When subnets and excludes are specified with hostnames, use all IPs.#541
When subnets and excludes are specified with hostnames, use all IPs.#541brianmay merged 6 commits intosshuttle:masterfrom
Conversation
The list of subnets to route over VPN and the list of subnets to exclude are parsed in option.py parse_subnetport(). Hostnames or IP addresses are supported. If a hostname was provided, only the first IP address was considered. This could result in some traffic not traversing the VPN that the user might expect should traverse it from the arguments passed to sshuttle. This patch makes the function handle all of the IPs if a hostname is provided. If a user provides a hostname with a CIDR mask, problems can occur and we warn the user about the issue. If the user includes a hostname with both an IPv4 and an IPv6 address, and the underlying method doesn't support IPv6, then this patch will cause sshuttle to fail. I plan to provide a future patch where failure won't occur if the only place IPv6 addresses appear is in the exclude list. In that case it should be safe to ignore the IPv6 address. This patch also changes parse_ipport() which is used by the --to-ns option. If the user provides a hostname here, we just use the first IP from the hostname and warn the user that only one is being used.
…r messages in tests
…oth in any particular order
Additional comments, checks, warning messages, and diagnostic information is printed out when the client starts. We assume IPv4 is always present and enabled. We assume IPv6 is not supported when it is disabled at the command line or when it is not supported by the firewall method. Warn if IPv6 is disabled but the user specified IPv6 subnets, IPv6 DNS servers, or IPv6 excludes that are effectively ignored. Instead of indicating which features are on/off, we also indicate if features are available in the verbose output. We also more clearly print the subnets that we forward, excludes, and any redirected DNS servers to the terminal output. These changes should help handling bug reports and make it clearer to users what is happening. It should also make it more graceful when a user specifies a subnet/exclude with hostname that resolves to both IPv4 and IPv6 (but IPv6 is disabled in sshuttle).
|
I think I'm done with this. The last commit makes more changes than what is strictly necessary to support what the original comment says. Initially, I wanted to have some sane behavior when an IPv4+IPv6 hostname is used as a part of a subnet to include or exclude (but IPv6 might not be enabled). However, once I started making changes, I ended up making some other related changes to the code. I think the changes, particularly the ones in the last commit, could use some testing. Suggestions and feedback are welcome. |
brianmay
left a comment
brianmay
left a comment
There was a problem hiding this comment.
This looks good to me. Will merge if you agree it is ready.
|
Merge it! I think it is completed and I hope it doesn't break things for anybody. I need this fix in to propose my forthcoming fix for #191 to auto-exclude the ssh host. I believe I found/implemented an appropriate workaround to the problem you mentioned in #191 (comment) . Stay tuned for another pull request. |
2 participants
The list of subnets to route over VPN and the list of subnets to
exclude are parsed in option.py parse_subnetport(). Hostnames or IP
addresses are supported. If a hostname was provided, only the first IP
address was considered. This could result in some traffic not
traversing the VPN that the user might expect should traverse it from
the arguments passed to sshuttle.
This patch makes the function handle all of the IPs if a hostname is
provided. If a user provides a hostname with a CIDR mask, problems can
occur and we warn the user about the issue.
If the user includes a hostname with both an IPv4 and an IPv6 address,
and the underlying method doesn't support IPv6, then this patch will
cause sshuttle to fail. I plan to provide a future patch where failure
won't occur if the only place IPv6 addresses appear is in the exclude
list. In that case it should be safe to ignore the IPv6 address.
This patch also changes parse_ipport() which is used by the --to-ns
option. If the user provides a hostname here, we just use the first IP
from the hostname and warn the user that only one is being used.