diff options
Diffstat (limited to 'src/migration-scripts/l2tp')
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/0-to-1 | 46 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/1-to-2 | 47 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/2-to-3 | 53 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/3-to-4 | 262 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/4-to-5 | 105 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/5-to-6 | 176 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/6-to-7 | 66 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/7-to-8 | 88 | ||||
| -rw-r--r--[-rwxr-xr-x] | src/migration-scripts/l2tp/8-to-9 | 50 |
9 files changed, 380 insertions, 513 deletions
diff --git a/src/migration-scripts/l2tp/0-to-1 b/src/migration-scripts/l2tp/0-to-1 index 15d229822..f0cb6af96 100755..100644 --- a/src/migration-scripts/l2tp/0-to-1 +++ b/src/migration-scripts/l2tp/0-to-1 @@ -1,29 +1,32 @@ -#!/usr/bin/env python3 - +# Copyright 2018-2024 VyOS maintainers and contributors <maintainers@vyos.io> +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. + +# T987: Unclutter L2TP/IPSec RADIUS configuration nodes # Unclutter L2TP VPN configuiration - move radius-server top level tag # nodes to a regular node which now also configures the radius source address # used when querying a radius server -import sys - from vyos.configtree import ConfigTree -if len(sys.argv) < 2: - print("Must specify file name!") - sys.exit(1) - -file_name = sys.argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() +cfg_base = ['vpn', 'l2tp', 'remote-access', 'authentication'] -config = ConfigTree(config_file) +def migrate(config: ConfigTree) -> None: + if not config.exists(cfg_base): + # Nothing to do + return -cfg_base = ['vpn', 'l2tp', 'remote-access', 'authentication'] -if not config.exists(cfg_base): - # Nothing to do - sys.exit(0) -else: # Migrate "vpn l2tp authentication radius-source-address" to new # "vpn l2tp authentication radius source-address" if config.exists(cfg_base + ['radius-source-address']): @@ -51,10 +54,3 @@ else: # delete top level tag node if config.exists(cfg_base + ['radius-server']): config.delete(cfg_base + ['radius-server']) - - try: - with open(file_name, 'w') as f: - f.write(config.to_string()) - except OSError as e: - print("Failed to save the modified config: {}".format(e)) - sys.exit(1) diff --git a/src/migration-scripts/l2tp/1-to-2 b/src/migration-scripts/l2tp/1-to-2 index 2ffb91c53..468d564ac 100755..100644 --- a/src/migration-scripts/l2tp/1-to-2 +++ b/src/migration-scripts/l2tp/1-to-2 @@ -1,33 +1,28 @@ -#!/usr/bin/env python3 - -# Delete depricated outside-nexthop address - -import sys +# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io> +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. + +# T1858: Delete deprecated outside-nexthop from vyos.configtree import ConfigTree -if len(sys.argv) < 2: - print("Must specify file name!") - sys.exit(1) - -file_name = sys.argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() +cfg_base = ['vpn', 'l2tp', 'remote-access'] -config = ConfigTree(config_file) +def migrate(config: ConfigTree) -> None: + if not config.exists(cfg_base): + # Nothing to do + return -cfg_base = ['vpn', 'l2tp', 'remote-access'] -if not config.exists(cfg_base): - # Nothing to do - sys.exit(0) -else: if config.exists(cfg_base + ['outside-nexthop']): config.delete(cfg_base + ['outside-nexthop']) - - try: - with open(file_name, 'w') as f: - f.write(config.to_string()) - except OSError as e: - print("Failed to save the modified config: {}".format(e)) - sys.exit(1) diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 index 8527c2d4a..00fabb6b6 100755..100644 --- a/src/migration-scripts/l2tp/2-to-3 +++ b/src/migration-scripts/l2tp/2-to-3 @@ -1,40 +1,32 @@ -#!