From 34a95e8a41a6bf357d8bb62280b5e92b0275c65d Mon Sep 17 00:00:00 2001 From: Alexander Golovanov Date: Thu, 17 Sep 2026 12:56:29 +0300 Subject: [PATCH] [blockcheck2] Add a way to test the size-based block without a real download The "16 KB" block triggers based on how much data passes through the connection, not on what that data actually is. Testing for it usually means pointing at a page you know is big enough to download - but that only works if your target actually has one. Adds CURL_PAD_KB: set it to a number and every request gets padded with that many KB of junk data, so the block can be triggered against any target, even a bare server with nothing to download. Off by default, and doesn't change anything unless you turn it on. The padding is written to a temp file and attached from there, not built inline: a large inline value can hit low, easy-to-reach limits on some platforms (Cygwin among them). --- blockcheck2.sh | 21 +++++++++++++++++++++ docs/manual.en.md | 1 + docs/manual.md | 1 + 3 files changed, 23 insertions(+) diff --git a/blockcheck2.sh b/blockcheck2.sh index 6063e3a..f6e74ed 100755 --- a/blockcheck2.sh +++ b/blockcheck2.sh @@ -37,6 +37,26 @@ DESYNC_MARK=0x10000000 CURL_MAX_TIME=${CURL_MAX_TIME:-2} CURL_MAX_TIME_QUIC=${CURL_MAX_TIME_QUIC:-$CURL_MAX_TIME} CURL_MAX_TIME_DOH=${CURL_MAX_TIME_DOH:-2} +# CURL_PAD_KB pads every curl request with the given number of KB, useful +# for the "16 KB" whitelist-style block (see docs): that block triggers on +# total bytes transferred on the connection, not on how much of it was an +# actual response, so padding the request is enough to test for it even +# against a target with no large page of its own to download - e.g. a bare +# IP from a provider's range rather than a known blocked domain. The padding +# is written straight to a small temp file (nothing large ever passes +# through a shell variable, command substitution, or argument) and attached +# as a header with curl's own @filename form of -H, which reads the file +# instead of taking the value on the command line - unlike an equivalent +# amount of data passed via --data/--data-binary, this doesn't conflict with +# HEAD requests, so it composes cleanly with CURL_HTTPS_GET either way. +CURL_PAD_KB=${CURL_PAD_KB:-0} +if [ "$CURL_PAD_KB" -gt 0 ] 2>/dev/null; then + CURL_PAD_FILE=/tmp/zapret-curlpad-$$ + printf 'X-Pad: ' > "$CURL_PAD_FILE" + head -c $((CURL_PAD_KB*1024)) /dev/zero | tr '\0' A >> "$CURL_PAD_FILE" + printf '\n' >> "$CURL_PAD_FILE" + CURL_OPT="${CURL_OPT}${CURL_OPT:+ }-H @$CURL_PAD_FILE" +fi USER_AGENT=${USER_AGENT:-Mozilla} HTTP_PORT=${HTTP_PORT:-80} HTTPS_PORT=${HTTPS_PORT:-443} @@ -163,6 +183,7 @@ cleanup() pf_clean ;; esac + [ -n "$CURL_PAD_FILE" ] && rm -f "$CURL_PAD_FILE" } IPT() diff --git a/docs/manual.en.md b/docs/manual.en.md index 609bed0..fab5a69 100644 --- a/docs/manual.en.md +++ b/docs/manual.en.md @@ -4973,6 +4973,7 @@ CURL_MAX_TIME_DOH - curl timeout for DoH servers CURL_CMD=1 - display curl commands CURL_OPT - additional curl options. `-k` to ignore certificates, `-v` for verbose protocol output CURL_HTTPS_GET=1 - use the GET method instead of HEAD for HTTPS +CURL_PAD_KB - pad every curl request with a junk header of this many KB. Useful for testing a "16 KB"-style whitelist block (see [below](#why-it-wont-open)) against a target with no large page of its own to download, since that block triggers on total bytes transferred rather than on how much of it was a real response. Independent of CURL_HTTPS_GET; use whichever fits the target DOMAINS - space-separated list of domains or domains with URIs to test TEST - name of the test IPVS=4|6|46 - IP protocol versions to test diff --git a/docs/manual.md b/docs/manual.md index 64dd275..08c0c46 100644 --- a/docs/manual.md +++ b/docs/manual.md @@ -5161,6 +5161,7 @@ CURL_MAX_TIME_DOH - время таймаута curl для DoH серверов CURL_CMD=1 - показывать команды curl CURL_OPT - дополнительные параметры curl. `-k` - игнор сертификатов. `-v` - подробный вывод протокола CURL_HTTPS_GET=1 - использовать метод GET вместо HEAD для https +CURL_PAD_KB - добавлять к каждому запросу curl мусорный заголовок на указанное число КБ. Полезно для проверки блока в стиле "16 кб" (см. [ниже](#почему-не-открывается)) на ресурсе без своей большой страницы для скачивания, поскольку этот блок срабатывает по суммарному числу переданных байт, а не по тому, сколько из них было настоящим ответом. Независимо от CURL_HTTPS_GET, используйте то, что подходит для конкретной цели DOMAINS - список тестируемых доменов или доменов с URI через пробел TEST - имя теста IPVS=4|6|46 - тестируемые версии ip протокола