README: remove the note about MacOS not working. It works now!

If your machine is a firewall/router, it affects whether people behind the
router can use your sshuttle connection - in the same way that it affects
whether they can route *anything* through you.  And thus, it should be set
by the admin, not by sshuttle.

sshuttle works fine for the local user either way.

(This also affects MacOS since it's a BSD variant.)

README.md

@@ -1,14 +1,10 @@
 sshuttle: where transparent proxy meets VPN meets ssh
 =====================================================
 
-I just spent an afternoon working on a new kind of VPN.  You can get
-the first release, <a href="http://github.com/apenwarr/sshuttle">sshuttle
-0.10, on github</a>.
-
 As far as I know, sshuttle is the only program that solves the following
 common case:
 
- - Your client machine (or router) is Linux.
+ - Your client machine (or router) is Linux, FreeBSD, or MacOS.
 
  - You have access to a remote network via ssh.
 
@@ -53,10 +49,8 @@ This is how you use it:
 -----------------------
 
  - <tt>git clone git://github.com/apenwarr/sshuttle</tt>
-    on your client and server machines. The server can be
-    any ssh server with python available; the client must
-    be Linux with iptables, and you'll need root or sudo
-    access.
+    on your client machine. You'll need root or sudo
+    access, and python needs to be installed.
 
  - <tt>./sshuttle -r username@sshserver 0.0.0.0/0 -vv</tt>
 
@@ -161,3 +155,6 @@ later.  You're welcome.
 --
 Avery Pennarun <apenwarr@gmail.com>
 
+Mailing list:
+   Subscribe by sending a message to <sshuttle+subscribe@googlegroups.com>
+   List archives are at: http://groups.google.com/group/sshuttle

client.py

@@ -20,10 +20,11 @@ def original_dst(sock):
 
 
 class FirewallClient:
-    def __init__(self, port, subnets):
+    def __init__(self, port, subnets_include, subnets_exclude):
         self.port = port
         self.auto_nets = []
-        self.subnets = subnets
+        self.subnets_include = subnets_include
+        self.subnets_exclude = subnets_exclude
         argvbase = ([sys.argv[0]] +
                     ['-v'] * (helpers.verbose or 0) +
                     ['--firewall', str(port)])
@@ -67,8 +68,10 @@ class FirewallClient:
 
     def start(self):
         self.pfile.write('ROUTES\n')
-        for (ip,width) in self.subnets+self.auto_nets:
-            self.pfile.write('%s,%d\n' % (ip, width))
+        for (ip,width) in self.subnets_include+self.auto_nets:
+            self.pfile.write('%d,0,%s\n' % (width, ip))
+        for (ip,width) in self.subnets_exclude:
+            self.pfile.write('%d,1,%s\n' % (width, ip))
         self.pfile.write('GO\n')
         self.pfile.flush()
         line = self.pfile.readline()
@@ -89,14 +92,15 @@ class FirewallClient:
             raise Fatal('cleanup: %r returned %d' % (self.argv, rv))
 
 
-def _main(listener, fw, use_server, remotename, seed_hosts, auto_nets):
+def _main(listener, fw, use_server, remotename, python, seed_hosts, auto_nets):
     handlers = []
     if use_server:
         if helpers.verbose >= 1:
             helpers.logprefix = 'c : '
         else:
             helpers.logprefix = 'client: '
-        (serverproc, serversock) = ssh.connect(remotename)
+        debug1('connecting to server...\n')
+        (serverproc, serversock) = ssh.connect(remotename, python)
         mux = Mux(serversock, serversock)
         handlers.append(mux)
 
@@ -110,6 +114,7 @@ def _main(listener, fw, use_server, remotename, seed_hosts, auto_nets):
         if initstring != expected:
             raise Fatal('expected server init string %r; got %r'
                             % (expected, initstring))
+        debug1('connected.\n')
 
     def onroutes(routestr):
         if auto_nets:
@@ -183,7 +188,8 @@ def _main(listener, fw, use_server, remotename, seed_hosts, auto_nets):
             mux.check_fullness()
 
 
-def main(listenip, use_server, remotename, seed_hosts, auto_nets, subnets):
+def main(listenip, use_server, remotename, python, seed_hosts, auto_nets,
+         subnets_include, subnets_exclude):
     debug1('Starting sshuttle proxy.\n')
     listener = socket.socket()
     listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
@@ -210,10 +216,10 @@ def main(listenip, use_server, remotename, seed_hosts, auto_nets, subnets):
     listenip = listener.getsockname()
     debug1('Listening on %r.\n' % (listenip,))
 
