ios_config 1.3.3 → 1.3.4

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: c4fd6dbd28429a9e1b572c8c173c7c6772f4d24e
+  data.tar.gz: e45a90bada36d9bde551bf5ef3b3c5b358d709a9
+SHA512:
+  metadata.gz: 8f6210a45d927fa3dadfab05a736c8a5f72bb9fbc74e9abefc73eac9e9ed10a0fe73fc85e96e7ec1a4b2036761858f767f0d64eb9d991fa4d318410e2121d8e3
+  data.tar.gz: d34c19c08e58db0d326bf19b2b2ee96448fe142b099e0eb195e88ec2766aaabeac9fa2889ad0ef8f54a129b6b604e275a7620bc2aea01a853ca627a3f0ec5f27

data/.travis.yml

@@ -0,0 +1,9 @@
+language: ruby
+rvm:
+    - 2.0.0
+    - 1.9.3
+    - jruby-19mode
+    - ruby-head
+    - jruby-head
+
+script: bundle exec rspec

data/README.md

@@ -1,4 +1,5 @@
 # ios_config
+[![Build Status](https://travis-ci.org/tboyko/ios_config.png?branch=master)](https://travis-ci.org/tboyko/ios_config)
 
 This gem provides an easy way to generate profiles and configuration payloads for use with Apple iOS devices. These profiles and payloads can be delivered via Apple MDM or Apple's Configurator or iPhone Configuration Utility (IPCU).
 
@@ -37,7 +38,7 @@ vpn_payload = IOSConfig::Payload::VPN.new connection_name:     "My VPN",
                                           connection_type:     :pptp,
                                           encryption_level:    :auto,
                                           proxy_type:          :none,
-                                          send_all_traffic?    true,
+                                          send_all_traffic:    true,
                                           server:              "example.org",
                                           username:            "macdemarco",
                                           password:            "viceroy"
@@ -52,8 +53,8 @@ profile = IOSConfig::Profile.new type:           "Configuration",
                                  organization:   "A Company Name",
                                  uuid:           SecureRandom.uuid,
                                  allow_removal:  false,
-                                 client_certs:   [OpenSSL::X509::Certificate.new], # Array of client certificates
-                                 payloads:       payloads # must be an array when type is "Configuration" 
+                                 client_certs:   [OpenSSL::X509::Certificate.new(string_with_pem_encoded_cert)], # Array of client certificates
+                                 payloads:       payloads # must be an array when type is "Configuration"
 
 
 # Generate a plist version of the profile, ready for delivery to the device
@@ -84,7 +85,7 @@ profile_plist = profile.signed( [signing_cert_path], [intermediate_path], [key_p
 
 ```ruby
 allow_removal # if profile can be deleted by device user. defaults to true
-description   # (optional) displayed in device settings 
+description   # (optional) displayed in device settings
 display_name  # displayed in device settings
 identifier
 organization  # (optional) displayed in device settings
@@ -155,26 +156,26 @@ payload = IOSConfig::Payload::VPN.new(parameters).build
 Available parameters:
 
 ```ruby
-connection_name    
+connection_name
 authentication_type  # :password, :rsa_securid
 connection_type      # :l2tp, :pptp, :ipsec, :anyconnect, :juniper_ssl, :f5_ssl, :sonicwall_modile_connect, :aruba_via
 encryption_level     # :none, :manual, :auto
-group_name           
+group_name
 prompt_for_password  # true, false
 proxy_type           # :none, :manual, :auto
-proxy_port          
-proxy_server        
+proxy_port
+proxy_server
 send_all_traffic     # true, false
-server               
-proxy_url            
-group_or_domain      
-password             
-username             
-proxy_password      
-proxy_username       
-realm     
-role             
-shared_secret      
+server
+proxy_url
+group_or_domain
+password
+username
+proxy_password
+proxy_username
+realm
+role
+shared_secret
 ```
 
 #### Wi-Fi
@@ -211,7 +212,7 @@ proxy_url
 
 ### Custom Payloads
 
-If you need to create a payload that isn't supported by the library, you can do so using the `IOSConfig::Payload::Custom` class. 
+If you need to create a payload that isn't supported by the library, you can do so using the `IOSConfig::Payload::Custom` class.
 
 The construction of this payload is similar to the ready-made ones with two exceptions: You must specify the payload type and the actual structure of the payload.
 

data/ios_config.gemspec

@@ -19,6 +19,8 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "CFPropertyList", "~> 2.2"
+  spec.add_dependency "plist", "~> 3.1"
   spec.add_development_dependency "bundler", "~> 1.3"
   spec.add_development_dependency "rake"
+  spec.add_development_dependency "rspec", "~> 2.1"
 end

data/lib/ios_config/payload/base.rb

@@ -11,7 +11,7 @@ module IOSConfig
         attributes.each do |name, value|
           begin
             send("#{name}=", value)
-          rescue NoMethodError => e 
+          rescue NoMethodError => e
             raise ArgumentError, %{"#{name}" is not a valid attribute}
           end
         end

data/lib/ios_config/payload/certificate.rb

@@ -0,0 +1,73 @@
+module IOSConfig
+  module Payload
+    class Certificate < Base
+
+      attr_accessor :type,           # pkcs12, caroot
+                    :filename,       # Certificate filename
+                    :cert_path,      # Certificate file path
+                    :description,    # Certificate description
+                    :displayname,    #
+                    :identifier,     # Certificate identifier
+                    :organization,   # Certificate organization
+                    :password,       # Password to unlock certificate
+                    :payload_version # Payload version
+
+      def initialize(attributes = {})
+        attributes ||= {}
+        [ :type,
+          :filename,
+          :cert_path,
+          :description,
+          :displayname,
+          :identifier,
+          :organization ].each do |attribute|
+          raise ArgumentError, "#{attribute} must be specified" unless attributes[attribute]
+        end
+
+        super(attributes)
+      end
+
+      private
+
+      def payload
+        p = { 'PayloadCertificateFileName' => @filename,
+              'PayloadContent' => read_cert(@cert_path, @password),
+              'PayloadDescription' => @description,
+              'PayloadDisplayName' => @displayname,
+              'PayloadIdentifier' => @identifier,
+              'PayloadOrganization' => @organization,
+            }
+
+        p['Password'] = @password unless @password.blank?
+
+        p
+      end
+
+      def read_cert(cert_path, password = nil)
+        data = File.read(cert_path)
+
+        # This will throw an exception if we have an incorrect password
+        if !password.nil?
+          OpenSSL::PKCS12.new(data, password)
+        end
+
+        StringIO.new data
+      end
+
+      def payload_type
+        case @type
+        when 'pkcs12'
+          'com.apple.security.pkcs12'
+        when 'caroot'
+          'com.apple.security.root'
+        else
+          raise NotImplementedError
+        end
+      end
+
+      def payload_version
+        @payload_version || super
+      end
+    end
+  end
+end

data/lib/ios_config/payload/custom.rb

@@ -2,7 +2,7 @@ module IOSConfig
   module Payload
     class Custom < Base
 
-      attr_accessor :payload_type, :payload_version, :payload 
+      attr_accessor :payload_type, :payload_version, :payload
 
       def initialize(attributes = {})
         attributes ||= {}

data/lib/ios_config/payload/vpn.rb

@@ -2,13 +2,15 @@ module IOSConfig
   module Payload
     class VPN < Base
 
-      attr_accessor :authentication_type, # :password, :rsa_securid
-                    :connection_type,     # :l2tp, :pptp, :ipsec, :anyconnect, :juniper_ssl, :f5_ssl, :sonicwall_modile_connect, :aruba_via
-                    :encryption_level,    # :none, :manual, :auto
+      attr_accessor :authentication_method, # :shared_secret, :certificate
+                    :authentication_type,   # :password, :rsa_securid
+                    :certificate_uuid,      # Certificate UUID. Only used with ipsec and authentication method :certificate
+                    :connection_type,       # :l2tp, :pptp, :ipsec, :anyconnect, :juniper_ssl, :f5_ssl, :sonicwall_modile_connect, :aruba_via
+                    :encryption_level,      # :none, :manual, :auto
                     :group_name,
                     :connection_name,
                     :prompt_for_password,
-                    :proxy_type,          # :none, :manual, :auto
+                    :proxy_type,            # :none, :manual, :auto
                     :proxy_port,
                     :proxy_server,
                     :send_all_traffic,
@@ -43,7 +45,7 @@ module IOSConfig
           p_ipsec['SharedSecret'] = StringIO.new(@shared_secret) unless @shared_secret.blank?
           p['IPSec']  = p_ipsec
           p['PPP']    = generate_ppp_config
-      
+
         when :pptp
           p['VPNType'] = 'PPTP'
           p['PPP'] = generate_ppp_config.merge({  'CPPEnabled'        => @encryption_level != :none,
@@ -53,16 +55,26 @@ module IOSConfig
 
         when :ipsec
           p['VPNType'] = 'IPSec'
-          p_ipsec = { 'AuthenticationMethod'  => 'SharedSecret',
-                      'LocalIdentifierType'   => 'KeyID',
-                      'RemoteAddress'         => @server }
-          p_ipsec['LocalIdentifier'] = @group_name unless @group_name.blank?
-          p_ipsec['SharedSecret']    = StringIO.new(@shared_secret) unless @shared_secret.blank?
+          p_ipsec = { 'RemoteAddress'         => @server }
+
+          case @authentication_method
+          when :certificate
+            p_ipsec['AuthenticationMethod']   = 'Certificate'
+            p_ipsec['PayloadCertificateUUID'] = @certificate_uuid
+          when :shared_secret
+            p_ipsec['AuthenticationMethod']  = 'SharedSecret'
+            p_ipsec['LocalIdentifierType']   = 'KeyID'
+            p_ipsec['LocalIdentifier'] = @group_name unless @group_name.blank?
+            p_ipsec['SharedSecret']    = StringIO.new(@shared_secret) unless @shared_secret.blank?
+          end
+
           unless @username.blank?
             p_ipsec['XAuthEnabled'] = 1
             p_ipsec['XAuthName']    = @username
+            p_ipsec['XAuthPassword'] = @password
+            p_ipsec['XAuthPasswordEncryption'] = 'Prompt' unless @prompt_for_password.blank?
           end
-          p_ipsec['XAuthPasswordEncryption'] = 'Prompt' unless @prompt_for_password.blank?
+
           p['IPSec'] = p_ipsec
 
         when :anyconnect
@@ -79,7 +91,7 @@ module IOSConfig
           vendor_config['Role']   = @role unless @role.blank?
           p['VendorConfig'] = vendor_config
           p['VPN']          = generate_vpn_config
-          
+
         when :f5_ssl
           p['VPNType']      = 'VPN'
           p['VPNSubType']   = 'com.f5.F5-Edge-Client.vpnplugin'
@@ -107,7 +119,7 @@ module IOSConfig
         case @proxy_type
         when :none
           p_proxy = {}
-        
+
         when :manual
           p_proxy = { 'HTTPEnable'  => 1,
                       'HTTPPort'    => @proxy_port,
@@ -118,11 +130,11 @@ module IOSConfig
 
           p_proxy['HTTPProxyUsername'] = @proxy_username unless @proxy_username.blank?
           p_proxy['HTTPProxyPassword'] = @proxy_password unless @proxy_password.blank?
-        
+
         when :auto
           p_proxy = { 'ProxyAutoConfigEnable'     => 1,
                       'ProxyAutoConfigURLString'  => @proxy_url }
-        
+
         end
         p['Proxies'] = p_proxy
 

data/lib/ios_config/payload/wi_fi.rb

@@ -37,7 +37,7 @@ module IOSConfig
       def payload
         p = { 'EncryptionType'  => ENCRYPTION_TYPES[@encryption_type] }
 
-        
+
         p['AutoJoin']       = @auto_join unless @auto_join.nil?
         p['HIDDEN_NETWORK'] = @hidden_network unless @hidden_network.nil?
         p['SSID_STR']       = @ssid unless @ssid.nil?
@@ -60,7 +60,7 @@ module IOSConfig
 
         p['ProxyType'] = @proxy_type.to_s.capitalize unless @proxy_type.nil?
 
-        case @proxy_type     
+        case @proxy_type
         when :manual
           p.merge! ({ 'ProxyServer'     => @proxy_server,
                       'ProxyServerPort' => @proxy_port })

data/lib/ios_config/profile.rb

@@ -1,11 +1,12 @@
 require 'cfpropertylist'
+require 'plist'
 
 module IOSConfig
   class Profile
     require 'openssl'
 
     attr_accessor :allow_removal, # if profile can be deleted by device user. defaults to true
-                  :description,   # (optional) displayed in device settings 
+                  :description,   # (optional) displayed in device settings
                   :display_name,  # displayed in device settings
                   :identifier,
                   :organization,  # (optional) displayed in device settings
@@ -17,57 +18,62 @@ module IOSConfig
 
     def initialize(options = {})
       options.each { |k,v| self.send("#{k}=", v) }
-      puts self.allow_removal
-      puts self.allow_removal.nil?
-      self.allow_removal  = true if self.allow_removal.nil?
-      self.type           ||= 'Configuration'
-      self.version        ||= 1
-      self.payloads       ||= []
+
+      @allow_removal  = true if @allow_removal.nil?
+      @type           ||= 'Configuration'
+      @version        ||= 1
+      @payloads       ||= []
     end
-  
+
     def signed(mdm_cert, mdm_intermediate_cert, mdm_private_key)
       certificate   = OpenSSL::X509::Certificate.new(File.read(mdm_cert))
       intermediate  = OpenSSL::X509::Certificate.new(File.read(mdm_intermediate_cert))
       private_key   = OpenSSL::PKey::RSA.new(File.read(mdm_private_key))
-    
+
       signed_profile = OpenSSL::PKCS7.sign(certificate, private_key, unsigned, [intermediate], OpenSSL::PKCS7::BINARY)
       signed_profile.to_der
     end
-  
-    def unsigned
+
+    def unsigned(format = :binary)
       raise_if_blank [:version, :uuid, :type, :identifier, :display_name]
-    
+
       profile = {
-        'PayloadDisplayName'        => self.display_name,
-        'PayloadVersion'            => self.version,
-        'PayloadUUID'               => self.uuid,
-        'PayloadIdentifier'         => self.identifier,
-        'PayloadType'               => self.type,
-        'PayloadRemovalDisallowed'  => !self.allow_removal
+        'PayloadDisplayName'        => @display_name,
+        'PayloadVersion'            => @version,
+        'PayloadUUID'               => @uuid,
+        'PayloadIdentifier'         => @identifier,
+        'PayloadType'               => @type,
+        'PayloadRemovalDisallowed'  => !@allow_removal
       }
-      profile['PayloadOrganization']  = self.organization if self.organization
-      profile['PayloadDescription']   = self.description  if self.description
-          
-      if self.client_certs.nil?
-        profile['PayloadContent'] = payloads
+      profile['PayloadOrganization']  = @organization if @organization
+      profile['PayloadDescription']   = @description  if @description
+
+      if @client_certs.nil?
+        profile['PayloadContent'] = @payloads
       else
-        encrypted_payload_content = OpenSSL::PKCS7.encrypt( self.client_certs, 
-                                                            payloads.to_plist, 
-                                                            OpenSSL::Cipher::Cipher::new("des-ede3-cbc"), 
+        encrypted_payload_content = OpenSSL::PKCS7.encrypt( @client_certs,
+                                                            @payloads.to_plist,
+                                                            OpenSSL::Cipher::Cipher::new("des-ede3-cbc"),
                                                             OpenSSL::PKCS7::BINARY)
-      
+
         profile['EncryptedPayloadContent'] = StringIO.new encrypted_payload_content.to_der
       end
 
-      profile.to_plist
+      case format
+      when :binary
+        profile.to_plist
+      when :xml
+        Plist::Emit.dump(profile)
+      else
+        raise ArgumentError, 'unknown format'
+      end
+
     end
 
     private
-  
+
     def raise_if_blank(required_attributes)
-      required_attributes.each { |a| raise "#{a} must be set" if self.send(a).blank? }
+      required_attributes.each { |a| raise "#{a} must be set" if self.send(a).nil?  }
     end
-    
   end
-
-end
+end

data/lib/ios_config/version.rb

@@ -1,3 +1,3 @@
 module IOSConfig
-  VERSION = "1.3.3"
+  VERSION = "1.3.4"
 end

data/lib/ios_config.rb

@@ -4,6 +4,7 @@ require 'ios_config/profile'
 require 'ios_config/payload/base'
 require 'ios_config/payload/air_play'
 require 'ios_config/payload/air_print'
+require 'ios_config/payload/certificate'
 require 'ios_config/payload/custom'
 require 'ios_config/payload/single_sign_on_account'
 require 'ios_config/payload/vpn'

data/spec/payload/vpn_spec.rb

@@ -0,0 +1,21 @@
+require 'spec_helper'
+
+describe IOSConfig::Payload::VPN do
+
+  subject(:vpn) do
+    IOSConfig::Payload::VPN.new connection_name:     "My VPN",
+                                authentication_type: :password,
+                                connection_type:     :pptp,
+                                encryption_level:    :auto,
+                                proxy_type:          :none,
+                                send_all_traffic:    true,
+                                server:              "example.org",
+                                username:            "macdemarco",
+                                password:            "viceroy"
+  end
+
+  it 'builds a payload hash' do
+    expect(vpn.build).to be_a_kind_of(Hash)
+  end
+
+end

data/spec/profile_spec.rb

@@ -0,0 +1,23 @@
+require 'spec_helper'
+
+describe IOSConfig::Profile do
+
+  subject(:profile) do
+    IOSConfig::Profile.new type:            "Configuration",
+                           display_name:    "A Profile Name",
+                           identifier:      "org.example.examplemdmservice.exampleprofile",
+                           organization:    "A Company Name",
+                           uuid:            SecureRandom.uuid,
+                           allow_removal:   false,
+                           client_certs:    [],
+                           payloads:        ['dummy payload content']
+  end
+
+  it 'creates an unsigned profile' do
+    unsigned = profile.unsigned
+
+    expect(unsigned).to be_a_kind_of(String)
+    expect(unsigned).to have_at_least(100).characters
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1 @@
+require 'ios_config'

metadata

@@ -1,20 +1,18 @@
 --- !ruby/object:Gem::Specification
 name: ios_config
 version: !ruby/object:Gem::Version
-  version: 1.3.3
-  prerelease: 
+  version: 1.3.4
 platform: ruby
 authors:
 - Taylor Boyko
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-24 00:00:00.000000000 Z
+date: 2014-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: CFPropertyList
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -22,15 +20,27 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: plist
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.1'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -38,7 +48,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -46,19 +55,31 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '2.1'
 description: Generate configuration profiles and payloads for Apple iOS devices
 email:
 - taylorboyko@gmail.com
@@ -67,6 +88,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - .gitignore
+- .travis.yml
 - Gemfile
 - LICENSE
 - README.md
@@ -77,43 +99,43 @@ files:
 - lib/ios_config/payload/air_play.rb
 - lib/ios_config/payload/air_print.rb
 - lib/ios_config/payload/base.rb
+- lib/ios_config/payload/certificate.rb
 - lib/ios_config/payload/custom.rb
 - lib/ios_config/payload/single_sign_on_account.rb
 - lib/ios_config/payload/vpn.rb
 - lib/ios_config/payload/wi_fi.rb
 - lib/ios_config/profile.rb
 - lib/ios_config/version.rb
+- spec/payload/vpn_spec.rb
+- spec/profile_spec.rb
+- spec/spec_helper.rb
 homepage: https://github.com/tboyko/ios_config
 licenses:
 - MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
-      segments:
-      - 0
-      hash: 4043779232017033479
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
-      segments:
-      - 0
-      hash: 4043779232017033479
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.24
+rubygems_version: 2.0.14
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: This gen provides an easy way to generate profiles and configuration payloads
   for use with Apple iOS devices. These profiles and payloads can be delivered via
   Apple MDM or Apple's Configurator or iPhone Configuration Utility (IPCU).
-test_files: []
+test_files:
+- spec/payload/vpn_spec.rb
+- spec/profile_spec.rb
+- spec/spec_helper.rb