summaryrefslogtreecommitdiff
path: root/src/leap/bitmask/vpn
AgeCommit message (Collapse)Author
2018-01-25[feat] get cert automatically on vpn startKali Kaneko
2018-01-16[bug] fix the systemctl runRuben Pollan
2018-01-12[feat] bump bitmask-root versionRuben Pollan
2018-01-12Add Qubes DNS support, fixesChristopher Laprise
2018-01-12Add anti-leak rules for qubes-firewallChristopher Laprise
2018-01-09[bug] fix issues with dns resolution with systemd-resolvedRuben Pollan
In ubuntu 17.10 some changes with systemd-resolved broke our firewall, blocking all DNS queries. The masquerade rules in the firewall, that are used to rewrite the source IP address of the DNS queries, were wrongly modifying the queries to systemd-resolved. Let's apply masquerade only to the packets addressed to the nameserver. - Resolves: #9137
2018-01-08[feat] try other gateways if the main one failsRuben Pollan
Removing '--persist-ip' param on openvpn it will try to connect to a different gateway if the first one fails. This means, that in case of network disconnection for some minutes bitmask will keep rotating between the different gateways and one the network comes back it will not connect anymore to the first one, but to the one that was trying at this moment. - Resolves: #9188
2017-12-21[doc] add note about expected paths to bitmask-root itselfKali Kaneko
I should remember this change when we merge elijah's fix again. Hopefully that happens soon enough.
2017-12-21[bug] temporarily revert dnsmasq firewall fixKali Kaneko
It has been reported that, after this fix, dns leaks happen under some circumstances not yet clear. Preparing for a release, we have decided to revert this change until the problem can be properly triaged. This means a broken vpn aartful support for the time being, but a non-leaking master. https://0xacab.org/leap/bitmask-dev/issues/9137 - Related: #9137
2017-12-20[bug] add lock in command dispatcherKali Kaneko
2017-12-08[docs] add comment about python interpreterKali Kaneko
2017-12-07[feat] update bitmask-root if neededRuben Pollan
Chech the hash of the installed bitmask root and sign as not installed if doesn't match the one we have in the bundle. Also for running bitmask-root, if there is more than one (in /usr/local/sbin and /usr/sbin) run the one with higher version number. - Resolves: #9020
2017-12-05[bug] change bitmask-root to work with dnsmasqelijah
2017-11-30[refactor] use /var/run for osx helper socketKali Kaneko
2017-11-02[style] fix formattingKali Kaneko
2017-11-02[feature] support deepin polkit agentKali Kaneko
-Resolves: #9119
2017-11-01[docs] document systray in changelogKali Kaneko
- Resolves: #9094
2017-11-01[refactor] refactor status objectKali Kaneko
2017-11-01[feature] display vpn status on systrayKali Kaneko
2017-10-25[feat] support pantheon polkit agentKali Kaneko
Apparently, this would allow us to run in Elementary OS. -Resolves: #9076
2017-10-11[style] pep8Kali Kaneko
2017-10-11[bug] import linux specific constants inside if blockkali
2017-10-09[bug] properly check for local openvpn pathKali Kaneko
- Resolves: #9099
2017-10-06[style] pep80.10.1Kali Kaneko
2017-10-06[bug] use sytem-wide bitmask-root, if foundKali Kaneko
we make a distinction between the system-wide bitmask-root, which should be placed there by the maintainers of whatever packages your distribution uses, and the bitmask-root that is placed by the bundles (using polkit). since the bundles copying over the helper from user-writeable folders is a potential attack vector, we prefer to use the package's version if present. also, if we cannot find either, we abort the launching of the VPN. we've discussed that this might move to the service initialization instead, but I think the cases in which this is needed should be rare. I fix also a corner-case in which we were using getcwd() at import time. if you execute code and then remove the installation path, this will raise a traceback in bitmaskctl. I think it's nicer to catch the error properly when starting.
2017-10-03[feat] Update polkit optionsRuben Pollan
2017-09-29[style] pep8Kali Kaneko
2017-09-29[bug] look also from bitmask-root in the debian pathKali Kaneko
2017-09-29[bug] fixes needed to launch vpn on mac after refactorkali
2017-09-29[bug] check for pkexec only in linuxkali
2017-09-29[bug] create /usr/local/sbin folder if it does not existKali Kaneko
- Resolves: #9084
2017-09-20[feat] detect if pkexec is present in the systemRuben Pollan
Check it before starting the vpn. - Resolves: #8895
2017-09-20[bug] flag vpn_ready == false if cert expiredRuben Pollan
We were not renewing the vpn cert. Now the UI will trigger a cert renewal by telling it that is the vpn is not ready if the cert is expired. - Resolves: #9059
2017-09-15[feat] wait up to 20 seconds for polkit to be launchedRuben Pollan
- Related: #9012
2017-09-15[refactor] remove unused 'is_missing_policy_permissions'Ruben Pollan
2017-09-15[feat] add --nodaemon param to polkit_agentRuben Pollan
2017-09-15[docs] having the polkits to try in a list sets already a prio to themRuben Pollan
2017-09-15[feat] use psutil to discover polkit processRuben Pollan
Better psutil than ps+grep.
2017-09-15[bug] get the VPN restart working againRuben Pollan
Don't persist-tun on the vpn, so it can restart properly. Also let's match better the options that are sent and taken into account from bitmask-root. - Resolves: #9048
2017-09-10[bug] add the error as an upper level attribute of the dictKali Kaneko
the UI is expecting it there, not inside the result data. we probably could delete it from the later.
2017-09-10[bug] avoid bogus failed statusKali Kaneko
there was an exception catched, AttributeError, that showed up as a transient "failed" state. - Resolves: #9044
2017-09-10[bug] mark vpn as failed if it had some problem startingKali Kaneko
2017-09-10[bug] fix policykit helper pathsKali Kaneko
the debian package was failing because of a bad polkit policy file name.
2017-08-31[feat] expose an API to set/get/list gateway preferencesRuben Pollan
- Related: #9010
2017-08-31[feat] list vpn gateways in the order that they are going to be usedRuben Pollan
2017-08-31[refactor] make the VPN location formating in the cliRuben Pollan
2017-08-30[refactor] remove verbose debug infoKali Kaneko
2017-08-30[bug] catch data tuple with len 5Kali Kaneko
2017-08-30[bug] fix typo in logger usageKali Kaneko
2017-08-30[bug] add initial ts assignmentKali Kaneko