/usr/bin/env python3 +# Copyright 2020-2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2020-2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. -# - remove primary/secondary identifier from nameserver -# - TODO: remove radius server req-limit +# T2264: combine IPv4/IPv6 name-server CLI syntax +# T2264: combine WINS CLI syntax +# T2264: remove RADIUS req-limit node +# T2264: migrate IPv6 prefix node to common CLI style -from sys import argv, exit from vyos.configtree import ConfigTree -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] +base = ['vpn', 'l2tp', 'remote-access'] -with open(file_name, 'r') as f: - config_file = f.read() +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + # Nothing to do + return -config = ConfigTree(config_file) -base = ['vpn', 'l2tp', 'remote-access'] -if not config.exists(base): - # Nothing to do - exit(0) -else: # Migrate IPv4 DNS servers dns_base = base + ['dns-servers'] if config.exists(dns_base): @@ -98,10 +90,3 @@ else: prefix = p.split(',')[0] mask = p.split(',')[1] config.set(ipv6_base + ['delegate', prefix, 'delegate-prefix'], value=mask) - - try: - with open(file_name, 'w') as f: - f.write(config.to_string()) - except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) diff --git a/src/migration-scripts/l2tp/3-to-4 b/src/migration-scripts/l2tp/3-to-4 index 14b86ff04..01c3fa844 100755..100644 --- a/src/migration-scripts/l2tp/3-to-4 +++ b/src/migration-scripts/l2tp/3-to-4 @@ -1,26 +1,22 @@ -#!/usr/bin/env python3 +# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2021-2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. -# - remove primary/secondary identifier from nameserver -# - TODO: remove radius server req-limit +# T2816: T3642: Move IPSec/L2TP code into vpn_ipsec.py and update to use PKI. import os -from sys import argv -from sys import exit from vyos.configtree import ConfigTree from vyos.pki import load_certificate from vyos.pki import load_private_key @@ -28,141 +24,125 @@ from vyos.pki import encode_certificate from vyos.pki import encode_private_key from vyos.utils.process import run -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) base = ['vpn', 'l2tp', 'remote-access', 'ipsec-settings'] pki_base = ['pki'] -if not config.exists(base): - exit(0) - AUTH_DIR = '/config/auth' def wrapped_pem_to_config_value(pem): return "".join(pem.strip().split("\n")[1:-1]) -if not config.exists(base + ['authentication', 'x509']): - exit(0) +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return + + if not config.exists(base + ['authentication', 'x509']): + return + + x509_base = base + ['authentication', 'x509'] + pki_name = 'l2tp_remote_access' + + if not config.exists(pki_base + ['ca']): + config.set(pki_base + ['ca']) + config.set_tag(pki_base + ['ca']) + + if not config.exists(pki_base + ['certificate']): + config.set(pki_base + ['certificate']) + config.set_tag(pki_base + ['certificate']) + + if config.exists(x509_base + ['ca-cert-file']): + cert_file = config.return_value(x509_base + ['ca-cert-file']) + cert_path = os.path.join(AUTH_DIR, cert_file) + cert = None + + if os.path.isfile(cert_path): + if not os.access(cert_path, os.R_OK): + run(f'sudo chmod 644 {cert_path}') + + with open(cert_path, 'r') as f: + cert_data = f.read() + cert = load_certificate(cert_data, wrap_tags=False) + + if cert: + cert_pem = encode_certificate(cert) + config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem)) + config.set(x509_base + ['ca-certificate'], value=pki_name) + else: + print(f'Failed to migrate CA certificate on l2tp remote-access config') + + config.delete(x509_base + ['ca-cert-file']) + + if config.exists(x509_base + ['crl-file']): + crl_file = config.return_value(x509_base + ['crl-file']) + crl_path = os.path.join(AUTH_DIR, crl_file) + crl = None + + if os.path.isfile(crl_path): + if not os.access(crl_path, os.R_OK): + run(f'sudo chmod 644 {crl_path}') + + with open(crl_path, 'r') as f: + crl_data = f.read() + crl = load_certificate(crl_data, wrap_tags=False) + + if crl: + crl_pem = encode_certificate(crl) + config.set(pki_base + ['ca', pki_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem)) + else: + print(f'Failed to migrate CRL on l2tp remote-access config') + + config.delete(x509_base + ['crl-file']) + + if config.exists(x509_base + ['server-cert-file']): + cert_file = config.return_value(x509_base + ['server-cert-file']) + cert_path = os.path.join(AUTH_DIR, cert_file) + cert = None + + if os.path.isfile(cert_path): + if not os.access(cert_path, os.R_OK): + run(f'sudo chmod 644 {cert_path}') + + with open(cert_path, 'r') as f: + cert_data = f.read() + cert = load_certificate(cert_data, wrap_tags=False) + + if cert: + cert_pem = encode_certificate(cert) + config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem)) + config.set(x509_base + ['certificate'], value=pki_name) + else: + print(f'Failed to migrate certificate on l2tp remote-access config') + + config.delete(x509_base + ['server-cert-file']) + + if config.exists(x509_base + ['server-key-file']): + key_file = config.return_value(x509_base + ['server-key-file']) + key_passphrase = None -x509_base = base + ['authentication', 'x509'] -pki_name = 'l2tp_remote_access' + if config.exists(x509_base + ['server-key-password']): + key_passphrase = config.return_value(x509_base + ['server-key-password']) -if not config.exists(pki_base + ['ca']): - config.set(pki_base + ['ca']) - config.set_tag(pki_base + ['ca']) + key_path = os.path.join(AUTH_DIR, key_file) + key = None -if not config.exists(pki_base + ['certificate']): - config.set(pki_base + ['certificate']) - config.set_tag(pki_base + ['certificate']) + if os.path.isfile(key_path): + if not os.access(key_path, os.R_OK): + run(f'sudo chmod 644 {key_path}') -if config.exists(x509_base + ['ca-cert-file']): - cert_file = config.return_value(x509_base + ['ca-cert-file']) - cert_path = os.path.join(AUTH_DIR, cert_file) - cert = None - - if os.path.isfile(cert_path): - if not os.access(cert_path, os.R_OK): - run(f'sudo chmod 644 {cert_path}') - - with open(cert_path, 'r') as f: - cert_data = f.read() - cert = load_certificate(cert_data, wrap_tags=False) - - if cert: - cert_pem = encode_certificate(cert) - config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem)) - config.set(x509_base + ['ca-certificate'], value=pki_name) - else: - print(f'Failed to migrate CA certificate on l2tp remote-access config') - - config.delete(x509_base + ['ca-cert-file']) - -if config.exists(x509_base + ['crl-file']): - crl_file = config.return_value(x509_base + ['crl-file']) - crl_path = os.path.join(AUTH_DIR, crl_file) - crl = None - - if os.path.isfile(crl_path): - if not os.access(crl_path, os.R_OK): - run(f'sudo chmod 644 {crl_path}') - - with open(crl_path, 'r') as f: - crl_data = f.read() - crl = load_certificate(crl_data, wrap_tags=False) - - if crl: - crl_pem = encode_certificate(crl) - config.set(pki_base + ['ca', pki_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem)) - else: - print(f'Failed to migrate CRL on l2tp remote-access config') - - config.delete(x509_base + ['crl-file']) - -if config.exists(x509_base + ['server-cert-file']): - cert_file = config.return_value(x509_base + ['server-cert-file']) - cert_path = os.path.join(AUTH_DIR, cert_file) - cert = None - - if os.path.isfile(cert_path): - if not os.access(cert_path, os.R_OK): - run(f'sudo chmod 644 {cert_path}') - - with open(cert_path, 'r') as f: - cert_data = f.read() - cert = load_certificate(cert_data, wrap_tags=False) - - if cert: - cert_pem = encode_certificate(cert) - config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem)) - config.set(x509_base + ['certificate'], value=pki_name) - else: - print(f'Failed to migrate certificate on l2tp remote-access config') - - config.delete(x509_base + ['server-cert-file']) - -if config.exists(x509_base + ['server-key-file']): - key_file = config.return_value(x509_base + ['server-key-file']) - key_passphrase = None - - if config.exists(x509_base + ['server-key-password']): - key_passphrase = config.return_value(x509_base + ['server-key-password']) - - key_path = os.path.join(AUTH_DIR, key_file) - key = None - - if os.path.isfile(key_path): - if not os.access(key_path, os.R_OK): - run(f'sudo chmod 644 {key_path}') - - with open(key_path, 'r') as f: - key_data = f.read() - key = load_private_key(key_data, passphrase=key_passphrase, wrap_tags=False) - - if key: - key_pem = encode_private_key(key, passphrase=key_passphrase) - config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem)) - - if key_passphrase: - config.set(pki_base + ['certificate', pki_name, 'private', 'password-protected']) - config.set(x509_base + ['private-key-passphrase'], value=key_passphrase) - else: - print(f'Failed to migrate private key on l2tp remote-access config') - - config.delete(x509_base + ['server-key-file']) - if config.exists(x509_base + ['server-key-password']): - config.delete(x509_base + ['server-key-password']) - -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) + with open(key_path, 'r') as f: + key_data = f.read() + key = load_private_key(key_data, passphrase=key_passphrase, wrap_tags=False) + + if key: + key_pem = encode_private_key(key, passphrase=key_passphrase) + config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem)) + + if key_passphrase: + config.set(pki_base + ['certificate', pki_name, 'private', 'password-protected']) + config.set(x509_base + ['private-key-passphrase'], value=key_passphrase) + else: + print(f'Failed to migrate private key on l2tp remote-access config') + + config.delete(x509_base + ['server-key-file']) + if config.exists(x509_base + ['server-key-password']): + config.delete(x509_base + ['server-key-password']) diff --git a/src/migration-scripts/l2tp/4-to-5 b/src/migration-scripts/l2tp/4-to-5 index b7f4d2677..56d451b8d 100755..100644 --- a/src/migration-scripts/l2tp/4-to-5 +++ b/src/migration-scripts/l2tp/4-to-5 @@ -1,85 +1,68 @@ -#!/usr/bin/env python3 +# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2023-2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. # - move all pool to named pools # 'start-stop' migrate to namedpool 'default-range-pool' # 'subnet' migrate to namedpool 'default-subnet-pool' # 'default-subnet-pool' is the next pool for 'default-range-pool' -from sys import argv -from sys import exit from vyos.configtree import ConfigTree from vyos.base import Warning -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) base = ['vpn', 'l2tp', 'remote-access'] pool_base = base + ['client-ip-pool'] -if not config.exists(base): - exit(0) -if not config.exists(pool_base): - exit(0) -default_pool = '' -range_pool_name = 'default-range-pool' +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return -if config.exists(pool_base + ['start']) and config.exists(pool_base + ['stop']): - def is_legalrange(ip1: str, ip2: str, mask: str): - from ipaddress import IPv4Interface - interface1 = IPv4Interface(f'{ip1}/{mask}') + if not config.exists(pool_base): + return - interface2 = IPv4Interface(f'{ip2}/{mask}') - return interface1.network.network_address == interface2.network.network_address and interface2.ip > interface1.ip + default_pool = '' + range_pool_name = 'default-range-pool' - start_ip = config.return_value(pool_base + ['start']) - stop_ip = config.return_value(pool_base + ['stop']) - if is_legalrange(start_ip, stop_ip,'24'): - ip_range = f'{start_ip}-{stop_ip}' - config.set(pool_base + [range_pool_name, 'range'], value=ip_range, replace=False) - default_pool = range_pool_name - else: - Warning( - f'L2TP client-ip-pool range start-ip:{start_ip} and stop-ip:{stop_ip} can not be migrated.') + if config.exists(pool_base + ['start']) and config.exists(pool_base + ['stop']): + def is_legalrange(ip1: str, ip2: str, mask: str): + from ipaddress import IPv4Interface + interface1 = IPv4Interface(f'{ip1}/{mask}') + + interface2 = IPv4Interface(f'{ip2}/{mask}') + return interface1.network.network_address == interface2.network.network_address and interface2.ip > interface1.ip - config.delete(pool_base + ['start']) - config.delete(pool_base + ['stop']) + start_ip = config.return_value(pool_base + ['start']) + stop_ip = config.return_value(pool_base + ['stop']) + if is_legalrange(start_ip, stop_ip,'24'): + ip_range = f'{start_ip}-{stop_ip}' + config.set(pool_base + [range_pool_name, 'range'], value=ip_range, replace=False) + default_pool = range_pool_name + else: + Warning( + f'L2TP client-ip-pool range start-ip:{start_ip} and stop-ip:{stop_ip} can not be migrated.') -if config.exists(pool_base + ['subnet']): - for subnet in config.return_values(pool_base + ['subnet']): - config.set(pool_base + [range_pool_name, 'range'], value=subnet, replace=False) + config.delete(pool_base + ['start']) + config.delete(pool_base + ['stop']) - config.delete(pool_base + ['subnet']) - default_pool = range_pool_name + if config.exists(pool_base + ['subnet']): + for subnet in config.return_values(pool_base + ['subnet']): + config.set(pool_base + [range_pool_name, 'range'], value=subnet, replace=False) -if default_pool: - config.set(base + ['default-pool'], value=default_pool) -# format as tag node -config.set_tag(pool_base) + config.delete(pool_base + ['subnet']) + default_pool = range_pool_name -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) + if default_pool: + config.set(base + ['default-pool'], value=default_pool) + # format as tag node + config.set_tag(pool_base) diff --git a/src/migration-scripts/l2tp/5-to-6 b/src/migration-scripts/l2tp/5-to-6 index ac40b89c8..cc9f948a6 100755..100644 --- a/src/migration-scripts/l2tp/5-to-6 +++ b/src/migration-scripts/l2tp/5-to-6 @@ -1,106 +1,88 @@ -#!/usr/bin/env python3 +# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. -from sys import argv -from sys import exit from vyos.configtree import ConfigTree -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) base = ['vpn', 'l2tp', 'remote-access'] -if not config.exists(base): - exit(0) - -#migrate idle to ppp option lcp-echo-timeout -idle_path = base + ['idle'] -if config.exists(idle_path): - config.set(base + ['ppp-options', 'lcp-echo-timeout'], - value=config.return_value(idle_path)) - config.delete(idle_path) - -#migrate mppe from authentication to ppp-otion -mppe_path = base + ['authentication', 'mppe'] -if config.exists(mppe_path): - config.set(base + ['ppp-options', 'mppe'], - value=config.return_value(mppe_path)) - config.delete(mppe_path) - -#migrate require to protocol -require_path = base + ['authentication', 'require'] -if config.exists(require_path): - protocols = list(config.return_values(require_path)) - for protocol in protocols: - config.set(base + ['authentication', 'protocols'], value=protocol, - replace=False) - config.delete(require_path) -else: - config.set(base + ['authentication', 'protocols'], value='mschap-v2') - -#migrate default gateway if not exist -if not config.exists(base + ['gateway-address']): - config.set(base + ['gateway-address'], value='10.255.255.0') - -#migrate authentication radius timeout -rad_timeout_path = base + ['authentication', 'radius', 'timeout'] -if config.exists(rad_timeout_path): - if int(config.return_value(rad_timeout_path)) > 60: - config.set(rad_timeout_path, value=60) - -#migrate authentication radius acct timeout -rad_acct_timeout_path = base + ['authentication', 'radius', 'acct-timeout'] -if config.exists(rad_acct_timeout_path): - if int(config.return_value(rad_acct_timeout_path)) > 60: - config.set(rad_acct_timeout_path,value=60) - -#migrate authentication radius max-try -rad_max_try_path = base + ['authentication', 'radius', 'max-try'] -if config.exists(rad_max_try_path): - if int(config.return_value(rad_max_try_path)) > 20: - config.set(rad_max_try_path, value=20) - -#migrate dae-server to dynamic-author -dae_path_old = base + ['authentication', 'radius', 'dae-server'] -dae_path_new = base + ['authentication', 'radius', 'dynamic-author'] - -if config.exists(dae_path_old + ['ip-address']): - config.set(dae_path_new + ['server'], - value=config.return_value(dae_path_old + ['ip-address'])) - -if config.exists(dae_path_old + ['port']): - config.set(dae_path_new + ['port'], - value=config.return_value(dae_path_old + ['port'])) - -if config.exists(dae_path_old + ['secret']): - config.set(dae_path_new + ['key'], - value=config.return_value(dae_path_old + ['secret'])) - -if config.exists(dae_path_old): - config.delete(dae_path_old) -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return + + #migrate idle to ppp option lcp-echo-timeout + idle_path = base + ['idle'] + if config.exists(idle_path): + config.set(base + ['ppp-options', 'lcp-echo-timeout'], + value=config.return_value(idle_path)) + config.delete(idle_path) + + #migrate mppe from authentication to ppp-otion + mppe_path = base + ['authentication', 'mppe'] + if config.exists(mppe_path): + config.set(base + ['ppp-options', 'mppe'], + value=config.return_value(mppe_path)) + config.delete(mppe_path) + + #migrate require to protocol + require_path = base + ['authentication', 'require'] + if config.exists(require_path): + protocols = list(config.return_values(require_path)) + for protocol in protocols: + config.set(base + ['authentication', 'protocols'], value=protocol, + replace=False) + config.delete(require_path) + else: + config.set(base + ['authentication', 'protocols'], value='mschap-v2') + + #migrate default gateway if not exist + if not config.exists(base + ['gateway-address']): + config.set(base + ['gateway-address'], value='10.255.255.0') + + #migrate authentication radius timeout + rad_timeout_path = base + ['authentication', 'radius', 'timeout'] + if config.exists(rad_timeout_path): + if int(config.return_value(rad_timeout_path)) > 60: + config.set(rad_timeout_path, value=60) + + #migrate authentication radius acct timeout + rad_acct_timeout_path = base + ['authentication', 'radius', 'acct-timeout'] + if config.exists(rad_acct_timeout_path): + if int(config.return_value(rad_acct_timeout_path)) > 60: + config.set(rad_acct_timeout_path,value=60) + + #migrate authentication radius max-try + rad_max_try_path = base + ['authentication', 'radius', 'max-try'] + if config.exists(rad_max_try_path): + if int(config.return_value(rad_max_try_path)) > 20: + config.set(rad_max_try_path, value=20) + + #migrate dae-server to dynamic-author + dae_path_old = base + ['authentication', 'radius', 'dae-server'] + dae_path_new = base + ['authentication', 'radius', 'dynamic-author'] + + if config.exists(dae_path_old + ['ip-address']): + config.set(dae_path_new + ['server'], + value=config.return_value(dae_path_old + ['ip-address'])) + + if config.exists(dae_path_old + ['port']): + config.set(dae_path_new + ['port'], + value=config.return_value(dae_path_old + ['port'])) + + if config.exists(dae_path_old + ['secret']): + config.set(dae_path_new + ['key'], + value=config.return_value(dae_path_old + ['secret'])) + + if config.exists(dae_path_old): + config.delete(dae_path_old) diff --git a/src/migration-scripts/l2tp/6-to-7 b/src/migration-scripts/l2tp/6-to-7 index 1c536585c..4dba5974e 100755..100644 --- a/src/migration-scripts/l2tp/6-to-7 +++ b/src/migration-scripts/l2tp/6-to-7 @@ -1,57 +1,39 @@ -#!/usr/bin/env python3 +# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. # Migrating to named ipv6 pools -from sys import argv -from sys import exit from vyos.configtree import ConfigTree -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) base = ['vpn', 'l2tp', 'remote-access'] pool_base = base + ['client-ipv6-pool'] -if not config.exists(base): - exit(0) -if not config.exists(pool_base): - exit(0) +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return -ipv6_pool_name = 'ipv6-pool' -config.copy(pool_base, pool_base + [ipv6_pool_name]) + if not config.exists(pool_base): + return -if config.exists(pool_base + ['prefix']): - config.delete(pool_base + ['prefix']) - config.set(base + ['default-ipv6-pool'], value=ipv6_pool_name) -if config.exists(pool_base + ['delegate']): - config.delete(pool_base + ['delegate']) -# format as tag node -config.set_tag(pool_base) + ipv6_pool_name = 'ipv6-pool' + config.copy(pool_base, pool_base + [ipv6_pool_name]) -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) + if config.exists(pool_base + ['prefix']): + config.delete(pool_base + ['prefix']) + config.set(base + ['default-ipv6-pool'], value=ipv6_pool_name) + if config.exists(pool_base + ['delegate']): + config.delete(pool_base + ['delegate']) + # format as tag node + config.set_tag(pool_base) diff --git a/src/migration-scripts/l2tp/7-to-8 b/src/migration-scripts/l2tp/7-to-8 index e429ed057..527906fc8 100755..100644 --- a/src/migration-scripts/l2tp/7-to-8 +++ b/src/migration-scripts/l2tp/7-to-8 @@ -1,65 +1,47 @@ -#!/usr/bin/env python3 +# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. # Migrate from 'ccp-disable' to 'ppp-options.disable-ccp' # Migration ipv6 options -from sys import argv -from sys import exit from vyos.configtree import ConfigTree -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) base = ['vpn', 'l2tp', 'remote-access'] -if not config.exists(base): - exit(0) - -#CCP migration -if config.exists(base + ['ccp-disable']): - config.delete(base + ['ccp-disable']) - config.set(base + ['ppp-options', 'disable-ccp']) - -#IPV6 options migrations -if config.exists(base + ['ppp-options','ipv6-peer-intf-id']): - intf_peer_id = config.return_value(base + ['ppp-options','ipv6-peer-intf-id']) - if intf_peer_id == 'ipv4': - intf_peer_id = 'ipv4-addr' - config.set(base + ['ppp-options','ipv6-peer-interface-id'], value=intf_peer_id, replace=True) - config.delete(base + ['ppp-options','ipv6-peer-intf-id']) - -if config.exists(base + ['ppp-options','ipv6-intf-id']): - intf_id = config.return_value(base + ['ppp-options','ipv6-intf-id']) - config.set(base + ['ppp-options','ipv6-interface-id'], value=intf_id, replace=True) - config.delete(base + ['ppp-options','ipv6-intf-id']) - -if config.exists(base + ['ppp-options','ipv6-accept-peer-intf-id']): - config.set(base + ['ppp-options','ipv6-accept-peer-interface-id']) - config.delete(base + ['ppp-options','ipv6-accept-peer-intf-id']) -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return + + #CCP migration + if config.exists(base + ['ccp-disable']): + config.delete(base + ['ccp-disable']) + config.set(base + ['ppp-options', 'disable-ccp']) + + #IPV6 options migrations + if config.exists(base + ['ppp-options','ipv6-peer-intf-id']): + intf_peer_id = config.return_value(base + ['ppp-options','ipv6-peer-intf-id']) + if intf_peer_id == 'ipv4': + intf_peer_id = 'ipv4-addr' + config.set(base + ['ppp-options','ipv6-peer-interface-id'], value=intf_peer_id, replace=True) + config.delete(base + ['ppp-options','ipv6-peer-intf-id']) + + if config.exists(base + ['ppp-options','ipv6-intf-id']): + intf_id = config.return_value(base + ['ppp-options','ipv6-intf-id']) + config.set(base + ['ppp-options','ipv6-interface-id'], value=intf_id, replace=True) + config.delete(base + ['ppp-options','ipv6-intf-id']) + + if config.exists(base + ['ppp-options','ipv6-accept-peer-intf-id']): + config.set(base + ['ppp-options','ipv6-accept-peer-interface-id']) + config.delete(base + ['ppp-options','ipv6-accept-peer-intf-id']) diff --git a/src/migration-scripts/l2tp/8-to-9 b/src/migration-scripts/l2tp/8-to-9 index 672180e25..e6b689e80 100755..100644 --- a/src/migration-scripts/l2tp/8-to-9 +++ b/src/migration-scripts/l2tp/8-to-9 @@ -1,46 +1,28 @@ -#!/usr/bin/env python3 +# Copyright 2024 VyOS maintainers and contributors <maintainers@vyos.io> # -# Copyright (C) 2024 VyOS maintainers and contributors +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. # -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, +# This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. # -# You should have received a copy of the GNU General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. # Deleted 'dhcp-interface' from l2tp -from sys import argv -from sys import exit from vyos.configtree import ConfigTree -if len(argv) < 2: - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) base = ['vpn', 'l2tp', 'remote-access'] -if not config.exists(base): - exit(0) -# deleting unused dhcp-interface -if config.exists(base + ['dhcp-interface']): - config.delete(base + ['dhcp-interface']) +def migrate(config: ConfigTree) -> None: + if not config.exists(base): + return -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) + # deleting unused dhcp-interface + if config.exists(base + ['dhcp-interface']): + config.delete(base + ['dhcp-interface']) |