Bump version to v72.20251213

PR: https://github.com/remittor/zapret-openwrt/pull/443

.github/workflows/build.yml

@@ -143,8 +143,6 @@ jobs:
         exclude:
           - branch: SNAPSHOT
             arch: arm_cortex-a9_vfpv3-d16
-          - branch: SNAPSHOT
-            arch: arm_cortex-a7_neon-vfpv4
           - { isTestOrFake: true }
         include:
           - branch: openwrt-24.10
@@ -172,7 +170,8 @@ jobs:
         shell: bash
         run: |
           # gpg --verbose --recv-keys 0x1D53D1877742E911
-          gpg --verbose --import <(wget -qO- 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/0x1D53D1877742E911.asc')
+          # gpg --verbose --import <(wget -qO- 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/0x1D53D1877742E911.asc')
+          gpg --verbose --import <(wget -qO- 'https://raw.githubusercontent.com/openwrt/keyring/refs/heads/master/gpg/0x1D53D1877742E911.asc')
           # disable check signatures
           sed -i 's/gpg --/#gpg --/g' setup.sh
           # disable cleanup keys

luci-app-zapret/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-zapret
-PKG_VERSION:=72.20251122
+PKG_VERSION:=72.20251213
 PKG_LICENSE:=MIT
 PKG_MAINTAINER:=remittor <https://github.com/remittor>
 

luci-app-zapret/htdocs/luci-static/resources/view/zapret/dmnlog.js

@@ -173,16 +173,16 @@ return view.extend({
             
             let tab = E('div', { 'data-tab': tabname, 'data-tab-title': tabNameText }, [
                 E('div', { 'id': 'content_dmnlog_' + log_num }, [
-                    E('div', {'style': 'padding-bottom: 20px'}, [ scrollDownButton ]),
+                    E('div', {'style': 'margin-bottom: 20px; '}, [ scrollDownButton ]),
                     E('textarea', {
                         'id': log_id,
                         'name': log_name,
-                        'style': 'font-size:12px',
+                        'style': 'font-size:12px; width: 100%; max-height: 50vh;',
                         'readonly': 'readonly',
                         'wrap': 'off',
                         'rows': logdata[log_num].rows,
                     }, [ log_text ]),
-                    E('div', {'style': 'padding-bottom: 20px'}, [ scrollUpButton ]),
+                    E('div', {'style': 'margin-top: 20px'}, [ scrollUpButton ]),
                 ]),
             ]);
             

luci-app-zapret/htdocs/luci-static/resources/view/zapret/service.js

@@ -48,6 +48,7 @@ return view.extend({
             tools.getSvcInfo(),                     // svc_info
             fs.exec('/bin/busybox', [ 'ps' ]),      // process list
             fs.exec(tools.packager.path, tools.packager.args),  // installed packages
+            tools.getStratList(),                   // nfqws strategy list
             uci.load(tools.appName),              // config
         ]).catch(e => {
             ui.addNotification(null, E('p', _('Unable to execute or read contents')
@@ -71,6 +72,7 @@ return view.extend({
         let svc_info  = status_array[2];   // stdout: JSON as text
         let proc_list = status_array[3];   // stdout: multiline text
         let pkg_list  = status_array[4];   // stdout: installed packages
+        this.nfqws_strat_list = status_array[5];   // array of strat names
         
         //console.log('svc_en: ' + svc_en.code);
         svc_en = (svc_en.code == 0) ? true : false;
@@ -147,7 +149,7 @@ return view.extend({
         });
     },
 
-    serviceActionEx: function(action, button, hide_modal = false) {
+    serviceActionEx: function(action, button, args = [ ], hide_modal = false) {
         if (button) {
             let elem = document.getElementById(button);
             this.disableButtons(true, elem);
@@ -164,7 +166,7 @@ return view.extend({
         }
         else if (action == 'reset') {
             exec_cmd = tools.defaultCfgPath;
-            exec_arg = [ 'sync' ];  // restore config + sync configs
+            exec_arg = args;  // (reset_ipset)(sync) ==> restore all configs + sync config
             errmsg = _('Unable to run restore-def-cfg.sh script.');
             action = null;
         } else {
@@ -228,6 +230,33 @@ return view.extend({
 
     dialogResetCfg: function(ev) {
         ev.target.blur();
+
+        let reset_base = E('label', [
+            E('input', { type: 'checkbox', id: 'cfg_reset_base',  checked: true }),
+            ' ', _('Restore all base settings')
+        ]);
+        
+        let reset_ipset = E('label', [
+            E('input', { type: 'checkbox', id: 'cfg_reset_ipset',  checked: true }),
+            ' ', _('Restore ipset configs')
+        ]);
+
+        let set_autohostlist = E('label', [
+            E('input', { type: 'checkbox', id: 'cfg_autohostlist',  checked: true }),
+            ' ', _('Set AutoHostList mode')
+        ]);
+
+        let strat_list = [ ];
+        strat_list.push( E('option', { value: 'strat__skip__' }, [ '-' ] ) );
+        for (let id = 0; id < this.nfqws_strat_list.length; id++) {
+            let strat = '' + this.nfqws_strat_list[id];
+            strat_list.push( E('option', { value: 'strat_' + id }, [ strat ] ) );
+        }
+        let nfqws_strat = E('label', [
+            _('NFQWS_OPT strategy: '),
+            E('select', { id: 'cfg_nfqws_strat' }, strat_list)
+        ]);
+
         let cancel_button = E('button', {
             'class': btn_style_neutral,
             'click': ui.hideModal,
@@ -238,12 +267,35 @@ return view.extend({
         }, _('Reset settings'));
         resetcfg_btn.onclick = ui.createHandlerFn(this, () => {
             //cancel_button.disabled = true;
-            return this.serviceActionEx('reset', resetcfg_btn, true);
+            let opt_flags = '';
+            if (document.getElementById('cfg_reset_base').checked == false) {
+                opt_flags += '(skip_base)';
+            };
+            if (document.getElementById('cfg_reset_ipset').checked) {
+                opt_flags += '(reset_ipset)';
+            };
+            if (document.getElementById('cfg_autohostlist').checked) {
+                opt_flags += '(set_mode_autohostlist)';
+            };
+            //console.log('RESET: opt_flags = ' + opt_flags);
+            let sel_strat = document.getElementById('cfg_nfqws_strat');
+            let opt_strat = sel_strat.options[sel_strat.selectedIndex].text;
+            //console.log('RESET: strat = ' + opt_strat);
+            opt_flags += '(sync)';
+            let args = [ opt_flags, opt_strat ];
+            return this.serviceActionEx('reset', resetcfg_btn, args, true);
         });
 
         ui.showModal(_('Reset settings to default'), [
             E('div', { 'class': 'cbi-section' }, [
-                E('p', _('All settings will be reset to default. Continue?')),
+                reset_base,
+                E('br'), E('br'),
+                reset_ipset,
+                E('br'), E('br'),
+                set_autohostlist,
+                E('br'), E('br'),
+                nfqws_strat,
+                E('br'), E('br')
             ]),
             E('div', { 'class': 'right' }, [
                 cancel_button,

luci-app-zapret/htdocs/luci-static/resources/view/zapret/settings.js

@@ -90,11 +90,11 @@ return view.extend({
         o.rmempty = false;
         o.default = 1;
 
-        o = s.taboption(tabname, form.ListValue, 'MODE_FILTER', _('MODE_FILTER'));
+        //o = s.taboption(tabname, form.ListValue, 'MODE_FILTER', _('MODE_FILTER'));
         //o.value('none',         'none');
         //o.value('ipset',        'ipset');
-        o.value('hostlist',     'hostlist');
-        o.value('autohostlist', 'autohostlist');
+        //o.value('hostlist',     'hostlist');
+        //o.value('autohostlist', 'autohostlist');
 
         o = s.taboption(tabname, form.Value, 'WS_USER', _('WS_USER'));
         o.rmempty  = false;
@@ -213,6 +213,20 @@ return view.extend({
         tabname = 'autohostlist_tab'; 
         s.tab(tabname, _('AutoHostList'));
 
+        o = s.taboption(tabname, form.Flag, 'MODE_FILTER', _('Use AutoHostList mode'));
+        o.rmempty = false;
+        o.default = '0';
+        o.validate = function(section_id, value) { return true; };
+        o.load = function(section_id) {
+            return uci.load(tools.appName).then(L.bind(function() {
+                var v = uci.get(tools.appName, section_id, 'MODE_FILTER');
+                return (v === 'autohostlist') ? '1' : '0';
+            }, this));
+        };
+        o.write = function(section_id, value) {
+            return uci.set(tools.appName, section_id, 'MODE_FILTER', value === '1' ? 'autohostlist' : 'hostlist');
+        };
+        
         o = s.taboption(tabname, form.Value, 'AUTOHOSTLIST_RETRANS_THRESHOLD', _('RETRANS_THRESHOLD'));
         o.rmempty     = false;
         o.datatype    = 'uinteger';

luci-app-zapret/htdocs/luci-static/resources/view/zapret/tools.js

@@ -39,6 +39,7 @@ return baseclass.extend({
     appName           : 'zapret',
     execPath          : '/etc/init.d/zapret',
     syncCfgPath       : '/opt/zapret/sync_config.sh',
+    defCfgPath        : '/opt/zapret/def-cfg.sh',
     defaultCfgPath    : '/opt/zapret/restore-def-cfg.sh',
 
     hostsGoogleFN     : '/opt/zapret/ipset/zapret-hosts-google.txt',
@@ -139,6 +140,20 @@ return baseclass.extend({
         });
     },
 
+    getStratList: function() {
+        this.init_consts();
+        let exec_cmd = '/bin/busybox';
+        let exec_arg = [ 'awk', '-F', '"', '/if \\[ "\\$strat" = "/ {print $4}', this.defCfgPath ];
+        return fs.exec(exec_cmd, exec_arg).then(res => {
+            if (res.code == 0) {
+                return this.getWordsArray(res.stdout);
+            }
+            return [ ];
+        }).catch(e => {
+            ui.addNotification(null, E('p', _('Failed to get strat list: %s').format(e)));
+        });
+    },
+
     handleServiceAction: function(name, action) {
         return this.callInitAction(name, action).then(success => {
             if (!success) {
@@ -154,6 +169,12 @@ return baseclass.extend({
         return (v && typeof(v) === 'string') ? v.trim().replace(/\r?\n/g, '') : v;
     },
 
