def get_gpg_bin_path(): """ Return the path to gpg binary. :returns: the gpg binary path :rtype: str """ global STANDALONE gpgbin = None if STANDALONE: if platform.system() == "Windows": gpgbin = os.path.abspath( os.path.join(here(), "apps", "mail", "gpg.exe")) elif platform.system() == "Darwin": gpgbin = os.path.abspath( os.path.join(here(), "apps", "mail", "gpg")) else: gpgbin = os.path.abspath( os.path.join(here(), "..", "apps", "mail", "gpg")) else: try: path_ext = '/usr/bin/:/usr/local/opt/gnupg/bin/' gpgbin_options = which("gpg", path_extension=path_ext) # gnupg checks that the path to the binary is not a # symlink, so we need to filter those and come up with # just one option. for opt in gpgbin_options: # dereference a symlink, but will fail because # no complete gpg2 support at the moment # path = os.readlink(opt) path = opt if os.path.exists(path) and not os.path.islink(path): gpgbin = path break except IndexError as e: log.debug("Couldn't find the gpg binary!: %s" % (e, )) if gpgbin is not None: return gpgbin # During the transition towards gpg2, we can look for /usr/bin/gpg1 # binary, in case it was renamed using dpkg-divert or manually. # We could just pick gpg2, but we need to solve #7564 first. try: path_ext = '/usr/bin/:/usr/local/opt/gnupg/bin/' gpgbin_options = which("gpg1", path_extension=path_ext) for opt in gpgbin_options: if not os.path.islink(opt): gpgbin = opt break except IndexError as e: log.debug("Couldn't find the gpg1 binary!: %s" % (e, )) if gpgbin is None: log.debug("Could not find gpg1 binary") return gpgbin
def maybe_pkexec(self): """ Checks whether pkexec is available in the system, and returns the path if found. Might raise: NoPkexecAvailable, NoPolkitAuthAgentAvailable. :returns: a list of the paths where pkexec is to be found :rtype: list """ if self._is_pkexec_in_system(): if not self.is_up(): self.launch() time.sleep(2) if self.is_up(): pkexec_possibilities = which(self.PKEXEC_BIN) leap_assert( len(pkexec_possibilities) > 0, "We couldn't find pkexec") return pkexec_possibilities else: logger.warning("No polkit auth agent found. pkexec " + "will use its own auth agent.") raise NoPolkitAuthAgentAvailable() else: logger.warning("System has no pkexec") raise NoPkexecAvailable()
def maybe_pkexec(self): """ Checks whether pkexec is available in the system, and returns the path if found. Might raise: NoPkexecAvailable, NoPolkitAuthAgentAvailable. :returns: a list of the paths where pkexec is to be found :rtype: list """ if self._is_pkexec_in_system(): if not self.is_up(): self.launch() time.sleep(2) if self.is_up(): pkexec_possibilities = which(self.PKEXEC_BIN) leap_assert(len(pkexec_possibilities) > 0, "We couldn't find pkexec") return pkexec_possibilities else: logger.warning("No polkit auth agent found. pkexec " + "will use its own auth agent.") raise NoPolkitAuthAgentAvailable() else: logger.warning("System has no pkexec") raise NoPkexecAvailable()
def maybe_pkexec(kls): """ Checks whether pkexec is available in the system, and returns the path if found. Might raise: EIPNoPkexecAvailable, EIPNoPolkitAuthAgentAvailable. :returns: a list of the paths where pkexec is to be found :rtype: list """ if _is_pkexec_in_system(): if not _is_auth_agent_running(): _try_to_launch_agent() time.sleep(0.5) if _is_auth_agent_running(): pkexec_possibilities = which(kls.PKEXEC_BIN) leap_assert(len(pkexec_possibilities) > 0, "We couldn't find pkexec") return pkexec_possibilities else: logger.warning("No polkit auth agent found. pkexec " + "will use its own auth agent.") raise EIPNoPolkitAuthAgentAvailable() else: logger.warning("System has no pkexec") raise EIPNoPkexecAvailable()
def get_gpg_bin_path(): """ Return the path to gpg binary. :returns: the gpg binary path :rtype: str """ global STANDALONE if STANDALONE: if platform.system() == "Windows": gpgbin = os.path.abspath( os.path.join(here(), "apps", "mail", "gpg.exe")) elif platform.system() == "Darwin": gpgbin = '/Applications/Bitmask.app/Contents/Resources/gpg' else: gpgbin = os.path.abspath( os.path.join(here(), "..", "apps", "mail", "gpg")) return gpgbin path_ext = '/bin:/usr/bin/:/usr/local/bin:/usr/local/opt/gnupg/bin/' for gpgbin_name in ["gpg1", "gpg"]: gpgbin_options = which(gpgbin_name, path_extension=path_ext) if len(gpgbin_options) >= 1: return gpgbin_options[0] log.debug("Could not find gpg binary") return None
def _get_gpg_bin_path(self): """ Return the path to gpg binary. :returns: the gpg binary path :rtype: str """ gpgbin = None if flags.STANDALONE: gpgbin = os.path.join(get_path_prefix(), "..", "apps", "mail", "gpg") if IS_WIN: gpgbin += ".exe" else: try: gpgbin_options = which("gpg") # gnupg checks that the path to the binary is not a # symlink, so we need to filter those and come up with # just one option. for opt in gpgbin_options: if not os.path.islink(opt): gpgbin = opt break except IndexError as e: logger.debug("Couldn't find the gpg binary!") logger.exception(e) leap_check(gpgbin is not None, "Could not find gpg binary") return gpgbin
def _is_pkexec_in_system(self): """ Checks the existence of the pkexec binary in system. """ pkexec_path = which('pkexec') if len(pkexec_path) == 0: return False return True
def _get_gpg_bin_path(self): """ Return the path to gpg binary. :returns: the gpg binary path :rtype: str """ gpgbin = None if flags.STANDALONE: gpgbin = os.path.join( get_path_prefix(), "..", "apps", "mail", "gpg") if IS_WIN: gpgbin += ".exe" else: try: gpgbin_options = which("gpg") # gnupg checks that the path to the binary is not a # symlink, so we need to filter those and come up with # just one option. for opt in gpgbin_options: if not os.path.islink(opt): gpgbin = opt break except IndexError as e: logger.debug("Couldn't find the gpg binary!") logger.exception(e) if IS_MAC: gpgbin = os.path.abspath( os.path.join(here(), "apps", "mail", "gpg")) # During the transition towards gpg2, we can look for /usr/bin/gpg1 # binary, in case it was renamed using dpkg-divert or manually. # We could just pick gpg2, but we need to solve #7564 first. if gpgbin is None: try: gpgbin_options = which("gpg1") for opt in gpgbin_options: if not os.path.islink(opt): gpgbin = opt break except IndexError as e: logger.debug("Couldn't find the gpg1 binary!") logger.exception(e) leap_check(gpgbin is not None, "Could not find gpg1 binary") return gpgbin
def _get_gpg_bin_path(self): """ Return the path to gpg binary. :returns: the gpg binary path :rtype: str """ gpgbin = None if flags.STANDALONE: gpgbin = os.path.join(get_path_prefix(), "..", "apps", "mail", "gpg") if IS_WIN: gpgbin += ".exe" else: try: gpgbin_options = which("gpg") # gnupg checks that the path to the binary is not a # symlink, so we need to filter those and come up with # just one option. for opt in gpgbin_options: if not os.path.islink(opt): gpgbin = opt break except IndexError as e: logger.debug("Couldn't find the gpg binary!") logger.exception(e) if IS_MAC: gpgbin = os.path.abspath( os.path.join(here(), "apps", "mail", "gpg")) # During the transition towards gpg2, we can look for /usr/bin/gpg1 # binary, in case it was renamed using dpkg-divert or manually. # We could just pick gpg2, but we need to solve #7564 first. if gpgbin is None: try: gpgbin_options = which("gpg1") for opt in gpgbin_options: if not os.path.islink(opt): gpgbin = opt break except IndexError as e: logger.debug("Couldn't find the gpg1 binary!") logger.exception(e) leap_check(gpgbin is not None, "Could not find gpg1 binary") return gpgbin
def get_vpn_command( self, eipconfig=None, providerconfig=None, socket_host=None, socket_port="9876", openvpn_verb=1 ): """ Returns the platform dependant vpn launching command. It will look for openvpn in the regular paths and algo in path_prefix/apps/eip/ (in case standalone is set) Might raise VPNException. :param eipconfig: eip configuration object :type eipconfig: EIPConfig :param providerconfig: provider specific configuration :type providerconfig: ProviderConfig :param socket_host: either socket path (unix) or socket IP :type socket_host: str :param socket_port: either string "unix" if it's a unix socket, or port otherwise :type socket_port: str :param openvpn_verb: the openvpn verbosity wanted :type openvpn_verb: int :return: A VPN command ready to be launched :rtype: list """ leap_assert(eipconfig, "We need an eip config") leap_assert_type(eipconfig, EIPConfig) leap_assert(providerconfig, "We need a provider config") leap_assert_type(providerconfig, ProviderConfig) leap_assert(socket_host, "We need a socket host!") leap_assert(socket_port, "We need a socket port!") leap_assert(socket_port != "unix", "We cannot use unix sockets in windows!") openvpn_possibilities = which( self.OPENVPN_BIN, path_extension=os.path.join(providerconfig.get_path_prefix(), "..", "apps", "eip") ) if len(openvpn_possibilities) == 0: raise OpenVPNNotFoundException() openvpn = first(openvpn_possibilities) args = [] args += ["--setenv", "LEAPOPENVPN", "1"] if openvpn_verb is not None: args += ["--verb", "%d" % (openvpn_verb,)] gateways = [] leap_settings = LeapSettings(ProviderConfig.standalone) domain = providerconfig.get_domain() gateway_conf = leap_settings.get_selected_gateway(domain) if gateway_conf == leap_settings.GATEWAY_AUTOMATIC: gateway_selector = VPNGatewaySelector(eipconfig) gateways = gateway_selector.get_gateways() else: gateways = [gateway_conf] if not gateways: logger.error("No gateway was found!") raise VPNLauncherException(self.tr("No gateway was found!")) logger.debug("Using gateways ips: {0}".format(", ".join(gateways))) for gw in gateways: args += ["--remote", gw, "1194", "udp"] args += [ "--client", "--dev", "tun", ############################################################## # persist-tun makes ping-restart fail because it leaves a # broken routing table ############################################################## # '--persist-tun', "--persist-key", "--tls-client", # We make it log to a file because we cannot attach to the # openvpn process' stdout since it's a process with more # privileges than we are "--log-append", "eip.log", "--remote-cert-tls", "server", ] openvpn_configuration = eipconfig.get_openvpn_configuration() for key, value in openvpn_configuration.items(): args += ["--%s" % (key,), value] ############################################################## # The down-root plugin fails in some situations, so we don't # drop privs for the time being ############################################################## # args += [ # '--user', getpass.getuser(), # #'--group', grp.getgrgid(os.getgroups()[-1]).gr_name # ] args += ["--management-signal", "--management", socket_host, socket_port, "--script-security", "2"] args += [ "--cert", eipconfig.get_client_cert_path(providerconfig), "--key", eipconfig.get_client_cert_path(providerconfig), "--ca", providerconfig.get_ca_cert_path(), ] logger.debug("Running VPN with command:") logger.debug("%s %s" % (openvpn, " ".join(args))) return [openvpn] + args
def get_vpn_command( self, eipconfig=None, providerconfig=None, socket_host=None, socket_port="unix", openvpn_verb=1 ): """ Returns the platform dependant vpn launching command Might raise VPNException. :param eipconfig: eip configuration object :type eipconfig: EIPConfig :param providerconfig: provider specific configuration :type providerconfig: ProviderConfig :param socket_host: either socket path (unix) or socket IP :type socket_host: str :param socket_port: either string "unix" if it's a unix socket, or port otherwise :type socket_port: str :param openvpn_verb: openvpn verbosity wanted :type openvpn_verb: int :return: A VPN command ready to be launched :rtype: list """ leap_assert(eipconfig, "We need an eip config") leap_assert_type(eipconfig, EIPConfig) leap_assert(providerconfig, "We need a provider config") leap_assert_type(providerconfig, ProviderConfig) leap_assert(socket_host, "We need a socket host!") leap_assert(socket_port, "We need a socket port!") if not self.maybe_kextloaded(): raise EIPNoTunKextLoaded kwargs = {} if ProviderConfig.standalone: kwargs["path_extension"] = os.path.join(providerconfig.get_path_prefix(), "..", "apps", "eip") openvpn_possibilities = which(self.OPENVPN_BIN, **kwargs) if len(openvpn_possibilities) == 0: raise OpenVPNNotFoundException() openvpn = first(openvpn_possibilities) args = [openvpn] args += ["--setenv", "LEAPOPENVPN", "1"] if openvpn_verb is not None: args += ["--verb", "%d" % (openvpn_verb,)] gateways = [] leap_settings = LeapSettings(ProviderConfig.standalone) domain = providerconfig.get_domain() gateway_conf = leap_settings.get_selected_gateway(domain) if gateway_conf == leap_settings.GATEWAY_AUTOMATIC: gateway_selector = VPNGatewaySelector(eipconfig) gateways = gateway_selector.get_gateways() else: gateways = [gateway_conf] if not gateways: logger.error("No gateway was found!") raise VPNLauncherException(self.tr("No gateway was found!")) logger.debug("Using gateways ips: {0}".format(", ".join(gateways))) for gw in gateways: args += ["--remote", gw, "1194", "udp"] args += [ "--client", "--dev", "tun", ############################################################## # persist-tun makes ping-restart fail because it leaves a # broken routing table ############################################################## # '--persist-tun', "--persist-key", "--tls-client", "--remote-cert-tls", "server", ] openvpn_configuration = eipconfig.get_openvpn_configuration() for key, value in openvpn_configuration.items(): args += ["--%s" % (key,), value] user = getpass.getuser() ############################################################## # The down-root plugin fails in some situations, so we don't # drop privs for the time being ############################################################## # args += [ # '--user', user, # '--group', grp.getgrgid(os.getgroups()[-1]).gr_name # ] if socket_port == "unix": args += ["--management-client-user", user] args += ["--management-signal", "--management", socket_host, socket_port, "--script-security", "2"] if _has_updown_scripts(self.UP_SCRIPT): args += ["--up", '"%s"' % (self.UP_SCRIPT,)] if _has_updown_scripts(self.DOWN_SCRIPT): args += ["--down", '"%s"' % (self.DOWN_SCRIPT,)] # should have the down script too if _has_updown_scripts(self.OPENVPN_DOWN_PLUGIN): args += [ ########################################################### # For the time being we are disabling the usage of the # down-root plugin, because it doesn't quite work as # expected (i.e. it doesn't run route -del as root # when finishing, so it fails to properly # restart/quit) ########################################################### # '--plugin', self.OPENVPN_DOWN_PLUGIN, # '\'%s\'' % self.DOWN_SCRIPT ] # we set user to be passed to the up/down scripts args += ["--setenv", "LEAPUSER", "%s" % (user,)] args += [ "--cert", eipconfig.get_client_cert_path(providerconfig), "--key", eipconfig.get_client_cert_path(providerconfig), "--ca", providerconfig.get_ca_cert_path(), ] command, cargs = self.get_cocoasudo_ovpn_cmd() cmd_args = cargs + args logger.debug("Running VPN with command:") logger.debug("%s %s" % (command, " ".join(cmd_args))) return [command] + cmd_args
def get_vpn_command( self, eipconfig=None, providerconfig=None, socket_host=None, socket_port="unix", openvpn_verb=1 ): """ Returns the platform dependant vpn launching command. It will look for openvpn in the regular paths and algo in path_prefix/apps/eip/ (in case standalone is set) Might raise: VPNLauncherException, OpenVPNNotFoundException. :param eipconfig: eip configuration object :type eipconfig: EIPConfig :param providerconfig: provider specific configuration :type providerconfig: ProviderConfig :param socket_host: either socket path (unix) or socket IP :type socket_host: str :param socket_port: either string "unix" if it's a unix socket, or port otherwise :type socket_port: str :param openvpn_verb: openvpn verbosity wanted :type openvpn_verb: int :return: A VPN command ready to be launched :rtype: list """ leap_assert(eipconfig, "We need an eip config") leap_assert_type(eipconfig, EIPConfig) leap_assert(providerconfig, "We need a provider config") leap_assert_type(providerconfig, ProviderConfig) leap_assert(socket_host, "We need a socket host!") leap_assert(socket_port, "We need a socket port!") kwargs = {} if ProviderConfig.standalone: kwargs["path_extension"] = os.path.join(providerconfig.get_path_prefix(), "..", "apps", "eip") openvpn_possibilities = which(self.OPENVPN_BIN, **kwargs) if len(openvpn_possibilities) == 0: raise OpenVPNNotFoundException() openvpn = first(openvpn_possibilities) args = [] pkexec = self.maybe_pkexec() if pkexec: args.append(openvpn) openvpn = first(pkexec) args += ["--setenv", "LEAPOPENVPN", "1"] if openvpn_verb is not None: args += ["--verb", "%d" % (openvpn_verb,)] gateways = [] leap_settings = LeapSettings(ProviderConfig.standalone) domain = providerconfig.get_domain() gateway_conf = leap_settings.get_selected_gateway(domain) if gateway_conf == leap_settings.GATEWAY_AUTOMATIC: gateway_selector = VPNGatewaySelector(eipconfig) gateways = gateway_selector.get_gateways() else: gateways = [gateway_conf] if not gateways: logger.error("No gateway was found!") raise VPNLauncherException(self.tr("No gateway was found!")) logger.debug("Using gateways ips: {0}".format(", ".join(gateways))) for gw in gateways: args += ["--remote", gw, "1194", "udp"] args += [ "--client", "--dev", "tun", ############################################################## # persist-tun makes ping-restart fail because it leaves a # broken routing table ############################################################## # '--persist-tun', "--persist-key", "--tls-client", "--remote-cert-tls", "server", ] openvpn_configuration = eipconfig.get_openvpn_configuration() for key, value in openvpn_configuration.items(): args += ["--%s" % (key,), value] ############################################################## # The down-root plugin fails in some situations, so we don't # drop privs for the time being ############################################################## # args += [ # '--user', getpass.getuser(), # '--group', grp.getgrgid(os.getgroups()[-1]).gr_name # ] if socket_port == "unix": # that's always the case for linux args += ["--management-client-user", getpass.getuser()] args += ["--management-signal", "--management", socket_host, socket_port, "--script-security", "2"] plugin_path = self.maybe_down_plugin() # If we do not have the down plugin neither in the bundle # nor in the system, we do not do updown scripts. The alternative # is leaving the user without the ability to restore dns and routes # to its original state. if plugin_path and _has_updown_scripts(self.UP_DOWN_PATH): args += [ "--up", self.UP_DOWN_PATH, "--down", self.UP_DOWN_PATH, ############################################################## # For the time being we are disabling the usage of the # down-root plugin, because it doesn't quite work as # expected (i.e. it doesn't run route -del as root # when finishing, so it fails to properly # restart/quit) ############################################################## # '--plugin', plugin_path, # '\'script_type=down %s\'' % self.UP_DOWN_PATH ] args += [ "--cert", eipconfig.get_client_cert_path(providerconfig), "--key", eipconfig.get_client_cert_path(providerconfig), "--ca", providerconfig.get_ca_cert_path(), ] logger.debug("Running VPN with command:") logger.debug("%s %s" % (openvpn, " ".join(args))) return [openvpn] + args
def get_vpn_command(kls, eipconfig, providerconfig, socket_host, socket_port, openvpn_verb=1): """ Returns the platform dependant vpn launching command Might raise: OpenVPNNotFoundException, VPNLauncherException. :param eipconfig: eip configuration object :type eipconfig: EIPConfig :param providerconfig: provider specific configuration :type providerconfig: ProviderConfig :param socket_host: either socket path (unix) or socket IP :type socket_host: str :param socket_port: either string "unix" if it's a unix socket, or port otherwise :type socket_port: str :param openvpn_verb: the openvpn verbosity wanted :type openvpn_verb: int :return: A VPN command ready to be launched. :rtype: list """ leap_assert_type(eipconfig, EIPConfig) leap_assert_type(providerconfig, ProviderConfig) kwargs = {} if flags.STANDALONE: kwargs['path_extension'] = os.path.join( get_path_prefix(), "..", "apps", "eip") openvpn_possibilities = which(kls.OPENVPN_BIN, **kwargs) if len(openvpn_possibilities) == 0: raise OpenVPNNotFoundException() openvpn = first(openvpn_possibilities) args = [] args += [ '--setenv', "LEAPOPENVPN", "1", '--nobind' ] if openvpn_verb is not None: args += ['--verb', '%d' % (openvpn_verb,)] gateways = [] leap_settings = LeapSettings() domain = providerconfig.get_domain() gateway_conf = leap_settings.get_selected_gateway(domain) if gateway_conf == leap_settings.GATEWAY_AUTOMATIC: gateway_selector = VPNGatewaySelector(eipconfig) gateways = gateway_selector.get_gateways() else: gateways = [gateway_conf] if not gateways: logger.error('No gateway was found!') raise VPNLauncherException('No gateway was found!') logger.debug("Using gateways ips: {0}".format(', '.join(gateways))) for gw in gateways: args += ['--remote', gw, '1194', 'udp'] args += [ '--client', '--dev', 'tun', ############################################################## # persist-tun makes ping-restart fail because it leaves a # broken routing table ############################################################## # '--persist-tun', '--persist-key', '--tls-client', '--remote-cert-tls', 'server' ] openvpn_configuration = eipconfig.get_openvpn_configuration() for key, value in openvpn_configuration.items(): args += ['--%s' % (key,), value] user = getpass.getuser() ############################################################## # The down-root plugin fails in some situations, so we don't # drop privs for the time being ############################################################## # args += [ # '--user', user, # '--group', grp.getgrgid(os.getgroups()[-1]).gr_name # ] if socket_port == "unix": # that's always the case for linux args += [ '--management-client-user', user ] args += [ '--management-signal', '--management', socket_host, socket_port, '--script-security', '2' ] if kls.UP_SCRIPT is not None: if _has_updown_scripts(kls.UP_SCRIPT): args += [ '--up', '\"%s\"' % (kls.UP_SCRIPT,), ] if kls.DOWN_SCRIPT is not None: if _has_updown_scripts(kls.DOWN_SCRIPT): args += [ '--down', '\"%s\"' % (kls.DOWN_SCRIPT,) ] ########################################################### # For the time being we are disabling the usage of the # down-root plugin, because it doesn't quite work as # expected (i.e. it doesn't run route -del as root # when finishing, so it fails to properly # restart/quit) ########################################################### # if _has_updown_scripts(kls.OPENVPN_DOWN_PLUGIN): # args += [ # '--plugin', kls.OPENVPN_DOWN_ROOT, # '\'%s\'' % kls.DOWN_SCRIPT # for OSX # '\'script_type=down %s\'' % kls.DOWN_SCRIPT # for Linux # ] args += [ '--cert', eipconfig.get_client_cert_path(providerconfig), '--key', eipconfig.get_client_cert_path(providerconfig), '--ca', providerconfig.get_ca_cert_path() ] args += [ '--ping', '10', '--ping-restart', '30'] command_and_args = [openvpn] + args return command_and_args