| Age | Commit message (Collapse) | Author |
|---|
|
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
|
|
Raw options are appended after --config and therefore override what the CLI
rendered, so they have to face the same checks. A single cipher the Kernel
module does not implement makes OpenVPN fall back to the userspace data path;
"ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and
pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an
AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop
the offload just the same.
"DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers
alone before it weighs the offload, and the migration drops the offload from
whatever stays rejected.
|
|
The CLI renders "keepalive <interval> <interval * failure-count>" while its
two ranges are independent, so it can produce parameters the daemon refuses
to start on: a timeout below twice the interval, or one beyond the 12 hours
OpenVPN is about to cap ping and keepalive at.
A zero interval renders "keepalive 0 0", on which OpenVPN skips these checks
and simply runs without keepalive, so leave that combination alone.
Migrate what stays rejected, or an upgrade would leave a configuration the
router can no longer commit at boot.
|
|
"offload dco" was accepted next to tap, static keys, compression, CBC
ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the
module altogether. Those combinations now fail verify(), which would break
config load on upgrade, so drop the request instead.
The migration has to mirror verify_dco() exactly: anything it keeps that
verify() turns away leaves a router unable to commit its own configuration.
|
|
This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634:
Remove support for insecure DES and Blowfish ciphers") by not only deleting
insecure DES and Blowfish ciphers, but providing an alternative (3DES).
If no cipher is defined, this will result in OpenVPN service not starting at
all, as the implicit defined BF-CBC cipher is no longer supported by
OpenSSL 3.0.0.
|
|
- Introduced new CLI option 'data-ciphers-fallback' for OpenVPN interfaces
(used as fallback cipher in site-to-site mode)
- Adjust migration 1‑to‑2 to skip migrating 'cipher' for site‑to‑site interfaces
|
|
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
|
|
and return an empty list in that case
(handy for migration scripts and the like)
|
|
|
|
|
|
|
|
Migration script introduced in commit 0f669a226 ("openvpn: T5487: Remove
eprecated option --cipher for server and client mode") lacked executable
permission.
|
|
|
|
|
|
|
