From 537b2e753bea8f45e33b01e5b1bc094462fb2c04 Mon Sep 17 00:00:00 2001 From: hagbard Date: Sun, 26 Jan 2020 10:39:04 -0800 Subject: IPoE: T1767: vyos.config rewrite --- src/conf_mode/ipoe_server.py | 496 +++++++++++++++++++++++-------------------- 1 file changed, 270 insertions(+), 226 deletions(-) diff --git a/src/conf_mode/ipoe_server.py b/src/conf_mode/ipoe_server.py index 1662e45e6..bd7a898d0 100755 --- a/src/conf_mode/ipoe_server.py +++ b/src/conf_mode/ipoe_server.py @@ -163,7 +163,7 @@ nas-identifier={{auth['radsettings']['nas-identifier']}} tcp=127.0.0.1:2002 ''' -### chap secrets +# chap secrets chap_secrets_conf = ''' # username server password acceptable local IP addresses shaper {% for aifc in auth['auth_if'] %} @@ -185,251 +185,295 @@ chap_secrets_conf = ''' {% endfor %} ''' -##### Inline functions start #### -### config path creation if not os.path.exists(ipoe_cnf_dir): - os.makedirs(ipoe_cnf_dir) - sl.syslog(sl.LOG_NOTICE, ipoe_cnf_dir + " created") + os.makedirs(ipoe_cnf_dir) + sl.syslog(sl.LOG_NOTICE, ipoe_cnf_dir + " created") -def get_cpu(): - cpu_cnt = 1 - if os.cpu_count() == 1: + +def _get_cpu(): cpu_cnt = 1 - else: - cpu_cnt = int(os.cpu_count()/2) - return cpu_cnt - -def chk_con(): - cnt = 0 - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - while True: + if os.cpu_count() == 1: + cpu_cnt = 1 + else: + cpu_cnt = int(os.cpu_count()/2) + return cpu_cnt + + +def _chk_con(): + cnt = 0 + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + while True: + try: + s.connect(("127.0.0.1", int(cmd_port))) + break + except ConnectionRefusedError: + time.sleep(0.5) + cnt += 1 + if cnt == 100: + raise("failed to start pppoe server") + break + + +def _accel_cmd(cmd=''): + if not cmd: + return None try: - s.connect(("127.0.0.1", int(cmd_port))) - break - except ConnectionRefusedError: - time.sleep(0.5) - cnt +=1 - if cnt == 100: - raise("failed to start pppoe server") - break - -def accel_cmd(cmd=''): - if not cmd: - return None - try: - ret = subprocess.check_output(['/usr/bin/accel-cmd', '-p', cmd_port, cmd]).decode().strip() - return ret - except: - return 1 - -### chap_secrets file if auth mode local -def gen_chap_secrets(c): - - tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) - chap_secrets_txt = tmpl.render(c) - old_umask = os.umask(0o077) - open(chap_secrets,'w').write(chap_secrets_txt) - os.umask(old_umask) - sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') + ret = subprocess.check_output( + ['/usr/bin/accel-cmd', '-p', cmd_port, cmd]).decode().strip() + return ret + except: + return 1 + +# chap_secrets file if auth mode local + + +def _gen_chap_secrets(c): + + tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) + chap_secrets_txt = tmpl.render(c) + old_umask = os.umask(0o077) + open(chap_secrets, 'w').write(chap_secrets_txt) + os.umask(old_umask) + sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') ##### Inline functions end #### + def get_config(): - c = Config() - if not c.exists('service ipoe-server'): - return None - - config_data = {} - - c.set_level('service ipoe-server') - config_data['interfaces'] = {} - for intfc in c.list_nodes('interface'): - config_data['interfaces'][intfc] = { - 'mode' : 'L2', - 'shared' : '1', - 'sess_start' : 'dhcpv4', ### may need a conifg option, can be dhcpv4 or up for unclassified pkts - 'range' : None, - 'ifcfg' : '1', - 'vlan_mon' : [] - } - config_data['dns'] = { - 'server1' : None, - 'server2' : None - } - config_data['dnsv6'] = { - 'server1' : None, - 'server2' : None, - 'server3' : None - } - config_data['ipv6'] = { - 'prfx' : [], - 'pd' : [], - } - config_data['auth'] = { - 'auth_if' : {}, - 'mech' : 'noauth', - 'radius' : {}, - 'radsettings' : { - 'dae-server' : {} - } - } - - if c.exists('interface ' + intfc + ' network-mode'): - config_data['interfaces'][intfc]['mode'] = c.return_value('interface ' + intfc + ' network-mode') - if c.return_value('interface ' + intfc + ' network') == 'vlan': - config_data['interfaces'][intfc]['shared'] = '0' - if c.exists('interface ' + intfc + ' vlan-id'): - config_data['interfaces'][intfc]['vlan_mon'] += c.return_values('interface ' + intfc + ' vlan-id') - if c.exists('interface ' + intfc + ' vlan-range'): - config_data['interfaces'][intfc]['vlan_mon'] += c.return_values('interface ' + intfc + ' vlan-range') - if c.exists('interface ' + intfc + ' client-subnet'): - config_data['interfaces'][intfc]['range'] = c.return_value('interface ' + intfc + ' client-subnet') - if c.exists('dns-server server-1'): - config_data['dns']['server1'] = c.return_value('dns-server server-1') - if c.exists('dns-server server-2'): - config_data['dns']['server2'] = c.return_value('dns-server server-2') - if c.exists('dnsv6-server server-1'): - config_data['dnsv6']['server1'] = c.return_value('dnsv6-server server-1') - if c.exists('dnsv6-server server-2'): - config_data['dnsv6']['server2'] = c.return_value('dnsv6-server server-2') - if c.exists('dnsv6-server server-3'): - config_data['dnsv6']['server3'] = c.return_value('dnsv6-server server-3') - if not c.exists('authentication mode noauth'): - config_data['auth']['mech'] = c.return_value('authentication mode') - if c.exists('authentication mode local'): - for auth_int in c.list_nodes('authentication interface'): - for mac in c.list_nodes('authentication interface ' + auth_int + ' mac-address'): - config_data['auth']['auth_if'][auth_int] = {} - if c.exists('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit'): - config_data['auth']['auth_if'][auth_int][mac] = {} - config_data['auth']['auth_if'][auth_int][mac]['up'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit upload') - config_data['auth']['auth_if'][auth_int][mac]['down'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' rate-limit download') - else: - config_data['auth']['auth_if'][auth_int][mac] = {} - config_data['auth']['auth_if'][auth_int][mac]['up'] = None - config_data['auth']['auth_if'][auth_int][mac]['down'] = None - ## client vlan-id - if c.exists('authentication interface ' + auth_int + ' mac-address ' + mac + ' vlan-id'): - config_data['auth']['auth_if'][auth_int][mac]['vlan'] = c.return_value('authentication interface ' + auth_int + ' mac-address ' + mac + ' vlan-id') - if c.exists('authentication mode radius'): - for rsrv in c.list_nodes('authentication radius-server'): - config_data['auth']['radius'][rsrv] = {} - if c.exists('authentication radius-server ' + rsrv + ' secret'): - config_data['auth']['radius'][rsrv]['secret'] = c.return_value('authentication radius-server ' + rsrv + ' secret') - else: - config_data['auth']['radius'][rsrv]['secret'] = None - if c.exists('authentication radius-server ' + rsrv + ' fail-time'): - config_data['auth']['radius'][rsrv]['fail-time'] = c.return_value('authentication radius-server ' + rsrv + ' fail-time') - else: - config_data['auth']['radius'][rsrv]['fail-time'] = '0' - if c.exists('authentication radius-server ' + rsrv + ' req-limit'): - config_data['auth']['radius'][rsrv]['req-limit'] = c.return_value('authentication radius-server ' + rsrv + ' req-limit') - else: - config_data['auth']['radius'][rsrv]['req-limit'] = '0' - if c.exists('authentication radius-settings'): - if c.exists('authentication radius-settings timeout'): - config_data['auth']['radsettings']['timeout'] = c.return_value('authentication radius-settings timeout') - if c.exists('authentication radius-settings nas-ip-address'): - config_data['auth']['radsettings']['nas-ip-address'] = c.return_value('authentication radius-settings nas-ip-address') - if c.exists('authentication radius-settings nas-identifier'): - config_data['auth']['radsettings']['nas-identifier'] = c.return_value('authentication radius-settings nas-identifier') - if c.exists('authentication radius-settings max-try'): - config_data['auth']['radsettings']['max-try'] = c.return_value('authentication radius-settings max-try') - if c.exists('authentication radius-settings acct-timeout'): - config_data['auth']['radsettings']['acct-timeout'] = c.return_value('authentication radius-settings acct-timeout') - if c.exists('authentication radius-settings dae-server ip-address'): - config_data['auth']['radsettings']['dae-server']['ip-address'] = c.return_value('authentication radius-settings dae-server ip-address') - if c.exists('authentication radius-settings dae-server port'): - config_data['auth']['radsettings']['dae-server']['port'] = c.return_value('authentication radius-settings dae-server port') - if c.exists('authentication radius-settings dae-server secret'): - config_data['auth']['radsettings']['dae-server']['secret'] = c.return_value('authentication radius-settings dae-server secret') - - if c.exists('client-ipv6-pool prefix'): - config_data['ipv6']['prfx'] = c.return_values('client-ipv6-pool prefix') - if c.exists('client-ipv6-pool delegate-prefix'): - config_data['ipv6']['pd'] = c.return_values('client-ipv6-pool delegate-prefix') - - return config_data + c = Config() + if not c.exists(['service', 'ipoe-server']): + return None + + config_data = {} + + c.set_level(['service', 'ipoe-server']) + config_data['interfaces'] = {} + for intfc in c.list_nodes(['interface']): + config_data['interfaces'][intfc] = { + 'mode': 'L2', + 'shared': '1', + # may need a conifg option, can be dhcpv4 or up for unclassified pkts + 'sess_start': 'dhcpv4', + 'range': None, + 'ifcfg': '1', + 'vlan_mon': [] + } + config_data['dns'] = { + 'server1': None, + 'server2': None + } + config_data['dnsv6'] = { + 'server1': None, + 'server2': None, + 'server3': None + } + config_data['ipv6'] = { + 'prfx': [], + 'pd': [], + } + config_data['auth'] = { + 'auth_if': {}, + 'mech': 'noauth', + 'radius': {}, + 'radsettings': { + 'dae-server': {} + } + } + + if c.exists(['interface', intfc, 'network-mode']): + config_data['interfaces'][intfc]['mode'] = c.return_value( + ['interface', intfc, 'network-mode']) + if c.return_value(['interface', intfc, 'network']) == 'vlan': + config_data['interfaces'][intfc]['shared'] = '0' + if c.exists(['interface', intfc, 'vlan-id']): + config_data['interfaces'][intfc]['vlan_mon'] += c.return_values( + ['interface', intfc, 'vlan-id']) + if c.exists(['interface', intfc, 'vlan-range']): + config_data['interfaces'][intfc]['vlan_mon'] += c.return_values( + ['interface', intfc, 'vlan-range']) + if c.exists(['interface', intfc, 'client-subnet']): + config_data['interfaces'][intfc]['range'] = c.return_value( + ['interface', intfc, 'client-subnet']) + if c.exists(['dns-server', 'server-1']): + config_data['dns']['server1'] = c.return_value( + ['dns-server', 'server-1']) + if c.exists(['dns-server', 'server-2']): + config_data['dns']['server2'] = c.return_value( + ['dns-server', 'server-2']) + if c.exists(['dnsv6-server', 'server-1']): + config_data['dnsv6']['server1'] = c.return_value( + ['dnsv6-server', 'server-1']) + if c.exists(['dnsv6-server', 'server-2']): + config_data['dnsv6']['server2'] = c.return_value( + ['dnsv6-server', 'server-2']) + if c.exists(['dnsv6-server', 'server-3']): + config_data['dnsv6']['server3'] = c.return_value( + ['dnsv6-server', 'server-3']) + if not c.exists(['authentication', 'mode', 'noauth']): + config_data['auth']['mech'] = c.return_value( + ['authentication', 'mode']) + if c.exists(['authentication', 'mode', 'local']): + for auth_int in c.list_nodes(['authentication', 'interface']): + for mac in c.list_nodes(['authentication', 'interface', auth_int, 'mac-address']): + config_data['auth']['auth_if'][auth_int] = {} + if c.exists(['authentication', 'interface', auth_int, 'mac-address', mac, 'rate-limit']): + config_data['auth']['auth_if'][auth_int][mac] = {} + config_data['auth']['auth_if'][auth_int][mac]['up'] = c.return_value( + ['authentication', 'interface', auth_int, 'mac-address', mac, 'rate-limit upload']) + config_data['auth']['auth_if'][auth_int][mac]['down'] = c.return_value( + ['authentication', 'interface', auth_int, 'mac-address', 'mac', 'rate-limit download']) + else: + config_data['auth']['auth_if'][auth_int][mac] = {} + config_data['auth']['auth_if'][auth_int][mac]['up'] = None + config_data['auth']['auth_if'][auth_int][mac]['down'] = None + # client vlan-id + if c.exists(['authentication', 'interface', auth_int, 'mac-address', mac, 'vlan-id']): + config_data['auth']['auth_if'][auth_int][mac]['vlan'] = c.return_value( + ['authentication', 'interface', auth_int, 'mac-address', mac, 'vlan-id']) + if c.exists(['authentication', 'mode', 'radius']): + for rsrv in c.list_nodes(['authentication', 'radius-server']): + config_data['auth']['radius'][rsrv] = {} + if c.exists(['authentication', 'radius-server', rsrv, 'secret']): + config_data['auth']['radius'][rsrv]['secret'] = c.return_value( + ['authentication', 'radius-server', rsrv, 'secret']) + else: + config_data['auth']['radius'][rsrv]['secret'] = None + if c.exists(['authentication', 'radius-server', rsrv, 'fail-time']): + config_data['auth']['radius'][rsrv]['fail-time'] = c.return_value( + ['authentication', 'radius-server', rsrv, 'fail-time']) + else: + config_data['auth']['radius'][rsrv]['fail-time'] = '0' + if c.exists(['authentication', 'radius-server', rsrv, 'req-limit']): + config_data['auth']['radius'][rsrv]['req-limit'] = c.return_value( + ['authentication', 'radius-server', rsrv, 'req-limit']) + else: + config_data['auth']['radius'][rsrv]['req-limit'] = '0' + if c.exists(['authentication', 'radius-settings']): + if c.exists(['authentication', 'radius-settings', 'timeout']): + config_data['auth']['radsettings']['timeout'] = c.return_value( + ['authentication', 'radius-settings', 'timeout']) + if c.exists(['authentication', 'radius-settings', 'nas-ip-address']): + config_data['auth']['radsettings']['nas-ip-address'] = c.return_value( + ['authentication', 'radius-settings', 'nas-ip-address']) + if c.exists(['authentication', 'radius-settings', 'nas-identifier']): + config_data['auth']['radsettings']['nas-identifier'] = c.return_value( + ['authentication', 'radius-settings', 'nas-identifier']) + if c.exists(['authentication', 'radius-settings', 'max-try']): + config_data['auth']['radsettings']['max-try'] = c.return_value( + ['authentication', 'radius-settings', 'max-try']) + if c.exists(['authentication', 'radius-settings', 'acct-timeout']): + config_data['auth']['radsettings']['acct-timeout'] = c.return_value( + ['authentication', 'radius-settings', 'acct-timeout']) + if c.exists(['authentication', 'radius-settings', 'dae-server', 'ip-address']): + config_data['auth']['radsettings']['dae-server']['ip-address'] = c.return_value( + ['authentication', 'radius-settings', 'dae-server', 'ip-address']) + if c.exists(['authentication', 'radius-settings', 'dae-server', 'port']): + config_data['auth']['radsettings']['dae-server']['port'] = c.return_value( + ['authentication', 'radius-settings', 'dae-server', 'port']) + if c.exists(['authentication', 'radius-settings', 'dae-server', 'secret']): + config_data['auth']['radsettings']['dae-server']['secret'] = c.return_value( + ['authentication', 'radius-settings', 'dae-server', 'secret']) + + if c.exists(['client-ipv6-pool', 'prefix']): + config_data['ipv6']['prfx'] = c.return_values( + ['client-ipv6-pool', 'prefix']) + if c.exists(['client-ipv6-pool', 'delegate-prefix']): + config_data['ipv6']['pd'] = c.return_values( + ['client-ipv6-pool', 'delegate-prefix']) + + return config_data + def generate(c): - if c == None or not c: - return None - - c['thread_cnt'] = get_cpu() + if c == None or not c: + return None - if c['auth']['mech'] == 'local': - gen_chap_secrets(c) + c['thread_cnt'] = _get_cpu() - tmpl = jinja2.Template(ipoe_config, trim_blocks=True) - config_text = tmpl.render(c) - open(ipoe_cnf,'w').write(config_text) - return c + if c['auth']['mech'] == 'local': + _gen_chap_secrets(c) -def verify(c): - if c == None or not c: - return None + tmpl = jinja2.Template(ipoe_config, trim_blocks=True) + config_text = tmpl.render(c) + open(ipoe_cnf, 'w').write(config_text) + return c - if not c['interfaces']: - raise ConfigError("service ipoe-server interface requires a value") - for intfc in c['interfaces']: - if not c['interfaces'][intfc]['range']: - raise ConfigError("service ipoe-server interface " + intfc + " client-subnet needs a value") +def verify(c): + if c == None or not c: + return None - if c['auth']['mech'] == 'radius': - if not c['auth']['radius']: - raise ConfigError("service ipoe-server authentication radius-server requires a value for authentication mode radius") - else: - for radsrv in c['auth']['radius']: - if not c['auth']['radius'][radsrv]['secret']: - raise ConfigError("service ipoe-server authentication radius-server " + radsrv + " secret requires a value") + if not c['interfaces']: + raise ConfigError("service ipoe-server interface requires a value") - if c['auth']['radsettings']['dae-server']: - try: - if c['auth']['radsettings']['dae-server']['ip-address']: - pass - except: - raise ConfigError("service ipoe-server authentication radius-settings dae-server ip-address value required") - try: - if c['auth']['radsettings']['dae-server']['secret']: - pass - except: - raise ConfigError("service ipoe-server authentication radius-settings dae-server secret value required") - try: - if c['auth']['radsettings']['dae-server']['port']: - pass - except: - raise ConfigError("service ipoe-server authentication radius-settings dae-server port value required") + for intfc in c['interfaces']: + if not c['interfaces'][intfc]['range']: + raise ConfigError("service ipoe-server interface " + + intfc + " client-subnet needs a value") - if len(c['ipv6']['pd']) != 0 and len(c['ipv6']['prfx']) == 0: - raise ConfigError("service ipoe-server client-ipv6-pool prefix needs a value") + if c['auth']['mech'] == 'radius': + if not c['auth']['radius']: + raise ConfigError( + "service ipoe-server authentication radius-server requires a value for authentication mode radius") + else: + for radsrv in c['auth']['radius']: + if not c['auth']['radius'][radsrv]['secret']: + raise ConfigError( + "service ipoe-server authentication radius-server " + radsrv + " secret requires a value") + + if c['auth']['radsettings']['dae-server']: + try: + if c['auth']['radsettings']['dae-server']['ip-address']: + pass + except: + raise ConfigError( + "service ipoe-server authentication radius-settings dae-server ip-address value required") + try: + if c['auth']['radsettings']['dae-server']['secret']: + pass + except: + raise ConfigError( + "service ipoe-server authentication radius-settings dae-server secret value required") + try: + if c['auth']['radsettings']['dae-server']['port']: + pass + except: + raise ConfigError( + "service ipoe-server authentication radius-settings dae-server port value required") + + if len(c['ipv6']['pd']) != 0 and len(c['ipv6']['prfx']) == 0: + raise ConfigError( + "service ipoe-server client-ipv6-pool prefix needs a value") + + return c - return c def apply(c): - if c == None: - if os.path.exists(pidfile): - accel_cmd('shutdown hard') - if os.path.exists(pidfile): - os.remove(pidfile) - return None - - if not os.path.exists(pidfile): - ret = subprocess.call(['/usr/sbin/accel-pppd', '-c', ipoe_cnf, '-p', pidfile, '-d']) - chk_con() - if ret !=0 and os.path.exists(pidfile): - os.remove(pidfile) - raise ConfigError('accel-pppd failed to start') - else: - accel_cmd('restart') - sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + if c == None: + if os.path.exists(pidfile): + _accel_cmd('shutdown hard') + if os.path.exists(pidfile): + os.remove(pidfile) + return None + + if not os.path.exists(pidfile): + ret = subprocess.call( + ['/usr/sbin/accel-pppd', '-c', ipoe_cnf, '-p', pidfile, '-d']) + _chk_con() + if ret != 0 and os.path.exists(pidfile): + os.remove(pidfile) + raise ConfigError('accel-pppd failed to start') + else: + _accel_cmd('restart') + sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + if __name__ == '__main__': - try: - c = get_config() - verify(c) - generate(c) - apply(c) - except ConfigError as e: - print(e) - sys.exit(1) + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3