nixos/tests/initrd-network-openvpn: fix

- The default cipher is BF-CBC, which openvpn refuses to use by default.
Switched to AES-256-CBC.
- openvpn does not require an external "ip" executable anymore, and does
not support the "ipconfig" option by default, so remove that option.

Changed files
+4 -5
nixos
modules
system
tests
initrd-network-openvpn
+1 -4
nixos/modules/system/boot/initrd-openvpn.nix
···
$out/bin/openvpn --show-gateway
'';
-
# Add `iproute /bin/ip` to the config, to ensure that openvpn
-
# is able to set the routes
boot.initrd.network.postCommands = ''
-
(cat /etc/initrd.ovpn; echo -e '\niproute /bin/ip') | \
-
openvpn /dev/stdin &
'';
};
···
$out/bin/openvpn --show-gateway
'';
boot.initrd.network.postCommands = ''
+
openvpn /etc/initrd.ovpn &
'';
};
+1
nixos/tests/initrd-network-openvpn/default.nix
···
config = ''
dev tun0
ifconfig 10.8.0.1 10.8.0.2
${secretblock}
'';
};
···
config = ''
dev tun0
ifconfig 10.8.0.1 10.8.0.2
+
cipher AES-256-CBC
${secretblock}
'';
};
+2 -1
nixos/tests/initrd-network-openvpn/initrd.ovpn
···
ifconfig 10.8.0.2 10.8.0.1
# Only force VLAN 2 through the VPN
route 192.168.2.0 255.255.255.0 10.8.0.1
secret [inline]
<secret>
#
···
e7811584363597599cce2040a68ac00e
f2125540e0f7f4adc37cb3f0d922eeb7
-----END OpenVPN Static key V1-----
-
</secret>
···
ifconfig 10.8.0.2 10.8.0.1
# Only force VLAN 2 through the VPN
route 192.168.2.0 255.255.255.0 10.8.0.1
+
cipher AES-256-CBC
secret [inline]
<secret>
#
···
e7811584363597599cce2040a68ac00e
f2125540e0f7f4adc37cb3f0d922eeb7
-----END OpenVPN Static key V1-----
+
</secret>