(port, dnsport, subnets)
| 256 | |
| 257 | |
| 258 | def do_ipfw(port, dnsport, subnets): |
| 259 | sport = str(port) |
| 260 | xsport = str(port+1) |
| 261 | |
| 262 | # cleanup any existing rules |
| 263 | if ipfw_rule_exists(port): |
| 264 | ipfw('delete', sport) |
| 265 | |
| 266 | while _changedctls: |
| 267 | name = _changedctls.pop() |
| 268 | oldval = _oldctls[name] |
| 269 | _sysctl_set(name, oldval) |
| 270 | |
| 271 | if subnets or dnsport: |
| 272 | sysctl_set('net.inet.ip.fw.enable', 1) |
| 273 | |
| 274 | # This seems to be needed on MacOS 10.6 and 10.7. For more |
| 275 | # information, see: |
| 276 | # http://groups.google.com/group/sshuttle/browse_thread/thread/bc32562e17987b25/6d3aa2bb30a1edab |
| 277 | # and |
| 278 | # http://serverfault.com/questions/138622/transparent-proxying-leaves-sockets-with-syn-rcvd-in-macos-x-10-6-snow-leopard |
| 279 | changeflag = sysctl_set('net.inet.ip.scopedroute', 0, permanent=True) |
| 280 | if changeflag == SUCCESS: |
| 281 | log("\n" |
| 282 | " WARNING: ONE-TIME NETWORK DISRUPTION:\n" |
| 283 | " =====================================\n" |
| 284 | "sshuttle has changed a MacOS kernel setting to work around\n" |
| 285 | "a bug in MacOS 10.6. This will cause your network to drop\n" |
| 286 | "within 5-10 minutes unless you restart your network\n" |
| 287 | "interface (change wireless networks or unplug/plug the\n" |
| 288 | "ethernet port) NOW, then restart sshuttle. The fix is\n" |
| 289 | "permanent; you only have to do this once.\n\n") |
| 290 | sys.exit(1) |
| 291 | elif changeflag == FAILED: |
| 292 | # On MacOS 10.7, the scopedroute sysctl became read-only, so |
| 293 | # we have to fix it using a kernel boot parameter instead, |
| 294 | # which requires rebooting. For more, see: |
| 295 | # http://groups.google.com/group/sshuttle/browse_thread/thread/a42505ca33e1de80/e5e8f3e5a92d25f7 |
| 296 | log('Updating kernel boot flags.\n') |
| 297 | defaults_write_kernel_flag('net.inet.ip.scopedroute', 0) |
| 298 | log("\n" |
| 299 | " YOU MUST REBOOT TO USE SSHUTTLE\n" |
| 300 | " ===============================\n" |
| 301 | "sshuttle has changed a MacOS kernel boot-time setting\n" |
| 302 | "to work around a bug in MacOS 10.7 Lion. You will need\n" |
| 303 | "to reboot before it takes effect. You only have to\n" |
| 304 | "do this once.\n\n") |
| 305 | sys.exit(EXITCODE_NEEDS_REBOOT) |
| 306 | |
| 307 | ipfw('add', sport, 'check-state', 'ip', |
| 308 | 'from', 'any', 'to', 'any') |
| 309 | |
| 310 | if subnets: |
| 311 | # create new subnet entries |
| 312 | for swidth,sexclude,snet in sorted(subnets, reverse=True): |
| 313 | if sexclude: |
| 314 | ipfw('add', sport, 'skipto', xsport, |
| 315 | 'tcp', |
nothing calls this directly
no test coverage detected