diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-04-30 21:02:33 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-04-30 21:02:33 +0200 |
| commit | 982221bb2649a7cef622d179f029f26bc3e1f3ed (patch) | |
| tree | 12c974d444d15b6277b2ebb501baec52dc725dc0 /data | |
| parent | 021cc22ebf3cb9f81edb4ae6772385d5dc1c2c23 (diff) | |
| parent | ef665adb7e44ef03e7f3e6f2cd1db88315ffcbe1 (diff) | |
| download | vyos-1x-982221bb2649a7cef622d179f029f26bc3e1f3ed.tar.gz vyos-1x-982221bb2649a7cef622d179f029f26bc3e1f3ed.zip | |
Merge pull request #3377 from vyos/mergify/bp/sagitta/pr-3371
openconnect: T4982: Support defining minimum TLS version in openconnect VPN (backport #3371)
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/ocserv/ocserv_config.j2 | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/data/templates/ocserv/ocserv_config.j2 b/data/templates/ocserv/ocserv_config.j2 index b5e890c32..81f777031 100644 --- a/data/templates/ocserv/ocserv_config.j2 +++ b/data/templates/ocserv/ocserv_config.j2 @@ -61,7 +61,15 @@ keepalive = 300 dpd = 60 mobile-dpd = 300 switch-to-tcp-timeout = 30 +{% if tls_version_min == '1.0' %} tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" +{% elif tls_version_min == '1.1' %} +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128:-VERS-TLS1.0" +{% elif tls_version_min == '1.2' %} +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128:-VERS-TLS1.0:-VERS-TLS1.1" +{% elif tls_version_min == '1.3' %} +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-TLS1.2" +{% endif %} auth-timeout = 240 idle-timeout = 1200 mobile-idle-timeout = 1800 |