GoodbyeDPI

Commit Graph

Author	SHA1	Message	Date
ValdikSS	d7c681d1a2	Add Max Payload Size limit option (`--max-payload-size`) This option excludes TCP packets with the data payload larger than defined value from being copied by WinDivert driver to GoodbyeDPI. As most of HTTP and TLS ClientHello packets are repatively small, and file transfers are usually big and are sent/received using the whole available MTU/MSS, we can just exclude them from being processed by our userspace program to reduce unnecessary CPU load.	3 years ago
ValdikSS	cc1676ad92	--allow-no-sni option. Useful with --blacklist and undetectable SNI. This option is added specially for protonmail.com, as it sends low Window Size in SYN-ACK for requests from Russia, to force the client to fragment the packet. GoodbyeDPI doesn't do reassembling and can't extract SNI in this case, thus won't circumvent the censorship if --blacklist option is used.	3 years ago
ValdikSS	7f59593a28	Check TLS Handshake ClientHello byte if packet length is enough	3 years ago
ValdikSS	372cc6a45d	Properly handle Native Fragmentation packet of bigger or equal size than the fragment size	3 years ago
ValdikSS	46c4f36de8	Add Fake Packet maximum TTL limit to Auto TTL mode This patchset adds maximum TTL size of the fake packet to be sent, to further improve compatibility with asymmertic routing and non-standard TTL value set on servers.	3 years ago
ValdikSS	8911e459d8	Exit when native fragmentation is enabled but http/https values are not set	3 years ago
ValdikSS	f4edcf7b4f	Small text output enhancements	3 years ago
ValdikSS	bb8bafb663	Add Auto TTL range adjustment, introduce min-ttl and use it for --set-ttl as well.	3 years ago
ValdikSS	e25d7432de	Better Auto TTL adjusting algorithm which honors short distance Say you set --auto-ttl to 4. If the TTL distance to the destination host is too short, say 6, auto-ttl would decrease it by 4 and send a fake packet with TTL 2, which is too low for the packet to travel via DPI system. But if you set --auto-ttl to a lower value such as 2, that may introduce issues over long lines where outgoing-path TTL and incoming-path TTL may have difference more than 2 hops due to higher chance of assymetric routing along the path. To solve this issue, this commit introduce auto-ttl range of two values. If the incoming TTL distance is more than autottl2, it is subtracted by autottl2 value. If the distance is less than autottl2, the distance value is used as a normalized weigth of [autottl1; autottl2] scale. The simplified formula is as follows: 128 > extracted_ttl > 98: // Server is running Windows nhops = 128 - extracted_ttl 64 > extracted_ttl > 34: // Server is running Linux/FreeBSD/other nhops = 64 - extracted_ttl if (nhops - autottl2 < autottl2) ttl_of_fake_packet = nhops - autottl1 - trunc((autottl2 - autottl1) * ((float)nhops/10)); else ttl_of_fake_packet = nhops - autottl2	3 years ago
ValdikSS	67c226dc7c	Fix all types and warnings	3 years ago
ValdikSS	6eec99e874	GoodbyeDPI v0.1.8	3 years ago
ValdikSS	fc15088c33	Fix spelling	3 years ago
ValdikSS	1ea70f9bc9	Do not print "Error receiving packet!" upon exiting	3 years ago
ValdikSS	ed42c5d627	Fix all the warnings and notes	3 years ago
ValdikSS	9fcf097cb7	Use Auto TTL = 4 by default Previous value of 2 caused issues with the services connected via very different uplink/downlink routing links.	3 years ago
ValdikSS	a5c2f9fac9	Introduce -5 and -6 modes and make -5 default Modern modesets (more stable, more compatible, faster): -5 -f 2 -e 2 --auto-ttl --reverse-frag (this is the default now) -6 -f 2 -e 2 --wrong-seq --reverse-frag	3 years ago
ValdikSS	11c322aaed	Show fragmentation value issues only when Window Size is used	3 years ago
ValdikSS	b45b463d51	Update readme	3 years ago
ValdikSS	80fcd9c5cf	Replace required/optional brackets in the readme	3 years ago
ValdikSS	21ff80b43c	Automatic TTL value picker for --set-ttl Fake Packet mode This is a per-connection (per-destination) automatic TTL adjusting feature. Basically a --set-ttl mode where you don't need to set specific TTL value. It works as follows: 1. All incoming SYN/ACKs (the response to client's SYN) are intercepted 2. TTL value is extracted from SYN/ACK 3. New TTL is calculated with the simple formula: 128 > extracted_ttl > 64: // Server is running Windows fakepacket_ttl = 128 - extracted_ttl - decrement 64 > extracted_ttl > 34: // Server is running Linux/FreeBSD/other fakepacket_ttl = 64 - extracted_ttl - decrement 4. Fake packet is sent To comply with the multi-path multi-hop server connections where 1 hop dispersion is not rare, decrement should be at least of value "2", which is the default. The patch does not process "too strange" TTL values (bigger than 128, less than 34).	3 years ago
ValdikSS	bbb6af89fe	New Fake Packet circumvention method: wrong SEQ/ACK numbers This method sends Fake Packet with the TCP SEQ/ACK numbers "in the past": -66000 is used for ACK (right out of the ACK permissive window in Linux stack), -10000 is used for SEQ (without any reasoning). This method is pretty effective in Russia. It also could be handy in a networks which prohibit changing TTL values (mobile networks with tethering block/premium feature).	3 years ago
ValdikSS	b9682ac222	Print parsed hostnames in DEBUG mode	3 years ago
ValdikSS	35c6e401db	Handle TLS SNI in blacklist option Now blacklist applies not only to HTTP websites, but also to HTTPS. Fixes #213	3 years ago
ValdikSS	cf7d1c69e0	Add TLS Server Name Indication (SNI) extractor	3 years ago
ValdikSS	7d50748e2e	GoodbyeDPI version 0.1.7	3 years ago
ValdikSS	e28cb52645	Send native-fragged fragments in the reversed order Some websites (or more precisely, TLS terminators/balancers) can't handle segmented TLS ClientHello packet properly, requiring the whole ClientHello in a single segment, otherwise the connection gets dropped. However they still operate with a proper TCP stack. Cheat on them: send the latter segment first (with TCP SEQ "in the future"), the former segment second (with "current" SEQ), allowing OS TCP stack to combine it in a single TCP read(). This fixes long-standing number of TCP fragmentation issues: Fixes #4, #158, #224, #59, #192 and many others.	3 years ago
ValdikSS	e3638786da	Add Native Fragmentation support (without window size) This patch adds `--native-frag` option for userspace TCP segmentation (packet splitting), without shrinking TCP Window Size in SYN/ACK. Compared to Window Size shrinking, this method does not require waiting for ACK, which saves two RTTs. This is preferrable method of operation since it has no cons. It's faster and easier to handle in the software.	3 years ago
ValdikSS	ad60d30caa	Fix fake packet handling without other modifying parameters Fixes #150	3 years ago
ValdikSS	b5d75a6c8e	Version v0.1.6	6 years ago
ValdikSS	f2de8fce8d	Fake Request Mode	6 years ago
KOLANICH	ff4c11a6eb	Integers fixes (with small modifications), closes #84 Signed-off-by: ValdikSS <[email protected]>	7 years ago
ValdikSS	1c7fe5f843	Use newlines for current options information	6 years ago
ValdikSS	46db057662	Add version number into greeting message	6 years ago
ValdikSS	c4d0ba1297	Skip impostor and loopback packets. Fixes #53 .	7 years ago
ValdikSS	a028cb01f4	WinDivert 1.4 support	7 years ago
ValdikSS	38b1ff1a92	Fix -f and -e options	7 years ago
ValdikSS	50e70ace76	Handle HTTP redirects within IPv6 Flow Label = 0x00 packets	7 years ago
ValdikSS	135c97ae69	Move program source code to src directory	7 years ago
ValdikSS	860f483ac3	IPv6 DNS redirection	7 years ago
ValdikSS	3d36127f5b	Handle IPv6 packets and prepare for IPv6 DNS redirection	7 years ago
ValdikSS	aa28d3e12a	Make sure to search DLLs only in safe path, not in current working dir	7 years ago
ValdikSS	cc770d302c	Add GoodbyeDPI Github link to the welcome message.	7 years ago
ValdikSS	2e23d93762	New option: --ip-id. Handles additional IP ID numbers of passive DPI.	7 years ago
ValdikSS	14ae107b53	Handle only IP IDs in [0x0; 0xF] (or→and)	7 years ago
ValdikSS	1bdfbb8c45	Move active filter template and passive filter to defines	7 years ago
ValdikSS	5eddb5f18a	Fix crash on error (free→LocalFree) and print KB3033929 message	7 years ago
ValdikSS	8e7f4ff505	Properly exclude Teredo	7 years ago
ValdikSS	bb8fc64f18	Handle ip.id up to 0xF. Some DPI send several TCP RST or HTTP redirection packets with increasing IP ID number. Handle them all.	7 years ago
ValdikSS	490525387d	Remove unused string	7 years ago
ValdikSS	5e9e1f0eb6	Preliminary IPv6 support. No IPv6 support in DNS redirection code. IPv6 DNS request packets would be dropped.	7 years ago

39 Commits (d7c681d1a249f2ebe2fe9dc2e08a2da5f1fd8fc7)