New release

IPv6 support for OSX and BSDs

.gitignore

@@ -1,4 +1,13 @@
-sshuttle/version.py
+/sshuttle/version.py
+/docs/conf.py
+/tmp/
+/.cache/
+/.eggs/
+/.tox/
+/build/
+/dist/
+/sshuttle.egg-info/
+/docs/_build/
 *.pyc
 *~
 *.8

.travis.yml

@@ -1,6 +1,8 @@
 language: python
 python:
+- 2.6
 - 2.7
+- 3.4
 - 3.5
 - pypy
 

CHANGES.rst

@@ -1,3 +1,45 @@
+Release 0.78.1 (6th August, 2016)
+=================================
+* Fix readthedocs versioning.
+* Don't crash on ENETUNREACH.
+* Various bug fixes.
+* Improvements to BSD and OSX support.
+
+
+Release 0.78.0 (Apr 8, 2016)
+============================
+
+* Don't force IPv6 if IPv6 nameservers supplied. Fixes #74.
+* Call /bin/sh as users shell may not be POSIX compliant. Fixes #77.
+* Use argparse for command line processing. Fixes #75.
+* Remove useless --server option.
+* Support multiple -s (subnet) options. Fixes #86.
+* Make server parts work with old versions of Python. Fixes #81.
+
+
+Release 0.77.2 (Mar 7, 2016)
+============================
+
+* Accidentally switched LGPL2 license with GPL2 license in 0.77.1 - now fixed.
+
+
+Release 0.77.1 (Mar 7, 2016)
+============================
+
+* Use semantic versioning. http://semver.org/
+* Update GPL 2 license text.
+* New release to fix PyPI.
+
+
+Release 0.77 (Mar 3, 2016)
+==========================
+
+* Various bug fixes.
+* Fix Documentation.
+* Add fix for MacOS X issue.
+* Add support for OpenBSD.
+
+
 Release 0.76 (Jan 17, 2016)
 ===========================
 

LICENSE

@@ -1,15 +1,15 @@
-		  GNU LIBRARY GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
+                  GNU LIBRARY GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
 
  Copyright (C) 1991 Free Software Foundation, Inc.
-                    675 Mass Ave, Cambridge, MA 02139, USA
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
 [This is the first released version of the library GPL.  It is
  numbered 2 because it goes with version 2 of the ordinary GPL.]
 
-			    Preamble
+                            Preamble
 
   The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -99,7 +99,7 @@ works together with the library.
   Note that it is possible for a library to be covered by the ordinary
 General Public License rather than by this special one.
 
-		  GNU LIBRARY GENERAL PUBLIC LICENSE
+                  GNU LIBRARY GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
   0. This License Agreement applies to any software library which
@@ -411,7 +411,7 @@ decision will be guided by the two goals of preserving the free status
 of all derivatives of our free software and of promoting the sharing
 and reuse of software generally.
 
-			    NO WARRANTY
+                            NO WARRANTY
 
   15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
 WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
@@ -434,9 +434,9 @@ FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
 SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.
 
-		     END OF TERMS AND CONDITIONS
+                     END OF TERMS AND CONDITIONS
 
-     Appendix: How to Apply These Terms to Your New Libraries
+           How to Apply These Terms to Your New Libraries
 
   If you develop a new library, and you want it to be of the greatest
 possible use to the public, we recommend making it free software that
@@ -463,8 +463,8 @@ convey the exclusion of warranty; and each file should have at least the
     Library General Public License for more details.
 
     You should have received a copy of the GNU Library General Public
-    License along with this library; if not, write to the Free
-    Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
 Also add information on how to contact you by electronic and paper mail.
 

MANIFEST.in

@@ -5,8 +5,11 @@ include MANIFEST.in
 include LICENSE
 include run
 include tox.ini
+exclude sshuttle/version.py
+exclude docs/conf.py
 recursive-include docs *.bat
 recursive-include docs *.py
 recursive-include docs *.rst
 recursive-include docs Makefile
 recursive-include sshuttle *.py
+recursive-exclude docs/_build *

VERSION.txt

@@ -1 +0,0 @@
-0.75

conftest.py

@@ -0,0 +1,10 @@
+import sys
+
+if sys.version_info >= (3, 0):
+    good_python = sys.version_info >= (3, 5)
+else:
+    good_python = sys.version_info >= (2, 7)
+
+collect_ignore = []
+if not good_python:
+    collect_ignore.append("sshuttle/tests/client")

docs/conf.orig.py

@@ -15,6 +15,7 @@
 
 # import sys
 # import os
+from setuptools_scm import get_version
 
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the
@@ -54,7 +55,6 @@ copyright = '2016, Brian May'
 # built documents.
 #
 # The short X.Y version.
-from setuptools_scm import get_version
 version = get_version(root="..")
 # The full version, including alpha/beta/rc tags.
 release = version

docs/index.rst

@@ -1,6 +1,9 @@
 sshuttle: where transparent proxy meets VPN meets ssh
 =====================================================
 
+:Date: |today|
+:Version: |version|
+
 Contents:
 
 .. toctree::
@@ -10,6 +13,7 @@ Contents:
    requirements
    installation
    usage
+   platform
    Man Page <manpage>
    how-it-works
    support

docs/manpage.rst

@@ -37,6 +37,12 @@ Options
     netmask), and 0/0 ('just route everything through the
     VPN').
 
+.. option:: --method [auto|nat|tproxy|pf]
+
+   Which firewall method should sshuttle use? For auto, sshuttle attempts to
+   guess the appropriate method depending on what it can find in PATH. The
+   default value is auto.
+
 .. option:: -l, --listen=[ip:]port
 
     Use this ip address and port number as the transparent
@@ -130,6 +136,10 @@ Options
     if you use this option to give it a few names to start
     from.
 
+    If this option is used *without* :option:`--auto-hosts`,
+    then the listed hostnames will be scanned and added, but
+    no further hostnames will be added.
+
 .. option:: --no-latency-control
 
     Sacrifice latency to improve bandwidth benchmarks. ssh
@@ -278,7 +288,6 @@ there is no need for congestion control to be shared
 between the two separate streams, so a tcp-based tunnel is
 fine.
 
+.. seealso::
 
-See Also
---------
-:manpage:`ssh(1)`, :manpage:`python(1)`
+   :manpage:`ssh(1)`, :manpage:`python(1)`

docs/platform.rst

@@ -0,0 +1,10 @@
+Platform Specific Notes
+=======================
+
+Contents:
+
+.. toctree::
+   :maxdepth: 2
+
+   tproxy
+   windows

docs/requirements.rst

@@ -37,11 +37,13 @@ Supports:
 Full UDP or DNS support with the TPROXY method requires the ``recvmsg()``
 syscall. This is not available in Python 2, however is in Python 3.5 and
 later. Under Python 2 you might find it sufficient installing PyXAPI_ to get
-the ``recvmsg()`` function.
+the ``recvmsg()`` function. See :doc:`tproxy` for more information.
 
 
-MacOS with PF method
-~~~~~~~~~~~~~~~~~~~~
+MacOS / FreeBSD / OpenBSD
+~~~~~~~~~~~~~~~~~~~~~~~~~
+Method: pf
+
 Supports:
 
 * IPv4 TCP
@@ -51,9 +53,16 @@ Requires:
 
 * You need to have the pfctl command.
 
+Windows
+~~~~~~~
+
+Not officially supported, however can be made to work with Vagrant. Requires
+cmd.exe with Administrator access. See :doc:`windows` for more information.
+
 
 Server side Requirements
 ------------------------
+Server requirements are more relaxed, however it is recommended that you use
 Python 2.7 or Python 3.5.
 
 

docs/tproxy.rst

@@ -0,0 +1,42 @@
+TPROXY
+======
+TPROXY is the only method that has full support of IPv6 and UDP.
+
+There are some things you need to consider for TPROXY to work:
+
+- The following commands need to be run first as root. This only needs to be
+  done once after booting up::
+
+      ip route add local default dev lo table 100
+      ip rule add fwmark 1 lookup 100
+      ip -6 route add local default dev lo table 100
+      ip -6 rule add fwmark 1 lookup 100
+
+- The ``--auto-nets`` feature does not detect IPv6 routes automatically. Add IPv6
+  routes manually. e.g. by adding ``'::/0'`` to the end of the command line.
+
+- The client needs to be run as root. e.g.::
+
+      sudo SSH_AUTH_SOCK="$SSH_AUTH_SOCK" $HOME/tree/sshuttle.tproxy/sshuttle  --method=tproxy ...
+
+- You may need to exclude the IP address of the server you are connecting to.
+  Otherwise sshuttle may attempt to intercept the ssh packets, which will not
+  work. Use the ``--exclude`` parameter for this.
+
+- Similarly, UDP return packets (including DNS) could get intercepted and
+  bounced back. This is the case if you have a broad subnet such as
+  ``0.0.0.0/0`` or ``::/0`` that includes the IP address of the client. Use the
+  ``--exclude`` parameter for this.
+
+- You need the ``--method=tproxy`` parameter, as above.
+
+- The routes for the outgoing packets must already exist. For example, if your
+  connection does not have IPv6 support, no IPv6 routes will exist, IPv6
+  packets will not be generated and sshuttle cannot intercept them::
+
+      telnet -6 www.google.com 80
+      Trying 2404:6800:4001:805::1010...
+      telnet: Unable to connect to remote host: Network is unreachable
+
+  Add some dummy routes to external interfaces. Make sure they get removed
+  however after sshuttle exits.

docs/trivia.rst

@@ -3,7 +3,7 @@ Useless Trivia
 This section written by the original author, Avery Pennarun
 <apenwarr@gmail.com>.
 
-Back in 1998 (12 years ago!  Yikes!), I released the first version of `Tunnel
+Back in 1998, I released the first version of `Tunnel
 Vision <http://alumnit.ca/wiki/?TunnelVisionReadMe>`_, a semi-intelligent VPN
 client for Linux.  Unfortunately, I made two big mistakes: I implemented the
 key exchange myself (oops), and I ended up doing TCP-over-TCP (double oops).
@@ -31,6 +31,6 @@ intended.)
 
 That project I did for Slipstream was what first gave me the idea to merge
 the concepts of Fast Forward, Double Vision, and Tunnel Vision into a single
-program that was the best of all worlds.  And here we are, at last, 10 years
-later.  You're welcome.
+program that was the best of all worlds.  And here we are, at last.
+You're welcome.
 

docs/usage.rst

@@ -1,24 +1,33 @@
 Usage
 =====
-- Forward all traffic::
 
-      sshuttle -r username@sshserver 0.0.0.0/0
+.. note::
+
+    For information on usage with Windows, see the :doc:`windows` section.
+    For information on using the TProxy method, see the :doc:`tproxy` section.
+
+Forward all traffic::
+
+    sshuttle -r username@sshserver 0.0.0.0/0
+
+- Use the :option:`sshuttle -r` parameter to specify a remote server.
 
 - By default sshuttle will automatically choose a method to use. Override with
-  the ``--method=`` parameter.
+  the :option:`sshuttle --method` parameter.
 
 - There is a shortcut for 0.0.0.0/0 for those that value
   their wrists::
 
       sshuttle -r username@sshserver 0/0
 
-- If you would also like your DNS queries to be proxied
-  through the DNS server of the server you are connect to::
+If you would also like your DNS queries to be proxied
+through the DNS server of the server you are connect to::
 
-      sshuttle --dns -r username@sshserver 0/0
+  sshuttle --dns -r username@sshserver 0/0
 
-  The above is probably what you want to use to prevent
-  local network attacks such as Firesheep and friends.
+The above is probably what you want to use to prevent
+local network attacks such as Firesheep and friends.
+See the documentation for the :option:`sshuttle --dns` parameter.
 
 (You may be prompted for one or more passwords; first, the local password to
 become root using sudo, and then the remote ssh password.  Or you might have
@@ -51,45 +60,3 @@ the data back and forth through ssh.
 Fun, right?  A poor man's instant VPN, and you don't even have to have
 admin access on the server.
 
-Additional information for TPROXY
----------------------------------
-TPROXY is the only method that supports full support of IPv6 and UDP.
-
-There are some things you need to consider for TPROXY to work:
-
-- The following commands need to be run first as root. This only needs to be
-  done once after booting up::
-
-      ip route add local default dev lo table 100
-      ip rule add fwmark 1 lookup 100
-      ip -6 route add local default dev lo table 100
-      ip -6 rule add fwmark 1 lookup 100
-
-- The ``--auto-nets`` feature does not detect IPv6 routes automatically. Add IPv6
-  routes manually. e.g. by adding ``'::/0'`` to the end of the command line.
-
-- The client needs to be run as root. e.g.::
-
-      sudo SSH_AUTH_SOCK="$SSH_AUTH_SOCK" $HOME/tree/sshuttle.tproxy/sshuttle  --method=tproxy ...
-
-- You may need to exclude the IP address of the server you are connecting to.
-  Otherwise sshuttle may attempt to intercept the ssh packets, which will not
-  work. Use the ``--exclude`` parameter for this.
-
-- Similarly, UDP return packets (including DNS) could get intercepted and
-  bounced back. This is the case if you have a broad subnet such as
-  ``0.0.0.0/0`` or ``::/0`` that includes the IP address of the client. Use the
-  ``--exclude`` parameter for this.
-
-- You need the ``--method=tproxy`` parameter, as above.
-
-- The routes for the outgoing packets must already exist. For example, if your
-  connection does not have IPv6 support, no IPv6 routes will exist, IPv6
-  packets will not be generated and sshuttle cannot intercept them::
-
-      telnet -6 www.google.com 80
-      Trying 2404:6800:4001:805::1010...
-      telnet: Unable to connect to remote host: Network is unreachable
-
-  Add some dummy routes to external interfaces. Make sure they get removed
-  however after sshuttle exits.

docs/windows.rst

@@ -0,0 +1,19 @@
+Microsoft Windows
+=================
+Currently there is no built in support for running sshuttle directly on
+Microsoft Windows.
+
+What we can really do is to create a Linux VM with Vagrant (or simply
+Virtualbox if you like). In the Vagrant settings, remember to turn on bridged
+NIC. Then, run sshuttle inside the VM like below::
+
+    sshuttle -l 0.0.0.0 -x 10.0.0.0/8 -x 192.168.0.0/16 0/0
+
+10.0.0.0/8 excludes NAT traffic of Vagrant and 192.168.0.0/16 excludes
+traffic to local area network (assuming that we're using 192.168.0.0 subnet).
+
+Assuming the VM has the IP 192.168.1.200 obtained on the bridge NIC (we can
+configure that in Vagrant), we can then ask Windows to route all its traffic
+via the VM by running the following in cmd.exe with admin right::
+
+     route add 0.0.0.0 mask 0.0.0.0 192.168.1.200

run

@@ -1,6 +1,8 @@
 #!/bin/sh
 if python3.5 -V 2>/dev/null; then
-	exec python3 -m "sshuttle" "$@"
+	exec python3.5 -m "sshuttle" "$@"
+elif python2.7 -V 2>/dev/null; then
+	exec python2.7 -m "sshuttle" "$@"
 else
 	exec python -m "sshuttle" "$@"
 fi

setup.cfg

@@ -0,0 +1,2 @@
+[aliases]
+test=pytest

setup.py

@@ -18,7 +18,12 @@
 # along with python-tldap  If not, see <http://www.gnu.org/licenses/>.
 
 from setuptools import setup, find_packages
+import shutil
 
+with open("./docs/conf.orig.py", "r") as src:
+    with open("./docs/conf.py", "w") as dst:
+        dst.write("# FILE COPIED FROM conf.orig.py; DO NOT CHANGE\n")
+        shutil.copyfileobj(src, dst)
 
 def version_scheme(version):
     from setuptools_scm.version import guess_next_dev_version
@@ -31,7 +36,7 @@ setup(
         'write_to': "sshuttle/version.py",
         'version_scheme': version_scheme,
     },
-    setup_requires=['setuptools_scm'],
+    setup_requires=['setuptools_scm', 'pytest-runner'],
     # version=version,
     url='https://github.com/sshuttle/sshuttle',
     author='Brian May',

sshuttle/__init__.py

@@ -0,0 +1,4 @@
+try:
+    from sshuttle.version import version as __version__
+except ImportError:
+    __version__ = "unknown"

sshuttle/assembler.py

@@ -4,19 +4,20 @@ import imp
 
 z = zlib.decompressobj()
 while 1:
-    name = stdin.readline().strip()
+    name = sys.stdin.readline().strip()
     if name:
         name = name.decode("ASCII")
 
-        nbytes = int(stdin.readline())
+        nbytes = int(sys.stdin.readline())
         if verbosity >= 2:
             sys.stderr.write('server: assembling %r (%d bytes)\n'
                              % (name, nbytes))
-        content = z.decompress(stdin.read(nbytes))
+        content = z.decompress(sys.stdin.read(nbytes))
 
         module = imp.new_module(name)
-        parent, _, parent_name = name.rpartition(".")
-        if parent != "":
+        parents = name.rsplit(".", 1)
+        if len(parents) == 2:
+            parent, parent_name = parents
             setattr(sys.modules[parent], parent_name, module)
 
         code = compile(content, name, "exec")
@@ -33,4 +34,4 @@ sshuttle.helpers.verbose = verbosity
 
 import sshuttle.cmdline_options as options
 from sshuttle.server import main
-main(options.latency_control)
+main(options.latency_control, options.auto_hosts)

sshuttle/client.py

@@ -95,16 +95,21 @@ def daemon_cleanup():
 class MultiListener:
 
     def __init__(self, type=socket.SOCK_STREAM, proto=0):
-        self.v6 = socket.socket(socket.AF_INET6, type, proto)
-        self.v4 = socket.socket(socket.AF_INET, type, proto)
+        self.type = type
+        self.proto = proto
+        self.v6 = None
+        self.v4 = None
+        self.bind_called = False
 
     def setsockopt(self, level, optname, value):
+        assert(self.bind_called)
         if self.v6:
             self.v6.setsockopt(level, optname, value)
         if self.v4:
             self.v4.setsockopt(level, optname, value)
 
     def add_handler(self, handlers, callback, method, mux):
+        assert(self.bind_called)
         socks = []
         if self.v6:
             socks.append(self.v6)
@@ -119,6 +124,7 @@ class MultiListener:
         )
 
     def listen(self, backlog):
+        assert(self.bind_called)
         if self.v6:
             self.v6.listen(backlog)
         if self.v4:
@@ -133,16 +139,23 @@ class MultiListener:
                     raise e
 
     def bind(self, address_v6, address_v4):
-        if address_v6 and self.v6:
+        assert(not self.bind_called)
+        self.bind_called = True
+        if address_v6 is not None:
+            self.v6 = socket.socket(socket.AF_INET6, self.type, self.proto)
+            self.v6.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
             self.v6.bind(address_v6)
         else:
             self.v6 = None
-        if address_v4 and self.v4:
+        if address_v4 is not None:
+            self.v4 = socket.socket(socket.AF_INET, self.type, self.proto)
+            self.v4.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
             self.v4.bind(address_v4)
         else:
             self.v4 = None
 
     def print_listening(self, what):
+        assert(self.bind_called)
         if self.v6:
             listenip = self.v6.getsockname()
             debug1('%s listening on %r.\n' % (what, listenip))
@@ -387,7 +400,7 @@ def ondns(listener, method, mux, handlers):
 
 def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
           python, latency_control,
-          dns_listener, seed_hosts, auto_nets, daemon):
+          dns_listener, seed_hosts, auto_hosts, auto_nets, daemon):
 
     debug1('Starting client with Python version %s\n'
            % platform.python_version())
@@ -405,7 +418,8 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
         (serverproc, serversock) = ssh.connect(
             ssh_cmd, remotename, python,
             stderr=ssyslog._p and ssyslog._p.stdin,
-            options=dict(latency_control=latency_control))
+            options=dict(latency_control=latency_control,
+                auto_hosts=auto_hosts))
     except socket.error as e:
         if e.args[0] == errno.EPIPE:
             raise Fatal("failed to establish ssh session (1)")
@@ -501,7 +515,7 @@ def _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
 
 def main(listenip_v6, listenip_v4,
          ssh_cmd, remotename, python, latency_control, dns, nslist,
-         method_name, seed_hosts, auto_nets,
+         method_name, seed_hosts, auto_hosts, auto_nets,
          subnets_include, subnets_exclude, daemon, pidfile):
 
     if daemon:
@@ -534,11 +548,16 @@ def main(listenip_v6, listenip_v4,
         else:
             listenip_v6 = None
 
-    required.ipv6 = len(subnets_v6) > 0 or len(nslist_v6) > 0 \
-        or listenip_v6 is not None
+    required.ipv6 = len(subnets_v6) > 0 or listenip_v6 is not None
+    required.ipv4 = len(subnets_v4) > 0 or listenip_v4 is not None
     required.udp = avail.udp
     required.dns = len(nslist) > 0
 
+    # if IPv6 not supported, ignore IPv6 DNS servers
+    if not required.ipv6:
+        nslist_v6 = []
+        nslist = nslist_v4
+
     fw.method.assert_features(required)
 
     if required.ipv6 and listenip_v6 is None:
@@ -553,6 +572,14 @@ def main(listenip_v6, listenip_v4,
     if listenip_v4 == "auto":
         listenip_v4 = ('127.0.0.1', 0)
 
+    if required.ipv4 and \
+            not any(listenip_v4[0] == sex[1] for sex in subnets_v4):
+        subnets_exclude.append((socket.AF_INET, listenip_v4[0], 32))
+
+    if required.ipv6 and \
+            not any(listenip_v6[0] == sex[1] for sex in subnets_v6):
+        subnets_exclude.append((socket.AF_INET6, listenip_v6[0], 128))
+
     if listenip_v6 and listenip_v6[1] and listenip_v4 and listenip_v4[1]:
         # if both ports given, no need to search for a spare port
         ports = [0, ]
@@ -569,11 +596,9 @@ def main(listenip_v6, listenip_v4,
     for port in ports:
         debug2(' %d' % port)
         tcp_listener = MultiListener()
-        tcp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 
         if required.udp:
             udp_listener = MultiListener(socket.SOCK_DGRAM)
-            udp_listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
         else:
             udp_listener = None
 
@@ -698,7 +723,7 @@ def main(listenip_v6, listenip_v4,
     try:
         return _main(tcp_listener, udp_listener, fw, ssh_cmd, remotename,
                      python, latency_control, dns_listener,
-                     seed_hosts, auto_nets, daemon)
+                     seed_hosts, auto_hosts, auto_nets, daemon)
     finally:
         try:
             if daemon:

sshuttle/cmdline.py

@@ -1,199 +1,46 @@
-import sys
 import re
-import socket
 import sshuttle.helpers as helpers
-import sshuttle.options as options
 import sshuttle.client as client
 import sshuttle.firewall as firewall
 import sshuttle.hostwatch as hostwatch
 import sshuttle.ssyslog as ssyslog
+from sshuttle.options import parser, parse_ipport6, parse_ipport4
 from sshuttle.helpers import family_ip_tuple, log, Fatal
 
 
-# 1.2.3.4/5 or just 1.2.3.4
-def parse_subnet4(s):
-    m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP subnet format' % s)
-    (a, b, c, d, width) = m.groups()
-    (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
-    if width is None:
-        width = 32
-    else:
-        width = int(width)
-    if a > 255 or b > 255 or c > 255 or d > 255:
-        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
-    if width > 32:
-        raise Fatal('*/%d is greater than the maximum of 32' % width)
-    return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)
-
-
-# 1:2::3/64 or just 1:2::3
-def parse_subnet6(s):
-    m = re.match(r'(?:([a-fA-F\d:]+))?(?:/(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP subnet format' % s)
-    (net, width) = m.groups()
-    if width is None:
-        width = 128
-    else:
-        width = int(width)
-    if width > 128:
-        raise Fatal('*/%d is greater than the maximum of 128' % width)
-    return(socket.AF_INET6, net, width)
-
-
-# Subnet file, supporting empty lines and hash-started comment lines
-def parse_subnet_file(s):
-    try:
-        handle = open(s, 'r')
-    except OSError:
-        raise Fatal('Unable to open subnet file: %s' % s)
-
-    raw_config_lines = handle.readlines()
-    config_lines = []
-    for line_no, line in enumerate(raw_config_lines):
-        line = line.strip()
-        if len(line) == 0:
-            continue
-        if line[0] == '#':
-            continue
-        config_lines.append(line)
-
-    return config_lines
-
-
-# list of:
-# 1.2.3.4/5 or just 1.2.3.4
-# 1:2::3/64 or just 1:2::3
-def parse_subnets(subnets_str):
-    subnets = []
-    for s in subnets_str:
-        if ':' in s:
-            subnet = parse_subnet6(s)
-        else:
-            subnet = parse_subnet4(s)
-        subnets.append(subnet)
-    return subnets
-
-
-# 1.2.3.4:567 or just 1.2.3.4 or just 567
-def parse_ipport4(s):
-    s = str(s)
-    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
-    if not m:
-        raise Fatal('%r is not a valid IP:port format' % s)
-    (a, b, c, d, port) = m.groups()
-    (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
-                          int(port or 0))
-    if a > 255 or b > 255 or c > 255 or d > 255:
-        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
-    if port > 65535:
-        raise Fatal('*:%d is greater than the maximum of 65535' % port)
-    if a is None:
-        a = b = c = d = 0
-    return ('%d.%d.%d.%d' % (a, b, c, d), port)
-
-
-# [1:2::3]:456 or [1:2::3] or 456
-def parse_ipport6(s):
-    s = str(s)
-    m = re.match(r'(?:\[([^]]*)])?(?::)?(?:(\d+))?$', s)
-    if not m:
-        raise Fatal('%s is not a valid IP:port format' % s)
-    (ip, port) = m.groups()
-    (ip, port) = (ip or '::', int(port or 0))
-    return (ip, port)
-
-
-def parse_list(list):
-    return re.split(r'[\s,]+', list.strip()) if list else []
-
-
-optspec = """
-sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
-sshuttle --firewall <port> <subnets...>
-sshuttle --hostwatch
---
-l,listen=  transproxy to this ip address and port number
-H,auto-hosts scan for remote hostnames and update local /etc/hosts
-N,auto-nets  automatically determine subnets to route
-dns        capture local DNS requests and forward to the remote DNS server
-ns-hosts=  capture and forward remote DNS requests to the following servers
-method=    auto, nat, tproxy or pf
-python=    path to python interpreter on the remote server
-r,remote=  ssh hostname (and optional username) of remote sshuttle server
-x,exclude= exclude this subnet (can be used more than once)
-X,exclude-from=  exclude the subnets in a file (whitespace separated)
-v,verbose  increase debug message verbosity
-V,version  print the sshuttle version number and exit
-e,ssh-cmd= the command to use to connect to the remote [ssh]
-seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
-no-latency-control  sacrifice latency to improve bandwidth benchmarks
-wrap=      restart counting channel numbers after this number (for testing)
-disable-ipv6 disables ipv6 support
-D,daemon   run in the background as a daemon
-s,subnets= file where the subnets are stored, instead of on the command line
-syslog     send log messages to syslog (default if you use --daemon)
-pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
-server     (internal use only)
-firewall   (internal use only)
-hostwatch  (internal use only)
-"""
-
-
 def main():
-    o = options.Options(optspec)
-    (opt, flags, extra) = o.parse(sys.argv[1:])
+    opt = parser.parse_args()
 
-    if opt.version:
-        from sshuttle.version import version
-        print(version)
-        return 0
     if opt.daemon:
         opt.syslog = 1
     if opt.wrap:
         import sshuttle.ssnet as ssnet
-        ssnet.MAX_CHANNEL = int(opt.wrap)
-    helpers.verbose = opt.verbose or 0
+        ssnet.MAX_CHANNEL = opt.wrap
+    helpers.verbose = opt.verbose
 
     try:
         if opt.firewall:
-            if len(extra) != 0:
-                o.fatal('exactly zero arguments expected')
+            if opt.subnets:
+                parser.error('exactly zero arguments expected')
             return firewall.main(opt.method, opt.syslog)
         elif opt.hostwatch:
-            return hostwatch.hw_main(extra)
+            return hostwatch.hw_main(opt.subnets)
         else:
-            if len(extra) < 1 and not opt.auto_nets and not opt.subnets:
-                o.fatal('at least one subnet, subnet file, or -N expected')
-            includes = extra
-            excludes = ['127.0.0.0/8']
-            for k, v in flags:
-                if k in ('-x', '--exclude'):
-                    excludes.append(v)
-                if k in ('-X', '--exclude-from'):
-                    excludes += open(v).read().split()
+            includes = opt.subnets
+            excludes = opt.exclude
+            if not includes and not opt.auto_nets:
+                parser.error('at least one subnet, subnet file, '
+                             'or -N expected')
             remotename = opt.remote
             if remotename == '' or remotename == '-':
                 remotename = None
-            nslist = [family_ip_tuple(ns) for ns in parse_list(opt.ns_hosts)]
-            if opt.seed_hosts and not opt.auto_hosts:
-                o.fatal('--seed-hosts only works if you also use -H')
+            nslist = [family_ip_tuple(ns) for ns in opt.ns_hosts]
             if opt.seed_hosts:
                 sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
             elif opt.auto_hosts:
                 sh = []
             else:
                 sh = None
-            if opt.subnets:
-                includes = parse_subnet_file(opt.subnets)
-            if not opt.method:
-                method_name = "auto"
-            elif opt.method in ["auto", "nat", "tproxy", "pf"]:
-                method_name = opt.method
-            else:
-                o.fatal("method_name %s not supported" % opt.method)
             if opt.listen:
                 ipport_v6 = None
                 ipport_v4 = None
@@ -218,11 +65,12 @@ def main():
                                       opt.latency_control,
                                       opt.dns,
                                       nslist,
-                                      method_name,
+                                      opt.method,
                                       sh,
+                                      opt.auto_hosts,
                                       opt.auto_nets,
-                                      parse_subnets(includes),
-                                      parse_subnets(excludes),
+                                      includes,
+                                      excludes,
                                       opt.daemon, opt.pidfile)
 
             if return_code == 0:

sshuttle/helpers.py

@@ -5,6 +5,17 @@ import errno
 logprefix = ''
 verbose = 0
 
+if sys.version_info[0] == 3:
+    binary_type = bytes
+
+    def b(s):
+        return s.encode("ASCII")
+else:
+    binary_type = str
+
+    def b(s):
+        return s
+
 
 def log(s):
     global logprefix
@@ -70,7 +81,8 @@ def islocal(ip, family):
     try:
         try:
             sock.bind((ip, 0))
-        except socket.error as e:
+        except socket.error:
+            _, e = sys.exc_info()[:2]
             if e.args[0] == errno.EADDRNOTAVAIL:
                 return False  # not a local IP
             else:

sshuttle/hostwatch.py

@@ -22,7 +22,8 @@ hostnames = {}
 queue = {}
 try:
     null = open('/dev/null', 'wb')
-except IOError as e:
+except IOError:
+    _, e = sys.exc_info()[:2]
     log('warning: %s\n' % e)
     null = os.popen("sh -c 'while read x; do :; done'", 'wb', 4096)
 
@@ -38,7 +39,7 @@ def write_host_cache():
         for name, ip in sorted(hostnames.items()):
             f.write(('%s,%s\n' % (name, ip)).encode("ASCII"))
         f.close()
-        os.chmod(tmpname, 0o600)
+        os.chmod(tmpname, 384)  # 600 in octal, 'rw-------'
         os.rename(tmpname, CACHEFILE)
     finally:
         try:
@@ -50,7 +51,8 @@ def write_host_cache():
 def read_host_cache():
     try:
         f = open(CACHEFILE)
-    except IOError as e:
+    except IOError:
+        _, e = sys.exc_info()[:2]
         if e.errno == errno.ENOENT:
             return
         else:
@@ -68,8 +70,8 @@ def read_host_cache():
 def found_host(hostname, ip):
     hostname = re.sub(r'\..*', '', hostname)
     hostname = re.sub(r'[^-\w]', '_', hostname)
-    if (ip.startswith('127.') or ip.startswith('255.')
-            or hostname == 'localhost'):
+    if (ip.startswith('127.') or ip.startswith('255.') or
+            hostname == 'localhost'):
         return
     oldip = hostnames.get(hostname)
     if oldip != ip:
@@ -124,7 +126,8 @@ def _check_netstat():
         p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
         content = p.stdout.read().decode("ASCII")
         p.wait()
-    except OSError as e:
+    except OSError:
+        _, e = sys.exc_info()[:2]
         log('%r failed: %r\n' % (argv, e))
         return
 
@@ -144,7 +147,8 @@ def _check_smb(hostname):
         p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
         lines = p.stdout.readlines()
         p.wait()
-    except OSError as e:
+    except OSError:
+        _, e = sys.exc_info()[:2]
         log('%r failed: %r\n' % (argv, e))
         _smb_ok = False
         return
@@ -201,7 +205,8 @@ def _check_nmb(hostname, is_workgroup, is_master):
         p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
         lines = p.stdout.readlines()
         rv = p.wait()
-    except OSError as e:
+    except OSError:
+        _, e = sys.exc_info()[:2]
         log('%r failed: %r\n' % (argv, e))
         _nmb_ok = False
         return
@@ -250,7 +255,7 @@ def _stdin_still_ok(timeout):
     return True
 
 
-def hw_main(seed_hosts):
+def hw_main(seed_hosts, auto_hosts):
     if helpers.verbose >= 2:
         helpers.logprefix = 'HH: '
     else:
@@ -259,17 +264,18 @@ def hw_main(seed_hosts):
     debug1('Starting hostwatch with Python version %s\n'
            % platform.python_version())
 
-    read_host_cache()
-
-    _enqueue(_check_etc_hosts)
-    _enqueue(_check_netstat)
-    check_host('localhost')
-    check_host(socket.gethostname())
-    check_workgroup('workgroup')
-    check_workgroup('-')
     for h in seed_hosts:
         check_host(h)
 
+    if auto_hosts:
+        read_host_cache()
+        _enqueue(_check_etc_hosts)
+        _enqueue(_check_netstat)
+        check_host('localhost')
+        check_host(socket.gethostname())
+        check_workgroup('workgroup')
+        check_workgroup('-')
+
     while 1:
         now = time.time()
         for t, last_polled in list(queue.items()):

sshuttle/linux.py

@@ -1,3 +1,4 @@
+import os
 import socket
 import subprocess as ssubprocess
 from sshuttle.helpers import log, debug1, Fatal, family_to_string
@@ -18,7 +19,11 @@ def ipt_chain_exists(family, table, name):
     else:
         raise Exception('Unsupported family "%s"' % family_to_string(family))
     argv = [cmd, '-t', table, '-nL']
-    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
+    env = {
+        'PATH': os.environ['PATH'],
+        'LC_ALL': "C",
+    }
+    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, env=env)
     for line in p.stdout:
         if line.startswith(b'Chain %s ' % name.encode("ASCII")):
             return True
@@ -35,7 +40,11 @@ def ipt(family, table, *args):
     else:
         raise Exception('Unsupported family "%s"' % family_to_string(family))
     debug1('>> %s\n' % ' '.join(argv))
-    rv = ssubprocess.call(argv)
+    env = {
+        'PATH': os.environ['PATH'],
+        'LC_ALL': "C",
+    }
+    rv = ssubprocess.call(argv, env=env)
     if rv:
         raise Fatal('%r returned %d' % (argv, rv))
 

sshuttle/methods/pf.py

@@ -11,54 +11,286 @@ from sshuttle.helpers import debug1, debug2, debug3, Fatal, family_to_string
 from sshuttle.methods import BaseMethod
 
 
-def pfctl(args, stdin=None):
-    argv = ['pfctl'] + list(args.split(" "))
-    debug1('>> %s\n' % ' '.join(argv))
-
-    p = ssubprocess.Popen(argv, stdin=ssubprocess.PIPE,
-                          stdout=ssubprocess.PIPE,
-                          stderr=ssubprocess.PIPE)
-    o = p.communicate(stdin)
-    if p.returncode:
-        raise Fatal('%r returned %d' % (argv, p.returncode))
-
-    return o
-
-_pf_context = {'started_by_sshuttle': False, 'Xtoken': None}
+_pf_context = {'started_by_sshuttle': False, 'Xtoken': []}
 _pf_fd = None
 
 
-class OsDefs(object):
+class Generic(object):
+    MAXPATHLEN = 1024
+    PF_CHANGE_ADD_TAIL = 2
+    PF_CHANGE_GET_TICKET = 6
+    PF_PASS = 0
+    PF_RDR = 8
+    PF_OUT = 2
+    ACTION_OFFSET = 0
+    POOL_TICKET_OFFSET = 8
+    ANCHOR_CALL_OFFSET = 1040
 
-    def __init__(self, platform=None):
-        if platform is None:
-            platform = sys.platform
-        self.platform = platform
+    class pf_addr(Structure):
+        class _pfa(Union):
+             _fields_ = [("v4", c_uint32),     # struct in_addr
+                        ("v6", c_uint32 * 4),  # struct in6_addr
+                        ("addr8", c_uint8 * 16),
+                        ("addr16", c_uint16 * 8),
+                        ("addr32", c_uint32 * 4)]
 
-        # This are some classes and functions used to support pf in yosemite.
-        if platform == 'darwin':
-            class pf_state_xport(Union):
-                _fields_ = [("port", c_uint16),
-                            ("call_id", c_uint16),
-                            ("spi", c_uint32)]
-        else:
-            class pf_state_xport(Union):
-                _fields_ = [("port", c_uint16),
-                            ("call_id", c_uint16)]
+        _fields_ = [("pfa", _pfa)]
+        _anonymous_ = ("pfa",)
 
-        class pf_addr(Structure):
+    def __init__(self):
+        self.status = b''
+        self.pfioc_pooladdr = c_char * 1136
 
-            class _pfa(Union):
-                _fields_ = [("v4",            c_uint32),      # struct in_addr
-                            ("v6",            c_uint32 * 4),  # struct in6_addr
-                            ("addr8",         c_uint8 * 16),
-                            ("addr16",        c_uint16 * 8),
-                            ("addr32",        c_uint32 * 4)]
+        self.DIOCNATLOOK = (
+            (0x40000000 | 0x80000000) |
+            ((sizeof(self.pfioc_natlook) & 0x1fff) << 16) |
+            ((ord('D')) << 8) | (23))
+        self.DIOCCHANGERULE = (
+            (0x40000000 | 0x80000000) |
+            ((sizeof(self.pfioc_rule) & 0x1fff) << 16) |
+            ((ord('D')) << 8) | (26))
+        self.DIOCBEGINADDRS = (
+            (0x40000000 | 0x80000000) |
+            ((sizeof(self.pfioc_pooladdr) & 0x1fff) << 16) |
+            ((ord('D')) << 8) | (51))
 
