From 8d99a2f6f81b225014d246dcf6c7bb03c641d4da Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Thu, 1 Oct 2026 15:41:53 +0200 Subject: openvpn: T9370: add chacha20poly1305 data cipher Offer chacha20poly1305 in "encryption data-ciphers" and "encryption data-ciphers-fallback", rendered as CHACHA20-POLY1305 and allowed with DCO. --- src/conf_mode/interfaces_openvpn.py | 5 ++--- src/op_mode/generate_ovpn_client_file.py | 3 ++- src/tests/test_template.py | 12 ++++++++++++ 3 files changed, 16 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py index 109e0f401..911b0f467 100755 --- a/src/conf_mode/interfaces_openvpn.py +++ b/src/conf_mode/interfaces_openvpn.py @@ -80,9 +80,8 @@ group = 'openvpn' cfg_dir = '/run/openvpn' cfg_file = '/run/openvpn/{ifname}.conf' # Ciphers implemented by the in-tree "ovpn" Kernel module. Any other cipher -# must be handled in userspace and thus rules out DCO. The module also does -# ChaCha20-Poly1305, which the CLI does not offer. -dco_ciphers = ['aes128gcm', 'aes192gcm', 'aes256gcm'] +# must be handled in userspace and thus rules out DCO. +dco_ciphers = ['aes128gcm', 'aes192gcm', 'aes256gcm', 'chacha20poly1305'] # Raw options that make OpenVPN fall back to the userspace data path, taken # from dco_check_option() and dco_check_option_ce() dco_incompatible_options = [ diff --git a/src/op_mode/generate_ovpn_client_file.py b/src/op_mode/generate_ovpn_client_file.py index a55f2e3c5..21c933932 100755 --- a/src/op_mode/generate_ovpn_client_file.py +++ b/src/op_mode/generate_ovpn_client_file.py @@ -47,7 +47,8 @@ verb 3 'aes192gcm': 'AES-192-GCM', 'aes192': 'AES-192-CBC', 'aes256gcm': 'AES-256-GCM', - 'aes256': 'AES-256-CBC' + 'aes256': 'AES-256-CBC', + 'chacha20poly1305': 'CHACHA20-POLY1305' } %} {% if encryption is defined and encryption is not none %} diff --git a/src/tests/test_template.py b/src/tests/test_template.py index 7ac396b68..65266584e 100644 --- a/src/tests/test_template.py +++ b/src/tests/test_template.py @@ -208,3 +208,15 @@ class TestVyOSTemplate(TestCase): internal_ports['certbot_haproxy']) self.assertEqual(vyos.template.nft_accept_invalid('arp'), 'ct state invalid ether type arp counter accept') + + def test_openvpn_ciphers(self): + # CLI values map onto the names OpenVPN expects + self.assertEqual( + vyos.template.get_openvpn_data_ciphers(['chacha20poly1305', 'aes256gcm']), + 'CHACHA20-POLY1305:AES-256-GCM', + ) + self.assertEqual( + vyos.template.get_openvpn_data_ciphers_fallback('chacha20poly1305'), + 'CHACHA20-POLY1305', + ) + self.assertEqual(vyos.template.get_openvpn_cipher('aes128'), 'AES-128-CBC') -- cgit v1.2.3