mirror of
https://github.com/DanielLavrushin/b4.git
synced 2026-10-22 05:59:48 +00:00
c48fa3eef6
* Enhance nftables rules to include connection tracking direction - Added rules to track the direction of original and reply packets in the nftables configuration for better handling of TCP traffic on port 443. - Updated existing rules to incorporate connection tracking direction, ensuring that original and reply packets are processed correctly. - Adjusted the conditions for packet acceptance and queuing to improve traffic management and performance. A TCP port filter that covers client source ports makes b4 skip outgoing TCP Fixes #429 Domain-only sets leave the first segment of Chrome's split ClientHello untouched Fixes #430 A TCP Fast Open SYN that carries a ClientHello is fragmented like a data segment Fixes #431 b4's own fakes and fragments count toward the per-connection queue window Fixes #432 * issue-427-428 (#435) * feat(config): add TCP port overlap detection with ephemeral ranges * feat(direction): implement queue direction handling and add tests * Enhance packet direction handling and flow management in TUN - Introduced a new `Direction` type in the `engine` package to represent packet directions. - Updated `firstNLimiter` to return packet direction alongside admission status. - Enhanced flow counting logic to track the direction of TCP flows (original vs reply). - Implemented direction-based packet forwarding in the `Engine` to ensure correct routing. - Added tests to verify the correct handling of packet directions and flow records. - Refactored existing tests to utilize the new direction handling logic. - Introduced new utility functions for determining TCP direction based on conntrack rules. * fix(queue): queue router traffic once, clamp MSS before the queue, give b4's own packets their own window - Router-local packets were queued twice, at OUTPUT and again at POSTROUTING (regression since 1.26.1): b4 now jumps from OUTPUT only when device filtering moves the B4 jump to FORWARD. - nftables: the MSS clamp rules ran after the queue rules, so queued SYN-ACKs and router SYNs were never clamped (since 1.39.1); they now lead prerouting, output and forward, as on iptables. - Packets b4 sends into a connection carry a mark bit of their own (0x2000000). The OUTPUT CONNMARK save no longer tags those connections with the queue mark (regression since 1.71.1): their SYN-ACKs and RSTs reach b4 again, so RST protection, RST escalation and TTL learning work on them; their server data stays unqueued unless a set uses an incoming mode. - #432: connections b4 has sent into get the window again on top (2N TCP, 2M UDP), so its own fakes and fragments no longer use up the client's packets. Diagnostics and the installer compare a flowtable guard with 2*max(N,M). - TCP to private destinations is accepted unprocessed again (regression since 1.22.0): inbound connections to port-forwarded LAN servers broke when a set matched. - nftables keeps counting the reply window in original packets; the port classifier warning gets its own dashboard event. * fix(quic): a QUIC drop holds for the whole connection, not only the queue window (#428) When a set drops or rejects a QUIC connection (udp.mode drop or reject, or a block set), b4 now keeps it dropped past the first datagrams the queue rules hand it. Before, a connection whose first datagram had been let through (a ClientHello split over two Initials, as Chrome sends it, decided on the second) used up its queue window on the dropped datagrams and the rest reached the server, so a blocked site could open over QUIC. - nftables: the flow goes into a timed set (b4_udp_drop4/6, 120 s) dropped in b4_chain ahead of the UDP window rule. - iptables, TUN with xt_connbytes, and alongside the nftables set: b4 deletes the flow's conntrack entry through ctnetlink, so its later datagrams start a fresh entry inside the window and reach b4 again. Every delete names a complete tuple and carries a mark guard that turns a tuple-less request into a no-op instead of a table flush; a self-test decides once whether conntrack netlink is usable. - TUN without xt_connbytes: the engine's own packet count lets a dropped connection through to b4 past its limit. - System Info shows whether drops hold (nf_conntrack_netlink, kmod-nf-conntrack-netlink on OpenWrt, which the installer recommends). * fix(queue): drop the wider window, hold only real QUIC, keep held flows decidable, docs - Revert the #432 window extension (2N/2M on connections b4 sent into) and the TUN doubling for tracked re-sends: letting the strategies reach client data past about 10 KB put the default pastseq fakes inside the stream and broke TLS uploads through a default-strategy set (measured 21-26 of 80), and the combo delay hit the first request after the handshake. #432 stays open until fakes cannot land inside the stream. - The return for connections b4 sent into matches bit 0x2000000 with the queue mark clear, so foreign whole-value marks that carry both bits are not taken for b4's. - A QUIC drop holds a flow only when the datagram is QUIC or belongs to a QUIC flow b4 named; other UDP to a learned address is dropped as before. - nftables: the drop set is written from a background writer over one netlink socket, waiting behind another nf_tables transaction is no longer a failure, and a settings change empties the drop sets (with conntrack netlink) so held connections are decided again. - RST protection judges the first connection to an address b4 has not learned yet by the SYN-ACK it saw before the connection matched a set. - A queue mark containing bit 0x2000000 is warned about. - The iptables monitor checks for a TCP queue rule on one listing line; System Info lists nf_conntrack_netlink only for iptables; make test-netns runs the conntrack netlink tests after the tables tests. - Docs EN/RU, AI topics and changelog for the queue direction, the marks, router traffic, the MSS clamp order, QUIC drops and private destinations. * fix(queue): direction match on duplication rules, private guard only without an address match, refuse a new queue mark with bit 25 From the Copilot review of #438. - Duplication rules carry the ORIGINAL direction match wherever the kernel has it: B4 (-m conntrack --ctdir ORIGINAL), b4_chain (ct direction original) and TUN's duplication steer rules. Without it a wide port filter let a reply from a duplication address, such as a local service answering a client in that range, be queued at POSTROUTING or steered into the TUN and duplicated as client traffic, since the hook and the TUN take such packets as original. The TUN tests that kept these rules port-only now require the match. - The private-destination guard in handleTCPPacket applies only when no set's IP targets cover the address on that port. A set that lists 10.0.0.0/8 keeps its strategy, as before this branch; SNI-matched and port-only sets still leave port-forwarded LAN servers alone. - Saving a queue mark with bit 0x2000000 as a new value is refused (queue.mark, mark_conflict). A configuration that already holds one keeps loading and saving with the warning, so an upgrade does not stop the service. - Docs (EN, RU): capture.md and marks.md drop the duplication exemption from the direction text, the zapret note follows (its untracked packets are no longer queued toward duplication addresses), marks.md lists the refusal, matching.md the exception for listed private addresses. * fix(config): refuse a mark with bit 25 only where NFQUEUE mode newly takes it From Copilot's review of |
||
|---|---|---|
| .. | ||
| docs | ||
| i18n/ru | ||
| scripts | ||
| src | ||
| static | ||
| .gitignore | ||
| docusaurus.config.ts | ||
| package.json | ||
| pnpm-lock.yaml | ||
| pnpm-workspace.yaml | ||
| REVIEW.md | ||
| sidebars.ts | ||
| STYLE.md | ||
| tsconfig.json | ||