summaryrefslogtreecommitdiff
path: root/python/vyos
diff options
context:
space:
mode:
Diffstat (limited to 'python/vyos')
-rw-r--r--python/vyos/configdict.py99
-rw-r--r--python/vyos/configverify.py87
-rw-r--r--python/vyos/ifconfig/bridge.py29
-rw-r--r--python/vyos/ifconfig/interface.py74
-rw-r--r--python/vyos/ifconfig/stp.py70
5 files changed, 231 insertions, 128 deletions
diff --git a/python/vyos/configdict.py b/python/vyos/configdict.py
index ce6d58693..62df3334c 100644
--- a/python/vyos/configdict.py
+++ b/python/vyos/configdict.py
@@ -18,12 +18,8 @@ A library for retrieving value dicts from VyOS configs in a declarative fashion.
"""
import os
-from copy import deepcopy
-
from vyos.util import vyos_dict_search
from vyos.xml import defaults
-from vyos.xml import is_tag
-from vyos.xml import is_leaf
from vyos import ConfigError
def retrieve_config(path_hash, base_path, config):
@@ -200,6 +196,7 @@ def is_member(conf, interface, intftype=None):
"""
ret_val = None
intftypes = ['bonding', 'bridge']
+
if intftype not in intftypes + [None]:
raise ValueError((
f'unknown interface type "{intftype}" or it cannot '
@@ -211,19 +208,13 @@ def is_member(conf, interface, intftype=None):
old_level = conf.get_level()
conf.set_level([])
- for it in intftype:
- base = ['interfaces', it]
+ for iftype in intftype:
+ base = ['interfaces', iftype]
for intf in conf.list_nodes(base):
- memberintf = base + [intf, 'member', 'interface']
- if is_tag(memberintf):
- if interface in conf.list_nodes(memberintf):
- ret_val = intf
- break
- elif is_leaf(memberintf):
- if ( conf.exists(memberintf) and
- interface in conf.return_values(memberintf) ):
- ret_val = intf
- break
+ member = base + [intf, 'member', 'interface', interface]
+ if conf.exists(member):
+ tmp = conf.get_config_dict(member, key_mangling=('-', '_'), get_first_key=True)
+ ret_val = {intf : tmp}
old_level = conf.set_level(old_level)
return ret_val
@@ -265,11 +256,12 @@ def is_source_interface(conf, interface, intftype=None):
def get_interface_dict(config, base, ifname=''):
"""
- Common utility function to retrieve and mandgle the interfaces available
- in CLI configuration. All interfaces have a common base ground where the
- value retrival is identical - so it can and should be reused
+ Common utility function to retrieve and mangle the interfaces configuration
+ from the CLI input nodes. All interfaces have a common base where value
+ retrival is identical. This function must be used whenever possible when
+ working on the interfaces node!
- Will return a dictionary with the necessary interface configuration
+ Return a dictionary with the necessary interface config keys.
"""
if not ifname:
# determine tagNode instance
@@ -405,3 +397,70 @@ def get_interface_dict(config, base, ifname=''):
# Check vif, vif-s/vif-c VLAN interfaces for removal
dict = get_removed_vlans(config, dict)
return dict
+
+
+def get_accel_dict(config, base, chap_secrets):
+ """
+ Common utility function to retrieve and mangle the Accel-PPP configuration
+ from different CLI input nodes. All Accel-PPP services have a common base
+ where value retrival is identical. This function must be used whenever
+ possible when working with Accel-PPP services!
+
+ Return a dictionary with the necessary interface config keys.
+ """
+ from vyos.util import get_half_cpus
+ from vyos.validate import is_ipv4
+
+ dict = config.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+ # We have gathered the dict representation of the CLI, but there are default
+ # options which we need to update into the dictionary retrived.
+ default_values = defaults(base)
+
+ # defaults include RADIUS server specifics per TAG node which need to be
+ # added to individual RADIUS servers instead - so we can simply delete them
+ if vyos_dict_search('authentication.radius.server', default_values):
+ del default_values['authentication']['radius']['server']
+
+ # defaults include static-ip address per TAG node which need to be added to
+ # individual local users instead - so we can simply delete them
+ if vyos_dict_search('authentication.local_users.username', default_values):
+ del default_values['authentication']['local_users']['username']
+
+ dict = dict_merge(default_values, dict)
+
+ # set CPUs cores to process requests
+ dict.update({'thread_count' : get_half_cpus()})
+ # we need to store the path to the secrets file
+ dict.update({'chap_secrets_file' : chap_secrets})
+
+ # We can only have two IPv4 and three IPv6 nameservers - also they are
+ # configured in a different way in the configuration, this is why we split
+ # the configuration
+ if 'name_server' in dict:
+ ns_v4 = []
+ ns_v6 = []
+ for ns in dict['name_server']:
+ if is_ipv4(ns): ns_v4.append(ns)
+ else: ns_v6.append(ns)
+
+ dict.update({'name_server_ipv4' : ns_v4, 'name_server_ipv6' : ns_v6})
+ del dict['name_server']
+
+ # Add individual RADIUS server default values
+ if vyos_dict_search('authentication.radius.server', dict):
+ default_values = defaults(base + ['authentication', 'radius', 'server'])
+
+ for server in vyos_dict_search('authentication.radius.server', dict):
+ dict['authentication']['radius']['server'][server] = dict_merge(
+ default_values, dict['authentication']['radius']['server'][server])
+
+ # Add individual local-user default values
+ if vyos_dict_search('authentication.local_users.username', dict):
+ default_values = defaults(base + ['authentication', 'local-users', 'username'])
+
+ for username in vyos_dict_search('authentication.local_users.username', dict):
+ dict['authentication']['local_users']['username'][username] = dict_merge(
+ default_values, dict['authentication']['local_users']['username'][username])
+
+ return dict
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index 944fc4294..422483663 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -22,6 +22,7 @@
# makes use of it!
from vyos import ConfigError
+from vyos.util import vyos_dict_search
def verify_mtu(config):
"""
@@ -51,27 +52,26 @@ def verify_mtu_ipv6(config):
configured on the interface. IPv6 requires a 1280 bytes MTU.
"""
from vyos.validate import is_ipv6
- from vyos.util import vyos_dict_search
- # IPv6 minimum required link mtu
- min_mtu = 1280
+ if 'mtu' in config:
+ # IPv6 minimum required link mtu
+ min_mtu = 1280
+ if int(config['mtu']) < min_mtu:
+ interface = config['ifname']
+ error_msg = f'IPv6 address will be configured on interface "{interface}" ' \
+ f'thus the minimum MTU requirement is {min_mtu}!'
- if int(config['mtu']) < min_mtu:
- interface = config['ifname']
- error_msg = f'IPv6 address will be configured on interface "{interface}" ' \
- f'thus the minimum MTU requirement is {min_mtu}!'
+ if not vyos_dict_search('ipv6.address.no_default_link_local', config):
+ raise ConfigError('link-local ' + error_msg)
- if not vyos_dict_search('ipv6.address.no_default_link_local', config):
- raise ConfigError('link-local ' + error_msg)
+ for address in (vyos_dict_search('address', config) or []):
+ if address in ['dhcpv6'] or is_ipv6(address):
+ raise ConfigError(error_msg)
- for address in (vyos_dict_search('address', config) or []):
- if address in ['dhcpv6'] or is_ipv6(address):
+ if vyos_dict_search('ipv6.address.autoconf', config):
raise ConfigError(error_msg)
- if vyos_dict_search('ipv6.address.autoconf', config):
- raise ConfigError(error_msg)
-
- if vyos_dict_search('ipv6.address.eui64', config):
- raise ConfigError(error_msg)
+ if vyos_dict_search('ipv6.address.eui64', config):
+ raise ConfigError(error_msg)
def verify_vrf(config):
@@ -204,3 +204,58 @@ def verify_vlan_config(config):
verify_dhcpv6(vlan)
verify_address(vlan)
verify_vrf(vlan)
+
+def verify_accel_ppp_base_service(config):
+ """
+ Common helper function which must be used by all Accel-PPP services based
+ on get_config_dict()
+ """
+ # vertify auth settings
+ if vyos_dict_search('authentication.mode', config) == 'local':
+ if not vyos_dict_search('authentication.local_users', config):
+ raise ConfigError('PPPoE local auth mode requires local users to be configured!')
+
+ for user in vyos_dict_search('authentication.local_users.username', config):
+ user_config = config['authentication']['local_users']['username'][user]
+
+ if 'password' not in user_config:
+ raise ConfigError(f'Password required for local user "{user}"')
+
+ if 'rate_limit' in user_config:
+ # if up/download is set, check that both have a value
+ if not {'upload', 'download'} <= set(user_config['rate_limit']):
+ raise ConfigError(f'User "{user}" has rate-limit configured for only one ' \
+ 'direction but both upload and download must be given!')
+
+ elif vyos_dict_search('authentication.mode', config) == 'radius':
+ if not vyos_dict_search('authentication.radius.server', config):
+ raise ConfigError('RADIUS authentication requires at least one server')
+
+ for server in vyos_dict_search('authentication.radius.server', config):
+ radius_config = config['authentication']['radius']['server'][server]
+ if 'key' not in radius_config:
+ raise ConfigError(f'Missing RADIUS secret key for server "{server}"')
+
+ if 'gateway_address' not in config:
+ raise ConfigError('PPPoE server requires gateway-address to be configured!')
+
+ if 'name_server_ipv4' in config:
+ if len(config['name_server_ipv4']) > 2:
+ raise ConfigError('Not more then two IPv4 DNS name-servers ' \
+ 'can be configured')
+
+ if 'name_server_ipv6' in config:
+ if len(config['name_server_ipv6']) > 3:
+ raise ConfigError('Not more then three IPv6 DNS name-servers ' \
+ 'can be configured')
+
+ if 'client_ipv6_pool' in config:
+ ipv6_pool = config['client_ipv6_pool']
+ if 'delegate' in ipv6_pool:
+ if 'prefix' not in ipv6_pool:
+ raise ConfigError('IPv6 "delegate" also requires "prefix" to be defined!')
+
+ for delegate in ipv6_pool['delegate']:
+ if 'delegation_prefix' not in ipv6_pool['delegate'][delegate]:
+ raise ConfigError('delegation-prefix length required!')
+
diff --git a/python/vyos/ifconfig/bridge.py b/python/vyos/ifconfig/bridge.py
index c133a56fc..bf78f8972 100644
--- a/python/vyos/ifconfig/bridge.py
+++ b/python/vyos/ifconfig/bridge.py
@@ -16,7 +16,6 @@
from netifaces import interfaces
from vyos.ifconfig.interface import Interface
-from vyos.ifconfig.stp import STP
from vyos.validate import assert_boolean
from vyos.validate import assert_positive
from vyos.util import cmd
@@ -234,25 +233,33 @@ class BridgeIf(Interface):
if member in interfaces():
self.del_port(member)
- STPBridgeIf = STP.enable(BridgeIf)
tmp = vyos_dict_search('member.interface', config)
if tmp:
for interface, interface_config in tmp.items():
- # if we've come here we already verified the interface
- # does not have an addresses configured so just flush
- # any remaining ones
- Interface(interface).flush_addrs()
+ # if interface does yet not exist bail out early and
+ # add it later
+ if interface not in interfaces():
+ continue
+
+ # Bridge lower "physical" interface
+ lower = Interface(interface)
+
+ # If we've come that far we already verified the interface does
+ # not have any addresses configured by CLI so just flush any
+ # remaining ones
+ lower.flush_addrs()
# enslave interface port to bridge
self.add_port(interface)
- tmp = STPBridgeIf(interface)
# set bridge port path cost
- value = interface_config.get('cost')
- tmp.set_path_cost(value)
+ if 'cost' in interface_config:
+ value = interface_config.get('cost')
+ lower.set_path_cost(value)
# set bridge port path priority
- value = interface_config.get('priority')
- tmp.set_path_priority(value)
+ if 'priority' in interface_config:
+ value = interface_config.get('priority')
+ lower.set_path_priority(value)
# Enable/Disable of an interface must always be done at the end of the
# derived class to make use of the ref-counting set_admin_state()
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index d200fc7a8..ae747e87c 100644
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -147,6 +147,10 @@ class Interface(Control):
'validate': assert_boolean,
'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_ignore',
},
+ 'ipv4_forwarding': {
+ 'validate': assert_boolean,
+ 'location': '/proc/sys/net/ipv4/conf/{ifname}/forwarding',
+ },
'ipv6_accept_ra': {
'validate': lambda ara: assert_range(ara,0,3),
'location': '/proc/sys/net/ipv6/conf/{ifname}/accept_ra',
@@ -163,6 +167,18 @@ class Interface(Control):
'validate': assert_positive,
'location': '/proc/sys/net/ipv6/conf/{ifname}/dad_transmits',
},
+ 'path_cost': {
+ # XXX: we should set a maximum
+ 'validate': assert_positive,
+ 'location': '/sys/class/net/{ifname}/brport/path_cost',
+ 'errormsg': '{ifname} is not a bridge port member'
+ },
+ 'path_priority': {
+ # XXX: we should set a maximum
+ 'validate': assert_positive,
+ 'location': '/sys/class/net/{ifname}/brport/priority',
+ 'errormsg': '{ifname} is not a bridge port member'
+ },
'proxy_arp': {
'validate': assert_boolean,
'location': '/proc/sys/net/ipv4/conf/{ifname}/proxy_arp',
@@ -461,6 +477,12 @@ class Interface(Control):
"""
return self.set_interface('arp_ignore', arp_ignore)
+ def set_ipv4_forwarding(self, forwarding):
+ """
+ Configure IPv4 forwarding.
+ """
+ return self.set_interface('ipv4_forwarding', forwarding)
+
def set_ipv6_accept_ra(self, accept_ra):
"""
Accept Router Advertisements; autoconfigure using them.
@@ -618,6 +640,28 @@ class Interface(Control):
self._admin_state_down_cnt += 1
return self.set_interface('admin_state', state)
+ def set_path_cost(self, cost):
+ """
+ Set interface path cost, only relevant for STP enabled interfaces
+
+ Example:
+
+ >>> from vyos.ifconfig import Interface
+ >>> Interface('eth0').set_path_cost(4)
+ """
+ self.set_interface('path_cost', cost)
+
+ def set_path_priority(self, priority):
+ """
+ Set interface path priority, only relevant for STP enabled interfaces
+
+ Example:
+
+ >>> from vyos.ifconfig import Interface
+ >>> Interface('eth0').set_path_priority(4)
+ """
+ self.set_interface('path_priority', priority)
+
def set_proxy_arp(self, enable):
"""
Set per interface proxy ARP configuration
@@ -799,24 +843,27 @@ class Interface(Control):
# flush all addresses
self._cmd(f'ip addr flush dev "{self.ifname}"')
- def add_to_bridge(self, br):
+ def add_to_bridge(self, bridge_dict):
"""
Adds the interface to the bridge with the passed port config.
Returns False if bridge doesn't exist.
"""
- # check if the bridge exists (on boot it doesn't)
- if br not in Section.interfaces('bridge'):
- return False
-
+ # drop all interface addresses first
self.flush_addrs()
- # add interface to bridge - use Section.klass to get BridgeIf class
- Section.klass(br)(br, create=False).add_port(self.ifname)
- # TODO: port config (STP)
+ for bridge, bridge_config in bridge_dict.items():
+ # add interface to bridge - use Section.klass to get BridgeIf class
+ Section.klass(bridge)(bridge, create=True).add_port(self.ifname)
- return True
+ # set bridge port path cost
+ if 'cost' in bridge_config:
+ self.set_path_cost(bridge_config['cost'])
+
+ # set bridge port path priority
+ if 'priority' in bridge_config:
+ self.set_path_cost(bridge_config['priority'])
def set_dhcp(self, enable):
"""
@@ -974,6 +1021,11 @@ class Interface(Control):
value = '1' if (tmp != None) else '0'
self.set_proxy_arp_pvlan(value)
+ # IPv4 forwarding
+ tmp = vyos_dict_search('ip.disable_forwarding', config)
+ value = '0' if (tmp != None) else '1'
+ self.set_ipv4_forwarding(value)
+
# IPv6 forwarding
tmp = vyos_dict_search('ipv6.disable_forwarding', config)
value = '0' if (tmp != None) else '1'
@@ -1032,8 +1084,8 @@ class Interface(Control):
# re-add ourselves to any bridge we might have fallen out of
if 'is_bridge_member' in config:
- bridge = config.get('is_bridge_member')
- self.add_to_bridge(bridge)
+ bridge_dict = config.get('is_bridge_member')
+ self.add_to_bridge(bridge_dict)
# remove no longer required 802.1ad (Q-in-Q VLANs)
ifname = config['ifname']
diff --git a/python/vyos/ifconfig/stp.py b/python/vyos/ifconfig/stp.py
deleted file mode 100644
index 5e83206c2..000000000
--- a/python/vyos/ifconfig/stp.py
+++ /dev/null
@@ -1,70 +0,0 @@
-# Copyright 2019 VyOS maintainers and contributors <maintainers@vyos.io>
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library. If not, see <http://www.gnu.org/licenses/>.
-
-
-from vyos.ifconfig.interface import Interface
-
-from vyos.validate import assert_positive
-
-
-class STP:
- """
- A spanning-tree capable interface. This applies only to bridge port member
- interfaces!
- """
-
- @classmethod
- def enable (cls, adaptee):
- adaptee._sysfs_set = {**adaptee._sysfs_set, **cls._sysfs_set}
- adaptee.set_path_cost = cls.set_path_cost
- adaptee.set_path_priority = cls.set_path_priority
- return adaptee
-
- _sysfs_set = {
- 'path_cost': {
- # XXX: we should set a maximum
- 'validate': assert_positive,
- 'location': '/sys/class/net/{ifname}/brport/path_cost',
- 'errormsg': '{ifname} is not a bridge port member'
- },
- 'path_priority': {
- # XXX: we should set a maximum
- 'validate': assert_positive,
- 'location': '/sys/class/net/{ifname}/brport/priority',
- 'errormsg': '{ifname} is not a bridge port member'
- },
- }
-
- def set_path_cost(self, cost):
- """
- Set interface path cost, only relevant for STP enabled interfaces
-
- Example:
-
- >>> from vyos.ifconfig import Interface
- >>> Interface('eth0').set_path_cost(4)
- """
- self.set_interface('path_cost', cost)
-
- def set_path_priority(self, priority):
- """
- Set interface path priority, only relevant for STP enabled interfaces
-
- Example:
-
- >>> from vyos.ifconfig import Interface
- >>> Interface('eth0').set_path_priority(4)
- """
- self.set_interface('path_priority', priority)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-21 08:11:38 +0000