(port, dnsport, subnets)
| 71 | # recently-started one will win (because we use "-I OUTPUT 1" instead of |
| 72 | # "-A OUTPUT"). |
| 73 | def do_iptables(port, dnsport, subnets): |
| 74 | chain = 'sshuttle-%s' % port |
| 75 | |
| 76 | # basic cleanup/setup of chains |
| 77 | if ipt_chain_exists(chain): |
| 78 | nonfatal(ipt, '-D', 'OUTPUT', '-j', chain) |
| 79 | nonfatal(ipt, '-D', 'PREROUTING', '-j', chain) |
| 80 | nonfatal(ipt, '-F', chain) |
| 81 | ipt('-X', chain) |
| 82 | |
| 83 | if subnets or dnsport: |
| 84 | ipt('-N', chain) |
| 85 | ipt('-F', chain) |
| 86 | ipt('-I', 'OUTPUT', '1', '-j', chain) |
| 87 | ipt('-I', 'PREROUTING', '1', '-j', chain) |
| 88 | |
| 89 | if subnets: |
| 90 | # create new subnet entries. Note that we're sorting in a very |
| 91 | # particular order: we need to go from most-specific (largest swidth) |
| 92 | # to least-specific, and at any given level of specificity, we want |
| 93 | # excludes to come first. That's why the columns are in such a non- |
| 94 | # intuitive order. |
| 95 | for swidth,sexclude,snet in sorted(subnets, reverse=True): |
| 96 | if sexclude: |
| 97 | ipt('-A', chain, '-j', 'RETURN', |
| 98 | '--dest', '%s/%s' % (snet,swidth), |
| 99 | '-p', 'tcp') |
| 100 | else: |
| 101 | ipt_ttl('-A', chain, '-j', 'REDIRECT', |
| 102 | '--dest', '%s/%s' % (snet,swidth), |
| 103 | '-p', 'tcp', |
| 104 | '--to-ports', str(port)) |
| 105 | |
| 106 | if dnsport: |
| 107 | nslist = resolvconf_nameservers() |
| 108 | for ip in nslist: |
| 109 | ipt_ttl('-A', chain, '-j', 'REDIRECT', |
| 110 | '--dest', '%s/32' % ip, |
| 111 | '-p', 'udp', |
| 112 | '--dport', '53', |
| 113 | '--to-ports', str(dnsport)) |
| 114 | |
| 115 | |
| 116 | def ipfw_rule_exists(n): |
nothing calls this directly
no test coverage detected