cfn-vpn 1.5.0 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03a0a38a10b42f88181de0fe2dc2954d4724f70515fcc3eb529f5a148ff17025
-  data.tar.gz: fb22c0da59f79dcf2b5175b31bb0b5c1cbf731568e3c99dc5de85bebe50f0240
+  metadata.gz: 150d5c310df91f38fb0136841949f85cacfb5e3cce61dde33b6a5d8e5835c6c5
+  data.tar.gz: 491ec001fe6e315be750c19003eeb18d3b2fd63a03630477a89531f8454f8938
 SHA512:
-  metadata.gz: 424241bf23dd636c2c3930e7475d6840dbd110421160c517fd23b66e08306183f6f398dde96ce3fb595f7bbe3852e1dcb40a45f2a750a00c4f61a76698277217
-  data.tar.gz: 8d06e2135f609be0b36bf8672bdc1f8d88bf1d31213763741592cd0f511060c925ce872e5081c30c1ad8a09e4465cc49249a652cd3c360a879da310f05a7d7e1
+  metadata.gz: 3bc9a43cd62eeb967b52589cfe7e816313cd4d260065e5a17317f1d19e9b9b8afc5d00279800854f0c4f8d319b8d7febf2b0a0ec3f7f79cea0bdbc2853cf16d6
+  data.tar.gz: 0d10b220d8fbfb78f53ab0b0f3e0f586f0214b759a7ba6f605b8b8a05c4eeebb718b91618128e2414dd7c2b31792224287363836d5820717718ed5347e6b73fd

data/Dockerfile

@@ -9,7 +9,7 @@ RUN apt-get update -qq \
 ENV EASYRSA=/usr/share/easy-rsa
 ENV EASYRSA_BATCH=yes
 
-ARG CFNVPN_VERSION="1.5.0"
+ARG CFNVPN_VERSION="1.8.0"
 
 COPY . /src
 

data/docs/certificate-users.md

@@ -25,6 +25,7 @@ This will revoke the client certificate and apply to the client VPN endpoint.
 Note this wont terminate the session but will stop the client from reconnecting using the certificate.
 
 ```sh
+# please ensure that you are using the latest cfn-vpn version before revoking cert since previous versions have issues maintaining the CRL
 cfn-vpn revoke myvpn --client-cn user1 --bucket mybucket
 ```
 
@@ -93,4 +94,4 @@ Modify base2-ciinabox.config.ovpn to include the full location of your extracted
 	echo "cert /<path>/user1.crt" >> myvpn.config.ovpn
 
 Open myvpn.config.ovpn with your favorite openvpn client.
-```
+```

data/docs/modifying.md

@@ -34,7 +34,7 @@ cfn-vpn params [name] --diff-yaml cfnvpn.[name].yaml
 cfn-vpn configuration can be managed through a YAML file using the `modify` command to apply the config changes to the vpn stack. See the [YAML docs](yaml-config.md) for config options.
 
 ```
-cfn-vpn modify [name] --params-yaml cfnvpn.[name].yaml
+cfn-vpn modify [name] --param-yaml cfnvpn.[name].yaml
 ```
 
 a cloudformation changeset is created with the desired changes and approval is asked

data/docs/yaml-config.md

@@ -7,7 +7,7 @@ cfn-vpn configuration can be managed through a YAML file using the `modify` comm
 run the `modify` command and supply the yaml file to apply the changes
 
 ```sh
-cfn-vpn routes [name] --params-yaml cfnvpn.[name].yaml
+cfn-vpn routes [name] --param-yaml cfnvpn.[name].yaml
 ```
 
 ## Dump Current Config to YAML File

data/lib/cfnvpn/actions/modify.rb

@@ -73,7 +73,8 @@ module CfnVpn::Actions
 
       if @options[:param_yaml]
         CfnVpn::Log.logger.debug "Loading config from YAML file #{@options[:param_yaml]}"
-        @config = CfnVpn::Config.get_config_from_yaml_file(@options[:param_yaml])
+        yaml_config = CfnVpn::Config.get_config_from_yaml_file(@options[:param_yaml])
+        @config = @config.merge(yaml_config)
       else
         CfnVpn::Log.logger.debug "Loading config from options"
         @options.each do |key, value|

data/lib/cfnvpn/actions/revoke.rb

@@ -38,6 +38,12 @@ module CfnVpn::Actions
       s3.get_object("#{@cert_dir}/#{@options['client_cn']}.tar.gz")
       CfnVpn::Log.logger.info "Generating new client certificate #{@options['client_cn']} using openvpn easy-rsa"
       CfnVpn::Log.logger.debug cert.revoke_client(@options['client_cn'])
+      
+      # persist index.txt which contains previous CRL back to s3
+      system("tar xzfv #{@cert_dir}/ca.tar.gz --directory #{@build_dir}")
+      FileUtils.cp(["#{@cert_dir}/index.txt"], "#{@build_dir}/pki/")
+      system("tar czfv #{@cert_dir}/ca.tar.gz -C #{@build_dir} pki/")
+      s3.store_object("#{@cert_dir}/ca.tar.gz")
     end
 
     def apply_rekocation_list

data/lib/cfnvpn/certificates.rb

@@ -142,11 +142,12 @@ module CfnVpn
         system("easyrsa revoke #{client_cn}")
         system("easyrsa gen-crl")
         FileUtils.cp("#{@pki_dir}/crl.pem", @cert_dir)
+        FileUtils.cp("#{@pki_dir}/index.txt", @cert_dir)
       else
         @docker_cmd << "-e EASYRSA_CLIENT_CN=#{client_cn}"
         @docker_cmd << "-v #{@cert_dir}:/easy-rsa/output"
         @docker_cmd << @easyrsa_image
-        @docker_cmd << "sh -c 'revoke-client'"
+        @docker_cmd << "sh -c 'revoke-client && cp pki/index.txt output/index.txt'"
         CfnVpn::Log.logger.debug `#{@docker_cmd.join(' ')}`
       end
     end

data/lib/cfnvpn/templates/vpn.rb

@@ -83,7 +83,7 @@ module CfnVpn
           network_assoc_dependson << "ClientVpnTargetNetworkAssociation#{suffix}"
         end
 
-        if config[:default_groups].any?
+        if !config[:default_groups].nil? && config[:default_groups].any?
           config[:default_groups].each do |group|
             EC2_ClientVpnAuthorizationRule(:"TargetNetworkAuthorizationRule#{group.resource_safe}"[0..255]) {
               Condition(:EnableSubnetAssociation)

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "1.5.0".freeze
+  VERSION = "1.8.0".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.8.0
 platform: ruby
 authors:
 - Guslington
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-02-07 00:00:00.000000000 Z
+date: 2026-08-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -290,7 +290,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/base2services/aws-client-vpn
   source_code_uri: https://github.com/base2services/aws-client-vpn
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -306,7 +306,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: creates and manages resources for the aws client vpn
 test_files: []