diff mbox series

[1/2] backup.pl: Ensure ncp-disable is removed from old backups and DATACIPHERS added

Message ID 20250825091914.5761-1-adolf.belka@ipfire.org
State New
Headers
Series [1/2] backup.pl: Ensure ncp-disable is removed from old backups and DATACIPHERS added |

Commit Message

Adolf Belka 25 Aug 2025, 9:19 a.m. UTC 
- With commit https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=e04f5376ba18767a6a9eccf104c472295a75340b
   then the settings file which is hashed into %vpnsettings already exists and so none
   of the defaults are set. Running the ovpnmain.cgi code resolves this for most of the
   settings but not for ncp-disable being present in server.conf and no DATACIPHERS entry
   in the settings file. ncp-disable then causes the openvpn server to fail to start as
   it is no longer recognised in OpenVPN-2.6
- This patch checks if ncp-disable is in the server.conf file from the restored backup
   and if it is it is then removed and the default values for DATACIPHERS is added into
   the settings file.
- Tested out in my vm testbed and successfully worked. The previously found issue after
   the above patch was added in has been resolved.
- Associated patch in this set is to do a similar thing for the update.sh file for CU197

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/backup/backup.pl | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/config/backup/backup.pl b/config/backup/backup.pl
index e79f510c6..42d24aa3c 100644
--- a/config/backup/backup.pl
+++ b/config/backup/backup.pl
@@ -350,6 +350,11 @@  restore_backup() {
 	fi
 
 	# Update the OpenVPN configuration and restart the openvpn daemons
+	if grep -q "ncp-disable" /var/ipfire/ovpn/server.conf; then
+		sed -r -e "/ncp-disable/d" -i /var/ipfire/ovpn/server.conf
+		echo "DATACIPHERS=AES-256-GCM|AES-128-GCM|CHACHA20-POLY1305" >> \
+			/var/ipfire/ovpn/settings
+	fi
 	sudo -u nobody /srv/web/ipfire/cgi-bin/ovpnmain.cgi
 	/etc/init.d/openvpn-n2n restart
 	/etc/init.d/openvpn-rw restart