sshuttle.md: fix whitespace issues.

(Slightly modified by apenwarr)

README.md

@@ -8,6 +8,14 @@ just switch your wireless off and on. Sshuttle makes the
 kernel setting it changes permanent, so this won't happen
 again, even after a reboot.
 
+Required Software
+=================
+
+ - You need PyXAPI, available here:
+   http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
+ - You also need autossh, available in various package management systems
+ - Python 2.x, both locally and the remote system
+
 
 sshuttle: where transparent proxy meets VPN meets ssh
 =====================================================
@@ -51,19 +59,46 @@ Prerequisites
    Linux.)
    
  - If you use MacOS or BSD on your client machine:
-   Your kernel needs to be compiled with IPFIREWALL_FORWARD
+   Your kernel needs to be compiled with `IPFIREWALL_FORWARD`
    (MacOS has this by default) and you need to have ipfw
    available. (The server doesn't need to be MacOS or BSD.)
 
 
-This is how you use it:
+Obtaining sshuttle
+------------------
+
+ - First, go get PyXAPI from the link above
+
+ - Clone github.com/jwyllie83/sshuttle/tree/local
+
+
+Usage on (Ubuntu) Linux
 -----------------------
 
- - <tt>git clone git://github.com/apenwarr/sshuttle</tt>
-    on your client machine. You'll need root or sudo
-    access, and python needs to be installed.
+ - `cd packaging; ./make_deb`
 
- - <tt>./sshuttle -r username@sshserver 0.0.0.0/0 -vv</tt>
+ - `sudo dpkg -i ./sshuttle-VERSION.deb`
+
+ - Check out the files in `/etc/sshuttle`; configure them so your tunnel works
+
+ - `sudo service sshuttle start`
+
+
+Usage on other Linuxes and OSes
+-------------------------------
+
+  <tt>./sshuttle -r username@sshserver 0.0.0.0/0 -vv</tt>
+
+ - There is a shortcut for 0.0.0.0/0 for those that value
+   their wrists
+   <tt>./sshuttle -r username@sshserver 0/0 -vv</tt>
+
+ - If you would also like your DNS queries to be proxied
+   through the DNS server of the server you are connect to:
+   <tt>./sshuttle --dns -vvr username@sshserver 0/0</tt>
+
+   The above is probably what you want to use to prevent
+   local network attacks such as Firesheep and friends.
 
 (You may be prompted for one or more passwords; first, the
 local password to become root using either sudo or su, and
@@ -71,6 +106,9 @@ then the remote ssh password.  Or you might have sudo and ssh set
 up to not require passwords, in which case you won't be
 prompted at all.)
 
+Usage Notes
+-----------
+
 That's it!  Now your local machine can access the remote network as if you
 were right there.  And if your "client" machine is a router, everyone on
 your local network can make connections to your remote network.

client.py

@@ -1,387 +0,0 @@
-import struct, socket, select, errno, re, signal, time
-import compat.ssubprocess as ssubprocess
-import helpers, ssnet, ssh, ssyslog
-from ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper
-from helpers import *
-
-_extra_fd = os.open('/dev/null', os.O_RDONLY)
-
-def got_signal(signum, frame):
-    log('exiting on signal %d\n' % signum)
-    sys.exit(1)
-
-
-_pidname = None
-def check_daemon(pidfile):
-    global _pidname
-    _pidname = os.path.abspath(pidfile)
-    try:
-        oldpid = open(_pidname).read(1024)
-    except IOError, e:
-        if e.errno == errno.ENOENT:
-            return  # no pidfile, ok
-        else:
-            raise Fatal("can't read %s: %s" % (_pidname, e))
-    if not oldpid:
-        os.unlink(_pidname)
-        return  # invalid pidfile, ok
-    oldpid = int(oldpid.strip() or 0)
-    if oldpid <= 0:
-        os.unlink(_pidname)
-        return  # invalid pidfile, ok
-    try:
-        os.kill(oldpid, 0)
-    except OSError, e:
-        if e.errno == errno.ESRCH:
-            os.unlink(_pidname)
-            return  # outdated pidfile, ok
-        elif e.errno == errno.EPERM:
-            pass
-        else:
-            raise
-    raise Fatal("%s: sshuttle is already running (pid=%d)"
-                % (_pidname, oldpid))
-
-
-def daemonize():
-    if os.fork():
-        os._exit(0)
-    os.setsid()
-    if os.fork():
-        os._exit(0)
-
-    outfd = os.open(_pidname, os.O_WRONLY|os.O_CREAT|os.O_EXCL, 0666)
-    try:
-        os.write(outfd, '%d\n' % os.getpid())
-    finally:
-        os.close(outfd)
-    os.chdir("/")
-
-    # Normal exit when killed, or try/finally won't work and the pidfile won't
-    # be deleted.
-    signal.signal(signal.SIGTERM, got_signal)
-    
-    si = open('/dev/null', 'r+')
-    os.dup2(si.fileno(), 0)
-    os.dup2(si.fileno(), 1)
-    si.close()
-
-    ssyslog.stderr_to_syslog()
-
-
-def daemon_cleanup():
-    try:
-        os.unlink(_pidname)
-    except OSError, e:
-        if e.errno == errno.ENOENT:
-            pass
-        else:
-            raise
-
-
-def original_dst(sock):
-    try:
-        SO_ORIGINAL_DST = 80
-        SOCKADDR_MIN = 16
-        sockaddr_in = sock.getsockopt(socket.SOL_IP,
-                                      SO_ORIGINAL_DST, SOCKADDR_MIN)
-        (proto, port, a,b,c,d) = struct.unpack('!HHBBBB', sockaddr_in[:8])
-        assert(socket.htons(proto) == socket.AF_INET)
-        ip = '%d.%d.%d.%d' % (a,b,c,d)
-        return (ip,port)
-    except socket.error, e:
-        if e.args[0] == errno.ENOPROTOOPT:
-            return sock.getsockname()
-        raise
-
-
-class FirewallClient:
-    def __init__(self, port, subnets_include, subnets_exclude, dnsport):
-        self.port = port
-        self.auto_nets = []
-        self.subnets_include = subnets_include
-        self.subnets_exclude = subnets_exclude
-        self.dnsport = dnsport
-        argvbase = ([sys.argv[1], sys.argv[0], sys.argv[1]] +
-                    ['-v'] * (helpers.verbose or 0) +
-                    ['--firewall', str(port), str(dnsport)])
-        if ssyslog._p:
-            argvbase += ['--syslog']
-        argv_tries = [
-            ['sudo', '-p', '[local sudo] Password: '] + argvbase,
-            ['su', '-c', ' '.join(argvbase)],
-            argvbase
-        ]
-
-        # we can't use stdin/stdout=subprocess.PIPE here, as we normally would,
-        # because stupid Linux 'su' requires that stdin be attached to a tty.
-        # Instead, attach a *bidirectional* socket to its stdout, and use
-        # that for talking in both directions.
-        (s1,s2) = socket.socketpair()
-        def setup():
-            # run in the child process
-            s2.close()
-        e = None
-        if os.getuid() == 0:
-            argv_tries = argv_tries[-1:]  # last entry only
-        for argv in argv_tries:
-            try:
-                if argv[0] == 'su':
-                    sys.stderr.write('[local su] ')
-                self.p = ssubprocess.Popen(argv, stdout=s1, preexec_fn=setup)
-                e = None
-                break
-            except OSError, e:
-                pass
-        self.argv = argv
-        s1.close()
-        self.pfile = s2.makefile('wb+')
-        if e:
-            log('Spawning firewall manager: %r\n' % self.argv)
-            raise Fatal(e)
-        line = self.pfile.readline()
-        self.check()
-        if line != 'READY\n':
-            raise Fatal('%r expected READY, got %r' % (self.argv, line))
-
-    def check(self):
-        rv = self.p.poll()
-        if rv:
-            raise Fatal('%r returned %d' % (self.argv, rv))
-
-    def start(self):
-        self.pfile.write('ROUTES\n')
-        for (ip,width) in self.subnets_include+self.auto_nets:
-            self.pfile.write('%d,0,%s\n' % (width, ip))
-        for (ip,width) in self.subnets_exclude:
-            self.pfile.write('%d,1,%s\n' % (width, ip))
-        self.pfile.write('GO\n')
-        self.pfile.flush()
-        line = self.pfile.readline()
-        self.check()
-        if line != 'STARTED\n':
-            raise Fatal('%r expected STARTED, got %r' % (self.argv, line))
-
-    def sethostip(self, hostname, ip):
-        assert(not re.search(r'[^-\w]', hostname))
-        assert(not re.search(r'[^0-9.]', ip))
-        self.pfile.write('HOST %s,%s\n' % (hostname, ip))
-        self.pfile.flush()
-
-    def done(self):
-        self.pfile.close()
-        rv = self.p.wait()
-        if rv:
-            raise Fatal('cleanup: %r returned %d' % (self.argv, rv))
-
-
-def _main(listener, fw, ssh_cmd, remotename, python, latency_control,
-          dnslistener, seed_hosts, auto_nets,
-          syslog, daemon):
-    handlers = []
-    if helpers.verbose >= 1:
-        helpers.logprefix = 'c : '
-    else:
-        helpers.logprefix = 'client: '
-    debug1('connecting to server...\n')
-
-    try:
-        (serverproc, serversock) = ssh.connect(ssh_cmd, remotename, python,
-                        stderr=ssyslog._p and ssyslog._p.stdin,
-                        options=dict(latency_control=latency_control))
-    except socket.error, e:
-        if e.args[0] == errno.EPIPE:
-            raise Fatal("failed to establish ssh session (1)")
-        else:
-            raise
-    mux = Mux(serversock, serversock)
-    handlers.append(mux)
-
-    expected = 'SSHUTTLE0001'
-    try:
-        initstring = serversock.recv(len(expected))
-    except socket.error, e:
-        if e.args[0] == errno.ECONNRESET:
-            raise Fatal("failed to establish ssh session (2)")
-        else:
-            raise
-    
-    rv = serverproc.poll()
-    if rv:
-        raise Fatal('server died with error code %d' % rv)
-        
-    if initstring != expected:
-        raise Fatal('expected server init string %r; got %r'
-                        % (expected, initstring))
-    debug1('connected.\n')
-    print 'Connected.'
-    sys.stdout.flush()
-    if daemon:
-        daemonize()
-        log('daemonizing (%s).\n' % _pidname)
-    elif syslog:
-        debug1('switching to syslog.\n')
-        ssyslog.stderr_to_syslog()
-
-    def onroutes(routestr):
-        if auto_nets:
-            for line in routestr.strip().split('\n'):
-                (ip,width) = line.split(',', 1)
-                fw.auto_nets.append((ip,int(width)))
-
-        # we definitely want to do this *after* starting ssh, or we might end
-        # up intercepting the ssh connection!
-        #
-        # Moreover, now that we have the --auto-nets option, we have to wait
-        # for the server to send us that message anyway.  Even if we haven't
-        # set --auto-nets, we might as well wait for the message first, then
-        # ignore its contents.
-        mux.got_routes = None
-        fw.start()
-    mux.got_routes = onroutes
-
-    def onhostlist(hostlist):
-        debug2('got host list: %r\n' % hostlist)
-        for line in hostlist.strip().split():
-            if line:
-                name,ip = line.split(',', 1)
-                fw.sethostip(name, ip)
-    mux.got_host_list = onhostlist
-
-    def onaccept():
-        global _extra_fd
-        try:
-            sock,srcip = listener.accept()
-        except socket.error, e:
-            if e.args[0] in [errno.EMFILE, errno.ENFILE]:
-                debug1('Rejected incoming connection: too many open files!\n')
-                # free up an fd so we can eat the connection
-                os.close(_extra_fd)
-                try:
-                    sock,srcip = listener.accept()
-                    sock.close()
-                finally:
-                    _extra_fd = os.open('/dev/null', os.O_RDONLY)
-                return
-            else:
-                raise
-        dstip = original_dst(sock)
-        debug1('Accept: %s:%r -> %s:%r.\n' % (srcip[0],srcip[1],
-                                              dstip[0],dstip[1]))
-        if dstip[1] == listener.getsockname()[1] and islocal(dstip[0]):
-            debug1("-- ignored: that's my address!\n")
-            sock.close()
-            return
-        chan = mux.next_channel()
-        if not chan:
-            log('warning: too many open channels.  Discarded connection.\n')
-            sock.close()
-            return
-        mux.send(chan, ssnet.CMD_CONNECT, '%s,%s' % dstip)
-        outwrap = MuxWrapper(mux, chan)
-        handlers.append(Proxy(SockWrapper(sock, sock), outwrap))
-    handlers.append(Handler([listener], onaccept))
-
-    dnsreqs = {}
-    def dns_done(chan, data):
-        peer,timeout = dnsreqs.get(chan) or (None,None)
-        debug3('dns_done: channel=%r peer=%r\n' % (chan, peer))
-        if peer:
-            del dnsreqs[chan]
-            debug3('doing sendto %r\n' % (peer,))
-            dnslistener.sendto(data, peer)
-    def ondns():
-        pkt,peer = dnslistener.recvfrom(4096)
-        now = time.time()
-        if pkt:
-            debug1('DNS request from %r: %d bytes\n' % (peer, len(pkt)))
-            chan = mux.next_channel()
-            dnsreqs[chan] = peer,now+30
-            mux.send(chan, ssnet.CMD_DNS_REQ, pkt)
-            mux.channels[chan] = lambda cmd,data: dns_done(chan,data)
-        for chan,(peer,timeout) in dnsreqs.items():
-            if timeout < now:
-                del dnsreqs[chan]
-        debug3('Remaining DNS requests: %d\n' % len(dnsreqs))
-    if dnslistener:
-        handlers.append(Handler([dnslistener], ondns))
-
-    if seed_hosts != None:
-        debug1('seed_hosts: %r\n' % seed_hosts)
-        mux.send(0, ssnet.CMD_HOST_REQ, '\n'.join(seed_hosts))
-    
-    while 1:
-        rv = serverproc.poll()
-        if rv:
-            raise Fatal('server died with error code %d' % rv)
-        
-        ssnet.runonce(handlers, mux)
-        if latency_control:
-            mux.check_fullness()
-        mux.callback()
-
-
-def main(listenip, ssh_cmd, remotename, python, latency_control, dns,
-         seed_hosts, auto_nets,
-         subnets_include, subnets_exclude, syslog, daemon, pidfile):
-    if syslog:
-        ssyslog.start_syslog()
-    if daemon:
-        try:
-            check_daemon(pidfile)
-        except Fatal, e:
-            log("%s\n" % e)
-            return 5
-    debug1('Starting sshuttle proxy.\n')
-    
-    if listenip[1]:
-        ports = [listenip[1]]
-    else:
-        ports = xrange(12300,9000,-1)
-    last_e = None
-    bound = False
-    debug2('Binding:')
-    for port in ports:
-        debug2(' %d' % port)
-        listener = socket.socket()
-        listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        dnslistener = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-        dnslistener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        try:
-            listener.bind((listenip[0], port))
-            dnslistener.bind((listenip[0], port))
-            bound = True
-            break
-        except socket.error, e:
-            last_e = e
-    debug2('\n')
-    if not bound:
-        assert(last_e)
-        raise last_e
-    listener.listen(10)
-    listenip = listener.getsockname()
-    debug1('Listening on %r.\n' % (listenip,))
-
-    if dns:
-        dnsip = dnslistener.getsockname()
-        debug1('DNS listening on %r.\n' % (dnsip,))
-        dnsport = dnsip[1]
-    else:
-        dnsport = 0
-        dnslistener = None
-
-    fw = FirewallClient(listenip[1], subnets_include, subnets_exclude, dnsport)
-    
-    try:
-        return _main(listener, fw, ssh_cmd, remotename,
-                     python, latency_control, dnslistener,
-                     seed_hosts, auto_nets, syslog, daemon)
-    finally:
-        try:
-            if daemon:
-                # it's not our child anymore; can't waitpid
-                fw.p.returncode = 0
-            fw.done()
-        finally:
-            if daemon:
-                daemon_cleanup()

do

@@ -1,150 +0,0 @@
-#!/bin/sh
-#
-# A minimal alternative to djb redo that doesn't support incremental builds.
-# For the full version, visit http://github.com/apenwarr/redo
-#
-# The author disclaims copyright to this source file and hereby places it in
-# the public domain. (2010 12 14)
-#
-
-# By default, no output coloring.
-GREEN=""
-BOLD=""
-PLAIN=""
-
-if [ -n "$TERM" -a "$TERM" != "dumb" ] && tty <&2 >/dev/null 2>&1; then
-	GREEN="$(printf '\033[32m')"
-	BOLD="$(printf '\033[1m')"
-	PLAIN="$(printf '\033[m')"
-fi
-
-_dirsplit()
-{
-	base=${1##*/}
-	dir=${1%$base}
-}
-
-_dirsplit "$0"
-export REDO=$(cd "${dir:-.}" && echo "$PWD/$base")
-
-DO_TOP=
-if [ -z "$DO_BUILT" ]; then
-	DO_TOP=1
-	[ -n "$*" ] || set all  # only toplevel redo has a default target
-	export DO_BUILT=$PWD/.do_built
-	: >>"$DO_BUILT"
-	echo "Removing previously built files..." >&2
-	sort -u "$DO_BUILT" | tee "$DO_BUILT.new" |
-	while read f; do printf "%s\0%s.did\0" "$f" "$f"; done |
-	xargs -0 rm -f 2>/dev/null
-	mv "$DO_BUILT.new" "$DO_BUILT"
-	DO_PATH=$DO_BUILT.dir
-	export PATH=$DO_PATH:$PATH
-	rm -rf "$DO_PATH"
-	mkdir "$DO_PATH"
-	for d in redo redo-ifchange; do
-		ln -s "$REDO" "$DO_PATH/$d";
-	done
-	[ -e /bin/true ] && TRUE=/bin/true || TRUE=/usr/bin/true
-	for d in redo-ifcreate redo-stamp redo-always; do 
-		ln -s $TRUE "$DO_PATH/$d";
-	done
-fi
-
-
-_find_dofile_pwd()
-{
-	DOFILE=default.$1.do
-	while :; do
-		DOFILE=default.${DOFILE#default.*.}
-		[ -e "$DOFILE" -o "$DOFILE" = default.do ] && break
-	done
-	EXT=${DOFILE#default}
-	EXT=${EXT%.do}
-	BASE=${1%$EXT}
-}
-
-
-_find_dofile()
-{
-	PREFIX=
-	while :; do
-		_find_dofile_pwd "$1"
-		[ -e "$DOFILE" ] && break
-		[ "$PWD" = "/" ] && break
-		TARGET=${PWD##*/}/$TARGET
-		PREFIX=${PWD##*/}/$PREFIX
-		cd ..
-	done
-	BASE=$PREFIX$BASE
-}
-
-
-_run_dofile()
-{
-	export DO_DEPTH="$DO_DEPTH  "
-	export REDO_TARGET=$PWD/$TARGET
-	set -e
-	read line1 <"$PWD/$DOFILE"
-	cmd=${line1#"#!/"}
-	if [ "$cmd" != "$line1" ]; then
-		/$cmd "$PWD/$DOFILE" "$@" >"$TARGET.tmp2"
-	else
-		. "$PWD/$DOFILE" >"$TARGET.tmp2"
-	fi
-}
-
-
-_do()
-{
-	DIR=$1
-	TARGET=$2
-	if [ ! -e "$TARGET" ] || [ -e "$TARGET/." -a ! -e "$TARGET.did" ]; then
-		printf '%sdo  %s%s%s%s\n' \
-			"$GREEN" "$DO_DEPTH" "$BOLD" "$DIR$TARGET" "$PLAIN" >&2
-		echo "$PWD/$TARGET" >>"$DO_BUILT"
-		DOFILE=$TARGET.do
-		BASE=$TARGET
-		EXT=
-		[ -e "$TARGET.do" ] || _find_dofile "$TARGET"
-		if [ ! -e "$DOFILE" ]; then
-			echo "do: $TARGET: no .do file" >&2
-			return 1
-		fi
-		[ ! -e "$DO_BUILD" ] || : >>"$TARGET.did"
-		( _run_dofile "$BASE" "$EXT" "$TARGET.tmp" )
-		RV=$?
-		if [ $RV != 0 ]; then
-			printf "do: %s%s\n" "$DO_DEPTH" \
-				"$DIR$TARGET: got exit code $RV" >&2
-			rm -f "$TARGET.tmp" "$TARGET.tmp2"
-			return $RV
-		fi
-		mv "$TARGET.tmp" "$TARGET" 2>/dev/null ||
-		! test -s "$TARGET.tmp2" ||
-		mv "$TARGET.tmp2" "$TARGET" 2>/dev/null
-		rm -f "$TARGET.tmp2"
-	else
-		echo "do  $DO_DEPTH$TARGET exists." >&2
-	fi
-}
-
-
-redo()
-{
-	for i in "$@"; do
-		_dirsplit "$i"
-		( cd "$dir" && _do "$dir" "$base" ) || return 1
-	done
-}
-
-
-set -e
-redo "$@"
-
-if [ -n "$DO_TOP" ]; then
-	echo "Removing stamp files..." >&2
-	[ ! -e "$DO_BUILT" ] ||
-	while read f; do printf "%s.did\0" "$f"; done <"$DO_BUILT" |
-	xargs -0 rm -f 2>/dev/null
-fi

main.py

@@ -1,130 +0,0 @@
-import sys, os, re
-import helpers, options, client, server, firewall, hostwatch
-import compat.ssubprocess as ssubprocess
-from helpers import *
-
-
-# list of:
-# 1.2.3.4/5 or just 1.2.3.4
-def parse_subnets(subnets_str):
-    subnets = []
-    for s in subnets_str:
-        m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
-        if not m:
-            raise Fatal('%r is not a valid IP subnet format' % s)
-        (a,b,c,d,width) = m.groups()
-        (a,b,c,d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
-        if width == None:
-            width = 32
-        else:
-            width = int(width)
-        if a > 255 or b > 255 or c > 255 or d > 255:
-            raise Fatal('%d.%d.%d.%d has numbers > 255' % (a,b,c,d))
-        if width > 32:
-            raise Fatal('*/%d is greater than the maximum of 32' % width)
-        subnets.append(('%d.%d.%d.%d' % (a,b,c,d), width))
-    return subnets
-
-
-# 1.2.3.4:567 or just 1.2.3.4 or just 567
-def parse_ipport(s):
-    s = str(s)
-    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP:port format' % s)
-    (a,b,c,d,port) = m.groups()
-    (a,b,c,d,port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
-                      int(port or 0))
-    if a > 255 or b > 255 or c > 255 or d > 255:
-        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a,b,c,d))
-    if port > 65535:
-        raise Fatal('*:%d is greater than the maximum of 65535' % port)
-    if a == None:
-        a = b = c = d = 0
-    return ('%d.%d.%d.%d' % (a,b,c,d), port)
-
-
-optspec = """
-sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
-sshuttle --server
-sshuttle --firewall <port> <subnets...>
-sshuttle --hostwatch
---
-l,listen=  transproxy to this ip address and port number [127.0.0.1:0]
-H,auto-hosts scan for remote hostnames and update local /etc/hosts
-N,auto-nets  automatically determine subnets to route
-dns        capture local DNS requests and forward to the remote DNS server
-python=    path to python interpreter on the remote server
-r,remote=  ssh hostname (and optional username) of remote sshuttle server
-x,exclude= exclude this subnet (can be used more than once)
-v,verbose  increase debug message verbosity
-e,ssh-cmd= the command to use to connect to the remote [ssh]
-seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
-no-latency-control  sacrifice latency to improve bandwidth benchmarks
-wrap=      restart counting channel numbers after this number (for testing)
-D,daemon   run in the background as a daemon
-syslog     send log messages to syslog (default if you use --daemon)
-pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
-server     (internal use only)
-firewall   (internal use only)
-hostwatch  (internal use only)
-"""
-o = options.Options(optspec)
-(opt, flags, extra) = o.parse(sys.argv[2:])
-
-if opt.daemon:
-    opt.syslog = 1
-if opt.wrap:
-    import ssnet
-    ssnet.MAX_CHANNEL = int(opt.wrap)
-helpers.verbose = opt.verbose
-
-try:
-    if opt.server:
-        if len(extra) != 0:
-            o.fatal('no arguments expected')
-        server.latency_control = opt.latency_control
-        sys.exit(server.main())
-    elif opt.firewall:
-        if len(extra) != 2:
-            o.fatal('exactly two arguments expected')
-        sys.exit(firewall.main(int(extra[0]), int(extra[1]), opt.syslog))
-    elif opt.hostwatch:
-        sys.exit(hostwatch.hw_main(extra))
-    else:
-        if len(extra) < 1 and not opt.auto_nets:
-            o.fatal('at least one subnet (or -N) expected')
-        includes = extra
-        excludes = ['127.0.0.0/8']
-        for k,v in flags:
-            if k in ('-x','--exclude'):
-                excludes.append(v)
-        remotename = opt.remote
-        if remotename == '' or remotename == '-':
-            remotename = None
-        if opt.seed_hosts and not opt.auto_hosts:
-            o.fatal('--seed-hosts only works if you also use -H')
-        if opt.seed_hosts:
-            sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
-        elif opt.auto_hosts:
-            sh = []
-        else:
-            sh = None
-        sys.exit(client.main(parse_ipport(opt.listen or '0.0.0.0:0'),
-                             opt.ssh_cmd,
-                             remotename,
-                             opt.python,
-                             opt.latency_control,
-                             opt.dns,
-                             sh,
-                             opt.auto_nets,
-                             parse_subnets(includes),
-                             parse_subnets(excludes),
-                             opt.syslog, opt.daemon, opt.pidfile))
-except Fatal, e:
-    log('fatal: %s\n' % e)
-    sys.exit(99)
-except KeyboardInterrupt:
-    log('\n')
-    log('Keyboard interrupt: exiting.\n')
-    sys.exit(1)

packaging/control

@@ -0,0 +1,26 @@
+Package: sshuttle
+Version: 0.2
+Architecture: i386
+Maintainer: Jim Wyllie <jwyllie83@gmail.com>
+Depends: autossh, upstart, python (>=2.6)
+Section: utils
+Priority: optional
+Homepage: http://github.com/jwyllie83/sshuttle.udp
+Description: "Full-featured" VPN over an SSH tunnel, allowing full remote
+ access somewhere where all you have is an SSH connection.  It works well if
+ you generally find yourself in the following situation:
+ .
+ - Your client machine (or router) is Linux, FreeBSD, or MacOS.
+ - You have access to a remote network via ssh.
+ - You don't necessarily have admin access on the remote network.
+ - You do not wish to, or can't, use other VPN software
+ - You don't want to create an ssh port forward for every
+    single host/port on the remote network.
+ - You hate openssh's port forwarding because it's randomly
+    slow and/or stupid.
+ - You can't use openssh's PermitTunnel feature because
+    it's disabled by default on openssh servers; plus it does
+    TCP-over-TCP, which has suboptimal performance
+ .
+ It also has hooks for more complicated setups (VPN-in-a-SSH-VPN, etc) to allow
+ you to set it up as you like.

packaging/make_deb

@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# This script puts together a .deb package suitable for installing on an Ubuntu
+# system
+
+B="/tmp/sshuttle/build"
+
+if [ ! -x /usr/bin/dpkg ]; then
+	echo 'Unable to build: dpkg not found on system'
+	exit 1
+fi
+
+# Create the new directory structure
+mkdir -p ${B}/etc/sshuttle/pre-start.d
+mkdir -p ${B}/etc/sshuttle/post-stop.d
+mkdir -p ${B}/usr/share/sshuttle
+mkdir -p ${B}/usr/bin
+mkdir -p ${B}/etc/init
+mkdir -p ${B}/DEBIAN
+
+# Copy over all of the files
+cp -r ../src/* ${B}/usr/share/sshuttle
+cp ../src/sshuttle ${B}/usr/bin
+cp -r sshuttle.conf ${B}/etc/init
+cp prefixes.conf ${B}/etc/sshuttle
+cp tunnel.conf ${B}/etc/sshuttle
+
+# Copy the control file over, as well
+cp control ${B}/DEBIAN
+
+# Create the md5sum manifest
+if [ -x /usr/bin/md5sum ]; then
+	cd ${B}
+	find . -type f | egrep -v DEBIAN | sed -re 's/^..//' | xargs md5sum > ${B}/DEBIAN/md5sums
+	cd ${OLDPWD}
+fi
+
+# Build the debian package
+VERSION=$(egrep -e '^Version' control | sed -re 's/^[^:]*: //')
+dpkg --build ${B} ./sshuttle-${VERSION}.deb
+rm -rf ${B}

packaging/prefixes.conf

@@ -0,0 +1,5 @@
+# Output prefixes here, one per line.  Prefix is in:
+# prefix/netmask format
+# Like this:
+# 192.168.0.0/16
+# 192.0.43.10/32

packaging/sshuttle.conf

@@ -0,0 +1,90 @@
+description "Create a transparent proxy over SSH"
+author      "Jim Wyllie <jwyllie83@gmail.com>"
+
+manual
+nice -5
+
+# Edit this file with network prefixes that should be loaded through the SSH
+# tunnel.
+env PREFIX_LOCATION=/etc/sshuttle/prefixes.conf
+
+# Routing table; defaults to 100
+env ROUTE_TABLE=100
+
+# fwmark; defaults to 1
+env FWMARK=1
+
+# SSH tunnel configuration file
+env SSHUTTLE_TUNNEL_FILE=/etc/sshuttle/tunnel.conf
+
+# File containing the tunnel proxy name / host / whatever
+env TUNNEL_PROXY="/etc/sshuttle/tunnel.conf"
+
+# Any other commands needed to run before or after loading the SSH tunnel.
+# This is where you can put any of your hacks to set up tunnels-in-tunnels,
+# etc.  Scripts in this directory are executed in order.
+env MISC_START_DIR=/etc/sshuttle/pre-start.d
+env MISC_STOP_DIR=/etc/sshuttle/post-stop.d
+
+start on (local-filesystems and net-device-up IFACE!=lo)
+stop on stopping network-services
+
+#respawn
+
+pre-start script
+	# Make sure we have created the routes
+	sudo ip rule add fwmark ${FWMARK} lookup ${ROUTE_TABLE}
+	logger "Starting sshuttle..."
+
+	if [ -f "${PREFIX_LOCATION}" ]; then
+		cat "${PREFIX_LOCATION}" | while read ROUTE; do
+
+			# Skip comments
+			if [ -n "$(echo ${ROUTE} | egrep "^[ 	]*#")" ]; then
+				continue
+			fi
+
+			# Skip empty lines
+			if [ -z "${ROUTE}" ]; then
+				continue
+			fi
+
+			logger "Adding route: ${ROUTE}"
+			ip route add local ${ROUTE} dev lo table ${ROUTE_TABLE}
+		done
+	fi
+
+	for RUNFILE in ${MISC_START_DIR}/*; do
+		logger "Executing ${RUNFILE}"
+		/bin/sh -c "${RUNFILE}"
+	done
+end script
+
+post-stop script
+	if [ -f "${PREFIX_LOCATION}" ]; then
+		cat "${PREFIX_LOCATION}" | while read ROUTE; do
+
+			# Skip comments
+			if [ -n "$(echo ${ROUTE} | egrep "^[ 	]*#")" ]; then
+				continue
+			fi
+
+			# Skip empty lines
+			if [ -z "${ROUTE}" ]; then
+				continue
+			fi
+
+			logger "Deleting route: ${ROUTE}"
+			ip route del local ${ROUTE} dev lo table ${ROUTE_TABLE}
+		done
+	fi
+
+	ip rule del fwmark ${FWMARK}
+
+	for RUNFILE in "${MISC_STOP_DIR}/*"; do
+		logger "Executing ${RUNFILE}"
+		/bin/sh -c "${RUNFILE}"
+	done
+end script
+
+exec /usr/bin/sshuttle --dns --method=tproxy --listen 0.0.0.0 --remote sshuttle_tunnel -s /etc/sshuttle/prefixes.conf -e "ssh -F ${TUNNEL_PROXY}"

packaging/tunnel.conf

@@ -0,0 +1,19 @@
+# Here is where you can specify any SSH tunnel options See ssh_config(5) for
+# details.  You need to leave the Host line intact, but everything else can
+# specify whatever you want
+Host sshuttle_tunnel
+
+# REQUIRED: Set this to be the host to which you would like to connect your
+# tunnel
+#Hostname localhost
+
+# REQUIRED: Set this to be the target SSH user on the remote system
+#User foo
+
+# ---------------------------------------------------------------------------
+# The rest are all optional; see ssh_config(5) for the full list of what can
+# be specified.  Some very commonly needed ones are below.
+# ---------------------------------------------------------------------------
+
+# SSH key used for connecting
+#IdentityFile /path/to/key

src/assembler.py

@@ -1,4 +1,5 @@
-import sys, zlib
+import sys
+import zlib
 
 z = zlib.decompressobj()
 mainmod = sys.modules[__name__]

src/client.py

@@ -0,0 +1,754 @@
+import struct
+import errno
+import re
+import signal
+import time
+import compat.ssubprocess as ssubprocess
+import helpers
+import os
+import ssnet
+import ssh
+import ssyslog
+import sys
+from ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper
+from helpers import log, debug1, debug2, debug3, Fatal, islocal
+
+recvmsg = None
+try:
+    # try getting recvmsg from python
+    import socket as pythonsocket
+    getattr(pythonsocket.socket, "recvmsg")
+    socket = pythonsocket
+    recvmsg = "python"
+except AttributeError:
+    # try getting recvmsg from socket_ext library
+    try:
+        import socket_ext
+        getattr(socket_ext.socket, "recvmsg")
+        socket = socket_ext
+        recvmsg = "socket_ext"
+    except ImportError:
+        import socket
+
+_extra_fd = os.open('/dev/null', os.O_RDONLY)
+
+
+def got_signal(signum, frame):
+    log('exiting on signal %d\n' % signum)
+    sys.exit(1)
+
+
+_pidname = None
+IP_TRANSPARENT = 19
+IP_ORIGDSTADDR = 20
+IP_RECVORIGDSTADDR = IP_ORIGDSTADDR
+SOL_IPV6 = 41
+IPV6_ORIGDSTADDR = 74
+IPV6_RECVORIGDSTADDR = IPV6_ORIGDSTADDR
+
+
+if recvmsg == "python":
+    def recv_udp(listener, bufsize):
+        debug3('Accept UDP python using recvmsg.\n')
+        data, ancdata, msg_flags, srcip = listener.recvmsg(
+            4096, socket.CMSG_SPACE(24))
+        dstip = None
+        family = None
+        for cmsg_level, cmsg_type, cmsg_data in ancdata:
+            if cmsg_level == socket.SOL_IP and cmsg_type == IP_ORIGDSTADDR:
+                family, port = struct.unpack('=HH', cmsg_data[0:4])
+                port = socket.htons(port)
+                if family == socket.AF_INET:
+                    start = 4
+                    length = 4
+                else:
+                    raise Fatal("Unsupported socket type '%s'" % family)
+                ip = socket.inet_ntop(family, cmsg_data[start:start + length])
+                dstip = (ip, port)
+                break
+            elif cmsg_level == SOL_IPV6 and cmsg_type == IPV6_ORIGDSTADDR:
+                family, port = struct.unpack('=HH', cmsg_data[0:4])
+                port = socket.htons(port)
+                if family == socket.AF_INET6:
+                    start = 8
+                    length = 16
+                else:
+                    raise Fatal("Unsupported socket type '%s'" % family)
+                ip = socket.inet_ntop(family, cmsg_data[start:start + length])
+                dstip = (ip, port)
+                break
+        return (srcip, dstip, data)
+elif recvmsg == "socket_ext":
+    def recv_udp(listener, bufsize):
+        debug3('Accept UDP using socket_ext recvmsg.\n')
+        srcip, data, adata, flags = listener.recvmsg(
+            (bufsize,), socket.CMSG_SPACE(24))
+        dstip = None
+        family = None
+        for a in adata:
+            if a.cmsg_level == socket.SOL_IP and a.cmsg_type == IP_ORIGDSTADDR:
+                family, port = struct.unpack('=HH', a.cmsg_data[0:4])
+                port = socket.htons(port)
+                if family == socket.AF_INET:
+                    start = 4
+                    length = 4
+                else:
+                    raise Fatal("Unsupported socket type '%s'" % family)
+                ip = socket.inet_ntop(
+                    family, a.cmsg_data[start:start + length])
+                dstip = (ip, port)
+                break
+            elif a.cmsg_level == SOL_IPV6 and a.cmsg_type == IPV6_ORIGDSTADDR:
+                family, port = struct.unpack('=HH', a.cmsg_data[0:4])
+                port = socket.htons(port)
+                if family == socket.AF_INET6:
+                    start = 8
+                    length = 16
+                else:
+                    raise Fatal("Unsupported socket type '%s'" % family)
+                ip = socket.inet_ntop(
+                    family, a.cmsg_data[start:start + length])
+                dstip = (ip, port)
+                break
+        return (srcip, dstip, data[0])
+else:
+    def recv_udp(listener, bufsize):
+        debug3('Accept UDP using recvfrom.\n')
+        data, srcip = listener.recvfrom(bufsize)
+        return (srcip, None, data)
+
+
+def check_daemon(pidfile):
+    global _pidname
+    _pidname = os.path.abspath(pidfile)
+    try:
+        oldpid = open(_pidname).read(1024)
+    except IOError, e:
+        if e.errno == errno.ENOENT:
+            return  # no pidfile, ok
+        else:
+            raise Fatal("can't read %s: %s" % (_pidname, e))
+    if not oldpid:
+        os.unlink(_pidname)
+        return  # invalid pidfile, ok
+    oldpid = int(oldpid.strip() or 0)
+    if oldpid <= 0:
+        os.unlink(_pidname)
+        return  # invalid pidfile, ok
+    try:
+        os.kill(oldpid, 0)
+    except OSError, e:
+        if e.errno == errno.ESRCH:
+            os.unlink(_pidname)
+            return  # outdated pidfile, ok
+        elif e.errno == errno.EPERM:
+            pass
+        else:
+            raise
+    raise Fatal("%s: sshuttle is already running (pid=%d)"
+                % (_pidname, oldpid))
+
+
+def daemonize():
+    if os.fork():
+        os._exit(0)
+    os.setsid()
+    if os.fork():
+        os._exit(0)
+
+    outfd = os.open(_pidname, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0666)
+    try:
+        os.write(outfd, '%d\n' % os.getpid())
+    finally:
+        os.close(outfd)
+    os.chdir("/")
+
+    # Normal exit when killed, or try/finally won't work and the pidfile won't
+    # be deleted.
+    signal.signal(signal.SIGTERM, got_signal)
+
+    si = open('/dev/null', 'r+')
+    os.dup2(si.fileno(), 0)
+    os.dup2(si.fileno(), 1)
+    si.close()
+
+    ssyslog.stderr_to_syslog()
+
+
+def daemon_cleanup():
+    try:
+        os.unlink(_pidname)
+    except OSError, e:
+        if e.errno == errno.ENOENT:
+            pass
+        else:
+            raise
+
+
+def original_dst(sock):
+    try:
+        SO_ORIGINAL_DST = 80
+        SOCKADDR_MIN = 16
+        sockaddr_in = sock.getsockopt(socket.SOL_IP,
+                                      SO_ORIGINAL_DST, SOCKADDR_MIN)
+        (proto, port, a, b, c, d) = struct.unpack('!HHBBBB', sockaddr_in[:8])
+        assert(socket.htons(proto) == socket.AF_INET)
+        ip = '%d.%d.%d.%d' % (a, b, c, d)
+        return (ip, port)
+    except socket.error, e:
+        if e.args[0] == errno.ENOPROTOOPT:
+            return sock.getsockname()
+        raise
+
+
+class MultiListener:
+
+    def __init__(self, type=socket.SOCK_STREAM, proto=0):
+        self.v6 = socket.socket(socket.AF_INET6, type, proto)
+        self.v4 = socket.socket(socket.AF_INET, type, proto)
+
+    def setsockopt(self, level, optname, value):
+        if self.v6:
+            self.v6.setsockopt(level, optname, value)
+        if self.v4:
+            self.v4.setsockopt(level, optname, value)
+
+    def add_handler(self, handlers, callback, method, mux):
+        if self.v6:
+            handlers.append(
+                Handler(
+                    [self.v6],
+                    lambda: callback(self.v6, method, mux, handlers)))
+        if self.v4:
+            handlers.append(
+                Handler(
+                    [self.v4],
+                    lambda: callback(self.v4, method, mux, handlers)))
+
+    def listen(self, backlog):
+        if self.v6:
+            self.v6.listen(backlog)
+        if self.v4:
+            try:
+                self.v4.listen(backlog)
+            except socket.error, e:
+                # on some systems v4 bind will fail if the v6 suceeded,
+                # in this case the v6 socket will receive v4 too.
+                if e.errno == errno.EADDRINUSE and self.v6:
+                    self.v4 = None
+                else:
+                    raise e
+
+    def bind(self, address_v6, address_v4):
+        if address_v6 and self.v6:
+            self.v6.bind(address_v6)
+        else:
+            self.v6 = None
+        if address_v4 and self.v4:
+            self.v4.bind(address_v4)
+        else:
+            self.v4 = None
+
+    def print_listening(self, what):
+        if self.v6:
+            listenip = self.v6.getsockname()
+            debug1('%s listening on %r.\n' % (what, listenip))
+        if self.v4:
+            listenip = self.v4.getsockname()
+            debug1('%s listening on %r.\n' % (what, listenip))
+
+
+class FirewallClient:
+
+    def __init__(self, port_v6, port_v4, subnets_include, subnets_exclude,
+                 dnsport_v6, dnsport_v4, method, udp):
+        self.auto_nets = []
+        self.subnets_include = subnets_include
+        self.subnets_exclude = subnets_exclude
+        argvbase = ([sys.argv[1], sys.argv[0], sys.argv[1]] +
+                    ['-v'] * (helpers.verbose or 0) +
+                    ['--firewall', str(port_v6), str(port_v4),
+                     str(dnsport_v6), str(dnsport_v4),
+                     method, str(int(udp))])
+        if ssyslog._p:
+            argvbase += ['--syslog']
+        argv_tries = [
+            ['sudo', '-p', '[local sudo] Password: '] + argvbase,
+            ['su', '-c', ' '.join(argvbase)],
+            argvbase
+        ]
+
+        # we can't use stdin/stdout=subprocess.PIPE here, as we normally would,
+        # because stupid Linux 'su' requires that stdin be attached to a tty.
+        # Instead, attach a *bidirectional* socket to its stdout, and use
+        # that for talking in both directions.
+        (s1, s2) = socket.socketpair()
+
+        def setup():
+            # run in the child process
+            s2.close()
+        e = None
+        if os.getuid() == 0:
+            argv_tries = argv_tries[-1:]  # last entry only
+        for argv in argv_tries:
+            try:
+                if argv[0] == 'su':
+                    sys.stderr.write('[local su] ')
+                self.p = ssubprocess.Popen(argv, stdout=s1, preexec_fn=setup)
+                e = None
+                break
+            except OSError, e:
+                pass
+        self.argv = argv
+        s1.close()
+        self.pfile = s2.makefile('wb+')
+        if e:
+            log('Spawning firewall manager: %r\n' % self.argv)
+            raise Fatal(e)
+        line = self.pfile.readline()
+        self.check()
+        if line[0:5] != 'READY':
+            raise Fatal('%r expected READY, got %r' % (self.argv, line))
+        self.method = line[6:-1]
+
+    def check(self):
+        rv = self.p.poll()
+        if rv:
+            raise Fatal('%r returned %d' % (self.argv, rv))
+
+    def start(self):
+        self.pfile.write('ROUTES\n')
+        for (family, ip, width) in self.subnets_include + self.auto_nets:
+            self.pfile.write('%d,%d,0,%s\n' % (family, width, ip))
+        for (family, ip, width) in self.subnets_exclude:
+            self.pfile.write('%d,%d,1,%s\n' % (family, width, ip))
+        self.pfile.write('GO\n')
+        self.pfile.flush()
+        line = self.pfile.readline()
+        self.check()
+        if line != 'STARTED\n':
+            raise Fatal('%r expected STARTED, got %r' % (self.argv, line))
+
+    def sethostip(self, hostname, ip):
+        assert(not re.search(r'[^-\w]', hostname))
+        assert(not re.search(r'[^0-9.]', ip))
+        self.pfile.write('HOST %s,%s\n' % (hostname, ip))
+        self.pfile.flush()
+
+    def done(self):
+        self.pfile.close()
+        rv = self.p.wait()
+        if rv:
+            raise Fatal('cleanup: %r returned %d' % (self.argv, rv))
+
+
+dnsreqs = {}
+udp_by_src = {}
+
+
+def expire_connections(now, mux):
+    for chan, timeout in dnsreqs.items():
+        if timeout < now:
+            debug3('expiring dnsreqs channel=%d\n' % chan)
+            del mux.channels[chan]
+            del dnsreqs[chan]
+    debug3('Remaining DNS requests: %d\n' % len(dnsreqs))
+    for peer, (chan, timeout) in udp_by_src.items():
+        if timeout < now:
+            debug3('expiring UDP channel channel=%d peer=%r\n' % (chan, peer))
+            mux.send(chan, ssnet.CMD_UDP_CLOSE, '')
+            del mux.channels[chan]
+            del udp_by_src[peer]
+    debug3('Remaining UDP channels: %d\n' % len(udp_by_src))
+
+
+def onaccept_tcp(listener, method, mux, handlers):
+    global _extra_fd
+    try:
+        sock, srcip = listener.accept()
+    except socket.error, e:
+        if e.args[0] in [errno.EMFILE, errno.ENFILE]:
+            debug1('Rejected incoming connection: too many open files!\n')
+            # free up an fd so we can eat the connection
+            os.close(_extra_fd)
+            try:
+                sock, srcip = listener.accept()
+                sock.close()
+            finally:
+                _extra_fd = os.open('/dev/null', os.O_RDONLY)
+            return
+        else:
+            raise
+    if method == "tproxy":
+        dstip = sock.getsockname()
+    else:
+        dstip = original_dst(sock)
+    debug1('Accept TCP: %s:%r -> %s:%r.\n' % (srcip[0], srcip[1],
+                                              dstip[0], dstip[1]))
+    if dstip[1] == sock.getsockname()[1] and islocal(dstip[0], sock.family):
+        debug1("-- ignored: that's my address!\n")
+        sock.close()
+        return
+    chan = mux.next_channel()
+    if not chan:
+        log('warning: too many open channels.  Discarded connection.\n')
+        sock.close()
+        return
+    mux.send(chan, ssnet.CMD_TCP_CONNECT, '%d,%s,%s' %
+             (sock.family, dstip[0], dstip[1]))
+    outwrap = MuxWrapper(mux, chan)
+    handlers.append(Proxy(SockWrapper(sock, sock), outwrap))
+    expire_connections(time.time(), mux)
+
+
+def udp_done(chan, data, method, family, dstip):
+    (src, srcport, data) = data.split(",", 2)
+    srcip = (src, int(srcport))
+    debug3('doing send from %r to %r\n' % (srcip, dstip,))
+
+    try:
+        sender = socket.socket(family, socket.SOCK_DGRAM)
+        sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        sender.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)
+        sender.bind(srcip)
+        sender.sendto(data, dstip)
+        sender.close()
+    except socket.error, e:
+        debug1('-- ignored socket error sending UDP data: %r\n' % e)
+
+
+def onaccept_udp(listener, method, mux, handlers):
+    now = time.time()
+    srcip, dstip, data = recv_udp(listener, 4096)
+    if not dstip:
+        debug1(
+            "-- ignored UDP from %r: "
+            "couldn't determine destination IP address\n" % (srcip,))
+        return
+    debug1('Accept UDP: %r -> %r.\n' % (srcip, dstip,))
+    if srcip in udp_by_src:
+        chan, timeout = udp_by_src[srcip]
+    else:
+        chan = mux.next_channel()
+        mux.channels[chan] = lambda cmd, data: udp_done(
+            chan, data, method, listener.family, dstip=srcip)
+        mux.send(chan, ssnet.CMD_UDP_OPEN, listener.family)
+    udp_by_src[srcip] = chan, now + 30
+
+    hdr = "%s,%r," % (dstip[0], dstip[1])
+    mux.send(chan, ssnet.CMD_UDP_DATA, hdr + data)
+
+    expire_connections(now, mux)
+
+
+def dns_done(chan, data, method, sock, srcip, dstip, mux):
+    debug3('dns_done: channel=%d src=%r dst=%r\n' % (chan, srcip, dstip))
+    del mux.channels[chan]
+    del dnsreqs[chan]
+    if method == "tproxy":
+        debug3('doing send from %r to %r\n' % (srcip, dstip,))
+        sender = socket.socket(sock.family, socket.SOCK_DGRAM)
+        sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        sender.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)
+        sender.bind(srcip)
+        sender.sendto(data, dstip)
+        sender.close()
+    else:
+        debug3('doing sendto %r\n' % (dstip,))
+        sock.sendto(data, dstip)
+
+
+def ondns(listener, method, mux, handlers):
+    now = time.time()
+    srcip, dstip, data = recv_udp(listener, 4096)
+    if method == "tproxy" and not dstip:
+        debug1(
+            "-- ignored UDP from %r: "
+            "couldn't determine destination IP address\n" % (srcip,))
+        return
+    debug1('DNS request from %r to %r: %d bytes\n' % (srcip, dstip, len(data)))
+    chan = mux.next_channel()
+    dnsreqs[chan] = now + 30
+    mux.send(chan, ssnet.CMD_DNS_REQ, data)
+    mux.channels[chan] = lambda cmd, data: dns_done(
+        chan, data, method, listener, srcip=dstip, dstip=srcip, mux=mux)
+    expire_connections(now, mux)
+
+
+def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
+          python, latency_control,
+          dns_listener, method, seed_hosts, auto_nets,
+          syslog, daemon):
+    handlers = []
+    if helpers.verbose >= 1:
+        helpers.logprefix = 'c : '
+    else:
+        helpers.logprefix = 'client: '
+    debug1('connecting to server...\n')
+
+    try:
+        (serverproc, serversock) = ssh.connect(
+            ssh_cmd, remotename, python,
+            stderr=ssyslog._p and ssyslog._p.stdin,
+            options=dict(latency_control=latency_control, method=method))
+    except socket.error, e:
+        if e.args[0] == errno.EPIPE:
+            raise Fatal("failed to establish ssh session (1)")
+        else:
+            raise
+    mux = Mux(serversock, serversock)
+    handlers.append(mux)
+
+    expected = 'SSHUTTLE0001'
+
+    try:
+        v = 'x'
+        while v and v != '\0':
+            v = serversock.recv(1)
+        v = 'x'
+        while v and v != '\0':
+            v = serversock.recv(1)
+        initstring = serversock.recv(len(expected))
+    except socket.error, e:
+        if e.args[0] == errno.ECONNRESET:
+            raise Fatal("failed to establish ssh session (2)")
+        else:
+            raise
+
+    rv = serverproc.poll()
+    if rv:
+        raise Fatal('server died with error code %d' % rv)
+
+    if initstring != expected:
+        raise Fatal('expected server init string %r; got %r'
+                    % (expected, initstring))
+    debug1('connected.\n')
+    print 'Connected.'
+    sys.stdout.flush()
+    if daemon:
+        daemonize()
+        log('daemonizing (%s).\n' % _pidname)
+    elif syslog:
+        debug1('switching to syslog.\n')
+        ssyslog.stderr_to_syslog()
+
+    def onroutes(routestr):
+        if auto_nets:
+            for line in routestr.strip().split('\n'):
+                (family, ip, width) = line.split(',', 2)
+                fw.auto_nets.append((family, ip, int(width)))
+
+        # we definitely want to do this *after* starting ssh, or we might end
+        # up intercepting the ssh connection!
+        #
+        # Moreover, now that we have the --auto-nets option, we have to wait
+        # for the server to send us that message anyway.  Even if we haven't
+        # set --auto-nets, we might as well wait for the message first, then
+        # ignore its contents.
+        mux.got_routes = None
+        fw.start()
+    mux.got_routes = onroutes
+
+    def onhostlist(hostlist):
+        debug2('got host list: %r\n' % hostlist)
+        for line in hostlist.strip().split():
+            if line:
+                name, ip = line.split(',', 1)
+                fw.sethostip(name, ip)
+    mux.got_host_list = onhostlist
+
+    tcp_listener.add_handler(handlers, onaccept_tcp, method, mux)
+
+    if udp_listener:
+        udp_listener.add_handler(handlers, onaccept_udp, method, mux)
+
+    if dns_listener:
+        dns_listener.add_handler(handlers, ondns, method, mux)
+
+    if seed_hosts is not None:
+        debug1('seed_hosts: %r\n' % seed_hosts)
+        mux.send(0, ssnet.CMD_HOST_REQ, '\n'.join(seed_hosts))
+
+    while 1:
+        rv = serverproc.poll()
+        if rv:
+            raise Fatal('server died with error code %d' % rv)
+
+        ssnet.runonce(handlers, mux)
+        if latency_control:
+            mux.check_fullness()
+        mux.callback()
+
+
+def main(listenip_v6, listenip_v4,
+         ssh_cmd, remotename, python, latency_control, dns,
+         method, seed_hosts, auto_nets,
+         subnets_include, subnets_exclude, syslog, daemon, pidfile):
+
+    if syslog:
+        ssyslog.start_syslog()
+    if daemon:
+        try:
+            check_daemon(pidfile)
+        except Fatal, e:
+            log("%s\n" % e)
+            return 5
+    debug1('Starting sshuttle proxy.\n')
+
+    if recvmsg is not None:
+        debug1("recvmsg %s support enabled.\n" % recvmsg)
+
+    if method == "tproxy":
+        if recvmsg is not None:
+            debug1("tproxy UDP support enabled.\n")
+            udp = True
+        else:
+            debug1("tproxy UDP support requires recvmsg function.\n")
+            udp = False
+        if dns and recvmsg is None:
+            debug1("tproxy DNS support requires recvmsg function.\n")
+            dns = False
+    else:
+        debug1("UDP support requires tproxy; disabling UDP.\n")
+        udp = False
+
+    if listenip_v6 and listenip_v6[1] and listenip_v4 and listenip_v4[1]:
+        # if both ports given, no need to search for a spare port
+        ports = [0, ]
+    else:
+        # if at least one port missing, we have to search
+        ports = xrange(12300, 9000, -1)
+
+    # search for free ports and try to bind
+    last_e = None
+    redirectport_v6 = 0
+    redirectport_v4 = 0
+    bound = False
+    debug2('Binding redirector:')
+    for port in ports:
+        debug2(' %d' % port)
+        tcp_listener = MultiListener()
+        tcp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+
+        if udp:
+            udp_listener = MultiListener(socket.SOCK_DGRAM)
+            udp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        else:
+            udp_listener = None
+
+        if listenip_v6 and listenip_v6[1]:
+            lv6 = listenip_v6
+            redirectport_v6 = lv6[1]
+        elif listenip_v6:
+            lv6 = (listenip_v6[0], port)
+            redirectport_v6 = port
+        else:
+            lv6 = None
+            redirectport_v6 = 0
+
+        if listenip_v4 and listenip_v4[1]:
+            lv4 = listenip_v4
+            redirectport_v4 = lv4[1]
+        elif listenip_v4:
+            lv4 = (listenip_v4[0], port)
+            redirectport_v4 = port
+        else:
+            lv4 = None
+            redirectport_v4 = 0
+
+        try:
+            tcp_listener.bind(lv6, lv4)
+            if udp_listener:
+                udp_listener.bind(lv6, lv4)
+            bound = True
+            break
+        except socket.error, e:
+            if e.errno == errno.EADDRINUSE:
+                last_e = e
+            else:
+                raise e
+    debug2('\n')
+    if not bound:
+        assert(last_e)
+        raise last_e
+    tcp_listener.listen(10)
+    tcp_listener.print_listening("TCP redirector")
+    if udp_listener:
+        udp_listener.print_listening("UDP redirector")
+
+    bound = False
+    if dns:
+        # search for spare port for DNS
+        debug2('Binding DNS:')
+        ports = xrange(12300, 9000, -1)
+        for port in ports:
+            debug2(' %d' % port)
+            dns_listener = MultiListener(socket.SOCK_DGRAM)
+
+            if listenip_v6:
+                lv6 = (listenip_v6[0], port)
+                dnsport_v6 = port
+            else:
+                lv6 = None
+                dnsport_v6 = 0
+
+            if listenip_v4:
+                lv4 = (listenip_v4[0], port)
+                dnsport_v4 = port
+            else:
+                lv4 = None
+                dnsport_v4 = 0
+
+            try:
+                dns_listener.bind(lv6, lv4)
+                bound = True
+                break
+            except socket.error, e:
+                if e.errno == errno.EADDRINUSE:
+                    last_e = e
+                else:
+                    raise e
+        debug2('\n')
+        dns_listener.print_listening("DNS")
+        if not bound:
+            assert(last_e)
+            raise last_e
+    else:
+        dnsport_v6 = 0
+        dnsport_v4 = 0
+        dns_listener = None
+
+    fw = FirewallClient(redirectport_v6, redirectport_v4, subnets_include,
+                        subnets_exclude, dnsport_v6, dnsport_v4, method, udp)
+
+    if fw.method == "tproxy":
+        tcp_listener.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)
+        if udp_listener:
+            udp_listener.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)
+            if udp_listener.v4 is not None:
+                udp_listener.v4.setsockopt(
+                    socket.SOL_IP, IP_RECVORIGDSTADDR, 1)
+            if udp_listener.v6 is not None:
+                udp_listener.v6.setsockopt(SOL_IPV6, IPV6_RECVORIGDSTADDR, 1)
+        if dns_listener:
+            dns_listener.setsockopt(socket.SOL_IP, IP_TRANSPARENT, 1)
+            if dns_listener.v4 is not None:
+                dns_listener.v4.setsockopt(
+                    socket.SOL_IP, IP_RECVORIGDSTADDR, 1)
+            if dns_listener.v6 is not None:
+                dns_listener.v6.setsockopt(SOL_IPV6, IPV6_RECVORIGDSTADDR, 1)
+
+    try:
+        return _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
+                     python, latency_control, dns_listener,
+                     fw.method, seed_hosts, auto_nets, syslog,
+                     daemon)
+    finally:
+        try:
+            if daemon:
+                # it's not our child anymore; can't waitpid
+                fw.p.returncode = 0
+            fw.done()
+        finally:
+            if daemon:
+                daemon_cleanup()

src/default.8.do

@@ -1,6 +1,6 @@
 exec >&2
 if pandoc </dev/null 2>/dev/null; then
-	pandoc -s -r markdown -w man -o $3 $1.md
+	pandoc -s -r markdown -w man -o $3 $2.md
 else
 	echo "Warning: pandoc not installed; can't generate manpages."
 	redo-always

src/do

@@ -0,0 +1,175 @@
+#!/bin/sh
+#
+# A minimal alternative to djb redo that doesn't support incremental builds.
+# For the full version, visit http://github.com/apenwarr/redo
+#
+# The author disclaims copyright to this source file and hereby places it in
+# the public domain. (2010 12 14)
+#
+
+# By default, no output coloring.
+green=""
+bold=""
+plain=""
+
+if [ -n "$TERM" -a "$TERM" != "dumb" ] && tty <&2 >/dev/null 2>&1; then
+	green="$(printf '\033[32m')"
+	bold="$(printf '\033[1m')"
+	plain="$(printf '\033[m')"
+fi
+
+_dirsplit()
+{
+	base=${1##*/}
+	dir=${1%$base}
+}
+
+dirname()
+(
+	_dirsplit "$1"
+	dir=${dir%/}
+	echo "${dir:-.}"
+)
+
+_dirsplit "$0"
+export REDO=$(cd "${dir:-.}" && echo "$PWD/$base")
+
+DO_TOP=
+if [ -z "$DO_BUILT" ]; then
+	DO_TOP=1
+	[ -n "$*" ] || set all  # only toplevel redo has a default target
+	export DO_BUILT=$PWD/.do_built
+	: >>"$DO_BUILT"
+	echo "Removing previously built files..." >&2
+	sort -u "$DO_BUILT" | tee "$DO_BUILT.new" |
+	while read f; do printf "%s\0%s.did\0" "$f" "$f"; done |
+	xargs -0 rm -f 2>/dev/null
+	mv "$DO_BUILT.new" "$DO_BUILT"
+	DO_PATH=$DO_BUILT.dir
+	export PATH=$DO_PATH:$PATH
+	rm -rf "$DO_PATH"
+	mkdir "$DO_PATH"
+	for d in redo redo-ifchange; do
+		ln -s "$REDO" "$DO_PATH/$d";
+	done
+	[ -e /bin/true ] && TRUE=/bin/true || TRUE=/usr/bin/true
+	for d in redo-ifcreate redo-stamp redo-always; do 
+		ln -s $TRUE "$DO_PATH/$d";
+	done
+fi
+
+
+_find_dofile_pwd()
+{
+	dofile=default.$1.do
+	while :; do
+		dofile=default.${dofile#default.*.}
+		[ -e "$dofile" -o "$dofile" = default.do ] && break
+	done
+	ext=${dofile#default}
+	ext=${ext%.do}
+	base=${1%$ext}
+}
+
+
+_find_dofile()
+{
+	local prefix=
+	while :; do
+		_find_dofile_pwd "$1"
+		[ -e "$dofile" ] && break
+		[ "$PWD" = "/" ] && break
+		target=${PWD##*/}/$target
+		tmp=${PWD##*/}/$tmp
+		prefix=${PWD##*/}/$prefix
+		cd ..
+	done
+	base=$prefix$base
+}
+
+
+_run_dofile()
+{
+	export DO_DEPTH="$DO_DEPTH  "
+	export REDO_TARGET=$PWD/$target
+	local line1
+	set -e
+	read line1 <"$PWD/$dofile"
+	cmd=${line1#"#!/"}
+	if [ "$cmd" != "$line1" ]; then
+		/$cmd "$PWD/$dofile" "$@" >"$tmp.tmp2"
+	else
+		:; . "$PWD/$dofile" >"$tmp.tmp2"
+	fi
+}
+
+
+_do()
+{
+	local dir=$1 target=$2 tmp=$3
+	if [ ! -e "$target" ] || [ -d "$target" -a ! -e "$target.did" ]; then
+		printf '%sdo  %s%s%s%s\n' \
+			"$green" "$DO_DEPTH" "$bold" "$dir$target" "$plain" >&2
+		echo "$PWD/$target" >>"$DO_BUILT"
+		dofile=$target.do
+		base=$target
+		ext=
+		[ -e "$target.do" ] || _find_dofile "$target"
+		if [ ! -e "$dofile" ]; then
+			echo "do: $target: no .do file" >&2
+			return 1
+		fi
+		[ ! -e "$DO_BUILT" ] || [ ! -d "$(dirname "$target")" ] ||
+		: >>"$target.did"
+		( _run_dofile "$target" "$base" "$tmp.tmp" )
+		rv=$?
+		if [ $rv != 0 ]; then
+			printf "do: %s%s\n" "$DO_DEPTH" \
+				"$dir$target: got exit code $rv" >&2
+			rm -f "$tmp.tmp" "$tmp.tmp2"
+			return $rv
+		fi
+		mv "$tmp.tmp" "$target" 2>/dev/null ||
+		! test -s "$tmp.tmp2" ||
+		mv "$tmp.tmp2" "$target" 2>/dev/null
+		rm -f "$tmp.tmp2"
+	else
+		echo "do  $DO_DEPTH$target exists." >&2
+	fi
+}
+
+
+# Make corrections for directories that don't actually exist yet.
+_dir_shovel()
+{
+	local dir base
+	xdir=$1 xbase=$2 xbasetmp=$2
+	while [ ! -d "$xdir" -a -n "$xdir" ]; do
+		_dirsplit "${xdir%/}"
+		xbasetmp=${base}__$xbase
+		xdir=$dir xbase=$base/$xbase
+		echo "xbasetmp='$xbasetmp'" >&2
+	done
+}
+
+
+redo()
+{
+	for i in "$@"; do
+		_dirsplit "$i"
+		_dir_shovel "$dir" "$base"
+		dir=$xdir base=$xbase basetmp=$xbasetmp
+		( cd "$dir" && _do "$dir" "$base" "$basetmp" ) || return 1
+	done
+}
+
+
+set -e
+redo "$@"
+
+if [ -n "$DO_TOP" ]; then
+	echo "Removing stamp files..." >&2
+	[ ! -e "$DO_BUILT" ] ||
+	while read f; do printf "%s.did\0" "$f"; done <"$DO_BUILT" |
+	xargs -0 rm -f 2>/dev/null
+fi

src/firewall.py

@@ -1,7 +1,14 @@
-import re, errno, socket, select, struct
+import errno
+import socket
+import select
+import signal
+import struct
 import compat.ssubprocess as ssubprocess
-import helpers, ssyslog
-from helpers import *
+import ssyslog
+import sys
+import os
+from helpers import log, debug1, debug3, islocal, Fatal, family_to_string, \
+    resolvconf_nameservers
 
 # python doesn't have a definition for this
 IPPROTO_DIVERT = 254
@@ -14,9 +21,15 @@ def nonfatal(func, *args):
         log('error: %s\n' % e)
 
 
-def ipt_chain_exists(name):
-    argv = ['iptables', '-t', 'nat', '-nL']
-    p = ssubprocess.Popen(argv, stdout = ssubprocess.PIPE)
+def ipt_chain_exists(family, table, name):
+    if family == socket.AF_INET6:
+        cmd = 'ip6tables'
+    elif family == socket.AF_INET:
+        cmd = 'iptables'
+    else:
+        raise Exception('Unsupported family "%s"' % family_to_string(family))
+    argv = [cmd, '-t', table, '-nL']
+    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
     for line in p.stdout:
         if line.startswith('Chain %s ' % name):
             return True
@@ -25,8 +38,13 @@ def ipt_chain_exists(name):
         raise Fatal('%r returned %d' % (argv, rv))
 
 
-def ipt(*args):
-    argv = ['iptables', '-t', 'nat'] + list(args)
+def _ipt(family, table, *args):
+    if family == socket.AF_INET6:
+        argv = ['ip6tables', '-t', table] + list(args)
+    elif family == socket.AF_INET:
+        argv = ['iptables', '-t', table] + list(args)
+    else:
+        raise Exception('Unsupported family "%s"' % family_to_string(family))
     debug1('>> %s\n' % ' '.join(argv))
     rv = ssubprocess.call(argv)
     if rv:
@@ -34,7 +52,9 @@ def ipt(*args):
 
 
 _no_ttl_module = False
-def ipt_ttl(*args):
+
+
+def _ipt_ttl(family, *args):
     global _no_ttl_module
     if not _no_ttl_module:
         # we avoid infinite loops by generating server-side connections
@@ -42,16 +62,15 @@ def ipt_ttl(*args):
         # connections, in case client == server.
         try:
             argsplus = list(args) + ['-m', 'ttl', '!', '--ttl', '42']
-            ipt(*argsplus)
+            _ipt(family, *argsplus)
         except Fatal:
-            ipt(*args)
+            _ipt(family, *args)
             # we only get here if the non-ttl attempt succeeds
             log('sshuttle: warning: your iptables is missing '
                 'the ttl module.\n')
             _no_ttl_module = True
     else:
-        ipt(*args)
-
+        _ipt(family, *args)
 
 
 # We name the chain based on the transproxy port number so that it's possible
@@ -59,11 +78,27 @@ def ipt_ttl(*args):
 # multiple copies shouldn't have overlapping subnets, or only the most-
 # recently-started one will win (because we use "-I OUTPUT 1" instead of
 # "-A OUTPUT").
-def do_iptables(port, dnsport, subnets):
+def do_iptables_nat(port, dnsport, family, subnets, udp):
+    # only ipv4 supported with NAT
+    if family != socket.AF_INET:
+        raise Exception(
+            'Address family "%s" unsupported by nat method'
+            % family_to_string(family))
+    if udp:
+        raise Exception("UDP not supported by nat method")
+
+    table = "nat"
+
+    def ipt(*args):
+        return _ipt(family, table, *args)
+
+    def ipt_ttl(*args):
+        return _ipt_ttl(family, table, *args)
+
     chain = 'sshuttle-%s' % port
 
     # basic cleanup/setup of chains
-    if ipt_chain_exists(chain):
+    if ipt_chain_exists(family, table, chain):
         nonfatal(ipt, '-D', 'OUTPUT', '-j', chain)
         nonfatal(ipt, '-D', 'PREROUTING', '-j', chain)
         nonfatal(ipt, '-F', chain)
@@ -81,20 +116,21 @@ def do_iptables(port, dnsport, subnets):
         # to least-specific, and at any given level of specificity, we want
         # excludes to come first.  That's why the columns are in such a non-
         # intuitive order.
-        for swidth,sexclude,snet in sorted(subnets, reverse=True):
+        for f, swidth, sexclude, snet \
+                in sorted(subnets, key=lambda s: s[1], reverse=True):
             if sexclude:
                 ipt('-A', chain, '-j', 'RETURN',
-                    '--dest', '%s/%s' % (snet,swidth),
+                    '--dest', '%s/%s' % (snet, swidth),
                     '-p', 'tcp')
             else:
                 ipt_ttl('-A', chain, '-j', 'REDIRECT',
-                        '--dest', '%s/%s' % (snet,swidth),
+                        '--dest', '%s/%s' % (snet, swidth),
                         '-p', 'tcp',
                         '--to-ports', str(port))
-                
+
     if dnsport:
         nslist = resolvconf_nameservers()
-        for ip in nslist:
+        for f, ip in filter(lambda i: i[0] == family, nslist):
             ipt_ttl('-A', chain, '-j', 'REDIRECT',
                     '--dest', '%s/32' % ip,
                     '-p', 'udp',
@@ -102,14 +138,115 @@ def do_iptables(port, dnsport, subnets):
                     '--to-ports', str(dnsport))
 
 
+def do_iptables_tproxy(port, dnsport, family, subnets, udp):
+    if family not in [socket.AF_INET, socket.AF_INET6]:
+        raise Exception(
+            'Address family "%s" unsupported by tproxy method'
+            % family_to_string(family))
+
+    table = "mangle"
+
+    def ipt(*args):
+        return _ipt(family, table, *args)
+
+    def ipt_ttl(*args):
+        return _ipt_ttl(family, table, *args)
+
+    mark_chain = 'sshuttle-m-%s' % port
+    tproxy_chain = 'sshuttle-t-%s' % port
+    divert_chain = 'sshuttle-d-%s' % port
+
+    # basic cleanup/setup of chains
+    if ipt_chain_exists(family, table, mark_chain):
+        ipt('-D', 'OUTPUT', '-j', mark_chain)
+        ipt('-F', mark_chain)
+        ipt('-X', mark_chain)
+
+    if ipt_chain_exists(family, table, tproxy_chain):
+        ipt('-D', 'PREROUTING', '-j', tproxy_chain)
+        ipt('-F', tproxy_chain)
+        ipt('-X', tproxy_chain)
+
+    if ipt_chain_exists(family, table, divert_chain):
+        ipt('-F', divert_chain)
+        ipt('-X', divert_chain)
+
+    if subnets or dnsport:
+        ipt('-N', mark_chain)
+        ipt('-F', mark_chain)
+        ipt('-N', divert_chain)
+        ipt('-F', divert_chain)
+        ipt('-N', tproxy_chain)
+        ipt('-F', tproxy_chain)
+        ipt('-I', 'OUTPUT', '1', '-j', mark_chain)
+        ipt('-I', 'PREROUTING', '1', '-j', tproxy_chain)
+        ipt('-A', divert_chain, '-j', 'MARK', '--set-mark', '1')
+        ipt('-A', divert_chain, '-j', 'ACCEPT')
+        ipt('-A', tproxy_chain, '-m', 'socket', '-j', divert_chain,
+            '-m', 'tcp', '-p', 'tcp')
+    if subnets and udp:
+        ipt('-A', tproxy_chain, '-m', 'socket', '-j', divert_chain,
+            '-m', 'udp', '-p', 'udp')
+
+    if dnsport:
+        nslist = resolvconf_nameservers()
+        for f, ip in filter(lambda i: i[0] == family, nslist):
+            ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',
+                '--dest', '%s/32' % ip,
+                '-m', 'udp', '-p', 'udp', '--dport', '53')
+            ipt('-A', tproxy_chain, '-j', 'TPROXY', '--tproxy-mark', '0x1/0x1',
+                '--dest', '%s/32' % ip,
+                '-m', 'udp', '-p', 'udp', '--dport', '53',
+                '--on-port', str(dnsport))
+
+    if subnets:
+        for f, swidth, sexclude, snet \
+                in sorted(subnets, key=lambda s: s[1], reverse=True):
+            if sexclude:
+                ipt('-A', mark_chain, '-j', 'RETURN',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'tcp', '-p', 'tcp')
+                ipt('-A', tproxy_chain, '-j', 'RETURN',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'tcp', '-p', 'tcp')
+            else:
+                ipt('-A', mark_chain, '-j', 'MARK',
+                    '--set-mark', '1',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'tcp', '-p', 'tcp')
+                ipt('-A', tproxy_chain, '-j', 'TPROXY',
+                    '--tproxy-mark', '0x1/0x1',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'tcp', '-p', 'tcp',
+                    '--on-port', str(port))
+
+            if sexclude and udp:
+                ipt('-A', mark_chain, '-j', 'RETURN',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'udp', '-p', 'udp')
+                ipt('-A', tproxy_chain, '-j', 'RETURN',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'udp', '-p', 'udp')
+            elif udp:
+                ipt('-A', mark_chain, '-j', 'MARK',
+                    '--set-mark', '1',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'udp', '-p', 'udp')
+                ipt('-A', tproxy_chain, '-j', 'TPROXY',
+                    '--tproxy-mark', '0x1/0x1',
+                    '--dest', '%s/%s' % (snet, swidth),
+                    '-m', 'udp', '-p', 'udp',
+                    '--on-port', str(port))
+
+
 def ipfw_rule_exists(n):
     argv = ['ipfw', 'list']
-    p = ssubprocess.Popen(argv, stdout = ssubprocess.PIPE)
+    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
     found = False
     for line in p.stdout:
         if line.startswith('%05d ' % n):
             if not ('ipttl 42' in line
-                    or ('skipto %d' % (n+1)) in line
+                    or ('skipto %d' % (n + 1)) in line
                     or 'check-state' in line):
                 log('non-sshuttle ipfw rule: %r\n' % line.strip())
                 raise Fatal('non-sshuttle ipfw rule #%d already exists!' % n)
@@ -121,12 +258,14 @@ def ipfw_rule_exists(n):
 
 
 _oldctls = {}
+
+
 def _fill_oldctls(prefix):
     argv = ['sysctl', prefix]
-    p = ssubprocess.Popen(argv, stdout = ssubprocess.PIPE)
+    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
     for line in p.stdout:
         assert(line[-1] == '\n')
-        (k,v) = line[:-1].split(': ', 1)
+        (k, v) = line[:-1].split(': ', 1)
         _oldctls[k] = v
     rv = p.wait()
     if rv:
@@ -138,10 +277,12 @@ def _fill_oldctls(prefix):
 def _sysctl_set(name, val):
     argv = ['sysctl', '-w', '%s=%s' % (name, val)]
     debug1('>> %s\n' % ' '.join(argv))
-    return ssubprocess.call(argv, stdout = open('/dev/null', 'w'))
+    return ssubprocess.call(argv, stdout=open('/dev/null', 'w'))
 
 
 _changedctls = []
+
+
 def sysctl_set(name, val, permanent=False):
     PREFIX = 'net.inet.ip'
     assert(name.startswith(PREFIX + '.'))
@@ -154,7 +295,7 @@ def sysctl_set(name, val, permanent=False):
     oldval = _oldctls[name]
     if val != oldval:
         rv = _sysctl_set(name, val)
-        if rv==0 and permanent:
+        if rv == 0 and permanent:
             debug1('>>   ...saving permanently in /etc/sysctl.conf\n')
             f = open('/etc/sysctl.conf', 'a')
             f.write('\n'
@@ -179,9 +320,11 @@ def _udp_repack(p, src, dst):
 
 
 _real_dns_server = [None]
+
+
 def _handle_diversion(divertsock, dnsport):
-    p,tag = divertsock.recvfrom(4096)
-    src,dst = _udp_unpack(p)
+    p, tag = divertsock.recvfrom(4096)
+    src, dst = _udp_unpack(p)
     debug3('got diverted packet from %r to %r\n' % (src, dst))
     if dst[1] == 53:
         # outgoing DNS
@@ -197,7 +340,7 @@ def _handle_diversion(divertsock, dnsport):
         assert(0)
     newp = _udp_repack(p, src, dst)
     divertsock.sendto(newp, tag)
-    
+
 
 def ipfw(*args):
     argv = ['ipfw', '-q'] + list(args)
@@ -207,9 +350,17 @@ def ipfw(*args):
         raise Fatal('%r returned %d' % (argv, rv))
 
 
-def do_ipfw(port, dnsport, subnets):
+def do_ipfw(port, dnsport, family, subnets, udp):
+    # IPv6 not supported
+    if family not in [socket.AF_INET, ]:
+        raise Exception(
+            'Address family "%s" unsupported by ipfw method'
+            % family_to_string(family))
+    if udp:
+        raise Exception("UDP not supported by ipfw method")
+
     sport = str(port)
-    xsport = str(port+1)
+    xsport = str(port + 1)
 
