * a, const void * b)
+{
+	return *(size_t*)a < *(size_t*)b ? -1 : *(size_t*)a > *(size_t*)b;
+}
+void qsort_size_t(size_t *array,size_t ct)
+{
+	qsort(array,ct,sizeof(*array),cmp_size_t);
+}
+
 
 void rtrim(char *s)
 {
@@ -43,22 +63,6 @@ char *strncasestr(const char *s, const char *find, size_t slen)
 	return (char *)s;
 }
 
-void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
-{
-	size_t k;
-	bool bcut = false;
-	if (size > limit)
-	{
-		size = limit;
-		bcut = true;
-	}
-	if (!size) return;
-	for (k = 0; k < size; k++) DLOG("%02X ", data[k]);
-	DLOG(bcut ? "... : " : ": ");
-	for (k = 0; k < size; k++) DLOG("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
-	if (bcut) DLOG(" ...");
-}
-
 
 bool load_file(const char *filename, void *buffer, size_t *buffer_size)
 {
@@ -199,38 +203,6 @@ uint16_t saport(const struct sockaddr *sa)
 		     sa->sa_family==AF_INET6 ? ((struct sockaddr_in6*)sa)->sin6_port : 0);
 }
 
-void dbgprint_socket_buffers(int fd)
-{
-	if (params.debug)
-	{
-		int v;
-		socklen_t sz;
-		sz = sizeof(int);
-		if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz))
-			DLOG("fd=%d SO_RCVBUF=%d\n", fd, v);
-			sz = sizeof(int);
-		if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz))
-			DLOG("fd=%d SO_SNDBUF=%d\n", fd, v);
-	}
-}
-bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
-{
-	DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf);
-	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0)
-	{
-		DLOG_PERROR("setsockopt (SO_RCVBUF)");
-		close(fd);
-		return false;
-	}
-	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0)
-	{
-		DLOG_PERROR("setsockopt (SO_SNDBUF)");
-		close(fd);
-		return false;
-	}
-	dbgprint_socket_buffers(fd);
-	return true;
-}
 
 uint64_t pntoh64(const void *p)
 {
@@ -395,14 +367,14 @@ void fill_random_az09(uint8_t *p,size_t sz)
 	}
 }
 
-bool cd_to_exe_dir(const char *argv0)
+bool set_env_exedir(const char *argv0)
 {
 	char *s,*d;
 	bool bOK=false;
 	if ((s = strdup(argv0)))
 	{
 		if ((d = dirname(s)))
-			bOK = !chdir(d);
+			setenv("EXEDIR",s,1);
 		free(s);
 	}
 	return bOK;

nfq/helpers.h

@@ -17,11 +17,13 @@ typedef union
 	char _align[32];		// force 16-byte alignment for ip6_and int128 ops
 } sockaddr_in46;
 
+int unique_size_t(size_t *pu, int ct);
+void qsort_size_t(size_t *array,size_t ct);
+
 void rtrim(char *s);
 void replace_char(char *s, char from, char to);
 char *strncasestr(const char *s,const char *find, size_t slen);
 
-void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);
 bool load_file(const char *filename,void *buffer,size_t *buffer_size);
 bool load_file_nonempty(const char *filename,void *buffer,size_t *buffer_size);
 bool save_file(const char *filename, const void *buffer, size_t buffer_size);
@@ -37,9 +39,6 @@ uint16_t saport(const struct sockaddr *sa);
 
 bool seq_within(uint32_t s, uint32_t s1, uint32_t s2);
 
-void dbgprint_socket_buffers(int fd);
-bool set_socket_buffers(int fd, int rcvbuf, int sndbuf);
-
 uint64_t pntoh64(const void *p);
 void phton64(uint8_t *p, uint64_t v);
 
@@ -76,7 +75,7 @@ void fill_random_bytes(uint8_t *p,size_t sz);
 void fill_random_az(uint8_t *p,size_t sz);
 void fill_random_az09(uint8_t *p,size_t sz);
 
-bool cd_to_exe_dir(const char *argv0);
+bool set_env_exedir(const char *argv0);
 
 
 struct cidr4

nfq/hostlist.c

@@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 			*hostlist = NULL;
 			return false;
 		}
-		(*ct)++;
+		if (ct) (*ct)++;
 	}
 	// advance to the next line
 	for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@@ -32,6 +32,11 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	return true;
 }
 
+bool AppendHostlistItem(strpool **hostlist, char *s)
+{
+	return addpool(hostlist,&s,s+strlen(s),NULL);
+}
+
 bool AppendHostList(strpool **hostlist, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -97,6 +102,8 @@ bool AppendHostList(strpool **hostlist, const char *filename)
 }
 
 static bool LoadHostList(struct hostlist_file *hfile)
+{
+	if (hfile->filename)
 	{
 		time_t t = file_mod_time(hfile->filename);
 		if (!t)
@@ -113,6 +120,7 @@ static bool LoadHostList(struct hostlist_file *hfile)
 			return false;
 		}
 		hfile->mod_time=t;
+	}
 	return true;
 }
 static bool LoadHostLists(struct hostlist_files_head *list)
@@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 
 	LIST_FOREACH(item, hostlists_exclude, next)
 	{
-		DLOG("[%s] exclude ", item->hfile->filename);
+		DLOG("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchHostList(item->hfile->hostlist, host))
 		{
 			if (excluded) *excluded = true;
@@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 	{
 		LIST_FOREACH(item, hostlists, next)
 		{
-			DLOG("[%s] include ", item->hfile->filename);
+			DLOG("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchHostList(item->hfile->hostlist, host))
 				return true;
 		}
@@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
 static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
 {
 	struct hostlist_file *hfile;
+
+	if (filename)
+	{
 		if (!(hfile=hostlist_files_search(hostlists, filename)))
 			if (!(hfile=hostlist_files_add(hostlists, filename)))
 				return NULL;
 		if (!hostlist_collection_search(hl_collection, filename))
 			if (!hostlist_collection_add(hl_collection, hfile))
 				return NULL;
+	}
+	else
+	{
+		if (!(hfile=hostlist_files_add(hostlists, NULL)))
+			return NULL;
+		if (!hostlist_collection_add(hl_collection, hfile))
+			return NULL;
+	}
+
 	return hfile;
 }
 struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access hostlist file '%s'\n",filename);
 		return NULL;
@@ -265,15 +285,30 @@ void HostlistsDebug()
 	struct hostlist_item *hl_item;
 
 	LIST_FOREACH(hfile, &params.hostlists, next)
+	{
+		if (hfile->filename)
 			DLOG("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
+		else
+			DLOG("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
 			if (hl_item->hfile!=dpl->dp.hostlist_auto)
+			{
+				if (hl_item->hfile->filename)
 					DLOG("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+				else
+					DLOG("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
+			}
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
+		{
+			if (hl_item->hfile->filename)
 				DLOG("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+			else
+				DLOG("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
+		}
 		if (dpl->dp.hostlist_auto)
 			DLOG("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
 	}

nfq/hostlist.h

@@ -4,6 +4,7 @@
 #include "pools.h"
 #include "params.h"
 
+bool AppendHostlistItem(strpool **hostlist, char *s);
 bool AppendHostList(strpool **hostlist, const char *filename);
 bool LoadAllHostLists();
 bool NonEmptyHostlist(strpool **hostlist);

nfq/ipset.c

@@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else if (parse_cidr6(cidr,&c6))
 		{
@@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else
 			DLOG_ERR("bad ip or subnet : %s\n",cidr);
@@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 
 }
 
+bool AppendIpsetItem(ipset *ips, char *ip)
+{
+	return addpool(ips,&ip,ip+strlen(ip),NULL);
+}
+
 static bool AppendIpset(ipset *ips, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -118,6 +123,8 @@ static bool AppendIpset(ipset *ips, const char *filename)
 }
 
 static bool LoadIpset(struct ipset_file *hfile)
+{
+	if (hfile->filename)
 	{
 		time_t t = file_mod_time(hfile->filename);
 		if (!t)
@@ -134,6 +141,7 @@ static bool LoadIpset(struct ipset_file *hfile)
 			return false;
 		}
 		hfile->mod_time=t;
+	}
 	return true;
 }
 static bool LoadIpsets(struct ipset_files_head *list)
@@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 
 	LIST_FOREACH(item, ips_exclude, next)
 	{
-		DLOG("[%s] exclude ",item->hfile->filename);
+		DLOG("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 			return false;
 	}
@@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 	{
 		LIST_FOREACH(item, ips, next)
 		{
-			DLOG("[%s] include ",item->hfile->filename);
+			DLOG("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 				return true;
 		}
@@ -234,17 +242,27 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
 static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename)
 {
 	struct ipset_file *hfile;
+	if (filename)
+	{
 		if (!(hfile=ipset_files_search(ipsets, filename)))
 			if (!(hfile=ipset_files_add(ipsets, filename)))
 				return NULL;
 		if (!ipset_collection_search(ips_collection, filename))
 			if (!ipset_collection_add(ips_collection, hfile))
 				return NULL;
+	}
+	else
+	{
+		if (!(hfile=ipset_files_add(ipsets, NULL)))
+			return NULL;
+		if (!ipset_collection_add(ips_collection, hfile))
+			return NULL;
+	}
 	return hfile;
 }
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access ipset file '%s'\n",filename);
 		return NULL;
@@ -277,13 +295,24 @@ void IpsetsDebug()
 	struct ipset_item *ips_item;
 
 	LIST_FOREACH(hfile, &params.ipsets, next)
+	{
+		if (hfile->filename)
 			DLOG("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
+		else
+			DLOG("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
+			if (ips_item->hfile->filename)
 				DLOG("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				DLOG("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
+			if (ips_item->hfile->filename)
 				DLOG("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				DLOG("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 	}
 }

nfq/ipset.h

@@ -9,3 +9,4 @@ bool LoadAllIpsets();
 bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
 void IpsetsDebug();
+bool AppendIpsetItem(ipset *ips, char *ip);

nfq/params.c

@@ -154,47 +154,65 @@ int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
 		return 0;
 }
 
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
+{
+	size_t k;
+	bool bcut = false;
+	if (size > limit)
+	{
+		size = limit;
+		bcut = true;
+	}
+	if (!size) return;
+	for (k = 0; k < size; k++) DLOG("%02X ", data[k]);
+	DLOG(bcut ? "... : " : ": ");
+	for (k = 0; k < size; k++) DLOG("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
+	if (bcut) DLOG(" ...");
+}
 
+void dp_init(struct desync_profile *dp)
+{
+	LIST_INIT(&dp->hl_collection);
+	LIST_INIT(&dp->hl_collection_exclude);
+	LIST_INIT(&dp->ips_collection);
+	LIST_INIT(&dp->ips_collection_exclude);
+	LIST_INIT(&dp->pf_tcp);
+	LIST_INIT(&dp->pf_udp);
+
+	memcpy(dp->hostspell, "host", 4); // default hostspell
+	dp->desync_skip_nosni = true;
+	dp->desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
+	dp->desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
+	dp->desync_repeats = 1;
+	dp->fake_tls_size = sizeof(fake_tls_clienthello_default);
+	memcpy(dp->fake_tls,fake_tls_clienthello_default,dp->fake_tls_size);
+	randomize_default_tls_payload(dp->fake_tls);
+	dp->fake_http_size = strlen(fake_http_request_default);
+	memcpy(dp->fake_http,fake_http_request_default,dp->fake_http_size);
+	dp->fake_quic_size = 620; // must be 601+ for TSPU hack
+	dp->fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
+	dp->fake_wg_size = 64;
+	dp->fake_dht_size = 64;
+	dp->fake_unknown_size = 256;
+	dp->fake_syndata_size = 16;
+	dp->fake_unknown_udp_size = 64;
+	dp->wscale=-1; // default - dont change scale factor (client)
+	dp->desync_ttl6 = 0xFF; // unused
+	dp->desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
+	dp->desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
+	dp->wssize_cutoff_mode = dp->desync_start_mode = dp->desync_cutoff_mode = 'n'; // packet number by default
+	dp->udplen_increment = UDPLEN_INCREMENT_DEFAULT;
+	dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
+	dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+	dp->hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
+	dp->filter_ipv4 = dp->filter_ipv6 = true;
+}
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 {
 	struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
 	if (!entry) return NULL;
 	
-	LIST_INIT(&entry->dp.hl_collection);
-	LIST_INIT(&entry->dp.hl_collection_exclude);
-	LIST_INIT(&entry->dp.ips_collection);
-	LIST_INIT(&entry->dp.ips_collection_exclude);
-	LIST_INIT(&entry->dp.pf_tcp);
-	LIST_INIT(&entry->dp.pf_udp);
-
-	memcpy(entry->dp.hostspell, "host", 4); // default hostspell
-	entry->dp.desync_skip_nosni = true;
-	entry->dp.desync_split_pos = 2;
-	entry->dp.desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
-	entry->dp.desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
-	entry->dp.desync_repeats = 1;
-	entry->dp.fake_tls_size = sizeof(fake_tls_clienthello_default);
-	memcpy(entry->dp.fake_tls,fake_tls_clienthello_default,entry->dp.fake_tls_size);
-	randomize_default_tls_payload(entry->dp.fake_tls);
-	entry->dp.fake_http_size = strlen(fake_http_request_default);
-	memcpy(entry->dp.fake_http,fake_http_request_default,entry->dp.fake_http_size);
-	entry->dp.fake_quic_size = 620; // must be 601+ for TSPU hack
-	entry->dp.fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
-	entry->dp.fake_wg_size = 64;
-	entry->dp.fake_dht_size = 64;
-	entry->dp.fake_unknown_size = 256;
-	entry->dp.fake_syndata_size = 16;
-	entry->dp.fake_unknown_udp_size = 64;
-	entry->dp.wscale=-1; // default - dont change scale factor (client)
-	entry->dp.desync_ttl6 = 0xFF; // unused
-	entry->dp.desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
-	entry->dp.desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
-	entry->dp.wssize_cutoff_mode = entry->dp.desync_start_mode = entry->dp.desync_cutoff_mode = 'n'; // packet number by default
-	entry->dp.udplen_increment = UDPLEN_INCREMENT_DEFAULT;
-	entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
-	entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
-	entry->dp.hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
-	entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
+	dp_init(&entry->dp);
 
 	// add to the tail
 	struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
@@ -208,15 +226,24 @@ struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 
 	return entry;
 }
-static void dp_entry_destroy(struct desync_profile_list *entry)
+static void dp_clear_dynamic(struct desync_profile *dp)
 {
-	hostlist_collection_destroy(&entry->dp.hl_collection);
-	hostlist_collection_destroy(&entry->dp.hl_collection_exclude);
-	ipset_collection_destroy(&entry->dp.ips_collection);
-	ipset_collection_destroy(&entry->dp.ips_collection_exclude);
-	port_filters_destroy(&entry->dp.pf_tcp);
-	port_filters_destroy(&entry->dp.pf_udp);
-	HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
+	hostlist_collection_destroy(&dp->hl_collection);
+	hostlist_collection_destroy(&dp->hl_collection_exclude);
+	ipset_collection_destroy(&dp->ips_collection);
+	ipset_collection_destroy(&dp->ips_collection_exclude);
+	port_filters_destroy(&dp->pf_tcp);
+	port_filters_destroy(&dp->pf_udp);
+	HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
+}
+void dp_clear(struct desync_profile *dp)
+{
+	dp_clear_dynamic(dp);
+	memset(dp,0,sizeof(*dp));
+}
+void dp_entry_destroy(struct desync_profile_list *entry)
+{
+	dp_clear_dynamic(&entry->dp);
 	free(entry);
 }
 void dp_list_destroy(struct desync_profile_list_head *head)

nfq/params.h

@@ -14,7 +14,7 @@
 #include <stdio.h>
 #include <time.h>
 #include <sys/queue.h>
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 #include <wordexp.h>
 #endif
 
@@ -38,6 +38,8 @@
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 #define	HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT	3
 
+#define MAX_SPLITS	64
+
 enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
 
 struct desync_profile
@@ -49,20 +51,24 @@ struct desync_profile
 	char wssize_cutoff_mode; // n - packets, d - data packets, s - relative sequence
 	unsigned int wssize_cutoff;
 
-	bool hostcase, hostnospace, domcase;
+	bool hostcase, hostnospace, domcase, methodeol;
 	char hostspell[4];
 	enum dpi_desync_mode desync_mode0,desync_mode,desync_mode2;
 	bool desync_retrans,desync_skip_nosni,desync_any_proto;
-	unsigned int desync_repeats,desync_split_pos,desync_seqovl,desync_ipfrag_pos_tcp,desync_ipfrag_pos_udp;
-	enum httpreqpos desync_split_http_req;
-	enum tlspos desync_split_tls;
+	unsigned int desync_repeats,desync_ipfrag_pos_tcp,desync_ipfrag_pos_udp;
+
+	// multisplit
+	struct proto_pos splits[MAX_SPLITS];
+	int split_count;
+	struct proto_pos seqovl;
+
 	char desync_start_mode, desync_cutoff_mode; // n - packets, d - data packets, s - relative sequence
 	unsigned int desync_start, desync_cutoff;
 	uint8_t desync_ttl, desync_ttl6;
 	autottl desync_autottl, desync_autottl6;
 	uint32_t desync_fooling_mode;
 	uint32_t desync_badseq_increment, desync_badseq_ack_increment;
-	uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460];
+	uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460],fsplit_pattern[1460];
 	uint8_t fake_unknown_udp[1472],udplen_pattern[1472],fake_quic[1472],fake_wg[1472],fake_dht[1472];
 	size_t fake_http_size,fake_tls_size,fake_quic_size,fake_wg_size,fake_dht_size,fake_unknown_size,fake_syndata_size,fake_unknown_udp_size;
 	int udplen_increment;
@@ -93,12 +99,15 @@ struct desync_profile_list {
 };
 LIST_HEAD(desync_profile_list_head, desync_profile_list);
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
+void dp_entry_destroy(struct desync_profile_list *entry);
 void dp_list_destroy(struct desync_profile_list_head *head);
 bool dp_list_have_autohostlist(struct desync_profile_list_head *head);
+void dp_init(struct desync_profile *dp);
+void dp_clear(struct desync_profile *dp);
 
 struct params_s
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	wordexp_t wexp; // for file based config
 #endif
 
@@ -143,3 +152,4 @@ int DLOG_ERR(const char *format, ...);
 int DLOG_PERROR(const char *s);
 int DLOG_CONDUP(const char *format, ...);
 int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);

nfq/pools.c

@@ -159,12 +159,17 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const
 {
 	struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
 	if (entry)
+	{
+		if (filename)
 		{
 			if (!(entry->filename = strdup(filename)))
 			{
 				free(entry);
 				return false;
 			}
+		}
+		else
+			entry->filename = NULL;
 		entry->mod_time = 0;
 		entry->hostlist = NULL;
 		LIST_INSERT_HEAD(head, entry, next);
@@ -192,7 +197,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -223,7 +228,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;
@@ -368,12 +373,17 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
 {
 	struct ipset_file *entry = malloc(sizeof(struct ipset_file));
 	if (entry)
+	{
+		if (filename)
 		{
 			if (!(entry->filename = strdup(filename)))
 			{
 				free(entry);
 				return false;
 			}
+		}
+		else
+			entry->filename = NULL;
 		entry->mod_time = 0;
 		memset(&entry->ipset,0,sizeof(entry->ipset));
 		LIST_INSERT_HEAD(head, entry, next);
@@ -401,7 +411,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -432,7 +442,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;

nfq/protocol.c

@@ -7,6 +7,150 @@
 #include <arpa/inet.h>
 #include <string.h>
 
+// find N level domain
+static bool FindNLD(const uint8_t *dom, size_t dlen, int level, const uint8_t **p, size_t *len)
+{
+	int i;
+	const uint8_t *p1,*p2;
+	for (i=1,p2=dom+dlen;i<level;i++)
+	{
+		for (p2--; p2>dom && *p2!='.'; p2--);
+		if (p2<=dom) return false;
+	}
+	for (p1=p2-1 ; p1>dom && *p1!='.'; p1--);
+	if (*p1=='.') p1++;
+	if (p) *p = p1;
+	if (len) *len = p2-p1;
+	return true;
+}
+
+const char *l7proto_str(t_l7proto l7)
+{
+	switch(l7)
+	{
+		case HTTP: return "http";
+		case TLS: return "tls";
+		case QUIC: return "quic";
+		case WIREGUARD: return "wireguard";
+		case DHT: return "dht";
+		default: return "unknown";
+	}
+}
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
+{
+	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
+		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
+		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
+		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
+		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
+		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
+}
+
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+bool IsHostMarker(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			return true;
+		default:
+			return false;
+	}
+}
+const char *posmarker_name(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_ABS: return "abs";
+		case PM_HOST: return "host";
+		case PM_HOST_END: return "endhost";
+		case PM_HOST_SLD: return "sld";
+		case PM_HOST_MIDSLD: return "midsld";
+		case PM_HOST_ENDSLD: return "endsld";
+		case PM_HTTP_METHOD: return "method";
+		case PM_SNI_EXT: return "sniext";
+		default: return "?";
+	}
+}
+
+static size_t CheckPos(size_t sz, ssize_t offset)
+{
+	return (offset>=0 && offset<sz) ? offset : 0;
+}
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
+{
+	ssize_t offset;
+	switch(posmarker)
+	{
+		case PM_ABS:
+			offset = (pos<0) ? sz+pos : pos;
+			return CheckPos(sz,offset);
+		default:
+			return 0;
+	}
+}
+static size_t HostPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz, size_t offset_host, size_t len_host)
+{
+	ssize_t offset;
+	const uint8_t *p;
+	size_t slen;
+
+	switch(posmarker)
+	{
+		case PM_HOST:
+			offset = offset_host+pos;
+			break;
+		case PM_HOST_END:
+			offset = offset_host+len_host+pos;
+			break;
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (((offset_host+len_host)<=sz) && FindNLD(data+offset_host,len_host,2,&p,&slen))
+				offset = (posmarker==PM_HOST_SLD ? p-data : posmarker==PM_HOST_ENDSLD ? p-data+slen : slen==1 ? p+1-data : p+slen/2-data) + pos;
+			else
+				offset = 0;
+			break;
+	}
+	return CheckPos(sz,offset);
+}
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp)
+{
+	switch(l7proto)
+	{
+		case HTTP:
+			return HttpPos(sp->marker, sp->pos, data, sz);
+		case TLS:
+			return TLSPos(sp->marker, sp->pos, data, sz);
+		default:
+			return AnyProtoPos(sp->marker, sp->pos, data, sz);
+	}
+}
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count)
+{
+	int i,j;
+	for(i=j=0;i<split_count;i++)
+	{
+		pos[j] = ResolvePos(data,sz,l7proto,splits+i);
+		if (pos[j]) j++;
+	}
+	qsort_size_t(pos, j);
+	j=unique_size_t(pos, j);
+	*pos_count=j;
+}
+
+
 const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
 const char *HttpMethod(const uint8_t *data, size_t len)
 {
@@ -116,17 +260,6 @@ bool HttpExtractHost(const uint8_t *data, size_t len, char *host, size_t len_hos
 {
 	return HttpExtractHeader(data, len, "\nHost:", host, len_host);
 }
-const char *HttpFind2ndLevelDomain(const char *host)
-{
-	const char *p=NULL;
-	if (*host)
-	{
-		for (p = host + strlen(host)-1; p>host && *p!='.'; p--);
-		if (*p=='.') for (p--; p>host && *p!='.'; p--);
-		if (*p=='.') p++;
-	}
-	return p;
-}
 // DPI redirects are global redirects to another domain
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host)
 {
@@ -157,43 +290,54 @@ bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *
 	// somethinkg like : censor.net
 	
 	// extract 2nd level domains
+	const char *dhost, *drhost;
+	if (!FindNLD((uint8_t*)host,strlen(host),2,(const uint8_t**)&dhost,NULL) || !FindNLD((uint8_t*)redirect_host,strlen(redirect_host),2,(const uint8_t**)&drhost,NULL))
+		return false;
 
-	const char *dhost = HttpFind2ndLevelDomain(host);
-	const char *drhost = HttpFind2ndLevelDomain(redirect_host);
-	
+	// compare 2nd level domains		
 	return strcasecmp(dhost, drhost)!=0;
 }
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz)
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
-	const uint8_t *method, *host=NULL;
+	const uint8_t *method, *host=NULL, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
 	int i;
 	
-	switch(tpos_type)
+	switch(posmarker)
 	{
-		case httpreqpos_method:
+		case PM_HTTP_METHOD:
 			// recognize some tpws pre-applied hacks
-			method=http;
+			method=data;
 			if (sz<10) break;
 			if (*method=='\n' || *method=='\r') method++;
 			if (*method=='\n' || *method=='\r') method++;
-			for (i=0;i<7;i++) if (*method>='A' && *method<='Z') method++;
-			if (i<3 || *method!=' ') break;
-			return method-http-1;
-		case httpreqpos_host:
-			if (HttpFindHostConst(&host,http,sz) && (host-http+7)<sz)
+			for (p=method,i=0;i<7;i++) if (*p>='A' && *p<='Z') p++;
+			if (i<3 || *p!=' ') break;
+			return CheckPos(sz,method-data+pos);
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (HttpFindHostConst(&host,data,sz) && (host-data+7)<sz)
 			{
 				host+=5;
-				if (*host==' ') host++;
-				return host-http;
+				if (*host==' ' || *host=='\t') host++;
+				offset_host = host-data;
+				if (posmarker!=PM_HOST)
+					for (len_host=0; (offset_host+len_host)<sz && data[offset_host+len_host]!='\r' && data[offset_host+len_host]!='\n'; len_host++);
+				else
+					len_host = 0;
+				return HostPos(posmarker,pos,data,sz,offset_host,len_host);
 			}
 			break;
-		case httpreqpos_pos:
-			break;
 		default:
+			return AnyProtoPos(posmarker,pos,data,sz);
+	}
 	return 0;
 }
-	return hpos_pos<sz ? hpos_pos : 0;
-}
+
 
 
 uint16_t TLSRecordDataLen(const uint8_t *data)
@@ -305,15 +449,24 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 	if (reclen<len) len=reclen; // correct len if it has more data than the first tls record has
 	return TLSFindExtInHandshake(data + 5, len - 5, type, ext, len_ext, bPartialIsOK);
 }
+static bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen)
+{
+	// u16	data+0 - name list length
+	// u8	data+2 - server name type. 0=host_name
+	// u16	data+3 - server name length
+	if (*elen < 5 || (*ext)[2] != 0) return false;
+	*slen = pntoh16(*ext + 3);
+	*ext += 5; *elen -= 5;
+	return *slen <= *elen;
+}
 static bool TLSExtractHostFromExt(const uint8_t *ext, size_t elen, char *host, size_t len_host)
 {
 	// u16	data+0 - name list length
 	// u8	data+2 - server name type. 0=host_name
 	// u16	data+3 - server name length
-	if (elen < 5 || ext[2] != 0) return false;
-	size_t slen = pntoh16(ext + 3);
-	ext += 5; elen -= 5;
-	if (slen < elen) return false;
+	size_t slen;
+	if (!TLSAdvanceToHostInSNI(&ext,&elen,&slen))
+		return false;
 	if (host && len_host)
 	{
 		if (slen >= len_host) slen = len_host - 1;
@@ -338,21 +491,39 @@ bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *hos
 	if (!TLSFindExtInHandshake(data, len, 0, &ext, &elen, bPartialIsOK)) return false;
 	return TLSExtractHostFromExt(ext, elen, host, len_host);
 }
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type)
+
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
 	size_t elen;
-	const uint8_t *ext;
-	switch(tpos_type)
+	const uint8_t *ext, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
+
+	switch(posmarker)
 	{
-		case tlspos_sni:
-		case tlspos_sniext:
-			if (TLSFindExt(tls,sz,0,&ext,&elen,false))
-				return (tpos_type==tlspos_sni) ? ext-tls+6 : ext-tls+1;
-			// fall through
-		case tlspos_pos:
-			return tpos_pos<sz ? tpos_pos : 0;
-		default:
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+		case PM_SNI_EXT:
+			if (TLSFindExt(data,sz,0,&ext,&elen,false))
+			{
+				if (posmarker==PM_SNI_EXT)
+				{
+					return CheckPos(sz,ext-data+pos);
+				}
+				else
+				{
+					if (!TLSAdvanceToHostInSNI(&ext,&elen,&len_host))
 						return 0;
+					offset_host = ext-data;
+					return HostPos(posmarker,pos,data,sz,offset_host,len_host);
+				}
+			}
+			return 0;
+		default:
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
 }
 
@@ -699,6 +870,7 @@ bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,siz
 	return found;
 }
 
+/*
 bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello)
 {
 	if (bIsCryptoHello) *bIsCryptoHello=false;
@@ -718,8 +890,9 @@ bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host
 	if (!IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len)) return false;
 	if (bIsCryptoHello) *bIsCryptoHello=true;
 
-	return TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, len_host, true);
+	return TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, len_host, NULL, true);
 }
+*/
 
 bool IsQUICInitial(const uint8_t *data, size_t len)
 {

nfq/protocol.h

@@ -7,6 +7,39 @@
 #include "crypto/aes-gcm.h"
 #include "helpers.h"
 
+typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
+#define L7_PROTO_HTTP		0x00000001
+#define L7_PROTO_TLS		0x00000002
+#define L7_PROTO_QUIC		0x00000004
+#define L7_PROTO_WIREGUARD	0x00000008
+#define L7_PROTO_DHT		0x00000010
+#define L7_PROTO_UNKNOWN	0x80000000
+const char *l7proto_str(t_l7proto l7);
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
+
+// pos markers
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+struct proto_pos
+{
+	int16_t pos;
+	uint8_t marker;
+};
+#define PROTO_POS_EMPTY(sp) ((sp)->marker==PM_ABS && (sp)->pos==0)
+bool IsHostMarker(uint8_t posmarker);
+const char *posmarker_name(uint8_t posmarker);
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp);
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count);
+
 extern const char *http_methods[9];
 const char *HttpMethod(const uint8_t *data, size_t len);
 bool IsHttp(const uint8_t *data, size_t len);
@@ -21,8 +54,6 @@ const char *HttpFind2ndLevelDomain(const char *host);
 int HttpReplyCode(const uint8_t *data, size_t len);
 // must be pre-checked by IsHttpReply
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host);
-enum httpreqpos { httpreqpos_none = 0, httpreqpos_method, httpreqpos_host, httpreqpos_pos };
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz);
 
 uint16_t TLSRecordDataLen(const uint8_t *data);
 size_t TLSRecordLen(const uint8_t *data);
@@ -35,8 +66,6 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
 bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
 bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
-enum tlspos { tlspos_none = 0, tlspos_sni, tlspos_sniext, tlspos_pos };
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type);
 
 bool IsWireguardHandshakeInitiation(const uint8_t *data, size_t len);
 bool IsDhtD1(const uint8_t *data, size_t len);
@@ -56,4 +85,4 @@ bool QUICExtractDCID(const uint8_t *data, size_t len, quic_cid_t *cid);
 
 bool QUICDecryptInitial(const uint8_t *data, size_t data_len, uint8_t *clean, size_t *clean_len);
 bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len);
-bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello);
+//bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello);

tpws/BSDmakefile

@@ -1,12 +1,12 @@
 CC ?= cc
-CFLAGS += -std=gnu99 -s -O3
+CFLAGS += -std=gnu99 -s -Os -flto=auto
 LIBS = -lz -lpthread
 SRC_FILES = *.c
 
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -Iepoll-shim/include -o $@ $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
 
 clean:
 	rm -f tpws *.o

tpws/Makefile

@@ -1,13 +1,18 @@
 CC ?= gcc
-CFLAGS += -std=gnu99 -O3
+CFLAGS += -std=gnu99 -Os -flto=auto
 CFLAGS_BSD = -Wno-address-of-packed-member
 LIBS = -lz -lpthread
+LIBS_ANDROID = -lz
 SRC_FILES = *.c
+SRC_FILES_ANDROID = $(SRC_FILES) andr/*.c
 
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+android: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LDFLAGS) $(LIBS_ANDROID)
 
 bsd: $(SRC_FILES)
 	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)

tpws/andr/_musl_license.txt

@@ -0,0 +1,26 @@
+Code in this dir is taken from musl libc to support old android versions <7.0
+
+musl as a whole is licensed under the following standard MIT license:
+
+----------------------------------------------------------------------
+Copyright <20> 2005-2020 Rich Felker, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----------------------------------------------------------------------

tpws/andr/getifaddrs.c

@@ -0,0 +1,216 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <ifaddrs.h>
+#include <syscall.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include "netlink.h"
+
+#define IFADDRS_HASH_SIZE 64
+
+/* getifaddrs() reports hardware addresses with PF_PACKET that implies
+ * struct sockaddr_ll.  But e.g. Infiniband socket address length is
+ * longer than sockaddr_ll.ssl_addr[8] can hold. Use this hack struct
+ * to extend ssl_addr - callers should be able to still use it. */
+struct sockaddr_ll_hack {
+	unsigned short sll_family, sll_protocol;
+	int sll_ifindex;
+	unsigned short sll_hatype;
+	unsigned char sll_pkttype, sll_halen;
+	unsigned char sll_addr[24];
+};
+
+union sockany {
+	struct sockaddr sa;
+	struct sockaddr_ll_hack ll;
+	struct sockaddr_in v4;
+	struct sockaddr_in6 v6;
+};
+
+struct ifaddrs_storage {
+	struct ifaddrs ifa;
+	struct ifaddrs_storage *hash_next;
+	union sockany addr, netmask, ifu;
+	unsigned int index;
+	char name[IFNAMSIZ+1];
+};
+
+struct ifaddrs_ctx {
+	struct ifaddrs *first;
+	struct ifaddrs *last;
+	struct ifaddrs_storage *hash[IFADDRS_HASH_SIZE];
+};
+
+void freeifaddrs(struct ifaddrs *ifp)
+{
+	struct ifaddrs *n;
+	while (ifp) {
+		n = ifp->ifa_next;
+		free(ifp);
+		ifp = n;
+	}
+}
+
+static void copy_addr(struct sockaddr **r, int af, union sockany *sa, void *addr, size_t addrlen, int ifindex)
+{
+	uint8_t *dst;
+	int len;
+
+	switch (af) {
+	case AF_INET:
+		dst = (uint8_t*) &sa->v4.sin_addr;
+		len = 4;
+		break;
+	case AF_INET6:
+		dst = (uint8_t*) &sa->v6.sin6_addr;
+		len = 16;
+		if (IN6_IS_ADDR_LINKLOCAL(addr) || IN6_IS_ADDR_MC_LINKLOCAL(addr))
+			sa->v6.sin6_scope_id = ifindex;
+		break;
+	default:
+		return;
+	}
+	if (addrlen < len) return;
+	sa->sa.sa_family = af;
+	memcpy(dst, addr, len);
+	*r = &sa->sa;
+}
+
+static void gen_netmask(struct sockaddr **r, int af, union sockany *sa, int prefixlen)
+{
+	uint8_t addr[16] = {0};
+	int i;
+
+	if (prefixlen > 8*sizeof(addr)) prefixlen = 8*sizeof(addr);
+	i = prefixlen / 8;
+	memset(addr, 0xff, i);
+	if (i < sizeof(addr)) addr[i++] = 0xff << (8 - (prefixlen % 8));
+	copy_addr(r, af, sa, addr, sizeof(addr), 0);
+}
+
+static void copy_lladdr(struct sockaddr **r, union sockany *sa, void *addr, size_t addrlen, int ifindex, unsigned short hatype)
+{
+	if (addrlen > sizeof(sa->ll.sll_addr)) return;
+	sa->ll.sll_family = AF_PACKET;
+	sa->ll.sll_ifindex = ifindex;
+	sa->ll.sll_hatype = hatype;
+	sa->ll.sll_halen = addrlen;
+	memcpy(sa->ll.sll_addr, addr, addrlen);
+	*r = &sa->sa;
+}
+
+static int netlink_msg_to_ifaddr(void *pctx, struct nlmsghdr *h)
+{
+	struct ifaddrs_ctx *ctx = pctx;
+	struct ifaddrs_storage *ifs, *ifs0;
+	struct ifinfomsg *ifi = NLMSG_DATA(h);
+	struct ifaddrmsg *ifa = NLMSG_DATA(h);
+	struct rtattr *rta;
+	int stats_len = 0;
+
+	if (h->nlmsg_type == RTM_NEWLINK) {
+		for (rta = NLMSG_RTA(h, sizeof(*ifi)); NLMSG_RTAOK(rta, h); rta = RTA_NEXT(rta)) {
+			if (rta->rta_type != IFLA_STATS) continue;
+			stats_len = RTA_DATALEN(rta);
+			break;
+		}
+	} else {
+		for (ifs0 = ctx->hash[ifa->ifa_index % IFADDRS_HASH_SIZE]; ifs0; ifs0 = ifs0->hash_next)
+			if (ifs0->index == ifa->ifa_index)
+				break;
+		if (!ifs0) return 0;
+	}
+
+	ifs = calloc(1, sizeof(struct ifaddrs_storage) + stats_len);
+	if (ifs == 0) return -1;
+
+	if (h->nlmsg_type == RTM_NEWLINK) {
+		ifs->index = ifi->ifi_index;
+		ifs->ifa.ifa_flags = ifi->ifi_flags;
+
+		for (rta = NLMSG_RTA(h, sizeof(*ifi)); NLMSG_RTAOK(rta, h); rta = RTA_NEXT(rta)) {
+			switch (rta->rta_type) {
+			case IFLA_IFNAME:
+				if (RTA_DATALEN(rta) < sizeof(ifs->name)) {
+					memcpy(ifs->name, RTA_DATA(rta), RTA_DATALEN(rta));
+					ifs->ifa.ifa_name = ifs->name;
+				}
+				break;
+			case IFLA_ADDRESS:
+				copy_lladdr(&ifs->ifa.ifa_addr, &ifs->addr, RTA_DATA(rta), RTA_DATALEN(rta), ifi->ifi_index, ifi->ifi_type);
+				break;
+			case IFLA_BROADCAST:
+				copy_lladdr(&ifs->ifa.ifa_broadaddr, &ifs->ifu, RTA_DATA(rta), RTA_DATALEN(rta), ifi->ifi_index, ifi->ifi_type);
+				break;
+			case IFLA_STATS:
+				ifs->ifa.ifa_data = (void*)(ifs+1);
+				memcpy(ifs->ifa.ifa_data, RTA_DATA(rta), RTA_DATALEN(rta));
+				break;
+			}
+		}
+		if (ifs->ifa.ifa_name) {
+			unsigned int bucket = ifs->index % IFADDRS_HASH_SIZE;
+			ifs->hash_next = ctx->hash[bucket];
+			ctx->hash[bucket] = ifs;
+		}
+	} else {
+		ifs->ifa.ifa_name = ifs0->ifa.ifa_name;
+		ifs->ifa.ifa_flags = ifs0->ifa.ifa_flags;
+		for (rta = NLMSG_RTA(h, sizeof(*ifa)); NLMSG_RTAOK(rta, h); rta = RTA_NEXT(rta)) {
+			switch (rta->rta_type) {
+			case IFA_ADDRESS:
+				/* If ifa_addr is already set we, received an IFA_LOCAL before
+				 * so treat this as destination address */
+				if (ifs->ifa.ifa_addr)
+					copy_addr(&ifs->ifa.ifa_dstaddr, ifa->ifa_family, &ifs->ifu, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				else
+					copy_addr(&ifs->ifa.ifa_addr, ifa->ifa_family, &ifs->addr, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				break;
+			case IFA_BROADCAST:
+				copy_addr(&ifs->ifa.ifa_broadaddr, ifa->ifa_family, &ifs->ifu, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				break;
+			case IFA_LOCAL:
+				/* If ifa_addr is set and we get IFA_LOCAL, assume we have
+				 * a point-to-point network. Move address to correct field. */
+				if (ifs->ifa.ifa_addr) {
+					ifs->ifu = ifs->addr;
+					ifs->ifa.ifa_dstaddr = &ifs->ifu.sa;
+					memset(&ifs->addr, 0, sizeof(ifs->addr));
+				}
+				copy_addr(&ifs->ifa.ifa_addr, ifa->ifa_family, &ifs->addr, RTA_DATA(rta), RTA_DATALEN(rta), ifa->ifa_index);
+				break;
+			case IFA_LABEL:
+				if (RTA_DATALEN(rta) < sizeof(ifs->name)) {
+					memcpy(ifs->name, RTA_DATA(rta), RTA_DATALEN(rta));
+					ifs->ifa.ifa_name = ifs->name;
+				}
+				break;
+			}
+		}
+		if (ifs->ifa.ifa_addr)
+			gen_netmask(&ifs->ifa.ifa_netmask, ifa->ifa_family, &ifs->netmask, ifa->ifa_prefixlen);
+	}
+
+	if (ifs->ifa.ifa_name) {
+		if (!ctx->first) ctx->first = &ifs->ifa;
+		if (ctx->last) ctx->last->ifa_next = &ifs->ifa;
+		ctx->last = &ifs->ifa;
+	} else {
+		free(ifs);
+	}
+	return 0;
+}
+
+int getifaddrs(struct ifaddrs **ifap)
+{
+	struct ifaddrs_ctx _ctx, *ctx = &_ctx;
+	int r;
+	memset(ctx, 0, sizeof *ctx);
+	r = __rtnetlink_enumerate(AF_UNSPEC, AF_UNSPEC, netlink_msg_to_ifaddr, ctx);
+	if (r == 0) *ifap = ctx->first;
+	else freeifaddrs(ctx->first);
+	return r;
+}

tpws/andr/ifaddrs.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include <ifaddrs.h>
+
+#if __ANDROID_API__ < 24
+void freeifaddrs(struct ifaddrs *);
+int getifaddrs(struct ifaddrs **);
+#endif

tpws/andr/netlink.c

@@ -0,0 +1,54 @@
+#include <errno.h>
+#include <string.h>
+#include <syscall.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include "netlink.h"
+
+static int __netlink_enumerate(int fd, unsigned int seq, int type, int af,
+	int (*cb)(void *ctx, struct nlmsghdr *h), void *ctx)
+{
+	struct nlmsghdr *h;
+	union {
+		uint8_t buf[8192];
+		struct {
+			struct nlmsghdr nlh;
+			struct rtgenmsg g;
+		} req;
+		struct nlmsghdr reply;
+	} u;
+	int r, ret;
+
+	memset(&u.req, 0, sizeof(u.req));
+	u.req.nlh.nlmsg_len = sizeof(u.req);
+	u.req.nlh.nlmsg_type = type;
+	u.req.nlh.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST;
+	u.req.nlh.nlmsg_seq = seq;
+	u.req.g.rtgen_family = af;
+	r = send(fd, &u.req, sizeof(u.req), 0);
+	if (r < 0) return r;
+
+	while (1) {
+		r = recv(fd, u.buf, sizeof(u.buf), MSG_DONTWAIT);
+		if (r <= 0) return -1;
+		for (h = &u.reply; NLMSG_OK(h, (void*)&u.buf[r]); h = NLMSG_NEXT(h)) {
+			if (h->nlmsg_type == NLMSG_DONE) return 0;
+			if (h->nlmsg_type == NLMSG_ERROR) return -1;
+			ret = cb(ctx, h);
+			if (ret) return ret;
+		}
+	}
+}
+
+int __rtnetlink_enumerate(int link_af, int addr_af, int (*cb)(void *ctx, struct nlmsghdr *h), void *ctx)
+{
+	int fd, r;
+
+	fd = socket(PF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE);
+	if (fd < 0) return -1;
+	r = __netlink_enumerate(fd, 1, RTM_GETLINK, link_af, cb, ctx);
+	if (!r) r = __netlink_enumerate(fd, 2, RTM_GETADDR, addr_af, cb, ctx);
+	close(fd);
+	return r;
+}

tpws/andr/netlink.h

@@ -0,0 +1,94 @@
+#include <stdint.h>
+
+/* linux/netlink.h */
+
+#define NETLINK_ROUTE 0
+
+struct nlmsghdr {
+	uint32_t	nlmsg_len;
+	uint16_t	nlmsg_type;
+	uint16_t	nlmsg_flags;
+	uint32_t	nlmsg_seq;
+	uint32_t	nlmsg_pid;
+};
+
+#define NLM_F_REQUEST	1
+#define NLM_F_MULTI	2
+#define NLM_F_ACK	4
+
+#define NLM_F_ROOT	0x100
+#define NLM_F_MATCH	0x200
+#define NLM_F_ATOMIC	0x400
+#define NLM_F_DUMP	(NLM_F_ROOT|NLM_F_MATCH)
+
+#define NLMSG_NOOP	0x1
+#define NLMSG_ERROR	0x2
+#define NLMSG_DONE	0x3
+#define NLMSG_OVERRUN	0x4
+
+/* linux/rtnetlink.h */
+
+#define RTM_NEWLINK	16
+#define RTM_GETLINK	18
+#define RTM_NEWADDR	20
+#define RTM_GETADDR	22
+
+struct rtattr {
+	unsigned short	rta_len;
+	unsigned short	rta_type;
+};
+
+struct rtgenmsg {
+	unsigned char	rtgen_family;
+};
+
+struct ifinfomsg {
+	unsigned char	ifi_family;
+	unsigned char	__ifi_pad;
+	unsigned short	ifi_type;
+	int		ifi_index;
+	unsigned	ifi_flags;
+	unsigned	ifi_change;
+};
+
+/* linux/if_link.h */
+
+#define IFLA_ADDRESS	1
+#define IFLA_BROADCAST	2
+#define IFLA_IFNAME	3
+#define IFLA_STATS	7
+
+/* linux/if_addr.h */
+
+struct ifaddrmsg {
+	uint8_t		ifa_family;
+	uint8_t		ifa_prefixlen;
+	uint8_t		ifa_flags;
+	uint8_t		ifa_scope;
+	uint32_t	ifa_index;
+};
+
+#define IFA_ADDRESS	1
+#define IFA_LOCAL	2
+#define IFA_LABEL	3
+#define IFA_BROADCAST	4
+
+/* musl */
+
+#define NETLINK_ALIGN(len)	(((len)+3) & ~3)
+#define NLMSG_DATA(nlh)		((void*)((char*)(nlh)+sizeof(struct nlmsghdr)))
+#define NLMSG_DATALEN(nlh)	((nlh)->nlmsg_len-sizeof(struct nlmsghdr))
+#define NLMSG_DATAEND(nlh)	((char*)(nlh)+(nlh)->nlmsg_len)
+#define NLMSG_NEXT(nlh)		(struct nlmsghdr*)((char*)(nlh)+NETLINK_ALIGN((nlh)->nlmsg_len))
+#define NLMSG_OK(nlh,end)	((char*)(end)-(char*)(nlh) >= sizeof(struct nlmsghdr))
+
+#define RTA_DATA(rta)		((void*)((char*)(rta)+sizeof(struct rtattr)))
+#define RTA_DATALEN(rta)	((rta)->rta_len-sizeof(struct rtattr))
+#define RTA_DATAEND(rta)	((char*)(rta)+(rta)->rta_len)
+#define RTA_NEXT(rta)		(struct rtattr*)((char*)(rta)+NETLINK_ALIGN((rta)->rta_len))
+#define RTA_OK(rta,end)		((char*)(end)-(char*)(rta) >= sizeof(struct rtattr))
+
+#define NLMSG_RTA(nlh,len)	((void*)((char*)(nlh)+sizeof(struct nlmsghdr)+NETLINK_ALIGN(len)))
+#define NLMSG_RTAOK(rta,nlh)	RTA_OK(rta,NLMSG_DATAEND(nlh))
+
+int __rtnetlink_enumerate(int link_af, int addr_af, int (*cb)(void *ctx, struct nlmsghdr *h), void *ctx);

tpws/helpers.c

@@ -1,15 +1,49 @@
 #define _GNU_SOURCE
 
-#include "helpers.h"
 #include <stdio.h>
 #include <string.h>
+#include <stdlib.h>
 #include <ctype.h>
 #include <errno.h>
 #include <sys/socket.h>
 #include <arpa/inet.h>
-#include <ifaddrs.h>
 #include <time.h>
 #include <sys/stat.h>
+#include <libgen.h>
+#include <unistd.h>
+
+#ifdef __linux__
+#include <linux/tcp.h>
+#endif
+
+#ifdef __ANDROID__
+#include "andr/ifaddrs.h"
+#else
+#include <ifaddrs.h>
+#endif
+
+#include "helpers.h"
+
+int unique_size_t(size_t *pu, int ct)
+{
+	int i, j, u;
+	for (i = j = 0; j < ct; i++)
+	{
+		u = pu[j++];
+		for (; j < ct && pu[j] == u; j++);
+		pu[i] = u;
+	}
+	return i;
+}
+static int cmp_size_t(const void * a, const void * b)
+{
+	return *(size_t*)a < *(size_t*)b ? -1 : *(size_t*)a > *(size_t*)b;
+}
+void qsort_size_t(size_t *array, size_t ct)
+{
+	qsort(array, ct, sizeof(*array), cmp_size_t);
+}
+
 
 void rtrim(char *s)
 {
@@ -326,6 +360,20 @@ bool pf_is_empty(const port_filter *pf)
 }
 
 
+bool set_env_exedir(const char *argv0)
+{
+	char *s, *d;
+	bool bOK = false;
+	if ((s = strdup(argv0)))
+	{
+		if ((d = dirname(s)))
+			setenv("EXEDIR", s, 1);
+		free(s);
+	}
+	return bOK;
+}
+
+
 static void mask_from_preflen6_make(uint8_t plen, struct in6_addr *a)
 {
 	if (plen >= 128)
@@ -418,3 +466,74 @@ bool parse_cidr6(char *s, struct cidr6 *cidr)
 	if (p) *p = d; // restore char
 	return b;
 }
+
+
+void msleep(unsigned int ms)
+{
+	struct timespec time = {
+		 .tv_nsec = (ms % 1000) * 1000000,
+		 .tv_sec = ms / 1000
+	};
+	nanosleep(&time, 0);
+}
+
+#ifdef __linux__
+bool socket_supports_notsent()
+{
+	int sfd;
+	struct tcp_info tcpi;
+
+	sfd = socket(AF_INET,SOCK_STREAM,0);
+	if (sfd<0) return false;
+
+	socklen_t ts = sizeof(tcpi);
+	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)
+	{
+		close(sfd);
+		return false;
+	}
+	close(sfd);
+
+	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi.tcpi_state + sizeof(tcpi.tcpi_notsent_bytes));
+}
+bool socket_has_notsent(int sfd)
+{
+	struct tcp_info tcpi;
+	socklen_t ts = sizeof(tcpi);
+
+	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)
+		return false;
+	if (tcpi.tcpi_state != 1) // TCP_ESTABLISHED
+		return false;
+	size_t s = (char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi + sizeof(tcpi.tcpi_notsent_bytes);
+	if (ts < s)
+		// old structure version
+		return false;
+	return !!tcpi.tcpi_notsent_bytes;
+}
+bool socket_wait_notsent(int sfd, unsigned int delay_ms, unsigned int *wasted_ms)
+{
+	struct timespec tres;
+	unsigned int mtick;
+
+	if (wasted_ms) *wasted_ms=0;
+	if (!socket_has_notsent(sfd)) return true;
+
+	if (clock_getres(CLOCK_MONOTONIC,&tres))
+	{
+		tres.tv_nsec = 10000000;
+		tres.tv_sec = 0;
+	}
+	mtick = (unsigned int)(tres.tv_sec*1000) + (unsigned int)(tres.tv_nsec/1000000);
+	if (mtick<1) mtick=1;
+	for(;;)
+	{
+		msleep(mtick);
+		if (wasted_ms) *wasted_ms+=mtick;
+		if (!socket_has_notsent(sfd)) return true;
+		if (delay_ms<=mtick) break;
+		delay_ms-=mtick;
+	}
+	return false;
+}
+#endif

tpws/helpers.h

@@ -15,6 +15,9 @@ typedef union
 	struct sockaddr_in6 sa6;	// size 28
 } sockaddr_in46;
 
+int unique_size_t(size_t *pu, int ct);
+void qsort_size_t(size_t *array,size_t ct);
+
 void rtrim(char *s);
 void replace_char(char *s, char from, char to);
 char *strncasestr(const char *s,const char *find, size_t slen);
@@ -70,6 +73,8 @@ bool pf_in_range(uint16_t port, const port_filter *pf);
 bool pf_parse(const char *s, port_filter *pf);
 bool pf_is_empty(const port_filter *pf);
 
+bool set_env_exedir(const char *argv0);
+
 #ifndef IN_LOOPBACK
 #define IN_LOOPBACK(a)          ((((uint32_t) (a)) & 0xff000000) == 0x7f000000)
 #endif
@@ -112,3 +117,10 @@ static inline const struct in6_addr *mask_from_preflen6(uint8_t preflen)
 {
 	return ip6_mask+preflen;
 }
+
+void msleep(unsigned int ms);
+#ifdef __linux__
+bool socket_supports_notsent();
+bool socket_has_notsent(int sfd);
+bool socket_wait_notsent(int sfd, unsigned int delay_ms, unsigned int *wasted_ms);
+#endif

tpws/hostlist.c

@@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 			*hostlist = NULL;
 			return false;
 		}
-		(*ct)++;
+		if (ct) (*ct)++;
 	}
 	// advance to the next line
 	for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@@ -32,6 +32,11 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	return true;
 }
 
+bool AppendHostlistItem(strpool **hostlist, char *s)
+{
+	return addpool(hostlist,&s,s+strlen(s),NULL);
+}
+
 bool AppendHostList(strpool **hostlist, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -97,6 +102,8 @@ bool AppendHostList(strpool **hostlist, const char *filename)
 }
 
 static bool LoadHostList(struct hostlist_file *hfile)
+{
+	if (hfile->filename)
 	{
 		time_t t = file_mod_time(hfile->filename);
 		if (!t)
@@ -113,6 +120,7 @@ static bool LoadHostList(struct hostlist_file *hfile)
 			return false;
 		}
 		hfile->mod_time=t;
+	}
 	return true;
 }
 static bool LoadHostLists(struct hostlist_files_head *list)
@@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 
 	LIST_FOREACH(item, hostlists_exclude, next)
 	{
-		VPRINT("[%s] exclude ", item->hfile->filename);
+		VPRINT("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchHostList(item->hfile->hostlist, host))
 		{
 			if (excluded) *excluded = true;
@@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 	{
 		LIST_FOREACH(item, hostlists, next)
 		{
-			VPRINT("[%s] include ", item->hfile->filename);
+			VPRINT("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchHostList(item->hfile->hostlist, host))
 				return true;
 		}
@@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
 static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
 {
 	struct hostlist_file *hfile;
+
+	if (filename)
+	{
 		if (!(hfile=hostlist_files_search(hostlists, filename)))
 			if (!(hfile=hostlist_files_add(hostlists, filename)))
 				return NULL;
 		if (!hostlist_collection_search(hl_collection, filename))
 			if (!hostlist_collection_add(hl_collection, hfile))
 				return NULL;
+	}
+	else
+	{
+		if (!(hfile=hostlist_files_add(hostlists, NULL)))
+			return NULL;
+		if (!hostlist_collection_add(hl_collection, hfile))
+			return NULL;
+	}
+
 	return hfile;
 }
 struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access hostlist file '%s'\n",filename);
 		return NULL;
@@ -265,15 +285,30 @@ void HostlistsDebug()
 	struct hostlist_item *hl_item;
 
 	LIST_FOREACH(hfile, &params.hostlists, next)
+	{
+		if (hfile->filename)
 			VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
+		else
+			VPRINT("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
 			if (hl_item->hfile!=dpl->dp.hostlist_auto)
+			{
+				if (hl_item->hfile->filename)
 					VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+				else
+					VPRINT("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
+			}
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
+		{
+			if (hl_item->hfile->filename)
 				VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+			else
+				VPRINT("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
+		}
 		if (dpl->dp.hostlist_auto)
 			VPRINT("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
 	}

tpws/hostlist.h

@@ -4,6 +4,7 @@
 #include "pools.h"
 #include "params.h"
 
+bool AppendHostlistItem(strpool **hostlist, char *s);
 bool AppendHostList(strpool **hostlist, const char *filename);
 bool LoadAllHostLists();
 bool NonEmptyHostlist(strpool **hostlist);

tpws/ipset.c

@@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else if (parse_cidr6(cidr,&c6))
 		{
@@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else
 			DLOG_ERR("bad ip or subnet : %s\n",cidr);
@@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 
 }
 
+bool AppendIpsetItem(ipset *ips, char *ip)
+{
+	return addpool(ips,&ip,ip+strlen(ip),NULL);
+}
+
 static bool AppendIpset(ipset *ips, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -118,6 +123,8 @@ static bool AppendIpset(ipset *ips, const char *filename)
 }
 
 static bool LoadIpset(struct ipset_file *hfile)
+{
+	if (hfile->filename)
 	{
 		time_t t = file_mod_time(hfile->filename);
 		if (!t)
@@ -134,6 +141,7 @@ static bool LoadIpset(struct ipset_file *hfile)
 			return false;
 		}
 		hfile->mod_time=t;
+	}
 	return true;
 }
 static bool LoadIpsets(struct ipset_files_head *list)
@@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 
 	LIST_FOREACH(item, ips_exclude, next)
 	{
-		VPRINT("[%s] exclude ",item->hfile->filename);
+		VPRINT("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 			return false;
 	}
@@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 	{
 		LIST_FOREACH(item, ips, next)
 		{
-			VPRINT("[%s] include ",item->hfile->filename);
+			VPRINT("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 				return true;
 		}
@@ -234,17 +242,27 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
 static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename)
 {
 	struct ipset_file *hfile;
+	if (filename)
+	{
 		if (!(hfile=ipset_files_search(ipsets, filename)))
 			if (!(hfile=ipset_files_add(ipsets, filename)))
 				return NULL;
 		if (!ipset_collection_search(ips_collection, filename))
 			if (!ipset_collection_add(ips_collection, hfile))
 				return NULL;
+	}
+	else
+	{
+		if (!(hfile=ipset_files_add(ipsets, NULL)))
+			return NULL;
+		if (!ipset_collection_add(ips_collection, hfile))
+			return NULL;
+	}
 	return hfile;
 }
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access ipset file '%s'\n",filename);
 		return NULL;
@@ -277,13 +295,24 @@ void IpsetsDebug()
 	struct ipset_item *ips_item;
 
 	LIST_FOREACH(hfile, &params.ipsets, next)
+	{
+		if (hfile->filename)
 			VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
+		else
+			VPRINT("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
+			if (ips_item->hfile->filename)
 				VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				VPRINT("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
+			if (ips_item->hfile->filename)
 				VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				VPRINT("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 	}
 }

tpws/ipset.h

@@ -9,3 +9,4 @@ bool LoadAllIpsets();
 bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
 void IpsetsDebug();
+bool AppendIpsetItem(ipset *ips, char *ip);

tpws/params.c

@@ -139,22 +139,42 @@ int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
 		return 0;
 }
 
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
+{
+	size_t k;
+	bool bcut = false;
+	if (size > limit)
+	{
+		size = limit;
+		bcut = true;
+	}
+	if (!size) return;
+	for (k = 0; k < size; k++) VPRINT("%02X ", data[k]);
+	VPRINT(bcut ? "... : " : ": ");
+	for (k = 0; k < size; k++) VPRINT("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
+	if (bcut) VPRINT(" ...");
+}
+
+void dp_init(struct desync_profile *dp)
+{
+	LIST_INIT(&dp->hl_collection);
+	LIST_INIT(&dp->hl_collection_exclude);
+	LIST_INIT(&dp->ips_collection);
+	LIST_INIT(&dp->ips_collection_exclude);
+	LIST_INIT(&dp->pf_tcp);
+
+	dp->filter_ipv4 = dp->filter_ipv6 = true;
+	memcpy(dp->hostspell, "host", 4); // default hostspell
+	dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
+	dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+}
 
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 {
 	struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
 	if (!entry) return NULL;
 
-	LIST_INIT(&entry->dp.hl_collection);
-	LIST_INIT(&entry->dp.hl_collection_exclude);
-	LIST_INIT(&entry->dp.ips_collection);
-	LIST_INIT(&entry->dp.ips_collection_exclude);
-	LIST_INIT(&entry->dp.pf_tcp);
-
-	entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
-	memcpy(entry->dp.hostspell, "host", 4); // default hostspell
-	entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
-	entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+	dp_init(&entry->dp);
 
 	// add to the tail
 	struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
@@ -168,14 +188,23 @@ struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
 
 	return entry;
 }
-static void dp_entry_destroy(struct desync_profile_list *entry)
+static void dp_clear_dynamic(struct desync_profile *dp)
 {
-	hostlist_collection_destroy(&entry->dp.hl_collection);
-	hostlist_collection_destroy(&entry->dp.hl_collection_exclude);
-	ipset_collection_destroy(&entry->dp.ips_collection);
-	ipset_collection_destroy(&entry->dp.ips_collection_exclude);
-	port_filters_destroy(&entry->dp.pf_tcp);
-	HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
+	hostlist_collection_destroy(&dp->hl_collection);
+	hostlist_collection_destroy(&dp->hl_collection_exclude);
+	ipset_collection_destroy(&dp->ips_collection);
+	ipset_collection_destroy(&dp->ips_collection_exclude);
+	port_filters_destroy(&dp->pf_tcp);
+	HostFailPoolDestroy(&dp->hostlist_auto_fail_counters);
+}
+void dp_clear(struct desync_profile *dp)
+{
+	dp_clear_dynamic(dp);
+	memset(dp,0,sizeof(*dp));
+}
+void dp_entry_destroy(struct desync_profile_list *entry)
+{
+	dp_clear_dynamic(&entry->dp);
 	free(entry);
 }
 void dp_list_destroy(struct desync_profile_list_head *head)

tpws/params.h

@@ -6,7 +6,7 @@
 #include <sys/param.h>
 #include <sys/queue.h>
 #include <time.h>
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 #include <wordexp.h>
 #endif
 
@@ -18,6 +18,8 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 
+#define FIX_SEG_DEFAULT_MAX_WAIT		30
+
 enum bindll { unwanted=0, no, prefer, force };
 
 #define MAX_BINDS	32
@@ -29,6 +31,8 @@ struct bind_s
 	int bind_wait_ifup,bind_wait_ip,bind_wait_ip_ll;
 };
 
+#define MAX_SPLITS	16
+
 enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
 
 struct desync_profile
@@ -38,16 +42,16 @@ struct desync_profile
 	bool hostcase, hostdot, hosttab, hostnospace, methodspace, methodeol, unixeol, domcase;
 	int hostpad;
 	char hostspell[4];
-	enum httpreqpos split_http_req;
-	enum tlspos tlsrec;
-	int tlsrec_pos;
-	enum tlspos split_tls;
 	bool split_any_protocol;
-	int split_pos;
 	bool disorder, disorder_http, disorder_tls;
 	bool oob, oob_http, oob_tls;
 	uint8_t oob_byte;
 
+	// multisplit
+	struct proto_pos splits[MAX_SPLITS];
+	int split_count;
+	struct proto_pos tlsrec;
+
 	int mss;
 
 	bool tamper_start_n,tamper_cutoff_n;
@@ -79,11 +83,14 @@ struct desync_profile_list {
 };
 LIST_HEAD(desync_profile_list_head, desync_profile_list);
 struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
+void dp_entry_destroy(struct desync_profile_list *entry);
 void dp_list_destroy(struct desync_profile_list_head *head);
+void dp_init(struct desync_profile *dp);
+void dp_clear(struct desync_profile *dp);
 
 struct params_s
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	wordexp_t wexp; // for file based config
 #endif
 
@@ -100,12 +107,14 @@ struct params_s
 	char connect_bind6_ifname[IF_NAMESIZE];
 
 	uint8_t proxy_type;
+	unsigned int fix_seg;
+	bool fix_seg_avail;
 	bool no_resolve;
 	bool skip_nodelay;
 	bool droproot;
+	bool daemon;
 	uid_t uid;
 	gid_t gid;
-	bool daemon;
 	char pidfile[256];
 	int maxconn,resolver_threads,maxfiles,max_orphan_time;
 	int local_rcvbuf,local_sndbuf,remote_rcvbuf,remote_sndbuf;
@@ -140,6 +149,7 @@ int DLOG_CONDUP(const char *format, ...);
 int DLOG_ERR(const char *format, ...);
 int DLOG_PERROR(const char *s);
 int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);
 
 #define VPRINT(format, ...) DLOG(format, 1, ##__VA_ARGS__)
 #define DBGPRINT(format, ...) DLOG(format, 2, ##__VA_ARGS__)

tpws/pools.c

@@ -154,17 +154,21 @@ void strlist_destroy(struct str_list_head *head)
 
 
 
-
 struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const char *filename)
 {
 	struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
 	if (entry)
+	{
+		if (filename)
 		{
 			if (!(entry->filename = strdup(filename)))
 			{
 				free(entry);
 				return false;
 			}
+		}
+		else
+			entry->filename = NULL;
 		entry->mod_time = 0;
 		entry->hostlist = NULL;
 		LIST_INSERT_HEAD(head, entry, next);
@@ -192,7 +196,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -223,7 +227,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;
@@ -368,12 +372,17 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
 {
 	struct ipset_file *entry = malloc(sizeof(struct ipset_file));
 	if (entry)
+	{
+		if (filename)
 		{
 			if (!(entry->filename = strdup(filename)))
 			{
 				free(entry);
 				return false;
 			}
+		}
+		else
+			entry->filename = NULL;
 		entry->mod_time = 0;
 		memset(&entry->ipset,0,sizeof(entry->ipset));
 		LIST_INSERT_HEAD(head, entry, next);
@@ -401,7 +410,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -432,7 +441,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;

tpws/protocol.c

@@ -7,6 +7,149 @@
 #include <arpa/inet.h>
 #include <string.h>
 
+// find N level domain
+static bool FindNLD(const uint8_t *dom, size_t dlen, int level, const uint8_t **p, size_t *len)
+{
+	int i;
+	const uint8_t *p1,*p2;
+	for (i=1,p2=dom+dlen;i<level;i++)
+	{
+		for (p2--; p2>dom && *p2!='.'; p2--);
+		if (p2<=dom) return false;
+	}
+	for (p1=p2-1 ; p1>dom && *p1!='.'; p1--);
+	if (*p1=='.') p1++;
+	if (p) *p = p1;
+	if (len) *len = p2-p1;
+	return true;
+}
+
+const char *l7proto_str(t_l7proto l7)
+{
+	switch(l7)
+	{
+		case HTTP: return "http";
+		case TLS: return "tls";
+		case QUIC: return "quic";
+		case WIREGUARD: return "wireguard";
+		case DHT: return "dht";
+		default: return "unknown";
+	}
+}
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
+{
+	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
+		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
+		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS)) ||
+		(l7proto==QUIC && (filter_l7 & L7_PROTO_QUIC)) ||
+		(l7proto==WIREGUARD && (filter_l7 & L7_PROTO_WIREGUARD)) ||
+		(l7proto==DHT && (filter_l7 & L7_PROTO_DHT));
+}
+
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+bool IsHostMarker(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			return true;
+		default:
+			return false;
+	}
+}
+const char *posmarker_name(uint8_t posmarker)
+{
+	switch(posmarker)
+	{
+		case PM_ABS: return "abs";
+		case PM_HOST: return "host";
+		case PM_HOST_END: return "endhost";
+		case PM_HOST_SLD: return "sld";
+		case PM_HOST_MIDSLD: return "midsld";
+		case PM_HOST_ENDSLD: return "endsld";
+		case PM_HTTP_METHOD: return "method";
+		case PM_SNI_EXT: return "sniext";
+		default: return "?";
+	}
+}
+
+static size_t CheckPos(size_t sz, ssize_t offset)
+{
+	return (offset>=0 && offset<sz) ? offset : 0;
+}
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
+{
+	ssize_t offset;
+	switch(posmarker)
+	{
+		case PM_ABS:
+			offset = (pos<0) ? sz+pos : pos;
+			return CheckPos(sz,offset);
+		default:
+			return 0;
+	}
+}
+static size_t HostPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz, size_t offset_host, size_t len_host)
+{
+	ssize_t offset;
+	const uint8_t *p;
+	size_t slen;
+
+	switch(posmarker)
+	{
+		case PM_HOST:
+			offset = offset_host+pos;
+			break;
+		case PM_HOST_END:
+			offset = offset_host+len_host+pos;
+			break;
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (((offset_host+len_host)<=sz) && FindNLD(data+offset_host,len_host,2,&p,&slen))
+				offset = (posmarker==PM_HOST_SLD ? p-data : posmarker==PM_HOST_ENDSLD ? p-data+slen : slen==1 ? p+1-data : p+slen/2-data) + pos;
+			else
+				offset = 0;
+			break;
+	}
+	return CheckPos(sz,offset);
+}
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp)
+{
+	switch(l7proto)
+	{
+		case HTTP:
+			return HttpPos(sp->marker, sp->pos, data, sz);
+		case TLS:
+			return TLSPos(sp->marker, sp->pos, data, sz);
+		default:
+			return AnyProtoPos(sp->marker, sp->pos, data, sz);
+	}
+}
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count)
+{
+	int i,j;
+	for(i=j=0;i<split_count;i++)
+	{
+		pos[j] = ResolvePos(data,sz,l7proto,splits+i);
+		if (pos[j]) j++;
+	}
+	qsort_size_t(pos, j);
+	j=unique_size_t(pos, j);
+	*pos_count=j;
+}
+
 
 const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
 const char *HttpMethod(const uint8_t *data, size_t len)
@@ -116,17 +259,6 @@ bool HttpExtractHost(const uint8_t *data, size_t len, char *host, size_t len_hos
 {
 	return HttpExtractHeader(data, len, "\nHost:", host, len_host);
 }
-const char *HttpFind2ndLevelDomain(const char *host)
-{
-	const char *p=NULL;
-	if (*host)
-	{
-		for (p = host + strlen(host)-1; p>host && *p!='.'; p--);
-		if (*p=='.') for (p--; p>host && *p!='.'; p--);
-		if (*p=='.') p++;
-	}
-	return p;
-}
 // DPI redirects are global redirects to another domain
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host)
 {
@@ -157,42 +289,52 @@ bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *
 	// somethinkg like : censor.net
 	
 	// extract 2nd level domains
+	const char *dhost, *drhost;
+	if (!FindNLD((uint8_t*)host,strlen(host),2,(const uint8_t**)&dhost,NULL) || !FindNLD((uint8_t*)redirect_host,strlen(redirect_host),2,(const uint8_t**)&drhost,NULL))
+		return false;
 
-	const char *dhost = HttpFind2ndLevelDomain(host);
-	const char *drhost = HttpFind2ndLevelDomain(redirect_host);
-	
+	// compare 2nd level domains		
 	return strcasecmp(dhost, drhost)!=0;
 }
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz)
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
-	const uint8_t *method, *host=NULL;
+	const uint8_t *method, *host=NULL, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
 	int i;
 	
-	switch(tpos_type)
+	switch(posmarker)
 	{
-		case httpreqpos_method:
+		case PM_HTTP_METHOD:
 			// recognize some tpws pre-applied hacks
-			method=http;
+			method=data;
 			if (sz<10) break;
 			if (*method=='\n' || *method=='\r') method++;
 			if (*method=='\n' || *method=='\r') method++;
-			for (i=0;i<7;i++) if (*method>='A' && *method<='Z') method++;
-			if (i<3 || *method!=' ') break;
-			return method-http-1;
-		case httpreqpos_host:
-			if (HttpFindHostConst(&host,http,sz) && (host-http+7)<sz)
+			for (p=method,i=0;i<7;i++) if (*p>='A' && *p<='Z') p++;
+			if (i<3 || *p!=' ') break;
+			return CheckPos(sz,method-data+pos);
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+			if (HttpFindHostConst(&host,data,sz) && (host-data+7)<sz)
 			{
 				host+=5;
-				if (*host==' ') host++;
-				return host-http;
+				if (*host==' ' || *host=='\t') host++;
+				offset_host = host-data;
+				if (posmarker!=PM_HOST)
+					for (len_host=0; (offset_host+len_host)<sz && data[offset_host+len_host]!='\r' && data[offset_host+len_host]!='\n'; len_host++);
+				else
+					len_host = 0;
+				return HostPos(posmarker,pos,data,sz,offset_host,len_host);
 			}
 			break;
-		case httpreqpos_pos:
-			break;
 		default:
-			return 0;
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
-	return hpos_pos<sz ? hpos_pos : 0;
+	return 0;
 }
 
 
@@ -295,15 +437,24 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 	if (reclen<len) len=reclen; // correct len if it has more data than the first tls record has
 	return TLSFindExtInHandshake(data + 5, len - 5, type, ext, len_ext, bPartialIsOK);
 }
+static bool TLSAdvanceToHostInSNI(const uint8_t **ext, size_t *elen, size_t *slen)
+{
+	// u16	data+0 - name list length
+	// u8	data+2 - server name type. 0=host_name
+	// u16	data+3 - server name length
+	if (*elen < 5 || (*ext)[2] != 0) return false;
+	*slen = pntoh16(*ext + 3);
+	*ext += 5; *elen -= 5;
+	return *slen <= *elen;
+}
 static bool TLSExtractHostFromExt(const uint8_t *ext, size_t elen, char *host, size_t len_host)
 {
 	// u16	data+0 - name list length
 	// u8	data+2 - server name type. 0=host_name
 	// u16	data+3 - server name length
-	if (elen < 5 || ext[2] != 0) return false;
-	size_t slen = pntoh16(ext + 3);
-	ext += 5; elen -= 5;
-	if (slen < elen) return false;
+	size_t slen;
+	if (!TLSAdvanceToHostInSNI(&ext,&elen,&slen))
+		return false;
 	if (host && len_host)
 	{
 		if (slen >= len_host) slen = len_host - 1;
@@ -328,20 +479,55 @@ bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *hos
 	if (!TLSFindExtInHandshake(data, len, 0, &ext, &elen, bPartialIsOK)) return false;
 	return TLSExtractHostFromExt(ext, elen, host, len_host);
 }
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type)
+
+// find N level domain in SNI
+static bool TLSHelloFindNLDInSNI(const uint8_t *ext, size_t elen, int level, const uint8_t **p, size_t *len)
+{
+	size_t slen;
+	return TLSAdvanceToHostInSNI(&ext,&elen,&slen) && FindNLD(ext,slen,level,p,len);
+}
+// find the middle of second level domain (SLD) in SNI ext : www.sobaka.ru => aka.ru
+// return false if SNI ext is bad or SLD is not found
+static bool TLSHelloFindMiddleOfSLDInSNI(const uint8_t *ext, size_t elen, const uint8_t **p)
+{
+	size_t len;
+	if (!TLSHelloFindNLDInSNI(ext,elen,2,p,&len))
+		return false;
+	// in case of one letter SLD (x.com) we split at '.' to prevent appearance of the whole SLD
+	*p = (len==1) ? *p+1 : *p+len/2;
+	return true;
+}
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 {
 	size_t elen;
-	const uint8_t *ext;
-	switch(tpos_type)
+	const uint8_t *ext, *p;
+	size_t offset_host,len_host;
+	ssize_t offset;
+
+	switch(posmarker)
 	{
-		case tlspos_sni:
-		case tlspos_sniext:
-			if (TLSFindExt(tls,sz,0,&ext,&elen,false))
-				return (tpos_type==tlspos_sni) ? ext-tls+6 : ext-tls+1;
-			// fall through
-		case tlspos_pos:
-			return tpos_pos<sz ? tpos_pos : 0;
-		default:
+		case PM_HOST:
+		case PM_HOST_END:
+		case PM_HOST_SLD:
+		case PM_HOST_MIDSLD:
+		case PM_HOST_ENDSLD:
+		case PM_SNI_EXT:
+			if (TLSFindExt(data,sz,0,&ext,&elen,false))
+			{
+				if (posmarker==PM_SNI_EXT)
+				{
+					return CheckPos(sz,ext-data+pos);
+				}
+				else
+				{
+					if (!TLSAdvanceToHostInSNI(&ext,&elen,&len_host))
 						return 0;
+					offset_host = ext-data;
+					return HostPos(posmarker,pos,data,sz,offset_host,len_host);
+				}
+			}
+			return 0;
+		default:
+			return AnyProtoPos(posmarker,pos,data,sz);
 	}
 }

tpws/protocol.h

@@ -4,6 +4,40 @@
 #include <stdint.h>
 #include <stdbool.h>
 
+typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
+#define L7_PROTO_HTTP		0x00000001
+#define L7_PROTO_TLS		0x00000002
+#define L7_PROTO_QUIC		0x00000004
+#define L7_PROTO_WIREGUARD	0x00000008
+#define L7_PROTO_DHT		0x00000010
+#define L7_PROTO_UNKNOWN	0x80000000
+const char *l7proto_str(t_l7proto l7);
+bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7);
+
+// pos markers
+#define PM_ABS		0
+#define PM_HOST		1
+#define PM_HOST_END	2
+#define PM_HOST_SLD	3
+#define PM_HOST_MIDSLD	4
+#define PM_HOST_ENDSLD	5
+#define PM_HTTP_METHOD	6
+#define PM_SNI_EXT	7
+struct proto_pos
+{
+	int16_t pos;
+	uint8_t marker;
+};
+#define PROTO_POS_EMPTY(sp) ((sp)->marker==PM_ABS && (sp)->pos==0)
+bool IsHostMarker(uint8_t posmarker);
+const char *posmarker_name(uint8_t posmarker);
+size_t AnyProtoPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t HttpPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz);
+size_t ResolvePos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *sp);
+void ResolveMultiPos(const uint8_t *data, size_t sz, t_l7proto l7proto, const struct proto_pos *splits, int split_count, size_t *pos, int *pos_count);
+
+
 extern const char *http_methods[9];
 const char *HttpMethod(const uint8_t *data, size_t len);
 bool IsHttp(const uint8_t *data, size_t len);
@@ -18,8 +52,6 @@ const char *HttpFind2ndLevelDomain(const char *host);
 int HttpReplyCode(const uint8_t *data, size_t len);
 // must be pre-checked by IsHttpReply
 bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host);
-enum httpreqpos { httpreqpos_none = 0, httpreqpos_method, httpreqpos_host, httpreqpos_pos };
-size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz);
 
 uint16_t TLSRecordDataLen(const uint8_t *data);
 size_t TLSRecordLen(const uint8_t *data);
@@ -29,5 +61,3 @@ bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **
 bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
 bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
 bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
-enum tlspos { tlspos_none = 0, tlspos_sni, tlspos_sniext, tlspos_pos };
-size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type);

tpws/resolver.c

@@ -221,7 +221,7 @@ bool resolver_init(int threads, int fd_signal_pipe)
 	if (pthread_attr_init(&attr)) goto ex;
 	// set minimum thread stack size
 
-	if (pthread_attr_setstacksize(&attr,PTHREAD_STACK_MIN>20480 ? PTHREAD_STACK_MIN : 20480))
+	if (pthread_attr_setstacksize(&attr,PTHREAD_STACK_MIN>32768 ? PTHREAD_STACK_MIN : 32768))
 	{
 		pthread_attr_destroy(&attr);
 		goto ex;

tpws/tamper.c

@@ -8,20 +8,11 @@
 #include "protocol.h"
 #include "helpers.h"
 
-const char *l7proto_str(t_l7proto l7)
+#define PKTDATA_MAXDUMP 32
+
+void packet_debug(const uint8_t *data, size_t sz)
 {
-	switch(l7)
-	{
-		case HTTP: return "http";
-		case TLS: return "tls";
-		default: return "unknown";
-	}
-}
-static bool l7_proto_match(t_l7proto l7proto, uint32_t filter_l7)
-{
-	return  (l7proto==UNKNOWN && (filter_l7 & L7_PROTO_UNKNOWN)) ||
-		(l7proto==HTTP && (filter_l7 & L7_PROTO_HTTP)) ||
-		(l7proto==TLS && (filter_l7 & L7_PROTO_TLS));
+	hexdump_limited_dlog(data, sz, PKTDATA_MAXDUMP); VPRINT("\n");
 }
 
 static bool dp_match(struct desync_profile *dp, const struct sockaddr *dest, const char *hostname, t_l7proto l7proto)
@@ -87,11 +78,10 @@ void apply_desync_profile(t_ctrack *ctrack, const struct sockaddr *dest)
 
 
 // segment buffer has at least 5 extra bytes to extend data block
-void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *split_pos, uint8_t *split_flags)
+void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *multisplit_pos, int *multisplit_count, uint8_t *split_flags)
 {
 	uint8_t *p, *pp, *pHost = NULL;
-	size_t method_len = 0, pos;
-	size_t tpos, spos;
+	size_t method_len = 0, pos, tpos, orig_size=*size;
 	const char *method;
 	bool bHaveHost = false;
 	char *pc, Host[256];
@@ -116,8 +106,8 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 		return;
 	}
 
-	*split_pos=0;
-	*split_flags=0;
+	if (multisplit_count) *multisplit_count=0;
+	if (split_flags) *split_flags=0;
 
 	if ((method = HttpMethod(segment,*size)))
 	{
@@ -150,11 +140,6 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 
 	if (bHaveHost)
 		VPRINT("request hostname: %s\n", Host);
-	if (ctrack->b_not_act)
-	{
-		VPRINT("Not acting on this request\n");
-		return;
-	}
 
 	bool bDiscoveredL7 = ctrack->l7proto==UNKNOWN && l7proto!=UNKNOWN;
 	if (bDiscoveredL7)
@@ -179,21 +164,28 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 		struct desync_profile *dp_prev = ctrack->dp;
 		apply_desync_profile(ctrack, dest);
 		if (ctrack->dp!=dp_prev)
+		{
 			VPRINT("desync profile changed by revealed l7 protocol or hostname !\n");
+			ctrack->b_host_checked = ctrack->b_ah_check = false;
+		}
 	}
 
-	if (bDiscoveredHostname && ctrack->dp->hostlist_auto)
+	if (l7proto!=UNKNOWN && ctrack->dp->hostlist_auto)
+	{
+		if (bHaveHost && !ctrack->b_host_checked)
 		{
 			bool bHostExcluded;
-		if (!HostlistCheck(ctrack->dp, Host, &bHostExcluded, false))
-		{
+			ctrack->b_host_matches = HostlistCheck(ctrack->dp, Host, &bHostExcluded, false);
+			ctrack->b_host_checked = true;
+			if (!ctrack->b_host_matches)
 				ctrack->b_ah_check = !bHostExcluded;
+		}
+		if (!ctrack->b_host_matches)
+		{
 			VPRINT("Not acting on this request\n");
-			ctrack->b_not_act = true;
 			return;
 		}
 	}
-
 	switch(l7proto)
 	{
 		case HTTP:
@@ -325,22 +317,27 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 					pHost = NULL; // invalidate
 				}
 			}
-			*split_pos = HttpPos(ctrack->dp->split_http_req, ctrack->dp->split_pos, segment, *size);
+			if (multisplit_pos) ResolveMultiPos(segment, *size, l7proto, ctrack->dp->splits, ctrack->dp->split_count, multisplit_pos, multisplit_count);
+			if (split_flags)
+			{
 				if (ctrack->dp->disorder_http) *split_flags |= SPLIT_FLAG_DISORDER;
 				if (ctrack->dp->oob_http) *split_flags |= SPLIT_FLAG_OOB;
+			}
 			break;
 
 		case TLS:
-			spos = TLSPos(ctrack->dp->split_tls, ctrack->dp->split_pos, segment, *size, 0);
+			if (multisplit_pos) ResolveMultiPos(segment, *size, l7proto, ctrack->dp->splits, ctrack->dp->split_count, multisplit_pos, multisplit_count);
 			if ((5+*size)<=segment_buffer_size)
 			{
-				tpos = TLSPos(ctrack->dp->tlsrec, ctrack->dp->tlsrec_pos+5, segment, *size, 0);
+				tpos = ResolvePos(segment, *size, l7proto, &ctrack->dp->tlsrec);
 				if (tpos>5)
 				{
 					// construct 2 TLS records from one
 					uint16_t l = pntoh16(segment+3); // length
 					if (l>=2)
 					{
+						int i;
+						size_t dlen;
 						// length is checked in IsTLSClientHello and cannot exceed buffer size
 						if ((tpos-5)>=l) tpos=5+1;
 						VPRINT("making 2 TLS records at pos %zu\n",tpos);
@@ -351,28 +348,46 @@ void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,
 						phton16(segment+tpos+3,l-(tpos-5));
 						phton16(segment+3,tpos-5);
 						*size += 5;
-						// split pos present and it is not before tlsrec split. increase split pos by tlsrec header size (5 bytes)
-						if (spos && spos>=tpos) spos+=5;
+						VPRINT("-2nd TLS record: ");
+						dlen = tpos<16 ? tpos : 16;
+						packet_debug(segment+tpos-dlen,dlen);
+						VPRINT("+2nd TLS record: ");
+						packet_debug(segment+tpos,*size-tpos);
+						// fix split positions after tlsrec. increase split pos by tlsrec header size (5 bytes)
+						if (multisplit_pos)
+							for(i=0;i<*multisplit_count;i++)
+								if (multisplit_pos[i]>tpos) multisplit_pos[i]+=5;
 					}
 				}
 			}
-
-			if (spos && spos < *size)
-				*split_pos = spos;
-
+			if (split_flags)
+			{
 				if (ctrack->dp->disorder_tls) *split_flags |= SPLIT_FLAG_DISORDER;
 				if (ctrack->dp->oob_tls) *split_flags |= SPLIT_FLAG_OOB;
-			
+			}
 			break;
 
 		default:
-			if (ctrack->dp->split_any_protocol && ctrack->dp->split_pos < *size)
-				*split_pos = ctrack->dp->split_pos;
+			if (multisplit_pos && ctrack->dp->split_any_protocol)
+				ResolveMultiPos(segment, *size, l7proto, ctrack->dp->splits, ctrack->dp->split_count, multisplit_pos, multisplit_count);
 	}
 
+	if (split_flags)
+	{
 		if (ctrack->dp->disorder) *split_flags |= SPLIT_FLAG_DISORDER;
 		if (ctrack->dp->oob) *split_flags |= SPLIT_FLAG_OOB;
 	}
+	if (orig_size!=*size)
+	{
+		VPRINT("segment size changed: %zu -> %zu\n", orig_size, *size);
+	}
+	if (params.debug && multisplit_count && *multisplit_count)
+	{
+		VPRINT("multisplit pos: ");
+		for (int i=0;i<*multisplit_count;i++) VPRINT("%zu ",multisplit_pos[i]);
+		VPRINT("\n");
+	}
+}
 
 static void auto_hostlist_reset_fail_counter(struct desync_profile *dp, const char *hostname, const char *client_ip_port, t_l7proto l7proto)
 {

tpws/tamper.h

@@ -9,28 +9,23 @@
 #define SPLIT_FLAG_DISORDER	0x01
 #define SPLIT_FLAG_OOB		0x02
 
-typedef enum {UNKNOWN=0, HTTP, TLS} t_l7proto;
-#define L7_PROTO_HTTP	1
-#define L7_PROTO_TLS	2
-#define L7_PROTO_UNKNOWN 0x80000000
-const char *l7proto_str(t_l7proto l7);
-
 typedef struct
 {
 	// common state
 	t_l7proto l7proto;
 	bool bTamperInCutoff;
-	bool b_ah_check;
-	bool b_not_act;
+	bool b_host_checked,b_host_matches,b_ah_check;
 	char *hostname;
 	struct desync_profile *dp;		// desync profile cache
 } t_ctrack;
 
 void apply_desync_profile(t_ctrack *ctrack, const struct sockaddr *dest);
 
-void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *split_pos, uint8_t *split_flags);
+void tamper_out(t_ctrack *ctrack, const struct sockaddr *dest, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *multisplit_pos, int *multisplit_count, uint8_t *split_flags);
 void tamper_in(t_ctrack *ctrack, const struct sockaddr *client, uint8_t *segment,size_t segment_buffer_size,size_t *size);
 // connection reset by remote leg
 void rst_in(t_ctrack *ctrack, const struct sockaddr *client);
 // local leg closed connection (timeout waiting response ?)
 void hup_out(t_ctrack *ctrack, const struct sockaddr *client);
+
+void packet_debug(const uint8_t *data, size_t sz);

tpws/tpws.c

@@ -7,7 +7,6 @@
 #include <netinet/in.h>
 #include <netinet/ip.h>
 #include <net/if.h>
-#include <ifaddrs.h>
 #include <netdb.h>
 #include <unistd.h>
 #include <arpa/inet.h>
@@ -25,6 +24,12 @@
 #include <time.h>
 #include <syslog.h>
 
+#ifdef __ANDROID__
+#include "andr/ifaddrs.h"
+#else
+#include <ifaddrs.h>
+#endif
+
 #include "tpws.h"
 
 #ifdef BSD
@@ -122,7 +127,7 @@ static int get_default_ttl(void)
 static void exithelp(void)
 {
 	printf(
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 		" @<config_file>|$<config_file>\t\t; read file for options. must be the only argument. other options are ignored.\n\n"
 #endif
 		" --bind-addr=<v4_addr>|<v6_addr>\t; for v6 link locals append %%interface_name\n"
@@ -164,28 +169,36 @@ static void exithelp(void)
 		" --uid=uid[:gid]\t\t\t; drop root privs\n"
 #if defined(__FreeBSD__)
 		" --enable-pf\t\t\t\t; enable PF redirector support. required in FreeBSD when used with PF firewall.\n"
+#endif
+#if defined(__linux__)
+		" --fix-seg=<int>\t\t\t; fix segmentation failures at the cost of possible slowdown. wait up to N msec (default %u)\n"
 #endif
 		" --debug=0|1|2|syslog|@<filename>\t; 1 and 2 means log to console and set debug level. for other targets use --debug-level.\n"
 		" --debug-level=0|1|2\t\t\t; specify debug level\n"
+		" --dry-run\t\t\t\t; verify parameters and exit with code 0 if successful\n"
 		"\nMULTI-STRATEGY:\n"
 		" --new\t\t\t\t\t; begin new strategy\n"
+		" --skip\t\t\t\t\t; do not use this strategy\n"
 		" --filter-l3=ipv4|ipv6\t\t\t; L3 protocol filter. multiple comma separated values allowed.\n"
 		" --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n"
 		" --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n"
 		" --ipset=<filename>\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
+		" --ipset-ip=<ip_list>\t\t\t; comma separated fixed subnet list\n"
 		" --ipset-exclude=<filename>\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
+		" --ipset-exclude-ip=<ip_list>\t\t; comma separated fixed subnet list\n"
 		"\nHOSTLIST FILTER:\n"
 		" --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
+		" --hostlist-domains=<domain_list>\t; comma separated fixed domain list\n"
 		" --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
+		" --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list\n"
 		" --hostlist-auto=<filename>\t\t; detect DPI blocks and build hostlist automatically\n"
 		" --hostlist-auto-fail-threshold=<int>\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
 		" --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n"
 		" --hostlist-auto-debug=<logfile>\t; debug auto hostlist positives\n"
 		"\nTAMPER:\n"
-		" --split-http-req=method|host\t\t; split at specified logical part of plain http request\n"
-		" --split-tls=sni|sniext\t\t\t; split at specified logical part of TLS ClientHello\n"
-		" --split-pos=<numeric_offset>\t\t; split at specified pos. split-http-req or split-tls take precedence for http.\n"
-		" --split-any-protocol\t\t\t; split not only http and https\n"
+		" --split-pos=N|-N|marker+N|marker-N\t; comma separated list of split positions\n"
+		"\t\t\t\t\t; markers: method,host,endhost,sld,endsld,midsld,sniext\n"
+		" --split-any-protocol\t\t\t; split not only http and TLS\n"
 #if defined(BSD) && !defined(__APPLE__)
 		" --disorder[=http|tls]\t\t\t; when splitting simulate sending second fragment first (BSD sends entire message instead of first fragment, this is not good)\n"
 #else
@@ -203,8 +216,7 @@ static void exithelp(void)
 		" --methodspace\t\t\t\t; add extra space after method\n"
 		" --methodeol\t\t\t\t; add end-of-line before method\n"
 		" --unixeol\t\t\t\t; replace 0D0A to 0A\n"
-		" --tlsrec=sni|sniext\t\t\t; make 2 TLS records. split at specified logical part. don't split if SNI is not present\n"
-		" --tlsrec-pos=<pos>\t\t\t; make 2 TLS records. split at specified pos\n"
+		" --tlsrec=N|-N|marker+N|marker-N\t; make 2 TLS records. split records at specified position.\n"
 #ifdef __linux__
 		" --mss=<int>\t\t\t\t; set client MSS. forces server to split messages but significantly decreases speed !\n"
 #endif
@@ -212,12 +224,15 @@ static void exithelp(void)
 		" --tamper-cutoff=[n]<pos>\t\t; do not tamper anymore after specified outbound stream position. default is unlimited.\n",
 #if defined(__linux__) || defined(__APPLE__)
 		DEFAULT_TCP_USER_TIMEOUT_LOCAL,DEFAULT_TCP_USER_TIMEOUT_REMOTE,
+#endif
+#ifdef __linux__
+		FIX_SEG_DEFAULT_MAX_WAIT,
 #endif
 		HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT, HOSTLIST_AUTO_FAIL_TIME_DEFAULT
 	);
 	exit(1);
 }
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 static void cleanup_args()
 {
 	wordfree(&params.wexp);
@@ -225,7 +240,7 @@ static void cleanup_args()
 #endif
 static void cleanup_params(void)
 {
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	cleanup_args();
 #endif
 
@@ -276,27 +291,131 @@ void save_default_ttl(void)
 	}
 }
 
-bool parse_httpreqpos(const char *s, enum httpreqpos *pos)
+static bool parse_httpreqpos(const char *s, struct proto_pos *sp)
 {
 	if (!strcmp(s, "method"))
-		*pos = httpreqpos_method;
+	{
+		sp->marker = PM_HTTP_METHOD;
+		sp->pos=2;
+	}
 	else if (!strcmp(s, "host"))
-		*pos = httpreqpos_host;
+	{
+		sp->marker = PM_HOST;
+		sp->pos=1;
+	}
 	else
 		return false;
 	return true;
 }
-bool parse_tlspos(const char *s, enum tlspos *pos)
+static bool parse_tlspos(const char *s, struct proto_pos *sp)
 {
 	if (!strcmp(s, "sni"))
-		*pos = tlspos_sni;
+	{
+		sp->marker = PM_HOST;
+		sp->pos=1;
+	}
 	else if (!strcmp(s, "sniext"))
-		*pos = tlspos_sniext;
+	{
+		sp->marker = PM_SNI_EXT;
+		sp->pos=1;
+	}
+	else if (!strcmp(s, "snisld"))
+	{
+		sp->marker = PM_HOST_MIDSLD;
+		sp->pos=0;
+	}
 	else
 		return false;
 	return true;
 }
 
+static bool parse_int16(const char *p, int16_t *v)
+{
+	if (*p=='+' || *p=='-' || *p>='0' && *p<='9')
+	{
+		int i = atoi(p);
+		*v = (int16_t)i;
+		return *v==i; // check overflow
+	}
+	return false;
+}
+static bool parse_posmarker(const char *opt, uint8_t *posmarker)
+{
+	if (!strcmp(opt,"host"))
+		*posmarker = PM_HOST;
+	else if (!strcmp(opt,"endhost"))
+		*posmarker = PM_HOST_END;
+	else if (!strcmp(opt,"sld"))
+		*posmarker = PM_HOST_SLD;
+	else if (!strcmp(opt,"midsld"))
+		*posmarker = PM_HOST_MIDSLD;
+	else if (!strcmp(opt,"endsld"))
+		*posmarker = PM_HOST_ENDSLD;
+	else if (!strcmp(opt,"method"))
+		*posmarker = PM_HTTP_METHOD;
+	else if (!strcmp(opt,"sniext"))
+		*posmarker = PM_SNI_EXT;
+	else
+		return false;
+	return true;
+}
+static bool parse_split_pos(char *opt, struct proto_pos *split)
+{
+	if (parse_int16(opt,&split->pos))
+	{
+		split->marker = PM_ABS;
+		return !!split->pos;
+	}
+	else
+	{
+		char c,*p=opt;
+		bool b;
+
+		for (; *opt && *opt!='+' && *opt!='-'; opt++);
+		c=*opt; *opt=0;
+		b=parse_posmarker(p,&split->marker);
+		*opt=c;
+		if (!b) return false;
+		if (*opt)
+			return parse_int16(opt,&split->pos);
+		else
+			split->pos = 0;
+	}
+	return true;
+}
+static bool parse_split_pos_list(char *opt, struct proto_pos *splits, int splits_size, int *split_count)
+{
+	char c,*e,*p;
+
+	for (p=opt, *split_count=0 ; p && *split_count<splits_size ; (*split_count)++)
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+		if (!parse_split_pos(p,splits+*split_count)) return false;
+		if (e) *e++=c;
+		p = e;
+	}
+	if (p) return false; // too much splits
+	return true;
+}
+static void SplitDebug(void)
+{
+	struct desync_profile_list *dpl;
+	const struct desync_profile *dp;
+	int x;
+	LIST_FOREACH(dpl, &params.desync_profiles, next)
+	{
+		dp = &dpl->dp;
+		for(x=0;x<dp->split_count;x++)
+			VPRINT("profile %d multisplit %s %d\n",dp->n,posmarker_name(dp->splits[x].marker),dp->splits[x].pos);
+		if (!PROTO_POS_EMPTY(&dp->tlsrec))
+			VPRINT("profile %d tlsrec %s %d\n",dp->n,posmarker_name(dp->tlsrec.marker),dp->tlsrec.pos);
+	}
+}
+
 static bool wf_make_l3(char *opt, bool *ipv4, bool *ipv6)
 {
 	char *e,*p,c;
@@ -370,7 +489,47 @@ static bool parse_pf_list(char *opt, struct port_filters_head *pfl)
 	return true;
 }
 
-#ifndef __OpenBSD__
+static bool parse_domain_list(char *opt, strpool **pp)
+{
+	char *e,*p,c;
+
+	for (p=opt ; p ; )
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+
+		if (*p && !AppendHostlistItem(pp,p)) return false;
+
+		if (e) *e++=c;
+		p = e;
+	}
+	return true;
+}
+
+static bool parse_ip_list(char *opt, ipset *pp)
+{
+	char *e,*p,c;
+
+	for (p=opt ; p ; )
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+
+		if (*p && !AppendIpsetItem(pp,p)) return false;
+
+		if (e) *e++=c;
+		p = e;
+	}
+	return true;
+}
+
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 // no static to not allow optimizer to inline this func (save stack)
 void config_from_file(const char *filename)
 {
@@ -397,10 +556,23 @@ void config_from_file(const char *filename)
 }
 #endif
 
+#ifndef __linux__
+static bool check_oob_disorder(const struct desync_profile *dp)
+{
+	return !(
+		dp->oob && (dp->disorder || dp->disorder_http || dp->disorder_tls) ||
+		dp->oob_http && (dp->disorder || dp->disorder_http) ||
+		dp->oob_tls && (dp->disorder || dp->disorder_tls));
+}
+#endif
+
 void parse_params(int argc, char *argv[])
 {
 	int option_index = 0;
 	int v, i;
+	bool bSkip=false, bDry=false;
+	struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL;
+	struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL;
 
 	memset(&params, 0, sizeof(params));
 	params.maxconn = DEFAULT_MAX_CONN;
@@ -415,6 +587,10 @@ void parse_params(int argc, char *argv[])
 	params.pf_enable = true; // OpenBSD and MacOS have no other choice
 #endif
 
+#ifdef __linux__
+	params.fix_seg_avail = socket_supports_notsent();
+#endif
+
 	LIST_INIT(&params.hostlists);
 	LIST_INIT(&params.ipsets);
 
@@ -435,7 +611,7 @@ void parse_params(int argc, char *argv[])
 	dp = &dpl->dp;
 	dp->n = ++desync_profile_count;
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	if (argc>=2 && (argv[1][0]=='@' || argv[1][0]=='$'))
 	{
 		config_from_file(argv[1]+1);
@@ -482,44 +658,51 @@ void parse_params(int argc, char *argv[])
 		{ "tlsrec",required_argument,0,0 },// optidx=34
 		{ "tlsrec-pos",required_argument,0,0 },// optidx=35
 		{ "hostlist",required_argument,0,0 },// optidx=36
-		{ "hostlist-exclude",required_argument,0,0 },// optidx=37
-		{ "hostlist-auto",required_argument,0,0}, // optidx=38
-		{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=39
-		{ "hostlist-auto-fail-time",required_argument,0,0},	// optidx=40
-		{ "hostlist-auto-debug",required_argument,0,0}, // optidx=41
-		{ "pidfile",required_argument,0,0 },// optidx=42
-		{ "debug",optional_argument,0,0 },// optidx=43
-		{ "debug-level",required_argument,0,0 },// optidx=44
-		{ "local-rcvbuf",required_argument,0,0 },// optidx=45
-		{ "local-sndbuf",required_argument,0,0 },// optidx=46
-		{ "remote-rcvbuf",required_argument,0,0 },// optidx=47
-		{ "remote-sndbuf",required_argument,0,0 },// optidx=48
-		{ "socks",no_argument,0,0 },// optidx=40
-		{ "no-resolve",no_argument,0,0 },// optidx=50
-		{ "resolver-threads",required_argument,0,0 },// optidx=51
-		{ "skip-nodelay",no_argument,0,0 },// optidx=52
-		{ "tamper-start",required_argument,0,0 },// optidx=53
-		{ "tamper-cutoff",required_argument,0,0 },// optidx=54
-		{ "connect-bind-addr",required_argument,0,0 },// optidx=55
+		{ "hostlist-domains",required_argument,0,0 },// optidx=37
+		{ "hostlist-exclude",required_argument,0,0 },// optidx=38
+		{ "hostlist-exclude-domains",required_argument,0,0 },// optidx=39
+		{ "hostlist-auto",required_argument,0,0}, // optidx=40
+		{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=41
+		{ "hostlist-auto-fail-time",required_argument,0,0},	// optidx=42
+		{ "hostlist-auto-debug",required_argument,0,0}, // optidx=43
+		{ "pidfile",required_argument,0,0 },// optidx=44
+		{ "debug",optional_argument,0,0 },// optidx=45
+		{ "debug-level",required_argument,0,0 },// optidx=46
+		{ "dry-run",no_argument,0,0 },// optidx=47
+		{ "local-rcvbuf",required_argument,0,0 },// optidx=48
+		{ "local-sndbuf",required_argument,0,0 },// optidx=49
+		{ "remote-rcvbuf",required_argument,0,0 },// optidx=50
+		{ "remote-sndbuf",required_argument,0,0 },// optidx=51
+		{ "socks",no_argument,0,0 },// optidx=52
+		{ "no-resolve",no_argument,0,0 },// optidx=53
+		{ "resolver-threads",required_argument,0,0 },// optidx=54
+		{ "skip-nodelay",no_argument,0,0 },// optidx=55
+		{ "tamper-start",required_argument,0,0 },// optidx=56
+		{ "tamper-cutoff",required_argument,0,0 },// optidx=57
+		{ "connect-bind-addr",required_argument,0,0 },// optidx=58
 
-		{ "new",no_argument,0,0 },				// optidx=56
-		{ "filter-l3",required_argument,0,0 },			// optidx=57
-		{ "filter-tcp",required_argument,0,0 },			// optidx=58
-		{ "filter-l7",required_argument,0,0 },			// optidx=59
-		{ "ipset",required_argument,0,0 },			// optidx=60
-		{ "ipset-exclude",required_argument,0,0 },		// optidx=61
+		{ "new",no_argument,0,0 },				// optidx=59
+		{ "skip",no_argument,0,0 },				// optidx=60
+		{ "filter-l3",required_argument,0,0 },			// optidx=61
+		{ "filter-tcp",required_argument,0,0 },			// optidx=63
+		{ "filter-l7",required_argument,0,0 },			// optidx=64
+		{ "ipset",required_argument,0,0 },			// optidx=65
+		{ "ipset-ip",required_argument,0,0 },			// optidx=66
+		{ "ipset-exclude",required_argument,0,0 },		// optidx=67
+		{ "ipset-exclude-ip",required_argument,0,0 },		// optidx=68
 
 #if defined(__FreeBSD__)
-		{ "enable-pf",no_argument,0,0 },// optidx=62
+		{ "enable-pf",no_argument,0,0 },// optidx=68
 #elif defined(__APPLE__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=62
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=63
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=68
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=69
 #elif defined(__linux__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=62
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=63
-		{ "mss",required_argument,0,0 },			// optidx=64
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=68
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=69
+		{ "mss",required_argument,0,0 },			// optidx=70
+		{ "fix-seg",optional_argument,0,0 },			// optidx=71
 #ifdef SPLICE_PRESENT
-		{ "nosplice",no_argument,0,0 },				// optidx=65
+		{ "nosplice",no_argument,0,0 },				// optidx=72
 #endif
 #endif
 		{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@@ -527,7 +710,11 @@ void parse_params(int argc, char *argv[])
 	};
 	while ((v = getopt_long_only(argc, argv, "", long_options, &option_index)) != -1)
 	{
-		if (v) exithelp_clean();
+		if (v)
+			if (bDry)
+				exit_clean(1);
+			else
+				exithelp_clean();
 		switch (option_index)
 		{
 		case 0:
@@ -680,30 +867,46 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 23: /* split-http-req */
-			if (!parse_httpreqpos(optarg, &dp->split_http_req))
+			DLOG_CONDUP("WARNING ! --split-http-req is deprecated. use --split-pos with markers.\n",MAX_SPLITS);
+			if (dp->split_count>=MAX_SPLITS)
+			{
+				DLOG_ERR("Too much splits. max splits: %u\n",MAX_SPLITS);
+				exit_clean(1);
+			}
+			if (!parse_httpreqpos(optarg, dp->splits + dp->split_count))
 			{
 				DLOG_ERR("Invalid argument for split-http-req\n");
 				exit_clean(1);
 			}
+			dp->split_count++;
 			params.tamper = true;
 			break;
 		case 24: /* split-tls */
-			if (!parse_tlspos(optarg, &dp->split_tls))
+			// obsolete arg
+			DLOG_CONDUP("WARNING ! --split-tls is deprecated. use --split-pos with markers.\n",MAX_SPLITS);
+			if (dp->split_count>=MAX_SPLITS)
+			{
+				DLOG_ERR("Too much splits. max splits: %u\n",MAX_SPLITS);
+				exit_clean(1);
+			}
+			if (!parse_tlspos(optarg, dp->splits + dp->split_count))
 			{
 				DLOG_ERR("Invalid argument for split-tls\n");
 				exit_clean(1);
 			}
+			dp->split_count++;
 			params.tamper = true;
 			break;
 		case 25: /* split-pos */
-			i = atoi(optarg);
-			if (i>0)
-				dp->split_pos = i;
-			else
 			{
-				DLOG_ERR("Invalid argument for split-pos\n");
+				int ct;
+				if (!parse_split_pos_list(optarg,dp->splits+dp->split_count,MAX_SPLITS-dp->split_count,&ct))
+				{
+					DLOG_ERR("could not parse split pos list or too much positions (before parsing - %u, max - %u) : %s\n",dp->split_count,MAX_SPLITS,optarg);
 					exit_clean(1);
 				}
+				dp->split_count += ct;
+			}
 			params.tamper = true;
 			break;
 		case 26: /* split-any-protocol */
@@ -722,7 +925,13 @@ void parse_params(int argc, char *argv[])
 			}
 			else
 				dp->disorder = true;
-			save_default_ttl();
+#ifndef __linux__
+			if (!check_oob_disorder(dp))
+			{
+				DLOG_ERR("--oob and --disorder work simultaneously only in linux. in this system it's guaranteed to fail.\n");
+				exit_clean(1);
+			}
+#endif
 			break;
 		case 28: /* oob */
 			if (optarg)
@@ -737,6 +946,13 @@ void parse_params(int argc, char *argv[])
 			}
 			else
 				dp->oob = true;
+#ifndef __linux__
+			if (!check_oob_disorder(dp))
+			{
+				DLOG_ERR("--oob and --disorder work simultaneously only in linux. in this system it's guaranteed to fail.\n");
+				exit_clean(1);
+			}
+#endif
 			break;
 		case 29: /* oob-data */
 			{
@@ -768,7 +984,7 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 34: /* tlsrec */
-			if (!parse_tlspos(optarg, &dp->tlsrec))
+			if (!parse_split_pos(optarg, &dp->tlsrec) && !parse_tlspos(optarg, &dp->tlsrec))
 			{
 				DLOG_ERR("Invalid argument for tlsrec\n");
 				exit_clean(1);
@@ -776,9 +992,11 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 35: /* tlsrec-pos */
-			if ((dp->tlsrec_pos = atoi(optarg))>0)
-				dp->tlsrec = tlspos_pos;
-			else
+			// obsolete arg
+			i = atoi(optarg);
+			dp->tlsrec.marker = PM_ABS;
+			dp->tlsrec.pos = (int16_t)i;
+			if (!dp->tlsrec.pos || i!=dp->tlsrec.pos)
 			{
 				DLOG_ERR("Invalid argument for tlsrec-pos\n");
 				exit_clean(1);
@@ -786,6 +1004,7 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 36: /* hostlist */
+			if (bSkip) break;
 			if (!RegisterHostlist(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@@ -793,7 +1012,22 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 37: /* hostlist-exclude */
+		case 37: /* hostlist-domains */
+			if (bSkip) break;
+			if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous hostlist\n");
+				exit_clean(1);
+			}
+			if (!parse_domain_list(optarg, &anon_hl->hostlist))
+			{
+				DLOG_ERR("failed to add domains to anonymous hostlist\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
+		case 38: /* hostlist-exclude */
+			if (bSkip) break;
 			if (!RegisterHostlist(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@@ -801,7 +1035,22 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 38: /* hostlist-auto */
+		case 39: /* hostlist-exclude-domains */
+			if (bSkip) break;
+			if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous hostlist\n");
+				exit_clean(1);
+			}
+			if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist))
+			{
+				DLOG_ERR("failed to add domains to anonymous hostlist\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
+		case 40: /* hostlist-auto */
+			if (bSkip) break;
 			if (dp->hostlist_auto)
 			{
 				DLOG_ERR("only one auto hostlist per profile is supported\n");
@@ -821,8 +1070,6 @@ void parse_params(int argc, char *argv[])
 					DLOG_ERR("gzipped auto hostlists are not supported\n");
 					exit_clean(1);
 				}
-				if (params.droproot && chown(optarg, params.uid, -1))
-					DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg);
 			}
 			if (!(dp->hostlist_auto=RegisterHostlist(dp, false, optarg)))
 			{
@@ -831,7 +1078,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice.
 			break;
-		case 39: /* hostlist-auto-fail-threshold */
+		case 41: /* hostlist-auto-fail-threshold */
 			dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
 			{
@@ -839,7 +1086,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 40: /* hostlist-auto-fail-time */
+		case 42: /* hostlist-auto-fail-time */
 			dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_time<1)
 			{
@@ -847,7 +1094,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 41: /* hostlist-auto-debug */
+		case 43: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -856,17 +1103,15 @@ void parse_params(int argc, char *argv[])
 					exit_clean(1);
 				}
 				fclose(F);
-				if (params.droproot && chown(optarg, params.uid, -1))
-					DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg);
 				strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog));
 				params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
 			}
 			break;
-		case 42: /* pidfile */
+		case 44: /* pidfile */
 			strncpy(params.pidfile,optarg,sizeof(params.pidfile));
 			params.pidfile[sizeof(params.pidfile)-1]='\0';
 			break;
-		case 43: /* debug */
+		case 45: /* debug */
 			if (optarg)
 			{
 				if (*optarg=='@')
@@ -879,8 +1124,6 @@ void parse_params(int argc, char *argv[])
 						fprintf(stderr, "cannot create %s\n", params.debug_logfile);
 						exit_clean(1);
 					}
-					if (params.droproot && chown(params.debug_logfile, params.uid, -1))
-						fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
 					if (!params.debug) params.debug = 1;
 					params.debug_target = LOG_TARGET_FILE;
 				}
@@ -902,44 +1145,47 @@ void parse_params(int argc, char *argv[])
 				params.debug_target = LOG_TARGET_CONSOLE;
 			}
 			break;
-		case 44: /* debug-level */
+		case 46: /* debug-level */
 			params.debug = atoi(optarg);
 			break;
-		case 45: /* local-rcvbuf */
+		case 47: /* dry-run */
+			bDry = true;
+			break;
+		case 48: /* local-rcvbuf */
 #ifdef __linux__
 			params.local_rcvbuf = atoi(optarg)/2;
 #else
 			params.local_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 46: /* local-sndbuf */
+		case 49: /* local-sndbuf */
 #ifdef __linux__
 			params.local_sndbuf = atoi(optarg)/2;
 #else
 			params.local_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 47: /* remote-rcvbuf */
+		case 50: /* remote-rcvbuf */
 #ifdef __linux__
 			params.remote_rcvbuf = atoi(optarg)/2;
 #else
 			params.remote_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 48: /* remote-sndbuf */
+		case 51: /* remote-sndbuf */
 #ifdef __linux__
 			params.remote_sndbuf = atoi(optarg)/2;
 #else
 			params.remote_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 49: /* socks */
+		case 52: /* socks */
 			params.proxy_type = CONN_TYPE_SOCKS;
 			break;
-		case 50: /* no-resolve */
+		case 53: /* no-resolve */
 			params.no_resolve = true;
 			break;
-		case 51: /* resolver-threads */
+		case 54: /* resolver-threads */
 			params.resolver_threads = atoi(optarg);
 			if (params.resolver_threads<1 || params.resolver_threads>300)
 			{
@@ -947,10 +1193,10 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 52: /* skip-nodelay */
+		case 55: /* skip-nodelay */
 			params.skip_nodelay = true;
 			break;
-		case 53: /* tamper-start */
+		case 56: /* tamper-start */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -964,7 +1210,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 54: /* tamper-cutoff */
+		case 57: /* tamper-cutoff */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -978,7 +1224,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 55: /* connect-bind-addr */
+		case 58: /* connect-bind-addr */
 			{
 				char *p = strchr(optarg,'%');
 				if (p) *p++=0;
@@ -1006,7 +1252,16 @@ void parse_params(int argc, char *argv[])
 			break;
 
 
-		case 56: /* new */
+		case 59: /* new */
+			if (bSkip)
+			{
+				dp_clear(dp);
+				dp_init(dp);
+				dp->n = desync_profile_count;
+				bSkip = false;
+			}
+			else
+			{
 				if (!(dpl = dp_list_add(&params.desync_profiles)))
 				{
 					DLOG_ERR("desync_profile_add: out of memory\n");
@@ -1014,29 +1269,36 @@ void parse_params(int argc, char *argv[])
 				}
 				dp = &dpl->dp;
 				dp->n = ++desync_profile_count;
+			}
+			anon_hl = anon_hl_exclude = NULL;
+			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 57: /* filter-l3 */
+		case 60: /* skip */
+			bSkip = true;
+			break;
+		case 61: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 58: /* filter-tcp */
+		case 62: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 59: /* filter-l7 */
+		case 63: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 60: /* ipset */
+		case 64: /* ipset */
+			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1044,7 +1306,22 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 61: /* ipset-exclude */
+		case 65: /* ipset-ip */
+			if (bSkip) break;
+			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous ipset\n");
+				exit_clean(1);
+			}
+			if (!parse_ip_list(optarg, &anon_ips->ipset))
+			{
+				DLOG_ERR("failed to add subnets to anonymous ipset\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
+		case 66: /* ipset-exclude */
+			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1052,13 +1329,27 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
+		case 67: /* ipset-exclude-ip */
+			if (bSkip) break;
+			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous ipset\n");
+				exit_clean(1);
+			}
+			if (!parse_ip_list(optarg, &anon_ips_exclude->ipset))
+			{
+				DLOG_ERR("failed to add subnets to anonymous ipset\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
 
 #if defined(__FreeBSD__)
-		case 62: /* enable-pf */
+		case 68: /* enable-pf */
 			params.pf_enable = true;
 			break;
 #elif defined(__linux__) || defined(__APPLE__)
-		case 62: /* local-tcp-user-timeout */
+		case 68: /* local-tcp-user-timeout */
 			params.tcp_user_timeout_local = atoi(optarg);
 			if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
 			{
@@ -1066,7 +1357,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 63: /* remote-tcp-user-timeout */
+		case 69: /* remote-tcp-user-timeout */
 			params.tcp_user_timeout_remote = atoi(optarg);
 			if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
 			{
@@ -1077,7 +1368,7 @@ void parse_params(int argc, char *argv[])
 #endif
 
 #if defined(__linux__)
-		case 64: /* mss */
+		case 70: /* mss */
 			// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
 			dp->mss = atoi(optarg);
 			if (dp->mss<88 || dp->mss>32767)
@@ -1086,14 +1377,40 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
+		case 71: /* fix-seg */
+			if (!params.fix_seg_avail)
+			{
+				DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
+				exit_clean(1);
+			}
+			if (optarg)
+			{
+				i = atoi(optarg);
+				if (i < 0 || i > 1000)
+				{
+					DLOG_ERR("fix_seg value must be within 0..1000\n");
+					exit_clean(1);
+				}
+				params.fix_seg = i;
+			}
+			else
+				params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
+			break;
 #ifdef SPLICE_PRESENT
-		case 65: /* nosplice */
+		case 72: /* nosplice */
 			params.nosplice = true;
 			break;
 #endif
 #endif
 		}
 	}
+	if (bSkip)
+	{
+		LIST_REMOVE(dpl,next);
+		dp_entry_destroy(dpl);
+		desync_profile_count--;
+	}
+
 	if (!params.bind_wait_only && !params.port)
 	{
 		DLOG_ERR("Need port number\n");
@@ -1115,16 +1432,21 @@ void parse_params(int argc, char *argv[])
 
 	DLOG_CONDUP("we have %d user defined desync profile(s) and default low priority profile 0\n",desync_profile_count);
 
+	save_default_ttl();
+	if (params.debug_target == LOG_TARGET_FILE && params.droproot && chown(params.debug_logfile, params.uid, -1))
+		fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
+	if (params.droproot && *params.hostlist_auto_debuglog && chown(params.hostlist_auto_debuglog, params.uid, -1))
+		DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", params.hostlist_auto_debuglog);
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		dp = &dpl->dp;
-		if (dp->split_tls==tlspos_none && dp->split_pos) dp->split_tls=tlspos_pos;
-		if (dp->split_http_req==httpreqpos_none && dp->split_pos) dp->split_http_req=httpreqpos_pos;
-		if (params.skip_nodelay && (dp->split_tls || dp->split_http_req || dp->split_pos))
+		if (params.skip_nodelay && dp->split_count)
 		{
 			DLOG_ERR("Cannot split with --skip-nodelay\n");
 			exit_clean(1);
 		}
+		if (params.droproot && dp->hostlist_auto && chown(dp->hostlist_auto->filename, params.uid, -1))
+			DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", dp->hostlist_auto->filename);
 	}
 
 	if (!LoadAllHostLists())
@@ -1141,12 +1463,20 @@ void parse_params(int argc, char *argv[])
 	VPRINT("\nlists summary:\n");
 	HostlistsDebug();
 	IpsetsDebug();
+
+	VPRINT("\nsplits summary:\n");
+	SplitDebug();
 	VPRINT("\n");
 
-#ifndef __OpenBSD__
+#if !defined( __OpenBSD__) && !defined(__ANDROID__)
 	// do not need args from file anymore
 	cleanup_args();
 #endif
+	if (bDry)
+	{
+		DLOG_CONDUP("command line parameters verified\n");
+		exit_clean(0);
+	}
 }
 
 
@@ -1296,15 +1626,27 @@ struct salisten_s
 	int bind_wait_ip_left; // how much seconds left from bind_wait_ip
 };
 static const char *bindll_s[] = { "unwanted","no","prefer","force" };
+
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 int main(int argc, char *argv[])
 {
 	int i, listen_fd[MAX_BINDS], yes = 1, retval = 0, if_index, exit_v=EXIT_FAILURE;
 	struct salisten_s list[MAX_BINDS];
 	char ip_port[48];
 
+	set_env_exedir(argv[0]);
 	srand(time(NULL));
 	mask_from_preflen6_prepare();
 
+	PRINT_VER;
+
 	parse_params(argc, argv);
 	argv=NULL; argc=0;
 

tpws/tpws_conn.c

@@ -24,7 +24,6 @@
 #include "helpers.h"
 #include "hostlist.h"
 
-
 // keep separate legs counter. counting every time thousands of legs can consume cpu
 static int legs_local, legs_remote;
 /*
@@ -93,25 +92,37 @@ static bool socks_send_rep_errno(uint8_t ver, int fd, int errn)
 }
 
 
+static bool cork(int fd, int enable)
+{
+#ifdef __linux__
+	int e = errno;
+	if (setsockopt(fd, SOL_TCP, TCP_CORK, &enable, sizeof(enable))<0)
+	{
+		DLOG_PERROR("setsockopt (TCP_CORK)");
+		errno = e;
+		return false;
+	}
+	errno = e;
+#endif
+	return true;
+}
+
 ssize_t send_with_ttl(int fd, const void *buf, size_t len, int flags, int ttl)
 {
 	ssize_t wr;
 
-	if (ttl)
+	if (!params.skip_nodelay)
 	{
+		int ttl_apply = ttl ? ttl : params.ttl_default;
 		DBGPRINT("send_with_ttl %d fd=%d\n",ttl,fd);
-		if (!set_ttl_hl(fd, ttl))
+		if (!set_ttl_hl(fd, ttl_apply))
 			//DLOG_ERR("could not set ttl %d to fd=%d\n",ttl,fd);
-			DLOG_ERR("could not set ttl %d to fd=%d\n",ttl,fd);
+			DLOG_ERR("could not set ttl %d to fd=%d\n",ttl_apply,fd);
+		cork(fd,true);
 	}
 	wr = send(fd, buf, len, flags);
-	if (ttl)
-	{
-		int e=errno;
-		if (!set_ttl_hl(fd, params.ttl_default))
-			DLOG_ERR("could not set ttl %d to fd=%d\n",params.ttl_default,fd);
-		errno=e;
-	}
+	if (!params.skip_nodelay)
+		cork(fd,false);
 	return wr;
 }
 
@@ -308,19 +319,18 @@ bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
 	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) <0)
 	{
 		DLOG_PERROR("setsockopt (SO_RCVBUF)");
-		close(fd);
 		return false;
 	}
 	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) <0)
 	{
 		DLOG_PERROR("setsockopt (SO_SNDBUF)");
-		close(fd);
 		return false;
 	}
 	dbgprint_socket_buffers(fd);
 	return true;
 }
 
+
 static bool proxy_remote_conn_ack(tproxy_conn_t *conn, int sock_err)
 {
 	// if proxy mode acknowledge connection request
@@ -393,7 +403,10 @@ static int connect_remote(const struct sockaddr *remote_addr, int mss)
 		return -1;
 	}
 	if (!set_socket_buffers(remote_fd, params.remote_rcvbuf, params.remote_sndbuf))
+	{
+		close(remote_fd);
 		return -1;
+	}
 	if (!set_keepalive(remote_fd))
 	{
 		DLOG_PERROR("set_keepalive");
@@ -466,6 +479,33 @@ static int connect_remote(const struct sockaddr *remote_addr, int mss)
 	return remote_fd;
 }
 
+static bool connect_remote_conn(tproxy_conn_t *conn)
+{
+	int mss=0;
+
+	apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
+
+	if (conn->track.dp && conn->track.dp->mss)
+	{
+		mss = conn->track.dp->mss;
+		if (conn->track.dp->hostlist_auto)
+		{
+			if (conn->track.hostname)
+			{
+				bool bHostExcluded;
+				conn->track.b_host_matches = HostlistCheck(conn->track.dp, conn->track.hostname, &bHostExcluded, false);
+				conn->track.b_host_checked = true;
+				if (!conn->track.b_host_matches)
+				{
+					conn->track.b_ah_check = !bHostExcluded;
+					mss = 0;
+				}
+			}
+		}
+	}
+
+	return (conn->partner->fd = connect_remote((struct sockaddr *)&conn->dest, mss))>=0;
+}
 
 //Free resources occupied by this connection
 static void free_conn(tproxy_conn_t *conn)
@@ -623,9 +663,7 @@ static tproxy_conn_t* add_tcp_connection(int efd, struct tailhead *conn_list,int
 		conn->partner->client = conn->client;
 		conn->partner->dest = conn->dest;
 
-		apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
-
-		if ((conn->partner->fd = connect_remote((struct sockaddr *)&orig_dst, conn->track.dp ? conn->track.dp->mss : 0)) < 0)
+		if (!connect_remote_conn(conn))
 		{
 			DLOG_ERR("Failed to connect\n");
 			free_conn(conn->partner);
@@ -798,14 +836,6 @@ static bool proxy_mode_connect_remote(tproxy_conn_t *conn, struct tailhead *conn
 		return false;
 	}
 
-	apply_desync_profile(&conn->track, (struct sockaddr *)&conn->dest);
-
-	if ((remote_fd = connect_remote((struct sockaddr *)&conn->dest, conn->track.dp ? conn->track.dp->mss : 0)) < 0)
-	{
-		DLOG_ERR("socks failed to connect (1) errno=%d\n", errno);
-		socks_send_rep_errno(conn->socks_ver, conn->fd, errno);
-		return false;
-	}
 	if (!(conn->partner = new_conn(remote_fd, true)))
 	{
 		close(remote_fd);
@@ -817,6 +847,15 @@ static bool proxy_mode_connect_remote(tproxy_conn_t *conn, struct tailhead *conn
 	conn->partner->efd = conn->efd;
 	conn->partner->client = conn->client;
 	conn->partner->dest = conn->dest;
+
+	if (!connect_remote_conn(conn))
+	{
+		free_conn(conn->partner); conn->partner = NULL;
+		DLOG_ERR("socks failed to connect (1) errno=%d\n", errno);
+		socks_send_rep_errno(conn->socks_ver, conn->fd, errno);
+		return false;
+	}
+
 	if (!epoll_set(conn->partner, EPOLLOUT))
 	{
 		DLOG_ERR("socks epoll_set error %d\n", errno);
@@ -1068,9 +1107,9 @@ static bool in_tamper_out_range(tproxy_conn_t *conn)
 		 
 }
 
-static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_size, size_t *segment_size, size_t *split_pos, uint8_t *split_flags)
+static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_size, size_t *segment_size, size_t *multisplit_pos, int *multisplit_count, uint8_t *split_flags)
 {
-	*split_pos=0;
+	if (multisplit_count) *multisplit_count=0;
 	if (params.tamper)
 	{
 		if (conn->remote)
@@ -1081,32 +1120,48 @@ static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_
 		else
 		{
 			if (in_tamper_out_range(conn))
-				tamper_out(&conn->track,(struct sockaddr*)&conn->dest,segment,segment_buffer_size,segment_size,split_pos,split_flags);
+				tamper_out(&conn->track,(struct sockaddr*)&conn->dest,segment,segment_buffer_size,segment_size,multisplit_pos,multisplit_count,split_flags);
 		}
 	}
 }
 
 // buffer must have at least one extra byte for OOB
-static ssize_t send_or_buffer_oob(send_buffer_t *sb, int fd, uint8_t *buf, size_t len, int ttl, bool oob, uint8_t oob_byte)
+static ssize_t send_oob(int fd, uint8_t *buf, size_t len, int ttl, bool oob, uint8_t oob_byte)
 {
 	ssize_t wr;
 	if (oob)
 	{
-		VPRINT("Sending OOB byte %02X\n", oob_byte);
 		uint8_t oob_save;
 		oob_save = buf[len];
 		buf[len] = oob_byte;
-		wr = send_or_buffer(sb, fd, buf, len+1, MSG_OOB, ttl);
+		wr = send_with_ttl(fd, buf, len+1, MSG_OOB, ttl);
 		buf[len] = oob_save;
+		if (wr<0 && errno==EAGAIN) wr=0;
 	}
 	else
-		wr = send_or_buffer(sb, fd, buf, len, 0, ttl);
+		wr = send_with_ttl(fd, buf, len, 0, ttl);
 	return wr;
 }
 
 
+static unsigned int segfail_count=0;
+static time_t segfail_report_time=0;
+static void report_segfail(void)
+{
+	time_t now = time(NULL);
+	segfail_count++;
+	if (now==segfail_report_time)
+		VPRINT("WARNING ! segmentation failed. total fails : %u\n", segfail_count);
+	else
+	{
+		DLOG_ERR("WARNING ! segmentation failed. total fails : %u\n", segfail_count);
+		segfail_report_time = now;
+	}
+}
+
 #define RD_BLOCK_SIZE 65536
 #define MAX_WASTE (1024*1024)
+
 static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32_t evt)
 {
 	int numbytes;
@@ -1186,36 +1241,71 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
 #endif
 		{
 			// incoming data from local leg
-			uint8_t buf[RD_BLOCK_SIZE + 5];
+			uint8_t buf[RD_BLOCK_SIZE + 6];
 
 			rd = recv(conn->fd, buf, RD_BLOCK_SIZE, MSG_DONTWAIT);
 			DBGPRINT("recv fd=%d rd=%zd err=%d\n",conn->fd, rd,errno);
 			if (rd<0 && errno==EAGAIN) rd=0;
 			if (rd>0)
 			{
-				size_t split_pos;
+				size_t multisplit_pos[MAX_SPLITS];
+				int multisplit_count;
+
 				uint8_t split_flags;
 
 				bs = rd;
 
 				// tamper needs to know stream position of the block start
-				tamper(conn, buf, sizeof(buf), &bs, &split_pos, &split_flags);
+				tamper(conn, buf, sizeof(buf), &bs, multisplit_pos, &multisplit_count, &split_flags);
 				// increase after tamper
 				conn->tnrd++;
 				conn->trd+=rd;
 
-				if (split_pos && bs<sizeof(buf) && split_pos<sizeof(buf))
+				if (multisplit_count)
 				{
-					VPRINT("Splitting at pos %zu%s\n", split_pos, (split_flags & SPLIT_FLAG_DISORDER) ? " with disorder" : "");
+					ssize_t from,to,len;
+					int i;
+					bool bApplyDisorder, bApplyOOB;
+					for (i=0,from=0;i<=multisplit_count;i++)
+					{
+						to = i==multisplit_count ? bs : multisplit_pos[i];
 
-					wr = send_or_buffer_oob(conn->partner->wr_buf, conn->partner->fd, buf, split_pos, !!(split_flags & SPLIT_FLAG_DISORDER), !!(split_flags & SPLIT_FLAG_OOB), conn->track.dp ? conn->track.dp->oob_byte : 0);
-					DBGPRINT("send_or_buffer(1) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
-					if (wr >= 0)
+						bApplyDisorder = !(i & 1) && i<multisplit_count && (split_flags & SPLIT_FLAG_DISORDER);
+						bApplyOOB = i==0 && (split_flags & SPLIT_FLAG_OOB);
+						len = to-from;
+#ifdef __linux__
+						if (params.fix_seg_avail)
 						{
+							if (params.fix_seg)
+							{
+								unsigned int wasted;
+								bool bWaitOK = socket_wait_notsent(conn->partner->fd, params.fix_seg, &wasted);
+								if (wasted)
+									VPRINT("WARNING ! wasted %u ms to fix segmenation\n", wasted);
+								if (!bWaitOK)
+									report_segfail();
+							}
+							else
+							{
+								if (socket_has_notsent(conn->partner->fd))
+									report_segfail();
+							}
+						}
+#endif
+						VPRINT("Sending multisplit part %d %zd-%zd (len %zd)%s%s : ", i+1, from, to, len, bApplyDisorder ? " with disorder" : "", bApplyOOB ? " with OOB" : "");
+						packet_debug(buf+from,len);
+						wr = send_oob(conn->partner->fd, buf+from, len, bApplyDisorder, bApplyOOB, conn->track.dp ? conn->track.dp->oob_byte : 0);
+						if (wr<0) break;
 						conn->partner->twr += wr;
-						wr = send_or_buffer(conn->partner->wr_buf + 1, conn->partner->fd, buf + split_pos, bs - split_pos, 0, 0);
-						DBGPRINT("send_or_buffer(2) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
+						if (wr<len)
+						{
+							from+=wr;
+							VPRINT("Cannot send part %d immediately. only %zd bytes were sent (%zd left in segment). cancelling split.\n", i+1, wr, bs-from);
+							wr = send_or_buffer(conn->partner->wr_buf, conn->partner->fd, buf+from, bs-from, 0, 0);
 							if (wr>0) conn->partner->twr += wr;
+							break;
+						}
+						from = to;
 					}
 				}
 				else
@@ -1279,7 +1369,7 @@ static bool read_all_and_buffer(tproxy_conn_t *conn, int buffer_number)
 		DBGPRINT("read_all_and_buffer(%d) numbytes=%d\n",buffer_number,numbytes);
 		if (numbytes>0)
 		{
-			if (send_buffer_create(conn->partner->wr_buf+buffer_number, NULL, numbytes, 5, 0, 0))
+			if (send_buffer_create(conn->partner->wr_buf+buffer_number, NULL, numbytes, 6, 0, 0))
 			{
 				ssize_t rd = recv(conn->fd, conn->partner->wr_buf[buffer_number].data, numbytes, MSG_DONTWAIT);
 				if (rd>0)
@@ -1289,10 +1379,7 @@ static bool read_all_and_buffer(tproxy_conn_t *conn, int buffer_number)
 
 					conn->partner->bFlowOut = true;
 
-					size_t split_pos;
-					uint8_t split_flags;
-
-					tamper(conn, conn->partner->wr_buf[buffer_number].data, numbytes+5, &conn->partner->wr_buf[buffer_number].len, &split_pos, &split_flags);
+					tamper(conn, conn->partner->wr_buf[buffer_number].data, numbytes+6, &conn->partner->wr_buf[buffer_number].len, NULL, NULL, NULL);
 
 					if (epoll_update_flow(conn->partner))
 						return true;
@@ -1369,7 +1456,7 @@ static bool handle_resolve_pipe(tproxy_conn_t **conn, struct tailhead *conn_list
 	else if (rd!=sizeof(void*))
 	{
 		// partial pointer read is FATAL. in any case it will cause pointer corruption and coredump
-		DLOG_ERR("resolve_pipe not full read %zu\n",rd);
+		DLOG_ERR("resolve_pipe not full read %zd\n",rd);
 		exit(1000);
 	}
 	b = resolve_complete(ri, conn_list);
@@ -1591,7 +1678,6 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
 						}
 						else
 						{
-
 							DBGPRINT("conn fd=%d has no unsent\n", conn->fd);
 							conn->bFlowIn = false;
 							epoll_update_flow(conn);