summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/flow_accounting_conf.py9
-rwxr-xr-xsrc/conf_mode/https.py27
-rwxr-xr-xsrc/conf_mode/interfaces-bridge.py6
-rwxr-xr-xsrc/conf_mode/interfaces-openvpn.py27
-rwxr-xr-xsrc/conf_mode/service-router-advert.py207
5 files changed, 248 insertions, 28 deletions
diff --git a/src/conf_mode/flow_accounting_conf.py b/src/conf_mode/flow_accounting_conf.py
index 0bc50482c..2e941de0a 100755
--- a/src/conf_mode/flow_accounting_conf.py
+++ b/src/conf_mode/flow_accounting_conf.py
@@ -22,7 +22,6 @@ import subprocess
from vyos.config import Config
from vyos import ConfigError
-import vyos.interfaces
from vyos.ifconfig import Interface
from jinja2 import Template
@@ -129,7 +128,7 @@ def _sflow_default_agentip(config):
return config.return_value('protocols ospfv3 parameters router-id')
# if router-id was not found, use first available ip of any interface
- for iface in vyos.interfaces.list_interfaces():
+ for iface in Interface.listing():
for address in Interface(iface).get_addr():
# return an IP, if this is not loopback
regex_filter = re.compile('^(?!(127)|(::1)|(fe80))(?P<ipaddr>[a-f\d\.:]+)/\d+$')
@@ -300,7 +299,7 @@ def verify(config):
# check that all configured interfaces exists in the system
for iface in config['interfaces']:
- if not iface in vyos.interfaces.list_interfaces():
+ if not iface in Interface.listing():
# chnged from error to warning to allow adding dynamic interfaces and interface templates
# raise ConfigError("The {} interface is not presented in the system".format(iface))
print("Warning: the {} interface is not presented in the system".format(iface))
@@ -328,7 +327,7 @@ def verify(config):
# check if configured sFlow agent-id exist in the system
agent_id_presented = None
- for iface in vyos.interfaces.list_interfaces():
+ for iface in Interface.listing():
for address in Interface(iface).get_addr():
# check an IP, if this is not loopback
regex_filter = re.compile('^(?!(127)|(::1)|(fe80))(?P<ipaddr>[a-f\d\.:]+)/\d+$')
@@ -348,7 +347,7 @@ def verify(config):
# check if configured netflow source-ip exist in the system
if config['netflow']['source-ip']:
source_ip_presented = None
- for iface in vyos.interfaces.list_interfaces():
+ for iface in Interface.listing():
for address in Interface(iface).get_addr():
# check an IP
regex_filter = re.compile('^(?!(127)|(::1)|(fe80))(?P<ipaddr>[a-f\d\.:]+)/\d+$')
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py
index fcbc3d384..a0fe9cf2f 100755
--- a/src/conf_mode/https.py
+++ b/src/conf_mode/https.py
@@ -18,6 +18,7 @@
import sys
import os
+from copy import deepcopy
import jinja2
@@ -111,22 +112,22 @@ def get_config():
else:
conf.set_level('service https')
- if conf.exists('listen-address'):
- for addr in conf.list_nodes('listen-address'):
- server_block = {'address' : addr}
- server_block['port'] = '443'
- server_block['name'] = ['_']
- if conf.exists('listen-address {0} listen-port'.format(addr)):
- port = conf.return_value('listen-address {0} listen-port'.format(addr))
+ if not conf.exists('virtual-host'):
+ server_block_list.append(default_server_block)
+ else:
+ for vhost in conf.list_nodes('virtual-host'):
+ server_block = deepcopy(default_server_block)
+ if conf.exists(f'virtual-host {vhost} listen-address'):
+ addr = conf.return_value(f'virtual-host {vhost} listen-address')
+ server_block['address'] = addr
+ if conf.exists(f'virtual-host {vhost} listen-port'):
+ port = conf.return_value(f'virtual-host {vhost} listen-port')
server_block['port'] = port
- if conf.exists('listen-address {0} server-name'.format(addr)):
- names = conf.return_values('listen-address {0} server-name'.format(addr))
+ if conf.exists(f'virtual-host {vhost} server-name'):
+ names = conf.return_values(f'virtual-host {vhost} server-name')
server_block['name'] = names[:]
server_block_list.append(server_block)
- if not server_block_list:
- server_block_list.append(default_server_block)
-
vyos_cert_data = {}
if conf.exists('certificates system-generated-certificate'):
vyos_cert_data = vyos.defaults.vyos_cert_data
@@ -170,7 +171,7 @@ def verify(https):
for sb in https['server_block_list']:
if sb['certbot']:
return None
- raise ConfigError("At least one 'listen-address x.x.x.x server-name' "
+ raise ConfigError("At least one 'virtual-host <id> server-name' "
"matching the 'certbot domain-name' is required.")
return None
diff --git a/src/conf_mode/interfaces-bridge.py b/src/conf_mode/interfaces-bridge.py
index f8f20bf5c..c45ab13a8 100755
--- a/src/conf_mode/interfaces-bridge.py
+++ b/src/conf_mode/interfaces-bridge.py
@@ -20,7 +20,8 @@ from copy import deepcopy
from sys import exit
from netifaces import interfaces
-from vyos.ifconfig import BridgeIf, STPIf
+from vyos.ifconfig import BridgeIf
+from vyos.ifconfig.stp import STP
from vyos.configdict import list_diff
from vyos.config import Config
from vyos import ConfigError
@@ -322,9 +323,10 @@ def apply(bridge):
for addr in bridge['address']:
br.add_addr(addr)
+ STPBridgeIf = STP.enable(BridgeIf)
# configure additional bridge member options
for member in bridge['member']:
- i = STPIf(member['name'])
+ i = STPBridgeIf(member['name'])
# configure ARP cache timeout
i.set_arp_cache_tmo(bridge['arp_cache_tmo'])
# ignore link state changes
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 3a3c69e37..9313e339b 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -28,10 +28,11 @@ from psutil import pid_exists
from pwd import getpwnam
from subprocess import Popen, PIPE
from time import sleep
+from shutil import rmtree
from vyos import ConfigError
from vyos.config import Config
-from vyos.ifconfig import Interface
+from vyos.ifconfig import VTunIf
from vyos.validate import is_addr_assigned
user = 'openvpn'
@@ -899,6 +900,10 @@ def generate(openvpn):
interface = openvpn['intf']
directory = os.path.dirname(get_config_name(interface))
+ # we can't know which clients were deleted, remove all client configs
+ if os.path.isdir(os.path.join(directory, 'ccd', interface)):
+ rmtree(os.path.join(directory, 'ccd', interface), ignore_errors=True)
+
# create config directory on demand
openvpn_mkdir(directory)
# create status directory on demand
@@ -920,6 +925,11 @@ def generate(openvpn):
fixup_permission(auth_file)
+ else:
+ # delete old auth file if present
+ if os.path.isfile('/tmp/openvpn-{}-pw'.format(interface)):
+ os.remove('/tmp/openvpn-{}-pw'.format(interface))
+
# get numeric uid/gid
uid = getpwnam(user).pw_uid
gid = getgrnam(group).gr_gid
@@ -977,11 +987,12 @@ def apply(openvpn):
# cleanup client config dir
directory = os.path.dirname(get_config_name(openvpn['intf']))
- if os.path.isdir(directory + '/ccd/' + openvpn['intf']):
- try:
- os.remove(directory + '/ccd/' + openvpn['intf'] + '/*')
- except:
- pass
+ if os.path.isdir(os.path.join(directory, 'ccd', openvpn['intf'])):
+ rmtree(os.path.join(directory, 'ccd', openvpn['intf']), ignore_errors=True)
+
+ # cleanup auth file
+ if os.path.isfile('/tmp/openvpn-{}-pw'.format(openvpn['intf'])):
+ os.remove('/tmp/openvpn-{}-pw'.format(openvpn['intf']))
return None
@@ -1025,14 +1036,14 @@ def apply(openvpn):
try:
# we need to catch the exception if the interface is not up due to
# reason stated above
- Interface(openvpn['intf']).set_alias(openvpn['description'])
+ VTunIf(openvpn['intf']).set_alias(openvpn['description'])
except:
pass
# TAP interface needs to be brought up explicitly
if openvpn['type'] == 'tap':
if not openvpn['disable']:
- Interface(openvpn['intf']).set_state('up')
+ VTunIf(openvpn['intf']).set_state('up')
return None
diff --git a/src/conf_mode/service-router-advert.py b/src/conf_mode/service-router-advert.py
new file mode 100755
index 000000000..5ae719c29
--- /dev/null
+++ b/src/conf_mode/service-router-advert.py
@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2019 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import sys
+import jinja2
+
+from stat import S_IRUSR, S_IWUSR, S_IRGRP
+from vyos.config import Config
+from vyos import ConfigError
+
+config_file = r'/etc/radvd.conf'
+
+config_tmpl = """
+### Autogenerated by service-router-advert.py ###
+
+{% for i in interfaces -%}
+interface {{ i.name }} {
+ IgnoreIfMissing on;
+ AdvDefaultPreference {{ i.default_preference }};
+ AdvManagedFlag {{ i.managed_flag }};
+ MaxRtrAdvInterval {{ i.interval_max }};
+{% if i.interval_min %}
+ MinRtrAdvInterval {{ i.interval_min }};
+{% endif %}
+ AdvReachableTime {{ i.reachable_time }};
+ AdvIntervalOpt {{ i.send_advert }};
+ AdvSendAdvert {{ i.send_advert }};
+{% if i.default_lifetime %}
+ AdvDefaultLifetime {{ i.default_lifetime }};
+{% endif %}
+ AdvLinkMTU {{ i.link_mtu }};
+ AdvOtherConfigFlag {{ i.other_config_flag }};
+ AdvRetransTimer {{ i.retrans_timer }};
+ AdvCurHopLimit {{ i.hop_limit }};
+{% for p in i.prefixes %}
+ prefix {{ p.prefix }} {
+ AdvAutonomous {{ p.autonomous_flag }};
+ AdvValidLifetime {{ p.valid_lifetime }};
+ AdvOnLink {{ p.on_link }};
+ AdvPreferredLifetime {{ p.preferred_lifetime }};
+ };
+{% endfor %}
+{% if i.name_server %}
+ RDNSS {{ i.name_server | join(" ") }} {
+ };
+{% endif %}
+};
+{% endfor -%}
+"""
+
+default_config_data = {
+ 'interfaces': []
+}
+
+def get_config():
+ rtradv = default_config_data
+ conf = Config()
+ base_level = ['service', 'router-advert']
+
+ if not conf.exists(base_level):
+ return rtradv
+
+ for interface in conf.list_nodes(base_level + ['interface']):
+ intf = {
+ 'name': interface,
+ 'hop_limit' : '64',
+ 'default_lifetime': '',
+ 'default_preference': 'medium',
+ 'dnssl': [],
+ 'link_mtu': '0',
+ 'managed_flag': 'off',
+ 'interval_max': '600',
+ 'interval_min': '',
+ 'name_server': [],
+ 'other_config_flag': 'off',
+ 'prefixes' : [],
+ 'reachable_time': '0',
+ 'retrans_timer': '0',
+ 'send_advert': 'on'
+ }
+
+ # set config level first to reduce boilerplate code
+ conf.set_level(base_level + ['interface', interface])
+
+ if conf.exists(['hop-limit']):
+ intf['hop_limit'] = conf.return_value(['hop-limit'])
+
+ if conf.exists(['default-lifetim']):
+ intf['default_lifetime'] = conf.return_value(['default-lifetim'])
+
+ if conf.exists(['default-preference']):
+ intf['default_preference'] = conf.return_value(['default-preference'])
+
+ if conf.exists(['dnssl']):
+ intf['dnssl'] = conf.return_values(['dnssl'])
+
+ if conf.exists(['link-mtu']):
+ intf['link_mtu'] = conf.return_value(['link-mtu'])
+
+ if conf.exists(['managed-flag']):
+ intf['managed_flag'] = 'on'
+
+ if conf.exists(['interval', 'max']):
+ intf['interval_max'] = conf.return_value(['interval', 'max'])
+
+ if conf.exists(['interval', 'min']):
+ intf['interval_min'] = conf.return_value(['interval', 'min'])
+
+ if conf.exists(['name-server']):
+ intf['name_server'] = conf.return_values(['name-server'])
+
+ if conf.exists(['other-config-flag']):
+ intf['other_config_flag'] = 'on'
+
+ if conf.exists(['reachable-time']):
+ intf['reachable_time'] = conf.return_value(['reachable-time'])
+
+ if conf.exists(['retrans-timer']):
+ intf['retrans_timer'] = conf.return_value(['retrans-timer'])
+
+ if conf.exists(['no-send-advert']):
+ intf['send_advert'] = 'off'
+
+ for prefix in conf.list_nodes(['prefix']):
+ tmp = {
+ 'prefix' : prefix,
+ 'autonomous_flag' : 'on',
+ 'on_link' : 'on',
+ 'preferred_lifetime': '14400',
+ 'valid_lifetime' : '2592000'
+
+ }
+
+ # set config level first to reduce boilerplate code
+ conf.set_level(base_level + ['interface', interface, 'prefix', prefix])
+
+ if conf.exists(['no-autonomous-flag']):
+ tmp['autonomous_flag'] = 'off'
+
+ if conf.exists(['no-on-link-flag']):
+ tmp['on_link'] = 'off'
+
+ if conf.exists(['preferred-lifetime']):
+ tmp['preferred_lifetime'] = conf.return_value(['preferred-lifetime'])
+
+ if conf.exists(['valid-lifetime']):
+ tmp['valid_lifetime'] = conf.return_value(['valid-lifetime'])
+
+ intf['prefixes'].append(tmp)
+
+ rtradv['interfaces'].append(intf)
+
+ return rtradv
+
+def verify(rtradv):
+ return None
+
+def generate(rtradv):
+ if not rtradv['interfaces']:
+ return None
+
+ tmpl = jinja2.Template(config_tmpl, trim_blocks=True)
+ config_text = tmpl.render(rtradv)
+ with open(config_file, 'w') as f:
+ f.write(config_text)
+
+ # adjust file permissions of new configuration file
+ if os.path.exists(config_file):
+ os.chmod(config_file, S_IRUSR | S_IWUSR | S_IRGRP)
+
+ return None
+
+def apply(rtradv):
+ if not rtradv['interfaces']:
+ # bail out early - looks like removal from running config
+ os.system('sudo systemctl stop radvd.service')
+ if os.path.exists(config_file):
+ os.unlink(config_file)
+
+ return None
+
+ os.system('sudo systemctl restart radvd.service')
+ return None
+
+if __name__ == '__main__':
+ try:
+ c = get_config()
+ verify(c)
+ generate(c)
+ apply(c)
+ except ConfigError as e:
+ print(e)
+ sys.exit(1)
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-17 07:47:11 +0000