Change Details

Currently, our OpenVPN configuration scripts generates the following options when `encryption cipher` is not specified: ``` # Encryption options cipher bf-cbc keysize 128 ``` The problem is that `--keysize` no [longer exists in OpenVPN 2.6](https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog#L643). And the default config of VyOS 1.3.x makes OpenVPN fail to start: ``` Sep 20 08:24:01 openvpn-vtun20[4801]: Options error: Unrecognized option or missing or extra parameter(s) in vtun20.conf:67: keysize (2.6.3) Sep 20 08:24:01 openvpn-vtun20[4801]: Use --help for more information. Sep 20 08:24:01 systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE Sep 20 08:24:01 systemd[1]: [email protected]: Failed with result 'exit-code'. ``` Simply removing the deprecated option fixes the problem.

Currently, our OpenVPN configuration scripts generates the following options when `encryption cipher` is not specified: ``` # Encryption options cipher bf-cbc keysize 128 ``` The problem is that `--keysize` no [longer exists in OpenVPN 2.6](https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog#L643). And the default config of VyOS 1.3.x makes OpenVPN fail to start: ``` Sep 20 08:24:01 openvpn-vtun20[4801]: Options error: Unrecognized option or missing or extra parameter(s) in vtun20.conf:67: keysize (2.6.3) Sep 20 08:24:01 openvpn-vtun20[4801]: Use --help for more information. Sep 20 08:24:01 systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE Sep 20 08:24:01 systemd[1]: [email protected]: Failed with result 'exit-code'. ``` Simply removing the deprecated option fixes the problem — for the old default, BF-CBC 128. However, there seem to be no explicit "bf-128-cbc" and "bf-256-cbc", so Blowfish with 265 bit keys is no longer possible to configure.

Currently, our OpenVPN configuration scripts generates the following options when `encryption cipher` is not specified: ``` # Encryption options cipher bf-cbc keysize 128 ``` The problem is that `--keysize` no [longer exists in OpenVPN 2.6](https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog#L643). And the default config of VyOS 1.3.x makes OpenVPN fail to start: ``` Sep 20 08:24:01 openvpn-vtun20[4801]: Options error: Unrecognized option or missing or extra parameter(s) in vtun20.conf:67: keysize (2.6.3) Sep 20 08:24:01 openvpn-vtun20[4801]: Use --help for more information. Sep 20 08:24:01 systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE Sep 20 08:24:01 systemd[1]: [email protected]: Failed with result 'exit-code'. ``` Simply removing the deprecated option fixes the problem. — for the old default, BF-CBC 128. However, there seem to be no explicit "bf-128-cbc" and "bf-256-cbc", so Blowfish with 265 bit keys is no longer possible to configure.