Commit 8b5c9514 authored by bol-van's avatar bol-van
Browse files

nfqws: ts fooling

parent 84e75b0f

nfq/darkmagic.c

+12 −8
Original line number Diff line number Diff line
@@ -118,6 +118,7 @@ static void fill_tcphdr( 
	uint16_t nsport, uint16_t ndport,

	uint16_t nwsize, uint8_t scale_factor,

	uint32_t *timestamps,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	uint16_t data_len)
@@ -165,13 +166,13 @@ static void fill_tcphdr( 
		*(uint32_t*)(tcpopt+t+14)=random();

		t+=18;

	}

	if (timestamps || (fooling & FOOL_TS))

	if (timestamps)

	{

		tcpopt[t] = 8; // kind

		tcpopt[t+1] = 10; // len

		// forge only TSecr if orig timestamp is present

		*(uint32_t*)(tcpopt+t+2) = timestamps ? timestamps[0] : -1;

		*(uint32_t*)(tcpopt+t+6) = (timestamps && !(fooling & FOOL_TS)) ? timestamps[1] : -1;

		memcpy(tcpopt+t+2,timestamps,8);

		// forge TSval, keep TSecr

		if (fooling & FOOL_TS) *(uint32_t*)(tcpopt+t+2) = net32_add(*(uint32_t*)(tcpopt+t+2),ts_increment);

		t+=10;

	}

	if (scale_factor!=SCALE_NONE)
@@ -242,6 +243,7 @@ bool prepare_tcp_segment4( 
	uint8_t tos,

	uint16_t ip_id,

	uint32_t fooling,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	const void *data, uint16_t len,
@@ -257,7 +259,7 @@ bool prepare_tcp_segment4( 
	uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen;



	fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, DF, ttl, tos, ip_id);

	fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len);

	fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,ts_increment,badseq_increment,badseq_ack_increment,len);



	memcpy(payload,data,len);

	tcp4_fix_checksum(tcp,ip_payload_len,&ip->ip_src,&ip->ip_dst);
@@ -279,6 +281,7 @@ bool prepare_tcp_segment6( 
	uint8_t ttl,

	uint32_t flow_label,

	uint32_t fooling,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	const void *data, uint16_t len,
@@ -343,7 +346,7 @@ bool prepare_tcp_segment6( 
	uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen;



	fill_ip6hdr(ip6, &src->sin6_addr, &dst->sin6_addr, ip_payload_len, proto, ttl, flow_label);

	fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin6_port,dst->sin6_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len);

	fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin6_port,dst->sin6_port,nwsize,scale_factor,timestamps,ts_increment,badseq_increment,badseq_ack_increment,len);



	memcpy(payload,data,len);

	tcp6_fix_checksum(tcp,transport_payload_len,&ip6->ip6_src,&ip6->ip6_dst);
@@ -368,15 +371,16 @@ bool prepare_tcp_segment( 
	uint16_t ip_id,

	uint32_t flow_label,

	uint32_t fooling,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	const void *data, uint16_t len,

	uint8_t *buf, size_t *buflen)

{

	return (src->sa_family==AF_INET && dst->sa_family==AF_INET) ?

		prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,DF,ttl,tos,ip_id,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :

		prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,DF,ttl,tos,ip_id,fooling,ts_increment,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :

		(src->sa_family==AF_INET6 && dst->sa_family==AF_INET6) ?

		prepare_tcp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,flow_label,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :

		prepare_tcp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,flow_label,fooling,ts_increment,badseq_increment,badseq_ack_increment,data,len,buf,buflen) :

		false;

}

nfq/darkmagic.h

+3 −0
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ bool prepare_tcp_segment4( 
	uint8_t tos,

	uint16_t ip_id,

	uint32_t fooling,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	const void *data, uint16_t len,
@@ -97,6 +98,7 @@ bool prepare_tcp_segment6( 
	uint8_t ttl,

	uint32_t flow_label,

	uint32_t fooling,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	const void *data, uint16_t len,
@@ -116,6 +118,7 @@ bool prepare_tcp_segment( 
	uint16_t ip_id,

	uint32_t flow_label,

	uint32_t fooling,

	uint32_t ts_increment,

	uint32_t badseq_increment,

	uint32_t badseq_ack_increment,

	const void *data, uint16_t len,

nfq/desync.c

+17 −17
Original line number Diff line number Diff line
@@ -981,7 +981,7 @@ static bool tcp_orig_send(uint8_t verdict, uint32_t fwmark, const char *ifout, c 
						flags_orig, sack, nmss,

						dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

						ip_has_df(dis->ip),ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

						dp->dup_fooling_mode,dp->dup_badseq_increment,dp->dup_badseq_ack_increment,

						dp->dup_fooling_mode,dp->dup_ts_increment,dp->dup_badseq_increment,dp->dup_badseq_ack_increment,

						dis->data_payload, dis->len_payload, pkt, &len))

				{

					DLOG_ERR("dup: packet reconstruct failed\n");
@@ -1326,7 +1326,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
			pkt1_len = sizeof(pkt1);

			if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_ACK, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, SCALE_NONE, timestamps,

				DF,ttl_orig,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),

				FOOL_NONE,0,0,NULL, 0, pkt1, &pkt1_len))

				FOOL_NONE,0,0,0,NULL, 0, pkt1, &pkt1_len))

			{

				DLOG_ERR("cannot prepare split SYNACK ACK part\n");

				goto send_orig;
@@ -1371,7 +1371,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					pkt1_len = sizeof(pkt1);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_SYN|TH_ACK, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

						DF,ttl_fake,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),

						dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

						dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

						NULL, 0, pkt1, &pkt1_len))

					{

						goto send_orig;
@@ -1395,7 +1395,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					pkt1_len = sizeof(pkt1);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, bSack, nmss, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

						DF,ttl_orig,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),

						0,0,0, dp->fake_syndata,dp->fake_syndata_size, pkt1,&pkt1_len))

						0,0,0,0, dp->fake_syndata,dp->fake_syndata_size, pkt1,&pkt1_len))

					{

						goto send_orig;

					}
@@ -1862,7 +1862,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
						pkt1_len = sizeof(pkt1);

						if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							fake_data, fake_item->size, pkt1, &pkt1_len))

						{

							reasm_orig_cancel(ctrack);
@@ -1886,7 +1886,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
				pkt1_len = sizeof(pkt1);

				if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_RST | (dp->desync_mode==DESYNC_RSTACK ? TH_ACK:0), false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

					DF,ttl_fake,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6),

					dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

					dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

					NULL, 0, pkt1, &pkt1_len))

				{

					reasm_orig_cancel(ctrack);
@@ -1914,7 +1914,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					pkt1_len = sizeof(pkt1);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

						DF,ttl_orig,0,0,IP6_FLOW(dis->ip6),

						fooling_orig,0,0,

						fooling_orig,0,0,0,

						dis->data_payload, dis->len_payload, pkt1, &pkt1_len))

					{

						goto send_orig;
@@ -1983,7 +1983,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
									net32_add(dis->tcp->th_seq,from-seqovl), dis->tcp->th_ack,

									dis->tcp->th_win, scale_factor, timestamps,

									DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

									fooling_orig,0,0,

									fooling_orig,0,0,0,

									seg, seg_len, pkt1, &pkt1_len))

								goto send_orig;

							ip_id=IP4_IP_ID_NEXT(ip_id);
@@ -2053,7 +2053,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
								net32_add(dis->tcp->th_seq,from-seqovl), dis->tcp->th_ack,

								dis->tcp->th_win, scale_factor, timestamps,

								DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

								fooling_orig,0,0,

								fooling_orig,0,0,0,

								seg, seg_len, pkt1, &pkt1_len))

							goto send_orig;

						ip_id=IP4_IP_ID_PREV(ip_id);
@@ -2112,7 +2112,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					fakeseg2_len = sizeof(fakeseg2);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							pat+split_pos, dis->len_payload-split_pos, fakeseg2, &fakeseg2_len))

						goto send_orig;

					ip_id=IP4_IP_ID_PREV(ip_id);
@@ -2124,7 +2124,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					pkt1_len = sizeof(pkt1);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq , split_pos - seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							seg, seg_len, pkt1, &pkt1_len))

						goto send_orig;

					ip_id=IP4_IP_ID_PREV(ip_id);
@@ -2144,7 +2144,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					seg_len = sizeof(fakeseg);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							pat, split_pos, fakeseg, &seg_len))

						goto send_orig;

					ip_id=IP4_IP_ID_PREV(ip_id);
@@ -2156,7 +2156,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					pkt1_len = sizeof(pkt1);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dis->data_payload, split_pos, pkt1, &pkt1_len))

						goto send_orig;

					ip_id=IP4_IP_ID_PREV(ip_id);
@@ -2192,7 +2192,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					fakeseg_len = sizeof(fakeseg);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							pat, split_pos, fakeseg, &fakeseg_len))

						goto send_orig;

					ip_id=IP4_IP_ID_NEXT(ip_id);
@@ -2228,7 +2228,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
						pkt1_len = sizeof(pkt1);

						if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,-seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

								DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

								fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

								fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

								seg, seg_len, pkt1, &pkt1_len))

							goto send_orig;

						ip_id=IP4_IP_ID_NEXT(ip_id);
@@ -2259,7 +2259,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					fakeseg_len = sizeof(fakeseg);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							pat+split_pos, dis->len_payload-split_pos, fakeseg, &fakeseg_len))

						goto send_orig;

					ip_id=IP4_IP_ID_NEXT(ip_id);
@@ -2271,7 +2271,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint 
					pkt1_len = sizeof(pkt1);

					if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps,

							DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6),

							fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment,

							dis->data_payload+split_pos, dis->len_payload-split_pos, pkt1, &pkt1_len))

						goto send_orig;

					ip_id=IP4_IP_ID_NEXT(ip_id);

nfq/nfqws.c

+29 −9
Original line number Diff line number Diff line
@@ -735,7 +735,7 @@ static bool parse_cutoff(const char *opt, unsigned int *value, char *mode) 
	*mode = (*opt=='n' || *opt=='d' || *opt=='s') ? *opt++ : 'n';

	return sscanf(opt, "%u", value)>0;

}

static bool parse_badseq_increment(const char *opt, uint32_t *value)

static bool parse_net32_signed(const char *opt, uint32_t *value)

{

	if (((opt[0]=='0' && opt[1]=='x') || (opt[0]=='-' && opt[1]=='0' && opt[2]=='x')) && sscanf(opt+2+(opt[0]=='-'), "%X", (int32_t*)value)>0)

	{
@@ -1579,7 +1579,8 @@ static void exithelp(void) 
		" --dup-ttl6=<int>\t\t\t\t; set ipv6 hop limit for dups. by default ttl value is used\n"

		" --dup-autottl=[<delta>[:<min>[-<max>]]|-]\t; auto ttl mode for both ipv4 and ipv6. default: %d:%u-%u\n"

		" --dup-autottl6=[<delta>[:<min>[-<max>]]|-]\t; overrides --dup-autottl for ipv6 only\n"

		" --dup-fooling=<mode>[,<mode>]\t\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack hopbyhop hopbyhop2\n"

		" --dup-fooling=<mode>[,<mode>]\t\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack ts hopbyhop hopbyhop2\n"

		" --dup-ts-increment=<int|0xHEX>\t\t\t; ts fooling TSval signed increment for dup. default %d\n"

		" --dup-badseq-increment=<int|0xHEX>\t\t; badseq fooling seq signed increment for dup. default %d\n"

		" --dup-badack-increment=<int|0xHEX>\t\t; badseq fooling ackseq signed increment for dup. default %d\n"

		" --dup-start=[n|d|s]N\t\t\t\t; apply dup to packet numbers (n, default), data packet numbers (d), relative sequence (s) greater or equal than N\n"
@@ -1601,7 +1602,7 @@ static void exithelp(void) 
		" --dpi-desync-ttl6=<int>\t\t\t; set ipv6 hop limit for fake packet. by default --dpi-desync-ttl value is used.\n"

		" --dpi-desync-autottl=[<delta>[:<min>[-<max>]]|-]  ; auto ttl mode for both ipv4 and ipv6. default: %d:%u-%u\n"

		" --dpi-desync-autottl6=[<delta>[:<min>[-<max>]]|-] ; overrides --dpi-desync-autottl for ipv6 only\n"

		" --dpi-desync-fooling=<mode>[,<mode>]\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack hopbyhop hopbyhop2\n"

		" --dpi-desync-fooling=<mode>[,<mode>]\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack ts hopbyhop hopbyhop2\n"

		" --dpi-desync-repeats=<N>\t\t\t; send every desync packet N times\n"

		" --dpi-desync-skip-nosni=0|1\t\t\t; 1(default)=do not act on ClientHello without SNI\n"

		" --dpi-desync-split-pos=N|-N|marker+N|marker-N\t; comma separated list of split positions\n"
@@ -1613,6 +1614,7 @@ static void exithelp(void) 
		" --dpi-desync-fakedsplit-pattern=<filename>|0xHEX ; fake pattern for fakedsplit/fakeddisorder\n"

		" --dpi-desync-ipfrag-pos-tcp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n"

		" --dpi-desync-ipfrag-pos-udp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n"

		" --dpi-desync-ts-increment=<int|0xHEX>\t\t; ts fooling TSval signed increment. default %d\n"

		" --dpi-desync-badseq-increment=<int|0xHEX>\t; badseq fooling seq signed increment. default %d\n"

		" --dpi-desync-badack-increment=<int|0xHEX>\t; badseq fooling ackseq signed increment. default %d\n"

		" --dpi-desync-any-protocol=0|1\t\t\t; 0(default)=desync only http and tls  1=desync any nonempty data packet\n"
@@ -1636,14 +1638,14 @@ static void exithelp(void) 
		HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT, HOSTLIST_AUTO_FAIL_TIME_DEFAULT, HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT,

		AUTOTTL_DEFAULT_ORIG_DELTA,AUTOTTL_DEFAULT_ORIG_MIN,AUTOTTL_DEFAULT_ORIG_MAX,

		AUTOTTL_DEFAULT_DUP_DELTA,AUTOTTL_DEFAULT_DUP_MIN,AUTOTTL_DEFAULT_DUP_MAX,

		BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT,

		TS_INCREMENT_DEFAULT, BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT,

#if defined(__linux__) || defined(SO_USER_COOKIE)

		DPI_DESYNC_FWMARK_DEFAULT,DPI_DESYNC_FWMARK_DEFAULT,

#endif

		AUTOTTL_DEFAULT_DESYNC_DELTA,AUTOTTL_DEFAULT_DESYNC_MIN,AUTOTTL_DEFAULT_DESYNC_MAX,

		DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_UDP_DEFAULT,

		DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_TCP_DEFAULT,

		BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT,

		TS_INCREMENT_DEFAULT, BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT,

		UDPLEN_INCREMENT_DEFAULT

	);

	exit(1);
@@ -1762,6 +1764,7 @@ enum opt_indices { 
	IDX_DUP_AUTOTTL,

	IDX_DUP_AUTOTTL6,

	IDX_DUP_FOOLING,

	IDX_DUP_TS_INCREMENT,

	IDX_DUP_BADSEQ_INCREMENT,

	IDX_DUP_BADACK_INCREMENT,

	IDX_DUP_REPLACE,
@@ -1788,6 +1791,7 @@ enum opt_indices { 
	IDX_DPI_DESYNC_FAKEDSPLIT_PATTERN,

	IDX_DPI_DESYNC_IPFRAG_POS_TCP,

	IDX_DPI_DESYNC_IPFRAG_POS_UDP,

	IDX_DPI_DESYNC_TS_INCREMENT,

	IDX_DPI_DESYNC_BADSEQ_INCREMENT,

	IDX_DPI_DESYNC_BADACK_INCREMENT,

	IDX_DPI_DESYNC_ANY_PROTOCOL,
@@ -1886,6 +1890,7 @@ static const struct option long_options[] = { 
	[IDX_DUP_AUTOTTL] = {"dup-autottl", optional_argument, 0, 0},

	[IDX_DUP_AUTOTTL6] = {"dup-autottl6", optional_argument, 0, 0},

	[IDX_DUP_FOOLING] = {"dup-fooling", required_argument, 0, 0},

	[IDX_DUP_TS_INCREMENT] = {"dup-ts-increment", required_argument, 0, 0},

	[IDX_DUP_BADSEQ_INCREMENT] = {"dup-badseq-increment", required_argument, 0, 0},

	[IDX_DUP_BADACK_INCREMENT] = {"dup-badack-increment", required_argument, 0, 0},

	[IDX_DUP_REPLACE] = {"dup-replace", optional_argument, 0, 0},
@@ -1912,6 +1917,7 @@ static const struct option long_options[] = { 
	[IDX_DPI_DESYNC_FAKEDSPLIT_PATTERN] = {"dpi-desync-fakedsplit-pattern", required_argument, 0, 0},

	[IDX_DPI_DESYNC_IPFRAG_POS_TCP] = {"dpi-desync-ipfrag-pos-tcp", required_argument, 0, 0},

	[IDX_DPI_DESYNC_IPFRAG_POS_UDP] = {"dpi-desync-ipfrag-pos-udp", required_argument, 0, 0},

	[IDX_DPI_DESYNC_TS_INCREMENT] = {"dpi-desync-ts-increment", required_argument, 0, 0},

	[IDX_DPI_DESYNC_BADSEQ_INCREMENT] = {"dpi-desync-badseq-increment", required_argument, 0, 0},

	[IDX_DPI_DESYNC_BADACK_INCREMENT] = {"dpi-desync-badack-increment", required_argument, 0, 0},

	[IDX_DPI_DESYNC_ANY_PROTOCOL] = {"dpi-desync-any-protocol", optional_argument, 0, 0},
@@ -2360,15 +2366,22 @@ int main(int argc, char **argv) 
				exit_clean(1);

			}

			break;

		case IDX_DUP_TS_INCREMENT:

			if (!parse_net32_signed(optarg,&dp->dup_ts_increment))

			{

				DLOG_ERR("dup-ts-increment should be signed decimal or signed 0xHEX\n");

				exit_clean(1);

			}

			break;

		case IDX_DUP_BADSEQ_INCREMENT:

			if (!parse_badseq_increment(optarg,&dp->dup_badseq_increment))

			if (!parse_net32_signed(optarg,&dp->dup_badseq_increment))

			{

				DLOG_ERR("dup-badseq-increment should be signed decimal or signed 0xHEX\n");

				exit_clean(1);

			}

			break;

		case IDX_DUP_BADACK_INCREMENT:

			if (!parse_badseq_increment(optarg,&dp->dup_badseq_ack_increment))

			if (!parse_net32_signed(optarg,&dp->dup_badseq_ack_increment))

			{

				DLOG_ERR("dup-badack-increment should be signed decimal or signed 0xHEX\n");

				exit_clean(1);
@@ -2559,15 +2572,22 @@ int main(int argc, char **argv) 
				exit_clean(1);

			}

			break;

		case IDX_DPI_DESYNC_TS_INCREMENT:

			if (!parse_net32_signed(optarg,&dp->desync_ts_increment))

			{

				DLOG_ERR("dpi-desync-ts-increment should be signed decimal or signed 0xHEX\n");

				exit_clean(1);

			}

			break;

		case IDX_DPI_DESYNC_BADSEQ_INCREMENT:

			if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment))

			if (!parse_net32_signed(optarg,&dp->desync_badseq_increment))

			{

				DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");

				exit_clean(1);

			}

			break;

		case IDX_DPI_DESYNC_BADACK_INCREMENT:

			if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment))

			if (!parse_net32_signed(optarg,&dp->desync_badseq_ack_increment))

			{

				DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");

				exit_clean(1);

nfq/params.c

+1 −0
Original line number Diff line number Diff line
@@ -227,6 +227,7 @@ void dp_init(struct desync_profile *dp) 
	dp->fake_syndata_size = 16;

	dp->wscale=-1; // default - dont change scale factor (client)

	dp->desync_ttl6 = dp->dup_ttl6 = dp->orig_mod_ttl6 = 0xFF; // unused

	dp->desync_ts_increment = dp->dup_ts_increment = TS_INCREMENT_DEFAULT;

	dp->desync_badseq_increment = dp->dup_badseq_increment = BADSEQ_INCREMENT_DEFAULT;

	dp->desync_badseq_ack_increment = dp->dup_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;

	dp->wssize_cutoff_mode = dp->desync_start_mode = dp->desync_cutoff_mode = dp->dup_start_mode = dp->dup_cutoff_mode = dp->orig_mod_start_mode = dp->orig_mod_cutoff_mode = 'n'; // packet number by default