summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-10-03Lock version of attrsBrian May
Latest version of attrs breaks pytest, see: https://stackoverflow.com/questions/58189683/typeerror-attrib-got-an-unexpected-keyword-argument-convert
2019-09-22Fix capturing of local DNS serversNick Sokolov
Regression was introduced in #337 that is skipping all local traffic, including DNS. This change makes UDP port 53 (DNS) LOCAL traffic to be treated as special case. Fixes #357
2019-09-22docs: openwrtunl89
2019-09-22Fix crashing on ECONNABORTEDNick Sokolov
In certain cases socket.connect fails with ECONNABORTED, which is treated as "unknown" error causing sshuttle to crash. Fixes #356
2019-09-22The size of pf_rule grew in OpenBSD 6.4Anthony Cornehl
2019-09-22Use prompt for sudo, not needed for doasAnthony Cornehl
2019-07-25Fix Arch linux installation instructionscptpcrd
`pacman -Sy` does a partial upgrade, which is specifically documented as being unsupported.
2019-06-21update readme to correct flag for arch linux.José Augusto
Correct the install flag for arch linux installation example.
2019-06-08Fix tests for existing PR-312 (#337)Daniel Jeffery
* use addrtype match to return the LOCAL trafik * Add assertion for the new LOCAL firewall rule added in PR 312. * Fix linter complaints
2019-06-08Add install instructions for FedoraJeremy Eder
2019-04-04Add install instructions for Arch LinuxElijah Lynn
2019-02-14Hyphen in hostname fixThomas Bouve
2019-02-14assembler import fix (#319)Thomas Bouve
* assembler import fix. * Added noqa to import statements.
2019-02-11Fix/pep8 (#277)Bastian Venthur
* re-organized imports according to pep8 * fixed all remaining pep8 issues * moved common config into setup.cfg, additionally test `tests` * removed --select=X -- the errors selected where by default not in flake8's --ignore list so effectively had no effect * update .travis.yml to reflect changes in tox.ini * make travis just use tox in order to avoid code duplaction * replace py.test with pytest * fixed .travis.yml * try different pypy toxenv * hopefully fixed testenv for pypy * added pypy basepython, removed unused python2.6 * install dev package before testing (fixes missing coverage) * fixed empty exception pass blocks with noqa * Added dummy log message on empty try-except-pass blocks to make dodacy happy :( * Replaced Exception with BaseException
2019-01-28Release 0.78.5v0.78.5Brian May
2019-01-28Update CHANGES.rst for new releaseBrian May
2019-01-28auto-nets: retrieve routes only if using auto-netsVasil Kolev
There's a known issue that makes sshuttle crash if there are too many routes on the remote host (that don't fit in 64KB). This patch requests the routes only if auto-nets is specified on the command line.
2019-01-23Fix potential deadlock condition in nft_get_handleAlex Tomlins
This was susceptible to the same deadlock issue that ipt_chain_exists had and was fixed in d43db80 where if the command returned a significant amount of output, it wouldn't all be read in, resulting in the subprocess hanging waiting for the output to be read.
2019-01-23Use subprocess.check_output instead of runAlex Tomlins
subprocess.run only exists for python3, and this needs to also support python 2.7
2018-12-29docs: document --ns-hosts --to-ns and update --dnsAndré Draszik
--ns-hosts is available since commit d2ee34d71c0e ("dns: Added --ns-hosts to tunnel only some requests") (released as v0.72), but was never documented. --to-ns is available since commit be559fc78b88 ("Fix case where there is no --dns.") after several bugfixes, released as v0.78.4, but was never documented.
2018-12-09Fix deadlock with iptables with large rulesetAlex Tomlins
When running sshuttle with a large list of routes it's failing to clean them up at exit. It returns the following: $ sshuttle -r user@host.example.com -s /tmp/aws-cidrs.txt user@host.example.com's password: client: Connected. ^CAnother app is currently holding the xtables lock; still -9s 0us time ahead to have a chance to grab the lock... Another app is currently holding the xtables lock; still -19s 0us time ahead to have a chance to grab the lock... Another app is currently holding the xtables lock; still -29s 0us time ahead to have a chance to grab the lock... This continues indefinitely. Looking in ps reveals that there are 2 iptables processes running. Killing -9 the first one, allows sshuttle to continue and clean up successfully. The problem lies with the use of Popen here. The function currently returns as soon as it finds a match without consuming everything from stdout. This means that if there's more output from iptables than will fit in the buffer it doesn't exit, and therefore doesn't release the kernel xtables lock.
2018-12-03Fix typo in docsDavid Landry
2018-11-29Document --version optionTodor Gaidarov
2018-11-03Changes pf exclusion rules precedenceJoão Vieira
Before this change, in pf, exclusions used a pass out quick which gave them higher precedence than any other rule independent of subnet width. As reported in #265 this causes exclusion from one instance of sshuttle to also take effect on other instances because quick aborts the evaluation of rules across all anchors. This commit changes the precedence of rules so quick can now be dropped. The new order is defined by the following rule, from subnet_weight: "We need to go from smaller, more specific, port ranges, to larger, less-specific, port ranges. At each level, we order by subnet width, from most-specific subnets (largest swidth) to least-specific. On ties, excludes come first."
2018-11-01Close stdin, stdout, and stderr when using syslog or forking to daemon (#283)Brian May
* Close stdin, stdout, and stderr when using syslog or forking to daemon Fixes #139 * Ensure we close devnull after use
2018-10-23Fixes support for OpenBSD (6.1+) (#282)João Vieira
* Fixes support for OpenBSD (6.1+) As reported in #219, new versions of OpenBSD ship with a different pfioc_rule struct. This commit adjusts the offset to match the new struct. * Fixes tests for OpenBSD 6.1+
2018-10-17Added coverage report to testsBastian Venthur
2018-10-17replace path /dev/null by os.devnullAbbalYouness
2018-10-17updated bandit configBastian Venthur
2018-10-17updated pathBastian Venthur
2018-10-17Moved sshuttle/tests into tests to.Bastian Venthur
Having the tests in a `tests` directory in root is the most common approach. Also moved pytest's conftest.py into `tests` making the fixture available for client and server tests.
2018-10-07Fix missing string formatting argumentBrian May
2018-09-22Merge pull request #271 from usabilla/no-sudo-pythonpathBrian May
Add --no-sudo-pythonpath option
2018-09-21Add --no-sudo-pythonpath optionSteven McDonald
This provides a way to avoid setting PYTHONPATH when invoking the privileged part of sshuttle with sudo. This is useful if running sshuttle as a PEX archive, as Telepresence does, as it enables sshuttle's sudo access to be securely locked down. PEX archives will extract themselves into the invoking user's home directory, which means that the invoking user has full control over the code in them. This makes restricting sudo access with PYTHONPATH set completely pointless in this scenario -- an attacker could put any code into ~/.pex and gain full root access anyway. On the other hand, if sshuttle is a PEX archive, the privileged invocation will simply extract itself into /root/.pex anyway, so there is no need to set PYTHONPATH in this case.
2018-08-25works on ChromeOS with Crostini VM (#262)tony godshall
* works on ChromeOS with Crostini VM tested on ASUS C101PA on Dev channel, should also work on Intel machines and Beta channel * crostini doc, and a note about xterms and VNC tested on ASUS C101PA on Dev channel, should also work on Intel machines and Beta channel
2018-08-21Don't crash if we can't look up peernameBrian May
Peername is only used for information display messages. Fixes #259
2018-06-29Doc UpdateDavid Patino
Remove reference to autossh per https://github.com/sshuttle/sshuttle/issues/143
2018-06-22Update README.rstDaisuke Taniwaki
2018-06-07Doc: Fix typoBenedikt Waldvogel
2018-06-03Doc: Improve Systemd service recommendation (fixes #238)desbma
2018-05-13Fix sudo/doasIvan Shvedunov
Fixes #227
2018-05-09Add doas support for clientevitalis
2018-04-30Fix line length for CI.Antoine POPINEAU
2018-04-30Fix concatening string to tuple. Allow for forwarding a single port.Antoine POPINEAU
2018-04-02Prepare for 0.78.4v0.78.4Brian May
2018-03-22Improve formattingBrian Hill
2018-03-22Preserve peer and port properlyBrian Hill
2018-03-22Make --to-dns and --ns-host work well togetherBrian Hill
2018-03-16Remove test that fails under OSXBrian May
Fixes #213
2018-03-16Remove Python 2.6 from automatic testsBrian May
Automatic python 2.6 testing is becoming harder, especially as pytest 3.4.2 is unavailable for Python 2.6.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 13:12:06 +0000