pppoe: T3090: migrate to vyos.ifconfig library to use the full potential

Now that MSS clamping is done on the "per-interface" level the entire PPPoE
stuff would have needed to get a full copy in GNU BASH for this or, participate
in the common library.

Add a new PPP ip-up script named 99-vyos-pppoe-callback which will call the
vyos.ifconfig.PPPoEIf.update() function to configure everything as done with
all other interfaces. This removes duplicated code for VRF assignment and route
installation when a PPPoE interface is brought up or down.

7 files changed, 230 insertions, 80 deletions

diff --git a/Makefile b/Makefile
index 0aa35d17d..2c79f545d 100644
--- a/Makefile
+++ b/Makefile
@@ -84,7 +84,7 @@ clean:
 
 .PHONY: test
 test:
-	set -e; python3 -m compileall -q -x '/vmware-tools/scripts/' .
+	set -e; python3 -m compileall -q -x '/vmware-tools/scripts/, /ppp/' .
 	PYTHONPATH=python/ python3 -m "nose" --with-xunit src --with-coverage --cover-erase --cover-xml --cover-package src/conf_mode,src/op_mode,src/completion,src/helpers,src/validators,src/tests --verbose
 
 .PHONY: sonar
diff --git a/data/templates/pppoe/ipv6-up.script.tmpl b/data/templates/pppoe/ipv6-up.script.tmpl
index 7e1bc33b4..da73cb4d5 100644
--- a/data/templates/pppoe/ipv6-up.script.tmpl
+++ b/data/templates/pppoe/ipv6-up.script.tmpl
@@ -7,43 +7,6 @@ if [ "$6" != "{{ ifname }}" ]; then
     exit
 fi
 
-{% if ipv6 is defined and ipv6.address is defined and ipv6.address.autoconf is defined %}
-# add some info to syslog
-DIALER_PID=$(cat /var/run/{{ ifname }}.pid)
-logger -t pppd[$DIALER_PID] "executing $0"
-logger -t pppd[$DIALER_PID] "configuring interface {{ ifname }} via {{ source_interface }}"
-
-# Configure interface-specific Host/Router behaviour.
-# Note: It is recommended to have the same setting on all interfaces; mixed
-# router/host scenarios are rather uncommon. Possible values are:
-#
-# 0  Forwarding disabled
-# 1  Forwarding enabled
-#
-echo 1 > /proc/sys/net/ipv6/conf/{{ ifname }}/forwarding
-
-# Accept Router Advertisements; autoconfigure using them.
-#
-# It also determines whether or not to transmit Router
-# Solicitations. If and only if the functional setting is to
-# accept Router Advertisements, Router Solicitations will be
-# transmitted. Possible values are:
-#
-# 0  Do not accept Router Advertisements.
-# 1  Accept Router Advertisements if forwarding is disabled.
-# 2  Overrule forwarding behaviour. Accept Router Advertisements
-#    even if forwarding is enabled.
-#
-echo 2 > /proc/sys/net/ipv6/conf/{{ ifname }}/accept_ra
-
-# Autoconfigure addresses using Prefix Information in Router Advertisements.
-echo 1 > /proc/sys/net/ipv6/conf/{{ ifname }}/autoconf
-{% endif %}
-
-{% if dhcpv6_options is defined and dhcpv6_options.pd is defined %}
-# Start wide dhcpv6 client
-systemctl restart dhcp6c@{{ ifname }}.service
-{% endif %}
 
 {% if default_route != 'none' %}
 # See https://phabricator.vyos.net/T2248 & T2220. Determine if we are enslaved
diff --git a/data/templates/pppoe/peer.tmpl b/data/templates/pppoe/peer.tmpl
index 0f78f9384..e8fda2cae 100644
--- a/data/templates/pppoe/peer.tmpl
+++ b/data/templates/pppoe/peer.tmpl
@@ -30,7 +30,7 @@ connect /bin/true
 noauth
 
 # Don't try to proxy ARP for the remote endpoint. User can set proxy
-# arp entries up manually if they wish.  More importantly, having
+# arp entries up manually if they wish. More importantly, having
 # the "proxyarp" parameter set disables the "defaultroute" option.
 noproxyarp
 
@@ -71,8 +71,14 @@ demand
 # passed to the ip-up.d/ip-down.s scripts which is required for VRF support.
 {%   if 'auto' in default_route %}
 defaultroute
+{{ 'defaultroute6' if ipv6 is defined }}
 {%   elif 'force' in default_route %}
 defaultroute
 replacedefaultroute
+{{ 'defaultroute6' if ipv6 is defined }}
 {%   endif %}
+{% else %}
+nodefaultroute
+noreplacedefaultroute
+{{ 'nodefaultroute6' if ipv6 is defined }}
 {% endif %}
diff --git a/debian/vyos-1x.install b/debian/vyos-1x.install
index 7ca568eff..d332e0d36 100644
--- a/debian/vyos-1x.install
+++ b/debian/vyos-1x.install
@@ -3,6 +3,7 @@ etc/dhcp
 etc/ipsec.d
 etc/netplug
 etc/opennhrp
+etc/ppp
 etc/rsyslog.d
 etc/securetty
 etc/security
diff --git a/python/vyos/ifconfig/pppoe.py b/python/vyos/ifconfig/pppoe.py
index 6acf7d1c7..9153863de 100644
--- a/python/vyos/ifconfig/pppoe.py
+++ b/python/vyos/ifconfig/pppoe.py
@@ -1,4 +1,4 @@
-# Copyright 2020 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2020-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -14,6 +14,7 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from vyos.ifconfig.interface import Interface
+from vyos.util import get_interface_config
 
 @Interface.register
 class PPPoEIf(Interface):
@@ -26,7 +27,31 @@ class PPPoEIf(Interface):
         },
     }
 
-    # stub this interface is created in the configure script
+    def _remove_routes(self, vrf=''):
+        # Always delete default routes when interface is removed
+        if vrf:
+            vrf = f'-c "vrf {vrf}"'
+        self._cmd(f'vtysh -c "conf t" {vrf} -c "no ip route 0.0.0.0/0 {self.ifname} tag 210"')
+        self._cmd(f'vtysh -c "conf t" {vrf} -c "no ipv6 route ::/0 {self.ifname} tag 210"')
+
+    def remove(self):
+        """
+        Remove interface from operating system. Removing the interface
+        deconfigures all assigned IP addresses and clear possible DHCP(v6)
+        client processes.
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> i = Interface('pppoe0')
+        >>> i.remove()
+        """
+
+        tmp = get_interface_config(self.ifname)
+        vrf = ''
+        if 'master' in tmp:
+            self._remove_routes(tmp['master'])
+
+        # remove bond master which places members in disabled state
+        super().remove()
 
     def _create(self):
         # we can not create this interface as it is managed outside
@@ -35,3 +60,84 @@ class PPPoEIf(Interface):
     def _delete(self):
         # we can not create this interface as it is managed outside
         pass
+
+    def del_addr(self, addr):
+        # we can not create this interface as it is managed outside
+        pass
+
+    def get_mac(self):
+        """ Get a synthetic MAC address. """
+        return self.get_mac_synthetic()
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # remove old routes from an e.g. old VRF assignment
+        vrf = ''
+        if 'vrf_old' in config:
+            vrf = config['vrf_old']
+        self._remove_routes(vrf)
+
+        # DHCPv6 PD handling is a bit different on PPPoE interfaces, as we do
+        # not require an 'address dhcpv6' CLI option as with other interfaces
+        if 'dhcpv6_options' in config and 'pd' in config['dhcpv6_options']:
+            self.set_dhcpv6(True)
+        else:
+            self.set_dhcpv6(False)
+
+        super().update(config)
+
+        if 'default_route' not in config or config['default_route'] == 'none':
+            return
+
+        #
+        # Set default routes pointing to pppoe interface
+        #
+        vrf = ''
+        sed_opt = '^ip route'
+
+        install_v4 = True
+        install_v6 = True
+
+        # generate proper configuration string when VRFs are in use
+        if 'vrf' in config:
+            tmp = config['vrf']
+            vrf = f'-c "vrf {tmp}"'
+            sed_opt = f'vrf {tmp}'
+
+        if config['default_route'] == 'auto':
+            # only add route if there is no default route present
+            tmp = self._cmd(f'vtysh -c "show running-config staticd no-header" | sed -n "/{sed_opt}/,/!/p"')
+            for line in tmp.splitlines():
+                line = line.lstrip()
+                if line.startswith('ip route 0.0.0.0/0'):
+                    install_v4 = False
+                    continue
+
+                if 'ipv6' in config and line.startswith('ipv6 route ::/0'):
+                    install_v6 = False
+                    continue
+
+        elif config['default_route'] == 'force':
+            # Force means that all static routes are replaced with the ones from this interface
+            tmp = self._cmd(f'vtysh -c "show running-config staticd no-header" | sed -n "/{sed_opt}/,/!/p"')
+            for line in tmp.splitlines():
+                if self.ifname in line:
+                    # It makes no sense to remove a route with our interface and the later re-add it.
+                    # This will only make traffic disappear - which is a no-no!
+                    continue
+
+                line = line.lstrip()
+                if line.startswith('ip route 0.0.0.0/0'):
+                    self._cmd(f'vtysh -c "conf t" {vrf} -c "no {line}"')
+
+                if 'ipv6' in config and line.startswith('ipv6 route ::/0'):
+                    self._cmd(f'vtysh -c "conf t" {vrf} -c "no {line}"')
+
+        if install_v4:
+            self._cmd(f'vtysh -c "conf t" {vrf} -c "ip route 0.0.0.0/0 {self.ifname} tag 210"')
+        if install_v6 and 'ipv6' in config:
+            self._cmd(f'vtysh -c "conf t" {vrf} -c "ipv6 route ::/0 {self.ifname} tag 210"')
diff --git a/src/conf_mode/interfaces-pppoe.py b/src/conf_mode/interfaces-pppoe.py
index 6c4c6c95b..584adc75e 100755
--- a/src/conf_mode/interfaces-pppoe.py
+++ b/src/conf_mode/interfaces-pppoe.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2020 VyOS maintainers and contributors
+# Copyright (C) 2019-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -22,12 +22,16 @@ from netifaces import interfaces
 
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
+from vyos.configdict import leaf_node_changed
 from vyos.configverify import verify_authentication
 from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_interface_exists
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_mtu_ipv6
+from vyos.ifconfig import PPPoEIf
 from vyos.template import render
 from vyos.util import call
+from vyos.util import is_systemd_service_running
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -44,6 +48,32 @@ def get_config(config=None):
     base = ['interfaces', 'pppoe']
     pppoe = get_interface_dict(conf, base)
 
+    # We should only terminate the PPPoE session if critical parameters change.
+    # All parameters that can be changed on-the-fly (like interface description)
+    # should not lead to a reconnect!
+    tmp = leaf_node_changed(conf, ['access-concentrator'])
+    if tmp: pppoe.update({'shutdown_required': {}})
+
+    tmp = leaf_node_changed(conf, ['connect-on-demand'])
+    if tmp: pppoe.update({'shutdown_required': {}})
+
+    tmp = leaf_node_changed(conf, ['service-name'])
+    if tmp: pppoe.update({'shutdown_required': {}})
+
+    tmp = leaf_node_changed(conf, ['source-interface'])
+    if tmp: pppoe.update({'shutdown_required': {}})
+
+    tmp = leaf_node_changed(conf, ['vrf'])
+    # leaf_node_changed() returns a list, as VRF is a non-multi node, there
+    # will be only one list element
+    if tmp: pppoe.update({'vrf_old': tmp[0]})
+
+    tmp = leaf_node_changed(conf, ['authentication', 'user'])
+    if tmp: pppoe.update({'shutdown_required': {}})
+
+    tmp = leaf_node_changed(conf, ['authentication', 'password'])
+    if tmp: pppoe.update({'shutdown_required': {}})
+
     return pppoe
 
 def verify(pppoe):
@@ -66,57 +96,42 @@ def generate(pppoe):
     # rendered into
     ifname = pppoe['ifname']
     config_pppoe = f'/etc/ppp/peers/{ifname}'
-    script_pppoe_pre_up = f'/etc/ppp/ip-pre-up.d/1000-vyos-pppoe-{ifname}'
-    script_pppoe_ip_up = f'/etc/ppp/ip-up.d/1000-vyos-pppoe-{ifname}'
-    script_pppoe_ip_down = f'/etc/ppp/ip-down.d/1000-vyos-pppoe-{ifname}'
-    script_pppoe_ipv6_up = f'/etc/ppp/ipv6-up.d/1000-vyos-pppoe-{ifname}'
-    config_wide_dhcp6c = f'/run/dhcp6c/dhcp6c.{ifname}.conf'
-
-    config_files = [config_pppoe, script_pppoe_pre_up, script_pppoe_ip_up,
-                    script_pppoe_ip_down, script_pppoe_ipv6_up, config_wide_dhcp6c]
 
     if 'deleted' in pppoe or 'disable' in pppoe:
-        # stop DHCPv6-PD client
-        call(f'systemctl stop dhcp6c@{ifname}.service')
-        # Hang-up PPPoE connection
-        call(f'systemctl stop ppp@{ifname}.service')
-
-        # Delete PPP configuration files
-        for file in config_files:
-            if os.path.exists(file):
-                os.unlink(file)
+        if os.path.exists(config_pppoe):
+            os.unlink(config_pppoe)
 
         return None
 
     # Create PPP configuration files
-    render(config_pppoe, 'pppoe/peer.tmpl', pppoe, permission=0o755)
-
-    # Create script for ip-pre-up.d
-    render(script_pppoe_pre_up, 'pppoe/ip-pre-up.script.tmpl', pppoe,
-           permission=0o755)
-    # Create script for ip-up.d
-    render(script_pppoe_ip_up, 'pppoe/ip-up.script.tmpl', pppoe,
-           permission=0o755)
-    # Create script for ip-down.d
-    render(script_pppoe_ip_down, 'pppoe/ip-down.script.tmpl', pppoe,
-           permission=0o755)
-    # Create script for ipv6-up.d
-    render(script_pppoe_ipv6_up, 'pppoe/ipv6-up.script.tmpl', pppoe,
-           permission=0o755)
-
-    if 'dhcpv6_options' in pppoe and 'pd' in pppoe['dhcpv6_options']:
-        # ipv6.tmpl relies on ifname - this should be made consitent in the
-        # future better then double key-ing the same value
-        render(config_wide_dhcp6c, 'dhcp-client/ipv6.tmpl', pppoe)
+    render(config_pppoe, 'pppoe/peer.tmpl', pppoe, permission=0o640)
 
     return None
 
 def apply(pppoe):
+    ifname = pppoe['ifname']
     if 'deleted' in pppoe or 'disable' in pppoe:
-        call('systemctl stop ppp@{ifname}.service'.format(**pppoe))
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = PPPoEIf(ifname)
+            p.remove()
+        call(f'systemctl stop ppp@{ifname}.service')
         return None
 
-    call('systemctl restart ppp@{ifname}.service'.format(**pppoe))
+    # reconnect should only be necessary when certain config options change,
+    # like ACS name, authentication, no-peer-dns, source-interface
+    if ((not is_systemd_service_running(f'ppp@{ifname}.service')) or
+        'shutdown_required' in pppoe):
+
+        # cleanup system (e.g. FRR routes first)
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = PPPoEIf(ifname)
+            p.remove()
+
+        call(f'systemctl restart ppp@{ifname}.service')
+    else:
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = PPPoEIf(ifname)
+            p.update(pppoe)
 
     return None
 
diff --git a/src/etc/ppp/ip-up.d/99-vyos-pppoe-callback b/src/etc/ppp/ip-up.d/99-vyos-pppoe-callback
new file mode 100755
index 000000000..bb918a468
--- /dev/null
+++ b/src/etc/ppp/ip-up.d/99-vyos-pppoe-callback
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# This is a Python hook script which is invoked whenever a PPPoE session goes
+# "ip-up". It will call into our vyos.ifconfig library and will then execute
+# common tasks for the PPPoE interface. The reason we have to "hook" this is
+# that we can not create a pppoeX interface in advance in linux and then connect
+# pppd to this already existing interface.
+
+from sys import argv
+from sys import exit
+
+from syslog import syslog
+from syslog import openlog
+from syslog import LOG_PID
+from syslog import LOG_INFO
+
+from vyos.configquery import ConfigTreeQuery
+from vyos.ifconfig import PPPoEIf
+from vyos.util import read_file
+
+# When the ppp link comes up, this script is called with the following
+# parameters
+#       $1      the interface name used by pppd (e.g. ppp3)
+#       $2      the tty device name
+#       $3      the tty device speed
+#       $4      the local IP address for the interface
+#       $5      the remote IP address
+#       $6      the parameter specified by the 'ipparam' option to pppd
+
+if (len(argv) < 7):
+    exit(1)
+
+interface = argv[6]
+dialer_pid = read_file(f'/var/run/{interface}.pid')
+
+openlog(ident=f'pppd[{dialer_pid}]', facility=LOG_INFO)
+syslog('executing ' + argv[0])
+
+conf = ConfigTreeQuery()
+pppoe = conf.get_config_dict(['interfaces', 'pppoe', argv[6]],
+                             get_first_key=True, key_mangling=('-', '_'))
+pppoe['ifname'] = argv[6]
+
+p = PPPoEIf(pppoe['ifname'])
+p.update(pppoe)