diff options
Diffstat (limited to 'src/conf_mode')
| -rwxr-xr-x | src/conf_mode/host_name.py | 4 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-dummy.py | 117 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-loopback.py | 60 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-macsec.py | 208 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-pppoe.py | 206 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-tunnel.py | 118 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-wirelessmodem.py | 143 | ||||
| -rwxr-xr-x | src/conf_mode/ntp.py | 71 | ||||
| -rwxr-xr-x | src/conf_mode/ssh.py | 2 | ||||
| -rwxr-xr-x | src/conf_mode/system_console.py | 2 | ||||
| -rwxr-xr-x | src/conf_mode/vrf.py | 2 |
11 files changed, 270 insertions, 663 deletions
diff --git a/src/conf_mode/host_name.py b/src/conf_mode/host_name.py index 3e301477d..f2fa64233 100755 --- a/src/conf_mode/host_name.py +++ b/src/conf_mode/host_name.py @@ -97,10 +97,6 @@ def verify(conf, hosts): for host, hostprops in hosts['static_host_mapping'].items(): if not hostprops['address']: raise ConfigError(f'IP address required for static-host-mapping "{host}"') - if hostprops['address'] in all_static_host_mapping_addresses: - raise ConfigError(( - f'static-host-mapping "{host}" address "{hostprops["address"]}"' - f'already used in another static-host-mapping')) all_static_host_mapping_addresses.append(hostprops['address']) for a in hostprops['aliases']: if not hostname_regex.match(a) and len(a) != 0: diff --git a/src/conf_mode/interfaces-dummy.py b/src/conf_mode/interfaces-dummy.py index ec255edd5..2d62420a6 100755 --- a/src/conf_mode/interfaces-dummy.py +++ b/src/conf_mode/interfaces-dummy.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2019 VyOS maintainers and contributors +# Copyright (C) 2019-2020 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -16,98 +16,53 @@ import os -from copy import deepcopy from sys import exit -from netifaces import interfaces -from vyos.ifconfig import DummyIf -from vyos.configdict import list_diff from vyos.config import Config +from vyos.configverify import verify_vrf +from vyos.configverify import verify_address +from vyos.configverify import verify_bridge_delete +from vyos.ifconfig import DummyIf from vyos.validate import is_member from vyos import ConfigError - from vyos import airbag airbag.enable() -default_config_data = { - 'address': [], - 'address_remove': [], - 'deleted': False, - 'description': '', - 'disable': False, - 'intf': '', - 'is_bridge_member': False, - 'vrf': '' -} - def get_config(): - dummy = deepcopy(default_config_data) + """ Retrive CLI config as dictionary. Dictionary can never be empty, + as at least the interface name will be added or a deleted flag """ conf = Config() # determine tagNode instance if 'VYOS_TAGNODE_VALUE' not in os.environ: raise ConfigError('Interface (VYOS_TAGNODE_VALUE) not specified') - dummy['intf'] = os.environ['VYOS_TAGNODE_VALUE'] - - # check if we are a member of any bridge - dummy['is_bridge_member'] = is_member(conf, dummy['intf'], 'bridge') + ifname = os.environ['VYOS_TAGNODE_VALUE'] + base = ['interfaces', 'dummy', ifname] + dummy = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) # Check if interface has been removed - if not conf.exists('interfaces dummy ' + dummy['intf']): - dummy['deleted'] = True - return dummy - - # set new configuration level - conf.set_level('interfaces dummy ' + dummy['intf']) + if dummy == {}: + dummy.update({'deleted' : ''}) - # retrieve configured interface addresses - if conf.exists('address'): - dummy['address'] = conf.return_values('address') + # store interface instance name in dictionary + dummy.update({'ifname': ifname}) - # retrieve interface description - if conf.exists('description'): - dummy['description'] = conf.return_value('description') - - # Disable this interface - if conf.exists('disable'): - dummy['disable'] = True - - # Determine interface addresses (currently effective) - to determine which - # address is no longer valid and needs to be removed from the interface - eff_addr = conf.return_effective_values('address') - act_addr = conf.return_values('address') - dummy['address_remove'] = list_diff(eff_addr, act_addr) - - # retrieve VRF instance - if conf.exists('vrf'): - dummy['vrf'] = conf.return_value('vrf') + # check if we are a member of any bridge + bridge = is_member(conf, ifname, 'bridge') + if bridge: + tmp = {'is_bridge_member' : bridge} + dummy.update(tmp) return dummy def verify(dummy): - if dummy['deleted']: - if dummy['is_bridge_member']: - raise ConfigError(( - f'Interface "{dummy["intf"]}" cannot be deleted as it is a ' - f'member of bridge "{dummy["is_bridge_member"]}"!')) - + if 'deleted' in dummy.keys(): + verify_bridge_delete(dummy) return None - if dummy['vrf']: - if dummy['vrf'] not in interfaces(): - raise ConfigError(f'VRF "{dummy["vrf"]}" does not exist') - - if dummy['is_bridge_member']: - raise ConfigError(( - f'Interface "{dummy["intf"]}" cannot be member of VRF ' - f'"{dummy["vrf"]}" and bridge "{dummy["is_bridge_member"]}" ' - f'at the same time!')) - - if dummy['is_bridge_member'] and dummy['address']: - raise ConfigError(( - f'Cannot assign address to interface "{dummy["intf"]}" ' - f'as it is a member of bridge "{dummy["is_bridge_member"]}"!')) + verify_vrf(dummy) + verify_address(dummy) return None @@ -115,33 +70,13 @@ def generate(dummy): return None def apply(dummy): - d = DummyIf(dummy['intf']) + d = DummyIf(dummy['ifname']) # Remove dummy interface - if dummy['deleted']: + if 'deleted' in dummy.keys(): d.remove() else: - # update interface description used e.g. within SNMP - d.set_alias(dummy['description']) - - # Configure interface address(es) - # - not longer required addresses get removed first - # - newly addresses will be added second - for addr in dummy['address_remove']: - d.del_addr(addr) - for addr in dummy['address']: - d.add_addr(addr) - - # assign/remove VRF (ONLY when not a member of a bridge, - # otherwise 'nomaster' removes it from it) - if not dummy['is_bridge_member']: - d.set_vrf(dummy['vrf']) - - # disable interface on demand - if dummy['disable']: - d.set_admin_state('down') - else: - d.set_admin_state('up') + d.update(dummy) return None diff --git a/src/conf_mode/interfaces-loopback.py b/src/conf_mode/interfaces-loopback.py index df268cec2..2368f88a9 100755 --- a/src/conf_mode/interfaces-loopback.py +++ b/src/conf_mode/interfaces-loopback.