From f55f1ed843894a7eb63bec6de1bbcead9417b67a Mon Sep 17 00:00:00 2001 From: Ritika Chopra Date: Tue, 16 Jun 2026 00:31:22 -0500 Subject: T8598: Accel-PPP: Add upgrade-safe migration support for calling-sid peer IID secret enforcement across PPPoE, L2TP, PPTP, and SSTP (BP 2188) (cherry picked from commit c9314daa78418751edaab9b4da8c2e33fb1a64ed) --- src/migration-scripts/pptp/5-to-6 | 41 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 src/migration-scripts/pptp/5-to-6 (limited to 'src/migration-scripts/pptp') diff --git a/src/migration-scripts/pptp/5-to-6 b/src/migration-scripts/pptp/5-to-6 new file mode 100644 index 000000000..88a857a5c --- /dev/null +++ b/src/migration-scripts/pptp/5-to-6 @@ -0,0 +1,41 @@ +# Copyright VyOS maintainers and contributors +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see . + +# Backfill IPv6 peer IID secret for legacy calling-sid configuration. + +from secrets import token_hex + +from vyos.configtree import ConfigTree + +base = ['vpn', 'pptp', 'remote-access'] +peer_id_path = base + ['ppp-options', 'ipv6-peer-interface-id'] +peer_id_secret_path = base + ['ppp-options', 'ipv6-peer-interface-id-secret'] + + +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return + + if not config.exists(peer_id_path): + return + + if config.return_value(peer_id_path) != 'calling-sid': + return + + if config.exists(peer_id_secret_path): + return + + config.set(peer_id_secret_path, value=token_hex(32)) + -- cgit v1.2.3