Add option to blacklist certain domains

[atahanacar]

Currently, the DPI prevention is working fine for me with -a option. However, this breaks locally hosted services that are on the same network. Accessing a locally hosted HTTPS website returns SSL_ERROR_RX_MALFORMED_SERVER_HELLO. This can be solved by adding an option to disable dpibreak on certain domains, similar to zapret's --hostlist-exclude option. For example: -b example.com -b *.example.com can stop dpibreak from sending a fake packet if the domain is example.com or any of its subdomains.

[dilluti0n]

While -b seems useful regardless of the problem you are experiencing, here is a temporary solution for linux:

#!/bin/bash
table=dpibreak
chain=OUTPUT

dpibreak "$@" &
pid=$!

for _ in $(seq 1 50); do
    if nft list chain inet $table $chain &>/dev/null; then
        nft insert rule inet $table $chain oif "lo" return
        break
    fi
    sleep 0.1
done

wait $pid

put this to /usr/local/bin/dbrk or something and use it with dbrk [options].

On windows, sadly recompilation required.

[atahanacar]

Thanks for the reply. I worked around my issue by using -o instead of -a. I didn't try your script, but it seems it would work for services hosted on the same computer. Unfortunately my issue was with services hosted on another computer on the same local network. One could easily adapt the script for that purpose, but I currently don't have the will or energy to learn nftables.

I won't close the issue, as you said the option could be useful.

[dilluti0n]

Split the LAN-server bug out into #27 with a temporary nftables workaround. Keeping this one for the -b discussion.