Improved Firewall Checks on Disable to double check and properly source the config

core/controllers/ProfileController.py

@@ -1,7 +1,8 @@
 from core.services.networking.systemwide.systemwide_wireguard import terminate_system_connection
 from core.services.networking.general_connection_tools.testing_evaluating import system_uses_wireguard_interface
 from core.services.networking.general_connection_tools.connection_enable import establish_connection
-# from core.services.networking.systemwide.systemwide_utils import get_firewall_setting, get_dns_setting
+from core.services.networking.systemwide.systemwide_utils import get_firewall_setting, get_dns_setting
+from core.services.networking.systemwide import killswitch
 from core.errors.exceptions import FirewallError
 
 from core.Errors import InvalidSubscriptionError, MissingSubscriptionError, ConnectionTerminationError, ProfileActivationError, ProfileDeactivationError, MissingLocationError, ConnectionUnprotectedError, EndpointVerificationError, ProfileStateConflictError
@@ -145,7 +146,16 @@ class ProfileController:
                     raise ProfileDeactivationError('The profile could not be disabled.')
 
                 try:
-                    terminate_system_connection()
+                    # ================= SETTINGS =================
+                    firewall_setting = get_firewall_setting()
+                    dns_setting = get_dns_setting()
+                    # ======= KILL SYSTEMWIDE =============                    
+                    terminate_system_connection(
+                        firewall_setting=firewall_setting,
+                        dns_setting=dns_setting
+                    )
+                    # ================= UPDATE UI ================
+                    # if it made it this far, it worked in theory.
                     if profile_observer is not None:
                         profile_observer.notify('disabled', profile, dict(
                             explicitly=explicitly,

core/services/networking/systemwide/systemwide_wireguard.py

@@ -29,16 +29,23 @@ import subprocess
 import time
 
 def terminate_system_connection(
-    firewall_setting: Optional[bool] = get_firewall_setting(),
-    dns_setting: Optional[bool] = get_dns_setting()
+    firewall_setting: Optional[bool] = None,
+    dns_setting: Optional[bool] = None
 ):
 
+    # ====== PREREQS =======
+    if firewall_setting is None:
+        firewall_setting = get_firewall_setting()
+
+    if dns_setting is None:
+        dns_setting = get_dns_setting()
+
     if shutil.which('nmcli') is None:
         raise CommandNotFoundError('nmcli')
 
     # ====== FIREWALL =======
     if firewall_setting:
-        check_and_kill_firewall() # on failure, this raises errors, which then bubble up
+        disable_result_object = killswitch.disarm() # raw blind kill
 
     # ====== DNS =======
     if dns_setting:
@@ -54,9 +61,9 @@ def terminate_system_connection(
             subprocess.run(('nmcli', 'connection', 'delete', 'hv-ipv6-sink'), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
             terminate_tor_connection()
 
-            # confirm check on dns:
-            # did_dns_revert = confirm_dns_is_reverted('wg')
-            # print(f"did_dns_revert is {did_dns_revert}")
+            # confirm firewall is off.
+            if firewall_setting:
+                check_and_kill_firewall() # on failure, this raises errors, which then bubble up
 
             # finally end that profile's JSON state:
             SystemState.dissolve()

core/services/networking/systemwide/wireguard/wg_firewall_dns.py

@@ -80,7 +80,8 @@ def check_and_kill_firewall():
             logger.error(error_msg)
 
             # if the systemwide_raiser didn't catch it with the reason, then..
-            raise ConnectionTerminationError(error_msg)
+            raise FirewallError(disable_result_object)
+
     else:
         logger.info("We are skipping disabling the firewall, because it's already off.")