Merge branch 'develop' of ssh://code.leap.se/leap_client into develop

10 files changed, 682 insertions, 460 deletions

diff --git a/src/leap/eip/checks.py b/src/leap/eip/checks.py
index 116c535e..9ae6e5f5 100644
--- a/src/leap/eip/checks.py
+++ b/src/leap/eip/checks.py
@@ -84,8 +84,7 @@ class ProviderCertChecker(object):
         # For MVS
         checker.is_there_provider_ca()
 
-        # XXX FAKE IT!!!
-        checker.is_https_working(verify=do_verify, autocacert=True)
+        checker.is_https_working(verify=do_verify, autocacert=False)
         checker.check_new_cert_needed(verify=do_verify)
 
     def download_ca_cert(self, uri=None, verify=True):
@@ -160,7 +159,6 @@ class ProviderCertChecker(object):
         if autocacert and verify is True and self.cacert is not None:
             logger.debug('verify cert: %s', self.cacert)
             verify = self.cacert
-        #import pdb4qt; pdb4qt.set_trace()
         logger.debug('is https working?')
         logger.debug('uri: %s (verify:%s)', uri, verify)
         try:
@@ -242,7 +240,9 @@ class ProviderCertChecker(object):
             raise
         try:
             pemfile_content = req.content
-            self.is_valid_pemfile(pemfile_content)
+            valid = self.is_valid_pemfile(pemfile_content)
+            if not valid:
+                return False
             cert_path = self._get_client_cert_path()
             self.write_cert(pemfile_content, to=cert_path)
         except:
@@ -276,7 +276,10 @@ class ProviderCertChecker(object):
         cert = gnutls.crypto.X509Certificate(cert_s)
         from_ = time.gmtime(cert.activation_time)
         to_ = time.gmtime(cert.expiration_time)
+        # FIXME BUG ON LEAP_CLI, certs are not valid on gmtime
+        # See #1153
         return from_ < now() < to_
+        #return now() < to_
 
     def is_valid_pemfile(self, cert_s=None):
         """
@@ -291,22 +294,11 @@ class ProviderCertChecker(object):
             with open(certfile) as cf:
                 cert_s = cf.read()
         try:
-            # XXX get a real cert validation
-            # so far this is only checking begin/end
-            # delimiters :)
-            # XXX use gnutls for get proper
-            # validation.
-            # crypto.X509Certificate(cert_s)
-            sep = "-" * 5 + "BEGIN CERTIFICATE" + "-" * 5
-            # we might have private key and cert in the same file
-            certparts = cert_s.split(sep)
-            if len(certparts) > 1:
-                cert_s = sep + certparts[1]
-            ssl.PEM_cert_to_DER_cert(cert_s)
-        except:
-            # XXX raise proper exception
-            raise
-        return True
+            valid = certs.can_load_cert_and_pkey(cert_s)
+        except certs.BadCertError:
+            logger.warning("Not valid pemfile")
+            valid = False
+        return valid
 
     @property
     def ca_cert_path(self):
@@ -427,6 +419,7 @@ class EIPConfigChecker(object):
         return True
 
     def fetch_definition(self, skip_download=False,
+                         force_download=False,
                          config=None, uri=None,
                          domain=None):
         """
@@ -459,6 +452,7 @@ class EIPConfigChecker(object):
         self.defaultprovider.save()
 
     def fetch_eip_service_config(self, skip_download=False,
+                                 force_download=False,
                                  config=None, uri=None, domain=None):
         if skip_download:
             return True
@@ -469,7 +463,10 @@ class EIPConfigChecker(object):
                 domain = self.domain or config.get('provider', None)
             uri = self._get_eip_service_uri(domain=domain)
 
-        self.eipserviceconfig.load(from_uri=uri, fetcher=self.fetcher)
+        self.eipserviceconfig.load(
+            from_uri=uri,
+            fetcher=self.fetcher,
+            force_download=force_download)
         self.eipserviceconfig.save()
 
     def check_complete_eip_config(self, config=None):
@@ -497,7 +494,7 @@ class EIPConfigChecker(object):
         return self.eipconfig.exists()
 
     def _dump_default_eipconfig(self):
-        self.eipconfig.save()
+        self.eipconfig.save(force=True)
 
     def _get_provider_definition_uri(self, domain=None, path=None):
         if domain is None:
diff --git a/src/leap/eip/config.py b/src/leap/eip/config.py
index 42c00380..48e6e9a7 100644
--- a/src/leap/eip/config.py
+++ b/src/leap/eip/config.py
@@ -1,10 +1,12 @@
 import logging
 import os
 import platform
+import re
 import tempfile
 
 from leap import __branding as BRANDING
 from leap import certs
+from leap.util.misc import null_check
 from leap.util.fileutil import (which, mkdir_p, check_and_fix_urw_only)
 
 from leap.base import config as baseconfig
@@ -53,53 +55,80 @@ def get_socket_path():
     socket_path = os.path.join(
         tempfile.mkdtemp(prefix="leap-tmp"),
         'openvpn.socket')
-    logger.debug('socket path: %s', socket_path)
+    #logger.debug('socket path: %s', socket_path)
     return socket_path
 
 
-def get_eip_gateway(provider=None):
+def get_eip_gateway(eipconfig=None, eipserviceconfig=None):
     """
     return the first host in eip service config
     that matches the name defined in the eip.json config
     file.
     """
-    placeholder = "testprovider.example.org"
-    # XXX check for null on provider??
+    # XXX eventually we should move to a more clever
+    # gateway selection. maybe we could return
+    # all gateways that match our cluster.
+
+    null_check(eipconfig, "eipconfig")
+    null_check(eipserviceconfig, "eipserviceconfig")
+    PLACEHOLDER = "testprovider.example.org"
 
-    eipconfig = EIPConfig(domain=provider)
-    eipconfig.load()
     conf = eipconfig.config
+    eipsconf = eipserviceconfig.config
 
     primary_gateway = conf.get('primary_gateway', None)
     if not primary_gateway:
-        return placeholder
+        return PLACEHOLDER
 
-    eipserviceconfig = EIPServiceConfig(domain=provider)
-    eipserviceconfig.load()
-    eipsconf = eipserviceconfig.get_config()
     gateways = eipsconf.get('gateways', None)
     if not gateways:
         logger.error('missing gateways in eip service config')
-        return placeholder
+        return PLACEHOLDER
+
     if len(gateways) > 0:
         for gw in gateways:
-            name = gw.get('name', None)
-            if not name:
+            clustername = gw.get('cluster', None)
+            if not clustername:
+                logger.error('no cluster name')
                 return
 
-            if name == primary_gateway:
-                hosts = gw.get('hosts', None)
-                if not hosts:
-                    logger.error('no hosts')
+            if clustername == primary_gateway:
+                # XXX at some moment, we must
+                # make this a more generic function,
+                # and return ports, protocols...
+                ipaddress = gw.get('ip_address', None)
+                if not ipaddress:
+                    logger.error('no ip_address')
                     return
-                if len(hosts) > 0:
-                    return hosts[0]
-                else:
-                    logger.error('no hosts')
+                return ipaddress
     logger.error('could not find primary gateway in provider'
                  'gateway list')
 
 
+def get_cipher_options(eipserviceconfig=None):
+    """
+    gathers optional cipher options from eip-service config.
+    :param eipserviceconfig: EIPServiceConfig instance
+    """
+    null_check(eipserviceconfig, 'eipserviceconfig')
+    eipsconf = eipserviceconfig.get_config()
+
+    ALLOWED_KEYS = ("auth", "cipher", "tls-cipher")
+    CIPHERS_REGEX = re.compile("[A-Z0-9\-]+")
+    opts = []
+    if 'openvpn_configuration' in eipsconf:
+        config = eipserviceconfig.config.get(
+            "openvpn_configuration", {})
+        for key, value in config.items():
+            if key in ALLOWED_KEYS and value is not None:
+                sanitized_val = CIPHERS_REGEX.findall(value)
+                if len(sanitized_val) != 0:
+                    _val = sanitized_val[0]
+                    opts.append('--%s' % key)
+                    opts.append('%s' % _val)
+    return opts
+
+
 def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
     """
     build a list of options
@@ -116,6 +145,10 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
     # things from there if present.
 
     provider = kwargs.pop('provider', None)
+    eipconfig = EIPConfig(domain=provider)
+    eipconfig.load()
+    eipserviceconfig = EIPServiceConfig(domain=provider)
+    eipserviceconfig.load()
 
     # get user/group name
     # also from config.
@@ -137,11 +170,17 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
         opts.append('--verb')
         opts.append("%s" % verbosity)
 
-    # remote
+    # remote ##############################
+    # (server, port, protocol)
+
     opts.append('--remote')
-    gw = get_eip_gateway(provider=provider)
+
+    gw = get_eip_gateway(eipconfig=eipconfig,
+                         eipserviceconfig=eipserviceconfig)
     logger.debug('setting eip gateway to %s', gw)
     opts.append(str(gw))
+
+    # get port/protocol from eipservice too
     opts.append('1194')
     #opts.append('80')
     opts.append('udp')
@@ -150,6 +189,13 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
     opts.append('--remote-cert-tls')
     opts.append('server')
 
+    # get ciphers #######################
+
+    ciphers = get_cipher_options(
+        eipserviceconfig=eipserviceconfig)
+    for cipheropt in ciphers:
+        opts.append(str(cipheropt))
+
     # set user and group
     opts.append('--user')
     opts.append('%s' % user)
diff --git a/src/leap/eip/eipconnection.py b/src/leap/eip/eipconnection.py
index 7828c864..27734f80 100644
--- a/src/leap/eip/eipconnection.py
+++ b/src/leap/eip/eipconnection.py
@@ -5,6 +5,9 @@ from __future__ import (absolute_import,)
 import logging
 import Queue
 import sys
+import time
+
+from dateutil.parser import parse as dateparse
 
 from leap.eip.checks import ProviderCertChecker
 from leap.eip.checks import EIPConfigChecker
@@ -15,20 +18,142 @@ from leap.eip.openvpnconnection import OpenVPNConnection
 logger = logging.getLogger(name=__name__)
 
 
-class EIPConnection(OpenVPNConnection):
+class StatusMixIn(object):
+
+    # a bunch of methods related with querying the connection
+    # state/status and displaying useful info.
+    # Needs to get clear on what is what, and
+    # separate functions.
+    # Should separate EIPConnectionStatus (self.status)
+    # from the OpenVPN state/status command and parsing.
+
+    def connection_state(self):
+        """
+        returns the current connection state
+        """
+        return self.status.current
+
+    def get_icon_name(self):
+        """
+        get icon name from status object
+        """
+        return self.status.get_state_icon()
+
+    def get_leap_status(self):
+        return self.status.get_leap_status()
+
+    def poll_connection_state(self):
+        """
+        """
+        try:
+            state = self.get_connection_state()
+        except eip_exceptions.ConnectionRefusedError:
+            # connection refused. might be not ready yet.
+            logger.warning('connection refused')
+            return
+        if not state:
+            logger.debug('no state')
+            return
+        (ts, status_step,
+         ok, ip, remote) = state
+        self.status.set_vpn_state(status_step)
+        status_step = self.status.get_readable_status()
+        return (ts, status_step, ok, ip, remote)
+
+    def make_error(self):
+        """
+        capture error and wrap it in an
+        understandable format
+        """
+        # mostly a hack to display errors in the debug UI
+        # w/o breaking the polling.
+        #XXX get helpful error codes
+        self.with_errors = True
+        now = int(time.time())
+        return '%s,LAUNCHER ERROR,ERROR,-,-' % now
+
+    def state(self):
+        """
+        Sends OpenVPN command: state
+        """
+        state = self._send_command("state")
+        if not state:
+            return None
+        if isinstance(state, str):
+            return state
+        if isinstance(state, list):
+            if len(state) == 1:
+                return state[0]
+            else:
+                return state[-1]
+
+    def vpn_status(self):
+        """
+        OpenVPN command: status
+        """
+        status = self._send_command("status")
+        return status
+
+    def vpn_status2(self):
+        """
+        OpenVPN command: last 2 statuses
+        """
+        return self._send_command("status 2")
+
+    #
+    # parse  info as the UI expects
+    #
+
+    def get_status_io(self):
+        status = self.vpn_status()
+        if isinstance(status, str):
+            lines = status.split('\n')
+        if isinstance(status, list):
+            lines = status
+        try:
+            (header, when, tun_read, tun_write,
+             tcp_read, tcp_write, auth_read) = tuple(lines)
+        except ValueError:
+            return None
+
+        when_ts = dateparse(when.split(',')[1]).timetuple()
+        sep = ','
+        # XXX clean up this!
+        tun_read = tun_read.split(sep)[1]
+        tun_write = tun_write.split(sep)[1]
+        tcp_read = tcp_read.split(sep)[1]
+        tcp_write = tcp_write.split(sep)[1]
+        auth_read = auth_read.split(sep)[1]
+
+        # XXX this could be a named tuple. prettier.
+        return when_ts, (tun_read, tun_write, tcp_read, tcp_write, auth_read)
+
+    def get_connection_state(self):
+        state = self.state()
+        if state is not None:
+            ts, status_step, ok, ip, remote = state.split(',')
+            ts = time.gmtime(float(ts))
+            # XXX this could be a named tuple. prettier.
+            return ts, status_step, ok, ip, remote
+
+
+class EIPConnection(OpenVPNConnection, StatusMixIn):
     """
+    Aka conductor.
     Manages the execution of the OpenVPN process, auto starts, monitors the
     network connection, handles configuration, fixes leaky hosts, handles
     errors, etc.
     Status updates (connected, bandwidth, etc) are signaled to the GUI.
     """
 
+    # XXX change name to EIPConductor ??
+
     def __init__(self,
                  provider_cert_checker=ProviderCertChecker,
                  config_checker=EIPConfigChecker,
                  *args, **kwargs):
-        self.settingsfile = kwargs.get('settingsfile', None)
-        self.logfile = kwargs.get('logfile', None)
+        #self.settingsfile = kwargs.get('settingsfile', None)
+        #self.logfile = kwargs.get('logfile', None)
         self.provider = kwargs.pop('provider', None)
         self._providercertchecker = provider_cert_checker
         self._configchecker = config_checker
@@ -48,11 +173,27 @@ class EIPConnection(OpenVPNConnection):
 
         super(EIPConnection, self).__init__(*args, **kwargs)
 
+    def connect(self):
+        """
+        entry point for connection process
+        """
+        # in OpenVPNConnection
+        self.try_openvpn_connection()
+
+    def disconnect(self, shutdown=False):
+        """
+        disconnects client
+        """
+        self.terminate_openvpn_connection(shutdown=shutdown)
+        self.status.change_to(self.status.DISCONNECTED)
+
     def has_errors(self):
         return True if self.error_queue.qsize() != 0 else False
 
     def init_checkers(self):
-        # initialize checkers
+        """
+        initialize checkers
+        """
         self.provider_cert_checker = self._providercertchecker(
             domain=self.provider)
         self.config_checker = self._configchecker(domain=self.provider)
@@ -101,96 +242,6 @@ class EIPConnection(OpenVPNConnection):
         except Exception as exc:
             push_err(exc)
 
-    def connect(self):
-        """
-        entry point for connection process
-        """
-        #self.forget_errors()
-        self._try_connection()
-
-    def disconnect(self):
-        """
-        disconnects client
-        """
-        self.cleanup()
-        logger.debug("disconnect: clicked.")
-        self.status.change_to(self.status.DISCONNECTED)
-
-    #def shutdown(self):
-        #"""
-        #shutdown and quit
-        #"""
-        #self.desired_con_state = self.status.DISCONNECTED
-
-    def connection_state(self):
-        """
-        returns the current connection state
-        """
-        return self.status.current
-
-    def poll_connection_state(self):
-        """
-        """
-        try:
-            state = self.get_connection_state()
-        except eip_exceptions.ConnectionRefusedError:
-            # connection refused. might be not ready yet.
-            logger.warning('connection refused')
-            return
-        if not state:
-            logger.debug('no state')
-            return
-        (ts, status_step,
-         ok, ip, remote) = state
-        self.status.set_vpn_state(status_step)
-        status_step = self.status.get_readable_status()
-        return (ts, status_step, ok, ip, remote)
-
-    def get_icon_name(self):
-        """
-        get icon name from status object
-        """
-        return self.status.get_state_icon()
-
-    def get_leap_status(self):
-        return self.status.get_leap_status()
-
-    #
-    # private methods
-    #
-
-    #def _disconnect(self):
-    #    """
-    #    private method for disconnecting
-    #    """
-    #    if self.subp is not None:
-    #        logger.debug('disconnecting...')
-    #        self.subp.terminate()
-    #        self.subp = None
-
-    #def _is_alive(self):
-        #"""
-        #don't know yet
-        #"""
-        #pass
-
-    def _connect(self):
-        """
-        entry point for connection cascade methods.
-        """
-        try:
-            conn_result = self._try_connection()
-        except eip_exceptions.UnrecoverableError as except_msg:
-            logger.error("FATAL: %s" % unicode(except_msg))
-            conn_result = self.status.UNRECOVERABLE
-
-        # XXX enqueue exceptions themselves instead?
-        except Exception as except_msg:
-            self.error_queue.append(except_msg)
-            logger.error("Failed Connection: %s" %
-                         unicode(except_msg))
-        return conn_result
-
 
 class EIPConnectionStatus(object):
     """
diff --git a/src/leap/eip/openvpnconnection.py b/src/leap/eip/openvpnconnection.py
index 859378c0..c2dc71a6 100644
--- a/src/leap/eip/openvpnconnection.py
+++ b/src/leap/eip/openvpnconnection.py
@@ -7,7 +7,6 @@ import os
 import psutil
 import shutil
 import socket
-import time
 from functools import partial
 
 logger = logging.getLogger(name=__name__)
@@ -20,12 +19,123 @@ from leap.eip import config as eip_config
 from leap.eip import exceptions as eip_exceptions
 
 
-class OpenVPNConnection(Connection):
+class OpenVPNManagement(object):
+
+    # TODO explain a little bit how management interface works
+    # and our telnet interface with support for unix sockets.
+
+    """
+    for more information, read openvpn management notes.
+    zcat `dpkg -L openvpn | grep management`
+    """
+
+    def _connect_to_management(self):
+        """
+        Connect to openvpn management interface
+        """
+        if hasattr(self, 'tn'):
+            self._close_management_socket()
+        self.tn = UDSTelnet(self.host, self.port)
+
+        # XXX make password optional
+        # specially for win. we should generate
+        # the pass on the fly when invoking manager
+        # from conductor
+
+        #self.tn.read_until('ENTER PASSWORD:', 2)
+        #self.tn.write(self.password + '\n')
+        #self.tn.read_until('SUCCESS:', 2)
+        if self.tn:
+            self._seek_to_eof()
+        return True
+
+    def _close_management_socket(self, announce=True):
+        """
+        Close connection to openvpn management interface
+        """
+        logger.debug('closing socket')
+        if announce:
+            self.tn.write("quit\n")
+            self.tn.read_all()
+        self.tn.get_socket().close()
+        del self.tn
+
+    def _seek_to_eof(self):
+        """
+        Read as much as available. Position seek pointer to end of stream
+        """
+        try:
+            b = self.tn.read_eager()
+        except EOFError:
+            logger.debug("Could not read from socket. Assuming it died.")
+            return
+        while b:
+            try:
+                b = self.tn.read_eager()
+            except EOFError:
+                logger.debug("Could not read from socket. Assuming it died.")
+
+    def _send_command(self, cmd):
+        """
+        Send a command to openvpn and return response as list
+        """
+        if not self.connected():
+            try:
+                self._connect_to_management()
+            except eip_exceptions.MissingSocketError:
+                logger.warning('missing management socket')
+                return []
+        try:
+            if hasattr(self, 'tn'):
+                self.tn.write(cmd + "\n")
+        except socket.error:
+            logger.error('socket error')
+            self._close_management_socket(announce=False)
+            return []
+        buf = self.tn.read_until(b"END", 2)
+        self._seek_to_eof()
+        blist = buf.split('\r\n')
+        if blist[-1].startswith('END'):
+            del blist[-1]
+            return blist
+        else:
+            return []
+
+    def _send_short_command(self, cmd):
+        """
+        parse output from commands that are
+        delimited by "success" instead
+        """
+        if not self.connected():
+            self.connect()
+        self.tn.write(cmd + "\n")
+        # XXX not working?
+        buf = self.tn.read_until(b"SUCCESS", 2)
+        self._seek_to_eof()
+        blist = buf.split('\r\n')
+        return blist
+
+    #
+    # random maybe useful vpn commands
+    #
+
+    def pid(self):
+        #XXX broken
+        return self._send_short_command("pid")
+
+
+class OpenVPNConnection(Connection, OpenVPNManagement):
     """
     All related to invocation
-    of the openvpn binary
+    of the openvpn binary.
+    It's extended by EIPConnection.
     """
 
