evo-cli 0.34.1__tar.gz → 0.34.3__tar.gz

{evo_cli-0.34.1 → evo_cli-0.34.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.1
+Version: 0.34.3
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.34.3/evo_cli/VERSION

@@ -0,0 +1 @@
+0.34.3

{evo_cli-0.34.1 → evo_cli-0.34.3}/evo_cli/openvpn.py

@@ -23,6 +23,8 @@ from urllib.parse import parse_qs, urlparse
 from evo_cli.credentials.store import CredentialError, compile_flat, read_flat, set_value
 
 APP = Path("/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect")
+# OpenVPN 2.6's default --data-ciphers.
+DATA_CIPHERS = ("AES-256-GCM", "AES-128-GCM", "CHACHA20-POLY1305")
 INLINE = {"ca", "cert", "key", "tls-auth", "tls-crypt", "tls-crypt-v2", "extra-certs"}
 # Only self-contained client profiles: never execute scripts/plugins or follow includes as root.
 OPTIONS = {
@@ -184,6 +186,24 @@ def uses_credentials(text):
     return any(words[0].removeprefix("--") == "auth-user-pass" for _, words in _directives(text))
 
 
+def data_ciphers(text):
+    """The --data-ciphers to pass for a profile that names only --cipher, else None.
+
+    OpenVPN 2.5 and Connect offer that cipher too; 2.6 no longer does, so a server that accepts nothing else
+    (Access Server profiles carry "cipher AES-256-CBC") ends with "no shared cipher". The defaults stay first.
+    """
+    cipher = None
+    for _, words in _directives(text):
+        option = words[0].removeprefix("--")
+        if option == "data-ciphers":
+            return None
+        if option == "cipher" and len(words) == 2:
+            cipher = words[1]
+    if not cipher or cipher.upper() in DATA_CIPHERS:
+        return None
+    return ":".join([*DATA_CIPHERS, cipher])
+
+
 def takes_default_route(text):
     """Whether a profile may take the default route. Only split-tunnel profiles can run beside another VPN.
 
@@ -635,6 +655,8 @@ def worker(name, timeout):
             # With no password to ask for, a server can add a sign-in step only through the browser (Access
             # Server SAML); announce it, or such a server refuses the client.
             command += ["--setenv", "IV_SSO", "openurl,webauth"]
+        if ciphers := data_ciphers(profile["config"]):
+            command += ["--data-ciphers", ciphers]
         pinned = [] if takes_default_route(profile["config"]) else remotes
         if profile.get("otp_url"):
             pinned = [*pinned, urlparse(profile["otp_url"]).hostname]

{evo_cli-0.34.1 → evo_cli-0.34.3}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.1
+Version: 0.34.3
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.34.1 → evo_cli-0.34.3}/tests/test_openvpn.py

@@ -367,6 +367,37 @@ def test_worker_pins_the_otp_host_even_for_a_full_tunnel(store, monkeypatch):
     assert pinned == [["otp.example"]]
 
 
+@pytest.mark.parametrize(
+    "extra,expected",
+    [
+        ("", None),
+        ("cipher AES-256-CBC\n", "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC"),
+        ("cipher AES-256-GCM\n", None),
+        ("cipher AES-256-CBC\ndata-ciphers AES-256-GCM\n", None),
+    ],
+)
+def test_a_profile_cipher_is_offered_after_the_defaults(extra, expected):
+    assert vpn.data_ciphers(CONFIG + extra) == expected
+
+
+def test_worker_passes_the_profile_cipher(store, monkeypatch):
+    vpn.save_profile("m1", {"config": CERT_ONLY + "cipher AES-256-CBC\n"})
+    monkeypatch.setattr(sys, "stdin", io.StringIO("\n"))
+    monkeypatch.setattr(vpn.os, "geteuid", lambda: 0)
+    monkeypatch.setattr(vpn.shutil, "which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr(vpn, "pin_remotes", lambda command, hosts: command)
+    started = []
+
+    def popen(command, **_):
+        started.append(command)
+        raise OSError("stop before running anything")
+
+    monkeypatch.setattr(vpn.subprocess, "Popen", popen)
+    vpn.worker("m1", 10)
+    command = started[0]
+    assert command[command.index("--data-ciphers") + 1].endswith(":AES-256-CBC")
+
+
 @pytest.mark.parametrize(
     "message,expected",
     [

{evo_cli-0.34.1 → evo_cli-0.34.3}/tests/test_route.py

@@ -429,7 +429,7 @@ def _fake_macos_bypass(monkeypatch, tmp_path, proxy_fails=()):
     monkeypatch.setattr(_dpi, "is_admin", lambda: False)
     monkeypatch.setattr(_probe, "diagnose", lambda host, timeout: {"host": host, "verdict": _probe.SNI_BLOCKED})
     monkeypatch.setattr(_spoofdpi, "ensure", ensure)
-    monkeypatch.setattr(_spoofdpi, "browser_overrides", lambda: [])
+    monkeypatch.setattr(_spoofdpi, "browser_overrides", list)
     monkeypatch.setattr(
         _probe, "proxy_probe", lambda host, proxy, timeout=6.0: _probe_row(host, tls=host not in proxy_fails)
     )

evo_cli-0.34.1/evo_cli/VERSION

@@ -1 +0,0 @@
-0.34.1