pfsensible / core

Core modules for managing pfSense firewalls with ansible
GNU General Public License v3.0
186 stars 46 forks source link

pfsense_openvpn_client providing a tls certificate to the `tls` field has no effect #132

Open samuel-emrys opened 3 weeks ago

samuel-emrys commented 3 weeks ago

Describe the bug When attempting to configure an openvpn client using pfsense_openvpn_client, the tls field does not appear to apply any changes to the <tls> field in config.xml. The "Use a TLS key" of the "TLS Configuration" parameter in the GUI also remains unchanged:

image

Expected behavior

  1. The tls key converted to base64 and added to the tls field in config.xml, i.e.
    <openvpn>
        <openvpn-client>
                    <tls>LZ0tLS1CRUdJTiBPcGVuVlBOIFN0YXRpYyBrZXkgVjEtLS0tLQ0KNDhkOTk5OWJkNzEwOTViMTA2NDljN2NiNDcxYzEwNTENCmIxYWZkZWNlNTk3Y2VhMDY5MDliOTkzMDNhMThjNjc0DQowMTU5N2IxMmMwNGE3ODdlOThjZGI2MTllZTk2MGQ5MA0KYTAxNjU1MjlkYzY1MGYzYTVjNmZiZTc3YzkxYzEzN2QNCmNmNTVkODYzZmNiZTMxNGRmNWYwYjQ1ZGJlOTc0ZDliDQpkZTMzZWY1YjQ4MDNjMzk4NTUzMWM2YzIzY2B2OTA2ZA0KNmNkMDI4ZWZjODU4NWQxYjllNzEwMDM1NjZiZDc4OTENCmI5Y2M5MjEyYmNiYTUxMDEwOTkyMmVlZDg3ZjVjOGU3DQo2ZDhlNTljYmQ4MjU3NTI2MWYwMjc3NzM3MmIyY2Q0Yw0KYTUyMTRjNGE2NTEzZmYyNmRkNTY4ZjU3NGZkNDBkNmMNCmQ0NTBmYzc4ODE2MGZmNjg0MzRjZTJiZjZhZmIwMGU3DQoxMGEzMTk4NTM4ZjE0YzRkNDVkODRhYjQyNjM3ODcyZQ0KNzc4YTZiMzVhMTI0ZTcwMDkyMDg3OWYxZDAwM2JhOTMNCmRjY2RiOTUzY2RmMzJiZWEwM2YzNjU3NjBiMGVkODAwDQoyMDk4ZDRjZTIwZDA0NWI0NWE4M2E4NDMyY2M3Mzc2Nw0KN2FlZDI3MTI1NTkyYTcxNDhkMjVjODdmZGJlMGEzZjYNCi0tLS0tRU5EIE9wZW5WUE4gU3RhdGljIGtleSBWMS0tLS0t</tls>
        </openvpn-client>
    </openvpn>
  2. The appropriate configuration to display in the web gui:

image

Playbook Please paste a minimal playbook to reproduce the issue:

---
- name: Configure pfSense
  hosts: pfsense
  vars:
  gather_facts: no
  tasks:
    - name: vpn | Add OpenVPN Client
      pfsensible.core.pfsense_openvpn_client:
        name: vpn01
        mode: p2p_tls
        protocol: UDP4
        dev_mode: tun
        interface: wan
        server_addr: server1.vpncompany.com
        server_port: 1194
        tls: |-
          -----BEGIN OpenVPN Static key V1-----
          48d9999bd71095b10649c7cb471c1051
          b1afdece597cea06909b99303a18c674
          01597b12c04c787e98cdb619ee960d90
          a0165529dc650f3a5c6fbe77c91c137d
          cf55d863fcbf314df5f0b45dbe974d9b
          de33ef5b4403c3985531c6c23ca6906d
          6cd028efc8585d1b9e71003566bd7891
          b9cc9212bcba510109922eed87f5c8e6
          6d8e59cbd82575261f02777372b2cd4c
          a5214c4a6513ff26dd568f574fd40d6c
          d450fc788160ff68434ce2bf6afb00e7
          10a3198538f14c4d45d84ab42637872e
          778a6b35a124e700920879f1d003ba93
          dccdb953cdf32bea03f365760b0ed800
          2098d4ce20d045b45a83a8432cc73767
          7aed27125592a7148d25c87fdbe0a4f6
          -----END OpenVPN Static key V1-----
        ca: my-ca
        cert: my-cert
        data_ciphers:
          - AES-256-GCM
          - AES-128-GCM
          - CHACHA20-POLY1305
        data_ciphers_fallback: AES-256-CBC
        digest: SHA256
        compression: adaptive
        verbosity_level: 3

Output Please paste the ansible output run with -vv:

ansible-playbook [core 2.16.7]
  config file = /home/user/.ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/.local/pipx/venvs/ansible/lib/python3.11/site-packages/ansible
  ansible collection location = /home/user/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/user/.local/bin/ansible-playbook
  python version = 3.11.1 (main, Feb  7 2023, 23:37:10) [Clang 15.0.7 ] (/home/user/.local/pipx/venvs/ansible/bin/python)
  jinja version = 3.1.2
  libyaml = True
Using /home/user/.ansible.cfg as config file
Skipping callback 'default', as we already have a stdout callback.
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.

PLAYBOOK: playbook.yml **************************************************************************************************************************************
1 plays in playbook.yml

PLAY [Configure pfSense] ************************************************************************************************************************************

TASK [vpn | Add OpenVPN Client] **********************************************************************************************************************
task path: /home/user/projects/pfsense-config/playbook.yml:647
changed: [192.168.100.1] => {"changed": true, "commands": ["create openvpn 'vpn01', description='vpn01'"], "stderr": "", "stderr_lines": [], "stdout": "pfSense shell: global $debug;\npfSense shell: $debug = 1;\npfSense shell: \npfSense shell: require_once('openvpn.inc');\npfSense shell: init_config_arr(array('openvpn', 'openvpn-client'));\npfSense shell: $a = &$config['openvpn']['openvpn-client'];\npfSense shell: $ovpn = $a[0];\npfSense shell: \npfSense shell: openvpn_resync('client',$ovpn);\npfSense shell: \npfSense shell: exec\npfSense shell: exit\n", "stdout_lines": ["pfSense shell: global $debug;", "pfSense shell: $debug = 1;", "pfSense shell: ", "pfSense shell: require_once('openvpn.inc');", "pfSense shell: init_config_arr(array('openvpn', 'openvpn-client'));", "pfSense shell: $a = &$config['openvpn']['openvpn-client'];", "pfSense shell: $ovpn = $a[0];", "pfSense shell: ", "pfSense shell: openvpn_resync('client',$ovpn);", "pfSense shell: ", "pfSense shell: exec", "pfSense shell: exit"]}

PLAY RECAP **************************************************************************************************************************************************
192.168.100.1               : ok=1   changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Environment

Additional context Add any other context about the problem here.

likeMyCoffee commented 5 days ago

Here's the quick fix I did :-)

/plugins/module_utils/openvpn_client.py Line 163 is missing: self._get_ansible_param(obj, 'tls')