Fix conflict between quic drop and udp port filter

UDP faking support

Kbuild

@@ -1,3 +1,3 @@
 obj-m := kyoutubeUnblock.o
-kyoutubeUnblock-objs := kytunblock.o mangle.o quic.o utils.o kargs.o tls.o
+kyoutubeUnblock-objs := kytunblock.o mangle.o quic.o utils.o kargs.o tls.o getopt.o args.o
 ccflags-y := -std=gnu99 -DKERNEL_SPACE -Wno-error -Wno-declaration-after-statement

Makefile

@@ -2,7 +2,7 @@ USPACE_TARGETS := default all install uninstall dev run_dev
 KMAKE_TARGETS := kmake kload kunload kreload xmod xtclean
 
 PKG_VERSION := 1.0.0
-PKG_RELEASE := 4
+PKG_RELEASE := 5
 
 PKG_FULLVERSION := $(PKG_VERSION)-$(PKG_RELEASE)
 

README.md

@@ -9,6 +9,7 @@
     - [IPv6](#ipv6)
   - [Check it](#check-it)
   - [Flags](#flags)
+  - [UDP](#udp)
   - [Troubleshooting](#troubleshooting)
     - [TV](#tv)
     - [Troubleshooting EPERMS (Operation not permitted)](#troubleshooting-eperms-operation-not-permitted)
@@ -92,16 +93,17 @@ If you got ` * pkg_hash_check_unresolved: cannot find dependency luci-lua-runtim
 
 LuCI configuration lives in **Services->youtubeUnblock** section. It is self descriptive, with description for each flag. Note, that after you push `Save & Apply` button, the configuration is applied automatically and the service is restarted.
 
-UCI configuration is available in /etc/config/youtubeUnblock file, in section `youtubeUnblock.youtubeUnblock`. The configuration is done with [flags](#flags). Note, that names of flags are not the same: you should replace `-` with `_`, you shouldn't use leading `--` for flag. Also you will enable toggle flags (without parameters) with `1`. 
+UCI configuration is available in /etc/config/youtubeUnblock file, in section `youtubeUnblock.youtubeUnblock`. You may pass any args as a string to parameter `args`, but before it disable interactive flags (You can configurate with it but it is a way harder and I recommend to use it only with `luci-app-youtubeUnblock`):
 
-For example, to enable trace logs you should do
 ```sh
-uci set youtubeUnblock.youtubeUnblock.trace=1
+uci set youtubeUnblock.youtubeUnblock.conf_strat="args"
+uci set youtubeUnblock.youtubeUnblock.args="--queue-num=537 --threads=1"
 ```
 
-You can check the logs in CLI mode with `logread -l 200 | grep youtubeUnblock` command. 
+To save the configs you should do `uci commit` and then `reload_config` to restart youtubeUnblock
 
-For uci, to save the configs you should do `uci commit` and then `reload_config` to restart the youtubeUnblock
+
+You can check the logs in CLI mode with `logread -l 200 | grep youtubeUnblock` command. 
 
 In CLI mode you will use youtubeUnblock as a normal init.d service:
 for example, you can enable it with `/etc/init.d/youtubeUnblock enable`.
@@ -133,7 +135,8 @@ Copy `youtubeUnblock.service` to `/usr/lib/systemd/system` (you should change th
 On nftables you should put next nftables rules:
 ```sh
 nft add chain inet fw4 youtubeUnblock '{ type filter hook postrouting priority mangle - 1; policy accept; }'
-nft add rule inet fw4 youtubeUnblock 'meta l4proto { tcp, udp } th dport 443 ct original packets < 20 counter queue num 537 bypass'
+nft add rule inet fw4 youtubeUnblock 'tcp dport 443 ct original packets < 20 counter queue num 537 bypass'
+nft add rule inet fw4 youtubeUnblock 'meta l4proto udp ct original packets < 9 counter queue num 537 bypass'
 nft insert rule inet fw4 output 'mark and 0x8000 == 0x8000 counter accept'
 ```
 
@@ -143,7 +146,7 @@ On iptables you should put next iptables rules:
 ```sh
 iptables -t mangle -N YOUTUBEUNBLOCK
 iptables -t mangle -A YOUTUBEUNBLOCK -p tcp --dport 443 -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:19 -j NFQUEUE --queue-num 537 --queue-bypass
-iptables -t mangle -A YOUTUBEUNBLOCK -p udp --dport 443 -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:19 -j NFQUEUE --queue-num 537 --queue-bypass
+iptables -t mangle -A YOUTUBEUNBLOCK -p udp -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:8 -j NFQUEUE --queue-num 537 --queue-bypass
 iptables -t mangle -A POSTROUTING -j YOUTUBEUNBLOCK
 iptables -I OUTPUT -m mark --mark 32768/32768 -j ACCEPT
 ```
@@ -154,7 +157,7 @@ For IPv6 on iptables you need to duplicate rules above for ip6tables:
 ```sh
 ip6tables -t mangle -N YOUTUBEUNBLOCK
 ip6tables -t mangle -A YOUTUBEUNBLOCK -p tcp --dport 443 -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:19 -j NFQUEUE --queue-num 537 --queue-bypass
-ip6tables -t mangle -A YOUTUBEUNBLOCK -p udp --dport 443 -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:19 -j NFQUEUE --queue-num 537 --queue-bypass
+ip6tables -t mangle -A YOUTUBEUNBLOCK -p udp -m connbytes --connbytes-dir original --connbytes-mode packets --connbytes 0:8 -j NFQUEUE --queue-num 537 --queue-bypass
 ip6tables -t mangle -A POSTROUTING -j YOUTUBEUNBLOCK
 ip6tables -I OUTPUT -m mark --mark 32768/32768 -j ACCEPT
 ```
@@ -184,13 +187,37 @@ curl -o/dev/null -k --connect-to ::google.com -k -L -H Host:\ mirror.gcr.io http
 Put flags to the **BINARY**, not an init script. If you are on OpenWRT you should put the flags inside the script: open `/etc/init.d/youtubeUnblock` with any text editor, like vi or nano and put your flags after `procd_set_param command /usr/bin/youtubeUnblock` line.
 
 Available flags:
-
-- `--sni-domains=<comma separated domain list>|all` List of domains you want to be handled by SNI. Use this string if you want to change default domain list. Defaults to `googlevideo.com,ggpht.com,ytimg.com,youtube.com,play.google.com,youtu.be,googleapis.com,googleusercontent.com,gstatic.com,l.google.com`. You can pass **all** if you want for every *ClientHello* to be handled. You can exclude some domains with `--exclude-domains` flag.
-
-- `--exclude-domains=<comma separated domain list>` List of domains to be excluded from targeting.
+#### General flags
+Flags that do not scoped to a specific section, used over all the youtubeUnblock
 
 - `--queue-num=<number of netfilter queue>` The number of netfilter queue **youtubeUnblock** will be linked to. Defaults to **537**.
 
+- `--silent` Disables verbose mode.
+
+- `--trace` Maximum verbosity for debugging purposes.
+
+- `--no-gso` Disables support for Google Chrome fat packets which uses GSO. This feature is well tested now, so this flag probably won't fix anything.
+
+- `--no-ipv6` Disables support for ipv6. May be useful if you don't want for ipv6 socket to be opened.
+
+- `--threads=<threads number>` Specifies the amount of threads you want to be running for your program. This defaults to **1** and shouldn't be edited for normal use. But if you really want multiple queue instances of youtubeUnblock, note that you should change --queue-num to --queue balance. For example, with 4 threads, use `--queue-balance 537:540` on iptables and `queue num 537-540` on nftables.
+
+- `--connbytes-limit=<pkts>` **Kernel module only!** Specify how much packets of connection should be processed by kyoutubeUnblock. Pass 0 if you want for each packet to be processed. This flag may be useful for UDP traffic since unlimited youtubeUnblock may lead to traffic flood and unexpected bans. Defaults to 5. In most cases you don't want to change it.
+
+- `--daemonize` Daemonizes the youtubeUnblock (forks and detaches it from the shell). Terminate the program with `killall youtubeUnblock`. If you want to track the logs of youtubeUnblock in logread or journalctl, use **--syslog** flag.
+
+- `--syslog` Redirects logs to the system log. You can read it with `journalctl` or `logread`.
+
+- `--noclose` Usable only with `--daemonize`. Will not redirect io streams to /dev/null.
+
+- `--packet-mark=<mark>` Use this option if youtubeUnblock conflicts with other systems rely on packet mark. Note that you may want to change accept rule for iptables to follow the mark.
+
+#### Section scoped flags
+
+- `--fbegin` and `--fend` flags: youtubeUnblock supports multiple sets of strategies for specific filters. You may want to initiate a new set after the default one, like: `--sni-domains=googlevideo.com --faking-strategy=md5sum --fbegin --sni-domains=youtube.com --faking-strategy=tcp_check --fbegin --sni-domains=l.google.com --faking-strategy=pastseq`. Note, that the priority of these sets goes backwards: last is first, default (one that does not start with --fbegin) is last. If you start the new section, the default settings are implemented just like youtubeUnblock without any parameters. Note that the config above is just an example and won't work for you.
+
+- `--tls={enabled|disabled}` Set it if you want not to process TLS traffic in current section. May be used if you want to set only UDP-based section. (Here section is a unit between `--fbegin` and `--fend` flags).
+
 - `--fake-sni={0|1}` This flag enables fake-sni which forces **youtubeUnblock** to send at least three packets instead of one with TLS *ClientHello*: Fake *ClientHello*, 1st part of original *ClientHello*, 2nd part of original *ClientHello*. This flag may be related to some Operation not permitted error messages, so before open an issue refer to [Troubleshooting for EPERMS](#troubleshooting-eperms-operation-not-permitted). Defaults to **1**.
 
 - `--fake-sni-seq-len=<length>` This flag specifies **youtubeUnblock** to build a complicated construction of fake client hello packets. length determines how much fakes will be sent. Defaults to **1**.
@@ -219,8 +246,6 @@ Available flags:
 
 - `--frag-sni-pos=<pos>` With this option **youtubeUnblock** will split the packet at the position pos. Defaults to 1.
 
-- `--quic-drop` Drop all QUIC packets which goes to youtubeUnblock. Won't affect any other UDP packets. Suitable for some TVs. Note, that for this option to work you should also add proxy udp to youtubeUnblock in firewall. `connbytes` may also be used with udp.
-
 - `--fk-winsize=<winsize>` Specifies window size for the fragmented TCP packet. Applicable if you want for response to be fragmented. May slowdown connection initialization.
 
 - `--synfake={1|0}` If 1, syn payload will be sent before each request. The idea is taken from syndata from zapret project. Syn payload will normally be discarded by endpoint but may be handled by TSPU. This option sends normal fake in that payload. Please note, that the option works for all the sites, so --sni-domains won't change anything.
@@ -231,25 +256,25 @@ Available flags:
 
 - `--seg2delay=<delay>` This flag forces **youtubeUnblock** to wait a little bit before send the 2nd part of the split packet.
 
-- `--silent` Disables verbose mode.
+- `--sni-domains=<comma separated domain list>|all` List of domains you want to be handled by SNI. Use this string if you want to change default domain list. Defaults to `googlevideo.com,ggpht.com,ytimg.com,youtube.com,play.google.com,youtu.be,googleapis.com,googleusercontent.com,gstatic.com,l.google.com`. You can pass **all** if you want for every *ClientHello* to be handled. You can exclude some domains with `--exclude-domains` flag.
 
-- `--trace` Maximum verbosity for debugging purposes.
+- `--exclude-domains=<comma separated domain list>` List of domains to be excluded from targeting.
 
-- `--no-gso` Disables support for Google Chrome fat packets which uses GSO. This feature is well tested now, so this flag probably won't fix anything.
+- `--udp-mode={drop|fake}` This flag specifies udp handling strategy. If drop udp packets will be dropped (useful for quic when browser can fallback to tcp), if fake udp will be faked. Defaults to fake.
 
-- `--no-ipv6` Disables support for ipv6. May be useful if you don't want for ipv6 socket to be opened.
+- `--udp-fake-seq-len=<amount of faking packets sent>` Specifies how much faking packets will be sent over the network. Defaults to 6.
 
-- `--threads=<threads number>` Specifies the amount of threads you want to be running for your program. This defaults to **1** and shouldn't be edited for normal use. But if you really want multiple queue instances of youtubeUnblock, note that you should change --queue-num to --queue balance. For example, with 4 threads, use `--queue-balance 537:540` on iptables and `queue num 537-540` on nftables.
+- `--udp-fake-len=<size of udp fake>` Size of udp fake payload (typically payload is zeroes). Defaults to 64.
 
-- `--daemonize` Daemonizes the youtubeUnblock (forks and detaches it from the shell). Terminate the program with `killall youtubeUnblock`. If you want to track the logs of youtubeUnblock in logread or journalctl, use **--syslog** flag.
+- `--udp-dport-filter=<5,6,200-500>` Filter the UDP destination ports. Defaults to no ports. Specifie the ports you want to be handled by youtubeUnblock.
 
-- `--syslog` Redirects logs to the system log. You can read it with `journalctl` or `logread`.
+- `--udp-filter-quic={disabled|all}` Enables QUIC filtering for UDP handler. If disabled, quic won't be processed, if all, all quic initial packets will be handled. Defaults to disabled.
 
-- `--noclose` Usable only with `--daemonize`. Will not redirect io streams to /dev/null.
+- `--quic-drop` Drop all QUIC packets which goes to youtubeUnblock. Won't affect any other UDP packets. Just an alias for `--udp-filter-quic=all --udp-mode=drop`.
 
-- `--packet-mark=<mark>` Use this option if youtubeUnblock conflicts with other systems rely on packet mark. Note that you may want to change accept rule for iptables to follow the mark.
+## UDP
 
-- `--fbegin` and `--fend` flags: youtubeUnblock supports multiple sets of strategies for specific filters. You may want to initiate a new set after the default one, like: `--sni-domains=googlevideo.com --faking-strategy=md5sum --fbegin --sni-domains=youtube.com --faking-strategy=tcp_check --fend --fbegin --sni-domains=l.google.com --faking-strategy=pastseq --fend`. Note, that the priority of these sets goes backwards: last is first, default (one that does not start with --fbegin) is last. If you start the new section, the default settings are implemented just like youtubeUnblock without any parameters. Note that the config above is just an example and won't work for you.
+UDP is another communication protocol. Well-known technologies that use it are DNS, QUIC, voice chats. UDP does not provide reliable connection and its header is much simpler than TCP thus fragmentation is limited. The support provided primarily by faking. For QUIC faking may not work well, so use `--quic-drop` if you want to drop all quic traffic. For other technologies I recommend to configure UDP support in the separate section from TCP, like `--fbegin --udp-dport-filter=50000-50099 --tls=disabled`. See more in flags related to udp and [issues tagged with udp label](https://github.com/Waujito/youtubeUnblock/issues?q=label%3Audp+). 
 
 ## Troubleshooting
 
@@ -343,24 +368,20 @@ When compilation is done, the binary file will be in build directory. Copy it to
 
 This section describes the kernel module version of youtubeUnblock. The kernel module operates as a normal module inside the kernel and integrates within the netfilter stack to statelessly mangle the packets sent over the Internet.
 
-You can configure the module with its flags in insmod:
-```
-insmod kyoutubeUnblock.ko fake_sni=1 exclude_domains=.ru quic_drop=1
-```
+You can configure the module with its flags:
 
-Note that the flags names are different from ones used for the regular youtubeUnblock(right like in UCI configuration for OpenWRT): replace `-` with `_` and no leading `--`. Also to configure togglers you should set them to `1` (`quic_drop=1`)
-
-Also a good thig to mention is verbosity. The kernel module combines --trace and --silent option to the one parameter `verbosity`. This parameter accepts 3 arguments: `trace`, `debug` and `silent`. I highly don't recommend to enable `trace` mod on router because it may cause huge problems with performance and even freeze your device. 
-
-Also a drop in replacement is supported for all the parameters excluding packet mark. A drop in replacement does not require module restart if you want to change the parameters. You can specify and check the parameters within module's directory inside the sysfs: `/sys/module/kyoutubeUnblock/parameters/`. For example, to set quic_drop to true you may use next command:
 ```sh
-echo 1 | sudo tee /sys/module/kyoutubeUnblock/parameters/quic_drop
+insmod kyoutubeUnblock.ko 
+echo "--fake_sni=1 --exclude_domains=.ru --quic_drop" | sudo tee /sys/module/kyoutubeUnblock/parameters/parameters
 ```
-and 
+
+You can also do 
+
 ```sh
-cat /sys/module/kyoutubeUnblock/parameters/quic_drop
+cat /sys/module/kyoutubeUnblock/parameters/parameters
 ```
-to check the parameter.
+
+and check all the parameters configured.
 
 ### Building kernel module
 

args.h

@@ -1,11 +1,23 @@
 #ifndef ARGS_H
 #define ARGS_H
+#include "types.h"
+#include "config.h"
 
-void print_version();
+void print_version(void);
 void print_usage(const char *argv0);
-int parse_args(int argc, char *argv[]);
+int  yparse_args(int argc, char *argv[]);
+size_t print_config(char *buffer, size_t buffer_size);
+
+// Initializes configuration storage.
+int init_config(struct config_t *config);
+// Allocates and initializes configuration section.
+int init_section_config(struct section_config_t **section, struct section_config_t *prev);
+// Frees configuration section
+void free_config_section(struct section_config_t *config);
+// Frees sections under config
+void free_config(struct config_t config);
 
 /* Prints starting messages */
-void print_welcome();
+void print_welcome(void);
 
 #endif /* ARGS_H */

config.h

@@ -5,7 +5,7 @@
 #define USER_SPACE
 #endif
 
-#include "raw_replacements.h"
+#include "types.h"
 
 typedef int (*raw_send_t)(const unsigned char *data, unsigned int data_len);
 /**
@@ -20,9 +20,28 @@ struct instance_config_t {
 };
 extern struct instance_config_t instance_config;
 
+struct udp_dport_range {
+	uint16_t start;
+	uint16_t end;
+};
+
+struct domains_list {
+	char *domain_name;
+	uint16_t domain_len;
+
+	struct domains_list *next;
+};
+
 struct section_config_t {
-	const char *domains_str;
-	unsigned int domains_strlen;
+	int id;
+	struct section_config_t *next;
+	struct section_config_t *prev;
+
+	struct domains_list *sni_domains;
+	struct domains_list *exclude_sni_domains;
+	unsigned int all_domains;
+
+	int tls_enabled;
 
 	int fragmentation_strategy;
 	int frag_sni_reverse;
@@ -40,21 +59,15 @@ struct section_config_t {
 #define FAKE_PAYLOAD_DEFAULT	2
 	int fake_sni_type;
 
-	int quic_drop;
-
 	/* In milliseconds */
 	unsigned int seg2_delay;
 	int synfake;
 	unsigned int synfake_len;
 
-	const char *exclude_domains_str;
-	unsigned int exclude_domains_strlen;
-	unsigned int all_domains;
-
 	const char *fake_sni_pkt;
 	unsigned int fake_sni_pkt_sz;
 
-	const char *fake_custom_pkt;
+	char *fake_custom_pkt;
 	unsigned int fake_custom_pkt_sz;
 
 	unsigned int fk_winsize;
@@ -64,6 +77,14 @@ struct section_config_t {
 #define SNI_DETECTION_BRUTE 1
 	int sni_detection;
 
+	int udp_mode;
+	unsigned int udp_fake_seq_len;
+	unsigned int udp_fake_len;
+	int udp_faking_strategy;
+
+	struct udp_dport_range *udp_dport_range;
+	int udp_dport_range_len;
+	int udp_filter_quic;
 };
 
 #define MAX_CONFIGLIST_LEN 64
@@ -79,53 +100,23 @@ struct config_t {
 	int noclose;
 	int syslog;
 
+	int connbytes_limit;
+
 #define VERBOSE_INFO	0
 #define VERBOSE_DEBUG	1
 #define VERBOSE_TRACE	2
 	int verbose;
 
-	struct section_config_t default_config;
-	struct section_config_t custom_configs[MAX_CONFIGLIST_LEN];
-	int custom_configs_len;
+	struct section_config_t *first_section;
+	struct section_config_t *last_section;
 };
 
 extern struct config_t config;
 
-#define ITER_CONFIG_SECTIONS(section) \
-for (struct section_config_t *section = &config.default_config + config.custom_configs_len; section >= &config.default_config; section--)
+#define ITER_CONFIG_SECTIONS(config, section) \
+for (struct section_config_t *section = (config)->last_section; section != NULL; section = section->prev)
 
-#define CONFIG_SECTION_NUMBER(section) (int)((section) - &config.default_config)
-
-#define default_section_config {				\
-	.frag_sni_reverse = 1,                                  \
-	.frag_sni_faked = 0,                                    \
-	.fragmentation_strategy = FRAGMENTATION_STRATEGY,       \
-	.faking_strategy = FAKING_STRATEGY,                     \
-	.faking_ttl = FAKE_TTL,                                 \
-	.fake_sni = 1,                                          \
-	.fake_sni_seq_len = 1,                                  \
-	.fake_sni_type = FAKE_PAYLOAD_DEFAULT,                  \
-	.frag_middle_sni = 1,                                   \
-	.frag_sni_pos = 1,                                      \
-	.fakeseq_offset = 10000,                                \
-	.synfake = 0,                                           \
-	.synfake_len = 0,                                       \
-	.quic_drop = 0,                                         \
-                                                                \
-	.seg2_delay = 0,                                        \
-                                                                \
-	.domains_str = defaul_snistr,                           \
-	.domains_strlen = sizeof(defaul_snistr),                \
-                                                                \
-	.exclude_domains_str = "",                              \
-	.exclude_domains_strlen = 0,                            \
-                                                                \
-	.fake_sni_pkt = fake_sni_old,                           \
-	.fake_sni_pkt_sz = sizeof(fake_sni_old) - 1,		\
-	.fake_custom_pkt = custom_fake_buf,                     \
-	.fake_custom_pkt_sz = 0,                                \
-	.sni_detection = SNI_DETECTION_PARSE,                   \
-}
+#define CONFIG_SECTION_NUMBER(section) ((section)->id)
 
 #define MAX_THREADS 16
 
@@ -165,8 +156,9 @@ for (struct section_config_t *section = &config.default_config + config.custom_c
 #define FAKE_STRAT_PAST_SEQ	(1 << 2)
 #define FAKE_STRAT_TCP_CHECK	(1 << 3)
 #define FAKE_STRAT_TCP_MD5SUM	(1 << 4)
+#define FAKE_STRAT_UDP_CHECK	(1 << 5)
 
-#define FAKE_STRAT_COUNT	5
+#define FAKE_STRAT_COUNT	6
 
 /**
  * This macros iterates through all faking strategies and executes code under it.
@@ -196,6 +188,77 @@ if ((fake_bitmask) & strategy)
 
 #define DEFAULT_SNISTR "googlevideo.com,ggpht.com,ytimg.com,youtube.com,play.google.com,youtu.be,googleapis.com,googleusercontent.com,gstatic.com,l.google.com"
 
-static const char defaul_snistr[] = DEFAULT_SNISTR;
+static const char default_snistr[] = DEFAULT_SNISTR;
+
+enum {
+	UDP_MODE_DROP,
+	UDP_MODE_FAKE,
+};
+
+enum {
+	UDP_FILTER_QUIC_DISABLED,
+	UDP_FILTER_QUIC_ALL,
+};
+
+#define default_section_config {				\
+	.sni_domains = NULL,					\
+	.exclude_sni_domains = NULL,				\
+	.all_domains = 0,					\
+	.tls_enabled = 1,					\
+	.frag_sni_reverse = 1,                                  \
+	.frag_sni_faked = 0,                                    \
+	.fragmentation_strategy = FRAGMENTATION_STRATEGY,       \
+	.faking_strategy = FAKING_STRATEGY,                     \
+	.faking_ttl = FAKE_TTL,                                 \
+	.fake_sni = 1,                                          \
+	.fake_sni_seq_len = 1,                                  \
+	.fake_sni_type = FAKE_PAYLOAD_DEFAULT,                  \
+	.fake_custom_pkt = NULL,				\
+	.fake_custom_pkt_sz = 0,				\
+	.frag_middle_sni = 1,                                   \
+	.frag_sni_pos = 1,                                      \
+	.fakeseq_offset = 10000,                                \
+	.synfake = 0,                                           \
+	.synfake_len = 0,                                       \
+                                                                \
+	.seg2_delay = 0,                                        \
+                                                                \
+	.sni_detection = SNI_DETECTION_PARSE,                   \
+								\
+	.udp_mode = UDP_MODE_FAKE,				\
+	.udp_fake_seq_len = 6,					\
+	.udp_fake_len = 64,					\
+	.udp_faking_strategy = FAKE_STRAT_UDP_CHECK,		\
+	.udp_dport_range = NULL,				\
+	.udp_dport_range_len = 0,				\
+	.udp_filter_quic = UDP_FILTER_QUIC_DISABLED,		\
+								\
+	.prev	= NULL,						\
+	.next	= NULL,						\
+	.id	= 0,						\
+}
+
+#define default_config_set {					\
+	.threads = THREADS_NUM,					\
+	.queue_start_num = DEFAULT_QUEUE_NUM,                   \
+	.mark = DEFAULT_RAWSOCKET_MARK,                         \
+	.use_ipv6 = 1,                                          \
+	.connbytes_limit = 8,                                   \
+                                                                \
+	.verbose = VERBOSE_DEBUG,                               \
+	.use_gso = 1,                                           \
+                                                                \
+	.first_section = NULL,					\
+	.last_section = NULL,					\
+                                                                \
+	.daemonize = 0,                                         \
+	.noclose = 0,                                           \
+	.syslog = 0,                                            \
+}
+
+#define CONFIG_SET(config)			\
+struct config_t config = default_config_set;	\
+config->last_section = &(config.default_config) \
+
 
 #endif /* YTB_CONFIG_H */

getopt.c

@@ -0,0 +1,204 @@
+#include "types.h"
+#include "logging.h"
+#include "getopt.h"
+
+char *optarg;
+int optind=1, opterr=1, optopt, __optpos, optreset=0;
+
+#define optpos __optpos
+
+static void __getopt_msg(const char *b, const char *c, size_t l)
+{
+	lgerr("%s %.*s\n", b, (int)l, c);
+}
+
+int getopt(int argc, char * const argv[], const char *optstring)
+{
+	int i, c, d;
+	int k, l;
+	char *optchar;
+
+	if (!optind || optreset) {
+		optreset = 0;
+		__optpos = 0;
+		optind = 1;
+	}
+
+	if (optind >= argc || !argv[optind])
+		return -1;
+
+	if (argv[optind][0] != '-') {
+		if (optstring[0] == '-') {
+			optarg = argv[optind++];
+			return 1;
+		}
+		return -1;
+	}
+
+	if (!argv[optind][1])
+		return -1;
+
+	if (argv[optind][1] == '-' && !argv[optind][2])
+		return optind++, -1;
+
+	if (!optpos) optpos++;
+	c = argv[optind][optpos], k = 1;
+	optchar = argv[optind]+optpos;
+	optopt = c;
+	optpos += k;
+
+	if (!argv[optind][optpos]) {
+		optind++;
+		optpos = 0;
+	}
+
+	if (optstring[0] == '-' || optstring[0] == '+')
+		optstring++;
+
+	i = 0;
+	d = 0;
+	do {
+		d = optstring[i], l = 1;
+		if (l>0) i+=l; else i++;
+	} while (l && d != c);
+
+	if (d != c) {
+		if (optstring[0] != ':' && opterr)
+			__getopt_msg("Unrecognized option: ", optchar, k);
+		return '?';
+	}
+	if (optstring[i] == ':') {
+		if (optstring[i+1] == ':') optarg = 0;
+		else if (optind >= argc) {
+			if (optstring[0] == ':') return ':';
+			if (opterr) __getopt_msg("Option requires an argument: ",
+				optchar, k);
+			return '?';
+		}
+		if (optstring[i+1] != ':' || optpos) {
+			optarg = argv[optind++] + optpos;
+			optpos = 0;
+		}
+	}
+	return c;
+}
+
+static void permute(char *const *argv, int dest, int src)
+{
+	char **av = (char **)argv;
+	char *tmp = av[src];
+	int i;
+	for (i=src; i>dest; i--)
+		av[i] = av[i-1];
+	av[dest] = tmp;
+}
+
+static int __getopt_long_core(int argc, char *const *argv, const char *optstring, const struct option *longopts, int *idx, int longonly)
+{
+	optarg = 0;
+	if (longopts && argv[optind][0] == '-' &&
+		((longonly && argv[optind][1] && argv[optind][1] != '-') ||
+		 (argv[optind][1] == '-' && argv[optind][2])))
+	{
+		int colon = optstring[optstring[0]=='+'||optstring[0]=='-']==':';
+		int i, cnt, match = -1;
+		char *opt;
+		for (cnt=i=0; longopts[i].name; i++) {
+			const char *name = longopts[i].name;
+			opt = argv[optind]+1;
+			if (*opt == '-') opt++;
+			for (; *name && *name == *opt; name++, opt++);
+			if (*opt && *opt != '=') continue;
+			match = i;
+			if (!*name) {
+				cnt = 1;
+				break;
+			}
+			cnt++;
+		}
+		if (cnt==1) {
+			i = match;
+			optind++;
+			optopt = longopts[i].val;
+			if (*opt == '=') {
+				if (!longopts[i].has_arg) {
+					if (colon || !opterr)
+						return '?';
+					__getopt_msg(
+						"Option does not take an argument: ",
+						longopts[i].name,
+						strlen(longopts[i].name));
+					return '?';
+				}
+				optarg = opt+1;
+			} else if (longopts[i].has_arg == required_argument) {
+				if (!(optarg = argv[optind])) {
+					if (colon) return ':';
+					if (!opterr) return '?';
+					__getopt_msg(
+						"Option requires an argument: ",
+						longopts[i].name,
+						strlen(longopts[i].name));
+					return '?';
+				}
+				optind++;
+			}
+			if (idx) *idx = i;
+			if (longopts[i].flag) {
+				*longopts[i].flag = longopts[i].val;
+				return 0;
+			}
+			return longopts[i].val;
+		}
+		if (argv[optind][1] == '-') {
+			if (!colon && opterr)
+				__getopt_msg(cnt ?
+					"Option is ambiguous: " :
+					"Unrecognized option: ",
+					argv[optind]+2,
+					strlen(argv[optind]+2));
+			optind++;
+			return '?';
+		}
+	}
+	return getopt(argc, argv, optstring);
+}
+
+static int __getopt_long(int argc, char *const *argv, const char *optstring, const struct option *longopts, int *idx, int longonly)
+{
+	int ret, skipped, resumed;
+	if (!optind || optreset) {
+		optreset = 0;
+		__optpos = 0;
+		optind = 1;
+	}
+	if (optind >= argc || !argv[optind]) return -1;
+	skipped = optind;
+	if (optstring[0] != '+' && optstring[0] != '-') {
+		int i;
+		for (i=optind; ; i++) {
+			if (i >= argc || !argv[i]) return -1;
+			if (argv[i][0] == '-' && argv[i][1]) break;
+		}
+		optind = i;
+	}
+	resumed = optind;
+	ret = __getopt_long_core(argc, argv, optstring, longopts, idx, longonly);
+	if (resumed > skipped) {
+		int i, cnt = optind-resumed;
+		for (i=0; i<cnt; i++)
+			permute(argv, skipped, optind-1);
+		optind = skipped + cnt;
+	}
+	return ret;
+}
+
+int getopt_long(int argc, char *const *argv, const char *optstring, const struct option *longopts, int *idx)
+{
+	return __getopt_long(argc, argv, optstring, longopts, idx, 0);
+}
+
+int getopt_long_only(int argc, char *const *argv, const char *optstring, const struct option *longopts, int *idx)
+{
+	return __getopt_long(argc, argv, optstring, longopts, idx, 1);
+}

getopt.h

@@ -0,0 +1,45 @@
+/*
+  Copyright 2005-2014 Rich Felker, et al.
+  
+  Permission is hereby granted, free of charge, to any person obtaining
+  a copy of this software and associated documentation files (the
+  "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so, subject to
+  the following conditions:
+  
+  The above copyright notice and this permission notice shall be
+  included in all copies or substantial portions of the Software.
+  
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#ifndef _GETOPT_H
+#define _GETOPT_H
+
+int getopt(int, char * const [], const char *);
+extern char *optarg;
+extern int optind, opterr, optopt, optreset;
+
+struct option {
+	const char *name;
+	int has_arg;
+	int *flag;
+	int val;
+};
+
+int getopt_long(int, char *const *, const char *, const struct option *, int *);
+int getopt_long_only(int, char *const *, const char *, const struct option *, int *);
+
+#define no_argument        0
+#define required_argument  1
+#define optional_argument  2
+
+#endif

kytunblock.c

@@ -16,10 +16,14 @@
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
 
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_acct.h>
+
 #include "mangle.h"
 #include "config.h"
 #include "utils.h"
 #include "logging.h"
+#include "args.h"
 
 #if defined(PKG_VERSION)
 MODULE_VERSION(PKG_VERSION);
@@ -206,9 +210,9 @@ erret_lc:
 	int ipvx = netproto_version(pkt, pktlen);
 
 	if (ipvx == IP4VERSION) {
-		return send_raw_ipv4(pkt, pktlen);
+		ret = send_raw_ipv4(pkt, pktlen);
 	} else if (ipvx == IP6VERSION) {
-		return send_raw_ipv6(pkt, pktlen);
+		ret = send_raw_ipv6(pkt, pktlen);
 	} else {
 		printf("proto version %d is unsupported\n", ipvx);
 		return -EINVAL;
@@ -228,6 +232,32 @@ struct instance_config_t instance_config = {
 	.send_delayed_packet = delay_packet_send,
 };
 
+static int connbytes_pkts(const struct sk_buff *skb) {
+	const struct nf_conn *ct;
+	enum ip_conntrack_info ctinfo;
+	u_int64_t pkts = 0;
+	const struct nf_conn_counter *counters;
+
+	ct = nf_ct_get(skb, &ctinfo);
+	if (!ct)
+		return -1;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+	const struct nf_conn_acct *acct;
+	acct = nf_conn_acct_find(ct);
+	if (!acct)
+		return -1;
+	counters = acct->counter;
+#else 
+	counters = nf_conn_acct_find(ct);
+	if (!counters)
+		return -1;
+#endif
+
+	pkts = atomic64_read(&counters[IP_CT_DIR_ORIGINAL].packets);
+
+	return pkts;
+}
 
 /* If this is a Red Hat-based kernel (Red Hat, CentOS, Fedora, etc)... */
 #ifdef RHEL_RELEASE_CODE
@@ -307,6 +337,9 @@ static NF_CALLBACK(ykb_nf_hook, skb) {
 	if (skb->len > MAX_PACKET_SIZE)
 		goto accept;
 
+	if (config.connbytes_limit != 0 && connbytes_pkts(skb) > config.connbytes_limit)
+		goto accept;
+
 	ret = skb_linearize(skb);
 	if (ret < 0) {
 		lgerror(ret, "Cannot linearize");
@@ -346,6 +379,8 @@ static struct nf_hook_ops ykb6_nf_reg __read_mostly = {
 
 static int __init ykb_init(void) {
 	int ret = 0;
+	ret = init_config(&config);
+	if (ret < 0) goto err;
 
 	ret = open_raw_socket();
 	if (ret < 0) goto err;
@@ -420,6 +455,8 @@ static void __exit ykb_destroy(void) {
 #endif
 
 	close_raw_socket();
+
+	free_config(config);
 	lginfo("youtubeUnblock kernel module destroyed.\n");
 }
 

mangle.c

@@ -62,7 +62,7 @@ int process_packet(const uint8_t *raw_payload, uint32_t raw_payload_len) {
 		lgtrace_addp("UDP");
 
 	
-	ITER_CONFIG_SECTIONS(section) {
+	ITER_CONFIG_SECTIONS(&config, section) {
 		lgtrace_addp("Section #%d", CONFIG_SECTION_NUMBER(section));
 
 		switch (transport_proto) {
@@ -74,16 +74,32 @@ int process_packet(const uint8_t *raw_payload, uint32_t raw_payload_len) {
 			break;
 		}
 
-		if (verdict == PKT_CONTINUE)
+		if (verdict == PKT_CONTINUE) {
+			lgtrace_addp("continue_flow");
 			continue;
+		}
 
-		lgtrace_end();
-		return verdict;
+		goto ret_verdict;
 	}
 
 accept:	
+	verdict = PKT_ACCEPT;
+
+ret_verdict:
+
+	switch (verdict) {
+	case PKT_ACCEPT:
+		lgtrace_addp("accept");
+		break;
+	case PKT_DROP:
+		lgtrace_addp("drop");
+		break;
+	default:
+		lgtrace_addp("unknow verdict: %d", verdict);
+	}
 	lgtrace_end();
-	return PKT_ACCEPT;
+
+	return verdict;
 }
 
 int process_tcp_packet(const struct section_config_t *section, const uint8_t *raw_payload, uint32_t raw_payload_len) {
@@ -154,6 +170,9 @@ int process_tcp_packet(const struct section_config_t *section, const uint8_t *ra
 
 	if (tcph->syn) goto continue_flow;
 