     # cleanup any existing rules
     if ipfw_rule_exists(port):
@@ -240,15 +391,16 @@ def do_ipfw(port, dnsport, subnets):
 
     if subnets:
         # create new subnet entries
-        for swidth,sexclude,snet in sorted(subnets, reverse=True):
+        for f, swidth, sexclude, snet \
+                in sorted(subnets, key=lambda s: s[1], reverse=True):
             if sexclude:
                 ipfw('add', sport, 'skipto', xsport,
-                     'log', 'tcp',
-                     'from', 'any', 'to', '%s/%s' % (snet,swidth))
+                     'tcp',
+                     'from', 'any', 'to', '%s/%s' % (snet, swidth))
             else:
                 ipfw('add', sport, 'fwd', '127.0.0.1,%d' % port,
-                     'log', 'tcp',
-                     'from', 'any', 'to', '%s/%s' % (snet,swidth),
+                     'tcp',
+                     'from', 'any', 'to', '%s/%s' % (snet, swidth),
                      'not', 'ipttl', '42', 'keep-state', 'setup')
 
     # This part is much crazier than it is on Linux, because MacOS (at least
@@ -283,31 +435,31 @@ def do_ipfw(port, dnsport, subnets):
     if dnsport:
         divertsock = socket.socket(socket.AF_INET, socket.SOCK_RAW,
                                    IPPROTO_DIVERT)
-        divertsock.bind(('0.0.0.0', port)) # IP field is ignored
+        divertsock.bind(('0.0.0.0', port))  # IP field is ignored
 
         nslist = resolvconf_nameservers()
-        for ip in nslist:
+        for f, ip in filter(lambda i: i[0] == family, nslist):
             # relabel and then catch outgoing DNS requests
             ipfw('add', sport, 'divert', sport,
-                 'log', 'udp',
+                 'udp',
                  'from', 'any', 'to', '%s/32' % ip, '53',
                  'not', 'ipttl', '42')
         # relabel DNS responses
         ipfw('add', sport, 'divert', sport,
-             'log', 'udp',
+             'udp',
              'from', 'any', str(dnsport), 'to', 'any',
              'not', 'ipttl', '42')
 
         def do_wait():
             while 1:
-                r,w,x = select.select([sys.stdin, divertsock], [], [])
+                r, w, x = select.select([sys.stdin, divertsock], [], [])
                 if divertsock in r:
                     _handle_diversion(divertsock, dnsport)
                 if sys.stdin in r:
                     return
     else:
         do_wait = None
-        
+
     return do_wait
 
 
@@ -320,10 +472,12 @@ def program_exists(name):
 
 
 hostmap = {}
+
+
 def rewrite_etc_hosts(port):
-    HOSTSFILE='/etc/hosts'
-    BAKFILE='%s.sbak' % HOSTSFILE
-    APPEND='# sshuttle-firewall-%d AUTOCREATED' % port
+    HOSTSFILE = '/etc/hosts'
+    BAKFILE = '%s.sbak' % HOSTSFILE
+    APPEND = '# sshuttle-firewall-%d AUTOCREATED' % port
     old_content = ''
     st = None
     try:
@@ -342,8 +496,8 @@ def rewrite_etc_hosts(port):
         if line.find(APPEND) >= 0:
             continue
         f.write('%s\n' % line)
-    for (name,ip) in sorted(hostmap.items()):
-        f.write('%-30s %s\n' % ('%s %s' % (ip,name), APPEND))
+    for (name, ip) in sorted(hostmap.items()):
+        f.write('%-30s %s\n' % ('%s %s' % (ip, name), APPEND))
     f.close()
 
     if st:
@@ -369,21 +523,35 @@ def restore_etc_hosts(port):
 # exit.  In case that fails, it's not the end of the world; future runs will
 # supercede it in the transproxy list, at least, so the leftover rules
 # are hopefully harmless.
-def main(port, dnsport, syslog):
-    assert(port > 0)
-    assert(port <= 65535)
-    assert(dnsport >= 0)
-    assert(dnsport <= 65535)
+def main(port_v6, port_v4, dnsport_v6, dnsport_v4, method, udp, syslog):
+    assert(port_v6 >= 0)
+    assert(port_v6 <= 65535)
+    assert(port_v4 >= 0)
+    assert(port_v4 <= 65535)
+    assert(dnsport_v6 >= 0)
+    assert(dnsport_v6 <= 65535)
+    assert(dnsport_v4 >= 0)
+    assert(dnsport_v4 <= 65535)
 
     if os.getuid() != 0:
         raise Fatal('you must be root (or enable su/sudo) to set the firewall')
 
-    if program_exists('ipfw'):
+    if method == "auto":
+        if program_exists('ipfw'):
+            method = "ipfw"
+        elif program_exists('iptables'):
+            method = "nat"
+        else:
+            raise Fatal("can't find either ipfw or iptables; check your PATH")
+
+    if method == "nat":
+        do_it = do_iptables_nat
+    elif method == "tproxy":
+        do_it = do_iptables_tproxy
+    elif method == "ipfw":
         do_it = do_ipfw
-    elif program_exists('iptables'):
-        do_it = do_iptables
     else:
-        raise Fatal("can't find either ipfw or iptables; check your PATH")
+        raise Exception('Unknown method "%s"' % method)
 
     # because of limitations of the 'su' command, the *real* stdin/stdout
     # are both attached to stdout initially.  Clone stdout into stdin so we
@@ -394,10 +562,17 @@ def main(port, dnsport, syslog):
         ssyslog.start_syslog()
         ssyslog.stderr_to_syslog()
 
-    debug1('firewall manager ready.\n')
-    sys.stdout.write('READY\n')
+    debug1('firewall manager ready method %s.\n' % method)
+    sys.stdout.write('READY %s\n' % method)
     sys.stdout.flush()
 
+    # don't disappear if our controlling terminal or stdout/stderr
+    # disappears; we still have to clean up.
+    signal.signal(signal.SIGHUP, signal.SIG_IGN)
+    signal.signal(signal.SIGPIPE, signal.SIG_IGN)
+    signal.signal(signal.SIGTERM, signal.SIG_IGN)
+    signal.signal(signal.SIGINT, signal.SIG_IGN)
+
     # ctrl-c shouldn't be passed along to me.  When the main sshuttle dies,
     # I'll die automatically.
     os.setsid()
@@ -419,17 +594,31 @@ def main(port, dnsport, syslog):
         elif line == 'GO\n':
             break
         try:
-            (width,exclude,ip) = line.strip().split(',', 2)
+            (family, width, exclude, ip) = line.strip().split(',', 3)
         except:
             raise Fatal('firewall: expected route or GO but got %r' % line)
-        subnets.append((int(width), bool(int(exclude)), ip))
-        
+        subnets.append((int(family), int(width), bool(int(exclude)), ip))
+
     try:
         if line:
             debug1('firewall manager: starting transproxy.\n')
-            do_wait = do_it(port, dnsport, subnets)
+
+            subnets_v6 = filter(lambda i: i[0] == socket.AF_INET6, subnets)
+            if port_v6:
+                do_wait = do_it(
+                    port_v6, dnsport_v6, socket.AF_INET6, subnets_v6, udp)
+            elif len(subnets_v6) > 0:
+                debug1("IPv6 subnets defined but IPv6 disabled\n")
+
+            subnets_v4 = filter(lambda i: i[0] == socket.AF_INET, subnets)
+            if port_v4:
+                do_wait = do_it(
+                    port_v4, dnsport_v4, socket.AF_INET, subnets_v4, udp)
+            elif len(subnets_v4) > 0:
+                debug1('IPv4 subnets defined but IPv4 disabled\n')
+
             sys.stdout.write('STARTED\n')
-        
+
         try:
             sys.stdout.flush()
         except IOError:
@@ -441,12 +630,13 @@ def main(port, dnsport, syslog):
         # to stay running so that we don't need a *second* password
         # authentication at shutdown time - that cleanup is important!
         while 1:
-            if do_wait: do_wait()
+            if do_wait:
+                do_wait()
             line = sys.stdin.readline(128)
             if line.startswith('HOST '):
-                (name,ip) = line[5:].strip().split(',', 1)
+                (name, ip) = line[5:].strip().split(',', 1)
                 hostmap[name] = ip
-                rewrite_etc_hosts(port)
+                rewrite_etc_hosts(port_v6 or port_v4)
             elif line:
                 raise Fatal('expected EOF, got %r' % line)
             else:
@@ -456,5 +646,8 @@ def main(port, dnsport, syslog):
             debug1('firewall manager: undoing changes.\n')
         except:
             pass
-        do_it(port, 0, [])
-        restore_etc_hosts(port)
+        if port_v6:
+            do_it(port_v6, 0, socket.AF_INET6, [], udp)
+        if port_v4:
+            do_it(port_v4, 0, socket.AF_INET, [], udp)
+        restore_etc_hosts(port_v6 or port_v4)

src/helpers.py

@@ -1,8 +1,11 @@
-import sys, os, socket
+import sys
+import socket
+import errno
 
 logprefix = ''
 verbose = 0
 
+
 def log(s):
     try:
         sys.stdout.flush()
@@ -13,14 +16,17 @@ def log(s):
         # our tty closes.  That sucks, but it's no reason to abort the program.
         pass
 
+
 def debug1(s):
     if verbose >= 1:
         log(s)
 
+
 def debug2(s):
     if verbose >= 2:
         log(s)
 
+
 def debug3(s):
     if verbose >= 3:
         log(s)
@@ -42,7 +48,10 @@ def resolvconf_nameservers():
     for line in open('/etc/resolv.conf'):
         words = line.lower().split()
         if len(words) >= 2 and words[0] == 'nameserver':
-            l.append(words[1])
+            if ':' in words[1]:
+                l.append((socket.AF_INET6, words[1]))
+            else:
+                l.append((socket.AF_INET, words[1]))
     return l
 
 
@@ -55,11 +64,11 @@ def resolvconf_random_nameserver():
             random.shuffle(l)
         return l[0]
     else:
-        return '127.0.0.1'
-    
+        return (socket.AF_INET, '127.0.0.1')
 
-def islocal(ip):
-    sock = socket.socket()
+
+def islocal(ip, family):
+    sock = socket.socket(family)
     try:
         try:
             sock.bind((ip, 0))
@@ -73,3 +82,10 @@ def islocal(ip):
     return True  # it's a local IP, or there would have been an error
 
 
+def family_to_string(family):
+    if family == socket.AF_INET6:
+        return "AF_INET6"
+    elif family == socket.AF_INET:
+        return "AF_INET"
+    else:
+        return str(family)

src/hostwatch.py

@@ -1,12 +1,18 @@
-import time, socket, re, select, errno
+import time
+import socket
+import re
+import select
+import errno
+import os
+import sys
 if not globals().get('skip_imports'):
     import compat.ssubprocess as ssubprocess
     import helpers
-    from helpers import *
+    from helpers import log, debug1, debug2, debug3
 
-POLL_TIME = 60*15
+POLL_TIME = 60 * 15
 NETSTAT_POLL_TIME = 30
-CACHEFILE=os.path.expanduser('~/.sshuttle.hosts')
+CACHEFILE = os.path.expanduser('~/.sshuttle.hosts')
 
 
 _nmb_ok = True
@@ -28,7 +34,7 @@ def write_host_cache():
     tmpname = '%s.%d.tmp' % (CACHEFILE, os.getpid())
     try:
         f = open(tmpname, 'wb')
-        for name,ip in sorted(hostnames.items()):
+        for name, ip in sorted(hostnames.items()):
             f.write('%s,%s\n' % (name, ip))
         f.close()
         os.rename(tmpname, CACHEFILE)
@@ -50,18 +56,18 @@ def read_host_cache():
     for line in f:
         words = line.strip().split(',')
         if len(words) == 2:
-            (name,ip) = words
+            (name, ip) = words
             name = re.sub(r'[^-\w]', '-', name).strip()
             ip = re.sub(r'[^0-9.]', '', ip).strip()
             if name and ip:
                 found_host(name, ip)
-                
+
 
 def found_host(hostname, ip):
     hostname = re.sub(r'\..*', '', hostname)
     hostname = re.sub(r'[^-\w]', '_', hostname)
-    if (ip.startswith('127.') or ip.startswith('255.') 
-        or hostname == 'localhost'):
+    if (ip.startswith('127.') or ip.startswith('255.')
+            or hostname == 'localhost'):
         return
     oldip = hostnames.get(hostname)
     if oldip != ip:
@@ -94,7 +100,7 @@ def _check_revdns(ip):
         debug3('<    %s\n' % r[0])
         check_host(r[0])
         found_host(r[0], ip)
-    except socket.herror, e:
+    except socket.herror:
         pass
 
 
@@ -105,7 +111,7 @@ def _check_dns(hostname):
         debug3('<    %s\n' % ip)
         check_host(ip)
         found_host(hostname, ip)
-    except socket.gaierror, e:
+    except socket.gaierror:
         pass
 
 
@@ -123,7 +129,7 @@ def _check_netstat():
     for ip in re.findall(r'\d+\.\d+\.\d+\.\d+', content):
         debug3('<    %s\n' % ip)
         check_host(ip)
-        
+
 
 def _check_smb(hostname):
     return
@@ -187,7 +193,7 @@ def _check_nmb(hostname, is_workgroup, is_master):
     global _nmb_ok
     if not _nmb_ok:
         return
-    argv = ['nmblookup'] + ['-M']*is_master + ['--', hostname]
+    argv = ['nmblookup'] + ['-M'] * is_master + ['--', hostname]
     debug2(' > n%d%d: %s\n' % (is_workgroup, is_master, hostname))
     try:
         p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
@@ -228,13 +234,13 @@ def check_workgroup(hostname):
 
 
 def _enqueue(op, *args):
-    t = (op,args)
-    if queue.get(t) == None:
+    t = (op, args)
+    if queue.get(t) is None:
         queue[t] = 0
 
 
 def _stdin_still_ok(timeout):
-    r,w,x = select.select([sys.stdin.fileno()], [], [], timeout)
+    r, w, x = select.select([sys.stdin.fileno()], [], [], timeout)
     if r:
         b = os.read(sys.stdin.fileno(), 4096)
         if not b:
@@ -249,7 +255,7 @@ def hw_main(seed_hosts):
         helpers.logprefix = 'hostwatch: '
 
     read_host_cache()
-        
+
     _enqueue(_check_etc_hosts)
     _enqueue(_check_netstat)
     check_host('localhost')
@@ -261,8 +267,8 @@ def hw_main(seed_hosts):
 
     while 1:
         now = time.time()
-        for t,last_polled in queue.items():
-            (op,args) = t
+        for t, last_polled in queue.items():
+            (op, args) = t
             if not _stdin_still_ok(0):
                 break
             maxtime = POLL_TIME
@@ -275,7 +281,7 @@ def hw_main(seed_hosts):
                 sys.stdout.flush()
             except IOError:
                 break
-                
+
         # FIXME: use a smarter timeout based on oldest last_polled
         if not _stdin_still_ok(1):
             break

src/main.py

@@ -0,0 +1,230 @@
+import sys
+import re
+import socket
+import helpers
+import options
+import client
+import server
+import firewall
+import hostwatch
+from helpers import log, Fatal
+
+
+# 1.2.3.4/5 or just 1.2.3.4
+def parse_subnet4(s):
+    m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP subnet format' % s)
+    (a, b, c, d, width) = m.groups()
+    (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
+    if width is None:
+        width = 32
+    else:
+        width = int(width)
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
+    if width > 32:
+        raise Fatal('*/%d is greater than the maximum of 32' % width)
+    return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)
+
+
+# 1:2::3/64 or just 1:2::3
+def parse_subnet6(s):
+    m = re.match(r'(?:([a-fA-F\d:]+))?(?:/(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP subnet format' % s)
+    (net, width) = m.groups()
+    if width is None:
+        width = 128
+    else:
+        width = int(width)
+    if width > 128:
+        raise Fatal('*/%d is greater than the maximum of 128' % width)
+    return(socket.AF_INET6, net, width)
+
+
+# Subnet file, supporting empty lines and hash-started comment lines
+def parse_subnet_file(s):
+    try:
+        handle = open(s, 'r')
+    except OSError:
+        raise Fatal('Unable to open subnet file: %s' % s)
+
+    raw_config_lines = handle.readlines()
+    config_lines = []
+    for line_no, line in enumerate(raw_config_lines):
+        line = line.strip()
+        if len(line) == 0:
+            continue
+        if line[0] == '#':
+            continue
+        config_lines.append(line)
+
+    return config_lines
+
+
+# list of:
+# 1.2.3.4/5 or just 1.2.3.4
+# 1:2::3/64 or just 1:2::3
+def parse_subnets(subnets_str):
+    subnets = []
+    for s in subnets_str:
+        if ':' in s:
+            subnet = parse_subnet6(s)
+        else:
+            subnet = parse_subnet4(s)
+        subnets.append(subnet)
+    return subnets
+
+
+# 1.2.3.4:567 or just 1.2.3.4 or just 567
+def parse_ipport4(s):
+    s = str(s)
+    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP:port format' % s)
+    (a, b, c, d, port) = m.groups()
+    (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
+                          int(port or 0))
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
+    if port > 65535:
+        raise Fatal('*:%d is greater than the maximum of 65535' % port)
+    if a is None:
+        a = b = c = d = 0
+    return ('%d.%d.%d.%d' % (a, b, c, d), port)
+
+
+# [1:2::3]:456 or [1:2::3] or 456
+def parse_ipport6(s):
+    s = str(s)
+    m = re.match(r'(?:\[([^]]*)])?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%s is not a valid IP:port format' % s)
+    (ip, port) = m.groups()
+    (ip, port) = (ip or '::', int(port or 0))
+    return (ip, port)
+
+
+optspec = """
+sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
+sshuttle --server
+sshuttle --firewall <port> <subnets...>
+sshuttle --hostwatch
+--
+l,listen=  transproxy to this ip address and port number
+H,auto-hosts scan for remote hostnames and update local /etc/hosts
+N,auto-nets  automatically determine subnets to route
+dns        capture local DNS requests and forward to the remote DNS server
+method=    auto, nat, tproxy, or ipfw
+python=    path to python interpreter on the remote server
+r,remote=  ssh hostname (and optional username) of remote sshuttle server
+x,exclude= exclude this subnet (can be used more than once)
+X,exclude-from=  exclude the subnets in a file (whitespace separated)
+v,verbose  increase debug message verbosity
+e,ssh-cmd= the command to use to connect to the remote [ssh]
+seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
+no-latency-control  sacrifice latency to improve bandwidth benchmarks
+wrap=      restart counting channel numbers after this number (for testing)
+D,daemon   run in the background as a daemon
+s,subnets= file where the subnets are stored, instead of on the command line
+syslog     send log messages to syslog (default if you use --daemon)
+pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
+server     (internal use only)
+firewall   (internal use only)
+hostwatch  (internal use only)
+"""
+o = options.Options(optspec)
+(opt, flags, extra) = o.parse(sys.argv[2:])
+
+if opt.daemon:
+    opt.syslog = 1
+if opt.wrap:
+    import ssnet
+    ssnet.MAX_CHANNEL = int(opt.wrap)
+helpers.verbose = opt.verbose
+
+try:
+    if opt.server:
+        if len(extra) != 0:
+            o.fatal('no arguments expected')
+        server.latency_control = opt.latency_control
+        sys.exit(server.main())
+    elif opt.firewall:
+        if len(extra) != 6:
+            o.fatal('exactly six arguments expected')
+        sys.exit(firewall.main(int(extra[0]), int(extra[1]),
+                               int(extra[2]), int(extra[3]),
+                               extra[4], int(extra[5]), opt.syslog))
+    elif opt.hostwatch:
+        sys.exit(hostwatch.hw_main(extra))
+    else:
+        if len(extra) < 1 and not opt.auto_nets and not opt.subnets:
+            o.fatal('at least one subnet, subnet file, or -N expected')
+        includes = extra
+        excludes = ['127.0.0.0/8']
+        for k, v in flags:
+            if k in ('-x', '--exclude'):
+                excludes.append(v)
+            if k in ('-X', '--exclude-from'):
+                excludes += open(v).read().split()
+        remotename = opt.remote
+        if remotename == '' or remotename == '-':
+            remotename = None
+        if opt.seed_hosts and not opt.auto_hosts:
+            o.fatal('--seed-hosts only works if you also use -H')
+        if opt.seed_hosts:
+            sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
+        elif opt.auto_hosts:
+            sh = []
+        else:
+            sh = None
+        if opt.subnets:
+            includes = parse_subnet_file(opt.subnets)
+        if not opt.method:
+            method = "auto"
+        elif opt.method in ["auto", "nat", "tproxy", "ipfw"]:
+            method = opt.method
+        else:
+            o.fatal("method %s not supported" % opt.method)
+        if not opt.listen:
+            if opt.method == "tproxy":
+                ipport_v6 = parse_ipport6('[::1]:0')
+            else:
+                ipport_v6 = None
+            ipport_v4 = parse_ipport4('127.0.0.1:0')
+        else:
+            ipport_v6 = None
+            ipport_v4 = None
+            list = opt.listen.split(",")
+            for ip in list:
+                if '[' in ip and ']' in ip and opt.method == "tproxy":
+                    ipport_v6 = parse_ipport6(ip)
+                else:
+                    ipport_v4 = parse_ipport4(ip)
+        return_code = client.main(ipport_v6, ipport_v4,
+                                  opt.ssh_cmd,
+                                  remotename,
+                                  opt.python,
+                                  opt.latency_control,
+                                  opt.dns,
+                                  method,
+                                  sh,
+                                  opt.auto_nets,
+                                  parse_subnets(includes),
+                                  parse_subnets(excludes),
+                                  opt.syslog, opt.daemon, opt.pidfile)
+
+        if return_code == 0:
+            log('Normal exit code, exiting...')
+        else:
+            log('Abnormal exit code detected, failing...' % return_code)
+        sys.exit(return_code)
+
+except Fatal, e:
+    log('fatal: %s\n' % e)
+    sys.exit(99)
+except KeyboardInterrupt:
+    log('\n')
+    log('Keyboard interrupt: exiting.\n')
+    sys.exit(1)

src/options.py

@@ -1,9 +1,16 @@
 """Command-line options parser.
 With the help of an options spec string, easily parse command-line options.
 """
-import sys, os, textwrap, getopt, re, struct
+import sys
+import os
+import textwrap
+import getopt
+import re
+import struct
+
 
 class OptDict:
+
     def __init__(self):
         self._opts = {}
 
@@ -46,7 +53,8 @@ def _atoi(v):
 def _remove_negative_kv(k, v):
     if k.startswith('no-') or k.startswith('no_'):
         return k[3:], not v
-    return k,v
+    return k, v
+
 
 def _remove_negative_k(k):
     return _remove_negative_kv(k, None)[0]
@@ -55,15 +63,17 @@ def _remove_negative_k(k):
 def _tty_width():
     s = struct.pack("HHHH", 0, 0, 0, 0)
     try:
-        import fcntl, termios
+        import fcntl
+        import termios
         s = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, s)
     except (IOError, ImportError):
         return _atoi(os.environ.get('WIDTH')) or 70
-    (ysize,xsize,ypix,xpix) = struct.unpack('HHHH', s)
+    (ysize, xsize, ypix, xpix) = struct.unpack('HHHH', s)
     return xsize or 70
 
 
 class Options:
+
     """Option parser.
     When constructed, two strings are mandatory. The first one is the command
     name showed before error messages. The second one is a string called an
@@ -76,6 +86,7 @@ class Options:
     By default, the parser function is getopt.gnu_getopt, and the abort
     behaviour is to exit the program.
     """
+
     def __init__(self, optspec, optfunc=getopt.gnu_getopt,
                  onabort=_default_onabort):
         self.optspec = optspec
@@ -95,7 +106,8 @@ class Options:
         first_syn = True
         while lines:
             l = lines.pop()
-            if l == '--': break
+            if l == '--':
+                break
             out.append('%s: %s\n' % (first_syn and 'usage' or '   or', l))
             first_syn = False
         out.append('\n')
@@ -122,7 +134,7 @@ class Options:
                 flagl = flags.split(',')
                 flagl_nice = []
                 for _f in flagl:
-                    f,dvi = _remove_negative_kv(_f, _intify(defval))
+                    f, dvi = _remove_negative_kv(_f, _intify(defval))
                     self._aliases[f] = _remove_negative_k(flagl[0])
                     self._hasparms[f] = has_parm
                     self._defaults[f] = dvi
@@ -140,8 +152,8 @@ class Options:
                     flags_nice += ' ...'
                 prefix = '    %-20s  ' % flags_nice
                 argtext = '\n'.join(textwrap.wrap(extra, width=_tty_width(),
-                                                initial_indent=prefix,
-                                                subsequent_indent=' '*28))
+                                                  initial_indent=prefix,
+                                                  subsequent_indent=' ' * 28))
                 out.append(argtext + '\n')
                 last_was_option = True
             else:
@@ -170,17 +182,18 @@ class Options:
         and "extra" is a list of positional arguments.
         """
         try:
-            (flags,extra) = self.optfunc(args, self._shortopts, self._longopts)
+            (flags, extra) = self.optfunc(
+                args, self._shortopts, self._longopts)
         except getopt.GetoptError, e:
             self.fatal(e)
 
         opt = OptDict()
 
-        for k,v in self._defaults.iteritems():
+        for k, v in self._defaults.iteritems():
             k = self._aliases[k]
             opt[k] = v
 
-        for (k,v) in flags:
+        for (k, v) in flags:
             k = k.lstrip('-')
             if k in ('h', '?', 'help'):
                 self.usage()
@@ -195,6 +208,6 @@ class Options:
                 else:
                     v = _intify(v)
             opt[k] = v
-        for (f1,f2) in self._aliases.iteritems():
+        for (f1, f2) in self._aliases.iteritems():
             opt[f1] = opt._opts.get(f2)
-        return (opt,flags,extra)
+        return (opt, flags, extra)

src/server.py

@@ -1,9 +1,22 @@
-import re, struct, socket, select, traceback, time
+import re
+import struct
+import socket
+import traceback
+import time
+import sys
+import os
 if not globals().get('skip_imports'):
-    import ssnet, helpers, hostwatch
+    import ssnet
+    import helpers
+    import hostwatch
     import compat.ssubprocess as ssubprocess
-    from ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper
-    from helpers import *
+    from ssnet import Handler, Proxy, Mux, MuxWrapper
+    from helpers import log, debug1, debug2, debug3, Fatal, \
+        resolvconf_random_nameserver
+
+
+if not globals().get('latency_control'):
+    latency_control = None
 
 
 def _ipmatch(ipstr):
@@ -14,13 +27,13 @@ def _ipmatch(ipstr):
         g = m.groups()
         ips = g[0]
         width = int(g[4] or 32)
-        if g[1] == None:
+        if g[1] is None:
             ips += '.0.0.0'
             width = min(width, 8)
-        elif g[2] == None:
+        elif g[2] is None:
             ips += '.0.0'
             width = min(width, 16)
-        elif g[3] == None:
+        elif g[3] is None:
             ips += '.0'
             width = min(width, 24)
         return (struct.unpack('!I', socket.inet_aton(ips))[0], width)
@@ -38,12 +51,12 @@ def _maskbits(netmask):
         return 32
     for i in range(32):
         if netmask[0] & _shl(1, i):
-            return 32-i
+            return 32 - i
     return 0
-    
-    
+
+
 def _shl(n, bits):
-    return n * int(2**bits)
+    return n * int(2 ** bits)
 
 
 def _list_routes():
@@ -58,8 +71,9 @@ def _list_routes():
         maskw = _ipmatch(cols[2])  # linux only
         mask = _maskbits(maskw)   # returns 32 if maskw is null
         width = min(ipw[1], mask)
-        ip = ipw[0] & _shl(_shl(1, width) - 1, 32-width)
-        routes.append((socket.inet_ntoa(struct.pack('!I', ip)), width))
+        ip = ipw[0] & _shl(_shl(1, width) - 1, 32 - width)
+        routes.append(
+            (socket.AF_INET, socket.inet_ntoa(struct.pack('!I', ip)), width))
     rv = p.wait()
     if rv != 0:
         log('WARNING: %r returned %d\n' % (argv, rv))
@@ -68,9 +82,9 @@ def _list_routes():
 
 
 def list_routes():
-    for (ip,width) in _list_routes():
+    for (family, ip, width) in _list_routes():
         if not ip.startswith('0.') and not ip.startswith('127.'):
-            yield (ip,width)
+            yield (family, ip, width)
 
 
 def _exc_dump():
@@ -79,7 +93,7 @@ def _exc_dump():
 
 
 def start_hostwatch(seed_hosts):
-    s1,s2 = socket.socketpair()
+    s1, s2 = socket.socketpair()
     pid = os.fork()
     if not pid:
         # child
@@ -91,32 +105,36 @@ def start_hostwatch(seed_hosts):
                 os.dup2(s1.fileno(), 0)
                 s1.close()
                 rv = hostwatch.hw_main(seed_hosts) or 0
-            except Exception, e:
+            except Exception:
                 log('%s\n' % _exc_dump())
                 rv = 98
         finally:
             os._exit(rv)
     s1.close()
-    return pid,s2
+    return pid, s2
 
 
 class Hostwatch:
+
     def __init__(self):
         self.pid = 0
         self.sock = None
 
 
 class DnsProxy(Handler):
+
     def __init__(self, mux, chan, request):
+        # FIXME! IPv4 specific
         sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
         Handler.__init__(self, [sock])
-        self.timeout = time.time()+30
+        self.timeout = time.time() + 30
         self.mux = mux
         self.chan = chan
         self.tries = 0
         self.peer = None
         self.request = request
         self.sock = sock
+        # FIXME! IPv4 specific
         self.sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
         self.try_send()
 
@@ -124,13 +142,14 @@ class DnsProxy(Handler):
         if self.tries >= 3:
             return
         self.tries += 1
-        self.peer = resolvconf_random_nameserver()
+        # FIXME! Support IPv6 nameservers
+        self.peer = resolvconf_random_nameserver()[1]
         self.sock.connect((self.peer, 53))
         debug2('DNS: sending to %r\n' % self.peer)
         try:
             self.sock.send(self.request)
         except socket.error, e:
-            if e.args[0] in [errno.ECONNREFUSED, errno.EHOSTUNREACH]:
+            if e.args[0] in ssnet.NET_ERRS:
                 # might have been spurious; try again.
                 # Note: these errors sometimes are reported by recv(),
                 # and sometimes by send().  We have to catch both.
@@ -145,7 +164,7 @@ class DnsProxy(Handler):
         try:
             data = self.sock.recv(4096)
         except socket.error, e:
-            if e.args[0] in [errno.ECONNREFUSED, errno.EHOSTUNREACH]:
+            if e.args[0] in ssnet.NET_ERRS:
                 # might have been spurious; try again.
                 # Note: these errors sometimes are reported by recv(),
                 # and sometimes by send().  We have to catch both.
@@ -160,20 +179,52 @@ class DnsProxy(Handler):
         self.ok = False
 
 
+class UdpProxy(Handler):
+
+    def __init__(self, mux, chan, family):
+        sock = socket.socket(family, socket.SOCK_DGRAM)
+        Handler.__init__(self, [sock])
+        self.timeout = time.time() + 30
+        self.mux = mux
+        self.chan = chan
+        self.sock = sock
+        if family == socket.AF_INET:
+            self.sock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
+
+    def send(self, dstip, data):
+        debug2('UDP: sending to %r port %d\n' % dstip)
+        try:
+            self.sock.sendto(data, dstip)
+        except socket.error, e:
+            log('UDP send to %r port %d: %s\n' % (dstip[0], dstip[1], e))
+            return
+
+    def callback(self):
+        try:
+            data, peer = self.sock.recvfrom(4096)
+        except socket.error, e:
+            log('UDP recv from %r port %d: %s\n' % (peer[0], peer[1], e))
+            return
+        debug2('UDP response: %d bytes\n' % len(data))
+        hdr = "%s,%r," % (peer[0], peer[1])
+        self.mux.send(self.chan, ssnet.CMD_UDP_DATA, hdr + data)
+
+
 def main():
     if helpers.verbose >= 1:
         helpers.logprefix = ' s: '
     else:
         helpers.logprefix = 'server: '
+    assert latency_control is not None
     debug1('latency control setting = %r\n' % latency_control)
 
     routes = list(list_routes())
     debug1('available routes:\n')
     for r in routes:
-        debug1('  %s/%d\n' % r)
-        
+        debug1('  %d/%s/%d\n' % r)
+
     # synchronization header
-    sys.stdout.write('SSHUTTLE0001')
+    sys.stdout.write('\0\0SSHUTTLE0001')
     sys.stdout.flush()
 
     handlers = []
@@ -184,12 +235,12 @@ def main():
     handlers.append(mux)
     routepkt = ''
     for r in routes:
-        routepkt += '%s,%d\n' % r
+        routepkt += '%d,%s,%d\n' % r
     mux.send(0, ssnet.CMD_ROUTES, routepkt)
 
     hw = Hostwatch()
     hw.leftover = ''
-        
+
     def hostwatch_ready():
         assert(hw.pid)
         content = hw.sock.recv(4096)
@@ -207,33 +258,64 @@ def main():
 
     def got_host_req(data):
         if not hw.pid:
-            (hw.pid,hw.sock) = start_hostwatch(data.strip().split())
-            handlers.append(Handler(socks = [hw.sock],
-                                    callback = hostwatch_ready))
+            (hw.pid, hw.sock) = start_hostwatch(data.strip().split())
+            handlers.append(Handler(socks=[hw.sock],
+                                    callback=hostwatch_ready))
     mux.got_host_req = got_host_req
 
     def new_channel(channel, data):
-        (dstip,dstport) = data.split(',', 1)
+        (family, dstip, dstport) = data.split(',', 2)
+        family = int(family)
         dstport = int(dstport)
-        outwrap = ssnet.connect_dst(dstip,dstport)
+        outwrap = ssnet.connect_dst(family, dstip, dstport)
         handlers.append(Proxy(MuxWrapper(mux, channel), outwrap))
     mux.new_channel = new_channel
 
     dnshandlers = {}
+
     def dns_req(channel, data):
-        debug2('Incoming DNS request.\n')
+        debug2('Incoming DNS request channel=%d.\n' % channel)
         h = DnsProxy(mux, channel, data)
         handlers.append(h)
         dnshandlers[channel] = h
     mux.got_dns_req = dns_req
 
+    udphandlers = {}
+
+    def udp_req(channel, cmd, data):
+        debug2('Incoming UDP request channel=%d, cmd=%d\n' % (channel, cmd))
+        if cmd == ssnet.CMD_UDP_DATA:
+            (dstip, dstport, data) = data.split(",", 2)
+            dstport = int(dstport)
+            debug2('is incoming UDP data. %r %d.\n' % (dstip, dstport))
+            h = udphandlers[channel]
+            h.send((dstip, dstport), data)
+        elif cmd == ssnet.CMD_UDP_CLOSE:
+            debug2('is incoming UDP close\n')
+            h = udphandlers[channel]
+            h.ok = False
+            del mux.channels[channel]
+
+    def udp_open(channel, data):
+        debug2('Incoming UDP open.\n')
+        family = int(data)
+        mux.channels[channel] = lambda cmd, data: udp_req(channel, cmd, data)
+        if channel in udphandlers:
+            raise Fatal('UDP connection channel %d already open' % channel)
+        else:
+            h = UdpProxy(mux, channel, family)
+            handlers.append(h)
+            udphandlers[channel] = h
+    mux.got_udp_open = udp_open
+
     while mux.ok:
         if hw.pid:
             assert(hw.pid > 0)
             (rpid, rv) = os.waitpid(hw.pid, os.WNOHANG)
             if rpid:
-                raise Fatal('hostwatch exited unexpectedly: code 0x%04x\n' % rv)
-        
+                raise Fatal(
+                    'hostwatch exited unexpectedly: code 0x%04x\n' % rv)
+
         ssnet.runonce(handlers, mux)
         if latency_control:
             mux.check_fullness()
@@ -241,7 +323,13 @@ def main():
 
         if dnshandlers:
             now = time.time()
-            for channel,h in dnshandlers.items():
+            for channel, h in dnshandlers.items():
                 if h.timeout < now or not h.ok:
+                    debug3('expiring dnsreqs channel=%d\n' % channel)
                     del dnshandlers[channel]
                     h.ok = False
+            for channel, h in udphandlers.items():
+                if not h.ok:
+                    debug3('expiring UDP channel=%d\n' % channel)
+                    del udphandlers[channel]
+                    h.ok = False

src/ssh.py

@@ -1,7 +1,11 @@
-import sys, os, re, socket, zlib
+import sys
+import os
+import re
+import socket
+import zlib
 import compat.ssubprocess as ssubprocess
 import helpers
-from helpers import *
+from helpers import debug2
 
 
 def readfile(name):
@@ -15,7 +19,7 @@ def readfile(name):
 
 
 def empackage(z, filename, data=None):
-    (path,basename) = os.path.split(filename)
+    (path, basename) = os.path.split(filename)
     if not data:
         data = readfile(filename)
     content = z.compress(data)
@@ -24,12 +28,9 @@ def empackage(z, filename, data=None):
 
 
 def connect(ssh_cmd, rhostport, python, stderr, options):
-    main_exe = sys.argv[0]
     portl = []
 
-    rhostIsIPv6 = False
     if (rhostport or '').count(':') > 1:
-        rhostIsIPv6 = True
         if rhostport.count(']') or rhostport.count('['):
             result = rhostport.split(']')
             rhost = result[0].strip('[')
@@ -37,9 +38,11 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
                 result[1] = result[1].strip(':')
                 if result[1] is not '':
                     portl = ['-p', str(int(result[1]))]
-        else: # can't disambiguate IPv6 colons and a port number. pass the hostname through.
+        # can't disambiguate IPv6 colons and a port number. pass the hostname
+        # through.
+        else:
             rhost = rhostport
-    else: # IPv4
+    else:  # IPv4
         l = (rhostport or '').split(':', 1)
         rhost = l[0]
         if len(l) > 1:
@@ -48,13 +51,9 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
     if rhost == '-':
         rhost = None
 
-    ipv6flag = []
-    if rhostIsIPv6:
-        ipv6flag = ['-6']
-
     z = zlib.compressobj(1)
     content = readfile('assembler.py')
-    optdata = ''.join("%s=%r\n" % (k,v) for (k,v) in options.items())
+    optdata = ''.join("%s=%r\n" % (k, v) for (k, v) in options.items())
     content2 = (empackage(z, 'cmdline_options.py', optdata) +
                 empackage(z, 'helpers.py') +
                 empackage(z, 'compat/ssubprocess.py') +
@@ -62,7 +61,7 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
                 empackage(z, 'hostwatch.py') +
                 empackage(z, 'server.py') +
                 "\n")
-    
+
     pyscript = r"""
                 import sys;
                 skip_imports=1;
@@ -71,7 +70,6 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
                 """ % (helpers.verbose or 0, len(content))
     pyscript = re.sub(r'\s+', ' ', pyscript.strip())
 
-        
     if not rhost:
         # ignore the --python argument when running locally; we already know
         # which python version works.
@@ -85,16 +83,16 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
             pycmd = "'%s' -c '%s'" % (python, pyscript)
         else:
             pycmd = ("P=python2; $P -V 2>/dev/null || P=python; "
-                     "\"$P\" -c '%s'") % pyscript
-        argv = (sshl + 
-                portl + 
-                ipv6flag + 
+                     "exec \"$P\" -c '%s'") % pyscript
+        argv = (sshl +
+                portl +
                 [rhost, '--', pycmd])
-    (s1,s2) = socket.socketpair()
+    (s1, s2) = socket.socketpair()
+
     def setup():
         # runs in the child process
         s2.close()
-    s1a,s1b = os.dup(s1.fileno()), os.dup(s1.fileno())
+    s1a, s1b = os.dup(s1.fileno()), os.dup(s1.fileno())
     s1.close()
     debug2('executing: %r\n' % argv)
     p = ssubprocess.Popen(argv, stdin=s1a, stdout=s1b, preexec_fn=setup,

src/sshuttle

@@ -1,5 +1,10 @@
 #!/bin/sh
-DIR=$(dirname "$0")
+EXE=$0
+for i in 1 2 3 4 5 6 7 8 9 10; do
+	[ -L "$EXE" ] || break
+	EXE=$(readlink "$EXE")
+done
+DIR=$(dirname "$EXE")
 if python2 -V 2>/dev/null; then
 	exec python2 "$DIR/main.py" python2 "$@"
 else

src/sshuttle.md

@@ -47,7 +47,7 @@ entire subnet to the VPN.
     not from outside machines.  If you want to accept
     connections from other machines on your network (ie. to
     run sshuttle on a router) try enabling IP Forwarding in
-    your kernel, then using `--listen 0.0.0.0:0`. 
+    your kernel, then using `--listen 0.0.0.0:0`.
 
 -H, --auto-hosts
 :   scan for remote hostnames and update the local /etc/hosts
@@ -63,22 +63,26 @@ entire subnet to the VPN.
     all running copies.  Third, if you're only routing a
     few subnets over the VPN, you probably would prefer to
     keep using your local DNS server for everything else.
-    
+
 -N, --auto-nets
 :   in addition to the subnets provided on the command
     line, ask the server which subnets it thinks we should
     route, and route those automatically.  The suggestions
     are taken automatically from the server's routing
     table.
-    
+
+--dns
+:   capture local DNS requests and forward to the remote DNS
+    server.
+
 --python
-:   specify the name/path of the remote python interpreter. 
+:   specify the name/path of the remote python interpreter.
     The default is just `python`, which means to use the
     default python interpreter on the remote system's PATH.
 
 -r, --remote=*[username@]sshserver[:port]*
 :   the remote hostname and optional username and ssh
-    port number to use for connecting to the remote server. 
+    port number to use for connecting to the remote server.
     For example, example.com, testuser@example.com,
     testuser@example.com:2222, or example.com:2244.
 
@@ -90,11 +94,15 @@ entire subnet to the VPN.
     `0/0 -x 1.2.3.0/24` to forward everything except the
     local subnet over the VPN, for example.
 
+-X, --exclude-from=*file*
+:   exclude the subnets specified in a file, one subnet per
+    line. Useful when you have lots of subnets to exclude.
+
 -v, --verbose
 :   print more information about the session.  This option
     can be used more than once for increased verbosity.  By
     default, sshuttle prints only error messages.
-    
+
 -e, --ssh-cmd
 :   the command to use to connect to the remote server. The
     default is just `ssh`.  Use this if your ssh client is
@@ -103,12 +111,12 @@ entire subnet to the VPN.
 
 --seed-hosts
 :   a comma-separated list of hostnames to use to
-    initialize the `--auto-hosts` scan algorithm. 
+    initialize the `--auto-hosts` scan algorithm.
     `--auto-hosts` does things like poll local SMB servers
     for lists of local hostnames, but can speed things up
     if you use this option to give it a few names to start
     from.
-    
+
 --no-latency-control
 :   sacrifice latency to improve bandwidth benchmarks. ssh
     uses really big socket buffers, which can overload the
@@ -124,16 +132,16 @@ entire subnet to the VPN.
     trying to control).  This option disables the latency
     control feature, maximizing bandwidth usage.  Use at
     your own risk.
-    
+
 -D, --daemon
 :   automatically fork into the background after connecting
     to the remote server.  Implies `--syslog`.
-    
+
 --syslog
 :   after connecting, send all log messages to the
     `syslog`(3) service instead of stderr.  This is
     implicit if you use `--daemon`.
-    
+
 --pidfile=*pidfilename*
 :   when using `--daemon`, save sshuttle's pid to
     *pidfilename*.  The default is `sshuttle.pid` in the
@@ -151,7 +159,7 @@ entire subnet to the VPN.
     automatically run `sudo` or `su` to start the firewall
     manager, but the core of sshuttle still runs as a
     normal user.
-    
+
 --hostwatch
 :   (internal use only) run the hostwatch daemon.  This
     process runs on the server side and collects hostnames for
@@ -168,7 +176,7 @@ Test locally by proxying all local connections, without using ssh:
 
     Starting sshuttle proxy.
     Listening on ('0.0.0.0', 12300).
-    [local sudo] Password: 
+    [local sudo] Password:
     firewall manager ready.
     c : connecting to server...
      s: available routes:
@@ -222,7 +230,7 @@ there.  Thus, you don't need to install sshuttle on the
 remote server, and there are never sshuttle version
 conflicts between client and server.
 
-Unlike most VPNs, sshuttle forwards sessions, not packets. 
+Unlike most VPNs, sshuttle forwards sessions, not packets.
 That is, it uses kernel transparent proxying (`iptables
 REDIRECT` rules on Linux, or `ipfw fwd` rules on BSD) to
 capture outgoing TCP sessions, then creates entirely
@@ -263,8 +271,14 @@ just switch your wireless off and on. Sshuttle makes the
 kernel setting it changes permanent, so this won't happen
 again, even after a reboot.
 
+On MacOS, sshuttle will set the kernel boot flag
+net.inet.ip.scopedroute to 0, which interferes with OS X
+Internet Sharing and some VPN clients. To reset this flag,
+you can remove any reference to net.inet.ip.scopedroute from
+/Library/Preferences/SystemConfiguration/com.apple.Boot.plist
+and reboot.
+
 
 # SEE ALSO
 
 `ssh`(1), `python`(1)
-

src/ssnet.py

@@ -1,9 +1,13 @@
-import struct, socket, errno, select
+import struct
+import socket
+import errno
+import select
+import os
 if not globals().get('skip_imports'):
-    from helpers import *
+    from helpers import log, debug1, debug2, debug3, Fatal
 
 MAX_CHANNEL = 65535
-    
+
 # these don't exist in the socket module in python 2.3!
 SHUT_RD = 0
 SHUT_WR = 1
@@ -16,31 +20,41 @@ HDR_LEN = 8
 CMD_EXIT = 0x4200
 CMD_PING = 0x4201
 CMD_PONG = 0x4202
-CMD_CONNECT = 0x4203
-CMD_STOP_SENDING = 0x4204
-CMD_EOF = 0x4205
-CMD_DATA = 0x4206
+CMD_TCP_CONNECT = 0x4203
+CMD_TCP_STOP_SENDING = 0x4204
+CMD_TCP_EOF = 0x4205
+CMD_TCP_DATA = 0x4206
 CMD_ROUTES = 0x4207
 CMD_HOST_REQ = 0x4208
 CMD_HOST_LIST = 0x4209
 CMD_DNS_REQ = 0x420a
 CMD_DNS_RESPONSE = 0x420b
+CMD_UDP_OPEN = 0x420c
+CMD_UDP_DATA = 0x420d
+CMD_UDP_CLOSE = 0x420e
 
 cmd_to_name = {
     CMD_EXIT: 'EXIT',
     CMD_PING: 'PING',
     CMD_PONG: 'PONG',
-    CMD_CONNECT: 'CONNECT',
-    CMD_STOP_SENDING: 'STOP_SENDING',
-    CMD_EOF: 'EOF',
-    CMD_DATA: 'DATA',
+    CMD_TCP_CONNECT: 'TCP_CONNECT',
+    CMD_TCP_STOP_SENDING: 'TCP_STOP_SENDING',
+    CMD_TCP_EOF: 'TCP_EOF',
+    CMD_TCP_DATA: 'TCP_DATA',
     CMD_ROUTES: 'ROUTES',
     CMD_HOST_REQ: 'HOST_REQ',
     CMD_HOST_LIST: 'HOST_LIST',
     CMD_DNS_REQ: 'DNS_REQ',
     CMD_DNS_RESPONSE: 'DNS_RESPONSE',
+    CMD_UDP_OPEN: 'UDP_OPEN',
+    CMD_UDP_DATA: 'UDP_DATA',
+    CMD_UDP_CLOSE: 'UDP_CLOSE',
 }
-    
+
+
+NET_ERRS = [errno.ECONNREFUSED, errno.ETIMEDOUT,
+            errno.EHOSTUNREACH, errno.ENETUNREACH,
+            errno.EHOSTDOWN, errno.ENETDOWN]
 
 
 def _add(l, elem):
@@ -82,7 +96,10 @@ def _try_peername(sock):
 
 
 _swcount = 0
+
+
 class SockWrapper:
+
     def __init__(self, rsock, wsock, connect_to=None, peername=None):
         global _swcount
         _swcount += 1
@@ -142,12 +159,21 @@ class SockWrapper:
                 debug3('%r: fixed connect result: %s\n' % (self, e))
             if e.args[0] in [errno.EINPROGRESS, errno.EALREADY]:
                 pass  # not connected yet
+            elif e.args[0] == 0:
+                # connected successfully (weird Linux bug?)
+                # Sometimes Linux seems to return EINVAL when it isn't
+                # invalid.  This *may* be caused by a race condition
+                # between connect() and getsockopt(SO_ERROR) (ie. it
+                # finishes connecting in between the two, so there is no
+                # longer an error).  However, I'm not sure of that.
+                #
+                # I did get at least one report that the problem went away
+                # when we added this, however.
+                self.connect_to = None
             elif e.args[0] == errno.EISCONN:
                 # connected successfully (BSD)
                 self.connect_to = None
-            elif e.args[0] in [errno.ECONNREFUSED, errno.ETIMEDOUT,
-                               errno.EHOSTUNREACH, errno.ENETUNREACH,
-                               errno.EACCES, errno.EPERM]:
+            elif e.args[0] in NET_ERRS + [errno.EACCES, errno.EPERM]:
                 # a "normal" kind of error
                 self.connect_to = None
                 self.seterr(e)
@@ -158,8 +184,8 @@ class SockWrapper:
         if not self.shut_read:
             debug2('%r: done reading\n' % self)
             self.shut_read = True
-            #self.rsock.shutdown(SHUT_RD)  # doesn't do anything anyway
-        
+            # self.rsock.shutdown(SHUT_RD)  # doesn't do anything anyway
+
     def nowrite(self):
         if not self.shut_write:
             debug2('%r: done writing\n' % self)
@@ -187,7 +213,7 @@ class SockWrapper:
                 # unexpected error... stream is dead
                 self.seterr('uwrite: %s' % e)
                 return 0
-        
+
     def write(self, buf):
         assert(buf)
         return self.uwrite(buf)
@@ -202,7 +228,7 @@ class SockWrapper:
             return _nb_clean(os.read, self.rsock.fileno(), 65536)
         except OSError, e:
             self.seterr('uread: %s' % e)
-            return '' # unexpected error... we'll call it EOF
+            return ''  # unexpected error... we'll call it EOF
 
     def fill(self):
         if self.buf:
@@ -224,7 +250,8 @@ class SockWrapper:
 
 
 class Handler:
-    def __init__(self, socks = None, callback = None):
+
+    def __init__(self, socks=None, callback=None):
         self.ok = True
         self.socks = socks or []
         if callback:
@@ -236,7 +263,7 @@ class Handler:
 
     def callback(self):
         log('--no callback defined-- %r\n' % self)
-        (r,w,x) = select.select(self.socks, [], [], 0)
+        (r, w, x) = select.select(self.socks, [], [], 0)
         for s in r:
             v = s.recv(4096)
             if not v:
@@ -246,6 +273,7 @@ class Handler:
 
 
 class Proxy(Handler):
+
     def __init__(self, wrap1, wrap2):
         Handler.__init__(self, [wrap1.rsock, wrap1.wsock,
                                 wrap2.rsock, wrap2.wsock])
@@ -253,9 +281,11 @@ class Proxy(Handler):
         self.wrap2 = wrap2
 
     def pre_select(self, r, w, x):
-        if self.wrap1.shut_write: self.wrap2.noread()
-        if self.wrap2.shut_write: self.wrap1.noread()
-        
+        if self.wrap1.shut_write:
+            self.wrap2.noread()
+        if self.wrap2.shut_write:
+            self.wrap1.noread()
+
         if self.wrap1.connect_to:
             _add(w, self.wrap1.rsock)
         elif self.wrap1.buf:
@@ -286,18 +316,20 @@ class Proxy(Handler):
             self.wrap2.buf = []
             self.wrap2.noread()
         if (self.wrap1.shut_read and self.wrap2.shut_read and
-            not self.wrap1.buf and not self.wrap2.buf):
+                not self.wrap1.buf and not self.wrap2.buf):
             self.ok = False
             self.wrap1.nowrite()
             self.wrap2.nowrite()
 
 
 class Mux(Handler):
+
     def __init__(self, rsock, wsock):
         Handler.__init__(self, [rsock, wsock])
         self.rsock = rsock
         self.wsock = wsock
         self.new_channel = self.got_dns_req = self.got_routes = None
+        self.got_udp_open = self.got_udp_data = self.got_udp_close = None
         self.got_host_req = self.got_host_list = None
         self.channels = {}
         self.chani = 0
@@ -322,31 +354,31 @@ class Mux(Handler):
         for b in self.outbuf:
             total += len(b)
         return total
-            
+
     def check_fullness(self):
         if self.fullness > 32768:
             if not self.too_full:
                 self.send(0, CMD_PING, 'rttest')
             self.too_full = True
         #ob = []
-        #for b in self.outbuf:
+        # for b in self.outbuf:
         #    (s1,s2,c) = struct.unpack('!ccH', b[:4])
         #    ob.append(c)
         #log('outbuf: %d %r\n' % (self.amount_queued(), ob))
-        
+
     def send(self, channel, cmd, data):
         data = str(data)
         assert(len(data) <= 65535)
         p = struct.pack('!ccHHH', 'S', 'S', channel, cmd, len(data)) + data
         self.outbuf.append(p)
         debug2(' > channel=%d cmd=%s len=%d (fullness=%d)\n'
-               % (channel, cmd_to_name.get(cmd,hex(cmd)),
+               % (channel, cmd_to_name.get(cmd, hex(cmd)),
                   len(data), self.fullness))
         self.fullness += len(data)
 
     def got_packet(self, channel, cmd, data):
-        debug2('<  channel=%d cmd=%s len=%d\n' 
-               % (channel, cmd_to_name.get(cmd,hex(cmd)), len(data)))
+        debug2('<  channel=%d cmd=%s len=%d\n'
+               % (channel, cmd_to_name.get(cmd, hex(cmd)), len(data)))
         if cmd == CMD_PING:
             self.send(0, CMD_PONG, data)
         elif cmd == CMD_PONG:
@@ -355,7 +387,7 @@ class Mux(Handler):
             self.fullness = 0
         elif cmd == CMD_EXIT:
             self.ok = False
-        elif cmd == CMD_CONNECT:
+        elif cmd == CMD_TCP_CONNECT:
             assert(not self.channels.get(channel))
             if self.new_channel:
                 self.new_channel(channel, data)
@@ -363,6 +395,10 @@ class Mux(Handler):
             assert(not self.channels.get(channel))
             if self.got_dns_req:
                 self.got_dns_req(channel, data)
+        elif cmd == CMD_UDP_OPEN:
+            assert(not self.channels.get(channel))
+            if self.got_udp_open:
+                self.got_udp_open(channel, data)
         elif cmd == CMD_ROUTES:
             if self.got_routes:
                 self.got_routes(data)
@@ -381,8 +417,8 @@ class Mux(Handler):
         else:
             callback = self.channels.get(channel)
             if not callback:
-                log('warning: closed channel %d got cmd=%s len=%d\n' 
-                       % (channel, cmd_to_name.get(cmd,hex(cmd)), len(data)))
+                log('warning: closed channel %d got cmd=%s len=%d\n'
+                    % (channel, cmd_to_name.get(cmd, hex(cmd)), len(data)))
             else:
                 callback(cmd, data)
 
@@ -403,18 +439,18 @@ class Mux(Handler):
         except OSError, e:
             raise Fatal('other end: %r' % e)
         #log('<<< %r\n' % b)
-        if b == '': # EOF
+        if b == '':  # EOF
             self.ok = False
         if b:
             self.inbuf += b
 
     def handle(self):
         self.fill()
-        #log('inbuf is: (%d,%d) %r\n'
+        # log('inbuf is: (%d,%d) %r\n'
         #     % (self.want, len(self.inbuf), self.inbuf))
         while 1:
             if len(self.inbuf) >= (self.want or HDR_LEN):
-                (s1,s2,channel,cmd,datalen) = \
+                (s1, s2, channel, cmd, datalen) = \
                     struct.unpack('!ccHHH', self.inbuf[:HDR_LEN])
                 assert(s1 == 'S')
                 assert(s2 == 'S')
@@ -433,7 +469,7 @@ class Mux(Handler):
             _add(w, self.wsock)
 
     def callback(self):
-        (r,w,x) = select.select([self.rsock], [self.wsock], [], 0)
+        (r, w, x) = select.select([self.rsock], [self.wsock], [], 0)
         if self.rsock in r:
             self.handle()
         if self.outbuf and self.wsock in w:
@@ -441,6 +477,7 @@ class Mux(Handler):
 
 
 class MuxWrapper(SockWrapper):
+
     def __init__(self, mux, channel):
         SockWrapper.__init__(self, mux.rsock, mux.wsock)
         self.mux = mux
@@ -454,18 +491,18 @@ class MuxWrapper(SockWrapper):
         SockWrapper.__del__(self)
 
     def __repr__(self):
-        return 'SW%r:Mux#%d' % (self.peername,self.channel)
+        return 'SW%r:Mux#%d' % (self.peername, self.channel)
 
     def noread(self):
         if not self.shut_read:
             self.shut_read = True
-            self.mux.send(self.channel, CMD_STOP_SENDING, '')
+            self.mux.send(self.channel, CMD_TCP_STOP_SENDING, '')
             self.maybe_close()
 
     def nowrite(self):
         if not self.shut_write:
             self.shut_write = True
-            self.mux.send(self.channel, CMD_EOF, '')
+            self.mux.send(self.channel, CMD_TCP_EOF, '')
             self.maybe_close()
 
     def maybe_close(self):
@@ -482,34 +519,34 @@ class MuxWrapper(SockWrapper):
             return 0  # too much already enqueued
         if len(buf) > 2048:
             buf = buf[:2048]
-        self.mux.send(self.channel, CMD_DATA, buf)
+        self.mux.send(self.channel, CMD_TCP_DATA, buf)
         return len(buf)
 
     def uread(self):
         if self.shut_read:
-            return '' # EOF
+            return ''  # EOF
         else:
             return None  # no data available right now
 
     def got_packet(self, cmd, data):
-        if cmd == CMD_EOF:
+        if cmd == CMD_TCP_EOF:
             self.noread()
-        elif cmd == CMD_STOP_SENDING:
+        elif cmd == CMD_TCP_STOP_SENDING:
             self.nowrite()
-        elif cmd == CMD_DATA:
+        elif cmd == CMD_TCP_DATA:
             self.buf.append(data)
         else:
-            raise Exception('unknown command %d (%d bytes)' 
+            raise Exception('unknown command %d (%d bytes)'
                             % (cmd, len(data)))
 
