vopono_core 0.1.2

Library code for running VPN connections in network namespaces
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

mod wireguard;

use super::{Provider, WireguardProvider};
use crate::config::vpn::Protocol;
use crate::util::get_username;
use anyhow::anyhow;
use log::{info, warn};
use reqwest::blocking::Client;
use serde::Deserialize;

#[derive(Deserialize, Debug)]
struct LoginURLs {
    login_url: String,
    verification_url: String,
    poll_interval: u64,
}

#[derive(Deserialize, Debug)]
struct User {
    devices: Vec<Device>,
}

#[derive(Deserialize, Debug)]
struct Login {
    user: User,
    token: String,
}

#[derive(Deserialize, Debug, Clone)]
struct Device {
    name: String,
    pubkey: String,
    ipv4_address: ipnet::Ipv4Net,
    ipv6_address: ipnet::Ipv6Net,
}

#[allow(dead_code)]
#[derive(Deserialize, Debug)]
struct Error {
    errno: u32,
    error: String,
}

impl std::fmt::Display for Device {
    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
        write!(f, "{}: {}", self.name, self.pubkey,)
    }
}

/// MozillaVPN is a wrapper for Wireguard using OAuth authentication with Mozilla services
/// Supports Wireguard only
pub struct MozillaVPN {}

impl Provider for MozillaVPN {
    fn alias(&self) -> String {
        "mozilla".to_string()
    }
    fn default_protocol(&self) -> Protocol {
        Protocol::Wireguard
    }
}

impl MozillaVPN {
    fn base_url(&self) -> &'static str {
        "https://vpn.mozilla.org/api/v1"
    }

    // TODO: Make this work with GUI - i.e. if terminal is not accessible
    /// Login with OAuth login (adapted from MozWire crate: https://github.com/NilsIrl/MozWire/blob/trunk/src/main.rs )
    fn get_login(&self, client: &Client) -> anyhow::Result<Login> {
        let login = client
            .post(&format!("{}/vpn/login", self.base_url()))
            .send()
            .unwrap()
            .json::<LoginURLs>()
            .unwrap();
        info!(
            "MozillaVPN requires an OAuth login to get the authentication token. Please visit: {}.",
            login.login_url
        );
        // Set directory permissions before dropping out of sudo so we can launch browser
        crate::util::set_config_permissions()?;
        let nixuser = nix::unistd::User::from_name(&get_username()?)?.expect("Failed to get user");

        nix::unistd::setgid(nixuser.gid)?;
        nix::unistd::setuid(nixuser.uid)?;

        // Need to drop out of sudo to launch browser: https://github.com/amodm/webbrowser-rs/issues/30
        match webbrowser::open(&login.login_url) {
            Ok(_) => info!("Link opened in browser: {}", &login.login_url),
            Err(_) => warn!(
                "Failed to open link in browser, please visit it manually: {}",
                &login.login_url
            ),
        }

        let poll_interval = std::time::Duration::from_secs(login.poll_interval);
        loop {
            let response = client.get(&login.verification_url).send().unwrap();
            if response.status() == reqwest::StatusCode::OK {
                info!("Mozilla Login successful");
                break Ok(response.json::<Login>().unwrap());
            } else {
                match response.json::<Error>().unwrap() {
                    // errno 126 is pending verification
                    Error { errno: 126, .. } => {}
                    error => break Err(anyhow!("Login failed: {:?}", error)),
                }
            }
            std::thread::sleep(poll_interval);
        }
    }
}

fn validate_hostname(hostname: &str) -> bool {
    hostname
        .chars()
        .all(|c| c.is_ascii_alphanumeric() || c == '-')
}