Comments on [ List || List <- "Incomprehension" ].: SoDS; Care and Feeding of,

2012-01-09T11:32:17.744-05:00

This comment has been removed by the author.

> 2012-01-09 09:11:10 knjuqljsfyyc2vdsnfwgkylek...

2012-01-09T08:34:50.594-05:00

> 2012-01-09 09:11:10 knjuqljsfyyc2vdsnfwgkyleknjuqmskmf3gcxzsgezq2cq.36202-0.id-38592.up.tunnel.testdomain.com
> 2012-01-09 09:11:10 rejecting request for domain: testdomain.com

Domain check was triggered. You can disable it by using the magic keyword "any":

./sods -u nobody -g nobody -d /tmp -L 127.0.0.1:22 any

Adding another domain component to sdt should make the tunnel work:

./sdt -t CNAME -r 8.8.8.8 -p 22220 -s 0 -vvvv s.tunnel.testdomain.com

(Added the subdomain "s" to tunnel.testdomain.com).

Hopefully that will work but let me know if you run into more problems!

Hi, On the SODS server I get :- 2012-01-09 09:11:...

2012-01-09T04:30:25.019-05:00

Hi,

On the SODS server I get :-
2012-01-09 09:11:10 knjuqljsfyyc2vdsnfwgkyleknjuqmskmf3gcxzsgezq2cq.36202-0.id-38592.up.tunnel.testdomain.com
2012-01-09 09:11:10 rejecting request for domain: testdomain.com
2012-01-09 09:11:10 0-36202.id-38592.down.tunnel.testdomain.com
2012-01-09 09:11:10 rejecting request for domain: testdomain.com

SODS Server:
[root@localhost sods]# ./sods -u nobody -g nobody -d /tmp -L 127.0.0.1:22 tunnel.testdomain.com -vvvv

SDT:
./sdt -t CNAME -r 8.8.8.8 -p 22220 -s 0 -vvvv tunnel.testdomain.com

I've used another IP over DNS program (not on the phone) and I found it best to set the "DNS Server" to be the actual server itself, rather than a real DNS server. When I do this with SDT I get a lot more packets through than going via google DNS but I get the same error.

I'm using a Samsung SGS 2 with GB 2.3.5

Hey Chris! For some reason which I haven't qu...

2012-01-07T11:34:10.108-05:00

Hey Chris!

For some reason which I haven't quite worked out yet, sdt on android is a bit flakey, so the first thing to try is rebooting your phone (I know, lame).

Here are some things you can try:

1. It looks as if the end to end connection to your sods server is good since you're seeing packets. Can you run sods in debug mode (sods -vvv) and paste the output here or email it to me? Feel free to sanitize the domain names.

2. Try specifying the IP of the dns server to rule out any problems in between (from an open network):

sdt -r x.x.x.x

3. And to rule out problems with Android, have you tested the tunnel on something besides the phone? What version of Android are you using?

4. Finally, what flags are you passing to sdt and sods?

Thanks!

Hi, I'm trying to get this to work on my phon...

2012-01-06T05:03:14.638-05:00

Hi,

I'm trying to get this to work on my phone but not quite getting it to.

The server side is setup ok as I've run the local test and this worked.

On the phone I get the error "res_search: unknown host" but this makes no sense (to me!) as if I ping the domain from the phone it resolves correctly.

On the SODS server I can see some packets coming through but I don't get connected to the SSH server on the server that SODS is running on.

I've likely made a noobie mistake but cannot work out what it is!

Hi Michael, thank you for your quick and detailed...

2011-11-03T04:02:08.528-04:00

Hi Michael,

thank you for your quick and detailed reply. I shortened down "sshdns" to a single character. Using the "-s" parameter and the session numbers also work as you explained, I can now use multiple services. :-)

Very useful piece of software, thanks a lot! ;-)

Best regards, Sven

Hey Sven! > I managed to get it running for on...

2011-11-02T21:02:55.250-04:00

Hey Sven!

> I managed to get it running for one service (SSH) like this:
>
> server: sods -L 127.0.0.1:22 tun.mydom.com
> client: sdt -t CNAME sshdns.tun.mydom.com
>
> What I would like to do now is run it for two services (HTTPS and SSH). If
> I got it right, I have to use the "-L" switch several times:
>
> sods -L 127.0.0.1:22 -L 127.0.0.1:443 tun.mydom.com

Yup, that's right!

> But: how do I tell the client (sdt) which service to use?

Use the "-s" switch to sdt and the session number. The sessions are
numbered starting from 0, from left to right. So in your example, to
connect to port 22 you would use:

sdt -s 0 -t CNAME sshdns.tun.mydom.com

And to connect to port 443:

sdt -s 1 -t CNAME sshdns.tun.mydom.com

> If I have only one service (https), is it possible to omit the "ssndns"
> prefix? Or is it always necessary?

No, you can use any prefix. I just use a single character to keep the
byte count down, something like s.tun.mydom.com.

> What do the client options "-D" and "-s" do? I read the client's help,
> but I do not understand it.

-s: chooses the session to use (a session is the destination IP/port you want
to proxy). Session 0 is the default.

-D: dynamic forwarding

"-D" is experimental. It lets the client tell the server which IP
address/port it wants to go to. I'm thinking of setting up a service on
a virutal machine somewhere so people won't have to through the hassle
of installing sods and all the DNS entries.

The C version of sods doesn't support dynamic forwarding yet. The version
(in Erlang) that does is here:

https://github.com/msantos/seds

> Sorry for these dumb questions.

Those were great questions, thanks for taking the time to put them
together! And let me know if you run into any other problems.

Hi, thanks for that piece of software! I was alwa...

2011-11-02T04:27:27.646-04:00

Hi,

thanks for that piece of software! I was always searching for a soluting that a) is able to use CNAME and b) is written in C. :-))

I managed to get it running for one service (SSH) like this:

server: sods -L 127.0.0.1:22 tun.mydom.com
client: sdt -t CNAME sshdns.tun.mydom.com

What I would like to do now is run it for two services (HTTPS and SSH). If I got it right, I have to use the "-L" switch several times:

sods -L 127.0.0.1:22 -L 127.0.0.1:443 tun.mydom.com

But: how do I tell the client (sdt) which service to use?

If I have only one service (https), is it possible to omit the "ssndns" prefix? Or is it always necessary?

What do the client options "-D" and "-s" do? I read the client's help, but I do not understand it.

Sorry for these dumb questions.

Best regards, Sven

GOT IT TO WORK :D finally, thanks so much for all ...

2011-07-21T07:50:10.463-04:00

GOT IT TO WORK :D finally, thanks so much for all the help!! :)

if anyone else who wants to run sods on tomato is reading this, i found out you can't "forward" port 53 to the router with the webui (even though it says it's forwarded), you have to do it manually with iptables.

also, tomato rewrites iptables every time you change any settings or reboot, so you have to put this script in the webui (administration->scripts->firewall):

iptables -A wanin -p tcp -m tcp -d 192.168.1.1 --dport 53 -j ACCEPT
iptables -A wanin -p udp -m udp -d 192.168.1.1 --dport 53 -j ACCEPT

and of course, read the instructions above for dnsmasq - you have edit its conf file in the webui as well (advanced -> dhcp/dns)

It seems libresolv in uclibc is just a wrapper and...

2011-07-15T16:59:33.903-04:00

It seems libresolv in uclibc is just a wrapper and isn't needed.

Here are 2 versions without any other dependencies:

https://github.com/downloads/msantos/sods/sods-uclibc-tomato-1.28.bz2

https://github.com/downloads/msantos/sods/sods-uclibc-tomato-1.28-static.bz2

# ./sods ./sods: can't load library 'libre...

2011-07-15T14:39:17.731-04:00

# ./sods
./sods: can't load library 'libresolv.so.0'

:(

So it seems the binary needs to be dynamically lin...

2011-07-15T11:28:00.413-04:00

So it seems the binary needs to be dynamically linked to use getuid().

I recompiled the Tomato toolchain and made some changes to sods to get it to work with uclibc. I was able to use the result on OpenWRT.

Here it is, hope this one works for you!

https://github.com/downloads/msantos/sods/sods-uclibc-tomato-1.28.bz2

i'm sorry, i forgot to mention before that use...

2011-07-14T16:29:31.834-04:00

i'm sorry, i forgot to mention before that user nobody is already added:

# cat /etc/passwd
root:x:0:0:root:/root:/bin/sh
nobody:x:65534:65534:nobody:/dev/null:/dev/null
# cat /etc/group
root:x:0:
nobody:x:65534:
# ./sods -vvvv -u nobody -g nobody -d /tmp -L 127.0.0.1:22 -i 123.123.123.123 sods.domain.com
Forwarded sessions = 1
Forward #0: 127.0.0.1:22
sods: user does not exist: nobody
sods: Could not drop privs

Just add a sods (or nobody) user to /etc/passwd an...

2011-07-14T15:57:50.423-04:00

Just add a sods (or nobody) user to /etc/passwd and a sods group to /etc/group. Also make sure the chroot directory exists (by default /var/chroot/sods). sods changes to an unprivileged user after startup.

Then start sods with the name/group. Something like:

./sods -u sods -g sods

with a /etc/passwd like:

sods:*:4321:4321:sods user:/:/bin/false

And for /etc/group something like:

sods:x:4321:

you are right, i had dnsmasq running... now i adde...

2011-07-14T15:16:00.466-04:00

you are right, i had dnsmasq running... now i added these 2 lines to its conf file:

except-interface=vlan1
bind-interfaces

the bind error seems to be gone now, but now this happens:

# ./sods -vvvv -d /tmp -L 127.0.0.1:22 -i 123.123.123.123 sods.domain.com
Forwarded sessions = 1
Forward #0: 127.0.0.1:22
sods: user does not exist: nobody
sods: Could not drop privs

Awesome. About the bind error: you probably have a...

2011-07-14T12:55:57.800-04:00

Awesome. About the bind error: you probably have another dns server (like dnsmasq) listening on port 53 on all interfaces. dnsmasq only needs to be listening on the LAN side and sods only needs to listen on the WAN side.

I start dnsmasq with the --bind-interfaces option and then start sods with -i $external_ip_address

huge step forward, it runs now! :D however, i get ...

2011-07-14T11:36:41.809-04:00

huge step forward, it runs now! :D however, i get this error when trying to start it:

# ./sods -vvvv -d /tmp -L 127.0.0.1:22 sods.mydomain.com
Forwarded sessions = 1
Forward #0: 127.0.0.1:22
sods: bind(ss->s, (struct sockaddr *)&ss->local, sizeof(ss->local)): Address already in use

And another attempt :) This version is statically ...

2011-07-14T09:28:09.456-04:00

And another attempt :) This version is statically linked:

https://github.com/downloads/msantos/sods/sods-mips-tomato-1.27-static.bz2

Thanks for you patience doing all these tests!

sorry for constantly bothering you... something ve...

2011-07-14T08:54:27.396-04:00

sorry for constantly bothering you... something very strange happens, file not found?! :S

# ls
sods-mips-tomato-1.27
# chmod +x sods-mips-tomato-1.27
# ./sods-mips-tomato-1.27
-sh: ./sods-mips-tomato-1.27: not found

It's a binary, not a shell script. Try: chmo...

2011-07-13T18:06:28.035-04:00

It's a binary, not a shell script. Try:

chmod +x sods
./sods

thanks for compiling it! sadly, it still won't...

2011-07-13T17:45:26.639-04:00

thanks for compiling it! sadly, it still won't work :(, this happens:

# sh sods-mips-tomato-1.27
sods-mips-tomato-1.27: line 1: syntax error: unexpected "("

If you clone the tomato git repository, there'...

2011-07-11T16:24:56.978-04:00

If you clone the tomato git repository, there's a pre-compiled toolchain in tools/bcrm. Copy the toolchain to /opt/bcrm and run:

mipsel-linux-gcc -DHAVE_SEND -o sods sods.c sods_handler.c sods_dns.c sods_io.c sods_q.c sods_sock.c sods_priv.c base32.c base64.c -lresolv

(Doesn't work with uclibc gcc yet, I should fix that some day).

Looked simple, so I compiled a version for tomato and put it here:

https://github.com/downloads/msantos/sods/sods-mips-tomato-1.27.bz2

I don't have tomato installed so let me know if you run into any problems!

thank you for your quick reply! unfortunately i st...

2011-07-11T09:58:18.224-04:00

thank you for your quick reply! unfortunately i still get the same error (User defined signal 1). im pretty new to compiling (ive only been using the automated make command so far), could you give me some suggestions as to how to compile it for tomato?

Try this version: https://github.com/downloads/ms...

2011-07-10T20:52:59.535-04:00

Try this version:

https://github.com/downloads/msantos/sods/sods-mips-wrt54gl-static.bz2

It's statically linked. If it doesn't work, you'll probably need to recompile sods under Tomato.

Very happy to hear sods has been useful for you!

hello! i'm trying to run your compiled versio...

2011-07-10T17:23:43.997-04:00

hello!

i'm trying to run your compiled version (http://github.com/downloads/msantos/sods/sods-mips-wrt54gl.bz2) on my router with tomato 1.28 firmware, but i only get this:

# ./sods 123
User defined signal 1

do you have an idea of what is wrong? :S

and thanks a lot for the program, i've been using it successfully at overpriced hotspots for quite some time now :)