From 55ee90e486a500868c7fd1b523d76179522f1f56 Mon Sep 17 00:00:00 2001 From: hagbard Date: Fri, 9 Nov 2018 10:50:00 -0800 Subject: T835: accel-ppp pppoe implementation --- debian/changelog | 7 + interface-definitions/pppoe-server.xml | 198 ++++++++++++++++++ op-mode-definitions/pppoe-server.xml | 32 +++ src/conf_mode/accel_pppoe.py | 363 +++++++++++++++++++++++++++++++++ 4 files changed, 600 insertions(+) create mode 100644 interface-definitions/pppoe-server.xml create mode 100644 op-mode-definitions/pppoe-server.xml create mode 100755 src/conf_mode/accel_pppoe.py diff --git a/debian/changelog b/debian/changelog index d60c36316..1db603fe5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,15 @@ +vyos-1x (1.2.0-5) unstable; urgency=medium + + * T835: accel-ppp: pppoe implementation + + -- hagbard Fri, 09 Nov 2018 10:49:48 -0800 + vyos-1x (1.2.0-4) unstable; urgency=medium * T240 adds feature system integrity check -- hagbard Mon, 29 Oct 2018 11:10:18 -0700 + vyos-1x (1.2.0-3) unstable; urgency=medium * T933: adding vmac_xmit_base if use_vmac has been chosen diff --git a/interface-definitions/pppoe-server.xml b/interface-definitions/pppoe-server.xml new file mode 100644 index 000000000..ffefff1cb --- /dev/null +++ b/interface-definitions/pppoe-server.xml @@ -0,0 +1,198 @@ + + + + + + + Point to Point over Ethernet (PPPoE) Server + 900 + + + + + Access concentrator name + + ^[a-zA-Z0-9]{1,100} + + access-concentrator name limited to aplhanumerical characters only (max. 100) + + + + + Authentication for remote access PPPoE Server + + + + + Local user authentication for PPPoE server + + + + + User name for authentication + + + + + Option to disable a PPPoE Server user + + + + + Password for authentication + + + + + Static client IP address + + + + + + + + + Authentication mode for PPPoE Server + + local + Use local username/password configuration + + + radius + Use Radius server to autenticate users + + + ^(local|radius) + + + + + + + + Pool of client IP address (must be within a /24) + + + + + First IP address in the pool + + + + + + + + Last IP address in the pool + + + + + + + + + + Domain Name Service (DNS) server + + + + + Primary DNS server + + + + + + + + Secondary DNS server + + + + + + + + + + interface(s) to listen on + + + + + + + + + local gateway address + + + + + + + + Maximum Transmission Unit (MTU) - default 1440 + + + + + + + + RADIUS settings + + + + + Default interim accounting interval + + text + Use local username/password configuration + + + + + + + + + + + Service name + + ^[a-zA-Z0-9\-]{1,100} + + servicename can contain aplhanumerical characters and dash only (max. 100) + + + + + Windows Internet Name Service (WINS) server settings + + + + + Primary WINS server + + + + + + + + Secondary WINS server + + + + + + + + + + + + diff --git a/op-mode-definitions/pppoe-server.xml b/op-mode-definitions/pppoe-server.xml new file mode 100644 index 000000000..7595d6ecf --- /dev/null +++ b/op-mode-definitions/pppoe-server.xml @@ -0,0 +1,32 @@ + + + + + + + show pppoe-server status + + + + + Show active PPPoE server sessions + + /usr/bin/accel-cmd 'show sessions' + + + + Show PPPoE server statistics + + /usr/bin/accel-cmd 'show stat' + + + + Show interfaces where pppoe-server listens on + + /usr/bin/accel-cmd 'pppoe interface show' + + + + + + diff --git a/src/conf_mode/accel_pppoe.py b/src/conf_mode/accel_pppoe.py new file mode 100755 index 000000000..4aea84c44 --- /dev/null +++ b/src/conf_mode/accel_pppoe.py @@ -0,0 +1,363 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# + +import sys +import os +import re +import subprocess +import jinja2 +import socket +import time +import syslog as sl + +from vyos.config import Config +from vyos import ConfigError + +pidfile = r'/var/run/accel_pppoe.pid' +pppoe_cnf_dir = r'/etc/accel-ppp/pppoe' +chap_secrets = pppoe_cnf_dir + '/chap-secrets' +pppoe_conf = pppoe_cnf_dir + '/pppoe.config' +# accel-pppd -d -c /etc/accel-ppp/pppoe/pppoe.config -p /var/run/accel_pppoe.pid + +### config path creation +if not os.path.exists(pppoe_cnf_dir): + os.makedirs(pppoe_cnf_dir) + sl.syslog(sl.LOG_NOTICE, pppoe_cnf_dir + " created") + +pppoe_config = ''' +### generated by accel_pppoe.py ### +[modules] +log_syslog +pppoe +ippool +chap-secrets +auth_pap +auth_chap_md5 +auth_mschap_v1 +auth_mschap_v2 +pppd_compat +shaper +net-snmp +connlimit +{% if authentication['mode'] == 'radius' %} +radius +{% endif %} + +[core] +thread-count={{thread_cnt}} + +[log] +syslog=accel-pppoe,daemon +copy=1 +level=5 + +[snmp] +master=1 + +[client-ip-range] +disable + +[ip-pool] +{% if client_ip_pool %} +{{client_ip_pool}} +{% endif %} +gw-ip-address={{ppp_gw}} + +{% if dns %} +[dns] +{% if dns[0] %} +dns1={{dns[0]}} +{% endif %} +{% if dns[1] %} +dns2={{dns[1]}} +{% endif %} +{% endif %} + +{% if wins %} +[wins] +{% if wins[0] %} +wins1={{wins[0]}} +{% endif %} +{% if wins[1] %} +wins2={{wins[1]}} +{% endif %} +{% endif %} + +{% if authentication['mode'] == 'local' %} +[chap-secrets] +chap-secrets=/etc/accel-ppp/pppoe/chap-secrets +{% endif %} + +{% if authentication['mode'] == 'radius' %} +[radius] +{% for rsrv in authentication['radiussrv']: %} +server={{rsrv}},{{authentication['radiussrv'][rsrv]}} +{% endfor %} +timeout=10 +acct-timeout=3 +gw-ip-address={{ppp_gw}} +verbose=1 +{% endif %} + +[ppp] +verbose=1 +min-mtu={{mtu}} +mtu={{mtu}} +mru=1400 +check-ip=1 +mppe=prefer +ipv4=require +check-ip=1 +single-session=replace +mppe=prefer +lcp-echo-interval=30 +lcp-echo-failure=3 + +[pppoe] +verbose=1 +{% if concentrator %} +ac-name={{concentrator}} +{% endif %} +{% if interface %} +{% for int in interface %} +interface={{int}} +{% endfor %} +{% endif %} +{% if svc_name %} +service-name={{svc_name}} +{% endif %} + + +[connlimit] +limit=10/min +burst=3 +timeout=60 + +[cli] +tcp=127.0.0.1:2001 +''' + +### pppoe chap secrets +chap_secrets_conf = ''' +# username server password acceptable local IP addresses +{% for user in authentication['local-users'] %} +{% if authentication['local-users'][user]['state'] == 'enabled' %} +{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}} +{% endif %} +{% endfor %} +''' +### +# inline helper functions +### +# depending on hw and threads, daemon needs a little to start +# if it takes longer than 100 * 0.5 secs, exception is being raised +# not sure if that's the best way to check it, but it worked so far quite well +### +def chk_con(): + cnt = 0 + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + while True: + try: + s.connect(("127.0.0.1", 2001)) + break + except ConnectionRefusedError: + time.sleep(0.5) + cnt +=1 + if cnt == 100: + raise("failed to start pppoe server") + break + +### chap_secrets file if auth mode local +def write_chap_secrets(c): + tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) + chap_secrets_txt = tmpl.render(c) + old_umask = os.umask(0o077) + open(chap_secrets,'w').write(chap_secrets_txt) + os.umask(old_umask) + sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') + +def accel_cmd(cmd=''): + if not cmd: + return None + try: + ret = subprocess.check_output(['/usr/bin/accel-cmd',cmd]).decode().strip() + return ret + except: + return 1 + +### +# inline helper functions end +### + +def get_config(): + c = Config() + if not c.exists('service pppoe-server'): + return None + + config_data = { + 'concentrator' : 'vyos-ac', + 'authentication' : { + 'local-users' : { + }, + 'mode' : 'local', + 'radiussrv' : {} + }, + 'client_ip_pool' : '', + 'interface' : [], + 'ppp_gw' : '', + 'svc_name' : '', + 'dns' : [], + 'wins' : [], + 'mtu' : '1492' + } + + c.set_level('service pppoe-server') + + if c.exists('access-concentrator'): + config_data['concentrator'] = c.return_value('access-concentrator') + if c.exists('service-name'): + config_data['svc_name'] = c.return_value('service-name') + if c.exists('interface'): + config_data['interface'] = c.return_values('interface') + if c.exists('local-ip'): + config_data['ppp_gw'] = c.return_value('local-ip') + if c.exists('dns-servers'): + if c.return_value('dns-servers server-1'): + config_data['dns'].append(c.return_value('dns-servers server-1')) + if c.return_value('dns-servers server-2'): + config_data['dns'].append(c.return_value('dns-servers server-2')) + if c.exists('wins-servers'): + if c.return_value('wins-servers server-1'): + config_data['wins'].append(c.return_value('wins-servers server-1')) + if c.return_value('wins-servers server-2'): + config_data['wins'].append(c.return_value('wins-servers server-2')) + if c.exists('client-ip-pool'): + if c.exists('client-ip-pool start'): + config_data['client_ip_pool'] = c.return_value('client-ip-pool start') + if c.exists('client-ip-pool stop'): + config_data['client_ip_pool'] += '-' + re.search('[0-9]+$', c.return_value('client-ip-pool stop')).group(0) + else: + raise ConfigError('client ip pool stop required') + + #### authentication mode local + if c.exists('authentication'): + if c.return_value('authentication mode') == 'local': + if c.exists('authentication local-users username'): + for usr in c.list_nodes('authentication local-users username'): + config_data['authentication']['local-users'].update( + { + usr : { + 'passwd' : '', + 'state' : 'enabled', + 'ip' : '*' + } + } + ) + if c.exists('authentication local-users username ' + usr + ' password'): + config_data['authentication']['local-users'][usr]['passwd'] = c.return_value('authentication local-users username ' + usr + ' password') + if c.exists('authentication local-users username ' + usr + ' disable'): + config_data['authentication']['local-users'][usr]['state'] = 'disable' + if c.exists('authentication local-users username ' + usr + ' static-ip'): + config_data['authentication']['local-users'][usr]['ip'] = c.return_value('authentication local-users username ' + usr + ' static-ip') + + ### authentication mode radius + if c.return_value('authentication mode') == 'radius': + config_data['authentication']['mode'] = 'radius' + rsrvs = c.list_nodes('authentication radius-server') + for rsrv in rsrvs: + config_data['authentication']['radiussrv'].update( + { + rsrv : str(c.return_value('authentication radius-server ' + rsrv + ' key')) + } + ) + + if c.exists('mtu'): + config_data['mtu'] = c.return_value('mtu') + + return config_data + +def verify(c): + if c == None: + return None + + for usr in c['authentication']['local-users']: + if not c['authentication']['local-users'][usr]: + raise ConfigError('user ' + usr + ' has no password set') + + if not c['ppp_gw']: + raise ConfigError('pppoe gateway-ip required') + + if c['authentication']['mode'] == 'radius': + if len(c['authentication']['radiussrv']) == 0: + raise ConfigError('radius server required') + +def generate(c): + if c == None: + return None + + ### accel-cmd reload doesn't work so any change results in a restart of the daemon + try: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + except KeyError: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + + tmpl = jinja2.Template(pppoe_config, trim_blocks=True) + config_text = tmpl.render(c) + open(pppoe_conf,'w').write(config_text) + sl.syslog(sl.LOG_NOTICE, pppoe_config + ' written') + + return c + +def apply(c): + if c == None: + if os.path.exists(pidfile): + accel_cmd('shutdown hard') + if os.path.exists(pidfile): + os.remove(pidfile) + return None + + if not os.path.exists(pidfile): + ret = subprocess.call(['/usr/sbin/accel-pppd','-c',pppoe_conf,'-p',pidfile,'-d']) + chk_con() + if ret !=0 and os.path.exists(pidfile): + os.remove(pidfile) + raise ConfigError('accel-pppd failed to start') + else: + accel_cmd('restart') + sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + + #if c['state'] == 'update': + # accel_cmd('restart') + # sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + # ## check that config reload actually works + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3