evo-cli 0.34.2__tar.gz → 0.35.0__tar.gz

{evo_cli-0.34.2 → evo_cli-0.35.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.2
+Version: 0.35.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.35.0/evo_cli/VERSION

@@ -0,0 +1 @@
+0.35.0

{evo_cli-0.34.2 → evo_cli-0.35.0}/evo_cli/commands/openvpn.py

@@ -390,7 +390,12 @@ def connect(name, timeout, sudo_password_stdin, watch):
     process.stdin.write((password + "\n").encode())
     process.stdin.close()
     password = ""
-    click.echo(f"Connecting {name}; disconnect any external GUI VPN first. System DNS is not modified.")
+    dns = (
+        "Names the server resolves (split DNS) go to its DNS while connected; other DNS is unchanged."
+        if sys.platform == "darwin"
+        else "System DNS is not modified."
+    )
+    click.echo(f"Connecting {name}; disconnect any external GUI VPN first. {dns}")
     deadline = time.monotonic() + timeout + 20
     shown = None
     try:

{evo_cli-0.34.2 → evo_cli-0.35.0}/evo_cli/commands/route/_spoofdpi.py

@@ -3,9 +3,10 @@
 GoodbyeDPI has no macOS build. SpoofDPI is a local HTTP proxy that splits the
 TLS ClientHello, so the filter never reads the server name in one piece. It only
 does that for the hosts `evo route open` named: every other name passes through
-untouched and resolves with the system resolver, so names only a VPN knows keep
-working. The named hosts resolve over DoH instead, because a name the filter
-blocks usually has its DNS answer poisoned too.
+untouched and resolves with the system's DNS server. The named hosts resolve over
+DoH instead, because a name the filter blocks usually has its DNS answer poisoned
+too. SpoofDPI's resolver never reads /etc/resolver, so names a connected evo VPN
+resolves through split DNS skip the proxy altogether (`sync_vpn_bypass`).
 """
 
 from __future__ import annotations
@@ -46,6 +47,10 @@ dns = {{ mode = "https", cache = true }}
 https = {{ skip = false, split-mode = "{SPLIT_MODE}" }}
 """
 
+# The evo openvpn DNS hook starts each /etc/resolver file it writes with this tag.
+RESOLVER = Path("/etc/resolver")
+VPN_TAG = "# evo openvpn "
+
 # networksetup names both proxies by these words: -getwebproxy, -setsecurewebproxystate, ...
 PROXY_KINDS = ("webproxy", "securewebproxy")
 
@@ -258,6 +263,56 @@ def clear_system_proxy():
     return cleared
 
 
+def vpn_domains():
+    """Domains a connected evo VPN resolves with its own DNS: its tagged files under /etc/resolver."""
+    domains = []
+    for path in sorted(RESOLVER.glob("*")):
+        try:
+            with path.open(encoding="utf-8") as handle:
+                tagged = handle.readline().startswith(VPN_TAG)
+        except (OSError, UnicodeDecodeError):
+            continue
+        if tagged:
+            domains.append(path.name)
+    return domains
+
+
+def _bypass(service):
+    lines = _networksetup("-getproxybypassdomains", service).stdout.splitlines()
+    return [line.strip() for line in lines if line.strip() and not line.startswith("There aren't any")]
+
+
+def sync_vpn_bypass():
+    """Let the names a connected evo VPN resolves skip the proxy, and take them out again once it is down.
+
+    SpoofDPI would ask the system's DNS server for them and fail. Each service whose proxy is ours bypasses those
+    domains; what this added is recorded per service, so only that comes out again and a user's entries stay.
+    """
+    record = home() / "vpn-bypass.json"
+    try:
+        added = json.loads(record.read_text())
+    except (OSError, ValueError):
+        added = {}
+    wanted = [entry for domain in vpn_domains() for entry in (domain, f"*.{domain}")]
+    proxied = proxied_services()
+    now = {}
+    for service in network_services():
+        mine = added.get(service, [])
+        if not mine and service not in proxied:
+            continue
+        current = _bypass(service)
+        kept = [entry for entry in current if entry not in mine]
+        new = [entry for entry in wanted if entry not in kept] if service in proxied else []
+        if kept + new != current:
+            _networksetup("-setproxybypassdomains", service, *(kept + new or ["Empty"]))
+        if new:
+            now[service] = new
+    if now or added:
+        home().mkdir(parents=True, exist_ok=True)
+        record.write_text(json.dumps(now))
+    return now
+
+
 def _extension_name(profile, ext_id):
     for path in sorted((profile / "Extensions" / ext_id).glob("*/manifest.json")):
         try:
@@ -323,6 +378,7 @@ def ensure(*hosts):
     if not _start(reload=_write_agent(exe)):
         return service_state()
     set_system_proxy()
+    sync_vpn_bypass()
     return service_state()
 
 
@@ -339,6 +395,7 @@ def forget(host):
 def remove():
     """Clear the system proxy first, so nothing points at a proxy that is gone, then stop and drop the agent."""
     clear_system_proxy()
+    sync_vpn_bypass()
     _launchctl("bootout", f"{_domain()}/{LABEL}")
     agent_path().unlink(missing_ok=True)
     hosts_path().unlink(missing_ok=True)

{evo_cli-0.34.2 → evo_cli-0.35.0}/evo_cli/openvpn.py

@@ -290,6 +290,83 @@ def pin_remotes(command, remotes):
     return ["sh", "-c", script, "sh", *command]
 
 
+# Run by OpenVPN as root (--route-up, --down) from a root-owned copy. It gives each domain a server resolves
+# (pushed "dns server N resolve-domains") an /etc/resolver file naming that server, so macOS sends only those
+# names into the tunnel. Files carry a tag line; a file without this profile's tag is never touched. Values come
+# from the server, so only plain domains and addresses on port 53 are used, and eval sees only digits.
+DNS_HOOK = r"""
+umask 022
+tag={tag}
+dir={directory}
+for f in "$dir"/*; do
+  [ -f "$f" ] && [ "$(head -n 1 "$f")" = "$tag" ] && rm -f "$f"
+done
+if [ "$1" = up ]; then
+  mkdir -p "$dir"
+  for n in $(env | sed -n 's/^dns_server_\([0-9]\{{1,3\}}\)_address_1=.*/\1/p' | sort -n); do
+    servers= m=1
+    while [ $m -le 8 ]; do
+      eval "a=\${{dns_server_${{n}}_address_$m-}} p=\${{dns_server_${{n}}_port_$m-53}}"
+      case $a$p in *[!0-9A-Fa-f:.]*) ;; *) [ -n "$a" ] && [ "$p" = 53 ] && servers="$servers $a" ;; esac
+      m=$((m + 1))
+    done
+    m=1
+    while eval "d=\${{dns_server_${{n}}_resolve_domain_$m-}}"; [ -n "$d" ]; do
+      m=$((m + 1))
+      [ -n "$servers" ] || continue
+      case $d in .*|*.|*..*|*[!A-Za-z0-9.-]*) continue ;; esac
+      [ -e "$dir/$d" ] || printf '%s\n' "$tag" > "$dir/$d"
+      [ "$(head -n 1 "$dir/$d")" = "$tag" ] || continue
+      for a in $servers; do printf 'nameserver %s\n' "$a" >> "$dir/$d"; done
+    done
+  done
+fi
+killall -HUP mDNSResponder 2>/dev/null
+exit 0
+"""
+
+
+def split_dns(command, name, hooks=Path("/var/run"), resolver=Path("/etc/resolver")):
+    """Wrap OpenVPN so the split DNS its server pushes applies while it runs, and is undone however it ends.
+
+    OpenVPN 2.6 leaves pushed DNS to scripts on macOS. The wrapper runs as root: it writes the hook where only
+    root can write (never a user-writable file run as root), lets OpenVPN call it after routes are up and on
+    close, and runs it once more after OpenVPN exits, so a crash leaves no resolver pointing into the tunnel.
+    """
+    hook = shlex.quote(str(hooks / f"evo-openvpn-{session_path(name).name}.sh"))
+    script = DNS_HOOK.format(tag=shlex.quote(f"# evo openvpn {name}"), directory=shlex.quote(str(resolver)))
+    wrapper = "; ".join(
+        [
+            f'rm -f {hook} && (umask 077 && printf "%s" "$1" > {hook}) || exit 1',
+            "shift",
+            # Leftovers of a run that died with its wrapper would send the remote's name into a tunnel not up.
+            f"/bin/sh {hook} down",
+            "trap : HUP INT TERM",
+            '"$@"',
+            "code=$?",
+            f"/bin/sh {hook} down",
+            f"rm -f {hook}",
+            'exit "$code"',
+        ]
+    )
+    hooked = list(command)
+    hooked[hooked.index("--script-security") + 1] = "2"
+    hooked += ["--route-up", f"/bin/sh {hook} up", "--down", f"/bin/sh {hook} down"]
+    return ["sh", "-c", wrapper, "sh", script, *hooked]
+
+
+def sync_proxy_bypass():
+    """On macOS, let the names this VPN resolves skip evo route's proxy; never fatal to the connection."""
+    if sys.platform != "darwin":
+        return
+    try:
+        from evo_cli.commands.route import _spoofdpi
+
+        _spoofdpi.sync_vpn_bypass()
+    except Exception:
+        pass
+
+
 def parse_totp(value):
     value = value.strip()
     settings = {"secret": value, "algorithm": "SHA1", "digits": 6, "period": 30}
@@ -657,6 +734,8 @@ def worker(name, timeout):
             command += ["--setenv", "IV_SSO", "openurl,webauth"]
         if ciphers := data_ciphers(profile["config"]):
             command += ["--data-ciphers", ciphers]
+        if sys.platform == "darwin":
+            command = split_dns(command, name)
         pinned = [] if takes_default_route(profile["config"]) else remotes
         if profile.get("otp_url"):
             pinned = [*pinned, urlparse(profile["otp_url"]).hostname]
@@ -744,6 +823,8 @@ def worker(name, timeout):
                                     state["since"] = time.time()
                                     state.pop("auth_url", None)
                                     state.pop("auth_expires", None)
+                                    # The DNS hook ran before CONNECTED (route-up); its domains now exist.
+                                    sync_proxy_bypass()
                                     # Once up, let OpenVPN retry for as long as the network is gone.
                                     deadline = float("inf")
                                 elif fields[1] != "CONNECTED":
@@ -795,6 +876,8 @@ def worker(name, timeout):
                     "error": "OpenVPN did not exit; inspect processes manually.",
                 }
         publish()
+        # OpenVPN has exited and its DNS hook has removed the domains; the proxy takes them back.
+        sync_proxy_bypass()
         selector.close()
         control.close()
         listener.close()

{evo_cli-0.34.2 → evo_cli-0.35.0}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.2
+Version: 0.35.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.34.2 → evo_cli-0.35.0}/tests/test_openvpn.py

@@ -18,6 +18,14 @@ CONFIG = "client\ndev tun\nremote vpn.example 1194 udp\nauth-user-pass\n<ca>\nte
 SECRET = base64.b32encode(b"12345678901234567890").decode()
 
 
+@pytest.fixture(autouse=True)
+def no_proxy_sync(monkeypatch):
+    """The worker would otherwise change this machine's proxy bypass list."""
+    synced = []
+    monkeypatch.setattr(vpn, "sync_proxy_bypass", lambda: synced.append(True))
+    return synced
+
+
 @pytest.fixture
 def store(tmp_path, monkeypatch):
     if sys.platform == "win32":
@@ -398,6 +406,94 @@ def test_worker_passes_the_profile_cipher(store, monkeypatch):
     assert command[command.index("--data-ciphers") + 1].endswith(":AES-256-CBC")
 
 
+SPLIT_DNS_ENV = {
+    "dns_server_10_address_1": "10.0.0.1",
+    "dns_server_10_resolve_domain_1": "corp.example",
+    "dns_server_10_resolve_domain_2": "../evil",
+    "dns_server_10_resolve_domain_3": "a b",
+    "dns_server_10_resolve_domain_4": "mine.example",
+    "dns_server_11_address_1": "10.0.0.2",
+    "dns_server_11_resolve_domain_1": "corp.example",
+    "dns_server_12_address_1": "10.0.0.3",
+    "dns_server_12_port_1": "5353",
+    "dns_server_12_resolve_domain_1": "odd.example",
+    "dns_server_13_address_1": "10.0.0.4; touch pwned",
+    "dns_server_13_resolve_domain_1": "bad.example",
+    "dns_server_14_address_1": "10.0.0.5",
+}
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX shell hook")
+def test_dns_hook_writes_split_dns_and_removes_only_its_own(tmp_path):
+    resolver = tmp_path / "resolver"
+    resolver.mkdir()
+    (resolver / "mine.example").write_text("nameserver 192.0.2.1\n")
+    (resolver / "other.example").write_text("# evo openvpn other\nnameserver 192.0.2.2\n")
+    script = vpn.DNS_HOOK.format(tag="'# evo openvpn m1'", directory=str(resolver))
+
+    def hook(stage):
+        env = {"PATH": "/usr/bin:/bin", **SPLIT_DNS_ENV}
+        subprocess.run(["sh", "-c", script, "hook", stage, "utun9", "1420", "init"], env=env, cwd=tmp_path, check=True)
+
+    hook("up")
+    files = {path.name: path.read_text() for path in resolver.iterdir()}
+    # Both servers of a domain, in server order; no file for a bad name, port, address or a server without domains.
+    assert files["corp.example"] == "# evo openvpn m1\nnameserver 10.0.0.1\nnameserver 10.0.0.2\n"
+    assert set(files) == {"corp.example", "mine.example", "other.example"}
+    assert files["mine.example"] == "nameserver 192.0.2.1\n"
+    assert not (tmp_path / "evil").exists() and not (tmp_path / "pwned").exists()
+    hook("up")  # a restart replaces its own files instead of appending to them
+    assert (resolver / "corp.example").read_text().count("nameserver") == 2
+    hook("down")
+    assert sorted(path.name for path in resolver.iterdir()) == ["mine.example", "other.example"]
+
+
+FAKE_HOOKED_OPENVPN = """
+import os, shlex, subprocess, sys
+resolver = sys.argv[1]
+args = sys.argv[2:]
+assert not os.path.exists(os.path.join(resolver, "stale.example")), "leftover not cleared before start"
+assert args[args.index("--script-security") + 1] == "2"
+command = shlex.split(args[args.index("--route-up") + 1]) + ["utun9", "1420", "init"]
+subprocess.run(command, env={**os.environ, "dns_server_10_address_1": "10.0.0.1",
+                             "dns_server_10_resolve_domain_1": "corp.example"}, check=True)
+assert open(os.path.join(resolver, "corp.example")).read().endswith("nameserver 10.0.0.1\\n")
+sys.exit(7)  # dies without running --down
+"""
+
+
+def test_split_dns_wrapper_undoes_everything_when_openvpn_dies(store, tmp_path):
+    hooks, resolver = tmp_path / "run", tmp_path / "resolver"
+    hooks.mkdir()
+    resolver.mkdir()
+    (resolver / "stale.example").write_text("# evo openvpn m1\nnameserver 10.9.9.9\n")
+    command = [sys.executable, "-c", FAKE_HOOKED_OPENVPN, str(resolver), "--script-security", "1", "--verb", "3"]
+    wrapped = vpn.split_dns(command, "m1", hooks=hooks, resolver=resolver)
+    result = subprocess.run(wrapped, capture_output=True, text=True, check=False)
+    assert result.returncode == 7, result.stderr
+    assert list(resolver.iterdir()) == [] and list(hooks.iterdir()) == []
+
+
+@pytest.mark.parametrize("platform,hooked", [("darwin", True), ("linux", False)])
+def test_worker_applies_split_dns_on_macos_only(store, monkeypatch, platform, hooked):
+    vpn.save_profile("m1", {"config": CERT_ONLY})
+    monkeypatch.setattr(sys, "stdin", io.StringIO("\n"))
+    monkeypatch.setattr(vpn.os, "geteuid", lambda: 0)
+    monkeypatch.setattr(vpn.shutil, "which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr(vpn.sys, "platform", platform)
+    monkeypatch.setattr(vpn, "pin_remotes", lambda command, hosts: command)
+    started = []
+
+    def popen(command, **_):
+        started.append(command)
+        raise OSError("stop before running anything")
+
+    monkeypatch.setattr(vpn.subprocess, "Popen", popen)
+    vpn.worker("m1", 10)
+    assert ("--route-up" in started[0]) == hooked
+    assert started[0][started[0].index("--script-security") + 1] == ("2" if hooked else "1")
+
+
 @pytest.mark.parametrize(
     "message,expected",
     [
@@ -555,7 +651,7 @@ with socket.socket(socket.AF_UNIX) as s:
 
 
 @pytest.mark.parametrize("mode", ["ok", "fail", "reconnect", "webauth"])
-def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatch, mode):
+def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatch, mode, no_proxy_sync):
     fail, webauth = mode == "fail", mode == "webauth"
     config = CERT_ONLY if webauth else CONFIG
     vpn.save_profile(
@@ -602,6 +698,8 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
         thread.join(5)
         assert not thread.is_alive()
         assert opened == (["https://vpn.example/auth/1"] if webauth else [])
+        # The proxy bypass follows the DNS hook: on each CONNECTED, and once more after OpenVPN exits.
+        assert len(no_proxy_sync) == {"fail": 1, "reconnect": 3}.get(mode, 2)
         assert vpn.request("m1")["state"] == "STOPPED"
         base = vpn.session_path("m1")
         state = json.loads(Path(str(base) + ".json").read_text())

{evo_cli-0.34.2 → evo_cli-0.35.0}/tests/test_route.py

@@ -254,6 +254,36 @@ def _fake_networksetup(proxies, calls):
     return run
 
 
+def test_vpn_split_dns_domains_skip_the_proxy_and_only_ours_come_out(tmp_path, monkeypatch):
+    monkeypatch.setenv("EVO_ROUTE_HOME", str(tmp_path / "route"))
+    resolver = tmp_path / "resolver"
+    resolver.mkdir()
+    monkeypatch.setattr(_spoofdpi, "RESOLVER", resolver)
+    (resolver / "corp.example").write_text("# evo openvpn m1\nnameserver 10.0.0.1\n")
+    (resolver / "mine.example").write_text("nameserver 192.0.2.1\n")
+    ours = (True, _spoofdpi.LISTEN_HOST, str(_spoofdpi.LISTEN_PORT))
+    proxies = {("Wi-Fi", "webproxy"): ours, ("Wi-Fi", "securewebproxy"): ours}
+    bypass = {"Wi-Fi": ["*.local", "*.corp.example"], "USB LAN": ["*.local"]}
+    fake = _fake_networksetup(proxies, [])
+
+    def run(*args):
+        if args[0] == "-getproxybypassdomains":
+            out = "\n".join(bypass[args[1]]) or f"There aren't any bypass domains set on {args[1]}."
+            return subprocess.CompletedProcess(args, 0, out + "\n", "")
+        if args[0] == "-setproxybypassdomains":
+            bypass[args[1]] = [] if args[2:] == ("Empty",) else list(args[2:])
+            return subprocess.CompletedProcess(args, 0, "", "")
+        return fake(*args)
+
+    monkeypatch.setattr(_spoofdpi, "_networksetup", run)
+    # Only the tagged domain, only on the proxied service; the user's own *.corp.example is not added twice.
+    assert _spoofdpi.sync_vpn_bypass() == {"Wi-Fi": ["corp.example"]}
+    assert bypass == {"Wi-Fi": ["*.local", "*.corp.example", "corp.example"], "USB LAN": ["*.local"]}
+    (resolver / "corp.example").unlink()  # the VPN is down
+    assert _spoofdpi.sync_vpn_bypass() == {}
+    assert bypass == {"Wi-Fi": ["*.local", "*.corp.example"], "USB LAN": ["*.local"]}
+
+
 def test_spoofdpi_host_list_round_trips_with_subdomains(tmp_path, monkeypatch):
     monkeypatch.setenv("EVO_ROUTE_HOME", str(tmp_path))
     _spoofdpi._write_hosts(["medium.com", "x.com", "medium.com"])
@@ -429,7 +459,7 @@ def _fake_macos_bypass(monkeypatch, tmp_path, proxy_fails=()):
     monkeypatch.setattr(_dpi, "is_admin", lambda: False)
     monkeypatch.setattr(_probe, "diagnose", lambda host, timeout: {"host": host, "verdict": _probe.SNI_BLOCKED})
     monkeypatch.setattr(_spoofdpi, "ensure", ensure)
-    monkeypatch.setattr(_spoofdpi, "browser_overrides", lambda: [])
+    monkeypatch.setattr(_spoofdpi, "browser_overrides", list)
     monkeypatch.setattr(
         _probe, "proxy_probe", lambda host, proxy, timeout=6.0: _probe_row(host, tls=host not in proxy_fails)
     )

evo_cli-0.34.2/evo_cli/VERSION

@@ -1 +0,0 @@
-0.34.2