Mirrors/bolvan-zapret2
1
0 Fork 0
mirror of https://github.com/bol-van/zapret2.git synced 2026-10-12 05:07:00 +04:00
Code Issues Packages Projects Releases Wiki Activity

nfqws2: pad tcp options with 0x00 in reconstruct. strip 0x00 ending options in dissect.

Browse Source
This commit is contained in:
bol-van committed 2026-09-02 09:18:27 +03:00
1 parent 36355d46e3
commit 6e186a3b38
3 files changed
+33 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/changes.txt
+2 -1
View File
@@ -329,5 +329,6 @@ v0.9.4.3
* github, builder_linux: lua 5.5.1
* nfqws2: negate SSID/NLM filters
* nfqws2: desync function can explicitly return nil as a synonym of VERDICT_PASS
* zapret-lub: luaexec now passes returned verdict code
* nfqws2: pad tcp options with 0x00 in reconstruct. strip 0x00 ending options in dissect.
* zapret-lib: luaexec now passes returned verdict code
* blockcheck2: fix script crash on bad strategies from the file in custom/10-list.sh
lua/zapret-tests.lua
+4 -7
View File
@@ -536,8 +536,7 @@ function test_dissect()
{ kind = 1 },
{ kind = 0xE0, data = brandom(math.random(1,10)) },
{ kind = 1 },
{ kind = 0xE1, data = brandom(math.random(1,10)) },
{ kind = 0 }
{ kind = 0xE1, data = brandom(math.random(1,10)) }
}
},
payload = brandom(math.random(0, 20))
@@ -704,8 +703,7 @@ function test_csum()
{ kind = 1 },
{ kind = 0xE0, data = brandom(math.random(1,10)) },
{ kind = 1 },
{ kind = 0xE1, data = brandom(math.random(1,10)) },
{ kind = 0 }
{ kind = 0xE1, data = brandom(math.random(1,10)) }
}
}
tcpb = reconstruct_tcphdr(tcp)
@@ -721,9 +719,8 @@ function test_csum()
bu8(tcp.options[1].kind)..
bu8(tcp.options[2].kind)..bu8(2 + #tcp.options[2].data)..tcp.options[2].data ..
bu8(tcp.options[3].kind)..
bu8(tcp.options[4].kind)..bu8(2 + #tcp.options[4].data)..tcp.options[4].data ..
bu8(tcp.options[5].kind)
raw = raw .. string.rep(bu8(TCP_KIND_NOOP), bitand(4-bitand(#raw,3),3))
bu8(tcp.options[4].kind)..bu8(2 + #tcp.options[4].data)..tcp.options[4].data
raw = raw .. string.rep(bu8(0), bitand(4-bitand(#raw,3),3))
print( raw==tcpb and "TCP RECONSTRUCT OK" or "TCP RECONSTRUCT FAILED" )
test_assert(raw==tcpb)
nfq2/lua.c
+27 -1
View File
@@ -1306,8 +1306,34 @@ void lua_pushf_tcphdr_options(lua_State *L, const struct tcphdr *tcp, size_t len
uint8_t *t = (uint8_t*)(tcp+1);
uint8_t *end = (uint8_t*)tcp + (tcp->th_off<<2);
uint8_t opt;
uint8_t opt, *ee;
if ((end-(uint8_t*)tcp) > len) end=(uint8_t*)tcp + len;
// strip ending 0x00 options (padding)
ee = end;
while(t<end)
{
opt = *t;
if (opt==TCP_KIND_END)
{
// set end marker only once
if (ee==end) ee=t;
}
else
// not 0x00 (END) ? clear end marker. ENDs inside other options must be dissected
ee=end;
// skip to the next option
if (opt==TCP_KIND_NOOP || opt==TCP_KIND_END)
t++;
else
{
if ((t+1)>=end || t[1]<2 || (t+t[1])>end) break;
t+=t[1];
}
}
end = ee;
t = (uint8_t*)(tcp+1);
lua_Integer idx=1;
while(t<end)
{