openvpn: T9363: multiply the site-to-site keepalive timeout

"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.

Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.

This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.

1 files changed, 21 insertions, 7 deletions

diff --git a/src/migration-scripts/openvpn/5-to-6 b/src/migration-scripts/openvpn/5-to-6
index 9a6de85cd..fc4dccb38 100644
--- a/src/migration-scripts/openvpn/5-to-6
+++ b/src/migration-scripts/openvpn/5-to-6
@@ -17,6 +17,11 @@
 # can not serve, because OpenVPN 2.6 silently ignored the module. Now that the
 # offload is real those combinations are rejected, so drop the request from
 # configurations that would otherwise fail to load.
+#
+# T9363: site-to-site rendered "ping-restart <failure-count>", so the count
+# landed as a number of seconds while the server has always rendered
+# interval * failure-count. Now that both agree, a timeout OpenVPN refuses is
+# reachable in site-to-site too, so the same clamp has to cover it.
 
 from vyos.configtree import ConfigTree
 
@@ -94,8 +99,9 @@ def _value(config: ConfigTree, path: list):
 
 
 def _clamp_keepalive(config: ConfigTree, path: list) -> None:
-    """Bring a server keepalive within what verify() accepts."""
-    if _value(config, path + ['mode']) != 'server':
+    """Bring a keepalive within what verify() accepts."""
+    mode = _value(config, path + ['mode'])
+    if mode not in ['server', 'site-to-site']:
         return
 
     # both nodes carry a CLI default, so they render even when absent
@@ -107,11 +113,19 @@ def _clamp_keepalive(config: ConfigTree, path: list) -> None:
     if interval < 1:
         return
 
-    # the timeout is interval * failure-count: it has to reach twice the
-    # interval and stay below 12 hours. Beyond an interval of 21600 no count
-    # satisfies both - the CLI range stops at 600, so only a hand-edited
-    # configuration gets there and its interval is rejected anyway.
-    wanted = min(max(count, 2), max(2, 43200 // interval))
+    if mode == 'site-to-site':
+        # site-to-site renders "ping-restart" itself, which OpenVPN caps at
+        # 24 hours and does not double. It carries no "at least twice the
+        # interval" rule either, since that one belongs to "keepalive".
+        wanted = min(count, 86400 // interval)
+    else:
+        # the timeout is interval * failure-count: it has to reach twice the
+        # interval and stay below 12 hours. Beyond an interval of 21600 no
+        # count satisfies both - the CLI range stops at 600, so only a
+        # hand-edited configuration gets there and its interval is rejected
+        # anyway.
+        wanted = min(max(count, 2), max(2, 43200 // interval))
+
     if wanted != count:
         config.set(path + ['keep-alive', 'failure-count'], value=str(wanted))