summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniil Baturin <daniil@baturin.org>2023-09-20 15:36:00 +0100
committerDaniil Baturin <daniil@baturin.org>2023-09-20 15:36:00 +0100
commit4bbbaab60d56bfd6f3a145378027642b4c47adee (patch)
tree90426ab7d91c5bd0621a2f3d79dd0865715e1875
parentb52cf1b7b3bc138b26eb21f917967748c40f9d3a (diff)
downloadvyos-1x-4bbbaab60d56bfd6f3a145378027642b4c47adee.tar.gz
vyos-1x-4bbbaab60d56bfd6f3a145378027642b4c47adee.zip
openvpn: T5269: add a deprecation warning for shared-secret
-rwxr-xr-xsrc/conf_mode/interfaces-openvpn.py6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 9f4de990c..bdeb44837 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -30,6 +30,7 @@ from netifaces import interfaces
from secrets import SystemRandom
from shutil import rmtree
+from vyos.base import DeprecationWarning
from vyos.config import Config
from vyos.configdict import get_interface_dict
from vyos.configdict import is_node_changed
@@ -165,6 +166,11 @@ def verify_pki(openvpn):
if shared_secret_key not in pki['openvpn']['shared_secret']:
raise ConfigError(f'Invalid shared-secret on openvpn interface {interface}')
+ # If PSK settings are correct, warn about its deprecation
+ DeprecationWarning("OpenVPN shared-secret support will be removed in future VyOS versions.\n\
+ Please migrate your site-to-site tunnels to TLS.\n\
+ You can use self-signed certificates with peer fingerprint verification, consult the documentation for details.")
+
if tls:
if (mode in ['server', 'client']) and ('ca_certificate' not in tls):
raise ConfigError(f'Must specify "tls ca-certificate" on openvpn interface {interface},\