diff options
| author | Nick Sokolov <nsokolov@google.com> | 2019-09-13 11:37:20 -0700 |
|---|---|---|
| committer | Brian May <brian@linuxpenguins.xyz> | 2019-09-22 10:37:49 +1000 |
| commit | a7193f508a8f315a134e6ded831f19a9518101e3 (patch) | |
| tree | 43bf0515a9cd89278040d94aa997c13212438856 | |
| parent | 7ebff926378abcf3eaf824b692c5356b2e13b18e (diff) | |
Fix capturing of local DNS servers
Regression was introduced in #337 that is skipping all local traffic,
including DNS. This change makes UDP port 53 (DNS) LOCAL traffic to be
treated as special case.
Fixes #357
| -rw-r--r-- | sshuttle/methods/nat.py | 8 | ||||
| -rw-r--r-- | tests/client/test_methods_nat.py | 6 |
2 files changed, 12 insertions, 2 deletions
diff --git a/sshuttle/methods/nat.py b/sshuttle/methods/nat.py index 912555d..3435240 100644 --- a/sshuttle/methods/nat.py +++ b/sshuttle/methods/nat.py @@ -54,7 +54,13 @@ class Method(BaseMethod): # tunnelling the traffic designated to all local TCP/IP addresses. _ipt('-A', chain, '-j', 'RETURN', '-m', 'addrtype', - '--dst-type', 'LOCAL') + '--dst-type', 'LOCAL', + '!', '-p', 'udp') + # Skip LOCAL traffic if it's not DNS. + _ipt('-A', chain, '-j', 'RETURN', + '-m', 'addrtype', + '--dst-type', 'LOCAL', + '-p', 'udp', '!', '--dport', '53') # create new subnet entries. for _, swidth, sexclude, snet, fport, lport \ diff --git a/tests/client/test_methods_nat.py b/tests/client/test_methods_nat.py index 94bbabf..83d0e36 100644 --- a/tests/client/test_methods_nat.py +++ b/tests/client/test_methods_nat.py @@ -140,7 +140,11 @@ def test_setup_firewall(mock_ipt_chain_exists, mock_ipt_ttl, mock_ipt): call(AF_INET, 'nat', '-I', 'OUTPUT', '1', '-j', 'sshuttle-1025'), call(AF_INET, 'nat', '-I', 'PREROUTING', '1', '-j', 'sshuttle-1025'), call(AF_INET, 'nat', '-A', 'sshuttle-1025', '-j', 'RETURN', - '-m', 'addrtype', '--dst-type', 'LOCAL'), + '-m', 'addrtype', '--dst-type', 'LOCAL', + '!', '-p', 'udp'), + call(AF_INET, 'nat', '-A', 'sshuttle-1025', '-j', 'RETURN', + '-m', 'addrtype', '--dst-type', 'LOCAL', + '-p', 'udp', '!', '--dport', '53'), call(AF_INET, 'nat', '-A', 'sshuttle-1025', '-j', 'RETURN', '--dest', u'1.2.3.66/32', '-p', 'tcp', '--dport', '8080:8080') ] |