[ { "path": ".gitignore", "content": "sshuttle/version.py\n*.pyc\n*~\n*.8\n/.do_built\n/.do_built.dir\n/.redo\n" }, { "path": ".travis.yml", "content": "language: python\npython:\n- 2.7\n- 3.5\n- pypy\n\ninstall:\n - travis_retry pip install -q pytest mock\n\nscript:\n - PYTHONPATH=. py.test\n" }, { "path": "CHANGES.rst", "content": "Release 0.77 (Mar 3, 2016)\n==========================\n\n* Various bug fixes.\n* Fix Documentation.\n* Add fix for MacOS X issue.\n* Add support for OpenBSD.\n\n\nRelease 0.76 (Jan 17, 2016)\n===========================\n\n* Add option to disable IPv6 support.\n* Update documentation.\n* Move documentation, including man page, to Sphinx.\n* Use setuptools-scm for automatic versioning.\n\n\nRelease 0.75 (Jan 12, 2016)\n===========================\n\n* Revert change that broke sshuttle entry point.\n\n\nRelease 0.74 (Jan 10, 2016)\n===========================\n\n* Add CHANGES.rst file.\n* Numerous bug fixes.\n* Python 3.5 fixes.\n* PF fixes, especially for BSD.\n" }, { "path": "LICENSE", "content": "\t\t GNU LIBRARY GENERAL PUBLIC LICENSE\n\t\t Version 2, June 1991\n\n Copyright (C) 1991 Free Software Foundation, Inc.\n 675 Mass Ave, Cambridge, MA 02139, USA\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n[This is the first released version of the library GPL. It is\n numbered 2 because it goes with version 2 of the ordinary GPL.]\n\n\t\t\t Preamble\n\n The licenses for most software are designed to take away your\nfreedom to share and change it. By contrast, the GNU General Public\nLicenses are intended to guarantee your freedom to share and change\nfree software--to make sure the software is free for all its users.\n\n This license, the Library General Public License, applies to some\nspecially designated Free Software Foundation software, and to any\nother libraries whose authors decide to use it. You can use it for\nyour libraries, too.\n\n When we speak of free software, we are referring to freedom, not\nprice. Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthis service if you wish), that you receive source code or can get it\nif you want it, that you can change the software or use pieces of it\nin new free programs; and that you know you can do these things.\n\n To protect your rights, we need to make restrictions that forbid\nanyone to deny you these rights or to ask you to surrender the rights.\nThese restrictions translate to certain responsibilities for you if\nyou distribute copies of the library, or if you modify it.\n\n For example, if you distribute copies of the library, whether gratis\nor for a fee, you must give the recipients all the rights that we gave\nyou. You must make sure that they, too, receive or can get the source\ncode. If you link a program with the library, you must provide\ncomplete object files to the recipients so that they can relink them\nwith the library, after making changes to the library and recompiling\nit. And you must show them these terms so they know their rights.\n\n Our method of protecting your rights has two steps: (1) copyright\nthe library, and (2) offer you this license which gives you legal\npermission to copy, distribute and/or modify the library.\n\n Also, for each distributor's protection, we want to make certain\nthat everyone understands that there is no warranty for this free\nlibrary. If the library is modified by someone else and passed on, we\nwant its recipients to know that what they have is not the original\nversion, so that any problems introduced by others will not reflect on\nthe original authors' reputations.\n\f\n Finally, any free program is threatened constantly by software\npatents. We wish to avoid the danger that companies distributing free\nsoftware will individually obtain patent licenses, thus in effect\ntransforming the program into proprietary software. To prevent this,\nwe have made it clear that any patent must be licensed for everyone's\nfree use or not licensed at all.\n\n Most GNU software, including some libraries, is covered by the ordinary\nGNU General Public License, which was designed for utility programs. This\nlicense, the GNU Library General Public License, applies to certain\ndesignated libraries. This license is quite different from the ordinary\none; be sure to read it in full, and don't assume that anything in it is\nthe same as in the ordinary license.\n\n The reason we have a separate public license for some libraries is that\nthey blur the distinction we usually make between modifying or adding to a\nprogram and simply using it. Linking a program with a library, without\nchanging the library, is in some sense simply using the library, and is\nanalogous to running a utility program or application program. However, in\na textual and legal sense, the linked executable is a combined work, a\nderivative of the original library, and the ordinary General Public License\ntreats it as such.\n\n Because of this blurred distinction, using the ordinary General\nPublic License for libraries did not effectively promote software\nsharing, because most developers did not use the libraries. We\nconcluded that weaker conditions might promote sharing better.\n\n However, unrestricted linking of non-free programs would deprive the\nusers of those programs of all benefit from the free status of the\nlibraries themselves. This Library General Public License is intended to\npermit developers of non-free programs to use free libraries, while\npreserving your freedom as a user of such programs to change the free\nlibraries that are incorporated in them. (We have not seen how to achieve\nthis as regards changes in header files, but we have achieved it as regards\nchanges in the actual functions of the Library.) The hope is that this\nwill lead to faster development of free libraries.\n\n The precise terms and conditions for copying, distribution and\nmodification follow. Pay close attention to the difference between a\n\"work based on the library\" and a \"work that uses the library\". The\nformer contains code derived from the library, while the latter only\nworks together with the library.\n\n Note that it is possible for a library to be covered by the ordinary\nGeneral Public License rather than by this special one.\n\f\n\t\t GNU LIBRARY GENERAL PUBLIC LICENSE\n TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n 0. This License Agreement applies to any software library which\ncontains a notice placed by the copyright holder or other authorized\nparty saying it may be distributed under the terms of this Library\nGeneral Public License (also called \"this License\"). Each licensee is\naddressed as \"you\".\n\n A \"library\" means a collection of software functions and/or data\nprepared so as to be conveniently linked with application programs\n(which use some of those functions and data) to form executables.\n\n The \"Library\", below, refers to any such software library or work\nwhich has been distributed under these terms. A \"work based on the\nLibrary\" means either the Library or any derivative work under\ncopyright law: that is to say, a work containing the Library or a\nportion of it, either verbatim or with modifications and/or translated\nstraightforwardly into another language. (Hereinafter, translation is\nincluded without limitation in the term \"modification\".)\n\n \"Source code\" for a work means the preferred form of the work for\nmaking modifications to it. For a library, complete source code means\nall the source code for all modules it contains, plus any associated\ninterface definition files, plus the scripts used to control compilation\nand installation of the library.\n\n Activities other than copying, distribution and modification are not\ncovered by this License; they are outside its scope. The act of\nrunning a program using the Library is not restricted, and output from\nsuch a program is covered only if its contents constitute a work based\non the Library (independent of the use of the Library in a tool for\nwriting it). Whether that is true depends on what the Library does\nand what the program that uses the Library does.\n \n 1. You may copy and distribute verbatim copies of the Library's\ncomplete source code as you receive it, in any medium, provided that\nyou conspicuously and appropriately publish on each copy an\nappropriate copyright notice and disclaimer of warranty; keep intact\nall the notices that refer to this License and to the absence of any\nwarranty; and distribute a copy of this License along with the\nLibrary.\n\n You may charge a fee for the physical act of transferring a copy,\nand you may at your option offer warranty protection in exchange for a\nfee.\n\f\n 2. You may modify your copy or copies of the Library or any portion\nof it, thus forming a work based on the Library, and copy and\ndistribute such modifications or work under the terms of Section 1\nabove, provided that you also meet all of these conditions:\n\n a) The modified work must itself be a software library.\n\n b) You must cause the files modified to carry prominent notices\n stating that you changed the files and the date of any change.\n\n c) You must cause the whole of the work to be licensed at no\n charge to all third parties under the terms of this License.\n\n d) If a facility in the modified Library refers to a function or a\n table of data to be supplied by an application program that uses\n the facility, other than as an argument passed when the facility\n is invoked, then you must make a good faith effort to ensure that,\n in the event an application does not supply such function or\n table, the facility still operates, and performs whatever part of\n its purpose remains meaningful.\n\n (For example, a function in a library to compute square roots has\n a purpose that is entirely well-defined independent of the\n application. Therefore, Subsection 2d requires that any\n application-supplied function or table used by this function must\n be optional: if the application does not supply it, the square\n root function must still compute square roots.)\n\nThese requirements apply to the modified work as a whole. If\nidentifiable sections of that work are not derived from the Library,\nand can be reasonably considered independent and separate works in\nthemselves, then this License, and its terms, do not apply to those\nsections when you distribute them as separate works. But when you\ndistribute the same sections as part of a whole which is a work based\non the Library, the distribution of the whole must be on the terms of\nthis License, whose permissions for other licensees extend to the\nentire whole, and thus to each and every part regardless of who wrote\nit.\n\nThus, it is not the intent of this section to claim rights or contest\nyour rights to work written entirely by you; rather, the intent is to\nexercise the right to control the distribution of derivative or\ncollective works based on the Library.\n\nIn addition, mere aggregation of another work not based on the Library\nwith the Library (or with a work based on the Library) on a volume of\na storage or distribution medium does not bring the other work under\nthe scope of this License.\n\n 3. You may opt to apply the terms of the ordinary GNU General Public\nLicense instead of this License to a given copy of the Library. To do\nthis, you must alter all the notices that refer to this License, so\nthat they refer to the ordinary GNU General Public License, version 2,\ninstead of to this License. (If a newer version than version 2 of the\nordinary GNU General Public License has appeared, then you can specify\nthat version instead if you wish.) Do not make any other change in\nthese notices.\n\f\n Once this change is made in a given copy, it is irreversible for\nthat copy, so the ordinary GNU General Public License applies to all\nsubsequent copies and derivative works made from that copy.\n\n This option is useful when you wish to copy part of the code of\nthe Library into a program that is not a library.\n\n 4. You may copy and distribute the Library (or a portion or\nderivative of it, under Section 2) in object code or executable form\nunder the terms of Sections 1 and 2 above provided that you accompany\nit with the complete corresponding machine-readable source code, which\nmust be distributed under the terms of Sections 1 and 2 above on a\nmedium customarily used for software interchange.\n\n If distribution of object code is made by offering access to copy\nfrom a designated place, then offering equivalent access to copy the\nsource code from the same place satisfies the requirement to\ndistribute the source code, even though third parties are not\ncompelled to copy the source along with the object code.\n\n 5. A program that contains no derivative of any portion of the\nLibrary, but is designed to work with the Library by being compiled or\nlinked with it, is called a \"work that uses the Library\". Such a\nwork, in isolation, is not a derivative work of the Library, and\ntherefore falls outside the scope of this License.\n\n However, linking a \"work that uses the Library\" with the Library\ncreates an executable that is a derivative of the Library (because it\ncontains portions of the Library), rather than a \"work that uses the\nlibrary\". The executable is therefore covered by this License.\nSection 6 states terms for distribution of such executables.\n\n When a \"work that uses the Library\" uses material from a header file\nthat is part of the Library, the object code for the work may be a\nderivative work of the Library even though the source code is not.\nWhether this is true is especially significant if the work can be\nlinked without the Library, or if the work is itself a library. The\nthreshold for this to be true is not precisely defined by law.\n\n If such an object file uses only numerical parameters, data\nstructure layouts and accessors, and small macros and small inline\nfunctions (ten lines or less in length), then the use of the object\nfile is unrestricted, regardless of whether it is legally a derivative\nwork. (Executables containing this object code plus portions of the\nLibrary will still fall under Section 6.)\n\n Otherwise, if the work is a derivative of the Library, you may\ndistribute the object code for the work under the terms of Section 6.\nAny executables containing that work also fall under Section 6,\nwhether or not they are linked directly with the Library itself.\n\f\n 6. As an exception to the Sections above, you may also compile or\nlink a \"work that uses the Library\" with the Library to produce a\nwork containing portions of the Library, and distribute that work\nunder terms of your choice, provided that the terms permit\nmodification of the work for the customer's own use and reverse\nengineering for debugging such modifications.\n\n You must give prominent notice with each copy of the work that the\nLibrary is used in it and that the Library and its use are covered by\nthis License. You must supply a copy of this License. If the work\nduring execution displays copyright notices, you must include the\ncopyright notice for the Library among them, as well as a reference\ndirecting the user to the copy of this License. Also, you must do one\nof these things:\n\n a) Accompany the work with the complete corresponding\n machine-readable source code for the Library including whatever\n changes were used in the work (which must be distributed under\n Sections 1 and 2 above); and, if the work is an executable linked\n with the Library, with the complete machine-readable \"work that\n uses the Library\", as object code and/or source code, so that the\n user can modify the Library and then relink to produce a modified\n executable containing the modified Library. (It is understood\n that the user who changes the contents of definitions files in the\n Library will not necessarily be able to recompile the application\n to use the modified definitions.)\n\n b) Accompany the work with a written offer, valid for at\n least three years, to give the same user the materials\n specified in Subsection 6a, above, for a charge no more\n than the cost of performing this distribution.\n\n c) If distribution of the work is made by offering access to copy\n from a designated place, offer equivalent access to copy the above\n specified materials from the same place.\n\n d) Verify that the user has already received a copy of these\n materials or that you have already sent this user a copy.\n\n For an executable, the required form of the \"work that uses the\nLibrary\" must include any data and utility programs needed for\nreproducing the executable from it. However, as a special exception,\nthe source code distributed need not include anything that is normally\ndistributed (in either source or binary form) with the major\ncomponents (compiler, kernel, and so on) of the operating system on\nwhich the executable runs, unless that component itself accompanies\nthe executable.\n\n It may happen that this requirement contradicts the license\nrestrictions of other proprietary libraries that do not normally\naccompany the operating system. Such a contradiction means you cannot\nuse both them and the Library together in an executable that you\ndistribute.\n\f\n 7. You may place library facilities that are a work based on the\nLibrary side-by-side in a single library together with other library\nfacilities not covered by this License, and distribute such a combined\nlibrary, provided that the separate distribution of the work based on\nthe Library and of the other library facilities is otherwise\npermitted, and provided that you do these two things:\n\n a) Accompany the combined library with a copy of the same work\n based on the Library, uncombined with any other library\n facilities. This must be distributed under the terms of the\n Sections above.\n\n b) Give prominent notice with the combined library of the fact\n that part of it is a work based on the Library, and explaining\n where to find the accompanying uncombined form of the same work.\n\n 8. You may not copy, modify, sublicense, link with, or distribute\nthe Library except as expressly provided under this License. Any\nattempt otherwise to copy, modify, sublicense, link with, or\ndistribute the Library is void, and will automatically terminate your\nrights under this License. However, parties who have received copies,\nor rights, from you under this License will not have their licenses\nterminated so long as such parties remain in full compliance.\n\n 9. You are not required to accept this License, since you have not\nsigned it. However, nothing else grants you permission to modify or\ndistribute the Library or its derivative works. These actions are\nprohibited by law if you do not accept this License. Therefore, by\nmodifying or distributing the Library (or any work based on the\nLibrary), you indicate your acceptance of this License to do so, and\nall its terms and conditions for copying, distributing or modifying\nthe Library or works based on it.\n\n 10. Each time you redistribute the Library (or any work based on the\nLibrary), the recipient automatically receives a license from the\noriginal licensor to copy, distribute, link with or modify the Library\nsubject to these terms and conditions. You may not impose any further\nrestrictions on the recipients' exercise of the rights granted herein.\nYou are not responsible for enforcing compliance by third parties to\nthis License.\n\f\n 11. If, as a consequence of a court judgment or allegation of patent\ninfringement or for any other reason (not limited to patent issues),\nconditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License. If you cannot\ndistribute so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you\nmay not distribute the Library at all. For example, if a patent\nlicense would not permit royalty-free redistribution of the Library by\nall those who receive copies directly or indirectly through you, then\nthe only way you could satisfy both it and this License would be to\nrefrain entirely from distribution of the Library.\n\nIf any portion of this section is held invalid or unenforceable under any\nparticular circumstance, the balance of the section is intended to apply,\nand the section as a whole is intended to apply in other circumstances.\n\nIt is not the purpose of this section to induce you to infringe any\npatents or other property right claims or to contest validity of any\nsuch claims; this section has the sole purpose of protecting the\nintegrity of the free software distribution system which is\nimplemented by public license practices. Many people have made\ngenerous contributions to the wide range of software distributed\nthrough that system in reliance on consistent application of that\nsystem; it is up to the author/donor to decide if he or she is willing\nto distribute software through any other system and a licensee cannot\nimpose that choice.\n\nThis section is intended to make thoroughly clear what is believed to\nbe a consequence of the rest of this License.\n\n 12. If the distribution and/or use of the Library is restricted in\ncertain countries either by patents or by copyrighted interfaces, the\noriginal copyright holder who places the Library under this License may add\nan explicit geographical distribution limitation excluding those countries,\nso that distribution is permitted only in or among countries not thus\nexcluded. In such case, this License incorporates the limitation as if\nwritten in the body of this License.\n\n 13. The Free Software Foundation may publish revised and/or new\nversions of the Library General Public License from time to time.\nSuch new versions will be similar in spirit to the present version,\nbut may differ in detail to address new problems or concerns.\n\nEach version is given a distinguishing version number. If the Library\nspecifies a version number of this License which applies to it and\n\"any later version\", you have the option of following the terms and\nconditions either of that version or of any later version published by\nthe Free Software Foundation. If the Library does not specify a\nlicense version number, you may choose any version ever published by\nthe Free Software Foundation.\n\f\n 14. If you wish to incorporate parts of the Library into other free\nprograms whose distribution conditions are incompatible with these,\nwrite to the author to ask for permission. For software which is\ncopyrighted by the Free Software Foundation, write to the Free\nSoftware Foundation; we sometimes make exceptions for this. Our\ndecision will be guided by the two goals of preserving the free status\nof all derivatives of our free software and of promoting the sharing\nand reuse of software generally.\n\n\t\t\t NO WARRANTY\n\n 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO\nWARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.\nEXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR\nOTHER PARTIES PROVIDE THE LIBRARY \"AS IS\" WITHOUT WARRANTY OF ANY\nKIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE\nLIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME\nTHE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.\n\n 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN\nWRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY\nAND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU\nFOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR\nCONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE\nLIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING\nRENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A\nFAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF\nSUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH\nDAMAGES.\n\n\t\t END OF TERMS AND CONDITIONS\n\f\n Appendix: How to Apply These Terms to Your New Libraries\n\n If you develop a new library, and you want it to be of the greatest\npossible use to the public, we recommend making it free software that\neveryone can redistribute and change. You can do so by permitting\nredistribution under these terms (or, alternatively, under the terms of the\nordinary General Public License).\n\n To apply these terms, attach the following notices to the library. It is\nsafest to attach them to the start of each source file to most effectively\nconvey the exclusion of warranty; and each file should have at least the\n\"copyright\" line and a pointer to where the full notice is found.\n\n \n Copyright (C) \n\n This library is free software; you can redistribute it and/or\n modify it under the terms of the GNU Library General Public\n License as published by the Free Software Foundation; either\n version 2 of the License, or (at your option) any later version.\n\n This library is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\n Library General Public License for more details.\n\n You should have received a copy of the GNU Library General Public\n License along with this library; if not, write to the Free\n Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.\n\nAlso add information on how to contact you by electronic and paper mail.\n\nYou should also get your employer (if you work as a programmer) or your\nschool, if any, to sign a \"copyright disclaimer\" for the library, if\nnecessary. Here is a sample; alter the names:\n\n Yoyodyne, Inc., hereby disclaims all copyright interest in the\n library `Frob' (a library for tweaking knobs) written by James Random Hacker.\n\n , 1 April 1990\n Ty Coon, President of Vice\n\nThat's all there is to it!\n" }, { "path": "MANIFEST.in", "content": "include *.txt\ninclude *.rst\ninclude *.py\ninclude MANIFEST.in\ninclude LICENSE\ninclude run\ninclude tox.ini\nexclude sshuttle/version.py\nrecursive-include docs *.bat\nrecursive-include docs *.py\nrecursive-include docs *.rst\nrecursive-include docs Makefile\nrecursive-include sshuttle *.py\n" }, { "path": "README.rst", "content": "sshuttle: where transparent proxy meets VPN meets ssh\n=====================================================\n\nAs far as I know, sshuttle is the only program that solves the following\ncommon case:\n\n- Your client machine (or router) is Linux, FreeBSD, or MacOS.\n\n- You have access to a remote network via ssh.\n\n- You don't necessarily have admin access on the remote network.\n\n- The remote network has no VPN, or only stupid/complex VPN\n protocols (IPsec, PPTP, etc). Or maybe you *are* the\n admin and you just got frustrated with the awful state of\n VPN tools.\n\n- You don't want to create an ssh port forward for every\n single host/port on the remote network.\n\n- You hate openssh's port forwarding because it's randomly\n slow and/or stupid.\n\n- You can't use openssh's PermitTunnel feature because\n it's disabled by default on openssh servers; plus it does\n TCP-over-TCP, which has terrible performance (see below).\n\n\nObtaining sshuttle\n------------------\n\n- From PyPI::\n\n pip install sshuttle\n\n- Clone::\n\n git clone https://github.com/sshuttle/sshuttle.git\n ./setup.py install\n\nDocumentation\n-------------\nThe documentation for the stable version is available at:\nhttp://sshuttle.readthedocs.org/\n\nThe documentation for the latest development version is available at:\nhttp://sshuttle.readthedocs.org/en/latest/\n" }, { "path": "docs/Makefile", "content": "# Makefile for Sphinx documentation\n#\n\n# You can set these variables from the command line.\nSPHINXOPTS =\nSPHINXBUILD = sphinx-build\nPAPER =\nBUILDDIR = _build\n\n# User-friendly check for sphinx-build\nifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)\n$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)\nendif\n\n# Internal variables.\nPAPEROPT_a4 = -D latex_paper_size=a4\nPAPEROPT_letter = -D latex_paper_size=letter\nALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .\n# the i18n builder cannot share the environment and doctrees with the others\nI18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .\n\n.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext\n\nhelp:\n\t@echo \"Please use \\`make ' where is one of\"\n\t@echo \" html to make standalone HTML files\"\n\t@echo \" dirhtml to make HTML files named index.html in directories\"\n\t@echo \" singlehtml to make a single large HTML file\"\n\t@echo \" pickle to make pickle files\"\n\t@echo \" json to make JSON files\"\n\t@echo \" htmlhelp to make HTML files and a HTML help project\"\n\t@echo \" qthelp to make HTML files and a qthelp project\"\n\t@echo \" devhelp to make HTML files and a Devhelp project\"\n\t@echo \" epub to make an epub\"\n\t@echo \" latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter\"\n\t@echo \" latexpdf to make LaTeX files and run them through pdflatex\"\n\t@echo \" latexpdfja to make LaTeX files and run them through platex/dvipdfmx\"\n\t@echo \" text to make text files\"\n\t@echo \" man to make manual pages\"\n\t@echo \" texinfo to make Texinfo files\"\n\t@echo \" info to make Texinfo files and run them through makeinfo\"\n\t@echo \" gettext to make PO message catalogs\"\n\t@echo \" changes to make an overview of all changed/added/deprecated items\"\n\t@echo \" xml to make Docutils-native XML files\"\n\t@echo \" pseudoxml to make pseudoxml-XML files for display purposes\"\n\t@echo \" linkcheck to check all external links for integrity\"\n\t@echo \" doctest to run all doctests embedded in the documentation (if enabled)\"\n\nclean:\n\trm -rf $(BUILDDIR)/*\n\nhtml:\n\t$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html\n\t@echo\n\t@echo \"Build finished. The HTML pages are in $(BUILDDIR)/html.\"\n\ndirhtml:\n\t$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml\n\t@echo\n\t@echo \"Build finished. The HTML pages are in $(BUILDDIR)/dirhtml.\"\n\nsinglehtml:\n\t$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml\n\t@echo\n\t@echo \"Build finished. The HTML page is in $(BUILDDIR)/singlehtml.\"\n\npickle:\n\t$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle\n\t@echo\n\t@echo \"Build finished; now you can process the pickle files.\"\n\njson:\n\t$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json\n\t@echo\n\t@echo \"Build finished; now you can process the JSON files.\"\n\nhtmlhelp:\n\t$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp\n\t@echo\n\t@echo \"Build finished; now you can run HTML Help Workshop with the\" \\\n\t \".hhp project file in $(BUILDDIR)/htmlhelp.\"\n\nqthelp:\n\t$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp\n\t@echo\n\t@echo \"Build finished; now you can run \"qcollectiongenerator\" with the\" \\\n\t \".qhcp project file in $(BUILDDIR)/qthelp, like this:\"\n\t@echo \"# qcollectiongenerator $(BUILDDIR)/qthelp/sshuttle.qhcp\"\n\t@echo \"To view the help file:\"\n\t@echo \"# assistant -collectionFile $(BUILDDIR)/qthelp/sshuttle.qhc\"\n\ndevhelp:\n\t$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp\n\t@echo\n\t@echo \"Build finished.\"\n\t@echo \"To view the help file:\"\n\t@echo \"# mkdir -p $$HOME/.local/share/devhelp/sshuttle\"\n\t@echo \"# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/sshuttle\"\n\t@echo \"# devhelp\"\n\nepub:\n\t$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub\n\t@echo\n\t@echo \"Build finished. The epub file is in $(BUILDDIR)/epub.\"\n\nlatex:\n\t$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex\n\t@echo\n\t@echo \"Build finished; the LaTeX files are in $(BUILDDIR)/latex.\"\n\t@echo \"Run \\`make' in that directory to run these through (pdf)latex\" \\\n\t \"(use \\`make latexpdf' here to do that automatically).\"\n\nlatexpdf:\n\t$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex\n\t@echo \"Running LaTeX files through pdflatex...\"\n\t$(MAKE) -C $(BUILDDIR)/latex all-pdf\n\t@echo \"pdflatex finished; the PDF files are in $(BUILDDIR)/latex.\"\n\nlatexpdfja:\n\t$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex\n\t@echo \"Running LaTeX files through platex and dvipdfmx...\"\n\t$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja\n\t@echo \"pdflatex finished; the PDF files are in $(BUILDDIR)/latex.\"\n\ntext:\n\t$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text\n\t@echo\n\t@echo \"Build finished. The text files are in $(BUILDDIR)/text.\"\n\nman:\n\t$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man\n\t@echo\n\t@echo \"Build finished. The manual pages are in $(BUILDDIR)/man.\"\n\ntexinfo:\n\t$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo\n\t@echo\n\t@echo \"Build finished. The Texinfo files are in $(BUILDDIR)/texinfo.\"\n\t@echo \"Run \\`make' in that directory to run these through makeinfo\" \\\n\t \"(use \\`make info' here to do that automatically).\"\n\ninfo:\n\t$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo\n\t@echo \"Running Texinfo files through makeinfo...\"\n\tmake -C $(BUILDDIR)/texinfo info\n\t@echo \"makeinfo finished; the Info files are in $(BUILDDIR)/texinfo.\"\n\ngettext:\n\t$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale\n\t@echo\n\t@echo \"Build finished. The message catalogs are in $(BUILDDIR)/locale.\"\n\nchanges:\n\t$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes\n\t@echo\n\t@echo \"The overview file is in $(BUILDDIR)/changes.\"\n\nlinkcheck:\n\t$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck\n\t@echo\n\t@echo \"Link check complete; look for any errors in the above output \" \\\n\t \"or in $(BUILDDIR)/linkcheck/output.txt.\"\n\ndoctest:\n\t$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest\n\t@echo \"Testing of doctests in the sources finished, look at the \" \\\n\t \"results in $(BUILDDIR)/doctest/output.txt.\"\n\nxml:\n\t$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml\n\t@echo\n\t@echo \"Build finished. The XML files are in $(BUILDDIR)/xml.\"\n\npseudoxml:\n\t$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml\n\t@echo\n\t@echo \"Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml.\"\n" }, { "path": "docs/changes.rst", "content": "Changelog\n---------\n\n.. include:: ../CHANGES.rst\n" }, { "path": "docs/conf.py", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n#\n# sshuttle documentation build configuration file, created by\n# sphinx-quickstart on Sun Jan 17 12:13:47 2016.\n#\n# This file is execfile()d with the current directory set to its\n# containing dir.\n#\n# Note that not all possible configuration values are present in this\n# autogenerated file.\n#\n# All configuration values have a default; values that are commented out\n# serve to show the default.\n\n# import sys\n# import os\n\n# If extensions (or modules to document with autodoc) are in another directory,\n# add these directories to sys.path here. If the directory is relative to the\n# documentation root, use os.path.abspath to make it absolute, like shown here.\n# sys.path.insert(0, os.path.abspath('.'))\n\n# -- General configuration ------------------------------------------------\n\n# If your documentation needs a minimal Sphinx version, state it here.\n# needs_sphinx = '1.0'\n\n# Add any Sphinx extension module names here, as strings. They can be\n# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom\n# ones.\nextensions = [\n 'sphinx.ext.todo',\n]\n\n# Add any paths that contain templates here, relative to this directory.\ntemplates_path = ['_templates']\n\n# The suffix of source filenames.\nsource_suffix = '.rst'\n\n# The encoding of source files.\n# source_encoding = 'utf-8-sig'\n\n# The master toctree document.\nmaster_doc = 'index'\n\n# General information about the project.\nproject = 'sshuttle'\ncopyright = '2016, Brian May'\n\n# The version info for the project you're documenting, acts as replacement for\n# |version| and |release|, also used in various other places throughout the\n# built documents.\n#\n# The short X.Y version.\nfrom setuptools_scm import get_version\nversion = get_version(root=\"..\")\n# The full version, including alpha/beta/rc tags.\nrelease = version\n\n# The language for content autogenerated by Sphinx. Refer to documentation\n# for a list of supported languages.\n# language = None\n\n# There are two options for replacing |today|: either, you set today to some\n# non-false value, then it is used:\n# today = ''\n# Else, today_fmt is used as the format for a strftime call.\n# today_fmt = '%B %d, %Y'\n\n# List of patterns, relative to source directory, that match files and\n# directories to ignore when looking for source files.\nexclude_patterns = ['_build']\n\n# The reST default role (used for this markup: `text`) to use for all\n# documents.\n# default_role = None\n\n# If true, '()' will be appended to :func: etc. cross-reference text.\n# add_function_parentheses = True\n\n# If true, the current module name will be prepended to all description\n# unit titles (such as .. function::).\n# add_module_names = True\n\n# If true, sectionauthor and moduleauthor directives will be shown in the\n# output. They are ignored by default.\n# show_authors = False\n\n# The name of the Pygments (syntax highlighting) style to use.\npygments_style = 'sphinx'\n\n# A list of ignored prefixes for module index sorting.\n# modindex_common_prefix = []\n\n# If true, keep warnings as \"system message\" paragraphs in the built documents.\n# keep_warnings = False\n\n\n# -- Options for HTML output ----------------------------------------------\n\n# The theme to use for HTML and HTML Help pages. See the documentation for\n# a list of builtin themes.\nhtml_theme = 'default'\n\n# Theme options are theme-specific and customize the look and feel of a theme\n# further. For a list of options available for each theme, see the\n# documentation.\n# html_theme_options = {}\n\n# Add any paths that contain custom themes here, relative to this directory.\n# html_theme_path = []\n\n# The name for this set of Sphinx documents. If None, it defaults to\n# \" v documentation\".\n# html_title = None\n\n# A shorter title for the navigation bar. Default is the same as html_title.\n# html_short_title = None\n\n# The name of an image file (relative to this directory) to place at the top\n# of the sidebar.\n# html_logo = None\n\n# The name of an image file (within the static path) to use as favicon of the\n# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32\n# pixels large.\n# html_favicon = None\n\n# Add any paths that contain custom static files (such as style sheets) here,\n# relative to this directory. They are copied after the builtin static files,\n# so a file named \"default.css\" will overwrite the builtin \"default.css\".\nhtml_static_path = ['_static']\n\n# Add any extra paths that contain custom files (such as robots.txt or\n# .htaccess) here, relative to this directory. These files are copied\n# directly to the root of the documentation.\n# html_extra_path = []\n\n# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,\n# using the given strftime format.\n# html_last_updated_fmt = '%b %d, %Y'\n\n# If true, SmartyPants will be used to convert quotes and dashes to\n# typographically correct entities.\n# html_use_smartypants = True\n\n# Custom sidebar templates, maps document names to template names.\n# html_sidebars = {}\n\n# Additional templates that should be rendered to pages, maps page names to\n# template names.\n# html_additional_pages = {}\n\n# If false, no module index is generated.\n# html_domain_indices = True\n\n# If false, no index is generated.\n# html_use_index = True\n\n# If true, the index is split into individual pages for each letter.\n# html_split_index = False\n\n# If true, links to the reST sources are added to the pages.\n# html_show_sourcelink = True\n\n# If true, \"Created using Sphinx\" is shown in the HTML footer. Default is True.\n# html_show_sphinx = True\n\n# If true, \"(C) Copyright ...\" is shown in the HTML footer. Default is True.\n# html_show_copyright = True\n\n# If true, an OpenSearch description file will be output, and all pages will\n# contain a tag referring to it. The value of this option must be the\n# base URL from which the finished HTML is served.\n# html_use_opensearch = ''\n\n# This is the file name suffix for HTML files (e.g. \".xhtml\").\n# html_file_suffix = None\n\n# Output file base name for HTML help builder.\nhtmlhelp_basename = 'sshuttledoc'\n\n\n# -- Options for LaTeX output ---------------------------------------------\n\nlatex_elements = {\n # The paper size ('letterpaper' or 'a4paper').\n # 'papersize': 'letterpaper',\n\n # The font size ('10pt', '11pt' or '12pt').\n # 'pointsize': '10pt',\n\n # Additional stuff for the LaTeX preamble.\n # 'preamble': '',\n}\n\n# Grouping the document tree into LaTeX files. List of tuples\n# (source start file, target name, title,\n# author, documentclass [howto, manual, or own class]).\nlatex_documents = [\n ('index', 'sshuttle.tex', 'sshuttle documentation', 'Brian May', 'manual'),\n]\n\n# The name of an image file (relative to this directory) to place at the top of\n# the title page.\n# latex_logo = None\n\n# For \"manual\" documents, if this is true, then toplevel headings are parts,\n# not chapters.\n# latex_use_parts = False\n\n# If true, show page references after internal links.\n# latex_show_pagerefs = False\n\n# If true, show URL addresses after external links.\n# latex_show_urls = False\n\n# Documents to append as an appendix to all manuals.\n# latex_appendices = []\n\n# If false, no module index is generated.\n# latex_domain_indices = True\n\n\n# -- Options for manual page output ---------------------------------------\n\n# One entry per manual page. List of tuples\n# (source start file, name, description, authors, manual section).\nman_pages = [\n ('manpage', 'sshuttle', 'sshuttle documentation', ['Brian May'], 1)\n]\n\n# If true, show URL addresses after external links.\n# man_show_urls = False\n\n\n# -- Options for Texinfo output -------------------------------------------\n\n# Grouping the document tree into Texinfo files. List of tuples\n# (source start file, target name, title, author,\n# dir menu entry, description, category)\ntexinfo_documents = [\n ('index', 'sshuttle', 'sshuttle documentation',\n 'Brian May', 'sshuttle', 'A transparent proxy-based VPN using ssh',\n 'Miscellaneous'),\n]\n\n# Documents to append as an appendix to all manuals.\n# texinfo_appendices = []\n\n# If false, no module index is generated.\n# texinfo_domain_indices = True\n\n# How to display URL addresses: 'footnote', 'no', or 'inline'.\n# texinfo_show_urls = 'footnote'\n\n# If true, do not generate a @detailmenu in the \"Top\" node's menu.\n# texinfo_no_detailmenu = False\n" }, { "path": "docs/how-it-works.rst", "content": "How it works\n============\nsshuttle is not exactly a VPN, and not exactly port forwarding. It's kind\nof both, and kind of neither.\n\nIt's like a VPN, since it can forward every port on an entire network, not\njust ports you specify. Conveniently, it lets you use the \"real\" IP\naddresses of each host rather than faking port numbers on localhost.\n\nOn the other hand, the way it *works* is more like ssh port forwarding than\na VPN. Normally, a VPN forwards your data one packet at a time, and\ndoesn't care about individual connections; ie. it's \"stateless\" with respect\nto the traffic. sshuttle is the opposite of stateless; it tracks every\nsingle connection.\n\nYou could compare sshuttle to something like the old `Slirp\n`_ program, which was a userspace TCP/IP\nimplementation that did something similar. But it operated on a\npacket-by-packet basis on the client side, reassembling the packets on the\nserver side. That worked okay back in the \"real live serial port\" days,\nbecause serial ports had predictable latency and buffering.\n\nBut you can't safely just forward TCP packets over a TCP session (like ssh),\nbecause TCP's performance depends fundamentally on packet loss; it\n*must* experience packet loss in order to know when to slow down! At\nthe same time, the outer TCP session (ssh, in this case) is a reliable\ntransport, which means that what you forward through the tunnel *never*\nexperiences packet loss. The ssh session itself experiences packet loss, of\ncourse, but TCP fixes it up and ssh (and thus you) never know the\ndifference. But neither does your inner TCP session, and extremely screwy\nperformance ensues.\n\nsshuttle assembles the TCP stream locally, multiplexes it statefully over\nan ssh session, and disassembles it back into packets at the other end. So\nit never ends up doing TCP-over-TCP. It's just data-over-TCP, which is\nsafe.\n\n" }, { "path": "docs/index.rst", "content": "sshuttle: where transparent proxy meets VPN meets ssh\n=====================================================\n\n:Date: |today|\n:Version: |version|\n\nContents:\n\n.. toctree::\n :maxdepth: 2\n\n overview\n requirements\n installation\n usage\n platform\n Man Page \n how-it-works\n support\n trivia\n changes\n\n\nIndices and tables\n==================\n\n* :ref:`genindex`\n* :ref:`search`\n\n" }, { "path": "docs/installation.rst", "content": "Installation\n============\n\n- From PyPI::\n\n pip install sshuttle\n\n- Clone::\n\n git clone https://github.com/sshuttle/sshuttle.git\n ./setup.py install\n" }, { "path": "docs/make.bat", "content": "@ECHO OFF\r\n\r\nREM Command file for Sphinx documentation\r\n\r\nif \"%SPHINXBUILD%\" == \"\" (\r\n\tset SPHINXBUILD=sphinx-build\r\n)\r\nset BUILDDIR=_build\r\nset ALLSPHINXOPTS=-d %BUILDDIR%/doctrees %SPHINXOPTS% .\r\nset I18NSPHINXOPTS=%SPHINXOPTS% .\r\nif NOT \"%PAPER%\" == \"\" (\r\n\tset ALLSPHINXOPTS=-D latex_paper_size=%PAPER% %ALLSPHINXOPTS%\r\n\tset I18NSPHINXOPTS=-D latex_paper_size=%PAPER% %I18NSPHINXOPTS%\r\n)\r\n\r\nif \"%1\" == \"\" goto help\r\n\r\nif \"%1\" == \"help\" (\r\n\t:help\r\n\techo.Please use `make ^` where ^ is one of\r\n\techo. html to make standalone HTML files\r\n\techo. dirhtml to make HTML files named index.html in directories\r\n\techo. singlehtml to make a single large HTML file\r\n\techo. pickle to make pickle files\r\n\techo. json to make JSON files\r\n\techo. htmlhelp to make HTML files and a HTML help project\r\n\techo. qthelp to make HTML files and a qthelp project\r\n\techo. devhelp to make HTML files and a Devhelp project\r\n\techo. epub to make an epub\r\n\techo. latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter\r\n\techo. text to make text files\r\n\techo. man to make manual pages\r\n\techo. texinfo to make Texinfo files\r\n\techo. gettext to make PO message catalogs\r\n\techo. changes to make an overview over all changed/added/deprecated items\r\n\techo. xml to make Docutils-native XML files\r\n\techo. pseudoxml to make pseudoxml-XML files for display purposes\r\n\techo. linkcheck to check all external links for integrity\r\n\techo. doctest to run all doctests embedded in the documentation if enabled\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"clean\" (\r\n\tfor /d %%i in (%BUILDDIR%\\*) do rmdir /q /s %%i\r\n\tdel /q /s %BUILDDIR%\\*\r\n\tgoto end\r\n)\r\n\r\n\r\n%SPHINXBUILD% 2> nul\r\nif errorlevel 9009 (\r\n\techo.\r\n\techo.The 'sphinx-build' command was not found. Make sure you have Sphinx\r\n\techo.installed, then set the SPHINXBUILD environment variable to point\r\n\techo.to the full path of the 'sphinx-build' executable. Alternatively you\r\n\techo.may add the Sphinx directory to PATH.\r\n\techo.\r\n\techo.If you don't have Sphinx installed, grab it from\r\n\techo.http://sphinx-doc.org/\r\n\texit /b 1\r\n)\r\n\r\nif \"%1\" == \"html\" (\r\n\t%SPHINXBUILD% -b html %ALLSPHINXOPTS% %BUILDDIR%/html\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The HTML pages are in %BUILDDIR%/html.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"dirhtml\" (\r\n\t%SPHINXBUILD% -b dirhtml %ALLSPHINXOPTS% %BUILDDIR%/dirhtml\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The HTML pages are in %BUILDDIR%/dirhtml.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"singlehtml\" (\r\n\t%SPHINXBUILD% -b singlehtml %ALLSPHINXOPTS% %BUILDDIR%/singlehtml\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The HTML pages are in %BUILDDIR%/singlehtml.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"pickle\" (\r\n\t%SPHINXBUILD% -b pickle %ALLSPHINXOPTS% %BUILDDIR%/pickle\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished; now you can process the pickle files.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"json\" (\r\n\t%SPHINXBUILD% -b json %ALLSPHINXOPTS% %BUILDDIR%/json\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished; now you can process the JSON files.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"htmlhelp\" (\r\n\t%SPHINXBUILD% -b htmlhelp %ALLSPHINXOPTS% %BUILDDIR%/htmlhelp\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished; now you can run HTML Help Workshop with the ^\r\n.hhp project file in %BUILDDIR%/htmlhelp.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"qthelp\" (\r\n\t%SPHINXBUILD% -b qthelp %ALLSPHINXOPTS% %BUILDDIR%/qthelp\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished; now you can run \"qcollectiongenerator\" with the ^\r\n.qhcp project file in %BUILDDIR%/qthelp, like this:\r\n\techo.^> qcollectiongenerator %BUILDDIR%\\qthelp\\sshuttle.qhcp\r\n\techo.To view the help file:\r\n\techo.^> assistant -collectionFile %BUILDDIR%\\qthelp\\sshuttle.ghc\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"devhelp\" (\r\n\t%SPHINXBUILD% -b devhelp %ALLSPHINXOPTS% %BUILDDIR%/devhelp\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"epub\" (\r\n\t%SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The epub file is in %BUILDDIR%/epub.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"latex\" (\r\n\t%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished; the LaTeX files are in %BUILDDIR%/latex.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"latexpdf\" (\r\n\t%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex\r\n\tcd %BUILDDIR%/latex\r\n\tmake all-pdf\r\n\tcd %BUILDDIR%/..\r\n\techo.\r\n\techo.Build finished; the PDF files are in %BUILDDIR%/latex.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"latexpdfja\" (\r\n\t%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex\r\n\tcd %BUILDDIR%/latex\r\n\tmake all-pdf-ja\r\n\tcd %BUILDDIR%/..\r\n\techo.\r\n\techo.Build finished; the PDF files are in %BUILDDIR%/latex.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"text\" (\r\n\t%SPHINXBUILD% -b text %ALLSPHINXOPTS% %BUILDDIR%/text\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The text files are in %BUILDDIR%/text.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"man\" (\r\n\t%SPHINXBUILD% -b man %ALLSPHINXOPTS% %BUILDDIR%/man\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The manual pages are in %BUILDDIR%/man.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"texinfo\" (\r\n\t%SPHINXBUILD% -b texinfo %ALLSPHINXOPTS% %BUILDDIR%/texinfo\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The Texinfo files are in %BUILDDIR%/texinfo.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"gettext\" (\r\n\t%SPHINXBUILD% -b gettext %I18NSPHINXOPTS% %BUILDDIR%/locale\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The message catalogs are in %BUILDDIR%/locale.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"changes\" (\r\n\t%SPHINXBUILD% -b changes %ALLSPHINXOPTS% %BUILDDIR%/changes\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.The overview file is in %BUILDDIR%/changes.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"linkcheck\" (\r\n\t%SPHINXBUILD% -b linkcheck %ALLSPHINXOPTS% %BUILDDIR%/linkcheck\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Link check complete; look for any errors in the above output ^\r\nor in %BUILDDIR%/linkcheck/output.txt.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"doctest\" (\r\n\t%SPHINXBUILD% -b doctest %ALLSPHINXOPTS% %BUILDDIR%/doctest\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Testing of doctests in the sources finished, look at the ^\r\nresults in %BUILDDIR%/doctest/output.txt.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"xml\" (\r\n\t%SPHINXBUILD% -b xml %ALLSPHINXOPTS% %BUILDDIR%/xml\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The XML files are in %BUILDDIR%/xml.\r\n\tgoto end\r\n)\r\n\r\nif \"%1\" == \"pseudoxml\" (\r\n\t%SPHINXBUILD% -b pseudoxml %ALLSPHINXOPTS% %BUILDDIR%/pseudoxml\r\n\tif errorlevel 1 exit /b 1\r\n\techo.\r\n\techo.Build finished. The pseudo-XML files are in %BUILDDIR%/pseudoxml.\r\n\tgoto end\r\n)\r\n\r\n:end\r\n" }, { "path": "docs/manpage.rst", "content": "sshuttle\n========\n\n\nSynopsis\n--------\n**sshuttle** [*options*] [**-r** *[username@]sshserver[:port]*] \\<*subnets* ...\\>\n\n\nDescription\n-----------\n:program:`sshuttle` allows you to create a VPN connection from your\nmachine to any remote server that you can connect to via\nssh, as long as that server has python 2.3 or higher.\n\nTo work, you must have root access on the local machine,\nbut you can have a normal account on the server.\n\nIt's valid to run :program:`sshuttle` more than once simultaneously on\na single client machine, connecting to a different server\nevery time, so you can be on more than one VPN at once.\n\nIf run on a router, :program:`sshuttle` can forward traffic for your\nentire subnet to the VPN.\n\n\nOptions\n-------\n.. program:: sshuttle\n\n.. option:: subnets\n\n A list of subnets to route over the VPN, in the form\n ``a.b.c.d[/width]``. Valid examples are 1.2.3.4 (a\n single IP address), 1.2.3.4/32 (equivalent to 1.2.3.4),\n 1.2.3.0/24 (a 24-bit subnet, ie. with a 255.255.255.0\n netmask), and 0/0 ('just route everything through the\n VPN').\n\n.. option:: --method [auto|nat|tproxy|pf]\n\n Which firewall method should sshuttle use? For auto, sshuttle attempts to\n guess the appropriate method depending on what it can find in PATH. The\n default value is auto.\n\n.. option:: -l, --listen=[ip:]port\n\n Use this ip address and port number as the transparent\n proxy port. By default :program:`sshuttle` finds an available\n port automatically and listens on IP 127.0.0.1\n (localhost), so you don't need to override it, and\n connections are only proxied from the local machine,\n not from outside machines. If you want to accept\n connections from other machines on your network (ie. to\n run :program:`sshuttle` on a router) try enabling IP Forwarding in\n your kernel, then using ``--listen 0.0.0.0:0``.\n\n For the tproxy method this can be an IPv6 address. Use this option twice if\n required, to provide both IPv4 and IPv6 addresses.\n\n.. option:: -H, --auto-hosts\n\n Scan for remote hostnames and update the local /etc/hosts\n file with matching entries for as long as the VPN is\n open. This is nicer than changing your system's DNS\n (/etc/resolv.conf) settings, for several reasons. First,\n hostnames are added without domain names attached, so\n you can ``ssh thatserver`` without worrying if your local\n domain matches the remote one. Second, if you :program:`sshuttle`\n into more than one VPN at a time, it's impossible to\n use more than one DNS server at once anyway, but\n :program:`sshuttle` correctly merges /etc/hosts entries between\n all running copies. Third, if you're only routing a\n few subnets over the VPN, you probably would prefer to\n keep using your local DNS server for everything else.\n\n.. option:: -N, --auto-nets\n\n In addition to the subnets provided on the command\n line, ask the server which subnets it thinks we should\n route, and route those automatically. The suggestions\n are taken automatically from the server's routing\n table.\n\n.. option:: --dns\n\n Capture local DNS requests and forward to the remote DNS\n server.\n\n.. option:: --python\n\n Specify the name/path of the remote python interpreter.\n The default is just ``python``, which means to use the\n default python interpreter on the remote system's PATH.\n\n.. option:: -r, --remote=[username@]sshserver[:port]\n\n The remote hostname and optional username and ssh\n port number to use for connecting to the remote server.\n For example, example.com, testuser@example.com,\n testuser@example.com:2222, or example.com:2244.\n\n.. option:: -x, --exclude=subnet\n\n Explicitly exclude this subnet from forwarding. The\n format of this option is the same as the ````\n option. To exclude more than one subnet, specify the\n ``-x`` option more than once. You can say something like\n ``0/0 -x 1.2.3.0/24`` to forward everything except the\n local subnet over the VPN, for example.\n\n.. option:: -X, --exclude-from=file\n\n Exclude the subnets specified in a file, one subnet per\n line. Useful when you have lots of subnets to exclude.\n\n.. option:: -v, --verbose\n\n Print more information about the session. This option\n can be used more than once for increased verbosity. By\n default, :program:`sshuttle` prints only error messages.\n\n.. option:: -e, --ssh-cmd\n\n The command to use to connect to the remote server. The\n default is just ``ssh``. Use this if your ssh client is\n in a non-standard location or you want to provide extra\n options to the ssh command, for example, ``-e 'ssh -v'``.\n\n.. option:: --seed-hosts\n\n A comma-separated list of hostnames to use to\n initialize the :option:`--auto-hosts` scan algorithm.\n :option:`--auto-hosts` does things like poll local SMB servers\n for lists of local hostnames, but can speed things up\n if you use this option to give it a few names to start\n from.\n\n.. option:: --no-latency-control\n\n Sacrifice latency to improve bandwidth benchmarks. ssh\n uses really big socket buffers, which can overload the\n connection if you start doing large file transfers,\n thus making all your other sessions inside the same\n tunnel go slowly. Normally, :program:`sshuttle` tries to avoid\n this problem using a \"fullness check\" that allows only\n a certain amount of outstanding data to be buffered at\n a time. But on high-bandwidth links, this can leave a\n lot of your bandwidth underutilized. It also makes\n :program:`sshuttle` seem slow in bandwidth benchmarks (benchmarks\n rarely test ping latency, which is what :program:`sshuttle` is\n trying to control). This option disables the latency\n control feature, maximizing bandwidth usage. Use at\n your own risk.\n\n.. option:: -D, --daemon\n\n Automatically fork into the background after connecting\n to the remote server. Implies :option:`--syslog`.\n\n.. option:: --syslog\n\n after connecting, send all log messages to the\n :manpage:`syslog(3)` service instead of stderr. This is\n implicit if you use :option:`--daemon`.\n\n.. option:: --pidfile=pidfilename\n\n when using :option:`--daemon`, save :program:`sshuttle`'s pid to\n *pidfilename*. The default is ``sshuttle.pid`` in the\n current directory.\n\n.. option:: --disable-ipv6\n\n If using the tproxy method, this will disable IPv6 support.\n\n.. option:: --firewall\n\n (internal use only) run the firewall manager. This is\n the only part of :program:`sshuttle` that must run as root. If\n you start :program:`sshuttle` as a non-root user, it will\n automatically run ``sudo`` or ``su`` to start the firewall\n manager, but the core of :program:`sshuttle` still runs as a\n normal user.\n\n.. option:: --hostwatch\n\n (internal use only) run the hostwatch daemon. This\n process runs on the server side and collects hostnames for\n the :option:`--auto-hosts` option. Using this option by itself\n makes it a lot easier to debug and test the :option:`--auto-hosts`\n feature.\n\n\nExamples\n--------\nTest locally by proxying all local connections, without using ssh::\n\n $ sshuttle -v 0/0\n\n Starting sshuttle proxy.\n Listening on ('0.0.0.0', 12300).\n [local sudo] Password:\n firewall manager ready.\n c : connecting to server...\n s: available routes:\n s: 192.168.42.0/24\n c : connected.\n firewall manager: starting transproxy.\n c : Accept: 192.168.42.106:50035 -> 192.168.42.121:139.\n c : Accept: 192.168.42.121:47523 -> 77.141.99.22:443.\n ...etc...\n ^C\n firewall manager: undoing changes.\n KeyboardInterrupt\n c : Keyboard interrupt: exiting.\n c : SW#8:192.168.42.121:47523: deleting\n c : SW#6:192.168.42.106:50035: deleting\n\nTest connection to a remote server, with automatic hostname\nand subnet guessing::\n\n $ sshuttle -vNHr example.org\n\n Starting sshuttle proxy.\n Listening on ('0.0.0.0', 12300).\n firewall manager ready.\n c : connecting to server...\n s: available routes:\n s: 77.141.99.0/24\n c : connected.\n c : seed_hosts: []\n firewall manager: starting transproxy.\n hostwatch: Found: testbox1: 1.2.3.4\n hostwatch: Found: mytest2: 5.6.7.8\n hostwatch: Found: domaincontroller: 99.1.2.3\n c : Accept: 192.168.42.121:60554 -> 77.141.99.22:22.\n ^C\n firewall manager: undoing changes.\n c : Keyboard interrupt: exiting.\n c : SW#6:192.168.42.121:60554: deleting\n\n\nDiscussion\n----------\nWhen it starts, :program:`sshuttle` creates an ssh session to the\nserver specified by the ``-r`` option. If ``-r`` is omitted,\nit will start both its client and server locally, which is\nsometimes useful for testing.\n\nAfter connecting to the remote server, :program:`sshuttle` uploads its\n(python) source code to the remote end and executes it\nthere. Thus, you don't need to install :program:`sshuttle` on the\nremote server, and there are never :program:`sshuttle` version\nconflicts between client and server.\n\nUnlike most VPNs, :program:`sshuttle` forwards sessions, not packets.\nThat is, it uses kernel transparent proxying (`iptables\nREDIRECT` rules on Linux) to\ncapture outgoing TCP sessions, then creates entirely\nseparate TCP sessions out to the original destination at\nthe other end of the tunnel.\n\nPacket-level forwarding (eg. using the tun/tap devices on\nLinux) seems elegant at first, but it results in\nseveral problems, notably the 'tcp over tcp' problem. The\ntcp protocol depends fundamentally on packets being dropped\nin order to implement its congestion control agorithm; if\nyou pass tcp packets through a tcp-based tunnel (such as\nssh), the inner tcp packets will never be dropped, and so\nthe inner tcp stream's congestion control will be\ncompletely broken, and performance will be terrible. Thus,\npacket-based VPNs (such as IPsec and openvpn) cannot use\ntcp-based encrypted streams like ssh or ssl, and have to\nimplement their own encryption from scratch, which is very\ncomplex and error prone.\n\n:program:`sshuttle`'s simplicity comes from the fact that it can\nsafely use the existing ssh encrypted tunnel without\nincurring a performance penalty. It does this by letting\nthe client-side kernel manage the incoming tcp stream, and\nthe server-side kernel manage the outgoing tcp stream;\nthere is no need for congestion control to be shared\nbetween the two separate streams, so a tcp-based tunnel is\nfine.\n\n.. seealso::\n\n :manpage:`ssh(1)`, :manpage:`python(1)`\n" }, { "path": "docs/overview.rst", "content": "Overview\n========\n\nAs far as I know, sshuttle is the only program that solves the following\ncommon case:\n\n- Your client machine (or router) is Linux, FreeBSD, or MacOS.\n\n- You have access to a remote network via ssh.\n\n- You don't necessarily have admin access on the remote network.\n\n- The remote network has no VPN, or only stupid/complex VPN\n protocols (IPsec, PPTP, etc). Or maybe you *are* the\n admin and you just got frustrated with the awful state of\n VPN tools.\n\n- You don't want to create an ssh port forward for every\n single host/port on the remote network.\n\n- You hate openssh's port forwarding because it's randomly\n slow and/or stupid.\n\n- You can't use openssh's PermitTunnel feature because\n it's disabled by default on openssh servers; plus it does\n TCP-over-TCP, which has terrible performance (see below).\n" }, { "path": "docs/platform.rst", "content": "Platform Specific Notes\n=======================\n\nContents:\n\n.. toctree::\n :maxdepth: 2\n\n tproxy\n windows\n" }, { "path": "docs/requirements.rst", "content": "Requirements\n============\n\nClient side Requirements\n------------------------\n\n- sudo, or root access on your client machine.\n (The server doesn't need admin access.)\n- Python 2.7 or Python 3.5.\n\n\nLinux with NAT method\n~~~~~~~~~~~~~~~~~~~~~\nSupports:\n\n* IPv4 TCP\n* IPv4 DNS\n\nRequires:\n\n* iptables DNAT, REDIRECT, and ttl modules.\n\n\nLinux with TPROXY method\n~~~~~~~~~~~~~~~~~~~~~~~~\nSupports:\n\n* IPv4 TCP\n* IPv4 UDP (requires ``recmsg`` - see below)\n* IPv6 DNS (requires ``recmsg`` - see below)\n* IPv6 TCP\n* IPv6 UDP (requires ``recmsg`` - see below)\n* IPv6 DNS (requires ``recmsg`` - see below)\n\n.. _PyXAPI: http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/\n\nFull UDP or DNS support with the TPROXY method requires the ``recvmsg()``\nsyscall. This is not available in Python 2, however is in Python 3.5 and\nlater. Under Python 2 you might find it sufficient installing PyXAPI_ to get\nthe ``recvmsg()`` function. See :doc:`tproxy` for more information.\n\n\nMacOS / FreeBSD / OpenBSD\n~~~~~~~~~~~~~~~~~~~~~~~~~\nMethod: pf\n\nSupports:\n\n* IPv4 TCP\n* IPv4 DNS\n\nRequires:\n\n* You need to have the pfctl command.\n\nWindows\n~~~~~~~\n\nNot officially supported, however can be made to work with Vagrant. Requires\ncmd.exe with Administrator access. See :doc:`windows` for more information.\n\n\nServer side Requirements\n------------------------\nPython 2.7 or Python 3.5.\n\n\nAdditional Suggested Software\n-----------------------------\n\n- You may want to use autossh, available in various package management\n systems\n" }, { "path": "docs/support.rst", "content": "Support\n=======\n\nMailing list:\n\n* Subscribe by sending a message to \n* List archives are at: http://groups.google.com/group/sshuttle\n\nIssue tracker and pull requests at github:\n\n* https://github.com/sshuttle/sshuttle\n" }, { "path": "docs/tproxy.rst", "content": "TPROXY\n======\nTPROXY is the only method that has full support of IPv6 and UDP.\n\nThere are some things you need to consider for TPROXY to work:\n\n- The following commands need to be run first as root. This only needs to be\n done once after booting up::\n\n ip route add local default dev lo table 100\n ip rule add fwmark 1 lookup 100\n ip -6 route add local default dev lo table 100\n ip -6 rule add fwmark 1 lookup 100\n\n- The ``--auto-nets`` feature does not detect IPv6 routes automatically. Add IPv6\n routes manually. e.g. by adding ``'::/0'`` to the end of the command line.\n\n- The client needs to be run as root. e.g.::\n\n sudo SSH_AUTH_SOCK=\"$SSH_AUTH_SOCK\" $HOME/tree/sshuttle.tproxy/sshuttle --method=tproxy ...\n\n- You may need to exclude the IP address of the server you are connecting to.\n Otherwise sshuttle may attempt to intercept the ssh packets, which will not\n work. Use the ``--exclude`` parameter for this.\n\n- Similarly, UDP return packets (including DNS) could get intercepted and\n bounced back. This is the case if you have a broad subnet such as\n ``0.0.0.0/0`` or ``::/0`` that includes the IP address of the client. Use the\n ``--exclude`` parameter for this.\n\n- You need the ``--method=tproxy`` parameter, as above.\n\n- The routes for the outgoing packets must already exist. For example, if your\n connection does not have IPv6 support, no IPv6 routes will exist, IPv6\n packets will not be generated and sshuttle cannot intercept them::\n\n telnet -6 www.google.com 80\n Trying 2404:6800:4001:805::1010...\n telnet: Unable to connect to remote host: Network is unreachable\n\n Add some dummy routes to external interfaces. Make sure they get removed\n however after sshuttle exits.\n" }, { "path": "docs/trivia.rst", "content": "Useless Trivia\n==============\nThis section written by the original author, Avery Pennarun\n.\n\nBack in 1998, I released the first version of `Tunnel\nVision `_, a semi-intelligent VPN\nclient for Linux. Unfortunately, I made two big mistakes: I implemented the\nkey exchange myself (oops), and I ended up doing TCP-over-TCP (double oops).\nThe resulting program worked okay - and people used it for years - but the\nperformance was always a bit funny. And nobody ever found any security flaws\nin my key exchange, either, but that doesn't mean anything. :)\n\nThe same year, dcoombs and I also released Fast Forward, a proxy server\nsupporting transparent proxying. Among other things, we used it for\nautomatically splitting traffic across more than one Internet connection (a\ntool we called \"Double Vision\").\n\nI was still in university at the time. A couple years after that, one of my\nprofessors was working with some graduate students on the technology that would\neventually become `Slipstream Internet Acceleration\n`_. He asked me to do a contract for him to build\nan initial prototype of a transparent proxy server for mobile networks. The\nidea was similar to sshuttle: if you reassemble and then disassemble the TCP\npackets, you can reduce latency and improve performance vs. just forwarding\nthe packets over a plain VPN or mobile network. (It's unlikely that any of my\ncode has persisted in the Slipstream product today, but the concept is still\npretty cool. I'm still horrified that people use plain TCP on complex mobile\nnetworks with crazily variable latency, for which it was never really\nintended.)\n\nThat project I did for Slipstream was what first gave me the idea to merge\nthe concepts of Fast Forward, Double Vision, and Tunnel Vision into a single\nprogram that was the best of all worlds. And here we are, at last.\nYou're welcome.\n\n" }, { "path": "docs/usage.rst", "content": "Usage\n=====\n\n.. note::\n\n For information on usage with Windows, see the :doc:`windows` section.\n For information on using the TProxy method, see the :doc:`tproxy` section.\n\nForward all traffic::\n\n sshuttle -r username@sshserver 0.0.0.0/0\n\n- Use the :option:`sshuttle -r` parameter to specify a remote server.\n\n- By default sshuttle will automatically choose a method to use. Override with\n the :option:`sshuttle --method` parameter.\n\n- There is a shortcut for 0.0.0.0/0 for those that value\n their wrists::\n\n sshuttle -r username@sshserver 0/0\n\nIf you would also like your DNS queries to be proxied\nthrough the DNS server of the server you are connect to::\n\n sshuttle --dns -r username@sshserver 0/0\n\nThe above is probably what you want to use to prevent\nlocal network attacks such as Firesheep and friends.\nSee the documentation for the :option:`sshuttle --dns` parameter.\n\n(You may be prompted for one or more passwords; first, the local password to\nbecome root using sudo, and then the remote ssh password. Or you might have\nsudo and ssh set up to not require passwords, in which case you won't be\nprompted at all.)\n\n\nUsage Notes\n-----------\nThat's it! Now your local machine can access the remote network as if you\nwere right there. And if your \"client\" machine is a router, everyone on\nyour local network can make connections to your remote network.\n\nYou don't need to install sshuttle on the remote server;\nthe remote server just needs to have python available. \nsshuttle will automatically upload and run its source code\nto the remote python interpreter.\n\nThis creates a transparent proxy server on your local machine for all IP\naddresses that match 0.0.0.0/0. (You can use more specific IP addresses if\nyou want; use any number of IP addresses or subnets to change which\naddresses get proxied. Using 0.0.0.0/0 proxies *everything*, which is\ninteresting if you don't trust the people on your local network.)\n\nAny TCP session you initiate to one of the proxied IP addresses will be\ncaptured by sshuttle and sent over an ssh session to the remote copy of\nsshuttle, which will then regenerate the connection on that end, and funnel\nthe data back and forth through ssh.\n\nFun, right? A poor man's instant VPN, and you don't even have to have\nadmin access on the server.\n\n" }, { "path": "docs/windows.rst", "content": "Microsoft Windows\n=================\nCurrently there is no built in support for running sshuttle directly on\nMicrosoft Windows.\n\nWhat we can really do is to create a Linux VM with Vagrant (or simply\nVirtualbox if you like). In the Vagrant settings, remember to turn on bridged\nNIC. Then, run sshuttle inside the VM like below::\n\n sshuttle -l 0.0.0.0 -x 10.0.0.0/8 -x 192.168.0.0/16 0/0\n\n10.0.0.0/8 excludes NAT traffic of Vagrant and 192.168.0.0/16 excludes\ntraffic to local area network (assuming that we're using 192.168.0.0 subnet).\n\nAssuming the VM has the IP 192.168.1.200 obtained on the bridge NIC (we can\nconfigure that in Vagrant), we can then ask Windows to route all its traffic\nvia the VM by running the following in cmd.exe with admin right::\n\n route add 0.0.0.0 mask 0.0.0.0 192.168.1.200\n" }, { "path": "requirements.txt", "content": "setuptools_scm\n" }, { "path": "run", "content": "#!/bin/sh\nif python3.5 -V 2>/dev/null; then\n\texec python3.5 -m \"sshuttle\" \"$@\"\nelse\n\texec python -m \"sshuttle\" \"$@\"\nfi\n" }, { "path": "setup.py", "content": "#!/usr/bin/env python\n\n# Copyright 2012-2014 Brian May\n#\n# This file is part of python-tldap.\n#\n# python-tldap is free software: you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation, either version 3 of the License, or\n# (at your option) any later version.\n#\n# python-tldap is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with python-tldap If not, see .\n\nfrom setuptools import setup, find_packages\n\n\ndef version_scheme(version):\n from setuptools_scm.version import guess_next_dev_version\n version = guess_next_dev_version(version)\n return version.lstrip(\"v\")\n\nsetup(\n name=\"sshuttle\",\n use_scm_version={\n 'write_to': \"sshuttle/version.py\",\n 'version_scheme': version_scheme,\n },\n setup_requires=['setuptools_scm'],\n # version=version,\n url='https://github.com/sshuttle/sshuttle',\n author='Brian May',\n author_email='brian@linuxpenguins.xyz',\n description='Full-featured\" VPN over an SSH tunnel',\n packages=find_packages(),\n license=\"GPL2+\",\n long_description=open('README.rst').read(),\n classifiers=[\n \"Development Status :: 5 - Production/Stable\",\n \"Intended Audience :: Developers\",\n \"Intended Audience :: End Users/Desktop\",\n \"License :: OSI Approved :: \"\n \"GNU General Public License v2 or later (GPLv2+)\",\n \"Operating System :: OS Independent\",\n \"Programming Language :: Python :: 2.7\",\n \"Programming Language :: Python :: 3.5\",\n \"Topic :: System :: Networking\",\n ],\n entry_points={\n 'console_scripts': [\n 'sshuttle = sshuttle.cmdline:main',\n ],\n },\n tests_require=['pytest', 'mock'],\n keywords=\"ssh vpn\",\n)\n" }, { "path": "sshuttle/__init__.py", "content": "" }, { "path": "sshuttle/__main__.py", "content": "\"\"\"Coverage.py's main entry point.\"\"\"\nimport sys\nfrom sshuttle.cmdline import main\nsys.exit(main())\n" }, { "path": "sshuttle/assembler.py", "content": "import sys\nimport zlib\nimport imp\n\nz = zlib.decompressobj()\nwhile 1:\n name = stdin.readline().strip()\n if name:\n name = name.decode(\"ASCII\")\n\n nbytes = int(stdin.readline())\n if verbosity >= 2:\n sys.stderr.write('server: assembling %r (%d bytes)\\n'\n % (name, nbytes))\n content = z.decompress(stdin.read(nbytes))\n\n module = imp.new_module(name)\n parent, _, parent_name = name.rpartition(\".\")\n if parent != \"\":\n setattr(sys.modules[parent], parent_name, module)\n\n code = compile(content, name, \"exec\")\n exec(code, module.__dict__)\n sys.modules[name] = module\n else:\n break\n\nsys.stderr.flush()\nsys.stdout.flush()\n\nimport sshuttle.helpers\nsshuttle.helpers.verbose = verbosity\n\nimport sshuttle.cmdline_options as options\nfrom sshuttle.server import main\nmain(options.latency_control)\n" }, { "path": "sshuttle/client.py", "content": "import socket\nimport errno\nimport re\nimport signal\nimport time\nimport subprocess as ssubprocess\nimport sshuttle.helpers as helpers\nimport os\nimport sshuttle.ssnet as ssnet\nimport sshuttle.ssh as ssh\nimport sshuttle.ssyslog as ssyslog\nimport sys\nimport platform\nfrom sshuttle.ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper\nfrom sshuttle.helpers import log, debug1, debug2, debug3, Fatal, islocal, \\\n resolvconf_nameservers\nfrom sshuttle.methods import get_method, Features\n\n_extra_fd = os.open('/dev/null', os.O_RDONLY)\n\n\ndef got_signal(signum, frame):\n log('exiting on signal %d\\n' % signum)\n sys.exit(1)\n\n\n_pidname = None\n\n\ndef check_daemon(pidfile):\n global _pidname\n _pidname = os.path.abspath(pidfile)\n try:\n oldpid = open(_pidname).read(1024)\n except IOError as e:\n if e.errno == errno.ENOENT:\n return # no pidfile, ok\n else:\n raise Fatal(\"can't read %s: %s\" % (_pidname, e))\n if not oldpid:\n os.unlink(_pidname)\n return # invalid pidfile, ok\n oldpid = int(oldpid.strip() or 0)\n if oldpid <= 0:\n os.unlink(_pidname)\n return # invalid pidfile, ok\n try:\n os.kill(oldpid, 0)\n except OSError as e:\n if e.errno == errno.ESRCH:\n os.unlink(_pidname)\n return # outdated pidfile, ok\n elif e.errno == errno.EPERM:\n pass\n else:\n raise\n raise Fatal(\"%s: sshuttle is already running (pid=%d)\"\n % (_pidname, oldpid))\n\n\ndef daemonize():\n if os.fork():\n os._exit(0)\n os.setsid()\n if os.fork():\n os._exit(0)\n\n outfd = os.open(_pidname, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o666)\n try:\n os.write(outfd, b'%d\\n' % os.getpid())\n finally:\n os.close(outfd)\n os.chdir(\"/\")\n\n # Normal exit when killed, or try/finally won't work and the pidfile won't\n # be deleted.\n signal.signal(signal.SIGTERM, got_signal)\n\n si = open('/dev/null', 'r+')\n os.dup2(si.fileno(), 0)\n os.dup2(si.fileno(), 1)\n si.close()\n\n\ndef daemon_cleanup():\n try:\n os.unlink(_pidname)\n except OSError as e:\n if e.errno == errno.ENOENT:\n pass\n else:\n raise\n\n\nclass MultiListener:\n\n def __init__(self, type=socket.SOCK_STREAM, proto=0):\n self.type = type\n self.proto = proto\n self.v6 = None\n self.v4 = None\n self.bind_called = False\n\n def setsockopt(self, level, optname, value):\n assert(self.bind_called)\n if self.v6:\n self.v6.setsockopt(level, optname, value)\n if self.v4:\n self.v4.setsockopt(level, optname, value)\n\n def add_handler(self, handlers, callback, method, mux):\n assert(self.bind_called)\n socks = []\n if self.v6:\n socks.append(self.v6)\n if self.v4:\n socks.append(self.v4)\n\n handlers.append(\n Handler(\n socks,\n lambda sock: callback(sock, method, mux, handlers)\n )\n )\n\n def listen(self, backlog):\n assert(self.bind_called)\n if self.v6:\n self.v6.listen(backlog)\n if self.v4:\n try:\n self.v4.listen(backlog)\n except socket.error as e:\n # on some systems v4 bind will fail if the v6 suceeded,\n # in this case the v6 socket will receive v4 too.\n if e.errno == errno.EADDRINUSE and self.v6:\n self.v4 = None\n else:\n raise e\n\n def bind(self, address_v6, address_v4):\n assert(not self.bind_called)\n self.bind_called = True\n if address_v6 is not None:\n self.v6 = socket.socket(socket.AF_INET6, self.type, self.proto)\n self.v6.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n self.v6.bind(address_v6)\n else:\n self.v6 = None\n if address_v4 is not None:\n self.v4 = socket.socket(socket.AF_INET, self.type, self.proto)\n self.v4.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n self.v4.bind(address_v4)\n else:\n self.v4 = None\n\n def print_listening(self, what):\n assert(self.bind_called)\n if self.v6:\n listenip = self.v6.getsockname()\n debug1('%s listening on %r.\\n' % (what, listenip))\n debug2('%s listening with %r.\\n' % (what, self.v6))\n if self.v4:\n listenip = self.v4.getsockname()\n debug1('%s listening on %r.\\n' % (what, listenip))\n debug2('%s listening with %r.\\n' % (what, self.v4))\n\n\nclass FirewallClient:\n\n def __init__(self, method_name):\n self.auto_nets = []\n python_path = os.path.dirname(os.path.dirname(__file__))\n argvbase = ([sys.executable, sys.argv[0]] +\n ['-v'] * (helpers.verbose or 0) +\n ['--method', method_name] +\n ['--firewall'])\n if ssyslog._p:\n argvbase += ['--syslog']\n argv_tries = [\n ['sudo', '-p', '[local sudo] Password: ',\n ('PYTHONPATH=%s' % python_path), '--'] + argvbase,\n argvbase\n ]\n\n # we can't use stdin/stdout=subprocess.PIPE here, as we normally would,\n # because stupid Linux 'su' requires that stdin be attached to a tty.