Commit Graph

778 Commits

Author SHA1 Message Date
127cac37ef --latency-buffer-size now impacts server's buffer.
sshuttle has a --latency-buffer-size parameter, but it only changes
the buffer size on the client and not the server. Therefore,
increasing or decreasing the number doesn't make any change in
download performance (like the documentation indicates that it should).

You can test this change by setting up a sshuttle connection and
downloading a large file through sshuttle. With this patch, you should
find that increasing --latency-buffer-size increases the download
speed. Without the patch, the parameter should have little impact on
performance.
2021-01-23 10:01:42 +11:00
d68f57b534 Bump pytest-cov from 2.11.0 to 2.11.1
Bumps [pytest-cov](https://github.com/pytest-dev/pytest-cov) from 2.11.0 to 2.11.1.
- [Release notes](https://github.com/pytest-dev/pytest-cov/releases)
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest-cov/compare/v2.11.0...v2.11.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2021-01-22 08:45:52 +11:00
0933684d0f Bump pytest-cov from 2.10.1 to 2.11.0
Bumps [pytest-cov](https://github.com/pytest-dev/pytest-cov) from 2.10.1 to 2.11.0.
- [Release notes](https://github.com/pytest-dev/pytest-cov/releases)
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest-cov/compare/v2.10.1...v2.11.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2021-01-19 20:35:20 +11:00
bf7b4a6c34 chore: remove attrs from requirements-test.txt
It used to be necessary to fix the version of attrs when using pytest. This problem has been fixed now, so I removed it.
https://stackoverflow.com/a/58198754
2021-01-19 09:14:03 +11:00
65d437a9f8 feat: remove mock from test dependencies.
Because mock can be replace by unittest.mock
2021-01-17 15:42:55 +11:00
254b8e7987 remove py35 from tox.ini
Because the supported version is python3.6 and above.
2021-01-17 15:42:24 +11:00
97c25e988e tproxy: Skip firewall chains if packets have local destination. (#578)
If you use the tproxy method with a large subnet (such as 0/0), then
(1) you may not receive UDP packets that sshuttle/tproxy can handle
and (2) you are unable to connect to your machine using an IP that
your computer recognizes as its own.

To resolve those issues, any traffic to an IP that the host knows is
local, does not go through the sshuttle chains.
2021-01-04 09:05:32 +11:00
b7730fc106 Improve error messages related to sshuttle server. (#580)
* Improve error messages related to sshuttle server.

There are many GitHub issues related to the cryptic message:
fatal: expected server init string 'SSHUTTLE0001'; got b''

The code that prints that message is after another check that is
intended to verify that the server is still running. This code was
faulty since the server is still running when rv==None (but exited
when rv==0).

I corrected this problem and then investigated ways to clarify the
error message. I added additional exit codes for the server: 97 (exec
in the shell returned), 98 (the python exec() function called
returned). The end result is that the cryptic error message above will
now print a more appropriate error message that should aid in
debugging.

I also changed the server so that it catches Fatal() and exits with
exit code 99 (like the client does). Previously, it was just an
unhandled exception on the server.

I suspect some of the error messages were caused by restricted shells.
I also investigated and added comments about how sshuttle might behave
if it is being run on a server that has a restricted shell.

This commit also replaces a couple of exit() calls in cmdline.py with
'return' since exit() is intended for interactive use. This change
doesn't impact the server.

* Remind user to exclude remote host when server exits with 255.
2021-01-04 08:35:10 +11:00
7fc33c0020 Refactor debug, log and Fatal messages.
This commit rewrites the log() function so that it will append a
newline at the end of the message if none is present. It doesn't make
sense to print a log message without a newline since the next log
message (which will write a prefix) expects to be starting at the
beginning of a line.

Although it isn't strictly necessary, this commit also removes any
newlines at the ends of messages. If I missed any, including the
newline at the end of the message will continue to work as it did
before.

Previously, some calls were missing the newline at the end even though
including it was necessary for subsequent messages to appear
correctly.

This code also cleans up some redundant prefixes. The log() method
will prepend the prefix and the different processes should set their
prefix as soon as they start.

Multiline messages are still supported (although the prefix for the
additional lines was changed to match the length of the prefix used
for the first line).
2021-01-01 19:32:48 +11:00
563f41478a Ignore quotes in config file passed to sshuttle with @
When users put parameters in a config file and pass them to sshuttle
using '@', they might copy the quotes from the command line into the
config file. This fix first ensures that we strip whitespace from the
beginning/end of each line in the config file. Then, if the line
begins and ends with a matching quote character, strip those too.

Fixes #573.
2020-12-31 10:20:22 +11:00
da848b6dba Readme: add instructions for installing via MacPorts 2020-12-29 19:12:06 +11:00
bc72bb4811 Release version 1.0.5 v1.0.5 2020-12-29 10:34:58 +11:00
b8cd2fae40 Add Python 3.9 support 2020-12-28 11:01:07 +11:00
8f0d3b0f8e Add release notes for new release 2020-12-28 10:56:01 +11:00
6d4261e3f9 Refactor automatic method selection.
Add an "is_supported()" function to the different methods so that each
method can include whatever logic they wish to indicate if they are
supported on a particular machine. Previously, methods/__init__.py
contained all of the logic for selecting individual methods. Now, it
iterates through a list of possible options and stops on the first
method that it finds that is_supported().

Currently, the decision is made based on the presence of programs in
the PATH. In the future, things such as the platform sshuttle is
running on could be considered.
2020-12-28 10:21:56 +11:00
7c338866bf Set default tmark to pass coverage tests
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
6b87ad3fc7 Set default tmark to pass coverage tests
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
0efd23f3b8 Correct options typo for argument tmark
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
9bdd9fea5d Correct flake8 liting issues
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
d5cceb3e42 Add workflow_dispatch to github actions
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
65b139ff6e Add current branch to github workflow for testing
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
76b8b83e22 Add .gitignore .vscode/ path. Resolve the issue #374 adding tproxy mark option to allow different network mapping.
Signed-off-by: Samuel Bernardo <samuel@lip.pt>
2020-12-28 10:20:46 +11:00
a5214e0fd7 Bump mock from 2.0.0 to 4.0.3
Bumps [mock](https://github.com/testing-cabal/mock) from 2.0.0 to 4.0.3.
- [Release notes](https://github.com/testing-cabal/mock/releases)
- [Changelog](https://github.com/testing-cabal/mock/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/testing-cabal/mock/compare/2.0.0...4.0.3)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-12-16 20:15:42 +11:00
3861d29de2 Merge pull request #571 from sshuttle/dependabot/pip/pytest-6.2.1
Bump pytest from 6.2.0 to 6.2.1
2020-12-16 20:15:16 +11:00
59a983f9a6 Bump pytest from 6.2.0 to 6.2.1
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.2.0 to 6.2.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.2.0...6.2.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-12-16 09:14:24 +00:00
4a65f97c8b Drop testing of Python 3.5
Due to message from CI:

DEPRECATION: Python 3.5 reached the end of its life on September 13th,
2020. Please upgrade your Python as Python 3.5 is no longer maintained.
pip 21.0 will drop support for Python 3.5 in January 2021. pip 21.0 will
remove support for this functionality.
2020-12-16 20:11:13 +11:00
461e676973 Merge pull request #570 from sshuttle/dependabot/pip/pytest-6.2.0
Bump pytest from 6.1.2 to 6.2.0
2020-12-14 19:12:11 +11:00
70e3e017ab Merge pull request #569 from sshuttle/dependabot/pip/setuptools-scm-5.0.1
Bump setuptools-scm from 4.1.2 to 5.0.1
2020-12-14 19:11:43 +11:00
26704cf742 Bump pytest from 6.1.2 to 6.2.0
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.1.2 to 6.2.0.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.1.2...6.2.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-12-14 06:47:57 +00:00
28a85928be Bump setuptools-scm from 4.1.2 to 5.0.1
Bumps [setuptools-scm](https://github.com/pypa/setuptools_scm) from 4.1.2 to 5.0.1.
- [Release notes](https://github.com/pypa/setuptools_scm/releases)
- [Changelog](https://github.com/pypa/setuptools_scm/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pypa/setuptools_scm/compare/v4.1.2...v5.0.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-12-14 06:47:33 +00:00
ff70f584d2 Merge pull request #561 from Krout0n/fix-handling-OSError
Fix handling OSError in FirewallClient#__init__
2020-11-16 17:00:29 +11:00
5ff834bd32 Fix handling OSError in FirewallClient#__init__ 2020-11-16 10:36:39 +09:00
6b75d62d68 Merge pull request #560 from sshuttle/dependabot/pip/attrs-20.3.0
Bump attrs from 20.2.0 to 20.3.0
2020-11-07 11:19:49 +11:00
6bbe8c0d34 Bump attrs from 20.2.0 to 20.3.0
Bumps [attrs](https://github.com/python-attrs/attrs) from 20.2.0 to 20.3.0.
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-attrs/attrs/compare/20.2.0...20.3.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-11-06 06:35:04 +00:00
7e726bc235 Merge pull request #558 from skuhl/dns-to-none
Fix "DNS request from ... to None" messages.
2020-11-05 07:30:09 +11:00
227412e218 Fix long line in previous commit 2020-11-04 11:40:07 -05:00
9b036fc689 Merge pull request #552 from skuhl/systemd-resolved
Intercept DNS requests sent by systemd-resolved.
2020-11-04 16:55:09 +11:00
34acdd0611 Merge pull request #557 from skuhl/nft-ipv6-improvements
Improve nft IPv6 support.
2020-11-04 16:52:49 +11:00
8461e08bc3 Make server and client handle resolv.conf differently.
The server should just read from resolv.conf to find DNS servers to
use. This restores this behavior after the previous commit changed it.

The client now reads both /etc/resolv.conf and
/run/systemd/resolve/resolv.conf. The latter is required to more
reliably intercept regular DNS requests that systemd-resolved makes.
2020-11-03 20:27:57 -05:00
d3700f09da Improve nft IPv6 support.
This commit makes two fixes:

1. If an IPv6 DNS server is used, an nft rule had "ip6 protocol" in it
which is invalid and caused sshuttle to exit.

2. I modified detection of udp vs tcp to follow the recommendation at
https://superuser.com/questions/1560376/match-ipv6-protocol-using-nftables

I also re-arranged the code slightly to reduce the number of
if-statements.
2020-11-03 20:14:56 -05:00
92b99442c3 Merge pull request #551 from skuhl/which-fix
Improve consistency of PATH, environments, and which()
2020-11-04 08:00:53 +11:00
709e5d1595 Improve error message when "ip" and "netstat" are missing and --auto-nets fails to work 2020-11-03 12:53:16 -05:00
b5aaeda2a8 Merge pull request #553 from sshuttle/dependabot/pip/pytest-6.1.2
Bump pytest from 6.1.1 to 6.1.2
2020-10-29 18:17:19 +11:00
0ce268f21b Bump pytest from 6.1.1 to 6.1.2
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.1.1 to 6.1.2.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.1.1...6.1.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-10-29 06:35:08 +00:00
34f538ff98 Merge branch 'master' into which-fix to resolve merge conflict. 2020-10-26 17:24:32 -04:00
7d89b2d89f Fix "DNS request from ... to None" messages.
Some methods are unable to determine the destination address of DNS
packets that we capture. When this happens, change the message so it
just shows where the DNS requests are from.
2020-10-26 15:46:01 -04:00
502960d796 Intercept DNS requests sent by systemd-resolved.
Previously, we would find DNS servers we wish to intercept traffic on
by reading /etc/resolv.conf. On systems using systemd-resolved,
/etc/resolv.conf points to localhost and then systemd-resolved
actually uses the DNS servers listed in
/run/systemd/resolve/resolv.conf. Many programs will route the DNS
traffic through localhost as /etc/resolv.conf indicates and sshuttle
would capture it. However, systemd-resolved also provides other
interfaces for programs to resolve hostnames besides the localhost
server in /etc/resolv.conf.

This patch adds systemd-resolved's servers into the list of DNS
servers when --dns is used.

Note that sshuttle will continue to fail to intercept any traffic sent
to port 853 for DNS over TLS (which systemd-resolved also supports).

For more info, see:
sshuttle issue #535
https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html
https://github.com/systemd/systemd/issues/6076
2020-10-25 12:29:32 -04:00
5c8c707208 Merge pull request #550 from skuhl/nft-ipv6
IPv6 support in nft method.
2020-10-25 15:55:33 +11:00
68c9c9bbcd Improve consistency of PATH, environments, and which()
This patch attempts to fix (or aid in debugging) issue #350.

sshuttle didn't explicitly search /sbin and /usr/sbin and they may be
missing in the user's PATH. If PATH is missing, these folders wouldn't
be searched either. There was also a program_exists function which is
redundant to which(). This consolidates everything into the helpers.py
file.

This patch introduces get_path() to return PATH + some extra hardcoded
paths. A new get_env() function can be called to create a consistent
environment when calling external programs. The new which() wrapper
function also ensures we use the same set of paths.

If -vv is supplied, messages clearly indicate the programs we are
looking for, if they are found, and where we looked if we failed to
find them.

I haven't tested the changes to ipfw or pf.
2020-10-23 20:33:20 -04:00
c02b93e719 nft IPv6 documentation (and other minor doc updates)
Update docs to indicate that IPv6 is supported with the nft method.

- Adds nft into the requirements.rst file.

- Update description of what happens when a hostname is used in a
  subnet.

- Add ipfw to list of methods.

- Indicate that --auto-nets does not work with IPv6. Previously this
  was only mentioned in tproxy.rst

- Clarify that we try to use "python3" on the server before trying
  "python".
2020-10-22 20:17:09 -04:00