sshuttle & N900 phone

[Alphazo]

My Nokia N90 phone has both Python and iptables built in so I had to
give sshuttle a try. I used the exact same server that I successfully
used on my server. Below is the trace I get on my phone when starting
sshuttle as root. Looks like there is some exchange going on but I
have no idea where it fails. I tried from both WiFi and 3G connection
but same result. Can someone help me to debug it?

Nokia-N900:/home/user/sshuttle# ./sshuttle -r jtan 0.0.0.0/0 -vv >
n900
Starting sshuttle proxy.
Binding: 12300
Listening on ('127.0.0.1', 12300).
firewall manager ready.
c : connecting to server...
c : executing: ['ssh', 'jtan', '--', '\'python\' -c \'import sys;
skip_imports=1; verbosity=2; exec compile(sys.stdin.read(764),
"assembler.py", "exec")\'']
c : > channel=0 cmd=PING len=7 (fullness=0)
server: assembling 'helpers.py' (332 bytes)
server: assembling 'ssubprocess.py' (13731 bytes)
server: assembling 'ssnet.py' (4782 bytes)
server: assembling 'hostwatch.py' (2181 bytes)
server: assembling 'server.py' (1712 bytes)
s: available routes:
s: 66.220.146.248/32
s: 207.106.6.0/24
s: 207.106.6.1/32
s: 207.106.6.4/32
s: 207.106.6.199/32
s: 207.106.84.128/26
s: 207.106.84.129/32
s: 207.106.84.130/32
s: 207.106.84.131/32
s: 207.106.84.134/32
s: 207.106.84.137/32
s: 207.106.84.138/32
s: 207.106.84.141/32
s: 207.106.84.142/32
s: 207.106.84.143/32
s: 207.106.84.147/32
s: 207.106.84.148/32
s: 207.106.84.148/32
s: 207.106.84.152/32
c : connected.
c : Waiting: 2 r=[3, 8] w=[8] x=[] (fullness=7/0)
c : Ready: 2 r=[8] w=[8] x=[]
c : < channel=0 cmd=PING len=7
c : > channel=0 cmd=PONG len=7 (fullness=7)
c : < channel=0 cmd=ROUTES len=470
firewall manager: starting transproxy.
s: 207.106.84.152/32
s: 207.106.84.158/32
s: 207.106.84.159/32
s: 207.106.84.164/32
s: 207.106.84.166/32
s: 207.106.84.188/32
s: 207.106.84.188/32
s: 224.0.0.0/4
s: > channel=0 cmd=PING len=7 (fullness=0)
s: > channel=0 cmd=ROUTES len=470 (fullness=7)
s: Waiting: 1 r=[6] w=[7] x=[] (fullness=477/0)
s: Ready: 1 r=[] w=[7] x=[]
s: mux wrote: 15/15
s: mux wrote: 478/478
s: Waiting: 1 r=[6] w=[] x=[] (fullness=477/0)
>> iptables -t nat -N sshuttle-12300
>> iptables -t nat -F sshuttle-12300
>> iptables -t nat -I OUTPUT 1 -j sshuttle-12300
>> iptables -t nat -I PREROUTING 1 -j sshuttle-12300
>> iptables -t nat -A sshuttle-12300 -j RETURN --dest 127.0.0.0/8 -p tcp
>> iptables -t nat -A sshuttle-12300 -j REDIRECT --dest 0.0.0.0/0 -p tcp --to-ports 12300 -m ttl ! --ttl 42
iptables: No chain/target/match by that name.
firewall manager: undoing changes.
>> iptables -t nat -D OUTPUT -j sshuttle-12300
>> iptables -t nat -D PREROUTING -j sshuttle-12300
>> iptables -t nat -F sshuttle-12300
>> iptables -t nat -X sshuttle-12300
fatal: ['iptables', '-t', 'nat', '-A', 'sshuttle-12300', '-j',
'REDIRECT', '--dest', '0.0.0.0/0', '-p', 'tcp', '--to-ports', '12300',
'-m', 'ttl', '!', '--ttl', '42'] returned 1
c : fatal: cleanup: ['./sshuttle', '-v', '-v', '--firewall', '12300']
returned 99
Nokia-N900:/home/user/sshuttle# s: Ready: 1 r=[6] w=[] x=[]

[Avery Pennarun]

On Fri, Jan 21, 2011 at 2:40 PM, Alphazo <alp...@gmail.com> wrote:
> fatal: ['iptables', '-t', 'nat', '-A', 'sshuttle-12300', '-j',
> 'REDIRECT', '--dest', '0.0.0.0/0', '-p', 'tcp', '--to-ports', '12300',
> '-m', 'ttl', '!', '--ttl', '42'] returned 1
> c : fatal: cleanup: ['./sshuttle', '-v', '-v', '--firewall', '12300']
> returned 99
> Nokia-N900:/home/user/sshuttle# s: Ready: 1 r=[6] w=[] x=[]

Your kernel doesn't have at least one of the required iptables
modules, probably the REDIRECT module. If you recompile your kernel,
you might be able to make this work.

Avery

[Alphazo]

I looked at my /lib/modules/{kernel}/ and it was full of iptable
related modules including a REDIRECT one. I manually loaded all of
them.

Below you can see that REDIRECT is loaded:

# lsmod | grep ipt
iptable_mangle 2176 0
ipt_REJECT 2432 0
ipt_NETMAP 1280 0
ipt_MASQUERADE 2112 0
ipt_LOG 4864 0
iptable_filter 1984 0
ipt_REDIRECT 1344 0
iptable_nat 4676 0
nf_nat 14222 4 ipt_NETMAP,ipt_MASQUERADE,ipt_REDIRECT,iptable_nat
nf_conntrack_ipv4 10892 3 iptable_nat,nf_nat
nf_conntrack 46524 4
ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4
ip_tables 9424 3 iptable_mangle,iptable_filter,iptable_nat
x_tables 11012 7
ipt_REJECT,ipt_NETMAP,ipt_MASQUERADE,ipt_LOG,ipt_REDIRECT,iptable_nat,ip_tables

When starting sshuttle I get a similar error message (see below). How
can narrow down the source of the problem? Thx Alphazo

Nokia-N900:/home/user/sshuttle# ./sshuttle -r jtan 0.0.0.0/0 -vv

Starting sshuttle proxy.
Binding: 12300
Listening on ('127.0.0.1', 12300).
firewall manager ready.
c : connecting to server...
c : executing: ['ssh', 'jtan', '--', '\'python\' -c \'import sys;
skip_imports=1; verbosity=2; exec compile(sys.stdin.read(764),
"assembler.py", "exec")\'']
c : > channel=0 cmd=PING len=7 (fullness=0)
server: assembling 'helpers.py' (332 bytes)
server: assembling 'ssubprocess.py' (13731 bytes)
server: assembling 'ssnet.py' (4782 bytes)
server: assembling 'hostwatch.py' (2181 bytes)
server: assembling 'server.py' (1712 bytes)
s: available routes:

s: 207.106.6.0/24
s: 207.106.6.1/32

s: 207.106.6.199/32
s: 207.106.84.128/26
s: 207.106.84.129/32

s: 207.106.84.134/32
s: 207.106.84.135/32
s: 207.106.84.137/32
s: 207.106.84.141/32

c : connected.
c : Waiting: 2 r=[3, 8] w=[8] x=[] (fullness=7/0)

c : Ready: 2 r=[] w=[8] x=[]
c : mux wrote: 15/15
c : Waiting: 2 r=[3, 8] w=[] x=[] (fullness=7/0)

s: 207.106.84.143/32
s: 207.106.84.147/32
s: 207.106.84.148/32
s: 207.106.84.148/32
s: 207.106.84.152/32

s: 207.106.84.152/32
s: 207.106.84.159/32
s: 207.106.84.164/32

s: 207.106.84.188/32
s: 207.106.84.188/32
s: 224.0.0.0/4
s: > channel=0 cmd=PING len=7 (fullness=0)

s: > channel=0 cmd=ROUTES len=347 (fullness=7)
c : Ready: 2 r=[8] w=[] x=[]

c : < channel=0 cmd=PING len=7
c : > channel=0 cmd=PONG len=7 (fullness=7)

c : < channel=0 cmd=ROUTES len=347
firewall manager: starting transproxy.
s: Waiting: 1 r=[6] w=[7] x=[] (fullness=354/0)

s: Ready: 1 r=[] w=[7] x=[]
s: mux wrote: 15/15

s: mux wrote: 355/355
s: Waiting: 1 r=[6] w=[] x=[] (fullness=354/0)

>> iptables -t nat -N sshuttle-12300
>> iptables -t nat -F sshuttle-12300

s: Ready: 1 r=[6] w=[] x=[]

s: < channel=0 cmd=PING len=7
s: > channel=0 cmd=PONG len=7 (fullness=354)
s: mux wrote: 15/15
s: Waiting: 1 r=[6] w=[] x=[] (fullness=361/0)

>> iptables -t nat -I OUTPUT 1 -j sshuttle-12300
>> iptables -t nat -I PREROUTING 1 -j sshuttle-12300
>> iptables -t nat -A sshuttle-12300 -j RETURN --dest 127.0.0.0/8 -p tcp
>> iptables -t nat -A sshuttle-12300 -j REDIRECT --dest 0.0.0.0/0 -p tcp --to-ports 12300 -m ttl ! --ttl 42
iptables: No chain/target/match by that name.
firewall manager: undoing changes.
>> iptables -t nat -D OUTPUT -j sshuttle-12300
>> iptables -t nat -D PREROUTING -j sshuttle-12300
>> iptables -t nat -F sshuttle-12300
>> iptables -t nat -X sshuttle-12300

fatal: ['iptables', '-t', 'nat', '-A', 'sshuttle-12300', '-j',
'REDIRECT', '--dest', '0.0.0.0/0', '-p', 'tcp', '--to-ports', '12300',
'-m', 'ttl', '!', '--ttl', '42'] returned 1
c : fatal: cleanup: ['./sshuttle', '-v', '-v', '--firewall', '12300']
returned 99
Nokia-N900:/home/user/sshuttle# s: Ready: 1 r=[6] w=[] x=[]

On Jan 22, 8:24 am, Avery Pennarun <apenw...@gmail.com> wrote:

[Axel Beckert]

On Sat, Jan 22, 2011 at 01:01:58PM -0800, Alphazo wrote:
> On Jan 22, 8:24�am, Avery Pennarun <apenw...@gmail.com> wrote:
> > On Fri, Jan 21, 2011 at 2:40 PM, Alphazo <alph...@gmail.com> wrote:
> > > fatal: ['iptables', '-t', 'nat', '-A', 'sshuttle-12300', '-j',
> > > 'REDIRECT', '--dest', '0.0.0.0/0', '-p', 'tcp', '--to-ports', '12300',
> > > '-m', 'ttl', '!', '--ttl', '42'] returned 1
> > > c : fatal: cleanup: ['./sshuttle', '-v', '-v', '--firewall', '12300']
> > > returned 99
> > > Nokia-N900:/home/user/sshuttle# s: Ready: 1 r=[6] w=[] x=[]
> >
> > Your kernel doesn't have at least one of the required iptables
> > modules, probably the REDIRECT module. �If you recompile your kernel,
> > you might be able to make this work.
>

> I looked at my /lib/modules/{kernel}/ and it was full of iptable
> related modules including a REDIRECT one.

Hmmm, the original N900 kernel does AFAIK neither support iptables nor
IP forwarding. Do you have that special kernel from extra-devel
repositories installed?

> Below you can see that REDIRECT is loaded:
>
> # lsmod | grep ipt
> iptable_mangle 2176 0
> ipt_REJECT 2432 0
> ipt_NETMAP 1280 0
> ipt_MASQUERADE 2112 0
> ipt_LOG 4864 0
> iptable_filter 1984 0
> ipt_REDIRECT 1344 0
> iptable_nat 4676 0
> nf_nat 14222 4 ipt_NETMAP,ipt_MASQUERADE,ipt_REDIRECT,iptable_nat
> nf_conntrack_ipv4 10892 3 iptable_nat,nf_nat
> nf_conntrack 46524 4
> ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4
> ip_tables 9424 3 iptable_mangle,iptable_filter,iptable_nat
> x_tables 11012 7
> ipt_REJECT,ipt_NETMAP,ipt_MASQUERADE,ipt_LOG,ipt_REDIRECT,iptable_nat,ip_tables

Looks fine, indeed.

No idea about the rest. Maybe iptables on the N900 is not compiled
with all necessary features? They seem to have dropped the one or
other feature in quite some packages. (I'm mostly annoyed about them
dropping the libnotify-bin package in comparison to the Debian or
Ubuntu libnotify source packages.)

Kind regards, Axel
--
/~\ Plain Text Ribbon Campaign | Axel Beckert
\ / Say No to HTML in E-Mail and News | a...@deuxchevaux.org (Mail)
X See http://www.asciiribbon.org/ | a...@noone.org (Mail+Jabber)
/ \ I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

[Avery Pennarun]

On Sat, Jan 22, 2011 at 1:01 PM, Alphazo <alp...@gmail.com> wrote:
>>> iptables -t nat -A sshuttle-12300 -j REDIRECT --dest 0.0.0.0/0 -p tcp --to-ports 12300 -m ttl ! --ttl 42
> iptables: No chain/target/match by that name.

Well, you might want to try running those commands by hand and
trimming them down to see what happens. I wouldn't be surprised if
it's the "-m ttl --ttl 42" that's the problem; you could try taking
that out of the sshuttle source, since it's sort of optional, as long
as the client machine != the server machine.

It would be better to just have the ttl module available though...

Have fun,

Avery

[Alphazo]

Great news! sshuttle officially supports a new hardware platform..
Nokia N900 phone!

I've commented out one line in firewall.py:

'-m', 'ttl', '!', '--ttl', '42' # to prevent infinite loops

It would be nice to have a switch for disabling this function when
calling sshuttle.

For information, I've posted a quick tutorial on Maemo forum:

http://talk.maemo.org/showthread.php?t=68805

Thanks again for you support
Alphazo

On Jan 23, 5:42 am, Avery Pennarun <apenw...@gmail.com> wrote:

[Avery Pennarun]

On Sun, Jan 23, 2011 at 5:43 AM, Alphazo <alp...@gmail.com> wrote:
> I've commented out one line in firewall.py:
>
> '-m', 'ttl', '!', '--ttl', '42'  # to prevent infinite loops
>
> It would be nice to have a switch for disabling this function when
> calling sshuttle.

Okay, I've just added a patch so that sshuttle can auto-detect that
the "-m ttl" stuff doesn't work, and try again without it in that
case. You shouldn't need to pass it a command-line option. Please
let me know how it works.

Thanks,

Avery

[Alphazo]

Works great! Thanks a lot for the quick fix. I've updated my tutorial
here http://talk.maemo.org/showthread.php?p=926691#post926691

On Jan 26, 5:38 am, Avery Pennarun <apenw...@gmail.com> wrote: