Merge pull request #5029 from c-po/openvpn-t8304

openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead

2 files changed, 16 insertions, 0 deletions

diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py
index bb9d06389..861f2e679 100755
--- a/src/conf_mode/interfaces_openvpn.py
+++ b/src/conf_mode/interfaces_openvpn.py
@@ -367,6 +367,11 @@ def verify(openvpn):
         if dict_search('encryption.data_ciphers', openvpn):
             raise ConfigError('Cipher negotiation can only be used in client or server mode')
 
+        if not dict_search('encryption.cipher', openvpn) and \
+           not dict_search('encryption.data_ciphers_fallback', openvpn):
+            raise ConfigError('Must define "encryption cipher" or "encryption ' \
+                              'data-ciphers-fallback" for site-to-site encryption!')
+
     else:
         # checks for client-server or site-to-site bridged
         if 'local_address' in openvpn or 'remote_address' in openvpn:
diff --git a/src/migration-scripts/openvpn/0-to-1 b/src/migration-scripts/openvpn/0-to-1
index 582cd9a46..26f41d2ce 100644
--- a/src/migration-scripts/openvpn/0-to-1
+++ b/src/migration-scripts/openvpn/0-to-1
@@ -17,6 +17,8 @@
 
 from vyos.configtree import ConfigTree
 
+updated_cipher='3des'
+
 def migrate(config: ConfigTree) -> None:
     if not config.exists(['interfaces', 'openvpn']):
         # Nothing to do
@@ -25,6 +27,7 @@ def migrate(config: ConfigTree) -> None:
     ovpn_intfs = config.list_nodes(['interfaces', 'openvpn'])
     for	i in ovpn_intfs:
         # Remove DES and Blowfish from 'encryption cipher'
+        # Support for these insecure ciphers will be removed in OpenVPN 2.6.
         cipher_path = ['interfaces', 'openvpn', i, 'encryption', 'cipher']
         if config.exists(cipher_path):
             cipher = config.return_value(cipher_path)
@@ -41,3 +44,11 @@ def migrate(config: ConfigTree) -> None:
         if config.exists(['interfaces', 'openvpn', i, 'encryption']) and \
            (config.list_nodes(['interfaces', 'openvpn', i, 'encryption']) == []):
             config.delete(['interfaces', 'openvpn', i, 'encryption'])
+
+        # We need to take care about site-to-site tunnels which had an implicit
+        # OpenVPN default cipher (BF-CBC) with block size less than 128 bit (64 bit).
+        mode_path = ['interfaces', 'openvpn', i, 'mode']
+        if config.exists(mode_path) and config.return_value(mode_path) == 'site-to-site':
+            # if no explicit cipher is defined, we will "upgrade" to 3DES at least
+            if not config.exists(cipher_path):
+                config.set(cipher_path, value=updated_cipher)