summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorViacheslav Hletenko <v.gletenko@vyos.io>2024-02-02 10:14:35 +0200
committerGitHub <noreply@github.com>2024-02-02 10:14:35 +0200
commitf2de4378b5048fb4fc3a493aa2a214a320dd8d48 (patch)
treec4c389afdc2c14a515bffadfdecf3b691625b928
parent0307801b8928bbaaa20caf5bd10b928bae459490 (diff)
parentd9e57fe65dd538c6ea80637f4f6f23cf11dc583d (diff)
downloadvyos-1x-f2de4378b5048fb4fc3a493aa2a214a320dd8d48.tar.gz
vyos-1x-f2de4378b5048fb4fc3a493aa2a214a320dd8d48.zip
Merge pull request #2891 from aapostoliuk/T5971-circinus
T5971: Rewritten ppp options in accel-ppp services
-rw-r--r--data/templates/accel-ppp/l2tp.config.j227
-rw-r--r--data/templates/accel-ppp/ppp-options.j239
-rw-r--r--data/templates/accel-ppp/pppoe.config.j236
-rw-r--r--data/templates/accel-ppp/pptp.config.j216
-rw-r--r--data/templates/accel-ppp/sstp.config.j214
-rw-r--r--interface-definitions/include/accel-ppp/ppp-options-ipv6-interface-id.xml.i12
-rw-r--r--interface-definitions/include/accel-ppp/ppp-options.xml.i65
-rw-r--r--interface-definitions/include/version/l2tp-version.xml.i2
-rw-r--r--interface-definitions/include/version/pppoe-server-version.xml.i2
-rw-r--r--interface-definitions/include/version/pptp-version.xml.i2
-rw-r--r--interface-definitions/service_pppoe-server.xml.in58
-rw-r--r--interface-definitions/vpn_l2tp.xml.in20
-rw-r--r--interface-definitions/vpn_pptp.xml.in28
-rw-r--r--interface-definitions/vpn_sstp.xml.in13
-rw-r--r--python/vyos/accel_ppp_util.py4
-rw-r--r--smoketest/scripts/cli/base_accel_ppp_test.py67
-rwxr-xr-xsmoketest/scripts/cli/test_service_ipoe-server.py4
-rwxr-xr-xsmoketest/scripts/cli/test_service_pppoe-server.py61
-rwxr-xr-xsmoketest/scripts/cli/test_vpn_l2tp.py52
-rwxr-xr-xsmoketest/scripts/cli/test_vpn_pptp.py23
-rwxr-xr-xsrc/conf_mode/vpn_l2tp.py5
-rwxr-xr-xsrc/conf_mode/vpn_pptp.py30
-rwxr-xr-xsrc/conf_mode/vpn_sstp.py1
-rwxr-xr-xsrc/migration-scripts/l2tp/7-to-868
-rwxr-xr-xsrc/migration-scripts/pppoe-server/8-to-969
-rwxr-xr-xsrc/migration-scripts/pptp/3-to-451
26 files changed, 401 insertions, 368 deletions
diff --git a/data/templates/accel-ppp/l2tp.config.j2 b/data/templates/accel-ppp/l2tp.config.j2
index f041e278e..203a9772e 100644
--- a/data/templates/accel-ppp/l2tp.config.j2
+++ b/data/templates/accel-ppp/l2tp.config.j2
@@ -65,30 +65,8 @@ ipv6-pool-delegate={{ default_ipv6_pool }}
{# Common chap-secrets and RADIUS server/option definitions #}
{% include 'accel-ppp/config_chap_secrets_radius.j2' %}
-[ppp]
-verbose=1
-check-ip=1
-single-session=replace
-lcp-echo-interval={{ ppp_options.lcp_echo_interval }}
-lcp-echo-timeout={{ ppp_options.lcp_echo_timeout }}
-lcp-echo-failure={{ ppp_options.lcp_echo_failure }}
-{# MTU #}
-mtu={{ mtu }}
-ipv6={{ 'allow' if ppp_options.ipv6 is vyos_defined("deny") and client_ipv6_pool is vyos_defined else ppp_options.ipv6 }}
-ipv4={{ ppp_options.ipv4 }}
-mppe={{ ppp_options.mppe }}
-{% if ccp_disable is vyos_defined %}
-ccp=0
-{% endif %}
-unit-preallocate={{ "1" if authentication.radius.preallocate_vif is vyos_defined else "0" }}
-
-{% if ppp_options.ipv6_intf_id is vyos_defined %}
-ipv6-intf-id={{ ppp_options.ipv6_intf_id }}
-{% endif %}
-{% if ppp_options.ipv6_peer_intf_id is vyos_defined %}
-ipv6-peer-intf-id={{ ppp_options.ipv6_peer_intf_id }}
-{% endif %}
-ipv6-accept-peer-intf-id={{ "1" if ppp_options.ipv6_accept_peer_intf_id is vyos_defined else "0" }}
+{# Common ppp-options definitions #}
+{% include 'accel-ppp/ppp-options.j2' %}
{# Common IPv6 pool definitions #}
{% include 'accel-ppp/config_ipv6_pool.j2' %}
@@ -98,5 +76,4 @@ ipv6-accept-peer-intf-id={{ "1" if ppp_options.ipv6_accept_peer_intf_id is vyos_
[cli]
tcp=127.0.0.1:2004
-sessions-columns=ifname,username,calling-sid,ip,{{ ip6_column | join(',') }}{{ ',' if ip6_column }}rate-limit,type,comp,state,rx-bytes,tx-bytes,uptime
diff --git a/data/templates/accel-ppp/ppp-options.j2 b/data/templates/accel-ppp/ppp-options.j2
new file mode 100644
index 000000000..f2d2519d9
--- /dev/null
+++ b/data/templates/accel-ppp/ppp-options.j2
@@ -0,0 +1,39 @@
+#ppp options
+[ppp]
+verbose=1
+check-ip=1
+ccp={{ "0" if ppp_options.disable_ccp is vyos_defined else "1" }}
+unit-preallocate={{ "1" if authentication.radius.preallocate_vif is vyos_defined else "0" }}
+{% if ppp_options.min_mtu is vyos_defined %}
+min-mtu={{ ppp_options.min_mtu }}
+{% endif %}
+{% if ppp_options.mru is vyos_defined %}
+mru={{ ppp_options.mru }}
+{% endif %}
+mppe={{ ppp_options.mppe }}
+lcp-echo-interval={{ ppp_options.lcp_echo_interval }}
+lcp-echo-timeout={{ ppp_options.lcp_echo_timeout }}
+lcp-echo-failure={{ ppp_options.lcp_echo_failure }}
+{% if ppp_options.ipv4 is vyos_defined %}
+ipv4={{ ppp_options.ipv4 }}
+{% endif %}
+{# IPv6 #}
+{% if ppp_options.ipv6 is vyos_defined %}
