From f35cf88ec4c63ba8510bbccbbb60bacc16d02aa5 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 18:32:33 +0200 Subject: vpn: l2tp: T2264: rename files to match CLI levels --- src/conf_mode/accel_l2tp.py | 397 -------------------------------------------- src/conf_mode/vpn_l2tp.py | 397 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 397 insertions(+), 397 deletions(-) delete mode 100755 src/conf_mode/accel_l2tp.py create mode 100755 src/conf_mode/vpn_l2tp.py (limited to 'src/conf_mode') diff --git a/src/conf_mode/accel_l2tp.py b/src/conf_mode/accel_l2tp.py deleted file mode 100755 index 4ca5a858a..000000000 --- a/src/conf_mode/accel_l2tp.py +++ /dev/null @@ -1,397 +0,0 @@ -#!/usr/bin/env python3 -# -# Copyright (C) 2019-2020 VyOS maintainers and contributors -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -import sys -import os -import re -import jinja2 -import socket -import time - -from jinja2 import FileSystemLoader, Environment - -from vyos.config import Config -from vyos.defaults import directories as vyos_data_dir -from vyos import ConfigError -from vyos.util import run - - -pidfile = r'/var/run/accel_l2tp.pid' -l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' -chap_secrets = l2tp_cnf_dir + '/chap-secrets' -l2tp_conf = l2tp_cnf_dir + '/l2tp.config' -# accel-pppd -d -c /etc/accel-ppp/l2tp/l2tp.config -p /var/run/accel_l2tp.pid - -# config path creation -if not os.path.exists(l2tp_cnf_dir): - os.makedirs(l2tp_cnf_dir) - -### -# inline helper functions -### -# depending on hw and threads, daemon needs a little to start -# if it takes longer than 100 * 0.5 secs, exception is being raised -# not sure if that's the best way to check it, but it worked so far quite well -### - - -def chk_con(): - cnt = 0 - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - while True: - try: - s.connect(("127.0.0.1", 2004)) - break - except ConnectionRefusedError: - time.sleep(0.5) - cnt += 1 - if cnt == 100: - raise("failed to start l2tp server") - break - - -def _accel_cmd(command): - return run(f'/usr/bin/accel-cmd -p 2004 {command}') - -### -# inline helper functions end -### - - -def get_config(): - c = Config() - if not c.exists('vpn l2tp remote-access '): - return None - - c.set_level('vpn l2tp remote-access') - config_data = { - 'authentication': { - 'mode': 'local', - 'local-users': { - }, - 'radiussrv': {}, - 'radiusopt': {}, - 'auth_proto': [], - 'mppe': 'prefer' - }, - 'outside_addr': '', - 'gateway_address': '10.255.255.0', - 'dns': [], - 'dnsv6': [], - 'wins': [], - 'client_ip_pool': None, - 'client_ip_subnets': [], - 'client_ipv6_pool': {}, - 'mtu': '1436', - 'ip6_column': '', - 'ip6_dp_column': '', - 'ppp_options': {}, - } - - ### general options ### - - if c.exists('dns-servers server-1'): - config_data['dns'].append(c.return_value('dns-servers server-1')) - if c.exists('dns-servers server-2'): - config_data['dns'].append(c.return_value('dns-servers server-2')) - if c.exists('dnsv6-servers'): - for dns6_server in c.return_values('dnsv6-servers'): - config_data['dnsv6'].append(dns6_server) - if c.exists('wins-servers server-1'): - config_data['wins'].append(c.return_value('wins-servers server-1')) - if c.exists('wins-servers server-2'): - config_data['wins'].append(c.return_value('wins-servers server-2')) - if c.exists('outside-address'): - config_data['outside_addr'] = c.return_value('outside-address') - - # auth local - if c.exists('authentication mode local'): - if c.exists('authentication local-users username'): - for usr in c.list_nodes('authentication local-users username'): - config_data['authentication']['local-users'].update( - { - usr: { - 'passwd': '', - 'state': 'enabled', - 'ip': '*', - 'upload': None, - 'download': None - } - } - ) - - if c.exists('authentication local-users username ' + usr + ' password'): - config_data['authentication']['local-users'][usr]['passwd'] = c.return_value( - 'authentication local-users username ' + usr + ' password') - if c.exists('authentication local-users username ' + usr + ' disable'): - config_data['authentication']['local-users'][usr]['state'] = 'disable' - if c.exists('authentication local-users username ' + usr + ' static-ip'): - config_data['authentication']['local-users'][usr]['ip'] = c.return_value( - 'authentication local-users username ' + usr + ' static-ip') - if c.exists('authentication local-users username ' + usr + ' rate-limit download'): - config_data['authentication']['local-users'][usr]['download'] = c.return_value( - 'authentication local-users username ' + usr + ' rate-limit download') - if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): - config_data['authentication']['local-users'][usr]['upload'] = c.return_value( - 'authentication local-users username ' + usr + ' rate-limit upload') - - # authentication mode radius servers and settings - - if c.exists('authentication mode radius'): - config_data['authentication']['mode'] = 'radius' - rsrvs = c.list_nodes('authentication radius server') - for rsrv in rsrvs: - if c.return_value('authentication radius server ' + rsrv + ' fail-time') == None: - ftime = '0' - else: - ftime = str(c.return_value( - 'authentication radius server ' + rsrv + ' fail-time')) - if c.return_value('authentication radius-server ' + rsrv + ' req-limit') == None: - reql = '0' - else: - reql = str(c.return_value( - 'authentication radius server ' + rsrv + ' req-limit')) - - config_data['authentication']['radiussrv'].update( - { - rsrv: { - 'secret': c.return_value('authentication radius server ' + rsrv + ' key'), - 'fail-time': ftime, - 'req-limit': reql - } - } - ) - # Source ip address feature - if c.exists('authentication radius source-address'): - config_data['authentication']['radius_source_address'] = c.return_value( - 'authentication radius source-address') - - # advanced radius-setting - if c.exists('authentication radius acct-timeout'): - config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value( - 'authentication radius acct-timeout') - if c.exists('authentication radius max-try'): - config_data['authentication']['radiusopt']['max-try'] = c.return_value( - 'authentication radius max-try') - if c.exists('authentication radius timeout'): - config_data['authentication']['radiusopt']['timeout'] = c.return_value( - 'authentication radius timeout') - if c.exists('authentication radius nas-identifier'): - config_data['authentication']['radiusopt']['nas-id'] = c.return_value( - 'authentication radius nas-identifier') - if c.exists('authentication radius dae-server'): - # Set default dae-server port if not defined - if c.exists('authentication radius dae-server port'): - dae_server_port = c.return_value( - 'authentication radius dae-server port') - else: - dae_server_port = "3799" - config_data['authentication']['radiusopt'].update( - { - 'dae-srv': { - 'ip-addr': c.return_value('authentication radius dae-server ip-address'), - 'port': dae_server_port, - 'secret': str(c.return_value('authentication radius dae-server secret')) - } - } - ) - # filter-id is the internal accel default