-    fw = FirewallClient(listenip[1], subnets)
+    fw = FirewallClient(listenip[1], subnets_include, subnets_exclude)
     
     try:
         return _main(listener, fw, use_server, remotename,
-                     seed_hosts, auto_nets)
+                     python, seed_hosts, auto_nets)
     finally:
         fw.done()

firewall.py

@@ -43,27 +43,41 @@ def do_iptables(port, subnets):
         ipt('-I', 'OUTPUT', '1', '-j', chain)
         ipt('-I', 'PREROUTING', '1', '-j', chain)
 
-        # create new subnet entries
-        for snet,swidth in subnets:
-            ipt('-A', chain, '-j', 'REDIRECT',
-                '--dest', '%s/%s' % (snet,swidth),
-                '-p', 'tcp',
-                '--to-ports', str(port),
-                '-m', 'ttl', '!', '--ttl', '42'  # to prevent infinite loops
-                )
+        # create new subnet entries.  Note that we're sorting in a very
+        # particular order: we need to go from most-specific (largest swidth)
+        # to least-specific, and at any given level of specificity, we want
+        # excludes to come first.  That's why the columns are in such a non-
+        # intuitive order.
+        for swidth,sexclude,snet in sorted(subnets, reverse=True):
+            if sexclude:
+                ipt('-A', chain, '-j', 'RETURN',
+                    '--dest', '%s/%s' % (snet,swidth),
+                    '-p', 'tcp')
+            else:
+                ipt('-A', chain, '-j', 'REDIRECT',
+                    '--dest', '%s/%s' % (snet,swidth),
+                    '-p', 'tcp',
+                    '--to-ports', str(port),
+                    '-m', 'ttl', '!', '--ttl', '42'  # to prevent infinite loops
+                    )
 
 
 def ipfw_rule_exists(n):
     argv = ['ipfw', 'list']
     p = subprocess.Popen(argv, stdout = subprocess.PIPE)
+    found = False
     for line in p.stdout:
         if line.startswith('%05d ' % n):
-            if line.find('ipttl 42') < 0 and line.find('established') < 0:
+            if not ('ipttl 42 setup keep-state' in line
+                    or ('skipto %d' % (n+1)) in line
+                    or 'check-state' in line):
+                log('non-sshuttle ipfw rule: %r\n' % line.strip())
                 raise Fatal('non-sshuttle ipfw rule #%d already exists!' % n)
-            return True
+            found = True
     rv = p.wait()
     if rv:
         raise Fatal('%r returned %d' % (argv, rv))
+    return found
 
 
 def sysctl_get(name):
@@ -103,6 +117,7 @@ def ipfw(*args):
 
 def do_ipfw(port, subnets):
     sport = str(port)
+    xsport = str(port+1)
 
     # cleanup any existing rules
     if ipfw_rule_exists(port):
@@ -114,17 +129,22 @@ def do_ipfw(port, subnets):
 
     if subnets:
         sysctl_set('net.inet.ip.fw.enable', 1)
-        sysctl_set('net.inet.ip.forwarding', 1)
+        sysctl_set('net.inet.ip.scopedroute', 0)
 
-        ipfw('add', sport, 'accept', 'ip',
-             'from', 'any', 'to', 'any', 'established')
+        ipfw('add', sport, 'check-state', 'ip',
+             'from', 'any', 'to', 'any')
         
         # create new subnet entries
-        for snet,swidth in subnets:
-            ipfw('add', sport, 'fwd', '127.0.0.1,%d' % port,
-                 'log', 'tcp',
-                 'from', 'any', 'to', '%s/%s' % (snet,swidth),
-                 'not', 'ipttl', '42')
+        for swidth,sexclude,snet in sorted(subnets, reverse=True):
+            if sexclude:
+                ipfw('add', sport, 'skipto', xsport,
+                     'log', 'tcp',
+                     'from', 'any', 'to', '%s/%s' % (snet,swidth))
+            else:
+                ipfw('add', sport, 'fwd', '127.0.0.1,%d' % port,
+                     'log', 'tcp',
+                     'from', 'any', 'to', '%s/%s' % (snet,swidth),
+                     'not', 'ipttl', '42', 'keep-state', 'setup')
 
 
 def program_exists(name):
@@ -228,10 +248,11 @@ def main(port):
         elif line == 'GO\n':
             break
         try:
-            (ip,width) = line.strip().split(',', 1)
+            (width,exclude,ip) = line.strip().split(',', 2)
         except:
             raise Fatal('firewall: expected route or GO but got %r' % line)
-        subnets.append((ip, int(width)))
+        subnets.append((int(width), bool(int(exclude)), ip))
+        
     try:
         if line:
             debug1('firewall manager: starting transproxy.\n')
@@ -258,7 +279,6 @@ def main(port):
                 raise Fatal('expected EOF, got %r' % line)
             else:
                 break
-
     finally:
         try:
             debug1('firewall manager: undoing changes.\n')

helpers.py

@@ -4,9 +4,14 @@ logprefix = ''
 verbose = 0
 
 def log(s):
-    sys.stdout.flush()
-    sys.stderr.write(logprefix + s)
-    sys.stderr.flush()
+    try:
+        sys.stdout.flush()
+        sys.stderr.write(logprefix + s)
+        sys.stderr.flush()
+    except IOError:
+        # this could happen if stderr gets forcibly disconnected, eg. because
+        # our tty closes.  That sucks, but it's no reason to abort the program.
+        pass
 
 def debug1(s):
     if verbose >= 1:

hostwatch.py

@@ -1,4 +1,4 @@
-import subprocess, time, socket, re, select
+import subprocess, time, socket, re, select, errno
 if not globals().get('skip_imports'):
     import helpers
     from helpers import *

main.py

@@ -49,16 +49,18 @@ sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
 sshuttle --firewall <port> <subnets...>
 sshuttle --server
 --
-l,listen=  transproxy to this ip address and port number [default=0]
+l,listen=  transproxy to this ip address and port number [0.0.0.0:0]
 H,auto-hosts scan for remote hostnames and update local /etc/hosts
 N,auto-nets  automatically determine subnets to route
+python= specify the name/path of the python interpreter on the remote server [python]
 r,remote=  ssh hostname (and optional username) of remote sshuttle server
+x,exclude= exclude this subnet (can be used more than once)
 v,verbose  increase debug message verbosity
 seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
 noserver   don't use a separate server process (mostly for debugging)
-server     [internal use only]
-firewall   [internal use only]
-hostwatch  [internal use only]
+server     (internal use only)
+firewall   (internal use only)
+hostwatch  (internal use only)
 """
 o = options.Options('sshuttle', optspec)
 (opt, flags, extra) = o.parse(sys.argv[1:])
@@ -79,6 +81,11 @@ try:
     else:
         if len(extra) < 1 and not opt.auto_nets:
             o.fatal('at least one subnet (or -N) expected')
+        includes = extra
+        excludes = ['127.0.0.0/8']
+        for k,v in flags:
+            if k in ('-x','--exclude'):
+                excludes.append(v)
         remotename = opt.remote
         if remotename == '' or remotename == '-':
             remotename = None
@@ -93,9 +100,11 @@ try:
         sys.exit(client.main(parse_ipport(opt.listen or '0.0.0.0:0'),
                              not opt.noserver,
                              remotename,
+                             (opt.python or "python"),
                              sh,
                              opt.auto_nets,
-                             parse_subnets(extra)))
+                             parse_subnets(includes),
+                             parse_subnets(excludes)))
 except Fatal, e:
     log('fatal: %s\n' % e)
     sys.exit(99)

options.py

@@ -1,28 +1,92 @@
-import sys, textwrap, getopt, re
+"""Command-line options parser.
+With the help of an options spec string, easily parse command-line options.
+"""
+import sys, os, textwrap, getopt, re, struct
 
 class OptDict:
     def __init__(self):
         self._opts = {}
 
     def __setitem__(self, k, v):
+        if k.startswith('no-') or k.startswith('no_'):
+            k = k[3:]
+            v = not v
         self._opts[k] = v
 
     def __getitem__(self, k):
+        if k.startswith('no-') or k.startswith('no_'):
+            return not self._opts[k[3:]]
         return self._opts[k]
 
     def __getattr__(self, k):
         return self[k]
 
 
+def _default_onabort(msg):
+    sys.exit(97)
+
+
+def _intify(v):
+    try:
+        vv = int(v or '')
+        if str(vv) == v:
+            return vv
+    except ValueError:
+        pass
+    return v
+
+
+def _atoi(v):
+    try:
+        return int(v or 0)
+    except ValueError:
+        return 0
+
+
+def _remove_negative_kv(k, v):
+    if k.startswith('no-') or k.startswith('no_'):
+        return k[3:], not v
+    return k,v
+
+def _remove_negative_k(k):
+    return _remove_negative_kv(k, None)[0]
+
+
+def _tty_width():
+    s = struct.pack("HHHH", 0, 0, 0, 0)
+    try:
+        import fcntl, termios
+        s = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, s)
+    except (IOError, ImportError):
+        return _atoi(os.environ.get('WIDTH')) or 70
+    (ysize,xsize,ypix,xpix) = struct.unpack('HHHH', s)
+    return xsize
+
+
 class Options:
-    def __init__(self, exe, optspec, optfunc=getopt.gnu_getopt):
+    """Option parser.
+    When constructed, two strings are mandatory. The first one is the command
+    name showed before error messages. The second one is a string called an
+    optspec that specifies the synopsis and option flags and their description.
+    For more information about optspecs, consult the bup-options(1) man page.
+
+    Two optional arguments specify an alternative parsing function and an
+    alternative behaviour on abort (after having output the usage string).
+
+    By default, the parser function is getopt.gnu_getopt, and the abort
+    behaviour is to exit the program.
+    """
+    def __init__(self, exe, optspec, optfunc=getopt.gnu_getopt,
+                 onabort=_default_onabort):
         self.exe = exe
         self.optspec = optspec
+        self._onabort = onabort
         self.optfunc = optfunc
         self._aliases = {}
         self._shortopts = 'h?'
         self._longopts = ['help']
         self._hasparms = {}
+        self._defaults = {}
         self._usagestr = self._gen_usage()
 
     def _gen_usage(self):
@@ -36,10 +100,13 @@ class Options:
             out.append('%s: %s\n' % (first_syn and 'usage' or '   or', l))
             first_syn = False
         out.append('\n')
+        last_was_option = False
         while lines:
             l = lines.pop()
             if l.startswith(' '):
-                out.append('\n%s\n' % l.lstrip())
+                out.append('%s%s\n' % (last_was_option and '\n' or '',
+                                       l.lstrip()))
+                last_was_option = False
             elif l:
                 (flags, extra) = l.split(' ', 1)
                 extra = extra.strip()
@@ -48,18 +115,24 @@ class Options:
                     has_parm = 1
                 else:
                     has_parm = 0
+                g = re.search(r'\[([^\]]*)\]$', extra)
+                if g:
+                    defval = g.group(1)
+                else:
+                    defval = None
                 flagl = flags.split(',')
                 flagl_nice = []
                 for f in flagl:
-                    f_nice = re.sub(r'\W', '_', f)
-                    self._aliases[f] = flagl[0]
-                    self._aliases[f_nice] = flagl[0]
+                    f,dvi = _remove_negative_kv(f, _intify(defval))
+                    self._aliases[f] = _remove_negative_k(flagl[0])
                     self._hasparms[f] = has_parm
+                    self._defaults[f] = dvi
                     if len(f) == 1:
                         self._shortopts += f + (has_parm and ':' or '')
                         flagl_nice.append('-' + f)
                     else:
-                        assert(not f.startswith('no-')) # supported implicitly
+                        f_nice = re.sub(r'\W', '_', f)
+                        self._aliases[f_nice] = _remove_negative_k(flagl[0])
                         self._longopts.append(f + (has_parm and '=' or ''))
                         self._longopts.append('no-' + f)
                         flagl_nice.append('--' + f)
@@ -67,52 +140,62 @@ class Options:
                 if has_parm:
                     flags_nice += ' ...'
                 prefix = '    %-20s  ' % flags_nice
-                argtext = '\n'.join(textwrap.wrap(extra, width=70,
+                argtext = '\n'.join(textwrap.wrap(extra, width=_tty_width(),
                                                 initial_indent=prefix,
                                                 subsequent_indent=' '*28))
                 out.append(argtext + '\n')
+                last_was_option = True
             else:
                 out.append('\n')
+                last_was_option = False
         return ''.join(out).rstrip() + '\n'
 
-    def usage(self):
+    def usage(self, msg=""):
+        """Print usage string to stderr and abort."""
         sys.stderr.write(self._usagestr)
-        sys.exit(97)
+        e = self._onabort and self._onabort(msg) or None
+        if e:
+            raise e
 
     def fatal(self, s):
-        sys.stderr.write('error: %s\n' % s)
-        return self.usage()
+        """Print an error message to stderr and abort with usage string."""
+        msg = 'error: %s\n' % s
+        sys.stderr.write(msg)
+        return self.usage(msg)
 
     def parse(self, args):
+        """Parse a list of arguments and return (options, flags, extra).
+
+        In the returned tuple, "options" is an OptDict with known options,
+        "flags" is a list of option flags that were used on the command-line,
+        and "extra" is a list of positional arguments.
+        """
         try:
             (flags,extra) = self.optfunc(args, self._shortopts, self._longopts)
         except getopt.GetoptError, e:
             self.fatal(e)
 
         opt = OptDict()
-        for f in self._aliases.values():
-            opt[f] = None
+
+        for k,v in self._defaults.iteritems():
+            k = self._aliases[k]
+            opt[k] = v
+
         for (k,v) in flags:
-            while k.startswith('-'):
-                k = k[1:]
-            if k in ['h', '?', 'help']:
+            k = k.lstrip('-')
+            if k in ('h', '?', 'help'):
                 self.usage()
             if k.startswith('no-'):
                 k = self._aliases[k[3:]]
-                opt[k] = None
+                v = 0
             else:
                 k = self._aliases[k]
                 if not self._hasparms[k]:
                     assert(v == '')
-                    opt[k] = (opt._opts.get(k) or 0) + 1
+                    v = (opt._opts.get(k) or 0) + 1
                 else:
-                    try:
-                        vv = int(v)
-                        if str(vv) == v:
-                            v = vv
-                    except ValueError:
-                        pass
-                    opt[k] = v
-        for (f1,f2) in self._aliases.items():
-            opt[f1] = opt[f2]
+                    v = _intify(v)
+            opt[k] = v
+        for (f1,f2) in self._aliases.iteritems():
+            opt[f1] = opt._opts.get(f2)
         return (opt,flags,extra)

server.py

@@ -57,7 +57,8 @@ def _list_routes():
         routes.append((socket.inet_ntoa(struct.pack('!I', ip)), width))
     rv = p.wait()
     if rv != 0:
-        raise Fatal('%r returned %d' % (argv, rv))
+        log('WARNING: %r returned %d\n' % (argv, rv))
+        log('WARNING: That prevents --auto-nets from working.\n')
     return routes
 
 
@@ -79,14 +80,15 @@ def start_hostwatch(seed_hosts):
         # child
         rv = 99
         try:
-            s2.close()
-            os.dup2(s1.fileno(), 1)
-            os.dup2(s1.fileno(), 0)
-            s1.close()
-            rv = hostwatch.hw_main(seed_hosts) or 0
-        except Exception, e:
-            log('%s\n' % _exc_dump())
-            rv = 98
+            try:
+                s2.close()
+                os.dup2(s1.fileno(), 1)
+                os.dup2(s1.fileno(), 0)
+                s1.close()
+                rv = hostwatch.hw_main(seed_hosts) or 0
+            except Exception, e:
+                log('%s\n' % _exc_dump())
+                rv = 98
         finally:
             os._exit(rv)
     s1.close()

ssh.py

@@ -5,8 +5,12 @@ from helpers import *
 
 def readfile(name):
     basedir = os.path.dirname(os.path.abspath(sys.argv[0]))
-    fullname = os.path.join(basedir, name)
-    return open(fullname, 'rb').read()
+    path = [basedir] + sys.path
+    for d in path:
+        fullname = os.path.join(d, name)
+        if os.path.exists(fullname):
+            return open(fullname, 'rb').read()
+    raise Exception("can't find file %r in any of %r" % (name, path))
 
 
 def empackage(z, filename):
@@ -15,7 +19,7 @@ def empackage(z, filename):
     return '%s\n%d\n%s' % (filename,len(content), content)
 
 
-def connect(rhostport):
+def connect(rhostport, python):
     main_exe = sys.argv[0]
     l = (rhostport or '').split(':', 1)
     rhost = l[0]
@@ -44,9 +48,9 @@ def connect(rhostport):
 
         
     if not rhost:
-        argv = ['python', '-c', pyscript]
+        argv = [python, '-c', pyscript]
     else:
-        argv = ['ssh'] + portl + [rhost, '--', "python -c '%s'" % pyscript]
+        argv = ['ssh'] + portl + [rhost, '--', "'%s' -c '%s'" % (python, pyscript)]
     (s1,s2) = socket.socketpair()
     def setup():
         # runs in the child process

ssnet.py

@@ -35,7 +35,7 @@ def _nb_clean(func, *args):
     try:
         return func(*args)
     except OSError, e:
-        if e.errno not in (errno.EWOULDBLOCK, errno.EAGAIN):
+        if e.errno not in (errno.EWOULDBLOCK, errno.EAGAIN, errno.EPIPE):
             raise
         else:
             return None
@@ -308,7 +308,7 @@ class Mux(Handler):
         self.wsock.setblocking(False)
         if self.outbuf and self.outbuf[0]:
             wrote = _nb_clean(os.write, self.wsock.fileno(), self.outbuf[0])
-            debug2('mux wrote: %d/%d\n' % (wrote, len(self.outbuf[0])))
+            debug2('mux wrote: %r/%d\n' % (wrote, len(self.outbuf[0])))
             if wrote:
                 self.outbuf[0] = self.outbuf[0][wrote:]
         while self.outbuf and not self.outbuf[0]: