Use WinDivert 2.2.0 for Github Actions building

This patch adds WinDivert 2.0+ support in a backward-incompatible way.
WinDivert 1.4 won't work after this commit anymore.

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,35 +1,19 @@
 name: Bug Report / Сообщение об ошибке
-description: File a bug report / Сообщить об ошибке в программе
+description: File a bug report / Сообщить об ошибке в проекте
 
 body:
   - type: markdown
     attributes:
       value: |
-        **USE THIS FORM ONLY FOR BUGS**
+        Please pay some attention!
-        GoodbyeDPI does not guarantee to work with your ISP for every blocked website or at all. If GoodbyeDPI can't unblock some or any websites, this is most likely not a software bug, and you should not report it here.
+        GoodbyeDPI does not guarantee to work on your ISP on 100% or at all. If GoodbyeDPI can't unblock some or any websites, this is most likely not a software bug, and you should not report it.
+        Please report software bugs, such as: website incompatibility (if the website works without GoodbyeDPI but breaks with GoobyeDPI enabled), antivirus incompatibility, DNS redirection problems, incorrect packet handling, and other software issues.
+        Please make sure to check other opened and closed issues, it could be your question or issue has been already discussed.
 
-        Please only report software bugs, such as:
+        Пожалуйста, прочтите!
-          * program crash
+        GoodbyeDPI не гарантирует ни 100% работу с вашим провайдером, ни работу вообще. Если GoodbyeDPI не разблокирует доступ к некоторым или всем веб-сайтам, вероятнее всего, это не программная ошибка, и не стоит о ней сообщать здесь.
-          * incorrect network packet handling
+        Сообщайте только об ошибках в программе, таких как: некорректная работа с веб-сайтами (когда веб-сайт работает без GoodbyeDPI, но ломается с GoodbyeDPI), несовместимость с антивирусами, проблемы с перенаправлением DNS, некорректная обработка пакетов, и другие проблемы.
-          * antivirus incompatibility
+        Также посмотрите другие открытые и закрытые баги. Возможно, ваш вопрос или проблема уже обсуждались.
-          * DNS redirection problems
-          * other software 
-
-        Please make sure to check other opened and closed issues, it could be your bug has been reported already.
-        For questions, or if in doubt, [use NTC.party forum](https://ntc.party/c/community-software/goodbyedpi).
-
-        **ИСПОЛЬЗУЙТЕ ЭТУ ФОРМУ ТОЛЬКО ДЛЯ БАГОВ**
-        GoodbyeDPI не гарантирует ни 100% работу с вашим провайдером, ни работу с каждым заблокированным сайтом. Если GoodbyeDPI не разблокирует доступ к некоторым или всем веб-сайтам, вероятнее всего, это не программная ошибка, и не стоит о ней сообщать здесь.
-
-        Пожалуйста, сообщайте только об ошибках в программе, таких как:
-          * падение программы
-          * некорректная обработка сетевых пакетов
-          * несовместимость с антивирусами
-          * проблемы с перенаправлением DNS
-          * другие ошибки в программе
-
-        Также посмотрите другие открытые и закрытые баги. Возможно, ошибка уже обсуждалась или исправлена.
-        Для вопросов, а также в случае сомнений в определении бага, обращайтесь [на форум NTC.party](https://ntc.party/c/community-software/goodbyedpi).
   - type: input
     id: os
     attributes:
@@ -51,8 +35,8 @@ body:
   - type: textarea
     id: what-happened
     attributes:
-      label: Describe the bug / Опишите ошибку программы
+      label: Describe the issue / Опишите проблему
-      description: A clear and concise description of what the bug is / Подробно опишите, в чём заключается ошибка
+      description: A clear and concise description of what the bug is / Подробно опишите, в чём заключается проблема
       placeholder: Attach the screenshots for clarity / При необходимости приложите скриншоты
     validations:
       required: true

