-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Closed
Labels
Description
Describe the Bug
The apache::vhost define allows to use a String or Array Datatype for the ssl_cipher parameter. The array is not handled correctly in the template:
(
puppetlabs-apache/manifests/vhost.pp
Line 1722 in 8c07b77
Optional[Variant[Array[String], String]] $ssl_cipher = undef, |
Let's declare a vhost:
apache::vhost { "${vhost}-https":
servername => $vhost,
port => 443,
ssl => true,
ssl_protocol => ['all', '-SSLv2', '-SSLv3', '-TLSv1', '-TLSv1.1'],
ssl_cipher => [
'ECDHE-ECDSA-AES128-GCM-SHA256',
'ECDHE-RSA-AES128-GCM-SHA256',
'ECDHE-ECDSA-AES256-GCM-SHA384',
'ECDHE-RSA-AES256-GCM-SHA384',
'ECDHE-ECDSA-CHACHA20-POLY1305',
'ECDHE-RSA-CHACHA20-POLY1305',
'DHE-RSA-AES128-GCM-SHA256',
'DHE-RSA-AES256-GCM-SHA384',
],
Let's have a look at the template:
puppetlabs-apache/templates/vhost/_ssl.erb
Lines 12 to 17 in 8c07b77
<%- if @ssl_protocol -%> | |
SSLProtocol <%= [@ssl_protocol].flatten.compact.join(' ') %> | |
<%- end -%> | |
<%- if @ssl_cipher -%> | |
SSLCipherSuite <%= @ssl_cipher %> | |
<%- end -%> |
The ssl_protocol allows the same data types and works.
Outcome:
Jun 08 20:36:13 testserver systemd[1]: Starting The Apache HTTP Server...
Jun 08 20:36:13 testserver apachectl[178095]: AH00526: Syntax error on line 46 of /etc/apache2/sites-enabled/25-bsb-test.atlasteam.net-https.conf:
Jun 08 20:36:13 testserver apachectl[178095]: SSLCipherSuite takes 1-2 arguments, Colon-delimited list of permitted SSL Ciphers, optional preceded by protocol identifier ('XXX:...:XXX' - see manual)
Expected Behavior
It works with arrays and strings
Steps to Reproduce
Steps to reproduce the behavior:
see above
Environment
Module Version v10.0.0