 
-def connect_dst(ip, port):
+def connect_dst(family, ip, port):
     debug2('Connecting to %s:%d\n' % (ip, port))
-    outsock = socket.socket()
+    outsock = socket.socket(family)
     outsock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
     return SockWrapper(outsock, outsock,
-                       connect_to = (ip,port),
-                       peername = '%s:%d' % (ip,port))
+                       connect_to=(ip, port),
+                       peername = '%s:%d' % (ip, port))
 
 
 def runonce(handlers, mux):
@@ -521,14 +558,14 @@ def runonce(handlers, mux):
         handlers.remove(h)
 
     for s in handlers:
-        s.pre_select(r,w,x)
-    debug2('Waiting: %d r=%r w=%r x=%r (fullness=%d/%d)\n' 
-            % (len(handlers), _fds(r), _fds(w), _fds(x),
+        s.pre_select(r, w, x)
+    debug2('Waiting: %d r=%r w=%r x=%r (fullness=%d/%d)\n'
+           % (len(handlers), _fds(r), _fds(w), _fds(x),
                mux.fullness, mux.too_full))
-    (r,w,x) = select.select(r,w,x)
-    debug2('  Ready: %d r=%r w=%r x=%r\n' 
-        % (len(handlers), _fds(r), _fds(w), _fds(x)))
-    ready = r+w+x
+    (r, w, x) = select.select(r, w, x)
+    debug2('  Ready: %d r=%r w=%r x=%r\n'
+           % (len(handlers), _fds(r), _fds(w), _fds(x)))
+    ready = r + w + x
     did = {}
     for h in handlers:
         for s in h.socks:

src/ssyslog.py

@@ -1,8 +1,11 @@
-import sys, os
+import sys
+import os
 from compat import ssubprocess
 
 
 _p = None
+
+
 def start_syslog():
     global _p
     _p = ssubprocess.Popen(['logger',

src/stresstest.py

@@ -1,5 +1,8 @@
 #!/usr/bin/env python
-import sys, os, socket, select, struct, time
+import socket
+import select
+import struct
+import time
 
 listener = socket.socket()
 listener.bind(('127.0.0.1', 0))
@@ -23,7 +26,7 @@ while 1:
         if count >= 16384:
             count = 1
         print 'cli CREATING %d' % count
-        b = struct.pack('I', count) + 'x'*count
+        b = struct.pack('I', count) + 'x' * count
         remain[c] = count
         print 'cli  >> %r' % len(b)
         c.send(b)
@@ -32,13 +35,13 @@ while 1:
         r = [listener]
         time.sleep(0.1)
     else:
-        r = [listener]+servers+clients
+        r = [listener] + servers + clients
     print 'select(%d)' % len(r)
-    r,w,x = select.select(r, [], [], 5)
+    r, w, x = select.select(r, [], [], 5)
     assert(r)
     for i in r:
         if i == listener:
-            s,addr = listener.accept()
+            s, addr = listener.accept()
             servers.append(s)
         elif i in servers:
             b = i.recv(4096)
@@ -47,7 +50,7 @@ while 1:
                 assert(len(b) >= 4)
                 want = struct.unpack('I', b[:4])[0]
                 b = b[4:]
-                #i.send('y'*want)
+                # i.send('y'*want)
             else:
                 want = remain[i]
             if want < len(b):
@@ -64,7 +67,7 @@ while 1:
                 del remain[i]
             else:
                 print 'srv  >> %r' % len(b)
-                i.send('y'*len(b))
+                i.send('y' * len(b))
                 if not want:
                     i.shutdown(socket.SHUT_WR)
         elif i in clients:

src/ui-macos/askpass.py

@@ -1,4 +1,6 @@
-import sys, os, re, subprocess
+import re
+import subprocess
+
 
 def askpass(prompt):
     prompt = prompt.replace('"', "'")
@@ -6,7 +8,7 @@ def askpass(prompt):
     if 'yes/no' in prompt:
         return "yes"
 
-    script="""
+    script = """
         tell application "Finder"
             activate
             display dialog "%s" \

src/ui-macos/bits/runpython.c

@@ -6,7 +6,7 @@
  * NSApplicationMain() looks for Info.plist using the path in argv[0], which
  * goes wrong if your interpreter is /usr/bin/python.
  */
-#include <Python.h>
+#include <Python/Python.h>
 #include <string.h>
 #include <unistd.h>
 

src/ui-macos/bits/runpython.do

@@ -0,0 +1,20 @@
+exec >&2
+redo-ifchange runpython.c
+ARCHES=""
+printf "Platforms: "
+if [ -d /usr/libexec/gcc/darwin ]; then
+    for d in /usr/libexec/gcc/darwin/*; do
+        PLAT=$(basename "$d")
+        [ "$PLAT" != "ppc64" ] || continue  # fails for some reason on my Mac
+        ARCHES="$ARCHES -arch $PLAT"
+        printf "$PLAT "
+    done
+fi
+printf "\n"
+PYTHON_LDFLAGS=$(python-config --ldflags)
+PYTHON_INCLUDES=$(python-config --includes)
+gcc $ARCHES \
+    -Wall -o $3 runpython.c \
+    $PYTHON_INCLUDES \
+    $PYTHON_LDFLAGS \
+    -framework Python

src/ui-macos/default.app.do

@@ -3,9 +3,9 @@ redo-ifchange sources.list
 redo-ifchange Info.plist bits/runpython \
 	$(while read name newname; do echo "$name"; done <sources.list)
 
-rm -rf "$1.app"
-mkdir "$1.app" "$1.app/Contents"
-cd "$1.app/Contents"
+rm -rf "$2.app"
+mkdir "$2.app" "$2.app/Contents"
+cd "$2.app/Contents"
 
 cp "$TOP/Info.plist" .
 
@@ -18,11 +18,11 @@ cd "$TOP"
 while read name newname; do
 	[ -z "$name" ] && continue
 	: "${newname:=$name}"
-	outname=$1.app/Contents/Resources/$newname
+	outname=$2.app/Contents/Resources/$newname
 	outdir=$(dirname "$outname")
 	[ -d "$outdir" ] || mkdir "$outdir"
 	cp "${name-$newname}" "$outname"
 done <sources.list
 
-cd "$1.app"
+cd "$2.app"
 redo-ifchange $(find . -type f)

src/ui-macos/default.app.tar.gz.do

@@ -0,0 +1,5 @@
+exec >&2
+IFS="
+"
+redo-ifchange $2.app
+tar -czf $3 $2.app/

src/ui-macos/default.app.zip.do

@@ -0,0 +1,5 @@
+exec >&2
+IFS="
+"
+redo-ifchange $2.app
+zip -q -r $3 $2.app/

src/ui-macos/default.nib.do

@@ -0,0 +1,2 @@
+redo-ifchange $2.xib
+ibtool --compile $3 $2.xib

src/ui-macos/main.py

@@ -1,6 +1,11 @@
-import sys, os, pty
+import sys
+import os
+import pty
 from AppKit import *
-import my, models, askpass
+import my
+import models
+import askpass
+
 
 def sshuttle_args(host, auto_nets, auto_hosts, dns, nets, debug,
                   no_latency_control):
@@ -21,21 +26,25 @@ def sshuttle_args(host, auto_nets, auto_hosts, dns, nets, debug,
 
 
 class _Callback(NSObject):
+
     def initWithFunc_(self, func):
         self = super(_Callback, self).init()
         self.func = func
         return self
+
     def func_(self, obj):
         return self.func(obj)
 
 
 class Callback:
+
     def __init__(self, func):
         self.obj = _Callback.alloc().initWithFunc_(func)
         self.sel = self.obj.func_
 
 
 class Runner:
+
     def __init__(self, argv, logfunc, promptfunc, serverobj):
         print 'in __init__'
         self.id = argv
@@ -49,7 +58,7 @@ class Runner:
         self.logfunc('\nConnecting to %s.\n' % self.serverobj.host())
         print 'will run: %r' % argv
         self.serverobj.setConnected_(False)
-        pid,fd = pty.fork()
+        pid, fd = pty.fork()
         if pid == 0:
             # child
             try:
@@ -62,19 +71,20 @@ class Runner:
         # parent
         self.pid = pid
         self.file = NSFileHandle.alloc()\
-               .initWithFileDescriptor_closeOnDealloc_(fd, True)
+            .initWithFileDescriptor_closeOnDealloc_(fd, True)
         self.cb = Callback(self.gotdata)
         NSNotificationCenter.defaultCenter()\
-            .addObserver_selector_name_object_(self.cb.obj, self.cb.sel,
-                        NSFileHandleDataAvailableNotification, self.file)
+            .addObserver_selector_name_object_(
+                self.cb.obj, self.cb.sel,
+                NSFileHandleDataAvailableNotification, self.file)
         self.file.waitForDataInBackgroundAndNotify()
 
     def __del__(self):
         self.wait()
 
     def _try_wait(self, options):
-        if self.rv == None and self.pid > 0:
-            pid,code = os.waitpid(self.pid, options)
+        if self.rv is None and self.pid > 0:
+            pid, code = os.waitpid(self.pid, options)
             if pid == self.pid:
                 if os.WIFEXITED(code):
                     self.rv = os.WEXITSTATUS(code)
@@ -87,15 +97,18 @@ class Runner:
         return self.rv
 
     def wait(self):
-        return self._try_wait(0)
-        
+        rv = None
+        while rv is None:
+            self.gotdata(None)
+            rv = self._try_wait(os.WNOHANG)
+
     def poll(self):
         return self._try_wait(os.WNOHANG)
 
     def kill(self):
         assert(self.pid > 0)
         print 'killing: pid=%r rv=%r' % (self.pid, self.rv)
-        if self.rv == None:
+        if self.rv is None:
             self.logfunc('Disconnecting from %s.\n' % self.serverobj.host())
             os.kill(self.pid, 15)
             self.wait()
@@ -118,12 +131,13 @@ class Runner:
                 self.file.writeData_(my.Data(resp + '\n'))
             self.file.waitForDataInBackgroundAndNotify()
         self.poll()
-        #print 'gotdata done!'
+        # print 'gotdata done!'
 
 
 class SshuttleApp(NSObject):
+
     def initialize(self):
-        d = my.PList('UserDefaults') 
+        d = my.PList('UserDefaults')
         my.Defaults().registerDefaults_(d)
 
 
@@ -137,7 +151,7 @@ class SshuttleController(NSObject):
     serversController = objc.IBOutlet()
     logField = objc.IBOutlet()
     latencyControlField = objc.IBOutlet()
-    
+
     servers = []
     conns = {}
 
@@ -145,12 +159,14 @@ class SshuttleController(NSObject):
         host = server.host()
         print 'connecting %r' % host
         self.fill_menu()
+
         def logfunc(msg):
             print 'log! (%d bytes)' % len(msg)
             self.logField.textStorage()\
-                .appendAttributedString_(NSAttributedString.alloc()\
+                .appendAttributedString_(NSAttributedString.alloc()
                                          .initWithString_(msg))
             self.logField.didChangeText()
+
         def promptfunc(prompt):
             print 'prompt! %r' % prompt
             return askpass.askpass(prompt)
@@ -164,12 +180,12 @@ class SshuttleController(NSObject):
             manual_nets = []
         noLatencyControl = (server.latencyControl() != models.LAT_INTERACTIVE)
         conn = Runner(sshuttle_args(host,
-                                    auto_nets = nets_mode == models.NET_AUTO,
-                                    auto_hosts = server.autoHosts(),
-                                    dns = server.useDns(),
-                                    nets = manual_nets,
-                                    debug = self.debugField.state(),
-                                    no_latency_control = noLatencyControl),
+                                    auto_nets=nets_mode == models.NET_AUTO,
+                                    auto_hosts=server.autoHosts(),
+                                    dns=server.useDns(),
+                                    nets=manual_nets,
+                                    debug=self.debugField.state(),
+                                    no_latency_control=noLatencyControl),
                       logfunc=logfunc, promptfunc=promptfunc,
                       serverobj=server)
         self.conns[host] = conn
@@ -182,8 +198,8 @@ class SshuttleController(NSObject):
             conn.kill()
         self.fill_menu()
         self.logField.textStorage().setAttributedString_(
-                        NSAttributedString.alloc().initWithString_(''))
-    
+            NSAttributedString.alloc().initWithString_(''))
+
     @objc.IBAction
     def cmd_connect(self, sender):
         server = sender.representedObject()
@@ -213,6 +229,7 @@ class SshuttleController(NSObject):
             it.setRepresentedObject_(obj)
             it.setTarget_(self)
             it.setAction_(func)
+
         def addnote(name):
             additem(name, None, None)
 
@@ -271,8 +288,9 @@ class SshuttleController(NSObject):
         sl = []
         for s in l:
             host = s.get('host', None)
-            if not host: continue
-            
+            if not host:
+                continue
+
             nets = s.get('nets', [])
             nl = []
             for n in nets:
@@ -282,7 +300,7 @@ class SshuttleController(NSObject):
                 net.setSubnet_(subnet)
                 net.setWidth_(width)
                 nl.append(net)
-            
+
             autoNets = s.get('autoNets', models.NET_AUTO)
             autoHosts = s.get('autoHosts', True)
             useDns = s.get('useDns', autoNets == models.NET_ALL)
@@ -302,11 +320,13 @@ class SshuttleController(NSObject):
         l = []
         for s in self.servers:
             host = s.host()
-            if not host: continue
+            if not host:
+                continue
             nets = []
             for n in s.nets():
                 subnet = n.subnet()
-                if not subnet: continue
+                if not subnet:
+                    continue
                 nets.append((subnet, n.width()))
             d = dict(host=s.host(),
                      nets=nets,
@@ -352,9 +372,9 @@ class SshuttleController(NSObject):
         statusitem.setHighlightMode_(True)
         statusitem.setMenu_(self.menu)
         self.fill_menu()
-        
+
         models.configchange_callback = my.DelayedCallback(self.save_servers)
-        
+
         def sc(server):
             if server.wantConnect():
                 self._connect(server)

src/ui-macos/models.py

@@ -3,6 +3,7 @@ import my
 
 
 configchange_callback = setconnect_callback = None
+objc_validator = objc.signature('@@:N^@o^@')
 
 
 def config_changed():
@@ -34,24 +35,29 @@ def _validate_width(v):
 
 
 class SshuttleNet(NSObject):
+
     def subnet(self):
         return getattr(self, '_k_subnet', None)
+
     def setSubnet_(self, v):
         self._k_subnet = v
         config_changed()
-    @objc.accessor
+
+    @objc_validator
     def validateSubnet_error_(self, value, error):
-        #print 'validateSubnet!'
+        # print 'validateSubnet!'
         return True, _validate_ip(value), error
 
     def width(self):
         return getattr(self, '_k_width', 24)
+
     def setWidth_(self, v):
         self._k_width = v
         config_changed()
-    @objc.accessor
+
+    @objc_validator
     def validateWidth_error_(self, value, error):
-        #print 'validateWidth!'
+        # print 'validateWidth!'
         return True, _validate_width(value), error
 
 NET_ALL = 0
@@ -61,30 +67,37 @@ NET_MANUAL = 2
 LAT_BANDWIDTH = 0
 LAT_INTERACTIVE = 1
 
+
 class SshuttleServer(NSObject):
+
     def init(self):
         self = super(SshuttleServer, self).init()
         config_changed()
         return self
-    
+
     def wantConnect(self):
         return getattr(self, '_k_wantconnect', False)
+
     def setWantConnect_(self, v):
         self._k_wantconnect = v
         self.setError_(None)
         config_changed()
-        if setconnect_callback: setconnect_callback(self)
+        if setconnect_callback:
+            setconnect_callback(self)
 
     def connected(self):
         return getattr(self, '_k_connected', False)
+
     def setConnected_(self, v):
         print 'setConnected of %r to %r' % (self, v)
         self._k_connected = v
-        if v: self.setError_(None)  # connected ok, so no error
+        if v:
+            self.setError_(None)  # connected ok, so no error
         config_changed()
 
     def error(self):
         return getattr(self, '_k_error', None)
+
     def setError_(self, v):
         self._k_error = v
         config_changed()
@@ -106,40 +119,47 @@ class SshuttleServer(NSObject):
             suffix = " (all traffic)"
         elif an == NET_MANUAL:
             n = self.nets()
-            suffix = ' (%d subnet%s)' % (len(n), len(n)!=1 and 's' or '')
+            suffix = ' (%d subnet%s)' % (len(n), len(n) != 1 and 's' or '')
         return self.host() + suffix
+
     def setTitle_(self, v):
         # title is always auto-generated
         config_changed()
-    
+
     def host(self):
         return getattr(self, '_k_host', None)
+
     def setHost_(self, v):
         self._k_host = v
         self.setTitle_(None)
         config_changed()
-    @objc.accessor
+
+    @objc_validator
     def validateHost_error_(self, value, error):
-        #print 'validatehost! %r %r %r' % (self, value, error)
+        # print 'validatehost! %r %r %r' % (self, value, error)
         while value.startswith('-'):
             value = value[1:]
         return True, value, error
 
     def nets(self):
         return getattr(self, '_k_nets', [])
+
     def setNets_(self, v):
         self._k_nets = v
         self.setTitle_(None)
         config_changed()
+
     def netsHidden(self):
-        #print 'checking netsHidden'
+        # print 'checking netsHidden'
         return self.autoNets() != NET_MANUAL
+
     def setNetsHidden_(self, v):
         config_changed()
-        #print 'setting netsHidden to %r' % v
-        
+        # print 'setting netsHidden to %r' % v
+
     def autoNets(self):
         return getattr(self, '_k_autoNets', NET_AUTO)
+
     def setAutoNets_(self, v):
         self._k_autoNets = v
         self.setNetsHidden_(-1)
@@ -149,18 +169,21 @@ class SshuttleServer(NSObject):
 
     def autoHosts(self):
         return getattr(self, '_k_autoHosts', True)
+
     def setAutoHosts_(self, v):
         self._k_autoHosts = v
         config_changed()
 
     def useDns(self):
         return getattr(self, '_k_useDns', False)
+
     def setUseDns_(self, v):
         self._k_useDns = v
         config_changed()
 
     def latencyControl(self):
         return getattr(self, '_k_latencyControl', LAT_INTERACTIVE)
+
     def setLatencyControl_(self, v):
         self._k_latencyControl = v
         config_changed()

src/ui-macos/my.py

@@ -1,4 +1,4 @@
-import sys, os
+import os
 from AppKit import *
 import PyObjCTools.AppHelper
 
@@ -44,11 +44,13 @@ def Defaults():
 #
 def DelayedCallback(func, *args, **kwargs):
     flag = [0]
+
     def _go():
         if flag[0]:
             print 'running %r (flag=%r)' % (func, flag)
             flag[0] = 0
             func(*args, **kwargs)
+
     def call():
         flag[0] += 1
         PyObjCTools.AppHelper.callAfter(_go)

ui-macos/bits/runpython.do

@@ -1,5 +0,0 @@
-exec >&2
-redo-ifchange runpython.c
-gcc -Wall -o $3 runpython.c \
-	-I/usr/include/python2.5 \
-	-lpython2.5

ui-macos/default.app.tar.gz.do

@@ -1,5 +0,0 @@
-exec >&2
-IFS="
-"
-redo-ifchange $1.app
-tar -czf $3 $1.app/

ui-macos/default.app.zip.do

@@ -1,5 +0,0 @@
-exec >&2
-IFS="
-"
-redo-ifchange $1.app
-zip -q -r $3 $1.app/

ui-macos/default.nib.do

@@ -1,2 +0,0 @@
-redo-ifchange $1.xib
-ibtool --compile $3 $1.xib