protonvpn / protonvpn-nm-lib

Proton VPN NM Library

Copyright (c) 2021 Proton Technologies AG

This repository holds the Proton VPN NM Library. For licensing information see COPYING. For contribution policy see CONTRIBUTING.

Description

The Proton VPN NM (NetworkManager) Library is intended for every Proton VPN service user.

You can download the latest stable release, either from our official repositories or directly on the official GitHub repository.

Dependencies:

Distro	Command
Fedora/RHEL	sudo dnf install -y NetworkManager NetworkManager-openvpn NetworkManager-openvpn-gnome openvpn python3-pyxdg python3-keyring python3-jinja2 python3-distro python3-gobject libsecret-devel dbus-x11 gnome-keyring
Ubuntu/Linux Mint/Debian and derivatives	sudo apt install -y network-manager network-manager-openvpn openvpn python3-xdg python3-keyring python3-jinja2 python3-distro gir1.2-nm-1.0 libsecret-tools dbus-x11 gnome-keyring network-manager-openvpn-gnome
Arch Linux/Manjaro	sudo pacman -S networkmanager networkmanager-openvpn openvpn python-pyxdg python-keyring python-jinja python-distro dbus-x11 gnome-keyring

Additional dependency:

Proton Python Client

Virtual Environment Dependencies:

If you would like to run the the CLI from within a virtual environment (for either development purposes or other), then you can easily do that with the help of pipenv. Make sure to install pipenv and additional packages before.

Distro	Command
Fedora/RHEL	sudo dnf install pkgconf-pkg-config networkmanager networkmanager-openvpn openvpn cairo-devel cairo-gobject-devel libsecret-devel gobject-introspection-devel dbus-x11 gnome-keyring
Ubuntu/Linux Mint/Debian and derivatives	sudo apt install -y pkg-config network-manager network-manager-openvpn openvpn libcairo2-dev libgirepository1.0-dev gir1.2-nm-1.0 dbus-x11 libsecret-tools gnome-keyring
Arch Linux/Manjaro	sudo pacman -S pkgconf networkmanager networkmanager-openvpn openvpn cairo base-devel gobject-introspection pkgconf dbus-x11 libsecret gnome-keyring gtk3

Install inside virtual environment:

1. cd protonvpn-nm-core
2. pipenv install (installs virtual environment and all necessary dependencies from Pipfile).
3. pipenv shell (enter virtual environment).
4. pip install -e . (to install).

How to use:

Import

from protonvpn_nm_lib.api import protonvpn

Login

protonvpn.login("[email protected]", "ProtonPassword")

Logout

protonvpn.logout()

Connect

protonvpn.setup_connection(ConnectionTypeEnum.SERVERNAME, "PT#12", ProtocolEnum.TCP)
protonvpn.connect()

Disconnect

protonvpn.disconnect()

API	Description
protonvpn.login(username, password)	Login with your Proton credentials.
protonvpn.logout()	Logout user and delete current user session.
protonvpn.setup_connection(connection_type, connection_type_extra_arg, protocol)	Setup and configure VPN connection prior to calling protonvpn.connect().
protonvpn.setup_reconnect()	Setup and configure VPN connection to a previously connected server. Should be called before calling protonvpn.connect().
protonvpn.connect()	Should be used either after protonvpn.setup_connection() protonvpn.setup_reconnect().
protonvpn.disconnect()	Disconnect from Proton VPN.
protonvpn.check_session_exists()	Check if sessions exists.
protonvpn.get_connection_status()	Get active connection status.
protonvpn.get_settings()	Get user settings. This object can be used to get and set user settings.
protonvpn.get_session()	Get user session. This object can be used to get servers list, get keyring data and other.
protonvpn.get_country()	Get country.
protonvpn.get_connection_metadata()	Get metadata of an active Proton VPN connection.
protonvpn.get_non_active_protonvpn_connection()	Get non active Proton VPN connection.
protonvpn.get_active_protonvpn_connection()	Get active Proton VPN connection.
protonvpn.ensure_connectivity()	Ensure that there is an internet connection.

protonvpn-nm-lib's Issues

Can't run on a systemd-less distro

Trying to run it in Slackware-current gives me an error in which protonvpn-nm-lib wrapper won't find any compatible systemctl binary. Is systemd a requirement then?

Fedora Dependencies

NetworkManager-openvpn-gnome is shown as a dependency for Fedora on the readme, but it is not automatically installed when installing from the Proton VPN repository.

Missing None check

protonvpn-nm-lib/protonvpn_nm_lib/core/session/session.py

Lines 436 to 446 in 7289196

	if self.__vpn_data is None:
	try:
	self.__vpn_data = ExecutionEnvironment().keyring[
	KeyringEnum.DEFAULT_KEYRING_USERDATA.value
	]
	except KeyError:
	# We couldn't load it from the keyring,
	# but that's really not something exceptional.
	self.__vpn_data_fetch_from_api()
	return self.__vpn_data

The above value can still return None, it should be loaded in case that the keyring value is empty itself. an if check after line 440 like the following would suffice:

if self.__vpn_data is None:
    self.__vpn_data_fetch_from_api()

KillSwitch: user has no permission to perform this operation

This issue is caused by enabling the KillSwitch feature, and is related to NetworkManager. Originally reported in the linux-cli repo, but it belongs here since it's caused by this lib: ProtonVPN/linux-cli#4

Setting up ProtonVPN.
Connecting to ProtonVPN on [REDACTED] with UDP.
ERROR:dbus.connection:Exception in handler for D-Bus signal:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/dbus/connection.py", line 232, in maybe_handle_message
    self._handler(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/connection_backend/nm_client/monitor_vpn_connection_start.py", line 58, in on_vpn_state_changed
    env.killswitch.manage(KillSwitchActionEnum.SOFT)
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/killswitch/killswitch.py", line has no permission to perform this operation82, in manage
    actions_dict = {
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/killswitch/killswitch.py", line 280, in setup_soft_connection
    self.setup_post_connection_ks(None, activating_soft_connection=True)
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/killswitch/killswitch.py", line 221, in setup_post_connection_ks
    self.activate_connection(self.ks_conn_name)
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/killswitch/killswitch.py", line 404, in activate_connection
    conn_dict = self.nm_wrapper.search_for_connection( # noqa
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/dbus/dbus_network_manager_wrapper.py", line 56, in search_for_connection
    all_connection_properties = self.get_settings_from_connection(
  File "/usr/lib/python3/dist-packages/protonvpn_nm_lib/core/dbus/dbus_network_manager_wrapper.py", line 418, in get_settings_from_connection
    return iface.GetSettings()
  File "/usr/lib/python3/dist-packages/dbus/proxies.py", line 72, in __call__
    return self._proxy_method(*args, **keywords)
  File "/usr/lib/python3/dist-packages/dbus/proxies.py", line 141, in __call__
    return self._connection.call_blocking(self._named_service,
  File "/usr/lib/python3/dist-packages/dbus/connection.py", line 652, in call_blocking
    reply_message = self.send_message_with_reply_and_block(
dbus.exceptions.DBusException: org.freedesktop.NetworkManager.Settings.PermissionDenied: uid 1000 has no permission to perform this operation

This happens in Debian 11 for me, and according to the mentioned issue, it also occurs in Manjaron, Ubuntu 21.04 and OpenSuse.

It seems relates to Polkit rules, the lack of one specifically. The lib should check for permission, or try and catch the exception to exit and fail properly. It should ideally also provide some instructions on how to solve it: can we create a polkit rule? can we execute that action in a different way?

'proton.exceptions' module seems to be missing

The required/used module proton.exceptions does not seem to be part of codebase nor dependencies (run
pipenv install/pipenv install --dev successfully), so running simple examples (as e.g. the 'How to use' from README) fails.
I'd assume that proton.exceptions (respectively exceptions such as e.g. the required ConnectionTimeOutError) will still be in included in codebase, or, where can it be found?
Many thanks in advance for the advise!

Traceback (most recent call last):
  File "./test.py", line 6, in <module>
    protonvpn.login("[email protected]", "ProtonPassword")
  File "/home/ubuntu/github/proton/protonvpn-nm-lib/protonvpn_nm_lib/api.py", line 30, in login
    self._env.api_session.authenticate(username, password)
  File "/home/ubuntu/github/proton/protonvpn-nm-lib/protonvpn_nm_lib/core/session/session.py", line 21, in __call__
    from proton.exceptions import (ConnectionTimeOutError,
ModuleNotFoundError: No module named 'proton.exceptions'

ModuleNotFoundError: No module named 'proton.api'; 'proton' is not a package

from protonvpn_nm_lib.api import protonvpn


protonvpn.login("OjIf*************", "VeIW****************************")
"""
RU#1
RU#2
RU#5
RU#6
RU#13
RU#14
"""
protonvpn.setup_connection(ConnectionTypeEnum.SERVERNAME, "RU#5", ProtocolEnum.TCP)
protonvpn.connect()

info = protonvpn.get_country()
print(info)
protonvpn.disconnect()

protonvpn.logout()

---

root@debian:/home/anar/pythonscripts# python3 proton.py
Traceback (most recent call last):
File "proton.py", line 4, in
protonvpn.login("OjIf*************", "VeIW****************************")
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/api.py", line 31, in login
self._env.api_session.authenticate(username, password, human_verification)
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/core/environment.py", line 56, in api_session
self.__api_session = APISession()
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/core/session/session.py", line 211, in init
self.__session_create()
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/core/session/session.py", line 231, in __session_create
from proton.api import Session
File "/home/anar/pythonscripts/proton.py", line 4, in
protonvpn.login("OjIf*************", "VeIW****************************")
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/api.py", line 31, in login
self._env.api_session.authenticate(username, password, human_verification)
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/core/environment.py", line 56, in api_session
self.__api_session = APISession()
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/core/session/session.py", line 211, in init
self.__session_create()
File "/usr/local/lib/python3.7/dist-packages/protonvpn_nm_lib-3.8.0-py3.7.egg/protonvpn_nm_lib/core/session/session.py", line 231, in __session_create
from proton.api import Session
ModuleNotFoundError: No module named 'proton.api'; 'proton' is not a package

Building without systemd as dependency.

I'm packaging protonvpn-nm-lib for GNU Guix. We don't have systemd package. Is there a way (flag, patch, etc,.) to build without systemd-python as dependency?

May be make seatd an alternative option?

PyPI release is missing

Is there a plan to release this package in PyPI?

Would be nice to have as this package is described as a dependency in setup.py for the GUI linux client.

Fedora system update fails due to invalid certificate : certificate is not alive | key is not alive

• I have searched open and closed issues for duplicates
• This isn't a feature request
• This is not a report about my app not working as expected

---

Error log:

error: Verifying a signature using certificate A88441BD4864F95BEE08E63A71EB474019940E11 (Proton Technologies AG <[email protected]>):
  1. Certificiate 71EB474019940E11 invalid: certificate is not alive
      because: The primary key is not live
      because: Expired on 2022-10-28T13:52:11Z
  2. Key 71EB474019940E11 invalid: key is not alive
      because: The primary key is not live
      because: Expired on 2022-10-28T13:52:11Z
ProtonVPN Fedora Stable repository                                                                  2.8 kB/s | 4.7 kB     00:01    
GPG key at https://repo.protonvpn.com/fedora-38-stable/public_key.asc (0x645F044F) is already installed
GPG key at https://repo.protonvpn.com/fedora-38-stable/public_key.asc (0x19940E11) is already installed
The GPG keys listed for the "ProtonVPN Fedora Stable repository" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: python3-protonvpn-nm-lib-3.16.0-1.fc38.noarch
 GPG Keys are configured as: https://repo.protonvpn.com/fedora-38-stable/public_key.asc
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Trying to upgrade the package with --nogpgcheck also fails:

sudo dnf upgrade --nogpgcheck python3-protonvpn-nm-lib
Last metadata expiration check: 0:26:37 ago on Thu 03 Aug 2023 08:47:49.
Dependencies resolved.
====================================================================================================================================
 Package                               Architecture        Version                       Repository                            Size
====================================================================================================================================
Upgrading:
 python3-protonvpn-nm-lib              noarch              3.16.0-1.fc38                 protonvpn-fedora-stable              222 k

Transaction Summary
====================================================================================================================================
Upgrade  1 Package

Total size: 222 k
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] python3-protonvpn-nm-lib-3.16.0-1.fc38.noarch.rpm: Already downloaded                                                    
Running transaction check
error: Verifying a signature using certificate A88441BD4864F95BEE08E63A71EB474019940E11 (Proton Technologies AG <[email protected]>):
  1. Certificiate 71EB474019940E11 invalid: certificate is not alive
      because: The primary key is not live
      because: Expired on 2022-10-28T13:52:11Z
  2. Key 71EB474019940E11 invalid: key is not alive
      because: The primary key is not live
      because: Expired on 2022-10-28T13:52:11Z
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: Transaction test error:
  package python3-protonvpn-nm-lib-3.16.0-1.fc38.noarch does not verify: Header V4 RSA/SHA256 Signature, key ID 19940e11: NOTTRUSTED

OS: Fedora 38