if attribute is empty - # set here as default for visibility which may change in the future - if c.exists('authentication radius rate-limit enable'): - if not c.exists('authentication radius rate-limit attribute'): - config_data['authentication']['radiusopt']['shaper'] = { - 'attr': 'Filter-Id' - } - else: - config_data['authentication']['radiusopt']['shaper'] = { - 'attr': c.return_value('authentication radius rate-limit attribute') - } - if c.exists('authentication radius rate-limit vendor'): - config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( - 'authentication radius rate-limit vendor') - - if c.exists('client-ip-pool'): - if c.exists('client-ip-pool start') and c.exists('client-ip-pool stop'): - config_data['client_ip_pool'] = c.return_value( - 'client-ip-pool start') + '-' + re.search('[0-9]+$', c.return_value('client-ip-pool stop')).group(0) - - if c.exists('client-ip-pool subnet'): - config_data['client_ip_subnets'] = c.return_values( - 'client-ip-pool subnet') - - if c.exists('client-ipv6-pool prefix'): - config_data['client_ipv6_pool']['prefix'] = c.return_values( - 'client-ipv6-pool prefix') - config_data['ip6_column'] = 'ip6,' - if c.exists('client-ipv6-pool delegate-prefix'): - config_data['client_ipv6_pool']['delegate_prefix'] = c.return_values( - 'client-ipv6-pool delegate-prefix') - config_data['ip6_dp_column'] = 'ip6-dp,' - - if c.exists('mtu'): - config_data['mtu'] = c.return_value('mtu') - - # gateway address - if c.exists('gateway-address'): - config_data['gateway_address'] = c.return_value('gateway-address') - else: - # calculate gw-ip-address - if c.exists('client-ip-pool start'): - # use start ip as gw-ip-address - config_data['gateway_address'] = c.return_value( - 'client-ip-pool start') - elif c.exists('client-ip-pool subnet'): - # use first ip address from first defined pool - lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", c.return_values( - 'client-ip-pool subnet')[0]) - config_data['gateway_address'] = lst_ip[0] - - if c.exists('authentication require'): - auth_mods = {'pap': 'pap', 'chap': 'auth_chap_md5', - 'mschap': 'auth_mschap_v1', 'mschap-v2': 'auth_mschap_v2'} - for proto in c.return_values('authentication require'): - config_data['authentication']['auth_proto'].append( - auth_mods[proto]) - else: - config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] - - if c.exists('authentication mppe'): - config_data['authentication']['mppe'] = c.return_value( - 'authentication mppe') - - if c.exists('idle'): - config_data['idle_timeout'] = c.return_value('idle') - - # LNS secret - if c.exists('lns shared-secret'): - config_data['lns_shared_secret'] = c.return_value('lns shared-secret') - - if c.exists('ccp-disable'): - config_data['ccp_disable'] = True - - # ppp_options - ppp_options = {} - if c.exists('ppp-options'): - if c.exists('ppp-options lcp-echo-failure'): - ppp_options['lcp-echo-failure'] = c.return_value( - 'ppp-options lcp-echo-failure') - if c.exists('ppp-options lcp-echo-interval'): - ppp_options['lcp-echo-interval'] = c.return_value( - 'ppp-options lcp-echo-interval') - - if len(ppp_options) != 0: - config_data['ppp_options'] = ppp_options - - return config_data - - -def verify(c): - if c == None: - return None - - if c['authentication']['mode'] == 'local': - if not c['authentication']['local-users']: - raise ConfigError( - 'l2tp-server authentication local-users required') - for usr in c['authentication']['local-users']: - if not c['authentication']['local-users'][usr]['passwd']: - raise ConfigError('user ' + usr + ' requires a password') - - if c['authentication']['mode'] == 'radius': - if len(c['authentication']['radiussrv']) == 0: - raise ConfigError('radius server required') - for rsrv in c['authentication']['radiussrv']: - if c['authentication']['radiussrv'][rsrv]['secret'] == None: - raise ConfigError('radius server ' + rsrv + - ' needs a secret configured') - - # check for the existence of a client ip pool - if not c['client_ip_pool'] and not c['client_ip_subnets']: - raise ConfigError( - "set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool") - - # check ipv6 - if 'delegate_prefix' in c['client_ipv6_pool'] and not 'prefix' in c['client_ipv6_pool']: - raise ConfigError( - "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") - - if len(c['dnsv6']) > 3: - raise ConfigError("Maximum allowed dnsv6-servers addresses is 3") - - -def generate(c): - if c == None: - return None - - # Prepare Jinja2 template loader from files - tmpl_path = os.path.join(vyos_data_dir['data'], 'templates', 'l2tp') - fs_loader = FileSystemLoader(tmpl_path) - env = Environment(loader=fs_loader, trim_blocks=True) - - # accel-cmd reload doesn't work so any change results in a restart of the daemon - try: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - except KeyError: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - - tmpl = env.get_template('l2tp.config.tmpl') - config_text = tmpl.render(c) - open(l2tp_conf, 'w').write(config_text) - - if c['authentication']['local-users']: - tmpl = env.get_template('chap-secrets.tmpl') - chap_secrets_txt = tmpl.render(c) - old_umask = os.umask(0o077) - open(chap_secrets, 'w').write(chap_secrets_txt) - os.umask(old_umask) - - return c - - -def apply(c): - if c == None: - if os.path.exists(pidfile): - _accel_cmd('shutdown hard') - if os.path.exists(pidfile): - os.remove(pidfile) - return None - - if not os.path.exists(pidfile): - ret = run(f'/usr/sbin/accel-pppd -c {l2tp_conf} -p {pidfile} -d') - chk_con() - if ret != 0 and os.path.exists(pidfile): - os.remove(pidfile) - raise ConfigError('accel-pppd failed to start') - else: - # if gw ip changes, only restart doesn't work - _accel_cmd('restart') - - -if __name__ == '__main__': - try: - c = get_config() - verify(c) - generate(c) - apply(c) - except ConfigError as e: - print(e) - sys.exit(1) diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py new file mode 100755 index 000000000..4ca5a858a --- /dev/null +++ b/src/conf_mode/vpn_l2tp.py @@ -0,0 +1,397 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2019-2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import sys +import os +import re +import jinja2 +import socket +import time + +from jinja2 import FileSystemLoader, Environment + +from vyos.config import Config +from vyos.defaults import directories as vyos_data_dir +from vyos import ConfigError +from vyos.util import run + + +pidfile = r'/var/run/accel_l2tp.pid' +l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' +chap_secrets = l2tp_cnf_dir + '/chap-secrets' +l2tp_conf = l2tp_cnf_dir + '/l2tp.config' +# accel-pppd -d -c /etc/accel-ppp/l2tp/l2tp.config -p /var/run/accel_l2tp.pid + +# config path creation +if not os.path.exists(l2tp_cnf_dir): + os.makedirs(l2tp_cnf_dir) + +### +# inline helper functions +### +# depending on hw and threads, daemon needs a little to start +# if it takes longer than 100 * 0.5 secs, exception is being raised +# not sure if that's the best way to check it, but it worked so far quite well +### + + +def chk_con(): + cnt = 0 + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + while True: + try: + s.connect(("127.0.0.1", 2004)) + break + except ConnectionRefusedError: + time.sleep(0.5) + cnt += 1 + if cnt == 100: + raise("failed to start l2tp server") + break + + +def _accel_cmd(command): + return run(f'/usr/bin/accel-cmd -p 2004 {command}') + +### +# inline helper functions end +### + + +def get_config(): + c = Config() + if not c.exists('vpn l2tp remote-access '): + return None + + c.set_level('vpn l2tp remote-access') + config_data = { + 'authentication': { + 'mode': 'local', + 'local-users': { + }, + 'radiussrv': {}, + 'radiusopt': {}, + 'auth_proto': [], + 'mppe': 'prefer' + }, + 'outside_addr': '', + 'gateway_address': '10.255.255.0', + 'dns': [], + 'dnsv6': [], + 'wins': [], + 'client_ip_pool': None, + 'client_ip_subnets': [], + 'client_ipv6_pool': {}, + 'mtu': '1436', + 'ip6_column': '', + 'ip6_dp_column': '', + 'ppp_options': {}, + } + + ### general options ### + + if c.exists('dns-servers server-1'): + config_data['dns'].append(c.return_value('dns-servers server-1')) + if c.exists('dns-servers server-2'): + config_data['dns'].append(c.return_value('dns-servers server-2')) + if c.exists('dnsv6-servers'): + for dns6_server in c.return_values('dnsv6-servers'): + config_data['dnsv6'].append(dns6_server) + if c.exists('wins-servers server-1'): + config_data['wins'].append(c.return_value('wins-servers server-1')) + if c.exists('wins-servers server-2'): + config_data['wins'].append(c.return_value('wins-servers server-2')) + if c.exists('outside-address'): + config_data['outside_addr'] = c.return_value('outside-address') + + # auth local + if c.exists('authentication mode local'): + if c.exists('authentication local-users username'): + for usr in c.list_nodes('authentication local-users username'): + config_data['authentication']['local-users'].update( + { + usr: { + 'passwd': '', + 'state': 'enabled', + 'ip': '*', + 'upload': None, + 'download': None + } + } + ) + + if c.exists('authentication local-users username ' + usr + ' password'): + config_data['authentication']['local-users'][usr]['passwd'] = c.return_value( + 'authentication local-users username ' + usr + ' password') + if c.exists('authentication local-users username ' + usr + ' disable'): + config_data['authentication']['local-users'][usr]['state'] = 'disable' + if c.exists('authentication local-users username ' + usr + ' static-ip'): + config_data['authentication']['local-users'][usr]['ip'] = c.return_value( + 'authentication local-users username ' + usr + ' static-ip') + if c.exists('authentication local-users username ' + usr + ' rate-limit download'): + config_data['authentication']['local-users'][usr]['download'] = c.return_value( + 'authentication local-users username ' + usr + ' rate-limit download') + if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): + config_data['authentication']['local-users'][usr]['upload'] = c.return_value( + 'authentication local-users username ' + usr + ' rate-limit upload') + + # authentication mode radius servers and settings + + if c.exists('authentication mode radius'): + config_data['authentication']['mode'] = 'radius' + rsrvs = c.list_nodes('authentication radius server') + for rsrv in rsrvs: + if c.return_value('authentication radius server ' + rsrv + ' fail-time') == None: + ftime = '0' + else: + ftime = str(c.return_value( + 'authentication radius server ' + rsrv + ' fail-time')) + if c.return_value('authentication radius-server ' + rsrv + ' req-limit') == None: + reql = '0' + else: + reql = str(c.return_value( + 'authentication radius server ' + rsrv + ' req-limit')) + + config_data['authentication']['radiussrv'].update( + { + rsrv: { + 'secret': c.return_value('authentication radius server ' + rsrv + ' key'), + 'fail-time': ftime, + 'req-limit': reql + } + } + ) + # Source ip address feature + if c.exists('authentication radius source-address'): + config_data['authentication']['radius_source_address'] = c.return_value( + 'authentication radius source-address') + + # advanced radius-setting + if c.exists('authentication radius acct-timeout'): + config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value( + 'authentication radius acct-timeout') + if c.exists('authentication radius max-try'): + config_data['authentication']['radiusopt']['max-try'] = c.return_value( + 'authentication radius max-try') + if c.exists('authentication radius timeout'): + config_data['authentication']['radiusopt']['timeout'] = c.return_value( + 'authentication radius timeout') + if c.exists('authentication radius nas-identifier'): + config_data['authentication']['radiusopt']['nas-id'] = c.return_value( + 'authentication radius nas-identifier') + if c.exists('authentication radius dae-server'): + # Set default dae-server port if not defined + if c.exists('authentication radius dae-server port'): + dae_server_port = c.return_value( + 'authentication radius dae-server port') + else: + dae_server_port = "3799" + config_data['authentication']['radiusopt'].update( + { + 'dae-srv': { + 'ip-addr': c.return_value('authentication radius dae-server ip-address'), + 'port': dae_server_port, + 'secret': str(c.return_value('authentication radius dae-server secret')) + } + } + ) + # filter-id is the internal accel default if attribute is empty + # set here as default for visibility which may change in the future + if c.exists('authentication radius rate-limit enable'): + if not c.exists('authentication radius rate-limit attribute'): + config_data['authentication']['radiusopt']['shaper'] = { + 'attr': 'Filter-Id' + } + else: + config_data['authentication']['radiusopt']['shaper'] = { + 'attr': c.return_value('authentication radius rate-limit attribute') + } + if c.exists('authentication radius rate-limit vendor'): + config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( + 'authentication radius rate-limit vendor') + + if c.exists('client-ip-pool'): + if c.exists('client-ip-pool start') and c.exists('client-ip-pool stop'): + config_data['client_ip_pool'] = c.return_value( + 'client-ip-pool start') + '-' + re.search('[0-9]+$', c.return_value('client-ip-pool stop')).group(0) + + if c.exists('client-ip-pool subnet'): + config_data['client_ip_subnets'] = c.return_values( + 'client-ip-pool subnet') + + if c.exists('client-ipv6-pool prefix'): + config_data['client_ipv6_pool']['prefix'] = c.return_values( + 'client-ipv6-pool prefix') + config_data['ip6_column'] = 'ip6,' + if c.exists('client-ipv6-pool delegate-prefix'): + config_data['client_ipv6_pool']['delegate_prefix'] = c.return_values( + 'client-ipv6-pool delegate-prefix') + config_data['ip6_dp_column'] = 'ip6-dp,' + + if c.exists('mtu'): + config_data['mtu'] = c.return_value('mtu') + + # gateway address + if c.exists('gateway-address'): + config_data['gateway_address'] = c.return_value('gateway-address') + else: + # calculate gw-ip-address + if c.exists('client-ip-pool start'): + # use start ip as gw-ip-address + config_data['gateway_address'] = c.return_value( + 'client-ip-pool