From 8b5c95145155551adf8508e2921d7a967866b5cc Mon Sep 17 00:00:00 2001 From: bol-van Date: Thu, 31 Jul 2025 12:50:57 +0300 Subject: [PATCH] nfqws: ts fooling --- nfq/darkmagic.c | 20 ++++++++++++-------- nfq/darkmagic.h | 3 +++ nfq/desync.c | 34 +++++++++++++++++----------------- nfq/nfqws.c | 38 +++++++++++++++++++++++++++++--------- nfq/params.c | 1 + nfq/params.h | 6 ++++-- 6 files changed, 66 insertions(+), 36 deletions(-) diff --git a/nfq/darkmagic.c b/nfq/darkmagic.c index efb6765..8d71bf2 100644 --- a/nfq/darkmagic.c +++ b/nfq/darkmagic.c @@ -118,6 +118,7 @@ static void fill_tcphdr( uint16_t nsport, uint16_t ndport, uint16_t nwsize, uint8_t scale_factor, uint32_t *timestamps, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, uint16_t data_len) @@ -165,13 +166,13 @@ static void fill_tcphdr( *(uint32_t*)(tcpopt+t+14)=random(); t+=18; } - if (timestamps || (fooling & FOOL_TS)) + if (timestamps) { tcpopt[t] = 8; // kind tcpopt[t+1] = 10; // len - // forge only TSecr if orig timestamp is present - *(uint32_t*)(tcpopt+t+2) = timestamps ? timestamps[0] : -1; - *(uint32_t*)(tcpopt+t+6) = (timestamps && !(fooling & FOOL_TS)) ? timestamps[1] : -1; + memcpy(tcpopt+t+2,timestamps,8); + // forge TSval, keep TSecr + if (fooling & FOOL_TS) *(uint32_t*)(tcpopt+t+2) = net32_add(*(uint32_t*)(tcpopt+t+2),ts_increment); t+=10; } if (scale_factor!=SCALE_NONE) @@ -242,6 +243,7 @@ bool prepare_tcp_segment4( uint8_t tos, uint16_t ip_id, uint32_t fooling, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, const void *data, uint16_t len, @@ -257,7 +259,7 @@ bool prepare_tcp_segment4( uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen; fill_iphdr(ip, &src->sin_addr, &dst->sin_addr, pktlen, IPPROTO_TCP, DF, ttl, tos, ip_id); - fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len); + fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin_port,dst->sin_port,nwsize,scale_factor,timestamps,ts_increment,badseq_increment,badseq_ack_increment,len); memcpy(payload,data,len); tcp4_fix_checksum(tcp,ip_payload_len,&ip->ip_src,&ip->ip_dst); @@ -279,6 +281,7 @@ bool prepare_tcp_segment6( uint8_t ttl, uint32_t flow_label, uint32_t fooling, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, const void *data, uint16_t len, @@ -343,7 +346,7 @@ bool prepare_tcp_segment6( uint8_t *payload = (uint8_t*)(tcp+1)+tcpoptlen; fill_ip6hdr(ip6, &src->sin6_addr, &dst->sin6_addr, ip_payload_len, proto, ttl, flow_label); - fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin6_port,dst->sin6_port,nwsize,scale_factor,timestamps,badseq_increment,badseq_ack_increment,len); + fill_tcphdr(tcp,fooling,tcp_flags,sack,nmss,nseq,nack_seq,src->sin6_port,dst->sin6_port,nwsize,scale_factor,timestamps,ts_increment,badseq_increment,badseq_ack_increment,len); memcpy(payload,data,len); tcp6_fix_checksum(tcp,transport_payload_len,&ip6->ip6_src,&ip6->ip6_dst); @@ -368,15 +371,16 @@ bool prepare_tcp_segment( uint16_t ip_id, uint32_t flow_label, uint32_t fooling, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, const void *data, uint16_t len, uint8_t *buf, size_t *buflen) { return (src->sa_family==AF_INET && dst->sa_family==AF_INET) ? - prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,DF,ttl,tos,ip_id,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) : + prepare_tcp_segment4((struct sockaddr_in *)src,(struct sockaddr_in *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,DF,ttl,tos,ip_id,fooling,ts_increment,badseq_increment,badseq_ack_increment,data,len,buf,buflen) : (src->sa_family==AF_INET6 && dst->sa_family==AF_INET6) ? - prepare_tcp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,flow_label,fooling,badseq_increment,badseq_ack_increment,data,len,buf,buflen) : + prepare_tcp_segment6((struct sockaddr_in6 *)src,(struct sockaddr_in6 *)dst,tcp_flags,sack,nmss,nseq,nack_seq,nwsize,scale_factor,timestamps,ttl,flow_label,fooling,ts_increment,badseq_increment,badseq_ack_increment,data,len,buf,buflen) : false; } diff --git a/nfq/darkmagic.h b/nfq/darkmagic.h index 3f9eaa8..77515a5 100644 --- a/nfq/darkmagic.h +++ b/nfq/darkmagic.h @@ -81,6 +81,7 @@ bool prepare_tcp_segment4( uint8_t tos, uint16_t ip_id, uint32_t fooling, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, const void *data, uint16_t len, @@ -97,6 +98,7 @@ bool prepare_tcp_segment6( uint8_t ttl, uint32_t flow_label, uint32_t fooling, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, const void *data, uint16_t len, @@ -116,6 +118,7 @@ bool prepare_tcp_segment( uint16_t ip_id, uint32_t flow_label, uint32_t fooling, + uint32_t ts_increment, uint32_t badseq_increment, uint32_t badseq_ack_increment, const void *data, uint16_t len, diff --git a/nfq/desync.c b/nfq/desync.c index 97fe4f6..2bd0ab3 100644 --- a/nfq/desync.c +++ b/nfq/desync.c @@ -981,7 +981,7 @@ static bool tcp_orig_send(uint8_t verdict, uint32_t fwmark, const char *ifout, c flags_orig, sack, nmss, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, ip_has_df(dis->ip),ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - dp->dup_fooling_mode,dp->dup_badseq_increment,dp->dup_badseq_ack_increment, + dp->dup_fooling_mode,dp->dup_ts_increment,dp->dup_badseq_increment,dp->dup_badseq_ack_increment, dis->data_payload, dis->len_payload, pkt, &len)) { DLOG_ERR("dup: packet reconstruct failed\n"); @@ -1326,7 +1326,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_ACK, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, SCALE_NONE, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6), - FOOL_NONE,0,0,NULL, 0, pkt1, &pkt1_len)) + FOOL_NONE,0,0,0,NULL, 0, pkt1, &pkt1_len)) { DLOG_ERR("cannot prepare split SYNACK ACK part\n"); goto send_orig; @@ -1371,7 +1371,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_SYN|TH_ACK, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, NULL, 0, pkt1, &pkt1_len)) { goto send_orig; @@ -1395,7 +1395,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, bSack, nmss, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6), - 0,0,0, dp->fake_syndata,dp->fake_syndata_size, pkt1,&pkt1_len)) + 0,0,0,0, dp->fake_syndata,dp->fake_syndata_size, pkt1,&pkt1_len)) { goto send_orig; } @@ -1862,7 +1862,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, fake_data, fake_item->size, pkt1, &pkt1_len)) { reasm_orig_cancel(ctrack); @@ -1886,7 +1886,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, TH_RST | (dp->desync_mode==DESYNC_RSTACK ? TH_ACK:0), false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),IP4_IP_ID_FIX(dis->ip),IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, NULL, 0, pkt1, &pkt1_len)) { reasm_orig_cancel(ctrack); @@ -1914,7 +1914,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,0,0,IP6_FLOW(dis->ip6), - fooling_orig,0,0, + fooling_orig,0,0,0, dis->data_payload, dis->len_payload, pkt1, &pkt1_len)) { goto send_orig; @@ -1983,7 +1983,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint net32_add(dis->tcp->th_seq,from-seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - fooling_orig,0,0, + fooling_orig,0,0,0, seg, seg_len, pkt1, &pkt1_len)) goto send_orig; ip_id=IP4_IP_ID_NEXT(ip_id); @@ -2053,7 +2053,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint net32_add(dis->tcp->th_seq,from-seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - fooling_orig,0,0, + fooling_orig,0,0,0, seg, seg_len, pkt1, &pkt1_len)) goto send_orig; ip_id=IP4_IP_ID_PREV(ip_id); @@ -2112,7 +2112,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint fakeseg2_len = sizeof(fakeseg2); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, pat+split_pos, dis->len_payload-split_pos, fakeseg2, &fakeseg2_len)) goto send_orig; ip_id=IP4_IP_ID_PREV(ip_id); @@ -2124,7 +2124,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq , split_pos - seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, seg, seg_len, pkt1, &pkt1_len)) goto send_orig; ip_id=IP4_IP_ID_PREV(ip_id); @@ -2144,7 +2144,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint seg_len = sizeof(fakeseg); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, pat, split_pos, fakeseg, &seg_len)) goto send_orig; ip_id=IP4_IP_ID_PREV(ip_id); @@ -2156,7 +2156,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, dis->data_payload, split_pos, pkt1, &pkt1_len)) goto send_orig; ip_id=IP4_IP_ID_PREV(ip_id); @@ -2192,7 +2192,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint fakeseg_len = sizeof(fakeseg); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, dis->tcp->th_seq, dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, pat, split_pos, fakeseg, &fakeseg_len)) goto send_orig; ip_id=IP4_IP_ID_NEXT(ip_id); @@ -2228,7 +2228,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,-seqovl), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, seg, seg_len, pkt1, &pkt1_len)) goto send_orig; ip_id=IP4_IP_ID_NEXT(ip_id); @@ -2259,7 +2259,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint fakeseg_len = sizeof(fakeseg); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_fake,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - dp->desync_fooling_mode,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + dp->desync_fooling_mode,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, pat+split_pos, dis->len_payload-split_pos, fakeseg, &fakeseg_len)) goto send_orig; ip_id=IP4_IP_ID_NEXT(ip_id); @@ -2271,7 +2271,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint pkt1_len = sizeof(pkt1); if (!prepare_tcp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, flags_orig, false, 0, net32_add(dis->tcp->th_seq,split_pos), dis->tcp->th_ack, dis->tcp->th_win, scale_factor, timestamps, DF,ttl_orig,IP4_TOS(dis->ip),ip_id,IP6_FLOW(dis->ip6), - fooling_orig,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, + fooling_orig,dp->desync_ts_increment,dp->desync_badseq_increment,dp->desync_badseq_ack_increment, dis->data_payload+split_pos, dis->len_payload-split_pos, pkt1, &pkt1_len)) goto send_orig; ip_id=IP4_IP_ID_NEXT(ip_id); diff --git a/nfq/nfqws.c b/nfq/nfqws.c index 9d44782..ce4e1f9 100644 --- a/nfq/nfqws.c +++ b/nfq/nfqws.c @@ -735,7 +735,7 @@ static bool parse_cutoff(const char *opt, unsigned int *value, char *mode) *mode = (*opt=='n' || *opt=='d' || *opt=='s') ? *opt++ : 'n'; return sscanf(opt, "%u", value)>0; } -static bool parse_badseq_increment(const char *opt, uint32_t *value) +static bool parse_net32_signed(const char *opt, uint32_t *value) { if (((opt[0]=='0' && opt[1]=='x') || (opt[0]=='-' && opt[1]=='0' && opt[2]=='x')) && sscanf(opt+2+(opt[0]=='-'), "%X", (int32_t*)value)>0) { @@ -1579,7 +1579,8 @@ static void exithelp(void) " --dup-ttl6=\t\t\t\t; set ipv6 hop limit for dups. by default ttl value is used\n" " --dup-autottl=[[:[-]]|-]\t; auto ttl mode for both ipv4 and ipv6. default: %d:%u-%u\n" " --dup-autottl6=[[:[-]]|-]\t; overrides --dup-autottl for ipv6 only\n" - " --dup-fooling=[,]\t\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack hopbyhop hopbyhop2\n" + " --dup-fooling=[,]\t\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack ts hopbyhop hopbyhop2\n" + " --dup-ts-increment=\t\t\t; ts fooling TSval signed increment for dup. default %d\n" " --dup-badseq-increment=\t\t; badseq fooling seq signed increment for dup. default %d\n" " --dup-badack-increment=\t\t; badseq fooling ackseq signed increment for dup. default %d\n" " --dup-start=[n|d|s]N\t\t\t\t; apply dup to packet numbers (n, default), data packet numbers (d), relative sequence (s) greater or equal than N\n" @@ -1601,7 +1602,7 @@ static void exithelp(void) " --dpi-desync-ttl6=\t\t\t; set ipv6 hop limit for fake packet. by default --dpi-desync-ttl value is used.\n" " --dpi-desync-autottl=[[:[-]]|-] ; auto ttl mode for both ipv4 and ipv6. default: %d:%u-%u\n" " --dpi-desync-autottl6=[[:[-]]|-] ; overrides --dpi-desync-autottl for ipv6 only\n" - " --dpi-desync-fooling=[,]\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack hopbyhop hopbyhop2\n" + " --dpi-desync-fooling=[,]\t\t; can use multiple comma separated values. modes : none md5sig badseq badsum datanoack ts hopbyhop hopbyhop2\n" " --dpi-desync-repeats=\t\t\t; send every desync packet N times\n" " --dpi-desync-skip-nosni=0|1\t\t\t; 1(default)=do not act on ClientHello without SNI\n" " --dpi-desync-split-pos=N|-N|marker+N|marker-N\t; comma separated list of split positions\n" @@ -1613,6 +1614,7 @@ static void exithelp(void) " --dpi-desync-fakedsplit-pattern=|0xHEX ; fake pattern for fakedsplit/fakeddisorder\n" " --dpi-desync-ipfrag-pos-tcp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n" " --dpi-desync-ipfrag-pos-udp=<8..%u>\t\t; ip frag position starting from the transport header. multiple of 8, default %u.\n" + " --dpi-desync-ts-increment=\t\t; ts fooling TSval signed increment. default %d\n" " --dpi-desync-badseq-increment=\t; badseq fooling seq signed increment. default %d\n" " --dpi-desync-badack-increment=\t; badseq fooling ackseq signed increment. default %d\n" " --dpi-desync-any-protocol=0|1\t\t\t; 0(default)=desync only http and tls 1=desync any nonempty data packet\n" @@ -1636,14 +1638,14 @@ static void exithelp(void) HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT, HOSTLIST_AUTO_FAIL_TIME_DEFAULT, HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT, AUTOTTL_DEFAULT_ORIG_DELTA,AUTOTTL_DEFAULT_ORIG_MIN,AUTOTTL_DEFAULT_ORIG_MAX, AUTOTTL_DEFAULT_DUP_DELTA,AUTOTTL_DEFAULT_DUP_MIN,AUTOTTL_DEFAULT_DUP_MAX, - BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT, + TS_INCREMENT_DEFAULT, BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT, #if defined(__linux__) || defined(SO_USER_COOKIE) DPI_DESYNC_FWMARK_DEFAULT,DPI_DESYNC_FWMARK_DEFAULT, #endif AUTOTTL_DEFAULT_DESYNC_DELTA,AUTOTTL_DEFAULT_DESYNC_MIN,AUTOTTL_DEFAULT_DESYNC_MAX, DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_UDP_DEFAULT, DPI_DESYNC_MAX_FAKE_LEN, IPFRAG_TCP_DEFAULT, - BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT, + TS_INCREMENT_DEFAULT, BADSEQ_INCREMENT_DEFAULT, BADSEQ_ACK_INCREMENT_DEFAULT, UDPLEN_INCREMENT_DEFAULT ); exit(1); @@ -1762,6 +1764,7 @@ enum opt_indices { IDX_DUP_AUTOTTL, IDX_DUP_AUTOTTL6, IDX_DUP_FOOLING, + IDX_DUP_TS_INCREMENT, IDX_DUP_BADSEQ_INCREMENT, IDX_DUP_BADACK_INCREMENT, IDX_DUP_REPLACE, @@ -1788,6 +1791,7 @@ enum opt_indices { IDX_DPI_DESYNC_FAKEDSPLIT_PATTERN, IDX_DPI_DESYNC_IPFRAG_POS_TCP, IDX_DPI_DESYNC_IPFRAG_POS_UDP, + IDX_DPI_DESYNC_TS_INCREMENT, IDX_DPI_DESYNC_BADSEQ_INCREMENT, IDX_DPI_DESYNC_BADACK_INCREMENT, IDX_DPI_DESYNC_ANY_PROTOCOL, @@ -1886,6 +1890,7 @@ static const struct option long_options[] = { [IDX_DUP_AUTOTTL] = {"dup-autottl", optional_argument, 0, 0}, [IDX_DUP_AUTOTTL6] = {"dup-autottl6", optional_argument, 0, 0}, [IDX_DUP_FOOLING] = {"dup-fooling", required_argument, 0, 0}, + [IDX_DUP_TS_INCREMENT] = {"dup-ts-increment", required_argument, 0, 0}, [IDX_DUP_BADSEQ_INCREMENT] = {"dup-badseq-increment", required_argument, 0, 0}, [IDX_DUP_BADACK_INCREMENT] = {"dup-badack-increment", required_argument, 0, 0}, [IDX_DUP_REPLACE] = {"dup-replace", optional_argument, 0, 0}, @@ -1912,6 +1917,7 @@ static const struct option long_options[] = { [IDX_DPI_DESYNC_FAKEDSPLIT_PATTERN] = {"dpi-desync-fakedsplit-pattern", required_argument, 0, 0}, [IDX_DPI_DESYNC_IPFRAG_POS_TCP] = {"dpi-desync-ipfrag-pos-tcp", required_argument, 0, 0}, [IDX_DPI_DESYNC_IPFRAG_POS_UDP] = {"dpi-desync-ipfrag-pos-udp", required_argument, 0, 0}, + [IDX_DPI_DESYNC_TS_INCREMENT] = {"dpi-desync-ts-increment", required_argument, 0, 0}, [IDX_DPI_DESYNC_BADSEQ_INCREMENT] = {"dpi-desync-badseq-increment", required_argument, 0, 0}, [IDX_DPI_DESYNC_BADACK_INCREMENT] = {"dpi-desync-badack-increment", required_argument, 0, 0}, [IDX_DPI_DESYNC_ANY_PROTOCOL] = {"dpi-desync-any-protocol", optional_argument, 0, 0}, @@ -2360,15 +2366,22 @@ int main(int argc, char **argv) exit_clean(1); } break; + case IDX_DUP_TS_INCREMENT: + if (!parse_net32_signed(optarg,&dp->dup_ts_increment)) + { + DLOG_ERR("dup-ts-increment should be signed decimal or signed 0xHEX\n"); + exit_clean(1); + } + break; case IDX_DUP_BADSEQ_INCREMENT: - if (!parse_badseq_increment(optarg,&dp->dup_badseq_increment)) + if (!parse_net32_signed(optarg,&dp->dup_badseq_increment)) { DLOG_ERR("dup-badseq-increment should be signed decimal or signed 0xHEX\n"); exit_clean(1); } break; case IDX_DUP_BADACK_INCREMENT: - if (!parse_badseq_increment(optarg,&dp->dup_badseq_ack_increment)) + if (!parse_net32_signed(optarg,&dp->dup_badseq_ack_increment)) { DLOG_ERR("dup-badack-increment should be signed decimal or signed 0xHEX\n"); exit_clean(1); @@ -2559,15 +2572,22 @@ int main(int argc, char **argv) exit_clean(1); } break; + case IDX_DPI_DESYNC_TS_INCREMENT: + if (!parse_net32_signed(optarg,&dp->desync_ts_increment)) + { + DLOG_ERR("dpi-desync-ts-increment should be signed decimal or signed 0xHEX\n"); + exit_clean(1); + } + break; case IDX_DPI_DESYNC_BADSEQ_INCREMENT: - if (!parse_badseq_increment(optarg,&dp->desync_badseq_increment)) + if (!parse_net32_signed(optarg,&dp->desync_badseq_increment)) { DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n"); exit_clean(1); } break; case IDX_DPI_DESYNC_BADACK_INCREMENT: - if (!parse_badseq_increment(optarg,&dp->desync_badseq_ack_increment)) + if (!parse_net32_signed(optarg,&dp->desync_badseq_ack_increment)) { DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n"); exit_clean(1); diff --git a/nfq/params.c b/nfq/params.c index aa9b984..df9c133 100644 --- a/nfq/params.c +++ b/nfq/params.c @@ -227,6 +227,7 @@ void dp_init(struct desync_profile *dp) dp->fake_syndata_size = 16; dp->wscale=-1; // default - dont change scale factor (client) dp->desync_ttl6 = dp->dup_ttl6 = dp->orig_mod_ttl6 = 0xFF; // unused + dp->desync_ts_increment = dp->dup_ts_increment = TS_INCREMENT_DEFAULT; dp->desync_badseq_increment = dp->dup_badseq_increment = BADSEQ_INCREMENT_DEFAULT; dp->desync_badseq_ack_increment = dp->dup_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT; dp->wssize_cutoff_mode = dp->desync_start_mode = dp->desync_cutoff_mode = dp->dup_start_mode = dp->dup_cutoff_mode = dp->orig_mod_start_mode = dp->orig_mod_cutoff_mode = 'n'; // packet number by default diff --git a/nfq/params.h b/nfq/params.h index 8ee5474..40c4ff3 100644 --- a/nfq/params.h +++ b/nfq/params.h @@ -28,6 +28,8 @@ #define BADSEQ_INCREMENT_DEFAULT -10000 #define BADSEQ_ACK_INCREMENT_DEFAULT -66000 +#define TS_INCREMENT_DEFAULT -600000 + #define IPFRAG_UDP_DEFAULT 8 #define IPFRAG_TCP_DEFAULT 32 @@ -108,7 +110,7 @@ struct desync_profile unsigned int dup_repeats; uint8_t dup_ttl, dup_ttl6; uint32_t dup_fooling_mode; - uint32_t dup_badseq_increment, dup_badseq_ack_increment; + uint32_t dup_ts_increment, dup_badseq_increment, dup_badseq_ack_increment; autottl dup_autottl, dup_autottl6; char orig_mod_start_mode, orig_mod_cutoff_mode; // n - packets, d - data packets, s - relative sequence @@ -121,7 +123,7 @@ struct desync_profile uint8_t desync_ttl, desync_ttl6; autottl desync_autottl, desync_autottl6; uint32_t desync_fooling_mode; - uint32_t desync_badseq_increment, desync_badseq_ack_increment; + uint32_t desync_ts_increment, desync_badseq_increment, desync_badseq_ack_increment; struct blob_collection_head fake_http,fake_tls,fake_unknown,fake_unknown_udp,fake_quic,fake_wg,fake_dht,fake_discord,fake_stun; uint8_t fake_syndata[FAKE_MAX_TCP],seqovl_pattern[FAKE_MAX_TCP],fsplit_pattern[FAKE_MAX_TCP],udplen_pattern[FAKE_MAX_UDP];