autottl, datanoack, oob, postnat

init.d/sysv/custom-nfqws-dht4all

@@ -21,7 +21,7 @@ zapret_custom_firewall()
 
         local MODE_OVERRIDE=nfqws
         local f uf4 uf6
-        local first_packet_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:1"
+        local first_packet_only="$ipt_connbytes 1:1"
         local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
 
         zapret_do_firewall_rules_ipt $1
@@ -38,7 +38,7 @@ zapret_custom_firewall_nft()
 
         local MODE_OVERRIDE=nfqws
         local f
-        local first_packet_only="ct original packets 1"
+        local first_packet_only="$nft_connbytes 1"
         local desync="mark and $DESYNC_MARK == 0"
 
         zapret_apply_firewall_rules_nft

init.d/sysv/custom-nfqws-quic4all

@@ -1,6 +1,5 @@
 # this custom script in addition to MODE=nfqws runs desync to all QUIC initial packets, without ipset/hostlist filtering
 # need to add to config : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake"
-# russian TSPU version  : NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_short_header.bin"
 # NOTE : do not use TTL fooling. chromium QUIC engine breaks sessions if TTL expired in transit received
 
 QNUM2=$(($QNUM+10))
@@ -23,7 +22,7 @@ zapret_custom_firewall()
 
 	local MODE_OVERRIDE=nfqws
 	local f
-	local first_packets_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:3"
+	local first_packets_only="$ipt_connbytes 1:3"
 	local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
 
 	zapret_do_firewall_rules_ipt $1
@@ -38,7 +37,7 @@ zapret_custom_firewall_nft()
 
 	local MODE_OVERRIDE=nfqws
 	local f
-	local first_packets_only="ct original packets 1-3"
+	local first_packets_only="$nft_connbytes 1-3"
 	local desync="mark and $DESYNC_MARK == 0"
 
 	zapret_apply_firewall_rules_nft

init.d/sysv/custom-tpws4http-nfqws4https

@@ -24,7 +24,7 @@ zapret_custom_firewall()
 	# $1 - 1 - run, 0 - stop
 
 	local f4 f6
-	local first_packet_only="-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:4"
+	local first_packet_only="$ipt_connbytes 1:$(first_packets_for_mode)"
 	local desync="-m mark ! --mark $DESYNC_MARK/$DESYNC_MARK"
 
 	[ "$MODE_HTTP" = "1" ] && {
@@ -39,14 +39,18 @@ zapret_custom_firewall()
 		f6=$f4
 		filter_apply_ipset_target f4 f6
 		fw_nfqws_post $1 "$f4 $desync" "$f6 $desync" $QNUM
+		# for modes that require incoming traffic
+		fw_reverse_nfqws_rule $1 "$f4" "$f6" $QNUM
 	}
 }
 zapret_custom_firewall_nft()
 {
 	# stop logic is not required
 
+	# do not use POSTNAT for udp first packet desync !
+	local POSTNAT=1
 	local f4 f6
-	local first_packet_only="ct original packets 1-4"
+	local first_packet_only="$nft_connbytes 1-$(first_packets_for_mode)"
 	local desync="mark and $DESYNC_MARK == 0"
 
 	[ "$MODE_HTTP" = "1" ] && {
@@ -61,5 +65,7 @@ zapret_custom_firewall_nft()
 		f6=$f4
 		nft_filter_apply_ipset_target f4 f6
 		nft_fw_nfqws_post "$f4 $desync" "$f6 $desync" $QNUM
+		# for modes that require incoming traffic
+		nft_fw_reverse_nfqws_rule "$f4" "$f6" $QNUM
 	}
 }

init.d/sysv/custom.default

@@ -0,0 +1,34 @@
+# this script contain your special code to launch daemons and configure firewall
+# use helpers from "functions" file
+# in case of upgrade keep this file only, do not modify others
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - run, 0 - stop
+
+	# PLACEHOLDER
+	echo !!! NEED ATTENTION !!!
+	echo Start daemon\(s\)
+	echo Study how other sections work
+
+	do_daemon $1 1 /bin/sleep 20
+}
+zapret_custom_firewall()
+{
+	# $1 - 1 - run, 0 - stop
+
+	# PLACEHOLDER
+	echo !!! NEED ATTENTION !!!
+	echo Configure iptables for required actions
+	echo Study how other sections work
+}
+
+zapret_custom_firewall_nft()
+{
+	# stop logic is not required
+
+	# PLACEHOLDER
+	echo !!! NEED ATTENTION !!!
+	echo Configure nftables for required actions
+	echo Study how other sections work
+}

init.d/sysv/functions

@@ -64,6 +64,9 @@ fi
 PIDDIR=/var/run
 IPSET_CR="$ZAPRET_BASE/ipset/create_ipset.sh"
 
+[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
+[ -n "$DESYNC_MARK_POSTNAT" ] || DESYNC_MARK_POSTNAT=0x20000000
+
 [ -n "$QNUM" ] || QNUM=200
 [ -n "$NFQWS" ] || NFQWS="$ZAPRET_BASE/nfq/nfqws"
 NFQWS_OPT_BASE="$USEROPT --dpi-desync-fwmark=$DESYNC_MARK"
@@ -81,8 +84,6 @@ TPWS_WAIT_SOCKS6="$TPWS_WAIT --bind-wait-ip-linklocal=30"
 # first wait for lan to ifup, then wait for bind-wait-ip-linklocal seconds for link local address and bind-wait-ip for any ipv6 as the worst case
 TPWS_OPT_BASE6_PRE="--bind-linklocal=prefer $TPWS_WAIT --bind-wait-ip-linklocal=3"
 
-[ -n "$DESYNC_MARK" ] || DESYNC_MARK=0x40000000
-
 # max wait time for the link local ipv6 on the LAN interface
 LINKLOCAL_WAIT_SEC=5