Disable conntrack by default

On some devices conntrack may return EPERM
This commit is contained in:
Vadim Vetrov
2025-01-19 18:08:09 +03:00
parent bb133f8b88
commit 3f11a65a73
4 changed files with 10 additions and 9 deletions

View File

@@ -202,7 +202,7 @@ Flags that do not scoped to a specific section, used over all the youtubeUnblock
- `--no-gso` Disables support for TCP fat packets which uses GSO. This feature is well tested now, so this flag probably won't fix anything. - `--no-gso` Disables support for TCP fat packets which uses GSO. This feature is well tested now, so this flag probably won't fix anything.
- `--no-conntrack` Disables support for conntrack in youtubeUnblock. - `--use-conntrack` Enables support for conntrack in youtubeUnblock. Disabled by default. Enabled in kernel module.
- `--no-ipv6` Disables support for ipv6. May be useful if you don't want for ipv6 socket to be opened. - `--no-ipv6` Disables support for ipv6. May be useful if you don't want for ipv6 socket to be opened.

View File

@@ -280,7 +280,7 @@ enum {
OPT_THREADS, OPT_THREADS,
OPT_SILENT, OPT_SILENT,
OPT_NO_GSO, OPT_NO_GSO,
OPT_NO_CONNTRACK, OPT_USE_CONNTRACK,
OPT_QUEUE_NUM, OPT_QUEUE_NUM,
OPT_UDP_MODE, OPT_UDP_MODE,
OPT_UDP_FAKE_SEQ_LEN, OPT_UDP_FAKE_SEQ_LEN,
@@ -331,7 +331,7 @@ static struct option long_opt[] = {
{"trace", 0, 0, OPT_TRACE}, {"trace", 0, 0, OPT_TRACE},
{"instaflush", 0, 0, OPT_INSTAFLUSH}, {"instaflush", 0, 0, OPT_INSTAFLUSH},
{"no-gso", 0, 0, OPT_NO_GSO}, {"no-gso", 0, 0, OPT_NO_GSO},
{"no-conntrack", 0, 0, OPT_NO_CONNTRACK}, {"use-conntrack", 0, 0, OPT_USE_CONNTRACK},
{"no-ipv6", 0, 0, OPT_NO_IPV6}, {"no-ipv6", 0, 0, OPT_NO_IPV6},
{"daemonize", 0, 0, OPT_DAEMONIZE}, {"daemonize", 0, 0, OPT_DAEMONIZE},
{"noclose", 0, 0, OPT_NOCLOSE}, {"noclose", 0, 0, OPT_NOCLOSE},
@@ -477,11 +477,11 @@ int yparse_args(struct config_t *config, int argc, char *argv[]) {
goto invalid_opt; goto invalid_opt;
#endif #endif
break; break;
case OPT_NO_CONNTRACK: case OPT_USE_CONNTRACK:
#ifndef KERNEL_SPACE #ifndef KERNEL_SPACE
config->use_conntrack = 0; config->use_conntrack = 1;
#else #else
lgerr("--no-conntrack is not supported in kernel space. Compile with make kmake EXTRA_CFLAGS=\"-DNO_CONNTRACK\" instead." ); lgerr("Conntrack is enabled by default in kernel space. If you want to disable it, compile with make kmake EXTRA_CFLAGS=\"-DNO_CONNTRACK\"." );
goto invalid_opt; goto invalid_opt;
#endif #endif
break; break;
@@ -1052,8 +1052,8 @@ size_t print_config(const struct config_t *config, char *buffer, size_t buffer_s
if (!config->use_gso) { if (!config->use_gso) {
print_cnf_buf("--no-gso"); print_cnf_buf("--no-gso");
} }
if (!config->use_conntrack) { if (config->use_conntrack) {
print_cnf_buf("--no-conntrack"); print_cnf_buf("--use-conntrack");
} }
#endif #endif

View File

@@ -284,7 +284,7 @@ enum {
\ \
.verbose = VERBOSE_DEBUG, \ .verbose = VERBOSE_DEBUG, \
.use_gso = 1, \ .use_gso = 1, \
.use_conntrack = 1, \ .use_conntrack = 0, \
\ \
.first_section = NULL, \ .first_section = NULL, \
.last_section = NULL, \ .last_section = NULL, \

View File

@@ -285,6 +285,7 @@ int process_tcp_packet(const struct section_config_t *section, const uint8_t *ra
lgdebug("Target SNI detected: %.*s", vrd.sni_len, vrd.sni_ptr); lgdebug("Target SNI detected: %.*s", vrd.sni_len, vrd.sni_ptr);
size_t target_sni_offset = vrd.target_sni_ptr - data; size_t target_sni_offset = vrd.target_sni_ptr - data;
size_t payload_len = raw_payload_len; size_t payload_len = raw_payload_len;
uint8_t *payload = malloc(raw_payload_len); uint8_t *payload = malloc(raw_payload_len);
if (payload == NULL) { if (payload == NULL) {