ovpnmcgen.rb 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8fa9ddfe28aee021b09d926a49dfd609833591e0
-  data.tar.gz: f7174a981ed646aa74c9da396cc0fb9ec9b41dda
+  metadata.gz: 510af3c4d73274fe91dff739fe77f883e3f5b79e
+  data.tar.gz: 39b381a40aadc97c26ee22500246be3b0e101879
 SHA512:
-  metadata.gz: 0c8d34469745b11850ba9eedb63dc85675294f05071afdc2393c4c9e52248cb182c3747d73cd4c74b630088ddcb602c458a97dd53ba79d45fccea4f5fe072187
-  data.tar.gz: 59525bbf6cf3ae0cc9fb468bafc10e11e3cd119fe9c0adfe45d06954badad08799cbdc80d7edea13e4c8feb486b3480fca605578254bbd90fb7bf2fbde95d3e2
+  metadata.gz: d38b4b00261d0593db63a8539c5fa65b2bd5d28e3a3f9b833d64a08cb332ec5a5ef4862f610372e4e6d991cbf63d954f05628b6f871dd141087def94e272cc52
+  data.tar.gz: 18d9405965ffc38ebd3676cc4e3e210ee3cc9be161ffd93c2bcfadb8082be88e2d3a57247f8fb7b8d6fd51c05b6fdc90c289a6620644d708aa3b136247facf9b

data/ChangeLog

@@ -1,4 +1,8 @@
-= 0.2.1 / Unreleased
+= 0.3.0 / 2014-05-04
+	* Documentation updates.
+	* Added support for `URLStringProbe`, via `--url-probe`.
+
+= 0.2.1 / 2014-04-19
 	* Implement unit testing.
 	* Switch to a portable and native uuidgen implementation.
 	* Minor documentation improvements.
@@ -18,4 +22,4 @@
 	* Improved Documentation.
 
 = 0.0.1 / 2014-03-26
-	* Initial Release.
+	* Initial Release.

data/README.md

@@ -2,11 +2,14 @@
 
 OpenVPN iOS Configuration Profile Utility
 
-[![GitHub version](https://badge.fury.io/gh/iphoting%2Fovpnmcgen.rb.svg)](http://badge.fury.io/gh/iphoting%2Fovpnmcgen.rb) [![Gem Version](https://badge.fury.io/rb/ovpnmcgen.rb.svg)](http://badge.fury.io/rb/ovpnmcgen.rb) [![Build Status](https://travis-ci.org/iphoting/ovpnmcgen.rb.svg?branch=master)](https://travis-ci.org/iphoting/ovpnmcgen.rb)
+[![Stories in Ready](https://badge.waffle.io/iphoting/ovpnmcgen.rb.png?label=ready&title=Ready)](http://waffle.io/iphoting/ovpnmcgen.rb)
+[![GitHub version](https://badge.fury.io/gh/iphoting%2Fovpnmcgen.rb.svg)](http://badge.fury.io/gh/iphoting%2Fovpnmcgen.rb)
+[![Gem Version](https://badge.fury.io/rb/ovpnmcgen.rb.svg)](http://badge.fury.io/rb/ovpnmcgen.rb)
+[![Build Status](https://travis-ci.org/iphoting/ovpnmcgen.rb.svg?branch=master)](https://travis-ci.org/iphoting/ovpnmcgen.rb)
 
 Generates iOS configuration profiles (.mobileconfig) that configures OpenVPN for use with VPN-on-Demand that are not accessible through the Apple Configurator or the iPhone Configuration Utility.
 
-Although there are many possible VPN-on-Demand (VoD) triggers, this utility currently only implements `SSIDMatch` and `InterfaceTypeMatch`. For 'high' (default) security level, the following algorithm is executed upon network changes, in order:
+Although there are many possible VPN-on-Demand (VoD) triggers, this utility currently only implements `SSIDMatch`, `InterfaceTypeMatch`, and optionally `URLStringProbe`. For 'high' (default) security level, the following algorithm is executed upon network changes, in order:
 
 - If wireless SSID matches any specified with `--trusted-ssids`, tear down the VPN connection and do not reconnect on demand.
 - Else if wireless SSID matches any specified with `--untrusted-ssids`, unconditionally bring up the VPN connection on the next network attempt.
@@ -14,7 +17,7 @@ Although there are many possible VPN-on-Demand (VoD) triggers, this utility curr
 - Else if the primary network interface becomes Cellular, leave any existing VPN connection up, but do not reconnect on demand.
 - Else, unconditionally bring up the VPN connection on the next network attempt.
 
