diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-01-15 16:36:53 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-01-15 16:36:53 +0100 |
| commit | 06eed816c29c11b1f1a8cfdd6b2116d5708a35eb (patch) | |
| tree | 992652c2e34b2838a8c961fc5f25d153e202b91a /src/conf_mode | |
| parent | 0c373c7c9cf0fff573e5acc5642f6af63c311da2 (diff) | |
| parent | 61487b13da8dc270907633a3140bd0cc2aa0926a (diff) | |
| download | vyos-1x-06eed816c29c11b1f1a8cfdd6b2116d5708a35eb.tar.gz vyos-1x-06eed816c29c11b1f1a8cfdd6b2116d5708a35eb.zip | |
Merge pull request #4923 from alexandr-san4ez/T7633-current
openvpn: T7633: Add support for `data-ciphers-fallback` in site-to-site tunnels
Diffstat (limited to 'src/conf_mode')
| -rwxr-xr-x | src/conf_mode/interfaces_openvpn.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py index 5cc09da89..bb9d06389 100755 --- a/src/conf_mode/interfaces_openvpn.py +++ b/src/conf_mode/interfaces_openvpn.py @@ -168,6 +168,12 @@ def is_ec_private_key(pki, cert_name): key = load_private_key(pki_cert['private']['key']) return isinstance(key, ec.EllipticCurvePrivateKey) + +def verify_data_ciphers_fallback(openvpn): + if openvpn['mode'] != 'site-to-site': + if dict_search('encryption.data_ciphers_fallback', openvpn): + raise ConfigError('Cipher fallback is valid only in site-to-site mode') + def verify_pki(openvpn): pki = openvpn['pki'] interface = openvpn['ifname'] @@ -615,6 +621,8 @@ def verify(openvpn): verify_bond_bridge_member(openvpn) verify_mirror_redirect(openvpn) + verify_data_ciphers_fallback(openvpn) + return None def generate_pki_files(openvpn): |