Commit Graph

56 Commits

Author SHA1 Message Date
ValdikSS
cc770d302c Add GoodbyeDPI Github link to the welcome message. 2018-01-21 14:36:41 +03:00
ValdikSS
2e23d93762 New option: --ip-id. Handles additional IP ID numbers of passive DPI. 2018-01-21 14:35:30 +03:00
ValdikSS
14ae107b53 Handle only IP IDs in [0x0; 0xF] (or→and) 2018-01-21 13:03:15 +03:00
ValdikSS
1bdfbb8c45 Move active filter template and passive filter to defines 2018-01-21 12:25:22 +03:00
ValdikSS
5eddb5f18a Fix crash on error (free→LocalFree) and print KB3033929 message 2018-01-21 01:28:17 +03:00
ValdikSS
bb8fc64f18 Handle ip.id up to 0xF.
Some DPI send several TCP RST or HTTP redirection packets with
increasing IP ID number. Handle them all.
2017-12-24 20:37:49 +03:00
ValdikSS
490525387d Remove unused string 2017-12-24 20:28:25 +03:00
ValdikSS
3ffce30871 Minor modifications.
* puts() instead of printf("%s")
* strdup() instead of malloc + strcpy
2017-12-24 20:19:18 +03:00
ValdikSS
eaac2d1a80 Minor service fixes 2017-12-21 23:52:23 +03:00
ValdikSS
ccd21a4281 ntohs -> htons (they produce the same output, but still) 2017-12-21 23:50:07 +03:00
ValdikSS
23babdc8fa Windows Service support.
Program can now be started as a Windows Service. No additional
arguments needed. Refer to `service_install` and `service_remove`
scripts in released zip file.
2017-12-20 17:03:22 +03:00
ValdikSS
95765f3ed9 Store fragment_size_message as a pointer 2017-12-20 17:01:21 +03:00
ValdikSS
a5b185c2a9 Set proper options if started without arguments 2017-12-20 12:36:21 +03:00
ValdikSS
c9cd3ac8c7 Fix signed/unsigned integer comparison warning for HTTP fragmentation 2017-12-20 04:05:28 +03:00
ValdikSS
fab9662ac9 Use WinDivert TCP Header structure to change Window Size 2017-12-20 04:04:40 +03:00
ValdikSS
a88ab4337e Apply HTTP Persistent fragmentation only for sufficiently large packets 2017-12-20 03:33:30 +03:00
ValdikSS
582503452f Implement TCP fragmentation for HTTP Persistent (keep-alive) sessions.
New option `-k` splits HTTP request into two segments, and either
send only the first one (Windows would retransmit the other one
based on ACK number in ACK reply) or both (with `-n` enabled).

This fixes behaviour on some DPI which trace persistent sessions
but do not reassemble packages.
2017-12-20 02:10:59 +03:00
ValdikSS
03e36b968a Free allocated error message string 2017-12-20 01:48:38 +03:00
ValdikSS
312d2b1d55 Remove unused IPV4_TOTALLEN_OFFSET 2017-12-20 01:48:20 +03:00
ValdikSS
60e87f769a Minor modifications 2017-12-17 00:28:11 +03:00
ValdikSS
bfed8638e5 Implement blacklist.
Only domains and subdomains from the blacklist file would be processed
with HTTP modifications. Does not affect HTTPS data.
2017-12-17 00:26:11 +03:00
ValdikSS
72516c0b2b Add information about --dns-verb option 2017-12-16 20:24:40 +03:00
ValdikSS
dd4d6bc5c6 Do not print DNS warnings by default and drop duplicate requests.
Windows is known to use all available interfaces for DNS requests,
which is handled as a duplicate (retransmission) in dns redirector.

It's safe to just drop these duplicates.
2017-12-16 14:30:42 +03:00
ValdikSS
5f231996d4 Fix incorrect host header memmove()s. Fixes #47 2017-12-13 01:42:29 +03:00
ValdikSS
81718f1a53 Small fix for dnsredir 2017-12-10 20:44:50 +03:00
ValdikSS
064cf575b6 Parse DNS packet only when DNS redirection is enabled 2017-12-09 02:36:45 +03:00
ValdikSS
a67f42eebc Use defined HOST_MAXLEN 2017-12-07 22:38:41 +03:00
ValdikSS
363b2dca37 Flush DNS cache if --dns-addr is used 2017-12-07 22:38:21 +03:00
ValdikSS
1e8835cfe5 Small fixes 2017-12-07 13:03:01 +03:00
ValdikSS
a182f52207 New experimental feature: UDP DNS redirection 2017-12-06 03:09:58 +03:00
ValdikSS
61e39bc095 New feature: additional processed TCP ports 2017-12-06 03:07:16 +03:00
ValdikSS
9b9be302cb New option "-w": try to find and parse HTTP traffic on all processed ports (not only on port 80) 2017-12-06 03:07:11 +03:00
ValdikSS
c7905f0b31 Mix HTTP Host header value 2017-12-04 22:06:46 +03:00
ValdikSS
da1e2e8aac Serious refactoring 2017-12-04 22:01:25 +03:00
ValdikSS
9fa2956065 Calculate checksums even there's no packet modifications. 2017-09-07 17:35:25 +03:00
ValdikSS
2f0429027d Small refactoring 2017-09-04 22:14:17 +03:00
ValdikSS
feb03c74c8 Print message of HTTP fragmentation > 2 incompatibility.
We can't reliably distinguish HTTP data from other data on port 80 when fragmentation is used.
HTTP method code has a special case which tries to find HTTP method when fragmentation = 1 or 2 is used,
but not for other values.
2017-08-28 11:46:59 +03:00
ValdikSS
4c13435ee3 Handle Host header after User-Agent header in the HTTP packet. Fixes #29.
Most browsers would put Host header as early as they could, but not Microsoft Edge.
2017-08-28 11:45:05 +03:00
ValdikSS
ee665ee3bd Search for HTTP methods in fragmented packets with Window Size 1 or 2. Fixes #30. 2017-08-28 11:43:55 +03:00
ValdikSS
00e4964e73 Remove webdav HTTP methods. They are rarely used and less probably filtered. 2017-08-28 11:42:30 +03:00
ValdikSS
2fe377a23f Do not handle traffic from private IP ranges 2017-08-15 14:09:47 +03:00
ValdikSS
b74c974235 Print error message if filter initialization fails 2017-08-15 14:09:06 +03:00
ValdikSS
96fb5f9516 Block passive DPI packets only with "Connection: close". Fixes #17.
Some servers set "don't fragment" flag and never increase TCP ID
field. If they send HTTP redirection to another website, it would
be blocked by the program.
This is a hack to block redirects only with "Connection: close"
header as presumably legal redirects are most likely would
use keep-alive.
2017-08-15 08:28:25 +03:00
ValdikSS
f5ac7c0d67 Change TCP Window Size based on SrcPort, not DstPort.
When HTTPS fragment size was set, the program always used it for HTTP, even
if HTTP fragmentation was disabled. This is due to a bug which checked DstPort,
not SrcPort, and the packets passed DstPort != htons(80) HTTPS check.
2017-06-11 21:50:22 +03:00
ValdikSS
d9e27f193c Reimplement -s option to fix unACKed data
Old code used to reduce packet size by one byte to remove space in
HTTP Host header. This introduces one unACKed byte which OS later
tried to send to the host. This byte was \n (the last byte in original
packet) which broke POST requests.

New code in this commit moves "stolen" space in the end of User-Agent
header value and do not reduce packet size anymore.
User-Agent value is used because not all web servers are compatible
with additional space in the end of Host value.

Fix #3
2017-05-25 00:25:21 +03:00
ValdikSS
c721ab0506 Always check for valid HTTP method before any modifications 2017-05-25 00:18:01 +03:00
ValdikSS
70765fa895 New option: additional space between Method and Request-URI (enables -s, may break sites) 2017-05-23 13:30:46 +03:00
ValdikSS
a2d5be1eed const char for window size function 2017-05-23 13:23:20 +03:00
ValdikSS
30fd25bc24 Replace char* with const char* where appropriate 2017-05-20 12:25:20 +03:00
ValdikSS
9fea771d2c Less invasive Passive DPI block. Fix #2. 2017-05-20 12:24:29 +03:00