diff options
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/https.py | 27 | ||||
| -rwxr-xr-x | src/conf_mode/interfaces-openvpn.py | 21 | ||||
| -rwxr-xr-x | src/conf_mode/service-router-advert.py | 207 | ||||
| -rwxr-xr-x | src/migration-scripts/https/0-to-1 | 72 | ||||
| -rwxr-xr-x | src/migration-scripts/interfaces/5-to-6 | 111 |
5 files changed, 420 insertions, 18 deletions
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py index fcbc3d384..a0fe9cf2f 100755 --- a/src/conf_mode/https.py +++ b/src/conf_mode/https.py @@ -18,6 +18,7 @@ import sys import os +from copy import deepcopy import jinja2 @@ -111,22 +112,22 @@ def get_config(): else: conf.set_level('service https') - if conf.exists('listen-address'): - for addr in conf.list_nodes('listen-address'): - server_block = {'address' : addr} - server_block['port'] = '443' - server_block['name'] = ['_'] - if conf.exists('listen-address {0} listen-port'.format(addr)): - port = conf.return_value('listen-address {0} listen-port'.format(addr)) + if not conf.exists('virtual-host'): + server_block_list.append(default_server_block) + else: + for vhost in conf.list_nodes('virtual-host'): + server_block = deepcopy(default_server_block) + if conf.exists(f'virtual-host {vhost} listen-address'): + addr = conf.return_value(f'virtual-host {vhost} listen-address') + server_block['address'] = addr + if conf.exists(f'virtual-host {vhost} listen-port'): + port = conf.return_value(f'virtual-host {vhost} listen-port') server_block['port'] = port - if conf.exists('listen-address {0} server-name'.format(addr)): - names = conf.return_values('listen-address {0} server-name'.format(addr)) + if conf.exists(f'virtual-host {vhost} server-name'): + names = conf.return_values(f'virtual-host {vhost} server-name') server_block['name'] = names[:] server_block_list.append(server_block) - if not server_block_list: - server_block_list.append(default_server_block) - vyos_cert_data = {} if conf.exists('certificates system-generated-certificate'): vyos_cert_data = vyos.defaults.vyos_cert_data @@ -170,7 +171,7 @@ def verify(https): for sb in https['server_block_list']: if sb['certbot']: return None - raise ConfigError("At least one 'listen-address x.x.x.x server-name' " + raise ConfigError("At least one 'virtual-host <id> server-name' " "matching the 'certbot domain-name' is required.") return None diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py index d72e4111c..9313e339b 100755 --- a/src/conf_mode/interfaces-openvpn.py +++ b/src/conf_mode/interfaces-openvpn.py @@ -28,6 +28,7 @@ from psutil import pid_exists from pwd import getpwnam from subprocess import Popen, PIPE from time import sleep +from shutil import rmtree from vyos import ConfigError from vyos.config import Config @@ -899,6 +900,10 @@ def generate(openvpn): interface = openvpn['intf'] directory = os.path.dirname(get_config_name(interface)) + # we can't know which clients were deleted, remove all client configs + if os.path.isdir(os.path.join(directory, 'ccd', interface)): + rmtree(os.path.join(directory, 'ccd', interface), ignore_errors=True) + # create config directory on demand openvpn_mkdir(directory) # create status directory on demand @@ -920,6 +925,11 @@ def generate(openvpn): fixup_permission(auth_file) + else: + # delete old auth file if present + if os.path.isfile('/tmp/openvpn-{}-pw'.format(interface)): + os.remove('/tmp/openvpn-{}-pw'.format(interface)) + # get numeric uid/gid uid = getpwnam(user).pw_uid gid = getgrnam(group).gr_gid @@ -977,11 +987,12 @@ def apply(openvpn): # cleanup client config dir directory = os.path.dirname(get_config_name(openvpn['intf'])) - if os.path.isdir(directory + '/ccd/' + openvpn['intf']): - try: - os.remove(directory + '/ccd/' + openvpn['intf'] + '/*') - except: - pass + if os.path.isdir(os.path.join(directory, 'ccd', openvpn['intf'])): + rmtree(os.path.join(directory, 'ccd', openvpn['intf']), ignore_errors=True) + + # cleanup auth file + if os.path.isfile('/tmp/openvpn-{}-pw'.format(openvpn['intf'])): + os.remove('/tmp/openvpn-{}-pw'.format(openvpn['intf'])) return None diff --git a/src/conf_mode/service-router-advert.py b/src/conf_mode/service-router-advert.py new file mode 100755 index 000000000..5ae719c29 --- /dev/null +++ b/src/conf_mode/service-router-advert.py @@ -0,0 +1,207 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018-2019 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +import os +import sys +import jinja2 + +from stat import S_IRUSR, S_IWUSR, S_IRGRP +from vyos.config import Config +from vyos import ConfigError + +config_file = r'/etc/radvd.conf' + +config_tmpl = """ +### Autogenerated by service-router-advert.py ### + +{% for i in interfaces -%} +interface {{ i.name }} { + IgnoreIfMissing on; + AdvDefaultPreference {{ i.default_preference }}; + AdvManagedFlag {{ i.managed_flag }}; + MaxRtrAdvInterval {{ i.interval_max }}; +{% if i.interval_min %} + MinRtrAdvInterval {{ i.interval_min }}; +{% endif %} + AdvReachableTime {{ i.reachable_time }}; + AdvIntervalOpt {{ i.send_advert }}; + AdvSendAdvert {{ i.send_advert }}; +{% if i.default_lifetime %} + AdvDefaultLifetime {{ i.default_lifetime }}; +{% endif %} + AdvLinkMTU {{ i.link_mtu }}; + AdvOtherConfigFlag {{ i.other_config_flag }}; + AdvRetransTimer {{ i.retrans_timer }}; + AdvCurHopLimit {{ i.hop_limit }}; +{% for p in i.prefixes %} + prefix {{ p.prefix }} { + AdvAutonomous {{ p.autonomous_flag }}; + AdvValidLifetime {{ p.valid_lifetime }}; + AdvOnLink {{ p.on_link }}; + AdvPreferredLifetime {{ p.preferred_lifetime }}; + }; +{% endfor %} +{% if i.name_server %} + RDNSS {{ i.name_server | join(" ") }} { + }; +{% endif %} +}; +{% endfor -%} +""" + +default_config_data = { + 'interfaces': [] +} + +def get_config(): + rtradv = default_config_data + conf = Config() + base_level = ['service', 'router-advert'] + + if not conf.exists(base_level): + return rtradv + + for interface in conf.list_nodes(base_level + ['interface']): + intf = { + 'name': interface, + 'hop_limit' : '64', + 'default_lifetime': '', + 'default_preference': 'medium', + 'dnssl': [], + 'link_mtu': '0', + 'managed_flag': 'off', + 'interval_max': '600', + 'interval_min': '', + 'name_server': [], + 'other_config_flag': 'off', + 'prefixes' : [], + 'reachable_time': '0', + 'retrans_timer': '0', + 'send_advert': 'on' + } + + # set config level first to reduce boilerplate code + conf.set_level(base_level + ['interface', interface]) + + if conf.exists(['hop-limit']): + intf['hop_limit'] = conf.return_value(['hop-limit']) + + if conf.exists(['default-lifetim']): + intf['default_lifetime'] = conf.return_value(['default-lifetim']) + + if conf.exists(['default-preference']): + intf['default_preference'] = conf.return_value(['default-preference']) + + if conf.exists(['dnssl']): + intf['dnssl'] = conf.return_values(['dnssl']) + + if conf.exists(['link-mtu']): + intf['link_mtu'] = conf.return_value(['link-mtu']) + + if conf.exists(['managed-flag']): + intf['managed_flag'] = 'on' + + if conf.exists(['interval', 'max']): + intf['interval_max'] = conf.return_value(['interval', 'max']) + + if conf.exists(['interval', 'min']): + intf['interval_min'] = conf.return_value(['interval', 'min']) + + if conf.exists(['name-server']): + intf['name_server'] = conf.return_values(['name-server']) + + if conf.exists(['other-config-flag']): + intf['other_config_flag'] = 'on' + + if conf.exists(['reachable-time']): + intf['reachable_time'] = conf.return_value(['reachable-time']) + + if conf.exists(['retrans-timer']): + intf['retrans_timer'] = conf.return_value(['retrans-timer']) + + if conf.exists(['no-send-advert']): + intf['send_advert'] = 'off' + + for prefix in conf.list_nodes(['prefix']): + tmp = { + 'prefix' : prefix, + 'autonomous_flag' : 'on', + 'on_link' : 'on', + 'preferred_lifetime': '14400', + 'valid_lifetime' : '2592000' + + } + + # set config level first to reduce boilerplate code + conf.set_level(base_level + ['interface', interface, 'prefix', prefix]) + + if conf.exists(['no-autonomous-flag']): + tmp['autonomous_flag'] = 'off' + + if conf.exists(['no-on-link-flag']): + tmp['on_link'] = 'off' + + if conf.exists(['preferred-lifetime']): + tmp['preferred_lifetime'] = conf.return_value(['preferred-lifetime']) + + if conf.exists(['valid-lifetime']): + tmp['valid_lifetime'] = conf.return_value(['valid-lifetime']) + + intf['prefixes'].append(tmp) + + rtradv['interfaces'].append(intf) + + return rtradv + +def verify(rtradv): + return None + +def generate(rtradv): + if not rtradv['interfaces']: + return None + + tmpl = jinja2.Template(config_tmpl, trim_blocks=True) + config_text = tmpl.render(rtradv) + with open(config_file, 'w') as f: + f.write(config_text) + + # adjust file permissions of new configuration file + if os.path.exists(config_file): + os.chmod(config_file, S_IRUSR | S_IWUSR | S_IRGRP) + + return None + +def apply(rtradv): + if not rtradv['interfaces']: + # bail out early - looks like removal from running config + os.system('sudo systemctl stop radvd.service') + if os.path.exists(config_file): + os.unlink(config_file) + + return None + + os.system('sudo systemctl restart radvd.service') + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) diff --git a/src/migration-scripts/https/0-to-1 b/src/migration-scripts/https/0-to-1 new file mode 100755 index 000000000..c6ed12fae --- /dev/null +++ b/src/migration-scripts/https/0-to-1 @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +# * remove "system login user <user> group" node, Why should be add a user to a +# 3rd party group when the system is fully managed by CLI? +# * remove "system login user <user> level" node +# This is the only privilege level left and also the default, what is the +# sense in keeping this orphaned node? + +import sys + +from vyos.configtree import ConfigTree + +if (len(sys.argv) < 2): + print("Must specify file name!") + sys.exit(1) + +file_name = sys.argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +config = ConfigTree(config_file) + +old_base = ['service', 'https', 'listen-address'] +if not config.exists(old_base): + # Nothing to do + sys.exit(0) +else: + new_base = ['service', 'https', 'virtual-host'] + config.set(new_base) + config.set_tag(new_base) + + index = 0 + for addr in config.list_nodes(old_base): + tag_name = f'vhost{index}' + config.set(new_base + [tag_name]) + config.set(new_base + [tag_name, 'listen-address'], value=addr) + + if config.exists(old_base + [addr, 'listen-port']): + port = config.return_value(old_base + [addr, 'listen-port']) + config.set(new_base + [tag_name, 'listen-port'], value=port) + + if config.exists(old_base + [addr, 'server-name']): + names = config.return_values(old_base + [addr, 'server-name']) + for name in names: + config.set(new_base + [tag_name, 'server-name'], value=name, + replace=False) + + index += 1 + + config.delete(old_base) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + sys.exit(1) diff --git a/src/migration-scripts/interfaces/5-to-6 b/src/migration-scripts/interfaces/5-to-6 new file mode 100755 index 000000000..9dbfd30e1 --- /dev/null +++ b/src/migration-scripts/interfaces/5-to-6 @@ -0,0 +1,111 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +# Migrate IPv6 router advertisments from a nested interface configuration to +# a denested "service router-advert" + +import sys +from vyos.configtree import ConfigTree + +def copy_rtradv(c, old_base, interface): + base = ['service', 'router-advert', 'interface'] + + if c.exists(old_base): + if not c.exists(base): + c.set(base) + c.set_tag(base) + + # take the old node as a whole and copy it to new new path, + # additional migrations will be done afterwards + new_base = base + [interface] + c.copy(old_base, new_base) + c.delete(old_base) + + # cur-hop-limit has been renamed to hop-limit + if c.exists(new_base + ['cur-hop-limit']): + c.rename(new_base + ['cur-hop-limit'], 'hop-limit') + + bool_cleanup = ['managed-flag', 'other-config-flag'] + for bool in bool_cleanup: + if c.exists(new_base + [bool]): + tmp = c.return_value(new_base + [bool]) + c.delete(new_base + [bool]) + if tmp == 'true': + c.set(new_base + [bool]) + + # max/min interval moved to subnode + intervals = ['max-interval', 'min-interval'] + for interval in intervals: + if c.exists(new_base + [interval]): + tmp = c.return_value(new_base + [interval]) + c.delete(new_base + [interval]) + min_max = interval.split('-')[0] + c.set(new_base + ['interval', min_max], value=tmp) + + # cleanup boolean nodes in individual prefix + prefix_base = new_base + ['prefix'] + if c.exists(prefix_base): + for prefix in config.list_nodes(prefix_base): + bool_cleanup = ['autonomous-flag', 'on-link-flag'] + for bool in bool_cleanup: + if c.exists(prefix_base + [prefix, bool]): + tmp = c.return_value(prefix_base + [prefix, bool]) + c.delete(prefix_base + [prefix, bool]) + if tmp == 'true': + c.set(prefix_base + [prefix, bool]) + + # router advertisement can be individually disabled per interface + # the node has been renamed from send-advert {true | false} to no-send-advert + if c.exists(new_base + ['send-advert']): + tmp = c.return_value(new_base + ['send-advert']) + c.delete(new_base + ['send-advert']) + if tmp == 'false': + c.set(new_base + ['no-send-advert']) + +if __name__ == '__main__': + if (len(sys.argv) < 1): + print("Must specify file name!") + exit(1) + + file_name = sys.argv[1] + with open(file_name, 'r') as f: + config_file = f.read() + + config = ConfigTree(config_file) + + # list all individual interface types like dummy, ethernet and so on + for if_type in config.list_nodes(['interfaces']): + base_if_type = ['interfaces', if_type] + + # for every individual interface we need to check if there is an + # ipv6 ra configured ... and also for every VIF (VLAN) interface + for intf in config.list_nodes(base_if_type): + old_base = base_if_type + [intf, 'ipv6', 'router-advert'] + copy_rtradv(config, old_base, intf) + + vif_base = base_if_type + [intf, 'vif'] + if config.exists(vif_base): + for vif in config.list_nodes(vif_base): + old_base = vif_base + [vif, 'ipv6', 'router-advert'] + vlan_name = f'{intf}.{vif}' + copy_rtradv(config, old_base, vlan_name) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + sys.exit(1) |