Commit Graph

1178 Commits

Author SHA1 Message Date
6d86e44fb4 IPv6 support in nft method.
This works for me but needs testing by others. Remember to specify a
::0/0 subnet or similar to route IPv6 through sshuttle.

I'm adding this to nft before nat since it is not sshuttle's default
method on Linux. Documentation updates may be required too.

This patch uses the ipaddress module, but that appears to be included
since Python 3.3.
2020-10-21 17:47:07 -04:00
ebf87d8f3b Merge pull request #549 from skuhl/nft-nat-update
Make nat and nft rules consistent; improve rule ordering.
2020-10-22 07:56:37 +11:00
bc24ed359a Make nat and nft rules consistent; improve rule ordering.
First, check if TTL indicates we should ignore packet (instead of
checking in multiple rules later). Also, nft method didn't do this at
all. Now, nft matches the behavior of nat.

Second, forward DNS traffic (we may need to intercept traffic to
localhost if a DNS server is running on localhost).

Third, ignore any local traffic packets. (Previously, we ignored local
traffic except DNS and then had the DNS rules). The nft method didn't
do this previously at all. It now matches the behavior of nat.

Lastly, list the subnets to redirect and/or exclude. This step is left
unchanged. Excluding the local port that we are listening on is
redundant with the third step, but should cause no harm.

In summary, this ordering simplifies the rules in nat and eliminates
differences that previously existed between nat and nft.
2020-10-21 11:51:39 -04:00
ac3ccb769a Merge pull request #544 from skuhl/fix-no-remote
Allow no remote to work.
2020-10-21 07:53:40 +11:00
1f3c74a1af Merge pull request #548 from skuhl/stdout-cleanup
Make prefixes in verbose output more consistent.
2020-10-21 07:53:14 +11:00
512a3a8d96 Add missing space in client ssh error message 2020-10-20 13:38:37 -04:00
4deee45bc6 whitespace cleanup 2020-10-20 13:35:32 -04:00
7cb30b783d Make prefixes in verbose output more consistent.
Use 'c' prefix for client, 's' prefix for server, and 'fw' prefix for
firewall messages. The 'c' and 's' prefixes were used sometimes but
not consistently. The firewall printed messages prefixed with
"firewall manager:" or "firewall:" or ">>" previously.

This patch also fixes a couple of print() calls that should have been
debug1()---a bug introduced in a recent commit.
2020-10-20 13:29:45 -04:00
fb4950fafc Merge pull request #547 from nickray/document-subnets-option-in-man-page
Document -s/--subnets option in man page
2020-10-20 07:57:21 +11:00
c3016f2d90 Merge pull request #541 from skuhl/use-all-ips
When subnets and excludes are specified with hostnames, use all IPs.
2020-10-20 07:56:50 +11:00
9d704b3503 Document -s/--subnets option in man page 2020-10-19 13:35:03 +02:00
a266e7a8bd Merge pull request #545 from skuhl/avoid-touching-etc-hosts
Only write /etc/hosts when necessary.
2020-10-19 15:53:14 +11:00
e1106a33a9 Only write /etc/hosts when necessary.
Without this patch, sshuttle 'restores' /etc/hosts even if it didn't
make any modifications to it. This can be confirmed by running without
--auto-hosts and confirming that the modification time of /etc/hosts
is unchanged while sshuttle is running, but is updated when sshuttle
exits (and a debug2() message is printed indicating the file is
written).

I'm not aware of the previous behavior causing problems. However,
writing an important file unnecessarily as root should be avoided.
2020-10-19 00:17:37 -04:00
574ed8e564 Allow no remote to work.
Pull request #502 made -r/--remote required. However, the
documentation still indicates that using no remote is a valid way to
test sshuttle (see Examples section of man page). I think this mode
might be useful for testing performance local without ssh, local with
ssh, and remote with ssh.

This patch adds a warning when -r/--remote is missing but restores the
previous behavior.
2020-10-18 23:54:18 -04:00
1dbf216369 Merge pull request #543 from skuhl/sdnotify-doc
sdnotify.py documentation
2020-10-19 09:49:16 +11:00
52558174b8 sdnotify.py documentation 2020-10-18 16:45:57 -04:00
b7a29acab7 Update/document client's handling of IPv4 and IPv6.
Additional comments, checks, warning messages, and diagnostic
information is printed out when the client starts.

We assume IPv4 is always present and enabled. We assume IPv6 is not
supported when it is disabled at the command line or when it is not
supported by the firewall method. Warn if IPv6 is disabled but the
user specified IPv6 subnets, IPv6 DNS servers, or IPv6 excludes that
are effectively ignored.

Instead of indicating which features are on/off, we also indicate if
features are available in the verbose output.

We also more clearly print the subnets that we forward, excludes, and
any redirected DNS servers to the terminal output.

These changes should help handling bug reports and make it clearer to
users what is happening. It should also make it more graceful when a
user specifies a subnet/exclude with hostname that resolves to both
IPv4 and IPv6 (but IPv6 is disabled in sshuttle).
2020-10-18 16:30:29 -04:00
c2b10465e7 Remove localhost test since it can resolve to either IPv4, IPv6, or both in any particular order 2020-10-17 15:56:23 -04:00
cfe14f2498 fix flake8 issues in updated tests 2020-10-17 15:40:28 -04:00
cb53d8a150 Make tests for parse_subnetport() expect lists & update expected error messages in tests 2020-10-17 15:36:16 -04:00
64d5c77a71 fix flake8 issues, clarify comment 2020-10-17 14:43:09 -04:00
036c49e412 When subnets and excludes are specified with hostnames, use all IPs.
The list of subnets to route over VPN and the list of subnets to
exclude are parsed in option.py parse_subnetport(). Hostnames or IP
addresses are supported. If a hostname was provided, only the first IP
address was considered. This could result in some traffic not
traversing the VPN that the user might expect should traverse it from
the arguments passed to sshuttle.

This patch makes the function handle all of the IPs if a hostname is
provided. If a user provides a hostname with a CIDR mask, problems can
occur and we warn the user about the issue.

If the user includes a hostname with both an IPv4 and an IPv6 address,
and the underlying method doesn't support IPv6, then this patch will
cause sshuttle to fail. I plan to provide a future patch where failure
won't occur if the only place IPv6 addresses appear is in the exclude
list. In that case it should be safe to ignore the IPv6 address.

This patch also changes parse_ipport() which is used by the --to-ns
option. If the user provides a hostname here, we just use the first IP
from the hostname and warn the user that only one is being used.
2020-10-16 18:29:16 -04:00
c1cc3911df Merge pull request #537 from skuhl/add-version
Include sshuttle version in verbose output.
2020-10-10 11:18:13 +11:00
84e43d3113 Include sshuttle version in verbose output.
Some bug reports include verbose sshuttle output but lack the version
that is being used. Including the sshuttle version in the output may
make it easier to handle future bug reports.
2020-10-08 22:39:42 -04:00
afad317f2c Merge pull request #536 from ed-velez/add_psutil_to_setup
Add psutil as dependency in setup.py
2020-10-08 08:09:21 +11:00
ae5dbd3b4d Add psutil as dependency in setup.py 2020-10-07 15:00:45 -05:00
2995a624f1 Merge pull request #534 from sshuttle/dependabot/pip/flake8-3.8.4
Bump flake8 from 3.8.3 to 3.8.4
2020-10-06 07:56:56 +11:00
909402a353 Merge pull request #533 from sshuttle/dependabot/pip/pytest-6.1.1
Bump pytest from 6.1.0 to 6.1.1
2020-10-06 07:56:36 +11:00
16148ac70f Bump flake8 from 3.8.3 to 3.8.4
Bumps [flake8](https://gitlab.com/pycqa/flake8) from 3.8.3 to 3.8.4.
- [Release notes](https://gitlab.com/pycqa/flake8/tags)
- [Commits](https://gitlab.com/pycqa/flake8/compare/3.8.3...3.8.4)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-10-05 06:37:36 +00:00
e50bbc2c92 Bump pytest from 6.1.0 to 6.1.1
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.1.0 to 6.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.1.0...6.1.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-10-05 06:37:12 +00:00
9eaed73098 Merge pull request #529 from sshuttle/dependabot/pip/pytest-6.1.0
Bump pytest from 6.0.2 to 6.1.0
2020-09-29 07:40:40 +10:00
4b07dab9dc Bump pytest from 6.0.2 to 6.1.0
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.0.2 to 6.1.0.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.0.2...6.1.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-09-28 06:43:22 +00:00
299854d2b5 Merge pull request #522 from sshuttle/dependabot/pip/pytest-6.0.2
Bump pytest from 6.0.1 to 6.0.2
2020-09-15 07:33:28 +10:00
8b71c150c6 Bump pytest from 6.0.1 to 6.0.2
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.0.1...6.0.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-09-14 06:39:11 +00:00
dcce0fa3df Merge pull request #520 from skuhl/master
Fix #494 sshuttle caught in infinite select() loop.
2020-09-09 08:37:27 +10:00
3ee74ddfa6 Merge pull request #519 from sshuttle/dependabot/pip/attrs-20.2.0
Bump attrs from 20.1.0 to 20.2.0
2020-09-08 07:33:26 +10:00
7573011a08 remove unneeded blank line 2020-09-07 15:58:59 -04:00
72ae202df3 Remove extra whitespace, wrap long lines 2020-09-07 15:56:59 -04:00
5d6b14673f Fix #494 sshuttle caught in infinite select() loop.
Improve detection of when the ssh process exits in both daemon and
foreground modes. Previously, sshuttle could infinite loop with 100%
cpu usage if the ssh process died. On machines that use suspend, the
ssh connection might not resume after wakeup. Now, this situation is
detected and sshuttle exits. The fix involves changing the return
value we check for when we call poll() and using a psutil function to
detect when the process exits if we are running sshuttle as a daemon.
2020-09-07 15:46:33 -04:00
aa97742405 Bump attrs from 20.1.0 to 20.2.0
Bumps [attrs](https://github.com/python-attrs/attrs) from 20.1.0 to 20.2.0.
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-attrs/attrs/compare/20.1.0...20.2.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2020-09-07 06:46:51 +00:00
19f653df36 Merge pull request #513 from drjbarker/python2-compat
Fix python2 server compatibility
2020-08-30 09:48:29 +10:00
ec5fb68350 Fix python2 client compatibility
Python2 ignores the byte string qualification (b’foo’)  but falls over for the combination rb for this regexp. Switching the qualification to br appears to fix this and works in both python2 and python3.
2020-08-29 21:32:18 +09:00
d9e5ccc19c Merge pull request #512 from xoro/master
Fixed typo.
2020-08-28 16:04:49 +10:00
f23510a4fc Fix Codacy check redefined-argument-from-local 2020-08-28 10:37:20 +09:00
459e573019 Fix flake8 line too long 2020-08-28 10:29:12 +09:00
c12d2ba5c6 Fix python2 server compatibility
Fixes  #469. We replace python3 exclusive code with a check for python3 and a compatibility fix. Note that the switch from os.set_nonblocking to fcntl.fcntl in 98d052d (fixing #503) also fixes python2 compatibility.
2020-08-28 10:04:12 +09:00
630f8c2357 Fixed typo. 2020-08-27 20:59:37 +02:00
e8f3b53c7d Merge pull request #511 from Rylan12/license-update
Change license text to LGPL-2.1
2020-08-27 08:03:26 +10:00
8ee230bca7 Change license text to LGPL-2.1 2020-08-26 12:25:36 -04:00
abb48f1996 Update changes file v1.0.4 2020-08-24 08:00:36 +10:00