Skip to content

Commit

Permalink
--allow-no-sni option. Useful with --blacklist and undetectable SNI.
Browse files Browse the repository at this point in the history 
This option is added specially for protonmail.com, as it sends
low Window Size in SYN-ACK for requests from Russia, to force
the client to fragment the packet. GoodbyeDPI doesn't do reassembling
and can't extract SNI in this case, thus won't circumvent the
censorship if --blacklist option is used.
  • Loading branch information
@ValdikSS
ValdikSS committed Dec 29, 2021
1 parent 7f59593 commit cc1676a
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 11 deletions.
1 change: 1 addition & 0 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ Usage: goodbyedpi.exe [OPTION...]
--blacklist <txtfile> perform circumvention tricks only to host names and subdomains from
supplied text file (HTTP Host/TLS SNI).
This option can be supplied multiple times.
--allow-no-sni perform circumvention if TLS SNI can't be detected with --blacklist enabled.
--set-ttl <value> activate Fake Request Mode and send it with supplied TTL value.
DANGEROUS! May break websites in unexpected ways. Use with care.
--auto-ttl [a1-a2-m] activate Fake Request Mode, automatically detect TTL and decrease
Expand Down
37 changes: 26 additions & 11 deletions src/goodbyedpi.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,7 @@ static struct option long_options[] = {
{"dnsv6-port", required_argument, 0, '@' },
{"dns-verb", no_argument, 0, 'v' },
{"blacklist", required_argument, 0, 'b' },
{"allow-no-sni",no_argument, 0, ']' },
{"ip-id", required_argument, 0, 'i' },
{"set-ttl", required_argument, 0, '$' },
{"min-ttl", required_argument, 0, '[' },
Expand Down Expand Up @@ -523,6 +524,7 @@ int main(int argc, char *argv[]) {
ipv6_tcp, ipv6_tcp_data, ipv6_udp_data
} packet_type;
int i, should_reinject, should_recalc_checksum = 0;
int sni_ok = 0;
int opt;
int packet_v4, packet_v6;
HANDLE w_filter = NULL;
Expand All @@ -547,6 +549,7 @@ int main(int argc, char *argv[]) {
do_host_mixedcase = 0,
do_dnsv4_redirect = 0, do_dnsv6_redirect = 0,
do_dns_verb = 0, do_tcp_verb = 0, do_blacklist = 0,
do_allow_no_sni = 0,
do_fake_packet = 0,
do_auto_ttl = 0,
do_wrong_chksum = 0,
Expand Down Expand Up @@ -778,6 +781,9 @@ int main(int argc, char *argv[]) {
exit(EXIT_FAILURE);
}
break;
case ']': // --allow-no-sni
do_allow_no_sni = 1;
break;
case '$': // --set-ttl
do_fake_packet = 1;
ttl_of_fake_packet = atoub(optarg, "Set TTL parameter error!");
Expand Down Expand Up @@ -861,6 +867,7 @@ int main(int argc, char *argv[]) {
" --blacklist <txtfile> perform circumvention tricks only to host names and subdomains from\n"
" supplied text file (HTTP Host/TLS SNI).\n"
" This option can be supplied multiple times.\n"
" --allow-no-sni perform circumvention if TLS SNI can't be detected with --blacklist enabled.\n"
" --set-ttl <value> activate Fake Request Mode and send it with supplied TTL value.\n"
" DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).\n"
" --auto-ttl [a1-a2-m] activate Fake Request Mode, automatically detect TTL and decrease\n"
Expand Down Expand Up @@ -925,9 +932,10 @@ int main(int argc, char *argv[]) {
"HTTP Persistent Nowait: %d\n" /* 12 */
"DNS redirect: %d\n" /* 13 */
"DNSv6 redirect: %d\n" /* 14 */
"Fake requests, TTL: %s (fixed: %hu, auto: %hu-%hu-%hu, min distance: %hu)\n" /* 15 */
"Fake requests, wrong checksum: %d\n" /* 16 */
"Fake requests, wrong SEQ/ACK: %d\n", /* 17 */
"Allow missing SNI: %d\n" /* 15 */
"Fake requests, TTL: %s (fixed: %hu, auto: %hu-%hu-%hu, min distance: %hu)\n" /* 16 */
"Fake requests, wrong checksum: %d\n" /* 17 */
"Fake requests, wrong SEQ/ACK: %d\n", /* 18 */
do_passivedpi, /* 1 */
(do_fragment_http ? http_fragment_size : 0), /* 2 */
(do_fragment_http_persistent ? http_fragment_size : 0),/* 3 */
Expand All @@ -942,11 +950,12 @@ int main(int argc, char *argv[]) {
do_fragment_http_persistent_nowait, /* 12 */
do_dnsv4_redirect, /* 13 */
do_dnsv6_redirect, /* 14 */
ttl_of_fake_packet ? "fixed" : (do_auto_ttl ? "auto" : "disabled"), /* 15 */
do_allow_no_sni, /* 15 */
ttl_of_fake_packet ? "fixed" : (do_auto_ttl ? "auto" : "disabled"), /* 16 */
ttl_of_fake_packet, do_auto_ttl ? auto_ttl_1 : 0, do_auto_ttl ? auto_ttl_2 : 0,
do_auto_ttl ? auto_ttl_max : 0, ttl_min_nhops,
do_wrong_chksum, /* 16 */
do_wrong_seq /* 17 */
do_wrong_chksum, /* 17 */
do_wrong_seq /* 18 */
);

if (do_fragment_http && http_fragment_size > 2 && !do_native_frag) {
Expand Down Expand Up @@ -1083,11 +1092,17 @@ int main(int argc, char *argv[]) {
if ((packet_dataLen == 2 && memcmp(packet_data, "\x16\x03", 2) == 0) ||
(packet_dataLen >= 3 && memcmp(packet_data, "\x16\x03\x01", 3) == 0))
{
if (do_blacklist
? (extract_sni(packet_data, packet_dataLen,
&host_addr, &host_len) &&
blackwhitelist_check_hostname(host_addr, host_len))
: 1)
if (do_blacklist) {
sni_ok = extract_sni(packet_data, packet_dataLen,
&host_addr, &host_len);
}
if (
(do_blacklist && sni_ok &&
blackwhitelist_check_hostname(host_addr, host_len)
) ||
(do_blacklist && !sni_ok && do_allow_no_sni) ||
(!do_blacklist)
)
{
#ifdef DEBUG
char lsni[HOST_MAXLEN + 1] = {0};
Expand Down

0 comments on commit cc1676a

Please sign in to comment.