.github/workflows/build.yml

@@ -6,9 +6,10 @@ on:
       - 'src/**'
 
 env:
-  WINDIVERT_URL: https://www.reqrypt.org/download/WinDivert-1.4.3-A.zip
+  WINDIVERT_URL: https://www.reqrypt.org/download/WinDivert-2.2.0-A.zip
-  WINDIVERT_NAME: WinDivert-1.4.3-A.zip
+  WINDIVERT_NAME: WinDivert-2.2.0-A.zip
-  WINDIVERT_SHA256: 4084bc3931f31546d375ed89e3f842776efa46f321ed0adcd32d3972a7d02566
+  WINDIVERT_BASENAME: WinDivert-2.2.0-A
+  WINDIVERT_SHA256: 2a7630aac0914746fbc565ac862fa096e3e54233883ac52d17c83107496b7a7f
 
 jobs:
   build:
@@ -46,14 +47,14 @@ jobs:
       - name: Compile x86_64
         run: >
           cd src && make clean &&
-          make CPREFIX=x86_64-w64-mingw32- BIT64=1 WINDIVERTHEADERS=../WinDivert-1.4.3-A/include WINDIVERTLIBS=../WinDivert-1.4.3-A/x86_64 -j4
+          make CPREFIX=x86_64-w64-mingw32- BIT64=1 WINDIVERTHEADERS=../${{ env.WINDIVERT_BASENAME }}/include WINDIVERTLIBS=../${{ env.WINDIVERT_BASENAME }}/x64 -j4
       
       - name: Prepare x86_64 directory
         run: |
           mkdir goodbyedpi_x86_64_${{ steps.vars.outputs.sha_short }}
-          cp src/goodbyedpi.exe WinDivert-1.4.3-A/x86_64/*.{dll,sys} goodbyedpi_x86_64_${{ steps.vars.outputs.sha_short }}
+          cp src/goodbyedpi.exe ${{ env.WINDIVERT_BASENAME }}/x64/*.{dll,sys} goodbyedpi_x86_64_${{ steps.vars.outputs.sha_short }}
 
-      - name: Upload output file x86_64 (64 bit)
+      - name: Upload output file x86_64
         uses: actions/upload-artifact@v2
         with:
           name: goodbyedpi_x86_64_${{ steps.vars.outputs.sha_short }}
@@ -62,12 +63,12 @@ jobs:
       - name: Compile i686
         run: >
           cd src && make clean &&
-          make CPREFIX=i686-w64-mingw32- WINDIVERTHEADERS=../WinDivert-1.4.3-A/include WINDIVERTLIBS=../WinDivert-1.4.3-A/x86 -j4
+          make CPREFIX=i686-w64-mingw32- WINDIVERTHEADERS=../${{ env.WINDIVERT_BASENAME }}/include WINDIVERTLIBS=../${{ env.WINDIVERT_BASENAME }}/x86 -j4
 
       - name: Prepare x86 directory
         run: |
           mkdir goodbyedpi_x86_${{ steps.vars.outputs.sha_short }}
-          cp src/goodbyedpi.exe WinDivert-1.4.3-A/x86/*.{dll,sys} goodbyedpi_x86_${{ steps.vars.outputs.sha_short }}
+          cp src/goodbyedpi.exe ${{ env.WINDIVERT_BASENAME }}/x86/*.{dll,sys} goodbyedpi_x86_${{ steps.vars.outputs.sha_short }}
 
