Skip to content

apache::vhost define parameter ssl_cipher allows array but is not handling it correctly in template #2420

@SimonHoenscheid

Description

@SimonHoenscheid

Describe the Bug

The apache::vhost define allows to use a String or Array Datatype for the ssl_cipher parameter. The array is not handled correctly in the template:

(

Optional[Variant[Array[String], String]] $ssl_cipher = undef,
)
Let's declare a vhost:

apache::vhost { "${vhost}-https":
      servername           => $vhost,
      port                 => 443,
      ssl                  => true,
      ssl_protocol         => ['all', '-SSLv2', '-SSLv3', '-TLSv1', '-TLSv1.1'],
      ssl_cipher           => [
        'ECDHE-ECDSA-AES128-GCM-SHA256',
        'ECDHE-RSA-AES128-GCM-SHA256',
        'ECDHE-ECDSA-AES256-GCM-SHA384',
        'ECDHE-RSA-AES256-GCM-SHA384',
        'ECDHE-ECDSA-CHACHA20-POLY1305',
        'ECDHE-RSA-CHACHA20-POLY1305',
        'DHE-RSA-AES128-GCM-SHA256',
        'DHE-RSA-AES256-GCM-SHA384',
      ],

Let's have a look at the template:

<%- if @ssl_protocol -%>
SSLProtocol <%= [@ssl_protocol].flatten.compact.join(' ') %>
<%- end -%>
<%- if @ssl_cipher -%>
SSLCipherSuite <%= @ssl_cipher %>
<%- end -%>

The ssl_protocol allows the same data types and works.

Outcome:

Jun 08 20:36:13 testserver systemd[1]: Starting The Apache HTTP Server...
Jun 08 20:36:13 testserver apachectl[178095]: AH00526: Syntax error on line 46 of /etc/apache2/sites-enabled/25-bsb-test.atlasteam.net-https.conf:
Jun 08 20:36:13 testserver apachectl[178095]: SSLCipherSuite takes 1-2 arguments, Colon-delimited list of permitted SSL Ciphers, optional preceded by protocol identifier ('XXX:...:XXX' - see manual)

Expected Behavior

It works with arrays and strings

Steps to Reproduce

Steps to reproduce the behavior:
see above

Environment

Module Version v10.0.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions