cfn-vpn 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76c6ac6edaf3eb278cc8a9fc5cb7dd30e6dc41c282170dffaa9907acf30a7926
-  data.tar.gz: 989702a95796354e7d74fb4bb810de2fcd31f39e122d44ae978702ccd247a06e
+  metadata.gz: 4f6be01a5786f8ea62be6d6b7f781ad1036b8edff08ba7d509707565fbeb5862
+  data.tar.gz: 9a9a2038b6c955871983649f1c2627c6c2eedf9a64cae20ceb04ba73c25a3616
 SHA512:
-  metadata.gz: 0b58001f192eaa370b33bf3f672c89424d64aa653c7e069f8d494680f75b4a095830036542ddbf9fa6e517d662875880116714da5875dc964fdc1bffec1a732f
-  data.tar.gz: f2984e88ce01da5987a19c66f4c57b24133aa45e075ed4fdce3b88d76b2df7cbef25ec1c9d136cbb1f0fdcb8458e4ead968798d3a52b17e2b65a7c669af15030
+  metadata.gz: d0a839efc1e6d5826fc9b9edfcd3c608b0eb3a1f6b79df624de1be888b4d817a4c9c6994e9ea806e002998e0affa9cb5b0db1b25c04fa12677181e7d504fc958
+  data.tar.gz: 051bc8385ced35fafbcffa4b013cb8e4d962dafb74f88c1574df4684f37b64fd074dfa4bdcdba0edafa3bc3dee855bd83217a3c23a00f60be6c18dad6f728052

data/README.md

@@ -69,6 +69,7 @@ Commands:
   cfn-vpn --version, -v                                                            # print the version
   cfn-vpn client [name] --bucket=BUCKET --client-cn=CLIENT_CN                      # Create a new client certificate
   cfn-vpn config [name] --bucket=BUCKET --client-cn=CLIENT_CN                      # Retrieve the config for the AWS Client VPN
+  cfn-vpn embedded [name] --bucket=BUCKET --client-cn=CLIENT_CN                    # Embed client certs into config and generate S3 presigned URL
   cfn-vpn help [COMMAND]                                                           # Describe available commands or one specific command
   cfn-vpn init [name] --bucket=BUCKET --server-cn=SERVER_CN --subnet-id=SUBNET_ID  # Create a AWS Client VPN
   cfn-vpn modify [name]                                                            # Modify your AWS Client VPN
@@ -225,6 +226,13 @@ to delete a route specify the `--del` flag with the cidr you want to delete.
 `cfn-vpn routes myvpn --del 10.10.0.0/16`
 
 
+### Embed client certificates into config file and share
+
+This will pull the clients certificate and key archives from S3 and embed them into the config file, upload it back to S3 and generate a presigned URL for the user.
+This allows the you to download or share a single, ready to import config file into a OpenVPN client.
+
+`cfn-vpn embedded myvpn --client-cn user1 --bucket mybucket`
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/base2services/aws-client-vpn.

data/lib/cfnvpn.rb

@@ -8,6 +8,7 @@ require 'cfnvpn/revoke'
 require 'cfnvpn/sessions'
 require 'cfnvpn/routes'
 require 'cfnvpn/share'
+require 'cfnvpn/embedded'
 
 module CfnVpn
   class Cli < Thor
@@ -42,5 +43,8 @@ module CfnVpn
     register CfnVpn::Share, 'share', 'share [name]', 'Provide a user with a s3 signed download for certificates and config'
     tasks["share"].options = CfnVpn::Share.class_options
 
+    register CfnVpn::Embedded, 'embedded', 'embedded [name]', 'Embed client certs into config and generate S3 presigned URL'
+    tasks["embedded"].options = CfnVpn::Embedded.class_options
+
   end
 end

data/lib/cfnvpn/embedded.rb

@@ -0,0 +1,108 @@
+require 'cfnvpn/log'
+require 'cfnvpn/s3'
+
+module CfnVpn
+  class Embedded < Thor::Group
+    include Thor::Actions
+    include CfnVpn::Log
+
+    argument :name
+
+    class_option :profile, desc: 'AWS Profile'
+    class_option :region, default: ENV['AWS_REGION'], desc: 'AWS Region'
+    class_option :verbose, desc: 'set log level to debug', type: :boolean
+
+    class_option :bucket, required: true, desc: 'S3 bucket'
+    class_option :client_cn, required: true, desc: 'Client certificates to download'
+    class_option :ignore_routes, alias: :i, type: :boolean, desc: 'Ignore client VPN pushed routes and set routes in config file'
+
+    def self.source_root
+      File.dirname(__FILE__)
+    end
+
+    def set_loglevel
+      Log.logger.level = Logger::DEBUG if @options['verbose']
+    end
+
+    def create_config_directory
+      @build_dir = "#{ENV['HOME']}/.cfnvpn/#{@name}"
+      @config_dir = "#{@build_dir}/config"
+      Log.logger.debug("Creating config directory #{@config_dir}")
+      FileUtils.mkdir_p(@config_dir)
+    end
+
+    def download_certificates
+      download = true
+      if File.exists?("#{@config_dir}/#{@options['client_cn']}.crt")
+        download = yes? "Certificates for #{@options['client_cn']} already exist in #{@config_dir}. Do you want to download again? ", :green
+      end
+
+      if download
+        Log.logger.info "Downloading certificates for #{@options['client_cn']} to #{@config_dir}"
+        s3 = CfnVpn::S3.new(@options['region'],@options['bucket'],@name)
+        s3.get_object("#{@config_dir}/#{@options['client_cn']}.tar.gz")
+        cert = CfnVpn::Certificates.new(@build_dir,@name)
+        Log.logger.debug cert.extract_certificate(@options['client_cn'])
+      end
+    end
+
+    def download_config
+      vpn = CfnVpn::ClientVpn.new(@name,@options['region'])
+      @endpoint_id = vpn.get_endpoint_id()
+      Log.logger.debug "downloading client config for #{@endpoint_id}"
+      @config = vpn.get_config(@endpoint_id)
+      string = (0...8).map { (65 + rand(26)).chr.downcase }.join
+      @config.sub!(@endpoint_id, "#{string}.#{@endpoint_id}")
+    end
+
+    def add_routes
+      if @options['ignore_routes']
+        Log.logger.debug "Ignoring routes pushed by the client vpn"
+        @config.concat("\nroute-nopull\n")
+        vpn = CfnVpn::ClientVpn.new(@name,@options['region'])
+        routes = vpn.get_route_with_mask
+        Log.logger.debug "Found routes #{routes}"
+        routes.each do |r|
+          @config.concat("route #{r[:route]} #{r[:mask]}\n")
+        end
+        dns_servers = vpn.get_dns_servers()
+        if dns_servers.any?
+          Log.logger.debug "Found DNS servers #{dns_servers.join(' ')}"
+          @config.concat("dhcp-option DNS #{dns_servers.first}\n")
+        end
+      end
+    end
+
+    def embed_certs
+      cert = CfnVpn::Certificates.new(@build_dir,@name)
+      Log.logger.debug cert.extract_certificate(@options['client_cn'])
+      Log.logger.debug "Reading extracted certificate and private key"
+      key = File.read("#{@config_dir}/#{@options['client_cn']}.key")
+      crt = File.read("#{@config_dir}/#{@options['client_cn']}.crt")
+      Log.logger.debug "Embedding certificate and private key into config"
+      @config.concat("\n<key>\n#{key}\n</key>\n")
+      @config.concat("\n<cert>\n#{crt}\n</cert>\n")
+    end
+
+    def upload_embedded_config
+      @s3 = CfnVpn::S3.new(@options['region'],@options['bucket'],@name)
+      @s3.store_embedded_config(@config, @options['client_cn'])
+    end
+
+    def get_presigned_url
+      @cn = @options['client_cn']
+      @config_url = @s3.get_url("#{@name}_#{@cn}.config.ovpn")
+      Log.logger.debug "Config presigned url: #{@config_url}"
+    end
+    
+    def display_url
+      Log.logger.info "Share the below instructions with the user..."
+      say "\nDownload the embedded config from the below presigned URL which will expire in 1 hour."
+      say "\nConfig:\n"
+      say "\tcurl #{@config_url} > #{@name}_#{@cn}.config.ovpn", :cyan
+      say "\nOpen #{@name}_#{@cn}.config.ovpn with your favourite openvpn client."
+    end
+
+  end
+
+end

data/lib/cfnvpn/s3.rb

@@ -53,5 +53,15 @@ module CfnVpn
       presigner.presigned_url(:get_object, params)
     end
 
+    def store_embedded_config(config, cn)
+      Log.logger.debug("uploading config to s3://#{@bucket}/#{@path}/#{@name}_#{cn}.config.ovpn")
+      @client.put_object({
+        body: config,
+        bucket: @bucket,
+        key: "#{@path}/#{@name}_#{cn}.config.ovpn",
+        tagging: "cfnvpn:name=#{@name}"
+      })
+    end
+
   end
 end

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "0.4.1".freeze
+  VERSION = "0.4.2".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-12-16 00:00:00.000000000 Z
+date: 2020-02-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -231,6 +231,7 @@ files:
 - lib/cfnvpn/clientvpn.rb
 - lib/cfnvpn/cloudformation.rb
 - lib/cfnvpn/config.rb
+- lib/cfnvpn/embedded.rb
 - lib/cfnvpn/init.rb
 - lib/cfnvpn/log.rb
 - lib/cfnvpn/modify.rb