+    # XXX Inheriting from Connection was an early design idea
+    # but currently that's an empty class.
+    # We can get rid of that if we don't use it for sharing
+    # state with other leap modules.
+
     def __init__(self,
                  watcher_cb=None,
                  debug=False,
@@ -34,24 +144,21 @@ class OpenVPNConnection(Connection):
                  password=None,
                  *args, **kwargs):
         """
-        :param config_file: configuration file to read from
         :param watcher_cb: callback to be \
 called for each line in watched stdout
         :param signal_map: dictionary of signal names and callables \
 to be triggered for each one of them.
-        :type config_file: str
         :type watcher_cb: function
         :type signal_map: dict
         """
         #XXX FIXME
         #change watcher_cb to line_observer
+        # XXX if not host: raise ImproperlyConfigured
 
         logger.debug('init openvpn connection')
         self.debug = debug
-        # XXX if not host: raise ImproperlyConfigured
         self.ovpn_verbosity = kwargs.get('ovpn_verbosity', None)
 
-        #self.config_file = config_file
         self.watcher_cb = watcher_cb
         #self.signal_maps = signal_maps
 
@@ -62,21 +169,13 @@ to be triggered for each one of them.
         self.port = None
         self.proto = None
 
-        #XXX workaround for signaling
-        #the ui that we don't know how to
-        #manage a connection error
-        #self.with_errors = False
-
         self.command = None
         self.args = None
 
         # XXX get autostart from config
         self.autostart = True
 
-        #
-        # management init methods
-        #
-
+        # management interface init
         self.host = host
         if isinstance(port, str) and port.isdigit():
             port = int(port)
@@ -88,101 +187,47 @@ to be triggered for each one of them.
         self.password = password
 
     def run_openvpn_checks(self):
+        """
+        runs check needed before launching
+        openvpn subprocess. will raise if errors found.
+        """
         logger.debug('running openvpn checks')
+        # XXX I think that "check_if_running" should be called
+        # from try openvpn connection instead. -- kali.
+        # let's prepare tests for that before changing it...
         self._check_if_running_instance()
         self._set_ovpn_command()
         self._check_vpn_keys()
 
-    def _set_ovpn_command(self):
-        # XXX check also for command-line --command flag
-        try:
-            command, args = eip_config.build_ovpn_command(
-                provider=self.provider,
-                debug=self.debug,
-                socket_path=self.host,
-                ovpn_verbosity=self.ovpn_verbosity)
-        except eip_exceptions.EIPNoPolkitAuthAgentAvailable:
-            command = args = None
-            raise
-        except eip_exceptions.EIPNoPkexecAvailable:
-            command = args = None
-            raise
-
-        # XXX if not command, signal error.
-        self.command = command
-        self.args = args
-
-    def _check_vpn_keys(self):
-        """
-        checks for correct permissions on vpn keys
-        """
-        try:
-            eip_config.check_vpn_keys(provider=self.provider)
-        except eip_exceptions.EIPInitBadKeyFilePermError:
-            logger.error('Bad VPN Keys permission!')
-            # do nothing now
-        # and raise the rest ...
-
-    def _launch_openvpn(self):
-        """
-        invocation of openvpn binaries in a subprocess.
-        """
-        #XXX TODO:
-        #deprecate watcher_cb,
-        #use _only_ signal_maps instead
-
-        logger.debug('_launch_openvpn called')
-        if self.watcher_cb is not None:
-            linewrite_callback = self.watcher_cb
-        else:
-            #XXX get logger instead
-            linewrite_callback = lambda line: print('watcher: %s' % line)
-
-        # the partial is not
-        # being applied now because we're not observing the process
-        # stdout like we did in the early stages. but I leave it
-        # here since it will be handy for observing patterns in the
-        # thru-the-manager updates (with regex)
-        observers = (linewrite_callback,
-                     partial(lambda con_status, line: None, self.status))
-        subp, watcher = spawn_and_watch_process(
-            self.command,
-            self.args,
-            observers=observers)
-        self.subp = subp
-        self.watcher = watcher
-
-    def _try_connection(self):
+    def try_openvpn_connection(self):
         """
         attempts to connect
         """
+        # XXX should make public method
         if self.command is None:
             raise eip_exceptions.EIPNoCommandError
         if self.subp is not None:
             logger.debug('cowardly refusing to launch subprocess again')
+            # XXX this is not returning ???!!
+            # FIXME -- so it's calling it all the same!!
 
         self._launch_openvpn()
 
-    def _check_if_running_instance(self):
+    def connected(self):
         """
-        check if openvpn is already running
+        Returns True if connected
+        rtype: bool
         """
-        for process in psutil.get_process_list():
-            if process.name == "openvpn":
-                logger.debug('an openvpn instance is already running.')
-                logger.debug('attempting to stop openvpn instance.')
-                if not self._stop():
-                    raise eip_exceptions.OpenVPNAlreadyRunning
-
-        logger.debug('no openvpn instance found.')
+        # XXX make a property
+        return hasattr(self, 'tn')
 
-    def cleanup(self):
+    def terminate_openvpn_connection(self, shutdown=False):
         """
         terminates openvpn child subprocess
         """
         if self.subp:
             try:
-                self._stop()
+                self._stop_openvpn()
             except eip_exceptions.ConnectionRefusedError:
                 logger.warning(
                     'unable to send sigterm signal to openvpn: '
@@ -201,9 +246,10 @@ to be triggered for each one of them.
                     'cannot terminate subprocess! Retcode %s'
                     '(We might have left openvpn running)' % RETCODE)
 
-        self.cleanup_tempfiles()
+        if shutdown:
+            self._cleanup_tempfiles()
 
-    def cleanup_tempfiles(self):
+    def _cleanup_tempfiles(self):
         """
         remove all temporal files
         we might have left behind
@@ -223,172 +269,93 @@ to be triggered for each one of them.
                 except OSError:
                     logger.error('could not delete tmpfolder %s' % tempfolder)
 
-    def _get_openvpn_process(self):
-        # plist = [p for p in psutil.get_process_list() if p.name == "openvpn"]
-        # return plist[0] if plist else None
-        for process in psutil.get_process_list():
-            if process.name == "openvpn":
-                return process
-        return None
+    # checks
 
-    # management methods
-    #
-    # XXX REVIEW-ME
-    # REFACTOR INFO: (former "manager".
-    # Can we move to another
-    # base class to test independently?)
-    #
-
-    #def forget_errors(self):
-        #logger.debug('forgetting errors')
-        #self.with_errors = False
-
-    def connect_to_management(self):
-        """Connect to openvpn management interface"""
-        #logger.debug('connecting socket')
-        if hasattr(self, 'tn'):
-            self.close()
-        self.tn = UDSTelnet(self.host, self.port)
-
-        # XXX make password optional
-        # specially for win. we should generate
-        # the pass on the fly when invoking manager
-        # from conductor
-
-        #self.tn.read_until('ENTER PASSWORD:', 2)
-        #self.tn.write(self.password + '\n')
-        #self.tn.read_until('SUCCESS:', 2)
-        if self.tn:
-            self._seek_to_eof()
-        return True
-
-    def _seek_to_eof(self):
+    def _check_if_running_instance(self):
         """
-        Read as much as available. Position seek pointer to end of stream
+        check if openvpn is already running
         """
         try:
-            b = self.tn.read_eager()
-        except EOFError:
-            logger.debug("Could not read from socket. Assuming it died.")
-            return
-        while b:
-            try:
-                b = self.tn.read_eager()
-            except EOFError:
-                logger.debug("Could not read from socket. Assuming it died.")
+            for process in psutil.get_process_list():
+                if process.name == "openvpn":
+                    logger.debug('an openvpn instance is already running.')
+                    logger.debug('attempting to stop openvpn instance.')
+                    if not self._stop_openvpn():
+                        raise eip_exceptions.OpenVPNAlreadyRunning
 
-    def connected(self):
-        """
-        Returns True if connected
-        rtype: bool
-        """
-        return hasattr(self, 'tn')
+        except psutil.error.NoSuchProcess:
+            logger.debug('detected a process which died. passing.')
 
-    def close(self, announce=True):
-        """
-        Close connection to openvpn management interface
-        """
-        logger.debug('closing socket')
-        if announce:
-            self.tn.write("quit\n")
-            self.tn.read_all()
-        self.tn.get_socket().close()
-        del self.tn
+        logger.debug('no openvpn instance found.')
 
-    def _send_command(self, cmd):
-        """
-        Send a command to openvpn and return response as list
-        """
-        if not self.connected():
-            try:
-                self.connect_to_management()
-            except eip_exceptions.MissingSocketError:
-                logger.warning('missing management socket')
-                return []
+    def _set_ovpn_command(self):
         try:
-            if hasattr(self, 'tn'):
-                self.tn.write(cmd + "\n")
-        except socket.error:
-            logger.error('socket error')
-            self.close(announce=False)
-            return []
-        buf = self.tn.read_until(b"END", 2)
-        self._seek_to_eof()
-        blist = buf.split('\r\n')
-        if blist[-1].startswith('END'):
-            del blist[-1]
-            return blist
-        else:
-            return []
-
-    def _send_short_command(self, cmd):
-        """
-        parse output from commands that are
-        delimited by "success" instead
-        """
-        if not self.connected():
-            self.connect()
-        self.tn.write(cmd + "\n")
-        # XXX not working?
-        buf = self.tn.read_until(b"SUCCESS", 2)
-        self._seek_to_eof()
-        blist = buf.split('\r\n')
-        return blist
-
-    #
-    # useful vpn commands
-    #
+            command, args = eip_config.build_ovpn_command(
+                provider=self.provider,
+                debug=self.debug,
+                socket_path=self.host,
+                ovpn_verbosity=self.ovpn_verbosity)
+        except eip_exceptions.EIPNoPolkitAuthAgentAvailable:
+            command = args = None
+            raise
+        except eip_exceptions.EIPNoPkexecAvailable:
+            command = args = None
+            raise
 
-    def pid(self):
-        #XXX broken
-        return self._send_short_command("pid")
+        # XXX if not command, signal error.
+        self.command = command
+        self.args = args
 
-    def make_error(self):
+    def _check_vpn_keys(self):
         """
-        capture error and wrap it in an
-        understandable format
+        checks for correct permissions on vpn keys
         """
-        #XXX get helpful error codes
-        self.with_errors = True
-        now = int(time.time())
-        return '%s,LAUNCHER ERROR,ERROR,-,-' % now
+        try:
+            eip_config.check_vpn_keys(provider=self.provider)
+        except eip_exceptions.EIPInitBadKeyFilePermError:
+            logger.error('Bad VPN Keys permission!')
+            # do nothing now
+        # and raise the rest ...
 
-    def state(self):
-        """
-        OpenVPN command: state
-        """
-        state = self._send_command("state")
-        if not state:
-            return None
-        if isinstance(state, str):
-            return state
-        if isinstance(state, list):
-            if len(state) == 1:
-                return state[0]
-            else:
-                return state[-1]
+    # starting and stopping openvpn subprocess
 
-    def vpn_status(self):
+    def _launch_openvpn(self):
         """
-        OpenVPN command: status
+        invocation of openvpn binaries in a subprocess.
         """
-        #logger.debug('status called')
-        status = self._send_command("status")
-        return status
+        #XXX TODO:
+        #deprecate watcher_cb,
+        #use _only_ signal_maps instead
 
-    def vpn_status2(self):
-        """
-        OpenVPN command: last 2 statuses
-        """
-        return self._send_command("status 2")
+        logger.debug('_launch_openvpn called')
+        if self.watcher_cb is not None:
+            linewrite_callback = self.watcher_cb
+        else:
+            #XXX get logger instead
+            linewrite_callback = lambda line: print('watcher: %s' % line)
 
-    def _stop(self):
+        # the partial is not
+        # being applied now because we're not observing the process
+        # stdout like we did in the early stages. but I leave it
+        # here since it will be handy for observing patterns in the
+        # thru-the-manager updates (with regex)
+        observers = (linewrite_callback,
+                     partial(lambda con_status, line: None, self.status))
+        subp, watcher = spawn_and_watch_process(
+            self.command,
+            self.args,
+            observers=observers)
+        self.subp = subp
+        self.watcher = watcher
+
+    def _stop_openvpn(self):
         """
         stop openvpn process
         by sending SIGTERM to the management
         interface
         """
-        logger.debug("disconnecting...")
+        # XXX method a bit too long, split
+        logger.debug("terminating openvpn process...")
         if self.connected():
             try:
                 self._send_command("signal SIGTERM\n")
@@ -407,8 +374,9 @@ to be triggered for each one of them.
             logger.debug('process :%s' % process)
             cmdline = process.cmdline
 
-            if isinstance(cmdline, list):
-                _index = cmdline.index("--management")
+            manag_flag = "--management"
+            if isinstance(cmdline, list) and manag_flag in cmdline:
+                _index = cmdline.index(manag_flag)
                 self.host = cmdline[_index + 1]
                 self._send_command("signal SIGTERM\n")
 
@@ -423,38 +391,10 @@ to be triggered for each one of them.
 
         return True
 
-    #
-    # parse  info
-    #
-
-    def get_status_io(self):
-        status = self.vpn_status()
-        if isinstance(status, str):
-            lines = status.split('\n')
-        if isinstance(status, list):
-            lines = status
-        try:
-            (header, when, tun_read, tun_write,
-             tcp_read, tcp_write, auth_read) = tuple(lines)
-        except ValueError:
-            return None
-
-        when_ts = time.strptime(when.split(',')[1], "%a %b %d %H:%M:%S %Y")
-        sep = ','
-        # XXX cleanup!
-        tun_read = tun_read.split(sep)[1]
-        tun_write = tun_write.split(sep)[1]
-        tcp_read = tcp_read.split(sep)[1]
-        tcp_write = tcp_write.split(sep)[1]
-        auth_read = auth_read.split(sep)[1]
-
-        # XXX this could be a named tuple. prettier.
-        return when_ts, (tun_read, tun_write, tcp_read, tcp_write, auth_read)
-
-    def get_connection_state(self):
-        state = self.state()
-        if state is not None:
-            ts, status_step, ok, ip, remote = state.split(',')
-            ts = time.gmtime(float(ts))
-            # XXX this could be a named tuple. prettier.
-            return ts, status_step, ok, ip, remote
+    def _get_openvpn_process(self):
+        # plist = [p for p in psutil.get_process_list() if p.name == "openvpn"]
+        # return plist[0] if plist else None
+        for process in psutil.get_process_list():
+            if process.name == "openvpn":
+                return process
+        return None
diff --git a/src/leap/eip/specs.py b/src/leap/eip/specs.py
index 57e7537b..c41fd29b 100644
--- a/src/leap/eip/specs.py
+++ b/src/leap/eip/specs.py
@@ -77,12 +77,12 @@ eipconfig_spec = {
         },
         'primary_gateway': {
             'type': unicode,
-            'default': u"turkey",
+            'default': u"location_unknown",
             #'required': True
         },
         'secondary_gateway': {
             'type': unicode,
-            'default': u"france"
+            'default': u"location_unknown2"
         },
         'management_password': {
             'type': unicode
@@ -100,25 +100,37 @@ eipservice_config_spec = {
             'default': 1
         },
         'version': {
-            'type': unicode,
+            'type': int,
             'required': True,
-            'default': "0.1.0"
+            'default': 1
         },
-        'capabilities': {
-            'type': dict,
-            'default': {
-                "transport": ["openvpn"],
-                "ports": ["80", "53"],
-                "protocols": ["udp", "tcp"],
-                "static_ips": True,
-                "adblock": True}
+        'clusters': {
+            'type': list,
+            'default': [
+                {"label": {
+                    "en": "Location Unknown"},
+                    "name": "location_unknown"}]
         },
         'gateways': {
             'type': list,
-            'default': [{"country_code": "us",
-                        "label": {"en":"west"},
-                        "capabilities": {},
-                        "hosts": ["1.2.3.4", "1.2.3.5"]}]
+            'default': [
+                {"capabilities": {
+                    "adblock": True,
+                    "filter_dns": True,
+                    "ports": ["80", "53", "443", "1194"],
+                    "protocols": ["udp", "tcp"],
+                    "transport": ["openvpn"],
+                    "user_ips": False},
+                 "cluster": "location_unknown",
+                 "host": "location.example.org",
+                 "ip_address": "127.0.0.1"}]
+        },
+        'openvpn_configuration': {
+            'type': dict,
+            'default': {
+                "auth": None,
+                "cipher": None,
+                "tls-cipher": None}
         }
     }
 }
diff --git a/src/leap/eip/tests/data.py b/src/leap/eip/tests/data.py
index cadf720e..a7fe1853 100644
--- a/src/leap/eip/tests/data.py
+++ b/src/leap/eip/tests/data.py
@@ -23,26 +23,29 @@ EIP_SAMPLE_CONFIG = {
         "keys/client/openvpn.pem" % PROVIDER),
     "connect_on_login": True,
     "block_cleartext_traffic": True,
-    "primary_gateway": "turkey",
-    "secondary_gateway": "france",
+    "primary_gateway": "location_unknown",
+    "secondary_gateway": "location_unknown2",
     #"management_password": "oph7Que1othahwiech6J"
 }
 
 EIP_SAMPLE_SERVICE = {
     "serial": 1,
-    "version": "0.1.0",
-    "capabilities": {
-        "transport": ["openvpn"],
-        "ports": ["80", "53"],
-        "protocols": ["udp", "tcp"],
-        "static_ips": True,
-        "adblock": True
-    },
+    "version": 1,
+    "clusters": [
+        {"label": {
+            "en": "Location Unknown"},
+            "name": "location_unknown"}
+    ],
     "gateways": [
-    {"country_code": "tr",
-     "name": "turkey",
-     "label": {"en":"Ankara, Turkey"},
-     "capabilities": {},
-     "hosts": ["192.0.43.10"]}
+        {"capabilities": {
+            "adblock": True,
+            "filter_dns": True,
+            "ports": ["80", "53", "443", "1194"],
+            "protocols": ["udp", "tcp"],
+            "transport": ["openvpn"],
+            "user_ips": False},
+         "cluster": "location_unknown",
+         "host": "location.example.org",
+         "ip_address": "192.0.43.10"}
     ]
 }
diff --git a/src/leap/eip/tests/test_checks.py b/src/leap/eip/tests/test_checks.py
index 1d7bfc17..ab11037a 100644
--- a/src/leap/eip/tests/test_checks.py
+++ b/src/leap/eip/tests/test_checks.py
@@ -25,6 +25,7 @@ from leap.eip.tests import data as testdata
 from leap.testing.basetest import BaseLeapTest
 from leap.testing.https_server import BaseHTTPSServerTestCase
 from leap.testing.https_server import where as where_cert
+from leap.util.fileutil import mkdir_f
 
 
 class NoLogRequestHandler:
@@ -118,6 +119,7 @@ class EIPCheckTest(BaseLeapTest):
         sampleconfig = copy.copy(testdata.EIP_SAMPLE_CONFIG)
         sampleconfig['provider'] = None
         eipcfg_path = checker.eipconfig.filename
+        mkdir_f(eipcfg_path)
         with open(eipcfg_path, 'w') as fp:
             json.dump(sampleconfig, fp)
         #with self.assertRaises(eipexceptions.EIPMissingDefaultProvider):
@@ -138,6 +140,8 @@ class EIPCheckTest(BaseLeapTest):
     def test_fetch_definition(self):
         with patch.object(requests, "get") as mocked_get:
             mocked_get.return_value.status_code = 200
+            mocked_get.return_value.headers = {
+                'last-modified': "Wed Dec 12 12:12:12 GMT 2012"}
             mocked_get.return_value.json = DEFAULT_PROVIDER_DEFINITION
             checker = eipchecks.EIPConfigChecker(fetcher=requests)
             sampleconfig = testdata.EIP_SAMPLE_CONFIG
@@ -156,6 +160,8 @@ class EIPCheckTest(BaseLeapTest):
     def test_fetch_eip_service_config(self):
         with patch.object(requests, "get") as mocked_get:
             mocked_get.return_value.status_code = 200
+            mocked_get.return_value.headers = {
+                'last-modified': "Wed Dec 12 12:12:12 GMT 2012"}
             mocked_get.return_value.json = testdata.EIP_SAMPLE_SERVICE
             checker = eipchecks.EIPConfigChecker(fetcher=requests)
             sampleconfig = testdata.EIP_SAMPLE_CONFIG
diff --git a/src/leap/eip/tests/test_config.py b/src/leap/eip/tests/test_config.py
index 50538240..5977ef3c 100644
--- a/src/leap/eip/tests/test_config.py
+++ b/src/leap/eip/tests/test_config.py
@@ -1,3 +1,4 @@
+from collections import OrderedDict
 import json
 import os
 import platform
@@ -10,11 +11,11 @@ except ImportError:
 
 #from leap.base import constants
 #from leap.eip import config as eip_config
-from leap import __branding as BRANDING
+#from leap import __branding as BRANDING
 from leap.eip import config as eipconfig
 from leap.eip.tests.data import EIP_SAMPLE_CONFIG, EIP_SAMPLE_SERVICE
 from leap.testing.basetest import BaseLeapTest
-from leap.util.fileutil import mkdir_p
+from leap.util.fileutil import mkdir_p, mkdir_f
 
 _system = platform.system()
 
@@ -47,11 +48,22 @@ class EIPConfigTest(BaseLeapTest):
         open(tfile, 'wb').close()
         os.chmod(tfile, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR)
 
-    def write_sample_eipservice(self):
+    def write_sample_eipservice(self, vpnciphers=False, extra_vpnopts=None,
+                                gateways=None):
         conf = eipconfig.EIPServiceConfig()
-        folder, f = os.path.split(conf.filename)
-        if not os.path.isdir(folder):
-            mkdir_p(folder)
+        mkdir_f(conf.filename)
+        if gateways:
+            EIP_SAMPLE_SERVICE['gateways'] = gateways
+        if vpnciphers:
+            openvpnconfig = OrderedDict({
+                "auth": "SHA1",
+                "cipher": "AES-128-CBC",
+                "tls-cipher": "DHE-RSA-AES128-SHA"})
+            if extra_vpnopts:
+                for k, v in extra_vpnopts.items():
+                    openvpnconfig[k] = v
+            EIP_SAMPLE_SERVICE['openvpn_configuration'] = openvpnconfig
+
         with open(conf.filename, 'w') as fd:
             fd.write(json.dumps(EIP_SAMPLE_SERVICE))
 
@@ -63,8 +75,17 @@ class EIPConfigTest(BaseLeapTest):
         with open(conf.filename, 'w') as fd:
             fd.write(json.dumps(EIP_SAMPLE_CONFIG))
 
-    def get_expected_openvpn_args(self):
+    def get_expected_openvpn_args(self, with_openvpn_ciphers=False):
+        """
+        yeah, this is almost as duplicating the
+        code for building the command
+        """
         args = []
+        eipconf = eipconfig.EIPConfig(domain=self.provider)
+        eipconf.load()
+        eipsconf = eipconfig.EIPServiceConfig(domain=self.provider)
+        eipsconf.load()
+
         username = self.get_username()
         groupname = self.get_groupname()
 
@@ -75,8 +96,10 @@ class EIPConfigTest(BaseLeapTest):
         args.append('--persist-tun')
         args.append('--persist-key')
         args.append('--remote')
+
         args.append('%s' % eipconfig.get_eip_gateway(
-            provider=self.provider))
+            eipconfig=eipconf,
+            eipserviceconfig=eipsconf))
         # XXX get port!?
         args.append('1194')
         # XXX get proto
@@ -85,6 +108,14 @@ class EIPConfigTest(BaseLeapTest):
         args.append('--remote-cert-tls')
         args.append('server')
 
+        if with_openvpn_ciphers:
+            CIPHERS = [
+                "--tls-cipher", "DHE-RSA-AES128-SHA",
+                "--cipher", "AES-128-CBC",
+                "--auth", "SHA1"]
+            for opt in CIPHERS:
+                args.append(opt)
+
         args.append('--user')
         args.append(username)
         args.append('--group')
@@ -130,6 +161,55 @@ class EIPConfigTest(BaseLeapTest):
     # params in the function call, to disable
     # some checks.
 
+    def test_get_eip_gateway(self):
+        self.write_sample_eipconfig()
+        eipconf = eipconfig.EIPConfig(domain=self.provider)
+
+        # default eipservice
+        self.write_sample_eipservice()
+        eipsconf = eipconfig.EIPServiceConfig(domain=self.provider)
+
+        gateway = eipconfig.get_eip_gateway(
+            eipconfig=eipconf,
+            eipserviceconfig=eipsconf)
+
+        # in spec is local gateway by default
+        self.assertEqual(gateway, '127.0.0.1')
+
+        # change eipservice
+        # right now we only check that cluster == selected primary gw in
+        # eip.json, and pick first matching ip
+        eipconf._config.config['primary_gateway'] = "foo_provider"
+        newgateways = [{"cluster": "foo_provider",
+                        "ip_address": "127.0.0.99"}]
+        self.write_sample_eipservice(gateways=newgateways)
+        eipsconf = eipconfig.EIPServiceConfig(domain=self.provider)
+        # load from disk file
+        eipsconf.load()
+
+        gateway = eipconfig.get_eip_gateway(
+            eipconfig=eipconf,
+            eipserviceconfig=eipsconf)
+        self.assertEqual(gateway, '127.0.0.99')
+
+        # change eipservice, several gateways
+        # right now we only check that cluster == selected primary gw in
+        # eip.json, and pick first matching ip
+        eipconf._config.config['primary_gateway'] = "bar_provider"
+        newgateways = [{"cluster": "foo_provider",
+                        "ip_address": "127.0.0.99"},
+                       {'cluster': "bar_provider",
+                        "ip_address": "127.0.0.88"}]
+        self.write_sample_eipservice(gateways=newgateways)
+        eipsconf = eipconfig.EIPServiceConfig(domain=self.provider)
+        # load from disk file
+        eipsconf.load()
+
+        gateway = eipconfig.get_eip_gateway(
+            eipconfig=eipconf,
+            eipserviceconfig=eipsconf)
+        self.assertEqual(gateway, '127.0.0.88')
+
     def test_build_ovpn_command_empty_config(self):
         self.touch_exec()
         self.write_sample_eipservice()
@@ -139,14 +219,63 @@ class EIPConfigTest(BaseLeapTest):
         from leap.util.fileutil import which
         path = os.environ['PATH']
         vpnbin = which('openvpn', path=path)
-        print 'path =', path
-        print 'vpnbin = ', vpnbin
-        command, args = eipconfig.build_ovpn_command(
+        #print 'path =', path
+        #print 'vpnbin = ', vpnbin
+        vpncommand, vpnargs = eipconfig.build_ovpn_command(
+            do_pkexec_check=False, vpnbin=vpnbin,
+            socket_path="/tmp/test.socket",
+            provider=self.provider)
+        self.assertEqual(vpncommand, self.home + '/bin/openvpn')
+        self.assertEqual(vpnargs, self.get_expected_openvpn_args())
+
+    def test_build_ovpn_command_openvpnoptions(self):
+        self.touch_exec()
+
+        from leap.eip import config as eipconfig
+        from leap.util.fileutil import which
+        path = os.environ['PATH']
+        vpnbin = which('openvpn', path=path)
+
+        self.write_sample_eipconfig()
+
+        # regular run, everything normal
+        self.write_sample_eipservice(vpnciphers=True)
+        vpncommand, vpnargs = eipconfig.build_ovpn_command(
+            do_pkexec_check=False, vpnbin=vpnbin,
+            socket_path="/tmp/test.socket",
+            provider=self.provider)
+        self.assertEqual(vpncommand, self.home + '/bin/openvpn')
+        expected = self.get_expected_openvpn_args(
+            with_openvpn_ciphers=True)
+        self.assertEqual(vpnargs, expected)
+
+        # bad options -- illegal options
+        self.write_sample_eipservice(
+            vpnciphers=True,
+            # WE ONLY ALLOW vpn options in auth, cipher, tls-cipher
+            extra_vpnopts={"notallowedconfig": "badvalue"})
+        vpncommand, vpnargs = eipconfig.build_ovpn_command(
+            do_pkexec_check=False, vpnbin=vpnbin,
+            socket_path="/tmp/test.socket",
+            provider=self.provider)
+        self.assertEqual(vpncommand, self.home + '/bin/openvpn')
+        expected = self.get_expected_openvpn_args(
+            with_openvpn_ciphers=True)
+        self.assertEqual(vpnargs, expected)
+
+        # bad options -- illegal chars
+        self.write_sample_eipservice(
+            vpnciphers=True,
+            # WE ONLY ALLOW A-Z09\-
+            extra_vpnopts={"cipher": "AES-128-CBC;FOOTHING"})
+        vpncommand, vpnargs = eipconfig.build_ovpn_command(
             do_pkexec_check=False, vpnbin=vpnbin,
             socket_path="/tmp/test.socket",
             provider=self.provider)
-        self.assertEqual(command, self.home + '/bin/openvpn')
-        self.assertEqual(args, self.get_expected_openvpn_args())
+        self.assertEqual(vpncommand, self.home + '/bin/openvpn')
+        expected = self.get_expected_openvpn_args(
+            with_openvpn_ciphers=True)
+        self.assertEqual(vpnargs, expected)
 
 
 if __name__ == "__main__":
diff --git a/src/leap/eip/tests/test_eipconnection.py b/src/leap/eip/tests/test_eipconnection.py
index aefca36f..163f8d45 100644
--- a/src/leap/eip/tests/test_eipconnection.py
+++ b/src/leap/eip/tests/test_eipconnection.py
@@ -1,6 +1,8 @@
+import glob
 import logging
 import platform
-import os
+#import os
+import shutil
 
 logging.basicConfig()
 logger = logging.getLogger(name=__name__)
@@ -66,11 +68,26 @@ class EIPConductorTest(BaseLeapTest):
         self.manager = Mock(name="openvpnmanager_mock")
         self.con = MockedEIPConnection()
         self.con.provider = self.provider
+
+        # XXX watch out. This sometimes is throwing the following error:
+        # NoSuchProcess: process no longer exists (pid=6571)
+        # because of a bad implementation of _check_if_running_instance
+
         self.con.run_openvpn_checks()
 
     def tearDown(self):
+        pass
+
+    def doCleanups(self):
+        super(BaseLeapTest, self).doCleanups()
+        self.cleanupSocketDir()
         del self.con
 
+    def cleanupSocketDir(self):
+        ptt = ('/tmp/leap-tmp*')
+        for tmpdir in glob.glob(ptt):
+            shutil.rmtree(tmpdir)
+
     #
     # tests
     #
@@ -81,6 +98,7 @@ class EIPConductorTest(BaseLeapTest):
         """
         con = self.con
         self.assertEqual(con.autostart, True)
+        # XXX moar!
 
     def test_ovpn_command(self):
         """
@@ -98,6 +116,7 @@ class EIPConductorTest(BaseLeapTest):
         # needed to run tests. (roughly 3 secs for this only)
         # We should modularize and inject Mocks on more places.
 
+        oldcon = self.con
         del(self.con)
         config_checker = Mock()
         self.con = MockedEIPConnection(config_checker=config_checker)
@@ -107,6 +126,7 @@ class EIPConductorTest(BaseLeapTest):
             skip_download=False)
 
         # XXX test for cert_checker also
+        self.con = oldcon
 
     # connect/disconnect calls
 
@@ -123,9 +143,14 @@ class EIPConductorTest(BaseLeapTest):
                          self.con.status.CONNECTED)
 
         # disconnect
-        self.con.cleanup = Mock()
+        self.con.terminate_openvpn_connection = Mock()
         self.con.disconnect()
-        self.con.cleanup.assert_called_once_with()
+        self.con.terminate_openvpn_connection.assert_called_once_with(
+            shutdown=False)
+        self.con.terminate_openvpn_connection = Mock()
+        self.con.disconnect(shutdown=True)
+        self.con.terminate_openvpn_connection.assert_called_once_with(
+            shutdown=True)
 
         # new status should be disconnected
         # XXX this should evolve and check no errors
diff --git a/src/leap/eip/tests/test_openvpnconnection.py b/src/leap/eip/tests/test_openvpnconnection.py
index 0f27facf..f7493567 100644
--- a/src/leap/eip/tests/test_openvpnconnection.py
+++ b/src/leap/eip/tests/test_openvpnconnection.py
@@ -58,16 +58,27 @@ class OpenVPNConnectionTest(BaseLeapTest):
     def setUp(self):
         # XXX this will have to change for win, host=localhost
         host = eipconfig.get_socket_path()
+        self.host = host
         self.manager = MockedOpenVPNConnection(host=host)
 
     def tearDown(self):
+        pass
+
+    def doCleanups(self):
+        super(BaseLeapTest, self).doCleanups()
+        self.cleanupSocketDir()
+
+    def cleanupSocketDir(self):
         # remove the socket folder.
         # XXX only if posix. in win, host is localhost, so nothing
         # has to be done.
-        if self.manager.host:
-            folder, fpath = os.path.split(self.manager.host)
-            assert folder.startswith('/tmp/leap-tmp')  # safety check
-            shutil.rmtree(folder)
+        if self.host:
+            folder, fpath = os.path.split(self.host)
+            try:
+                assert folder.startswith('/tmp/leap-tmp')  # safety check
+                shutil.rmtree(folder)
+            except:
+                self.fail("could not remove temp file")
 
         del self.manager
 
@@ -108,12 +119,14 @@ class OpenVPNConnectionTest(BaseLeapTest):
         self.assertEqual(self.manager.port, 7777)
 
     def test_port_types_init(self):
+        oldmanager = self.manager
         self.manager = MockedOpenVPNConnection(port="42")
         self.assertEqual(self.manager.port, 42)
         self.manager = MockedOpenVPNConnection()
         self.assertEqual(self.manager.port, "unix")
         self.manager = MockedOpenVPNConnection(port="bad")
         self.assertEqual(self.manager.port, None)
+        self.manager = oldmanager
 
     def test_uds_telnet_called_on_connect(self):
         self.manager.connect_to_management()