summaryrefslogtreecommitdiff
path: root/src/conf_mode/vpn_sstp.py
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2020-04-11 19:14:11 +0200
committerChristian Poessinger <christian@poessinger.com>2020-04-11 19:14:11 +0200
commit867fc8d75380fee36dab7d495b835b19e7dafd58 (patch)
tree05a441f2cf0a3fb133465ef960550e59f3273039 /src/conf_mode/vpn_sstp.py
parentc27f13ab459ef5116eeac417d256abfabf2690c2 (diff)
parent0edca98b751faa3f3817fe4899d2822daade4212 (diff)
downloadvyos-1x-867fc8d75380fee36dab7d495b835b19e7dafd58.tar.gz
vyos-1x-867fc8d75380fee36dab7d495b835b19e7dafd58.zip
Merge branch 't2264-l2tp' of github.com:c-po/vyos-1x into current
* 't2264-l2tp' of github.com:c-po/vyos-1x: (25 commits) vpn: l2tp: sstp: T2264: create config dir on demand vpn: l2tp: T2264: migrate IPv6 prefix node to common CLI style vpn: l2tp: T2264: simplify IPv6 config dictionary elements vpn: sstp: T2008: migrate from SysVinit -> systemd vpn: sstp: T2008: bugfix KeyError 'client_gateway' vpn: l2tp: T2264: migrate from SysVinit -> systemd vpn: l2tp: T2264: remove debug pprint vpn: l2tp: T2264: proper set PPP default values to ease Jinja2 template vpn: l2tp: T2110: re-use RADIUS XML include file vpn: l2tp: T2264: remove RADIUS req-limit node vpn: l2tp: T2264: migrate to new dictionary keys for radius auth vpn: sstp: T2008: set accell default values in config dict vpn: l2tp: T2264: use "with open()" when writing config vpn: l2tp: T2264: migrate to new dictionary keys for local auth vpn: sstp: T2008: improve error message for non existent local-users vpn: l2tp: T2264: cleanup thread_cnt generation vpn: sstp: T2008: cleanup thread_cnt generation vpn: l2tp: T2264: combine WINS CLI syntax vpn: l2tp: T2264: combine IPv4/IPv6 name-server CLI syntax vpn: sstp: T2008: adjust DNS error message ...
Diffstat (limited to 'src/conf_mode/vpn_sstp.py')
-rwxr-xr-xsrc/conf_mode/vpn_sstp.py112
1 files changed, 32 insertions, 80 deletions
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
index ca0844c50..b2eb5bdcb 100755
--- a/src/conf_mode/vpn_sstp.py
+++ b/src/conf_mode/vpn_sstp.py
@@ -18,7 +18,6 @@ import os
from time import sleep
from sys import exit
-from socket import socket, AF_INET, SOCK_STREAM
from copy import deepcopy
from stat import S_IRUSR, S_IWUSR, S_IRGRP
from jinja2 import FileSystemLoader, Environment
@@ -26,41 +25,17 @@ from jinja2 import FileSystemLoader, Environment
from vyos.config import Config
from vyos import ConfigError
from vyos.defaults import directories as vyos_data_dir
-from vyos.util import process_running
-from vyos.util import process_running, cmd, run
-
-pidfile = r'/var/run/accel_sstp.pid'
-sstp_cnf_dir = r'/etc/accel-ppp/sstp'
-chap_secrets = sstp_cnf_dir + '/chap-secrets'
-sstp_conf = sstp_cnf_dir + '/sstp.config'
-
-# config path creation
-if not os.path.exists(sstp_cnf_dir):
- os.makedirs(sstp_cnf_dir)
-
-def chk_con():
- cnt = 0
- s = socket(AF_INET, SOCK_STREAM)
- while True:
- try:
- s.connect(("127.0.0.1", 2005))
- s.close()
- break
- except ConnectionRefusedError:
- sleep(0.5)
- cnt += 1
- if cnt == 100:
- raise("failed to start sstp server")
- break
-
-
-def _accel_cmd(command):
- return run(f'/usr/bin/accel-cmd -p 2005 {command}')
+from vyos.util import call, run
+
+sstp_conf = '/etc/accel-ppp/sstp.conf'
+sstp_chap_secrets = '/etc/accel-ppp/sstp.chap-secrets'
default_config_data = {
'local_users' : [],
'auth_mode' : 'local',
- 'auth_proto' : [],
+ 'auth_proto' : ['auth_mschap_v2'],
+ 'chap_secrets_file': sstp_chap_secrets, # used in Jinja2 template
+ 'client_gateway': '',
'radius_server' : [],
'radius_acct_tmo' : '3',
'radius_max_try' : '3',
@@ -77,11 +52,11 @@ default_config_data = {
'client_ip_pool' : [],
'dnsv4' : [],
'mtu' : '',
- 'ppp_mppe' : '',
+ 'ppp_mppe' : 'prefer',
'ppp_echo_failure' : '',
'ppp_echo_interval' : '',
'ppp_echo_timeout' : '',
- 'thread_cnt' : ''
+ 'thread_cnt' : 1
}
def get_config():
@@ -93,10 +68,9 @@ def get_config():
conf.set_level(base_path)
- cpu = int(os.cpu_count()/2)
- if cpu < 1:
- cpu = 1
- sstp['thread_cnt'] = cpu
+ cpu = os.cpu_count()
+ if cpu > 1:
+ sstp['thread_cnt'] = int(cpu/2)
if conf.exists(['authentication', 'mode']):
sstp['auth_mode'] = conf.return_value(['authentication', 'mode'])
@@ -224,9 +198,6 @@ def get_config():
for proto in conf.return_values(['protocols']):
sstp['auth_proto'].append(auth_mods[proto])
- else:
- sstp['auth_proto'] = ['auth_mschap_v2']
-
#
# read in SSL certs
conf.set_level(base_path + ['ssl'])
@@ -262,7 +233,7 @@ def get_config():
# read in PPP stuff
conf.set_level(base_path + ['ppp-settings'])
if conf.exists('mppe'):
- sstp['ppp_mppe'] = conf.return_value('ppp-settings mppe')
+ sstp['ppp_mppe'] = conf.return_value(['ppp-settings', 'mppe'])
if conf.exists(['lcp-echo-failure']):
sstp['ppp_echo_failure'] = conf.return_value(['lcp-echo-failure'])
@@ -283,7 +254,7 @@ def verify(sstp):
# vertify auth settings
if sstp['auth_mode'] == 'local':
if not sstp['local_users']:
- raise ConfigError('sstp-server authentication local-users required')
+ raise ConfigError('SSTP local auth mode requires local users to be configured!')
for user in sstp['local_users']:
if not user['password']:
@@ -303,7 +274,7 @@ def verify(sstp):
raise ConfigError("Client gateway IP address required")
if len(sstp['dnsv4']) > 2:
- raise ConfigError("Only 2 DNS name-servers can be configured")
+ raise ConfigError('Not more then two IPv4 DNS name-servers can be configured')
if not sstp['ssl_ca'] or not sstp['ssl_cert'] or not sstp['ssl_key']:
raise ConfigError('One or more SSL certificates missing')
@@ -334,6 +305,10 @@ def generate(sstp):
fs_loader = FileSystemLoader(tmpl_path)
env = Environment(loader=fs_loader, trim_blocks=True)
+ dirname = os.path.dirname(sstp_conf)
+ if not os.path.exists(dirname):
+ os.mkdir(dirname)
+
# accel-cmd reload doesn't work so any change results in a restart of the daemon
tmpl = env.get_template('sstp.config.tmpl')
config_text = tmpl.render(sstp)
@@ -343,52 +318,29 @@ def generate(sstp):
if sstp['local_users']:
tmpl = env.get_template('chap-secrets.tmpl')
config_text = tmpl.render(sstp)
- with open(chap_secrets, 'w') as f:
- f.write(config_text)
+ with open(sstp_chap_secrets, 'w') as f:
+ f.write(sstp_chap_secrets)
- os.chmod(chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP)
+ os.chmod(sstp_chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP)
else:
- if os.path.exists(chap_secrets):
- os.unlink(chap_secrets)
+ if os.path.exists(sstp_chap_secrets):
+ os.unlink(sstp_chap_secrets)
return sstp
def apply(sstp):
- if sstp is None:
- if process_running(pidfile):
- command = 'start-stop-daemon'
- command += ' --stop '
- command += ' --quiet'
- command += ' --oknodo'
- command += ' --pidfile ' + pidfile
- cmd(command)
+ if not sstp:
+ call('systemctl stop accel-ppp-sstp.service')
- if os.path.exists(pidfile):
- os.remove(pidfile)
+ if os.path.exists(sstp_conf):
+ os.unlink(sstp_conf)
- return None
+ if os.path.exists(sstp_chap_secrets):
+ os.unlink(sstp_chap_secrets)
- if not process_running(pidfile):
- if os.path.exists(pidfile):
- os.remove(pidfile)
-
- command = 'start-stop-daemon'
- command += ' --start '
- command += ' --quiet'
- command += ' --oknodo'
- command += ' --pidfile ' + pidfile
- command += ' --exec /usr/sbin/accel-pppd'
- # now pass arguments to accel-pppd binary
- command += ' --'
- command += ' -c ' + sstp_conf
- command += ' -p ' + pidfile
- command += ' -d'
- cmd(command)
-
- chk_con()
+ return None
- else:
- _accel_cmd('restart')
+ call('systemctl restart accel-ppp-sstp.service')
if __name__ == '__main__':