tpws/params.h

@@ -13,8 +13,8 @@
 #define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
 #define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
 
-enum httpreqpos { httpreqpos_none = 0, httpreqpos_method, httpreqpos_host };
-enum tlspos { tlspos_none = 0, tlspos_sni, tlspos_sniext, tlspos_pos };
+enum splithttpreq { split_none = 0, split_method, split_host };
+enum tlsrec { tlsrec_none = 0, tlsrec_sni, tlsrec_pos };
 enum bindll { unwanted=0, no, prefer, force };
 
 #define MAX_BINDS	32
@@ -47,10 +47,9 @@ struct params_s
 	bool hostcase, hostdot, hosttab, hostnospace, methodspace, methodeol, unixeol, domcase;
 	int hostpad;
 	char hostspell[4];
-	enum httpreqpos split_http_req;
-	enum tlspos tlsrec;
+	enum splithttpreq split_http_req;
+	enum tlsrec tlsrec;
 	int tlsrec_pos;
-	enum tlspos split_tls;
 	bool split_any_protocol;
 	int split_pos;
 	bool disorder, disorder_http, disorder_tls;

tpws/tamper.c

@@ -9,7 +9,7 @@
 #include <stdio.h>
 
 // pHost points to "Host: ..."
-static bool find_host(uint8_t **pHost,uint8_t *buf,size_t bs)
+bool find_host(uint8_t **pHost,uint8_t *buf,size_t bs)
 {
 	if (!*pHost)
 	{
@@ -23,24 +23,6 @@ static bool find_host(uint8_t **pHost,uint8_t *buf,size_t bs)
 	return !!*pHost;
 }
 
-static size_t tls_pos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type)
-{
-	size_t elen;
-	const uint8_t *ext;
-	switch(tpos_type)
-	{
-		case tlspos_sni:
-		case tlspos_sniext:
-			if (TLSFindExt(tls,sz,0,&ext,&elen,false))
-				return (tpos_type==tlspos_sni) ? ext-tls+6 : ext-tls+1;
-			// fall through
-		case tlspos_pos:
-			return tpos_pos;
-	}
-	return 0;
-}
-
-
 static const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
 // segment buffer has at least 5 extra bytes to extend data block
 void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,size_t *size, size_t *split_pos, uint8_t *split_flags)
@@ -218,10 +200,10 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
 			}
 			switch (params.split_http_req)
 			{
-				case httpreqpos_method:
+				case split_method:
 					*split_pos = method_len - 1 + params.methodeol + (params.methodeol && !params.unixeol);
 					break;
-				case httpreqpos_host:
+				case split_host:
 					if (find_host(&pHost,segment,*size))
 						*split_pos = pHost + 6 - bRemovedHostSpace - segment;
 					break;
@@ -238,7 +220,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
 	}
 	else if (IsTLSClientHello(segment,*size,false))
 	{
-		size_t tpos=0,spos=0;
+		size_t tpos=0,elen;
 		const uint8_t *ext;
 		
 		if (!ctrack->l7proto) ctrack->l7proto=TLS;
@@ -257,38 +239,39 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
 		}
 		else
 		{
-			spos = tls_pos(params.split_tls, params.split_pos, segment, *size, 0);
-
-			if ((5+*size)<=segment_buffer_size)
+			switch(params.tlsrec)
 			{
-				tpos = tls_pos(params.tlsrec, params.tlsrec_pos+5, segment, *size, 0);
-				if (tpos>5)
+				case tlsrec_sni:
+					if (TLSFindExt(segment,*size,0,&ext,&elen,false))
+						tpos = ext-segment+1; // between typical 1st and 2nd char of hostname
+					break;
+				case tlsrec_pos:
+					tpos = params.tlsrec_pos;
+					break;
+				default:
+					break;
+			}
+			if (tpos && (5+*size)<=segment_buffer_size)
+			{
+				// construct 2 TLS records from one
+				uint16_t l = pntoh16(segment+3); // length
+				if (l>=2)
 				{
-					// construct 2 TLS records from one
-					uint16_t l = pntoh16(segment+3); // length
-					if (l>=2)
-					{
-						// length is checked in IsTLSClientHello and cannot exceed buffer size
-						if ((tpos-5)>=l) tpos=5+1;
-						VPRINT("making 2 TLS records at pos %zu",tpos)
-						memmove(segment+tpos+5,segment+tpos,*size-tpos);
-						segment[tpos] = segment[0];
-						segment[tpos+1] = segment[1];
-						segment[tpos+2] = segment[2];
-						phton16(segment+tpos+3,l-(tpos-5));
-						phton16(segment+3,tpos-5);
-						*size += 5;
-						// split pos present and it is not before tlsrec split. increase split pos by tlsrec header size (5 bytes)
-						if (spos && spos>=tpos) spos+=5;
-					}
+					// length is checked in IsTLSClientHello and cannot exceed buffer size
+					if (tpos>=l) tpos=1;
+					VPRINT("making 2 TLS records at pos %zu",tpos)
+					memmove(segment+5+tpos+5,segment+5+tpos,*size-(5+tpos));
+					segment[5+tpos] = segment[0];
+					segment[5+tpos+1] = segment[1];
+					segment[5+tpos+2] = segment[2];
+					phton16(segment+5+tpos+3,l-tpos);
+					phton16(segment+3,tpos);
+					*size += 5;
 				}
 			}
 		
-			if (spos && spos < *size)
-			{
-				VPRINT("split pos %zu",spos);
-				*split_pos = spos;
-			}
+			if (params.split_pos < *size)
+				*split_pos = params.split_pos;
 
 			if (params.disorder_tls) *split_flags |= SPLIT_FLAG_DISORDER;
 			if (params.oob_tls) *split_flags |= SPLIT_FLAG_OOB;

tpws/tpws.c

@@ -172,8 +172,7 @@ static void exithelp(void)
 		" --hostlist-auto-debug=<logfile>\t; debug auto hostlist positives\n"
 		"\nTAMPER:\n"
 		" --split-http-req=method|host\t\t; split at specified logical part of plain http request\n"
-		" --split-tls=sni|sniext\t\t\t; split at specified logical part of TLS ClientHello\n"
-		" --split-pos=<numeric_offset>\t\t; split at specified pos. split-http-req or split-tls take precedence for http.\n"
+		" --split-pos=<numeric_offset>\t\t; split at specified pos. split-http-req takes precedence for http.\n"
 		" --split-any-protocol\t\t\t; split not only http and https\n"
 #if defined(BSD) && !defined(__APPLE__)
 		" --disorder[=http|tls]\t\t\t; when splitting simulate sending second fragment first (BSD sends entire message instead of first fragment, this is not good)\n"
@@ -192,7 +191,7 @@ static void exithelp(void)
 		" --methodspace\t\t\t\t; add extra space after method\n"
 		" --methodeol\t\t\t\t; add end-of-line before method\n"
 		" --unixeol\t\t\t\t; replace 0D0A to 0A\n"
-		" --tlsrec=sni|sniext\t\t\t; make 2 TLS records. split at specified logical part. don't split if SNI is not present\n"
+		" --tlsrec=sni\t\t\t\t; make 2 TLS records. split at SNI. don't split if SNI is not present\n"
 		" --tlsrec-pos=<pos>\t\t\t; make 2 TLS records. split at specified pos\n"
 #ifdef __linux__
 		" --mss=<int>\t\t\t\t; set client MSS. forces server to split messages but significantly decreases speed !\n"
@@ -254,28 +253,6 @@ void save_default_ttl(void)
 	}
 }
 
-bool parse_httpreqpos(const char *s, enum httpreqpos *pos)
-{
-	if (!strcmp(s, "method"))
-		*pos = httpreqpos_method;
-	else if (!strcmp(s, "host"))
-		*pos = httpreqpos_host;
-	else
-		return false;
-	return true;
-}
-bool parse_tlspos(const char *s, enum tlspos *pos)
-{
-	if (!strcmp(s, "sni"))
-		*pos = tlspos_sni;
-	else if (!strcmp(s, "sniext"))
-		*pos = tlspos_sniext;
-	else
-		return false;
-	return true;
-}
-
-
 void parse_params(int argc, char *argv[])
 {
 	int option_index = 0;
@@ -325,41 +302,40 @@ void parse_params(int argc, char *argv[])
 		{ "hostpad",required_argument,0,0 },// optidx=21
 		{ "domcase",no_argument,0,0 },// optidx=22
 		{ "split-http-req",required_argument,0,0 },// optidx=23
-		{ "split-tls",required_argument,0,0 },// optidx=24
-		{ "split-pos",required_argument,0,0 },// optidx=25
-		{ "split-any-protocol",optional_argument,0,0},// optidx=26
-		{ "disorder",optional_argument,0,0 },// optidx=27
-		{ "oob",optional_argument,0,0 },// optidx=28
-		{ "oob-data",required_argument,0,0 },// optidx=29
-		{ "methodspace",no_argument,0,0 },// optidx=30
-		{ "methodeol",no_argument,0,0 },// optidx=31
-		{ "hosttab",no_argument,0,0 },// optidx=32
-		{ "unixeol",no_argument,0,0 },// optidx=33
-		{ "tlsrec",required_argument,0,0 },// optidx=34
-		{ "tlsrec-pos",required_argument,0,0 },// optidx=35
-		{ "hostlist",required_argument,0,0 },// optidx=36
-		{ "hostlist-exclude",required_argument,0,0 },// optidx=37
-		{ "hostlist-auto",required_argument,0,0}, // optidx=38
-		{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=39
-		{ "hostlist-auto-fail-time",required_argument,0,0},	// optidx=40
-		{ "hostlist-auto-debug",required_argument,0,0}, // optidx=41
-		{ "pidfile",required_argument,0,0 },// optidx=42
-		{ "debug",optional_argument,0,0 },// optidx=43
-		{ "local-rcvbuf",required_argument,0,0 },// optidx=44
-		{ "local-sndbuf",required_argument,0,0 },// optidx=45
-		{ "remote-rcvbuf",required_argument,0,0 },// optidx=46
-		{ "remote-sndbuf",required_argument,0,0 },// optidx=47
-		{ "socks",no_argument,0,0 },// optidx=48
-		{ "no-resolve",no_argument,0,0 },// optidx=49
-		{ "resolver-threads",required_argument,0,0 },// optidx=50
-		{ "skip-nodelay",no_argument,0,0 },// optidx=51
-		{ "tamper-start",required_argument,0,0 },// optidx=52
-		{ "tamper-cutoff",required_argument,0,0 },// optidx=53
+		{ "split-pos",required_argument,0,0 },// optidx=24
+		{ "split-any-protocol",optional_argument,0,0},// optidx=25
+		{ "disorder",optional_argument,0,0 },// optidx=26
+		{ "oob",optional_argument,0,0 },// optidx=27
+		{ "oob-data",required_argument,0,0 },// optidx=28
+		{ "methodspace",no_argument,0,0 },// optidx=29
+		{ "methodeol",no_argument,0,0 },// optidx=30
+		{ "hosttab",no_argument,0,0 },// optidx=31
+		{ "unixeol",no_argument,0,0 },// optidx=32
+		{ "tlsrec",required_argument,0,0 },// optidx=33
+		{ "tlsrec-pos",required_argument,0,0 },// optidx=34
+		{ "hostlist",required_argument,0,0 },// optidx=35
+		{ "hostlist-exclude",required_argument,0,0 },// optidx=36
+		{ "hostlist-auto",required_argument,0,0}, // optidx=37
+		{ "hostlist-auto-fail-threshold",required_argument,0,0}, // optidx=38
+		{ "hostlist-auto-fail-time",required_argument,0,0},	// optidx=39
+		{ "hostlist-auto-debug",required_argument,0,0}, // optidx=40
+		{ "pidfile",required_argument,0,0 },// optidx=41
+		{ "debug",optional_argument,0,0 },// optidx=42
+		{ "local-rcvbuf",required_argument,0,0 },// optidx=43
+		{ "local-sndbuf",required_argument,0,0 },// optidx=44
+		{ "remote-rcvbuf",required_argument,0,0 },// optidx=45
+		{ "remote-sndbuf",required_argument,0,0 },// optidx=46
+		{ "socks",no_argument,0,0 },// optidx=47
+		{ "no-resolve",no_argument,0,0 },// optidx=48
+		{ "resolver-threads",required_argument,0,0 },// optidx=49
+		{ "skip-nodelay",no_argument,0,0 },// optidx=50
+		{ "tamper-start",required_argument,0,0 },// optidx=51
+		{ "tamper-cutoff",required_argument,0,0 },// optidx=52
 #if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
-		{ "enable-pf",no_argument,0,0 },// optidx=54
+		{ "enable-pf",no_argument,0,0 },// optidx=53
 #elif defined(__linux__)
-		{ "mss",required_argument,0,0 },// optidx=54
-		{ "mss-pf",required_argument,0,0 },// optidx=55
+		{ "mss",required_argument,0,0 },// optidx=53
+		{ "mss-pf",required_argument,0,0 },// optidx=54
 #ifdef SPLICE_PRESENT
 		{ "nosplice",no_argument,0,0 },// optidx=55
 #endif
@@ -522,22 +498,18 @@ void parse_params(int argc, char *argv[])
 			params.tamper = true;
 			break;
 		case 23: /* split-http-req */
-			if (!parse_httpreqpos(optarg, &params.split_http_req))
+			if (!strcmp(optarg, "method"))
+				params.split_http_req = split_method;
+			else if (!strcmp(optarg, "host"))
+				params.split_http_req = split_host;
+			else
 			{
 				fprintf(stderr, "Invalid argument for split-http-req\n");
 				exit_clean(1);
 			}
 			params.tamper = true;
 			break;
-		case 24: /* split-tls */
-			if (!parse_tlspos(optarg, &params.split_tls))
-			{
-				fprintf(stderr, "Invalid argument for split-tls\n");
-				exit_clean(1);
-			}
-			params.tamper = true;
-			break;
-		case 25: /* split-pos */
+		case 24: /* split-pos */
 			i = atoi(optarg);
 			if (i>0)
 				params.split_pos = i;
@@ -548,10 +520,10 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 26: /* split-any-protocol */
+		case 25: /* split-any-protocol */
 			params.split_any_protocol = true;
 			break;
-		case 27: /* disorder */
+		case 26: /* disorder */
 			if (optarg)
 			{
 				if (!strcmp(optarg,"http")) params.disorder_http=true;
@@ -566,7 +538,7 @@ void parse_params(int argc, char *argv[])
 				params.disorder = true;
 			save_default_ttl();
 			break;
-		case 28: /* oob */
+		case 27: /* oob */
 			if (optarg)
 			{
 				if (!strcmp(optarg,"http")) params.oob_http=true;
@@ -580,7 +552,7 @@ void parse_params(int argc, char *argv[])
 			else
 				params.oob = true;
 			break;
-		case 29: /* oob-data */
+		case 28: /* oob-data */
 			{
 				size_t l = strlen(optarg);
 				unsigned int bt;
@@ -593,33 +565,35 @@ void parse_params(int argc, char *argv[])
 				else params.oob_byte = (uint8_t)bt;
 			}
 			break;
-		case 30: /* methodspace */
+		case 29: /* methodspace */
 			params.methodspace = true;
 			params.tamper = true;
 			break;
-		case 31: /* methodeol */
+		case 30: /* methodeol */
 			params.methodeol = true;
 			params.tamper = true;
 			break;
-		case 32: /* hosttab */
+		case 31: /* hosttab */
 			params.hosttab = true;
 			params.tamper = true;
 			break;
-		case 33: /* unixeol */
+		case 32: /* unixeol */
 			params.unixeol = true;
 			params.tamper = true;
 			break;
-		case 34: /* tlsrec */
-			if (!parse_tlspos(optarg, &params.tlsrec))
+		case 33: /* tlsrec */
+			if (!strcmp(optarg, "sni"))
+				params.tlsrec = tlsrec_sni;
+			else
 			{
 				fprintf(stderr, "Invalid argument for tlsrec\n");
 				exit_clean(1);
 			}
 			params.tamper = true;
 			break;
-		case 35: /* tlsrec-pos */
+		case 34: /* tlsrec-pos */
 			if ((params.tlsrec_pos = atoi(optarg))>0)
-				params.tlsrec = tlspos_pos;
+				params.tlsrec = tlsrec_pos;
 			else
 			{
 				fprintf(stderr, "Invalid argument for tlsrec-pos\n");
@@ -627,7 +601,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 36: /* hostlist */
+		case 35: /* hostlist */
 			if (!strlist_add(&params.hostlist_files, optarg))
 			{
 				fprintf(stderr, "strlist_add failed\n");
@@ -635,7 +609,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 37: /* hostlist-exclude */
+		case 36: /* hostlist-exclude */
 			if (!strlist_add(&params.hostlist_exclude_files, optarg))
 			{
 				fprintf(stderr, "strlist_add failed\n");
@@ -643,7 +617,7 @@ void parse_params(int argc, char *argv[])
 			}
 			params.tamper = true;
 			break;
-		case 38: /* hostlist-auto */
+		case 37: /* hostlist-auto */
 			if (*params.hostlist_auto_filename)
 			{
 				fprintf(stderr, "only one auto hostlist is supported\n");
@@ -675,7 +649,7 @@ void parse_params(int argc, char *argv[])
 			params.hostlist_auto_filename[sizeof(params.hostlist_auto_filename) - 1] = '\0';
 			params.tamper = true; // need to detect blocks and update autohostlist. cannot just slice.
 			break;
-		case 39: /* hostlist-auto-fail-threshold */
+		case 38: /* hostlist-auto-fail-threshold */
 			params.hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
 			if (params.hostlist_auto_fail_threshold<1 || params.hostlist_auto_fail_threshold>20)
 			{
@@ -683,7 +657,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 40: /* hostlist-auto-fail-time */
+		case 39: /* hostlist-auto-fail-time */
 			params.hostlist_auto_fail_time = (uint8_t)atoi(optarg);
 			if (params.hostlist_auto_fail_time<1)
 			{
@@ -691,7 +665,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 41: /* hostlist-auto-debug */
+		case 40: /* hostlist-auto-debug */
 			{
 				FILE *F = fopen(optarg,"a+t");
 				if (!F)
@@ -706,48 +680,48 @@ void parse_params(int argc, char *argv[])
 				params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
 			}
 			break;
-		case 42: /* pidfile */
+		case 41: /* pidfile */
 			strncpy(params.pidfile,optarg,sizeof(params.pidfile));
 			params.pidfile[sizeof(params.pidfile)-1]='\0';
 			break;
-		case 43:
+		case 42:
 			params.debug = optarg ? atoi(optarg) : 1;
 			break;
-		case 44: /* local-rcvbuf */
+		case 43: /* local-rcvbuf */
 #ifdef __linux__
 			params.local_rcvbuf = atoi(optarg)/2;
 #else
 			params.local_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 45: /* local-sndbuf */
+		case 44: /* local-sndbuf */
 #ifdef __linux__
 			params.local_sndbuf = atoi(optarg)/2;
 #else
 			params.local_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 46: /* remote-rcvbuf */
+		case 45: /* remote-rcvbuf */
 #ifdef __linux__
 			params.remote_rcvbuf = atoi(optarg)/2;
 #else
 			params.remote_rcvbuf = atoi(optarg);
 #endif
 			break;
-		case 47: /* remote-sndbuf */
+		case 46: /* remote-sndbuf */
 #ifdef __linux__
 			params.remote_sndbuf = atoi(optarg)/2;
 #else
 			params.remote_sndbuf = atoi(optarg);
 #endif
 			break;
-		case 48: /* socks */
+		case 47: /* socks */
 			params.proxy_type = CONN_TYPE_SOCKS;
 			break;
-		case 49: /* no-resolve */
+		case 48: /* no-resolve */
 			params.no_resolve = true;
 			break;
-		case 50: /* resolver-threads */
+		case 49: /* resolver-threads */
 			params.resolver_threads = atoi(optarg);
 			if (params.resolver_threads<1 || params.resolver_threads>300)
 			{
@@ -755,10 +729,10 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 51: /* skip-nodelay */
+		case 50: /* skip-nodelay */
 			params.skip_nodelay = true;
 			break;
-		case 52: /* tamper-start */
+		case 51: /* tamper-start */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -771,7 +745,7 @@ void parse_params(int argc, char *argv[])
 				params.tamper_start = atoi(p);
 			}
 			break;
-		case 53: /* tamper-cutoff */
+		case 52: /* tamper-cutoff */
 			{
 				const char *p=optarg;
 				if (*p=='n')
@@ -785,11 +759,11 @@ void parse_params(int argc, char *argv[])
 			}
 			break;
 #if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
-		case 54: /* enable-pf */
+		case 53: /* enable-pf */
 			params.pf_enable = true;
 			break;
 #elif defined(__linux__)
-		case 54: /* mss */
+		case 53: /* mss */
 			// this option does not work in any BSD and MacOS. OS may accept but it changes nothing
 			params.mss = atoi(optarg);
 			if (params.mss<88 || params.mss>32767)
@@ -798,7 +772,7 @@ void parse_params(int argc, char *argv[])
 				exit_clean(1);
 			}
 			break;
-		case 55: /* mss-pf */
+		case 54: /* mss-pf */
 			if (!pf_parse(optarg,&params.mss_pf))
 			{
 				fprintf(stderr, "Invalid MSS port filter.\n");
@@ -806,7 +780,7 @@ void parse_params(int argc, char *argv[])
 			}
 			break;
 #ifdef SPLICE_PRESENT
-		case 56: /* nosplice */
+		case 55: /* nosplice */
 			params.nosplice = true;
 			break;
 #endif
@@ -828,7 +802,6 @@ void parse_params(int argc, char *argv[])
 		exit_clean(1);
 	}
 	if (!params.resolver_threads) params.resolver_threads = 5 + params.maxconn/50;
-	if (params.split_tls==tlspos_none && params.split_pos) params.split_tls=tlspos_pos;
 
 	if (*params.hostlist_auto_filename) params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename);
 	if (!LoadIncludeHostLists())