mirrors/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2024-12-22 06:15:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

tpws: fixed ipset and hostlist

Browse Source
This commit is contained in:
bol-van 2024-11-24 16:02:51 +03:00
parent 16a9e3f9c9
commit 422faaa29c
6 changed files with 283 additions and 114 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
tpws/hostlist.c
View File

@ -24,7 +24,7 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
*hostlist = NULL; *hostlist = NULL;
return false; return false;
} }
(*ct)++; if (ct) (*ct)++;
} }
// advance to the next line // advance to the next line
for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++); for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
@ -32,6 +32,11 @@ static bool addpool(strpool **hostlist, char **s, const char *end, int *ct)
return true; return true;
} }
bool AppendHostlistItem(strpool **hostlist, char *s)
{
return addpool(hostlist,&s,s+strlen(s),NULL);
}
bool AppendHostList(strpool **hostlist, const char *filename) bool AppendHostList(strpool **hostlist, const char *filename)
{ {
char *p, *e, s[256], *zbuf; char *p, *e, s[256], *zbuf;
@ -98,21 +103,24 @@ bool AppendHostList(strpool **hostlist, const char *filename)
static bool LoadHostList(struct hostlist_file *hfile) static bool LoadHostList(struct hostlist_file *hfile)
{ {
time_t t = file_mod_time(hfile->filename); if (hfile->filename)
if (!t)
{
// stat() error
DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
return true;
}
if (t==hfile->mod_time) return true; // up to date
StrPoolDestroy(&hfile->hostlist);
if (!AppendHostList(&hfile->hostlist, hfile->filename))
{ {
time_t t = file_mod_time(hfile->filename);
if (!t)
{
// stat() error
DLOG_ERR("cannot access hostlist file '%s'. in-memory content remains unchanged.\n",hfile->filename);
return true;
}
if (t==hfile->mod_time) return true; // up to date
StrPoolDestroy(&hfile->hostlist); StrPoolDestroy(&hfile->hostlist);
return false; if (!AppendHostList(&hfile->hostlist, hfile->filename))
{
StrPoolDestroy(&hfile->hostlist);
return false;
}
hfile->mod_time=t;
} }
hfile->mod_time=t;
return true; return true;
} }
static bool LoadHostLists(struct hostlist_files_head *list) static bool LoadHostLists(struct hostlist_files_head *list)
@ -202,7 +210,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
LIST_FOREACH(item, hostlists_exclude, next) LIST_FOREACH(item, hostlists_exclude, next)
{ {
VPRINT("[%s] exclude ", item->hfile->filename); VPRINT("[%s] exclude ", item->hfile->filename ? item->hfile->filename : "fixed");
if (SearchHostList(item->hfile->hostlist, host)) if (SearchHostList(item->hfile->hostlist, host))
{ {
if (excluded) *excluded = true; if (excluded) *excluded = true;
@ -214,7 +222,7 @@ static bool HostlistCheck_(const struct hostlist_collection_head *hostlists, con
{ {
LIST_FOREACH(item, hostlists, next) LIST_FOREACH(item, hostlists, next)
{ {
VPRINT("[%s] include ", item->hfile->filename); VPRINT("[%s] include ", item->hfile->filename ? item->hfile->filename : "fixed");
if (SearchHostList(item->hfile->hostlist, host)) if (SearchHostList(item->hfile->hostlist, host))
return true; return true;
} }
@ -235,17 +243,29 @@ bool HostlistCheck(const struct desync_profile *dp, const char *host, bool *excl
static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename) static struct hostlist_file *RegisterHostlist_(struct hostlist_files_head *hostlists, struct hostlist_collection_head *hl_collection, const char *filename)
{ {
struct hostlist_file *hfile; struct hostlist_file *hfile;
if (!(hfile=hostlist_files_search(hostlists, filename)))
if (!(hfile=hostlist_files_add(hostlists, filename))) if (filename)
{
if (!(hfile=hostlist_files_search(hostlists, filename)))
if (!(hfile=hostlist_files_add(hostlists, filename)))
return NULL;
if (!hostlist_collection_search(hl_collection, filename))
if (!hostlist_collection_add(hl_collection, hfile))
return NULL;
}
else
{
if (!(hfile=hostlist_files_add(hostlists, NULL)))
return NULL; return NULL;
if (!hostlist_collection_search(hl_collection, filename))
if (!hostlist_collection_add(hl_collection, hfile)) if (!hostlist_collection_add(hl_collection, hfile))
return NULL; return NULL;
}
return hfile; return hfile;
} }
struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename) struct hostlist_file *RegisterHostlist(struct desync_profile *dp, bool bExclude, const char *filename)
{ {
if (!file_mod_time(filename)) if (filename && !file_mod_time(filename))
{ {
DLOG_ERR("cannot access hostlist file '%s'\n",filename); DLOG_ERR("cannot access hostlist file '%s'\n",filename);
return NULL; return NULL;
@ -265,15 +285,30 @@ void HostlistsDebug()
struct hostlist_item *hl_item; struct hostlist_item *hl_item;
LIST_FOREACH(hfile, &params.hostlists, next) LIST_FOREACH(hfile, &params.hostlists, next)
VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)"); {
if (hfile->filename)
VPRINT("hostlist file %s%s\n",hfile->filename,hfile->hostlist ? "" : " (empty)");
else
VPRINT("hostlist fixed%s\n",hfile->hostlist ? "" : " (empty)");
}
LIST_FOREACH(dpl, &params.desync_profiles, next) LIST_FOREACH(dpl, &params.desync_profiles, next)
{ {
LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next) LIST_FOREACH(hl_item, &dpl->dp.hl_collection, next)
if (hl_item->hfile!=dpl->dp.hostlist_auto) if (hl_item->hfile!=dpl->dp.hostlist_auto)
VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); {
if (hl_item->hfile->filename)
VPRINT("profile %d include hostlist %s%s\n",dpl->dp.n, hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
else
VPRINT("profile %d include fixed hostlist%s\n",dpl->dp.n, hl_item->hfile->hostlist ? "" : " (empty)");
}
LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next) LIST_FOREACH(hl_item, &dpl->dp.hl_collection_exclude, next)
VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)"); {
if (hl_item->hfile->filename)
VPRINT("profile %d exclude hostlist %s%s\n",dpl->dp.n,hl_item->hfile->filename,hl_item->hfile->hostlist ? "" : " (empty)");
else
VPRINT("profile %d exclude fixed hostlist%s\n",dpl->dp.n,hl_item->hfile->hostlist ? "" : " (empty)");
}
if (dpl->dp.hostlist_auto) if (dpl->dp.hostlist_auto)
VPRINT("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)"); VPRINT("profile %d auto hostlist %s%s\n",dpl->dp.n,dpl->dp.hostlist_auto->filename,dpl->dp.hostlist_auto->hostlist ? "" : " (empty)");
} }

1
tpws/hostlist.h
View File

@ -4,6 +4,7 @@
#include "pools.h" #include "pools.h"
#include "params.h" #include "params.h"
bool AppendHostlistItem(strpool **hostlist, char *s);
bool AppendHostList(strpool **hostlist, const char *filename); bool AppendHostList(strpool **hostlist, const char *filename);
bool LoadAllHostLists(); bool LoadAllHostLists();
bool NonEmptyHostlist(strpool **hostlist); bool NonEmptyHostlist(strpool **hostlist);

59
tpws/ipset.c
View File

@ -31,7 +31,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
ipsetDestroy(ips); ipsetDestroy(ips);
return false; return false;
} }
(*ct)++; if (ct) (*ct)++;
} }
else if (parse_cidr6(cidr,&c6)) else if (parse_cidr6(cidr,&c6))
{ {
@ -40,7 +40,7 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
ipsetDestroy(ips); ipsetDestroy(ips);
return false; return false;
} }
(*ct)++; if (ct) (*ct)++;
} }
else else
DLOG_ERR("bad ip or subnet : %s\n",cidr); DLOG_ERR("bad ip or subnet : %s\n",cidr);
@ -53,6 +53,11 @@ static bool addpool(ipset *ips, char **s, const char *end, int *ct)
} }
bool AppendIpsetItem(ipset *ips, char *ip)
{
return addpool(ips,&ip,ip+strlen(ip),NULL);
}
static bool AppendIpset(ipset *ips, const char *filename) static bool AppendIpset(ipset *ips, const char *filename)
{ {
char *p, *e, s[256], *zbuf; char *p, *e, s[256], *zbuf;
@ -119,21 +124,24 @@ static bool AppendIpset(ipset *ips, const char *filename)
static bool LoadIpset(struct ipset_file *hfile) static bool LoadIpset(struct ipset_file *hfile)
{ {
time_t t = file_mod_time(hfile->filename); if (hfile->filename)
if (!t)
{
// stat() error
DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
return true;
}
if (t==hfile->mod_time) return true; // up to date
ipsetDestroy(&hfile->ipset);
if (!AppendIpset(&hfile->ipset, hfile->filename))
{ {
time_t t = file_mod_time(hfile->filename);
if (!t)
{
// stat() error
DLOG_ERR("cannot access ipset file '%s'. in-memory content remains unchanged.\n",hfile->filename);
return true;
}
if (t==hfile->mod_time) return true; // up to date
ipsetDestroy(&hfile->ipset); ipsetDestroy(&hfile->ipset);
return false; if (!AppendIpset(&hfile->ipset, hfile->filename))
{
ipsetDestroy(&hfile->ipset);
return false;
}
hfile->mod_time=t;
} }
hfile->mod_time=t;
return true; return true;
} }
static bool LoadIpsets(struct ipset_files_head *list) static bool LoadIpsets(struct ipset_files_head *list)
@ -205,7 +213,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
LIST_FOREACH(item, ips_exclude, next) LIST_FOREACH(item, ips_exclude, next)
{ {
VPRINT("[%s] exclude ",item->hfile->filename); VPRINT("[%s] exclude ",item->hfile->filename ? item->hfile->filename : "fixed");
if (SearchIpset(&item->hfile->ipset, ipv4, ipv6)) if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
return false; return false;
} }
@ -214,7 +222,7 @@ static bool IpsetCheck_(const struct ipset_collection_head *ips, const struct ip
{ {
LIST_FOREACH(item, ips, next) LIST_FOREACH(item, ips, next)
{ {
VPRINT("[%s] include ",item->hfile->filename); VPRINT("[%s] include ",item->hfile->filename ? item->hfile->filename : "fixed");
if (SearchIpset(&item->hfile->ipset, ipv4, ipv6)) if (SearchIpset(&item->hfile->ipset, ipv4, ipv6))
return true; return true;
} }
@ -244,7 +252,7 @@ static struct ipset_file *RegisterIpset_(struct ipset_files_head *ipsets, struct
} }
struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename) struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename)
{ {
if (!file_mod_time(filename)) if (filename && !file_mod_time(filename))
{ {
DLOG_ERR("cannot access ipset file '%s'\n",filename); DLOG_ERR("cannot access ipset file '%s'\n",filename);
return NULL; return NULL;
@ -277,13 +285,24 @@ void IpsetsDebug()
struct ipset_item *ips_item; struct ipset_item *ips_item;
LIST_FOREACH(hfile, &params.ipsets, next) LIST_FOREACH(hfile, &params.ipsets, next)
VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset)); {
if (hfile->filename)
VPRINT("ipset file %s (%s)\n",hfile->filename,dbg_ipset_fill(&hfile->ipset));
else
VPRINT("ipset fixed (%s)\n",dbg_ipset_fill(&hfile->ipset));
}
LIST_FOREACH(dpl, &params.desync_profiles, next) LIST_FOREACH(dpl, &params.desync_profiles, next)
{ {
LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next) LIST_FOREACH(ips_item, &dpl->dp.ips_collection, next)
VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); if (ips_item->hfile->filename)
VPRINT("profile %d include ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
else
VPRINT("profile %d include fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next) LIST_FOREACH(ips_item, &dpl->dp.ips_collection_exclude, next)
VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset)); if (ips_item->hfile->filename)
VPRINT("profile %d exclude ipset %s (%s)\n",dpl->dp.n,ips_item->hfile->filename,dbg_ipset_fill(&ips_item->hfile->ipset));
else
VPRINT("profile %d exclude fixed ipset (%s)\n",dpl->dp.n,dbg_ipset_fill(&ips_item->hfile->ipset));
} }
} }

1
tpws/ipset.h
View File

@ -9,3 +9,4 @@ bool LoadAllIpsets();
bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6); bool IpsetCheck(const struct desync_profile *dp, const struct in_addr *ipv4, const struct in6_addr *ipv6);
struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename); struct ipset_file *RegisterIpset(struct desync_profile *dp, bool bExclude, const char *filename);
void IpsetsDebug(); void IpsetsDebug();
bool AppendIpsetItem(ipset *ips, char *ip);

12
tpws/pools.c
View File

@ -160,7 +160,7 @@ struct hostlist_file *hostlist_files_add(struct hostlist_files_head *head, const
struct hostlist_file *entry = malloc(sizeof(struct hostlist_file)); struct hostlist_file *entry = malloc(sizeof(struct hostlist_file));
if (entry) if (entry)
{ {
if (!(entry->filename = strdup(filename))) if (filename && !(entry->filename = strdup(filename)))
{ {
free(entry); free(entry);
return false; return false;
@ -192,7 +192,7 @@ struct hostlist_file *hostlist_files_search(struct hostlist_files_head *head, co
LIST_FOREACH(hfile, head, next) LIST_FOREACH(hfile, head, next)
{ {
if (!strcmp(hfile->filename,filename)) if (hfile->filename && !strcmp(hfile->filename,filename))
return hfile; return hfile;
} }
return NULL; return NULL;
@ -223,7 +223,7 @@ struct hostlist_item *hostlist_collection_search(struct hostlist_collection_head
LIST_FOREACH(item, head, next) LIST_FOREACH(item, head, next)
{ {
if (!strcmp(item->hfile->filename,filename)) if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
return item; return item;
} }
return NULL; return NULL;
@ -369,7 +369,7 @@ struct ipset_file *ipset_files_add(struct ipset_files_head *head, const char *fi
struct ipset_file *entry = malloc(sizeof(struct ipset_file)); struct ipset_file *entry = malloc(sizeof(struct ipset_file));
if (entry) if (entry)
{ {
if (!(entry->filename = strdup(filename))) if (filename && !(entry->filename = strdup(filename)))
{ {
free(entry); free(entry);
return false; return false;
@ -401,7 +401,7 @@ struct ipset_file *ipset_files_search(struct ipset_files_head *head, const char
LIST_FOREACH(hfile, head, next) LIST_FOREACH(hfile, head, next)
{ {
if (!strcmp(hfile->filename,filename)) if (hfile->filename && !strcmp(hfile->filename,filename))
return hfile; return hfile;
} }
return NULL; return NULL;
@ -432,7 +432,7 @@ struct ipset_item *ipset_collection_search(struct ipset_collection_head *head, c
LIST_FOREACH(item, head, next) LIST_FOREACH(item, head, next)
{ {
if (!strcmp(item->hfile->filename,filename)) if (item->hfile->filename && !strcmp(item->hfile->filename,filename))
return item; return item;
} }
return NULL; return NULL;

245
tpws/tpws.c
View File

@ -182,10 +182,14 @@ static void exithelp(void)
" --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n" " --filter-tcp=[~]port1[-port2]|*\t; TCP port filter. ~ means negation. multiple comma separated values allowed.\n"
" --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n" " --filter-l7=[http|tls|unknown]\t\t; L6-L7 protocol filter. multiple comma separated values allowed.\n"
" --ipset=<filename>\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n" " --ipset=<filename>\t\t\t; ipset include filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
" --ipset-ip=<ip_list>\t\t\t; comma separated fixed ip list\n"
" --ipset-exclude=<filename>\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n" " --ipset-exclude=<filename>\t\t; ipset exclude filter (one ip/CIDR per line, ipv4 and ipv6 accepted, gzip supported, multiple ipsets allowed)\n"
" --ipset-exclude-ip=<ip_list>\t\t; comma separated fixed ip list\n"
"\nHOSTLIST FILTER:\n" "\nHOSTLIST FILTER:\n"
" --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" " --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-domains=<domain_list>\t; comma separated fixed domain list\n"
" --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" " --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-exclude-domains=<domain_list> ; comma separated fixed domain list\n"
" --hostlist-auto=<filename>\t\t; detect DPI blocks and build hostlist automatically\n" " --hostlist-auto=<filename>\t\t; detect DPI blocks and build hostlist automatically\n"
" --hostlist-auto-fail-threshold=<int>\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n" " --hostlist-auto-fail-threshold=<int>\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
" --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n" " --hostlist-auto-fail-time=<int>\t; all failed attemps must be within these seconds (default : %d)\n"
@ -484,6 +488,46 @@ static bool parse_pf_list(char *opt, struct port_filters_head *pfl)
return true; return true;
} }
static bool parse_domain_list(char *opt, strpool **pp)
{
char *e,*p,c;
for (p=opt ; p ; )
{
if ((e = strchr(p,',')))
{
c=*e;
*e=0;
}
if (*p && !AppendHostlistItem(pp,p)) return false;
if (e) *e++=c;
p = e;
}
return true;
}
static bool parse_ip_list(char *opt, ipset *pp)
{
char *e,*p,c;
for (p=opt ; p ; )
{
if ((e = strchr(p,',')))
{
c=*e;
*e=0;
}
if (*p && !AppendIpsetItem(pp,p)) return false;
if (e) *e++=c;
p = e;
}
return true;
}
#if !defined( __OpenBSD__) && !defined(__ANDROID__) #if !defined( __OpenBSD__) && !defined(__ANDROID__)
// no static to not allow optimizer to inline this func (save stack) // no static to not allow optimizer to inline this func (save stack)
void config_from_file(const char *filename) void config_from_file(const char *filename)
@ -526,6 +570,8 @@ void parse_params(int argc, char *argv[])
int option_index = 0; int option_index = 0;
int v, i; int v, i;
bool bSkip=false; bool bSkip=false;
struct hostlist_file *anon_hl = NULL, *anon_hl_exclude = NULL;
struct ipset_file *anon_ips = NULL, *anon_ips_exclude = NULL;
memset(&params, 0, sizeof(params)); memset(&params, 0, sizeof(params));
params.maxconn = DEFAULT_MAX_CONN; params.maxconn = DEFAULT_MAX_CONN;
@ -611,46 +657,50 @@ void parse_params(int argc, char *argv[])
{ "tlsrec",required_argument,0,0 },// optidx=34 { "tlsrec",required_argument,0,0 },// optidx=34
{ "tlsrec-pos",required_argument,0,0 },// optidx=35 { "tlsrec-pos",required_argument,0,0 },// optidx=35
{ "hostlist",required_argument,0,0 },// optidx=36 { "hostlist",required_argument,0,0 },// optidx=36
{ "hostlist-exclude",required_argument,0,0 },// optidx=37 { "hostlist-domains",required_argument,0,0 },// optidx=37
{ "hostlist-auto",required_argument,0,0}, // optidx=38 { "hostlist-exclude",required_argument,0,0 },// optidx=38
{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=39 { "hostlist-exclude-domains",required_argument,0,0 },// optidx=39
{ "hostlist-auto-fail-time",required_argument,0,0}, // optidx=40 { "hostlist-auto",required_argument,0,0}, // optidx=40
{ "hostlist-auto-debug",required_argument,0,0}, // optidx=41 { "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=41
{ "pidfile",required_argument,0,0 },// optidx=42 { "hostlist-auto-fail-time",required_argument,0,0}, // optidx=42
{ "debug",optional_argument,0,0 },// optidx=43 { "hostlist-auto-debug",required_argument,0,0}, // optidx=43
{ "debug-level",required_argument,0,0 },// optidx=44 { "pidfile",required_argument,0,0 },// optidx=44
{ "local-rcvbuf",required_argument,0,0 },// optidx=45 { "debug",optional_argument,0,0 },// optidx=45
{ "local-sndbuf",required_argument,0,0 },// optidx=46 { "debug-level",required_argument,0,0 },// optidx=46
{ "remote-rcvbuf",required_argument,0,0 },// optidx=47 { "local-rcvbuf",required_argument,0,0 },// optidx=47
{ "remote-sndbuf",required_argument,0,0 },// optidx=48 { "local-sndbuf",required_argument,0,0 },// optidx=48
{ "socks",no_argument,0,0 },// optidx=40 { "remote-rcvbuf",required_argument,0,0 },// optidx=49
{ "no-resolve",no_argument,0,0 },// optidx=50 { "remote-sndbuf",required_argument,0,0 },// optidx=50
{ "resolver-threads",required_argument,0,0 },// optidx=51 { "socks",no_argument,0,0 },// optidx=51
{ "skip-nodelay",no_argument,0,0 },// optidx=52 { "no-resolve",no_argument,0,0 },// optidx=52
{ "tamper-start",required_argument,0,0 },// optidx=53 { "resolver-threads",required_argument,0,0 },// optidx=53
{ "tamper-cutoff",required_argument,0,0 },// optidx=54 { "skip-nodelay",no_argument,0,0 },// optidx=54
{ "connect-bind-addr",required_argument,0,0 },// optidx=55 { "tamper-start",required_argument,0,0 },// optidx=55
{ "tamper-cutoff",required_argument,0,0 },// optidx=56
{ "connect-bind-addr",required_argument,0,0 },// optidx=57
{ "new",no_argument,0,0 }, // optidx=56 { "new",no_argument,0,0 }, // optidx=58
{ "skip",no_argument,0,0 }, // optidx=57 { "skip",no_argument,0,0 }, // optidx=59
{ "filter-l3",required_argument,0,0 }, // optidx=58 { "filter-l3",required_argument,0,0 }, // optidx=60
{ "filter-tcp",required_argument,0,0 }, // optidx=59 { "filter-tcp",required_argument,0,0 }, // optidx=61
{ "filter-l7",required_argument,0,0 }, // optidx=60 { "filter-l7",required_argument,0,0 }, // optidx=62
{ "ipset",required_argument,0,0 }, // optidx=61 { "ipset",required_argument,0,0 }, // optidx=63
{ "ipset-exclude",required_argument,0,0 }, // optidx=62 { "ipset-ip",required_argument,0,0 }, // optidx=64
{ "ipset-exclude",required_argument,0,0 }, // optidx=65
{ "ipset-exclude-ip",required_argument,0,0 }, // optidx=66
#if defined(__FreeBSD__) #if defined(__FreeBSD__)
{ "enable-pf",no_argument,0,0 },// optidx=62 { "enable-pf",no_argument,0,0 },// optidx=67
#elif defined(__APPLE__) #elif defined(__APPLE__)
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63 { "local-tcp-user-timeout",required_argument,0,0 }, // optidx=67
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64 { "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=68
#elif defined(__linux__) #elif defined(__linux__)
{ "local-tcp-user-timeout",required_argument,0,0 }, // optidx=63 { "local-tcp-user-timeout",required_argument,0,0 }, // optidx=67
{ "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=64 { "remote-tcp-user-timeout",required_argument,0,0 }, // optidx=68
{ "mss",required_argument,0,0 }, // optidx=65 { "mss",required_argument,0,0 }, // optidx=69
{ "fix-seg",optional_argument,0,0 }, // optidx=66 { "fix-seg",optional_argument,0,0 }, // optidx=70
#ifdef SPLICE_PRESENT #ifdef SPLICE_PRESENT
{ "nosplice",no_argument,0,0 }, // optidx=67 { "nosplice",no_argument,0,0 }, // optidx=71
#endif #endif
#endif #endif
{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility { "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@ -948,6 +998,7 @@ void parse_params(int argc, char *argv[])
params.tamper = true; params.tamper = true;
break; break;
case 36: /* hostlist */ case 36: /* hostlist */
if (bSkip) break;
if (!RegisterHostlist(dp, false, optarg)) if (!RegisterHostlist(dp, false, optarg))
{ {
DLOG_ERR("failed to register hostlist '%s'\n", optarg); DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@ -955,7 +1006,22 @@ void parse_params(int argc, char *argv[])
} }
params.tamper = true; params.tamper = true;
break; break;
case 37: /* hostlist-exclude */ case 37: /* hostlist-domains */
if (bSkip) break;
if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL)))
{
DLOG_ERR("failed to register anonymous hostlist\n");
exit_clean(1);
}
if (!parse_domain_list(optarg, &anon_hl->hostlist))
{
DLOG_ERR("failed to add domains to anonymous hostlist\n");
exit_clean(1);
}
params.tamper = true;
break;
case 38: /* hostlist-exclude */
if (bSkip) break;
if (!RegisterHostlist(dp, true, optarg)) if (!RegisterHostlist(dp, true, optarg))
{ {
DLOG_ERR("failed to register hostlist '%s'\n", optarg); DLOG_ERR("failed to register hostlist '%s'\n", optarg);
@ -963,7 +1029,22 @@ void parse_params(int argc, char *argv[])
} }
params.tamper = true; params.tamper = true;
break; break;
case 38: /* hostlist-auto */ case 39: /* hostlist-exclude-domains */
if (bSkip) break;
if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL)))
{
DLOG_ERR("failed to register anonymous hostlist\n");
exit_clean(1);
}
if (!parse_domain_list(optarg, &anon_hl_exclude->hostlist))
{
DLOG_ERR("failed to add domains to anonymous hostlist\n");
exit_clean(1);
}
params.tamper = true;
break;
case 40: /* hostlist-auto */
if (bSkip) break;
if (dp->hostlist_auto) if (dp->hostlist_auto)
{ {
DLOG_ERR("only one auto hostlist per profile is supported\n"); DLOG_ERR("only one auto hostlist per profile is supported\n");
@ -991,7 +1072,7 @@ void parse_params(int argc, char *argv[])
} }
params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice. params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice.
break; break;
case 39: /* hostlist-auto-fail-threshold */ case 41: /* hostlist-auto-fail-threshold */
dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg); dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20) if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20)
{ {
@ -999,7 +1080,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1); exit_clean(1);
} }
break; break;
case 40: /* hostlist-auto-fail-time */ case 42: /* hostlist-auto-fail-time */
dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg); dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (dp->hostlist_auto_fail_time<1) if (dp->hostlist_auto_fail_time<1)
{ {
@ -1007,7 +1088,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1); exit_clean(1);
} }
break; break;
case 41: /* hostlist-auto-debug */ case 43: /* hostlist-auto-debug */
{ {
FILE *F = fopen(optarg,"a+t"); FILE *F = fopen(optarg,"a+t");
if (!F) if (!F)
@ -1020,11 +1101,11 @@ void parse_params(int argc, char *argv[])
params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0'; params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
} }
break; break;
case 42: /* pidfile */ case 44: /* pidfile */
strncpy(params.pidfile,optarg,sizeof(params.pidfile)); strncpy(params.pidfile,optarg,sizeof(params.pidfile));
params.pidfile[sizeof(params.pidfile)-1]='\0'; params.pidfile[sizeof(params.pidfile)-1]='\0';
break; break;
case 43: /* debug */ case 45: /* debug */
if (optarg) if (optarg)
{ {
if (*optarg=='@') if (*optarg=='@')
@ -1058,44 +1139,44 @@ void parse_params(int argc, char *argv[])
params.debug_target = LOG_TARGET_CONSOLE; params.debug_target = LOG_TARGET_CONSOLE;
} }
break; break;
case 44: /* debug-level */ case 46: /* debug-level */
params.debug = atoi(optarg); params.debug = atoi(optarg);
break; break;
case 45: /* local-rcvbuf */ case 47: /* local-rcvbuf */
#ifdef __linux__ #ifdef __linux__
params.local_rcvbuf = atoi(optarg)/2; params.local_rcvbuf = atoi(optarg)/2;
#else #else
params.local_rcvbuf = atoi(optarg); params.local_rcvbuf = atoi(optarg);
#endif #endif
break; break;
case 46: /* local-sndbuf */ case 48: /* local-sndbuf */
#ifdef __linux__ #ifdef __linux__
params.local_sndbuf = atoi(optarg)/2; params.local_sndbuf = atoi(optarg)/2;
#else #else
params.local_sndbuf = atoi(optarg); params.local_sndbuf = atoi(optarg);
#endif #endif
break; break;
case 47: /* remote-rcvbuf */ case 49: /* remote-rcvbuf */
#ifdef __linux__ #ifdef __linux__
params.remote_rcvbuf = atoi(optarg)/2; params.remote_rcvbuf = atoi(optarg)/2;
#else #else
params.remote_rcvbuf = atoi(optarg); params.remote_rcvbuf = atoi(optarg);
#endif #endif
break; break;
case 48: /* remote-sndbuf */ case 50: /* remote-sndbuf */
#ifdef __linux__ #ifdef __linux__
params.remote_sndbuf = atoi(optarg)/2; params.remote_sndbuf = atoi(optarg)/2;
#else #else
params.remote_sndbuf = atoi(optarg); params.remote_sndbuf = atoi(optarg);
#endif #endif
break; break;
case 49: /* socks */ case 51: /* socks */
params.proxy_type = CONN_TYPE_SOCKS; params.proxy_type = CONN_TYPE_SOCKS;
break; break;
case 50: /* no-resolve */ case 52: /* no-resolve */
params.no_resolve = true; params.no_resolve = true;
break; break;
case 51: /* resolver-threads */ case 53: /* resolver-threads */
params.resolver_threads = atoi(optarg); params.resolver_threads = atoi(optarg);
if (params.resolver_threads<1 || params.resolver_threads>300) if (params.resolver_threads<1 || params.resolver_threads>300)
{ {
@ -1103,10 +1184,10 @@ void parse_params(int argc, char *argv[])
exit_clean(1); exit_clean(1);
} }
break; break;
case 52: /* skip-nodelay */ case 54: /* skip-nodelay */
params.skip_nodelay = true; params.skip_nodelay = true;
break; break;
case 53: /* tamper-start */ case 55: /* tamper-start */
{ {
const char *p=optarg; const char *p=optarg;
if (*p=='n') if (*p=='n')
@ -1120,7 +1201,7 @@ void parse_params(int argc, char *argv[])
} }
params.tamper_lim = true; params.tamper_lim = true;
break; break;
case 54: /* tamper-cutoff */ case 56: /* tamper-cutoff */
{ {
const char *p=optarg; const char *p=optarg;
if (*p=='n') if (*p=='n')
@ -1134,7 +1215,7 @@ void parse_params(int argc, char *argv[])
} }
params.tamper_lim = true; params.tamper_lim = true;
break; break;
case 55: /* connect-bind-addr */ case 57: /* connect-bind-addr */
{ {
char *p = strchr(optarg,'%'); char *p = strchr(optarg,'%');
if (p) *p++=0; if (p) *p++=0;
@ -1162,7 +1243,7 @@ void parse_params(int argc, char *argv[])
break; break;
case 56: /* new */ case 58: /* new */
if (bSkip) if (bSkip)
{ {
dp_clear(dp); dp_clear(dp);
@ -1180,32 +1261,35 @@ void parse_params(int argc, char *argv[])
dp = &dpl->dp; dp = &dpl->dp;
dp->n = ++desync_profile_count; dp->n = ++desync_profile_count;
} }
anon_hl = anon_hl_exclude = NULL;
anon_ips = anon_ips_exclude = NULL;
break; break;
case 57: /* skip */ case 59: /* skip */
bSkip = true; bSkip = true;
break; break;
case 58: /* filter-l3 */ case 60: /* filter-l3 */
if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6)) if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6))
{ {
DLOG_ERR("bad value for --filter-l3\n"); DLOG_ERR("bad value for --filter-l3\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 59: /* filter-tcp */ case 61: /* filter-tcp */
if (!parse_pf_list(optarg,&dp->pf_tcp)) if (!parse_pf_list(optarg,&dp->pf_tcp))
{ {
DLOG_ERR("Invalid port filter : %s\n",optarg); DLOG_ERR("Invalid port filter : %s\n",optarg);
exit_clean(1); exit_clean(1);
} }
break; break;
case 60: /* filter-l7 */ case 62: /* filter-l7 */
if (!parse_l7_list(optarg,&dp->filter_l7)) if (!parse_l7_list(optarg,&dp->filter_l7))
{ {
DLOG_ERR("Invalid l7 filter : %s\n",optarg); DLOG_ERR("Invalid l7 filter : %s\n",optarg);
exit_clean(1); exit_clean(1);
} }
break; break;
case 61: /* ipset */ case 63: /* ipset */
if (bSkip) break;
if (!RegisterIpset(dp, false, optarg)) if (!RegisterIpset(dp, false, optarg))
{ {
DLOG_ERR("failed to register ipset '%s'\n", optarg); DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1213,7 +1297,22 @@ void parse_params(int argc, char *argv[])
} }
params.tamper = true; params.tamper = true;
break; break;
case 62: /* ipset-exclude */ case 64: /* ipset-ip */
if (bSkip) break;
if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL)))
{
DLOG_ERR("failed to register anonymous ipset\n");
exit_clean(1);
}
if (!parse_ip_list(optarg, &anon_ips->ipset))
{
DLOG_ERR("failed to add subnets to anonymous ipset\n");
exit_clean(1);
}
params.tamper = true;
break;
case 65: /* ipset-exclude */
if (bSkip) break;
if (!RegisterIpset(dp, true, optarg)) if (!RegisterIpset(dp, true, optarg))
{ {
DLOG_ERR("failed to register ipset '%s'\n", optarg); DLOG_ERR("failed to register ipset '%s'\n", optarg);
@ -1221,13 +1320,27 @@ void parse_params(int argc, char *argv[])
} }
params.tamper = true; params.tamper = true;
break; break;
case 66: /* ipset-exclude-ip */
if (bSkip) break;
if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL)))
{
DLOG_ERR("failed to register anonymous ipset\n");
exit_clean(1);
}
if (!parse_ip_list(optarg, &anon_ips_exclude->ipset))
{
DLOG_ERR("failed to add subnets to anonymous ipset\n");
exit_clean(1);
}
params.tamper = true;
break;
#if defined(__FreeBSD__) #if defined(__FreeBSD__)
case 63: /* enable-pf */ case 67: /* enable-pf */
params.pf_enable = true; params.pf_enable = true;
break; break;
#elif defined(__linux__) || defined(__APPLE__) #elif defined(__linux__) || defined(__APPLE__)
case 63: /* local-tcp-user-timeout */ case 67: /* local-tcp-user-timeout */
params.tcp_user_timeout_local = atoi(optarg); params.tcp_user_timeout_local = atoi(optarg);
if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400) if (params.tcp_user_timeout_local<0 || params.tcp_user_timeout_local>86400)
{ {
@ -1235,7 +1348,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1); exit_clean(1);
} }
break; break;
case 64: /* remote-tcp-user-timeout */ case 68: /* remote-tcp-user-timeout */
params.tcp_user_timeout_remote = atoi(optarg); params.tcp_user_timeout_remote = atoi(optarg);
if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400) if (params.tcp_user_timeout_remote<0 || params.tcp_user_timeout_remote>86400)
{ {
@ -1246,7 +1359,7 @@ void parse_params(int argc, char *argv[])
#endif #endif
#if defined(__linux__) #if defined(__linux__)
case 65: /* mss */ case 69: /* mss */
// this option does not work in any BSD and MacOS. OS may accept but it changes nothing // this option does not work in any BSD and MacOS. OS may accept but it changes nothing
dp->mss = atoi(optarg); dp->mss = atoi(optarg);
if (dp->mss<88 || dp->mss>32767) if (dp->mss<88 || dp->mss>32767)
@ -1255,7 +1368,7 @@ void parse_params(int argc, char *argv[])
exit_clean(1); exit_clean(1);
} }
break; break;
case 66: /* fix-seg */ case 70: /* fix-seg */
if (!params.fix_seg_avail) if (!params.fix_seg_avail)
{ {
DLOG_ERR("--fix-seg is supported since kernel 4.6\n"); DLOG_ERR("--fix-seg is supported since kernel 4.6\n");
@ -1275,7 +1388,7 @@ void parse_params(int argc, char *argv[])
params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT; params.fix_seg = FIX_SEG_DEFAULT_MAX_WAIT;
break; break;
#ifdef SPLICE_PRESENT #ifdef SPLICE_PRESENT
case 67: /* nosplice */ case 71: /* nosplice */
params.nosplice = true; params.nosplice = true;
break; break;
#endif #endif