\n # Instead, attach a *bidirectional* socket to its stdout, and use\n # that for talking in both directions.\n (s1, s2) = socket.socketpair()\n\n def setup():\n # run in the child process\n s2.close()\n e = None\n if os.getuid() == 0:\n argv_tries = argv_tries[-1:] # last entry only\n for argv in argv_tries:\n try:\n if argv[0] == 'su':\n sys.stderr.write('[local su] ')\n self.p = ssubprocess.Popen(argv, stdout=s1, preexec_fn=setup)\n e = None\n break\n except OSError as e:\n pass\n self.argv = argv\n s1.close()\n if sys.version_info < (3, 0):\n # python 2.7\n self.pfile = s2.makefile('wb+')\n else:\n # python 3.5\n self.pfile = s2.makefile('rwb')\n if e:\n log('Spawning firewall manager: %r\\n' % self.argv)\n raise Fatal(e)\n line = self.pfile.readline()\n self.check()\n if line[0:5] != b'READY':\n raise Fatal('%r expected READY, got %r' % (self.argv, line))\n method_name = line[6:-1]\n self.method = get_method(method_name.decode(\"ASCII\"))\n self.method.set_firewall(self)\n\n def setup(self, subnets_include, subnets_exclude, nslist,\n redirectport_v6, redirectport_v4, dnsport_v6, dnsport_v4, udp):\n self.subnets_include = subnets_include\n self.subnets_exclude = subnets_exclude\n self.nslist = nslist\n self.redirectport_v6 = redirectport_v6\n self.redirectport_v4 = redirectport_v4\n self.dnsport_v6 = dnsport_v6\n self.dnsport_v4 = dnsport_v4\n self.udp = udp\n\n def check(self):\n rv = self.p.poll()\n if rv:\n raise Fatal('%r returned %d' % (self.argv, rv))\n\n def start(self):\n self.pfile.write(b'ROUTES\\n')\n for (family, ip, width) in self.subnets_include + self.auto_nets:\n self.pfile.write(b'%d,%d,0,%s\\n'\n % (family, width, ip.encode(\"ASCII\")))\n for (family, ip, width) in self.subnets_exclude:\n self.pfile.write(b'%d,%d,1,%s\\n'\n % (family, width, ip.encode(\"ASCII\")))\n\n self.pfile.write(b'NSLIST\\n')\n for (family, ip) in self.nslist:\n self.pfile.write(b'%d,%s\\n'\n % (family, ip.encode(\"ASCII\")))\n\n self.pfile.write(\n b'PORTS %d,%d,%d,%d\\n'\n % (self.redirectport_v6, self.redirectport_v4,\n self.dnsport_v6, self.dnsport_v4))\n\n udp = 0\n if self.udp:\n udp = 1\n\n self.pfile.write(b'GO %d\\n' % udp)\n self.pfile.flush()\n\n line = self.pfile.readline()\n self.check()\n if line != b'STARTED\\n':\n raise Fatal('%r expected STARTED, got %r' % (self.argv, line))\n\n def sethostip(self, hostname, ip):\n assert(not re.search(b'[^-\\w]', hostname))\n assert(not re.search(b'[^0-9.]', ip))\n self.pfile.write(b'HOST %s,%s\\n' % (hostname, ip))\n self.pfile.flush()\n\n def done(self):\n self.pfile.close()\n rv = self.p.wait()\n if rv:\n raise Fatal('cleanup: %r returned %d' % (self.argv, rv))\n\n\ndnsreqs = {}\nudp_by_src = {}\n\n\ndef expire_connections(now, mux):\n remove = []\n for chan, timeout in dnsreqs.items():\n if timeout < now:\n debug3('expiring dnsreqs channel=%d\\n' % chan)\n remove.append(chan)\n del mux.channels[chan]\n for chan in remove:\n del dnsreqs[chan]\n debug3('Remaining DNS requests: %d\\n' % len(dnsreqs))\n\n remove = []\n for peer, (chan, timeout) in udp_by_src.items():\n if timeout < now:\n debug3('expiring UDP channel channel=%d peer=%r\\n' % (chan, peer))\n mux.send(chan, ssnet.CMD_UDP_CLOSE, b'')\n remove.append(peer)\n del mux.channels[chan]\n for peer in remove:\n del udp_by_src[peer]\n debug3('Remaining UDP channels: %d\\n' % len(udp_by_src))\n\n\ndef onaccept_tcp(listener, method, mux, handlers):\n global _extra_fd\n try:\n sock, srcip = listener.accept()\n except socket.error as e:\n if e.args[0] in [errno.EMFILE, errno.ENFILE]:\n debug1('Rejected incoming connection: too many open files!\\n')\n # free up an fd so we can eat the connection\n os.close(_extra_fd)\n try:\n sock, srcip = listener.accept()\n sock.close()\n finally:\n _extra_fd = os.open('/dev/null', os.O_RDONLY)\n return\n else:\n raise\n\n dstip = method.get_tcp_dstip(sock)\n debug1('Accept TCP: %s:%r -> %s:%r.\\n' % (srcip[0], srcip[1],\n dstip[0], dstip[1]))\n if dstip[1] == sock.getsockname()[1] and islocal(dstip[0], sock.family):\n debug1(\"-- ignored: that's my address!\\n\")\n sock.close()\n return\n chan = mux.next_channel()\n if not chan:\n log('warning: too many open channels. Discarded connection.\\n')\n sock.close()\n return\n mux.send(chan, ssnet.CMD_TCP_CONNECT, b'%d,%s,%d' %\n (sock.family, dstip[0].encode(\"ASCII\"), dstip[1]))\n outwrap = MuxWrapper(mux, chan)\n handlers.append(Proxy(SockWrapper(sock, sock), outwrap))\n expire_connections(time.time(), mux)\n\n\ndef udp_done(chan, data, method, sock, dstip):\n (src, srcport, data) = data.split(b\",\", 2)\n srcip = (src, int(srcport))\n debug3('doing send from %r to %r\\n' % (srcip, dstip,))\n method.send_udp(sock, srcip, dstip, data)\n\n\ndef onaccept_udp(listener, method, mux, handlers):\n now = time.time()\n t = method.recv_udp(listener, 4096)\n if t is None:\n return\n srcip, dstip, data = t\n debug1('Accept UDP: %r -> %r.\\n' % (srcip, dstip,))\n if srcip in udp_by_src:\n chan, timeout = udp_by_src[srcip]\n else:\n chan = mux.next_channel()\n mux.channels[chan] = lambda cmd, data: udp_done(\n chan, data, method, listener, dstip=srcip)\n mux.send(chan, ssnet.CMD_UDP_OPEN, b\"%d\" % listener.family)\n udp_by_src[srcip] = chan, now + 30\n\n hdr = b\"%s,%d,\" % (dstip[0].encode(\"ASCII\"), dstip[1])\n mux.send(chan, ssnet.CMD_UDP_DATA, hdr + data)\n\n expire_connections(now, mux)\n\n\ndef dns_done(chan, data, method, sock, srcip, dstip, mux):\n debug3('dns_done: channel=%d src=%r dst=%r\\n' % (chan, srcip, dstip))\n del mux.channels[chan]\n del dnsreqs[chan]\n method.send_udp(sock, srcip, dstip, data)\n\n\ndef ondns(listener, method, mux, handlers):\n now = time.time()\n t = method.recv_udp(listener, 4096)\n if t is None:\n return\n srcip, dstip, data = t\n debug1('DNS request from %r to %r: %d bytes\\n' % (srcip, dstip, len(data)))\n chan = mux.next_channel()\n dnsreqs[chan] = now + 30\n mux.send(chan, ssnet.CMD_DNS_REQ, data)\n mux.channels[chan] = lambda cmd, data: dns_done(\n chan, data, method, listener, srcip=dstip, dstip=srcip, mux=mux)\n expire_connections(now, mux)\n\n\ndef _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,\n python, latency_control,\n dns_listener, seed_hosts, auto_nets, daemon):\n\n debug1('Starting client with Python version %s\\n'\n % platform.python_version())\n\n method = fw.method\n\n handlers = []\n if helpers.verbose >= 1:\n helpers.logprefix = 'c : '\n else:\n helpers.logprefix = 'client: '\n debug1('connecting to server...\\n')\n\n try:\n (serverproc, serversock) = ssh.connect(\n ssh_cmd, remotename, python,\n stderr=ssyslog._p and ssyslog._p.stdin,\n options=dict(latency_control=latency_control))\n except socket.error as e:\n if e.args[0] == errno.EPIPE:\n raise Fatal(\"failed to establish ssh session (1)\")\n else:\n raise\n mux = Mux(serversock, serversock)\n handlers.append(mux)\n\n expected = b'SSHUTTLE0001'\n\n try:\n v = 'x'\n while v and v != b'\\0':\n v = serversock.recv(1)\n v = 'x'\n while v and v != b'\\0':\n v = serversock.recv(1)\n initstring = serversock.recv(len(expected))\n except socket.error as e:\n if e.args[0] == errno.ECONNRESET:\n raise Fatal(\"failed to establish ssh session (2)\")\n else:\n raise\n\n rv = serverproc.poll()\n if rv:\n raise Fatal('server died with error code %d' % rv)\n\n if initstring != expected:\n raise Fatal('expected server init string %r; got %r'\n % (expected, initstring))\n log('Connected.\\n')\n sys.stdout.flush()\n if daemon:\n daemonize()\n log('daemonizing (%s).\\n' % _pidname)\n\n def onroutes(routestr):\n if auto_nets:\n for line in routestr.strip().split(b'\\n'):\n (family, ip, width) = line.split(b',', 2)\n family = int(family)\n width = int(width)\n ip = ip.decode(\"ASCII\")\n if family == socket.AF_INET6 and tcp_listener.v6 is None:\n debug2(\"Ignored auto net %d/%s/%d\\n\" % (family, ip, width))\n if family == socket.AF_INET and tcp_listener.v4 is None:\n debug2(\"Ignored auto net %d/%s/%d\\n\" % (family, ip, width))\n else:\n debug2(\"Adding auto net %d/%s/%d\\n\" % (family, ip, width))\n fw.auto_nets.append((family, ip, width))\n\n # we definitely want to do this *after* starting ssh, or we might end\n # up intercepting the ssh connection!\n #\n # Moreover, now that we have the --auto-nets option, we have to wait\n # for the server to send us that message anyway. Even if we haven't\n # set --auto-nets, we might as well wait for the message first, then\n # ignore its contents.\n mux.got_routes = None\n fw.start()\n mux.got_routes = onroutes\n\n def onhostlist(hostlist):\n debug2('got host list: %r\\n' % hostlist)\n for line in hostlist.strip().split():\n if line:\n name, ip = line.split(b',', 1)\n fw.sethostip(name, ip)\n mux.got_host_list = onhostlist\n\n tcp_listener.add_handler(handlers, onaccept_tcp, method, mux)\n\n if udp_listener:\n udp_listener.add_handler(handlers, onaccept_udp, method, mux)\n\n if dns_listener:\n dns_listener.add_handler(handlers, ondns, method, mux)\n\n if seed_hosts is not None:\n debug1('seed_hosts: %r\\n' % seed_hosts)\n mux.send(0, ssnet.CMD_HOST_REQ, str.encode('\\n'.join(seed_hosts)))\n\n while 1:\n rv = serverproc.poll()\n if rv:\n raise Fatal('server died with error code %d' % rv)\n\n ssnet.runonce(handlers, mux)\n if latency_control:\n mux.check_fullness()\n\n\ndef main(listenip_v6, listenip_v4,\n ssh_cmd, remotename, python, latency_control, dns, nslist,\n method_name, seed_hosts, auto_nets,\n subnets_include, subnets_exclude, daemon, pidfile):\n\n if daemon:\n try:\n check_daemon(pidfile)\n except Fatal as e:\n log(\"%s\\n\" % e)\n return 5\n debug1('Starting sshuttle proxy.\\n')\n\n fw = FirewallClient(method_name)\n\n # Get family specific subnet lists\n if dns:\n nslist += resolvconf_nameservers()\n\n subnets = subnets_include + subnets_exclude # we don't care here\n subnets_v6 = [i for i in subnets if i[0] == socket.AF_INET6]\n nslist_v6 = [i for i in nslist if i[0] == socket.AF_INET6]\n subnets_v4 = [i for i in subnets if i[0] == socket.AF_INET]\n nslist_v4 = [i for i in nslist if i[0] == socket.AF_INET]\n\n # Check features available\n avail = fw.method.get_supported_features()\n required = Features()\n\n if listenip_v6 == \"auto\":\n if avail.ipv6:\n listenip_v6 = ('::1', 0)\n else:\n listenip_v6 = None\n\n required.ipv6 = len(subnets_v6) > 0 or len(nslist_v6) > 0 \\\n or listenip_v6 is not None\n required.udp = avail.udp\n required.dns = len(nslist) > 0\n\n fw.method.assert_features(required)\n\n if required.ipv6 and listenip_v6 is None:\n raise Fatal(\"IPv6 required but not listening.\")\n\n # display features enabled\n debug1(\"IPv6 enabled: %r\\n\" % required.ipv6)\n debug1(\"UDP enabled: %r\\n\" % required.udp)\n debug1(\"DNS enabled: %r\\n\" % required.dns)\n\n # bind to required ports\n if listenip_v4 == \"auto\":\n listenip_v4 = ('127.0.0.1', 0)\n\n if listenip_v6 and listenip_v6[1] and listenip_v4 and listenip_v4[1]:\n # if both ports given, no need to search for a spare port\n ports = [0, ]\n else:\n # if at least one port missing, we have to search\n ports = range(12300, 9000, -1)\n\n # search for free ports and try to bind\n last_e = None\n redirectport_v6 = 0\n redirectport_v4 = 0\n bound = False\n debug2('Binding redirector:')\n for port in ports:\n debug2(' %d' % port)\n tcp_listener = MultiListener()\n\n if required.udp:\n udp_listener = MultiListener(socket.SOCK_DGRAM)\n else:\n udp_listener = None\n\n if listenip_v6 and listenip_v6[1]:\n lv6 = listenip_v6\n redirectport_v6 = lv6[1]\n elif listenip_v6:\n lv6 = (listenip_v6[0], port)\n redirectport_v6 = port\n else:\n lv6 = None\n redirectport_v6 = 0\n\n if listenip_v4 and listenip_v4[1]:\n lv4 = listenip_v4\n redirectport_v4 = lv4[1]\n elif listenip_v4:\n lv4 = (listenip_v4[0], port)\n redirectport_v4 = port\n else:\n lv4 = None\n redirectport_v4 = 0\n\n try:\n tcp_listener.bind(lv6, lv4)\n if udp_listener:\n udp_listener.bind(lv6, lv4)\n bound = True\n break\n except socket.error as e:\n if e.errno == errno.EADDRINUSE:\n last_e = e\n else:\n raise e\n\n debug2('\\n')\n if not bound:\n assert(last_e)\n raise last_e\n tcp_listener.listen(10)\n tcp_listener.print_listening(\"TCP redirector\")\n if udp_listener:\n udp_listener.print_listening(\"UDP redirector\")\n\n bound = False\n if required.dns:\n # search for spare port for DNS\n debug2('Binding DNS:')\n ports = range(12300, 9000, -1)\n for port in ports:\n debug2(' %d' % port)\n dns_listener = MultiListener(socket.SOCK_DGRAM)\n\n if listenip_v6:\n lv6 = (listenip_v6[0], port)\n dnsport_v6 = port\n else:\n lv6 = None\n dnsport_v6 = 0\n\n if listenip_v4:\n lv4 = (listenip_v4[0], port)\n dnsport_v4 = port\n else:\n lv4 = None\n dnsport_v4 = 0\n\n try:\n dns_listener.bind(lv6, lv4)\n bound = True\n break\n except socket.error as e:\n if e.errno == errno.EADDRINUSE:\n last_e = e\n else:\n raise e\n debug2('\\n')\n dns_listener.print_listening(\"DNS\")\n if not bound:\n assert(last_e)\n raise last_e\n else:\n dnsport_v6 = 0\n dnsport_v4 = 0\n dns_listener = None\n\n # Last minute sanity checks.\n # These should never fail.\n # If these do fail, something is broken above.\n if len(subnets_v6) > 0:\n assert required.ipv6\n if redirectport_v6 == 0:\n raise Fatal(\"IPv6 subnets defined but not listening\")\n\n if len(nslist_v6) > 0:\n assert required.dns\n assert required.ipv6\n if dnsport_v6 == 0:\n raise Fatal(\"IPv6 ns servers defined but not listening\")\n\n if len(subnets_v4) > 0:\n if redirectport_v4 == 0:\n raise Fatal(\"IPv4 subnets defined but not listening\")\n\n if len(nslist_v4) > 0:\n if dnsport_v4 == 0:\n raise Fatal(\"IPv4 ns servers defined but not listening\")\n\n # setup method specific stuff on listeners\n fw.method.setup_tcp_listener(tcp_listener)\n if udp_listener:\n fw.method.setup_udp_listener(udp_listener)\n if dns_listener:\n fw.method.setup_udp_listener(dns_listener)\n\n # start the firewall\n fw.setup(subnets_include, subnets_exclude, nslist,\n redirectport_v6, redirectport_v4, dnsport_v6, dnsport_v4,\n required.udp)\n\n # start the client process\n try:\n return _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,\n python, latency_control, dns_listener,\n seed_hosts, auto_nets, daemon)\n finally:\n try:\n if daemon:\n # it's not our child anymore; can't waitpid\n fw.p.returncode = 0\n fw.done()\n finally:\n if daemon:\n daemon_cleanup()\n" }, { "path": "sshuttle/cmdline.py", "content": "import sys\nimport re\nimport socket\nimport sshuttle.helpers as helpers\nimport sshuttle.options as options\nimport sshuttle.client as client\nimport sshuttle.firewall as firewall\nimport sshuttle.hostwatch as hostwatch\nimport sshuttle.ssyslog as ssyslog\nfrom sshuttle.helpers import family_ip_tuple, log, Fatal\n\n\n# 1.2.3.4/5 or just 1.2.3.4\ndef parse_subnet4(s):\n m = re.match(r'(\\d+)(?:\\.(\\d+)\\.(\\d+)\\.(\\d+))?(?:/(\\d+))?$', s)\n if not m:\n raise Fatal('%r is not a valid IP subnet format' % s)\n (a, b, c, d, width) = m.groups()\n (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))\n if width is None:\n width = 32\n else:\n width = int(width)\n if a > 255 or b > 255 or c > 255 or d > 255:\n raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))\n if width > 32:\n raise Fatal('*/%d is greater than the maximum of 32' % width)\n return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)\n\n\n# 1:2::3/64 or just 1:2::3\ndef parse_subnet6(s):\n m = re.match(r'(?:([a-fA-F\\d:]+))?(?:/(\\d+))?$', s)\n if not m:\n raise Fatal('%r is not a valid IP subnet format' % s)\n (net, width) = m.groups()\n if width is None:\n width = 128\n else:\n width = int(width)\n if width > 128:\n raise Fatal('*/%d is greater than the maximum of 128' % width)\n return(socket.AF_INET6, net, width)\n\n\n# Subnet file, supporting empty lines and hash-started comment lines\ndef parse_subnet_file(s):\n try:\n handle = open(s, 'r')\n except OSError:\n raise Fatal('Unable to open subnet file: %s' % s)\n\n raw_config_lines = handle.readlines()\n config_lines = []\n for line_no, line in enumerate(raw_config_lines):\n line = line.strip()\n if len(line) == 0:\n continue\n if line[0] == '#':\n continue\n config_lines.append(line)\n\n return config_lines\n\n\n# list of:\n# 1.2.3.4/5 or just 1.2.3.4\n# 1:2::3/64 or just 1:2::3\ndef parse_subnets(subnets_str):\n subnets = []\n for s in subnets_str:\n if ':' in s:\n subnet = parse_subnet6(s)\n else:\n subnet = parse_subnet4(s)\n subnets.append(subnet)\n return subnets\n\n\n# 1.2.3.4:567 or just 1.2.3.4 or just 567\ndef parse_ipport4(s):\n s = str(s)\n m = re.match(r'(?:(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+))?(?::)?(?:(\\d+))?$', s)\n if not m:\n raise Fatal('%r is not a valid IP:port format' % s)\n (a, b, c, d, port) = m.groups()\n (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),\n int(port or 0))\n if a > 255 or b > 255 or c > 255 or d > 255:\n raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))\n if port > 65535:\n raise Fatal('*:%d is greater than the maximum of 65535' % port)\n if a is None:\n a = b = c = d = 0\n return ('%d.%d.%d.%d' % (a, b, c, d), port)\n\n\n# [1:2::3]:456 or [1:2::3] or 456\ndef parse_ipport6(s):\n s = str(s)\n m = re.match(r'(?:\\[([^]]*)])?(?::)?(?:(\\d+))?$', s)\n if not m:\n raise Fatal('%s is not a valid IP:port format' % s)\n (ip, port) = m.groups()\n (ip, port) = (ip or '::', int(port or 0))\n return (ip, port)\n\n\ndef parse_list(list):\n return re.split(r'[\\s,]+', list.strip()) if list else []\n\n\noptspec = \"\"\"\nsshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] \nsshuttle --firewall \nsshuttle --hostwatch\n--\nl,listen= transproxy to this ip address and port number\nH,auto-hosts scan for remote hostnames and update local /etc/hosts\nN,auto-nets automatically determine subnets to route\ndns capture local DNS requests and forward to the remote DNS server\nns-hosts= capture and forward remote DNS requests to the following servers\nmethod= auto, nat, tproxy or pf\npython= path to python interpreter on the remote server\nr,remote= ssh hostname (and optional username) of remote sshuttle server\nx,exclude= exclude this subnet (can be used more than once)\nX,exclude-from= exclude the subnets in a file (whitespace separated)\nv,verbose increase debug message verbosity\nV,version print the sshuttle version number and exit\ne,ssh-cmd= the command to use to connect to the remote [ssh]\nseed-hosts= with -H, use these hostnames for initial scan (comma-separated)\nno-latency-control sacrifice latency to improve bandwidth benchmarks\nwrap= restart counting channel numbers after this number (for testing)\ndisable-ipv6 disables ipv6 support\nD,daemon run in the background as a daemon\ns,subnets= file where the subnets are stored, instead of on the command line\nsyslog send log messages to syslog (default if you use --daemon)\npidfile= pidfile name (only if using --daemon) [./sshuttle.pid]\nserver (internal use only)\nfirewall (internal use only)\nhostwatch (internal use only)\n\"\"\"\n\n\ndef main():\n o = options.Options(optspec)\n (opt, flags, extra) = o.parse(sys.argv[1:])\n\n if opt.version:\n from sshuttle.version import version\n print(version)\n return 0\n if opt.daemon:\n opt.syslog = 1\n if opt.wrap:\n import sshuttle.ssnet as ssnet\n ssnet.MAX_CHANNEL = int(opt.wrap)\n helpers.verbose = opt.verbose or 0\n\n try:\n if opt.firewall:\n if len(extra) != 0:\n o.fatal('exactly zero arguments expected')\n return firewall.main(opt.method, opt.syslog)\n elif opt.hostwatch:\n return hostwatch.hw_main(extra)\n else:\n if len(extra) < 1 and not opt.auto_nets and not opt.subnets:\n o.fatal('at least one subnet, subnet file, or -N expected')\n includes = extra\n excludes = ['127.0.0.0/8']\n for k, v in flags:\n if k in ('-x', '--exclude'):\n excludes.append(v)\n if k in ('-X', '--exclude-from'):\n excludes += open(v).read().split()\n remotename = opt.remote\n if remotename == '' or remotename == '-':\n remotename = None\n nslist = [family_ip_tuple(ns) for ns in parse_list(opt.ns_hosts)]\n if opt.seed_hosts and not opt.auto_hosts:\n o.fatal('--seed-hosts only works if you also use -H')\n if opt.seed_hosts:\n sh = re.split(r'[\\s,]+', (opt.seed_hosts or \"\").strip())\n elif opt.auto_hosts:\n sh = []\n else:\n sh = None\n if opt.subnets:\n includes = parse_subnet_file(opt.subnets)\n if not opt.method:\n method_name = \"auto\"\n elif opt.method in [\"auto\", \"nat\", \"tproxy\", \"pf\"]:\n method_name = opt.method\n else:\n o.fatal(\"method_name %s not supported\" % opt.method)\n if opt.listen:\n ipport_v6 = None\n ipport_v4 = None\n list = opt.listen.split(\",\")\n for ip in list:\n if '[' in ip and ']' in ip:\n ipport_v6 = parse_ipport6(ip)\n else:\n ipport_v4 = parse_ipport4(ip)\n else:\n # parse_ipport4('127.0.0.1:0')\n ipport_v4 = \"auto\"\n # parse_ipport6('[::1]:0')\n ipport_v6 = \"auto\" if not opt.disable_ipv6 else None\n if opt.syslog:\n ssyslog.start_syslog()\n ssyslog.stderr_to_syslog()\n return_code = client.main(ipport_v6, ipport_v4,\n opt.ssh_cmd,\n remotename,\n opt.python,\n opt.latency_control,\n opt.dns,\n nslist,\n method_name,\n sh,\n opt.auto_nets,\n parse_subnets(includes),\n parse_subnets(excludes),\n opt.daemon, opt.pidfile)\n\n if return_code == 0:\n log('Normal exit code, exiting...')\n else:\n log('Abnormal exit code detected, failing...' % return_code)\n return return_code\n\n except Fatal as e:\n log('fatal: %s\\n' % e)\n return 99\n except KeyboardInterrupt:\n log('\\n')\n log('Keyboard interrupt: exiting.\\n')\n return 1\n" }, { "path": "sshuttle/firewall.py", "content": "import errno\nimport socket\nimport signal\nimport sshuttle.ssyslog as ssyslog\nimport sys\nimport os\nimport platform\nimport traceback\nfrom sshuttle.helpers import debug1, debug2, Fatal\nfrom sshuttle.methods import get_auto_method, get_method\n\nHOSTSFILE = '/etc/hosts'\n\n\ndef rewrite_etc_hosts(hostmap, port):\n BAKFILE = '%s.sbak' % HOSTSFILE\n APPEND = '# sshuttle-firewall-%d AUTOCREATED' % port\n old_content = ''\n st = None\n try:\n old_content = open(HOSTSFILE).read()\n st = os.stat(HOSTSFILE)\n except IOError as e:\n if e.errno == errno.ENOENT:\n pass\n else:\n raise\n if old_content.strip() and not os.path.exists(BAKFILE):\n os.link(HOSTSFILE, BAKFILE)\n tmpname = \"%s.%d.tmp\" % (HOSTSFILE, port)\n f = open(tmpname, 'w')\n for line in old_content.rstrip().split('\\n'):\n if line.find(APPEND) >= 0:\n continue\n f.write('%s\\n' % line)\n for (name, ip) in sorted(hostmap.items()):\n f.write('%-30s %s\\n' % ('%s %s' % (ip, name), APPEND))\n f.close()\n\n if st is not None:\n os.chown(tmpname, st.st_uid, st.st_gid)\n os.chmod(tmpname, st.st_mode)\n else:\n os.chown(tmpname, 0, 0)\n os.chmod(tmpname, 0o600)\n os.rename(tmpname, HOSTSFILE)\n\n\ndef restore_etc_hosts(port):\n rewrite_etc_hosts({}, port)\n\n\n# Isolate function that needs to be replaced for tests\ndef setup_daemon():\n if os.getuid() != 0:\n raise Fatal('you must be root (or enable su/sudo) to set the firewall')\n\n # don't disappear if our controlling terminal or stdout/stderr\n # disappears; we still have to clean up.\n signal.signal(signal.SIGHUP, signal.SIG_IGN)\n signal.signal(signal.SIGPIPE, signal.SIG_IGN)\n signal.signal(signal.SIGTERM, signal.SIG_IGN)\n signal.signal(signal.SIGINT, signal.SIG_IGN)\n\n # ctrl-c shouldn't be passed along to me. When the main sshuttle dies,\n # I'll die automatically.\n os.setsid()\n\n # because of limitations of the 'su' command, the *real* stdin/stdout\n # are both attached to stdout initially. Clone stdout into stdin so we\n # can read from it.\n os.dup2(1, 0)\n\n return sys.stdin, sys.stdout\n\n\n# This is some voodoo for setting up the kernel's transparent\n# proxying stuff. If subnets is empty, we just delete our sshuttle rules;\n# otherwise we delete it, then make them from scratch.\n#\n# This code is supposed to clean up after itself by deleting its rules on\n# exit. In case that fails, it's not the end of the world; future runs will\n# supercede it in the transproxy list, at least, so the leftover rules\n# are hopefully harmless.\ndef main(method_name, syslog):\n stdin, stdout = setup_daemon()\n hostmap = {}\n\n debug1('firewall manager: Starting firewall with Python version %s\\n'\n % platform.python_version())\n\n if method_name == \"auto\":\n method = get_auto_method()\n else:\n method = get_method(method_name)\n\n if syslog:\n ssyslog.start_syslog()\n ssyslog.stderr_to_syslog()\n\n debug1('firewall manager: ready method name %s.\\n' % method.name)\n stdout.write('READY %s\\n' % method.name)\n stdout.flush()\n\n # we wait until we get some input before creating the rules. That way,\n # sshuttle can launch us as early as possible (and get sudo password\n # authentication as early in the startup process as possible).\n line = stdin.readline(128)\n if not line:\n return # parent died; nothing to do\n\n subnets = []\n if line != 'ROUTES\\n':\n raise Fatal('firewall: expected ROUTES but got %r' % line)\n while 1:\n line = stdin.readline(128)\n if not line:\n raise Fatal('firewall: expected route but got %r' % line)\n elif line.startswith(\"NSLIST\\n\"):\n break\n try:\n (family, width, exclude, ip) = line.strip().split(',', 3)\n except:\n raise Fatal('firewall: expected route or NSLIST but got %r' % line)\n subnets.append((int(family), int(width), bool(int(exclude)), ip))\n debug2('firewall manager: Got subnets: %r\\n' % subnets)\n\n nslist = []\n if line != 'NSLIST\\n':\n raise Fatal('firewall: expected NSLIST but got %r' % line)\n while 1:\n line = stdin.readline(128)\n if not line:\n raise Fatal('firewall: expected nslist but got %r' % line)\n elif line.startswith(\"PORTS \"):\n break\n try:\n (family, ip) = line.strip().split(',', 1)\n except:\n raise Fatal('firewall: expected nslist or PORTS but got %r' % line)\n nslist.append((int(family), ip))\n debug2('firewall manager: Got partial nslist: %r\\n' % nslist)\n debug2('firewall manager: Got nslist: %r\\n' % nslist)\n\n if not line.startswith('PORTS '):\n raise Fatal('firewall: expected PORTS but got %r' % line)\n _, _, ports = line.partition(\" \")\n ports = ports.split(\",\")\n if len(ports) != 4:\n raise Fatal('firewall: expected 4 ports but got %n' % len(ports))\n port_v6 = int(ports[0])\n port_v4 = int(ports[1])\n dnsport_v6 = int(ports[2])\n dnsport_v4 = int(ports[3])\n\n assert(port_v6 >= 0)\n assert(port_v6 <= 65535)\n assert(port_v4 >= 0)\n assert(port_v4 <= 65535)\n assert(dnsport_v6 >= 0)\n assert(dnsport_v6 <= 65535)\n assert(dnsport_v4 >= 0)\n assert(dnsport_v4 <= 65535)\n\n debug2('firewall manager: Got ports: %d,%d,%d,%d\\n'\n % (port_v6, port_v4, dnsport_v6, dnsport_v4))\n\n line = stdin.readline(128)\n if not line:\n raise Fatal('firewall: expected GO but got %r' % line)\n elif not line.startswith(\"GO \"):\n raise Fatal('firewall: expected GO but got %r' % line)\n\n _, _, udp = line.partition(\" \")\n udp = bool(int(udp))\n debug2('firewall manager: Got udp: %r\\n' % udp)\n\n subnets_v6 = [i for i in subnets if i[0] == socket.AF_INET6]\n nslist_v6 = [i for i in nslist if i[0] == socket.AF_INET6]\n subnets_v4 = [i for i in subnets if i[0] == socket.AF_INET]\n nslist_v4 = [i for i in nslist if i[0] == socket.AF_INET]\n\n try:\n debug1('firewall manager: setting up.\\n')\n\n if len(subnets_v6) > 0 or len(nslist_v6) > 0:\n debug2('firewall manager: setting up IPv6.\\n')\n method.setup_firewall(\n port_v6, dnsport_v6, nslist_v6,\n socket.AF_INET6, subnets_v6, udp)\n\n if len(subnets_v4) > 0 or len(nslist_v4) > 0:\n debug2('firewall manager: setting up IPv4.\\n')\n method.setup_firewall(\n port_v4, dnsport_v4, nslist_v4,\n socket.AF_INET, subnets_v4, udp)\n\n stdout.write('STARTED\\n')\n\n try:\n stdout.flush()\n except IOError:\n # the parent process died for some reason; he's surely been loud\n # enough, so no reason to report another error\n return\n\n # Now we wait until EOF or any other kind of exception. We need\n # to stay running so that we don't need a *second* password\n # authentication at shutdown time - that cleanup is important!\n while 1:\n line = stdin.readline(128)\n if line.startswith('HOST '):\n (name, ip) = line[5:].strip().split(',', 1)\n hostmap[name] = ip\n debug2('firewall manager: setting up /etc/hosts.\\n')\n rewrite_etc_hosts(hostmap, port_v6 or port_v4)\n elif line:\n if not method.firewall_command(line):\n raise Fatal('firewall: expected command, got %r' % line)\n else:\n break\n finally:\n try:\n debug1('firewall manager: undoing changes.\\n')\n except:\n pass\n\n try:\n if len(subnets_v6) > 0 or len(nslist_v6) > 0:\n debug2('firewall manager: undoing IPv6 changes.\\n')\n method.restore_firewall(port_v6, socket.AF_INET6, udp)\n except:\n try:\n debug1(\"firewall manager: \"\n \"Error trying to undo IPv6 firewall.\\n\")\n for line in traceback.format_exc().splitlines():\n debug1(\"---> %s\\n\" % line)\n except:\n pass\n\n try:\n if len(subnets_v4) > 0 or len(nslist_v4) > 0:\n debug2('firewall manager: undoing IPv4 changes.\\n')\n method.restore_firewall(port_v4, socket.AF_INET, udp)\n except:\n try:\n debug1(\"firewall manager: \"\n \"Error trying to undo IPv4 firewall.\\n\")\n for line in traceback.format_exc().splitlines():\n debug1(\"firewall manager: ---> %s\\n\" % line)\n except:\n pass\n\n try:\n debug2('firewall manager: undoing /etc/hosts changes.\\n')\n restore_etc_hosts(port_v6 or port_v4)\n except:\n try:\n debug1(\"firewall manager: \"\n \"Error trying to undo /etc/hosts changes.\\n\")\n for line in traceback.format_exc().splitlines():\n debug1(\"firewall manager: ---> %s\\n\" % line)\n except:\n pass\n" }, { "path": "sshuttle/helpers.py", "content": "import sys\nimport socket\nimport errno\n\nlogprefix = ''\nverbose = 0\n\n\ndef log(s):\n global logprefix\n try:\n sys.stdout.flush()\n if s.find(\"\\n\") != -1:\n prefix = logprefix\n s = s.rstrip(\"\\n\")\n for line in s.split(\"\\n\"):\n sys.stderr.write(prefix + line + \"\\n\")\n prefix = \"---> \"\n else:\n sys.stderr.write(logprefix + s)\n sys.stderr.flush()\n except IOError:\n # this could happen if stderr gets forcibly disconnected, eg. because\n # our tty closes. That sucks, but it's no reason to abort the program.\n pass\n\n\ndef debug1(s):\n if verbose >= 1:\n log(s)\n\n\ndef debug2(s):\n if verbose >= 2:\n log(s)\n\n\ndef debug3(s):\n if verbose >= 3:\n log(s)\n\n\nclass Fatal(Exception):\n pass\n\n\ndef resolvconf_nameservers():\n l = []\n for line in open('/etc/resolv.conf'):\n words = line.lower().split()\n if len(words) >= 2 and words[0] == 'nameserver':\n l.append(family_ip_tuple(words[1]))\n return l\n\n\ndef resolvconf_random_nameserver():\n l = resolvconf_nameservers()\n if l:\n if len(l) > 1:\n # don't import this unless we really need it\n import random\n random.shuffle(l)\n return l[0]\n else:\n return (socket.AF_INET, '127.0.0.1')\n\n\ndef islocal(ip, family):\n sock = socket.socket(family)\n try:\n try:\n sock.bind((ip, 0))\n except socket.error as e:\n if e.args[0] == errno.EADDRNOTAVAIL:\n return False # not a local IP\n else:\n raise\n finally:\n sock.close()\n return True # it's a local IP, or there would have been an error\n\n\ndef family_ip_tuple(ip):\n if ':' in ip:\n return (socket.AF_INET6, ip)\n else:\n return (socket.AF_INET, ip)\n\n\ndef family_to_string(family):\n if family == socket.AF_INET6:\n return \"AF_INET6\"\n elif family == socket.AF_INET:\n return \"AF_INET\"\n else:\n return str(family)\n" }, { "path": "sshuttle/hostwatch.py", "content": "import time\nimport socket\nimport re\nimport select\nimport errno\nimport os\nimport sys\nimport platform\n\nimport subprocess as ssubprocess\nimport sshuttle.helpers as helpers\nfrom sshuttle.helpers import log, debug1, debug2, debug3\n\nPOLL_TIME = 60 * 15\nNETSTAT_POLL_TIME = 30\nCACHEFILE = os.path.expanduser('~/.sshuttle.hosts')\n\n\n_nmb_ok = True\n_smb_ok = True\nhostnames = {}\nqueue = {}\ntry:\n null = open('/dev/null', 'wb')\nexcept IOError as e:\n log('warning: %s\\n' % e)\n null = os.popen(\"sh -c 'while read x; do :; done'\", 'wb', 4096)\n\n\ndef _is_ip(s):\n return re.match(r'\\d+\\.\\d+\\.\\d+\\.\\d+$', s)\n\n\ndef write_host_cache():\n tmpname = '%s.%d.tmp' % (CACHEFILE, os.getpid())\n try:\n f = open(tmpname, 'wb')\n for name, ip in sorted(hostnames.items()):\n f.write(('%s,%s\\n' % (name, ip)).encode(\"ASCII\"))\n f.close()\n os.chmod(tmpname, 0o600)\n os.rename(tmpname, CACHEFILE)\n finally:\n try:\n os.unlink(tmpname)\n except:\n pass\n\n\ndef read_host_cache():\n try:\n f = open(CACHEFILE)\n except IOError as e:\n if e.errno == errno.ENOENT:\n return\n else:\n raise\n for line in f:\n words = line.strip().split(',')\n if len(words) == 2:\n (name, ip) = words\n name = re.sub(r'[^-\\w]', '-', name).strip()\n ip = re.sub(r'[^0-9.]', '', ip).strip()\n if name and ip:\n found_host(name, ip)\n\n\ndef found_host(hostname, ip):\n hostname = re.sub(r'\\..*', '', hostname)\n hostname = re.sub(r'[^-\\w]', '_', hostname)\n if (ip.startswith('127.') or ip.startswith('255.')\n or hostname == 'localhost'):\n return\n oldip = hostnames.get(hostname)\n if oldip != ip:\n hostnames[hostname] = ip\n debug1('Found: %s: %s\\n' % (hostname, ip))\n sys.stdout.write('%s,%s\\n' % (hostname, ip))\n write_host_cache()\n\n\ndef _check_etc_hosts():\n debug2(' > hosts\\n')\n for line in open('/etc/hosts'):\n line = re.sub(r'#.*', '', line)\n words = line.strip().split()\n if not words:\n continue\n ip = words[0]\n names = words[1:]\n if _is_ip(ip):\n debug3('< %s %r\\n' % (ip, names))\n for n in names:\n check_host(n)\n found_host(n, ip)\n\n\ndef _check_revdns(ip):\n debug2(' > rev: %s\\n' % ip)\n try:\n r = socket.gethostbyaddr(ip)\n debug3('< %s\\n' % r[0])\n check_host(r[0])\n found_host(r[0], ip)\n except socket.herror:\n pass\n\n\ndef _check_dns(hostname):\n debug2(' > dns: %s\\n' % hostname)\n try:\n ip = socket.gethostbyname(hostname)\n debug3('< %s\\n' % ip)\n check_host(ip)\n found_host(hostname, ip)\n except socket.gaierror:\n pass\n\n\ndef _check_netstat():\n debug2(' > netstat\\n')\n argv = ['netstat', '-n']\n try:\n p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)\n content = p.stdout.read().decode(\"ASCII\")\n p.wait()\n except OSError as e:\n log('%r failed: %r\\n' % (argv, e))\n return\n\n for ip in re.findall(r'\\d+\\.\\d+\\.\\d+\\.\\d+', content):\n debug3('< %s\\n' % ip)\n check_host(ip)\n\n\ndef _check_smb(hostname):\n return\n global _smb_ok\n if not _smb_ok:\n return\n argv = ['smbclient', '-U', '%', '-L', hostname]\n debug2(' > smb: %s\\n' % hostname)\n try:\n p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)\n lines = p.stdout.readlines()\n p.wait()\n except OSError as e:\n log('%r failed: %r\\n' % (argv, e))\n _smb_ok = False\n return\n\n lines.reverse()\n\n # junk at top\n while lines:\n line = lines.pop().strip()\n if re.match(r'Server\\s+', line):\n break\n\n # server list section:\n # Server Comment\n # ------ -------\n while lines:\n line = lines.pop().strip()\n if not line or re.match(r'-+\\s+-+', line):\n continue\n if re.match(r'Workgroup\\s+Master', line):\n break\n words = line.split()\n hostname = words[0].lower()\n debug3('< %s\\n' % hostname)\n check_host(hostname)\n\n # workgroup list section:\n # Workgroup Master\n # --------- ------\n while lines:\n line = lines.pop().strip()\n if re.match(r'-+\\s+', line):\n continue\n if not line:\n break\n words = line.split()\n (workgroup, hostname) = (words[0].lower(), words[1].lower())\n debug3('< group(%s) -> %s\\n' % (workgroup, hostname))\n check_host(hostname)\n check_workgroup(workgroup)\n\n if lines:\n assert(0)\n\n\ndef _check_nmb(hostname, is_workgroup, is_master):\n return\n global _nmb_ok\n if not _nmb_ok:\n return\n argv = ['nmblookup'] + ['-M'] * is_master + ['--', hostname]\n debug2(' > n%d%d: %s\\n' % (is_workgroup, is_master, hostname))\n try:\n p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)\n lines = p.stdout.readlines()\n rv = p.wait()\n except OSError as e:\n log('%r failed: %r\\n' % (argv, e))\n _nmb_ok = False\n return\n if rv:\n log('%r returned %d\\n' % (argv, rv))\n return\n for line in lines:\n m = re.match(r'(\\d+\\.\\d+\\.\\d+\\.\\d+) (\\w+)<\\w\\w>\\n', line)\n if m:\n g = m.groups()\n (ip, name) = (g[0], g[1].lower())\n debug3('< %s -> %s\\n' % (name, ip))\n if is_workgroup:\n _enqueue(_check_smb, ip)\n else:\n found_host(name, ip)\n check_host(name)\n\n\ndef check_host(hostname):\n if _is_ip(hostname):\n _enqueue(_check_revdns, hostname)\n else:\n _enqueue(_check_dns, hostname)\n _enqueue(_check_smb, hostname)\n _enqueue(_check_nmb, hostname, False, False)\n\n\ndef check_workgroup(hostname):\n _enqueue(_check_nmb, hostname, True, False)\n _enqueue(_check_nmb, hostname, True, True)\n\n\ndef _enqueue(op, *args):\n t = (op, args)\n if queue.get(t) is None:\n queue[t] = 0\n\n\ndef _stdin_still_ok(timeout):\n r, w, x = select.select([sys.stdin.fileno()], [], [], timeout)\n if r:\n b = os.read(sys.stdin.fileno(), 4096)\n if not b:\n return False\n return True\n\n\ndef hw_main(seed_hosts):\n if helpers.verbose >= 2:\n helpers.logprefix = 'HH: '\n else:\n helpers.logprefix = 'hostwatch: '\n\n debug1('Starting hostwatch with Python version %s\\n'\n % platform.python_version())\n\n read_host_cache()\n\n _enqueue(_check_etc_hosts)\n _enqueue(_check_netstat)\n check_host('localhost')\n check_host(socket.gethostname())\n check_workgroup('workgroup')\n check_workgroup('-')\n for h in seed_hosts:\n check_host(h)\n\n while 1:\n now = time.time()\n for t, last_polled in list(queue.items()):\n (op, args) = t\n if not _stdin_still_ok(0):\n break\n maxtime = POLL_TIME\n if op == _check_netstat:\n maxtime = NETSTAT_POLL_TIME\n if now - last_polled > maxtime:\n queue[t] = time.time()\n op(*args)\n try:\n sys.stdout.flush()\n except IOError:\n break\n\n # FIXME: use a smarter timeout based on oldest last_polled\n if not _stdin_still_ok(1):\n break\n" }, { "path": "sshuttle/linux.py", "content": "import socket\nimport subprocess as ssubprocess\nfrom sshuttle.helpers import log, debug1, Fatal, family_to_string\n\n\ndef nonfatal(func, *args):\n try:\n func(*args)\n except Fatal as e:\n log('error: %s\\n' % e)\n\n\ndef ipt_chain_exists(family, table, name):\n if family == socket.AF_INET6:\n cmd = 'ip6tables'\n elif family == socket.AF_INET:\n cmd = 'iptables'\n else:\n raise Exception('Unsupported family \"%s\"' % family_to_string(family))\n argv = [cmd, '-t', table, '-nL']\n p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)\n for line in p.stdout:\n if line.startswith(b'Chain %s ' % name.encode(\"ASCII\")):\n return True\n rv = p.wait()\n if rv:\n raise Fatal('%r returned %d' % (argv, rv))\n\n\ndef ipt(family, table, *args):\n if family == socket.AF_INET6:\n argv = ['ip6tables', '-t', table] + list(args)\n elif family == socket.AF_INET:\n argv = ['iptables', '-t', table] + list(args)\n else:\n raise Exception('Unsupported family \"%s\"' % family_to_string(family))\n debug1('>> %s\\n' % ' '.join(argv))\n rv = ssubprocess.call(argv)\n if rv:\n raise Fatal('%r returned %d' % (argv, rv))\n\n\n_no_ttl_module = False\n\n\ndef ipt_ttl(family, *args):\n global _no_ttl_module\n if not _no_ttl_module:\n # we avoid infinite loops by generating server-side connections\n # with ttl 42. This makes the client side not recapture those\n # connections, in case client == server.\n try:\n argsplus = list(args) + ['-m', 'ttl', '!', '--ttl', '42']\n ipt(family, *argsplus)\n except Fatal:\n ipt(family, *args)\n # we only get here if the non-ttl attempt succeeds\n log('sshuttle: warning: your iptables is missing '\n 'the ttl module.\\n')\n _no_ttl_module = True\n else:\n ipt(family, *args)\n" }, { "path": "sshuttle/methods/__init__.py", "content": "import os\nimport importlib\nimport socket\nimport struct\nimport errno\nfrom sshuttle.helpers import Fatal, debug3\n\n\ndef original_dst(sock):\n try:\n SO_ORIGINAL_DST = 80\n SOCKADDR_MIN = 16\n sockaddr_in = sock.getsockopt(socket.SOL_IP,\n SO_ORIGINAL_DST, SOCKADDR_MIN)\n (proto, port, a, b, c, d) = struct.unpack('!HHBBBB', sockaddr_in[:8])\n # FIXME: decoding is IPv4 only.\n assert(socket.htons(proto) == socket.AF_INET)\n ip = '%d.%d.%d.%d' % (a, b, c, d)\n return (ip, port)\n except socket.error as e:\n if e.args[0] == errno.ENOPROTOOPT:\n return sock.getsockname()\n raise\n\n\nclass Features(object):\n pass\n\n\nclass BaseMethod(object):\n def __init__(self, name):\n self.firewall = None\n self.name = name\n\n def set_firewall(self, firewall):\n self.firewall = firewall\n\n def get_supported_features(self):\n result = Features()\n result.ipv6 = False\n result.udp = False\n result.dns = True\n return result\n\n def get_tcp_dstip(self, sock):\n return original_dst(sock)\n\n def recv_udp(self, udp_listener, bufsize):\n debug3('Accept UDP using recvfrom.\\n')\n data, srcip = udp_listener.recvfrom(bufsize)\n return (srcip, None, data)\n\n def send_udp(self, sock, srcip, dstip, data):\n if srcip is not None:\n Fatal(\"Method %s send_udp does not support setting srcip to %r\"\n % (self.name, srcip))\n sock.sendto(data, dstip)\n\n def setup_tcp_listener(self, tcp_listener):\n pass\n\n def setup_udp_listener(self, udp_listener):\n pass\n\n def assert_features(self, features):\n avail = self.get_supported_features()\n for key in [\"udp\", \"dns\", \"ipv6\"]:\n if getattr(features, key) and not getattr(avail, key):\n raise Fatal(\n \"Feature %s not supported with method %s.\\n\" %\n (key, self.name))\n\n def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):\n raise NotImplementedError()\n\n def restore_firewall(self, port, family, udp):\n raise NotImplementedError()\n\n def firewall_command(self, line):\n return False\n\n\ndef _program_exists(name):\n paths = (os.getenv('PATH') or os.defpath).split(os.pathsep)\n for p in paths:\n fn = '%s/%s' % (p, name)\n if os.path.exists(fn):\n return not os.path.isdir(fn) and os.access(fn, os.X_OK)\n\n\ndef get_method(method_name):\n module = importlib.import_module(\"sshuttle.methods.%s\" % method_name)\n return module.Method(method_name)\n\n\ndef get_auto_method():\n if _program_exists('iptables'):\n method_name = \"nat\"\n elif _program_exists('pfctl'):\n method_name = \"pf\"\n else:\n raise Fatal(\n \"can't find either iptables or pfctl; check your PATH\")\n\n return get_method(method_name)\n" }, { "path": "sshuttle/methods/nat.py", "content": "import socket\nfrom sshuttle.helpers import family_to_string\nfrom sshuttle.linux import ipt, ipt_ttl, ipt_chain_exists, nonfatal\nfrom sshuttle.methods import BaseMethod\n\n\nclass Method(BaseMethod):\n\n # We name the chain based on the transproxy port number so that it's\n # possible to run multiple copies of sshuttle at the same time. Of course,\n # the multiple copies shouldn't have overlapping subnets, or only the most-\n # recently-started one will win (because we use \"-I OUTPUT 1\" instead of\n # \"-A OUTPUT\").\n def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):\n # only ipv4 supported with NAT\n if family != socket.AF_INET:\n raise Exception(\n 'Address family \"%s\" unsupported by nat method_name'\n % family_to_string(family))\n if udp:\n raise Exception(\"UDP not supported by nat method_name\")\n\n table = \"nat\"\n\n def _ipt(*args):\n return ipt(family, table, *args)\n\n def _ipt_ttl(*args):\n return ipt_ttl(family, table, *args)\n\n chain = 'sshuttle-%s' % port\n\n # basic cleanup/setup of chains\n self.restore_firewall(port, family, udp)\n\n _ipt('-N', chain)\n _ipt('-F', chain)\n _ipt('-I', 'OUTPUT', '1', '-j', chain)\n _ipt('-I', 'PREROUTING', '1', '-j', chain)\n\n # create new subnet entries. Note that we're sorting in a very\n # particular order: we need to go from most-specific (largest\n # swidth) to least-specific, and at any given level of specificity,\n # we want excludes to come first. That's why the columns are in\n # such a non- intuitive order.\n for f, swidth, sexclude, snet \\\n in sorted(subnets, key=lambda s: s[1], reverse=True):\n if sexclude:\n _ipt('-A', chain, '-j', 'RETURN',\n '--dest', '%s/%s' % (snet, swidth),\n '-p', 'tcp')\n else:\n _ipt_ttl('-A', chain, '-j', 'REDIRECT',\n '--dest', '%s/%s' % (snet, swidth),\n '-p', 'tcp',\n '--to-ports', str(port))\n\n for f, ip in [i for i in nslist if i[0] == family]:\n _ipt_ttl('-A', chain, '-j', 'REDIRECT',\n '--dest', '%s/32' % ip,\n '-p', 'udp',\n '--dport', '53',\n '--to-ports', str(dnsport))\n\n def restore_firewall(self, port, family, udp):\n # only ipv4 supported with NAT\n if family != socket.AF_INET:\n raise Exception(\n 'Address family \"%s\" unsupported by nat method_name'\n % family_to_string(family))\n if udp:\n raise Exception(\"UDP not supported by nat method_name\")\n\n table = \"nat\"\n\n def _ipt(*args):\n return ipt(family, table, *args)\n\n def _ipt_ttl(*args):\n return ipt_ttl(family, table, *args)\n\n chain = 'sshuttle-%s' % port\n\n # basic cleanup/setup of chains\n if ipt_chain_exists(family, table, chain):\n nonfatal(_ipt, '-D', 'OUTPUT', '-j', chain)\n nonfatal(_ipt, '-D', 'PREROUTING', '-j', chain)\n nonfatal(_ipt, '-F', chain)\n _ipt('-X', chain)\n" }, { "path": "sshuttle/methods/pf.py", "content": "import os\nimport sys\nimport re\nimport socket\nimport struct\nimport subprocess as ssubprocess\nfrom fcntl import ioctl\nfrom ctypes import c_char, c_uint8, c_uint16, c_uint32, Union, Structure, \\\n sizeof, addressof, memmove\nfrom sshuttle.helpers import debug1, debug2, debug3, Fatal, family_to_string\nfrom sshuttle.methods import BaseMethod\n\n\n_pf_context = {'started_by_sshuttle': False, 'Xtoken': None}\n_pf_fd = None\n\n\nclass Generic(object):\n MAXPATHLEN = 1024\n PF_CHANGE_ADD_TAIL = 2\n PF_CHANGE_GET_TICKET = 6\n PF_PASS = 0\n PF_RDR = 8\n PF_OUT = 2\n ACTION_OFFSET = 0\n POOL_TICKET_OFFSET = 8\n ANCHOR_CALL_OFFSET = 1040\n\n class pf_addr(Structure):\n class _pfa(Union):\n _fields_ = [(\"v4\", c_uint32), # struct in_addr\n (\"v6\", c_uint32 * 4), # struct in6_addr\n (\"addr8\", c_uint8 * 16),\n (\"addr16\", c_uint16 * 8),\n (\"addr32\", c_uint32 * 4)]\n\n _fields_ = [(\"pfa\", _pfa)]\n _anonymous_ = (\"pfa\",)\n\n def __init__(self):\n self.status = b''\n self.pfioc_pooladdr = c_char * 1136\n\n self.DIOCNATLOOK = (\n (0x40000000 | 0x80000000) |\n ((sizeof(self.pfioc_natlook) & 0x1fff) << 16) |\n ((ord('D')) << 8) | (23))\n self.DIOCCHANGERULE = (\n (0x40000000 | 0x80000000) |\n ((sizeof(self.pfioc_rule) & 0x1fff) << 16) |\n ((ord('D')) << 8) | (26))\n self.DIOCBEGINADDRS = (\n (0x40000000 | 0x80000000) |\n ((sizeof(self.pfioc_pooladdr) & 0x1fff) << 16) |\n ((ord('D')) << 8) | (51))\n\n def enable(self):\n if b'INFO:\\nStatus: Disabled' in self.status:\n pfctl('-e')\n _pf_context['started_by_sshuttle'] = True\n\n def disable(self):\n if _pf_context['started_by_sshuttle']:\n pfctl('-d')\n\n def query_nat(self, family, proto, src_ip, src_port, dst_ip, dst_port):\n [proto, family, src_port, dst_port] = [\n int(v) for v in [proto, family, src_port, dst_port]]\n\n packed_src_ip = socket.inet_pton(family, src_ip)\n packed_dst_ip = socket.inet_pton(family, dst_ip)\n\n assert len(packed_src_ip) == len(packed_dst_ip)\n length = len(packed_src_ip)\n\n pnl = self.pfioc_natlook()\n pnl.proto = proto\n pnl.direction = self.PF_OUT\n pnl.af = family\n memmove(addressof(pnl.saddr), packed_src_ip, length)\n memmove(addressof(pnl.daddr), packed_dst_ip, length)\n self._add_natlook_ports(pnl, src_port, dst_port)\n\n ioctl(pf_get_dev(), self.DIOCNATLOOK,\n (c_char * sizeof(pnl)).from_address(addressof(pnl)))\n\n ip = socket.inet_ntop(\n pnl.af, (c_char * length).from_address(addressof(pnl.rdaddr)).raw)\n port = socket.ntohs(self._get_natlook_port(pnl.rdxport))\n return (ip, port)\n\n def _add_natlook_ports(self, pnl, src_port, dst_port):\n pnl.sxport = socket.htons(src_port)\n pnl.dxport = socket.htons(dst_port)\n\n def _get_natlook_port(self, xport):\n return xport\n\n def add_anchors(self, status=None):\n if status is None:\n status = pfctl('-s all')[0]\n self.status = status\n if b'\\nanchor \"sshuttle\"' not in status:\n self._add_anchor_rule(self.PF_PASS, b\"sshuttle\")\n\n def _add_anchor_rule(self, type, name, pr=None):\n if pr is None:\n pr = self.pfioc_rule()\n\n memmove(addressof(pr) + self.ANCHOR_CALL_OFFSET, name,\n min(self.MAXPATHLEN, len(name))) # anchor_call = name\n memmove(addressof(pr) + self.RULE_ACTION_OFFSET,\n struct.pack('I', type), 4) # rule.action = type\n\n memmove(addressof(pr) + self.ACTION_OFFSET, struct.pack(\n 'I', self.PF_CHANGE_GET_TICKET), 4) # action = PF_CHANGE_GET_TICKET\n ioctl(pf_get_dev(), pf.DIOCCHANGERULE, pr)\n\n memmove(addressof(pr) + self.ACTION_OFFSET, struct.pack(\n 'I', self.PF_CHANGE_ADD_TAIL), 4) # action = PF_CHANGE_ADD_TAIL\n ioctl(pf_get_dev(), pf.DIOCCHANGERULE, pr)\n\n def add_rules(self, rules):\n assert isinstance(rules, bytes)\n debug3(\"rules:\\n\" + rules.decode(\"ASCII\"))\n pfctl('-a sshuttle -f /dev/stdin', rules)\n\n\nclass FreeBsd(Generic):\n RULE_ACTION_OFFSET = 2968\n\n def __new__(cls):\n class pfioc_natlook(Structure):\n pf_addr = Generic.pf_addr\n _fields_ = [(\"saddr\", pf_addr),\n (\"daddr\", pf_addr),\n (\"rsaddr\", pf_addr),\n (\"rdaddr\", pf_addr),\n (\"sxport\", c_uint16),\n (\"dxport\", c_uint16),\n (\"rsxport\", c_uint16),\n (\"rdxport\", c_uint16),\n (\"af\", c_uint8), # sa_family_t\n (\"proto\", c_uint8),\n (\"proto_variant\", c_uint8),\n (\"direction\", c_uint8)]\n\n freebsd = Generic.__new__(cls)\n freebsd.pfioc_rule = c_char * 3040\n freebsd.pfioc_natlook = pfioc_natlook\n return freebsd\n\n def __init__(self):\n super(FreeBsd, self).__init__()\n\n def add_anchors(self):\n status = pfctl('-s all')[0]\n if b'\\nrdr-anchor \"sshuttle\"' not in status:\n self._add_anchor_rule(self.PF_RDR, b'sshuttle')\n super(FreeBsd, self).add_anchors(status=status)\n\n def _add_anchor_rule(self, type, name):\n pr = self.pfioc_rule()\n ppa = self.pfioc_pooladdr()\n\n ioctl(pf_get_dev(), self.DIOCBEGINADDRS, ppa)\n # pool ticket\n memmove(addressof(pr) + self.POOL_TICKET_OFFSET, ppa[4:8], 4)\n super(FreeBsd, self)._add_anchor_rule(type, name, pr=pr)\n\n def add_rules(self, includes, port, dnsport, nslist):\n tables = [\n b'table {%s}' % b','.join(includes)\n ]\n translating_rules = [\n b'rdr pass on lo0 proto tcp '\n b'to -> 127.0.0.1 port %r' % port\n ]\n filtering_rules = [\n b'pass out route-to lo0 inet proto tcp '\n b'to keep state'\n ]\n\n if len(nslist) > 0:\n tables.append(\n b'table {%s}' %\n b','.join([ns[1].encode(\"ASCII\") for ns in nslist]))\n translating_rules.append(\n b'rdr pass on lo0 proto udp to '\n b' port 53 -> 127.0.0.1 port %r' % dnsport)\n filtering_rules.append(\n b'pass out route-to lo0 inet proto udp to '\n b' port 53 keep state')\n\n rules = b'\\n'.join(tables + translating_rules + filtering_rules) \\\n + b'\\n'\n\n super(FreeBsd, self).add_rules(rules)\n\n\nclass OpenBsd(Generic):\n POOL_TICKET_OFFSET = 4\n RULE_ACTION_OFFSET = 3324\n ANCHOR_CALL_OFFSET = 1036\n\n def __init__(self):\n class pfioc_natlook(Structure):\n pf_addr = Generic.pf_addr\n _fields_ = [(\"saddr\", pf_addr),\n (\"daddr\", pf_addr),\n (\"rsaddr\", pf_addr),\n (\"rdaddr\", pf_addr),\n (\"rdomain\", c_uint16),\n (\"rrdomain\", c_uint16),\n (\"sxport\", c_uint16),\n (\"dxport\", c_uint16),\n (\"rsxport\", c_uint16),\n (\"rdxport\", c_uint16),\n (\"af\", c_uint8), # sa_family_t\n (\"proto\", c_uint8),\n (\"proto_variant\", c_uint8),\n (\"direction\", c_uint8)]\n\n self.pfioc_rule = c_char * 3400\n self.pfioc_natlook = pfioc_natlook\n super(OpenBsd, self).__init__()\n\n def add_anchors(self):\n # before adding anchors and rules we must override the skip lo\n # that comes by default in openbsd pf.conf so the rules we will add,\n # which rely on translating/filtering packets on lo, can work\n pfctl('-f /dev/stdin', b'match on lo\\n')\n super(OpenBsd, self).add_anchors()\n\n def add_rules(self, includes, port, dnsport, nslist):\n tables = [\n b'table {%s}' % b','.join(includes)\n ]\n translating_rules = [\n b'pass in on lo0 inet proto tcp '\n b'divert-to 127.0.0.1 port %r' % port\n ]\n filtering_rules = [\n b'pass out inet proto tcp '\n b'to route-to lo0 keep state'\n ]\n\n if len(nslist) > 0:\n tables.append(\n b'table {%s}' %\n b','.join([ns[1].encode(\"ASCII\") for ns in nslist]))\n translating_rules.append(\n b'pass in on lo0 inet proto udp to '\n b'port 53 rdr-to 127.0.0.1 port %r' % dnsport)\n filtering_rules.append(\n b'pass out inet proto udp to '\n b' port 53 route-to lo0 keep state')\n\n rules = b'\\n'.join(tables + translating_rules + filtering_rules) \\\n + b'\\n'\n\n super(OpenBsd, self).add_rules(rules)\n\n\nclass Darwin(FreeBsd):\n RULE_ACTION_OFFSET = 3068\n\n def __init__(self):\n class pf_state_xport(Union):\n _fields_ = [(\"port\", c_uint16),\n (\"call_id\", c_uint16),\n (\"spi\", c_uint32)]\n\n class pfioc_natlook(Structure):\n pf_addr = Generic.pf_addr\n _fields_ = [(\"saddr\", pf_addr),\n (\"daddr\", pf_addr),\n (\"rsaddr\", pf_addr),\n (\"rdaddr\", pf_addr),\n (\"sxport\", pf_state_xport),\n (\"dxport\", pf_state_xport),\n (\"rsxport\", pf_state_xport),\n (\"rdxport\", pf_state_xport),\n (\"af\", c_uint8), # sa_family_t\n (\"proto\", c_uint8),\n (\"proto_variant\", c_uint8),\n (\"direction\", c_uint8)]\n\n self.pfioc_rule = c_char * 3104\n self.pfioc_natlook = pfioc_natlook\n super(Darwin, self).__init__()\n\n def enable(self):\n o = pfctl('-E')\n _pf_context['Xtoken'] = \\\n re.search(b'Token : (.+)', o[1]).group(1)\n\n def disable(self):\n if _pf_context['Xtoken'] is not None:\n pfctl('-X %s' % _pf_context['Xtoken'].decode(\"ASCII\"))\n\n def add_anchors(self):\n # before adding anchors and rules we must override the skip lo\n # that in some cases ends up in the chain so the rules we will add,\n # which rely on translating/filtering packets on lo, can work\n pfctl('-f /dev/stdin', b'pass on lo\\n')\n super(Darwin, self).add_anchors()\n\n def _add_natlook_ports(self, pnl, src_port, dst_port):\n pnl.sxport.port = socket.htons(src_port)\n pnl.dxport.port = socket.htons(dst_port)\n\n def _get_natlook_port(self, xport):\n return xport.port\n\n\nif sys.platform == 'darwin':\n pf = Darwin()\nelif sys.platform.startswith('openbsd'):\n pf = OpenBsd()\nelse:\n pf = FreeBsd()\n\n\ndef pfctl(args, stdin=None):\n argv = ['pfctl'] + list(args.split(\" \"))\n debug1('>> %s\\n' % ' '.join(argv))\n\n p = ssubprocess.Popen(argv, stdin=ssubprocess.PIPE,\n stdout=ssubprocess.PIPE,\n stderr=ssubprocess.PIPE)\n o = p.communicate(stdin)\n if p.returncode:\n raise Fatal('%r returned %d' % (argv, p.returncode))\n\n return o\n\n\ndef pf_get_dev():\n global _pf_fd\n if _pf_fd is None:\n _pf_fd = os.open('/dev/pf', os.O_RDWR)\n\n return _pf_fd\n\n\n\nclass Method(BaseMethod):\n\n def get_tcp_dstip(self, sock):\n pfile = self.firewall.pfile\n\n peer = sock.getpeername()\n proxy = sock.getsockname()\n\n argv = (sock.family, socket.IPPROTO_TCP,\n peer[0].encode(\"ASCII\"), peer[1],\n proxy[0].encode(\"ASCII\"), proxy[1])\n out_line = b\"QUERY_PF_NAT %d,%d,%s,%d,%s,%d\\n\" % argv\n pfile.write(out_line)\n pfile.flush()\n in_line = pfile.readline()\n debug2(out_line.decode(\"ASCII\") + ' > ' + in_line.decode(\"ASCII\"))\n if in_line.startswith(b'QUERY_PF_NAT_SUCCESS '):\n (ip, port) = in_line[21:].split(b',')\n return (ip.decode(\"ASCII\"), int(port))\n\n return sock.getsockname()\n\n def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):\n tables = []\n translating_rules = []\n filtering_rules = []\n\n if family != socket.AF_INET:\n raise Exception(\n 'Address family \"%s\" unsupported by pf method_name'\n % family_to_string(family))\n if udp:\n raise Exception(\"UDP not supported by pf method_name\")\n\n if len(subnets) > 0:\n includes = []\n # If a given subnet is both included and excluded, list the\n # exclusion first; the table will ignore the second, opposite\n # definition\n for f, swidth, sexclude, snet in sorted(\n subnets, key=lambda s: (s[1], s[2]), reverse=True):\n includes.append(b\"%s%s/%d\" %\n (b\"!\" if sexclude else b\"\",\n snet.encode(\"ASCII\"),\n swidth))\n\n pf.add_anchors()\n pf.add_rules(includes, port, dnsport, nslist)\n pf.enable()\n\n def restore_firewall(self, port, family, udp):\n if family != socket.AF_INET:\n raise Exception(\n 'Address family \"%s\" unsupported by pf method_name'\n % family_to_string(family))\n if udp:\n raise Exception(\"UDP not supported by pf method_name\")\n\n pfctl('-a sshuttle -F all')\n pf.disable()\n\n def firewall_command(self, line):\n if line.startswith('QUERY_PF_NAT '):\n try:\n dst = pf.query_nat(*(line[13:].split(',')))\n sys.stdout.write('QUERY_PF_NAT_SUCCESS %s,%r\\n' % dst)\n except IOError as e:\n sys.stdout.write('QUERY_PF_NAT_FAILURE %s\\n' % e)\n\n sys.stdout.flush()\n return True\n else:\n return False\n" }, { "path": "sshuttle/methods/tproxy.py", "content": "import struct\nfrom sshuttle.helpers import family_to_string\nfrom sshuttle.linux import ipt, ipt_ttl, ipt_chain_exists\nfrom sshuttle.methods import BaseMethod\nfrom sshuttle.helpers import debug1, debug3, Fatal\n\nrecvmsg = None\ntry:\n # try getting recvmsg from python\n import socket as pythonsocket\n getattr(pythonsocket.socket, \"recvmsg\")\n socket = pythonsocket\n recvmsg = \"python\"\nexcept AttributeError:\n # try getting recvmsg from socket_ext library\n try:\n import socket_ext\n getattr(socket_ext.socket, \"recvmsg\")\n socket = socket_ext\n recvmsg = \"socket_ext\"\n except ImportError:\n import socket\n\n\nIP_TRANSPARENT = 19\nIP_ORIGDSTADDR = 20\nIP_RECVORIGDSTADDR = IP_ORIGDSTADDR\nSOL_IPV6 = 41\nIPV6_ORIGDSTADDR = 74\nIPV6_RECVORIGDSTADDR = IPV6_ORIGDSTADDR\n\nif recvmsg == \"python\":\n def recv_udp(listener, bufsize):\n debug3('Accept UDP python using recvmsg.\\n')\n data, ancdata, msg_flags, srcip = listener.recvmsg(\n 4096, socket.CMSG_SPACE(24))\n dstip = None\n family = None\n for cmsg_level, cmsg_type, cmsg_data in ancdata:\n if cmsg_level == socket.SOL_IP and cmsg_type == IP_ORIGDSTADDR:\n family, port = struct.unpack('=HH', cmsg_data[0:4])\n port = socket.htons(port)\n if family == socket.AF_INET:\n start = 4\n length = 4\n else:\n raise Fatal(\"Unsupported socket type '%s'\" % family)\n ip = socket.inet_ntop(family, cmsg_data[start:start + length])\n dstip = (ip, port)\n break\n elif cmsg_level == SOL_IPV6 and cmsg_type == IPV6_ORIGDSTADDR:\n family, port = struct.unpack('=HH', cmsg_data[0:4])\n port = socket.htons(port)\n if family == socket.AF_INET6:\n start = 8\n length = 16\n else:\n raise Fatal(\"Unsupported socket type '%s'\" % family)\n ip = socket.inet_ntop(family, cmsg_data[start:start + length])\n dstip = (ip, port)\n break\n return (srcip, dstip, data)\nelif recvmsg == \"socket_ext\":\n def recv_udp(listener, bufsize):\n debug3('Accept UDP using socket_ext recvmsg.\\n')\n srcip, data, adata, flags = listener.recvmsg(\n (bufsize,), socket.CMSG_SPACE(24))\n dstip = None\n family = None\n for a in adata:\n if a.cmsg_level == socket.SOL_IP and a.cmsg_type == IP_ORIGDSTADDR:\n family, port = struct.unpack('=HH', a.cmsg_data[0:4])\n port = socket.htons(port)\n if family == socket.AF_INET:\n start = 4\n length = 4\n else:\n raise Fatal(\"Unsupported socket type '%s'\" % family)\n ip = socket.inet_ntop(\n family, a.cmsg_data[start:start + length])\n dstip = (ip, port)\n break\n elif a.cmsg_level == SOL_IPV6 and a.cmsg_type == IPV6_ORIGDSTADDR:\n family, port = struct.unpack('=HH', a.cmsg_data[0:4])\n port = socket.htons(port)\n if family == socket.AF_INET6:\n start = 8\n length = 16\n else:\n raise Fatal(\"Unsupported socket type '%s'\" % family)\n ip = socket.inet_ntop(\n family, a.cmsg_data[start:start + length])\n dstip = (ip, port)\n break\n return (srcip, dstip, data[0])\nelse:\n def recv_udp(listener, bufsize):\n debug3('Accept UDP using recvfrom.\\n')\n data, srcip = listener.recvfrom(bufsize)\n return (srcip, None, data)\n\n\nclass Method(BaseMethod):\n\n def get_supported_features(self):\n result = super(Method, self).get_supported_features()\n result.ipv6 = True\n if recvmsg is None:\n result.udp = False\n result.dns = False\n else:\n result.udp = True\n result.dns = True\n return result\n\n def get_tcp_dstip(self, sock):\n return sock.getsockname()\n\n def recv_udp(self, udp_listener, bufsize):\n srcip, dstip, data = recv_udp(udp_listener, bufsize)\n if not dstip:\n debug1(\n \"-- ignored UDP from %r: \"\n \"couldn't determine destination IP address\\n\" % (srcip,))\n return None\n return srcip, dstip, data\n\n def send_udp(self, sock, srcip, dstip, data):\n if not srcip:\n debug1(\n \"-- ignored UDP to %r: \"\n \"couldn't determine source IP address\\n\" % (dstip,))\n return\n sender = socket.socket(sock.family, socket.SOCK_DGRAM)\n sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n sender.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)\n sender.bind(srcip)\n sender.sendto(data, dstip)\n sender.close()\n\n def setup_tcp_listener(self, tcp_listener):\n tcp_listener.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)\n\n def setup_udp_listener(self, udp_listener):\n udp_listener.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)\n if udp_listener.v4 is not None:\n udp_listener.v4.setsockopt(\n socket.SOL_IP, IP_RECVORIGDSTADDR, 1)\n if udp_listener.v6 is not None:\n udp_listener.v6.setsockopt(SOL_IPV6, IPV6_RECVORIGDSTADDR, 1)\n\n def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):\n if family not in [socket.AF_INET, socket.AF_INET6]:\n raise Exception(\n 'Address family \"%s\" unsupported by tproxy method'\n % family_to_string(family))\n\n table = \"mangle\"\n\n def _ipt(*args):\n return ipt(family, table, *args)\n\n def _ipt_ttl(*args):\n return ipt_ttl(family, table, *args)\n\n mark_chain = 'sshuttle-m-%s' % port\n tproxy_chain = 'sshuttle-t-%s' % port\n divert_chain = 'sshuttle-d-%s' % port\n\n # basic cleanup/setup of chains\n self.restore_firewall(port, family, udp)\n\n _ipt('-N', mark_chain)\n _ipt('-F', mark_chain)\n _ipt('-N', divert_chain)\n _ipt('-F', divert_chain)\n _ipt('-N', tproxy_chain)\n _ipt('-F', tproxy_chain)\n _ipt('-I', 'OUTPUT', '1', '-j', mark_chain)\n _ipt('-I', 'PREROUTING', '1', '-j', tproxy_chain)\n _ipt('-A', divert_chain, '-j', 'MARK', '--set-mark', '1')\n _ipt('-A', divert_chain, '-j', 'ACCEPT')\n _ipt('-A', tproxy_chain, '-m', 'socket', '-j', divert_chain,\n '-m', 'tcp', '-p', 'tcp')\n\n if udp:\n _ipt('-A', tproxy_chain, '-m', 'socket', '-j', divert_chain,\n '-m', 'udp', '-p', 'udp')\n\n for f, ip in [i for i in nslist if i[0] == family]:\n _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',\n '--dest', '%s/32' % ip,\n '-m', 'udp', '-p', 'udp', '--dport', '53')\n _ipt('-A', tproxy_chain, '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1',\n '--dest', '%s/32' % ip,\n '-m', 'udp', '-p', 'udp', '--dport', '53',\n '--on-port', str(dnsport))\n\n for f, swidth, sexclude, snet \\\n in sorted(subnets, key=lambda s: s[1], reverse=True):\n if sexclude:\n _ipt('-A', mark_chain, '-j', 'RETURN',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'tcp', '-p', 'tcp')\n _ipt('-A', tproxy_chain, '-j', 'RETURN',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'tcp', '-p', 'tcp')\n else:\n _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'tcp', '-p', 'tcp')\n _ipt('-A', tproxy_chain, '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'tcp', '-p', 'tcp',\n '--on-port', str(port))\n\n if udp:\n if sexclude:\n _ipt('-A', mark_chain, '-j', 'RETURN',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'udp', '-p', 'udp')\n _ipt('-A', tproxy_chain, '-j', 'RETURN',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'udp', '-p', 'udp')\n else:\n _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'udp', '-p', 'udp')\n _ipt('-A', tproxy_chain, '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1',\n '--dest', '%s/%s' % (snet, swidth),\n '-m', 'udp', '-p', 'udp',\n '--on-port', str(port))\n\n def restore_firewall(self, port, family, udp):\n if family not in [socket.AF_INET, socket.AF_INET6]:\n raise Exception(\n 'Address family \"%s\" unsupported by tproxy method'\n % family_to_string(family))\n\n table = \"mangle\"\n\n def _ipt(*args):\n return ipt(family, table, *args)\n\n def _ipt_ttl(*args):\n return ipt_ttl(family, table, *args)\n\n mark_chain = 'sshuttle-m-%s' % port\n tproxy_chain = 'sshuttle-t-%s' % port\n divert_chain = 'sshuttle-d-%s' % port\n\n # basic cleanup/setup of chains\n if ipt_chain_exists(family, table, mark_chain):\n _ipt('-D', 'OUTPUT', '-j', mark_chain)\n _ipt('-F', mark_chain)\n _ipt('-X', mark_chain)\n\n if ipt_chain_exists(family, table, tproxy_chain):\n _ipt('-D', 'PREROUTING', '-j', tproxy_chain)\n _ipt('-F', tproxy_chain)\n _ipt('-X', tproxy_chain)\n\n if ipt_chain_exists(family, table, divert_chain):\n _ipt('-F', divert_chain)\n _ipt('-X', divert_chain)\n" }, { "path": "sshuttle/options.py", "content": "\"\"\"Command-line options parser.\nWith the help of an options spec string, easily parse command-line options.\n\"\"\"\nimport sys\nimport os\nimport textwrap\nimport getopt\nimport re\nimport struct\n\n\nclass OptDict:\n\n def __init__(self):\n self._opts = {}\n\n def __setitem__(self, k, v):\n if k.startswith('no-') or k.startswith('no_'):\n k = k[3:]\n v = not v\n self._opts[k] = v\n\n def __getitem__(self, k):\n if k.startswith('no-') or k.startswith('no_'):\n return not self._opts[k[3:]]\n return self._opts[k]\n\n def __getattr__(self, k):\n return self[k]\n\n\ndef _default_onabort(msg):\n sys.exit(97)\n\n\ndef _intify(v):\n try:\n vv = int(v or '')\n if str(vv) == v:\n return vv\n except ValueError:\n pass\n return v\n\n\ndef _atoi(v):\n try:\n return int(v or 0)\n except ValueError:\n return 0\n\n\ndef _remove_negative_kv(k, v):\n if k.startswith('no-') or k.startswith('no_'):\n return k[3:], not v\n return k, v\n\n\ndef _remove_negative_k(k):\n return _remove_negative_kv(k, None)[0]\n\n\ndef _tty_width():\n if not hasattr(sys.stderr, \"fileno\"):\n return _atoi(os.environ.get('WIDTH')) or 70\n s = struct.pack(\"HHHH\", 0, 0, 0, 0)\n try:\n import fcntl\n import termios\n s = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, s)\n except (IOError, ImportError):\n return _atoi(os.environ.get('WIDTH')) or 70\n (ysize, xsize, ypix, xpix) = struct.unpack('HHHH', s)\n return xsize or 70\n\n\nclass Options:\n\n \"\"\"Option parser.\n When constructed, two strings are mandatory. The first one is the command\n name showed before error messages. The second one is a string called an\n optspec that specifies the synopsis and option flags and their description.\n For more information about optspecs, consult the bup-options(1) man page.\n\n Two optional arguments specify an alternative parsing function and an\n alternative behaviour on abort (after having output the usage string).\n\n By default, the parser function is getopt.gnu_getopt, and the abort\n behaviour is to exit the program.\n \"\"\"\n\n def __init__(self, optspec, optfunc=getopt.gnu_getopt,\n onabort=_default_onabort):\n self.optspec = optspec\n self._onabort = onabort\n self.optfunc = optfunc\n self._aliases = {}\n self._shortopts = 'h?'\n self._longopts = ['help']\n self._hasparms = {}\n self._defaults = {}\n self._usagestr = self._gen_usage()\n\n def _gen_usage(self):\n out = []\n lines = self.optspec.strip().split('\\n')\n lines.reverse()\n first_syn = True\n while lines:\n l = lines.pop()\n if l == '--':\n break\n out.append('%s: %s\\n' % (first_syn and 'usage' or ' or', l))\n first_syn = False\n out.append('\\n')\n last_was_option = False\n while lines:\n l = lines.pop()\n if l.startswith(' '):\n out.append('%s%s\\n' % (last_was_option and '\\n' or '',\n l.lstrip()))\n last_was_option = False\n elif l:\n (flags, extra) = l.split(' ', 1)\n extra = extra.strip()\n if flags.endswith('='):\n flags = flags[:-1]\n has_parm = 1\n else:\n has_parm = 0\n g = re.search(r'\\[([^\\]]*)\\]$', extra)\n if g:\n defval = g.group(1)\n else:\n defval = None\n flagl = flags.split(',')\n flagl_nice = []\n for _f in flagl:\n f, dvi = _remove_negative_kv(_f, _intify(defval))\n self._aliases[f] = _remove_negative_k(flagl[0])\n self._hasparms[f] = has_parm\n self._defaults[f] = dvi\n if len(f) == 1:\n self._shortopts += f + (has_parm and ':' or '')\n flagl_nice.append('-' + f)\n else:\n f_nice = re.sub(r'\\W', '_', f)\n self._aliases[f_nice] = _remove_negative_k(flagl[0])\n self._longopts.append(f + (has_parm and '=' or ''))\n self._longopts.append('no-' + f)\n flagl_nice.append('--' + _f)\n flags_nice = ', '.join(flagl_nice)\n if has_parm:\n flags_nice += ' ...'\n prefix = ' %-20s ' % flags_nice\n argtext = '\\n'.join(textwrap.wrap(extra, width=_tty_width(),\n initial_indent=prefix,\n subsequent_indent=' ' * 28))\n out.append(argtext + '\\n')\n last_was_option = True\n else:\n out.append('\\n')\n last_was_option = False\n return ''.join(out).rstrip() + '\\n'\n\n def usage(self, msg=\"\"):\n \"\"\"Print usage string to stderr and abort.\"\"\"\n sys.stderr.write(self._usagestr)\n e = self._onabort and self._onabort(msg) or None\n if e:\n raise e\n\n def fatal(self, s):\n \"\"\"Print an error message to stderr and abort with usage string.\"\"\"\n msg = 'error: %s\\n' % s\n sys.stderr.write(msg)\n return self.usage(msg)\n\n def parse(self, args):\n \"\"\"Parse a list of arguments and return (options, flags, extra).\n\n In the returned tuple, \"options\" is an OptDict with known options,\n \"flags\" is a list of option flags that were used on the command-line,\n and \"extra\" is a list of positional arguments.\n \"\"\"\n try:\n (flags, extra) = self.optfunc(\n args, self._shortopts, self._longopts)\n except getopt.GetoptError as e:\n self.fatal(e)\n\n opt = OptDict()\n\n for k, v in self._defaults.items():\n k = self._aliases[k]\n opt[k] = v\n\n for (k, v) in flags:\n k = k.lstrip('-')\n if k in ('h', '?', 'help'):\n self.usage()\n if k.startswith('no-'):\n k = self._aliases[k[3:]]\n v = 0\n else:\n k = self._aliases[k]\n if not self._hasparms[k]:\n assert(v == '')\n v = (opt._opts.get(k) or 0) + 1\n else:\n v = _intify(v)\n opt[k] = v\n for (f1, f2) in self._aliases.items():\n opt[f1] = opt._opts.get(f2)\n return (opt, flags, extra)\n" }, { "path": "sshuttle/server.py", "content": "import re\nimport struct\nimport socket\nimport traceback\nimport time\nimport sys\nimport os\nimport platform\n\nimport sshuttle.ssnet as ssnet\nimport sshuttle.helpers as helpers\nimport sshuttle.hostwatch as hostwatch\nimport subprocess as ssubprocess\nfrom sshuttle.ssnet import Handler, Proxy, Mux, MuxWrapper\nfrom sshuttle.helpers import log, debug1, debug2, debug3, Fatal, \\\n resolvconf_random_nameserver\n\n\ndef _ipmatch(ipstr):\n if ipstr == b'default':\n ipstr = b'0.0.0.0/0'\n m = re.match(b'^(\\d+(\\.\\d+(\\.\\d+(\\.\\d+)?)?)?)(?:/(\\d+))?$', ipstr)\n if m:\n g = m.groups()\n ips = g[0]\n width = int(g[4] or 32)\n if g[1] is None:\n ips += b'.0.0.0'\n width = min(width, 8)\n elif g[2] is None:\n ips += b'.0.0'\n width = min(width, 16)\n elif g[3] is None:\n ips += b'.0'\n width = min(width, 24)\n ips = ips.decode(\"ASCII\")\n return (struct.unpack('!I', socket.inet_aton(ips))[0], width)\n\n\ndef _ipstr(ip, width):\n if width >= 32:\n return ip\n else:\n return \"%s/%d\" % (ip, width)\n\n\ndef _maskbits(netmask):\n if not netmask:\n return 32\n for i in range(32):\n if netmask[0] & _shl(1, i):\n return 32 - i\n return 0\n\n\ndef _shl(n, bits):\n return n * int(2 ** bits)\n\n\ndef _list_routes():\n # FIXME: IPv4 only\n argv = ['netstat', '-rn']\n p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)\n routes = []\n for line in p.stdout:\n cols = re.split(b'\\s+', line)\n ipw = _ipmatch(cols[0])\n if not ipw:\n continue # some lines won't be parseable; never mind\n maskw = _ipmatch(cols[2]) # linux only\n mask = _maskbits(maskw) # returns 32 if maskw is null\n width = min(ipw[1], mask)\n ip = ipw[0] & _shl(_shl(1, width) - 1, 32 - width)\n routes.append(\n (socket.AF_INET, socket.inet_ntoa(struct.pack('!I', ip)), width))\n rv = p.wait()\n if rv != 0:\n log('WARNING: %r returned %d\\n' % (argv, rv))\n log('WARNING: That prevents --auto-nets from working.\\n')\n return routes\n\n\ndef list_routes():\n for (family, ip, width) in _list_routes():\n if not ip.startswith('0.') and not ip.startswith('127.'):\n yield (family, ip, width)\n\n\ndef _exc_dump():\n exc_info = sys.exc_info()\n return ''.join(traceback.format_exception(*exc_info))\n\n\ndef start_hostwatch(seed_hosts):\n s1, s2 = socket.socketpair()\n pid = os.fork()\n if not pid:\n # child\n rv = 99\n try:\n try:\n s2.close()\n os.dup2(s1.fileno(), 1)\n os.dup2(s1.fileno(), 0)\n s1.close()\n rv = hostwatch.hw_main(seed_hosts) or 0\n except Exception:\n log('%s\\n' % _exc_dump())\n rv = 98\n finally:\n os._exit(rv)\n s1.close()\n return pid, s2\n\n\nclass Hostwatch:\n\n def __init__(self):\n self.pid = 0\n self.sock = None\n\n\nclass DnsProxy(Handler):\n\n def __init__(self, mux, chan, request):\n Handler.__init__(self, [])\n self.timeout = time.time() + 30\n self.mux = mux\n self.chan = chan\n self.tries = 0\n self.request = request\n self.peers = {}\n self.try_send()\n\n def try_send(self):\n if self.tries >= 3:\n return\n self.tries += 1\n\n family, peer = resolvconf_random_nameserver()\n\n sock = socket.socket(family, socket.SOCK_DGRAM)\n sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)\n sock.connect((peer, 53))\n\n self.peers[sock] = peer\n\n debug2('DNS: sending to %r (try %d)\\n' % (peer, self.tries))\n try:\n sock.send(self.request)\n self.socks.append(sock)\n except socket.error as e:\n if e.args[0] in ssnet.NET_ERRS:\n # might have been spurious; try again.\n # Note: these errors sometimes are reported by recv(),\n # and sometimes by send(). We have to catch both.\n debug2('DNS send to %r: %s\\n' % (peer, e))\n self.try_send()\n return\n else:\n log('DNS send to %r: %s\\n' % (peer, e))\n return\n\n def callback(self, sock):\n peer = self.peers[sock]\n\n try:\n data = sock.recv(4096)\n except socket.error as e:\n self.socks.remove(sock)\n del self.peers[sock]\n\n if e.args[0] in ssnet.NET_ERRS:\n # might have been spurious; try again.\n # Note: these errors sometimes are reported by recv(),\n # and sometimes by send(). We have to catch both.\n debug2('DNS recv from %r: %s\\n' % (peer, e))\n self.try_send()\n return\n else:\n log('DNS recv from %r: %s\\n' % (peer, e))\n return\n debug2('DNS response: %d bytes\\n' % len(data))\n self.mux.send(self.chan, ssnet.CMD_DNS_RESPONSE, data)\n self.ok = False\n\n\nclass UdpProxy(Handler):\n\n def __init__(self, mux, chan, family):\n sock = socket.socket(family, socket.SOCK_DGRAM)\n Handler.__init__(self, [sock])\n self.timeout = time.time() + 30\n self.mux = mux\n self.chan = chan\n self.sock = sock\n if family == socket.AF_INET:\n self.sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)\n\n def send(self, dstip, data):\n debug2('UDP: sending to %r port %d\\n' % dstip)\n try:\n self.sock.sendto(data, dstip)\n except socket.error as e:\n log('UDP send to %r port %d: %s\\n' % (dstip[0], dstip[1], e))\n return\n\n def callback(self, sock):\n try:\n data, peer = sock.recvfrom(4096)\n except socket.error as e:\n log('UDP recv from %r port %d: %s\\n' % (peer[0], peer[1], e))\n return\n debug2('UDP response: %d bytes\\n' % len(data))\n hdr = \"%s,%r,\" % (peer[0], peer[1])\n self.mux.send(self.chan, ssnet.CMD_UDP_DATA, hdr + data)\n\n\ndef main(latency_control):\n debug1('Starting server with Python version %s\\n'\n % platform.python_version())\n\n if helpers.verbose >= 1:\n helpers.logprefix = ' s: '\n else:\n helpers.logprefix = 'server: '\n debug1('latency control setting = %r\\n' % latency_control)\n\n routes = list(list_routes())\n debug1('available routes:\\n')\n for r in routes:\n debug1(' %d/%s/%d\\n' % r)\n\n # synchronization header\n sys.stdout.write('\\0\\0SSHUTTLE0001')\n sys.stdout.flush()\n\n handlers = []\n mux = Mux(socket.fromfd(sys.stdin.fileno(),\n socket.AF_INET, socket.SOCK_STREAM),\n socket.fromfd(sys.stdout.fileno(),\n socket.AF_INET, socket.SOCK_STREAM))\n handlers.append(mux)\n routepkt = b''\n for r in routes:\n routepkt += b'%d,%s,%d\\n' % (r[0], r[1].encode(\"ASCII\"), r[2])\n mux.send(0, ssnet.CMD_ROUTES, routepkt)\n\n hw = Hostwatch()\n hw.leftover = b''\n\n def hostwatch_ready(sock):\n assert(hw.pid)\n content = hw.sock.recv(4096)\n if content:\n lines = (hw.leftover + content).split(b'\\n')\n if lines[-1]:\n # no terminating newline: entry isn't complete yet!\n hw.leftover = lines.pop()\n lines.append(b'')\n else:\n hw.leftover = b''\n mux.send(0, ssnet.CMD_HOST_LIST, b'\\n'.join(lines))\n else:\n raise Fatal('hostwatch process died')\n\n def got_host_req(data):\n if not hw.pid:\n (hw.pid, hw.sock) = start_hostwatch(data.strip().split())\n handlers.append(Handler(socks=[hw.sock],\n callback=hostwatch_ready))\n mux.got_host_req = got_host_req\n\n def new_channel(channel, data):\n (family, dstip, dstport) = data.split(b',', 2)\n family = int(family)\n dstport = int(dstport)\n outwrap = ssnet.connect_dst(family, dstip, dstport)\n handlers.append(Proxy(MuxWrapper(mux, channel), outwrap))\n mux.new_channel = new_channel\n\n dnshandlers = {}\n\n def dns_req(channel, data):\n debug2('Incoming DNS request channel=%d.\\n' % channel)\n h = DnsProxy(mux, channel, data)\n handlers.append(h)\n dnshandlers[channel] = h\n mux.got_dns_req = dns_req\n\n udphandlers = {}\n\n def udp_req(channel, cmd, data):\n debug2('Incoming UDP request channel=%d, cmd=%d\\n' % (channel, cmd))\n if cmd == ssnet.CMD_UDP_DATA:\n (dstip, dstport, data) = data.split(\",\", 2)\n dstport = int(dstport)\n debug2('is incoming UDP data. %r %d.\\n' % (dstip, dstport))\n h = udphandlers[channel]\n h.send((dstip, dstport), data)\n elif cmd == ssnet.CMD_UDP_CLOSE:\n debug2('is incoming UDP close\\n')\n h = udphandlers[channel]\n h.ok = False\n del mux.channels[channel]\n\n def udp_open(channel, data):\n debug2('Incoming UDP open.\\n')\n family = int(data)\n mux.channels[channel] = lambda cmd, data: udp_req(channel, cmd, data)\n if channel in udphandlers:\n raise Fatal('UDP connection channel %d already open' % channel)\n else:\n h = UdpProxy(mux, channel, family)\n handlers.append(h)\n udphandlers[channel] = h\n mux.got_udp_open = udp_open\n\n while mux.ok:\n if hw.pid:\n assert(hw.pid > 0)\n (rpid, rv) = os.waitpid(hw.pid, os.WNOHANG)\n if rpid:\n raise Fatal(\n 'hostwatch exited unexpectedly: code 0x%04x\\n' % rv)\n\n ssnet.runonce(handlers, mux)\n if latency_control:\n mux.check_fullness()\n\n if dnshandlers:\n now = time.time()\n remove = []\n for channel, h in dnshandlers.items():\n if h.timeout < now or not h.ok:\n debug3('expiring dnsreqs channel=%d\\n' % channel)\n remove.append(channel)\n h.ok = False\n for channel in remove:\n del dnshandlers[channel]\n if udphandlers:\n remove = []\n for channel, h in udphandlers.items():\n if not h.ok:\n debug3('expiring UDP channel=%d\\n' % channel)\n remove.append(channel)\n h.ok = False\n for channel in remove:\n del udphandlers[channel]\n" }, { "path": "sshuttle/ssh.py", "content": "import sys\nimport os\nimport re\nimport socket\nimport zlib\nimport imp\nimport subprocess as ssubprocess\nimport sshuttle.helpers as helpers\nfrom sshuttle.helpers import debug2\n\n\ndef readfile(name):\n tokens = name.split(\".\")\n f = None\n\n token = tokens[0]\n token_name = [token]\n token_str = \".\".join(token_name)\n\n try:\n f, pathname, description = imp.find_module(token_str)\n\n for token in tokens[1:]:\n module = imp.load_module(token_str, f, pathname, description)\n if f is not None:\n f.close()\n\n token_name.append(token)\n token_str = \".\".join(token_name)\n\n f, pathname, description = imp.find_module(\n token, module.__path__)\n\n if f is not None:\n contents = f.read()\n else:\n contents = \"\"\n\n finally:\n if f is not None:\n f.close()\n\n return contents.encode(\"UTF8\")\n\n\ndef empackage(z, name, data=None):\n if not data:\n data = readfile(name)\n content = z.compress(data)\n content += z.flush(zlib.Z_SYNC_FLUSH)\n\n return b'%s\\n%d\\n%s' % (name.encode(\"ASCII\"), len(content), content)\n\n\ndef connect(ssh_cmd, rhostport, python, stderr, options):\n portl = []\n\n if (rhostport or '').count(':') > 1:\n if rhostport.count(']') or rhostport.count('['):\n result = rhostport.split(']')\n rhost = result[0].strip('[')\n if len(result) > 1:\n result[1] = result[1].strip(':')\n if result[1] is not '':\n portl = ['-p', str(int(result[1]))]\n # can't disambiguate IPv6 colons and a port number. pass the hostname\n # through.\n else:\n rhost = rhostport\n else: # IPv4\n l = (rhostport or '').split(':', 1)\n rhost = l[0]\n if len(l) > 1:\n portl = ['-p', str(int(l[1]))]\n\n if rhost == '-':\n rhost = None\n\n z = zlib.compressobj(1)\n content = readfile('sshuttle.assembler')\n optdata = ''.join(\"%s=%r\\n\" % (k, v) for (k, v) in list(options.items()))\n optdata = optdata.encode(\"UTF8\")\n content2 = (empackage(z, 'sshuttle') +\n empackage(z, 'sshuttle.cmdline_options', optdata) +\n empackage(z, 'sshuttle.helpers') +\n empackage(z, 'sshuttle.ssnet') +\n empackage(z, 'sshuttle.hostwatch') +\n empackage(z, 'sshuttle.server') +\n b\"\\n\")\n\n pyscript = r\"\"\"\n import sys;\n verbosity=%d;\n stdin=getattr(sys.stdin,\"buffer\",sys.stdin);\n exec(compile(stdin.read(%d), \"assembler.py\", \"exec\"))\n \"\"\" % (helpers.verbose or 0, len(content))\n pyscript = re.sub(r'\\s+', ' ', pyscript.strip())\n\n if not rhost:\n # ignore the --python argument when running locally; we already know\n # which python version works.\n argv = [sys.argv[1], '-c', pyscript]\n else:\n if ssh_cmd:\n sshl = ssh_cmd.split(' ')\n else:\n sshl = ['ssh']\n if python:\n pycmd = \"'%s' -c '%s'\" % (python, pyscript)\n else:\n pycmd = (\"P=python3.5; $P -V 2>/dev/null || P=python; \"\n \"exec \\\"$P\\\" -c '%s'\") % pyscript\n argv = (sshl +\n portl +\n [rhost, '--', pycmd])\n (s1, s2) = socket.socketpair()\n\n def setup():\n # runs in the child process\n s2.close()\n s1a, s1b = os.dup(s1.fileno()), os.dup(s1.fileno())\n s1.close()\n debug2('executing: %r\\n' % argv)\n p = ssubprocess.Popen(argv, stdin=s1a, stdout=s1b, preexec_fn=setup,\n close_fds=True, stderr=stderr)\n os.close(s1a)\n os.close(s1b)\n s2.sendall(content)\n s2.sendall(content2)\n return p, s2\n" }, { "path": "sshuttle/ssnet.py", "content": "import struct\nimport socket\nimport errno\nimport select\nimport os\nfrom sshuttle.helpers import log, debug1, debug2, debug3, Fatal\n\nMAX_CHANNEL = 65535\n\n# these don't exist in the socket module in python 2.3!\nSHUT_RD = 0\nSHUT_WR = 1\nSHUT_RDWR = 2\n\n\nHDR_LEN = 8\n\n\nCMD_EXIT = 0x4200\nCMD_PING = 0x4201\nCMD_PONG = 0x4202\nCMD_TCP_CONNECT = 0x4203\nCMD_TCP_STOP_SENDING = 0x4204\nCMD_TCP_EOF = 0x4205\nCMD_TCP_DATA = 0x4206\nCMD_ROUTES = 0x4207\nCMD_HOST_REQ = 0x4208\nCMD_HOST_LIST = 0x4209\nCMD_DNS_REQ = 0x420a\nCMD_DNS_RESPONSE = 0x420b\nCMD_UDP_OPEN = 0x420c\nCMD_UDP_DATA = 0x420d\nCMD_UDP_CLOSE = 0x420e\n\ncmd_to_name = {\n CMD_EXIT: 'EXIT',\n CMD_PING: 'PING',\n CMD_PONG: 'PONG',\n CMD_TCP_CONNECT: 'TCP_CONNECT',\n CMD_TCP_STOP_SENDING: 'TCP_STOP_SENDING',\n CMD_TCP_EOF: 'TCP_EOF',\n CMD_TCP_DATA: 'TCP_DATA',\n CMD_ROUTES: 'ROUTES',\n CMD_HOST_REQ: 'HOST_REQ',\n CMD_HOST_LIST: 'HOST_LIST',\n CMD_DNS_REQ: 'DNS_REQ',\n CMD_DNS_RESPONSE: 'DNS_RESPONSE',\n CMD_UDP_OPEN: 'UDP_OPEN',\n CMD_UDP_DATA: 'UDP_DATA',\n CMD_UDP_CLOSE: 'UDP_CLOSE',\n}\n\n\nNET_ERRS = [errno.ECONNREFUSED, errno.ETIMEDOUT,\n errno.EHOSTUNREACH, errno.ENETUNREACH,\n errno.EHOSTDOWN, errno.ENETDOWN]\n\n\ndef _add(l, elem):\n if elem not in l:\n l.append(elem)\n\n\ndef _fds(l):\n out = []\n for i in l:\n try:\n out.append(i.fileno())\n except AttributeError:\n out.append(i)\n out.sort()\n return out\n\n\ndef _nb_clean(func, *args):\n try:\n return func(*args)\n except OSError as e:\n if e.errno not in (errno.EWOULDBLOCK, errno.EAGAIN):\n raise\n else:\n debug3('%s: err was: %s\\n' % (func.__name__, e))\n return None\n\n\ndef _try_peername(sock):\n try:\n pn = sock.getpeername()\n if pn:\n return '%s:%s' % (pn[0], pn[1])\n except socket.error as e:\n if e.args[0] not in (errno.ENOTCONN, errno.ENOTSOCK):\n raise\n return 'unknown'\n\n\n_swcount = 0\n\n\nclass SockWrapper:\n\n def __init__(self, rsock, wsock, connect_to=None, peername=None):\n global _swcount\n _swcount += 1\n debug3('creating new SockWrapper (%d now exist)\\n' % _swcount)\n self.exc = None\n self.rsock = rsock\n self.wsock = wsock\n self.shut_read = self.shut_write = False\n self.buf = []\n self.connect_to = connect_to\n self.peername = peername or _try_peername(self.rsock)\n self.try_connect()\n\n def __del__(self):\n global _swcount\n _swcount -= 1\n debug1('%r: deleting (%d remain)\\n' % (self, _swcount))\n if self.exc:\n debug1('%r: error was: %s\\n' % (self, self.exc))\n\n def __repr__(self):\n if self.rsock == self.wsock:\n fds = '#%d' % self.rsock.fileno()\n else:\n fds = '#%d,%d' % (self.rsock.fileno(), self.wsock.fileno())\n return 'SW%s:%s' % (fds, self.peername)\n\n def seterr(self, e):\n if not self.exc:\n self.exc = e\n self.nowrite()\n self.noread()\n\n def try_connect(self):\n if self.connect_to and self.shut_write:\n self.noread()\n self.connect_to = None\n if not self.connect_to:\n return # already connected\n self.rsock.setblocking(False)\n debug3('%r: trying connect to %r\\n' % (self, self.connect_to))\n try:\n self.rsock.connect(self.connect_to)\n # connected successfully (Linux)\n self.connect_to = None\n except socket.error as e:\n debug3('%r: connect result: %s\\n' % (self, e))\n if e.args[0] == errno.EINVAL:\n # this is what happens when you call connect() on a socket\n # that is now connected but returned EINPROGRESS last time,\n # on BSD, on python pre-2.5.1. We need to use getsockopt()\n # to get the \"real\" error. Later pythons do this\n # automatically, so this code won't run.\n realerr = self.rsock.getsockopt(socket.SOL_SOCKET,\n socket.SO_ERROR)\n e = socket.error(realerr, os.strerror(realerr))\n debug3('%r: fixed connect result: %s\\n' % (self, e))\n if e.args[0] in [errno.EINPROGRESS, errno.EALREADY]:\n pass # not connected yet\n elif e.args[0] == 0:\n # connected successfully (weird Linux bug?)\n # Sometimes Linux seems to return EINVAL when it isn't\n # invalid. This *may* be caused by a race condition\n # between connect() and getsockopt(SO_ERROR) (ie. it\n # finishes connecting in between the two, so there is no\n # longer an error). However, I'm not sure of that.\n #\n # I did get at least one report that the problem went away\n # when we added this, however.\n self.connect_to = None\n elif e.args[0] == errno.EISCONN:\n # connected successfully (BSD)\n self.connect_to = None\n elif e.args[0] in NET_ERRS + [errno.EACCES, errno.EPERM]:\n # a \"normal\" kind of error\n self.connect_to = None\n self.seterr(e)\n else:\n raise # error we've never heard of?! barf completely.\n\n def noread(self):\n if not self.shut_read:\n debug2('%r: done reading\\n' % self)\n self.shut_read = True\n # self.rsock.shutdown(SHUT_RD) # doesn't do anything anyway\n\n def nowrite(self):\n if not self.shut_write:\n debug2('%r: done writing\\n' % self)\n self.shut_write = True\n try:\n self.wsock.shutdown(SHUT_WR)\n except socket.error as e:\n self.seterr('nowrite: %s' % e)\n\n def too_full(self):\n return False # fullness is determined by the socket's select() state\n\n def uwrite(self, buf):\n if self.connect_to:\n return 0 # still connecting\n self.wsock.setblocking(False)\n try:\n return _nb_clean(os.write, self.wsock.fileno(), buf)\n except OSError as e:\n if e.errno == errno.EPIPE:\n debug1('%r: uwrite: got EPIPE\\n' % self)\n self.nowrite()\n return 0\n else:\n # unexpected error... stream is dead\n self.seterr('uwrite: %s' % e)\n return 0\n\n def write(self, buf):\n assert(buf)\n return self.uwrite(buf)\n\n def uread(self):\n if self.connect_to:\n return None # still connecting\n if self.shut_read:\n return\n self.rsock.setblocking(False)\n try:\n return _nb_clean(os.read, self.rsock.fileno(), 65536)\n except OSError as e:\n self.seterr('uread: %s' % e)\n return b'' # unexpected error... we'll call it EOF\n\n def fill(self):\n if self.buf:\n return\n rb = self.uread()\n if rb:\n self.buf.append(rb)\n if rb == b'': # empty string means EOF; None means temporarily empty\n self.noread()\n\n def copy_to(self, outwrap):\n if self.buf and self.buf[0]:\n wrote = outwrap.write(self.buf[0])\n self.buf[0] = self.buf[0][wrote:]\n while self.buf and not self.buf[0]:\n self.buf.pop(0)\n if not self.buf and self.shut_read:\n outwrap.nowrite()\n\n\nclass Handler:\n\n def __init__(self, socks=None, callback=None):\n self.ok = True\n self.socks = socks or []\n if callback:\n self.callback = callback\n\n def pre_select(self, r, w, x):\n for i in self.socks:\n _add(r, i)\n\n def callback(self, sock):\n log('--no callback defined-- %r\\n' % self)\n (r, w, x) = select.select(self.socks, [], [], 0)\n for s in r:\n v = s.recv(4096)\n if not v:\n log('--closed-- %r\\n' % self)\n self.socks = []\n self.ok = False\n\n\nclass Proxy(Handler):\n\n def __init__(self, wrap1, wrap2):\n Handler.__init__(self, [wrap1.rsock, wrap1.wsock,\n wrap2.rsock, wrap2.wsock])\n self.wrap1 = wrap1\n self.wrap2 = wrap2\n\n def pre_select(self, r, w, x):\n if self.wrap1.shut_write:\n self.wrap2.noread()\n if self.wrap2.shut_write:\n self.wrap1.noread()\n\n if self.wrap1.connect_to:\n _add(w, self.wrap1.rsock)\n elif self.wrap1.buf:\n if not self.wrap2.too_full():\n _add(w, self.wrap2.wsock)\n elif not self.wrap1.shut_read:\n _add(r, self.wrap1.rsock)\n\n if self.wrap2.connect_to:\n _add(w, self.wrap2.rsock)\n elif self.wrap2.buf:\n if not self.wrap1.too_full():\n _add(w, self.wrap1.wsock)\n elif not self.wrap2.shut_read:\n _add(r, self.wrap2.rsock)\n\n def callback(self, sock):\n self.wrap1.try_connect()\n self.wrap2.try_connect()\n self.wrap1.fill()\n self.wrap2.fill()\n self.wrap1.copy_to(self.wrap2)\n self.wrap2.copy_to(self.wrap1)\n if self.wrap1.buf and self.wrap2.shut_write:\n self.wrap1.buf = []\n self.wrap1.noread()\n if self.wrap2.buf and self.wrap1.shut_write:\n self.wrap2.buf = []\n self.wrap2.noread()\n if (self.wrap1.shut_read and self.wrap2.shut_read and\n not self.wrap1.buf and not self.wrap2.buf):\n self.ok = False\n self.wrap1.nowrite()\n self.wrap2.nowrite()\n\n\nclass Mux(Handler):\n\n def __init__(self, rsock, wsock):\n Handler.__init__(self, [rsock, wsock])\n self.rsock = rsock\n self.wsock = wsock\n self.new_channel = self.got_dns_req = self.got_routes = None\n self.got_udp_open = self.got_udp_data = self.got_udp_close = None\n self.got_host_req = self.got_host_list = None\n self.channels = {}\n self.chani = 0\n self.want = 0\n self.inbuf = b''\n self.outbuf = []\n self.fullness = 0\n self.too_full = False\n self.send(0, CMD_PING, b'chicken')\n\n def next_channel(self):\n # channel 0 is special, so we never allocate it\n for timeout in range(1024):\n self.chani += 1\n if self.chani > MAX_CHANNEL:\n self.chani = 1\n if not self.channels.get(self.chani):\n return self.chani\n\n def amount_queued(self):\n total = 0\n for b in self.outbuf:\n total += len(b)\n return total\n\n def check_fullness(self):\n if self.fullness > 32768:\n if not self.too_full:\n self.send(0, CMD_PING, b'rttest')\n self.too_full = True\n # ob = []\n # for b in self.outbuf:\n # (s1,s2,c) = struct.unpack('!ccH', b[:4])\n # ob.append(c)\n # log('outbuf: %d %r\\n' % (self.amount_queued(), ob))\n\n def send(self, channel, cmd, data):\n assert isinstance(data, bytes)\n assert len(data) <= 65535\n p = struct.pack('!ccHHH', b'S', b'S', channel, cmd, len(data)) + data\n self.outbuf.append(p)\n debug2(' > channel=%d cmd=%s len=%d (fullness=%d)\\n'\n % (channel, cmd_to_name.get(cmd, hex(cmd)),\n len(data), self.fullness))\n self.fullness += len(data)\n\n def got_packet(self, channel, cmd, data):\n debug2('< channel=%d cmd=%s len=%d\\n'\n % (channel, cmd_to_name.get(cmd, hex(cmd)), len(data)))\n if cmd == CMD_PING:\n self.send(0, CMD_PONG, data)\n elif cmd == CMD_PONG:\n debug2('received PING response\\n')\n self.too_full = False\n self.fullness = 0\n elif cmd == CMD_EXIT:\n self.ok = False\n elif cmd == CMD_TCP_CONNECT:\n assert(not self.channels.get(channel))\n if self.new_channel:\n self.new_channel(channel, data)\n elif cmd == CMD_DNS_REQ:\n assert(not self.channels.get(channel))\n if self.got_dns_req:\n self.got_dns_req(channel, data)\n elif cmd == CMD_UDP_OPEN:\n assert(not self.channels.get(channel))\n if self.got_udp_open:\n self.got_udp_open(channel, data)\n elif cmd == CMD_ROUTES:\n if self.got_routes:\n self.got_routes(data)\n else:\n raise Exception('got CMD_ROUTES without got_routes?')\n elif cmd == CMD_HOST_REQ:\n if self.got_host_req:\n self.got_host_req(data)\n else:\n raise Exception('got CMD_HOST_REQ without got_host_req?')\n elif cmd == CMD_HOST_LIST:\n if self.got_host_list:\n self.got_host_list(data)\n else:\n raise Exception('got CMD_HOST_LIST without got_host_list?')\n else:\n callback = self.channels.get(channel)\n if not callback:\n log('warning: closed channel %d got cmd=%s len=%d\\n'\n % (channel, cmd_to_name.get(cmd, hex(cmd)), len(data)))\n else:\n callback(cmd, data)\n\n def flush(self):\n self.wsock.setblocking(False)\n if self.outbuf and self.outbuf[0]:\n wrote = _nb_clean(os.write, self.wsock.fileno(), self.outbuf[0])\n debug2('mux wrote: %r/%d\\n' % (wrote, len(self.outbuf[0])))\n if wrote:\n self.outbuf[0] = self.outbuf[0][wrote:]\n while self.outbuf and not self.outbuf[0]:\n self.outbuf[0:1] = []\n\n def fill(self):\n self.rsock.setblocking(False)\n try:\n b = _nb_clean(os.read, self.rsock.fileno(), 32768)\n except OSError as e:\n raise Fatal('other end: %r' % e)\n # log('<<< %r\\n' % b)\n if b == b'': # EOF\n self.ok = False\n if b:\n self.inbuf += b\n\n def handle(self):\n self.fill()\n # log('inbuf is: (%d,%d) %r\\n'\n # % (self.want, len(self.inbuf), self.inbuf))\n while 1:\n if len(self.inbuf) >= (self.want or HDR_LEN):\n (s1, s2, channel, cmd, datalen) = \\\n struct.unpack('!ccHHH', self.inbuf[:HDR_LEN])\n assert(s1 == b'S')\n assert(s2 == b'S')\n self.want = datalen + HDR_LEN\n if self.want and len(self.inbuf) >= self.want:\n data = self.inbuf[HDR_LEN:self.want]\n self.inbuf = self.inbuf[self.want:]\n self.want = 0\n self.got_packet(channel, cmd, data)\n else:\n break\n\n def pre_select(self, r, w, x):\n _add(r, self.rsock)\n if self.outbuf:\n _add(w, self.wsock)\n\n def callback(self, sock):\n (r, w, x) = select.select([self.rsock], [self.wsock], [], 0)\n if self.rsock in r:\n self.handle()\n if self.outbuf and self.wsock in w:\n self.flush()\n\n\nclass MuxWrapper(SockWrapper):\n\n def __init__(self, mux, channel):\n SockWrapper.__init__(self, mux.rsock, mux.wsock)\n self.mux = mux\n self.channel = channel\n self.mux.channels[channel] = self.got_packet\n self.socks = []\n debug2('new channel: %d\\n' % channel)\n\n def __del__(self):\n self.nowrite()\n SockWrapper.__del__(self)\n\n def __repr__(self):\n return 'SW%r:Mux#%d' % (self.peername, self.channel)\n\n def noread(self):\n if not self.shut_read:\n debug2('%r: done reading\\n' % self)\n self.shut_read = True\n self.mux.send(self.channel, CMD_TCP_STOP_SENDING, b'')\n self.maybe_close()\n\n def nowrite(self):\n if not self.shut_write:\n debug2('%r: done writing\\n' % self)\n self.shut_write = True\n self.mux.send(self.channel, CMD_TCP_EOF, b'')\n self.maybe_close()\n\n def maybe_close(self):\n if self.shut_read and self.shut_write:\n debug2('%r: closing connection\\n' % self)\n # remove the mux's reference to us. The python garbage collector\n # will then be able to reap our object.\n self.mux.channels[self.channel] = None\n\n def too_full(self):\n return self.mux.too_full\n\n def uwrite(self, buf):\n if self.mux.too_full:\n return 0 # too much already enqueued\n if len(buf) > 2048:\n buf = buf[:2048]\n self.mux.send(self.channel, CMD_TCP_DATA, buf)\n return len(buf)\n\n def uread(self):\n if self.shut_read:\n return b'' # EOF\n else:\n return None # no data available right now\n\n def got_packet(self, cmd, data):\n if cmd == CMD_TCP_EOF:\n self.noread()\n elif cmd == CMD_TCP_STOP_SENDING:\n self.nowrite()\n elif cmd == CMD_TCP_DATA:\n self.buf.append(data)\n else:\n raise Exception('unknown command %d (%d bytes)'\n % (cmd, len(data)))\n\n\ndef connect_dst(family, ip, port):\n debug2('Connecting to %s:%d\\n' % (ip, port))\n outsock = socket.socket(family)\n outsock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)\n return SockWrapper(outsock, outsock,\n connect_to=(ip, port),\n peername = '%s:%d' % (ip, port))\n\n\ndef runonce(handlers, mux):\n r = []\n w = []\n x = []\n to_remove = [s for s in handlers if not s.ok]\n for h in to_remove:\n handlers.remove(h)\n\n for s in handlers:\n s.pre_select(r, w, x)\n debug2('Waiting: %d r=%r w=%r x=%r (fullness=%d/%d)\\n'\n % (len(handlers), _fds(r), _fds(w), _fds(x),\n mux.fullness, mux.too_full))\n (r, w, x) = select.select(r, w, x)\n debug2(' Ready: %d r=%r w=%r x=%r\\n'\n % (len(handlers), _fds(r), _fds(w), _fds(x)))\n ready = r + w + x\n did = {}\n for h in handlers:\n for s in h.socks:\n if s in ready:\n h.callback(s)\n did[s] = 1\n for s in ready:\n if s not in did:\n raise Fatal('socket %r was not used by any handler' % s)\n" }, { "path": "sshuttle/ssyslog.py", "content": "import sys\nimport os\nimport subprocess as ssubprocess\n\n\n_p = None\n\n\ndef start_syslog():\n global _p\n _p = ssubprocess.Popen(['logger',\n '-p', 'daemon.notice',\n '-t', 'sshuttle'], stdin=ssubprocess.PIPE)\n\n\ndef stderr_to_syslog():\n sys.stdout.flush()\n sys.stderr.flush()\n os.dup2(_p.stdin.fileno(), 2)\n" }, { "path": "sshuttle/stresstest.py", "content": "#!/usr/bin/env python\nimport socket\nimport select\nimport struct\nimport time\n\nlistener = socket.socket()\nlistener.bind(('127.0.0.1', 0))\nlistener.listen(500)\n\nservers = []\nclients = []\nremain = {}\n\nNUMCLIENTS = 50\ncount = 0\n\n\nwhile 1:\n if len(clients) < NUMCLIENTS:\n c = socket.socket()\n c.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n c.bind(('0.0.0.0', 0))\n c.connect(listener.getsockname())\n count += 1\n if count >= 16384:\n count = 1\n print('cli CREATING %d' % count)\n b = struct.pack('I', count) + 'x' * count\n remain[c] = count\n print('cli >> %r' % len(b))\n c.send(b)\n c.shutdown(socket.SHUT_WR)\n clients.append(c)\n r = [listener]\n time.sleep(0.1)\n else:\n r = [listener] + servers + clients\n print('select(%d)' % len(r))\n r, w, x = select.select(r, [], [], 5)\n assert(r)\n for i in r:\n if i == listener:\n s, addr = listener.accept()\n servers.append(s)\n elif i in servers:\n b = i.recv(4096)\n print('srv << %r' % len(b))\n if i not in remain:\n assert(len(b) >= 4)\n want = struct.unpack('I', b[:4])[0]\n b = b[4:]\n # i.send('y'*want)\n else:\n want = remain[i]\n if want < len(b):\n print('weird wanted %d bytes, got %d: %r' % (want, len(b), b))\n assert(want >= len(b))\n want -= len(b)\n remain[i] = want\n if not b: # EOF\n if want:\n print('weird: eof but wanted %d more' % want)\n assert(want == 0)\n i.close()\n servers.remove(i)\n del remain[i]\n else:\n print('srv >> %r' % len(b))\n i.send('y' * len(b))\n if not want:\n i.shutdown(socket.SHUT_WR)\n elif i in clients:\n b = i.recv(4096)\n print('cli << %r' % len(b))\n want = remain[i]\n if want < len(b):\n print('weird wanted %d bytes, got %d: %r' % (want, len(b), b))\n assert(want >= len(b))\n want -= len(b)\n remain[i] = want\n if not b: # EOF\n if want:\n print('weird: eof but wanted %d more' % want)\n assert(want == 0)\n i.close()\n clients.remove(i)\n del remain[i]\nlistener.accept()\n" }, { "path": "sshuttle/tests/test_firewall.py", "content": "from mock import Mock, patch, call\nimport io\n\nimport sshuttle.firewall\n\n\ndef setup_daemon():\n stdin = io.StringIO(u\"\"\"ROUTES\n2,24,0,1.2.3.0\n2,32,1,1.2.3.66\n10,64,0,2404:6800:4004:80c::\n10,128,1,2404:6800:4004:80c::101f\nNSLIST\n2,1.2.3.33\n10,2404:6800:4004:80c::33\nPORTS 1024,1025,1026,1027\nGO 1\nHOST 1.2.3.3,existing\n\"\"\")\n stdout = Mock()\n return stdin, stdout\n\n\ndef test_rewrite_etc_hosts(tmpdir):\n orig_hosts = tmpdir.join(\"hosts.orig\")\n orig_hosts.write(\"1.2.3.3 existing\\n\")\n\n new_hosts = tmpdir.join(\"hosts\")\n orig_hosts.copy(new_hosts)\n\n hostmap = {\n 'myhost': '1.2.3.4',\n 'myotherhost': '1.2.3.5',\n }\n with patch('sshuttle.firewall.HOSTSFILE', new=str(new_hosts)):\n sshuttle.firewall.rewrite_etc_hosts(hostmap, 10)\n\n with new_hosts.open() as f:\n line = f.readline()\n s = line.split()\n assert s == ['1.2.3.3', 'existing']\n\n line = f.readline()\n s = line.split()\n assert s == ['1.2.3.4', 'myhost',\n '#', 'sshuttle-firewall-10', 'AUTOCREATED']\n\n line = f.readline()\n s = line.split()\n assert s == ['1.2.3.5', 'myotherhost',\n '#', 'sshuttle-firewall-10', 'AUTOCREATED']\n\n line = f.readline()\n assert line == \"\"\n\n with patch('sshuttle.firewall.HOSTSFILE', new=str(new_hosts)):\n sshuttle.firewall.restore_etc_hosts(10)\n assert orig_hosts.computehash() == new_hosts.computehash()\n\n\n@patch('sshuttle.firewall.rewrite_etc_hosts')\n@patch('sshuttle.firewall.setup_daemon')\n@patch('sshuttle.firewall.get_method')\ndef test_main(mock_get_method, mock_setup_daemon, mock_rewrite_etc_hosts):\n stdin, stdout = setup_daemon()\n mock_setup_daemon.return_value = stdin, stdout\n\n mock_get_method(\"not_auto\").name = \"test\"\n mock_get_method.reset_mock()\n\n sshuttle.firewall.main(\"not_auto\", False)\n\n assert mock_rewrite_etc_hosts.mock_calls == [\n call({'1.2.3.3': 'existing'}, 1024),\n call({}, 1024),\n ]\n\n assert stdout.mock_calls == [\n call.write('READY test\\n'),\n call.flush(),\n call.write('STARTED\\n'),\n call.flush()\n ]\n assert mock_setup_daemon.mock_calls == [call()]\n assert mock_get_method.mock_calls == [\n call('not_auto'),\n call().setup_firewall(\n 1024, 1026,\n [(10, u'2404:6800:4004:80c::33')],\n 10,\n [(10, 64, False, u'2404:6800:4004:80c::'),\n (10, 128, True, u'2404:6800:4004:80c::101f')],\n True),\n call().setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n True),\n call().restore_firewall(1024, 10, True),\n call().restore_firewall(1025, 2, True),\n ]\n" }, { "path": "sshuttle/tests/test_helpers.py", "content": "from mock import patch, call\nimport sys\nimport io\nimport socket\n\nimport sshuttle.helpers\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_log(mock_stderr, mock_stdout):\n sshuttle.helpers.log(\"message\")\n sshuttle.helpers.log(\"abc\")\n sshuttle.helpers.log(\"message 1\\n\")\n sshuttle.helpers.log(\"message 2\\nline2\\nline3\\n\")\n sshuttle.helpers.log(\"message 3\\nline2\\nline3\")\n assert mock_stdout.mock_calls == [\n call.flush(),\n call.flush(),\n call.flush(),\n call.flush(),\n call.flush(),\n ]\n assert mock_stderr.mock_calls == [\n call.write('prefix: message'),\n call.flush(),\n call.write('prefix: abc'),\n call.flush(),\n call.write('prefix: message 1\\n'),\n call.flush(),\n call.write('prefix: message 2\\n'),\n call.write('---> line2\\n'),\n call.write('---> line3\\n'),\n call.flush(),\n call.write('prefix: message 3\\n'),\n call.write('---> line2\\n'),\n call.write('---> line3\\n'),\n call.flush(),\n ]\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.verbose', new=1)\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_debug1(mock_stderr, mock_stdout):\n sshuttle.helpers.debug1(\"message\")\n assert mock_stdout.mock_calls == [\n call.flush(),\n ]\n assert mock_stderr.mock_calls == [\n call.write('prefix: message'),\n call.flush(),\n ]\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.verbose', new=0)\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_debug1_nop(mock_stderr, mock_stdout):\n sshuttle.helpers.debug1(\"message\")\n assert mock_stdout.mock_calls == []\n assert mock_stderr.mock_calls == []\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.verbose', new=2)\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_debug2(mock_stderr, mock_stdout):\n sshuttle.helpers.debug2(\"message\")\n assert mock_stdout.mock_calls == [\n call.flush(),\n ]\n assert mock_stderr.mock_calls == [\n call.write('prefix: message'),\n call.flush(),\n ]\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.verbose', new=1)\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_debug2_nop(mock_stderr, mock_stdout):\n sshuttle.helpers.debug2(\"message\")\n assert mock_stdout.mock_calls == []\n assert mock_stderr.mock_calls == []\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.verbose', new=3)\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_debug3(mock_stderr, mock_stdout):\n sshuttle.helpers.debug3(\"message\")\n assert mock_stdout.mock_calls == [\n call.flush(),\n ]\n assert mock_stderr.mock_calls == [\n call.write('prefix: message'),\n call.flush(),\n ]\n\n\n@patch('sshuttle.helpers.logprefix', new='prefix: ')\n@patch('sshuttle.helpers.verbose', new=2)\n@patch('sshuttle.helpers.sys.stdout')\n@patch('sshuttle.helpers.sys.stderr')\ndef test_debug3_nop(mock_stderr, mock_stdout):\n sshuttle.helpers.debug3(\"message\")\n assert mock_stdout.mock_calls == []\n assert mock_stderr.mock_calls == []\n\n\n@patch('sshuttle.helpers.open', create=True)\ndef test_resolvconf_nameservers(mock_open):\n mock_open.return_value = io.StringIO(u\"\"\"\n# Generated by NetworkManager\nsearch pri\nnameserver 192.168.1.1\nnameserver 192.168.2.1\nnameserver 192.168.3.1\nnameserver 192.168.4.1\nnameserver 2404:6800:4004:80c::1\nnameserver 2404:6800:4004:80c::2\nnameserver 2404:6800:4004:80c::3\nnameserver 2404:6800:4004:80c::4\n\"\"\")\n\n ns = sshuttle.helpers.resolvconf_nameservers()\n assert ns == [\n (2, u'192.168.1.1'), (2, u'192.168.2.1'),\n (2, u'192.168.3.1'), (2, u'192.168.4.1'),\n (10, u'2404:6800:4004:80c::1'), (10, u'2404:6800:4004:80c::2'),\n (10, u'2404:6800:4004:80c::3'), (10, u'2404:6800:4004:80c::4')\n ]\n\n\n@patch('sshuttle.helpers.open', create=True)\ndef test_resolvconf_random_nameserver(mock_open):\n mock_open.return_value = io.StringIO(u\"\"\"\n# Generated by NetworkManager\nsearch pri\nnameserver 192.168.1.1\nnameserver 192.168.2.1\nnameserver 192.168.3.1\nnameserver 192.168.4.1\nnameserver 2404:6800:4004:80c::1\nnameserver 2404:6800:4004:80c::2\nnameserver 2404:6800:4004:80c::3\nnameserver 2404:6800:4004:80c::4\n\"\"\")\n ns = sshuttle.helpers.resolvconf_random_nameserver()\n assert ns in [\n (2, u'192.168.1.1'), (2, u'192.168.2.1'),\n (2, u'192.168.3.1'), (2, u'192.168.4.1'),\n (10, u'2404:6800:4004:80c::1'), (10, u'2404:6800:4004:80c::2'),\n (10, u'2404:6800:4004:80c::3'), (10, u'2404:6800:4004:80c::4')\n ]\n\n\ndef test_islocal():\n assert sshuttle.helpers.islocal(\"127.0.0.1\", socket.AF_INET)\n assert not sshuttle.helpers.islocal(\"192.0.2.1\", socket.AF_INET)\n assert sshuttle.helpers.islocal(\"::1\", socket.AF_INET6)\n assert not sshuttle.helpers.islocal(\"2001:db8::1\", socket.AF_INET6)\n\n\ndef test_family_ip_tuple():\n assert sshuttle.helpers.family_ip_tuple(\"127.0.0.1\") \\\n == (socket.AF_INET, \"127.0.0.1\")\n assert sshuttle.helpers.family_ip_tuple(\"192.168.2.6\") \\\n == (socket.AF_INET, \"192.168.2.6\")\n assert sshuttle.helpers.family_ip_tuple(\"::1\") \\\n == (socket.AF_INET6, \"::1\")\n assert sshuttle.helpers.family_ip_tuple(\"2404:6800:4004:80c::1\") \\\n == (socket.AF_INET6, \"2404:6800:4004:80c::1\")\n\n\ndef test_family_to_string():\n assert sshuttle.helpers.family_to_string(socket.AF_INET) == \"AF_INET\"\n assert sshuttle.helpers.family_to_string(socket.AF_INET6) == \"AF_INET6\"\n