diff options
Diffstat (limited to 'src/conf_mode')
| -rwxr-xr-x | src/conf_mode/vpn_l2tp.py | 276 |
1 files changed, 144 insertions, 132 deletions
diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index b357be1ed..1058eeac6 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -19,6 +19,7 @@ import re from copy import deepcopy from socket import AF_INET, SOCK_STREAM, socket +from stat import S_IRUSR, S_IWUSR, S_IRGRP from sys import exit from time import sleep @@ -30,31 +31,36 @@ from vyos.util import run from vyos.validate import is_ipv4 from vyos import ConfigError -pidfile = r'/var/run/accel_l2tp.pid' -l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' -chap_secrets = l2tp_cnf_dir + '/chap-secrets' -l2tp_conf = l2tp_cnf_dir + '/l2tp.config' - +pidfile = '/var/run/accel_l2tp.pid' +l2tp_conf = '/etc/accel-ppp/l2tp/l2tp.config' +l2tp_chap_secrets = '/etc/accel-ppp/l2tp/chap-secrets' default_config_data = { - 'authentication': { - 'radiussrv': {}, - 'radiusopt': {}, - 'mppe': 'prefer' - }, - 'auth_proto' : [], - 'local_users' : [], - 'auth_mode' : 'local', - 'radius_server' : [], - 'outside_addr': '', - 'gateway_address': '10.255.255.0', - 'dnsv4': [], - 'dnsv6': [], - 'wins': [], + 'auth_mode': 'local', + 'auth_ppp_mppe': 'prefer', + 'auth_proto': ['auth_mschap_v2'], + 'chap_secrets_file': l2tp_chap_secrets, 'client_ip_pool': None, 'client_ip_subnets': [], 'client_ipv6_pool': {}, + 'dnsv4': [], + 'dnsv6': [], + 'gateway_address': '10.255.255.0', + 'local_users' : [], 'mtu': '1436', + 'outside_addr': '', + 'ppp_mppe': 'prefer', + 'radius_server': [], + 'radius_acct_tmo': '3', + 'radius_max_try': '3', + 'radius_timeout': '3', + 'radius_nas_id': '', + 'radius_nas_ip': '', + 'radius_source_address': '', + 'radius_shaper_attr': '', + 'radius_shaper_vendor': '', + 'radius_dynamic_author': '', + 'wins': [], 'ip6_column': '', 'ip6_dp_column': '', 'ppp_options': {}, @@ -115,6 +121,20 @@ def get_config(): if conf.exists(['authentication', 'mode']): l2tp['auth_mode'] = conf.return_value(['authentication', 'mode']) + if conf.exists(['authentication', 'protocols']): + auth_mods = { + 'pap': 'auth_pap', + 'chap': 'auth_chap_md5', + 'mschap': 'auth_mschap_v1', + 'mschap-v2': 'auth_mschap_v2' + } + + for proto in conf.return_values(['authentication', 'protocols']): + l2tp['auth_proto'].append(auth_mods[proto]) + + if conf.exists(['authentication', 'mppe']): + l2tp['auth_ppp_mppe'] = conf.return_value(['authentication', 'mppe']) + # # local auth if conf.exists(['authentication', 'local-users']): @@ -147,93 +167,98 @@ def get_config(): l2tp['local_users'].append(user) - conf.set_level(base_path) - # authentication mode radius servers and settings - if conf.exists('authentication mode radius'): - rsrvs = conf.list_nodes('authentication radius server') - for rsrv in rsrvs: - if conf.return_value('authentication radius server ' + rsrv + ' fail-time') == None: - ftime = '0' - else: - ftime = str(conf.return_value( - 'authentication radius server ' + rsrv + ' fail-time')) - if conf.return_value('authentication radius-server ' + rsrv + ' req-limit') == None: - reql = '0' - else: - reql = str(conf.return_value( - 'authentication radius server ' + rsrv + ' req-limit')) - - l2tp['authentication']['radiussrv'].update( - { - rsrv: { - 'secret': conf.return_value('authentication radius server ' + rsrv + ' key'), - 'fail-time': ftime, - 'req-limit': reql - } - } - ) - # Source ip address feature - if conf.exists('authentication radius source-address'): - l2tp['authentication']['radius_source_address'] = conf.return_value( - 'authentication radius source-address') + # + # RADIUS auth and settings + conf.set_level(base_path + ['authentication', 'radius']) + if conf.exists(['server']): + for server in conf.list_nodes(['server']): + radius = { + 'server' : server, + 'key' : '', + 'fail_time' : 0, + 'port' : '1812' + } + + conf.set_level(base_path + ['authentication', 'radius', 'server', server]) + + if conf.exists(['fail-time']): + radius['fail-time'] = conf.return_value(['fail-time']) + + if conf.exists(['port']): + radius['port'] = conf.return_value(['port']) + + if conf.exists(['key']): + radius['key'] = conf.return_value(['key']) + if not conf.exists(['disable']): + l2tp['radius_server'].append(radius) + + # # advanced radius-setting - if conf.exists('authentication radius acct-timeout'): - l2tp['authentication']['radiusopt']['acct-timeout'] = conf.return_value( - 'authentication radius acct-timeout') - if conf.exists('authentication radius max-try'): - l2tp['authentication']['radiusopt']['max-try'] = conf.return_value( - 'authentication radius max-try') - if conf.exists('authentication radius timeout'): - l2tp['authentication']['radiusopt']['timeout'] = conf.return_value( - 'authentication radius timeout') - if conf.exists('authentication radius nas-identifier'): - l2tp['authentication']['radiusopt']['nas-id'] = conf.return_value( - 'authentication radius nas-identifier') - if conf.exists('authentication radius dae-server'): - # Set default dae-server port if not defined - if conf.exists('authentication radius dae-server port'): - dae_server_port = conf.return_value( - 'authentication radius dae-server port') - else: - dae_server_port = "3799" - l2tp['authentication']['radiusopt'].update( - { - 'dae-srv': { - 'ip-addr': conf.return_value('authentication radius dae-server ip-address'), - 'port': dae_server_port, - 'secret': str(conf.return_value('authentication radius dae-server secret')) - } - } - ) - # filter-id is the internal accel default if attribute is empty - # set here as default for visibility which may change in the future - if conf.exists('authentication radius rate-limit enable'): - if not conf.exists('authentication radius rate-limit attribute'): - l2tp['authentication']['radiusopt']['shaper'] = { - 'attr': 'Filter-Id' - } - else: - l2tp['authentication']['radiusopt']['shaper'] = { - 'attr': conf.return_value('authentication radius rate-limit attribute') - } - if conf.exists('authentication radius rate-limit vendor'): - l2tp['authentication']['radiusopt']['shaper']['vendor'] = conf.return_value( - 'authentication radius rate-limit vendor') - - if conf.exists('client-ip-pool'): - if conf.exists('client-ip-pool start') and conf.exists('client-ip-pool stop'): - l2tp['client_ip_pool'] = conf.return_value( - 'client-ip-pool start') + '-' + re.search('[0-9]+$', conf.return_value('client-ip-pool stop')).group(0) - - if conf.exists('client-ip-pool subnet'): - l2tp['client_ip_subnets'] = conf.return_values( - 'client-ip-pool subnet') - - if conf.exists('client-ipv6-pool prefix'): + conf.set_level(base_path + ['authentication', 'radius']) + + if conf.exists(['acct-timeout']): + l2tp['radius_acct_tmo'] = conf.return_value(['acct-timeout']) + + if conf.exists(['max-try']): + l2tp['radius_max_try'] = conf.return_value(['max-try']) + + if conf.exists(['timeout']): + l2tp['radius_timeout'] = conf.return_value(['timeout']) + + if conf.exists(['nas-identifier']): + l2tp['radius_nas_id'] = conf.return_value(['nas-identifier']) + + if conf.exists(['nas-ip-address']): + l2tp['radius_nas_ip'] = conf.return_value(['nas-ip-address']) + + if conf.exists(['source-address']): + l2tp['radius_source_address'] = conf.return_value(['source-address']) + + # Dynamic Authorization Extensions (DOA)/Change Of Authentication (COA) + if conf.exists(['dynamic-author']): + dae = { + 'port' : '', + 'server' : '', + 'key' : '' + } + + if conf.exists(['dynamic-author', 'server']): + dae['server'] = conf.return_value(['dynamic-author', 'server']) + + if conf.exists(['dynamic-author', 'port']): + dae['port'] = conf.return_value(['dynamic-author', 'port']) + + if conf.exists(['dynamic-author', 'key']): + dae['key'] = conf.return_value(['dynamic-author', 'key']) + + l2tp['radius_dynamic_author'] = dae + + if conf.exists(['rate-limit', 'enable']): + l2tp['radius_shaper_attr'] = 'Filter-Id' + c_attr = ['rate-limit', 'enable', 'attribute'] + if conf.exists(c_attr): + l2tp['radius_shaper_attr'] = conf.return_value(c_attr) + + c_vendor = ['rate-limit', 'enable', 'vendor'] + if conf.exists(c_vendor): + l2tp['radius_shaper_vendor'] = conf.return_value(c_vendor) + + conf.set_level(base_path) + if conf.exists(['client-ip-pool']): + if conf.exists(['client-ip-pool', 'start']) and conf.exists(['client-ip-pool', 'stop']): + start = conf.return_value(['client-ip-pool', 'start']) + stop = conf.return_value(['client-ip-pool', 'stop']) + l2tp['client_ip_pool'] = start + '-' + re.search('[0-9]+$', stop).group(0) + + if conf.exists(['client-ip-pool', 'subnet']): + l2tp['client_ip_subnets'] = conf.return_values(['client-ip-pool', 'subnet']) + + if conf.exists(['client-ipv6-pool', 'prefix']): l2tp['client_ipv6_pool']['prefix'] = conf.return_values( 'client-ipv6-pool prefix') l2tp['ip6_column'] = 'ip6,' + if conf.exists('client-ipv6-pool delegate-prefix'): l2tp['client_ipv6_pool']['delegate_prefix'] = conf.return_values( 'client-ipv6-pool delegate-prefix') @@ -257,26 +282,6 @@ def get_config(): 'client-ip-pool subnet')[0]) l2tp['gateway_address'] = lst_ip[0] - # - # authentication protocols - conf.set_level(base_path + ['authentication']) - if conf.exists(['protocols']): - auth_mods = { - 'pap': 'auth_pap', - 'chap': 'auth_chap_md5', - 'mschap': 'auth_mschap_v1', - 'mschap-v2': 'auth_mschap_v2' - } - - for proto in conf.return_values(['protocols']): - l2tp['auth_proto'].append(auth_mods[proto]) - - else: - l2tp['auth_proto'] = ['auth_mschap_v2'] - - if conf.exists('authentication mppe'): - l2tp['authentication']['mppe'] = conf.return_value( - 'authentication mppe') if conf.exists('idle'): l2tp['idle_timeout'] = conf.return_value('idle') @@ -319,13 +324,12 @@ def verify(l2tp): raise ConfigError(f"Password required for user {user['name']}") elif l2tp['auth_mode'] == 'radius': - if len(l2tp['authentication']['radiussrv']) == 0: - raise ConfigError('radius server required') + if len(l2tp['radius_server']) == 0: + raise ConfigError("RADIUS authentication requires at least one server") - for rsrv in l2tp['authentication']['radiussrv']: - if l2tp['authentication']['radiussrv'][rsrv]['secret'] == None: - raise ConfigError('radius server ' + rsrv + - ' needs a secret configured') + for radius in l2tp['radius_server']: + if not radius['key']: + raise ConfigError(f"Missing RADIUS secret for server {{ radius['key'] }}") # check for the existence of a client ip pool if not (l2tp['client_ip_pool'] or l2tp['client_ip_subnets']): @@ -350,11 +354,13 @@ def verify(l2tp): def generate(l2tp): - if l2tp == None: + if not l2tp: return None - if not os.path.exists(l2tp_cnf_dir): - os.makedirs(l2tp_cnf_dir) + # Create configuration directory if it's non existent + dirname = os.path.dirname(l2tp_conf) + if not os.path.isdir(dirname): + os.mkdir(dirname) # Prepare Jinja2 template loader from files tmpl_path = os.path.join(vyos_data_dir['data'], 'templates', 'l2tp') @@ -369,14 +375,20 @@ def generate(l2tp): if l2tp['auth_mode'] == 'local': tmpl = env.get_template('chap-secrets.tmpl') config_text = tmpl.render(l2tp) - with open(chap_secrets, 'w') as f: + with open(l2tp['chap_secrets_file'], 'w') as f: f.write(config_text) + os.chmod(l2tp['chap_secrets_file'], S_IRUSR | S_IWUSR | S_IRGRP) + + else: + if os.path.exists(l2tp['chap_secrets_file']): + os.unlink(l2tp['chap_secrets_file']) + return None def apply(l2tp): - if l2tp == None: + if not l2tp: if os.path.exists(pidfile): _accel_cmd('shutdown hard') if os.path.exists(pidfile): |