diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2026-01-05 17:20:02 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-01-05 17:20:02 +0200 |
| commit | 06945f0a7079b72ab3844bec77288aea208ac266 (patch) | |
| tree | 2271fa220bfe6c90f7320ffdbc0d6bf8ebcf42af /src | |
| parent | 2e9c1ffd20a8149842a71acae062a8f0822f95dc (diff) | |
| parent | 381ae4a8ccddb524bca5951e27cc826eeef45453 (diff) | |
| download | vyos-1x-06945f0a7079b72ab3844bec77288aea208ac266.tar.gz vyos-1x-06945f0a7079b72ab3844bec77288aea208ac266.zip | |
Merge pull request #4618 from giga1699/T7635
T7635: OpenConnect Certificate Authentication
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/vpn_openconnect.py | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py index 68cd363f0..bfc1d5269 100755 --- a/src/conf_mode/vpn_openconnect.py +++ b/src/conf_mode/vpn_openconnect.py @@ -105,11 +105,17 @@ def verify(ocserv): if 'authentication' in ocserv: if 'mode' in ocserv['authentication']: if ( - 'local' in ocserv['authentication']['mode'] - and 'radius' in ocserv['authentication']['mode'] + ('local' in ocserv['authentication']['mode'] + and 'radius' in ocserv['authentication']['mode']) + or + ('local' in ocserv['authentication']['mode'] + and 'certificate' in ocserv['authentication']['mode']) + or + ('radius' in ocserv['authentication']['mode'] + and 'certificate' in ocserv['authentication']['mode']) ): raise ConfigError( - 'OpenConnect authentication modes are mutually-exclusive, remove either local or radius from your configuration' + 'OpenConnect authentication modes are mutually-exclusive. Use only one of local, radius, or certificate.' ) if 'radius' in ocserv['authentication']['mode']: if 'server' not in ocserv['authentication']['radius']: @@ -203,6 +209,9 @@ def verify(ocserv): raise ConfigError('SSL certificate missing on OpenConnect config!') verify_pki_certificate(ocserv, ocserv['ssl']['certificate']) + if 'ca_certificate' not in ocserv['ssl'] and 'certificiate' in ocserv['authentication']['mode']: + raise ConfigError('CA certificate must be provided in certificate authentication mode!') + if 'ca_certificate' in ocserv['ssl']: for ca_cert in ocserv['ssl']['ca_certificate']: verify_pki_ca_certificate(ocserv, ca_cert) |