diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-03-05 19:49:28 +0100 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-03-06 20:14:56 +0100 |
| commit | 89e037a7d85cf9525418d521dcdf427545161948 (patch) | |
| tree | 236d3662349da50e7ecc7b96ed1b4119dd370fac /src/migration-scripts | |
| parent | 7c520f8ec786f6cff411188498822eab00e69afd (diff) | |
| download | vyos-1x-89e037a7d85cf9525418d521dcdf427545161948.tar.gz vyos-1x-89e037a7d85cf9525418d521dcdf427545161948.zip | |
openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead
This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634:
Remove support for insecure DES and Blowfish ciphers") by not only deleting
insecure DES and Blowfish ciphers, but providing an alternative (3DES).
If no cipher is defined, this will result in OpenVPN service not starting at
all, as the implicit defined BF-CBC cipher is no longer supported by
OpenSSL 3.0.0.
Diffstat (limited to 'src/migration-scripts')
| -rw-r--r-- | src/migration-scripts/openvpn/0-to-1 | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/migration-scripts/openvpn/0-to-1 b/src/migration-scripts/openvpn/0-to-1 index 582cd9a46..26f41d2ce 100644 --- a/src/migration-scripts/openvpn/0-to-1 +++ b/src/migration-scripts/openvpn/0-to-1 @@ -17,6 +17,8 @@ from vyos.configtree import ConfigTree +updated_cipher='3des' + def migrate(config: ConfigTree) -> None: if not config.exists(['interfaces', 'openvpn']): # Nothing to do @@ -25,6 +27,7 @@ def migrate(config: ConfigTree) -> None: ovpn_intfs = config.list_nodes(['interfaces', 'openvpn']) for i in ovpn_intfs: # Remove DES and Blowfish from 'encryption cipher' + # Support for these insecure ciphers will be removed in OpenVPN 2.6. cipher_path = ['interfaces', 'openvpn', i, 'encryption', 'cipher'] if config.exists(cipher_path): cipher = config.return_value(cipher_path) @@ -41,3 +44,11 @@ def migrate(config: ConfigTree) -> None: if config.exists(['interfaces', 'openvpn', i, 'encryption']) and \ (config.list_nodes(['interfaces', 'openvpn', i, 'encryption']) == []): config.delete(['interfaces', 'openvpn', i, 'encryption']) + + # We need to take care about site-to-site tunnels which had an implicit + # OpenVPN default cipher (BF-CBC) with block size less than 128 bit (64 bit). + mode_path = ['interfaces', 'openvpn', i, 'mode'] + if config.exists(mode_path) and config.return_value(mode_path) == 'site-to-site': + # if no explicit cipher is defined, we will "upgrade" to 3DES at least + if not config.exists(cipher_path): + config.set(cipher_path, value=updated_cipher) |