From b6abe23ba2d2a5d5055afd203bc3e60ee20bf757 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Thu, 24 Sep 2026 16:32:15 +0200 Subject: openvpn: T9363: multiply the site-to-site keepalive timeout "failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults. --- src/migration-scripts/openvpn/5-to-6 | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) (limited to 'src/migration-scripts') diff --git a/src/migration-scripts/openvpn/5-to-6 b/src/migration-scripts/openvpn/5-to-6 index 9a6de85cd..fc4dccb38 100644 --- a/src/migration-scripts/openvpn/5-to-6 +++ b/src/migration-scripts/openvpn/5-to-6 @@ -17,6 +17,11 @@ # can not serve, because OpenVPN 2.6 silently ignored the module. Now that the # offload is real those combinations are rejected, so drop the request from # configurations that would otherwise fail to load. +# +# T9363: site-to-site rendered "ping-restart ", so the count +# landed as a number of seconds while the server has always rendered +# interval * failure-count. Now that both agree, a timeout OpenVPN refuses is +# reachable in site-to-site too, so the same clamp has to cover it. from vyos.configtree import ConfigTree @@ -94,8 +99,9 @@ def _value(config: ConfigTree, path: list): def _clamp_keepalive(config: ConfigTree, path: list) -> None: - """Bring a server keepalive within what verify() accepts.""" - if _value(config, path + ['mode']) != 'server': + """Bring a keepalive within what verify() accepts.""" + mode = _value(config, path + ['mode']) + if mode not in ['server', 'site-to-site']: return # both nodes carry a CLI default, so they render even when absent @@ -107,11 +113,19 @@ def _clamp_keepalive(config: ConfigTree, path: list) -> None: if interval < 1: return - # the timeout is interval * failure-count: it has to reach twice the - # interval and stay below 12 hours. Beyond an interval of 21600 no count - # satisfies both - the CLI range stops at 600, so only a hand-edited - # configuration gets there and its interval is rejected anyway. - wanted = min(max(count, 2), max(2, 43200 // interval)) + if mode == 'site-to-site': + # site-to-site renders "ping-restart" itself, which OpenVPN caps at + # 24 hours and does not double. It carries no "at least twice the + # interval" rule either, since that one belongs to "keepalive". + wanted = min(count, 86400 // interval) + else: + # the timeout is interval * failure-count: it has to reach twice the + # interval and stay below 12 hours. Beyond an interval of 21600 no + # count satisfies both - the CLI range stops at 600, so only a + # hand-edited configuration gets there and its interval is rejected + # anyway. + wanted = min(max(count, 2), max(2, 43200 // interval)) + if wanted != count: config.set(path + ['keep-alive', 'failure-count'], value=str(wanted)) -- cgit v1.2.3