Skip to content

Commit 849441f

Browse files
chloesoechloesoe
committed
Merge branch 'master' into chloesoe/VSHNOPS-1537
* master: Add tls_crypt Adjust clients $compression type to match servers
2 parents 6d9add7 + a8dc5ad commit 849441f

File tree

7 files changed

+89
-24
lines changed

7 files changed

+89
-24
lines changed

‎manifests/ca.pp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
# @param key_ou Value for organizationalUnitName_default variable in openssl.cnf and KEY_OU in vars
1515
# @param key_cn Value for commonName_default variable in openssl.cnf and KEY_CN in vars
1616
# @param tls_auth Determins if a tls key is generated
17+
# @param tls_static_key Determins if a tls key is generated
1718
# @example
1819
# openvpn::ca {
1920
# 'my_user':
@@ -37,8 +38,13 @@
3738
String $key_name = '',
3839
String $key_ou = '',
3940
Boolean $tls_auth = false,
41+
Boolean $tls_static_key = false,
4042
) {
4143

44+
if $tls_auth {
45+
warning('Parameter $tls_auth is deprecated. Use $tls_static_key instead.')
46+
}
47+
4248
include openvpn
4349
$group_to_set = $group ? {
4450
undef => $openvpn::group,
@@ -217,7 +223,7 @@
217223
require => Exec["create crl.pem on ${name}"],
218224
}
219225

220-
if $tls_auth {
226+
if $tls_static_key {
221227
exec { "generate tls key for ${name}":
222228
command => 'openvpn --genkey --secret keys/ta.key',
223229
cwd => "${etc_directory}/openvpn/${name}/easy-rsa",

‎manifests/client.pp‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
# @param pam DEPRECATED: Boolean, Enable/Disable.
2121
# @param authuserpass Set if username and password required
2222
# @param tls_auth Activates tls-auth to Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks. This has to be set to the same value as on the Server
23+
# @param tls_crypt Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.)
2324
# @param x509_name Common name of openvpn server to make an x509-name verification
2425
# @param setenv Set a custom environmental variable name=value to pass to script.
2526
# @param setenv_safe Set a custom environmental variable OPENVPN_name=value to pass to script. This directive is designed to be pushed by the server to clients, and the prepending of "OPENVPN_" to the environmental variable is a safety precaution to prevent a LD_PRELOAD style attack from a malicious or compromised server.
@@ -45,7 +46,7 @@
4546
#
4647
define openvpn::client (
4748
String $server,
48-
Enum['comp-lzo', ''] $compression = 'comp-lzo',
49+
String $compression = 'comp-lzo',
4950
Enum['tap', 'tun'] $dev = 'tun',
5051
Integer $mute = 20,
5152
Boolean $mute_replay_warnings = true,
@@ -67,6 +68,7 @@
6768
String $up = '',
6869
String $down = '',
6970
Boolean $tls_auth = false,
71+
Boolean $tls_crypt = false,
7072
Optional[String] $x509_name = undef,
7173
Optional[Integer] $sndbuf = undef,
7274
Optional[Integer] $rcvbuf = undef,
@@ -89,6 +91,7 @@
8991

9092
$extca_enabled = pick(getparam(Openvpn::Server[$server], 'extca_enabled'), $server_extca_enabled)
9193
if $extca_enabled { fail('cannot currently create client configs when corresponding openvpn::server is extca_enabled') }
94+
if $tls_auth and $tls_crypt { fail('tls_auth and tls_crypt are mutually exclusive') }
9295

9396
$ca_name = pick($shared_ca, $server)
9497
Openvpn::Ca[$ca_name]
@@ -164,7 +167,7 @@
164167
require => Exec["generate certificate for ${name} in context of ${ca_name}"],
165168
}
166169

167-
if $tls_auth {
170+
if $tls_auth or $tls_crypt {
168171
file { "${etc_directory}/openvpn/${server}/download-configs/${name}/keys/${name}/ta.key":
169172
ensure => link,
170173
target => "${etc_directory}/openvpn/${server}/easy-rsa/keys/ta.key",
@@ -319,4 +322,23 @@
319322
order => '13',
320323
}
321324
}
325+
elsif $tls_crypt {
326+
concat::fragment { "/etc/openvpn/${server}/download-configs/${name}.ovpn/tls_crypt_open_tag":
327+
target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
328+
content => "<tls-crypt>\n",
329+
order => '11',
330+
}
331+
332+
concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/tls_crypt":
333+
target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
334+
source => "${etc_directory}/openvpn/${server}/download-configs/${name}/keys/${name}/ta.key",
335+
order => '12',
336+
}
337+
338+
concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/tls_crypt_close_tag":
339+
target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
340+
content => "</tls-crypt>\n",
341+
order => '13',
342+
}
343+
}
322344
}

‎manifests/server.pp‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@
6868
# @param key_ou Value for organizationalUnitName_default variable in openssl.cnf and KEY_OU in vars
6969
# @param key_cn Value for commonName_default variable in openssl.cnf and KEY_CN in vars
7070
# @param tls_auth Activates tls-auth to Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.
71+
# @param tls_crypt Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.)
7172
# @param tls_server If proto not tcp it lets you choose if the parameter tls-server is set or not.
7273
# @param tls_client Allows you to set this server up as a tls-client connection.
7374
# @param server_poll_timeout Value for timeout before trying the next server.
@@ -187,6 +188,7 @@
187188
Boolean $persist_key = false,
188189
Boolean $persist_tun = false,
189190
Boolean $tls_auth = false,
191+
Boolean $tls_crypt = false,
190192
Boolean $tls_server = false,
191193
Boolean $tls_client = false,
192194
Optional[Integer] $server_poll_timeout = undef,
@@ -221,6 +223,10 @@
221223
fail("Using systemd and namespecific rclink's (BSD-style) is not allowed")
222224
}
223225

226+
if $tls_auth and $tls_crypt {
227+
fail('tls_auth and tls_crypt are mutually exclusive')
228+
}
229+
224230
if $openvpn::manage_service {
225231
if $facts['service_provider'] == 'systemd' {
226232
$lnotify = Service["openvpn@${name}"]
@@ -307,20 +313,20 @@
307313

308314
$ca_common_name = $common_name
309315
::openvpn::ca { $name:
310-
country => $country,
311-
province => $province,
312-
city => $city,
313-
organization => $organization,
314-
email => $email,
315-
common_name => $common_name,
316-
group => $group,
317-
ssl_key_size => $ssl_key_size,
318-
ca_expire => $ca_expire,
319-
key_expire => $key_expire,
320-
key_cn => $key_cn,
321-
key_name => $key_name,
322-
key_ou => $key_ou,
323-
tls_auth => $tls_auth,
316+
country => $country,
317+
province => $province,
318+
city => $city,
319+
organization => $organization,
320+
email => $email,
321+
common_name => $common_name,
322+
group => $group,
323+
ssl_key_size => $ssl_key_size,
324+
ca_expire => $ca_expire,
325+
key_expire => $key_expire,
326+
key_cn => $key_cn,
327+
key_name => $key_name,
328+
key_ou => $key_ou,
329+
tls_static_key => $tls_auth or $tls_crypt,
324330
}
325331

326332
## Renewal of crl.pem

‎spec/defines/openvpn_client_spec.rb‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@
9999
let(:params) do
100100
{
101101
'server' => 'test_server',
102-
'compression' => 'comp-lzo',
102+
'compression' => 'compress lz4',
103103
'dev' => 'tap',
104104
'mute' => 10,
105105
'mute_replay_warnings' => false,
@@ -135,7 +135,7 @@
135135
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^proto\s+udp$}) }
136136
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^remote\s+somewhere\s+123$}) }
137137
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^remote\s+galaxy\s+123$}) }
138-
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^comp-lzo$}) }
138+
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^compress lz4$}) }
139139
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^resolv-retry\s+2m$}) }
140140
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^verb\s+1$}) }
141141
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^mute\s+10$}) }
@@ -153,6 +153,12 @@
153153
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^remote-cert-tls\s+server$}) }
154154
end
155155

156+
context 'test tls_crypt' do
157+
let(:params) { { 'server' => 'test_server', 'tls_crypt' => true } }
158+
159+
it { is_expected.to contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(%r{^tls-crypt keys/test_client/ta\.key$}) }
160+
end
161+
156162
context 'omitting the cipher key' do
157163
let(:params) { { 'server' => 'test_server' } }
158164

‎spec/defines/openvpn_server_spec.rb‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,7 @@
241241
'city' => 'Some City',
242242
'organization' => 'example.org',
243243
'email' => '[email protected]',
244-
'compression' => 'fake_compression',
244+
'compression' => 'compress lz4',
245245
'port' => '123',
246246
'proto' => 'udp',
247247
'group' => 'someone',
@@ -293,7 +293,7 @@
293293
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^proto\s+udp$}) }
294294
it { is_expected.not_to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^proto\s+tls-server$}) }
295295
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^port\s+123$}) }
296-
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^fake_compression$}) }
296+
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^compress lz4$}) }
297297
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^group\s+someone$}) }
298298
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^user\s+someone$}) }
299299
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^log\-append\s+/var/log/openvpn/test_server\.log$}) }
@@ -356,10 +356,29 @@
356356
key_cn: 'yolo',
357357
key_name: 'burp',
358358
key_ou: 'NSA',
359-
tls_auth: true)
359+
tls_static_key: true)
360360
}
361361
end
362362

363+
context 'creating a server setting all parameters including tls_crypt' do
364+
let(:params) do
365+
{
366+
'country' => 'CO',
367+
'province' => 'ST',
368+
'city' => 'Some City',
369+
'organization' => 'example.org',
370+
'email' => '[email protected]',
371+
'proto' => 'tcp6',
372+
'tls_crypt' => true
373+
}
374+
end
375+
376+
it { is_expected.to contain_file('/etc/openvpn/test_server.conf').with_content(%r{^tls-crypt\s+/etc/openvpn/test_server/keys/ta.key$}) }
377+
378+
# OpenVPN easy-rsa CA
379+
it { is_expected.to contain_openvpn__ca('test_server').with(tls_static_key: true) }
380+
end
381+
363382
# tests dedicated to easyrsa version 2
364383
context 'with easyrsa 2.0' do
365384
let(:facts) do
@@ -377,7 +396,7 @@
377396
'city' => 'Some City',
378397
'organization' => 'example.org',
379398
'email' => '[email protected]',
380-
'compression' => 'fake_compression',
399+
'compression' => 'compress lz4',
381400
'port' => '123',
382401
'proto' => 'udp',
383402
'group' => 'someone',
@@ -683,7 +702,7 @@
683702
'city' => 'Some City',
684703
'organization' => 'example.org',
685704
'email' => '[email protected]',
686-
'compression' => 'fake_compression',
705+
'compression' => 'compress lz4',
687706
'port' => '123',
688707
'proto' => 'udp',
689708
'group' => 'someone',

‎templates/client_external_auth.erb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,6 @@ key keys/<%= @name %>/<%= @name %>.key
77
tls-client
88
tls-auth keys/<%= @name %>/ta.key 1
99
<% end -%>
10+
<% if @tls_crypt -%>
11+
tls-crypt keys/<%= @name %>/ta.key
12+
<% end -%>

‎templates/server.erb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,9 @@ key-direction 0
182182
key-direction 1
183183
<% end -%>
184184
<% end -%>
185+
<% if @tls_crypt -%>
186+
tls-crypt <%= @etc_directory -%>/openvpn/<%= @name %>/keys/ta.key
187+
<% end -%>
185188
<% if @fragment != false -%>
186189
fragment <%= @fragment %>
187190
<% end -%>

0 commit comments

Comments
 (0)