DNSTT Client

The app provides two distinct tunneling protocols for bypassing network restrictions via DNS:

1. DNSTT: Uses DNS TXT queries with KCP reliable transport and Noise encryption. The traffic flow is: App Traffic → SOCKS5 → dnstt tunnel (KCP+Noise) → DNS queries → Server.
2. Slipstream: Uses QUIC-over-DNS with TLS 1.3 encryption, offering approximately 5x higher throughput than DNSTT. The traffic flow is: App Traffic → slipstream-client (QUIC) → DNS queries → Server.

Both protocols utilize the same DNS server list. For DNSTT, the selected DNS server carries the tunnel traffic; for Slipstream, the selected DNS server acts as the resolver.

SSH Tunnel mode is an alternative to the standard SOCKS5 proxy mode. Instead of the DNSTT client providing the SOCKS5 proxy directly, the app establishes an SSH connection through the DNSTT tunnel. It then uses SSH dynamic port forwarding (similar to ssh -D) to create the SOCKS5 proxy.

This creates a layered architecture:

1. User Apps connect to a local SOCKS5 proxy.
2. SSH Client (using JSch) handles the SOCKS5 requests and forwards them via SSH.
3. DNSTT Client tunnels that SSH traffic over DNS queries.
4. DNSTT Server decodes the DNS traffic and forwards it to a local SSH server.
5. SSH Server authenticates the user and provides internet access.

To cross-compile the Slipstream component for all supported Android architectures, use the provided script.

./scripts/build_slipstream_android.sh

Building for Desktop requires running the provided build scripts. If you want Slipstream support, you must build the slipstream-client first.

# Build slipstream-client first (optional, for Slipstream protocol support)
git submodule update --init --recursive
./scripts/build_slipstream_desktop.sh

# macOS (bundles both DNSTT + Slipstream)
./scripts/build_macos.sh release

# Windows
./scripts/build_windows.sh release

# Linux
./scripts/build_linux.sh release

If you prefer not to use the automated PowerShell script, you can obtain connect.exe using one of the following three methods:

1. Git for Windows: If installed, copy the file from C:\Program Files\Git\mingw64\bin\connect.exe.
2. Pre-built binaries: Download the executable from the ssh-connect releases page.
3. Build from source: Clone the repository at https://github.com/gotoh/ssh-connect and build it using MinGW or Visual Studio. Ensure the resulting binary is named connect.exe and placed in the windows/runner/tools/ directory.

On Desktop (macOS, Windows, Linux), the app operates as a local SOCKS5 proxy on 127.0.0.1:7000. You must manually configure your applications or browsers to use this proxy.

Firefox Configuration:

1. Go to Settings → Network Settings → Manual proxy configuration.
2. Set SOCKS Host to 127.0.0.1 and Port to 7000.
3. Ensure SOCKS v5 is selected.

Chrome Configuration: Launch Chrome via the command line with the proxy flag.

google-chrome --proxy-server="socks5://127.0.0.1:7000"

To enable SSH SOCKS5 proxy support in the DNSTT app, you must place a utility named connect.exe in the windows/runner/tools/ directory. This tool allows SSH to route connections through a SOCKS5 proxy, which is required for routing SSH traffic through the DNSTT tunnel.

# Quick Setup using the provided PowerShell script
.\scripts\get_connect_exe.ps1

The Go dnstt library source is located in go_src/. You can rebuild it for Android (as an .aar) or for Desktop (as a shared library).

# For Android
cd go_src
gomobile bind -v -androidapi 21 -target=android -o dnstt.aar ./mobile
cp dnstt.aar ../android/app/libs/

# For Desktop (macOS example)
CGO_ENABLED=1 go build -buildmode=c-shared -o libdnstt.dylib ./desktop

To build the Android application, ensure you have the Flutter SDK (3.x+), Android SDK (API 21+ with NDK), Go (1.21+), gomobile, Java JDK 17, and the Rust toolchain installed.

Note: For Slipstream support, you must also install cargo-ndk.

# Clone the repository (with submodules for Slipstream source)
git clone --recursive https://github.com/dnstt-xyz/dnstt_xyz_app.git
cd dnstt_xyz_app

# Install Flutter dependencies
flutter pub get

# Build split APKs (recommended)
flutter build apk --release --split-per-abi

Covertness

• DoH and DoT: These modes provide protection against detection of the tunnel because they encrypt DNS messages between the client and the recursive resolver.
• UDP: This mode is not covert. It sends plaintext DNS messages which reveal the tunnel's special format.

Metadata and Detection

Even when using DoH or DoT, an observer may infer the use of a tunnel through traffic metadata (volume and timing). Additionally, the recursive resolver can see the plaintext of DNS messages and can detect the tunnel.

Encryption

Regardless of the transport mode, the contents of the tunnel remain encrypted and authenticated via an end-to-end layer that is independent of the DNS transport encryption.

To use SSH Tunnel mode, you must configure a single configuration object that includes both DNSTT connection parameters and SSH authentication credentials. You must set tunnelType to ssh to enable this mode.