-            _fields_ = [("pfa",               _pfa)]
-            _anonymous_ = ("pfa",)
+    def enable(self):
+        if b'INFO:\nStatus: Disabled' in self.status:
+            pfctl('-e')
+            _pf_context['started_by_sshuttle'] = True
+
+    def disable(self, anchor):
+        pfctl('-a %s -F all' % anchor)
+        if _pf_context['started_by_sshuttle']:
+            pfctl('-d')
+
+    def query_nat(self, family, proto, src_ip, src_port, dst_ip, dst_port):
+        [proto, family, src_port, dst_port] = [
+            int(v) for v in [proto, family, src_port, dst_port]]
+
+        packed_src_ip = socket.inet_pton(family, src_ip)
+        packed_dst_ip = socket.inet_pton(family, dst_ip)
+
+        assert len(packed_src_ip) == len(packed_dst_ip)
+        length = len(packed_src_ip)
+
+        pnl = self.pfioc_natlook()
+        pnl.proto = proto
+        pnl.direction = self.PF_OUT
+        pnl.af = family
+        memmove(addressof(pnl.saddr), packed_src_ip, length)
+        memmove(addressof(pnl.daddr), packed_dst_ip, length)
+        self._add_natlook_ports(pnl, src_port, dst_port)
+
+        ioctl(pf_get_dev(), self.DIOCNATLOOK,
+              (c_char * sizeof(pnl)).from_address(addressof(pnl)))
+
+        ip = socket.inet_ntop(
+            pnl.af, (c_char * length).from_address(addressof(pnl.rdaddr)).raw)
+        port = socket.ntohs(self._get_natlook_port(pnl.rdxport))
+        return (ip, port)
+
+    def _add_natlook_ports(self, pnl, src_port, dst_port):
+        pnl.sxport = socket.htons(src_port)
+        pnl.dxport = socket.htons(dst_port)
+
+    def _get_natlook_port(self, xport):
+        return xport
+
+    def add_anchors(self, anchor, status=None):
+        if status is None:
+            status = pfctl('-s all')[0]
+        self.status = status
+        if ('\nanchor "%s"' % anchor).encode('ASCII') not in status:
+            self._add_anchor_rule(self.PF_PASS, anchor.encode('ASCII'))
+
+    def _add_anchor_rule(self, type, name, pr=None):
+        if pr is None:
+            pr = self.pfioc_rule()
+
+        memmove(addressof(pr) + self.ANCHOR_CALL_OFFSET, name,
+                min(self.MAXPATHLEN, len(name)))  # anchor_call = name
+        memmove(addressof(pr) + self.RULE_ACTION_OFFSET,
+                struct.pack('I', type), 4)  # rule.action = type
+
+        memmove(addressof(pr) + self.ACTION_OFFSET, struct.pack(
+            'I', self.PF_CHANGE_GET_TICKET), 4)  # action = PF_CHANGE_GET_TICKET
+        ioctl(pf_get_dev(), pf.DIOCCHANGERULE, pr)
+
+        memmove(addressof(pr) + self.ACTION_OFFSET, struct.pack(
+            'I', self.PF_CHANGE_ADD_TAIL), 4)  # action = PF_CHANGE_ADD_TAIL
+        ioctl(pf_get_dev(), pf.DIOCCHANGERULE, pr)
+
+    def _inet_version(self, family):
+        return b'inet' if family == socket.AF_INET else b'inet6'
+
+    def _lo_addr(self, family):
+        return b'127.0.0.1' if family == socket.AF_INET else b'::1'
+
+    def add_rules(self, anchor, rules):
+        assert isinstance(rules, bytes)
+        debug3("rules:\n" + rules.decode("ASCII"))
+        pfctl('-a %s -f /dev/stdin' % anchor, rules)
+
+    def has_skip_loopback(self):
+        return b'skip' in pfctl('-s Interfaces -i lo -v')[0]
+
+
+
+class FreeBsd(Generic):
+    RULE_ACTION_OFFSET = 2968
+
+    def __new__(cls):
+        class pfioc_natlook(Structure):
+            pf_addr = Generic.pf_addr
+            _fields_ = [("saddr", pf_addr),
+                        ("daddr", pf_addr),
+                        ("rsaddr", pf_addr),
+                        ("rdaddr", pf_addr),
+                        ("sxport", c_uint16),
+                        ("dxport", c_uint16),
+                        ("rsxport", c_uint16),
+                        ("rdxport", c_uint16),
+                        ("af", c_uint8),                      # sa_family_t
+                        ("proto", c_uint8),
+                        ("proto_variant", c_uint8),
+                        ("direction", c_uint8)]
+
+        freebsd = Generic.__new__(cls)
+        freebsd.pfioc_rule = c_char * 3040
+        freebsd.pfioc_natlook = pfioc_natlook
+        return freebsd
+
+    def __init__(self):
+        super(FreeBsd, self).__init__()
+
+    def add_anchors(self, anchor):
+        status = pfctl('-s all')[0]
+        if ('\nrdr-anchor "%s"' % anchor).encode('ASCII') not in status:
+            self._add_anchor_rule(self.PF_RDR, anchor.encode('ASCII'))
+        super(FreeBsd, self).add_anchors(anchor, status=status)
+
+    def _add_anchor_rule(self, type, name):
+        pr = self.pfioc_rule()
+        ppa = self.pfioc_pooladdr()
+
+        ioctl(pf_get_dev(), self.DIOCBEGINADDRS, ppa)
+        # pool ticket
+        memmove(addressof(pr) + self.POOL_TICKET_OFFSET, ppa[4:8], 4)
+        super(FreeBsd, self)._add_anchor_rule(type, name, pr=pr)
+
+    def add_rules(self, anchor, includes, port, dnsport, nslist, family):
+        inet_version = self._inet_version(family)
+        lo_addr = self._lo_addr(family)
+
+        tables = [
+            b'table <forward_subnets> {%s}' % b','.join(includes)
+        ]
+        translating_rules = [
+            b'rdr pass on lo0 %s proto tcp to <forward_subnets> '
+            b'-> %s port %r' % (inet_version, lo_addr, port)
+        ]
+        filtering_rules = [
+            b'pass out route-to lo0 %s proto tcp '
+            b'to <forward_subnets> keep state' % inet_version
+        ]
+
+        if len(nslist) > 0:
+            tables.append(
+                b'table <dns_servers> {%s}' %
+                b','.join([ns[1].encode("ASCII") for ns in nslist]))
+            translating_rules.append(
+                b'rdr pass on lo0 %s proto udp to <dns_servers> '
+                b'port 53 -> %s port %r' % (inet_version, lo_addr, dnsport))
+            filtering_rules.append(
+                b'pass out route-to lo0 %s proto udp to '
+                b'<dns_servers> port 53 keep state' % inet_version)
+
+        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
+                + b'\n'
+
+        super(FreeBsd, self).add_rules(anchor, rules)
+
+
+class OpenBsd(Generic):
+    POOL_TICKET_OFFSET = 4
+    RULE_ACTION_OFFSET = 3324
+    ANCHOR_CALL_OFFSET = 1036
+
+    def __init__(self):
+        class pfioc_natlook(Structure):
+            pf_addr = Generic.pf_addr
+            _fields_ = [("saddr", pf_addr),
+                        ("daddr", pf_addr),
+                        ("rsaddr", pf_addr),
+                        ("rdaddr", pf_addr),
+                        ("rdomain", c_uint16),
+                        ("rrdomain", c_uint16),
+                        ("sxport", c_uint16),
+                        ("dxport", c_uint16),
+                        ("rsxport", c_uint16),
+                        ("rdxport", c_uint16),
+                        ("af", c_uint8),                      # sa_family_t
+                        ("proto", c_uint8),
+                        ("proto_variant", c_uint8),
+                        ("direction", c_uint8)]
+
+        self.pfioc_rule = c_char * 3400
+        self.pfioc_natlook = pfioc_natlook
+        super(OpenBsd, self).__init__()
+
+    def add_anchors(self, anchor):
+        # before adding anchors and rules we must override the skip lo
+        # that comes by default in openbsd pf.conf so the rules we will add,
+        # which rely on translating/filtering  packets on lo, can work
+        if self.has_skip_loopback():
+            pfctl('-f /dev/stdin', b'match on lo\n')
+        super(OpenBsd, self).add_anchors(anchor)
+
+    def add_rules(self, anchor, includes, port, dnsport, nslist, family):
+        inet_version = self._inet_version(family)
+        lo_addr = self._lo_addr(family)
+
+        tables = [
+            b'table <forward_subnets> {%s}' % b','.join(includes)
+        ]
+        translating_rules = [
+            b'pass in on lo0 %s proto tcp to <forward_subnets> '
+            b'divert-to %s port %r' % (inet_version, lo_addr, port)
+        ]
+        filtering_rules = [
+            b'pass out %s proto tcp to <forward_subnets> '
+            b'route-to lo0 keep state' % inet_version
+        ]
+
+        if len(nslist) > 0:
+            tables.append(
+                b'table <dns_servers> {%s}' %
+                b','.join([ns[1].encode("ASCII") for ns in nslist]))
+            translating_rules.append(
+                b'pass in on lo0 %s proto udp to <dns_servers> port 53 '
+                b'rdr-to %s port %r' % (inet_version, lo_addr, dnsport))
+            filtering_rules.append(
+                b'pass out %s proto udp to <dns_servers> port 53 '
+                b'route-to lo0 keep state' % inet_version)
+
+        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
+                + b'\n'
+
+        super(OpenBsd, self).add_rules(anchor, rules)
+
+
+class Darwin(FreeBsd):
+    RULE_ACTION_OFFSET = 3068
+
+    def __init__(self):
+        class pf_state_xport(Union):
+            _fields_ = [("port", c_uint16),
+                        ("call_id", c_uint16),
+                        ("spi", c_uint32)]
 
         class pfioc_natlook(Structure):
+            pf_addr = Generic.pf_addr
             _fields_ = [("saddr", pf_addr),
                         ("daddr", pf_addr),
                         ("rsaddr", pf_addr),
@@ -71,39 +303,61 @@ class OsDefs(object):
                         ("proto", c_uint8),
                         ("proto_variant", c_uint8),
                         ("direction", c_uint8)]
+
+        self.pfioc_rule = c_char * 3104
         self.pfioc_natlook = pfioc_natlook
+        super(Darwin, self).__init__()
 
-        # sizeof(struct pfioc_rule)
-        self.pfioc_rule = c_char * \
-            (3104 if platform == 'darwin' else 3040)
+    def enable(self):
+        o = pfctl('-E')
+        _pf_context['Xtoken'].append(re.search(b'Token : (.+)', o[1]).group(1))
 
-        # sizeof(struct pfioc_pooladdr)
-        self.pfioc_pooladdr = c_char * 1136
+    def disable(self, anchor):
+        pfctl('-a %s -F all' % anchor)
+        if _pf_context['Xtoken']:
+            pfctl('-X %s' % _pf_context['Xtoken'].pop().decode("ASCII"))
 
-        self.MAXPATHLEN = 1024
+    def add_anchors(self, anchor):
+        # before adding anchors and rules we must override the skip lo
+        # that in some cases ends up in the chain so the rules we will add,
+        # which rely on translating/filtering  packets on lo, can work
+        if self.has_skip_loopback():
+            pfctl('-f /dev/stdin', b'pass on lo\n')
+        super(Darwin, self).add_anchors(anchor)
 
-        self.DIOCNATLOOK = (
-            (0x40000000 | 0x80000000) |
-            ((sizeof(pfioc_natlook) & 0x1fff) << 16) |
-            ((ord('D')) << 8) | (23))
-        self.DIOCCHANGERULE = (
-            (0x40000000 | 0x80000000) |
-            ((sizeof(self.pfioc_rule) & 0x1fff) << 16) |
-            ((ord('D')) << 8) | (26))
-        self.DIOCBEGINADDRS = (
-            (0x40000000 | 0x80000000) |
-            ((sizeof(self.pfioc_pooladdr) & 0x1fff) << 16) |
-            ((ord('D')) << 8) | (51))
+    def _add_natlook_ports(self, pnl, src_port, dst_port):
+        pnl.sxport.port = socket.htons(src_port)
+        pnl.dxport.port = socket.htons(dst_port)
 
-        self.PF_CHANGE_ADD_TAIL = 2
-        self.PF_CHANGE_GET_TICKET = 6
+    def _get_natlook_port(self, xport):
+        return xport.port
 
-        self.PF_PASS = 0
-        self.PF_RDR = 8
 
-        self.PF_OUT = 2
+if sys.platform == 'darwin':
+    pf = Darwin()
+elif sys.platform.startswith('openbsd'):
+    pf = OpenBsd()
+else:
+    pf = FreeBsd()
 
-osdefs = OsDefs()
+
+def pfctl(args, stdin=None):
+    argv = ['pfctl'] + list(args.split(" "))
+    debug1('>> %s\n' % ' '.join(argv))
+
+    env = {
+        'PATH': os.environ['PATH'],
+        'LC_ALL': "C",
+    }
+    p = ssubprocess.Popen(argv, stdin=ssubprocess.PIPE,
+                          stdout=ssubprocess.PIPE,
+                          stderr=ssubprocess.PIPE,
+                          env=env)
+    o = p.communicate(stdin)
+    if p.returncode:
+        raise Fatal('%r returned %d' % (argv, p.returncode))
+
+    return o
 
 
 def pf_get_dev():
@@ -114,62 +368,17 @@ def pf_get_dev():
     return _pf_fd
 
 
-def pf_query_nat(family, proto, src_ip, src_port, dst_ip, dst_port):
-    [proto, family, src_port, dst_port] = [
-        int(v) for v in [proto, family, src_port, dst_port]]
-
-    packed_src_ip = socket.inet_pton(family, src_ip)
-    packed_dst_ip = socket.inet_pton(family, dst_ip)
-
-    assert len(packed_src_ip) == len(packed_dst_ip)
-    length = len(packed_src_ip)
-
-    pnl = osdefs.pfioc_natlook()
-    pnl.proto = proto
-    pnl.direction = osdefs.PF_OUT
-    pnl.af = family
-    memmove(addressof(pnl.saddr), packed_src_ip, length)
-    memmove(addressof(pnl.daddr), packed_dst_ip, length)
-    pnl.sxport.port = socket.htons(src_port)
-    pnl.dxport.port = socket.htons(dst_port)
-
-    ioctl(pf_get_dev(), osdefs.DIOCNATLOOK,
-          (c_char * sizeof(pnl)).from_address(addressof(pnl)))
-
-    ip = socket.inet_ntop(
-        pnl.af, (c_char * length).from_address(addressof(pnl.rdaddr)).raw)
-    port = socket.ntohs(pnl.rdxport.port)
-    return (ip, port)
-
-
-def pf_add_anchor_rule(type, name):
-    ACTION_OFFSET = 0
-    POOL_TICKET_OFFSET = 8
-    ANCHOR_CALL_OFFSET = 1040
-    RULE_ACTION_OFFSET = 3068 if osdefs.platform == 'darwin' else 2968
-
-    pr = osdefs.pfioc_rule()
-    ppa = osdefs.pfioc_pooladdr()
-
-    ioctl(pf_get_dev(), osdefs.DIOCBEGINADDRS, ppa)
-
-    memmove(addressof(pr) + POOL_TICKET_OFFSET, ppa[4:8], 4)  # pool_ticket
-    memmove(addressof(pr) + ANCHOR_CALL_OFFSET, name,
-            min(osdefs.MAXPATHLEN, len(name)))  # anchor_call = name
-    memmove(addressof(pr) + RULE_ACTION_OFFSET,
-            struct.pack('I', type), 4)  # rule.action = type
-
-    memmove(addressof(pr) + ACTION_OFFSET, struct.pack(
-        'I', osdefs.PF_CHANGE_GET_TICKET), 4)  # action = PF_CHANGE_GET_TICKET
-    ioctl(pf_get_dev(), osdefs.DIOCCHANGERULE, pr)
-
-    memmove(addressof(pr) + ACTION_OFFSET, struct.pack(
-        'I', osdefs.PF_CHANGE_ADD_TAIL), 4)  # action = PF_CHANGE_ADD_TAIL
-    ioctl(pf_get_dev(), osdefs.DIOCCHANGERULE, pr)
+def pf_get_anchor(family, port):
+    return 'sshuttle%s-%d' % ('' if family == socket.AF_INET else '6', port)
 
 
 class Method(BaseMethod):
 
+    def get_supported_features(self):
+        result = super(Method, self).get_supported_features()
+        result.ipv6 = True
+        return result
+
     def get_tcp_dstip(self, sock):
         pfile = self.firewall.pfile
 
@@ -195,7 +404,7 @@ class Method(BaseMethod):
         translating_rules = []
         filtering_rules = []
 
-        if family != socket.AF_INET:
+        if family not in [socket.AF_INET, socket.AF_INET6]:
             raise Exception(
                 'Address family "%s" unsupported by pf method_name'
                 % family_to_string(family))
@@ -214,65 +423,25 @@ class Method(BaseMethod):
                                     snet.encode("ASCII"),
                                     swidth))
 
-            tables.append(
-                b'table <forward_subnets> {%s}' % b','.join(includes))
-            translating_rules.append(
-                b'rdr pass on lo0 proto tcp '
-                b'to <forward_subnets> -> 127.0.0.1 port %r' % port)
-            filtering_rules.append(
-                b'pass out route-to lo0 inet proto tcp '
-                b'to <forward_subnets> keep state')
-
-        if len(nslist) > 0:
-            tables.append(
-                b'table <dns_servers> {%s}' %
-                b','.join([ns[1].encode("ASCII") for ns in nslist]))
-            translating_rules.append(
-                b'rdr pass on lo0 proto udp to '
-                b'<dns_servers> port 53 -> 127.0.0.1 port %r' % dnsport)
-            filtering_rules.append(
-                b'pass out route-to lo0 inet proto udp to '
-                b'<dns_servers> port 53 keep state')
-
-        rules = b'\n'.join(tables + translating_rules + filtering_rules) \
-                + b'\n'
-        assert isinstance(rules, bytes)
-        debug3("rules:\n" + rules.decode("ASCII"))
-
-        pf_status = pfctl('-s all')[0]
-        if b'\nrdr-anchor "sshuttle" all\n' not in pf_status:
-            pf_add_anchor_rule(osdefs.PF_RDR, b"sshuttle")
-        if b'\nanchor "sshuttle" all\n' not in pf_status:
-            pf_add_anchor_rule(osdefs.PF_PASS, b"sshuttle")
-
-        pfctl('-a sshuttle -f /dev/stdin', rules)
-        if osdefs.platform == "darwin":
-            o = pfctl('-E')
-            _pf_context['Xtoken'] = \
-                re.search(b'Token : (.+)', o[1]).group(1)
-        elif b'INFO:\nStatus: Disabled' in pf_status:
-            pfctl('-e')
-            _pf_context['started_by_sshuttle'] = True
+        anchor = pf_get_anchor(family, port)
+        pf.add_anchors(anchor)
+        pf.add_rules(anchor, includes, port, dnsport, nslist, family)
+        pf.enable()
 
     def restore_firewall(self, port, family, udp):
-        if family != socket.AF_INET:
+        if family not in [socket.AF_INET, socket.AF_INET6]:
             raise Exception(
                 'Address family "%s" unsupported by pf method_name'
                 % family_to_string(family))
         if udp:
             raise Exception("UDP not supported by pf method_name")
 
-        pfctl('-a sshuttle -F all')
-        if osdefs.platform == "darwin":
-            if _pf_context['Xtoken'] is not None:
-                pfctl('-X %s' % _pf_context['Xtoken'].decode("ASCII"))
-        elif _pf_context['started_by_sshuttle']:
-            pfctl('-d')
+        pf.disable(pf_get_anchor(family, port))
 
     def firewall_command(self, line):
         if line.startswith('QUERY_PF_NAT '):
             try:
-                dst = pf_query_nat(*(line[13:].split(',')))
+                dst = pf.query_nat(*(line[13:].split(',')))
                 sys.stdout.write('QUERY_PF_NAT_SUCCESS %s,%r\n' % dst)
             except IOError as e:
                 sys.stdout.write('QUERY_PF_NAT_FAILURE %s\n' % e)

sshuttle/options.py

@@ -1,215 +1,306 @@
-"""Command-line options parser.
-With the help of an options spec string, easily parse command-line options.
-"""
-import sys
-import os
-import textwrap
-import getopt
 import re
-import struct
+import socket
+from argparse import ArgumentParser, Action, ArgumentTypeError as Fatal
+from sshuttle import __version__
 
 
-class OptDict:
-
-    def __init__(self):
-        self._opts = {}
-
-    def __setitem__(self, k, v):
-        if k.startswith('no-') or k.startswith('no_'):
-            k = k[3:]
-            v = not v
-        self._opts[k] = v
-
-    def __getitem__(self, k):
-        if k.startswith('no-') or k.startswith('no_'):
-            return not self._opts[k[3:]]
-        return self._opts[k]
-
-    def __getattr__(self, k):
-        return self[k]
+# 1.2.3.4/5 or just 1.2.3.4
+def parse_subnet4(s):
+    m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP subnet format' % s)
+    (a, b, c, d, width) = m.groups()
+    (a, b, c, d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
+    if width is None:
+        width = 32
+    else:
+        width = int(width)
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
+    if width > 32:
+        raise Fatal('*/%d is greater than the maximum of 32' % width)
+    return(socket.AF_INET, '%d.%d.%d.%d' % (a, b, c, d), width)
 
 
-def _default_onabort(msg):
-    sys.exit(97)
+# 1:2::3/64 or just 1:2::3
+def parse_subnet6(s):
+    m = re.match(r'(?:([a-fA-F\d:]+))?(?:/(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP subnet format' % s)
+    (net, width) = m.groups()
+    if width is None:
+        width = 128
+    else:
+        width = int(width)
+    if width > 128:
+        raise Fatal('*/%d is greater than the maximum of 128' % width)
+    return(socket.AF_INET6, net, width)
 
 
-def _intify(v):
+# Subnet file, supporting empty lines and hash-started comment lines
+def parse_subnet_file(s):
     try:
-        vv = int(v or '')
-        if str(vv) == v:
-            return vv
-    except ValueError:
-        pass
-    return v
+        handle = open(s, 'r')
+    except OSError:
+        raise Fatal('Unable to open subnet file: %s' % s)
+
+    raw_config_lines = handle.readlines()
+    subnets = []
+    for line_no, line in enumerate(raw_config_lines):
+        line = line.strip()
+        if len(line) == 0:
+            continue
+        if line[0] == '#':
+            continue
+        subnets.append(parse_subnet(line))
+
+    return subnets
 
 
-def _atoi(v):
-    try:
-        return int(v or 0)
-    except ValueError:
-        return 0
+# 1.2.3.4/5 or just 1.2.3.4
+# 1:2::3/64 or just 1:2::3
+def parse_subnet(subnet_str):
+    if ':' in subnet_str:
+        return parse_subnet6(subnet_str)
+    else:
+        return parse_subnet4(subnet_str)
 
 
-def _remove_negative_kv(k, v):
-    if k.startswith('no-') or k.startswith('no_'):
-        return k[3:], not v
-    return k, v
+# 1.2.3.4:567 or just 1.2.3.4 or just 567
+def parse_ipport4(s):
+    s = str(s)
+    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP:port format' % s)
+    (a, b, c, d, port) = m.groups()
+    (a, b, c, d, port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
+                          int(port or 0))
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a, b, c, d))
+    if port > 65535:
+        raise Fatal('*:%d is greater than the maximum of 65535' % port)
+    if a is None:
+        a = b = c = d = 0
+    return ('%d.%d.%d.%d' % (a, b, c, d), port)
 
 
-def _remove_negative_k(k):
-    return _remove_negative_kv(k, None)[0]
+# [1:2::3]:456 or [1:2::3] or 456
+def parse_ipport6(s):
+    s = str(s)
+    m = re.match(r'(?:\[([^]]*)])?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%s is not a valid IP:port format' % s)
+    (ip, port) = m.groups()
+    (ip, port) = (ip or '::', int(port or 0))
+    return (ip, port)
 
 
-def _tty_width():
-    if not hasattr(sys.stderr, "fileno"):
-        return _atoi(os.environ.get('WIDTH')) or 70
-    s = struct.pack("HHHH", 0, 0, 0, 0)
-    try:
-        import fcntl
-        import termios
-        s = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, s)
-    except (IOError, ImportError):
-        return _atoi(os.environ.get('WIDTH')) or 70
-    (ysize, xsize, ypix, xpix) = struct.unpack('HHHH', s)
-    return xsize or 70
+def parse_list(list):
+    return re.split(r'[\s,]+', list.strip()) if list else []
 
 
-class Options:
+class Concat(Action):
+    def __init__(self, option_strings, dest, nargs=None, **kwargs):
+        if nargs is not None:
+            raise ValueError("nargs not supported")
+        super(Concat, self).__init__(option_strings, dest, **kwargs)
 
-    """Option parser.
-    When constructed, two strings are mandatory. The first one is the command
-    name showed before error messages. The second one is a string called an
-    optspec that specifies the synopsis and option flags and their description.
-    For more information about optspecs, consult the bup-options(1) man page.
+    def __call__(self, parser, namespace, values, option_string=None):
+        curr_value = getattr(namespace, self.dest, [])
+        setattr(namespace, self.dest, curr_value + values)
 
-    Two optional arguments specify an alternative parsing function and an
-    alternative behaviour on abort (after having output the usage string).
 
-    By default, the parser function is getopt.gnu_getopt, and the abort
-    behaviour is to exit the program.
+parser = ArgumentParser(
+    prog="sshuttle",
+    usage="%(prog)s [-l [ip:]port] [-r [user@]sshserver[:port]] <subnets...>"
+)
+parser.add_argument(
+    "subnets",
+    metavar="IP/MASK [IP/MASK...]",
+    nargs="*",
+    type=parse_subnet,
+    help="""
+    capture and forward traffic to these subnets (whitespace separated)
     """
-
-    def __init__(self, optspec, optfunc=getopt.gnu_getopt,
-                 onabort=_default_onabort):
-        self.optspec = optspec
-        self._onabort = onabort
-        self.optfunc = optfunc
-        self._aliases = {}
-        self._shortopts = 'h?'
-        self._longopts = ['help']
-        self._hasparms = {}
-        self._defaults = {}
-        self._usagestr = self._gen_usage()
-
-    def _gen_usage(self):
-        out = []
-        lines = self.optspec.strip().split('\n')
-        lines.reverse()
-        first_syn = True
-        while lines:
-            l = lines.pop()
-            if l == '--':
-                break
-            out.append('%s: %s\n' % (first_syn and 'usage' or '   or', l))
-            first_syn = False
-        out.append('\n')
-        last_was_option = False
-        while lines:
-            l = lines.pop()
-            if l.startswith(' '):
-                out.append('%s%s\n' % (last_was_option and '\n' or '',
-                                       l.lstrip()))
-                last_was_option = False
-            elif l:
-                (flags, extra) = l.split(' ', 1)
-                extra = extra.strip()
-                if flags.endswith('='):
-                    flags = flags[:-1]
-                    has_parm = 1
-                else:
-                    has_parm = 0
-                g = re.search(r'\[([^\]]*)\]$', extra)
-                if g:
-                    defval = g.group(1)
-                else:
-                    defval = None
-                flagl = flags.split(',')
-                flagl_nice = []
-                for _f in flagl:
-                    f, dvi = _remove_negative_kv(_f, _intify(defval))
-                    self._aliases[f] = _remove_negative_k(flagl[0])
-                    self._hasparms[f] = has_parm
-                    self._defaults[f] = dvi
-                    if len(f) == 1:
-                        self._shortopts += f + (has_parm and ':' or '')
-                        flagl_nice.append('-' + f)
-                    else:
-                        f_nice = re.sub(r'\W', '_', f)
-                        self._aliases[f_nice] = _remove_negative_k(flagl[0])
-                        self._longopts.append(f + (has_parm and '=' or ''))
-                        self._longopts.append('no-' + f)
-                        flagl_nice.append('--' + _f)
-                flags_nice = ', '.join(flagl_nice)
-                if has_parm:
-                    flags_nice += ' ...'
-                prefix = '    %-20s  ' % flags_nice
-                argtext = '\n'.join(textwrap.wrap(extra, width=_tty_width(),
-                                                  initial_indent=prefix,
-                                                  subsequent_indent=' ' * 28))
-                out.append(argtext + '\n')
-                last_was_option = True
-            else:
-                out.append('\n')
-                last_was_option = False
-        return ''.join(out).rstrip() + '\n'
-
-    def usage(self, msg=""):
-        """Print usage string to stderr and abort."""
-        sys.stderr.write(self._usagestr)
-        e = self._onabort and self._onabort(msg) or None
-        if e:
-            raise e
-
-    def fatal(self, s):
-        """Print an error message to stderr and abort with usage string."""
-        msg = 'error: %s\n' % s
-        sys.stderr.write(msg)
-        return self.usage(msg)
-
-    def parse(self, args):
-        """Parse a list of arguments and return (options, flags, extra).
-
-        In the returned tuple, "options" is an OptDict with known options,
-        "flags" is a list of option flags that were used on the command-line,
-        and "extra" is a list of positional arguments.
-        """
-        try:
-            (flags, extra) = self.optfunc(
-                args, self._shortopts, self._longopts)
-        except getopt.GetoptError as e:
-            self.fatal(e)
-
-        opt = OptDict()
-
-        for k, v in self._defaults.items():
-            k = self._aliases[k]
-            opt[k] = v
-
-        for (k, v) in flags:
-            k = k.lstrip('-')
-            if k in ('h', '?', 'help'):
-                self.usage()
-            if k.startswith('no-'):
-                k = self._aliases[k[3:]]
-                v = 0
-            else:
-                k = self._aliases[k]
-                if not self._hasparms[k]:
-                    assert(v == '')
-                    v = (opt._opts.get(k) or 0) + 1
-                else:
-                    v = _intify(v)
-            opt[k] = v
-        for (f1, f2) in self._aliases.items():
-            opt[f1] = opt._opts.get(f2)
-        return (opt, flags, extra)
+)
+parser.add_argument(
+    "-l", "--listen",
+    metavar="[IP:]PORT",
+    help="""
+    transproxy to this ip address and port number
+    """
+)
+parser.add_argument(
+    "-H", "--auto-hosts",
+    action="store_true",
+    help="""
+    continuously scan for remote hostnames and update local /etc/hosts as they are found
+    """
+)
+parser.add_argument(
+    "-N", "--auto-nets",
+    action="store_true",
+    help="""
+    automatically determine subnets to route
+    """
+)
+parser.add_argument(
+    "--dns",
+    action="store_true",
+    help="""
+    capture local DNS requests and forward to the remote DNS server
+    """
+)
+parser.add_argument(
+    "--ns-hosts",
+    metavar="IP[,IP]",
+    default=[],
+    type=parse_list,
+    help="""
+    capture and forward DNS requests made to the following servers
+    """
+)
+parser.add_argument(
+    "--method",
+    choices=["auto", "nat", "tproxy", "pf"],
+    metavar="TYPE",
+    default="auto",
+    help="""
+    %(choices)s
+    """
+)
+parser.add_argument(
+    "--python",
+    metavar="PATH",
+    help="""
+    path to python interpreter on the remote server
+    """
+)
+parser.add_argument(
+    "-r", "--remote",
+    metavar="[USERNAME@]ADDR[:PORT]",
+    help="""
+    ssh hostname (and optional username) of remote %(prog)s server
+    """
+)
+parser.add_argument(
+    "-x", "--exclude",
+    metavar="IP/MASK",
+    action="append",
+    default=[],
+    type=parse_subnet,
+    help="""
+    exclude this subnet (can be used more than once)
+    """
+)
+parser.add_argument(
+    "-X", "--exclude-from",
+    metavar="PATH",
+    action=Concat,
+    dest="exclude",
+    type=parse_subnet_file,
+    help="""
+    exclude the subnets in a file (whitespace separated)
+    """
+)
+parser.add_argument(
+    "-v", "--verbose",
+    action="count",
+    default=0,
+    help="""
+    increase debug message verbosity
+    """
+)
+parser.add_argument(
+    "-V", "--version",
+    action="version",
+    version=__version__,
+    help="""
+    print the %(prog)s version number and exit
+    """
+)
+parser.add_argument(
+    "-e", "--ssh-cmd",
+    metavar="CMD",
+    default="ssh",
+    help="""
+    the command to use to connect to the remote [%(default)s]
+    """
+)
+parser.add_argument(
+    "--seed-hosts",
+    metavar="HOSTNAME[,HOSTNAME]",
+    default=[],
+    help="""
+    comma-separated list of hostnames for initial scan (may be used with or without --auto-hosts)
+    """
+)
+parser.add_argument(
+    "--no-latency-control",
+    action="store_false",
+    dest="latency_control",
+    help="""
+    sacrifice latency to improve bandwidth benchmarks
+    """
+)
+parser.add_argument(
+    "--wrap",
+    metavar="NUM",
+    type=int,
+    help="""
+    restart counting channel numbers after this number (for testing)
+    """
+)
+parser.add_argument(
+    "--disable-ipv6",
+    action="store_true",
+    help="""
+    disable IPv6 support
+    """
+)
+parser.add_argument(
+    "-D", "--daemon",
+    action="store_true",
+    help="""
+    run in the background as a daemon
+    """
+)
+parser.add_argument(
+    "-s", "--subnets",
+    metavar="PATH",
+    action=Concat,
+    dest="subnets",
+    type=parse_subnet_file,
+    help="""
+    file where the subnets are stored, instead of on the command line
+    """
+)
+parser.add_argument(
+    "--syslog",
+    action="store_true",
+    help="""
+    send log messages to syslog (default if you use --daemon)
+    """
+)
+parser.add_argument(
+    "--pidfile",
+    metavar="PATH",
+    default="./sshuttle.pid",
+    help="""
+    pidfile name (only if using --daemon) [%(default)s]
+    """
+)
+parser.add_argument(
+    "--firewall",
+    action="store_true",
+    help="""
+    (internal use only)
+    """
+)
+parser.add_argument(
+    "--hostwatch",
+    action="store_true",
+    help="""
+    (internal use only)
+    """
+)

sshuttle/server.py

@@ -12,32 +12,34 @@ import sshuttle.helpers as helpers
 import sshuttle.hostwatch as hostwatch
 import subprocess as ssubprocess
 from sshuttle.ssnet import Handler, Proxy, Mux, MuxWrapper
-from sshuttle.helpers import log, debug1, debug2, debug3, Fatal, \
+from sshuttle.helpers import b, log, debug1, debug2, debug3, Fatal, \
     resolvconf_random_nameserver
 
 
 def _ipmatch(ipstr):
-    if ipstr == b'default':
-        ipstr = b'0.0.0.0/0'
-    m = re.match(b'^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
+    # FIXME: IPv4 only
+    if ipstr == 'default':
+        ipstr = '0.0.0.0/0'
+    m = re.match('^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
     if m:
         g = m.groups()
         ips = g[0]
         width = int(g[4] or 32)
         if g[1] is None:
-            ips += b'.0.0.0'
+            ips += '.0.0.0'
             width = min(width, 8)
         elif g[2] is None:
-            ips += b'.0.0'
+            ips += '.0.0'
             width = min(width, 16)
         elif g[3] is None:
-            ips += b'.0'
+            ips += '.0'
             width = min(width, 24)
-        ips = ips.decode("ASCII")
+        ips = ips
         return (struct.unpack('!I', socket.inet_aton(ips))[0], width)
 
 
 def _ipstr(ip, width):
+    # FIXME: IPv4 only
     if width >= 32:
         return ip
     else:
@@ -45,6 +47,7 @@ def _ipstr(ip, width):
 
 
 def _maskbits(netmask):
+    # FIXME: IPv4 only
     if not netmask:
         return 32
     for i in range(32):
@@ -60,10 +63,14 @@ def _shl(n, bits):
 def _list_routes():
     # FIXME: IPv4 only
     argv = ['netstat', '-rn']
-    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
+    env = {
+        'PATH': os.environ['PATH'],
+        'LC_ALL': "C",
+    }
+    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, env=env)
     routes = []
     for line in p.stdout:
-        cols = re.split(b'\s+', line)
+        cols = re.split(r'\s+', line.decode("ASCII"))
         ipw = _ipmatch(cols[0])
         if not ipw:
             continue  # some lines won't be parseable; never mind
@@ -91,7 +98,7 @@ def _exc_dump():
     return ''.join(traceback.format_exception(*exc_info))
 
 
-def start_hostwatch(seed_hosts):
+def start_hostwatch(seed_hosts, auto_hosts):
     s1, s2 = socket.socketpair()
     pid = os.fork()
     if not pid:
@@ -103,7 +110,7 @@ def start_hostwatch(seed_hosts):
                 os.dup2(s1.fileno(), 1)
                 os.dup2(s1.fileno(), 0)
                 s1.close()
-                rv = hostwatch.hw_main(seed_hosts) or 0
+                rv = hostwatch.hw_main(seed_hosts, auto_hosts) or 0
             except Exception:
                 log('%s\n' % _exc_dump())
                 rv = 98
@@ -149,7 +156,8 @@ class DnsProxy(Handler):
         try:
             sock.send(self.request)
             self.socks.append(sock)
-        except socket.error as e:
+        except socket.error:
+            _, e = sys.exc_info()[:2]
             if e.args[0] in ssnet.NET_ERRS:
                 # might have been spurious; try again.
                 # Note: these errors sometimes are reported by recv(),
@@ -166,7 +174,8 @@ class DnsProxy(Handler):
 
         try:
             data = sock.recv(4096)
-        except socket.error as e:
+        except socket.error:
+            _, e = sys.exc_info()[:2]
             self.socks.remove(sock)
             del self.peers[sock]
 
@@ -201,22 +210,24 @@ class UdpProxy(Handler):
         debug2('UDP: sending to %r port %d\n' % dstip)
         try:
             self.sock.sendto(data, dstip)
-        except socket.error as e:
+        except socket.error:
+            _, e = sys.exc_info()[:2]
             log('UDP send to %r port %d: %s\n' % (dstip[0], dstip[1], e))
             return
 
     def callback(self, sock):
         try:
             data, peer = sock.recvfrom(4096)
-        except socket.error as e:
+        except socket.error:
+            _, e = sys.exc_info()[:2]
             log('UDP recv from %r port %d: %s\n' % (peer[0], peer[1], e))
             return
         debug2('UDP response: %d bytes\n' % len(data))
-        hdr = "%s,%r," % (peer[0], peer[1])
+        hdr = b("%s,%r," % (peer[0], peer[1]))
         self.mux.send(self.chan, ssnet.CMD_UDP_DATA, hdr + data)
 
 
-def main(latency_control):
+def main(latency_control, auto_hosts):
     debug1('Starting server with Python version %s\n'
            % platform.python_version())
 
@@ -241,39 +252,46 @@ def main(latency_control):
               socket.fromfd(sys.stdout.fileno(),
                             socket.AF_INET, socket.SOCK_STREAM))
     handlers.append(mux)
-    routepkt = b''
+    routepkt = ''
     for r in routes:
-        routepkt += b'%d,%s,%d\n' % (r[0], r[1].encode("ASCII"), r[2])
-    mux.send(0, ssnet.CMD_ROUTES, routepkt)
+        routepkt += '%d,%s,%d\n' % r
+    mux.send(0, ssnet.CMD_ROUTES, b(routepkt))
 
     hw = Hostwatch()
-    hw.leftover = b''
+    hw.leftover = b('')
 
     def hostwatch_ready(sock):
         assert(hw.pid)
         content = hw.sock.recv(4096)
         if content:
-            lines = (hw.leftover + content).split(b'\n')
+            lines = (hw.leftover + content).split(b('\n'))
             if lines[-1]:
                 # no terminating newline: entry isn't complete yet!
                 hw.leftover = lines.pop()
-                lines.append('')
+                lines.append(b(''))
             else:
-                hw.leftover = b''
-            mux.send(0, ssnet.CMD_HOST_LIST, b'\n'.join(lines))
+                hw.leftover = b('')
+            mux.send(0, ssnet.CMD_HOST_LIST, b('\n').join(lines))
         else:
             raise Fatal('hostwatch process died')
 
     def got_host_req(data):
         if not hw.pid:
-            (hw.pid, hw.sock) = start_hostwatch(data.strip().split())
+            (hw.pid, hw.sock) = start_hostwatch(
+                    data.strip().split(), auto_hosts)
             handlers.append(Handler(socks=[hw.sock],
                                     callback=hostwatch_ready))
     mux.got_host_req = got_host_req
 
     def new_channel(channel, data):
-        (family, dstip, dstport) = data.split(b',', 2)
+        (family, dstip, dstport) = data.decode("ASCII").split(',', 2)
         family = int(family)
+        # AF_INET is the same constant on Linux and BSD but AF_INET6
+        # is different. As the client and server can be running on
+        # different platforms we can not just set the socket family
+        # to what comes in the wire.
+        if family != socket.AF_INET:
+            family = socket.AF_INET6
         dstport = int(dstport)
         outwrap = ssnet.connect_dst(family, dstip, dstport)
         handlers.append(Proxy(MuxWrapper(mux, channel), outwrap))
@@ -293,7 +311,7 @@ def main(latency_control):
     def udp_req(channel, cmd, data):
         debug2('Incoming UDP request channel=%d, cmd=%d\n' % (channel, cmd))
         if cmd == ssnet.CMD_UDP_DATA:
-            (dstip, dstport, data) = data.split(",", 2)
+            (dstip, dstport, data) = data.split(b(','), 2)
             dstport = int(dstport)
             debug2('is incoming UDP data. %r %d.\n' % (dstip, dstport))
             h = udphandlers[channel]

sshuttle/ssh.py

@@ -8,6 +8,13 @@ import subprocess as ssubprocess
 import sshuttle.helpers as helpers
 from sshuttle.helpers import debug2
 
+try:
+    # Python >= 3.5
+    from shlex import quote
+except ImportError:
+    # Python 2.x
+    from pipes import quote
+
 
 def readfile(name):
     tokens = name.split(".")
@@ -89,17 +96,17 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
                 b"\n")
 
     pyscript = r"""
-                import sys;
+                import sys, os;
                 verbosity=%d;
-                stdin=getattr(sys.stdin,"buffer",sys.stdin);
-                exec(compile(stdin.read(%d), "assembler.py", "exec"))
+                sys.stdin = os.fdopen(0, "rb");
+                exec(compile(sys.stdin.read(%d), "assembler.py", "exec"))
                 """ % (helpers.verbose or 0, len(content))
     pyscript = re.sub(r'\s+', ' ', pyscript.strip())
 
     if not rhost:
         # ignore the --python argument when running locally; we already know
         # which python version works.
-        argv = [sys.argv[1], '-c', pyscript]
+        argv = [sys.executable, '-c', pyscript]
     else:
         if ssh_cmd:
             sshl = ssh_cmd.split(' ')
@@ -109,7 +116,8 @@ def connect(ssh_cmd, rhostport, python, stderr, options):
             pycmd = "'%s' -c '%s'" % (python, pyscript)
         else:
             pycmd = ("P=python3.5; $P -V 2>/dev/null || P=python; "
-                     "exec \"$P\" -c '%s'") % pyscript
+                     "exec \"$P\" -c %s") % quote(pyscript)
+            pycmd = ("exec /bin/sh -c %s" % quote(pycmd))
         argv = (sshl +
                 portl +
                 [rhost, '--', pycmd])

sshuttle/ssnet.py

@@ -1,9 +1,10 @@
+import sys
 import struct
 import socket
 import errno
 import select
 import os
-from sshuttle.helpers import log, debug1, debug2, debug3, Fatal
+from sshuttle.helpers import b, binary_type, log, debug1, debug2, debug3, Fatal
 
 MAX_CHANNEL = 65535
 
@@ -53,7 +54,8 @@ cmd_to_name = {
 
 NET_ERRS = [errno.ECONNREFUSED, errno.ETIMEDOUT,
             errno.EHOSTUNREACH, errno.ENETUNREACH,
-            errno.EHOSTDOWN, errno.ENETDOWN]
+            errno.EHOSTDOWN, errno.ENETDOWN,
+            errno.ENETUNREACH]
 
 
 def _add(l, elem):
@@ -75,7 +77,8 @@ def _fds(l):
 def _nb_clean(func, *args):
     try:
         return func(*args)
-    except OSError as e:
+    except OSError:
+        _, e = sys.exc_info()[:2]
         if e.errno not in (errno.EWOULDBLOCK, errno.EAGAIN):
             raise
         else:
@@ -88,7 +91,8 @@ def _try_peername(sock):
         pn = sock.getpeername()
         if pn:
             return '%s:%s' % (pn[0], pn[1])
-    except socket.error as e:
+    except socket.error:
+        _, e = sys.exc_info()[:2]
         if e.args[0] not in (errno.ENOTCONN, errno.ENOTSOCK):
             raise
     return 'unknown'
@@ -144,7 +148,8 @@ class SockWrapper:
             self.rsock.connect(self.connect_to)
             # connected successfully (Linux)
             self.connect_to = None
-        except socket.error as e:
+        except socket.error:
+            _, e = sys.exc_info()[:2]
             debug3('%r: connect result: %s\n' % (self, e))
             if e.args[0] == errno.EINVAL:
                 # this is what happens when you call connect() on a socket
@@ -191,7 +196,8 @@ class SockWrapper:
             self.shut_write = True
             try:
                 self.wsock.shutdown(SHUT_WR)
-            except socket.error as e:
+            except socket.error:
+                _, e = sys.exc_info()[:2]
                 self.seterr('nowrite: %s' % e)
 
     def too_full(self):
@@ -203,7 +209,8 @@ class SockWrapper:
         self.wsock.setblocking(False)
         try:
             return _nb_clean(os.write, self.wsock.fileno(), buf)
-        except OSError as e:
+        except OSError:
+            _, e = sys.exc_info()[:2]
             if e.errno == errno.EPIPE:
                 debug1('%r: uwrite: got EPIPE\n' % self)
                 self.nowrite()
@@ -225,9 +232,10 @@ class SockWrapper:
         self.rsock.setblocking(False)
         try:
             return _nb_clean(os.read, self.rsock.fileno(), 65536)
-        except OSError as e:
+        except OSError:
+            _, e = sys.exc_info()[:2]
             self.seterr('uread: %s' % e)
-            return b''  # unexpected error... we'll call it EOF
+            return b('')  # unexpected error... we'll call it EOF
 
     def fill(self):
         if self.buf:
@@ -235,7 +243,7 @@ class SockWrapper:
         rb = self.uread()
         if rb:
             self.buf.append(rb)
-        if rb == b'':  # empty string means EOF; None means temporarily empty
+        if rb == b(''):  # empty string means EOF; None means temporarily empty
             self.noread()
 
     def copy_to(self, outwrap):
@@ -333,11 +341,11 @@ class Mux(Handler):
         self.channels = {}
         self.chani = 0
         self.want = 0
-        self.inbuf = b''
+        self.inbuf = b('')
         self.outbuf = []
         self.fullness = 0
         self.too_full = False
-        self.send(0, CMD_PING, b'chicken')
+        self.send(0, CMD_PING, b('chicken'))
 
     def next_channel(self):
         # channel 0 is special, so we never allocate it
@@ -350,14 +358,14 @@ class Mux(Handler):
 
     def amount_queued(self):
         total = 0
-        for b in self.outbuf:
-            total += len(b)
+        for byte in self.outbuf:
+            total += len(byte)
         return total
 
     def check_fullness(self):
         if self.fullness > 32768:
             if not self.too_full:
-                self.send(0, CMD_PING, b'rttest')
+                self.send(0, CMD_PING, b('rttest'))
             self.too_full = True
         # ob = []
         # for b in self.outbuf:
@@ -366,9 +374,10 @@ class Mux(Handler):
         # log('outbuf: %d %r\n' % (self.amount_queued(), ob))
 
     def send(self, channel, cmd, data):
-        assert isinstance(data, bytes)
+        assert isinstance(data, binary_type)
         assert len(data) <= 65535
-        p = struct.pack('!ccHHH', b'S', b'S', channel, cmd, len(data)) + data
+        p = struct.pack('!ccHHH', b('S'), b('S'), channel, cmd, len(data)) \
+            + data
         self.outbuf.append(p)
         debug2(' > channel=%d cmd=%s len=%d (fullness=%d)\n'
                % (channel, cmd_to_name.get(cmd, hex(cmd)),
@@ -434,14 +443,15 @@ class Mux(Handler):
     def fill(self):
         self.rsock.setblocking(False)
         try:
-            b = _nb_clean(os.read, self.rsock.fileno(), 32768)
-        except OSError as e:
+            read = _nb_clean(os.read, self.rsock.fileno(), 32768)
+        except OSError:
+            _, e = sys.exc_info()[:2]
             raise Fatal('other end: %r' % e)
         # log('<<< %r\n' % b)
-        if b == b'':  # EOF
+        if read == b(''):  # EOF
             self.ok = False
-        if b:
-            self.inbuf += b
+        if read:
+            self.inbuf += read
 
     def handle(self):
         self.fill()
@@ -451,8 +461,8 @@ class Mux(Handler):
             if len(self.inbuf) >= (self.want or HDR_LEN):
                 (s1, s2, channel, cmd, datalen) = \
                     struct.unpack('!ccHHH', self.inbuf[:HDR_LEN])
-                assert(s1 == b'S')
-                assert(s2 == b'S')
+                assert(s1 == b('S'))
+                assert(s2 == b('S'))
                 self.want = datalen + HDR_LEN
             if self.want and len(self.inbuf) >= self.want:
                 data = self.inbuf[HDR_LEN:self.want]
@@ -496,14 +506,14 @@ class MuxWrapper(SockWrapper):
         if not self.shut_read:
             debug2('%r: done reading\n' % self)
             self.shut_read = True
-            self.mux.send(self.channel, CMD_TCP_STOP_SENDING, b'')
+            self.mux.send(self.channel, CMD_TCP_STOP_SENDING, b(''))
             self.maybe_close()
 
     def nowrite(self):
         if not self.shut_write:
             debug2('%r: done writing\n' % self)
             self.shut_write = True
-            self.mux.send(self.channel, CMD_TCP_EOF, b'')
+            self.mux.send(self.channel, CMD_TCP_EOF, b(''))
             self.maybe_close()
 
     def maybe_close(self):
@@ -526,7 +536,7 @@ class MuxWrapper(SockWrapper):
 
     def uread(self):
         if self.shut_read:
-            return b''  # EOF
+            return b('')  # EOF
         else:
             return None  # no data available right now
 
@@ -548,7 +558,7 @@ def connect_dst(family, ip, port):
     outsock.setsockopt(socket.SOL_IP, socket.IP_TTL, 42)
     return SockWrapper(outsock, outsock,
                        connect_to=(ip, port),
-                       peername = '%s:%d' % (ip, port))
+                       peername='%s:%d' % (ip, port))
 
 
 def runonce(handlers, mux):

sshuttle/tests/client/test_methods_pf.py

@@ -4,13 +4,13 @@ import socket
 
 from sshuttle.methods import get_method
 from sshuttle.helpers import Fatal
-from sshuttle.methods.pf import OsDefs
+from sshuttle.methods.pf import FreeBsd, Darwin, OpenBsd
 
 
 def test_get_supported_features():
     method = get_method('pf')
     features = method.get_supported_features()
-    assert not features.ipv6
+    assert features.ipv6
     assert not features.udp
     assert features.dns
 
@@ -85,7 +85,7 @@ def test_assert_features():
         method.assert_features(features)
 
 
-@patch('sshuttle.methods.pf.osdefs', OsDefs('darwin'))
+@patch('sshuttle.methods.pf.pf', Darwin())
 @patch('sshuttle.methods.pf.sys.stdout')
 @patch('sshuttle.methods.pf.ioctl')
 @patch('sshuttle.methods.pf.pf_get_dev')
@@ -108,11 +108,11 @@ def test_firewall_command_darwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
     ]
 
 
-@patch('sshuttle.methods.pf.osdefs', OsDefs('notdarwin'))
+@patch('sshuttle.methods.pf.pf', FreeBsd())
 @patch('sshuttle.methods.pf.sys.stdout')
 @patch('sshuttle.methods.pf.ioctl')
 @patch('sshuttle.methods.pf.pf_get_dev')
-def test_firewall_command_notdarwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
+def test_firewall_command_freebsd(mock_pf_get_dev, mock_ioctl, mock_stdout):
     method = get_method('pf')
     assert not method.firewall_command("somthing")
 
@@ -131,7 +131,32 @@ def test_firewall_command_notdarwin(mock_pf_get_dev, mock_ioctl, mock_stdout):
     ]
 
 
+@patch('sshuttle.methods.pf.pf', OpenBsd())
+@patch('sshuttle.methods.pf.sys.stdout')
+@patch('sshuttle.methods.pf.ioctl')
+@patch('sshuttle.methods.pf.pf_get_dev')
+def test_firewall_command_openbsd(mock_pf_get_dev, mock_ioctl, mock_stdout):
+    method = get_method('pf')
+    assert not method.firewall_command("somthing")
+
+    command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % (
+        socket.AF_INET, socket.IPPROTO_TCP,
+        "127.0.0.1", 1025, "127.0.0.2", 1024)
+    assert method.firewall_command(command)
+
+    assert mock_pf_get_dev.mock_calls == [call()]
+    assert mock_ioctl.mock_calls == [
+        call(mock_pf_get_dev(), 0xc0504417, ANY),
+    ]
+    assert mock_stdout.mock_calls == [
+        call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'),
+        call.flush(),
+    ]
+
+
 def pfctl(args, stdin=None):
+    if args == '-s Interfaces -i lo -v':
+        return (b'lo0 (skip)',)
     if args == '-s all':
         return (b'INFO:\nStatus: Disabled\nanother mary had a little lamb\n',
                 b'little lamb\n')
@@ -141,7 +166,7 @@ def pfctl(args, stdin=None):
 
 
 @patch('sshuttle.helpers.verbose', new=3)
-@patch('sshuttle.methods.pf.osdefs', OsDefs('darwin'))
+@patch('sshuttle.methods.pf.pf', Darwin())
 @patch('sshuttle.methods.pf.pfctl')
 @patch('sshuttle.methods.pf.ioctl')
 @patch('sshuttle.methods.pf.pf_get_dev')
@@ -151,19 +176,45 @@ def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
     method = get_method('pf')
     assert method.name == 'pf'
 
-    with pytest.raises(Exception) as excinfo:
-        method.setup_firewall(
-            1024, 1026,
-            [(10, u'2404:6800:4004:80c::33')],
-            10,
-            [(10, 64, False, u'2404:6800:4004:80c::'),
-                (10, 128, True, u'2404:6800:4004:80c::101f')],
-            True)
-    assert str(excinfo.value) \
-        == 'Address family "AF_INET6" unsupported by pf method_name'
-    assert mock_pf_get_dev.mock_calls == []
-    assert mock_ioctl.mock_calls == []
-    assert mock_pfctl.mock_calls == []
+    # IPV6
+
+    method.setup_firewall(
+        1024, 1026,
+        [(10, u'2404:6800:4004:80c::33')],
+        10,
+        [(10, 64, False, u'2404:6800:4004:80c::'),
+            (10, 128, True, u'2404:6800:4004:80c::101f')],
+        False)
+    assert mock_ioctl.mock_calls == [
+        call(mock_pf_get_dev(), 0xC4704433, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+        call(mock_pf_get_dev(), 0xC4704433, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+        call(mock_pf_get_dev(), 0xCC20441A, ANY),
+    ]
+    assert mock_pfctl.mock_calls == [
+        call('-s Interfaces -i lo -v'),
+        call('-f /dev/stdin', b'pass on lo\n'),
+        call('-s all'),
+        call('-a sshuttle6-1024 -f /dev/stdin',
+             b'table <forward_subnets> {'
+             b'!2404:6800:4004:80c::101f/128,2404:6800:4004:80c::/64'
+             b'}\n'
+             b'table <dns_servers> {2404:6800:4004:80c::33}\n'
+             b'rdr pass on lo0 inet6 proto tcp '
+             b'to <forward_subnets> -> ::1 port 1024\n'
+             b'rdr pass on lo0 inet6 proto udp '
+             b'to <dns_servers> port 53 -> ::1 port 1026\n'
+             b'pass out route-to lo0 inet6 proto tcp '
+             b'to <forward_subnets> keep state\n'
+             b'pass out route-to lo0 inet6 proto udp '
+             b'to <dns_servers> port 53 keep state\n'),
+        call('-E'),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_ioctl.reset_mock()
+    mock_pfctl.reset_mock()
 
     with pytest.raises(Exception) as excinfo:
         method.setup_firewall(
@@ -192,13 +243,15 @@ def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
         call(mock_pf_get_dev(), 0xCC20441A, ANY),
     ]
     assert mock_pfctl.mock_calls == [
+        call('-s Interfaces -i lo -v'),
+        call('-f /dev/stdin', b'pass on lo\n'),
         call('-s all'),
-        call('-a sshuttle -f /dev/stdin',
+        call('-a sshuttle-1025 -f /dev/stdin',
              b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
              b'table <dns_servers> {1.2.3.33}\n'
-             b'rdr pass on lo0 proto tcp '
+             b'rdr pass on lo0 inet proto tcp '
              b'to <forward_subnets> -> 127.0.0.1 port 1025\n'
-             b'rdr pass on lo0 proto udp '
+             b'rdr pass on lo0 inet proto udp '
              b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
              b'pass out route-to lo0 inet proto tcp '
              b'to <forward_subnets> keep state\n'
@@ -213,7 +266,7 @@ def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
     method.restore_firewall(1025, 2, False)
     assert mock_ioctl.mock_calls == []
     assert mock_pfctl.mock_calls == [
-        call('-a sshuttle -F all'),
+        call('-a sshuttle-1025 -F all'),
         call("-X abcdefg"),
     ]
     mock_pf_get_dev.reset_mock()
@@ -222,29 +275,44 @@ def test_setup_firewall_darwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
 
 
 @patch('sshuttle.helpers.verbose', new=3)
-@patch('sshuttle.methods.pf.osdefs', OsDefs('notdarwin'))
+@patch('sshuttle.methods.pf.pf', FreeBsd())
 @patch('sshuttle.methods.pf.pfctl')
 @patch('sshuttle.methods.pf.ioctl')
 @patch('sshuttle.methods.pf.pf_get_dev')
-def test_setup_firewall_notdarwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
+def test_setup_firewall_freebsd(mock_pf_get_dev, mock_ioctl, mock_pfctl):
     mock_pfctl.side_effect = pfctl
 
     method = get_method('pf')
     assert method.name == 'pf'
 
-    with pytest.raises(Exception) as excinfo:
-        method.setup_firewall(
-            1024, 1026,
-            [(10, u'2404:6800:4004:80c::33')],
-            10,
-            [(10, 64, False, u'2404:6800:4004:80c::'),
-                (10, 128, True, u'2404:6800:4004:80c::101f')],
-            True)
-    assert str(excinfo.value) \
-        == 'Address family "AF_INET6" unsupported by pf method_name'
-    assert mock_pf_get_dev.mock_calls == []
-    assert mock_ioctl.mock_calls == []
-    assert mock_pfctl.mock_calls == []
+    method.setup_firewall(
+        1024, 1026,
+        [(10, u'2404:6800:4004:80c::33')],
+        10,
+        [(10, 64, False, u'2404:6800:4004:80c::'),
+            (10, 128, True, u'2404:6800:4004:80c::101f')],
+        False)
+
+    assert mock_pfctl.mock_calls == [
+        call('-s all'),
+        call('-a sshuttle6-1024 -f /dev/stdin',
+             b'table <forward_subnets> {'
+             b'!2404:6800:4004:80c::101f/128,2404:6800:4004:80c::/64'
+             b'}\n'
+             b'table <dns_servers> {2404:6800:4004:80c::33}\n'
+             b'rdr pass on lo0 inet6 proto tcp '
+             b'to <forward_subnets> -> ::1 port 1024\n'
+             b'rdr pass on lo0 inet6 proto udp '
+             b'to <dns_servers> port 53 -> ::1 port 1026\n'
+             b'pass out route-to lo0 inet6 proto tcp '
+             b'to <forward_subnets> keep state\n'
+             b'pass out route-to lo0 inet6 proto udp '
+             b'to <dns_servers> port 53 keep state\n'),
+        call('-e'),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_ioctl.reset_mock()
+    mock_pfctl.reset_mock()
 
     with pytest.raises(Exception) as excinfo:
         method.setup_firewall(
@@ -274,12 +342,12 @@ def test_setup_firewall_notdarwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
     ]
     assert mock_pfctl.mock_calls == [
         call('-s all'),
-        call('-a sshuttle -f /dev/stdin',
+        call('-a sshuttle-1025 -f /dev/stdin',
              b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
              b'table <dns_servers> {1.2.3.33}\n'
-             b'rdr pass on lo0 proto tcp '
+             b'rdr pass on lo0 inet proto tcp '
              b'to <forward_subnets> -> 127.0.0.1 port 1025\n'
-             b'rdr pass on lo0 proto udp '
+             b'rdr pass on lo0 inet proto udp '
              b'to <dns_servers> port 53 -> 127.0.0.1 port 1027\n'
              b'pass out route-to lo0 inet proto tcp '
              b'to <forward_subnets> keep state\n'
@@ -294,7 +362,106 @@ def test_setup_firewall_notdarwin(mock_pf_get_dev, mock_ioctl, mock_pfctl):
     method.restore_firewall(1025, 2, False)
     assert mock_ioctl.mock_calls == []
     assert mock_pfctl.mock_calls == [
-        call('-a sshuttle -F all'),
+        call('-a sshuttle-1025 -F all'),
+        call("-d"),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_pfctl.reset_mock()
+    mock_ioctl.reset_mock()
+
+
+@patch('sshuttle.helpers.verbose', new=3)
+@patch('sshuttle.methods.pf.pf', OpenBsd())
+@patch('sshuttle.methods.pf.pfctl')
+@patch('sshuttle.methods.pf.ioctl')
+@patch('sshuttle.methods.pf.pf_get_dev')
+def test_setup_firewall_openbsd(mock_pf_get_dev, mock_ioctl, mock_pfctl):
+    mock_pfctl.side_effect = pfctl
+
+    method = get_method('pf')
+    assert method.name == 'pf'
+
+    method.setup_firewall(
+        1024, 1026,
+        [(10, u'2404:6800:4004:80c::33')],
+        10,
+        [(10, 64, False, u'2404:6800:4004:80c::'),
+            (10, 128, True, u'2404:6800:4004:80c::101f')],
+        False)
+
+    assert mock_ioctl.mock_calls == [
+        call(mock_pf_get_dev(), 0xcd48441a, ANY),
+        call(mock_pf_get_dev(), 0xcd48441a, ANY),
+    ]
+    assert mock_pfctl.mock_calls == [
+        call('-s Interfaces -i lo -v'),
+        call('-f /dev/stdin', b'match on lo\n'),
+        call('-s all'),
+        call('-a sshuttle6-1024 -f /dev/stdin',
+             b'table <forward_subnets> {'
+             b'!2404:6800:4004:80c::101f/128,2404:6800:4004:80c::/64'
+             b'}\n'
+             b'table <dns_servers> {2404:6800:4004:80c::33}\n'
+             b'pass in on lo0 inet6 proto tcp to '
+             b'<forward_subnets> divert-to ::1 port 1024\n'
+             b'pass in on lo0 inet6 proto udp '
+             b'to <dns_servers> port 53 rdr-to ::1 port 1026\n'
+             b'pass out inet6 proto tcp to '
+             b'<forward_subnets> route-to lo0 keep state\n'
+             b'pass out inet6 proto udp to '
+             b'<dns_servers> port 53 route-to lo0 keep state\n'),
+        call('-e'),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_ioctl.reset_mock()
+    mock_pfctl.reset_mock()
+    
+    with pytest.raises(Exception) as excinfo:
+        method.setup_firewall(
+            1025, 1027,
+            [(2, u'1.2.3.33')],
+            2,
+            [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+            True)
+    assert str(excinfo.value) == 'UDP not supported by pf method_name'
+    assert mock_pf_get_dev.mock_calls == []
+    assert mock_ioctl.mock_calls == []
+    assert mock_pfctl.mock_calls == []
+
+    method.setup_firewall(
+        1025, 1027,
+        [(2, u'1.2.3.33')],
+        2,
+        [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')],
+        False)
+    assert mock_ioctl.mock_calls == [
+        call(mock_pf_get_dev(), 0xcd48441a, ANY),
+        call(mock_pf_get_dev(), 0xcd48441a, ANY),
+    ]
+    assert mock_pfctl.mock_calls == [
+        call('-s Interfaces -i lo -v'),
+        call('-f /dev/stdin', b'match on lo\n'),
+        call('-s all'),
+        call('-a sshuttle-1025 -f /dev/stdin',
+             b'table <forward_subnets> {!1.2.3.66/32,1.2.3.0/24}\n'
+             b'table <dns_servers> {1.2.3.33}\n'
+             b'pass in on lo0 inet proto tcp to <forward_subnets> divert-to 127.0.0.1 port 1025\n'
+             b'pass in on lo0 inet proto udp to '
+             b'<dns_servers> port 53 rdr-to 127.0.0.1 port 1027\n'
+             b'pass out inet proto tcp to '
+             b'<forward_subnets> route-to lo0 keep state\n'
+             b'pass out inet proto udp to '
+             b'<dns_servers> port 53 route-to lo0 keep state\n'),
+        call('-e'),
+    ]
+    mock_pf_get_dev.reset_mock()
+    mock_ioctl.reset_mock()
+    mock_pfctl.reset_mock()
+
+    method.restore_firewall(1025, 2, False)
+    assert mock_ioctl.mock_calls == []
+    assert mock_pfctl.mock_calls == [
+        call('-a sshuttle-1025 -F all'),
         call("-d"),
     ]
     mock_pf_get_dev.reset_mock()

sshuttle/tests/server/test_server.py

@@ -0,0 +1,68 @@
+import os
+import io
+import socket
+import sshuttle.server
+from mock import patch, Mock, call
+
+
+def test__ipmatch():
+    assert sshuttle.server._ipmatch("1.2.3.4") is not None
+    assert sshuttle.server._ipmatch("::1") is None   # ipv6 not supported
+    assert sshuttle.server._ipmatch("42 Example Street, Melbourne") is None
+
+
+def test__ipstr():
+    assert sshuttle.server._ipstr("1.2.3.4", 24) == "1.2.3.4/24"
+    assert sshuttle.server._ipstr("1.2.3.4", 32) == "1.2.3.4"
+
+
+def test__maskbits():
+    netmask = sshuttle.server._ipmatch("255.255.255.0")
+    sshuttle.server._maskbits(netmask)
+
+
+@patch('sshuttle.server.ssubprocess.Popen')
+def test__listroutes(mock_popen):
+    mock_pobj = Mock()
+    mock_pobj.stdout = io.BytesIO(b"""
+Kernel IP routing table
+Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
+0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 wlan0
+192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
+""")
+    mock_pobj.wait.return_value = 0
+    mock_popen.return_value = mock_pobj
+
+    routes = sshuttle.server._list_routes()
+
+    env = {
+        'PATH': os.environ['PATH'],
+        'LC_ALL': "C",
+    }
+    assert mock_popen.mock_calls == [
+        call(['netstat', '-rn'], stdout=-1, env=env),
+        call().wait()
+    ]
+    assert routes == [
+        (socket.AF_INET, '0.0.0.0', 0),
+        (socket.AF_INET, '192.168.1.0', 24)
+    ]
+
+
+@patch('sshuttle.server.ssubprocess.Popen')
+def test_listroutes(mock_popen):
+    mock_pobj = Mock()
+    mock_pobj.stdout = io.BytesIO(b"""
+Kernel IP routing table
+Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
+0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 wlan0
+192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
+""")
+    mock_pobj.wait.return_value = 0
+    mock_popen.return_value = mock_pobj
+
+    routes = sshuttle.server.list_routes()
+
+    assert list(routes) == [
+        (socket.AF_INET, '192.168.1.0', 24)
+    ]

tox.ini

@@ -1,12 +1,16 @@
 [tox]
 downloadcache = {toxworkdir}/cache/
 envlist =
+    py26,
     py27,
+    py34,
     py35,
 
 [testenv]
 basepython =
+    py26: python2.6
     py27: python2.7
+    py34: python3.4
     py35: python3.5
 commands =
     py.test