summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/accel_l2tp.py24
-rwxr-xr-xsrc/conf_mode/ipsec-settings.py41
-rwxr-xr-xsrc/conf_mode/system-ip.py81
-rwxr-xr-xsrc/conf_mode/system-ipv6.py109
-rwxr-xr-xsrc/conf_mode/system-options.py81
-rwxr-xr-xsrc/conf_mode/system-timezone.py (renamed from src/conf_mode/timezone.py)0
6 files changed, 305 insertions, 31 deletions
diff --git a/src/conf_mode/accel_l2tp.py b/src/conf_mode/accel_l2tp.py
index 37fda2029..a7af9cc68 100755
--- a/src/conf_mode/accel_l2tp.py
+++ b/src/conf_mode/accel_l2tp.py
@@ -118,15 +118,15 @@ secret={{lns_shared_secret}}
{% endfor -%}
{% endif %}
{% endif %}
-{% if outside_nexthop %}
-gw-ip-address={{outside_nexthop}}
+{% if gateway_address %}
+gw-ip-address={{gateway_address}}
{% endif %}
{% if authentication['mode'] == 'local' %}
[chap-secrets]
chap-secrets=/etc/accel-ppp/l2tp/chap-secrets
-{% if outside_nexthop %}
-gw-ip-address={{outside_nexthop}}
+{% if gateway_address %}
+gw-ip-address={{gateway_address}}
{% endif %}
{% endif %}
@@ -181,7 +181,7 @@ dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\
{{authentication['radiusopt']['dae-srv']['port']}},\
{{authentication['radiusopt']['dae-srv']['secret']}}
{% endif -%}
-gw-ip-address={{outside_nexthop}}
+gw-ip-address={{gateway_address}}
verbose=1
{% endif -%}
@@ -290,7 +290,7 @@ def get_config():
'mppe' : 'prefer'
},
'outside_addr' : '',
- 'outside_nexthop' : '10.255.255.0',
+ 'gateway_address' : '10.255.255.0',
'dns' : [],
'dnsv6' : [],
'wins' : [],
@@ -430,17 +430,17 @@ def get_config():
config_data['mtu'] = c.return_value('mtu')
### gateway address
- if c.exists('outside-nexthop'):
- config_data['outside_nexthop'] = c.return_value('outside-nexthop')
+ if c.exists('gateway-address'):
+ config_data['gateway_address'] = c.return_value('gateway-address')
else:
### calculate gw-ip-address
if c.exists('client-ip-pool start'):
### use start ip as gw-ip-address
- config_data['outside_nexthop'] = c.return_value('client-ip-pool start')
+ config_data['gateway_address'] = c.return_value('client-ip-pool start')
elif c.exists('client-ip-pool subnet'):
### use first ip address from first defined pool
lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", c.return_values('client-ip-pool subnet')[0])
- config_data['outside_nexthop'] = lst_ip[0]
+ config_data['gateway_address'] = lst_ip[0]
if c.exists('authentication require'):
auth_mods = {'pap' : 'pap','chap' : 'auth_chap_md5', 'mschap' : 'auth_mschap_v1', 'mschap-v2' : 'auth_mschap_v2'}
@@ -497,10 +497,6 @@ def verify(c):
if not c['client_ip_pool'] and not c['client_ip_subnets']:
raise ConfigError("set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool")
- if not c['outside_nexthop']:
- #raise ConfigError('set vpn l2tp remote-access outside-nexthop required')
- print ("WARMING: set vpn l2tp remote-access outside-nexthop required")
-
## check ipv6
if 'delegate_prefix' in c['client_ipv6_pool'] and not 'prefix' in c['client_ipv6_pool']:
raise ConfigError("\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ")
