openvpn: T7633: Add support for 'data-ciphers-fallback' in site-to-site tunnels

- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces
  (used as fallback cipher in site-to-site mode)
- Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces

1 files changed, 8 insertions, 0 deletions

diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py
index 5cc09da89..bb9d06389 100755
--- a/src/conf_mode/interfaces_openvpn.py
+++ b/src/conf_mode/interfaces_openvpn.py
@@ -168,6 +168,12 @@ def is_ec_private_key(pki, cert_name):
     key = load_private_key(pki_cert['private']['key'])
     return isinstance(key, ec.EllipticCurvePrivateKey)
 
+
+def verify_data_ciphers_fallback(openvpn):
+    if openvpn['mode'] != 'site-to-site':
+        if dict_search('encryption.data_ciphers_fallback', openvpn):
+            raise ConfigError('Cipher fallback is valid only in site-to-site mode')
+
 def verify_pki(openvpn):
     pki = openvpn['pki']
     interface = openvpn['ifname']
@@ -615,6 +621,8 @@ def verify(openvpn):
     verify_bond_bridge_member(openvpn)
     verify_mirror_redirect(openvpn)
 
+    verify_data_ciphers_fallback(openvpn)
+
     return None
 
 def generate_pki_files(openvpn):