From f8d08b84361eaece84538de9e44530c9edcc6b89 Mon Sep 17 00:00:00 2001
From: bol-van <none@none.none>
Date: Tue, 20 Oct 2026 15:28:52 +0300
Subject: [PATCH] AI fixes

---
 lua/zapret-lib.lua  | 169 +++++++++++++++++++++++---------------------
 lua/zapret-obfs.lua |   2 +-
 nfq2/conntrack.c    |   2 +-
 nfq2/helpers.c      |   2 +-
 nfq2/helpers.h      |   4 +-
 5 files changed, 94 insertions(+), 85 deletions(-)

diff --git a/lua/zapret-lib.lua b/lua/zapret-lib.lua
index 45247e4..8d94296 100644
--- a/lua/zapret-lib.lua
+++ b/lua/zapret-lib.lua
@@ -1602,7 +1602,7 @@ function tls_client_hello_mod(tls, options)
 		DLOG("tls_client_hello_mod: could not dissect tls")
 		return
 	end
-	if not tdis.handshake or not tdis.handshake[TLS_HANDSHAKE_TYPE_CLIENT] then
+	if not tdis.handshake or not tdis.handshake[TLS_HANDSHAKE_TYPE_CLIENT] or not tdis.handshake[TLS_HANDSHAKE_TYPE_CLIENT].dis then
 		DLOG("tls_client_hello_mod: handshake not dissected")
 		return
 	end
@@ -2447,93 +2447,102 @@ end
 
 -- dissect client/server hello. leave 'data' as is for others
 function tls_dissect_handshake(handshake, partialOK)
-	if is_tls_hello(handshake.data, 1, partialOK) then
-		local hlen = tls_handshake_len(handshake.data, 1)
-		if hlen > #handshake.data then
-			if not partialOK then return false end
-			hlen = #handshake.data
-		end
-		local typ = tls_handshake_type(handshake.data, 1)
-		handshake.dis = { type = typ , ver = u16(handshake.data, 5), name = tostring(TLS_HANDSHAKE_TYPE_NAMES[typ]) }
-
-		-- random
-		if hlen<38 then return partialOK end
-		handshake.dis.random = string.sub(handshake.data, 7, 38)
-
-		-- session_id
-		if hlen<39 then return partialOK end
-		local len = u8(handshake.data, 39)
-		local left = hlen-39-len
-		if left<0 then return partialOK end
-		handshake.dis.session_id = string.sub(handshake.data, 40, 40+len-1)
-		local off = 40+len
-
-		-- cipher suite(s)
-		if left<2 then return partialOK end
-		if handshake.dis.type==TLS_HANDSHAKE_TYPE_CLIENT then
-			-- client hello - array
-			len = u16(handshake.data, off)
-			if left<(2+len) then return partialOK end
-			handshake.dis.cipher_suites={}
-			for i=1,(len/2) do
-				handshake.dis.cipher_suites[i] = u16(handshake.data, off + i*2)
+	local function tls_dissect_handshake_(handshake, partialOK)
+		handshake.dis = nil
+		if is_tls_hello(handshake.data, 1, partialOK) then
+			local hlen = tls_handshake_len(handshake.data, 1)
+			if hlen > #handshake.data then
+				if not partialOK then return false end
+				hlen = #handshake.data
 			end
-			off = off + 2 + len
-			left = left - 2 - len
-		else
-			-- server hello - single
-			handshake.dis.cipher_suite = u16(handshake.data, off)
+			local typ = tls_handshake_type(handshake.data, 1)
+			handshake.dis = { type = typ , ver = u16(handshake.data, 5), name = tostring(TLS_HANDSHAKE_TYPE_NAMES[typ]) }
+
+			-- random
+			if hlen<38 then return partialOK end
+			handshake.dis.random = string.sub(handshake.data, 7, 38)
+
+			-- session_id
+			if hlen<39 then return partialOK end
+			local len = u8(handshake.data, 39)
+			local left = hlen-39-len
+			if left<0 then return partialOK end
+			handshake.dis.session_id = string.sub(handshake.data, 40, 40+len-1)
+			local off = 40+len
+
+			-- cipher suite(s)
+			if left<2 then return partialOK end
+			if handshake.dis.type==TLS_HANDSHAKE_TYPE_CLIENT then
+				-- client hello - array
+				len = u16(handshake.data, off)
+				if left<(2+len) then return partialOK end
+				handshake.dis.cipher_suites={}
+				for i=1,(len/2) do
+					handshake.dis.cipher_suites[i] = u16(handshake.data, off + i*2)
+				end
+				off = off + 2 + len
+				left = left - 2 - len
+			else
+				-- server hello - single
+				handshake.dis.cipher_suite = u16(handshake.data, off)
+				off = off + 2
+				left = left - 2
+			end
+
+			-- compression method(s)
+			if left<1 then return partialOK end
+			if handshake.dis.type==1 then
+				-- client hello - array
+				len = u8(handshake.data, off)
+				if left<(1+len) then return partialOK end
+				handshake.dis.compression_methods={}
+				for i=1,len do
+					handshake.dis.compression_methods[i] = u8(handshake.data, off + i)
+				end
+				off = off + 1 + len
+				left = left - 1 - len
+			else
+				-- server hello - single
+				handshake.dis.compression_method = u8(handshake.data, off)
+				off = off + 1
+				left = left - 1
+			end
+
+			-- tls extensions
+			if left<2 then return partialOK end
+			local extlen = u16(handshake.data, off)
+			if left<(2+extlen) and not partialOK then return false end
 			off = off + 2
 			left = left - 2
-		end
+			if left>extlen then left=extlen end
 
