From 5d8801d4687035ae45143f0f3bc3eeaf75dc17ec Mon Sep 17 00:00:00 2001 From: Yves Fischer Date: Mon, 11 Aug 2014 23:26:36 +0200 Subject: Upgrade code to iodine 0.7.0 and improve logging --- jni/iodine/README | 50 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 14 deletions(-) (limited to 'jni/iodine/README') diff --git a/jni/iodine/README b/jni/iodine/README index d9e3c29..cfc8ede 100644 --- a/jni/iodine/README +++ b/jni/iodine/README @@ -8,6 +8,17 @@ server. This can be usable in different situations where internet access is firewalled, but DNS queries are allowed. +COMPILING: + +Iodine has no configure script. There are two optional features for Linux +(SELinux and systemd support) that will be enabled automatically if the +relevant header files are found in /usr/include. (See script at ./src/osflags) + +Run 'make' to compile the server and client binaries. +Run 'make install' to copy binaries and manpage to the destination directory. +Run 'make test' to compile and run the unit tests. (Requires the check library) + + QUICKSTART: Try it out within your own LAN! Follow these simple steps: @@ -103,6 +114,16 @@ end of the tunnel. In this case, ping 192.168.99.1 from the iodine client, and MISC. INFO: +IPv6: +At the moment the iodined server only supports IPv4. The data inside the tunnel +is IPv4 only. + +The client can use IPv4 or IPv6 nameservers to connect to iodined. The relay +nameservers will translate between protocols automatically if needed. Use +options -4 or -6 to force the client to use a specific IP version for its DNS +queries. The client has to force IPv4 if it has dual-stack connectivity and +the hostname handling the tunnel domain has both A and AAAA records. + Routing: It is possible to route all traffic through the DNS tunnel. To do this, first add a host route to the nameserver used by iodine over the wired/wireless @@ -156,12 +177,13 @@ packet, and one query can be max 256 chars. Each domain name part can be max 63 chars. So your domain name and subdomain should be as short as possible to allow maximum upstream throughput. -Several DNS request types are supported, with the NULL type expected to provide -the largest downstream bandwidth. Other available types are TXT, SRV, MX, -CNAME and A (returning CNAME), in decreasing bandwidth order. Normally the +Several DNS request types are supported, with the NULL and PRIVATE types +expected to provide the largest downstream bandwidth. The PRIVATE type uses +value 65399 in the private-use range. Other available types are TXT, SRV, MX, +CNAME and A (returning CNAME), in decreasing bandwidth order. Normally the "best" request type is autodetected and used. However, DNS relays may impose limits on for example NULL and TXT, making SRV or MX actually the best choice. -This is not autodetected, but can be forced using the -T option. It is +This is not autodetected, but can be forced using the -T option. It is advisable to try various alternatives especially when the autodetected request type provides a downstream fragment size of less than 200 bytes. @@ -169,14 +191,14 @@ Note that SRV, MX and A (returning CNAME) queries may/will cause additional lookups by "smart" caching nameservers to get an actual IP address, which may either slow down or fail completely. -DNS responses for non-NULL queries can be encoded with the same set of codecs -as upstream data. This is normally also autodetected, but no fully exhaustive -tests are done, so some problems may not be noticed when selecting more -advanced codecs. In that case, you'll see failures/corruption in the fragment -size autoprobe. In particular, several DNS relays have been found that change -replies returning hostnames (SRV, MX, CNAME, A) to lowercase only when that -hostname exceeds ca. 180 characters. In these and similar cases, use the -O -option to try other downstream codecs; Base32 should always work. +DNS responses for non-NULL/PRIVATE queries can be encoded with the same set of +codecs as upstream data. This is normally also autodetected, but no fully +exhaustive tests are done, so some problems may not be noticed when selecting +more advanced codecs. In that case, you'll see failures/corruption in the +fragment size autoprobe. In particular, several DNS relays have been found that +change replies returning hostnames (SRV, MX, CNAME, A) to lowercase only when +that hostname exceeds ca. 180 characters. In these and similar cases, use the +-O option to try other downstream codecs; Base32 should always work. Normal operation now is for the server to _not_ answer a DNS request until the next DNS request has come in, a.k.a. being "lazy". This way, the server @@ -337,8 +359,8 @@ THANKS: AUTHORS & LICENSE: -Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman -Also major contributions by Anne Bezemer. +Copyright (c) 2006-2014 Erik Ekman , 2006-2009 Bjorn +Andersson . Also major contributions by Anne Bezemer. Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice -- cgit v1.2.1