vyos-1x.git/src/tests/test_openvpn_migration.py, branch fix/T8955-http-api-verify-tls

openvpn: T9363: multiply the site-to-site keepalive timeout

2026-09-29T18:40:44+00:00

"failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults.

openvpn: T8264: reject the raw options DCO cannot serve

2026-09-13T19:06:12+00:00

Raw options are appended after --config and therefore override what the CLI rendered, so they have to face the same checks. A single cipher the Kernel module does not implement makes OpenVPN fall back to the userspace data path; "ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop the offload just the same. "DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers alone before it weighs the offload, and the migration drops the offload from whatever stays rejected.

openvpn: T8264: keep the keepalive within what OpenVPN accepts

2026-09-13T19:06:12+00:00

The CLI renders "keepalive " while its two ranges are independent, so it can produce parameters the daemon refuses to start on: a timeout below twice the interval, or one beyond the 12 hours OpenVPN is about to cap ping and keepalive at. A zero interval renders "keepalive 0 0", on which OpenVPN skips these checks and simply runs without keepalive, so leave that combination alone. Migrate what stays rejected, or an upgrade would leave a configuration the router can no longer commit at boot.

openvpn: T8264: migrate away DCO the Kernel module cannot serve

2026-09-13T19:06:12+00:00

"offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration.