$ show EndPositive/slipstream
Slipstream is a high-performance covert channel that tunnels TCP traffic over DNS queries and responses using the QUIC protocol. The client runs inside a restricted network, accepting TCP connections and forwarding data via DNS to the server, which acts as an authoritative DNS server for a configured domain and forwards data to a target TCP service. The architecture leverages picoquic for QUIC implementation with custom packet loops to handle UDP (DNS) and TCP sockets, incorporating innovations like QUIC multipath for aggregating bandwidth from multiple resolvers, a server-side congestion control disable to maximize response opportunities, and a spoofed source address technique to prevent QUIC path migration based on fluctuating DNS resolver addresses. The codebase demonstrates careful engineering in integrating picoquic with DNS transport, featuring efficient base32 encoding with dotification for DNS label splitting and utility functions for connection ID handling and socket address manipulation. Notable reusable components include the dotification/undotification functions for DNS label encoding and a set of picoquic utility functions. The project is actively maintained with modern build tools (Meson/Ninja), regular releases, and clear documentation, indicating ongoing development and low technical debt relative to its ecosystem.
The LLM identified 2 files worth highlighting for reuse:
Provides efficient dotification and undotification functions for splitting arbitrary byte sequences into DNS-compliant labels. The algorithm inserts a dot every 57 characters (to accommodate base32 encoding and DNS label limits) and is self-contained with no external dependencies, making it reusable in any DNS tunneling or data encoding project with minimal modification.
Contains three utility functions: picoquic_connection_id_to_string (converts binary connection IDs to hex strings for logging), sockaddr_dummy (sets a sockaddr_storage to a fixed IP/port to spoof packet sources and prevent QUIC path migration), and print_sockaddr_ip_and_port (formats socket addresses for display). These functions solve common problems in picoquic-based applications and can be extracted with minimal changes due to their independence and clear, focused purpose.