+	if (!section->tls_enabled)
+		goto continue_flow;
+
 	struct tls_verdict vrd = analyze_tls_data(section, data, dlen);
 	lgtrace_addp("TLS analyzed");
 
@@ -309,13 +328,10 @@ drop_lc:
 	}
 
 continue_flow:
-	lgtrace_addp("continue_flow");
 	return PKT_CONTINUE;
 accept:
-	lgtrace_addp("accept");
 	return PKT_ACCEPT;
 drop:
-	lgtrace_addp("drop");
 	return PKT_DROP;
 }
 
@@ -325,7 +341,6 @@ int process_udp_packet(const struct section_config_t *section, const uint8_t *pk
 	const struct udphdr *udph;
 	const uint8_t *data;
 	uint32_t dlen;
-	int ipver = netproto_version(pkt, pktlen);
 
 	int ret = udp_payload_split((uint8_t *)pkt, pktlen,
 			      (void **)&iph, &iph_len, 
@@ -350,75 +365,54 @@ int process_udp_packet(const struct section_config_t *section, const uint8_t *pk
 	}
 
 
-	if (section->quic_drop) {
-		lgtrace_addp("QUIC probe");
-		const struct quic_lhdr *qch;
-		uint32_t qch_len;
-		struct quic_cids qci;
-		uint8_t *quic_raw_payload;
-		uint32_t quic_raw_plen;
-		ret = quic_parse_data((uint8_t *)data, dlen, 
-			 (struct quic_lhdr **)&qch, &qch_len, &qci, 
-			 &quic_raw_payload, &quic_raw_plen);
-
-		if (ret < 0) {
-			lgtrace_addp("undefined type");
-			goto accept_quic;
-		}
-
-		lgtrace_addp("QUIC detected");
-		uint8_t qtype = qch->type;
+	if (!detect_udp_filtered(section, pkt, pktlen)) 
+		goto continue_flow;
 
+	if (section->udp_mode == UDP_MODE_DROP)
 		goto drop;
-
-		if (qch->version == QUIC_V1)
-			qtype = quic_convtype_v1(qtype);
-		else if (qch->version == QUIC_V2) 
-			qtype = quic_convtype_v2(qtype);
-
-		if (qtype != QUIC_INITIAL_TYPE) {
-			lgtrace_addp("quic message type: %d", qtype);
-			goto accept_quic;
-		}
-		
-		lgtrace_addp("quic initial message");
-	}
-
-/*
-	if (1) {
-		lgtrace_addp("Probe udp");
-		if (ipver == IP4VERSION && ntohs(udph->dest) > 30) {
-			lgtrace_addp("udp fool");
-			const uint8_t *payload;
-			uint32_t payload_len;
-
-			uint32_t poses[10];
-			int cnt = 3;
-
-			poses[0] = 8;
-			for (int i = 1; i < cnt; i++) {
-				poses[i] = poses[i - 1] + 8;
+	else if (section->udp_mode == UDP_MODE_FAKE) {
+		for (int i = 0; i < section->udp_fake_seq_len; i++) {
+			NETBUF_ALLOC(fake_udp, MAX_PACKET_SIZE);
+			if (!NETBUF_CHECK(fake_udp)) {
+				lgerror(-ENOMEM, "Allocation error");
+				return -ENOMEM;
 			}
+			uint32_t fsn_len = MAX_PACKET_SIZE;
 
-			ret = send_ip4_frags(pkt, pktlen, poses, cnt, 0);
+			struct udp_fake_type fake_type = {
+				.fake_len = section->udp_fake_len,
+				.strategy = {
+					.strategy = section->udp_faking_strategy,
+				},
+			};
+			ret = gen_fake_udp(fake_type, iph, iph_len, udph, fake_udp, &fsn_len);
 			if (ret < 0) {
-				lgerror("ip4 send frags", ret);
-				goto accept;
+				lgerror(ret, "gen_fake_udp");
+				goto erret_lc;
 			}
 
-			goto drop;
-		} else {
-			lginfo("WARNING: IP fragmentation is supported only for IPv4\n");	
+			lgtrace_addp("post fake udp #%d", i + 1);
+
+			ret = instance_config.send_raw_packet(fake_udp, fsn_len);
+			if (ret < 0) {
+				lgerror(ret, "send fake udp");
+				goto erret_lc;
+			}
+						
+			NETBUF_FREE(fake_udp);
+			continue;
+erret_lc:
+			NETBUF_FREE(fake_udp);
 			goto accept;
 		}
-	}
-*/
 
+		
+		ret = instance_config.send_raw_packet(pkt, pktlen);
+		goto drop;
+	}
 
 continue_flow:
-	lgtrace_addp("continue_flow");
 	return PKT_CONTINUE;
-accept_quic:
 accept:
 	return PKT_ACCEPT;
 drop:
@@ -456,6 +450,7 @@ int send_ip4_frags(const struct section_config_t *section, const uint8_t *packet
 			return -ENOMEM;
 		}
 
+/*
 		NETBUF_ALLOC(fake_pad, MAX_PACKET_SIZE);
 		if (!NETBUF_CHECK(fake_pad)) {
 			lgerror(-ENOMEM, "Allocation error");
@@ -463,10 +458,11 @@ int send_ip4_frags(const struct section_config_t *section, const uint8_t *packet
 			NETBUF_FREE(frag2);
 			return -ENOMEM;
 		}
+*/
 
 		uint32_t f1len = MAX_PACKET_SIZE;
 		uint32_t f2len = MAX_PACKET_SIZE;
-		uint32_t fake_pad_len = MAX_PACKET_SIZE;
+		// uint32_t fake_pad_len = MAX_PACKET_SIZE;
 
 		int ret;
 
@@ -542,12 +538,12 @@ send_frag2:
 out_lc:
 		NETBUF_FREE(frag1);
 		NETBUF_FREE(frag2);
-		NETBUF_FREE(fake_pad);
+		// NETBUF_FREE(fake_pad);
 		goto out;
 erret_lc:
 		NETBUF_FREE(frag1);
 		NETBUF_FREE(frag2);
-		NETBUF_FREE(fake_pad);
+		// NETBUF_FREE(fake_pad);
 		return ret;
 	}
 

quic.c

@@ -43,7 +43,7 @@ int quic_parse_data(uint8_t *raw_payload, uint32_t raw_payload_len,
 	uint32_t left_len = raw_payload_len - sizeof(struct quic_lhdr);
 	uint8_t *cur_rawptr = raw_payload + sizeof(struct quic_lhdr);
 	if (!nqch->fixed) {
-		lgtrace_addp("quic fixed uset");
+		lgtrace_addp("quic fixed unset");
 		return -EPROTO;
 	}
 
@@ -138,3 +138,183 @@ invalid_packet:
 	lgerror(-EINVAL, "QUIC invalid Initial packet");
 	return -EINVAL;
 }
+
+int udp_fail_packet(struct udp_failing_strategy strategy, uint8_t *payload, uint32_t *plen, uint32_t avail_buflen) {
+	void *iph;
+	uint32_t iph_len;
+	struct udphdr *udph;
+	uint8_t *data;
+	uint32_t dlen;
+	int ret;
+
+	ret = udp_payload_split(payload, *plen, 
+			&iph, &iph_len, &udph,
+			&data, &dlen);
+
+	uint32_t ipxv = netproto_version(payload, *plen);
+
+	if (ret < 0) {
+		return ret;
+	}
+
+
+	if (strategy.strategy == FAKE_STRAT_TTL) {
+		lgtrace_addp("set fake ttl to %d", strategy.faking_ttl);
+
+		if (ipxv == IP4VERSION) {
+			((struct iphdr *)iph)->ttl = strategy.faking_ttl;
+		} else if (ipxv == IP6VERSION) {
+			((struct ip6_hdr *)iph)->ip6_hops = strategy.faking_ttl;
+		} else {
+			lgerror(-EINVAL, "fail_packet: IP version is unsupported");
+			return -EINVAL;
+		}
+	}
+
+	if (ipxv == IP4VERSION) {
+		((struct iphdr *)iph)->frag_off = 0;
+	}
+
+
+	set_ip_checksum(iph, iph_len);
+
+	if (strategy.strategy == FAKE_STRAT_UDP_CHECK) {
+		lgtrace_addp("break fake udp checksum");
+		udph->check += 1;
+	}
+
+	return 0;
+}
+
+int gen_fake_udp(struct udp_fake_type type,
+		const void *ipxh, uint32_t iph_len, 
+		const struct udphdr *udph,
+		uint8_t *buf, uint32_t *buflen) {
+	uint32_t data_len = type.fake_len;
+
+	if (!ipxh || !udph || !buf || !buflen)
+		return -EINVAL;
+
+	int ipxv = netproto_version(ipxh, iph_len);
+
+	if (ipxv == IP4VERSION) {
+		const struct iphdr *iph = ipxh;
+
+		memcpy(buf, iph, iph_len);
+		struct iphdr *niph = (struct iphdr *)buf;
+
+		niph->protocol = IPPROTO_UDP;
+	} else if (ipxv == IP6VERSION) {
+		const struct ip6_hdr *iph = ipxh;
+
+		iph_len = sizeof(struct ip6_hdr);
+		memcpy(buf, iph, iph_len);
+		struct ip6_hdr *niph = (struct ip6_hdr *)buf;
+
+		niph->ip6_nxt = IPPROTO_UDP;
+	} else {
+		return -EINVAL;
+	}
+
+	uint32_t dlen = iph_len + sizeof(struct udphdr) + data_len;
+
+	if (*buflen < dlen) 
+		return -ENOMEM;
+
+	memcpy(buf + iph_len, udph, sizeof(struct udphdr));
+	uint8_t *bfdptr = buf + iph_len + sizeof(struct udphdr);
+
+	memset(bfdptr, 0, data_len);
+
+	if (ipxv == IP4VERSION) {
+		struct iphdr *niph = (struct iphdr *)buf;
+		niph->tot_len = htons(dlen);
+		niph->id = randint();
+	} else if (ipxv == IP6VERSION) {
+		struct ip6_hdr *niph = (struct ip6_hdr *)buf;
+		niph->ip6_plen = htons(dlen - iph_len);
+	}
+
+	struct udphdr *nudph = (struct udphdr *)(buf + iph_len);
+	nudph->len = htons(sizeof(struct udphdr) + data_len);
+
+
+	udp_fail_packet(type.strategy, buf, &dlen, *buflen);
+
+	*buflen = dlen;
+	
+	return 0;
+}
+
+int detect_udp_filtered(const struct section_config_t *section,
+			const uint8_t *payload, uint32_t plen) {
+	const void *iph;
+	uint32_t iph_len;
+	const struct udphdr *udph;
+	const uint8_t *data;
+	uint32_t dlen;
+	int ret;
+
+	ret = udp_payload_split((uint8_t *)payload, plen,
+			      (void **)&iph, &iph_len, 
+			      (struct udphdr **)&udph,
+			      (uint8_t **)&data, &dlen);
+	int udp_dport = ntohs(udph->dest);
+	lgtrace_addp("UDP dport: %d", udp_dport);
+
+	
+	if (ret < 0) {
+		goto skip;
+	}
+	
+	if (section->udp_filter_quic) {
+		const struct quic_lhdr *qch;
+		uint32_t qch_len;
+		struct quic_cids qci;
+		uint8_t *quic_raw_payload;
+		uint32_t quic_raw_plen;
+
+		lgtrace_addp("QUIC probe");
+
+		ret = quic_parse_data((uint8_t *)data, dlen, 
+			 (struct quic_lhdr **)&qch, &qch_len, &qci, 
+			 &quic_raw_payload, &quic_raw_plen);
+
+		if (ret < 0) {
+			lgtrace_addp("QUIC undefined type");
+			goto match_port;
+		}
+
+		lgtrace_addp("QUIC detected");
+
+		uint8_t qtype = qch->type;
+		if (qch->version == QUIC_V1)
+			qtype = quic_convtype_v1(qtype);
+		else if (qch->version == QUIC_V2) 
+			qtype = quic_convtype_v2(qtype);
+
+		if (qtype != QUIC_INITIAL_TYPE) {
+			lgtrace_addp("QUIC message type: %d", qtype);
+			goto match_port;
+		}
+
+		lgtrace_addp("QUIC initial message");
+
+		goto approve;
+	}
+
+match_port:
+
+	for (int i = 0; i < section->udp_dport_range_len; i++) {
+		struct udp_dport_range crange = section->udp_dport_range[i];
+		if (udp_dport >= crange.start && udp_dport <= crange.end) {
+			lgtrace_addp("matched to %d-%d", crange.start, crange.end);
+			goto approve;
+		}
+	}
+
+skip:
+	return 0;
+approve:
+	return 1;
+}

quic.h

@@ -1,6 +1,7 @@
 #ifndef QUIC_H
 #define QUIC_H
 #include "types.h"
+#include "utils.h"
 
 
 /**
@@ -125,4 +126,16 @@ int quic_parse_initial_message(uint8_t *inpayload, uint32_t inplen,
 			struct quici_hdr *qhdr,
 			uint8_t **payload, uint32_t *plen);
 
+// Like fail_packet for TCP
+int udp_fail_packet(struct udp_failing_strategy strategy, uint8_t *payload, uint32_t *plen, uint32_t avail_buflen);
+
+// Like gen_fake_sni for TCP
+int gen_fake_udp(struct udp_fake_type type,
+		const void *ipxh, uint32_t iph_len, 
+		const struct udphdr *udph,
+		uint8_t *buf, uint32_t *buflen);
+
+int detect_udp_filtered(const struct section_config_t *section,
+			const uint8_t *payload, uint32_t plen);
+
 #endif /* QUIC_H */

tls.c

@@ -9,6 +9,114 @@
 #include <unistd.h>
 #endif
 
+static int bruteforce_analyze_sni_str(
+	const struct section_config_t *section,
+	const uint8_t *data, size_t dlen,
+	struct tls_verdict *vrd
+) {
+	if (section->all_domains) {
+		vrd->target_sni = 1;
+		vrd->sni_len = 0;
+		vrd->sni_offset = dlen / 2;
+		return 0;
+	}
+
+	for (struct domains_list *sne = section->sni_domains; sne != NULL; sne = sne->next) {
+		const char *domain_startp = sne->domain_name;
+		int domain_len = sne->domain_len;
+
+		if (sne->domain_len + dlen + 1 > MAX_PACKET_SIZE) { 
+			continue;
+		}
+
+		NETBUF_ALLOC(buf, MAX_PACKET_SIZE);
+		if (!NETBUF_CHECK(buf)) {
+			lgerror(-ENOMEM, "Allocation error");
+			return -ENOMEM;
+		}
+		NETBUF_ALLOC(nzbuf, MAX_PACKET_SIZE * sizeof(int));
+		if (!NETBUF_CHECK(nzbuf)) {
+			lgerror(-ENOMEM, "Allocation error");
+			NETBUF_FREE(buf);
+			return -ENOMEM;
+		}
+
+		int *zbuf = (void *)nzbuf;
+
+		memcpy(buf, domain_startp, domain_len);
+		memcpy(buf + domain_len, "#", 1);
+		memcpy(buf + domain_len + 1, data, dlen);
+
+		z_function((char *)buf, zbuf, domain_len + 1 + dlen);
+
+		for (unsigned int k = 0; k < dlen; k++) {
+			if (zbuf[k] == domain_len) {
+				vrd->target_sni = 1;
+				vrd->sni_len = domain_len;
+				vrd->sni_offset = (k - domain_len - 1);
+				vrd->sni_target_offset = vrd->sni_offset;
+				vrd->sni_target_len = vrd->sni_len;
+				NETBUF_FREE(buf);
+				NETBUF_FREE(nzbuf);
+				return 0;
+			}
+		}
+
+
+		NETBUF_FREE(buf);
+		NETBUF_FREE(nzbuf);
+	}
+
+	return 0;
+}
+static int analyze_sni_str(
+	const struct section_config_t *section,
+	const char *sni_name, int sni_len, const uint8_t *data, 
+	struct tls_verdict *vrd
+) {
+	if (section->all_domains) {
+		vrd->target_sni = 1;
+		goto check_domain;
+	}
+		
+	for (struct domains_list *sne = section->sni_domains; sne != NULL; sne = sne->next) {
+		const char *sni_startp = sni_name + sni_len - sne->domain_len;
+		const char *domain_startp = sne->domain_name;
+
+		if (sni_len >= sne->domain_len &&
+			sni_len < 128 && 
+			!strncmp(sni_startp, 
+			domain_startp, 
+			sne->domain_len)) {
+				vrd->target_sni = 1;
+				vrd->sni_target_offset = (const uint8_t *)sni_startp - data;
+				vrd->sni_target_len = sne->domain_len;
+				break;
+		}
+	}
+
+check_domain:
+	if (vrd->target_sni == 1) {
+		for (struct domains_list *sne = section->exclude_sni_domains; sne != NULL; sne = sne->next) {
+			const char *sni_startp = sni_name + sni_len - sne->domain_len;
+			const char *domain_startp = sne->domain_name;
+
+			if (sni_len >= sne->domain_len &&
+				sni_len < 128 && 
+				!strncmp(sni_startp, 
+				domain_startp, 
+				sne->domain_len)) {
+					vrd->target_sni = 0;
+					lgdebugmsg("Excluded SNI: %.*s", 
+						vrd->sni_len, data + vrd->sni_offset);
+			}
+		}
+	}
+
+	return 0;
+}
+
+
 #define TLS_CONTENT_TYPE_HANDSHAKE 0x16
 #define TLS_HANDSHAKE_TYPE_CLIENT_HELLO 0x01
 #define TLS_EXTENSION_SNI 0x0000
@@ -30,6 +138,11 @@ struct tls_verdict analyze_tls_data(
 	size_t i = 0;
 	const uint8_t *data_end = data + dlen;
 
+	if (section->sni_detection == SNI_DETECTION_BRUTE) {
+		bruteforce_analyze_sni_str(section, data, dlen, &vrd);
+		goto out;
+	}
+
 	while (i + 4 < dlen) {
 		const uint8_t *msgData = data + i;
 
@@ -44,10 +157,6 @@ struct tls_verdict analyze_tls_data(
 		if (tls_content_type != TLS_CONTENT_TYPE_HANDSHAKE) 
 			goto nextMessage;
 
-		if (section->sni_detection == SNI_DETECTION_BRUTE) {
-			goto brute;
-		}
-
 		const uint8_t *handshakeProto = msgData + 5;
 
 		if (handshakeProto + 1 >= data_end) break;
@@ -120,76 +229,14 @@ struct tls_verdict analyze_tls_data(
 
 			if (sni_ext_ptr + sni_len > sni_ext_end) break;
 
-			char *sni_name = (char *)sni_ext_ptr;
+			const char *sni_name = (char *)sni_ext_ptr;
 
 			vrd.sni_offset = (uint8_t *)sni_name - data;
 			vrd.sni_target_offset = vrd.sni_offset;
 			vrd.sni_len = sni_len;
 			vrd.sni_target_len = vrd.sni_len;
 
-			if (section->all_domains) {
-				vrd.target_sni = 1;
-				goto check_domain;
-			}
-
-			unsigned int j = 0;
-			for (unsigned int i = 0; i <= section->domains_strlen; i++) {
-				if (	i > j &&
-					(i == section->domains_strlen	||	
-					section->domains_str[i] == '\0'	||
-					section->domains_str[i] == ','	|| 
-					section->domains_str[i] == '\n'	)) {
-
-					unsigned int domain_len = (i - j);
-					const char *sni_startp = sni_name + sni_len - domain_len;
-					const char *domain_startp = section->domains_str + j;
-
-					if (sni_len >= domain_len &&
-						sni_len < 128 && 
-						!strncmp(sni_startp, 
-						domain_startp, 
-						domain_len)) {
-							vrd.target_sni = 1;
-							vrd.sni_target_offset = (const uint8_t *)sni_startp - data;
-							vrd.sni_target_len = domain_len;
-							goto check_domain;
-					}
-
-					j = i + 1;
-				}
-			}
-
-check_domain:
-			if (vrd.target_sni == 1 && section->exclude_domains_strlen != 0) {
-				unsigned int j = 0;
-				for (unsigned int i = 0; i <= section->exclude_domains_strlen; i++) {
-					if (	i > j &&
-						(i == section->exclude_domains_strlen	||	
-						section->exclude_domains_str[i] == '\0'	||
-						section->exclude_domains_str[i] == ','	|| 
-						section->exclude_domains_str[i] == '\n'	)) {
-
-						unsigned int domain_len = (i - j);
-						const char *sni_startp = sni_name + sni_len - domain_len;
-						const char *domain_startp = section->exclude_domains_str + j;
-
-						if (sni_len >= domain_len &&
-							sni_len < 128 && 
-							!strncmp(sni_startp, 
-							domain_startp, 
-							domain_len)) {
-
-							vrd.target_sni = 0;
-							lgdebugmsg("Excluded SNI: %.*s", 
-								vrd.sni_len, data + vrd.sni_offset);
-							goto out;
-						}
-
-						j = i + 1;
-					}
-				}
-			}
-
+			analyze_sni_str(section, sni_name, sni_len, data, &vrd);
 			goto out;
 
 nextExtension:
@@ -201,73 +248,6 @@ nextMessage:
 
 out:
 	return vrd;
-
-
-brute:
-	if (section->all_domains) {
-		vrd.target_sni = 1;
-		vrd.sni_len = 0;
-		vrd.sni_offset = dlen / 2;
-		goto out;
-	}
-
-	unsigned int j = 0;
-	for (unsigned int i = 0; i <= section->domains_strlen; i++) {
-		if (	i > j &&
-			(i == section->domains_strlen	||	
-			section->domains_str[i] == '\0'	||
-			section->domains_str[i] == ','	|| 
-			section->domains_str[i] == '\n'	)) {
-
-			unsigned int domain_len = (i - j);
-			const char *domain_startp = section->domains_str + j;
-
-			if (domain_len + dlen + 1> MAX_PACKET_SIZE) { 
-				continue;
-			}
-
-			NETBUF_ALLOC(buf, MAX_PACKET_SIZE);
-			if (!NETBUF_CHECK(buf)) {
-				lgerror(-ENOMEM, "Allocation error");
-				goto out;
-			}
-			NETBUF_ALLOC(nzbuf, MAX_PACKET_SIZE * sizeof(int));
-			if (!NETBUF_CHECK(nzbuf)) {
-				lgerror(-ENOMEM, "Allocation error");
-				NETBUF_FREE(buf);
-				goto out;
-			}
-
-			int *zbuf = (void *)nzbuf;
-
-			memcpy(buf, domain_startp, domain_len);
-			memcpy(buf + domain_len, "#", 1);
-			memcpy(buf + domain_len + 1, data, dlen);
-
-			z_function((char *)buf, zbuf, domain_len + 1 + dlen);
-
-			for (unsigned int k = 0; k < dlen; k++) {
-				if (zbuf[k] == domain_len) {
-					vrd.target_sni = 1;
-					vrd.sni_len = domain_len;
-					vrd.sni_offset = (k - domain_len - 1);
-					vrd.sni_target_offset = vrd.sni_offset;
-					vrd.sni_target_len = vrd.sni_len;
-					NETBUF_FREE(buf);
-					NETBUF_FREE(nzbuf);
-					goto out;
-				}
-			}
-
-
-			j = i + 1;
-
-			NETBUF_FREE(buf);
-			NETBUF_FREE(nzbuf);
-		}
-	}
-
-	goto out;
 }
 
 int gen_fake_sni(struct fake_type type,
@@ -275,7 +255,6 @@ int gen_fake_sni(struct fake_type type,
 		const struct tcphdr *tcph, uint32_t tcph_len,
 		uint8_t *buf, uint32_t *buflen) {
 	uint32_t data_len = type.fake_len;
-	int ret;
 
 	if (type.type == FAKE_PAYLOAD_RANDOM && data_len == 0) {
 		data_len = (uint32_t)randint() % 1200;
@@ -322,7 +301,8 @@ int gen_fake_sni(struct fake_type type,
 			get_random_bytes(bfdptr, data_len);
 #else /* KERNEL_SPACE */
 #if _NO_GETRANDOM
-			ret = open("/dev/urandom", O_RDONLY);
+		{
+			int ret = open("/dev/urandom", O_RDONLY);
 			if (ret < 0) {
 				lgerror(ret, "Unable to open /dev/urandom");
 				return ret;
@@ -330,7 +310,7 @@ int gen_fake_sni(struct fake_type type,
 			
 			read(ret, bfdptr, data_len);
 			close(ret);
-			
+		}
 #else /* _NO_GETRANDOM */
 			getrandom(bfdptr, data_len, 0);
 #endif /* _NO_GETRANDOM */

types.h

@@ -34,6 +34,9 @@
 #include <linux/tcp.h> // IWYU pragma: export
 #include <linux/version.h>
 
+#define free kfree
+#define malloc(size) kmalloc((size), GFP_KERNEL)
+
 #define ip6_hdr ipv6hdr
 
 /* from <netinet/ip.h> */
@@ -67,6 +70,11 @@
 #include <netinet/udp.h>	// IWYU pragma: export
 #endif
 
+#define SFREE(item) do {	\
+free((item));			\
+(item) = NULL;			\
+} while (0)
+
 #ifndef KERNEL_SPACE
 
 #define max(a,b)__extension__\

uspace.mk

@@ -31,7 +31,7 @@ export CC CCLD LD CFLAGS LDFLAGS LIBNFNETLINK_CFLAGS LIBNFNETLINK_LIBS LIBMNL_CF
 
 APP:=$(BUILD_DIR)/youtubeUnblock
 
-SRCS := youtubeUnblock.c mangle.c args.c utils.c quic.c tls.c
+SRCS := youtubeUnblock.c mangle.c args.c utils.c quic.c tls.c getopt.c
 OBJS := $(SRCS:%.c=$(BUILD_DIR)/%.o)
 
 LIBNFNETLINK := $(DEPSDIR)/lib/libnfnetlink.la

utils.c

@@ -514,7 +514,9 @@ void z_function(const char *str, int *zbuf, size_t len) {
 	for (int i = 1; i < (int)len; i++) {
 		zbuf[i] = 0;
 		if (i < rh) {
-			zbuf[i] = min(zbuf[i - lh], rh - i);
+			zbuf[i] = zbuf[i - lh];
+			if (rh - i < zbuf[i])
+				zbuf[i] = rh - i;
 		}
 
 		while (i + zbuf[i] < len && str[zbuf[i]] == str[i + zbuf[i]])

utils.h

@@ -142,6 +142,20 @@ struct fake_type {
 	struct failing_strategy strategy;
 };
 
+struct udp_failing_strategy {
+	unsigned int strategy;
+	uint8_t faking_ttl;
+};
+
+struct udp_fake_type {
+	uint16_t fake_len;
+
+	// faking strategy of the fake packet.
+	// Does not support bitmask, pass standalone strategy.
+	// Pass 0 if you don't want any faking procedures.
+	struct udp_failing_strategy strategy;
+};
+
 /**
  * Invalidates the raw packet. The function aims to invalid the packet
  * in such way as it will be accepted by DPI, but dropped by target server

youtubeUnblock.c

@@ -45,12 +45,12 @@ static int open_socket(struct mnl_socket **_nl) {
 	nl = mnl_socket_open(NETLINK_NETFILTER);
 
 	if (nl == NULL) {
-		lgerror(errno, "mnl_socket_open");
+		lgerror(-errno, "mnl_socket_open");
 		return -1;
 	}
 
 	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
-		lgerror(errno, "mnl_socket_bind");
+		lgerror(-errno, "mnl_socket_bind");
 		mnl_socket_close(nl);
 		return -1;
 	}
@@ -65,7 +65,7 @@ static int close_socket(struct mnl_socket **_nl) {
 	struct mnl_socket *nl = *_nl;
 	if (nl == NULL) return 1;
 	if (mnl_socket_close(nl) < 0) {
-		lgerror(errno, "mnl_socket_close");
+		lgerror(-errno, "mnl_socket_close");
 		return -1;
 	}
 
@@ -77,26 +77,26 @@ static int close_socket(struct mnl_socket **_nl) {
 static int open_raw_socket(void) {
 	if (rawsocket != -2) {
 		errno = EALREADY;
-		lgerror(errno, "Raw socket is already opened");
+		lgerror(-errno, "Raw socket is already opened");
 		return -1;
 	}
 	
 	rawsocket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 	if (rawsocket == -1) {
-		lgerror(errno, "Unable to create raw socket");
+		lgerror(-errno, "Unable to create raw socket");
 		return -1;
 	}
 
 	int mark = config.mark;
 	if (setsockopt(rawsocket, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0)
 	{
-		lgerror(errno, "setsockopt(SO_MARK, %d) failed\n", mark);
+		lgerror(-errno, "setsockopt(SO_MARK, %d) failed\n", mark);
 		return -1;
 	}
 
 	int mst = pthread_mutex_init(&rawsocket_lock, NULL);
 	if (mst) {
-		lgerror(errno, "Mutex err: %d\n", mst);
+		lgerror(-errno, "Mutex err: %d\n", mst);
 		close(rawsocket);
 		errno = mst;
 
@@ -110,12 +110,12 @@ static int open_raw_socket(void) {
 static int close_raw_socket(void) {
 	if (rawsocket < 0) {
 		errno = EALREADY;
-		lgerror(errno, "Raw socket is not set");
+		lgerror(-errno, "Raw socket is not set");
 		return -1;
 	}
 
 	if (close(rawsocket)) {
-		lgerror(errno, "Unable to close raw socket");
+		lgerror(-errno, "Unable to close raw socket");
 		pthread_mutex_destroy(&rawsocket_lock);
 		return -1;
 	}
@@ -129,28 +129,27 @@ static int close_raw_socket(void) {
 static int open_raw6_socket(void) {
 	if (raw6socket != -2) {
 		errno = EALREADY;
-		lgerror(errno, "Raw socket is already opened");
+		lgerror(-errno, "Raw socket is already opened");
 		return -1;
 	}
 	
 	raw6socket = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW);
 	if (rawsocket == -1) {
-		lgerror(errno, "Unable to create raw socket");
+		lgerror(-errno, "Unable to create raw socket");
 		return -1;
 	}
 
 	int mark = config.mark;
 	if (setsockopt(raw6socket, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0)
 	{
-		lgerror(errno, "setsockopt(SO_MARK, %d) failed\n", mark);
+		lgerror(-errno, "setsockopt(SO_MARK, %d) failed\n", mark);
 		return -1;
 	}
 
 	int mst = pthread_mutex_init(&raw6socket_lock, NULL);
 	if (mst) {
-		lgerror(mst, "Mutex err: %d\n", mst);
+		lgerror(-errno, "Mutex err: %d\n", mst);
 		close(raw6socket);
-		errno = mst;
 
 		return -1;
 	}
@@ -162,12 +161,12 @@ static int open_raw6_socket(void) {
 static int close_raw6_socket(void) {
 	if (raw6socket < 0) {
 		errno = EALREADY;
-		lgerror(errno, "Raw socket is not set");
+		lgerror(-errno, "Raw socket is not set");
 		return -1;
 	}
 
 	if (close(raw6socket)) {
-		lgerror(errno, "Unable to close raw socket");
+		lgerror(-errno, "Unable to close raw socket");
 		pthread_mutex_destroy(&rawsocket_lock);
 		return -1;
 	}
@@ -345,7 +344,7 @@ static int fallback_accept_packet(uint32_t id, struct queue_data qdata) {
         nfq_nlmsg_verdict_put(verdnlh, id, NF_ACCEPT);
 
         if (mnl_socket_sendto(*qdata._nl, verdnlh, verdnlh->nlmsg_len) < 0) {
-                lgerror(errno, "mnl_socket_send");
+                lgerror(-errno, "mnl_socket_send");
                 return MNL_CB_ERROR;
         }
 
@@ -370,7 +369,7 @@ void *delay_packet_send_fn(void *data) {
 	int ret = send_raw_socket(pkt, pktlen);
 	if (ret < 0) {
 		errno = -ret;
-		lgerror(errno, "send delayed raw packet");
+		lgerror(-errno, "send delayed raw packet");
 	}
 
 	free(pkt);
@@ -402,13 +401,13 @@ static int queue_cb(const struct nlmsghdr *nlh, void *data) {
 	struct packet_data packet = {0};
 
         if (nfq_nlmsg_parse(nlh, attr) < 0) {
-                lgerror(errno, "Attr parse");
+                lgerror(-errno, "Attr parse");
                 return MNL_CB_ERROR;
         }
  
         if (attr[NFQA_PACKET_HDR] == NULL) {
 		errno = ENODATA;
-                lgerror(errno, "Metaheader not set");
+                lgerror(-errno, "Metaheader not set");
                 return MNL_CB_ERROR;
         }
 
@@ -449,7 +448,7 @@ static int queue_cb(const struct nlmsghdr *nlh, void *data) {
 	}
 
         if (mnl_socket_sendto(*qdata->_nl, verdnlh, verdnlh->nlmsg_len) < 0) {
-                lgerror(errno, "mnl_socket_send");
+                lgerror(-errno, "mnl_socket_send");
                 return MNL_CB_ERROR;
         }
 	
@@ -462,7 +461,7 @@ int init_queue(int queue_num) {
 	struct mnl_socket *nl;
 
 	if (open_socket(&nl)) {
-		lgerror(errno, "Unable to open socket");
+		lgerror(-errno, "Unable to open socket");
 		return -1;
 	}
 
@@ -484,7 +483,7 @@ int init_queue(int queue_num) {
 	nfq_nlmsg_cfg_put_cmd(nlh, PF_INET, NFQNL_CFG_CMD_PF_UNBIND);
 
 	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		lgerror(errno, "mnl_socket_send");
+		lgerror(-errno, "mnl_socket_send");
 		goto die;
 	}
 
@@ -492,7 +491,7 @@ int init_queue(int queue_num) {
 	nfq_nlmsg_cfg_put_cmd(nlh, PF_INET, NFQNL_CFG_CMD_PF_BIND);
 
 	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		lgerror(errno, "mnl_socket_send");
+		lgerror(-errno, "mnl_socket_send");
 		goto die;
 	}
 
@@ -501,7 +500,7 @@ int init_queue(int queue_num) {
 		nfq_nlmsg_cfg_put_cmd(nlh, PF_INET6, NFQNL_CFG_CMD_PF_UNBIND);
 
 		if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-			lgerror(errno, "mnl_socket_send");
+			lgerror(-errno, "mnl_socket_send");
 			goto die;
 		}
 
@@ -509,7 +508,7 @@ int init_queue(int queue_num) {
 		nfq_nlmsg_cfg_put_cmd(nlh, PF_INET6, NFQNL_CFG_CMD_PF_BIND);
 
 		if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-			lgerror(errno, "mnl_socket_send");
+			lgerror(-errno, "mnl_socket_send");
 			goto die;
 		}
 	}
@@ -519,7 +518,7 @@ int init_queue(int queue_num) {
 	nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND);
 
 	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		lgerror(errno, "mnl_socket_send");
+		lgerror(-errno, "mnl_socket_send");
 		goto die;
 	}
 
@@ -532,7 +531,7 @@ int init_queue(int queue_num) {
 	}
 
 	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		lgerror(errno, "mnl_socket_send");
+		lgerror(-errno, "mnl_socket_send");
 		goto die;
 	}
 
@@ -554,7 +553,7 @@ int init_queue(int queue_num) {
 	while (1) {
 		ret = mnl_socket_recvfrom(nl, buf, BUF_SIZE);
 		if (ret == -1) {
-			lgerror(errno, "mnl_socket_recvfrom");
+			lgerror(-errno, "mnl_socket_recvfrom");
 			goto die;
 		}
 
@@ -562,9 +561,9 @@ int init_queue(int queue_num) {
 		if (ret < 0) {
 			lgerror(-EPERM, "mnl_cb_run");
 			if (errno == EPERM) {
-				lgerror(errno, "Probably another instance of youtubeUnblock with the same queue number is running\n");
+				lgerror(-errno, "Probably another instance of youtubeUnblock with the same queue number is running\n");
 			} else {
-				lgerror(errno, "Make sure the nfnetlink_queue kernel module is loaded\n");
+				lgerror(-errno, "Make sure the nfnetlink_queue kernel module is loaded\n");
 			}
 			goto die;
 		}
@@ -613,9 +612,9 @@ struct instance_config_t instance_config = {
 
 int main(int argc, char *argv[]) {
 	int ret;
-	if ((ret = parse_args(argc, argv)) != 0) {
+	if ((ret = yparse_args(argc, argv)) != 0) {
 		if (ret < 0) {
-			lgerror(errno, "Unable to parse args");
+			lgerror(-errno, "Unable to parse args");
 			exit(EXIT_FAILURE);
 		}
 		exit(EXIT_SUCCESS);
@@ -626,13 +625,13 @@ int main(int argc, char *argv[]) {
 
 
 	if (open_raw_socket() < 0) {
-		lgerror(errno, "Unable to open raw socket");
+		lgerror(-errno, "Unable to open raw socket");
 		exit(EXIT_FAILURE);
 	}
 
 	if (config.use_ipv6) {
 		if (open_raw6_socket() < 0) {
-			lgerror(errno, "Unable to open raw socket for ipv6");
+			lgerror(-errno, "Unable to open raw socket for ipv6");
 			close_raw_socket();
 			exit(EXIT_FAILURE);
 		}