iodine - https://code.kryo.se/iodine ************************************ CHANGES: master: - Changed deprecated tzsetwall() to tzset() (only used by FreeBSD), patch by Pouria Mousavizadeh Tehrani. 2023-04-17: 0.8.0 "Burning Snowman" - Mac OS X: Support native utun VPN devices. Patch by Peter Sagerson, ported from OpenVPN by Catalin Patulea. - Fix compilation failure on kFreeBSD and Hurd, by Gregor Herrmann - Patch from Ryan Welton that fixes compilation warning. - README converted to markdown by Nicolas Braud-Santoni. - Linux: use pkg-config for systemd support flags. Patch by Jason A. Donenfeld. - Add support for IPv6 in the server. Raw mode will be with same protocol as used for login. Traffic inside tunnel is still IPv4. - Update android build to try to support 5.0 (Lollipop) and newer. - Change external IP lookup to using myip.opendns.com via DNS. - Add option to choose IPv4 listen address from external IP lookup. - Add server support for handling multiple domains via wildcard. - Recognize tap device component id 'root' prefix on Windows. 2014-06-16: 0.7.0 "Kryoptonite" - Partial IPv6 support (#107) Client can connect to iodined through an relaying IPv6 nameserver. Server only supports IPv4 for now. Traffic inside tunnel is IPv4. - Add socket activation for systemd, by Michael Scherer. - Add automated lookup of external ip (via -n auto). - Bugfix for OS X (Can't assign requested address) - Fix DNS tunneling bug caused by uninitialized variable, #94 - Handle spaces when entering password interactively, fixes #93. Patch by Hagar. - Add -R option to set OpenBSD routing domain for the DNS socket. Patch by laurent at gouloum fr, fixes #95. - Add android patches and makefile, from Marcel Bokhorst, fixes #105. - Added missing break in iodine.c, by Pavel Pergamenshchik, #108. - A number of minor patches from Frank Denis, Gregor Herrmann and Barak A. Pearlmutter. - Testcase compilation fixes for OS X and FreeBSD - Do not let sockets be inherited by sub-processes, fixes #99. - Add unspecified RR type (called PRIVATE; id 65399, in private use range). For servers with RFC3597 support. Fixes #97. - Fix authentication bypass vulnerability; found by Oscar Reparaz. 2010-02-06: 0.6.0-rc1 "Hotspotify" - Fixed tunnel not working on Windows. - Any device name is now supported on Windows, fixes #47. - Multiple installed TAP32 interfaces are now supported, fixes #46. - Return nonzero if tunnel fails to open, fixes #62. - Support for setting a SELinux context, based on patch by Sebastien Raveau. Sample context file in doc/iodine.te - Allow listen port and DNS forward port to be the same if listen IP does not include localhost. - The client will now exit if configuring IP or MTU fails. - The starting cache miss value is randomized at startup, fixes #65. - Raw UDP mode added. If the iodined server is reachable directly, packets can be sent to it without DNS encoding. Fixes #36. - Do not overwrite users CC/CFLAGS/LDFLAGS, only add to them. - Added -F option to write pidfile, based on patch from misc at mandriva.org. Fixes #70. - Allow password to be set via environment variable, fixes #77. Based on patch by logix. - Client now prints server tunnel IP, fixes #78. Patch by logix. - Fix build error on Mac OS X 10.6, patch by G. Rischard. #79. - Added support for CNAME/TXT/A/MX query types, fixes #75. Patch by Anne Bezemer, merge help by logix. - Merged low-latency patch from Anne Bezemer, fixes #76. - Resolve client nameserver argument if given as hostname, fixes #82. - Open log before chroot, fixes #86: logging on FreeBSD. - Merged big bugfix patch from Anne Bezemer, #88. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 - Added check that nameserver lookup was successful - Fixed ENOTSOCK error on OS X and FreeBSD, #58. 2009-03-21: 0.5.1 "Boringo" - Added initial Windows support, fixes #43. - Added length check of autoprobe responses - Refactored and added unit tests - Added syslog logging for iodined on version and login packets - Fixed segfault when encoding just one block, fixes #51. The normal code was never affected by this. - Added win32 code to read DNS server from system, fixes #45. - Disabled password echo on win32, fixes #44. - Fix encoding error making all autoprobing > 1024 bytes fail, #52. - Increase default interface MTU to 1200. - Fix autoprobing error making every third probe fail, set IP flag Dont-Fragment where supported. Fixes #54. - Added TAP32 version 0901 as accepted (#53). 2009-01-23: 0.5.0 "iPassed" - Fixed segfault in server when sending version reject. - Applied patch to make iodine build on BeOS R5-BONE and Haiku, from Francois Revol. Still work to do to get tun device working. - Added capability to forward DNS queries outside tunnel domain to a nameserver on localhost. Use -b port to enable, fixes #31. - iodined now replies to NS request on its own domain, fixes issue #33. The destination IP address is sent as reply. Use -n to specify a specific IP address to return (if behind NAT etc). - Upstream data is now Base64 encoded if relay server preserves case and supports the plus (+) character in domain names, fixes #16. - Fixed problem in client when DNS trans. ID has highest bit set (#37) - IP addresses are now assigned within the netmask, so iodined can use any address for itself, fixes #28. - Netmask size is now adjustable. Setting a small net will reduce the number of users. Use x.x.x.x/n notation on iodined tunnel ip. This fixes #27. - Downstream data is now fragmented, and the fragment size is auto- probed after login. Fixes #7. It only took a few years :) - Enhanced the checks that validates incoming packets - Fixed endless loop in fragment size autodetection, #39. - Fixed broken hostname dot placing with specific lengths, #40. 2008-08-06: 0.4.2 "Opened Zone" - Applied a few small patches from Maxim Bourmistrov and Gregor Herrmann - Applied a patch for not creating and configuring the tun interface, Debian bug #477692 by Vincent Bernat, controlled by -s switch - Applied a security patch from Andrew Griffiths, use setgroups() to limit the groups of the user - Applied a patch to make iodine build on (Open)Solaris, from Albert Lee Needs TUN/TAP driver http://www.whiteboard.ne.jp/~admin2/tuntap/ Still needs more code in tun.c for opening/closing the device - Added option in server (-c) to disable IP/port checking on packets, will hopefully help when server is behind NAT - Fixed bug #21, now only IP address part of each packet is checked. Should remove the need for the -c option and also work with bugfixed DNS servers worldwide. - Added -D option on server to enable debugging. Debug level 1 now prints info about each RX/TX datagram. 2007-11-30: 0.4.1 "Tea Online" - Introduced encoding API - Switched to new Base32 implementation - Added Base64 implementation that only uses 63 chars (not used yet) - Refined 'install' make target and use $(MAKE) for recursive calls - All received error messages (RCODE field) are echoed - Top domain limited to 128 chars - Case preservation check sent after login to decide codec - Fixed crash on incoming NULL query in server with bad top domain - /etc/resolv.conf is consulted if no nameserver is given on commandline - Applied patch from Matthew W. S. Bell (Detach before chroot/dropping priv) 2007-03-25: 0.4.0 "Run Home" - Added multiuser support (up to 8 users simultaneously) - Added authentication (password entered as argument or on stdin) - Added manpage - Added install/uninstall make target - Cleanup of dns code, more test cases, use check library - Changed directory structure 2006-11-08: 0.3.4 - Fixed handshake() buffer overflow (Found by poplix, Secunia: SA22674 / FrSIRT/ADV-2006-4333) - Added more tests - More name parsing enhancements - Now runs on Linux/AMD64 - Added setting to change server port 2006-11-05: 0.3.3 - Fixed possible buffer overflow (Found by poplix, Bugtraq ID: 20883) - Reworked dns hostname encoding 2006-09-11: 0.3.2 - Support for NetBSD - Fixed potential security problems - Name parsing routines rewritten, added regression tests - New encoding, 25% more peak upstream throughput - New -l option to set local ip to listen to on server 2006-07-11: 0.3.1 - Add Mac OSX support - Add setting device name - Use compression of domain name in reply (should allow setting MTU approx 200 bytes higher) 2006-06-24: 0.3.0 - First public release - Support for Linux, FreeBSD, OpenBSD