update docs

.github/workflows/build.yml

@@ -22,6 +22,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - arch: lexra
+            tool: mips-linux
+            dir: rsdk-4.6.4-5281-EB-3.10-0.9.33-m32ub-20141001
           - arch: arm64
             tool: aarch64-unknown-linux-musl
           - arch: arm
@@ -61,12 +64,21 @@ jobs:
       - name: Set up build tools
         env:
           REPO: 'spvkgn/musl-cross'
+          REPO_LEXRA: 'bol-van/build'
+          ARCH: ${{ matrix.arch }}
           TOOL: ${{ matrix.tool }}
+          DIR: ${{ matrix.dir }}
         run: |
-          sudo apt update -qq && sudo apt install -y libcap-dev
+          DIR=${DIR:-$TOOL}
+          [ "$ARCH" = lexra ] && sudo dpkg --add-architecture i386
+          sudo apt update -qq
+          sudo apt install -y libcap-dev
+          [ "$ARCH" = lexra ] && sudo apt install -y libc6:i386 zlib1g:i386
           mkdir -p $HOME/tools
-          wget -qO- https://github.com/$REPO/releases/download/latest/$TOOL.tar.xz | tar -C $HOME/tools -xJ || exit 1
+          URL=https://github.com/$REPO/releases/download/latest/$DIR.tar.xz
-          [ -d "$HOME/tools/$TOOL/bin" ] && echo "$HOME/tools/$TOOL/bin" >> $GITHUB_PATH
+          [ "$ARCH" = lexra ] && URL=https://github.com/$REPO_LEXRA/raw/refs/heads/master/$DIR.txz
+          wget -qO- $URL | tar -C $HOME/tools -xJ || exit 1
+          [ -d "$HOME/tools/$DIR/bin" ] && echo "$HOME/tools/$DIR/bin" >> $GITHUB_PATH
 
       - name: Build
         env:
@@ -81,6 +93,10 @@ jobs:
           export NM=$TARGET-nm
           export STRIP=$TARGET-strip
           export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
+          export STAGING_DIR=/tmp
+          LDFLAGS=
+          [ "$ARCH" = lexra ] && LDFLAGS=-lgcc_eh
+          export LDFLAGS
 
           # netfilter libs
           wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
@@ -114,7 +130,7 @@ jobs:
 
           # zapret
           CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include" \
-          LDFLAGS="-L$DEPS_DIR/lib" \
+          LDFLAGS="-L$DEPS_DIR/lib $LDFLAGS" \
           make -C zapret -j$(nproc)
           tar -C zapret/binaries/my -cJf zapret-linux-$ARCH.tar.xz .
 
@@ -390,7 +406,7 @@ jobs:
                   if [[ $dir == *-linux-x86_64 ]]; then
                     tar -C $dir -czvf $dir/tpws_wsl.tgz tpws
                     run_upx $dir/*
-                  elif [[ $dir =~ linux ]] && [[ $dir != *-linux-mips64 ]]; then
+                  elif [[ $dir =~ linux ]] && [[ $dir != *-linux-mips64 ]] && [[ $dir != *-linux-lexra ]]; then
                     run_upx $dir/*
                   fi
                   ;;
@@ -422,6 +438,7 @@ jobs:
                 *-linux-ppc )           run_dir ppc ;;
                 *-linux-x86 )           run_dir x86 ;;
                 *-linux-x86_64 )        run_dir x86_64 ;;
+                *-linux-lexra )         run_dir lexra ;;
                 *-mac-x64 )             run_dir mac64 ;;
                 *-win-x86 )             run_dir win32 ;;
                 *-win-x86_64 )          run_dir win64 ;;

blockcheck.sh

@@ -212,7 +212,7 @@ doh_resolve()
 	# $1 - ip version 4/6
 	# $2 - hostname
 	# $3 - doh server URL. use $DOH_SERVER if empty
-	$MDIG --family=$1 --dns-make-query=$2 | curl -s --data-binary @- -H "Content-Type: application/dns-message" "${3:-$DOH_SERVER}" | $MDIG --dns-parse-query
+	$MDIG --family=$1 --dns-make-query=$2 | $CURL -s --data-binary @- -H "Content-Type: application/dns-message" "${3:-$DOH_SERVER}" | $MDIG --dns-parse-query
 }
 doh_find_working()
 {

docs/changes.txt

@@ -423,3 +423,14 @@ v69.6
 nfqws: set NETLINK_NO_ENOBUFS to fix possible nfq recv errors
 init.d: unify custom scripts for linux
 init.d: new custom scripts : 20-fw-extra, 50-wg4all
+
+v69.7
+
+nfqws,tpws: --comment
+nfqws: trash flood warning
+winws: exclude empty outgoing ack packets in windivert filter
+
+v69.8
+
+winws: accept empty outgoing RST and FIN packets for conntrack needs
+repo: lexra build

docs/readme.en.md

@@ -1,4 +1,4 @@
-# zapret v69.6
+# zapret v69.8
 
 # SCAMMER WARNING
 
@@ -132,6 +132,7 @@ nfqws takes the following parameters:
 
  --debug=0|1
  --dry-run                                      ; verify parameters and exit with code 0 if successful
+ --comment                                      ; any text (ignored)
  --qnum=<nfqueue_number>
  --daemon                                       ; daemonize
  --pidfile=<filename>                           ; write pid to file

docs/readme.md

@@ -1,4 +1,4 @@
-# zapret v69.6
+# zapret v69.8
 
 # ВНИМАНИЕ, остерегайтесь мошенников
 
@@ -163,6 +163,7 @@ dvtws, собираемый из тех же исходников (см. [док
 
 --debug=0|1                                        ; 1=выводить отладочные сообщения
 --dry-run                                          ; проверить опции командной строки и выйти. код 0 - успешная проверка.
+--comment                                          ; любой текст (игнорируется)
 --daemon                                           ; демонизировать прогу
 --pidfile=<file>                                   ; сохранить PID в файл
 --user=<username>                                  ; менять uid процесса

install_bin.sh

@@ -56,7 +56,7 @@ UNAME=$(uname)
 unset PKTWS
 case $UNAME in
 	Linux)
-		ARCHLIST="my x86_64 x86 aarch64 arm mips64r2-msb mips32r1-lsb mips32r1-msb ppc"
+		ARCHLIST="my x86_64 x86 aarch64 arm mips64r2-msb mips32r1-lsb mips32r1-msb lexra ppc"
 		PKTWS=nfqws
 		;;
 	Darwin)

ip2net/Makefile

@@ -9,22 +9,22 @@ SRC_FILES = ip2net.c qsort.c
 all: ip2net
 
 ip2net: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 android: ip2net
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2neta $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2neta $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2netx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2netx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS) $(LDFLAGS)
 	strip ip2neta ip2netx
 	lipo -create -output ip2net ip2netx ip2neta
 	rm -f ip2netx ip2neta
 
 win: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS_WIN)
+	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o ip2net $(SRC_FILES) $(LIBS_WIN) $(LDFLAGS)
 
 clean:
 	rm -f ip2net *.o

mdig/Makefile

@@ -10,23 +10,23 @@ SRC_FILES = *.c
 all: mdig
 
 mdig: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 android: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_ANDROID)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LIBS_ANDROID) $(LDFLAGS)
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdiga $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdiga $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdigx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdigx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
 	strip mdiga mdigx
 	lipo -create -output mdig mdigx mdiga
 	rm -f mdigx mdiga
 
 win: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_WIN)
+	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o mdig $(SRC_FILES) $(LIBS_WIN) $(LDFLAGS)
 
 clean:
 	rm -f mdig *.o

nfq/BSDmakefile

@@ -6,7 +6,7 @@ SRC_FILES = *.c crypto/*.c
 all: dvtws
 
 dvtws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 clean:
 	rm -f dvtws

nfq/Makefile

@@ -14,24 +14,24 @@ SRC_FILES = *.c crypto/*.c
 all: nfqws
 
 nfqws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LIBS_LINUX) $(LDFLAGS)
 
 android: nfqws
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS_BSD)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LIBS_BSD) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
 	strip dvtwsa dvtwsx
 	lipo -create -output dvtws dvtwsx dvtwsa
 	rm -f dvtwsx dvtwsa
 
 cygwin64:
-	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) $(LIBS_CYGWIN64) $(RES_CYGWIN64)
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LIBS_CYGWIN) $(LIBS_CYGWIN64) $(RES_CYGWIN64) $(LDFLAGS)
 cygwin32:
-	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) $(LIBS_CYGWIN32) $(RES_CYGWIN32)
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LIBS_CYGWIN) $(LIBS_CYGWIN32) $(RES_CYGWIN32) $(LDFLAGS)
 cygwin: cygwin64
 
 clean:

nfq/desync.c

@@ -76,13 +76,6 @@ void randomize_default_tls_payload(uint8_t *p)
 #define PKTDATA_MAXDUMP 32
 #define IP_MAXDUMP 80
 
