From fd371f58805a9ed8b58a2548798ba683e9736642 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 18 Apr 2020 15:26:22 +0200 Subject: ipoe-server: rename XML/Python files for a common pattern --- interface-definitions/service-ipoe.xml.in | 378 ----------------------- interface-definitions/service_ipoe-server.xml.in | 378 +++++++++++++++++++++++ 2 files changed, 378 insertions(+), 378 deletions(-) delete mode 100644 interface-definitions/service-ipoe.xml.in create mode 100644 interface-definitions/service_ipoe-server.xml.in (limited to 'interface-definitions') diff --git a/interface-definitions/service-ipoe.xml.in b/interface-definitions/service-ipoe.xml.in deleted file mode 100644 index 6804469cb..000000000 --- a/interface-definitions/service-ipoe.xml.in +++ /dev/null @@ -1,378 +0,0 @@ - - - - - - - Internet Protocol over Ethernet (IPoE) Server - 900 - - - - - Network interface to server IPoE - - - - - - - - Network Layer IPoE serves on - - L2 L3 - - - (L2|L3) - - - L2 - client share the same subnet - - - L3 - clients are behind this router - - - - - - Enables clients to share the same network or each client has its own vlan - - shared vlan - - - (shared|vlan) - - - shared - Multiple clients share the same network - - - vlan - One VLAN per client - - - - - - Client address pool - - ipv4net - IPv4 address and prefix length - - - - - - - - - DHCP requests will be forwarded - - - - - DHCP Server the request will be redirected to. - - ipv4 - IPv4 address of the DHCP Server - - - - - - - - - address of the relay agent (Relay Agent IP Address) - - - - - - - VLAN monitor for the automatic creation of vlans (user per vlan) - - - - VLAN ID needs to be between 1 and 4096 - - - - - - VLAN monitor for the automatic creation of vlans (user per vlan) - - (409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2})-(409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2}) - - - - - - - - - DNS servers offered via internal DHCP - - - - - IP address of the primary DNS server - - - - - - - - IP address of the secondary DNS server - - - - - - - - - - DNSv6 servers offered via internal DHCPv6 - - - - - IP address of the primary DNS server - - - - - - - - IP address of the secondary DNS server - - - - - - - - IP address of the tertiary DNS server - - - - - - - - - - Pool of client IPv6 addresses - - - - - Format: ipv6prefix/mask,prefix_len (e.g.: fc00:0:1::/48,64 - divides prefix into /64 subnets for clients) - - - - - - Format: ipv6prefix/mask,prefix_len (delegates prefix to clients via DHCPv6 prefix delegation - - - - - - - - Client authentication methods - - - - - Authetication mode - - local radius noauth - - - (local|radius|noauth) - - - local - Authentication based on local definition - - - radius - Authentication based on a RADIUS server - - - noauth - Authentication disabled - - - - - - Network interface the client mac will appear on - - - - - - - - Client mac address allowed to receive an IP address - - h:h:h:h:h:h - Hardware (MAC) address - - - - - - - - - Upload/Download speed limits - - - - - Upload bandwidth limit in kbits/sec - - - - - - - - Download bandwidth limit in kbits/sec - - - - - - - - - - VLAN-ID of the client network - - - - VLAN ID needs to be between 1 and 4096 - - - - - - - - - IP address of RADIUS server - - ipv4 - IP address of RADIUS server - - - - - - Key for accessing the specified server - - - - - Maximum number of simultaneous requests to server (default: unlimited) - - - - - If server does not respond, mark it unavailable for this time (seconds) - - - - - - - RADIUS settings - - - - - Timeout to wait response from server (seconds) - - - - - Timeout to wait reply for Interim-Update packets. (default 3 seconds) - - - - - Maximum number of tries to send Access-Request/Accounting-Request queries - - - - - Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests. - - - - - Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also DM/CoA server will bind to that address. - - ipv4 - IPv4 address of the DAE Server - - - - - - - - - IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA) - - - - - IP address for Dynamic Authorization Extension server (DM/CoA) - - ipv4 - IPv4 address of the DAE Server - - - - - - - - - Port for Dynamic Authorization Extension server (DM/CoA) - - 1-65535 - port number - - - - - - - - - Secret for Dynamic Authorization Extension server (DM/CoA) - - - - - - - - - - - - - diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in new file mode 100644 index 000000000..4033b56d6 --- /dev/null +++ b/interface-definitions/service_ipoe-server.xml.in @@ -0,0 +1,378 @@ + + + + + + + Internet Protocol over Ethernet (IPoE) Server + 900 + + + + + Network interface to server IPoE + + + + + + + + Network Layer IPoE serves on + + L2 L3 + + + (L2|L3) + + + L2 + client share the same subnet + + + L3 + clients are behind this router + + + + + + Enables clients to share the same network or each client has its own vlan + + shared vlan + + + (shared|vlan) + + + shared + Multiple clients share the same network + + + vlan + One VLAN per client + + + + + + Client address pool + + ipv4net + IPv4 address and prefix length + + + + + + + + + DHCP requests will be forwarded + + + + + DHCP Server the request will be redirected to. + + ipv4 + IPv4 address of the DHCP Server + + + + + + + + + address of the relay agent (Relay Agent IP Address) + + + + + + + VLAN monitor for the automatic creation of vlans (user per vlan) + + + + VLAN ID needs to be between 1 and 4096 + + + + + + VLAN monitor for the automatic creation of vlans (user per vlan) + + (409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2})-(409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2}) + + + + + + + + + DNS servers offered via internal DHCP + + + + + IP address of the primary DNS server + + + + + + + + IP address of the secondary DNS server + + + + + + + + + + DNSv6 servers offered via internal DHCPv6 + + + + + IP address of the primary DNS server + + + + + + + + IP address of the secondary DNS server + + + + + + + + IP address of the tertiary DNS server + + + + + + + + + + Pool of client IPv6 addresses + + + + + Format: ipv6prefix/mask,prefix_len (e.g.: fc00:0:1::/48,64 - divides prefix into /64 subnets for clients) + + + + + + Format: ipv6prefix/mask,prefix_len (delegates prefix to clients via DHCPv6 prefix delegation + + + + + + + + Client authentication methods + + + + + Authetication mode + + local radius noauth + + + (local|radius|noauth) + + + local + Authentication based on local definition + + + radius + Authentication based on a RADIUS server + + + noauth + Authentication disabled + + + + + + Network interface the client mac will appear on + + + + + + + + Client mac address allowed to receive an IP address + + h:h:h:h:h:h + Hardware (MAC) address + + + + + + + + + Upload/Download speed limits + + + + + Upload bandwidth limit in kbits/sec + + + + + + + + Download bandwidth limit in kbits/sec + + + + + + + + + + VLAN-ID of the client network + + + + VLAN ID needs to be between 1 and 4096 + + + + + + + + + IP address of RADIUS server + + ipv4 + IP address of RADIUS server + + + + + + Key for accessing the specified server + + + + + Maximum number of simultaneous requests to server (default: unlimited) + + + + + If server does not respond, mark it unavailable for this time (seconds) + + + + + + + RADIUS settings + + + + + Timeout to