ovpnmcgen.rb 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 367d863a65d76ef7131544d0cfeabe155b43ada8
-  data.tar.gz: 638bd7fb996c3f265005992d0d452d41fceb1ab3
+  metadata.gz: fdb5a1d34606c4cbb5765c7054f2e467c535b54d
+  data.tar.gz: 03169243a1c65f06da0c35ae43d4cbca470de610
 SHA512:
-  metadata.gz: 11d4d579cb0a28ed0536afb99ba0c98c88c97923c0c1deaa7acc4dedd01dc8ef24f315a0bcc2fa2164511216c65164b39bdcdd7c97b6506ef7078e715aace314
-  data.tar.gz: f981db017988637593dc2b883531014040fefbe4b0846187a330519960a2e310690c757bd0e1a9020253a16dd139f4f0aa6cdbff8491ced055da851b1c27cd46
+  metadata.gz: 20331f1211f7fc4848f936c6d4b72d06b6cc01dfcb6dc89f8d558ba4fdaa76ff0c91484928aea0ca56aef253ef0e1c9dbd05747f6ccfa8e97065fc68ea576da2
+  data.tar.gz: 0e30f9454ec12d9f8d3f9cbc7df5246925aba72a88c7ba14ca7a75119ebbbd7b8846f9b0165b8a772722b375f66a5e74ef2dff3f7ec71a821bcd02cd4790211e

data/ChangeLog

@@ -1,3 +1,8 @@
+= 0.2.0 / 2014-04-18
+	* Support custom UUID value overrides.
+	* Support for security level, i.e. paranoid, high (default), medium.
+	* TLS-Auth keyfile now optional.
+
 = 0.1.0 / 2014-03-27
 	* Added support for `--ovpnconfigfile`, `--port`, `--proto`.
 	* Shorter switches for `--[un]trusted-ssids`.

data/README.md

@@ -4,11 +4,11 @@ OpenVPN iOS Configuration Profile Utility
 
 Generates iOS configuration profiles (.mobileconfig) that configures OpenVPN for use with VPN-on-Demand that are not accessible through the Apple Configurator or the iPhone Configuration Utility.
 
-Although there are many possible VPN-on-Demand (VoD) triggers, this utility currently only implements `SSIDMatch` and `InterfaceTypeMatch`. The following algorithm is executed upon network changes, in order: 
+Although there are many possible VPN-on-Demand (VoD) triggers, this utility currently only implements `SSIDMatch` and `InterfaceTypeMatch`. For 'high' (default) security level, the following algorithm is executed upon network changes, in order:
 
 - If wireless SSID matches any specified with `--trusted-ssids`, tear down the VPN connection and do not reconnect on demand.
 - Else if wireless SSID matches any specified with `--untrusted-ssids`, unconditionally bring up the VPN connection on the next network attempt.
-- Else if the primary network interface becomes Wifi (any SSID except those above), bring up the VPN connection.
+- Else if the primary network interface becomes Wifi (any SSID except those above), unconditionally bring up the VPN connection on the next network attempt.
 - Else if the primary network interface becomes Cellular, leave any existing VPN connection up, but do not reconnect on demand.
 - Else, unconditionally bring up the VPN connection on the next network attempt.
 
@@ -40,16 +40,43 @@ Usage: ovpnmcgen.rb generate [options] <user> <device>
 
   Options:
     --cafile FILE        Path to OpenVPN CA file. (Required)
-    --tafile FILE        Path to TLS Key file. (Required)
+    --tafile FILE        Path to TLS-Auth Key file.
     --host HOSTNAME      Hostname of OpenVPN server. (Required)
+    --proto PROTO        OpenVPN server protocol. [Default: udp]
+    -p, --port PORT      OpenVPN server port. [Default: 1194]
     --p12file FILE       Path to user PKCS#12 file. (Required)
     --p12pass PASSWORD   Password to unlock PKCS#12 file.
     --[no-]vod           Enable or Disable VPN-On-Demand. [Default: Enabled]
-    --trusted-ssids SSIDS List of comma-separated trusted SSIDs.
-    --untrusted-ssids SSIDS List of comma-separated untrusted SSIDs.
+    --security-level LEVEL Security level of VPN-On-Demand Behaviour: paranoid, high, medium. [Default: high]
+    --vpn-uuid UUID      Override a VPN configuration payload UUID.
+    --profile-uuid UUID  Override a Profile UUID.
+    --cert-uuid UUID     Override a Certificate payload UUID.
+    -t, --trusted-ssids SSIDS List of comma-separated trusted SSIDs.
+    -u, --untrusted-ssids SSIDS List of comma-separated untrusted SSIDs.
+    --ovpnconfigfile FILE Path to OpenVPN client config file.
     -o, --output FILE    Output to file. [Default: stdout]
 ```
 
+### Security Levels
+
+There are three different security levels to choose from, 'paranoid', 'high' (default), and 'medium'. The algorithm illustrated above is for 'high'.
+
+For 'paranoid' security level, the following algorithm is executed upon network changes, in order:
+
+- If wireless SSID matches any specified with `--trusted-ssids`, tear down the VPN connection and do not reconnect on demand.
+- Else if wireless SSID matches any specified with `--untrusted-ssids`, unconditionally bring up the VPN connection on the next network attempt.
+- Else if the primary network interface becomes Wifi (any SSID except those above), unconditionally bring up the VPN connection on the next network attempt.
+- Else if the primary network interface becomes Cellular, unconditionally bring up the VPN connection on the next network attempt.
+- Else, unconditionally bring up the VPN connection on the next network attempt.
+
+For 'medium' security level, the following algorithm is executed upon network changes, in order:
+
+- If wireless SSID matches any specified with `--trusted-ssids`, tear down the VPN connection and do not reconnect on demand.
+- Else if wireless SSID matches any specified with `--untrusted-ssids`, unconditionally bring up the VPN connection on the next network attempt.
+- Else if the primary network interface becomes Wifi (any SSID except those above), leave any existing VPN connection up, but do not reconnect on demand.
+- Else if the primary network interface becomes Cellular, leave any existing VPN connection up, but do not reconnect on demand.
+- Else, unconditionally bring up the VPN connection on the next network attempt.
+
 ## Examples
 
 ### Typical Usage
@@ -277,6 +304,8 @@ Output similar to above:
 
 	The same UUID should be used for profile updates, so that iOS knows which profile to replace, especially in MDM environments.
 
+	Custom overrides now supported for UUIDs.
+
 - Adopt OpenVPN parameters from an OpenVPN-compatible client.conf input file.
 
 	Implemented, but lacks support for inline `<ca|tls-auth>` data enclosures.

data/bin/ovpnmcgen.rb

@@ -19,13 +19,17 @@ command :generate do |c|
   c.example 'Extended Usage', 'ovpnmcgen.rb gen --trusted-ssids home,school --untrusted-ssids virusnet --host vpn.example.com --cafile path/to/ca.pem --tafile path/to/ta.key --p12file path/to/john-ipad.p12 --p12pass p12passphrase john ipad'
   c.example 'Using OpenSSL to convert files into PKCS#12 (.p12)', 'openssl pkcs12 -export -out path/to/john-ipad.p12 -inkey path/to/john-ipad.key -in path/to/john-ipad.crt -passout pass:p12passphrase -name john-ipad@vpn.example.com'
   c.option '--cafile FILE', 'Path to OpenVPN CA file. (Required)'
-  c.option '--tafile FILE', 'Path to TLS Key file. (Required)'
+  c.option '--tafile FILE', 'Path to TLS-Auth Key file.'
   c.option '--host HOSTNAME', 'Hostname of OpenVPN server. (Required)'
   c.option '--proto PROTO', 'OpenVPN server protocol. [Default: udp]'
   c.option '-p', '--port PORT', 'OpenVPN server port. [Default: 1194]'
   c.option '--p12file FILE', 'Path to user PKCS#12 file. (Required)'
   c.option '--p12pass PASSWORD', 'Password to unlock PKCS#12 file.'
   c.option '--[no-]vod', 'Enable or Disable VPN-On-Demand. [Default: Enabled]'
+  c.option '--security-level LEVEL', 'Security level of VPN-On-Demand Behaviour: paranoid, high, medium. [Default: high]'
+  c.option '--vpn-uuid UUID', 'Override a VPN configuration payload UUID.'
+  c.option '--profile-uuid UUID', 'Override a Profile UUID.'
+  c.option '--cert-uuid UUID', 'Override a Certificate payload UUID.'
   c.option '-t', '--trusted-ssids SSIDS', Array, 'List of comma-separated trusted SSIDs.'
   c.option '-u', '--untrusted-ssids SSIDS', Array, 'List of comma-separated untrusted SSIDs.'
   c.option '--ovpnconfigfile FILE', 'Path to OpenVPN client config file.'
@@ -34,9 +38,8 @@ command :generate do |c|
     raise ArgumentError.new "Invalid arguments. Run '#{File.basename(__FILE__)} help generate' for guidance" if args.nil? or args.length < 2
     raise ArgumentError.new "Host is required" unless options.host
     raise ArgumentError.new "cafile is required" unless options.cafile
-    raise ArgumentError.new "tafile is required" unless options.tafile
     raise ArgumentError.new "PKCS#12 file is required" unless options.p12file
-    options.default :vod => true, :proto => 'udp', :port => 1194
+    options.default :vod => true, :proto => 'udp', :port => 1194, :security_level => 'high'
     user, device, p12file, p12pass = args
     inputs = {
       :user => user,
@@ -44,15 +47,19 @@ command :generate do |c|
       :p12file => options.p12file,
       :p12pass => options.p12pass,
       :cafile => options.cafile,
-      :tafile => options.tafile,
       :host => options.host,
       :proto => options.proto,
       :port => options.port,
       :enableVOD => options.vod,
       :trusted_ssids => options.trusted_ssids,
-      :untrusted_ssids => options.untrusted_ssids
+      :untrusted_ssids => options.untrusted_ssids,
+      :profile_uuid => options.profile_uuid,
+      :vpn_uuid => options.vpn_uuid,
+      :cert_uuid => options.cert_uuid,
+      :security_level => options.security_level
     }
     inputs[:ovpnconfigfile] = options.ovpnconfigfile if options.ovpnconfigfile
+    inputs[:tafile] = options.tafile if options.tafile
 
     unless options.output
       puts Ovpnmcgen.generate(inputs)

data/lib/ovpnmcgen.rb

@@ -13,7 +13,9 @@ module Ovpnmcgen
   def generate(inputs = {})
     identifier = inputs[:identifier] || inputs[:host].split('.').reverse!.join('.')
     port = inputs[:port] || 1194
-    certUUID = inputs[:certUUID] || `uuidgen`.chomp.upcase
+    certUUID = inputs[:cert_uuid] || `uuidgen`.chomp.upcase
+    vpnUUID = inputs[:vpn_uuid] || `uuidgen`.chomp.upcase
+    plistUUID = inputs[:profile_uuid] || `uuidgen`.chomp.upcase
     user, device, domain, host, proto, enableVOD = inputs[:user], inputs[:device], inputs[:host], inputs[:host], inputs[:proto], inputs[:enableVOD]
     p12pass = inputs[:p12pass] || ''
     trusted_ssids = inputs[:trusted_ssids] || false
@@ -31,7 +33,7 @@ module Ovpnmcgen
     rescue Errno::ENOENT
       puts "TLS file not found: #{inputs[:tafile]}!"
       exit
-    end
+    end if inputs[:tafile]
 
     begin
       p12file = Base64.encode64(File.read(inputs[:p12file]))
@@ -47,13 +49,13 @@ module Ovpnmcgen
         'client' => 'NOARGS',
         'comp-lzo' => 'NOARGS',
         'dev' => 'tun',
-        'key-direction' => '1',
         'remote-cert-tls' => 'server'
       }
     end
     ovpnconfighash['remote'] = "#{host} #{port} #{proto}"
     ovpnconfighash['ca'] = ca_cert
-    ovpnconfighash['tls-auth'] = tls_auth
+    ovpnconfighash['tls-auth'] = tls_auth if inputs[:tafile]
+    ovpnconfighash['key-direction'] = '1' if inputs[:tafile]
 
     vpnOnDemandRules = Array.new
     vodTrusted = { # Trust only Wifi SSID
@@ -69,10 +71,22 @@ module Ovpnmcgen
 
     vpnOnDemandRules << { # Untrust all Wifi
       'InterfaceTypeMatch' => 'WiFi',
-      'Action' => 'Connect'
+      'Action' => case inputs[:security_level]
+        when 'paranoid', 'high'
+          'Connect'
+        else # medium
+          'Ignore'
+        end
     } << { # Trust Cellular
       'InterfaceTypeMatch' => 'Cellular',
-      'Action' => 'Ignore'
+      'Action' => case inputs[:security_level]
+          when 'paranoid'
+            'Connect'
+          when 'high'
+            'Ignore'
+          else # medium
+            'Disconnect'
+          end
     } << { # Default catch-all
       'Action' => 'Connect'
     }
@@ -96,7 +110,7 @@ module Ovpnmcgen
       'PayloadIdentifier' => "#{identifier}.#{user}-#{device}.vpnconfig",
       'PayloadOrganization' => domain,
       'PayloadType' => 'com.apple.vpn.managed',
-      'PayloadUUID' => `uuidgen`.chomp.upcase,
+      'PayloadUUID' => vpnUUID,
       'PayloadVersion' => 1,
       'UserDefinedName' => "#{host}/VoD",
       'VPN' => {
@@ -121,7 +135,7 @@ module Ovpnmcgen
       'PayloadOrganization' => domain,
       'PayloadRemovalDisallowed' => false,
       'PayloadType' => 'Configuration',
-      'PayloadUUID' => `uuidgen`.chomp.upcase,
+      'PayloadUUID' => plistUUID,
       'PayloadVersion' => 1,
       #'EncryptedPayloadContent' => StringData.new(encPlistPayloadContent)
       'PayloadContent' => plistPayloadContent

data/lib/ovpnmcgen/version.rb

@@ -1,4 +1,4 @@
 module Ovpnmcgen
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
   SUMMARY = "An OpenVPN iOS Configuration Profile (.mobileconfig) Utility"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ovpnmcgen.rb
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Ronald Ip
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-27 00:00:00.000000000 Z
+date: 2014-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler