evo-cli 0.34.0__tar.gz → 0.34.2__tar.gz

{evo_cli-0.34.0 → evo_cli-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.0
+Version: 0.34.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.34.2/evo_cli/VERSION

@@ -0,0 +1 @@
+0.34.2

{evo_cli-0.34.0 → evo_cli-0.34.2}/evo_cli/openvpn.py

@@ -23,6 +23,8 @@ from urllib.parse import parse_qs, urlparse
 from evo_cli.credentials.store import CredentialError, compile_flat, read_flat, set_value
 
 APP = Path("/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect")
+# OpenVPN 2.6's default --data-ciphers.
+DATA_CIPHERS = ("AES-256-GCM", "AES-128-GCM", "CHACHA20-POLY1305")
 INLINE = {"ca", "cert", "key", "tls-auth", "tls-crypt", "tls-crypt-v2", "extra-certs"}
 # Only self-contained client profiles: never execute scripts/plugins or follow includes as root.
 OPTIONS = {
@@ -184,6 +186,24 @@ def uses_credentials(text):
     return any(words[0].removeprefix("--") == "auth-user-pass" for _, words in _directives(text))
 
 
+def data_ciphers(text):
+    """The --data-ciphers to pass for a profile that names only --cipher, else None.
+
+    OpenVPN 2.5 and Connect offer that cipher too; 2.6 no longer does, so a server that accepts nothing else
+    (Access Server profiles carry "cipher AES-256-CBC") ends with "no shared cipher". The defaults stay first.
+    """
+    cipher = None
+    for _, words in _directives(text):
+        option = words[0].removeprefix("--")
+        if option == "data-ciphers":
+            return None
+        if option == "cipher" and len(words) == 2:
+            cipher = words[1]
+    if not cipher or cipher.upper() in DATA_CIPHERS:
+        return None
+    return ":".join([*DATA_CIPHERS, cipher])
+
+
 def takes_default_route(text):
     """Whether a profile may take the default route. Only split-tunnel profiles can run beside another VPN.
 
@@ -503,12 +523,26 @@ def quote(value):
     return '"' + value.replace("\\", "\\\\").replace('"', '\\"') + '"'
 
 
+def rejection_reason(line):
+    """The server's text in a Verification Failed notice, for the user; a dynamic challenge keeps only its prompt.
+
+    OpenVPN writes >PASSWORD:Verification Failed: 'Auth' ['REASON'] (the brackets are its own). A CRV1 challenge
+    carries a state ID and the username besides its prompt, so neither is shown.
+    """
+    reason = line.partition("['")[2].rpartition("']")[0]
+    if reason.startswith("CRV1:"):
+        return "dynamic challenge, not supported: " + reason.split(":", 4)[-1]
+    return reason
+
+
 def auth_commands(line, profile):
     # OpenVPN itself caches server-issued session tokens. This notification needs no reply.
     if line.startswith(">PASSWORD:Auth-Token:"):
         return ""
     if "Verification Failed" in line:
-        raise CredentialError("VPN authentication rejected; check password/OTP enrollment before retrying.")
+        reason = rejection_reason(line)
+        detail = f": {reason}" if reason else "; check password/OTP enrollment before retrying"
+        raise CredentialError(f"VPN authentication rejected{detail}.")
     if "Need 'Auth' username/password" not in line:
         raise CredentialError("Unsupported authentication challenge (private-key password or dynamic challenge).")
     username, password = profile.get("username", ""), profile.get("password", "")
@@ -621,6 +655,8 @@ def worker(name, timeout):
             # With no password to ask for, a server can add a sign-in step only through the browser (Access
             # Server SAML); announce it, or such a server refuses the client.
             command += ["--setenv", "IV_SSO", "openurl,webauth"]
+        if ciphers := data_ciphers(profile["config"]):
+            command += ["--data-ciphers", ciphers]
         pinned = [] if takes_default_route(profile["config"]) else remotes
         if profile.get("otp_url"):
             pinned = [*pinned, urlparse(profile["otp_url"]).hostname]
@@ -715,7 +751,9 @@ def worker(name, timeout):
                                     state.pop("since", None)
                                 if fields[1] == "AUTH_PENDING":
                                     # Signing in happens in the browser: allow the time the server gives it.
-                                    wait = int(fields[2]) if fields[2].isdigit() else 300
+                                    # "timeout 180" in OpenVPN 2.6, a bare number in older notes.
+                                    wait = fields[2].split()[-1] if fields[2] else ""
+                                    wait = int(wait) if wait.isdigit() else 300
                                     deadline = max(deadline, time.monotonic() + wait)
                                     state["auth_expires"] = time.time() + wait
                                 if fields[1] == "RECONNECTING":

{evo_cli-0.34.0 → evo_cli-0.34.2}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.0
+Version: 0.34.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.34.0 → evo_cli-0.34.2}/tests/test_openvpn.py

@@ -261,10 +261,23 @@ def test_static_challenge_uses_scrv1_and_fresh_totp(monkeypatch):
     assert "SCRV1:cGFzcw==:NjU0MzIx" in vpn.auth_commands(line, profile)
 
 
-def test_auth_rejection_does_not_retry_or_leak_challenge():
+@pytest.mark.parametrize(
+    "line,shown,hidden",
+    [
+        (">PASSWORD:Verification Failed: 'Auth'", "check password/OTP enrollment", None),
+        (">PASSWORD:Verification Failed: 'Auth' ['SAML user does not match']", ": SAML user does not match.", None),
+        (
+            ">PASSWORD:Verification Failed: 'Auth' ['CRV1:R,E:state-id-secret:dXNlcg==:Enter token PIN']",
+            "dynamic challenge, not supported: Enter token PIN",
+            "state-id-secret",
+        ),
+    ],
+)
+def test_auth_rejection_shows_the_reason_but_not_the_challenge_state(line, shown, hidden):
     with pytest.raises(CredentialError) as exc:
-        vpn.auth_commands(">PASSWORD:Verification Failed: 'Auth' ['sensitive']", {})
-    assert "sensitive" not in str(exc.value)
+        vpn.auth_commands(line, {})
+    assert shown in str(exc.value)
+    assert not hidden or (hidden not in str(exc.value) and "dXNlcg==" not in str(exc.value))
 
 
 def test_auth_token_is_a_notification_not_a_prompt():
@@ -354,6 +367,37 @@ def test_worker_pins_the_otp_host_even_for_a_full_tunnel(store, monkeypatch):
     assert pinned == [["otp.example"]]
 
 
+@pytest.mark.parametrize(
+    "extra,expected",
+    [
+        ("", None),
+        ("cipher AES-256-CBC\n", "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC"),
+        ("cipher AES-256-GCM\n", None),
+        ("cipher AES-256-CBC\ndata-ciphers AES-256-GCM\n", None),
+    ],
+)
+def test_a_profile_cipher_is_offered_after_the_defaults(extra, expected):
+    assert vpn.data_ciphers(CONFIG + extra) == expected
+
+
+def test_worker_passes_the_profile_cipher(store, monkeypatch):
+    vpn.save_profile("m1", {"config": CERT_ONLY + "cipher AES-256-CBC\n"})
+    monkeypatch.setattr(sys, "stdin", io.StringIO("\n"))
+    monkeypatch.setattr(vpn.os, "geteuid", lambda: 0)
+    monkeypatch.setattr(vpn.shutil, "which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr(vpn, "pin_remotes", lambda command, hosts: command)
+    started = []
+
+    def popen(command, **_):
+        started.append(command)
+        raise OSError("stop before running anything")
+
+    monkeypatch.setattr(vpn.subprocess, "Popen", popen)
+    vpn.worker("m1", 10)
+    command = started[0]
+    assert command[command.index("--data-ciphers") + 1].endswith(":AES-256-CBC")
+
+
 @pytest.mark.parametrize(
     "message,expected",
     [
@@ -489,7 +533,7 @@ with socket.socket(socket.AF_UNIX) as s:
     held = b'hold off\\n' not in seen
     if sys.argv[2] == 'webauth':
         # Access Server SAML: no password prompt, a browser sign-in instead.
-        s.sendall(b'>STATE:1,AUTH_PENDING,120,,,,,\\n')
+        s.sendall(b'>STATE:1,AUTH_PENDING,timeout 120,,,,,\\n')
         s.sendall(b'>INFOMSG:WEB_AUTH::https://vpn.example/auth/1\\n')
     else:
         auth()

evo_cli-0.34.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.34.0