+    getWordsArray: function (text, { trim = true, removeEmpty = true } = {}) {
+        const rawLines = text.split(/\n/);
+        const processed = trim ? rawLines.map(line => line.trim()) : rawLines.slice();
+        return removeEmpty ? processed.filter(line => line.length > 0) : processed;
+    },
+
     decode_pkg_list: function(pkg_list) {
         let pkg_dict = { };
         let lines = pkg_list.trim().split('\n');
@@ -448,9 +469,12 @@ return baseclass.extend({
             if (typeof(value) === 'string') {
                 value = value.trim();
                 if (this.multiline == 2) {
-                    value = value.replace(/\n\t\t\t--/g, "\n--");
-                    value = value.replace(/\n\t\t--/g, "\n--");
-                    value = value.replace(/\n\t--/g, "\n--");
+                    value = value.replace(/\n\t/g, "\n");
+                    value = value.replace(/\n\t/g, "\n");
+                    value = value.replace(/\n\t/g, "\n");
+                    value = value.replace(/\n\t/g, "\n");
+                    value = value.replace(/\n\t/g, "\n");
+                    value = value.replace(/\n\t/g, "\n");
                     value = value.replace(/\n  --/g, "\n--");
                     value = value.replace(/\n --/g, "\n--");
                     value = value.replace(/ --/g, "\n--");

zapret-ip2net/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret-ip2net
-PKG_VERSION:=72.20251122
+PKG_VERSION:=72.20251213
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -9,8 +9,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=97cefbace9eee57c5f3799743df9d755690dac4c
-PKG_SOURCE_DATE:=2025-11-22
+PKG_SOURCE_VERSION:=0bc09971914c9ec8ad5553bf0678cb827adf5839
+PKG_SOURCE_DATE:=2025-12-13
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?

zapret-mdig/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret-mdig
-PKG_VERSION:=72.20251122
+PKG_VERSION:=72.20251213
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -9,8 +9,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=97cefbace9eee57c5f3799743df9d755690dac4c
-PKG_SOURCE_DATE:=2025-11-22
+PKG_SOURCE_VERSION:=0bc09971914c9ec8ad5553bf0678cb827adf5839
+PKG_SOURCE_DATE:=2025-12-13
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?

zapret-tpws/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret-tpws
-PKG_VERSION:=72.20251122
+PKG_VERSION:=72.20251213
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -9,8 +9,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=97cefbace9eee57c5f3799743df9d755690dac4c
-PKG_SOURCE_DATE:=2025-11-22
+PKG_SOURCE_VERSION:=0bc09971914c9ec8ad5553bf0678cb827adf5839
+PKG_SOURCE_DATE:=2025-12-13
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?

zapret/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zapret
-PKG_VERSION:=72.20251122
+PKG_VERSION:=72.20251213
 
 PKG_MAINTAINER:=bol-van
 PKG_LICENSE:=MIT
@@ -13,8 +13,8 @@ PKG_LICENSE_FILES:=docs/LICENSE.txt
 
 PKG_SOURCE_URL:=https://github.com/bol-van/zapret.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=97cefbace9eee57c5f3799743df9d755690dac4c
-PKG_SOURCE_DATE:=2025-11-22
+PKG_SOURCE_VERSION:=0bc09971914c9ec8ad5553bf0678cb827adf5839
+PKG_SOURCE_DATE:=2025-12-13
 
 #PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 #PKG_SOURCE_URL:=https://github.com/bol-van/zapret/archive/refs/tags/v$(PKG_VERSION).tar.gz?
@@ -54,6 +54,7 @@ define Package/$(PKG_NAME)/conffiles
 /etc/config/zapret
 /opt/zapret/config
 /opt/zapret/ipset/
+/opt/zapret/init.d/openwrt/custom.d/
 endef
 
 define Package/$(PKG_NAME)/install
@@ -66,6 +67,7 @@ define Package/$(PKG_NAME)/install
 	#$(CP) $(PKG_BUILD_DIR)/docs/* $(1)/opt/zapret/docs/
 	$(INSTALL_DIR) $(1)/opt/zapret/files
 	$(CP) $(PKG_BUILD_DIR)/files/* $(1)/opt/zapret/files/
+	$(CP)                ./files/* $(1)/opt/zapret/files/
 	$(INSTALL_DIR) $(1)/opt/zapret/ipset
 	$(CP) $(PKG_BUILD_DIR)/ipset/* $(1)/opt/zapret/ipset/
 	$(INSTALL_BIN)  $(PKG_BUILD_DIR)/blockcheck.sh  $(1)/opt/zapret/blockcheck.sh
@@ -79,8 +81,18 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_BIN) ./init.d.sh $(1)/etc/init.d/zapret
 	$(INSTALL_DATA) ./config.default $(1)/opt/zapret/config.default
 	$(INSTALL_DATA) ./ipset/zapret-hosts-google.txt       $(1)/opt/zapret/ipset/zapret-hosts-google.txt
+	$(INSTALL_DATA) ./ipset/zapret-hosts-user.txt         $(1)/opt/zapret/ipset/zapret-hosts-user.txt
 	$(INSTALL_DATA) ./ipset/zapret-hosts-user-exclude.txt $(1)/opt/zapret/ipset/zapret-hosts-user-exclude.txt
 	$(INSTALL_DATA) ./ipset/zapret-ip-exclude.txt         $(1)/opt/zapret/ipset/zapret-ip-exclude.txt
+	$(INSTALL_DIR) $(1)/opt/zapret/ipset_def
+	$(INSTALL_DATA) ./ipset/zapret-hosts-google.txt       $(1)/opt/zapret/ipset_def/zapret-hosts-google.txt
+	$(INSTALL_DATA) ./ipset/zapret-hosts-user.txt         $(1)/opt/zapret/ipset_def/zapret-hosts-user.txt
+	$(INSTALL_DATA) ./ipset/zapret-hosts-user-exclude.txt $(1)/opt/zapret/ipset_def/zapret-hosts-user-exclude.txt
+	$(INSTALL_DATA) ./ipset/zapret-ip-exclude.txt         $(1)/opt/zapret/ipset_def/zapret-ip-exclude.txt
+	$(INSTALL_DIR) $(1)/opt/zapret/init.d
+	$(INSTALL_DIR) $(1)/opt/zapret/init.d/openwrt
+	$(INSTALL_DIR) $(1)/opt/zapret/init.d/openwrt/custom.d
+	$(CP) ./custom.d/* $(1)/opt/zapret/init.d/openwrt/custom.d/
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_BIN) ./uci-def-cfg.sh     $(1)/etc/uci-defaults/zapret-uci-def-cfg.sh
 	$(INSTALL_BIN) ./uci-def-cfg.sh     $(1)/opt/zapret/uci-def-cfg.sh
@@ -91,6 +103,8 @@ define Package/$(PKG_NAME)/install
 	$(INSTALL_BIN) ./sync_config.sh     $(1)/opt/zapret/sync_config.sh
 	# Fix permisions
 	chmod 644 $(1)/opt/zapret/ipset/*.txt
+	chmod 644 $(1)/opt/zapret/ipset_def/*.txt
+	chmod 644 $(1)/opt/zapret/init.d/openwrt/custom.d/*.sh
 	chmod 644 $(1)/opt/zapret/config.default
 	chmod 755 $(1)/opt/zapret/*.sh
 endef

zapret/comfunc.sh

@@ -90,14 +90,32 @@ function get_run_on_boot_option
 	fi
 }
 
+function restore_ipset_txt
+{
+	local cfgname=$1
+	if [ -f "$ZAPRET_BASE/ipset_def/$cfgname" ]; then
+		cp -f "$ZAPRET_BASE/ipset_def/$cfgname" "$ZAPRET_BASE/ipset/$cfgname"
+	fi
+}
+
+function restore_all_ipset_cfg
+{
+	restore_ipset_txt zapret-hosts-google.txt
+	restore_ipset_txt zapret-hosts-user.txt
+	restore_ipset_txt zapret-hosts-user-exclude.txt
+	restore_ipset_txt zapret-ip-exclude.txt.txt
+}
+
 function create_default_cfg
 {
-	local cfgname=${1:-$ZAPRET_CFG_NAME}
+	local opt_flags=${1:--}
+	local opt_strat=$2
+	local cfgname=${3:-$ZAPRET_CFG_NAME}
 	local cfgfile=/etc/config/$cfgname
 	rm -f $cfgfile
 	touch $cfgfile
 	uci set $cfgname.config=main
-	set_cfg_default_values $cfgname
+	set_cfg_default_values "$opt_flags" "$opt_strat" $cfgname
 	return 0
 }
 
@@ -112,7 +130,7 @@ function merge_cfg_with_def_values
 	local cfg_sec_name="$( uci -q get $ZAPRET_CFG_NAME.config )"
 	[ -z "$cfg_sec_name" ] && create_default_cfg
 
-	create_default_cfg "$NEWCFGNAME"
+	create_default_cfg "-" "" "$NEWCFGNAME"
 	[ ! -f "$NEWCFGFILE" ] && return 1 
 
 	uci -m -f $cfgfile import "$NEWCFGNAME"

zapret/config.default

@@ -106,7 +106,7 @@ NFQWS_PORTS_UDP_KEEPALIVE=""
 NFQWS_OPT="--filter-tcp=80 <HOSTLIST> --dpi-desync=fake,fakedsplit --dpi-desync-autottl=2 --dpi-desync-fooling=badsum --new --filter-tcp=443 --hostlist=/opt/zapret/ipset/zapret-hosts-google.txt --dpi-desync=fake,multidisorder --dpi-desync-split-pos=1,midsld --dpi-desync-repeats=11 --dpi-desync-fooling=badsum --dpi-desync-fake-tls-mod=rnd,dupsid,sni=www.google.com --new --filter-udp=443 --hostlist=/opt/zapret/ipset/zapret-hosts-google.txt --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin --new --filter-udp=443 <HOSTLIST_NOAUTO> --dpi-desync=fake --dpi-desync-repeats=11 --new --filter-tcp=443 <HOSTLIST> --dpi-desync=multidisorder --dpi-desync-split-pos=1,sniext+1,host+1,midsld-2,midsld,midsld+2,endhost-1"
 
 
-DISABLE_CUSTOM=0
+DISABLE_CUSTOM=1
 
 # FlowOffload mode : donttouch,none,software,hardware
 FLOWOFFLOAD=none

zapret/custom.d/50-script.sh

@@ -0,0 +1,31 @@
+# Stun4ALL (discord audio, discord video, telegram call, etc)
+# this custom script runs desync to all stun packets
+# NOTE: @ih requires nft 1.0.1+ and updated kernel version. it's confirmed to work on 5.15 (openwrt 23) and not work on 5.10 (openwrt 22)
+
+# can override in config :
+NFQWS_OPT_DESYNC_STUN="${NFQWS_OPT_DESYNC_STUN:---dpi-desync=fake --dpi-desync-repeats=2}"
+
+alloc_dnum DNUM_STUN4ALL
+alloc_qnum QNUM_STUN4ALL
+
+zapret_custom_daemons()
+{
+	# $1 - 1 - add, 0 - stop
+
+	local opt="--qnum=$QNUM_STUN4ALL $NFQWS_OPT_DESYNC_STUN"
+	do_nfqws $1 $DNUM_STUN4ALL "$opt"
+}
+zapret_custom_firewall()
+{
+        # $1 - 1 - run, 0 - stop
+
+	local f='-p udp -m u32 --u32'
+	fw_nfqws_post $1 "$f 0>>22&0x3C@4>>16=28:65535&&0>>22&0x3C@12=0x2112A442&&0>>22&0x3C@8&0xC0000003=0" "$f 44>>16=28:65535&&52=0x2112A442&&48&0xC0000003=0" $QNUM_STUN4ALL
+}
+zapret_custom_firewall_nft()
+{
+        # stop logic is not required
+
+	local f="udp length >= 28 @ih,32,32 0x2112A442 @ih,0,2 0 @ih,30,2 0"
+	nft_fw_nfqws_post "$f" "$f" $QNUM_STUN4ALL
+}

zapret/def-cfg.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # Copyright (c) 2024 remittor
 
-function set_cfg_default_values
+function set_cfg_reset_values
 {
 	local cfgname=${1:-$ZAPRET_CFG_NAME}
 	local TAB="$( echo -n -e '\t' )"
@@ -16,7 +16,7 @@ function set_cfg_default_values
 		set $cfgname.config.DISABLE_IPV6='1'
 		set $cfgname.config.FILTER_TTL_EXPIRED_ICMP='1'
 		set $cfgname.config.MODE_FILTER='hostlist'
-		set $cfgname.config.DISABLE_CUSTOM='0'
+		set $cfgname.config.DISABLE_CUSTOM='1'
 		set $cfgname.config.WS_USER='daemon'
 		set $cfgname.config.DAEMON_LOG_ENABLE='0'
 		set $cfgname.config.DAEMON_LOG_FILE='/tmp/zapret+<DAEMON_NAME>+<DAEMON_IDNUM>+<DAEMON_CFGNAME>.log'
@@ -38,10 +38,76 @@ function set_cfg_default_values
 		set $cfgname.config.NFQWS_UDP_PKT_IN='0'
 		set $cfgname.config.NFQWS_PORTS_TCP_KEEPALIVE='0'
 		set $cfgname.config.NFQWS_PORTS_UDP_KEEPALIVE='0'
+		# save changes
+		commit $cfgname
+	EOF
+	return 0
+}
+
+function clear_nfqws_strat
+{
+	local cfgname=${1:-$ZAPRET_CFG_NAME}
+	local TAB="$( echo -n -e '\t' )"
+	uci batch <<-EOF
+		set $cfgname.config.MODE_FILTER='hostlist'
+		set $cfgname.config.NFQWS_PORTS_TCP='80,443'
+		set $cfgname.config.NFQWS_PORTS_UDP='443'
+		set $cfgname.config.NFQWS_OPT='$TAB'
+		commit $cfgname
+	EOF
+}
+
+function set_cfg_nfqws_strat
+{
+	local strat=${1:--}
+	local cfgname=${2:-$ZAPRET_CFG_NAME}
+	local TAB="$( echo -n -e '\t' )"
+    
+	uci batch <<-EOF
+		set $cfgname.config.MODE_FILTER='hostlist'
+		commit $cfgname
+	EOF
+	if [ "$strat" = "empty" ]; then
+		clear_nfqws_strat $cfgname
+	fi
+	if [ "$strat" = "v1_by_StressOzz" ]; then
+		uci batch <<-EOF
+			set $cfgname.config.NFQWS_PORTS_TCP='80,443'
+			set $cfgname.config.NFQWS_PORTS_UDP='443'
 			set $cfgname.config.NFQWS_OPT="
-			--filter-tcp=443
+				# Strategy $strat
+				
+				--filter-tcp=443 <HOSTLIST>
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--dpi-desync=fake,multidisorder
+				--dpi-desync-split-seqovl=681
+				--dpi-desync-split-pos=1
+				--dpi-desync-fooling=badseq
+				--dpi-desync-badseq-increment=10000000
+				--dpi-desync-repeats=2
+				--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
+				--dpi-desync-fake-tls-mod=rnd,dupsid,sni=fonts.google.com
+				
+				--new
+				--filter-udp=443
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
+				--dpi-desync=fake
+				--dpi-desync-repeats=6
+				--dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin
+			"
+			commit $cfgname
+		EOF
+	fi
+	if [ "$strat" = "v2_by_StressOzz" ]; then
+		uci batch <<-EOF
+			set $cfgname.config.NFQWS_PORTS_TCP='80,443'
+			set $cfgname.config.NFQWS_PORTS_UDP='443'
+			set $cfgname.config.NFQWS_OPT="
+				# Strategy $strat
+				
+				--filter-tcp=443 <HOSTLIST>
 				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
-			--hostlist=/opt/zapret/ipset/zapret-hosts-user.txt
 				--hostlist-exclude-domains=openwrt.org
 				--dpi-desync=fake,fakeddisorder
 				--dpi-desync-split-pos=10,midsld
@@ -54,15 +120,153 @@ function set_cfg_default_values
 				--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/tls_clienthello_gosuslugi_ru.bin
 				--dpi-desync-fooling=badseq,badsum
 				--dpi-desync-badseq-increment=0
+				
 				--new
 				--filter-udp=443
 				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
 				--dpi-desync=fake
 				--dpi-desync-repeats=6
 				--dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin
 			"
-		# save changes
 			commit $cfgname
 		EOF
+	fi
+	if [ "$strat" = "v3_by_StressOzz" ]; then
+		uci batch <<-EOF
+			set $cfgname.config.NFQWS_PORTS_TCP='80,443'
+			set $cfgname.config.NFQWS_PORTS_UDP='443'
+			set $cfgname.config.NFQWS_OPT="
+				# Strategy $strat
+				
+				--filter-tcp=443 <HOSTLIST>
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude-domains=openwrt.org
+				--dpi-desync=fake,fakeddisorder
+				--dpi-desync-split-pos=10,midsld
+				--dpi-desync-fake-tls=/opt/zapret/files/fake/t2.bin
+				--dpi-desync-fake-tls-mod=rnd,dupsid,sni=m.ok.ru
+				--dpi-desync-fake-tls=0x0F0F0F0F
+				--dpi-desync-fake-tls-mod=none
+				--dpi-desync-fakedsplit-pattern=/opt/zapret/files/fake/tls_clienthello_vk_com.bin
+				--dpi-desync-split-seqovl=336
+				--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/tls_clienthello_gosuslugi_ru.bin
+				--dpi-desync-fooling=badseq,badsum
+				--dpi-desync-badseq-increment=0
+				
+				--new
+				--filter-udp=443
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
+				--dpi-desync=fake
+				--dpi-desync-repeats=6
+				--dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin
+			"
+			commit $cfgname
+		EOF
+	fi
+	if [ "$strat" = "v4_by_StressOzz" ]; then
+		uci batch <<-EOF
+			set $cfgname.config.NFQWS_PORTS_TCP='80,443'
+			set $cfgname.config.NFQWS_PORTS_UDP='443'
+			set $cfgname.config.NFQWS_OPT="
+				# Strategy $strat
+				
+				--filter-tcp=443
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
+				--hostlist-exclude-domains=openwrt.org
+				--dpi-desync=fake,multisplit
+				--dpi-desync-split-pos=2,sld
+				--dpi-desync-fake-tls=0x0F0F0F0F
+				--dpi-desync-fake-tls=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
+				--dpi-desync-fake-tls-mod=rnd,dupsid,sni=google.com
+				--dpi-desync-split-seqovl=2108
+				--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
+				--dpi-desync-fooling=badseq
+				
+				--new
+				--filter-tcp=443 <HOSTLIST>
+				--hostlist-exclude-domains=openwrt.org
+				--dpi-desync-any-protocol=1
+				--dpi-desync-cutoff=n5
+				--dpi-desync=multisplit
+				--dpi-desync-split-seqovl=582
+				--dpi-desync-split-pos=1
+				--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/4pda.bin
+				
+				--new
+				--filter-udp=443
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
+				--dpi-desync=fake
+				--dpi-desync-repeats=6
+				--dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin
+			"
+			commit $cfgname
+		EOF
+	fi
+	if [ "$strat" = "v5_by_StressOzz" ]; then
+		uci batch <<-EOF
+			set $cfgname.config.NFQWS_PORTS_TCP='80,443'
+			set $cfgname.config.NFQWS_PORTS_UDP='443'
+			set $cfgname.config.NFQWS_OPT="
+				# Strategy $strat
+				
+				--filter-tcp=443
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
+				--hostlist-exclude-domains=openwrt.org
+				--ip-id=zero
+				--dpi-desync=multisplit
+				--dpi-desync-split-seqovl=681
+				--dpi-desync-split-pos=1
+				--dpi-desync-split-seqovl-pattern=/opt/zapret/files/fake/tls_clienthello_www_google_com.bin
+				
+				--new
+				--filter-tcp=443 <HOSTLIST>
+				--hostlist-exclude-domains=openwrt.org
+				--dpi-desync=fake,fakeddisorder
+				--dpi-desync-split-pos=10,midsld
+				--dpi-desync-fake-tls=/opt/zapret/files/fake/max.bin
+				--dpi-desync-fake-tls-mod=rnd,dupsid
+				--dpi-desync-fake-tls=0x0F0F0F0F
+				--dpi-desync-fake-tls-mod=none
+				--dpi-desync-fakedsplit-pattern=/opt/zapret/files/fake/tls_clienthello_vk_com.bin
+				--dpi-desync-fooling=badseq,badsum
+				--dpi-desync-badseq-increment=0
+				
+				--new
+				--filter-udp=443
+				--hostlist=/opt/zapret/ipset/zapret-hosts-google.txt
+				--hostlist-exclude=/opt/zapret/ipset/zapret-hosts-user-exclude.txt
+				--dpi-desync=fake
+				--dpi-desync-repeats=6
+				--dpi-desync-fake-quic=/opt/zapret/files/fake/quic_initial_www_google_com.bin
+			"
+			commit $cfgname
+		EOF
+	fi
+	return 0
+}
+
+function set_cfg_default_values
+{
+	local opt_flags=${1:--}
+	local opt_strat=${2:-v2_by_StressOzz}
+	local cfgname=${3:-$ZAPRET_CFG_NAME}
+
+	if ! echo "$opt_flags" | grep -q "(skip_base)"; then
+		set_cfg_reset_values $cfgname
+	fi
+	if [ "$opt_strat" != "-" ]; then
+		set_cfg_nfqws_strat "$opt_strat" $cfgname
+	fi
+	if echo "$opt_flags" | grep -q "(set_mode_autohostlist)"; then
+		uci batch <<-EOF
+			set $cfgname.config.MODE_FILTER='autohostlist'
+			commit $cfgname
+		EOF
+	fi
 	return 0
 }

zapret/ipset/zapret-hosts-user-exclude.txt

@@ -8,173 +8,187 @@
 fc00::/7
 fe80::/10
 ####################################
+gstatic.com
 gosuslugi.ru
+ipstream.one
 #################################### Epicgames
+easy.ac
+fab.com
+quixel.se
+quixel.com
+eac-cdn.com
+paragon.com
+spyjinx.com
 3lateral.com
-accountportal-website-prod07.ol.epicgames.com
-account-public-service-prod03.ol.epicgames.com
-accounts.epicgames.com
-api.epicgames.dev
+fortnite.com
+epicgames.com
+epicgames.dev
+hyprsense.com
+sketchfab.com
 artstation.com
+roborecall.com
+twinmotion.com
+cubicmotion.com
+playparagon.com
+realityscan.com
+epicgamescdn.com
+et.epicgames.com
+ol.epicgames.com
+radgametools.com
+unrealengine.com
+api.epicgames.dev
+easyanticheat.net
+shadowcomplex.com
 battlebreakers.com
+store.epicgames.com
 capturingreality.com
-catalog-public-service-prod06.ol.epicgames.com
+unrealtournament.com
 cdn1.unrealengine.com
 cdn2.unrealengine.com
-cubicmotion.com
-datarouter.ol.epicgames.com
-datastorage-public-service-liveegs.live.use1a.on.epicgames.com
+accounts.epicgames.com
 download.epicgames.com
+tracking.epicgames.com
 download2.epicgames.com
 download3.epicgames.com
 download4.epicgames.com
-eac-cdn.com
-easy.ac
-easyanticheat.net
-entitlement-public-service-prod08.ol.epicgames.com
-epicgames.com
-epicgames.dev
-epicgamescdn.com
-epicgames-download1.akamaized.net
-et.epicgames.com
-fab.com
-fastly-download.epicgames.com
-fortnite.com
-friends-public-service-prod06.ol.epicgames.com
-hyprsense.com
-launcher-public-service-prod06.ol.epicgames.com
-launcherwaitingroom-public-service-prod06.ol.epicgames.com
-launcher-website-prod07.ol.epicgames.com
-library-service.live.use1a.on.epicgames.com
-lightswitch-public-service-prod06.ol.epicgames.com
 metrics.ol.epicgames.com
-ol.epicgames.com
-orderprocessor-public-service-ecomprod01.ol.epicgames.com
-paragon.com
-playparagon.com
-quixel.com
-quixel.se
-radgametools.com
-realityscan.com
-roborecall.com
-shadowcomplex.com
-sketchfab.com
-spyjinx.com
-static-assets-prod.epicgames.com
-store.epicgames.com
+datarouter.ol.epicgames.com
+fastly-download.epicgames.com
 store-content.ak.epicgames.com
-store-site-backend-static.ak.epicgames.com
-tracking.epicgames.com
-twinmotion.com
-unrealengine.com
-unrealtournament.com
+static-assets-prod.epicgames.com
+epicgames-download1.akamaized.net
+launcher-website-prod07.ol.epicgames.com
 ut-public-service-prod10.ol.epicgames.com
+store-site-backend-static.ak.epicgames.com
+library-service.live.use1a.on.epicgames.com
+accountportal-website-prod07.ol.epicgames.com
+account-public-service-prod03.ol.epicgames.com
+catalog-public-service-prod06.ol.epicgames.com
+friends-public-service-prod06.ol.epicgames.com
+launcher-public-service-prod06.ol.epicgames.com
+entitlement-public-service-prod08.ol.epicgames.com
+lightswitch-public-service-prod06.ol.epicgames.com
+orderprocessor-public-service-ecomprod01.ol.epicgames.com
+launcherwaitingroom-public-service-prod06.ol.epicgames.com
+datastorage-public-service-liveegs.live.use1a.on.epicgames.com
 #################################### Steam
-api.steampowered.com
-avatars.fastly.steamstatic.com
-cdn.akamai.steamstatic.com
-cdn.cloudflare.steamstatic.com
-cdn.fastly.steamstatic.com
-cdn.steamcommunity.com
-cdn.steamstatic.com
-checkout.steampowered.com
-clan.fastly.steamstatic.com
-client-download.steampowered.com
-client-update.queniuqe.com
-community.cloudflare.steamstatic.com
-community.fastly.steamstatic.com
-community.steampowered.com
-community.steamstatic.com
-cs.steampowered.com
-dl.steam.clngaa.com
-edge.steam-dns.top.comcast.net
-gstore.val.manlaxy.com
-help.steampowered.com
-login.steampowered.com
-media.steampowered.com
-partner.steamgames.com
-partner.steampowered.com
-playartifact.com
 s.team
-scontent.steamusercontent.com
-shared.fastly.steamstatic.com
-shared.steamstatic.com
-steam.apac.qtlglb.com
-steam.cdn.on.net
-steam.cdn.orcon.net.nz
-steam.cdn.slingshot.co.nz
-steam.cdn.webra.ru
-steam.eca.qtlglb.com
-steam.naeu.qtlglb.com
-steam.ru.qtlglb.com
 steam.tv
-steam-api.com
-steambroadcast.akamaized.net
-steambroadcast.com
+valve.net
 steamcdn.com
 steamcdn.net
-steamcdn-a.akamaihd.net
-steamcdn-a.akamaihd.net.edgesuite.net
-steamcdn-a.akamaized.net
+steamstat.us
+valvecdn.com
+steam-api.com
 steamchat.com
-steam-chat.com
-steamcloudsweden.blob.core.windows.net
-steamcommunity.akamaized.net
-steamcommunity.cloudflare.steamstatic.com
-steamcommunity.com
-steamcommunity-a.akamaihd.net
-steamcommunity-a.akamaihd.net.edgesuite.net
-steamcommunity-a.akamaized.net
-steamcontent.com
-steamcontent-a.akamaihd.net
 steamdeck.com
-steamdeckcdn.akamaized.net
-steamdeckusercontent.com
+steam-chat.com
 steamgames.com
 steamgames.net
-steammobile.akamaized.net
-steampipe.akamaized.net
-steampipe-kr.akamaized.net
-steampipe-partner.akamaized.net
-steampowered.com
-steamserver.net
-steamstat.us
-steamstatic.akamaized.net
-steamstatic.com
-steamstore-a.akamaihd.net
-steamusercontent.com
-steamusercontent-a.akamaihd.net
-steamuserimages-a.akamaihd.net
-steamvideo-a.akamaihd.net
-store.akamai.steamstatic.com
-store.cloudflare.steamstatic.com
-store.fastly.steamstatic.com
-store.steampowered.com
-support.steampowered.com
 underlords.com
-valve.net
-valvecdn.com
+steamserver.net
+steamstatic.com
+playartifact.com
+steam.cdn.on.net
+steamcontent.com
+steampowered.com
 valvecontent.com
 valvesoftware.com
 valvesoftware.net
+steam.cdn.webra.ru
+steambroadcast.com
+steamcommunity.com
+cdn.steamstatic.com
+cs.steampowered.com
+dl.steam.clngaa.com
+steam.ru.qtlglb.com
+api.steampowered.com
+steam.eca.qtlglb.com
+steamusercontent.com
+help.steampowered.com
+steam.apac.qtlglb.com
+steam.naeu.qtlglb.com
+cdn.steamcommunity.com
+gstore.val.manlaxy.com
+login.steampowered.com
+media.steampowered.com
+partner.steamgames.com
+shared.steamstatic.com
+steam.cdn.orcon.net.nz
+store.steampowered.com
+steamcdn-a.akamaihd.net
+steampipe.akamaized.net
+partner.steampowered.com
+steamcdn-a.akamaized.net
+steamdeckusercontent.com
+support.steampowered.com
+checkout.steampowered.com
+community.steamstatic.com
+steam.cdn.slingshot.co.nz
+steammobile.akamaized.net
+steamstatic.akamaized.net
+steamstore-a.akamaihd.net
+steamvideo-a.akamaihd.net
 workshop.steampowered.com
+cdn.akamai.steamstatic.com
+cdn.fastly.steamstatic.com
+client-update.queniuqe.com
+community.steampowered.com
+steamdeckcdn.akamaized.net
+steampipe-kr.akamaized.net
+clan.fastly.steamstatic.com
+steamcontent-a.akamaihd.net
+steambroadcast.akamaized.net
+steamcommunity.akamaized.net
+store.akamai.steamstatic.com
+store.fastly.steamstatic.com
+scontent.steamusercontent.com
+shared.fastly.steamstatic.com
+steamcommunity-a.akamaihd.net
+avatars.fastly.steamstatic.com
+cdn.cloudflare.steamstatic.com
+edge.steam-dns.top.comcast.net
+steamcommunity-a.akamaized.net
+steamuserimages-a.akamaihd.net
+steampipe-partner.akamaized.net
+steamusercontent-a.akamaihd.net
+client-download.steampowered.com
+community.fastly.steamstatic.com
+store.cloudflare.steamstatic.com
+community.cloudflare.steamstatic.com
+steamcdn-a.akamaihd.net.edgesuite.net
+steamcloudsweden.blob.core.windows.net
+steamcommunity.cloudflare.steamstatic.com
+steamcommunity-a.akamaihd.net.edgesuite.net
 #################################### OpenWRT
-archive.openwrt.org
+github.com
+openwrt.org
+gh.openwrt.org
 cdn.openwrt.org
 dev.openwrt.org
-downloads.openwrt.org
-forum.openwrt.org
-fwdownloads.openwrt.org
-gh.openwrt.org
 git.openwrt.org
-github.com
 lede-project.org
+wiki.openwrt.org
+forum.openwrt.org
 lists.openwrt.org
+openwrt.gitlab.io
+archive.openwrt.org
+downloads.openwrt.org
+fwdownloads.openwrt.org
 mirror-01.infra.openwrt.org
 mirror-02.infra.openwrt.org
 mirror-03.infra.openwrt.org
 mirror-04.infra.openwrt.org
-openwrt.gitlab.io
-openwrt.org
-wiki.openwrt.org
-####################################
+#################################### UbisoftConnect
+ubi.com
+ubisoft.com
+store.ubi.com
+ubisoftconnect.com
+connect.ubisoft.com
+drops-register.ubi.com
+public-ubiservices.ubi.com
+ubisoftconnect.cdn.ubi.com
+uplaypc-s-ubisoft.cdn.ubi.com
+uplaypc-s-ubisoft-ww.cdn.ubi.com
+ubisoft-orbit-savegames.s3.amazonaws.com
+ubisoft-uplay-savegames.s3.amazonaws.com

zapret/restore-def-cfg.sh

@@ -5,14 +5,29 @@
 
 cfg_run_on_boot="$( uci -q get zapret.config.run_on_boot )"
 
-create_default_cfg
+opt_flags=${1:--}
+opt_strat=$2
+
+if echo "$opt_flags" | grep -q "(reset_ipset)"; then
+	restore_all_ipset_cfg
+fi
+	
+create_default_cfg "$opt_flags" "$opt_strat"
 
 if [ "$cfg_run_on_boot" = "1" ]; then
 	uci set zapret.config.run_on_boot=1
 	uci commit
 fi
 
-if [ "$1" = "sync" ]; then
+ZAPRET_SYNC_CONFIG=0
+if [ "$opt_flags" = "sync" ]; then
+	ZAPRET_SYNC_CONFIG=1
+fi
+if echo "$opt_flags" | grep -q "(sync)"; then
+	ZAPRET_SYNC_CONFIG=1
+fi
+
+if [ "$ZAPRET_SYNC_CONFIG" = "1" ]; then
 	# renew main config
 	/opt/zapret/sync_config.sh
 fi