From 31f059883cf22130602c483534de6734febed2fd Mon Sep 17 00:00:00 2001 From: Scott Kuhl Date: Fri, 21 May 2021 17:47:38 -0400 Subject: [PATCH] Fix: Allow --to-ns and --ns-host without --dns. If the user specifies --to-ns (tells the remote server which DNS server to use for lookups coming from sshuttle), then either --ns-host or --dns need to also be used (route DNS requests through sshuttle). A previous commit incorrectly made it so --to-ns and --ns-host couldn't be successfully used together. Attempts to fix #641. --- sshuttle/client.py | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/sshuttle/client.py b/sshuttle/client.py index e586a4a..647fb27 100644 --- a/sshuttle/client.py +++ b/sshuttle/client.py @@ -688,19 +688,26 @@ def main(listenip_v6, listenip_v4, fw = FirewallClient(method_name, sudo_pythonpath, ttl) - # If --dns is used, store the IP addresses that the client - # normally uses for DNS lookups in nslist. The firewall needs to - # redirect packets outgoing to this server to the remote host + # nslist is the list of name severs to intercept. If --dns is + # used, we add all DNS servers in resolv.conf. Otherwise, the list + # can be populated with the --ns-hosts option (which is already + # stored in nslist). This list is used to setup the firewall so it + # can redirect packets outgoing to this server to the remote host # instead. if dns: nslist += resolvconf_nameservers(True) + + # If we are intercepting DNS requests, we tell the remote host + # where it should send the DNS requests to with the --to-ns + # option. + if len(nslist) > 0: if to_nameserver is not None: to_nameserver = "%s@%s" % tuple(to_nameserver[1:]) - else: - # option doesn't make sense if we aren't proxying dns + else: # if we are not intercepting DNS traffic + # ...and the user specified a server to send DNS traffic to. if to_nameserver and len(to_nameserver) > 0: - print("WARNING: --to-ns option is ignored because --dns was not " - "used.") + print("WARNING: --to-ns option is ignored unless " + "--dns or --ns-hosts is used.") to_nameserver = None # Get family specific subnet lists. Also, the user may not specify