diff options
| -rw-r--r-- | src/leap/bitmask/vpn/_checks.py | 25 | ||||
| -rw-r--r-- | src/leap/bitmask/vpn/service.py | 20 |
2 files changed, 30 insertions, 15 deletions
diff --git a/src/leap/bitmask/vpn/_checks.py b/src/leap/bitmask/vpn/_checks.py index 3921d03..6c08962 100644 --- a/src/leap/bitmask/vpn/_checks.py +++ b/src/leap/bitmask/vpn/_checks.py @@ -1,5 +1,9 @@ import os +from datetime import datetime +from time import mktime + +from leap.common.certs import get_cert_time_boundaries from leap.common.config import get_path_prefix @@ -11,10 +15,21 @@ class ImproperlyConfigured(Exception): def is_service_ready(provider): - _has_valid_cert(provider) + if not _has_valid_cert(provider): + raise ImproperlyConfigured('Missing VPN certificate') + return True +def cert_expires(provider): + path = get_vpn_cert_path(provider) + with open(path, 'r') as f: + cert = f.read() + _, to = get_cert_time_boundaries(cert) + expiry_date = datetime.fromtimestamp(mktime(to)) + return expiry_date + + def get_vpn_cert_path(provider): return os.path.join(get_path_prefix(), 'leap', 'providers', provider, @@ -25,4 +40,10 @@ def _has_valid_cert(provider): cert_path = get_vpn_cert_path(provider) has_file = os.path.isfile(cert_path) if not has_file: - raise ImproperlyConfigured('Missing VPN certificate') + return False + + expiry = cert_expires(provider) + if datetime.now() > expiry: + return False + + return True diff --git a/src/leap/bitmask/vpn/service.py b/src/leap/bitmask/vpn/service.py index c9e1890..1ecfa79 100644 --- a/src/leap/bitmask/vpn/service.py +++ b/src/leap/bitmask/vpn/service.py @@ -22,7 +22,6 @@ VPN service declaration. import json import os -from time import strftime from twisted.internet import defer from twisted.logger import Logger @@ -31,11 +30,14 @@ from leap.bitmask.util import merge_status from leap.bitmask.vpn.gateways import GatewaySelector from leap.bitmask.vpn.fw.firewall import FirewallManager from leap.bitmask.vpn.tunnel import ConfiguredTunnel -from leap.bitmask.vpn._checks import is_service_ready, get_vpn_cert_path +from leap.bitmask.vpn._checks import ( + is_service_ready, + get_vpn_cert_path, + cert_expires +) from leap.bitmask.vpn import privilege, helpers from leap.common.config import get_path_prefix from leap.common.files import check_and_fix_urw_only -from leap.common.certs import get_cert_time_boundaries class ImproperlyConfigured(Exception): @@ -166,7 +168,8 @@ class VPNService(HookableService): ret = {'installed': helpers.check()} if domain: ret['vpn_ready'] = is_service_ready(domain) - ret['cert_expires'] = self._cert_expires(domain) + expiry = cert_expires(domain).strftime('%Y-%m-%dT%H:%M:%SZ') + ret['cert_expires'] = expiry return ret @defer.inlineCallbacks @@ -270,15 +273,6 @@ class VPNService(HookableService): provider, remotes, cert_path, key_path, ca_path, extra_flags) self._firewall = FirewallManager(remotes) - def _cert_expires(self, provider): - path = os.path.join( - self._basepath, "leap", "providers", provider, - "keys", "client", "openvpn.pem") - with open(path, 'r') as f: - cert = f.read() - _, to = get_cert_time_boundaries(cert) - return strftime('%Y-%m-%dT%H:%M:%SZ', to) - def _write_last(self, domain): path = os.path.join(self._basepath, self._last_vpn_path) with open(path, 'w') as f: |