openvpn: server with "keep-alive interval 0" fails to start on OpenVPN 2.7.7
Open, Requires assessmentPublicBUG
Actions

Assigned To

None

Authored By

	a.kudientsov
	Fri, Sep 18, 8:09 AM

Description

An OpenVPN server configured with keep-alive interval 0 no longer starts. The commit succeeds with no error, the interface stays down and the service restart-loops.

The CLI accepts interval 0 (u32:0-600) and VyOS renders it as keepalive 0 0. OpenVPN 2.7.6 began constraining both --keepalive parameters to 1..86400 at option-parse time, so keepalive 0 0 is now a fatal options error. Before 2.7.6 the directive parsed and keepalive was simply treated as absent.

This reaches users two ways: a new commit, and an upgrade of a saved configuration that already has interval 0

Steps to reproduce

Any rolling image carrying openvpn 2.7.7-1+vyos1 (built after vyos-build T9330). CA/SRV are any CA and server certificate in the PKI.

set interfaces openvpn vtun10 mode server
set interfaces openvpn vtun10 server subnet 10.10.10.0/24
set interfaces openvpn vtun10 tls ca-certificate CA
set interfaces openvpn vtun10 tls certificate SRV
set interfaces openvpn vtun10 keep-alive interval 0
commit

The commit reports success. /run/openvpn/vtun10.conf contains:

keepalive 0 0

and the daemon refuses it:

openvpn-vtun10[7641]: Options error: keepalive ping: Must be an integer between 1 and 86400, not 0
openvpn-vtun10[7641]: Use --help for more information.
systemd[1]: openvpn@vtun10.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: openvpn@vtun10.service: Failed with result 'exit-code'.

The smoketest asserts this behaviour

smoketest/scripts/cli/test_interfaces_openvpn.py::test_openvpn_server_keepalive_limit sets interval 0 and then asserts the service is running. On an image with 2.7.7 it fails:

FAIL: test_openvpn_server_keepalive_limit
  File ".../test_interfaces_openvpn.py", line 1429
    self.assertTrue(is_systemd_service_running(f'openvpn@{interface}.service'))
AssertionError: False is not true

Details

Version: 2026.09.18-rolling
Is it a breaking change?: Unspecified (possibly destroys the router)
Issue type: Bug (incorrect behavior)

Related Objects

Mentioned In: T9337: OpenVPN site-to-site: "keep-alive interval 0" leaves ping-restart armed and flaps an idle tunnel

Event Timeline

a.kudientsov created this task.Fri, Sep 18, 8:09 AM

pasik subscribed.Fri, Sep 18, 8:42 AM

This is a regression caused by the version bump we just merged (from 2.7.5 to 2.7.7).
The following commit

commit 4e4236ded8ce8e7e191a5091d55c286c0071f341
Author: Frank Lichtenheld <frank@lichtenheld.com>
Date:   Thu May 14 21:27:21 2026 +0200

    options: Move <= 0 check for keepalive settings earlier

    Use the atoi_constrained function.

merged in openvpn 2.7.6 broke configs having keepalive 0 0 (like VyOS is doing).

PR: https://github.com/vyos/vyos-1x/pull/5488

Rather than rejecting "interval 0" in verify(), the change leaves the directive
out of the generated file: "keepalive" only stands for "ping" and "ping-restart",
and the server branch of the template sets neither on its own, so an absent
directive is the keepalive-off the interval asked for. Nothing needs a migration
and a saved configuration still commits.

Verified on 2026.09.17-0028-rolling with openvpn upgraded to 2.7.7-1+vyos1:
test_openvpn_server_keepalive_limit fails before the change and passes with it.

b3r1k mentioned this in T9337: OpenVPN site-to-site: "keep-alive interval 0" leaves ping-restart armed and flaps an idle tunnel.Fri, Sep 18, 11:06 AM