-Note: The other match triggers, such as `DNSDomainMatch`, `DNSServerAddressMatch`, `URLStringProbe`, and per-connection domain inspection (`ActionParameters`), are not implemented. I reckon some kind of DSL will need to be built to support them; pull-requests are welcome.
+Note: The other match triggers, such as `DNSDomainMatch`, `DNSServerAddressMatch`, and per-connection domain inspection (`ActionParameters`), are not implemented. I reckon some kind of DSL will need to be built to support them; pull-requests are welcome.
 
 ## Installation
 
@@ -55,6 +58,7 @@ Usage: ovpnmcgen.rb generate [options] <user> <device>
     --cert-uuid UUID     Override a Certificate payload UUID.
     -t, --trusted-ssids SSIDS List of comma-separated trusted SSIDs.
     -u, --untrusted-ssids SSIDS List of comma-separated untrusted SSIDs.
+    --url-probe URL      This URL must return HTTP status 200, without redirection, before the VPN service will try establishing.
     --ovpnconfigfile FILE Path to OpenVPN client config file.
     -o, --output FILE    Output to file. [Default: stdout]
 ```
@@ -79,6 +83,14 @@ For 'medium' security level, the following algorithm is executed upon network ch
 - Else if the primary network interface becomes Cellular, leave any existing VPN connection up, but do not reconnect on demand.
 - Else, unconditionally bring up the VPN connection on the next network attempt.
 
+### URL Probe
+
+Apple provides a `URLStringProbe` test condition where a VPN connection will only be established, if and only if a specified URL is successfully fetched (returning a 200 HTTP status code) without redirection.
+
+This feature can be enabled for statistical and maintenance-protection reasons. Otherwise, it can also workaround a circular limitation with unsecured wireless captive portals. See Known Issues below for further elaboration.
+
+By enabling this option, you will need to reliably and quickly respond with HTTP status code 200 at the URL string supplied.
+
 ## Examples
 
 ### Typical Usage
@@ -235,6 +247,7 @@ Output:
 	--p12file path/to/john-ipad.p12 --p12pass p12passphrase john ipad
 
 Output similar to above:
+
 ```
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -303,16 +316,28 @@ Output similar to above:
 
 - "Not connected to Internet" error/behaviour when VPN should be established.
 
+	Diagnosis: Load any site in Safari. An error message "Safari cannot open the page because your iPhone is not connected to the Internet" will be presented.
+
 	There is a bug in the iOS/OS X network routing code that hangs the routing system, preventing the gateway or IP address from being set. This happens more frequently when the tunnel is brought up/down more frequently.
 
 	Workaround: Hard-restart iOS. Press and hold down both the home and sleep/wake buttons until iOS turns off and back on with the Apple boot up screen. Release when the Apple boot up screen appears.
 
 - Weird Rapid Connecting…/Disconnected behaviour.
 
+	Diagnosis: VPN status in Settings.app rapid alternates between Connecting… and Disconnected.
+
 	Usually happens when the VoD component is stuck in an infinite loop. Not sure what triggers it.
 
 	Workaround: Hard-restart iOS. Press and hold down both the home and sleep/wake buttons until iOS turns off and back on with the Apple boot up screen. Release when the Apple boot up screen appears.
 
+- Cannot load Captive Portals (Hotspots on unsecured Wireless networks).
+
+	Some unsecured hotspots require navigating certain webpages before full access to the internet is available. This requirement blocks VPN connections and iOS will also block captive portal access, waiting on the VPN connection. This circular dependency results in no internet access.
+
+	Workaround: Manually disable VPN-on-Demand in Settings.app > VPN > Server (i) option screen. Reenable only after Internet access is available.
+
+	Solution: Implement `URLStringProbe` where, if and only if this URL is successfully fetched (returning a 200 HTTP status code) without redirection, will the VPN service be required, relied on, and brought up. Enable with the `--url-probe` flag.
+
 ## TODO
 
 - Config file to specify global options, such as `--cafile`, `--tafile`, `--host`, `--[un]trusted-ssids`.
@@ -320,11 +345,11 @@ Output similar to above:
 
 	The same UUID should be used for profile updates, so that iOS knows which profile to replace, especially in MDM environments.
 
-	Custom overrides now supported for UUIDs.
+	Custom UUID overrides now supported via `--{profile,vpn,cert}-uuid`.
 
 - Adopt OpenVPN parameters from an OpenVPN-compatible client.conf input file.
 
-	Implemented, but lacks support for inline `<ca|tls-auth>` data enclosures.
+	Implemented, but does not support inline `<ca|tls-auth>` data enclosures, and command line flags (that are required) override config file values.
 
 - Sign/Encrypt .mobileconfig.
 

data/bin/ovpnmcgen.rb

@@ -32,6 +32,7 @@ command :generate do |c|
   c.option '--cert-uuid UUID', 'Override a Certificate payload UUID.'
   c.option '-t', '--trusted-ssids SSIDS', Array, 'List of comma-separated trusted SSIDs.'
   c.option '-u', '--untrusted-ssids SSIDS', Array, 'List of comma-separated untrusted SSIDs.'
+  c.option '--url-probe URL', 'This URL must return HTTP status 200, without redirection, before the VPN service will try establishing.'
   c.option '--ovpnconfigfile FILE', 'Path to OpenVPN client config file.'
   c.option '-o', '--output FILE', 'Output to file. [Default: stdout]'
   c.action do |args, options|
@@ -60,6 +61,7 @@ command :generate do |c|
     }
     inputs[:ovpnconfigfile] = options.ovpnconfigfile if options.ovpnconfigfile
     inputs[:tafile] = options.tafile if options.tafile
+    inputs[:url_probe] = options.url_probe if options.url_probe
 
     unless options.output
       puts Ovpnmcgen.generate(inputs)

data/features/gen_basic.feature

@@ -122,6 +122,35 @@ Feature: Basic Generate Functionality
 			\s*<integer>0</integer>
 			"""
 
+	Scenario: The url-probe flag is set.
+		When I run `ovpnmcgen.rb g --host aruba.cucumber.org --cafile ca.crt --p12file p12file.p12 --url-probe 'https://url.to.probe/' cucumber aruba`
+		Then the output should match:
+			"""
+			<key>URLStringProbe</key>
+			\s*<string>https://url.to.probe/</string>
+			"""
+		And the output should match:
+			"""
+			<dict>
+			\s*<key>Action</key>
+			\s*<string>Ignore</string>
+			\s*</dict>
+			"""
+
+	Scenario: The url-probe flag is not set.
+		When I run `ovpnmcgen.rb g --host aruba.cucumber.org --cafile ca.crt --p12file p12file.p12 cucumber aruba`
+		Then the output should not contain:
+			"""
+			<key>URLStringProbe</key>
+			"""
+		And the output should not match:
+			"""
+			<dict>
+			\s*<key>Action</key>
+			\s*<string>Ignore</string>
+			\s*</dict>
+			"""
+
 	Scenario: The [un]trusted-ssids flags are set.
 		When I run `ovpnmcgen.rb g --host aruba.cucumber.org --cafile ca.crt --p12file p12file.p12 --trusted-ssids trusted1,trusted2 --untrusted-ssids evil3,evil4 cucumber aruba`
 		Then the output should match:

data/lib/ovpnmcgen/version.rb

@@ -1,4 +1,4 @@
 module Ovpnmcgen
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
   SUMMARY = "An OpenVPN iOS Configuration Profile (.mobileconfig) Utility"
 end

data/lib/ovpnmcgen.rb

@@ -63,10 +63,7 @@ module Ovpnmcgen
       'SSIDMatch' => untrusted_ssids,
       'Action' => 'Connect'
     }
-    vpnOnDemandRules << vodTrusted if trusted_ssids
-    vpnOnDemandRules << vodUntrusted if untrusted_ssids
-
-    vpnOnDemandRules << { # Untrust all Wifi
+    vodWifiOnly = { # Untrust all Wifi
       'InterfaceTypeMatch' => 'WiFi',
       'Action' => case inputs[:security_level]
         when 'paranoid', 'high'
@@ -74,7 +71,8 @@ module Ovpnmcgen
         else # medium
           'Ignore'
         end
-    } << { # Trust Cellular
+    }
+    vodCellularOnly = { # Trust Cellular
       'InterfaceTypeMatch' => 'Cellular',
       'Action' => case inputs[:security_level]
           when 'paranoid'
@@ -84,10 +82,21 @@ module Ovpnmcgen
           else # medium
             'Disconnect'
           end
-    } << { # Default catch-all
+    }
+    vodDefault = { # Default catch-all
       'Action' => 'Connect'
     }
 
+    # Insert URLStringProbe conditions when enabled with --url-probe
+    vodTrusted['URLStringProbe'] = vodUntrusted['URLStringProbe'] = vodWifiOnly['URLStringProbe'] = vodCellularOnly['URLStringProbe'] = vodDefault['URLStringProbe'] = inputs[:url_probe] if inputs[:url_probe]
+
+    vpnOnDemandRules << vodTrusted if trusted_ssids
+    vpnOnDemandRules << vodUntrusted if untrusted_ssids
+    vpnOnDemandRules << vodWifiOnly << vodCellularOnly << vodDefault
+    vpnOnDemandRules << { # Default catch-all when URLStringProbe is enabled and returns false to prevent circular race.
+      'Action' => 'Ignore'
+      } if inputs[:url_probe]
+
     cert = {
       'Password' => p12pass,
       'PayloadCertificateFileName' => "#{user}-#{device}.p12",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ovpnmcgen.rb
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Ronald Ip
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-19 00:00:00.000000000 Z
+date: 2014-05-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler