T7635: OpenConnect Certificate Authentication

[giga1699]

Change summary

Adds feature to enable certificate based authentication for OpenConnect

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

https://vyos.dev/T7635

Related PR(s)

vyos/vyos-documentation#1662

How to test / Smoketest result

configure
run generate pki ca install catest
commit
run generate pki certificate sign catest install certtest
commit
set vpn openconnect authentication mode cert cn
set vpn openconnect network-settings client-ip-settings subnet 192.168.1.0/24
set vpn openconnect ssl ca-certificate catest
set vpn openconnect ssl certificate certtest
commit
exit

Check ocserv.conf for auth = "certificate" and cert-user-oid = 2.5.4.3

sudo cat /var/run/ocserv/ocserv.conf

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[github-actions]

CI integration ❌ failed!

Details

CI logs

• CLI Smoketests (no interfaces) ❌ failed
• CLI Smoketests (interfaces only) ❌ failed
• Config tests ❌ failed
• RAID1 tests ❌ failed
• TPM tests ❌ failed

[giga1699]

I believe this would be backwards compatible to Sagitta if you'd like to backport it.