Merge branch 'feature/openvpn-ciphers' into develop

1 files changed, 56 insertions, 13 deletions

diff --git a/src/leap/eip/config.py b/src/leap/eip/config.py
index 42c00380..e40d2785 100644
--- a/src/leap/eip/config.py
+++ b/src/leap/eip/config.py
@@ -1,10 +1,12 @@
 import logging
 import os
 import platform
+import re
 import tempfile
 
 from leap import __branding as BRANDING
 from leap import certs
+from leap.util.misc import null_check
 from leap.util.fileutil import (which, mkdir_p, check_and_fix_urw_only)
 
 from leap.base import config as baseconfig
@@ -53,34 +55,34 @@ def get_socket_path():
     socket_path = os.path.join(
         tempfile.mkdtemp(prefix="leap-tmp"),
         'openvpn.socket')
-    logger.debug('socket path: %s', socket_path)
+    #logger.debug('socket path: %s', socket_path)
     return socket_path
 
 
-def get_eip_gateway(provider=None):
+def get_eip_gateway(eipconfig=None, eipserviceconfig=None):
     """
     return the first host in eip service config
     that matches the name defined in the eip.json config
     file.
     """
-    placeholder = "testprovider.example.org"
-    # XXX check for null on provider??
+    null_check(eipconfig, "eipconfig")
+    null_check(eipserviceconfig, "eipserviceconfig")
+
+    PLACEHOLDER = "testprovider.example.org"
 
-    eipconfig = EIPConfig(domain=provider)
-    eipconfig.load()
     conf = eipconfig.config
+    eipsconf = eipserviceconfig.config
 
     primary_gateway = conf.get('primary_gateway', None)
     if not primary_gateway:
-        return placeholder
+        return PLACEHOLDER
 
-    eipserviceconfig = EIPServiceConfig(domain=provider)
-    eipserviceconfig.load()
-    eipsconf = eipserviceconfig.get_config()
     gateways = eipsconf.get('gateways', None)
+
     if not gateways:
         logger.error('missing gateways in eip service config')
-        return placeholder
+        return PLACEHOLDER
+
     if len(gateways) > 0:
         for gw in gateways:
             name = gw.get('name', None)
@@ -100,6 +102,30 @@ def get_eip_gateway(provider=None):
                  'gateway list')
 
 
+def get_cipher_options(eipserviceconfig=None):
+    """
+    gathers optional cipher options from eip-service config.
+    :param eipserviceconfig: EIPServiceConfig instance
+    """
+    null_check(eipserviceconfig, 'eipserviceconfig')
+    eipsconf = eipserviceconfig.get_config()
+
+    ALLOWED_KEYS = ("auth", "cipher", "tls-cipher")
+    CIPHERS_REGEX = re.compile("[A-Z0-9\-]+")
+    opts = []
+    if 'openvpn_configuration' in eipsconf:
+        config = eipserviceconfig.config.get(
+            "openvpn_configuration", {})
+        for key, value in config.items():
+            if key in ALLOWED_KEYS and value is not None:
+                sanitized_val = CIPHERS_REGEX.findall(value)
+                if len(sanitized_val) != 0:
+                    _val = sanitized_val[0]
+                    opts.append('--%s' % key)
+                    opts.append('%s' % _val)
+    return opts
+
+
 def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
     """
     build a list of options
@@ -116,6 +142,10 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
     # things from there if present.
 
     provider = kwargs.pop('provider', None)
+    eipconfig = EIPConfig(domain=provider)
+    eipconfig.load()
+    eipserviceconfig = EIPServiceConfig(domain=provider)
+    eipserviceconfig.load()
 
     # get user/group name
     # also from config.
@@ -137,11 +167,17 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
         opts.append('--verb')
         opts.append("%s" % verbosity)
 
-    # remote
+    # remote ##############################
+    # (server, port, protocol)
+
     opts.append('--remote')
-    gw = get_eip_gateway(provider=provider)
+
+    gw = get_eip_gateway(eipconfig=eipconfig,
+                         eipserviceconfig=eipserviceconfig)
     logger.debug('setting eip gateway to %s', gw)
     opts.append(str(gw))
+
+    # get port/protocol from eipservice too
     opts.append('1194')
     #opts.append('80')
     opts.append('udp')
@@ -150,6 +186,13 @@ def build_ovpn_options(daemon=False, socket_path=None, **kwargs):
     opts.append('--remote-cert-tls')
     opts.append('server')
 
+    # get ciphers #######################
+
+    ciphers = get_cipher_options(
+        eipserviceconfig=eipserviceconfig)
+    for cipheropt in ciphers:
+        opts.append(str(cipheropt))
+
     # set user and group
     opts.append('--user')
     opts.append('%s' % user)