Update readme

Some websites (or more precisely, TLS terminators/balancers) can't
handle segmented TLS ClientHello packet properly, requiring the whole
ClientHello in a single segment, otherwise the connection gets dropped.

However they still operate with a proper TCP stack.
Cheat on them: send the latter segment first (with TCP SEQ "in the future"),
the former segment second (with "current" SEQ), allowing OS TCP
stack to combine it in a single TCP read().

This fixes long-standing number of TCP fragmentation issues:
Fixes #4, #158, #224, #59, #192 and many others.

README.md

@@ -37,6 +37,12 @@ Usage: goodbyedpi.exe [OPTION...]
                           DANGEROUS! May break websites in unexpected ways. Use with care.
  --wrong-chksum           activate Fake Request Mode and send it with incorrect TCP checksum.
                           May not work in a VM or with some routers, but is safer than set-ttl.
+ --native-frag            fragment (split) the packets by sending them in smaller packets, without
+                          shrinking the Window Size. Works faster (does not slow down the connection)
+                          and better.
+ --reverse-frag           fragment (split) the packets just as --native-frag, but send them in the
+                          reversed order. Works with the websites which could not handle segmented
+                          HTTPS TLS ClientHello (because they receive the TCP flow "combined").
 
  -1          -p -r -s -f 2 -k 2 -n -e 2 (most compatible mode, default)
  -2          -p -r -s -f 2 -k 2 -n -e 40 (better speed for HTTPS yet still compatible)
@@ -94,14 +100,17 @@ Modify them according to your own needs.
 # Known issues
 
 * Horribly outdated Windows 7 installations are not able to load WinDivert driver due to missing support for SHA256 digital signatures. Install KB3033929 [x86](https://www.microsoft.com/en-us/download/details.aspx?id=46078)/[x64](https://www.microsoft.com/en-us/download/details.aspx?id=46148), or better, update the whole system using Windows Update.
-* Some SSL/TLS stacks unable to process fragmented ClientHello packets, and HTTPS websites won't open. Bug: [#4](https://github.com/ValdikSS/GoodbyeDPI/issues/4), [#64](https://github.com/ValdikSS/GoodbyeDPI/issues/64).
+* ~~Some SSL/TLS stacks unable to process fragmented ClientHello packets, and HTTPS websites won't open. Bug: [#4](https://github.com/ValdikSS/GoodbyeDPI/issues/4), [#64](https://github.com/ValdikSS/GoodbyeDPI/issues/64).~~ Fragmentation issues are fixed in v0.1.7.
-* ESET Antivirus is incompatible with WinDivert driver [#91](https://github.com/ValdikSS/GoodbyeDPI/issues/91). This is most probably antivirus bug, not WinDivert.
+* ~~ESET Antivirus is incompatible with WinDivert driver [#91](https://github.com/ValdikSS/GoodbyeDPI/issues/91). This is most probably antivirus bug, not WinDivert.~~
 
 
 # Similar projects
 
 - **[zapret](https://github.com/bol-van/zapret)** by @bol-van (for Linux).
 - **[Green Tunnel](https://github.com/SadeghHayeri/GreenTunnel)** by @SadeghHayeri (for MacOS, Linux and Windows).
+- **[DPITunnel](https://github.com/zhenyolka/DPITunnel)** by @zhenyolka (for Android).
+- **[PowerTunnel](https://github.com/krlvm/PowerTunnel)** by @krlvm (for Windows, MacOS and Linux).
+- **[PowerTunnel for Android](https://github.com/krlvm/PowerTunnel-Android)** by @krlvm (for Android).
 
 # Kudos
 

src/goodbyedpi.c

@@ -22,7 +22,7 @@
 // My mingw installation does not load inet_pton definition for some reason
 WINSOCK_API_LINKAGE INT WSAAPI inet_pton(INT Family, LPCSTR pStringBuf, PVOID pAddr);
 
-#define GOODBYEDPI_VERSION "v0.1.6"
+#define GOODBYEDPI_VERSION "v0.1.7"
 
 #define die() do { sleep(20); exit(EXIT_FAILURE); } while (0)
 
@@ -125,6 +125,8 @@ static struct option long_options[] = {
     {"ip-id",       required_argument, 0,  'i' },
     {"set-ttl",     required_argument, 0,  '$' },
     {"wrong-chksum",no_argument,       0,  '%' },
+    {"native-frag", no_argument,       0,  '*' },
+    {"reverse-frag",no_argument,       0,  '(' },
     {0,             0,                 0,   0  }
 };
 
@@ -353,6 +355,72 @@ static PVOID find_http_method_end(const char *pkt, unsigned int http_frag, int *
     return NULL;
 }
 
+/** Fragment and send the packet.
+ *
+ * This function cuts off the end of the packet (step=0) or
+ * the beginning of the packet (step=1) with fragment_size bytes.
+ */
+static PVOID send_native_fragment(HANDLE w_filter, WINDIVERT_ADDRESS addr,
+                        char *packet, UINT packetLen, PVOID packet_data,
+                        UINT packet_dataLen, int packet_v4, int packet_v6,
+                        PWINDIVERT_IPHDR ppIpHdr, PWINDIVERT_IPV6HDR ppIpV6Hdr,
+                        PWINDIVERT_TCPHDR ppTcpHdr,
+                        int fragment_size, int step) {
+    char packet_bak[MAX_PACKET_SIZE];
+    memcpy(&packet_bak, packet, packetLen);
+    UINT orig_packetLen = packetLen;
+
+    if (step == 0) {
+        if (packet_v4)
+            ppIpHdr->Length = htons(
+                ntohs(ppIpHdr->Length) -
+                packet_dataLen + fragment_size
+            );
+        else if (packet_v6)
+            ppIpV6Hdr->Length = htons(
+                ntohs(ppIpV6Hdr->Length) -
+                packet_dataLen + fragment_size
+            );
+        //printf("step0 (%d:%d), pp:%d, was:%d, now:%d\n",
+        //                packet_v4, packet_v6, ntohs(ppIpHdr->Length),
+        //                packetLen, packetLen - packet_dataLen + fragment_size);
+        packetLen = packetLen - packet_dataLen + fragment_size;
+    }
+
+    else if (step == 1) {
+        if (packet_v4)
+            ppIpHdr->Length = htons(
+                ntohs(ppIpHdr->Length) - fragment_size
+            );
+        else if (packet_v6)
+            ppIpV6Hdr->Length = htons(
+                ntohs(ppIpV6Hdr->Length) - fragment_size
+            );
+        //printf("step1 (%d:%d), pp:%d, was:%d, now:%d\n", packet_v4, packet_v6, ntohs(ppIpHdr->Length),
+        //                packetLen, packetLen - fragment_size);
+        memmove(packet_data,
+                packet_data + fragment_size,
+                packet_dataLen - fragment_size);
+        packetLen -= fragment_size;
+
+        ppTcpHdr->SeqNum = htonl(ntohl(ppTcpHdr->SeqNum) + fragment_size);
+    }
+
+    addr.PseudoIPChecksum = 0;
+    addr.PseudoTCPChecksum = 0;
+
+    WinDivertHelperCalcChecksums(
+        packet, packetLen, &addr, 0
+    );
+    WinDivertSend(
+        w_filter, packet,
+        packetLen,
+        &addr, NULL
+    );
+    memcpy(packet, &packet_bak, orig_packetLen);
+    //printf("Sent native fragment of %d size (step%d)\n", packetLen, step);
+}
+
 int main(int argc, char *argv[]) {
     static enum packet_type_e {
         unknown,
@@ -383,9 +451,12 @@ int main(int argc, char *argv[]) {
         do_host_mixedcase = 0,
         do_dnsv4_redirect = 0, do_dnsv6_redirect = 0,
         do_dns_verb = 0, do_blacklist = 0,
-        do_wrong_chksum = 0;
+        do_fake_packet = 0,
+        do_wrong_chksum = 0,
+        do_native_frag = 0, do_reverse_frag = 0;
     unsigned int http_fragment_size = 0;
     unsigned int https_fragment_size = 0;
+    unsigned int current_fragment_size = 0;
     BYTE ttl_of_fake_packet = 0;
     uint32_t dnsv4_addr = 0;
     struct in6_addr dnsv6_addr = {0};
@@ -486,10 +557,13 @@ int main(int argc, char *argv[]) {
                 break;
             case 'k':
                 do_fragment_http_persistent = 1;
+                do_native_frag = 1;
                 SET_HTTP_FRAGMENT_SIZE_OPTION(atousi(optarg, "Fragment size should be in range [0 - 0xFFFF]\n"));
                 break;
             case 'n':
+                do_fragment_http_persistent = 1;
                 do_fragment_http_persistent_nowait = 1;
+                do_native_frag = 1;
                 break;
             case 'e':
                 do_fragment_https = 1;
@@ -584,11 +658,24 @@ int main(int argc, char *argv[]) {
                 }
                 break;
             case '$':
+                do_fake_packet = 1;
                 ttl_of_fake_packet = atoub(optarg, "Set TTL parameter error!");
                 break;
             case '%':
+                do_fake_packet = 1;
                 do_wrong_chksum = 1;
                 break;
+            case '*':
+                do_native_frag = 1;
+                do_fragment_http_persistent = 1;
+                do_fragment_http_persistent_nowait = 1;
+                break;
+            case '(':
+                do_reverse_frag = 1;
+                do_native_frag = 1;
+                do_fragment_http_persistent = 1;
+                do_fragment_http_persistent_nowait = 1;
+                break;
             default:
                 puts("Usage: goodbyedpi.exe [OPTION...]\n"
                 " -p          block passive DPI\n"
@@ -615,7 +702,13 @@ int main(int argc, char *argv[]) {
                 "                          Could be combined with --wrong-chksum.\n"
                 " --wrong-chksum           activate Fake Request Mode and send it with incorrect TCP checksum.\n"
                 "                          May not work in a VM or with some routers, but is safer than set-ttl.\n"
-                "                          Could be combined with --set-ttl\n."
+                "                          Could be combined with --set-ttl\n"
+                " --native-frag            fragment (split) the packets by sending them in smaller packets, without\n"
+                "                          shrinking the Window Size. Works faster (does not slow down the connection)\n"
+                "                          and better.\n"
+                " --reverse-frag           fragment (split) the packets just as --native-frag, but send them in the\n"
+                "                          reversed order. Works with the websites which could not handle segmented\n"
+                "                          HTTPS TLS ClientHello (because they receive the TCP flow \"combined\").\n"
                 "\n"
                 " -1          -p -r -s -f 2 -k 2 -n -e 2 (most compatible mode, default)\n"
                 " -2          -p -r -s -f 2 -k 2 -n -e 40 (better speed for HTTPS yet still compatible)\n"
@@ -631,13 +724,16 @@ int main(int argc, char *argv[]) {
         https_fragment_size = 2;
 
     printf("Block passive: %d\nFragment HTTP: %d\nFragment persistent HTTP: %d\n"
-           "Fragment HTTPS: %d\nhoSt: %d\nHost no space: %d\nAdditional space: %d\n"
+           "Fragment HTTPS: %d\nNative fragmentation (splitting): %d\n"
+           "Fragments sending in reverse: %d\n"
+           "hoSt: %d\nHost no space: %d\nAdditional space: %d\n"
            "Mix Host: %d\nHTTP AllPorts: %d\nHTTP Persistent Nowait: %d\n"
            "DNS redirect: %d\nDNSv6 redirect: %d\n"
            "Fake requests, TTL: %hu\nFake requests, wrong checksum: %d\n",
            do_passivedpi, (do_fragment_http ? http_fragment_size : 0),
            (do_fragment_http_persistent ? http_fragment_size : 0),
            (do_fragment_https ? https_fragment_size : 0),
+           do_native_frag, do_reverse_frag,
            do_host, do_host_removespace, do_additional_space, do_host_mixedcase,
            do_http_allports, do_fragment_http_persistent_nowait, do_dnsv4_redirect,
            do_dnsv6_redirect, ttl_of_fake_packet, do_wrong_chksum
@@ -761,13 +857,19 @@ int main(int argc, char *argv[]) {
                         ((do_fragment_https ? packet_dataLen == https_fragment_size : 0) ||
                          packet_dataLen > 16) &&
                          ppTcpHdr->DstPort != htons(80) &&
-                         (ttl_of_fake_packet || do_wrong_chksum)
+                         (do_fake_packet || do_native_frag)
                         )
                 {
                     if (packet_dataLen >=2 && memcmp(packet_data, "\x16\x03", 2) == 0) {
+                        if (do_fake_packet) {
                             send_fake_https_request(w_filter, &addr, packet, packetLen, packet_v6,
                                                     ttl_of_fake_packet, do_wrong_chksum);
                         }
+                        if (do_native_frag) {
+                            // Signal for native fragmentation code handler
+                            should_recalc_checksum = 1;
+                        }
+                    }
                 }
                 /* Handle OUTBOUND packet on port 80, search for Host header */
                 else if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND && 
@@ -777,7 +879,8 @@ int main(int argc, char *argv[]) {
                                              (do_fragment_http ? http_fragment_size : 0u),
                                              &http_req_fragmented) &&
                         (do_host || do_host_removespace ||
-                        do_host_mixedcase || do_fragment_http_persistent))
+                        do_host_mixedcase || do_fragment_http_persistent ||
+                        do_fake_packet))
                 {
 
                     /* Find Host header */
@@ -789,73 +892,14 @@ int main(int argc, char *argv[]) {
                         host_addr = hdr_value_addr;
                         host_len = hdr_value_len;
 
