extern/sshuttle
1
1
Fork 0
mirror of https://github.com/sshuttle/sshuttle.git synced 2024-12-29 10:09:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Increase IP4 ttl to 63 hops instead of 42

Browse Source
This commit is contained in:
Erik Selin 2020-07-16 20:51:27 -04:00
parent c5dcc918db
commit 3037a91e51
5 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sshuttle/linux.py
View File

@ -71,10 +71,10 @@ def ipt_ttl(family, *args):
global _no_ttl_module
if not _no_ttl_module:
# we avoid infinite loops by generating server-side connections
# with ttl 42. This makes the client side not recapture those
# with ttl 63. This makes the client side not recapture those
# connections, in case client == server.
try:
argsplus = list(args) + ['-m', 'ttl', '!', '--ttl', '42']
argsplus = list(args) + ['-m', 'ttl', '!', '--ttl', '63']
ipt(family, *argsplus)
except Fatal:
ipt(family, *args)

10
sshuttle/methods/ipfw.py
View File

@ -70,7 +70,7 @@ def ipfw_rule_exists(n):
found = False
for line in p.stdout:
if line.startswith(b'%05d ' % n):
if not ('ipttl 42' in line or 'check-state' in line):
if not ('ipttl 63' in line or 'check-state' in line):
log('non-sshuttle ipfw rule: %r\n' % line.strip())
raise Fatal('non-sshuttle ipfw rule #%d already exists!' % n)
found = True
@ -185,7 +185,7 @@ class Method(BaseMethod):
sender.setsockopt(socket.SOL_IP, IP_BINDANY, 1)
sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
sender.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
sender.setsockopt(socket.SOL_IP, socket.IP_TTL, 63)
sender.bind(srcip)
sender.sendto(data, dstip)
sender.close()
@ -224,7 +224,7 @@ class Method(BaseMethod):
ipfw('add', '1', 'fwd', '127.0.0.1,%d' % port,
'tcp',
'from', 'any', 'to', 'table(126)',
'not', 'ipttl', '42', 'keep-state', 'setup')
'not', 'ipttl', '63', 'keep-state', 'setup')
ipfw_noexit('table', '124', 'flush')
dnscount = 0
@ -235,11 +235,11 @@ class Method(BaseMethod):
ipfw('add', '1', 'fwd', '127.0.0.1,%d' % dnsport,
'udp',
'from', 'any', 'to', 'table(124)',
'not', 'ipttl', '42')
'not', 'ipttl', '63')
ipfw('add', '1', 'allow',
'udp',
'from', 'any', 'to', 'any',
'ipttl', '42')
'ipttl', '63')
if subnets:
# create new subnet entries

6
sshuttle/methods/nft.py
View File

@ -50,17 +50,17 @@ class Method(BaseMethod):
'ip daddr %s/%s' % (snet, swidth), 'return')))
else:
_nft('add rule', chain, *(tcp_ports + (
'ip daddr %s/%s' % (snet, swidth), 'ip ttl != 42',
'ip daddr %s/%s' % (snet, swidth), 'ip ttl != 63',
('redirect to :' + str(port)))))
for _, ip in [i for i in nslist if i[0] == family]:
if family == socket.AF_INET:
_nft('add rule', chain, 'ip protocol udp ip daddr %s' % ip,
'udp dport { 53 }', 'ip ttl != 42',
'udp dport { 53 }', 'ip ttl != 63',
('redirect to :' + str(dnsport)))
elif family == socket.AF_INET6:
_nft('add rule', chain, 'ip6 protocol udp ip6 daddr %s' % ip,
'udp dport { 53 }', 'ip ttl != 42',
'udp dport { 53 }', 'ip ttl != 63',
('redirect to :' + str(dnsport)))
def restore_firewall(self, port, family, udp, user):

4
sshuttle/server.py
View File

@ -195,7 +195,7 @@ class DnsProxy(Handler):
family, sockaddr = self._addrinfo(peer, port)
sock = socket.socket(family, socket.SOCK_DGRAM)
sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 63)
sock.connect(sockaddr)
self.peers[sock] = peer
@ -252,7 +252,7 @@ class UdpProxy(Handler):
self.chan = chan
self.sock = sock
if family == socket.AF_INET:
self.sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
self.sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 63)
def send(self, dstip, data):
debug2('UDP: sending to %r port %d\n' % dstip)

2
sshuttle/ssnet.py
View File

@ -570,7 +570,7 @@ class MuxWrapper(SockWrapper):
def connect_dst(family, ip, port):
debug2('Connecting to %s:%d\n' % (ip, port))
outsock = socket.socket(family)
outsock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
outsock.setsockopt(socket.SOL_IP, socket.IP_TTL, 63)
return SockWrapper(outsock, outsock,
connect_to=(ip, port),
peername='%s:%d' % (ip, port))