Repository navigation
Conversation
|
Sorry @mbnunes, your pull request is larger than the review limit of 150,000 diff characters |
| os.chmod(target_dir, 0o700) | ||
| except OSError: | ||
| pass | ||
| if old_profile_id and old_profile_id != profile_id: |
There was a problem hiding this comment.
original_profile_id is set from the imported file's stem (or New_IPsec_VPN) even when no saved profile has that ID. Importing office.sswan named "Office VPN" while office.conf exists deletes office.conf on save. When the names match, _confirm_overwrite_if_exists treats it as an edit and overwrites without asking. Saving two new profiles in a row does the same. original_profile_id should only be set when editing an existing saved profile.
Also, on rename only the networkmgr .conf is removed. The old ipsec.d/nm-<old>.conf and .secrets (holding the PSK or password) stay included by StrongSwan, and a running nm-<old> SA is never brought down.
| pass | ||
|
|
||
| # Fallback: check pgrep for an openvpn process using this config | ||
| result = run( |
There was a problem hiding this comment.
This pattern isn't anchored, so profile work matches homework.conf. While homework runs, work shows Connected, enable_openvpn('work') returns success without starting anything, and disable_openvpn('work') kills the homework tunnel. Please anchor on a path separator, e.g. /{re.escape(profile_id)}\.(conf|ovpn)( |$), or track the PID file.
| os.makedirs(cert_dir, exist_ok=True) | ||
| os.chmod(cert_dir, 0o700) | ||
| auth_file = os.path.join(cert_dir, 'auth.txt') | ||
| _write_secure_file(auth_file, f'{username}\n{password}', 0o600) |
There was a problem hiding this comment.
A password typed at the connect prompt is written into the same auth.txt the saved config points to. After one connect, both values are on disk, the prompt never appears again and the editor shows the password. A prompted password should go to a temporary file that is removed after OpenVPN reads it, or be passed through the management interface.
| elif cfg.get('key_path'): | ||
| key_file = _copy_or_keep_cert(cfg['key_path'], cert_dir, 'client.key', 0o600) | ||
|
|
||
| pkcs12_file = '' |
There was a problem hiding this comment.
pkcs12_inline from the parser is never handled here, only pkcs12_path. An imported .ovpn with an inline <pkcs12> block is saved without a client certificate and fails to connect.
| if _is_safe_extra_line(extra): | ||
| lines.append(_clean_ovpn_val(extra)) | ||
|
|
||
| conf_file = os.path.join(OPENVPN_CONFIG_PATH, f'{profile_id}.conf') |
There was a problem hiding this comment.
The save always writes <id>.conf. Editing an existing foo.ovpn creates foo.conf next to it. openvpn_dictionary then shows the .ovpn (it sorts last and overwrites the key), so the editor reopens the old content while enable_openvpn starts the .conf. Please remove the other extension, or keep the original file name.
| cfg['pre_down'] = val | ||
| elif is_internal_profile and key == 'postdown': | ||
| cfg['post_down'] = val | ||
| elif section == 'peer': |
There was a problem hiding this comment.
All [Peer] sections are merged into one: the last PublicKey, Endpoint and PSK win and every AllowedIPs is concatenated. Saving a multi-peer config drops all but one peer and gives it every peer's AllowedIPs. Either keep a list of peers, or refuse to edit multi-peer configs in the GUI.
| configure_item.connect("activate", self.configuration_window_open, netcard) | ||
| self.menu.append(configure_item) | ||
| wired_label = _("Wired %s (%s)") % (cardnum, netcard) | ||
| if connection_state in ("Connected", "Disabled", "Disconnected"): |
There was a problem hiding this comment.
A wired card in the "Disconnected" state (up, no link or address) now gets Connect (enable_card) instead of the previous Disable, so you can no longer bring that interface down from the tray.
| if btn2 is not None: | ||
| btn2.connect("clicked", lambda _b: _invoke(on_configure)) | ||
|
|
||
| def _on_button_release(_item, event): |
There was a problem hiding this comment.
Any click on the row, including the name, runs the toggle. One mis-click on a connected wired row stops networking. Could the toggle be limited to the button?
| {'network': r[0], 'prefixlen': r[1], 'gateway': r[2]} | ||
| for r in self.nic_r6_store | ||
| ] | ||
| save_interface_routes(nic, r4_list, r6_list) |
There was a problem hiding this comment.
Routes are saved to routes/<nic>.routes and applied only here. Nothing applies them again at boot or on interface restart, so they're lost after a reboot. A route removed from the list is also never deleted from the live routing table.
|
|
||
| auth_lines = [] | ||
| if cfg.get('ppp_mschapv2', True): | ||
| auth_lines.append(' set link accept mschapv2') |
There was a problem hiding this comment.
mschapv2 isn't a valid mpd5 set link accept option (valid: pap, chap-md5, chap-msv1, chap-msv2, eap). Line 799 already adds chap-msv2, so this line can map to chap-msv2 or be dropped.
github-project-automation
Bot
moved this from To triage
to In review
in NetworkMGR Issue Traker
Summary
This PR introduces full OpenVPN (
.ovpn/.conf) and WireGuard (.conf) configuration import and management tonetworkmgr(modeled after Linux'sNetworkManager-openvpn), alongside a redesigned compact single-row Tray Menu UI and non-blocking desktop popup notifications when connecting or disconnecting networks.Key Features & Changes
1. OpenVPN & WireGuard Configuration Importer and Editor
NetworkMgr/openvpn_api.py):.ovpnand.confprofiles (parse_openvpn_config,save_openvpn_config,delete_openvpn_config,openvpn_dictionary,enable_openvpn,disable_openvpn).detect_vpn_file_type).<ca>,<cert>,<key>,<pkcs12>,<tls-auth>,<tls-crypt>,<tls-crypt-v2>,<secret>,<extra-certs>,<http-proxy-user-pass>) and<connection>blocks, storing certificates and keys safely with0600permissions under/usr/local/etc/openvpn/certs/<profile_id>/.tls,password,tls-password,static-key) and prompts for credentials viaOpenVPNAuthDialogwhen needed.ifconfig,route-gateway), Manual/Static IPv6 (ifconfig-ipv6,pull-filter ignore), and custom Static Routes (IPv4 & IPv6) (route,route-ipv6).# networkmgr-name:) and handles profile renaming cleanly whenimporting or editing a profile.
security/openvpnis installed (is_openvpn_installed) and shows a clear warning dialog(
show_openvpn_not_installed_alert) instead of raisingFileNotFoundErrorwhen/usr/local/sbin/openvpnis missing.NetworkMgr/wg_api.py):parse_wireguard_config,save_wireguard_config,delete_wireguard_config, anddefault_wireguard_configtoimport, create, edit, and remove WireGuard profiles in
/usr/local/etc/wireguard/.wgandwg-quicksubprocess calls against missing binaries (OSError/FileNotFoundError).NetworkMgr/vpn_dialog.py):import_vpn_file_dialogandVPNConnectionDialogwith 6 tabs for OpenVPN (VPN, IPv4 Settings, IPv6Settings, Advanced, Security & TLS, Proxies) plus WireGuard profile editing.
NetworkMgr/configuration.py):NetCardConfigWindowallowing users to view, Import VPN..., create New OpenVPN,Edit, Connect / Disconnect, and Delete VPN profiles directly from the configuration window.
2. Compact Single-Row Tray Menu UI/UX (
NetworkMgr/trayicon.py)<Name> Connected+Disable <Name>+Configure <Name>) into aclean, single-row layout for OpenVPN, WireGuard, and Ethernet (Wired) connections:
● <Connection Name> [Connect / Red X Disconnect] [⚙ Configure]GdkPixbuf.PixbufLoader:✕icon when connected.⚙) icon to open the profile or interface configuration window.3. Desktop Popup Toast Notifications (
NetworkMgr/vpn_dialog.py,NetworkMgr/trayicon.py,NetworkMgr/configuration.py)show_connection_notification(name, connected)using a non-blocking GTK3Gdk.WindowTypeHint.NOTIFICATIONpopup toastin the top-right corner of the primary monitor:
[✓] <Connection Name> Connected(green checkmark icon)[✕] <Connection Name> Disconnected(red X icon)notification daemons, never steals keyboard focus, and auto-dismisses after 3 seconds (or on click).
Files Changed
NetworkMgr/openvpn_api.py: OpenVPN configuration parser, exporter, certificate manager, anddaemon lifecycle management.
NetworkMgr/vpn_dialog.py: VPN file importer, tabbed VPN connection editor, authenticationdialog, and toast notification popup.
NetworkMgr/wg_api.py: WireGuard configuration parser, saver, and deleter.NetworkMgr/configuration.py: Added the VPN Settings tab and integrated VPN management andnotifications.
NetworkMgr/trayicon.py: Single-row connection items for OpenVPN, WireGuard, and Wired interfaces,VPN import entry, and connection notifications.
Testing
.ovpnand WireGuard.confprofiles (with both external and inline<ca>,<cert>,<key>,<tls-auth>,<tls-crypt>blocks) and verified generated configurations in/usr/local/etc/openvpn/and/usr/local/etc/wireguard/.openvpnis not yet installed.