evo-cli 0.27.0__tar.gz → 0.28.0__tar.gz

{evo_cli-0.27.0 → evo_cli-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.27.0
+Version: 0.28.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -170,8 +170,14 @@ supported. Only trusted, self-contained TUN client profiles are accepted; script
 plugins and external certificate/key files are refused. Runtime data uses
 `~/.evo/openvpn` (override with `EVO_OPENVPN_HOME`).
 
-Only one evo-managed tunnel runs at a time. Disconnect any GUI VPN before connecting
-through evo; GUI profiles are never removed or modified. Server routes are applied,
+Several evo-managed tunnels can run at once, as long as at most one of them may take the
+default route. A profile is split-tunnel when it has `route-nopull` or
+`pull-filter ignore "redirect-gateway"` (add `route` lines for the networks it should
+carry); any other profile might receive a pushed `redirect-gateway`, so `connect` refuses
+to stack two of those. While a split-tunnel profile runs, its server is pinned to the
+physical gateway with a host route, so a full-tunnel VPN connected before or after it
+never carries its handshake. Disconnect any GUI VPN before connecting through evo; GUI
+profiles are never removed or modified. Server routes are applied,
 but this backend does not change system DNS. Internal IP access works through the
 tunnel; private DNS names may need your organization's DNS configuration. `CONNECTED`
 confirms the tunnel, not the availability of a particular internal application.

{evo_cli-0.27.0 → evo_cli-0.28.0}/README.md

@@ -137,8 +137,14 @@ supported. Only trusted, self-contained TUN client profiles are accepted; script
 plugins and external certificate/key files are refused. Runtime data uses
 `~/.evo/openvpn` (override with `EVO_OPENVPN_HOME`).
 
-Only one evo-managed tunnel runs at a time. Disconnect any GUI VPN before connecting
-through evo; GUI profiles are never removed or modified. Server routes are applied,
+Several evo-managed tunnels can run at once, as long as at most one of them may take the
+default route. A profile is split-tunnel when it has `route-nopull` or
+`pull-filter ignore "redirect-gateway"` (add `route` lines for the networks it should
+carry); any other profile might receive a pushed `redirect-gateway`, so `connect` refuses
+to stack two of those. While a split-tunnel profile runs, its server is pinned to the
+physical gateway with a host route, so a full-tunnel VPN connected before or after it
+never carries its handshake. Disconnect any GUI VPN before connecting through evo; GUI
+profiles are never removed or modified. Server routes are applied,
 but this backend does not change system DNS. Internal IP access works through the
 tunnel; private DNS names may need your organization's DNS configuration. `CONNECTED`
 confirms the tunnel, not the availability of a particular internal application.

evo_cli-0.28.0/evo_cli/VERSION

@@ -0,0 +1 @@
+0.28.0

{evo_cli-0.27.0 → evo_cli-0.28.0}/evo_cli/commands/openvpn.py

@@ -324,10 +324,17 @@ def connect(name, timeout, sudo_password_stdin, watch):
         raise click.ClickException("Missing credentials; run evo openvpn credentials PROFILE.")
     if _guard(vpn.request, name)["state"] != "STOPPED":
         raise click.ClickException("This profile already has a worker; use status or disconnect first.")
-    # Avoid unintentionally stacking two route sets. The external GUI is never controlled here.
-    for other in _guard(vpn.profiles):
-        if other != name and _guard(vpn.request, other)["state"] != "STOPPED":
-            raise click.ClickException(f"Disconnect '{other}' first to avoid conflicting VPN routes.")
+    # Two tunnels that may both take the default route would fight over it; a split-tunnel profile stacks
+    # beside any other. The external GUI is never controlled here.
+    full = _guard(vpn.takes_default_route, profile["config"])
+    for other, data in _guard(vpn.profiles).items():
+        if other == name or _guard(vpn.request, other)["state"] == "STOPPED":
+            continue
+        if full and _guard(vpn.takes_default_route, data.get("config", "")):
+            raise click.ClickException(
+                f"Disconnect '{other}' first: both may take the default route. To run them together, add "
+                'pull-filter ignore "redirect-gateway" (plus the routes you need) to one of them.'
+            )
     password = ""
     if os.geteuid() != 0:
         if sudo_password_stdin:

