Enhance PS1 script (trailofbits#510)

update docs

Update README.md

update readme

Author: gunph1ld

README.md

@@ -102,31 +102,16 @@ No version of Android supports IKEv2. Install the [strongSwan VPN Client for And
 
 ### Windows
 
-Windows clients have a more complicated setup than most others. Follow the steps below to set one up:
+#### Scripted installation
 
-1. Copy the CA certificate (`cacert.pem`), user certificate (`$user.p12`), and the user PowerShell script (`windows_$user.ps1`) to the client computer.
-2. Import the CA certificate to the local machine Trusted Root certificate store.
-3. Open PowerShell as Administrator. Navigate to your copied files.
-4. If you haven't already, you will need to change the Execution Policy to allow unsigned scripts to run.
-
-```powershell
-Set-ExecutionPolicy Unrestricted -Scope CurrentUser
+Copy your powershell script `windows_{username}.ps1` and p12 certificate `{username}.p12` to the Windows machine and run the following command as Administrator to configure the VPN connection.
 ```
-
-5. In the same PowerShell window, run the included PowerShell script to import the user certificate, set up a VPN connection, and activate stronger ciphers on it.
-6. After you execute the user script, set the Execution Policy back before you close the PowerShell window.
-
-```powershell
-Set-ExecutionPolicy Restricted -Scope CurrentUser
+powershell -ExecutionPolicy ByPass -File windows_{username}.ps1 Add
 ```
 
-Your VPN is now installed and ready to use.
+#### Manual installation
 
-If you want to perform these steps by hand, you will need to import the user certificate to the Personal certificate store, add an IKEv2 connection in the network settings, then activate stronger ciphers on it via the following PowerShell script:
-
-```powershell
-Set-VpnConnectionIPsecConfiguration -ConnectionName "Algo" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES128 -IntegrityCheckMethod SHA384 -DHGroup ECP256 -PfsGroup ECP256
-```
+See the [Windows setup instructions](/docs/client-windows.md) for more a more detailed walkthrough.
 
 ### Linux Network Manager Clients (e.g., Ubuntu, Debian, or Fedora Desktop)
 

docs/client-windows.md

@@ -0,0 +1,27 @@
+# Windows client manual setup
+
+Windows clients have a more complicated setup than most others. Follow the steps below to set one up:
+
+1. Copy the CA certificate (`cacert.pem`), user certificate (`$user.p12`), and the user PowerShell script (`windows_$user.ps1`) to the client computer.
+2. Import the CA certificate to the local machine Trusted Root certificate store.
+3. Open PowerShell as Administrator. Navigate to your copied files.
+4. If you haven't already, you will need to change the Execution Policy to allow unsigned scripts to run.
+
+```powershell
+Set-ExecutionPolicy Unrestricted -Scope CurrentUser
+```
+
+5. In the same PowerShell window, run the included PowerShell script to import the user certificate, set up a VPN connection, and activate stronger ciphers on it.
+6. After you execute the user script, set the Execution Policy back before you close the PowerShell window.
+
+```powershell
+Set-ExecutionPolicy Restricted -Scope CurrentUser
+```
+
+Your VPN is now installed and ready to use.
+
+If you want to perform these steps by hand, you will need to import the user certificate to the Personal certificate store, add an IKEv2 connection in the network settings, then activate stronger ciphers on it via the following PowerShell script:
+
+```powershell
+Set-VpnConnectionIPsecConfiguration -ConnectionName "Algo" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES128 -IntegrityCheckMethod SHA384 -DHGroup ECP256 -PfsGroup ECP256
+```

roles/vpn/templates/client_windows.ps1.j2

@@ -1,3 +1,18 @@
-certutil -f -p {{ easyrsa_p12_export_password }} -importpfx .\{{ item }}.p12
-Add-VpnConnection -name "Algo VPN {{ IP_subject_alt_name }} IKEv2" -ServerAddress "{{ IP_subject_alt_name }}" -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required
-Set-VpnConnectionIPsecConfiguration -ConnectionName "Algo VPN {{ IP_subject_alt_name }} IKEv2" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES128 -IntegrityCheckMethod SHA384 -DHGroup ECP256 -PfsGroup ECP256
+
+function AddAlgoVPN {
+  certutil -f -p {{ easyrsa_p12_export_password }} -importpfx .\{{ item }}.p12
+  Add-VpnConnection -name "Algo VPN {{ IP_subject_alt_name }} IKEv2" -ServerAddress "{{ IP_subject_alt_name }}" -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required
+  Set-VpnConnectionIPsecConfiguration -ConnectionName "Algo VPN {{ IP_subject_alt_name }} IKEv2" -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES128 -IntegrityCheckMethod SHA384 -DHGroup ECP256 -PfsGroup ECP256  -Force
+}
+
+function RemoveAlgoVPN {
+  Get-ChildItem cert:LocalMachine/Root | Where-Object { $_.Subject -match '^CN={{ IP_subject_alt_name }}$' -and $_.Issuer -match '^CN={{ IP_subject_alt_name }}$' } | Remove-Item
+  Get-ChildItem cert:LocalMachine/My | Where-Object { $_.Subject -match '^CN={{ item }}$' -and $_.Issuer -match '^CN={{ IP_subject_alt_name }}$' } | Remove-Item
+  Remove-VpnConnection -name "Algo VPN {{ IP_subject_alt_name }} IKEv2" -Force
+}
+
+switch ($args[0]) {
+  "Add" { AddAlgoVPN }
+  "Remove" { RemoveAlgoVPN }
+  default { Write-Host Usage: $MyInvocation.MyCommand.Name "(Add|Remove)" }
+}