v1

Initial release

v2

nfqws : command line options change. now using standard getopt.
nfqws : added options for window size changing and "Host:" case change
ISP support : tested on mns.ru and beeline (corbina)
init scripts : rewritten init scripts for simple choise of ISP
create_ipset : now using 'ipset restore', it works much faster
readme : updated. now using UTF-8 charset.

v3

tpws : added transparent proxy (supports TPROXY and DNAT).
       can help when ISP tracks whole HTTP session, not only the beginning
ipset : added zapret-hosts-user.txt which contain user defined host names to be resolved
        and added to zapret ip list
ISP support : dom.ru support via TPROXY/DNAT
ISP support : successfully tested sknt.ru on 'domru' configuration
  other configs will probably also work, but cannot test
compile : openwrt compile howto

v4

tpws : added ability to insert extra space after http method : "GET /" => "GET  /"
ISP support : TKT support

v5

nfqws : ipv6 support in nfqws

v6

ipset : added "get_antizapret.sh"

v7

tpws : added ability to insert "." after Host: name

v8

openwrt init : removed hotplug.d/firewall because of race conditions. now only use /etc/firewall.user

v9

ipban : added ipban ipset. place domains banned by ip to zapret-hosts-user-ipban.txt
	these IPs must be soxified for both http and https
ISP support : tiera support
ISP support : added DNS filtering to ubuntu and debian scripts

v10

tpws : added split-pos option. split every message at specified position

v11

ipset : scripts optimizations

v12

nfqws : fix wrong tcp checksum calculation if packet length is odd and platform is big-endian

v13

added binaries

v14

change get_antizapret script to work with https://github.com/zapret-info/z-i/raw/master/dump.csv
filter out 192.168.*, 127.*, 10.* from blocked ips

v15

added --hostspell option to nfqws and tpws
ISP support : beeline now catches "host" but other spellings still work
openwrt/LEDE : changed init script to work with procd
tpws, nfqws : minor cosmetic fixes

v16

tpws: split-http-req=method : split inside method name, not after
ISP support : mns.ru changed split pos to 3 (got redirect page with HEAD req : curl -I ej.ru)

v17

ISP support : athome moved from nfqws to tpws because of instability and http request hangs
tpws : added options unixeol,methodeol,hosttab

v18

tpws,nfqws : added hostnospace option

v19

tpws : added hostlist option

v20

added ip2net. ip2net groups ips from iplist into subnets and reduces ipset size twice

v21

added mdig. get_reestr.sh is *real* again

v22

total review of init script logic
dropped support of older debian 7 and ubuntu 12/14 systems
install_bin.sh : auto binaries preparation
docs: readme review. some new topics added, others deleted
docs: VPN setup with policy based routing using wireguard
docs: wireguard modding guide

v23

major init system rewrite
openwrt : separate firewall include /etc/firewall.zapret
install_easy.sh : easy setup on openwrt, debian, ubuntu, centos, fedora, opensuse

v24

separate config from init scripts
gzip support in ipset/*.sh and tpws

v25

init : move to native systemd units
use links to units, init scripts and firewall includes, no more copying

v26

ipv6 support
tpws : advanced bind options

v27

tpws : major connection code rewrite. originally it was derived from not top quality example , with many bugs and potential problems.
next generation connection code uses nonblocking sockets. now its in EXPERIMENTAL state.

v28

tpws : added socks5 support
ipset : major RKN getlist rewrite. added antifilter.network support

v29

nfqws : DPI desync attack
ip exclude system

v30

nfqws : DPI desync attack modes : fake,rst

v31

nfqws : DPI desync attack modes : disorder,disorder2,split,split2.
nfqws : DPI desync fooling mode : badseq.  multiple modes supported

v32

tpws : multiple binds
init scripts : run only one instance of tpws in any case

v33

openwrt : flow offloading support
config : MODE refactoring

v34

nfqws : dpi-desync 2 mode combos
nfqws : dpi-desync without parameter no more supported. previously it meant "fake"
nfqws : custom fake http request and tls client hello

v35

limited FreeBSD and OpenBSD support

v36

full FreeBSD and OpenBSD support

v37

limited MacOS support

v38

MacOS easy install

v39

nfqws: conntrack, wssize

v40

init scripts : IFACE_LAN, IFACE_WAN now accept multiple interfaces
init scripts : openwrt uses now OPENWRT_LAN parameter to override incoming interfaces for tpws

v41

install_easy : openrc support

v42

blockcheck.sh

v43

nfqws: UDP desync with conntrack support (any-protocol only for now)

v44

nfqws: ipfrag

v45

nfqws: hop-by-hop ipv6 desync and fooling

v46

big startup script refactoring to support nftables and new openwrt snapshot builds with firewall4

v47

nfqws: QUIC initial decryption
nfqws: udplen, fakeknown dpi desync modes

v48

nfqws, tpws : multiple --hostlist and --hostlist-exclude support
launch system, ipset : no more list merging. all lists are passed separately to nfqws and tpws
nfqws : udplen fooling supports packet shrinking (negative increment value)

v49

QUIC support integrated to the main system and setup

v50

DHT protocol support.
DPI desync mode 'tamper' for DHT.
HEX string support in addition to binary files.

v51

tpws --tlsrec attack.

v52

autohostlist mode

v53

nfqws: tcp session reassemble for TLS ClientHello

v54

tpws: out of band send when splitting (--oob)
nfqws: autottl
nfqws: datanoack fooling
nftables: use POSTNAT path for tcp redirections to allow NAT-breaking strategies. use additional mark bit DESYNC_MARK_POSTNAT.

v55

tpws: incompatible oob parameter change. it doesn't take oob byte anymore. instead it takes optional protocol filter - http or tls.
  the same is done with disorder. oob byte can be specified in parameter --oob-data.
blockcheck: quick mode, strategy order optimizations, QUIC protocol support
nfqws: syndata desync mode

v56

tpws: mss fooling
tpws: multi thread resolver. eliminates blocks related to hostname resolve.

v57

tpws: --nosplice option
nfqws: postnat fixes
nfqws: --dpi-desync-start option
nfqws: packet delay for kyber TLS and QUIC
nfqws: --dpi-desync-retrans obsolete
nfqws: --qnum is mandatory, no more default queue 0

v58

winws

v59

tpws: --split-tls
tpws: --tlsrec=sniext
nfqws: --dpi-desync-split-http-req, --dpi-desync-split-tls. multi segment TLS support for split.
blockcheck: mdig dns cache

v60

blockcheck: port block test, partial ip block test
nfqws: seqovl split/disorder modes

v61

C code cleanups
dvtws: do not use raw sockets. use divert.
nfqws,tpws: detect TLS 1.2 ClientHello from very old libraries with SSL 3.0 version in record layer
nfqws,tpws: debug log to file and syslog
tpws: --connect-bind-addr option
tpws: log local endpoint (including source port number) for remote leg

v62:

tpws: connection close logic rewrite. tcp user timeout parameters for local and remote leg.
nfqws: multi-strategy

v63:

tpws: multi-strategy

v64:

blockcheck: warn if dpi bypass software is already running
blockcheck: TPWS_EXTRA, NFQWS_EXTRA
init.d: multiple custom scripts

v65:

init.d: dynamic number allocation for dnum,tpws_port,qnum
init.d: FW_EXTRA_PRE, FW_EXTRA_POST
init.d: zapret_custom_firewall_nft_flush
nfqws,tpws: l7proto and client ip:port info in autohostlist debug log
nfqws,tpws: user mode ipset filter support
nfqws,tpws: l7proto filter support
tpws: fixed MSS apply in transparent mode
nfqws: fixed autottl apply if desync profile changed
tpws,nfqws: fixed 100% cpu hang on gzipped list with comments
ipset: get_refilter_ipsum.sh , get_refilter_domain.sh

v66:

init.d: rewrite traffic interception and daemon launch parameters in config file. this break compatibility with old versions.
init.d: openwrt-minimal : tpws launch for low storage openwrt devices

v67:

mdig: --dns-make-query, --dns-parse-query for side-channel resolving (DoH)
blockcheck: use DoH resolvers if DNS spoof is detected
blockcheck: restring fooling to testing domain's IPs
nfqws,tpws: internal hostlist deduplication to save RAM
nfqws,tpws: hostlist/ipset auto reload on file change. no more HUP.
nfqws,tpws: --filter-tcp, --filter-udp take comma separated port range list
nfqws,tpws: @<config_file> - read config from a file
config: <HOSTLIST_NOAUTO> marker
binaries: remove zapret-winws. add win32.
blockcheck, install_easy.sh: preserve user environment variables during elevation
blockcheck: do not require root if SKIP_PKTWS=1

v68:

docs : move russian version to markdown
nfqws,tpws: use alternate $ sign for $<config_file>
repo: binaries removed from repo. git actions binaries build in releases.
uninstall_easy.sh: offer to remove dependencies in openwrt
install_easy.sh: allow to download lists in autohostlist filter mode

v69:

nfqws, tpws: multisplit/multidisorder support.
nfqws: name change split->fakedsplit, disorder->fakeddisorder. compat : old names are synonyms
nfqws: --dpi-desync-split-http-req, --dpi-desync-split-tls deprecated. compat : these parameters add split point to multisplit.
nfqws: --dpi-desync=split2|disorder2 deprecated. compat: they are now synonyms for multisplit/multidisorder
nfqws: cancel seqovl if MTU is exceeded (linux only). cancel seqovl for disorder if seqovl>=first_part_size.
nfqws: fixed splits in multiple TLS segments.
tpws: --split-http-req,--split-tls deprecated. compat : these parameters add split point to multisplit.
tpws: --tlsrec now takes pos markers. compat : old names are converted to pos markers
tpws: --tlsrec-pos deprecated. compat : sets absolute pos marker
nfqws,tpws: chown autohostlist, autohostlist debug log and debug log files after options parse
nfqws,tpws: set EXEDIR env var to use in @config (won't work for stadalone winws without /bin/sh)
dvtws: set random/increasing ip_id value in generated packets
mdig: fixed parsing of DNS reply in windows (stdin is opened as text, not binary)
tpws: support compile for android NDK api level >= 21 (Android 5.0)
tpws: --fix-seg segmentation fixer
repo: build for android NDK api level 21 (Android 5.0)
install_easy: support for APK package manager in openwrt
blockcheck: removed ignore CA question
blockcheck: removed IGNORE_CA, CURL_VERBOSE
blockcheck: added CURL_OPT
blockcheck: new strategies support
blockcheck: test sequence rework
blockcheck: view all working strategies in summary

v69.1:

init.d: keenetic udp fix custom
tpws: fixed incorrect hostlist checks

v69.2:

nfqws,tpws: --skip
nfqws: --methodeol
init.d: do not use pgrep in sysv for busybox compat

v69.3

nfqws,tpws: fixed ipsets and hostlists
all progs: version numbers for github, build date/time for self built
repo: light release for openwrt and embedded systems
repo: sha256sum

v69.4

nfqws: fakedsplit/fakeddisorder fakes for both split segments
nfqws: --dpi-desync-fakedsplit-pattern

v69.5

nfqws,tpws: --dry-run
install_easy: check tpws and nfqws options validity

v69.6

nfqws: set NETLINK_NO_ENOBUFS to fix possible nfq recv errors
init.d: unify custom scripts for linux
init.d: new custom scripts : 20-fw-extra, 50-wg4all

v69.7

nfqws,tpws: --comment
nfqws: trash flood warning
winws: exclude empty outgoing ack packets in windivert filter

v69.8

winws: accept empty outgoing RST and FIN packets for conntrack needs
repo: lexra build

v69.9

init.d: exclude ipban from tpws redirection
macos: fix install_easy
macos: fix national decimal separator in sleep
ipset: scripts maintenance

v70

blockcheck: override all dialog questions and enable batch mode
blockcheck: parallel attempts
nfqws: weaken wireguard initiation recognition. use len=148 and data[0]=1 signature
nfqws: apply split+seqovl only to the first reasm fragment
install_easy: dnf packager support
nfqws,tpws: hostlist/ipset track not only file mod time but also file size
nfqws,tpws,ipset: return lists reload on HUP
nfqws,blockcheck: --dpi-desync-fake-tls-mod

v70.1

nfqws: --dpi-desync-fake-tls-mod=dupsid
nfqws,tpws: test accessibility of list files after privs drop
nfqws,tpws: --version

v70.4

nfqws,tpws: ^ prefix in hostlist to disable subdomain matches
nfqws,tpws: optional systemd notify support. compile using 'make systemd'
nfqws,tpws: systemd instance templates for nfqws and tpws
nfqws,tpws: separate droproot from dropcaps
tpws: detect WSL 1 and warn about non-working options

v70.5

nfqws: multiple --dpi-desync-fake-xxx
nfqws: support of inter-packet fragmented QUIC CRYPTO

v70.6

nfqws: detect Discord Voice IP discovery packets
nfqws: detect STUN message packets
nfqws: change SNI to specified value tls mod : --dpi-desync-fake-tls-mod sni=<sni>
nfqws: update default TLS ClientHello fake. firefox 136.0.4 finger, no kyber, SNI=microsoft.com
nfqws: multiple mods for multiple TLS fakes
init.d: remove 50-discord
blockcheck: use tpws --fix-seg on linux for multiple splits

v71

nfqws,tpws: debug tls version, alpn, ech
nfqws: --dpi-desync-fake-tls=! means default tls fake
nfqws: --dup*
nfqws: --orig*
nfqws: ipcache of hop count and host names
nfqws: --ctrack-disable
nfqws: --synack-split
nfqws: --autottl=- or --autottl=0:0-0 disable autottl. previous "0" does not work anymore.
tpws: ipcache of host names
nfqws,tpws: set 1024 repeat limit to fakes and dups
nfqws,tpws: do more before daemonize
nfqws,tpws: accept multiple gids in --gid
nfqws,tpws: display "android" in version string if built for android
init.d: remove --ipset parameter prohibition
init.d, blockcheck: drop time exceeded icmp for nfqws-related connections
blockcheck: some dup and orig-ttl mods
blockcheck: PKTWS_EXTRA_PRE
blockcheck: report test function and domain every test

v71.1

nfqws,tpws: much faster ipset implementation. move from hash to avl tree
nfqws,tpws: check list files accessibility with dropped privs in --dry-run mode
nfqws,tpws: --debug=android for NDK builds
nfqws,tpws: use initgroups instead of setgroups if --user specified
nfqws: --filter-ssid (linux-only)
install_easy: stop if running embedded release on traditional linux system (some files missing)
install_bin: add "read elf" arch detection method
binaries: renamed arch dirs in binaries

v71.1.1

nfqws: use wireless ext in case nl80211 does not return SSID

v71.2

nfqws: apply udp desync to replayed packets with non-zero reasm offset (except fake)
blockcheck: display curl version and kernel version
install_bin: stop if no binaries found. display help text.
winws: increase buffers for port filter
tpws: tpws no more opens /dev/pf in OpenBSD by default. requires --enable-pf like in FreeBSD. this is migration from rdr-to to divert-to redirection scheme.
install_easy: warn if --ipset parameter is specified

v71.3

init.d: FILTER_MARK
nfqws: ts fooling
blockcheck: test ts fooling
blockcheck: auto enable tcp timestamps in windows
tpws,nfqws: special handling of IP-like hostnames. strip :port from hostname:port

v71.4

nfqws,tpws: fix possible crashes or high memory usage if hostlist has duplicate hostnames
init.d: custom scripts 50-discord-media, 50-stun4all
init.d: windivert filters for discord media, stun, wireguard
readme: hardware problems description

v72

winws: --wf-raw-part
nfqws: --dpi-desync=hostfakesplit
nfqws: --dpi-desync-fake-tcp-mod=seq
nfqws: --dpi-desync-fake-tls=!+offset , --dpi-desync-fake-xxx=[+offset]@filename
nfqws: --dpi-desync-fakedsplit-mod=altorder  for fakedsplit/fakeddisorder
nfqws: --dpi-desync-hostfakesplit-mod=altorder
nfqws: fakedsplit/fakeddisorder normalize fake split pattern offset to reasm offset
nfqws: optimize ipv4 ip_id. apply ip_id on all OS the same way.
blockcheck: print PRETTY_NAME and some OPENWRT_xxx from /etc/os-release
blockcheck: new strategies
blockcheck: curl test simulation : SIMULATE=1

v72.1

nfqws: --ip-id=seq|seqgroup|rnd|zero
blockcheck: MIN_AUTOTTL_DELTA,MAX_AUTOTTL_DELTA
init.d: 50-quic4all custom

72.2

nfqws: --wssize-forced-cutoff
nfqws: --orig-tcp-flags, --dup-tcp-flags, --dpi-desync-tcp-flags
nfqws: --dup-ip-id

72.3

blockcheck: support URIs
blockcheck: CURL_HTTPS_GET=1 suppresses -I curl option for https (HEAD -> GET)

72.4

blockcheck: fix broken dns cache

72.5

nfqws: fix broken l7proto profile rediscovery
nfqws: backport from nfqws2 nl80211 ssid discovery fix for newer kernels

72.6

ipset: remove zapret-info based scripts because it's gone
blockcheck: fix tpws test regression

72.7

nfqws,tpws: memleak fix
mdig: --eagain, --eagain-delay

72.8

nfqws: fix breaking tcp if ts fooling is enabled but no timestamps present

72.9

blockcheck: fix detection of http redirection if domain/URI specified
install_easy: fix writing of ask_list variables

72.10

* nfqws2: fix broken wifi ssid update
* minor AI fixes

72.12

* github: reduce binaries size
* github: use 16K page size for android arm64 build
* nfqws: join fragments in quic CRYPTO reconstruction. allow intersections.
