Test

We can't reliably distinguish HTTP data from other data on port 80 when fragmentation is used.
HTTP method code has a special case which tries to find HTTP method when fragmentation = 1 or 2 is used,
but not for other values.

goodbyedpi.c

@@ -53,15 +53,6 @@ static const char *http_methods[] = {
     "DELETE ",
     "CONNECT ",
     "OPTIONS ",
-    "TRACE ",
-    "PATCH ",
-    "PROPFIND ",
-    "PROPPATCH ",
-    "MKCOL ",
-    "COPY ",
-    "MOVE ",
-    "LOCK ",
-    "UNLOCK ",
 };
 
 static char* dumb_memmem(const char* haystack, int hlen, const char* needle, int nlen) {
@@ -139,11 +130,19 @@ static void change_window_size(const char *pkt, int size) {
 }
 
 /* HTTP method end without trailing space */
-static PVOID find_http_method_end(const char *pkt) {
+static PVOID find_http_method_end(const char *pkt, int offset) {
     int i;
     for (i = 0; i<(sizeof(http_methods) / sizeof(*http_methods)); i++) {
         if (memcmp(pkt, http_methods[i], strlen(http_methods[i])) == 0) {
-            return (char*)pkt+strlen(http_methods[i]) - 1;
+            return (char*)pkt + strlen(http_methods[i]) - 1;
+        }
+        /* Try to find HTTP method in a second part of fragmented packet */
+        if ((offset == 1 || offset == 2) &&
+            memcmp(pkt, http_methods[i] + offset,
+                   strlen(http_methods[i]) - offset) == 0
+           )
+        {
+            return (char*)pkt + strlen(http_methods[i]) - offset - 1;
         }
     }
     return NULL;
@@ -152,7 +151,7 @@ static PVOID find_http_method_end(const char *pkt) {
 int main(int argc, char *argv[]) {
     static const char fragment_size_message[] =
                 "Fragment size should be in range [0 - 65535]\n";
-    int i, should_reinject = 0;
+    int i, should_reinject, should_recalc_checksum = 0;
     int opt;
     HANDLE w_filter = NULL;
     WINDIVERT_ADDRESS addr;
@@ -249,6 +248,12 @@ int main(int argc, char *argv[]) {
            (do_fragment_https ? https_fragment_size : 0),
            do_host, do_host_removespace, do_additional_space);
 
+    if (do_fragment_http && http_fragment_size > 2) {
+        printf("WARNING: HTTP fragmentation values > 2 are not fully compatible "
+               "with other options. Please use values <= 2 or disable HTTP fragmentation "
+               "completely.\n");
+    }
+
     printf("\nOpening filter\n");
     filter_num = 0;
 
@@ -290,103 +295,22 @@ int main(int argc, char *argv[]) {
     signal(SIGINT, sigint_handler);
 
     while (1) {
-        if (WinDivertRecv(w_filter, packet, sizeof(packet), &addr, &packetLen)) {
+         if (WinDivertRecv(w_filter, packet, sizeof(packet), &addr, &packetLen)) {
-            //printf("Got %s packet, len=%d!\n", addr.Direction ? "inbound" : "outbound",
+            printf("Got %s packet, len=%d!\n", addr.Direction ? "inbound" : "outbound",
-            //       packetLen);
+                   packetLen);
-            should_reinject = 1;
 
