diff options
| -rw-r--r-- | data/templates/accel-ppp/ipoe.config.j2 | 4 | ||||
| -rw-r--r-- | interface-definitions/pki.xml.in | 6 | ||||
| -rw-r--r-- | interface-definitions/service_ipoe-server.xml.in | 24 | ||||
| -rw-r--r-- | op-mode-definitions/show-monitoring.xml.in | 62 | ||||
| -rw-r--r-- | op-mode-definitions/show-zebra.xml.in | 54 | ||||
| -rw-r--r-- | python/vyos/defaults.py | 3 | ||||
| -rwxr-xr-x | src/conf_mode/pki.py | 61 | ||||
| -rwxr-xr-x | src/conf_mode/protocols_static_multicast.py | 6 | ||||
| -rwxr-xr-x | src/init/vyos-router | 6 |
9 files changed, 138 insertions, 88 deletions
diff --git a/data/templates/accel-ppp/ipoe.config.j2 b/data/templates/accel-ppp/ipoe.config.j2 index a10dcf2c1..34dfa529a 100644 --- a/data/templates/accel-ppp/ipoe.config.j2 +++ b/data/templates/accel-ppp/ipoe.config.j2 @@ -59,7 +59,9 @@ lua-file={{ lua_file }} {% set relay = ',' ~ 'relay=' ~ iface_config.external_dhcp.dhcp_relay if iface_config.external_dhcp.dhcp_relay is vyos_defined else '' %} {% set giaddr = ',' ~ 'giaddr=' ~ iface_config.external_dhcp.giaddr if iface_config.external_dhcp.giaddr is vyos_defined else '' %} {% set username = ',' ~ 'username=lua:' ~ iface_config.lua_username if iface_config.lua_username is vyos_defined else '' %} -{{ tmp }},{{ shared }}mode={{ iface_config.mode | upper }},ifcfg=1,{{ range }}start=dhcpv4,ipv6=1{{ relay }}{{ giaddr }}{{ username }} +{% set start_map = {'dhcp': 'dhcpv4', 'unclassified-packet': 'up', 'auto': 'auto'} %} +{% set start = start_map[iface_config.start_session] %} +{{ tmp }},{{ shared }}mode={{ iface_config.mode | upper }},ifcfg=1,{{ range }}start={{ start }},ipv6=1{{ relay }}{{ giaddr }}{{ username }} {% if iface_config.vlan_mon is vyos_defined %} vlan-mon={{ iface }},{{ iface_config.vlan | join(',') }} {% endif %} diff --git a/interface-definitions/pki.xml.in b/interface-definitions/pki.xml.in index b922771c1..c69886a4b 100644 --- a/interface-definitions/pki.xml.in +++ b/interface-definitions/pki.xml.in @@ -35,6 +35,12 @@ <multi/> </properties> </leafNode> + <leafNode name="system-install"> + <properties> + <help>Install into CA certificate store on router</help> + <valueless/> + </properties> + </leafNode> #include <include/pki/cli-revoke.xml.i> </children> </tagNode> diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in index 27a654f92..39cfb7889 100644 --- a/interface-definitions/service_ipoe-server.xml.in +++ b/interface-definitions/service_ipoe-server.xml.in @@ -131,6 +131,30 @@ </properties> <defaultValue>shared</defaultValue> </leafNode> + <leafNode name="start-session"> + <properties> + <help>Start session options</help> + <completionHelp> + <list>auto dhcp unclassified-packet</list> + </completionHelp> + <valueHelp> + <format>auto</format> + <description>Start session with username as the interface name</description> + </valueHelp> + <valueHelp> + <format>dhcp</format> + <description>Start session on DHCPv4 Discover</description> + </valueHelp> + <valueHelp> + <format>unclassified-packet</format> + <description>Start session on unclassified-packet</description> + </valueHelp> + <constraint> + <regex>(auto|dhcp|unclassified-packet)</regex> + </constraint> + </properties> + <defaultValue>dhcp</defaultValue> + </leafNode> <leafNode name="client-subnet"> <properties> <help>Client address pool</help> diff --git a/op-mode-definitions/show-monitoring.xml.in b/op-mode-definitions/show-monitoring.xml.in index 2651b3438..9fd60e45a 100644 --- a/op-mode-definitions/show-monitoring.xml.in +++ b/op-mode-definitions/show-monitoring.xml.in @@ -2,12 +2,68 @@ <interfaceDefinition> <node name="show"> <children> - <leafNode name="monitoring"> + <node name="monitoring"> <properties> <help>Show currently monitored services</help> </properties> - <command>vtysh -c "show debugging"</command> - </leafNode> + <children> + <node name="frr"> + <properties> + <help>Show currently monitored FRR services</help> + </properties> + <command>vtysh -c "show debugging"</command> + <children> + <node name="zebra"> + <properties> + <help>Show Zebra routing information</help> + </properties> + <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command> + <children> + <node name="client"> + <properties> + <help>Client information</help> + </properties> + <children> + <node name="summary"> + <properties> + <help>Brief summary</help> + </properties> + <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command> + </node> + </children> + </node> + <node name="dplane"> + <properties> + <help>Zebra dataplane information</help> + </properties> + <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command> + </node> + <node name="router"> + <properties> + <help>Zebra router information</help> + </properties> + <children> + <node name="table"> + <properties> + <help>Zebra routing table information</help> + </properties> + <children> + <node name="summary"> + <properties> + <help>Summary information</help> + </properties> + <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command> + </node> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </node> + </children> + </node> </children> </node> </interfaceDefinition> diff --git a/op-mode-definitions/show-zebra.xml.in b/op-mode-definitions/show-zebra.xml.in deleted file mode 100644 index 69991a1d5..000000000 --- a/op-mode-definitions/show-zebra.xml.in +++ /dev/null @@ -1,54 +0,0 @@ -<?xml version="1.0"?> -<interfaceDefinition> - <node name="show"> - <children> - <node name="zebra"> - <properties> - <help>Show Zebra routing information</help> - </properties> - <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command> - <children> - <node name="client"> - <properties> - <help>Client information </help> - </properties> - <children> - <node name="summary"> - <properties> - <help>Brief Summary</help> - </properties> - <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command> - </node> - </children> - </node> - <node name="dplane"> - <properties> - <help>Zebra dataplane information</help> - </properties> - <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command> - </node> - <node name="router"> - <properties> - <help>Zebra Router Information</help> - </properties> - <children> - <node name="table"> - <properties> - <help>Table Information about this Zebra Router</help> - </properties> - <children> - <node name="summary"> - <properties> - <help>Summary Information</help> - </properties> - <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command> - </node> - </children> - </node> - </children> - </node> - </children> - </node> - </children> - </node> -</interfaceDefinition> diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py index dec619d3e..425990967 100644 --- a/python/vyos/defaults.py +++ b/python/vyos/defaults.py @@ -36,7 +36,8 @@ directories = { 'isc_dhclient_dir' : '/run/dhclient', 'dhcp6_client_dir' : '/run/dhcp6c', 'vyos_configdir' : '/opt/vyatta/config', - 'completion_dir' : f'{base_dir}/completion' + 'completion_dir' : f'{base_dir}/completion', + 'ca_certificates' : '/usr/local/share/ca-certificates/vyos' } config_status = '/tmp/vyos-config-status' diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py index 45e0129a3..acea2c9be 100755 --- a/src/conf_mode/pki.py +++ b/src/conf_mode/pki.py @@ -50,6 +50,7 @@ from vyos import airbag airbag.enable() vyos_certbot_dir = directories['certbot'] +vyos_ca_certificates_dir = directories['ca_certificates'] # keys to recursively search for under specified path sync_search = [ @@ -149,35 +150,15 @@ def get_config(config=None): if len(argv) > 1 and argv[1] == 'certbot_renew': pki['certbot_renew'] = {} - tmp = node_changed(conf, base + ['ca'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if tmp: - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'ca' : tmp}) - - tmp = node_changed(conf, base + ['certificate'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if tmp: - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'certificate' : tmp}) + changed_keys = ['ca', 'certificate', 'dh', 'key-pair', 'openssh', 'openvpn'] - tmp = node_changed(conf, base + ['dh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if tmp: - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'dh' : tmp}) + for key in changed_keys: + tmp = node_changed(conf, base + [key], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - tmp = node_changed(conf, base + ['key-pair'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if tmp: - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'key_pair' : tmp}) - - tmp = node_changed(conf, base + ['openssh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if tmp: - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'openssh' : tmp}) + if 'changed' not in pki: + pki.update({'changed':{}}) - tmp = node_changed(conf, base + ['openvpn', 'shared-secret'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if tmp: - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'openvpn' : tmp}) + pki['changed'].update({key.replace('-', '_') : tmp}) # We only merge on the defaults of there is a configuration at all if conf.exists(base): @@ -417,10 +398,33 @@ def verify(pki): return None +def cleanup_system_ca(): + if not os.path.exists(vyos_ca_certificates_dir): + os.mkdir(vyos_ca_certificates_dir) + else: + for filename in os.listdir(vyos_ca_certificates_dir): + full_path = os.path.join(vyos_ca_certificates_dir, filename) + if os.path.isfile(full_path): + os.unlink(full_path) + def generate(pki): if not pki: + cleanup_system_ca() return None + # Create or cleanup CA install directory + if 'changed' in pki and 'ca' in pki['changed']: + cleanup_system_ca() + + if 'ca' in pki: + for ca, ca_conf in pki['ca'].items(): + if 'system_install' in ca_conf: + ca_obj = load_certificate(ca_conf['certificate']) + ca_path = os.path.join(vyos_ca_certificates_dir, f'{ca}.crt') + + with open(ca_path, 'w') as f: + f.write(encode_certificate(ca_obj)) + # Certbot renewal only needs to re-trigger the services to load up the # new PEM file if 'certbot_renew' in pki: @@ -487,6 +491,7 @@ def apply(pki): systemd_certbot_name = 'certbot.timer' if not pki: call(f'systemctl stop {systemd_certbot_name}') + call('update-ca-certificates') return None has_certbot = False @@ -504,6 +509,10 @@ def apply(pki): if 'changed' in pki: call_dependents() + # Rebuild ca-certificates bundle + if 'ca' in pki['changed']: + call('update-ca-certificates') + return None if __name__ == '__main__': diff --git a/src/conf_mode/protocols_static_multicast.py b/src/conf_mode/protocols_static_multicast.py index d323ceb4f..c8894fd41 100755 --- a/src/conf_mode/protocols_static_multicast.py +++ b/src/conf_mode/protocols_static_multicast.py @@ -86,10 +86,10 @@ def verify(mroute): if mroute is None: return None - for route in mroute['mroute']: - route = route.split('/') + for mcast_route in mroute['mroute']: + route = mcast_route.split('/') if IPv4Address(route[0]) < IPv4Address('224.0.0.0'): - raise ConfigError(route + " not a multicast network") + raise ConfigError(f'{mcast_route} not a multicast network') def generate(mroute): diff --git a/src/init/vyos-router b/src/init/vyos-router index 8825cc16a..f8cc87507 100755 --- a/src/init/vyos-router +++ b/src/init/vyos-router @@ -471,6 +471,12 @@ start () touch /tmp/vyos.smoketest.debug fi + # Cleanup PKI CAs + if [ -d /usr/local/share/ca-certificates/vyos ]; then + rm -f /usr/local/share/ca-certificates/vyos/*.crt + update-ca-certificates >/dev/null 2>&1 + fi + log_action_begin_msg "Mounting VyOS Config" # ensure the vyatta_configdir supports a large number of inodes since # the config hierarchy is often inode-bound (instead of size). |