Merge pull request #79 from hagbard-01/IPoE

[IPoE] T989 - IPoE implementation

3 files changed, 630 insertions, 0 deletions

diff --git a/interface-definitions/ipoe-server.xml b/interface-definitions/ipoe-server.xml
new file mode 100644
index 000000000..18968a033
--- /dev/null
+++ b/interface-definitions/ipoe-server.xml
@@ -0,0 +1,279 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="service">
+    <children>
+      <node name="ipoe-server" owner="${vyos_conf_scripts_dir}/ipoe_server.py">
+        <properties>
+          <help>Internet Protocol over Ethernet (IPoE) Server</help>
+          <priority>900</priority>
+        </properties>
+        <children>
+          <tagNode name="interface">
+            <properties>
+              <help>Network interface to server IPoE</help>
+              <completionHelp>
+                <script>${vyos_completion_dir}/list_interfaces.py</script>
+              </completionHelp>
+            </properties>
+            <children>
+              <leafNode name="network-mode">
+                <properties>
+                  <help>Network Layer IPoE serves on</help>
+                  <completionHelp>
+                    <list>L2 L3</list>
+                  </completionHelp>
+                  <constraint>
+                    <regex>^(L2|L3)</regex>
+                  </constraint>
+                  <valueHelp>
+                    <format>L2</format>
+                    <description>client share the same subnet</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>L3</format>
+                    <description>clients are behind this router</description>
+                  </valueHelp>
+                </properties>
+              </leafNode>
+              <leafNode name="network">
+                <properties>
+                  <help>Enables clients to share the same network or each client has its own vlan</help>
+                  <completionHelp>
+                    <list>shared vlan</list>
+                  </completionHelp>
+                  <constraint>
+                    <regex>^(shared|vlan)</regex>
+                  </constraint>
+                  <valueHelp>
+                    <format>shared</format>
+                    <description>Multiple clients share the same network</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>vlan</format>
+                    <description>One VLAN per client</description>    
+                  </valueHelp>
+                </properties>
+              </leafNode>
+              <leafNode name="client-subnet">
+                <properties>
+                  <help>Client address pool</help>
+                  <valueHelp>
+                    <format>ipv4net</format>
+                    <description>IPv4 address and prefix length</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="ipv4-prefix"/>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <node name="external-dhcp">
+                <properties>
+                  <help>DHCP requests will be forwarded</help>
+                </properties>
+                <children>
+                  <leafNode name="dhcp-relay">
+                    <properties>
+                      <help>DHCP Server the request will be redirected to.</help>
+                      <valueHelp>
+                        <format>ipv4</format>
+                        <description>IPv4 address of the DHCP Server</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="ipv4-address"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="giaddr">
+                    <properties>
+                      <help>address of the relay agent (Relay Agent IP Address)</help>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+            </children>
+          </tagNode>
+          <node name="dns-server">
+            <properties>
+              <help>DNS servers offered via internal DHCP</help>
+            </properties>
+            <children>
+              <leafNode name="server-1">
+                <properties>
+                  <help>IP address of the primary DNS server</help>
+                  <constraint>
+                    <validator name="ipv4-address"/>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <leafNode name="server-2">
+                <properties>
+                  <help>IP address of the primary DNS server</help>
+                  <constraint>
+                    <validator name="ipv4-address"/>
+                  </constraint>
+                </properties>
+              </leafNode>
+            </children>
+          </node>
+          <node name="authentication">
+            <properties>
+              <help>Client authentication methods</help>
+            </properties>
+            <children>
+              <leafNode name="mode">
+                <properties>
+                  <help>Authetication mode</help>
+                  <completionHelp>
+                    <list>local radius noauth</list>
+                  </completionHelp>
+                  <constraint>
+                    <regex>^(local|radius|noauth)</regex>
+                  </constraint>
+                  <valueHelp>
+                    <format>local</format>
+                    <description>Authentication based on local definition</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>radius</format>
+                    <description>Authentication based on a RADIUS server</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>noauth</format>
+                    <description>Authentication disabled</description>
+                  </valueHelp>
+                </properties>
+                </leafNode>
+                <tagNode name="interface">
+                  <properties>
+                    <help>Network interface the client mac will appear on</help>
+                    <completionHelp>
+                      <script>${vyos_completion_dir}/list_interfaces.py</script>
+                    </completionHelp>
+                  </properties>
+                  <children>
+                    <tagNode name="mac-address">
+                      <properties>
+                        <help>Client mac address allowed to receive an IP address</help>
+                        <valueHelp>
+                          <format>h:h:h:h:h:h</format>
+                          <description>Hardware (MAC) address</description>
+                        </valueHelp>
+                        <constraint>
+                          <validator name="mac-address"/>
+                        </constraint>
+                      </properties>
+                      <children>
+                        <node name="rate-limit">
+                          <properties>
+                            <help>Upload/Download speed limits</help>
+                          </properties>
+                          <children>
+                            <leafNode name="upload">
+                              <properties>
+                                <help>Upload bandwidth limit in kbits/sec</help>
+                                <constraint>
+                                  <validator name="numeric" argument="--range 1-65535"/>
+                                </constraint>
+                              </properties>
+                            </leafNode>
+                            <leafNode name="download">
+                              <properties>
+                                <help>Download bandwidth limit in kbits/sec</help>
+                                <constraint>
+                                  <validator name="numeric" argument="--range 1-65535"/>
+                                </constraint>
+                              </properties>
+                            </leafNode>
+                          </children>
+                        </node>
+                      </children>
+                    </tagNode>
+                  </children>
+                </tagNode> 
+                <tagNode name="radius-server">
+                  <properties>
+                    <help>IP address of RADIUS server</help>
+                    <valueHelp>
+                      <format>ipv4</format>
+                        <description>IP address of RADIUS server</description>
+                    </valueHelp>
+                  </properties>
+                  <children>
+                    <leafNode name="secret">
+                      <properties>
+                        <help>Key for accessing the specified server</help>
+                      </properties>
+                    </leafNode>
+                   <leafNode name="req-limit">
+                      <properties>
+                        <help>Maximum number of simultaneous requests to server (default: unlimited)</help>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="fail-time">
+                      <properties>
+                        <help>If server doesn't responds mark it as unavailable for this amount of time in seconds</help>
+                      </properties>
+                    </leafNode>
+                  </children>
+                </tagNode>
+                <node name="radius-settings">
+                  <properties>
+                    <help>RADIUS settings</help>
+                  </properties>
+                  <children>
+                    <leafNode name="timeout">
+                      <properties>
+                        <help>Timeout to wait response from server (seconds)</help>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="acct-timeout">
+                      <properties>
+                        <help>Timeout to wait reply for Interim-Update packets. (default 3 seconds)</help>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="max-try">
+                      <properties>
+                        <help>Maximum number of tries to send Access-Request/Accounting-Request queries</help>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="nas-identifier">
+                      <properties>
+                        <help>Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.</help>
+                      </properties>
+                    </leafNode>
+                    <leafNode name="nas-ip-address">
+                      <properties>
+                        <help>Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also DM/CoA server will bind to that address.</help>
+                      </properties>
+                    </leafNode>
+                    <node name="dae-server">
+                      <properties>
+                        <help>IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA)</help>
+                      </properties>
+                      <children>
+                        <leafNode name="ip-address">
+                          <properties>
+                            <help>IP address for Dynamic Authorization Extension server (DM/CoA)</help>
+                          </properties>
+                        </leafNode>
+                        <leafNode name="port">
+                          <properties>
+                            <help>Port for Dynamic Authorization Extension server (DM/CoA)</help>
+                          </properties>
+                        </leafNode>
+                        <leafNode name="secret">
+                          <properties>
+                            <help>Secret for Dynamic Authorization Extension server (DM/CoA)</help>
+                          </properties>
+                        </leafNode>
+                      </children>
+                    </node>
+                  </children>
+                </node>
+            </children>
+          </node>
+        </children>
+      </node>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/op-mode-definitions/ipoe-server.xml b/op-mode-definitions/ipoe-server.xml
new file mode 100644
index 000000000..484201f40
--- /dev/null
+++ b/op-mode-definitions/ipoe-server.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="show">
+    <children>
+      <node name="ipoe-server">
+        <properties>
+          <help>show ipoe-server status</help>
+        </properties>
+        <children>
+          <leafNode name="sessions">
+            <properties>
+              <help>Show active IPoE server sessions</help>
+            </properties>
+            <command>/usr/bin/accel-cmd '-p 2002 show sessions ifname,called-sid,calling-sid,ip,ip6,ip6-dp,rate-limit,state,uptime,sid'</command>
+          </leafNode>
+          <leafNode name="statistics">
+            <properties>
+              <help>Show IPoE server statistics</help>
+            </properties>
+            <command>/usr/bin/accel-cmd '-p 2002 show stat'</command>
+          </leafNode>
+        </children>
+      </node>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/src/conf_mode/ipoe_server.py b/src/conf_mode/ipoe_server.py
new file mode 100755
index 000000000..39f0cb279
--- /dev/null
+++ b/src/conf_mode/ipoe_server.py
@@ -0,0 +1,325 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import sys
+import os
+import re
+import time
+import socket
+import subprocess
+import jinja2
+import syslog as sl
+
+from vyos.config import Config
+from vyos import ConfigError
+
+ipoe_cnf_dir = r'/etc/accel-ppp/ipoe'
+ipoe_cnf = ipoe_cnf_dir + r'/ipoe.config'
+
+pidfile = r'/var/run/accel_ipoe.pid'
+cmd_port = r'2002'
+
+chap_secrets = ipoe_cnf_dir + '/chap-secrets'
+## accel-pppd -d -c /etc/accel-ppp/pppoe/pppoe.config -p /var/run/accel_pppoe.pid
+
+ipoe_config = '''
+### generated by ipoe.py ### 
+[modules]
+log_syslog
+ippool
+ipoe
+shaper
+{% if auth == 'radius' %}
+radius
+{% endif -%}
+{% if auth == 'local' %}
+chap-secrets
+{% endif %}
+
+[core]
+thread-count={{thread_cnt}}
+
+[log]
+syslog=accel-ipoe,daemon
+copy=1
+level=5
+
+[ipoe]
+verbose=1
+{% for intfc in interfaces %}
+interface={{intfc}},\
+shared={{interfaces[intfc]['shared']}},\
+mode={{interfaces[intfc]['mode']}},\
+ifcfg={{interfaces[intfc]['ifcfg']}},\
+range={{interfaces[intfc]['range']}},\
+start={{interfaces[intfc]['sess_start']}}
+{% endfor %}
+{% if auth == 'noauth' %}
+noauth=1
+{% endif %}
+{% if auth == 'local' %}
+username=ifname
+password=csid
+{% endif %}
+
+{% if (dns['server1']) or (dns['server2']) %}
+[dns]
+{% if dns['server1'] %}
+dns1={{dns['server1']}}
+{% endif -%}
+{% if dns['server2'] %}
+dns2={{dns['server2']}}
+{% endif -%}
+{% endif %}
+
+{% if auth == 'local' %}
+[chap-secrets]
+chap-secrets=/etc/accel-ppp/ipoe/chap-secrets 
+{% endif %}
+
+{% if auth == 'radius' %}
+[radius]
+verbose=1
+{% for srv in radius %}
+server={{srv}},{{radius[srv]['secret']}},\
+req-limit={{radius[srv]['req-limit']}},\
+fail-time={{radius[srv]['fail-time']}}
+{% endfor %}
+{% if radsettings['dae-server']['ip-address'] %}
+dae-server={{radsettings['dae-server']['ip-address']}}:{{radsettings['dae-server']['port']}},{{radsettings['dae-server']['secret']}}
+{% endif -%}
+{% if radsettings['acct-timeout'] %}
+acct-timeout={{radsettings['acct-timeout']}}
+{% endif -%}
+{% if radsettings['max-try'] %}
+max-try={{radsettings['max-try']}}
+{% endif -%}
+{% if radsettings['nas-ip-address'] %}
+nas-ip-address={{radsettings['nas-ip-address']}}
+{% endif -%}
+{% if radsettings['nas-identifier'] %}
+nas-identifier={{radsettings['nas-identifier']}}
+{% endif -%}
+{% endif %}
+
+[cli]
+tcp=127.0.0.1:2002
+'''
+
+### pppoe chap secrets
+chap_secrets_conf = '''
+# username  server  password  acceptable local IP addresses   shaper
+{% for aifc in auth_if %}
+{% for mac in auth_if[aifc] %}
+{% if (auth_if[aifc][mac]['up']) and (auth_if[aifc][mac]['down']) %}
+{{aifc}}\t*\t{{mac}}\t*\t{{auth_if[aifc][mac]['down']}}/{{auth_if[aifc][mac]['up']}}
+{% else %}
+{{aifc}}\t*\t{{mac}}\t*
+{% endif %}
+{% endfor %}
+{% endfor %}
+'''
+
+##### Inline functions start ####
+### config path creation
+if not os.path.exists(ipoe_cnf_dir):
+  os.makedirs(ipoe_cnf_dir)
+  sl.syslog(sl.LOG_NOTICE, ipoe_cnf_dir + " created")
+
+def get_cpu():
+  cpu_cnt = 1
+  if os.cpu_count() == 1:
+    cpu_cnt = 1
+  else:
+    cpu_cnt = int(os.cpu_count()/2)
+  return cpu_cnt
+
+def chk_con():
+  cnt = 0
+  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+  while True:
+    try:
+      s.connect(("127.0.0.1", int(cmd_port)))
+      break
+    except ConnectionRefusedError:
+      time.sleep(0.5)
+      cnt +=1
+      if cnt == 100:
+        raise("failed to start pppoe server")
+        break
+
+def accel_cmd(cmd=''):
+  if not cmd:
+    return None
+  try:
+    ret = subprocess.check_output(['/usr/bin/accel-cmd', '-p', cmd_port, cmd]).decode().strip()
+    return ret
+  except:
+    return 1
+
+### chap_secrets file if auth mode local
+def gen_chap_secrets(c):
+  tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True)
+  chap_secrets_txt = tmpl.render(c)
+  old_umask = os.umask(0o077)
+  open(chap_secrets,'w').write(chap_secrets_txt)
+  os.umask(old_umask)
+  sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written')
+
+##### Inline functions end ####
+
+def get_config():
+  c = Config()
+  if not c.exists('service ipoe-server'):
+    return None
+
+  config_data = {}
+
+  c.set_level('service ipoe-server')
+  for intfc in c.list_nodes('interface'):
+    config_data.update(
+      {
+        'interfaces'  : {
+          intfc : {
+            'mode'        : 'L2',
+            'shared'      : '1',
+            'sess_start'  : 'dhcpv4',  ### may need a conifg option, can be dhcpv4 or up for unclassified pkts
+            'range'       : '',
+            'ifcfg'       : '1'
+          }
+        },
+        'dns' : {
+          'server1'     : None,
+          'server2'     : None
+        },
+        'auth'          : 'noauth',
+        'auth_if'       : {},
+        'radius'        : {},
+        'radsettings'   : {
+          'dae-server'  : {}
+        } 
+      }
+    )
+
+    if c.exists('interface ' + intfc + ' network-mode'):
+      config_data['interfaces'][intfc]['mode'] = c.return_value('interface ' + intfc + ' network-mode')
+    if c.return_value('interface ' + intfc + ' network') == 'vlan':
+      config_data['interfaces'][intfc]['shared'] = '0'
+    if c.exists('interface ' + intfc + ' client-subnet'):
+      config_data['interfaces'][intfc]['range'] = c.return_value('interface ' + intfc + ' client-subnet')
+    if c.exists('dns-server server-1'):
+      config_data['dns']['server1'] = c.return_value('dns-server server-1')
+    if c.exists('dns-server server-2'):
+      config_data['dns']['server2'] = c.return_value('dns-server server-2')
+    if not c.exists('authentication mode noauth'):
+      config_data['auth'] = c.return_value('authentication mode')
+    if c.exists('authentication mode local'):
+      for auth_int in c.list_nodes('authentication interface'):
+        for mac in c.list_nodes('authentication interface ' + auth_int + ' mac-address'):
+          config_data['auth_if'][auth_int] = {}
+          if c.exists('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit'):
+            config_data['auth_if'][auth_int][mac] = {}
+            config_data['auth_if'][auth_int][mac]['up'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit upload') 
+            config_data['auth_if'][auth_int][mac]['down'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit download')
+          else:
+            config_data['auth_if'][auth_int][mac] = {}
+            config_data['auth_if'][auth_int][mac]['up'] = None
+            config_data['auth_if'][auth_int][mac]['down'] = None
+    if c.exists('authentication mode radius'):
+      for rsrv in c.list_nodes('authentication radius-server'):
+        config_data['radius'][rsrv] = {}
+        if c.exists('authentication radius-server ' + rsrv + ' secret'):
+          config_data['radius'][rsrv]['secret'] = c.return_value('authentication radius-server ' + rsrv + ' secret')
+        if c.exists('authentication radius-server ' + rsrv + ' fail-time'):
+          config_data['radius'][rsrv]['fail-time'] = c.return_value('authentication radius-server ' + rsrv + ' fail-time')
+        else:
+          config_data['radius'][rsrv]['fail-time'] = '0'
+        if c.exists('authentication radius-server ' + rsrv + ' req-limit'):
+          config_data['radius'][rsrv]['req-limit'] = c.return_value('authentication radius-server ' + rsrv + ' req-limit')
+        else:
+          config_data['radius'][rsrv]['req-limit'] = '0'
+      if c.exists('authentication radius-settings'):
+        if c.exists('authentication radius-settings timeout'):
+          config_data['radsettings']['timeout'] = c.return_value('authentication radius-settings timeout')
+        if c.exists('authentication radius-settings nas-ip-address'):
+           config_data['radsettings']['nas-ip-address'] = c.return_value('authentication radius-settings nas-ip-address')
+        if c.exists('authentication radius-settings nas-identifier'):
+          config_data['radsettings']['nas-identifier'] = c.return_value('authentication radius-settings nas-identifier')
+        if c.exists('authentication radius-settings max-try'):
+          config_data['radsettings']['max-try'] = c.return_value('authentication radius-settings max-try')
+        if c.exists('authentication radius-settings acct-timeout'):
+          config_data['radsettings']['acct-timeout'] = c.return_value('authentication radius-settings acct-timeout')
+        if c.exists('authentication radius-settings dae-server ip-address'):
+          config_data['radsettings']['dae-server']['ip-address'] = c.return_value('authentication radius-settings dae-server ip-address')
+        if c.exists('authentication radius-settings dae-server port'):
+          config_data['radsettings']['dae-server']['port'] = c.return_value('authentication radius-settings dae-server port')
+        if c.exists('authentication radius-settings dae-server secret'):
+           config_data['radsettings']['dae-server']['secret'] = c.return_value('authentication radius-settings dae-server secret')
+  
+  return config_data
+
+def generate(c):
+  if c == None or not c:
+    return None
+  
+  c['thread_cnt'] = get_cpu()
+
+  if c['auth'] == 'local':
+    gen_chap_secrets(c)
+
+  tmpl = jinja2.Template(ipoe_config, trim_blocks=True)
+  config_text = tmpl.render(c)
+
+  open(ipoe_cnf,'w').write(config_text)
+  return c
+
+def verify(c):
+  if c == None or not c:
+    return None
+
+  for intfc in c['interfaces']:
+    if not c['interfaces'][intfc]['range']:
+     raise ConfigError("service ipoe-server interface eth2 client-subnet needs a value") 
+
+def apply(c):
+  if c == None:
+    if os.path.exists(pidfile):
+      accel_cmd('shutdown hard')
+      if os.path.exists(pidfile):
+        os.remove(pidfile)
+    return None
+
+  if not os.path.exists(pidfile):
+    ret = subprocess.call(['/usr/sbin/accel-pppd', '-c', ipoe_cnf, '-p', pidfile, '-d'])
+    chk_con()
+    if ret !=0 and os.path.exists(pidfile):
+      os.remove(pidfile)
+      raise ConfigError('accel-pppd failed to start')
+  else:
+    accel_cmd('restart')
+    sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart")
+
+if __name__ == '__main__':
+  try:
+    c = get_config()
+    verify(c)
+    generate(c)
+    apply(c)
+  except ConfigError as e:
+    print(e)
+    sys.exit(1)