cfn-vpn 1.8.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 150d5c310df91f38fb0136841949f85cacfb5e3cce61dde33b6a5d8e5835c6c5
-  data.tar.gz: 491ec001fe6e315be750c19003eeb18d3b2fd63a03630477a89531f8454f8938
+  metadata.gz: 6de2cee8e97ac8192d0b8e6016b7dafc792b9390a7e92ceb7424e196b84ad93d
+  data.tar.gz: 246b593793480b838261ccd08578755b558b2c9e6f504d8752eaad2a7f35a71c
 SHA512:
-  metadata.gz: 3bc9a43cd62eeb967b52589cfe7e816313cd4d260065e5a17317f1d19e9b9b8afc5d00279800854f0c4f8d319b8d7febf2b0a0ec3f7f79cea0bdbc2853cf16d6
-  data.tar.gz: 0d10b220d8fbfb78f53ab0b0f3e0f586f0214b759a7ba6f605b8b8a05c4eeebb718b91618128e2414dd7c2b31792224287363836d5820717718ed5347e6b73fd
+  metadata.gz: 263267e258bf0bf399b36ac62582fe6750ec9f08054dd4e91d06dc2812d5d9f7fcd421bd21c5feb6c412a1ff07aad9e8919da87395231538faf876273b731ac3
+  data.tar.gz: cb323bf1459d72ce0e2110b822a0d79c0855e2b9932b02cc6fe84efae0c59b333427954367b57507107e86ce0e2b7e6a6375c8b5ae5e20cda23130cc92c67760

data/Dockerfile

@@ -9,7 +9,7 @@ RUN apt-get update -qq \
 ENV EASYRSA=/usr/share/easy-rsa
 ENV EASYRSA_BATCH=yes
 
-ARG CFNVPN_VERSION="1.8.0"
+ARG CFNVPN_VERSION="1.10.0"
 
 COPY . /src
 

data/docs/certificate-renewal.md

@@ -56,10 +56,18 @@ remote kdipkcte.cvpn-endpoint-<replace-id>.prod.clientvpn.<aws-region>.amazonaws
 
 ## VPNs Using Federated Access
 
-run the renew command with the default options
+run the renew command using your local easyrsa
 
 ```sh
-cfn-vpn renew [name] --bucket [s3-bucket]
+cfn-vpn renew [name] --bucket [s3-bucket] --easyrsa-local
+```
+
+The `--easyrsa-local` flag is required, the docker image scripts expect a client certificate common name which federated VPNs don't have.
+
+easyrsa will prompt for confirmation while creating the new CA, set `EASYRSA_BATCH=1` for unattended runs
+
+```sh
+EASYRSA_BATCH=1 cfn-vpn renew [name] --bucket [s3-bucket] --easyrsa-local
 ```
 
 This will recreate the vpn with the updated server certificate.

data/lib/cfnvpn/actions/renew_certificate.rb

@@ -75,9 +75,9 @@ module CfnVpn::Actions
           cert.renew(@config[:server_cn],@client_cn,@options['certificate_expiry'])
         end
       else
-        CfnVpn::Log.logger.info "recreating server and #{@client_cn} certificates with a new CA"
+        CfnVpn::Log.logger.info "recreating server certificate with a new CA"
         cert = CfnVpn::Certificates.new(@build_dir,@name,@options['easyrsa_local'])
-        cert.generate_ca(@options['server_cn'],@options['certificate_expiry'])
+        cert.generate_ca(@config[:server_cn],nil,@options['certificate_expiry'])
       end
     end
 

data/lib/cfnvpn/certificates.rb

@@ -39,9 +39,16 @@ module CfnVpn
         ENV["EASYRSA_PKI"] = @pki_dir
         system("easyrsa init-pki")
         system("easyrsa build-ca nopass")
+        # easyrsa 3.1+ rejects build-*-full while an external commonName is set
+        ENV.delete("EASYRSA_REQ_CN")
         system("easyrsa #{opts} build-server-full server nopass")
-        system("easyrsa #{opts} build-client-full #{client_cn} nopass")
-        FileUtils.cp(["#{@pki_dir}/ca.crt", "#{@pki_dir}/issued/server.crt", "#{@pki_dir}/private/server.key", "#{@pki_dir}/issued/#{client_cn}.crt", "#{@pki_dir}/private/#{client_cn}.key"], @cert_dir)
+        certs = ["#{@pki_dir}/ca.crt", "#{@pki_dir}/issued/server.crt", "#{@pki_dir}/private/server.key"]
+        # federated vpns only need the server certificate
+        unless client_cn.nil?
+          system("easyrsa #{opts} build-client-full #{client_cn} nopass")
+          certs.push("#{@pki_dir}/issued/#{client_cn}.crt", "#{@pki_dir}/private/#{client_cn}.key")
+        end
+        FileUtils.cp(certs, @cert_dir)
         system("tar czfv #{@cert_dir}/ca.tar.gz -C #{@build_dir} pki/")
       else
         @docker_cmd << "-e EASYRSA_REQ_CN=#{server_cn}"
@@ -119,6 +126,8 @@ module CfnVpn
         FileUtils.mv("#{@pki_dir}/issued/#{client_cn}.crt", "#{@pki_dir}/issued/#{client_cn}.req.bak-#{timestamp}")
         FileUtils.mv("#{@pki_dir}/private/#{client_cn}.key", "#{@pki_dir}/private/#{client_cn}.req.bak-#{timestamp}")
 
+        # easyrsa 3.1+ rejects build-*-full while an external commonName is set
+        ENV.delete("EASYRSA_REQ_CN")
         system("easyrsa #{opts} build-server-full server nopass")
         system("easyrsa #{opts} build-client-full #{client_cn} nopass")
         FileUtils.cp(["#{@pki_dir}/ca.crt", "#{@pki_dir}/issued/server.crt", "#{@pki_dir}/private/server.key", "#{@pki_dir}/issued/#{client_cn}.crt", "#{@pki_dir}/private/#{client_cn}.key"], @cert_dir)

data/lib/cfnvpn/templates/vpn.rb

@@ -203,7 +203,12 @@ module CfnVpn
 
           elsif route.has_key?(:cidr)
             target_subnets.each do |subnet|
+              # routes are tied to the subnet association: aws deletes them when the
+              # target network is disassociated, so they must be conditioned on the
+              # association to stay in sync with it.
               EC2_ClientVpnRoute(:"#{route[:cidr].resource_safe}VpnRouteTo#{subnet.resource_safe}"[0..255]) {
+                Condition(:EnableSubnetAssociation)
+                DependsOn network_assoc_dependson if network_assoc_dependson.any?
                 Description "cfnvpn static route for #{route[:cidr]}. #{route[:desc]}".strip
                 ClientVpnEndpointId Ref(:ClientVpnEndpoint)
                 DestinationCidrBlock route[:cidr]

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "1.8.0".freeze
+  VERSION = "1.10.0".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.10.0
 platform: ruby
 authors:
 - Guslington
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-21 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor