Update changelog for 0.78.3

Get version for sphinx from sshuttle.version
Fix error in requirements.rst
2025-07-04 00:30:35 +02:00 · 2017-07-09 09:12:04 +10:00 · 2017-07-09 09:08:48 +10:00 · 2017-07-09 09:08:48 +10:00 · 2017-07-09 09:08:48 +10:00 · 2017-07-09 09:08:48 +10:00
58 changed files with 3698 additions and 1577 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,12 @@
 /sshuttle/version.py
 /tmp/
 /.cache/
 /.eggs/
 /.tox/
 /build/
 /dist/
 /sshuttle.egg-info/
 /docs/_build/
 *.pyc
 *~
 *.8
--- a/.travis.yml
+++ b/.travis.yml
@ -1,6 +1,8 @@
 language: python
 python:
 - 2.6
 - 2.7
 - 3.4
 - 3.5
 - pypy
--- a/CHANGES.rst
+++ b/CHANGES.rst
@ -1,11 +1,117 @@
-Release 0.75 (Jan 12, 2016)
+==========
-===========================
+Change log
 ==========
 All notable changes to this project will be documented in this file. The format
 is based on `Keep a Changelog`_ and this project
 adheres to `Semantic Versioning`_.
 .. _`Keep a Changelog`: http://keepachangelog.com/
 .. _`Semantic Versioning`: http://semver.org/
 0.78.3 - 2017-07-09
 -------------------
 The "I should have done a git pull" first release.
 Fixed
 ~~~~~
 * Order first by port range and only then by swidth
 0.78.2 - 2017-07-09
 -------------------
 Added
 ~~~~~
 * Adds support for tunneling specific port ranges (#144).
 * Add support for iproute2.
 * Allow remote hosts with colons in the username.
 * Re-introduce ipfw support for sshuttle on FreeBSD with support for --DNS option as well.
 * Add support for PfSense.
 * Tests and documentation for systemd integration.
 * Allow subnets to be given only by file (-s).
 Fixed
 ~~~~~
 * Work around non tabular headers in BSD netstat.
 * Fix UDP and DNS support on Python 2.7 with tproxy method.
 * Fixed tests after adding support for iproute2.
 * Small refactoring of netstat/iproute parsing.
 * Set started_by_sshuttle False after disabling pf.
 * Fix punctuation and explain Type=notify.
 * Move pytest-runner to tests_require.
 * Fix warning: closed channel got=STOP_SENDING.
 * Support sdnotify for better systemd integration.
 * Fix #117 to allow for no subnets via file (-s).
 * Fix argument splitting for multi-word arguments.
 * requirements.rst: Fix mistakes.
 * Fix typo, space not required here.
 * Update installation instructions.
 * Support using run from different directory.
 * Ensure we update sshuttle/version.py in run.
 * Don't print python version in run.
 * Add CWD to PYTHONPATH in run.
 0.78.1 - 2016-08-06
 -------------------
 * Fix readthedocs versioning.
 * Don't crash on ENETUNREACH.
 * Various bug fixes.
 * Improvements to BSD and OSX support.
 0.78.0 - 2016-04-08
 -------------------
 * Don't force IPv6 if IPv6 nameservers supplied. Fixes #74.
 * Call /bin/sh as users shell may not be POSIX compliant. Fixes #77.
 * Use argparse for command line processing. Fixes #75.
 * Remove useless --server option.
 * Support multiple -s (subnet) options. Fixes #86.
 * Make server parts work with old versions of Python. Fixes #81.
 0.77.2 - 2016-03-07
 -------------------
 * Accidentally switched LGPL2 license with GPL2 license in 0.77.1 - now fixed.
 0.77.1 - 2016-03-07
 -------------------
 * Use semantic versioning. http://semver.org/
 * Update GPL 2 license text.
 * New release to fix PyPI.
 0.77 - 2016-03-03
 -----------------
 * Various bug fixes.
 * Fix Documentation.
 * Add fix for MacOS X issue.
 * Add support for OpenBSD.
 0.76 - 2016-01-17
 -----------------
 * Add option to disable IPv6 support.
 * Update documentation.
 * Move documentation, including man page, to Sphinx.
 * Use setuptools-scm for automatic versioning.
 0.75 - 2016-01-12
 -----------------
 * Revert change that broke sshuttle entry point.
-Release 0.74 (Jan 10, 2016)
+0.74 - 2016-01-10
-===========================
+-----------------
 * Add CHANGES.rst file.
 * Numerous bug fixes.
--- a/20
+++ b/20
@ -1,15 +1,15 @@
-		  GNU LIBRARY GENERAL PUBLIC LICENSE
+                  GNU LIBRARY GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
+                       Version 2, June 1991
 Copyright (C) 1991 Free Software Foundation, Inc.
-                    675 Mass Ave, Cambridge, MA 02139, USA
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
 [This is the first released version of the library GPL.  It is
 numbered 2 because it goes with version 2 of the ordinary GPL.]
-			    Preamble
+                            Preamble
  The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@ -99,7 +99,7 @@ works together with the library.
  Note that it is possible for a library to be covered by the ordinary
 General Public License rather than by this special one.
-		  GNU LIBRARY GENERAL PUBLIC LICENSE
+                  GNU LIBRARY GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
  0. This License Agreement applies to any software library which
@ -411,7 +411,7 @@ decision will be guided by the two goals of preserving the free status
 of all derivatives of our free software and of promoting the sharing
 and reuse of software generally.
-			    NO WARRANTY
+                            NO WARRANTY
  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
 WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
@ -434,9 +434,9 @@ FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
 SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.
-		     END OF TERMS AND CONDITIONS
+                     END OF TERMS AND CONDITIONS
-     Appendix: How to Apply These Terms to Your New Libraries
+           How to Apply These Terms to Your New Libraries
  If you develop a new library, and you want it to be of the greatest
 possible use to the public, we recommend making it free software that
@ -463,8 +463,8 @@ convey the exclusion of warranty; and each file should have at least the
    Library General Public License for more details.
    You should have received a copy of the GNU Library General Public
-    License along with this library; if not, write to the Free
+    License along with this library; if not, write to the Free Software
-    Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 Also add information on how to contact you by electronic and paper mail.
--- a/MANIFEST.in
+++ b/MANIFEST.in
@ -2,4 +2,13 @@ include *.txt
 include *.rst
 include *.py
 include MANIFEST.in
 include LICENSE
 include run
 include tox.ini
 exclude sshuttle/version.py
 recursive-include docs *.bat
 recursive-include docs *.py
 recursive-include docs *.rst
 recursive-include docs Makefile
 recursive-include sshuttle *.py
 recursive-exclude docs/_build *
--- a/README.rst
+++ b/README.rst
@ -26,242 +26,41 @@ common case:
  TCP-over-TCP, which has terrible performance (see below).
 Client side Requirements
 ------------------------
 - sudo, or logged in as root on your client machine.
  (The server doesn't need admin access.)
 - Python 2.7 or Python 3.5.
 +-------+--------+------------+-----------------------------------------------+
 | OS    | Method | Features   | Requirements                                  |
 +=======+========+============+===============================================+
 | Linux | NAT    | * IPv4 TCP + iptables DNAT, REDIRECT, and ttl modules.     |
 +       +--------+------------+-----------------------------------------------+
 |       | TPROXY | * IPv4 TCP + Linux with TPROXY support.                    |
 |       |        | * IPv4 UDP + Python 3.5 preferred (see below).             |
 |       |        | * IPv6 TCP +                                               |
 |       |        | * IPv6 UDP +                                               |
 +-------+--------+------------+-----------------------------------------------+
 | MacOS | PF     | * IPv4 TCP + You need to have the pfctl command.           |
 +-------+--------+------------+-----------------------------------------------+
 Server side Requirements
 ------------------------
 Python 2.7 or Python 3.5.
 Additional Suggested Software
 -----------------------------
 - You may want to use autossh, available in various package management
  systems
 Additional information for TPROXY
 ---------------------------------
 TPROXY is the only method that supports full support of IPv6 and UDP.
 Full UDP or DNS support with the TPROXY method requires the `recvmsg()`
 syscall. This is not available in Python 2.7, however is in Python 3.5 and
 later.
 - For Python 2.7, you need PyXAPI, available here:
  http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
 There are some things you need to consider for TPROXY to work:
 - The following commands need to be run first as root. This only needs to be
  done once after booting up::
      ip route add local default dev lo table 100
      ip rule add fwmark 1 lookup 100
      ip -6 route add local default dev lo table 100
      ip -6 rule add fwmark 1 lookup 100
 - The --auto-nets feature does not detect IPv6 routes automatically. Add IPv6
  routes manually. e.g. by adding '::/0' to the end of the command line.
 - The client needs to be run as root. e.g.::
      sudo SSH_AUTH_SOCK="$SSH_AUTH_SOCK" $HOME/tree/sshuttle.tproxy/sshuttle  --method=tproxy ...
 - You may need to exclude the IP address of the server you are connecting to.
  Otherwise sshuttle may attempt to intercept the ssh packets, which will not
  work. Use the `--exclude` parameter for this.
 - Similarly, UDP return packets (including DNS) could get intercepted and
  bounced back. This is the case if you have a broad subnet such as
  ``0.0.0.0/0`` or ``::/0`` that includes the IP address of the client. Use the
  `--exclude` parameter for this.
 - You do need the `--method=tproxy` parameter, as above.
 - The routes for the outgoing packets must already exist. For example, if your
  connection does not have IPv6 support, no IPv6 routes will exist, IPv6
  packets will not be generated and sshuttle cannot intercept them::
      telnet -6 www.google.com 80
      Trying 2404:6800:4001:805::1010...
      telnet: Unable to connect to remote host: Network is unreachable
  Add some dummy routes to external interfaces. Make sure they get removed
  however after sshuttle exits.
 Obtaining sshuttle
 ------------------
 - Debian stretch or later::
      apt-get install sshuttle
 - From PyPI::
-      pip install sshuttle
+      sudo pip install sshuttle
 - Clone::
      git clone https://github.com/sshuttle/sshuttle.git
      sudo ./setup.py install
 It is also possible to install into a virtualenv as a non-root user.
 - From PyPI::
      virtualenv -p python3 /tmp/sshuttle
      . /tmp/sshuttle/bin/activate
      pip install sshuttle
 - Clone::
      virtualenv -p python3 /tmp/sshuttle
      . /tmp/sshuttle/bin/activate
      git clone https://github.com/sshuttle/sshuttle.git
      ./setup.py install
 Documentation
 -------------
 The documentation for the stable version is available at:
 http://sshuttle.readthedocs.org/
-Usage
+The documentation for the latest development version is available at:
-----
+http://sshuttle.readthedocs.org/en/latest/
 - Forward all traffic::
      sshuttle -r username@sshserver 0.0.0.0/0 -vv
 - By default sshuttle will automatically choose a method to use. Override with
  the `--method=` parameter.
 - There is a shortcut for 0.0.0.0/0 for those that value
  their wrists::
      sshuttle -r username@sshserver 0/0 -vv
 - If you would also like your DNS queries to be proxied
  through the DNS server of the server you are connect to::
      sshuttle --dns -vvr username@sshserver 0/0
  The above is probably what you want to use to prevent
  local network attacks such as Firesheep and friends.
 (You may be prompted for one or more passwords; first, the local password to
 become root using sudo, and then the remote ssh password.  Or you might have
 sudo and ssh set up to not require passwords, in which case you won't be
 prompted at all.)
 Usage Notes
 -----------
 That's it!  Now your local machine can access the remote network as if you
 were right there.  And if your "client" machine is a router, everyone on
 your local network can make connections to your remote network.
 You don't need to install sshuttle on the remote server;
 the remote server just needs to have python available. 
 sshuttle will automatically upload and run its source code
 to the remote python interpreter.
 This creates a transparent proxy server on your local machine for all IP
 addresses that match 0.0.0.0/0.  (You can use more specific IP addresses if
 you want; use any number of IP addresses or subnets to change which
 addresses get proxied.  Using 0.0.0.0/0 proxies *everything*, which is
 interesting if you don't trust the people on your local network.)
 Any TCP session you initiate to one of the proxied IP addresses will be
 captured by sshuttle and sent over an ssh session to the remote copy of
 sshuttle, which will then regenerate the connection on that end, and funnel
 the data back and forth through ssh.
 Fun, right?  A poor man's instant VPN, and you don't even have to have
 admin access on the server.
 Support
 -------
 Mailing list:
 * Subscribe by sending a message to <sshuttle+subscribe@googlegroups.com>
 * List archives are at: http://groups.google.com/group/sshuttle
 Issue tracker and pull requests at github:
 * https://github.com/sshuttle/sshuttle
 Theory of Operation
 -------------------
 sshuttle is not exactly a VPN, and not exactly port forwarding.  It's kind
 of both, and kind of neither.
 It's like a VPN, since it can forward every port on an entire network, not
 just ports you specify.  Conveniently, it lets you use the "real" IP
 addresses of each host rather than faking port numbers on localhost.
 On the other hand, the way it *works* is more like ssh port forwarding than
 a VPN.  Normally, a VPN forwards your data one packet at a time, and
 doesn't care about individual connections; ie. it's "stateless" with respect
 to the traffic.  sshuttle is the opposite of stateless; it tracks every
 single connection.
 You could compare sshuttle to something like the old `Slirp
 <http://en.wikipedia.org/wiki/Slirp>`_ program, which was a userspace TCP/IP
 implementation that did something similar.  But it operated on a
 packet-by-packet basis on the client side, reassembling the packets on the
 server side.  That worked okay back in the "real live serial port" days,
 because serial ports had predictable latency and buffering.
 But you can't safely just forward TCP packets over a TCP session (like ssh),
 because TCP's performance depends fundamentally on packet loss; it
 *must* experience packet loss in order to know when to slow down!  At
 the same time, the outer TCP session (ssh, in this case) is a reliable
 transport, which means that what you forward through the tunnel *never*
 experiences packet loss.  The ssh session itself experiences packet loss, of
 course, but TCP fixes it up and ssh (and thus you) never know the
 difference.  But neither does your inner TCP session, and extremely screwy
 performance ensues.
 sshuttle assembles the TCP stream locally, multiplexes it statefully over
 an ssh session, and disassembles it back into packets at the other end.  So
 it never ends up doing TCP-over-TCP.  It's just data-over-TCP, which is
 safe.
 Useless Trivia
 --------------
 This section written by Avery Pennarun <apenwarr@gmail.com>.
 Back in 1998 (12 years ago!  Yikes!), I released the first version of `Tunnel
 Vision <http://alumnit.ca/wiki/?TunnelVisionReadMe>`_, a semi-intelligent VPN
 client for Linux.  Unfortunately, I made two big mistakes: I implemented the
 key exchange myself (oops), and I ended up doing TCP-over-TCP (double oops).
 The resulting program worked okay - and people used it for years - but the
 performance was always a bit funny.  And nobody ever found any security flaws
 in my key exchange, either, but that doesn't mean anything. :)
 The same year, dcoombs and I also released Fast Forward, a proxy server
 supporting transparent proxying.  Among other things, we used it for
 automatically splitting traffic across more than one Internet connection (a
 tool we called "Double Vision").
 I was still in university at the time.  A couple years after that, one of my
 professors was working with some graduate students on the technology that would
 eventually become `Slipstream Internet Acceleration
 <http://www.slipstream.com/>`_.  He asked me to do a contract for him to build
 an initial prototype of a transparent proxy server for mobile networks.  The
 idea was similar to sshuttle: if you reassemble and then disassemble the TCP
 packets, you can reduce latency and improve performance vs.  just forwarding
 the packets over a plain VPN or mobile network.  (It's unlikely that any of my
 code has persisted in the Slipstream product today, but the concept is still
 pretty cool.  I'm still horrified that people use plain TCP on complex mobile
 networks with crazily variable latency, for which it was never really
 intended.)
 That project I did for Slipstream was what first gave me the idea to merge
 the concepts of Fast Forward, Double Vision, and Tunnel Vision into a single
 program that was the best of all worlds.  And here we are, at last, 10 years
 later.  You're welcome.
--- a/VERSION.txt
+++ b/VERSION.txt
@ -1 +0,0 @@
 0.75
--- a/conftest.py
+++ b/conftest.py
@ -0,0 +1,10 @@
 import sys
 if sys.version_info >= (3, 0):
    good_python = sys.version_info >= (3, 5)
 else:
    good_python = sys.version_info >= (2, 7)
 collect_ignore = []
 if not good_python:
    collect_ignore.append("sshuttle/tests/client")
--- a/docs/Makefile
+++ b/docs/Makefile
@ -0,0 +1,177 @@
 # Makefile for Sphinx documentation
 #
 # You can set these variables from the command line.
 SPHINXOPTS    =
 SPHINXBUILD   = sphinx-build
 PAPER         =
 BUILDDIR      = _build
 # User-friendly check for sphinx-build
 ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
 $(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
 endif
 # Internal variables.
 PAPEROPT_a4     = -D latex_paper_size=a4
 PAPEROPT_letter = -D latex_paper_size=letter
 ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
 # the i18n builder cannot share the environment and doctrees with the others
 I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
 .PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
 help:
 	@echo "Please use \`make <target>' where <target> is one of"
 	@echo "  html       to make standalone HTML files"
 	@echo "  dirhtml    to make HTML files named index.html in directories"
 	@echo "  singlehtml to make a single large HTML file"
 	@echo "  pickle     to make pickle files"
 	@echo "  json       to make JSON files"
 	@echo "  htmlhelp   to make HTML files and a HTML help project"
 	@echo "  qthelp     to make HTML files and a qthelp project"
 	@echo "  devhelp    to make HTML files and a Devhelp project"
 	@echo "  epub       to make an epub"
 	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
 	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
 	@echo "  latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
 	@echo "  text       to make text files"
 	@echo "  man        to make manual pages"
 	@echo "  texinfo    to make Texinfo files"
 	@echo "  info       to make Texinfo files and run them through makeinfo"
 	@echo "  gettext    to make PO message catalogs"
 	@echo "  changes    to make an overview of all changed/added/deprecated items"
 	@echo "  xml        to make Docutils-native XML files"
 	@echo "  pseudoxml  to make pseudoxml-XML files for display purposes"
 	@echo "  linkcheck  to check all external links for integrity"
 	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
 clean:
 	rm -rf $(BUILDDIR)/*
 html:
 	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
 	@echo
 	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
 dirhtml:
 	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
 	@echo
 	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
 singlehtml:
 	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
 	@echo
 	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
 pickle:
 	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
 	@echo
 	@echo "Build finished; now you can process the pickle files."
 json:
 	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
 	@echo
 	@echo "Build finished; now you can process the JSON files."
 htmlhelp:
 	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
 	@echo
 	@echo "Build finished; now you can run HTML Help Workshop with the" \
 	      ".hhp project file in $(BUILDDIR)/htmlhelp."
 qthelp:
 	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
 	@echo
 	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
 	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
 	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/sshuttle.qhcp"
 	@echo "To view the help file:"
 	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/sshuttle.qhc"
 devhelp:
 	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
 	@echo
 	@echo "Build finished."
 	@echo "To view the help file:"
 	@echo "# mkdir -p $$HOME/.local/share/devhelp/sshuttle"
 	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/sshuttle"
 	@echo "# devhelp"
 epub:
 	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
 	@echo
 	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
 latex:
 	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
 	@echo
 	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
 	@echo "Run \`make' in that directory to run these through (pdf)latex" \
 	      "(use \`make latexpdf' here to do that automatically)."
 latexpdf:
 	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
 	@echo "Running LaTeX files through pdflatex..."
 	$(MAKE) -C $(BUILDDIR)/latex all-pdf
 	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
 latexpdfja:
 	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
 	@echo "Running LaTeX files through platex and dvipdfmx..."
 	$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
 	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
 text:
 	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
 	@echo
 	@echo "Build finished. The text files are in $(BUILDDIR)/text."
 man:
 	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
 	@echo
 	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
 texinfo:
 	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
 	@echo
 	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
 	@echo "Run \`make' in that directory to run these through makeinfo" \
 	      "(use \`make info' here to do that automatically)."
 info:
 	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
 	@echo "Running Texinfo files through makeinfo..."
 	make -C $(BUILDDIR)/texinfo info
 	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
 gettext:
 	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
 	@echo
 	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
 changes:
 	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
 	@echo
 	@echo "The overview file is in $(BUILDDIR)/changes."
 linkcheck:
 	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
 	@echo
 	@echo "Link check complete; look for any errors in the above output " \
 	      "or in $(BUILDDIR)/linkcheck/output.txt."
 doctest:
 	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
 	@echo "Testing of doctests in the sources finished, look at the " \
 	      "results in $(BUILDDIR)/doctest/output.txt."
 xml:
 	$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
 	@echo
 	@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
 pseudoxml:
 	$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
 	@echo
 	@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."
--- a/docs/changes.rst
+++ b/docs/changes.rst
@ -0,0 +1 @@
 .. include:: ../CHANGES.rst
--- a/docs/conf.py
+++ b/docs/conf.py
@ -0,0 +1,261 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 #
 # sshuttle documentation build configuration file, created by
 # sphinx-quickstart on Sun Jan 17 12:13:47 2016.
 #
 # This file is execfile()d with the current directory set to its
 # containing dir.
 #
 # Note that not all possible configuration values are present in this
 # autogenerated file.
 #
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 import sys
 import os
 sys.path.insert(0, os.path.abspath('..'))
 import sshuttle.version  # NOQA
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
 # sys.path.insert(0, os.path.abspath('.'))
 # -- General configuration ------------------------------------------------
 # If your documentation needs a minimal Sphinx version, state it here.
 # needs_sphinx = '1.0'
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
 extensions = [
    'sphinx.ext.todo',
 ]
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
 # The suffix of source filenames.
 source_suffix = '.rst'
 # The encoding of source files.
 # source_encoding = 'utf-8-sig'
 # The master toctree document.
 master_doc = 'index'
 # General information about the project.
 project = 'sshuttle'
 copyright = '2016, Brian May'
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
 # built documents.
 #
 # The full version, including alpha/beta/rc tags.
 release = sshuttle.version.version
 # The short X.Y version.
 version = '.'.join(release.split('.')[:2])
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
 # language = None
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
 # today = ''
 # Else, today_fmt is used as the format for a strftime call.
 # today_fmt = '%B %d, %Y'
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 exclude_patterns = ['_build']
 # The reST default role (used for this markup: `text`) to use for all
 # documents.
 # default_role = None
 # If true, '()' will be appended to :func: etc. cross-reference text.
 # add_function_parentheses = True
 # If true, the current module name will be prepended to all description
 # unit titles (such as .. function::).
 # add_module_names = True
 # If true, sectionauthor and moduleauthor directives will be shown in the
 # output. They are ignored by default.
 # show_authors = False
 # The name of the Pygments (syntax highlighting) style to use.
 pygments_style = 'sphinx'
 # A list of ignored prefixes for module index sorting.
 # modindex_common_prefix = []
 # If true, keep warnings as "system message" paragraphs in the built documents.
 # keep_warnings = False
 # -- Options for HTML output ----------------------------------------------
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 html_theme = 'default'
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
 # documentation.
 # html_theme_options = {}
 # Add any paths that contain custom themes here, relative to this directory.
 # html_theme_path = []
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".
 # html_title = None
 # A shorter title for the navigation bar.  Default is the same as html_title.
 # html_short_title = None
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
 # html_logo = None
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
 # pixels large.
 # html_favicon = None
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
 html_static_path = ['_static']
 # Add any extra paths that contain custom files (such as robots.txt or
 # .htaccess) here, relative to this directory. These files are copied
 # directly to the root of the documentation.
 # html_extra_path = []
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.
 # html_last_updated_fmt = '%b %d, %Y'
 # If true, SmartyPants will be used to convert quotes and dashes to
 # typographically correct entities.
 # html_use_smartypants = True
 # Custom sidebar templates, maps document names to template names.
 # html_sidebars = {}
 # Additional templates that should be rendered to pages, maps page names to
 # template names.
 # html_additional_pages = {}
 # If false, no module index is generated.
 # html_domain_indices = True
 # If false, no index is generated.
 # html_use_index = True
 # If true, the index is split into individual pages for each letter.
 # html_split_index = False
 # If true, links to the reST sources are added to the pages.
 # html_show_sourcelink = True
 # If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
 # html_show_sphinx = True
 # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
 # html_show_copyright = True
 # If true, an OpenSearch description file will be output, and all pages will
 # contain a <link> tag referring to it.  The value of this option must be the
 # base URL from which the finished HTML is served.
 # html_use_opensearch = ''
 # This is the file name suffix for HTML files (e.g. ".xhtml").
 # html_file_suffix = None
 # Output file base name for HTML help builder.
 htmlhelp_basename = 'sshuttledoc'
 # -- Options for LaTeX output ---------------------------------------------
 latex_elements = {
    # The paper size ('letterpaper' or 'a4paper').
    # 'papersize': 'letterpaper',
    # The font size ('10pt', '11pt' or '12pt').
    # 'pointsize': '10pt',
    # Additional stuff for the LaTeX preamble.
    # 'preamble': '',
 }
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title,
 #  author, documentclass [howto, manual, or own class]).
 latex_documents = [
    ('index', 'sshuttle.tex', 'sshuttle documentation', 'Brian May', 'manual'),
 ]
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
 # latex_logo = None
 # For "manual" documents, if this is true, then toplevel headings are parts,
 # not chapters.
 # latex_use_parts = False
 # If true, show page references after internal links.
 # latex_show_pagerefs = False
 # If true, show URL addresses after external links.
 # latex_show_urls = False
 # Documents to append as an appendix to all manuals.
 # latex_appendices = []
 # If false, no module index is generated.
 # latex_domain_indices = True
 # -- Options for manual page output ---------------------------------------
 # One entry per manual page. List of tuples
 # (source start file, name, description, authors, manual section).
 man_pages = [
    ('manpage', 'sshuttle', 'sshuttle documentation', ['Brian May'], 1)
 ]
 # If true, show URL addresses after external links.
 # man_show_urls = False
 # -- Options for Texinfo output -------------------------------------------
 # Grouping the document tree into Texinfo files. List of tuples
 # (source start file, target name, title, author,
 #  dir menu entry, description, category)
 texinfo_documents = [
    ('index', 'sshuttle', 'sshuttle documentation',
     'Brian May', 'sshuttle', 'A transparent proxy-based VPN using ssh',
     'Miscellaneous'),
 ]
 # Documents to append as an appendix to all manuals.
 # texinfo_appendices = []
 # If false, no module index is generated.
 # texinfo_domain_indices = True
 # How to display URL addresses: 'footnote', 'no', or 'inline'.
 # texinfo_show_urls = 'footnote'
 # If true, do not generate a @detailmenu in the "Top" node's menu.
 # texinfo_no_detailmenu = False
--- a/docs/how-it-works.rst
+++ b/docs/how-it-works.rst
@ -0,0 +1,37 @@
 How it works
 ============
 sshuttle is not exactly a VPN, and not exactly port forwarding.  It's kind
 of both, and kind of neither.
 It's like a VPN, since it can forward every port on an entire network, not
 just ports you specify.  Conveniently, it lets you use the "real" IP
 addresses of each host rather than faking port numbers on localhost.
 On the other hand, the way it *works* is more like ssh port forwarding than
 a VPN.  Normally, a VPN forwards your data one packet at a time, and
 doesn't care about individual connections; ie. it's "stateless" with respect
 to the traffic.  sshuttle is the opposite of stateless; it tracks every
 single connection.
 You could compare sshuttle to something like the old `Slirp
 <http://en.wikipedia.org/wiki/Slirp>`_ program, which was a userspace TCP/IP
 implementation that did something similar.  But it operated on a
 packet-by-packet basis on the client side, reassembling the packets on the
 server side.  That worked okay back in the "real live serial port" days,
 because serial ports had predictable latency and buffering.
 But you can't safely just forward TCP packets over a TCP session (like ssh),
 because TCP's performance depends fundamentally on packet loss; it
 *must* experience packet loss in order to know when to slow down!  At
 the same time, the outer TCP session (ssh, in this case) is a reliable
 transport, which means that what you forward through the tunnel *never*
 experiences packet loss.  The ssh session itself experiences packet loss, of
 course, but TCP fixes it up and ssh (and thus you) never know the
 difference.  But neither does your inner TCP session, and extremely screwy
 performance ensues.
 sshuttle assembles the TCP stream locally, multiplexes it statefully over
 an ssh session, and disassembles it back into packets at the other end.  So
 it never ends up doing TCP-over-TCP.  It's just data-over-TCP, which is
 safe.
--- a/docs/index.rst
+++ b/docs/index.rst
@ -0,0 +1,29 @@
 sshuttle: where transparent proxy meets VPN meets ssh
 =====================================================
 :Date: |today|
 :Version: |version|
 Contents:
 .. toctree::
   :maxdepth: 2
   overview
   requirements
   installation
   usage
   platform
   Man Page <manpage>
   how-it-works
   support
   trivia
   changes
 Indices and tables
 ==================
 * :ref:`genindex`
 * :ref:`search`
--- a/docs/installation.rst
+++ b/docs/installation.rst
@ -0,0 +1,11 @@
 Installation
 ============
 - From PyPI::
      pip install sshuttle
 - Clone::
      git clone https://github.com/sshuttle/sshuttle.git
      ./setup.py install
--- a/docs/make.bat
+++ b/docs/make.bat
@ -0,0 +1,242 @@
@ECHO OFF
 REM Command file for Sphinx documentation
 if "%SPHINXBUILD%" == "" (
 	set SPHINXBUILD=sphinx-build
 )
 set BUILDDIR=_build
 set ALLSPHINXOPTS=-d %BUILDDIR%/doctrees %SPHINXOPTS% .
 set I18NSPHINXOPTS=%SPHINXOPTS% .
 if NOT "%PAPER%" == "" (
 	set ALLSPHINXOPTS=-D latex_paper_size=%PAPER% %ALLSPHINXOPTS%
 	set I18NSPHINXOPTS=-D latex_paper_size=%PAPER% %I18NSPHINXOPTS%
 )
 if "%1" == "" goto help
 if "%1" == "help" (
 	:help
 	echo.Please use `make ^<target^>` where ^<target^> is one of
 	echo.  html       to make standalone HTML files
 	echo.  dirhtml    to make HTML files named index.html in directories
 	echo.  singlehtml to make a single large HTML file
 	echo.  pickle     to make pickle files
 	echo.  json       to make JSON files
 	echo.  htmlhelp   to make HTML files and a HTML help project
 	echo.  qthelp     to make HTML files and a qthelp project
 	echo.  devhelp    to make HTML files and a Devhelp project
 	echo.  epub       to make an epub
 	echo.  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter
 	echo.  text       to make text files
 	echo.  man        to make manual pages
 	echo.  texinfo    to make Texinfo files
 	echo.  gettext    to make PO message catalogs
 	echo.  changes    to make an overview over all changed/added/deprecated items
 	echo.  xml        to make Docutils-native XML files
 	echo.  pseudoxml  to make pseudoxml-XML files for display purposes
 	echo.  linkcheck  to check all external links for integrity
 	echo.  doctest    to run all doctests embedded in the documentation if enabled
 	goto end
 )
 if "%1" == "clean" (
 	for /d %%i in (%BUILDDIR%\*) do rmdir /q /s %%i
 	del /q /s %BUILDDIR%\*
 	goto end
 )
 %SPHINXBUILD% 2> nul
 if errorlevel 9009 (
 	echo.
 	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
 	echo.installed, then set the SPHINXBUILD environment variable to point
 	echo.to the full path of the 'sphinx-build' executable. Alternatively you
 	echo.may add the Sphinx directory to PATH.
 	echo.
 	echo.If you don't have Sphinx installed, grab it from
 	echo.http://sphinx-doc.org/
 	exit /b 1
 )
 if "%1" == "html" (
 	%SPHINXBUILD% -b html %ALLSPHINXOPTS% %BUILDDIR%/html
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The HTML pages are in %BUILDDIR%/html.
 	goto end
 )
 if "%1" == "dirhtml" (
 	%SPHINXBUILD% -b dirhtml %ALLSPHINXOPTS% %BUILDDIR%/dirhtml
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The HTML pages are in %BUILDDIR%/dirhtml.
 	goto end
 )
 if "%1" == "singlehtml" (
 	%SPHINXBUILD% -b singlehtml %ALLSPHINXOPTS% %BUILDDIR%/singlehtml
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The HTML pages are in %BUILDDIR%/singlehtml.
 	goto end
 )
 if "%1" == "pickle" (
 	%SPHINXBUILD% -b pickle %ALLSPHINXOPTS% %BUILDDIR%/pickle
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished; now you can process the pickle files.
 	goto end
 )
 if "%1" == "json" (
 	%SPHINXBUILD% -b json %ALLSPHINXOPTS% %BUILDDIR%/json
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished; now you can process the JSON files.
 	goto end
 )
 if "%1" == "htmlhelp" (
 	%SPHINXBUILD% -b htmlhelp %ALLSPHINXOPTS% %BUILDDIR%/htmlhelp
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished; now you can run HTML Help Workshop with the ^
 .hhp project file in %BUILDDIR%/htmlhelp.
 	goto end
 )
 if "%1" == "qthelp" (
 	%SPHINXBUILD% -b qthelp %ALLSPHINXOPTS% %BUILDDIR%/qthelp
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished; now you can run "qcollectiongenerator" with the ^
 .qhcp project file in %BUILDDIR%/qthelp, like this:
 	echo.^> qcollectiongenerator %BUILDDIR%\qthelp\sshuttle.qhcp
 	echo.To view the help file:
 	echo.^> assistant -collectionFile %BUILDDIR%\qthelp\sshuttle.ghc
 	goto end
 )
 if "%1" == "devhelp" (
 	%SPHINXBUILD% -b devhelp %ALLSPHINXOPTS% %BUILDDIR%/devhelp
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished.
 	goto end
 )
 if "%1" == "epub" (
 	%SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The epub file is in %BUILDDIR%/epub.
 	goto end
 )
 if "%1" == "latex" (
 	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished; the LaTeX files are in %BUILDDIR%/latex.
 	goto end
 )
 if "%1" == "latexpdf" (
 	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
 	cd %BUILDDIR%/latex
 	make all-pdf
 	cd %BUILDDIR%/..
 	echo.
 	echo.Build finished; the PDF files are in %BUILDDIR%/latex.
 	goto end
 )
 if "%1" == "latexpdfja" (
 	%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
 	cd %BUILDDIR%/latex
 	make all-pdf-ja
 	cd %BUILDDIR%/..
 	echo.
 	echo.Build finished; the PDF files are in %BUILDDIR%/latex.
 	goto end
 )
 if "%1" == "text" (
 	%SPHINXBUILD% -b text %ALLSPHINXOPTS% %BUILDDIR%/text
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The text files are in %BUILDDIR%/text.
 	goto end
 )
 if "%1" == "man" (
 	%SPHINXBUILD% -b man %ALLSPHINXOPTS% %BUILDDIR%/man
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The manual pages are in %BUILDDIR%/man.
 	goto end
 )
 if "%1" == "texinfo" (
 	%SPHINXBUILD% -b texinfo %ALLSPHINXOPTS% %BUILDDIR%/texinfo
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The Texinfo files are in %BUILDDIR%/texinfo.
 	goto end
 )
 if "%1" == "gettext" (
 	%SPHINXBUILD% -b gettext %I18NSPHINXOPTS% %BUILDDIR%/locale
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The message catalogs are in %BUILDDIR%/locale.
 	goto end
 )
 if "%1" == "changes" (
 	%SPHINXBUILD% -b changes %ALLSPHINXOPTS% %BUILDDIR%/changes
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.The overview file is in %BUILDDIR%/changes.
 	goto end
 )
 if "%1" == "linkcheck" (
 	%SPHINXBUILD% -b linkcheck %ALLSPHINXOPTS% %BUILDDIR%/linkcheck
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Link check complete; look for any errors in the above output ^
 or in %BUILDDIR%/linkcheck/output.txt.
 	goto end
 )
 if "%1" == "doctest" (
 	%SPHINXBUILD% -b doctest %ALLSPHINXOPTS% %BUILDDIR%/doctest
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Testing of doctests in the sources finished, look at the ^
 results in %BUILDDIR%/doctest/output.txt.
 	goto end
 )
 if "%1" == "xml" (
 	%SPHINXBUILD% -b xml %ALLSPHINXOPTS% %BUILDDIR%/xml
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The XML files are in %BUILDDIR%/xml.
 	goto end
 )
 if "%1" == "pseudoxml" (
 	%SPHINXBUILD% -b pseudoxml %ALLSPHINXOPTS% %BUILDDIR%/pseudoxml
 	if errorlevel 1 exit /b 1
 	echo.
 	echo.Build finished. The pseudo-XML files are in %BUILDDIR%/pseudoxml.
 	goto end
 )
 :end
--- a/docs/manpage.rst
+++ b/docs/manpage.rst
@ -0,0 +1,302 @@
 sshuttle
 ========
 Synopsis
 --------
 **sshuttle** [*options*] [**-r** *[username@]sshserver[:port]*] \<*subnets* ...\>
 Description
 -----------
 :program:`sshuttle` allows you to create a VPN connection from your
 machine to any remote server that you can connect to via
 ssh, as long as that server has python 2.3 or higher.
 To work, you must have root access on the local machine,
 but you can have a normal account on the server.
 It's valid to run :program:`sshuttle` more than once simultaneously on
 a single client machine, connecting to a different server
 every time, so you can be on more than one VPN at once.
 If run on a router, :program:`sshuttle` can forward traffic for your
 entire subnet to the VPN.
 Options
 -------
 .. program:: sshuttle
 .. option:: subnets
    A list of subnets to route over the VPN, in the form
    ``a.b.c.d[/width][port[-port]]``.  Valid examples are 1.2.3.4 (a
    single IP address), 1.2.3.4/32 (equivalent to 1.2.3.4),
    1.2.3.0/24 (a 24-bit subnet, ie. with a 255.255.255.0
    netmask), and 0/0 ('just route everything through the
    VPN'). Any of the previous examples are also valid if you append
    a port or a port range, so 1.2.3.4:8000 will only tunnel traffic
    that has as the destination port 8000 of 1.2.3.4 and 
    1.2.3.0/24:8000-9000 will tunnel traffic going to any port between
    8000 and 9000 (inclusive) for all IPs in the 1.2.3.0/24 subnet.
    It is also possible to use a name in which case the first IP it resolves
    to during startup will be routed over the VPN. Valid examples are
    example.com, example.com:8000 and example.com:8000-9000.
 .. option:: --method [auto|nat|tproxy|pf]
   Which firewall method should sshuttle use? For auto, sshuttle attempts to
   guess the appropriate method depending on what it can find in PATH. The
   default value is auto.
 .. option:: -l, --listen=[ip:]port
    Use this ip address and port number as the transparent
    proxy port.  By default :program:`sshuttle` finds an available
    port automatically and listens on IP 127.0.0.1
    (localhost), so you don't need to override it, and
    connections are only proxied from the local machine,
    not from outside machines.  If you want to accept
    connections from other machines on your network (ie. to
    run :program:`sshuttle` on a router) try enabling IP Forwarding in
    your kernel, then using ``--listen 0.0.0.0:0``.
    You can use any name resolving to an IP address of the machine running
    :program:`sshuttle`, e.g. ``--listen localhost``.
    For the tproxy and pf methods this can be an IPv6 address. Use this option 
    twice if required, to provide both IPv4 and IPv6 addresses.
 .. option:: -H, --auto-hosts
    Scan for remote hostnames and update the local /etc/hosts
    file with matching entries for as long as the VPN is
    open.  This is nicer than changing your system's DNS
    (/etc/resolv.conf) settings, for several reasons.  First,
    hostnames are added without domain names attached, so
    you can ``ssh thatserver`` without worrying if your local
    domain matches the remote one.  Second, if you :program:`sshuttle`
    into more than one VPN at a time, it's impossible to
    use more than one DNS server at once anyway, but
    :program:`sshuttle` correctly merges /etc/hosts entries between
    all running copies.  Third, if you're only routing a
    few subnets over the VPN, you probably would prefer to
    keep using your local DNS server for everything else.
 .. option:: -N, --auto-nets
    In addition to the subnets provided on the command
    line, ask the server which subnets it thinks we should
    route, and route those automatically.  The suggestions
    are taken automatically from the server's routing
    table.
 .. option:: --dns
    Capture local DNS requests and forward to the remote DNS
    server.
 .. option:: --python
    Specify the name/path of the remote python interpreter.
    The default is just ``python``, which means to use the
    default python interpreter on the remote system's PATH.
 .. option:: -r, --remote=[username@]sshserver[:port]
    The remote hostname and optional username and ssh
    port number to use for connecting to the remote server.
    For example, example.com, testuser@example.com,
    testuser@example.com:2222, or example.com:2244.
 .. option:: -x, --exclude=subnet
    Explicitly exclude this subnet from forwarding.  The
    format of this option is the same as the ``<subnets>``
    option.  To exclude more than one subnet, specify the
    ``-x`` option more than once.  You can say something like
    ``0/0 -x 1.2.3.0/24`` to forward everything except the
    local subnet over the VPN, for example.
 .. option:: -X, --exclude-from=file
    Exclude the subnets specified in a file, one subnet per
    line. Useful when you have lots of subnets to exclude.
 .. option:: -v, --verbose
    Print more information about the session.  This option
    can be used more than once for increased verbosity.  By
    default, :program:`sshuttle` prints only error messages.
 .. option:: -e, --ssh-cmd
    The command to use to connect to the remote server. The
    default is just ``ssh``.  Use this if your ssh client is
    in a non-standard location or you want to provide extra
    options to the ssh command, for example, ``-e 'ssh -v'``.
 .. option:: --seed-hosts
    A comma-separated list of hostnames to use to
    initialize the :option:`--auto-hosts` scan algorithm.
    :option:`--auto-hosts` does things like poll local SMB servers
    for lists of local hostnames, but can speed things up
    if you use this option to give it a few names to start
    from.
    If this option is used *without* :option:`--auto-hosts`,
    then the listed hostnames will be scanned and added, but
    no further hostnames will be added.
 .. option:: --no-latency-control
    Sacrifice latency to improve bandwidth benchmarks. ssh
    uses really big socket buffers, which can overload the
    connection if you start doing large file transfers,
    thus making all your other sessions inside the same
    tunnel go slowly. Normally, :program:`sshuttle` tries to avoid
    this problem using a "fullness check" that allows only
    a certain amount of outstanding data to be buffered at
    a time.  But on high-bandwidth links, this can leave a
    lot of your bandwidth underutilized.  It also makes
    :program:`sshuttle` seem slow in bandwidth benchmarks (benchmarks
    rarely test ping latency, which is what :program:`sshuttle` is
    trying to control).  This option disables the latency
    control feature, maximizing bandwidth usage.  Use at
    your own risk.
 .. option:: -D, --daemon
    Automatically fork into the background after connecting
    to the remote server.  Implies :option:`--syslog`.
 .. option:: --syslog
    after connecting, send all log messages to the
    :manpage:`syslog(3)` service instead of stderr.  This is
    implicit if you use :option:`--daemon`.
 .. option:: --pidfile=pidfilename
    when using :option:`--daemon`, save :program:`sshuttle`'s pid to
    *pidfilename*.  The default is ``sshuttle.pid`` in the
    current directory.
 .. option:: --disable-ipv6
    If using tproxy or pf methods, this will disable IPv6 support.
 .. option:: --firewall
    (internal use only) run the firewall manager.  This is
    the only part of :program:`sshuttle` that must run as root.  If
    you start :program:`sshuttle` as a non-root user, it will
    automatically run ``sudo`` or ``su`` to start the firewall
    manager, but the core of :program:`sshuttle` still runs as a
    normal user.
 .. option:: --hostwatch
    (internal use only) run the hostwatch daemon.  This
    process runs on the server side and collects hostnames for
    the :option:`--auto-hosts` option.  Using this option by itself
    makes it a lot easier to debug and test the :option:`--auto-hosts`
    feature.
 Examples
 --------
 Test locally by proxying all local connections, without using ssh::
    $ sshuttle -v 0/0
    Starting sshuttle proxy.
    Listening on ('0.0.0.0', 12300).
    [local sudo] Password:
    firewall manager ready.
    c : connecting to server...
     s: available routes:
     s:   192.168.42.0/24
    c : connected.
    firewall manager: starting transproxy.
    c : Accept: 192.168.42.106:50035 -> 192.168.42.121:139.
    c : Accept: 192.168.42.121:47523 -> 77.141.99.22:443.
        ...etc...
    ^C
    firewall manager: undoing changes.
    KeyboardInterrupt
    c : Keyboard interrupt: exiting.
    c : SW#8:192.168.42.121:47523: deleting
    c : SW#6:192.168.42.106:50035: deleting
 Test connection to a remote server, with automatic hostname
 and subnet guessing::
    $ sshuttle -vNHr example.org
    Starting sshuttle proxy.
    Listening on ('0.0.0.0', 12300).
    firewall manager ready.
    c : connecting to server...
     s: available routes:
     s:   77.141.99.0/24
    c : connected.
    c : seed_hosts: []
    firewall manager: starting transproxy.
    hostwatch: Found: testbox1: 1.2.3.4
    hostwatch: Found: mytest2: 5.6.7.8
    hostwatch: Found: domaincontroller: 99.1.2.3
    c : Accept: 192.168.42.121:60554 -> 77.141.99.22:22.
    ^C
    firewall manager: undoing changes.
    c : Keyboard interrupt: exiting.
    c : SW#6:192.168.42.121:60554: deleting
 Discussion
 ----------
 When it starts, :program:`sshuttle` creates an ssh session to the
 server specified by the ``-r`` option.  If ``-r`` is omitted,
 it will start both its client and server locally, which is
 sometimes useful for testing.
 After connecting to the remote server, :program:`sshuttle` uploads its
 (python) source code to the remote end and executes it
 there.  Thus, you don't need to install :program:`sshuttle` on the
 remote server, and there are never :program:`sshuttle` version
 conflicts between client and server.
 Unlike most VPNs, :program:`sshuttle` forwards sessions, not packets.
 That is, it uses kernel transparent proxying (`iptables
 REDIRECT` rules on Linux) to
 capture outgoing TCP sessions, then creates entirely
 separate TCP sessions out to the original destination at
 the other end of the tunnel.
 Packet-level forwarding (eg. using the tun/tap devices on
 Linux) seems elegant at first, but it results in
 several problems, notably the 'tcp over tcp' problem.  The
 tcp protocol depends fundamentally on packets being dropped
 in order to implement its congestion control agorithm; if
 you pass tcp packets through a tcp-based tunnel (such as
 ssh), the inner tcp packets will never be dropped, and so
 the inner tcp stream's congestion control will be
 completely broken, and performance will be terrible.  Thus,
 packet-based VPNs (such as IPsec and openvpn) cannot use
 tcp-based encrypted streams like ssh or ssl, and have to
 implement their own encryption from scratch, which is very
 complex and error prone.
 :program:`sshuttle`'s simplicity comes from the fact that it can
 safely use the existing ssh encrypted tunnel without
 incurring a performance penalty.  It does this by letting
 the client-side kernel manage the incoming tcp stream, and
 the server-side kernel manage the outgoing tcp stream;
 there is no need for congestion control to be shared
 between the two separate streams, so a tcp-based tunnel is
 fine.
 .. seealso::
   :manpage:`ssh(1)`, :manpage:`python(1)`
--- a/docs/overview.rst
+++ b/docs/overview.rst
@ -0,0 +1,26 @@
 Overview
 ========
 As far as I know, sshuttle is the only program that solves the following
 common case:
 - Your client machine (or router) is Linux, MacOS, FreeBSD, OpenBSD or pfSense.
 - You have access to a remote network via ssh.
 - You don't necessarily have admin access on the remote network.
 - The remote network has no VPN, or only stupid/complex VPN
  protocols (IPsec, PPTP, etc). Or maybe you *are* the
  admin and you just got frustrated with the awful state of
  VPN tools.
 - You don't want to create an ssh port forward for every
  single host/port on the remote network.
 - You hate openssh's port forwarding because it's randomly
  slow and/or stupid.
 - You can't use openssh's PermitTunnel feature because
  it's disabled by default on openssh servers; plus it does
  TCP-over-TCP, which has terrible performance (see below).
--- a/docs/platform.rst
+++ b/docs/platform.rst
@ -0,0 +1,10 @@
 Platform Specific Notes
 =======================
 Contents:
 .. toctree::
   :maxdepth: 2
   tproxy
   windows
--- a/docs/requirements.rst
+++ b/docs/requirements.rst
@ -0,0 +1,95 @@
 Requirements
 ============
 Client side Requirements
 ------------------------
 - sudo, or root access on your client machine.
  (The server doesn't need admin access.)
 - Python 2.7 or Python 3.5.
 Linux with NAT method
 ~~~~~~~~~~~~~~~~~~~~~
 Supports:
 * IPv4 TCP
 * IPv4 DNS
 Requires:
 * iptables DNAT, REDIRECT, and ttl modules.
 Linux with TPROXY method
 ~~~~~~~~~~~~~~~~~~~~~~~~
 Supports:
 * IPv4 TCP
 * IPv4 UDP (requires ``recvmsg`` - see below)
 * IPv6 DNS (requires ``recvmsg`` - see below)
 * IPv6 TCP
 * IPv6 UDP (requires ``recvmsg`` - see below)
 * IPv6 DNS (requires ``recvmsg`` - see below)
 .. _PyXAPI: http://www.pps.univ-paris-diderot.fr/~ylg/PyXAPI/
 Full UDP or DNS support with the TPROXY method requires the ``recvmsg()``
 syscall. This is not available in Python 2, however it is in Python 3.5 and
 later. Under Python 2 you might find it sufficient to install PyXAPI_ in
 order to get the ``recvmsg()`` function. See :doc:`tproxy` for more
 information.
 MacOS / FreeBSD / OpenBSD / pfSense
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Method: pf
 Supports:
 * IPv4 TCP
 * IPv4 DNS
 * IPv6 TCP
 * IPv6 DNS
 Requires:
 * You need to have the pfctl command.
 Windows
 ~~~~~~~
 Not officially supported, however can be made to work with Vagrant. Requires
 cmd.exe with Administrator access. See :doc:`windows` for more information.
 Server side Requirements
 ------------------------
 The server can run in any version of Python between 2.4 and 3.6.
 However it is recommended that you use Python 2.7, Python 3.5 or later whenever
 possible as support for older versions might be dropped in the future.
 Additional Suggested Software
 -----------------------------
 - You may want to use autossh, available in various package management
  systems.
 - If you are using systemd, sshuttle can notify it when the connection to
  the remote end is established and the firewall rules are installed. For
  this feature to work you must configure the process start-up type for the
  sshuttle service unit to notify, as shown in the example below. 
 .. code-block:: ini
   :emphasize-lines: 6
   [Unit]
   Description=sshuttle
   After=network.target
   [Service]
   Type=notify
   ExecStart=/usr/bin/sshuttle --dns --remote <user>@<server> <subnets...>
   [Install]
   WantedBy=multi-user.target
--- a/docs/support.rst
+++ b/docs/support.rst
@ -0,0 +1,11 @@
 Support
 =======
 Mailing list:
 * Subscribe by sending a message to <sshuttle+subscribe@googlegroups.com>
 * List archives are at: http://groups.google.com/group/sshuttle
 Issue tracker and pull requests at github:
 * https://github.com/sshuttle/sshuttle
--- a/docs/tproxy.rst
+++ b/docs/tproxy.rst
@ -0,0 +1,42 @@
 TPROXY
 ======
 TPROXY is the only method that has full support of IPv6 and UDP.
 There are some things you need to consider for TPROXY to work:
 - The following commands need to be run first as root. This only needs to be
  done once after booting up::
      ip route add local default dev lo table 100
      ip rule add fwmark 1 lookup 100
      ip -6 route add local default dev lo table 100
      ip -6 rule add fwmark 1 lookup 100
 - The ``--auto-nets`` feature does not detect IPv6 routes automatically. Add IPv6
  routes manually. e.g. by adding ``'::/0'`` to the end of the command line.
 - The client needs to be run as root. e.g.::
      sudo SSH_AUTH_SOCK="$SSH_AUTH_SOCK" $HOME/tree/sshuttle.tproxy/sshuttle  --method=tproxy ...
 - You may need to exclude the IP address of the server you are connecting to.
  Otherwise sshuttle may attempt to intercept the ssh packets, which will not
  work. Use the ``--exclude`` parameter for this.
 - Similarly, UDP return packets (including DNS) could get intercepted and
  bounced back. This is the case if you have a broad subnet such as
  ``0.0.0.0/0`` or ``::/0`` that includes the IP address of the client. Use the
  ``--exclude`` parameter for this.
 - You need the ``--method=tproxy`` parameter, as above.
 - The routes for the outgoing packets must already exist. For example, if your
  connection does not have IPv6 support, no IPv6 routes will exist, IPv6
  packets will not be generated and sshuttle cannot intercept them::
      telnet -6 www.google.com 80
      Trying 2404:6800:4001:805::1010...
      telnet: Unable to connect to remote host: Network is unreachable
  Add some dummy routes to external interfaces. Make sure they get removed
  however after sshuttle exits.
--- a/docs/trivia.rst
+++ b/docs/trivia.rst
@ -0,0 +1,36 @@
 Useless Trivia
 ==============
 This section written by the original author, Avery Pennarun
 <apenwarr@gmail.com>.
 Back in 1998, I released the first version of `Tunnel
 Vision <http://alumnit.ca/wiki/?TunnelVisionReadMe>`_, a semi-intelligent VPN
 client for Linux.  Unfortunately, I made two big mistakes: I implemented the
 key exchange myself (oops), and I ended up doing TCP-over-TCP (double oops).
 The resulting program worked okay - and people used it for years - but the
 performance was always a bit funny.  And nobody ever found any security flaws
 in my key exchange, either, but that doesn't mean anything. :)
 The same year, dcoombs and I also released Fast Forward, a proxy server
 supporting transparent proxying.  Among other things, we used it for
 automatically splitting traffic across more than one Internet connection (a
 tool we called "Double Vision").
 I was still in university at the time.  A couple years after that, one of my
 professors was working with some graduate students on the technology that would
 eventually become `Slipstream Internet Acceleration
 <http://www.slipstream.com/>`_.  He asked me to do a contract for him to build
 an initial prototype of a transparent proxy server for mobile networks.  The
 idea was similar to sshuttle: if you reassemble and then disassemble the TCP
 packets, you can reduce latency and improve performance vs.  just forwarding
 the packets over a plain VPN or mobile network.  (It's unlikely that any of my
 code has persisted in the Slipstream product today, but the concept is still
 pretty cool.  I'm still horrified that people use plain TCP on complex mobile
 networks with crazily variable latency, for which it was never really
 intended.)
 That project I did for Slipstream was what first gave me the idea to merge
 the concepts of Fast Forward, Double Vision, and Tunnel Vision into a single
 program that was the best of all worlds.  And here we are, at last.
 You're welcome.
--- a/docs/usage.rst
+++ b/docs/usage.rst
@ -0,0 +1,62 @@
 Usage
 =====
 .. note::
    For information on usage with Windows, see the :doc:`windows` section.
    For information on using the TProxy method, see the :doc:`tproxy` section.
 Forward all traffic::
    sshuttle -r username@sshserver 0.0.0.0/0
 - Use the :option:`sshuttle -r` parameter to specify a remote server.
 - By default sshuttle will automatically choose a method to use. Override with
  the :option:`sshuttle --method` parameter.
 - There is a shortcut for 0.0.0.0/0 for those that value
  their wrists::
      sshuttle -r username@sshserver 0/0
 If you would also like your DNS queries to be proxied
 through the DNS server of the server you are connect to::
  sshuttle --dns -r username@sshserver 0/0
 The above is probably what you want to use to prevent
 local network attacks such as Firesheep and friends.
 See the documentation for the :option:`sshuttle --dns` parameter.
 (You may be prompted for one or more passwords; first, the local password to
 become root using sudo, and then the remote ssh password.  Or you might have
 sudo and ssh set up to not require passwords, in which case you won't be
 prompted at all.)
 Usage Notes
 -----------
 That's it!  Now your local machine can access the remote network as if you
 were right there.  And if your "client" machine is a router, everyone on
 your local network can make connections to your remote network.
 You don't need to install sshuttle on the remote server;
 the remote server just needs to have python available. 
 sshuttle will automatically upload and run its source code
 to the remote python interpreter.
 This creates a transparent proxy server on your local machine for all IP
 addresses that match 0.0.0.0/0.  (You can use more specific IP addresses if
 you want; use any number of IP addresses or subnets to change which
 addresses get proxied.  Using 0.0.0.0/0 proxies *everything*, which is
 interesting if you don't trust the people on your local network.)
 Any TCP session you initiate to one of the proxied IP addresses will be
 captured by sshuttle and sent over an ssh session to the remote copy of
 sshuttle, which will then regenerate the connection on that end, and funnel
 the data back and forth through ssh.
 Fun, right?  A poor man's instant VPN, and you don't even have to have
 admin access on the server.
--- a/docs/windows.rst
+++ b/docs/windows.rst
@ -0,0 +1,19 @@
 Microsoft Windows
 =================
 Currently there is no built in support for running sshuttle directly on
 Microsoft Windows.
 What we can really do is to create a Linux VM with Vagrant (or simply
 Virtualbox if you like). In the Vagrant settings, remember to turn on bridged
 NIC. Then, run sshuttle inside the VM like below::
    sshuttle -l 0.0.0.0 -x 10.0.0.0/8 -x 192.168.0.0/16 0/0
 10.0.0.0/8 excludes NAT traffic of Vagrant and 192.168.0.0/16 excludes
 traffic to local area network (assuming that we're using 192.168.0.0 subnet).
 Assuming the VM has the IP 192.168.1.200 obtained on the bridge NIC (we can
 configure that in Vagrant), we can then ask Windows to route all its traffic
 via the VM by running the following in cmd.exe with admin right::
     route add 0.0.0.0 mask 0.0.0.0 192.168.1.200
--- a/requirements.txt
+++ b/requirements.txt
@ -0,0 +1 @@
 setuptools-scm==1.15.6
--- a/9
+++ b/9
@ -1,6 +1,11 @@
 #!/bin/sh
-if python3.5 -V 2>/dev/null; then
+source_dir="$(dirname $0)"
-	exec python3 -m "sshuttle" "$@"
+(cd "$source_dir" && "$source_dir/setup.py" --version > /dev/null)
 export PYTHONPATH="$source_dir:$PYTHONPATH"
 if python3.5 -V >/dev/null 2>&1; then
 	exec python3.5 -m "sshuttle" "$@"
 elif python2.7 -V >/dev/null 2>&1; then
 	exec python2.7 -m "sshuttle" "$@"
 else
 	exec python -m "sshuttle" "$@"
 fi
--- a/setup.cfg
+++ b/setup.cfg
@ -0,0 +1,9 @@
 [aliases]
 test=pytest
 [bdist_wheel]
 universal = 1
 [upload]
 sign=true
 identity=0x1784577F811F6EAC
--- a/setup.py
+++ b/setup.py
@ -19,12 +19,21 @@
 from setuptools import setup, find_packages
-with open('VERSION.txt', 'r') as f:
+
-    version = f.readline().strip()
+def version_scheme(version):
    from setuptools_scm.version import guess_next_dev_version
    version = guess_next_dev_version(version)
    return version.lstrip("v")
 setup(
    name="sshuttle",
-    version=version,
+    use_scm_version={
        'write_to': "sshuttle/version.py",
        'version_scheme': version_scheme,
    },
    setup_requires=['setuptools_scm'],
    # version=version,
    url='https://github.com/sshuttle/sshuttle',
    author='Brian May',
    author_email='brian@linuxpenguins.xyz',
@ -45,9 +54,9 @@ setup(
    ],
    entry_points={
        'console_scripts': [
-            'sshuttle = sshuttle.__main__',
+            'sshuttle = sshuttle.cmdline:main',
        ],
    },
-    tests_require=['pytest', 'mock'],
+    tests_require=['pytest', 'pytest-runner', 'mock'],
    keywords="ssh vpn",
 )
--- a/sshuttle/init.py
+++ b/sshuttle/init.py
@ -0,0 +1,4 @@
 try:
    from sshuttle.version import version as __version__
 except ImportError:
    __version__ = "unknown"
--- a/sshuttle/main.py
+++ b/sshuttle/main.py
@ -1,230 +1,4 @@
 """Coverage.py's main entry point."""
 import sys
-import re
+from sshuttle.cmdline import main
-import socket
+sys.exit(main())
 import sshuttle.helpers as helpers
 import sshuttle.options as options
 import sshuttle.client as client
 import sshuttle.firewall as firewall
 import sshuttle.hostwatch as hostwatch
 import sshuttle.ssyslog as ssyslog
 from sshuttle.helpers import family_ip_tuple, log, Fatal
 # 1.2.3.4/5 or just 1.2.3.4
 def parse_subnet4(s):
    m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
    if not m:
        raise Fatal('%r is not a valid IP subnet format' % s)
    (a, b, c, d, width) = m.groups()
    (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
    if width is None:
        width = 32
    else:
        width = int(width)
    if a > 255 or b > 255 or c > 255 or d > 255:
        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
    if width > 32:
        raise Fatal('*/%d is greater than the maximum of 32' % width)
    return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)
 # 1:2::3/64 or just 1:2::3
 def parse_subnet6(s):
    m = re.match(r'(?:([a-fA-F\d:]+))?(?:/(\d+))?$', s)
    if not m:
        raise Fatal('%r is not a valid IP subnet format' % s)
    (net, width) = m.groups()
    if width is None:
        width = 128
    else:
        width = int(width)
    if width > 128:
        raise Fatal('*/%d is greater than the maximum of 128' % width)
    return(socket.AF_INET6, net, width)
 # Subnet file, supporting empty lines and hash-started comment lines
 def parse_subnet_file(s):
    try:
        handle = open(s, 'r')
    except OSError:
        raise Fatal('Unable to open subnet file: %s' % s)
    raw_config_lines = handle.readlines()
    config_lines = []
    for line_no, line in enumerate(raw_config_lines):
        line = line.strip()
        if len(line) == 0:
            continue
        if line[0] == '#':
            continue
        config_lines.append(line)
    return config_lines
 # list of:
 # 1.2.3.4/5 or just 1.2.3.4
 # 1:2::3/64 or just 1:2::3
 def parse_subnets(subnets_str):
    subnets = []
    for s in subnets_str:
        if ':' in s:
            subnet = parse_subnet6(s)
        else:
            subnet = parse_subnet4(s)
        subnets.append(subnet)
    return subnets
 # 1.2.3.4:567 or just 1.2.3.4 or just 567
 def parse_ipport4(s):
    s = str(s)
    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
    if not m:
        raise Fatal('%r is not a valid IP:port format' % s)
    (a, b, c, d, port) = m.groups()
    (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
                          int(port or 0))
    if a > 255 or b > 255 or c > 255 or d > 255:
        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
    if port > 65535:
        raise Fatal('*:%d is greater than the maximum of 65535' % port)
    if a is None:
        a = b = c = d = 0
    return ('%d.%d.%d.%d' % (a, b, c, d), port)
 # [1:2::3]:456 or [1:2::3] or 456
 def parse_ipport6(s):
    s = str(s)
    m = re.match(r'(?:\[([^]]*)])?(?::)?(?:(\d+))?$', s)
    if not m:
        raise Fatal('%s is not a valid IP:port format' % s)
    (ip, port) = m.groups()
    (ip, port) = (ip or '::', int(port or 0))
    return (ip, port)
 def parse_list(list):
    return re.split(r'[\s,]+', list.strip()) if list else []
 optspec = """
 sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
 sshuttle --firewall <port> <subnets...>
 sshuttle --hostwatch
 --
 l,listen=  transproxy to this ip address and port number
 H,auto-hosts scan for remote hostnames and update local /etc/hosts
 N,auto-nets  automatically determine subnets to route
 dns        capture local DNS requests and forward to the remote DNS server
 ns-hosts=  capture and forward remote DNS requests to the following servers
 method=    auto, nat, tproxy or pf
 python=    path to python interpreter on the remote server
 r,remote=  ssh hostname (and optional username) of remote sshuttle server
 x,exclude= exclude this subnet (can be used more than once)
 X,exclude-from=  exclude the subnets in a file (whitespace separated)
 v,verbose  increase debug message verbosity
 e,ssh-cmd= the command to use to connect to the remote [ssh]
 seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
 no-latency-control  sacrifice latency to improve bandwidth benchmarks
 wrap=      restart counting channel numbers after this number (for testing)
 D,daemon   run in the background as a daemon
 s,subnets= file where the subnets are stored, instead of on the command line
 syslog     send log messages to syslog (default if you use --daemon)
 pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
 server     (internal use only)
 firewall   (internal use only)
 hostwatch  (internal use only)
 """
 o = options.Options(optspec)
 (opt, flags, extra) = o.parse(sys.argv[1:])
 if opt.daemon:
    opt.syslog = 1
 if opt.wrap:
    import sshuttle.ssnet as ssnet
    ssnet.MAX_CHANNEL = int(opt.wrap)
 helpers.verbose = opt.verbose or 0
 try:
    if opt.firewall:
        if len(extra) != 0:
            o.fatal('exactly zero arguments expected')
        result = firewall.main(opt.method, opt.syslog)
        sys.exit(result)
    elif opt.hostwatch:
        sys.exit(hostwatch.hw_main(extra))
    else:
        if len(extra) < 1 and not opt.auto_nets and not opt.subnets:
            o.fatal('at least one subnet, subnet file, or -N expected')
        includes = extra
        excludes = ['127.0.0.0/8']
        for k, v in flags:
            if k in ('-x', '--exclude'):
                excludes.append(v)
            if k in ('-X', '--exclude-from'):
                excludes += open(v).read().split()
        remotename = opt.remote
        if remotename == '' or remotename == '-':
            remotename = None
        nslist = [family_ip_tuple(ns) for ns in parse_list(opt.ns_hosts)]
        if opt.seed_hosts and not opt.auto_hosts:
            o.fatal('--seed-hosts only works if you also use -H')
        if opt.seed_hosts:
            sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
        elif opt.auto_hosts:
            sh = []
        else:
            sh = None
        if opt.subnets:
            includes = parse_subnet_file(opt.subnets)
        if not opt.method:
            method_name = "auto"
        elif opt.method in ["auto", "nat", "tproxy", "pf"]:
            method_name = opt.method
        else:
            o.fatal("method_name %s not supported" % opt.method)
        if not opt.listen:
            ipport_v6 = "auto"  # parse_ipport6('[::1]:0')
            ipport_v4 = "auto"  # parse_ipport4('127.0.0.1:0')
        else:
            ipport_v6 = None
            ipport_v4 = None
            list = opt.listen.split(",")
            for ip in list:
                if '[' in ip and ']' in ip:
                    ipport_v6 = parse_ipport6(ip)
                else:
                    ipport_v4 = parse_ipport4(ip)
        if opt.syslog:
            ssyslog.start_syslog()
            ssyslog.stderr_to_syslog()
        return_code = client.main(ipport_v6, ipport_v4,
                                  opt.ssh_cmd,
                                  remotename,
                                  opt.python,
                                  opt.latency_control,
                                  opt.dns,
                                  nslist,
                                  method_name,
                                  sh,
                                  opt.auto_nets,
                                  parse_subnets(includes),
                                  parse_subnets(excludes),
                                  opt.daemon, opt.pidfile)
        if return_code == 0:
            log('Normal exit code, exiting...')
        else:
            log('Abnormal exit code detected, failing...' % return_code)
        sys.exit(return_code)
 except Fatal as e:
    log('fatal: %s\n' % e)
    sys.exit(99)
 except KeyboardInterrupt:
    log('\n')
    log('Keyboard interrupt: exiting.\n')
    sys.exit(1)
--- a/sshuttle/assembler.py
+++ b/sshuttle/assembler.py
@ -4,19 +4,20 @@ import imp
 z = zlib.decompressobj()
 while 1:
-    name = stdin.readline().strip()
+    name = sys.stdin.readline().strip()
    if name:
        name = name.decode("ASCII")
-        nbytes = int(stdin.readline())
+        nbytes = int(sys.stdin.readline())
        if verbosity >= 2:
            sys.stderr.write('server: assembling %r (%d bytes)\n'
                             % (name, nbytes))
-        content = z.decompress(stdin.read(nbytes))
+        content = z.decompress(sys.stdin.read(nbytes))
        module = imp.new_module(name)
-        parent, _, parent_name = name.rpartition(".")
+        parents = name.rsplit(".", 1)
-        if parent != "":
+        if len(parents) == 2:
            parent, parent_name = parents
            setattr(sys.modules[parent], parent_name, module)
        code = compile(content, name, "exec")
@ -33,4 +34,4 @@ sshuttle.helpers.verbose = verbosity
 import sshuttle.cmdline_options as options
 from sshuttle.server import main
-main(options.latency_control)
+main(options.latency_control, options.auto_hosts)
--- a/sshuttle/client.py
+++ b/sshuttle/client.py
@ -1,4 +1,3 @@
 import socket
 import errno
 import re
 import signal
@ -9,6 +8,7 @@ import os
 import sshuttle.ssnet as ssnet
 import sshuttle.ssh as ssh
 import sshuttle.ssyslog as ssyslog
 import sshuttle.sdnotify as sdnotify
 import sys
 import platform
 from sshuttle.ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper
@ -16,6 +16,20 @@ from sshuttle.helpers import log, debug1, debug2, debug3, Fatal, islocal, \
    resolvconf_nameservers
 from sshuttle.methods import get_method, Features
 try:
    # try getting recvmsg from python
    import socket as pythonsocket
    getattr(pythonsocket.socket, "recvmsg")
    socket = pythonsocket
 except AttributeError:
    # try getting recvmsg from socket_ext library
    try:
        import socket_ext
        getattr(socket_ext.socket, "recvmsg")
        socket = socket_ext
    except ImportError:
        import socket
 _extra_fd = os.open('/dev/null', os.O_RDONLY)
@ -95,16 +109,21 @@ def daemon_cleanup():
 class MultiListener:
    def __init__(self, type=socket.SOCK_STREAM, proto=0):
-        self.v6 = socket.socket(socket.AF_INET6, type, proto)
+        self.type = type
-        self.v4 = socket.socket(socket.AF_INET, type, proto)
+        self.proto = proto
        self.v6 = None
        self.v4 = None
        self.bind_called = False
    def setsockopt(self, level, optname, value):
        assert(self.bind_called)
        if self.v6:
            self.v6.setsockopt(level, optname, value)
        if self.v4:
            self.v4.setsockopt(level, optname, value)
    def add_handler(self, handlers, callback, method, mux):
        assert(self.bind_called)
        socks = []
        if self.v6:
            socks.append(self.v6)
@ -119,6 +138,7 @@ class MultiListener:
        )
    def listen(self, backlog):
        assert(self.bind_called)
        if self.v6:
            self.v6.listen(backlog)
        if self.v4:
@ -133,16 +153,23 @@ class MultiListener:
                    raise e
    def bind(self, address_v6, address_v4):
-        if address_v6 and self.v6:
+        assert(not self.bind_called)
        self.bind_called = True
        if address_v6 is not None:
            self.v6 = socket.socket(socket.AF_INET6, self.type, self.proto)
            self.v6.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            self.v6.bind(address_v6)
        else:
            self.v6 = None
-        if address_v4 and self.v4:
+        if address_v4 is not None:
            self.v4 = socket.socket(socket.AF_INET, self.type, self.proto)
            self.v4.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            self.v4.bind(address_v4)
        else:
            self.v4 = None
    def print_listening(self, what):
        assert(self.bind_called)
        if self.v6:
            listenip = self.v6.getsockname()
            debug1('%s listening on %r.\n' % (what, listenip))
@ -228,12 +255,13 @@ class FirewallClient:
    def start(self):
        self.pfile.write(b'ROUTES\n')
-        for (family, ip, width) in self.subnets_include + self.auto_nets:
+        for (family, ip, width, fport, lport) \
-            self.pfile.write(b'%d,%d,0,%s\n'
+                in self.subnets_include + self.auto_nets:
-                             % (family, width, ip.encode("ASCII")))
+            self.pfile.write(b'%d,%d,0,%s,%d,%d\n'
-        for (family, ip, width) in self.subnets_exclude:
+                    % (family, width, ip.encode("ASCII"), fport, lport))
-            self.pfile.write(b'%d,%d,1,%s\n'
+        for (family, ip, width, fport, lport) in self.subnets_exclude:
-                             % (family, width, ip.encode("ASCII")))
+            self.pfile.write(b'%d,%d,1,%s,%d,%d\n'
                    % (family, width, ip.encode("ASCII"), fport, lport))
        self.pfile.write(b'NSLIST\n')
        for (family, ip) in self.nslist:
@ -387,7 +415,7 @@ def ondns(listener, method, mux, handlers):
 def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
          python, latency_control,
-          dns_listener, seed_hosts, auto_nets, daemon):
+          dns_listener, seed_hosts, auto_hosts, auto_nets, daemon):
    debug1('Starting client with Python version %s\n'
           % platform.python_version())
@ -405,7 +433,8 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
        (serverproc, serversock) = ssh.connect(
            ssh_cmd, remotename, python,
            stderr=ssyslog._p and ssyslog._p.stdin,
-            options=dict(latency_control=latency_control))
+            options=dict(latency_control=latency_control,
                auto_hosts=auto_hosts))
    except socket.error as e:
        if e.args[0] == errno.EPIPE:
            raise Fatal("failed to establish ssh session (1)")
@ -456,7 +485,7 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
                    debug2("Ignored auto net %d/%s/%d\n" % (family, ip, width))
                else:
                    debug2("Adding auto net %d/%s/%d\n" % (family, ip, width))
-                    fw.auto_nets.append((family, ip, width))
+                    fw.auto_nets.append((family, ip, width, 0, 0))
        # we definitely want to do this *after* starting ssh, or we might end
        # up intercepting the ssh connection!
@ -487,7 +516,10 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
    if seed_hosts is not None:
        debug1('seed_hosts: %r\n' % seed_hosts)
-        mux.send(0, ssnet.CMD_HOST_REQ, b'\n'.join(seed_hosts))
+        mux.send(0, ssnet.CMD_HOST_REQ, str.encode('\n'.join(seed_hosts)))
    sdnotify.send(sdnotify.ready(),
                  sdnotify.status('Connected to %s.' % remotename))
    while 1:
        rv = serverproc.poll()
@ -501,7 +533,7 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
 def main(listenip_v6, listenip_v4,
         ssh_cmd, remotename, python, latency_control, dns, nslist,
-         method_name, seed_hosts, auto_nets,
+         method_name, seed_hosts, auto_hosts, auto_nets,
         subnets_include, subnets_exclude, daemon, pidfile):
    if daemon:
@ -534,11 +566,16 @@ def main(listenip_v6, listenip_v4,
        else:
            listenip_v6 = None
-    required.ipv6 = len(subnets_v6) > 0 or len(nslist_v6) > 0 \
+    required.ipv6 = len(subnets_v6) > 0 or listenip_v6 is not None
-        or listenip_v6 is not None
+    required.ipv4 = len(subnets_v4) > 0 or listenip_v4 is not None
    required.udp = avail.udp
    required.dns = len(nslist) > 0
    # if IPv6 not supported, ignore IPv6 DNS servers
    if not required.ipv6:
        nslist_v6 = []
        nslist = nslist_v4
    fw.method.assert_features(required)
    if required.ipv6 and listenip_v6 is None:
@ -553,6 +590,14 @@ def main(listenip_v6, listenip_v4,
    if listenip_v4 == "auto":
        listenip_v4 = ('127.0.0.1', 0)
    if required.ipv4 and \
            not any(listenip_v4[0] == sex[1] for sex in subnets_v4):
        subnets_exclude.append((socket.AF_INET, listenip_v4[0], 32, 0, 0))
    if required.ipv6 and \
            not any(listenip_v6[0] == sex[1] for sex in subnets_v6):
        subnets_exclude.append((socket.AF_INET6, listenip_v6[0], 128, 0, 0))
    if listenip_v6 and listenip_v6[1] and listenip_v4 and listenip_v4[1]:
        # if both ports given, no need to search for a spare port
        ports = [0, ]
@ -569,11 +614,9 @@ def main(listenip_v6, listenip_v4,
    for port in ports:
        debug2(' %d' % port)
        tcp_listener = MultiListener()
        tcp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        if required.udp:
            udp_listener = MultiListener(socket.SOCK_DGRAM)
            udp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        else:
            udp_listener = None
@ -698,7 +741,7 @@ def main(listenip_v6, listenip_v4,
    try:
        return _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
                     python, latency_control, dns_listener,
-                     seed_hosts, auto_nets, daemon)
+                     seed_hosts, auto_hosts, auto_nets, daemon)
    finally:
        try:
            if daemon:
--- a/sshuttle/cmdline.py
+++ b/sshuttle/cmdline.py
@ -0,0 +1,90 @@
 import re
 import socket
 import sshuttle.helpers as helpers
 import sshuttle.client as client
 import sshuttle.firewall as firewall
 import sshuttle.hostwatch as hostwatch
 import sshuttle.ssyslog as ssyslog
 from sshuttle.options import parser, parse_ipport
 from sshuttle.helpers import family_ip_tuple, log, Fatal
 def main():
    opt = parser.parse_args()
    if opt.daemon:
        opt.syslog = 1
    if opt.wrap:
        import sshuttle.ssnet as ssnet
        ssnet.MAX_CHANNEL = opt.wrap
    helpers.verbose = opt.verbose
    try:
        if opt.firewall:
            if opt.subnets or opt.subnets_file:
                parser.error('exactly zero arguments expected')
            return firewall.main(opt.method, opt.syslog)
        elif opt.hostwatch:
            return hostwatch.hw_main(opt.subnets)
        else:
            includes = opt.subnets + opt.subnets_file
            excludes = opt.exclude
            if not includes and not opt.auto_nets:
                parser.error('at least one subnet, subnet file, '
                             'or -N expected')
            remotename = opt.remote
            if remotename == '' or remotename == '-':
                remotename = None
            nslist = [family_ip_tuple(ns) for ns in opt.ns_hosts]
            if opt.seed_hosts:
                sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
            elif opt.auto_hosts:
                sh = []
            else:
                sh = None
            if opt.listen:
                ipport_v6 = None
                ipport_v4 = None
                list = opt.listen.split(",")
                for ip in list:
                    family, ip, port = parse_ipport(ip)
                    if family == socket.AF_INET6:
                        ipport_v6 = (ip, port)
                    else:
                        ipport_v4 = (ip, port)
            else:
                # parse_ipport4('127.0.0.1:0')
                ipport_v4 = "auto"
                # parse_ipport6('[::1]:0')
                ipport_v6 = "auto" if not opt.disable_ipv6 else None
            if opt.syslog:
                ssyslog.start_syslog()
                ssyslog.stderr_to_syslog()
            return_code = client.main(ipport_v6, ipport_v4,
                                      opt.ssh_cmd,
                                      remotename,
                                      opt.python,
                                      opt.latency_control,
                                      opt.dns,
                                      nslist,
                                      opt.method,
                                      sh,
                                      opt.auto_hosts,
                                      opt.auto_nets,
                                      includes,
                                      excludes,
                                      opt.daemon, opt.pidfile)
            if return_code == 0:
                log('Normal exit code, exiting...')
            else:
                log('Abnormal exit code detected, failing...' % return_code)
            return return_code
    except Fatal as e:
        log('fatal: %s\n' % e)
        return 99
    except KeyboardInterrupt:
        log('\n')
        log('Keyboard interrupt: exiting.\n')
        return 1
--- a/sshuttle/firewall.py
+++ b/sshuttle/firewall.py
@ -74,6 +74,16 @@ def setup_daemon():
    return sys.stdin, sys.stdout
 # Note that we're sorting in a very particular order:
 # we need to go from smaller, more specific, port ranges, to larger,
 # less-specific, port ranges. At each level, we order by subnet
 # width, from most-specific subnets (largest swidth) to
 # least-specific. On ties, excludes come first.
 # s:(inet, subnet width, exclude flag, subnet, first port, last port)
 def subnet_weight(s):
    return (-s[-1] + (s[-2] or -65535), s[1], s[2])
 # This is some voodoo for setting up the kernel's transparent
 # proxying stuff.  If subnets is empty, we just delete our sshuttle rules;
 # otherwise we delete it, then make them from scratch.
@ -119,10 +129,17 @@ def main(method_name, syslog):
        elif line.startswith("NSLIST\n"):
            break
        try:
-            (family, width, exclude, ip) = line.strip().split(',', 3)
+            (family, width, exclude, ip, fport, lport) = \
                    line.strip().split(',', 5)
        except:
            raise Fatal('firewall: expected route or NSLIST but got %r' % line)
-        subnets.append((int(family), int(width), bool(int(exclude)), ip))
+        subnets.append((
            int(family),
            int(width),
            bool(int(exclude)),
            ip,
            int(fport),
            int(lport)))
    debug2('firewall manager: Got subnets: %r\n' % subnets)
    nslist = []
@ -221,6 +238,7 @@ def main(method_name, syslog):
                break
    finally:
        try:
            sdnotify.send(sdnotify.stop())
            debug1('firewall manager: undoing changes.\n')
        except:
            pass
--- a/sshuttle/helpers.py
+++ b/sshuttle/helpers.py
@ -5,6 +5,17 @@ import errno
 logprefix = ''
 verbose = 0
 if sys.version_info[0] == 3:
    binary_type = bytes
    def b(s):
        return s.encode("ASCII")
 else:
    binary_type = str
    def b(s):
        return s
 def log(s):
    global logprefix
@ -70,7 +81,8 @@ def islocal(ip, family):
    try:
        try:
            sock.bind((ip, 0))
-        except socket.error as e:
+        except socket.error:
            _, e = sys.exc_info()[:2]
            if e.args[0] == errno.EADDRNOTAVAIL:
                return False  # not a local IP
            else:
--- a/sshuttle/hostwatch.py
+++ b/sshuttle/hostwatch.py
@ -22,7 +22,8 @@ hostnames = {}
 queue = {}
 try:
    null = open('/dev/null', 'wb')
-except IOError as e:
+except IOError:
    _, e = sys.exc_info()[:2]
    log('warning: %s\n' % e)
    null = os.popen("sh -c 'while read x; do :; done'", 'wb', 4096)
@ -38,7 +39,7 @@ def write_host_cache():
        for name, ip in sorted(hostnames.items()):
            f.write(('%s,%s\n' % (name, ip)).encode("ASCII"))
        f.close()
-        os.chmod(tmpname, 0o600)
+        os.chmod(tmpname, 384)  # 600 in octal, 'rw-------'
        os.rename(tmpname, CACHEFILE)
    finally:
        try:
@ -50,7 +51,8 @@ def write_host_cache():
 def read_host_cache():
    try:
        f = open(CACHEFILE)
-    except IOError as e:
+    except IOError:
        _, e = sys.exc_info()[:2]
        if e.errno == errno.ENOENT:
            return
        else:
@ -68,8 +70,8 @@ def read_host_cache():
 def found_host(hostname, ip):
    hostname = re.sub(r'\..*', '', hostname)
    hostname = re.sub(r'[^-\w]', '_', hostname)
-    if (ip.startswith('127.') or ip.startswith('255.')
+    if (ip.startswith('127.') or ip.startswith('255.') or
-            or hostname == 'localhost'):
+            hostname == 'localhost'):
        return
    oldip = hostnames.get(hostname)
    if oldip != ip:
@ -124,7 +126,8 @@ def _check_netstat():
        p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
        content = p.stdout.read().decode("ASCII")
        p.wait()
-    except OSError as e:
+    except OSError:
        _, e = sys.exc_info()[:2]
        log('%r failed: %r\n' % (argv, e))
        return
@ -144,7 +147,8 @@ def _check_smb(hostname):
        p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
        lines = p.stdout.readlines()
        p.wait()
-    except OSError as e:
+    except OSError:
        _, e = sys.exc_info()[:2]
        log('%r failed: %r\n' % (argv, e))
        _smb_ok = False
        return
@ -201,7 +205,8 @@ def _check_nmb(hostname, is_workgroup, is_master):
        p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
        lines = p.stdout.readlines()
        rv = p.wait()
-    except OSError as e:
+    except OSError:
        _, e = sys.exc_info()[:2]
        log('%r failed: %r\n' % (argv, e))
        _nmb_ok = False
        return
@ -250,7 +255,7 @@ def _stdin_still_ok(timeout):
    return True
-def hw_main(seed_hosts):
+def hw_main(seed_hosts, auto_hosts):
    if helpers.verbose >= 2:
        helpers.logprefix = 'HH: '
    else:
@ -259,17 +264,18 @@ def hw_main(seed_hosts):
    debug1('Starting hostwatch with Python version %s\n'
           % platform.python_version())
    read_host_cache()
    _enqueue(_check_etc_hosts)
    _enqueue(_check_netstat)
    check_host('localhost')
    check_host(socket.gethostname())
    check_workgroup('workgroup')
    check_workgroup('-')
    for h in seed_hosts:
        check_host(h)
    if auto_hosts:
        read_host_cache()
        _enqueue(_check_etc_hosts)
        _enqueue(_check_netstat)
        check_host('localhost')
        check_host(socket.gethostname())
        check_workgroup('workgroup')
        check_workgroup('-')
    while 1:
        now = time.time()
        for t, last_polled in list(queue.items()):
--- a/sshuttle/linux.py
+++ b/sshuttle/linux.py
@ -1,3 +1,4 @@
 import os
 import socket
 import subprocess as ssubprocess
 from sshuttle.helpers import log, debug1, Fatal, family_to_string
@ -18,7 +19,11 @@ def ipt_chain_exists(family, table, name):
    else:
        raise Exception('Unsupported family "%s"' % family_to_string(family))
    argv = [cmd, '-t', table, '-nL']
-    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
+    env = {
        'PATH': os.environ['PATH'],
        'LC_ALL': "C",
    }
    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, env=env)
    for line in p.stdout:
        if line.startswith(b'Chain %s ' % name.encode("ASCII")):
            return True
@ -35,7 +40,11 @@ def ipt(family, table, *args):
    else:
        raise Exception('Unsupported family "%s"' % family_to_string(family))
    debug1('>> %s\n' % ' '.join(argv))
-    rv = ssubprocess.call(argv)
+    env = {
        'PATH': os.environ['PATH'],
        'LC_ALL': "C",
    }
    rv = ssubprocess.call(argv, env=env)
    if rv:
        raise Fatal('%r returned %d' % (argv, rv))
--- a/sshuttle/methods/init.py
+++ b/sshuttle/methods/init.py
@ -98,6 +98,8 @@ def get_auto_method():
        method_name = "nat"
    elif _program_exists('pfctl'):
        method_name = "pf"
    elif _program_exists('ipfw'):
        method_name = "ipfw"
    else:
        raise Fatal(
            "can't find either iptables or pfctl; check your PATH")
--- a/sshuttle/methods/ipfw.py
+++ b/sshuttle/methods/ipfw.py
@ -0,0 +1,268 @@
 import os
 import sys
 import struct
 import subprocess as ssubprocess
 from sshuttle.methods import BaseMethod
 from sshuttle.helpers import log, debug1, debug3, \
    Fatal, family_to_string
 recvmsg = None
 try:
    # try getting recvmsg from python
    import socket as pythonsocket
    getattr(pythonsocket.socket, "recvmsg")
    socket = pythonsocket
    recvmsg = "python"
 except AttributeError:
    # try getting recvmsg from socket_ext library
    try:
        import socket_ext
        getattr(socket_ext.socket, "recvmsg")
        socket = socket_ext
        recvmsg = "socket_ext"
    except ImportError:
        import socket
 IP_BINDANY = 24
 IP_RECVDSTADDR = 7
 SOL_IPV6 = 41
 IPV6_RECVDSTADDR = 74
 if recvmsg == "python":
    def recv_udp(listener, bufsize):
        debug3('Accept UDP python using recvmsg.\n')
        data, ancdata, msg_flags, srcip = listener.recvmsg(4096, socket.CMSG_SPACE(4))
        dstip = None
        family = None
        for cmsg_level, cmsg_type, cmsg_data in ancdata:
            if cmsg_level == socket.SOL_IP and cmsg_type == IP_RECVDSTADDR:
                port = 53
                ip = socket.inet_ntop(socket.AF_INET, cmsg_data[0:4])
                dstip = (ip, port)
                break
        return (srcip, dstip, data)
 elif recvmsg == "socket_ext":
    def recv_udp(listener, bufsize):
        debug3('Accept UDP using socket_ext recvmsg.\n')
        srcip, data, adata, flags = listener.recvmsg((bufsize,), socket.CMSG_SPACE(4))
        dstip = None
        family = None
        for a in adata:
            if a.cmsg_level == socket.SOL_IP and a.cmsg_type == IP_RECVDSTADDR:
                port = 53
                ip = socket.inet_ntop(socket.AF_INET, cmsg_data[0:4])
                dstip = (ip, port)
                break
        return (srcip, dstip, data[0])
 else:
    def recv_udp(listener, bufsize):
        debug3('Accept UDP using recvfrom.\n')
        data, srcip = listener.recvfrom(bufsize)
        return (srcip, None, data)
 def ipfw_rule_exists(n):
    argv = ['ipfw', 'list']
    env = {
        'PATH': os.environ['PATH'],
        'LC_ALL': "C",
    }
    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, env=env)
    found = False
    for line in p.stdout:
        if line.startswith(b'%05d ' % n):
            if not ('ipttl 42' in line or 'check-state' in line):
                log('non-sshuttle ipfw rule: %r\n' % line.strip())
                raise Fatal('non-sshuttle ipfw rule #%d already exists!' % n)
                found = True
    rv = p.wait()
    if rv:
        raise Fatal('%r returned %d' % (argv, rv))
    return found
 _oldctls = {}
 def _fill_oldctls(prefix):
    argv = ['sysctl', prefix]
    env = {
        'PATH': os.environ['PATH'],
        'LC_ALL': "C",
    }
    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, env=env)
    for line in p.stdout:
        line = line.decode()
        assert(line[-1] == '\n')
        (k, v) = line[:-1].split(': ', 1)
        _oldctls[k] = v.strip()
    rv = p.wait()
    if rv:
        raise Fatal('%r returned %d' % (argv, rv))
    if not line:
        raise Fatal('%r returned no data' % (argv,))
 def _sysctl_set(name, val):
    argv = ['sysctl', '-w', '%s=%s' % (name, val)]
    debug1('>> %s\n' % ' '.join(argv))
    return ssubprocess.call(argv, stdout=open('/dev/null', 'w'))
 _changedctls = []
 def sysctl_set(name, val, permanent=False):
    PREFIX = 'net.inet.ip'
    assert(name.startswith(PREFIX + '.'))
    val = str(val)
    if not _oldctls:
        _fill_oldctls(PREFIX)
    if not (name in _oldctls):
        debug1('>> No such sysctl: %r\n' % name)
        return False
    oldval = _oldctls[name]
    if val != oldval:
        rv = _sysctl_set(name, val)
        if rv == 0 and permanent:
            debug1('>>   ...saving permanently in /etc/sysctl.conf\n')
            f = open('/etc/sysctl.conf', 'a')
            f.write('\n'
                    '# Added by sshuttle\n'
                    '%s=%s\n' % (name, val))
            f.close()
        else:
            _changedctls.append(name)
        return True
 def ipfw(*args):
    argv = ['ipfw', '-q'] + list(args)
    debug1('>> %s\n' % ' '.join(argv))
    rv = ssubprocess.call(argv)
    if rv:
        raise Fatal('%r returned %d' % (argv, rv))
 def ipfw_noexit(*args):
    argv = ['ipfw', '-q'] + list(args)
    debug1('>> %s\n' % ' '.join(argv))
    ssubprocess.call(argv)
 class Method(BaseMethod):
    def get_supported_features(self):
        result = super(Method, self).get_supported_features()
        result.ipv6 = False
        result.udp = False #NOTE: Almost there, kernel patch needed
        result.dns = True
        return result
    def get_tcp_dstip(self, sock):
        return sock.getsockname()
    def recv_udp(self, udp_listener, bufsize):
        srcip, dstip, data = recv_udp(udp_listener, bufsize)
        if not dstip:
            debug1(
                   "-- ignored UDP from %r: "
                   "couldn't determine destination IP address\n" % (srcip,))
            return None
        return srcip, dstip, data
    def send_udp(self, sock, srcip, dstip, data):
        if not srcip:
            debug1(
               "-- ignored UDP to %r: "
               "couldn't determine source IP address\n" % (dstip,))
            return
        #debug3('Sending SRC: %r DST: %r\n' % (srcip, dstip))
        sender = socket.socket(sock.family, socket.SOCK_DGRAM)
        sender.setsockopt(socket.SOL_IP, IP_BINDANY, 1)
        sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        sender.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
        sender.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
        sender.bind(srcip)
        sender.sendto(data,dstip)
        sender.close()
    def setup_udp_listener(self, udp_listener):
        if udp_listener.v4 is not None:
            udp_listener.v4.setsockopt(socket.SOL_IP, IP_RECVDSTADDR, 1)
        #if udp_listener.v6 is not None:
        #    udp_listener.v6.setsockopt(SOL_IPV6, IPV6_RECVDSTADDR, 1)
    def setup_firewall(self, port, dnsport, nslist, family, subnets, udp):
        # IPv6 not supported
        if family not in [socket.AF_INET ]:
            raise Exception(
                'Address family "%s" unsupported by ipfw method_name'
                % family_to_string(family))
        #XXX: Any risk from this?
        ipfw_noexit('delete', '1')
        while _changedctls:
            name = _changedctls.pop()
            oldval = _oldctls[name]
            _sysctl_set(name, oldval)
        if subnets or dnsport:
            sysctl_set('net.inet.ip.fw.enable', 1)
        ipfw('add', '1', 'check-state', 'ip',
             'from', 'any', 'to', 'any')
        ipfw('add', '1', 'skipto', '2',
             'tcp',
             'from', 'any', 'to', 'table(125)')
        ipfw('add', '1', 'fwd', '127.0.0.1,%d' % port,
             'tcp',
             'from', 'any', 'to', 'table(126)',
             'not', 'ipttl', '42', 'keep-state', 'setup')
        ipfw_noexit('table', '124', 'flush')
        dnscount = 0
        for f, ip in [i for i in nslist if i[0] == family]:
            ipfw('table', '124', 'add', '%s' % (ip))
            dnscount += 1
        if dnscount > 0:
            ipfw('add', '1', 'fwd', '127.0.0.1,%d' % dnsport,
                 'udp',
                 'from', 'any', 'to', 'table(124)',
                 'not', 'ipttl', '42')
        """if udp:
            ipfw('add', '1', 'skipto', '2',
                 'udp',
                 'from', 'any', 'to', 'table(125)')
            ipfw('add', '1', 'fwd', '127.0.0.1,%d' % port,
                 'udp',
                 'from', 'any', 'to', 'table(126)',
                 'not', 'ipttl', '42')
        """
        ipfw('add', '1', 'allow', 
             'udp',
             'from', 'any', 'to', 'any',
             'ipttl', '42')
        if subnets:
            # create new subnet entries
            for f, swidth, sexclude, snet \
                in sorted(subnets, key=lambda s: s[1], reverse=True):
                if sexclude:
                    ipfw('table', '125', 'add', '%s/%s' % (snet, swidth))
            else:
                ipfw('table', '126', 'add', '%s/%s' % (snet, swidth))
    def restore_firewall(self, port, family, udp):
        if family not in [socket.AF_INET]:
            raise Exception(
                'Address family "%s" unsupported by tproxy method'
                % family_to_string(family))
        ipfw_noexit('delete', '1')
        ipfw_noexit('table', '124', 'flush')
        ipfw_noexit('table', '125', 'flush')
        ipfw_noexit('table', '126', 'flush')
--- a/sshuttle/methods/nat.py
+++ b/sshuttle/methods/nat.py
@ -1,4 +1,5 @@
 import socket
 from sshuttle.firewall import subnet_weight
 from sshuttle.helpers import family_to_string
 from sshuttle.linux import ipt, ipt_ttl, ipt_chain_exists, nonfatal
 from sshuttle.methods import BaseMethod
@ -38,22 +39,21 @@ class Method(BaseMethod):
        _ipt('-I', 'OUTPUT', '1', '-j', chain)
        _ipt('-I', 'PREROUTING', '1', '-j', chain)
-        # create new subnet entries.  Note that we're sorting in a very
+        # create new subnet entries.
-        # particular order: we need to go from most-specific (largest
+        for f, swidth, sexclude, snet, fport, lport \
-        # swidth) to least-specific, and at any given level of specificity,
+                in sorted(subnets, key=subnet_weight, reverse=True):
-        # we want excludes to come first.  That's why the columns are in
+            tcp_ports = ('-p', 'tcp')
-        # such a non- intuitive order.
+            if fport:
-        for f, swidth, sexclude, snet \
+                tcp_ports = tcp_ports + ('--dport', '%d:%d' % (fport, lport))
-                in sorted(subnets, key=lambda s: s[1], reverse=True):
+
            if sexclude:
                _ipt('-A', chain, '-j', 'RETURN',
                     '--dest', '%s/%s' % (snet, swidth),
-                     '-p', 'tcp')
+                     *tcp_ports)
            else:
                _ipt_ttl('-A', chain, '-j', 'REDIRECT',
                         '--dest', '%s/%s' % (snet, swidth),
-                         '-p', 'tcp',
+                         *(tcp_ports + ('--to-ports', str(port))))
                         '--to-ports', str(port))
        for f, ip in [i for i in nslist if i[0] == family]:
            _ipt_ttl('-A', chain, '-j', 'REDIRECT',
--- a/sshuttle/methods/pf.py
+++ b/sshuttle/methods/pf.py
@ -1,64 +1,304 @@
 import os
 import sys
 import platform
 import re
 import socket
 import struct
 import subprocess as ssubprocess
 import shlex
 from fcntl import ioctl
 from ctypes import c_char, c_uint8, c_uint16, c_uint32, Union, Structure, \
    sizeof, addressof, memmove
 from sshuttle.firewall import subnet_weight
 from sshuttle.helpers import debug1, debug2, debug3, Fatal, family_to_string
 from sshuttle.methods import BaseMethod
-def pfctl(args, stdin=None):
+_pf_context = {'started_by_sshuttle': False, 'Xtoken': []}
    argv = ['pfctl'] + list(args.split(" "))
    debug1('>> %s\n' % ' '.join(argv))
    p = ssubprocess.Popen(argv, stdin=ssubprocess.PIPE,
                          stdout=ssubprocess.PIPE,
                          stderr=ssubprocess.PIPE)
    o = p.communicate(stdin)
    if p.returncode:
        raise Fatal('%r returned %d' % (argv, p.returncode))
    return o
 _pf_context = {'started_by_sshuttle': False, 'Xtoken': None}
 _pf_fd = None
-class OsDefs(object):
+class Generic(object):
    MAXPATHLEN = 1024
    PF_CHANGE_ADD_TAIL = 2
    PF_CHANGE_GET_TICKET = 6
    PF_PASS = 0
    PF_RDR = 8
    PF_OUT = 2
    ACTION_OFFSET = 0
    POOL_TICKET_OFFSET = 8
    ANCHOR_CALL_OFFSET = 1040
-    def __init__(self, platform=None):
+    class pf_addr(Structure):
-        if platform is None:
+        class _pfa(Union):
-            platform = sys.platform
+             _fields_ = [("v4", c_uint32),     # struct in_addr
-        self.platform = platform
+                        ("v6", c_uint32 * 4),  # struct in6_addr
                        ("addr8", c_uint8 * 16),
                        ("addr16", c_uint16 * 8),
                        ("addr32", c_uint32 * 4)]
-        # This are some classes and functions used to support pf in yosemite.
+        _fields_ = [("pfa", _pfa)]
-        if platform == 'darwin':
+        _anonymous_ = ("pfa",)
            class pf_state_xport(Union):
                _fields_ = [("port", c_uint16),
                            ("call_id", c_uint16),
                            ("spi", c_uint32)]
        else:
            class pf_state_xport(Union):
                _fields_ = [("port", c_uint16),
                            ("call_id", c_uint16)]
-        class pf_addr(Structure):
+    def __init__(self):
        self.status = b''
        self.pfioc_pooladdr = c_char * 1136
-            class _pfa(Union):
+        self.DIOCNATLOOK = (
-                _fields_ = [("v4",            c_uint32),      # struct in_addr
+            (0x40000000 | 0x80000000) |
-                            ("v6",            c_uint32 * 4),  # struct in6_addr
+            ((sizeof(self.pfioc_natlook) & 0x1fff) << 16) |
-                            ("addr8",         c_uint8 * 16),
+            ((ord('D')) << 8) | (23))
-                            ("addr16",        c_uint16 * 8),
+        self.DIOCCHANGERULE = (
-                            ("addr32",        c_uint32 * 4)]
+            (0x40000000 | 0x80000000) |
            ((sizeof(self.pfioc_rule) & 0x1fff) << 16) |
            ((ord('D')) << 8) | (26))
        self.DIOCBEGINADDRS = (
            (0x40000000 | 0x80000000) |
            ((sizeof(self.pfioc_pooladdr) & 0x1fff) << 16) |
            ((ord('D')) << 8) | (51))
-            _fields_ = [("pfa",               _pfa)]
+    def enable(self):
-            _anonymous_ = ("pfa",)
+        if b'INFO:\nStatus: Disabled' in self.status:
            pfctl('-e')
            _pf_context['started_by_sshuttle'] = True
    def disable(self, anchor):
        pfctl('-a %s -F all' % anchor)
        if _pf_context['started_by_sshuttle']:
            pfctl('-d')
            _pf_context['started_by_sshuttle'] = False
    def query_nat(self, family, proto, src_ip, src_port, dst_ip, dst_port):
        [proto, family, src_port, dst_port] = [
            int(v) for v in [proto, family, src_port, dst_port]]
        packed_src_ip = socket.inet_pton(family, src_ip)
        packed_dst_ip = socket.inet_pton(family, dst_ip)
        assert len(packed_src_ip) == len(packed_dst_ip)
        length = len(packed_src_ip)
        pnl = self.pfioc_natlook()
        pnl.proto = proto
        pnl.direction = self.PF_OUT
        pnl.af = family
        memmove(addressof(pnl.saddr), packed_src_ip, length)
        memmove(addressof(pnl.daddr), packed_dst_ip, length)
        self._add_natlook_ports(pnl, src_port, dst_port)
        ioctl(pf_get_dev(), self.DIOCNATLOOK,
              (c_char * sizeof(pnl)).from_address(addressof(pnl)))
        ip = socket.inet_ntop(
            pnl.af, (c_char * length).from_address(addressof(pnl.rdaddr)).raw)
        port = socket.ntohs(self._get_natlook_port(pnl.rdxport))
        return (ip, port)
    def _add_natlook_ports(self, pnl, src_port, dst_port):
        pnl.sxport = socket.htons(src_port)
        pnl.dxport = socket.htons(dst_port)
    def _get_natlook_port(self, xport):
        return xport
    def add_anchors(self, anchor, status=None):
        if status is None:
            status = pfctl('-s all')[0]
        self.status = status
        if ('\nanchor "%s"' % anchor).encode('ASCII') not in status:
            self._add_anchor_rule(self.PF_PASS, anchor.encode('ASCII'))
    def _add_anchor_rule(self, type, name, pr=None):
        if pr is None:
            pr = self.pfioc_rule()
        memmove(addressof(pr) + self.ANCHOR_CALL_OFFSET, name,
                min(self.MAXPATHLEN, len(name)))  # anchor_call = name
        memmove(addressof(pr) + self.RULE_ACTION_OFFSET,
                struct.pack('I', type), 4)  # rule.action = type
        memmove(addressof(pr) + self.ACTION_OFFSET, struct.pack(
            'I', self.PF_CHANGE_GET_TICKET), 4)  # action = PF_CHANGE_GET_TICKET
        ioctl(pf_get_dev(), pf.DIOCCHANGERULE, pr)
        memmove(addressof(pr) + self.ACTION_OFFSET, struct.pack(
            'I', self.PF_CHANGE_ADD_TAIL), 4)  # action = PF_CHANGE_ADD_TAIL
        ioctl(pf_get_dev(), pf.DIOCCHANGERULE, pr)
    def _inet_version(self, family):
        return b'inet' if family == socket.AF_INET else b'inet6'
    def _lo_addr(self, family):
        return b'127.0.0.1' if family == socket.AF_INET else b'::1'
    def add_rules(self, anchor, rules):
        assert isinstance(rules, bytes)
        debug3("rules:\n" + rules.decode("ASCII"))
        pfctl('-a %s -f /dev/stdin' % anchor, rules)
    def has_skip_loopback(self):
        return b'skip' in pfctl('-s Interfaces -i lo -v')[0]
 class FreeBsd(Generic):
    RULE_ACTION_OFFSET = 2968
    def __new__(cls):
        class pfioc_natlook(Structure):
            pf_addr = Generic.pf_addr
            _fields_ = [("saddr", pf_addr),
                        ("daddr", pf_addr),
                        ("rsaddr", pf_addr),
                        ("rdaddr", pf_addr),
                        ("sxport", c_uint16),
                        ("dxport", c_uint16),
                        ("rsxport", c_uint16),
                        ("rdxport", c_uint16),
                        ("af", c_uint8),                      # sa_family_t
                        ("proto", c_uint8),
                        ("proto_variant", c_uint8),
                        ("direction", c_uint8)]
        freebsd = Generic.__new__(cls)
        freebsd.pfioc_rule = c_char * 3040
        freebsd.pfioc_natlook = pfioc_natlook
        return freebsd
    def __init__(self):
        super(FreeBsd, self).__init__()
    def add_anchors(self, anchor):
        status = pfctl('-s all')[0]
        if ('\nrdr-anchor "%s"' % anchor).encode('ASCII') not in status:
            self._add_anchor_rule(self.PF_RDR, anchor.encode('ASCII'))
        super(FreeBsd, self).add_anchors(anchor, status=status)
    def _add_anchor_rule(self, type, name):
        pr = self.pfioc_rule()
        ppa = self.pfioc_pooladdr()
        ioctl(pf_get_dev(), self.DIOCBEGINADDRS, ppa)
        # pool ticket
        memmove(addressof(pr) + self.POOL_TICKET_OFFSET, ppa[4:8], 4)
        super(FreeBsd, self)._add_anchor_rule(type, name, pr=pr)
    def add_rules(self, anchor, includes, port, dnsport, nslist, family):
        inet_version = self._inet_version(family)
        lo_addr = self._lo_addr(family)
        tables = []
        translating_rules = [
            b'rdr pass on lo0 %s proto tcp to %s '
            b'-> %s port %r' % (inet_version, subnet, lo_addr, port)
            for exclude, subnet in includes if not exclude
        ]
        filtering_rules = [
            b'pass out route-to lo0 %s proto tcp '
            b'to %s keep state' % (inet_version, subnet)
            if not exclude else
            b'pass out quick %s proto tcp to %s' % (inet_version, subnet)
            for exclude, subnet in includes
        ]
        if len(nslist) > 0:
            tables.append(
                b'table <dns_servers> {%s}' %
                b','.join([ns[1].encode("ASCII") for ns in nslist]))
            translating_rules.append(
                b'rdr pass on lo0 %s proto udp to <dns_servers> '
                b'port 53 -> %s port %r' % (inet_version, lo_addr, dnsport))
            filtering_rules.append(
                b'pass out route-to lo0 %s proto udp to '
                b'<dns_servers> port 53 keep state' % inet_version)
        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
                + b'\n'
        super(FreeBsd, self).add_rules(anchor, rules)
 class OpenBsd(Generic):
    POOL_TICKET_OFFSET = 4
    RULE_ACTION_OFFSET = 3324
    ANCHOR_CALL_OFFSET = 1036
    def __init__(self):
        class pfioc_natlook(Structure):
            pf_addr = Generic.pf_addr
            _fields_ = [("saddr", pf_addr),
                        ("daddr", pf_addr),
                        ("rsaddr", pf_addr),
                        ("rdaddr", pf_addr),
                        ("rdomain", c_uint16),
                        ("rrdomain", c_uint16),
                        ("sxport", c_uint16),
                        ("dxport", c_uint16),
                        ("rsxport", c_uint16),
                        ("rdxport", c_uint16),
                        ("af", c_uint8),                      # sa_family_t
                        ("proto", c_uint8),
                        ("proto_variant", c_uint8),
                        ("direction", c_uint8)]
        self.pfioc_rule = c_char * 3400
        self.pfioc_natlook = pfioc_natlook
        super(OpenBsd, self).__init__()
    def add_anchors(self, anchor):
        # before adding anchors and rules we must override the skip lo
        # that comes by default in openbsd pf.conf so the rules we will add,
        # which rely on translating/filtering  packets on lo, can work
        if self.has_skip_loopback():
            pfctl('-f /dev/stdin', b'match on lo\n')
        super(OpenBsd, self).add_anchors(anchor)
    def add_rules(self, anchor, includes, port, dnsport, nslist, family):
        inet_version = self._inet_version(family)
        lo_addr = self._lo_addr(family)
        tables = []
        translating_rules = [
            b'pass in on lo0 %s proto tcp to %s '
            b'divert-to %s port %r' % (inet_version, subnet, lo_addr, port)
            for exclude, subnet in includes if not exclude
        ]
        filtering_rules = [
            b'pass out %s proto tcp to %s '
            b'route-to lo0 keep state' % (inet_version, subnet)
            if not exclude else
            b'pass out quick %s proto tcp to %s' % (inet_version, subnet)
            for exclude, subnet in includes
        ]
        if len(nslist) > 0:
            tables.append(
                b'table <dns_servers> {%s}' %
                b','.join([ns[1].encode("ASCII") for ns in nslist]))
            translating_rules.append(
                b'pass in on lo0 %s proto udp to <dns_servers> port 53 '
                b'rdr-to %s port %r' % (inet_version, lo_addr, dnsport))
            filtering_rules.append(
                b'pass out %s proto udp to <dns_servers> port 53 '
                b'route-to lo0 keep state' % inet_version)
        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
                + b'\n'
        super(OpenBsd, self).add_rules(anchor, rules)
 class Darwin(FreeBsd):
    RULE_ACTION_OFFSET = 3068
    def __init__(self):
        class pf_state_xport(Union):
            _fields_ = [("port", c_uint16),
                        ("call_id", c_uint16),
                        ("spi", c_uint32)]
        class pfioc_natlook(Structure):
            pf_addr = Generic.pf_addr
            _fields_ = [("saddr", pf_addr),
                        ("daddr", pf_addr),
                        ("rsaddr", pf_addr),
@ -71,39 +311,71 @@ class OsDefs(object):
                        ("proto", c_uint8),
                        ("proto_variant", c_uint8),
                        ("direction", c_uint8)]
        self.pfioc_rule = c_char * 3104
        self.pfioc_natlook = pfioc_natlook
        super(Darwin, self).__init__()
-        # sizeof(struct pfioc_rule)
+    def enable(self):
-        self.pfioc_rule = c_char * \
+        o = pfctl('-E')
-            (3104 if platform == 'darwin' else 3040)
+        _pf_context['Xtoken'].append(re.search(b'Token : (.+)', o[1]).group(1))
-        # sizeof(struct pfioc_pooladdr)
+    def disable(self, anchor):
-        self.pfioc_pooladdr = c_char * 1136
+        pfctl('-a %s -F all' % anchor)
        if _pf_context['Xtoken']:
            pfctl('-X %s' % _pf_context['Xtoken'].pop().decode("ASCII"))
-        self.MAXPATHLEN = 1024
+    def add_anchors(self, anchor):
        # before adding anchors and rules we must override the skip lo
        # that in some cases ends up in the chain so the rules we will add,
        # which rely on translating/filtering  packets on lo, can work
        if self.has_skip_loopback():
            pfctl('-f /dev/stdin', b'pass on lo\n')
        super(Darwin, self).add_anchors(anchor)
-        self.DIOCNATLOOK = (
+    def _add_natlook_ports(self, pnl, src_port, dst_port):
-            (0x40000000 | 0x80000000) |
+        pnl.sxport.port = socket.htons(src_port)
-            ((sizeof(pfioc_natlook) & 0x1fff) << 16) |
+        pnl.dxport.port = socket.htons(dst_port)
            ((ord('D')) << 8) | (23))
        self.DIOCCHANGERULE = (
            (0x40000000 | 0x80000000) |
            ((sizeof(self.pfioc_rule) & 0x1fff) << 16) |
            ((ord('D')) << 8) | (26))
        self.DIOCBEGINADDRS = (
            (0x40000000 | 0x80000000) |
            ((sizeof(self.pfioc_pooladdr) & 0x1fff) << 16) |
            ((ord('D')) << 8) | (51))
-        self.PF_CHANGE_ADD_TAIL = 2
+    def _get_natlook_port(self, xport):
-        self.PF_CHANGE_GET_TICKET = 6
+        return xport.port
        self.PF_PASS = 0
        self.PF_RDR = 8
-        self.PF_OUT = 2
+class PfSense(FreeBsd):
    RULE_ACTION_OFFSET = 3040
-osdefs = OsDefs()
+    def __init__(self):
        self.pfioc_rule = c_char * 3112
        super(PfSense, self).__init__()
 if sys.platform == 'darwin':
    pf = Darwin()
 elif sys.platform.startswith('openbsd'):
    pf = OpenBsd()
 elif platform.version().endswith('pfSense'):
    pf = PfSense()
 else:
    pf = FreeBsd()
 def pfctl(args, stdin=None):
    argv = ['pfctl'] + shlex.split(args)
    debug1('>> %s\n' % ' '.join(argv))
    env = {
        'PATH': os.environ['PATH'],
        'LC_ALL': "C",
    }
    p = ssubprocess.Popen(argv, stdin=ssubprocess.PIPE,
                          stdout=ssubprocess.PIPE,
                          stderr=ssubprocess.PIPE,
                          env=env)
    o = p.communicate(stdin)
    if p.returncode:
        raise Fatal('%r returned %d' % (argv, p.returncode))
    return o
 def pf_get_dev():
@ -114,62 +386,17 @@ def pf_get_dev():
    return _pf_fd
-def pf_query_nat(family, proto, src_ip, src_port, dst_ip, dst_port):
+def pf_get_anchor(family, port):
-    [proto, family, src_port, dst_port] = [
+    return 'sshuttle%s-%d' % ('' if family == socket.AF_INET else '6', port)
        int(v) for v in [proto, family, src_port, dst_port]]
    packed_src_ip = socket.inet_pton(family, src_ip)
    packed_dst_ip = socket.inet_pton(family, dst_ip)
    assert len(packed_src_ip) == len(packed_dst_ip)
    length = len(packed_src_ip)
    pnl = osdefs.pfioc_natlook()
    pnl.proto = proto
    pnl.direction = osdefs.PF_OUT
    pnl.af = family
    memmove(addressof(pnl.saddr), packed_src_ip, length)
    memmove(addressof(pnl.daddr), packed_dst_ip, length)
    pnl.sxport.port = socket.htons(src_port)
    pnl.dxport.port = socket.htons(dst_port)
    ioctl(pf_get_dev(), osdefs.DIOCNATLOOK,
          (c_char * sizeof(pnl)).from_address(addressof(pnl)))
    ip = socket.inet_ntop(
        pnl.af, (c_char * length).from_address(addressof(pnl.rdaddr)).raw)
    port = socket.ntohs(pnl.rdxport.port)
    return (ip, port)
 def pf_add_anchor_rule(type, name):
    ACTION_OFFSET = 0
    POOL_TICKET_OFFSET = 8
    ANCHOR_CALL_OFFSET = 1040
    RULE_ACTION_OFFSET = 3068 if osdefs.platform == 'darwin' else 2968
    pr = osdefs.pfioc_rule()
    ppa = osdefs.pfioc_pooladdr()
    ioctl(pf_get_dev(), osdefs.DIOCBEGINADDRS, ppa)
    memmove(addressof(pr) + POOL_TICKET_OFFSET, ppa[4:8], 4)  # pool_ticket
    memmove(addressof(pr) + ANCHOR_CALL_OFFSET, name,
            min(osdefs.MAXPATHLEN, len(name)))  # anchor_call = name
    memmove(addressof(pr) + RULE_ACTION_OFFSET,
            struct.pack('I', type), 4)  # rule.action = type
    memmove(addressof(pr) + ACTION_OFFSET, struct.pack(
        'I', osdefs.PF_CHANGE_GET_TICKET), 4)  # action = PF_CHANGE_GET_TICKET
    ioctl(pf_get_dev(), osdefs.DIOCCHANGERULE, pr)
    memmove(addressof(pr) + ACTION_OFFSET, struct.pack(
        'I', osdefs.PF_CHANGE_ADD_TAIL), 4)  # action = PF_CHANGE_ADD_TAIL
    ioctl(pf_get_dev(), osdefs.DIOCCHANGERULE, pr)
 class Method(BaseMethod):
    def get_supported_features(self):
        result = super(Method, self).get_supported_features()
        result.ipv6 = True
        return result
    def get_tcp_dstip(self, sock):
        pfile = self.firewall.pfile
@ -195,7 +422,7 @@ class Method(BaseMethod):
        translating_rules = []
        filtering_rules = []
-        if family != socket.AF_INET:
+        if family not in [socket.AF_INET, socket.AF_INET6]:
            raise Exception(
                'Address family "%s" unsupported by pf method_name'
                % family_to_string(family))
@ -207,72 +434,32 @@ class Method(BaseMethod):
            # If a given subnet is both included and excluded, list the
            # exclusion first; the table will ignore the second, opposite
            # definition
-            for f, swidth, sexclude, snet in sorted(
+            for f, swidth, sexclude, snet, fport, lport \
-                    subnets, key=lambda s: (s[1], s[2]), reverse=True):
+                    in sorted(subnets, key=subnet_weight, reverse=True):
-                includes.append(b"%s%s/%d" %
+                includes.append((sexclude, b"%s/%d%s" % (
-                                (b"!" if sexclude else b"",
+                    snet.encode("ASCII"),
-                                    snet.encode("ASCII"),
+                    swidth,
-                                    swidth))
+                    b" port %d:%d" % (fport, lport) if fport else b"")))
-            tables.append(
+        anchor = pf_get_anchor(family, port)
-                b'table <forward_subnets> {%s}' % b','.join(includes))
+        pf.add_anchors(anchor)
-            translating_rules.append(
+        pf.add_rules(anchor, includes, port, dnsport, nslist, family)
-                b'rdr pass on lo0 proto tcp '
+        pf.enable()
                b'to <forward_subnets> -> 127.0.0.1 port %r' % port)
            filtering_rules.append(
                b'pass out route-to lo0 inet proto tcp '
                b'to <forward_subnets> keep state')
        if len(nslist) > 0:
            tables.append(
                b'table <dns_servers> {%s}' %
                b','.join([ns[1].encode("ASCII") for ns in nslist]))
            translating_rules.append(
                b'rdr pass on lo0 proto udp to '
                b'<dns_servers> port 53 -> 127.0.0.1 port %r' % dnsport)
            filtering_rules.append(
                b'pass out route-to lo0 inet proto udp to '
                b'<dns_servers> port 53 keep state')
        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
                + b'\n'
        assert isinstance(rules, bytes)
        debug3("rules:\n" + rules.decode("ASCII"))
        pf_status = pfctl('-s all')[0]
        if b'\nrdr-anchor "sshuttle" all\n' not in pf_status:
            pf_add_anchor_rule(osdefs.PF_RDR, b"sshuttle")
        if b'\nanchor "sshuttle" all\n' not in pf_status:
            pf_add_anchor_rule(osdefs.PF_PASS, b"sshuttle")
        pfctl('-a sshuttle -f /dev/stdin', rules)
        if osdefs.platform == "darwin":
            o = pfctl('-E')
            _pf_context['Xtoken'] = \
                re.search(b'Token : (.+)', o[1]).group(1)
        elif b'INFO:\nStatus: Disabled' in pf_status:
            pfctl('-e')
            _pf_context['started_by_sshuttle'] = True
    def restore_firewall(self, port, family, udp):
-        if family != socket.AF_INET:
+        if family not in [socket.AF_INET, socket.AF_INET6]:
            raise Exception(
                'Address family "%s" unsupported by pf method_name'
                % family_to_string(family))
        if udp:
            raise Exception("UDP not supported by pf method_name")
-        pfctl('-a sshuttle -F all')
+        pf.disable(pf_get_anchor(family, port))
        if osdefs.platform == "darwin":
            if _pf_context['Xtoken'] is not None:
                pfctl('-X %s' % _pf_context['Xtoken'].decode("ASCII"))
        elif _pf_context['started_by_sshuttle']:
            pfctl('-d')
    def firewall_command(self, line):
        if line.startswith('QUERY_PF_NAT '):
            try:
-                dst = pf_query_nat(*(line[13:].split(',')))
+                dst = pf.query_nat(*(line[13:].split(',')))
                sys.stdout.write('QUERY_PF_NAT_SUCCESS %s,%r\n' % dst)
            except IOError as e:
                sys.stdout.write('QUERY_PF_NAT_FAILURE %s\n' % e)
--- a/sshuttle/methods/tproxy.py
+++ b/sshuttle/methods/tproxy.py
@ -1,4 +1,5 @@
 import struct
 from sshuttle.firewall import subnet_weight
 from sshuttle.helpers import family_to_string
 from sshuttle.linux import ipt, ipt_ttl, ipt_chain_exists
 from sshuttle.methods import BaseMethod
@ -59,7 +60,6 @@ if recvmsg == "python":
                ip = socket.inet_ntop(family, cmsg_data[start:start + length])
                dstip = (ip, port)
                break
        print("xxxxx", srcip, dstip)
        return (srcip, dstip, data)
 elif recvmsg == "socket_ext":
    def recv_udp(listener, bufsize):
@ -164,6 +164,11 @@ class Method(BaseMethod):
        def _ipt_ttl(*args):
            return ipt_ttl(family, table, *args)
        def _ipt_proto_ports(proto, fport, lport):
            return proto + ('--dport', '%d:%d' % (fport, lport)) \
                    if fport else proto
        mark_chain = 'sshuttle-m-%s' % port
        tproxy_chain = 'sshuttle-t-%s' % port
        divert_chain = 'sshuttle-d-%s' % port
@ -198,33 +203,44 @@ class Method(BaseMethod):
                 '-m', 'udp', '-p', 'udp', '--dport', '53',
                 '--on-port', str(dnsport))
-        for f, swidth, sexclude, snet \
+        for f, swidth, sexclude, snet, fport, lport \
-                in sorted(subnets, key=lambda s: s[1], reverse=True):
+                in sorted(subnets, key=subnet_weight, reverse=True):
            tcp_ports = ('-p', 'tcp')
            tcp_ports = _ipt_proto_ports(tcp_ports, fport, lport)
            if sexclude:
                _ipt('-A', mark_chain, '-j', 'RETURN',
                     '--dest', '%s/%s' % (snet, swidth),
-                     '-m', 'tcp', '-p', 'tcp')
+                     '-m', 'tcp',
                     *tcp_ports)
                _ipt('-A', tproxy_chain, '-j', 'RETURN',
                     '--dest', '%s/%s' % (snet, swidth),
-                     '-m', 'tcp', '-p', 'tcp')
+                     '-m', 'tcp',
                     *tcp_ports)
            else:
                _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',
                     '--dest', '%s/%s' % (snet, swidth),
-                     '-m', 'tcp', '-p', 'tcp')
+                     '-m', 'tcp',
                     *tcp_ports)
                _ipt('-A', tproxy_chain, '-j', 'TPROXY',
                     '--tproxy-mark', '0x1/0x1',
                     '--dest', '%s/%s' % (snet, swidth),
-                     '-m', 'tcp', '-p', 'tcp',
+                     '-m', 'tcp',
-                     '--on-port', str(port))
+                     *(tcp_ports + ('--on-port', str(port))))
            if udp:
                udp_ports = ('-p', 'udp')
                udp_ports = _ipt_proto_ports(udp_ports, fport, lport)
                if sexclude:
                    _ipt('-A', mark_chain, '-j', 'RETURN',
                         '--dest', '%s/%s' % (snet, swidth),
-                         '-m', 'udp', '-p', 'udp')
+                         '-m', 'udp',
                         *udp_ports)
                    _ipt('-A', tproxy_chain, '-j', 'RETURN',
                         '--dest', '%s/%s' % (snet, swidth),
-                         '-m', 'udp', '-p', 'udp')
+                         '-m', 'udp',
                         *udp_ports)
                else:
                    _ipt('-A', mark_chain, '-j', 'MARK', '--set-mark', '1',
                         '--dest', '%s/%s' % (snet, swidth),
@ -232,8 +248,8 @@ class Method(BaseMethod):
                    _ipt('-A', tproxy_chain, '-j', 'TPROXY',
                         '--tproxy-mark', '0x1/0x1',
                         '--dest', '%s/%s' % (snet, swidth),
-                         '-m', 'udp', '-p', 'udp',
+                         '-m', 'udp',
-                         '--on-port', str(port))
+                         *(udp_ports + ('--on-port', str(port))))
    def restore_firewall(self, port, family, udp):
        if family not in [socket.AF_INET, socket.AF_INET6]:
--- a/sshuttle/options.py
+++ b/sshuttle/options.py
@ -1,215 +1,293 @@
 """Command-line options parser.
 With the help of an options spec string, easily parse command-line options.
 """
 import sys
 import os
 import textwrap
 import getopt
 import re
-import struct
+import socket
 from argparse import ArgumentParser, Action, ArgumentTypeError as Fatal
 from sshuttle import __version__
-class OptDict:
+# Subnet file, supporting empty lines and hash-started comment lines
-
+def parse_subnetport_file(s):
    def __init__(self):
        self._opts = {}
    def __setitem__(self, k, v):
        if k.startswith('no-') or k.startswith('no_'):
            k = k[3:]
            v = not v
        self._opts[k] = v
    def __getitem__(self, k):
        if k.startswith('no-') or k.startswith('no_'):
            return not self._opts[k[3:]]
        return self._opts[k]
    def __getattr__(self, k):
        return self[k]
 def _default_onabort(msg):
    sys.exit(97)
 def _intify(v):
    try:
-        vv = int(v or '')
+        handle = open(s, 'r')
-        if str(vv) == v:
+    except OSError:
-            return vv
+        raise Fatal('Unable to open subnet file: %s' % s)
-    except ValueError:
+
-        pass
+    raw_config_lines = handle.readlines()
-    return v
+    subnets = []
    for line_no, line in enumerate(raw_config_lines):
        line = line.strip()
        if len(line) == 0:
            continue
        if line[0] == '#':
            continue
        subnets.append(parse_subnetport(line))
    return subnets
-def _atoi(v):
+# 1.2.3.4/5:678, 1.2.3.4:567, 1.2.3.4/16 or just 1.2.3.4
 # [1:2::3/64]:456, [1:2::3]:456, 1:2::3/64 or just 1:2::3
 # example.com:123 or just example.com
 def parse_subnetport(s):
    if s.count(':') > 1:
        rx = r'(?:\[?([\w\:]+)(?:/(\d+))?]?)(?::(\d+)(?:-(\d+))?)?$'
    else:
        rx = r'([\w\.]+)(?:/(\d+))?(?::(\d+)(?:-(\d+))?)?$'
    m = re.match(rx, s)
    if not m:
        raise Fatal('%r is not a valid address/mask:port format' % s)
    addr, width, fport, lport = m.groups()
    try:
-        return int(v or 0)
+        addrinfo = socket.getaddrinfo(addr, 0, 0, socket.SOCK_STREAM)
-    except ValueError:
+    except socket.gaierror:
-        return 0
+        raise Fatal('Unable to resolve address: %s' % addr)
    family, _, _, _, addr = min(addrinfo)
    max_width = 32 if family == socket.AF_INET else 128
    width = int(width or max_width)
    if not 0 <= width <= max_width:
        raise Fatal('width %d is not between 0 and %d' % (width, max_width))
    return (family, addr[0], width, int(fport or 0), int(lport or fport or 0))
-def _remove_negative_kv(k, v):
+# 1.2.3.4:567 or just 1.2.3.4 or just 567
-    if k.startswith('no-') or k.startswith('no_'):
+# [1:2::3]:456 or [1:2::3] or just [::]:567
-        return k[3:], not v
+# example.com:123 or just example.com
-    return k, v
+def parse_ipport(s):
    s = str(s)
    if s.isdigit():
        rx = r'()(\d+)$'
    elif ']' in s:
        rx = r'(?:\[([^]]+)])(?::(\d+))?$'
    else:
        rx = r'([\w\.]+)(?::(\d+))?$'
    m = re.match(rx, s)
    if not m:
        raise Fatal('%r is not a valid IP:port format' % s)
-def _remove_negative_k(k):
+    ip, port = m.groups()
-    return _remove_negative_kv(k, None)[0]
+    ip = ip or '0.0.0.0'
    port = int(port or 0)
 def _tty_width():
    if not hasattr(sys.stderr, "fileno"):
        return _atoi(os.environ.get('WIDTH')) or 70
    s = struct.pack("HHHH", 0, 0, 0, 0)
    try:
-        import fcntl
+        addrinfo = socket.getaddrinfo(ip, port, 0, socket.SOCK_STREAM)
-        import termios
+    except socket.gaierror:
-        s = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, s)
+        raise Fatal('%r is not a valid IP:port format' % s)
-    except (IOError, ImportError):
+
-        return _atoi(os.environ.get('WIDTH')) or 70
+    family, _, _, _, addr = min(addrinfo)
-    (ysize, xsize, ypix, xpix) = struct.unpack('HHHH', s)
+    return (family,) + addr[:2]
    return xsize or 70
-class Options:
+def parse_list(list):
    return re.split(r'[\s,]+', list.strip()) if list else []
    """Option parser.
    When constructed, two strings are mandatory. The first one is the command
    name showed before error messages. The second one is a string called an
    optspec that specifies the synopsis and option flags and their description.
    For more information about optspecs, consult the bup-options(1) man page.
-    Two optional arguments specify an alternative parsing function and an
+class Concat(Action):
-    alternative behaviour on abort (after having output the usage string).
+    def __init__(self, option_strings, dest, nargs=None, **kwargs):
        if nargs is not None:
            raise ValueError("nargs not supported")
        super(Concat, self).__init__(option_strings, dest, **kwargs)
-    By default, the parser function is getopt.gnu_getopt, and the abort
+    def __call__(self, parser, namespace, values, option_string=None):
-    behaviour is to exit the program.
+        curr_value = getattr(namespace, self.dest, None) or []
        setattr(namespace, self.dest, curr_value + values)
 parser = ArgumentParser(
    prog="sshuttle",
    usage="%(prog)s [-l [ip:]port] [-r [user@]sshserver[:port]] <subnets...>"
 )
 parser.add_argument(
    "subnets",
    metavar="IP/MASK[:PORT[-PORT]]...",
    nargs="*",
    type=parse_subnetport,
    help="""
    capture and forward traffic to these subnets (whitespace separated)
    """
-
+)
-    def __init__(self, optspec, optfunc=getopt.gnu_getopt,
+parser.add_argument(
-                 onabort=_default_onabort):
+    "-l", "--listen",
-        self.optspec = optspec
+    metavar="[IP:]PORT",
-        self._onabort = onabort
+    help="""
-        self.optfunc = optfunc
+    transproxy to this ip address and port number
-        self._aliases = {}
+    """
-        self._shortopts = 'h?'
