evo-cli 0.26.0__tar.gz → 0.26.1__tar.gz

{evo_cli-0.26.0 → evo_cli-0.26.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.26.0
+Version: 0.26.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -132,6 +132,7 @@ evo openvpn list                               # numbered table: state, tunnel I
 evo openvpn connect work                       # hidden sudo prompt, then a live status view
 evo openvpn connect 2                          # by # from list; omit to pick (last one is default)
 evo openvpn status -w                          # watch again later; alerts on drops
+evo openvpn log -n 80                          # recent OpenVPN log lines: why it dropped
 evo openvpn disconnect                         # picks the active tunnel
 evo cred sync push
 ```
@@ -145,6 +146,9 @@ reconnects (`--no-watch` returns immediately). Ctrl-C stops watching and offers
 disconnect; the tunnel otherwise keeps running. Soft drops (`ping-restart`,
 `connection-reset`) reconnect automatically with a fresh OTP; the view logs each one and
 raises a desktop notification, and exits 1 with the reason if the tunnel goes down.
+`evo openvpn log` prints the worker's last 200 OpenVPN log lines, kept in memory only,
+to show why a drop happened. The client sends a keepalive ping every 10 seconds so idle
+TCP sessions survive NAT and firewalls; a keepalive pushed by the server takes precedence.
 
 Import each profile under a different name. Imports refuse to overwrite an existing
 name unless `--replace` is supplied; replacement preserves that profile's credentials.

{evo_cli-0.26.0 → evo_cli-0.26.1}/README.md

@@ -99,6 +99,7 @@ evo openvpn list                               # numbered table: state, tunnel I
 evo openvpn connect work                       # hidden sudo prompt, then a live status view
 evo openvpn connect 2                          # by # from list; omit to pick (last one is default)
 evo openvpn status -w                          # watch again later; alerts on drops
+evo openvpn log -n 80                          # recent OpenVPN log lines: why it dropped
 evo openvpn disconnect                         # picks the active tunnel
 evo cred sync push
 ```
@@ -112,6 +113,9 @@ reconnects (`--no-watch` returns immediately). Ctrl-C stops watching and offers
 disconnect; the tunnel otherwise keeps running. Soft drops (`ping-restart`,
 `connection-reset`) reconnect automatically with a fresh OTP; the view logs each one and
 raises a desktop notification, and exits 1 with the reason if the tunnel goes down.
+`evo openvpn log` prints the worker's last 200 OpenVPN log lines, kept in memory only,
+to show why a drop happened. The client sends a keepalive ping every 10 seconds so idle
+TCP sessions survive NAT and firewalls; a keepalive pushed by the server takes precedence.
 
 Import each profile under a different name. Imports refuse to overwrite an existing
 name unless `--replace` is supplied; replacement preserves that profile's credentials.

evo_cli-0.26.1/evo_cli/VERSION

@@ -0,0 +1 @@
+0.26.1

{evo_cli-0.26.0 → evo_cli-0.26.1}/evo_cli/commands/localproxy.py

@@ -2,9 +2,9 @@
 evo localproxy — HTTPS reverse proxy mapping https://{domain}.local -> https://{domain}.
 
 Use case: browse / test a real HTTPS site under a local alias. A request to
-``https://edunext.ptudev.net.local`` is TLS-terminated locally with a leaf cert
+``https://app.example.com.local`` is TLS-terminated locally with a leaf cert
 issued by a small local CA, the ``.local`` suffix is stripped, and the request is
-forwarded over TLS to the real ``https://edunext.ptudev.net``.
+forwarded over TLS to the real ``https://app.example.com``.
 
 Rewrites that make logins / redirects stay inside the alias:
   - outbound (request):  Host, Origin, Referer   {domain}.local -> {domain}
@@ -604,10 +604,10 @@ class LocalReverseProxy:
 
 EPILOG = Text.from_markup(
     "[bold]Examples[/bold]\n\n"
-    "  [cyan]evo localproxy edunext.ptudev.net --install-ca[/cyan]\n"
-    "  [cyan]evo localproxy edunext.ptudev.net api.ptudev.net[/cyan]\n"
-    "  [cyan]evo localproxy edunext.ptudev.net -p 8443[/cyan]   (if 443 is busy)\n"
-    "  [cyan]evo localproxy edunext.ptudev.net --no-hosts[/cyan]"
+    "  [cyan]evo localproxy app.example.com --install-ca[/cyan]\n"
+    "  [cyan]evo localproxy app.example.com api.example.com[/cyan]\n"
+    "  [cyan]evo localproxy app.example.com -p 8443[/cyan]   (if 443 is busy)\n"
+    "  [cyan]evo localproxy app.example.com --no-hosts[/cyan]"
 )
 
 

{evo_cli-0.26.0 → evo_cli-0.26.1}/evo_cli/commands/openvpn.py

@@ -141,6 +141,7 @@ def _event(out, name, state, previous):
         line.append(f"  {detail}")
     out.print(line)
     if status == "RECONNECTING":
+        out.print(f"[dim]  Why: evo openvpn log {name}[/dim]")
         _notify(f"{name} dropped ({state.get('last_reason', 'unknown')}); reconnecting")
     elif status == "CONNECTED" and previous != "CONNECTED" and state.get("reconnects"):
         _notify(f"{name} reconnected")
@@ -273,6 +274,18 @@ def status(name, watch):
     click.echo(json.dumps(_guard(vpn.request, name), indent=2))
 
 
+@openvpn_group.command("log", help="Show recent OpenVPN log lines; kept in the worker's memory only, never on disk.")
+@click.argument("name", required=False)
+@click.option("-n", "--lines", type=click.IntRange(1, 200), default=40, show_default=True)
+def show_log(name, lines):
+    name = _pick(name, prefer_active=True)
+    state = _guard(vpn.request, name, "log")
+    if "log" not in state:
+        raise click.ClickException(f"{name} has no running worker; logs exist only while it runs.")
+    for line in state["log"][-lines:]:
+        click.echo(line)
+
+
 @openvpn_group.command("disconnect", help="Disconnect only the named evo-managed connection, not the GUI profiles.")
 @click.argument("name", required=False)
 def disconnect(name):

{evo_cli-0.26.0 → evo_cli-0.26.1}/evo_cli/commands/ssh.py

@@ -14,7 +14,7 @@ warnings.filterwarnings("ignore", category=DeprecationWarning)
 EPILOG = Text.from_markup(
     "[bold]Examples[/bold]\n\n"
     "  [cyan]evo setupssh[/cyan]\n"
-    "  [cyan]evo setupssh -H 42.96.16.233 -u root[/cyan]\n"
+    "  [cyan]evo setupssh -H 203.0.113.10 -u root[/cyan]\n"
     "  [cyan]evo setupssh -H host -u root -P 2222 -i ~/.ssh/id_ed25519[/cyan]"
 )
 

{evo_cli-0.26.0 → evo_cli-0.26.1}/evo_cli/openvpn.py

@@ -15,6 +15,7 @@ import struct
 import subprocess
 import sys
 import time
+from collections import deque
 from pathlib import Path
 from urllib.parse import parse_qs, urlparse
 
@@ -235,7 +236,11 @@ def request(name, command="status"):
                     return {"profile": name, "state": "STOPPED", "error": last["error"]}
             return {"profile": name, "state": "STOPPED"}
         client.sendall(command.encode() + b"\n")
-        return json.loads(client.recv(8192))
+        # The worker closes after one reply; a log reply spans several reads.
+        chunks = []
+        while chunk := client.recv(65536):
+            chunks.append(chunk)
+        return json.loads(b"".join(chunks))
 
 
 def quote(value):
@@ -275,6 +280,8 @@ def worker(name, timeout):
     config = Path(str(base) + ".ovpn")
     control_path, management_path = str(base) + ".sock", str(base) + ".mgmt"
     state = {"profile": name, "state": "STARTING"}
+    # Served over the control socket for diagnosis; kept in memory only, gone with the worker.
+    log = deque(maxlen=200)
     lock = open(runtime_dir() / "active.lock", "a")
     try:
         fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
@@ -325,6 +332,9 @@ def worker(name, timeout):
             "none",
             "--connect-timeout",
             str(timeout),
+            # Keep idle TCP sessions alive through NAT/firewalls; a server-pushed keepalive overrides it.
+            "--ping",
+            "10",
             "--verb",
             "3",
         ]
@@ -353,7 +363,8 @@ def worker(name, timeout):
                                 state["state"] = "STOPPING"
                                 deadline = time.monotonic() + 15
                                 publish()
-                            client.sendall(json.dumps(state).encode())
+                            reply = {**state, "log": list(log)} if command == b"log" else state
+                            client.sendall(json.dumps(reply).encode())
                         except (OSError, TimeoutError):
                             pass
                 elif key.data == "accept":
@@ -361,7 +372,9 @@ def worker(name, timeout):
                     management.settimeout(2)
                     selector.unregister(listener)
                     selector.register(management, selectors.EVENT_READ, "management")
-                    management.sendall(b"state on\nbytecount 2\nhold release\n")
+                    # The hold flag survives restarts and OpenVPN resets the release on each one: without
+                    # "hold off" every reconnect would wait forever for another "hold release".
+                    management.sendall(b"state on\nlog on\nbytecount 2\nhold off\nhold release\n")
                     if stopping:
                         management.sendall(b"signal SIGTERM\n")
                 else:
@@ -385,6 +398,11 @@ def worker(name, timeout):
                             received, _, sent = line[11:].partition(",")
                             if received.isdigit() and sent.isdigit():
                                 state["bytes_in"], state["bytes_out"] = int(received), int(sent)
+                        elif line.startswith(">LOG:"):
+                            stamp, _, rest = line[5:].partition(",")
+                            if stamp.isdigit():
+                                clock = time.strftime("%H:%M:%S", time.localtime(int(stamp)))
+                                log.append(f"{clock}  {rest.partition(',')[2]}")
                         elif line.startswith(">FATAL:"):
                             raise CredentialError("OpenVPN reported a fatal error; check config, TLS and permissions.")
                         elif line.startswith(">STATE:"):

{evo_cli-0.26.0 → evo_cli-0.26.1}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.26.0
+Version: 0.26.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -132,6 +132,7 @@ evo openvpn list                               # numbered table: state, tunnel I
 evo openvpn connect work                       # hidden sudo prompt, then a live status view
 evo openvpn connect 2                          # by # from list; omit to pick (last one is default)
 evo openvpn status -w                          # watch again later; alerts on drops
+evo openvpn log -n 80                          # recent OpenVPN log lines: why it dropped
 evo openvpn disconnect                         # picks the active tunnel
 evo cred sync push
 ```
@@ -145,6 +146,9 @@ reconnects (`--no-watch` returns immediately). Ctrl-C stops watching and offers
 disconnect; the tunnel otherwise keeps running. Soft drops (`ping-restart`,
 `connection-reset`) reconnect automatically with a fresh OTP; the view logs each one and
 raises a desktop notification, and exits 1 with the reason if the tunnel goes down.
+`evo openvpn log` prints the worker's last 200 OpenVPN log lines, kept in memory only,
+to show why a drop happened. The client sends a keepalive ping every 10 seconds so idle
+TCP sessions survive NAT and firewalls; a keepalive pushed by the server takes precedence.
 
 Import each profile under a different name. Imports refuse to overwrite an existing
 name unless `--replace` is supplied; replacement preserves that profile's credentials.

{evo_cli-0.26.0 → evo_cli-0.26.1}/tests/test_openvpn.py

@@ -39,6 +39,7 @@ def test_commands_registered():
         "connect",
         "status",
         "disconnect",
+        "log",
     }
 
 
@@ -182,20 +183,37 @@ sys.stdin.readline()
 with socket.socket(socket.AF_UNIX) as s:
     s.connect(sys.argv[1])
     stream = s.makefile('rb')
-    assert stream.readline() == b'state on\\n'
-    assert stream.readline() == b'bytecount 2\\n'
-    assert stream.readline() == b'hold release\\n'
-    s.sendall(b\">PASSWORD:Need 'Auth' username/password SC:1,OTP\\n\")
-    assert stream.readline().startswith(b'username ')
-    assert b'SCRV1:' in stream.readline()
+
+    # Like OpenVPN 2.6: every (re)start with the hold flag set waits for a fresh "hold release".
+    def hold():
+        s.sendall(b'>HOLD:Waiting for hold release:0\\n')
+        seen = set()
+        while (line := stream.readline()) != b'hold release\\n':
+            assert line, 'hold never released'
+            seen.add(line)
+        return seen
+
+    def auth():
+        s.sendall(b\">PASSWORD:Need 'Auth' username/password SC:1,OTP\\n\")
+        assert stream.readline().startswith(b'username ')
+        assert b'SCRV1:' in stream.readline()
+
+    seen = hold()
+    assert {b'state on\\n', b'log on\\n', b'bytecount 2\\n'} <= seen
+    held = b'hold off\\n' not in seen
+    auth()
     if sys.argv[2] == 'fail':
         s.sendall(b\">PASSWORD:Verification Failed: 'Auth'\\n\")
     else:
         s.sendall(b'>PASSWORD:Auth-Token:ephemeral-secret\\n')
+        s.sendall(b''.join(b'>LOG:1700000000,I,line %d\\n' % n for n in range(250)))
         s.sendall(b'>BYTECOUNT:1024,2048\\n')
         s.sendall(b'>STATE:1,CONNECTED,SUCCESS,10.8.0.2,192.0.2.1\\n')
         if sys.argv[2] == 'reconnect':
-            s.sendall(b'>STATE:2,RECONNECTING,ping-restart,,\\n')
+            s.sendall(b'>STATE:2,RECONNECTING,connection-reset,,\\n')
+            if held:
+                hold()
+            auth()  # --auth-nocache: a restart asks again, with a fresh OTP
             s.sendall(b'>STATE:3,CONNECTED,SUCCESS,10.8.0.2,192.0.2.1\\n')
     assert stream.readline() == b'signal SIGTERM\\n'
 """
@@ -217,6 +235,7 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
         assert "--script-security" in command and "--management-client" in command
         # A soft restart (ping-restart, connection-reset) must reconnect, not exit.
         assert "--remap-usr1" not in command and "--connect-retry-max" not in command
+        assert command[command.index("--ping") + 1] == "10"
         endpoint = command[command.index("--management") + 1]
         return popen([sys.executable, "-c", FAKE_OPENVPN, endpoint, mode], **kwargs)
 
@@ -236,7 +255,10 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
                 assert state["since"] and (state["bytes_in"], state["bytes_out"]) == (1024, 2048)
                 assert not fail
                 if mode == "reconnect":
-                    assert state["reconnects"] == 1 and state["last_reason"] == "ping-restart"
+                    assert state["reconnects"] == 1 and state["last_reason"] == "connection-reset"
+                # Only the newest lines are kept, and a reply larger than one read arrives whole.
+                log = vpn.request("m1", "log")["log"]
+                assert len(log) == 200 and log[-1].endswith("  line 249") and "log" not in vpn.request("m1")
                 vpn.request("m1", "disconnect")
                 break
             time.sleep(0.05)
@@ -324,6 +346,17 @@ def test_watch_clean_stop_and_ctrl_c_leave_no_alert(store, monkeypatch):
     assert result.exit_code == 0 and "keeps running in the background" in result.output and notes == []
 
 
+def test_log_reads_the_live_worker_only(store, monkeypatch):
+    vpn.save_profile("m1", {"config": CONFIG})
+    replies = {"log": {"state": "CONNECTED", "log": [f"09:38:{n:02}  line {n}" for n in range(50)]}}
+    monkeypatch.setattr(vpn, "request", lambda name, command="status": replies.get(command, {"state": "CONNECTED"}))
+    result = CliRunner().invoke(cli, ["openvpn", "log", "m1", "-n", "2"])
+    assert result.exit_code == 0 and result.output == "09:38:48  line 48\n09:38:49  line 49\n"
+    replies.clear()
+    result = CliRunner().invoke(cli, ["openvpn", "log", "m1"])
+    assert result.exit_code == 1 and "no running worker" in result.output
+
+
 def test_qr_decoder_is_local_and_output_is_not_printed(monkeypatch):
     monkeypatch.setattr(vpn.shutil, "which", lambda _: "/usr/bin/zbarimg")
     monkeypatch.setattr(

{evo_cli-0.26.0 → evo_cli-0.26.1}/tests/test_route.py

@@ -34,7 +34,7 @@ def test_is_bogus():
     assert _dns.is_bogus("127.0.0.1")
     assert _dns.is_bogus("0.0.0.0")
     assert not _dns.is_bogus("162.159.152.4")
-    assert not _dns.is_bogus("118.68.82.144")
+    assert not _dns.is_bogus("203.0.113.7")
 
 
 def test_encode_qname_round_trip():

evo_cli-0.26.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.26.0