Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if not os.path.exists(log_folder):
logger.error(
"Please initialise first by running 'sudo openpyn --init', then start using 'openpyn' without sudo")
return 1
# Add another rotating handler to log to .log files
# fix permissions if needed
for attempt in range(2):
try:
file_handler = logging.handlers.TimedRotatingFileHandler(
log_folder + '/openpyn.log', when='W0', interval=4)
file_handler_formatter = logging.Formatter(log_format)
file_handler.setFormatter(file_handler_formatter)
logger.addHandler(file_handler)
except PermissionError:
root.verify_root_access(
"Root access needed to set permissions of {}/openpyn.log".format(log_folder))
subprocess.run("sudo chmod 777 {}/openpyn.log".format(log_folder).split())
subprocess.run("sudo chmod 777 {}/openpyn-notifications.log".format(log_folder).split())
else:
break
# In this case only log messages originating from this logger will show up on the terminal.
coloredlogs.install(level="verbose", logger=logger, fmt=log_format,
level_styles=levelstyles, field_styles=fieldstyles)
stats = True
if sys.__stdin__.isatty():
logger.debug("Interactive")
else:
logger.addHandler(logging.StreamHandler(sys.stdout))
logger.setLevel(logging.WARNING)
if test:
logger.success("Simulation end reached, \
openpyn would have connected to server: " + server + " on port: " + port + " with 'silent' mode: " + str(silent).lower())
return 0
kill_vpn_processes() # kill existing OpenVPN processes
kill_management_client()
logger.success("CONNECTING TO SERVER " + server + " ON PORT " + port)
root_access = root.verify_root_access("Sudo credentials required to run 'openvpn'")
if root_access is False:
root.obtain_root_access()
if not silent:
# notifications Don't work with 'sudo'
if detected_os == "linux" and root.running_with_sudo():
logger.warning("Desktop notifications don't work when using 'sudo', run without it, \
when asked, provide the sudo credentials")
subprocess.Popen("openpyn-management".split())
else:
subprocess.Popen("openpyn-management --do-notify".split())
use_systemd_resolved = False
use_resolvconf = False
if detected_os == "linux":
if subprocess.check_output(["/bin/uname", "-o"]).decode(sys.stdout.encoding).strip() == "ASUSWRT-Merlin":
skip_dns_patch = True
elif os.path.exists("/etc/openwrt_release"):
skip_dns_patch = True
else:
use_systemd_resolved = uses_systemd_resolved()
use_resolvconf = os.path.isfile("/sbin/resolvconf")
else:
def clear_fw_rules():
root.verify_root_access("Root access needed to modify 'iptables' rules")
print("Flushing iptables INPUT and OUTPUT chains AND Applying default Rules")
subprocess.call(["sudo", "iptables", "-F", "OUTPUT"])
# allow all outgoing traffic
subprocess.call("sudo iptables -P OUTPUT ACCEPT", shell=True)
subprocess.call(["sudo", "iptables", "-F", "INPUT"])
subprocess.call(["sudo", "iptables", "-A", "INPUT", "-i", "lo", "-j", "ACCEPT"])
subprocess.call(["sudo", "iptables", "-A", "OUTPUT", "-o", "lo", "-j", "ACCEPT"])
subprocess.call("sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT", shell=True)
# best practice, stops spoofing
subprocess.call("sudo iptables -A INPUT -s 127.0.0.0/8 -j DROP", shell=True)
# drop anything else incoming
subprocess.call("sudo iptables -P INPUT DROP", shell=True)
return
def kill_openpyn_process() -> None:
try:
root.verify_root_access("Root access needed to kill openpyn process")
subprocess.call(["sudo", "killall", "openpyn"])
except subprocess.CalledProcessError:
# when Exception, the openvpn_processes issued non 0 result, "not found"
pass
return
def apply_fw_rules(interfaces_details, vpn_server_ip):
root.verify_root_access("Root access needed to modify 'iptables' rules")
# Empty the INPUT and OUTPUT chain of any current rules
subprocess.call(["sudo", "iptables", "-F", "OUTPUT"])
subprocess.call(["sudo", "iptables", "-F", "INPUT"])
# Allow all traffic out over the vpn tunnel
subprocess.call("sudo iptables -A OUTPUT -o tun+ -j ACCEPT", shell=True)
# accept traffic that comes through tun that you connect to
subprocess.call("sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -i tun+ -j ACCEPT", shell=True)
for interface in interfaces_details:
# if interface is active with an IP in it, don't send DNS requests to it
if len(interface) == 3 and "tun" not in interface[0]:
subprocess.call(
["sudo", "iptables", "-A", "OUTPUT", "-o", interface[0], "-p",
"udp", "--destination-port", "53", "-j", "DROP"])