def get_gpg_bin_path():
"""
Return the path to gpg binary.
:returns: the gpg binary path
:rtype: str
"""
global STANDALONE
gpgbin = None
if STANDALONE:
if platform.system() == "Windows":
gpgbin = os.path.abspath(
os.path.join(here(), "apps", "mail", "gpg.exe"))
elif platform.system() == "Darwin":
gpgbin = os.path.abspath(
os.path.join(here(), "apps", "mail", "gpg"))
else:
gpgbin = os.path.abspath(
os.path.join(here(), "..", "apps", "mail", "gpg"))
else:
try:
path_ext = '/usr/bin/:/usr/local/opt/gnupg/bin/'
gpgbin_options = which("gpg", path_extension=path_ext)
# gnupg checks that the path to the binary is not a
# symlink, so we need to filter those and come up with
# just one option.
for opt in gpgbin_options:
# dereference a symlink, but will fail because
# no complete gpg2 support at the moment
# path = os.readlink(opt)
path = opt
if os.path.exists(path) and not os.path.islink(path):
gpgbin = path
break
except IndexError as e:
log.debug("Couldn't find the gpg binary!: %s" % (e, ))
if gpgbin is not None:
return gpgbin
# During the transition towards gpg2, we can look for /usr/bin/gpg1
# binary, in case it was renamed using dpkg-divert or manually.
# We could just pick gpg2, but we need to solve #7564 first.
try:
path_ext = '/usr/bin/:/usr/local/opt/gnupg/bin/'
gpgbin_options = which("gpg1", path_extension=path_ext)
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
log.debug("Couldn't find the gpg1 binary!: %s" % (e, ))
if gpgbin is None:
log.debug("Could not find gpg1 binary")
return gpgbin
def maybe_pkexec(self):
"""
Checks whether pkexec is available in the system, and
returns the path if found.
Might raise:
NoPkexecAvailable,
NoPolkitAuthAgentAvailable.
:returns: a list of the paths where pkexec is to be found
:rtype: list
"""
if self._is_pkexec_in_system():
if not self.is_up():
self.launch()
time.sleep(2)
if self.is_up():
pkexec_possibilities = which(self.PKEXEC_BIN)
leap_assert(
len(pkexec_possibilities) > 0, "We couldn't find pkexec")
return pkexec_possibilities
else:
logger.warning("No polkit auth agent found. pkexec " +
"will use its own auth agent.")
raise NoPolkitAuthAgentAvailable()
else:
logger.warning("System has no pkexec")
raise NoPkexecAvailable()
def maybe_pkexec(self):
"""
Checks whether pkexec is available in the system, and
returns the path if found.
Might raise:
NoPkexecAvailable,
NoPolkitAuthAgentAvailable.
:returns: a list of the paths where pkexec is to be found
:rtype: list
"""
if self._is_pkexec_in_system():
if not self.is_up():
self.launch()
time.sleep(2)
if self.is_up():
pkexec_possibilities = which(self.PKEXEC_BIN)
leap_assert(len(pkexec_possibilities) > 0,
"We couldn't find pkexec")
return pkexec_possibilities
else:
logger.warning("No polkit auth agent found. pkexec " +
"will use its own auth agent.")
raise NoPolkitAuthAgentAvailable()
else:
logger.warning("System has no pkexec")
raise NoPkexecAvailable()
def maybe_pkexec(kls):
"""
Checks whether pkexec is available in the system, and
returns the path if found.
Might raise:
EIPNoPkexecAvailable,
EIPNoPolkitAuthAgentAvailable.
:returns: a list of the paths where pkexec is to be found
:rtype: list
"""
if _is_pkexec_in_system():
if not _is_auth_agent_running():
_try_to_launch_agent()
time.sleep(0.5)
if _is_auth_agent_running():
pkexec_possibilities = which(kls.PKEXEC_BIN)
leap_assert(len(pkexec_possibilities) > 0,
"We couldn't find pkexec")
return pkexec_possibilities
else:
logger.warning("No polkit auth agent found. pkexec " +
"will use its own auth agent.")
raise EIPNoPolkitAuthAgentAvailable()
else:
logger.warning("System has no pkexec")
raise EIPNoPkexecAvailable()
def get_gpg_bin_path():
"""
Return the path to gpg binary.
:returns: the gpg binary path
:rtype: str
"""
global STANDALONE
if STANDALONE:
if platform.system() == "Windows":
gpgbin = os.path.abspath(
os.path.join(here(), "apps", "mail", "gpg.exe"))
elif platform.system() == "Darwin":
gpgbin = '/Applications/Bitmask.app/Contents/Resources/gpg'
else:
gpgbin = os.path.abspath(
os.path.join(here(), "..", "apps", "mail", "gpg"))
return gpgbin
path_ext = '/bin:/usr/bin/:/usr/local/bin:/usr/local/opt/gnupg/bin/'
for gpgbin_name in ["gpg1", "gpg"]:
gpgbin_options = which(gpgbin_name, path_extension=path_ext)
if len(gpgbin_options) >= 1:
return gpgbin_options[0]
log.debug("Could not find gpg binary")
return None
def _get_gpg_bin_path(self):
"""
Return the path to gpg binary.
:returns: the gpg binary path
:rtype: str
"""
gpgbin = None
if flags.STANDALONE:
gpgbin = os.path.join(get_path_prefix(), "..", "apps", "mail", "gpg")
if IS_WIN:
gpgbin += ".exe"
else:
try:
gpgbin_options = which("gpg")
# gnupg checks that the path to the binary is not a
# symlink, so we need to filter those and come up with
# just one option.
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
logger.debug("Couldn't find the gpg binary!")
logger.exception(e)
leap_check(gpgbin is not None, "Could not find gpg binary")
return gpgbin
def _get_gpg_bin_path(self):
"""
Return the path to gpg binary.
:returns: the gpg binary path
:rtype: str
"""
gpgbin = None
if flags.STANDALONE:
gpgbin = os.path.join(get_path_prefix(), "..", "apps", "mail",
"gpg")
if IS_WIN:
gpgbin += ".exe"
else:
try:
gpgbin_options = which("gpg")
# gnupg checks that the path to the binary is not a
# symlink, so we need to filter those and come up with
# just one option.
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
logger.debug("Couldn't find the gpg binary!")
logger.exception(e)
leap_check(gpgbin is not None, "Could not find gpg binary")
return gpgbin
def _is_pkexec_in_system(self):
"""
Checks the existence of the pkexec binary in system.
"""
pkexec_path = which('pkexec')
if len(pkexec_path) == 0:
return False
return True
def _is_pkexec_in_system(self):
"""
Checks the existence of the pkexec binary in system.
"""
pkexec_path = which('pkexec')
if len(pkexec_path) == 0:
return False
return True
def _get_gpg_bin_path(self):
"""
Return the path to gpg binary.
:returns: the gpg binary path
:rtype: str
"""
gpgbin = None
if flags.STANDALONE:
gpgbin = os.path.join(
get_path_prefix(), "..", "apps", "mail", "gpg")
if IS_WIN:
gpgbin += ".exe"
else:
try:
gpgbin_options = which("gpg")
# gnupg checks that the path to the binary is not a
# symlink, so we need to filter those and come up with
# just one option.
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
logger.debug("Couldn't find the gpg binary!")
logger.exception(e)
if IS_MAC:
gpgbin = os.path.abspath(
os.path.join(here(), "apps", "mail", "gpg"))
# During the transition towards gpg2, we can look for /usr/bin/gpg1
# binary, in case it was renamed using dpkg-divert or manually.
# We could just pick gpg2, but we need to solve #7564 first.
if gpgbin is None:
try:
gpgbin_options = which("gpg1")
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
logger.debug("Couldn't find the gpg1 binary!")
logger.exception(e)
leap_check(gpgbin is not None, "Could not find gpg1 binary")
return gpgbin
def _get_gpg_bin_path(self):
"""
Return the path to gpg binary.
:returns: the gpg binary path
:rtype: str
"""
gpgbin = None
if flags.STANDALONE:
gpgbin = os.path.join(get_path_prefix(), "..", "apps", "mail",
"gpg")
if IS_WIN:
gpgbin += ".exe"
else:
try:
gpgbin_options = which("gpg")
# gnupg checks that the path to the binary is not a
# symlink, so we need to filter those and come up with
# just one option.
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
logger.debug("Couldn't find the gpg binary!")
logger.exception(e)
if IS_MAC:
gpgbin = os.path.abspath(
os.path.join(here(), "apps", "mail", "gpg"))
# During the transition towards gpg2, we can look for /usr/bin/gpg1
# binary, in case it was renamed using dpkg-divert or manually.
# We could just pick gpg2, but we need to solve #7564 first.
if gpgbin is None:
try:
gpgbin_options = which("gpg1")
for opt in gpgbin_options:
if not os.path.islink(opt):
gpgbin = opt
break
except IndexError as e:
logger.debug("Couldn't find the gpg1 binary!")
logger.exception(e)
leap_check(gpgbin is not None, "Could not find gpg1 binary")
return gpgbin
def get_vpn_command(
self, eipconfig=None, providerconfig=None, socket_host=None, socket_port="9876", openvpn_verb=1
):
"""
Returns the platform dependant vpn launching command. It will
look for openvpn in the regular paths and algo in
path_prefix/apps/eip/ (in case standalone is set)
Might raise VPNException.
:param eipconfig: eip configuration object
:type eipconfig: EIPConfig
:param providerconfig: provider specific configuration
:type providerconfig: ProviderConfig
:param socket_host: either socket path (unix) or socket IP
:type socket_host: str
:param socket_port: either string "unix" if it's a unix
socket, or port otherwise
:type socket_port: str
:param openvpn_verb: the openvpn verbosity wanted
:type openvpn_verb: int
:return: A VPN command ready to be launched
:rtype: list
"""
leap_assert(eipconfig, "We need an eip config")
leap_assert_type(eipconfig, EIPConfig)
leap_assert(providerconfig, "We need a provider config")
leap_assert_type(providerconfig, ProviderConfig)
leap_assert(socket_host, "We need a socket host!")
leap_assert(socket_port, "We need a socket port!")
leap_assert(socket_port != "unix", "We cannot use unix sockets in windows!")
openvpn_possibilities = which(
self.OPENVPN_BIN, path_extension=os.path.join(providerconfig.get_path_prefix(), "..", "apps", "eip")
)
if len(openvpn_possibilities) == 0:
raise OpenVPNNotFoundException()
openvpn = first(openvpn_possibilities)
args = []
args += ["--setenv", "LEAPOPENVPN", "1"]
if openvpn_verb is not None:
args += ["--verb", "%d" % (openvpn_verb,)]
gateways = []
leap_settings = LeapSettings(ProviderConfig.standalone)
domain = providerconfig.get_domain()
gateway_conf = leap_settings.get_selected_gateway(domain)
if gateway_conf == leap_settings.GATEWAY_AUTOMATIC:
gateway_selector = VPNGatewaySelector(eipconfig)
gateways = gateway_selector.get_gateways()
else:
gateways = [gateway_conf]
if not gateways:
logger.error("No gateway was found!")
raise VPNLauncherException(self.tr("No gateway was found!"))
logger.debug("Using gateways ips: {0}".format(", ".join(gateways)))
for gw in gateways:
args += ["--remote", gw, "1194", "udp"]
args += [
"--client",
"--dev",
"tun",
##############################################################
# persist-tun makes ping-restart fail because it leaves a
# broken routing table
##############################################################
# '--persist-tun',
"--persist-key",
"--tls-client",
# We make it log to a file because we cannot attach to the
# openvpn process' stdout since it's a process with more
# privileges than we are
"--log-append",
"eip.log",
"--remote-cert-tls",
"server",
]
openvpn_configuration = eipconfig.get_openvpn_configuration()
for key, value in openvpn_configuration.items():
args += ["--%s" % (key,), value]
##############################################################
# The down-root plugin fails in some situations, so we don't
# drop privs for the time being
##############################################################
# args += [
# '--user', getpass.getuser(),
# #'--group', grp.getgrgid(os.getgroups()[-1]).gr_name
# ]
args += ["--management-signal", "--management", socket_host, socket_port, "--script-security", "2"]
args += [
"--cert",
eipconfig.get_client_cert_path(providerconfig),
"--key",
eipconfig.get_client_cert_path(providerconfig),
"--ca",
providerconfig.get_ca_cert_path(),
]
logger.debug("Running VPN with command:")
logger.debug("%s %s" % (openvpn, " ".join(args)))
return [openvpn] + args
def get_vpn_command(
self, eipconfig=None, providerconfig=None, socket_host=None, socket_port="unix", openvpn_verb=1
):
"""
Returns the platform dependant vpn launching command
Might raise VPNException.
:param eipconfig: eip configuration object
:type eipconfig: EIPConfig
:param providerconfig: provider specific configuration
:type providerconfig: ProviderConfig
:param socket_host: either socket path (unix) or socket IP
:type socket_host: str
:param socket_port: either string "unix" if it's a unix
socket, or port otherwise
:type socket_port: str
:param openvpn_verb: openvpn verbosity wanted
:type openvpn_verb: int
:return: A VPN command ready to be launched
:rtype: list
"""
leap_assert(eipconfig, "We need an eip config")
leap_assert_type(eipconfig, EIPConfig)
leap_assert(providerconfig, "We need a provider config")
leap_assert_type(providerconfig, ProviderConfig)
leap_assert(socket_host, "We need a socket host!")
leap_assert(socket_port, "We need a socket port!")
if not self.maybe_kextloaded():
raise EIPNoTunKextLoaded
kwargs = {}
if ProviderConfig.standalone:
kwargs["path_extension"] = os.path.join(providerconfig.get_path_prefix(), "..", "apps", "eip")
openvpn_possibilities = which(self.OPENVPN_BIN, **kwargs)
if len(openvpn_possibilities) == 0:
raise OpenVPNNotFoundException()
openvpn = first(openvpn_possibilities)
args = [openvpn]
args += ["--setenv", "LEAPOPENVPN", "1"]
if openvpn_verb is not None:
args += ["--verb", "%d" % (openvpn_verb,)]
gateways = []
leap_settings = LeapSettings(ProviderConfig.standalone)
domain = providerconfig.get_domain()
gateway_conf = leap_settings.get_selected_gateway(domain)
if gateway_conf == leap_settings.GATEWAY_AUTOMATIC:
gateway_selector = VPNGatewaySelector(eipconfig)
gateways = gateway_selector.get_gateways()
else:
gateways = [gateway_conf]
if not gateways:
logger.error("No gateway was found!")
raise VPNLauncherException(self.tr("No gateway was found!"))
logger.debug("Using gateways ips: {0}".format(", ".join(gateways)))
for gw in gateways:
args += ["--remote", gw, "1194", "udp"]
args += [
"--client",
"--dev",
"tun",
##############################################################
# persist-tun makes ping-restart fail because it leaves a
# broken routing table
##############################################################
# '--persist-tun',
"--persist-key",
"--tls-client",
"--remote-cert-tls",
"server",
]
openvpn_configuration = eipconfig.get_openvpn_configuration()
for key, value in openvpn_configuration.items():
args += ["--%s" % (key,), value]
user = getpass.getuser()
##############################################################
# The down-root plugin fails in some situations, so we don't
# drop privs for the time being
##############################################################
# args += [
# '--user', user,
# '--group', grp.getgrgid(os.getgroups()[-1]).gr_name
# ]
if socket_port == "unix":
args += ["--management-client-user", user]
args += ["--management-signal", "--management", socket_host, socket_port, "--script-security", "2"]
if _has_updown_scripts(self.UP_SCRIPT):
args += ["--up", '"%s"' % (self.UP_SCRIPT,)]
if _has_updown_scripts(self.DOWN_SCRIPT):
args += ["--down", '"%s"' % (self.DOWN_SCRIPT,)]
# should have the down script too
if _has_updown_scripts(self.OPENVPN_DOWN_PLUGIN):
args += [
###########################################################
# For the time being we are disabling the usage of the
# down-root plugin, because it doesn't quite work as
# expected (i.e. it doesn't run route -del as root
# when finishing, so it fails to properly
# restart/quit)
###########################################################
# '--plugin', self.OPENVPN_DOWN_PLUGIN,
# '\'%s\'' % self.DOWN_SCRIPT
]
# we set user to be passed to the up/down scripts
args += ["--setenv", "LEAPUSER", "%s" % (user,)]
args += [
"--cert",
eipconfig.get_client_cert_path(providerconfig),
"--key",
eipconfig.get_client_cert_path(providerconfig),
"--ca",
providerconfig.get_ca_cert_path(),
]
command, cargs = self.get_cocoasudo_ovpn_cmd()
cmd_args = cargs + args
logger.debug("Running VPN with command:")
logger.debug("%s %s" % (command, " ".join(cmd_args)))
return [command] + cmd_args
def get_vpn_command(
self, eipconfig=None, providerconfig=None, socket_host=None, socket_port="unix", openvpn_verb=1
):
"""
Returns the platform dependant vpn launching command. It will
look for openvpn in the regular paths and algo in
path_prefix/apps/eip/ (in case standalone is set)
Might raise:
VPNLauncherException,
OpenVPNNotFoundException.
:param eipconfig: eip configuration object
:type eipconfig: EIPConfig
:param providerconfig: provider specific configuration
:type providerconfig: ProviderConfig
:param socket_host: either socket path (unix) or socket IP
:type socket_host: str
:param socket_port: either string "unix" if it's a unix
socket, or port otherwise
:type socket_port: str
:param openvpn_verb: openvpn verbosity wanted
:type openvpn_verb: int
:return: A VPN command ready to be launched
:rtype: list
"""
leap_assert(eipconfig, "We need an eip config")
leap_assert_type(eipconfig, EIPConfig)
leap_assert(providerconfig, "We need a provider config")
leap_assert_type(providerconfig, ProviderConfig)
leap_assert(socket_host, "We need a socket host!")
leap_assert(socket_port, "We need a socket port!")
kwargs = {}
if ProviderConfig.standalone:
kwargs["path_extension"] = os.path.join(providerconfig.get_path_prefix(), "..", "apps", "eip")
openvpn_possibilities = which(self.OPENVPN_BIN, **kwargs)
if len(openvpn_possibilities) == 0:
raise OpenVPNNotFoundException()
openvpn = first(openvpn_possibilities)
args = []
pkexec = self.maybe_pkexec()
if pkexec:
args.append(openvpn)
openvpn = first(pkexec)
args += ["--setenv", "LEAPOPENVPN", "1"]
if openvpn_verb is not None:
args += ["--verb", "%d" % (openvpn_verb,)]
gateways = []
leap_settings = LeapSettings(ProviderConfig.standalone)
domain = providerconfig.get_domain()
gateway_conf = leap_settings.get_selected_gateway(domain)
if gateway_conf == leap_settings.GATEWAY_AUTOMATIC:
gateway_selector = VPNGatewaySelector(eipconfig)
gateways = gateway_selector.get_gateways()
else:
gateways = [gateway_conf]
if not gateways:
logger.error("No gateway was found!")
raise VPNLauncherException(self.tr("No gateway was found!"))
logger.debug("Using gateways ips: {0}".format(", ".join(gateways)))
for gw in gateways:
args += ["--remote", gw, "1194", "udp"]
args += [
"--client",
"--dev",
"tun",
##############################################################
# persist-tun makes ping-restart fail because it leaves a
# broken routing table
##############################################################
# '--persist-tun',
"--persist-key",
"--tls-client",
"--remote-cert-tls",
"server",
]
openvpn_configuration = eipconfig.get_openvpn_configuration()
for key, value in openvpn_configuration.items():
args += ["--%s" % (key,), value]
##############################################################
# The down-root plugin fails in some situations, so we don't
# drop privs for the time being
##############################################################
# args += [
# '--user', getpass.getuser(),
# '--group', grp.getgrgid(os.getgroups()[-1]).gr_name
# ]
if socket_port == "unix": # that's always the case for linux
args += ["--management-client-user", getpass.getuser()]
args += ["--management-signal", "--management", socket_host, socket_port, "--script-security", "2"]
plugin_path = self.maybe_down_plugin()
# If we do not have the down plugin neither in the bundle
# nor in the system, we do not do updown scripts. The alternative
# is leaving the user without the ability to restore dns and routes
# to its original state.
if plugin_path and _has_updown_scripts(self.UP_DOWN_PATH):
args += [
"--up",
self.UP_DOWN_PATH,
"--down",
self.UP_DOWN_PATH,
##############################################################
# For the time being we are disabling the usage of the
# down-root plugin, because it doesn't quite work as
# expected (i.e. it doesn't run route -del as root
# when finishing, so it fails to properly
# restart/quit)
##############################################################
# '--plugin', plugin_path,
# '\'script_type=down %s\'' % self.UP_DOWN_PATH
]
args += [
"--cert",
eipconfig.get_client_cert_path(providerconfig),
"--key",
eipconfig.get_client_cert_path(providerconfig),
"--ca",
providerconfig.get_ca_cert_path(),
]
logger.debug("Running VPN with command:")
logger.debug("%s %s" % (openvpn, " ".join(args)))
return [openvpn] + args
def get_vpn_command(kls, eipconfig, providerconfig,
socket_host, socket_port, openvpn_verb=1):
"""
Returns the platform dependant vpn launching command
Might raise:
OpenVPNNotFoundException,
VPNLauncherException.
:param eipconfig: eip configuration object
:type eipconfig: EIPConfig
:param providerconfig: provider specific configuration
:type providerconfig: ProviderConfig
:param socket_host: either socket path (unix) or socket IP
:type socket_host: str
:param socket_port: either string "unix" if it's a unix socket,
or port otherwise
:type socket_port: str
:param openvpn_verb: the openvpn verbosity wanted
:type openvpn_verb: int
:return: A VPN command ready to be launched.
:rtype: list
"""
leap_assert_type(eipconfig, EIPConfig)
leap_assert_type(providerconfig, ProviderConfig)
kwargs = {}
if flags.STANDALONE:
kwargs['path_extension'] = os.path.join(
get_path_prefix(), "..", "apps", "eip")
openvpn_possibilities = which(kls.OPENVPN_BIN, **kwargs)
if len(openvpn_possibilities) == 0:
raise OpenVPNNotFoundException()
openvpn = first(openvpn_possibilities)
args = []
args += [
'--setenv', "LEAPOPENVPN", "1",
'--nobind'
]
if openvpn_verb is not None:
args += ['--verb', '%d' % (openvpn_verb,)]
gateways = []
leap_settings = LeapSettings()
domain = providerconfig.get_domain()
gateway_conf = leap_settings.get_selected_gateway(domain)
if gateway_conf == leap_settings.GATEWAY_AUTOMATIC:
gateway_selector = VPNGatewaySelector(eipconfig)
gateways = gateway_selector.get_gateways()
else:
gateways = [gateway_conf]
if not gateways:
logger.error('No gateway was found!')
raise VPNLauncherException('No gateway was found!')
logger.debug("Using gateways ips: {0}".format(', '.join(gateways)))
for gw in gateways:
args += ['--remote', gw, '1194', 'udp']
args += [
'--client',
'--dev', 'tun',
##############################################################
# persist-tun makes ping-restart fail because it leaves a
# broken routing table
##############################################################
# '--persist-tun',
'--persist-key',
'--tls-client',
'--remote-cert-tls',
'server'
]
openvpn_configuration = eipconfig.get_openvpn_configuration()
for key, value in openvpn_configuration.items():
args += ['--%s' % (key,), value]
user = getpass.getuser()
##############################################################
# The down-root plugin fails in some situations, so we don't
# drop privs for the time being
##############################################################
# args += [
# '--user', user,
# '--group', grp.getgrgid(os.getgroups()[-1]).gr_name
# ]
if socket_port == "unix": # that's always the case for linux
args += [
'--management-client-user', user
]
args += [
'--management-signal',
'--management', socket_host, socket_port,
'--script-security', '2'
]
if kls.UP_SCRIPT is not None:
if _has_updown_scripts(kls.UP_SCRIPT):
args += [
'--up', '\"%s\"' % (kls.UP_SCRIPT,),
]
if kls.DOWN_SCRIPT is not None:
if _has_updown_scripts(kls.DOWN_SCRIPT):
args += [
'--down', '\"%s\"' % (kls.DOWN_SCRIPT,)
]
###########################################################
# For the time being we are disabling the usage of the
# down-root plugin, because it doesn't quite work as
# expected (i.e. it doesn't run route -del as root
# when finishing, so it fails to properly
# restart/quit)
###########################################################
# if _has_updown_scripts(kls.OPENVPN_DOWN_PLUGIN):
# args += [
# '--plugin', kls.OPENVPN_DOWN_ROOT,
# '\'%s\'' % kls.DOWN_SCRIPT # for OSX
# '\'script_type=down %s\'' % kls.DOWN_SCRIPT # for Linux
# ]
args += [
'--cert', eipconfig.get_client_cert_path(providerconfig),
'--key', eipconfig.get_client_cert_path(providerconfig),
'--ca', providerconfig.get_ca_cert_path()
]
args += [
'--ping', '10',
'--ping-restart', '30']
command_and_args = [openvpn] + args
return command_and_args