-static uint8_t zeropkt[DPI_DESYNC_MAX_FAKE_LEN];
-
-void desync_init(void)
-{
-	memset(zeropkt, 0, sizeof(zeropkt));
-}
-
 bool desync_valid_zero_stage(enum dpi_desync_mode mode)
 {
 	return mode==DESYNC_SYNACK || mode==DESYNC_SYNDATA;

nfq/desync.h

@@ -52,5 +52,4 @@ bool desync_valid_second_stage(enum dpi_desync_mode mode);
 bool desync_valid_second_stage_tcp(enum dpi_desync_mode mode);
 bool desync_valid_second_stage_udp(enum dpi_desync_mode mode);
 
-void desync_init(void);
 uint8_t dpi_desync_packet(uint32_t fwmark, const char *ifout, uint8_t *data_pkt, size_t *len_pkt);

nfq/nfqws.c

@@ -84,8 +84,6 @@ static void pre_desync(void)
 	signal(SIGHUP, onhup);
 	signal(SIGUSR1, onusr1);
 	signal(SIGUSR2, onusr2);
-
-	desync_init();
 }
 
 
@@ -238,19 +236,15 @@ static int nfq_main(void)
 	int fd,e;
 	ssize_t rd;
 
-#ifndef __CYGWIN__
 	sec_harden();
-
 	if (params.droproot && !droproot(params.uid, params.gid))
-		goto exiterr;
+		return 1;
-
 	print_id();
-#endif
 
 	pre_desync();
 
 	if (!nfq_init(&h,&qh))
-		goto exiterr;
+		return 1;
 
 	fd = nfq_fd(h);
 	do
@@ -273,13 +267,7 @@ static int nfq_main(void)
 	} while(e==ENOBUFS);
 
 	nfq_deinit(&h,&qh);
-
 	return 0;
-
-exiterr:
-	if (qh) nfq_destroy_queue(qh);
-	if (h) nfq_close(h);
-	return 1;
 }
 
 #elif defined(BSD)
@@ -313,8 +301,6 @@ static int dvt_main(void)
 			DLOG_PERROR("bind (DIVERT4)");
 			goto exiterr;
 		}
-		if (!set_socket_buffers(fd[0],Q_RCVBUF,Q_SNDBUF))
-			goto exiterr;
 	}
 
 
@@ -339,8 +325,6 @@ static int dvt_main(void)
 			goto exiterr;
 		}
 		fdct++;
-		if (!set_socket_buffers(fd[1],Q_RCVBUF,Q_SNDBUF))
-			goto exiterr;
 	}
 #endif
 	fdmax = (fd[0]>fd[1] ? fd[0] : fd[1]) + 1;
@@ -995,6 +979,7 @@ static bool wf_make_pf(char *opt, const char *l4, const char *portname, char *bu
 #define DIVERT_NO_LOCALNETS_SRC "(" DIVERT_NO_LOCALNETSv4_SRC " or " DIVERT_NO_LOCALNETSv6_SRC ")"
 #define DIVERT_NO_LOCALNETS_DST "(" DIVERT_NO_LOCALNETSv4_DST " or " DIVERT_NO_LOCALNETSv6_DST ")"
 
+#define DIVERT_TCP_NOT_EMPTY "(!tcp or tcp.Syn or tcp.Rst or tcp.Fin or tcp.PayloadLength>0)"
 #define DIVERT_TCP_INBOUNDS "(tcp.Ack and tcp.Syn or tcp.Rst or tcp.Fin)"
 
 // HTTP/1.? 30(2|7)
@@ -1012,6 +997,7 @@ static bool wf_make_filter(
 	char pf_dst_buf[512],iface[64];
 	const char *pf_dst;
 	const char *f_tcpin = *pf_tcp_src ? dp_list_have_autohostlist(&params.desync_profiles) ? "(" DIVERT_TCP_INBOUNDS " or (" DIVERT_HTTP_REDIRECT "))" : DIVERT_TCP_INBOUNDS : "";
+	const char *f_tcp_not_empty = *pf_tcp_src ? DIVERT_TCP_NOT_EMPTY " and " : "";
 
 	snprintf(iface,sizeof(iface)," ifIdx=%u and subIfIdx=%u and",IfIdx,SubIfIdx);
 
@@ -1024,9 +1010,10 @@ static bool wf_make_filter(
 	else
 		pf_dst = *pf_tcp_dst ? pf_tcp_dst : pf_udp_dst;
 	snprintf(wf,len,
- 	       DIVERT_PROLOG " and%s%s\n ((outbound and %s%s)\n  or\n  (inbound and tcp%s%s%s%s%s%s%s))",
+	       DIVERT_PROLOG " and%s%s\n ((outbound and %s%s%s)\n  or\n  (inbound and tcp%s%s%s%s%s%s%s))",
 		IfIdx ? iface : "",
 		ipv4 ? ipv6 ? "" : " ip and" : " ipv6 and",
+		f_tcp_not_empty,
 		pf_dst,
 		ipv4 ? ipv6 ? " and " DIVERT_NO_LOCALNETS_DST : " and " DIVERT_NO_LOCALNETSv4_DST : " and " DIVERT_NO_LOCALNETSv6_DST,
 		*pf_tcp_src ? "" : " and false",
@@ -1059,6 +1046,7 @@ static void exithelp(void)
 #endif
 		" --debug=0|1|syslog|@<filename>\n"
 		" --dry-run\t\t\t\t\t; verify parameters and exit with code 0 if successful\n"
+		" --comment=any_text\n"
 #ifdef __linux__
 		" --qnum=<nfqueue_number>\n"
 #elif defined(BSD)
@@ -1203,6 +1191,27 @@ void config_from_file(const char *filename)
 }
 #endif
 
+void check_dp(const struct desync_profile *dp)
+{
+	// only linux has connbytes limiter
+	if (dp->desync_any_proto && !dp->desync_cutoff &&
+		(dp->desync_mode==DESYNC_FAKE || dp->desync_mode==DESYNC_RST || dp->desync_mode==DESYNC_RSTACK ||
+		 dp->desync_mode==DESYNC_FAKEDSPLIT || dp->desync_mode==DESYNC_FAKEDDISORDER || dp->desync_mode2==DESYNC_FAKEDSPLIT || dp->desync_mode2==DESYNC_FAKEDDISORDER))
+	{
+#ifdef __linux__
+		DLOG_CONDUP("WARNING !!! in profile %d you are using --dpi-desync-any-protocol without --dpi-desync-cutoff\n", dp->n);
+		DLOG_CONDUP("WARNING !!! it's completely ok if connbytes or payload based ip/nf tables limiter is applied. Make sure it exists.\n");
+#else
+		DLOG_CONDUP("WARNING !!! possible TRASH FLOOD configuration detected in profile %d\n", dp->n);
+		DLOG_CONDUP("WARNING !!! it's highly recommended to use --dpi-desync-cutoff limiter or fakes will be sent on every processed packet\n");
+		DLOG_CONDUP("WARNING !!! make sure it's really what you want\n");
+#ifdef __CYGWIN__
+		DLOG_CONDUP("WARNING !!! in most cases this is acceptable only with custom payload based windivert filter (--wf-raw)\n");
+#endif
+#endif
+	}
+}
+
 #define STRINGIFY(x) #x
 #define TOSTRING(x) STRINGIFY(x)
 #if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
@@ -1293,101 +1302,102 @@ int main(int argc, char **argv)
 	const struct option long_options[] = {
 		{"debug",optional_argument,0,0},	// optidx=0
 		{"dry-run",no_argument,0,0},		// optidx=1
+		{"comment",optional_argument,0,0},	// optidx=2
 #ifdef __linux__
-		{"qnum",required_argument,0,0},		// optidx=2
+		{"qnum",required_argument,0,0},		// optidx=3
 #elif defined(BSD)
-		{"port",required_argument,0,0},		// optidx=2
+		{"port",required_argument,0,0},		// optidx=3
 #else
-		{"disabled_argument_1",no_argument,0,0},// optidx=2
+		{"disabled_argument_1",no_argument,0,0},// optidx=3
 #endif
-		{"daemon",no_argument,0,0},		// optidx=3
+		{"daemon",no_argument,0,0},		// optidx=4
-		{"pidfile",required_argument,0,0},	// optidx=4
+		{"pidfile",required_argument,0,0},	// optidx=5
 #ifndef __CYGWIN__
-		{"user",required_argument,0,0 },	// optidx=5
+		{"user",required_argument,0,0 },	// optidx=6
-		{"uid",required_argument,0,0 },		// optidx=6
+		{"uid",required_argument,0,0 },		// optidx=7
 #else
-		{"disabled_argument_2",no_argument,0,0},	// optidx=5
+		{"disabled_argument_2",no_argument,0,0},	// optidx=6
-		{"disabled_argument_3",no_argument,0,0},	// optidx=6
+		{"disabled_argument_3",no_argument,0,0},	// optidx=7
 #endif
-		{"wsize",required_argument,0,0},	// optidx=7
+		{"wsize",required_argument,0,0},	// optidx=8
-		{"wssize",required_argument,0,0},	// optidx=8
+		{"wssize",required_argument,0,0},	// optidx=9
-		{"wssize-cutoff",required_argument,0,0},// optidx=9
+		{"wssize-cutoff",required_argument,0,0},// optidx=10
-		{"ctrack-timeouts",required_argument,0,0},// optidx=10
+		{"ctrack-timeouts",required_argument,0,0},// optidx=11
-		{"hostcase",no_argument,0,0},		// optidx=11
+		{"hostcase",no_argument,0,0},		// optidx=12
-		{"hostspell",required_argument,0,0},	// optidx=12
+		{"hostspell",required_argument,0,0},	// optidx=13
-		{"hostnospace",no_argument,0,0},	// optidx=13
+		{"hostnospace",no_argument,0,0},	// optidx=14
-		{"domcase",no_argument,0,0 },		// optidx=14
+		{"domcase",no_argument,0,0 },		// optidx=15
-		{"methodeol",no_argument,0,0 },		// optidx=15
+		{"methodeol",no_argument,0,0 },		// optidx=16
 		{"dpi-desync",required_argument,0,0},		// optidx=17
 #ifdef __linux__
-		{"dpi-desync-fwmark",required_argument,0,0},	// optidx=17
+		{"dpi-desync-fwmark",required_argument,0,0},	// optidx=18
 #elif defined(SO_USER_COOKIE)
-		{"dpi-desync-sockarg",required_argument,0,0},	// optidx=17
+		{"dpi-desync-sockarg",required_argument,0,0},	// optidx=18
 #else
-		{"disabled_argument_4",no_argument,0,0},	// optidx=17
+		{"disabled_argument_4",no_argument,0,0},	// optidx=18
 #endif
-		{"dpi-desync-ttl",required_argument,0,0},	// optidx=18
+		{"dpi-desync-ttl",required_argument,0,0},	// optidx=19
-		{"dpi-desync-ttl6",required_argument,0,0},	// optidx=19
+		{"dpi-desync-ttl6",required_argument,0,0},	// optidx=20
-		{"dpi-desync-autottl",optional_argument,0,0},	// optidx=20
+		{"dpi-desync-autottl",optional_argument,0,0},	// optidx=21
-		{"dpi-desync-autottl6",optional_argument,0,0},	// optidx=21
+		{"dpi-desync-autottl6",optional_argument,0,0},	// optidx=22
-		{"dpi-desync-fooling",required_argument,0,0},	// optidx=22
+		{"dpi-desync-fooling",required_argument,0,0},	// optidx=23
-		{"dpi-desync-repeats",required_argument,0,0},	// optidx=23
+		{"dpi-desync-repeats",required_argument,0,0},	// optidx=24
-		{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=24
+		{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=25
-		{"dpi-desync-split-pos",required_argument,0,0},// optidx=25
+		{"dpi-desync-split-pos",required_argument,0,0},// optidx=26
-		{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=26
+		{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=27
-		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=27
+		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=28
-		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=28
+		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=29
-		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=29
+		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=30
-		{"dpi-desync-fakedsplit-pattern",required_argument,0,0 },// optidx=30
+		{"dpi-desync-fakedsplit-pattern",required_argument,0,0 },// optidx=31
-		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=31
+		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=32
-		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=32
+		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=33
-		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=33
+		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=34
-		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=34
+		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=35
-		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=35
+		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=36
-		{"dpi-desync-fake-http",required_argument,0,0},// optidx=36
+		{"dpi-desync-fake-http",required_argument,0,0},// optidx=37
-		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=37
+		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=38
-		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=38
+		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=39
-		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=39
+		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=40
-		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=40
+		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=41
-		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=41
+		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=42
-		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=42
+		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=43
-		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=43
+		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=44
-		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=44
+		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=45
-		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=45
+		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=46
-		{"dpi-desync-cutoff",required_argument,0,0},// optidx=46
+		{"dpi-desync-cutoff",required_argument,0,0},// optidx=47
-		{"dpi-desync-start",required_argument,0,0},// optidx=47
+		{"dpi-desync-start",required_argument,0,0},// optidx=48
-		{"hostlist",required_argument,0,0},		// optidx=48
+		{"hostlist",required_argument,0,0},		// optidx=49
-		{"hostlist-domains",required_argument,0,0},// optidx=49
+		{"hostlist-domains",required_argument,0,0},// optidx=50
-		{"hostlist-exclude",required_argument,0,0},	// optidx=50
+		{"hostlist-exclude",required_argument,0,0},	// optidx=51
-		{"hostlist-exclude-domains",required_argument,0,0},// optidx=51
+		{"hostlist-exclude-domains",required_argument,0,0},// optidx=52
-		{"hostlist-auto",required_argument,0,0},	// optidx=52
+		{"hostlist-auto",required_argument,0,0},	// optidx=53
-		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=53
+		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=54
-		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=54
+		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=55
-		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=55
+		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=56
-		{"hostlist-auto-debug",required_argument,0,0},	// optidx=56
+		{"hostlist-auto-debug",required_argument,0,0},	// optidx=57
-		{"new",no_argument,0,0},	// optidx=57
+		{"new",no_argument,0,0},	// optidx=58
-		{"skip",no_argument,0,0},	// optidx=58
+		{"skip",no_argument,0,0},	// optidx=59
-		{"filter-l3",required_argument,0,0},	// optidx=59
+		{"filter-l3",required_argument,0,0},	// optidx=60
-		{"filter-tcp",required_argument,0,0},	// optidx=60
+		{"filter-tcp",required_argument,0,0},	// optidx=61
-		{"filter-udp",required_argument,0,0},	// optidx=61
+		{"filter-udp",required_argument,0,0},	// optidx=62
-		{"filter-l7",required_argument,0,0},	// optidx=62
+		{"filter-l7",required_argument,0,0},	// optidx=63
-		{"ipset",required_argument,0,0},	// optidx=63
+		{"ipset",required_argument,0,0},	// optidx=64
-		{"ipset-ip",required_argument,0,0},	// optidx=64
+		{"ipset-ip",required_argument,0,0},	// optidx=65
-		{"ipset-exclude",required_argument,0,0},// optidx=65
+		{"ipset-exclude",required_argument,0,0},// optidx=66
-		{"ipset-exclude-ip",required_argument,0,0},	// optidx=66
+		{"ipset-exclude-ip",required_argument,0,0},	// optidx=67
 #ifdef __linux__
-		{"bind-fix4",no_argument,0,0},		// optidx=67
+		{"bind-fix4",no_argument,0,0},		// optidx=68
-		{"bind-fix6",no_argument,0,0},		// optidx=68
+		{"bind-fix6",no_argument,0,0},		// optidx=69
 #elif defined(__CYGWIN__)
-		{"wf-iface",required_argument,0,0},	// optidx=67
+		{"wf-iface",required_argument,0,0},	// optidx=68
-		{"wf-l3",required_argument,0,0},	// optidx=68
+		{"wf-l3",required_argument,0,0},	// optidx=69
-		{"wf-tcp",required_argument,0,0},	// optidx=69
+		{"wf-tcp",required_argument,0,0},	// optidx=70
-		{"wf-udp",required_argument,0,0},	// optidx=70
+		{"wf-udp",required_argument,0,0},	// optidx=71
-		{"wf-raw",required_argument,0,0},	// optidx=71
+		{"wf-raw",required_argument,0,0},	// optidx=72
-		{"wf-save",required_argument,0,0},	// optidx=72
+		{"wf-save",required_argument,0,0},	// optidx=73
-		{"ssid-filter",required_argument,0,0},	// optidx=73
+		{"ssid-filter",required_argument,0,0},	// optidx=74
-		{"nlm-filter",required_argument,0,0},	// optidx=74
+		{"nlm-filter",required_argument,0,0},	// optidx=75
-		{"nlm-list",optional_argument,0,0},	// optidx=75
+		{"nlm-list",optional_argument,0,0},	// optidx=76
 #endif
 		{NULL,0,NULL,0}
 	};
@@ -1440,7 +1450,9 @@ int main(int argc, char **argv)
 		case 1: /* dry-run */
 			bDry=true;
 			break;
-		case 2: /* qnum or port */
+		case 2: /* comment */
+			break;
+		case 3: /* qnum or port */
 #ifdef __linux__
 			params.qnum = atoi(optarg);
 			if (params.qnum < 0 || params.qnum>65535)
@@ -1460,15 +1472,15 @@ int main(int argc, char **argv)
 			}
 #endif
 			break;
-		case 3: /* daemon */
+		case 4: /* daemon */
 			daemon = true;
 			break;
-		case 4: /* pidfile */
+		case 5: /* pidfile */
 			strncpy(pidfile, optarg, sizeof(pidfile));
 			pidfile[sizeof(pidfile) - 1] = '\0';
 			break;
 #ifndef __CYGWIN__
-		case 5: /* user */
+		case 6: /* user */
 		{
 			struct passwd *pwd = getpwnam(optarg);
 			if (!pwd)
@@ -1481,7 +1493,7 @@ int main(int argc, char **argv)
 			params.droproot = true;
 			break;
 		}
-		case 6: /* uid */
+		case 7: /* uid */
 			params.gid = 0x7FFFFFFF; // default gid. drop gid=0
 			params.droproot = true;
 			if (sscanf(optarg, "%u:%u", &params.uid, &params.gid)<1)
@@ -1491,32 +1503,32 @@ int main(int argc, char **argv)
 			}
 			break;
 #endif
-		case 7: /* wsize */
+		case 8: /* wsize */
 			if (!parse_ws_scale_factor(optarg,&dp->wsize,&dp->wscale))
 				exit_clean(1);
 			break;
-		case 8: /* wssize */
+		case 9: /* wssize */
 			if (!parse_ws_scale_factor(optarg,&dp->wssize,&dp->wsscale))
 				exit_clean(1);
 			break;
-		case 9: /* wssize-cutoff */
+		case 10: /* wssize-cutoff */
 			if (!parse_cutoff(optarg, &dp->wssize_cutoff, &dp->wssize_cutoff_mode))
 			{
 				DLOG_ERR("invalid wssize-cutoff value\n");
 				exit_clean(1);
 			}
 			break;
-		case 10: /* ctrack-timeouts */
+		case 11: /* ctrack-timeouts */
 			if (sscanf(optarg, "%u:%u:%u:%u", &params.ctrack_t_syn, &params.ctrack_t_est, &params.ctrack_t_fin, &params.ctrack_t_udp)<3)
 			{
 				DLOG_ERR("invalid ctrack-timeouts value\n");
 				exit_clean(1);
 			}
 			break;
-		case 11: /* hostcase */
+		case 12: /* hostcase */
 			dp->hostcase = true;
 			break;
-		case 12: /* hostspell */
+		case 13: /* hostspell */
 			if (strlen(optarg) != 4)
 			{
 				DLOG_ERR("hostspell must be exactly 4 chars long\n");
@@ -1525,7 +1537,7 @@ int main(int argc, char **argv)
 			dp->hostcase = true;
 			memcpy(dp->hostspell, optarg, 4);
 			break;
-		case 13: /* hostnospace */
+		case 14: /* hostnospace */
 			if (dp->methodeol)
 			{
 				DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
@@ -1533,10 +1545,10 @@ int main(int argc, char **argv)
 			}
 			dp->hostnospace = true;
 			break;
-		case 14: /* domcase */
+		case 15: /* domcase */
 			dp->domcase = true;
 			break;
-		case 15: /* methodeol */
+		case 16: /* methodeol */
 			if (dp->hostnospace)
 			{
 				DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
@@ -1544,7 +1556,7 @@ int main(int argc, char **argv)
 			}
 			dp->methodeol = true;
 			break;
-		case 16: /* dpi-desync */
+		case 17: /* dpi-desync */
 			{
 				char *mode=optarg,*mode2,*mode3;
 				mode2 = mode ? strchr(mode,',') : NULL;
@@ -1590,7 +1602,7 @@ int main(int argc, char **argv)
 			}
 			break;
 #ifndef __CYGWIN__
-		case 17: /* dpi-desync-fwmark/dpi-desync-sockarg */
+		case 18: /* dpi-desync-fwmark/dpi-desync-sockarg */
 #if defined(__linux__) || defined(SO_USER_COOKIE)
 			params.desync_fwmark = 0;
 			if (sscanf(optarg, "0x%X", &params.desync_fwmark)<=0) sscanf(optarg, "%u", &params.desync_fwmark);
@@ -1605,27 +1617,27 @@ int main(int argc, char **argv)
 #endif
 			break;
 #endif
-		case 18: /* dpi-desync-ttl */
+		case 19: /* dpi-desync-ttl */
 			dp->desync_ttl = (uint8_t)atoi(optarg);
 			break;
-		case 19: /* dpi-desync-ttl6 */
+		case 20: /* dpi-desync-ttl6 */
 			dp->desync_ttl6 = (uint8_t)atoi(optarg);
 			break;
-		case 20: /* dpi-desync-autottl */
+		case 21: /* dpi-desync-autottl */
 			if (!parse_autottl(optarg, &dp->desync_autottl))
 			{
 				DLOG_ERR("dpi-desync-autottl value error\n");
 				exit_clean(1);
 			}
 			break;
-		case 21: /* dpi-desync-autottl6 */
+		case 22: /* dpi-desync-autottl6 */
 			if (!parse_autottl(optarg, &dp->desync_autottl6))
 			{
 				DLOG_ERR("dpi-desync-autottl6 value error\n");
 				exit_clean(1);
 			}
 			break;
-		case 22: /* dpi-desync-fooling */
+		case 23: /* dpi-desync-fooling */
 			{
 				char *e,*p = optarg;
 				while (p)
@@ -1660,17 +1672,17 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 23: /* dpi-desync-repeats */
+		case 24: /* dpi-desync-repeats */
 			if (sscanf(optarg,"%u",&dp->desync_repeats)<1 || !dp->desync_repeats || dp->desync_repeats>20)
 			{
 				DLOG_ERR("dpi-desync-repeats must be within 1..20\n");
 				exit_clean(1);
 			}
 			break;
-		case 24: /* dpi-desync-skip-nosni */
+		case 25: /* dpi-desync-skip-nosni */
 			dp->desync_skip_nosni = !optarg || atoi(optarg);
 			break;
-		case 25: /* dpi-desync-split-pos */
+		case 26: /* dpi-desync-split-pos */
 			{
 				int ct;
 				if (!parse_split_pos_list(optarg,dp->splits+dp->split_count,MAX_SPLITS-dp->split_count,&ct))
@@ -1681,7 +1693,7 @@ int main(int argc, char **argv)
 				dp->split_count += ct;
 			}
 			break;
-		case 26: /* dpi-desync-split-http-req */
+		case 27: /* dpi-desync-split-http-req */
 			// obsolete arg
 			DLOG_CONDUP("WARNING ! --dpi-desync-split-http-req is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
 			if (dp->split_count>=MAX_SPLITS)
@@ -1696,7 +1708,7 @@ int main(int argc, char **argv)
 			}
 			dp->split_count++;
 			break;
-		case 27: /* dpi-desync-split-tls */
+		case 28: /* dpi-desync-split-tls */
 			// obsolete arg
 			DLOG_CONDUP("WARNING ! --dpi-desync-split-tls is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
 			if (dp->split_count>=MAX_SPLITS)
@@ -1711,7 +1723,7 @@ int main(int argc, char **argv)
 			}
 			dp->split_count++;
 			break;
-		case 28: /* dpi-desync-split-seqovl */
+		case 29: /* dpi-desync-split-seqovl */
 			if (!strcmp(optarg,"0"))
 			{
 				// allow zero = disable seqovl
@@ -1724,7 +1736,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 29: /* dpi-desync-split-seqovl-pattern */
+		case 30: /* dpi-desync-split-seqovl-pattern */
 			{
 				char buf[sizeof(dp->seqovl_pattern)];
 				size_t sz=sizeof(buf);
@@ -1732,7 +1744,7 @@ int main(int argc, char **argv)
 				fill_pattern(dp->seqovl_pattern,sizeof(dp->seqovl_pattern),buf,sz);
 			}
 			break;
-		case 30: /* dpi-desync-fakedsplit-pattern */
+		case 31: /* dpi-desync-fakedsplit-pattern */
 			{
 				char buf[sizeof(dp->fsplit_pattern)];
 				size_t sz=sizeof(buf);
@@ -1740,7 +1752,7 @@ int main(int argc, char **argv)
 				fill_pattern(dp->fsplit_pattern,sizeof(dp->fsplit_pattern),buf,sz);
 			}
 			break;
-		case 31: /* dpi-desync-ipfrag-pos-tcp */
+		case 32: /* dpi-desync-ipfrag-pos-tcp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_tcp)<1 || dp->desync_ipfrag_pos_tcp<1 || dp->desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1752,7 +1764,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 32: /* dpi-desync-ipfrag-pos-udp */
+		case 33: /* dpi-desync-ipfrag-pos-udp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_udp)<1 || dp->desync_ipfrag_pos_udp<1 || dp->desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1764,63 +1776,63 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 33: /* dpi-desync-badseq-increments */
+		case 34: /* dpi-desync-badseq-increments */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment))
 			{
 				DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 34: /* dpi-desync-badack-increment */
+		case 35: /* dpi-desync-badack-increment */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment))
 			{
 				DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 35: /* dpi-desync-any-protocol */
+		case 36: /* dpi-desync-any-protocol */
 			dp->desync_any_proto = !optarg || atoi(optarg);
 			break;
-		case 36: /* dpi-desync-fake-http */
+		case 37: /* dpi-desync-fake-http */
 			dp->fake_http_size = sizeof(dp->fake_http);
 			load_file_or_exit(optarg,dp->fake_http,&dp->fake_http_size);
 			break;
-		case 37: /* dpi-desync-fake-tls */
+		case 38: /* dpi-desync-fake-tls */
 			dp->fake_tls_size = sizeof(dp->fake_tls);
 			load_file_or_exit(optarg,dp->fake_tls,&dp->fake_tls_size);
 			break;
-		case 38: /* dpi-desync-fake-unknown */
+		case 39: /* dpi-desync-fake-unknown */
 			dp->fake_unknown_size = sizeof(dp->fake_unknown);
 			load_file_or_exit(optarg,dp->fake_unknown,&dp->fake_unknown_size);
 			break;
-		case 39: /* dpi-desync-fake-syndata */
+		case 40: /* dpi-desync-fake-syndata */
 			dp->fake_syndata_size = sizeof(dp->fake_syndata);
 			load_file_or_exit(optarg,dp->fake_syndata,&dp->fake_syndata_size);
 			break;
-		case 40: /* dpi-desync-fake-quic */
+		case 41: /* dpi-desync-fake-quic */
 			dp->fake_quic_size = sizeof(dp->fake_quic);
 			load_file_or_exit(optarg,dp->fake_quic,&dp->fake_quic_size);
 			break;
-		case 41: /* dpi-desync-fake-wireguard */
+		case 42: /* dpi-desync-fake-wireguard */
 			dp->fake_wg_size = sizeof(dp->fake_wg);
 			load_file_or_exit(optarg,dp->fake_wg,&dp->fake_wg_size);
 			break;
-		case 42: /* dpi-desync-fake-dht */
+		case 43: /* dpi-desync-fake-dht */
 			dp->fake_dht_size = sizeof(dp->fake_dht);
 			load_file_or_exit(optarg,dp->fake_dht,&dp->fake_dht_size);
 			break;
-		case 43: /* dpi-desync-fake-unknown-udp */
+		case 44: /* dpi-desync-fake-unknown-udp */
 			dp->fake_unknown_udp_size = sizeof(dp->fake_unknown_udp);
 			load_file_or_exit(optarg,dp->fake_unknown_udp,&dp->fake_unknown_udp_size);
 			break;
-		case 44: /* dpi-desync-udplen-increment */
+		case 45: /* dpi-desync-udplen-increment */
 			if (sscanf(optarg,"%d",&dp->udplen_increment)<1 || dp->udplen_increment>0x7FFF || dp->udplen_increment<-0x8000)
 			{
 				DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
 				exit_clean(1);
 			}
 			break;
-		case 45: /* dpi-desync-udplen-pattern */
+		case 46: /* dpi-desync-udplen-pattern */
 			{
 				char buf[sizeof(dp->udplen_pattern)];
 				size_t sz=sizeof(buf);
@@ -1828,21 +1840,21 @@ int main(int argc, char **argv)
 				fill_pattern(dp->udplen_pattern,sizeof(dp->udplen_pattern),buf,sz);
 			}
 			break;
-		case 46: /* desync-cutoff */
+		case 47: /* desync-cutoff */
 			if (!parse_cutoff(optarg, &dp->desync_cutoff, &dp->desync_cutoff_mode))
 			{
 				DLOG_ERR("invalid desync-cutoff value\n");
 				exit_clean(1);
 			}
 			break;
-		case 47: /* desync-start */
+		case 48: /* desync-start */
 			if (!parse_cutoff(optarg, &dp->desync_start, &dp->desync_start_mode))
 			{
 				DLOG_ERR("invalid desync-start value\n");
 				exit_clean(1);
 			}
 			break;
-		case 48: /* hostlist */
+		case 49: /* hostlist */
 			if (bSkip) break;
 			if (!RegisterHostlist(dp, false, optarg))
 			{
@@ -1850,7 +1862,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 49: /* hostlist-domains */
+		case 50: /* hostlist-domains */
 			if (bSkip) break;
 			if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
 			{
@@ -1863,7 +1875,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 50: /* hostlist-exclude */
+		case 51: /* hostlist-exclude */
 			if (bSkip) break;
 			if (!RegisterHostlist(dp, true, optarg))
 			{
@@ -1871,7 +1883,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 51: /* hostlist-exclude-domains */
+		case 52: /* hostlist-exclude-domains */
 			if (bSkip) break;
 			if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
 			{
@@ -1884,7 +1896,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 52: /* hostlist-auto */
+		case 53: /* hostlist-auto */
 			if (bSkip) break;
 			if (dp->hostlist_auto)
 			{
@@ -1912,7 +1924,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 53: /* hostlist-auto-fail-threshold */
+		case 54: /* hostlist-auto-fail-threshold */
 			dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
 			{
@@ -1920,7 +1932,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 54: /* hostlist-auto-fail-time */
+		case 55: /* hostlist-auto-fail-time */
 			dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_time<1)
 			{
@@ -1928,7 +1940,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 55: /* hostlist-auto-retrans-threshold */
+		case 56: /* hostlist-auto-retrans-threshold */
 			dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10)
 			{
@@ -1936,7 +1948,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 56: /* hostlist-auto-debug */
+		case 57: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -1950,7 +1962,7 @@ int main(int argc, char **argv)
 			}
 			break;
 
