MacOS precompiled app package for sshuttle-0.45

Sshuttle VPN.app/Contents/Info.plist

+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleDisplayName</key>
+	<string>Sshuttle VPN</string>
+	<key>CFBundleExecutable</key>
+	<string>Sshuttle</string>
+	<key>CFBundleIconFile</key>
+	<string>app.icns</string>
+	<key>CFBundleIdentifier</key>
+	<string>ca.apenwarr.Sshuttle</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>Sshuttle VPN</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>0.0.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>0.0.0</string>
+	<key>LSUIElement</key>
+	<string>1</string>
+	<key>LSHasLocalizedDisplayName</key>
+	<false/>
+	<key>NSAppleScriptEnabled</key>
+	<false/>
+	<key>NSHumanReadableCopyright</key>
+	<string>GNU LGPL Version 2</string>
+	<key>NSMainNibFile</key>
+	<string>MainMenu</string>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
+</dict>
+</plist>

Sshuttle VPN.app/Contents/Resources/UserDefaults.plist

+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>startAtLogin</key>
+	<false/>
+	<key>autoReconnect</key>
+	<true/>
+</dict>
+</plist>

Sshuttle VPN.app/Contents/Resources/askpass.py

+import sys, os, re, subprocess
+
+def askpass(prompt):
+    prompt = prompt.replace('"', "'")
+
+    if 'yes/no' in prompt:
+        return "yes"
+
+    script="""
+        tell application "Finder"
+            activate
+            display dialog "%s" \
+              with title "Sshuttle SSH Connection" \
+              default answer "" \
+              with icon caution \
+              with hidden answer
+        end tell
+    """ % prompt
+
+    p = subprocess.Popen(['osascript', '-e', script], stdout=subprocess.PIPE)
+    out = p.stdout.read()
+    rv = p.wait()
+    if rv:
+        return None
+    g = re.match("text returned:(.*), button returned:.*", out)
+    if not g:
+        return None
+    return g.group(1)

Sshuttle VPN.app/Contents/Resources/models.py

+from AppKit import *
+import my
+
+
+configchange_callback = setconnect_callback = None
+
+
+def config_changed():
+    if configchange_callback:
+        configchange_callback()
+
+
+def _validate_ip(v):
+    parts = v.split('.')[:4]
+    if len(parts) < 4:
+        parts += ['0'] * (4 - len(parts))
+    for i in range(4):
+        n = my.atoi(parts[i])
+        if n < 0:
+            n = 0
+        elif n > 255:
+            n = 255
+        parts[i] = str(n)
+    return '.'.join(parts)
+
+
+def _validate_width(v):
+    n = my.atoi(v)
+    if n < 0:
+        n = 0
+    elif n > 32:
+        n = 32
+    return n
+
+
+class SshuttleNet(NSObject):
+    def subnet(self):
+        return getattr(self, '_k_subnet', None)
+    def setSubnet_(self, v):
+        self._k_subnet = v
+        config_changed()
+    @objc.accessor
+    def validateSubnet_error_(self, value, error):
+        #print 'validateSubnet!'
+        return True, _validate_ip(value), error
+
+    def width(self):
+        return getattr(self, '_k_width', 24)
+    def setWidth_(self, v):
+        self._k_width = v
+        config_changed()
+    @objc.accessor
+    def validateWidth_error_(self, value, error):
+        #print 'validateWidth!'
+        return True, _validate_width(value), error
+
+NET_ALL = 0
+NET_AUTO = 1
+NET_MANUAL = 2
+
+class SshuttleServer(NSObject):
+    def init(self):
+        self = super(SshuttleServer, self).init()
+        config_changed()
+        return self
+    
+    def wantConnect(self):
+        return getattr(self, '_k_wantconnect', False)
+    def setWantConnect_(self, v):
+        self._k_wantconnect = v
+        self.setError_(None)
+        config_changed()
+        if setconnect_callback: setconnect_callback(self)
+
+    def connected(self):
+        return getattr(self, '_k_connected', False)
+    def setConnected_(self, v):
+        print 'setConnected of %r to %r' % (self, v)
+        self._k_connected = v
+        if v: self.setError_(None)  # connected ok, so no error
+        config_changed()
+
+    def error(self):
+        return getattr(self, '_k_error', None)
+    def setError_(self, v):
+        self._k_error = v
+        config_changed()
+
+    def isValid(self):
+        if not self.host():
+            return False
+        if self.autoNets() == NET_MANUAL and not len(list(self.nets())):
+            return False
+        return True
+    
+    def host(self):
+        return getattr(self, '_k_host', None)
+    def setHost_(self, v):
+        self._k_host = v
+        config_changed()
+    @objc.accessor
+    def validateHost_error_(self, value, error):
+        #print 'validatehost! %r %r %r' % (self, value, error)
+        while value.startswith('-'):
+            value = value[1:]
+        return True, value, error
+
+    def nets(self):
+        return getattr(self, '_k_nets', [])
+    def setNets_(self, v):
+        self._k_nets = v
+        config_changed()
+    def netsHidden(self):
+        #print 'checking netsHidden'
+        return self.autoNets() != NET_MANUAL
+    def setNetsHidden_(self, v):
+        config_changed()
+        #print 'setting netsHidden to %r' % v
+        
+    def autoNets(self):
+        return getattr(self, '_k_autoNets', NET_AUTO)
+    def setAutoNets_(self, v):
+        self._k_autoNets = v
+        self.setNetsHidden_(-1)
+        config_changed()
+
+    def autoHosts(self):
+        return getattr(self, '_k_autoHosts', True)
+    def setAutoHosts_(self, v):
+        self._k_autoHosts = v
+        config_changed()

Sshuttle VPN.app/Contents/Resources/my.py

+import sys, os
+from AppKit import *
+import PyObjCTools.AppHelper
+
+
+def bundle_path(name, typ):
+    if typ:
+        return NSBundle.mainBundle().pathForResource_ofType_(name, typ)
+    else:
+        return os.path.join(NSBundle.mainBundle().resourcePath(), name)
+
+
+# Load an NSData using a python string
+def Data(s):
+    return NSData.alloc().initWithBytes_length_(s, len(s))
+
+
+# Load a property list from a file in the application bundle.
+def PList(name):
+    path = bundle_path(name, 'plist')
+    return NSDictionary.dictionaryWithContentsOfFile_(path)
+
+
+# Load an NSImage from a file in the application bundle.
+def Image(name, ext):
+    bytes = open(bundle_path(name, ext)).read()
+    img = NSImage.alloc().initWithData_(Data(bytes))
+    return img
+
+
+# Return the NSUserDefaults shared object.
+def Defaults():
+    return NSUserDefaults.standardUserDefaults()
+
+
+# Usage:
+#   f = DelayedCallback(func, args...)
+# later:
+#   f()
+#
+# When you call f(), it will schedule a call to func() next time the
+# ObjC event loop iterates.  Multiple calls to f() in a single iteration
+# will only result in one call to func().
+#
+def DelayedCallback(func, *args, **kwargs):
+    flag = [0]
+    def _go():
+        if flag[0]:
+            print 'running %r (flag=%r)' % (func, flag)
+            flag[0] = 0
+            func(*args, **kwargs)
+    def call():
+        flag[0] += 1
+        PyObjCTools.AppHelper.callAfter(_go)
+    return call
+
+
+def atoi(s):
+    try:
+        return int(s)
+    except ValueError:
+        return 0

Sshuttle VPN.app/Contents/Resources/sshuttle/assembler.py

+import sys, zlib
+
+z = zlib.decompressobj()
+mainmod = sys.modules[__name__]
+while 1:
+    name = sys.stdin.readline().strip()
+    if name:
+        nbytes = int(sys.stdin.readline())
+        if verbosity >= 2:
+            sys.stderr.write('server: assembling %r (%d bytes)\n'
+                             % (name, nbytes))
+        content = z.decompress(sys.stdin.read(nbytes))
+        exec compile(content, name, "exec")
+
+        # FIXME: this crushes everything into a single module namespace,
+        # then makes each of the module names point at this one. Gross.
+        assert(name.endswith('.py'))
+        modname = name[:-3]
+        mainmod.__dict__[modname] = mainmod
+    else:
+        break
+
+verbose = verbosity
+sys.stderr.flush()
+sys.stdout.flush()
+main()

Sshuttle VPN.app/Contents/Resources/sshuttle/firewall.py

+import re, errno
+import compat.ssubprocess as ssubprocess
+import helpers, ssyslog
+from helpers import *
+
+
+def ipt_chain_exists(name):
+    argv = ['iptables', '-t', 'nat', '-nL']
+    p = ssubprocess.Popen(argv, stdout = ssubprocess.PIPE)
+    for line in p.stdout:
+        if line.startswith('Chain %s ' % name):
+            return True
+    rv = p.wait()
+    if rv:
+        raise Fatal('%r returned %d' % (argv, rv))
+
+
+def ipt(*args):
+    argv = ['iptables', '-t', 'nat'] + list(args)
+    debug1('>> %s\n' % ' '.join(argv))
+    rv = ssubprocess.call(argv)
+    if rv:
+        raise Fatal('%r returned %d' % (argv, rv))
+
+
+# We name the chain based on the transproxy port number so that it's possible
+# to run multiple copies of sshuttle at the same time.  Of course, the
+# multiple copies shouldn't have overlapping subnets, or only the most-
+# recently-started one will win (because we use "-I OUTPUT 1" instead of
+# "-A OUTPUT").
+def do_iptables(port, subnets):
+    chain = 'sshuttle-%s' % port
+
+    # basic cleanup/setup of chains
+    if ipt_chain_exists(chain):
+        ipt('-D', 'OUTPUT', '-j', chain)
+        ipt('-D', 'PREROUTING', '-j', chain)
+        ipt('-F', chain)
+        ipt('-X', chain)
+
+    if subnets:
+        ipt('-N', chain)
+        ipt('-F', chain)
+        ipt('-I', 'OUTPUT', '1', '-j', chain)
+        ipt('-I', 'PREROUTING', '1', '-j', chain)
+
+        # create new subnet entries.  Note that we're sorting in a very
+        # particular order: we need to go from most-specific (largest swidth)
+        # to least-specific, and at any given level of specificity, we want
+        # excludes to come first.  That's why the columns are in such a non-
+        # intuitive order.
+        for swidth,sexclude,snet in sorted(subnets, reverse=True):
+            if sexclude:
+                ipt('-A', chain, '-j', 'RETURN',
+                    '--dest', '%s/%s' % (snet,swidth),
+                    '-p', 'tcp')
+            else:
+                ipt('-A', chain, '-j', 'REDIRECT',
+                    '--dest', '%s/%s' % (snet,swidth),
+                    '-p', 'tcp',
+                    '--to-ports', str(port),
+                    '-m', 'ttl', '!', '--ttl', '42'  # to prevent infinite loops
+                    )
+
+
+def ipfw_rule_exists(n):
+    argv = ['ipfw', 'list']
+    p = ssubprocess.Popen(argv, stdout = ssubprocess.PIPE)
+    found = False
+    for line in p.stdout:
+        if line.startswith('%05d ' % n):
+            if not ('ipttl 42 setup keep-state' in line
+                    or ('skipto %d' % (n+1)) in line
+                    or 'check-state' in line):
+                log('non-sshuttle ipfw rule: %r\n' % line.strip())
+                raise Fatal('non-sshuttle ipfw rule #%d already exists!' % n)
+            found = True
+    rv = p.wait()
+    if rv:
+        raise Fatal('%r returned %d' % (argv, rv))
+    return found
+
+
+_oldctls = {}
+def _fill_oldctls(prefix):
+    argv = ['sysctl', prefix]
+    p = ssubprocess.Popen(argv, stdout = ssubprocess.PIPE)
+    for line in p.stdout:
+        assert(line[-1] == '\n')
+        (k,v) = line[:-1].split(': ', 1)
+        _oldctls[k] = v
+    rv = p.wait()
+    if rv:
+        raise Fatal('%r returned %d' % (argv, rv))
+    if not line:
+        raise Fatal('%r returned no data' % (argv,))
+
+
+def _sysctl_set(name, val):
+    argv = ['sysctl', '-w', '%s=%s' % (name, val)]
+    debug1('>> %s\n' % ' '.join(argv))
+    rv = ssubprocess.call(argv, stdout = open('/dev/null', 'w'))
+
+
+_changedctls = []
+def sysctl_set(name, val):
+    PREFIX = 'net.inet.ip'
+    assert(name.startswith(PREFIX + '.'))
+    val = str(val)
+    if not _oldctls:
+        _fill_oldctls(PREFIX)
+    if not (name in _oldctls):
+        debug1('>> No such sysctl: %r\n' % name)
+        return
+    oldval = _oldctls[name]
+    if val != oldval:
+        _changedctls.append(name)
+        return _sysctl_set(name, val)
+    
+
+def ipfw(*args):
+    argv = ['ipfw', '-q'] + list(args)
+    debug1('>> %s\n' % ' '.join(argv))
+    rv = ssubprocess.call(argv)
+    if rv:
+        raise Fatal('%r returned %d' % (argv, rv))
+
+
+def do_ipfw(port, subnets):
+    sport = str(port)
+    xsport = str(port+1)
+
+    # cleanup any existing rules
+    if ipfw_rule_exists(port):
+        ipfw('delete', sport)
+
+    while _changedctls:
+        name = _changedctls.pop()
+        oldval = _oldctls[name]
+        _sysctl_set(name, oldval)
+
+    if subnets:
+        sysctl_set('net.inet.ip.fw.enable', 1)
+        sysctl_set('net.inet.ip.scopedroute', 0)
+
+        ipfw('add', sport, 'check-state', 'ip',
+             'from', 'any', 'to', 'any')
+        
+        # create new subnet entries
+        for swidth,sexclude,snet in sorted(subnets, reverse=True):
+            if sexclude:
+                ipfw('add', sport, 'skipto', xsport,
+                     'log', 'tcp',
+                     'from', 'any', 'to', '%s/%s' % (snet,swidth))
+            else:
+                ipfw('add', sport, 'fwd', '127.0.0.1,%d' % port,
+                     'log', 'tcp',
+                     'from', 'any', 'to', '%s/%s' % (snet,swidth),
+                     'not', 'ipttl', '42', 'keep-state', 'setup')
+
+
+def program_exists(name):
+    paths = (os.getenv('PATH') or os.defpath).split(os.pathsep)
+    for p in paths:
+        fn = '%s/%s' % (p, name)
+        if os.path.exists(fn):
+            return not os.path.isdir(fn) and os.access(fn, os.X_OK)
+
+hostmap = {}
+def rewrite_etc_hosts(port):
+    HOSTSFILE='/etc/hosts'
+    BAKFILE='%s.sbak' % HOSTSFILE
+    APPEND='# sshuttle-firewall-%d AUTOCREATED' % port
+    old_content = ''
+    st = None
+    try:
+        old_content = open(HOSTSFILE).read()
+        st = os.stat(HOSTSFILE)
+    except IOError, e:
+        if e.errno == errno.ENOENT:
+            pass
+        else:
+            raise
+    if old_content.strip() and not os.path.exists(BAKFILE):
+        os.link(HOSTSFILE, BAKFILE)
+    tmpname = "%s.%d.tmp" % (HOSTSFILE, port)
+    f = open(tmpname, 'w')
+    for line in old_content.rstrip().split('\n'):
+        if line.find(APPEND) >= 0:
+            continue
+        f.write('%s\n' % line)
+    for (name,ip) in sorted(hostmap.items()):
+        f.write('%-30s %s\n' % ('%s %s' % (ip,name), APPEND))
+    f.close()
+
+    if st:
+        os.chown(tmpname, st.st_uid, st.st_gid)
+        os.chmod(tmpname, st.st_mode)
+    else:
+        os.chown(tmpname, 0, 0)
+        os.chmod(tmpname, 0644)
+    os.rename(tmpname, HOSTSFILE)
+
+
+def restore_etc_hosts(port):
+    global hostmap
+    hostmap = {}
+    rewrite_etc_hosts(port)
+
+
+# This is some voodoo for setting up the kernel's transparent
+# proxying stuff.  If subnets is empty, we just delete our sshuttle rules;
+# otherwise we delete it, then make them from scratch.
+#
+# This code is supposed to clean up after itself by deleting its rules on
+# exit.  In case that fails, it's not the end of the world; future runs will
+# supercede it in the transproxy list, at least, so the leftover rules
+# are hopefully harmless.
+def main(port, syslog):
+    assert(port > 0)
+    assert(port <= 65535)
+
+    if os.getuid() != 0:
+        raise Fatal('you must be root (or enable su/sudo) to set the firewall')
+
+    if program_exists('ipfw'):
+        do_it = do_ipfw
+    elif program_exists('iptables'):
+        do_it = do_iptables
+    else:
+        raise Fatal("can't find either ipfw or iptables; check your PATH")
+
+    # because of limitations of the 'su' command, the *real* stdin/stdout
+    # are both attached to stdout initially.  Clone stdout into stdin so we
+    # can read from it.
+    os.dup2(1, 0)
+
+    if syslog:
+        ssyslog.start_syslog()
+        ssyslog.stderr_to_syslog()
+
+    debug1('firewall manager ready.\n')
+    sys.stdout.write('READY\n')
+    sys.stdout.flush()
+
+    # ctrl-c shouldn't be passed along to me.  When the main sshuttle dies,
+    # I'll die automatically.
+    os.setsid()
+
+    # we wait until we get some input before creating the rules.  That way,
+    # sshuttle can launch us as early as possible (and get sudo password
+    # authentication as early in the startup process as possible).
+    line = sys.stdin.readline(128)
+    if not line:
+        return  # parent died; nothing to do
+
+    subnets = []
+    if line != 'ROUTES\n':
+        raise Fatal('firewall: expected ROUTES but got %r' % line)
+    while 1:
+        line = sys.stdin.readline(128)
+        if not line:
+            raise Fatal('firewall: expected route but got %r' % line)
+        elif line == 'GO\n':
+            break
+        try:
+            (width,exclude,ip) = line.strip().split(',', 2)
+        except:
+            raise Fatal('firewall: expected route or GO but got %r' % line)
+        subnets.append((int(width), bool(int(exclude)), ip))
+        
+    try:
+        if line:
+            debug1('firewall manager: starting transproxy.\n')
+            do_it(port, subnets)
+            sys.stdout.write('STARTED\n')
+        
+        try:
+            sys.stdout.flush()
+        except IOError:
+            # the parent process died for some reason; he's surely been loud
+            # enough, so no reason to report another error
+            return
+
+        # Now we wait until EOF or any other kind of exception.  We need
+        # to stay running so that we don't need a *second* password
+        # authentication at shutdown time - that cleanup is important!
+        while 1:
+            line = sys.stdin.readline(128)
+            if line.startswith('HOST '):
+                (name,ip) = line[5:].strip().split(',', 1)
+                hostmap[name] = ip
+                rewrite_etc_hosts(port)
+            elif line:
+                raise Fatal('expected EOF, got %r' % line)
+            else:
+                break
+    finally:
+        try:
+            debug1('firewall manager: undoing changes.\n')
+        except:
+            pass
+        do_it(port, [])
+        restore_etc_hosts(port)

Sshuttle VPN.app/Contents/Resources/sshuttle/helpers.py

+import sys, os
+
+logprefix = ''
+verbose = 0
+
+def log(s):
+    try:
+        sys.stdout.flush()
+        sys.stderr.write(logprefix + s)
+        sys.stderr.flush()
+    except IOError:
+        # this could happen if stderr gets forcibly disconnected, eg. because
+        # our tty closes.  That sucks, but it's no reason to abort the program.
+        pass
+
+def debug1(s):
+    if verbose >= 1:
+        log(s)
+
+def debug2(s):
+    if verbose >= 2:
+        log(s)
+
+def debug3(s):
+    if verbose >= 3:
+        log(s)
+
+
+class Fatal(Exception):
+    pass
+
+
+def list_contains_any(l, sub):
+    for i in sub:
+        if i in l:
+            return True
+    return False

Sshuttle VPN.app/Contents/Resources/sshuttle/hostwatch.py

+import time, socket, re, select, errno
+if not globals().get('skip_imports'):
+    import compat.ssubprocess as ssubprocess
+    import helpers
+    from helpers import *
+
+POLL_TIME = 60*15
+NETSTAT_POLL_TIME = 30
+CACHEFILE=os.path.expanduser('~/.sshuttle.hosts')
+
+
+_nmb_ok = True
+_smb_ok = True
+hostnames = {}
+queue = {}
+null = open('/dev/null', 'rb+')
+
+
+def _is_ip(s):
+    return re.match(r'\d+\.\d+\.\d+\.\d+$', s)
+
+
+def write_host_cache():
+    tmpname = '%s.%d.tmp' % (CACHEFILE, os.getpid())
+    try:
+        f = open(tmpname, 'wb')
+        for name,ip in sorted(hostnames.items()):
+            f.write('%s,%s\n' % (name, ip))
+        f.close()
+        os.rename(tmpname, CACHEFILE)
+    finally:
+        try:
+            os.unlink(tmpname)
+        except:
+            pass
+
+
+def read_host_cache():
+    try:
+        f = open(CACHEFILE)
+    except IOError, e:
+        if e.errno == errno.ENOENT:
+            return
+        else:
+            raise
+    for line in f:
+        words = line.strip().split(',')
+        if len(words) == 2:
+            (name,ip) = words
+            name = re.sub(r'[^-\w]', '-', name).strip()
+            ip = re.sub(r'[^0-9.]', '', ip).strip()
+            if name and ip:
+                found_host(name, ip)
+                
+
+def found_host(hostname, ip):
+    hostname = re.sub(r'\..*', '', hostname)
+    hostname = re.sub(r'[^-\w]', '_', hostname)
+    if (ip.startswith('127.') or ip.startswith('255.') 
+        or hostname == 'localhost'):
+        return
+    oldip = hostnames.get(hostname)
+    if oldip != ip:
+        hostnames[hostname] = ip
+        debug1('Found: %s: %s\n' % (hostname, ip))
+        sys.stdout.write('%s,%s\n' % (hostname, ip))
+        write_host_cache()
+
+
+def _check_etc_hosts():
+    debug2(' > hosts\n')
+    for line in open('/etc/hosts'):
+        line = re.sub(r'#.*', '', line)
+        words = line.strip().split()
+        if not words:
+            continue
+        ip = words[0]
+        names = words[1:]
+        if _is_ip(ip):
+            debug3('<    %s %r\n' % (ip, names))
+            for n in names:
+                check_host(n)
+                found_host(n, ip)
+
+
+def _check_revdns(ip):
+    debug2(' > rev: %s\n' % ip)
+    try:
+        r = socket.gethostbyaddr(ip)
+        debug3('<    %s\n' % r[0])
+        check_host(r[0])
+        found_host(r[0], ip)
+    except socket.herror, e:
+        pass
+
+
+def _check_dns(hostname):
+    debug2(' > dns: %s\n' % hostname)
+    try:
+        ip = socket.gethostbyname(hostname)
+        debug3('<    %s\n' % ip)
+        check_host(ip)
+        found_host(hostname, ip)
+    except socket.gaierror, e:
+        pass
+
+
+def _check_netstat():
+    debug2(' > netstat\n')
+    argv = ['netstat', '-n']
+    try:
+        p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
+        content = p.stdout.read()
+        p.wait()
+    except OSError, e:
+        log('%r failed: %r\n' % (argv, e))
+        return
+
+    for ip in re.findall(r'\d+\.\d+\.\d+\.\d+', content):
+        debug3('<    %s\n' % ip)
+        check_host(ip)
+        
+
+def _check_smb(hostname):
+    return
+    global _smb_ok
+    if not _smb_ok:
+        return
+    argv = ['smbclient', '-U', '%', '-L', hostname]
+    debug2(' > smb: %s\n' % hostname)
+    try:
+        p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
+        lines = p.stdout.readlines()
+        p.wait()
+    except OSError, e:
+        log('%r failed: %r\n' % (argv, e))
+        _smb_ok = False
+        return
+
+    lines.reverse()
+
+    # junk at top
+    while lines:
+        line = lines.pop().strip()
+        if re.match(r'Server\s+', line):
+            break
+
+    # server list section:
+    #    Server   Comment
+    #    ------   -------
+    while lines:
+        line = lines.pop().strip()
+        if not line or re.match(r'-+\s+-+', line):
+            continue
+        if re.match(r'Workgroup\s+Master', line):
+            break
+        words = line.split()
+        hostname = words[0].lower()
+        debug3('<    %s\n' % hostname)
+        check_host(hostname)
+
+    # workgroup list section:
+    #   Workgroup  Master
+    #   ---------  ------
+    while lines:
+        line = lines.pop().strip()
+        if re.match(r'-+\s+', line):
+            continue
+        if not line:
+            break
+        words = line.split()
+        (workgroup, hostname) = (words[0].lower(), words[1].lower())
+        debug3('<    group(%s) -> %s\n' % (workgroup, hostname))
+        check_host(hostname)
+        check_workgroup(workgroup)
+
+    if lines:
+        assert(0)
+
+
+def _check_nmb(hostname, is_workgroup, is_master):
+    return
+    global _nmb_ok
+    if not _nmb_ok:
+        return
+    argv = ['nmblookup'] + ['-M']*is_master + ['--', hostname]
+    debug2(' > n%d%d: %s\n' % (is_workgroup, is_master, hostname))
+    try:
+        p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE, stderr=null)
+        lines = p.stdout.readlines()
+        rv = p.wait()
+    except OSError, e:
+        log('%r failed: %r\n' % (argv, e))
+        _nmb_ok = False
+        return
+    if rv:
+        log('%r returned %d\n' % (argv, rv))
+        return
+    for line in lines:
+        m = re.match(r'(\d+\.\d+\.\d+\.\d+) (\w+)<\w\w>\n', line)
+        if m:
+            g = m.groups()
+            (ip, name) = (g[0], g[1].lower())
+            debug3('<    %s -> %s\n' % (name, ip))
+            if is_workgroup:
+                _enqueue(_check_smb, ip)
+            else:
+                found_host(name, ip)
+                check_host(name)
+
+
+def check_host(hostname):
+    if _is_ip(hostname):
+        _enqueue(_check_revdns, hostname)
+    else:
+        _enqueue(_check_dns, hostname)
+    _enqueue(_check_smb, hostname)
+    _enqueue(_check_nmb, hostname, False, False)
+
+
+def check_workgroup(hostname):
+    _enqueue(_check_nmb, hostname, True, False)
+    _enqueue(_check_nmb, hostname, True, True)
+
+
+def _enqueue(op, *args):
+    t = (op,args)
+    if queue.get(t) == None:
+        queue[t] = 0
+
+
+def _stdin_still_ok(timeout):
+    r,w,x = select.select([sys.stdin.fileno()], [], [], timeout)
+    if r:
+        b = os.read(sys.stdin.fileno(), 4096)
+        if not b:
+            return False
+    return True
+
+
+def hw_main(seed_hosts):
+    if helpers.verbose >= 2:
+        helpers.logprefix = 'HH: '
+    else:
+        helpers.logprefix = 'hostwatch: '
+
+    read_host_cache()
+        
+    _enqueue(_check_etc_hosts)
+    _enqueue(_check_netstat)
+    check_host('localhost')
+    check_host(socket.gethostname())
+    check_workgroup('workgroup')
+    check_workgroup('-')
+    for h in seed_hosts:
+        check_host(h)
+
+    while 1:
+        now = time.time()
+        for t,last_polled in queue.items():
+            (op,args) = t
+            if not _stdin_still_ok(0):
+                break
+            maxtime = POLL_TIME
+            if op == _check_netstat:
+                maxtime = NETSTAT_POLL_TIME
+            if now - last_polled > maxtime:
+                queue[t] = time.time()
+                op(*args)
+            try:
+                sys.stdout.flush()
+            except IOError:
+                break
+                
+        # FIXME: use a smarter timeout based on oldest last_polled
+        if not _stdin_still_ok(1):
+            break

Sshuttle VPN.app/Contents/Resources/sshuttle/main.py

+#!/usr/bin/env python
+import sys, os, re
+import helpers, options, client, server, firewall, hostwatch
+import compat.ssubprocess as ssubprocess
+from helpers import *
+
+
+# list of:
+# 1.2.3.4/5 or just 1.2.3.4
+def parse_subnets(subnets_str):
+    subnets = []
+    for s in subnets_str:
+        m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
+        if not m:
+            raise Fatal('%r is not a valid IP subnet format' % s)
+        (a,b,c,d,width) = m.groups()
+        (a,b,c,d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
+        if width == None:
+            width = 32
+        else:
+            width = int(width)
+        if a > 255 or b > 255 or c > 255 or d > 255:
+            raise Fatal('%d.%d.%d.%d has numbers > 255' % (a,b,c,d))
+        if width > 32:
+            raise Fatal('*/%d is greater than the maximum of 32' % width)
+        subnets.append(('%d.%d.%d.%d' % (a,b,c,d), width))
+    return subnets
+
+
+# 1.2.3.4:567 or just 1.2.3.4 or just 567
+def parse_ipport(s):
+    s = str(s)
+    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP:port format' % s)
+    (a,b,c,d,port) = m.groups()
+    (a,b,c,d,port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
+                      int(port or 0))
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a,b,c,d))
+    if port > 65535:
+        raise Fatal('*:%d is greater than the maximum of 65535' % port)
+    if a == None:
+        a = b = c = d = 0
+    return ('%d.%d.%d.%d' % (a,b,c,d), port)
+
+
+optspec = """
+sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
+sshuttle --server
+sshuttle --firewall <port> <subnets...>
+sshuttle --hostwatch
+--
+l,listen=  transproxy to this ip address and port number [127.0.0.1:0]
+H,auto-hosts scan for remote hostnames and update local /etc/hosts
+N,auto-nets  automatically determine subnets to route
+python=    path to python interpreter on the remote server [python]
+r,remote=  ssh hostname (and optional username) of remote sshuttle server
+x,exclude= exclude this subnet (can be used more than once)
+v,verbose  increase debug message verbosity
+e,ssh-cmd= the command to use to connect to the remote [ssh]
+seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
+D,daemon   run in the background as a daemon
+syslog     send log messages to syslog (default if you use --daemon)
+pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
+server     (internal use only)
+firewall   (internal use only)
+hostwatch  (internal use only)
+"""
+o = options.Options('sshuttle', optspec)
+(opt, flags, extra) = o.parse(sys.argv[1:])
+
+if opt.daemon:
+    opt.syslog = 1
+helpers.verbose = opt.verbose
+
+try:
+    if opt.server:
+        if len(extra) != 0:
+            o.fatal('no arguments expected')
+        sys.exit(server.main())
+    elif opt.firewall:
+        if len(extra) != 1:
+            o.fatal('exactly one argument expected')
+        sys.exit(firewall.main(int(extra[0]), opt.syslog))
+    elif opt.hostwatch:
+        sys.exit(hostwatch.hw_main(extra))
+    else:
+        if len(extra) < 1 and not opt.auto_nets:
+            o.fatal('at least one subnet (or -N) expected')
+        includes = extra
+        excludes = ['127.0.0.0/8']
+        for k,v in flags:
+            if k in ('-x','--exclude'):
+                excludes.append(v)
+        remotename = opt.remote
+        if remotename == '' or remotename == '-':
+            remotename = None
+        if opt.seed_hosts and not opt.auto_hosts:
+            o.fatal('--seed-hosts only works if you also use -H')
+        if opt.seed_hosts:
+            sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
+        elif opt.auto_hosts:
+            sh = []
+        else:
+            sh = None
+        sys.exit(client.main(parse_ipport(opt.listen or '0.0.0.0:0'),
+                             opt.ssh_cmd,
+                             remotename,
+                             opt.python,
+                             sh,
+                             opt.auto_nets,
+                             parse_subnets(includes),
+                             parse_subnets(excludes),
+                             opt.syslog, opt.daemon, opt.pidfile))
+except Fatal, e:
+    log('fatal: %s\n' % e)
+    sys.exit(99)
+except KeyboardInterrupt:
+    log('\n')
+    log('Keyboard interrupt: exiting.\n')
+    sys.exit(1)

Sshuttle VPN.app/Contents/Resources/sshuttle/options.py

+"""Command-line options parser.
+With the help of an options spec string, easily parse command-line options.
+"""
+import sys, os, textwrap, getopt, re, struct
+
+class OptDict:
+    def __init__(self):
+        self._opts = {}
+
+    def __setitem__(self, k, v):
+        if k.startswith('no-') or k.startswith('no_'):
+            k = k[3:]
+            v = not v
+        self._opts[k] = v
+
+    def __getitem__(self, k):
+        if k.startswith('no-') or k.startswith('no_'):
+            return not self._opts[k[3:]]
+        return self._opts[k]
+
+    def __getattr__(self, k):
+        return self[k]
+
+
+def _default_onabort(msg):
+    sys.exit(97)
+
+
+def _intify(v):
+    try:
+        vv = int(v or '')
+        if str(vv) == v:
+            return vv
+    except ValueError:
+        pass
+    return v
+
+
+def _atoi(v):
+    try:
+        return int(v or 0)
+    except ValueError:
+        return 0
+
+
+def _remove_negative_kv(k, v):
+    if k.startswith('no-') or k.startswith('no_'):
+        return k[3:], not v
+    return k,v
+
+def _remove_negative_k(k):
+    return _remove_negative_kv(k, None)[0]
+
+
+def _tty_width():
+    s = struct.pack("HHHH", 0, 0, 0, 0)
+    try:
+        import fcntl, termios
+        s = fcntl.ioctl(sys.stderr.fileno(), termios.TIOCGWINSZ, s)
+    except (IOError, ImportError):
+        return _atoi(os.environ.get('WIDTH')) or 70
+    (ysize,xsize,ypix,xpix) = struct.unpack('HHHH', s)
+    return xsize or 70
+
+
+class Options:
+    """Option parser.
+    When constructed, two strings are mandatory. The first one is the command
+    name showed before error messages. The second one is a string called an
+    optspec that specifies the synopsis and option flags and their description.
+    For more information about optspecs, consult the bup-options(1) man page.
+
+    Two optional arguments specify an alternative parsing function and an
+    alternative behaviour on abort (after having output the usage string).
+
+    By default, the parser function is getopt.gnu_getopt, and the abort
+    behaviour is to exit the program.
+    """
+    def __init__(self, exe, optspec, optfunc=getopt.gnu_getopt,
+                 onabort=_default_onabort):
+        self.exe = exe
+        self.optspec = optspec
+        self._onabort = onabort
+        self.optfunc = optfunc
+        self._aliases = {}
+        self._shortopts = 'h?'
+        self._longopts = ['help']
+        self._hasparms = {}
+        self._defaults = {}
+        self._usagestr = self._gen_usage()
+
+    def _gen_usage(self):
+        out = []
+        lines = self.optspec.strip().split('\n')
+        lines.reverse()
+        first_syn = True
+        while lines:
+            l = lines.pop()
+            if l == '--': break
+            out.append('%s: %s\n' % (first_syn and 'usage' or '   or', l))
+            first_syn = False
+        out.append('\n')
+        last_was_option = False
+        while lines:
+            l = lines.pop()
+            if l.startswith(' '):
+                out.append('%s%s\n' % (last_was_option and '\n' or '',
+                                       l.lstrip()))
+                last_was_option = False
+            elif l:
+                (flags, extra) = l.split(' ', 1)
+                extra = extra.strip()
+                if flags.endswith('='):
+                    flags = flags[:-1]
+                    has_parm = 1
+                else:
+                    has_parm = 0
+                g = re.search(r'\[([^\]]*)\]$', extra)
+                if g:
+                    defval = g.group(1)
+                else:
+                    defval = None
+                flagl = flags.split(',')
+                flagl_nice = []
+                for f in flagl:
+                    f,dvi = _remove_negative_kv(f, _intify(defval))
+                    self._aliases[f] = _remove_negative_k(flagl[0])
+                    self._hasparms[f] = has_parm
+                    self._defaults[f] = dvi
+                    if len(f) == 1:
+                        self._shortopts += f + (has_parm and ':' or '')
+                        flagl_nice.append('-' + f)
+                    else:
+                        f_nice = re.sub(r'\W', '_', f)
+                        self._aliases[f_nice] = _remove_negative_k(flagl[0])
+                        self._longopts.append(f + (has_parm and '=' or ''))
+                        self._longopts.append('no-' + f)
+                        flagl_nice.append('--' + f)
+                flags_nice = ', '.join(flagl_nice)
+                if has_parm:
+                    flags_nice += ' ...'
+                prefix = '    %-20s  ' % flags_nice
+                argtext = '\n'.join(textwrap.wrap(extra, width=_tty_width(),
+                                                initial_indent=prefix,
+                                                subsequent_indent=' '*28))
+                out.append(argtext + '\n')
+                last_was_option = True
+            else:
+                out.append('\n')
+                last_was_option = False
+        return ''.join(out).rstrip() + '\n'
+
+    def usage(self, msg=""):
+        """Print usage string to stderr and abort."""
+        sys.stderr.write(self._usagestr)
+        e = self._onabort and self._onabort(msg) or None
+        if e:
+            raise e
+
+    def fatal(self, s):
+        """Print an error message to stderr and abort with usage string."""
+        msg = 'error: %s\n' % s
+        sys.stderr.write(msg)
+        return self.usage(msg)
+
+    def parse(self, args):
+        """Parse a list of arguments and return (options, flags, extra).
+
+        In the returned tuple, "options" is an OptDict with known options,
+        "flags" is a list of option flags that were used on the command-line,
+        and "extra" is a list of positional arguments.
+        """
+        try:
+            (flags,extra) = self.optfunc(args, self._shortopts, self._longopts)
+        except getopt.GetoptError, e:
+            self.fatal(e)
+
+        opt = OptDict()
+
+        for k,v in self._defaults.iteritems():
+            k = self._aliases[k]
+            opt[k] = v
+
+        for (k,v) in flags:
+            k = k.lstrip('-')
+            if k in ('h', '?', 'help'):
+                self.usage()
+            if k.startswith('no-'):
+                k = self._aliases[k[3:]]
+                v = 0
+            else:
+                k = self._aliases[k]
+                if not self._hasparms[k]:
+                    assert(v == '')
+                    v = (opt._opts.get(k) or 0) + 1
+                else:
+                    v = _intify(v)
+            opt[k] = v
+        for (f1,f2) in self._aliases.iteritems():
+            opt[f1] = opt._opts.get(f2)
+        return (opt,flags,extra)

Sshuttle VPN.app/Contents/Resources/sshuttle/server.py

+import re, struct, socket, select, traceback
+if not globals().get('skip_imports'):
+    import ssnet, helpers, hostwatch
+    import compat.ssubprocess as ssubprocess
+    from ssnet import SockWrapper, Handler, Proxy, Mux, MuxWrapper
+    from helpers import *
+
+
+def _ipmatch(ipstr):
+    if ipstr == 'default':
+        ipstr = '0.0.0.0/0'
+    m = re.match(r'^(\d+(\.\d+(\.\d+(\.\d+)?)?)?)(?:/(\d+))?$', ipstr)
+    if m:
+        g = m.groups()
+        ips = g[0]
+        width = int(g[4] or 32)
+        if g[1] == None:
+            ips += '.0.0.0'
+            width = min(width, 8)
+        elif g[2] == None:
+            ips += '.0.0'
+            width = min(width, 16)
+        elif g[3] == None:
+            ips += '.0'
+            width = min(width, 24)
+        return (struct.unpack('!I', socket.inet_aton(ips))[0], width)
+
+
+def _ipstr(ip, width):
+    if width >= 32:
+        return ip
+    else:
+        return "%s/%d" % (ip, width)
+
+
+def _maskbits(netmask):
+    if not netmask:
+        return 32
+    for i in range(32):
+        if netmask[0] & _shl(1, i):
+            return 32-i
+    return 0
+    
+    
+def _shl(n, bits):
+    return n * int(2**bits)
+
+
+def _list_routes():
+    argv = ['netstat', '-rn']
+    p = ssubprocess.Popen(argv, stdout=ssubprocess.PIPE)
+    routes = []
+    for line in p.stdout:
+        cols = re.split(r'\s+', line)
+        ipw = _ipmatch(cols[0])
+        if not ipw:
+            continue  # some lines won't be parseable; never mind
+        maskw = _ipmatch(cols[2])  # linux only
+        mask = _maskbits(maskw)   # returns 32 if maskw is null
+        width = min(ipw[1], mask)
+        ip = ipw[0] & _shl(_shl(1, width) - 1, 32-width)
+        routes.append((socket.inet_ntoa(struct.pack('!I', ip)), width))
+    rv = p.wait()
+    if rv != 0:
+        log('WARNING: %r returned %d\n' % (argv, rv))
+        log('WARNING: That prevents --auto-nets from working.\n')
+    return routes
+
+
+def list_routes():
+    for (ip,width) in _list_routes():
+        if not ip.startswith('0.') and not ip.startswith('127.'):
+            yield (ip,width)
+
+
+def _exc_dump():
+    exc_info = sys.exc_info()
+    return ''.join(traceback.format_exception(*exc_info))
+
+
+def start_hostwatch(seed_hosts):
+    s1,s2 = socket.socketpair()
+    pid = os.fork()
+    if not pid:
+        # child
+        rv = 99
+        try:
+            try:
+                s2.close()
+                os.dup2(s1.fileno(), 1)
+                os.dup2(s1.fileno(), 0)
+                s1.close()
+                rv = hostwatch.hw_main(seed_hosts) or 0
+            except Exception, e:
+                log('%s\n' % _exc_dump())
+                rv = 98
+        finally:
+            os._exit(rv)
+    s1.close()
+    return pid,s2
+
+
+class Hostwatch:
+    def __init__(self):
+        self.pid = 0
+        self.sock = None
+
+
+def main():
+    if helpers.verbose >= 1:
+        helpers.logprefix = ' s: '
+    else:
+        helpers.logprefix = 'server: '
+
+    routes = list(list_routes())
+    debug1('available routes:\n')
+    for r in routes:
+        debug1('  %s/%d\n' % r)
+        
+    # synchronization header
+    sys.stdout.write('SSHUTTLE0001')
+    sys.stdout.flush()
+
+    handlers = []
+    mux = Mux(socket.fromfd(sys.stdin.fileno(),
+                            socket.AF_INET, socket.SOCK_STREAM),
+              socket.fromfd(sys.stdout.fileno(),
+                            socket.AF_INET, socket.SOCK_STREAM))
+    handlers.append(mux)
+    routepkt = ''
+    for r in routes:
+        routepkt += '%s,%d\n' % r
+    mux.send(0, ssnet.CMD_ROUTES, routepkt)
+
+    hw = Hostwatch()
+    hw.leftover = ''
+        
+    def hostwatch_ready():
+        assert(hw.pid)
+        content = hw.sock.recv(4096)
+        if content:
+            lines = (hw.leftover + content).split('\n')
+            if lines[-1]:
+                # no terminating newline: entry isn't complete yet!
+                hw.leftover = lines.pop()
+                lines.append('')
+            else:
+                hw.leftover = ''
+            mux.send(0, ssnet.CMD_HOST_LIST, '\n'.join(lines))
+        else:
+            raise Fatal('hostwatch process died')
+
+    def got_host_req(data):
+        if not hw.pid:
+            (hw.pid,hw.sock) = start_hostwatch(data.strip().split())
+            handlers.append(Handler(socks = [hw.sock],
+                                    callback = hostwatch_ready))
+    mux.got_host_req = got_host_req
+
+    def new_channel(channel, data):
+        (dstip,dstport) = data.split(',', 1)
+        dstport = int(dstport)
+        outwrap = ssnet.connect_dst(dstip,dstport)
+        handlers.append(Proxy(MuxWrapper(mux, channel), outwrap))
+    mux.new_channel = new_channel
+
+    while mux.ok:
+        if hw.pid:
+            assert(hw.pid > 0)
+            (rpid, rv) = os.waitpid(hw.pid, os.WNOHANG)
+            if rpid:
+                raise Fatal('hostwatch exited unexpectedly: code 0x%04x\n' % rv)
+        
+        ssnet.runonce(handlers, mux)
+        mux.check_fullness()
+        mux.callback()

Sshuttle VPN.app/Contents/Resources/sshuttle/ssh.py

+import sys, os, re, socket, zlib
+import compat.ssubprocess as ssubprocess
+import helpers
+from helpers import *
+
+
+def readfile(name):
+    basedir = os.path.dirname(os.path.abspath(sys.argv[0]))
+    path = [basedir] + sys.path
+    for d in path:
+        fullname = os.path.join(d, name)
+        if os.path.exists(fullname):
+            return open(fullname, 'rb').read()
+    raise Exception("can't find file %r in any of %r" % (name, path))
+
+
+def empackage(z, filename):
+    (path,basename) = os.path.split(filename)
+    content = z.compress(readfile(filename))
+    content += z.flush(zlib.Z_SYNC_FLUSH)
+    return '%s\n%d\n%s' % (basename,len(content), content)
+
+
+def connect(ssh_cmd, rhostport, python, stderr):
+    main_exe = sys.argv[0]
+    portl = []
+
+    rhostIsIPv6 = False
+    if (rhostport or '').count(':') > 1:
+        rhostIsIPv6 = True
+        if rhostport.count(']') or rhostport.count('['):
+            result = rhostport.split(']')
+            rhost = result[0].strip('[')
+            if len(result) > 1:
+                result[1] = result[1].strip(':')
+                if result[1] is not '':
+                    portl = ['-p', str(int(result[1]))]
+        else: # can't disambiguate IPv6 colons and a port number. pass the hostname through.
+            rhost = rhostport
+    else: # IPv4
+        l = (rhostport or '').split(':', 1)
+        rhost = l[0]
+        if len(l) > 1:
+            portl = ['-p', str(int(l[1]))]
+
+    if rhost == '-':
+        rhost = None
+
+    ipv6flag = []
+    if rhostIsIPv6:
+        ipv6flag = ['-6']
+
+    z = zlib.compressobj(1)
+    content = readfile('assembler.py')
+    content2 = (empackage(z, 'helpers.py') +
+                empackage(z, 'compat/ssubprocess.py') +
+                empackage(z, 'ssnet.py') +
+                empackage(z, 'hostwatch.py') +
+                empackage(z, 'server.py') +
+                "\n")
+    
+    pyscript = r"""
+                import sys;
+                skip_imports=1;
+                verbosity=%d;
+                exec compile(sys.stdin.read(%d), "assembler.py", "exec")
+                """ % (helpers.verbose or 0, len(content))
+    pyscript = re.sub(r'\s+', ' ', pyscript.strip())
+
+        
+    if not rhost:
+        argv = [python, '-c', pyscript]
+    else:
+        if ssh_cmd:
+            sshl = ssh_cmd.split(' ')
+        else:
+            sshl = ['ssh']
+        argv = (sshl + 
+                portl + 
+                ipv6flag + 
+                [rhost, '--', "'%s' -c '%s'" % (python, pyscript)])
+    (s1,s2) = socket.socketpair()
+    def setup():
+        # runs in the child process
+        s2.close()
+    s1a,s1b = os.dup(s1.fileno()), os.dup(s1.fileno())
+    s1.close()
+    debug2('executing: %r\n' % argv)
+    p = ssubprocess.Popen(argv, stdin=s1a, stdout=s1b, preexec_fn=setup,
+                          close_fds=True, stderr=stderr)
+    os.close(s1a)
+    os.close(s1b)
+    s2.sendall(content)
+    s2.sendall(content2)
+    return p, s2

Sshuttle VPN.app/Contents/Resources/sshuttle/sshuttle

+#!/usr/bin/env python
+import sys, os, re
+import helpers, options, client, server, firewall, hostwatch
+import compat.ssubprocess as ssubprocess
+from helpers import *
+
+
+# list of:
+# 1.2.3.4/5 or just 1.2.3.4
+def parse_subnets(subnets_str):
+    subnets = []
+    for s in subnets_str:
+        m = re.match(r'(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?(?:/(\d+))?$', s)
+        if not m:
+            raise Fatal('%r is not a valid IP subnet format' % s)
+        (a,b,c,d,width) = m.groups()
+        (a,b,c,d) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0))
+        if width == None:
+            width = 32
+        else:
+            width = int(width)
+        if a > 255 or b > 255 or c > 255 or d > 255:
+            raise Fatal('%d.%d.%d.%d has numbers > 255' % (a,b,c,d))
+        if width > 32:
+            raise Fatal('*/%d is greater than the maximum of 32' % width)
+        subnets.append(('%d.%d.%d.%d' % (a,b,c,d), width))
+    return subnets
+
+
+# 1.2.3.4:567 or just 1.2.3.4 or just 567
+def parse_ipport(s):
+    s = str(s)
+    m = re.match(r'(?:(\d+)\.(\d+)\.(\d+)\.(\d+))?(?::)?(?:(\d+))?$', s)
+    if not m:
+        raise Fatal('%r is not a valid IP:port format' % s)
+    (a,b,c,d,port) = m.groups()
+    (a,b,c,d,port) = (int(a or 0), int(b or 0), int(c or 0), int(d or 0),
+                      int(port or 0))
+    if a > 255 or b > 255 or c > 255 or d > 255:
+        raise Fatal('%d.%d.%d.%d has numbers > 255' % (a,b,c,d))
+    if port > 65535:
+        raise Fatal('*:%d is greater than the maximum of 65535' % port)
+    if a == None:
+        a = b = c = d = 0
+    return ('%d.%d.%d.%d' % (a,b,c,d), port)
+
+
+optspec = """
+sshuttle [-l [ip:]port] [-r [username@]sshserver[:port]] <subnets...>
+sshuttle --server
+sshuttle --firewall <port> <subnets...>
+sshuttle --hostwatch
+--
+l,listen=  transproxy to this ip address and port number [127.0.0.1:0]
+H,auto-hosts scan for remote hostnames and update local /etc/hosts
+N,auto-nets  automatically determine subnets to route
+python=    path to python interpreter on the remote server [python]
+r,remote=  ssh hostname (and optional username) of remote sshuttle server
+x,exclude= exclude this subnet (can be used more than once)
+v,verbose  increase debug message verbosity
+e,ssh-cmd= the command to use to connect to the remote [ssh]
+seed-hosts= with -H, use these hostnames for initial scan (comma-separated)
+D,daemon   run in the background as a daemon
+syslog     send log messages to syslog (default if you use --daemon)
+pidfile=   pidfile name (only if using --daemon) [./sshuttle.pid]
+server     (internal use only)
+firewall   (internal use only)
+hostwatch  (internal use only)
+"""
+o = options.Options('sshuttle', optspec)
+(opt, flags, extra) = o.parse(sys.argv[1:])
+
+if opt.daemon:
+    opt.syslog = 1
+helpers.verbose = opt.verbose
+
+try:
+    if opt.server:
+        if len(extra) != 0:
+            o.fatal('no arguments expected')
+        sys.exit(server.main())
+    elif opt.firewall:
+        if len(extra) != 1:
+            o.fatal('exactly one argument expected')
+        sys.exit(firewall.main(int(extra[0]), opt.syslog))
+    elif opt.hostwatch:
+        sys.exit(hostwatch.hw_main(extra))
+    else:
+        if len(extra) < 1 and not opt.auto_nets:
+            o.fatal('at least one subnet (or -N) expected')
+        includes = extra
+        excludes = ['127.0.0.0/8']
+        for k,v in flags:
+            if k in ('-x','--exclude'):
+                excludes.append(v)
+        remotename = opt.remote
+        if remotename == '' or remotename == '-':
+            remotename = None
+        if opt.seed_hosts and not opt.auto_hosts:
+            o.fatal('--seed-hosts only works if you also use -H')
+        if opt.seed_hosts:
+            sh = re.split(r'[\s,]+', (opt.seed_hosts or "").strip())
+        elif opt.auto_hosts:
+            sh = []
+        else:
+            sh = None
+        sys.exit(client.main(parse_ipport(opt.listen or '0.0.0.0:0'),
+                             opt.ssh_cmd,
+                             remotename,
+                             opt.python,
+                             sh,
+                             opt.auto_nets,
+                             parse_subnets(includes),
+                             parse_subnets(excludes),
+                             opt.syslog, opt.daemon, opt.pidfile))
+except Fatal, e:
+    log('fatal: %s\n' % e)
+    sys.exit(99)
+except KeyboardInterrupt:
+    log('\n')
+    log('Keyboard interrupt: exiting.\n')
+    sys.exit(1)

Sshuttle VPN.app/Contents/Resources/sshuttle/ssyslog.py

+import sys, os
+from compat import ssubprocess
+
+
+_p = None
+def start_syslog():
+    global _p
+    _p = ssubprocess.Popen(['logger',
+                            '-p', 'daemon.notice',
+                            '-t', 'sshuttle'], stdin=ssubprocess.PIPE)
+
+
+def stderr_to_syslog():
+    sys.stdout.flush()
+    sys.stderr.flush()
+    os.dup2(_p.stdin.fileno(), 2)

Sshuttle VPN.app/Contents/Resources/stupid.py

+import os
+
+pid = os.fork()
+if pid == 0:
+    # child
+    try:
+        os.setsid()
+        #os.execvp('sudo', ['sudo', 'SSH_ASKPASS=%s' % os.path.abspath('askpass.py'), 'ssh', 'afterlife', 'ls'])
+        os.execvp('ssh', ['ssh', 'afterlife', 'ls'])
+    finally:
+        os._exit(44)
+else:
+    # parent
+    os.wait()