+)
-        self._longopts = ['help']
+parser.add_argument(
-        self._hasparms = {}
+    "-H", "--auto-hosts",
-        self._defaults = {}
+    action="store_true",
-        self._usagestr = self._gen_usage()
+    help="""
-
+    continuously scan for remote hostnames and update local /etc/hosts as they are found
-    def _gen_usage(self):
+    """
-        out = []
+)
-        lines = self.optspec.strip().split('\n')
+parser.add_argument(
-        lines.reverse()
+    "-N", "--auto-nets",
-        first_syn = True
+    action="store_true",
-        while lines:
+    help="""
-            l = lines.pop()
+    automatically determine subnets to route
-            if l == '--':
+    """
-                break
+)
-            out.append('%s: %s\n' % (first_syn and 'usage' or '   or', l))
+parser.add_argument(
-            first_syn = False
+    "--dns",
-        out.append('\n')
+    action="store_true",
-        last_was_option = False
+    help="""
-        while lines:
+    capture local DNS requests and forward to the remote DNS server
-            l = lines.pop()
+    """
-            if l.startswith(' '):
+)
-                out.append('%s%s\n' % (last_was_option and '\n' or '',
+parser.add_argument(
-                                       l.lstrip()))
+    "--ns-hosts",
-                last_was_option = False
+    metavar="IP[,IP]",
-            elif l:
+    default=[],
-                (flags, extra) = l.split(' ', 1)
+    type=parse_list,
-                extra = extra.strip()
+    help="""
-                if flags.endswith('='):
+    capture and forward DNS requests made to the following servers
-                    flags = flags[:-1]
+    """
-                    has_parm = 1
+)
-                else:
+parser.add_argument(
-                    has_parm = 0
+    "--method",
-                g = re.search(r'\[([^\]]*)\]$', extra)
+    choices=["auto", "nat", "tproxy", "pf", "ipfw"],
-                if g:
+    metavar="TYPE",
-                    defval = g.group(1)
+    default="auto",
-                else:
+    help="""
-                    defval = None
+    %(choices)s
-                flagl = flags.split(',')
+    """
-                flagl_nice = []
+)
-                for _f in flagl:
+parser.add_argument(
-                    f, dvi = _remove_negative_kv(_f, _intify(defval))
+    "--python",
-                    self._aliases[f] = _remove_negative_k(flagl[0])
+    metavar="PATH",
-                    self._hasparms[f] = has_parm
+    help="""
-                    self._defaults[f] = dvi
+    path to python interpreter on the remote server
-                    if len(f) == 1:
+    """
-                        self._shortopts += f + (has_parm and ':' or '')
+)
-                        flagl_nice.append('-' + f)
+parser.add_argument(
-                    else:
+    "-r", "--remote",
-                        f_nice = re.sub(r'\W', '_', f)
+    metavar="[USERNAME@]ADDR[:PORT]",
-                        self._aliases[f_nice] = _remove_negative_k(flagl[0])
+    help="""
-                        self._longopts.append(f + (has_parm and '=' or ''))
+    ssh hostname (and optional username) of remote %(prog)s server
-                        self._longopts.append('no-' + f)
+    """
-                        flagl_nice.append('--' + _f)
+)
-                flags_nice = ', '.join(flagl_nice)
+parser.add_argument(
-                if has_parm:
+    "-x", "--exclude",
-                    flags_nice += ' ...'
+    metavar="IP/MASK[:PORT[-PORT]]",
-                prefix = '    %-20s  ' % flags_nice
+    action="append",
-                argtext = '\n'.join(textwrap.wrap(extra, width=_tty_width(),
+    default=[],
-                                                  initial_indent=prefix,
+    type=parse_subnetport,
-                                                  subsequent_indent=' ' * 28))
+    help="""
-                out.append(argtext + '\n')
+    exclude this subnet (can be used more than once)
-                last_was_option = True
+    """
-            else:
+)
-                out.append('\n')
+parser.add_argument(
-                last_was_option = False
+    "-X", "--exclude-from",
-        return ''.join(out).rstrip() + '\n'
+    metavar="PATH",
-
+    action=Concat,
-    def usage(self, msg=""):
+    dest="exclude",
-        """Print usage string to stderr and abort."""
+    type=parse_subnetport_file,
-        sys.stderr.write(self._usagestr)
+    help="""
-        e = self._onabort and self._onabort(msg) or None
+    exclude the subnets in a file (whitespace separated)
-        if e:
+    """
-            raise e
+)
-
+parser.add_argument(
-    def fatal(self, s):
+    "-v", "--verbose",
-        """Print an error message to stderr and abort with usage string."""
+    action="count",
-        msg = 'error: %s\n' % s
+    default=0,
-        sys.stderr.write(msg)
+    help="""
-        return self.usage(msg)
+    increase debug message verbosity
-
+    """
-    def parse(self, args):
+)
-        """Parse a list of arguments and return (options, flags, extra).
+parser.add_argument(
-
+    "-V", "--version",
-        In the returned tuple, "options" is an OptDict with known options,
+    action="version",
-        "flags" is a list of option flags that were used on the command-line,
+    version=__version__,
-        and "extra" is a list of positional arguments.
+    help="""
-        """
+    print the %(prog)s version number and exit
-        try:
+    """
-            (flags, extra) = self.optfunc(
+)
-                args, self._shortopts, self._longopts)
+parser.add_argument(
-        except getopt.GetoptError as e:
+    "-e", "--ssh-cmd",
-            self.fatal(e)
+    metavar="CMD",
-
+    default="ssh",
-        opt = OptDict()
+    help="""
-
+    the command to use to connect to the remote [%(default)s]
-        for k, v in self._defaults.items():
+    """
-            k = self._aliases[k]
+)
-            opt[k] = v
+parser.add_argument(
-
+    "--seed-hosts",
-        for (k, v) in flags:
+    metavar="HOSTNAME[,HOSTNAME]",
-            k = k.lstrip('-')
+    default=[],
-            if k in ('h', '?', 'help'):
+    help="""
-                self.usage()
+    comma-separated list of hostnames for initial scan (may be used with or without --auto-hosts)
-            if k.startswith('no-'):
+    """
-                k = self._aliases[k[3:]]
+)
-                v = 0
+parser.add_argument(
-            else:
+    "--no-latency-control",
-                k = self._aliases[k]
+    action="store_false",
-                if not self._hasparms[k]:
+    dest="latency_control",
-                    assert(v == '')
+    help="""
-                    v = (opt._opts.get(k) or 0) + 1
+    sacrifice latency to improve bandwidth benchmarks
-                else:
+    """
-                    v = _intify(v)
+)
-            opt[k] = v
+parser.add_argument(
-        for (f1, f2) in self._aliases.items():
+    "--wrap",
-            opt[f1] = opt._opts.get(f2)
+    metavar="NUM",
-        return (opt, flags, extra)
+    type=int,
    help="""
    restart counting channel numbers after this number (for testing)
    """
 )
 parser.add_argument(
    "--disable-ipv6",
    action="store_true",
    help="""
    disable IPv6 support
    """
 )
 parser.add_argument(
    "-D", "--daemon",
    action="store_true",
    help="""
    run in the background as a daemon
    """
 )
 parser.add_argument(
    "-s", "--subnets",
    metavar="PATH",
    action=Concat,
    dest="subnets_file",
    default=[],
    type=parse_subnetport_file,
    help="""
    file where the subnets are stored, instead of on the command line
    """
 )
 parser.add_argument(
    "--syslog",
    action="store_true",
    help="""
    send log messages to syslog (default if you use --daemon)
    """
 )
 parser.add_argument(
    "--pidfile",
    metavar="PATH",
    default="./sshuttle.pid",
    help="""
    pidfile name (only if using --daemon) [%(default)s]
    """
 )
 parser.add_argument(
    "--firewall",
    action="store_true",
    help="""
    (internal use only)
    """
 )
 parser.add_argument(
    "--hostwatch",
    action="store_true",
    help="""
    (internal use only)
    """
 )
--- a/sshuttle/sdnotify.py
+++ b/sshuttle/sdnotify.py
@ -0,0 +1,40 @@
 import socket
 import os
 from sshuttle.helpers import debug1
 def _notify(message):
    addr = os.environ.get("NOTIFY_SOCKET", None)
    if not addr or len(addr) == 1 or addr[0] not in ('/', '@'):
        return False
    addr = '\0' + addr[1:] if addr[0] == '@' else addr
    try:
        sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
    except (OSError, IOError) as e:
        debug1("Error creating socket to notify systemd: %s\n" % e)
        return False
    if not message: 
        return False
    assert isinstance(message, bytes)
    try:
        return (sock.sendto(message, addr) > 0)
    except (OSError, IOError) as e:
        debug1("Error notifying systemd: %s\n" % e)
        return False
 def send(*messages):
    return _notify(b'\n'.join(messages))
 def ready():
    return b"READY=1"
 def stop():
    return b"STOPPING=1"
 def status(message):
    return b"STATUS=%s" % message.encode('utf8')
--- a/sshuttle/server.py
+++ b/sshuttle/server.py
@ -12,32 +12,39 @@ import sshuttle.helpers as helpers
 import sshuttle.hostwatch as hostwatch
 import subprocess as ssubprocess
 from sshuttle.ssnet import Handler, Proxy, Mux, MuxWrapper
-from sshuttle.helpers import log, debug1, debug2, debug3, Fatal, \
+from sshuttle.helpers import b, log, debug1, debug2, debug3, Fatal, \
    resolvconf_random_nameserver
 try:
    from shutil import which
 except ImportError:
    from distutils.spawn import find_executable as which
 def _ipmatch(ipstr):
-    if ipstr == b'default':
+    # FIXME: IPv4 only
-        ipstr = b'0.0.0.0/0'
+    if ipstr == 'default':
-    m = re.match(b'^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
+        ipstr = '0.0.0.0/0'
    m = re.match('^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
    if m:
        g = m.groups()
        ips = g[0]
        width = int(g[4] or 32)
        if g[1] is None:
-            ips += b'.0.0.0'
+            ips += '.0.0.0'
            width = min(width, 8)
        elif g[2] is None:
-            ips += b'.0.0'
+            ips += '.0.0'
            width = min(width, 16)
        elif g[3] is None:
-            ips += b'.0'
+            ips += '.0'
            width = min(width, 24)
-        ips = ips.decode("ASCII")
+        ips = ips
        return (struct.unpack('!I', socket.inet_aton(ips))[0], width)
 def _ipstr(ip, width):
    # FIXME: IPv4 only
    if width >= 32:
        return ip
    else:
@ -45,6 +52,7 @@ def _ipstr(ip, width):
 def _maskbits(netmask):
    # FIXME: IPv4 only
    if not netmask:
        return 32
    for i in range(32):
@ -57,18 +65,39 @@ def _shl(n, bits):
    return n * int(2 ** bits)
-def _list_routes():
+def _route_netstat(line):
    cols = line.split(None)
    if len(cols) < 3:
        return None, None
    ipw = _ipmatch(cols[0])
    maskw = _ipmatch(cols[2])  # linux only
    mask = _maskbits(maskw)   # returns 32 if maskw is null
    return ipw, mask
 def _route_iproute(line):
    ipm = line.split(None, 1)[0]
    if '/' not in ipm:
        return None, None
    ip, mask = ipm.split('/')
    ipw = _ipmatch(ip)
    return ipw, int(mask)
 def _list_routes(argv, extract_route):
    # FIXME: IPv4 only
-    argv = ['netstat', '-rn']
+    env = {
-    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
+        'PATH': os.environ['PATH'],
        'LC_ALL': "C",
    }
    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, env=env)
    routes = []
    for line in p.stdout:
-        cols = re.split(b'\s+', line)
+        if not line.strip():
-        ipw = _ipmatch(cols[0])
+            continue
        ipw, mask = extract_route(line.decode("ASCII"))
        if not ipw:
-            continue  # some lines won't be parseable; never mind
+            continue
        maskw = _ipmatch(cols[2])  # linux only
        mask = _maskbits(maskw)   # returns 32 if maskw is null
        width = min(ipw[1], mask)
        ip = ipw[0] & _shl(_shl(1, width) - 1, 32 - width)
        routes.append(
@ -77,11 +106,20 @@ def _list_routes():
    if rv != 0:
        log('WARNING: %r returned %d\n' % (argv, rv))
        log('WARNING: That prevents --auto-nets from working.\n')
    return routes
 def list_routes():
-    for (family, ip, width) in _list_routes():
+    if which('ip'):
        routes = _list_routes(['ip', 'route'], _route_iproute)
    elif which('netstat'):
        routes = _list_routes(['netstat', '-rn'], _route_netstat)
    else:
        log('WARNING: Neither ip nor netstat were found on the server.\n')
        routes = []
    for (family, ip, width) in routes:
        if not ip.startswith('0.') and not ip.startswith('127.'):
            yield (family, ip, width)
@ -91,7 +129,7 @@ def _exc_dump():
    return ''.join(traceback.format_exception(*exc_info))
-def start_hostwatch(seed_hosts):
+def start_hostwatch(seed_hosts, auto_hosts):
    s1, s2 = socket.socketpair()
    pid = os.fork()
    if not pid:
@ -103,7 +141,7 @@ def start_hostwatch(seed_hosts):
                os.dup2(s1.fileno(), 1)
                os.dup2(s1.fileno(), 0)
                s1.close()
-                rv = hostwatch.hw_main(seed_hosts) or 0
+                rv = hostwatch.hw_main(seed_hosts, auto_hosts) or 0
            except Exception:
                log('%s\n' % _exc_dump())
                rv = 98
@ -149,7 +187,8 @@ class DnsProxy(Handler):
        try:
            sock.send(self.request)
            self.socks.append(sock)
-        except socket.error as e:
+        except socket.error:
            _, e = sys.exc_info()[:2]
            if e.args[0] in ssnet.NET_ERRS:
                # might have been spurious; try again.
                # Note: these errors sometimes are reported by recv(),
@ -166,7 +205,8 @@ class DnsProxy(Handler):
        try:
            data = sock.recv(4096)
-        except socket.error as e:
+        except socket.error:
            _, e = sys.exc_info()[:2]
            self.socks.remove(sock)
            del self.peers[sock]
@ -201,22 +241,24 @@ class UdpProxy(Handler):
        debug2('UDP: sending to %r port %d\n' % dstip)
        try:
            self.sock.sendto(data, dstip)
-        except socket.error as e:
+        except socket.error:
            _, e = sys.exc_info()[:2]
            log('UDP send to %r port %d: %s\n' % (dstip[0], dstip[1], e))
            return
    def callback(self, sock):
        try:
            data, peer = sock.recvfrom(4096)
-        except socket.error as e:
+        except socket.error:
            _, e = sys.exc_info()[:2]
            log('UDP recv from %r port %d: %s\n' % (peer[0], peer[1], e))
            return
        debug2('UDP response: %d bytes\n' % len(data))
-        hdr = "%s,%r," % (peer[0], peer[1])
+        hdr = b("%s,%r," % (peer[0], peer[1]))
        self.mux.send(self.chan, ssnet.CMD_UDP_DATA, hdr + data)
-def main(latency_control):
+def main(latency_control, auto_hosts):
    debug1('Starting server with Python version %s\n'
           % platform.python_version())
@ -241,39 +283,46 @@ def main(latency_control):
              socket.fromfd(sys.stdout.fileno(),
                            socket.AF_INET, socket.SOCK_STREAM))
    handlers.append(mux)
-    routepkt = b''
+    routepkt = ''
    for r in routes:
-        routepkt += b'%d,%s,%d\n' % (r[0], r[1].encode("ASCII"), r[2])
+        routepkt += '%d,%s,%d\n' % r
-    mux.send(0, ssnet.CMD_ROUTES, routepkt)
+    mux.send(0, ssnet.CMD_ROUTES, b(routepkt))
    hw = Hostwatch()
-    hw.leftover = b''
+    hw.leftover = b('')
    def hostwatch_ready(sock):
        assert(hw.pid)
        content = hw.sock.recv(4096)
        if content:
-            lines = (hw.leftover + content).split(b'\n')
+            lines = (hw.leftover + content).split(b('\n'))
            if lines[-1]:
                # no terminating newline: entry isn't complete yet!
                hw.leftover = lines.pop()
-                lines.append('')
+                lines.append(b(''))
            else:
-                hw.leftover = b''
+                hw.leftover = b('')
-            mux.send(0, ssnet.CMD_HOST_LIST, b'\n'.join(lines))
+            mux.send(0, ssnet.CMD_HOST_LIST, b('\n').join(lines))
        else:
            raise Fatal('hostwatch process died')
    def got_host_req(data):
        if not hw.pid:
-            (hw.pid, hw.sock) = start_hostwatch(data.strip().split())
+            (hw.pid, hw.sock) = start_hostwatch(
                    data.strip().split(), auto_hosts)
            handlers.append(Handler(socks=[hw.sock],
                                    callback=hostwatch_ready))
    mux.got_host_req = got_host_req
    def new_channel(channel, data):
-        (family, dstip, dstport) = data.split(b',', 2)
+        (family, dstip, dstport) = data.decode("ASCII").split(',', 2)
        family = int(family)
        # AF_INET is the same constant on Linux and BSD but AF_INET6
        # is different. As the client and server can be running on
        # different platforms we can not just set the socket family
        # to what comes in the wire.
        if family != socket.AF_INET:
            family = socket.AF_INET6
        dstport = int(dstport)
        outwrap = ssnet.connect_dst(family, dstip, dstport)
        handlers.append(Proxy(MuxWrapper(mux, channel), outwrap))
@ -293,7 +342,7 @@ def main(latency_control):
    def udp_req(channel, cmd, data):
        debug2('Incoming UDP request channel=%d, cmd=%d\n' % (channel, cmd))
        if cmd == ssnet.CMD_UDP_DATA:
-            (dstip, dstport, data) = data.split(",", 2)
+            (dstip, dstport, data) = data.split(b(','), 2)
            dstport = int(dstport)
            debug2('is incoming UDP data. %r %d.\n' % (dstip, dstport))
            h = udphandlers[channel]
--- a/sshuttle/ssh.py
+++ b/sshuttle/ssh.py
@ -5,9 +5,17 @@ import socket
 import zlib
 import imp
 import subprocess as ssubprocess
 import shlex
 import sshuttle.helpers as helpers
 from sshuttle.helpers import debug2
 try:
    # Python >= 3.5
    from shlex import quote
 except ImportError:
    # Python 2.x
    from pipes import quote
 def readfile(name):
    tokens = name.split(".")
@ -55,7 +63,7 @@ def empackage(z, name, data=None):
 def connect(ssh_cmd, rhostport, python, stderr, options):
    portl = []
-    if (rhostport or '').count(':') > 1:
+    if re.sub(r'.*@', '', rhostport or '').count(':') > 1:
        if rhostport.count(']') or rhostport.count('['):
            result = rhostport.split(']')
            rhost = result[0].strip('[')
@ -68,7 +76,7 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
        else:
            rhost = rhostport
    else:  # IPv4
-        l = (rhostport or '').split(':', 1)
+        l = (rhostport or '').rsplit(':', 1)
        rhost = l[0]
        if len(l) > 1:
            portl = ['-p', str(int(l[1]))]
@ -89,27 +97,28 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
                b"\n")
    pyscript = r"""
-                import sys;
+                import sys, os;
                verbosity=%d;
-                stdin=getattr(sys.stdin,"buffer",sys.stdin);
+                sys.stdin = os.fdopen(0, "rb");
-                exec(compile(stdin.read(%d), "assembler.py", "exec"))
+                exec(compile(sys.stdin.read(%d), "assembler.py", "exec"))
                """ % (helpers.verbose or 0, len(content))
    pyscript = re.sub(r'\s+', ' ', pyscript.strip())
    if not rhost:
        # ignore the --python argument when running locally; we already know
        # which python version works.
-        argv = [sys.argv[1], '-c', pyscript]
+        argv = [sys.executable, '-c', pyscript]
    else:
        if ssh_cmd:
-            sshl = ssh_cmd.split(' ')
+            sshl = shlex.split(ssh_cmd)
        else:
            sshl = ['ssh']
        if python:
            pycmd = "'%s' -c '%s'" % (python, pyscript)
        else:
            pycmd = ("P=python3.5; $P -V 2>/dev/null || P=python; "
-                     "exec \"$P\" -c '%s'") % pyscript
+                     "exec \"$P\" -c %s") % quote(pyscript)
            pycmd = ("exec /bin/sh -c %s" % quote(pycmd))
        argv = (sshl +
                portl +
                [rhost, '--', pycmd])
--- a/sshuttle/sshuttle.md
+++ b/sshuttle/sshuttle.md
@ -1,261 +0,0 @@
 % sshuttle(8) Sshuttle 0.46
 % Avery Pennarun <apenwarr@gmail.com>
 % 2011-01-25
 # NAME
 sshuttle - a transparent proxy-based VPN using ssh
 # SYNOPSIS
 sshuttle [options...] [-r [username@]sshserver[:port]] \<subnets...\>
 # DESCRIPTION
 sshuttle allows you to create a VPN connection from your
 machine to any remote server that you can connect to via
 ssh, as long as that server has python 2.3 or higher.
 To work, you must have root access on the local machine,
 but you can have a normal account on the server.
 It's valid to run sshuttle more than once simultaneously on
 a single client machine, connecting to a different server
 every time, so you can be on more than one VPN at once.
 If run on a router, sshuttle can forward traffic for your
 entire subnet to the VPN.
 # OPTIONS
 \<subnets...\>
 :   a list of subnets to route over the VPN, in the form
    `a.b.c.d[/width]`.  Valid examples are 1.2.3.4 (a
    single IP address), 1.2.3.4/32 (equivalent to 1.2.3.4),
    1.2.3.0/24 (a 24-bit subnet, ie. with a 255.255.255.0
    netmask), and 0/0 ('just route everything through the
    VPN').
 -l, --listen=*[ip:]port*
 :   use this ip address and port number as the transparent
    proxy port.  By default sshuttle finds an available
    port automatically and listens on IP 127.0.0.1
    (localhost), so you don't need to override it, and
    connections are only proxied from the local machine,
    not from outside machines.  If you want to accept
    connections from other machines on your network (ie. to
    run sshuttle on a router) try enabling IP Forwarding in
    your kernel, then using `--listen 0.0.0.0:0`.
 -H, --auto-hosts
 :   scan for remote hostnames and update the local /etc/hosts
    file with matching entries for as long as the VPN is
    open.  This is nicer than changing your system's DNS
    (/etc/resolv.conf) settings, for several reasons.  First,
    hostnames are added without domain names attached, so
    you can `ssh thatserver` without worrying if your local
    domain matches the remote one.  Second, if you sshuttle
    into more than one VPN at a time, it's impossible to
    use more than one DNS server at once anyway, but
    sshuttle correctly merges /etc/hosts entries between
    all running copies.  Third, if you're only routing a
    few subnets over the VPN, you probably would prefer to
    keep using your local DNS server for everything else.
 -N, --auto-nets
 :   in addition to the subnets provided on the command
    line, ask the server which subnets it thinks we should
    route, and route those automatically.  The suggestions
    are taken automatically from the server's routing
    table.
 --dns
 :   capture local DNS requests and forward to the remote DNS
    server.
 --python
 :   specify the name/path of the remote python interpreter.
    The default is just `python`, which means to use the
    default python interpreter on the remote system's PATH.
 -r, --remote=*[username@]sshserver[:port]*
 :   the remote hostname and optional username and ssh
    port number to use for connecting to the remote server.
    For example, example.com, testuser@example.com,
    testuser@example.com:2222, or example.com:2244.
 -x, --exclude=*subnet*
 :   explicitly exclude this subnet from forwarding.  The
    format of this option is the same as the `<subnets>`
    option.  To exclude more than one subnet, specify the
    `-x` option more than once.  You can say something like
    `0/0 -x 1.2.3.0/24` to forward everything except the
    local subnet over the VPN, for example.
 -X, --exclude-from=*file*
 :   exclude the subnets specified in a file, one subnet per
    line. Useful when you have lots of subnets to exclude.
 -v, --verbose
 :   print more information about the session.  This option
    can be used more than once for increased verbosity.  By
    default, sshuttle prints only error messages.
 -e, --ssh-cmd
 :   the command to use to connect to the remote server. The
    default is just `ssh`.  Use this if your ssh client is
    in a non-standard location or you want to provide extra
    options to the ssh command, for example, `-e 'ssh -v'`.
 --seed-hosts
 :   a comma-separated list of hostnames to use to
    initialize the `--auto-hosts` scan algorithm.
    `--auto-hosts` does things like poll local SMB servers
    for lists of local hostnames, but can speed things up
    if you use this option to give it a few names to start
    from.
 --no-latency-control
 :   sacrifice latency to improve bandwidth benchmarks. ssh
    uses really big socket buffers, which can overload the
    connection if you start doing large file transfers,
    thus making all your other sessions inside the same
    tunnel go slowly. Normally, sshuttle tries to avoid
    this problem using a "fullness check" that allows only
    a certain amount of outstanding data to be buffered at
    a time.  But on high-bandwidth links, this can leave a
    lot of your bandwidth underutilized.  It also makes
    sshuttle seem slow in bandwidth benchmarks (benchmarks
    rarely test ping latency, which is what sshuttle is
    trying to control).  This option disables the latency
    control feature, maximizing bandwidth usage.  Use at
    your own risk.
 -D, --daemon
 :   automatically fork into the background after connecting
    to the remote server.  Implies `--syslog`.
 --syslog
 :   after connecting, send all log messages to the
    `syslog`(3) service instead of stderr.  This is
    implicit if you use `--daemon`.
 --pidfile=*pidfilename*
 :   when using `--daemon`, save sshuttle's pid to
    *pidfilename*.  The default is `sshuttle.pid` in the
    current directory.
 --firewall
 :   (internal use only) run the firewall manager.  This is
    the only part of sshuttle that must run as root.  If
    you start sshuttle as a non-root user, it will
    automatically run `sudo` or `su` to start the firewall
    manager, but the core of sshuttle still runs as a
    normal user.
 --hostwatch
 :   (internal use only) run the hostwatch daemon.  This
    process runs on the server side and collects hostnames for
    the `--auto-hosts` option.  Using this option by itself
    makes it a lot easier to debug and test the `--auto-hosts`
    feature.
 # EXAMPLES
 Test locally by proxying all local connections, without using ssh:
    $ sshuttle -v 0/0
    Starting sshuttle proxy.
    Listening on ('0.0.0.0', 12300).
    [local sudo] Password:
    firewall manager ready.
    c : connecting to server...
     s: available routes:
     s:   192.168.42.0/24
    c : connected.
    firewall manager: starting transproxy.
    c : Accept: 192.168.42.106:50035 -> 192.168.42.121:139.
    c : Accept: 192.168.42.121:47523 -> 77.141.99.22:443.
        ...etc...
    ^C
    firewall manager: undoing changes.
    KeyboardInterrupt
    c : Keyboard interrupt: exiting.
    c : SW#8:192.168.42.121:47523: deleting
    c : SW#6:192.168.42.106:50035: deleting
 Test connection to a remote server, with automatic hostname
 and subnet guessing:
    $ sshuttle -vNHr example.org
    Starting sshuttle proxy.
    Listening on ('0.0.0.0', 12300).
    firewall manager ready.
    c : connecting to server...
     s: available routes:
     s:   77.141.99.0/24
    c : connected.
    c : seed_hosts: []
    firewall manager: starting transproxy.
    hostwatch: Found: testbox1: 1.2.3.4
    hostwatch: Found: mytest2: 5.6.7.8
    hostwatch: Found: domaincontroller: 99.1.2.3
    c : Accept: 192.168.42.121:60554 -> 77.141.99.22:22.
    ^C
    firewall manager: undoing changes.
    c : Keyboard interrupt: exiting.
    c : SW#6:192.168.42.121:60554: deleting
 # DISCUSSION
 When it starts, sshuttle creates an ssh session to the
 server specified by the `-r` option.  If `-r` is omitted,
 it will start both its client and server locally, which is
 sometimes useful for testing.
 After connecting to the remote server, sshuttle uploads its
 (python) source code to the remote end and executes it
 there.  Thus, you don't need to install sshuttle on the
 remote server, and there are never sshuttle version
 conflicts between client and server.
 Unlike most VPNs, sshuttle forwards sessions, not packets.
 That is, it uses kernel transparent proxying (`iptables
 REDIRECT` rules on Linux) to
 capture outgoing TCP sessions, then creates entirely
 separate TCP sessions out to the original destination at
 the other end of the tunnel.
 Packet-level forwarding (eg. using the tun/tap devices on
 Linux) seems elegant at first, but it results in
 several problems, notably the 'tcp over tcp' problem.  The
 tcp protocol depends fundamentally on packets being dropped
 in order to implement its congestion control agorithm; if
 you pass tcp packets through a tcp-based tunnel (such as
 ssh), the inner tcp packets will never be dropped, and so
 the inner tcp stream's congestion control will be
 completely broken, and performance will be terrible.  Thus,
 packet-based VPNs (such as IPsec and openvpn) cannot use
 tcp-based encrypted streams like ssh or ssl, and have to
 implement their own encryption from scratch, which is very
 complex and error prone.
 sshuttle's simplicity comes from the fact that it can
 safely use the existing ssh encrypted tunnel without
 incurring a performance penalty.  It does this by letting
 the client-side kernel manage the incoming tcp stream, and
 the server-side kernel manage the outgoing tcp stream;
 there is no need for congestion control to be shared
 between the two separate streams, so a tcp-based tunnel is
 fine.
 # SEE ALSO
 `ssh`(1), `python`(1)
--- a/sshuttle/ssnet.py
+++ b/sshuttle/ssnet.py
@ -1,9 +1,10 @@
 import sys
 import struct
 import socket
 import errno
 import select
 import os
-from sshuttle.helpers import log, debug1, debug2, debug3, Fatal
+from sshuttle.helpers import b, binary_type, log, debug1, debug2, debug3, Fatal
 MAX_CHANNEL = 65535
@ -53,7 +54,8 @@ cmd_to_name = {
 NET_ERRS = [errno.ECONNREFUSED, errno.ETIMEDOUT,
            errno.EHOSTUNREACH, errno.ENETUNREACH,
-            errno.EHOSTDOWN, errno.ENETDOWN]
+            errno.EHOSTDOWN, errno.ENETDOWN,
            errno.ENETUNREACH]
 def _add(l, elem):
@ -75,7 +77,8 @@ def _fds(l):
 def _nb_clean(func, *args):
    try:
        return func(*args)
-    except OSError as e:
+    except OSError:
        _, e = sys.exc_info()[:2]
        if e.errno not in (errno.EWOULDBLOCK, errno.EAGAIN):
            raise
        else:
@ -88,7 +91,8 @@ def _try_peername(sock):
        pn = sock.getpeername()
        if pn:
            return '%s:%s' % (pn[0], pn[1])
-    except socket.error as e:
+    except socket.error:
        _, e = sys.exc_info()[:2]
        if e.args[0] not in (errno.ENOTCONN, errno.ENOTSOCK):
            raise
    return 'unknown'
@ -144,7 +148,8 @@ class SockWrapper:
            self.rsock.connect(self.connect_to)
            # connected successfully (Linux)
            self.connect_to = None
-        except socket.error as e:
+        except socket.error:
            _, e = sys.exc_info()[:2]
            debug3('%r: connect result: %s\n' % (self, e))
            if e.args[0] == errno.EINVAL:
                # this is what happens when you call connect() on a socket
@ -191,7 +196,8 @@ class SockWrapper:
            self.shut_write = True
            try:
                self.wsock.shutdown(SHUT_WR)
-            except socket.error as e:
+            except socket.error:
                _, e = sys.exc_info()[:2]
                self.seterr('nowrite: %s' % e)
    def too_full(self):
@ -203,7 +209,8 @@ class SockWrapper:
        self.wsock.setblocking(False)
        try:
            return _nb_clean(os.write, self.wsock.fileno(), buf)
-        except OSError as e:
+        except OSError:
            _, e = sys.exc_info()[:2]
            if e.errno == errno.EPIPE:
                debug1('%r: uwrite: got EPIPE\n' % self)
                self.nowrite()
@ -225,9 +232,10 @@ class SockWrapper:
        self.rsock.setblocking(False)
        try:
            return _nb_clean(os.read, self.rsock.fileno(), 65536)
-        except OSError as e:
+        except OSError:
            _, e = sys.exc_info()[:2]
            self.seterr('uread: %s' % e)
-            return b''  # unexpected error... we'll call it EOF
+            return b('')  # unexpected error... we'll call it EOF
    def fill(self):
        if self.buf:
@ -235,7 +243,7 @@ class SockWrapper:
        rb = self.uread()
        if rb:
            self.buf.append(rb)
-        if rb == b'':  # empty string means EOF; None means temporarily empty
+        if rb == b(''):  # empty string means EOF; None means temporarily empty
            self.noread()
    def copy_to(self, outwrap):
@ -333,11 +341,11 @@ class Mux(Handler):
        self.channels = {}
        self.chani = 0
        self.want = 0
-        self.inbuf = b''
+        self.inbuf = b('')
        self.outbuf = []
        self.fullness = 0
        self.too_full = False
-        self.send(0, CMD_PING, b'chicken')
+        self.send(0, CMD_PING, b('chicken'))
    def next_channel(self):
        # channel 0 is special, so we never allocate it
@ -350,14 +358,14 @@ class Mux(Handler):
    def amount_queued(self):
        total = 0
-        for b in self.outbuf:
+        for byte in self.outbuf:
-            total += len(b)
+            total += len(byte)
        return total
    def check_fullness(self):
        if self.fullness > 32768:
            if not self.too_full:
-                self.send(0, CMD_PING, b'rttest')
+                self.send(0, CMD_PING, b('rttest'))
            self.too_full = True
        # ob = []
        # for b in self.outbuf:
@ -366,9 +374,10 @@ class Mux(Handler):
        # log('outbuf: %d %r\n' % (self.amount_queued(), ob))
    def send(self, channel, cmd, data):
-        assert isinstance(data, bytes)
+        assert isinstance(data, binary_type)
        assert len(data) <= 65535
-        p = struct.pack('!ccHHH', b'S', b'S', channel, cmd, len(data)) + data
+        p = struct.pack('!ccHHH', b('S'), b('S'), channel, cmd, len(data)) \
            + data
        self.outbuf.append(p)
        debug2(' > channel=%d cmd=%s len=%d (fullness=%d)\n'
               % (channel, cmd_to_name.get(cmd, hex(cmd)),
@ -434,14 +443,15 @@ class Mux(Handler):
    def fill(self):
        self.rsock.setblocking(False)
        try:
-            b = _nb_clean(os.read, self.rsock.fileno(), 32768)
+            read = _nb_clean(os.read, self.rsock.fileno(), 32768)
-        except OSError as e:
+        except OSError:
            _, e = sys.exc_info()[:2]
            raise Fatal('other end: %r' % e)
        # log('<<< %r\n' % b)
-        if b == b'':  # EOF
+        if read == b(''):  # EOF
            self.ok = False
-        if b:
+        if read:
-            self.inbuf += b
+            self.inbuf += read
    def handle(self):
        self.fill()
@ -451,8 +461,8 @@ class Mux(Handler):
            if len(self.inbuf) >= (self.want or HDR_LEN):
                (s1, s2, channel, cmd, datalen) = \
                    struct.unpack('!ccHHH', self.inbuf[:HDR_LEN])
-                assert(s1 == b'S')
+                assert(s1 == b('S'))
-                assert(s2 == b'S')
+                assert(s2 == b('S'))
                self.want = datalen + HDR_LEN
            if self.want and len(self.inbuf) >= self.want:
                data = self.inbuf[HDR_LEN:self.want]
@ -493,17 +503,25 @@ class MuxWrapper(SockWrapper):
        return 'SW%r:Mux#%d' % (self.peername, self.channel)
    def noread(self):
        if not self.shut_read:
            self.mux.send(self.channel, CMD_TCP_STOP_SENDING, b(''))
            self.setnoread()
    def setnoread(self):
        if not self.shut_read:
            debug2('%r: done reading\n' % self)
            self.shut_read = True
            self.mux.send(self.channel, CMD_TCP_STOP_SENDING, b'')
            self.maybe_close()
    def nowrite(self):
        if not self.shut_write:
            self.mux.send(self.channel, CMD_TCP_EOF, b(''))
            self.setnowrite()
    def setnowrite(self):
        if not self.shut_write:
            debug2('%r: done writing\n' % self)
            self.shut_write = True
            self.mux.send(self.channel, CMD_TCP_EOF, b'')
            self.maybe_close()
    def maybe_close(self):
@ -526,15 +544,17 @@ class MuxWrapper(SockWrapper):
    def uread(self):
        if self.shut_read:
-            return b''  # EOF
+            return b('')  # EOF
        else:
            return None  # no data available right now
    def got_packet(self, cmd, data):
        if cmd == CMD_TCP_EOF:
-            self.noread()
+            # Remote side already knows the status - set flag but don't notify
            self.setnoread()
        elif cmd == CMD_TCP_STOP_SENDING:
-            self.nowrite()
+            # Remote side already knows the status - set flag but don't notify
            self.setnowrite()
        elif cmd == CMD_TCP_DATA:
            self.buf.append(data)
        else:
@ -548,7 +568,7 @@ def connect_dst(family, ip, port):
    outsock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
    return SockWrapper(outsock, outsock,
                       connect_to=(ip, port),
-                       peername = '%s:%d' % (ip, port))
+                       peername='%s:%d' % (ip, port))
 def runonce(handlers, mux):
--- a/sshuttle/tests/client/test_firewall.py
+++ b/sshuttle/tests/client/test_firewall.py
@ -1,15 +1,16 @@
 from mock import Mock, patch, call
 import io
 import socket
 import sshuttle.firewall
 def setup_daemon():
    stdin = io.StringIO(u"""ROUTES
-2,24,0,1.2.3.0
+2,24,0,1.2.3.0,8000,9000
-2,32,1,1.2.3.66
+2,32,1,1.2.3.66,8080,8080
-10,64,0,2404:6800:4004:80c::
+10,64,0,2404:6800:4004:80c::,0,0
-10,128,1,2404:6800:4004:80c::101f
+10,128,1,2404:6800:4004:80c::101f,80,80
 NSLIST
 2,1.2.3.33
 10,2404:6800:4004:80c::33
@ -58,6 +59,36 @@ def test_rewrite_etc_hosts(tmpdir):
    assert orig_hosts.computehash() == new_hosts.computehash()
 def test_subnet_weight():
    subnets = [
        (socket.AF_INET, 16, 0, '192.168.0.0', 0, 0),
        (socket.AF_INET, 24, 0, '192.168.69.0', 0, 0),
        (socket.AF_INET, 32, 0, '192.168.69.70', 0, 0),
        (socket.AF_INET, 32, 1, '192.168.69.70', 0, 0),
        (socket.AF_INET, 32, 1, '192.168.69.70', 80, 80),
        (socket.AF_INET, 0, 1, '0.0.0.0', 0, 0),
        (socket.AF_INET, 0, 1, '0.0.0.0', 8000, 9000),
        (socket.AF_INET, 0, 1, '0.0.0.0', 8000, 8500),
        (socket.AF_INET, 0, 1, '0.0.0.0', 8000, 8000),
        (socket.AF_INET, 0, 1, '0.0.0.0', 400, 450)
    ]
    subnets_sorted = [
        (socket.AF_INET, 32, 1, '192.168.69.70', 80, 80),
        (socket.AF_INET, 0, 1, '0.0.0.0', 8000, 8000),
        (socket.AF_INET, 0, 1, '0.0.0.0', 400, 450),
        (socket.AF_INET, 0, 1, '0.0.0.0', 8000, 8500),
        (socket.AF_INET, 0, 1, '0.0.0.0', 8000, 9000),
        (socket.AF_INET, 32, 1, '192.168.69.70', 0, 0),
        (socket.AF_INET, 32, 0, '192.168.69.70', 0, 0),
        (socket.AF_INET, 24, 0, '192.168.69.0', 0, 0),
        (socket.AF_INET, 16, 0, '192.168.0.0', 0, 0),
        (socket.AF_INET, 0, 1, '0.0.0.0', 0, 0)
    ]
    assert subnets_sorted == \
            sorted(subnets, key=sshuttle.firewall.subnet_weight, reverse=True)
@patch('sshuttle.firewall.rewrite_etc_hosts')
@patch('sshuttle.firewall.setup_daemon')
@patch('sshuttle.firewall.get_method')
@ -88,14 +119,15 @@ def test_main(mock_get_method, mock_setup_daemon, mock_rewrite_etc_hosts):
            1024, 1026,
            [(10, u'2404:6800:4004:80c::33')],
            10,
-            [(10, 64, False, u'2404:6800:4004:80c::'),
+            [(10, 64, False, u'2404:6800:4004:80c::', 0, 0),
-                (10, 128, True, u'2404:6800:4004:80c::101f')],
+                (10, 128, True, u'2404:6800:4004:80c::101f', 80, 80)],
            True),
        call().setup_firewall(
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
-            [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+            [(2, 24, False, u'1.2.3.0', 8000, 9000),
                (2, 32, True, u'1.2.3.66', 8080, 8080)],
            True),
        call().restore_firewall(1024, 10, True),
        call().restore_firewall(1025, 2, True),
--- a/sshuttle/tests/client/test_helpers.py
+++ b/sshuttle/tests/client/test_helpers.py
--- a/sshuttle/tests/client/test_methods_nat.py
+++ b/sshuttle/tests/client/test_methods_nat.py
@ -86,8 +86,8 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
            1024, 1026,
            [(10, u'2404:6800:4004:80c::33')],
            10,
-            [(10, 64, False, u'2404:6800:4004:80c::'),
+            [(10, 64, False, u'2404:6800:4004:80c::', 0, 0),
-                (10, 128, True, u'2404:6800:4004:80c::101f')],
+                (10, 128, True, u'2404:6800:4004:80c::101f', 80, 80)],
            True)
    assert str(excinfo.value) \
        == 'Address family "AF_INET6" unsupported by nat method_name'
@ -100,7 +100,8 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
-            [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+            [(2, 24, False, u'1.2.3.0', 8000, 9000),
                (2, 32, True, u'1.2.3.66', 8080, 8080)],
            True)
    assert str(excinfo.value) == 'UDP not supported by nat method_name'
    assert mock_ipt_chain_exists.mock_calls == []
@ -111,14 +112,16 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
-        [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+        [(2, 24, False, u'1.2.3.0', 8000, 9000),
            (2, 32, True, u'1.2.3.66', 8080, 8080)],
        False)
    assert mock_ipt_chain_exists.mock_calls == [
        call(2, 'nat', 'sshuttle-1025')
    ]
    assert mock_ipt_ttl.mock_calls == [
        call(2, 'nat', '-A', 'sshuttle-1025', '-j', 'REDIRECT',
-             '--dest', u'1.2.3.0/24', '-p', 'tcp', '--to-ports', '1025'),
+            '--dest', u'1.2.3.0/24', '-p', 'tcp', '--dport', '8000:9000',
             '--to-ports', '1025'),
        call(2, 'nat', '-A', 'sshuttle-1025', '-j', 'REDIRECT',
             '--dest', u'1.2.3.33/32', '-p', 'udp',
             '--dport', '53', '--to-ports', '1027')
@ -133,7 +136,7 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
        call(2, 'nat', '-I', 'OUTPUT', '1', '-j', 'sshuttle-1025'),
        call(2, 'nat', '-I', 'PREROUTING', '1', '-j', 'sshuttle-1025'),
        call(2, 'nat', '-A', 'sshuttle-1025', '-j', 'RETURN',
-             '--dest', u'1.2.3.66/32', '-p', 'tcp')
+            '--dest', u'1.2.3.66/32', '-p', 'tcp', '--dport', '8080:8080')
    ]
    mock_ipt_chain_exists.reset_mock()
    mock_ipt_ttl.reset_mock()
--- a/sshuttle/tests/client/test_methods_pf.py
+++ b/sshuttle/tests/client/test_methods_pf.py
@ -0,0 +1,468 @@
 import pytest
 from mock import Mock, patch, call, ANY
 import socket
 from sshuttle.methods import get_method
 from sshuttle.helpers import Fatal
 from sshuttle.methods.pf import FreeBsd, Darwin, OpenBsd
 def test_get_supported_features():
    method = get_method('pf')
    features = method.get_supported_features()
    assert features.ipv6
    assert not features.udp
    assert features.dns
@patch('sshuttle.helpers.verbose', new=3)
 def test_get_tcp_dstip():
    sock = Mock()
    sock.getpeername.return_value = ("127.0.0.1", 1024)
    sock.getsockname.return_value = ("127.0.0.2", 1025)
    sock.family = socket.AF_INET
    firewall = Mock()
    firewall.pfile.readline.return_value = \
        b"QUERY_PF_NAT_SUCCESS 127.0.0.3,1026\n"
    method = get_method('pf')
    method.set_firewall(firewall)
    assert method.get_tcp_dstip(sock) == ('127.0.0.3', 1026)
    assert sock.mock_calls == [
        call.getpeername(),
        call.getsockname(),
    ]
    assert firewall.mock_calls == [
        call.pfile.write(b'QUERY_PF_NAT 2,6,127.0.0.1,1024,127.0.0.2,1025\n'),
        call.pfile.flush(),
        call.pfile.readline()
    ]
 def test_recv_udp():
    sock = Mock()
    sock.recvfrom.return_value = "11111", "127.0.0.1"
    method = get_method('pf')
    result = method.recv_udp(sock, 1024)
    assert sock.mock_calls == [call.recvfrom(1024)]
    assert result == ("127.0.0.1", None, "11111")
 def test_send_udp():
    sock = Mock()
    method = get_method('pf')
    method.send_udp(sock, None, "127.0.0.1", "22222")
    assert sock.mock_calls == [call.sendto("22222", "127.0.0.1")]
 def test_setup_tcp_listener():
    listener = Mock()
    method = get_method('pf')
    method.setup_tcp_listener(listener)
    assert listener.mock_calls == []
 def test_setup_udp_listener():
    listener = Mock()
    method = get_method('pf')
    method.setup_udp_listener(listener)
    assert listener.mock_calls == []
 def test_assert_features():
    method = get_method('pf')
    features = method.get_supported_features()
    method.assert_features(features)
    features.udp = True
    with pytest.raises(Fatal):
        method.assert_features(features)
    features.ipv6 = True
    with pytest.raises(Fatal):
        method.assert_features(features)
@patch('sshuttle.methods.pf.pf', Darwin())
@patch('sshuttle.methods.pf.sys.stdout')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_firewall_command_darwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
    method = get_method('pf')
    assert not method.firewall_command("somthing")
    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
        socket.AF_INET, socket.IPPROTO_TCP,
        "127.0.0.1", 1025, "127.0.0.2", 1024)
    assert method.firewall_command(command)
    assert mock_pf_get_dev.mock_calls == [call()]
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xc0544417, ANY),
    ]
    assert mock_stdout.mock_calls == [
        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
        call.flush(),
    ]
@patch('sshuttle.methods.pf.pf', FreeBsd())
@patch('sshuttle.methods.pf.sys.stdout')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_firewall_command_freebsd(mock_pf_get_dev, mock_ioctl, mock_stdout):
    method = get_method('pf')
    assert not method.firewall_command("somthing")
    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
        socket.AF_INET, socket.IPPROTO_TCP,
        "127.0.0.1", 1025, "127.0.0.2", 1024)
    assert method.firewall_command(command)
    assert mock_pf_get_dev.mock_calls == [call()]
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xc04c4417, ANY),
    ]
    assert mock_stdout.mock_calls == [
        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
        call.flush(),
    ]
@patch('sshuttle.methods.pf.pf', OpenBsd())
@patch('sshuttle.methods.pf.sys.stdout')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_firewall_command_openbsd(mock_pf_get_dev, mock_ioctl, mock_stdout):
    method = get_method('pf')
    assert not method.firewall_command("somthing")
    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
        socket.AF_INET, socket.IPPROTO_TCP,
        "127.0.0.1", 1025, "127.0.0.2", 1024)
    assert method.firewall_command(command)
    assert mock_pf_get_dev.mock_calls == [call()]
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xc0504417, ANY),
    ]
    assert mock_stdout.mock_calls == [
        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
        call.flush(),
    ]
 def pfctl(args, stdin=None):
    if args == '-s Interfaces -i lo -v':
        return (b'lo0 (skip)',)
    if args == '-s all':
        return (b'INFO:\nStatus: Disabled\nanother mary had a little lamb\n',
                b'little lamb\n')
    if args == '-E':
        return (b'\n', b'Token : abcdefg\n')
    return None
@patch('sshuttle.helpers.verbose', new=3)
@patch('sshuttle.methods.pf.pf', Darwin())
@patch('sshuttle.methods.pf.pfctl')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
    mock_pfctl.side_effect = pfctl
    method = get_method('pf')
    assert method.name == 'pf'
    # IPV6
    method.setup_firewall(
        1024, 1026,
        [(10, u'2404:6800:4004:80c::33')],
        10,
        [(10, 64, False, u'2404:6800:4004:80c::', 8000, 9000),
            (10, 128, True, u'2404:6800:4004:80c::101f', 8080, 8080)],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s Interfaces -i lo -v'),
        call('-f /dev/stdin', b'pass on lo\n'),
        call('-s all'),
        call('-a sshuttle6-1024 -f /dev/stdin',
             b'table <dns_servers> {2404:6800:4004:80c::33}\n'
             b'rdr pass on lo0 inet6 proto tcp to '
             b'2404:6800:4004:80c::/64 port 8000:9000 -> ::1 port 1024\n'
             b'rdr pass on lo0 inet6 proto udp '
             b'to <dns_servers> port 53 -> ::1 port 1026\n'
             b'pass out quick inet6 proto tcp to '
             b'2404:6800:4004:80c::101f/128 port 8080:8080\n'
             b'pass out route-to lo0 inet6 proto tcp to '
             b'2404:6800:4004:80c::/64 port 8000:9000 keep state\n'
             b'pass out route-to lo0 inet6 proto udp '
             b'to <dns_servers> port 53 keep state\n'),
        call('-E'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
            [(2, 24, False, u'1.2.3.0', 0, 0),
                (2, 32, True, u'1.2.3.66', 80, 80)],
            True)
    assert str(excinfo.value) == 'UDP not supported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    method.setup_firewall(
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
        [(2, 24, False, u'1.2.3.0', 0, 0), (2, 32, True, u'1.2.3.66', 80, 80)],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s Interfaces -i lo -v'),
        call('-f /dev/stdin', b'pass on lo\n'),
        call('-s all'),
        call('-a sshuttle-1025 -f /dev/stdin',
             b'table <dns_servers> {1.2.3.33}\n'
             b'rdr pass on lo0 inet proto tcp to 1.2.3.0/24 '
             b'-> 127.0.0.1 port 1025\n'
             b'rdr pass on lo0 inet proto udp '
             b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
             b'pass out quick inet proto tcp to 1.2.3.66/32 port 80:80\n'
             b'pass out route-to lo0 inet proto tcp to 1.2.3.0/24 keep state\n'
             b'pass out route-to lo0 inet proto udp '
             b'to <dns_servers> port 53 keep state\n'),
        call('-E'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    method.restore_firewall(1025, 2, False)
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == [
        call('-a sshuttle-1025 -F all'),
        call("-X abcdefg"),
    ]
    mock_pf_get_dev.reset_mock()
    mock_pfctl.reset_mock()
    mock_ioctl.reset_mock()
@patch('sshuttle.helpers.verbose', new=3)
@patch('sshuttle.methods.pf.pf', FreeBsd())
@patch('sshuttle.methods.pf.pfctl')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_setup_firewall_freebsd(mock_pf_get_dev, mock_ioctl, mock_pfctl):
    mock_pfctl.side_effect = pfctl
    method = get_method('pf')
    assert method.name == 'pf'
    method.setup_firewall(
        1024, 1026,
        [(10, u'2404:6800:4004:80c::33')],
        10,
        [(10, 64, False, u'2404:6800:4004:80c::', 8000, 9000),
            (10, 128, True, u'2404:6800:4004:80c::101f', 8080, 8080)],
        False)
    assert mock_pfctl.mock_calls == [
        call('-s all'),
        call('-a sshuttle6-1024 -f /dev/stdin',
             b'table <dns_servers> {2404:6800:4004:80c::33}\n'
             b'rdr pass on lo0 inet6 proto tcp to 2404:6800:4004:80c::/64 '
             b'port 8000:9000 -> ::1 port 1024\n'
             b'rdr pass on lo0 inet6 proto udp '
             b'to <dns_servers> port 53 -> ::1 port 1026\n'
             b'pass out quick inet6 proto tcp to '
             b'2404:6800:4004:80c::101f/128 port 8080:8080\n'
             b'pass out route-to lo0 inet6 proto tcp to '
             b'2404:6800:4004:80c::/64 port 8000:9000 keep state\n'
             b'pass out route-to lo0 inet6 proto udp '
             b'to <dns_servers> port 53 keep state\n'),
        call('-e'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
            [(2, 24, False, u'1.2.3.0', 0, 0),
                (2, 32, True, u'1.2.3.66', 80, 80)],
            True)
    assert str(excinfo.value) == 'UDP not supported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    method.setup_firewall(
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
        [(2, 24, False, u'1.2.3.0', 0, 0), (2, 32, True, u'1.2.3.66', 80, 80)],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s all'),
        call('-a sshuttle-1025 -f /dev/stdin',
             b'table <dns_servers> {1.2.3.33}\n'
             b'rdr pass on lo0 inet proto tcp to 1.2.3.0/24 -> '
             b'127.0.0.1 port 1025\n'
             b'rdr pass on lo0 inet proto udp '
             b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
             b'pass out quick inet proto tcp to 1.2.3.66/32 port 80:80\n'
             b'pass out route-to lo0 inet proto tcp to 1.2.3.0/24 keep state\n'
             b'pass out route-to lo0 inet proto udp '
             b'to <dns_servers> port 53 keep state\n'),
        call('-e'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    method.restore_firewall(1025, 2, False)
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == [
        call('-a sshuttle-1025 -F all'),
        call("-d"),
    ]
    mock_pf_get_dev.reset_mock()
    mock_pfctl.reset_mock()
    mock_ioctl.reset_mock()
@patch('sshuttle.helpers.verbose', new=3)
@patch('sshuttle.methods.pf.pf', OpenBsd())
@patch('sshuttle.methods.pf.pfctl')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_setup_firewall_openbsd(mock_pf_get_dev, mock_ioctl, mock_pfctl):
    mock_pfctl.side_effect = pfctl
    method = get_method('pf')
    assert method.name == 'pf'
    method.setup_firewall(
        1024, 1026,
        [(10, u'2404:6800:4004:80c::33')],
        10,
        [(10, 64, False, u'2404:6800:4004:80c::', 8000, 9000),
            (10, 128, True, u'2404:6800:4004:80c::101f', 8080, 8080)],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xcd48441a, ANY),
        call(mock_pf_get_dev(), 0xcd48441a, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s Interfaces -i lo -v'),
        call('-f /dev/stdin', b'match on lo\n'),
        call('-s all'),
        call('-a sshuttle6-1024 -f /dev/stdin',
             b'table <dns_servers> {2404:6800:4004:80c::33}\n'
             b'pass in on lo0 inet6 proto tcp to 2404:6800:4004:80c::/64 '
             b'port 8000:9000 divert-to ::1 port 1024\n'
             b'pass in on lo0 inet6 proto udp '
             b'to <dns_servers> port 53 rdr-to ::1 port 1026\n'
             b'pass out quick inet6 proto tcp to '
             b'2404:6800:4004:80c::101f/128 port 8080:8080\n'
             b'pass out inet6 proto tcp to 2404:6800:4004:80c::/64 '
             b'port 8000:9000 route-to lo0 keep state\n'
             b'pass out inet6 proto udp to '
             b'<dns_servers> port 53 route-to lo0 keep state\n'),
        call('-e'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
            [(2, 24, False, u'1.2.3.0', 0, 0),
                (2, 32, True, u'1.2.3.66', 80, 80)],
            True)
    assert str(excinfo.value) == 'UDP not supported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    method.setup_firewall(
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
        [(2, 24, False, u'1.2.3.0', 0, 0),
            (2, 32, True, u'1.2.3.66', 80, 80)],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xcd48441a, ANY),
        call(mock_pf_get_dev(), 0xcd48441a, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s Interfaces -i lo -v'),
        call('-f /dev/stdin', b'match on lo\n'),
        call('-s all'),
        call('-a sshuttle-1025 -f /dev/stdin',
             b'table <dns_servers> {1.2.3.33}\n'
             b'pass in on lo0 inet proto tcp to 1.2.3.0/24 divert-to '
             b'127.0.0.1 port 1025\n'
             b'pass in on lo0 inet proto udp to '
             b'<dns_servers> port 53 rdr-to 127.0.0.1 port 1027\n'
             b'pass out quick inet proto tcp to 1.2.3.66/32 port 80:80\n'
             b'pass out inet proto tcp to 1.2.3.0/24 route-to lo0 keep state\n'
             b'pass out inet proto udp to '
             b'<dns_servers> port 53 route-to lo0 keep state\n'),
        call('-e'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    method.restore_firewall(1025, 2, False)
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == [
        call('-a sshuttle-1025 -F all'),
        call("-d"),
    ]
    mock_pf_get_dev.reset_mock()
    mock_pfctl.reset_mock()
    mock_ioctl.reset_mock()
--- a/sshuttle/tests/client/test_methods_tproxy.py
+++ b/sshuttle/tests/client/test_methods_tproxy.py
@ -102,8 +102,8 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
        1024, 1026,
        [(10, u'2404:6800:4004:80c::33')],
        10,
-        [(10, 64, False, u'2404:6800:4004:80c::'),
+        [(10, 64, False, u'2404:6800:4004:80c::', 8000, 9000),
-            (10, 128, True, u'2404:6800:4004:80c::101f')],
+            (10, 128, True, u'2404:6800:4004:80c::101f', 8080, 8080)],
        True)
    assert mock_ipt_chain_exists.mock_calls == [
        call(10, 'mangle', 'sshuttle-m-1024'),
@ -144,28 +144,30 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
             '-m', 'udp', '-p', 'udp', '--dport', '53', '--on-port', '1026'),
        call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'RETURN',
             '--dest', u'2404:6800:4004:80c::101f/128',
-             '-m', 'tcp', '-p', 'tcp'),
+             '-m', 'tcp', '-p', 'tcp', '--dport', '8080:8080'),
        call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'RETURN',
             '--dest', u'2404:6800:4004:80c::101f/128',
-             '-m', 'tcp', '-p', 'tcp'),
+             '-m', 'tcp', '-p', 'tcp', '--dport', '8080:8080'),
        call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'RETURN',
             '--dest', u'2404:6800:4004:80c::101f/128',
-             '-m', 'udp', '-p', 'udp'),
+             '-m', 'udp', '-p', 'udp', '--dport', '8080:8080'),
        call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'RETURN',
             '--dest', u'2404:6800:4004:80c::101f/128',
-             '-m', 'udp', '-p', 'udp'),
+             '-m', 'udp', '-p', 'udp', '--dport', '8080:8080'),
        call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'MARK',
             '--set-mark', '1', '--dest', u'2404:6800:4004:80c::/64',
-             '-m', 'tcp', '-p', 'tcp'),
+             '-m', 'tcp', '-p', 'tcp', '--dport', '8000:9000'),
        call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'TPROXY',
             '--tproxy-mark', '0x1/0x1', '--dest', u'2404:6800:4004:80c::/64',
-             '-m', 'tcp', '-p', 'tcp', '--on-port', '1024'),
+             '-m', 'tcp', '-p', 'tcp', '--dport', '8000:9000',
             '--on-port', '1024'),
        call(10, 'mangle', '-A', 'sshuttle-m-1024', '-j', 'MARK',
             '--set-mark', '1', '--dest', u'2404:6800:4004:80c::/64',
             '-m', 'udp', '-p', 'udp'),
        call(10, 'mangle', '-A', 'sshuttle-t-1024', '-j', 'TPROXY',
             '--tproxy-mark', '0x1/0x1', '--dest', u'2404:6800:4004:80c::/64',
-             '-m', 'udp', '-p', 'udp', '--on-port', '1024')
+             '-m', 'udp', '-p', 'udp', '--dport', '8000:9000',
             '--on-port', '1024')
    ]
    mock_ipt_chain_exists.reset_mock()
    mock_ipt_ttl.reset_mock()
@ -198,7 +200,7 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
-        [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+        [(2, 24, False, u'1.2.3.0', 0, 0), (2, 32, True, u'1.2.3.66', 80, 80)],
        True)
    assert mock_ipt_chain_exists.mock_calls == [
        call(2, 'mangle', 'sshuttle-m-1025'),
@ -237,13 +239,17 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt):
             '--tproxy-mark', '0x1/0x1', '--dest', u'1.2.3.33/32',
             '-m', 'udp', '-p', 'udp', '--dport', '53', '--on-port', '1027'),
        call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'RETURN',
-             '--dest', u'1.2.3.66/32', '-m', 'tcp', '-p', 'tcp'),
+             '--dest', u'1.2.3.66/32', '-m', 'tcp', '-p', 'tcp', 
             '--dport', '80:80'),
        call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'RETURN',
-             '--dest', u'1.2.3.66/32', '-m', 'tcp', '-p', 'tcp'),
+             '--dest', u'1.2.3.66/32', '-m', 'tcp', '-p', 'tcp',
             '--dport', '80:80'),
        call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'RETURN',
-             '--dest', u'1.2.3.66/32', '-m', 'udp', '-p', 'udp'),
+             '--dest', u'1.2.3.66/32', '-m', 'udp', '-p', 'udp',
             '--dport', '80:80'),
        call(2, 'mangle', '-A', 'sshuttle-t-1025', '-j', 'RETURN',
-             '--dest', u'1.2.3.66/32', '-m', 'udp', '-p', 'udp'),
+             '--dest', u'1.2.3.66/32', '-m', 'udp', '-p', 'udp',
             '--dport', '80:80'),
        call(2, 'mangle', '-A', 'sshuttle-m-1025', '-j', 'MARK',
             '--set-mark', '1', '--dest', u'1.2.3.0/24',
             '-m', 'tcp', '-p', 'tcp'),
--- a/sshuttle/tests/client/test_options.py
+++ b/sshuttle/tests/client/test_options.py
@ -0,0 +1,101 @@
 import socket
 import pytest
 import sshuttle.options
 from argparse import ArgumentTypeError as Fatal
 _ip4_reprs = {
        '0.0.0.0': '0.0.0.0',
        '255.255.255.255': '255.255.255.255',
        '10.0': '10.0.0.0',
        '184.172.10.74': '184.172.10.74',
        '3098282570': '184.172.10.74',
        '0xb8.0xac.0x0a.0x4a': '184.172.10.74',
        '0270.0254.0012.0112': '184.172.10.74',
        'localhost': '127.0.0.1'
 }
 _ip4_swidths = (1, 8, 22, 27, 32)
 _ip6_reprs = {
        '::': '::',
        '::1': '::1',
        'fc00::': 'fc00::',
        '2a01:7e00:e000:188::1': '2a01:7e00:e000:188::1'
 }
 _ip6_swidths = (48, 64, 96, 115, 128)
 def test_parse_subnetport_ip4():
    for ip_repr, ip in _ip4_reprs.items():
        assert sshuttle.options.parse_subnetport(ip_repr) \
                == (socket.AF_INET, ip, 32, 0, 0)
    with pytest.raises(Fatal) as excinfo:
        sshuttle.options.parse_subnetport('10.256.0.0')
    assert str(excinfo.value) == 'Unable to resolve address: 10.256.0.0'
 def test_parse_subnetport_ip4_with_mask():
    for ip_repr, ip in _ip4_reprs.items():
        for swidth in _ip4_swidths:
            assert sshuttle.options.parse_subnetport(
                    '/'.join((ip_repr, str(swidth)))
                    ) == (socket.AF_INET, ip, swidth, 0, 0)
    assert sshuttle.options.parse_subnetport('0/0') \
            == (socket.AF_INET, '0.0.0.0', 0, 0, 0)
    with pytest.raises(Fatal) as excinfo:
        sshuttle.options.parse_subnetport('10.0.0.0/33')
    assert str(excinfo.value) == 'width 33 is not between 0 and 32'
 def test_parse_subnetport_ip4_with_port():
    for ip_repr, ip in _ip4_reprs.items():
        assert sshuttle.options.parse_subnetport(':'.join((ip_repr, '80'))) \
                == (socket.AF_INET, ip, 32, 80, 80)
        assert sshuttle.options.parse_subnetport(':'.join((ip_repr, '80-90'))) \
                == (socket.AF_INET, ip, 32, 80, 90)
 def test_parse_subnetport_ip4_with_mask_and_port():
    for ip_repr, ip in _ip4_reprs.items():
        assert sshuttle.options.parse_subnetport(ip_repr + '/32:80') \
                == (socket.AF_INET, ip, 32, 80, 80)
        assert sshuttle.options.parse_subnetport(ip_repr + '/16:80-90') \
                == (socket.AF_INET, ip, 16, 80, 90)
 def test_parse_subnetport_ip6():
    for ip_repr, ip in _ip6_reprs.items():
        assert sshuttle.options.parse_subnetport(ip_repr) \
                == (socket.AF_INET6, ip, 128, 0, 0)
    with pytest.raises(Fatal) as excinfo:
        sshuttle.options.parse_subnetport('2001::1::3f')
    assert str(excinfo.value) == 'Unable to resolve address: 2001::1::3f'
 def test_parse_subnetport_ip6_with_mask():
    for ip_repr, ip in _ip6_reprs.items():
        for swidth in _ip4_swidths + _ip6_swidths:
            assert sshuttle.options.parse_subnetport(
                    '/'.join((ip_repr, str(swidth)))
                    ) == (socket.AF_INET6, ip, swidth, 0, 0)
    assert sshuttle.options.parse_subnetport('::/0') \
            == (socket.AF_INET6, '::', 0, 0, 0)
    with pytest.raises(Fatal) as excinfo:
        sshuttle.options.parse_subnetport('fc00::/129')
    assert str(excinfo.value) == 'width 129 is not between 0 and 128'
 def test_parse_subnetport_ip6_with_port():
    for ip_repr, ip in _ip6_reprs.items():
        assert sshuttle.options.parse_subnetport('[' + ip_repr + ']:80') \
                == (socket.AF_INET6, ip, 128, 80, 80)
        assert sshuttle.options.parse_subnetport('[' + ip_repr + ']:80-90') \
                == (socket.AF_INET6, ip, 128, 80, 90)
 def test_parse_subnetport_ip6_with_mask_and_port():
    for ip_repr, ip in _ip6_reprs.items():
        assert sshuttle.options.parse_subnetport('[' + ip_repr + '/128]:80') \
                == (socket.AF_INET6, ip, 128, 80, 80)
        assert sshuttle.options.parse_subnetport('[' + ip_repr + '/16]:80-90') \
                == (socket.AF_INET6, ip, 16, 80, 90)
--- a/sshuttle/tests/client/test_sdnotify.py
+++ b/sshuttle/tests/client/test_sdnotify.py
@ -0,0 +1,66 @@
 from mock import Mock, patch, call
 import sys
 import io
 import socket
 import sshuttle.sdnotify
@patch('sshuttle.sdnotify.os.environ.get')
 def test_notify_invalid_socket_path(mock_get):
    mock_get.return_value = 'invalid_path'
    assert not sshuttle.sdnotify.send(sshuttle.sdnotify.ready())
@patch('sshuttle.sdnotify.os.environ.get')
 def test_notify_socket_not_there(mock_get):
    mock_get.return_value = '/run/valid_nonexistent_path'
    assert not sshuttle.sdnotify.send(sshuttle.sdnotify.ready())
@patch('sshuttle.sdnotify.os.environ.get')
 def test_notify_no_message(mock_get):
    mock_get.return_value = '/run/valid_path'
    assert not sshuttle.sdnotify.send()
@patch('sshuttle.sdnotify.socket.socket')
@patch('sshuttle.sdnotify.os.environ.get')
 def test_notify_socket_error(mock_get, mock_socket):
    mock_get.return_value = '/run/valid_path'
    mock_socket.side_effect = socket.error('test error')
    assert not sshuttle.sdnotify.send(sshuttle.sdnotify.ready())
@patch('sshuttle.sdnotify.socket.socket')
@patch('sshuttle.sdnotify.os.environ.get')
 def test_notify_sendto_error(mock_get, mock_socket):
    message = sshuttle.sdnotify.ready()
    socket_path = '/run/valid_path'
    sock = Mock()
    sock.sendto.side_effect = socket.error('test error')
    mock_get.return_value = '/run/valid_path'
    mock_socket.return_value = sock
    assert not sshuttle.sdnotify.send(message)
    assert sock.sendto.mock_calls == [
        call(message, socket_path),
    ]
@patch('sshuttle.sdnotify.socket.socket')
@patch('sshuttle.sdnotify.os.environ.get')
 def test_notify(mock_get, mock_socket):
    messages = [sshuttle.sdnotify.ready(), sshuttle.sdnotify.status('Running')]
    socket_path = '/run/valid_path'
    sock = Mock()
    sock.sendto.return_value = 1
    mock_get.return_value = '/run/valid_path'
    mock_socket.return_value = sock
    assert sshuttle.sdnotify.send(*messages)
    assert sock.sendto.mock_calls == [
        call(b'\n'.join(messages), socket_path),
    ]
--- a/sshuttle/tests/server/test_server.py
+++ b/sshuttle/tests/server/test_server.py
@ -0,0 +1,59 @@
 import os
 import io
 import socket
 import sshuttle.server
 from mock import patch, Mock, call
 def test__ipmatch():
    assert sshuttle.server._ipmatch("1.2.3.4") is not None
    assert sshuttle.server._ipmatch("::1") is None   # ipv6 not supported
    assert sshuttle.server._ipmatch("42 Example Street, Melbourne") is None
 def test__ipstr():
    assert sshuttle.server._ipstr("1.2.3.4", 24) == "1.2.3.4/24"
    assert sshuttle.server._ipstr("1.2.3.4", 32) == "1.2.3.4"
 def test__maskbits():
    netmask = sshuttle.server._ipmatch("255.255.255.0")
    sshuttle.server._maskbits(netmask)
@patch('sshuttle.server.which', side_effect=lambda x: x == 'netstat')
@patch('sshuttle.server.ssubprocess.Popen')
 def test_listroutes_netstat(mock_popen, mock_which):
    mock_pobj = Mock()
    mock_pobj.stdout = io.BytesIO(b"""
 Kernel IP routing table
 Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
 0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 wlan0
 192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
 """)
    mock_pobj.wait.return_value = 0
    mock_popen.return_value = mock_pobj
    routes = sshuttle.server.list_routes()
    assert list(routes) == [
        (socket.AF_INET, '192.168.1.0', 24)
    ]
@patch('sshuttle.server.which', side_effect=lambda x: x == 'ip')
@patch('sshuttle.server.ssubprocess.Popen')
 def test_listroutes_iproute(mock_popen, mock_which):
    mock_pobj = Mock()
    mock_pobj.stdout = io.BytesIO(b"""
 default via 192.168.1.1 dev wlan0  proto static 
 192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.1
 """)
    mock_pobj.wait.return_value = 0
    mock_popen.return_value = mock_pobj
    routes = sshuttle.server.list_routes()
    assert list(routes) == [
        (socket.AF_INET, '192.168.1.0', 24)
    ]
--- a/sshuttle/tests/test_methods_pf.py
+++ b/sshuttle/tests/test_methods_pf.py
@ -1,302 +0,0 @@
 import pytest
 from mock import Mock, patch, call, ANY
 import socket
 from sshuttle.methods import get_method
 from sshuttle.helpers import Fatal
 from sshuttle.methods.pf import OsDefs
 def test_get_supported_features():
    method = get_method('pf')
    features = method.get_supported_features()
    assert not features.ipv6
    assert not features.udp
    assert features.dns
@patch('sshuttle.helpers.verbose', new=3)
 def test_get_tcp_dstip():
    sock = Mock()
    sock.getpeername.return_value = ("127.0.0.1", 1024)
    sock.getsockname.return_value = ("127.0.0.2", 1025)
    sock.family = socket.AF_INET
    firewall = Mock()
    firewall.pfile.readline.return_value = \
        b"QUERY_PF_NAT_SUCCESS 127.0.0.3,1026\n"
    method = get_method('pf')
    method.set_firewall(firewall)
    assert method.get_tcp_dstip(sock) == ('127.0.0.3', 1026)
    assert sock.mock_calls == [
        call.getpeername(),
        call.getsockname(),
    ]
    assert firewall.mock_calls == [
        call.pfile.write(b'QUERY_PF_NAT 2,6,127.0.0.1,1024,127.0.0.2,1025\n'),
        call.pfile.flush(),
        call.pfile.readline()
    ]
 def test_recv_udp():
    sock = Mock()
    sock.recvfrom.return_value = "11111", "127.0.0.1"
    method = get_method('pf')
    result = method.recv_udp(sock, 1024)
    assert sock.mock_calls == [call.recvfrom(1024)]
    assert result == ("127.0.0.1", None, "11111")
 def test_send_udp():
    sock = Mock()
    method = get_method('pf')
    method.send_udp(sock, None, "127.0.0.1", "22222")
    assert sock.mock_calls == [call.sendto("22222", "127.0.0.1")]
 def test_setup_tcp_listener():
    listener = Mock()
    method = get_method('pf')
    method.setup_tcp_listener(listener)
    assert listener.mock_calls == []
 def test_setup_udp_listener():
    listener = Mock()
    method = get_method('pf')
    method.setup_udp_listener(listener)
    assert listener.mock_calls == []
 def test_assert_features():
    method = get_method('pf')
    features = method.get_supported_features()
    method.assert_features(features)
    features.udp = True
    with pytest.raises(Fatal):
        method.assert_features(features)
    features.ipv6 = True
    with pytest.raises(Fatal):
        method.assert_features(features)
@patch('sshuttle.methods.pf.osdefs', OsDefs('darwin'))
@patch('sshuttle.methods.pf.sys.stdout')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_firewall_command_darwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
    method = get_method('pf')
    assert not method.firewall_command("somthing")
    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
        socket.AF_INET, socket.IPPROTO_TCP,
        "127.0.0.1", 1025, "127.0.0.2", 1024)
    assert method.firewall_command(command)
    assert mock_pf_get_dev.mock_calls == [call()]
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xc0544417, ANY),
    ]
    assert mock_stdout.mock_calls == [
        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
        call.flush(),
    ]
@patch('sshuttle.methods.pf.osdefs', OsDefs('notdarwin'))
@patch('sshuttle.methods.pf.sys.stdout')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_firewall_command_notdarwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
    method = get_method('pf')
    assert not method.firewall_command("somthing")
    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
        socket.AF_INET, socket.IPPROTO_TCP,
        "127.0.0.1", 1025, "127.0.0.2", 1024)
    assert method.firewall_command(command)
    assert mock_pf_get_dev.mock_calls == [call()]
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xc04c4417, ANY),
    ]
    assert mock_stdout.mock_calls == [
        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
        call.flush(),
    ]
 def pfctl(args, stdin=None):
    if args == '-s all':
        return (b'INFO:\nStatus: Disabled\nanother mary had a little lamb\n',
                b'little lamb\n')
    if args == '-E':
        return (b'\n', b'Token : abcdefg\n')
    return None
@patch('sshuttle.helpers.verbose', new=3)
@patch('sshuttle.methods.pf.osdefs', OsDefs('darwin'))
@patch('sshuttle.methods.pf.pfctl')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
    mock_pfctl.side_effect = pfctl
    method = get_method('pf')
    assert method.name == 'pf'
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1024, 1026,
            [(10, u'2404:6800:4004:80c::33')],
            10,
            [(10, 64, False, u'2404:6800:4004:80c::'),
                (10, 128, True, u'2404:6800:4004:80c::101f')],
            True)
    assert str(excinfo.value) \
        == 'Address family "AF_INET6" unsupported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
            [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
            True)
    assert str(excinfo.value) == 'UDP not supported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    method.setup_firewall(
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
        [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
        call(mock_pf_get_dev(), 0xCC20441A, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s all'),
        call('-a sshuttle -f /dev/stdin',
             b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
             b'table <dns_servers> {1.2.3.33}\n'
             b'rdr pass on lo0 proto tcp '
             b'to <forward_subnets> -> 127.0.0.1 port 1025\n'
             b'rdr pass on lo0 proto udp '
             b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
             b'pass out route-to lo0 inet proto tcp '
             b'to <forward_subnets> keep state\n'
             b'pass out route-to lo0 inet proto udp '
             b'to <dns_servers> port 53 keep state\n'),
        call('-E'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    method.restore_firewall(1025, 2, False)
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == [
        call('-a sshuttle -F all'),
        call("-X abcdefg"),
    ]
    mock_pf_get_dev.reset_mock()
    mock_pfctl.reset_mock()
    mock_ioctl.reset_mock()
@patch('sshuttle.helpers.verbose', new=3)
@patch('sshuttle.methods.pf.osdefs', OsDefs('notdarwin'))
@patch('sshuttle.methods.pf.pfctl')
@patch('sshuttle.methods.pf.ioctl')
@patch('sshuttle.methods.pf.pf_get_dev')
 def test_setup_firewall_notdarwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
    mock_pfctl.side_effect = pfctl
    method = get_method('pf')
    assert method.name == 'pf'
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1024, 1026,
            [(10, u'2404:6800:4004:80c::33')],
            10,
            [(10, 64, False, u'2404:6800:4004:80c::'),
                (10, 128, True, u'2404:6800:4004:80c::101f')],
            True)
    assert str(excinfo.value) \
        == 'Address family "AF_INET6" unsupported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    with pytest.raises(Exception) as excinfo:
        method.setup_firewall(
            1025, 1027,
            [(2, u'1.2.3.33')],
            2,
            [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
            True)
    assert str(excinfo.value) == 'UDP not supported by pf method_name'
    assert mock_pf_get_dev.mock_calls == []
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == []
    method.setup_firewall(
        1025, 1027,
        [(2, u'1.2.3.33')],
        2,
        [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
        False)
    assert mock_ioctl.mock_calls == [
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
        call(mock_pf_get_dev(), 0xC4704433, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
        call(mock_pf_get_dev(), 0xCBE0441A, ANY),
    ]
    assert mock_pfctl.mock_calls == [
        call('-s all'),
        call('-a sshuttle -f /dev/stdin',
             b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
             b'table <dns_servers> {1.2.3.33}\n'
             b'rdr pass on lo0 proto tcp '
             b'to <forward_subnets> -> 127.0.0.1 port 1025\n'
             b'rdr pass on lo0 proto udp '
             b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
             b'pass out route-to lo0 inet proto tcp '
             b'to <forward_subnets> keep state\n'
             b'pass out route-to lo0 inet proto udp '
             b'to <dns_servers> port 53 keep state\n'),
        call('-e'),
    ]
    mock_pf_get_dev.reset_mock()
    mock_ioctl.reset_mock()
    mock_pfctl.reset_mock()
    method.restore_firewall(1025, 2, False)
    assert mock_ioctl.mock_calls == []
    assert mock_pfctl.mock_calls == [
        call('-a sshuttle -F all'),
        call("-d"),
    ]
    mock_pf_get_dev.reset_mock()
    mock_pfctl.reset_mock()
    mock_ioctl.reset_mock()
--- a/tox.ini
+++ b/tox.ini
@ -1,12 +1,16 @@
 [tox]
 downloadcache = {toxworkdir}/cache/
 envlist =
    py26,
    py27,
    py34,
    py35,
 [testenv]
 basepython =
    py26: python2.6
    py27: python2.7
    py34: python3.4
    py35: python3.5
 commands =
    py.test