evo-cli 0.31.3__tar.gz → 0.32.0__tar.gz

{evo_cli-0.31.3 → evo_cli-0.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.31.3
+Version: 0.32.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -159,6 +159,8 @@ permissions and private-repository access, not an encrypted vault. Do not sync i
 a public repository or treat storing the password and OTP together as independent factors.
 
 Use `credentials NAME --otp` for hidden manual enrollment input instead of a QR image.
+For a PIN+OTP server whose codes come from a link, `credentials NAME --otp-url` saves the
+https link (hidden input; it is a secret) and each login sends the PIN plus a fresh code.
 `evo openvpn otp NAME` explicitly prints the current code; list and status never print
 secrets. Sudo passwords are not stored. Automation can pass the sudo password on stdin
 with `connect NAME --sudo-password-stdin`, not in an argument or environment variable.

{evo_cli-0.31.3 → evo_cli-0.32.0}/README.md

@@ -126,6 +126,8 @@ permissions and private-repository access, not an encrypted vault. Do not sync i
 a public repository or treat storing the password and OTP together as independent factors.
 
 Use `credentials NAME --otp` for hidden manual enrollment input instead of a QR image.
+For a PIN+OTP server whose codes come from a link, `credentials NAME --otp-url` saves the
+https link (hidden input; it is a secret) and each login sends the PIN plus a fresh code.
 `evo openvpn otp NAME` explicitly prints the current code; list and status never print
 secrets. Sudo passwords are not stored. Automation can pass the sudo password on stdin
 with `connect NAME --sudo-password-stdin`, not in an argument or environment variable.

evo_cli-0.32.0/evo_cli/VERSION

@@ -0,0 +1 @@
+0.32.0

{evo_cli-0.31.3 → evo_cli-0.32.0}/evo_cli/commands/openvpn.py

@@ -43,7 +43,7 @@ def _table(rows):
             state.get("vpn_ip", ""),
             (profile.get("remotes") or [""])[0],
             _creds(profile),
-            "yes" if profile.get("totp") else "no",
+            "url" if profile.get("otp_url") else "yes" if profile.get("totp") else "no",
         )
     return table
 
@@ -58,6 +58,17 @@ def _creds(profile):
         return "no"
 
 
+def _ask(name, command="status"):
+    """vpn.request for polling loops, where a missed 2s reply is no verdict.
+
+    A worker stops answering for a moment while it fetches an OTP or waits for OpenVPN to exit.
+    """
+    try:
+        return _guard(vpn.request, name, command)
+    except OSError:
+        return {"profile": name, "state": "UNKNOWN", "error": "Worker did not answer in time."}
+
+
 def _rows():
     profiles = _guard(vpn.profiles)
     return [(name, profiles[name], _guard(vpn.request, name)) for name in sorted(profiles)]
@@ -233,7 +244,9 @@ def import_profile(name, config, replace):
     click.echo(f"Imported {name} into evo cred: openvpn.profiles.{name}")
 
 
-@openvpn_group.command("credentials", help="Save username/password and optionally a TOTP enrollment; input is hidden.")
+@openvpn_group.command(
+    "credentials", help="Save username/password and optionally an OTP source (TOTP or URL); input is hidden."
+)
 @click.argument("name", required=False)
 @click.option("--username", help="VPN account name; password is prompted, never passed as an argument.")
 @click.option("--password-stdin", is_flag=True, help="Read VPN password from stdin rather than the hidden prompt.")
@@ -241,22 +254,34 @@ def import_profile(name, config, replace):
 @click.option(
     "--qr", type=click.Path(exists=True, dir_okay=False, path_type=Path), help="Read OTP from a local QR image."
 )
-def credentials(name, username, password_stdin, otp, qr):
-    if otp and qr:
-        raise click.UsageError("Use either --otp or --qr, not both.")
+@click.option(
+    "--otp-url",
+    is_flag=True,
+    help="Prompt for a link that answers with the current OTP; each login sends the password (PIN) plus a fresh code.",
+)
+def credentials(name, username, password_stdin, otp, qr, otp_url):
+    if otp + bool(qr) + otp_url > 1:
+        raise click.UsageError("Use only one of --otp, --qr and --otp-url.")
     name = _pick(name)
     profile = _guard(vpn.get_profile, name)
     username = username or click.prompt("Username", default=profile.get("username", ""))
-    password = sys.stdin.readline().rstrip("\n") if password_stdin else getpass.getpass("VPN password (hidden): ")
+    label = "VPN password or PIN, without the OTP" if otp_url or profile.get("otp_url") else "VPN password"
+    password = sys.stdin.readline().rstrip("\n") if password_stdin else getpass.getpass(f"{label} (hidden): ")
     if not password:
         raise click.ClickException("Empty password; nothing saved.")
     _guard(vpn.quote, username)
     _guard(vpn.quote, password)
     profile.update(username=username, password=password)
+    # One OTP source per profile.
     if qr:
         profile["totp"] = _guard(vpn.qr_totp, qr)
+        profile.pop("otp_url", None)
     elif otp:
         profile["totp"] = _guard(vpn.parse_totp, getpass.getpass("OTP enrollment secret/URI (hidden): "))
+        profile.pop("otp_url", None)
+    elif otp_url:
+        profile["otp_url"] = _guard(vpn.parse_otp_url, getpass.getpass("OTP URL (hidden): "))
+        profile.pop("totp", None)
     _guard(vpn.save_profile, name, profile)
     click.echo(f"Saved credentials for {name}. Sync explicitly with: evo cred sync push")
 
@@ -265,10 +290,10 @@ def credentials(name, username, password_stdin, otp, qr):
 @click.argument("name", required=False)
 def otp_code(name):
     name = _pick(name)
-    settings = _guard(vpn.get_profile, name).get("totp")
-    if not settings:
+    profile = _guard(vpn.get_profile, name)
+    if not profile.get("totp") and not profile.get("otp_url"):
         raise click.ClickException("No OTP enrollment for this profile.")
-    click.echo(_guard(vpn.totp, settings))
+    click.echo(_guard(vpn.current_otp, profile))
 
 
 @openvpn_group.command("status", help="Query the live worker; stale status files never count as connected.")
@@ -303,13 +328,13 @@ def disconnect(name):
 
 
 def _disconnect(name):
-    state = _guard(vpn.request, name, "disconnect")
+    state = _ask(name, "disconnect")
     if state["state"] == "STOPPED" and state.get("error"):
         click.echo(f"{name} was not running; last error: {state['error']}", err=True)
     deadline = time.monotonic() + 20
     while state["state"] != "STOPPED" and time.monotonic() < deadline:
         time.sleep(0.2)
-        state = _guard(vpn.request, name)
+        state = _ask(name)
     if state["state"] != "STOPPED":
         raise click.ClickException(state.get("error") or "Disconnect not confirmed; inspect evo openvpn status.")
     click.echo(f"{name}: stopped (OpenVPN Connect profiles unchanged).")
@@ -369,7 +394,7 @@ def connect(name, timeout, sudo_password_stdin, watch):
     deadline = time.monotonic() + timeout + 20
     try:
         while time.monotonic() < deadline:
-            state = _guard(vpn.request, name)
+            state = _ask(name)
             if state["state"] == "CONNECTED":
                 click.echo(f"{name}: connected, tunnel IP {state.get('vpn_ip', 'unknown')}")
                 break
@@ -380,8 +405,8 @@ def connect(name, timeout, sudo_password_stdin, watch):
                 raise click.ClickException("OpenVPN worker exited before startup.")
             time.sleep(0.2)
     finally:
-        if _guard(vpn.request, name)["state"] != "CONNECTED":
-            _guard(vpn.request, name, "disconnect")
+        if _ask(name)["state"] != "CONNECTED":
+            _ask(name, "disconnect")
     if state["state"] != "CONNECTED":
         raise click.ClickException("Connection not confirmed before timeout; disconnect requested.")
     _guard(vpn.remember, name)

{evo_cli-0.31.3 → evo_cli-0.32.0}/evo_cli/openvpn.py

@@ -238,12 +238,14 @@ def remote_addresses(remotes):
 
 
 def pin_remotes(command, remotes):
-    """Wrap OpenVPN so the profile's servers stay on the physical gateway while it runs.
+    """Wrap OpenVPN so the given hosts (a remote's first word) stay on the physical gateway while it runs.
 
     A split-tunnel profile adds no host route for its own server, so a full-tunnel VPN that is (or later comes)
-    up would carry this handshake inside itself and break it on either side's reconnect. The wrapper runs as
-    root with OpenVPN: pin each server, run OpenVPN, unpin after it exits. Addresses are validated IPs, so
-    they are safe to place in the script; the OpenVPN command is passed as arguments, never interpolated.
+    up would carry this handshake inside itself and break it on either side's reconnect. The same holds for
+    an OTP URL's host, which a reconnect needs while the routes still lead into the tunnel that is down. The
+    wrapper runs as root with OpenVPN: pin each host, run OpenVPN, unpin after it exits. Addresses are
+    validated IPs, so they are safe to place in the script; the OpenVPN command is passed as arguments, never
+    interpolated.
     """
     gateway, addresses = default_gateway(), remote_addresses(remotes)
     if not gateway or not addresses:
@@ -310,6 +312,43 @@ def totp(settings, at=None):
     return str(number % (10**digits)).zfill(digits)
 
 
+def parse_otp_url(value):
+    """An https link that answers with the current OTP as bare digits; checked by fetching one code.
+
+    The link alone yields valid codes, so it is a secret: errors never echo it.
+    """
+    value = value.strip()
+    uri = urlparse(value)
+    if uri.scheme != "https" or not uri.hostname:
+        raise CredentialError("The OTP URL must be an https:// link.")
+    fetch_otp(value)
+    return value
+
+
+def fetch_otp(url):
+    import http.client
+    import urllib.request
+
+    # Cloudflare answers the default Python-urllib agent with 403.
+    request = urllib.request.Request(url, headers={"User-Agent": "evo-cli"})
+    try:
+        with urllib.request.urlopen(request, timeout=5) as response:
+            code = response.read(64).decode(errors="replace").strip()
+    except (OSError, ValueError, http.client.HTTPException):
+        raise CredentialError("Cannot fetch the OTP from its URL; check the network and the link.") from None
+    if not re.fullmatch(r"\d{6,8}", code):
+        raise CredentialError("The OTP URL did not answer with a 6-8 digit code.")
+    return code
+
+
+def current_otp(profile):
+    if profile.get("totp"):
+        return totp(profile["totp"])
+    if profile.get("otp_url"):
+        return fetch_otp(profile["otp_url"])
+    raise CredentialError("This profile needs OTP; run evo openvpn credentials PROFILE --otp or --otp-url.")
+
+
 def qr_totp(path):
     decoder = shutil.which("zbarimg")
     if not decoder:
@@ -423,6 +462,17 @@ def _reap(name, last):
     return state
 
 
+def _saved_state(name):
+    path = Path(str(session_path(name)) + ".json")
+    if path.exists():
+        last = json.loads(path.read_text())
+        if last["state"] not in ("FAILED", "STOPPED") or last.get("cleanup_failed"):
+            return _reap(name, last)
+        if last.get("error"):
+            return {"profile": name, "state": "STOPPED", "error": last["error"]}
+    return {"profile": name, "state": "STOPPED"}
+
+
 def request(name, command="status"):
     endpoint = str(session_path(name)) + ".sock"
     with socket.socket(socket.AF_UNIX) as client:
@@ -430,20 +480,20 @@ def request(name, command="status"):
         try:
             client.connect(endpoint)
         except (FileNotFoundError, ConnectionRefusedError):
-            path = Path(str(session_path(name)) + ".json")
-            if path.exists():
-                last = json.loads(path.read_text())
-                if last["state"] not in ("FAILED", "STOPPED") or last.get("cleanup_failed"):
-                    return _reap(name, last)
-                if last.get("error"):
-                    return {"profile": name, "state": "STOPPED", "error": last["error"]}
-            return {"profile": name, "state": "STOPPED"}
-        client.sendall(command.encode() + b"\n")
+            return _saved_state(name)
         # The worker closes after one reply; a log reply spans several reads.
         chunks = []
-        while chunk := client.recv(65536):
-            chunks.append(chunk)
-        return json.loads(b"".join(chunks))
+        try:
+            client.sendall(command.encode() + b"\n")
+            while chunk := client.recv(65536):
+                chunks.append(chunk)
+        except (BrokenPipeError, ConnectionResetError):
+            chunks = []
+    if not chunks:
+        # A worker that is shutting down publishes its final state, then closes the control socket with
+        # this request still queued (EOF on macOS, reset on Linux). Its outcome is in the saved state.
+        return _saved_state(name)
+    return json.loads(b"".join(chunks))
 
 
 def quote(value):
@@ -464,12 +514,11 @@ def auth_commands(line, profile):
     if not username or not password:
         raise CredentialError("Missing username/password; run evo openvpn credentials PROFILE.")
     if "SC:" in line:
-        settings = profile.get("totp")
-        if not settings:
-            raise CredentialError("This profile needs OTP; run evo openvpn credentials PROFILE --otp.")
-        password = (
-            f"SCRV1:{base64.b64encode(password.encode()).decode()}:{base64.b64encode(totp(settings).encode()).decode()}"
-        )
+        code = current_otp(profile)
+        password = f"SCRV1:{base64.b64encode(password.encode()).decode()}:{base64.b64encode(code.encode()).decode()}"
+    elif profile.get("otp_url"):
+        # PIN+OTP servers take the code appended to the password; no challenge announces it.
+        password += fetch_otp(profile["otp_url"])
     return f'username "Auth" {quote(username)}\npassword "Auth" {quote(password)}\n'
 
 
@@ -543,8 +592,11 @@ def worker(name, timeout):
             "--verb",
             "3",
         ]
-        if not takes_default_route(profile["config"]):
-            command = pin_remotes(command, remotes)
+        pinned = [] if takes_default_route(profile["config"]) else remotes
+        if profile.get("otp_url"):
+            pinned = [*pinned, urlparse(profile["otp_url"]).hostname]
+        if pinned:
+            command = pin_remotes(command, pinned)
         if os.geteuid() != 0:
             command = ["sudo", "-S", "-p", "", "--"] + command
         process = subprocess.Popen(command, stdin=subprocess.PIPE, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

{evo_cli-0.31.3 → evo_cli-0.32.0}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.31.3
+Version: 0.32.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -159,6 +159,8 @@ permissions and private-repository access, not an encrypted vault. Do not sync i
 a public repository or treat storing the password and OTP together as independent factors.
 
 Use `credentials NAME --otp` for hidden manual enrollment input instead of a QR image.
+For a PIN+OTP server whose codes come from a link, `credentials NAME --otp-url` saves the
+https link (hidden input; it is a secret) and each login sends the PIN plus a fresh code.
 `evo openvpn otp NAME` explicitly prints the current code; list and status never print
 secrets. Sudo passwords are not stored. Automation can pass the sudo password on stdin
 with `connect NAME --sudo-password-stdin`, not in an argument or environment variable.

{evo_cli-0.31.3 → evo_cli-0.32.0}/tests/test_openvpn.py

@@ -266,6 +266,89 @@ def test_auth_token_is_a_notification_not_a_prompt():
     assert vpn.auth_commands(">PASSWORD:Auth-Token:ephemeral-secret", {}) == ""
 
 
+OTP_URL = "https://otp.example/public/link-secret"
+
+
+def test_otp_url_is_appended_without_a_challenge_and_scrv1_with_one(monkeypatch):
+    codes = iter(["123456", "654321"])
+    monkeypatch.setattr(vpn, "fetch_otp", lambda url: url == OTP_URL and next(codes))
+    profile = {"username": "u", "password": "1307", "otp_url": OTP_URL}
+    # A fresh code at each login: OpenVPN asks again on every restart (--auth-nocache).
+    assert 'password "Auth" "1307123456"' in vpn.auth_commands("Need 'Auth' username/password", profile)
+    line = ">PASSWORD:Need 'Auth' username/password SC:1,OTP"
+    assert "SCRV1:MTMwNw==:NjU0MzIx" in vpn.auth_commands(line, profile)
+
+
+def test_fetch_otp_checks_the_answer_without_echoing_the_link(monkeypatch):
+    import urllib.error
+
+    answers = iter([b"042137\n", b"<html>login</html>", urllib.error.HTTPError(OTP_URL, 403, "no", {}, None)])
+
+    class Response(io.BytesIO):
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_):
+            return None
+
+    def urlopen(request, timeout):
+        assert request.get_header("User-agent") == "evo-cli" and timeout <= 5
+        answer = next(answers)
+        if isinstance(answer, BaseException):
+            raise answer
+        return Response(answer)
+
+    monkeypatch.setattr("urllib.request.urlopen", urlopen)
+    assert vpn.fetch_otp(OTP_URL) == "042137"
+    for _ in range(2):
+        with pytest.raises(CredentialError) as exc:
+            vpn.fetch_otp(OTP_URL)
+        assert "link-secret" not in str(exc.value)
+    with pytest.raises(CredentialError) as exc:
+        vpn.parse_otp_url("http://otp.example/public/link-secret")
+    assert "link-secret" not in str(exc.value)
+
+
+def test_credentials_otp_url_replaces_totp_and_serves_otp(store, monkeypatch):
+    vpn.save_profile("m1", {"config": CONFIG, "totp": vpn.parse_totp(SECRET)})
+    prompts = []
+
+    def getpass(prompt):
+        prompts.append(prompt)
+        return OTP_URL if prompt.startswith("OTP URL") else "1307"
+
+    monkeypatch.setattr("evo_cli.commands.openvpn.getpass.getpass", getpass)
+    monkeypatch.setattr(vpn, "fetch_otp", lambda url: "042137")
+    runner = CliRunner()
+    result = runner.invoke(cli, ["openvpn", "credentials", "m1", "--username", "u", "--otp-url"])
+    assert result.exit_code == 0, result.output
+    assert prompts[0].startswith("VPN password or PIN, without the OTP")
+    assert "link-secret" not in result.output and "1307" not in result.output
+    profile = vpn.get_profile("m1")
+    assert (profile["password"], profile["otp_url"], "totp" in profile) == ("1307", OTP_URL, False)
+    assert runner.invoke(cli, ["openvpn", "otp", "m1"]).output.strip() == "042137"
+    listing = runner.invoke(cli, ["openvpn", "list"]).output
+    assert "url" in listing and "link-secret" not in listing
+    assert runner.invoke(cli, ["openvpn", "credentials", "m1", "--otp", "--otp-url"]).exit_code == 2
+
+
+def test_worker_pins_the_otp_host_even_for_a_full_tunnel(store, monkeypatch):
+    vpn.save_profile("m1", {"config": CONFIG, "username": "u", "password": "1307", "otp_url": OTP_URL})
+    monkeypatch.setattr(sys, "stdin", io.StringIO("\n"))
+    monkeypatch.setattr(vpn.os, "geteuid", lambda: 0)
+    monkeypatch.setattr(vpn.shutil, "which", lambda _: "/fake/openvpn")
+    pinned = []
+    monkeypatch.setattr(vpn, "pin_remotes", lambda command, hosts: pinned.append(hosts) or command)
+
+    def popen(command, **_):
+        raise OSError("stop before running anything")
+
+    monkeypatch.setattr(vpn.subprocess, "Popen", popen)
+    vpn.worker("m1", 10)
+    # Not the full-tunnel server (OpenVPN routes it itself), only the host a reconnect needs for its OTP.
+    assert pinned == [["otp.example"]]
+
+
 def test_plain_password_escaping_and_no_unrequested_otp():
     text = vpn.auth_commands("Need 'Auth' username/password", {"username": "u", "password": 'p"\\'})
     assert text == 'username "Auth" "u"\npassword "Auth" "p\\"\\\\"\n'
@@ -320,6 +403,41 @@ def test_dead_worker_is_reaped_and_disconnect_confirms_it(store, monkeypatch):
     assert vpn.request("m1")["state"] == "STOPPED"  # so connect and import accept the profile again
 
 
+def test_connect_reports_the_failure_of_a_worker_closing_with_a_request_queued(store, monkeypatch):
+    import socket
+
+    vpn.save_profile("m1", {"config": CONFIG, "username": "u", "password": "p"})
+    base = str(vpn.session_path("m1"))
+    monkeypatch.setattr("evo_cli.commands.openvpn.shutil.which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr("evo_cli.commands.openvpn.os.geteuid", lambda: 0)
+    closed = threading.Event()
+
+    class ShuttingDown:
+        """A worker in its finally: final state published, control socket listening but never accepting."""
+
+        def __init__(self):
+            self.stdin = io.BytesIO()
+            self.control = socket.socket(socket.AF_UNIX)
+            self.control.bind(base + ".sock")
+            self.control.listen(2)
+            error = "VPN authentication rejected; check password/OTP enrollment before retrying."
+            vpn.private_write(Path(base + ".json"), json.dumps({"profile": "m1", "state": "FAILED", "error": error}))
+            threading.Timer(0.3, self.close).start()
+
+        def close(self):
+            self.control.close()
+            Path(base + ".sock").unlink()
+            closed.set()
+
+        def poll(self):
+            return 1 if closed.is_set() else None
+
+    monkeypatch.setattr("evo_cli.commands.openvpn.subprocess.Popen", lambda command, **_: ShuttingDown())
+    result = CliRunner().invoke(cli, ["openvpn", "connect", "m1", "--no-watch"])
+    assert result.exit_code == 1 and "VPN authentication rejected" in result.output, result.output
+    assert "Expecting value" not in result.output
+
+
 FAKE_OPENVPN = """
 import socket,sys
 sys.stdin.readline()
@@ -388,11 +506,8 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
     try:
         deadline = time.monotonic() + 8
         while thread.is_alive() and time.monotonic() < deadline:
-            try:
-                state = vpn.request("m1")
-            except (ConnectionResetError, json.JSONDecodeError):
-                time.sleep(0.05)
-                continue
+            # No retry on reset or empty replies: request() must read through the worker's shutdown.
+            state = vpn.request("m1")
             if state["state"] == "CONNECTED" and (mode != "reconnect" or state.get("reconnects")):
                 assert state["vpn_ip"] == "10.8.0.2"
                 assert state["since"] and (state["bytes_in"], state["bytes_out"]) == (1024, 2048)

evo_cli-0.31.3/evo_cli/VERSION

@@ -1 +0,0 @@
-0.31.3