evo-cli 0.35.0__tar.gz → 0.35.2__tar.gz

{evo_cli-0.35.0 → evo_cli-0.35.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.35.0
+Version: 0.35.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.35.2/evo_cli/VERSION

@@ -0,0 +1 @@
+0.35.2

{evo_cli-0.35.0 → evo_cli-0.35.2}/evo_cli/commands/route/_spoofdpi.py

@@ -3,10 +3,9 @@
 GoodbyeDPI has no macOS build. SpoofDPI is a local HTTP proxy that splits the
 TLS ClientHello, so the filter never reads the server name in one piece. It only
 does that for the hosts `evo route open` named: every other name passes through
-untouched and resolves with the system's DNS server. The named hosts resolve over
-DoH instead, because a name the filter blocks usually has its DNS answer poisoned
-too. SpoofDPI's resolver never reads /etc/resolver, so names a connected evo VPN
-resolves through split DNS skip the proxy altogether (`sync_vpn_bypass`).
+untouched and resolves with the system's DNS server (SpoofDPI's own resolver,
+which does not read /etc/resolver). The named hosts resolve over DoH instead,
+because a name the filter blocks usually has its DNS answer poisoned too.
 """
 
 from __future__ import annotations
@@ -47,10 +46,6 @@ dns = {{ mode = "https", cache = true }}
 https = {{ skip = false, split-mode = "{SPLIT_MODE}" }}
 """
 
-# The evo openvpn DNS hook starts each /etc/resolver file it writes with this tag.
-RESOLVER = Path("/etc/resolver")
-VPN_TAG = "# evo openvpn "
-
 # networksetup names both proxies by these words: -getwebproxy, -setsecurewebproxystate, ...
 PROXY_KINDS = ("webproxy", "securewebproxy")
 
@@ -263,56 +258,6 @@ def clear_system_proxy():
     return cleared
 
 
-def vpn_domains():
-    """Domains a connected evo VPN resolves with its own DNS: its tagged files under /etc/resolver."""
-    domains = []
-    for path in sorted(RESOLVER.glob("*")):
-        try:
-            with path.open(encoding="utf-8") as handle:
-                tagged = handle.readline().startswith(VPN_TAG)
-        except (OSError, UnicodeDecodeError):
-            continue
-        if tagged:
-            domains.append(path.name)
-    return domains
-
-
-def _bypass(service):
-    lines = _networksetup("-getproxybypassdomains", service).stdout.splitlines()
-    return [line.strip() for line in lines if line.strip() and not line.startswith("There aren't any")]
-
-
-def sync_vpn_bypass():
-    """Let the names a connected evo VPN resolves skip the proxy, and take them out again once it is down.
-
-    SpoofDPI would ask the system's DNS server for them and fail. Each service whose proxy is ours bypasses those
-    domains; what this added is recorded per service, so only that comes out again and a user's entries stay.
-    """
-    record = home() / "vpn-bypass.json"
-    try:
-        added = json.loads(record.read_text())
-    except (OSError, ValueError):
-        added = {}
-    wanted = [entry for domain in vpn_domains() for entry in (domain, f"*.{domain}")]
-    proxied = proxied_services()
-    now = {}
-    for service in network_services():
-        mine = added.get(service, [])
-        if not mine and service not in proxied:
-            continue
-        current = _bypass(service)
-        kept = [entry for entry in current if entry not in mine]
-        new = [entry for entry in wanted if entry not in kept] if service in proxied else []
-        if kept + new != current:
-            _networksetup("-setproxybypassdomains", service, *(kept + new or ["Empty"]))
-        if new:
-            now[service] = new
-    if now or added:
-        home().mkdir(parents=True, exist_ok=True)
-        record.write_text(json.dumps(now))
-    return now
-
-
 def _extension_name(profile, ext_id):
     for path in sorted((profile / "Extensions" / ext_id).glob("*/manifest.json")):
         try:
@@ -378,7 +323,6 @@ def ensure(*hosts):
     if not _start(reload=_write_agent(exe)):
         return service_state()
     set_system_proxy()
-    sync_vpn_bypass()
     return service_state()
 
 
@@ -395,7 +339,6 @@ def forget(host):
 def remove():
     """Clear the system proxy first, so nothing points at a proxy that is gone, then stop and drop the agent."""
     clear_system_proxy()
-    sync_vpn_bypass()
     _launchctl("bootout", f"{_domain()}/{LABEL}")
     agent_path().unlink(missing_ok=True)
     hosts_path().unlink(missing_ok=True)

{evo_cli-0.35.0 → evo_cli-0.35.2}/evo_cli/openvpn.py

@@ -355,18 +355,6 @@ def split_dns(command, name, hooks=Path("/var/run"), resolver=Path("/etc/resolve
     return ["sh", "-c", wrapper, "sh", script, *hooked]
 
 
-def sync_proxy_bypass():
-    """On macOS, let the names this VPN resolves skip evo route's proxy; never fatal to the connection."""
-    if sys.platform != "darwin":
-        return
-    try:
-        from evo_cli.commands.route import _spoofdpi
-
-        _spoofdpi.sync_vpn_bypass()
-    except Exception:
-        pass
-
-
 def parse_totp(value):
     value = value.strip()
     settings = {"secret": value, "algorithm": "SHA1", "digits": 6, "period": 30}
@@ -823,8 +811,6 @@ def worker(name, timeout):
                                     state["since"] = time.time()
                                     state.pop("auth_url", None)
                                     state.pop("auth_expires", None)
-                                    # The DNS hook ran before CONNECTED (route-up); its domains now exist.
-                                    sync_proxy_bypass()
                                     # Once up, let OpenVPN retry for as long as the network is gone.
                                     deadline = float("inf")
                                 elif fields[1] != "CONNECTED":
@@ -876,8 +862,6 @@ def worker(name, timeout):
                     "error": "OpenVPN did not exit; inspect processes manually.",
                 }
         publish()
-        # OpenVPN has exited and its DNS hook has removed the domains; the proxy takes them back.
-        sync_proxy_bypass()
         selector.close()
         control.close()
         listener.close()

{evo_cli-0.35.0 → evo_cli-0.35.2}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.35.0
+Version: 0.35.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.35.0 → evo_cli-0.35.2}/tests/test_openvpn.py

@@ -18,14 +18,6 @@ CONFIG = "client\ndev tun\nremote vpn.example 1194 udp\nauth-user-pass\n<ca>\nte
 SECRET = base64.b32encode(b"12345678901234567890").decode()
 
 
-@pytest.fixture(autouse=True)
-def no_proxy_sync(monkeypatch):
-    """The worker would otherwise change this machine's proxy bypass list."""
-    synced = []
-    monkeypatch.setattr(vpn, "sync_proxy_bypass", lambda: synced.append(True))
-    return synced
-
-
 @pytest.fixture
 def store(tmp_path, monkeypatch):
     if sys.platform == "win32":
@@ -651,7 +643,7 @@ with socket.socket(socket.AF_UNIX) as s:
 
 
 @pytest.mark.parametrize("mode", ["ok", "fail", "reconnect", "webauth"])
-def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatch, mode, no_proxy_sync):
+def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatch, mode):
     fail, webauth = mode == "fail", mode == "webauth"
     config = CERT_ONLY if webauth else CONFIG
     vpn.save_profile(
@@ -698,8 +690,6 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
         thread.join(5)
         assert not thread.is_alive()
         assert opened == (["https://vpn.example/auth/1"] if webauth else [])
-        # The proxy bypass follows the DNS hook: on each CONNECTED, and once more after OpenVPN exits.
-        assert len(no_proxy_sync) == {"fail": 1, "reconnect": 3}.get(mode, 2)
         assert vpn.request("m1")["state"] == "STOPPED"
         base = vpn.session_path("m1")
         state = json.loads(Path(str(base) + ".json").read_text())

{evo_cli-0.35.0 → evo_cli-0.35.2}/tests/test_route.py

@@ -254,36 +254,6 @@ def _fake_networksetup(proxies, calls):
     return run
 
 
-def test_vpn_split_dns_domains_skip_the_proxy_and_only_ours_come_out(tmp_path, monkeypatch):
-    monkeypatch.setenv("EVO_ROUTE_HOME", str(tmp_path / "route"))
-    resolver = tmp_path / "resolver"
-    resolver.mkdir()
-    monkeypatch.setattr(_spoofdpi, "RESOLVER", resolver)
-    (resolver / "corp.example").write_text("# evo openvpn m1\nnameserver 10.0.0.1\n")
-    (resolver / "mine.example").write_text("nameserver 192.0.2.1\n")
-    ours = (True, _spoofdpi.LISTEN_HOST, str(_spoofdpi.LISTEN_PORT))
-    proxies = {("Wi-Fi", "webproxy"): ours, ("Wi-Fi", "securewebproxy"): ours}
-    bypass = {"Wi-Fi": ["*.local", "*.corp.example"], "USB LAN": ["*.local"]}
-    fake = _fake_networksetup(proxies, [])
-
-    def run(*args):
-        if args[0] == "-getproxybypassdomains":
-            out = "\n".join(bypass[args[1]]) or f"There aren't any bypass domains set on {args[1]}."
-            return subprocess.CompletedProcess(args, 0, out + "\n", "")
-        if args[0] == "-setproxybypassdomains":
-            bypass[args[1]] = [] if args[2:] == ("Empty",) else list(args[2:])
-            return subprocess.CompletedProcess(args, 0, "", "")
-        return fake(*args)
-
-    monkeypatch.setattr(_spoofdpi, "_networksetup", run)
-    # Only the tagged domain, only on the proxied service; the user's own *.corp.example is not added twice.
-    assert _spoofdpi.sync_vpn_bypass() == {"Wi-Fi": ["corp.example"]}
-    assert bypass == {"Wi-Fi": ["*.local", "*.corp.example", "corp.example"], "USB LAN": ["*.local"]}
-    (resolver / "corp.example").unlink()  # the VPN is down
-    assert _spoofdpi.sync_vpn_bypass() == {}
-    assert bypass == {"Wi-Fi": ["*.local", "*.corp.example"], "USB LAN": ["*.local"]}
-
-
 def test_spoofdpi_host_list_round_trips_with_subdomains(tmp_path, monkeypatch):
     monkeypatch.setenv("EVO_ROUTE_HOME", str(tmp_path))
     _spoofdpi._write_hosts(["medium.com", "x.com", "medium.com"])

evo_cli-0.35.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.35.0