diff --git a/nfq/desync.c b/nfq/desync.c index 3c6e8e9..4a2c073 100644 --- a/nfq/desync.c +++ b/nfq/desync.c @@ -1449,10 +1449,17 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint case DESYNC_FAKEDDISORDER: if (split_pos) { - uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100], fakeseg2[DPI_DESYNC_MAX_FAKE_LEN+100], *seg; + uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100], fakeseg2[DPI_DESYNC_MAX_FAKE_LEN+100], pat[DPI_DESYNC_MAX_FAKE_LEN], *seg; size_t seg_len,fakeseg2_len; unsigned int seqovl; + if (dis->len_payload>sizeof(pat)) + { + DLOG("packet is too large\n"); + return verdict; + } + fill_pattern(pat,dis->len_payload,dp->fsplit_pattern,sizeof(dp->fsplit_pattern)); + ip_id = IP4_IP_ID_FIX(dis->ip); if (seqovl_pos>=split_pos) @@ -1485,11 +1492,11 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, - zeropkt, dis->len_payload-split_pos, fakeseg2, &fakeseg2_len)) + pat+split_pos, dis->len_payload-split_pos, fakeseg2, &fakeseg2_len)) return verdict; ip_id=IP4_IP_ID_PREV(ip_id); DLOG("sending fake(1) 2nd out-of-order tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg2, fakeseg2_len)) return verdict; @@ -1509,7 +1516,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint ip_id=IP4_IP_ID_PREV(ip_id); DLOG("sending fake(2) 2nd out-of-order tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg2, fakeseg2_len)) return verdict; @@ -1517,11 +1524,11 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, - zeropkt, split_pos, fakeseg, &seg_len)) + pat, split_pos, fakeseg, &seg_len)) return verdict; ip_id=IP4_IP_ID_PREV(ip_id); DLOG("sending fake(1) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len)) return verdict; @@ -1539,7 +1546,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint if (dis->ip) ((struct ip*)fakeseg)->ip_id = ip_id; DLOG("sending fake(2) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len)) return verdict; @@ -1549,20 +1556,27 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint case DESYNC_FAKEDSPLIT: if (split_pos) { - uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100],ovlseg[DPI_DESYNC_MAX_FAKE_LEN+100], *seg; + uint8_t fakeseg[DPI_DESYNC_MAX_FAKE_LEN+100],ovlseg[DPI_DESYNC_MAX_FAKE_LEN+100],pat[DPI_DESYNC_MAX_FAKE_LEN], *seg; size_t fakeseg_len,seg_len; + if (dis->len_payload>sizeof(pat)) + { + DLOG("packet is too large\n"); + return verdict; + } + fill_pattern(pat,dis->len_payload,dp->fsplit_pattern,sizeof(dp->fsplit_pattern)); + ip_id = IP4_IP_ID_FIX(dis->ip); fakeseg_len = sizeof(fakeseg); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, - zeropkt, split_pos, fakeseg, &fakeseg_len)) + pat, split_pos, fakeseg, &fakeseg_len)) return verdict; ip_id=IP4_IP_ID_NEXT(ip_id); DLOG("sending fake(1) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len)) return verdict; @@ -1617,7 +1631,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint if (dis->ip) ((struct ip*)fakeseg)->ip_id = ip_id; ip_id=IP4_IP_ID_NEXT(ip_id); DLOG("sending fake(2) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len)) return verdict; @@ -1625,11 +1639,11 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, - zeropkt, dis->len_payload-split_pos, fakeseg, &fakeseg_len)) + pat+split_pos, dis->len_payload-split_pos, fakeseg, &fakeseg_len)) return verdict; ip_id=IP4_IP_ID_NEXT(ip_id); DLOG("sending fake(1) 2nd tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len)) return verdict; @@ -1648,7 +1662,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint if (dis->ip) ((struct ip*)fakeseg)->ip_id = ip_id; DLOG("sending fake(2) 2nd tcp segment %zu-%zu len=%zu : ",split_pos,dis->len_payload-1, dis->len_payload-split_pos); - hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n"); + hexdump_limited_dlog(pat+split_pos,dis->len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n"); if (!rawsend_rep(dp->desync_repeats,(struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len)) return verdict; diff --git a/nfq/nfqws.c b/nfq/nfqws.c index 0498a31..c5bc1e0 100644 --- a/nfq/nfqws.c +++ b/nfq/nfqws.c @@ -1110,6 +1110,7 @@ static void exithelp(void) "\t\t\t\t\t\t; fakedsplit/fakeddisorder use first l7-protocol-compatible parameter if present, first abs value otherwise\n" " --dpi-desync-split-seqovl=N|-N|marker+N|marker-N ; use sequence overlap before first sent original split segment\n" " --dpi-desync-split-seqovl-pattern=|0xHEX ; pattern for the fake part of overlap\n" + " --dpi-desync-fakedsplit-pattern=|0xHEX ; fake pattern for fakedsplit/fakeddisorder\n" " --dpi-desync-ipfrag-pos-tcp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n" " --dpi-desync-ipfrag-pos-udp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n" " --dpi-desync-badseq-increment=\t; badseq fooling seq signed increment. default %d\n" @@ -1307,55 +1308,56 @@ int main(int argc, char **argv) {"dpi-desync-split-tls",required_argument,0,0 },// optidx=26 {"dpi-desync-split-seqovl",required_argument,0,0 },// optidx=27 {"dpi-desync-split-seqovl-pattern",required_argument,0,0 },// optidx=28 - {"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=29 - {"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=30 - {"dpi-desync-badseq-increment",required_argument,0,0},// optidx=31 - {"dpi-desync-badack-increment",required_argument,0,0},// optidx=32 - {"dpi-desync-any-protocol",optional_argument,0,0},// optidx=33 - {"dpi-desync-fake-http",required_argument,0,0},// optidx=34 - {"dpi-desync-fake-tls",required_argument,0,0},// optidx=35 - {"dpi-desync-fake-unknown",required_argument,0,0},// optidx=36 - {"dpi-desync-fake-syndata",required_argument,0,0},// optidx=37 - {"dpi-desync-fake-quic",required_argument,0,0},// optidx=38 - {"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=39 - {"dpi-desync-fake-dht",required_argument,0,0},// optidx=40 - {"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=41 - {"dpi-desync-udplen-increment",required_argument,0,0},// optidx=42 - {"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=43 - {"dpi-desync-cutoff",required_argument,0,0},// optidx=44 - {"dpi-desync-start",required_argument,0,0},// optidx=45 - {"hostlist",required_argument,0,0}, // optidx=46 - {"hostlist-domains",required_argument,0,0},// optidx=47 - {"hostlist-exclude",required_argument,0,0}, // optidx=48 - {"hostlist-exclude-domains",required_argument,0,0},// optidx=49 - {"hostlist-auto",required_argument,0,0}, // optidx=50 - {"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=51 - {"hostlist-auto-fail-time",required_argument,0,0}, // optidx=52 - {"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=53 - {"hostlist-auto-debug",required_argument,0,0}, // optidx=54 - {"new",no_argument,0,0}, // optidx=55 - {"skip",no_argument,0,0}, // optidx=56 - {"filter-l3",required_argument,0,0}, // optidx=57 - {"filter-tcp",required_argument,0,0}, // optidx=58 - {"filter-udp",required_argument,0,0}, // optidx=59 - {"filter-l7",required_argument,0,0}, // optidx=60 - {"ipset",required_argument,0,0}, // optidx=61 - {"ipset-ip",required_argument,0,0}, // optidx=62 - {"ipset-exclude",required_argument,0,0},// optidx=63 - {"ipset-exclude-ip",required_argument,0,0}, // optidx=64 + {"dpi-desync-fakedsplit-pattern",required_argument,0,0 },// optidx=29 + {"dpi-desync-ipfrag-pos-tcp",required_argument,0,0},// optidx=30 + {"dpi-desync-ipfrag-pos-udp",required_argument,0,0},// optidx=31 + {"dpi-desync-badseq-increment",required_argument,0,0},// optidx=32 + {"dpi-desync-badack-increment",required_argument,0,0},// optidx=33 + {"dpi-desync-any-protocol",optional_argument,0,0},// optidx=34 + {"dpi-desync-fake-http",required_argument,0,0},// optidx=35 + {"dpi-desync-fake-tls",required_argument,0,0},// optidx=36 + {"dpi-desync-fake-unknown",required_argument,0,0},// optidx=37 + {"dpi-desync-fake-syndata",required_argument,0,0},// optidx=38 + {"dpi-desync-fake-quic",required_argument,0,0},// optidx=39 + {"dpi-desync-fake-wireguard",required_argument,0,0},// optidx=40 + {"dpi-desync-fake-dht",required_argument,0,0},// optidx=41 + {"dpi-desync-fake-unknown-udp",required_argument,0,0},// optidx=42 + {"dpi-desync-udplen-increment",required_argument,0,0},// optidx=43 + {"dpi-desync-udplen-pattern",required_argument,0,0},// optidx=44 + {"dpi-desync-cutoff",required_argument,0,0},// optidx=45 + {"dpi-desync-start",required_argument,0,0},// optidx=46 + {"hostlist",required_argument,0,0}, // optidx=47 + {"hostlist-domains",required_argument,0,0},// optidx=48 + {"hostlist-exclude",required_argument,0,0}, // optidx=49 + {"hostlist-exclude-domains",required_argument,0,0},// optidx=50 + {"hostlist-auto",required_argument,0,0}, // optidx=51 + {"hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=52 + {"hostlist-auto-fail-time",required_argument,0,0}, // optidx=53 + {"hostlist-auto-retrans-threshold",required_argument,0,0}, // optidx=54 + {"hostlist-auto-debug",required_argument,0,0}, // optidx=55 + {"new",no_argument,0,0}, // optidx=56 + {"skip",no_argument,0,0}, // optidx=57 + {"filter-l3",required_argument,0,0}, // optidx=58 + {"filter-tcp",required_argument,0,0}, // optidx=59 + {"filter-udp",required_argument,0,0}, // optidx=60 + {"filter-l7",required_argument,0,0}, // optidx=61 + {"ipset",required_argument,0,0}, // optidx=62 + {"ipset-ip",required_argument,0,0}, // optidx=63 + {"ipset-exclude",required_argument,0,0},// optidx=64 + {"ipset-exclude-ip",required_argument,0,0}, // optidx=65 #ifdef __linux__ - {"bind-fix4",no_argument,0,0}, // optidx=65 - {"bind-fix6",no_argument,0,0}, // optidx=66 + {"bind-fix4",no_argument,0,0}, // optidx=66 + {"bind-fix6",no_argument,0,0}, // optidx=67 #elif defined(__CYGWIN__) - {"wf-iface",required_argument,0,0}, // optidx=65 - {"wf-l3",required_argument,0,0}, // optidx=66 - {"wf-tcp",required_argument,0,0}, // optidx=67 - {"wf-udp",required_argument,0,0}, // optidx=68 - {"wf-raw",required_argument,0,0}, // optidx=69 - {"wf-save",required_argument,0,0}, // optidx=70 - {"ssid-filter",required_argument,0,0}, // optidx=71 - {"nlm-filter",required_argument,0,0}, // optidx=72 - {"nlm-list",optional_argument,0,0}, // optidx=73 + {"wf-iface",required_argument,0,0}, // optidx=66 + {"wf-l3",required_argument,0,0}, // optidx=67 + {"wf-tcp",required_argument,0,0}, // optidx=68 + {"wf-udp",required_argument,0,0}, // optidx=69 + {"wf-raw",required_argument,0,0}, // optidx=70 + {"wf-save",required_argument,0,0}, // optidx=71 + {"ssid-filter",required_argument,0,0}, // optidx=72 + {"nlm-filter",required_argument,0,0}, // optidx=73 + {"nlm-list",optional_argument,0,0}, // optidx=74 #endif {NULL,0,NULL,0} }; @@ -1693,7 +1695,15 @@ int main(int argc, char **argv) fill_pattern(dp->seqovl_pattern,sizeof(dp->seqovl_pattern),buf,sz); } break; - case 29: /* dpi-desync-ipfrag-pos-tcp */ + case 29: /* dpi-desync-fakedsplit-pattern */ + { + char buf[sizeof(dp->fsplit_pattern)]; + size_t sz=sizeof(buf); + load_file_or_exit(optarg,buf,&sz); + fill_pattern(dp->fsplit_pattern,sizeof(dp->fsplit_pattern),buf,sz); + } + break; + case 30: /* dpi-desync-ipfrag-pos-tcp */ if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_tcp)<1 || dp->desync_ipfrag_pos_tcp<1 || dp->desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN) { DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN); @@ -1705,7 +1715,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 30: /* dpi-desync-ipfrag-pos-udp */ + case 31: /* dpi-desync-ipfrag-pos-udp */ if (sscanf(optarg,"%u",&dp->desync_ipfrag_pos_udp)<1 || dp->desync_ipfrag_pos_udp<1 || dp->desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN) { DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN); @@ -1717,63 +1727,63 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 31: /* dpi-desync-badseq-increments */ + case 32: /* dpi-desync-badseq-increments */ if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment)) { DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n"); exit_clean(1); } break; - case 32: /* dpi-desync-badack-increment */ + case 33: /* dpi-desync-badack-increment */ if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment)) { DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n"); exit_clean(1); } break; - case 33: /* dpi-desync-any-protocol */ + case 34: /* dpi-desync-any-protocol */ dp->desync_any_proto = !optarg || atoi(optarg); break; - case 34: /* dpi-desync-fake-http */ + case 35: /* dpi-desync-fake-http */ dp->fake_http_size = sizeof(dp->fake_http); load_file_or_exit(optarg,dp->fake_http,&dp->fake_http_size); break; - case 35: /* dpi-desync-fake-tls */ + case 36: /* dpi-desync-fake-tls */ dp->fake_tls_size = sizeof(dp->fake_tls); load_file_or_exit(optarg,dp->fake_tls,&dp->fake_tls_size); break; - case 36: /* dpi-desync-fake-unknown */ + case 37: /* dpi-desync-fake-unknown */ dp->fake_unknown_size = sizeof(dp->fake_unknown); load_file_or_exit(optarg,dp->fake_unknown,&dp->fake_unknown_size); break; - case 37: /* dpi-desync-fake-syndata */ + case 38: /* dpi-desync-fake-syndata */ dp->fake_syndata_size = sizeof(dp->fake_syndata); load_file_or_exit(optarg,dp->fake_syndata,&dp->fake_syndata_size); break; - case 38: /* dpi-desync-fake-quic */ + case 39: /* dpi-desync-fake-quic */ dp->fake_quic_size = sizeof(dp->fake_quic); load_file_or_exit(optarg,dp->fake_quic,&dp->fake_quic_size); break; - case 39: /* dpi-desync-fake-wireguard */ + case 40: /* dpi-desync-fake-wireguard */ dp->fake_wg_size = sizeof(dp->fake_wg); load_file_or_exit(optarg,dp->fake_wg,&dp->fake_wg_size); break; - case 40: /* dpi-desync-fake-dht */ + case 41: /* dpi-desync-fake-dht */ dp->fake_dht_size = sizeof(dp->fake_dht); load_file_or_exit(optarg,dp->fake_dht,&dp->fake_dht_size); break; - case 41: /* dpi-desync-fake-unknown-udp */ + case 42: /* dpi-desync-fake-unknown-udp */ dp->fake_unknown_udp_size = sizeof(dp->fake_unknown_udp); load_file_or_exit(optarg,dp->fake_unknown_udp,&dp->fake_unknown_udp_size); break; - case 42: /* dpi-desync-udplen-increment */ + case 43: /* dpi-desync-udplen-increment */ if (sscanf(optarg,"%d",&dp->udplen_increment)<1 || dp->udplen_increment>0x7FFF || dp->udplen_increment<-0x8000) { DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n"); exit_clean(1); } break; - case 43: /* dpi-desync-udplen-pattern */ + case 44: /* dpi-desync-udplen-pattern */ { char buf[sizeof(dp->udplen_pattern)]; size_t sz=sizeof(buf); @@ -1781,21 +1791,21 @@ int main(int argc, char **argv) fill_pattern(dp->udplen_pattern,sizeof(dp->udplen_pattern),buf,sz); } break; - case 44: /* desync-cutoff */ + case 45: /* desync-cutoff */ if (!parse_cutoff(optarg, &dp->desync_cutoff, &dp->desync_cutoff_mode)) { DLOG_ERR("invalid desync-cutoff value\n"); exit_clean(1); } break; - case 45: /* desync-start */ + case 46: /* desync-start */ if (!parse_cutoff(optarg, &dp->desync_start, &dp->desync_start_mode)) { DLOG_ERR("invalid desync-start value\n"); exit_clean(1); } break; - case 46: /* hostlist */ + case 47: /* hostlist */ if (bSkip) break; if (!RegisterHostlist(dp, false, optarg)) { @@ -1803,7 +1813,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 47: /* hostlist-domains */ + case 48: /* hostlist-domains */ if (bSkip) break; if (!anon_hl && !(anon_hl=RegisterHostlist(dp, false, NULL))) { @@ -1816,7 +1826,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 48: /* hostlist-exclude */ + case 49: /* hostlist-exclude */ if (bSkip) break; if (!RegisterHostlist(dp, true, optarg)) { @@ -1824,7 +1834,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 49: /* hostlist-exclude-domains */ + case 50: /* hostlist-exclude-domains */ if (bSkip) break; if (!anon_hl_exclude && !(anon_hl_exclude=RegisterHostlist(dp, true, NULL))) { @@ -1837,7 +1847,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 50: /* hostlist-auto */ + case 51: /* hostlist-auto */ if (bSkip) break; if (dp->hostlist_auto) { @@ -1865,7 +1875,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 51: /* hostlist-auto-fail-threshold */ + case 52: /* hostlist-auto-fail-threshold */ dp->hostlist_auto_fail_threshold = (uint8_t)atoi(optarg); if (dp->hostlist_auto_fail_threshold<1 || dp->hostlist_auto_fail_threshold>20) { @@ -1873,7 +1883,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 52: /* hostlist-auto-fail-time */ + case 53: /* hostlist-auto-fail-time */ dp->hostlist_auto_fail_time = (uint8_t)atoi(optarg); if (dp->hostlist_auto_fail_time<1) { @@ -1881,7 +1891,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 53: /* hostlist-auto-retrans-threshold */ + case 54: /* hostlist-auto-retrans-threshold */ dp->hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg); if (dp->hostlist_auto_retrans_threshold<2 || dp->hostlist_auto_retrans_threshold>10) { @@ -1889,7 +1899,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 54: /* hostlist-auto-debug */ + case 55: /* hostlist-auto-debug */ { FILE *F = fopen(optarg,"a+t"); if (!F) @@ -1903,7 +1913,7 @@ int main(int argc, char **argv) } break; - case 55: /* new */ + case 56: /* new */ if (bSkip) { dp_clear(dp); @@ -1924,18 +1934,18 @@ int main(int argc, char **argv) anon_hl = anon_hl_exclude = NULL; anon_ips = anon_ips_exclude = NULL; break; - case 56: /* skip */ + case 57: /* skip */ bSkip = true; break; - case 57: /* filter-l3 */ + case 58: /* filter-l3 */ if (!wf_make_l3(optarg,&dp->filter_ipv4,&dp->filter_ipv6)) { DLOG_ERR("bad value for --filter-l3\n"); exit_clean(1); } break; - case 58: /* filter-tcp */ + case 59: /* filter-tcp */ if (!parse_pf_list(optarg,&dp->pf_tcp)) { DLOG_ERR("Invalid port filter : %s\n",optarg); @@ -1945,7 +1955,7 @@ int main(int argc, char **argv) if (!port_filters_deny_if_empty(&dp->pf_udp)) exit_clean(1); break; - case 59: /* filter-udp */ + case 60: /* filter-udp */ if (!parse_pf_list(optarg,&dp->pf_udp)) { DLOG_ERR("Invalid port filter : %s\n",optarg); @@ -1955,14 +1965,14 @@ int main(int argc, char **argv) if (!port_filters_deny_if_empty(&dp->pf_tcp)) exit_clean(1); break; - case 60: /* filter-l7 */ + case 61: /* filter-l7 */ if (!parse_l7_list(optarg,&dp->filter_l7)) { DLOG_ERR("Invalid l7 filter : %s\n",optarg); exit_clean(1); } break; - case 61: /* ipset */ + case 62: /* ipset */ if (bSkip) break; if (!RegisterIpset(dp, false, optarg)) { @@ -1970,7 +1980,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 62: /* ipset-ip */ + case 63: /* ipset-ip */ if (bSkip) break; if (!anon_ips && !