Skip to content

Commit 1e8a9c5

Browse files
jackivanovjackivanov
authored
Generate mobileconfigs for WireGuard (trailofbits#1698)
* Generate mobileconfigs for WireGuard * add xmllint to wireguard profiles * Enable onDemand prompts for WireGuard * linting
1 parent 512b566 commit 1e8a9c5

File tree

6 files changed

+174
-34
lines changed

6 files changed

+174
-34
lines changed

‎input.yml

Lines changed: 34 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -52,42 +52,43 @@
5252
when:
5353
- server_name is undefined
5454
- algo_provider != "local"
55-
- block:
56-
- name: Cellular On Demand prompt
57-
pause:
58-
prompt: |
59-
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to cellular networks?
60-
[y/N]
61-
register: _ondemand_cellular
62-
when: ondemand_cellular is undefined
6355

64-
- name: Wi-Fi On Demand prompt
65-
pause:
66-
prompt: |
67-
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to Wi-Fi?
68-
[y/N]
69-
register: _ondemand_wifi
70-
when: ondemand_wifi is undefined
56+
- name: Cellular On Demand prompt
57+
pause:
58+
prompt: |
59+
Do you want macOS/iOS clients to enable "Connect On Demand" when connected to cellular networks?
60+
[y/N]
61+
register: _ondemand_cellular
62+
when: ondemand_cellular is undefined
63+
64+
- name: Wi-Fi On Demand prompt
65+
pause:
66+
prompt: |
67+
Do you want macOS/iOS clients to enable "Connect On Demand" when connected to Wi-Fi?
68+
[y/N]
69+
register: _ondemand_wifi
70+
when: ondemand_wifi is undefined
7171

72-
- name: Trusted Wi-Fi networks prompt
73-
pause:
74-
prompt: |
75-
List the names of any trusted Wi-Fi networks where macOS/iOS IPsec clients should not use "Connect On Demand"
76-
(e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
77-
register: _ondemand_wifi_exclude
78-
when:
79-
- ondemand_wifi_exclude is undefined
80-
- (ondemand_wifi|default(false)|bool) or
81-
(booleans_map[_ondemand_wifi.user_input|default(omit)]|default(false))
72+
- name: Trusted Wi-Fi networks prompt
73+
pause:
74+
prompt: |
75+
List the names of any trusted Wi-Fi networks where macOS/iOS clients should not use "Connect On Demand"
76+
(e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
77+
register: _ondemand_wifi_exclude
78+
when:
79+
- ondemand_wifi_exclude is undefined
80+
- (ondemand_wifi|default(false)|bool) or
81+
(booleans_map[_ondemand_wifi.user_input|default(omit)]|default(false))
8282

83-
- name: Retain the PKI prompt
84-
pause:
85-
prompt: |
86-
Do you want to retain the keys (PKI)? (required to add users in the future, but less secure)
87-
[y/N]
88-
register: _store_pki
89-
when: store_pki is undefined
90-
when: ipsec_enabled
83+
- name: Retain the PKI prompt
84+
pause:
85+
prompt: |
86+
Do you want to retain the keys (PKI)? (required to add users in the future, but less secure)
87+
[y/N]
88+
register: _store_pki
89+
when:
90+
- store_pki is undefined
91+
- ipsec_enabled
9192

9293
- name: DNS adblocking prompt
9394
pause:

‎roles/wireguard/tasks/main.yml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
- "{{ wireguard_pki_path }}/preshared"
99
- "{{ wireguard_pki_path }}/private"
1010
- "{{ wireguard_pki_path }}/public"
11-
- "{{ wireguard_config_path }}"
11+
- "{{ wireguard_config_path }}/apple/ios"
12+
- "{{ wireguard_config_path }}/apple/macos"
1213
delegate_to: localhost
1314
become: false
1415

@@ -51,6 +52,13 @@
5152
vars:
5253
index: "{{ item.0 }}"
5354

55+
- include_tasks: mobileconfig.yml
56+
loop:
57+
- ios
58+
- macos
59+
loop_control:
60+
loop_var: system
61+
5462
- name: Generate QR codes
5563
shell: >
5664
umask 077;

‎roles/wireguard/tasks/mobileconfig.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
- name: WireGuard apple mobileconfig generated
3+
template:
4+
src: mobileconfig.j2
5+
dest: "{{ wireguard_config_path }}/apple/{{ system }}/{{ item.1 }}.mobileconfig"
6+
mode: "0600"
7+
with_indexed_items: "{{ wireguard_users }}"
8+
when: item.1 in users
9+
vars:
10+
index: "{{ item.0 }}"

‎roles/wireguard/templates/mobileconfig.j2

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#jinja2:lstrip_blocks: True
2+
<?xml version="1.0" encoding="UTF-8"?>
3+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
4+
<plist version="1.0">
5+
<dict>
6+
<key>PayloadContent</key>
7+
<array>
8+
{% include 'vpn-dict.j2' %}
9+
</array>
10+
<key>PayloadDisplayName</key>
11+
<string>AlgoVPN {{ algo_server_name }} WireGuard</string>
12+
<key>PayloadIdentifier</key>
13+
<string>donut.local.{{ 500000 | random | to_uuid | upper }}</string>
14+
<key>PayloadOrganization</key>
15+
<string>AlgoVPN</string>
16+
<key>PayloadRemovalDisallowed</key>
17+
<false/>
18+
<key>PayloadType</key>
19+
<string>Configuration</string>
20+
<key>PayloadUUID</key>
21+
<string>{{ 400000 | random | to_uuid | upper }}</string>
22+
<key>PayloadVersion</key>
23+
<integer>1</integer>
24+
</dict>
25+
</plist>

‎roles/wireguard/templates/vpn-dict.j2

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
<dict>
2+
<key>IPv4</key>
3+
<dict>
4+
<key>OverridePrimary</key>
5+
<integer>1</integer>
6+
</dict>
7+
<key>PayloadDescription</key>
8+
<string>Configures VPN settings</string>
9+
<key>PayloadDisplayName</key>
10+
<string>{{ algo_server_name }}</string>
11+
<key>PayloadIdentifier</key>
12+
<string>com.apple.vpn.managed.{{ algo_server_name + system | to_uuid | upper }}</string>
13+
<key>PayloadType</key>
14+
<string>com.apple.vpn.managed</string>
15+
<key>PayloadUUID</key>
16+
<string>{{ algo_server_name + system | to_uuid | upper }}</string>
17+
<key>PayloadVersion</key>
18+
<integer>1</integer>
19+
<key>Proxies</key>
20+
<dict>
21+
<key>HTTPEnable</key>
22+
<integer>0</integer>
23+
<key>HTTPSEnable</key>
24+
<integer>0</integer>
25+
</dict>
26+
<key>UserDefinedName</key>
27+
<string>AlgoVPN {{ algo_server_name }}</string>
28+
<key>VPN</key>
29+
<dict>
30+
<key>OnDemandEnabled</key>
31+
<integer>{{ 1 if algo_ondemand_wifi or algo_ondemand_cellular else 0 }}</integer>
32+
<key>OnDemandRules</key>
33+
<array>
34+
{% if algo_ondemand_wifi or algo_ondemand_cellular %}
35+
{% if algo_ondemand_wifi_exclude|b64decode != '_null' %}
36+
{% set WIFI_EXCLUDE_LIST = (algo_ondemand_wifi_exclude|b64decode|string).split(',') %}
37+
<dict>
38+
<key>Action</key>
39+
<string>Disconnect</string>
40+
<key>InterfaceTypeMatch</key>
41+
<string>WiFi</string>
42+
<key>SSIDMatch</key>
43+
<array>
44+
{% for network_name in WIFI_EXCLUDE_LIST %}
45+
<string>{{ network_name|e }}</string>
46+
{% endfor %}
47+
</array>
48+
</dict>
49+
{% endif %}
50+
<dict>
51+
<key>Action</key>
52+
{% if algo_ondemand_wifi %}
53+
<string>Connect</string>
54+
{% else %}
55+
<string>Disconnect</string>
56+
{% endif %}
57+
<key>InterfaceTypeMatch</key>
58+
<string>WiFi</string>
59+
<key>URLStringProbe</key>
60+
<string>http://captive.apple.com/hotspot-detect.html</string>
61+
</dict>
62+
<dict>
63+
<key>Action</key>
64+
{% if algo_ondemand_cellular %}
65+
<string>Connect</string>
66+
{% else %}
67+
<string>Disconnect</string>
68+
{% endif %}
69+
<key>InterfaceTypeMatch</key>
70+
<string>Cellular</string>
71+
<key>URLStringProbe</key>
72+
<string>http://captive.apple.com/hotspot-detect.html</string>
73+
</dict>
74+
{% endif %}
75+
<dict>
76+
<key>Action</key>
77+
<string>{{ 'Disconnect' if algo_ondemand_wifi or algo_ondemand_cellular else 'Connect' }}</string>
78+
</dict>
79+
</array>
80+
<key>AuthenticationMethod</key>
81+
<string>Password</string>
82+
<key>RemoteAddress</key>
83+
<string>{{ IP_subject_alt_name }}:{{ wireguard_port }}</string>
84+
</dict>
85+
<key>VPNSubType</key>
86+
<string>com.wireguard.{{ system }}</string>
87+
<key>VPNType</key>
88+
<string>VPN</string>
89+
<key>VendorConfig</key>
90+
<dict>
91+
<key>WgQuickConfig</key>
92+
<string>{{- lookup('template', 'client.conf.j2') | indent(8) }}</string>
93+
</dict>
94+
</dict>

‎tests/wireguard-client.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
set -euxo pipefail
44

5+
xmllint --noout ./configs/10.0.8.100/wireguard/apple/*/*.mobileconfig
6+
57
crudini --set configs/10.0.8.100/wireguard/user1.conf Interface Table off
68

79
wg-quick up configs/10.0.8.100/wireguard/user1.conf

0 commit comments

Comments
 (0)