blockcheck2: fix unterminated string

zapret-lib: detect_payload_str
zapret-auto: cond_payload_str
2026-03-17 23:19:44 +00:00 · 2025-12-09 14:17:07 +03:00 · 2025-12-09 12:18:59 +03:00 · 2025-12-09 11:48:23 +03:00 · 2025-12-09 11:22:09 +03:00 · 2025-12-09 10:50:54 +03:00
24 changed files with 1031 additions and 234 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -108,7 +108,7 @@ jobs:
          export PKG_CONFIG_PATH=$DEPS_DIR/lib/pkgconfig
          export STAGING_DIR=$RUNNER_TEMP

-          if [[ "$ARCH" == lexra ]] || [[ "$ARCH" == ppc ]]; then
+          if [[ "$ARCH" == lexra ]] || [[ "$ARCH" == ppc ]] || [[ "$ARCH" == x86 ]]; then
            # use classic lua
            wget -qO- https://www.lua.org/ftp/lua-${LUA_RELEASE}.tar.gz | tar -xz
            (
--- a/blockcheck2.d/standard/24-syndata.sh
+++ b/blockcheck2.d/standard/24-syndata.sh
@@ -0,0 +1,49 @@
+. "$TESTDIR/def.inc"
+
+pktws_check_http()
+{
+	# $1 - test function
+	# $2 - domain
+
+	local PAYLOAD="--payload http_req" split
+
+	for split in '' multisplit multidisorder; do
+		pktws_curl_test_update "$1" "$2" --lua-desync=syndata ${split:+$PAYLOAD --lua-desync=$split}
+		pktws_curl_test_update "$1" "$2" --lua-desync=syndata:blob=fake_default_http $PAYLOAD ${split:+$PAYLOAD --lua-desync=$split}
+	done
+}
+
+pktws_check_https_tls()
+{
+	# $1 - test function
+	# $2 - domain
+	# $3 - PRE args for nfqws2
+
+	local PAYLOAD="--payload tls_client_hello" ok=0 pre="$3" split
+
+	for split in '' multisplit multidisorder; do
+		pktws_curl_test_update "$1" "$2" $pre --lua-desync=syndata ${split:+$PAYLOAD --lua-desync=$split} && ok=1
+		pktws_curl_test_update "$1" "$2" $pre --lua-desync=syndata:blob=0x1603 ${split:+$PAYLOAD --lua-desync=$split} && ok=1
+		pktws_curl_test_update "$1" "$2" $pre --lua-desync=syndata:blob=fake_default_tls:tls_mod=rnd,dupsid,rndsni ${split:+$PAYLOAD --lua-desync=$split} && ok=1
+		pktws_curl_test_update "$1" "$2" $pre --lua-desync=syndata:blob=fake_default_tls:tls_mod=rnd,dupsid,sni=google.com ${split:+$PAYLOAD --lua-desync=$split} && ok=1
+	done
+
+	[ "$ok" = 1 ]
+}
+
+pktws_check_https_tls12()
+{
+	# $1 - test function
+	# $2 - domain
+
+	pktws_check_https_tls "$1" "$2" && [ "$SCANLEVEL" != force ] && return
+	pktws_check_https_tls "$1" "$2" --lua-desync=wssize:wsize=1:scale=6
+}
+
+pktws_check_https_tls13()
+{
+	# $1 - test function
+	# $2 - domain
+
+	pktws_check_https_tls "$1" "$2"
+}
--- a/blockcheck2.d/standard/def.inc
+++ b/blockcheck2.d/standard/def.inc
@@ -2,6 +2,6 @@ FOOLINGS46_TCP=${FOOLINGS46_TCP:-"tcp_md5 badsum tcp_seq=-3000 tcp_seq=1000000 t
 FOOLINGS6_TCP=${FOOLINGS6_TCP:-"ip6_hopbyhop ip6_hopbyhop:ip6_hopbyhop2 ip6_destopt ip6_routing ip6_ah"}
 FOOLINGS_TCP="$FOOLINGS46_TCP"
 [ "$IPV" = 6 ] && FOOLINGS_TCP="$FOOLINGS_TCP $FOOLINGS6_TCP"
-FOOLINGS_UDP="badsum"
+FOOLINGS_UDP="${FOOLINGS_UDP:-badsum}"

 FAKE_REPEATS=${FAKE_REPEATS:-1}
--- a/blockcheck2.sh
+++ b/blockcheck2.sh
@@ -26,7 +26,7 @@ CURL=${CURL:-curl}

 TEST_DEFAULT=${TEST_DEFAULT:-standard}
 DOMAINS_DEFAULT=${DOMAINS_DEFAULT:-rutracker.org}
-QNUM=${QNUM:-59780}
+QNUM=${QNUM:-59781}
 SOCKS_PORT=${SOCKS_PORT:-1993}
 WS_UID=${WS_UID:-1}
 WS_GID=${WS_GID:-3003}
@@ -1199,8 +1199,8 @@ test_runner()
 				[ -f "$script" ] || continue
 				unset -f $FUNC
 				. "$script"
-				echo
 				existf $FUNC && {
+					echo
 					echo "* script : $TEST/$(basename "$script")"
 					$FUNC "$@"
 				}
@@ -1354,7 +1354,7 @@ check_domain_http_udp()
 	[ "$SKIP_PKTWS" = 1 ] || {
 		echo
 	        echo preparing $PKTWSD redirection
-		mdig_resolve_all $IPV ips $4
+		mdig_resolve_all $IPV ips $3
 		pktws_ipt_prepare_udp $2 "$ips"

 		pktws_check_domain_http3_bypass $1 $3
--- a/common/list.sh
+++ b/common/list.sh
@@ -25,7 +25,7 @@ filter_apply_hostlist_target()
 {
 	# $1 - var name of nfqws params

-	local v parm parm1 parm2 parm3 parm4 parm5 parm6 parm7 parm8 parmNA
+	local v parm parm1 parm2 parm3 parm4 parm5 parm6 parm7 parm8 parm9 parmNA
 	eval v="\$$1"
 	if contains "$v" "$HOSTLIST_MARKER" || contains "$v" "$HOSTLIST_NOAUTO_MARKER"; then
 		[ "$MODE_FILTER" = hostlist -o "$MODE_FILTER" = autohostlist ] &&
@@ -40,10 +40,11 @@ filter_apply_hostlist_target()
 				parm5="${AUTOHOSTLIST_FAIL_THRESHOLD:+--hostlist-auto-fail-threshold=$AUTOHOSTLIST_FAIL_THRESHOLD}"
 				parm6="${AUTOHOSTLIST_FAIL_TIME:+--hostlist-auto-fail-time=$AUTOHOSTLIST_FAIL_TIME}"
 				parm7="${AUTOHOSTLIST_RETRANS_THRESHOLD:+--hostlist-auto-retrans-threshold=$AUTOHOSTLIST_RETRANS_THRESHOLD}"
-				parm8="--hostlist=$HOSTLIST_AUTO"
+				parm8="${AUTOHOSTLIST_RETRANS_MAXSEQ:+--hostlist-auto-retrans-maxseq=$AUTOHOSTLIST_RETRANS_MAXSEQ}"
+				parm9="--hostlist=$HOSTLIST_AUTO"
 			}
-			parm="$parm1${parm2:+ $parm2}${parm3:+ $parm3}${parm4:+ $parm4}${parm5:+ $parm5}${parm6:+ $parm6}${parm7:+ $parm7}"
-			parmNA="$parm1${parm2:+ $parm2}${parm3:+ $parm3}${parm8:+ $parm8}"
+			parm="$parm1${parm2:+ $parm2}${parm3:+ $parm3}${parm4:+ $parm4}${parm5:+ $parm5}${parm6:+ $parm6}${parm7:+ $parm7}${parm8:+ $parm8}"
+			parmNA="$parm1${parm2:+ $parm2}${parm3:+ $parm3}${parm9:+ $parm9}"
 		}
 		v="$(replace_str $HOSTLIST_NOAUTO_MARKER "$parmNA" "$v")"
 		v="$(replace_str $HOSTLIST_MARKER "$parm" "$v")"
--- a/config.default
+++ b/config.default
@@ -26,6 +26,7 @@ IPSET_OPT="hashsize 262144 maxelem $SET_MAXELEM"
 IP2NET_OPT4="--prefix-length=22-30 --v4-threshold=3/4"
 IP2NET_OPT6="--prefix-length=56-64 --v6-threshold=5"
 # options for auto hostlist
+AUTOHOSTLIST_RETRANS_MAXSEQ=65536
 AUTOHOSTLIST_RETRANS_THRESHOLD=3
 AUTOHOSTLIST_FAIL_THRESHOLD=3
 AUTOHOSTLIST_FAIL_TIME=60
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -47,5 +47,36 @@ v0.4
 * nfqws2: profile templates
 * nfqws2: remove stun_binding_req, replace to stun. no more message type details
 * nfqws2: proper conntack position for replayed packets
+* nfqws2: execution_plan, execution_plan_cancel
 * blockcheck2: fix broken dns cache
 * nfqws2: LUA_COMPAT_VER tracking
+
+v0.5
+
+* nfqws2: u8add,u16add,u24add,u32add luacalls
+* nfqws2: abandon any arithmetics beyond 32bit (because lua 5.1 does not support 64 bit integers, store everything as double)
+* nfqws2: fix issues with 32-bit lua_Integer in lua<5.3 on 32-bit platforms
+* nfqws2: instance_cutoff luacall just warns and do nothing if ctx is nil
+* actions: build nfqws2 x86 binary with LUA 5.4, not with luajit
+* zapret-lib: http_reply, url and nld dissectors
+* zapret-lib: instance_cutoff_shim
+* zapret-auto: circular orchestrator
+
+v0.5.1
+
+* zapret-auto: separate failure detection logic
+* blockcheck2: fix broken http3 test
+
+v0.6
+
+* zapret-lib,zapret-antidpi: tls_mod_shim supports sni=%var subst
+* blockcheck2: syndata tests
+* nfqws2: reasm support negative overlaps. gaps are not supported.
+* nfqws2,zapret-auto: changed retransmission detection scheme.
+* zapret-auto: udp_in/udp_out failure detection
+
+v0.6.1
+
+* zapret-lib, zapret-auto: condition and stopif orchestrators
+* zapret-lib: detect_payload_str - sample lua payload detector
+* blockcheck2: unterminated string fix
--- a/init.d/openwrt/zapret2
+++ b/init.d/openwrt/zapret2
@@ -41,7 +41,7 @@ PIDDIR=/var/run

 USEROPT="--user=$WS_USER"
 NFQWS2="${NFQWS2:-$ZAPRET_BASE/nfq2/nfqws2}"
-LUAOPT="--lua-init=@$ZAPRET_BASE/lua/zapret-lib.lua --lua-init=@$ZAPRET_BASE/lua/zapret-antidpi.lua"
+LUAOPT="--lua-init=@$ZAPRET_BASE/lua/zapret-lib.lua --lua-init=@$ZAPRET_BASE/lua/zapret-antidpi.lua --lua-init=@$ZAPRET_BASE/lua/zapret-auto.lua"
 NFQWS2_OPT_BASE="$USEROPT --fwmark=$DESYNC_MARK $LUAOPT"

 run_daemon()
--- a/init.d/sysv/functions
+++ b/init.d/sysv/functions
@@ -72,7 +72,7 @@ DESYNC_MARK_POSTNAT=${DESYNC_MARK_POSTNAT:-0x20000000}

 QNUM=${QNUM:-300}
 NFQWS2="${NFQWS2:-$ZAPRET_BASE/nfq2/nfqws2}"
-LUAOPT="--lua-init=@$ZAPRET_BASE/lua/zapret-lib.lua --lua-init=@$ZAPRET_BASE/lua/zapret-antidpi.lua"
+LUAOPT="--lua-init=@$ZAPRET_BASE/lua/zapret-lib.lua --lua-init=@$ZAPRET_BASE/lua/zapret-antidpi.lua --lua-init=@$ZAPRET_BASE/lua/zapret-auto.lua"
 NFQWS2_OPT_BASE="$USEROPT --fwmark=$DESYNC_MARK $LUAOPT"


--- a/lua/zapret-antidpi.lua
+++ b/lua/zapret-antidpi.lua
@@ -113,7 +113,7 @@ end
 -- standard args : direction
 function http_domcase(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -139,7 +139,7 @@ end
 -- arg : spell=<str> . spelling of the "Host" header. must be exactly 4 chars long
 function http_hostcase(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -164,7 +164,7 @@ end
 -- standard args : direction
 function http_methodeol(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -221,10 +221,10 @@ function synack_split(ctx, desync)
 				error("synack_split: bad mode '"..mode.."'")
 			end
 		else
-			instance_cutoff(ctx) -- mission complete
+			instance_cutoff_shim(ctx, desync) -- mission complete
 		end
 	else
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 	end
 end

@@ -238,10 +238,10 @@ function synack(ctx, desync)
 			DLOG("synack: sending")
 			rawsend_dissect_ipfrag(dis, desync_opts(desync))
 		else
-			instance_cutoff(ctx) -- mission complete
+			instance_cutoff_shim(ctx, desync) -- mission complete
 		end
 	else
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 	end
 end

@@ -256,10 +256,10 @@ function wsize(ctx, desync)
 				return VERDICT_MODIFY
 			end
 		else
-			instance_cutoff(ctx) -- mission complete
+			instance_cutoff_shim(ctx, desync) -- mission complete
 		end
 	else
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 	end
 end

@@ -270,7 +270,7 @@ end
 -- arg : forced_cutoff=<list> - comma separated list of payloads that trigger forced wssize cutoff. by default - any non-empty payload
 function wssize(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	local verdict = VERDICT_PASS
@@ -281,7 +281,7 @@ function wssize(ctx, desync)
 		end
 		if #desync.dis.payload>0 and (not desync.arg.forced_cutoff or in_list(desync.arg.forced_cutoff, desync.l7payload)) then
 			DLOG("wssize: forced cutoff")
-			instance_cutoff(ctx)
+			instance_cutoff_shim(ctx, desync)
 		end
 	end
 	return verdict
@@ -290,7 +290,7 @@ end
 -- nfqws1 : "--dpi-desync=syndata"
 -- standard args : fooling, rawsend, reconstruct, ipfrag
 -- arg : blob=<blob> - fake payload. must fit to single packet. no segmentation possible. default - 16 zero bytes.
-- arg : tls_mod=<list> - comma separated list of tls mods : rnd,rndsni,sni=<str>,dupsid,padencap
+-- arg : tls_mod=<list> - comma separated list of tls mods : rnd,rndsni,sni=<str>. sni=%var is supported
 function syndata(ctx, desync)
 	if desync.dis.tcp then
 		if bitand(desync.dis.tcp.th_flags, TH_SYN + TH_ACK)==TH_SYN then
@@ -298,17 +298,17 @@ function syndata(ctx, desync)
 			dis.payload = blob(desync, desync.arg.blob, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
 			apply_fooling(desync, dis)
 			if desync.arg.tls_mod then
-				dis.payload = tls_mod(dis.payload, desync.arg.tls_mod, nil)
+				dis.payload = tls_mod_shim(desync, dis.payload, desync.arg.tls_mod, nil)
 			end
 			if b_debug then DLOG("syndata: "..hexdump_dlog(dis.payload)) end
 			if rawsend_dissect_ipfrag(dis, desync_opts(desync)) then
 				return VERDICT_DROP
 			end
 		else
-			instance_cutoff(ctx) -- mission complete
+			instance_cutoff_shim(ctx, desync) -- mission complete
 		end
 	else
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 	end
 end

@@ -317,7 +317,7 @@ end
 -- arg : rstack - send RST,ACK instead of RST
 function rst(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -340,7 +340,7 @@ end
 -- nfqws1 : "--dpi-desync=fake"
 -- standard args : direction, payload, fooling, ip_id, rawsend, reconstruct, ipfrag
 -- arg : blob=<blob> - fake payload
-- arg : tls_mod=<list> - comma separated list of tls mods : rnd,rndsni,sni=<str>,dupsid,padencap
+-- arg : tls_mod=<list> - comma separated list of tls mods : rnd,rndsni,sni=<str>,dupsid,padencap . sni=%var is supported
 function fake(ctx, desync)
 	direction_cutoff_opposite(ctx, desync)
 	-- by default process only outgoing known payloads
@@ -351,7 +351,7 @@ function fake(ctx, desync)
 			end
 			local fake_payload = blob(desync, desync.arg.blob)
 			if desync.reasm_data and desync.arg.tls_mod then
-				fake_payload = tls_mod(fake_payload, desync.arg.tls_mod, desync.reasm_data)
+				fake_payload = tls_mod_shim(desync, fake_payload, desync.arg.tls_mod, desync.reasm_data)
 			end
 			-- check debug to save CPU
 			if b_debug then DLOG("fake: "..hexdump_dlog(fake_payload)) end
@@ -371,7 +371,7 @@ end
 -- arg : nodrop - do not drop current dissect
 function multisplit(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -421,11 +421,11 @@ end
 -- arg : pos=<postmarker list> . position marker list. example : "1,host,midsld+1,-10"
 -- arg : seqovl=N . decrease seq number of the second segment in the original order by N and fill N bytes with pattern (default - all zero). N must be less than the first split pos.
 -- arg : seqovl_pattern=<blob> . override pattern
-- arg : blob=<blob> - use this data instead of desync.dis.payload
+-- arg : blob=<blob> - use this data instead of reasm_data
 -- arg : nodrop - do not drop current dissect
 function multidisorder(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -491,7 +491,7 @@ end
 -- arg : nodrop - do not drop current dissect
 function hostfakesplit(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -600,11 +600,11 @@ end
 -- arg : pattern=<blob> . fill fake parts with this pattern
 -- arg : seqovl=N . decrease seq number of the first segment by N and fill N bytes with pattern (default - all zero)
 -- arg : seqovl_pattern=<blob> . override seqovl pattern
-- arg : blob=<blob> - use this data instead of desync.dis.payload
+-- arg : blob=<blob> - use this data instead of reasm_data
 -- arg : nodrop - do not drop current dissect
 function fakedsplit(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -697,7 +697,7 @@ end
 -- arg : nodrop - do not drop current dissect
 function fakeddisorder(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -797,7 +797,7 @@ end
 -- arg : blob=<blob> - use this data instead of desync.dis.payload
 function tcpseg(ctx, desync)
 	if not desync.dis.tcp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -841,7 +841,7 @@ end
 -- arg : pattern_offset=N . offset in the pattern. 0 by default
 function udplen(ctx, desync)
 	if not desync.dis.udp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
@@ -877,7 +877,7 @@ end
 -- arg : dn=N - message starts from "dN". 2 by default
 function dht_dn(ctx, desync)
 	if not desync.dis.udp then
-		instance_cutoff(ctx)
+		instance_cutoff_shim(ctx, desync)
 		return
 	end
 	direction_cutoff_opposite(ctx, desync)
--- a/lua/zapret-auto.lua
+++ b/lua/zapret-auto.lua
@@ -0,0 +1,320 @@
+-- standard automation/orchestration code
+-- this is related to making dynamic strategy decisions without rewriting or altering strategy function code
+-- orchestrators can decide which instances to call or not to call or pass them dynamic arguments
+-- failure detectors test potential block conditions for orchestrators
+
+-- arg: reqhost - require hostname, do not work with ip
+function automate_host_record(desync)
+	local key
+	if desync.arg.reqhost then
+		key = desync.track and desync.track.hostname
+	else
+		key = host_or_ip(desync)
+	end
+	if not key then
+		DLOG("automate: host record key unavailable")
+		return nil
+	end
+	DLOG("automate: host record key '"..key.."'")
+	if not autostate then
+		autostate = {}
+	end
+	if not autostate[key] then
+		autostate[key] = {}
+	end
+	return autostate[key]
+end
+function automate_conn_record(desync)
+	if not desync.track.lua_state.automate then
+		desync.track.lua_state.automate = {}
+	end
+	return desync.track.lua_state.automate
+end
+
+-- counts failure, optionally (if crec is given) prevents dup failure counts in a single connection
+-- if 'maxtime' between failures is exceeded then failure count is reset
+-- return true if threshold ('fails') is reached
+-- hres is host record. host or ip bound table
+-- cres is connection record. connection bound table
+function automate_failure_counter(hrec, crec, fails, maxtime)
+	if crec and crec.failure then
+		DLOG("automate: duplicate failure in the same connection. not counted")
+	else
+		if crec then crec.failure = true end
+		local tnow=os.time()
+		if not hrec.failure_time_last then
+			hrec.failure_time_last = tnow
+		end
+		if not hrec.failure_counter then
+			hrec.failure_counter = 0
+		elseif tnow>(hrec.failure_time_last + maxtime) then
+			DLOG("automate: failure counter reset because last failure was "..(tnow - hrec.failure_time_last).." seconds ago")
+			hrec.failure_counter = 0
+		end
+		hrec.failure_counter = hrec.failure_counter + 1
+		hrec.failure_time_last = tnow
+		if b_debug then DLOG("automate: failure counter "..hrec.failure_counter..(fails and ('/'..fails) or '')) end
+		if fails and hrec.failure_counter>=fails then
+			hrec.failure_counter = nil -- reset counter
+			return true
+		end
+	end
+	return false
+end
+
+-- location is url compatible with Location: header
+-- hostname is original hostname
+function is_dpi_redirect(hostname, location)
+	local ds = dissect_url(location)
+	if ds.domain then
+		local sld1 = dissect_nld(hostname,2)
+		local sld2 = dissect_nld(ds.domain,2)
+		return sld2 and sld1~=sld2
+	end
+	return false
+end
+
+-- standard failure detector
+-- works with tcp and udp
+-- detected failures:
+--   incoming RST
+--   incoming http redirection
+--   outgoing retransmissions
+--   udp too much out with too few in
+-- arg: seq=<rseq> - tcp: if packet is beyond this relative sequence number treat this connection as successful. default is 64K
+-- arg: retrans=N - tcp: retrans count threshold. default is 3
+-- arg: rst=<rseq> - tcp: maximum relative sequence number to treat incoming RST as DPI reset. default is 1
+-- arg: no_http_redirect - tcp: disable http_reply dpi redirect trigger
+-- arg: udp_out - udp: >= outgoing udp packets. default is 3
+-- arg: udp_in - udp: with <= incoming udp packets. default is 1
+function standard_failure_detector(desync, crec, arg)
+	if crec.nocheck then return false end
+
+	local seq_rst = tonumber(arg.rst) or 1
+	local retrans = tonumber(arg.retrans) or 3
+	local maxseq = tonumber(arg.seq) or 0x10000
+	local udp_in = tonumber(arg.udp_in) or 1
+	local udp_out = tonumber(arg.udp_out) or 3
+
+	local trigger = false
+	if desync.dis.tcp then
+		local seq = pos_get(desync,'s')
+		if maxseq and seq>maxseq then
+			DLOG("standard_failure_detector: s"..seq.." is beyond s"..maxseq..". treating connection as successful")
+			crec.nocheck = true
+			return false
+		end
+
+		if desync.outgoing then
+			if #desync.dis.payload>0 and retrans and (crec.retrans or 0)<retrans then
+				if is_retransmission(desync) then
+					crec.retrans = crec.retrans and (crec.retrans+1) or 1
+					DLOG("standard_failure_detector: retransmission "..crec.retrans.."/"..retrans)
+					trigger = crec.retrans>=retrans
+				end
+			end
+		else
+			if seq_rst and bitand(desync.dis.tcp.th_flags, TH_RST)~=0 then
+				trigger = seq<=seq_rst
+				if b_debug then
+					if trigger then
+						DLOG("standard_failure_detector: incoming RST s"..seq.." in range s"..seq_rst)
+					else
+						DLOG("standard_failure_detector: not counting incoming RST s"..seq.." beyond s"..seq_rst)
+					end
+				end
+			elseif not arg.no_http_redirect and desync.l7payload=="http_reply" and desync.track.hostname then
+				local hdis = http_dissect_reply(desync.dis.payload)
+				if hdis and (hdis.code==302 or hdis.code==307) and hdis.headers.location and hdis.headers.location then
+					trigger = is_dpi_redirect(desync.track.hostname, hdis.headers.location.value)
+					if b_debug then
+						if trigger then
+							DLOG("standard_failure_detector: http redirect "..hdis.code.." to '"..hdis.headers.location.value.."'. looks like DPI redirect.")
+						else
+							DLOG("standard_failure_detector: http redirect "..hdis.code.." to '"..hdis.headers.location.value.."'. NOT a DPI redirect.")
+						end
+					end
+				end
+			end
+		end
+	elseif desync.dis.udp then
+		if desync.outgoing then
+			if udp_out then
+				local udp_in = udp_in or 0
+				trigger = desync.track.pcounter_orig>=udp_out and desync.track.pcounter_reply<=udp_in
+				if trigger then
+					crec.nocheck = true
+					if b_debug then
+						DLOG("standard_failure_detector: udp_out "..desync.track.pcounter_orig..">="..udp_out.." udp_in "..desync.track.pcounter_reply.."<="..udp_in)
+					end
+				end
+			end
+		end
+	end
+	return trigger
+end
+
+-- circularily change strategy numbers when failure count reaches threshold ('fails')
+-- works with tcp only
+-- this orchestrator requires redirection of incoming traffic to cache RST and http replies !
+-- each orchestrated instance must have strategy=N arg, where N starts from 1 and increment without gaps
+-- if 'final' arg is present in an orchestrated instance it stops rotation
+-- arg: fails=N - failture count threshold. default is 3
+-- arg: time=<sec> - if last failure happened earlier than `maxtime` seconds ago - reset failure counter. default is 60.
+-- arg: reqhost - pass with no tampering if hostname is unavailable
+-- arg: detector - failure detector function name.
+-- args for failure detector - see standard_failure_detector or your own detector
+-- test case: nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-init=@zapret-auto.lua --in-range=-s1 --lua-desync=circular --lua-desync=argdebug:strategy=1 --lua-desync=argdebug:strategy=2
+function circular(ctx, desync)
+	local function count_strategies(hrec)
+		if not hrec.ctstrategy then
+			local uniq={}
+			local n=0
+			for i,instance in pairs(desync.plan) do
+				if instance.arg.strategy then
+					n = tonumber(instance.arg.strategy)
+					if not n or n<1 then
+						error("circular: strategy number '"..tostring(instance.arg.strategy).."' is invalid")
+					end
+					uniq[tonumber(instance.arg.strategy)] = true
+					if instance.arg.final then
+						hrec.final = n
+					end
+				end
+			end
+			n=0
+			for i,v in pairs(uniq) do
+				n=n+1
+			end
+			if n~=#uniq then
+				error("circular: strategies numbers must start from 1 and increment. gaps are not allowed.")
+			end
+			hrec.ctstrategy = n
+		end
+	end
+
+	-- take over execution. prevent further instance execution in case of error
+	orchestrate(ctx, desync)
+
+	if not desync.track then
+		DLOG_ERR("circular: conntrack is missing but required")
+		return
+	end
+
+	local hrec = automate_host_record(desync)
+	if not hrec then
+		DLOG("circular: passing with no tampering")
+		return
+	end
+
+	count_strategies(hrec)
+	if hrec.ctstrategy==0 then
+		error("circular: add strategy=N tag argument to each following instance ! N must start from 1 and increment")
+	end
+	if not hrec.nstrategy then
+		DLOG("circular: start from strategy 1")
+		hrec.nstrategy = 1
+	end
+
+	local verdict = VERDICT_PASS
+	if hrec.final~=hrec.nstrategy then
+		local crec = automate_conn_record(desync)
+		local fails = tonumber(desync.arg.fails) or 3
+		local maxtime = tonumber(desync.arg.time) or 60
+		local failure_detector
+		if desync.arg.detector then
+			if type(_G[desync.arg.detector])~="function" then
+				error("circular: invalid failure detector function '"..desync.arg.detector.."'")
+			end
+			failure_detector = _G[desync.arg.detector]
+		else
+			failure_detector = standard_failure_detector
+		end
+		if failure_detector(desync,crec,desync.arg) then
+			-- failure happened. count failures.
+			if automate_failure_counter(hrec, crec, fails, maxtime) then
+				-- counter reaches threshold. circular strategy change
+				hrec.nstrategy = (hrec.nstrategy % hrec.ctstrategy) + 1
+				DLOG("circular: rotate strategy to "..hrec.nstrategy)
+				if hrec.nstrategy == hrec.final then
+					DLOG("circular: final strategy "..hrec.final.." reached. will rotate no more.")
+				end
+			end
+		end
+	end
+
+	DLOG("circular: current strategy "..hrec.nstrategy)
+	local dcopy = desync_copy(desync)
+	while true do
+		local instance = plan_instance_pop(desync)
+		if not instance then break end
+		if instance.arg.strategy and tonumber(instance.arg.strategy)==hrec.nstrategy then
+			verdict = plan_instance_execute(dcopy, verdict, instance)
+		end
+	end
+
+	return verdict
+end
+
+-- test iff functions
+function cond_true(desync)
+	return true
+end
+function cond_false(desync)
+	return false
+end
+-- arg: percent - of true . 50 by default
+function cond_random(desync)
+	return math.random(0,99)<(tonumber(desync.arg.percent) or 50)
+end
+-- this iif function detects packets having 'arg.pattern' string in their payload
+-- test case : nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-init=@zapret-auto.lua --lua-desync=condition:iff=cond_payload_str:pattern=1234 --lua-desync=argdebug:testarg=1 --lua-desync=argdebug:testarg=2:morearg=xyz
+-- test case (true)  : echo aaz1234zzz | ncat -4u 1.1.1.1 443
+-- test case (false) : echo aaze124zzz | ncat -4u 1.1.1.1 443
+function cond_payload_str(desync)
+	if not desync.arg.pattern then
+		error("cond_payload_str: missing 'pattern'")
+	end
+	return string.find(desync.dis.payload,desync.arg.pattern,1,true)
+end
+-- check iff function available. error if not
+function require_iff(desync, name)
+	if not desync.arg.iff then
+		error(name..": missing 'iff' function")
+	end
+	if type(_G[desync.arg.iff])~="function" then
+		error(name..": invalid 'iff' function '"..desync.arg.iff.."'")
+	end
+end
+-- execute further desync instances only if user-provided 'iff' function returns true
+-- for example, this can be used by custom protocol detectors
+-- arg: iff - condition function. takes desync as arg and returns bool. (cant use 'if' because of reserved word)
+-- arg: neg - invert condition function result
+-- test case : nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-init=@zapret-auto.lua --lua-desync=condition:iff=cond_random --lua-desync=argdebug:testarg=1 --lua-desync=argdebug:testarg=2:morearg=xyz
+function condition(ctx, desync)
+	require_iff(desync, "condition")
+	orchestrate(ctx, desync)
+	if logical_xor(_G[desync.arg.iff](desync), desync.arg.neg) then
+		DLOG("condition: true")
+		return replay_execution_plan(desync)
+	else
+		DLOG("condition: false")
+		plan_clear(desync)
+	end
+end
+-- clear execution plan if user provided 'iff' functions returns true
+-- can be used with other orchestrators to stop execution conditionally
+-- arg: iff - condition function. takes desync as arg and returns bool. (cant use 'if' because of reserved word)
+-- arg: neg - invert condition function result
+-- test case : nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-init=@zapret-auto.lua --in-range=-s1 --lua-desync=circular --lua-desync=stopif:iff=cond_random:strategy=1 --lua-desync=argdebug:strategy=1 --lua-desync=argdebug:strategy=2
+function stopif(ctx, desync)
+	require_iff(desync, "stopif")
+	orchestrate(ctx, desync)
+	if logical_xor(_G[desync.arg.iff](desync), desync.arg.neg) then
+		DLOG("stopif: true")
+		plan_clear(desync)
+	else
+		-- do not do anything. allow other orchestrator to finish the plan
+		DLOG("stopif: false")
+	end
+end
--- a/lua/zapret-lib.lua
+++ b/lua/zapret-lib.lua
@@ -1,8 +1,8 @@
 HEXDUMP_DLOG_MAX = HEXDUMP_DLOG_MAX or 32
 NOT3=bitnot(3)
 NOT7=bitnot(7)
-math.randomseed(os.time())
-
+-- xor pid,tid,sec,nsec
+math.randomseed(bitxor(getpid(),gettid(),clock_gettime()))

 -- basic desync function
 -- execute given lua code. "desync" is temporary set as global var to be accessible to the code
@@ -61,6 +61,70 @@ function posdebug(ctx,desync)
 	DLOG(s)
 end

+-- basic desync function
+-- set l7payload to 'arg.payload' if reasm.data or desync.dis.payload contains 'arg.pattern' substring
+-- NOTE : this does not set payload on C code side !
+-- NOTE : C code will not see payload change. --payload args take only payloads known to C code and cause error if unknown.
+-- arg: pattern - substring for search inside reasm_data or desync.dis.payload
+-- arg: payload - set desync.l7payload to this if detected
+-- arg: undetected - set desync.l7payload to this if not detected
+-- test case : nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-init=@zapret-antidpi.lua --lua-init=@zapret-auto.lua --lua-desync=detect_payload_str:pattern=1234:payload=my --lua-desync=fake:blob=0x1234:payload=my
+function detect_payload_str(ctx, desync)
+	if not desync.arg.pattern then
+		error("detect_payload_str: missing 'pattern'")
+	end
+	local data = desync.reasm_data or desync.dis.payload
+	local b = string.find(data,desync.arg.pattern,1,true)
+	if b then
+		DLOG("detect_payload_str: detected '"..desync.arg.payload.."'")
+		if desync.arg.payload then desync.l7payload = desync.arg.payload end
+	else
+		DLOG("detect_payload_str: not detected '"..desync.arg.payload.."'")
+		if desync.arg.undetected then desync.l7payload = desync.arg.undetected end
+	end
+end
+
+
+-- this shim is needed then function is orchestrated. ctx services not available
+-- have to emulate cutoff in LUA using connection persistent table track.lua_state
+function instance_cutoff_shim(ctx, desync, dir)
+	if ctx then
+		instance_cutoff(ctx, dir)
+	elseif not desync.track then
+		DLOG("instance_cutoff_shim: cannot cutoff '"..desync.func_instance.."' because conntrack is absent")
+	else
+		if not desync.track.lua_state.cutoff_shim then
+			desync.track.lua_state.cutoff_shim = {}
+		end
+		if not desync.track.lua_state.cutoff_shim[desync.func_instance] then
+			desync.track.lua_state.cutoff_shim[desync.func_instance] = {}
+		end
+		if type(dir)=="nil" then
+			-- cutoff both directions by default
+			desync.track.lua_state.cutoff_shim[desync.func_instance][true] = true
+			desync.track.lua_state.cutoff_shim[desync.func_instance][false] = true
+		else
+			desync.track.lua_state.cutoff_shim[desync.func_instance][dir] = true
+		end
+		if b_debug then DLOG("instance_cutoff_shim: cutoff '"..desync.func_instance.."' in="..tostring(type(dir)=="nil" and true or not dir).." out="..tostring(type(dir)=="nil" or dir)) end
+	end
+end
+function cutoff_shim_check(desync)
+	if not desync.track then
+		DLOG("cutoff_shim_check: cannot check '"..desync.func_instance.."' cutoff because conntrack is absent")
+		return false
+	else
+		local b=desync.track.lua_state.cutoff_shim and
+			desync.track.lua_state.cutoff_shim[desync.func_instance] and
+			desync.track.lua_state.cutoff_shim[desync.func_instance][desync.outgoing]
+		if b and b_debug then 
+			DLOG("cutoff_shim_check: '"..desync.func_instance.."' "..(desync.outgoing and "out" or "in").." cutoff")
+		end
+		return b
+	end
+end
+
+
 -- applies # and $ prefixes. #var means var length, %var means var value
 function apply_arg_prefix(arg)
 	for a,v in pairs(arg) do
@@ -78,41 +142,88 @@ function apply_arg_prefix(arg)
 	end
 end
 -- copy instance identification and args from execution plan to desync table
-function apply_execution_plan(desync, plan)
-	desync.func = plan.func
-	desync.func_n = plan.func_n
-	desync.func_instance = plan.func_instance
-	desync.arg = deepcopy(plan.arg)
+function apply_execution_plan(desync, instance)
+	desync.func = instance.func
+	desync.func_n = instance.func_n
+	desync.func_instance = instance.func_instance
+	desync.arg = deepcopy(instance.arg)
 	apply_arg_prefix(desync.arg)
 end
-- redo what whould be done without orchestration
-function replay_execution_plan(desync, plan)
-	for i=1,#plan do
-		if not payload_match_filter(desync.l7payload, plan[i].payload_filter) then
-			DLOG("orchestrator: not calling '"..desync.func_instance.."' because payload '"..desync.l7payload.."' does not match filter '"..plan[i].payload_filter.."'")
-		elseif not pos_check_range(desync, plan[i].range) then
-			DLOG("orchestrator: not calling '"..desync.func_instance.."' because pos "..pos_str(desync,plan[i].range.from).." "..pos_str(desync,plan[i].range.to).." is out of range '"..pos_range_str(plan[i].range).."'")
-		else
-			apply_execution_plan(desync, plan[i])
-			DLOG("orchestrator: executing '"..desync.func_instance.."'")
-			_G[plan[i].func](ctx, desync)
-		end
+-- produce resulting verdict from 2 verdicts
+function verdict_aggregate(v1, v2)
+	local v
+	v1 = v1 or VERDICT_PASS
+	v2 = v2 or VERDICT_PASS
+	if v1==VERDICT_DROP or v2==VERDICT_DROP then
+		v=VERDICT_DROP
+	elseif v1==VERDICT_MODIFY or v2==VERDICT_MODIFY then
+		v=VERDICT_MODIFY
+	else
+		v=VERDICT_PASS
 	end
+	return v
+end
+function plan_instance_execute(desync, verdict, instance)
+	apply_execution_plan(desync, instance)
+	if cutoff_shim_check(desync) then
+		DLOG("plan_instance_execute: not calling '"..desync.func_instance.."' because of voluntary cutoff")
+	elseif not payload_match_filter(desync.l7payload, instance.payload_filter) then
+		DLOG("plan_instance_execute: not calling '"..desync.func_instance.."' because payload '"..desync.l7payload.."' does not match filter '"..instance.payload_filter.."'")
+	elseif not pos_check_range(desync, instance.range) then
+		DLOG("plan_instance_execute: not calling '"..desync.func_instance.."' because pos "..pos_str(desync,instance.range.from).." "..pos_str(desync,instance.range.to).." is out of range '"..pos_range_str(instance.range).."'")
+	else
+		DLOG("plan_instance_execute: calling '"..desync.func_instance.."'")
+		verdict = verdict_aggregate(verdict,_G[instance.func](nil, desync))
+	end
+	return verdict
+end
+function plan_instance_pop(desync)
+	return (desync.plan and #desync.plan>0) and table.remove(desync.plan, 1)
+end
+function plan_clear(desync)
+	while table.remove(desync.plan) do end
+end
+-- this approach allows nested orchestrators
+function orchestrate(ctx, desync)
+	if not desync.plan then
+		execution_plan_cancel(ctx)
+		desync.plan = execution_plan(ctx)
+	end
+end
+-- copy desync preserving lua_state
+function desync_copy(desync)
+	local dcopy = deepcopy(desync)
+	if desync.track then
+		-- preserve lua state
+		dcopy.track.lua_state = desync.track.lua_state
+	end
+	if desync.plan then
+		-- preserve execution plan
+		dcopy.plan = desync.plan
+	end
+	return dcopy
+end
+-- redo what whould be done without orchestration
+function replay_execution_plan(desync)
+	local dcopy = desync_copy(desync)
+	local verdict = VERDICT_PASS
+	while true do
+		local instance = plan_instance_pop(dcopy)
+		if not instance then break end
+		verdict = plan_instance_execute(dcopy, verdict, instance)
+	end
+	return verdict
 end
 -- this function demonstrates how to stop execution of upcoming desync instances and take over their job
 -- this can be used, for example, for orchestrating conditional processing without modifying of desync functions code
 -- test case : nfqws2 --qnum 200 --debug --lua-init=@zapret-lib.lua --lua-desync=desync_orchestrator_example --lua-desync=pass --lua-desync=pass
 function desync_orchestrator_example(ctx, desync)
-	local plan = execution_plan(ctx)
-	if #plan>0 then
-		DLOG("orchestrator: taking over upcoming desync instances")
-		local desync_copy = deepcopy(desync)
-		execution_plan_cancel(ctx)
-		replay_execution_plan(desync_copy, plan)
-	end
+	DLOG("orchestrator: taking over upcoming desync instances")
+	orchestrate(ctx, desync)
+	return replay_execution_plan(desync)
 end

-- these function duplicate range check logic from C code
+-- these functions duplicate range check logic from C code
 -- mode must be n,d,b,s,x,a
 -- pos is {mode,pos}
 -- range is {from={mode,pos}, to={mode,pos}, upper_cutoff}
@@ -126,7 +237,7 @@ function pos_get(desync, mode)
 		elseif mode=='b' then
 			return desync.outgoing and desync.track.pbcounter_orig or desync.track.pbcounter_reply
 		elseif mode=='s' and desync.track.tcp then
-			return desync.outgoing and (desync.track.tcp.seq - desync.track.tcp.seq0) or (desync.track.tcp.ack - desync.track.tcp.ack0)
+			return desync.outgoing and u32add(desync.track.tcp.seq, -desync.track.tcp.seq0) or u32add(desync.track.tcp.ack, -desync.track.tcp.ack0)
 		end
 	end
 	return 0
@@ -164,7 +275,9 @@ end
 function pos_str(desync, pos)
 	return pos.mode..pos_get(desync, pos.mode)
 end
-
+function is_retransmission(desync)
+	return desync.track and desync.track.tcp and 0==bitand(u32add(desync.track.tcp.uppos_orig_prev, -desync.track.tcp.pos_orig), 0x80000000)
+end

 -- prepare standard rawsend options from desync
 -- repeats - how many time send the packet
@@ -236,12 +349,15 @@ function str_or_hex(s)
 		return s
 	end
 end
+function logical_xor(a,b)
+	return a and not b or not a and b
+end
 -- print to DLOG any variable. tables are expanded in the tree form, unprintables strings are hex dumped
 function var_debug(v)
 	local function dbg(v,level)
 		if type(v)=="table" then
 			for key, value in pairs(v) do
-				DLOG(string.rep(" ",2*level).."."..key)
+				DLOG(string.rep(" ",2*level).."."..tostring(key))
 				dbg(v[key],level+1)
 			end
 		elseif type(v)=="string" then
@@ -429,6 +545,88 @@ function http_dissect_req(http)
 	local uri = string.sub(req,pos,pnext-1)
 	return { method = method, uri = uri, headers = http_dissect_headers(http,hdrpos) }
 end
+function http_dissect_reply(http)
+	if not http then return nil; end
+	local s, pos, code
+	s = string.sub(http,1,8)
+	if s~="HTTP/1.1" and s~="HTTP/1.0" then return nil end
+	pos = string.find(http,"[ \t\r\n]",10)
+	code = tonumber(string.sub(http,10,pos-1))
+	if not code then return nil end
+	pos = find_next_line(http,pos)
+	return { code = code, headers = http_dissect_headers(http,pos) }
+end
+function dissect_url(url)
+	local p1,pb,pstart,pend
+	local proto, creds, domain, port, uri
+	p1 = string.find(url,"[^ \t]")
+	if not p1 then return nil end
+	pb = p1
+	pstart,pend = string.find(url,"[a-z]+://",p1)
+	if pend then
+		proto = string.sub(url,pstart,pend-3)
+		p1 = pend+1
+	end
+	pstart,pend = string.find(url,"[@/]",p1)
+	if pend and string.sub(url,pstart,pend)=='@' then
+		creds = string.sub(url,p1,pend-1)
+		p1 = pend+1
+	end
+	pstart,pend = string.find(url,"/",p1,true)
+	if pend then
+		if pend==pb then
+			uri = string.sub(url,pb)
+		else
+			uri = string.sub(url,pend)
+			domain = string.sub(url,p1,pend-1)
+		end
+	else
+		if proto then
+			domain = string.sub(url,p1)
+		else
+			uri = string.sub(url,p1)
+		end
+	end
+	if domain then
+		pstart,pend = string.find(domain,':',1,true)
+		if pend then
+			port = string.sub(domain, pend+1)
+			domain = string.sub(domain, 1, pstart-1)
+		end
+	end
+	return { proto = proto, creds = creds, domain = domain, port = port, uri=uri }
+end
+function dissect_nld(domain, level)
+	if domain then
+		local n=1
+		for pos=#domain,1,-1 do
+			if string.sub(domain,pos,pos)=='.' then
+				if n==level then
+					return string.sub(domain, pos+1)
+				end
+				n=n+1
+			end
+		end
+		if n==level then
+			return domain
+		end
+	end
+	return nil
+end
+
+-- support sni=%var
+function tls_mod_shim(desync, blob, modlist, payload)
+	local p1,p2 = string.find(modlist,"sni=%%[^,]+")
+	if p1 then
+		local var = string.sub(modlist,p1+5,p2)
+		local val = desync[var] or _G[var]
+		if not val then
+			error("tls_mod_shim: non-existent var '"..var.."'")
+		end
+		modlist = string.sub(modlist,1,p1+3)..val..string.sub(modlist,p2+1)
+	end
+	return tls_mod(blob,modlist,payload)
+end

 -- convert comma separated list of tcp flags to tcp.th_flags bit field
 function parse_tcp_flags(s)
@@ -641,10 +839,10 @@ function apply_fooling(desync, dis, fooling_options)
 	if not dis then dis = desync.dis end
 	if dis.tcp then
 		if tonumber(fooling_options.tcp_seq) then
-			dis.tcp.th_seq = dis.tcp.th_seq + fooling_options.tcp_seq
+			dis.tcp.th_seq = u32add(dis.tcp.th_seq, fooling_options.tcp_seq)
 		end
 		if tonumber(fooling_options.tcp_ack) then
-			dis.tcp.th_ack = dis.tcp.th_ack + fooling_options.tcp_ack
+			dis.tcp.th_ack = u32add(dis.tcp.th_ack, fooling_options.tcp_ack)
 		end
 		if fooling_options.tcp_flags_unset then
 			dis.tcp.th_flags = bitand(dis.tcp.th_flags, bitnot(parse_tcp_flags(fooling_options.tcp_flags_unset)))
@@ -655,7 +853,7 @@ function apply_fooling(desync, dis, fooling_options)
 		if tonumber(fooling_options.tcp_ts) then
 			local idx = find_tcp_option(dis.tcp.options,TCP_KIND_TS)
 			if idx and (dis.tcp.options[idx].data and #dis.tcp.options[idx].data or 0)==8 then
-				dis.tcp.options[idx].data = bu32(u32(dis.tcp.options[idx].data)+fooling_options.tcp_ts)..string.sub(dis.tcp.options[idx].data,5)
+				dis.tcp.options[idx].data = bu32(u32add(u32(dis.tcp.options[idx].data),fooling_options.tcp_ts))..string.sub(dis.tcp.options[idx].data,5)
 			else
 				DLOG("apply_fooling: timestamp tcp option not present or invalid")
 			end
@@ -872,7 +1070,6 @@ end
 -- send dissect with tcp segmentation based on mss value. appply specified rawsend options.
 function rawsend_dissect_segmented(desync, dis, mss, options)
 	local discopy = deepcopy(dis)
-	apply_ip_id(desync, discopy, options and options.ipid)
 	apply_fooling(desync, discopy, options and options.fooling)

 	if dis.tcp then
@@ -888,6 +1085,7 @@ function rawsend_dissect_segmented(desync, dis, mss, options)
 				len = #payload - pos + 1
 				if len > max_data then len = max_data end
 				discopy.payload = string.sub(payload,pos,pos+len-1)
+				apply_ip_id(desync, discopy, options and options.ipid)
 				if not rawsend_dissect_ipfrag(discopy, options) then
 					-- stop if failed
 					return false
@@ -898,6 +1096,7 @@ function rawsend_dissect_segmented(desync, dis, mss, options)
 			return true
 		end
 	end
+	apply_ip_id(desync, discopy, options and options.ipid)
 	-- no reason to segment
 	return rawsend_dissect_ipfrag(discopy, options)
 end
@@ -924,10 +1123,10 @@ function direction_cutoff_opposite(ctx, desync, def)
 	local dir = desync.arg.dir or def or "out"
 	if dir=="out" then
 		-- cutoff in
-		instance_cutoff(ctx, false)
+		instance_cutoff_shim(ctx, desync, false)
 	elseif dir=="in" then
 		-- cutoff out
-		instance_cutoff(ctx, true)
+		instance_cutoff_shim(ctx, desync, true)
 	end
 end

@@ -1015,6 +1214,14 @@ function genhost(len, template)
 	end
 end

+-- return hostname if present or ip address in text form otherwise
+function host_or_ip(desync)
+	if desync.track and desync.track.hostname then
+		return desync.track.hostname
+	end
+	return desync.target.ip and ntop(desync.target.ip) or desync.target.ip6 and ntop(desync.target.ip6)
+end
+
 function is_absolute_path(path)
 	if string.sub(path,1,1)=='/' then return true end
 	local un = uname()
--- a/lua/zapret-tests.lua
+++ b/lua/zapret-tests.lua
@@ -264,8 +264,8 @@ end
 function test_bit()
 	local v, v2, v3, v4, b1, b2, pow

-	v = math.random(0,0xFFFFFFFFFFFF)
-	b1 = math.random(1,15)
+	v = math.random(0,0xFFFFFFFF)
+	b1 = math.random(1,16)

 	v2 = bitrshift(v, b1)
 	pow = 2^b1
@@ -275,17 +275,17 @@ function test_bit()

 	v2 = bitlshift(v, b1)
 	pow = 2^b1
-	v3 = v * pow
-	print(string.format("lshift(0x%X,%u) = 0x%X  0x%X*%u = 0x%X", v,b1,v2, v,pow,v3))
+	v3 = (v * pow) % 0x100000000
+	print(string.format("lshift(0x%X,%u) = 0x%X  0x%X*%u %% 0x10000000 = 0x%X", v,b1,v2, v,pow,v3))
 	test_assert(v2==v3)

-	v2 = math.random(0,0xFFFFFFFFFFFF)
+	v2 = math.random(0,0xFFFFFFFF)
 	v3 = bitxor(v, v2)
 	v4 = bitor(v, v2) - bitand(v, v2)
 	print(string.format("xor(0x%X,0x%X) = %X  or/and/minus = %X", v, v2, v3, v4))
 	test_assert(v3==v4)

-	b2 = b1 + math.random(1,31)
+	b2 = b1 + math.random(1,15)
 	v2 = bitget(v, b1, b2)
 	pow = 2^(b2-b1+1) - 1
 	v3 = bitand(bitrshift(v,b1), pow)
@@ -299,8 +299,32 @@ function test_bit()
 	test_assert(v2==v3)
 end

+function test_ux()
+	local v1, v2, v3, usum, sum
+	for k,test in pairs({
+		{ add=u8add, fname="u8add", max = 0xFF },
+		{ add=u16add, fname="u16add", max = 0xFFFF },
+		{ add=u24add, fname="u24add", max = 0xFFFFFF },
+		{ add=u32add, fname="u32add", max = 0xFFFFFFFF }
+	}) do
+		io.write(test.fname.." : ")
+		for i=1,1000 do
+			v1=math.random(-test.max,test.max)
+			v2=math.random(-test.max,test.max)
+			v3=math.random(-test.max,test.max)
+			usum = test.add(v1,v2,v3)
+			sum = bitand((v1+v2+v3)%(test.max+1),test.max)
+			if sum~=usum then
+				print("FAIL")
+			end
+			test_assert(sum==usum)
+		end
+		print("OK")
+	end
+end
+
 function test_bin(...)
-	test_run({test_ub, test_bit},...)
+	test_run({test_ub, test_bit, test_ux},...)
 end


--- a/nfq2/conntrack.c
+++ b/nfq2/conntrack.c
@@ -180,9 +180,17 @@ static void ConntrackFeedPacket(t_ctrack *t, bool bReverse, const struct tcphdr
 		mss = ntohs(tcp_find_mss(tcphdr));
 		if (bReverse)
 		{
-			t->pos.pos_orig = t->pos.seq_last = ntohl(tcphdr->th_ack);
 			t->pos.ack_last = ntohl(tcphdr->th_seq);
+			t->pos.pos_orig = t->pos.seq_last = ntohl(tcphdr->th_ack);
 			t->pos.pos_reply = t->pos.ack_last + len_payload;
+			if (t->pos.state == SYN)
+				t->pos.uppos_reply_prev = t->pos.uppos_reply = t->pos.pos_reply;
+			else if (len_payload)
+			{
+				t->pos.uppos_reply_prev = t->pos.uppos_reply;
+				if (!((t->pos.pos_reply - t->pos.uppos_reply) & 0x80000000))
+					t->pos.uppos_reply = t->pos.pos_reply;
+			}
 			t->pos.winsize_reply = ntohs(tcphdr->th_win);
 			t->pos.winsize_reply_calc = t->pos.winsize_reply;
 			if (t->pos.scale_reply != SCALE_NONE) t->pos.winsize_reply_calc <<= t->pos.scale_reply;
@@ -194,6 +202,14 @@ static void ConntrackFeedPacket(t_ctrack *t, bool bReverse, const struct tcphdr
 			t->pos.seq_last = ntohl(tcphdr->th_seq);
 			t->pos.pos_orig = t->pos.seq_last + len_payload;
 			t->pos.pos_reply = t->pos.ack_last = ntohl(tcphdr->th_ack);
+			if (t->pos.state == SYN)
+				t->pos.uppos_orig_prev = t->pos.uppos_orig = t->pos.pos_orig;
+			else if (len_payload)
+			{
+				t->pos.uppos_orig_prev = t->pos.uppos_orig;
+				if (!((t->pos.pos_orig - t->pos.uppos_orig) & 0x80000000))
+					t->pos.uppos_orig = t->pos.pos_orig;
+			}
 			t->pos.winsize_orig = ntohs(tcphdr->th_win);
 			t->pos.winsize_orig_calc = t->pos.winsize_orig;
 			if (t->pos.scale_orig != SCALE_NONE) t->pos.winsize_orig_calc <<= t->pos.scale_orig;
@@ -394,17 +410,30 @@ bool ReasmResize(t_reassemble *reasm, size_t new_size)
 	if (reasm->size_present > new_size) reasm->size_present = new_size;
 	return true;
 }
+#define REASM_MAX_NEG 0x100000
 bool ReasmFeed(t_reassemble *reasm, uint32_t seq, const void *payload, size_t len)
 {
-	if (reasm->seq != seq) return false; // fail session if out of sequence
-
-	size_t szcopy;
-	szcopy = reasm->size - reasm->size_present;
-	if (len < szcopy) szcopy = len;
-	memcpy(reasm->packet + reasm->size_present, payload, szcopy);
-	reasm->size_present += szcopy;
-	reasm->seq += (uint32_t)szcopy;
+	uint32_t dseq = seq - reasm->seq;
+	if (dseq && (dseq < REASM_MAX_NEG))
+		return false; // fail session if a gap about to appear
+	uint32_t neg_overlap = reasm->seq - seq;
+	if (neg_overlap > REASM_MAX_NEG)
+		return false; // too big minus

+	size_t szcopy, szignore;
+	szignore = (neg_overlap > reasm->size_present) ? neg_overlap - reasm->size_present : 0;
+	if (szignore>=len) return true; // everyting is before the starting pos
+	szcopy = len - szignore;
+	neg_overlap -= szignore;
+	if ((reasm->size_present - neg_overlap + szcopy) > reasm->size)
+		return false; // buffer overflow
+	// in case of seq overlap new data replaces old - unix behavior
+	memcpy(reasm->packet + reasm->size_present - neg_overlap, payload + szignore, szcopy);
+	if (szcopy>neg_overlap)
+	{
+		reasm->size_present += szcopy - neg_overlap;
+		reasm->seq += (uint32_t)szcopy - neg_overlap;
+	}
 	return true;
 }
 bool ReasmHasSpace(t_reassemble *reasm, size_t len)
--- a/nfq2/conntrack.h
+++ b/nfq2/conntrack.h
@@ -43,7 +43,7 @@ typedef struct
 // this structure helps to reassemble continuous packets streams. it does not support out-of-orders
 typedef struct {
 	uint8_t *packet;		// allocated for size during reassemble request. requestor must know the message size.
-	uint32_t seq;			// current seq number. if a packet comes with an unexpected seq - it fails reassemble session.
+	uint32_t seq;			// current seq number. if a packet comes with unsupported seq overlap - it fails reassemble session.
 	size_t size;			// expected message size. success means that we have received exactly 'size' bytes and have them in 'packet'
 	size_t size_present;		// how many bytes already stored in 'packet'
 } t_reassemble;
@@ -61,8 +61,7 @@ typedef struct
 	bool dp_search_complete;

 	uint8_t req_retrans_counter;		// number of request retransmissions
-	bool req_seq_present,req_seq_finalized,req_seq_abandoned;
-	uint32_t req_seq_start,req_seq_end;	// sequence interval of the request (to track retransmissions)
+	bool retrans_detect_finalized;

 	uint8_t incoming_ttl;

--- a/nfq2/conntrack_base.h
+++ b/nfq2/conntrack_base.h
@@ -20,6 +20,8 @@ typedef struct
 	uint64_t pdcounter_orig, pdcounter_reply; // data packet counter (with payload)
 	uint64_t pbcounter_orig, pbcounter_reply; // transferred byte counter. includes retransmissions. it's not the same as relative seq.
 	uint32_t pos_orig, pos_reply;		// TCP: seq_last+payload, ack_last+payload  UDP: sum of all seen payload lenghts including current
+	uint32_t uppos_orig, uppos_reply;	// max seen position. useful to detect retransmissions
+	uint32_t uppos_orig_prev, uppos_reply_prev; // previous max seen position. useful to detect retransmissions
 	uint32_t seq_last, ack_last;		// TCP: last seen seq and ack  UDP: sum of all seen payload lenghts NOT including current

 	// tcp only state, not used in udp
--- a/nfq2/desync.c
+++ b/nfq2/desync.c
@@ -240,6 +240,11 @@ static void auto_hostlist_reset_fail_counter(struct desync_profile *dp, const ch
 	}
 }

+static bool is_retransmission(const t_ctrack *ctrack)
+{
+	return !((ctrack->pos.uppos_orig_prev - ctrack->pos.pos_orig) & 0x80000000);
+}
+
 // return true if retrans trigger fires
 static bool auto_hostlist_retrans(t_ctrack *ctrack, uint8_t l4proto, int threshold, const char *client_ip_port, t_l7proto l7proto)
 {
@@ -247,24 +252,28 @@ static bool auto_hostlist_retrans(t_ctrack *ctrack, uint8_t l4proto, int thresho
 	{
 		if (l4proto == IPPROTO_TCP)
 		{
-			if (!ctrack->req_seq_finalized || ctrack->req_seq_abandoned)
+			if (ctrack->retrans_detect_finalized)
 				return false;
-			if (!seq_within(ctrack->pos.seq_last, ctrack->req_seq_start, ctrack->req_seq_end))
+			if (!seq_within(ctrack->pos.seq_last, ctrack->pos.seq0, ctrack->pos.seq0 + ctrack->dp->hostlist_auto_retrans_maxseq))
 			{
-				DLOG("req retrans : tcp seq %u not within the req range %u-%u. stop tracking.\n", ctrack->pos.seq_last, ctrack->req_seq_start, ctrack->req_seq_end);
+				ctrack->retrans_detect_finalized = true;
+				DLOG("retrans : tcp seq %u not within the req range %u-%u. stop tracking.\n", ctrack->pos.seq_last, ctrack->pos.seq0, ctrack->pos.seq0 + ctrack->dp->hostlist_auto_retrans_maxseq);
 				ctrack_stop_retrans_counter(ctrack);
 				auto_hostlist_reset_fail_counter(ctrack->dp, ctrack->hostname, client_ip_port, l7proto);
 				return false;
 			}
+			if (!is_retransmission(ctrack))
+				return false;
 		}
 		ctrack->req_retrans_counter++;
 		if (ctrack->req_retrans_counter >= threshold)
 		{
-			DLOG("req retrans threshold reached : %u/%u\n", ctrack->req_retrans_counter, threshold);
+			DLOG("retrans threshold reached : %u/%u\n", ctrack->req_retrans_counter, threshold);
 			ctrack_stop_retrans_counter(ctrack);
+			ctrack->retrans_detect_finalized = true;
 			return true;
 		}
-		DLOG("req retrans counter : %u/%u\n", ctrack->req_retrans_counter, threshold);
+		DLOG("retrans counter : %u/%u\n", ctrack->req_retrans_counter, threshold);
 	}
 	return false;
 }
@@ -647,7 +656,9 @@ static uint8_t desync(
 	t_ctrack *ctrack,
 	const t_ctrack_position *pos,
 	t_l7payload l7payload,
+	t_l7proto l7proto,
 	const struct dissect *dis,
+	const struct in_addr *sdp4, const struct in6_addr *sdp6, uint16_t sdport,
 	uint8_t *mod_pkt, size_t *len_mod_pkt,
 	unsigned int replay_piece, unsigned int replay_piece_count, size_t reasm_offset, const uint8_t *rdata_payload, size_t rlen_payload,
 	const uint8_t *data_decrypt, size_t len_decrypt)
@@ -677,6 +688,9 @@ static uint8_t desync(
 		}
 		if (!pos) pos = &ctrack->pos;
 	}
+
+	LUA_STACK_GUARD_ENTER(params.L)
+
 	if (LIST_FIRST(&dp->lua_desync))
 	{
 		b_cutoff_all = b_unwanted_payload = true;
@@ -732,7 +746,13 @@ static uint8_t desync(
 			lua_pushf_bool("outgoing", !bIncoming);
 			lua_pushf_str("ifin", (ifin && *ifin) ? ifin : NULL);
 			lua_pushf_str("ifout", (ifout && *ifout) ? ifout : NULL);
-			lua_pushf_int("fwmark", fwmark);
+			lua_pushf_lint("fwmark", fwmark);
+			lua_pushf_table("target");
+			lua_getfield(params.L,-1,"target");
+			if (sdport) lua_pushf_int("port",sdport);
+			if (sdp4) lua_pushf_lstr("ip",(const char*)sdp4,sizeof(*sdp4));
+			if (sdp6) lua_pushf_lstr("ip6",(const char*)sdp6,sizeof(*sdp6));
+			lua_pop(params.L,1);
 			lua_pushf_bool("replay", !!replay_piece_count);
 			if (replay_piece_count)
 			{
@@ -741,10 +761,11 @@ static uint8_t desync(
 				lua_pushf_bool("replay_piece_last", (replay_piece+1)>=replay_piece_count);
 			}
 			lua_pushf_str("l7payload", l7payload_str(l7payload));
+			lua_pushf_str("l7proto", l7proto_str(l7proto));
 			lua_pushf_int("reasm_offset", reasm_offset);
 			lua_pushf_raw("reasm_data", rdata_payload, rlen_payload);
 			lua_pushf_raw("decrypt_data", data_decrypt, len_decrypt);
-			if (ctrack) lua_pushf_reg("instance_cutoff", ctrack->lua_instance_cutoff);
+			//if (ctrack) lua_pushf_reg("instance_cutoff", ctrack->lua_instance_cutoff);
 			if (dis->tcp)
 			{
 				// recommended mss value for generated packets
@@ -864,6 +885,7 @@ static uint8_t desync(
 		DLOG("no lua functions in this profile\n");
 ex:
 	luaL_unref(params.L, LUA_REGISTRYINDEX, ref_arg);
+	LUA_STACK_GUARD_LEAVE(params.L, 0)
 	return verdict;
 err:
 	DLOG_ERR("desync ERROR. passing packet unmodified.\n");
@@ -1156,17 +1178,6 @@ static uint8_t dpi_desync_tcp_packet_play(
 				DLOG("not applying tampering to HTTP without Host:\n");
 				goto pass;
 			}
-			if (ctrack)
-			{
-				// we do not reassemble http
-				if (!ctrack->req_seq_present)
-				{
-					ctrack->req_seq_start = ctrack->pos.seq_last;
-					ctrack->req_seq_end = ctrack->pos.pos_orig - 1;
-					ctrack->req_seq_present = ctrack->req_seq_finalized = true;
-					DLOG("req retrans : tcp seq interval %u-%u\n", ctrack->req_seq_start, ctrack->req_seq_end);
-				}
-			}
 		}
 		else if (IsTLSClientHello(rdata_payload, rlen_payload, TLS_PARTIALS_ENABLE))
 		{
@@ -1185,27 +1196,12 @@ static uint8_t dpi_desync_tcp_packet_play(
 			if (ctrack && !(params.reasm_payload_disable && l7_payload_match(l7payload, params.reasm_payload_disable)))
 			{
 				// do not reasm retransmissions
-				if (!bReqFull && ReasmIsEmpty(&ctrack->reasm_orig) && !ctrack->req_seq_abandoned &&
-					!(ctrack->req_seq_finalized && seq_within(ctrack->pos.seq_last, ctrack->req_seq_start, ctrack->req_seq_end)))
+				if (!bReqFull && ReasmIsEmpty(&ctrack->reasm_orig) && !is_retransmission(ctrack))
 				{
 					// do not reconstruct unexpected large payload (they are feeding garbage ?)
 					if (!reasm_orig_start(ctrack, IPPROTO_TCP, TLSRecordLen(dis->data_payload), TCP_MAX_REASM, dis->data_payload, dis->len_payload))
 						goto pass_reasm_cancel;
 				}
-				if (!ctrack->req_seq_finalized)
-				{
-					if (!ctrack->req_seq_present)
-					{
-						// lower bound of request seq interval
-						ctrack->req_seq_start = ctrack->pos.seq_last;
-						ctrack->req_seq_present = true;
-					}
-					// upper bound of request seq interval
-					// it can grow on every packet until request is complete. then interval is finalized and never touched again.
-					ctrack->req_seq_end = ctrack->pos.pos_orig - 1;
-					DLOG("req retrans : seq interval %u-%u\n", ctrack->req_seq_start, ctrack->req_seq_end);
-					ctrack->req_seq_finalized |= bReqFull;
-				}

 				if (!ReasmIsEmpty(&ctrack->reasm_orig))
 				{
@@ -1246,12 +1242,6 @@ static uint8_t dpi_desync_tcp_packet_play(
 			};
 			protocol_probe(testers, sizeof(testers) / sizeof(*testers), dis->data_payload, dis->len_payload, ctrack, &l7proto, &l7payload);
 		}
-		if (ctrack && ctrack->req_seq_finalized)
-		{
-			uint32_t dseq = ctrack->pos.seq_last - ctrack->req_seq_end;
-			// do not react to 32-bit overflowed sequence numbers. allow 16 Mb grace window then cutoff.
-			if (dseq >= 0x1000000 && !(dseq & 0x80000000)) ctrack->req_seq_abandoned = true;
-		}

 		if (bHaveHost)
 		{
@@ -1314,7 +1304,6 @@ static uint8_t dpi_desync_tcp_packet_play(
 				DLOG("desync profile changed by revealed l7 protocol or hostname !\n");
 			}
 		}
-
 		if (bHaveHost && !PROFILE_HOSTLISTS_EMPTY(dp))
 		{
 			if (!bCheckDone)
@@ -1354,7 +1343,7 @@ static uint8_t dpi_desync_tcp_packet_play(
 		ntop46_port((struct sockaddr *)&dst, s2, sizeof(s2));
 		DLOG("dpi desync src=%s dst=%s track_direction=%s fixed_direction=%s connection_proto=%s payload_type=%s\n", s1, s2, bReverse ? "in" : "out", bReverseFixed ? "in" : "out", l7proto_str(l7proto), l7payload_str(l7payload));
 	}
-	verdict = desync(dp, fwmark, ifin, ifout, bReverseFixed, ctrack_replay, pos, l7payload, dis, mod_pkt, len_mod_pkt, replay_piece, replay_piece_count, reasm_offset, rdata_payload, rlen_payload, NULL, 0);
+	verdict = desync(dp, fwmark, ifin, ifout, bReverseFixed, ctrack_replay, pos, l7payload, l7proto, dis, sdip4, sdip6, sdport, mod_pkt, len_mod_pkt, replay_piece, replay_piece_count, reasm_offset, rdata_payload, rlen_payload, NULL, 0);

 pass:
 	return (!bReverseFixed && (verdict & VERDICT_MASK) == VERDICT_DROP) ? ct_new_postnat_fix(ctrack, dis, mod_pkt, len_mod_pkt) : verdict;
@@ -1810,7 +1799,7 @@ static uint8_t dpi_desync_udp_packet_play(
 		ntop46_port((struct sockaddr *)&dst, s2, sizeof(s2));
 		DLOG("dpi desync src=%s dst=%s track_direction=%s fixed_direction=%s connection_proto=%s payload_type=%s\n", s1, s2, bReverse ? "in" : "out", bReverseFixed ? "in" : "out", l7proto_str(l7proto), l7payload_str(l7payload));
 	}
-	verdict = desync(dp, fwmark, ifin, ifout, bReverseFixed, ctrack_replay, pos, l7payload, dis, mod_pkt, len_mod_pkt, replay_piece, replay_piece_count, reasm_offset, NULL, 0, data_decrypt, len_decrypt);
+	verdict = desync(dp, fwmark, ifin, ifout, bReverseFixed, ctrack_replay, pos, l7payload, l7proto, dis, sdip4, sdip6, sdport, mod_pkt, len_mod_pkt, replay_piece, replay_piece_count, reasm_offset, NULL, 0, data_decrypt, len_decrypt);

 pass:
 	return (!bReverse && (verdict & VERDICT_MASK) == VERDICT_DROP) ? ct_new_postnat_fix(ctrack, dis, mod_pkt, len_mod_pkt) : verdict;
--- a/nfq2/lua.c
+++ b/nfq2/lua.c
@@ -68,72 +68,100 @@ static int luacall_DLOG_CONDUP(lua_State *L)
 static int luacall_bitlshift(lua_State *L)
 {
 	lua_check_argc(L,"bitlshift",2);
-	lua_pushinteger(L,luaL_checkinteger(L,1) << luaL_checkinteger(L,2));
+	int64_t v=(int64_t)luaL_checklint(L,1);
+	if (v>0xFFFFFFFF || v<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+	lua_pushlint(L,((uint32_t)v) << luaL_checkinteger(L,2));
 	return 1;
 }
 static int luacall_bitrshift(lua_State *L)
 {
 	lua_check_argc(L,"bitrshift",2);
-	lua_pushinteger(L,((LUA_UNSIGNED)luaL_checkinteger(L,1)) >> luaL_checkinteger(L,2));
+	int64_t v=(int64_t)luaL_checklint(L,1);
+	if (v>0xFFFFFFFF || v<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+	lua_pushlint(L,((uint32_t)v) >> luaL_checkinteger(L,2));
 	return 1;
 }
 static int luacall_bitand(lua_State *L)
 {
 	lua_check_argc_range(L,"bitand",2,100);
 	int argc = lua_gettop(L);
-	lua_Integer v=luaL_checkinteger(L,1);
-	for(int i=2;i<=argc;i++) v&=luaL_checkinteger(L,i);
-	lua_pushinteger(L,v);
+	int64_t v;
+	uint32_t sum=0xFFFFFFFF;
+	for(int i=1;i<=argc;i++)
+	{
+		v=(int64_t)luaL_checklint(L,i);
+		if (v>0xFFFFFFFF || v<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+		sum&=(uint32_t)v;
+	}
+	lua_pushlint(L,sum);
 	return 1;
 }
 static int luacall_bitor(lua_State *L)
 {
-	lua_check_argc_range(L,"bitor",2,100);
+	lua_check_argc_range(L,"bitor",1,100);
 	int argc = lua_gettop(L);
-	lua_Integer v=0;
-	for(int i=1;i<=argc;i++) v|=luaL_checkinteger(L,i);
-	lua_pushinteger(L,v);
+	int64_t v;
+	uint32_t sum=0;
+	for(int i=1;i<=argc;i++)
+	{
+		v=(int64_t)luaL_checklint(L,i);
+		if (v>0xFFFFFFFF || v<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+		sum|=(uint32_t)v;
+	}
+	lua_pushlint(L,sum);
 	return 1;
 }
 static int luacall_bitnot(lua_State *L)
 {
 	lua_check_argc(L,"bitnot",1);
-	lua_pushinteger(L,~luaL_checkinteger(L,1));
+	lua_pushlint(L,~(uint32_t)luaL_checklint(L,1));
 	return 1;
 }
 static int luacall_bitxor(lua_State *L)
 {
-	lua_check_argc_range(L,"bitxor",2,100);
+	lua_check_argc_range(L,"bitxor",1,100);
 	int argc = lua_gettop(L);
-	lua_Integer v=0;
-	for(int i=1;i<=argc;i++) v^=luaL_checkinteger(L,i);
-	lua_pushinteger(L,v);
+	int64_t v;
+	uint32_t sum=0;
+	for(int i=1;i<=argc;i++)
+	{
+		v=(int64_t)luaL_checklint(L,i);
+		if (v>0xFFFFFFFF || v<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+		sum^=(uint32_t)v;
+	}
+	lua_pushlint(L,sum);
 	return 1;
 }
 static int luacall_bitget(lua_State *L)
 {
 	lua_check_argc(L,"bitget",3);

-	LUA_UNSIGNED what = (LUA_UNSIGNED)luaL_checkinteger(L,1);
+	int64_t iwhat = (int64_t)luaL_checklint(L,1);
+	if (iwhat>0xFFFFFFFF || iwhat<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+	uint32_t what = (uint32_t)iwhat;
 	lua_Integer from = luaL_checkinteger(L,2);
 	lua_Integer to = luaL_checkinteger(L,3);
-	if (from>to || from>63 || to>63)
+	if (from>to || from>31 || to>31)
 		luaL_error(L, "bit range invalid");

 	what = (what >> from) & ~((lua_Integer)-1 << (to-from+1));

-	lua_pushinteger(L,what);
+	lua_pushlint(L,what);
 	return 1;
 }
 static int luacall_bitset(lua_State *L)
 {
 	lua_check_argc(L,"bitset",4);

-	LUA_UNSIGNED what = (LUA_UNSIGNED)luaL_checkinteger(L,1);
+	int64_t iwhat = (int64_t)luaL_checklint(L,1);
+	if (iwhat>0xFFFFFFFF || iwhat<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+	uint32_t what = (uint32_t)iwhat;
 	lua_Integer from = luaL_checkinteger(L,2);
 	lua_Integer to = luaL_checkinteger(L,3);
-	LUA_UNSIGNED set = (LUA_UNSIGNED)luaL_checkinteger(L,4);
-	if (from>to || from>63 || to>63)
+	int64_t iset = (int64_t)luaL_checklint(L,4);
+	if (iset>0xFFFFFFFF || iset<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
+	uint32_t set = (uint32_t)iset;
+	if (from>to || from>31 || to>31)
 		luaL_error(L, "bit range invalid");

 	lua_Integer mask = ~((lua_Integer)-1 << (to-from+1));
@@ -141,7 +169,7 @@ static int luacall_bitset(lua_State *L)
 	mask <<= from;
 	what = what & ~mask | set;

-	lua_pushinteger(L,what);
+	lua_pushlint(L,what);
 	return 1;
 }

@@ -198,15 +226,15 @@ static int luacall_u32(lua_State *L)
 	offset = (argc>=2 && lua_type(L,2)!=LUA_TNIL) ? luaL_checkinteger(L,2)-1 : 0;
 	if (offset<0 || (offset+4)>l) luaL_error(L, "out of range");

-	lua_pushinteger(L,pntoh32(p+offset));
+	lua_pushlint(L,pntoh32(p+offset));
 	return 1;
 }
 static int luacall_swap16(lua_State *L)
 {
 	lua_check_argc(L,"swap16",1);

-	lua_Integer i = luaL_checkinteger(L,1);
-	if (i>0xFFFF || i<-(lua_Integer)0xFFFF) luaL_error(L, "out of range");
+	int64_t i = (int64_t)luaL_checklint(L,1);
+	if (i>0xFFFF || i<-(int64_t)0xFFFF) luaL_error(L, "out of range");
 	uint16_t u = (uint16_t)i;
 	// __builtin_bswap16 is absent in ancient lexra gcc 4.6
 	lua_pushinteger(L,(u>>8) | ((u&0xFF)<<8));
@@ -216,17 +244,52 @@ static int luacall_swap32(lua_State *L)
 {
 	lua_check_argc(L,"swap32",1);

-	lua_Integer i = luaL_checkinteger(L,1);
-	if (i>0xFFFFFFFF || i<-(lua_Integer)0xFFFFFFFF) luaL_error(L, "out of range");
+	int64_t i =(int64_t)luaL_checklint(L,1);
+	if (i>0xFFFFFFFF || i<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
 	uint32_t u = (uint32_t)i;
-	lua_pushinteger(L,__builtin_bswap32(u));
+	lua_pushlint(L,__builtin_bswap32(u));
 	return 1;
 }
+static int lua_uxadd(lua_State *L, uint32_t max)
+{
+	int64_t v;
+	uint32_t sum=0;
+	int argc = lua_gettop(L);
+	for(int i=1;i<=argc;i++)
+	{
+		v = (int64_t)luaL_checklint(L,i);
+		if (v>max || v<-(int64_t)max) luaL_error(L, "out of range");
+		sum+=(uint32_t)v;
+	}
+	lua_pushlint(L, sum & max);
+	return 1;
+}
+static int luacall_u8add(lua_State *L)
+{
+	lua_check_argc_range(L,"u8add",1,100);
+	return lua_uxadd(L, 0xFF);
+}
+static int luacall_u16add(lua_State *L)
+{
+	lua_check_argc_range(L,"u16add",1,100);
+	return lua_uxadd(L, 0xFFFF);
+}
+static int luacall_u24add(lua_State *L)
+{
+	lua_check_argc_range(L,"u24add",1,100);
+	return lua_uxadd(L, 0xFFFFFF);
+}
+static int luacall_u32add(lua_State *L)
+{
+	lua_check_argc_range(L,"u32add",1,100);
+	return lua_uxadd(L, 0xFFFFFFFF);
+}
+
 static int luacall_bu8(lua_State *L)
 {
 	lua_check_argc(L,"bu8",1);

-	lua_Integer i = luaL_checkinteger(L,1);
+	int64_t i = (int64_t)luaL_checklint(L,1);
 	if (i>0xFF || i<-(lua_Integer)0xFF) luaL_error(L, "out of range");
 	uint8_t v=(uint8_t)i;
 	lua_pushlstring(L,(char*)&v,1);
@@ -236,7 +299,7 @@ static int luacall_bu16(lua_State *L)
 {
 	lua_check_argc(L,"bu16",1);

-	lua_Integer i = luaL_checkinteger(L,1);
+	int64_t i = (int64_t)luaL_checklint(L,1);
 	if (i>0xFFFF || i<-(lua_Integer)0xFFFF) luaL_error(L, "out of range");
 	uint8_t v[2];
 	phton16(v,(uint16_t)i);
@@ -247,7 +310,7 @@ static int luacall_bu24(lua_State *L)
 {
 	lua_check_argc(L,"bu24",1);

-	lua_Integer i = luaL_checkinteger(L,1);
+	int64_t i = (int64_t)luaL_checklint(L,1);
 	if (i>0xFFFFFF || i<-(lua_Integer)0xFFFFFF) luaL_error(L, "out of range");
 	uint8_t v[3];
 	phton24(v,(uint32_t)i);
@@ -258,8 +321,8 @@ static int luacall_bu32(lua_State *L)
 {
 	lua_check_argc(L,"bu32",1);

-	lua_Integer i = luaL_checkinteger(L,1);
-	if (i>0xFFFFFFFF || i<-(lua_Integer)0xFFFFFFFF) luaL_error(L, "out of range");
+	int64_t i = (int64_t)luaL_checklint(L,1);
+	if (i>0xFFFFFFFF || i<-(int64_t)0xFFFFFFFF) luaL_error(L, "out of range");
 	uint8_t v[4];
 	phton32(v,(uint32_t)i);
 	lua_pushlstring(L,(char*)v,4);
@@ -269,10 +332,10 @@ static int luacall_bu32(lua_State *L)
 static int luacall_divint(lua_State *L)
 {
 	lua_check_argc(L,"divint",2);
-	lua_Integer v1=luaL_checkinteger(L,1);
-	lua_Integer v2=luaL_checkinteger(L,2);
+	int64_t v1=(int64_t)luaL_checklint(L,1);
+	int64_t v2=(int64_t)luaL_checklint(L,2);
 	if (v2)
-		lua_pushinteger(L,v1/v2);
+		lua_pushlint(L,v1/v2);
 	else
 		lua_pushnil(L);
 	return 1;
@@ -622,15 +685,15 @@ static int luacall_clock_gettime(lua_State *L)
 	}
 	else
 	{
-		lua_pushinteger(L, ts.tv_sec);
+		lua_pushlint(L, ts.tv_sec);
 		lua_pushinteger(L, ts.tv_nsec);
 	}
 	LUA_STACK_GUARD_RETURN(L,2)
 }
 static int luacall_instance_cutoff(lua_State *L)
 {
-	// out : func_name.profile_number[0]
-	// in  : func_name.profile_number[1]
+	// out : instance_name.profile_number[0]
+	// in  : instance_name.profile_number[1]

 	lua_check_argc_range(L,"instance_cutoff",1,2);

@@ -638,45 +701,51 @@ static int luacall_instance_cutoff(lua_State *L)

 	const t_lua_desync_context *ctx;

-	if (!lua_islightuserdata(L,1))
-		luaL_error(L, "instance_cutoff expect desync context in the first argument");
-	ctx = lua_touserdata(L,1);
-
-	int argc=lua_gettop(L);
-	bool bIn,bOut;
-	if (argc>=2 && lua_type(L,2)!=LUA_TNIL)
-	{
-		luaL_checktype(L,2,LUA_TBOOLEAN);
-		bOut = lua_toboolean(L,2);
-		bIn = !bOut;
-	}
+	if (lua_isnil(L,1))
+		// this can happen in orchestrated function. they do not have their own ctx and they cant cutoff
+		DLOG("instance cutoff not possible because missing ctx\n");
 	else
-		bIn = bOut = true;
-
-	if (ctx->ctrack)
 	{
-		DLOG("instance cutoff for '%s' in=%u out=%u\n",ctx->instance,bIn,bOut);
-		lua_rawgeti(L,LUA_REGISTRYINDEX,ctx->ctrack->lua_instance_cutoff);
-		lua_getfield(L,-1,ctx->instance);
-		if (!lua_istable(L,-1))
+		if (!lua_islightuserdata(L,1))
+			luaL_error(L, "instance_cutoff expect desync context in the first argument");
+		ctx = lua_touserdata(L,1);
+
+		int argc=lua_gettop(L);
+		bool bIn,bOut;
+		if (argc>=2 && lua_type(L,2)!=LUA_TNIL)
 		{
-			lua_pop(L,1);
-			lua_pushf_table(ctx->instance);
+			luaL_checktype(L,2,LUA_TBOOLEAN);
+			bOut = lua_toboolean(L,2);
+			bIn = !bOut;
+		}
+		else
+			bIn = bOut = true;
+
+		if (ctx->ctrack)
+		{
+			DLOG("instance cutoff for '%s' in=%u out=%u\n",ctx->instance,bIn,bOut);
+			lua_rawgeti(L,LUA_REGISTRYINDEX,ctx->ctrack->lua_instance_cutoff);
 			lua_getfield(L,-1,ctx->instance);
-		}
-		lua_rawgeti(L,-1,ctx->dp->n);
-		if (!lua_istable(L,-1))
-		{
-			lua_pop(L,1);
-			lua_pushi_table(ctx->dp->n);
+			if (!lua_istable(L,-1))
+			{
+				lua_pop(L,1);
+				lua_pushf_table(ctx->instance);
+				lua_getfield(L,-1,ctx->instance);
+			}
 			lua_rawgeti(L,-1,ctx->dp->n);
+			if (!lua_istable(L,-1))
+			{
+				lua_pop(L,1);
+				lua_pushi_table(ctx->dp->n);
+				lua_rawgeti(L,-1,ctx->dp->n);
+			}
+			if (bOut) lua_pushi_bool(0,true);
+			if (bIn) lua_pushi_bool(1,true);
+			lua_pop(L,3);
 		}
-		if (bOut) lua_pushi_bool(0,true);
-		if (bIn) lua_pushi_bool(1,true);
-		lua_pop(L,3);
+		else
+			DLOG("instance cutoff requested for '%s' in=%u out=%u but not possible without conntrack\n",ctx->instance,bIn,bOut);
 	}
-	else
-		DLOG("instance cutoff requested for '%s' in=%u out=%u but not possible without conntrack\n",ctx->instance,bIn,bOut);

 	LUA_STACK_GUARD_RETURN(L,0)
 }
@@ -839,13 +908,25 @@ void lua_pushi_nil(lua_Integer idx)
 void lua_pushf_int(const char *field, lua_Integer v)
 {
 	lua_pushstring(params.L, field);
-	lua_pushinteger(params.L, v);
+	lua_pushlint(params.L, v);
 	lua_rawset(params.L,-3);
 }
 void lua_pushi_int(lua_Integer idx, lua_Integer v)
 {
 	lua_pushinteger(params.L, idx);
-	lua_pushinteger(params.L, v);
+	lua_pushlint(params.L, v);
+	lua_rawset(params.L,-3);
+}
+void lua_pushf_lint(const char *field, int64_t v)
+{
+	lua_pushstring(params.L, field);
+	lua_pushlint(params.L, v);
+	lua_rawset(params.L,-3);
+}
+void lua_pushi_lint(lua_Integer idx, int64_t v)
+{
+	lua_pushinteger(params.L, idx);
+	lua_pushlint(params.L, v);
 	lua_rawset(params.L,-3);
 }
 void lua_pushf_bool(const char *field, bool b)
@@ -872,6 +953,18 @@ void lua_pushi_str(lua_Integer idx, const char *str)
 	lua_pushstring(params.L, str); // pushes nil if str==NULL
 	lua_rawset(params.L,-3);
 }
+void lua_pushf_lstr(const char *field, const char *str, size_t size)
+{
+	lua_pushstring(params.L, field);
+	lua_pushlstring(params.L, str, size);
+	lua_rawset(params.L,-3);
+}
+void lua_pushi_lstr(lua_Integer idx, const char *str, size_t size)
+{
+	lua_pushinteger(params.L, idx);
+	lua_pushlstring(params.L, str, size);
+	lua_rawset(params.L,-3);
+}
 void lua_push_raw(const void *v, size_t l)
 {
 	if (v)
@@ -990,8 +1083,8 @@ void lua_pushf_tcphdr(const struct tcphdr *tcp, size_t len)
 		lua_createtable(params.L, 0, 11);
 		lua_pushf_int("th_sport",ntohs(tcp->th_sport));
 		lua_pushf_int("th_dport",ntohs(tcp->th_dport));
-		lua_pushf_int("th_seq",ntohl(tcp->th_seq));
-		lua_pushf_int("th_ack",ntohl(tcp->th_ack));
+		lua_pushf_lint("th_seq",ntohl(tcp->th_seq));
+		lua_pushf_lint("th_ack",ntohl(tcp->th_ack));
 		lua_pushf_int("th_x2",tcp->th_x2);
 		lua_pushf_int("th_off",tcp->th_off);
 		lua_pushf_int("th_flags",tcp->th_flags);
@@ -1126,8 +1219,8 @@ void lua_pushf_ip6hdr(const struct ip6_hdr *ip6, size_t len)
 	if (ip6)
 	{
 		lua_createtable(params.L, 0, 7);
-		lua_pushf_int("ip6_flow",ntohl(ip6->ip6_ctlun.ip6_un1.ip6_un1_flow));
-		lua_pushf_int("ip6_plen",ntohs(ip6->ip6_ctlun.ip6_un1.ip6_un1_plen));
+		lua_pushf_lint("ip6_flow",ntohl(ip6->ip6_ctlun.ip6_un1.ip6_un1_flow));
+		lua_pushf_lint("ip6_plen",ntohs(ip6->ip6_ctlun.ip6_un1.ip6_un1_plen));
 		lua_pushf_int("ip6_nxt",ip6->ip6_ctlun.ip6_un1.ip6_un1_nxt);
 		lua_pushf_int("ip6_hlim",ip6->ip6_ctlun.ip6_un1.ip6_un1_hlim);
 		lua_pushf_raw("ip6_src",&ip6->ip6_src,sizeof(struct in6_addr));
@@ -1178,12 +1271,12 @@ void lua_pushf_ctrack(const t_ctrack *ctrack, const t_ctrack_position *pos)
 	{
 		lua_createtable(params.L, 0, 13 + (ctrack->ipproto == IPPROTO_TCP));

-		lua_pushf_int("pcounter_orig", pos->pcounter_orig);
-		lua_pushf_int("pdcounter_orig", pos->pdcounter_orig);
-		lua_pushf_int("pbcounter_orig", pos->pbcounter_orig);
-		lua_pushf_int("pcounter_reply", pos->pcounter_reply);
-		lua_pushf_int("pdcounter_reply", pos->pdcounter_reply);
-		lua_pushf_int("pbcounter_reply", pos->pbcounter_reply);
+		lua_pushf_lint("pcounter_orig", pos->pcounter_orig);
+		lua_pushf_lint("pdcounter_orig", pos->pdcounter_orig);
+		lua_pushf_lint("pbcounter_orig", pos->pbcounter_orig);
+		lua_pushf_lint("pcounter_reply", pos->pcounter_reply);
+		lua_pushf_lint("pdcounter_reply", pos->pdcounter_reply);
+		lua_pushf_lint("pbcounter_reply", pos->pbcounter_reply);
 		if (ctrack->incoming_ttl)
 			lua_pushf_int("incoming_ttl", ctrack->incoming_ttl);
 		else
@@ -1198,17 +1291,21 @@ void lua_pushf_ctrack(const t_ctrack *ctrack, const t_ctrack_position *pos)
 		if (ctrack->ipproto == IPPROTO_TCP)
 		{
 			lua_pushliteral(params.L, "tcp");
-			lua_createtable(params.L, 0, 14);
-			lua_pushf_int("seq0", pos->seq0);
-			lua_pushf_int("seq", pos->seq_last);
-			lua_pushf_int("ack0", pos->ack0);
-			lua_pushf_int("ack", pos->ack_last);
+			lua_createtable(params.L, 0, 18);
+			lua_pushf_lint("seq0", pos->seq0);
+			lua_pushf_lint("seq", pos->seq_last);
+			lua_pushf_lint("ack0", pos->ack0);
+			lua_pushf_lint("ack", pos->ack_last);
 			lua_pushf_int("pos_orig", pos->pos_orig - pos->seq0);
+			lua_pushf_int("uppos_orig", pos->uppos_orig - pos->seq0);
+			lua_pushf_int("uppos_orig_prev", pos->uppos_orig_prev - pos->seq0);
 			lua_pushf_int("winsize_orig", pos->winsize_orig);
 			lua_pushf_int("winsize_orig_calc", pos->winsize_orig_calc);
 			lua_pushf_int("scale_orig", pos->scale_orig);
 			lua_pushf_int("mss_orig", pos->mss_orig);
 			lua_pushf_int("pos_reply", pos->pos_reply - pos->ack0);
+			lua_pushf_int("uppos_reply", pos->uppos_reply - pos->ack0);
+			lua_pushf_int("uppos_reply_prev", pos->uppos_reply_prev - pos->ack0);
 			lua_pushf_int("winsize_reply", pos->winsize_reply);
 			lua_pushf_int("winsize_reply_calc", pos->winsize_reply_calc);
 			lua_pushf_int("scale_reply", pos->scale_reply);
@@ -1272,7 +1369,7 @@ void lua_pushf_pos(const char *name, const struct packet_pos *pos)
 	lua_getfield(params.L,-1,name);
 	*smode=pos->mode;
 	lua_pushf_str("mode",smode);
-	lua_pushf_int("pos",pos->pos);
+	lua_pushf_lint("pos",pos->pos);
 	lua_pop(params.L,1);

 	LUA_STACK_GUARD_LEAVE(params.L, 0)
@@ -1406,7 +1503,7 @@ bool lua_reconstruct_ip6hdr(int idx, struct ip6_hdr *ip6, size_t *len, uint8_t l
 	idx = lua_absindex(params.L, idx);

 	lua_getfield(params.L,idx,"ip6_flow");
-	ip6->ip6_ctlun.ip6_un1.ip6_un1_flow = htonl(lua_type(params.L,-1)==LUA_TNUMBER ? (uint32_t)lua_tointeger(params.L,-1) : 0x60000000);
+	ip6->ip6_ctlun.ip6_un1.ip6_un1_flow = htonl(lua_type(params.L,-1)==LUA_TNUMBER ? (uint32_t)lua_tolint(params.L,-1) : 0x60000000);
 	lua_pop(params.L, 1);

 	lua_getfield(params.L,idx,"ip6_plen");
@@ -1666,12 +1763,12 @@ bool lua_reconstruct_tcphdr(int idx, struct tcphdr *tcp, size_t *len)

 	lua_getfield(params.L,idx,"th_seq");
 	if (lua_type(params.L,-1)!=LUA_TNUMBER) goto err;
-	tcp->th_seq = htonl((uint32_t)lua_tointeger(params.L,-1));
+	tcp->th_seq = htonl((uint32_t)lua_tolint(params.L,-1));
 	lua_pop(params.L, 1);

 	lua_getfield(params.L,idx,"th_ack");
 	if (lua_type(params.L,-1)!=LUA_TNUMBER) goto err;
-	tcp->th_ack = htonl((uint32_t)lua_tointeger(params.L,-1));
+	tcp->th_ack = htonl((uint32_t)lua_tolint(params.L,-1));
 	lua_pop(params.L, 1);

 	lua_getfield(params.L,idx,"th_x2");
@@ -2146,7 +2243,7 @@ static void lua_rawsend_extract_options(lua_State *L, int idx, int *repeats, uin
 		if (fwmark)
 		{
 			lua_getfield(L,idx,"fwmark");
-			*fwmark=(uint32_t)lua_tointeger(L,-1) | params.desync_fwmark;
+			*fwmark=(uint32_t)lua_tolint(L,-1) | params.desync_fwmark;
 			lua_pop(L,1);
 		}
 		if (ifout)
@@ -2948,6 +3045,11 @@ static void lua_init_functions(void)
 		{"u16",luacall_u16},
 		{"u24",luacall_u24},
 		{"u32",luacall_u32},
+		// add any number of arguments as they would be unsigned int of specific size
+		{"u8add",luacall_u8add},
+		{"u16add",luacall_u16add},
+		{"u24add",luacall_u24add},
+		{"u32add",luacall_u32add},
 		// convert number to blob (string) - big endian
 		{"bu8",luacall_bu8},
 		{"bu16",luacall_bu16},
--- a/nfq2/lua.h
+++ b/nfq2/lua.h
@@ -22,6 +22,17 @@
 #define LUA_UNSIGNED uint64_t
 #endif

+// in old lua integer is 32 bit on 32 bit platforms and 64 bit on 64 bit platforms
+#if LUA_VERSION_NUM < 503 && __SIZEOF_POINTER__==4
+#define lua_pushlint lua_pushnumber
+#define lua_tolint lua_tonumber
+#define luaL_checklint luaL_checknumber
+#else
+#define lua_pushlint lua_pushinteger
+#define luaL_checklint luaL_checkinteger
+#define lua_tolint lua_tointeger
+#endif
+
 // pushing and not popping inside luacall cause memory leak
 #define LUA_STACK_GUARD_ENTER(L) int _lsg=lua_gettop(L);
 #define LUA_STACK_GUARD_LEAVE(L,N) if ((_lsg+N)!=lua_gettop(L)) luaL_error(L,"stack guard failure");
@@ -51,8 +62,12 @@ void lua_pushf_bool(const char *field, bool b);
 void lua_pushi_bool(lua_Integer idx, bool b);
 void lua_pushf_str(const char *field, const char *str);
 void lua_pushi_str(lua_Integer idx, const char *str);
+void lua_pushf_lstr(const char *field, const char *str, size_t len);
+void lua_pushi_lstr(lua_Integer idx, const char *str, size_t len);
 void lua_pushf_int(const char *field, lua_Integer v);
 void lua_pushi_int(lua_Integer idx, lua_Integer v);
+void lua_pushf_lint(const char *field, int64_t v);
+void lua_pushi_lint(lua_Integer idx, int64_t v);
 void lua_push_raw(const void *v, size_t l);
 void lua_pushf_raw(const char *field, const void *v, size_t l);
 void lua_pushi_raw(lua_Integer idx, const void *v, size_t l);
--- a/nfq2/nfqws.c
+++ b/nfq2/nfqws.c
@@ -1283,8 +1283,10 @@ static bool wf_make_filter(

 	if (bHaveTCP)
 	{
-		if (dp_list_have_autohostlist(&params.desync_profiles))
-			snprintf(wf + strlen(wf), len - strlen(wf), " or\n " DIVERT_HTTP_REDIRECT);
+//		may be required by orchestrators - always redirect
+//		if (dp_list_have_autohostlist(&params.desync_profiles))
+
+		snprintf(wf + strlen(wf), len - strlen(wf), " or\n " DIVERT_HTTP_REDIRECT);
 	}

 	if (!LIST_EMPTY(wf_raw_part))
@@ -1432,6 +1434,7 @@ static void exithelp(void)
 		" --hostlist-auto-fail-threshold=<int>\t\t\t; how many failed attempts cause hostname to be added to auto hostlist (default : %d)\n"
 		" --hostlist-auto-fail-time=<int>\t\t\t; all failed attemps must be within these seconds (default : %d)\n"
 		" --hostlist-auto-retrans-threshold=<int>\t\t; how many request retransmissions cause attempt to fail (default : %d)\n"
+		" --hostlist-auto-retrans-maxseq=<int>\t\t\t; count retransmissions only within this relative sequence (default : %u)\n"
 		" --hostlist-auto-debug=<logfile>\t\t\t; debug auto hostlist positives (global parameter)\n"
 		"\nLUA PACKET PASS MODE:\n"
 		" --payload=type[,type]\t\t\t\t\t; set payload types following LUA functions should process : %s\n"
@@ -1446,7 +1449,8 @@ static void exithelp(void)
 		IPCACHE_LIFETIME,
 		LUA_GC_INTERVAL,
 		all_protos,
-		HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT, HOSTLIST_AUTO_FAIL_TIME_DEFAULT, HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT,
+		HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT, HOSTLIST_AUTO_FAIL_TIME_DEFAULT,
+		HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT, HOSTLIST_AUTO_RETRANS_MAXSEQ,
 		all_payloads
 	);
 	exit(1);
@@ -1543,6 +1547,7 @@ enum opt_indices {
 	IDX_HOSTLIST_AUTO_FAIL_THRESHOLD,
 	IDX_HOSTLIST_AUTO_FAIL_TIME,
 	IDX_HOSTLIST_AUTO_RETRANS_THRESHOLD,
+	IDX_HOSTLIST_AUTO_RETRANS_MAXSEQ,
 	IDX_HOSTLIST_AUTO_DEBUG,
 	IDX_NEW,
 	IDX_SKIP,
@@ -1627,6 +1632,7 @@ static const struct option long_options[] = {
 	[IDX_HOSTLIST_AUTO_FAIL_THRESHOLD] = {"hostlist-auto-fail-threshold", required_argument, 0, 0},
 	[IDX_HOSTLIST_AUTO_FAIL_TIME] = {"hostlist-auto-fail-time", required_argument, 0, 0},
 	[IDX_HOSTLIST_AUTO_RETRANS_THRESHOLD] = {"hostlist-auto-retrans-threshold", required_argument, 0, 0},
+	[IDX_HOSTLIST_AUTO_RETRANS_MAXSEQ] = {"hostlist-auto-retrans-maxseq", required_argument, 0, 0},
 	[IDX_HOSTLIST_AUTO_DEBUG] = {"hostlist-auto-debug", required_argument, 0, 0},
 	[IDX_NEW] = {"new", no_argument, 0, 0},
 	[IDX_SKIP] = {"skip", no_argument, 0, 0},
@@ -1689,6 +1695,22 @@ static const struct option long_options[] = {

 int main(int argc, char **argv)
 {
+/*
+	t_reassemble t;
+	ReasmInit(&t,16,-10);
+	memset(t.packet,0,16);
+	bool b;
+	b=ReasmFeed(&t,-10,"0123456789",10);
+	printf("b=%u size=%zu seq=%d s=%s\n",b,t.size_present,t.seq,t.packet);
+	b=ReasmFeed(&t,0,"YOREK",5);
+	printf("b=%u size=%zu seq=%d s=%s\n",b,t.size_present,t.seq,t.packet);
+	b=ReasmFeed(&t,-12,"XOR",3);
+	printf("b=%u size=%zu seq=%d s=%s\n",b,t.size_present,t.seq,t.packet);
+	b=ReasmFeed(&t,3,"abc",3);
+	printf("b=%u size=%zu seq=%d s=%s\n",b,t.size_present,t.seq,t.packet);
+	return 0;
+*/
+
 #ifdef __CYGWIN__
 	if (service_run(argc, argv))
 	{
@@ -2075,6 +2097,9 @@ int main(int argc, char **argv)
 				exit_clean(1);
 			}
 			break;
+		case IDX_HOSTLIST_AUTO_RETRANS_MAXSEQ:
+			dp->hostlist_auto_retrans_maxseq = (uint32_t)atoi(optarg);
+			break;
 		case IDX_HOSTLIST_AUTO_DEBUG:
 		{
 			FILE *F = fopen(optarg, "a+t");
--- a/nfq2/params.c
+++ b/nfq2/params.c
@@ -342,6 +342,7 @@ void dp_init(struct desync_profile *dp)
 	dp->hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
 	dp->hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
 	dp->hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
+	dp->hostlist_auto_retrans_maxseq = HOSTLIST_AUTO_RETRANS_MAXSEQ;
 	dp->filter_ipv4 = dp->filter_ipv6 = true;
 }
 static void dp_clear_dynamic(struct desync_profile *dp)
--- a/nfq2/params.h
+++ b/nfq2/params.h
@@ -30,6 +30,7 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 #define	HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT	3
+#define HOSTLIST_AUTO_RETRANS_MAXSEQ		65536

 #define IPCACHE_LIFETIME		7200

@@ -78,6 +79,7 @@ struct desync_profile
 	// pointer to autohostlist. NULL if no autohostlist for the profile.
 	struct hostlist_file *hostlist_auto;
 	int hostlist_auto_fail_threshold, hostlist_auto_fail_time, hostlist_auto_retrans_threshold;
+	uint32_t hostlist_auto_retrans_maxseq;

 	hostfail_pool *hostlist_auto_fail_counters;

--- a/nfq2/protocol.c
+++ b/nfq2/protocol.c
@@ -848,7 +848,7 @@ bool TLSMod(const struct fake_tls_mod *tls_mod, const uint8_t *payload, size_t p
 	{
 		if (tls_mod->mod & FAKE_TLS_MOD_DUP_SID)
 		{
-			if (IsTLSClientHello(payload, payload_len, false))
+			if (IsTLSClientHelloPartial(payload, payload_len))
 			{
 				if (payload_len < 44)
 				{
--- a/nfq2/protocol.h
+++ b/nfq2/protocol.h
@@ -127,7 +127,7 @@ bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *hos

 struct fake_tls_mod
 {
-	char sni[128];
+	char sni[256];
 	uint32_t mod;
 };
 #define FAKE_TLS_MOD_RND		0x01
Author	SHA1	Message	Date
bol-van	776155a326	blockcheck2: fix unterminated string	2025-12-09 14:17:07 +03:00
bol-van	30423596ca	zapret-lib: detect_payload_str	2025-12-09 12:18:59 +03:00
bol-van	27ef67adf9	zapret-auto: cond_payload_str	2025-12-09 11:48:23 +03:00
bol-van	bb604f111c	zapret-auto: add comments	2025-12-09 11:22:09 +03:00
bol-van	e5174bc9ad	zapret-auto: condition and stopif orchestrators	2025-12-09 10:50:54 +03:00
bol-van	6c29bf6702	zapret-lib,zapret-auto: allow nested orchestration	2025-12-09 09:52:24 +03:00
bol-van	976033be37	nfqws2: do not increase upseq_prev on empty packets	2025-12-09 09:52:08 +03:00
bol-van	f9b2135688	zapret-auto: add comments	2025-12-08 22:45:42 +03:00
bol-van	844fa6ab47	zapret-auto: optimize detector code	2025-12-08 20:02:26 +03:00
bol-van	dc0fe70bd6	zapret-auto: udp_in/udp_out failure detection	2025-12-08 19:46:00 +03:00
bol-van	2752c26795	blockcheck2: FOOLINGS_UDP overridable	2025-12-08 18:37:18 +03:00
bol-van	1600b41135	init.d: support --hostlist-auto-retrans-threshold	2025-12-08 16:52:49 +03:00
bol-van	2017889207	nfqws2: change retransmission detection scheme	2025-12-08 16:46:04 +03:00
bol-van	146ab847df	nfqws2: allow dupsid with partial tls	2025-12-08 11:31:46 +03:00
bol-van	cf9059ed22	update changes.txt	2025-12-08 10:57:04 +03:00
bol-van	c94264c79e	nfqws2: more fixes to reasm overlap support	2025-12-08 10:55:32 +03:00
bol-van	04cb71150a	nfqws2: improve reasm overlap support	2025-12-08 10:35:26 +03:00
bol-van	378ee514c4	nfqws2: reasm support negative overlaps without gaps and without going beyond the starting seq	2025-12-08 09:55:44 +03:00
bol-van	1a190fcf9e	nfqws2: increase tls_mod sni max size	2025-12-07 21:30:07 +03:00
bol-van	0f8a788351	zapret-auto: optimize code	2025-12-07 20:05:43 +03:00
bol-van	4c00f11c15	zapret-auto: move crec record get	2025-12-07 20:01:29 +03:00
bol-van	0f8cfd7022	zapret-lib: remove duplicate function	2025-12-07 19:59:31 +03:00
bol-van	4563b6ddcb	blockcheck2: syndata tests	2025-12-07 19:44:28 +03:00
bol-van	9ae6927a0e	zapret-auto: remove duplicate seq assignment	2025-12-07 17:03:45 +03:00
bol-van	8540278c9b	zapret-antidpi: use tls_mod_shim	2025-12-07 17:00:55 +03:00
bol-van	76b9ab5075	zapret-lib: improve random seed	2025-12-07 16:52:37 +03:00
bol-van	3a153035e8	zapret-lib,zapret-antidpi: support sni=%var in tls_mod	2025-12-07 15:08:56 +03:00
bol-van	2b5eb3cd2d	blockcheck2: remove newline print if test function absent	2025-12-07 14:31:56 +03:00
bol-van	2c35e8949a	blockcheck2: fix brokern http3 test	2025-12-07 14:01:54 +03:00
bol-van	7edd428508	zapret-auto, zapret-lib: deduplicate plan instance execution code	2025-12-07 11:07:46 +03:00
bol-van	7749fce7dc	zapret-auto: separate failure detection logic	2025-12-07 10:51:52 +03:00
bol-van	ea6e1e0853	blockcheck2: change qnum to allow parallel run with blockcheck1 for different domains	2025-12-07 09:46:32 +03:00
bol-van	7d2f12cbad	zapret-auto: remove unused code	2025-12-06 23:50:35 +03:00
bol-van	f91c069a8b	nfqws2: fix wrong enum type	2025-12-06 23:25:19 +03:00
bol-van	6961c013c5	actions: build x86 binary with classic LUA 5.4	2025-12-06 23:13:19 +03:00
bol-van	e5736b5fdd	fix multiple problems with lua_Integer 32 bit type in lua < 5.3 on 32-bit platforms	2025-12-06 22:43:45 +03:00
bol-van	efa675468d	nfqws2: fix wrong payload/proto type	2025-12-06 20:53:42 +03:00
bol-van	1073f03802	update changes.txt	2025-12-06 20:27:26 +03:00
bol-van	9125cb0205	zapret-auto: circular.reqhost parameter	2025-12-06 20:25:04 +03:00
bol-van	9d5435f977	nfqws2: do not export instance_cutoff, export l7proto for conntrack-less case	2025-12-06 19:43:39 +03:00
bol-van	f17ab4c91e	zapret-lib,zapret-auto: unify messages	2025-12-06 17:19:28 +03:00
bol-van	97aa261e14	winws: always catch http redirect	2025-12-06 16:18:18 +03:00
bol-van	813fece07a	nfqws2,zapret-auto: circular orchestrator	2025-12-06 15:58:09 +03:00
bol-van	2a7b44b1d0	zapret-lib: port support in url dissector	2025-12-06 10:46:47 +03:00
bol-van	28e719d825	zapret-lib: url and nld dissectors	2025-12-06 10:39:19 +03:00
bol-van	18725f6442	zapret-lib: remove temp debug code	2025-12-06 10:01:19 +03:00
bol-van	20b20fbb90	zapret-tests: adapt to 32bit arithmetics	2025-12-06 10:00:19 +03:00
bol-van	967b53b628	update changes.txt	2025-12-06 09:59:08 +03:00
bol-van	9cebc5cc37	nfqws2: remove any arithmetics beyond 32 bit	2025-12-06 09:57:08 +03:00
bol-van	0dc29c9c35	zapret-lib: http_reply dissector	2025-12-05 22:51:56 +03:00
bol-van	fd1eac2ef1	zapret-lib: fix seq number substraction	2025-12-05 22:31:51 +03:00
bol-van	0c2abab6a9	nfqws2: uXadd luacalls	2025-12-05 22:31:27 +03:00
bol-van	efd8acb8de	zapret-lib: fix multiple problems	2025-12-05 14:42:33 +03:00
bol-van	a147ebef61	update changes.txt	2025-12-05 11:28:58 +03:00