update docs

Use `-march=native` when building from install_easy.sh

.github/issue_template.md

@@ -1,8 +1,8 @@
-1. Здесь не место для вопросов, касающихся компьютерной грамотности и навыков использования ОС
+1. Здесь не место для вопросов, касающихся компьютерной грамотности и навыков использования ОС
 2. Здесь не место для вопросов "у меня не работает" без технических подробностей
-3. Здесь не место для вопросов "как мне открыть ютуб" или "что писать в ..."
+3. Здесь не место для вопросов "как мне открыть ютуб", "что писать в ...", "перестало открываться".
 4. Здесь не место для обсуждения сборок
-5. Вирусов здесь нет. У вас либо чья-то сборка, либо ваш антивирус давно пора отправить на покой. Не согласны - удаляйте софт.
+5. Вирусов здесь нет. У вас либо чья-то сборка, либо ваш антивирус давно пора отправить на покой. Антивирусы в основном жалуются на upx и windivert, которые убраны НЕ будут. Не согласны - удаляйте софт. За агрессивные наезды "почему автор распространяет вирусы" молча схватите бан.
 
 Все означенное обсуждать в дискуссиях или на форумах.
 При нарушении будет закрываться или конвертироваться в дискуссии.

.github/workflows/build.yml

@@ -52,6 +52,13 @@ jobs:
             tool: i586-unknown-linux-musl
           - arch: x86_64
             tool: x86_64-unknown-linux-musl
+          - arch: lexra
+            tool: mips-linux
+            dir: rsdk-4.6.4-5281-EB-3.10-0.9.33-m32ub-20141001
+            env:
+              CFLAGS: '-march=5281'
+              LDFLAGS: '-lgcc_eh'
+            repo: 'bol-van/build'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -60,18 +67,31 @@ jobs:
 
       - name: Set up build tools
         env:
-          REPO: 'spvkgn/musl-cross'
+          ARCH: ${{ matrix.arch }}
           TOOL: ${{ matrix.tool }}
+          REPO: ${{ matrix.arch == 'lexra' && matrix.repo || 'spvkgn/musl-cross' }}
+          DIR: ${{ matrix.arch == 'lexra' && matrix.dir || matrix.tool }}
         run: |
-          sudo apt update -qq && sudo apt install -y libcap-dev
+          if [[ "$ARCH" == lexra ]]; then
+            sudo dpkg --add-architecture i386
+            sudo apt update -qq
+            sudo apt install -y libcap-dev libc6:i386 zlib1g:i386
+            URL=https://github.com/$REPO/raw/refs/heads/master/$DIR.txz
+          else
+            sudo apt update -qq
+            sudo apt install -y libcap-dev
+            URL=https://github.com/$REPO/releases/download/latest/$TOOL.tar.xz
+          fi
           mkdir -p $HOME/tools
-          wget -qO- https://github.com/$REPO/releases/download/latest/$TOOL.tar.xz | tar -C $HOME/tools -xJ || exit 1
+          wget -qO- $URL | tar -C $HOME/tools -xJ || exit 1
-          [ -d "$HOME/tools/$TOOL/bin" ] && echo "$HOME/tools/$TOOL/bin" >> $GITHUB_PATH
+          [[ -d "$HOME/tools/$DIR/bin" ]] && echo "$HOME/tools/$DIR/bin" >> $GITHUB_PATH
 
       - name: Build
         env:
           ARCH: ${{ matrix.arch }}
           TARGET: ${{ matrix.tool }}
+          CFLAGS: ${{ matrix.env.CFLAGS != '' && matrix.env.CFLAGS || null }}
+          LDFLAGS: ${{ matrix.env.LDFLAGS != '' && matrix.env.LDFLAGS || null }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           DEPS_DIR=$GITHUB_WORKSPACE/deps
@@ -81,6 +101,7 @@ jobs:
           export NM=$TARGET-nm
           export STRIP=$TARGET-strip
           export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
+          export STAGING_DIR=$RUNNER_TEMP
 
           # netfilter libs
           wget -qO- https://www.netfilter.org/pub/libnfnetlink/libnfnetlink-1.0.2.tar.bz2 | tar -xj
@@ -90,7 +111,7 @@ jobs:
           for i in libmnl libnfnetlink libnetfilter_queue ; do
             (
               cd $i-*
-              CFLAGS="-Os -flto=auto" \
+              CFLAGS="-Os -flto=auto $CFLAGS" \
               ./configure --prefix= --host=$TARGET --enable-static --disable-shared --disable-dependency-tracking
               make install -j$(nproc) DESTDIR=$DEPS_DIR
             )
@@ -102,7 +123,7 @@ jobs:
             xargs -I{} wget -qO- https://github.com/madler/zlib/archive/refs/tags/{}.tar.gz | tar -xz
           (
             cd zlib-*
-            CFLAGS="-Os -flto=auto" \
+            CFLAGS="-Os -flto=auto $CFLAGS" \
             ./configure --prefix= --static
             make install -j$(nproc) DESTDIR=$DEPS_DIR
           )
@@ -113,8 +134,8 @@ jobs:
           install -Dm644 -t $DEPS_DIR/include/sys /usr/include/x86_64-linux-gnu/sys/queue.h /usr/include/sys/capability.h
 
           # zapret
-          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include" \
+          CFLAGS="-DZAPRET_GH_VER=${{ github.ref_name }} -DZAPRET_GH_HASH=${{ github.sha }} -static-libgcc -static -I$DEPS_DIR/include $CFLAGS" \
-          LDFLAGS="-L$DEPS_DIR/lib" \
+          LDFLAGS="-L$DEPS_DIR/lib $LDFLAGS" \
           make -C zapret -j$(nproc)
           tar -C zapret/binaries/my -cJf zapret-linux-$ARCH.tar.xz .
 
@@ -390,7 +411,7 @@ jobs:
                   if [[ $dir == *-linux-x86_64 ]]; then
                     tar -C $dir -czvf $dir/tpws_wsl.tgz tpws
                     run_upx $dir/*
-                  elif [[ $dir =~ linux ]] && [[ $dir != *-linux-mips64 ]]; then
+                  elif [[ $dir =~ linux ]] && [[ $dir != *-linux-mips64 ]] && [[ $dir != *-linux-lexra ]]; then
                     run_upx $dir/*
                   fi
                   ;;
@@ -422,6 +443,7 @@ jobs:
                 *-linux-ppc )           run_dir ppc ;;
                 *-linux-x86 )           run_dir x86 ;;
                 *-linux-x86_64 )        run_dir x86_64 ;;
+                *-linux-lexra )         run_dir lexra ;;
                 *-mac-x64 )             run_dir mac64 ;;
                 *-win-x86 )             run_dir win32 ;;
                 *-win-x86_64 )          run_dir win64 ;;

blockcheck.sh

@@ -212,7 +212,7 @@ doh_resolve()
 	# $1 - ip version 4/6
 	# $2 - hostname
 	# $3 - doh server URL. use $DOH_SERVER if empty
-	$MDIG --family=$1 --dns-make-query=$2 | curl -s --data-binary @- -H "Content-Type: application/dns-message" "${3:-$DOH_SERVER}" | $MDIG --dns-parse-query
+	$MDIG --family=$1 --dns-make-query=$2 | $CURL -s --data-binary @- -H "Content-Type: application/dns-message" "${3:-$DOH_SERVER}" | $MDIG --dns-parse-query
 }
 doh_find_working()
 {

common/base.sh

@@ -241,7 +241,7 @@ fix_sbin_path()
 # it can calculate floating point expr
 calc()
 {
-	awk "BEGIN { print $*}";
+	LC_ALL=C awk "BEGIN { print $*}";
 }
 
 fsleep_setup()
@@ -318,18 +318,27 @@ setup_md5()
 	exists $MD5 || MD5=md5
 }
 
+setup_random()
+{
+	[ -n "$RCUT" ] && return
+	RCUT="cut -c 1-17"
+	# some shells can operate with 32 bit signed int
+	[ $((0x100000000)) = 0 ] && RCUT="cut -c 1-9"
+}
+
 random()
 {
 	# $1 - min, $2 - max
 	local r rs
 	setup_md5
+	setup_random
 	if [ -c /dev/urandom ]; then
 		read rs </dev/urandom
 	else
 		rs="$RANDOM$RANDOM$(date)"
 	fi
 	# shells use signed int64
-	r=1$(echo $rs | $MD5 | sed 's/[^0-9]//g' | cut -c 1-17)
+	r=1$(echo $rs | $MD5 | sed 's/[^0-9]//g' | $RCUT)
 	echo $(( ($r % ($2-$1+1)) + $1 ))
 }
 

common/installer.sh

@@ -1,4 +1,4 @@
-readonly GET_LIST_PREFIX=/ipset/get_
+GET_LIST_PREFIX=/ipset/get_
 
 SYSTEMD_DIR=/lib/systemd
 [ -d "$SYSTEMD_DIR" ] || SYSTEMD_DIR=/usr/lib/systemd

common/ipt.sh

@@ -1,5 +1,9 @@
 std_ports
-readonly ipt_connbytes="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes"
+ipt_connbytes="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes"
+IPSET_EXCLUDE="-m set ! --match-set nozapret"
+IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
+IPBAN_EXCLUDE="-m set ! --match-set ipban"
+IPBAN_EXCLUDE6="-m set ! --match-set ipban6"
 
 ipt()
 {
@@ -132,7 +136,7 @@ _fw_tpws4()
 
 		ipt_print_op $1 "$2" "tpws (port $3)"
 
-		rule="$2 $IPSET_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3"
+		rule="$2 $IPSET_EXCLUDE dst $IPBAN_EXCLUDE dst -j DNAT --to $TPWS_LOCALHOST4:$3"
 		for i in $4 ; do
 			ipt_add_del $1 PREROUTING -t nat -i $i $rule
 	 	done
@@ -160,7 +164,7 @@ _fw_tpws6()
 
 		ipt_print_op $1 "$2" "tpws (port $3)" 6
 
-		rule="$2 $IPSET_EXCLUDE6 dst"
+		rule="$2 $IPSET_EXCLUDE6 dst $IPBAN_EXCLUDE6 dst"
 		for i in $4 ; do
 			_dnat6_target $i DNAT6
 			[ -n "$DNAT6" -a "$DNAT6" != "-" ] && ipt6_add_del $1 PREROUTING -t nat -i $i $rule -j DNAT --to [$DNAT6]:$3

common/linux_iphelper.sh

@@ -4,6 +4,8 @@
 # PREROUTING - can't DNAT to ::1. can DNAT to link local of -i interface or to any global addr
 # not a good idea to expose tpws to the world (bind to ::)
 
+# max wait time for the link local ipv6 on the LAN interface
+LINKLOCAL_WAIT_SEC=${LINKLOCAL_WAIT_SEC:-5}
 
 get_ipv6_linklocal()
 {

common/list.sh

@@ -1,5 +1,5 @@
-readonly HOSTLIST_MARKER="<HOSTLIST>"
+HOSTLIST_MARKER="<HOSTLIST>"
-readonly HOSTLIST_NOAUTO_MARKER="<HOSTLIST_NOAUTO>"
+HOSTLIST_NOAUTO_MARKER="<HOSTLIST_NOAUTO>"
 
 find_hostlists()
 {

common/nft.sh

@@ -1,5 +1,5 @@
 [ -n "$ZAPRET_NFT_TABLE" ] || ZAPRET_NFT_TABLE=zapret
-readonly nft_connbytes="ct original packets"
+nft_connbytes="ct original packets"
 
 # required for : nft -f -
 create_dev_stdin
@@ -263,28 +263,6 @@ nft_add_flow_offload_exemption()
 	[ "$DISABLE_IPV6" = "1" -o -z "$2" ] || nft_add_rule flow_offload oifname @wanif6 $2 ip6 daddr != @nozapret6 return comment \"$3\"
 }
 
-nft_hw_offload_supported()
-{
-	# $1,$2,... - interface names
-	local devices res=1
-	make_quoted_comma_list devices "$@"
-	[ -n "$devices" ] && devices="devices={$devices};"
-	nft add table ${ZAPRET_NFT_TABLE}_test && nft add flowtable ${ZAPRET_NFT_TABLE}_test ft "{ flags offload; $devices }" 2>/dev/null && res=0
-	nft delete table ${ZAPRET_NFT_TABLE}_test 2>/dev/null
-	return $res
-}
-
-nft_hw_offload_find_supported()
-{
-	# $1,$2,... - interface names
-	local supported_list
-	while [ -n "$1" ]; do
-		nft_hw_offload_supported "$1" && append_separator_list supported_list ' ' '' "$1"
-		shift
-	done
-	echo $supported_list
-}
-
 nft_apply_flow_offloading()
 {
 	# ft can be absent
@@ -370,17 +348,15 @@ flush set inet $ZAPRET_NFT_TABLE lanif"
 			nft_create_or_update_flowtable 'offload' 2>/dev/null
 			# then add elements. some of them can cause error because unsupported
 			for i in $ALLDEVS; do
-				if nft_hw_offload_supported $i; then
+				# first try to add interface itself
-					nft_create_or_update_flowtable 'offload' $i
+				nft_create_or_update_flowtable 'offload' $i 2>/dev/null
-				else
+				# bridge members must be added instead of the bridge itself
-					# bridge members must be added instead of the bridge itself
+				# some members may not support hw offload. example : lan1 lan2 lan3 support, wlan0 wlan1 - not
-					# some members may not support hw offload. example : lan1 lan2 lan3 support, wlan0 wlan1 - not
+				devs=$(resolve_lower_devices $i)
-					devs=$(resolve_lower_devices $i)
+				for j in $devs; do
-					for j in $devs; do
+					# do not display error if addition failed
-						# do not display error if addition failed
+					nft_create_or_update_flowtable 'offload' $j 2>/dev/null
-						nft_create_or_update_flowtable 'offload' $j 2>/dev/null
+				done
-					done
-				fi
 			done
 			;;
 	esac
@@ -411,8 +387,8 @@ _nft_fw_tpws4()
 	[ "$DISABLE_IPV4" = "1" -o -z "$1" ] || {
 		local filter="$1" port="$2"
 		nft_print_op "$filter" "tpws (port $2)" 4
-		nft_insert_rule dnat_output skuid != $WS_USER ${3:+oifname @wanif }$filter ip daddr != @nozapret $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
+		nft_insert_rule dnat_output skuid != $WS_USER ${3:+oifname @wanif }$filter ip daddr != @nozapret ip daddr != @ipban $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
-		nft_insert_rule dnat_pre iifname @lanif $filter ip daddr != @nozapret $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
+		nft_insert_rule dnat_pre iifname @lanif $filter ip daddr != @nozapret ip daddr != @ipban $FW_EXTRA_POST dnat ip to $TPWS_LOCALHOST4:$port
 		prepare_route_localnet
 	}
 }
@@ -426,9 +402,9 @@ _nft_fw_tpws6()
 	[ "$DISABLE_IPV6" = "1" -o -z "$1" ] || {
 		local filter="$1" port="$2" DNAT6 i
 		nft_print_op "$filter" "tpws (port $port)" 6
-		nft_insert_rule dnat_output skuid != $WS_USER ${4:+oifname @wanif6 }$filter ip6 daddr != @nozapret6 $FW_EXTRA_POST dnat ip6 to [::1]:$port
+		nft_insert_rule dnat_output skuid != $WS_USER ${4:+oifname @wanif6 }$filter ip6 daddr != @nozapret6 ip6 daddr != @ipban6 $FW_EXTRA_POST dnat ip6 to [::1]:$port
 		[ -n "$3" ] && {
-			nft_insert_rule dnat_pre $filter ip6 daddr != @nozapret6 $FW_EXTRA_POST dnat ip6 to iifname map @link_local:$port
+			nft_insert_rule dnat_pre $filter ip6 daddr != @nozapret6 ip6 daddr != @ipban6 $FW_EXTRA_POST dnat ip6 to iifname map @link_local:$port
 			for i in $3; do
 				_dnat6_target $i DNAT6
 				# can be multiple tpws processes on different ports

docs/changes.txt

@@ -423,3 +423,21 @@ v69.6
 nfqws: set NETLINK_NO_ENOBUFS to fix possible nfq recv errors
 init.d: unify custom scripts for linux
 init.d: new custom scripts : 20-fw-extra, 50-wg4all
+
+v69.7
+
+nfqws,tpws: --comment
+nfqws: trash flood warning
+winws: exclude empty outgoing ack packets in windivert filter
+
+v69.8
+
+winws: accept empty outgoing RST and FIN packets for conntrack needs
+repo: lexra build
+
+v69.9
+
+init.d: exclude ipban from tpws redirection
+macos: fix install_easy
+macos: fix national decimal separator in sleep
+nfqws: apply relative markers to partial TLS ClientHello

docs/readme.en.md

@@ -1,4 +1,4 @@
-# zapret v69.6
+# zapret v69.9
 
 # SCAMMER WARNING
 
@@ -119,7 +119,7 @@ You need to run them with the necessary parameters and redirect certain traffic
 when blocked domains are queried. If this is the case change DNS to public ones, such as 8.8.8.8 or 1.1.1.1.Sometimes ISP hijacks queries to any DNS server. Dnscrypt or dns-over-tls help.
 * If blocking is done by IP.
 * If a connection passes through a filter capable of reconstructing a TCP connection, and which
-follows all standards. For example, we are routed to squid. Connection goes through the full OS tcpip stack, fragmentation disappears immediately as a means of circumvention. Squid is correct, it will find everything as it should, it is useless to deceive him. BUT. Only small providers can afford using squid, since it is very resource intensive. Large companies usually use DPI, which is designed for much greater bandwidth.
+follows all standards. For example, we are routed to squid. Connection goes through the full OS tcpip stack. This project targets DPI only, not full OS stack and not server applications.
 
 ## nfqws
 
@@ -132,6 +132,7 @@ nfqws takes the following parameters:
 
  --debug=0|1
  --dry-run                                      ; verify parameters and exit with code 0 if successful
+ --comment                                      ; any text (ignored)
  --qnum=<nfqueue_number>
  --daemon                                       ; daemonize
  --pidfile=<filename>                           ; write pid to file

docs/readme.md

@@ -1,4 +1,4 @@
-# zapret v69.6
+# zapret v69.9
 
 # ВНИМАНИЕ, остерегайтесь мошенников
 
@@ -144,14 +144,9 @@ DPI. Все больше становится внереестровых бло
 * Если подменяется DNS. С этой проблемой легко справиться.
 * Если блокировка осуществляется по IP.
 * Если соединение проходит через фильтр, способный реконструировать TCP соединение, и который следует всем стандартам.
-  Например, нас заворачивают на squid. Соединение идет через полноценный стек tcpip операционной системы, фрагментация
+  Например, нас заворачивают на squid. Соединение идет через полноценный стек tcpip операционной системы.
-  отпадает сразу как средство обхода. Squid правильный, он все найдет как надо, обманывать его бесполезно. НО.
+  Проект нацелен на обман DPI, который всилу ограниченности ресурсов и большого трафика вынужден интерпретировать его лишь ограниченно.
-  Заворачивать на squid могут позволить себе лишь небольшие провайдеры, поскольку это очень ресурсоемко. Большие
+  Обмануть полноценный стек ОС и полноценные серверные приложения не получится.
-  компании обычно используют DPI, который рассчитан на гораздо большую пропускную способность. Может применяться
-  комбинированный подход, когда на DPI заворачивают только IP из "плохого" списка, и дальше уже DPI решает пропускать
-  или нет. Так можно снизить нагрузку на DPI в десятки, если не сотни раз, а следовательно не покупать очень дорогие
-  решения, обойдясь чем-то существенно более дешевым. Мелкие провайдеры могут покупать услугу фильтрации у вышестоящих,
-  чтобы самим не морочиться, и они уже будут применять DPI.
 
 ## nfqws
 
@@ -163,6 +158,7 @@ dvtws, собираемый из тех же исходников (см. [док
 
 --debug=0|1                                        ; 1=выводить отладочные сообщения
 --dry-run                                          ; проверить опции командной строки и выйти. код 0 - успешная проверка.
+--comment                                          ; любой текст (игнорируется)
 --daemon                                           ; демонизировать прогу
 --pidfile=<file>                                   ; сохранить PID в файл
 --user=<username>                                  ; менять uid процесса
@@ -1443,6 +1439,7 @@ PKTWS_EXTRA_1 .. PKTWS_EXTRA_9, TPWS_EXTRA_1 .. TPWS_EXTRA_9 - отдельно
 SECURE_DNS=0|1 - принудительно выключить или включить DoH
 DOH_SERVERS - список URL DoH через пробел для автоматического выбора работающего сервера
 DOH_SERVER - конкретный DoH URL, отказ от поиска
+UNBLOCKED_DOM - незаблокированный домен, который используется для тестов IP block
 ```
 
 Пример запуска с переменными:\
@@ -2071,17 +2068,18 @@ adb push tpws /data/local/tmp/zapret
 chmod 755 /data/local/tmp/zapret /data/local/tmp/zapret/tpws
 chcon u:object_r:system_file:s0 /data/local/tmp/zapret/tpws
 ```
-Как найти стратегию обхода сотового оператора: проще всего раздать инет на комп с linux.
+Как найти стратегию обхода сотового оператора: проще всего раздать инет на комп.
-Можно записать live image linux на флэшку и загрузиться с нее или запустить виртуалку с linux
+Для этого подойдет любая поддерживаемая ОС. Подключите android через USB кабель к компу и включите режим модема.
-и пробросить в нее usb устройство от режима модема с телефона.
+Прогоните стандартную процедуру blockcheck. При переносе правил на телефон уменьшить TTL на 1,
-На компе с linux прогнать стандартную процедуру blockcheck. При переносе правил на телефон уменьшить TTL на 1,
+если правила с TTL присутствуют в стратегии. Если проверялось на windows, убрать параметры `--wf-*`.
-если правила с TTL присутствуют в стратегии.
+
-Можно развернуть rootfs какого-нибудь дистрибутива linux прямо на телефоне, имея рута.
+Работа blockcheck в android shell не поддерживается, но имея рута можно развернуть rootfs какого-нибудь дистрибутива linux.
 Это лучше всего делать с компа через adb shell.
-Если компа нет, то это единственный вариант, хотя и неудобный.
+Если компа нет, то развертка chroot - единственный вариант, хотя и неудобный.
 Подойдет что-то легковесное, например, alpine или даже openwrt.
 Если это не эмулятор android, то универсальная архитектура - arm (любой вариант).
 Если вы точно знаете, что ОС у вас 64-разрядная, то лучше вместо arm - aarch64.
+Выяснить архитектуру можно командой `uname -a`.
 
 ```
 mount --bind /dev /data/linux/dev

init.d/openwrt/functions

@@ -25,15 +25,8 @@ CUSTOM_DIR="$ZAPRET_RW/init.d/openwrt"
 
 TPWS_LOCALHOST4=127.0.0.127
 
-# max wait time for the link local ipv6 on the LAN interface
-LINKLOCAL_WAIT_SEC=5
-
 IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
 
-IPSET_EXCLUDE="-m set ! --match-set nozapret"
-IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
-
-
 # can be multiple ipv6 outgoing interfaces
 # uplink from isp, tunnelbroker, vpn, ...
 # want them all. who knows what's the real one that blocks sites

init.d/sysv/functions

@@ -90,13 +90,6 @@ TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
 # first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case
 TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3"
 
-# max wait time for the link local ipv6 on the LAN interface
-LINKLOCAL_WAIT_SEC=5
-
-IPSET_EXCLUDE="-m set ! --match-set nozapret"
-IPSET_EXCLUDE6="-m set ! --match-set nozapret6"
-
-
 dnat6_target()
 {
 	_dnat6_target "$@"

init.d/sysv/zapret

@@ -74,8 +74,7 @@ case "$1" in
 		;;
 		
   *)
-	N=/etc/init.d/$NAME
+	echo "Usage: $SCRIPT {start|stop|restart|start-fw|stop-fw|restart-fw|start-daemons|stop-daemons|restart-daemons|reload-ifsets|list-ifsets|list-table}" >&2
-	echo "Usage: $N {start|stop|restart|start-fw|stop-fw|restart-fw|start-daemons|stop-daemons|restart-daemons|reload-ifsets|list-ifsets|list-table}" >&2
 	exit 1
 	;;
 esac

install_bin.sh

@@ -56,7 +56,7 @@ UNAME=$(uname)
 unset PKTWS
 case $UNAME in
 	Linux)
-		ARCHLIST="my x86_64 x86 aarch64 arm mips64r2-msb mips32r1-lsb mips32r1-msb ppc"
+		ARCHLIST="my x86_64 x86 aarch64 arm mips64r2-msb mips32r1-lsb mips32r1-msb lexra ppc"
 		PKTWS=nfqws
 		;;
 	Darwin)

install_easy.sh

@@ -70,7 +70,7 @@ check_bins()
 	elif [ -f "$EXEDIR/Makefile" ] && exists make; then
 		echo trying to compile
 		[ "$SYSTEM" = "macos" ] && make_target=mac
-		make -C "$EXEDIR" $make_target || {
+		CFLAGS="-march=native ${CFLAGS}" make -C "$EXEDIR" $make_target || {
 			echo could not compile
 			make -C "$EXEDIR" clean
 			exitp 8
@@ -292,7 +292,7 @@ ask_config_tmpdir()
 		echo default tmpfs has size of 50% RAM
 		echo "RAM  : $(get_ram_mb) Mb"
 		echo "DISK : $(get_free_space_mb) Mb"
-		echo select temp file location 
+		echo select temp file location
 		[ -z "$TMPDIR" ] && TMPDIR=/tmp
 		ask_list TMPDIR "/tmp $EXEDIR/tmp" && {
 		    [ "$TMPDIR" = "/tmp" ] && TMPDIR=
@@ -388,7 +388,7 @@ copy_openwrt()
 	local ARCH="$(get_bin_arch)"
 	local BINDIR="$1/binaries/$ARCH"
 	local file
-	
+
 	[ -d "$2" ] || mkdir -p "$2"
 
 	mkdir "$2/tpws" "$2/nfq" "$2/ip2net" "$2/mdig" "$2/binaries" "$2/binaries/$ARCH" "$2/init.d" "$2/tmp" "$2/files"
@@ -482,7 +482,7 @@ _restore_settings()
 		[ -z "$f" -o "$f" = "/" ] && continue
 
 		[ -f "/tmp/zapret-bkp-$i" ] && {
-			mv -f "/tmp/zapret-bkp-$i" "$ZAPRET_TARGET/$f" || rm -f "/tmp/zapret-bkp-$i" 
+			mv -f "/tmp/zapret-bkp-$i" "$ZAPRET_TARGET/$f" || rm -f "/tmp/zapret-bkp-$i"
 		}
 		[ -d "/tmp/zapret-bkp-$i" ] && {
 			[ -d "$ZAPRET_TARGET/$f" ] && rm -r "$ZAPRET_TARGET/$f"
@@ -724,7 +724,7 @@ install_linux()
 	crontab_del_quiet
 	# desktop system. more likely up at daytime
 	crontab_add 10 22
-	
+
 	echo
 	echo '!!! WARNING. YOUR SETUP IS INCOMPLETE !!!'
 	echo you must manually add to auto start : $INIT_SCRIPT_SRC start
@@ -772,7 +772,6 @@ deoffload_openwrt_firewall()
 	else
 		echo system wide software flow offloading disabled. ok
 	fi
-			
 }
 
 

ip2net/Makefile

@@ -9,22 +9,22 @@ SRC_FILES = ip2net.c qsort.c
 all: ip2net
 
 ip2net: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o ip2net $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 android: ip2net
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o ip2net $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2neta $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2neta $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2netx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o ip2netx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS) $(LDFLAGS)
 	strip ip2neta ip2netx
 	lipo -create -output ip2net ip2netx ip2neta
 	rm -f ip2netx ip2neta
 
 win: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o ip2net $(SRC_FILES) $(LDFLAGS) $(LIBS_WIN)
+	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o ip2net $(SRC_FILES) $(LIBS_WIN) $(LDFLAGS)
 
 clean:
 	rm -f ip2net *.o

ipset/antifilter.helper

@@ -7,7 +7,7 @@ get_antifilter()
  [ "$DISABLE_IPV4" != "1" ] && {
   curl --fail --max-time 150 --connect-timeout 20 --max-filesize 41943040 -k -L "$1" | cut_local >"$ZIPLISTTMP" &&
   {
-   dlsize=$(LANG=C wc -c "$ZIPLISTTMP" | xargs | cut -f 1 -d ' ')
+   dlsize=$(LC_ALL=C LANG=C wc -c "$ZIPLISTTMP" | xargs | cut -f 1 -d ' ')
    if [ $dlsize -lt 102400 ]; then
     echo list file is too small. can be bad.
     exit 2

ipset/def.sh

@@ -5,7 +5,7 @@ ZAPRET_RW=${ZAPRET_RW:-"$ZAPRET_BASE"}
 ZAPRET_CONFIG=${ZAPRET_CONFIG:-"$ZAPRET_RW/config"}
 IPSET_RW_DIR="$ZAPRET_RW/ipset"
 
-. "$ZAPRET_CONFIG"
+[ -f "$ZAPRET_CONFIG" ] && . "$ZAPRET_CONFIG"
 . "$ZAPRET_BASE/common/base.sh"
 
 [ -z "$TMPDIR" ] && TMPDIR=/tmp
@@ -141,6 +141,18 @@ zzsize()
   printf 0
  fi
 }
+zzcopy()
+{
+ local is_gz=0
+ zztest "$1" && is_gz=1
+ if [ "$GZIP_LISTS" = 1 -a $is_gz = 1 ]; then
+  cp "$1" "${2}.gz"
+ elif [ "$GZIP_LISTS" != 1 -a $is_gz != 1 ]; then
+  cp "$1" "$2"
+ else
+  zzcat "$1" | zz "$2"
+ fi
+}
 
 digger()
 {

ipset/get_antizapret_domains.sh

@@ -21,7 +21,7 @@ curl -H "Accept-Encoding: gzip" -k --fail --max-time 600 --connect-timeout 5 --r
  exit 2
 }
 
-dlsize=$(LANG=C wc -c "$ZDOM" | xargs | cut -f 1 -d ' ')
+dlsize=$(LC_ALL=C LANG=C wc -c "$ZDOM" | xargs | cut -f 1 -d ' ')
 if test $dlsize -lt 102400; then
  echo list file is too small. can be bad.
  exit 2

ipset/get_config.sh

@@ -4,7 +4,7 @@
 IPSET_DIR="$(dirname "$0")"
 IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
 
-. "$IPSET_DIR/../config"
+[ -f "$IPSET_DIR/../config" ] && . "$IPSET_DIR/../config"
 
 [ -z "$GETLIST" ] && GETLIST=get_ipban.sh
 [ -x "$IPSET_DIR/$GETLIST" ] && exec "$IPSET_DIR/$GETLIST"

ipset/get_reestr_hostlist.sh

@@ -5,9 +5,9 @@ IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
 
 . "$IPSET_DIR/def.sh"
 
-ZREESTR="$TMPDIR/zapret.txt"
+ZREESTR="$TMPDIR/zapret.txt.gz"
 IPB="$TMPDIR/ipb.txt"
-ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv
+ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv.gz
 
 dl_checked()
 {
@@ -21,7 +21,7 @@ dl_checked()
    echo list download failed : $1
    return 2
   }
-  dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    return 2
@@ -31,11 +31,11 @@ dl_checked()
 
 reestr_list()
 {
- LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
+ LC_ALL=C LANG=C gunzip -c "$ZREESTR" | cut -s -f2 -d';' | LC_ALL=C  LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
 }
 reestr_extract_ip()
 {
- LANG=C nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' "$ZREESTR" | LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
+ LC_ALL=C LANG=C gunzip -c | nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' | LC_ALL=C  LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
 }
 
 ipban_fin()

ipset/get_reestr_preresolved.sh

@@ -24,12 +24,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/get_reestr_preresolved_smart.sh

@@ -24,12 +24,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/get_reestr_resolvable_domains.sh

@@ -23,12 +23,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/get_reestr_resolve.sh

@@ -5,12 +5,12 @@ IPSET_DIR="$(cd "$IPSET_DIR"; pwd)"
 
 . "$IPSET_DIR/def.sh"
 
-ZREESTR="$TMPDIR/zapret.txt"
+ZREESTR="$TMPDIR/zapret.txt.gz"
 ZDIG="$TMPDIR/zapret-dig.txt"
 IPB="$TMPDIR/ipb.txt"
 ZIPLISTTMP="$TMPDIR/zapret-ip.txt"
 #ZURL=https://reestr.rublacklist.net/api/current
-ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv
+ZURL_REESTR=https://raw.githubusercontent.com/zapret-info/z-i/master/dump.csv.gz
 
 dl_checked()
 {
@@ -24,7 +24,7 @@ dl_checked()
    echo list download failed : $1
    return 2
   }
-  dlsize=$(LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$2" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    return 2
@@ -34,11 +34,11 @@ dl_checked()
 
 reestr_list()
 {
- LANG=C cut -s -f2 -d';' "$ZREESTR" | LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p'
+ LC_ALL=C LANG=C gunzip -c "$ZREESTR" | cut -s -f2 -d';' | LC_ALL=C LANG=C nice -n 5 sed -Ee 's/^\*\.(.+)$/\1/' -ne 's/^[a-z0-9A-Z._-]+$/&/p' | $AWK '{ print tolower($0) }'
 }
 reestr_extract_ip()
 {
- LANG=C nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' "$ZREESTR" | LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
+ LC_ALL=C LANG=C gunzip -c | nice -n 5 $AWK -F ';' '($1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}/) && (($2 == "" && $3 == "") || ($1 == $2)) {gsub(/ \| /, RS); print $1}' | LC_ALL=C LANG=C $AWK '{split($1, a, /\|/); for (i in a) {print a[i]}}'
 }
 
 getuser && {

ipset/get_refilter_domains.sh

@@ -20,12 +20,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  zzcat "$TMPLIST" | tr -d '\015' | zz "$2"
+  zzcopy "$TMPLIST" "$2"
   rm -f "$TMPLIST"
 }
 

ipset/get_refilter_ipsum.sh

@@ -20,13 +20,12 @@ dl()
    echo list download failed : $1
    exit 2
   }
-  dlsize=$(LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
+  dlsize=$(LC_ALL=C LANG=C wc -c "$TMPLIST" | xargs | cut -f 1 -d ' ')
   if test $dlsize -lt $3; then
    echo list is too small : $dlsize bytes. can be bad.
    exit 2
   fi
-  # remove DOS EOL \r
+  zzcopy "$TMPLIST" "$2"
-  zzcat "$TMPLIST" | tr -d '\015' | zz "$2"
   rm -f "$TMPLIST"
 }
 

mdig/Makefile

@@ -10,23 +10,23 @@ SRC_FILES = *.c
 all: mdig
 
 mdig: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 android: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_ANDROID)
+	$(CC) -s $(CFLAGS) -o mdig $(SRC_FILES) $(LIBS_ANDROID) $(LDFLAGS)
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o mdig $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdiga $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdiga $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdigx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o mdigx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
 	strip mdiga mdigx
 	lipo -create -output mdig mdigx mdiga
 	rm -f mdigx mdiga
 
 win: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o mdig $(SRC_FILES) $(LDFLAGS) $(LIBS_WIN)
+	$(CC) -s $(CFLAGS) $(CFLAGS_WIN) -o mdig $(SRC_FILES) $(LIBS_WIN) $(LDFLAGS)
 
 clean:
 	rm -f mdig *.o

nfq/BSDmakefile

@@ -6,7 +6,7 @@ SRC_FILES = *.c crypto/*.c
 all: dvtws
 
 dvtws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -o dvtws $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 clean:
 	rm -f dvtws

nfq/Makefile

@@ -14,24 +14,24 @@ SRC_FILES = *.c crypto/*.c
 all: nfqws
 
 nfqws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+	$(CC) -s $(CFLAGS) -o nfqws $(SRC_FILES) $(LIBS_LINUX) $(LDFLAGS)
 
 android: nfqws
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS_BSD)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LIBS_BSD) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) -target arm64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) -target x86_64-apple-macos10.8 $(LIBS_BSD) $(LDFLAGS)
 	strip dvtwsa dvtwsx
 	lipo -create -output dvtws dvtwsx dvtwsa
 	rm -f dvtwsx dvtwsa
 
 cygwin64:
-	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) $(LIBS_CYGWIN64) $(RES_CYGWIN64)
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LIBS_CYGWIN) $(LIBS_CYGWIN64) $(RES_CYGWIN64) $(LDFLAGS)
 cygwin32:
-	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) $(LIBS_CYGWIN32) $(RES_CYGWIN32)
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LIBS_CYGWIN) $(LIBS_CYGWIN32) $(RES_CYGWIN32) $(LDFLAGS)
 cygwin: cygwin64
 
 clean:

nfq/desync.c

@@ -76,13 +76,6 @@ void randomize_default_tls_payload(uint8_t *p)
 #define PKTDATA_MAXDUMP 32
 #define IP_MAXDUMP 80
 
-static uint8_t zeropkt[DPI_DESYNC_MAX_FAKE_LEN];
-
-void desync_init(void)
-{
-	memset(zeropkt, 0, sizeof(zeropkt));
-}
-
 bool desync_valid_zero_stage(enum dpi_desync_mode mode)
 {
 	return mode==DESYNC_SYNACK || mode==DESYNC_SYNDATA;

nfq/desync.h

@@ -52,5 +52,4 @@ bool desync_valid_second_stage(enum dpi_desync_mode mode);
 bool desync_valid_second_stage_tcp(enum dpi_desync_mode mode);
 bool desync_valid_second_stage_udp(enum dpi_desync_mode mode);
 
-void desync_init(void);
 uint8_t dpi_desync_packet(uint32_t fwmark, const char *ifout, uint8_t *data_pkt, size_t *len_pkt);

nfq/nfqws.c

@@ -84,8 +84,6 @@ static void pre_desync(void)
 	signal(SIGHUP, onhup);
 	signal(SIGUSR1, onusr1);
 	signal(SIGUSR2, onusr2);
-
-	desync_init();
 }
 
 
@@ -238,19 +236,15 @@ static int nfq_main(void)
 	int fd,e;
 	ssize_t rd;
 
-#ifndef __CYGWIN__
 	sec_harden();
-
 	if (params.droproot && !droproot(params.uid, params.gid))
-		goto exiterr;
+		return 1;
-
 	print_id();
-#endif
 
 	pre_desync();
 
 	if (!nfq_init(&h,&qh))
-		goto exiterr;
+		return 1;
 
 	fd = nfq_fd(h);
 	do
@@ -273,13 +267,7 @@ static int nfq_main(void)
 	} while(e==ENOBUFS);
 
 	nfq_deinit(&h,&qh);
-
 	return 0;
-
-exiterr:
-	if (qh) nfq_destroy_queue(qh);
-	if (h) nfq_close(h);
-	return 1;
 }
 
 #elif defined(BSD)
@@ -313,8 +301,6 @@ static int dvt_main(void)
 			DLOG_PERROR("bind (DIVERT4)");
 			goto exiterr;
 		}
-		if (!set_socket_buffers(fd[0],Q_RCVBUF,Q_SNDBUF))
-			goto exiterr;
 	}
 
 
@@ -339,8 +325,6 @@ static int dvt_main(void)
 			goto exiterr;
 		}
 		fdct++;
-		if (!set_socket_buffers(fd[1],Q_RCVBUF,Q_SNDBUF))
-			goto exiterr;
 	}
 #endif
 	fdmax = (fd[0]>fd[1] ? fd[0] : fd[1]) + 1;
@@ -995,6 +979,7 @@ static bool wf_make_pf(char *opt, const char *l4, const char *portname, char *bu
 #define DIVERT_NO_LOCALNETS_SRC "(" DIVERT_NO_LOCALNETSv4_SRC " or " DIVERT_NO_LOCALNETSv6_SRC ")"
 #define DIVERT_NO_LOCALNETS_DST "(" DIVERT_NO_LOCALNETSv4_DST " or " DIVERT_NO_LOCALNETSv6_DST ")"
 
+#define DIVERT_TCP_NOT_EMPTY "(!tcp or tcp.Syn or tcp.Rst or tcp.Fin or tcp.PayloadLength>0)"
 #define DIVERT_TCP_INBOUNDS "(tcp.Ack and tcp.Syn or tcp.Rst or tcp.Fin)"
 
 // HTTP/1.? 30(2|7)
@@ -1012,6 +997,7 @@ static bool wf_make_filter(
 	char pf_dst_buf[512],iface[64];
 	const char *pf_dst;
 	const char *f_tcpin = *pf_tcp_src ? dp_list_have_autohostlist(&params.desync_profiles) ? "(" DIVERT_TCP_INBOUNDS " or (" DIVERT_HTTP_REDIRECT "))" : DIVERT_TCP_INBOUNDS : "";
+	const char *f_tcp_not_empty = *pf_tcp_src ? DIVERT_TCP_NOT_EMPTY " and " : "";
 
 	snprintf(iface,sizeof(iface)," ifIdx=%u and subIfIdx=%u and",IfIdx,SubIfIdx);
 
@@ -1024,9 +1010,10 @@ static bool wf_make_filter(
 	else
 		pf_dst = *pf_tcp_dst ? pf_tcp_dst : pf_udp_dst;
 	snprintf(wf,len,
- 	       DIVERT_PROLOG " and%s%s\n ((outbound and %s%s)\n  or\n  (inbound and tcp%s%s%s%s%s%s%s))",
+	       DIVERT_PROLOG " and%s%s\n ((outbound and %s%s%s)\n  or\n  (inbound and tcp%s%s%s%s%s%s%s))",
 		IfIdx ? iface : "",
 		ipv4 ? ipv6 ? "" : " ip and" : " ipv6 and",
+		f_tcp_not_empty,
 		pf_dst,
 		ipv4 ? ipv6 ? " and " DIVERT_NO_LOCALNETS_DST : " and " DIVERT_NO_LOCALNETSv4_DST : " and " DIVERT_NO_LOCALNETSv6_DST,
 		*pf_tcp_src ? "" : " and false",
@@ -1059,6 +1046,7 @@ static void exithelp(void)
 #endif
 		" --debug=0|1|syslog|@<filename>\n"
 		" --dry-run\t\t\t\t\t; verify parameters and exit with code 0 if successful\n"
+		" --comment=any_text\n"
 #ifdef __linux__
 		" --qnum=<nfqueue_number>\n"
 #elif defined(BSD)
@@ -1203,6 +1191,27 @@ void config_from_file(const char *filename)
 }
 #endif
 
+void check_dp(const struct desync_profile *dp)
+{
+	// only linux has connbytes limiter
+	if (dp->desync_any_proto && !dp->desync_cutoff &&
+		(dp->desync_mode==DESYNC_FAKE || dp->desync_mode==DESYNC_RST || dp->desync_mode==DESYNC_RSTACK ||
+		 dp->desync_mode==DESYNC_FAKEDSPLIT || dp->desync_mode==DESYNC_FAKEDDISORDER || dp->desync_mode2==DESYNC_FAKEDSPLIT || dp->desync_mode2==DESYNC_FAKEDDISORDER))
+	{
+#ifdef __linux__
+		DLOG_CONDUP("WARNING !!! in profile %d you are using --dpi-desync-any-protocol without --dpi-desync-cutoff\n", dp->n);
+		DLOG_CONDUP("WARNING !!! it's completely ok if connbytes or payload based ip/nf tables limiter is applied. Make sure it exists.\n");
+#else
+		DLOG_CONDUP("WARNING !!! possible TRASH FLOOD configuration detected in profile %d\n", dp->n);
+		DLOG_CONDUP("WARNING !!! it's highly recommended to use --dpi-desync-cutoff limiter or fakes will be sent on every processed packet\n");
+		DLOG_CONDUP("WARNING !!! make sure it's really what you want\n");
+#ifdef __CYGWIN__
+		DLOG_CONDUP("WARNING !!! in most cases this is acceptable only with custom payload based windivert filter (--wf-raw)\n");
+#endif
+#endif
+	}
+}
+
 #define STRINGIFY(x) #x
 #define TOSTRING(x) STRINGIFY(x)
 #if defined(ZAPRET_GH_VER) || defined (ZAPRET_GH_HASH)
@@ -1293,101 +1302,102 @@ int main(int argc, char **argv)
 	const struct option long_options[] = {
 		{"debug",optional_argument,0,0},	// optidx=0
 		{"dry-run",no_argument,0,0},		// optidx=1
+		{"comment",optional_argument,0,0},	// optidx=2
 #ifdef __linux__
-		{"qnum",required_argument,0,0},		// optidx=2
+		{"qnum",required_argument,0,0},		// optidx=3
 #elif defined(BSD)
-		{"port",required_argument,0,0},		// optidx=2
+		{"port",required_argument,0,0},		// optidx=3
 #else
-		{"disabled_argument_1",no_argument,0,0},// optidx=2
+		{"disabled_argument_1",no_argument,0,0},// optidx=3
 #endif
-		{"daemon",no_argument,0,0},		// optidx=3
+		{"daemon",no_argument,0,0},		// optidx=4
-		{"pidfile",required_argument,0,0},	// optidx=4
+		{"pidfile",required_argument,0,0},	// optidx=5
 #ifndef __CYGWIN__
-		{"user",required_argument,0,0 },	// optidx=5
+		{"user",required_argument,0,0 },	// optidx=6
-		{"uid",required_argument,0,0 },		// optidx=6
+		{"uid",required_argument,0,0 },		// optidx=7
 #else
-		{"disabled_argument_2",no_argument,0,0},	// optidx=5
+		{"disabled_argument_2",no_argument,0,0},	// optidx=6
-		{"disabled_argument_3",no_argument,0,0},	// optidx=6
+		{"disabled_argument_3",no_argument,0,0},	// optidx=7
 #endif
-		{"wsize",required_argument,0,0},	// optidx=7
+		{"wsize",required_argument,0,0},	// optidx=8
-		{"wssize",required_argument,0,0},	// optidx=8
+		{"wssize",required_argument,0,0},	// optidx=9
-		{"wssize-cutoff",required_argument,0,0},// optidx=9
+		{"wssize-cutoff",required_argument,0,0},// optidx=10
-		{"ctrack-timeouts",required_argument,0,0},// optidx=10
+		{"ctrack-timeouts",required_argument,0,0},// optidx=11
-		{"hostcase",no_argument,0,0},		// optidx=11
+		{"hostcase",no_argument,0,0},		// optidx=12
-		{"hostspell",required_argument,0,0},	// optidx=12
+		{"hostspell",required_argument,0,0},	// optidx=13
-		{"hostnospace",no_argument,0,0},	// optidx=13
+		{"hostnospace",no_argument,0,0},	// optidx=14
-		{"domcase",no_argument,0,0 },		// optidx=14
+		{"domcase",no_argument,0,0 },		// optidx=15
-		{"methodeol",no_argument,0,0 },		// optidx=15
+		{"methodeol",no_argument,0,0 },		// optidx=16
 		{"dpi-desync",required_argument,0,0},		// optidx=17
 #ifdef __linux__
-		{"dpi-desync-fwmark",required_argument,0,0},	// optidx=17
+		{"dpi-desync-fwmark",required_argument,0,0},	// optidx=18
 #elif defined(SO_USER_COOKIE)
-		{"dpi-desync-sockarg",required_argument,0,0},	// optidx=17
+		{"dpi-desync-sockarg",required_argument,0,0},	// optidx=18
 #else
-		{"disabled_argument_4",no_argument,0,0},	// optidx=17
+		{"disabled_argument_4",no_argument,0,0},	// optidx=18
 #endif
-		{"dpi-desync-ttl",required_argument,0,0},	// optidx=18
+		{"dpi-desync-ttl",required_argument,0,0},	// optidx=19
-		{"dpi-desync-ttl6",required_argument,0,0},	// optidx=19
+		{"dpi-desync-ttl6",required_argument,0,0},	// optidx=20
-		{"dpi-desync-autottl",optional_argument,0,0},	// optidx=20
+		{"dpi-desync-autottl",optional_argument,0,0},	// optidx=21
-		{"dpi-desync-autottl6",optional_argument,0,0},	// optidx=21
+		{"dpi-desync-autottl6",optional_argument,0,0},	// optidx=22
-		{"dpi-desync-fooling",required_argument,0,0},	// optidx=22
+		{"dpi-desync-fooling",required_argument,0,0},	// optidx=23
-		{"dpi-desync-repeats",required_argument,0,0},	// optidx=23
+		{"dpi-desync-repeats",required_argument,0,0},	// optidx=24
-		{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=24
+		{"dpi-desync-skip-nosni",optional_argument,0,0},// optidx=25
-		{"dpi-desync-split-pos",required_argument,0,0},// optidx=25
+		{"dpi-desync-split-pos",required_argument,0,0},// optidx=26
-		{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=26
+		{"dpi-desync-split-http-req",required_argument,0,0 },// optidx=27
-		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=27
+		{"dpi-desync-split-tls",required_argument,0,0 },// optidx=28
-		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=28
+		{"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=29
-		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=29
+		{"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=30
-		{"dpi-desync-fakedsplit-pattern",required_argument,0,0 },// optidx=30
+		{"dpi-desync-fakedsplit-pattern",required_argument,0,0 },// optidx=31
-		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=31
+		{"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=32
-		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=32
+		{"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=33
-		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=33
+		{"dpi-desync-badseq-increment",required_argument,0,0},// optidx=34
-		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=34
+		{"dpi-desync-badack-increment",required_argument,0,0},// optidx=35
-		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=35
+		{"dpi-desync-any-protocol",optional_argument,0,0},// optidx=36
-		{"dpi-desync-fake-http",required_argument,0,0},// optidx=36
+		{"dpi-desync-fake-http",required_argument,0,0},// optidx=37
-		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=37
+		{"dpi-desync-fake-tls",required_argument,0,0},// optidx=38
-		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=38
+		{"dpi-desync-fake-unknown",required_argument,0,0},// optidx=39
-		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=39
+		{"dpi-desync-fake-syndata",required_argument,0,0},// optidx=40
-		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=40
+		{"dpi-desync-fake-quic",required_argument,0,0},// optidx=41
-		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=41
+		{"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=42
-		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=42
+		{"dpi-desync-fake-dht",required_argument,0,0},// optidx=43
-		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=43
+		{"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=44
-		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=44
+		{"dpi-desync-udplen-increment",required_argument,0,0},// optidx=45
-		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=45
+		{"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=46
-		{"dpi-desync-cutoff",required_argument,0,0},// optidx=46
+		{"dpi-desync-cutoff",required_argument,0,0},// optidx=47
-		{"dpi-desync-start",required_argument,0,0},// optidx=47
+		{"dpi-desync-start",required_argument,0,0},// optidx=48
-		{"hostlist",required_argument,0,0},		// optidx=48
+		{"hostlist",required_argument,0,0},		// optidx=49
-		{"hostlist-domains",required_argument,0,0},// optidx=49
+		{"hostlist-domains",required_argument,0,0},// optidx=50
-		{"hostlist-exclude",required_argument,0,0},	// optidx=50
+		{"hostlist-exclude",required_argument,0,0},	// optidx=51
-		{"hostlist-exclude-domains",required_argument,0,0},// optidx=51
+		{"hostlist-exclude-domains",required_argument,0,0},// optidx=52
-		{"hostlist-auto",required_argument,0,0},	// optidx=52
+		{"hostlist-auto",required_argument,0,0},	// optidx=53
-		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=53
+		{"hostlist-auto-fail-threshold",required_argument,0,0},	// optidx=54
-		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=54
+		{"hostlist-auto-fail-time",required_argument,0,0},	// optidx=55
-		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=55
+		{"hostlist-auto-retrans-threshold",required_argument,0,0},	// optidx=56
-		{"hostlist-auto-debug",required_argument,0,0},	// optidx=56
+		{"hostlist-auto-debug",required_argument,0,0},	// optidx=57
-		{"new",no_argument,0,0},	// optidx=57
+		{"new",no_argument,0,0},	// optidx=58
-		{"skip",no_argument,0,0},	// optidx=58
+		{"skip",no_argument,0,0},	// optidx=59
-		{"filter-l3",required_argument,0,0},	// optidx=59
+		{"filter-l3",required_argument,0,0},	// optidx=60
-		{"filter-tcp",required_argument,0,0},	// optidx=60
+		{"filter-tcp",required_argument,0,0},	// optidx=61
-		{"filter-udp",required_argument,0,0},	// optidx=61
+		{"filter-udp",required_argument,0,0},	// optidx=62
-		{"filter-l7",required_argument,0,0},	// optidx=62
+		{"filter-l7",required_argument,0,0},	// optidx=63
-		{"ipset",required_argument,0,0},	// optidx=63
+		{"ipset",required_argument,0,0},	// optidx=64
-		{"ipset-ip",required_argument,0,0},	// optidx=64
+		{"ipset-ip",required_argument,0,0},	// optidx=65
-		{"ipset-exclude",required_argument,0,0},// optidx=65
+		{"ipset-exclude",required_argument,0,0},// optidx=66
-		{"ipset-exclude-ip",required_argument,0,0},	// optidx=66
+		{"ipset-exclude-ip",required_argument,0,0},	// optidx=67
 #ifdef __linux__
-		{"bind-fix4",no_argument,0,0},		// optidx=67
+		{"bind-fix4",no_argument,0,0},		// optidx=68
-		{"bind-fix6",no_argument,0,0},		// optidx=68
+		{"bind-fix6",no_argument,0,0},		// optidx=69
 #elif defined(__CYGWIN__)
-		{"wf-iface",required_argument,0,0},	// optidx=67
+		{"wf-iface",required_argument,0,0},	// optidx=68
-		{"wf-l3",required_argument,0,0},	// optidx=68
+		{"wf-l3",required_argument,0,0},	// optidx=69
-		{"wf-tcp",required_argument,0,0},	// optidx=69
+		{"wf-tcp",required_argument,0,0},	// optidx=70
-		{"wf-udp",required_argument,0,0},	// optidx=70
+		{"wf-udp",required_argument,0,0},	// optidx=71
-		{"wf-raw",required_argument,0,0},	// optidx=71
+		{"wf-raw",required_argument,0,0},	// optidx=72
-		{"wf-save",required_argument,0,0},	// optidx=72
+		{"wf-save",required_argument,0,0},	// optidx=73
-		{"ssid-filter",required_argument,0,0},	// optidx=73
+		{"ssid-filter",required_argument,0,0},	// optidx=74
-		{"nlm-filter",required_argument,0,0},	// optidx=74
+		{"nlm-filter",required_argument,0,0},	// optidx=75
-		{"nlm-list",optional_argument,0,0},	// optidx=75
+		{"nlm-list",optional_argument,0,0},	// optidx=76
 #endif
 		{NULL,0,NULL,0}
 	};
@@ -1440,7 +1450,9 @@ int main(int argc, char **argv)
 		case 1: /* dry-run */
 			bDry=true;
 			break;
-		case 2: /* qnum or port */
+		case 2: /* comment */
+			break;
+		case 3: /* qnum or port */
 #ifdef __linux__
 			params.qnum = atoi(optarg);
 			if (params.qnum < 0 || params.qnum>65535)
@@ -1460,15 +1472,15 @@ int main(int argc, char **argv)
 			}
 #endif
 			break;
-		case 3: /* daemon */
+		case 4: /* daemon */
 			daemon = true;
 			break;
-		case 4: /* pidfile */
+		case 5: /* pidfile */
 			strncpy(pidfile, optarg, sizeof(pidfile));
 			pidfile[sizeof(pidfile) - 1] = '\0';
 			break;
 #ifndef __CYGWIN__
-		case 5: /* user */
+		case 6: /* user */
 		{
 			struct passwd *pwd = getpwnam(optarg);
 			if (!pwd)
@@ -1481,7 +1493,7 @@ int main(int argc, char **argv)
 			params.droproot = true;
 			break;
 		}
-		case 6: /* uid */
+		case 7: /* uid */
 			params.gid = 0x7FFFFFFF; // default gid. drop gid=0
 			params.droproot = true;
 			if (sscanf(optarg, "%u:%u", &params.uid, &params.gid)<1)
@@ -1491,32 +1503,32 @@ int main(int argc, char **argv)
 			}
 			break;
 #endif
-		case 7: /* wsize */
+		case 8: /* wsize */
 			if (!parse_ws_scale_factor(optarg,&dp->wsize,&dp->wscale))
 				exit_clean(1);
 			break;
-		case 8: /* wssize */
+		case 9: /* wssize */
 			if (!parse_ws_scale_factor(optarg,&dp->wssize,&dp->wsscale))
 				exit_clean(1);
 			break;
-		case 9: /* wssize-cutoff */
+		case 10: /* wssize-cutoff */
 			if (!parse_cutoff(optarg, &dp->wssize_cutoff, &dp->wssize_cutoff_mode))
 			{
 				DLOG_ERR("invalid wssize-cutoff value\n");
 				exit_clean(1);
 			}
 			break;
-		case 10: /* ctrack-timeouts */
+		case 11: /* ctrack-timeouts */
 			if (sscanf(optarg, "%u:%u:%u:%u", &params.ctrack_t_syn, &params.ctrack_t_est, &params.ctrack_t_fin, &params.ctrack_t_udp)<3)
 			{
 				DLOG_ERR("invalid ctrack-timeouts value\n");
 				exit_clean(1);
 			}
 			break;
-		case 11: /* hostcase */
+		case 12: /* hostcase */
 			dp->hostcase = true;
 			break;
-		case 12: /* hostspell */
+		case 13: /* hostspell */
 			if (strlen(optarg) != 4)
 			{
 				DLOG_ERR("hostspell must be exactly 4 chars long\n");
@@ -1525,7 +1537,7 @@ int main(int argc, char **argv)
 			dp->hostcase = true;
 			memcpy(dp->hostspell, optarg, 4);
 			break;
-		case 13: /* hostnospace */
+		case 14: /* hostnospace */
 			if (dp->methodeol)
 			{
 				DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
@@ -1533,10 +1545,10 @@ int main(int argc, char **argv)
 			}
 			dp->hostnospace = true;
 			break;
-		case 14: /* domcase */
+		case 15: /* domcase */
 			dp->domcase = true;
 			break;
-		case 15: /* methodeol */
+		case 16: /* methodeol */
 			if (dp->hostnospace)
 			{
 				DLOG_ERR("--hostnospace and --methodeol are incompatible\n");
@@ -1544,7 +1556,7 @@ int main(int argc, char **argv)
 			}
 			dp->methodeol = true;
 			break;
-		case 16: /* dpi-desync */
+		case 17: /* dpi-desync */
 			{
 				char *mode=optarg,*mode2,*mode3;
 				mode2 = mode ? strchr(mode,',') : NULL;
@@ -1590,7 +1602,7 @@ int main(int argc, char **argv)
 			}
 			break;
 #ifndef __CYGWIN__
-		case 17: /* dpi-desync-fwmark/dpi-desync-sockarg */
+		case 18: /* dpi-desync-fwmark/dpi-desync-sockarg */
 #if defined(__linux__) || defined(SO_USER_COOKIE)
 			params.desync_fwmark = 0;
 			if (sscanf(optarg, "0x%X", &params.desync_fwmark)<=0) sscanf(optarg, "%u", &params.desync_fwmark);
@@ -1605,27 +1617,27 @@ int main(int argc, char **argv)
 #endif
 			break;
 #endif
-		case 18: /* dpi-desync-ttl */
+		case 19: /* dpi-desync-ttl */
 			dp->desync_ttl = (uint8_t)atoi(optarg);
 			break;
-		case 19: /* dpi-desync-ttl6 */
+		case 20: /* dpi-desync-ttl6 */
 			dp->desync_ttl6 = (uint8_t)atoi(optarg);
 			break;
-		case 20: /* dpi-desync-autottl */
+		case 21: /* dpi-desync-autottl */
 			if (!parse_autottl(optarg, &dp->desync_autottl))
 			{
 				DLOG_ERR("dpi-desync-autottl value error\n");
 				exit_clean(1);
 			}
 			break;
-		case 21: /* dpi-desync-autottl6 */
+		case 22: /* dpi-desync-autottl6 */
 			if (!parse_autottl(optarg, &dp->desync_autottl6))
 			{
 				DLOG_ERR("dpi-desync-autottl6 value error\n");
 				exit_clean(1);
 			}
 			break;
-		case 22: /* dpi-desync-fooling */
+		case 23: /* dpi-desync-fooling */
 			{
 				char *e,*p = optarg;
 				while (p)
@@ -1660,17 +1672,17 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 23: /* dpi-desync-repeats */
+		case 24: /* dpi-desync-repeats */
 			if (sscanf(optarg,"%u",&dp->desync_repeats)<1 || !dp->desync_repeats || dp->desync_repeats>20)
 			{
 				DLOG_ERR("dpi-desync-repeats must be within 1..20\n");
 				exit_clean(1);
 			}
 			break;
-		case 24: /* dpi-desync-skip-nosni */
+		case 25: /* dpi-desync-skip-nosni */
 			dp->desync_skip_nosni = !optarg || atoi(optarg);
 			break;
-		case 25: /* dpi-desync-split-pos */
+		case 26: /* dpi-desync-split-pos */
 			{
 				int ct;
 				if (!parse_split_pos_list(optarg,dp->splits+dp->split_count,MAX_SPLITS-dp->split_count,&ct))
@@ -1681,7 +1693,7 @@ int main(int argc, char **argv)
 				dp->split_count += ct;
 			}
 			break;
-		case 26: /* dpi-desync-split-http-req */
+		case 27: /* dpi-desync-split-http-req */
 			// obsolete arg
 			DLOG_CONDUP("WARNING ! --dpi-desync-split-http-req is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
 			if (dp->split_count>=MAX_SPLITS)
@@ -1696,7 +1708,7 @@ int main(int argc, char **argv)
 			}
 			dp->split_count++;
 			break;
-		case 27: /* dpi-desync-split-tls */
+		case 28: /* dpi-desync-split-tls */
 			// obsolete arg
 			DLOG_CONDUP("WARNING ! --dpi-desync-split-tls is deprecated. use --dpi-desync-split-pos with markers.\n",MAX_SPLITS);
 			if (dp->split_count>=MAX_SPLITS)
@@ -1711,7 +1723,7 @@ int main(int argc, char **argv)
 			}
 			dp->split_count++;
 			break;
-		case 28: /* dpi-desync-split-seqovl */
+		case 29: /* dpi-desync-split-seqovl */
 			if (!strcmp(optarg,"0"))
 			{
 				// allow zero = disable seqovl
@@ -1724,7 +1736,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 29: /* dpi-desync-split-seqovl-pattern */
+		case 30: /* dpi-desync-split-seqovl-pattern */
 			{
 				char buf[sizeof(dp->seqovl_pattern)];
 				size_t sz=sizeof(buf);
@@ -1732,7 +1744,7 @@ int main(int argc, char **argv)
 				fill_pattern(dp->seqovl_pattern,sizeof(dp->seqovl_pattern),buf,sz);
 			}
 			break;
-		case 30: /* dpi-desync-fakedsplit-pattern */
+		case 31: /* dpi-desync-fakedsplit-pattern */
 			{
 				char buf[sizeof(dp->fsplit_pattern)];
 				size_t sz=sizeof(buf);
@@ -1740,7 +1752,7 @@ int main(int argc, char **argv)
 				fill_pattern(dp->fsplit_pattern,sizeof(dp->fsplit_pattern),buf,sz);
 			}
 			break;
-		case 31: /* dpi-desync-ipfrag-pos-tcp */
+		case 32: /* dpi-desync-ipfrag-pos-tcp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_tcp)<1 || dp->desync_ipfrag_pos_tcp<1 || dp->desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1752,7 +1764,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 32: /* dpi-desync-ipfrag-pos-udp */
+		case 33: /* dpi-desync-ipfrag-pos-udp */
 			if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_udp)<1 || dp->desync_ipfrag_pos_udp<1 || dp->desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
 			{
 				DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
@@ -1764,63 +1776,63 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 33: /* dpi-desync-badseq-increments */
+		case 34: /* dpi-desync-badseq-increments */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment))
 			{
 				DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 34: /* dpi-desync-badack-increment */
+		case 35: /* dpi-desync-badack-increment */
 			if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment))
 			{
 				DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
 				exit_clean(1);
 			}
 			break;
-		case 35: /* dpi-desync-any-protocol */
+		case 36: /* dpi-desync-any-protocol */
 			dp->desync_any_proto = !optarg || atoi(optarg);
 			break;
-		case 36: /* dpi-desync-fake-http */
+		case 37: /* dpi-desync-fake-http */
 			dp->fake_http_size = sizeof(dp->fake_http);
 			load_file_or_exit(optarg,dp->fake_http,&dp->fake_http_size);
 			break;
-		case 37: /* dpi-desync-fake-tls */
+		case 38: /* dpi-desync-fake-tls */
 			dp->fake_tls_size = sizeof(dp->fake_tls);
 			load_file_or_exit(optarg,dp->fake_tls,&dp->fake_tls_size);
 			break;
-		case 38: /* dpi-desync-fake-unknown */
+		case 39: /* dpi-desync-fake-unknown */
 			dp->fake_unknown_size = sizeof(dp->fake_unknown);
 			load_file_or_exit(optarg,dp->fake_unknown,&dp->fake_unknown_size);
 			break;
-		case 39: /* dpi-desync-fake-syndata */
+		case 40: /* dpi-desync-fake-syndata */
 			dp->fake_syndata_size = sizeof(dp->fake_syndata);
 			load_file_or_exit(optarg,dp->fake_syndata,&dp->fake_syndata_size);
 			break;
-		case 40: /* dpi-desync-fake-quic */
+		case 41: /* dpi-desync-fake-quic */
 			dp->fake_quic_size = sizeof(dp->fake_quic);
 			load_file_or_exit(optarg,dp->fake_quic,&dp->fake_quic_size);
 			break;
-		case 41: /* dpi-desync-fake-wireguard */
+		case 42: /* dpi-desync-fake-wireguard */
 			dp->fake_wg_size = sizeof(dp->fake_wg);
 			load_file_or_exit(optarg,dp->fake_wg,&dp->fake_wg_size);
 			break;
-		case 42: /* dpi-desync-fake-dht */
+		case 43: /* dpi-desync-fake-dht */
 			dp->fake_dht_size = sizeof(dp->fake_dht);
 			load_file_or_exit(optarg,dp->fake_dht,&dp->fake_dht_size);
 			break;
-		case 43: /* dpi-desync-fake-unknown-udp */
+		case 44: /* dpi-desync-fake-unknown-udp */
 			dp->fake_unknown_udp_size = sizeof(dp->fake_unknown_udp);
 			load_file_or_exit(optarg,dp->fake_unknown_udp,&dp->fake_unknown_udp_size);
 			break;
-		case 44: /* dpi-desync-udplen-increment */
+		case 45: /* dpi-desync-udplen-increment */
 			if (sscanf(optarg,"%d",&dp->udplen_increment)<1 || dp->udplen_increment>0x7FFF || dp->udplen_increment<-0x8000)
 			{
 				DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
 				exit_clean(1);
 			}
 			break;
-		case 45: /* dpi-desync-udplen-pattern */
+		case 46: /* dpi-desync-udplen-pattern */
 			{
 				char buf[sizeof(dp->udplen_pattern)];
 				size_t sz=sizeof(buf);
@@ -1828,21 +1840,21 @@ int main(int argc, char **argv)
 				fill_pattern(dp->udplen_pattern,sizeof(dp->udplen_pattern),buf,sz);
 			}
 			break;
-		case 46: /* desync-cutoff */
+		case 47: /* desync-cutoff */
 			if (!parse_cutoff(optarg, &dp->desync_cutoff, &dp->desync_cutoff_mode))
 			{
 				DLOG_ERR("invalid desync-cutoff value\n");
 				exit_clean(1);
 			}
 			break;
-		case 47: /* desync-start */
+		case 48: /* desync-start */
 			if (!parse_cutoff(optarg, &dp->desync_start, &dp->desync_start_mode))
 			{
 				DLOG_ERR("invalid desync-start value\n");
 				exit_clean(1);
 			}
 			break;
-		case 48: /* hostlist */
+		case 49: /* hostlist */
 			if (bSkip) break;
 			if (!RegisterHostlist(dp, false, optarg))
 			{
@@ -1850,7 +1862,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 49: /* hostlist-domains */
+		case 50: /* hostlist-domains */
 			if (bSkip) break;
 			if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
 			{
@@ -1863,7 +1875,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 50: /* hostlist-exclude */
+		case 51: /* hostlist-exclude */
 			if (bSkip) break;
 			if (!RegisterHostlist(dp, true, optarg))
 			{
@@ -1871,7 +1883,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 51: /* hostlist-exclude-domains */
+		case 52: /* hostlist-exclude-domains */
 			if (bSkip) break;
 			if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
 			{
@@ -1884,7 +1896,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 52: /* hostlist-auto */
+		case 53: /* hostlist-auto */
 			if (bSkip) break;
 			if (dp->hostlist_auto)
 			{
@@ -1912,7 +1924,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 53: /* hostlist-auto-fail-threshold */
+		case 54: /* hostlist-auto-fail-threshold */
 			dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
 			{
@@ -1920,7 +1932,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 54: /* hostlist-auto-fail-time */
+		case 55: /* hostlist-auto-fail-time */
 			dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_fail_time<1)
 			{
@@ -1928,7 +1940,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 55: /* hostlist-auto-retrans-threshold */
+		case 56: /* hostlist-auto-retrans-threshold */
 			dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
 			if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10)
 			{
@@ -1936,7 +1948,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 56: /* hostlist-auto-debug */
+		case 57: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -1950,7 +1962,7 @@ int main(int argc, char **argv)
 			}
 			break;
 
-		case 57: /* new */
+		case 58: /* new */
 			if (bSkip)
 			{
 				dp_clear(dp);
@@ -1960,6 +1972,7 @@ int main(int argc, char **argv)
 			}
 			else
 			{
+				check_dp(dp);
 				if (!(dpl = dp_list_add(&params.desync_profiles)))
 				{
 					DLOG_ERR("desync_profile_add: out of memory\n");
@@ -1971,18 +1984,18 @@ int main(int argc, char **argv)
 			anon_hl = anon_hl_exclude = NULL;
 			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 58: /* skip */
+		case 59: /* skip */
 			bSkip = true;
 			break;
 
-		case 59: /* filter-l3 */
+		case 60: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 60: /* filter-tcp */
+		case 61: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -1992,7 +2005,7 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_udp))
 				exit_clean(1);
 			break;
-		case 61: /* filter-udp */
+		case 62: /* filter-udp */
 			if (!parse_pf_list(optarg,&dp->pf_udp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
@@ -2002,14 +2015,14 @@ int main(int argc, char **argv)
 			if (!port_filters_deny_if_empty(&dp->pf_tcp))
 				exit_clean(1);
 			break;
-		case 62: /* filter-l7 */
+		case 63: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 63: /* ipset */
+		case 64: /* ipset */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
@@ -2017,7 +2030,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 64: /* ipset-ip */
+		case 65: /* ipset-ip */
 			if (bSkip) break;
 			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
 			{
@@ -2030,7 +2043,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 65: /* ipset-exclude */
+		case 66: /* ipset-exclude */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
@@ -2038,7 +2051,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 66: /* ipset-exclude-ip */
+		case 67: /* ipset-exclude-ip */
 			if (bSkip) break;
 			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
 			{
@@ -2054,28 +2067,28 @@ int main(int argc, char **argv)
 
 
 #ifdef __linux__
-		case 67: /* bind-fix4 */
+		case 68: /* bind-fix4 */
 			params.bind_fix4 = true;
 			break;
-		case 68: /* bind-fix6 */
+		case 69: /* bind-fix6 */
 			params.bind_fix6 = true;
 			break;
 #elif defined(__CYGWIN__)
-		case 67: /* wf-iface */
+		case 68: /* wf-iface */
 			if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
 			{
 				DLOG_ERR("bad value for --wf-iface\n");
 				exit_clean(1);
 			}
 			break;
-		case 68: /* wf-l3 */
+		case 69: /* wf-l3 */
 			if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
 			{
 				DLOG_ERR("bad value for --wf-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 69: /* wf-tcp */
+		case 70: /* wf-tcp */
 			hash_wf_tcp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
 				!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
@@ -2084,7 +2097,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 70: /* wf-udp */
+		case 71: /* wf-udp */
 			hash_wf_udp=hash_jen(optarg,strlen(optarg));
 			if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
 				!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
@@ -2093,7 +2106,7 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
-		case 71: /* wf-raw */
+		case 72: /* wf-raw */
 			hash_wf_raw=hash_jen(optarg,strlen(optarg));
 			if (optarg[0]=='@')
 			{
@@ -2107,11 +2120,11 @@ int main(int argc, char **argv)
 				windivert_filter[sizeof(windivert_filter) - 1] = '\0';
 			}
 			break;
-		case 72: /* wf-save */
+		case 73: /* wf-save */
 			strncpy(wf_save_file, optarg, sizeof(wf_save_file));
 			wf_save_file[sizeof(wf_save_file) - 1] = '\0';
 			break;
-		case 73: /* ssid-filter */
+		case 74: /* ssid-filter */
 			hash_ssid_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -2129,7 +2142,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 74: /* nlm-filter */
+		case 75: /* nlm-filter */
 			hash_nlm_filter=hash_jen(optarg,strlen(optarg));
 			{
 				char *e,*p = optarg;
@@ -2147,7 +2160,7 @@ int main(int argc, char **argv)
 				}
 			}
 			break;
-		case 75: /* nlm-list */
+		case 76: /* nlm-list */
 			if (!nlm_list(optarg && !strcmp(optarg,"all")))
 			{
 				DLOG_ERR("could not get list of NLM networks\n");
@@ -2164,6 +2177,8 @@ int main(int argc, char **argv)
 		dp_entry_destroy(dpl);
 		desync_profile_count--;
 	}
+	else
+		check_dp(dp);
 
 	// do not need args from file anymore
 #if !defined( __OpenBSD__) && !defined(__ANDROID__)
@@ -2250,9 +2265,9 @@ int main(int argc, char **argv)
 		if (dp->desync_ttl6 == 0xFF) dp->desync_ttl6=dp->desync_ttl;
 		if (!AUTOTTL_ENABLED(dp->desync_autottl6)) dp->desync_autottl6 = dp->desync_autottl;
 		if (AUTOTTL_ENABLED(dp->desync_autottl))
-			DLOG("[profile %d] autottl ipv4 %u:%u-%u\n",dp->n,dp->desync_autottl.delta,dp->desync_autottl.min,dp->desync_autottl.max);
+			DLOG("profile %d autottl ipv4 %u:%u-%u\n",dp->n,dp->desync_autottl.delta,dp->desync_autottl.min,dp->desync_autottl.max);
 		if (AUTOTTL_ENABLED(dp->desync_autottl6))
-			DLOG("[profile %d] autottl ipv6 %u:%u-%u\n",dp->n,dp->desync_autottl6.delta,dp->desync_autottl6.min,dp->desync_autottl6.max);
+			DLOG("profile %d autottl ipv6 %u:%u-%u\n",dp->n,dp->desync_autottl6.delta,dp->desync_autottl6.min,dp->desync_autottl6.max);
 		split_compat(dp);
 #ifndef __CYGWIN__
 		if (params.droproot && dp->hostlist_auto && chown(dp->hostlist_auto->filename, params.uid, -1))

nfq/params.h

@@ -20,8 +20,6 @@
 
 #define TLS_PARTIALS_ENABLE	true
 
-#define Q_RCVBUF	(128*1024)	// in bytes
-#define Q_SNDBUF	(64*1024)	// in bytes
 #define RAW_SNDBUF	(64*1024)	// in bytes
 
 #define Q_MAXLEN	1024		// in packets

nfq/protocol.c

@@ -2,6 +2,8 @@
 
 #include "protocol.h"
 #include "helpers.h"
+#include "params.h"
+
 #include <string.h>
 #include <ctype.h>
 #include <arpa/inet.h>
@@ -507,7 +509,7 @@ size_t TLSPos(uint8_t posmarker, int16_t pos, const uint8_t *data, size_t sz)
 		case PM_HOST_MIDSLD:
 		case PM_HOST_ENDSLD:
 		case PM_SNI_EXT:
-			if (TLSFindExt(data,sz,0,&ext,&elen,false))
+			if (TLSFindExt(data,sz,0,&ext,&elen,TLS_PARTIALS_ENABLE))
 			{
 				if (posmarker==PM_SNI_EXT)
 				{

nfq/sec.c

@@ -88,10 +88,6 @@ SYS_symlinkat,
 SYS_link,
 #endif
 SYS_linkat,
-#ifdef SYS_pkey_mprotect
-SYS_pkey_mprotect,
-#endif
-SYS_mprotect,
 SYS_truncate,
 #ifdef SYS_truncate64
 SYS_truncate64,

tpws/BSDmakefile

@@ -6,7 +6,7 @@ SRC_FILES = *.c
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 
 clean:
 	rm -f tpws *.o

tpws/Makefile

@@ -9,17 +9,17 @@ SRC_FILES_ANDROID = $(SRC_FILES) andr/*.c
 all: tpws
 
 tpws: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES) $(LIBS) $(LDFLAGS)
 
 android: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LDFLAGS) $(LIBS_ANDROID)
+	$(CC) -s $(CFLAGS) -o tpws $(SRC_FILES_ANDROID) $(LIBS_ANDROID) $(LDFLAGS)
 
 bsd: $(SRC_FILES)
-	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -o tpws $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 
 mac: $(SRC_FILES)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsa -target arm64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsa -target arm64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
-	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsx -target x86_64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LDFLAGS) $(LIBS)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -Iepoll-shim/include -Imacos -o tpwsx -target x86_64-apple-macos10.8 $(SRC_FILES) epoll-shim/src/*.c $(LIBS) $(LDFLAGS)
 	strip tpwsa tpwsx
 	lipo -create -output tpws tpwsx tpwsa
 	rm -f tpwsx tpwsa

tpws/helpers.c

@@ -12,10 +12,6 @@
 #include <libgen.h>
 #include <unistd.h>
 
-#ifdef __linux__
-#include <linux/tcp.h>
-#endif
-
 #ifdef __ANDROID__
 #include "andr/ifaddrs.h"
 #else
@@ -23,6 +19,10 @@
 #endif
 
 #include "helpers.h"
+#ifdef __linux__
+#include <linux/tcp.h>
+#endif
+#include "linux_compat.h"
 
 int unique_size_t(size_t *pu, int ct)
 {
@@ -481,7 +481,7 @@ void msleep(unsigned int ms)
 bool socket_supports_notsent()
 {
 	int sfd;
-	struct tcp_info tcpi;
+	struct tcp_info_new tcpi;
 
 	sfd = socket(AF_INET,SOCK_STREAM,0);
 	if (sfd<0) return false;
@@ -494,11 +494,11 @@ bool socket_supports_notsent()
 	}
 	close(sfd);
 
-	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi.tcpi_state + sizeof(tcpi.tcpi_notsent_bytes));
+	return ts>=((char *)&tcpi.tcpi_notsent_bytes - (char *)&tcpi + sizeof(tcpi.tcpi_notsent_bytes));
 }
 bool socket_has_notsent(int sfd)
 {
-	struct tcp_info tcpi;
+	struct tcp_info_new tcpi;
 	socklen_t ts = sizeof(tcpi);
 
 	if (getsockopt(sfd, IPPROTO_TCP, TCP_INFO, (char *)&tcpi, &ts) < 0)

tpws/linux_compat.h

@@ -0,0 +1,111 @@
+#ifdef __linux__
+
+#include <linux/types.h>
+
+#ifndef TCP_USER_TIMEOUT
+#define TCP_USER_TIMEOUT 18
+#endif
+
+#ifndef IP6T_SO_ORIGINAL_DST
+ #define IP6T_SO_ORIGINAL_DST 80
+#endif
+
+#ifndef PR_SET_NO_NEW_PRIVS
+ #define PR_SET_NO_NEW_PRIVS	38
+#endif
+
+// workaround for old headers
+
+struct tcp_info_new {
+	__u8    tcpi_state;
+	__u8    tcpi_ca_state;
+	__u8    tcpi_retransmits;
+	__u8    tcpi_probes;
+	__u8    tcpi_backoff;
+	__u8    tcpi_options;
+	__u8    tcpi_snd_wscale : 4, tcpi_rcv_wscale : 4;
+	__u8    tcpi_delivery_rate_app_limited : 1, tcpi_fastopen_client_fail : 2;
+
+	__u32   tcpi_rto;
+	__u32   tcpi_ato;
+	__u32   tcpi_snd_mss;
+	__u32   tcpi_rcv_mss;
+
+	__u32   tcpi_unacked;
+	__u32   tcpi_sacked;
+	__u32   tcpi_lost;
+	__u32   tcpi_retrans;
+	__u32   tcpi_fackets;
+
+	/* Times. */
+	__u32   tcpi_last_data_sent;
+	__u32   tcpi_last_ack_sent;     /* Not remembered, sorry. */
+	__u32   tcpi_last_data_recv;
+	__u32   tcpi_last_ack_recv;
+
+	/* Metrics. */
+	__u32   tcpi_pmtu;
+	__u32   tcpi_rcv_ssthresh;
+	__u32   tcpi_rtt;
+	__u32   tcpi_rttvar;
+	__u32   tcpi_snd_ssthresh;
+	__u32   tcpi_snd_cwnd;
+	__u32   tcpi_advmss;
+	__u32   tcpi_reordering;
+
+	__u32   tcpi_rcv_rtt;
+	__u32   tcpi_rcv_space;
+
+	__u32   tcpi_total_retrans;
+
+	__u64   tcpi_pacing_rate;
+	__u64   tcpi_max_pacing_rate;
+	__u64   tcpi_bytes_acked;    /* RFC4898 tcpEStatsAppHCThruOctetsAcked */
+	__u64   tcpi_bytes_received; /* RFC4898 tcpEStatsAppHCThruOctetsReceived */
+	__u32   tcpi_segs_out;       /* RFC4898 tcpEStatsPerfSegsOut */
+	__u32   tcpi_segs_in;        /* RFC4898 tcpEStatsPerfSegsIn */
+
+	__u32   tcpi_notsent_bytes;
+	__u32   tcpi_min_rtt;
+	__u32   tcpi_data_segs_in;      /* RFC4898 tcpEStatsDataSegsIn */
+	__u32   tcpi_data_segs_out;     /* RFC4898 tcpEStatsDataSegsOut */
+
+	__u64   tcpi_delivery_rate;
+
+	__u64   tcpi_busy_time;      /* Time (usec) busy sending data */
+	__u64   tcpi_rwnd_limited;   /* Time (usec) limited by receive window */
+	__u64   tcpi_sndbuf_limited; /* Time (usec) limited by send buffer */
+
+	__u32   tcpi_delivered;
+	__u32   tcpi_delivered_ce;
+
+	__u64   tcpi_bytes_sent;     /* RFC4898 tcpEStatsPerfHCDataOctetsOut */
+	__u64   tcpi_bytes_retrans;  /* RFC4898 tcpEStatsPerfOctetsRetrans */
+	__u32   tcpi_dsack_dups;     /* RFC4898 tcpEStatsStackDSACKDups */
+	__u32   tcpi_reord_seen;     /* reordering events seen */
+
+	__u32   tcpi_rcv_ooopack;    /* Out-of-order packets received */
+
+	__u32   tcpi_snd_wnd;        /* peer's advertised receive window after
+								  * scaling (bytes)
+								  */
+	__u32   tcpi_rcv_wnd;        /* local advertised receive window after
+								  * scaling (bytes)
+								  */
+
+	__u32   tcpi_rehash;         /* PLB or timeout triggered rehash attempts */
+
+	__u16   tcpi_total_rto; /* Total number of RTO timeouts, including
+							 * SYN/SYN-ACK and recurring timeouts.
+							 */
+	__u16   tcpi_total_rto_recoveries;      /* Total number of RTO
+											 * recoveries, including any
+											 * unfinished recovery.
+											 */
+	__u32   tcpi_total_rto_time;    /* Total time spent in RTO recoveries
+									 * in milliseconds, including any
+									 * unfinished recovery.
+									 */
+};
+
+#endif

tpws/params.h

@@ -18,7 +18,7 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 
-#define FIX_SEG_DEFAULT_MAX_WAIT		30
+#define FIX_SEG_DEFAULT_MAX_WAIT		50
 
 enum bindll { unwanted=0, no, prefer, force };
 

tpws/redirect.c

@@ -9,12 +9,10 @@
 
 #include "params.h"
 #include "helpers.h"
+#include "linux_compat.h"
 
 #ifdef __linux__
  #include <linux/netfilter_ipv4.h>
- #ifndef IP6T_SO_ORIGINAL_DST
-  #define IP6T_SO_ORIGINAL_DST 80
- #endif
 #endif
 
 

tpws/tpws.c

@@ -176,6 +176,7 @@ static void exithelp(void)
 		" --debug=0|1|2|syslog|@<filename>\t; 1 and 2 means log to console and set debug level. for other targets use --debug-level.\n"
 		" --debug-level=0|1|2\t\t\t; specify debug level\n"
 		" --dry-run\t\t\t\t; verify parameters and exit with code 0 if successful\n"
+		" --comment=any_text\n"
 		"\nMULTI-STRATEGY:\n"
 		" --new\t\t\t\t\t; begin new strategy\n"
 		" --skip\t\t\t\t\t; do not use this strategy\n"
@@ -669,21 +670,22 @@ void parse_params(int argc, char *argv[])
 		{ "debug",optional_argument,0,0 },// optidx=45
 		{ "debug-level",required_argument,0,0 },// optidx=46
 		{ "dry-run",no_argument,0,0 },// optidx=47
-		{ "local-rcvbuf",required_argument,0,0 },// optidx=48
+		{ "comment",optional_argument,0,0 },// optidx=48
-		{ "local-sndbuf",required_argument,0,0 },// optidx=49
+		{ "local-rcvbuf",required_argument,0,0 },// optidx=49
-		{ "remote-rcvbuf",required_argument,0,0 },// optidx=50
+		{ "local-sndbuf",required_argument,0,0 },// optidx=50
-		{ "remote-sndbuf",required_argument,0,0 },// optidx=51
+		{ "remote-rcvbuf",required_argument,0,0 },// optidx=51
-		{ "socks",no_argument,0,0 },// optidx=52
+		{ "remote-sndbuf",required_argument,0,0 },// optidx=52
-		{ "no-resolve",no_argument,0,0 },// optidx=53
+		{ "socks",no_argument,0,0 },// optidx=53
-		{ "resolver-threads",required_argument,0,0 },// optidx=54
+		{ "no-resolve",no_argument,0,0 },// optidx=54
-		{ "skip-nodelay",no_argument,0,0 },// optidx=55
+		{ "resolver-threads",required_argument,0,0 },// optidx=55
-		{ "tamper-start",required_argument,0,0 },// optidx=56
+		{ "skip-nodelay",no_argument,0,0 },// optidx=56
-		{ "tamper-cutoff",required_argument,0,0 },// optidx=57
+		{ "tamper-start",required_argument,0,0 },// optidx=57
-		{ "connect-bind-addr",required_argument,0,0 },// optidx=58
+		{ "tamper-cutoff",required_argument,0,0 },// optidx=58
+		{ "connect-bind-addr",required_argument,0,0 },// optidx=59
 
-		{ "new",no_argument,0,0 },				// optidx=59
+		{ "new",no_argument,0,0 },				// optidx=60
-		{ "skip",no_argument,0,0 },				// optidx=60
+		{ "skip",no_argument,0,0 },				// optidx=61
-		{ "filter-l3",required_argument,0,0 },			// optidx=61
+		{ "filter-l3",required_argument,0,0 },			// optidx=62
 		{ "filter-tcp",required_argument,0,0 },			// optidx=63
 		{ "filter-l7",required_argument,0,0 },			// optidx=64
 		{ "ipset",required_argument,0,0 },			// optidx=65
@@ -692,17 +694,17 @@ void parse_params(int argc, char *argv[])
 		{ "ipset-exclude-ip",required_argument,0,0 },		// optidx=68
 
 #if defined(__FreeBSD__)
-		{ "enable-pf",no_argument,0,0 },// optidx=68
+		{ "enable-pf",no_argument,0,0 },// optidx=69
 #elif defined(__APPLE__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=68
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=69
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=69
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=70
 #elif defined(__linux__)
-		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=68
+		{ "local-tcp-user-timeout",required_argument,0,0 },	// optidx=69
-		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=69
+		{ "remote-tcp-user-timeout",required_argument,0,0 },	// optidx=70
-		{ "mss",required_argument,0,0 },			// optidx=70
+		{ "mss",required_argument,0,0 },			// optidx=71
-		{ "fix-seg",optional_argument,0,0 },			// optidx=71
+		{ "fix-seg",optional_argument,0,0 },			// optidx=72
 #ifdef SPLICE_PRESENT
-		{ "nosplice",no_argument,0,0 },				// optidx=72
+		{ "nosplice",no_argument,0,0 },				// optidx=73
 #endif
 #endif
 		{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@@ -1153,41 +1155,43 @@ void parse_params(int argc, char *argv[])
 		case 47: /* dry-run */
 			bDry = true;
 			break;
-		case 48: /* local-rcvbuf */
+		case 48: /* comment */
+			break;
+		case 49: /* local-rcvbuf */
 #ifdef __linux__
 			params.local_rcvbuf = atoi(optarg)/2;
 #else
 			params.local_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 49: /* local-sndbuf */
+		case 50: /* local-sndbuf */
 #ifdef __linux__
 			params.local_sndbuf = atoi(optarg)/2;
 #else
 			params.local_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 50: /* remote-rcvbuf */
+		case 51: /* remote-rcvbuf */
 #ifdef __linux__
 			params.remote_rcvbuf = atoi(optarg)/2;
 #else
 			params.remote_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 51: /* remote-sndbuf */
+		case 52: /* remote-sndbuf */
 #ifdef __linux__
 			params.remote_sndbuf = atoi(optarg)/2;
 #else
 			params.remote_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 52: /* socks */
+		case 53: /* socks */
 			params.proxy_type = CONN_TYPE_SOCKS;
 			break;
-		case 53: /* no-resolve */
+		case 54: /* no-resolve */
 			params.no_resolve = true;
 			break;
-		case 54: /* resolver-threads */
+		case 55: /* resolver-threads */
 			params.resolver_threads = atoi(optarg);
 			if (params.resolver_threads<1 || params.resolver_threads>300)
 			{
@@ -1195,10 +1199,10 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 55: /* skip-nodelay */
+		case 56: /* skip-nodelay */
 			params.skip_nodelay = true;
 			break;
-		case 56: /* tamper-start */
+		case 57: /* tamper-start */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -1212,7 +1216,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 57: /* tamper-cutoff */
+		case 58: /* tamper-cutoff */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -1226,7 +1230,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper_lim = true;
 			break;
-		case 58: /* connect-bind-addr */
+		case 59: /* connect-bind-addr */
 			{
 				char *p = strchr(optarg,'%');
 				if (p) *p++=0;
@@ -1254,7 +1258,7 @@ void parse_params(int argc, char *argv[])
 			break;
 
 
-		case 59: /* new */
+		case 60: /* new */
 			if (bSkip)
 			{
 				dp_clear(dp);
@@ -1275,31 +1279,31 @@ void parse_params(int argc, char *argv[])
 			anon_hl = anon_hl_exclude = NULL;
 			anon_ips = anon_ips_exclude = NULL;
 			break;
-		case 60: /* skip */
+		case 61: /* skip */
 			bSkip = true;
 			break;
-		case 61: /* filter-l3 */
+		case 62: /* filter-l3 */
 			if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
 			{
 				DLOG_ERR("bad value for --filter-l3\n");
 				exit_clean(1);
 			}
 			break;
-		case 62: /* filter-tcp */
+		case 63: /* filter-tcp */
 			if (!parse_pf_list(optarg,&dp->pf_tcp))
 			{
 				DLOG_ERR("Invalid port filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 63: /* filter-l7 */
+		case 64: /* filter-l7 */
 			if (!parse_l7_list(optarg,&dp->filter_l7))
 			{
 				DLOG_ERR("Invalid l7 filter : %s\n",optarg);
 				exit_clean(1);
 			}
 			break;
-		case 64: /* ipset */
+		case 65: /* ipset */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, false, optarg))
 			{
@@ -1308,7 +1312,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 65: /* ipset-ip */
+		case 66: /* ipset-ip */
 			if (bSkip) break;
 			if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
 			{
@@ -1322,7 +1326,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 66: /* ipset-exclude */
+		case 67: /* ipset-exclude */
 			if (bSkip) break;
 			if (!RegisterIpset(dp, true, optarg))
 			{
@@ -1331,7 +1335,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 67: /* ipset-exclude-ip */
+		case 68: /* ipset-exclude-ip */
 			if (bSkip) break;
 			if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
 			{
@@ -1347,11 +1351,11 @@ void parse_params(int argc, char *argv[])
 			break;
 
 #if defined(__FreeBSD__)
-		case 68: /* enable-pf */
+		case 69: /* enable-pf */
 			params.pf_enable = true;
 			break;
 #elif defined(__linux__) || defined(__APPLE__)
-		case 68: /* local-tcp-user-timeout */
+		case 69: /* local-tcp-user-timeout */
 			params.tcp_user_timeout_local = atoi(optarg);
 			if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
 			{
@@ -1359,7 +1363,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 69: /* remote-tcp-user-timeout */
+		case 70: /* remote-tcp-user-timeout */
 			params.tcp_user_timeout_remote = atoi(optarg);
 			if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
 			{
@@ -1370,7 +1374,7 @@ void parse_params(int argc, char *argv[])
 #endif
 
 #if defined(__linux__)
-		case 70: /* mss */
+		case 71: /* mss */
 			// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
 			dp->mss = atoi(optarg);
 			if (dp->mss<88 || dp->mss>32767)
@@ -1379,7 +1383,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 71: /* fix-seg */
+		case 72: /* fix-seg */
 			if (!params.fix_seg_avail)
 			{
 				DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
@@ -1399,7 +1403,7 @@ void parse_params(int argc, char *argv[])
 				params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
 			break;
 #ifdef SPLICE_PRESENT
-		case 72: /* nosplice */
+		case 73: /* nosplice */
 			params.nosplice = true;
 			break;
 #endif

tpws/tpws_conn.c

@@ -23,6 +23,7 @@
 #include "socks.h"
 #include "helpers.h"
 #include "hostlist.h"
+#include "linux_compat.h"
 
 // keep separate legs counter. counting every time thousands of legs can consume cpu
 static int legs_local, legs_remote;