diff --git a/src/conf_mode/ipsec-settings.py b/src/conf_mode/ipsec-settings.py
index 331a62316..aab3e9734 100755
--- a/src/conf_mode/ipsec-settings.py
+++ b/src/conf_mode/ipsec-settings.py
@@ -32,14 +32,15 @@ from vyos import ConfigError
ra_conn_name = "remote-access"
charon_conf_file = "/etc/strongswan.d/charon.conf"
ipsec_secrets_flie = "/etc/ipsec.secrets"
-ipsec_ra_conn_file = "/etc/ipsec.d/tunnels/"+ra_conn_name
+ipsec_ra_conn_dir = "/etc/ipsec.d/tunnels/"
+ipsec_ra_conn_file = ipsec_ra_conn_dir + ra_conn_name
ipsec_conf_flie = "/etc/ipsec.conf"
-ca_cert_path = '/etc/ipsec.d/cacerts'
-server_cert_path = '/etc/ipsec.d/certs'
-server_key_path = '/etc/ipsec.d/private'
+ca_cert_path = "/etc/ipsec.d/cacerts"
+server_cert_path = "/etc/ipsec.d/certs"
+server_key_path = "/etc/ipsec.d/private"
delim_ipsec_l2tp_begin = "### VyOS L2TP VPN Begin ###"
delim_ipsec_l2tp_end = "### VyOS L2TP VPN End ###"
-charon_pidfile = '/var/run/charon.pid'
+charon_pidfile = "/var/run/charon.pid"
l2pt_ipsec_conf = '''
{{delim_ipsec_l2tp_begin}}
@@ -147,21 +148,27 @@ def get_config():
### ipsec secret l2tp
def write_ipsec_secrets(c):
- tmpl = jinja2.Template(l2pt_ipsec_secrets_conf, trim_blocks=True)
- l2pt_ipsec_secrets_txt = tmpl.render(c)
- old_umask = os.umask(0o077)
- open(ipsec_secrets_flie,'w').write(l2pt_ipsec_secrets_txt)
- os.umask(old_umask)
- sl.syslog(sl.LOG_NOTICE, ipsec_secrets_flie + ' written')
+ tmpl = jinja2.Template(l2pt_ipsec_secrets_conf, trim_blocks=True)
+ l2pt_ipsec_secrets_txt = tmpl.render(c)
+ old_umask = os.umask(0o077)
+ open(ipsec_secrets_flie,'w').write(l2pt_ipsec_secrets_txt)
+ os.umask(old_umask)
+ sl.syslog(sl.LOG_NOTICE, ipsec_secrets_flie + ' written')
### ipsec remote access connection config
def write_ipsec_ra_conn(c):
- tmpl = jinja2.Template(l2tp_ipsec_ra_conn_conf, trim_blocks=True)
- ipsec_ra_conn_txt = tmpl.render(c)
- old_umask = os.umask(0o077)
- open(ipsec_ra_conn_file,'w').write(ipsec_ra_conn_txt)
- os.umask(old_umask)
- sl.syslog(sl.LOG_NOTICE, ipsec_ra_conn_file + ' written')
+ tmpl = jinja2.Template(l2tp_ipsec_ra_conn_conf, trim_blocks=True)
+ ipsec_ra_conn_txt = tmpl.render(c)
+ old_umask = os.umask(0o077)
+
+ # Create tunnels directory if does not exist
+ if not os.path.exists(ipsec_ra_conn_dir):
+ os.makedirs(ipsec_ra_conn_dir)
+ sl.syslog(sl.LOG_NOTICE, ipsec_ra_conn_dir + " created")
+
+ open(ipsec_ra_conn_file,'w').write(ipsec_ra_conn_txt)
+ os.umask(old_umask)
+ sl.syslog(sl.LOG_NOTICE, ipsec_ra_conn_file + ' written')
### Remove config from file by delimiter
def remove_confs(delim_begin, delim_end, conf_file):
diff --git a/src/conf_mode/system-ip.py b/src/conf_mode/system-ip.py
new file mode 100755
index 000000000..335507411
--- /dev/null
+++ b/src/conf_mode/system-ip.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from copy import deepcopy
+from vyos.config import Config
+from vyos import ConfigError
+
+default_config_data = {
+ 'arp_table': 8192,
+ 'ipv4_forward': '1',
+ 'mp_unreach_nexthop': '0',
+ 'mp_layer4_hashing': '0'
+}
+
+def sysctl(name, value):
+ os.system('sysctl -wq {}={}'.format(name, value))
+
+def get_config():
+ ip_opt = deepcopy(default_config_data)
+ conf = Config()
+ conf.set_level('system ip')
+ if conf.exists(''):
+ if conf.exists('arp table-size'):
+ ip_opt['arp_table'] = int(conf.return_value('arp table-size'))
+
+ if conf.exists('disable-forwarding'):
+ ip_opt['ipv4_forward'] = '0'
+
+ if conf.exists('multipath ignore-unreachable-nexthops'):
+ ip_opt['mp_unreach_nexthop'] = '1'
+
+ if conf.exists('multipath layer4-hashing'):
+ ip_opt['mp_layer4_hashing'] = '1'
+
+ return ip_opt
+
+def verify(ip_opt):
+ pass
+
+def generate(ip_opt):
+ pass
+
+def apply(ip_opt):
+ # apply ARP threshold values
+ sysctl('net.ipv4.neigh.default.gc_thresh3', ip_opt['arp_table'])
+ sysctl('net.ipv4.neigh.default.gc_thresh2', ip_opt['arp_table'] // 2)
+ sysctl('net.ipv4.neigh.default.gc_thresh1', ip_opt['arp_table'] // 8)
+
+ # enable/disable IPv4 forwarding
+ with open('/proc/sys/net/ipv4/conf/all/forwarding', 'w') as f:
+ f.write(ip_opt['ipv4_forward'])
+
+ # configure multipath
+ sysctl('net.ipv4.fib_multipath_use_neigh', ip_opt['mp_unreach_nexthop'])
+ sysctl('net.ipv4.fib_multipath_hash_policy', ip_opt['mp_layer4_hashing'])
+
+if __name__ == '__main__':
+ try:
+ c = get_config()
+ verify(c)
+ generate(c)
+ apply(c)
+ except ConfigError as e:
+ print(e)
+ exit(1)
diff --git a/src/conf_mode/system-ipv6.py b/src/conf_mode/system-ipv6.py
new file mode 100755
index 000000000..bd28ec357
--- /dev/null
+++ b/src/conf_mode/system-ipv6.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import sys
+
+from sys import exit
+from copy import deepcopy
+from vyos.config import Config
+from vyos import ConfigError
+
+ipv6_disable_file = '/etc/modprobe.d/vyos_disable_ipv6.conf'
+
+default_config_data = {
+ 'reboot_message': False,
+ 'ipv6_forward': '1',
+ 'disable_addr_assignment': False,
+ 'mp_layer4_hashing': '0',
+ 'neighbor_cache': 8192,
+ 'strict_dad': '1'
+
+}
+
+def sysctl(name, value):
+ os.system('sysctl -wq {}={}'.format(name, value))
+
+def get_config():
+ ip_opt = deepcopy(default_config_data)
+ conf = Config()
+ conf.set_level('system ipv6')
+ if conf.exists(''):
+ ip_opt['disable_addr_assignment'] = conf.exists('disable')
+ if conf.exists_effective('disable') != conf.exists('disable'):
+ ip_opt['reboot_message'] = True
+
+ if conf.exists('disable-forwarding'):
+ ip_opt['ipv6_forward'] = '0'
+
+ if conf.exists('multipath layer4-hashing'):
+ ip_opt['mp_layer4_hashing'] = '1'
+
+ if conf.exists('neighbor table-size'):
+ ip_opt['neighbor_cache'] = int(conf.return_value('neighbor table-size'))
+
+ if conf.exists('strict-dad'):
+ ip_opt['strict_dad'] = 2
+
+ return ip_opt
+
+def verify(ip_opt):
+ pass
+
+def generate(ip_opt):
+ pass
+
+def apply(ip_opt):
+ # disable IPv6 address assignment
+ if ip_opt['disable_addr_assignment']:
+ with open(ipv6_disable_file, 'w') as f:
+ f.write('options ipv6 disable_ipv6=1')
+ else:
+ if os.path.exists(ipv6_disable_file):
+ os.unlink(ipv6_disable_file)
+
+ if ip_opt['reboot_message']:
+ print('Changing IPv6 disable parameter will only take affect\n' \
+ 'when the system is rebooted.')
+
+ # configure multipath
+ sysctl('net.ipv6.fib_multipath_hash_policy', ip_opt['mp_layer4_hashing'])
+
+ # apply neighbor table threshold values
+ sysctl('net.ipv6.neigh.default.gc_thresh3', ip_opt['neighbor_cache'])
+ sysctl('net.ipv6.neigh.default.gc_thresh2', ip_opt['neighbor_cache'] // 2)
+ sysctl('net.ipv6.neigh.default.gc_thresh1', ip_opt['neighbor_cache'] // 8)
+
+ # enable/disable IPv6 forwarding
+ with open('/proc/sys/net/ipv6/conf/all/forwarding', 'w') as f:
+ f.write(ip_opt['ipv6_forward'])
+
+ # configure IPv6 strict-dad
+ for root, dirs, files in os.walk('/proc/sys/net/ipv6/conf'):
+ for name in files:
+ if name == "accept_dad":
+ with open(os.path.join(root, name), 'w') as f:
+ f.write(str(ip_opt['strict_dad']))
+
+if __name__ == '__main__':
+ try:
+ c = get_config()
+ verify(c)
+ generate(c)
+ apply(c)
+ except ConfigError as e:
+ print(e)
+ exit(1)
diff --git a/src/conf_mode/system-options.py b/src/conf_mode/system-options.py
new file mode 100755
index 000000000..4c809d044
--- /dev/null
+++ b/src/conf_mode/system-options.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from copy import deepcopy
+from vyos.config import Config
+from vyos import ConfigError
+
+systemd_ctrl_alt_del = '/lib/systemd/system/ctrl-alt-del.target'
+
+default_config_data = {
+ 'ctrl_alt_del': 'ignore',
+ 'reboot_on_panic': True
+}
+
+def get_config():
+ opt = deepcopy(default_config_data)
+ conf = Config()
+ conf.set_level('system options')
+ if conf.exists(''):
+ if conf.exists('ctrl-alt-del-action'):
+ opt['ctrl_alt_del'] = conf.return_value('ctrl-alt-del-action')
+
+ opt['reboot_on_panic'] = conf.exists('reboot-on-panic')
+
+ return opt
+
+def verify(opt):
+ pass
+
+def generate(opt):
+ pass
+
+def apply(opt):
+
+ # Ctrl-Alt-Delete action
+ if opt['ctrl_alt_del'] == 'ignore':
+ os.unlink('/lib/systemd/system/ctrl-alt-del.target')
+
+ elif opt['ctrl_alt_del'] == 'reboot':
+ if os.path.exists(systemd_ctrl_alt_del):
+ os.unlink(systemd_ctrl_alt_del)
+ os.symlink('/lib/systemd/system/reboot.target', systemd_ctrl_alt_del)
+
+ elif opt['ctrl_alt_del'] == 'poweroff':
+ if os.path.exists(systemd_ctrl_alt_del):
+ os.unlink(systemd_ctrl_alt_del)
+ os.symlink('/lib/systemd/system/poweroff.target', systemd_ctrl_alt_del)
+
+ # Reboot system on kernel panic
+ with open('/proc/sys/kernel/panic', 'w') as f:
+ if opt['reboot_on_panic']:
+ f.write('60')
+ else:
+ f.write('0')
+
+if __name__ == '__main__':
+ try:
+ c = get_config()
+ verify(c)
+ generate(c)
+ apply(c)
+ except ConfigError as e:
+ print(e)
+ exit(1)
+
diff --git a/src/conf_mode/timezone.py b/src/conf_mode/system-timezone.py
index d715bd27e..d715bd27e 100755
--- a/src/conf_mode/timezone.py
+++ b/src/conf_mode/system-timezone.py
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-17 16:31:45 +0000