Skip to content

Commit

Permalink
T5734: OpenVPN check PKI DH name exists if DH configured
Browse files Browse the repository at this point in the history
Check if DH is configured for OpenVPN but dies not exist in the
PKI section

```
set pki dh dh-correct parameters 'xxxx'
set interfaces openvpn vtun10 tls dh-params 'dh-fake'

  File "/usr/libexec/vyos/conf_mode/interfaces_openvpn.py", line 208, in verify_pki
    pki_dh = pki['dh'][tls['dh_params']]
             ~~~~~~~~~^^^^^^^^^^^^^^^^^^
KeyError: 'dh-fake'
```
  • Loading branch information
sever-sever committed Apr 15, 2024
1 parent a6ccf35 commit f88b3e8
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions src/conf_mode/interfaces_openvpn.py
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,12 @@ def verify_pki(openvpn):
raise ConfigError(f'Cannot use encrypted private key on openvpn interface {interface}')

if 'dh_params' in tls:
if 'dh' not in pki:
raise ConfigError(f'pki dh is not configured')
proposed_dh = tls['dh_params']
if proposed_dh not in pki['dh'].keys():
raise ConfigError(f"pki dh '{proposed_dh}' is not configured")

pki_dh = pki['dh'][tls['dh_params']]
dh_params = load_dh_parameters(pki_dh['parameters'])
dh_numbers = dh_params.parameter_numbers()
Expand Down

0 comments on commit f88b3e8

Please sign in to comment.