summaryrefslogtreecommitdiff
path: root/data
diff options
context:
space:
mode:
Diffstat (limited to 'data')
-rw-r--r--data/templates/accel-ppp/pppoe.config.tmpl18
-rw-r--r--data/templates/accel-ppp/sstp.config.tmpl29
-rw-r--r--data/templates/dhcp-client/daemon-options.tmpl1
-rw-r--r--data/templates/dhcp-client/ipv4.tmpl2
-rw-r--r--data/templates/dhcp-client/ipv6.tmpl45
-rw-r--r--data/templates/dhcpv6-server/dhcpdv6.conf.tmpl7
-rw-r--r--data/templates/firewall/nftables-nat.tmpl139
-rw-r--r--data/templates/frr/bfd.frr.tmpl (renamed from data/templates/frr-bfd/bfd.frr.tmpl)0
-rw-r--r--data/templates/frr/igmp.frr.tmpl (renamed from data/templates/igmp/igmp.frr.tmpl)0
-rw-r--r--data/templates/frr/ldpd.frr.tmpl (renamed from data/templates/mpls/ldpd.frr.tmpl)0
-rw-r--r--data/templates/frr/pimd.frr.tmpl (renamed from data/templates/pim/pimd.frr.tmpl)0
-rw-r--r--data/templates/frr/static_mcast.frr.tmpl (renamed from data/templates/frr-mcast/static_mcast.frr.tmpl)0
-rw-r--r--data/templates/openvpn/server.conf.tmpl2
-rw-r--r--data/templates/pppoe/ip-down.script.tmpl5
-rw-r--r--data/templates/pppoe/ipv6-up.script.tmpl5
-rw-r--r--data/templates/salt-minion/minion.tmpl10
-rw-r--r--data/templates/system-login/pam_radius_auth.conf.tmpl4
17 files changed, 245 insertions, 22 deletions
diff --git a/data/templates/accel-ppp/pppoe.config.tmpl b/data/templates/accel-ppp/pppoe.config.tmpl
index b6a239fad..aa9254e61 100644
--- a/data/templates/accel-ppp/pppoe.config.tmpl
+++ b/data/templates/accel-ppp/pppoe.config.tmpl
@@ -12,10 +12,9 @@ ipv6pool
ipv6_nd
ipv6_dhcp
{% endif %}
-auth_pap
-auth_chap_md5
-auth_mschap_v1
-auth_mschap_v2
+{% for proto in auth_proto: %}
+{{proto}}
+{% endfor%}
shaper
{% if snmp %}
net-snmp
@@ -54,6 +53,9 @@ gw-ip-address={{ ppp_gw }}
{% endif %}
{% if client_ipv6_pool %}
+[ipv6-nd]
+AdvAutonomousFlag=1
+
[ipv6-pool]
{% for p in client_ipv6_pool %}
{{ p.prefix }},{{ p.mask }}
@@ -115,12 +117,14 @@ dae-server={{ radius_dynamic_author.server }}:{{ radius_dynamic_author.port }},{
{% endif -%}
{% endif %}
+{% if sesscrtl != 'disable' %}
+[common]
+single-session={{ sesscrtl }}
+{% endif %}
+
[ppp]
verbose=1
check-ip=1
-{% if not sesscrtl == 'disable' %}
-single-session={{sesscrtl}}
-{% endif -%}
{% if ppp_ccp %}
ccp=1
{% endif %}
diff --git a/data/templates/accel-ppp/sstp.config.tmpl b/data/templates/accel-ppp/sstp.config.tmpl
index c3dc83429..411fca489 100644
--- a/data/templates/accel-ppp/sstp.config.tmpl
+++ b/data/templates/accel-ppp/sstp.config.tmpl
@@ -9,6 +9,9 @@ chap-secrets
radius
{% endif -%}
ippool
+ipv6pool
+ipv6_nd
+ipv6_dhcp
{% for proto in auth_proto %}
{{proto}}
@@ -51,6 +54,14 @@ dns{{ loop.index }}={{ dns }}
{% endfor -%}
{% endif %}
+{% if dnsv6 %}
+[ipv6-dns]
+{% for dns in dnsv6 -%}
+{{ dns }}
+{% endfor -%}
+{% endif %}
+
+
{% if auth_mode == 'local' %}
[chap-secrets]
chap-secrets={{ chap_secrets_file }}
@@ -87,6 +98,9 @@ check-ip=1
{% if mtu %}
mtu={{ mtu }}
{% endif -%}
+{% if client_ipv6_pool %}
+ipv6=allow
+{% endif %}
{% if ppp_mppe %}
mppe={{ ppp_mppe }}
@@ -101,6 +115,21 @@ lcp-echo-failure={{ ppp_echo_failure }}
lcp-echo-timeout={{ ppp_echo_timeout }}
{% endif %}
+{% if client_ipv6_pool %}
+[ipv6-pool]
+{% for p in client_ipv6_pool %}
+{{ p.prefix }},{{ p.mask }}
+{% endfor %}
+{% for p in client_ipv6_delegate_prefix %}
+delegate={{ p.prefix }},{{ p.mask }}
+{% endfor %}
+{% endif %}
+
+{% if client_ipv6_delegate_prefix %}
+[ipv6-dhcp]
+verbose=1
+{% endif %}
+
{% if radius_shaper_attr %}
[shaper]
verbose=1
diff --git a/data/templates/dhcp-client/daemon-options.tmpl b/data/templates/dhcp-client/daemon-options.tmpl
new file mode 100644
index 000000000..b5a10c3b8
--- /dev/null
+++ b/data/templates/dhcp-client/daemon-options.tmpl
@@ -0,0 +1 @@
+DHCLIENT_OPTS="-nw -cf {{ conf_file }} -pf {{ pid_file }} -lf {{ lease_file }} {{ '-S' if dhcpv6_prm_only }} {{ '-T' if dhcpv6_temporary }} {{ ifname }}"
diff --git a/data/templates/dhcp-client/ipv4.tmpl b/data/templates/dhcp-client/ipv4.tmpl
index 43f273077..ab772b5f6 100644
--- a/data/templates/dhcp-client/ipv4.tmpl
+++ b/data/templates/dhcp-client/ipv4.tmpl
@@ -1,4 +1,4 @@
-# generated by ifconfig.py
+# generated by dhcp.py
option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
timeout 60;
retry 300;
diff --git a/data/templates/dhcp-client/ipv6.tmpl b/data/templates/dhcp-client/ipv6.tmpl
index 83db40c5f..6cfe24d3e 100644
--- a/data/templates/dhcp-client/ipv6.tmpl
+++ b/data/templates/dhcp-client/ipv6.tmpl
@@ -1,4 +1,41 @@
-# generated by ifconfig.py
-interface "{{ ifname }}" {
- request routers, domain-name-servers, domain-name;
-}
+# generated by dhcp.py
+# man https://www.unix.com/man-page/debian/5/dhcp6c.conf/
+
+interface {{ ifname }} {
+ request domain-name-servers;
+ request domain-name;
+{% if dhcpv6_prm_only %}
+ information-only;
+{% endif %}
+{% if not dhcpv6_temporary %}
+ send ia-na 1; # non-temporary address
+{% endif %}
+{% if dhcpv6_pd %}
+ send ia-pd 2; # prefix delegation
+{% endif %}
+};
+
+{% if not dhcpv6_temporary %}
+id-assoc na 1 {
+ # Identity association NA
+};
+{% endif %}
+
+{% if dhcpv6_pd %}
+id-assoc pd 2 {
+{% for intf in dhcpv6_pd %}
+ prefix-interface {{ intf.ifname }} {
+{% if intf.sla_id %}
+ sla-id {{ intf.sla_id }};
+{% endif %}
+{% if intf.sla_len %}
+ sla-len {{ intf.sla_len }};
+{% endif %}
+{% if intf.if_id %}
+ ifid {{ intf.if_id }};
+{% endif %}
+ };
+{% endfor %}
+};
+{% endif %}
+
diff --git a/data/templates/dhcpv6-server/dhcpdv6.conf.tmpl b/data/templates/dhcpv6-server/dhcpdv6.conf.tmpl
index 80d620fcf..ff7822b0d 100644
--- a/data/templates/dhcpv6-server/dhcpdv6.conf.tmpl
+++ b/data/templates/dhcpv6-server/dhcpdv6.conf.tmpl
@@ -21,7 +21,7 @@ shared-network {{ network.name }} {
range6 {{ range.start }} {{ range.stop }};
{%- endfor %}
{%- if subnet.domain_search %}
- option dhcp6.domain-search {{ subnet.domain_search | join(', ') }};
+ option dhcp6.domain-search "{{ subnet.domain_search | join('", "') }}";
{%- endif %}
{%- if subnet.lease_def %}
default-lease-time {{ subnet.lease_def }};
@@ -51,11 +51,14 @@ shared-network {{ network.name }} {
option dhcp6.sip-servers-addresses {{ subnet.sip_address | join(', ') }};
{%- endif %}
{%- if subnet.sip_hostname %}
- option dhcp6.sip-servers-names {{ subnet.sip_hostname | join(', ') }};
+ option dhcp6.sip-servers-names "{{ subnet.sip_hostname | join('", "') }}";
{%- endif %}
{%- if subnet.sntp_server %}
option dhcp6.sntp-servers {{ subnet.sntp_server | join(', ') }};
{%- endif %}
+ {%- for prefix in subnet.prefix_delegation %}
+ prefix6 {{ prefix.start }} {{ prefix.stop }} /{{ prefix.length }};
+ {%- endfor %}
{%- for host in subnet.static_mapping %}
{% if not host.disabled -%}
host {{ network.name }}_{{ host.name }} {
diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl
new file mode 100644
index 000000000..abb32ddc6
--- /dev/null
+++ b/data/templates/firewall/nftables-nat.tmpl
@@ -0,0 +1,139 @@
+#!/usr/sbin/nft -f
+
+# Start with clean NAT table
+flush table nat
+
+{% if helper_functions == 'remove' %}
+{# NAT if going to be disabled - remove rules and targets from nftables #}
+
+{% set base_command = "delete rule ip raw" %}
+{{ base_command }} PREROUTING handle {{ pre_ct_ignore }}
+{{ base_command }} OUTPUT handle {{ out_ct_ignore }}
+{{ base_command }} PREROUTING handle {{ pre_ct_conntrack }}
+{{ base_command }} OUTPUT handle {{ out_ct_conntrack }}
+
+delete chain ip raw NAT_CONNTRACK
+
+{% elif helper_functions == 'add' %}
+{# NAT if enabled - add targets to nftables #}
+add chain ip raw NAT_CONNTRACK
+add rule ip raw NAT_CONNTRACK counter accept
+
+{% set base_command = "add rule ip raw" %}
+
+{{ base_command }} PREROUTING position {{ pre_ct_ignore }} counter jump VYATTA_CT_HELPER
+{{ base_command }} OUTPUT position {{ out_ct_ignore }} counter jump VYATTA_CT_HELPER
+{{ base_command }} PREROUTING position {{ pre_ct_conntrack }} counter jump NAT_CONNTRACK
+{{ base_command }} OUTPUT position {{ out_ct_conntrack }} counter jump NAT_CONNTRACK
+{% endif %}
+
+{% macro nat_rule(rule, chain) %}
+{% set src_addr = "ip saddr " + rule.source_address if rule.source_address %}
+{% set src_port = "sport { " + rule.source_port +" }" if rule.source_port %}
+{% set dst_addr = "ip daddr " + rule.dest_address if rule.dest_address %}
+{% set dst_port = "dport { " + rule.dest_port +" }" if rule.dest_port %}
+{% set comment = "DST-NAT-" + rule.number %}
+
+{% if chain == "PREROUTING" %}
+{% set interface = " iifname \"" + rule.interface_in + "\"" %}
+{% set trns_addr = "dnat to " + rule.translation_address %}
+{% elif chain == "POSTROUTING" %}
+{% set interface = " oifname \"" + rule.interface_out + "\"" %}
+{% set trns_addr = rule.translation_address %}
+{% if rule.translation_address != 'masquerade' %}
+{% set trns_addr = "snat to " + trns_addr %}
+{% endif %}
+{% endif %}
+{% set trns_port = ":" + rule.translation_port if rule.translation_port %}
+
+{% if rule.protocol == "tcp_udp" %}
+{% set protocol = "tcp" %}
+{% set comment = comment + " tcp_udp" %}
+{% else %}
+{% set protocol = rule.protocol %}
+{% endif %}
+
+{% if rule.log %}
+{% set base_log = "[NAT-DST-" + rule.number %}
+{% if rule.exclude %}
+{% set log = base_log + "-EXCL]" %}
+{% elif rule.translation_address == 'masquerade' %}
+{% set log = base_log + "-MASQ]" %}
+{% else %}
+{% set log = base_log + "]" %}
+{% endif %}
+{% endif %}
+
+{% if rule.exclude %}
+{# rule has been marked as "exclude" thus we simply return here #}
+{% set trns_addr = "return" %}
+{% set trns_port = "" %}
+{% endif %}
+
+{% set output = "add rule ip nat " + chain + interface %}
+
+{% if protocol != "all" %}
+{% set output = output + " ip protocol " + protocol %}
+{% endif %}
+
+{% if src_addr %}
+{% set output = output + " " + src_addr %}
+{% endif %}
+{% if src_port %}
+{% set output = output + " " + protocol + " " + src_port %}
+{% endif %}
+
+{% if dst_addr %}
+{% set output = output + " " + dst_addr %}
+{% endif %}
+{% if dst_port %}
+{% set output = output + " " + protocol + " " + dst_port %}
+{% endif %}
+
+{# Count packets #}
+{% set output = output + " counter" %}
+
+{# Special handling of log option, we must repeat the entire rule before the #}
+{# NAT translation options are added, this is essential #}
+{% if log %}
+{% set log_output = output + " log prefix \"" + log + "\" comment \"" + comment + "\"" %}
+{% endif %}
+
+{% if trns_addr %}
+{% set output = output + " " + trns_addr %}
+{% endif %}
+
+{% if trns_port %}
+{# Do not add a whitespace here, translation port must be directly added after IP address #}
+{# e.g. 192.0.2.10:3389 #}
+{% set output = output + trns_port %}
+{% endif %}
+
+{% if comment %}
+{% set output = output + " comment \"" + comment + "\"" %}
+{% endif %}
+
+{{ log_output if log_output }}
+{{ output }}
+
+{# Special handling if protocol is tcp_udp, we must repeat the entire rule with udp as protocol #}
+{% if rule.protocol == "tcp_udp" %}
+{# Beware of trailing whitespace, without it the comment tcp_udp will be changed to udp_udp #}
+{{ log_output | replace("tcp ", "udp ") if log_output }}
+{{ output | replace("tcp ", "udp ") }}
+{% endif %}
+{% endmacro %}
+
+#
+# Destination NAT rules build up here
+#
+{% for rule in destination if not rule.disabled -%}
+{{ nat_rule(rule, 'PREROUTING') }}
+{% endfor %}
+
+#
+# Source NAT rules build up here
+#
+{% for rule in source if not rule.disabled -%}
+{{ nat_rule(rule, 'POSTROUTING') }}
+{% endfor %}
diff --git a/data/templates/frr-bfd/bfd.frr.tmpl b/data/templates/frr/bfd.frr.tmpl
index 7df4bfd01..7df4bfd01 100644
--- a/data/templates/frr-bfd/bfd.frr.tmpl
+++ b/data/templates/frr/bfd.frr.tmpl
diff --git a/data/templates/igmp/igmp.frr.tmpl b/data/templates/frr/igmp.frr.tmpl
index de4696c1f..de4696c1f 100644
--- a/data/templates/igmp/igmp.frr.tmpl
+++ b/data/templates/frr/igmp.frr.tmpl
diff --git a/data/templates/mpls/ldpd.frr.tmpl b/data/templates/frr/ldpd.frr.tmpl
index bbff88ae5..bbff88ae5 100644
--- a/data/templates/mpls/ldpd.frr.tmpl
+++ b/data/templates/frr/ldpd.frr.tmpl
diff --git a/data/templates/pim/pimd.frr.tmpl b/data/templates/frr/pimd.frr.tmpl
index 1d1532c60..1d1532c60 100644
--- a/data/templates/pim/pimd.frr.tmpl
+++ b/data/templates/frr/pimd.frr.tmpl
diff --git a/data/templates/frr-mcast/static_mcast.frr.tmpl b/data/templates/frr/static_mcast.frr.tmpl
index 86d619ab0..86d619ab0 100644
--- a/data/templates/frr-mcast/static_mcast.frr.tmpl
+++ b/data/templates/frr/static_mcast.frr.tmpl
diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl
index 75ab602f8..401f8e04b 100644
--- a/data/templates/openvpn/server.conf.tmpl
+++ b/data/templates/openvpn/server.conf.tmpl
@@ -74,7 +74,7 @@ nobind
topology {% if server_topology == 'point-to-point' %}p2p{% else %}{{ server_topology }}{% endif %}
{%- endif %}
-{%- if bridge_member %}
+{%- if is_bridge_member %}
mode server
tls-server
{%- else %}
diff --git a/data/templates/pppoe/ip-down.script.tmpl b/data/templates/pppoe/ip-down.script.tmpl
index a68fc099c..fe8fd7584 100644
--- a/data/templates/pppoe/ip-down.script.tmpl
+++ b/data/templates/pppoe/ip-down.script.tmpl
@@ -26,3 +26,8 @@ fi
# Always delete default route when interface goes down
vtysh -c "conf t" ${VRF_NAME} -c "no ip route 0.0.0.0/0 {{ intf }} ${VRF_NAME}"
{% endif %}
+
+{% if dhcpv6_pd %}
+# Start wide dhcpv6 client
+systemctl stop dhcp6c@{{ intf }}.service
+{% endif %}
diff --git a/data/templates/pppoe/ipv6-up.script.tmpl b/data/templates/pppoe/ipv6-up.script.tmpl
index a4b08ddaf..90873229a 100644
--- a/data/templates/pppoe/ipv6-up.script.tmpl
+++ b/data/templates/pppoe/ipv6-up.script.tmpl
@@ -39,3 +39,8 @@ echo 2 > /proc/sys/net/ipv6/conf/{{ intf }}/accept_ra
# Autoconfigure addresses using Prefix Information in Router Advertisements.
echo 1 > /proc/sys/net/ipv6/conf/{{ intf }}/autoconfigure
{% endif %}
+
+{% if dhcpv6_pd %}
+# Start wide dhcpv6 client
+systemctl start dhcp6c@{{ intf }}.service
+{% endif %}
diff --git a/data/templates/salt-minion/minion.tmpl b/data/templates/salt-minion/minion.tmpl
index 5e50d588c..9369573a4 100644
--- a/data/templates/salt-minion/minion.tmpl
+++ b/data/templates/salt-minion/minion.tmpl
@@ -12,7 +12,7 @@
#
# Prior to changing this value, the master should be stopped and all Salt
# caches should be cleared.
-hash_type: {{ hash_type }}
+hash_type: {{ hash }}
##### Logging settings #####
##########################################
@@ -21,11 +21,7 @@ hash_type: {{ hash_type }}
# location. Remote logging works best when configured to use rsyslogd(8) (e.g.:
# ``file:///dev/log``), with rsyslogd(8) configured for network logging. The URI
# format is: <file|udp|tcp>://<host|socketpath>:<port-if-required>/<log-facility>
-#log_file: /var/log/salt/minion
-#log_file: file:///dev/log
-#log_file: udp://loghost:10514
-#
-log_file: {{ log_file }}
+log_file: file:///dev/log
# The level of messages to send to the console.
# One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
@@ -58,6 +54,6 @@ id: {{ salt_id }}
# The number of minutes between mine updates.
-mine_interval: {{ mine_interval }}
+mine_interval: {{ interval }}
verify_master_pubkey_sign: {{ verify_master_pubkey_sign }}
diff --git a/data/templates/system-login/pam_radius_auth.conf.tmpl b/data/templates/system-login/pam_radius_auth.conf.tmpl
index 6cff67867..ad196fa3d 100644
--- a/data/templates/system-login/pam_radius_auth.conf.tmpl
+++ b/data/templates/system-login/pam_radius_auth.conf.tmpl
@@ -10,4 +10,8 @@
priv-lvl 15
mapped_priv_user radius_priv_user
+
+{% if radius_vrf %}
+vrf-name {{ radius_vrf }}
+{% endif %}
{% endif %}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-16 17:12:29 +0000