From 02533e1dcfc097ea31ba0155b9495ba841d666f5 Mon Sep 17 00:00:00 2001 From: Ewald van Geffen Date: Sat, 13 Oct 2018 18:52:07 +0200 Subject: Update show_dhcp.py I don't really do python, please check/test. --- src/op_mode/show_dhcp.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/op_mode/show_dhcp.py b/src/op_mode/show_dhcp.py index e76fc3a14..0005d62a3 100755 --- a/src/op_mode/show_dhcp.py +++ b/src/op_mode/show_dhcp.py @@ -142,7 +142,12 @@ if __name__ == '__main__': for p in pools: size = get_pool_size(config, p) leases = len(get_leases(lease_file, state='active', pool=args.pool)) - use_percentage = round(leases / size) * 100 + + if size != 0: + use_percentage = round(leases / size) * 100 + else: + use_percentage = 0 + if args.json: pool_stats = {"pool": p, "size": size, "leases": leases, "available": (size - leases), "percentage": use_percentage} -- cgit v1.2.3 From 77e277208e67dc1370ddffda90e1e18bc50220d3 Mon Sep 17 00:00:00 2001 From: Daniil Baturin Date: Sun, 14 Oct 2018 18:17:36 +0200 Subject: T898: add a script for checking if a bridge has configured members. --- src/conf_mode/bridge_has_members.py | 85 +++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100755 src/conf_mode/bridge_has_members.py (limited to 'src') diff --git a/src/conf_mode/bridge_has_members.py b/src/conf_mode/bridge_has_members.py new file mode 100755 index 000000000..712a9cc46 --- /dev/null +++ b/src/conf_mode/bridge_has_members.py @@ -0,0 +1,85 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# + +import sys + +import vyos.config + +if len(sys.argv) < 2: + print("Argument (bridge interface name) is required") + sys.exit(1) +else: + bridge = sys.argv[1] + +c = vyos.config.Config() + +members = [] + + +# Check in ethernet and bonding interfaces +for p in ["interfaces ethernet", "interfaces bonding"]: + intfs = c.list_nodes(p) + for i in intfs: + intf_bridge_path = "{0} {1} bridge-group bridge".format(p, i) + if c.exists(intf_bridge_path): + intf_bridge = c.return_value(intf_bridge_path) + if intf_bridge == bridge: + members.append(i) + # Walk VLANs + for v in c.list_nodes("{0} {1} vif".format(p, i)): + vif_bridge_path = "{0} {1} vif {2} bridge-group bridge".format(p, i, v) + if c.exists(vif_bridge_path): + vif_bridge = c.return_value(vif_bridge_path) + if vif_bridge == bridge: + members.append("{0}.{1}".format(i, v)) + # Walk QinQ interfaces + for vs in c.list_nodes("{0} {1} vif-s".format(p, i)): + vifs_bridge_path = "{0} {1} vif-s {2} bridge-group bridge".format(p, i, vs) + if c.exists(vifs_bridge_path): + vifs_bridge = c.return_value(vifs_bridge_path) + if vifs_bridge == bridge: + members.append("{0}.{1}".format(i, vs)) + for vc in c.list_nodes("{0} {1} vif-s {2} vif-c".format(p, i, vs)): + vifc_bridge_path = "{0} {1} vif-s {2} vif-c {3} bridge-group bridge".format(p, i, vs, vc) + if c.exists(vifc_bridge_path): + vifc_bridge = c.return_value(vifc_bridge_path) + if vifc_bridge == bridge: + members.append("{0}.{1}.{2}".format(i, vs, vc)) + +# Check tunnel interfaces +for t in c.list_nodes("interfaces tunnel"): + tunnel_bridge_path = "interfaces tunnel {0} parameters ip bridge-group bridge".format(t) + if c.exists(tunnel_bridge_path): + intf_bridge = c.return_value(tunnel_bridge_path) + if intf_bridge == bridge: + members.append(t) + +# Check OpenVPN interfaces +for o in c.list_nodes("interfaces openvpn"): + ovpn_bridge_path = "interfaces openvpn {0} bridge-group bridge".format(o) + if c.exists(ovpn_bridge_path): + intf_bridge = c.return_value(ovpn_bridge_path) + if intf_bridge == bridge: + members.append(o) + +if members: + print("Bridge {0} cannot be deleted because some interfaces are configured as its members".format(bridge)) + print("The following interfaces are members of {0}: {1}".format(bridge, " ".join(members))) + sys.exit(1) +else: + sys.exit(0) -- cgit v1.2.3 From 95d95c52cb447b3ddb1bce6737583e4fd1c945d0 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sun, 14 Oct 2018 18:12:45 +0200 Subject: T896: Fix dynamic DNS for CUSTOM provider JINJA2 templated missed the 'server=' statement when generating custom dynamic DNS entries in the resulting ddclient.conf. --- src/conf_mode/dynamic_dns.py | 1 + 1 file changed, 1 insertion(+) (limited to 'src') diff --git a/src/conf_mode/dynamic_dns.py b/src/conf_mode/dynamic_dns.py index 90d4ff567..60efcaae2 100755 --- a/src/conf_mode/dynamic_dns.py +++ b/src/conf_mode/dynamic_dns.py @@ -63,6 +63,7 @@ protocol={{ srv.protocol }} max-interval=28d login={{ srv.login }} password='{{ srv.password }}' +server={{ srv.server }} {{ host }} {% endfor %} {% endfor %} -- cgit v1.2.3 From 8cf83c6ca8cf9cfda0179765effc2696f99dbc94 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Wed, 17 Oct 2018 20:16:37 +0200 Subject: T913: DHCP relay service XML/Python rewrite for IPv4 --- interface-definitions/dhcp-relay.xml | 108 ++++++++++++++++++++++++ src/conf_mode/dhcp_relay.py | 158 +++++++++++++++++++++++++++++++++++ 2 files changed, 266 insertions(+) create mode 100644 interface-definitions/dhcp-relay.xml create mode 100755 src/conf_mode/dhcp_relay.py (limited to 'src') diff --git a/interface-definitions/dhcp-relay.xml b/interface-definitions/dhcp-relay.xml new file mode 100644 index 000000000..c918d25a3 --- /dev/null +++ b/interface-definitions/dhcp-relay.xml @@ -0,0 +1,108 @@ + + + + + + + + Host Configuration Protocol (DHCP) relay agent + 910 + + + + + DHCP relay interface [REQUIRED] + + + + + + + + + Relay options + + + + + Policy to discard packets that have reached specified hop-count + + 1-255 + Hop count (default: 10) + + + + + hop-count must be a value between 1 and 255 + + + + + Maximum packet size to send to a DHCPv4/BOOTP server + + 64-1400 + Maximum packet size (default: 576) + + + + + max-size must be a value between 64 and 1400 + + + + + Port number to listen on + + 1-65535 + Port to listen on + + + + + port must be a value between 1 and 65535 + + + + + Policy to handle incoming DHCPv4 packets which already contain relay agent options (default: forward) + + append + append own relay options to packet + + + replace + replace existing agent option field + + + forward + forward packet unchanged + + + discard + discard packet (default action if giaddr not set in packet) + + + (append|replace|forward|discard) + + + + + + + + DHCP server address + + ipv4 + DHCP server IPv4 address + + + + + + + + + + + + diff --git a/src/conf_mode/dhcp_relay.py b/src/conf_mode/dhcp_relay.py new file mode 100755 index 000000000..f757491e0 --- /dev/null +++ b/src/conf_mode/dhcp_relay.py @@ -0,0 +1,158 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# + +import sys +import os +import jinja2 + +from vyos.config import Config +from vyos import ConfigError + +config_file = r'/etc/default/isc-dhcp-relay' + +# Please be careful if you edit the template. +config_tmpl = """ +### Autogenerated by dhcp_relay.py ### + +# Defaults for isc-dhcp-relay initscript +# sourced by /etc/init.d/isc-dhcp-relay + +# +# This is a POSIX shell fragment +# + +# What servers should the DHCP relay forward requests to? +SERVERS="{{ server | join(' ') }}" + +# On what interfaces should the DHCP relay (dhrelay) serve DHCP requests? +INTERFACES="{{ interface | join(' ') }}" + +# Additional options that are passed to the DHCP relay daemon? +OPTIONS="-4 -p {{ port }} {{ options | join(' ') }}" +""" + +default_config_data = { + 'interface': [], + 'server': [], + 'options': [], + 'port': '67', + 'hop_count': '10', + 'relay_agent_packets': 'forward' +} + +def get_config(): + relay = default_config_data + conf = Config() + if not conf.exists('service dhcp-relay'): + return None + else: + conf.set_level('service dhcp-relay') + + # Network interfaces to listen on + if conf.exists('interface'): + relay['interface'] = conf.return_values('interface') + + # Servers equal to the address of the DHCP server(s) + if conf.exists('server'): + relay['server'] = conf.return_values('server') + + conf.set_level('service dhcp-relay relay-options') + + if conf.exists('hop-count'): + count = '-c ' + conf.return_value('hop-count') + relay['options'].append(count) + + # Specify the maximum packet size to send to a DHCPv4/BOOTP server. + # This might be done to allow sufficient space for addition of relay agent + # options while still fitting into the Ethernet MTU size. + # + # Available in DHCPv4 mode only: + if conf.exists('max-size'): + size = '-A ' + conf.return_value('max-size') + relay['options'].append(size) + + # Listen and transmit on port . This is mostly useful for debugging + # purposes. Default is port 67 for DHCPv4/BOOTP, or port 547 for DHCPv6. + if conf.exists('port'): + relay['port'] = conf.return_value('port') + + # Control the handling of incoming DHCPv4 packets which already contain + # relay agent options. If such a packet does not have giaddr set in its + # header, the DHCP standard requires that the packet be discarded. However, + # if giaddr is set, the relay agent may handle the situation in four ways: + # It may append its own set of relay options to the packet, leaving the + # supplied option field intact; it may replace the existing agent option + # field; it may forward the packet unchanged; or, it may discard it. + # + # Available in DHCPv4 mode only: + if conf.exists('relay-agents-packets'): + pkt = '-m ' + conf.return_value('relay-agents-packets') + relay['options'].append(pkt) + + return relay + +def verify(relay): + # bail out early - looks like removal from running config + if relay is None: + return None + + if len(relay['interface']) < 2: + # We can only issue a warning otherwise old configurations might break + print('WARNING: At least two interfaces are required for DHCP relay\n' \ + 'to work\n') + + if 'lo' in relay['interface']: + raise ConfigError('DHCP relay does not support the loopback interface.') + + if len(relay['server']) == 0: + raise ConfigError('No DHCP relay server(s) configured.\n' \ + 'At least one DHCP relay server required.') + + return None + +def generate(relay): + # bail out early - looks like removal from running config + if relay is None: + return None + + tmpl = jinja2.Template(config_tmpl) + config_text = tmpl.render(relay) + with open(config_file, 'w') as f: + f.write(config_text) + + return None + +def apply(relay): + if relay is not None: + os.system('sudo systemctl restart isc-dhcp-relay.service') + else: + # DHCP relay support is removed in the commit + os.system('sudo systemctl stop isc-dhcp-relay.service') + os.unlink(config_file) + + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3 From ddab02cbd638f0fb5db3003284e360b5b1603007 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Wed, 17 Oct 2018 21:09:42 +0200 Subject: T913: DHCP relay service XML/Python rewrite for IPv6 --- interface-definitions/dhcpv6-relay.xml | 92 +++++++++++++++++++++++++ src/conf_mode/dhcpv6_relay.py | 121 +++++++++++++++++++++++++++++++++ 2 files changed, 213 insertions(+) create mode 100644 interface-definitions/dhcpv6-relay.xml create mode 100755 src/conf_mode/dhcpv6_relay.py (limited to 'src') diff --git a/interface-definitions/dhcpv6-relay.xml b/interface-definitions/dhcpv6-relay.xml new file mode 100644 index 000000000..d6e6daf51 --- /dev/null +++ b/interface-definitions/dhcpv6-relay.xml @@ -0,0 +1,92 @@ + + + + + + + + DHCPv6 Relay Agent parameters + 900 + + + + + Interface for DHCPv6 Relay Agent to listen for requests + + + + + + + + IPv6 address on listen-interface listen for requests on + + ipv6 + IPv6 address on listen interface + + + + + + + + + + + UDP port to listen for requests on + + 1-65535 + Port to listen on + + + + + port must be a value between 1 and 65535 + + + + + Maximum hop count for which requests will be processed + + 1-255 + Hop count (default: 10) + + + + + max-hop-count must be a value between 1 and 255 + + + + + Interface for DHCPv6 Relay Agent forward requests out + + + + + + + + IPv6 address to forward requests to + + ipv6 + IPv6 address of the DHCP server + + + + + + + + + + + Option to set DHCPv6 interface-ID option + + + + + + + + diff --git a/src/conf_mode/dhcpv6_relay.py b/src/conf_mode/dhcpv6_relay.py new file mode 100755 index 000000000..982320d18 --- /dev/null +++ b/src/conf_mode/dhcpv6_relay.py @@ -0,0 +1,121 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# + +import sys +import os +import jinja2 + +from vyos.config import Config +from vyos import ConfigError + +config_file = r'/etc/default/isc-dhcpv6-relay' + +# Please be careful if you edit the template. +config_tmpl = """ +### Autogenerated by dhcpv6_relay.py ### + +# Defaults for isc-dhcpv6-relay initscript sourced by /etc/init.d/isc-dhcpv6-relay + +OPTIONS="-6 -l {{ listen_addr | join('-l ') }} -p {{ port }} {{ options | join(' ') }} -u {{ upstream_addr | join('-u ') }}" +""" + +default_config_data = { + 'listen_addr': [], + 'upstream_addr': [], + 'port': '547', + 'options': [], +} + +def get_config(): + relay = default_config_data + conf = Config() + if not conf.exists('service dhcpv6-relay'): + return None + else: + conf.set_level('service dhcpv6-relay') + + # Network interfaces/address to listen on for DHCPv6 query(s) + if conf.exists('listen-interface'): + interfaces = conf.list_nodes('listen-interface') + for intf in interfaces: + addr = conf.return_value('listen-interface {0} address'.format(intf)) + listen = addr + '%' + intf + relay['listen_addr'].append(listen) + + # Upstream interface/address for remote DHCPv6 server + if conf.exists('upstream-interface'): + interfaces = conf.list_nodes('upstream-interface') + for intf in interfaces: + addr = conf.return_value('upstream-interface {0} address'.format(intf)) + server = addr + '%' + intf + relay['upstream_addr'].append(server) + + # Listen and transmit on port . This is mostly useful for debugging + # purposes. Default is port 67 for DHCPv4/BOOTP, or port 547 for DHCPv6. + if conf.exists('listen-port'): + relay['port'] = conf.return_value('listen-port') + + # Maximum hop count. When forwarding packets, dhcrelay discards packets + # which have reached a hop count of COUNT. Default is 10. Maximum is 255. + if conf.exists('max-hop-count'): + count = '-c ' + conf.return_value('max-hop-count') + relay['options'].append(count) + + if conf.exists('use-interface-id-option'): + relay['options'].append('-I') + + return relay + +def verify(relay): + # bail out early - looks like removal from running config + if relay is None: + return None + + return None + +def generate(relay): + # bail out early - looks like removal from running config + if relay is None: + return None + + tmpl = jinja2.Template(config_tmpl) + config_text = tmpl.render(relay) + with open(config_file, 'w') as f: + f.write(config_text) + + return None + +def apply(relay): + if relay is not None: + os.system('sudo systemctl restart isc-dhcpv6-relay.service') + else: + # DHCPv6 relay support is removed in the commit + os.system('sudo systemctl stop isc-dhcpv6-relay.service') + os.unlink(config_file) + + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3 From 06d4635eba6a8d11d92d13c41f09d2ade254f770 Mon Sep 17 00:00:00 2001 From: UnicronNL Date: Fri, 19 Oct 2018 00:33:55 +0200 Subject: Add Client keepalive option for use with cloud-init Add option to specify multiple listening ports Clean up template generation layout --- debian/control | 4 ++- interface-definitions/ssh.xml | 9 +++++++ src/conf_mode/ssh.py | 57 +++++++++++++++++++++++++++++++++---------- 3 files changed, 56 insertions(+), 14 deletions(-) (limited to 'src') diff --git a/debian/control b/debian/control index 4cd852687..c0ce26c86 100644 --- a/debian/control +++ b/debian/control @@ -9,7 +9,9 @@ Build-Depends: debhelper (>= 9), quilt, python3-lxml, python3-nose, - python3-coverage + python3-coverage, + whois, + libvyosconfig0 Standards-Version: 3.9.6 Package: vyos-1x diff --git a/interface-definitions/ssh.xml b/interface-definitions/ssh.xml index 35fe79214..422e6d64d 100644 --- a/interface-definitions/ssh.xml +++ b/interface-definitions/ssh.xml @@ -167,11 +167,20 @@ 1-65535 Numeric IP port + + + + how often send keep alives in seconds + + + + + diff --git a/src/conf_mode/ssh.py b/src/conf_mode/ssh.py index beca7bb9a..b681acea3 100755 --- a/src/conf_mode/ssh.py +++ b/src/conf_mode/ssh.py @@ -67,7 +67,13 @@ UseDNS {{ host_validation }} # Specifies the port number that sshd listens on. The default is 22. # Multiple options of this type are permitted. +{% if mport|length != 0 %} +{% for p in mport %} +Port {{ p }} +{% endfor %} +{% else %} Port {{ port }} +{% endif %} # Gives the verbosity level that is used when logging messages from sshd LogLevel {{ log_level }} @@ -78,64 +84,80 @@ PermitRootLogin {{ allow_root }} # Specifies whether password authentication is allowed PasswordAuthentication {{ password_authentication }} -{% if listen_on -%} +{% if listen_on %} # Specifies the local addresses sshd should listen on -{% for a in listen_on -%} +{% for a in listen_on %} ListenAddress {{ a }} -{% endfor -%} +{% endfor %} +{{ "\n" }} {% endif %} -{% if ciphers -%} +{%- if ciphers %} # Specifies the ciphers allowed. Multiple ciphers must be comma-separated. # # NOTE: As of now, there is no 'multi' node for 'ciphers', thus we have only one :/ Ciphers {{ ciphers | join(",") }} +{{ "\n" }} {% endif %} -{% if mac -%} +{%- if mac %} # Specifies the available MAC (message authentication code) algorithms. The MAC # algorithm is used for data integrity protection. Multiple algorithms must be # comma-separated. # # NOTE: As of now, there is no 'multi' node for 'mac', thus we have only one :/ MACs {{ mac | join(",") }} +{{ "\n" }} {% endif %} -{% if key_exchange -%} +{%- if key_exchange %} # Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must # be comma-separated. # # NOTE: As of now, there is no 'multi' node for 'key-exchange', thus we have only one :/ KexAlgorithms {{ key_exchange | join(",") }} +{{ "\n" }} {% endif %} -{% if allow_users -%} +{%- if allow_users %} # This keyword can be followed by a list of user name patterns, separated by spaces. # If specified, login is allowed only for user names that match one of the patterns. # Only user names are valid, a numerical user ID is not recognized. AllowUsers {{ allow_users | join(" ") }} +{{ "\n" }} {% endif %} -{% if allow_groups -%} +{%- if allow_groups %} # This keyword can be followed by a list of group name patterns, separated by spaces. # If specified, login is allowed only for users whose primary group or supplementary # group list matches one of the patterns. Only group names are valid, a numerical group # ID is not recognized. AllowGroups {{ allow_groups | join(" ") }} +{{ "\n" }} {% endif %} -{% if deny_users -%} +{%- if deny_users %} # This keyword can be followed by a list of user name patterns, separated by spaces. # Login is disallowed for user names that match one of the patterns. Only user names # are valid, a numerical user ID is not recognized. DenyUsers {{ deny_users | join(" ") }} +{{ "\n" }} {% endif %} -{% if deny_groups -%} +{%- if deny_groups %} # This keyword can be followed by a list of group name patterns, separated by spaces. # Login is disallowed for users whose primary group or supplementary group list matches # one of the patterns. Only group names are valid, a numerical group ID is not recognized. DenyGroups {{ deny_groups | join(" ") }} +{{ "\n" }} +{% endif %} + +{%- if client_keepalive %} +# Sets a timeout interval in seconds after which if no data has been received from the client, +# sshd will send a message through the encrypted channel to request a response from the client. +# The default is 0, indicating that these messages will not be sent to the client. +# This option applies to protocol version 2 only. +ClientAliveInterval {{ client_keepalive }} {% endif %} """ @@ -208,8 +230,17 @@ def get_config(): ssh['mac'] = mac if conf.exists('port'): - port = conf.return_value('port') - ssh['port'] = port + ports = conf.return_values('port') + mport = [] + + for prt in ports: + mport.append(prt) + + ssh['mport'] = mport + + if conf.exists('client-keepalive-interval'): + client_keepalive = conf.return_value('client-keepalive-interval') + ssh['client_keepalive'] = client_keepalive return ssh @@ -228,7 +259,7 @@ def generate(ssh): if ssh is None: return None - tmpl = jinja2.Template(config_tmpl) + tmpl = jinja2.Template(config_tmpl, trim_blocks=True) config_text = tmpl.render(ssh) with open(config_file, 'w') as f: f.write(config_text) -- cgit v1.2.3 From e0e3fe5ebaf109717c848e089adf4978c142fa8e Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 19 Oct 2018 07:40:13 +0200 Subject: dhcpv6-relay: added missing verify() step for listen and upstream interfaces --- src/conf_mode/dhcpv6_relay.py | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src') diff --git a/src/conf_mode/dhcpv6_relay.py b/src/conf_mode/dhcpv6_relay.py index 982320d18..c8b3eca6d 100755 --- a/src/conf_mode/dhcpv6_relay.py +++ b/src/conf_mode/dhcpv6_relay.py @@ -86,6 +86,9 @@ def verify(relay): if relay is None: return None + if len(relay['listen_addr']) == 0 or len(relay['upstream_addr']) == 0: + raise ConfigError('Must set at least one listen and upstream interface.') + return None def generate(relay): -- cgit v1.2.3 From 2ece325c3a45d4ce82ed72de64d0e376a50ca408 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 20 Oct 2018 15:27:59 +0200 Subject: T923: support SNMP integration with FRR routing daemon --- src/conf_mode/snmp.py | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'src') diff --git a/src/conf_mode/snmp.py b/src/conf_mode/snmp.py index cbca72a85..37f5e7acd 100755 --- a/src/conf_mode/snmp.py +++ b/src/conf_mode/snmp.py @@ -95,15 +95,10 @@ daemon_config_tmpl = """ sysObjectID 1.3.6.1.4.1.44641 sysServices 14 master agentx -agentXPerms 0755 0755 +agentXPerms 0777 0777 pass .1.3.6.1.2.1.31.1.1.1.18 /opt/vyatta/sbin/if-mib-alias smuxpeer .1.3.6.1.2.1.83 smuxpeer .1.3.6.1.2.1.157 -smuxpeer .1.3.6.1.4.1.3317.1.2.2 -smuxpeer .1.3.6.1.4.1.3317.1.2.3 -smuxpeer .1.3.6.1.4.1.3317.1.2.5 -smuxpeer .1.3.6.1.4.1.3317.1.2.8 -smuxpeer .1.3.6.1.4.1.3317.1.2.9 smuxsocket localhost # linkUp/Down configure the Event MIB tables to monitor -- cgit v1.2.3 From 06e3d57867d2da4118ea0328fb3cf9074081f444 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 20 Oct 2018 15:40:06 +0200 Subject: SNMP: update comments in Python generator --- src/conf_mode/snmp.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/conf_mode/snmp.py b/src/conf_mode/snmp.py index 37f5e7acd..19d89e13c 100755 --- a/src/conf_mode/snmp.py +++ b/src/conf_mode/snmp.py @@ -47,7 +47,7 @@ OIDs = { 'des' : '.1.3.6.1.6.3.10.1.2.2', 'none': '.1.3.6.1.6.3.10.1.2.1' } -# SNMPS template - be careful if you edit the template. +# SNMP template (/etc/snmp/snmp.conf) - be careful if you edit the template. client_config_tmpl = """ ### Autogenerated by snmp.py ### {% if trap_source -%} @@ -56,7 +56,7 @@ clientaddr {{ trap_source }} """ -# SNMPS template - be careful if you edit the template. +# SNMP template (/usr/share/snmp/snmpd.conf) - be careful if you edit the template. access_config_tmpl = """ ### Autogenerated by snmp.py ### {%- for u in v3_users %} @@ -67,7 +67,7 @@ rwuser {{ vyos_user }} """ -# SNMPS template - be careful if you edit the template. +# SNMP template (/var/lib/snmp/snmpd.conf) - be careful if you edit the template. user_config_tmpl = """ ### Autogenerated by snmp.py ### # user @@ -87,7 +87,7 @@ oldEngineID {{ v3_engineid }} {%- endif %} """ -# SNMPS template - be careful if you edit the template. +# SNMP template (/etc/snmp/snmpd.conf) - be careful if you edit the template. daemon_config_tmpl = """ ### Autogenerated by snmp.py ### @@ -204,6 +204,7 @@ group {{ u.group }} tsm {{ u.name }} {%- endif %} """ +# SNMP template (/etc/default/snmpd) - be careful if you edit the template. init_config_tmpl = """ ### Autogenerated by snmp.py ### # This file controls the activity of snmpd -- cgit v1.2.3 From 9cf0514668b1461d3b74076b99c9edabafa10418 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sun, 21 Oct 2018 20:03:13 +0200 Subject: T634: remove 'service ssh allow-root' --- interface-definitions/ssh.xml | 6 ------ src/conf_mode/ssh.py | 6 +----- src/migration-scripts/ssh/0-to-1 | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+), 11 deletions(-) create mode 100755 src/migration-scripts/ssh/0-to-1 (limited to 'src') diff --git a/interface-definitions/ssh.xml b/interface-definitions/ssh.xml index 422e6d64d..c0ce976d6 100644 --- a/interface-definitions/ssh.xml +++ b/interface-definitions/ssh.xml @@ -72,12 +72,6 @@ - - - Allow the root user to login - - - Allowed ciphers diff --git a/src/conf_mode/ssh.py b/src/conf_mode/ssh.py index b681acea3..2a5cba99a 100755 --- a/src/conf_mode/ssh.py +++ b/src/conf_mode/ssh.py @@ -79,7 +79,7 @@ Port {{ port }} LogLevel {{ log_level }} # Specifies whether root can log in using ssh -PermitRootLogin {{ allow_root }} +PermitRootLogin no # Specifies whether password authentication is allowed PasswordAuthentication {{ password_authentication }} @@ -164,7 +164,6 @@ ClientAliveInterval {{ client_keepalive }} default_config_data = { 'port' : '22', 'log_level': 'INFO', - 'allow_root': 'no', 'password_authentication': 'yes', 'host_validation': 'yes' } @@ -193,9 +192,6 @@ def get_config(): deny_groups = conf.return_values('access-control deny group') ssh['deny_groups'] = deny_groups - if conf.exists('allow-root'): - ssh['allow-root'] = 'yes' - if conf.exists('ciphers'): ciphers = conf.return_values('ciphers') ssh['ciphers'] = ciphers diff --git a/src/migration-scripts/ssh/0-to-1 b/src/migration-scripts/ssh/0-to-1 new file mode 100755 index 000000000..91b832276 --- /dev/null +++ b/src/migration-scripts/ssh/0-to-1 @@ -0,0 +1,32 @@ +#!/usr/bin/env python3 + +# Delete "service ssh allow-root" option + +import sys + +from vyos.configtree import ConfigTree + +if (len(sys.argv) < 1): + print("Must specify file name!") + sys.exit(1) + +file_name = sys.argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +config = ConfigTree(config_file) + +if not config.exists(['service', 'ssh', 'allow-root']): + # Nothing to do + sys.exit(0) +else: + # Delete node with abandoned command + config.delete(['service', 'ssh', 'allow-root']) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + sys.exit(1) -- cgit v1.2.3 From 4029814a1ee22d02748ab92e01c357c66a9f9137 Mon Sep 17 00:00:00 2001 From: hagbard Date: Thu, 25 Oct 2018 11:34:24 -0700 Subject: T933: vrrp split brain while using unicast mode and virtual mac address - adding vmac_xmit_base to keepalived.conf when use_vmac is being used otherwise both nodes will become master --- debian/changelog | 7 +++++++ src/conf_mode/vrrp.py | 1 + 2 files changed, 8 insertions(+) (limited to 'src') diff --git a/debian/changelog b/debian/changelog index a7c428cda..1d0d37d51 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +vyos-1x (1.2.0-3) unstable; urgency=medium + + * T933: adding vmac_xmit_base if use_vmac has been chosen + to avoid split-brain + + -- hagbard Thu, 25 Oct 2018 11:14:44 -0700 + vyos-1x (1.2.0-2) unstable; urgency=medium * T773: adding wireguard support diff --git a/src/conf_mode/vrrp.py b/src/conf_mode/vrrp.py index 0480a886a..c458e3b04 100755 --- a/src/conf_mode/vrrp.py +++ b/src/conf_mode/vrrp.py @@ -78,6 +78,7 @@ vrrp_instance {{ group.name }} { {% if group.use_vmac -%} use_vmac {{group.interface}}v{{group.vrid}} + vmac_xmit_base {% endif -%} {% if group.auth_password -%} -- cgit v1.2.3 From 710fb88625e4f23a694931ad8bba8c91e0e21aba Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Thu, 25 Oct 2018 23:11:33 +0200 Subject: T938: do not bind DHCP relay to default port if unspecified Binding isc-dhcp-relay to its default port (67 e.g. for IPv4) will result in an error when starting up the service: bad: ---- $ dhcrelay -q -4 -p 67 -c 10 -A 576 -m discard -i eth0.21 -i eth0 10.253.253.1 binding to user-specified port 67 good: ----- $ dhcrelay -q -4 -c 10 -A 576 -m discard -i eth0.21 -i eth0 10.253.253.1 Setting removed from the IPv6 implementation, too! --- src/conf_mode/dhcp_relay.py | 4 ++-- src/conf_mode/dhcpv6_relay.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/conf_mode/dhcp_relay.py b/src/conf_mode/dhcp_relay.py index f757491e0..61b494b7e 100755 --- a/src/conf_mode/dhcp_relay.py +++ b/src/conf_mode/dhcp_relay.py @@ -43,14 +43,14 @@ SERVERS="{{ server | join(' ') }}" INTERFACES="{{ interface | join(' ') }}" # Additional options that are passed to the DHCP relay daemon? -OPTIONS="-4 -p {{ port }} {{ options | join(' ') }}" +OPTIONS="-4 {% if port -%} -p {{ port }}{%- endif %} {{ options | join(' ') }}" """ default_config_data = { 'interface': [], 'server': [], 'options': [], - 'port': '67', + 'port': '', 'hop_count': '10', 'relay_agent_packets': 'forward' } diff --git a/src/conf_mode/dhcpv6_relay.py b/src/conf_mode/dhcpv6_relay.py index c8b3eca6d..959bf0496 100755 --- a/src/conf_mode/dhcpv6_relay.py +++ b/src/conf_mode/dhcpv6_relay.py @@ -31,13 +31,13 @@ config_tmpl = """ # Defaults for isc-dhcpv6-relay initscript sourced by /etc/init.d/isc-dhcpv6-relay -OPTIONS="-6 -l {{ listen_addr | join('-l ') }} -p {{ port }} {{ options | join(' ') }} -u {{ upstream_addr | join('-u ') }}" +OPTIONS="-6 -l {{ listen_addr | join('-l ') }} {% if port -%} -p {{ port }}{%- endif %} {{ options | join(' ') }} -u {{ upstream_addr | join('-u ') }}" """ default_config_data = { 'listen_addr': [], 'upstream_addr': [], - 'port': '547', + 'port': '', 'options': [], } -- cgit v1.2.3 From 2b8d48bcd77134dff741158c81f7fadf3183e280 Mon Sep 17 00:00:00 2001 From: Daniil Baturin Date: Sun, 28 Oct 2018 17:35:36 +0100 Subject: T923: enable AgentX in FRR after SNMP is configured. --- src/conf_mode/snmp.py | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src') diff --git a/src/conf_mode/snmp.py b/src/conf_mode/snmp.py index 19d89e13c..7d695bb4c 100755 --- a/src/conf_mode/snmp.py +++ b/src/conf_mode/snmp.py @@ -830,6 +830,9 @@ def apply(snmp): os.system('vyos_libexec_dir=/usr/libexec/vyos /opt/vyatta/sbin/my_delete service snmp v3 user "{0}" auth plaintext-key > /dev/null'.format(cfg['user'])) os.system('vyos_libexec_dir=/usr/libexec/vyos /opt/vyatta/sbin/my_delete service snmp v3 user "{0}" privacy plaintext-key > /dev/null'.format(cfg['user'])) + # Enable AgentX in FRR + os.system('vtysh -c "configure terminal" -c "agentx"') + return None if __name__ == '__main__': -- cgit v1.2.3