-                        if (ttl_of_fake_packet || do_wrong_chksum)
+                        if (do_native_frag) {
-                            send_fake_http_request(w_filter, &addr, packet, packetLen, packet_v6,
+                            // Signal for native fragmentation code handler
-                                                   ttl_of_fake_packet, do_wrong_chksum);
-
-
-                        /*
-                         * Handle new HTTP request in new
-                         * connection (when Window Size modification disabled)
-                         * or already established connection (keep-alive).
-                         * We split HTTP request into two packets: one of http_fragment_size length
-                         * and another of original_size - http_fragment_size length.
-                         *
-                         * The second packet of a splitted part is not really needed to be sent
-                         * as Windows understand that is hasn't been sent by checking
-                         * ack number of received packet and retransmitting missing part again,
-                         * but it's better to send it anyway since it eliminates one RTT.
-                         */
-                        if (do_fragment_http_persistent && !http_req_fragmented &&
-                            (packet_dataLen > http_fragment_size))
-                        {
-                            if (packet_v4)
-                                ppIpHdr->Length = htons(
-                                    ntohs(ppIpHdr->Length) -
-                                    packet_dataLen + http_fragment_size
-                                );
-                            else if (packet_v6)
-                                ppIpV6Hdr->Length = htons(
-                                    ntohs(ppIpV6Hdr->Length) -
-                                    packet_dataLen + http_fragment_size
-                                );
-
-                            WinDivertHelperCalcChecksums(
-                                packet, packetLen - packet_dataLen + http_fragment_size, &addr, 0
-                            );
-                            WinDivertSend(
-                                w_filter, packet,
-                                packetLen - packet_dataLen + http_fragment_size,
-                                &addr, NULL
-                            );
-
-                            if (do_fragment_http_persistent_nowait) {
-                                if (packet_v4)
-                                    ppIpHdr->Length = htons(
-                                        ntohs(ppIpHdr->Length) -
-                                        http_fragment_size + packet_dataLen - http_fragment_size
-                                    );
-                                else if (packet_v6)
-                                    ppIpV6Hdr->Length = htons(
-                                        ntohs(ppIpV6Hdr->Length) -
-                                        http_fragment_size + packet_dataLen - http_fragment_size
-                                    );
-                                memmove(packet_data,
-                                        packet_data + http_fragment_size,
-                                        packet_dataLen);
-                                packet_dataLen -= http_fragment_size;
-                                packetLen -= http_fragment_size;
-                                hdr_value_addr -= http_fragment_size;
-                                hdr_name_addr -= http_fragment_size;
-                                host_addr = hdr_value_addr;
-
-                                ppTcpHdr->SeqNum = htonl(ntohl(ppTcpHdr->SeqNum) + http_fragment_size);
                             should_recalc_checksum = 1;
                         }
-                            else {
+
-                                continue;
+                        if (do_fake_packet)
-                            }
+                            send_fake_http_request(w_filter, &addr, packet, packetLen, packet_v6,
-                        }
+                                                   ttl_of_fake_packet, do_wrong_chksum);
 
                         if (do_host_mixedcase) {
                             mix_case(host_addr, host_len);
@@ -933,13 +977,43 @@ int main(int argc, char *argv[]) {
                         } /* else if (do_host_removespace) */
                     } /* if (find_header_and_get_info http_host) */
                 } /* Handle OUTBOUND packet with data */
+
+                /*
+                * should_recalc_checksum mean we have detected a packet to handle and
+                * modified it in some way.
+                * Handle native fragmentation here, incl. sending the packet.
+                */
+                if (should_reinject && should_recalc_checksum && do_native_frag)
+                {
+                    current_fragment_size = 0;
+                    if (do_fragment_http && ppTcpHdr->DstPort == htons(80)) {
+                        current_fragment_size = http_fragment_size;
+                    }
+                    else if (do_fragment_https && ppTcpHdr->DstPort != htons(80)) {
+                        current_fragment_size = https_fragment_size;
+                    }
+
+                    if (current_fragment_size) {
+                        send_native_fragment(w_filter, addr, packet, packetLen, packet_data,
+                                            packet_dataLen,packet_v4, packet_v6,
+                                            ppIpHdr, ppIpV6Hdr, ppTcpHdr,
+                                            current_fragment_size, do_reverse_frag);
+
+                        send_native_fragment(w_filter, addr, packet, packetLen, packet_data,
+                                            packet_dataLen,packet_v4, packet_v6,
+                                            ppIpHdr, ppIpV6Hdr, ppTcpHdr,
+                                            current_fragment_size, !do_reverse_frag);
+                        continue;
+                    }
+                }
             } /* Handle TCP packet with data */
 
             /* Else if we got TCP packet without data */
             else if (packet_type == ipv4_tcp || packet_type == ipv6_tcp) {
                 /* If we got INBOUND SYN+ACK packet */
                 if (addr.Direction == WINDIVERT_DIRECTION_INBOUND &&
-                    ppTcpHdr->Syn == 1 && ppTcpHdr->Ack == 1) {
+                    ppTcpHdr->Syn == 1 && ppTcpHdr->Ack == 1 &&
+                    !do_native_frag) {
                     //printf("Changing Window Size!\n");
                     /*
                      * Window Size is changed even if do_fragment_http_persistent