summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rwxr-xr-xsrc/conf_mode/accel_l2tp.py22
-rwxr-xr-xsrc/conf_mode/interface-bonding.py10
-rwxr-xr-xsrc/conf_mode/interface-openvpn.py19
-rwxr-xr-xsrc/op_mode/reset_vpn.py85
-rwxr-xr-xsrc/op_mode/show_openvpn.py7
5 files changed, 128 insertions, 15 deletions
diff --git a/src/conf_mode/accel_l2tp.py b/src/conf_mode/accel_l2tp.py
index 3af8b7958..244a720db 100755
--- a/src/conf_mode/accel_l2tp.py
+++ b/src/conf_mode/accel_l2tp.py
@@ -94,6 +94,7 @@ wins2={{wins[1]}}
[l2tp]
verbose=1
+ifname=l2tp%d
ppp-max-mtu={{mtu}}
mppe={{authentication['mppe']}}
{% if outside_addr %}
@@ -133,7 +134,16 @@ single-session=replace
{% if idle_timeout %}
lcp-echo-timeout={{idle_timeout}}
{% endif %}
+{% if ppp_options['lcp-echo-interval'] %}
+lcp-echo-interval={{ppp_options['lcp-echo-interval']}}
+{% else %}
lcp-echo-interval=30
+{% endif %}
+{% if ppp_options['lcp-echo-failure'] %}
+lcp-echo-failure={{ppp_options['lcp-echo-failure']}}
+{% else %}
+lcp-echo-failure=3
+{% endif %}
{% if ccp_disable %}
ccp=0
{% endif %}
@@ -287,6 +297,7 @@ def get_config():
'mtu' : '1436',
'ip6_column' : '',
'ip6_dp_column' : '',
+ 'ppp_options' : {},
}
### general options ###
@@ -439,6 +450,17 @@ def get_config():
if c.exists('ccp-disable'):
config_data['ccp_disable'] = True
+ ### ppp_options
+ ppp_options = {}
+ if c.exists('ppp-options'):
+ if c.exists('ppp-options lcp-echo-failure'):
+ ppp_options['lcp-echo-failure'] = c.return_value('ppp-options lcp-echo-failure')
+ if c.exists('ppp-options lcp-echo-interval'):
+ ppp_options['lcp-echo-interval'] = c.return_value('ppp-options lcp-echo-interval')
+
+ if len(ppp_options) !=0:
+ config_data['ppp_options'] = ppp_options
+
return config_data
def verify(c):
diff --git a/src/conf_mode/interface-bonding.py b/src/conf_mode/interface-bonding.py
index dc0363fb7..f0a33beff 100755
--- a/src/conf_mode/interface-bonding.py
+++ b/src/conf_mode/interface-bonding.py
@@ -157,8 +157,6 @@ def get_config():
# retrieve interface description
if conf.exists('description'):
bond['description'] = conf.return_value('description')
- else:
- bond['description'] = bond['intf']
# get DHCP client identifier
if conf.exists('dhcp-options client-id'):
@@ -354,12 +352,12 @@ def apply(bond):
for intf in b.get_slaves():
b.del_port(intf)
- # ARP link monitoring frequency
- b.arp_interval = bond['arp_mon_intvl']
- # reset miimon on arp-montior deletion
+ # ARP link monitoring frequency, reset miimon when arp-montior is inactive
if bond['arp_mon_intvl'] == 0:
# reset miimon to default
- b.bond_miimon = 250
+ b.miimon = 250
+ else:
+ b.arp_interval = bond['arp_mon_intvl']
# ARP monitor targets need to be synchronized between sysfs and CLI.
# Unfortunately an address can't be send twice to sysfs as this will
diff --git a/src/conf_mode/interface-openvpn.py b/src/conf_mode/interface-openvpn.py
index 548c78535..34c094862 100755
--- a/src/conf_mode/interface-openvpn.py
+++ b/src/conf_mode/interface-openvpn.py
@@ -326,14 +326,14 @@ def checkCertHeader(header, filename):
Returns True on success or on file not found to not trigger the exceptions
"""
if not os.path.isfile(filename):
- return True
+ return False
with open(filename, 'r') as f:
for line in f:
if re.match(header, line):
return True
- return False
+ return True
def get_config():
openvpn = deepcopy(default_config_data)
@@ -696,8 +696,9 @@ def verify(openvpn):
#
# TLS/encryption
#
- if not checkCertHeader('-----BEGIN OpenVPN Static key V1-----', openvpn['shared_secret_file']):
- raise ConfigError('Specified shared-secret-key-file "{}" is not valid'.format(openvpn['shared_secret_file']))
+ if openvpn['shared_secret_file']:
+ if not checkCertHeader('-----BEGIN OpenVPN Static key V1-----', openvpn['shared_secret_file']):
+ raise ConfigError('Specified shared-secret-key-file "{}" is not valid'.format(openvpn['shared_secret_file']))
if openvpn['tls']:
if not openvpn['tls_ca_cert']:
@@ -719,11 +720,13 @@ def verify(openvpn):
if not checkCertHeader('-----BEGIN (?:RSA )?PRIVATE KEY-----', openvpn['tls_key']):
raise ConfigError('Specified key-file "{}" is not valid'.format(openvpn['tls_key']))
- if not checkCertHeader('-----BEGIN X509 CRL-----', openvpn['tls_crl']):
- raise ConfigError('Specified crl-file "{} not valid'.format(openvpn['tls_crl']))
+ if openvpn['tls_crl']:
+ if not checkCertHeader('-----BEGIN X509 CRL-----', openvpn['tls_crl']):
+ raise ConfigError('Specified crl-file "{} not valid'.format(openvpn['tls_crl']))
- if not checkCertHeader('-----BEGIN DH PARAMETERS-----', openvpn['tls_dh']):
- raise ConfigError('Specified dh-file "{}" is not valid'.format(openvpn['tls_dh']))
+ if openvpn['tls_dh']:
+ if not checkCertHeader('-----BEGIN DH PARAMETERS-----', openvpn['tls_dh']):
+ raise ConfigError('Specified dh-file "{}" is not valid'.format(openvpn['tls_dh']))
if openvpn['tls_role']:
if openvpn['mode'] in ['client', 'server']:
diff --git a/src/op_mode/reset_vpn.py b/src/op_mode/reset_vpn.py
new file mode 100755
index 000000000..52677b58d
--- /dev/null
+++ b/src/op_mode/reset_vpn.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# import os
+import sys
+import subprocess
+import argparse
+#import re
+
+pptp_cmd = ["/usr/bin/accel-cmd", "-p 2003"]
+l2tp_cmd = ["/usr/bin/accel-cmd", "-p 2004"]
+
+def terminate_sessions(username='', interface='', protocol=''):
+ if username:
+ if username == "all_users":
+ if protocol == "pptp":
+ pptp_cmd.append("terminate all")
+ subprocess.call(pptp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ return
+ elif protocol == "l2tp":
+ l2tp_cmd.append("terminate all")
+ subprocess.call(l2tp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ return
+ else:
+ pptp_cmd.append("terminate all")
+ subprocess.call(pptp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ l2tp_cmd.append("terminate all")
+ subprocess.call(l2tp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ return
+
+ if protocol == "pptp":
+ pptp_cmd.append("terminate username {0}".format(username))
+ subprocess.call(pptp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ return
+ elif protocol == "l2tp":
+ l2tp_cmd.append("terminate username {0}".format(username))
+ subprocess.call(l2tp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ return
+ else:
+ pptp_cmd.append("terminate username {0}".format(username))
+ subprocess.call(pptp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ l2tp_cmd.append("terminate username {0}".format(username))
+ subprocess.call(l2tp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ return
+
+ # rewrite `terminate by interface` if pptp will have pptp%d interface naming
+ if interface:
+ pptp_cmd.append("terminate if {0}".format(interface))
+ subprocess.call(pptp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+ l2tp_cmd.append("terminate if {0}".format(interface))
+ subprocess.call(l2tp_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+
+def main():
+ #parese args
+ parser = argparse.ArgumentParser()
+ parser.add_argument('--username', help='Terminate by username (all_users used for disconnect all users)', required=False)
+ parser.add_argument('--interface', help='Terminate by interface', required=False)
+ parser.add_argument('--protocol', help='Set protocol (pptp|l2tp)', required=False)
+ args = parser.parse_args()
+
+ if args.username or args.interface:
+ terminate_sessions(username=args.username, interface=args.interface, protocol=args.protocol)
+ else:
+ print("Param --username or --interface required")
+ sys.exit(1)
+
+ terminate_sessions()
+
+
+if __name__ == '__main__':
+ main()
diff --git a/src/op_mode/show_openvpn.py b/src/op_mode/show_openvpn.py
index 23a8156ec..577ed7eb7 100755
--- a/src/op_mode/show_openvpn.py
+++ b/src/op_mode/show_openvpn.py
@@ -18,6 +18,7 @@
import jinja2
import argparse
+from sys import exit
from vyos.config import Config
outp_tmpl = """
@@ -136,7 +137,7 @@ if __name__ == '__main__':
config = Config()
if len(config.list_effective_nodes('interfaces openvpn')) == 0:
print("No OpenVPN interfaces configured")
- sys.exit(0)
+ exit(0)
# search all OpenVPN interfaces and add those with a matching mode to our
# interfaces list
@@ -161,6 +162,10 @@ if __name__ == '__main__':
remote_host = config.return_effective_values('interfaces openvpn {} remote-host'.format(intf))
remote_port = config.return_effective_value('interfaces openvpn {} remote-port'.format(intf))
+
+ if not remote_port:
+ remote_port = '1194'
+
if len(remote_host) >= 1:
client['remote'] = str(remote_host[0]) + ':' + remote_port
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-26 10:19:51 +0000