openvpn: T9370: add chacha20poly1305 data cipher

Offer chacha20poly1305 in "encryption data-ciphers" and
"encryption data-ciphers-fallback", rendered as CHACHA20-POLY1305 and
allowed with DCO.

3 files changed, 16 insertions, 4 deletions

diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py
index 109e0f401..911b0f467 100755
--- a/src/conf_mode/interfaces_openvpn.py
+++ b/src/conf_mode/interfaces_openvpn.py
@@ -80,9 +80,8 @@ group = 'openvpn'
 cfg_dir = '/run/openvpn'
 cfg_file = '/run/openvpn/{ifname}.conf'
 # Ciphers implemented by the in-tree "ovpn" Kernel module. Any other cipher
-# must be handled in userspace and thus rules out DCO. The module also does
-# ChaCha20-Poly1305, which the CLI does not offer.
-dco_ciphers = ['aes128gcm', 'aes192gcm', 'aes256gcm']
+# must be handled in userspace and thus rules out DCO.
+dco_ciphers = ['aes128gcm', 'aes192gcm', 'aes256gcm', 'chacha20poly1305']
 # Raw options that make OpenVPN fall back to the userspace data path, taken
 # from dco_check_option() and dco_check_option_ce()
 dco_incompatible_options = [
diff --git a/src/op_mode/generate_ovpn_client_file.py b/src/op_mode/generate_ovpn_client_file.py
index a55f2e3c5..21c933932 100755
--- a/src/op_mode/generate_ovpn_client_file.py
+++ b/src/op_mode/generate_ovpn_client_file.py
@@ -47,7 +47,8 @@ verb 3
     'aes192gcm': 'AES-192-GCM',
     'aes192': 'AES-192-CBC',
     'aes256gcm': 'AES-256-GCM',
-    'aes256': 'AES-256-CBC'
+    'aes256': 'AES-256-CBC',
+    'chacha20poly1305': 'CHACHA20-POLY1305'
 } %}
 
 {% if encryption is defined and encryption is not none %}
diff --git a/src/tests/test_template.py b/src/tests/test_template.py
index 7ac396b68..65266584e 100644
--- a/src/tests/test_template.py
+++ b/src/tests/test_template.py
@@ -208,3 +208,15 @@ class TestVyOSTemplate(TestCase):
                          internal_ports['certbot_haproxy'])
         self.assertEqual(vyos.template.nft_accept_invalid('arp'),
                          'ct state invalid ether type arp counter accept')
+
+    def test_openvpn_ciphers(self):
+        # CLI values map onto the names OpenVPN expects
+        self.assertEqual(
+            vyos.template.get_openvpn_data_ciphers(['chacha20poly1305', 'aes256gcm']),
+            'CHACHA20-POLY1305:AES-256-GCM',
+        )
+        self.assertEqual(
+            vyos.template.get_openvpn_data_ciphers_fallback('chacha20poly1305'),
+            'CHACHA20-POLY1305',
+        )
+        self.assertEqual(vyos.template.get_openvpn_cipher('aes128'), 'AES-128-CBC')