summaryrefslogtreecommitdiff
path: root/src/leap/bitmask/vpn/tunnel.py
blob: d9a8be3d206d32a794a08df28cb65b4ddc310e4d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
# -*- coding: utf-8 -*-
# manager.py
# Copyright (C) 2015 LEAP
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""
VPN Tunnel.
"""

import os
import tempfile

from twisted.internet import reactor, defer
from twisted.logger import Logger

from ._config import _TempVPNConfig, _TempProviderConfig
from .constants import IS_WIN
from .process import VPNProcess


# TODO ----------------- refactor --------------------
# [ ] register change state listener
# emit_async(catalog.VPN_STATUS_CHANGED)
# [ ] catch ping-restart
# 'NETWORK_UNREACHABLE': (
#    'Network is unreachable (code=101)',),
# 'PROCESS_RESTART_TLS': (
#    "SIGTERM[soft,tls-error]",),
# TODO ----------------- refactor --------------------


class ConfiguredTunnel(object):

    """
    A ConfiguredTunne holds the configuration for a VPN connection, and allows
    to control that connection.

    This is the high-level object that the service knows about.
    It exposes the start and terminate methods for the VPN Tunnel.

    On start, it spawns a VPNProcess instance that will use a vpnlauncher
    suited for the running platform and connect to the management interface
    opened by the openvpn process, executing commands over that interface on
    demand.
    """

    log = Logger()

    def __init__(self, provider, remotes, cert_path, key_path, ca_path,
                 extra_flags):
        """
        :param remotes: a list of gateways tuple (ip, port) looking like this:
            ((ip1, portA), (ip2, portB), ...)
        :type remotes: tuple of tuple(str, int)
        """
        self._remotes = remotes
        ports = []

        self._vpnconfig = _TempVPNConfig(extra_flags, cert_path, ports)
        self._providerconfig = _TempProviderConfig(provider, ca_path)

        host, port = _get_management_location()
        self._host = host
        self._port = port
        self._vpnproc = None

    @defer.inlineCallbacks
    def start(self):
        started = yield self._start_vpn()
        defer.returnValue(started)

    @defer.inlineCallbacks
    def stop(self):
        stopped = yield self._stop_vpn(restart=False)
        defer.returnValue(stopped)

    #  status

    @property
    def status(self):
        if not self._vpnproc:
            return {'status': 'off', 'error': None}
        return self._vpnproc.status

    @property
    def traffic_status(self):
        return self._vpnproc.traffic_status

    # VPN Control

    @defer.inlineCallbacks
    def _start_vpn(self):
        self.log.debug('VPN: start')
        args = [self._vpnconfig, self._providerconfig, self._host,
                self._port]
        kwargs = {'openvpn_verb': 4, 'remotes': self._remotes,
                  'restartfun': self._restart_vpn}
        vpnproc = VPNProcess(*args, **kwargs)
        self._vpnproc = vpnproc

        self.__start_pre_up(vpnproc)
        cmd = self.__start_get_cmd(vpnproc)

        running = yield self.__start_spawn_proc(vpnproc, cmd)
        if running:
            vpnproc.pid = running.pid
            defer.returnValue(True)
        else:
            defer.returnValue(False)

    def __start_pre_up(self, proc):
        try:
            proc.preUp()
        except Exception as exc:
            self.log.error('Error on vpn pre-up {0!r}'.format(exc))
            raise

    def __start_get_cmd(self, proc):
        try:
            cmd = proc.getCommand()
        except Exception as exc:
            self.log.error(
                'Error while getting vpn command... {0!r}'.format(exc))
            raise
        return cmd

    def __start_spawn_proc(self, proc, cmd):
        env = os.environ
        try:
            running_p = reactor.spawnProcess(proc, cmd[0], cmd, env)
        except Exception as e:
            self.log.error(
                'Error while spawning vpn process... {0!r}'.format(e))
            return False
        return running_p

    @defer.inlineCallbacks
    def _restart_vpn(self):
        yield self.stop(restart=True)
        reactor.callLater(
            self.RESTART_WAIT, self.start)

    @defer.inlineCallbacks
    def _stop_vpn(self, restart=False):
        """
        Stops the openvpn subprocess.

        Attempts to send a SIGTERM first, and after a timeout
        it sends a SIGKILL.

        :param restart: whether this stop is part of a hard restart.
        :type restart: bool
        """
        # TODO how to return False if this fails
        # XXX maybe return a deferred

        if self._vpnproc is None:
            self.log.debug('Tried to stop VPN but no process found')
            defer.returnValue(False)

        self._vpnproc.restarting = restart
        self.__stop_pre_down(self._vpnproc)
        stopped = yield self._vpnproc.terminate_or_kill()
        defer.returnValue(stopped)

    def __stop_pre_down(self, proc):
        try:
            proc.preDown()
        except Exception as e:
            self.log.error('Error on vpn pre-down {0!r}'.format(e))
            raise


# utils


def _get_management_location():
    """
    Return a tuple with the host (socket) and port to be used for VPN.

    :return: (host, port)
    :rtype: tuple (str, str)
    """
    if IS_WIN:
        host = "localhost"
        port = "9876"
    else:
        host = os.path.join(
            tempfile.mkdtemp(prefix="leap-tmp"), 'openvpn.socket')
        port = "unix"
    return host, port