From 89e037a7d85cf9525418d521dcdf427545161948 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Thu, 5 Mar 2026 19:49:28 +0100 Subject: openvpn: T8304: fix migration for des, bf128 or bf256 cipher; use 3des instead This extends the CLI migration from commit 941c5adfaca2c7 ("openvpn: T5634: Remove support for insecure DES and Blowfish ciphers") by not only deleting insecure DES and Blowfish ciphers, but providing an alternative (3DES). If no cipher is defined, this will result in OpenVPN service not starting at all, as the implicit defined BF-CBC cipher is no longer supported by OpenSSL 3.0.0. --- src/migration-scripts/openvpn/0-to-1 | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'src/migration-scripts') diff --git a/src/migration-scripts/openvpn/0-to-1 b/src/migration-scripts/openvpn/0-to-1 index 582cd9a46..26f41d2ce 100644 --- a/src/migration-scripts/openvpn/0-to-1 +++ b/src/migration-scripts/openvpn/0-to-1 @@ -17,6 +17,8 @@ from vyos.configtree import ConfigTree +updated_cipher='3des' + def migrate(config: ConfigTree) -> None: if not config.exists(['interfaces', 'openvpn']): # Nothing to do @@ -25,6 +27,7 @@ def migrate(config: ConfigTree) -> None: ovpn_intfs = config.list_nodes(['interfaces', 'openvpn']) for i in ovpn_intfs: # Remove DES and Blowfish from 'encryption cipher' + # Support for these insecure ciphers will be removed in OpenVPN 2.6. cipher_path = ['interfaces', 'openvpn', i, 'encryption', 'cipher'] if config.exists(cipher_path): cipher = config.return_value(cipher_path) @@ -41,3 +44,11 @@ def migrate(config: ConfigTree) -> None: if config.exists(['interfaces', 'openvpn', i, 'encryption']) and \ (config.list_nodes(['interfaces', 'openvpn', i, 'encryption']) == []): config.delete(['interfaces', 'openvpn', i, 'encryption']) + + # We need to take care about site-to-site tunnels which had an implicit + # OpenVPN default cipher (BF-CBC) with block size less than 128 bit (64 bit). + mode_path = ['interfaces', 'openvpn', i, 'mode'] + if config.exists(mode_path) and config.return_value(mode_path) == 'site-to-site': + # if no explicit cipher is defined, we will "upgrade" to 3DES at least + if not config.exists(cipher_path): + config.set(cipher_path, value=updated_cipher) -- cgit v1.2.3