evo-cli 0.33.0__tar.gz → 0.34.1__tar.gz

{evo_cli-0.33.0 → evo_cli-0.34.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.33.0
+Version: 0.34.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.34.1/evo_cli/VERSION

@@ -0,0 +1 @@
+0.34.1

{evo_cli-0.33.0 → evo_cli-0.34.1}/evo_cli/commands/openvpn.py

@@ -392,9 +392,15 @@ def connect(name, timeout, sudo_password_stdin, watch):
     password = ""
     click.echo(f"Connecting {name}; disconnect any external GUI VPN first. System DNS is not modified.")
     deadline = time.monotonic() + timeout + 20
+    shown = None
     try:
         while time.monotonic() < deadline:
             state = _ask(name)
+            if state.get("auth_url") and state["auth_url"] != shown:
+                shown = state["auth_url"]
+                click.echo(f"Sign in to finish connecting (opened in your browser): {shown}")
+            if state.get("auth_expires"):
+                deadline = max(deadline, time.monotonic() + state["auth_expires"] - time.time() + 20)
             if state["state"] == "CONNECTED":
                 click.echo(f"{name}: connected, tunnel IP {state.get('vpn_ip', 'unknown')}")
                 break

{evo_cli-0.33.0 → evo_cli-0.34.1}/evo_cli/openvpn.py

@@ -45,6 +45,7 @@ OPTIONS = {
     "connect-retry",
     "connect-retry-max",
     "connect-timeout",
+    "server-poll-timeout",
     "float",
     "tun-mtu",
     "mssfix",
@@ -502,12 +503,26 @@ def quote(value):
     return '"' + value.replace("\\", "\\\\").replace('"', '\\"') + '"'
 
 
+def rejection_reason(line):
+    """The server's text in a Verification Failed notice, for the user; a dynamic challenge keeps only its prompt.
+
+    OpenVPN writes >PASSWORD:Verification Failed: 'Auth' ['REASON'] (the brackets are its own). A CRV1 challenge
+    carries a state ID and the username besides its prompt, so neither is shown.
+    """
+    reason = line.partition("['")[2].rpartition("']")[0]
+    if reason.startswith("CRV1:"):
+        return "dynamic challenge, not supported: " + reason.split(":", 4)[-1]
+    return reason
+
+
 def auth_commands(line, profile):
     # OpenVPN itself caches server-issued session tokens. This notification needs no reply.
     if line.startswith(">PASSWORD:Auth-Token:"):
         return ""
     if "Verification Failed" in line:
-        raise CredentialError("VPN authentication rejected; check password/OTP enrollment before retrying.")
+        reason = rejection_reason(line)
+        detail = f": {reason}" if reason else "; check password/OTP enrollment before retrying"
+        raise CredentialError(f"VPN authentication rejected{detail}.")
     if "Need 'Auth' username/password" not in line:
         raise CredentialError("Unsupported authentication challenge (private-key password or dynamic challenge).")
     username, password = profile.get("username", ""), profile.get("password", "")
@@ -522,6 +537,30 @@ def auth_commands(line, profile):
     return f'username "Auth" {quote(username)}\npassword "Auth" {quote(password)}\n'
 
 
+def web_auth_url(message):
+    """The sign-in URL of a pending-auth INFOMSG (WEB_AUTH:flags:url or the older OPEN_URL:url), else None."""
+    if message.startswith("WEB_AUTH:"):
+        # No proxy is announced, so flags hold no colon.
+        url = message[9:].partition(":")[2]
+    elif message.startswith("OPEN_URL:"):
+        url = message[9:]
+    else:
+        return None
+    if urlparse(url).scheme != "https" or any(c.isspace() or not c.isprintable() for c in url):
+        raise CredentialError("VPN server sent an unusable sign-in URL.")
+    return url
+
+
+def open_url(url):
+    """Open the sign-in page in the user's browser; the worker runs as the user, never as root."""
+    opener = shutil.which("open" if sys.platform == "darwin" else "xdg-open")
+    if opener:
+        try:
+            subprocess.Popen([opener, url], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        except OSError:
+            pass
+
+
 def worker(name, timeout):
     """Keep the management channel alive for reauthentication; never persist raw VPN logs."""
     import fcntl
@@ -592,6 +631,10 @@ def worker(name, timeout):
             "--verb",
             "3",
         ]
+        if not uses_credentials(profile["config"]):
+            # With no password to ask for, a server can add a sign-in step only through the browser (Access
+            # Server SAML); announce it, or such a server refuses the client.
+            command += ["--setenv", "IV_SSO", "openurl,webauth"]
         pinned = [] if takes_default_route(profile["config"]) else remotes
         if profile.get("otp_url"):
             pinned = [*pinned, urlparse(profile["otp_url"]).hostname]
@@ -662,6 +705,12 @@ def worker(name, timeout):
                             if stamp.isdigit():
                                 clock = time.strftime("%H:%M:%S", time.localtime(int(stamp)))
                                 log.append(f"{clock}  {rest.partition(',')[2]}")
+                        elif line.startswith(">INFOMSG:"):
+                            url = web_auth_url(line[9:])
+                            if url:
+                                state["auth_url"] = url
+                                publish()
+                                open_url(url)
                         elif line.startswith(">FATAL:"):
                             raise CredentialError("OpenVPN reported a fatal error; check config, TLS and permissions.")
                         elif line.startswith(">STATE:"):
@@ -671,11 +720,20 @@ def worker(name, timeout):
                                 if fields[1] == "CONNECTED" and fields[2] == "SUCCESS":
                                     state["vpn_ip"] = fields[3]
                                     state["since"] = time.time()
+                                    state.pop("auth_url", None)
+                                    state.pop("auth_expires", None)
                                     # Once up, let OpenVPN retry for as long as the network is gone.
                                     deadline = float("inf")
                                 elif fields[1] != "CONNECTED":
                                     state.pop("vpn_ip", None)
                                     state.pop("since", None)
+                                if fields[1] == "AUTH_PENDING":
+                                    # Signing in happens in the browser: allow the time the server gives it.
+                                    # "timeout 180" in OpenVPN 2.6, a bare number in older notes.
+                                    wait = fields[2].split()[-1] if fields[2] else ""
+                                    wait = int(wait) if wait.isdigit() else 300
+                                    deadline = max(deadline, time.monotonic() + wait)
+                                    state["auth_expires"] = time.time() + wait
                                 if fields[1] == "RECONNECTING":
                                     state["reconnects"] = state.get("reconnects", 0) + 1
                                 if fields[1] in ("RECONNECTING", "EXITING"):

{evo_cli-0.33.0 → evo_cli-0.34.1}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.33.0
+Version: 0.34.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.33.0 → evo_cli-0.34.1}/tests/test_openvpn.py

@@ -104,6 +104,11 @@ def test_rejects_unsafe_or_external_config(directive):
         vpn.validate_config(CONFIG + directive + "\n")
 
 
+def test_config_accepts_access_server_timing():
+    # OpenVPN Access Server profiles carry server-poll-timeout, an alias of connect-timeout.
+    assert vpn.validate_config(CONFIG + "server-poll-timeout 4\n") == ["vpn.example 1194 udp"]
+
+
 def test_config_accepts_inline_key_without_parsing_it():
     assert vpn.validate_config(CONFIG + "lport 0\n<key>\nPRIVATE SECRET\n</key>\n") == ["vpn.example 1194 udp"]
 
@@ -256,10 +261,23 @@ def test_static_challenge_uses_scrv1_and_fresh_totp(monkeypatch):
     assert "SCRV1:cGFzcw==:NjU0MzIx" in vpn.auth_commands(line, profile)
 
 
-def test_auth_rejection_does_not_retry_or_leak_challenge():
+@pytest.mark.parametrize(
+    "line,shown,hidden",
+    [
+        (">PASSWORD:Verification Failed: 'Auth'", "check password/OTP enrollment", None),
+        (">PASSWORD:Verification Failed: 'Auth' ['SAML user does not match']", ": SAML user does not match.", None),
+        (
+            ">PASSWORD:Verification Failed: 'Auth' ['CRV1:R,E:state-id-secret:dXNlcg==:Enter token PIN']",
+            "dynamic challenge, not supported: Enter token PIN",
+            "state-id-secret",
+        ),
+    ],
+)
+def test_auth_rejection_shows_the_reason_but_not_the_challenge_state(line, shown, hidden):
     with pytest.raises(CredentialError) as exc:
-        vpn.auth_commands(">PASSWORD:Verification Failed: 'Auth' ['sensitive']", {})
-    assert "sensitive" not in str(exc.value)
+        vpn.auth_commands(line, {})
+    assert shown in str(exc.value)
+    assert not hidden or (hidden not in str(exc.value) and "dXNlcg==" not in str(exc.value))
 
 
 def test_auth_token_is_a_notification_not_a_prompt():
@@ -349,6 +367,26 @@ def test_worker_pins_the_otp_host_even_for_a_full_tunnel(store, monkeypatch):
     assert pinned == [["otp.example"]]
 
 
+@pytest.mark.parametrize(
+    "message,expected",
+    [
+        ("WEB_AUTH::https://vpn.example/a?b=1", "https://vpn.example/a?b=1"),
+        ("WEB_AUTH:external:https://vpn.example/a", "https://vpn.example/a"),
+        ("OPEN_URL:https://vpn.example/a", "https://vpn.example/a"),
+        ("CR_TEXT:E,R:Enter code", None),
+        ("some other notice", None),
+    ],
+)
+def test_web_auth_url(message, expected):
+    assert vpn.web_auth_url(message) == expected
+
+
+@pytest.mark.parametrize("url", ["http://vpn.example/a", "file:///etc/passwd", "https://vpn.example/a b", "-a"])
+def test_web_auth_url_rejects_anything_but_plain_https(url):
+    with pytest.raises(CredentialError):
+        vpn.web_auth_url("WEB_AUTH::" + url)
+
+
 def test_plain_password_escaping_and_no_unrequested_otp():
     text = vpn.auth_commands("Need 'Auth' username/password", {"username": "u", "password": 'p"\\'})
     assert text == 'username "Auth" "u"\npassword "Auth" "p\\"\\\\"\n'
@@ -462,7 +500,12 @@ with socket.socket(socket.AF_UNIX) as s:
     seen = hold()
     assert {b'state on\\n', b'log on\\n', b'bytecount 2\\n'} <= seen
     held = b'hold off\\n' not in seen
-    auth()
+    if sys.argv[2] == 'webauth':
+        # Access Server SAML: no password prompt, a browser sign-in instead.
+        s.sendall(b'>STATE:1,AUTH_PENDING,timeout 120,,,,,\\n')
+        s.sendall(b'>INFOMSG:WEB_AUTH::https://vpn.example/auth/1\\n')
+    else:
+        auth()
     if sys.argv[2] == 'fail':
         s.sendall(b\">PASSWORD:Verification Failed: 'Auth'\\n\")
     else:
@@ -480,12 +523,15 @@ with socket.socket(socket.AF_UNIX) as s:
 """
 
 
-@pytest.mark.parametrize("mode", ["ok", "fail", "reconnect"])
+@pytest.mark.parametrize("mode", ["ok", "fail", "reconnect", "webauth"])
 def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatch, mode):
-    fail = mode == "fail"
+    fail, webauth = mode == "fail", mode == "webauth"
+    config = CERT_ONLY if webauth else CONFIG
     vpn.save_profile(
-        "m1", {"config": CONFIG, "username": "test", "password": "password-secret", "totp": vpn.parse_totp(SECRET)}
+        "m1", {"config": config, "username": "test", "password": "password-secret", "totp": vpn.parse_totp(SECRET)}
     )
+    opened = []
+    monkeypatch.setattr(vpn, "open_url", opened.append)
     monkeypatch.setattr(sys, "stdin", io.StringIO("not-a-real-sudo-password\n"))
     monkeypatch.setattr(vpn.os, "geteuid", lambda: 0)
     monkeypatch.setattr(vpn.shutil, "which", lambda _: "/fake/openvpn")
@@ -497,6 +543,8 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
         # A soft restart (ping-restart, connection-reset) must reconnect, not exit.
         assert "--remap-usr1" not in command and "--connect-retry-max" not in command
         assert command[command.index("--ping") + 1] == "10"
+        # Only a profile without a password announces browser sign-in.
+        assert ("IV_SSO" in command) == webauth
         endpoint = command[command.index("--management") + 1]
         return popen([sys.executable, "-c", FAKE_OPENVPN, endpoint, mode], **kwargs)
 
@@ -511,7 +559,7 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
             if state["state"] == "CONNECTED" and (mode != "reconnect" or state.get("reconnects")):
                 assert state["vpn_ip"] == "10.8.0.2"
                 assert state["since"] and (state["bytes_in"], state["bytes_out"]) == (1024, 2048)
-                assert not fail
+                assert not fail and "auth_url" not in state and "auth_expires" not in state
                 if mode == "reconnect":
                     assert state["reconnects"] == 1 and state["last_reason"] == "connection-reset"
                 # Only the newest lines are kept, and a reply larger than one read arrives whole.
@@ -522,6 +570,7 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
             time.sleep(0.05)
         thread.join(5)
         assert not thread.is_alive()
+        assert opened == (["https://vpn.example/auth/1"] if webauth else [])
         assert vpn.request("m1")["state"] == "STOPPED"
         base = vpn.session_path("m1")
         state = json.loads(Path(str(base) + ".json").read_text())
@@ -609,6 +658,27 @@ def test_cert_only_profile_connects_and_lists_without_credentials(store, monkeyp
     assert rows == {"cert": "cert", "login": "no"}
 
 
+def test_connect_shows_the_sign_in_url_once_and_waits_for_it(store, monkeypatch):
+    vpn.save_profile("sso", {"config": CERT_ONLY})
+    pending = {"state": "AUTH_PENDING", "auth_url": "https://vpn.example/auth/1", "auth_expires": time.time() + 120}
+    states = iter([{"state": "STOPPED"}, pending, pending])
+    monkeypatch.setattr(vpn, "request", lambda name, command="status": next(states, {"state": "CONNECTED"}))
+    monkeypatch.setattr("evo_cli.commands.openvpn.shutil.which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr("evo_cli.commands.openvpn.os.geteuid", lambda: 0)
+
+    class Running:
+        def __init__(self):
+            self.stdin = io.BytesIO()
+
+        def poll(self):
+            return None
+
+    monkeypatch.setattr("evo_cli.commands.openvpn.subprocess.Popen", lambda command, **_: Running())
+    result = CliRunner().invoke(cli, ["openvpn", "connect", "sso", "--no-watch", "--timeout", "10"])
+    assert result.exit_code == 0, result.output
+    assert result.output.count("https://vpn.example/auth/1") == 1 and "connected" in result.output
+
+
 def test_pick_profile_by_number_single_or_prompt(store, monkeypatch):
     runner = CliRunner()
     totp = vpn.parse_totp(SECRET)

evo_cli-0.33.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.33.0