IPoE: T1767: vyos.config rewrite

1 files changed, 270 insertions, 226 deletions

diff --git a/src/conf_mode/ipoe_server.py b/src/conf_mode/ipoe_server.py
index 1662e45e6..bd7a898d0 100755
--- a/src/conf_mode/ipoe_server.py
+++ b/src/conf_mode/ipoe_server.py
@@ -163,7 +163,7 @@ nas-identifier={{auth['radsettings']['nas-identifier']}}
 tcp=127.0.0.1:2002
 '''
 
-### chap secrets
+# chap secrets
 chap_secrets_conf = '''
 # username  server  password  acceptable local IP addresses   shaper
 {% for aifc in auth['auth_if'] %}
@@ -185,251 +185,295 @@ chap_secrets_conf = '''
 {% endfor %}
 '''
 
-##### Inline functions start ####
-### config path creation
 if not os.path.exists(ipoe_cnf_dir):
-  os.makedirs(ipoe_cnf_dir)
-  sl.syslog(sl.LOG_NOTICE, ipoe_cnf_dir + " created")
+    os.makedirs(ipoe_cnf_dir)
+    sl.syslog(sl.LOG_NOTICE, ipoe_cnf_dir + " created")
 
-def get_cpu():
-  cpu_cnt = 1
-  if os.cpu_count() == 1:
+
+def _get_cpu():
     cpu_cnt = 1
-  else:
-    cpu_cnt = int(os.cpu_count()/2)
-  return cpu_cnt
-
-def chk_con():
-  cnt = 0
-  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-  while True:
+    if os.cpu_count() == 1:
+        cpu_cnt = 1
+    else:
+        cpu_cnt = int(os.cpu_count()/2)
+    return cpu_cnt
+
+
+def _chk_con():
+    cnt = 0
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    while True:
+        try:
+            s.connect(("127.0.0.1", int(cmd_port)))
+            break
+        except ConnectionRefusedError:
+            time.sleep(0.5)
+            cnt += 1
+            if cnt == 100:
+                raise("failed to start pppoe server")
+                break
+
+
+def _accel_cmd(cmd=''):
+    if not cmd:
+        return None
     try:
-      s.connect(("127.0.0.1", int(cmd_port)))
-      break
-    except ConnectionRefusedError:
-      time.sleep(0.5)
-      cnt +=1
-      if cnt == 100:
-        raise("failed to start pppoe server")
-        break
-
-def accel_cmd(cmd=''):
-  if not cmd:
-    return None
-  try:
-    ret = subprocess.check_output(['/usr/bin/accel-cmd', '-p', cmd_port, cmd]).decode().strip()
-    return ret
-  except:
-    return 1
-
-### chap_secrets file if auth mode local
-def gen_chap_secrets(c):
-  
-  tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True)
-  chap_secrets_txt = tmpl.render(c)
-  old_umask = os.umask(0o077)
-  open(chap_secrets,'w').write(chap_secrets_txt)
-  os.umask(old_umask)
-  sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written')
+        ret = subprocess.check_output(
+            ['/usr/bin/accel-cmd', '-p', cmd_port, cmd]).decode().strip()
+        return ret
+    except:
+        return 1
+
+# chap_secrets file if auth mode local
+
+
+def _gen_chap_secrets(c):
+
+    tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True)
+    chap_secrets_txt = tmpl.render(c)
+    old_umask = os.umask(0o077)
+    open(chap_secrets, 'w').write(chap_secrets_txt)
+    os.umask(old_umask)
+    sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written')
 
 ##### Inline functions end ####
 
+
 def get_config():
-  c = Config()
-  if not c.exists('service ipoe-server'):
-    return None
-
-  config_data = {}
-
-  c.set_level('service ipoe-server')
-  config_data['interfaces'] = {}
-  for intfc in c.list_nodes('interface'):
-    config_data['interfaces'][intfc] = {
-      'mode'        : 'L2',
-      'shared'      : '1',
-      'sess_start'  : 'dhcpv4',  ### may need a conifg option, can be dhcpv4 or up for unclassified pkts
-      'range'       : None,
-      'ifcfg'       : '1',
-      'vlan_mon'    : []
-    }
-    config_data['dns'] = {
-      'server1'     : None,
-      'server2'     : None
-    }
-    config_data['dnsv6'] = {
-      'server1'     : None,
-      'server2'     : None,
-      'server3'     : None
-    }
-    config_data['ipv6'] = {
-      'prfx'        : [],
-      'pd'     : [],
-    }
-    config_data['auth'] = {
-      'auth_if'       : {},
-      'mech'          : 'noauth',
-      'radius'        : {},
-      'radsettings'   : {
-        'dae-server'  : {}
-      }
-    }
-
-    if c.exists('interface ' + intfc + ' network-mode'):
-      config_data['interfaces'][intfc]['mode'] = c.return_value('interface ' + intfc + ' network-mode')
-    if c.return_value('interface ' + intfc + ' network') == 'vlan':
-      config_data['interfaces'][intfc]['shared'] = '0'
-      if c.exists('interface ' + intfc + ' vlan-id'):
-        config_data['interfaces'][intfc]['vlan_mon'] += c.return_values('interface ' + intfc + ' vlan-id')
-      if c.exists('interface ' + intfc + ' vlan-range'):
-        config_data['interfaces'][intfc]['vlan_mon'] += c.return_values('interface ' + intfc + ' vlan-range')
-    if c.exists('interface ' + intfc + ' client-subnet'):
-      config_data['interfaces'][intfc]['range'] = c.return_value('interface ' + intfc + ' client-subnet')
-    if c.exists('dns-server server-1'):
-      config_data['dns']['server1'] = c.return_value('dns-server server-1')
-    if c.exists('dns-server server-2'):
-      config_data['dns']['server2'] = c.return_value('dns-server server-2')
-    if c.exists('dnsv6-server server-1'):
-      config_data['dnsv6']['server1'] = c.return_value('dnsv6-server server-1')
-    if c.exists('dnsv6-server server-2'):
-      config_data['dnsv6']['server2'] = c.return_value('dnsv6-server server-2')
-    if c.exists('dnsv6-server server-3'):
-      config_data['dnsv6']['server3'] = c.return_value('dnsv6-server server-3')
-    if not c.exists('authentication mode noauth'):
-      config_data['auth']['mech'] = c.return_value('authentication mode')
-    if c.exists('authentication mode local'):
-      for auth_int in c.list_nodes('authentication interface'):
-        for mac in c.list_nodes('authentication interface ' + auth_int + ' mac-address'):
-          config_data['auth']['auth_if'][auth_int] = {}
-          if c.exists('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit'):
-            config_data['auth']['auth_if'][auth_int][mac] = {}
-            config_data['auth']['auth_if'][auth_int][mac]['up'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit upload') 
-            config_data['auth']['auth_if'][auth_int][mac]['down'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit download')
-          else:
-            config_data['auth']['auth_if'][auth_int][mac] = {}
-            config_data['auth']['auth_if'][auth_int][mac]['up'] = None
-            config_data['auth']['auth_if'][auth_int][mac]['down'] = None
-          ## client vlan-id
-          if c.exists('authentication interface ' + auth_int + ' mac-address ' + mac + ' vlan-id'):
-            config_data['auth']['auth_if'][auth_int][mac]['vlan'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' vlan-id')
-    if c.exists('authentication mode radius'):
-      for rsrv in c.list_nodes('authentication radius-server'):
-        config_data['auth']['radius'][rsrv] = {}
-        if c.exists('authentication radius-server ' + rsrv + ' secret'):
-          config_data['auth']['radius'][rsrv]['secret'] = c.return_value('authentication radius-server ' + rsrv + ' secret')
-        else:
-          config_data['auth']['radius'][rsrv]['secret'] = None
-        if c.exists('authentication radius-server ' + rsrv + ' fail-time'):
-          config_data['auth']['radius'][rsrv]['fail-time'] = c.return_value('authentication radius-server ' + rsrv + ' fail-time')
-        else:
-          config_data['auth']['radius'][rsrv]['fail-time'] = '0'
-        if c.exists('authentication radius-server ' + rsrv + ' req-limit'):
-          config_data['auth']['radius'][rsrv]['req-limit'] = c.return_value('authentication radius-server ' + rsrv + ' req-limit')
-        else:
-          config_data['auth']['radius'][rsrv]['req-limit'] = '0'
-      if c.exists('authentication radius-settings'):
-        if c.exists('authentication radius-settings timeout'):
-          config_data['auth']['radsettings']['timeout'] = c.return_value('authentication radius-settings timeout')
-        if c.exists('authentication radius-settings nas-ip-address'):
-           config_data['auth']['radsettings']['nas-ip-address'] = c.return_value('authentication radius-settings nas-ip-address')
-        if c.exists('authentication radius-settings nas-identifier'):
-          config_data['auth']['radsettings']['nas-identifier'] = c.return_value('authentication radius-settings nas-identifier')
-        if c.exists('authentication radius-settings max-try'):
-          config_data['auth']['radsettings']['max-try'] = c.return_value('authentication radius-settings max-try')
-        if c.exists('authentication radius-settings acct-timeout'):
-          config_data['auth']['radsettings']['acct-timeout'] = c.return_value('authentication radius-settings acct-timeout')
-        if c.exists('authentication radius-settings dae-server ip-address'):
-          config_data['auth']['radsettings']['dae-server']['ip-address'] = c.return_value('authentication radius-settings dae-server ip-address')
-        if c.exists('authentication radius-settings dae-server port'):
-          config_data['auth']['radsettings']['dae-server']['port'] = c.return_value('authentication radius-settings dae-server port')
-        if c.exists('authentication radius-settings dae-server secret'):
-           config_data['auth']['radsettings']['dae-server']['secret'] = c.return_value('authentication radius-settings dae-server secret')
-
-    if c.exists('client-ipv6-pool prefix'):
-      config_data['ipv6']['prfx'] = c.return_values('client-ipv6-pool prefix')
-    if c.exists('client-ipv6-pool delegate-prefix'):
-      config_data['ipv6']['pd'] = c.return_values('client-ipv6-pool delegate-prefix')
-
-  return config_data
+    c = Config()
+    if not c.exists(['service', 'ipoe-server']):
+        return None
+
+    config_data = {}
+
+    c.set_level(['service', 'ipoe-server'])
+    config_data['interfaces'] = {}
+    for intfc in c.list_nodes(['interface']):
+        config_data['interfaces'][intfc] = {
+            'mode': 'L2',
+            'shared': '1',
+            # may need a conifg option, can be dhcpv4 or up for unclassified pkts
+            'sess_start': 'dhcpv4',
+            'range': None,
+            'ifcfg': '1',
+            'vlan_mon': []
+        }
+        config_data['dns'] = {
+            'server1': None,
+            'server2': None
+        }
+        config_data['dnsv6'] = {
+            'server1': None,
+            'server2': None,
+            'server3': None
+        }
+        config_data['ipv6'] = {
+            'prfx': [],
+            'pd': [],
+        }
+        config_data['auth'] = {
+            'auth_if': {},
+            'mech': 'noauth',
+            'radius': {},
+            'radsettings': {
+                'dae-server': {}
+            }
+        }
+
+        if c.exists(['interface', intfc, 'network-mode']):
+            config_data['interfaces'][intfc]['mode'] = c.return_value(
+                ['interface', intfc, 'network-mode'])
+        if c.return_value(['interface', intfc, 'network']) == 'vlan':
+            config_data['interfaces'][intfc]['shared'] = '0'
+            if c.exists(['interface', intfc, 'vlan-id']):
+                config_data['interfaces'][intfc]['vlan_mon'] += c.return_values(
+                    ['interface', intfc, 'vlan-id'])
+            if c.exists(['interface', intfc, 'vlan-range']):
+                config_data['interfaces'][intfc]['vlan_mon'] += c.return_values(
+                    ['interface', intfc, 'vlan-range'])
+        if c.exists(['interface', intfc, 'client-subnet']):
+            config_data['interfaces'][intfc]['range'] = c.return_value(
+                ['interface', intfc, 'client-subnet'])
+        if c.exists(['dns-server', 'server-1']):
+            config_data['dns']['server1'] = c.return_value(
+                ['dns-server', 'server-1'])
+        if c.exists(['dns-server', 'server-2']):
+            config_data['dns']['server2'] = c.return_value(
+                ['dns-server', 'server-2'])
+        if c.exists(['dnsv6-server', 'server-1']):
+            config_data['dnsv6']['server1'] = c.return_value(
+                ['dnsv6-server', 'server-1'])
+        if c.exists(['dnsv6-server', 'server-2']):
+            config_data['dnsv6']['server2'] = c.return_value(
+                ['dnsv6-server', 'server-2'])
+        if c.exists(['dnsv6-server', 'server-3']):
+            config_data['dnsv6']['server3'] = c.return_value(
+                ['dnsv6-server', 'server-3'])
+        if not c.exists(['authentication', 'mode', 'noauth']):
+            config_data['auth']['mech'] = c.return_value(
+                ['authentication', 'mode'])
+        if c.exists(['authentication', 'mode', 'local']):
+            for auth_int in c.list_nodes(['authentication', 'interface']):
+                for mac in c.list_nodes(['authentication', 'interface', auth_int, 'mac-address']):
+                    config_data['auth']['auth_if'][auth_int] = {}
+                    if c.exists(['authentication', 'interface', auth_int, 'mac-address',  mac, 'rate-limit']):
+                        config_data['auth']['auth_if'][auth_int][mac] = {}
+                        config_data['auth']['auth_if'][auth_int][mac]['up'] = c.return_value(
+                            ['authentication', 'interface', auth_int, 'mac-address', mac, 'rate-limit upload'])
+                        config_data['auth']['auth_if'][auth_int][mac]['down'] = c.return_value(
+                            ['authentication', 'interface', auth_int, 'mac-address', 'mac', 'rate-limit download'])
+                    else:
+                        config_data['auth']['auth_if'][auth_int][mac] = {}
+                        config_data['auth']['auth_if'][auth_int][mac]['up'] = None
+                        config_data['auth']['auth_if'][auth_int][mac]['down'] = None
+                    # client vlan-id
+                    if c.exists(['authentication', 'interface', auth_int, 'mac-address', mac, 'vlan-id']):
+                        config_data['auth']['auth_if'][auth_int][mac]['vlan'] = c.return_value(
+                            ['authentication', 'interface', auth_int, 'mac-address', mac, 'vlan-id'])
+        if c.exists(['authentication', 'mode',  'radius']):
+            for rsrv in c.list_nodes(['authentication', 'radius-server']):
+                config_data['auth']['radius'][rsrv] = {}
+                if c.exists(['authentication', 'radius-server', rsrv, 'secret']):
+                    config_data['auth']['radius'][rsrv]['secret'] = c.return_value(
+                        ['authentication', 'radius-server', rsrv, 'secret'])
+                else:
+                    config_data['auth']['radius'][rsrv]['secret'] = None
+                if c.exists(['authentication', 'radius-server', rsrv, 'fail-time']):
+                    config_data['auth']['radius'][rsrv]['fail-time'] = c.return_value(
+                        ['authentication', 'radius-server', rsrv, 'fail-time'])
+                else:
+                    config_data['auth']['radius'][rsrv]['fail-time'] = '0'
+                if c.exists(['authentication', 'radius-server', rsrv, 'req-limit']):
+                    config_data['auth']['radius'][rsrv]['req-limit'] = c.return_value(
+                        ['authentication', 'radius-server', rsrv, 'req-limit'])
+                else:
+                    config_data['auth']['radius'][rsrv]['req-limit'] = '0'
+            if c.exists(['authentication', 'radius-settings']):
+                if c.exists(['authentication', 'radius-settings', 'timeout']):
+                    config_data['auth']['radsettings']['timeout'] = c.return_value(
+                        ['authentication', 'radius-settings', 'timeout'])
+                if c.exists(['authentication', 'radius-settings', 'nas-ip-address']):
+                    config_data['auth']['radsettings']['nas-ip-address'] = c.return_value(
+                        ['authentication', 'radius-settings', 'nas-ip-address'])
+                if c.exists(['authentication', 'radius-settings', 'nas-identifier']):
+                    config_data['auth']['radsettings']['nas-identifier'] = c.return_value(
+                        ['authentication', 'radius-settings', 'nas-identifier'])
+                if c.exists(['authentication', 'radius-settings', 'max-try']):
+                    config_data['auth']['radsettings']['max-try'] = c.return_value(
+                        ['authentication', 'radius-settings', 'max-try'])
+                if c.exists(['authentication', 'radius-settings', 'acct-timeout']):
+                    config_data['auth']['radsettings']['acct-timeout'] = c.return_value(
+                        ['authentication', 'radius-settings', 'acct-timeout'])
+                if c.exists(['authentication', 'radius-settings', 'dae-server', 'ip-address']):
+                    config_data['auth']['radsettings']['dae-server']['ip-address'] = c.return_value(
+                        ['authentication', 'radius-settings', 'dae-server', 'ip-address'])
+                if c.exists(['authentication', 'radius-settings', 'dae-server', 'port']):
+                    config_data['auth']['radsettings']['dae-server']['port'] = c.return_value(
+                        ['authentication', 'radius-settings', 'dae-server', 'port'])
+                if c.exists(['authentication', 'radius-settings', 'dae-server', 'secret']):
+                    config_data['auth']['radsettings']['dae-server']['secret'] = c.return_value(
+                        ['authentication', 'radius-settings', 'dae-server', 'secret'])
+
+        if c.exists(['client-ipv6-pool', 'prefix']):
+            config_data['ipv6']['prfx'] = c.return_values(
+                ['client-ipv6-pool', 'prefix'])
+        if c.exists(['client-ipv6-pool', 'delegate-prefix']):
+            config_data['ipv6']['pd'] = c.return_values(
+                ['client-ipv6-pool', 'delegate-prefix'])
+
+    return config_data
+
 
 def generate(c):
-  if c == None or not c:
-    return None
-  
-  c['thread_cnt'] = get_cpu()
+    if c == None or not c:
+        return None
 
-  if c['auth']['mech'] == 'local':
-    gen_chap_secrets(c)
+    c['thread_cnt'] = _get_cpu()
 
-  tmpl = jinja2.Template(ipoe_config, trim_blocks=True)
-  config_text = tmpl.render(c)
-  open(ipoe_cnf,'w').write(config_text)
-  return c
+    if c['auth']['mech'] == 'local':
+        _gen_chap_secrets(c)
 
-def verify(c):
-  if c == None or not c:
-    return None
+    tmpl = jinja2.Template(ipoe_config, trim_blocks=True)
+    config_text = tmpl.render(c)
+    open(ipoe_cnf, 'w').write(config_text)
+    return c
 
-  if not c['interfaces']:
-    raise ConfigError("service ipoe-server interface requires a value")
 
-  for intfc in c['interfaces']:
-    if not c['interfaces'][intfc]['range']:
-      raise ConfigError("service ipoe-server interface " + intfc + " client-subnet needs a value") 
+def verify(c):
+    if c == None or not c:
+        return None
 
-  if c['auth']['mech'] == 'radius':
-    if not c['auth']['radius']:
-      raise ConfigError("service ipoe-server authentication radius-server requires a value for authentication mode radius")
-    else:
-      for radsrv in c['auth']['radius']:
-        if not c['auth']['radius'][radsrv]['secret']:
-          raise ConfigError("service ipoe-server authentication radius-server " + radsrv + " secret requires a value")
+    if not c['interfaces']:
+        raise ConfigError("service ipoe-server interface requires a value")
 
-  if c['auth']['radsettings']['dae-server']:
-    try:
-      if c['auth']['radsettings']['dae-server']['ip-address']:
-        pass
-    except:
-      raise ConfigError("service ipoe-server authentication radius-settings dae-server ip-address value required") 
-    try:
-      if c['auth']['radsettings']['dae-server']['secret']:
-        pass
-    except:
-      raise ConfigError("service ipoe-server authentication radius-settings dae-server secret value required")
-    try:
-      if c['auth']['radsettings']['dae-server']['port']:
-        pass
-    except:
-      raise ConfigError("service ipoe-server authentication radius-settings dae-server port value required")
+    for intfc in c['interfaces']:
+        if not c['interfaces'][intfc]['range']:
+            raise ConfigError("service ipoe-server interface " +
+                              intfc + " client-subnet needs a value")
 
-  if len(c['ipv6']['pd']) != 0 and len(c['ipv6']['prfx']) == 0:
-    raise ConfigError("service ipoe-server client-ipv6-pool prefix needs a value")
+    if c['auth']['mech'] == 'radius':
+        if not c['auth']['radius']:
+            raise ConfigError(
+                "service ipoe-server authentication radius-server requires a value for authentication mode radius")
+        else:
+            for radsrv in c['auth']['radius']:
+                if not c['auth']['radius'][radsrv]['secret']:
+                    raise ConfigError(
+                        "service ipoe-server authentication radius-server " + radsrv + " secret requires a value")
+
+    if c['auth']['radsettings']['dae-server']:
+        try:
+            if c['auth']['radsettings']['dae-server']['ip-address']:
+                pass
+        except:
+            raise ConfigError(
+                "service ipoe-server authentication radius-settings dae-server ip-address value required")
+        try:
+            if c['auth']['radsettings']['dae-server']['secret']:
+                pass
+        except:
+            raise ConfigError(
+                "service ipoe-server authentication radius-settings dae-server secret value required")
+        try:
+            if c['auth']['radsettings']['dae-server']['port']:
+                pass
+        except:
+            raise ConfigError(
+                "service ipoe-server authentication radius-settings dae-server port value required")
+
+    if len(c['ipv6']['pd']) != 0 and len(c['ipv6']['prfx']) == 0:
+        raise ConfigError(
+            "service ipoe-server client-ipv6-pool prefix needs a value")
+
+    return c
 
-  return c
 
 def apply(c):
-  if c == None:
-    if os.path.exists(pidfile):
-      accel_cmd('shutdown hard')
-      if os.path.exists(pidfile):
-        os.remove(pidfile)
-    return None
-
-  if not os.path.exists(pidfile):
-    ret = subprocess.call(['/usr/sbin/accel-pppd', '-c', ipoe_cnf, '-p', pidfile, '-d'])
-    chk_con()
-    if ret !=0 and os.path.exists(pidfile):
-      os.remove(pidfile)
-      raise ConfigError('accel-pppd failed to start')
-  else:
-    accel_cmd('restart')
-    sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart")
+    if c == None:
+        if os.path.exists(pidfile):
+            _accel_cmd('shutdown hard')
+            if os.path.exists(pidfile):
+                os.remove(pidfile)
+        return None
+
+    if not os.path.exists(pidfile):
+        ret = subprocess.call(
+            ['/usr/sbin/accel-pppd', '-c', ipoe_cnf, '-p', pidfile, '-d'])
+        _chk_con()
+        if ret != 0 and os.path.exists(pidfile):
+            os.remove(pidfile)
+            raise ConfigError('accel-pppd failed to start')
+    else:
+        _accel_cmd('restart')
+        sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart")
+
 
 if __name__ == '__main__':
-  try:
-    c = get_config()
-    verify(c)
-    generate(c)
-    apply(c)
-  except ConfigError as e:
-    print(e)
-    sys.exit(1)
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        sys.exit(1)