if sys.version_info < (3, 0):\n expected = \"1\"\n assert sshuttle.helpers.family_to_string(socket.AF_UNIX) == \"1\"\n else:\n expected = 'AddressFamily.AF_UNIX'\n assert sshuttle.helpers.family_to_string(socket.AF_UNIX) == expected\n" }, { "path": "sshuttle/tests/test_methods_nat.py", "content": "import pytest\nfrom mock import Mock, patch, call\nimport socket\nimport struct\n\nfrom sshuttle.helpers import Fatal\nfrom sshuttle.methods import get_method\n\n\ndef test_get_supported_features():\n method = get_method('nat')\n features = method.get_supported_features()\n assert not features.ipv6\n assert not features.udp\n assert features.dns\n\n\ndef test_get_tcp_dstip():\n sock = Mock()\n sock.getsockopt.return_value = struct.pack(\n '!HHBBBB', socket.ntohs(socket.AF_INET), 1024, 127, 0, 0, 1)\n method = get_method('nat')\n assert method.get_tcp_dstip(sock) == ('127.0.0.1', 1024)\n assert sock.mock_calls == [call.getsockopt(0, 80, 16)]\n\n\ndef test_recv_udp():\n sock = Mock()\n sock.recvfrom.return_value = \"11111\", \"127.0.0.1\"\n method = get_method('nat')\n result = method.recv_udp(sock, 1024)\n assert sock.mock_calls == [call.recvfrom(1024)]\n assert result == (\"127.0.0.1\", None, \"11111\")\n\n\ndef test_send_udp():\n sock = Mock()\n method = get_method('nat')\n method.send_udp(sock, None, \"127.0.0.1\", \"22222\")\n assert sock.mock_calls == [call.sendto(\"22222\", \"127.0.0.1\")]\n\n\ndef test_setup_tcp_listener():\n listener = Mock()\n method = get_method('nat')\n method.setup_tcp_listener(listener)\n assert listener.mock_calls == []\n\n\ndef test_setup_udp_listener():\n listener = Mock()\n method = get_method('nat')\n method.setup_udp_listener(listener)\n assert listener.mock_calls == []\n\n\ndef test_assert_features():\n method = get_method('nat')\n features = method.get_supported_features()\n method.assert_features(features)\n\n features.udp = True\n with pytest.raises(Fatal):\n method.assert_features(features)\n\n features.ipv6 = True\n with pytest.raises(Fatal):\n method.assert_features(features)\n\n\ndef test_firewall_command():\n method = get_method('nat')\n assert not method.firewall_command(\"somthing\")\n\n\n@patch('sshuttle.methods.nat.ipt')\n@patch('sshuttle.methods.nat.ipt_ttl')\n@patch('sshuttle.methods.nat.ipt_chain_exists')\ndef test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):\n mock_ipt_chain_exists.return_value = True\n method = get_method('nat')\n assert method.name == 'nat'\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1024, 1026,\n [(10, u'2404:6800:4004:80c::33')],\n 10,\n [(10, 64, False, u'2404:6800:4004:80c::'),\n (10, 128, True, u'2404:6800:4004:80c::101f')],\n True)\n assert str(excinfo.value) \\\n == 'Address family \"AF_INET6\" unsupported by nat method_name'\n assert mock_ipt_chain_exists.mock_calls == []\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == []\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n True)\n assert str(excinfo.value) == 'UDP not supported by nat method_name'\n assert mock_ipt_chain_exists.mock_calls == []\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == []\n\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n False)\n assert mock_ipt_chain_exists.mock_calls == [\n call(2, 'nat', 'sshuttle-1025')\n ]\n assert mock_ipt_ttl.mock_calls == [\n call(2, 'nat', '-A', 'sshuttle-1025', '-j', 'REDIRECT',\n '--dest', u'1.2.3.0/24', '-p', 'tcp', '--to-ports', '1025'),\n call(2, 'nat', '-A', 'sshuttle-1025', '-j', 'REDIRECT',\n '--dest', u'1.2.3.33/32', '-p', 'udp',\n '--dport', '53', '--to-ports', '1027')\n ]\n assert mock_ipt.mock_calls == [\n call(2, 'nat', '-D', 'OUTPUT', '-j', 'sshuttle-1025'),\n call(2, 'nat', '-D', 'PREROUTING', '-j', 'sshuttle-1025'),\n call(2, 'nat', '-F', 'sshuttle-1025'),\n call(2, 'nat', '-X', 'sshuttle-1025'),\n call(2, 'nat', '-N', 'sshuttle-1025'),\n call(2, 'nat', '-F', 'sshuttle-1025'),\n call(2, 'nat', '-I', 'OUTPUT', '1', '-j', 'sshuttle-1025'),\n call(2, 'nat', '-I', 'PREROUTING', '1', '-j', 'sshuttle-1025'),\n call(2, 'nat', '-A', 'sshuttle-1025', '-j', 'RETURN',\n '--dest', u'1.2.3.66/32', '-p', 'tcp')\n ]\n mock_ipt_chain_exists.reset_mock()\n mock_ipt_ttl.reset_mock()\n mock_ipt.reset_mock()\n\n method.restore_firewall(1025, 2, False)\n assert mock_ipt_chain_exists.mock_calls == [\n call(2, 'nat', 'sshuttle-1025')\n ]\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == [\n call(2, 'nat', '-D', 'OUTPUT', '-j', 'sshuttle-1025'),\n call(2, 'nat', '-D', 'PREROUTING', '-j', 'sshuttle-1025'),\n call(2, 'nat', '-F', 'sshuttle-1025'),\n call(2, 'nat', '-X', 'sshuttle-1025')\n ]\n mock_ipt_chain_exists.reset_mock()\n mock_ipt_ttl.reset_mock()\n mock_ipt.reset_mock()\n" }, { "path": "sshuttle/tests/test_methods_pf.py", "content": "import pytest\nfrom mock import Mock, patch, call, ANY\nimport socket\n\nfrom sshuttle.methods import get_method\nfrom sshuttle.helpers import Fatal\nfrom sshuttle.methods.pf import FreeBsd, Darwin, OpenBsd\n\n\ndef test_get_supported_features():\n method = get_method('pf')\n features = method.get_supported_features()\n assert not features.ipv6\n assert not features.udp\n assert features.dns\n\n\n@patch('sshuttle.helpers.verbose', new=3)\ndef test_get_tcp_dstip():\n sock = Mock()\n sock.getpeername.return_value = (\"127.0.0.1\", 1024)\n sock.getsockname.return_value = (\"127.0.0.2\", 1025)\n sock.family = socket.AF_INET\n\n firewall = Mock()\n firewall.pfile.readline.return_value = \\\n b\"QUERY_PF_NAT_SUCCESS 127.0.0.3,1026\\n\"\n\n method = get_method('pf')\n method.set_firewall(firewall)\n assert method.get_tcp_dstip(sock) == ('127.0.0.3', 1026)\n\n assert sock.mock_calls == [\n call.getpeername(),\n call.getsockname(),\n ]\n assert firewall.mock_calls == [\n call.pfile.write(b'QUERY_PF_NAT 2,6,127.0.0.1,1024,127.0.0.2,1025\\n'),\n call.pfile.flush(),\n call.pfile.readline()\n ]\n\n\ndef test_recv_udp():\n sock = Mock()\n sock.recvfrom.return_value = \"11111\", \"127.0.0.1\"\n method = get_method('pf')\n result = method.recv_udp(sock, 1024)\n assert sock.mock_calls == [call.recvfrom(1024)]\n assert result == (\"127.0.0.1\", None, \"11111\")\n\n\ndef test_send_udp():\n sock = Mock()\n method = get_method('pf')\n method.send_udp(sock, None, \"127.0.0.1\", \"22222\")\n assert sock.mock_calls == [call.sendto(\"22222\", \"127.0.0.1\")]\n\n\ndef test_setup_tcp_listener():\n listener = Mock()\n method = get_method('pf')\n method.setup_tcp_listener(listener)\n assert listener.mock_calls == []\n\n\ndef test_setup_udp_listener():\n listener = Mock()\n method = get_method('pf')\n method.setup_udp_listener(listener)\n assert listener.mock_calls == []\n\n\ndef test_assert_features():\n method = get_method('pf')\n features = method.get_supported_features()\n method.assert_features(features)\n\n features.udp = True\n with pytest.raises(Fatal):\n method.assert_features(features)\n\n features.ipv6 = True\n with pytest.raises(Fatal):\n method.assert_features(features)\n\n\n@patch('sshuttle.methods.pf.pf', Darwin())\n@patch('sshuttle.methods.pf.sys.stdout')\n@patch('sshuttle.methods.pf.ioctl')\n@patch('sshuttle.methods.pf.pf_get_dev')\ndef test_firewall_command_darwin(mock_pf_get_dev, mock_ioctl, mock_stdout):\n method = get_method('pf')\n assert not method.firewall_command(\"somthing\")\n\n command = \"QUERY_PF_NAT %d,%d,%s,%d,%s,%d\\n\" % (\n socket.AF_INET, socket.IPPROTO_TCP,\n \"127.0.0.1\", 1025, \"127.0.0.2\", 1024)\n assert method.firewall_command(command)\n\n assert mock_pf_get_dev.mock_calls == [call()]\n assert mock_ioctl.mock_calls == [\n call(mock_pf_get_dev(), 0xc0544417, ANY),\n ]\n assert mock_stdout.mock_calls == [\n call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\\n'),\n call.flush(),\n ]\n\n\n@patch('sshuttle.methods.pf.pf', FreeBsd())\n@patch('sshuttle.methods.pf.sys.stdout')\n@patch('sshuttle.methods.pf.ioctl')\n@patch('sshuttle.methods.pf.pf_get_dev')\ndef test_firewall_command_freebsd(mock_pf_get_dev, mock_ioctl, mock_stdout):\n method = get_method('pf')\n assert not method.firewall_command(\"somthing\")\n\n command = \"QUERY_PF_NAT %d,%d,%s,%d,%s,%d\\n\" % (\n socket.AF_INET, socket.IPPROTO_TCP,\n \"127.0.0.1\", 1025, \"127.0.0.2\", 1024)\n assert method.firewall_command(command)\n\n assert mock_pf_get_dev.mock_calls == [call()]\n assert mock_ioctl.mock_calls == [\n call(mock_pf_get_dev(), 0xc04c4417, ANY),\n ]\n assert mock_stdout.mock_calls == [\n call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\\n'),\n call.flush(),\n ]\n\n\n@patch('sshuttle.methods.pf.pf', OpenBsd())\n@patch('sshuttle.methods.pf.sys.stdout')\n@patch('sshuttle.methods.pf.ioctl')\n@patch('sshuttle.methods.pf.pf_get_dev')\ndef test_firewall_command_openbsd(mock_pf_get_dev, mock_ioctl, mock_stdout):\n method = get_method('pf')\n assert not method.firewall_command(\"somthing\")\n\n command = \"QUERY_PF_NAT %d,%d,%s,%d,%s,%d\\n\" % (\n socket.AF_INET, socket.IPPROTO_TCP,\n \"127.0.0.1\", 1025, \"127.0.0.2\", 1024)\n assert method.firewall_command(command)\n\n assert mock_pf_get_dev.mock_calls == [call()]\n assert mock_ioctl.mock_calls == [\n call(mock_pf_get_dev(), 0xc0504417, ANY),\n ]\n assert mock_stdout.mock_calls == [\n call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\\n'),\n call.flush(),\n ]\n\n\ndef pfctl(args, stdin=None):\n if args == '-s all':\n return (b'INFO:\\nStatus: Disabled\\nanother mary had a little lamb\\n',\n b'little lamb\\n')\n if args == '-E':\n return (b'\\n', b'Token : abcdefg\\n')\n return None\n\n\n@patch('sshuttle.helpers.verbose', new=3)\n@patch('sshuttle.methods.pf.pf', Darwin())\n@patch('sshuttle.methods.pf.pfctl')\n@patch('sshuttle.methods.pf.ioctl')\n@patch('sshuttle.methods.pf.pf_get_dev')\ndef test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):\n mock_pfctl.side_effect = pfctl\n\n method = get_method('pf')\n assert method.name == 'pf'\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1024, 1026,\n [(10, u'2404:6800:4004:80c::33')],\n 10,\n [(10, 64, False, u'2404:6800:4004:80c::'),\n (10, 128, True, u'2404:6800:4004:80c::101f')],\n True)\n assert str(excinfo.value) \\\n == 'Address family \"AF_INET6\" unsupported by pf method_name'\n assert mock_pf_get_dev.mock_calls == []\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == []\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n True)\n assert str(excinfo.value) == 'UDP not supported by pf method_name'\n assert mock_pf_get_dev.mock_calls == []\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == []\n\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n False)\n assert mock_ioctl.mock_calls == [\n call(mock_pf_get_dev(), 0xC4704433, ANY),\n call(mock_pf_get_dev(), 0xCC20441A, ANY),\n call(mock_pf_get_dev(), 0xCC20441A, ANY),\n call(mock_pf_get_dev(), 0xC4704433, ANY),\n call(mock_pf_get_dev(), 0xCC20441A, ANY),\n call(mock_pf_get_dev(), 0xCC20441A, ANY),\n ]\n assert mock_pfctl.mock_calls == [\n call('-f /dev/stdin', b'pass on lo\\n'),\n call('-s all'),\n call('-a sshuttle -f /dev/stdin',\n b'table {!1.2.3.66/32,1.2.3.0/24}\\n'\n b'table {1.2.3.33}\\n'\n b'rdr pass on lo0 proto tcp '\n b'to -> 127.0.0.1 port 1025\\n'\n b'rdr pass on lo0 proto udp '\n b'to port 53 -> 127.0.0.1 port 1027\\n'\n b'pass out route-to lo0 inet proto tcp '\n b'to keep state\\n'\n b'pass out route-to lo0 inet proto udp '\n b'to port 53 keep state\\n'),\n call('-E'),\n ]\n mock_pf_get_dev.reset_mock()\n mock_ioctl.reset_mock()\n mock_pfctl.reset_mock()\n\n method.restore_firewall(1025, 2, False)\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == [\n call('-a sshuttle -F all'),\n call(\"-X abcdefg\"),\n ]\n mock_pf_get_dev.reset_mock()\n mock_pfctl.reset_mock()\n mock_ioctl.reset_mock()\n\n\n@patch('sshuttle.helpers.verbose', new=3)\n@patch('sshuttle.methods.pf.pf', FreeBsd())\n@patch('sshuttle.methods.pf.pfctl')\n@patch('sshuttle.methods.pf.ioctl')\n@patch('sshuttle.methods.pf.pf_get_dev')\ndef test_setup_firewall_freebsd(mock_pf_get_dev, mock_ioctl, mock_pfctl):\n mock_pfctl.side_effect = pfctl\n\n method = get_method('pf')\n assert method.name == 'pf'\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1024, 1026,\n [(10, u'2404:6800:4004:80c::33')],\n 10,\n [(10, 64, False, u'2404:6800:4004:80c::'),\n (10, 128, True, u'2404:6800:4004:80c::101f')],\n True)\n assert str(excinfo.value) \\\n == 'Address family \"AF_INET6\" unsupported by pf method_name'\n assert mock_pf_get_dev.mock_calls == []\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == []\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n True)\n assert str(excinfo.value) == 'UDP not supported by pf method_name'\n assert mock_pf_get_dev.mock_calls == []\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == []\n\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n False)\n assert mock_ioctl.mock_calls == [\n call(mock_pf_get_dev(), 0xC4704433, ANY),\n call(mock_pf_get_dev(), 0xCBE0441A, ANY),\n call(mock_pf_get_dev(), 0xCBE0441A, ANY),\n call(mock_pf_get_dev(), 0xC4704433, ANY),\n call(mock_pf_get_dev(), 0xCBE0441A, ANY),\n call(mock_pf_get_dev(), 0xCBE0441A, ANY),\n ]\n assert mock_pfctl.mock_calls == [\n call('-s all'),\n call('-a sshuttle -f /dev/stdin',\n b'table {!1.2.3.66/32,1.2.3.0/24}\\n'\n b'table {1.2.3.33}\\n'\n b'rdr pass on lo0 proto tcp '\n b'to -> 127.0.0.1 port 1025\\n'\n b'rdr pass on lo0 proto udp '\n b'to port 53 -> 127.0.0.1 port 1027\\n'\n b'pass out route-to lo0 inet proto tcp '\n b'to keep state\\n'\n b'pass out route-to lo0 inet proto udp '\n b'to port 53 keep state\\n'),\n call('-e'),\n ]\n mock_pf_get_dev.reset_mock()\n mock_ioctl.reset_mock()\n mock_pfctl.reset_mock()\n\n method.restore_firewall(1025, 2, False)\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == [\n call('-a sshuttle -F all'),\n call(\"-d\"),\n ]\n mock_pf_get_dev.reset_mock()\n mock_pfctl.reset_mock()\n mock_ioctl.reset_mock()\n\n\n@patch('sshuttle.helpers.verbose', new=3)\n@patch('sshuttle.methods.pf.pf', OpenBsd())\n@patch('sshuttle.methods.pf.pfctl')\n@patch('sshuttle.methods.pf.ioctl')\n@patch('sshuttle.methods.pf.pf_get_dev')\ndef test_setup_firewall_openbsd(mock_pf_get_dev, mock_ioctl, mock_pfctl):\n mock_pfctl.side_effect = pfctl\n\n method = get_method('pf')\n assert method.name == 'pf'\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1024, 1026,\n [(10, u'2404:6800:4004:80c::33')],\n 10,\n [(10, 64, False, u'2404:6800:4004:80c::'),\n (10, 128, True, u'2404:6800:4004:80c::101f')],\n True)\n assert str(excinfo.value) \\\n == 'Address family \"AF_INET6\" unsupported by pf method_name'\n assert mock_pf_get_dev.mock_calls == []\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == []\n\n with pytest.raises(Exception) as excinfo:\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n True)\n assert str(excinfo.value) == 'UDP not supported by pf method_name'\n assert mock_pf_get_dev.mock_calls == []\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == []\n\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n False)\n assert mock_ioctl.mock_calls == [\n call(mock_pf_get_dev(), 0xcd48441a, ANY),\n call(mock_pf_get_dev(), 0xcd48441a, ANY),\n ]\n assert mock_pfctl.mock_calls == [\n call('-f /dev/stdin', b'match on lo\\n'),\n call('-s all'),\n call('-a sshuttle -f /dev/stdin',\n b'table {!1.2.3.66/32,1.2.3.0/24}\\n'\n b'table {1.2.3.33}\\n'\n b'pass in on lo0 inet proto tcp divert-to 127.0.0.1 port 1025\\n'\n b'pass in on lo0 inet proto udp to '\n b'port 53 rdr-to 127.0.0.1 port 1027\\n'\n b'pass out inet proto tcp to '\n b' route-to lo0 keep state\\n'\n b'pass out inet proto udp to '\n b' port 53 route-to lo0 keep state\\n'),\n call('-e'),\n ]\n mock_pf_get_dev.reset_mock()\n mock_ioctl.reset_mock()\n mock_pfctl.reset_mock()\n\n method.restore_firewall(1025, 2, False)\n assert mock_ioctl.mock_calls == []\n assert mock_pfctl.mock_calls == [\n call('-a sshuttle -F all'),\n call(\"-d\"),\n ]\n mock_pf_get_dev.reset_mock()\n mock_pfctl.reset_mock()\n mock_ioctl.reset_mock()\n" }, { "path": "sshuttle/tests/test_methods_tproxy.py", "content": "from mock import Mock, patch, call\n\nfrom sshuttle.methods import get_method\n\n\n@patch(\"sshuttle.methods.tproxy.recvmsg\")\ndef test_get_supported_features_recvmsg(mock_recvmsg):\n method = get_method('tproxy')\n features = method.get_supported_features()\n assert features.ipv6\n assert features.udp\n assert features.dns\n\n\n@patch(\"sshuttle.methods.tproxy.recvmsg\", None)\ndef test_get_supported_features_norecvmsg():\n method = get_method('tproxy')\n features = method.get_supported_features()\n assert features.ipv6\n assert not features.udp\n assert not features.dns\n\n\ndef test_get_tcp_dstip():\n sock = Mock()\n sock.getsockname.return_value = ('127.0.0.1', 1024)\n method = get_method('tproxy')\n assert method.get_tcp_dstip(sock) == ('127.0.0.1', 1024)\n assert sock.mock_calls == [call.getsockname()]\n\n\n@patch(\"sshuttle.methods.tproxy.recv_udp\")\ndef test_recv_udp(mock_recv_udp):\n mock_recv_udp.return_value = (\"127.0.0.1\", \"127.0.0.2\", \"11111\")\n\n sock = Mock()\n method = get_method('tproxy')\n result = method.recv_udp(sock, 1024)\n assert sock.mock_calls == []\n assert mock_recv_udp.mock_calls == [call(sock, 1024)]\n assert result == (\"127.0.0.1\", \"127.0.0.2\", \"11111\")\n\n\n@patch(\"sshuttle.methods.socket.socket\")\ndef test_send_udp(mock_socket):\n sock = Mock()\n method = get_method('tproxy')\n method.send_udp(sock, \"127.0.0.2\", \"127.0.0.1\", \"2222222\")\n assert sock.mock_calls == []\n assert mock_socket.mock_calls == [\n call(sock.family, 2),\n call().setsockopt(1, 2, 1),\n call().setsockopt(0, 19, 1),\n call().bind('127.0.0.2'),\n call().sendto(\"2222222\", '127.0.0.1'),\n call().close()\n ]\n\n\ndef test_setup_tcp_listener():\n listener = Mock()\n method = get_method('tproxy')\n method.setup_tcp_listener(listener)\n assert listener.mock_calls == [\n call.setsockopt(0, 19, 1)\n ]\n\n\ndef test_setup_udp_listener():\n listener = Mock()\n method = get_method('tproxy')\n method.setup_udp_listener(listener)\n assert listener.mock_calls == [\n call.setsockopt(0, 19, 1),\n call.v4.setsockopt(0, 20, 1),\n call.v6.setsockopt(41, 74, 1)\n ]\n\n\ndef test_assert_features():\n method = get_method('tproxy')\n features = method.get_supported_features()\n method.assert_features(features)\n\n\ndef test_firewall_command():\n method = get_method('tproxy')\n assert not method.firewall_command(\"somthing\")\n\n\n@patch('sshuttle.methods.tproxy.ipt')\n@patch('sshuttle.methods.tproxy.ipt_ttl')\n@patch('sshuttle.methods.tproxy.ipt_chain_exists')\ndef test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):\n mock_ipt_chain_exists.return_value = True\n method = get_method('tproxy')\n assert method.name == 'tproxy'\n\n # IPV6\n\n method.setup_firewall(\n 1024, 1026,\n [(10, u'2404:6800:4004:80c::33')],\n 10,\n [(10, 64, False, u'2404:6800:4004:80c::'),\n (10, 128, True, u'2404:6800:4004:80c::101f')],\n True)\n assert mock_ipt_chain_exists.mock_calls == [\n call(10, 'mangle', 'sshuttle-m-1024'),\n call(10, 'mangle', 'sshuttle-t-1024'),\n call(10, 'mangle', 'sshuttle-d-1024')\n ]\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == [\n call(10, 'mangle', '-D', 'OUTPUT', '-j', 'sshuttle-m-1024'),\n call(10, 'mangle', '-F', 'sshuttle-m-1024'),\n call(10, 'mangle', '-X', 'sshuttle-m-1024'),\n call(10, 'mangle', '-D', 'PREROUTING', '-j', 'sshuttle-t-1024'),\n call(10, 'mangle', '-F', 'sshuttle-t-1024'),\n call(10, 'mangle', '-X', 'sshuttle-t-1024'),\n call(10, 'mangle', '-F', 'sshuttle-d-1024'),\n call(10, 'mangle', '-X', 'sshuttle-d-1024'),\n call(10, 'mangle', '-N', 'sshuttle-m-1024'),\n call(10, 'mangle', '-F', 'sshuttle-m-1024'),\n call(10, 'mangle', '-N', 'sshuttle-d-1024'),\n call(10, 'mangle', '-F', 'sshuttle-d-1024'),\n call(10, 'mangle', '-N', 'sshuttle-t-1024'),\n call(10, 'mangle', '-F', 'sshuttle-t-1024'),\n call(10, 'mangle', '-I', 'OUTPUT', '1', '-j', 'sshuttle-m-1024'),\n call(10, 'mangle', '-I', 'PREROUTING', '1', '-j', 'sshuttle-t-1024'),\n call(10, 'mangle', '-A', 'sshuttle-d-1024', '-j', 'MARK',\n '--set-mark', '1'),\n call(10, 'mangle', '-A', 'sshuttle-d-1024', '-j', 'ACCEPT'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-m', 'socket',\n '-j', 'sshuttle-d-1024', '-m', 'tcp', '-p', 'tcp'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-m', 'socket',\n '-j', 'sshuttle-d-1024', '-m', 'udp', '-p', 'udp'),\n call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'MARK',\n '--set-mark', '1', '--dest', u'2404:6800:4004:80c::33/32',\n '-m', 'udp', '-p', 'udp', '--dport', '53'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1',\n '--dest', u'2404:6800:4004:80c::33/32',\n '-m', 'udp', '-p', 'udp', '--dport', '53', '--on-port', '1026'),\n call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'RETURN',\n '--dest', u'2404:6800:4004:80c::101f/128',\n '-m', 'tcp', '-p', 'tcp'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'RETURN',\n '--dest', u'2404:6800:4004:80c::101f/128',\n '-m', 'tcp', '-p', 'tcp'),\n call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'RETURN',\n '--dest', u'2404:6800:4004:80c::101f/128',\n '-m', 'udp', '-p', 'udp'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'RETURN',\n '--dest', u'2404:6800:4004:80c::101f/128',\n '-m', 'udp', '-p', 'udp'),\n call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'MARK',\n '--set-mark', '1', '--dest', u'2404:6800:4004:80c::/64',\n '-m', 'tcp', '-p', 'tcp'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1', '--dest', u'2404:6800:4004:80c::/64',\n '-m', 'tcp', '-p', 'tcp', '--on-port', '1024'),\n call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'MARK',\n '--set-mark', '1', '--dest', u'2404:6800:4004:80c::/64',\n '-m', 'udp', '-p', 'udp'),\n call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1', '--dest', u'2404:6800:4004:80c::/64',\n '-m', 'udp', '-p', 'udp', '--on-port', '1024')\n ]\n mock_ipt_chain_exists.reset_mock()\n mock_ipt_ttl.reset_mock()\n mock_ipt.reset_mock()\n\n method.restore_firewall(1025, 10, True)\n assert mock_ipt_chain_exists.mock_calls == [\n call(10, 'mangle', 'sshuttle-m-1025'),\n call(10, 'mangle', 'sshuttle-t-1025'),\n call(10, 'mangle', 'sshuttle-d-1025')\n ]\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == [\n call(10, 'mangle', '-D', 'OUTPUT', '-j', 'sshuttle-m-1025'),\n call(10, 'mangle', '-F', 'sshuttle-m-1025'),\n call(10, 'mangle', '-X', 'sshuttle-m-1025'),\n call(10, 'mangle', '-D', 'PREROUTING', '-j', 'sshuttle-t-1025'),\n call(10, 'mangle', '-F', 'sshuttle-t-1025'),\n call(10, 'mangle', '-X', 'sshuttle-t-1025'),\n call(10, 'mangle', '-F', 'sshuttle-d-1025'),\n call(10, 'mangle', '-X', 'sshuttle-d-1025')\n ]\n mock_ipt_chain_exists.reset_mock()\n mock_ipt_ttl.reset_mock()\n mock_ipt.reset_mock()\n\n # IPV4\n\n method.setup_firewall(\n 1025, 1027,\n [(2, u'1.2.3.33')],\n 2,\n [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],\n True)\n assert mock_ipt_chain_exists.mock_calls == [\n call(2, 'mangle', 'sshuttle-m-1025'),\n call(2, 'mangle', 'sshuttle-t-1025'),\n call(2, 'mangle', 'sshuttle-d-1025')\n ]\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == [\n call(2, 'mangle', '-D', 'OUTPUT', '-j', 'sshuttle-m-1025'),\n call(2, 'mangle', '-F', 'sshuttle-m-1025'),\n call(2, 'mangle', '-X', 'sshuttle-m-1025'),\n call(2, 'mangle', '-D', 'PREROUTING', '-j', 'sshuttle-t-1025'),\n call(2, 'mangle', '-F', 'sshuttle-t-1025'),\n call(2, 'mangle', '-X', 'sshuttle-t-1025'),\n call(2, 'mangle', '-F', 'sshuttle-d-1025'),\n call(2, 'mangle', '-X', 'sshuttle-d-1025'),\n call(2, 'mangle', '-N', 'sshuttle-m-1025'),\n call(2, 'mangle', '-F', 'sshuttle-m-1025'),\n call(2, 'mangle', '-N', 'sshuttle-d-1025'),\n call(2, 'mangle', '-F', 'sshuttle-d-1025'),\n call(2, 'mangle', '-N', 'sshuttle-t-1025'),\n call(2, 'mangle', '-F', 'sshuttle-t-1025'),\n call(2, 'mangle', '-I', 'OUTPUT', '1', '-j', 'sshuttle-m-1025'),\n call(2, 'mangle', '-I', 'PREROUTING', '1', '-j', 'sshuttle-t-1025'),\n call(2, 'mangle', '-A', 'sshuttle-d-1025',\n '-j', 'MARK', '--set-mark', '1'),\n call(2, 'mangle', '-A', 'sshuttle-d-1025', '-j', 'ACCEPT'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-m', 'socket',\n '-j', 'sshuttle-d-1025', '-m', 'tcp', '-p', 'tcp'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-m', 'socket',\n '-j', 'sshuttle-d-1025', '-m', 'udp', '-p', 'udp'),\n call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'MARK',\n '--set-mark', '1', '--dest', u'1.2.3.33/32',\n '-m', 'udp', '-p', 'udp', '--dport', '53'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1', '--dest', u'1.2.3.33/32',\n '-m', 'udp', '-p', 'udp', '--dport', '53', '--on-port', '1027'),\n call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'RETURN',\n '--dest', u'1.2.3.66/32', '-m', 'tcp', '-p', 'tcp'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'RETURN',\n '--dest', u'1.2.3.66/32', '-m', 'tcp', '-p', 'tcp'),\n call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'RETURN',\n '--dest', u'1.2.3.66/32', '-m', 'udp', '-p', 'udp'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'RETURN',\n '--dest', u'1.2.3.66/32', '-m', 'udp', '-p', 'udp'),\n call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'MARK',\n '--set-mark', '1', '--dest', u'1.2.3.0/24',\n '-m', 'tcp', '-p', 'tcp'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1', '--dest', u'1.2.3.0/24',\n '-m', 'tcp', '-p', 'tcp', '--on-port', '1025'),\n call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'MARK',\n '--set-mark', '1', '--dest', u'1.2.3.0/24',\n '-m', 'udp', '-p', 'udp'),\n call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'TPROXY',\n '--tproxy-mark', '0x1/0x1', '--dest', u'1.2.3.0/24',\n '-m', 'udp', '-p', 'udp', '--on-port', '1025')\n ]\n mock_ipt_chain_exists.reset_mock()\n mock_ipt_ttl.reset_mock()\n mock_ipt.reset_mock()\n\n method.restore_firewall(1025, 2, True)\n assert mock_ipt_chain_exists.mock_calls == [\n call(2, 'mangle', 'sshuttle-m-1025'),\n call(2, 'mangle', 'sshuttle-t-1025'),\n call(2, 'mangle', 'sshuttle-d-1025')\n ]\n assert mock_ipt_ttl.mock_calls == []\n assert mock_ipt.mock_calls == [\n call(2, 'mangle', '-D', 'OUTPUT', '-j', 'sshuttle-m-1025'),\n call(2, 'mangle', '-F', 'sshuttle-m-1025'),\n call(2, 'mangle', '-X', 'sshuttle-m-1025'),\n call(2, 'mangle', '-D', 'PREROUTING', '-j', 'sshuttle-t-1025'),\n call(2, 'mangle', '-F', 'sshuttle-t-1025'),\n call(2, 'mangle', '-X', 'sshuttle-t-1025'),\n call(2, 'mangle', '-F', 'sshuttle-d-1025'),\n call(2, 'mangle', '-X', 'sshuttle-d-1025')\n ]\n mock_ipt_chain_exists.reset_mock()\n mock_ipt_ttl.reset_mock()\n mock_ipt.reset_mock()\n" }, { "path": "tox.ini", "content": "[tox]\ndownloadcache = {toxworkdir}/cache/\nenvlist =\n py27,\n py35,\n\n[testenv]\nbasepython =\n py27: python2.7\n py35: python3.5\ncommands =\n py.test\ndeps =\n pytest\n mock\n setuptools>=17.1\n" } ]