Release version 0.76

Closes #60.

.gitignore

@@ -1,3 +1,4 @@
+sshuttle/version.py
 *.pyc
 *~
 *.8

CHANGES.rst

@@ -0,0 +1,22 @@
+Release 0.76 (Jan 17, 2016)
+===========================
+
+* Add option to disable IPv6 support.
+* Update documentation.
+* Move documentation, including man page, to Sphinx.
+* Use setuptools-scm for automatic versioning.
+
+
+Release 0.75 (Jan 12, 2016)
+===========================
+
+* Revert change that broke sshuttle entry point.
+
+
+Release 0.74 (Jan 10, 2016)
+===========================
+
+* Add CHANGES.rst file.
+* Numerous bug fixes.
+* Python 3.5 fixes.
+* PF fixes, especially for BSD.

MANIFEST.in

@@ -2,4 +2,11 @@ include *.txt
 include *.rst
 include *.py
 include MANIFEST.in
+include LICENSE
+include run
+include tox.ini
+recursive-include docs *.bat
+recursive-include docs *.py
+recursive-include docs *.rst
+recursive-include docs Makefile
 recursive-include sshuttle *.py

README.rst

@@ -26,81 +26,6 @@ common case:
   TCP-over-TCP, which has terrible performance (see below).
 
 
-Client side Requirements
-------------------------
-
-- sudo, or logged in as root on your client machine.
-  (The server doesn't need admin access.)
-- Python 2.7 or Python 3.5.
-
-+-------+--------+------------+-----------------------------------------------+
-| OS    | Method | Features   | Requirements                                  |
-+=======+========+============+===============================================+
-| Linux | NAT    | * IPv4 TCP + iptables DNAT, REDIRECT, and ttl modules.     |
-+       +--------+------------+-----------------------------------------------+
-|       | TPROXY | * IPv4 TCP + Linux with TPROXY support.                    |
-|       |        | * IPv4 UDP + Python 3.5 preferred (see below).             |
-|       |        | * IPv6 TCP +                                               |
-|       |        | * IPv6 UDP +                                               |
-+-------+--------+------------+-----------------------------------------------+
-| BSD   | IPFW   | * IPv4 TCP | Your kernel needs to be compiled with         |
-|       |        |            | `IPFIREWALL_FORWARD` and you need to have ipfw|
-|       |        |            | available.                                    |
-+-------+--------+------------+-----------------------------------------------+
-| MacOS | PF     | * IPv4 TCP + You need to have the pfctl command.           |
-+-------+--------+------------+-----------------------------------------------+
-
-The IPFW method is depreciated. It was originally required for MacOS support,
-however is no longer maintained. It is likely to get removed from future
-versions of sshuttle.
-
-
-Server side Requirements
-------------------------
-Python 2.7 or Python 3.5. This should match what is used on the client side.
-
-
-Additional Suggested Software
------------------------------
-
-- You may want to use autossh, available in various package management
-  systems
-
-
-Additional information for TPROXY
----------------------------------
-TPROXY is the only method that supports full support of IPv6 and UDP.
-
-Full UDP or DNS support with the TPROXY method requires the `recvmsg()`
-syscall. This is not available in Python 2.7, however is in Python 3.5 and
-later.
-
-- For Python 2.7, you need PyXAPI, available here:
-  http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
-
-There are some things you need to consider for TPROXY to work:
-
-1. The following commands need to be run first as root. This only needs to be
-   done once after booting up::
-
-       ip route add local default dev lo table 100
-       ip rule add fwmark 1 lookup 100
-       ip -6 route add local default dev lo table 100
-       ip -6 rule add fwmark 1 lookup 100
-
-2. The client needs to be run as root. e.g.::
-
-       sudo SSH_AUTH_SOCK="$SSH_AUTH_SOCK" $HOME/tree/sshuttle.tproxy/sshuttle  --method=tproxy ...
-
-3. You do need the `--method=tproxy` parameter, as above.
-
-4. The routes for the outgoing packets must already exist. For example, if your
-   connection does not have IPv6 support, no IPv6 routes will exist, IPv6
-   packets will not be generated and sshuttle cannot intercept them. Add some
-   dummy routes to external interfaces. Make sure they get removed however
-   after sshuttle exits.
-
-
 Obtaining sshuttle
 ------------------
 
@@ -113,146 +38,10 @@ Obtaining sshuttle
       git clone https://github.com/sshuttle/sshuttle.git
       ./setup.py install
 
+Documentation
+-------------
+The documentation for the stable version is available at:
+http://sshuttle.readthedocs.org/
 
-Usage
------
-
-- Forward all traffic::
-
-      sshuttle -r username@sshserver 0.0.0.0/0 -vv
-
-- By default sshuttle will automatically choose a method to use. Override with
-  the `--method=` parameter.
-
-- There is a shortcut for 0.0.0.0/0 for those that value
-  their wrists::
-
-      sshuttle -r username@sshserver 0/0 -vv
-
-- If you would also like your DNS queries to be proxied
-  through the DNS server of the server you are connect to::
-
-      sshuttle --dns -vvr username@sshserver 0/0
-
-  The above is probably what you want to use to prevent
-  local network attacks such as Firesheep and friends.
-
-(You may be prompted for one or more passwords; first, the local password to
-become root using sudo, and then the remote ssh password.  Or you might have
-sudo and ssh set up to not require passwords, in which case you won't be
-prompted at all.)
-
-
-Usage Notes
------------
-
-That's it!  Now your local machine can access the remote network as if you
-were right there.  And if your "client" machine is a router, everyone on
-your local network can make connections to your remote network.
-
-You don't need to install sshuttle on the remote server;
-the remote server just needs to have python available. 
-sshuttle will automatically upload and run its source code
-to the remote python interpreter.
-
-This creates a transparent proxy server on your local machine for all IP
-addresses that match 0.0.0.0/0.  (You can use more specific IP addresses if
-you want; use any number of IP addresses or subnets to change which
-addresses get proxied.  Using 0.0.0.0/0 proxies *everything*, which is
-interesting if you don't trust the people on your local network.)
-
-Any TCP session you initiate to one of the proxied IP addresses will be
-captured by sshuttle and sent over an ssh session to the remote copy of
-sshuttle, which will then regenerate the connection on that end, and funnel
-the data back and forth through ssh.
-
-Fun, right?  A poor man's instant VPN, and you don't even have to have
-admin access on the server.
-
-
-Support
--------
-
-Mailing list:
-
-* Subscribe by sending a message to <sshuttle+subscribe@googlegroups.com>
-* List archives are at: http://groups.google.com/group/sshuttle
-
-Issue tracker and pull requests at github:
-
-* https://github.com/sshuttle/sshuttle
-
-
-Theory of Operation
--------------------
-
-sshuttle is not exactly a VPN, and not exactly port forwarding.  It's kind
-of both, and kind of neither.
-
-It's like a VPN, since it can forward every port on an entire network, not
-just ports you specify.  Conveniently, it lets you use the "real" IP
-addresses of each host rather than faking port numbers on localhost.
-
-On the other hand, the way it *works* is more like ssh port forwarding than
-a VPN.  Normally, a VPN forwards your data one packet at a time, and
-doesn't care about individual connections; ie. it's "stateless" with respect
-to the traffic.  sshuttle is the opposite of stateless; it tracks every
-single connection.
-
-You could compare sshuttle to something like the old `Slirp
-<http://en.wikipedia.org/wiki/Slirp>`_ program, which was a userspace TCP/IP
-implementation that did something similar.  But it operated on a
-packet-by-packet basis on the client side, reassembling the packets on the
-server side.  That worked okay back in the "real live serial port" days,
-because serial ports had predictable latency and buffering.
-
-But you can't safely just forward TCP packets over a TCP session (like ssh),
-because TCP's performance depends fundamentally on packet loss; it
-*must* experience packet loss in order to know when to slow down!  At
-the same time, the outer TCP session (ssh, in this case) is a reliable
-transport, which means that what you forward through the tunnel *never*
-experiences packet loss.  The ssh session itself experiences packet loss, of
-course, but TCP fixes it up and ssh (and thus you) never know the
-difference.  But neither does your inner TCP session, and extremely screwy
-performance ensues.
-
-sshuttle assembles the TCP stream locally, multiplexes it statefully over
-an ssh session, and disassembles it back into packets at the other end.  So
-it never ends up doing TCP-over-TCP.  It's just data-over-TCP, which is
-safe.
-
-
-Useless Trivia
---------------
-This section written by Avery Pennarun <apenwarr@gmail.com>.
-
-Back in 1998 (12 years ago!  Yikes!), I released the first version of `Tunnel
-Vision <http://alumnit.ca/wiki/?TunnelVisionReadMe>`_, a semi-intelligent VPN
-client for Linux.  Unfortunately, I made two big mistakes: I implemented the
-key exchange myself (oops), and I ended up doing TCP-over-TCP (double oops).
-The resulting program worked okay - and people used it for years - but the
-performance was always a bit funny.  And nobody ever found any security flaws
-in my key exchange, either, but that doesn't mean anything. :)
-
-The same year, dcoombs and I also released Fast Forward, a proxy server
-supporting transparent proxying.  Among other things, we used it for
-automatically splitting traffic across more than one Internet connection (a
-tool we called "Double Vision").
-
-I was still in university at the time.  A couple years after that, one of my
-professors was working with some graduate students on the technology that would
-eventually become `Slipstream Internet Acceleration
-<http://www.slipstream.com/>`_.  He asked me to do a contract for him to build
-an initial prototype of a transparent proxy server for mobile networks.  The
-idea was similar to sshuttle: if you reassemble and then disassemble the TCP
-packets, you can reduce latency and improve performance vs.  just forwarding
-the packets over a plain VPN or mobile network.  (It's unlikely that any of my
-code has persisted in the Slipstream product today, but the concept is still
-pretty cool.  I'm still horrified that people use plain TCP on complex mobile
-networks with crazily variable latency, for which it was never really
-intended.)
-
-That project I did for Slipstream was what first gave me the idea to merge
-the concepts of Fast Forward, Double Vision, and Tunnel Vision into a single
-program that was the best of all worlds.  And here we are, at last, 10 years
-later.  You're welcome.
+The documentation for the latest development version is available at:
+http://sshuttle.readthedocs.org/en/latest/

VERSION.txt

@@ -1 +1 @@
-0.73
+0.75

docs/Makefile

@@ -0,0 +1,177 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+PAPER         =
+BUILDDIR      = _build
+
+# User-friendly check for sphinx-build
+ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
+$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
+endif
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+# the i18n builder cannot share the environment and doctrees with the others
+I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html       to make standalone HTML files"
+	@echo "  dirhtml    to make HTML files named index.html in directories"
+	@echo "  singlehtml to make a single large HTML file"
+	@echo "  pickle     to make pickle files"
+	@echo "  json       to make JSON files"
+	@echo "  htmlhelp   to make HTML files and a HTML help project"
+	@echo "  qthelp     to make HTML files and a qthelp project"
+	@echo "  devhelp    to make HTML files and a Devhelp project"
+	@echo "  epub       to make an epub"
+	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
+	@echo "  latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
+	@echo "  text       to make text files"
+	@echo "  man        to make manual pages"
+	@echo "  texinfo    to make Texinfo files"
+	@echo "  info       to make Texinfo files and run them through makeinfo"
+	@echo "  gettext    to make PO message catalogs"
+	@echo "  changes    to make an overview of all changed/added/deprecated items"
+	@echo "  xml        to make Docutils-native XML files"
+	@echo "  pseudoxml  to make pseudoxml-XML files for display purposes"
+	@echo "  linkcheck  to check all external links for integrity"
+	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
+
+clean:
+	rm -rf $(BUILDDIR)/*
+
+html:
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+dirhtml:
+	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
+
+singlehtml:
+	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
+	@echo
+	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
+
+pickle:
+	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
+	@echo
+	@echo "Build finished; now you can process the pickle files."
+
+json:
+	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
+	@echo
+	@echo "Build finished; now you can process the JSON files."
+
+htmlhelp:
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in $(BUILDDIR)/htmlhelp."
+
+qthelp:
+	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
+	@echo
+	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
+	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
+	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/sshuttle.qhcp"
+	@echo "To view the help file:"
+	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/sshuttle.qhc"
+
+devhelp:
+	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
+	@echo
+	@echo "Build finished."
+	@echo "To view the help file:"
+	@echo "# mkdir -p $$HOME/.local/share/devhelp/sshuttle"
+	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/sshuttle"
+	@echo "# devhelp"
+
+epub:
+	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
+	@echo
+	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
+
+latex:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
+	@echo "Run \`make' in that directory to run these through (pdf)latex" \
+	      "(use \`make latexpdf' here to do that automatically)."
+
+latexpdf:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through pdflatex..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+latexpdfja:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through platex and dvipdfmx..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+text:
+	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
+	@echo
+	@echo "Build finished. The text files are in $(BUILDDIR)/text."
+
+man:
+	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
+	@echo
+	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
+
+texinfo:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo
+	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
+	@echo "Run \`make' in that directory to run these through makeinfo" \
+	      "(use \`make info' here to do that automatically)."
+
+info:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo "Running Texinfo files through makeinfo..."
+	make -C $(BUILDDIR)/texinfo info
+	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
+
+gettext:
+	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
+	@echo
+	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
+
+changes:
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
+	@echo
+	@echo "The overview file is in $(BUILDDIR)/changes."
+
+linkcheck:
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in $(BUILDDIR)/linkcheck/output.txt."
+
+doctest:
+	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
+	@echo "Testing of doctests in the sources finished, look at the " \
+	      "results in $(BUILDDIR)/doctest/output.txt."
+
+xml:
+	$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
+	@echo
+	@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
+
+pseudoxml:
+	$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
+	@echo
+	@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."

docs/changes.rst

@@ -0,0 +1,4 @@
+Changelog
+---------
+
+.. include:: ../CHANGES.rst

docs/conf.py

@@ -0,0 +1,260 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# sshuttle documentation build configuration file, created by
+# sphinx-quickstart on Sun Jan 17 12:13:47 2016.
+#
+# This file is execfile()d with the current directory set to its
+# containing dir.
+#
+# Note that not all possible configuration values are present in this
+# autogenerated file.
+#
+# All configuration values have a default; values that are commented out
+# serve to show the default.
+
+# import sys
+# import os
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+# sys.path.insert(0, os.path.abspath('.'))
+
+# -- General configuration ------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+# needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+    'sphinx.ext.todo',
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The encoding of source files.
+# source_encoding = 'utf-8-sig'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = 'sshuttle'
+copyright = '2016, Brian May'
+
+# The version info for the project you're documenting, acts as replacement for
+# |version| and |release|, also used in various other places throughout the
+# built documents.
+#
+# The short X.Y version.
+from setuptools_scm import get_version
+version = get_version(root="..")
+# The full version, including alpha/beta/rc tags.
+release = version
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+# language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+# today = ''
+# Else, today_fmt is used as the format for a strftime call.
+# today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+exclude_patterns = ['_build']
+
+# The reST default role (used for this markup: `text`) to use for all
+# documents.
+# default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+# add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+# add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+# show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# A list of ignored prefixes for module index sorting.
+# modindex_common_prefix = []
+
+# If true, keep warnings as "system message" paragraphs in the built documents.
+# keep_warnings = False
+
+
+# -- Options for HTML output ----------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+html_theme = 'default'
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+# html_theme_options = {}
+
+# Add any paths that contain custom themes here, relative to this directory.
+# html_theme_path = []
+
+# The name for this set of Sphinx documents.  If None, it defaults to
+# "<project> v<release> documentation".
+# html_title = None
+
+# A shorter title for the navigation bar.  Default is the same as html_title.
+# html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+# html_logo = None
+
+# The name of an image file (within the static path) to use as favicon of the
+# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+# html_favicon = None
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['_static']
+
+# Add any extra paths that contain custom files (such as robots.txt or
+# .htaccess) here, relative to this directory. These files are copied
+# directly to the root of the documentation.
+# html_extra_path = []
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+# html_last_updated_fmt = '%b %d, %Y'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+# html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+# html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+# html_additional_pages = {}
+
+# If false, no module index is generated.
+# html_domain_indices = True
+
+# If false, no index is generated.
+# html_use_index = True
+
+# If true, the index is split into individual pages for each letter.
+# html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+# html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+# html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+# html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it.  The value of this option must be the
+# base URL from which the finished HTML is served.
+# html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+# html_file_suffix = None
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'sshuttledoc'
+
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+    # The paper size ('letterpaper' or 'a4paper').
+    # 'papersize': 'letterpaper',
+
+    # The font size ('10pt', '11pt' or '12pt').
+    # 'pointsize': '10pt',
+
+    # Additional stuff for the LaTeX preamble.
+    # 'preamble': '',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+#  author, documentclass [howto, manual, or own class]).
+latex_documents = [
+    ('index', 'sshuttle.tex', 'sshuttle documentation', 'Brian May', 'manual'),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+# latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+# latex_use_parts = False
+
+# If true, show page references after internal links.
+# latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+# latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+# latex_appendices = []
+
+# If false, no module index is generated.
+# latex_domain_indices = True
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    ('manpage', 'sshuttle', 'sshuttle documentation', ['Brian May'], 1)
+]
+
+# If true, show URL addresses after external links.
+# man_show_urls = False
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+    ('index', 'sshuttle', 'sshuttle documentation',
+     'Brian May', 'sshuttle', 'A transparent proxy-based VPN using ssh',
+     'Miscellaneous'),
+]
+
+# Documents to append as an appendix to all manuals.
+# texinfo_appendices = []
+
+# If false, no module index is generated.
+# texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+# texinfo_show_urls = 'footnote'
+
+# If true, do not generate a @detailmenu in the "Top" node's menu.
+# texinfo_no_detailmenu = False

docs/how-it-works.rst

@@ -0,0 +1,37 @@
+How it works
+============
+sshuttle is not exactly a VPN, and not exactly port forwarding.  It's kind
+of both, and kind of neither.
+
+It's like a VPN, since it can forward every port on an entire network, not
+just ports you specify.  Conveniently, it lets you use the "real" IP
+addresses of each host rather than faking port numbers on localhost.
+
+On the other hand, the way it *works* is more like ssh port forwarding than
+a VPN.  Normally, a VPN forwards your data one packet at a time, and
+doesn't care about individual connections; ie. it's "stateless" with respect
+to the traffic.  sshuttle is the opposite of stateless; it tracks every
+single connection.
+
+You could compare sshuttle to something like the old `Slirp
+<http://en.wikipedia.org/wiki/Slirp>`_ program, which was a userspace TCP/IP
+implementation that did something similar.  But it operated on a
+packet-by-packet basis on the client side, reassembling the packets on the
+server side.  That worked okay back in the "real live serial port" days,
+because serial ports had predictable latency and buffering.
+
+But you can't safely just forward TCP packets over a TCP session (like ssh),
+because TCP's performance depends fundamentally on packet loss; it
+*must* experience packet loss in order to know when to slow down!  At
+the same time, the outer TCP session (ssh, in this case) is a reliable
+transport, which means that what you forward through the tunnel *never*
+experiences packet loss.  The ssh session itself experiences packet loss, of
+course, but TCP fixes it up and ssh (and thus you) never know the
+difference.  But neither does your inner TCP session, and extremely screwy
+performance ensues.
+
+sshuttle assembles the TCP stream locally, multiplexes it statefully over
+an ssh session, and disassembles it back into packets at the other end.  So
+it never ends up doing TCP-over-TCP.  It's just data-over-TCP, which is
+safe.
+

docs/index.rst

@@ -0,0 +1,25 @@
+sshuttle: where transparent proxy meets VPN meets ssh
+=====================================================
+
+Contents:
+
+.. toctree::
+   :maxdepth: 2
+
+   overview
+   requirements
+   installation
+   usage
+   Man Page <manpage>
+   how-it-works
+   support
+   trivia
+   changes
+
+
+Indices and tables
+==================
+
+* :ref:`genindex`
+* :ref:`search`
+

docs/installation.rst

@@ -0,0 +1,11 @@
+Installation
+============
+
+- From PyPI::
+
+      pip install sshuttle
+
+- Clone::
+
+      git clone https://github.com/sshuttle/sshuttle.git
+      ./setup.py install

docs/make.bat

@@ -0,0 +1,242 @@
+@ECHO OFF
+
+REM Command file for Sphinx documentation
+
+if "%SPHINXBUILD%" == "" (
+	set SPHINXBUILD=sphinx-build
+)
+set BUILDDIR=_build
+set ALLSPHINXOPTS=-d %BUILDDIR%/doctrees %SPHINXOPTS% .
+set I18NSPHINXOPTS=%SPHINXOPTS% .
+if NOT "%PAPER%" == "" (
+	set ALLSPHINXOPTS=-D latex_paper_size=%PAPER% %ALLSPHINXOPTS%
+	set I18NSPHINXOPTS=-D latex_paper_size=%PAPER% %I18NSPHINXOPTS%
+)
+
+if "%1" == "" goto help
+
+if "%1" == "help" (
+	:help
+	echo.Please use `make ^<target^>` where ^<target^> is one of
+	echo.  html       to make standalone HTML files
+	echo.  dirhtml    to make HTML files named index.html in directories
+	echo.  singlehtml to make a single large HTML file
+	echo.  pickle     to make pickle files
+	echo.  json       to make JSON files
+	echo.  htmlhelp   to make HTML files and a HTML help project
+	echo.  qthelp     to make HTML files and a qthelp project
+	echo.  devhelp    to make HTML files and a Devhelp project
+	echo.  epub       to make an epub
+	echo.  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter
+	echo.  text       to make text files
+	echo.  man        to make manual pages
+	echo.  texinfo    to make Texinfo files
+	echo.  gettext    to make PO message catalogs
+	echo.  changes    to make an overview over all changed/added/deprecated items
+	echo.  xml        to make Docutils-native XML files
+	echo.  pseudoxml  to make pseudoxml-XML files for display purposes
+	echo.  linkcheck  to check all external links for integrity
+	echo.  doctest    to run all doctests embedded in the documentation if enabled
+	goto end
+)
+
+if "%1" == "clean" (
+	for /d %%i in (%BUILDDIR%\*) do rmdir /q /s %%i
+	del /q /s %BUILDDIR%\*
+	goto end
+)
+
+
+%SPHINXBUILD% 2> nul
+if errorlevel 9009 (
+	echo.
+	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
+	echo.installed, then set the SPHINXBUILD environment variable to point
+	echo.to the full path of the 'sphinx-build' executable. Alternatively you
+	echo.may add the Sphinx directory to PATH.
+	echo.
+	echo.If you don't have Sphinx installed, grab it from
+	echo.http://sphinx-doc.org/
+	exit /b 1
+)
+
+if "%1" == "html" (
+	%SPHINXBUILD% -b html %ALLSPHINXOPTS% %BUILDDIR%/html
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The HTML pages are in %BUILDDIR%/html.
+	goto end
+)
+
+if "%1" == "dirhtml" (
+	%SPHINXBUILD% -b dirhtml %ALLSPHINXOPTS% %BUILDDIR%/dirhtml
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The HTML pages are in %BUILDDIR%/dirhtml.
+	goto end
+)
+
+if "%1" == "singlehtml" (
+	%SPHINXBUILD% -b singlehtml %ALLSPHINXOPTS% %BUILDDIR%/singlehtml
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The HTML pages are in %BUILDDIR%/singlehtml.
+	goto end
+)
+
+if "%1" == "pickle" (
+	%SPHINXBUILD% -b pickle %ALLSPHINXOPTS% %BUILDDIR%/pickle
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished; now you can process the pickle files.
+	goto end
+)
+
+if "%1" == "json" (
+	%SPHINXBUILD% -b json %ALLSPHINXOPTS% %BUILDDIR%/json
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished; now you can process the JSON files.
+	goto end
+)
+
+if "%1" == "htmlhelp" (
+	%SPHINXBUILD% -b htmlhelp %ALLSPHINXOPTS% %BUILDDIR%/htmlhelp
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished; now you can run HTML Help Workshop with the ^
+.hhp project file in %BUILDDIR%/htmlhelp.
+	goto end
+)
+
+if "%1" == "qthelp" (
+	%SPHINXBUILD% -b qthelp %ALLSPHINXOPTS% %BUILDDIR%/qthelp
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished; now you can run "qcollectiongenerator" with the ^
+.qhcp project file in %BUILDDIR%/qthelp, like this:
+	echo.^> qcollectiongenerator %BUILDDIR%\qthelp\sshuttle.qhcp
+	echo.To view the help file:
+	echo.^> assistant -collectionFile %BUILDDIR%\qthelp\sshuttle.ghc
+	goto end
+)
+
+if "%1" == "devhelp" (
+	%SPHINXBUILD% -b devhelp %ALLSPHINXOPTS% %BUILDDIR%/devhelp
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished.
+	goto end
+)
+
+if "%1" == "epub" (
+	%SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The epub file is in %BUILDDIR%/epub.
+	goto end
+)
+
+if "%1" == "latex" (
+	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished; the LaTeX files are in %BUILDDIR%/latex.
+	goto end
+)
+
+if "%1" == "latexpdf" (
+	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
+	cd %BUILDDIR%/latex
+	make all-pdf
+	cd %BUILDDIR%/..
+	echo.
+	echo.Build finished; the PDF files are in %BUILDDIR%/latex.
+	goto end
+)
+
+if "%1" == "latexpdfja" (
+	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
+	cd %BUILDDIR%/latex
+	make all-pdf-ja
+	cd %BUILDDIR%/..
+	echo.
+	echo.Build finished; the PDF files are in %BUILDDIR%/latex.
+	goto end
+)
+
+if "%1" == "text" (
+	%SPHINXBUILD% -b text %ALLSPHINXOPTS% %BUILDDIR%/text
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The text files are in %BUILDDIR%/text.
+	goto end
+)
+
+if "%1" == "man" (
+	%SPHINXBUILD% -b man %ALLSPHINXOPTS% %BUILDDIR%/man
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The manual pages are in %BUILDDIR%/man.
+	goto end
+)
+
+if "%1" == "texinfo" (
+	%SPHINXBUILD% -b texinfo %ALLSPHINXOPTS% %BUILDDIR%/texinfo
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The Texinfo files are in %BUILDDIR%/texinfo.
+	goto end
+)
+
+if "%1" == "gettext" (
+	%SPHINXBUILD% -b gettext %I18NSPHINXOPTS% %BUILDDIR%/locale
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The message catalogs are in %BUILDDIR%/locale.
+	goto end
+)
+
+if "%1" == "changes" (
+	%SPHINXBUILD% -b changes %ALLSPHINXOPTS% %BUILDDIR%/changes
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.The overview file is in %BUILDDIR%/changes.
+	goto end
+)
+
+if "%1" == "linkcheck" (
+	%SPHINXBUILD% -b linkcheck %ALLSPHINXOPTS% %BUILDDIR%/linkcheck
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Link check complete; look for any errors in the above output ^
+or in %BUILDDIR%/linkcheck/output.txt.
+	goto end
+)
+
+if "%1" == "doctest" (
+	%SPHINXBUILD% -b doctest %ALLSPHINXOPTS% %BUILDDIR%/doctest
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Testing of doctests in the sources finished, look at the ^
+results in %BUILDDIR%/doctest/output.txt.
+	goto end
+)
+
+if "%1" == "xml" (
+	%SPHINXBUILD% -b xml %ALLSPHINXOPTS% %BUILDDIR%/xml
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The XML files are in %BUILDDIR%/xml.
+	goto end
+)
+
+if "%1" == "pseudoxml" (
+	%SPHINXBUILD% -b pseudoxml %ALLSPHINXOPTS% %BUILDDIR%/pseudoxml
+	if errorlevel 1 exit /b 1
+	echo.
+	echo.Build finished. The pseudo-XML files are in %BUILDDIR%/pseudoxml.
+	goto end
+)
+
+:end

docs/manpage.rst

@@ -1,171 +1,194 @@
-% sshuttle(8) Sshuttle 0.46
-% Avery Pennarun <apenwarr@gmail.com>
-% 2011-01-25
-
-# NAME
-
-sshuttle - a transparent proxy-based VPN using ssh
-
-# SYNOPSIS
-
-sshuttle [options...] [-r [username@]sshserver[:port]] \<subnets...\>
+sshuttle
+========
 
 
-# DESCRIPTION
+Synopsis
+--------
+**sshuttle** [*options*] [**-r** *[username@]sshserver[:port]*] \<*subnets* ...\>
 
-sshuttle allows you to create a VPN connection from your
+
+Description
+-----------
+:program:`sshuttle` allows you to create a VPN connection from your
 machine to any remote server that you can connect to via
 ssh, as long as that server has python 2.3 or higher.
 
 To work, you must have root access on the local machine,
 but you can have a normal account on the server.
 
-It's valid to run sshuttle more than once simultaneously on
+It's valid to run :program:`sshuttle` more than once simultaneously on
 a single client machine, connecting to a different server
 every time, so you can be on more than one VPN at once.
 
-If run on a router, sshuttle can forward traffic for your
+If run on a router, :program:`sshuttle` can forward traffic for your
 entire subnet to the VPN.
 
 
-# OPTIONS
+Options
+-------
+.. program:: sshuttle
 
-\<subnets...\>
-:   a list of subnets to route over the VPN, in the form
-    `a.b.c.d[/width]`.  Valid examples are 1.2.3.4 (a
+.. option:: subnets
+
+    A list of subnets to route over the VPN, in the form
+    ``a.b.c.d[/width]``.  Valid examples are 1.2.3.4 (a
     single IP address), 1.2.3.4/32 (equivalent to 1.2.3.4),
     1.2.3.0/24 (a 24-bit subnet, ie. with a 255.255.255.0
     netmask), and 0/0 ('just route everything through the
     VPN').
 
--l, --listen=*[ip:]port*
-:   use this ip address and port number as the transparent
-    proxy port.  By default sshuttle finds an available
+.. option:: -l, --listen=[ip:]port
+
+    Use this ip address and port number as the transparent
+    proxy port.  By default :program:`sshuttle` finds an available
     port automatically and listens on IP 127.0.0.1
     (localhost), so you don't need to override it, and
     connections are only proxied from the local machine,
     not from outside machines.  If you want to accept
     connections from other machines on your network (ie. to
-    run sshuttle on a router) try enabling IP Forwarding in
-    your kernel, then using `--listen 0.0.0.0:0`.
+    run :program:`sshuttle` on a router) try enabling IP Forwarding in
+    your kernel, then using ``--listen 0.0.0.0:0``.
 
--H, --auto-hosts
-:   scan for remote hostnames and update the local /etc/hosts
+    For the tproxy method this can be an IPv6 address. Use this option twice if
+    required, to provide both IPv4 and IPv6 addresses.
+
+.. option:: -H, --auto-hosts
+
+    Scan for remote hostnames and update the local /etc/hosts
     file with matching entries for as long as the VPN is
     open.  This is nicer than changing your system's DNS
     (/etc/resolv.conf) settings, for several reasons.  First,
     hostnames are added without domain names attached, so
-    you can `ssh thatserver` without worrying if your local
-    domain matches the remote one.  Second, if you sshuttle
+    you can ``ssh thatserver`` without worrying if your local
+    domain matches the remote one.  Second, if you :program:`sshuttle`
     into more than one VPN at a time, it's impossible to
     use more than one DNS server at once anyway, but
-    sshuttle correctly merges /etc/hosts entries between
+    :program:`sshuttle` correctly merges /etc/hosts entries between
     all running copies.  Third, if you're only routing a
     few subnets over the VPN, you probably would prefer to
     keep using your local DNS server for everything else.
 
--N, --auto-nets
-:   in addition to the subnets provided on the command
+.. option:: -N, --auto-nets
+
+    In addition to the subnets provided on the command
     line, ask the server which subnets it thinks we should
     route, and route those automatically.  The suggestions
     are taken automatically from the server's routing
     table.
 
---dns
-:   capture local DNS requests and forward to the remote DNS
+.. option:: --dns
+
+    Capture local DNS requests and forward to the remote DNS
     server.
 
---python
-:   specify the name/path of the remote python interpreter.
-    The default is just `python`, which means to use the
+.. option:: --python
+
+    Specify the name/path of the remote python interpreter.
+    The default is just ``python``, which means to use the
     default python interpreter on the remote system's PATH.
 
--r, --remote=*[username@]sshserver[:port]*
-:   the remote hostname and optional username and ssh
+.. option:: -r, --remote=[username@]sshserver[:port]
+
+    The remote hostname and optional username and ssh
     port number to use for connecting to the remote server.
     For example, example.com, testuser@example.com,
     testuser@example.com:2222, or example.com:2244.
 
--x, --exclude=*subnet*
-:   explicitly exclude this subnet from forwarding.  The
-    format of this option is the same as the `<subnets>`
+.. option:: -x, --exclude=subnet
+
+    Explicitly exclude this subnet from forwarding.  The
+    format of this option is the same as the ``<subnets>``
     option.  To exclude more than one subnet, specify the
-    `-x` option more than once.  You can say something like
-    `0/0 -x 1.2.3.0/24` to forward everything except the
+    ``-x`` option more than once.  You can say something like
+    ``0/0 -x 1.2.3.0/24`` to forward everything except the
     local subnet over the VPN, for example.
 
--X, --exclude-from=*file*
-:   exclude the subnets specified in a file, one subnet per
+.. option:: -X, --exclude-from=file
+
+    Exclude the subnets specified in a file, one subnet per
     line. Useful when you have lots of subnets to exclude.
 
--v, --verbose
-:   print more information about the session.  This option
+.. option:: -v, --verbose
+
+    Print more information about the session.  This option
     can be used more than once for increased verbosity.  By
-    default, sshuttle prints only error messages.
+    default, :program:`sshuttle` prints only error messages.
 
--e, --ssh-cmd
-:   the command to use to connect to the remote server. The
-    default is just `ssh`.  Use this if your ssh client is
+.. option:: -e, --ssh-cmd
+
+    The command to use to connect to the remote server. The
+    default is just ``ssh``.  Use this if your ssh client is
     in a non-standard location or you want to provide extra
-    options to the ssh command, for example, `-e 'ssh -v'`.
+    options to the ssh command, for example, ``-e 'ssh -v'``.
 
---seed-hosts
-:   a comma-separated list of hostnames to use to
-    initialize the `--auto-hosts` scan algorithm.
-    `--auto-hosts` does things like poll local SMB servers
+.. option:: --seed-hosts
+
+    A comma-separated list of hostnames to use to
+    initialize the :option:`--auto-hosts` scan algorithm.
+    :option:`--auto-hosts` does things like poll local SMB servers
     for lists of local hostnames, but can speed things up
     if you use this option to give it a few names to start
     from.
 
---no-latency-control
-:   sacrifice latency to improve bandwidth benchmarks. ssh
+.. option:: --no-latency-control
+
+    Sacrifice latency to improve bandwidth benchmarks. ssh
     uses really big socket buffers, which can overload the
     connection if you start doing large file transfers,
     thus making all your other sessions inside the same
-    tunnel go slowly. Normally, sshuttle tries to avoid
+    tunnel go slowly. Normally, :program:`sshuttle` tries to avoid
     this problem using a "fullness check" that allows only
     a certain amount of outstanding data to be buffered at
     a time.  But on high-bandwidth links, this can leave a
     lot of your bandwidth underutilized.  It also makes
-    sshuttle seem slow in bandwidth benchmarks (benchmarks
-    rarely test ping latency, which is what sshuttle is
+    :program:`sshuttle` seem slow in bandwidth benchmarks (benchmarks
+    rarely test ping latency, which is what :program:`sshuttle` is
     trying to control).  This option disables the latency
     control feature, maximizing bandwidth usage.  Use at
     your own risk.
 
--D, --daemon
-:   automatically fork into the background after connecting
-    to the remote server.  Implies `--syslog`.
+.. option:: -D, --daemon
 
---syslog
-:   after connecting, send all log messages to the
-    `syslog`(3) service instead of stderr.  This is
-    implicit if you use `--daemon`.
+    Automatically fork into the background after connecting
+    to the remote server.  Implies :option:`--syslog`.
 
---pidfile=*pidfilename*
-:   when using `--daemon`, save sshuttle's pid to
-    *pidfilename*.  The default is `sshuttle.pid` in the
+.. option:: --syslog
+
+    after connecting, send all log messages to the
+    :manpage:`syslog(3)` service instead of stderr.  This is
+    implicit if you use :option:`--daemon`.
+
+.. option:: --pidfile=pidfilename
+
+    when using :option:`--daemon`, save :program:`sshuttle`'s pid to
+    *pidfilename*.  The default is ``sshuttle.pid`` in the
     current directory.
 
---firewall
-:   (internal use only) run the firewall manager.  This is
-    the only part of sshuttle that must run as root.  If
-    you start sshuttle as a non-root user, it will
-    automatically run `sudo` or `su` to start the firewall
-    manager, but the core of sshuttle still runs as a
+.. option:: --disable-ipv6
+
+    If using the tproxy method, this will disable IPv6 support.
+
+.. option:: --firewall
+
+    (internal use only) run the firewall manager.  This is
+    the only part of :program:`sshuttle` that must run as root.  If
+    you start :program:`sshuttle` as a non-root user, it will
+    automatically run ``sudo`` or ``su`` to start the firewall
+    manager, but the core of :program:`sshuttle` still runs as a
     normal user.
 
---hostwatch
-:   (internal use only) run the hostwatch daemon.  This
+.. option:: --hostwatch
+
+    (internal use only) run the hostwatch daemon.  This
     process runs on the server side and collects hostnames for
-    the `--auto-hosts` option.  Using this option by itself
-    makes it a lot easier to debug and test the `--auto-hosts`
+    the :option:`--auto-hosts` option.  Using this option by itself
+    makes it a lot easier to debug and test the :option:`--auto-hosts`
     feature.
 
 
-# EXAMPLES
-
-Test locally by proxying all local connections, without using ssh:
+Examples
+--------
+Test locally by proxying all local connections, without using ssh::
 
     $ sshuttle -v 0/0
 
@@ -189,7 +212,7 @@ Test locally by proxying all local connections, without using ssh:
     c : SW#6:192.168.42.106:50035: deleting
 
 Test connection to a remote server, with automatic hostname
-and subnet guessing:
+and subnet guessing::
 
     $ sshuttle -vNHr example.org
 
@@ -212,22 +235,22 @@ and subnet guessing:
     c : SW#6:192.168.42.121:60554: deleting
 
 
-# DISCUSSION
-
-When it starts, sshuttle creates an ssh session to the
-server specified by the `-r` option.  If `-r` is omitted,
+Discussion
+----------
+When it starts, :program:`sshuttle` creates an ssh session to the
+server specified by the ``-r`` option.  If ``-r`` is omitted,
 it will start both its client and server locally, which is
 sometimes useful for testing.
 
-After connecting to the remote server, sshuttle uploads its
+After connecting to the remote server, :program:`sshuttle` uploads its
 (python) source code to the remote end and executes it
-there.  Thus, you don't need to install sshuttle on the
-remote server, and there are never sshuttle version
+there.  Thus, you don't need to install :program:`sshuttle` on the
+remote server, and there are never :program:`sshuttle` version
 conflicts between client and server.
 
-Unlike most VPNs, sshuttle forwards sessions, not packets.
+Unlike most VPNs, :program:`sshuttle` forwards sessions, not packets.
 That is, it uses kernel transparent proxying (`iptables
-REDIRECT` rules on Linux, or `ipfw fwd` rules on BSD) to
+REDIRECT` rules on Linux) to
 capture outgoing TCP sessions, then creates entirely
 separate TCP sessions out to the original destination at
 the other end of the tunnel.
@@ -246,7 +269,7 @@ tcp-based encrypted streams like ssh or ssl, and have to
 implement their own encryption from scratch, which is very
 complex and error prone.
 
-sshuttle's simplicity comes from the fact that it can
+:program:`sshuttle`'s simplicity comes from the fact that it can
 safely use the existing ssh encrypted tunnel without
 incurring a performance penalty.  It does this by letting
 the client-side kernel manage the incoming tcp stream, and
@@ -256,24 +279,6 @@ between the two separate streams, so a tcp-based tunnel is
 fine.
 
 
-# BUGS
-
-On MacOS 10.6 (at least up to 10.6.6), your network will
-stop responding about 10 minutes after the first time you
-start sshuttle, because of a MacOS kernel bug relating to
-arp and the net.inet.ip.scopedroute sysctl.  To fix it,
-just switch your wireless off and on. Sshuttle makes the
-kernel setting it changes permanent, so this won't happen
-again, even after a reboot.
-
-On MacOS, sshuttle will set the kernel boot flag
-net.inet.ip.scopedroute to 0, which interferes with OS X
-Internet Sharing and some VPN clients. To reset this flag,
-you can remove any reference to net.inet.ip.scopedroute from
-/Library/Preferences/SystemConfiguration/com.apple.Boot.plist
-and reboot.
-
-
-# SEE ALSO
-
-`ssh`(1), `python`(1)
+See Also
+--------
+:manpage:`ssh(1)`, :manpage:`python(1)`

docs/overview.rst

@@ -0,0 +1,26 @@
+Overview
+========
+
+As far as I know, sshuttle is the only program that solves the following
+common case:
+
+- Your client machine (or router) is Linux, FreeBSD, or MacOS.
+
+- You have access to a remote network via ssh.
+
+- You don't necessarily have admin access on the remote network.
+
+- The remote network has no VPN, or only stupid/complex VPN
+  protocols (IPsec, PPTP, etc). Or maybe you *are* the
+  admin and you just got frustrated with the awful state of
+  VPN tools.
+
+- You don't want to create an ssh port forward for every
+  single host/port on the remote network.
+
+- You hate openssh's port forwarding because it's randomly
+  slow and/or stupid.
+
+- You can't use openssh's PermitTunnel feature because
+  it's disabled by default on openssh servers; plus it does
+  TCP-over-TCP, which has terrible performance (see below).

docs/requirements.rst

@@ -0,0 +1,64 @@
+Requirements
+============
+
+Client side Requirements
+------------------------
+
+- sudo, or root access on your client machine.
+  (The server doesn't need admin access.)
+- Python 2.7 or Python 3.5.
+
+
+Linux with NAT method
+~~~~~~~~~~~~~~~~~~~~~
+Supports:
+
+* IPv4 TCP
+* IPv4 DNS
+
+Requires:
+
+* iptables DNAT, REDIRECT, and ttl modules.
+
+
+Linux with TPROXY method
+~~~~~~~~~~~~~~~~~~~~~~~~
+Supports:
+
+* IPv4 TCP
+* IPv4 UDP (requires ``recmsg`` - see below)
+* IPv6 DNS (requires ``recmsg`` - see below)
+* IPv6 TCP
+* IPv6 UDP (requires ``recmsg`` - see below)
+* IPv6 DNS (requires ``recmsg`` - see below)
+
+.. _PyXAPI: http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
+
+Full UDP or DNS support with the TPROXY method requires the ``recvmsg()``
+syscall. This is not available in Python 2, however is in Python 3.5 and
+later. Under Python 2 you might find it sufficient installing PyXAPI_ to get
+the ``recvmsg()`` function.
+
+
+MacOS with PF method
+~~~~~~~~~~~~~~~~~~~~
+Supports:
+
+* IPv4 TCP
+* IPv4 DNS
+
+Requires:
+
+* You need to have the pfctl command.
+
+
+Server side Requirements
+------------------------
+Python 2.7 or Python 3.5.
+
+
+Additional Suggested Software
+-----------------------------
+
+- You may want to use autossh, available in various package management
+  systems

docs/support.rst

@@ -0,0 +1,11 @@
+Support
+=======
+
+Mailing list:
+
+* Subscribe by sending a message to <sshuttle+subscribe@googlegroups.com>
+* List archives are at: http://groups.google.com/group/sshuttle
+
+Issue tracker and pull requests at github:
+
+* https://github.com/sshuttle/sshuttle

docs/trivia.rst

@@ -0,0 +1,36 @@
+Useless Trivia
+==============
+This section written by the original author, Avery Pennarun
+<apenwarr@gmail.com>.
+
+Back in 1998 (12 years ago!  Yikes!), I released the first version of `Tunnel
+Vision <http://alumnit.ca/wiki/?TunnelVisionReadMe>`_, a semi-intelligent VPN
+client for Linux.  Unfortunately, I made two big mistakes: I implemented the
+key exchange myself (oops), and I ended up doing TCP-over-TCP (double oops).
+The resulting program worked okay - and people used it for years - but the
+performance was always a bit funny.  And nobody ever found any security flaws
+in my key exchange, either, but that doesn't mean anything. :)
+
+The same year, dcoombs and I also released Fast Forward, a proxy server
+supporting transparent proxying.  Among other things, we used it for
+automatically splitting traffic across more than one Internet connection (a
+tool we called "Double Vision").
+
+I was still in university at the time.  A couple years after that, one of my
+professors was working with some graduate students on the technology that would
+eventually become `Slipstream Internet Acceleration
+<http://www.slipstream.com/>`_.  He asked me to do a contract for him to build
+an initial prototype of a transparent proxy server for mobile networks.  The
+idea was similar to sshuttle: if you reassemble and then disassemble the TCP
+packets, you can reduce latency and improve performance vs.  just forwarding
+the packets over a plain VPN or mobile network.  (It's unlikely that any of my
+code has persisted in the Slipstream product today, but the concept is still
+pretty cool.  I'm still horrified that people use plain TCP on complex mobile
+networks with crazily variable latency, for which it was never really
+intended.)
+
+That project I did for Slipstream was what first gave me the idea to merge
+the concepts of Fast Forward, Double Vision, and Tunnel Vision into a single
+program that was the best of all worlds.  And here we are, at last, 10 years
+later.  You're welcome.
+

docs/usage.rst

@@ -0,0 +1,95 @@
+Usage
+=====
+- Forward all traffic::
+
+      sshuttle -r username@sshserver 0.0.0.0/0
+
+- By default sshuttle will automatically choose a method to use. Override with
+  the ``--method=`` parameter.
+
+- There is a shortcut for 0.0.0.0/0 for those that value
+  their wrists::
+
+      sshuttle -r username@sshserver 0/0
+
+- If you would also like your DNS queries to be proxied
+  through the DNS server of the server you are connect to::
+
+      sshuttle --dns -r username@sshserver 0/0
+
+  The above is probably what you want to use to prevent
+  local network attacks such as Firesheep and friends.
+
+(You may be prompted for one or more passwords; first, the local password to
+become root using sudo, and then the remote ssh password.  Or you might have
+sudo and ssh set up to not require passwords, in which case you won't be
+prompted at all.)
+
+
+Usage Notes
+-----------
+That's it!  Now your local machine can access the remote network as if you
+were right there.  And if your "client" machine is a router, everyone on
+your local network can make connections to your remote network.
+
+You don't need to install sshuttle on the remote server;
+the remote server just needs to have python available. 
+sshuttle will automatically upload and run its source code
+to the remote python interpreter.
+
+This creates a transparent proxy server on your local machine for all IP
+addresses that match 0.0.0.0/0.  (You can use more specific IP addresses if
+you want; use any number of IP addresses or subnets to change which
+addresses get proxied.  Using 0.0.0.0/0 proxies *everything*, which is
+interesting if you don't trust the people on your local network.)
+
+Any TCP session you initiate to one of the proxied IP addresses will be
+captured by sshuttle and sent over an ssh session to the remote copy of
+sshuttle, which will then regenerate the connection on that end, and funnel
+the data back and forth through ssh.
+
+Fun, right?  A poor man's instant VPN, and you don't even have to have
+admin access on the server.
+
+Additional information for TPROXY
+---------------------------------
+TPROXY is the only method that supports full support of IPv6 and UDP.
+
+There are some things you need to consider for TPROXY to work:
+
+- The following commands need to be run first as root. This only needs to be
+  done once after booting up::
+
+      ip route add local default dev lo table 100
+      ip rule add fwmark 1 lookup 100
+      ip -6 route add local default dev lo table 100
+      ip -6 rule add fwmark 1 lookup 100
+
+- The ``--auto-nets`` feature does not detect IPv6 routes automatically. Add IPv6
+  routes manually. e.g. by adding ``'::/0'`` to the end of the command line.
+
+- The client needs to be run as root. e.g.::
+
+      sudo SSH_AUTH_SOCK="$SSH_AUTH_SOCK" $HOME/tree/sshuttle.tproxy/sshuttle  --method=tproxy ...
+
+- You may need to exclude the IP address of the server you are connecting to.
+  Otherwise sshuttle may attempt to intercept the ssh packets, which will not
+  work. Use the ``--exclude`` parameter for this.
+
+- Similarly, UDP return packets (including DNS) could get intercepted and
+  bounced back. This is the case if you have a broad subnet such as
+  ``0.0.0.0/0`` or ``::/0`` that includes the IP address of the client. Use the
+  ``--exclude`` parameter for this.
+
+- You need the ``--method=tproxy`` parameter, as above.
+
+- The routes for the outgoing packets must already exist. For example, if your
+  connection does not have IPv6 support, no IPv6 routes will exist, IPv6
+  packets will not be generated and sshuttle cannot intercept them::
+
+      telnet -6 www.google.com 80
+      Trying 2404:6800:4001:805::1010...
+      telnet: Unable to connect to remote host: Network is unreachable
+
+  Add some dummy routes to external interfaces. Make sure they get removed
+  however after sshuttle exits.

requirements.txt

@@ -0,0 +1 @@
+setuptools_scm

run

@@ -1,6 +1,6 @@
 #!/bin/sh
-if python2 -V 2>/dev/null; then
-	exec python2 -m "sshuttle" "$@"
+if python3.5 -V 2>/dev/null; then
+	exec python3 -m "sshuttle" "$@"
 else
 	exec python -m "sshuttle" "$@"
 fi

setup.py

@@ -19,16 +19,24 @@
 
 from setuptools import setup, find_packages
 
-with open('VERSION.txt', 'r') as f:
-    version = f.readline().strip()
+
+def version_scheme(version):
+    from setuptools_scm.version import guess_next_dev_version
+    version = guess_next_dev_version(version)
+    return version.lstrip("v")
 
 setup(
     name="sshuttle",
-    version=version,
+    use_scm_version={
+        'write_to': "sshuttle/version.py",
+        'version_scheme': version_scheme,
+    },
+    setup_requires=['setuptools_scm'],
+    # version=version,
     url='https://github.com/sshuttle/sshuttle',
     author='Brian May',
     author_email='brian@linuxpenguins.xyz',
-    description='Transparent proxy server that works as a poor man\'s VPN.',
+    description='Full-featured" VPN over an SSH tunnel',
     packages=find_packages(),
     license="GPL2+",
     long_description=open('README.rst').read(),
@@ -45,8 +53,9 @@ setup(
     ],
     entry_points={
         'console_scripts': [
-            'sshuttle = sshuttle.__main__',
+            'sshuttle = sshuttle.cmdline:main',
         ],
     },
+    tests_require=['pytest', 'mock'],
     keywords="ssh vpn",
 )

sshuttle/__main__.py

@@ -1,226 +1,4 @@
+"""Coverage.py's main entry point."""
 import sys
-import re
-import socket
-import sshuttle.helpers as helpers
-import sshuttle.options as options
-import sshuttle.client as client
-import sshuttle.firewall as firewall
-import sshuttle.hostwatch as hostwatch
-from sshuttle.helpers import family_ip_tuple, log, Fatal
-
-
-# 1.2.3.4/5 or just 1.2.3.4
-def parse_subnet4(s):
-    m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP subnet format' % s)
-    (a, b, c, d, width) = m.groups()
-    (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
-    if width is None:
-        width = 32
-    else:
-        width = int(width)
-    if a > 255 or b > 255 or c > 255 or d > 255:
-        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
-    if width > 32:
-        raise Fatal('*/%d is greater than the maximum of 32' % width)
-    return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)
-
-
-# 1:2::3/64 or just 1:2::3
-def parse_subnet6(s):
-    m = re.match(r'(?:([a-fA-F\d:]+))?(?:/(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP subnet format' % s)
-    (net, width) = m.groups()
-    if width is None:
-        width = 128
-    else:
-        width = int(width)
-    if width > 128:
-        raise Fatal('*/%d is greater than the maximum of 128' % width)
-    return(socket.AF_INET6, net, width)
-
-
-# Subnet file, supporting empty lines and hash-started comment lines
-def parse_subnet_file(s):
-    try:
-        handle = open(s, 'r')
-    except OSError:
-        raise Fatal('Unable to open subnet file: %s' % s)
-
-    raw_config_lines = handle.readlines()
-    config_lines = []
-    for line_no, line in enumerate(raw_config_lines):
-        line = line.strip()
-        if len(line) == 0:
-            continue
-        if line[0] == '#':
-            continue
-        config_lines.append(line)
-
-    return config_lines
-
-
-# list of:
-# 1.2.3.4/5 or just 1.2.3.4
-# 1:2::3/64 or just 1:2::3
-def parse_subnets(subnets_str):
-    subnets = []
-    for s in subnets_str:
-        if ':' in s:
-            subnet = parse_subnet6(s)
-        else:
-            subnet = parse_subnet4(s)
-        subnets.append(subnet)
-    return subnets
-
-
-# 1.2.3.4:567 or just 1.2.3.4 or just 567
-def parse_ipport4(s):
-    s = str(s)
-    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP:port format' % s)
-    (a, b, c, d, port) = m.groups()
-    (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
-                          int(port or 0))
-    if a > 255 or b > 255 or c > 255 or d > 255:
-        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
-    if port > 65535:
-        raise Fatal('*:%d is greater than the maximum of 65535' % port)
-    if a is None:
-        a = b = c = d = 0
-    return ('%d.%d.%d.%d' % (a, b, c, d), port)
-
-
-# [1:2::3]:456 or [1:2::3] or 456
-def parse_ipport6(s):
-    s = str(s)
-    m = re.match(r'(?:\[([^]]*)])?(?::)?(?:(\d+))?$', s)
-    if not m:
-        raise Fatal('%s is not a valid IP:port format' % s)
-    (ip, port) = m.groups()
-    (ip, port) = (ip or '::', int(port or 0))
-    return (ip, port)
-
-
-def parse_list(list):
-    return re.split(r'[\s,]+', list.strip()) if list else []
-
-
-optspec = """
-sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
-sshuttle --firewall <port> <subnets...>
-sshuttle --hostwatch
---
-l,listen=  transproxy to this ip address and port number
-H,auto-hosts scan for remote hostnames and update local /etc/hosts
-N,auto-nets  automatically determine subnets to route
-dns        capture local DNS requests and forward to the remote DNS server
-ns-hosts=  capture and forward remote DNS requests to the following servers
-method=    auto, nat, tproxy, pf or ipfw
-python=    path to python interpreter on the remote server
-r,remote=  ssh hostname (and optional username) of remote sshuttle server
-x,exclude= exclude this subnet (can be used more than once)
-X,exclude-from=  exclude the subnets in a file (whitespace separated)
-v,verbose  increase debug message verbosity
-e,ssh-cmd= the command to use to connect to the remote [ssh]
-seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
-no-latency-control  sacrifice latency to improve bandwidth benchmarks
-wrap=      restart counting channel numbers after this number (for testing)
-D,daemon   run in the background as a daemon
-s,subnets= file where the subnets are stored, instead of on the command line
-syslog     send log messages to syslog (default if you use --daemon)
-pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
-server     (internal use only)
-firewall   (internal use only)
-hostwatch  (internal use only)
-"""
-o = options.Options(optspec)
-(opt, flags, extra) = o.parse(sys.argv[1:])
-
-if opt.daemon:
-    opt.syslog = 1
-if opt.wrap:
-    import sshuttle.ssnet as ssnet
-    ssnet.MAX_CHANNEL = int(opt.wrap)
-helpers.verbose = opt.verbose
-
-try:
-    if opt.firewall:
-        if len(extra) != 0:
-            o.fatal('exactly zero arguments expected')
-        result = firewall.main(opt.method, opt.syslog)
-        sys.exit(result)
-    elif opt.hostwatch:
-        sys.exit(hostwatch.hw_main(extra))
-    else:
-        if len(extra) < 1 and not opt.auto_nets and not opt.subnets:
-            o.fatal('at least one subnet, subnet file, or -N expected')
-        includes = extra
-        excludes = ['127.0.0.0/8']
-        for k, v in flags:
-            if k in ('-x', '--exclude'):
-                excludes.append(v)
-            if k in ('-X', '--exclude-from'):
-                excludes += open(v).read().split()
-        remotename = opt.remote
-        if remotename == '' or remotename == '-':
-            remotename = None
-        nslist = [family_ip_tuple(ns) for ns in parse_list(opt.ns_hosts)]
-        if opt.seed_hosts and not opt.auto_hosts:
-            o.fatal('--seed-hosts only works if you also use -H')
-        if opt.seed_hosts:
-            sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
-        elif opt.auto_hosts:
-            sh = []
-        else:
-            sh = None
-        if opt.subnets:
-            includes = parse_subnet_file(opt.subnets)
-        if not opt.method:
-            method_name = "auto"
-        elif opt.method in ["auto", "nat", "tproxy", "ipfw", "pf"]:
-            method_name = opt.method
-        else:
-            o.fatal("method_name %s not supported" % opt.method)
-        if not opt.listen:
-            ipport_v6 = "auto"  # parse_ipport6('[::1]:0')
-            ipport_v4 = "auto"  # parse_ipport4('127.0.0.1:0')
-        else:
-            ipport_v6 = None
-            ipport_v4 = None
-            list = opt.listen.split(",")
-            for ip in list:
-                if '[' in ip and ']' in ip:
-                    ipport_v6 = parse_ipport6(ip)
-                else:
-                    ipport_v4 = parse_ipport4(ip)
-        return_code = client.main(ipport_v6, ipport_v4,
-                                  opt.ssh_cmd,
-                                  remotename,
-                                  opt.python,
-                                  opt.latency_control,
-                                  opt.dns,
-                                  nslist,
-                                  method_name,
-                                  sh,
-                                  opt.auto_nets,
-                                  parse_subnets(includes),
-                                  parse_subnets(excludes),
-                                  opt.syslog, opt.daemon, opt.pidfile)
-
-        if return_code == 0:
-            log('Normal exit code, exiting...')
-        else:
-            log('Abnormal exit code detected, failing...' % return_code)
-        sys.exit(return_code)
-
-except Fatal as e:
-    log('fatal: %s\n' % e)
-    sys.exit(99)
-except KeyboardInterrupt:
-    log('\n')
-    log('Keyboard interrupt: exiting.\n')
-    sys.exit(1)
+from sshuttle.cmdline import main
+sys.exit(main())

sshuttle/assembler.py

@@ -4,13 +4,15 @@ import imp
 
 z = zlib.decompressobj()
 while 1:
-    name = sys.stdin.readline().strip()
+    name = stdin.readline().strip()
     if name:
-        nbytes = int(sys.stdin.readline())
+        name = name.decode("ASCII")
+
+        nbytes = int(stdin.readline())
         if verbosity >= 2:
             sys.stderr.write('server: assembling %r (%d bytes)\n'
                              % (name, nbytes))
-        content = z.decompress(sys.stdin.read(nbytes))
+        content = z.decompress(stdin.read(nbytes))
 
         module = imp.new_module(name)
         parent, _, parent_name = name.rpartition(".")

sshuttle/client.py

@@ -10,10 +10,11 @@ import sshuttle.ssnet as ssnet
 import sshuttle.ssh as ssh
 import sshuttle.ssyslog as ssyslog
 import sys
+import platform
 from sshuttle.ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper
 from sshuttle.helpers import log, debug1, debug2, debug3, Fatal, islocal, \
     resolvconf_nameservers
-from sshuttle.methods import get_method
+from sshuttle.methods import get_method, Features
 
 _extra_fd = os.open('/dev/null', os.O_RDONLY)
 
@@ -66,7 +67,7 @@ def daemonize():
 
     outfd = os.open(_pidname, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o666)
     try:
-        os.write(outfd, '%d\n' % os.getpid())
+        os.write(outfd, b'%d\n' % os.getpid())
     finally:
         os.close(outfd)
     os.chdir("/")
@@ -80,8 +81,6 @@ def daemonize():
     os.dup2(si.fileno(), 1)
     si.close()
 
-    ssyslog.stderr_to_syslog()
-
 
 def daemon_cleanup():
     try:
@@ -259,8 +258,8 @@ class FirewallClient:
             raise Fatal('%r expected STARTED, got %r' % (self.argv, line))
 
     def sethostip(self, hostname, ip):
-        assert(not re.search(r'[^-\w]', hostname))
-        assert(not re.search(r'[^0-9.]', ip))
+        assert(not re.search(b'[^-\w]', hostname))
+        assert(not re.search(b'[^0-9.]', ip))
         self.pfile.write(b'HOST %s,%s\n' % (hostname, ip))
         self.pfile.flush()
 
@@ -276,17 +275,24 @@ udp_by_src = {}
 
 
 def expire_connections(now, mux):
+    remove = []
     for chan, timeout in dnsreqs.items():
         if timeout < now:
             debug3('expiring dnsreqs channel=%d\n' % chan)
+            remove.append(chan)
             del mux.channels[chan]
+    for chan in remove:
         del dnsreqs[chan]
     debug3('Remaining DNS requests: %d\n' % len(dnsreqs))
+
+    remove = []
     for peer, (chan, timeout) in udp_by_src.items():
         if timeout < now:
             debug3('expiring UDP channel channel=%d peer=%r\n' % (chan, peer))
-            mux.send(chan, ssnet.CMD_UDP_CLOSE, '')
+            mux.send(chan, ssnet.CMD_UDP_CLOSE, b'')
+            remove.append(peer)
             del mux.channels[chan]
+    for peer in remove:
         del udp_by_src[peer]
     debug3('Remaining UDP channels: %d\n' % len(udp_by_src))
 
@@ -329,7 +335,7 @@ def onaccept_tcp(listener, method, mux, handlers):
 
 
 def udp_done(chan, data, method, sock, dstip):
-    (src, srcport, data) = data.split(",", 2)
+    (src, srcport, data) = data.split(b",", 2)
     srcip = (src, int(srcport))
     debug3('doing send from %r to %r\n' % (srcip, dstip,))
     method.send_udp(sock, srcip, dstip, data)
@@ -348,10 +354,10 @@ def onaccept_udp(listener, method, mux, handlers):
         chan = mux.next_channel()
         mux.channels[chan] = lambda cmd, data: udp_done(
             chan, data, method, listener, dstip=srcip)
-        mux.send(chan, ssnet.CMD_UDP_OPEN, listener.family)
+        mux.send(chan, ssnet.CMD_UDP_OPEN, b"%d" % listener.family)
     udp_by_src[srcip] = chan, now + 30
 
-    hdr = "%s,%r," % (dstip[0], dstip[1])
+    hdr = b"%s,%d," % (dstip[0].encode("ASCII"), dstip[1])
     mux.send(chan, ssnet.CMD_UDP_DATA, hdr + data)
 
     expire_connections(now, mux)
@@ -381,8 +387,10 @@ def ondns(listener, method, mux, handlers):
 
 def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
           python, latency_control,
-          dns_listener, seed_hosts, auto_nets,
-          syslog, daemon):
+          dns_listener, seed_hosts, auto_nets, daemon):
+
+    debug1('Starting client with Python version %s\n'
+           % platform.python_version())
 
     method = fw.method
 
@@ -429,21 +437,26 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
     if initstring != expected:
         raise Fatal('expected server init string %r; got %r'
                     % (expected, initstring))
-    debug1('connected.\n')
-    print('Connected.')
+    log('Connected.\n')
     sys.stdout.flush()
     if daemon:
         daemonize()
         log('daemonizing (%s).\n' % _pidname)
-    elif syslog:
-        debug1('switching to syslog.\n')
-        ssyslog.stderr_to_syslog()
 
     def onroutes(routestr):
         if auto_nets:
-            for line in routestr.strip().split('\n'):
-                (family, ip, width) = line.split(',', 2)
-                fw.auto_nets.append((int(family), ip, int(width)))
+            for line in routestr.strip().split(b'\n'):
+                (family, ip, width) = line.split(b',', 2)
+                family = int(family)
+                width = int(width)
+                ip = ip.decode("ASCII")
+                if family == socket.AF_INET6 and tcp_listener.v6 is None:
+                    debug2("Ignored auto net %d/%s/%d\n" % (family, ip, width))
+                if family == socket.AF_INET and tcp_listener.v4 is None:
+                    debug2("Ignored auto net %d/%s/%d\n" % (family, ip, width))
+                else:
+                    debug2("Adding auto net %d/%s/%d\n" % (family, ip, width))
+                    fw.auto_nets.append((family, ip, width))
 
         # we definitely want to do this *after* starting ssh, or we might end
         # up intercepting the ssh connection!
@@ -460,7 +473,7 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
         debug2('got host list: %r\n' % hostlist)
         for line in hostlist.strip().split():
             if line:
-                name, ip = line.split(',', 1)
+                name, ip = line.split(b',', 1)
                 fw.sethostip(name, ip)
     mux.got_host_list = onhostlist
 
@@ -474,7 +487,7 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
 
     if seed_hosts is not None:
         debug1('seed_hosts: %r\n' % seed_hosts)
-        mux.send(0, ssnet.CMD_HOST_REQ, '\n'.join(seed_hosts))
+        mux.send(0, ssnet.CMD_HOST_REQ, str.encode('\n'.join(seed_hosts)))
 
     while 1:
         rv = serverproc.poll()
@@ -489,10 +502,8 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
 def main(listenip_v6, listenip_v4,
          ssh_cmd, remotename, python, latency_control, dns, nslist,
          method_name, seed_hosts, auto_nets,
-         subnets_include, subnets_exclude, syslog, daemon, pidfile):
+         subnets_include, subnets_exclude, daemon, pidfile):
 
-    if syslog:
-        ssyslog.start_syslog()
     if daemon:
         try:
             check_daemon(pidfile)
@@ -503,19 +514,45 @@ def main(listenip_v6, listenip_v4,
 
     fw = FirewallClient(method_name)
 
-    features = fw.method.get_supported_features()
+    # Get family specific subnet lists
+    if dns:
+        nslist += resolvconf_nameservers()
+
+    subnets = subnets_include + subnets_exclude  # we don't care here
+    subnets_v6 = [i for i in subnets if i[0] == socket.AF_INET6]
+    nslist_v6 = [i for i in nslist if i[0] == socket.AF_INET6]
+    subnets_v4 = [i for i in subnets if i[0] == socket.AF_INET]
+    nslist_v4 = [i for i in nslist if i[0] == socket.AF_INET]
+
+    # Check features available
+    avail = fw.method.get_supported_features()
+    required = Features()
+
     if listenip_v6 == "auto":
-        if features.ipv6:
+        if avail.ipv6:
             listenip_v6 = ('::1', 0)
         else:
             listenip_v6 = None
 
+    required.ipv6 = len(subnets_v6) > 0 or len(nslist_v6) > 0 \
+        or listenip_v6 is not None
+    required.udp = avail.udp
+    required.dns = len(nslist) > 0
+
+    fw.method.assert_features(required)
+
+    if required.ipv6 and listenip_v6 is None:
+        raise Fatal("IPv6 required but not listening.")
+
+    # display features enabled
+    debug1("IPv6 enabled: %r\n" % required.ipv6)
+    debug1("UDP enabled: %r\n" % required.udp)
+    debug1("DNS enabled: %r\n" % required.dns)
+
+    # bind to required ports
     if listenip_v4 == "auto":
         listenip_v4 = ('127.0.0.1', 0)
 
-    udp = features.udp
-    debug1("UDP enabled: %r\n" % udp)
-
     if listenip_v6 and listenip_v6[1] and listenip_v4 and listenip_v4[1]:
         # if both ports given, no need to search for a spare port
         ports = [0, ]
@@ -534,7 +571,7 @@ def main(listenip_v6, listenip_v4,
         tcp_listener = MultiListener()
         tcp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 
-        if udp:
+        if required.udp:
             udp_listener = MultiListener(socket.SOCK_DGRAM)
             udp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
         else:
@@ -582,10 +619,7 @@ def main(listenip_v6, listenip_v4,
         udp_listener.print_listening("UDP redirector")
 
     bound = False
-    if dns or nslist:
-        if dns:
-            nslist += resolvconf_nameservers()
-        dns = True
+    if required.dns:
         # search for spare port for DNS
         debug2('Binding DNS:')
         ports = range(12300, 9000, -1)
@@ -626,22 +660,45 @@ def main(listenip_v6, listenip_v4,
         dnsport_v4 = 0
         dns_listener = None
 
-    fw.method.check_settings(udp, dns)
+    # Last minute sanity checks.
+    # These should never fail.
+    # If these do fail, something is broken above.
+    if len(subnets_v6) > 0:
+        assert required.ipv6
+        if redirectport_v6 == 0:
+            raise Fatal("IPv6 subnets defined but not listening")
+
+    if len(nslist_v6) > 0:
+        assert required.dns
+        assert required.ipv6
+        if dnsport_v6 == 0:
+            raise Fatal("IPv6 ns servers defined but not listening")
+
+    if len(subnets_v4) > 0:
+        if redirectport_v4 == 0:
+            raise Fatal("IPv4 subnets defined but not listening")
+
+    if len(nslist_v4) > 0:
+        if dnsport_v4 == 0:
+            raise Fatal("IPv4 ns servers defined but not listening")
+
+    # setup method specific stuff on listeners
     fw.method.setup_tcp_listener(tcp_listener)
     if udp_listener:
         fw.method.setup_udp_listener(udp_listener)
     if dns_listener:
         fw.method.setup_udp_listener(dns_listener)
 
+    # start the firewall
     fw.setup(subnets_include, subnets_exclude, nslist,
              redirectport_v6, redirectport_v4, dnsport_v6, dnsport_v4,
-             udp)
+             required.udp)
 
+    # start the client process
     try:
         return _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
                      python, latency_control, dns_listener,
-                     seed_hosts, auto_nets, syslog,
-                     daemon)
+                     seed_hosts, auto_nets, daemon)
     finally:
         try:
             if daemon:

sshuttle/cmdline.py

@@ -0,0 +1,240 @@
+import sys
+import re
+import socket
+import sshuttle.helpers as helpers
+import sshuttle.options as options
+import sshuttle.client as client
+import sshuttle.firewall as firewall
+import sshuttle.hostwatch as hostwatch
+import sshuttle.ssyslog as ssyslog
+from sshuttle.helpers import family_ip_tuple, log, Fatal
+
+
+# 1.2.3.4/5 or just 1.2.3.4
+def parse_subnet4(s):
+    m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP subnet format' % s)
+    (a, b, c, d, width) = m.groups()
+    (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
+    if width is None:
+        width = 32
+    else:
+        width = int(width)
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
+    if width > 32:
+        raise Fatal('*/%d is greater than the maximum of 32' % width)
+    return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)
+
+
+# 1:2::3/64 or just 1:2::3
+def parse_subnet6(s):
+    m = re.match(r'(?:([a-fA-F\d:]+))?(?:/(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP subnet format' % s)
+    (net, width) = m.groups()
+    if width is None:
+        width = 128
+    else:
+        width = int(width)
+    if width > 128:
+        raise Fatal('*/%d is greater than the maximum of 128' % width)
+    return(socket.AF_INET6, net, width)
+
+
+# Subnet file, supporting empty lines and hash-started comment lines
+def parse_subnet_file(s):
+    try:
+        handle = open(s, 'r')
+    except OSError:
+        raise Fatal('Unable to open subnet file: %s' % s)
+
+    raw_config_lines = handle.readlines()
+    config_lines = []
+    for line_no, line in enumerate(raw_config_lines):
+        line = line.strip()
+        if len(line) == 0:
+            continue
+        if line[0] == '#':
+            continue
+        config_lines.append(line)
+
+    return config_lines
+
+
+# list of:
+# 1.2.3.4/5 or just 1.2.3.4
+# 1:2::3/64 or just 1:2::3
+def parse_subnets(subnets_str):
+    subnets = []
+    for s in subnets_str:
+        if ':' in s:
+            subnet = parse_subnet6(s)
+        else:
+            subnet = parse_subnet4(s)
+        subnets.append(subnet)
+    return subnets
+
+
+# 1.2.3.4:567 or just 1.2.3.4 or just 567
+def parse_ipport4(s):
+    s = str(s)
+    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP:port format' % s)
+    (a, b, c, d, port) = m.groups()
+    (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
+                          int(port or 0))
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
+    if port > 65535:
+        raise Fatal('*:%d is greater than the maximum of 65535' % port)
+    if a is None:
+        a = b = c = d = 0
+    return ('%d.%d.%d.%d' % (a, b, c, d), port)
+
+
+# [1:2::3]:456 or [1:2::3] or 456
+def parse_ipport6(s):
+    s = str(s)
+    m = re.match(r'(?:\[([^]]*)])?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%s is not a valid IP:port format' % s)
+    (ip, port) = m.groups()
+    (ip, port) = (ip or '::', int(port or 0))
+    return (ip, port)
+
+
+def parse_list(list):
+    return re.split(r'[\s,]+', list.strip()) if list else []
+
+
+optspec = """
+sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
+sshuttle --firewall <port> <subnets...>
+sshuttle --hostwatch
+--
+l,listen=  transproxy to this ip address and port number
+H,auto-hosts scan for remote hostnames and update local /etc/hosts
+N,auto-nets  automatically determine subnets to route
+dns        capture local DNS requests and forward to the remote DNS server
+ns-hosts=  capture and forward remote DNS requests to the following servers
+method=    auto, nat, tproxy or pf
+python=    path to python interpreter on the remote server
+r,remote=  ssh hostname (and optional username) of remote sshuttle server
+x,exclude= exclude this subnet (can be used more than once)
+X,exclude-from=  exclude the subnets in a file (whitespace separated)
+v,verbose  increase debug message verbosity
+V,version  print the sshuttle version number and exit
+e,ssh-cmd= the command to use to connect to the remote [ssh]
+seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
+no-latency-control  sacrifice latency to improve bandwidth benchmarks
+wrap=      restart counting channel numbers after this number (for testing)
+disable-ipv6 disables ipv6 support
+D,daemon   run in the background as a daemon
+s,subnets= file where the subnets are stored, instead of on the command line
+syslog     send log messages to syslog (default if you use --daemon)
+pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
+server     (internal use only)
+firewall   (internal use only)
+hostwatch  (internal use only)
+"""
+
+
+def main():
+    o = options.Options(optspec)
+    (opt, flags, extra) = o.parse(sys.argv[1:])
+
+    if opt.version:
+        from sshuttle.version import version
+        print(version)
+        return 0
+    if opt.daemon:
+        opt.syslog = 1
+    if opt.wrap:
+        import sshuttle.ssnet as ssnet
+        ssnet.MAX_CHANNEL = int(opt.wrap)
+    helpers.verbose = opt.verbose or 0
+
+    try:
+        if opt.firewall:
+            if len(extra) != 0:
+                o.fatal('exactly zero arguments expected')
+            return firewall.main(opt.method, opt.syslog)
+        elif opt.hostwatch:
+            return hostwatch.hw_main(extra)
+        else:
+            if len(extra) < 1 and not opt.auto_nets and not opt.subnets:
+                o.fatal('at least one subnet, subnet file, or -N expected')
+            includes = extra
+            excludes = ['127.0.0.0/8']
+            for k, v in flags:
+                if k in ('-x', '--exclude'):
+                    excludes.append(v)
+                if k in ('-X', '--exclude-from'):
+                    excludes += open(v).read().split()
+            remotename = opt.remote
+            if remotename == '' or remotename == '-':
+                remotename = None
+            nslist = [family_ip_tuple(ns) for ns in parse_list(opt.ns_hosts)]
+            if opt.seed_hosts and not opt.auto_hosts:
+                o.fatal('--seed-hosts only works if you also use -H')
+            if opt.seed_hosts:
+                sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
+            elif opt.auto_hosts:
+                sh = []
+            else:
+                sh = None
+            if opt.subnets:
+                includes = parse_subnet_file(opt.subnets)
+            if not opt.method:
+                method_name = "auto"
+            elif opt.method in ["auto", "nat", "tproxy", "pf"]:
+                method_name = opt.method
+            else:
+                o.fatal("method_name %s not supported" % opt.method)
+            if opt.listen:
+                ipport_v6 = None
+                ipport_v4 = None
+                list = opt.listen.split(",")
+                for ip in list:
+                    if '[' in ip and ']' in ip:
+                        ipport_v6 = parse_ipport6(ip)
+                    else:
+                        ipport_v4 = parse_ipport4(ip)
+            else:
+                # parse_ipport4('127.0.0.1:0')
+                ipport_v4 = "auto"
+                # parse_ipport6('[::1]:0')
+                ipport_v6 = "auto" if not opt.disable_ipv6 else None
+            if opt.syslog:
+                ssyslog.start_syslog()
+                ssyslog.stderr_to_syslog()
+            return_code = client.main(ipport_v6, ipport_v4,
+                                      opt.ssh_cmd,
+                                      remotename,
+                                      opt.python,
+                                      opt.latency_control,
+                                      opt.dns,
+                                      nslist,
+                                      method_name,
+                                      sh,
+                                      opt.auto_nets,
+                                      parse_subnets(includes),
+                                      parse_subnets(excludes),
+                                      opt.daemon, opt.pidfile)
+
+            if return_code == 0:
+                log('Normal exit code, exiting...')
+            else:
+                log('Abnormal exit code detected, failing...' % return_code)
+            return return_code
+
+    except Fatal as e:
+        log('fatal: %s\n' % e)
+        return 99
+    except KeyboardInterrupt:
+        log('\n')
+        log('Keyboard interrupt: exiting.\n')
+        return 1

sshuttle/firewall.py

@@ -4,14 +4,15 @@ import signal
 import sshuttle.ssyslog as ssyslog
 import sys
 import os
+import platform
+import traceback
 from sshuttle.helpers import debug1, debug2, Fatal
 from sshuttle.methods import get_auto_method, get_method
 
-hostmap = {}
 HOSTSFILE = '/etc/hosts'
 
 
-def rewrite_etc_hosts(port):
+def rewrite_etc_hosts(hostmap, port):
     BAKFILE = '%s.sbak' % HOSTSFILE
     APPEND = '# sshuttle-firewall-%d AUTOCREATED' % port
     old_content = ''
@@ -36,19 +37,17 @@ def rewrite_etc_hosts(port):
         f.write('%-30s %s\n' % ('%s %s' % (ip, name), APPEND))
     f.close()
 
-    if st:
+    if st is not None:
         os.chown(tmpname, st.st_uid, st.st_gid)
         os.chmod(tmpname, st.st_mode)
     else:
         os.chown(tmpname, 0, 0)
-        os.chmod(tmpname, 0o644)
+        os.chmod(tmpname, 0o600)
     os.rename(tmpname, HOSTSFILE)
 
 
 def restore_etc_hosts(port):
-    global hostmap
-    hostmap = {}
-    rewrite_etc_hosts(port)
+    rewrite_etc_hosts({}, port)
 
 
 # Isolate function that needs to be replaced for tests
@@ -85,6 +84,10 @@ def setup_daemon():
 # are hopefully harmless.
 def main(method_name, syslog):
     stdin, stdout = setup_daemon()
+    hostmap = {}
+
+    debug1('firewall manager: Starting firewall with Python version %s\n'
+           % platform.python_version())
 
     if method_name == "auto":
         method = get_auto_method()
@@ -95,7 +98,7 @@ def main(method_name, syslog):
         ssyslog.start_syslog()
         ssyslog.stderr_to_syslog()
 
-    debug1('firewall manager ready method name %s.\n' % method.name)
+    debug1('firewall manager: ready method name %s.\n' % method.name)
     stdout.write('READY %s\n' % method.name)
     stdout.flush()
 
@@ -120,7 +123,7 @@ def main(method_name, syslog):
         except:
             raise Fatal('firewall: expected route or NSLIST but got %r' % line)
         subnets.append((int(family), int(width), bool(int(exclude)), ip))
-    debug2('Got subnets: %r\n' % subnets)
+    debug2('firewall manager: Got subnets: %r\n' % subnets)
 
     nslist = []
     if line != 'NSLIST\n':
@@ -136,8 +139,8 @@ def main(method_name, syslog):
         except:
             raise Fatal('firewall: expected nslist or PORTS but got %r' % line)
         nslist.append((int(family), ip))
-        debug2('Got partial nslist: %r\n' % nslist)
-    debug2('Got nslist: %r\n' % nslist)
+        debug2('firewall manager: Got partial nslist: %r\n' % nslist)
+    debug2('firewall manager: Got nslist: %r\n' % nslist)
 
     if not line.startswith('PORTS '):
         raise Fatal('firewall: expected PORTS but got %r' % line)
@@ -159,7 +162,7 @@ def main(method_name, syslog):
     assert(dnsport_v4 >= 0)
     assert(dnsport_v4 <= 65535)
 
-    debug2('Got ports: %d,%d,%d,%d\n'
+    debug2('firewall manager: Got ports: %d,%d,%d,%d\n'
            % (port_v6, port_v4, dnsport_v6, dnsport_v4))
 
     line = stdin.readline(128)
@@ -170,29 +173,27 @@ def main(method_name, syslog):
 
     _, _, udp = line.partition(" ")
     udp = bool(int(udp))
-    debug2('Got udp: %r\n' % udp)
+    debug2('firewall manager: Got udp: %r\n' % udp)
+
+    subnets_v6 = [i for i in subnets if i[0] == socket.AF_INET6]
+    nslist_v6 = [i for i in nslist if i[0] == socket.AF_INET6]
+    subnets_v4 = [i for i in subnets if i[0] == socket.AF_INET]
+    nslist_v4 = [i for i in nslist if i[0] == socket.AF_INET]
 
     try:
-        do_wait = None
-        debug1('firewall manager: starting transproxy.\n')
+        debug1('firewall manager: setting up.\n')
 
-        nslist_v6 = [i for i in nslist if i[0] == socket.AF_INET6]
-        subnets_v6 = [i for i in subnets if i[0] == socket.AF_INET6]
-        if port_v6 > 0:
-            do_wait = method.setup_firewall(
+        if len(subnets_v6) > 0 or len(nslist_v6) > 0:
+            debug2('firewall manager: setting up IPv6.\n')
+            method.setup_firewall(
                 port_v6, dnsport_v6, nslist_v6,
                 socket.AF_INET6, subnets_v6, udp)
-        elif len(subnets_v6) > 0:
-            debug1("IPv6 subnets defined but IPv6 disabled\n")
 
-        nslist_v4 = [i for i in nslist if i[0] == socket.AF_INET]
-        subnets_v4 = [i for i in subnets if i[0] == socket.AF_INET]
-        if port_v4 > 0:
-            do_wait = method.setup_firewall(
+        if len(subnets_v4) > 0 or len(nslist_v4) > 0:
+            debug2('firewall manager: setting up IPv4.\n')
+            method.setup_firewall(
                 port_v4, dnsport_v4, nslist_v4,
                 socket.AF_INET, subnets_v4, udp)
-        elif len(subnets_v4) > 0:
-            debug1('IPv4 subnets defined but IPv4 disabled\n')
 
         stdout.write('STARTED\n')
 
@@ -207,16 +208,15 @@ def main(method_name, syslog):
         # to stay running so that we don't need a *second* password
         # authentication at shutdown time - that cleanup is important!
         while 1:
-            if do_wait is not None:
-                do_wait()
             line = stdin.readline(128)
             if line.startswith('HOST '):
                 (name, ip) = line[5:].strip().split(',', 1)
                 hostmap[name] = ip
-                rewrite_etc_hosts(port_v6 or port_v4)
+                debug2('firewall manager: setting up /etc/hosts.\n')
+                rewrite_etc_hosts(hostmap, port_v6 or port_v4)
             elif line:
                 if not method.firewall_command(line):
-                    raise Fatal('expected EOF, got %r' % line)
+                    raise Fatal('firewall: expected command, got %r' % line)
             else:
                 break
     finally:
@@ -224,8 +224,41 @@ def main(method_name, syslog):
             debug1('firewall manager: undoing changes.\n')
         except:
             pass
-        if port_v6:
-            method.setup_firewall(port_v6, 0, [], socket.AF_INET6, [], udp)
-        if port_v4:
-            method.setup_firewall(port_v4, 0, [], socket.AF_INET, [], udp)
+
+        try:
+            if len(subnets_v6) > 0 or len(nslist_v6) > 0:
+                debug2('firewall manager: undoing IPv6 changes.\n')
+                method.restore_firewall(port_v6, socket.AF_INET6, udp)
+        except:
+            try:
+                debug1("firewall manager: "
+                       "Error trying to undo IPv6 firewall.\n")
+                for line in traceback.format_exc().splitlines():
+                    debug1("---> %s\n" % line)
+            except:
+                pass
+
+        try:
+            if len(subnets_v4) > 0 or len(nslist_v4) > 0:
+                debug2('firewall manager: undoing IPv4 changes.\n')
+                method.restore_firewall(port_v4, socket.AF_INET, udp)
+        except:
+            try:
+                debug1("firewall manager: "
+                       "Error trying to undo IPv4 firewall.\n")
+                for line in traceback.format_exc().splitlines():
+                    debug1("firewall manager: ---> %s\n" % line)
+            except:
+                pass
+
+        try:
+            debug2('firewall manager: undoing /etc/hosts changes.\n')
             restore_etc_hosts(port_v6 or port_v4)
+        except:
+            try:
+                debug1("firewall manager: "
+                       "Error trying to undo /etc/hosts changes.\n")
+                for line in traceback.format_exc().splitlines():
+                    debug1("firewall manager: ---> %s\n" % line)
+            except:
+                pass

sshuttle/helpers.py

@@ -7,8 +7,16 @@ verbose = 0
 
 
 def log(s):
+    global logprefix
     try:
         sys.stdout.flush()
+        if s.find("\n") != -1:
+            prefix = logprefix
+            s = s.rstrip("\n")
+            for line in s.split("\n"):
+                sys.stderr.write(prefix + line + "\n")
+                prefix = "---> "
+        else:
             sys.stderr.write(logprefix + s)
         sys.stderr.flush()
     except IOError:

sshuttle/hostwatch.py

@@ -5,6 +5,7 @@ import select
 import errno
 import os
 import sys
+import platform
 
 import subprocess as ssubprocess
 import sshuttle.helpers as helpers
@@ -35,8 +36,9 @@ def write_host_cache():
     try:
         f = open(tmpname, 'wb')
         for name, ip in sorted(hostnames.items()):
-            f.write('%s,%s\n' % (name, ip))
+            f.write(('%s,%s\n' % (name, ip)).encode("ASCII"))
         f.close()
+        os.chmod(tmpname, 0o600)
         os.rename(tmpname, CACHEFILE)
     finally:
         try:
@@ -120,7 +122,7 @@ def _check_netstat():
     argv = ['netstat', '-n']
     try:
         p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
-        content = p.stdout.read()
+        content = p.stdout.read().decode("ASCII")
         p.wait()
     except OSError as e:
         log('%r failed: %r\n' % (argv, e))
@@ -254,6 +256,9 @@ def hw_main(seed_hosts):
     else:
         helpers.logprefix = 'hostwatch: '
 
+    debug1('Starting hostwatch with Python version %s\n'
+           % platform.python_version())
+
     read_host_cache()
 
     _enqueue(_check_etc_hosts)

sshuttle/methods/__init__.py

@@ -39,6 +39,7 @@ class BaseMethod(object):
         result = Features()
         result.ipv6 = False
         result.udp = False
+        result.dns = True
         return result
 
     def get_tcp_dstip(self, sock):
@@ -61,13 +62,20 @@ class BaseMethod(object):
     def setup_udp_listener(self, udp_listener):
         pass
 
-    def check_settings(self, udp, dns):
-        if udp:
-            Fatal("UDP support not supported with method %s.\n" % self.name)
+    def assert_features(self, features):
+        avail = self.get_supported_features()
+        for key in ["udp", "dns", "ipv6"]:
+            if getattr(features, key) and not getattr(avail, key):
+                raise Fatal(
+                    "Feature %s not supported with method %s.\n" %
+                    (key, self.name))
 
     def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):
         raise NotImplementedError()
 
+    def restore_firewall(self, port, family, udp):
+        raise NotImplementedError()
+
     def firewall_command(self, line):
         return False
 
@@ -86,14 +94,12 @@ def get_method(method_name):
 
 
 def get_auto_method():
-    if _program_exists('ipfw'):
-        method_name = "ipfw"
-    elif _program_exists('iptables'):
+    if _program_exists('iptables'):
         method_name = "nat"
     elif _program_exists('pfctl'):
         method_name = "pf"
     else:
         raise Fatal(
-            "can't find either ipfw, iptables or pfctl; check your PATH")
+            "can't find either iptables or pfctl; check your PATH")
 
     return get_method(method_name)

sshuttle/methods/ipfw.py

@@ -1,237 +0,0 @@
-import sys
-import select
-import socket
-import struct
-import subprocess as ssubprocess
-from sshuttle.helpers import log, debug1, debug3, islocal, \
-    Fatal, family_to_string
-from sshuttle.methods import BaseMethod
-
-
-# python doesn't have a definition for this
-IPPROTO_DIVERT = 254
-
-
-def ipfw_rule_exists(n):
-    argv = ['ipfw', 'list']
-    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
-    found = False
-    for line in p.stdout:
-        if line.startswith('%05d ' % n):
-            if not ('ipttl 42' in line
-                    or ('skipto %d' % (n + 1)) in line
-                    or 'check-state' in line):
-                log('non-sshuttle ipfw rule: %r\n' % line.strip())
-                raise Fatal('non-sshuttle ipfw rule #%d already exists!' % n)
-            found = True
-    rv = p.wait()
-    if rv:
-        raise Fatal('%r returned %d' % (argv, rv))
-    return found
-
-
-_oldctls = {}
-
-
-def _fill_oldctls(prefix):
-    argv = ['sysctl', prefix]
-    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
-    for line in p.stdout:
-        assert(line[-1] == '\n')
-        (k, v) = line[:-1].split(': ', 1)
-        _oldctls[k] = v
-    rv = p.wait()
-    if rv:
-        raise Fatal('%r returned %d' % (argv, rv))
-    if not line:
-        raise Fatal('%r returned no data' % (argv,))
-
-
-def _sysctl_set(name, val):
-    argv = ['sysctl', '-w', '%s=%s' % (name, val)]
-    debug1('>> %s\n' % ' '.join(argv))
-    return ssubprocess.call(argv, stdout=open('/dev/null', 'w'))
-
-
-_changedctls = []
-
-
-def sysctl_set(name, val, permanent=False):
-    PREFIX = 'net.inet.ip'
-    assert(name.startswith(PREFIX + '.'))
-    val = str(val)
-    if not _oldctls:
-        _fill_oldctls(PREFIX)
-    if not (name in _oldctls):
-        debug1('>> No such sysctl: %r\n' % name)
-        return False
-    oldval = _oldctls[name]
-    if val != oldval:
-        rv = _sysctl_set(name, val)
-        if rv == 0 and permanent:
-            debug1('>>   ...saving permanently in /etc/sysctl.conf\n')
-            f = open('/etc/sysctl.conf', 'a')
-            f.write('\n'
-                    '# Added by sshuttle\n'
-                    '%s=%s\n' % (name, val))
-            f.close()
-        else:
-            _changedctls.append(name)
-        return True
-
-
-def _udp_unpack(p):
-    src = (socket.inet_ntoa(p[12:16]), struct.unpack('!H', p[20:22])[0])
-    dst = (socket.inet_ntoa(p[16:20]), struct.unpack('!H', p[22:24])[0])
-    return src, dst
-
-
-def _udp_repack(p, src, dst):
-    addrs = socket.inet_aton(src[0]) + socket.inet_aton(dst[0])
-    ports = struct.pack('!HH', src[1], dst[1])
-    return p[:12] + addrs + ports + p[24:]
-
-
-_real_dns_server = [None]
-
-
-def _handle_diversion(divertsock, dnsport):
-    p, tag = divertsock.recvfrom(4096)
-    src, dst = _udp_unpack(p)
-    debug3('got diverted packet from %r to %r\n' % (src, dst))
-    if dst[1] == 53:
-        # outgoing DNS
-        debug3('...packet is a DNS request.\n')
-        _real_dns_server[0] = dst
-        dst = ('127.0.0.1', dnsport)
-    elif src[1] == dnsport:
-        if islocal(src[0], divertsock.family):
-            debug3('...packet is a DNS response.\n')
-            src = _real_dns_server[0]
-    else:
-        log('weird?! unexpected divert from %r to %r\n' % (src, dst))
-        assert(0)
-    newp = _udp_repack(p, src, dst)
-    divertsock.sendto(newp, tag)
-
-
-def ipfw(*args):
-    argv = ['ipfw', '-q'] + list(args)
-    debug1('>> %s\n' % ' '.join(argv))
-    rv = ssubprocess.call(argv)
-    if rv:
-        raise Fatal('%r returned %d' % (argv, rv))
-
-
-class Method(BaseMethod):
-
-    def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):
-        # IPv6 not supported
-        if family not in [socket.AF_INET, ]:
-            raise Exception(
-                'Address family "%s" unsupported by ipfw method_name'
-                % family_to_string(family))
-        if udp:
-            raise Exception("UDP not supported by ipfw method_name")
-
-        sport = str(port)
-        xsport = str(port + 1)
-
-        # cleanup any existing rules
-        if ipfw_rule_exists(port):
-            ipfw('delete', sport)
-
-        while _changedctls:
-            name = _changedctls.pop()
-            oldval = _oldctls[name]
-            _sysctl_set(name, oldval)
-
-        if subnets or dnsport:
-            sysctl_set('net.inet.ip.fw.enable', 1)
-            changed = sysctl_set('net.inet.ip.scopedroute', 0, permanent=True)
-            if changed:
-                log("\n"
-                    "        WARNING: ONE-TIME NETWORK DISRUPTION:\n"
-                    "        =====================================\n"
-                    "sshuttle has changed a MacOS kernel setting to work around\n"
-                    "a bug in MacOS 10.6.  This will cause your network to drop\n"
-                    "within 5-10 minutes unless you restart your network\n"
-                    "interface (change wireless networks or unplug/plug the\n"
-                    "ethernet port) NOW, then restart sshuttle.  The fix is\n"
-                    "permanent; you only have to do this once.\n\n")
-                sys.exit(1)
-
-            ipfw('add', sport, 'check-state', 'ip',
-                 'from', 'any', 'to', 'any')
-
-        if subnets:
-            # create new subnet entries
-            for f, swidth, sexclude, snet \
-                    in sorted(subnets, key=lambda s: s[1], reverse=True):
-                if sexclude:
-                    ipfw('add', sport, 'skipto', xsport,
-                         'tcp',
-                         'from', 'any', 'to', '%s/%s' % (snet, swidth))
-                else:
-                    ipfw('add', sport, 'fwd', '127.0.0.1,%d' % port,
-                         'tcp',
-                         'from', 'any', 'to', '%s/%s' % (snet, swidth),
-                         'not', 'ipttl', '42', 'keep-state', 'setup')
-
-        # This part is much crazier than it is on Linux, because MacOS (at
-        # least 10.6, and probably other versions, and maybe FreeBSD too)
-        # doesn't correctly fixup the dstip/dstport for UDP packets when it
-        # puts them through a 'fwd' rule.  It also doesn't fixup the
-        # srcip/srcport in the response packet.  In Linux iptables, all that
-        # happens magically for us, so we just redirect the packets and relax.
-        #
-        # On MacOS, we have to fix the ports ourselves.  For that, we use a
-        # 'divert' socket, which receives raw packets and lets us mangle them.
-        #
-        # Here's how it works.  Let's say the local DNS server is 1.1.1.1:53,
-        # and the remote DNS server is 2.2.2.2:53, and the local transproxy
-        # port is 10.0.0.1:12300, and a client machine is making a request from
-        # 10.0.0.5:9999. We see a packet like this:
-        #    10.0.0.5:9999 -> 1.1.1.1:53
-        # Since the destip:port matches one of our local nameservers, it will
-        # match a 'fwd' rule, thus grabbing it on the local machine.  However,
-        # the local kernel will then see a packet addressed to *:53 and not
-        # know what to do with it; there's nobody listening on port 53.  Thus,
-        # we divert it, rewriting it into this:
-        #    10.0.0.5:9999 -> 10.0.0.1:12300
-        # This gets proxied out to the server, which sends it to 2.2.2.2:53,
-        # and the answer comes back, and the proxy sends it back out like this:
-        #    10.0.0.1:12300 -> 10.0.0.5:9999
-        # But that's wrong!  The original machine expected an answer from
-        # 1.1.1.1:53, so we have to divert the *answer* and rewrite it:
-        #    1.1.1.1:53 -> 10.0.0.5:9999
-        #
-        # See?  Easy stuff.
-        if dnsport:
-            divertsock = socket.socket(socket.AF_INET, socket.SOCK_RAW,
-                                       IPPROTO_DIVERT)
-            divertsock.bind(('0.0.0.0', port))  # IP field is ignored
-
-            for f, ip in [i for i in nslist if i[0] == family]:
-                # relabel and then catch outgoing DNS requests
-                ipfw('add', sport, 'divert', sport,
-                     'udp',
-                     'from', 'any', 'to', '%s/32' % ip, '53',
-                     'not', 'ipttl', '42')
-            # relabel DNS responses
-            ipfw('add', sport, 'divert', sport,
-                 'udp',
-                 'from', 'any', str(dnsport), 'to', 'any',
-                 'not', 'ipttl', '42')
-
-            def do_wait():
-                while 1:
-                    r, w, x = select.select([sys.stdin, divertsock], [], [])
-                    if divertsock in r:
-                        _handle_diversion(divertsock, dnsport)
-                    if sys.stdin in r:
-                        return
-        else:
-            do_wait = None
-
-        return do_wait

sshuttle/methods/nat.py

@@ -31,19 +31,13 @@ class Method(BaseMethod):
         chain = 'sshuttle-%s' % port
 
         # basic cleanup/setup of chains
-        if ipt_chain_exists(family, table, chain):
-            nonfatal(_ipt, '-D', 'OUTPUT', '-j', chain)
-            nonfatal(_ipt, '-D', 'PREROUTING', '-j', chain)
-            nonfatal(_ipt, '-F', chain)
-            _ipt('-X', chain)
+        self.restore_firewall(port, family, udp)
 
-        if subnets or dnsport:
         _ipt('-N', chain)
         _ipt('-F', chain)
         _ipt('-I', 'OUTPUT', '1', '-j', chain)
         _ipt('-I', 'PREROUTING', '1', '-j', chain)
 
-        if subnets:
         # create new subnet entries.  Note that we're sorting in a very
         # particular order: we need to go from most-specific (largest
         # swidth) to least-specific, and at any given level of specificity,
@@ -61,10 +55,35 @@ class Method(BaseMethod):
                          '-p', 'tcp',
                          '--to-ports', str(port))
 
-        if dnsport:
         for f, ip in [i for i in nslist if i[0] == family]:
             _ipt_ttl('-A', chain, '-j', 'REDIRECT',
                      '--dest', '%s/32' % ip,
                      '-p', 'udp',
                      '--dport', '53',
                      '--to-ports', str(dnsport))
+
+    def restore_firewall(self, port, family, udp):
+        # only ipv4 supported with NAT
+        if family != socket.AF_INET:
+            raise Exception(
+                'Address family "%s" unsupported by nat method_name'
+                % family_to_string(family))
+        if udp:
+            raise Exception("UDP not supported by nat method_name")
+
+        table = "nat"
+
+        def _ipt(*args):
+            return ipt(family, table, *args)
+
+        def _ipt_ttl(*args):
+            return ipt_ttl(family, table, *args)
+
+        chain = 'sshuttle-%s' % port
+
+        # basic cleanup/setup of chains
+        if ipt_chain_exists(family, table, chain):
+            nonfatal(_ipt, '-D', 'OUTPUT', '-j', chain)
+            nonfatal(_ipt, '-D', 'PREROUTING', '-j', chain)
+            nonfatal(_ipt, '-F', chain)
+            _ipt('-X', chain)

sshuttle/methods/pf.py

@@ -7,7 +7,7 @@ import subprocess as ssubprocess
 from fcntl import ioctl
 from ctypes import c_char, c_uint8, c_uint16, c_uint32, Union, Structure, \
     sizeof, addressof, memmove
-from sshuttle.helpers import debug1, debug2, Fatal, family_to_string
+from sshuttle.helpers import debug1, debug2, debug3, Fatal, family_to_string
 from sshuttle.methods import BaseMethod
 
 
@@ -24,15 +24,27 @@ def pfctl(args, stdin=None):
 
     return o
 
-_pf_context = {'started_by_sshuttle': False, 'Xtoken': ''}
+_pf_context = {'started_by_sshuttle': False, 'Xtoken': None}
+_pf_fd = None
 
 
+class OsDefs(object):
+
+    def __init__(self, platform=None):
+        if platform is None:
+            platform = sys.platform
+        self.platform = platform
+
         # This are some classes and functions used to support pf in yosemite.
+        if platform == 'darwin':
             class pf_state_xport(Union):
                 _fields_ = [("port", c_uint16),
                             ("call_id", c_uint16),
                             ("spi", c_uint32)]
-
+        else:
+            class pf_state_xport(Union):
+                _fields_ = [("port", c_uint16),
+                            ("call_id", c_uint16)]
 
         class pf_addr(Structure):
 
@@ -46,7 +58,6 @@ class pf_addr(Structure):
             _fields_ = [("pfa",               _pfa)]
             _anonymous_ = ("pfa",)
 
-
         class pfioc_natlook(Structure):
             _fields_ = [("saddr", pf_addr),
                         ("daddr", pf_addr),
@@ -60,29 +71,39 @@ class pfioc_natlook(Structure):
                         ("proto", c_uint8),
                         ("proto_variant", c_uint8),
                         ("direction", c_uint8)]
+        self.pfioc_natlook = pfioc_natlook
 
-pfioc_rule = c_char * 3104  # sizeof(struct pfioc_rule)
+        # sizeof(struct pfioc_rule)
+        self.pfioc_rule = c_char * \
+            (3104 if platform == 'darwin' else 3040)
 
-pfioc_pooladdr = c_char * 1136  # sizeof(struct pfioc_pooladdr)
+        # sizeof(struct pfioc_pooladdr)
+        self.pfioc_pooladdr = c_char * 1136
 
-MAXPATHLEN = 1024
+        self.MAXPATHLEN = 1024
 
-DIOCNATLOOK = ((0x40000000 | 0x80000000) | (
-    (sizeof(pfioc_natlook) & 0x1fff) << 16) | ((ord('D')) << 8) | (23))
-DIOCCHANGERULE = ((0x40000000 | 0x80000000) | (
-    (sizeof(pfioc_rule) & 0x1fff) << 16) | ((ord('D')) << 8) | (26))
-DIOCBEGINADDRS = ((0x40000000 | 0x80000000) | (
-    (sizeof(pfioc_pooladdr) & 0x1fff) << 16) | ((ord('D')) << 8) | (51))
+        self.DIOCNATLOOK = (
+            (0x40000000 | 0x80000000) |
+            ((sizeof(pfioc_natlook) & 0x1fff) << 16) |
+            ((ord('D')) << 8) | (23))
+        self.DIOCCHANGERULE = (
+            (0x40000000 | 0x80000000) |
+            ((sizeof(self.pfioc_rule) & 0x1fff) << 16) |
+            ((ord('D')) << 8) | (26))
+        self.DIOCBEGINADDRS = (
+            (0x40000000 | 0x80000000) |
+            ((sizeof(self.pfioc_pooladdr) & 0x1fff) << 16) |
+            ((ord('D')) << 8) | (51))
 
-PF_CHANGE_ADD_TAIL = 2
-PF_CHANGE_GET_TICKET = 6
+        self.PF_CHANGE_ADD_TAIL = 2
+        self.PF_CHANGE_GET_TICKET = 6
 
-PF_PASS = 0
-PF_RDR = 8
+        self.PF_PASS = 0
+        self.PF_RDR = 8
 
-PF_OUT = 2
+        self.PF_OUT = 2
 
-_pf_fd = None
+osdefs = OsDefs()
 
 
 def pf_get_dev():
@@ -103,16 +124,16 @@ def pf_query_nat(family, proto, src_ip, src_port, dst_ip, dst_port):
     assert len(packed_src_ip) == len(packed_dst_ip)
     length = len(packed_src_ip)
 
-    pnl = pfioc_natlook()
+    pnl = osdefs.pfioc_natlook()
     pnl.proto = proto
-    pnl.direction = PF_OUT
+    pnl.direction = osdefs.PF_OUT
     pnl.af = family
     memmove(addressof(pnl.saddr), packed_src_ip, length)
-    pnl.sxport.port = socket.htons(src_port)
     memmove(addressof(pnl.daddr), packed_dst_ip, length)
+    pnl.sxport.port = socket.htons(src_port)
     pnl.dxport.port = socket.htons(dst_port)
 
-    ioctl(pf_get_dev(), DIOCNATLOOK,
+    ioctl(pf_get_dev(), osdefs.DIOCNATLOOK,
           (c_char * sizeof(pnl)).from_address(addressof(pnl)))
 
     ip = socket.inet_ntop(
@@ -125,26 +146,26 @@ def pf_add_anchor_rule(type, name):
     ACTION_OFFSET = 0
     POOL_TICKET_OFFSET = 8
     ANCHOR_CALL_OFFSET = 1040
-    RULE_ACTION_OFFSET = 3068
+    RULE_ACTION_OFFSET = 3068 if osdefs.platform == 'darwin' else 2968
 
-    pr = pfioc_rule()
-    ppa = pfioc_pooladdr()
+    pr = osdefs.pfioc_rule()
+    ppa = osdefs.pfioc_pooladdr()
 
-    ioctl(pf_get_dev(), DIOCBEGINADDRS, ppa)
+    ioctl(pf_get_dev(), osdefs.DIOCBEGINADDRS, ppa)
 
     memmove(addressof(pr) + POOL_TICKET_OFFSET, ppa[4:8], 4)  # pool_ticket
     memmove(addressof(pr) + ANCHOR_CALL_OFFSET, name,
-            min(MAXPATHLEN, len(name)))  # anchor_call = name
+            min(osdefs.MAXPATHLEN, len(name)))  # anchor_call = name
     memmove(addressof(pr) + RULE_ACTION_OFFSET,
             struct.pack('I', type), 4)  # rule.action = type
 
     memmove(addressof(pr) + ACTION_OFFSET, struct.pack(
-        'I', PF_CHANGE_GET_TICKET), 4)  # action = PF_CHANGE_GET_TICKET
-    ioctl(pf_get_dev(), DIOCCHANGERULE, pr)
+        'I', osdefs.PF_CHANGE_GET_TICKET), 4)  # action = PF_CHANGE_GET_TICKET
+    ioctl(pf_get_dev(), osdefs.DIOCCHANGERULE, pr)
 
     memmove(addressof(pr) + ACTION_OFFSET, struct.pack(
-        'I', PF_CHANGE_ADD_TAIL), 4)  # action = PF_CHANGE_ADD_TAIL
-    ioctl(pf_get_dev(), DIOCCHANGERULE, pr)
+        'I', osdefs.PF_CHANGE_ADD_TAIL), 4)  # action = PF_CHANGE_ADD_TAIL
+    ioctl(pf_get_dev(), osdefs.DIOCCHANGERULE, pr)
 
 
 class Method(BaseMethod):
@@ -156,19 +177,20 @@ class Method(BaseMethod):
         proxy = sock.getsockname()
 
         argv = (sock.family, socket.IPPROTO_TCP,
-                peer[0], peer[1], proxy[0], proxy[1])
-        pfile.write("QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % argv)
+                peer[0].encode("ASCII"), peer[1],
+                proxy[0].encode("ASCII"), proxy[1])
+        out_line = b"QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % argv
+        pfile.write(out_line)
         pfile.flush()
-        line = pfile.readline()
-        debug2("QUERY_PF_NAT %d,%d,%s,%d,%s,%d" % argv + ' > ' + line)
-        if line.startswith('QUERY_PF_NAT_SUCCESS '):
-            (ip, port) = line[21:].split(',')
-            return (ip, int(port))
+        in_line = pfile.readline()
+        debug2(out_line.decode("ASCII") + ' > ' + in_line.decode("ASCII"))
+        if in_line.startswith(b'QUERY_PF_NAT_SUCCESS '):
+            (ip, port) = in_line[21:].split(b',')
+            return (ip.decode("ASCII"), int(port))
 
         return sock.getsockname()
 
     def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):
-        global _pf_started_by_sshuttle
         tables = []
         translating_rules = []
         filtering_rules = []
@@ -180,55 +202,70 @@ class Method(BaseMethod):
         if udp:
             raise Exception("UDP not supported by pf method_name")
 
-        if subnets:
+        if len(subnets) > 0:
             includes = []
             # If a given subnet is both included and excluded, list the
             # exclusion first; the table will ignore the second, opposite
             # definition
             for f, swidth, sexclude, snet in sorted(
                     subnets, key=lambda s: (s[1], s[2]), reverse=True):
-                includes.append("%s%s/%s" %
-                                ("!" if sexclude else "", snet, swidth))
+                includes.append(b"%s%s/%d" %
+                                (b"!" if sexclude else b"",
+                                    snet.encode("ASCII"),
+                                    swidth))
 
-            tables.append('table <forward_subnets> {%s}' % ','.join(includes))
+            tables.append(
+                b'table <forward_subnets> {%s}' % b','.join(includes))
             translating_rules.append(
-                'rdr pass on lo0 proto tcp '
-                'to <forward_subnets> -> 127.0.0.1 port %r' % port)
+                b'rdr pass on lo0 proto tcp '
+                b'to <forward_subnets> -> 127.0.0.1 port %r' % port)
             filtering_rules.append(
-                'pass out route-to lo0 inet proto tcp '
-                'to <forward_subnets> keep state')
+                b'pass out route-to lo0 inet proto tcp '
+                b'to <forward_subnets> keep state')
 
-            if dnsport:
-                tables.append('table <dns_servers> {%s}' % ','.join(
-                    [ns[1] for ns in nslist]))
+        if len(nslist) > 0:
+            tables.append(
+                b'table <dns_servers> {%s}' %
+                b','.join([ns[1].encode("ASCII") for ns in nslist]))
             translating_rules.append(
-                    'rdr pass on lo0 proto udp to '
-                    '<dns_servers> port 53 -> 127.0.0.1 port %r' % dnsport)
+                b'rdr pass on lo0 proto udp to '
+                b'<dns_servers> port 53 -> 127.0.0.1 port %r' % dnsport)
             filtering_rules.append(
-                    'pass out route-to lo0 inet proto udp to '
-                    '<dns_servers> port 53 keep state')
+                b'pass out route-to lo0 inet proto udp to '
+                b'<dns_servers> port 53 keep state')
 
-            rules = '\n'.join(tables + translating_rules + filtering_rules) \
-                    + '\n'
+        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
+                + b'\n'
+        assert isinstance(rules, bytes)
+        debug3("rules:\n" + rules.decode("ASCII"))
 
         pf_status = pfctl('-s all')[0]
-            if '\nrdr-anchor "sshuttle" all\n' not in pf_status:
-                pf_add_anchor_rule(PF_RDR, "sshuttle")
-            if '\nanchor "sshuttle" all\n' not in pf_status:
-                pf_add_anchor_rule(PF_PASS, "sshuttle")
+        if b'\nrdr-anchor "sshuttle" all\n' not in pf_status:
+            pf_add_anchor_rule(osdefs.PF_RDR, b"sshuttle")
+        if b'\nanchor "sshuttle" all\n' not in pf_status:
+            pf_add_anchor_rule(osdefs.PF_PASS, b"sshuttle")
 
         pfctl('-a sshuttle -f /dev/stdin', rules)
-            if sys.platform == "darwin":
+        if osdefs.platform == "darwin":
             o = pfctl('-E')
             _pf_context['Xtoken'] = \
-                    re.search(r'Token : (.+)', o[1]).group(1)
-            elif 'INFO:\nStatus: Disabled' in pf_status:
+                re.search(b'Token : (.+)', o[1]).group(1)
+        elif b'INFO:\nStatus: Disabled' in pf_status:
             pfctl('-e')
             _pf_context['started_by_sshuttle'] = True
-        else:
+
+    def restore_firewall(self, port, family, udp):
+        if family != socket.AF_INET:
+            raise Exception(
+                'Address family "%s" unsupported by pf method_name'
+                % family_to_string(family))
+        if udp:
+            raise Exception("UDP not supported by pf method_name")
+
         pfctl('-a sshuttle -F all')
-            if sys.platform == "darwin":
-                pfctl('-X %s' % _pf_context['Xtoken'])
+        if osdefs.platform == "darwin":
+            if _pf_context['Xtoken'] is not None:
+                pfctl('-X %s' % _pf_context['Xtoken'].decode("ASCII"))
         elif _pf_context['started_by_sshuttle']:
             pfctl('-d')
 

sshuttle/methods/tproxy.py

@@ -105,7 +105,12 @@ class Method(BaseMethod):
     def get_supported_features(self):
         result = super(Method, self).get_supported_features()
         result.ipv6 = True
+        if recvmsg is None:
+            result.udp = False
+            result.dns = False
+        else:
             result.udp = True
+            result.dns = True
         return result
 
     def get_tcp_dstip(self, sock):
@@ -163,21 +168,8 @@ class Method(BaseMethod):
         divert_chain = 'sshuttle-d-%s' % port
 
         # basic cleanup/setup of chains
-        if ipt_chain_exists(family, table, mark_chain):
-            _ipt('-D', 'OUTPUT', '-j', mark_chain)
-            _ipt('-F', mark_chain)
-            _ipt('-X', mark_chain)
+        self.restore_firewall(port, family, udp)
 
-        if ipt_chain_exists(family, table, tproxy_chain):
-            _ipt('-D', 'PREROUTING', '-j', tproxy_chain)
-            _ipt('-F', tproxy_chain)
-            _ipt('-X', tproxy_chain)
-
-        if ipt_chain_exists(family, table, divert_chain):
-            _ipt('-F', divert_chain)
-            _ipt('-X', divert_chain)
-
-        if subnets or dnsport:
         _ipt('-N', mark_chain)
         _ipt('-F', mark_chain)
         _ipt('-N', divert_chain)
@@ -190,11 +182,11 @@ class Method(BaseMethod):
         _ipt('-A', divert_chain, '-j', 'ACCEPT')
         _ipt('-A', tproxy_chain, '-m', 'socket', '-j', divert_chain,
              '-m', 'tcp', '-p', 'tcp')
-        if subnets and udp:
+
+        if udp:
             _ipt('-A', tproxy_chain, '-m', 'socket', '-j', divert_chain,
                  '-m', 'udp', '-p', 'udp')
 
-        if dnsport:
         for f, ip in [i for i in nslist if i[0] == family]:
             _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',
                  '--dest', '%s/32' % ip,
@@ -205,7 +197,6 @@ class Method(BaseMethod):
                  '-m', 'udp', '-p', 'udp', '--dport', '53',
                  '--on-port', str(dnsport))
 
-        if subnets:
         for f, swidth, sexclude, snet \
                 in sorted(subnets, key=lambda s: s[1], reverse=True):
             if sexclude:
@@ -225,14 +216,15 @@ class Method(BaseMethod):
                      '-m', 'tcp', '-p', 'tcp',
                      '--on-port', str(port))
 
-                if sexclude and udp:
+            if udp:
+                if sexclude:
                     _ipt('-A', mark_chain, '-j', 'RETURN',
                          '--dest', '%s/%s' % (snet, swidth),
                          '-m', 'udp', '-p', 'udp')
                     _ipt('-A', tproxy_chain, '-j', 'RETURN',
                          '--dest', '%s/%s' % (snet, swidth),
                          '-m', 'udp', '-p', 'udp')
-                elif udp:
+                else:
                     _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',
                          '--dest', '%s/%s' % (snet, swidth),
                          '-m', 'udp', '-p', 'udp')
@@ -242,15 +234,35 @@ class Method(BaseMethod):
                          '-m', 'udp', '-p', 'udp',
                          '--on-port', str(port))
 
-    def check_settings(self, udp, dns):
-        if udp and recvmsg is None:
-            Fatal("tproxy UDP support requires recvmsg function.\n")
+    def restore_firewall(self, port, family, udp):
+        if family not in [socket.AF_INET, socket.AF_INET6]:
+            raise Exception(
+                'Address family "%s" unsupported by tproxy method'
+                % family_to_string(family))
 
-        if dns and recvmsg is None:
-            Fatal("tproxy DNS support requires recvmsg function.\n")
+        table = "mangle"
 
-        if udp:
-            debug1("tproxy UDP support enabled.\n")
+        def _ipt(*args):
+            return ipt(family, table, *args)
 
-        if dns:
-            debug1("tproxy DNS support enabled.\n")
+        def _ipt_ttl(*args):
+            return ipt_ttl(family, table, *args)
+
+        mark_chain = 'sshuttle-m-%s' % port
+        tproxy_chain = 'sshuttle-t-%s' % port
+        divert_chain = 'sshuttle-d-%s' % port
+
+        # basic cleanup/setup of chains
+        if ipt_chain_exists(family, table, mark_chain):
+            _ipt('-D', 'OUTPUT', '-j', mark_chain)
+            _ipt('-F', mark_chain)
+            _ipt('-X', mark_chain)
+
+        if ipt_chain_exists(family, table, tproxy_chain):
+            _ipt('-D', 'PREROUTING', '-j', tproxy_chain)
+            _ipt('-F', tproxy_chain)
+            _ipt('-X', tproxy_chain)
+
+        if ipt_chain_exists(family, table, divert_chain):
+            _ipt('-F', divert_chain)
+            _ipt('-X', divert_chain)

sshuttle/server.py

@@ -5,6 +5,7 @@ import traceback
 import time
 import sys
 import os
+import platform
 
 import sshuttle.ssnet as ssnet
 import sshuttle.helpers as helpers
@@ -16,22 +17,23 @@ from sshuttle.helpers import log, debug1, debug2, debug3, Fatal, \
 
 
 def _ipmatch(ipstr):
-    if ipstr == 'default':
-        ipstr = '0.0.0.0/0'
-    m = re.match(r'^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
+    if ipstr == b'default':
+        ipstr = b'0.0.0.0/0'
+    m = re.match(b'^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
     if m:
         g = m.groups()
         ips = g[0]
         width = int(g[4] or 32)
         if g[1] is None:
-            ips += '.0.0.0'
+            ips += b'.0.0.0'
             width = min(width, 8)
         elif g[2] is None:
-            ips += '.0.0'
+            ips += b'.0.0'
             width = min(width, 16)
         elif g[3] is None:
-            ips += '.0'
+            ips += b'.0'
             width = min(width, 24)
+        ips = ips.decode("ASCII")
         return (struct.unpack('!I', socket.inet_aton(ips))[0], width)
 
 
@@ -56,11 +58,12 @@ def _shl(n, bits):
 
 
 def _list_routes():
+    # FIXME: IPv4 only
     argv = ['netstat', '-rn']
     p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
     routes = []
     for line in p.stdout:
-        cols = re.split(r'\s+', line)
+        cols = re.split(b'\s+', line)
         ipw = _ipmatch(cols[0])
         if not ipw:
             continue  # some lines won't be parseable; never mind
@@ -214,6 +217,9 @@ class UdpProxy(Handler):
 
 
 def main(latency_control):
+    debug1('Starting server with Python version %s\n'
+           % platform.python_version())
+
     if helpers.verbose >= 1:
         helpers.logprefix = ' s: '
     else:
@@ -235,26 +241,26 @@ def main(latency_control):
               socket.fromfd(sys.stdout.fileno(),
                             socket.AF_INET, socket.SOCK_STREAM))
     handlers.append(mux)
-    routepkt = ''
+    routepkt = b''
     for r in routes:
-        routepkt += '%d,%s,%d\n' % r
+        routepkt += b'%d,%s,%d\n' % (r[0], r[1].encode("ASCII"), r[2])
     mux.send(0, ssnet.CMD_ROUTES, routepkt)
 
     hw = Hostwatch()
-    hw.leftover = ''
+    hw.leftover = b''
 
     def hostwatch_ready(sock):
         assert(hw.pid)
         content = hw.sock.recv(4096)
         if content:
-            lines = (hw.leftover + content).split('\n')
+            lines = (hw.leftover + content).split(b'\n')
             if lines[-1]:
                 # no terminating newline: entry isn't complete yet!
                 hw.leftover = lines.pop()
                 lines.append('')
             else:
-                hw.leftover = ''
-            mux.send(0, ssnet.CMD_HOST_LIST, '\n'.join(lines))
+                hw.leftover = b''
+            mux.send(0, ssnet.CMD_HOST_LIST, b'\n'.join(lines))
         else:
             raise Fatal('hostwatch process died')
 
@@ -266,7 +272,7 @@ def main(latency_control):
     mux.got_host_req = got_host_req
 
     def new_channel(channel, data):
-        (family, dstip, dstport) = data.split(',', 2)
+        (family, dstip, dstport) = data.split(b',', 2)
         family = int(family)
         dstport = int(dstport)
         outwrap = ssnet.connect_dst(family, dstip, dstport)
@@ -324,14 +330,20 @@ def main(latency_control):
 
         if dnshandlers:
             now = time.time()
-            for channel, h in list(dnshandlers.items()):
+            remove = []
+            for channel, h in dnshandlers.items():
                 if h.timeout < now or not h.ok:
                     debug3('expiring dnsreqs channel=%d\n' % channel)
-                    del dnshandlers[channel]
+                    remove.append(channel)
                     h.ok = False
+            for channel in remove:
+                del dnshandlers[channel]
         if udphandlers:
-            for channel, h in list(udphandlers.items()):
+            remove = []
+            for channel, h in udphandlers.items():
                 if not h.ok:
                     debug3('expiring UDP channel=%d\n' % channel)
-                    del udphandlers[channel]
+                    remove.append(channel)
                     h.ok = False
+            for channel in remove:
+                del udphandlers[channel]

sshuttle/ssh.py

@@ -91,7 +91,8 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
     pyscript = r"""
                 import sys;
                 verbosity=%d;
-                exec compile(sys.stdin.read(%d), "assembler.py", "exec")
+                stdin=getattr(sys.stdin,"buffer",sys.stdin);
+                exec(compile(stdin.read(%d), "assembler.py", "exec"))
                 """ % (helpers.verbose or 0, len(content))
     pyscript = re.sub(r'\s+', ' ', pyscript.strip())
 
@@ -107,7 +108,7 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
         if python:
             pycmd = "'%s' -c '%s'" % (python, pyscript)
         else:
-            pycmd = ("P=python2; $P -V 2>/dev/null || P=python; "
+            pycmd = ("P=python3.5; $P -V 2>/dev/null || P=python; "
                      "exec \"$P\" -c '%s'") % pyscript
         argv = (sshl +
                 portl +

sshuttle/tests/test_firewall.py

@@ -1,9 +1,5 @@
 from mock import Mock, patch, call
 import io
-import os
-import os.path
-import shutil
-import filecmp
 
 import sshuttle.firewall
 
@@ -19,27 +15,27 @@ NSLIST
 10,2404:6800:4004:80c::33
 PORTS 1024,1025,1026,1027
 GO 1
+HOST 1.2.3.3,existing
 """)
     stdout = Mock()
     return stdin, stdout
 
 
-@patch('sshuttle.firewall.HOSTSFILE', new='tmp/hosts')
-@patch('sshuttle.firewall.hostmap', new={
+def test_rewrite_etc_hosts(tmpdir):
+    orig_hosts = tmpdir.join("hosts.orig")
+    orig_hosts.write("1.2.3.3 existing\n")
+
+    new_hosts = tmpdir.join("hosts")
+    orig_hosts.copy(new_hosts)
+
+    hostmap = {
         'myhost': '1.2.3.4',
         'myotherhost': '1.2.3.5',
-})
-def test_rewrite_etc_hosts():
-    if not os.path.isdir("tmp"):
-        os.mkdir("tmp")
+    }
+    with patch('sshuttle.firewall.HOSTSFILE', new=str(new_hosts)):
+        sshuttle.firewall.rewrite_etc_hosts(hostmap, 10)
 
-    with open("tmp/hosts.orig", "w") as f:
-        f.write("1.2.3.3 existing\n")
-
-    shutil.copyfile("tmp/hosts.orig", "tmp/hosts")
-
-    sshuttle.firewall.rewrite_etc_hosts(10)
-    with open("tmp/hosts") as f:
+    with new_hosts.open() as f:
         line = f.readline()
         s = line.split()
         assert s == ['1.2.3.3', 'existing']
@@ -57,39 +53,37 @@ def test_rewrite_etc_hosts():
         line = f.readline()
         assert line == ""
 
+    with patch('sshuttle.firewall.HOSTSFILE', new=str(new_hosts)):
         sshuttle.firewall.restore_etc_hosts(10)
-    assert filecmp.cmp("tmp/hosts.orig", "tmp/hosts", shallow=False) is True
+    assert orig_hosts.computehash() == new_hosts.computehash()
 
 
-@patch('sshuttle.firewall.HOSTSFILE', new='tmp/hosts')
+@patch('sshuttle.firewall.rewrite_etc_hosts')
 @patch('sshuttle.firewall.setup_daemon')
 @patch('sshuttle.firewall.get_method')
-def test_main(mock_get_method, mock_setup_daemon):
+def test_main(mock_get_method, mock_setup_daemon, mock_rewrite_etc_hosts):
     stdin, stdout = setup_daemon()
     mock_setup_daemon.return_value = stdin, stdout
 
-    if not os.path.isdir("tmp"):
-        os.mkdir("tmp")
+    mock_get_method("not_auto").name = "test"
+    mock_get_method.reset_mock()
 
-    sshuttle.firewall.main("test", False)
+    sshuttle.firewall.main("not_auto", False)
 
-    with open("tmp/hosts") as f:
-        line = f.readline()
-        s = line.split()
-        assert s == ['1.2.3.3', 'existing']
+    assert mock_rewrite_etc_hosts.mock_calls == [
+        call({'1.2.3.3': 'existing'}, 1024),
+        call({}, 1024),
+    ]
 
-        line = f.readline()
-        assert line == ""
-
-    stdout.mock_calls == [
+    assert stdout.mock_calls == [
         call.write('READY test\n'),
         call.flush(),
         call.write('STARTED\n'),
         call.flush()
     ]
-    mock_setup_daemon.mock_calls == [call()]
-    mock_get_method.mock_calls == [
-        call('test'),
+    assert mock_setup_daemon.mock_calls == [call()]
+    assert mock_get_method.mock_calls == [
+        call('not_auto'),
         call().setup_firewall(
             1024, 1026,
             [(10, u'2404:6800:4004:80c::33')],
@@ -103,7 +97,6 @@ def test_main(mock_get_method, mock_setup_daemon):
             2,
             [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
             True),
-        call().setup_firewall()(),
-        call().setup_firewall(1024, 0, [], 10, [], True),
-        call().setup_firewall(1025, 0, [], 2, [], True),
+        call().restore_firewall(1024, 10, True),
+        call().restore_firewall(1025, 2, True),
     ]

sshuttle/tests/test_helpers.py

@@ -11,12 +11,32 @@ import sshuttle.helpers
 @patch('sshuttle.helpers.sys.stderr')
 def test_log(mock_stderr, mock_stdout):
     sshuttle.helpers.log("message")
+    sshuttle.helpers.log("abc")
+    sshuttle.helpers.log("message 1\n")
+    sshuttle.helpers.log("message 2\nline2\nline3\n")
+    sshuttle.helpers.log("message 3\nline2\nline3")
     assert mock_stdout.mock_calls == [
         call.flush(),
+        call.flush(),
+        call.flush(),
+        call.flush(),
+        call.flush(),
     ]
     assert mock_stderr.mock_calls == [
         call.write('prefix: message'),
         call.flush(),
+        call.write('prefix: abc'),
+        call.flush(),
+        call.write('prefix: message 1\n'),
+        call.flush(),
+        call.write('prefix: message 2\n'),
+        call.write('---> line2\n'),
+        call.write('---> line3\n'),
+        call.flush(),
+        call.write('prefix: message 3\n'),
+        call.write('---> line2\n'),
+        call.write('---> line3\n'),
+        call.flush(),
     ]
 
 

sshuttle/tests/test_methods_nat.py

@@ -3,6 +3,7 @@ from mock import Mock, patch, call
 import socket
 import struct
 
+from sshuttle.helpers import Fatal
 from sshuttle.methods import get_method
 
 
@@ -11,6 +12,7 @@ def test_get_supported_features():
     features = method.get_supported_features()
     assert not features.ipv6
     assert not features.udp
+    assert features.dns
 
 
 def test_get_tcp_dstip():
@@ -52,10 +54,18 @@ def test_setup_udp_listener():
     assert listener.mock_calls == []
 
 
-def test_check_settings():
+def test_assert_features():
     method = get_method('nat')
-    method.check_settings(True, True)
-    method.check_settings(False, True)
+    features = method.get_supported_features()
+    method.assert_features(features)
+
+    features.udp = True
+    with pytest.raises(Fatal):
+        method.assert_features(features)
+
+    features.ipv6 = True
+    with pytest.raises(Fatal):
+        method.assert_features(features)
 
 
 def test_firewall_command():
@@ -129,7 +139,7 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
     mock_ipt_ttl.reset_mock()
     mock_ipt.reset_mock()
 
-    method.setup_firewall(1025, 0, [], 2, [], False)
+    method.restore_firewall(1025, 2, False)
     assert mock_ipt_chain_exists.mock_calls == [
         call(2, 'nat', 'sshuttle-1025')
     ]

sshuttle/tests/test_methods_pf.py

@@ -3,6 +3,8 @@ from mock import Mock, patch, call, ANY
 import socket
 
 from sshuttle.methods import get_method
+from sshuttle.helpers import Fatal
+from sshuttle.methods.pf import OsDefs
 
 
 def test_get_supported_features():
@@ -10,8 +12,10 @@ def test_get_supported_features():
     features = method.get_supported_features()
     assert not features.ipv6
     assert not features.udp
+    assert features.dns
 
 
+@patch('sshuttle.helpers.verbose', new=3)
 def test_get_tcp_dstip():
     sock = Mock()
     sock.getpeername.return_value = ("127.0.0.1", 1024)
@@ -20,7 +24,7 @@ def test_get_tcp_dstip():
 
     firewall = Mock()
     firewall.pfile.readline.return_value = \
-        "QUERY_PF_NAT_SUCCESS 127.0.0.3,1026\n"
+        b"QUERY_PF_NAT_SUCCESS 127.0.0.3,1026\n"
 
     method = get_method('pf')
     method.set_firewall(firewall)
@@ -31,7 +35,7 @@ def test_get_tcp_dstip():
         call.getsockname(),
     ]
     assert firewall.mock_calls == [
-        call.pfile.write('QUERY_PF_NAT 2,6,127.0.0.1,1024,127.0.0.2,1025\n'),
+        call.pfile.write(b'QUERY_PF_NAT 2,6,127.0.0.1,1024,127.0.0.2,1025\n'),
         call.pfile.flush(),
         call.pfile.readline()
     ]
@@ -67,16 +71,25 @@ def test_setup_udp_listener():
     assert listener.mock_calls == []
 
 
-def test_check_settings():
+def test_assert_features():
     method = get_method('pf')
-    method.check_settings(True, True)
-    method.check_settings(False, True)
+    features = method.get_supported_features()
+    method.assert_features(features)
+
+    features.udp = True
+    with pytest.raises(Fatal):
+        method.assert_features(features)
+
+    features.ipv6 = True
+    with pytest.raises(Fatal):
+        method.assert_features(features)
 
 
+@patch('sshuttle.methods.pf.osdefs', OsDefs('darwin'))
 @patch('sshuttle.methods.pf.sys.stdout')
 @patch('sshuttle.methods.pf.ioctl')
 @patch('sshuttle.methods.pf.pf_get_dev')
-def test_firewall_command(mock_pf_get_dev, mock_ioctl, mock_stdout):
+def test_firewall_command_darwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
     method = get_method('pf')
     assert not method.firewall_command("somthing")
 
@@ -87,7 +100,7 @@ def test_firewall_command(mock_pf_get_dev, mock_ioctl, mock_stdout):
 
     assert mock_pf_get_dev.mock_calls == [call()]
     assert mock_ioctl.mock_calls == [
-        call(mock_pf_get_dev(), 3226747927, ANY),
+        call(mock_pf_get_dev(), 0xc0544417, ANY),
     ]
     assert mock_stdout.mock_calls == [
         call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
@@ -95,13 +108,46 @@ def test_firewall_command(mock_pf_get_dev, mock_ioctl, mock_stdout):
     ]
 
 
-# FIXME - test fails with platform=='darwin' due re.search not liking Mock
-# objects.
-@patch('sshuttle.methods.pf.sys.platform', 'not_darwin')
+@patch('sshuttle.methods.pf.osdefs', OsDefs('notdarwin'))
+@patch('sshuttle.methods.pf.sys.stdout')
+@patch('sshuttle.methods.pf.ioctl')
+@patch('sshuttle.methods.pf.pf_get_dev')
+def test_firewall_command_notdarwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
+    method = get_method('pf')
+    assert not method.firewall_command("somthing")
+
+    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
+        socket.AF_INET, socket.IPPROTO_TCP,
+        "127.0.0.1", 1025, "127.0.0.2", 1024)
+    assert method.firewall_command(command)
+
+    assert mock_pf_get_dev.mock_calls == [call()]
+    assert mock_ioctl.mock_calls == [
+        call(mock_pf_get_dev(), 0xc04c4417, ANY),
+    ]
+    assert mock_stdout.mock_calls == [
+        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
+        call.flush(),
+    ]
+
+
+def pfctl(args, stdin=None):
+    if args == '-s all':
+        return (b'INFO:\nStatus: Disabled\nanother mary had a little lamb\n',
+                b'little lamb\n')
+    if args == '-E':
+        return (b'\n', b'Token : abcdefg\n')
+    return None
+
+
+@patch('sshuttle.helpers.verbose', new=3)
+@patch('sshuttle.methods.pf.osdefs', OsDefs('darwin'))
 @patch('sshuttle.methods.pf.pfctl')
 @patch('sshuttle.methods.pf.ioctl')
 @patch('sshuttle.methods.pf.pf_get_dev')
-def test_setup_firewall(mock_pf_get_dev, mock_ioctl, mock_pfctl):
+def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
+    mock_pfctl.side_effect = pfctl
+
     method = get_method('pf')
     assert method.name == 'pf'
 
@@ -138,23 +184,119 @@ def test_setup_firewall(mock_pf_get_dev, mock_ioctl, mock_pfctl):
         [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
         False)
     assert mock_ioctl.mock_calls == [
-        call(mock_pf_get_dev(), 3295691827, ANY),
-        call(mock_pf_get_dev(), 3424666650, ANY),
-        call(mock_pf_get_dev(), 3424666650, ANY),
-        call(mock_pf_get_dev(), 3295691827, ANY),
-        call(mock_pf_get_dev(), 3424666650, ANY),
-        call(mock_pf_get_dev(), 3424666650, ANY),
+        call(mock_pf_get_dev(), 0xC4704433, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+        call(mock_pf_get_dev(), 0xC4704433, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+    ]
+    assert mock_pfctl.mock_calls == [
+        call('-s all'),
+        call('-a sshuttle -f /dev/stdin',
+             b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
+             b'table <dns_servers> {1.2.3.33}\n'
+             b'rdr pass on lo0 proto tcp '
+             b'to <forward_subnets> -> 127.0.0.1 port 1025\n'
+             b'rdr pass on lo0 proto udp '
+             b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
+             b'pass out route-to lo0 inet proto tcp '
+             b'to <forward_subnets> keep state\n'
+             b'pass out route-to lo0 inet proto udp '
+             b'to <dns_servers> port 53 keep state\n'),
+        call('-E'),
     ]
-    # FIXME - needs more work
-    # print(mock_pfctl.mock_calls)
-    # assert mock_pfctl.mock_calls == []
     mock_pf_get_dev.reset_mock()
     mock_ioctl.reset_mock()
     mock_pfctl.reset_mock()
 
-    method.setup_firewall(1025, 0, [], 2, [], False)
+    method.restore_firewall(1025, 2, False)
     assert mock_ioctl.mock_calls == []
-    assert mock_pfctl.mock_calls == [call('-a sshuttle -F all')]
+    assert mock_pfctl.mock_calls == [
+        call('-a sshuttle -F all'),
+        call("-X abcdefg"),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_pfctl.reset_mock()
+    mock_ioctl.reset_mock()
+
+
+@patch('sshuttle.helpers.verbose', new=3)
+@patch('sshuttle.methods.pf.osdefs', OsDefs('notdarwin'))
+@patch('sshuttle.methods.pf.pfctl')
+@patch('sshuttle.methods.pf.ioctl')
+@patch('sshuttle.methods.pf.pf_get_dev')
+def test_setup_firewall_notdarwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
+    mock_pfctl.side_effect = pfctl
+
+    method = get_method('pf')
+    assert method.name == 'pf'
+
+    with pytest.raises(Exception) as excinfo:
+        method.setup_firewall(
+            1024, 1026,
+            [(10, u'2404:6800:4004:80c::33')],
+            10,
+            [(10, 64, False, u'2404:6800:4004:80c::'),
+                (10, 128, True, u'2404:6800:4004:80c::101f')],
+            True)
+    assert str(excinfo.value) \
+        == 'Address family "AF_INET6" unsupported by pf method_name'
+    assert mock_pf_get_dev.mock_calls == []
+    assert mock_ioctl.mock_calls == []
+    assert mock_pfctl.mock_calls == []
+
+    with pytest.raises(Exception) as excinfo:
+        method.setup_firewall(
+            1025, 1027,
+            [(2, u'1.2.3.33')],
+            2,
+            [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+            True)
+    assert str(excinfo.value) == 'UDP not supported by pf method_name'
+    assert mock_pf_get_dev.mock_calls == []
+    assert mock_ioctl.mock_calls == []
+    assert mock_pfctl.mock_calls == []
+
+    method.setup_firewall(
+        1025, 1027,
+        [(2, u'1.2.3.33')],
+        2,
+        [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+        False)
+    assert mock_ioctl.mock_calls == [
+        call(mock_pf_get_dev(), 0xC4704433, ANY),
+        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
+        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
+        call(mock_pf_get_dev(), 0xC4704433, ANY),
+        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
+        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
+    ]
+    assert mock_pfctl.mock_calls == [
+        call('-s all'),
+        call('-a sshuttle -f /dev/stdin',
+             b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
+             b'table <dns_servers> {1.2.3.33}\n'
+             b'rdr pass on lo0 proto tcp '
+             b'to <forward_subnets> -> 127.0.0.1 port 1025\n'
+             b'rdr pass on lo0 proto udp '
+             b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
+             b'pass out route-to lo0 inet proto tcp '
+             b'to <forward_subnets> keep state\n'
+             b'pass out route-to lo0 inet proto udp '
+             b'to <dns_servers> port 53 keep state\n'),
+        call('-e'),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_ioctl.reset_mock()
+    mock_pfctl.reset_mock()
+
+    method.restore_firewall(1025, 2, False)
+    assert mock_ioctl.mock_calls == []
+    assert mock_pfctl.mock_calls == [
+        call('-a sshuttle -F all'),
+        call("-d"),
+    ]
     mock_pf_get_dev.reset_mock()
     mock_pfctl.reset_mock()
     mock_ioctl.reset_mock()

sshuttle/tests/test_methods_tproxy.py

@@ -3,11 +3,22 @@ from mock import Mock, patch, call
 from sshuttle.methods import get_method
 
 
-def test_get_supported_features():
+@patch("sshuttle.methods.tproxy.recvmsg")
+def test_get_supported_features_recvmsg(mock_recvmsg):
     method = get_method('tproxy')
     features = method.get_supported_features()
     assert features.ipv6
     assert features.udp
+    assert features.dns
+
+
+@patch("sshuttle.methods.tproxy.recvmsg", None)
+def test_get_supported_features_norecvmsg():
+    method = get_method('tproxy')
+    features = method.get_supported_features()
+    assert features.ipv6
+    assert not features.udp
+    assert not features.dns
 
 
 def test_get_tcp_dstip():
@@ -66,10 +77,10 @@ def test_setup_udp_listener():
     ]
 
 
-def test_check_settings():
+def test_assert_features():
     method = get_method('tproxy')
-    method.check_settings(True, True)
-    method.check_settings(False, True)
+    features = method.get_supported_features()
+    method.assert_features(features)
 
 
 def test_firewall_command():
@@ -160,7 +171,7 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
     mock_ipt_ttl.reset_mock()
     mock_ipt.reset_mock()
 
-    method.setup_firewall(1025, 0, [], 10, [], True)
+    method.restore_firewall(1025, 10, True)
     assert mock_ipt_chain_exists.mock_calls == [
         call(10, 'mangle', 'sshuttle-m-1025'),
         call(10, 'mangle', 'sshuttle-t-1025'),
@@ -250,7 +261,7 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
     mock_ipt_ttl.reset_mock()
     mock_ipt.reset_mock()
 
-    method.setup_firewall(1025, 0, [], 2, [], True)
+    method.restore_firewall(1025, 2, True)
     assert mock_ipt_chain_exists.mock_calls == [
         call(2, 'mangle', 'sshuttle-m-1025'),
         call(2, 'mangle', 'sshuttle-t-1025'),

tox.ini

@@ -0,0 +1,16 @@
+[tox]
+downloadcache = {toxworkdir}/cache/
+envlist =
+    py27,
+    py35,
+
+[testenv]
+basepython =
+    py27: python2.7
+    py35: python3.5
+commands =
+    py.test
+deps =
+    pytest
+    mock
+    setuptools>=17.1