(anon_ips=RegisterIpset(dp, false, NULL))) { @@ -1983,7 +1993,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 63: /* ipset-exclude */ + case 64: /* ipset-exclude */ if (bSkip) break; if (!RegisterIpset(dp, true, optarg)) { @@ -1991,7 +2001,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 64: /* ipset-exclude-ip */ + case 65: /* ipset-exclude-ip */ if (bSkip) break; if (!anon_ips_exclude && !(anon_ips_exclude=RegisterIpset(dp, true, NULL))) { @@ -2007,28 +2017,28 @@ int main(int argc, char **argv) #ifdef __linux__ - case 65: /* bind-fix4 */ + case 66: /* bind-fix4 */ params.bind_fix4 = true; break; - case 66: /* bind-fix6 */ + case 67: /* bind-fix6 */ params.bind_fix6 = true; break; #elif defined(__CYGWIN__) - case 65: /* wf-iface */ + case 66: /* wf-iface */ if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx)) { DLOG_ERR("bad value for --wf-iface\n"); exit_clean(1); } break; - case 66: /* wf-l3 */ + case 67: /* wf-l3 */ if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6)) { DLOG_ERR("bad value for --wf-l3\n"); exit_clean(1); } break; - case 67: /* wf-tcp */ + case 68: /* wf-tcp */ hash_wf_tcp=hash_jen(optarg,strlen(optarg)); if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) || !wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst))) @@ -2037,7 +2047,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 68: /* wf-udp */ + case 69: /* wf-udp */ hash_wf_udp=hash_jen(optarg,strlen(optarg)); if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) || !wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst))) @@ -2046,7 +2056,7 @@ int main(int argc, char **argv) exit_clean(1); } break; - case 69: /* wf-raw */ + case 70: /* wf-raw */ hash_wf_raw=hash_jen(optarg,strlen(optarg)); if (optarg[0]=='@') { @@ -2060,11 +2070,11 @@ int main(int argc, char **argv) windivert_filter[sizeof(windivert_filter) - 1] = '\0'; } break; - case 70: /* wf-save */ + case 71: /* wf-save */ strncpy(wf_save_file, optarg, sizeof(wf_save_file)); wf_save_file[sizeof(wf_save_file) - 1] = '\0'; break; - case 71: /* ssid-filter */ + case 72: /* ssid-filter */ hash_ssid_filter=hash_jen(optarg,strlen(optarg)); { char *e,*p = optarg; @@ -2082,7 +2092,7 @@ int main(int argc, char **argv) } } break; - case 72: /* nlm-filter */ + case 73: /* nlm-filter */ hash_nlm_filter=hash_jen(optarg,strlen(optarg)); { char *e,*p = optarg; @@ -2100,7 +2110,7 @@ int main(int argc, char **argv) } } break; - case 73: /* nlm-list */ + case 74: /* nlm-list */ if (!nlm_list(optarg && !strcmp(optarg,"all"))) { DLOG_ERR("could not get list of NLM networks\n"); diff --git a/nfq/params.h b/nfq/params.h index 4adc3e9..a7a24ff 100644 --- a/nfq/params.h +++ b/nfq/params.h @@ -68,7 +68,7 @@ struct desync_profile autottl desync_autottl, desync_autottl6; uint32_t desync_fooling_mode; uint32_t desync_badseq_increment, desync_badseq_ack_increment; - uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460]; + uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460],fsplit_pattern[1460]; uint8_t fake_unknown_udp[1472],udplen_pattern[1472],fake_quic[1472],fake_wg[1472],fake_dht[1472]; size_t fake_http_size,fake_tls_size,fake_quic_size,fake_wg_size,fake_dht_size,fake_unknown_size,fake_syndata_size,fake_unknown_udp_size; int udplen_increment;