-		-- compression method(s)
-		if left<1 then return partialOK end
-		if handshake.dis.type==1 then
-			-- client hello - array
-			len = u8(handshake.data, off)
-			if left<(1+len) then return partialOK end
-			handshake.dis.compression_methods={}
-			for i=1,len do
-				handshake.dis.compression_methods[i] = u8(handshake.data, off + i)
-			end
-			off = off + 1 + len
-			left = left - 1 - len
-		else
-			-- server hello - single
-			handshake.dis.compression_method = u8(handshake.data, off)
-			off = off + 1
-			left = left - 1
-		end
-
-		-- tls extensions
-		if left<2 then return partialOK end
-		local extlen = u16(handshake.data, off)
-		if left<(2+extlen) and not partialOK then return end
-		off = off + 2
-		left = left - 2
-		if left>extlen then left=extlen end
-
-		handshake.dis.ext = {}
-		while left>=4 do
-			len = u16(handshake.data, off + 2)
-			if len>(left-4) then
-				if partialOK then
-					break
-				else
-					return
+			handshake.dis.ext = {}
+			while left>=4 do
+				len = u16(handshake.data, off + 2)
+				if len>(left-4) then
+					if partialOK then
+						break
+					else
+						return false
+					end
 				end
+				local typ = u16(handshake.data, off)
+				handshake.dis.ext[#handshake.dis.ext+1] = { type = typ, name = tostring(TLS_HELLO_EXT_NAMES[typ]), data = string.sub(handshake.data, off+4, off+4+len-1) }
+				tls_dissect_ext(handshake.dis.ext[#handshake.dis.ext])
+				left = left - 4 - len
+				off = off + 4 + len
 			end
-			local typ = u16(handshake.data, off)
-			handshake.dis.ext[#handshake.dis.ext+1] = { type = typ, name = tostring(TLS_HELLO_EXT_NAMES[typ]), data = string.sub(handshake.data, off+4, off+4+len-1) }
-			tls_dissect_ext(handshake.dis.ext[#handshake.dis.ext])
-			left = left - 4 - len
-			off = off + 4 + len
-		end
 
-		return true
+			return true
+		end
+		return false
 	end
-	return false
+	local b = tls_dissect_handshake_(handshake,partialOK)
+	if not b then
+		-- clear partially filled dissect if failed
+		handshake.dis = nil
+	end
+	return b
 end
 
 -- convert tls blob tls dissect
diff --git a/lua/zapret-obfs.lua b/lua/zapret-obfs.lua
index 1d39cea..c0f0bd8 100644
--- a/lua/zapret-obfs.lua
+++ b/lua/zapret-obfs.lua
@@ -429,7 +429,7 @@ function synhide(ctx, desync)
 
 	if fl==TH_SYN then
 		-- client sent
-		local ttl = tonumber(desync.dis.ip and desync.arg.ghost or desync.arg.ghost6)
+		local ttl = tonumber(desync.dis.ip and desync.arg.ghost or (desync.dis.ip6 and desync.arg.ghost6))
 		if ttl then
 			DLOG("synhide: punch NAT hole with ttl="..ttl)
 			local dis = deepcopy(desync.dis)
diff --git a/nfq2/conntrack.c b/nfq2/conntrack.c
index 1eaad17..169d3ed 100644
--- a/nfq2/conntrack.c
+++ b/nfq2/conntrack.c
@@ -146,7 +146,7 @@ static void ConntrackApplyPos(t_ctrack *t, bool bReverse, const struct dissect *
 	{
 		// scale and mss only valid in syn packets
 		scale = tcp_find_scale_factor(dis->tcp);
-		if (scale != SCALE_NONE) direct->scale = scale;
+		if (scale != SCALE_NONE) direct->scale = scale<14 ? scale : 14; // RFC7323 hard limit
 		direct->mss = tcp_find_mss(dis->tcp);
 	}
 	else
diff --git a/nfq2/helpers.c b/nfq2/helpers.c
index ada33a5..3c27805 100644
--- a/nfq2/helpers.c
+++ b/nfq2/helpers.c
@@ -435,7 +435,7 @@ bool file_mod_signature(const char *filename, file_mod_sig *ms)
 		FILE_MOD_RESET(ms);
 		return false;
 	}
-	ms->mod_time = st.st_mtime;
+	ms->mod_time = st.st_mtim;
 	ms->size = st.st_size;
 	return true;
 }
diff --git a/nfq2/helpers.h b/nfq2/helpers.h
index 725ab49..b0709e1 100644
--- a/nfq2/helpers.h
+++ b/nfq2/helpers.h
@@ -82,10 +82,10 @@ int fprint_localtime(FILE *F);
 
 typedef struct
 {
-	time_t mod_time;
+	struct timespec mod_time;
 	off_t size;
 } file_mod_sig;
-#define FILE_MOD_COMPARE(ms1,ms2) (((ms1)->mod_time==(ms2)->mod_time) && ((ms1)->size==(ms2)->size))
+#define FILE_MOD_COMPARE(ms1,ms2) (((ms1)->mod_time.tv_sec==(ms2)->mod_time.tv_sec) && ((ms1)->mod_time.tv_nsec==(ms2)->mod_time.tv_nsec) && ((ms1)->size==(ms2)->size))
 #define FILE_MOD_RESET(ms) memset(ms,0,sizeof(file_mod_sig))
 bool file_mod_signature(const char *filename, file_mod_sig *ms);
 bool file_size(const char *filename, off_t *size);