From 0d35f2a82bf15504ace2135af3e0c66ae1c16874 Mon Sep 17 00:00:00 2001 From: kali Date: Tue, 18 Sep 2012 11:11:43 +0900 Subject: do_branding command added to setup --- src/leap/__init__.py | 5 +++++ src/leap/app.py | 2 +- src/leap/base/config.py | 2 +- src/leap/base/constants.py | 15 +++++++++------ src/leap/base/tests/test_config.py | 2 +- src/leap/baseapp/eip.py | 19 +++++++++---------- src/leap/certs/__init__.py | 7 +++++++ src/leap/eip/checks.py | 14 +++++++++----- src/leap/eip/eipconnection.py | 4 +++- src/leap/eip/openvpnconnection.py | 7 +++---- src/leap/eip/specs.py | 10 ++++++++-- 11 files changed, 56 insertions(+), 31 deletions(-) create mode 100644 src/leap/certs/__init__.py (limited to 'src/leap') diff --git a/src/leap/__init__.py b/src/leap/__init__.py index 75bddd6d..5e003931 100644 --- a/src/leap/__init__.py +++ b/src/leap/__init__.py @@ -28,3 +28,8 @@ except ImportError: pass __full_version__ = __appname__ + '/' + str(__version__) + +try: + from leap._branding import BRANDING as __branding +except ImportError: + __branding = {} diff --git a/src/leap/app.py b/src/leap/app.py index b721468f..1aebfca2 100644 --- a/src/leap/app.py +++ b/src/leap/app.py @@ -44,7 +44,7 @@ def main(): fileh.setFormatter(formatter) logger.addHandler(fileh) - logger.debug('args: %s' % opts) + #logger.debug('args: %s' % opts) logger.info('Starting app') logger.info('Running client version %s', VERSION) diff --git a/src/leap/base/config.py b/src/leap/base/config.py index 5a52637c..e896ffd2 100644 --- a/src/leap/base/config.py +++ b/src/leap/base/config.py @@ -239,7 +239,7 @@ def get_config_file(filename, folder=None): def get_default_provider_path(): default_subpath = os.path.join("providers", - constants.DEFAULT_TEST_PROVIDER) + constants.DEFAULT_PROVIDER) default_provider_path = get_config_file( '', folder=default_subpath) diff --git a/src/leap/base/constants.py b/src/leap/base/constants.py index 6266c693..f3e24715 100644 --- a/src/leap/base/constants.py +++ b/src/leap/base/constants.py @@ -1,23 +1,26 @@ """constants to be used in base module""" -APP_NAME = "leap" +from leap import __branding +APP_NAME = __branding.get("short_name", "leap") # default provider placeholder # using `example.org` we make sure that this # is not going to be resolved during the tests phases # (we expect testers to add it to their /etc/hosts -DEFAULT_TEST_PROVIDER = "testprovider.example.org" +DEFAULT_PROVIDER = __branding.get( + "provider_domain", + "testprovider.example.org") -DEFINITION_EXPECTED_PATH = "provider-definition.json" +DEFINITION_EXPECTED_PATH = "definition.json" DEFAULT_PROVIDER_DEFINITION = { - u'api_uri': u'https://api.testprovider.example.org/', + u'api_uri': u'https://api.%s/' % DEFAULT_PROVIDER, u'api_version': u'0.1.0', u'ca_cert': u'8aab80ae4326fd30721689db813733783fe0bd7e', - u'ca_cert_uri': u'https://testprovider.example.org/cacert.pem', + u'ca_cert_uri': u'https://%s/cacert.pem' % DEFAULT_PROVIDER, u'description': {u'en': u'This is a test provider'}, u'display_name': {u'en': u'Test Provider'}, - u'domain': u'testprovider.example.org', + u'domain': u'%s' % DEFAULT_PROVIDER, u'enrollment_policy': u'open', u'public_key': u'cb7dbd679f911e85bc2e51bd44afd7308ee19c21', u'serial': 1, diff --git a/src/leap/base/tests/test_config.py b/src/leap/base/tests/test_config.py index 40461b99..74b06119 100644 --- a/src/leap/base/tests/test_config.py +++ b/src/leap/base/tests/test_config.py @@ -218,7 +218,7 @@ class ConfigHelperFunctions(BaseLeapTest): config.get_default_provider_path(), os.path.expanduser( '~/.config/leap/providers/%s/' % - constants.DEFAULT_TEST_PROVIDER) + constants.DEFAULT_PROVIDER) ) # validate ip diff --git a/src/leap/baseapp/eip.py b/src/leap/baseapp/eip.py index 515ae58d..ff6a79ac 100644 --- a/src/leap/baseapp/eip.py +++ b/src/leap/baseapp/eip.py @@ -1,5 +1,7 @@ +from __future__ import print_function import logging import time +import sys from PyQt4 import QtCore @@ -38,8 +40,9 @@ class EIPConductorAppMixin(object): debug=self.debugmode, ovpn_verbosity=opts.openvpn_verb) - # XXX remove skip download when sample service is ready - self.conductor.run_checks(skip_download=True) + # XXX get skip_download from cli flag + skip_download = False + self.conductor.run_checks(skip_download=skip_download) self.error_check() # XXX should receive "ready" signal @@ -58,13 +61,11 @@ class EIPConductorAppMixin(object): """ logger.debug('error check') - ##################################### - # XXX refactor in progress (by #504) - errq = self.conductor.error_queue while errq.qsize() != 0: logger.debug('%s errors left in conductor queue', errq.qsize()) - error = errq.get() + # we get exception and original traceback from queue + error, tb = errq.get() # redundant log, debugging the loop. logger.error('%s: %s', error.__class__.