From 502960d7967f39c6e21617e725960aebf890dbb6 Mon Sep 17 00:00:00 2001 From: Scott Kuhl Date: Sun, 25 Oct 2020 12:29:32 -0400 Subject: [PATCH 1/2] Intercept DNS requests sent by systemd-resolved. Previously, we would find DNS servers we wish to intercept traffic on by reading /etc/resolv.conf. On systems using systemd-resolved, /etc/resolv.conf points to localhost and then systemd-resolved actually uses the DNS servers listed in /run/systemd/resolve/resolv.conf. Many programs will route the DNS traffic through localhost as /etc/resolv.conf indicates and sshuttle would capture it. However, systemd-resolved also provides other interfaces for programs to resolve hostnames besides the localhost server in /etc/resolv.conf. This patch adds systemd-resolved's servers into the list of DNS servers when --dns is used. Note that sshuttle will continue to fail to intercept any traffic sent to port 853 for DNS over TLS (which systemd-resolved also supports). For more info, see: sshuttle issue #535 https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html https://github.com/systemd/systemd/issues/6076 --- docs/manpage.rst | 6 ++++-- sshuttle/helpers.py | 45 +++++++++++++++++++++++++++++++++++++++------ 2 files changed, 43 insertions(+), 8 deletions(-) diff --git a/docs/manpage.rst b/docs/manpage.rst index 9c59c17..b5adfb6 100644 --- a/docs/manpage.rst +++ b/docs/manpage.rst @@ -104,10 +104,12 @@ Options Capture local DNS requests and forward to the remote DNS server. All queries to any of the local system's DNS - servers (/etc/resolv.conf) will be intercepted and + servers (/etc/resolv.conf and, if it exists, + /run/systemd/resolve/resolv.conf) will be intercepted and resolved on the remote side of the tunnel instead, there using the DNS specified via the :option:`--to-ns` option, - if specified. + if specified. Only plain DNS traffic sent to these servers + on port 53 are captured. .. option:: --ns-hosts= diff --git a/sshuttle/helpers.py b/sshuttle/helpers.py index a62bea9..5d61b43 100644 --- a/sshuttle/helpers.py +++ b/sshuttle/helpers.py @@ -49,12 +49,45 @@ class Fatal(Exception): def resolvconf_nameservers(): - lines = [] - for line in open('/etc/resolv.conf'): - words = line.lower().split() - if len(words) >= 2 and words[0] == 'nameserver': - lines.append(family_ip_tuple(words[1])) - return lines + """Retrieves a list of tuples (address type, address as a string) that + the current system uses to resolve hostnames from /etc/resolv.conf + and possibly other files. + """ + + # Historically, we just needed to read /etc/resolv.conf. + # + # If systemd-resolved is active, /etc/resolv.conf will point to + # localhost and the actual DNS servers that systemd-resolved uses + # are stored in /run/systemd/resolve/resolv.conf. For programs + # that use the localhost DNS server, only reading /etc/resolv.conf + # is sufficient. However, resolved provides other ways of + # resolving hostnames (such as via dbus) that may not route + # requests through localhost. So, we retrieve a list of DNS + # servers that resolved uses so we can intercept those as well. + # + # For more information about systemd-resolved, see: + # https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html + # + # On machines without systemd-resolved, we expect opening the + # second file will fail. + files = ['/etc/resolv.conf', '/run/systemd/resolve/resolv.conf'] + + nsservers = [] + for f in files: + this_file_nsservers = [] + try: + for line in open(f): + words = line.lower().split() + if len(words) >= 2 and words[0] == 'nameserver': + this_file_nsservers.append(family_ip_tuple(words[1])) + debug2("Found DNS servers in %s: %s\n" % + (f, [n[1] for n in this_file_nsservers])) + nsservers += this_file_nsservers + except OSError as e: + debug3("Failed to read %s when looking for DNS servers: %s\n" % + (f, e.strerror)) + + return nsservers def resolvconf_random_nameserver(): From 8461e08bc3db2170a28cab33e2af1cb08f321cb0 Mon Sep 17 00:00:00 2001 From: Scott Kuhl Date: Tue, 3 Nov 2020 20:27:57 -0500 Subject: [PATCH 2/2] Make server and client handle resolv.conf differently. The server should just read from resolv.conf to find DNS servers to use. This restores this behavior after the previous commit changed it. The client now reads both /etc/resolv.conf and /run/systemd/resolve/resolv.conf. The latter is required to more reliably intercept regular DNS requests that systemd-resolved makes. --- sshuttle/client.py | 2 +- sshuttle/helpers.py | 36 +++++++++++++++++++++++++----------- sshuttle/server.py | 2 +- tests/client/test_helpers.py | 4 ++-- 4 files changed, 29 insertions(+), 15 deletions(-) diff --git a/sshuttle/client.py b/sshuttle/client.py index da23b7d..ab28d0b 100644 --- a/sshuttle/client.py +++ b/sshuttle/client.py @@ -589,7 +589,7 @@ def main(listenip_v6, listenip_v4, # redirect packets outgoing to this server to the remote host # instead. if dns: - nslist += resolvconf_nameservers() + nslist += resolvconf_nameservers(True) if to_nameserver is not None: to_nameserver = "%s@%s" % tuple(to_nameserver[1:]) else: diff --git a/sshuttle/helpers.py b/sshuttle/helpers.py index 5d61b43..0cd97df 100644 --- a/sshuttle/helpers.py +++ b/sshuttle/helpers.py @@ -48,10 +48,18 @@ class Fatal(Exception): pass -def resolvconf_nameservers(): - """Retrieves a list of tuples (address type, address as a string) that - the current system uses to resolve hostnames from /etc/resolv.conf - and possibly other files. +def resolvconf_nameservers(systemd_resolved): + """Retrieves a list of tuples (address type, address as a string) of + the DNS servers used by the system to resolve hostnames. + + If parameter is False, DNS servers are retrieved from only + /etc/resolv.conf. This behavior makes sense for the sshuttle + server. + + If parameter is True, we retrieve information from both + /etc/resolv.conf and /run/systemd/resolve/resolv.conf (if it + exists). This behavior makes sense for the sshuttle client. + """ # Historically, we just needed to read /etc/resolv.conf. @@ -59,10 +67,10 @@ def resolvconf_nameservers(): # If systemd-resolved is active, /etc/resolv.conf will point to # localhost and the actual DNS servers that systemd-resolved uses # are stored in /run/systemd/resolve/resolv.conf. For programs - # that use the localhost DNS server, only reading /etc/resolv.conf - # is sufficient. However, resolved provides other ways of - # resolving hostnames (such as via dbus) that may not route - # requests through localhost. So, we retrieve a list of DNS + # that use the localhost DNS server, having sshuttle read + # /etc/resolv.conf is sufficient. However, resolved provides other + # ways of resolving hostnames (such as via dbus) that may not + # route requests through localhost. So, we retrieve a list of DNS # servers that resolved uses so we can intercept those as well. # # For more information about systemd-resolved, see: @@ -70,7 +78,9 @@ def resolvconf_nameservers(): # # On machines without systemd-resolved, we expect opening the # second file will fail. - files = ['/etc/resolv.conf', '/run/systemd/resolve/resolv.conf'] + files = ['/etc/resolv.conf'] + if systemd_resolved: + files += ['/run/systemd/resolve/resolv.conf'] nsservers = [] for f in files: @@ -90,8 +100,12 @@ def resolvconf_nameservers(): return nsservers -def resolvconf_random_nameserver(): - lines = resolvconf_nameservers() +def resolvconf_random_nameserver(systemd_resolved): + """Return a random nameserver selected from servers produced by + resolvconf_nameservers(). See documentation for + resolvconf_nameservers() for a description of the parameter. + """ + lines = resolvconf_nameservers(systemd_resolved) if lines: if len(lines) > 1: # don't import this unless we really need it diff --git a/sshuttle/server.py b/sshuttle/server.py index 8e15866..67409a7 100644 --- a/sshuttle/server.py +++ b/sshuttle/server.py @@ -205,7 +205,7 @@ class DnsProxy(Handler): self.tries += 1 if self.to_nameserver is None: - _, peer = resolvconf_random_nameserver() + _, peer = resolvconf_random_nameserver(False) port = 53 else: peer = self.to_ns_peer diff --git a/tests/client/test_helpers.py b/tests/client/test_helpers.py index 3ed588f..732f38a 100644 --- a/tests/client/test_helpers.py +++ b/tests/client/test_helpers.py @@ -131,7 +131,7 @@ nameserver 2404:6800:4004:80c::3 nameserver 2404:6800:4004:80c::4 """) - ns = sshuttle.helpers.resolvconf_nameservers() + ns = sshuttle.helpers.resolvconf_nameservers(False) assert ns == [ (AF_INET, u'192.168.1.1'), (AF_INET, u'192.168.2.1'), (AF_INET, u'192.168.3.1'), (AF_INET, u'192.168.4.1'), @@ -156,7 +156,7 @@ nameserver 2404:6800:4004:80c::2 nameserver 2404:6800:4004:80c::3 nameserver 2404:6800:4004:80c::4 """) - ns = sshuttle.helpers.resolvconf_random_nameserver() + ns = sshuttle.helpers.resolvconf_random_nameserver(False) assert ns in [ (AF_INET, u'192.168.1.1'), (AF_INET, u'192.168.2.1'), (AF_INET, u'192.168.3.1'), (AF_INET, u'192.168.4.1'),