Merge branch 'current' into 2fa

2 files changed, 81 insertions, 86 deletions

diff --git a/data/templates/vrrp/daemon.tmpl b/data/templates/vrrp/daemon.tmpl
deleted file mode 100644
index c9dbea72d..000000000
--- a/data/templates/vrrp/daemon.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-# Autogenerated by VyOS
-# Options to pass to keepalived
-
-# DAEMON_ARGS are appended to the keepalived command-line
-DAEMON_ARGS="--snmp"
diff --git a/data/templates/vrrp/keepalived.conf.tmpl b/data/templates/vrrp/keepalived.conf.tmpl
index c01101d85..b4824a994 100644
--- a/data/templates/vrrp/keepalived.conf.tmpl
+++ b/data/templates/vrrp/keepalived.conf.tmpl
@@ -5,102 +5,102 @@
 global_defs {
     dynamic_interfaces
     script_user root
-    notify_fifo /run/keepalived_notify_fifo
+    # Don't run scripts configured to be run as root if any part of the path
+    # is writable by a non-root user.
+    enable_script_security
+    notify_fifo /run/keepalived/keepalived_notify_fifo
     notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
 }
 
-{% for group in groups %}
-
-{% if group.health_check_script %}
-vrrp_script healthcheck_{{ group.name }} {
-    script "{{ group.health_check_script }}"
-    interval {{ group.health_check_interval }}
-    fall {{ group.health_check_count }}
+{% if group is defined and group is not none %}
+{%   for name, group_config in group.items() if group_config.disable is not defined %}
+{%     if group_config.health_check is defined and group_config.health_check.script is defined and group_config.health_check.script is not none %}
+vrrp_script healthcheck_{{ name }} {
+    script "{{ group_config.health_check.script }}"
+    interval {{ group_config.health_check.interval }}
+    fall {{ group_config.health_check.failure_count }}
     rise 1
-
 }
-{% endif %}
-
-vrrp_instance {{ group.name }} {
-    {% if group.description %}
-    # {{ group.description }}
-    {% endif %}
-
+{%     endif %}
+vrrp_instance {{ name }} {
+{%     if group_config.description is defined and group_config.description is not none %}
+    # {{ group_config.description }}
+{%     endif %}
     state BACKUP
-    interface {{ group.interface }}
-    virtual_router_id {{ group.vrid }}
-    priority {{ group.priority }}
-    advert_int {{ group.advertise_interval }}
-
-    {% if group.preempt %}
-    preempt_delay {{ group.preempt_delay }}
-    {% else %}
+    interface {{ group_config.interface }}
+    virtual_router_id {{ group_config.vrid }}
+    priority {{ group_config.priority }}
+    advert_int {{ group_config.advertise_interval }}
+{%     if group_config.no_preempt is not defined and group_config.preempt_delay is defined and group_config.preempt_delay is not none %}
+    preempt_delay {{ group_config.preempt_delay }}
+{%     elif group_config.no_preempt is defined %}
     nopreempt
-    {% endif %}
-
-    {% if group.peer_address %}
-    unicast_peer { {{ group.peer_address }} }
-    {% endif %}
-
-    {% if group.hello_source %}
-      {% if group.peer_address %}
-      unicast_src_ip {{ group.hello_source }}
-      {% else %}
-      mcast_src_ip {{ group.hello_source }}
-      {% endif %}
-    {% endif %}
-
-    {% if group.use_vmac and group.peer_address %}
-      use_vmac {{group.interface}}v{{group.vrid}}
-      vmac_xmit_base
-    {% elif group.use_vmac %}
-      use_vmac {{group.interface}}v{{group.vrid}}
-    {% endif %}
-
-    {% if group.auth_password %}
-      authentication {
-        auth_pass "{{ group.auth_password }}"
-        auth_type {{ group.auth_type }}
-      }
-    {% endif %}
-
+{%     endif %}
+{%     if group_config.peer_address is defined and group_config.peer_address is not none %}
+    unicast_peer { {{ group_config.peer_address }} }
+{%     endif %}
+{%     if group_config.hello_source_address is defined and group_config.hello_source_address is not none %}
+{%       if group_config.peer_address is defined and group_config.peer_address is not none %}
+    unicast_src_ip {{ group_config.hello_source_address }}
+{%       else %}
+    mcast_src_ip {{ group_config.hello_source_address }}
+{%       endif %}
+{%     endif %}
+{%     if group_config.rfc3768_compatibility is defined and group_config.peer_address is defined %}
+    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
+    vmac_xmit_base
+{%     elif group_config.rfc3768_compatibility is defined %}
+    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
+{%     endif %}
+{%     if group_config.authentication is defined and group_config.authentication is not none %}
+    authentication {
+        auth_pass "{{ group_config.authentication.password }}"
+{%       if group_config.authentication.type == 'plaintext-password' %}
+        auth_type PASS
+{%       else %}
+        auth_type {{ group_config.authentication.type | upper }}
+{%       endif %}
+    }
+{%     endif %}
+{%     if group_config.address is defined and group_config.address is not none %}
     virtual_ipaddress {
-    {% for addr in group.virtual_addresses %}
+{%       for addr in group_config.address %}
         {{ addr }}
-    {% endfor %}
+{%       endfor %}
     }
-
-    {% if group.virtual_addresses_excluded %}
+{%     endif %}
+{%     if group_config.excluded_address is defined and group_config.excluded_address is not none %}
     virtual_ipaddress_excluded {
-    {% for addr in group.virtual_addresses_excluded %}
+{%       for addr in group_config.excluded_address %}
         {{ addr }}
-    {% endfor %}
+{%       endfor %}
     }
-    {% endif %}
-
-    {% if group.health_check_script %}
+{%     endif %}
+{%     if group_config.health_check is defined and group_config.health_check.script is defined and group_config.health_check.script is not none %}
     track_script {
-        healthcheck_{{ group.name }}
+        healthcheck_{{ name }}
     }
-    {% endif %}
+{%     endif %}
 }
+{%   endfor %}
+{% endif %}
 
-{% endfor %}
-
-{% for sync_group in sync_groups %}
-vrrp_sync_group {{ sync_group.name }} {
-       group {
-            {% for member in sync_group.members %}
-                {{ member }}
-            {% endfor %}
-        }
-
-        {% if sync_group.conntrack_sync %}
-        {%  set vyos_helper = "/usr/libexec/vyos/vyos-vrrp-conntracksync.sh" %}
-            notify_master "{{ vyos_helper }} master {{ sync_group.name }}"
-            notify_backup "{{ vyos_helper }} backup {{ sync_group.name }}"
-            notify_fault "{{ vyos_helper }} fault {{ sync_group.name }}"
-        {% endif %}
+{% if sync_group is defined and sync_group is not none %}
+{%   for name, group_config in sync_group.items() if group_config.disable is not defined %}
+vrrp_sync_group {{ name }} {
+    group {
+{%     if group_config.member is defined and group_config.member is not none %}
+{%       for member in group_config.member %}
+        {{ member }}
+{%       endfor %}
+{%     endif %}
+    }
+{%     if conntrack_sync_group is defined and conntrack_sync_group == name %}
+{%     set vyos_helper = "/usr/libexec/vyos/vyos-vrrp-conntracksync.sh" %}
+    notify_master "{{ vyos_helper }} master {{ name }}"
+    notify_backup "{{ vyos_helper }} backup {{ name }}"
+    notify_fault "{{ vyos_helper }} fault {{ name }}"
+{%     endif %}
 }
-
-{% endfor %}
+{%   endfor %}
+{% endif %}