diff options
| -rwxr-xr-x | smoketest/scripts/cli/test_interfaces_openvpn.py | 6 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces_openvpn.py | 5 |
2 files changed, 11 insertions, 0 deletions
diff --git a/smoketest/scripts/cli/test_interfaces_openvpn.py b/smoketest/scripts/cli/test_interfaces_openvpn.py index 9286a8c0e..42e4eed60 100755 --- a/smoketest/scripts/cli/test_interfaces_openvpn.py +++ b/smoketest/scripts/cli/test_interfaces_openvpn.py @@ -642,6 +642,12 @@ class TestInterfacesOpenVPN(VyOSUnitTestSHIM.TestCase): self.cli_commit() self.cli_set(path + ['shared-secret-key', 'ovpn_test']) + # check validate() - Must define "encryption cipher" or "encryption + # data-ciphers-fallback" for site-to-site encryption + with self.assertRaises(ConfigSessionError): + self.cli_commit() + self.cli_set(path + ['encryption', 'cipher', '3des']) + self.cli_commit() def test_openvpn_options(self): diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py index bb9d06389..861f2e679 100755 --- a/src/conf_mode/interfaces_openvpn.py +++ b/src/conf_mode/interfaces_openvpn.py @@ -367,6 +367,11 @@ def verify(openvpn): if dict_search('encryption.data_ciphers', openvpn): raise ConfigError('Cipher negotiation can only be used in client or server mode') + if not dict_search('encryption.cipher', openvpn) and \ + not dict_search('encryption.data_ciphers_fallback', openvpn): + raise ConfigError('Must define "encryption cipher" or "encryption ' \ + 'data-ciphers-fallback" for site-to-site encryption!') + else: # checks for client-server or site-to-site bridged if 'local_address' in openvpn or 'remote_address' in openvpn: |