gsd
/
zapret
mirror of https://github.com/bol-van/zapret/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

complex TSPU hack is overkill

pull/113/head
bol-van 3 years ago
parent
ef669a15a5
commit
e2a5f6bb21
2 changed files with 8 additions and 8 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 6
      init.d/openwrt/custom-nfqws-quic4all-complex
  2. 10
      init.d/sysv/custom-nfqws-quic4all-complex

6
init.d/openwrt/custom-nfqws-quic4all-tspu → init.d/openwrt/custom-nfqws-quic4all-complex
View File

@ -1,11 +1,11 @@
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering
# and also sends special fake on outgoing packets with short header and udp.length>=600
# and also sends special fake on the first outgoing packet with short header and udp.length>600
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
# need to add to config : NFQWS_OPT_DESYNC_QUIC_SHORT_HEADER="--dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-fake-unknown-udp=/opt/zapret/files/fake/quic_short_header.bin --dpi-desync-cutoff=n2"
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
# this hack is for russian TSPU QUIC blocking
# without additional short header fake connections randomly hang
# this hack was first intended for TSPU but it appeared that it's overkill
# it's enough to send short header fake before initial
QNUM2=$(($QNUM+10))
QNUM3=$(($QNUM+11))

10
init.d/sysv/custom-nfqws-quic4all-tspu → init.d/sysv/custom-nfqws-quic4all-complex
View File

@ -1,11 +1,11 @@
# this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering
# and also sends special fake on outgoing packets with short header and udp.length>=600
# and also sends special fake on the first outgoing packet with short header and udp.length>600
# need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
# need to add to config : NFQWS_OPT_DESYNC_QUIC_SHORT_HEADER="--dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-fake-unknown-udp=/opt/zapret/files/fake/quic_short_header.bin --dpi-desync-cutoff=n2"
# NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
# this hack is for russian TSPU QUIC blocking
# without additional short header fake connections randomly hang
# this hack was first intended for TSPU but it appeared that it's overkill
# it's enough to send short header fake before initial
QNUM2=$(($QNUM+10))
QNUM3=$(($QNUM+11))
@ -33,7 +33,7 @@ zapret_custom_firewall()
local f
local first_packets_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:3"
local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
local udplen="-m length --length 600:1500"
local udplen="-m length --length 601:1500"
local short_header4="-m u32 --u32 0>>22&0x3C@8>>24&0xC0=0x40"
zapret_do_firewall_rules_ipt $1
@ -52,7 +52,7 @@ zapret_custom_firewall_nft()
local f
local first_packets_only="ct original packets 1-3"
local desync="mark and $DESYNC_MARK == 0"
local udplen="udp length 600-1500"
local udplen="udp length 601-1500"
local short_header4="@th,64,2 1"
zapret_apply_firewall_rules_nft
Write Preview
Loading…
Cancel
Save