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2019 VyOS maintainers and contributors +# Copyright (C) 2019-2020 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -17,54 +17,31 @@ import os from sys import exit -from copy import deepcopy from vyos.ifconfig import LoopbackIf -from vyos.configdict import list_diff from vyos.config import Config -from vyos import ConfigError - -from vyos import airbag +from vyos import ConfigError, airbag airbag.enable() -default_config_data = { - 'address': [], - 'address_remove': [], - 'deleted': False, - 'description': '', -} - - def get_config(): - loopback = deepcopy(default_config_data) + """ Retrive CLI config as dictionary. Dictionary can never be empty, + as at least the interface name will be added or a deleted flag """ conf = Config() # determine tagNode instance if 'VYOS_TAGNODE_VALUE' not in os.environ: raise ConfigError('Interface (VYOS_TAGNODE_VALUE) not specified') - loopback['intf'] = os.environ['VYOS_TAGNODE_VALUE'] + ifname = os.environ['VYOS_TAGNODE_VALUE'] + base = ['interfaces', 'loopback', ifname] + loopback = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) # Check if interface has been removed - if not conf.exists('interfaces loopback ' + loopback['intf']): - loopback['deleted'] = True - - # set new configuration level - conf.set_level('interfaces loopback ' + loopback['intf']) + if loopback == {}: + loopback.update({'deleted' : ''}) - # retrieve configured interface addresses - if conf.exists('address'): - loopback['address'] = conf.return_values('address') - - # retrieve interface description - if conf.exists('description'): - loopback['description'] = conf.return_value('description') - - # Determine interface addresses (currently effective) - to determine which - # address is no longer valid and needs to be removed from the interface - eff_addr = conf.return_effective_values('address') - act_addr = conf.return_values('address') - loopback['address_remove'] = list_diff(eff_addr, act_addr) + # store interface instance name in dictionary + loopback.update({'ifname': ifname}) return loopback @@ -75,20 +52,11 @@ def generate(loopback): return None def apply(loopback): - l = LoopbackIf(loopback['intf']) - if loopback['deleted']: + l = LoopbackIf(loopback['ifname']) + if 'deleted' in loopback.keys(): l.remove() else: - # update interface description used e.g. within SNMP - l.set_alias(loopback['description']) - - # Configure interface address(es) - # - not longer required addresses get removed first - # - newly addresses will be added second - for addr in loopback['address_remove']: - l.del_addr(addr) - for addr in loopback['address']: - l.add_addr(addr) + l.update(loopback) return None diff --git a/src/conf_mode/interfaces-macsec.py b/src/conf_mode/interfaces-macsec.py index a8966148f..56273f71a 100755 --- a/src/conf_mode/interfaces-macsec.py +++ b/src/conf_mode/interfaces-macsec.py @@ -18,177 +18,108 @@ import os from copy import deepcopy from sys import exit -from netifaces import interfaces from vyos.config import Config -from vyos.configdict import list_diff +from vyos.configdict import dict_merge from vyos.ifconfig import MACsecIf from vyos.template import render from vyos.util import call from vyos.validate import is_member +from vyos.configverify import verify_vrf +from vyos.configverify import verify_address +from vyos.configverify import verify_bridge_delete +from vyos.configverify import verify_source_interface +from vyos.xml import defaults from vyos import ConfigError - from vyos import airbag airbag.enable() -default_config_data = { - 'address': [], - 'address_remove': [], - 'deleted': False, - 'description': '', - 'disable': False, - 'security_cipher': '', - 'security_encrypt': False, - 'security_mka_cak': '', - 'security_mka_ckn': '', - 'security_mka_priority': '255', - 'security_replay_window': '', - 'intf': '', - 'source_interface': '', - 'is_bridge_member': False, - 'vrf': '' -} - # XXX: wpa_supplicant works on the source interface wpa_suppl_conf = '/run/wpa_supplicant/{source_interface}.conf' - def get_config(): - macsec = deepcopy(default_config_data) + """ Retrive CLI config as dictionary. Dictionary can never be empty, + as at least the interface name will be added or a deleted flag """ conf = Config() # determine tagNode instance if 'VYOS_TAGNODE_VALUE' not in os.environ: raise ConfigError('Interface (VYOS_TAGNODE_VALUE) not specified') - macsec['intf'] = os.environ['VYOS_TAGNODE_VALUE'] - base_path = ['interfaces', 'macsec', macsec['intf']] + # retrieve interface default values + base = ['interfaces', 'macsec'] + default_values = defaults(base) - # check if we are a member of any bridge - macsec['is_bridge_member'] = is_member(conf, macsec['intf'], 'bridge') + ifname = os.environ['VYOS_TAGNODE_VALUE'] + base = base + [ifname] + macsec = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) # Check if interface has been removed - if not conf.exists(base_path): - macsec['deleted'] = True - # When stopping wpa_supplicant we need to stop it via the physical - # interface - thus we need to retrieve ir from the effective config - if conf.exists_effective(base_path + ['source-interface']): - macsec['source_interface'] = conf.return_effective_value( - base_path + ['source-interface']) - - return macsec - - # set new configuration level - conf.set_level(base_path) - - # retrieve configured interface addresses - if conf.exists(['address']): - macsec['address'] = conf.return_values(['address']) - - # retrieve interface description - if conf.exists(['description']): - macsec['description'] = conf.return_value(['description']) - - # Disable this interface - if conf.exists(['disable']): - macsec['disable'] = True - - # retrieve interface cipher - if conf.exists(['security', 'cipher']): - macsec['security_cipher'] = conf.return_value(['security', 'cipher']) - - # Enable optional MACsec encryption - if conf.exists(['security', 'encrypt']): - macsec['security_encrypt'] = True - - # Secure Connectivity Association Key - if conf.exists(['security', 'mka', 'cak']): - macsec['security_mka_cak'] = conf.return_value( - ['security', 'mka', 'cak']) - - # Secure Connectivity Association Name - if conf.exists(['security', 'mka', 'ckn']): - macsec['security_mka_ckn'] = conf.return_value( - ['security', 'mka', 'ckn']) - - # MACsec Key Agreement protocol (MKA) actor priority - if conf.exists(['security', 'mka', 'priority']): - macsec['security_mka_priority'] = conf.return_value( - ['security', 'mka', 'priority']) - - # IEEE 802.1X/MACsec replay protection - if conf.exists(['security', 'replay-window']): - macsec['security_replay_window'] = conf.return_value( - ['security', 'replay-window']) - - # Physical interface - if conf.exists(['source-interface']): - macsec['source_interface'] = conf.return_value(['source-interface']) - - # Determine interface addresses (currently effective) - to determine which - # address is no longer valid and needs to be removed from the interface - eff_addr = conf.return_effective_values(['address']) - act_addr = conf.return_values(['address']) - macsec['address_remove'] = list_diff(eff_addr, act_addr) - - # retrieve VRF instance - if conf.exists(['vrf']): - macsec['vrf'] = conf.return_value(['vrf']) + if macsec == {}: + tmp = { + 'deleted' : '', + 'source_interface' : conf.return_effective_value( + base + ['source-interface']) + } + macsec.update(tmp) + + # We have gathered the dict representation of the CLI, but there are + # default options which we need to update into the dictionary + # retrived. + macsec = dict_merge(default_values, macsec) + + # Add interface instance name into dictionary + macsec.update({'ifname': ifname}) + + # Check if we are a member of any bridge + bridge = is_member(conf, ifname, 'bridge') + if bridge: + tmp = {'is_bridge_member' : bridge} + macsec.update(tmp) return macsec def verify(macsec): - if macsec['deleted']: - if macsec['is_bridge_member']: - raise ConfigError( - 'Interface "{intf}" cannot be deleted as it is a ' - 'member of bridge "{is_bridge_member}"!'.format(**macsec)) - + if 'deleted' in macsec.keys(): + verify_bridge_delete(macsec) return None - if not macsec['source_interface']: - raise ConfigError('Physical source interface must be set for ' - 'MACsec "{intf}"'.format(**macsec)) + verify_source_interface(macsec) + verify_vrf(macsec) + verify_address(macsec) - if not macsec['security_cipher']: + if not (('security' in macsec.keys()) and + ('cipher' in macsec['security'].keys())): raise ConfigError( - 'Cipher suite must be set for MACsec "{intf}"'.format(**macsec)) - - if macsec['security_encrypt']: - if not (macsec['security_mka_cak'] and macsec['security_mka_ckn']): - raise ConfigError( - 'MACsec security keys mandartory when encryption is enabled') + 'Cipher suite must be set for MACsec "{ifname}"'.format(**macsec)) - if macsec['vrf']: - if macsec['vrf'] not in interfaces(): - raise ConfigError('VRF "{vrf}" does not exist'.format(**macsec)) + if (('security' in macsec.keys()) and + ('encrypt' in macsec['security'].keys())): + tmp = macsec.get('security') - if macsec['is_bridge_member']: - raise ConfigError('Interface "{intf}" cannot be member of VRF ' - '"{vrf}" and bridge "{is_bridge_member}" at ' - 'the same time!'.format(**macsec)) - - if macsec['is_bridge_member'] and macsec['address']: - raise ConfigError( - 'Cannot assign address to interface "{intf}" as it is' - 'a member of bridge "{is_bridge_member}"!'.format(**macsec)) + if not (('mka' in tmp.keys()) and + ('cak' in tmp['mka'].keys()) and + ('ckn' in tmp['mka'].keys())): + raise ConfigError('Missing mandatory MACsec security ' + 'keys as encryption is enabled!') return None def generate(macsec): render(wpa_suppl_conf.format(**macsec), - 'macsec/wpa_supplicant.conf.tmpl', macsec, permission=0o640) + 'macsec/wpa_supplicant.conf.tmpl', macsec) return None def apply(macsec): # Remove macsec interface - if macsec['deleted']: + if 'deleted' in macsec.keys(): call('systemctl stop wpa_supplicant-macsec@{source_interface}' .format(**macsec)) - MACsecIf(macsec['intf']).remove() + + MACsecIf(macsec['ifname']).remove() # delete configuration on interface removal if os.path.isfile(wpa_suppl_conf.format(**macsec)): @@ -198,35 +129,16 @@ def apply(macsec): # MACsec interfaces require a configuration when they are added using # iproute2. This static method will provide the configuration # dictionary used by this class. - conf = deepcopy(MACsecIf.get_config()) - # Assign MACsec instance configuration parameters to config dict + # XXX: subject of removal after completing T2653 + conf = deepcopy(MACsecIf.get_config()) conf['source_interface'] = macsec['source_interface'] - conf['security_cipher'] = macsec['security_cipher'] + conf['security_cipher'] = macsec['security']['cipher'] # It is safe to "re-create" the interface always, there is a sanity # check that the interface will only be create if its non existent - i = MACsecIf(macsec['intf'], **conf) - - # update interface description used e.g. within SNMP - i.set_alias(macsec['description']) - - # Configure interface address(es) - # - not longer required addresses get removed first - # - newly addresses will be added second - for addr in macsec['address_remove']: - i.del_addr(addr) - for addr in macsec['address']: - i.add_addr(addr) - - # assign/remove VRF (ONLY when not a member of a bridge, - # otherwise 'nomaster' removes it from it) - if not macsec['is_bridge_member']: - i.set_vrf(macsec['vrf']) - - # Interface is administratively down by default, enable if desired - if not macsec['disable']: - i.set_admin_state('up') + i = MACsecIf(macsec['ifname'], **conf) + i.update(macsec) call('systemctl restart wpa_supplicant-macsec@{source_interface}' .format(**macsec)) diff --git a/src/conf_mode/interfaces-pppoe.py b/src/conf_mode/interfaces-pppoe.py index 611206d84..3ee57e83c 100755 --- a/src/conf_mode/interfaces-pppoe.py +++ b/src/conf_mode/interfaces-pppoe.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2019 VyOS maintainers and contributors +# Copyright (C) 2019-2020 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -15,179 +15,65 @@ # along with this program. If not, see <http://www.gnu.org/licenses/>. import os +import jmespath from sys import exit from copy import deepcopy from netifaces import interfaces from vyos.config import Config -from vyos.configdict import dhcpv6_pd_default_data -from vyos.ifconfig import Interface +from vyos.configdict import dict_merge +from vyos.configverify import verify_source_interface +from vyos.configverify import verify_vrf from vyos.template import render -from vyos.util import chown, chmod_755, call +from vyos.util import call +from vyos.xml import defaults from vyos import ConfigError - from vyos import airbag airbag.enable() -default_config_data = { - **dhcpv6_pd_default_data, - 'access_concentrator': '', - 'auth_username': '', - 'auth_password': '', - 'on_demand': False, - 'default_route': 'auto', - 'deleted': False, - 'description': '\0', - 'disable': False, - 'intf': '', - 'idle_timeout': '', - 'ipv6_autoconf': False, - 'ipv6_enable': False, - 'local_address': '', - 'mtu': '1492', - 'name_server': True, - 'remote_address': '', - 'service_name': '', - 'source_interface': '', - 'vrf': '' -} - def get_config(): - pppoe = deepcopy(default_config_data) + """ Retrive CLI config as dictionary. Dictionary can never be empty, + as at least the interface name will be added or a deleted flag """ conf = Config() - base_path = ['interfaces', 'pppoe'] # determine tagNode instance if 'VYOS_TAGNODE_VALUE' not in os.environ: raise ConfigError('Interface (VYOS_TAGNODE_VALUE) not specified') - pppoe['intf'] = os.environ['VYOS_TAGNODE_VALUE'] - - # Check if interface has been removed - if not conf.exists(base_path + [pppoe['intf']]): - pppoe['deleted'] = True - return pppoe - - # set new configuration level - conf.set_level(base_path + [pppoe['intf']]) - - # Access concentrator name (only connect to this concentrator) - if conf.exists(['access-concentrator']): - pppoe['access_concentrator'] = conf.return_values(['access-concentrator']) - - # Authentication name supplied to PPPoE server - if conf.exists(['authentication', 'user']): - pppoe['auth_username'] = conf.return_value(['authentication', 'user']) - - # Password for authenticating local machine to PPPoE server - if conf.exists(['authentication', 'password']): - pppoe['auth_password'] = conf.return_value(['authentication', 'password']) - - # Access concentrator name (only connect to this concentrator) - if conf.exists(['connect-on-demand']): - pppoe['on_demand'] = True - - # Enable/Disable default route to peer when link comes up - if conf.exists(['default-route']): - pppoe['default_route'] = conf.return_value(['default-route']) - - # Retrieve interface description - if conf.exists(['description']): - pppoe['description'] = conf.return_value(['description']) - - # Disable this interface - if conf.exists(['disable']): - pppoe['disable'] = True - - # Delay before disconnecting idle session (in seconds) - if conf.exists(['idle-timeout']): - pppoe['idle_timeout'] = conf.return_value(['idle-timeout']) - - # Enable Stateless Address Autoconfiguration (SLAAC) - if conf.exists(['ipv6', 'address', 'autoconf']): - pppoe['ipv6_autoconf'] = True + # retrieve interface default values + base = ['interfaces', 'pppoe'] + default_values = defaults(base) + # PPPoE is "special" the default MTU is 1492 - update accordingly + default_values['mtu'] = '1492' - # Activate IPv6 support on this connection - if conf.exists(['ipv6', 'enable']): - pppoe['ipv6_enable'] = True + ifname = os.environ['VYOS_TAGNODE_VALUE'] + base = base + [ifname] - # IPv4 address of local end of PPPoE link - if conf.exists(['local-address']): - pppoe['local_address'] = conf.return_value(['local-address']) - - # Physical Interface used for this PPPoE session - if conf.exists(['source-interface']): - pppoe['source_interface'] = conf.return_value(['source-interface']) - - # Maximum Transmission Unit (MTU) - if conf.exists(['mtu']): - pppoe['mtu'] = conf.return_value(['mtu']) - - # Do not use DNS servers provided by the peer - if conf.exists(['no-peer-dns']): - pppoe['name_server'] = False - - # IPv4 address for remote end of PPPoE session - if conf.exists(['remote-address']): - pppoe['remote_address'] = conf.return_value(['remote-address']) - - # Service name, only connect to access concentrators advertising this - if conf.exists(['service-name']): - pppoe['service_name'] = conf.return_value(['service-name']) - - # retrieve VRF instance - if conf.exists('vrf'): - pppoe['vrf'] = conf.return_value(['vrf']) - - if conf.exists(['dhcpv6-options', 'prefix-delegation']): - dhcpv6_pd_path = base_path + [pppoe['intf'], - 'dhcpv6-options', 'prefix-delegation'] - conf.set_level(dhcpv6_pd_path) - - # Retrieve DHCPv6-PD prefix helper length as some ISPs only hand out a - # /64 by default (https://phabricator.vyos.net/T2506) - if conf.exists(['length']): - pppoe['dhcpv6_pd_length'] = conf.return_value(['length']) - - for interface in conf.list_nodes(['interface']): - conf.set_level(dhcpv6_pd_path + ['interface', interface]) - pd = { - 'ifname': interface, - 'sla_id': '', - 'sla_len': '', - 'if_id': '' - } - - if conf.exists(['sla-id']): - pd['sla_id'] = conf.return_value(['sla-id']) - - if conf.exists(['sla-len']): - pd['sla_len'] = conf.return_value(['sla-len']) + pppoe = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) + # Check if interface has been removed + if pppoe == {}: + pppoe.update({'deleted' : ''}) - if conf.exists(['address']): - pd['if_id'] = conf.return_value(['address']) + # We have gathered the dict representation of the CLI, but there are + # default options which we need to update into the dictionary + # retrived. + pppoe = dict_merge(default_values, pppoe) - pppoe['dhcpv6_pd_interfaces'].append(pd) + # Add interface instance name into dictionary + pppoe.update({'ifname': ifname}) return pppoe def verify(pppoe): - if pppoe['deleted']: + if 'deleted' in pppoe.keys(): # bail out early return None - if not pppoe['source_interface']: - raise ConfigError('PPPoE source interface missing') - - if not pppoe['source_interface'] in interfaces(): - raise ConfigError(f"PPPoE source interface {pppoe['source_interface']} does not exist") - - vrf_name = pppoe['vrf'] - if vrf_name and vrf_name not in interfaces(): - raise ConfigError(f'VRF {vrf_name} does not exist') + verify_source_interface(pppoe) + verify_vrf(pppoe) - if pppoe['on_demand'] and pppoe['vrf']: + if {'connect_on_demand', 'vrf'} <= set(pppoe): raise ConfigError('On-demand dialing and VRF can not be used at the same time') return None @@ -195,22 +81,22 @@ def verify(pppoe): def generate(pppoe): # set up configuration file path variables where our templates will be # rendered into - intf = pppoe['intf'] - config_pppoe = f'/etc/ppp/peers/{intf}' - script_pppoe_pre_up = f'/etc/ppp/ip-pre-up.d/1000-vyos-pppoe-{intf}' - script_pppoe_ip_up = f'/etc/ppp/ip-up.d/1000-vyos-pppoe-{intf}' - script_pppoe_ip_down = f'/etc/ppp/ip-down.d/1000-vyos-pppoe-{intf}' - script_pppoe_ipv6_up = f'/etc/ppp/ipv6-up.d/1000-vyos-pppoe-{intf}' - config_wide_dhcp6c = f'/run/dhcp6c/dhcp6c.{intf}.conf' + ifname = pppoe['ifname'] + config_pppoe = f'/etc/ppp/peers/{ifname}' + script_pppoe_pre_up = f'/etc/ppp/ip-pre-up.d/1000-vyos-pppoe-{ifname}' + script_pppoe_ip_up = f'/etc/ppp/ip-up.d/1000-vyos-pppoe-{ifname}' + script_pppoe_ip_down = f'/etc/ppp/ip-down.d/1000-vyos-pppoe-{ifname}' + script_pppoe_ipv6_up = f'/etc/ppp/ipv6-up.d/1000-vyos-pppoe-{ifname}' + config_wide_dhcp6c = f'/run/dhcp6c/dhcp6c.{ifname}.conf' config_files = [config_pppoe, script_pppoe_pre_up, script_pppoe_ip_up, script_pppoe_ip_down, script_pppoe_ipv6_up, config_wide_dhcp6c] - if pppoe['deleted']: + if 'deleted' in pppoe.keys(): # stop DHCPv6-PD client - call(f'systemctl stop dhcp6c@{intf}.service') + call(f'systemctl stop dhcp6c@{ifname}.service') # Hang-up PPPoE connection - call(f'systemctl stop ppp@{intf}.service') + call(f'systemctl stop ppp@{ifname}.service') # Delete PPP configuration files for file in config_files: @@ -235,22 +121,22 @@ def generate(pppoe): render(script_pppoe_ipv6_up, 'pppoe/ipv6-up.script.tmpl', pppoe, trim_blocks=True, permission=0o755) - if len(pppoe['dhcpv6_pd_interfaces']) > 0: + tmp = jmespath.search('dhcpv6_options.prefix_delegation.interface', pppoe) + if tmp and len(tmp) > 0: # ipv6.tmpl relies on ifname - this should be made consitent in the # future better then double key-ing the same value - pppoe['ifname'] = intf - render(config_wide_dhcp6c, 'dhcp-client/ipv6.tmpl', pppoe, trim_blocks=True) + render(config_wide_dhcp6c, 'dhcp-client/ipv6_new.tmpl', pppoe, trim_blocks=True) return None def apply(pppoe): - if pppoe['deleted']: + if 'deleted' in pppoe.keys(): # bail out early return None - if not pppoe['disable']: + if 'disable' not in pppoe.keys(): # Dial PPPoE connection - call('systemctl restart ppp@{intf}.service'.format(**pppoe)) + call('systemctl restart ppp@{ifname}.service'.format(**pppoe)) return None diff --git a/src/conf_mode/interfaces-tunnel.py b/src/conf_mode/interfaces-tunnel.py index c13f77d91..ea15a7fb7 100755 --- a/src/conf_mode/interfaces-tunnel.py +++ b/src/conf_mode/interfaces-tunnel.py @@ -32,7 +32,8 @@ from vyos.dicts import FixedDict from vyos import airbag airbag.enable() -class ConfigurationState(Config): + +class ConfigurationState(object): """ The current API require a dict to be generated by get_config() which is then consumed by verify(), generate() and apply() @@ -40,7 +41,7 @@ class ConfigurationState(Config): ConfiguartionState is an helper class wrapping Config and providing an common API to this dictionary structure - Its to_dict() function return a dictionary containing three fields, + Its to_api() function return a dictionary containing three fields, each a dict, called options, changes, actions. options: @@ -84,16 +85,16 @@ class ConfigurationState(Config): which for each field represent how it was modified since the last commit """ - def __init__ (self, section, default): + def __init__(self, configuration, section, default): """ initialise the class for a given configuration path: - >>> conf = ConfigurationState('interfaces ethernet eth1') + >>> conf = ConfigurationState(conf, 'interfaces ethernet eth1') all further references to get_value(s) and get_effective(s) will be for this part of the configuration (eth1) """ - super().__init__() - self.section = section + self._conf = configuration + self.default = deepcopy(default) self.options = FixedDict(**default) self.actions = { @@ -104,13 +105,19 @@ class ConfigurationState(Config): 'delete': [], # the key was present and was deleted } self.changes = {} - if not self.exists(section): + if not self._conf.exists(section): self.changes['section'] = 'delete' - elif self.exists_effective(section): + elif self._conf.exists_effective(section): self.changes['section'] = 'modify' else: self.changes['section'] = 'create' + self.set_level(section) + + def set_level(self, lpath): + self.section = lpath + self._conf.set_level(lpath) + def _act(self, section): """ Returns for a given configuration field determine what happened to it @@ -121,18 +128,18 @@ class ConfigurationState(Config): 'delete': it was present but was removed from the configuration 'absent': it was not and is not present """ - if self.exists(section): - if self.exists_effective(section): - if self.return_value(section) != self.return_effective_value(section): + if self._conf.exists(section): + if self._conf.exists_effective(section): + if self._conf.return_value(section) != self._conf.return_effective_value(section): return 'modify' return 'static' return 'create' else: - if self.exists_effective(section): + if self._conf.exists_effective(section): return 'delete' return 'absent' - def _action (self, name, key): + def _action(self, name, key): action = self._act(key) self.changes[name] = action self.actions[action].append(name) @@ -157,18 +164,28 @@ class ConfigurationState(Config): """ if self._action(name, key) in ('delete', 'absent'): return - return self._get(name, key, default, self.return_value) + return self._get(name, key, default, self._conf.return_value) def get_values(self, name, key, default=None): """ - >>> conf.get_values('addresses-add', 'address') - will place a list made of the IP present in 'interface dummy dum1 address' - into the dictionnary entry 'addr' using Config.return_values - (the data in the configuration to apply) + >>> conf.get_values('addresses', 'address') + will place a list of the new IP present in 'interface dummy dum1 address' + into the dictionnary entry "-add" (here 'addresses-add') using + Config.return_values and will add the the one which were removed in into + the entry "-del" (here addresses-del') """ - if self._action(name, key) in ('delete', 'absent'): + add_name = f'{name}-add' + + if self._action(add_name, key) in ('delete', 'absent'): return - return self._get(name, key, default, self.return_values) + + self._get(add_name, key, default, self._conf.return_values) + + # get the effective values to determine which data is no longer valid + self.options['addresses-del'] = list_diff( + self._conf.return_effective_values('address'), + self.options['addresses-add'] + ) def get_effective(self, name, key, default=None): """ @@ -178,7 +195,7 @@ class ConfigurationState(Config): (the data in the configuration to apply) """ self._action(name, key) - return self._get(name, key, default, self.return_effective_value) + return self._get(name, key, default, self._conf.return_effective_value) def get_effectives(self, name, key, default=None): """ @@ -188,7 +205,7 @@ class ConfigurationState(Config): (the data in the un-modified configuration) """ self._action(name, key) - return self._get(name, key, default, self.return_effectives_value) + return self._get(name, key, default, self._conf.return_effectives_value) def load(self, mapping): """ @@ -220,16 +237,35 @@ class ConfigurationState(Config): else: self.get_value(local_name, config_name, default) - def remove_default (self,*options): + def remove_default(self,*options): """ remove all the values which were not changed from the default """ for option in options: - if self.exists(option) and self.self_return_value(option) != self.default[option]: + if not self._conf.exists(option): + del self.options[option] continue - del self.options[option] - def to_dict (self): + if self._conf.return_value(option) == self.default[option]: + del self.options[option] + continue + + if self._conf.return_values(option) == self.default[option]: + del self.options[option] + continue + + def as_dict(self, lpath): + l = self._conf.get_level() + self._conf.set_level([]) + d = self._conf.get_config_dict(lpath) + # XXX: that not what I would have expected from get_config_dict + if lpath: + d = d[lpath[-1]] + # XXX: it should have provided me the content and not the key + self._conf.set_level(l) + return d + + def to_api(self): """ provide a dictionary with the generated data for the configuration options: the configuration value for the key @@ -243,6 +279,7 @@ class ConfigurationState(Config): 'actions': self.actions, } + default_config_data = { # interface definition 'vrf': '', @@ -288,6 +325,7 @@ default_config_data = { '6rd-relay-prefix': '', } + # dict name -> config name, multiple values, default mapping = { 'type': ('encapsulation', False, None), @@ -310,7 +348,7 @@ mapping = { 'state': ('disable', False, 'down'), 'link_detect': ('disable-link-detect', False, 2), 'vrf': ('vrf', False, None), - 'addresses-add': ('address', True, None), + 'addresses': ('address', True, None), 'arp_filter': ('ip disable-arp-filter', False, 0), 'arp_accept': ('ip enable-arp-accept', False, 1), 'arp_announce': ('ip enable-arp-announce', False, 1), @@ -320,6 +358,7 @@ mapping = { 'ipv6_dad_transmits:': ('ipv6 dup-addr-detect-transmits', False, None) } + def get_class (options): dispatch = { 'gre': GREIf, @@ -363,19 +402,17 @@ def get_config(): if not ifname: raise ConfigError('Interface not specified') - conf = ConfigurationState('interfaces tunnel ' + ifname, default_config_data) + config = Config() + conf = ConfigurationState(config, ['interfaces', 'tunnel ', ifname], default_config_data) options = conf.options changes = conf.changes options['ifname'] = ifname - # set new configuration level - conf.set_level(conf.section) - if changes['section'] == 'delete': conf.get_effective('type', mapping['type'][0]) - conf.set_level('protocols nhrp tunnel') - options['nhrp'] = conf.list_nodes('') - return conf.to_dict() + config.set_level(['protocols', 'nhrp', 'tunnel']) + options['nhrp'] = config.list_nodes('') + return conf.to_api() # load all the configuration option according to the mapping conf.load(mapping) @@ -407,12 +444,6 @@ def get_config(): options['local'] = picked options['dhcp-interface'] = '' - # get interface addresses (currently effective) - to determine which - # address is no longer valid and needs to be removed - # could be done within ConfigurationState - eff_addr = conf.return_effective_values('address') - options['addresses-del'] = list_diff(eff_addr, options['addresses-add']) - # to make IPv6 SLAAC and DHCPv6 work with forwarding=1, # accept_ra must be 2 if options['ipv6_autoconf'] or 'dhcpv6' in options['addresses-add']: @@ -422,12 +453,11 @@ def get_config(): options['allmulticast'] = options['multicast'] # check that per encapsulation all local-remote pairs are unique - conf.set_level('interfaces tunnel') - ct = conf.get_config_dict()['tunnel'] + ct = conf.as_dict(['interfaces', 'tunnel']) options['tunnel'] = {} # check for bridges - options['bridge'] = is_member(conf, ifname, 'bridge') + options['bridge'] = is_member(config, ifname, 'bridge') options['interfaces'] = interfaces() for name in ct: @@ -440,7 +470,7 @@ def get_config(): pair = f'{local}-{remote}' options['tunnel'][encap][pair] = options['tunnel'].setdefault(encap, {}).get(pair, 0) + 1 - return conf.to_dict() + return conf.to_api() def verify(conf): diff --git a/src/conf_mode/interfaces-wirelessmodem.py b/src/conf_mode/interfaces-wirelessmodem.py index 35e3c583c..ec5a85e54 100755 --- a/src/conf_mode/interfaces-wirelessmodem.py +++ b/src/conf_mode/interfaces-wirelessmodem.py @@ -16,38 +16,19 @@ import os -from copy import deepcopy from fnmatch import fnmatch -from netifaces import interfaces from sys import exit from vyos.config import Config -from vyos.ifconfig import BridgeIf, Section +from vyos.configdict import dict_merge +from vyos.configverify import verify_vrf from vyos.template import render from vyos.util import call -from vyos.validate import is_member +from vyos.xml import defaults from vyos import ConfigError - from vyos import airbag airbag.enable() -default_config_data = { - 'apn': '', - 'chat_script': '', - 'deleted': False, - 'description': '', - 'device': '', - 'disable': False, - 'disable_link_detect': 1, - 'on_demand': False, - 'metric': '10', - 'mtu': '1500', - 'name_server': True, - 'is_bridge_member': False, - 'intf': '', - 'vrf': '' -} - def check_kmod(): modules = ['option', 'usb_wwan', 'usbserial'] for module in modules: @@ -66,115 +47,80 @@ def find_device_file(device): return None def get_config(): - wwan = deepcopy(default_config_data) + """ Retrive CLI config as dictionary. Dictionary can never be empty, + as at least the interface name will be added or a deleted flag """ conf = Config() # determine tagNode instance if 'VYOS_TAGNODE_VALUE' not in os.environ: raise ConfigError('Interface (VYOS_TAGNODE_VALUE) not specified') - wwan['intf'] = os.environ['VYOS_TAGNODE_VALUE'] - wwan['chat_script'] = f"/etc/ppp/peers/chat.{wwan['intf']}" + # retrieve interface default values + base = ['interfaces', 'wirelessmodem'] + default_values = defaults(base) + + ifname = os.environ['VYOS_TAGNODE_VALUE'] + base = base + [ifname] + wwan = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) # Check if interface has been removed - if not conf.exists('interfaces wirelessmodem ' + wwan['intf']): - wwan['deleted'] = True - return wwan - - # set new configuration level - conf.set_level('interfaces wirelessmodem ' + wwan['intf']) - - # get metrick for backup default route - if conf.exists(['apn']): - wwan['apn'] = conf.return_value(['apn']) - - # get metrick for backup default route - if conf.exists(['backup', 'distance']): - wwan['metric'] = conf.return_value(['backup', 'distance']) - - # Retrieve interface description - if conf.exists(['description']): - wwan['description'] = conf.return_value(['description']) - - # System device name - if conf.exists(['device']): - tmp = conf.return_value(['device']) - wwan['device'] = find_device_file(tmp) - # If device file was not found in /dev we will just re-use - # the plain device name, thus we can trigger the exception - # in verify() as it's a non existent file - if wwan['device'] == None: - wwan['device'] = tmp - - # disable interface - if conf.exists('disable'): - wwan['disable'] = True - - # ignore link state changes - if conf.exists('disable-link-detect'): - wwan['disable_link_detect'] = 2 - - # Do not use DNS servers provided by the peer - if conf.exists(['mtu']): - wwan['mtu'] = conf.return_value(['mtu']) - - # Do not use DNS servers provided by the peer - if conf.exists(['no-peer-dns']): - wwan['name_server'] = False - - # Access concentrator name (only connect to this concentrator) - if conf.exists(['ondemand']): - wwan['on_demand'] = True - - # retrieve VRF instance - if conf.exists('vrf'): - wwan['vrf'] = conf.return_value(['vrf']) + if wwan == {}: + wwan.update({'deleted' : ''}) + + # We have gathered the dict representation of the CLI, but there are + # default options which we need to update into the dictionary + # retrived. + wwan = dict_merge(default_values, wwan) + + # Add interface instance name into dictionary + wwan.update({'ifname': ifname}) return wwan def verify(wwan): - if wwan['deleted']: + if 'deleted' in wwan.keys(): return None - if not wwan['apn']: - raise ConfigError('No APN configured for "{intf}"'.format(**wwan)) + if not 'apn' in wwan.keys(): + raise ConfigError('No APN configured for "{ifname}"'.format(**wwan)) - if not wwan['device']: + if not 'device' in wwan.keys(): raise ConfigError('Physical "device" must be configured') # we can not use isfile() here as Linux device files are no regular files # thus the check will return False - if not os.path.exists('{device}'.format(**wwan)): + if not os.path.exists(find_device_file(wwan['device'])): raise ConfigError('Device "{device}" does not exist'.format(**wwan)) - if wwan['vrf'] and wwan['vrf'] not in interfaces(): - raise ConfigError('VRF "{vrf}" does not exist'.format(**wwan)) + verify_vrf(wwan) return None def generate(wwan): # set up configuration file path variables where our templates will be # rendered into - intf = wwan['intf'] - config_wwan = f'/etc/ppp/peers/{intf}' - config_wwan_chat = wwan['chat_script'] - script_wwan_pre_up = f'/etc/ppp/ip-pre-up.d/1010-vyos-wwan-{intf}' - script_wwan_ip_up = f'/etc/ppp/ip-up.d/1010-vyos-wwan-{intf}' - script_wwan_ip_down = f'/etc/ppp/ip-down.d/1010-vyos-wwan-{intf}' + ifname = wwan['ifname'] + config_wwan = f'/etc/ppp/peers/{ifname}' + config_wwan_chat = f'/etc/ppp/peers/chat.{ifname}' + script_wwan_pre_up = f'/etc/ppp/ip-pre-up.d/1010-vyos-wwan-{ifname}' + script_wwan_ip_up = f'/etc/ppp/ip-up.d/1010-vyos-wwan-{ifname}' + script_wwan_ip_down = f'/etc/ppp/ip-down.d/1010-vyos-wwan-{ifname}' config_files = [config_wwan, config_wwan_chat, script_wwan_pre_up, script_wwan_ip_up, script_wwan_ip_down] # Always hang-up WWAN connection prior generating new configuration file - call(f'systemctl stop ppp@{intf}.service') + call(f'systemctl stop ppp@{ifname}.service') - if wwan['deleted']: + if 'deleted' in wwan: # Delete PPP configuration files for file in config_files: if os.path.exists(file): os.unlink(file) else: + wwan['device'] = find_device_file(wwan['device']) + # Create PPP configuration files render(config_wwan, 'wwan/peer.tmpl', wwan) # Create PPP chat script @@ -195,20 +141,13 @@ def generate(wwan): return None def apply(wwan): - if wwan['deleted']: + if 'deleted' in wwan.keys(): # bail out early return None - if not wwan['disable']: + if not 'disable' in wwan.keys(): # "dial" WWAN connection - intf = wwan['intf'] - call(f'systemctl start ppp@{intf}.service') - - # re-add ourselves to any bridge we might have fallen out of - # FIXME: wwan isn't under vyos.ifconfig so we can't call - # Interfaces.add_to_bridge() so STP settings won't get applied - if wwan['is_bridge_member'] in Section.interfaces('bridge'): - BridgeIf(wwan['is_bridge_member'], create=False).add_port(wwan['intf']) + call('systemctl start ppp@{ifname}.service'.format(**wwan)) return None diff --git a/src/conf_mode/ntp.py b/src/conf_mode/ntp.py index 9180998aa..bba8f87a4 100755 --- a/src/conf_mode/ntp.py +++ b/src/conf_mode/ntp.py @@ -16,77 +16,22 @@ import os -from copy import deepcopy -from ipaddress import ip_network -from netifaces import interfaces -from sys import exit - from vyos.config import Config +from vyos.configverify import verify_vrf +from vyos import ConfigError from vyos.util import call from vyos.template import render -from vyos import ConfigError - from vyos import airbag airbag.enable() config_file = r'/etc/ntp.conf' systemd_override = r'/etc/systemd/system/ntp.service.d/override.conf' -default_config_data = { - 'servers': [], - 'allowed_networks': [], - 'listen_address': [], - 'vrf': '' -} - def get_config(): - ntp = deepcopy(default_config_data) conf = Config() base = ['system', 'ntp'] - if not conf.exists(base): - return None - else: - conf.set_level(base) - - node = ['allow-clients', 'address'] - if conf.exists(node): - networks = conf.return_values(node) - for n in networks: - addr = ip_network(n) - net = { - "network" : n, - "address" : addr.network_address, - "netmask" : addr.netmask - } - - ntp['allowed_networks'].append(net) - - node = ['listen-address'] - if conf.exists(node): - ntp['listen_address'] = conf.return_values(node) - - node = ['server'] - if conf.exists(node): - for node in conf.list_nodes(node): - options = [] - server = { - "name": node, - "options": [] - } - if conf.exists('server {0} noselect'.format(node)): - options.append('noselect') - if conf.exists('server {0} preempt'.format(node)): - options.append('preempt') - if conf.exists('server {0} prefer'.format(node)): - options.append('prefer') - - server['options'] = options - ntp['servers'].append(server) - - node = ['vrf'] - if conf.exists(node): - ntp['vrf'] = conf.return_value(node) + ntp = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) return ntp def verify(ntp): @@ -94,13 +39,10 @@ def verify(ntp): if not ntp: return None - # Configuring allowed clients without a server makes no sense - if len(ntp['allowed_networks']) and not len(ntp['servers']): + if len(ntp.get('allow_clients', {})) and not (len(ntp.get('server', {})) > 0): raise ConfigError('NTP server not configured') - if ntp['vrf'] and ntp['vrf'] not in interfaces(): - raise ConfigError('VRF "{vrf}" does not exist'.format(**ntp)) - + verify_vrf(ntp) return None def generate(ntp): @@ -108,7 +50,7 @@ def generate(ntp): if not ntp: return None - render(config_file, 'ntp/ntp.conf.tmpl', ntp) + render(config_file, 'ntp/ntp.conf.tmpl', ntp, trim_blocks=True) render(systemd_override, 'ntp/override.conf.tmpl', ntp, trim_blocks=True) return None @@ -124,7 +66,6 @@ def apply(ntp): # Reload systemd manager configuration call('systemctl daemon-reload') - if ntp: call('systemctl restart ntp.service') diff --git a/src/conf_mode/ssh.py b/src/conf_mode/ssh.py index 1ca2c8b4c..ffb0b700d 100755 --- a/src/conf_mode/ssh.py +++ b/src/conf_mode/ssh.py @@ -37,7 +37,7 @@ def get_config(): if not conf.exists(base): return None - ssh = conf.get_config_dict(base, key_mangling=('-', '_')) + ssh = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) # We have gathered the dict representation of the CLI, but there are default # options which we need to update into the dictionary retrived. default_values = defaults(base) diff --git a/src/conf_mode/system_console.py b/src/conf_mode/system_console.py index 034cbee63..6f83335f3 100755 --- a/src/conf_mode/system_console.py +++ b/src/conf_mode/system_console.py @@ -31,7 +31,7 @@ def get_config(): base = ['system', 'console'] # retrieve configuration at once - console = conf.get_config_dict(base) + console = conf.get_config_dict(base, get_first_key=True) # bail out early if no serial console is configured if 'device' not in console.keys(): diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py index e8f523e36..d3327b3c7 100755 --- a/src/conf_mode/vrf.py +++ b/src/conf_mode/vrf.py @@ -52,7 +52,7 @@ def vrf_interfaces(c, match): matched = [] old_level = c.get_level() c.set_level(['interfaces']) - section = c.get_config_dict([]) + section = c.get_config_dict([], get_first_key=True) for type in section: interfaces = section[type] for name in interfaces: |