openconnect: T4982: Support defining minimum TLS version in openconnect VPN (backport #3371)

[mergify]

Change Summary

Allow configuration of minimum acceptable TLS version for openconnect VPN.
Default is set at TLSv1.2 to ensure out-of-box/unconfigured option is not insecure.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

https://vyos.dev/T4982

Related PR(s)

Component(s) name

vpn -> openconnect

Proposed changes

How to test

1. Create an openconnect VPN configuration:

set vpn openconnect authentication local-users username example password 'test'
set vpn openconnect authentication mode local 'password'
set vpn openconnect network-settings client-ip-settings subnet '192.168.1.1/30'
set vpn openconnect network-settings name-server '192.168.1.254'
set vpn openconnect ssl ca-certificate 'test-ca'
set vpn openconnect ssl certificate 'test-certificate'
set vpn openconnect tls-version-min 1.2

2. Validate in the configuration file rendered that minimum TLS version has been set correctly:

vyos@vyos:~$ cat /var/run/ocserv/ocserv.conf | grep "tls-priorities"
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128:-VERS-TLS1.0:-VERS-TLS1.1"

Smoketest result

vyos@vyos:~$ /usr/libexec/vyos/tests/smoke/cli/test_vpn_openconnect.py
test_ocserv (__main__.TestVPNOpenConnect.test_ocserv) ...
SSL missing on OpenConnect config!

ok

----------------------------------------------------------------------
Ran 1 test in 8.705s

OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

  ---

  This is an automatic backport of pull request openconnect: T4982: Support defining minimum TLS version in openconnect VPN #3371 done by Mergify.