cfn-vpn 1.5.0 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03a0a38a10b42f88181de0fe2dc2954d4724f70515fcc3eb529f5a148ff17025
-  data.tar.gz: fb22c0da59f79dcf2b5175b31bb0b5c1cbf731568e3c99dc5de85bebe50f0240
+  metadata.gz: ef9cd59cf1876c3b909d920e68d331e6a6c7985eb6e4a9ad069cc065d7e5e79b
+  data.tar.gz: 3beaf85c7b146bb7df165661b9a0a66268a6372e34865c62b7b9ddc238982a75
 SHA512:
-  metadata.gz: 424241bf23dd636c2c3930e7475d6840dbd110421160c517fd23b66e08306183f6f398dde96ce3fb595f7bbe3852e1dcb40a45f2a750a00c4f61a76698277217
-  data.tar.gz: 8d06e2135f609be0b36bf8672bdc1f8d88bf1d31213763741592cd0f511060c925ce872e5081c30c1ad8a09e4465cc49249a652cd3c360a879da310f05a7d7e1
+  metadata.gz: f4221735ef37e25221dd6802baace032d1330d980fd0827aa9c2907042b0b6ceb18888d7f431553e4cbc027af96382166a3662d63bd936db250443d3baa6cd4c
+  data.tar.gz: 8ab592bdc27770b1eb61fd4532e6b572c895d94d7e5225d7a5518fc22242975be58a71e31d8465d770b88c95f6992ff8074ff0ce02356b1feb2bb35233b18282

data/Dockerfile

@@ -9,7 +9,7 @@ RUN apt-get update -qq \
 ENV EASYRSA=/usr/share/easy-rsa
 ENV EASYRSA_BATCH=yes
 
-ARG CFNVPN_VERSION="1.5.0"
+ARG CFNVPN_VERSION="1.7.0"
 
 COPY . /src
 

data/docs/certificate-users.md

@@ -25,6 +25,7 @@ This will revoke the client certificate and apply to the client VPN endpoint.
 Note this wont terminate the session but will stop the client from reconnecting using the certificate.
 
 ```sh
+# please ensure that you are using the latest cfn-vpn version before revoking cert since previous versions have issues maintaining the CRL
 cfn-vpn revoke myvpn --client-cn user1 --bucket mybucket
 ```
 
@@ -93,4 +94,4 @@ Modify base2-ciinabox.config.ovpn to include the full location of your extracted
 	echo "cert /<path>/user1.crt" >> myvpn.config.ovpn
 
 Open myvpn.config.ovpn with your favorite openvpn client.
-```
+```

data/lib/cfnvpn/actions/revoke.rb

@@ -38,6 +38,12 @@ module CfnVpn::Actions
       s3.get_object("#{@cert_dir}/#{@options['client_cn']}.tar.gz")
       CfnVpn::Log.logger.info "Generating new client certificate #{@options['client_cn']} using openvpn easy-rsa"
       CfnVpn::Log.logger.debug cert.revoke_client(@options['client_cn'])
+      
+      # persist index.txt which contains previous CRL back to s3
+      system("tar xzfv #{@cert_dir}/ca.tar.gz --directory #{@build_dir}")
+      FileUtils.cp(["#{@cert_dir}/index.txt"], "#{@build_dir}/pki/")
+      system("tar czfv #{@cert_dir}/ca.tar.gz -C #{@build_dir} pki/")
+      s3.store_object("#{@cert_dir}/ca.tar.gz")
     end
 
     def apply_rekocation_list

data/lib/cfnvpn/certificates.rb

@@ -142,11 +142,12 @@ module CfnVpn
         system("easyrsa revoke #{client_cn}")
         system("easyrsa gen-crl")
         FileUtils.cp("#{@pki_dir}/crl.pem", @cert_dir)
+        FileUtils.cp("#{@pki_dir}/index.txt", @cert_dir)
       else
         @docker_cmd << "-e EASYRSA_CLIENT_CN=#{client_cn}"
         @docker_cmd << "-v #{@cert_dir}:/easy-rsa/output"
         @docker_cmd << @easyrsa_image
-        @docker_cmd << "sh -c 'revoke-client'"
+        @docker_cmd << "sh -c 'revoke-client && cp pki/index.txt output/index.txt'"
         CfnVpn::Log.logger.debug `#{@docker_cmd.join(' ')}`
       end
     end

data/lib/cfnvpn/templates/vpn.rb

@@ -83,7 +83,7 @@ module CfnVpn
           network_assoc_dependson << "ClientVpnTargetNetworkAssociation#{suffix}"
         end
 
-        if config[:default_groups].any?
+        if !config[:default_groups].nil? && config[:default_groups].any?
           config[:default_groups].each do |group|
             EC2_ClientVpnAuthorizationRule(:"TargetNetworkAuthorizationRule#{group.resource_safe}"[0..255]) {
               Condition(:EnableSubnetAssociation)

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "1.5.0".freeze
+  VERSION = "1.7.0".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.7.0
 platform: ruby
 authors:
 - Guslington
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-02-07 00:00:00.000000000 Z
+date: 2025-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -290,7 +290,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/base2services/aws-client-vpn
   source_code_uri: https://github.com/base2services/aws-client-vpn
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -306,7 +306,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: creates and manages resources for the aws client vpn
 test_files: []