update docs

github: minor

.github/issue_template.md

@@ -0,0 +1,10 @@
+1. Здесь не место для вопросов, касающихся компьютерной грамотности и навыков использования ОС
+2. Здесь не место для вопросов "у меня не работает" без технических подробностей
+3. Здесь не место для вопросов "как мне открыть ютуб" или "что писать в ..."
+4. Здесь не место для обсуждения сборок
+5. Вирусов здесь нет. У вас либо чья-то сборка, либо ваш антивирус давно пора отправить на покой. Не согласны - удаляйте софт.
+
+Все означенное обсуждать в дискуссиях или на форумах.
+При нарушении будет закрываться или конвертироваться в дискуссии.
+Issue только для обсуждения проблем самого софта. Неработа стратегии или ваше неумение настроить - это ваша проблема, а не проблема софта.
+

.github/workflows/build.yml

@@ -82,10 +82,6 @@ jobs:
           export STRIP=$TARGET-strip
           export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
 
-          # optimize for size
-          export CFLAGS="-Os -flto=auto"
-          export LDFLAGS="-Os"
-
           # netfilter libs
           wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
           wget -qO- https://www.netfilter.org/pub/libmnl/libmnl-1.0.5.tar.bz2 | tar -xj
@@ -94,6 +90,7 @@ jobs:
           for i in libmnl libnfnetlink libnetfilter_queue ; do
             (
               cd $i-*
+              CFLAGS="-Os -flto=auto" \
               ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
               make install -j$(nproc) DESTDIR=$DEPS_DIR
             )
@@ -105,6 +102,7 @@ jobs:
             xargs -I{} wget -qO- https://github.com/madler/zlib/archive/refs/tags/{}.tar.gz | tar -xz
           (
             cd zlib-*
+            CFLAGS="-Os -flto=auto" \
             ./configure --prefix= --static
             make install -j$(nproc) DESTDIR=$DEPS_DIR
           )
@@ -115,8 +113,8 @@ jobs:
           install -Dm644 -t $DEPS_DIR/include/sys /usr/include/x86_64-linux-gnu/sys/queue.h /usr/include/sys/capability.h
 
           # zapret
-          CFLAGS="$CFLAGS -static-libgcc -static -I$DEPS_DIR/include" \
+          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include" \
-          LDFLAGS="$LDFLAGS -L$DEPS_DIR/lib" \
+          LDFLAGS="-L$DEPS_DIR/lib" \
           make -C zapret -j$(nproc)
           tar -C zapret/binaries/my -cJf zapret-linux-$ARCH.tar.xz .
 
@@ -136,6 +134,7 @@ jobs:
 
       - name: Build zapret
         run: |
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
           make mac -j$(sysctl -n hw.logicalcpu)
           tar -C binaries/my -cJf zapret-mac-x64.tar.xz .
 
@@ -170,7 +169,8 @@ jobs:
           TARGET: ${{ matrix.target }}
           ARCH: ${{ matrix.arch }}
         run: |
-          settarget $TARGET-freebsd11 make bsd -j$(nproc) || exit 1
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
+          settarget $TARGET-freebsd11 make bsd -j$(nproc)
           tar -C binaries/my -cJf zapret-freebsd-$ARCH.tar.xz .
 
       - name: Upload artifacts
@@ -203,6 +203,7 @@ jobs:
       - name: Build ip2net, mdig
         shell: msys2 {0}
         run: |
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}"
           mkdir -p output
           cd zapret
           mingw32-make -C ip2net win
@@ -259,6 +260,7 @@ jobs:
         shell: C:\cygwin\bin\bash.exe -eo pipefail '{0}'
         run: >-
           export MAKEFLAGS=-j$(nproc) &&
+          export CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }}" &&
           cd zapret &&
           make -C nfq ${TARGET} &&
           cp -a nfq/winws.exe ../output
@@ -317,10 +319,6 @@ jobs:
           export STRIP=$TOOLCHAIN/bin/llvm-strip
           export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
 
-          # optimize for size
-          export CFLAGS="-Os -flto=auto"
-          export LDFLAGS="-Os"
-
           # netfilter libs
           wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
           wget -qO- https://www.netfilter.org/pub/libmnl/libmnl-1.0.5.tar.bz2 | tar -xj
@@ -330,7 +328,7 @@ jobs:
           for i in libmnl libnfnetlink libnetfilter_queue ; do
             (
               cd $i-*
-              CFLAGS="$CFLAGS -Wno-implicit-function-declaration" \
+              CFLAGS="-Os -flto=auto -Wno-implicit-function-declaration" \
               ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
               make install -j$(nproc) DESTDIR=$DEPS_DIR
             )
@@ -338,7 +336,8 @@ jobs:
           done
 
           # zapret
-          CFLAGS="$CFLAGS -I$DEPS_DIR/include" LDFLAGS="$LDFLAGS -L$DEPS_DIR/lib" \
+          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -I$DEPS_DIR/include" \
+          LDFLAGS="-L$DEPS_DIR/lib" \
           make -C zapret android -j$(nproc)
           zip zapret-android-$ABI.zip -j zapret/binaries/my/*
 
@@ -434,8 +433,16 @@ jobs:
       - name: Create release bundles
         run: |
           rm -rf ${{ env.repo_dir }}/.git*
-          tar -czf ${{ env.repo_dir }}.tar.gz ${{ env.repo_dir }}
+          find ${{ env.repo_dir }}/binaries -type f -exec sha256sum {} \; >sha256sum.txt
+          tar --owner=0 --group=0 -czf ${{ env.repo_dir }}.tar.gz ${{ env.repo_dir }}
           zip -qr ${{ env.repo_dir }}.zip ${{ env.repo_dir }}
+          (
+            cd ${{ env.repo_dir }}
+            rm -rf binaries/{android*,freebsd*,mac*,win*,x86_64/tpws_wsl.tgz} \
+                   init.d/{openrc,macos,pfsense,runit,s6,systemd} \
+                   tpws nfq ip2net mdig docs files/huawei Makefile
+          )
+          tar --owner=0 --group=0 -czf ${{ env.repo_dir }}-openwrt-embedded.tar.gz ${{ env.repo_dir }}
 
       - name: Upload release assets
         uses: softprops/action-gh-release@v2
@@ -448,3 +455,4 @@ jobs:
           files: |
             zapret*.tar.gz
             zapret*.zip
+            sha256sum.txt

blockcheck.sh

@@ -1011,11 +1011,10 @@ tpws_curl_test()
 	echo - checking tpws $3 $4 $5 $6 $7 $8 $9${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}
 	local ALL_PROXY="socks5://127.0.0.1:$SOCKS_PORT"
 	ws_curl_test tpws_start "$@"${TPWS_EXTRA:+ $TPWS_EXTRA}${TPWS_EXTRA_1:+ "$TPWS_EXTRA_1"}${TPWS_EXTRA_2:+ "$TPWS_EXTRA_2"}${TPWS_EXTRA_3:+ "$TPWS_EXTRA_3"}${TPWS_EXTRA_4:+ "$TPWS_EXTRA_4"}${TPWS_EXTRA_5:+ "$TPWS_EXTRA_5"}${TPWS_EXTRA_6:+ "$TPWS_EXTRA_6"}${TPWS_EXTRA_7:+ "$TPWS_EXTRA_7"}${TPWS_EXTRA_8:+ "$TPWS_EXTRA_8"}${TPWS_EXTRA_9:+ "$TPWS_EXTRA_9"}
-	local code=$?
+	local testf=$1 dom=$2 strategy code=$?
 	[ "$code" = 0 ] && {
-		local testf=$1 dom=$2
 		shift; shift;
-		local strategy="$@"
+		strategy="$@"
 		strategy_append_extra_tpws
 		report_append "ipv${IPV} $dom $testf : tpws ${WF:+$WF }$strategy"
 	}
@@ -1028,11 +1027,10 @@ pktws_curl_test()
 	# $3,$4,$5, ... - nfqws/dvtws params
 	echo - checking $PKTWSD ${WF:+$WF }$3 $4 $5 $6 $7 $8 $9${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}
 	ws_curl_test pktws_start "$@"${PKTWS_EXTRA:+ $PKTWS_EXTRA}${PKTWS_EXTRA_1:+ "$PKTWS_EXTRA_1"}${PKTWS_EXTRA_2:+ "$PKTWS_EXTRA_2"}${PKTWS_EXTRA_3:+ "$PKTWS_EXTRA_3"}${PKTWS_EXTRA_4:+ "$PKTWS_EXTRA_4"}${PKTWS_EXTRA_5:+ "$PKTWS_EXTRA_5"}${PKTWS_EXTRA_6:+ "$PKTWS_EXTRA_6"}${PKTWS_EXTRA_7:+ "$PKTWS_EXTRA_7"}${PKTWS_EXTRA_8:+ "$PKTWS_EXTRA_8"}${PKTWS_EXTRA_9:+ "$PKTWS_EXTRA_9"}
-	local code=$?
+	local testf=$1 dom=$2 strategy code=$?
 	[ "$code" = 0 ] && {
-		local testf=$1 dom=$2
 		shift; shift;
-		local strategy="$@"
+		strategy="$@"
 		strategy_append_extra_pktws
 		report_append "ipv${IPV} $dom $testf : $PKTWSD ${WF:+$WF }$strategy"
 	}
@@ -1112,6 +1110,10 @@ test_has_split()
 {
 	contains "$1" split || contains "$1" disorder
 }
+test_has_fakedsplit()
+{
+	contains "$1" fakedsplit || contains "$1" fakeddisorder
+}
 test_has_fake()
 {
 	[ "$1" = fake ] || starts_with "$1" fake,
@@ -1138,10 +1140,13 @@ pktws_curl_test_update_vary()
 	proto=http
 	[ "$sec" = 0 ] || proto=tls
 	test_has_fake $desync && zerofake="--dpi-desync-fake-$proto=0x00000000"
-	test_has_split $desync && {
+	if test_has_fakedsplit $desync ; then
+		splits="method+2 midsld"
+		[ "$sec" = 0 ] || splits="1 midsld"
+	elif test_has_split $desync ; then
 		splits="method+2 midsld"
 		[ "$sec" = 0 ] || splits="1 midsld 1,midsld"
-	}
+	fi
 	for fake in '' $zerofake ; do
 		if [ -n "$splits" ]; then
 			for pos in $splits ; do

docs/changes.txt

@@ -400,3 +400,15 @@ v69.2:
 nfqws,tpws: --skip
 nfqws: --methodeol
 init.d: do not use pgrep in sysv for busybox compat
+
+v69.3
+
+nfqws,tpws: fixed ipsets and hostlists
+all progs: version numbers for github, build date/time for self built
+repo: light release for openwrt and embedded systems
+repo: sha256sum
+
+v69.4
+
+nfqws : fakedsplit/fakeddisorder fakes for both split segments
+nfqws : --dpi-desync-fakedsplit-pattern

docs/quick_start.md

@@ -50,6 +50,8 @@
 > образ `squashfs` с помощью `image builder` и перешить этим вариантом роутер.
 
 1. Скачайте последний [tar.gz релиз](https://github.com/bol-van/zapret/releases) в /tmp, распакуйте его, затем удалите архив.
+   Для openwrt и прошивок используйте вариант `openwrt-embedded`.
+   Для экономия места в /tmp можно качать через curl в stdout и сразу распаковывать.
 
 2. Убедитесь, что у вас отключены все средства обхода блокировок, в том числе и
    сам zapret. Гарантированно уберет zapret скрипт `uninstall_easy.sh`.

docs/readme.en.md

@@ -1,4 +1,4 @@
-# zapret v.69
+# zapret v69.4
 
 # SCAMMER WARNING
 
@@ -162,6 +162,7 @@ nfqws takes the following parameters:
                                                 ; fakedsplit/fakeddisorder use first l7-protocol-compatible parameter if present, first abs value otherwise
  --dpi-desync-split-seqovl=N|-N|marker+N|marker-N ; use sequence overlap before first sent original split segment
  --dpi-desync-split-seqovl-pattern=<filename>|0xHEX ; pattern for the fake part of overlap
+ --dpi-desync-fakedsplit-pattern=<filename>|0xHEX ; fake pattern for fakedsplit/fakeddisorder
  --dpi-desync-ipfrag-pos-tcp=<8..9216>          ; ip frag position starting from the transport header. multiple of 8, default 8.
  --dpi-desync-ipfrag-pos-udp=<8..9216>          ; ip frag position starting from the transport header. multiple of 8, default 32.
  --dpi-desync-badseq-increment=<int|0xHEX>      ; badseq fooling seq signed increment. default -10000
@@ -180,7 +181,9 @@ nfqws takes the following parameters:
  --dpi-desync-start=[n|d|s]N                    ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) greater or equal than N
  --dpi-desync-cutoff=[n|d|s]N                   ; apply dpi desync only to packet numbers (n, default), data packet numbers (d), relative sequence (s) less than N
  --hostlist=<filename>                          ; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-domains=<domain_list>               ; comma separated fixed domain list
  --hostlist-exclude=<filename>                  ; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-exclude-domains=<domain_list>       ; comma separated fixed domain list
  --hostlist-auto=<filename>                     ; detect DPI blocks and build hostlist automatically
  --hostlist-auto-fail-threshold=<int>           ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
  --hostlist-auto-fail-time=<int>                ; all failed attemps must be within these seconds (default : 60)
@@ -193,7 +196,9 @@ nfqws takes the following parameters:
  --filter-udp=[~]port1[-port2]|*                ; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list supported.
  --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.
  --ipset=<filename>                             ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-ip=<ip_list>                           ; comma separated fixed subnet list
  --ipset-exclude=<filename>                     ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-exclude-ip=<ip_list>                   ; comma separated fixed subnet list
 ```
 
 ### DPI desync attack
@@ -258,8 +263,8 @@ Fakes are separate generated by nfqws packets carrying false information for DPI
 
  * `multisplit`. split request at specified in `--dpi-desync-split-pos` positions
  * `multidisorder`. same as `multisplit` but send in reverse order
- * `fakedsplit`. split request into 2 segments adding fakes in the middle of them : fake 1st segment, 1st segment, fake 1st segment, 2nd segment
+ * `fakedsplit`. split request into 2 segments adding fakes in the middle of them : fake 1st segment, 1st segment, fake 1st segment, fake 2nd segment, 2nd segment, fake 2nd segment
- * `fakeddisorder`. same as `fakedsplit` but with another order : 2nd segment, fake 1st segment, 1st segment, fake 1st segment
+ * `fakeddisorder`. same as `fakedsplit` but with another order : fake 2nd segment, 2nd segment, fake 2nd segment, fake 1st segment, 1st segment, fake 1st segment
 
 Positions are defined by markers.
 
@@ -671,10 +676,14 @@ tpws is transparent proxy.
  --filter-tcp=[~]port1[-port2]|*         ; TCP port filter. ~ means negation. comma separated list supported.
  --filter-l7=[http|tls|unknown]          ; L6-L7 protocol filter. multiple comma separated values allowed.
  --ipset=<filename>                      ; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-ip=<ip_list>                    ; comma separated fixed subnet list
  --ipset-exclude=<filename>              ; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)
+ --ipset-exclude-ip=<ip_list>            ; comma separated fixed subnet list
 
  --hostlist=<filename>                   ; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-domains=<domain_list>        ; comma separated fixed domain list
  --hostlist-exclude=<filename>           ; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)
+ --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list
  --hostlist-auto=<filename>              ; detect DPI blocks and build hostlist automatically
  --hostlist-auto-fail-threshold=<int>    ; how many failed attempts cause hostname to be added to auto hostlist (default : 3)
  --hostlist-auto-fail-time=<int>         ; all failed attemps must be within these seconds (default : 60)
@@ -704,7 +713,7 @@ tpws is transparent proxy.
  --daemon                                ; daemonize
  --pidfile=<filename>                    ; write pid to file
  --user=<username>                       ; drop root privs
- --uid=uid[:gid]		                ; drop root privs
+ --uid=uid[:gid]                         ; drop root privs
 ```
 
 ### TCP segmentation in tpws

docs/readme.md

@@ -1,4 +1,4 @@
-# zapret v.69
+# zapret v69.4
 
 # ВНИМАНИЕ, остерегайтесь мошенников
 
@@ -190,6 +190,7 @@ dvtws, собираемый из тех же исходников (см. [док
 --dpi-desync-split-pos=N|-N|marker+N|marker-N	; список через запятую маркеров для tcp сегментации в режимах split и disorder
 --dpi-desync-split-seqovl=N|-N|marker+N|marker-N ; единичный маркер, определяющий величину перекрытия sequence в режимах split и disorder. для split поддерживается только положительное число.
 --dpi-desync-split-seqovl-pattern=<filename>|0xHEX ; чем заполнять фейковую часть overlap
+--dpi-desync-fakedsplit-pattern=<filename>|0xHEX ; чем заполнять фейки в fakedsplit/fakeddisorder
 --dpi-desync-badseq-increment=<int|0xHEX>	; инкремент sequence number для badseq. по умолчанию -10000
 --dpi-desync-badack-increment=<int|0xHEX>	; инкремент ack sequence number для badseq. по умолчанию -66000
 --dpi-desync-any-protocol=0|1			; 0(default)=работать только по http request и tls clienthello  1=по всем непустым пакетам данных
@@ -211,7 +212,9 @@ dvtws, собираемый из тех же исходников (см. [док
 						; список может быть запакован в gzip. формат автоматически распознается и разжимается
 						; списков может быть множество. пустой общий лист = его отсутствие
 						; хосты извлекаются из Host: хедера обычных http запросов и из SNI в TLS ClientHello.
+--hostlist-domains=<domain_list>		; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
 --hostlist-exclude=<filename>			; не применять дурение к доменам из листа. может быть множество листов. схема аналогична include листам.
+--hostlist-exclude-domains=<domain_list>	; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
 --hostlist-auto=<filename>			; обнаруживать автоматически блокировки и заполнять автоматический hostlist (требует перенаправления входящего трафика)
 --hostlist-auto-fail-threshold=<int>		; сколько раз нужно обнаружить ситуацию, похожую на блокировку, чтобы добавить хост в лист (по умолчанию: 3)
 --hostlist-auto-fail-time=<int>			; все эти ситуации должны быть в пределах указанного количества секунд (по умолчанию: 60)
@@ -224,7 +227,9 @@ dvtws, собираемый из тех же исходников (см. [док
 --filter-udp=[~]port1[-port2]|*			; фильтр портов udp для текущей стратегии. ~ означает инверсию. установка фильтра udp и неустановка фильтра tcp запрещает tcp. поддерживается список через запятую.
 --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; фильтр протокола L6-L7. поддерживается несколько значений через запятую.
 --ipset=<filename>				; включающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
+--ipset-ip=<ip_list>				; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
 --ipset-exclude=<filename>			; исключающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
+--ipset-exclude-ip=<ip_list>			; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
 ```
 
 `--debug` позволяет выводить подробный лог действий на консоль, в syslog или в файл. Может быть важен порядок следования
@@ -314,8 +319,13 @@ dvtws, собираемый из тех же исходников (см. [док
 
  * `multisplit`. нарезаем запрос на указанных в `--dpi-desync-split-pos` позициях.
  * `multidisorder`. нарезаем запрос на указанных в `--dpi-desync-split-pos` позициях и отправляем в обратном порядке.
- * `fakedsplit`. нарезаем запрос на 2 части, обрамляя его фейками : фейк 1-й части, 1 часть, фейк 1-й части, 2 часть
+ * `fakedsplit`. нарезаем запрос на 2 части, обрамляя каждую часть фейками : фейк 1-й части, 1 часть, фейк 1-й части, фейк 2-й части, 2 часть, фейк 2-й части
- * `fakeddisorder`. нарезаем запрос на 2 части, обрамляя его фейками : 2 часть, фейк 1-й части, 1 часть, фейк 1 части.
+ * `fakeddisorder`. аналогично `fakedsplit`, только в обратном порядке : фейк 2-й части, 2 часть, фейк 2-й части, фейк 1-й части, 1 часть, фейк 1 части.
+
+Содержимое фейков в `fakedsplit`/`fakeddisorder` определяется параметром `--dpi-desync-fakedsplit-pattern` (по умолчанию 0x00).
+Данные фейков берутся из паттерна со смещением, соответствующим смещению отсылаемых частей.
+Размеры фейков соответствуют длинам отсылаемых частей.
+Цель этих режимов - максимально усложнить выявление оригинальных данных среди фейков.
 
 Для определения позиций нарезки используются маркеры.
 
@@ -822,7 +832,9 @@ tpws - это transparent proxy.
 					; список может быть запакован в gzip. формат автоматически распознается и разжимается
 					; списков может быть множество. пустой общий лист = его отсутствие
 					; хосты извлекаются из Host: хедера обычных http запросов и из SNI в TLS ClientHello.
+--hostlist-domains=<domain_list>	; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
 --hostlist-exclude=<filename>		; не применять дурение к доменам из листа. может быть множество листов. схема аналогична include листам.
+--hostlist-exclude-domains=<domain_list>; фиксированный список доменов через зяпятую. можно использовать # в начале для комментирования отдельных доменов.
 --hostlist-auto=<filename>		; обнаруживать автоматически блокировки и заполнять автоматический hostlist (требует перенаправления входящего трафика)
 --hostlist-auto-fail-threshold=<int>	; сколько раз нужно обнаружить ситуацию, похожую на блокировку, чтобы добавить хост в лист (по умолчанию: 3)
 --hostlist-auto-fail-time=<int>		; все эти ситуации должны быть в пределах указанного количества секунд (по умолчанию: 60)
@@ -833,7 +845,9 @@ tpws - это transparent proxy.
 --filter-tcp=[~]port1[-port2]|*		; фильтр портов tcp для текущей стратегии. ~ означает инверсию. поддерживается список через запятую.
 --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; фильтр протокола L6-L7. поддерживается несколько значений через запятую.
 --ipset=<filename>			; включающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
+--ipset-ip=<ip_list>			; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
 --ipset-exclude=<filename>		; исключающий ip list. на каждой строчке ip или cidr ipv4 или ipv6. поддерживается множество листов и gzip. перечитка автоматическая.
+--ipset-exclude-ip=<ip_list>		; фиксированный список подсетей через запятую. можно использовать # в начале для комментирования отдельных подсетей.
 ```
 
 ### TCP СЕГМЕНТАЦИЯ В TPWS

init.d/sysv/functions

@@ -102,7 +102,7 @@ dnat6_target()
 }
 set_route_localnet()
 {
-	_set_route_localnet $1 "$IFACE_LAN"
+	_set_route_localnet $1 $IFACE_LAN
 }
 
 fw_nfqws_post4()

install_bin.sh

@@ -68,7 +68,7 @@ case $UNAME in
 		;;
 	CYGWIN*)
 		UNAME=CYGWIN
-		ARCHLIST="win64"
+		ARCHLIST="win64 win32"
 		PKTWS=winws
 		;;
 	*)

ip2net/ip2net.c

@@ -192,7 +192,7 @@ static void ip6_and(const struct in6_addr * restrict a, const struct in6_addr *
 static void rtrim(char *s)
 {
 	if (s)
-		for (char *p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r'); p--) *p = '\0';
+		for (char *p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'); p--) *p = '\0';
 }
 
 
@@ -217,6 +217,14 @@ static void exithelp(void)
 	exit(1);
 }
 
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 static void parse_params(int argc, char *argv[])
 {
 	int option_index = 0;
@@ -245,6 +253,7 @@ static void parse_params(int argc, char *argv[])
 		{
 		case 0:
 		case 1:
+			PRINT_VER;
 			exithelp();
 			break;
 		case 2:

mdig/mdig.c

@@ -35,7 +35,7 @@
 static void trimstr(char *s)
 {
 	char *p;
-	for (p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r'); p--) *p = '\0';
+	for (p = s + strlen(s) - 1; p >= s && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'); p--) *p = '\0';
 }
 
 static const char* eai_str(int r)
@@ -458,6 +458,15 @@ static void exithelp(void)
 	);
 	exit(1);
 }
+
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 int main(int argc, char **argv)
 {
 	int r, v, option_index = 0;
@@ -487,6 +496,7 @@ int main(int argc, char **argv)
 		switch (option_index)
 		{
 		case 0: /* help */
+			PRINT_VER;
 			exithelp();
 			break;
 		case 1: /* threads */

nfq/desync.c

@@ -1449,10 +1449,17 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 			case DESYNC_FAKEDDISORDER:
 				if (split_pos)
 				{
-					uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100], *seg;
+					uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100], fakeseg2[DPI_DESYNC_MAX_FAKE_LEN+100], pat[DPI_DESYNC_MAX_FAKE_LEN], *seg;
-					size_t seg_len;
+					size_t seg_len,fakeseg2_len;
 					unsigned int seqovl;
 
+					if (dis->len_payload > sizeof(pat))
+					{
+						DLOG("packet is too large\n");
+						return verdict;
+					}
+					fill_pattern(pat,dis->len_payload,dp->fsplit_pattern,sizeof(dp->fsplit_pattern));
+
 					ip_id = IP4_IP_ID_FIX(dis->ip);
 
 					if (seqovl_pos>=split_pos)
@@ -1480,6 +1487,19 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 						seg = dis->data_payload+split_pos;
 						seg_len = dis->len_payload-split_pos;
 					}
+
+					fakeseg2_len = sizeof(fakeseg2);
+					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
+							ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
+							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
+							pat+split_pos, dis->len_payload-split_pos, fakeseg2, &fakeseg2_len))
+						return verdict;
+					ip_id=IP4_IP_ID_PREV(ip_id);
+					DLOG("sending fake(1) 2nd out-of-order tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos);
+					hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg2, fakeseg2_len))
+						return verdict;
+
 					pkt1_len = sizeof(pkt1);
 					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq , split_pos - seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
 							ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
@@ -1492,15 +1512,23 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 					if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
 						return verdict;
 
+					if (dis->ip) ((struct ip*)fakeseg2)->ip_id = ip_id;
+					ip_id=IP4_IP_ID_PREV(ip_id);
+
+					DLOG("sending fake(2) 2nd out-of-order tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos);
+					hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg2, fakeseg2_len))
+						return verdict;
+
 					seg_len = sizeof(fakeseg);
 					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
 							ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
 							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
-							zeropkt, split_pos, fakeseg, &seg_len))
+							pat, split_pos, fakeseg, &seg_len))
 						return verdict;
 					ip_id=IP4_IP_ID_PREV(ip_id);
 					DLOG("sending fake(1) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
-					hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
 					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len))
 						return verdict;
 
@@ -1518,7 +1546,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 
 					if (dis->ip) ((struct ip*)fakeseg)->ip_id = ip_id;
 					DLOG("sending fake(2) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
-					hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
 					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len))
 						return verdict;
 
@@ -1528,20 +1556,27 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 			case DESYNC_FAKEDSPLIT:
 				if (split_pos)
 				{
-					uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100],ovlseg[DPI_DESYNC_MAX_FAKE_LEN+100], *seg;
+					uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100],ovlseg[DPI_DESYNC_MAX_FAKE_LEN+100],pat[DPI_DESYNC_MAX_FAKE_LEN], *seg;
 					size_t fakeseg_len,seg_len;
 
+					if (dis->len_payload > sizeof(pat))
+					{
+						DLOG("packet is too large\n");
+						return verdict;
+					}
+					fill_pattern(pat,dis->len_payload,dp->fsplit_pattern,sizeof(dp->fsplit_pattern));
+
 					ip_id = IP4_IP_ID_FIX(dis->ip);
 
 					fakeseg_len = sizeof(fakeseg);
 					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
 							ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
 							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
-							zeropkt, split_pos, fakeseg, &fakeseg_len))
+							pat, split_pos, fakeseg, &fakeseg_len))
 						return verdict;
 					ip_id=IP4_IP_ID_NEXT(ip_id);
 					DLOG("sending fake(1) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
-					hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
 					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
 						return verdict;
 
@@ -1596,7 +1631,19 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 					if (dis->ip) ((struct ip*)fakeseg)->ip_id = ip_id;
 					ip_id=IP4_IP_ID_NEXT(ip_id);
 					DLOG("sending fake(2) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
-					hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
+						return verdict;
+
+					fakeseg_len = sizeof(fakeseg);
+					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,
+							ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),
+							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
+							pat+split_pos, dis->len_payload-split_pos, fakeseg, &fakeseg_len))
+						return verdict;
+					ip_id=IP4_IP_ID_NEXT(ip_id);
+					DLOG("sending fake(1) 2nd tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos);
+					hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n");
 					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
 						return verdict;
 
@@ -1606,11 +1653,19 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 							fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,
 							dis->data_payload+split_pos, dis->len_payload-split_pos, pkt1, &pkt1_len))
 						return verdict;
+					ip_id=IP4_IP_ID_NEXT(ip_id);
 					DLOG("sending 2nd tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos);
 					hexdump_limited_dlog(dis->data_payload+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n");
 					if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
 						return verdict;
 
+					if (dis->ip) ((struct ip*)fakeseg)->ip_id = ip_id;
+
+					DLOG("sending fake(2) 2nd tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos);
+					hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n");
+					if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
+						return verdict;
+
 					return VERDICT_DROP;
 				}
 				break;

nfq/hostlist.c

@@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 			*hostlist = NULL;
 			return false;
 		}
-		(*ct)++;
+		if (ct) (*ct)++;
 	}
 	// advance to the next line
 	for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@@ -32,6 +32,11 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	return true;
 }
 
+bool AppendHostlistItem(strpool **hostlist, char *s)
+{
+	return addpool(hostlist,&s,s+strlen(s),NULL);
+}
+
 bool AppendHostList(strpool **hostlist, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -98,21 +103,24 @@ bool AppendHostList(strpool **hostlist, const char *filename)
 
 static bool LoadHostList(struct hostlist_file *hfile)
 {
-	time_t t = file_mod_time(hfile->filename);
+	if (hfile->filename)
-	if (!t)
-	{
-		// stat() error
-		DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
-		return true;
-	}
-	if (t==hfile->mod_time) return true; // up to date
-	StrPoolDestroy(&hfile->hostlist);
-	if (!AppendHostList(&hfile->hostlist, hfile->filename))
 	{
+		time_t t = file_mod_time(hfile->filename);
+		if (!t)
+		{
+			// stat() error
+			DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
+			return true;
+		}
+		if (t==hfile->mod_time) return true; // up to date
 		StrPoolDestroy(&hfile->hostlist);
-		return false;
+		if (!AppendHostList(&hfile->hostlist, hfile->filename))
+		{
+			StrPoolDestroy(&hfile->hostlist);
+			return false;
+		}
+		hfile->mod_time=t;
 	}
-	hfile->mod_time=t;
 	return true;
 }
 static bool LoadHostLists(struct hostlist_files_head *list)
@@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 
 	LIST_FOREACH(item, hostlists_exclude, next)
 	{
-		DLOG("[%s] exclude ", item->hfile->filename);
+		DLOG("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchHostList(item->hfile->hostlist, host))
 		{
 			if (excluded) *excluded = true;
@@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 	{
 		LIST_FOREACH(item, hostlists, next)
 		{
-			DLOG("[%s] include ", item->hfile->filename);
+			DLOG("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchHostList(item->hfile->hostlist, host))
 				return true;
 		}
@@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
 static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
 {
 	struct hostlist_file *hfile;
-	if (!(hfile=hostlist_files_search(hostlists, filename)))
+
-		if (!(hfile=hostlist_files_add(hostlists, filename)))
+	if (filename)
+	{
+		if (!(hfile=hostlist_files_search(hostlists, filename)))
+			if (!(hfile=hostlist_files_add(hostlists, filename)))
+				return NULL;
+		if (!hostlist_collection_search(hl_collection, filename))
+			if (!hostlist_collection_add(hl_collection, hfile))
+				return NULL;
+	}
+	else
+	{
+		if (!(hfile=hostlist_files_add(hostlists, NULL)))
 			return NULL;
-	if (!hostlist_collection_search(hl_collection, filename))
 		if (!hostlist_collection_add(hl_collection, hfile))
 			return NULL;
+	}
+
 	return hfile;
 }
 struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access hostlist file '%s'\n",filename);
 		return NULL;
@@ -265,15 +285,30 @@ void HostlistsDebug()
 	struct hostlist_item *hl_item;
 
 	LIST_FOREACH(hfile, &params.hostlists, next)
-		DLOG("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
+	{
+		if (hfile->filename)
+			DLOG("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
+		else
+			DLOG("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
 			if (hl_item->hfile!=dpl->dp.hostlist_auto)
-				DLOG("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+			{
+				if (hl_item->hfile->filename)
+					DLOG("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+				else
+					DLOG("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
+			}
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
-			DLOG("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+		{
+			if (hl_item->hfile->filename)
+				DLOG("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+			else
+				DLOG("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
+		}
 		if (dpl->dp.hostlist_auto)
 			DLOG("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
 	}

nfq/hostlist.h

@@ -4,6 +4,7 @@
 #include "pools.h"
 #include "params.h"
 
+bool AppendHostlistItem(strpool **hostlist, char *s);
 bool AppendHostList(strpool **hostlist, const char *filename);
 bool LoadAllHostLists();
 bool NonEmptyHostlist(strpool **hostlist);

nfq/ipset.c

@@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else if (parse_cidr6(cidr,&c6))
 		{
@@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else
 			DLOG_ERR("bad ip or subnet : %s\n",cidr);
@@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 
 }
 
+bool AppendIpsetItem(ipset *ips, char *ip)
+{
+	return addpool(ips,&ip,ip+strlen(ip),NULL);
+}
+
 static bool AppendIpset(ipset *ips, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -119,21 +124,24 @@ static bool AppendIpset(ipset *ips, const char *filename)
 
 static bool LoadIpset(struct ipset_file *hfile)
 {
-	time_t t = file_mod_time(hfile->filename);
+	if (hfile->filename)
-	if (!t)
-	{
-		// stat() error
-		DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
-		return true;
-	}
-	if (t==hfile->mod_time) return true; // up to date
-	ipsetDestroy(&hfile->ipset);
-	if (!AppendIpset(&hfile->ipset, hfile->filename))
 	{
+		time_t t = file_mod_time(hfile->filename);
+		if (!t)
+		{
+			// stat() error
+			DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
+			return true;
+		}
+			if (t==hfile->mod_time) return true; // up to date
 		ipsetDestroy(&hfile->ipset);
-		return false;
+		if (!AppendIpset(&hfile->ipset, hfile->filename))
+		{
+			ipsetDestroy(&hfile->ipset);
+			return false;
+		}
+		hfile->mod_time=t;
 	}
-	hfile->mod_time=t;
 	return true;
 }
 static bool LoadIpsets(struct ipset_files_head *list)
@@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 
 	LIST_FOREACH(item, ips_exclude, next)
 	{
-		DLOG("[%s] exclude ",item->hfile->filename);
+		DLOG("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 			return false;
 	}
@@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 	{
 		LIST_FOREACH(item, ips, next)
 		{
-			DLOG("[%s] include ",item->hfile->filename);
+			DLOG("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 				return true;
 		}
@@ -234,17 +242,27 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
 static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename)
 {
 	struct ipset_file *hfile;
-	if (!(hfile=ipset_files_search(ipsets, filename)))
+	if (filename)
-		if (!(hfile=ipset_files_add(ipsets, filename)))
+	{
+		if (!(hfile=ipset_files_search(ipsets, filename)))
+			if (!(hfile=ipset_files_add(ipsets, filename)))
+				return NULL;
+		if (!ipset_collection_search(ips_collection, filename))
+			if (!ipset_collection_add(ips_collection, hfile))
+				return NULL;
+	}
+	else
+	{
+		if (!(hfile=ipset_files_add(ipsets, NULL)))
 			return NULL;
-	if (!ipset_collection_search(ips_collection, filename))
 		if (!ipset_collection_add(ips_collection, hfile))
 			return NULL;
+	}
 	return hfile;
 }
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access ipset file '%s'\n",filename);
 		return NULL;
@@ -277,13 +295,24 @@ void IpsetsDebug()
 	struct ipset_item *ips_item;
 
 	LIST_FOREACH(hfile, &params.ipsets, next)
-		DLOG("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
+	{
+		if (hfile->filename)
+			DLOG("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
+		else
+			DLOG("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
-			DLOG("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			if (ips_item->hfile->filename)
+				DLOG("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				DLOG("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
-			DLOG("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			if (ips_item->hfile->filename)
+				DLOG("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				DLOG("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 	}
 }

nfq/ipset.h

@@ -9,3 +9,4 @@ bool LoadAllIpsets();
 bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
 void IpsetsDebug();
+bool AppendIpsetItem(ipset *ips, char *ip);

nfq/nfqws.c

@@ -836,6 +836,47 @@ static bool parse_split_pos_list(char *opt, struct proto_pos *splits, int splits
 	if (p) return false; // too much splits
 	return true;
 }
+
+static bool parse_domain_list(char *opt, strpool **pp)
+{
+	char *e,*p,c;
+
+	for (p=opt ; p ; )
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+
+		if (*p && !AppendHostlistItem(pp,p)) return false;
+
+		if (e) *e++=c;
+		p = e;
+	}
+	return true;
+}
+
+static bool parse_ip_list(char *opt, ipset *pp)
+{
+	char *e,*p,c;
+
+	for (p=opt ; p ; )
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+
+		if (*p && !AppendIpsetItem(pp,p)) return false;
+
+		if (e) *e++=c;
+		p = e;
+	}
+	return true;
+}
+
 static void split_compat(struct desync_profile *dp)
 {
 	if (!dp->split_count)
@@ -1026,10 +1067,14 @@ static void exithelp(void)
 		" --filter-udp=[~]port1[-port2]|*\t\t; UDP port filter. ~ means negation. setting udp and not setting tcp filter denies tcp. comma separated list allowed.\n"
 		" --filter-l7=[http|tls|quic|wireguard|dht|unknown] ; L6-L7 protocol filter. multiple comma separated values allowed.\n"
 		" --ipset=<filename>\t\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
+		" --ipset-ip=<ip_list>\t\t\t\t; comma separated fixed subnet list\n"
 		" --ipset-exclude=<filename>\t\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
+		" --ipset-exclude-ip=<ip_list>\t\t\t; comma separated fixed subnet list\n"
 		"\nHOSTLIST FILTER:\n"
 		" --hostlist=<filename>\t\t\t\t; apply dpi desync only to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
+		" --hostlist-domains=<domain_list>\t\t; comma separated fixed domain list\n"
 		" --hostlist-exclude=<filename>\t\t\t; do not apply dpi desync to the listed hosts (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
+		" --hostlist-exclude-domains=<domain_list>\t; comma separated fixed domain list\n"
 		" --hostlist-auto=<filename>\t\t\t; detect DPI blocks and build hostlist automatically\n"
 		" --hostlist-auto-fail-threshold=<int>\t\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
 		" --hostlist-auto-fail-time=<int>\t\t; all failed attemps must be within these seconds (default : %d)\n"
@@ -1065,6 +1110,7 @@ static void exithelp(void)
 		"\t\t\t\t\t\t; fakedsplit/fakeddisorder use first l7-protocol-compatible parameter if present, first abs value otherwise\n"
 		" --dpi-desync-split-seqovl=N|-N|marker+N|marker-N ; use sequence overlap before first sent original split segment\n"
 		" --dpi-desync-split-seqovl-pattern=<filename>|0xHEX ; pattern for the fake part of overlap\n"
+		" --dpi-desync-fakedsplit-pattern=<filename>|0xHEX ; fake pattern for fakedsplit/fakeddisorder\n"
 		" --dpi-desync-ipfrag-pos-tcp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n"
 		" --dpi-desync-ipfrag-pos-udp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n"
 		" --dpi-desync-badseq-increment=<int|0xHEX>\t; badseq fooling seq signed increment. default %d\n"
@@ -1128,6 +1174,14 @@ void config_from_file(const char *filename)
 }
 #endif
 
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 int main(int argc, char **argv)
 {
 	set_env_exedir(argv[0]);
@@ -1143,6 +1197,8 @@ int main(int argc, char **argv)
 	int option_index = 0;
 	bool daemon = false, bSkip = false;
 	char pidfile[256];
+	struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL;
+	struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL;
 #ifdef __CYGWIN__
 	char windivert_filter[8192], wf_pf_tcp_src[256], wf_pf_tcp_dst[256], wf_pf_udp_src[256], wf_pf_udp_dst[256], wf_save_file[256];
 	bool wf_ipv4=true, wf_ipv6=true;
@@ -1154,6 +1210,8 @@ int main(int argc, char **argv)
 	srandom(time(NULL));
 	mask_from_preflen6_prepare();
 
+	PRINT_VER;
+
 	memset(&params, 0, sizeof(params));
 	*pidfile = 0;
 
@@ -1250,51 +1308,56 @@ int main(int argc, char **argv)
 		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=26
 		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=27
 		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=28
-		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=29
+		{"dpi-desync-fakedsplit-pattern",required_argument,0,0 },// optidx=29
-		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=30
+		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=30
-		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=31
+		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=31
-		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=32
+		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=32
-		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=33
+		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=33
-		{"dpi-desync-fake-http",required_argument,0,0},// optidx=34
+		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=34
-		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=35
+		{"dpi-desync-fake-http",required_argument,0,0},// optidx=35
-		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=36
+		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=36
-		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=37
+		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=37
-		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=38
+		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=38
-		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=39
+		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=39
-		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=40
+		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=40
-		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=41
+		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=41
-		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=42
+		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=42
-		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=43
+		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=43
-		{"dpi-desync-cutoff",required_argument,0,0},// optidx=44
+		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=44
-		{"dpi-desync-start",required_argument,0,0},// optidx=45
+		{"dpi-desync-cutoff",required_argument,0,0},// optidx=45
-		{"hostlist",required_argument,0,0},		// optidx=46
+		{"dpi-desync-start",required_argument,0,0},// optidx=46
-		{"hostlist-exclude",required_argument,0,0},	// optidx=47
+		{"hostlist",required_argument,0,0},		// optidx=47
-		{"hostlist-auto",required_argument,0,0},	// optidx=48
+		{"hostlist-domains",required_argument,0,0},// optidx=48
-		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=49
+		{"hostlist-exclude",required_argument,0,0},	// optidx=49
-		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=50
+		{"hostlist-exclude-domains",required_argument,0,0},// optidx=50
-		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=51
+		{"hostlist-auto",required_argument,0,0},	// optidx=51
-		{"hostlist-auto-debug",required_argument,0,0},	// optidx=52
+		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=52
-		{"new",no_argument,0,0},	// optidx=53
+		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=53
-		{"skip",no_argument,0,0},	// optidx=54
+		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=54
-		{"filter-l3",required_argument,0,0},	// optidx=55
+		{"hostlist-auto-debug",required_argument,0,0},	// optidx=55
-		{"filter-tcp",required_argument,0,0},	// optidx=56
+		{"new",no_argument,0,0},	// optidx=56
-		{"filter-udp",required_argument,0,0},	// optidx=57
+		{"skip",no_argument,0,0},	// optidx=57
-		{"filter-l7",required_argument,0,0},	// optidx=58
+		{"filter-l3",required_argument,0,0},	// optidx=58
-		{"ipset",required_argument,0,0},	// optidx=59
+		{"filter-tcp",required_argument,0,0},	// optidx=59
-		{"ipset-exclude",required_argument,0,0},// optidx=60
+		{"filter-udp",required_argument,0,0},	// optidx=60
+		{"filter-l7",required_argument,0,0},	// optidx=61
+		{"ipset",required_argument,0,0},	// optidx=62
+		{"ipset-ip",required_argument,0,0},	// optidx=63
+		{"ipset-exclude",required_argument,0,0},// optidx=64
+		{"ipset-exclude-ip",required_argument,0,0},	// optidx=65
 #ifdef __linux__
-		{"bind-fix4",no_argument,0,0},		// optidx=61
+		{"bind-fix4",no_argument,0,0},		// optidx=66
-		{"bind-fix6",no_argument,0,0},		// optidx=62
+		{"bind-fix6",no_argument,0,0},		// optidx=67
 #elif defined(__CYGWIN__)
-		{"wf-iface",required_argument,0,0},	// optidx=61
+		{"wf-iface",required_argument,0,0},	// optidx=66
-		{"wf-l3",required_argument,0,0},	// optidx=62
+		{"wf-l3",required_argument,0,0},	// optidx=67
-		{"wf-tcp",required_argument,0,0},	// optidx=63
+		{"wf-tcp",required_argument,0,0},	// optidx=68
-		{"wf-udp",required_argument,0,0},	// optidx=64
+		{"wf-udp",required_argument,0,0},	// optidx=69
-		{"wf-raw",required_argument,0,0},	// optidx=65
+		{"wf-raw",required_argument,0,0},	// optidx=70
-		{"wf-save",required_argument,0,0},	// optidx=66
+		{"wf-save",required_argument,0,0},	// optidx=71
-		{"ssid-filter",required_argument,0,0},	// optidx=67
+		{"ssid-filter",required_argument,0,0},	// optidx=72
-		{"nlm-filter",required_argument,0,0},	// optidx=68
+		{"nlm-filter",required_argument,0,0},	// optidx=73
-		{"nlm-list",optional_argument,0,0},	// optidx=69
+		{"nlm-list",optional_argument,0,0},	// optidx=74
 #endif
 		{NULL,0,NULL,0}
 	};
@@ -1632,7 +1695,15 @@ int main(int argc, char **argv)
 				fill_pattern(dp->seqovl_pattern,sizeof(dp->seqovl_pattern),buf,sz);
 			}
 			break;
-		case 29: /* dpi-desync-ipfrag-pos-tcp */
+		case 29: /* dpi-desync-fakedsplit-pattern */
+			{
+				char buf[sizeof(dp->fsplit_pattern)];
+				size_t sz=sizeof(buf);
+				load_file_or_exit(optarg,buf,&sz);
+				fill_pattern(dp->fsplit_pattern,sizeof(dp->fsplit_pattern),buf,sz);
+			}
+			break;
+		case 30: /* dpi-desync-ipfrag-pos-tcp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_tcp)<1 || dp->desync_ipfrag_pos_tcp<1 || dp->desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1644,7 +1715,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 30: /* dpi-desync-ipfrag-pos-udp */
+		case 31: /* dpi-desync-ipfrag-pos-udp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_udp)<1 || dp->desync_ipfrag_pos_udp<1 || dp->desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1656,63 +1727,63 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 31: /* dpi-desync-badseq-increments */
+		case 32: /* dpi-desync-badseq-increments */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment))
 			{
 				DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 32: /* dpi-desync-badack-increment */
+		case 33: /* dpi-desync-badack-increment */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment))
 			{
 				DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 33: /* dpi-desync-any-protocol */
+		case 34: /* dpi-desync-any-protocol */
 			dp->desync_any_proto = !optarg || atoi(optarg);
 			break;
-		case 34: /* dpi-desync-fake-http */
+		case 35: /* dpi-desync-fake-http */
 			dp->fake_http_size = sizeof(dp->fake_http);
 			load_file_or_exit(optarg,dp->fake_http,&dp->fake_http_size);
 			break;
-		case 35: /* dpi-desync-fake-tls */
+		case 36: /* dpi-desync-fake-tls */
 			dp->fake_tls_size = sizeof(dp->fake_tls);
 			load_file_or_exit(optarg,dp->fake_tls,&dp->fake_tls_size);
 			break;
-		case 36: /* dpi-desync-fake-unknown */
+		case 37: /* dpi-desync-fake-unknown */
 			dp->fake_unknown_size = sizeof(dp->fake_unknown);
 			load_file_or_exit(optarg,dp->fake_unknown,&dp->fake_unknown_size);
 			break;
-		case 37: /* dpi-desync-fake-syndata */
+		case 38: /* dpi-desync-fake-syndata */
 			dp->fake_syndata_size = sizeof(dp->fake_syndata);
 			load_file_or_exit(optarg,dp->fake_syndata,&dp->fake_syndata_size);
 			break;
-		case 38: /* dpi-desync-fake-quic */
+		case 39: /* dpi-desync-fake-quic */
 			dp->fake_quic_size = sizeof(dp->fake_quic);
 			load_file_or_exit(optarg,dp->fake_quic,&dp->fake_quic_size);
 			break;
-		case 39: /* dpi-desync-fake-wireguard */
+		case 40: /* dpi-desync-fake-wireguard */
 			dp->fake_wg_size = sizeof(dp->fake_wg);
 			load_file_or_exit(optarg,dp->fake_wg,&dp->fake_wg_size);
 			break;
-		case 40: /* dpi-desync-fake-dht */
+		case 41: /* dpi-desync-fake-dht */
 			dp->fake_dht_size = sizeof(dp->fake_dht);
 			load_file_or_exit(optarg,dp->fake_dht,&dp->fake_dht_size);
 			break;
-		case 41: /* dpi-desync-fake-unknown-udp */
+		case 42: /* dpi-desync-fake-unknown-udp */
 			dp->fake_unknown_udp_size = sizeof(dp->fake_unknown_udp);
 			load_file_or_exit(optarg,dp->fake_unknown_udp,&dp->fake_unknown_udp_size);
 			break;
-		case 42: /* dpi-desync-udplen-increment */
+		case 43: /* dpi-desync-udplen-increment */
 			if (sscanf(optarg,"%d",&dp->udplen_increment)<1 || dp->udplen_increment>0x7FFF || dp->udplen_increment<-0x8000)
 			{
 				DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
 				exit_clean(1);
 			}
 			break;
-		case 43: /* dpi-desync-udplen-pattern */
+		case 44: /* dpi-desync-udplen-pattern */
 			{
 				char buf[sizeof(dp->udplen_pattern)];
 				size_t sz=sizeof(buf);
@@ -1720,35 +1791,64 @@ int main(int argc, char **argv)
 				fill_pattern(dp->udplen_pattern,sizeof(dp->udplen_pattern),buf,sz);
 			}
 			break;
-		case 44: /* desync-cutoff */
+		case 45: /* desync-cutoff */
 			if (!parse_cutoff(optarg, &dp->desync_cutoff, &dp->desync_cutoff_mode))
 			{
 				DLOG_ERR("invalid desync-cutoff value\n");
 				exit_clean(1);
 			}
 			break;
-		case 45: /* desync-start */
+		case 46: /* desync-start */
 			if (!parse_cutoff(optarg, &dp->desync_start, &dp->desync_start_mode))
 			{
 				DLOG_ERR("invalid desync-start value\n");
 				exit_clean(1);
 			}
 			break;
-		case 46: /* hostlist */
+		case 47: /* hostlist */
+			if (bSkip) break;
 			if (!RegisterHostlist(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-		case 47: /* hostlist-exclude */
+		case 48: /* hostlist-domains */
+			if (bSkip) break;
+			if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous hostlist\n");
+				exit_clean(1);
+			}
+			if (!parse_domain_list(optarg, &anon_hl->hostlist))
+			{
+				DLOG_ERR("failed to add domains to anonymous hostlist\n");
+				exit_clean(1);
+			}
+			break;
+		case 49: /* hostlist-exclude */
+			if (bSkip) break;
 			if (!RegisterHostlist(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-		case 48: /* hostlist-auto */
+		case 50: /* hostlist-exclude-domains */
+			if (bSkip) break;
+			if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous hostlist\n");
+				exit_clean(1);
+			}
+			if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist))
+			{
+				DLOG_ERR("failed to add domains to anonymous hostlist\n");
+				exit_clean(1);
+			}
+			break;
+		case 51: /* hostlist-auto */
+			if (bSkip) break;
 			if (dp->hostlist_auto)
 			{
 				DLOG_ERR("only one auto hostlist per profile is supported\n");
@@ -1775,7 +1875,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 49: /* hostlist-auto-fail-threshold */
+		case 52: /* hostlist-auto-fail-threshold */
 			dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
 			{
@@ -1783,7 +1883,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 50: /* hostlist-auto-fail-time */
+		case 53: /* hostlist-auto-fail-time */
 			dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_time<1)
 			{
@@ -1791,7 +1891,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 51: /* hostlist-auto-retrans-threshold */
+		case 54: /* hostlist-auto-retrans-threshold */
 			dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10)
 			{
@@ -1799,7 +1899,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 52: /* hostlist-auto-debug */
+		case 55: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -1813,7 +1913,7 @@ int main(int argc, char **argv)
 			}
 			break;
 
-		case 53: /* new */
+		case 56: /* new */
 			if (bSkip)
 			{
 				dp_clear(dp);
@@ -1831,19 +1931,21 @@ int main(int argc, char **argv)
 				dp = &dpl->dp;
 				dp->n = ++desync_profile_count;
 			}
+			anon_hl = anon_hl_exclude = NULL;
+			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 54: /* skip */
+		case 57: /* skip */
 			bSkip = true;
 			break;
 
-		case 55: /* filter-l3 */
+		case 58: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 56: /* filter-tcp */
+		case 59: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -1853,7 +1955,7 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_udp))
 				exit_clean(1);
 			break;
-		case 57: /* filter-udp */
+		case 60: /* filter-udp */
 			if (!parse_pf_list(optarg,&dp->pf_udp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -1863,53 +1965,80 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_tcp))
 				exit_clean(1);
 			break;
-		case 58: /* filter-l7 */
+		case 61: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 59: /* ipset */
+		case 62: /* ipset */
+			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-		case 60: /* ipset-exclude */
+		case 63: /* ipset-ip */
+			if (bSkip) break;
+			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous ipset\n");
+				exit_clean(1);
+			}
+			if (!parse_ip_list(optarg, &anon_ips->ipset))
+			{
+				DLOG_ERR("failed to add subnets to anonymous ipset\n");
+				exit_clean(1);
+			}
+			break;
+		case 64: /* ipset-exclude */
+			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
 				exit_clean(1);
 			}
 			break;
-
+		case 65: /* ipset-exclude-ip */
+			if (bSkip) break;
+			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous ipset\n");
+				exit_clean(1);
+			}
+			if (!parse_ip_list(optarg, &anon_ips_exclude->ipset))
+			{
+				DLOG_ERR("failed to add subnets to anonymous ipset\n");
+				exit_clean(1);
+			}
+			break;
 
 
 #ifdef __linux__
-		case 61: /* bind-fix4 */
+		case 66: /* bind-fix4 */
 			params.bind_fix4 = true;
 			break;
-		case 62: /* bind-fix6 */
+		case 67: /* bind-fix6 */
 			params.bind_fix6 = true;
 			break;
 #elif defined(__CYGWIN__)
-		case 61: /* wf-iface */
+		case 66: /* wf-iface */
 			if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
 			{
 				DLOG_ERR("bad value for --wf-iface\n");
 				exit_clean(1);
 			}
 			break;
-		case 62: /* wf-l3 */
+		case 67: /* wf-l3 */
 			if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
 			{
 				DLOG_ERR("bad value for --wf-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 63: /* wf-tcp */
+		case 68: /* wf-tcp */
 			hash_wf_tcp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
 				!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
@@ -1918,7 +2047,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 64: /* wf-udp */
+		case 69: /* wf-udp */
 			hash_wf_udp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
 				!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
@@ -1927,7 +2056,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 65: /* wf-raw */
+		case 70: /* wf-raw */
 			hash_wf_raw=hash_jen(optarg,strlen(optarg));
 			if (optarg[0]=='@')
 			{
@@ -1941,11 +2070,11 @@ int main(int argc, char **argv)
 				windivert_filter[sizeof(windivert_filter) - 1] = '\0';
 			}
 			break;
-		case 66: /* wf-save */
+		case 71: /* wf-save */
 			strncpy(wf_save_file, optarg, sizeof(wf_save_file));
 			wf_save_file[sizeof(wf_save_file) - 1] = '\0';
 			break;
-		case 67: /* ssid-filter */
+		case 72: /* ssid-filter */
 			hash_ssid_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -1963,7 +2092,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 68: /* nlm-filter */
+		case 73: /* nlm-filter */
 			hash_nlm_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -1981,7 +2110,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 69: /* nlm-list */
+		case 74: /* nlm-list */
 			if (!nlm_list(optarg && !strcmp(optarg,"all")))
 			{
 				DLOG_ERR("could not get list of NLM networks\n");

nfq/params.h

@@ -68,7 +68,7 @@ struct desync_profile
 	autottl desync_autottl, desync_autottl6;
 	uint32_t desync_fooling_mode;
 	uint32_t desync_badseq_increment, desync_badseq_ack_increment;
-	uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460];
+	uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460],fsplit_pattern[1460];
 	uint8_t fake_unknown_udp[1472],udplen_pattern[1472],fake_quic[1472],fake_wg[1472],fake_dht[1472];
 	size_t fake_http_size,fake_tls_size,fake_quic_size,fake_wg_size,fake_dht_size,fake_unknown_size,fake_syndata_size,fake_unknown_udp_size;
 	int udplen_increment;

nfq/pools.c

@@ -160,12 +160,17 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const
 	struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
 	if (entry)
 	{
-		if (!(entry->filename = strdup(filename)))
+		if (filename)
 		{
-			free(entry);
+			if (!(entry->filename = strdup(filename)))
-			return false;
+			{
+				free(entry);
+				return false;
+			}
 		}
-		entry->mod_time=0;
+		else
+			entry->filename = NULL;
+		entry->mod_time = 0;
 		entry->hostlist = NULL;
 		LIST_INSERT_HEAD(head, entry, next);
 	}
@@ -192,7 +197,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -223,7 +228,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;
@@ -369,12 +374,17 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
 	struct ipset_file *entry = malloc(sizeof(struct ipset_file));
 	if (entry)
 	{
-		if (!(entry->filename = strdup(filename)))
+		if (filename)
 		{
-			free(entry);
+			if (!(entry->filename = strdup(filename)))
-			return false;
+			{
+				free(entry);
+				return false;
+			}
 		}
-		entry->mod_time=0;
+		else
+			entry->filename = NULL;
+		entry->mod_time = 0;
 		memset(&entry->ipset,0,sizeof(entry->ipset));
 		LIST_INSERT_HEAD(head, entry, next);
 	}
@@ -401,7 +411,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -432,7 +442,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;

tpws/hostlist.c

@@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 			*hostlist = NULL;
 			return false;
 		}
-		(*ct)++;
+		if (ct) (*ct)++;
 	}
 	// advance to the next line
 	for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@@ -32,6 +32,11 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
 	return true;
 }
 
+bool AppendHostlistItem(strpool **hostlist, char *s)
+{
+	return addpool(hostlist,&s,s+strlen(s),NULL);
+}
+
 bool AppendHostList(strpool **hostlist, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -98,21 +103,24 @@ bool AppendHostList(strpool **hostlist, const char *filename)
 
 static bool LoadHostList(struct hostlist_file *hfile)
 {
-	time_t t = file_mod_time(hfile->filename);
+	if (hfile->filename)
-	if (!t)
-	{
-		// stat() error
-		DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
-		return true;
-	}
-	if (t==hfile->mod_time) return true; // up to date
-	StrPoolDestroy(&hfile->hostlist);
-	if (!AppendHostList(&hfile->hostlist, hfile->filename))
 	{
+		time_t t = file_mod_time(hfile->filename);
+		if (!t)
+		{
+			// stat() error
+			DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
+			return true;
+		}
+		if (t==hfile->mod_time) return true; // up to date
 		StrPoolDestroy(&hfile->hostlist);
-		return false;
+		if (!AppendHostList(&hfile->hostlist, hfile->filename))
+		{
+			StrPoolDestroy(&hfile->hostlist);
+			return false;
+		}
+		hfile->mod_time=t;
 	}
-	hfile->mod_time=t;
 	return true;
 }
 static bool LoadHostLists(struct hostlist_files_head *list)
@@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 
 	LIST_FOREACH(item, hostlists_exclude, next)
 	{
-		VPRINT("[%s] exclude ", item->hfile->filename);
+		VPRINT("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchHostList(item->hfile->hostlist, host))
 		{
 			if (excluded) *excluded = true;
@@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
 	{
 		LIST_FOREACH(item, hostlists, next)
 		{
-			VPRINT("[%s] include ", item->hfile->filename);
+			VPRINT("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchHostList(item->hfile->hostlist, host))
 				return true;
 		}
@@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
 static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
 {
 	struct hostlist_file *hfile;
-	if (!(hfile=hostlist_files_search(hostlists, filename)))
+
-		if (!(hfile=hostlist_files_add(hostlists, filename)))
+	if (filename)
+	{
+		if (!(hfile=hostlist_files_search(hostlists, filename)))
+			if (!(hfile=hostlist_files_add(hostlists, filename)))
+				return NULL;
+		if (!hostlist_collection_search(hl_collection, filename))
+			if (!hostlist_collection_add(hl_collection, hfile))
+				return NULL;
+	}
+	else
+	{
+		if (!(hfile=hostlist_files_add(hostlists, NULL)))
 			return NULL;
-	if (!hostlist_collection_search(hl_collection, filename))
 		if (!hostlist_collection_add(hl_collection, hfile))
 			return NULL;
+	}
+
 	return hfile;
 }
 struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access hostlist file '%s'\n",filename);
 		return NULL;
@@ -265,15 +285,30 @@ void HostlistsDebug()
 	struct hostlist_item *hl_item;
 
 	LIST_FOREACH(hfile, &params.hostlists, next)
-		VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
+	{
+		if (hfile->filename)
+			VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
+		else
+			VPRINT("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
 			if (hl_item->hfile!=dpl->dp.hostlist_auto)
-				VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+			{
+				if (hl_item->hfile->filename)
+					VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+				else
+					VPRINT("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
+			}
 		LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
-			VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+		{
+			if (hl_item->hfile->filename)
+				VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
+			else
+				VPRINT("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
+		}
 		if (dpl->dp.hostlist_auto)
 			VPRINT("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
 	}

tpws/hostlist.h

@@ -4,6 +4,7 @@
 #include "pools.h"
 #include "params.h"
 
+bool AppendHostlistItem(strpool **hostlist, char *s);
 bool AppendHostList(strpool **hostlist, const char *filename);
 bool LoadAllHostLists();
 bool NonEmptyHostlist(strpool **hostlist);

tpws/ipset.c

@@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else if (parse_cidr6(cidr,&c6))
 		{
@@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 				ipsetDestroy(ips);
 				return false;
 			}
-			(*ct)++;
+			if (ct) (*ct)++;
 		}
 		else
 			DLOG_ERR("bad ip or subnet : %s\n",cidr);
@@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
 
 }
 
+bool AppendIpsetItem(ipset *ips, char *ip)
+{
+	return addpool(ips,&ip,ip+strlen(ip),NULL);
+}
+
 static bool AppendIpset(ipset *ips, const char *filename)
 {
 	char *p, *e, s[256], *zbuf;
@@ -119,21 +124,24 @@ static bool AppendIpset(ipset *ips, const char *filename)
 
 static bool LoadIpset(struct ipset_file *hfile)
 {
-	time_t t = file_mod_time(hfile->filename);
+	if (hfile->filename)
-	if (!t)
-	{
-		// stat() error
-		DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
-		return true;
-	}
-	if (t==hfile->mod_time) return true; // up to date
-	ipsetDestroy(&hfile->ipset);
-	if (!AppendIpset(&hfile->ipset, hfile->filename))
 	{
+		time_t t = file_mod_time(hfile->filename);
+		if (!t)
+		{
+			// stat() error
+			DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
+			return true;
+		}
+			if (t==hfile->mod_time) return true; // up to date
 		ipsetDestroy(&hfile->ipset);
-		return false;
+		if (!AppendIpset(&hfile->ipset, hfile->filename))
+		{
+			ipsetDestroy(&hfile->ipset);
+			return false;
+		}
+		hfile->mod_time=t;
 	}
-	hfile->mod_time=t;
 	return true;
 }
 static bool LoadIpsets(struct ipset_files_head *list)
@@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 
 	LIST_FOREACH(item, ips_exclude, next)
 	{
-		VPRINT("[%s] exclude ",item->hfile->filename);
+		VPRINT("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
 		if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 			return false;
 	}
@@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
 	{
 		LIST_FOREACH(item, ips, next)
 		{
-			VPRINT("[%s] include ",item->hfile->filename);
+			VPRINT("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
 			if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
 				return true;
 		}
@@ -234,17 +242,27 @@ bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, con
 static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct ipset_collection_head *ips_collection, const char *filename)
 {
 	struct ipset_file *hfile;
-	if (!(hfile=ipset_files_search(ipsets, filename)))
+	if (filename)
-		if (!(hfile=ipset_files_add(ipsets, filename)))
+	{
+		if (!(hfile=ipset_files_search(ipsets, filename)))
+			if (!(hfile=ipset_files_add(ipsets, filename)))
+				return NULL;
+		if (!ipset_collection_search(ips_collection, filename))
+			if (!ipset_collection_add(ips_collection, hfile))
+				return NULL;
+	}
+	else
+	{
+		if (!(hfile=ipset_files_add(ipsets, NULL)))
 			return NULL;
-	if (!ipset_collection_search(ips_collection, filename))
 		if (!ipset_collection_add(ips_collection, hfile))
 			return NULL;
+	}
 	return hfile;
 }
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
 {
-	if (!file_mod_time(filename))
+	if (filename && !file_mod_time(filename))
 	{
 		DLOG_ERR("cannot access ipset file '%s'\n",filename);
 		return NULL;
@@ -277,13 +295,24 @@ void IpsetsDebug()
 	struct ipset_item *ips_item;
 
 	LIST_FOREACH(hfile, &params.ipsets, next)
-		VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
+	{
+		if (hfile->filename)
+			VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
+		else
+			VPRINT("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
+	}
 
 	LIST_FOREACH(dpl, &params.desync_profiles, next)
 	{
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
-			VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			if (ips_item->hfile->filename)
+				VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				VPRINT("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 		LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
-			VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			if (ips_item->hfile->filename)
+				VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
+			else
+				VPRINT("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
 	}
 }

tpws/ipset.h

@@ -9,3 +9,4 @@ bool LoadAllIpsets();
 bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
 struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
 void IpsetsDebug();
+bool AppendIpsetItem(ipset *ips, char *ip);

tpws/pools.c

@@ -154,18 +154,22 @@ void strlist_destroy(struct str_list_head *head)
 
 
 
-
 struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const char *filename)
 {
 	struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
 	if (entry)
 	{
-		if (!(entry->filename = strdup(filename)))
+		if (filename)
 		{
-			free(entry);
+			if (!(entry->filename = strdup(filename)))
-			return false;
+			{
+				free(entry);
+				return false;
+			}
 		}
-		entry->mod_time=0;
+		else
+			entry->filename = NULL;
+		entry->mod_time = 0;
 		entry->hostlist = NULL;
 		LIST_INSERT_HEAD(head, entry, next);
 	}
@@ -192,7 +196,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -223,7 +227,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;
@@ -369,12 +373,17 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
 	struct ipset_file *entry = malloc(sizeof(struct ipset_file));
 	if (entry)
 	{
-		if (!(entry->filename = strdup(filename)))
+		if (filename)
 		{
-			free(entry);
+			if (!(entry->filename = strdup(filename)))
-			return false;
+			{
+				free(entry);
+				return false;
+			}
 		}
-		entry->mod_time=0;
+		else
+			entry->filename = NULL;
+		entry->mod_time = 0;
 		memset(&entry->ipset,0,sizeof(entry->ipset));
 		LIST_INSERT_HEAD(head, entry, next);
 	}
@@ -401,7 +410,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
 
 	LIST_FOREACH(hfile, head, next)
 	{
-		if (!strcmp(hfile->filename,filename))
+		if (hfile->filename && !strcmp(hfile->filename,filename))
 			return hfile;
 	}
 	return NULL;
@@ -432,7 +441,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
 
 	LIST_FOREACH(item, head, next)
 	{
-		if (!strcmp(item->hfile->filename,filename))
+		if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
 			return item;
 	}
 	return NULL;

tpws/tpws.c

@@ -182,10 +182,14 @@ static void exithelp(void)
 		" --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n"
 		" --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n"
 		" --ipset=<filename>\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
+		" --ipset-ip=<ip_list>\t\t\t; comma separated fixed subnet list\n"
 		" --ipset-exclude=<filename>\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
+		" --ipset-exclude-ip=<ip_list>\t\t; comma separated fixed subnet list\n"
 		"\nHOSTLIST FILTER:\n"
 		" --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
+		" --hostlist-domains=<domain_list>\t; comma separated fixed domain list\n"
 		" --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
+		" --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list\n"
 		" --hostlist-auto=<filename>\t\t; detect DPI blocks and build hostlist automatically\n"
 		" --hostlist-auto-fail-threshold=<int>\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
 		" --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n"
@@ -484,6 +488,46 @@ static bool parse_pf_list(char *opt, struct port_filters_head *pfl)
 	return true;
 }
 
+static bool parse_domain_list(char *opt, strpool **pp)
+{
+	char *e,*p,c;
+
+	for (p=opt ; p ; )
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+
+		if (*p && !AppendHostlistItem(pp,p)) return false;
+
+		if (e) *e++=c;
+		p = e;
+	}
+	return true;
+}
+
+static bool parse_ip_list(char *opt, ipset *pp)
+{
+	char *e,*p,c;
+
+	for (p=opt ; p ; )
+	{
+		if ((e = strchr(p,',')))
+		{
+			c=*e;
+			*e=0;
+		}
+
+		if (*p && !AppendIpsetItem(pp,p)) return false;
+
+		if (e) *e++=c;
+		p = e;
+	}
+	return true;
+}
+
 #if !defined( __OpenBSD__) && !defined(__ANDROID__)
 // no static to not allow optimizer to inline this func (save stack)
 void config_from_file(const char *filename)
@@ -526,6 +570,8 @@ void parse_params(int argc, char *argv[])
 	int option_index = 0;
 	int v, i;
 	bool bSkip=false;
+	struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL;
+	struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL;
 
 	memset(&params, 0, sizeof(params));
 	params.maxconn = DEFAULT_MAX_CONN;
@@ -611,46 +657,50 @@ void parse_params(int argc, char *argv[])
 		{ "tlsrec",required_argument,0,0 },// optidx=34
 		{ "tlsrec-pos",required_argument,0,0 },// optidx=35
 		{ "hostlist",required_argument,0,0 },// optidx=36
-		{ "hostlist-exclude",required_argument,0,0 },// optidx=37
+		{ "hostlist-domains",required_argument,0,0 },// optidx=37
-		{ "hostlist-auto",required_argument,0,0}, // optidx=38
+		{ "hostlist-exclude",required_argument,0,0 },// optidx=38
-		{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=39
+		{ "hostlist-exclude-domains",required_argument,0,0 },// optidx=39
-		{ "hostlist-auto-fail-time",required_argument,0,0},	// optidx=40
+		{ "hostlist-auto",required_argument,0,0}, // optidx=40
-		{ "hostlist-auto-debug",required_argument,0,0}, // optidx=41
+		{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=41
-		{ "pidfile",required_argument,0,0 },// optidx=42
+		{ "hostlist-auto-fail-time",required_argument,0,0},	// optidx=42
-		{ "debug",optional_argument,0,0 },// optidx=43
+		{ "hostlist-auto-debug",required_argument,0,0}, // optidx=43
-		{ "debug-level",required_argument,0,0 },// optidx=44
+		{ "pidfile",required_argument,0,0 },// optidx=44
-		{ "local-rcvbuf",required_argument,0,0 },// optidx=45
+		{ "debug",optional_argument,0,0 },// optidx=45
-		{ "local-sndbuf",required_argument,0,0 },// optidx=46
+		{ "debug-level",required_argument,0,0 },// optidx=46
-		{ "remote-rcvbuf",required_argument,0,0 },// optidx=47
+		{ "local-rcvbuf",required_argument,0,0 },// optidx=47
-		{ "remote-sndbuf",required_argument,0,0 },// optidx=48
+		{ "local-sndbuf",required_argument,0,0 },// optidx=48
-		{ "socks",no_argument,0,0 },// optidx=40
+		{ "remote-rcvbuf",required_argument,0,0 },// optidx=49
-		{ "no-resolve",no_argument,0,0 },// optidx=50
+		{ "remote-sndbuf",required_argument,0,0 },// optidx=50
-		{ "resolver-threads",required_argument,0,0 },// optidx=51
+		{ "socks",no_argument,0,0 },// optidx=51
-		{ "skip-nodelay",no_argument,0,0 },// optidx=52
+		{ "no-resolve",no_argument,0,0 },// optidx=52
-		{ "tamper-start",required_argument,0,0 },// optidx=53
+		{ "resolver-threads",required_argument,0,0 },// optidx=53
-		{ "tamper-cutoff",required_argument,0,0 },// optidx=54
+		{ "skip-nodelay",no_argument,0,0 },// optidx=54
-		{ "connect-bind-addr",required_argument,0,0 },// optidx=55
+		{ "tamper-start",required_argument,0,0 },// optidx=55
+		{ "tamper-cutoff",required_argument,0,0 },// optidx=56
+		{ "connect-bind-addr",required_argument,0,0 },// optidx=57
 
-		{ "new",no_argument,0,0 },				// optidx=56
+		{ "new",no_argument,0,0 },				// optidx=58
-		{ "skip",no_argument,0,0 },				// optidx=57
+		{ "skip",no_argument,0,0 },				// optidx=59
-		{ "filter-l3",required_argument,0,0 },			// optidx=58
+		{ "filter-l3",required_argument,0,0 },			// optidx=60
-		{ "filter-tcp",required_argument,0,0 },			// optidx=59
+		{ "filter-tcp",required_argument,0,0 },			// optidx=61
-		{ "filter-l7",required_argument,0,0 },			// optidx=60
+		{ "filter-l7",required_argument,0,0 },			// optidx=62
-		{ "ipset",required_argument,0,0 },			// optidx=61
+		{ "ipset",required_argument,0,0 },			// optidx=63
-		{ "ipset-exclude",required_argument,0,0 },		// optidx=62
+		{ "ipset-ip",required_argument,0,0 },			// optidx=64
+		{ "ipset-exclude",required_argument,0,0 },		// optidx=65
+		{ "ipset-exclude-ip",required_argument,0,0 },		// optidx=66
 
 #if defined(__FreeBSD__)
-		{ "enable-pf",no_argument,0,0 },// optidx=62
+		{ "enable-pf",no_argument,0,0 },// optidx=67
 #elif defined(__APPLE__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=63
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=67
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=64
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=68
 #elif defined(__linux__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=63
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=67
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=64
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=68
-		{ "mss",required_argument,0,0 },			// optidx=65
+		{ "mss",required_argument,0,0 },			// optidx=69
-		{ "fix-seg",optional_argument,0,0 },			// optidx=66
+		{ "fix-seg",optional_argument,0,0 },			// optidx=70
 #ifdef SPLICE_PRESENT
-		{ "nosplice",no_argument,0,0 },				// optidx=67
+		{ "nosplice",no_argument,0,0 },				// optidx=71
 #endif
 #endif
 		{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@@ -948,6 +998,7 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 36: /* hostlist */
+			if (bSkip) break;
 			if (!RegisterHostlist(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@@ -955,7 +1006,22 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 37: /* hostlist-exclude */
+		case 37: /* hostlist-domains */
+			if (bSkip) break;
+			if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous hostlist\n");
+				exit_clean(1);
+			}
+			if (!parse_domain_list(optarg, &anon_hl->hostlist))
+			{
+				DLOG_ERR("failed to add domains to anonymous hostlist\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
+		case 38: /* hostlist-exclude */
+			if (bSkip) break;
 			if (!RegisterHostlist(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@@ -963,7 +1029,22 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 38: /* hostlist-auto */
+		case 39: /* hostlist-exclude-domains */
+			if (bSkip) break;
+			if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous hostlist\n");
+				exit_clean(1);
+			}
+			if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist))
+			{
+				DLOG_ERR("failed to add domains to anonymous hostlist\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
+		case 40: /* hostlist-auto */
+			if (bSkip) break;
 			if (dp->hostlist_auto)
 			{
 				DLOG_ERR("only one auto hostlist per profile is supported\n");
@@ -991,7 +1072,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice.
 			break;
-		case 39: /* hostlist-auto-fail-threshold */
+		case 41: /* hostlist-auto-fail-threshold */
 			dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
 			{
@@ -999,7 +1080,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 40: /* hostlist-auto-fail-time */
+		case 42: /* hostlist-auto-fail-time */
 			dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_time<1)
 			{
@@ -1007,7 +1088,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 41: /* hostlist-auto-debug */
+		case 43: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -1020,11 +1101,11 @@ void parse_params(int argc, char *argv[])
 				params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
 			}
 			break;
-		case 42: /* pidfile */
+		case 44: /* pidfile */
 			strncpy(params.pidfile,optarg,sizeof(params.pidfile));
 			params.pidfile[sizeof(params.pidfile)-1]='\0';
 			break;
-		case 43: /* debug */
+		case 45: /* debug */
 			if (optarg)
 			{
 				if (*optarg=='@')
@@ -1058,44 +1139,44 @@ void parse_params(int argc, char *argv[])
 				params.debug_target = LOG_TARGET_CONSOLE;
 			}
 			break;
-		case 44: /* debug-level */
+		case 46: /* debug-level */
 			params.debug = atoi(optarg);
 			break;
-		case 45: /* local-rcvbuf */
+		case 47: /* local-rcvbuf */
 #ifdef __linux__
 			params.local_rcvbuf = atoi(optarg)/2;
 #else
 			params.local_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 46: /* local-sndbuf */
+		case 48: /* local-sndbuf */
 #ifdef __linux__
 			params.local_sndbuf = atoi(optarg)/2;
 #else
 			params.local_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 47: /* remote-rcvbuf */
+		case 49: /* remote-rcvbuf */
 #ifdef __linux__
 			params.remote_rcvbuf = atoi(optarg)/2;
 #else
 			params.remote_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 48: /* remote-sndbuf */
+		case 50: /* remote-sndbuf */
 #ifdef __linux__
 			params.remote_sndbuf = atoi(optarg)/2;
 #else
 			params.remote_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 49: /* socks */
+		case 51: /* socks */
 			params.proxy_type = CONN_TYPE_SOCKS;
 			break;
-		case 50: /* no-resolve */
+		case 52: /* no-resolve */
 			params.no_resolve = true;
 			break;
-		case 51: /* resolver-threads */
+		case 53: /* resolver-threads */
 			params.resolver_threads = atoi(optarg);
 			if (params.resolver_threads<1 || params.resolver_threads>300)
 			{
@@ -1103,10 +1184,10 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 52: /* skip-nodelay */
+		case 54: /* skip-nodelay */
 			params.skip_nodelay = true;
 			break;
-		case 53: /* tamper-start */
+		case 55: /* tamper-start */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -1120,7 +1201,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 54: /* tamper-cutoff */
+		case 56: /* tamper-cutoff */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -1134,7 +1215,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 55: /* connect-bind-addr */
+		case 57: /* connect-bind-addr */
 			{
 				char *p = strchr(optarg,'%');
 				if (p) *p++=0;
@@ -1162,7 +1243,7 @@ void parse_params(int argc, char *argv[])
 			break;
 
 
-		case 56: /* new */
+		case 58: /* new */
 			if (bSkip)
 			{
 				dp_clear(dp);
@@ -1180,32 +1261,35 @@ void parse_params(int argc, char *argv[])
 				dp = &dpl->dp;
 				dp->n = ++desync_profile_count;
 			}
+			anon_hl = anon_hl_exclude = NULL;
+			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 57: /* skip */
+		case 59: /* skip */
 			bSkip = true;
 			break;
-		case 58: /* filter-l3 */
+		case 60: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 59: /* filter-tcp */
+		case 61: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 60: /* filter-l7 */
+		case 62: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 61: /* ipset */
+		case 63: /* ipset */
+			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1213,7 +1297,22 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 62: /* ipset-exclude */
+		case 64: /* ipset-ip */
+			if (bSkip) break;
+			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous ipset\n");
+				exit_clean(1);
+			}
+			if (!parse_ip_list(optarg, &anon_ips->ipset))
+			{
+				DLOG_ERR("failed to add subnets to anonymous ipset\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
+		case 65: /* ipset-exclude */
+			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
 				DLOG_ERR("failed to register ipset '%s'\n", optarg);
@@ -1221,13 +1320,27 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
+		case 66: /* ipset-exclude-ip */
+			if (bSkip) break;
+			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
+			{
+				DLOG_ERR("failed to register anonymous ipset\n");
+				exit_clean(1);
+			}
+			if (!parse_ip_list(optarg, &anon_ips_exclude->ipset))
+			{
+				DLOG_ERR("failed to add subnets to anonymous ipset\n");
+				exit_clean(1);
+			}
+			params.tamper = true;
+			break;
 
 #if defined(__FreeBSD__)
-		case 63: /* enable-pf */
+		case 67: /* enable-pf */
 			params.pf_enable = true;
 			break;
 #elif defined(__linux__) || defined(__APPLE__)
-		case 63: /* local-tcp-user-timeout */
+		case 67: /* local-tcp-user-timeout */
 			params.tcp_user_timeout_local = atoi(optarg);
 			if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
 			{
@@ -1235,7 +1348,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 64: /* remote-tcp-user-timeout */
+		case 68: /* remote-tcp-user-timeout */
 			params.tcp_user_timeout_remote = atoi(optarg);
 			if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
 			{
@@ -1246,7 +1359,7 @@ void parse_params(int argc, char *argv[])
 #endif
 
 #if defined(__linux__)
-		case 65: /* mss */
+		case 69: /* mss */
 			// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
 			dp->mss = atoi(optarg);
 			if (dp->mss<88 || dp->mss>32767)
@@ -1255,7 +1368,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 66: /* fix-seg */
+		case 70: /* fix-seg */
 			if (!params.fix_seg_avail)
 			{
 				DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
@@ -1275,7 +1388,7 @@ void parse_params(int argc, char *argv[])
 				params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
 			break;
 #ifdef SPLICE_PRESENT
-		case 67: /* nosplice */
+		case 71: /* nosplice */
 			params.nosplice = true;
 			break;
 #endif
@@ -1499,6 +1612,15 @@ struct salisten_s
 	int bind_wait_ip_left; // how much seconds left from bind_wait_ip
 };
 static const char *bindll_s[] = { "unwanted","no","prefer","force" };
+
+#define STRINGIFY(x) #x
+#define TOSTRING(x) STRINGIFY(x)
+#if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
+#define PRINT_VER printf("github version %s (%s)\n\n", TOSTRING(ZAPRET_GH_VER), TOSTRING(ZAPRET_GH_HASH))
+#else
+#define PRINT_VER printf("self-built version %s %s\n\n", __DATE__, __TIME__)
+#endif
+
 int main(int argc, char *argv[])
 {
 	int i, listen_fd[MAX_BINDS], yes = 1, retval = 0, if_index, exit_v=EXIT_FAILURE;
@@ -1509,6 +1631,8 @@ int main(int argc, char *argv[])
 	srand(time(NULL));
 	mask_from_preflen6_prepare();
 
+	PRINT_VER;
+
 	parse_params(argc, argv);
 	argv=NULL; argc=0;