Skip to content

Commit fe0e82d

Browse files
root-expertroot-expert
authored
Merge pull request #432 from jkroepke/dn_mode
2 parents 3b5d9ab + 34e99e2 commit fe0e82d

File tree

8 files changed

+105
-56
lines changed

8 files changed

+105
-56
lines changed

‎REFERENCE.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,7 @@ openvpn::ca {
237237

238238
The following parameters are available in the `openvpn::ca` defined type:
239239

240+
* [`dn_mode`](#dn_mode)
240241
* [`country`](#country)
241242
* [`province`](#province)
242243
* [`city`](#city)
@@ -257,6 +258,14 @@ The following parameters are available in the `openvpn::ca` defined type:
257258
* [`tls_static_key`](#tls_static_key)
258259
* [`crl_days`](#crl_days)
259260

261+
##### <a name="dn_mode"></a>`dn_mode`
262+
263+
Data type: `Enum['org','cn_only']`
264+
265+
EasyRSA X509 DN mode.
266+
267+
Default value: `'org'`
268+
260269
##### <a name="country"></a>`country`
261270

262271
Data type: `Optional[String]`
@@ -933,6 +942,7 @@ openvpn::server { 'zurich':
933942

934943
The following parameters are available in the `openvpn::server` defined type:
935944

945+
* [`dn_mode`](#dn_mode)
936946
* [`country`](#country)
937947
* [`province`](#province)
938948
* [`city`](#city)
@@ -1039,6 +1049,14 @@ The following parameters are available in the `openvpn::server` defined type:
10391049
* [`custom_options`](#custom_options)
10401050
* [`fragment`](#fragment)
10411051

1052+
##### <a name="dn_mode"></a>`dn_mode`
1053+
1054+
Data type: `Enum['org','cn_only']`
1055+
1056+
EasyRSA X509 DN mode.
1057+
1058+
Default value: `'org'`
1059+
10421060
##### <a name="country"></a>`country`
10431061

10441062
Data type: `Optional[String[1]]`

‎manifests/ca.pp‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# @summary This define creates the openvpn ca and ssl certificates
22
#
3+
# @param dn_mode EasyRSA X509 DN mode.
34
# @param country Country to be used for the SSL certificate
45
# @param province Province to be used for the SSL certificate
56
# @param city City to be used for the SSL certificate
@@ -26,6 +27,7 @@
2627
# }
2728
#
2829
define openvpn::ca (
30+
Enum['org','cn_only'] $dn_mode = 'org',
2931
Optional[String] $country = undef,
3032
Optional[String] $province = undef,
3133
Optional[String] $city = undef,
@@ -152,6 +154,7 @@
152154
'ca_expire' => $ca_expire,
153155
'key_expire' => $key_expire,
154156
'crl_days' => $crl_days,
157+
'dn_mode' => $dn_mode,
155158
'digest' => $digest,
156159
'country' => $country,
157160
'province' => $province,
@@ -173,12 +176,18 @@
173176
}
174177
}
175178

179+
$_initca_environment = $dn_mode ? {
180+
'cn_only' => ["EASYRSA_REQ_CN=${common_name} CA"],
181+
default => [],
182+
}
183+
176184
exec { "initca ${name}":
177-
command => './easyrsa --batch init-pki && ./easyrsa --batch build-ca nopass',
178-
cwd => "${server_directory}/${name}/easy-rsa",
179-
creates => "${server_directory}/${name}/easy-rsa/keys/ca.crt",
180-
provider => 'shell',
181-
require => File["${server_directory}/${name}/easy-rsa/vars"],
185+
command => './easyrsa --batch init-pki && ./easyrsa --batch build-ca nopass',
186+
cwd => "${server_directory}/${name}/easy-rsa",
187+
creates => "${server_directory}/${name}/easy-rsa/keys/ca.crt",
188+
environment => $_initca_environment,
189+
provider => 'shell',
190+
require => File["${server_directory}/${name}/easy-rsa/vars"],
182191
}
183192

184193
if ($ssl_key_algo == 'rsa') {
@@ -193,7 +202,7 @@
193202
}
194203

195204
exec { "generate server cert ${name}":
196-
command => "./easyrsa build-server-full ${common_name} nopass",
205+
command => "./easyrsa build-server-full '${common_name}' nopass",
197206
cwd => "${server_directory}/${name}/easy-rsa",
198207
creates => "${server_directory}/${name}/easy-rsa/keys/private/${common_name}.key",
199208
provider => 'shell',
@@ -206,13 +215,17 @@
206215
}
207216

208217
exec { "create crl.pem on ${name}":
209-
command => ". ./vars && EASYRSA_REQ_CN='' EASYRSA_REQ_OU='' openssl ca -gencrl -out ${server_directory}/${name}/crl.pem -config ${server_directory}/${name}/easy-rsa/openssl.cnf",
218+
command => './easyrsa gen-crl',
210219
cwd => "${server_directory}/${name}/easy-rsa",
211-
creates => "${server_directory}/${name}/crl.pem",
212-
group => $group_to_set,
220+
creates => "${server_directory}/${name}/easy-rsa/keys/crl.pem",
213221
provider => 'shell',
214222
require => Exec["generate server cert ${name}"],
215223
}
224+
-> exec { "copy created crl.pem to ${name} keys directory":
225+
command => "cp ${server_directory}/${name}/easy-rsa/keys/crl.pem ${server_directory}/${name}/crl.pem",
226+
creates => "${server_directory}/${name}/crl.pem",
227+
provider => 'shell',
228+
}
216229
}
217230
default: {
218231
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0.")
@@ -244,10 +257,4 @@
244257
require => Exec["generate server cert ${name}"],
245258
}
246259
}
247-
248-
file { "${server_directory}/${name}/easy-rsa/keys/crl.pem":
249-
ensure => link,
250-
target => "${server_directory}/${name}/crl.pem",
251-
require => Exec["create crl.pem on ${name}"],
252-
}
253260
}

‎manifests/revoke.pp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131

3232
$renew_command = $openvpn::easyrsa_version ? {
3333
'2.0' => ". ./vars && KEY_CN='' KEY_OU='' KEY_NAME='' KEY_ALTNAMES='' openssl ca -gencrl -out ${server_directory}/${server}/crl.pem -config ${server_directory}/${server}/easy-rsa/openssl.cnf",
34-
'3.0' => ". ./vars && EASYRSA_REQ_CN='' EASYRSA_REQ_OU='' openssl ca -gencrl -out ${server_directory}/${server}/crl.pem -config ${server_directory}/${server}/easy-rsa/openssl.cnf",
34+
'3.0' => './easyrsa gen-crl',
3535
default => fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0."),
3636
}
3737

@@ -54,4 +54,13 @@
5454
provider => 'shell',
5555
refreshonly => true,
5656
}
57+
58+
if ($openvpn::easyrsa_version == '3.0') {
59+
exec { "copy renewed crl.pem to ${name} keys directory because of revocation of ${name}":
60+
command => "cp ${server_directory}/${server}/easy-rsa/keys/crl.pem ${server_directory}/${server}/crl.pem",
61+
subscribe => Exec["renew crl.pem on ${server} because of revocation of ${name}"],
62+
provider => 'shell',
63+
refreshonly => true,
64+
}
65+
}
5766
}

‎manifests/server.pp‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#
22
# @summary This define creates the openvpn server instance which can run in server or client mode.
33
#
4+
# @param dn_mode EasyRSA X509 DN mode.
45
# @param country Country to be used for the SSL certificate, mandatory for server mode.
56
# @param province Province to be used for the SSL certificate, mandatory for server mode.
67
# @param city City to be used for the SSL certificate, mandatory for server mode.
@@ -146,6 +147,7 @@
146147
# }
147148
#
148149
define openvpn::server (
150+
Enum['org','cn_only'] $dn_mode = 'org',
149151
Optional[String[1]] $country = undef,
150152
Optional[String[1]] $province = undef,
151153
Optional[String[1]] $city = undef,
@@ -351,21 +353,24 @@
351353

352354
if !$remote {
353355
if !$shared_ca and !$extca_enabled {
354-
# VPN Server Mode
355-
if $country == undef {
356-
fail('country has to be specified in server mode')
357-
}
358-
if $province == undef {
359-
fail('province has to be specified in server mode')
360-
}
361-
if $city == undef { fail('city has to be specified in server mode') }
362-
if $organization == undef {
363-
fail('organization has to be specified in server mode')
356+
if $dn_mode == 'org' or $openvpn::easyrsa_version == '2.0' {
357+
# VPN Server Mode
358+
if $country == undef {
359+
fail('country has to be specified in server mode')
360+
}
361+
if $province == undef {
362+
fail('province has to be specified in server mode')
363+
}
364+
if $city == undef { fail('city has to be specified in server mode') }
365+
if $organization == undef {
366+
fail('organization has to be specified in server mode')
367+
}
368+
if $email == undef { fail('email has to be specified in server mode') }
364369
}
365-
if $email == undef { fail('email has to be specified in server mode') }
366370

367371
$ca_common_name = $common_name
368372
::openvpn::ca { $name:
373+
dn_mode => $dn_mode,
369374
country => $country,
370375
province => $province,
371376
city => $city,
@@ -404,11 +409,16 @@
404409
}
405410
'3.0': {
406411
exec { "renew crl.pem on ${name}":
407-
command => ". ./vars && EASYRSA_REQ_CN='' EASYRSA_REQ_OU='' openssl ca -gencrl -out ${server_directory}/${name}/crl.pem -config ${server_directory}/${name}/easy-rsa/openssl.cnf",
412+
command => "./easyrsa gen-crl && cp ./keys/crl.pem ${server_directory}/${server}/crl.pem",
408413
cwd => "${server_directory}/${name}/easy-rsa",
409414
provider => 'shell',
410415
schedule => "renew crl.pem schedule on ${name}",
411416
}
417+
~> exec { "copy renewed crl.pem to ${name} keys directory":
418+
command => "cp ${server_directory}/${name}/easy-rsa/keys/crl.pem ${server_directory}/${name}/crl.pem",
419+
refreshonly => true,
420+
provider => 'shell',
421+
}
412422
}
413423
default: {
414424
fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 2.0 or 3.0.")

‎spec/acceptance/openvpn_spec.rb‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@
195195
if easy_rsa_version == '3.0'
196196
describe 'server defined type w/ easy-rsa 3.0' do
197197
dev = 'tun1'
198-
server_name = 'test_openvpn_server_ec'
198+
server_name = 'test_openvpn_server_ec_dn_mode'
199199
port = 1195
200200
management_port = 7506
201201

@@ -204,11 +204,7 @@
204204
pp = %(
205205
openvpn::server { '#{server_name}':
206206
dev => '#{dev}',
207-
country => 'CO',
208-
province => 'ST',
209-
city => 'A city',
210-
organization => 'FOO',
211-
email => '[email protected]',
207+
dn_mode => 'cn_only',
212208
ssl_key_algo => 'ec',
213209
ssl_key_curve => 'secp521r1',
214210
ecdh_curve => 'secp521r1',
@@ -229,11 +225,7 @@
229225
pp = %(
230226
openvpn::server { '#{server_name}':
231227
dev => '#{dev}',
232-
country => 'CO',
233-
province => 'ST',
234-
city => 'A city',
235-
organization => 'FOO',
236-
email => '[email protected]',
228+
dn_mode => 'cn_only',
237229
ssl_key_algo => 'ec',
238230
ssl_key_curve => 'secp521r1',
239231
ecdh_curve => 'secp521r1',
@@ -262,11 +254,7 @@
262254
pp = %(
263255
openvpn::server { '#{server_name}':
264256
dev => '#{dev}',
265-
country => 'CO',
266-
province => 'ST',
267-
city => 'A city',
268-
organization => 'FOO',
269-
email => '[email protected]',
257+
dn_mode => 'cn_only',
270258
ssl_key_algo => 'ec',
271259
ssl_key_curve => 'secp521r1',
272260
ecdh_curve => 'secp521r1',
@@ -308,6 +296,7 @@
308296
it { is_expected.to contain 'export EASYRSA_ALGO=ec' }
309297
it { is_expected.to contain 'export EASYRSA_CURVE=secp521r1' }
310298
it { is_expected.to contain 'export EASYRSA_DIGEST=sha256' }
299+
it { is_expected.to contain 'export EASYRSA_DN="cn_only"' }
311300
end
312301

313302
describe file(server_crt.to_s), :crtFile do
@@ -334,7 +323,7 @@
334323

335324
describe file("#{server_directory}/#{server_name}/easy-rsa/keys/issued/#{server_name}-vpnclienta.crt") do
336325
it { is_expected.to be_file }
337-
it { is_expected.to contain 'Issuer: C=CO, ST=ST, L=A city, O=FOO, ' }
326+
it { is_expected.to contain 'Issuer: CN=openvpn-server CA' }
338327
end
339328

340329
describe file("#{server_directory}/#{server_name}/easy-rsa/keys/index.txt") do

‎spec/defines/openvpn_ca_spec.rb‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,6 @@
4242

4343
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with(mode: '0550') }
4444

45-
it {
46-
is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/keys/crl.pem").
47-
with(ensure: 'link', target: "#{server_directory}/test_server/crl.pem")
48-
}
49-
5045
it {
5146
is_expected.to contain_file("#{server_directory}/test_server/keys").
5247
with(ensure: 'link', target: "#{server_directory}/test_server/easy-rsa/keys")
@@ -69,6 +64,7 @@
6964
context 'creating a ca setting all parameters' do
7065
let(:params) do
7166
{
67+
'dn_mode' => 'cn_only',
7268
'country' => 'CO',
7369
'province' => 'ST',
7470
'city' => 'Some City',
@@ -86,6 +82,7 @@
8682
}
8783
end
8884

85+
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_DN="cn_only"$}) }
8986
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_CA_EXPIRE=365$}) }
9087
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_CERT_EXPIRE=365$}) }
9188
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_REQ_CN="yolo"$}) }
@@ -112,11 +109,6 @@
112109

113110
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with(mode: '0550') }
114111

115-
it {
116-
is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/keys/crl.pem").
117-
with(ensure: 'link', target: "#{server_directory}/test_server/crl.pem")
118-
}
119-
120112
it {
121113
is_expected.to contain_file("#{server_directory}/test_server/keys").
122114
with(ensure: 'link', target: "#{server_directory}/test_server/easy-rsa/keys")
@@ -152,6 +144,7 @@
152144
context 'creating a ca setting all parameters' do
153145
let(:params) do
154146
{
147+
'dn_mode' => 'cn_only',
155148
'country' => 'CO',
156149
'province' => 'ST',
157150
'city' => 'Some City',
@@ -169,6 +162,7 @@
169162
end
170163

171164
if facts[:os]['release']['major'] =~ %r{10|11|20.04}
165+
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_DN="cn_only"$}) }
172166
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_CA_EXPIRE=365$}) }
173167
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_CERT_EXPIRE=365$}) }
174168
it { is_expected.to contain_file("#{server_directory}/test_server/easy-rsa/vars").with_content(%r{^export EASYRSA_REQ_CN="yolo"$}) }

‎spec/defines/openvpn_server_spec.rb‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -974,6 +974,18 @@
974974
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^dh\s+#{server_directory}/test_server/keys/dh.pem$}) }
975975
end
976976

977+
context 'creating a server in dn_mode cn_only' do
978+
let(:params) do
979+
{
980+
'dn_mode' => 'cn_only',
981+
}
982+
end
983+
984+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^cert\s+#{server_directory}/test_server/keys/issued/server.crt$}) }
985+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^key\s+#{server_directory}/test_server/keys/private/server.key$}) }
986+
it { is_expected.to contain_file("#{server_directory}/test_server.conf").with_content(%r{^dh\s+#{server_directory}/test_server/keys/dh.pem$}) }
987+
end
988+
977989
context 'creating a server in client mode' do
978990
let(:title) { 'test_client' }
979991
let(:nobind) { false }

‎templates/vars-30.epp‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,16 +81,26 @@ export EASYRSA_CRL_DAYS=<%= $crl_days %>
8181

8282
export EASYRSA_DIGEST=<%= $digest %>
8383

84-
export EASYRSA_DN="org"
84+
export EASYRSA_DN="<%= $dn_mode %>"
8585

8686
# These are the default values for fields
8787
# which will be placed in the certificate.
8888
# Don't leave any of these fields blank.
89+
<% if $country { -%>
8990
export EASYRSA_REQ_COUNTRY="<%= $country %>"
91+
<% } -%>
92+
<% if $province { -%>
9093
export EASYRSA_REQ_PROVINCE="<%= $province %>"
94+
<% } -%>
95+
<% if $city { -%>
9196
export EASYRSA_REQ_CITY="<%= $city %>"
97+
<% } -%>
98+
<% if $organization { -%>
9299
export EASYRSA_REQ_ORG="<%= $organization %>"
100+
<% } -%>
101+
<% if $email { -%>
93102
export EASYRSA_REQ_EMAIL="<%= $email %>"
103+
<% } -%>
94104
<% if $key_cn { -%>
95105
export EASYRSA_REQ_CN="<%= $key_cn %>"
96106
<% } -%>

0 commit comments

Comments
 (0)