From 1e8a9c5cf1bd0b443958f7eb40207504b817e534 Mon Sep 17 00:00:00 2001 From: Jack Ivanov <17044561+jackivanov@users.noreply.github.com> Date: Wed, 12 Feb 2020 08:31:44 +0100 Subject: [PATCH] Generate mobileconfigs for WireGuard (#1698) * Generate mobileconfigs for WireGuard * add xmllint to wireguard profiles * Enable onDemand prompts for WireGuard * linting --- input.yml | 67 ++++++++-------- roles/wireguard/tasks/main.yml | 10 ++- roles/wireguard/tasks/mobileconfig.yml | 10 +++ roles/wireguard/templates/mobileconfig.j2 | 25 ++++++ roles/wireguard/templates/vpn-dict.j2 | 94 +++++++++++++++++++++++ tests/wireguard-client.sh | 2 + 6 files changed, 174 insertions(+), 34 deletions(-) create mode 100644 roles/wireguard/tasks/mobileconfig.yml create mode 100644 roles/wireguard/templates/mobileconfig.j2 create mode 100644 roles/wireguard/templates/vpn-dict.j2 diff --git a/input.yml b/input.yml index cc1794b..3ee6257 100644 --- a/input.yml +++ b/input.yml @@ -52,42 +52,43 @@ when: - server_name is undefined - algo_provider != "local" - - block: - - name: Cellular On Demand prompt - pause: - prompt: | - Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to cellular networks? - [y/N] - register: _ondemand_cellular - when: ondemand_cellular is undefined - - name: Wi-Fi On Demand prompt - pause: - prompt: | - Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to Wi-Fi? - [y/N] - register: _ondemand_wifi - when: ondemand_wifi is undefined + - name: Cellular On Demand prompt + pause: + prompt: | + Do you want macOS/iOS clients to enable "Connect On Demand" when connected to cellular networks? + [y/N] + register: _ondemand_cellular + when: ondemand_cellular is undefined - - name: Trusted Wi-Fi networks prompt - pause: - prompt: | - List the names of any trusted Wi-Fi networks where macOS/iOS IPsec clients should not use "Connect On Demand" - (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi) - register: _ondemand_wifi_exclude - when: - - ondemand_wifi_exclude is undefined - - (ondemand_wifi|default(false)|bool) or - (booleans_map[_ondemand_wifi.user_input|default(omit)]|default(false)) + - name: Wi-Fi On Demand prompt + pause: + prompt: | + Do you want macOS/iOS clients to enable "Connect On Demand" when connected to Wi-Fi? + [y/N] + register: _ondemand_wifi + when: ondemand_wifi is undefined - - name: Retain the PKI prompt - pause: - prompt: | - Do you want to retain the keys (PKI)? (required to add users in the future, but less secure) - [y/N] - register: _store_pki - when: store_pki is undefined - when: ipsec_enabled + - name: Trusted Wi-Fi networks prompt + pause: + prompt: | + List the names of any trusted Wi-Fi networks where macOS/iOS clients should not use "Connect On Demand" + (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi) + register: _ondemand_wifi_exclude + when: + - ondemand_wifi_exclude is undefined + - (ondemand_wifi|default(false)|bool) or + (booleans_map[_ondemand_wifi.user_input|default(omit)]|default(false)) + + - name: Retain the PKI prompt + pause: + prompt: | + Do you want to retain the keys (PKI)? (required to add users in the future, but less secure) + [y/N] + register: _store_pki + when: + - store_pki is undefined + - ipsec_enabled - name: DNS adblocking prompt pause: diff --git a/roles/wireguard/tasks/main.yml b/roles/wireguard/tasks/main.yml index 4e38762..7e1fbc1 100644 --- a/roles/wireguard/tasks/main.yml +++ b/roles/wireguard/tasks/main.yml @@ -8,7 +8,8 @@ - "{{ wireguard_pki_path }}/preshared" - "{{ wireguard_pki_path }}/private" - "{{ wireguard_pki_path }}/public" - - "{{ wireguard_config_path }}" + - "{{ wireguard_config_path }}/apple/ios" + - "{{ wireguard_config_path }}/apple/macos" delegate_to: localhost become: false @@ -51,6 +52,13 @@ vars: index: "{{ item.0 }}" + - include_tasks: mobileconfig.yml + loop: + - ios + - macos + loop_control: + loop_var: system + - name: Generate QR codes shell: > umask 077; diff --git a/roles/wireguard/tasks/mobileconfig.yml b/roles/wireguard/tasks/mobileconfig.yml new file mode 100644 index 0000000..0e192b4 --- /dev/null +++ b/roles/wireguard/tasks/mobileconfig.yml @@ -0,0 +1,10 @@ +--- +- name: WireGuard apple mobileconfig generated + template: + src: mobileconfig.j2 + dest: "{{ wireguard_config_path }}/apple/{{ system }}/{{ item.1 }}.mobileconfig" + mode: "0600" + with_indexed_items: "{{ wireguard_users }}" + when: item.1 in users + vars: + index: "{{ item.0 }}" diff --git a/roles/wireguard/templates/mobileconfig.j2 b/roles/wireguard/templates/mobileconfig.j2 new file mode 100644 index 0000000..6c3f33e --- /dev/null +++ b/roles/wireguard/templates/mobileconfig.j2 @@ -0,0 +1,25 @@ +#jinja2:lstrip_blocks: True + + + + + PayloadContent + + {% include 'vpn-dict.j2' %} + + PayloadDisplayName + AlgoVPN {{ algo_server_name }} WireGuard + PayloadIdentifier + donut.local.{{ 500000 | random | to_uuid | upper }} + PayloadOrganization + AlgoVPN + PayloadRemovalDisallowed + + PayloadType + Configuration + PayloadUUID + {{ 400000 | random | to_uuid | upper }} + PayloadVersion + 1 + + diff --git a/roles/wireguard/templates/vpn-dict.j2 b/roles/wireguard/templates/vpn-dict.j2 new file mode 100644 index 0000000..6444df9 --- /dev/null +++ b/roles/wireguard/templates/vpn-dict.j2 @@ -0,0 +1,94 @@ + + IPv4 + + OverridePrimary + 1 + + PayloadDescription + Configures VPN settings + PayloadDisplayName + {{ algo_server_name }} + PayloadIdentifier + com.apple.vpn.managed.{{ algo_server_name + system | to_uuid | upper }} + PayloadType + com.apple.vpn.managed + PayloadUUID + {{ algo_server_name + system | to_uuid | upper }} + PayloadVersion + 1 + Proxies + + HTTPEnable + 0 + HTTPSEnable + 0 + + UserDefinedName + AlgoVPN {{ algo_server_name }} + VPN + + OnDemandEnabled + {{ 1 if algo_ondemand_wifi or algo_ondemand_cellular else 0 }} + OnDemandRules + + {% if algo_ondemand_wifi or algo_ondemand_cellular %} + {% if algo_ondemand_wifi_exclude|b64decode != '_null' %} + {% set WIFI_EXCLUDE_LIST = (algo_ondemand_wifi_exclude|b64decode|string).split(',') %} + + Action + Disconnect + InterfaceTypeMatch + WiFi + SSIDMatch + + {% for network_name in WIFI_EXCLUDE_LIST %} + {{ network_name|e }} + {% endfor %} + + + {% endif %} + + Action + {% if algo_ondemand_wifi %} + Connect + {% else %} + Disconnect + {% endif %} + InterfaceTypeMatch + WiFi + URLStringProbe + http://captive.apple.com/hotspot-detect.html + + + Action + {% if algo_ondemand_cellular %} + Connect + {% else %} + Disconnect + {% endif %} + InterfaceTypeMatch + Cellular + URLStringProbe + http://captive.apple.com/hotspot-detect.html + + {% endif %} + + Action + {{ 'Disconnect' if algo_ondemand_wifi or algo_ondemand_cellular else 'Connect' }} + + + AuthenticationMethod + Password + RemoteAddress + {{ IP_subject_alt_name }}:{{ wireguard_port }} + + VPNSubType + com.wireguard.{{ system }} + VPNType + VPN + VendorConfig + + WgQuickConfig + {{- lookup('template', 'client.conf.j2') | indent(8) }} + + diff --git a/tests/wireguard-client.sh b/tests/wireguard-client.sh index 46b4603..cc7d652 100755 --- a/tests/wireguard-client.sh +++ b/tests/wireguard-client.sh @@ -2,6 +2,8 @@ set -euxo pipefail +xmllint --noout ./configs/10.0.8.100/wireguard/apple/*/*.mobileconfig + crudini --set configs/10.0.8.100/wireguard/user1.conf Interface Table off wg-quick up configs/10.0.8.100/wireguard/user1.conf