From 6e186a3b38f0ed97626ff425fa4c50a79329aeed Mon Sep 17 00:00:00 2001
From: bol-van <none@none.none>
Date: Wed, 2 Sep 2026 09:16:55 +0300
Subject: [PATCH] nfqws2: pad tcp options with 0x00 in reconstruct. strip 0x00
 ending options in dissect.

---
 docs/changes.txt     |  3 ++-
 lua/zapret-tests.lua | 11 ++++-------
 nfq2/lua.c           | 28 +++++++++++++++++++++++++++-
 3 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/docs/changes.txt b/docs/changes.txt
index 873e36f..1680643 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -329,5 +329,6 @@ v0.9.4.3
 * github, builder_linux: lua 5.5.1
 * nfqws2: negate SSID/NLM filters
 * nfqws2: desync function can explicitly return nil as a synonym of VERDICT_PASS
-* zapret-lub: luaexec now passes returned verdict code
+* nfqws2: pad tcp options with 0x00 in reconstruct. strip 0x00 ending options in dissect.
+* zapret-lib: luaexec now passes returned verdict code
 * blockcheck2: fix script crash on bad strategies from the file in custom/10-list.sh
diff --git a/lua/zapret-tests.lua b/lua/zapret-tests.lua
index 6690c05..b0eca54 100644
--- a/lua/zapret-tests.lua
+++ b/lua/zapret-tests.lua
@@ -536,8 +536,7 @@ function test_dissect()
 					{ kind = 1 },
 					{ kind = 0xE0, data = brandom(math.random(1,10)) },
 					{ kind = 1 },
-					{ kind = 0xE1, data = brandom(math.random(1,10)) },
-					{ kind = 0 }
+					{ kind = 0xE1, data = brandom(math.random(1,10)) }
 				}
 			},
 			payload = brandom(math.random(0, 20))
@@ -704,8 +703,7 @@ function test_csum()
 			{ kind = 1 },
 			{ kind = 0xE0, data = brandom(math.random(1,10)) },
 			{ kind = 1 },
-			{ kind = 0xE1, data = brandom(math.random(1,10)) },
-			{ kind = 0 }
+			{ kind = 0xE1, data = brandom(math.random(1,10)) }
 		}
 	}
 	tcpb = reconstruct_tcphdr(tcp)
@@ -721,9 +719,8 @@ function test_csum()
 		bu8(tcp.options[1].kind)..
 		bu8(tcp.options[2].kind)..bu8(2 + #tcp.options[2].data)..tcp.options[2].data ..
 		bu8(tcp.options[3].kind)..
-		bu8(tcp.options[4].kind)..bu8(2 + #tcp.options[4].data)..tcp.options[4].data ..
-		bu8(tcp.options[5].kind)
-	raw = raw .. string.rep(bu8(TCP_KIND_NOOP), bitand(4-bitand(#raw,3),3))
+		bu8(tcp.options[4].kind)..bu8(2 + #tcp.options[4].data)..tcp.options[4].data
+	raw = raw .. string.rep(bu8(0), bitand(4-bitand(#raw,3),3))
 	print( raw==tcpb and "TCP RECONSTRUCT OK" or "TCP RECONSTRUCT FAILED" )
 	test_assert(raw==tcpb)
 
diff --git a/nfq2/lua.c b/nfq2/lua.c
index b77a442..61e4027 100644
--- a/nfq2/lua.c
+++ b/nfq2/lua.c
@@ -1306,8 +1306,34 @@ void lua_pushf_tcphdr_options(lua_State *L, const struct tcphdr *tcp, size_t len
 
 	uint8_t *t = (uint8_t*)(tcp+1);
 	uint8_t *end = (uint8_t*)tcp + (tcp->th_off<<2);
-	uint8_t opt;
+	uint8_t opt, *ee;
 	if ((end-(uint8_t*)tcp) > len) end=(uint8_t*)tcp + len;
+
+	// strip ending 0x00 options (padding)
+	ee = end;
+	while(t<end)
+	{
+		opt = *t;
+		if (opt==TCP_KIND_END)
+		{
+			// set end marker only once
+			if (ee==end) ee=t;
+		}
+		else
+			// not 0x00 (END) ? clear end marker. ENDs inside other options must be dissected
+			ee=end;
+		// skip to the next option
+		if (opt==TCP_KIND_NOOP || opt==TCP_KIND_END)
+			t++;
+		else
+		{
+			if ((t+1)>=end || t[1]<2 || (t+t[1])>end) break;
+			t+=t[1];
+		}
+	}
+	end = ee;
+	t = (uint8_t*)(tcp+1);
+
 	lua_Integer idx=1;
 	while(t<end)
 	{