Skip to content

Commit 5fea37d

Browse files
rvm-peercodervm-peercode
committed
Support data-ciphers and data-ciphers-fallback options
These are new in OpenVPN 2.5. Since they are not supported in OpenVPN 2.4, they aren't produced in the output unless they are changed from the default.
1 parent 7ce40c3 commit 5fea37d

File tree

7 files changed

+54
-0
lines changed

7 files changed

+54
-0
lines changed

‎REFERENCE.md

+20
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,8 @@ The following parameters are available in the `openvpn::client` defined type:
451451
* [`remote_host`](#remote_host)
452452
* [`cipher`](#cipher)
453453
* [`tls_cipher`](#tls_cipher)
454+
* [`data_ciphers`](#data_ciphers)
455+
* [`data_ciphers_fallback`](#data_ciphers_fallback)
454456
* [`resolv_retry`](#resolv_retry)
455457
* [`auth_retry`](#auth_retry)
456458
* [`verb`](#verb)
@@ -575,6 +577,22 @@ TLS Ciphers to use
575577

576578
Default value: `'TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256'`
577579

580+
##### <a name="data_ciphers"></a>`data_ciphers`
581+
582+
Data type: `String`
583+
584+
Ciphers to allow for packet encryption
585+
586+
Default value: `'AES-256-GCM:AES-128-GCM'`
587+
588+
##### <a name="data_ciphers_fallback"></a>`data_ciphers_fallback`
589+
590+
Data type: `String`
591+
592+
Cipher that is used to fall back to if OpenVPN cannot determine which cipher the peer is willing to use.
593+
594+
Default value: ``undef``
595+
578596
##### <a name="resolv_retry"></a>`resolv_retry`
579597

580598
Data type: `String`
@@ -1012,6 +1030,8 @@ The following parameters are available in the `openvpn::server` defined type:
10121030
* [`verb`](#verb)
10131031
* [`cipher`](#cipher)
10141032
* [`tls_cipher`](#tls_cipher)
1033+
* [`data_ciphers`](#data_ciphers)
1034+
* [`data_ciphers_fallback`](#data_ciphers_fallback)
10151035
* [`persist_key`](#persist_key)
10161036
* [`persist_tun`](#persist_tun)
10171037
* [`key_expire`](#key_expire)

‎manifests/client.pp

+4
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
# @param remote_host The IP or hostname of the openvpn server service.
1515
# @param cipher Cipher to use for packet encryption
1616
# @param tls_cipher TLS Ciphers to use
17+
# @param data_ciphers Ciphers to allow for packet encryption
18+
# @param data_ciphers_fallback Cipher to use if peer cipher config cannot be determined
1719
# @param resolv_retry How many seconds should the openvpn client try to resolve the server's hostname
1820
# @param auth_retry Controls how OpenVPN responds to username/password verification errors such as the client-side response to an AUTH_FAILED message from the server or verification failure of the private key password.
1921
# @param verb Level of logging verbosity
@@ -61,6 +63,8 @@
6163
Boolean $pam = false,
6264
String $cipher = 'AES-256-GCM',
6365
String $tls_cipher = 'TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256',
66+
String $data_ciphers = 'AES-256-GCM:AES-128-GCM',
67+
String $data_ciphers_fallback = undef,
6468
Boolean $authuserpass = false,
6569
Hash $setenv = {},
6670
Hash $setenv_safe = {},

‎manifests/server.pp

+4
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@
7171
# @param verb Level of logging verbosity
7272
# @param cipher Cipher to use for packet encryption
7373
# @param tls_cipher TLS Ciphers to use
74+
# @param data_ciphers Ciphers to allow for packet encryption
75+
# @param data_ciphers_fallback Cipher to use if peer cipher config cannot be determined
7476
# @param persist_key Try to retain access to resources that may be unavailable because of privilege downgrades
7577
# @param persist_tun Try to retain access to resources that may be unavailable because of privilege downgrades
7678
# @param key_expire The number of days to certify the server certificate for
@@ -225,6 +227,8 @@
225227
Optional[String] $verb = undef,
226228
String $cipher = 'AES-256-GCM',
227229
String $tls_cipher = 'TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256',
230+
String $data_ciphers = 'AES-256-GCM:AES-128-GCM',
231+
String $data_ciphers_fallback = undef,
228232
Boolean $persist_key = false,
229233
Boolean $persist_tun = false,
230234
Boolean $tls_auth = false,

‎spec/defines/openvpn_client_spec.rb

+4
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,8 @@
152152
'persist_tun' => false,
153153
'cipher' => 'AES-256-GCM',
154154
'tls_cipher' => 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA',
155+
'data_ciphers' => 'AES-256-GCM',
156+
'data_ciphers_fallback' => 'AES-128-GCM',
155157
'port' => '123',
156158
'proto' => 'udp',
157159
'remote_host' => %w[somewhere galaxy],
@@ -187,6 +189,8 @@
187189
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^setenv_safe\s+FORWARD_COMPATIBLE\s+1$}) }
188190
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^cipher\s+AES-256-GCM$}) }
189191
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^tls-cipher\s+TLS-DHE-RSA-WITH-AES-256-CBC-SHA$}) }
192+
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^data-ciphers\s+AES-256-GCM$}) }
193+
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^data-ciphers-fallback\s+AES-128-GCM$}) }
190194
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^tls-client$}) }
191195
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^verify-x509-name\s+"test_server"\s+name$}) }
192196
it { is_expected.to contain_file("#{server_directory}/test_server/download-configs/test_client/test_client.conf").with_content(%r{^sndbuf\s+393216$}) }

‎spec/defines/openvpn_server_spec.rb

+10
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,8 @@
409409
'verb' => 'mute',
410410
'cipher' => 'DES-CBC',
411411
'tls_cipher' => 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA',
412+
'data_ciphers' => 'AES-256-GCM',
413+
'data_ciphers_fallback' => 'AES-128-GCM',
412414
'persist_key' => true,
413415
'persist_tun' => true,
414416
'duplicate_cn' => true,
@@ -449,6 +451,8 @@
449451
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^management\s+1.3.3.7 1337$}) }
450452
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^verb mute$}) }
451453
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^cipher DES-CBC$}) }
454+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^data-ciphers\s+AES-256-GCM$}) }
455+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^data-ciphers-fallback\s+AES-128-GCM$}) }
452456
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^tls-cipher\s+TLS-DHE-RSA-WITH-AES-256-CBC-SHA$}) }
453457
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^persist-key$}) }
454458
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^persist-tun$}) }
@@ -569,6 +573,8 @@
569573
'verb' => 'mute',
570574
'cipher' => 'DES-CBC',
571575
'tls_cipher' => 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA',
576+
'data_ciphers' => 'AES-256-GCM',
577+
'data_ciphers_fallback' => 'AES-128-GCM',
572578
'persist_key' => true,
573579
'persist_tun' => true,
574580
'duplicate_cn' => true,
@@ -687,6 +693,8 @@
687693

688694
it { is_expected.not_to contain_file("#{server_directory}/test_server.conf").with_content(%r{verb}) }
689695
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{cipher AES-256-GCM}) }
696+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^data-ciphers\s+AES-256-GCM$}) }
697+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^data-ciphers-fallback\s+AES-128-GCM$}) }
690698
it { is_expected.not_to contain_file("#{server_directory}/test_server.conf").with_content(%r{persist-key}) }
691699
it { is_expected.not_to contain_file("#{server_directory}/test_server.conf").with_content(%r{persist-tun}) }
692700
it { is_expected.not_to contain_file("#{server_directory}/test_server.conf").with_content(%r{^duplicate-cn$}) }
@@ -957,6 +965,8 @@
957965
'verb' => 'mute',
958966
'cipher' => 'DES-CBC',
959967
'tls_cipher' => 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA',
968+
'data_ciphers' => 'AES-256-GCM',
969+
'data_ciphers_fallback' => 'AES-128-GCM',
960970
'persist_key' => true,
961971
'persist_tun' => true,
962972
'duplicate_cn' => true,

‎templates/client.erb

+6
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@ cipher <%= @cipher %>
2828
<% if @tls_cipher != '' -%>
2929
tls-cipher <%= @tls_cipher %>
3030
<% end -%>
31+
<% if @data_ciphers != 'AES-256-GCM:AES-128-GCM' -%>
32+
data-ciphers <%= @data_ciphers %>
33+
<% end -%>
34+
<% if @data_ciphers_fallback -%>
35+
data-ciphers-fallback <%= @data_ciphers_fallback %>
36+
<% end -%>
3137
<% if @mute_replay_warnings -%>
3238
mute-replay-warnings
3339
<% end -%>

‎templates/server.erb

+6
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,12 @@ cipher <%= @cipher %>
138138
<% if @tls_cipher != '' -%>
139139
tls-cipher <%= @tls_cipher %>
140140
<% end -%>
141+
<% if @data_ciphers != 'AES-256-GCM:AES-128-GCM' -%>
142+
data-ciphers <%= @data_ciphers %>
143+
<% end -%>
144+
<% if @data_ciphers_fallback -%>
145+
data-ciphers-fallback <%= @data_ciphers_fallback %>
146+
<% end -%>
141147
<% if @c2c -%>
142148
client-to-client
143149
<% end -%>

0 commit comments

Comments
 (0)