cfn-vpn 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e3b6334f24037b79137a09d3d93325a2513162f4e151b1e565875e74352aac7
-  data.tar.gz: d0e7e304876a4bcccab2b082fc8c298f8fc74b0769b4eb9338fdc98b5d5842a1
+  metadata.gz: 14100a22fc434fa08bc329c9b37b3fd8c72a8b03825c0ae2ebbb8b008229711b
+  data.tar.gz: 72a211b53647c788bc149bca7c5c30d1f7ad6939f7c26573da4d483068fe2008
 SHA512:
-  metadata.gz: c75ae0f97eb239c6db309b98d09d5b08a688bde621aa5f23b091face28fab3737369d67d6d40c9f13e7615ba8f58c4ee3553fe24a55715ac0282f889b72946fd
-  data.tar.gz: d543e66f8ce62534e64de754d09be061c4a92b50bff6d8ddfbd0f8df03a48f830217c501024986e8810e4f2a300fa503a9631efb7ad0cb4a22c6c47019456df6
+  metadata.gz: 23f99dfeda3e9508f75b3fd8af5aa2a16f9062d96ba4a6a1c12b8cde8517c42c9a76e8b99e20c790972529870c588ef9c966b23d30b7f587697c2315355eabe2
+  data.tar.gz: 86b27e631221e973769d2b61f98637a90e63b4c9fd4a463a540b0ee843c412bd66f3953fdb52cf96d488b4cf2c4ec60478936d978e606e1dd23413c3cc0a8f90

data/lib/cfnvpn.rb

@@ -1,6 +1,7 @@
 require 'thor'
 require 'cfnvpn/version'
 require 'cfnvpn/init'
+require 'cfnvpn/modify'
 require 'cfnvpn/config'
 
 module CfnVpn
@@ -13,10 +14,13 @@ module CfnVpn
     end
 
     # Initializes ciinabox configuration
-    register CfnVpn::Init, 'init', 'init [name]', 'Ciinabox configuration initialization'
+    register CfnVpn::Init, 'init', 'init [name]', 'Create a AWS Client VPN'
     tasks["init"].options = CfnVpn::Init.class_options
 
-    register CfnVpn::Config, 'config', 'config [name]', 'Ciinabox configuration initialization'
+    register CfnVpn::Modify, 'modify', 'modify [name]', 'Modify your AWS Client VPN'
+    tasks["modify"].options = CfnVpn::Modify.class_options
+
+    register CfnVpn::Config, 'config', 'config [name]', 'Retrieve the config for the AWS Client VPN'
     tasks["config"].options = CfnVpn::Config.class_options
 
   end

data/lib/cfnvpn/cloudformation.rb

@@ -29,14 +29,29 @@ module CfnVpn
       return does_cf_stack_exist() ? 'UPDATE' : 'CREATE'
     end
 
-    def create_change_set(template_path)
-      change_set_name = "#{@stack_name}-#{CfnVpn::CHANGE_SET_VERSION}"
+    def create_change_set(template_path,parameters)
+      change_set_name = "#{@stack_name}-#{CfnVpn::CHANGE_SET_VERSION}-#{Time.now.utc.strftime("%Y%m%d%H%M%S")}"
       change_set_type = get_change_set_type()
+
+      if change_set_type == 'CREATE'
+        params = get_parameters_from_template(template_path)
+      else
+        params = get_parameters_from_stack()
+      end
+
+      params.each do |param|
+        if !parameters[param[:parameter_key]].nil?
+          param['parameter_value'] = parameters[param[:parameter_key]]
+          param['use_previous_value'] = false
+        end
+      end
+
       template_body = File.read(template_path)
       Log.logger.debug "Creating changeset"
       change_set = @client.create_change_set({
         stack_name: @stack_name,
         template_body: template_body,
+        parameters: params,
         tags: [
           {
             key: "cfnvpn:version",
@@ -55,7 +70,19 @@ module CfnVpn
 
     def wait_for_changeset(change_set_id)
       Log.logger.debug "Waiting for changeset to be created"
-      @client.wait_until :change_set_create_complete, change_set_name: change_set_id
+      begin
+        @client.wait_until :change_set_create_complete, change_set_name: change_set_id
+      rescue Aws::Waiters::Errors::FailureStateError => e
+        change_set = get_change_set(change_set_id)
+        Log.logger.error("change set status: #{change_set.status} reason: #{change_set.status_reason}")
+        exit 1
+      end
+    end
+
+    def get_change_set(change_set_id)
+      @client.describe_change_set({
+        change_set_name: change_set_id,
+      })
     end
 
     def execute_change_set(change_set_id)
@@ -71,5 +98,16 @@ module CfnVpn
       resp = @client.wait_until waiter, stack_name: @stack_name
     end
 
+    def get_parameters_from_stack()
+      resp = @client.get_template_summary({ stack_name: @stack_name })
+      return resp.parameters.collect { |p| { parameter_key: p.parameter_key, use_previous_value: true }  }
+    end
+
+    def get_parameters_from_template(template_path)
+      template_body = File.read(template_path)
+      resp = @client.get_template_summary({ template_body: template_body })
+      return resp.parameters.collect { |p| { parameter_key: p.parameter_key, parameter_value: p.default_value }  }
+    end
+
   end
 end

data/lib/cfnvpn/config.rb

@@ -11,9 +11,11 @@ module CfnVpn
 
     class_option :profile, desc: 'AWS Profile'
     class_option :region, default: ENV['AWS_REGION'], desc: 'AWS Region'
-    class_option :force, default: false, type: :boolean, desc: 'AWS Region'
     class_option :verbose, desc: 'set log level to debug', type: :boolean
 
+    class_option :key_path, required: true, desc: 'full file path to the client vpn key'
+    class_option :crt_path, required: true, desc: 'full file path to the client vpn certificate'
+
     def self.source_root
       File.dirname(__FILE__)
     end
@@ -36,35 +38,11 @@ module CfnVpn
       @config = vpn.get_config(@endpoint_id)
     end
 
-    def download_certificate
-      ssm = CfnVpn::SSM.new(@name,@options['region'],@home_dir)
-      cert_body = ssm.get_parameter("#{@name}.crt")
-      if cert_body
-        cert = CfnVpn::Certificates.new(@home_dir,@name)
-        cert.write_certificate(cert_body,"#{@name}.crt",@options['force'])
-        Log.logger.info "downloaded client certificate #{@name}.crt"
-      else
-        Log.logger.error "unable to find client certificate #{@name}.crt"
-      end
-    end
-
-    def download_key
-      ssm = CfnVpn::SSM.new(@name,@options['region'],@home_dir)
-      cert_body = ssm.get_parameter("#{@name}.key")
-      if cert_body
-        cert = CfnVpn::Certificates.new(@home_dir,@name)
-        cert.write_certificate(cert_body,"#{@name}.key",@options['force'])
-        Log.logger.info "downloaded client key #{@name}.key"
-      else
-        Log.logger.error "unable to find client certificate #{@name}.crt"
-      end
-    end
-
     def alter_config
       string = (0...8).map { (65 + rand(26)).chr.downcase }.join
       @config.sub!(@endpoint_id, "#{string}.#{@endpoint_id}")
-      @config.concat("\n\ncert #{@config_dir}/#{@name}.crt")
-      @config.concat("\nkey #{@config_dir}/#{@name}.key\n")
+      @config.concat("\n\ncert #{@options['crt_path']}")
+      @config.concat("\nkey #{@options['key_path']}\n")
     end
 
     def write_config

data/lib/cfnvpn/init.rb

@@ -23,6 +23,7 @@ module CfnVpn
 
     class_option :subnet_id, required: true, desc: 'subnet id to associate your vpn with'
     class_option :cidr, default: '10.250.0.0/16', desc: 'cidr from which to assign client IP addresses'
+    class_option :dns_servers, desc: 'DNS Servers to push to clients.'
 
     def self.source_root
       File.dirname(__FILE__)
@@ -40,8 +41,12 @@ module CfnVpn
 
     def initialize_config
       @config = {}
-      @config['subnet_id'] = @options['subnet_id']
-      @config['cidr'] = @options['cidr']
+      @config['parameters'] = {}
+      @config['parameters']['EnvironmentName'] = @name
+      @config['parameters']['AssociationSubnetId'] = @options['subnet_id']
+      @config['parameters']['ClientCidrBlock'] = @options['cidr']
+      @config['parameters']['DnsServers'] = @options['dns_servers']
+      @config['template_version'] = '0.1.1'
     end
 
     def stack_exist
@@ -62,21 +67,19 @@ module CfnVpn
 
     def upload_certificates
       cert = CfnVpn::Certificates.new(@build_dir,@name)
-      @config['server_cert_arn'] = cert.upload_certificates(@options['region'],'server','server',@options['server_cn'])
-      @config['client_cert_arn'] = cert.upload_certificates(@options['region'],@client_cn,'client')
-      cert.store_certificate(@options['region'],"#{@client_cn}.crt")
-      cert.store_certificate(@options['region'],"#{@client_cn}.key")
+      @config['parameters']['ServerCertificateArn'] = cert.upload_certificates(@options['region'],'server','server',@options['server_cn'])
+      @config['parameters']['ClientCertificateArn'] = cert.upload_certificates(@options['region'],@client_cn,'client')
     end
 
     def deploy_vpn
-      template('templates/cfnvpn.cfhighlander.rb.tt', "#{@build_dir}/#{@name}.cfhighlander.rb", @config)
+      template('templates/cfnvpn.cfhighlander.rb.tt', "#{@build_dir}/#{@name}.cfhighlander.rb", @config, force: true)
       Log.logger.debug "Generating cloudformation from #{@build_dir}/#{@name}.cfhighlander.rb"
       cfhl = CfnVpn::CfHiglander.new(@options['region'],@name,@config,@build_dir)
       template_path = cfhl.render()
       Log.logger.debug "Cloudformation template #{template_path} generated and validated"
       Log.logger.info "Launching cloudformation stack #{@name}-cfnvpn in #{@options['region']}"
       cfn = CfnVpn::Cloudformation.new(@options['region'],@name)
-      change_set, change_set_type = cfn.create_change_set(template_path)
+      change_set, change_set_type = cfn.create_change_set(template_path, @config['parameters'])
       cfn.wait_for_changeset(change_set.id)
       cfn.execute_change_set(change_set.id)
       cfn.wait_for_execute(change_set_type)

data/lib/cfnvpn/modify.rb

@@ -0,0 +1,95 @@
+require 'thor'
+require 'fileutils'
+require 'cfnvpn/cloudformation'
+require 'cfnvpn/certificates'
+require 'cfnvpn/cfhighlander'
+require 'cfnvpn/cloudformation'
+require 'cfnvpn/log'
+require 'cfnvpn/clientvpn'
+
+module CfnVpn
+  class Modify < Thor::Group
+    include Thor::Actions
+    include CfnVpn::Log
+
+    argument :name
+
+    class_option :profile, aliases: :p, desc: 'AWS Profile'
+    class_option :region, aliases: :r, default: ENV['AWS_REGION'], desc: 'AWS Region'
+    class_option :verbose, desc: 'set log level to debug', type: :boolean
+
+    class_option :subnet_id, desc: 'subnet id to associate your vpn with'
+    class_option :cidr, desc: 'cidr from which to assign client IP addresses'
+    class_option :dns_servers, desc: 'DNS Servers to push to clients.'
+
+    def self.source_root
+      File.dirname(__FILE__)
+    end
+
+    def set_loglevel
+      Log.logger.level = Logger::DEBUG if @options['verbose']
+    end
+
+    def create_build_directory
+      @build_dir = "#{ENV['HOME']}/.cfnvpn/#{@name}"
+      Log.logger.debug "creating directory #{@build_dir}"
+      FileUtils.mkdir_p(@build_dir)
+    end
+
+    def initialize_config
+      @config = {}
+      @config['parameters'] = {}
+      @config['parameters']['AssociationSubnetId'] = @options['subnet_id']
+      @config['parameters']['ClientCidrBlock'] = @options['cidr']
+      @config['parameters']['DnsServers'] = @options['dns_servers']
+      @config['template_version'] = '0.1.1'
+    end
+
+    def stack_exist
+      @cfn = CfnVpn::Cloudformation.new(@options['region'],@name)
+      if !@cfn.does_cf_stack_exist()
+        Log.logger.error "#{@name}-cfnvpn stack doesn't exists in this account in region #{@options['region']}\n Try running `cfn-vpn init #{@name}` to setup the stack"
+        exit 1
+      end
+    end
+
+    def deploy_vpn
+      template('templates/cfnvpn.cfhighlander.rb.tt', "#{@build_dir}/#{@name}.cfhighlander.rb", @config, force: true)
+      Log.logger.debug "Generating cloudformation from #{@build_dir}/#{@name}.cfhighlander.rb"
+      cfhl = CfnVpn::CfHiglander.new(@options['region'],@name,@config,@build_dir)
+      template_path = cfhl.render()
+      Log.logger.debug "Cloudformation template #{template_path} generated and validated"
+
+      Log.logger.info "Modifying cloudformation stack #{@name}-cfnvpn in #{@options['region']}"
+      cfn = CfnVpn::Cloudformation.new(@options['region'],@name)
+      change_set, change_set_type = cfn.create_change_set(template_path,@config['parameters'])
+      cfn.wait_for_changeset(change_set.id)
+      changes = cfn.get_change_set(change_set.id)
+
+      Log.logger.warn("The following changes to the cfnvpn stack will be made")
+      changes.changes.each do |change|
+        Log.logger.warn("ID: #{change.resource_change.logical_resource_id} Action: #{change.resource_change.action}")
+        change.resource_change.details.each do |details|
+          Log.logger.warn("Name: #{details.target.name} Attribute: #{details.target.attribute} Cause: #{details.causing_entity}")
+        end
+      end
+
+      continue = yes? "Continue?", :green
+      if !continue
+        Log.logger.error("Cancelled cfn-vpn modifiy #{@name}")
+        exit 1
+      end
+
+      cfn.execute_change_set(change_set.id)
+      cfn.wait_for_execute(change_set_type)
+      Log.logger.debug "Changeset #{change_set_type} complete"
+    end
+
+    def finish
+      vpn = CfnVpn::ClientVpn.new(@name,@options['region'])
+      @endpoint_id = vpn.get_endpoint_id()
+      Log.logger.info "Client VPN #{@endpoint_id} modified."
+    end
+
+  end
+end

data/lib/cfnvpn/templates/cfnvpn.cfhighlander.rb.tt

@@ -1,14 +1,21 @@
 CfhighlanderTemplate do
 
   Parameters do
-    ComponentParam 'EnvironmentName', '<%= @name %>'
+    ComponentParam 'EnvironmentName'
+    ComponentParam 'AssociationSubnetId'
+    ComponentParam 'ClientCidrBlock'
+    ComponentParam 'ClientCertificateArn'
+    ComponentParam 'ServerCertificateArn'
+    ComponentParam 'DnsServers'
   end
 
-  Component template: 'client-vpn', name: 'vpn', render: Inline do
-    parameter name: 'AssociationSubnetId', value: '<%= @config['subnet_id'] %>'
-    parameter name: 'ClientCidrBlock', value: '<%= @config['cidr'] %>'
-    parameter name: 'ClientCertificateArn', value: '<%= @config['client_cert_arn'] %>'
-    parameter name: 'ServerCertificateArn', value: '<%= @config['server_cert_arn'] %>'
+  Component template: 'client-vpn@<%= @config['template_version'] %>', name: 'vpn', render: Inline do
+    parameter name: 'EnvironmentName', value: Ref('EnvironmentName')
+    parameter name: 'AssociationSubnetId', value: Ref('AssociationSubnetId')
+    parameter name: 'ClientCidrBlock', value: Ref('ClientCidrBlock')
+    parameter name: 'ClientCertificateArn', value: Ref('ClientCertificateArn')
+    parameter name: 'ServerCertificateArn', value: Ref('ServerCertificateArn')
+    parameter name: 'DnsServers', value: Ref('DnsServers')
   end
 
 end

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "0.1.0".freeze
+  VERSION = "0.2.0".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-06-21 00:00:00.000000000 Z
+date: 2019-06-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -198,6 +198,7 @@ files:
 - lib/cfnvpn/config.rb
 - lib/cfnvpn/init.rb
 - lib/cfnvpn/log.rb
+- lib/cfnvpn/modify.rb
 - lib/cfnvpn/ssm.rb
 - lib/cfnvpn/templates/cfnvpn.cfhighlander.rb.tt
 - lib/cfnvpn/version.rb