__name__, error.message) @@ -73,10 +74,8 @@ class EIPConductorAppMixin(object): self.handle_eip_error(error) else: - # This is not quite working. FIXME - import traceback - traceback.print_exc() - raise error + # deprecated form of raising exception. + raise error, None, tb if error.failfirst is True: break diff --git a/src/leap/certs/__init__.py b/src/leap/certs/__init__.py new file mode 100644 index 00000000..c4d009b1 --- /dev/null +++ b/src/leap/certs/__init__.py @@ -0,0 +1,7 @@ +import os + +_where = os.path.split(__file__)[0] + + +def where(filename): + return os.path.join(_where, filename) diff --git a/src/leap/eip/checks.py b/src/leap/eip/checks.py index f368c551..aea5a5d7 100644 --- a/src/leap/eip/checks.py +++ b/src/leap/eip/checks.py @@ -257,7 +257,7 @@ class ProviderCertChecker(object): return True def _get_client_cert_uri(self): - return "https://%s/cert/get" % (baseconstants.DEFAULT_TEST_PROVIDER) + return "https://%s/cert/get" % (baseconstants.DEFAULT_PROVIDER) def _get_client_cert_path(self): # MVS+ : get provider path @@ -414,14 +414,18 @@ class EIPConfigChecker(object): def _get_provider_definition_uri(self, domain=None, path=None): if domain is None: - domain = baseconstants.DEFAULT_TEST_PROVIDER + domain = baseconstants.DEFAULT_PROVIDER if path is None: path = baseconstants.DEFINITION_EXPECTED_PATH - return "https://%s/%s" % (domain, path) + uri = u"https://%s/%s" % (domain, path) + logger.debug('getting provider definition from %s' % uri) + return uri def _get_eip_service_uri(self, domain=None, path=None): if domain is None: - domain = baseconstants.DEFAULT_TEST_PROVIDER + domain = baseconstants.DEFAULT_PROVIDER if path is None: path = eipconstants.EIP_SERVICE_EXPECTED_PATH - return "https://%s/%s" % (domain, path) + uri = "https://%s/%s" % (domain, path) + logger.debug('getting eip service file from %s', uri) + return uri diff --git a/src/leap/eip/eipconnection.py b/src/leap/eip/eipconnection.py index 3a879f01..d1c84b2a 100644 --- a/src/leap/eip/eipconnection.py +++ b/src/leap/eip/eipconnection.py @@ -4,6 +4,7 @@ EIP Connection Class from __future__ import (absolute_import,) import logging import Queue +import sys from leap.eip.checks import EIPConfigChecker from leap.eip import config as eipconfig @@ -48,7 +49,8 @@ class EIPConnection(OpenVPNConnection): self.config_checker.run_all(skip_download=skip_download) self.run_openvpn_checks() except Exception as exc: - self.error_queue.put(exc) + exc_traceback = sys.exc_info()[2] + self.error_queue.put((exc, exc_traceback)) def connect(self): """ diff --git a/src/leap/eip/openvpnconnection.py b/src/leap/eip/openvpnconnection.py index c280f70d..65683485 100644 --- a/src/leap/eip/openvpnconnection.py +++ b/src/leap/eip/openvpnconnection.py @@ -117,11 +117,10 @@ to be triggered for each one of them. """ try: eip_config.check_vpn_keys() - except eip_exceptions.EIPInitNoKeyFileError: - self.missing_vpn_keyfile = True except eip_exceptions.EIPInitBadKeyFilePermError: - logger.error('error while checking vpn keys') - self.bad_keyfile_perms = True + logger.error('Bad VPN Keys permission!') + # do nothing now + # and raise the rest ... def _launch_openvpn(self): """ diff --git a/src/leap/eip/specs.py b/src/leap/eip/specs.py index e617574c..05aef590 100644 --- a/src/leap/eip/specs.py +++ b/src/leap/eip/specs.py @@ -1,15 +1,21 @@ from __future__ import (unicode_literals) import os +from leap import __branding from leap.base import config as baseconfig +PROVIDER_CA_CERT = __branding.get( + 'provider_ca_file', + 'testprovider-ca-cert.pem') provider_ca_path = lambda: unicode(os.path.join( baseconfig.get_default_provider_path(), 'keys', 'ca', - 'testprovider-ca-cert.pem' + PROVIDER_CA_CERT )) +PROVIDER_DOMAIN = __branding.get('provider_domain', 'testprovider.example.org') + client_cert_path = lambda: unicode(os.path.join( baseconfig.get_default_provider_path(), @@ -20,7 +26,7 @@ client_cert_path = lambda: unicode(os.path.join( eipconfig_spec = { 'provider': { 'type': unicode, - 'default': u"testprovider.example.org", + 'default': u"%s" % PROVIDER_DOMAIN, 'required': True, }, 'transport': { -- cgit v1.2.3 From 89735a5fd3c81e8aba3cb7b1d4836c1bf1e8c098 Mon Sep 17 00:00:00 2001 From: kali Date: Tue, 18 Sep 2012 22:55:45 +0900 Subject: cert verification and malformed json checks --- src/leap/base/config.py | 20 ++++++++++--- src/leap/base/constants.py | 2 +- src/leap/base/exceptions.py | 2 ++ src/leap/baseapp/eip.py | 2 ++ src/leap/eip/checks.py | 65 ++++++++++++++++++++++++++++++------------- src/leap/eip/eipconnection.py | 26 +++++++++++++++-- src/leap/eip/exceptions.py | 15 +++++++++- 7 files changed, 104 insertions(+), 28 deletions(-) (limited to 'src/leap') diff --git a/src/leap/base/config.py b/src/leap/base/config.py index e896ffd2..eb9bf88a 100644 --- a/src/leap/base/config.py +++ b/src/leap/base/config.py @@ -18,6 +18,9 @@ from leap.base import exceptions from leap.base import constants from leap.util.fileutil import (mkdir_p) +# move to base! +from leap.eip import exceptions as eipexceptions + class BaseLeapConfig(object): slug = None @@ -145,9 +148,9 @@ class JSONLeapConfig(BaseLeapConfig): config[k] = v() self._config.serialize(to) - def load(self, fromfile=None, from_uri=None, fetcher=None): + def load(self, fromfile=None, from_uri=None, fetcher=None, verify=False): if from_uri is not None: - fetched = self.fetch(from_uri, fetcher=fetcher) + fetched = self.fetch(from_uri, fetcher=fetcher, verify=verify) if fetched: return if fromfile is None: @@ -156,12 +159,21 @@ class JSONLeapConfig(BaseLeapConfig): # XXX check for no errors, etc self._config.config = newconfig - def fetch(self, uri, fetcher=None): + def fetch(self, uri, fetcher=None, verify=True): if not fetcher: fetcher = self.fetcher - request = fetcher.get(uri) + logger.debug('verify: %s', verify) + request = fetcher.get(uri, verify=verify) + + # XXX get 404, ... + # and raise a UnableToFetch... request.raise_for_status() fd, fname = tempfile.mkstemp(suffix=".json") + if not request.json: + try: + json.loads(request.content) + except ValueError: + raise eipexceptions.LeapBadConfigFetchedError with open(fname, 'w') as tmp: tmp.write(json.dumps(request.json)) self._loadtemp(fname) diff --git a/src/leap/base/constants.py b/src/leap/base/constants.py index f3e24715..7a1415fb 100644 --- a/src/leap/base/constants.py +++ b/src/leap/base/constants.py @@ -11,7 +11,7 @@ DEFAULT_PROVIDER = __branding.get( "provider_domain", "testprovider.example.org") -DEFINITION_EXPECTED_PATH = "definition.json" +DEFINITION_EXPECTED_PATH = "provider.json" DEFAULT_PROVIDER_DEFINITION = { u'api_uri': u'https://api.%s/' % DEFAULT_PROVIDER, diff --git a/src/leap/base/exceptions.py b/src/leap/base/exceptions.py index 9c4aa77b..caaa3be6 100644 --- a/src/leap/base/exceptions.py +++ b/src/leap/base/exceptions.py @@ -4,3 +4,5 @@ class MissingConfigFileError(Exception): class ImproperlyConfigured(Exception): pass + + diff --git a/src/leap/baseapp/eip.py b/src/leap/baseapp/eip.py index ff6a79ac..8ebd84ae 100644 --- a/src/leap/baseapp/eip.py +++ b/src/leap/baseapp/eip.py @@ -131,6 +131,8 @@ class EIPConductorAppMixin(object): ErrorDialog(errtype="critical", msg=message, label="critical error") + elif error.warning: + logger.warning(error.message) else: dialog = ErrorDialog() diff --git a/src/leap/eip/checks.py b/src/leap/eip/checks.py index aea5a5d7..b55f5827 100644 --- a/src/leap/eip/checks.py +++ b/src/leap/eip/checks.py @@ -9,6 +9,8 @@ import netifaces import ping import requests +from leap import __branding as BRANDING +from leap import certs from leap.base import constants as baseconstants from leap.base import providers from leap.eip import config as eipconfig @@ -20,6 +22,11 @@ from leap.util.fileutil import mkdir_p logger = logging.getLogger(name=__name__) """ +ProviderCertChecker +------------------- +Checks on certificates. To be moved to base. +docs TBD + EIPConfigChecker ---------- It is used from the eip conductor (a instance of EIPConnection that is @@ -36,14 +43,15 @@ LeapNetworkChecker ------------------ Network checks. To be moved to base. docs TBD - -ProviderCertChecker -------------------- -Checks on certificates. -docs TBD """ +def get_ca_cert(): + ca_file = BRANDING.get('provider_ca_file') + if ca_file: + return certs.where(ca_file) + + class LeapNetworkChecker(object): """ all network related checks @@ -67,6 +75,7 @@ class LeapNetworkChecker(object): # XXX we probably should raise an exception here? # unless we use this as smoke test try: + # XXX remove this hardcoded random ip requests.get('http://216.172.161.165') except (requests.HTTPError, requests.RequestException) as e: self.error = e.message @@ -124,7 +133,7 @@ class ProviderCertChecker(object): """ def __init__(self, fetcher=requests): self.fetcher = fetcher - self.cacert = None + self.cacert = get_ca_cert() def run_all(self, checker=None, skip_download=False): if not checker: @@ -159,25 +168,34 @@ class ProviderCertChecker(object): raise NotImplementedError def is_there_provider_ca(self): - # XXX fake it till you make it! :P + from leap import certs + logger.debug('do we have provider_ca?') + cacert_path = BRANDING.get('provider_ca_file', None) + if not cacert_path: + logger.debug('False') + return False + self.cacert = certs.where(cacert_path) + logger.debug('True') return True - # enable this when we have - # a custom "branded" bundle - # certs package. - try: - from leap.custom import certs - except ImportError: - raise - self.cacert = certs.where('cacert.pem') - def is_https_working(self, uri=None, verify=True): + if uri is None: + uri = self._get_root_uri() # XXX raise InsecureURI or something better + logger.debug('is https working?') + logger.debug('uri: %s', uri) + #import ipdb;ipdb.set_trace() assert uri.startswith('https') if verify is True and self.cacert is not None: + logger.debug('verify cert: %s', self.cacert) verify = self.cacert - self.fetcher.get(uri, verify=verify) - return True + try: + self.fetcher.get(uri, verify=verify) + except requests.exceptions.SSLError: + raise eipexceptions.EIPBadCertError + else: + logger.debug('True') + return True def check_new_cert_needed(self, skip_download=False): if not self.is_cert_valid(do_raise=False): @@ -256,7 +274,11 @@ class ProviderCertChecker(object): raise return True + def _get_root_uri(self): + return u"https://%s/" % baseconstants.DEFAULT_PROVIDER + def _get_client_cert_uri(self): + # XXX get the whole thing from constants return "https://%s/cert/get" % (baseconstants.DEFAULT_PROVIDER) def _get_client_cert_path(self): @@ -370,7 +392,12 @@ class EIPConfigChecker(object): domain = config.get('provider', None) uri = self._get_provider_definition_uri(domain=domain) - self.defaultprovider.load(from_uri=uri, fetcher=self.fetcher) + # FIXME! Pass ca path verify!!! + self.defaultprovider.load( + from_uri=uri, + fetcher=self.fetcher, + verify=False) + #import ipdb;ipdb.set_trace() self.defaultprovider.save() def fetch_eip_service_config(self, skip_download=False, diff --git a/src/leap/eip/eipconnection.py b/src/leap/eip/eipconnection.py index d1c84b2a..4e240f16 100644 --- a/src/leap/eip/eipconnection.py +++ b/src/leap/eip/eipconnection.py @@ -6,6 +6,7 @@ import logging import Queue import sys +from leap.eip.checks import ProviderCertChecker from leap.eip.checks import EIPConfigChecker from leap.eip import config as eipconfig from leap.eip import exceptions as eip_exceptions @@ -22,7 +23,10 @@ class EIPConnection(OpenVPNConnection): Status updates (connected, bandwidth, etc) are signaled to the GUI. """ - def __init__(self, config_checker=EIPConfigChecker, *args, **kwargs): + def __init__(self, + provider_cert_checker=ProviderCertChecker, + config_checker=EIPConfigChecker, + *args, **kwargs): self.settingsfile = kwargs.get('settingsfile', None) self.logfile = kwargs.get('logfile', None) @@ -30,6 +34,8 @@ class EIPConnection(OpenVPNConnection): status_signals = kwargs.pop('status_signals', None) self.status = EIPConnectionStatus(callbacks=status_signals) + + self.provider_cert_checker = provider_cert_checker() self.config_checker = config_checker() host = eipconfig.get_socket_path() @@ -45,12 +51,25 @@ class EIPConnection(OpenVPNConnection): run all eip checks previous to attempting a connection """ logger.debug('running conductor checks') + + def push_err(exc): + # keep the original traceback! + exc_traceback = sys.exc_info()[2] + self.error_queue.put((exc, exc_traceback)) + + try: + # network (1) + self.provider_cert_checker.run_all() + except Exception as exc: + push_err(exc) try: self.config_checker.run_all(skip_download=skip_download) + except Exception as exc: + push_err(exc) + try: self.run_openvpn_checks() except Exception as exc: - exc_traceback = sys.exc_info()[2] - self.error_queue.put((exc, exc_traceback)) + push_err(exc) def connect(self): """ @@ -84,6 +103,7 @@ class EIPConnection(OpenVPNConnection): # XXX this separation does not # make sense anymore after having # merged Connection and Manager classes. + # XXX GET RID OF THIS FUNCTION HERE! try: state = self.get_connection_state() except eip_exceptions.ConnectionRefusedError: diff --git a/src/leap/eip/exceptions.py b/src/leap/eip/exceptions.py index 467be7fe..f048621f 100644 --- a/src/leap/eip/exceptions.py +++ b/src/leap/eip/exceptions.py @@ -40,6 +40,8 @@ class EIPClientError(Exception): base EIPClient exception """ critical = False + failfirst = False + warning = False class CriticalError(EIPClientError): @@ -54,7 +56,7 @@ class Warning(EIPClientError): """ just that, warnings """ - pass + warning = True class EIPNoPolkitAuthAgentAvailable(CriticalError): @@ -81,10 +83,21 @@ class EIPNoCommandError(EIPClientError): "
(Might be a permissions problem)") +class EIPBadCertError(Warning): + # XXX this should be critical and fail close + message = "cert verification failed" + usermessage = "there is a problem with provider certificate" + + +class LeapBadConfigFetchedError(Warning): + message = "provider sent a malformed json file" + usermessage = "an error occurred during configuratio of leap services" + # # errors still needing some love # + class EIPInitNoKeyFileError(CriticalError): message = "No vpn keys found in the expected path" usermessage = "We could not find your eip certs in the expected path" -- cgit v1.2.3 From 79db1d90f617d90cda61a790c92a54afcf30ff16 Mon Sep 17 00:00:00 2001 From: kali Date: Wed, 19 Sep 2012 05:02:30 +0900 Subject: checks for certificate --- src/leap/eip/checks.py | 52 +++++++++++++++++++++++++++++++---------------- src/leap/eip/constants.py | 2 +- 2 files changed, 36 insertions(+), 18 deletions(-) (limited to 'src/leap') diff --git a/src/leap/eip/checks.py b/src/leap/eip/checks.py index b55f5827..cf758314 100644 --- a/src/leap/eip/checks.py +++ b/src/leap/eip/checks.py @@ -147,9 +147,10 @@ class ProviderCertChecker(object): # For MVS checker.is_there_provider_ca() - checker.is_https_working() - checker.check_new_cert_needed() - #checker.download_new_client_cert() + + # XXX FAKE IT!!! + checker.is_https_working(verify=False) + checker.check_new_cert_needed(verify=False) def download_ca_cert(self): # MVS+ @@ -184,7 +185,6 @@ class ProviderCertChecker(object): # XXX raise InsecureURI or something better logger.debug('is https working?') logger.debug('uri: %s', uri) - #import ipdb;ipdb.set_trace() assert uri.startswith('https') if verify is True and self.cacert is not None: logger.debug('verify cert: %s', self.cacert) @@ -192,19 +192,26 @@ class ProviderCertChecker(object): try: self.fetcher.get(uri, verify=verify) except requests.exceptions.SSLError: + logger.debug('False!') raise eipexceptions.EIPBadCertError else: logger.debug('True') return True - def check_new_cert_needed(self, skip_download=False): + def check_new_cert_needed(self, skip_download=False, verify=True): + logger.debug('is new cert needed?') if not self.is_cert_valid(do_raise=False): - self.download_new_client_cert(skip_download=skip_download) + logger.debug('True') + self.download_new_client_cert( + skip_download=skip_download, + verify=verify) return True + logger.debug('False') return False def download_new_client_cert(self, uri=None, verify=True, skip_download=False): + logger.debug('download new client cert') if skip_download: return True if uri is None: @@ -213,20 +220,28 @@ class ProviderCertChecker(object): assert uri.startswith('https') if verify is True and self.cacert is not None: verify = self.cacert - req = self.fetcher.get(uri, verify=verify) - pemfile_content = req.content - self.is_valid_pemfile(pemfile_content) - cert_path = self._get_client_cert_path() - self.write_cert(pemfile_content, to=cert_path) + try: + req = self.fetcher.get(uri, verify=verify) + req.raise_for_status() + except requests.exceptions.SSLError: + logger.warning('SSLError while fetching cert. ' + 'Look below for stack trace.') + # XXX raise better exception + raise + try: + pemfile_content = req.content + self.is_valid_pemfile(pemfile_content) + cert_path = self._get_client_cert_path() + self.write_cert(pemfile_content, to=cert_path) + except: + logger.warning('Error while validating cert') + raise return True def is_cert_valid(self, cert_path=None, do_raise=True): exists = lambda: self.is_certificate_exists() valid_pemfile = lambda: self.is_valid_pemfile() not_expired = lambda: self.is_cert_not_expired() - #print 'exists?', exists - #print 'valid', valid_pemfile - #print 'not expired', not_expired valid = exists() and valid_pemfile() and not_expired() if not valid: @@ -268,6 +283,11 @@ class ProviderCertChecker(object): # XXX use gnutls for get proper # validation. # crypto.X509Certificate(cert_s) + sep = "-" * 5 + "BEGIN CERTIFICATE" + "-" * 5 + # we might have private key and cert in the same file + certparts = cert_s.split(sep) + if len(certparts) > 1: + cert_s = sep + certparts[1] ssl.PEM_cert_to_DER_cert(cert_s) except: # XXX raise proper exception @@ -279,11 +299,10 @@ class ProviderCertChecker(object): def _get_client_cert_uri(self): # XXX get the whole thing from constants - return "https://%s/cert/get" % (baseconstants.DEFAULT_PROVIDER) + return "https://%s/1/cert" % (baseconstants.DEFAULT_PROVIDER) def _get_client_cert_path(self): # MVS+ : get provider path - #import ipdb;ipdb.set_trace() return eipspecs.client_cert_path() def write_cert(self, pemfile_content, to=None): @@ -397,7 +416,6 @@ class EIPConfigChecker(object): from_uri=uri, fetcher=self.fetcher, verify=False) - #import ipdb;ipdb.set_trace() self.defaultprovider.save() def fetch_eip_service_config(self, skip_download=False, diff --git a/src/leap/eip/constants.py b/src/leap/eip/constants.py index ce50f5e0..9af5a947 100644 --- a/src/leap/eip/constants.py +++ b/src/leap/eip/constants.py @@ -1,3 +1,3 @@ # not used anymore with the new JSONConfig.slug EIP_CONFIG = "eip.json" -EIP_SERVICE_EXPECTED_PATH = "eip-service.json" +EIP_SERVICE_EXPECTED_PATH = "1/config/eip-service.json" -- cgit v1.2.3 From 68b1a4a987b85540d2f13cfc800cbdf5efc27805 Mon Sep 17 00:00:00 2001 From: kali Date: Wed, 19 Sep 2012 05:16:57 +0900 Subject: copy cacert to local config dir --- src/leap/eip/config.py | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) (limited to 'src/leap') diff --git a/src/leap/eip/config.py b/src/leap/eip/config.py index c0e17a19..c3e830dd 100644 --- a/src/leap/eip/config.py +++ b/src/leap/eip/config.py @@ -3,7 +3,9 @@ import os import platform import tempfile -from leap.util.fileutil import (which, check_and_fix_urw_only) +from leap import __branding as BRANDING +from leap import certs +from leap.util.fileutil import (which, mkdir_p, check_and_fix_urw_only) from leap.base import config as baseconfig from leap.baseapp.permcheck import (is_pkexec_in_system, @@ -12,6 +14,7 @@ from leap.eip import exceptions as eip_exceptions from leap.eip import specs as eipspecs logger = logging.getLogger(name=__name__) +provider_ca_file = BRANDING.get('provider_ca_file', None) class EIPConfig(baseconfig.JSONLeapConfig): @@ -211,15 +214,30 @@ def check_vpn_keys(): logger.debug('client cert = %s', client_cert) # if no keys, raise error. - # should be catched by the ui and signal user. + # it's catched by the ui and signal user. + + if not os.path.isfile(provider_ca): + # not there. let's try to copy. + folder, filename = os.path.split(provider_ca) + if not os.path.isdir(folder): + mkdir_p(folder) + if provider_ca_file: + cacert = certs.where(provider_ca_file) + with open(provider_ca, 'w') as pca: + with open(cacert, 'r') as cac: + pca.write(cac.read()) + + if not os.path.isfile(provider_ca): + logger.error('key file %s not found. aborting.', + provider_ca) + raise eip_exceptions.EIPInitNoKeyFileError + + if not os.path.isfile(client_cert): + logger.error('key file %s not found. aborting.', + client_cert) + raise eip_exceptions.EIPInitNoKeyFileError for keyfile in (provider_ca, client_cert): - if not os.path.isfile(keyfile): - logger.error('key file %s not found. aborting.', - keyfile) - raise eip_exceptions.EIPInitNoKeyFileError - - # check proper permission on keys # bad perms? try to fix them try: check_and_fix_urw_only(keyfile) -- cgit v1.2.3 From 6a9523b0e83aca75bbfde5a8939ee612c5a78f9a Mon Sep 17 00:00:00 2001 From: kali Date: Wed, 19 Sep 2012 05:52:16 +0900 Subject: openvpn options come from eip.json --- src/leap/base/config.py | 180 ++++++++++++++++++++++++------------------------ src/leap/eip/config.py | 31 ++++++++- 2 files changed, 118 insertions(+), 93 deletions(-) (limited to 'src/leap') diff --git a/src/leap/base/config.py b/src/leap/base/config.py index eb9bf88a..a468a849 100644 --- a/src/leap/base/config.py +++ b/src/leap/base/config.py @@ -278,55 +278,55 @@ def get_groupname(): # json stuff # XXX merge with JSONConfig / EIPChecks as appropiate. -def get_config_json(config_file=None): - """ - will replace get_config function be developing them - in parralel for branch purposes. - @param: configuration file - @type: file - @rparam: configuration turples - @rtype: dictionary - """ - if not config_file: +#def get_config_json(config_file=None): + #""" + #will replace get_config function be developing them + #in parralel for branch purposes. + #@param: configuration file + #@type: file + #@rparam: configuration turples + #@rtype: dictionary + #""" + #if not config_file: #TODO: NOT SURE WHAT this default should be, if anything - fpath = get_config_file('eip.json') - if not os.path.isfile(fpath): - dpath, cfile = os.path.split(fpath) - if not os.path.isdir(dpath): - mkdir_p(dpath) - with open(fpath, 'wb') as configfile: - configfile.flush() - try: - return json.load(open(fpath)) - except ValueError: - raise exceptions.MissingConfigFileError - - else: + #fpath = get_config_file('eip.json') + #if not os.path.isfile(fpath): + #dpath, cfile = os.path.split(fpath) + #if not os.path.isdir(dpath): + #mkdir_p(dpath) + #with open(fpath, 'wb') as configfile: + #configfile.flush() + #try: + #return json.load(open(fpath)) + #except ValueError: + #raise exceptions.MissingConfigFileError +# + #else: #TODO: add validity checks of file - try: - return json.load(open(config_file)) - except IOError: - raise exceptions.MissingConfigFileError - - -def get_definition_file(url=None): - """ - """ + #try: + #return json.load(open(config_file)) + #except IOError: + #raise exceptions.MissingConfigFileError +# +# +#def get_definition_file(url=None): + #""" + #""" #TODO: determine good default location of definition file. - r = requests.get(url) - return r.json - - -def is_internet_up(): - """TODO: Build more robust network diagnosis capabilities - """ - try: - requests.get('http://128.30.52.45', timeout=1) - return True - except requests.Timeout: # as err: - pass - return False - + #r = requests.get(url) + #return r.json +# +# +#def is_internet_up(): + #"""TODO: Build more robust network diagnosis capabilities + #""" + #try: + #requests.get('http://128.30.52.45', timeout=1) + #return True + #except requests.Timeout: # as err: + #pass + #return False +# # XXX DEPRECATE. # move to eip.checks # @@ -335,49 +335,49 @@ def is_internet_up(): # moving it here transiently until I clean merge commit. # -- kali 2012-08-24 00:32 # - - -class Configuration(object): - """ - All configurations (providers et al) will be managed in this class. - """ - def __init__(self, provider_url=None): - try: +# +# +#class Configuration(object): + #""" + #All configurations (providers et al) will be managed in this class. + #""" + #def __init__(self, provider_url=None): + #try: #requests.get('foo') - self.providers = {} - self.error = False - provider_file = self.check_and_get_definition_file(provider_url) - self.providers['default'] = get_config_json(provider_file) - except (requests.HTTPError, requests.RequestException) as e: - self.error = e.message - except requests.ConnectionError as e: - if e.message == "[Errno 113] No route to host": - if not is_internet_up: + #self.providers = {} + #self.error = False + #provider_file = self.check_and_get_definition_file(provider_url) + #self.providers['default'] = get_config_json(provider_file) + #except (requests.HTTPError, requests.RequestException) as e: + #self.error = e.message + #except requests.ConnectionError as e: + #if e.message == "[Errno 113] No route to host": + #if not is_internet_up: # this was meant to be a function invocation I guess... - self.error = "No valid internet connection found" - else: - self.error = "Provider server appears currently down." - - def check_and_get_definition_file(self, provider_url): - """ - checks if provider definition.json file is present. - if not downloads one from the web. - """ - default_provider_path = get_default_provider_path() - - if not os.path.isdir(default_provider_path): - mkdir_p(default_provider_path) - - definition_file = get_config_file( - 'definition.json', - folder=default_provider_path) - - if os.path.isfile(definition_file): - return - - else: - r = requests.get(provider_url) - r.raise_for_status() - with open(definition_file, 'wb') as f: - f.write(json.dumps(r.json, indent=4)) - return definition_file + #self.error = "No valid internet connection found" + #else: + #self.error = "Provider server appears currently down." +# + #def check_and_get_definition_file(self, provider_url): + #""" + #checks if provider definition.json file is present. + #if not downloads one from the web. + #""" + #default_provider_path = get_default_provider_path() +# + #if not os.path.isdir(default_provider_path): + #mkdir_p(default_provider_path) +# + #definition_file = get_config_file( + #'definition.json', + #folder=default_provider_path) +# + #if os.path.isfile(definition_file): + #return +# + #else: + #r = requests.get(provider_url) + #r.raise_for_status() + #with open(definition_file, 'wb') as f: + #f.write(json.dumps(r.json, indent=4)) + #return definition_file diff --git a/src/leap/eip/config.py b/src/leap/eip/config.py index c3e830dd..e5fcd164 100644 --- a/src/leap/eip/config.py +++ b/src/leap/eip/config.py @@ -21,7 +21,11 @@ class EIPConfig(baseconfig.JSONLeapConfig): spec = eipspecs.eipconfig_spec def _get_slug(self): - return baseconfig.get_config_file('eip.json') + dppath = baseconfig.get_default_provider_path() + eipjsonpath = baseconfig.get_config_file( + 'eip-service.json', + folder=dppath) + return eipjsonpath def _set_slug(self, *args, **kwargs): raise AttributeError("you cannot set slug") @@ -51,6 +55,25 @@ def get_socket_path(): return socket_path +def get_eip_gateway(): + """ + return the first host in the list of hosts + under gateways list + """ + eipconfig = EIPConfig() + eipconfig.load() + conf = eipconfig.get_config() + gateways = conf.get('gateways', None) + if len(gateways) > 0: + # we just pick first + gw = gateways[0] + hosts = gw['hosts'] + if len(hosts) > 0: + return hosts[0] + else: + return "testprovider.example.org" + + def build_ovpn_options(daemon=False, socket_path=None, **kwargs): """ build a list of options @@ -87,9 +110,10 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs): opts.append("%s" % verbosity) # remote - # XXX get remote from eip.json opts.append('--remote') - opts.append('testprovider.example.org') + gw = get_eip_gateway() + logger.debug('setting eip gateway to %s', gw) + opts.append(str(gw)) opts.append('1194') opts.append('udp') @@ -140,6 +164,7 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs): #if daemon is True: #opts.append('--daemon') + logger.debug('vpn options: %s', opts) return opts -- cgit v1.2.3 From ecd8696e6e009826523b62a508cdf2202eaa2411 Mon Sep 17 00:00:00 2001 From: kali Date: Thu, 20 Sep 2012 02:29:19 +0900 Subject: tests pass after branding changes --- src/leap/base/exceptions.py | 2 -- src/leap/base/providers.py | 2 +- src/leap/base/tests/test_config.py | 62 ++++++++++++++++++----------------- src/leap/base/tests/test_providers.py | 6 ++-- src/leap/eip/config.py | 1 + src/leap/eip/tests/data.py | 14 +++++--- src/leap/eip/tests/test_checks.py | 4 +-- src/leap/eip/tests/test_config.py | 26 ++++++++++++--- 8 files changed, 70 insertions(+), 47 deletions(-) (limited to 'src/leap') diff --git a/src/leap/base/exceptions.py b/src/leap/base/exceptions.py index caaa3be6..9c4aa77b 100644 --- a/src/leap/base/exceptions.py +++ b/src/leap/base/exceptions.py @@ -4,5 +4,3 @@ class MissingConfigFileError(Exception): class ImproperlyConfigured(Exception): pass - - diff --git a/src/leap/base/providers.py b/src/leap/base/providers.py index ce30d4a4..7b219cc7 100644 --- a/src/leap/base/providers.py +++ b/src/leap/base/providers.py @@ -9,7 +9,7 @@ class LeapProviderDefinition(baseconfig.JSONLeapConfig): def _get_slug(self): provider_path = baseconfig.get_default_provider_path() return baseconfig.get_config_file( - 'provider-definition.json', + 'provider.json', folder=provider_path) def _set_slug(self, *args, **kwargs): diff --git a/src/leap/base/tests/test_config.py b/src/leap/base/tests/test_config.py index 74b06119..bede5ea1 100644 --- a/src/leap/base/tests/test_config.py +++ b/src/leap/base/tests/test_config.py @@ -65,15 +65,15 @@ class ProviderTest(BaseLeapTest): pass -class BareHomeTestCase(ProviderTest): +# XXX depreacated. similar test in eip.checks - __name__ = "provider_config_tests_bare_home" - - # XXX review. is it still needed? - - def test_should_raise_if_missing_eip_json(self): - with self.assertRaises(exceptions.MissingConfigFileError): - config.get_config_json(os.path.join(self.home, 'eip.json')) +#class BareHomeTestCase(ProviderTest): +# + #__name__ = "provider_config_tests_bare_home" +# + #def test_should_raise_if_missing_eip_json(self): + #with self.assertRaises(exceptions.MissingConfigFileError): + #config.get_config_json(os.path.join(self.home, 'eip.json')) class ProviderDefinitionTestCase(ProviderTest): @@ -94,8 +94,10 @@ class ProviderDefinitionTestCase(ProviderTest): json.dump(eipconstants.EIP_SAMPLE_JSON, fp) -# these tests below should move to wherever -# we put the fetcher for provider files and related stuff. +# these tests below should move to +# eip.checks +# config.Configuration has been deprecated + # TODO: # - We're instantiating a ProviderTest because we're doing the home wipeoff # on setUpClass instead of the setUp (for speedup of the general cases). @@ -112,26 +114,26 @@ class ProviderDefinitionTestCase(ProviderTest): # (so we can pass mock easily). -class ProviderFetchConError(ProviderTest): - def test_connection_error(self): - with mock.patch.object(requests, "get") as mock_method: - mock_method.side_effect = requests.ConnectionError - cf = config.Configuration() - self.assertIsInstance(cf.error, str) - - -class ProviderFetchHttpError(ProviderTest): - def test_file_not_found(self): - with mock.patch.object(requests, "get") as mock_method: - mock_method.side_effect = requests.HTTPError - cf = config.Configuration() - self.assertIsInstance(cf.error, str) - - -class ProviderFetchInvalidUrl(ProviderTest): - def test_invalid_url(self): - cf = config.Configuration("ht") - self.assertTrue(cf.error) +#class ProviderFetchConError(ProviderTest): + #def test_connection_error(self): + #with mock.patch.object(requests, "get") as mock_method: + #mock_method.side_effect = requests.ConnectionError + #cf = config.Configuration() + #self.assertIsInstance(cf.error, str) +# +# +#class ProviderFetchHttpError(ProviderTest): + #def test_file_not_found(self): + #with mock.patch.object(requests, "get") as mock_method: + #mock_method.side_effect = requests.HTTPError + #cf = config.Configuration() + #self.assertIsInstance(cf.error, str) +# +# +#class ProviderFetchInvalidUrl(ProviderTest): + #def test_invalid_url(self): + #cf = config.Configuration("ht") + #self.assertTrue(cf.error) # end provider fetch tests diff --git a/src/leap/base/tests/test_providers.py b/src/leap/base/tests/test_providers.py index 23f63a95..9e0ff90c 100644 --- a/src/leap/base/tests/test_providers.py +++ b/src/leap/base/tests/test_providers.py @@ -6,9 +6,11 @@ except ImportError: import os +from leap import __branding as BRANDING from leap.testing.basetest import BaseLeapTest from leap.base import providers + EXPECTED_DEFAULT_CONFIG = { "api_version": "0.1.0", "description": "test provider", @@ -45,8 +47,8 @@ class TestLeapProviderDefinition(BaseLeapTest): os.path.join( self.home, '.config', 'leap', 'providers', - 'testprovider.example.org', - 'provider-definition.json')) + '%s' % BRANDING.get('provider_domain'), + 'provider.json')) with self.assertRaises(AttributeError): self.definition.slug = 23 diff --git a/src/leap/eip/config.py b/src/leap/eip/config.py index e5fcd164..44922310 100644 --- a/src/leap/eip/config.py +++ b/src/leap/eip/config.py @@ -112,6 +112,7 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs): # remote opts.append('--remote') gw = get_eip_gateway() + #gw = "springbokvpn.org" logger.debug('setting eip gateway to %s', gw) opts.append(str(gw)) opts.append('1194') diff --git a/src/leap/eip/tests/data.py b/src/leap/eip/tests/data.py index 284b398f..4da0e18f 100644 --- a/src/leap/eip/tests/data.py +++ b/src/leap/eip/tests/data.py @@ -1,21 +1,25 @@ from __future__ import unicode_literals import os +from leap import __branding + # sample data used in tests +PROVIDER = __branding.get('provider_domain') + EIP_SAMPLE_JSON = { - "provider": "testprovider.example.org", + "provider": "%s" % PROVIDER, "transport": "openvpn", "openvpn_protocol": "tcp", "openvpn_port": 80, "openvpn_ca_certificate": os.path.expanduser( "~/.config/leap/providers/" - "testprovider.example.org/" - "keys/ca/testprovider-ca-cert.pem"), + "%s/" + "keys/ca/testprovider-ca-cert.pem" % PROVIDER), "openvpn_client_certificate": os.path.expanduser( "~/.config/leap/providers/" - "testprovider.example.org/" - "keys/client/openvpn.pem"), + "%s/" + "keys/client/openvpn.pem" % PROVIDER), "connect_on_login": True, "block_cleartext_traffic": True, "primary_gateway": "usa_west", diff --git a/src/leap/eip/tests/test_checks.py b/src/leap/eip/tests/test_checks.py index 952b10d2..42aa9cce 100644 --- a/src/leap/eip/tests/test_checks.py +++ b/src/leap/eip/tests/test_checks.py @@ -331,10 +331,10 @@ class ProviderCertCheckerHTTPSTests(BaseHTTPSServerTestCase, BaseLeapTest): fetcher.get(uri, verify=True) self.assertTrue( "SSL23_GET_SERVER_HELLO:unknown protocol" in exc.message) - with self.assertRaises(requests.exceptions.SSLError) as exc: + with self.assertRaises(eipexceptions.EIPBadCertError) as exc: checker.is_https_working(uri=uri, verify=True) self.assertTrue( - "SSL23_GET_SERVER_HELLO:unknown protocol" in exc.message) + "cert verification failed" in exc.message) # get cacert from testing.https_server cacert = where_cert('cacert.pem') diff --git a/src/leap/eip/tests/test_config.py b/src/leap/eip/tests/test_config.py index 60300770..f9f963dc 100644 --- a/src/leap/eip/tests/test_config.py +++ b/src/leap/eip/tests/test_config.py @@ -1,3 +1,4 @@ +import json import os import platform import stat @@ -9,11 +10,17 @@ except ImportError: #from leap.base import constants #from leap.eip import config as eip_config +from leap import __branding as BRANDING +from leap.eip import config as eipconfig +from leap.eip.tests.data import EIP_SAMPLE_SERVICE from leap.testing.basetest import BaseLeapTest from leap.util.fileutil import mkdir_p _system = platform.system() +PROVIDER = BRANDING.get('provider_domain') +PROVIDER_SHORTNAME = BRANDING.get('short_name') + class EIPConfigTest(BaseLeapTest): @@ -39,6 +46,14 @@ class EIPConfigTest(BaseLeapTest): open(tfile, 'wb').close() os.chmod(tfile, stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR) + def write_sample_eipservice(self): + conf = eipconfig.EIPConfig() + folder, f = os.path.split(conf.filename) + if not os.path.isdir(folder): + mkdir_p(folder) + with open(conf.filename, 'w') as fd: + fd.write(json.dumps(EIP_SAMPLE_SERVICE)) + def get_expected_openvpn_args(self): args = [] username = self.get_username() @@ -51,7 +66,7 @@ class EIPConfigTest(BaseLeapTest): args.append('--persist-tun') args.append('--persist-key') args.append('--remote') - args.append('testprovider.example.org') + args.append('%s' % eipconfig.get_eip_gateway()) # XXX get port!? args.append('1194') # XXX get proto @@ -80,23 +95,23 @@ class EIPConfigTest(BaseLeapTest): args.append(os.path.join( self.home, '.config', 'leap', 'providers', - 'testprovider.example.org', + '%s' % PROVIDER, 'keys', 'client', 'openvpn.pem')) args.append('--key') args.append(os.path.join( self.home, '.config', 'leap', 'providers', - 'testprovider.example.org', + '%s' % PROVIDER, 'keys', 'client', 'openvpn.pem')) args.append('--ca') args.append(os.path.join( self.home, '.config', 'leap', 'providers', - 'testprovider.example.org', + '%s' % PROVIDER, 'keys', 'ca', - 'testprovider-ca-cert.pem')) + '%s-cacert.pem' % PROVIDER_SHORTNAME)) return args # build command string @@ -107,6 +122,7 @@ class EIPConfigTest(BaseLeapTest): def test_build_ovpn_command_empty_config(self): self.touch_exec() + self.write_sample_eipservice() from leap.eip import config as eipconfig from leap.util.fileutil import which path = os.environ['PATH'] -- cgit v1.2.3