Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
S
sshuttle
Project
Project
Details
Activity
Releases
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
pub
sshuttle
Commits
e6f2395d
Commit
e6f2395d
authored
Nov 15, 2015
by
Brian May
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Fixup PEP8 issues.
parent
d4f10b23
Changes
7
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
7 changed files
with
113 additions
and
93 deletions
+113
-93
__main__.py
sshuttle/__main__.py
+1
-0
client.py
sshuttle/client.py
+5
-2
ssubprocess.py
sshuttle/compat/ssubprocess.py
+33
-42
firewall.py
sshuttle/firewall.py
+55
-31
ssh.py
sshuttle/ssh.py
+1
-0
main.py
sshuttle/ui-macos/main.py
+13
-13
my.py
sshuttle/ui-macos/my.py
+5
-5
No files found.
sshuttle/__main__.py
View file @
e6f2395d
...
...
@@ -105,6 +105,7 @@ def parse_ipport6(s):
(
ip
,
port
)
=
(
ip
or
'::'
,
int
(
port
or
0
))
return
(
ip
,
port
)
def
parse_list
(
list
):
return
re
.
split
(
r'[\s,]+'
,
list
.
strip
())
if
list
else
[]
...
...
sshuttle/client.py
View file @
e6f2395d
...
...
@@ -12,7 +12,7 @@ import ssyslog
import
sys
from
sshuttle.ssnet
import
SockWrapper
,
Handler
,
Proxy
,
Mux
,
MuxWrapper
from
sshuttle.helpers
import
log
,
debug1
,
debug2
,
debug3
,
Fatal
,
islocal
,
\
resolvconf_nameservers
resolvconf_nameservers
recvmsg
=
None
try
:
...
...
@@ -187,11 +187,13 @@ def daemon_cleanup():
pf_command_file
=
None
def
pf_dst
(
sock
):
peer
=
sock
.
getpeername
()
proxy
=
sock
.
getsockname
()
argv
=
(
sock
.
family
,
socket
.
IPPROTO_TCP
,
peer
[
0
],
peer
[
1
],
proxy
[
0
],
proxy
[
1
])
argv
=
(
sock
.
family
,
socket
.
IPPROTO_TCP
,
peer
[
0
],
peer
[
1
],
proxy
[
0
],
proxy
[
1
])
pf_command_file
.
write
(
"QUERY_PF_NAT
%
r,
%
r,
%
s,
%
r,
%
s,
%
r
\n
"
%
argv
)
pf_command_file
.
flush
()
line
=
pf_command_file
.
readline
()
...
...
@@ -202,6 +204,7 @@ def pf_dst(sock):
return
sock
.
getsockname
()
def
original_dst
(
sock
):
try
:
SO_ORIGINAL_DST
=
80
...
...
sshuttle/compat/ssubprocess.py
View file @
e6f2395d
This diff is collapsed.
Click to expand it.
sshuttle/firewall.py
View file @
e6f2395d
...
...
@@ -12,7 +12,7 @@ from sshuttle.helpers import log, debug1, debug3, islocal, Fatal, family_to_stri
resolvconf_nameservers
from
fcntl
import
ioctl
from
ctypes
import
c_char
,
c_uint8
,
c_uint16
,
c_uint32
,
Union
,
Structure
,
\
sizeof
,
addressof
,
memmove
sizeof
,
addressof
,
memmove
# python doesn't have a definition for this
...
...
@@ -465,20 +465,21 @@ def do_ipfw(port, dnsport, family, subnets, udp):
return
do_wait
def
pfctl
(
args
,
stdin
=
None
):
def
pfctl
(
args
,
stdin
=
None
):
argv
=
[
'pfctl'
]
+
list
(
args
.
split
(
" "
))
debug1
(
'>>
%
s
\n
'
%
' '
.
join
(
argv
))
p
=
ssubprocess
.
Popen
(
argv
,
stdin
=
ssubprocess
.
PIPE
,
stdout
=
ssubprocess
.
PIPE
,
stderr
=
ssubprocess
.
PIPE
)
p
=
ssubprocess
.
Popen
(
argv
,
stdin
=
ssubprocess
.
PIPE
,
stdout
=
ssubprocess
.
PIPE
,
stderr
=
ssubprocess
.
PIPE
)
o
=
p
.
communicate
(
stdin
)
if
p
.
returncode
:
raise
Fatal
(
'
%
r returned
%
d'
%
(
argv
,
p
.
returncode
))
return
o
_pf_context
=
{
'started_by_sshuttle'
:
False
,
'Xtoken'
:
''
}
_pf_context
=
{
'started_by_sshuttle'
:
False
,
'Xtoken'
:
''
}
def
do_pf
(
port
,
dnsport
,
nslist
,
family
,
subnets
,
udp
):
global
_pf_started_by_sshuttle
...
...
@@ -487,27 +488,33 @@ def do_pf(port, dnsport, nslist, family, subnets, udp):
filtering_rules
=
[]
if
subnets
:
includes
=
[]
includes
=
[]
# If a given subnet is both included and excluded, list the exclusion
# first; the table will ignore the second, opposite definition
for
f
,
swidth
,
sexclude
,
snet
\
in
sorted
(
subnets
,
key
=
lambda
s
:
(
s
[
1
],
s
[
2
]),
reverse
=
True
):
includes
.
append
(
"
%
s
%
s/
%
s"
%
(
"!"
if
sexclude
else
""
,
snet
,
swidth
))
includes
.
append
(
"
%
s
%
s/
%
s"
%
(
"!"
if
sexclude
else
""
,
snet
,
swidth
))
tables
.
append
(
'table <forward_subnets> {
%
s}'
%
','
.
join
(
includes
))
translating_rules
.
append
(
'rdr pass on lo0 proto tcp to <forward_subnets> -> 127.0.0.1 port
%
r'
%
port
)
filtering_rules
.
append
(
'pass out route-to lo0 inet proto tcp to <forward_subnets> keep state'
)
translating_rules
.
append
(
'rdr pass on lo0 proto tcp to <forward_subnets> -> 127.0.0.1 port
%
r'
%
port
)
filtering_rules
.
append
(
'pass out route-to lo0 inet proto tcp to <forward_subnets> keep state'
)
if
dnsport
:
tables
.
append
(
'table <dns_servers> {
%
s}'
%
','
.
join
([
ns
[
1
]
for
ns
in
nslist
]))
translating_rules
.
append
(
'rdr pass on lo0 proto udp to <dns_servers> port 53 -> 127.0.0.1 port
%
r'
%
dnsport
)
filtering_rules
.
append
(
'pass out route-to lo0 inet proto udp to <dns_servers> port 53 keep state'
)
tables
.
append
(
'table <dns_servers> {
%
s}'
%
','
.
join
(
[
ns
[
1
]
for
ns
in
nslist
]))
translating_rules
.
append
(
'rdr pass on lo0 proto udp to <dns_servers> port 53 -> 127.0.0.1 port
%
r'
%
dnsport
)
filtering_rules
.
append
(
'pass out route-to lo0 inet proto udp to <dns_servers> port 53 keep state'
)
rules
=
'
\n
'
.
join
(
tables
+
translating_rules
+
filtering_rules
)
+
'
\n
'
pf_status
=
pfctl
(
'-s all'
)[
0
]
if
not
'
\n
rdr-anchor "sshuttle" all
\n
'
in
pf_status
:
pf_add_anchor_rule
(
PF_RDR
,
"sshuttle"
)
pf_add_anchor_rule
(
PF_RDR
,
"sshuttle"
)
if
not
'
\n
anchor "sshuttle" all
\n
'
in
pf_status
:
pf_add_anchor_rule
(
PF_PASS
,
"sshuttle"
)
...
...
@@ -515,7 +522,7 @@ def do_pf(port, dnsport, nslist, family, subnets, udp):
if
sys
.
platform
==
"darwin"
:
o
=
pfctl
(
'-E'
)
_pf_context
[
'Xtoken'
]
=
re
.
search
(
r'Token : (.+)'
,
o
[
1
])
.
group
(
1
)
elif
'INFO:
\n
Status: Disabled'
in
pf_status
:
elif
'INFO:
\n
Status: Disabled'
in
pf_status
:
pfctl
(
'-e'
)
_pf_context
[
'started_by_sshuttle'
]
=
True
else
:
...
...
@@ -578,13 +585,15 @@ def restore_etc_hosts(port):
rewrite_etc_hosts
(
port
)
# This are some classes and functions used to support pf in yosemite.
# This are some classes and functions used to support pf in yosemite.
class
pf_state_xport
(
Union
):
_fields_
=
[(
"port"
,
c_uint16
),
(
"call_id"
,
c_uint16
),
(
"spi"
,
c_uint32
)]
class
pf_addr
(
Structure
):
class
_pfa
(
Union
):
_fields_
=
[(
"v4"
,
c_uint32
),
# struct in_addr
(
"v6"
,
c_uint32
*
4
),
# struct in6_addr
...
...
@@ -595,6 +604,7 @@ class pf_addr(Structure):
_fields_
=
[(
"pfa"
,
_pfa
)]
_anonymous_
=
(
"pfa"
,)
class
pfioc_natlook
(
Structure
):
_fields_
=
[(
"saddr"
,
pf_addr
),
(
"daddr"
,
pf_addr
),
...
...
@@ -604,20 +614,23 @@ class pfioc_natlook(Structure):
(
"dxport"
,
pf_state_xport
),
(
"rsxport"
,
pf_state_xport
),
(
"rdxport"
,
pf_state_xport
),
(
"af"
,
c_uint8
),
# sa_family_t
(
"af"
,
c_uint8
),
# sa_family_t
(
"proto"
,
c_uint8
),
(
"proto_variant"
,
c_uint8
),
(
"direction"
,
c_uint8
)]
pfioc_rule
=
c_char
*
3104
# sizeof(struct pfioc_rule)
pfioc_pooladdr
=
c_char
*
1136
# sizeof(struct pfioc_pooladdr)
pfioc_pooladdr
=
c_char
*
1136
# sizeof(struct pfioc_pooladdr)
MAXPATHLEN
=
1024
DIOCNATLOOK
=
((
0x40000000
L
|
0x80000000
L
)
|
((
sizeof
(
pfioc_natlook
)
&
0x1fff
)
<<
16
)
|
((
ord
(
'D'
))
<<
8
)
|
(
23
))
DIOCCHANGERULE
=
((
0x40000000
L
|
0x80000000
L
)
|
((
sizeof
(
pfioc_rule
)
&
0x1fff
)
<<
16
)
|
((
ord
(
'D'
))
<<
8
)
|
(
26
))
DIOCBEGINADDRS
=
((
0x40000000
L
|
0x80000000
L
)
|
((
sizeof
(
pfioc_pooladdr
)
&
0x1fff
)
<<
16
)
|
((
ord
(
'D'
))
<<
8
)
|
(
51
))
DIOCNATLOOK
=
((
0x40000000
L
|
0x80000000
L
)
|
(
(
sizeof
(
pfioc_natlook
)
&
0x1fff
)
<<
16
)
|
((
ord
(
'D'
))
<<
8
)
|
(
23
))
DIOCCHANGERULE
=
((
0x40000000
L
|
0x80000000
L
)
|
(
(
sizeof
(
pfioc_rule
)
&
0x1fff
)
<<
16
)
|
((
ord
(
'D'
))
<<
8
)
|
(
26
))
DIOCBEGINADDRS
=
((
0x40000000
L
|
0x80000000
L
)
|
(
(
sizeof
(
pfioc_pooladdr
)
&
0x1fff
)
<<
16
)
|
((
ord
(
'D'
))
<<
8
)
|
(
51
))
PF_CHANGE_ADD_TAIL
=
2
PF_CHANGE_GET_TICKET
=
6
...
...
@@ -629,6 +642,7 @@ PF_OUT = 2
_pf_fd
=
None
def
pf_get_dev
():
global
_pf_fd
if
_pf_fd
==
None
:
...
...
@@ -636,9 +650,11 @@ def pf_get_dev():
return
_pf_fd
def
pf_query_nat
(
family
,
proto
,
src_ip
,
src_port
,
dst_ip
,
dst_port
):
[
proto
,
family
,
src_port
,
dst_port
]
=
[
int
(
v
)
for
v
in
[
proto
,
family
,
src_port
,
dst_port
]]
[
proto
,
family
,
src_port
,
dst_port
]
=
[
int
(
v
)
for
v
in
[
proto
,
family
,
src_port
,
dst_port
]]
length
=
4
if
family
==
socket
.
AF_INET
else
16
pnl
=
pfioc_natlook
()
...
...
@@ -650,12 +666,15 @@ def pf_query_nat(family, proto, src_ip, src_port, dst_ip, dst_port):
memmove
(
addressof
(
pnl
.
daddr
),
socket
.
inet_pton
(
pnl
.
af
,
dst_ip
),
length
)
pnl
.
dxport
.
port
=
socket
.
htons
(
dst_port
)
ioctl
(
pf_get_dev
(),
DIOCNATLOOK
,
(
c_char
*
sizeof
(
pnl
))
.
from_address
(
addressof
(
pnl
)))
ioctl
(
pf_get_dev
(),
DIOCNATLOOK
,
(
c_char
*
sizeof
(
pnl
))
.
from_address
(
addressof
(
pnl
)))
ip
=
socket
.
inet_ntop
(
pnl
.
af
,
(
c_char
*
length
)
.
from_address
(
addressof
(
pnl
.
rdaddr
)))
ip
=
socket
.
inet_ntop
(
pnl
.
af
,
(
c_char
*
length
)
.
from_address
(
addressof
(
pnl
.
rdaddr
)))
port
=
socket
.
ntohs
(
pnl
.
rdxport
.
port
)
return
(
ip
,
port
)
def
pf_add_anchor_rule
(
type
,
name
):
ACTION_OFFSET
=
0
POOL_TICKET_OFFSET
=
8
...
...
@@ -667,14 +686,18 @@ def pf_add_anchor_rule(type, name):
ioctl
(
pf_get_dev
(),
DIOCBEGINADDRS
,
ppa
)
memmove
(
addressof
(
pr
)
+
POOL_TICKET_OFFSET
,
ppa
[
4
:
8
],
4
)
#pool_ticket
memmove
(
addressof
(
pr
)
+
ANCHOR_CALL_OFFSET
,
name
,
min
(
MAXPATHLEN
,
len
(
name
)))
#anchor_call = name
memmove
(
addressof
(
pr
)
+
RULE_ACTION_OFFSET
,
struct
.
pack
(
'I'
,
type
),
4
)
#rule.action = type
memmove
(
addressof
(
pr
)
+
POOL_TICKET_OFFSET
,
ppa
[
4
:
8
],
4
)
# pool_ticket
memmove
(
addressof
(
pr
)
+
ANCHOR_CALL_OFFSET
,
name
,
min
(
MAXPATHLEN
,
len
(
name
)))
# anchor_call = name
memmove
(
addressof
(
pr
)
+
RULE_ACTION_OFFSET
,
struct
.
pack
(
'I'
,
type
),
4
)
# rule.action = type
memmove
(
addressof
(
pr
)
+
ACTION_OFFSET
,
struct
.
pack
(
'I'
,
PF_CHANGE_GET_TICKET
),
4
)
#action = PF_CHANGE_GET_TICKET
memmove
(
addressof
(
pr
)
+
ACTION_OFFSET
,
struct
.
pack
(
'I'
,
PF_CHANGE_GET_TICKET
),
4
)
# action = PF_CHANGE_GET_TICKET
ioctl
(
pf_get_dev
(),
DIOCCHANGERULE
,
pr
)
memmove
(
addressof
(
pr
)
+
ACTION_OFFSET
,
struct
.
pack
(
'I'
,
PF_CHANGE_ADD_TAIL
),
4
)
#action = PF_CHANGE_ADD_TAIL
memmove
(
addressof
(
pr
)
+
ACTION_OFFSET
,
struct
.
pack
(
'I'
,
PF_CHANGE_ADD_TAIL
),
4
)
# action = PF_CHANGE_ADD_TAIL
ioctl
(
pf_get_dev
(),
DIOCCHANGERULE
,
pr
)
...
...
@@ -707,7 +730,8 @@ def main(port_v6, port_v4, dnsport_v6, dnsport_v4, nslist, method, udp, syslog):
elif
program_exists
(
'pfctl'
):
method
=
"pf"
else
:
raise
Fatal
(
"can't find either ipfw, iptables or pfctl; check your PATH"
)
raise
Fatal
(
"can't find either ipfw, iptables or pfctl; check your PATH"
)
if
method
==
"nat"
:
do_it
=
do_iptables_nat
...
...
sshuttle/ssh.py
View file @
e6f2395d
...
...
@@ -42,6 +42,7 @@ def readfile(name):
return
contents
def
empackage
(
z
,
name
,
data
=
None
):
if
not
data
:
data
=
readfile
(
name
)
...
...
sshuttle/ui-macos/main.py
View file @
e6f2395d
...
...
@@ -2,19 +2,19 @@ import sys
import
os
import
pty
from
AppKit
import
(
objc
,
NSApp
,
NSApplicationMain
,
NSAttributedString
,
NSFileHandle
,
NSFileHandleDataAvailableNotification
,
NSImage
,
NSMenu
,
NSMenuItem
,
NSNotificationCenter
,
NSObject
,
NSStatusBar
,
NSVariableStatusItemLength
,
objc
,
NSApp
,
NSApplicationMain
,
NSAttributedString
,
NSFileHandle
,
NSFileHandleDataAvailableNotification
,
NSImage
,
NSMenu
,
NSMenuItem
,
NSNotificationCenter
,
NSObject
,
NSStatusBar
,
NSVariableStatusItemLength
,
)
import
my
import
models
...
...
sshuttle/ui-macos/my.py
View file @
e6f2395d
import
os
from
AppKit
import
(
NSBundle
,
NSData
,
NSDictionary
,
NSImage
,
NSUserDefaults
,
NSBundle
,
NSData
,
NSDictionary
,
NSImage
,
NSUserDefaults
,
)
import
PyObjCTools.AppHelper
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment