From 722afd140b3d8bc8915e9ff34dbc8039c87dba63 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Wed, 1 May 2013 04:11:26 +0900
Subject: whitelist openvpn cipher parameters

---
 src/leap/services/eip/eipconfig.py | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

(limited to 'src/leap/services/eip/eipconfig.py')

diff --git a/src/leap/services/eip/eipconfig.py b/src/leap/services/eip/eipconfig.py
index 4e74687a..baf26bca 100644
--- a/src/leap/services/eip/eipconfig.py
+++ b/src/leap/services/eip/eipconfig.py
@@ -18,8 +18,9 @@
 """
 Provider configuration
 """
-import os
 import logging
+import os
+import re
 
 from leap.common.check import leap_assert, leap_assert_type
 from leap.common.config.baseconfig import BaseConfig
@@ -33,6 +34,8 @@ class EIPConfig(BaseConfig):
     """
     Provider configuration abstraction class
     """
+    OPENVPN_ALLOWED_KEYS = ("auth", "cipher", "tls-cipher")
+    OPENVPN_CIPHERS_REGEX = re.compile("[A-Z0-9\-]+")
 
     def __init__(self):
         BaseConfig.__init__(self)
@@ -52,7 +55,24 @@ class EIPConfig(BaseConfig):
         return self._safe_get_value("gateways")
 
     def get_openvpn_configuration(self):
-        return self._safe_get_value("openvpn_configuration")
+        """
+        Returns a dictionary containing the openvpn configuration
+        parameters.
+
+        These are sanitized with alphanumeric whitelist.
+
+        @returns: openvpn configuration dict
+        @rtype: C{dict}
+        """
+        ovpncfg = self._safe_get_value("openvpn_configuration")
+        config = {}
+        for key, value in ovpncfg.items():
+            if key in self.OPENVPN_ALLOWED_KEYS and value is not None:
+                sanitized_val = self.OPENVPN_CIPHERS_REGEX.findall(value)
+                if len(sanitized_val) != 0:
+                    _val = sanitized_val[0]
+                    config[str(key)] = str(_val)
+        return config
 
     def get_serial(self):
         return self._safe_get_value("serial")
@@ -61,6 +81,9 @@ class EIPConfig(BaseConfig):
         return self._safe_get_value("version")
 
     def get_gateway_ip(self, index=0):
+        """
+        Returns the ip of the gateway
+        """
         gateways = self.get_gateways()
         leap_assert(len(gateways) > 0, "We don't have any gateway!")
         if index > len(gateways):
-- 
cgit v1.2.3


From 2370950c7e2d15355daa95a01f20e77786da742e Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Wed, 1 May 2013 04:41:11 +0900
Subject: sanitize ip address

---
 src/leap/services/eip/eipconfig.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/leap/services/eip/eipconfig.py')

diff --git a/src/leap/services/eip/eipconfig.py b/src/leap/services/eip/eipconfig.py
index baf26bca..e6b93647 100644
--- a/src/leap/services/eip/eipconfig.py
+++ b/src/leap/services/eip/eipconfig.py
@@ -36,6 +36,7 @@ class EIPConfig(BaseConfig):
     """
     OPENVPN_ALLOWED_KEYS = ("auth", "cipher", "tls-cipher")
     OPENVPN_CIPHERS_REGEX = re.compile("[A-Z0-9\-]+")
+    IP_REGEX = re.compile("^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$")
 
     def __init__(self):
         BaseConfig.__init__(self)
@@ -90,7 +91,9 @@ class EIPConfig(BaseConfig):
             index = 0
             logger.warning("Provided an unknown gateway index %s, " +
                            "defaulting to 0")
-        return gateways[0]["ip_address"]
+        ip_addr = gateways[0]["ip_address"]
+        if self.IP_REGEX.search(ip_addr):
+            return ip_addr
 
     def get_client_cert_path(self,
                              providerconfig=None,
-- 
cgit v1.2.3


From 3f304a2241196edda14deb9fcbe595b434a08ff2 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Tue, 7 May 2013 22:51:08 +0900
Subject: use ipaddr to get ipv6 support

---
 src/leap/services/eip/eipconfig.py | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

(limited to 'src/leap/services/eip/eipconfig.py')

diff --git a/src/leap/services/eip/eipconfig.py b/src/leap/services/eip/eipconfig.py
index e6b93647..0a7d2b23 100644
--- a/src/leap/services/eip/eipconfig.py
+++ b/src/leap/services/eip/eipconfig.py
@@ -22,6 +22,8 @@ import logging
 import os
 import re
 
+import ipaddr
+
 from leap.common.check import leap_assert, leap_assert_type
 from leap.common.config.baseconfig import BaseConfig
 from leap.config.providerconfig import ProviderConfig
@@ -36,7 +38,6 @@ class EIPConfig(BaseConfig):
     """
     OPENVPN_ALLOWED_KEYS = ("auth", "cipher", "tls-cipher")
     OPENVPN_CIPHERS_REGEX = re.compile("[A-Z0-9\-]+")
-    IP_REGEX = re.compile("^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$")
 
     def __init__(self):
         BaseConfig.__init__(self)
@@ -91,9 +92,14 @@ class EIPConfig(BaseConfig):
             index = 0
             logger.warning("Provided an unknown gateway index %s, " +
                            "defaulting to 0")
-        ip_addr = gateways[0]["ip_address"]
-        if self.IP_REGEX.search(ip_addr):
-            return ip_addr
+        ip_addr_str = gateways[0]["ip_address"]
+
+        try:
+            ipaddr.IPAddress(ip_addr_str)
+            return ip_addr_str
+        except ValueError:
+            logger.error("Invalid ip address in config: %s" % (ip_addr_str,))
+            return None
 
     def get_client_cert_path(self,
                              providerconfig=None,
-- 
cgit v1.2.3