Merge branch 'reintegrate-soledad' into develop

2 files changed, 73 insertions, 24 deletions

diff --git a/src/leap/services/eip/tests/test_providerbootstrapper.py b/src/leap/services/eip/tests/test_providerbootstrapper.py
index cd740793..b24334a2 100644
--- a/src/leap/services/eip/tests/test_providerbootstrapper.py
+++ b/src/leap/services/eip/tests/test_providerbootstrapper.py
@@ -43,6 +43,7 @@ from leap.common.testing.https_server import where
 from leap.common.testing.basetest import BaseLeapTest
 from leap.services.eip.providerbootstrapper import ProviderBootstrapper
 from leap.services.eip.providerbootstrapper import UnsupportedProviderAPI
+from leap.services.eip.providerbootstrapper import WrongFingerprint
 from leap.provider.supportedapis import SupportedAPIs
 from leap.config.providerconfig import ProviderConfig
 from leap.crypto.tests import fake_provider
@@ -194,7 +195,7 @@ class ProviderBootstrapperTest(BaseLeapTest):
 
         self.pb._should_proceed_cert = mock.MagicMock(return_value=True)
 
-        with self.assertRaises(AssertionError):
+        with self.assertRaises(WrongFingerprint):
             self.pb._check_ca_fingerprint()
 
     # This two hashes different in the last byte, but that's good enough
@@ -282,7 +283,7 @@ yV8e
 
         self.pb._should_proceed_cert = mock.MagicMock(return_value=True)
 
-        with self.assertRaises(AssertionError):
+        with self.assertRaises(WrongFingerprint):
             self.pb._check_ca_fingerprint()
 
         os.unlink(cert_path)
@@ -412,6 +413,15 @@ class ProviderBootstrapperActiveTest(unittest.TestCase):
             p.write("A")
         return provider_path
 
+    def test_download_provider_info_new_provider(self):
+        self._setup_provider_config_with("1", tempfile.mkdtemp())
+        self._setup_providerbootstrapper(True)
+
+        self.pb._download_provider_info()
+        self.assertTrue(ProviderConfig.save.called)
+
+    @mock.patch('leap.config.providerconfig.ProviderConfig.get_ca_cert_path',
+                lambda x: where('cacert.pem'))
     def test_download_provider_info_not_modified(self):
         self._setup_provider_config_with("1", tempfile.mkdtemp())
         self._setup_providerbootstrapper(True)
@@ -420,12 +430,16 @@ class ProviderBootstrapperActiveTest(unittest.TestCase):
         # set mtime to something really new
         os.utime(provider_path, (-1, time.time()))
 
-        self.pb._download_provider_info()
-        # we check that it doesn't do anything with the provider
+        with mock.patch.object(
+                ProviderConfig, 'get_api_uri',
+                return_value="https://localhost:%s" % (self.https_port,)):
+            self.pb._download_provider_info()
+        # we check that it doesn't save the provider
         # config, because it's new enough
-        self.assertFalse(ProviderConfig.load.called)
         self.assertFalse(ProviderConfig.save.called)
 
+    @mock.patch('leap.config.providerconfig.ProviderConfig.get_ca_cert_path',
+                lambda x: where('cacert.pem'))
     def test_download_provider_info_modified(self):
         self._setup_provider_config_with("1", tempfile.mkdtemp())
         self._setup_providerbootstrapper(True)
@@ -434,32 +448,45 @@ class ProviderBootstrapperActiveTest(unittest.TestCase):
         # set mtime to something really old
         os.utime(provider_path, (-1, 100))
 
-        self.pb._download_provider_info()
+        with mock.patch.object(
+                ProviderConfig, 'get_api_uri',
+                return_value="https://localhost:%s" % (self.https_port,)):
+            self.pb._download_provider_info()
         self.assertTrue(ProviderConfig.load.called)
         self.assertTrue(ProviderConfig.save.called)
 
+    @mock.patch('leap.config.providerconfig.ProviderConfig.get_ca_cert_path',
+                lambda x: where('cacert.pem'))
     def test_download_provider_info_unsupported_api_raises(self):
         self._setup_provider_config_with("9999999", tempfile.mkdtemp())
         self._setup_providerbootstrapper(False)
         self._produce_dummy_provider_json()
 
-        with self.assertRaises(UnsupportedProviderAPI):
-            self.pb._download_provider_info()
+        with mock.patch.object(
+                ProviderConfig, 'get_api_uri',
+                return_value="https://localhost:%s" % (self.https_port,)):
+            with self.assertRaises(UnsupportedProviderAPI):
+                self.pb._download_provider_info()
 
+    @mock.patch('leap.config.providerconfig.ProviderConfig.get_ca_cert_path',
+                lambda x: where('cacert.pem'))
     def test_download_provider_info_unsupported_api(self):
         self._setup_provider_config_with(SupportedAPIs.SUPPORTED_APIS[0],
                                          tempfile.mkdtemp())
         self._setup_providerbootstrapper(False)
         self._produce_dummy_provider_json()
 
-        self.pb._download_provider_info()
+        with mock.patch.object(
+                ProviderConfig, 'get_api_uri',
+                return_value="https://localhost:%s" % (self.https_port,)):
+            self.pb._download_provider_info()
 
+    @mock.patch('leap.config.providerconfig.ProviderConfig.get_api_uri',
+                lambda x: 'api.uri')
+    @mock.patch('leap.config.providerconfig.ProviderConfig.get_ca_cert_path',
+                lambda x: '/cert/path')
     def test_check_api_certificate_skips(self):
         self.pb._provider_config = ProviderConfig()
-        self.pb._provider_config.get_api_uri = mock.MagicMock(
-            return_value="api.uri")
-        self.pb._provider_config.get_ca_cert_path = mock.MagicMock(
-            return_value="/cert/path")
         self.pb._session.get = mock.MagicMock(return_value=Response())
 
         self.pb._should_proceed_cert = mock.MagicMock(return_value=False)
diff --git a/src/leap/services/eip/vpnlaunchers.py b/src/leap/services/eip/vpnlaunchers.py
index 8522d1df..b591b3ca 100644
--- a/src/leap/services/eip/vpnlaunchers.py
+++ b/src/leap/services/eip/vpnlaunchers.py
@@ -38,6 +38,8 @@ from leap.common.files import which
 from leap.config.providerconfig import ProviderConfig
 from leap.services.eip.eipconfig import EIPConfig, VPNGatewaySelector
 from leap.util import first
+from leap.util.privilege_policies import LinuxPolicyChecker
+from leap.util import privilege_policies
 
 logger = logging.getLogger(__name__)
 
@@ -62,7 +64,7 @@ class EIPNoTunKextLoaded(VPNLauncherException):
     pass
 
 
-class VPNLauncher:
+class VPNLauncher(object):
     """
     Abstract launcher class
     """
@@ -237,6 +239,10 @@ class LinuxVPNLauncher(VPNLauncher):
 
     PKEXEC_BIN = 'pkexec'
     OPENVPN_BIN = 'openvpn'
+    OPENVPN_BIN_PATH = os.path.join(
+        ProviderConfig().get_path_prefix(),
+        "..", "apps", "eip", OPENVPN_BIN)
+
     SYSTEM_CONFIG = "/etc/leap"
     UP_DOWN_FILE = "resolv-update"
     UP_DOWN_PATH = "%s/%s" % (SYSTEM_CONFIG, UP_DOWN_FILE)
@@ -250,12 +256,26 @@ class LinuxVPNLauncher(VPNLauncher):
         OPENVPN_DOWN_ROOT_BASE,
         OPENVPN_DOWN_ROOT_FILE)
 
-    POLKIT_BASE = "/usr/share/polkit-1/actions"
-    POLKIT_FILE = "net.openvpn.gui.leap.policy"
-    POLKIT_PATH = "%s/%s" % (POLKIT_BASE, POLKIT_FILE)
-
     UPDOWN_FILES = (UP_DOWN_PATH,)
-    OTHER_FILES = (POLKIT_PATH,)
+    POLKIT_PATH = LinuxPolicyChecker.get_polkit_path()
+    OTHER_FILES = (POLKIT_PATH, )
+
+    def missing_other_files(self):
+        """
+        'Extend' the VPNLauncher's missing_other_files to check if the polkit
+        files is outdated. If the polkit file that is in OTHER_FILES exists but
+        is not up to date, it is added to the missing list.
+
+        :returns: a list of missing files
+        :rtype: list of str
+        """
+        missing = VPNLauncher.missing_other_files.im_func(self)
+        polkit_file = LinuxPolicyChecker.get_polkit_path()
+        if polkit_file not in missing:
+            if privilege_policies.is_policy_outdated(self.OPENVPN_BIN_PATH):
+                missing.append(polkit_file)
+
+        return missing
 
     @classmethod
     def cmd_for_missing_scripts(kls, frompath, pol_file):
@@ -271,11 +291,13 @@ class LinuxVPNLauncher(VPNLauncher):
         :rtype: str
         """
         to = kls.SYSTEM_CONFIG
-        cmd = "#!/bin/sh\nset -e\nmkdir -p %s\n"
-        cmd = (cmd + "cp %s/%s %s\ncp \"%s\" \"%s\"") % (
-            to,
-            frompath, kls.UP_DOWN_FILE, to,
-            pol_file, kls.POLKIT_PATH)
+
+        cmd = '#!/bin/sh\nset -e\n'
+        cmd += 'mkdir -p "%s"\n' % (to, )
+        cmd += 'cp "%s/%s" "%s"\n' % (frompath, kls.UP_DOWN_FILE, to)
+        cmd += 'cp "%s" "%s"\n' % (pol_file, kls.POLKIT_PATH)
+        cmd += 'chmod 644 "%s"\n' % (kls.POLKIT_PATH, )
+
         return cmd
 
     @classmethod