Merge remote-tracking branch 'upstream/current' into current

4 files changed, 233 insertions, 26 deletions

diff --git a/smoketest/scripts/cli/test_interfaces_bridge.py b/smoketest/scripts/cli/test_interfaces_bridge.py
index bc0bb69c6..a1359680b 100755
--- a/smoketest/scripts/cli/test_interfaces_bridge.py
+++ b/smoketest/scripts/cli/test_interfaces_bridge.py
@@ -18,6 +18,8 @@ import os
 import unittest
 
 from base_interfaces_test import BasicInterfaceTest
+from glob import glob
+from netifaces import interfaces
 from vyos.ifconfig import Section
 
 class BridgeInterfaceTest(BasicInterfaceTest.BaseTest):
@@ -44,6 +46,7 @@ class BridgeInterfaceTest(BasicInterfaceTest.BaseTest):
             self._options['br0'].append(f'member interface {member}')
 
     def test_add_remove_member(self):
+        """ Add member interfaces to bridge and set STP cost/priority """
         for interface in self._interfaces:
             base = self._base_path + [interface]
             self.session.set(base + ['stp'])
@@ -59,12 +62,46 @@ class BridgeInterfaceTest(BasicInterfaceTest.BaseTest):
                 cost += 1
                 priority += 1
 
+        # commit config
         self.session.commit()
 
+        # check member interfaces are added on the bridge
+        bridge_members = []
+        for tmp in glob(f'/sys/class/net/{interface}/lower_*'):
+            bridge_members.append(os.path.basename(tmp).replace('lower_', ''))
+
+        for member in self._members:
+            self.assertIn(member, bridge_members)
+
+        # delete all members
         for interface in self._interfaces:
             self.session.delete(self._base_path + [interface, 'member'])
 
         self.session.commit()
 
+    def test_vlan_members(self):
+        """ T2945: ensure that VIFs are not dropped from bridge """
+
+        self.session.set(['interfaces', 'ethernet', 'eth0', 'vif', '300'])
+        self.session.set(['interfaces', 'bridge', 'br0', 'member', 'interface', 'eth0.300'])
+        self.session.commit()
+
+        # member interface must be assigned to the bridge
+        self.assertTrue(os.path.exists('/sys/class/net/br0/lower_eth0.300'))
+
+        # add second bridge member
+        self.session.set(['interfaces', 'ethernet', 'eth0', 'vif', '400'])
+        self.session.commit()
+
+        # member interface must still be assigned to the bridge
+        self.assertTrue(os.path.exists('/sys/class/net/br0/lower_eth0.300'))
+
+        # remove VLAN interfaces
+        self.session.delete(['interfaces', 'ethernet', 'eth0', 'vif', '300'])
+        self.session.delete(['interfaces', 'ethernet', 'eth0', 'vif', '400'])
+        self.session.commit()
+
+
 if __name__ == '__main__':
     unittest.main()
+
diff --git a/smoketest/scripts/cli/test_interfaces_macsec.py b/smoketest/scripts/cli/test_interfaces_macsec.py
index 6d1be86ba..177d2b946 100755
--- a/smoketest/scripts/cli/test_interfaces_macsec.py
+++ b/smoketest/scripts/cli/test_interfaces_macsec.py
@@ -105,7 +105,7 @@ class MACsecInterfaceTest(BasicInterfaceTest.BaseTest):
             # Check for running process
             self.assertTrue(process_named_running('wpa_supplicant'))
 
-    def test_mandatory_toptions(self):
+    def test_mandatory_options(self):
         interface = 'macsec1'
         self.session.set(self._base_path + [interface])
 
diff --git a/smoketest/scripts/cli/test_interfaces_wireguard.py b/smoketest/scripts/cli/test_interfaces_wireguard.py
index 0c32a4696..726405780 100755
--- a/smoketest/scripts/cli/test_interfaces_wireguard.py
+++ b/smoketest/scripts/cli/test_interfaces_wireguard.py
@@ -38,10 +38,8 @@ class WireGuardInterfaceTest(unittest.TestCase):
         self.session.commit()
         del self.session
 
-    def test_peer_setup(self):
-        """
-        Create WireGuard interfaces with associated peers
-        """
+    def test_peer(self):
+        """ Create WireGuard interfaces with associated peers """
         for intf in self._interfaces:
             peer = 'foo-' + intf
             psk = 'u2xdA70hkz0S1CG0dZlOh0aq2orwFXRIVrKo4DCvHgM='
@@ -64,5 +62,37 @@ class WireGuardInterfaceTest(unittest.TestCase):
 
             self.assertTrue(os.path.isdir(f'/sys/class/net/{intf}'))
 
+
+    def test_add_remove_peer(self):
+        """ Create WireGuard interfaces with associated peers. Remove one of
+        the configured peers. Bug reported as T2939 """
+        interface = 'wg0'
+        port = '12345'
+        pubkey_1 = 'n1CUsmR0M2LUUsyicBd6blZICwUqqWWHbu4ifZ2/9gk='
+        pubkey_2 = 'ebFx/1G0ti8tvuZd94sEIosAZZIznX+dBAKG/8DFm0I='
+
+        self.session.set(base_path + [interface, 'address', '172.16.0.1/24'])
+
+        self.session.set(base_path + [interface, 'peer', 'PEER01', 'pubkey', pubkey_1])
+        self.session.set(base_path + [interface, 'peer', 'PEER01', 'port', port])
+        self.session.set(base_path + [interface, 'peer', 'PEER01', 'allowed-ips', '10.205.212.10/32'])
+        self.session.set(base_path + [interface, 'peer', 'PEER01', 'address', '192.0.2.1'])
+
+        self.session.set(base_path + [interface, 'peer', 'PEER02', 'pubkey', pubkey_2])
+        self.session.set(base_path + [interface, 'peer', 'PEER02', 'port', port])
+        self.session.set(base_path + [interface, 'peer', 'PEER02', 'allowed-ips', '10.205.212.11/32'])
+        self.session.set(base_path + [interface, 'peer', 'PEER02', 'address', '192.0.2.2'])
+
+        # Commit peers
+        self.session.commit()
+
+        self.assertTrue(os.path.isdir(f'/sys/class/net/{interface}'))
+
+        # Delete second peer
+        self.session.delete(base_path + [interface, 'peer', 'PEER01'])
+        self.session.commit()
+
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/smoketest/scripts/cli/test_service_pppoe-server.py b/smoketest/scripts/cli/test_service_pppoe-server.py
index 3a6b12ef4..2e435fa67 100755
--- a/smoketest/scripts/cli/test_service_pppoe-server.py
+++ b/smoketest/scripts/cli/test_service_pppoe-server.py
@@ -15,12 +15,14 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
+import re
 import unittest
 
 from configparser import ConfigParser
 from vyos.configsession import ConfigSession
 from vyos.configsession import ConfigSessionError
 from vyos.util import process_named_running
+from vyos.util import cmd
 
 process_name = 'accel-pppd'
 base_path = ['service', 'pppoe-server']
@@ -28,10 +30,8 @@ local_if = ['interfaces', 'dummy', 'dum667']
 pppoe_conf = '/run/accel-pppd/pppoe.conf'
 
 ac_name = 'ACN'
-subnet = '172.18.0.0/24'
 gateway = '192.0.2.1'
 nameserver = '9.9.9.9'
-mtu = '1492'
 interface = 'eth0'
 
 class TestServicePPPoEServer(unittest.TestCase):
@@ -48,10 +48,12 @@ class TestServicePPPoEServer(unittest.TestCase):
         del self.session
 
     def verify(self, conf):
+        mtu = '1492'
+
         # validate some common values in the configuration
-        for tmp in ['log_syslog', 'pppoe', 'chap-secrets', 'ippool', 'ipv6pool',
-                    'ipv6_nd', 'ipv6_dhcp', 'auth_mschap_v2', 'auth_mschap_v1',
-                    'auth_chap_md5', 'auth_pap', 'shaper']:
+        for tmp in ['log_syslog', 'pppoe', 'chap-secrets', 'ippool',
+                    'auth_mschap_v2', 'auth_mschap_v1', 'auth_chap_md5',
+                    'auth_pap', 'shaper']:
             # Settings without values provide None
             self.assertEqual(conf['modules'][tmp], None)
 
@@ -60,14 +62,9 @@ class TestServicePPPoEServer(unittest.TestCase):
         self.assertTrue(conf['pppoe'].getboolean('verbose'))
         self.assertTrue(conf['pppoe']['interface'], interface)
 
-        # check configured subnet
-        self.assertEqual(conf['ip-pool'][subnet], None)
-        self.assertEqual(conf['ip-pool']['gw-ip-address'], gateway)
-
         # check ppp
         self.assertTrue(conf['ppp'].getboolean('verbose'))
         self.assertTrue(conf['ppp'].getboolean('check-ip'))
-        self.assertEqual(conf['ppp']['min-mtu'], mtu)
         self.assertEqual(conf['ppp']['mtu'], mtu)
         self.assertEqual(conf['ppp']['lcp-echo-interval'], '30')
         self.assertEqual(conf['ppp']['lcp-echo-timeout'], '0')
@@ -76,24 +73,46 @@ class TestServicePPPoEServer(unittest.TestCase):
     def basic_config(self):
         self.session.set(local_if + ['address', '192.0.2.1/32'])
 
+        # PPPoE local auth mode requires local users to be configured!
+        self.session.set(base_path + ['authentication', 'local-users', 'username', 'vyos', 'password', 'vyos'])
+        self.session.set(base_path + ['authentication', 'mode', 'local'])
+
         self.session.set(base_path + ['access-concentrator', ac_name])
         self.session.set(base_path + ['authentication', 'mode', 'local'])
-        self.session.set(base_path + ['client-ip-pool', 'subnet', subnet])
         self.session.set(base_path + ['name-server', nameserver])
         self.session.set(base_path + ['interface', interface])
         self.session.set(base_path + ['local-ip', gateway])
 
-    def test_local_auth(self):
+    def test_local_user(self):
         """ Test configuration of local authentication for PPPoE server """
         self.basic_config()
-        # authentication
-        self.session.set(base_path + ['authentication', 'local-users', 'username', 'vyos', 'password', 'vyos'])
-        self.session.set(base_path + ['authentication', 'mode', 'local'])
+
         # other settings
         self.session.set(base_path + ['ppp-options', 'ccp'])
         self.session.set(base_path + ['ppp-options', 'mppe', 'require'])
         self.session.set(base_path + ['limits', 'connection-limit', '20/min'])
 
+        # upload / download limit
+        user = 'test'
+        password = 'test2'
+        static_ip = '100.100.100.101'
+        self.session.set(base_path + ['authentication', 'local-users', 'username', user, 'password', password])
+        self.session.set(base_path + ['authentication', 'local-users', 'username', user, 'static-ip', static_ip])
+        self.session.set(base_path + ['authentication', 'local-users', 'username', user, 'rate-limit', 'upload', '5000'])
+
+        # upload rate-limit requires also download rate-limit
+        with self.assertRaises(ConfigSessionError):
+            self.session.commit()
+        self.session.set(base_path + ['authentication', 'local-users', 'username', user, 'rate-limit', 'download', '10000'])
+
+        # min-mtu
+        min_mtu = '1400'
+        self.session.set(base_path + ['ppp-options', 'min-mtu', min_mtu])
+
+        # mru
+        mru = '9000'
+        self.session.set(base_path + ['ppp-options', 'mru', mru])
+
         # commit changes
         self.session.commit()
 
@@ -108,13 +127,22 @@ class TestServicePPPoEServer(unittest.TestCase):
         self.assertEqual(conf['chap-secrets']['chap-secrets'], '/run/accel-pppd/pppoe.chap-secrets')
         self.assertEqual(conf['chap-secrets']['gw-ip-address'], gateway)
 
-        # check pado
+        # check ppp
         self.assertEqual(conf['ppp']['mppe'], 'require')
+        self.assertEqual(conf['ppp']['min-mtu'], min_mtu)
+        self.assertEqual(conf['ppp']['mru'], mru)
+
         self.assertTrue(conf['ppp'].getboolean('ccp'))
 
         # check other settings
         self.assertEqual(conf['connlimit']['limit'], '20/min')
 
+        # check local users
+        tmp = cmd('sudo cat /run/accel-pppd/pppoe.chap-secrets')
+        regex = f'{user}\s+\*\s+{password}\s+{static_ip}\s+10000/5000'
+        tmp = re.findall(regex, tmp)
+        self.assertTrue(tmp)
+
         # Check for running process
         self.assertTrue(process_named_running(process_name))
 
@@ -124,12 +152,30 @@ class TestServicePPPoEServer(unittest.TestCase):
         radius_key = 'secretVyOS'
         radius_port = '2000'
         radius_port_acc = '3000'
+        radius_acct_interim_jitter = '9'
+        radius_called_sid = 'ifname:mac'
 
         self.basic_config()
+
+        self.session.set(base_path + ['authentication', 'mode', 'radius'])
         self.session.set(base_path + ['authentication', 'radius', 'server', radius_server, 'key', radius_key])
         self.session.set(base_path + ['authentication', 'radius', 'server', radius_server, 'port', radius_port])
         self.session.set(base_path + ['authentication', 'radius', 'server', radius_server, 'acct-port', radius_port_acc])
-        self.session.set(base_path + ['authentication', 'mode', 'radius'])
+        self.session.set(base_path + ['authentication', 'radius', 'acct-interim-jitter', radius_acct_interim_jitter])
+        self.session.set(base_path + ['authentication', 'radius', 'called-sid-format', radius_called_sid])
+
+        coa_server = '4.4.4.4'
+        coa_key = 'testCoA'
+        self.session.set(base_path + ['authentication', 'radius', 'dynamic-author', 'server', coa_server])
+        self.session.set(base_path + ['authentication', 'radius', 'dynamic-author', 'key', coa_key])
+
+        nas_id = 'VyOS-PPPoE'
+        nas_ip = '7.7.7.7'
+        self.session.set(base_path + ['authentication', 'radius', 'nas-identifier', nas_id])
+        self.session.set(base_path + ['authentication', 'radius', 'nas-ip-address', nas_ip])
+
+        source_address = '1.2.3.4'
+        self.session.set(base_path + ['authentication', 'radius', 'source-address', source_address])
 
         # commit changes
         self.session.commit()
@@ -143,10 +189,16 @@ class TestServicePPPoEServer(unittest.TestCase):
 
         # check auth
         self.assertTrue(conf['radius'].getboolean('verbose'))
-        self.assertTrue(conf['radius']['acct-timeout'], '3')
-        self.assertTrue(conf['radius']['timeout'], '3')
-        self.assertTrue(conf['radius']['max-try'], '3')
-        self.assertTrue(conf['radius']['gw-ip-address'], gateway)
+        self.assertEqual(conf['radius']['acct-timeout'], '3')
+        self.assertEqual(conf['radius']['timeout'], '3')
+        self.assertEqual(conf['radius']['max-try'], '3')
+        self.assertEqual(conf['radius']['gw-ip-address'], gateway)
+        self.assertEqual(conf['radius']['acct-interim-jitter'], radius_acct_interim_jitter)
+        self.assertEqual(conf['radius']['called-sid'], radius_called_sid)
+        self.assertEqual(conf['radius']['dae-server'], f'{coa_server}:1700,{coa_key}')
+        self.assertEqual(conf['radius']['nas-identifier'], nas_id)
+        self.assertEqual(conf['radius']['nas-ip-address'], nas_ip)
+        self.assertEqual(conf['radius']['bind'], source_address)
 
         server = conf['radius']['server'].split(',')
         self.assertEqual(radius_server, server[0])
@@ -163,5 +215,93 @@ class TestServicePPPoEServer(unittest.TestCase):
         # Check for running process
         self.assertTrue(process_named_running(process_name))
 
+    def test_auth_protocols(self):
+        """ Test configuration of local authentication for PPPoE server """
+        self.basic_config()
+
+        # explicitly test mschap-v2 - no special reason
+        self.session.set(base_path + ['authentication', 'protocols', 'mschap-v2'])
+
+        # commit changes
+        self.session.commit()
+
+        # Validate configuration values
+        conf = ConfigParser(allow_no_value=True)
+        conf.read(pppoe_conf)
+
+        self.assertEqual(conf['modules']['auth_mschap_v2'], None)
+
+        # Check for running process
+        self.assertTrue(process_named_running(process_name))
+
+
+    def test_ip_pool(self):
+        """ Test configuration of IPv6 client pools """
+        self.basic_config()
+
+        subnet = '172.18.0.0/24'
+        self.session.set(base_path + ['client-ip-pool', 'subnet', subnet])
+
+        start = '192.0.2.10'
+        stop = '192.0.2.20'
+        start_stop = f'{start}-{stop}'
+        self.session.set(base_path + ['client-ip-pool', 'start', start])
+        self.session.set(base_path + ['client-ip-pool', 'stop', stop])
+
+        # commit changes
+        self.session.commit()
+
+        # Validate configuration values
+        conf = ConfigParser(allow_no_value=True)
+        conf.read(pppoe_conf)
+
+        # check configured subnet
+        self.assertEqual(conf['ip-pool'][subnet], None)
+        self.assertEqual(conf['ip-pool'][start_stop], None)
+        self.assertEqual(conf['ip-pool']['gw-ip-address'], gateway)
+
+
+    def test_ipv6_pool(self):
+        """ Test configuration of IPv6 client pools """
+        self.basic_config()
+
+        # Enable IPv6
+        allow_ipv6 = 'allow'
+        random = 'random'
+        self.session.set(base_path + ['ppp-options', 'ipv6', allow_ipv6])
+        self.session.set(base_path + ['ppp-options', 'ipv6-intf-id', random])
+        self.session.set(base_path + ['ppp-options', 'ipv6-accept-peer-intf-id'])
+        self.session.set(base_path + ['ppp-options', 'ipv6-peer-intf-id', random])
+
+        prefix = '2001:db8:ffff::/64'
+        prefix_mask = '128'
+        client_prefix = f'{prefix},{prefix_mask}'
+        self.session.set(base_path + ['client-ipv6-pool', 'prefix', prefix, 'mask', prefix_mask])
+
+        delegate_prefix = '2001:db8::/40'
+        delegate_mask = '56'
+        self.session.set(base_path + ['client-ipv6-pool', 'delegate', delegate_prefix, 'delegation-prefix', delegate_mask])
+
+        # commit changes
+        self.session.commit()
+
+        # Validate configuration values
+        conf = ConfigParser(allow_no_value=True, delimiters='=')
+        conf.read(pppoe_conf)
+
+        for tmp in ['ipv6pool', 'ipv6_nd', 'ipv6_dhcp']:
+            self.assertEqual(conf['modules'][tmp], None)
+
+        self.assertEqual(conf['ppp']['ipv6'], allow_ipv6)
+        self.assertEqual(conf['ppp']['ipv6-intf-id'], random)
+        self.assertEqual(conf['ppp']['ipv6-peer-intf-id'], random)
+        self.assertTrue(conf['ppp'].getboolean('ipv6-accept-peer-intf-id'))
+
+        self.assertEqual(conf['ipv6-pool'][client_prefix], None)
+        self.assertEqual(conf['ipv6-pool']['delegate'], f'{delegate_prefix},{delegate_mask}')
+
+        # Check for running process
+        self.assertTrue(process_named_running(process_name))
+
 if __name__ == '__main__':
     unittest.main()