diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-03-05 20:21:07 +0100 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-03-06 20:14:56 +0100 |
| commit | 0122baeac73dbd26d1461aadd502d8fa2ba3b827 (patch) | |
| tree | 33d4e111ccc77679d13914ad71baafc21fdcf2b8 /src | |
| parent | 89e037a7d85cf9525418d521dcdf427545161948 (diff) | |
| download | vyos-1x-0122baeac73dbd26d1461aadd502d8fa2ba3b827.tar.gz vyos-1x-0122baeac73dbd26d1461aadd502d8fa2ba3b827.zip | |
openvpn: T8304: site-to-site VPN requires either cipher or data-ciphers-fallback
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/interfaces_openvpn.py | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py index bb9d06389..861f2e679 100755 --- a/src/conf_mode/interfaces_openvpn.py +++ b/src/conf_mode/interfaces_openvpn.py @@ -367,6 +367,11 @@ def verify(openvpn): if dict_search('encryption.data_ciphers', openvpn): raise ConfigError('Cipher negotiation can only be used in client or server mode') + if not dict_search('encryption.cipher', openvpn) and \ + not dict_search('encryption.data_ciphers_fallback', openvpn): + raise ConfigError('Must define "encryption cipher" or "encryption ' \ + 'data-ciphers-fallback" for site-to-site encryption!') + else: # checks for client-server or site-to-site bridged if 'local_address' in openvpn or 'remote_address' in openvpn: |