Add {TLSCipher}* options for agent
MODIFY
manifests/agent.pp
manifests/agent.pp
# [*tlspskidentity*]
# Unique, case sensitive string used to identify the pre-shared key.
#
+# [*tlscipherall*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlscipherall13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlsciphercert*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlsciphercert13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlscipherpsk*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
+# [*tlscipherpsk13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
# [*tlsservercertissuer*]
# Allowed server certificate issuer.
#
@@ -311,6 +335,12 @@ class zabbix::agent (
$tlsaccept = $zabbix::params::agent_tlsaccept,
$tlscafile = $zabbix::params::agent_tlscafile,
$tlscertfile = $zabbix::params::agent_tlscertfile,
+ Optional[String[1]] $tlscipherall = $zabbix::params::agent_tlscipherall,
+ Optional[String[1]] $tlscipherall13 = $zabbix::params::agent_tlscipherall13,
+ Optional[String[1]] $tlsciphercert = $zabbix::params::agent_tlsciphercert,
+ Optional[String[1]] $tlsciphercert13 = $zabbix::params::agent_tlsciphercert13,
+ Optional[String[1]] $tlscipherpsk = $zabbix::params::agent_tlscipherpsk,
+ Optional[String[1]] $tlscipherpsk13 = $zabbix::params::agent_tlscipherpsk13,
$tlsconnect = $zabbix::params::agent_tlsconnect,
$tlscrlfile = $zabbix::params::agent_tlscrlfile,
$tlskeyfile = $zabbix::params::agent_tlskeyfile,

MODIFY
manifests/params.pp
manifests/params.pp
@@ -316,6 +316,12 @@ class zabbix::params {
$agent_tlsaccept = undef
$agent_tlscafile = undef
$agent_tlscertfile = undef
+ $agent_tlscipherall = undef
+ $agent_tlscipherall13 = undef
+ $agent_tlsciphercert = undef
+ $agent_tlsciphercert13 = undef
+ $agent_tlscipherpsk = undef
+ $agent_tlscipherpsk13 = undef
$agent_tlsconnect = undef
$agent_tlscrlfile = undef
$agent_tlskeyfile = undef

MODIFY
spec/classes/agent_spec.rb
spec/classes/agent_spec.rb
@@ -288,7 +288,13 @@ describe 'zabbix::agent' do
tlscertfile: '/etc/zabbix/keys/tls.crt',
tlskeyfile: '/etc/zabbix/keys/tls.key',
tlspskidentity: '/etc/zabbix/keys/tlspskidentity.id',
- tlspskfile: '/etc/zabbix/keys/tlspskfile.key'
+ tlspskfile: '/etc/zabbix/keys/tlspskfile.key',
+ tlsciphercert: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlsciphercert13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlscipherpsk: 'kECDHEPSK+AES128:kPSK+AES128',
+ tlscipherpsk13: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128'
}
end
@@ -324,6 +330,12 @@ describe 'zabbix::agent' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSKeyFile=/etc/zabbix/keys/tls.key$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSPSKIdentity=/etc/zabbix/keys/tlspskidentity.id$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSPSKFile=/etc/zabbix/keys/tlspskfile.key$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherCert=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherCert13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherPSK=kECDHEPSK\+AES128:kPSK\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherAll=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherAll13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128:kECDHEPSK\+AES128:kPSK\+AES128$} }
end
end

MODIFY
templates/zabbix_agentd.conf.erb
templates/zabbix_agentd.conf.erb
@@ -374,3 +374,70 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSPSKFile=
<% if @tlspskfile %>TLSPSKFile=<%= @tlspskfile %><% end %>
+
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: TLSCipherCert13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+#
+# Mandatory: no
+# Default:
+<% if @tlsciphercert13 %>TLSCipherCert13=<%= @tlsciphercert13 %><% end %>
+
+### Option: TLSCipherCert
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128
+#
+# Mandatory: no
+# Default:
+<% if @tlsciphercert %>TLSCipherCert=<%= @tlsciphercert %><% end %>
+
+### Option: TLSCipherPSK13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example:
+# TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherpsk13 %>TLSCipherPSK13=<%= @tlscipherpsk13 %><% end %>
+
+### Option: TLSCipherPSK
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL
+# Example for OpenSSL:
+# kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherpsk %>TLSCipherPSK=<%= @tlscipherpsk %><% end %>
+
+### Option: TLSCipherAll13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example:
+# TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherall13 %>TLSCipherAll13=<%= @tlscipherall13 %><% end %>
+
+### Option: TLSCipherAll
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+
+<% end %>

Add {TLSCipher}* options for agent

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>