summaryrefslogtreecommitdiff
path: root/src/leap/bitmask
diff options
context:
space:
mode:
authorKali Kaneko <kali@leap.se>2014-05-07 08:14:01 -0500
committerKali Kaneko <kali@leap.se>2014-05-12 11:25:09 -0500
commitd8d7d2b781aea558d7e39d397a85c15ac9839abb (patch)
treea5a5e50b055d315f8a33a333bd7e1e78aecb5a38 /src/leap/bitmask
parent6d18c78b384dc6624cde25cb41a998587661ffa5 (diff)
tear the firewall down when openvpn is finished
Diffstat (limited to 'src/leap/bitmask')
-rw-r--r--src/leap/bitmask/services/eip/vpnprocess.py24
1 files changed, 21 insertions, 3 deletions
diff --git a/src/leap/bitmask/services/eip/vpnprocess.py b/src/leap/bitmask/services/eip/vpnprocess.py
index beb33db8..c09daf78 100644
--- a/src/leap/bitmask/services/eip/vpnprocess.py
+++ b/src/leap/bitmask/services/eip/vpnprocess.py
@@ -183,7 +183,7 @@ class VPN(object):
logger.info("Another vpn process is running. Will try to stop it.")
vpnproc.stop_if_already_running()
- # XXX we try to bring the firewall up
+ # we try to bring the firewall up
if IS_LINUX:
gateways = vpnproc.getGateways()
firewall_up = self._launch_firewall(gateways)
@@ -226,13 +226,20 @@ class VPN(object):
# XXX could check for wrapper existence, check it's root owned etc.
# XXX could check that the iptables rules are in place.
- print "LAUNCHING FIREWALL --", gateways
-
BM_ROOT = linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT
exitCode = subprocess.call(["pkexec",
BM_ROOT, "firewall", "start"] + gateways)
return True if exitCode is 0 else False
+ def _tear_down_firewall(self):
+ """
+ Tear the firewall down using the privileged wrapper.
+ """
+ BM_ROOT = linuxvpnlauncher.LinuxVPNLauncher.BITMASK_ROOT
+ exitCode = subprocess.call(["pkexec",
+ BM_ROOT, "firewall", "stop"])
+ return True if exitCode is 0 else False
+
def _kill_if_left_alive(self, tries=0):
"""
Check if the process is still alive, and sends a
@@ -245,6 +252,17 @@ class VPN(object):
while tries < self.TERMINATE_MAXTRIES:
if self._vpnproc.transport.pid is None:
logger.debug("Process has been happily terminated.")
+
+ # we try to bring the firewall up
+ # XXX We could keep some state to be sure it was the
+ # user who did turn EIP off.
+ if IS_LINUX:
+ firewall_down = self._tear_down_firewall()
+ if firewall_down:
+ logger.debug("Firewall down")
+ else:
+ logger.warning("Could not tear firewall down")
+
return
else:
logger.debug("Process did not die, waiting...")