Skip to content

Commit de20a1c

Browse files
nemesifiernemesifier
committed
[feature] Added data-ciphers #322
Closes #322
1 parent c1d7f6a commit de20a1c

5 files changed

Lines changed: 605 additions & 37 deletions

File tree

‎netjsonconfig/backends/openvpn/converters.py‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,23 @@ def __intermediate_vpn(self, config, remove=None):
5353
# do not display status-version if status directive not present
5454
if 'status' not in config and 'status_version' in config:
5555
del config['status_version']
56+
config = self.__output_data_ciphers(config)
5657
config = self.__add_tls_auth_key(config)
5758
return self.sorted_dict(config)
5859

60+
def __output_data_ciphers(self, config):
61+
data_ciphers = config.get('data_ciphers', None)
62+
if not data_ciphers:
63+
return config
64+
output = ''
65+
for cipher in data_ciphers:
66+
cipher_text = cipher['cipher']
67+
if cipher['optional']:
68+
cipher_text = f'?{cipher_text}'
69+
output = f'{output}:{cipher_text}'
70+
config['data_ciphers'] = output[1:]
71+
return config
72+
5973
def __add_tls_auth_key(self, config):
6074
tls_auth = config.get('tls_auth', None)
6175
if not tls_auth:
@@ -109,4 +123,18 @@ def __netjson_vpn(self, vpn):
109123
else:
110124
remote.append(dict(host=items[0], port=int(items[1])))
111125
vpn['remote'] = remote
126+
vpn = self.__netjson_data_ciphers(vpn)
127+
return vpn
128+
129+
def __netjson_data_ciphers(self, vpn):
130+
data_ciphers_text = vpn.get('data_ciphers')
131+
if not data_ciphers_text:
132+
return vpn
133+
data_ciphers = []
134+
ciphers = data_ciphers_text.split(':')
135+
for cipher in ciphers:
136+
optional = cipher.startswith('?')
137+
cipher_text = cipher if not optional else cipher[1:]
138+
data_ciphers.append({'cipher': cipher_text, 'optional': optional})
139+
vpn['data_ciphers'] = data_ciphers
112140
return vpn

‎netjsonconfig/backends/openvpn/schema.py‎

Lines changed: 137 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,91 @@
55

66
from ...schema import schema as default_schema
77

8+
data_ciphers = [
9+
"AES-128-CBC",
10+
"AES-128-CFB",
11+
"AES-128-CFB1",
12+
"AES-128-CFB8",
13+
"AES-128-GCM",
14+
"AES-128-OFB",
15+
"AES-192-CBC",
16+
"AES-192-CFB",
17+
"AES-192-CFB1",
18+
"AES-192-CFB8",
19+
"AES-192-GCM",
20+
"AES-192-OFB",
21+
"AES-256-CBC",
22+
"AES-256-CFB",
23+
"AES-256-CFB1",
24+
"AES-256-CFB8",
25+
"AES-256-GCM",
26+
"AES-256-OFB",
27+
"ARIA-128-CBC",
28+
"ARIA-128-CFB",
29+
"ARIA-128-CFB1",
30+
"ARIA-128-CFB8",
31+
"ARIA-128-OFB",
32+
"ARIA-192-CBC",
33+
"ARIA-192-CFB",
34+
"ARIA-192-CFB1",
35+
"ARIA-192-CFB8",
36+
"ARIA-192-OFB",
37+
"ARIA-256-CBC",
38+
"ARIA-256-CFB",
39+
"ARIA-256-CFB1",
40+
"ARIA-256-CFB8",
41+
"ARIA-256-OFB",
42+
"CAMELLIA-128-CBC",
43+
"CAMELLIA-128-CFB",
44+
"CAMELLIA-128-CFB1",
45+
"CAMELLIA-128-CFB8",
46+
"CAMELLIA-128-OFB",
47+
"CAMELLIA-192-CBC",
48+
"CAMELLIA-192-CFB",
49+
"CAMELLIA-192-CFB1",
50+
"CAMELLIA-192-CFB8",
51+
"CAMELLIA-192-OFB",
52+
"CAMELLIA-256-CBC",
53+
"CAMELLIA-256-CFB",
54+
"CAMELLIA-256-CFB1",
55+
"CAMELLIA-256-CFB8",
56+
"CAMELLIA-256-OFB",
57+
"CHACHA20-POLY1305",
58+
"SEED-CBC",
59+
"SEED-CFB",
60+
"SEED-OFB",
61+
"SM4-CBC",
62+
"SM4-CFB",
63+
"SM4-OFB",
64+
"BF-CBC",
65+
"BF-CFB",
66+
"BF-OFB",
67+
"CAST5-CBC",
68+
"CAST5-CFB",
69+
"CAST5-OFB",
70+
"DES-CBC",
71+
"DES-CFB",
72+
"DES-CFB1",
73+
"DES-CFB8",
74+
"DES-EDE-CBC",
75+
"DES-EDE-CFB",
76+
"DES-EDE-OFB",
77+
"DES-EDE3-CBC",
78+
"DES-EDE3-CFB",
79+
"DES-EDE3-CFB1",
80+
"DES-EDE3-CFB8",
81+
"DES-EDE3-OFB",
82+
"DES-OFB",
83+
"DESX-CBC",
84+
"RC2-40-CBC",
85+
"RC2-64-CBC",
86+
"RC2-CBC",
87+
"RC2-CFB",
88+
"RC2-OFB",
89+
"none",
90+
]
91+
default_cipher = "AES-256-GCM"
92+
893
base_openvpn_schema = {
994
"$schema": "http://json-schema.org/draft-04/schema#",
1095
"type": "object",
@@ -102,46 +187,61 @@
102187
"default": "SHA1",
103188
"propertyOrder": 11,
104189
},
190+
"data_ciphers": {
191+
"title": "data ciphers",
192+
"description": (
193+
"Restrict the allowed ciphers to be negotiated "
194+
"to the ciphers in this list."
195+
),
196+
"type": "array",
197+
"additionalItems": True,
198+
"propertyOrder": 12.0,
199+
"minItems": 1,
200+
"default": [
201+
{"cipher": "AES-256-GCM", "optional": False},
202+
{"cipher": "AES-128-GCM", "optional": False},
203+
],
204+
"items": {
205+
"type": "object",
206+
"required": ["cipher", "optional"],
207+
"properties": {
208+
"cipher": {
209+
"type": "string",
210+
"enum": [""] + data_ciphers,
211+
"default": "",
212+
"propertyOrder": 1,
213+
},
214+
"optional": {
215+
"type": "boolean",
216+
"default": False,
217+
"format": "checkbox",
218+
"propertyOrder": 2,
219+
},
220+
},
221+
},
222+
},
223+
"data_ciphers_fallback": {
224+
"title": "data ciphers fallback",
225+
"type": "string",
226+
"description": (
227+
"Configure a cipher that is used to fall back to if we "
228+
"could not determine which cipher the peer is willing to use."
229+
),
230+
"enum": data_ciphers,
231+
"default": default_cipher,
232+
"propertyOrder": 12.1,
233+
},
105234
"cipher": {
106235
"title": "cipher",
107236
"type": "string",
108-
"description": "Encrypt data channel packets with cipher algorithm",
109-
"enum": [
110-
"AES-128-CBC",
111-
"AES-128-CFB",
112-
"AES-128-CFB1",
113-
"AES-128-CFB8",
114-
"AES-128-GCM",
115-
"AES-128-OFB",
116-
"AES-192-CBC",
117-
"AES-192-CFB",
118-
"AES-192-CFB1",
119-
"AES-192-CFB8",
120-
"AES-192-GCM",
121-
"AES-192-OFB",
122-
"AES-256-CBC",
123-
"AES-256-CFB",
124-
"AES-256-CFB1",
125-
"AES-256-CFB8",
126-
"AES-256-GCM",
127-
"AES-256-OFB",
128-
"BF-CBC",
129-
"BF-CFB",
130-
"BF-OFB",
131-
"CAMELLIA-128-CBC",
132-
"CAMELLIA-128-CFB1",
133-
"CAMELLIA-128-CFB8",
134-
"CAMELLIA-128-OFB",
135-
"CAMELLIA-192-CBC",
136-
"CAMELLIA-192-CFB",
137-
"CAMELLIA-192-CFB1",
138-
"CAMELLIA-192-CFB8",
139-
"CAMELLIA-192-OFB",
140-
"CAMELLIA-256-CBC",
141-
"none",
142-
],
143-
"default": "BF-CBC",
144-
"propertyOrder": 12,
237+
"description": (
238+
"Encrypt data channel packets with cipher algorithm. "
239+
"This option is deprecated in favour of data-ciphers "
240+
"and data-ciphers-fallback."
241+
),
242+
"enum": data_ciphers,
243+
"default": default_cipher,
244+
"propertyOrder": 12.2,
145245
},
146246
"engine": {
147247
"title": "engine",

0 commit comments

Comments
 (0)