wait response from server (seconds) + + + + + Timeout to wait reply for Interim-Update packets. (default 3 seconds) + + + + + Maximum number of tries to send Access-Request/Accounting-Request queries + + + + + Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests. + + + + + Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also DM/CoA server will bind to that address. + + ipv4 + IPv4 address of the DAE Server + + + + + + + + + IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA) + + + + + IP address for Dynamic Authorization Extension server (DM/CoA) + + ipv4 + IPv4 address of the DAE Server + + + + + + + + + Port for Dynamic Authorization Extension server (DM/CoA) + + 1-65535 + port number + + + + + + + + + Secret for Dynamic Authorization Extension server (DM/CoA) + + + + + + + + + + + + + -- cgit v1.2.3 From 03c9155cd012a56c9454b396c5db7785abb80b0a Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 18 Apr 2020 15:27:28 +0200 Subject: router-advert: rename XML/Python files for a common pattern --- interface-definitions/service-router-advert.xml.in | 266 --------------------- interface-definitions/service_router-advert.xml.in | 266 +++++++++++++++++++++ src/conf_mode/service-router-advert.py | 169 ------------- src/conf_mode/service_router-advert.py | 169 +++++++++++++ 4 files changed, 435 insertions(+), 435 deletions(-) delete mode 100644 interface-definitions/service-router-advert.xml.in create mode 100644 interface-definitions/service_router-advert.xml.in delete mode 100755 src/conf_mode/service-router-advert.py create mode 100755 src/conf_mode/service_router-advert.py (limited to 'interface-definitions') diff --git a/interface-definitions/service-router-advert.xml.in b/interface-definitions/service-router-advert.xml.in deleted file mode 100644 index bd63b15a3..000000000 --- a/interface-definitions/service-router-advert.xml.in +++ /dev/null @@ -1,266 +0,0 @@ - - - - - - - IPv6 Router Advertisements (RAs) service - 900 - - - - - Interface to send DDNS updates for [REQUIRED] - - - - - - - - Set Hop Count field of the IP header for outgoing packets (default: 64) - - 1-255 - Value should represent current diameter of the Internet - - - 0 - Unspecified (by this router) - - - - - Hop count must be between 0 and 255 - - - - - Lifetime associated with the default router in units of seconds - - 4-9000 - Router Lifetime in seconds - - - 0 - Not a default router - - - - - Default router livetime bust be 0 or between 4 and 9000 - - - - - Preference associated with the default router, - - low medium high - - - low - Default router has low preference - - - medium - Default router has medium preference (default) - - - high - Default router has high preference - - - (low|medium|high) - - Default preference must be low, medium or high - - - - - DNS search list - - - - - - Link MTU value placed in RAs, exluded in RAs if unset - - 1280-9000 - Link MTU value in RAs - - - - - Link MTU must be between 1280 and 9000 - - - - - Hosts use the administered (stateful) protocol for address autoconfiguration in addition to any addresses autoconfigured using SLAAC - - - - - - Set interval between unsolicited multicast RAs - - - - - Maximum interval between unsolicited multicast RAs (default: 600) - - 4-1800 - Maximum interval in seconds - - - - - Maximum interval must be between 4 and 1800 seconds - - - - - Minimum interval between unsolicited multicast RAs - - 3-1350 - Minimum interval in seconds - - - - - Minimum interval must be between 3 and 1350 seconds - - - - - - - IPv6 address of recursive DNS server - - ipv6 - IPv6 address of DNS name server - - - - - - - - - - Hosts use the administered (stateful) protocol for autoconfiguration of other (non-address) information - - - - - - IPv6 prefix to be advertised in Router Advertisements (RAs) - - ipv6net - IPv6 prefix to be advertized - - - - - - - - - Prefix can not be used for stateless address auto-configuration - - - - - - Prefix can not be used for on-link determination - - - - - - Time in seconds that the prefix will remain preferred (default 4 hours) - - infinity - - - 0-4294967295 - Time in seconds that the prefix will remain preferred - - - infinity - Prefix will remain preferred forever - - - - (infinity) - - - - - - Time in seconds that the prefix will remain valid (default: 30 days) - - infinity - - - 1-4294967295 - Time in seconds that the prefix will remain valid - - - infinity - Prefix will remain preferred forever - - - - (infinity) - - - - - - - - Time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation - - 1-3600000 - Reachable Time value in RAs (in milliseconds) - - - 0 - Reachable Time unspecified by this router - - - - - Reachable time must be 0 or between 1 and 3600000 milliseconds - - - - - Time in milliseconds between retransmitted Neighbor Solicitation messages - - 1-4294967295 - Minimum interval in milliseconds - - - 0 - Time, in milliseconds, between retransmitted Neighbor Solicitation messages - - - - - Retransmit interval must be 0 or between 1 and 4294967295 milliseconds - - - - - Do not send router adverts - - - - - - - - - - diff --git a/interface-definitions/service_router-advert.xml.in b/interface-definitions/service_router-advert.xml.in new file mode 100644 index 000000000..6a4706ab7 --- /dev/null +++ b/interface-definitions/service_router-advert.xml.in @@ -0,0 +1,266 @@ + + + + + + + IPv6 Router Advertisements (RAs) service + 900 + + + + + Interface to send DDNS updates for [REQUIRED] + + + + + + + + Set Hop Count field of the IP header for outgoing packets (default: 64) + + 1-255 + Value should represent current diameter of the Internet + + + 0 + Unspecified (by this router) + + + + + Hop count must be between 0 and 255 + + + + + Lifetime associated with the default router in units of seconds + + 4-9000 + Router Lifetime in seconds + + + 0 + Not a default router + + + + + Default router livetime bust be 0 or between 4 and 9000 + + + + + Preference associated with the default router, + + low medium high + + + low + Default router has low preference + + + medium + Default router has medium preference (default) + + + high + Default router has high preference + + + (low|medium|high) + + Default preference must be low, medium or high + + + + + DNS search list + + + + + + Link MTU value placed in RAs, exluded in RAs if unset + + 1280-9000 + Link MTU value in RAs + + + + + Link MTU must be between 1280 and 9000 + + + + + Hosts use the administered (stateful) protocol for address autoconfiguration in addition to any addresses autoconfigured using SLAAC + + + + + + Set interval between unsolicited multicast RAs + + + + + Maximum interval between unsolicited multicast RAs (default: 600) + + 4-1800 + Maximum interval in seconds + + + + + Maximum interval must be between 4 and 1800 seconds + + + + + Minimum interval between unsolicited multicast RAs + + 3-1350 + Minimum interval in seconds + + + + + Minimum interval must be between 3 and 1350 seconds + + + + + + + IPv6 address of recursive DNS server + + ipv6 + IPv6 address of DNS name server + + + + + + + + + + Hosts use the administered (stateful) protocol for autoconfiguration of other (non-address) information + + + + + + IPv6 prefix to be advertised in Router Advertisements (RAs) + + ipv6net + IPv6 prefix to be advertized + + + + + + + + + Prefix can not be used for stateless address auto-configuration + + + + + + Prefix can not be used for on-link determination + + + + + + Time in seconds that the prefix will remain preferred (default 4 hours) + + infinity + + + 0-4294967295 + Time in seconds that the prefix will remain preferred + + + infinity + Prefix will remain preferred forever + + + + (infinity) + + + + + + Time in seconds that the prefix will remain valid (default: 30 days) + + infinity + + + 1-4294967295 + Time in seconds that the prefix will remain valid + + + infinity + Prefix will remain preferred forever + + + + (infinity) + + + + + + + + Time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation + + 1-3600000 + Reachable Time value in RAs (in milliseconds) + + + 0 + Reachable Time unspecified by this router + + + + + Reachable time must be 0 or between 1 and 3600000 milliseconds + + + + + Time in milliseconds between retransmitted Neighbor Solicitation messages + + 1-4294967295 + Minimum interval in milliseconds + + + 0 + Time, in milliseconds, between retransmitted Neighbor Solicitation messages + + + + + Retransmit interval must be 0 or between 1 and 4294967295 milliseconds + + + + + Do not send router adverts + + + + + + + + + + diff --git a/src/conf_mode/service-router-advert.py b/src/conf_mode/service-router-advert.py deleted file mode 100755 index 620f3eacf..000000000 --- a/src/conf_mode/service-router-advert.py +++ /dev/null @@ -1,169 +0,0 @@ -#!/usr/bin/env python3 -# -# Copyright (C) 2018-2019 VyOS maintainers and contributors -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -import os - -from stat import S_IRUSR, S_IWUSR, S_IRGRP -from sys import exit - -from vyos.config import Config -from vyos import ConfigError -from vyos.util import call -from vyos.template import render - - -config_file = r'/etc/radvd.conf' - -default_config_data = { - 'interfaces': [] -} - -def get_config(): - rtradv = default_config_data - conf = Config() - base_level = ['service', 'router-advert'] - - if not conf.exists(base_level): - return rtradv - - for interface in conf.list_nodes(base_level + ['interface']): - intf = { - 'name': interface, - 'hop_limit' : '64', - 'default_lifetime': '', - 'default_preference': 'medium', - 'dnssl': [], - 'link_mtu': '', - 'managed_flag': 'off', - 'interval_max': '600', - 'interval_min': '', - 'name_server': [], - 'other_config_flag': 'off', - 'prefixes' : [], - 'reachable_time': '0', - 'retrans_timer': '0', - 'send_advert': 'on' - } - - # set config level first to reduce boilerplate code - conf.set_level(base_level + ['interface', interface]) - - if conf.exists(['hop-limit']): - intf['hop_limit'] = conf.return_value(['hop-limit']) - - if conf.exists(['default-lifetim']): - intf['default_lifetime'] = conf.return_value(['default-lifetim']) - - if conf.exists(['default-preference']): - intf['default_preference'] = conf.return_value(['default-preference']) - - if conf.exists(['dnssl']): - intf['dnssl'] = conf.return_values(['dnssl']) - - if conf.exists(['link-mtu']): - intf['link_mtu'] = conf.return_value(['link-mtu']) - - if conf.exists(['managed-flag']): - intf['managed_flag'] = 'on' - - if conf.exists(['interval', 'max']): - intf['interval_max'] = conf.return_value(['interval', 'max']) - - if conf.exists(['interval', 'min']): - intf['interval_min'] = conf.return_value(['interval', 'min']) - - if conf.exists(['name-server']): - intf['name_server'] = conf.return_values(['name-server']) - - if conf.exists(['other-config-flag']): - intf['other_config_flag'] = 'on' - - if conf.exists(['reachable-time']): - intf['reachable_time'] = conf.return_value(['reachable-time']) - - if conf.exists(['retrans-timer']): - intf['retrans_timer'] = conf.return_value(['retrans-timer']) - - if conf.exists(['no-send-advert']): - intf['send_advert'] = 'off' - - for prefix in conf.list_nodes(['prefix']): - tmp = { - 'prefix' : prefix, - 'autonomous_flag' : 'on', - 'on_link' : 'on', - 'preferred_lifetime': '14400', - 'valid_lifetime' : '2592000' - - } - - # set config level first to reduce boilerplate code - conf.set_level(base_level + ['interface', interface, 'prefix', prefix]) - - if conf.exists(['no-autonomous-flag']): - tmp['autonomous_flag'] = 'off' - - if conf.exists(['no-on-link-flag']): - tmp['on_link'] = 'off' - - if conf.exists(['preferred-lifetime']): - tmp['preferred_lifetime'] = conf.return_value(['preferred-lifetime']) - - if conf.exists(['valid-lifetime']): - tmp['valid_lifetime'] = conf.return_value(['valid-lifetime']) - - intf['prefixes'].append(tmp) - - rtradv['interfaces'].append(intf) - - return rtradv - -def verify(rtradv): - return None - -def generate(rtradv): - if not rtradv['interfaces']: - return None - - render(config_file, 'router-advert/radvd.conf.tmpl', rtradv, trim_blocks=True) - - # adjust file permissions of new configuration file - if os.path.exists(config_file): - os.chmod(config_file, S_IRUSR | S_IWUSR | S_IRGRP) - - return None - -def apply(rtradv): - if not rtradv['interfaces']: - # bail out early - looks like removal from running config - call('systemctl stop radvd.service') - if os.path.exists(config_file): - os.unlink(config_file) - - return None - - call('systemctl restart radvd.service') - return None - -if __name__ == '__main__': - try: - c = get_config() - verify(c) - generate(c) - apply(c) - except ConfigError as e: - print(e) - exit(1) diff --git a/src/conf_mode/service_router-advert.py b/src/conf_mode/service_router-advert.py new file mode 100755 index 000000000..620f3eacf --- /dev/null +++ b/src/conf_mode/service_router-advert.py @@ -0,0 +1,169 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018-2019 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os + +from stat import S_IRUSR, S_IWUSR, S_IRGRP +from sys import exit + +from vyos.config import Config +from vyos import ConfigError +from vyos.util import call +from vyos.template import render + + +config_file = r'/etc/radvd.conf' + +default_config_data = { + 'interfaces': [] +} + +def get_config(): + rtradv = default_config_data + conf = Config() + base_level = ['service', 'router-advert'] + + if not conf.exists(base_level): + return rtradv + + for interface in conf.list_nodes(base_level + ['interface']): + intf = { + 'name': interface, + 'hop_limit' : '64', + 'default_lifetime': '', + 'default_preference': 'medium', + 'dnssl': [], + 'link_mtu': '', + 'managed_flag': 'off', + 'interval_max': '600', + 'interval_min': '', + 'name_server': [], + 'other_config_flag': 'off', + 'prefixes' : [], + 'reachable_time': '0', + 'retrans_timer': '0', + 'send_advert': 'on' + } + + # set config level first to reduce boilerplate code + conf.set_level(base_level + ['interface', interface]) + + if conf.exists(['hop-limit']): + intf['hop_limit'] = conf.return_value(['hop-limit']) + + if conf.exists(['default-lifetim']): + intf['default_lifetime'] = conf.return_value(['default-lifetim']) + + if conf.exists(['default-preference']): + intf['default_preference'] = conf.return_value(['default-preference']) + + if conf.exists(['dnssl']): + intf['dnssl'] = conf.return_values(['dnssl']) + + if conf.exists(['link-mtu']): + intf['link_mtu'] = conf.return_value(['link-mtu']) + + if conf.exists(['managed-flag']): + intf['managed_flag'] = 'on' + + if conf.exists(['interval', 'max']): + intf['interval_max'] = conf.return_value(['interval', 'max']) + + if conf.exists(['interval', 'min']): + intf['interval_min'] = conf.return_value(['interval', 'min']) + + if conf.exists(['name-server']): + intf['name_server'] = conf.return_values(['name-server']) + + if conf.exists(['other-config-flag']): + intf['other_config_flag'] = 'on' + + if conf.exists(['reachable-time']): + intf['reachable_time'] = conf.return_value(['reachable-time']) + + if conf.exists(['retrans-timer']): + intf['retrans_timer'] = conf.return_value(['retrans-timer']) + + if conf.exists(['no-send-advert']): + intf['send_advert'] = 'off' + + for prefix in conf.list_nodes(['prefix']): + tmp = { + 'prefix' : prefix, + 'autonomous_flag' : 'on', + 'on_link' : 'on', + 'preferred_lifetime': '14400', + 'valid_lifetime' : '2592000' + + } + + # set config level first to reduce boilerplate code + conf.set_level(base_level + ['interface', interface, 'prefix', prefix]) + + if conf.exists(['no-autonomous-flag']): + tmp['autonomous_flag'] = 'off' + + if conf.exists(['no-on-link-flag']): + tmp['on_link'] = 'off' + + if conf.exists(['preferred-lifetime']): + tmp['preferred_lifetime'] = conf.return_value(['preferred-lifetime']) + + if conf.exists(['valid-lifetime']): + tmp['valid_lifetime'] = conf.return_value(['valid-lifetime']) + + intf['prefixes'].append(tmp) + + rtradv['interfaces'].append(intf) + + return rtradv + +def verify(rtradv): + return None + +def generate(rtradv): + if not rtradv['interfaces']: + return None + + render(config_file, 'router-advert/radvd.conf.tmpl', rtradv, trim_blocks=True) + + # adjust file permissions of new configuration file + if os.path.exists(config_file): + os.chmod(config_file, S_IRUSR | S_IWUSR | S_IRGRP) + + return None + +def apply(rtradv): + if not rtradv['interfaces']: + # bail out early - looks like removal from running config + call('systemctl stop radvd.service') + if os.path.exists(config_file): + os.unlink(config_file) + + return None + + call('systemctl restart radvd.service') + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + exit(1) -- cgit v1.2.3 From e9a2c4b96edc52ea114451ece6884845ad18ba6f Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 18 Apr 2020 17:56:19 +0200 Subject: ipoe-server: T2324: remove boilerplate code and adjust to other accel implementations --- data/templates/accel-ppp/pppoe.config.tmpl | 46 ++- data/templates/ipoe-server/chap-secrets.tmpl | 18 +- data/templates/ipoe-server/ipoe.config.tmpl | 109 +++--- interface-definitions/service_ipoe-server.xml.in | 6 + python/vyos/util.py | 6 + src/conf_mode/service_ipoe-server.py | 403 ++++++++++++----------- src/conf_mode/service_pppoe-server.py | 1 + 7 files changed, 299 insertions(+), 290 deletions(-) (limited to 'interface-definitions') diff --git a/data/templates/accel-ppp/pppoe.config.tmpl b/data/templates/accel-ppp/pppoe.config.tmpl index 325b75adc..39a20c1ca 100644 --- a/data/templates/accel-ppp/pppoe.config.tmpl +++ b/data/templates/accel-ppp/pppoe.config.tmpl @@ -88,37 +88,35 @@ wins{{ loop.index }}={{ server }} {% if auth_mode == 'local' %} [chap-secrets] chap-secrets={{ chap_secrets_file }} -{% elif auth_mode == 'radius' %} +{% endif %} + +{% if auth_mode == 'radius' %} [radius] verbose=1 -{% for r in radius_server %} -server={{ r.server }},{{ r.key }},auth-port={{ r.port }},req-limit=0,fail-time={{ r.fail_time }} -{% endfor -%} - -acct-timeout={{ radius_acct_tmo }} -timeout={{ radius_timeout }} -max-try={{ radius_max_try }} -{% if radius_nas_id %} -nas-identifier={{ radius_nas_id }} +{% for srv in auth['radius'] %} +server={{srv}},{{auth['radius'][srv]['secret']}}, +req-limit={{auth['radius'][srv]['req-limit']}}, +fail-time={{auth['radius'][srv]['fail-time']}} +{% endfor %} +{% if auth['radsettings']['dae-server']['ip-address'] %} +dae-server={{auth['radsettings']['dae-server']['ip-address']}}: +{{auth['radsettings']['dae-server']['port']}}, +{{auth['radsettings']['dae-server']['secret']}} {% endif -%} -{% if radius_nas_ip %} -nas-ip-address={{ radius_nas_ip }} +{% if auth['radsettings']['acct-timeout'] %} +acct-timeout={{auth['radsettings']['acct-timeout']}} {% endif -%} -{% if radius_source_address %} -bind={{ radius_source_address }} +{% if auth['radsettings']['max-try'] %} +max-try={{auth['radsettings']['max-try']}} {% endif -%} - -{% if radius_dynamic_author %} -dae-server={{ radius_dynamic_author.server }}:{{ radius_dynamic_author.port }},{{ radius_dynamic_author.key }} +{% if auth['radsettings']['timeout'] %} +timeout={{auth['radsettings']['timeout']}} {% endif -%} - -{% if radius_shaper_attr %} -[shaper] -verbose=1 -attr={{ radius_shaper_attr }} -{% if radius_shaper_vendor %} -vendor={{ radius_shaper_vendor }} +{% if auth['radsettings']['nas-ip-address'] %} +nas-ip-address={{auth['radsettings']['nas-ip-address']}} {% endif -%} +{% if auth['radsettings']['nas-identifier'] %} +nas-identifier={{auth['radsettings']['nas-identifier']}} {% endif -%} {% endif %} diff --git a/data/templates/ipoe-server/chap-secrets.tmpl b/data/templates/ipoe-server/chap-secrets.tmpl index 5e35d5775..a7d899354 100644 --- a/data/templates/ipoe-server/chap-secrets.tmpl +++ b/data/templates/ipoe-server/chap-secrets.tmpl @@ -1,17 +1,17 @@ # username server password acceptable local IP addresses shaper -{% for aifc in auth['auth_if'] -%} -{% for mac in auth['auth_if'][aifc] -%} -{% if (auth['auth_if'][aifc][mac]['up']) and (auth['auth_if'][aifc][mac]['down']) -%} -{% if auth['auth_if'][aifc][mac]['vlan'] -%} -{{aifc}}.{{auth['auth_if'][aifc][mac]['vlan']}} * {{mac.lower()}} * {{auth['auth_if'][aifc][mac]['down']}}/{{auth['auth_if'][aifc][mac]['up']}} +{% for interface in auth_interfaces -%} +{% for mac in interface.mac -%} +{% if mac.rate_upload and mac.rate_download -%} +{% if mac.vlan_id -%} +{{ interface.name }}.{{ mac.vlan_id }} * {{ mac.address | lower }} * {{ mac.rate_download }}/{{ mac.rate_upload }} {% else -%} -{{aifc}} * {{mac.lower()}} * {{auth['auth_if'][aifc][mac]['down']}}/{{auth['auth_if'][aifc][mac]['up']}} +{{ interface.name }} * {{ mac.address | lower }} * {{ mac.rate_download }}/{{ mac.rate_upload }} {% endif -%} {% else -%} -{% if auth['auth_if'][aifc][mac]['vlan'] %} -{{aifc}}.{{auth['auth_if'][aifc][mac]['vlan']}} * {{mac.lower()}} * +{% if mac.vlan_id -%} +{{ interface.name }}.{{ mac.vlan_id }} * {{ mac.address | lower }} * {% else -%} -{{aifc}} * {{mac.lower()}} * +{{ interface.name }} * {{ mac.address | lower }} * {% endif -%} {% endif -%} {% endfor -%} diff --git a/data/templates/ipoe-server/ipoe.config.tmpl b/data/templates/ipoe-server/ipoe.config.tmpl index 0a5ee09a6..1f34b67c8 100644 --- a/data/templates/ipoe-server/ipoe.config.tmpl +++ b/data/templates/ipoe-server/ipoe.config.tmpl @@ -6,16 +6,15 @@ shaper ipv6pool ipv6_nd ipv6_dhcp -{% if auth['mech'] == 'radius' %} -radius -{% endif -%} ippool -{% if auth['mech'] == 'local' %} +{% if auth_mode == 'radius' %} +radius +{% elif auth_mode == 'local' %} chap-secrets {% endif %} [core] -thread-count={{thread_cnt}} +thread-count={{ thread_cnt }} [log] syslog=accel-ipoe,daemon @@ -24,39 +23,35 @@ level=5 [ipoe] verbose=1 -{% for intfc in interfaces %} -{% if interfaces[intfc]['vlan_mon'] %} -interface=re:{{intfc}}\.\d+,{% else %}interface={{intfc}},{% endif %}shared={{interfaces[intfc]['shared']}},mode={{interfaces[intfc]['mode']}},ifcfg={{interfaces[intfc]['ifcfg']}},range={{interfaces[intfc]['range']}},start={{interfaces[intfc]['sess_start']}},ipv6=1 +{% for interface in interfaces %} +{% if interface.vlan_mon %} +interface=re:{{ interface.name }}\.\d+,{% else %}interface={{ interface }},{% endif %}shared={{ interface.shared }},mode={{ interface.mode }},ifcfg={{ interface.ifcfg }},range={{ interface.range }},start={{ interface.sess_start }},ipv6=1 {% endfor %} -{% if auth['mech'] == 'noauth' %} +{% if auth_mode == 'noauth' %} noauth=1 -{% endif %} -{% if auth['mech'] == 'local' %} +{% elif auth_mode == 'local' %} username=ifname password=csid {% endif %} -{%- for intfc in interfaces %} -{% if (interfaces[intfc]['shared'] == '0') and (interfaces[intfc]['vlan_mon']) %} -vlan-mon={{intfc}},{{interfaces[intfc]['vlan_mon']|join(',')}} +{%- for interface in interfaces %} +{% if (interface.shared == '0') and (interface.vlan_mon) %} +vlan-mon={{ interface.name }},{{ interface.vlan_mon | join(',') }} {% endif %} {% endfor %} -{% if (dns['server1']) or (dns['server2']) %} +{% if dnsv4 %} [dns] -{% if dns['server1'] %} -dns1={{dns['server1']}} -{% endif -%} -{% if dns['server2'] %} -dns2={{dns['server2']}} -{% endif -%} -{% endif -%} +{% for dns in dnsv4 -%} +dns{{ loop.index }}={{ dns }} +{% endfor -%} +{% endif %} -{% if (dnsv6['server1']) or (dnsv6['server2']) or (dnsv6['server3']) %} -[dnsv6] -dns={{dnsv6['server1']}} -dns={{dnsv6['server2']}} -dns={{dnsv6['server3']}} +{% if dnsv6 %} +[ipv6-dns] +{% for dns in dnsv6 -%} +{{ dns }} +{% endfor -%} {% endif %} [ipv6-nd] @@ -65,48 +60,50 @@ verbose=1 [ipv6-dhcp] verbose=1 -{% if ipv6['prfx'] %} +{% if client_ipv6_pool %} [ipv6-pool] -{% for prfx in ipv6['prfx'] %} -{{prfx}} +{% for p in client_ipv6_pool %} +{{ p }} {% endfor %} -{% for pd in ipv6['pd'] %} -delegate={{pd}} +{% for pd in client_ipv6_delegate_prefix %} +delegate={{ pd }} {% endfor %} {% endif %} -{% if auth['mech'] == 'local' %} +{% if auth_mode == 'local' %} [chap-secrets] -chap-secrets={{chap_secrets_file}} -{% endif %} - -{% if auth['mech'] == 'radius' %} +chap-secrets={{ chap_secrets_file }} +{% elif auth_mode == 'radius' %} [radius] verbose=1 -{% for srv in auth['radius'] %} -server={{srv}},{{auth['radius'][srv]['secret']}}, -req-limit={{auth['radius'][srv]['req-limit']}}, -fail-time={{auth['radius'][srv]['fail-time']}} -{% endfor %} -{% if auth['radsettings']['dae-server']['ip-address'] %} -dae-server={{auth['radsettings']['dae-server']['ip-address']}}: -{{auth['radsettings']['dae-server']['port']}}, -{{auth['radsettings']['dae-server']['secret']}} +{% for r in radius_server %} +server={{ r.server }},{{ r.key }},auth-port={{ r.port }},req-limit=0,fail-time={{ r.fail_time }} +{% endfor -%} + +acct-timeout={{ radius_acct_tmo }} +timeout={{ radius_timeout }} +max-try={{ radius_max_try }} +{% if radius_nas_id %} +nas-identifier={{ radius_nas_id }} {% endif -%} -{% if auth['radsettings']['acct-timeout'] %} -acct-timeout={{auth['radsettings']['acct-timeout']}} +{% if radius_nas_ip %} +nas-ip-address={{ radius_nas_ip }} {% endif -%} -{% if auth['radsettings']['max-try'] %} -max-try={{auth['radsettings']['max-try']}} +{% if radius_source_address %} +bind={{ radius_source_address }} {% endif -%} -{% if auth['radsettings']['timeout'] %} -timeout={{auth['radsettings']['timeout']}} + +{% if radius_dynamic_author %} +dae-server={{ radius_dynamic_author.server }}:{{ radius_dynamic_author.port }},{{ radius_dynamic_author.key }} {% endif -%} -{% if auth['radsettings']['nas-ip-address'] %} -nas-ip-address={{auth['radsettings']['nas-ip-address']}} + +{% if radius_shaper_attr %} +[shaper] +verbose=1 +attr={{ radius_shaper_attr }} +{% if radius_shaper_vendor %} +vendor={{ radius_shaper_vendor }} {% endif -%} -{% if auth['radsettings']['nas-identifier'] %} -nas-identifier={{auth['radsettings']['nas-identifier']}} {% endif -%} {% endif %} diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in index 4033b56d6..3948627d7 100644 --- a/interface-definitions/service_ipoe-server.xml.in +++ b/interface-definitions/service_ipoe-server.xml.in @@ -292,6 +292,12 @@ If server does not respond, mark it unavailable for this time (seconds) + + + Temporary disable this server + + + diff --git a/python/vyos/util.py b/python/vyos/util.py index eb78c4a26..c70bff091 100644 --- a/python/vyos/util.py +++ b/python/vyos/util.py @@ -447,3 +447,9 @@ def is_bridge_member(interface): return False, None +def get_half_cpus(): + """ return 1/2 of the numbers of available CPUs """ + cpu = os.cpu_count() + if cpu > 1: + cpu /= 2 + return int(cpu) diff --git a/src/conf_mode/service_ipoe-server.py b/src/conf_mode/service_ipoe-server.py index 76aa80a10..e0a607629 100755 --- a/src/conf_mode/service_ipoe-server.py +++ b/src/conf_mode/service_ipoe-server.py @@ -17,174 +17,227 @@ import os import re +from copy import deepcopy +from stat import S_IRUSR, S_IWUSR, S_IRGRP from sys import exit -from time import sleep -from stat import S_IRUSR, S_IWUSR, S_IRGRP from vyos.config import Config from vyos import ConfigError -from vyos.util import call +from vyos.util import call, get_half_cpus from vyos.template import render - ipoe_conf = '/run/accel-pppd/ipoe.conf' ipoe_chap_secrets = '/run/accel-pppd/ipoe.chap-secrets' - -def _get_cpu(): - cpu_cnt = 1 - if os.cpu_count() == 1: - cpu_cnt = 1 - else: - cpu_cnt = int(os.cpu_count()/2) - return cpu_cnt - +default_config_data = { + 'auth_mode': 'local', + 'auth_interfaces': [], + 'chap_secrets_file': ipoe_chap_secrets, # used in Jinja2 template + 'interfaces': [], + 'dnsv4': [], + 'dnsv6': [], + 'client_ipv6_pool': [], + 'client_ipv6_delegate_prefix': [], + 'radius_server': [], + 'radius_acct_tmo': '3', + 'radius_max_try': '3', + 'radius_timeout': '3', + 'radius_nas_id': '', + 'radius_nas_ip': '', + 'radius_source_address': '', + 'radius_shaper_attr': '', + 'radius_shaper_vendor': '', + 'radius_dynamic_author': '', + 'thread_cnt': get_half_cpus() +} def get_config(): - c = Config() - if not c.exists(['service', 'ipoe-server']): + conf = Config() + base_path = ['service', 'ipoe-server'] + if not conf.exists(base_path): return None - config_data = { - 'chap_secrets_file' : ipoe_chap_secrets - } + conf.set_level(base_path) + ipoe = deepcopy(default_config_data) - c.set_level(['service', 'ipoe-server']) - config_data['interfaces'] = {} - for intfc in c.list_nodes(['interface']): - config_data['interfaces'][intfc] = { + for interface in conf.list_nodes(['interface']): + tmp = { 'mode': 'L2', + 'name': interface, 'shared': '1', - # may need a conifg option, can be dhcpv4 or up for unclassified pkts + # may need a config option, can be dhcpv4 or up for unclassified pkts 'sess_start': 'dhcpv4', 'range': None, 'ifcfg': '1', 'vlan_mon': [] } - config_data['dns'] = { - 'server1': None, - 'server2': None - } - config_data['dnsv6'] = { - 'server1': None, - 'server2': None, - 'server3': None - } - config_data['ipv6'] = { - 'prfx': [], - 'pd': [], - } - config_data['auth'] = { - 'auth_if': {}, - 'mech': 'noauth', - 'radius': {}, - 'radsettings': { - 'dae-server': {} + + conf.set_level(base_path + ['interface', interface]) + + if conf.exists(['network-mode']): + tmp['mode'] = conf.return_value(['network-mode']) + + if conf.exists(['network']): + mode = conf.return_value(['network']) + if mode == 'vlan': + tmp['shared'] = '0' + + if conf.exists(['vlan-id']): + tmp['vlan_mon'] += conf.return_values(['vlan-id']) + + if conf.exists(['vlan-range']): + tmp['vlan_mon'] += conf.return_values(['vlan-range']) + + if conf.exists(['client-subnet']): + tmp['range'] = conf.return_value(['client-subnet']) + + ipoe['interfaces'].append(tmp) + + conf.set_level(base_path) + for server in ['server-1', 'server-2']: + if conf.exists(['dns-server', server]): + tmp = conf.return_value(['dns-server', server]) + ipoe['dnsv4'].append(tmp) + + for server in ['server-1', 'server-2', 'server-3']: + if conf.exists(['dnsv6-server', server]): + tmp = conf.return_value(['dnsv6-server', server]) + ipoe['dnsv6'].append(tmp) + + if conf.exists(['authentication', 'mode']): + ipoe['auth_mode'] = conf.return_value(['authentication', 'mode']) + + if conf.exists(['authentication', 'interface']): + for interface in conf.list_nodes(['authentication', 'interface']): + tmp = { + 'name': interface, + 'mac': [] + } + for client in conf.list_nodes(base_path + ['authentication', 'interface', interface, 'mac-address']): + mac = { + 'address': mac, + 'rate_download': '', + 'rate_upload': '', + 'vlan_id': '' + } + conf.set_level(base_path + ['authentication', 'interface', interface, 'mac-address', client]) + + if conf.exists(['rate-limit', 'download']): + mac['rate_download'] = conf.return_value(['rate-limit', 'download']) + + if conf.exists(['rate-limit', 'upload']): + mac['rate_upload'] = conf.return_value(['rate-limit', 'upload']) + + if conf.exists(['vlan-id']): + mac['vlan'] = conf.return_value(['vlan-id']) + + tmp['mac'].append(mac) + + ipoe['auth_interfaces'].append(tmp) + + # + # authentication mode radius servers and settings + if conf.exists(['authentication', 'mode', 'radius']): + for server in conf.list_nodes(['authentication', 'radius-server']): + radius = { + 'server' : server, + 'key' : '', + 'fail_time' : 0, + 'port' : '1812' } + + conf.set_level(base_path + ['authentication', 'radius-server', server]) + + if conf.exists(['fail-time']): + radius['fail-time'] = conf.return_value(['fail-time']) + + if conf.exists(['port']): + radius['port'] = conf.return_value(['port']) + + if conf.exists(['key']): + radius['key'] = conf.return_value(['key']) + + if not conf.exists(['disable']): + ipoe['radius_server'].append(radius) + + # + # advanced radius-setting + conf.set_level(base_path + ['authentication', 'radius-settings']) + if conf.exists(['acct-timeout']): + ipoe['radius_acct_tmo'] = conf.return_value(['acct-timeout']) + + if conf.exists(['max-try']): + ipoe['radius_max_try'] = conf.return_value(['max-try']) + + if conf.exists(['timeout']): + ipoe['radius_timeout'] = conf.return_value(['timeout']) + + if conf.exists(['nas-identifier']): + ipoe['radius_nas_id'] = conf.return_value(['nas-identifier']) + + if conf.exists(['nas-ip-address']): + ipoe['radius_nas_ip'] = conf.return_value(['nas-ip-address']) + + if conf.exists(['source-address']): + ipoe['radius_source_address'] = conf.return_value(['source-address']) + + # Dynamic Authorization Extensions (DOA)/Change Of Authentication (COA) + if conf.exists(['dynamic-author']): + dae = { + 'port' : '', + 'server' : '', + 'key' : '' } - if c.exists(['interface', intfc, 'network-mode']): - config_data['interfaces'][intfc]['mode'] = c.return_value( - ['interface', intfc, 'network-mode']) - if c.return_value(['interface', intfc, 'network']) == 'vlan': - config_data['interfaces'][intfc]['shared'] = '0' - if c.exists(['interface', intfc, 'vlan-id']): - config_data['interfaces'][intfc]['vlan_mon'] += c.return_values( - ['interface', intfc, 'vlan-id']) - if c.exists(['interface', intfc, 'vlan-range']): - config_data['interfaces'][intfc]['vlan_mon'] += c.return_values( - ['interface', intfc, 'vlan-range']) - if c.exists(['interface', intfc, 'client-subnet']): - config_data['interfaces'][intfc]['range'] = c.return_value( - ['interface', intfc, 'client-subnet']) - if c.exists(['dns-server', 'server-1']): - config_data['dns']['server1'] = c.return_value( - ['dns-server', 'server-1']) - if c.exists(['dns-server', 'server-2']): - config_data['dns']['server2'] = c.return_value( - ['dns-server', 'server-2']) - if c.exists(['dnsv6-server', 'server-1']): - config_data['dnsv6']['server1'] = c.return_value( - ['dnsv6-server', 'server-1']) - if c.exists(['dnsv6-server', 'server-2']): - config_data['dnsv6']['server2'] = c.return_value( - ['dnsv6-server', 'server-2']) - if c.exists(['dnsv6-server', 'server-3']): - config_data['dnsv6']['server3'] = c.return_value( - ['dnsv6-server', 'server-3']) - if not c.exists(['authentication', 'mode', 'noauth']): - config_data['auth']['mech'] = c.return_value( - ['authentication', 'mode']) - if c.exists(['authentication', 'mode', 'local']): - for auth_int in c.list_nodes(['authentication', 'interface']): - for mac in c.list_nodes(['authentication', 'interface', auth_int, 'mac-address']): - config_data['auth']['auth_if'][auth_int] = {} - if c.exists(['authentication', 'interface', auth_int, 'mac-address', mac, 'rate-limit']): - config_data['auth']['auth_if'][auth_int][mac] = {} - config_data['auth']['auth_if'][auth_int][mac]['up'] = c.return_value( - ['authentication', 'interface', auth_int, 'mac-address', mac, 'rate-limit upload']) - config_data['auth']['auth_if'][auth_int][mac]['down'] = c.return_value( - ['authentication', 'interface', auth_int, 'mac-address', 'mac', 'rate-limit download']) - else: - config_data['auth']['auth_if'][auth_int][mac] = {} - config_data['auth']['auth_if'][auth_int][mac]['up'] = None - config_data['auth']['auth_if'][auth_int][mac]['down'] = None - # client vlan-id - if c.exists(['authentication', 'interface', auth_int, 'mac-address', mac, 'vlan-id']): - config_data['auth']['auth_if'][auth_int][mac]['vlan'] = c.return_value( - ['authentication', 'interface', auth_int, 'mac-address', mac, 'vlan-id']) - if c.exists(['authentication', 'mode', 'radius']): - for rsrv in c.list_nodes(['authentication', 'radius-server']): - config_data['auth']['radius'][rsrv] = {} - if c.exists(['authentication', 'radius-server', rsrv, 'secret']): - config_data['auth']['radius'][rsrv]['secret'] = c.return_value( - ['authentication', 'radius-server', rsrv, 'secret']) - else: - config_data['auth']['radius'][rsrv]['secret'] = None - if c.exists(['authentication', 'radius-server', rsrv, 'fail-time']): - config_data['auth']['radius'][rsrv]['fail-time'] = c.return_value( - ['authentication', 'radius-server', rsrv, 'fail-time']) - else: - config_data['auth']['radius'][rsrv]['fail-time'] = '0' - if c.exists(['authentication', 'radius-server', rsrv, 'req-limit']): - config_data['auth']['radius'][rsrv]['req-limit'] = c.return_value( - ['authentication', 'radius-server', rsrv, 'req-limit']) - else: - config_data['auth']['radius'][rsrv]['req-limit'] = '0' - if c.exists(['authentication', 'radius-settings']): - if c.exists(['authentication', 'radius-settings', 'timeout']): - config_data['auth']['radsettings']['timeout'] = c.return_value( - ['authentication', 'radius-settings', 'timeout']) - if c.exists(['authentication', 'radius-settings', 'nas-ip-address']): - config_data['auth']['radsettings']['nas-ip-address'] = c.return_value( - ['authentication', 'radius-settings', 'nas-ip-address']) - if c.exists(['authentication', 'radius-settings', 'nas-identifier']): - config_data['auth']['radsettings']['nas-identifier'] = c.return_value( - ['authentication', 'radius-settings', 'nas-identifier']) - if c.exists(['authentication', 'radius-settings', 'max-try']): - config_data['auth']['radsettings']['max-try'] = c.return_value( - ['authentication', 'radius-settings', 'max-try']) - if c.exists(['authentication', 'radius-settings', 'acct-timeout']): - config_data['auth']['radsettings']['acct-timeout'] = c.return_value( - ['authentication', 'radius-settings', 'acct-timeout']) - if c.exists(['authentication', 'radius-settings', 'dae-server', 'ip-address']): - config_data['auth']['radsettings']['dae-server']['ip-address'] = c.return_value( - ['authentication', 'radius-settings', 'dae-server', 'ip-address']) - if c.exists(['authentication', 'radius-settings', 'dae-server', 'port']): - config_data['auth']['radsettings']['dae-server']['port'] = c.return_value( - ['authentication', 'radius-settings', 'dae-server', 'port']) - if c.exists(['authentication', 'radius-settings', 'dae-server', 'secret']): - config_data['auth']['radsettings']['dae-server']['secret'] = c.return_value( - ['authentication', 'radius-settings', 'dae-server', 'secret']) - - if c.exists(['client-ipv6-pool', 'prefix']): - config_data['ipv6']['prfx'] = c.return_values( - ['client-ipv6-pool', 'prefix']) - if c.exists(['client-ipv6-pool', 'delegate-prefix']): - config_data['ipv6']['pd'] = c.return_values( - ['client-ipv6-pool', 'delegate-prefix']) - - return config_data + if conf.exists(['dynamic-author', 'ip-address']): + dae['server'] = conf.return_value(['dynamic-author', 'ip-address']) + + if conf.exists(['dynamic-author', 'port']): + dae['port'] = conf.return_value(['dynamic-author', 'port']) + + if conf.exists(['dynamic-author', 'secret']): + dae['key'] = conf.return_value(['dynamic-author', 'secret']) + + ipoe['radius_dynamic_author'] = dae + + + conf.set_level(base_path) + if conf.exists(['client-ipv6-pool', 'prefix']): + ipoe['client_ipv6_pool'] = conf.return_values(['client-ipv6-pool', 'prefix']) + + if conf.exists(['client-ipv6-pool', 'delegate-prefix']): + ipoe['client_ipv6_delegate_prefix'] = conf.return_values(['client-ipv6-pool', 'delegate-prefix']) + + return ipoe + + +def verify(ipoe): + if not ipoe: + return None + + import pprint + pprint.pprint(ipoe) + + if not ipoe['interfaces']: + raise ConfigError('No IPoE interface configured') + + for interface in ipoe['interfaces']: + if not interface['range']: + raise ConfigError(f'No IPoE client subnet defined on interface "{{ interface }}"') + + if ipoe['auth_mode'] == 'radius': + if len(ipoe['radius_server']) == 0: + raise ConfigError('RADIUS authentication requires at least one server') + + for radius in ipoe['radius_server']: + if not radius['key']: + server = radius['server'] + raise ConfigError(f'Missing RADIUS secret key for server "{{ server }}"') + + if ipoe['client_ipv6_delegate_prefix'] and not ipoe['client_ipv6_pool']: + raise ConfigError('IPoE IPv6 deletate-prefix requires IPv6 prefix to be configured!') + + return None def generate(ipoe): @@ -195,10 +248,9 @@ def generate(ipoe): if not os.path.exists(dirname): os.mkdir(dirname) - ipoe['thread_cnt'] = _get_cpu() render(ipoe_conf, 'ipoe-server/ipoe.config.tmpl', ipoe, trim_blocks=True) - if ipoe['auth']['mech'] == 'local': + if ipoe['auth_mode'] == 'local': render(ipoe_chap_secrets, 'ipoe-server/chap-secrets.tmpl', ipoe) os.chmod(ipoe_chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP) @@ -209,69 +261,18 @@ def generate(ipoe): return None -def verify(c): - if c == None or not c: - return None - - if not c['interfaces']: - raise ConfigError("service ipoe-server interface requires a value") - - for intfc in c['interfaces']: - if not c['interfaces'][intfc]['range']: - raise ConfigError("service ipoe-server interface " + - intfc + " client-subnet needs a value") - - if c['auth']['mech'] == 'radius': - if not c['auth']['radius']: - raise ConfigError( - "service ipoe-server authentication radius-server requires a value for authentication mode radius") - else: - for radsrv in c['auth']['radius']: - if not c['auth']['radius'][radsrv]['secret']: - raise ConfigError( - "service ipoe-server authentication radius-server " + radsrv + " secret requires a value") - - if c['auth']['radsettings']['dae-server']: - try: - if c['auth']['radsettings']['dae-server']['ip-address']: - pass - except: - raise ConfigError( - "service ipoe-server authentication radius-settings dae-server ip-address value required") - try: - if c['auth']['radsettings']['dae-server']['secret']: - pass - except: - raise ConfigError( - "service ipoe-server authentication radius-settings dae-server secret value required") - try: - if c['auth']['radsettings']['dae-server']['port']: - pass - except: - raise ConfigError( - "service ipoe-server authentication radius-settings dae-server port value required") - - if len(c['ipv6']['pd']) != 0 and len(c['ipv6']['prfx']) == 0: - raise ConfigError( - "service ipoe-server client-ipv6-pool prefix needs a value") - - return c - - def apply(ipoe): if ipoe == None: call('systemctl stop accel-ppp@ipoe.service') - - if os.path.exists(ipoe_conf): - os.unlink(ipoe_conf) - - if os.path.exists(ipoe_chap_secrets): - os.unlink(ipoe_chap_secrets) + for file in [ipoe_conf, ipoe_chap_secrets]: + if os.path.exists(file): + os.unlink(file) return None call('systemctl restart accel-ppp@ipoe.service') + raise ConfigError("faslkdjfhaslkjdfhklsjahdf") if __name__ == '__main__': try: diff --git a/src/conf_mode/service_pppoe-server.py b/src/conf_mode/service_pppoe-server.py index 13d0b1920..b791f1716 100755 --- a/src/conf_mode/service_pppoe-server.py +++ b/src/conf_mode/service_pppoe-server.py @@ -78,6 +78,7 @@ default_config_data = { 'radius_dynamic_author': '', 'sesscrtl': 'replace', 'snmp': False, + 'thread_cnt': '1' } def get_config(): -- cgit v1.2.3 From b81a37d19abfac0dbc1f49860dbe75a4f8caed61 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 18 Apr 2020 18:38:05 +0200 Subject: ipoe-server: T2324: migrate IPv4/IPv6 name-servers to common node --- interface-definitions/service_ipoe-server.xml.in | 68 ++++++------------------ src/conf_mode/service_ipoe-server.py | 30 +++++------ src/migration-scripts/ipoe-server/0-to-1 | 66 +++++++++++++++++++++++ 3 files changed, 97 insertions(+), 67 deletions(-) create mode 100755 src/migration-scripts/ipoe-server/0-to-1 (limited to 'interface-definitions') diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in index 3948627d7..f0651d53d 100644 --- a/interface-definitions/service_ipoe-server.xml.in +++ b/interface-definitions/service_ipoe-server.xml.in @@ -111,60 +111,24 @@ - + - DNS servers offered via internal DHCP + Domain Name Server (DNS) propagated to client + + ipv4 + Domain Name Server (DNS) IPv4 address + + + ipv6 + Domain Name Server (DNS) IPv6 address + + + + + + - - - - IP address of the primary DNS server - - - - - - - - IP address of the secondary DNS server - - - - - - - - - - DNSv6 servers offered via internal DHCPv6 - - - - - IP address of the primary DNS server - - - - - - - - IP address of the secondary DNS server - - - - - - - - IP address of the tertiary DNS server - - - - - - - + Pool of client IPv6 addresses diff --git a/src/conf_mode/service_ipoe-server.py b/src/conf_mode/service_ipoe-server.py index e0a607629..25c33cc6d 100755 --- a/src/conf_mode/service_ipoe-server.py +++ b/src/conf_mode/service_ipoe-server.py @@ -22,9 +22,10 @@ from stat import S_IRUSR, S_IWUSR, S_IRGRP from sys import exit from vyos.config import Config -from vyos import ConfigError -from vyos.util import call, get_half_cpus from vyos.template import render +from vyos.util import call, get_half_cpus +from vyos.validate import is_ipv4 +from vyos import ConfigError ipoe_conf = '/run/accel-pppd/ipoe.conf' ipoe_chap_secrets = '/run/accel-pppd/ipoe.chap-secrets' @@ -94,15 +95,13 @@ def get_config(): ipoe['interfaces'].append(tmp) conf.set_level(base_path) - for server in ['server-1', 'server-2']: - if conf.exists(['dns-server', server]): - tmp = conf.return_value(['dns-server', server]) - ipoe['dnsv4'].append(tmp) - for server in ['server-1', 'server-2', 'server-3']: - if conf.exists(['dnsv6-server', server]): - tmp = conf.return_value(['dnsv6-server', server]) - ipoe['dnsv6'].append(tmp) + if conf.exists(['name-server']): + for name_server in conf.return_values(['name-server']): + if is_ipv4(name_server): + ipoe['dnsv4'].append(name_server) + else: + ipoe['dnsv6'].append(name_server) if conf.exists(['authentication', 'mode']): ipoe['auth_mode'] = conf.return_value(['authentication', 'mode']) @@ -215,9 +214,6 @@ def verify(ipoe): if not ipoe: return None - import pprint - pprint.pprint(ipoe) - if not ipoe['interfaces']: raise ConfigError('No IPoE interface configured') @@ -225,6 +221,12 @@ def verify(ipoe): if not interface['range']: raise ConfigError(f'No IPoE client subnet defined on interface "{{ interface }}"') + if len(ipoe['dnsv4']) > 2: + raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') + + if len(ipoe['dnsv6']) > 3: + raise ConfigError('Not more then three IPv6 DNS name-servers can be configured') + if ipoe['auth_mode'] == 'radius': if len(ipoe['radius_server']) == 0: raise ConfigError('RADIUS authentication requires at least one server') @@ -272,8 +274,6 @@ def apply(ipoe): call('systemctl restart accel-ppp@ipoe.service') - raise ConfigError("faslkdjfhaslkjdfhklsjahdf") - if __name__ == '__main__': try: c = get_config() diff --git a/src/migration-scripts/ipoe-server/0-to-1 b/src/migration-scripts/ipoe-server/0-to-1 new file mode 100755 index 000000000..94addcbdb --- /dev/null +++ b/src/migration-scripts/ipoe-server/0-to-1 @@ -0,0 +1,66 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# - remove primary/secondary identifier from nameserver + +import os +import sys + +from sys import argv, exit +from vyos.configtree import ConfigTree + +if (len(argv) < 1): + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +config = ConfigTree(config_file) +base = ['service', 'ipoe-server'] +if not config.exists(base): + # Nothing to do + exit(0) +else: + + # Migrate IPv4 DNS servers + dns_base = base + ['dns-servers'] + if config.exists(dns_base): + for server in ['server-1', 'server-2']: + if config.exists(dns_base + [server]): + dns = config.return_value(dns_base + [server]) + config.set(base + ['name-server'], value=dns, replace=False) + + config.delete(dns_base) + + # Migrate IPv6 DNS servers + dns_base = base + ['dnsv6-servers'] + if config.exists(dns_base): + for server in ['server-1', 'server-2', 'server-3']: + if config.exists(dns_base + [server]): + dns = config.return_value(dns_base + [server]) + config.set(base + ['name-server'], value=dns, replace=False) + + config.delete(dns_base) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) -- cgit v1.2.3 From f07f46d36e17ea07b0db65e3856cc090033d9e78 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 18 Apr 2020 18:40:53 +0200 Subject: ipoe-server: T2324: migrate RADIUS configuration to common CLI syntax --- interface-definitions/service_ipoe-server.xml.in | 81 ++++++------------------ src/conf_mode/service_ipoe-server.py | 6 +- src/migration-scripts/ipoe-server/0-to-1 | 23 +++++++ 3 files changed, 45 insertions(+), 65 deletions(-) (limited to 'interface-definitions') diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in index f0651d53d..decd94060 100644 --- a/interface-definitions/service_ipoe-server.xml.in +++ b/interface-definitions/service_ipoe-server.xml.in @@ -232,43 +232,26 @@ - - - IP address of RADIUS server - - ipv4 - IP address of RADIUS server - - - - - - Key for accessing the specified server - - - - - Maximum number of simultaneous requests to server (default: unlimited) - - - - - If server does not respond, mark it unavailable for this time (seconds) - - - - - Temporary disable this server - - - - - - - - RADIUS settings - + #include + + + + + + Mark server unavailable for <n> seconds on failure + + 0-600 + Fail time penalty + + + + + Fail time must be between 0 and 600 seconds + + + + Timeout to wait response from server (seconds) @@ -289,18 +272,6 @@ Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests. - - - Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also DM/CoA server will bind to that address. - - ipv4 - IPv4 address of the DAE Server - - - - - - IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA) @@ -309,25 +280,11 @@ IP address for Dynamic Authorization Extension server (DM/CoA) - - ipv4 - IPv4 address of the DAE Server - - - - Port for Dynamic Authorization Extension server (DM/CoA) - - 1-65535 - port number - - - - diff --git a/src/conf_mode/service_ipoe-server.py b/src/conf_mode/service_ipoe-server.py index 25c33cc6d..958fbd561 100755 --- a/src/conf_mode/service_ipoe-server.py +++ b/src/conf_mode/service_ipoe-server.py @@ -137,7 +137,7 @@ def get_config(): # # authentication mode radius servers and settings if conf.exists(['authentication', 'mode', 'radius']): - for server in conf.list_nodes(['authentication', 'radius-server']): + for server in conf.list_nodes(['authentication', 'radius', 'server']): radius = { 'server' : server, 'key' : '', @@ -145,7 +145,7 @@ def get_config(): 'port' : '1812' } - conf.set_level(base_path + ['authentication', 'radius-server', server]) + conf.set_level(base_path + ['authentication', 'radius', 'server', server]) if conf.exists(['fail-time']): radius['fail-time'] = conf.return_value(['fail-time']) @@ -161,7 +161,7 @@ def get_config(): # # advanced radius-setting - conf.set_level(base_path + ['authentication', 'radius-settings']) + conf.set_level(base_path + ['authentication', 'radius']) if conf.exists(['acct-timeout']): ipoe['radius_acct_tmo'] = conf.return_value(['acct-timeout']) diff --git a/src/migration-scripts/ipoe-server/0-to-1 b/src/migration-scripts/ipoe-server/0-to-1 index 94addcbdb..c04a7fb19 100755 --- a/src/migration-scripts/ipoe-server/0-to-1 +++ b/src/migration-scripts/ipoe-server/0-to-1 @@ -15,6 +15,7 @@ # along with this program. If not, see . # - remove primary/secondary identifier from nameserver +# - Unifi RADIUS configuration by placing it all under "authentication radius" node import os import sys @@ -58,6 +59,28 @@ else: config.delete(dns_base) + # Migrate radius-settings node to RADIUS and use this as base for the + # later migration of the RADIUS servers - this will save a lot of code + radius_settings = base + ['authentication', 'radius-settings'] + if config.exists(radius_settings): + config.rename(radius_settings, 'radius') + + # Migrate RADIUS server + radius_server = base + ['authentication', 'radius-server'] + if config.exists(radius_server): + new_base = base + ['authentication', 'radius', 'server'] + config.set(new_base) + config.set_tag(new_base) + for server in config.list_nodes(radius_server): + old_base = radius_server + [server] + config.copy(old_base, new_base + [server]) + + # remove old req-limit node + if config.exists(new_base + [server, 'req-limit']): + config.delete(new_base + [server, 'req-limit']) + + config.delete(radius_server) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3