{evo_cli-0.27.0 → evo_cli-0.28.0}/evo_cli/openvpn.py

@@ -4,6 +4,7 @@ import base64
 import binascii
 import hashlib
 import hmac
+import ipaddress
 import json
 import os
 import re
@@ -128,10 +129,9 @@ def save_profile(name, data):
         os.umask(previous_umask)
 
 
-def validate_config(text):
-    """Validate without exposing private key material in errors; return endpoint metadata."""
+def _directives(text):
+    """Yield (line number, words) per directive; inline blocks are skipped, never parsed."""
     block = None
-    remotes = []
     for number, raw in enumerate(text.splitlines(), 1):
         line = raw.strip()
         if block:
@@ -149,6 +149,15 @@ def validate_config(text):
             words = shlex.split(line, comments=True)
         except ValueError:
             raise CredentialError(f"Invalid OpenVPN syntax at line {number}.") from None
+        yield number, words
+    if block:
+        raise CredentialError("Unclosed inline block in OpenVPN profile.")
+
+
+def validate_config(text):
+    """Validate without exposing private key material in errors; return endpoint metadata."""
+    remotes = []
+    for number, words in _directives(text):
         option = words[0].removeprefix("--")
         if option not in OPTIONS:
             raise CredentialError(
@@ -164,13 +173,95 @@ def validate_config(text):
             if len(words) not in (2, 3, 4):
                 raise CredentialError(f"Invalid remote at line {number}.")
             remotes.append(" ".join(words[1:]))
-    if block:
-        raise CredentialError("Unclosed inline block in OpenVPN profile.")
     if not remotes:
         raise CredentialError("No remote endpoint in OpenVPN profile.")
     return remotes
 
 
+def takes_default_route(text):
+    """Whether a profile may take the default route. Only split-tunnel profiles can run beside another VPN.
+
+    Split means route-nopull, or a pull-filter that ignores a pushed redirect-gateway; anything else might
+    receive one, so it counts as full-tunnel.
+    """
+    split, filtered = False, False
+    for _, words in _directives(text):
+        option = words[0].removeprefix("--")
+        if option == "redirect-gateway":
+            return True
+        if option == "route-nopull":
+            split = True
+        # OpenVPN applies only the first pull-filter whose text starts the pushed option.
+        elif option == "pull-filter" and not filtered and len(words) == 3 and words[2]:
+            filtered = "redirect-gateway".startswith(words[2])
+            split = split or (filtered and words[1] == "ignore")
+    return not split
+
+
+def default_gateway():
+    """The physical IPv4 gateway of the 0/0 route, which def1 VPN routes (0/1, 128/1) leave in place."""
+    if sys.platform == "darwin":
+        command, pattern = ["route", "-n", "get", "default"], r"gateway:\s*(\S+)[\s\S]*?interface:\s*(\S+)"
+    else:
+        command, pattern = ["ip", "-4", "route", "show", "default"], r"via\s+(\S+)\s+dev\s+(\S+)"
+    try:
+        output = subprocess.run(command, capture_output=True, text=True, timeout=5, check=False).stdout
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    match = re.search(pattern, output)
+    if not match or match.group(2).startswith(("tun", "utun")):
+        return None
+    try:
+        return str(ipaddress.IPv4Address(match.group(1)))
+    except ValueError:
+        return None
+
+
+def remote_addresses(remotes):
+    """IPv4 addresses of the profile's servers, resolved just before OpenVPN resolves them itself."""
+    addresses = []
+    for remote in remotes:
+        try:
+            infos = socket.getaddrinfo(remote.split()[0], None, socket.AF_INET)
+        except OSError:
+            continue
+        for *_, (address, _) in infos:
+            address = str(ipaddress.IPv4Address(address))
+            if address not in addresses:
+                addresses.append(address)
+    return addresses
+
+
+def pin_remotes(command, remotes):
+    """Wrap OpenVPN so the profile's servers stay on the physical gateway while it runs.
+
+    A split-tunnel profile adds no host route for its own server, so a full-tunnel VPN that is (or later comes)
+    up would carry this handshake inside itself and break it on either side's reconnect. The wrapper runs as
+    root with OpenVPN: pin each server, run OpenVPN, unpin after it exits. Addresses are validated IPs, so
+    they are safe to place in the script; the OpenVPN command is passed as arguments, never interpolated.
+    """
+    gateway, addresses = default_gateway(), remote_addresses(remotes)
+    if not gateway or not addresses:
+        return command
+    if sys.platform == "darwin":
+        pin = "route -n delete -host {0} >/dev/null 2>&1; route -n add -host {0} {1} >/dev/null"
+        unpin = "route -n delete -host {0} >/dev/null 2>&1"
+    else:
+        pin, unpin = "ip route replace {0}/32 via {1}", "ip route del {0}/32 via {1} 2>/dev/null"
+    script = "; ".join(
+        [
+            *(pin.format(address, gateway) for address in addresses),
+            # Survive the signals relayed by sudo so the unpin still runs; OpenVPN handles its own.
+            "trap : HUP INT TERM",
+            '"$@"',
+            "code=$?",
+            *(unpin.format(address, gateway) for address in addresses),
+            'exit "$code"',
+        ]
+    )
+    return ["sh", "-c", script, "sh", *command]
+
+
 def parse_totp(value):
     value = value.strip()
     settings = {"secret": value, "algorithm": "SHA1", "digits": 6, "period": 30}
@@ -341,8 +432,9 @@ def worker(name, timeout):
     state = {"profile": name, "state": "STARTING"}
     # Served over the control socket for diagnosis; kept in memory only, gone with the worker.
     log = deque(maxlen=200)
+    # One worker per profile; connect decides whether profiles may run side by side.
     # Held for the worker's whole life (flock) and closed in the outer finally.
-    lock = open(runtime_dir() / "active.lock", "a")  # noqa: SIM115
+    lock = open(str(base) + ".lock", "a")  # noqa: SIM115
     try:
         fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
     except BlockingIOError:
@@ -357,7 +449,7 @@ def worker(name, timeout):
 
     try:
         profile = get_profile(name)
-        validate_config(profile["config"])
+        remotes = validate_config(profile["config"])
         private_write(config, profile["config"])
         for path, server in ((control_path, control), (management_path, listener)):
             Path(path).unlink(missing_ok=True)
@@ -398,6 +490,8 @@ def worker(name, timeout):
             "--verb",
             "3",
         ]
+        if not takes_default_route(profile["config"]):
+            command = pin_remotes(command, remotes)
         if os.geteuid() != 0:
             command = ["sudo", "-S", "-p", "", "--"] + command
         process = subprocess.Popen(command, stdin=subprocess.PIPE, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

{evo_cli-0.27.0 → evo_cli-0.28.0}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.27.0
+Version: 0.28.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -170,8 +170,14 @@ supported. Only trusted, self-contained TUN client profiles are accepted; script
 plugins and external certificate/key files are refused. Runtime data uses
 `~/.evo/openvpn` (override with `EVO_OPENVPN_HOME`).
 
-Only one evo-managed tunnel runs at a time. Disconnect any GUI VPN before connecting
-through evo; GUI profiles are never removed or modified. Server routes are applied,
+Several evo-managed tunnels can run at once, as long as at most one of them may take the
+default route. A profile is split-tunnel when it has `route-nopull` or
+`pull-filter ignore "redirect-gateway"` (add `route` lines for the networks it should
+carry); any other profile might receive a pushed `redirect-gateway`, so `connect` refuses
+to stack two of those. While a split-tunnel profile runs, its server is pinned to the
+physical gateway with a host route, so a full-tunnel VPN connected before or after it
+never carries its handshake. Disconnect any GUI VPN before connecting through evo; GUI
+profiles are never removed or modified. Server routes are applied,
 but this backend does not change system DNS. Internal IP access works through the
 tunnel; private DNS names may need your organization's DNS configuration. `CONNECTED`
 confirms the tunnel, not the availability of a particular internal application.

{evo_cli-0.27.0 → evo_cli-0.28.0}/tests/test_openvpn.py

@@ -108,6 +108,91 @@ def test_config_accepts_inline_key_without_parsing_it():
     assert vpn.validate_config(CONFIG + "lport 0\n<key>\nPRIVATE SECRET\n</key>\n") == ["vpn.example 1194 udp"]
 
 
+@pytest.mark.parametrize(
+    "extra,full",
+    [
+        ("", True),
+        ('pull-filter ignore "redirect-gateway"\n', False),
+        ("pull-filter ignore redirect\n", False),
+        ("route-nopull\n", False),
+        ('pull-filter ignore "route"\n', True),
+        # The first matching pull-filter wins, and a local redirect-gateway needs no push.
+        ('pull-filter accept "redirect-gateway"\npull-filter ignore "redirect-gateway"\n', True),
+        ('pull-filter ignore "redirect-gateway"\nredirect-gateway def1\n', True),
+        ('<key>\nredirect-gateway def1\n</key>\npull-filter ignore "redirect-gateway"\n', False),
+    ],
+)
+def test_split_tunnel_is_only_what_provably_keeps_the_default_route(extra, full):
+    assert vpn.takes_default_route(CONFIG + extra) is full
+
+
+@pytest.mark.parametrize(
+    "platform,output,gateway",
+    [
+        ("darwin", "route to: default\n    gateway: 192.0.2.1\n  interface: en0\n", "192.0.2.1"),
+        ("darwin", "route to: default\n    gateway: 10.8.0.1\n  interface: utun4\n", None),
+        ("linux", "default via 192.0.2.1 dev wlan0 proto dhcp metric 600\n", "192.0.2.1"),
+        ("linux", "default via 10.8.0.1 dev tun0\n", None),
+        ("linux", "", None),
+    ],
+)
+def test_default_gateway_is_the_physical_one(monkeypatch, platform, output, gateway):
+    monkeypatch.setattr(vpn.sys, "platform", platform)
+    monkeypatch.setattr(vpn.subprocess, "run", lambda *a, **k: subprocess.CompletedProcess(a, 0, output, ""))
+    assert vpn.default_gateway() == gateway
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="the wrapper is a POSIX shell script")
+@pytest.mark.parametrize(
+    "platform,expected",
+    [
+        (
+            "darwin",
+            [
+                "route -n delete -host 198.51.100.7",
+                "route -n add -host 198.51.100.7 192.0.2.1",
+                "openvpn --config $(touch pwned)",
+                "route -n delete -host 198.51.100.7",
+            ],
+        ),
+        (
+            "linux",
+            [
+                "ip route replace 198.51.100.7/32 via 192.0.2.1",
+                "openvpn --config $(touch pwned)",
+                "ip route del 198.51.100.7/32 via 192.0.2.1",
+            ],
+        ),
+    ],
+)
+def test_split_tunnel_pins_its_server_around_openvpn(tmp_path, monkeypatch, platform, expected):
+    monkeypatch.setattr(vpn.sys, "platform", platform)
+    monkeypatch.setattr(vpn, "default_gateway", lambda: "192.0.2.1")
+    for tool in ("route", "ip"):
+        (tmp_path / tool).write_text(f'#!/bin/sh\necho "{tool} $*" >> "$LOG"\n')
+        (tmp_path / tool).chmod(0o755)
+    fake = "import os,sys; open(os.environ['LOG'],'a').write(' '.join(['openvpn',*sys.argv[1:]])+'\\n'); sys.exit(3)"
+    command = vpn.pin_remotes([sys.executable, "-c", fake, "--config", "$(touch pwned)"], ["198.51.100.7 1194 tcp4"])
+    log = tmp_path / "log"
+    env = {**vpn.os.environ, "PATH": f"{tmp_path}:{vpn.os.environ['PATH']}", "LOG": str(log)}
+    # OpenVPN's exit status survives the unpin, and its arguments never reach the shell as code.
+    assert subprocess.run(command, cwd=tmp_path, env=env, check=False).returncode == 3
+    assert log.read_text().splitlines() == expected
+    assert not (tmp_path / "pwned").exists()
+
+
+def test_no_pin_without_a_physical_gateway_or_address(monkeypatch):
+    monkeypatch.setattr(vpn, "default_gateway", lambda: None)
+    assert vpn.pin_remotes(["openvpn"], ["198.51.100.7 1194"]) == ["openvpn"]
+    monkeypatch.setattr(vpn, "default_gateway", lambda: "192.0.2.1")
+
+    def unresolvable(*_):
+        raise vpn.socket.gaierror("no such host")
+
+    monkeypatch.setattr(vpn.socket, "getaddrinfo", unresolvable)
+    assert vpn.pin_remotes(["openvpn"], ["vpn.example 1194"]) == ["openvpn"]
+
+
 @pytest.mark.parametrize("name", ["../x", "x.y", "-flag", "x/y", "", "x" * 49])
 def test_rejects_ambiguous_profile_names(name):
     with pytest.raises(CredentialError):
@@ -284,6 +369,46 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
             thread.join(5)
 
 
+def test_worker_lock_is_per_profile(store, monkeypatch):
+    import fcntl
+
+    monkeypatch.setattr(sys, "stdin", io.StringIO("\n\n"))
+    with open(str(vpn.session_path("m1")) + ".lock", "a") as held:
+        fcntl.flock(held, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        vpn.worker("m1", 10)  # a second worker for a running profile leaves at once
+        assert not Path(str(vpn.session_path("m1")) + ".json").exists()
+        vpn.worker("m2", 10)  # another profile gets past the lock (and fails: it does not exist)
+        assert json.loads(Path(str(vpn.session_path("m2")) + ".json").read_text())["state"] == "FAILED"
+
+
+def test_connect_stacks_a_split_tunnel_beside_a_full_one_only(store, monkeypatch):
+    split = CONFIG + 'pull-filter ignore "redirect-gateway"\n'
+    for name, config in (("full", CONFIG), ("full-2", CONFIG), ("split", split)):
+        vpn.save_profile(name, {"config": config, "username": "u", "password": "p"})
+    monkeypatch.setattr(
+        vpn, "request", lambda name, command="status": {"state": "CONNECTED" if name == "full" else "STOPPED"}
+    )
+    monkeypatch.setattr("evo_cli.commands.openvpn.shutil.which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr("evo_cli.commands.openvpn.os.geteuid", lambda: 0)
+    started = []
+
+    class Exited:
+        def __init__(self):
+            self.stdin = io.BytesIO()
+
+        def poll(self):
+            return 1
+
+    monkeypatch.setattr(
+        "evo_cli.commands.openvpn.subprocess.Popen", lambda command, **_: started.append(command) or Exited()
+    )
+    runner = CliRunner()
+    result = runner.invoke(cli, ["openvpn", "connect", "full-2", "--no-watch"])
+    assert result.exit_code != 0 and "both may take the default route" in result.output and not started
+    result = runner.invoke(cli, ["openvpn", "connect", "split", "--no-watch"])
+    assert "default route" not in result.output and started, result.output
+
+
 def test_pick_profile_by_number_single_or_prompt(store, monkeypatch):
     runner = CliRunner()
     totp = vpn.parse_totp(SECRET)

evo_cli-0.27.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.27.0