diff --git a/sshuttle/methods/pf.py b/sshuttle/methods/pf.py index 444e0e0..2c0e575 100644 --- a/sshuttle/methods/pf.py +++ b/sshuttle/methods/pf.py @@ -14,7 +14,11 @@ from sshuttle.helpers import debug1, debug2, debug3, Fatal, family_to_string from sshuttle.methods import BaseMethod -_pf_context = {'started_by_sshuttle': False, 'Xtoken': []} +_pf_context = { + 'started_by_sshuttle': 0, + 'loaded_by_sshuttle': True, + 'Xtoken': [] +} _pf_fd = None @@ -60,13 +64,13 @@ class Generic(object): def enable(self): if b'INFO:\nStatus: Disabled' in self.status: pfctl('-e') - _pf_context['started_by_sshuttle'] = True + _pf_context['started_by_sshuttle'] += 1 def disable(self, anchor): pfctl('-a %s -F all' % anchor) - if _pf_context['started_by_sshuttle']: + if _pf_context['started_by_sshuttle'] == 1: pfctl('-d') - _pf_context['started_by_sshuttle'] = False + _pf_context['started_by_sshuttle'] -= 1 def query_nat(self, family, proto, src_ip, src_port, dst_ip, dst_port): [proto, family, src_port, dst_port] = [ @@ -168,6 +172,18 @@ class FreeBsd(Generic): def __init__(self): super(FreeBsd, self).__init__() + def enable(self): + returncode = ssubprocess.call(['kldload', 'pf']) + super(FreeBsd, self).enable() + if returncode == 0: + _pf_context['loaded_by_sshuttle'] = True + + def disable(self, anchor): + super(FreeBsd, self).disable(anchor) + if _pf_context['loaded_by_sshuttle'] and \ + _pf_context['started_by_sshuttle'] == 0: + ssubprocess.call(['kldunload', 'pf']) + def add_anchors(self, anchor): status = pfctl('-s all')[0] if ('\nrdr-anchor "%s"' % anchor).encode('ASCII') not in status: