Unverified Commit 86d30f2a authored by Kali Kaneko's avatar Kali Kaneko
Browse files

[feat] retry if dns lookup fails

parent 083f4095
// Copyright (C) 2018-2020 LEAP
// Copyright (C) 2018-2021 LEAP
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
......@@ -75,6 +75,17 @@ type geoLocation struct {
SortedGateways []geoGateway `json:"sortedGateways"`
}
func getAPIAddr(provider string) string {
switch provider {
case "riseup.net":
return "198.252.153.107"
case "calyx.net":
return "162.247.73.194"
default:
return ""
}
}
// New Bonafide: Initializes a Bonafide object. By default, no Credentials are passed.
func New() *Bonafide {
certs := x509.NewCertPool()
......@@ -179,6 +190,17 @@ func (b *Bonafide) GetPemCertificate() ([]byte, error) {
return ioutil.ReadAll(resp.Body)
}
func (b *Bonafide) GetPemCertificateNoDNS() ([]byte, error) {
req, err := http.NewRequest("POST", b.getURLNoDNS("certv3"), strings.NewReader(""))
resp, err := b.client.Do(req)
if err != nil {
return nil, err
}
defer resp.Body.Close()
return ioutil.ReadAll(resp.Body)
}
func (b *Bonafide) getURL(object string) string {
switch object {
case "cert":
......@@ -192,6 +214,23 @@ func (b *Bonafide) getURL(object string) string {
return ""
}
func (b *Bonafide) getURLNoDNS(object string) string {
p := strings.ToLower(config.Provider)
base := "https://" + getAPIAddr(p) + "/"
switch object {
case "cert":
return base + certPathv1
case "certv3":
return base + certPathv3
case "auth":
return base + authPathv3
case "eip":
return base + "3/config/eip-service.json"
}
log.Println("BUG: unknown url object")
return ""
}
func (b *Bonafide) maybeInitializeEIP() error {
if b.eip == nil {
err := b.fetchEipJSON()
......
......@@ -83,6 +83,13 @@ func (b *Bonafide) fetchEipJSON() error {
// TODO why exactly 1 retry? Make it configurable, for tests
time.Sleep(retryFetchJSONSeconds * time.Second)
resp, err = b.client.Post(eip3API, "", nil)
if err != nil {
// TODO it might be that it's not an error, but an empty file or whatever done
// by DNS poisoning. Should try to parse the file.
uri := b.getURLNoDNS("eip")
log.Println("Fetching ", uri)
resp, err = b.client.Post(uri, "", nil)
}
}
defer resp.Body.Close()
......
// Copyright (C) 2018-2020 LEAP
// Copyright (C) 2018-2021 LEAP
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
......@@ -177,6 +177,7 @@ func (b *Bitmask) startOpenVPN() error {
}
func (b *Bitmask) getCert() (certPath string, err error) {
failed := false
persistentCertFile := filepath.Join(config.Path, strings.ToLower(config.Provider)+".pem")
if _, err := os.Stat(persistentCertFile); !os.IsNotExist(err) && isValidCert(persistentCertFile) {
// reuse cert. for the moment we're not writing one there, this is
......@@ -191,9 +192,26 @@ func (b *Bitmask) getCert() (certPath string, err error) {
log.Println("Fetching certificate to", certPath)
cert, err := b.bonafide.GetPemCertificate()
if err != nil {
return "", err
log.Println(err)
failed = true
}
err = ioutil.WriteFile(certPath, cert, 0600)
if err != nil {
failed = true
}
}
}
if failed || !isValidCert(certPath) {
cert, err := b.bonafide.GetPemCertificateNoDNS()
if cert != nil {
log.Println("Successfully did certificate bypass")
err = nil
} else {
err = errors.New("Cannot get vpn certificate")
}
err = ioutil.WriteFile(certPath, cert, 0600)
if err != nil {
failed = true
}
}
return certPath, err
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment