Print message of HTTP fragmentation > 2 incompatibility.

We can't reliably distinguish HTTP data from other data on port 80 when fragmentation is used.
HTTP method code has a special case which tries to find HTTP method when fragmentation = 1 or 2 is used,
but not for other values.

goodbyedpi.c

@@ -53,15 +53,6 @@ static const char *http_methods[] = {
     "DELETE ",
     "CONNECT ",
     "OPTIONS ",
-    "TRACE ",
-    "PATCH ",
-    "PROPFIND ",
-    "PROPPATCH ",
-    "MKCOL ",
-    "COPY ",
-    "MOVE ",
-    "LOCK ",
-    "UNLOCK ",
 };
 
 static char* dumb_memmem(const char* haystack, int hlen, const char* needle, int nlen) {
@@ -139,11 +130,19 @@ static void change_window_size(const char *pkt, int size) {
 }
 
 /* HTTP method end without trailing space */
-static PVOID find_http_method_end(const char *pkt) {
+static PVOID find_http_method_end(const char *pkt, int offset) {
     int i;
     for (i = 0; i<(sizeof(http_methods) / sizeof(*http_methods)); i++) {
         if (memcmp(pkt, http_methods[i], strlen(http_methods[i])) == 0) {
-            return (char*)pkt+strlen(http_methods[i]) - 1;
+            return (char*)pkt + strlen(http_methods[i]) - 1;
+        }
+        /* Try to find HTTP method in a second part of fragmented packet */
+        if ((offset == 1 || offset == 2) &&
+            memcmp(pkt, http_methods[i] + offset,
+                   strlen(http_methods[i]) - offset) == 0
+           )
+        {
+            return (char*)pkt + strlen(http_methods[i]) - offset - 1;
         }
     }
     return NULL;
@@ -249,6 +248,12 @@ int main(int argc, char *argv[]) {
            (do_fragment_https ? https_fragment_size : 0),
            do_host, do_host_removespace, do_additional_space);
 
+    if (do_fragment_http && http_fragment_size > 2) {
+        printf("WARNING: HTTP fragmentation values > 2 are not fully compatible "
+               "with other options. Please use values <= 2 or disable HTTP fragmentation "
+               "completely.\n");
+    }
+
     printf("\nOpening filter\n");
     filter_num = 0;
 
@@ -313,8 +318,10 @@ int main(int argc, char *argv[]) {
                 /* Handle OUTBOUND packet, search for Host header */
                 else if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND && 
                         packet_dataLen > 16 && ppTcpHdr->DstPort == htons(80) &&
-                        find_http_method_end(packet_data) &&
+                        find_http_method_end(packet_data,
-                        (do_host || do_host_removespace)) {
+                                             (do_fragment_http ? http_fragment_size : 0)) &&
+                        (do_host || do_host_removespace))
+                {
 
                     data_addr = find_host_header(packet_data, packet_dataLen);
                     if (data_addr) {
@@ -328,7 +335,8 @@ int main(int argc, char *argv[]) {
                         if (do_additional_space && do_host_removespace) {
                             /* End of "Host:" without trailing space */
                             host_addr = data_addr + strlen(http_host_find) - 1;
-                            method_addr = find_http_method_end(packet_data);
+                            method_addr = find_http_method_end(packet_data,
+                                                            (do_fragment_http ? http_fragment_size : 0));
 
                             if (method_addr) {
                                 memmove(method_addr + 1, method_addr, (PVOID)host_addr - (PVOID)method_addr);
@@ -350,27 +358,40 @@ int main(int argc, char *argv[]) {
                                  */
                                 host_len = data_addr_rn - host_addr;
                                 useragent_addr = find_useragent_header(packet_data, packet_dataLen);
-                                if (host_len <= 253 && useragent_addr && useragent_addr > host_addr) {
+                                if (host_len <= 253 && useragent_addr) {
-                                    /* Performing action only if User-Agent header goes after Host */
-
                                     useragent_addr += strlen(http_useragent_find);
                                     /* useragent_addr is in the beginning of User-Agent value */
 
                                     data_len = packet_dataLen - ((PVOID)useragent_addr - packet_data);
                                     data_addr_rn = dumb_memmem(useragent_addr,
-                                                               data_len, "\r\n", 2);
+                                                            data_len, "\r\n", 2);
                                     /* data_addr_rn is in the end of User-Agent value */
 
                                     if (data_addr_rn) {
-                                        data_len = (PVOID)data_addr_rn - (PVOID)host_addr;
+                                        if (useragent_addr > host_addr) {
+                                            /* User-Agent goes AFTER Host header */
+                                            data_len = (PVOID)data_addr_rn - (PVOID)host_addr;
 
-                                        /* Move one byte to the left from "Host:"
+                                            /* Move one byte to the LEFT from "Host:"
-                                         * to the end of User-Agen
+                                            * to the end of User-Agent
-                                         */
+                                            */
-                                        memmove(host_addr - 1, host_addr, data_len);
+                                            memmove(host_addr - 1, host_addr, data_len);
-                                        /* Put space in the end of User-Agent header */
+                                            /* Put space in the end of User-Agent header */
-                                        *(char*)(data_addr_rn - 1) = ' ';
+                                            *(char*)(data_addr_rn - 1) = ' ';
-                                        //printf("Replaced Host header!\n");
+                                            //printf("Replaced Host header!\n");
+                                        }
+                                        else {
+                                            /* User-Agent goes BEFORE Host header */
+                                            data_len = (PVOID)host_addr - (PVOID)data_addr_rn - 1;
+
+                                            /* Move one byte to the RIGHT from the end of User-Agent
+                                            * to the "Host:"
+                                            */
+                                            memmove(data_addr_rn + 1, data_addr_rn, data_len);
+                                            /* Put space in the end of User-Agent header */
+                                            *(char*)(data_addr_rn) = ' ';
+                                            //printf("Replaced Host header!\n");
+                                        }
                                     }
                                 }
                             }