vyos-1x.git/src/migration-scripts/openvpn, branch fix/T8955-http-api-verify-tls

openvpn: T9363: multiply the site-to-site keepalive timeout

2026-09-29T18:40:44+00:00

"failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults.

openvpn: T8264: reject the raw options DCO cannot serve

2026-09-13T19:06:12+00:00

Raw options are appended after --config and therefore override what the CLI rendered, so they have to face the same checks. A single cipher the Kernel module does not implement makes OpenVPN fall back to the userspace data path; "ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop the offload just the same. "DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers alone before it weighs the offload, and the migration drops the offload from whatever stays rejected.

openvpn: T8264: keep the keepalive within what OpenVPN accepts

2026-09-13T19:06:12+00:00

The CLI renders "keepalive " while its two ranges are independent, so it can produce parameters the daemon refuses to start on: a timeout below twice the interval, or one beyond the 12 hours OpenVPN is about to cap ping and keepalive at. A zero interval renders "keepalive 0 0", on which OpenVPN skips these checks and simply runs without keepalive, so leave that combination alone. Migrate what stays rejected, or an upgrade would leave a configuration the router can no longer commit at boot.

openvpn: T8264: migrate away DCO the Kernel module cannot serve

2026-09-13T19:06:12+00:00

"offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration.

openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead

2026-03-06T19:14:56+00:00

This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634: Remove support for insecure DES and Blowfish ciphers") by not only deleting insecure DES and Blowfish ciphers, but providing an alternative (3DES). If no cipher is defined, this will result in OpenVPN service not starting at all, as the implicit defined BF-CBC cipher is no longer supported by OpenSSL 3.0.0.

openvpn: T7633: Add support for 'data-ciphers-fallback' in site-to-site tunnels

2026-01-12T13:44:32+00:00

- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces (used as fallback cipher in site-to-site mode) - Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

vyos.configtree: T6620: allow list_nodes() to work on non-existent paths

2024-07-29T18:16:43+00:00

and return an empty list in that case (handy for migration scripts and the like)

OpenVPN CLI-option: T6571: rename ncp-ciphers with data-ciphers

2024-07-25T10:07:02+00:00

openvpn: T6591: deprecate OpenVPN server net30 topology (#3825)

2024-07-18T18:33:24+00:00