-		case 57: /* new */
+		case 58: /* new */
 			if (bSkip)
 			{
 				dp_clear(dp);
@@ -1960,6 +1972,7 @@ int main(int argc, char **argv)
 			}
 			else
 			{
+				check_dp(dp);
 				if (!(dpl = dp_list_add(&params.desync_profiles)))
 				{
 					DLOG_ERR("desync_profile_add: out of memory\n");
@@ -1971,18 +1984,18 @@ int main(int argc, char **argv)
 			anon_hl = anon_hl_exclude = NULL;
 			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 58: /* skip */
+		case 59: /* skip */
 			bSkip = true;
 			break;
 
-		case 59: /* filter-l3 */
+		case 60: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 60: /* filter-tcp */
+		case 61: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -1992,7 +2005,7 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_udp))
 				exit_clean(1);
 			break;
-		case 61: /* filter-udp */
+		case 62: /* filter-udp */
 			if (!parse_pf_list(optarg,&dp->pf_udp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -2002,14 +2015,14 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_tcp))
 				exit_clean(1);
 			break;
-		case 62: /* filter-l7 */
+		case 63: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 63: /* ipset */
+		case 64: /* ipset */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
@@ -2017,7 +2030,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 64: /* ipset-ip */
+		case 65: /* ipset-ip */
 			if (bSkip) break;
 			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
 			{
@@ -2030,7 +2043,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 65: /* ipset-exclude */
+		case 66: /* ipset-exclude */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
@@ -2038,7 +2051,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 66: /* ipset-exclude-ip */
+		case 67: /* ipset-exclude-ip */
 			if (bSkip) break;
 			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
 			{
@@ -2054,28 +2067,28 @@ int main(int argc, char **argv)
 
 
 #ifdef __linux__
-		case 67: /* bind-fix4 */
+		case 68: /* bind-fix4 */
 			params.bind_fix4 = true;
 			break;
-		case 68: /* bind-fix6 */
+		case 69: /* bind-fix6 */
 			params.bind_fix6 = true;
 			break;
 #elif defined(__CYGWIN__)
-		case 67: /* wf-iface */
+		case 68: /* wf-iface */
 			if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
 			{
 				DLOG_ERR("bad value for --wf-iface\n");
 				exit_clean(1);
 			}
 			break;
-		case 68: /* wf-l3 */
+		case 69: /* wf-l3 */
 			if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
 			{
 				DLOG_ERR("bad value for --wf-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 69: /* wf-tcp */
+		case 70: /* wf-tcp */
 			hash_wf_tcp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
 				!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
@@ -2084,7 +2097,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 70: /* wf-udp */
+		case 71: /* wf-udp */
 			hash_wf_udp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
 				!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
@@ -2093,7 +2106,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 71: /* wf-raw */
+		case 72: /* wf-raw */
 			hash_wf_raw=hash_jen(optarg,strlen(optarg));
 			if (optarg[0]=='@')
 			{
@@ -2107,11 +2120,11 @@ int main(int argc, char **argv)
 				windivert_filter[sizeof(windivert_filter) - 1] = '\0';
 			}
 			break;
-		case 72: /* wf-save */
+		case 73: /* wf-save */
 			strncpy(wf_save_file, optarg, sizeof(wf_save_file));
 			wf_save_file[sizeof(wf_save_file) - 1] = '\0';
 			break;
-		case 73: /* ssid-filter */
+		case 74: /* ssid-filter */
 			hash_ssid_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -2129,7 +2142,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 74: /* nlm-filter */
+		case 75: /* nlm-filter */
 			hash_nlm_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -2147,7 +2160,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 75: /* nlm-list */
+		case 76: /* nlm-list */
 			if (!nlm_list(optarg && !strcmp(optarg,"all")))
 			{
 				DLOG_ERR("could not get list of NLM networks\n");
@@ -2164,6 +2177,8 @@ int main(int argc, char **argv)
 		dp_entry_destroy(dpl);
 		desync_profile_count--;
 	}
+	else
+		check_dp(dp);
 
 	// do not need args from file anymore
 #if !defined( __OpenBSD__) && !defined(__ANDROID__)
@@ -2250,9 +2265,9 @@ int main(int argc, char **argv)
 		if (dp->desync_ttl6 == 0xFF) dp->desync_ttl6=dp->desync_ttl;
 		if (!AUTOTTL_ENABLED(dp->desync_autottl6)) dp->desync_autottl6 = dp->desync_autottl;
 		if (AUTOTTL_ENABLED(dp->desync_autottl))
-			DLOG("[profile %d] autottl ipv4 %u:%u-%u\n",dp->n,dp->desync_autottl.delta,dp->desync_autottl.min,dp->desync_autottl.max);
+			DLOG("profile %d autottl ipv4 %u:%u-%u\n",dp->n,dp->desync_autottl.delta,dp->desync_autottl.min,dp->desync_autottl.max);
 		if (AUTOTTL_ENABLED(dp->desync_autottl6))
-			DLOG("[profile %d] autottl ipv6 %u:%u-%u\n",dp->n,dp->desync_autottl6.delta,dp->desync_autottl6.min,dp->desync_autottl6.max);
+			DLOG("profile %d autottl ipv6 %u:%u-%u\n",dp->n,dp->desync_autottl6.delta,dp->desync_autottl6.min,dp->desync_autottl6.max);
 		split_compat(dp);
 #ifndef __CYGWIN__
 		if (params.droproot && dp->hostlist_auto && chown(dp->hostlist_auto->filename, params.uid, -1))

nfq/params.h

@@ -20,8 +20,6 @@
 
 #define TLS_PARTIALS_ENABLE	true
 
-#define Q_RCVBUF	(128*1024)	// in bytes
-#define Q_SNDBUF	(64*1024)	// in bytes
 #define RAW_SNDBUF	(64*1024)	// in bytes
 
 #define Q_MAXLEN	1024		// in packets

nfq/sec.c

@@ -88,10 +88,6 @@ SYS_symlinkat,
 SYS_link,
 #endif
 SYS_linkat,
-#ifdef SYS_pkey_mprotect
-SYS_pkey_mprotect,
-#endif
-SYS_mprotect,
 SYS_truncate,
 #ifdef SYS_truncate64
 SYS_truncate64,

tpws/BSDmakefile

@@ -6,7 +6,7 @@ SRC_FILES = *.c
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 
 clean:
 	rm -f tpws *.o

tpws/Makefile

@@ -9,17 +9,17 @@ SRC_FILES_ANDROID = $(SRC_FILES) andr/*.c
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 android: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LDFLAGS) $(LIBS_ANDROID)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LIBS_ANDROID) $(LDFLAGS)
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsa -target arm64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsa -target arm64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsx -target x86_64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsx -target x86_64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 	strip tpwsa tpwsx
 	lipo -create -output tpws tpwsx tpwsa
 	rm -f tpwsx tpwsa

tpws/helpers.c

@@ -12,10 +12,6 @@
 #include <libgen.h>
 #include <unistd.h>
 
-#ifdef __linux__
-#include <linux/tcp.h>
-#endif
-
 #ifdef __ANDROID__
 #include "andr/ifaddrs.h"
 #else
@@ -23,6 +19,10 @@
 #endif
 
 #include "helpers.h"
+#ifdef __linux__
+#include <linux/tcp.h>
+#endif
+#include "linux_compat.h"
 
 int unique_size_t(size_t *pu, int ct)
 {
@@ -481,7 +481,7 @@ void msleep(unsigned int ms)
 bool socket_supports_notsent()
 {
 	int sfd;
-	struct tcp_info tcpi;
+	struct tcp_info_new tcpi;
 
 	sfd = socket(AF_INET,SOCK_STREAM,0);
 	if (sfd<0) return false;
@@ -494,11 +494,11 @@ bool socket_supports_notsent()
 	}
 	close(sfd);
 
-	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi.tcpi_state + sizeof(tcpi.tcpi_notsent_bytes));
+	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi + sizeof(tcpi.tcpi_notsent_bytes));
 }
 bool socket_has_notsent(int sfd)
 {
-	struct tcp_info tcpi;
+	struct tcp_info_new tcpi;
 	socklen_t ts = sizeof(tcpi);
 
 	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)

tpws/linux_compat.h

@@ -0,0 +1,111 @@
+#ifdef __linux__
+
+#include <linux/types.h>
+
+#ifndef TCP_USER_TIMEOUT
+#define TCP_USER_TIMEOUT 18
+#endif
+
+#ifndef IP6T_SO_ORIGINAL_DST
+ #define IP6T_SO_ORIGINAL_DST 80
+#endif
+
+#ifndef PR_SET_NO_NEW_PRIVS
+ #define PR_SET_NO_NEW_PRIVS	38
+#endif
+
+// workaround for old headers
+
+struct tcp_info_new {
+	__u8    tcpi_state;
+	__u8    tcpi_ca_state;
+	__u8    tcpi_retransmits;
+	__u8    tcpi_probes;
+	__u8    tcpi_backoff;
+	__u8    tcpi_options;
+	__u8    tcpi_snd_wscale : 4, tcpi_rcv_wscale : 4;
+	__u8    tcpi_delivery_rate_app_limited : 1, tcpi_fastopen_client_fail : 2;
+
+	__u32   tcpi_rto;
+	__u32   tcpi_ato;
+	__u32   tcpi_snd_mss;
+	__u32   tcpi_rcv_mss;
+
+	__u32   tcpi_unacked;
+	__u32   tcpi_sacked;
+	__u32   tcpi_lost;
+	__u32   tcpi_retrans;
+	__u32   tcpi_fackets;
+
+	/* Times. */
+	__u32   tcpi_last_data_sent;
+	__u32   tcpi_last_ack_sent;     /* Not remembered, sorry. */
+	__u32   tcpi_last_data_recv;
+	__u32   tcpi_last_ack_recv;
+
+	/* Metrics. */
+	__u32   tcpi_pmtu;
+	__u32   tcpi_rcv_ssthresh;
+	__u32   tcpi_rtt;
+	__u32   tcpi_rttvar;
+	__u32   tcpi_snd_ssthresh;
+	__u32   tcpi_snd_cwnd;
+	__u32   tcpi_advmss;
+	__u32   tcpi_reordering;
+
+	__u32   tcpi_rcv_rtt;
+	__u32   tcpi_rcv_space;
+
+	__u32   tcpi_total_retrans;
+
+	__u64   tcpi_pacing_rate;
+	__u64   tcpi_max_pacing_rate;
+	__u64   tcpi_bytes_acked;    /* RFC4898 tcpEStatsAppHCThruOctetsAcked */
+	__u64   tcpi_bytes_received; /* RFC4898 tcpEStatsAppHCThruOctetsReceived */
+	__u32   tcpi_segs_out;       /* RFC4898 tcpEStatsPerfSegsOut */
+	__u32   tcpi_segs_in;        /* RFC4898 tcpEStatsPerfSegsIn */
+
+	__u32   tcpi_notsent_bytes;
+	__u32   tcpi_min_rtt;
+	__u32   tcpi_data_segs_in;      /* RFC4898 tcpEStatsDataSegsIn */
+	__u32   tcpi_data_segs_out;     /* RFC4898 tcpEStatsDataSegsOut */
+
+	__u64   tcpi_delivery_rate;
+
+	__u64   tcpi_busy_time;      /* Time (usec) busy sending data */
+	__u64   tcpi_rwnd_limited;   /* Time (usec) limited by receive window */
+	__u64   tcpi_sndbuf_limited; /* Time (usec) limited by send buffer */
+
+	__u32   tcpi_delivered;
+	__u32   tcpi_delivered_ce;
+
+	__u64   tcpi_bytes_sent;     /* RFC4898 tcpEStatsPerfHCDataOctetsOut */
+	__u64   tcpi_bytes_retrans;  /* RFC4898 tcpEStatsPerfOctetsRetrans */
+	__u32   tcpi_dsack_dups;     /* RFC4898 tcpEStatsStackDSACKDups */
+	__u32   tcpi_reord_seen;     /* reordering events seen */
+
+	__u32   tcpi_rcv_ooopack;    /* Out-of-order packets received */
+
+	__u32   tcpi_snd_wnd;        /* peer's advertised receive window after
+								  * scaling (bytes)
+								  */
+	__u32   tcpi_rcv_wnd;        /* local advertised receive window after
+								  * scaling (bytes)
+								  */
+
+	__u32   tcpi_rehash;         /* PLB or timeout triggered rehash attempts */
+
+	__u16   tcpi_total_rto; /* Total number of RTO timeouts, including
+							 * SYN/SYN-ACK and recurring timeouts.
+							 */
+	__u16   tcpi_total_rto_recoveries;      /* Total number of RTO
+											 * recoveries, including any
+											 * unfinished recovery.
+											 */
+	__u32   tcpi_total_rto_time;    /* Total time spent in RTO recoveries
+									 * in milliseconds, including any
+									 * unfinished recovery.
+									 */
+};
+
+#endif

tpws/params.h

@@ -18,7 +18,7 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 
-#define FIX_SEG_DEFAULT_MAX_WAIT		30
+#define FIX_SEG_DEFAULT_MAX_WAIT		50
 
 enum bindll { unwanted=0, no, prefer, force };
 

tpws/redirect.c

@@ -9,12 +9,10 @@
 
 #include "params.h"
 #include "helpers.h"
+#include "linux_compat.h"
 
 #ifdef __linux__
  #include <linux/netfilter_ipv4.h>
- #ifndef IP6T_SO_ORIGINAL_DST
-  #define IP6T_SO_ORIGINAL_DST 80
- #endif
 #endif
 
 

tpws/tpws.c

@@ -176,6 +176,7 @@ static void exithelp(void)
 		" --debug=0|1|2|syslog|@<filename>\t; 1 and 2 means log to console and set debug level. for other targets use --debug-level.\n"
 		" --debug-level=0|1|2\t\t\t; specify debug level\n"
 		" --dry-run\t\t\t\t; verify parameters and exit with code 0 if successful\n"
+		" --comment=any_text\n"
 		"\nMULTI-STRATEGY:\n"
 		" --new\t\t\t\t\t; begin new strategy\n"
 		" --skip\t\t\t\t\t; do not use this strategy\n"
@@ -669,21 +670,22 @@ void parse_params(int argc, char *argv[])
 		{ "debug",optional_argument,0,0 },// optidx=45
 		{ "debug-level",required_argument,0,0 },// optidx=46
 		{ "dry-run",no_argument,0,0 },// optidx=47
-		{ "local-rcvbuf",required_argument,0,0 },// optidx=48
+		{ "comment",optional_argument,0,0 },// optidx=48
-		{ "local-sndbuf",required_argument,0,0 },// optidx=49
+		{ "local-rcvbuf",required_argument,0,0 },// optidx=49
-		{ "remote-rcvbuf",required_argument,0,0 },// optidx=50
+		{ "local-sndbuf",required_argument,0,0 },// optidx=50
-		{ "remote-sndbuf",required_argument,0,0 },// optidx=51
+		{ "remote-rcvbuf",required_argument,0,0 },// optidx=51
-		{ "socks",no_argument,0,0 },// optidx=52
+		{ "remote-sndbuf",required_argument,0,0 },// optidx=52
-		{ "no-resolve",no_argument,0,0 },// optidx=53
+		{ "socks",no_argument,0,0 },// optidx=53
-		{ "resolver-threads",required_argument,0,0 },// optidx=54
+		{ "no-resolve",no_argument,0,0 },// optidx=54
-		{ "skip-nodelay",no_argument,0,0 },// optidx=55
+		{ "resolver-threads",required_argument,0,0 },// optidx=55
-		{ "tamper-start",required_argument,0,0 },// optidx=56
+		{ "skip-nodelay",no_argument,0,0 },// optidx=56
-		{ "tamper-cutoff",required_argument,0,0 },// optidx=57
+		{ "tamper-start",required_argument,0,0 },// optidx=57
-		{ "connect-bind-addr",required_argument,0,0 },// optidx=58
+		{ "tamper-cutoff",required_argument,0,0 },// optidx=58
+		{ "connect-bind-addr",required_argument,0,0 },// optidx=59
 
-		{ "new",no_argument,0,0 },				// optidx=59
+		{ "new",no_argument,0,0 },				// optidx=60
-		{ "skip",no_argument,0,0 },				// optidx=60
+		{ "skip",no_argument,0,0 },				// optidx=61
-		{ "filter-l3",required_argument,0,0 },			// optidx=61
+		{ "filter-l3",required_argument,0,0 },			// optidx=62
 		{ "filter-tcp",required_argument,0,0 },			// optidx=63
 		{ "filter-l7",required_argument,0,0 },			// optidx=64
 		{ "ipset",required_argument,0,0 },			// optidx=65
@@ -692,17 +694,17 @@ void parse_params(int argc, char *argv[])
 		{ "ipset-exclude-ip",required_argument,0,0 },		// optidx=68
 
 #if defined(__FreeBSD__)
-		{ "enable-pf",no_argument,0,0 },// optidx=68
+		{ "enable-pf",no_argument,0,0 },// optidx=69
 #elif defined(__APPLE__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=68
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=69
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=69
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=70
 #elif defined(__linux__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=68
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=69
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=69
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=70
-		{ "mss",required_argument,0,0 },			// optidx=70
+		{ "mss",required_argument,0,0 },			// optidx=71
-		{ "fix-seg",optional_argument,0,0 },			// optidx=71
+		{ "fix-seg",optional_argument,0,0 },			// optidx=72
 #ifdef SPLICE_PRESENT
-		{ "nosplice",no_argument,0,0 },				// optidx=72
+		{ "nosplice",no_argument,0,0 },				// optidx=73
 #endif
 #endif
 		{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@@ -1153,41 +1155,43 @@ void parse_params(int argc, char *argv[])
 		case 47: /* dry-run */
 			bDry = true;
 			break;
-		case 48: /* local-rcvbuf */
+		case 48: /* comment */
+			break;
+		case 49: /* local-rcvbuf */
 #ifdef __linux__
 			params.local_rcvbuf = atoi(optarg)/2;
 #else
 			params.local_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 49: /* local-sndbuf */
+		case 50: /* local-sndbuf */
 #ifdef __linux__
 			params.local_sndbuf = atoi(optarg)/2;
 #else
 			params.local_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 50: /* remote-rcvbuf */
+		case 51: /* remote-rcvbuf */
 #ifdef __linux__
 			params.remote_rcvbuf = atoi(optarg)/2;
 #else
 			params.remote_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 51: /* remote-sndbuf */
+		case 52: /* remote-sndbuf */
 #ifdef __linux__
 			params.remote_sndbuf = atoi(optarg)/2;
 #else
 			params.remote_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 52: /* socks */
+		case 53: /* socks */
 			params.proxy_type = CONN_TYPE_SOCKS;
 			break;
-		case 53: /* no-resolve */
+		case 54: /* no-resolve */
 			params.no_resolve = true;
 			break;
-		case 54: /* resolver-threads */
+		case 55: /* resolver-threads */
 			params.resolver_threads = atoi(optarg);
 			if (params.resolver_threads<1 || params.resolver_threads>300)
 			{
@@ -1195,10 +1199,10 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 55: /* skip-nodelay */
+		case 56: /* skip-nodelay */
 			params.skip_nodelay = true;
 			break;
-		case 56: /* tamper-start */
+		case 57: /* tamper-start */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -1212,7 +1216,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 57: /* tamper-cutoff */
+		case 58: /* tamper-cutoff */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -1226,7 +1230,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 58: /* connect-bind-addr */
+		case 59: /* connect-bind-addr */
 			{
 				char *p = strchr(optarg,'%');
 				if (p) *p++=0;
@@ -1254,7 +1258,7 @@ void parse_params(int argc, char *argv[])
 			break;
 
 
-		case 59: /* new */
+		case 60: /* new */
 			if (bSkip)
 			{
 				dp_clear(dp);
@@ -1275,31 +1279,31 @@ void parse_params(int argc, char *argv[])
 			anon_hl = anon_hl_exclude = NULL;
 			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 60: /* skip */
+		case 61: /* skip */
 			bSkip = true;
 			break;
-		case 61: /* filter-l3 */
+		case 62: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 62: /* filter-tcp */
+		case 63: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 63: /* filter-l7 */
+		case 64: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 64: /* ipset */
+		case 65: /* ipset */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
@@ -1308,7 +1312,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 65: /* ipset-ip */
+		case 66: /* ipset-ip */
 			if (bSkip) break;
 			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
 			{
@@ -1322,7 +1326,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 66: /* ipset-exclude */
+		case 67: /* ipset-exclude */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
@@ -1331,7 +1335,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 67: /* ipset-exclude-ip */
+		case 68: /* ipset-exclude-ip */
 			if (bSkip) break;
 			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
 			{
@@ -1347,11 +1351,11 @@ void parse_params(int argc, char *argv[])
 			break;
 
 #if defined(__FreeBSD__)
-		case 68: /* enable-pf */
+		case 69: /* enable-pf */
 			params.pf_enable = true;
 			break;
 #elif defined(__linux__) || defined(__APPLE__)
-		case 68: /* local-tcp-user-timeout */
+		case 69: /* local-tcp-user-timeout */
 			params.tcp_user_timeout_local = atoi(optarg);
 			if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
 			{
@@ -1359,7 +1363,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 69: /* remote-tcp-user-timeout */
+		case 70: /* remote-tcp-user-timeout */
 			params.tcp_user_timeout_remote = atoi(optarg);
 			if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
 			{
@@ -1370,7 +1374,7 @@ void parse_params(int argc, char *argv[])
 #endif
 
 #if defined(__linux__)
-		case 70: /* mss */
+		case 71: /* mss */
 			// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
 			dp->mss = atoi(optarg);
 			if (dp->mss<88 || dp->mss>32767)
@@ -1379,7 +1383,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 71: /* fix-seg */
+		case 72: /* fix-seg */
 			if (!params.fix_seg_avail)
 			{
 				DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
@@ -1399,7 +1403,7 @@ void parse_params(int argc, char *argv[])
 				params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
 			break;
 #ifdef SPLICE_PRESENT
-		case 72: /* nosplice */
+		case 73: /* nosplice */
 			params.nosplice = true;
 			break;
 #endif

tpws/tpws_conn.c

@@ -23,6 +23,7 @@
 #include "socks.h"
 #include "helpers.h"
 #include "hostlist.h"
+#include "linux_compat.h"
 
 // keep separate legs counter. counting every time thousands of legs can consume cpu
 static int legs_local, legs_remote;