From f35cf88ec4c63ba8510bbccbbb60bacc16d02aa5 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 18:32:33 +0200 Subject: vpn: l2tp: T2264: rename files to match CLI levels --- interface-definitions/vpn-l2tp.xml.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'interface-definitions') diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 7fc844054..dcbb5f3ed 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -2,7 +2,7 @@ - + L2TP Virtual Private Network (VPN) -- cgit v1.2.3 From 6a2e75dbe4003c6987c6932296e68c486ff7b380 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:32:24 +0200 Subject: vpn: l2tp: T2264: combine IPv4/IPv6 name-server CLI syntax There is no reason to distinguish between an IPv4 and IPv6 name-server node on the CLI - this can be done in the underlaying Python scripts. --- data/templates/l2tp/l2tp.config.tmpl | 17 ++++------ interface-definitions/vpn-l2tp.xml.in | 46 ++++++------------------- src/conf_mode/vpn_l2tp.py | 29 +++++++++------- src/migration-scripts/l2tp/2-to-3 | 64 +++++++++++++++++++++++++++++++++++ 4 files changed, 98 insertions(+), 58 deletions(-) create mode 100755 src/migration-scripts/l2tp/2-to-3 (limited to 'interface-definitions') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index b8637e256..bea2943d2 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -23,21 +23,18 @@ syslog=accel-l2tp,daemon copy=1 level=5 -{% if dns %} +{% if dnsv4 %} [dns] -{% if dns[0] %} -dns1={{dns[0]}} -{% endif %} -{% if dns[1] %} -dns2={{dns[1]}} +{% for dns in dnsv4 -%} +dns{{ loop.index }}={{ dns }} +{% endfor -%} {% endif %} -{% endif -%} {% if dnsv6 %} [ipv6-dns] -{% for srv in dnsv6: %} -{{srv}} -{% endfor %} +{% for dns in dnsv6 -%} +{{ dns }} +{% endfor -%} {% endif %} {% if wins %} diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index dcbb5f3ed..0bd592746 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -36,48 +36,22 @@ - + - IPv4 Domain Name Service (DNS) server - - - - - Primary DNS server - - ipv4 - IPv4 address - - - - - - - - - Secondary DNS server - - ipv4 - IPv4 address - - - - - - - - - - - IPv6 Domain Name Service (DNS) server + Domain Name Server (DNS) propagated to client - ipv6 - IPv6 DNS address + ipv4 + Domain Name Server (DNS) IPv4 address + + + ipv6 + Domain Name Server (DNS) IPv6 address + - + diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index d5274a6bc..93ee9edf9 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -26,9 +26,9 @@ from jinja2 import FileSystemLoader, Environment from vyos.config import Config from vyos.defaults import directories as vyos_data_dir -from vyos import ConfigError from vyos.util import run - +from vyos.validate import is_ipv4 +from vyos import ConfigError pidfile = r'/var/run/accel_l2tp.pid' l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' @@ -53,7 +53,7 @@ default_config_data = { }, 'outside_addr': '', 'gateway_address': '10.255.255.0', - 'dns': [], + 'dnsv4': [], 'dnsv6': [], 'wins': [], 'client_ip_pool': None, @@ -91,7 +91,7 @@ def _accel_cmd(command): def get_config(): c = Config() - base = ['vpn', 'l2tp' 'remote-access'] + base = ['vpn', 'l2tp', 'remote-access'] if not c.exists(base): return None @@ -99,17 +99,19 @@ def get_config(): config_data = deepcopy(default_config_data) ### general options ### - if c.exists('dns-servers server-1'): - config_data['dns'].append(c.return_value('dns-servers server-1')) - if c.exists('dns-servers server-2'): - config_data['dns'].append(c.return_value('dns-servers server-2')) - if c.exists('dnsv6-servers'): - for dns6_server in c.return_values('dnsv6-servers'): - config_data['dnsv6'].append(dns6_server) + if c.exists(['name-server']): + for name_server in c.return_values(['name-server']): + if is_ipv4(name_server): + config_data['dnsv4'].append(name_server) + else: + config_data['dnsv6'].append(name_server) + if c.exists('wins-servers server-1'): config_data['wins'].append(c.return_value('wins-servers server-1')) + if c.exists('wins-servers server-2'): config_data['wins'].append(c.return_value('wins-servers server-2')) + if c.exists('outside-address'): config_data['outside_addr'] = c.return_value('outside-address') @@ -324,8 +326,11 @@ def verify(c): raise ConfigError( "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") + if len(c['dnsv4']) > 2: + raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') + if len(c['dnsv6']) > 3: - raise ConfigError("Maximum allowed dnsv6-servers addresses is 3") + raise ConfigError('Not more then three IPv6 DNS name-servers can be configured') def generate(c): diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 new file mode 100755 index 000000000..ebeb814c1 --- /dev/null +++ b/src/migration-scripts/l2tp/2-to-3 @@ -0,0 +1,64 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# - remove primary/secondary identifier from nameserver + +import os +import sys + +from sys import argv, exit +from vyos.configtree import ConfigTree + +if (len(argv) < 1): + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +config = ConfigTree(config_file) +base = ['vpn', 'l2tp', 'remote-access'] +if not config.exists(base): + # Nothing to do + exit(0) +else: + + # Migrate IPv4 DNS servers + dns_base = base + ['dns-servers'] + if config.exists(dns_base): + for server in ['server-1', 'server-2']: + if config.exists(dns_base + [server]): + dns = config.return_value(dns_base + [server]) + config.set(base + ['name-server'], value=dns, replace=False) + + config.delete(dns_base) + + # Migrate IPv6 DNS servers + dns_base = base + ['dnsv6-servers'] + if config.exists(dns_base): + for server in config.return_values(dns_base): + config.set(base + ['name-server'], value=server, replace=False) + + config.delete(dns_base) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) -- cgit v1.2.3 From a533ca621567150732b58fc5176cd18b608f1f92 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:43:38 +0200 Subject: vpn: l2tp: T2264: combine WINS CLI syntax There is no reason to distinguish between WINS servers in terms of priority. This is solely a task which can be done in the underlaying Python scripts. --- data/templates/l2tp/l2tp.config.tmpl | 9 +++------ interface-definitions/vpn-l2tp.xml.in | 32 +++++++++++--------------------- src/conf_mode/vpn_l2tp.py | 10 +++++----- src/migration-scripts/l2tp/2-to-3 | 11 +++++++++++ 4 files changed, 30 insertions(+), 32 deletions(-) (limited to 'interface-definitions') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index bea2943d2..7e15233bb 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -39,13 +39,10 @@ dns{{ loop.index }}={{ dns }} {% if wins %} [wins] -{% if wins[0] %} -wins1={{wins[0]}} -{% endif %} -{% if wins[1] %} -wins2={{wins[1]}} +{% for server in wins -%} +wins{{ loop.index }}={{ server }} +{% endfor -%} {% endif %} -{% endif -%} [l2tp] verbose=1 diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 0bd592746..5604ea3d2 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -182,29 +182,19 @@ - + - Windows Internet Name Service (WINS) server settings + Windows Internet Name Service (WINS) servers propagated to client + + ipv4 + Domain Name Server (DNS) IPv4 address + + + + + - - - - Primary WINS server - - - - - - - - Secondary WINS server - - - - - - - + Pool of client IP addresses (must be within a /24) diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 93ee9edf9..fb7297928 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -106,11 +106,8 @@ def get_config(): else: config_data['dnsv6'].append(name_server) - if c.exists('wins-servers server-1'): - config_data['wins'].append(c.return_value('wins-servers server-1')) - - if c.exists('wins-servers server-2'): - config_data['wins'].append(c.return_value('wins-servers server-2')) + if c.exists(['wins-server']): + config_data['wins'] = c.return_values(['wins-server']) if c.exists('outside-address'): config_data['outside_addr'] = c.return_value('outside-address') @@ -326,6 +323,9 @@ def verify(c): raise ConfigError( "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") + if len(c['wins']) > 2: + raise ConfigError('Not more then two IPv4 WINS name-servers can be configured') + if len(c['dnsv4']) > 2: raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 index ebeb814c1..f1f9b67b5 100755 --- a/src/migration-scripts/l2tp/2-to-3 +++ b/src/migration-scripts/l2tp/2-to-3 @@ -56,6 +56,17 @@ else: config.delete(dns_base) + + # Migrate IPv4 WINS servers + wins_base = base + ['wins-servers'] + if config.exists(wins_base): + for server in ['server-1', 'server-2']: + if config.exists(wins_base + [server]): + wins = config.return_value(wins_base + [server]) + config.set(base + ['wins-server'], value=wins, replace=False) + + config.delete(wins_base) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3 From 9e07ddb150fbf235466ce6de6f209d0ea3038b06 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 00:34:44 +0200 Subject: vpn: l2tp: T2264: remove RADIUS req-limit node It makes less sense for the user to specify this behavior. --- interface-definitions/vpn-l2tp.xml.in | 5 ----- src/migration-scripts/l2tp/2-to-3 | 10 +++++++++- 2 files changed, 9 insertions(+), 6 deletions(-) (limited to 'interface-definitions') diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 5604ea3d2..5f0537de5 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -428,11 +428,6 @@ Key for accessing the specified server - - - Maximum number of simultaneous requests to server (default: unlimited) - - If server doesn not responds mark it unavailable for this time (seconds) diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 index f1f9b67b5..e24d1ffa9 100755 --- a/src/migration-scripts/l2tp/2-to-3 +++ b/src/migration-scripts/l2tp/2-to-3 @@ -15,6 +15,7 @@ # along with this program. If not, see . # - remove primary/secondary identifier from nameserver +# - TODO: remove radius server req-limit import os import sys @@ -56,7 +57,6 @@ else: config.delete(dns_base) - # Migrate IPv4 WINS servers wins_base = base + ['wins-servers'] if config.exists(wins_base): @@ -67,6 +67,14 @@ else: config.delete(wins_base) + + # Remove RADIUS server req-limit node + radius_base = base + ['authentication', 'radius'] + if config.exists(radius_base): + for server in config.list_nodes(radius_base + ['server']): + if config.exists(radius_base + ['server', server, 'req-limit']): + config.delete(radius_base + ['server', server, 'req-limit']) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3 From 20da27d779ad0d0c9bb78a0f661bc580abcf208e Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 00:47:31 +0200 Subject: vpn: l2tp: T2110: re-use RADIUS XML include file --- interface-definitions/vpn-l2tp.xml.in | 35 ++++++++++------------------------- 1 file changed, 10 insertions(+), 25 deletions(-) (limited to 'interface-definitions') diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 5f0537de5..84dd8187c 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -409,41 +409,26 @@ + #include - - RADIUS specific configuration - - - IP address of RADIUS server - - ipv4 - IPv4 address of RADIUS server - - - - - Key for accessing the specified server - - - If server doesn not responds mark it unavailable for this time (seconds) + Mark server unavailable for <n> seconds on failure + + 0-600 + Fail time penalty + + + + + Fail time must be between 0 and 600 seconds - - - Local RADIUS client address from which packets are sent. - - <x.x.x.x> - Local RADIUS client address from which packets are sent - - - Timeout to wait response from server (seconds) -- cgit v1.2.3 From 07080afd4015a900fb7474e1c81008f58b478565 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 15:12:52 +0200 Subject: vpn: l2tp: T2264: migrate IPv6 prefix node to common CLI style Combining multiple options into a single CLI node is considered bad practice. IPv6 prefixes consited of the prefix itself and a mask send to the client in one node only. The following CLI parts have been migrated from client-ipv6-pool { delegate-prefix fc00:0:1::/48,64 prefix 2001:db8::/64,64 } to client-ipv6-pool { delegate fc00:0:1::/48 { delegation-prefix 48 } prefix 2001:db8::/48 { mask 64 } } Thus regular validation steps from the VyOS CLI can be used when a prefix is configured. --- data/templates/l2tp/l2tp.config.tmpl | 8 ++--- interface-definitions/vpn-l2tp.xml.in | 56 +++++++++++++++++++++++++++-------- src/conf_mode/vpn_l2tp.py | 30 ++++++++++++++++--- src/migration-scripts/l2tp/2-to-3 | 28 ++++++++++++++++++ 4 files changed, 102 insertions(+), 20 deletions(-) (limited to 'interface-definitions') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index 0dcff1371..ba78cadcd 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -118,11 +118,11 @@ ipv6=allow {% if client_ipv6_pool %} [ipv6-pool] -{% for prefix in client_ipv6_pool %} -{{ prefix }} +{% for p in client_ipv6_pool %} +{{ p.prefix }},{{ p.mask }} {% endfor %} -{% for prefix in client_ipv6_delegate_prefix %} -delegate={{ prefix }} +{% for p in client_ipv6_delegate_prefix %} +delegate={{ p.prefix }},{{ p.mask }} {% endfor %} {% endif %} diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 84dd8187c..d4286a810 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -237,26 +237,58 @@ Pool of client IPv6 addresses - + - IPV6 prefix delegation + Pool of addresses used to assign to clients - ipv6prefix/mask,prefix_len - e.g.: fc00:0:1::/48,64 - divides prefix into /64 subnets for clients + ipv6net + IPv6 address and prefix length - + + + - - + + + + Prefix length used for individual client + + <48-128> + Client prefix length (default: 64) + + + + + + + + + - DHCPv6 prefix delegation - rfc3633 + Subnet used to delegate prefix through DHCPv6-PD (RFC3633) - ipv6prefix/mask,prefix_len - Delegate to clients through DHCPv6 prefix delegation - rfc3633 + ipv6net + IPv6 address and prefix length - + + + - + + + + Prefix length delegated to client + + <32-64> + Delegated prefix length + + + + + + + + diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 08654e2ff..7cfb4e74e 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -232,12 +232,30 @@ def get_config(): l2tp['client_ip_subnets'] = conf.return_values(['client-ip-pool', 'subnet']) if conf.exists(['client-ipv6-pool', 'prefix']): - l2tp['client_ipv6_pool'] = conf.return_values(['client-ipv6-pool', 'prefix']) l2tp['ip6_column'].append('ip6') + for prefix in conf.list_nodes(['client-ipv6-pool', 'prefix']): + tmp = { + 'prefix': prefix, + 'mask': '64' + } + + if conf.exists(['client-ipv6-pool', 'prefix', prefix, 'mask']): + tmp['mask'] = conf.return_value(['client-ipv6-pool', 'prefix', prefix, 'mask']) - if conf.exists(['client-ipv6-pool', 'delegate-prefix']): - l2tp['client_ipv6_delegate_prefix'] = conf.return_values(['client-ipv6-pool', 'delegate-prefix']) - l2tp['ip6_column'].append('ip6-dp') + l2tp['client_ipv6_pool'].append(tmp) + + if conf.exists(['client-ipv6-pool', 'delegate']): + l2tp['ip6_column'].append('ip6-db') + for prefix in conf.list_nodes(['client-ipv6-pool', 'delegate']): + tmp = { + 'prefix': prefix, + 'mask': '' + } + + if conf.exists(['client-ipv6-pool', 'delegate', prefix, 'mask']): + tmp['mask'] = conf.return_value(['client-ipv6-pool', 'delegate', prefix, 'delegation-prefix']) + + l2tp['client_ipv6_delegate_prefix'].append(tmp) if conf.exists(['mtu']): l2tp['mtu'] = conf.return_value(['mtu']) @@ -306,6 +324,10 @@ def verify(l2tp): if l2tp['client_ipv6_delegate_prefix'] and not l2tp['client_ipv6_pool']: raise ConfigError('IPv6 prefix delegation requires client-ipv6-pool prefix') + for prefix in l2tp['client_ipv6_delegate_prefix']: + if not prefix['mask']: + raise ConfigError('Delegation-prefix required for individual delegated networks') + if len(l2tp['wins']) > 2: raise ConfigError('Not more then two IPv4 WINS name-servers can be configured') diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 index e24d1ffa9..bd0839e03 100755 --- a/src/migration-scripts/l2tp/2-to-3 +++ b/src/migration-scripts/l2tp/2-to-3 @@ -75,6 +75,34 @@ else: if config.exists(radius_base + ['server', server, 'req-limit']): config.delete(radius_base + ['server', server, 'req-limit']) + # Migrate IPv6 prefixes + ipv6_base = base + ['client-ipv6-pool'] + if config.exists(ipv6_base + ['prefix']): + prefix_old = config.return_values(ipv6_base + ['prefix']) + # delete old prefix CLI nodes + config.delete(ipv6_base + ['prefix']) + # create ned prefix tag node + config.set(ipv6_base + ['prefix']) + config.set_tag(ipv6_base + ['prefix']) + + for p in prefix_old: + prefix = p.split(',')[0] + mask = p.split(',')[1] + config.set(ipv6_base + ['prefix', prefix, 'mask'], value=mask) + + if config.exists(ipv6_base + ['delegate-prefix']): + prefix_old = config.return_values(ipv6_base + ['delegate-prefix']) + # delete old delegate prefix CLI nodes + config.delete(ipv6_base + ['delegate-prefix']) + # create ned delegation tag node + config.set(ipv6_base + ['delegate ']) + config.set_tag(ipv6_base + ['delegate ']) + + for p in prefix_old: + prefix = p.split(',')[0] + mask = p.split(',')[1] + config.set(ipv6_base + ['delegate', prefix, 'mask'], value=mask) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3