+ipv6={{ ppp_options.ipv6 }}
+{% if ppp_options.ipv6_interface_id is vyos_defined %}
+ipv6-intf-id={{ ppp_options.ipv6_interface_id }}
+{% endif %}
+{% if ppp_options.ipv6_peer_interface_id is vyos_defined %}
+{% if ppp_options.ipv6_peer_interface_id == 'ipv4-addr' %}
+ipv6-peer-intf-id=ipv4
+{% else %}
+ipv6-peer-intf-id={{ ppp_options.ipv6_peer_interface_id }}
+{% endif %}
+{% endif %}
+ipv6-accept-peer-intf-id={{ "1" if ppp_options.ipv6_accept_peer_interface_id is vyos_defined else "0" }}
+{% endif %}
+{# MTU #}
+mtu={{ mtu }}
+{% if ppp_options.interface_cache is vyos_defined %}
+unit-cache={{ ppp_options.interface_cache }}
+{% endif %}
diff --git a/data/templates/accel-ppp/pppoe.config.j2 b/data/templates/accel-ppp/pppoe.config.j2
index fb8a11366..bf7b2eb72 100644
--- a/data/templates/accel-ppp/pppoe.config.j2
+++ b/data/templates/accel-ppp/pppoe.config.j2
@@ -70,40 +70,8 @@ single-session={{ session_control }}
max-starting={{ max_concurrent_sessions }}
{% endif %}
-[ppp]
-verbose=1
-check-ip=1
-ccp={{ "1" if ppp_options.ccp is vyos_defined else "0" }}
-unit-preallocate={{ "1" if authentication.radius.preallocate_vif is vyos_defined else "0" }}
-{% if ppp_options.min_mtu is vyos_defined %}
-min-mtu={{ ppp_options.min_mtu }}
-{% endif %}
-{% if ppp_options.mru is vyos_defined %}
-mru={{ ppp_options.mru }}
-{% endif %}
-mppe={{ ppp_options.mppe }}
-lcp-echo-interval={{ ppp_options.lcp_echo_interval }}
-lcp-echo-timeout={{ ppp_options.lcp_echo_timeout }}
-lcp-echo-failure={{ ppp_options.lcp_echo_failure }}
-{% if ppp_options.ipv4 is vyos_defined %}
-ipv4={{ ppp_options.ipv4 }}
-{% endif %}
-{# IPv6 #}
-{% if ppp_options.ipv6 is vyos_defined %}
-ipv6={{ ppp_options.ipv6 }}
-{% if ppp_options.ipv6_intf_id is vyos_defined %}
-ipv6-intf-id={{ ppp_options.ipv6_intf_id }}
-{% endif %}
-{% if ppp_options.ipv6_peer_intf_id is vyos_defined %}
-ipv6-peer-intf-id={{ ppp_options.ipv6_peer_intf_id }}
-{% endif %}
-ipv6-accept-peer-intf-id={{ "1" if ppp_options.ipv6_accept_peer_intf_id is vyos_defined else "0" }}
-{% endif %}
-{# MTU #}
-mtu={{ mtu }}
-{% if ppp_options.interface_cache is vyos_defined %}
-unit-cache={{ ppp_options.interface_cache }}
-{% endif %}
+{# Common ppp-options definitions #}
+{% include 'accel-ppp/ppp-options.j2' %}
[pppoe]
verbose=1
diff --git a/data/templates/accel-ppp/pptp.config.j2 b/data/templates/accel-ppp/pptp.config.j2
index daafd6e92..7fe4b17bf 100644
--- a/data/templates/accel-ppp/pptp.config.j2
+++ b/data/templates/accel-ppp/pptp.config.j2
@@ -6,6 +6,8 @@ shaper
{# Common authentication backend definitions #}
{% include 'accel-ppp/config_modules_auth_mode.j2' %}
ippool
+{# Common IPv6 definitions #}
+{% include 'accel-ppp/config_modules_ipv6.j2' %}
{# Common authentication protocols (pap, chap ...) #}
{% if authentication.require is vyos_defined %}
{% if authentication.require == 'chap' %}
@@ -40,7 +42,6 @@ wins{{ loop.index }}={{ server }}
{% endfor %}
{% endif %}
-
[pptp]
ifname=pptp%d
{% if outside_address is vyos_defined %}
@@ -54,6 +55,10 @@ echo-failure=3
{% if default_pool is vyos_defined %}
ip-pool={{ default_pool }}
{% endif %}
+{% if default_ipv6_pool is vyos_defined %}
+ipv6-pool={{ default_ipv6_pool }}
+ipv6-pool-delegate={{ default_ipv6_pool }}
+{% endif %}
[client-ip-range]
0.0.0.0/0
@@ -61,10 +66,11 @@ ip-pool={{ default_pool }}
{# Common IP pool definitions #}
{% include 'accel-ppp/config_ip_pool.j2' %}
-[ppp]
-verbose=5
-check-ip=1
-single-session=replace
+{# Common IPv6 pool definitions #}
+{% include 'accel-ppp/config_ipv6_pool.j2' %}
+
+{# Common ppp-options definitions #}
+{% include 'accel-ppp/ppp-options.j2' %}
{# Common chap-secrets and RADIUS server/option definitions #}
{% include 'accel-ppp/config_chap_secrets_radius.j2' %}
diff --git a/data/templates/accel-ppp/sstp.config.j2 b/data/templates/accel-ppp/sstp.config.j2
index 51f7dfca8..c0bc62d9f 100644
--- a/data/templates/accel-ppp/sstp.config.j2
+++ b/data/templates/accel-ppp/sstp.config.j2
@@ -56,18 +56,8 @@ ipv6-pool-delegate={{ default_ipv6_pool }}
{# Common chap-secrets and RADIUS server/option definitions #}
{% include 'accel-ppp/config_chap_secrets_radius.j2' %}
-[ppp]
-verbose=1
-check-ip=1
-{# MTU #}
-mtu={{ mtu }}
-unit-preallocate={{ "1" if authentication.radius.preallocate_vif is vyos_defined else "0" }}
-ipv6={{ 'allow' if ppp_options.ipv6 is vyos_defined("deny") and client_ipv6_pool is vyos_defined else ppp_options.ipv6 }}
-ipv4={{ ppp_options.ipv4 }}
-mppe={{ ppp_options.mppe }}
-lcp-echo-interval={{ ppp_options.lcp_echo_interval }}
-lcp-echo-timeout={{ ppp_options.lcp_echo_timeout }}
-lcp-echo-failure={{ ppp_options.lcp_echo_failure }}
+{# Common ppp-options definitions #}
+{% include 'accel-ppp/ppp-options.j2' %}
{# Common RADIUS shaper configuration #}
{% include 'accel-ppp/config_shaper_radius.j2' %}
diff --git a/interface-definitions/include/accel-ppp/ppp-options-ipv6-interface-id.xml.i b/interface-definitions/include/accel-ppp/ppp-options-ipv6-interface-id.xml.i
index 265f7f97c..c4cf0a458 100644
--- a/interface-definitions/include/accel-ppp/ppp-options-ipv6-interface-id.xml.i
+++ b/interface-definitions/include/accel-ppp/ppp-options-ipv6-interface-id.xml.i
@@ -1,5 +1,5 @@
<!-- include start from accel-ppp/ppp-options-ipv6-interface-id.xml.i -->
-<leafNode name="ipv6-intf-id">
+<leafNode name="ipv6-interface-id">
<properties>
<help>Fixed or random interface identifier for IPv6</help>
<completionHelp>
@@ -18,11 +18,11 @@
</constraint>
</properties>
</leafNode>
-<leafNode name="ipv6-peer-intf-id">
+<leafNode name="ipv6-peer-interface-id">
<properties>
<help>Peer interface identifier for IPv6</help>
<completionHelp>
- <list>random calling-sid ipv4</list>
+ <list>random calling-sid ipv4-addr</list>
</completionHelp>
<valueHelp>
<format>x:x:x:x</format>
@@ -33,7 +33,7 @@
<description>Use a random interface identifier for IPv6</description>
</valueHelp>
<valueHelp>
- <format>ipv4</format>
+ <format>ipv4-addr</format>
<description>Calculate interface identifier from IPv4 address, for example 192:168:0:1</description>
</valueHelp>
<valueHelp>
@@ -41,11 +41,11 @@
<description>Calculate interface identifier from calling-station-id</description>
</valueHelp>
<constraint>
- <regex>(random|calling-sid|ipv4|((\d+){1,4}:){3}(\d+){1,4})</regex>
+ <regex>(random|calling-sid|ipv4-addr|((\d+){1,4}:){3}(\d+){1,4})</regex>
</constraint>
</properties>
</leafNode>
-<leafNode name="ipv6-accept-peer-intf-id">
+<leafNode name="ipv6-accept-peer-interface-id">
<properties>
<help>Accept peer interface identifier</help>
<valueless/>
diff --git a/interface-definitions/include/accel-ppp/ppp-options.xml.i b/interface-definitions/include/accel-ppp/ppp-options.xml.i
new file mode 100644
index 000000000..9b4f1d0ca
--- /dev/null
+++ b/interface-definitions/include/accel-ppp/ppp-options.xml.i
@@ -0,0 +1,65 @@
+<!-- include start from accel-ppp/ppp-options.xml.i -->
+<node name="ppp-options">
+ <properties>
+ <help>Advanced protocol options</help>
+ </properties>
+ <children>
+ <leafNode name="min-mtu">
+ <properties>
+ <help>Minimum acceptable MTU (68-65535)</help>
+ <constraint>
+ <validator name="numeric" argument="--range 68-65535"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ <leafNode name="mru">
+ <properties>
+ <help>Preferred MRU (68-65535)</help>
+ <constraint>
+ <validator name="numeric" argument="--range 68-65535"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ <leafNode name="disable-ccp">
+ <properties>
+ <help>Disable Compression Control Protocol (CCP)</help>
+ <valueless />
+ </properties>
+ </leafNode>
+ #include <include/accel-ppp/ppp-mppe.xml.i>
+ #include <include/accel-ppp/lcp-echo-interval-failure.xml.i>
+ #include <include/accel-ppp/lcp-echo-timeout.xml.i>
+ #include <include/accel-ppp/ppp-interface-cache.xml.i>
+ <leafNode name="ipv4">
+ <properties>
+ <help>IPv4 (IPCP) negotiation algorithm</help>
+ <constraint>
+ <regex>(deny|allow|prefer|require)</regex>
+ </constraint>
+ <constraintErrorMessage>invalid value</constraintErrorMessage>
+ <valueHelp>
+ <format>deny</format>
+ <description>Do not negotiate IPv4</description>
+ </valueHelp>
+ <valueHelp>
+ <format>allow</format>
+ <description>Negotiate IPv4 only if client requests</description>
+ </valueHelp>
+ <valueHelp>
+ <format>prefer</format>
+ <description>Ask client for IPv4 negotiation, do not fail if it rejects</description>
+ </valueHelp>
+ <valueHelp>
+ <format>require</format>
+ <description>Require IPv4 negotiation</description>
+ </valueHelp>
+ <completionHelp>
+ <list>deny allow prefer require</list>
+ </completionHelp>
+ </properties>
+ </leafNode>
+ #include <include/accel-ppp/ppp-options-ipv6.xml.i>
+ #include <include/accel-ppp/ppp-options-ipv6-interface-id.xml.i>
+ </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/version/l2tp-version.xml.i b/interface-definitions/include/version/l2tp-version.xml.i
index 793cd5d0c..01004c5a0 100644
--- a/interface-definitions/include/version/l2tp-version.xml.i
+++ b/interface-definitions/include/version/l2tp-version.xml.i
@@ -1,3 +1,3 @@
<!-- include start from include/version/l2tp-version.xml.i -->
-<syntaxVersion component='l2tp' version='7'></syntaxVersion>
+<syntaxVersion component='l2tp' version='8'></syntaxVersion>
<!-- include end -->
diff --git a/interface-definitions/include/version/pppoe-server-version.xml.i b/interface-definitions/include/version/pppoe-server-version.xml.i
index 02f98cc16..c253c58d9 100644
--- a/interface-definitions/include/version/pppoe-server-version.xml.i
+++ b/interface-definitions/include/version/pppoe-server-version.xml.i
@@ -1,3 +1,3 @@
<!-- include start from include/version/pppoe-server-version.xml.i -->
-<syntaxVersion component='pppoe-server' version='8'></syntaxVersion>
+<syntaxVersion component='pppoe-server' version='9'></syntaxVersion>
<!-- include end -->
diff --git a/interface-definitions/include/version/pptp-version.xml.i b/interface-definitions/include/version/pptp-version.xml.i
index 4386cedbd..3e1482ecc 100644
--- a/interface-definitions/include/version/pptp-version.xml.i
+++ b/interface-definitions/include/version/pptp-version.xml.i
@@ -1,3 +1,3 @@
<!-- include start from include/version/pptp-version.xml.i -->
-<syntaxVersion component='pptp' version='3'></syntaxVersion>
+<syntaxVersion component='pptp' version='4'></syntaxVersion>
<!-- include end -->
diff --git a/interface-definitions/service_pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in
index 6fdc2a65a..477ed115f 100644
--- a/interface-definitions/service_pppoe-server.xml.in
+++ b/interface-definitions/service_pppoe-server.xml.in
@@ -103,68 +103,12 @@
</properties>
</leafNode>
#include <include/accel-ppp/wins-server.xml.i>
+ #include <include/accel-ppp/ppp-options.xml.i>
<node name="ppp-options">
- <properties>
- <help>Advanced protocol options</help>
- </properties>
<children>
<leafNode name="min-mtu">
- <properties>
- <help>Minimum acceptable MTU (68-65535)</help>
- <constraint>
- <validator name="numeric" argument="--range 68-65535"/>
- </constraint>
- </properties>
<defaultValue>1280</defaultValue>
</leafNode>
- <leafNode name="mru">
- <properties>
- <help>Preferred MRU (68-65535)</help>
- <constraint>
- <validator name="numeric" argument="--range 68-65535"/>
- </constraint>
- </properties>
- </leafNode>
- <leafNode name="ccp">
- <properties>
- <help>CCP negotiation (default disabled)</help>
- <valueless />
- </properties>
- </leafNode>
- #include <include/accel-ppp/ppp-mppe.xml.i>
- #include <include/accel-ppp/lcp-echo-interval-failure.xml.i>
- #include <include/accel-ppp/lcp-echo-timeout.xml.i>
- #include <include/accel-ppp/ppp-interface-cache.xml.i>
- <leafNode name="ipv4">
- <properties>
- <help>IPv4 (IPCP) negotiation algorithm</help>
- <constraint>
- <regex>(deny|allow|prefer|require)</regex>
- </constraint>
- <constraintErrorMessage>invalid value</constraintErrorMessage>
- <valueHelp>
- <format>deny</format>
- <description>Do not negotiate IPv4</description>
- </valueHelp>
- <valueHelp>
- <format>allow</format>
- <description>Negotiate IPv4 only if client requests</description>
- </valueHelp>
- <valueHelp>
- <format>prefer</format>
- <description>Ask client for IPv4 negotiation, do not fail if it rejects</description>
- </valueHelp>
- <valueHelp>
- <format>require</format>
- <description>Require IPv4 negotiation</description>
- </valueHelp>
- <completionHelp>
- <list>deny allow prefer require</list>
- </completionHelp>
- </properties>
- </leafNode>
- #include <include/accel-ppp/ppp-options-ipv6.xml.i>
- #include <include/accel-ppp/ppp-options-ipv6-interface-id.xml.i>
</children>
</node>
<tagNode name="pado-delay">
diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in
index d3fb58433..942690bca 100644
--- a/interface-definitions/vpn_l2tp.xml.in
+++ b/interface-definitions/vpn_l2tp.xml.in
@@ -49,12 +49,6 @@
</leafNode>
</children>
</node>
- <leafNode name="ccp-disable">
- <properties>
- <help>Disable Compression Control Protocol (CCP)</help>
- <valueless />
- </properties>
- </leafNode>
<node name="ipsec-settings">
<properties>
<help>Internet Protocol Security (IPsec) for remote access L2TP VPN</help>
@@ -140,19 +134,7 @@
</node>
</children>
</node>
- <node name="ppp-options">
- <properties>
- <help>Advanced protocol options</help>
- </properties>
- <children>
- #include <include/accel-ppp/ppp-mppe.xml.i>
- #include <include/accel-ppp/ppp-options-ipv4.xml.i>
- #include <include/accel-ppp/ppp-options-ipv6.xml.i>
- #include <include/accel-ppp/ppp-options-ipv6-interface-id.xml.i>
- #include <include/accel-ppp/lcp-echo-interval-failure.xml.i>
- #include <include/accel-ppp/lcp-echo-timeout.xml.i>
- </children>
- </node>
+ #include <include/accel-ppp/ppp-options.xml.i>
#include <include/accel-ppp/default-pool.xml.i>
#include <include/accel-ppp/default-ipv6-pool.xml.i>
</children>
diff --git a/interface-definitions/vpn_pptp.xml.in b/interface-definitions/vpn_pptp.xml.in
index ec622b5d0..d23086c02 100644
--- a/interface-definitions/vpn_pptp.xml.in
+++ b/interface-definitions/vpn_pptp.xml.in
@@ -27,7 +27,7 @@
</properties>
</leafNode>
#include <include/accel-ppp/gateway-address.xml.i>
- #include <include/name-server-ipv4.xml.i>
+ #include <include/name-server-ipv4-ipv6.xml.i>
#include <include/accel-ppp/wins-server.xml.i>
#include <include/accel-ppp/client-ip-pool.xml.i>
<node name="authentication">
@@ -63,30 +63,6 @@
</properties>
<defaultValue>mschap-v2</defaultValue>
</leafNode>
- <leafNode name="mppe">
- <properties>
- <help>Specifies mppe negotioation preference. (default require mppe 128-bit stateless</help>
- <valueHelp>
- <format>deny</format>
- <description>deny mppe</description>
- </valueHelp>
- <valueHelp>
- <format>prefer</format>
- <description>ask client for mppe, if it rejects do not fail</description>
- </valueHelp>
- <valueHelp>
- <format>require</format>
- <description>ask client for mppe, if it rejects drop connection</description>
- </valueHelp>
- <constraint>
- <regex>(deny|prefer|require)</regex>
- </constraint>
- <completionHelp>
- <list>deny prefer require</list>
- </completionHelp>
- </properties>
- <defaultValue>prefer</defaultValue>
- </leafNode>
#include <include/accel-ppp/auth-mode.xml.i>
<node name="local-users">
<properties>
@@ -134,7 +110,9 @@
</children>
</node>
#include <include/accel-ppp/default-pool.xml.i>
+ #include <include/accel-ppp/client-ipv6-pool.xml.i>
#include <include/accel-ppp/default-ipv6-pool.xml.i>
+ #include <include/accel-ppp/ppp-options.xml.i>
</children>
</node>
</children>
diff --git a/interface-definitions/vpn_sstp.xml.in b/interface-definitions/vpn_sstp.xml.in
index 2727540be..0d5d53301 100644
--- a/interface-definitions/vpn_sstp.xml.in
+++ b/interface-definitions/vpn_sstp.xml.in
@@ -37,18 +37,7 @@
</leafNode>
#include <include/accel-ppp/default-pool.xml.i>
#include <include/accel-ppp/default-ipv6-pool.xml.i>
- <node name="ppp-options">
- <properties>
- <help>PPP (Point-to-Point Protocol) settings</help>
- </properties>
- <children>
- #include <include/accel-ppp/ppp-mppe.xml.i>
- #include <include/accel-ppp/ppp-options-ipv4.xml.i>
- #include <include/accel-ppp/ppp-options-ipv6.xml.i>
- #include <include/accel-ppp/lcp-echo-interval-failure.xml.i>
- #include <include/accel-ppp/lcp-echo-timeout.xml.i>
- </children>
- </node>
+ #include <include/accel-ppp/ppp-options.xml.i>
<node name="ssl">
<properties>
<help>SSL Certificate, SSL Key and CA</help>
diff --git a/python/vyos/accel_ppp_util.py b/python/vyos/accel_ppp_util.py
index 2f029e042..d60402e48 100644
--- a/python/vyos/accel_ppp_util.py
+++ b/python/vyos/accel_ppp_util.py
@@ -187,13 +187,13 @@ def verify_accel_ppp_ip_pool(vpn_config):
for ipv6_pool, ipv6_pool_config in vpn_config['client_ipv6_pool'].items():
if 'delegate' in ipv6_pool_config and 'prefix' not in ipv6_pool_config:
raise ConfigError(
- f'IPoE IPv6 deletate-prefix requires IPv6 prefix to be configured in "{ipv6_pool}"!')
+ f'IPv6 delegate-prefix requires IPv6 prefix to be configured in "{ipv6_pool}"!')
if dict_search('authentication.mode', vpn_config) in ['local', 'noauth']:
if not dict_search('client_ip_pool', vpn_config) and not dict_search(
'client_ipv6_pool', vpn_config):
raise ConfigError(
- "L2TP local auth mode requires local client-ip-pool or client-ipv6-pool to be configured!")
+ "Local auth mode requires local client-ip-pool or client-ipv6-pool to be configured!")
if dict_search('client_ip_pool', vpn_config) and not dict_search(
'default_pool', vpn_config):
Warning("'default-pool' is not defined")
diff --git a/smoketest/scripts/cli/base_accel_ppp_test.py b/smoketest/scripts/cli/base_accel_ppp_test.py
index 6219a0a4c..0e6e522b9 100644
--- a/smoketest/scripts/cli/base_accel_ppp_test.py
+++ b/smoketest/scripts/cli/base_accel_ppp_test.py
@@ -492,3 +492,70 @@ class BasicAccelPPPTest:
delegate={delegate_1_prefix},{delegate_mask},name={pool_name}
delegate={delegate_2_prefix},{delegate_mask},name={pool_name}"""
self.assertIn(pool_config, config)
+
+ def test_accel_ppp_options(self):
+ # Test configuration of local authentication for PPPoE server
+ self.basic_config()
+
+ # other settings
+ mppe = 'require'
+ self.set(['ppp-options', 'disable-ccp'])
+ self.set(['ppp-options', 'mppe', mppe])
+
+ # min-mtu
+ min_mtu = '1400'
+ self.set(['ppp-options', 'min-mtu', min_mtu])
+
+ # mru
+ mru = '9000'
+ self.set(['ppp-options', 'mru', mru])
+
+ # interface-cache
+ interface_cache = '128000'
+ self.set(['ppp-options', 'interface-cache', interface_cache])
+
+ # ipv6
+ allow_ipv6 = 'allow'
+ allow_ipv4 = 'require'
+ random = 'random'
+ lcp_failure = '4'
+ lcp_interval = '40'
+ lcp_timeout = '100'
+ self.set(['ppp-options', 'ipv4', allow_ipv4])
+ self.set(['ppp-options', 'ipv6', allow_ipv6])
+ self.set(['ppp-options', 'ipv6-interface-id', random])
+ self.set(['ppp-options', 'ipv6-accept-peer-interface-id'])
+ self.set(['ppp-options', 'ipv6-peer-interface-id', random])
+ self.set(['ppp-options', 'lcp-echo-failure', lcp_failure])
+ self.set(['ppp-options', 'lcp-echo-interval', lcp_interval])
+ self.set(['ppp-options', 'lcp-echo-timeout', lcp_timeout])
+ # commit changes
+ self.cli_commit()
+
+ # Validate configuration values
+ conf = ConfigParser(allow_no_value=True, delimiters='=')
+ conf.read(self._config_file)
+
+ self.assertEqual(conf['chap-secrets']['gw-ip-address'], self._gateway)
+
+ # check ppp
+ self.assertEqual(conf['ppp']['mppe'], mppe)
+ self.assertEqual(conf['ppp']['min-mtu'], min_mtu)
+ self.assertEqual(conf['ppp']['mru'], mru)
+
+ self.assertEqual(conf['ppp']['ccp'],'0')
+
+ # check interface-cache
+ self.assertEqual(conf['ppp']['unit-cache'], interface_cache)
+
+ #check ipv6
+ for tmp in ['ipv6pool', 'ipv6_nd', 'ipv6_dhcp']:
+ self.assertEqual(conf['modules'][tmp], None)
+
+ self.assertEqual(conf['ppp']['ipv6'], allow_ipv6)
+ self.assertEqual(conf['ppp']['ipv6-intf-id'], random)
+ self.assertEqual(conf['ppp']['ipv6-peer-intf-id'], random)
+ self.assertTrue(conf['ppp'].getboolean('ipv6-accept-peer-intf-id'))
+ self.assertEqual(conf['ppp']['lcp-echo-failure'], lcp_failure)
+ self.assertEqual(conf['ppp']['lcp-echo-interval'], lcp_interval)
+ self.assertEqual(conf['ppp']['lcp-echo-timeout'], lcp_timeout) \ No newline at end of file
diff --git a/smoketest/scripts/cli/test_service_ipoe-server.py b/smoketest/scripts/cli/test_service_ipoe-server.py
index cec6adb09..20a168b58 100755
--- a/smoketest/scripts/cli/test_service_ipoe-server.py
+++ b/smoketest/scripts/cli/test_service_ipoe-server.py
@@ -228,5 +228,9 @@ delegate={delegate_1_prefix},{delegate_mask},name={pool_name}
delegate={delegate_2_prefix},{delegate_mask},name={pool_name}"""
self.assertIn(pool_config, config)
+ @unittest.skip("PPP is not a part of IPoE")
+ def test_accel_ppp_options(self):
+ pass
+
if __name__ == "__main__":
unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_service_pppoe-server.py b/smoketest/scripts/cli/test_service_pppoe-server.py
index 11d5b8b78..d7c7aa164 100755
--- a/smoketest/scripts/cli/test_service_pppoe-server.py
+++ b/smoketest/scripts/cli/test_service_pppoe-server.py
@@ -59,9 +59,6 @@ class TestServicePPPoEServer(BasicAccelPPPTest.TestCase):
self.assertTrue(conf['ppp'].getboolean('verbose'))
self.assertTrue(conf['ppp'].getboolean('check-ip'))
self.assertEqual(conf['ppp']['mtu'], mtu)
- self.assertEqual(conf['ppp']['lcp-echo-interval'], '30')
- self.assertEqual(conf['ppp']['lcp-echo-timeout'], '0')
- self.assertEqual(conf['ppp']['lcp-echo-failure'], '3')
super().verify(conf)
@@ -70,70 +67,14 @@ class TestServicePPPoEServer(BasicAccelPPPTest.TestCase):
self.set(['access-concentrator', ac_name])
self.set(['interface', interface])
-
- def test_pppoe_server_ppp_options(self):
- # Test configuration of local authentication for PPPoE server
+ def test_pppoe_limits(self):
self.basic_config()
-
- # other settings
- mppe = 'require'
- self.set(['ppp-options', 'ccp'])
- self.set(['ppp-options', 'mppe', mppe])
self.set(['limits', 'connection-limit', '20/min'])
-
- # min-mtu
- min_mtu = '1400'
- self.set(['ppp-options', 'min-mtu', min_mtu])
-
- # mru
- mru = '9000'
- self.set(['ppp-options', 'mru', mru])
-
- # interface-cache
- interface_cache = '128000'
- self.set(['ppp-options', 'interface-cache', interface_cache])
-
- # ipv6
- allow_ipv6 = 'allow'
- random = 'random'
- self.set(['ppp-options', 'ipv6', allow_ipv6])
- self.set(['ppp-options', 'ipv6-intf-id', random])
- self.set(['ppp-options', 'ipv6-accept-peer-intf-id'])
- self.set(['ppp-options', 'ipv6-peer-intf-id', random])
- # commit changes
self.cli_commit()
-
- # Validate configuration values
conf = ConfigParser(allow_no_value=True, delimiters='=')
conf.read(self._config_file)
-
- # basic verification
- self.verify(conf)
-
- self.assertEqual(conf['chap-secrets']['gw-ip-address'], self._gateway)
-
- # check ppp
- self.assertEqual(conf['ppp']['mppe'], mppe)
- self.assertEqual(conf['ppp']['min-mtu'], min_mtu)
- self.assertEqual(conf['ppp']['mru'], mru)
-
- self.assertTrue(conf['ppp'].getboolean('ccp'))
-
- # check other settings
self.assertEqual(conf['connlimit']['limit'], '20/min')
- # check interface-cache
- self.assertEqual(conf['ppp']['unit-cache'], interface_cache)
-
- #check ipv6
- for tmp in ['ipv6pool', 'ipv6_nd', 'ipv6_dhcp']:
- self.assertEqual(conf['modules'][tmp], None)
-
- self.assertEqual(conf['ppp']['ipv6'], allow_ipv6)
- self.assertEqual(conf['ppp']['ipv6-intf-id'], random)
- self.assertEqual(conf['ppp']['ipv6-peer-intf-id'], random)
- self.assertTrue(conf['ppp'].getboolean('ipv6-accept-peer-intf-id'))
-
def test_pppoe_server_authentication_protocols(self):
# Test configuration of local authentication for PPPoE server
self.basic_config()
diff --git a/smoketest/scripts/cli/test_vpn_l2tp.py b/smoketest/scripts/cli/test_vpn_l2tp.py
index 129a9c602..3d9d94f52 100755
--- a/smoketest/scripts/cli/test_vpn_l2tp.py
+++ b/smoketest/scripts/cli/test_vpn_l2tp.py
@@ -38,58 +38,6 @@ class TestVPNL2TPServer(BasicAccelPPPTest.TestCase):
def basic_protocol_specific_config(self):
pass
- def test_l2tp_server_ppp_options(self):
- # Test configuration of local authentication for PPPoE server
- self.basic_config()
- mtu = '1425'
- lcp_echo_failure = '5'
- lcp_echo_interval = '40'
- lcp_echo_timeout = '3000'
- # other settings
- mppe = 'require'
- self.set(['ccp-disable'])
- self.set(['ppp-options', 'mppe', mppe])
- self.set(['authentication', 'radius', 'preallocate-vif'])
- self.set(['mtu', mtu])
- self.set(['ppp-options', 'lcp-echo-failure', lcp_echo_failure])
- self.set(['ppp-options', 'lcp-echo-interval', lcp_echo_interval])
- self.set(['ppp-options', 'lcp-echo-timeout', lcp_echo_timeout])
-
- allow_ipv6 = 'allow'
- random = 'random'
- self.set(['ppp-options', 'ipv6', allow_ipv6])
- self.set(['ppp-options', 'ipv6-intf-id', random])
- self.set(['ppp-options', 'ipv6-accept-peer-intf-id'])
- self.set(['ppp-options', 'ipv6-peer-intf-id', random])
-
- # commit changes
- self.cli_commit()
-
- # Validate configuration values
- conf = ConfigParser(allow_no_value=True, delimiters='=')
- conf.read(self._config_file)
-
- # basic verification
- self.verify(conf)
-
- # check ppp
- self.assertEqual(conf['ppp']['mppe'], mppe)
- self.assertFalse(conf['ppp'].getboolean('ccp'))
- self.assertEqual(conf['ppp']['unit-preallocate'], '1')
- self.assertTrue(conf['ppp'].getboolean('verbose'))
- self.assertTrue(conf['ppp'].getboolean('check-ip'))
- self.assertEqual(conf['ppp']['mtu'], mtu)
- self.assertEqual(conf['ppp']['lcp-echo-interval'], lcp_echo_interval)
- self.assertEqual(conf['ppp']['lcp-echo-timeout'], lcp_echo_timeout)
- self.assertEqual(conf['ppp']['lcp-echo-failure'], lcp_echo_failure)
-
- for tmp in ['ipv6pool', 'ipv6_nd', 'ipv6_dhcp']:
- self.assertEqual(conf['modules'][tmp], None)
- self.assertEqual(conf['ppp']['ipv6'], allow_ipv6)
- self.assertEqual(conf['ppp']['ipv6-intf-id'], random)
- self.assertEqual(conf['ppp']['ipv6-peer-intf-id'], random)
- self.assertTrue(conf['ppp'].getboolean('ipv6-accept-peer-intf-id'))
-
def test_l2tp_server_authentication_protocols(self):
# Test configuration of local authentication for PPPoE server
self.basic_config()
diff --git a/smoketest/scripts/cli/test_vpn_pptp.py b/smoketest/scripts/cli/test_vpn_pptp.py
index f3fce822b..40dcb7f80 100755
--- a/smoketest/scripts/cli/test_vpn_pptp.py
+++ b/smoketest/scripts/cli/test_vpn_pptp.py
@@ -40,25 +40,6 @@ class TestVPNPPTPServer(BasicAccelPPPTest.TestCase):
def basic_protocol_specific_config(self):
pass
- def test_accel_name_servers(self):
- # Verify proper Name-Server configuration for IPv4
- self.basic_config()
-
- nameserver = ["192.0.2.1", "192.0.2.2"]
- for ns in nameserver:
- self.set(["name-server", ns])
-
- # commit changes
- self.cli_commit()
-
- # Validate configuration values
- conf = ConfigParser(allow_no_value=True, delimiters="=", strict=False)
- conf.read(self._config_file)
-
- # IPv4 and IPv6 nameservers must be checked individually
- for ns in nameserver:
- self.assertIn(ns, [conf["dns"]["dns1"], conf["dns"]["dns2"]])
-
def test_accel_local_authentication(self):
# Test configuration of local authentication
self.basic_config()
@@ -218,10 +199,6 @@ class TestVPNPPTPServer(BasicAccelPPPTest.TestCase):
self.assertEqual(f"req-limit=0", server[4])
self.assertEqual(f"fail-time=0", server[5])
- @unittest.skip("IPv6 is not implemented in PPTP")
- def test_accel_ipv6_pool(self):
- pass
-
if __name__ == '__main__':
unittest.main(verbosity=2)
diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py
index b569ca140..36b3d2a30 100755
--- a/src/conf_mode/vpn_l2tp.py
+++ b/src/conf_mode/vpn_l2tp.py
@@ -51,11 +51,6 @@ def get_config(config=None):
# Multiple named pools require ordered values T5099
l2tp['ordered_named_pools'] = get_pools_in_order(
dict_search('client_ip_pool', l2tp))
- l2tp['ip6_column'] = []
- if dict_search('client_ipv6_pool.prefix', l2tp):
- l2tp['ip6_column'].append('ipv6')
- if dict_search('client_ipv6_pool.delegate', l2tp):
- l2tp['ip6_column'].append('ip6-db')
l2tp['server_type'] = 'l2tp'
return l2tp
diff --git a/src/conf_mode/vpn_pptp.py b/src/conf_mode/vpn_pptp.py
index 0629625bf..b1d5067d5 100755
--- a/src/conf_mode/vpn_pptp.py
+++ b/src/conf_mode/vpn_pptp.py
@@ -22,6 +22,7 @@ from vyos.config import Config
from vyos.template import render
from vyos.utils.process import call
from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import verify_accel_ppp_base_service
from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
from vyos.accel_ppp_util import get_pools_in_order
from vyos import ConfigError
@@ -58,36 +59,10 @@ def get_config(config=None):
def verify(pptp):
if not pptp:
return None
- auth_mode = dict_search('authentication.mode', pptp)
- if auth_mode == 'local':
- if not dict_search('authentication.local_users', pptp):
- raise ConfigError(
- 'PPTP local auth mode requires local users to be configured!')
-
- for user in dict_search('authentication.local_users.username', pptp):
- user_config = pptp['authentication']['local_users']['username'][
- user]
- if 'password' not in user_config:
- raise ConfigError(f'Password required for local user "{user}"')
-
- elif auth_mode == 'radius':
- if not dict_search('authentication.radius.server', pptp):
- raise ConfigError(
- 'RADIUS authentication requires at least one server')
- for server in dict_search('authentication.radius.server', pptp):
- radius_config = pptp['authentication']['radius']['server'][server]
- if 'key' not in radius_config:
- raise ConfigError(
- f'Missing RADIUS secret key for server "{server}"')
+ verify_accel_ppp_base_service(pptp)
verify_accel_ppp_ip_pool(pptp)
- if 'name_server' in pptp:
- if len(pptp['name_server']) > 2:
- raise ConfigError(
- 'Not more then two IPv4 DNS name-servers can be configured'
- )
-
if 'wins_server' in pptp and len(pptp['wins_server']) > 2:
raise ConfigError(
'Not more then two WINS name-servers can be configured')
@@ -105,6 +80,7 @@ def generate(pptp):
return None
+
def apply(pptp):
if not pptp:
call('systemctl stop accel-ppp@pptp.service')
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
index a84513a0f..5c229fe62 100755
--- a/src/conf_mode/vpn_sstp.py
+++ b/src/conf_mode/vpn_sstp.py
@@ -20,7 +20,6 @@ from sys import exit
from vyos.config import Config
from vyos.configdict import get_accel_dict
-from vyos.configdict import dict_merge
from vyos.pki import wrap_certificate
from vyos.pki import wrap_private_key
from vyos.template import render
diff --git a/src/migration-scripts/l2tp/7-to-8 b/src/migration-scripts/l2tp/7-to-8
new file mode 100755
index 000000000..4956e1155
--- /dev/null
+++ b/src/migration-scripts/l2tp/7-to-8
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# Migrate from 'ccp-disable' to 'ppp-options.disable-ccp'
+# Migration ipv6 options
+
+import os
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+
+if len(argv) < 2:
+ print("Must specify file name!")
+ exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+ config_file = f.read()
+
+config = ConfigTree(config_file)
+base = ['vpn', 'l2tp', 'remote-access']
+if not config.exists(base):
+ exit(0)
+
+#CCP migration
+if config.exists(base + ['ccp-disable']):
+ config.delete(base + ['ccp-disable'])
+ config.set(base + ['ppp-options', 'disable-ccp'])
+
+#IPV6 options migrations
+if config.exists(base + ['ppp-options','ipv6-peer-intf-id']):
+ intf_peer_id = config.return_value(base + ['ppp-options','ipv6-peer-intf-id'])
+ if intf_peer_id == 'ipv4':
+ intf_peer_id = 'ipv4-addr'
+ config.set(base + ['ppp-options','ipv6-peer-interface-id'], value=intf_peer_id, replace=True)
+ config.delete(base + ['ppp-options','ipv6-peer-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-intf-id']):
+ intf_id = config.return_value(base + ['ppp-options','ipv6-intf-id'])
+ config.set(base + ['ppp-options','ipv6-interface-id'], value=intf_id, replace=True)
+ config.delete(base + ['ppp-options','ipv6-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-accept-peer-intf-id']):
+ config.set(base + ['ppp-options','ipv6-accept-peer-interface-id'])
+ config.delete(base + ['ppp-options','ipv6-accept-peer-intf-id'])
+
+try:
+ with open(file_name, 'w') as f:
+ f.write(config.to_string())
+except OSError as e:
+ print("Failed to save the modified config: {}".format(e))
+ exit(1)
diff --git a/src/migration-scripts/pppoe-server/8-to-9 b/src/migration-scripts/pppoe-server/8-to-9
new file mode 100755
index 000000000..ad75c28a1
--- /dev/null
+++ b/src/migration-scripts/pppoe-server/8-to-9
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# Change from 'ccp' to 'disable-ccp' in ppp-option section
+# Migration ipv6 options
+
+import os
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+
+if len(argv) < 2:
+ print("Must specify file name!")
+ exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+ config_file = f.read()
+
+config = ConfigTree(config_file)
+base = ['service', 'pppoe-server']
+if not config.exists(base):
+ exit(0)
+
+#CCP migration
+if config.exists(base + ['ppp-options', 'ccp']):
+ config.delete(base + ['ppp-options', 'ccp'])
+else:
+ config.set(base + ['ppp-options', 'disable-ccp'])
+
+#IPV6 options migrations
+if config.exists(base + ['ppp-options','ipv6-peer-intf-id']):
+ intf_peer_id = config.return_value(base + ['ppp-options','ipv6-peer-intf-id'])
+ if intf_peer_id == 'ipv4':
+ intf_peer_id = 'ipv4-addr'
+ config.set(base + ['ppp-options','ipv6-peer-interface-id'], value=intf_peer_id, replace=True)
+ config.delete(base + ['ppp-options','ipv6-peer-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-intf-id']):
+ intf_id = config.return_value(base + ['ppp-options','ipv6-intf-id'])
+ config.set(base + ['ppp-options','ipv6-interface-id'], value=intf_id, replace=True)
+ config.delete(base + ['ppp-options','ipv6-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-accept-peer-intf-id']):
+ config.set(base + ['ppp-options','ipv6-accept-peer-interface-id'])
+ config.delete(base + ['ppp-options','ipv6-accept-peer-intf-id'])
+
+try:
+ with open(file_name, 'w') as f:
+ f.write(config.to_string())
+except OSError as e:
+ print("Failed to save the modified config: {}".format(e))
+ exit(1)
diff --git a/src/migration-scripts/pptp/3-to-4 b/src/migration-scripts/pptp/3-to-4
new file mode 100755
index 000000000..0a8dad2f4
--- /dev/null
+++ b/src/migration-scripts/pptp/3-to-4
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# - Move 'mppe' from 'authentication' node to 'ppp-options'
+
+import os
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+
+if len(argv) < 2:
+ print("Must specify file name!")
+ exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+ config_file = f.read()
+
+config = ConfigTree(config_file)
+base = ['vpn', 'pptp', 'remote-access']
+
+if not config.exists(base):
+ exit(0)
+
+if config.exists(base + ['authentication','mppe']):
+ mppe = config.return_value(base + ['authentication','mppe'])
+ config.set(base + ['ppp-options', 'mppe'], value=mppe, replace=True)
+ config.delete(base + ['authentication','mppe'])
+
+try:
+ with open(file_name, 'w') as f:
+ f.write(config.to_string())
+except OSError as e:
+ print("Failed to save the modified config: {}".format(e))
+ exit(1)