From fbeb124cf82202216af3d64b9231e0bdd251644f Mon Sep 17 00:00:00 2001
From: bol-van <none@none.none>
Date: Sat, 15 Aug 2026 12:08:09 +0300
Subject: [PATCH] blockcheck2: use --wf-raw-filter in Windows instead of
 --ipset to limit target IP addresses

---
 blockcheck2.sh   | 15 ++++++++-------
 docs/changes.txt |  4 ++++
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/blockcheck2.sh b/blockcheck2.sh
index 6e0a0d5..4bbf298 100755
--- a/blockcheck2.sh
+++ b/blockcheck2.sh
@@ -49,7 +49,6 @@ IPFW_RULE_NUM=${IPFW_RULE_NUM:-$(($$ % $IPFW_RULE_MAX + 1))}
 IPFW_DIVERT_PORT=${IPFW_DIVERT_PORT:-$(($$ % 64536 + 1000))}
 QNUM=${QNUM:-$(($$ % 64536 + 1000))}
 
-IPSET_FILE=/tmp/blockcheck_ipset_$$.txt
 PARALLEL_OUT=/tmp/zapret_parallel_$$
 HDRTEMP=/tmp/zapret-hdr-$$
 NFT_TABLE=blockcheck$$
@@ -822,7 +821,7 @@ pktws_ipt_prepare()
 	# $2 - port
 	# $3 - ip list
 
-	local ip
+	local ip n= v=
 
 	case "$FWTYPE" in
 		iptables)
@@ -842,10 +841,13 @@ pktws_ipt_prepare()
 			opf_prepare_dvtws $1 $2 "$3"
 			;;
 		windivert)
+			[ "$IPV" = 6 ] && v="v6"
 			WF="--wf-l3=ipv${IPV} --wf-${1}-out=$2"
-			rm -f "$IPSET_FILE"
+			WFRAWF=
 			for ip in $3; do
-				echo $ip >>"$IPSET_FILE"
+				[ -n "$n" ] && WFRAWF="$WFRAWF or "
+				WFRAWF="${WFRAWF}ip${v}.DstAddr=$ip or ip${v}.SrcAddr=$ip"
+				n=1
 			done
 			;;
 
@@ -874,8 +876,7 @@ pktws_ipt_unprepare()
 			pf_restore
 			;;
 		windivert)
-			unset WF
-			rm -f "$IPSET_FILE"
+			unset WF WFRAWF
 			;;
 	esac
 }
@@ -957,7 +958,7 @@ pktws_start()
 			# allow multiple PKTWS instances with the same wf filter but different ipset
 			# some methods require empty acks
 			# use guard timer to kill unmanaged pktws instances
-			"$WINWS2" --wf-dup-check=0 --wf-tcp-empty=1 $WF --ipset="$IPSET_FILE" \
+			"$WINWS2" --wf-dup-check=0 --wf-tcp-empty=1 $WF --wf-raw-filter="$WFRAWF" \
 				--lua-init="timer_set('exit_guard',function(name,data) io.stderr:write('exit_guard\n'); os.exit(3000); end,20000,true)" \
 				--lua-init=@"$ZAPRET_BASE/lua/zapret-lib.lua" --lua-init=@"$ZAPRET_BASE/lua/zapret-antidpi.lua" "$@" >/dev/null &
 			;;
diff --git a/docs/changes.txt b/docs/changes.txt
index 80ad97c..596fb4f 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -322,3 +322,7 @@ v0.9.4.3
 * nfqws2: desync_timer_name includes now instance name
 * builder_linux: optional build with zlib-ng : set ZLIB_NG=1 variable
 * github: remove high_entropy_va patch for windivert.dll, but leave dynamic_base
+
+1.0.5
+
+* blockcheck2: use --wf-raw-filter in Windows instead of --ipset to limit target IP addresses