       - name: Upload output file x86
         uses: actions/upload-artifact@v2

README.md

@@ -44,13 +44,12 @@ Usage: goodbyedpi.exe [OPTION...]
                           This option can be supplied multiple times.
  --allow-no-sni           perform circumvention if TLS SNI can't be detected with --blacklist enabled.
  --set-ttl     <value>    activate Fake Request Mode and send it with supplied TTL value.
-                          DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).
+                          DANGEROUS! May break websites in unexpected ways. Use with care.
  --auto-ttl    [a1-a2-m]  activate Fake Request Mode, automatically detect TTL and decrease
                           it based on a distance. If the distance is shorter than a2, TTL is decreased
                           by a2. If it's longer, (a1; a2) scale is used with the distance as a weight.
                           If the resulting TTL is more than m(ax), set it to m.
                           Default (if set): --auto-ttl 1-4-10. Also sets --min-ttl 3.
-                          DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).
  --min-ttl     <value>    minimum TTL distance (128/64 - TTL) for which to send Fake Request
                           in --set-ttl and --auto-ttl modes.
  --wrong-chksum           activate Fake Request Mode and send it with incorrect TCP checksum.
@@ -66,7 +65,6 @@ Usage: goodbyedpi.exe [OPTION...]
                           Use this option to reduce CPU usage by skipping huge amount of data
                           (like file transfers) in already established sessions.
                           May skip some huge HTTP requests from being processed.
-                          Default (if set): --max-payload 1200.
 
 
 LEGACY modesets:
@@ -76,8 +74,8 @@ LEGACY modesets:
  -4          -p -r -s (best speed)
 
 Modern modesets (more stable, more compatible, faster):
- -5          -f 2 -e 2 --auto-ttl --reverse-frag --max-payload (this is the default)
+ -5          -f 2 -e 2 --auto-ttl --reverse-frag (this is the default)
- -6          -f 2 -e 2 --wrong-seq --reverse-frag --max-payload
+ -6          -f 2 -e 2 --wrong-seq --reverse-frag
 ```
 
 To check if your ISP's DPI could be circumvented, first make sure that your provider does not poison DNS answers by enabling "Secure DNS (DNS over HTTPS)" option in your browser.
@@ -145,7 +143,6 @@ Modify them according to your own needs.
 - **[DPITunnel](https://github.com/zhenyolka/DPITunnel)** by @zhenyolka (for Android).
 - **[PowerTunnel](https://github.com/krlvm/PowerTunnel)** by @krlvm (for Windows, MacOS and Linux).
 - **[PowerTunnel for Android](https://github.com/krlvm/PowerTunnel-Android)** by @krlvm (for Android).
-- **[SpoofDPI](https://github.com/xvzc/SpoofDPI)** by @xvzc (for macOS and Linux)
 
 # Kudos
 

src/fakepackets.c

@@ -70,19 +70,21 @@ static int send_fake_data(const HANDLE w_filter,
     memcpy(&addr_new, addr, sizeof(WINDIVERT_ADDRESS));
     memcpy(packet_fake, pkt, packetLen);
 
-    addr_new.PseudoTCPChecksum = 0;
+    addr_new.TCPChecksum = 0;
-    addr_new.PseudoIPChecksum = 0;
+    addr_new.IPChecksum = 0;
 
     if (!is_ipv6) {
         // IPv4 TCP Data packet
         if (!WinDivertHelperParsePacket(packet_fake, packetLen, &ppIpHdr,
-            NULL, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen))
+            NULL, NULL, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen,
+            NULL, NULL))
             return 1;
     }
     else {
         // IPv6 TCP Data packet
         if (!WinDivertHelperParsePacket(packet_fake, packetLen, NULL,
-            &ppIpV6Hdr, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen))
+            &ppIpV6Hdr, NULL, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen,
+            NULL, NULL))
             return 1;
     }
 
@@ -126,12 +128,12 @@ static int send_fake_data(const HANDLE w_filter,
         // ...and damage it
         ppTcpHdr->Checksum = htons(ntohs(ppTcpHdr->Checksum) - 1);
     }
-    //printf("Pseudo checksum: %d\n", addr_new.PseudoTCPChecksum);
+    //printf("Pseudo checksum: %d\n", addr_new.TCPChecksum);
 
     WinDivertSend(
         w_filter, packet_fake,
         packetLen_new,
-        &addr_new, NULL
+        NULL, &addr_new
     );
     debug("Fake packet: OK");
 

src/goodbyedpi.c

@@ -23,7 +23,7 @@
 // My mingw installation does not load inet_pton definition for some reason
 WINSOCK_API_LINKAGE INT WSAAPI inet_pton(INT Family, LPCSTR pStringBuf, PVOID pAddr);
 
-#define GOODBYEDPI_VERSION "v0.2.2"
+#define GOODBYEDPI_VERSION "v0.2.1"
 
 #define die() do { sleep(20); exit(EXIT_FAILURE); } while (0)
 
@@ -119,8 +119,8 @@ WINSOCK_API_LINKAGE INT WSAAPI inet_pton(INT Family, LPCSTR pStringBuf, PVOID pA
             } \
             else if (ttl_min_nhops) { \
                 /* If not Auto TTL mode but --min-ttl is set */ \
-                if (!tcp_get_auto_ttl(tcp_conn_info.ttl, 0, 0, ttl_min_nhops, 0)) { \
+                if (tcp_get_auto_ttl(tcp_conn_info.ttl, 0, 0, ttl_min_nhops, 0)) { \
-                    /* Send only if nhops >= min_ttl */ \
+                    /* Send only if nhops > min_ttl */ \
                     should_send_fake = 0; \
                 } \
             } \
@@ -309,6 +309,7 @@ static HANDLE init(char *filter, UINT64 flags) {
 
 static int deinit(HANDLE handle) {
     if (handle) {
+        WinDivertShutdown(handle, WINDIVERT_SHUTDOWN_BOTH);
         WinDivertClose(handle);
         return TRUE;
     }
@@ -415,7 +416,7 @@ static int extract_sni(const char *pktdata, unsigned int pktlen,
                 }
                 /* Validate that hostname has only ascii lowercase characters */
                 for (int i=0; i<hnlen; i++) {
-                    if (!( (hnaddr[i] >= '0' && hnaddr[i] <= '9') ||
+                    if (!( (hnaddr[i] >= '1' && hnaddr[i] <= '9') ||
                          (hnaddr[i] >= 'a' && hnaddr[i] <= 'z') ||
                          hnaddr[i] == '.' || hnaddr[i] == '-'))
                     {
@@ -518,8 +519,8 @@ static void send_native_fragment(HANDLE w_filter, WINDIVERT_ADDRESS addr,
         ppTcpHdr->SeqNum = htonl(ntohl(ppTcpHdr->SeqNum) + fragment_size);
     }
 
-    addr.PseudoIPChecksum = 0;
+    addr.IPChecksum = 0;
-    addr.PseudoTCPChecksum = 0;
+    addr.TCPChecksum = 0;
 
     WinDivertHelperCalcChecksums(
         packet, packetLen, &addr, 0
@@ -527,7 +528,7 @@ static void send_native_fragment(HANDLE w_filter, WINDIVERT_ADDRESS addr,
     WinDivertSend(
         w_filter, packet,
         packetLen,
-        &addr, NULL
+        NULL, &addr
     );
     memcpy(packet, &packet_bak, orig_packetLen);
     //printf("Sent native fragment of %d size (step%d)\n", packetLen, step);
@@ -870,7 +871,7 @@ int main(int argc, char *argv[]) {
                     optarg = argv[optind];
                 if (optarg)
                     max_payload_size = atousi(optarg, "Max payload size parameter error!");
-                else
+                if (!max_payload_size)
                     max_payload_size = 1200;
                 break;
             default:
@@ -929,8 +930,8 @@ int main(int argc, char *argv[]) {
                 " -4          -p -r -s (best speed)"
                 "\n"
                 "Modern modesets (more stable, more compatible, faster):\n"
-                " -5          -f 2 -e 2 --auto-ttl --reverse-frag --max-payload (this is the default)\n"
+                " -5          -f 2 -e 2 --auto-ttl --reverse-frag (this is the default)\n"
-                " -6          -f 2 -e 2 --wrong-seq --reverse-frag --max-payload\n");
+                " -6          -f 2 -e 2 --wrong-seq --reverse-frag\n");
                 exit(EXIT_FAILURE);
         }
     }
@@ -1001,7 +1002,7 @@ int main(int argc, char *argv[]) {
     if (do_native_frag && !(do_fragment_http || do_fragment_https)) {
         puts("\nERROR: Native fragmentation is enabled but fragment sizes are not set.\n"
              "Fragmentation has no effect.");
-        exit(EXIT_FAILURE);
+        die();
     }
 
     if (max_payload_size)
@@ -1038,8 +1039,8 @@ int main(int argc, char *argv[]) {
     signal(SIGINT, sigint_handler);
 
     while (1) {
-        if (WinDivertRecv(w_filter, packet, sizeof(packet), &addr, &packetLen)) {
+        if (WinDivertRecv(w_filter, packet, sizeof(packet), &packetLen, &addr)) {
-            debug("Got %s packet, len=%d!\n", addr.Direction ? "inbound" : "outbound",
+            debug("Got %s packet, len=%d!\n", addr.Outbound ? "outbound" : "inbound",
                    packetLen);
             should_reinject = 1;
             should_recalc_checksum = 0;
@@ -1052,36 +1053,36 @@ int main(int argc, char *argv[]) {
             packet_type = unknown;
 
             // Parse network packet and set it's type
-            if ((packet_v4 = WinDivertHelperParsePacket(packet, packetLen, &ppIpHdr,
+            if (WinDivertHelperParsePacket(packet, packetLen, &ppIpHdr,
-                NULL, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen)))
+                &ppIpV6Hdr, NULL, NULL, NULL, &ppTcpHdr, &ppUdpHdr, &packet_data, &packet_dataLen,
+                NULL, NULL))
             {
+                if (ppIpHdr) {
+                    packet_v4 = 1;
+                    if (ppTcpHdr) {
+                        packet_type = ipv4_tcp;
+                        if (packet_data) {
                             packet_type = ipv4_tcp_data;
                         }
-            else if ((packet_v6 = WinDivertHelperParsePacket(packet, packetLen, NULL,
-                &ppIpV6Hdr, NULL, NULL, &ppTcpHdr, NULL, &packet_data, &packet_dataLen)))
-            {
-                packet_type = ipv6_tcp_data;
                     }
-            else if ((packet_v4 = WinDivertHelperParsePacket(packet, packetLen, &ppIpHdr,
+                    else if (ppUdpHdr && packet_data) {
-                NULL, NULL, NULL, &ppTcpHdr, NULL, NULL, NULL)))
-            {
-                packet_type = ipv4_tcp;
-            }
-            else if ((packet_v6 = WinDivertHelperParsePacket(packet, packetLen, NULL,
-                &ppIpV6Hdr, NULL, NULL, &ppTcpHdr, NULL, NULL, NULL)))
-            {
-                packet_type = ipv6_tcp;
-            }
-            else if ((packet_v4 = WinDivertHelperParsePacket(packet, packetLen, &ppIpHdr,
-                NULL, NULL, NULL, NULL, &ppUdpHdr, &packet_data, &packet_dataLen)))
-            {
                         packet_type = ipv4_udp_data;
                     }
-            else if ((packet_v6 = WinDivertHelperParsePacket(packet, packetLen, NULL,
+                }
-                &ppIpV6Hdr, NULL, NULL, NULL, &ppUdpHdr, &packet_data, &packet_dataLen)))
+
-            {
+                else if (ppIpV6Hdr) {
+                    packet_v6 = 1;
+                    if (ppTcpHdr) {
+                        packet_type = ipv6_tcp;
+                        if (packet_data) {
+                            packet_type = ipv6_tcp_data;
+                        }
+                    }
+                    else if (ppUdpHdr && packet_data) {
                         packet_type = ipv6_udp_data;
                     }
+                }
+            }
 
             debug("packet_type: %d, packet_v4: %d, packet_v6: %d\n", packet_type, packet_v4, packet_v6);
 
@@ -1090,7 +1091,7 @@ int main(int argc, char *argv[]) {
                 /* Got a TCP packet WITH DATA */
 
                 /* Handle INBOUND packet with data and find HTTP REDIRECT in there */
-                if (addr.Direction == WINDIVERT_DIRECTION_INBOUND && packet_dataLen > 16) {
+                if (!addr.Outbound && packet_dataLen > 16) {
                     /* If INBOUND packet with DATA (tcp.Ack) */
 
                     /* Drop packets from filter with HTTP 30x Redirect */
@@ -1114,7 +1115,7 @@ int main(int argc, char *argv[]) {
                 /* Handle OUTBOUND packet on port 443, search for something that resembles
                  * TLS handshake, send fake request.
                  */
-                else if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND &&
+                else if (addr.Outbound &&
                         ((do_fragment_https ? packet_dataLen == https_fragment_size : 0) ||
                          packet_dataLen > 16) &&
                          ppTcpHdr->DstPort != htons(80) &&
@@ -1158,7 +1159,7 @@ int main(int argc, char *argv[]) {
                     }
                 }
                 /* Handle OUTBOUND packet on port 80, search for Host header */
-                else if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND && 
+                else if (addr.Outbound && 
                         packet_dataLen > 16 &&
                         (do_http_allports ? 1 : (ppTcpHdr->DstPort == htons(80))) &&
                         find_http_method_end(packet_data,
@@ -1302,7 +1303,7 @@ int main(int argc, char *argv[]) {
             /* Else if we got TCP packet without data */
             else if (packet_type == ipv4_tcp || packet_type == ipv6_tcp) {
                 /* If we got INBOUND SYN+ACK packet */
-                if (addr.Direction == WINDIVERT_DIRECTION_INBOUND &&
+                if (!addr.Outbound &&
                     ppTcpHdr->Syn == 1 && ppTcpHdr->Ack == 1) {
                     //printf("Changing Window Size!\n");
                     /*
@@ -1342,7 +1343,7 @@ int main(int argc, char *argv[]) {
             else if ((do_dnsv4_redirect && (packet_type == ipv4_udp_data)) ||
                      (do_dnsv6_redirect && (packet_type == ipv6_udp_data)))
             {
-                if (addr.Direction == WINDIVERT_DIRECTION_INBOUND) {
+                if (!addr.Outbound) {
                     if ((packet_v4 && dns_handle_incoming(&ppIpHdr->DstAddr, ppUdpHdr->DstPort,
                                         packet_data, packet_dataLen,
                                         &dns_conn_info, 0))
@@ -1372,7 +1373,7 @@ int main(int argc, char *argv[]) {
                     }
                 }
 
-                else if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND) {
+                else if (addr.Outbound) {
                     if ((packet_v4 && dns_handle_outgoing(&ppIpHdr->SrcAddr, ppUdpHdr->SrcPort,
                                         &ppIpHdr->DstAddr, ppUdpHdr->DstPort,
                                         packet_data, packet_dataLen, 0))
@@ -1410,7 +1411,7 @@ int main(int argc, char *argv[]) {
                 if (should_recalc_checksum) {
                     WinDivertHelperCalcChecksums(packet, packetLen, &addr, (UINT64)0LL);
                 }
-                WinDivertSend(w_filter, packet, packetLen, &addr, NULL);
+                WinDivertSend(w_filter, packet, packetLen, NULL, &addr);
             }
         }
         else {

src/service.c

@@ -30,7 +30,7 @@ int service_register(int argc, char *argv[])
      */
     if (!service_argc && !service_argv) {
         service_argc = argc;
-        service_argv = calloc((size_t)(argc + 1), sizeof(void*));
+        service_argv = malloc(sizeof(void*) * (size_t)argc);
         for (i = 0; i < argc; i++) {
             service_argv[i] = strdup(argv[i]);
         }