+            // do nothing for DATA packet
             if (WinDivertHelperParsePacket(packet, packetLen, &ppIpHdr,
                 NULL, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen)) {
-                //printf("Got parsed packet, len=%d!\n", packet_dataLen);
-                /* Got a packet WITH DATA */
-
-                /* Handle INBOUND packet with data and find HTTP REDIRECT in there */
-                if (addr.Direction == WINDIVERT_DIRECTION_INBOUND && packet_dataLen > 16) {
-                    /* If INBOUND packet with DATA (tcp.Ack) */
-
-                    /* Drop packets from filter with HTTP 30x Redirect */
-                    if (do_passivedpi && is_passivedpi_redirect(packet_data, packet_dataLen)) {
-                        //printf("Dropping HTTP Redirect packet!\n");
-                        should_reinject = 0;
-                    }
-                }
-                /* Handle OUTBOUND packet, search for Host header */
-                else if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND && 
-                        packet_dataLen > 16 && ppTcpHdr->DstPort == htons(80) &&
-                        find_http_method_end(packet_data) &&
-                        (do_host || do_host_removespace)) {
-
-                    data_addr = find_host_header(packet_data, packet_dataLen);
-                    if (data_addr) {
-
-                        if (do_host) {
-                            /* Replace "Host: " with "hoSt: " */
-                            memcpy(data_addr, http_host_replace, strlen(http_host_replace));
-                            //printf("Replaced Host header!\n");
-                        }
-
-                        if (do_additional_space && do_host_removespace) {
-                            /* End of "Host:" without trailing space */
-                            host_addr = data_addr + strlen(http_host_find) - 1;
-                            method_addr = find_http_method_end(packet_data);
-
-                            if (method_addr) {
-                                memmove(method_addr + 1, method_addr, (PVOID)host_addr - (PVOID)method_addr);
-                            }
-                        }
-                        else if (do_host_removespace) {
-                            host_addr = data_addr + strlen(http_host_find);
-
-                            data_addr_rn = dumb_memmem(host_addr,
-                                                       packet_dataLen - ((PVOID)host_addr - packet_data),
-                                                       "\r\n", 2);
-                            if (data_addr_rn) {
-                                /* We move Host header value by one byte to the left and then
-                                 * "insert" stolen space to the end of User-Agent value because
-                                 * some web servers are not tolerant to additional space in the
-                                 * end of Host header.
-                                 *
-                                 * Nothing is done if User-Agent header is missing.
-                                 */
-                                host_len = data_addr_rn - host_addr;
-                                useragent_addr = find_useragent_header(packet_data, packet_dataLen);
-                                if (host_len <= 253 && useragent_addr && useragent_addr > host_addr) {
-                                    /* Performing action only if User-Agent header goes after Host */
-
-                                    useragent_addr += strlen(http_useragent_find);
-                                    /* useragent_addr is in the beginning of User-Agent value */
-
-                                    data_len = packet_dataLen - ((PVOID)useragent_addr - packet_data);
-                                    data_addr_rn = dumb_memmem(useragent_addr,
-                                                               data_len, "\r\n", 2);
-                                    /* data_addr_rn is in the end of User-Agent value */
-
-                                    if (data_addr_rn) {
-                                        data_len = (PVOID)data_addr_rn - (PVOID)host_addr;
-
-                                        /* Move one byte to the left from "Host:"
-                                         * to the end of User-Agen
-                                         */
-                                        memmove(host_addr - 1, host_addr, data_len);
-                                        /* Put space in the end of User-Agent header */
-                                        *(char*)(data_addr_rn - 1) = ' ';
-                                        //printf("Replaced Host header!\n");
-                                    }
-                                }
-                            }
-                        }
-
-                        WinDivertHelperCalcChecksums(packet, packetLen, 0);
-                    }
-                }
             }
-            /* Else if we got TCP packet without data */
+
+            // reduce window size on non-data packet
             else if (WinDivertHelperParsePacket(packet, packetLen, &ppIpHdr,
                 NULL, NULL, NULL, &ppTcpHdr, NULL, NULL, NULL)) {
                 /* If we got SYN+ACK packet */
                 if (addr.Direction == WINDIVERT_DIRECTION_INBOUND && 
                     ppTcpHdr->Syn == 1) {
-                    //printf("Changing Window Size!\n");
+                    printf("Changing Window Size!\n");
                     if (do_fragment_http && ppTcpHdr->SrcPort == htons(80)) {
                         change_window_size(packet, http_fragment_size);
                         WinDivertHelperCalcChecksums(packet, packetLen, 0);
@@ -397,11 +321,9 @@ int main(int argc, char *argv[]) {
                     }
                 }
             }
-
+            // uncomment this to make it work
-            if (should_reinject) {
+            //WinDivertHelperCalcChecksums(packet, packetLen, 0);
-                //printf("Re-injecting!\n");
+            WinDivertSend(w_filter, packet, packetLen, &addr, NULL);
-                WinDivertSend(w_filter, packet, packetLen, &addr, NULL);
-            }
         }
         else {
             // error, ignore