T5734: OpenVPN check PKI DH name exists if DH configured

[sever-sever]

Change Summary

Check if DH is configured for OpenVPN but does not exist in the PKI section

set pki dh dh-correct parameters 'xxxx'
set interfaces openvpn vtun10 tls dh-params 'dh-fake'

  File "/usr/libexec/vyos/conf_mode/interfaces_openvpn.py", line 208, in verify_pki
    pki_dh = pki['dh'][tls['dh_params']]
             ~~~~~~~~~^^^^^^^^^^^^^^^^^^
KeyError: 'dh-fake'

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T5734

Related PR(s)

Component(s) name

OpenVPN

Proposed changes

How to test

Use not exist dh for OpenVPN configuration

set pki dh dh-correct parameters 'xxxx'

set interfaces openvpn vtun10 encryption cipher 'aes256'
set interfaces openvpn vtun10 hash 'sha512'
set interfaces openvpn vtun10 local-host '203.0.113.1'
set interfaces openvpn vtun10 local-port '1194'
set interfaces openvpn vtun10 mode 'server'
set interfaces openvpn vtun10 persistent-tunnel
set interfaces openvpn vtun10 protocol 'udp'
set interfaces openvpn vtun10 server client client1 ip '10.10.0.10'
set interfaces openvpn vtun10 server domain-name 'vyos.net'
set interfaces openvpn vtun10 server max-connections '250'
set interfaces openvpn vtun10 server mfa totp
set interfaces openvpn vtun10 server name-server '172.16.254.30'
set interfaces openvpn vtun10 server subnet '10.10.0.0/24'
set interfaces openvpn vtun10 server topology 'subnet'
set interfaces openvpn vtun10 tls ca-certificate 'ca'
set interfaces openvpn vtun10 tls certificate 'cert'
set interfaces openvpn vtun10 tls dh-params 'dh-fake'
set interfaces openvpn vtun10 tls tls-version-min '1.0'
set interfaces openvpn vtun10 use-lzo-compression

Before the fix:

Traceback (most recent call last):
  File "/usr/libexec/vyos/conf_mode/interfaces-openvpn.py", line 726, in <module>
    verify(c)
  File "/usr/libexec/vyos/conf_mode/interfaces-openvpn.py", line 513, in verify
    verify_pki(openvpn)
  File "/usr/libexec/vyos/conf_mode/interfaces-openvpn.py", line 205, in verify_pki
    pki_dh = pki['dh'][tls['dh_params']]
             ~~~^^^^^^
KeyError: 'dh-fake'



[[interfaces openvpn vtun10]] failed
Commit failed
[edit]
vyos@r4#

After the fix:

vyos@r4# commit
[ interfaces openvpn vtun10 ]
pki dh 'dh-fake' is not configured

[[interfaces openvpn vtun10]] failed
Commit failed
[edit]
vyos@r4# 

Smoketest result

vyos@r4:~$ /usr/libexec/vyos/tests/smoke/cli/test_interfaces_openvpn.py
test_openvpn_client_interfaces (__main__.TestInterfacesOpenVPN.test_openvpn_client_interfaces) ... ok
test_openvpn_client_verify (__main__.TestInterfacesOpenVPN.test_openvpn_client_verify) ... ok
test_openvpn_options (__main__.TestInterfacesOpenVPN.test_openvpn_options) ... ok
test_openvpn_server_subnet_topology (__main__.TestInterfacesOpenVPN.test_openvpn_server_subnet_topology) ... ok
test_openvpn_server_verify (__main__.TestInterfacesOpenVPN.test_openvpn_server_verify) ... ok
test_openvpn_site2site_interfaces_tun (__main__.TestInterfacesOpenVPN.test_openvpn_site2site_interfaces_tun) ... ok
test_openvpn_site2site_verify (__main__.TestInterfacesOpenVPN.test_openvpn_site2site_verify) ... ok

----------------------------------------------------------------------
Ran 7 tests in 167.585s

OK
vyos@r4:~$

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[dmbaturin]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #3312 T5734: OpenVPN check PKI DH name exists if DH configured (backport #3308) has been created for branch sagitta