start') + elif c.exists('client-ip-pool subnet'): + # use first ip address from first defined pool + lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", c.return_values( + 'client-ip-pool subnet')[0]) + config_data['gateway_address'] = lst_ip[0] + + if c.exists('authentication require'): + auth_mods = {'pap': 'pap', 'chap': 'auth_chap_md5', + 'mschap': 'auth_mschap_v1', 'mschap-v2': 'auth_mschap_v2'} + for proto in c.return_values('authentication require'): + config_data['authentication']['auth_proto'].append( + auth_mods[proto]) + else: + config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] + + if c.exists('authentication mppe'): + config_data['authentication']['mppe'] = c.return_value( + 'authentication mppe') + + if c.exists('idle'): + config_data['idle_timeout'] = c.return_value('idle') + + # LNS secret + if c.exists('lns shared-secret'): + config_data['lns_shared_secret'] = c.return_value('lns shared-secret') + + if c.exists('ccp-disable'): + config_data['ccp_disable'] = True + + # ppp_options + ppp_options = {} + if c.exists('ppp-options'): + if c.exists('ppp-options lcp-echo-failure'): + ppp_options['lcp-echo-failure'] = c.return_value( + 'ppp-options lcp-echo-failure') + if c.exists('ppp-options lcp-echo-interval'): + ppp_options['lcp-echo-interval'] = c.return_value( + 'ppp-options lcp-echo-interval') + + if len(ppp_options) != 0: + config_data['ppp_options'] = ppp_options + + return config_data + + +def verify(c): + if c == None: + return None + + if c['authentication']['mode'] == 'local': + if not c['authentication']['local-users']: + raise ConfigError( + 'l2tp-server authentication local-users required') + for usr in c['authentication']['local-users']: + if not c['authentication']['local-users'][usr]['passwd']: + raise ConfigError('user ' + usr + ' requires a password') + + if c['authentication']['mode'] == 'radius': + if len(c['authentication']['radiussrv']) == 0: + raise ConfigError('radius server required') + for rsrv in c['authentication']['radiussrv']: + if c['authentication']['radiussrv'][rsrv]['secret'] == None: + raise ConfigError('radius server ' + rsrv + + ' needs a secret configured') + + # check for the existence of a client ip pool + if not c['client_ip_pool'] and not c['client_ip_subnets']: + raise ConfigError( + "set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool") + + # check ipv6 + if 'delegate_prefix' in c['client_ipv6_pool'] and not 'prefix' in c['client_ipv6_pool']: + raise ConfigError( + "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") + + if len(c['dnsv6']) > 3: + raise ConfigError("Maximum allowed dnsv6-servers addresses is 3") + + +def generate(c): + if c == None: + return None + + # Prepare Jinja2 template loader from files + tmpl_path = os.path.join(vyos_data_dir['data'], 'templates', 'l2tp') + fs_loader = FileSystemLoader(tmpl_path) + env = Environment(loader=fs_loader, trim_blocks=True) + + # accel-cmd reload doesn't work so any change results in a restart of the daemon + try: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + except KeyError: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + + tmpl = env.get_template('l2tp.config.tmpl') + config_text = tmpl.render(c) + open(l2tp_conf, 'w').write(config_text) + + if c['authentication']['local-users']: + tmpl = env.get_template('chap-secrets.tmpl') + chap_secrets_txt = tmpl.render(c) + old_umask = os.umask(0o077) + open(chap_secrets, 'w').write(chap_secrets_txt) + os.umask(old_umask) + + return c + + +def apply(c): + if c == None: + if os.path.exists(pidfile): + _accel_cmd('shutdown hard') + if os.path.exists(pidfile): + os.remove(pidfile) + return None + + if not os.path.exists(pidfile): + ret = run(f'/usr/sbin/accel-pppd -c {l2tp_conf} -p {pidfile} -d') + chk_con() + if ret != 0 and os.path.exists(pidfile): + os.remove(pidfile) + raise ConfigError('accel-pppd failed to start') + else: + # if gw ip changes, only restart doesn't work + _accel_cmd('restart') + + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3 From 87151df4aabc6d131d341837327dac29afd492ed Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 18:33:42 +0200 Subject: vpn: l2tp: T2264: import cleanup --- src/conf_mode/vpn_l2tp.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 4ca5a858a..5a68faa5d 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -14,12 +14,12 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . -import sys import os import re -import jinja2 -import socket -import time + +from socket import AF_INET, SOCK_STREAM, socket +from sys import exit +from time import sleep from jinja2 import FileSystemLoader, Environment @@ -50,13 +50,13 @@ if not os.path.exists(l2tp_cnf_dir): def chk_con(): cnt = 0 - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s = socket(AF_INET, SOCK_STREAM) while True: try: s.connect(("127.0.0.1", 2004)) break except ConnectionRefusedError: - time.sleep(0.5) + sleep(0.5) cnt += 1 if cnt == 100: raise("failed to start l2tp server") @@ -66,7 +66,7 @@ def chk_con(): def _accel_cmd(command): return run(f'/usr/bin/accel-cmd -p 2004 {command}') -### +### # inline helper functions end ### @@ -394,4 +394,4 @@ if __name__ == '__main__': apply(c) except ConfigError as e: print(e) - sys.exit(1) + exit(1) -- cgit v1.2.3 From 5a1a4bb5ac2de027ced721bdf82021f5424e0bee Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 18:44:53 +0200 Subject: vpn: l2tp: T2264: introduce common config base --- src/conf_mode/vpn_l2tp.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 5a68faa5d..cb4e44443 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -73,10 +73,12 @@ def _accel_cmd(command): def get_config(): c = Config() - if not c.exists('vpn l2tp remote-access '): + base = ['vpn', 'l2tp' 'remote-access'] + if not c.exists(base): return None - c.set_level('vpn l2tp remote-access') + c.set_level(base) + config_data = { 'authentication': { 'mode': 'local', -- cgit v1.2.3 From 3217abf039388465558c8cf8a6d29dda2c58189d Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 18:46:35 +0200 Subject: vpn: l2tp: T2264: use default_config_data dict --- src/conf_mode/vpn_l2tp.py | 52 ++++++++++++++++++++++++----------------------- 1 file changed, 27 insertions(+), 25 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index cb4e44443..b5ad1c3c0 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -17,6 +17,7 @@ import os import re +from copy import deepcopy from socket import AF_INET, SOCK_STREAM, socket from sys import exit from time import sleep @@ -39,6 +40,31 @@ l2tp_conf = l2tp_cnf_dir + '/l2tp.config' if not os.path.exists(l2tp_cnf_dir): os.makedirs(l2tp_cnf_dir) + +default_config_data = { + 'authentication': { + 'mode': 'local', + 'local-users': { + }, + 'radiussrv': {}, + 'radiusopt': {}, + 'auth_proto': [], + 'mppe': 'prefer' + }, + 'outside_addr': '', + 'gateway_address': '10.255.255.0', + 'dns': [], + 'dnsv6': [], + 'wins': [], + 'client_ip_pool': None, + 'client_ip_subnets': [], + 'client_ipv6_pool': {}, + 'mtu': '1436', + 'ip6_column': '', + 'ip6_dp_column': '', + 'ppp_options': {}, +} + ### # inline helper functions ### @@ -78,33 +104,9 @@ def get_config(): return None c.set_level(base) - - config_data = { - 'authentication': { - 'mode': 'local', - 'local-users': { - }, - 'radiussrv': {}, - 'radiusopt': {}, - 'auth_proto': [], - 'mppe': 'prefer' - }, - 'outside_addr': '', - 'gateway_address': '10.255.255.0', - 'dns': [], - 'dnsv6': [], - 'wins': [], - 'client_ip_pool': None, - 'client_ip_subnets': [], - 'client_ipv6_pool': {}, - 'mtu': '1436', - 'ip6_column': '', - 'ip6_dp_column': '', - 'ppp_options': {}, - } + config_data = deepcopy(default_config_data) ### general options ### - if c.exists('dns-servers server-1'): config_data['dns'].append(c.return_value('dns-servers server-1')) if c.exists('dns-servers server-2'): -- cgit v1.2.3 From 0adecf6c79c0de37a705cb0b035e7ab8a24cd09c Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 18:48:01 +0200 Subject: vpn: l2tp: T2264: comment cleanup on chk_con() --- src/conf_mode/vpn_l2tp.py | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index b5ad1c3c0..d5274a6bc 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -34,7 +34,7 @@ pidfile = r'/var/run/accel_l2tp.pid' l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' chap_secrets = l2tp_cnf_dir + '/chap-secrets' l2tp_conf = l2tp_cnf_dir + '/l2tp.config' -# accel-pppd -d -c /etc/accel-ppp/l2tp/l2tp.config -p /var/run/accel_l2tp.pid + # config path creation if not os.path.exists(l2tp_cnf_dir): @@ -65,16 +65,12 @@ default_config_data = { 'ppp_options': {}, } -### -# inline helper functions -### -# depending on hw and threads, daemon needs a little to start -# if it takes longer than 100 * 0.5 secs, exception is being raised -# not sure if that's the best way to check it, but it worked so far quite well -### - - def chk_con(): + """ + Depending on hardware and threads, daemon needs a little to start if it + takes longer than 100 * 0.5 secs, exception is being raised not sure if + that's the best way to check it, but it worked so far quite well + """ cnt = 0 s = socket(AF_INET, SOCK_STREAM) while True: @@ -92,10 +88,6 @@ def chk_con(): def _accel_cmd(command): return run(f'/usr/bin/accel-cmd -p 2004 {command}') -### -# inline helper functions end -### - def get_config(): c = Config() -- cgit v1.2.3 From c2ae1ca3be86abfdba418a738785c8a217f6245f Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:09:58 +0200 Subject: vpn: sstp: T2008: adjust DNS error message --- src/conf_mode/vpn_sstp.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index ca0844c50..f1c65eef4 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -303,7 +303,7 @@ def verify(sstp): raise ConfigError("Client gateway IP address required") if len(sstp['dnsv4']) > 2: - raise ConfigError("Only 2 DNS name-servers can be configured") + raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') if not sstp['ssl_ca'] or not sstp['ssl_cert'] or not sstp['ssl_key']: raise ConfigError('One or more SSL certificates missing') -- cgit v1.2.3 From 6a2e75dbe4003c6987c6932296e68c486ff7b380 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:32:24 +0200 Subject: vpn: l2tp: T2264: combine IPv4/IPv6 name-server CLI syntax There is no reason to distinguish between an IPv4 and IPv6 name-server node on the CLI - this can be done in the underlaying Python scripts. --- data/templates/l2tp/l2tp.config.tmpl | 17 ++++------ interface-definitions/vpn-l2tp.xml.in | 46 ++++++------------------- src/conf_mode/vpn_l2tp.py | 29 +++++++++------- src/migration-scripts/l2tp/2-to-3 | 64 +++++++++++++++++++++++++++++++++++ 4 files changed, 98 insertions(+), 58 deletions(-) create mode 100755 src/migration-scripts/l2tp/2-to-3 (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index b8637e256..bea2943d2 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -23,21 +23,18 @@ syslog=accel-l2tp,daemon copy=1 level=5 -{% if dns %} +{% if dnsv4 %} [dns] -{% if dns[0] %} -dns1={{dns[0]}} -{% endif %} -{% if dns[1] %} -dns2={{dns[1]}} +{% for dns in dnsv4 -%} +dns{{ loop.index }}={{ dns }} +{% endfor -%} {% endif %} -{% endif -%} {% if dnsv6 %} [ipv6-dns] -{% for srv in dnsv6: %} -{{srv}} -{% endfor %} +{% for dns in dnsv6 -%} +{{ dns }} +{% endfor -%} {% endif %} {% if wins %} diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index dcbb5f3ed..0bd592746 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -36,48 +36,22 @@ - + - IPv4 Domain Name Service (DNS) server - - - - - Primary DNS server - - ipv4 - IPv4 address - - - - - - - - - Secondary DNS server - - ipv4 - IPv4 address - - - - - - - - - - - IPv6 Domain Name Service (DNS) server + Domain Name Server (DNS) propagated to client - ipv6 - IPv6 DNS address + ipv4 + Domain Name Server (DNS) IPv4 address + + + ipv6 + Domain Name Server (DNS) IPv6 address + - + diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index d5274a6bc..93ee9edf9 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -26,9 +26,9 @@ from jinja2 import FileSystemLoader, Environment from vyos.config import Config from vyos.defaults import directories as vyos_data_dir -from vyos import ConfigError from vyos.util import run - +from vyos.validate import is_ipv4 +from vyos import ConfigError pidfile = r'/var/run/accel_l2tp.pid' l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' @@ -53,7 +53,7 @@ default_config_data = { }, 'outside_addr': '', 'gateway_address': '10.255.255.0', - 'dns': [], + 'dnsv4': [], 'dnsv6': [], 'wins': [], 'client_ip_pool': None, @@ -91,7 +91,7 @@ def _accel_cmd(command): def get_config(): c = Config() - base = ['vpn', 'l2tp' 'remote-access'] + base = ['vpn', 'l2tp', 'remote-access'] if not c.exists(base): return None @@ -99,17 +99,19 @@ def get_config(): config_data = deepcopy(default_config_data) ### general options ### - if c.exists('dns-servers server-1'): - config_data['dns'].append(c.return_value('dns-servers server-1')) - if c.exists('dns-servers server-2'): - config_data['dns'].append(c.return_value('dns-servers server-2')) - if c.exists('dnsv6-servers'): - for dns6_server in c.return_values('dnsv6-servers'): - config_data['dnsv6'].append(dns6_server) + if c.exists(['name-server']): + for name_server in c.return_values(['name-server']): + if is_ipv4(name_server): + config_data['dnsv4'].append(name_server) + else: + config_data['dnsv6'].append(name_server) + if c.exists('wins-servers server-1'): config_data['wins'].append(c.return_value('wins-servers server-1')) + if c.exists('wins-servers server-2'): config_data['wins'].append(c.return_value('wins-servers server-2')) + if c.exists('outside-address'): config_data['outside_addr'] = c.return_value('outside-address') @@ -324,8 +326,11 @@ def verify(c): raise ConfigError( "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") + if len(c['dnsv4']) > 2: + raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') + if len(c['dnsv6']) > 3: - raise ConfigError("Maximum allowed dnsv6-servers addresses is 3") + raise ConfigError('Not more then three IPv6 DNS name-servers can be configured') def generate(c): diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 new file mode 100755 index 000000000..ebeb814c1 --- /dev/null +++ b/src/migration-scripts/l2tp/2-to-3 @@ -0,0 +1,64 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# - remove primary/secondary identifier from nameserver + +import os +import sys + +from sys import argv, exit +from vyos.configtree import ConfigTree + +if (len(argv) < 1): + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +config = ConfigTree(config_file) +base = ['vpn', 'l2tp', 'remote-access'] +if not config.exists(base): + # Nothing to do + exit(0) +else: + + # Migrate IPv4 DNS servers + dns_base = base + ['dns-servers'] + if config.exists(dns_base): + for server in ['server-1', 'server-2']: + if config.exists(dns_base + [server]): + dns = config.return_value(dns_base + [server]) + config.set(base + ['name-server'], value=dns, replace=False) + + config.delete(dns_base) + + # Migrate IPv6 DNS servers + dns_base = base + ['dnsv6-servers'] + if config.exists(dns_base): + for server in config.return_values(dns_base): + config.set(base + ['name-server'], value=server, replace=False) + + config.delete(dns_base) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) -- cgit v1.2.3 From a533ca621567150732b58fc5176cd18b608f1f92 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:43:38 +0200 Subject: vpn: l2tp: T2264: combine WINS CLI syntax There is no reason to distinguish between WINS servers in terms of priority. This is solely a task which can be done in the underlaying Python scripts. --- data/templates/l2tp/l2tp.config.tmpl | 9 +++------ interface-definitions/vpn-l2tp.xml.in | 32 +++++++++++--------------------- src/conf_mode/vpn_l2tp.py | 10 +++++----- src/migration-scripts/l2tp/2-to-3 | 11 +++++++++++ 4 files changed, 30 insertions(+), 32 deletions(-) (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index bea2943d2..7e15233bb 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -39,13 +39,10 @@ dns{{ loop.index }}={{ dns }} {% if wins %} [wins] -{% if wins[0] %} -wins1={{wins[0]}} -{% endif %} -{% if wins[1] %} -wins2={{wins[1]}} +{% for server in wins -%} +wins{{ loop.index }}={{ server }} +{% endfor -%} {% endif %} -{% endif -%} [l2tp] verbose=1 diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 0bd592746..5604ea3d2 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -182,29 +182,19 @@ - + - Windows Internet Name Service (WINS) server settings + Windows Internet Name Service (WINS) servers propagated to client + + ipv4 + Domain Name Server (DNS) IPv4 address + + + + + - - - - Primary WINS server - - - - - - - - Secondary WINS server - - - - - - - + Pool of client IP addresses (must be within a /24) diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 93ee9edf9..fb7297928 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -106,11 +106,8 @@ def get_config(): else: config_data['dnsv6'].append(name_server) - if c.exists('wins-servers server-1'): - config_data['wins'].append(c.return_value('wins-servers server-1')) - - if c.exists('wins-servers server-2'): - config_data['wins'].append(c.return_value('wins-servers server-2')) + if c.exists(['wins-server']): + config_data['wins'] = c.return_values(['wins-server']) if c.exists('outside-address'): config_data['outside_addr'] = c.return_value('outside-address') @@ -326,6 +323,9 @@ def verify(c): raise ConfigError( "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") + if len(c['wins']) > 2: + raise ConfigError('Not more then two IPv4 WINS name-servers can be configured') + if len(c['dnsv4']) > 2: raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 index ebeb814c1..f1f9b67b5 100755 --- a/src/migration-scripts/l2tp/2-to-3 +++ b/src/migration-scripts/l2tp/2-to-3 @@ -56,6 +56,17 @@ else: config.delete(dns_base) + + # Migrate IPv4 WINS servers + wins_base = base + ['wins-servers'] + if config.exists(wins_base): + for server in ['server-1', 'server-2']: + if config.exists(wins_base + [server]): + wins = config.return_value(wins_base + [server]) + config.set(base + ['wins-server'], value=wins, replace=False) + + config.delete(wins_base) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3 From f21719e65a7286aca3267bbbc7fae891b175724f Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:58:42 +0200 Subject: vpn: sstp: T2008: cleanup thread_cnt generation --- src/conf_mode/vpn_sstp.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index f1c65eef4..8bafa0e61 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -81,7 +81,7 @@ default_config_data = { 'ppp_echo_failure' : '', 'ppp_echo_interval' : '', 'ppp_echo_timeout' : '', - 'thread_cnt' : '' + 'thread_cnt' : 1 } def get_config(): @@ -93,10 +93,9 @@ def get_config(): conf.set_level(base_path) - cpu = int(os.cpu_count()/2) - if cpu < 1: - cpu = 1 - sstp['thread_cnt'] = cpu + cpu = os.cpu_count() + if cpu > 1: + sstp['thread_cnt'] = int(cpu/2) if conf.exists(['authentication', 'mode']): sstp['auth_mode'] = conf.return_value(['authentication', 'mode']) -- cgit v1.2.3 From c39968861c97b4674031299c3e7dc8a32189528a Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 19:59:02 +0200 Subject: vpn: l2tp: T2264: cleanup thread_cnt generation --- src/conf_mode/vpn_l2tp.py | 133 ++++++++++++++++++++++------------------------ 1 file changed, 63 insertions(+), 70 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index fb7297928..8f493ddaf 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -63,6 +63,7 @@ default_config_data = { 'ip6_column': '', 'ip6_dp_column': '', 'ppp_options': {}, + 'thread_cnt': 1 } def chk_con(): @@ -96,27 +97,31 @@ def get_config(): return None c.set_level(base) - config_data = deepcopy(default_config_data) + l2tp = deepcopy(default_config_data) + + cpu = os.cpu_count() + if cpu > 1: + l2tp['thread_cnt'] = int(cpu/2) ### general options ### if c.exists(['name-server']): for name_server in c.return_values(['name-server']): if is_ipv4(name_server): - config_data['dnsv4'].append(name_server) + l2tp['dnsv4'].append(name_server) else: - config_data['dnsv6'].append(name_server) + l2tp['dnsv6'].append(name_server) if c.exists(['wins-server']): - config_data['wins'] = c.return_values(['wins-server']) + l2tp['wins'] = c.return_values(['wins-server']) if c.exists('outside-address'): - config_data['outside_addr'] = c.return_value('outside-address') + l2tp['outside_addr'] = c.return_value('outside-address') # auth local if c.exists('authentication mode local'): if c.exists('authentication local-users username'): for usr in c.list_nodes('authentication local-users username'): - config_data['authentication']['local-users'].update( + l2tp['authentication']['local-users'].update( { usr: { 'passwd': '', @@ -129,24 +134,24 @@ def get_config(): ) if c.exists('authentication local-users username ' + usr + ' password'): - config_data['authentication']['local-users'][usr]['passwd'] = c.return_value( + l2tp['authentication']['local-users'][usr]['passwd'] = c.return_value( 'authentication local-users username ' + usr + ' password') if c.exists('authentication local-users username ' + usr + ' disable'): - config_data['authentication']['local-users'][usr]['state'] = 'disable' + l2tp['authentication']['local-users'][usr]['state'] = 'disable' if c.exists('authentication local-users username ' + usr + ' static-ip'): - config_data['authentication']['local-users'][usr]['ip'] = c.return_value( + l2tp['authentication']['local-users'][usr]['ip'] = c.return_value( 'authentication local-users username ' + usr + ' static-ip') if c.exists('authentication local-users username ' + usr + ' rate-limit download'): - config_data['authentication']['local-users'][usr]['download'] = c.return_value( + l2tp['authentication']['local-users'][usr]['download'] = c.return_value( 'authentication local-users username ' + usr + ' rate-limit download') if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): - config_data['authentication']['local-users'][usr]['upload'] = c.return_value( + l2tp['authentication']['local-users'][usr]['upload'] = c.return_value( 'authentication local-users username ' + usr + ' rate-limit upload') # authentication mode radius servers and settings if c.exists('authentication mode radius'): - config_data['authentication']['mode'] = 'radius' + l2tp['authentication']['mode'] = 'radius' rsrvs = c.list_nodes('authentication radius server') for rsrv in rsrvs: if c.return_value('authentication radius server ' + rsrv + ' fail-time') == None: @@ -160,7 +165,7 @@ def get_config(): reql = str(c.return_value( 'authentication radius server ' + rsrv + ' req-limit')) - config_data['authentication']['radiussrv'].update( + l2tp['authentication']['radiussrv'].update( { rsrv: { 'secret': c.return_value('authentication radius server ' + rsrv + ' key'), @@ -171,21 +176,21 @@ def get_config(): ) # Source ip address feature if c.exists('authentication radius source-address'): - config_data['authentication']['radius_source_address'] = c.return_value( + l2tp['authentication']['radius_source_address'] = c.return_value( 'authentication radius source-address') # advanced radius-setting if c.exists('authentication radius acct-timeout'): - config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value( + l2tp['authentication']['radiusopt']['acct-timeout'] = c.return_value( 'authentication radius acct-timeout') if c.exists('authentication radius max-try'): - config_data['authentication']['radiusopt']['max-try'] = c.return_value( + l2tp['authentication']['radiusopt']['max-try'] = c.return_value( 'authentication radius max-try') if c.exists('authentication radius timeout'): - config_data['authentication']['radiusopt']['timeout'] = c.return_value( + l2tp['authentication']['radiusopt']['timeout'] = c.return_value( 'authentication radius timeout') if c.exists('authentication radius nas-identifier'): - config_data['authentication']['radiusopt']['nas-id'] = c.return_value( + l2tp['authentication']['radiusopt']['nas-id'] = c.return_value( 'authentication radius nas-identifier') if c.exists('authentication radius dae-server'): # Set default dae-server port if not defined @@ -194,7 +199,7 @@ def get_config(): 'authentication radius dae-server port') else: dae_server_port = "3799" - config_data['authentication']['radiusopt'].update( + l2tp['authentication']['radiusopt'].update( { 'dae-srv': { 'ip-addr': c.return_value('authentication radius dae-server ip-address'), @@ -207,75 +212,75 @@ def get_config(): # set here as default for visibility which may change in the future if c.exists('authentication radius rate-limit enable'): if not c.exists('authentication radius rate-limit attribute'): - config_data['authentication']['radiusopt']['shaper'] = { + l2tp['authentication']['radiusopt']['shaper'] = { 'attr': 'Filter-Id' } else: - config_data['authentication']['radiusopt']['shaper'] = { + l2tp['authentication']['radiusopt']['shaper'] = { 'attr': c.return_value('authentication radius rate-limit attribute') } if c.exists('authentication radius rate-limit vendor'): - config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( + l2tp['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( 'authentication radius rate-limit vendor') if c.exists('client-ip-pool'): if c.exists('client-ip-pool start') and c.exists('client-ip-pool stop'): - config_data['client_ip_pool'] = c.return_value( + l2tp['client_ip_pool'] = c.return_value( 'client-ip-pool start') + '-' + re.search('[0-9]+$', c.return_value('client-ip-pool stop')).group(0) if c.exists('client-ip-pool subnet'): - config_data['client_ip_subnets'] = c.return_values( + l2tp['client_ip_subnets'] = c.return_values( 'client-ip-pool subnet') if c.exists('client-ipv6-pool prefix'): - config_data['client_ipv6_pool']['prefix'] = c.return_values( + l2tp['client_ipv6_pool']['prefix'] = c.return_values( 'client-ipv6-pool prefix') - config_data['ip6_column'] = 'ip6,' + l2tp['ip6_column'] = 'ip6,' if c.exists('client-ipv6-pool delegate-prefix'): - config_data['client_ipv6_pool']['delegate_prefix'] = c.return_values( + l2tp['client_ipv6_pool']['delegate_prefix'] = c.return_values( 'client-ipv6-pool delegate-prefix') - config_data['ip6_dp_column'] = 'ip6-dp,' + l2tp['ip6_dp_column'] = 'ip6-dp,' if c.exists('mtu'): - config_data['mtu'] = c.return_value('mtu') + l2tp['mtu'] = c.return_value('mtu') # gateway address if c.exists('gateway-address'): - config_data['gateway_address'] = c.return_value('gateway-address') + l2tp['gateway_address'] = c.return_value('gateway-address') else: # calculate gw-ip-address if c.exists('client-ip-pool start'): # use start ip as gw-ip-address - config_data['gateway_address'] = c.return_value( + l2tp['gateway_address'] = c.return_value( 'client-ip-pool start') elif c.exists('client-ip-pool subnet'): # use first ip address from first defined pool lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", c.return_values( 'client-ip-pool subnet')[0]) - config_data['gateway_address'] = lst_ip[0] + l2tp['gateway_address'] = lst_ip[0] if c.exists('authentication require'): auth_mods = {'pap': 'pap', 'chap': 'auth_chap_md5', 'mschap': 'auth_mschap_v1', 'mschap-v2': 'auth_mschap_v2'} for proto in c.return_values('authentication require'): - config_data['authentication']['auth_proto'].append( + l2tp['authentication']['auth_proto'].append( auth_mods[proto]) else: - config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] + l2tp['authentication']['auth_proto'] = ['auth_mschap_v2'] if c.exists('authentication mppe'): - config_data['authentication']['mppe'] = c.return_value( + l2tp['authentication']['mppe'] = c.return_value( 'authentication mppe') if c.exists('idle'): - config_data['idle_timeout'] = c.return_value('idle') + l2tp['idle_timeout'] = c.return_value('idle') # LNS secret if c.exists('lns shared-secret'): - config_data['lns_shared_secret'] = c.return_value('lns shared-secret') + l2tp['lns_shared_secret'] = c.return_value('lns shared-secret') if c.exists('ccp-disable'): - config_data['ccp_disable'] = True + l2tp['ccp_disable'] = True # ppp_options ppp_options = {} @@ -288,53 +293,53 @@ def get_config(): 'ppp-options lcp-echo-interval') if len(ppp_options) != 0: - config_data['ppp_options'] = ppp_options + l2tp['ppp_options'] = ppp_options - return config_data + return l2tp -def verify(c): - if c == None: +def verify(l2tp): + if l2tp == None: return None - if c['authentication']['mode'] == 'local': - if not c['authentication']['local-users']: + if l2tp['authentication']['mode'] == 'local': + if not l2tp['authentication']['local-users']: raise ConfigError( 'l2tp-server authentication local-users required') - for usr in c['authentication']['local-users']: - if not c['authentication']['local-users'][usr]['passwd']: + for usr in l2tp['authentication']['local-users']: + if not l2tp['authentication']['local-users'][usr]['passwd']: raise ConfigError('user ' + usr + ' requires a password') - if c['authentication']['mode'] == 'radius': - if len(c['authentication']['radiussrv']) == 0: + if l2tp['authentication']['mode'] == 'radius': + if len(l2tp['authentication']['radiussrv']) == 0: raise ConfigError('radius server required') - for rsrv in c['authentication']['radiussrv']: - if c['authentication']['radiussrv'][rsrv]['secret'] == None: + for rsrv in l2tp['authentication']['radiussrv']: + if l2tp['authentication']['radiussrv'][rsrv]['secret'] == None: raise ConfigError('radius server ' + rsrv + ' needs a secret configured') # check for the existence of a client ip pool - if not c['client_ip_pool'] and not c['client_ip_subnets']: + if not l2tp['client_ip_pool'] and not l2tp['client_ip_subnets']: raise ConfigError( "set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool") # check ipv6 - if 'delegate_prefix' in c['client_ipv6_pool'] and not 'prefix' in c['client_ipv6_pool']: + if 'delegate_prefix' in l2tp['client_ipv6_pool'] and not 'prefix' in l2tp['client_ipv6_pool']: raise ConfigError( "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") - if len(c['wins']) > 2: + if len(l2tp['wins']) > 2: raise ConfigError('Not more then two IPv4 WINS name-servers can be configured') - if len(c['dnsv4']) > 2: + if len(l2tp['dnsv4']) > 2: raise ConfigError('Not more then two IPv4 DNS name-servers can be configured') - if len(c['dnsv6']) > 3: + if len(l2tp['dnsv6']) > 3: raise ConfigError('Not more then three IPv6 DNS name-servers can be configured') -def generate(c): - if c == None: +def generate(l2tp): + if l2tp == None: return None # Prepare Jinja2 template loader from files @@ -342,23 +347,11 @@ def generate(c): fs_loader = FileSystemLoader(tmpl_path) env = Environment(loader=fs_loader, trim_blocks=True) - # accel-cmd reload doesn't work so any change results in a restart of the daemon - try: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - except KeyError: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - tmpl = env.get_template('l2tp.config.tmpl') config_text = tmpl.render(c) open(l2tp_conf, 'w').write(config_text) - if c['authentication']['local-users']: + if l2tp['authentication']['local-users']: tmpl = env.get_template('chap-secrets.tmpl') chap_secrets_txt = tmpl.render(c) old_umask = os.umask(0o077) -- cgit v1.2.3 From 53932650928688188aa8a5b122293165959f426f Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 23:21:16 +0200 Subject: vpn: sstp: T2008: improve error message for non existent local-users --- src/conf_mode/vpn_sstp.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 8bafa0e61..95bf12bb5 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -282,7 +282,7 @@ def verify(sstp): # vertify auth settings if sstp['auth_mode'] == 'local': if not sstp['local_users']: - raise ConfigError('sstp-server authentication local-users required') + raise ConfigError('SSTP local auth mode requires local users to be configured!') for user in sstp['local_users']: if not user['password']: -- cgit v1.2.3 From 762d36d5b71d600e5f286a4f06c806a2e016ae7a Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 23:22:17 +0200 Subject: vpn: l2tp: T2264: migrate to new dictionary keys for local auth --- data/templates/l2tp/chap-secrets.tmpl | 12 +- data/templates/l2tp/l2tp.config.tmpl | 10 +- src/conf_mode/vpn_l2tp.py | 271 ++++++++++++++++++---------------- 3 files changed, 156 insertions(+), 137 deletions(-) (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/chap-secrets.tmpl b/data/templates/l2tp/chap-secrets.tmpl index 0db295fdc..dd00d7bd0 100644 --- a/data/templates/l2tp/chap-secrets.tmpl +++ b/data/templates/l2tp/chap-secrets.tmpl @@ -1,10 +1,10 @@ -# username server password acceptable local IP addresses shaper -{% for user in authentication['local-users'] %} -{% if authentication['local-users'][user]['state'] == 'enabled' %} -{% if authentication['local-users'][user]['upload'] and authentication['local-users'][user]['download'] %} -{{ "%-12s" | format(user) }} * {{ "%-16s" | format(authentication['local-users'][user]['passwd']) }} {{ "%-16s" | format(authentication['local-users'][user]['ip']) }} {{ authentication['local-users'][user]['download'] }} / {{ authentication['local-users'][user]['upload'] }} +# username server password acceptable local IP addresses shaper +{% for user in local_users %} +{% if user.state == 'enabled' %} +{% if user.upload and user.download %} +{{ "%-12s" | format(user.name) }} * {{ "%-16s" | format(user.password) }} {{ "%-16s" | format(user.ip) }} {{ user.download }} / {{ user.upload }} {% else %} -{{ "%-12s" | format(user) }} * {{ "%-16s" | format(authentication['local-users'][user]['passwd']) }} {{ "%-16s" | format(authentication['local-users'][user]['ip']) }} +{{ "%-12s" | format(user.name) }} * {{ "%-16s" | format(user.password) }} {{ "%-16s" | format(user.ip) }} {% endif %} {% endif %} {% endfor %} diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index 7e15233bb..cce526dd8 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -3,12 +3,14 @@ log_syslog l2tp chap-secrets -{% for proto in authentication['auth_proto']: %} +{% for proto in auth_proto: %} {{proto}} {% endfor%} -{% if authentication['mode'] == 'radius' %} + +{% if auth_mode == 'radius' %} radius {% endif -%} + ippool shaper ipv6pool @@ -74,7 +76,7 @@ secret={{lns_shared_secret}} gw-ip-address={{gateway_address}} {% endif %} -{% if authentication['mode'] == 'local' %} +{% if auth_mode == 'local' %} [chap-secrets] chap-secrets=/etc/accel-ppp/l2tp/chap-secrets {% if gateway_address %} @@ -106,7 +108,7 @@ ccp=0 ipv6=allow {% endif %} -{% if authentication['mode'] == 'radius' %} +{% if auth_mode == 'radius' %} [radius] {% for rsrv in authentication['radiussrv']: %} server={{rsrv}},{{authentication['radiussrv'][rsrv]['secret']}},\ diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 8f493ddaf..4cd28e0fe 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -43,14 +43,14 @@ if not os.path.exists(l2tp_cnf_dir): default_config_data = { 'authentication': { - 'mode': 'local', - 'local-users': { - }, 'radiussrv': {}, 'radiusopt': {}, - 'auth_proto': [], 'mppe': 'prefer' }, + 'auth_proto' : [], + 'local_users' : [], + 'auth_mode' : 'local', + 'radius_server' : [], 'outside_addr': '', 'gateway_address': '10.255.255.0', 'dnsv4': [], @@ -91,12 +91,12 @@ def _accel_cmd(command): def get_config(): - c = Config() - base = ['vpn', 'l2tp', 'remote-access'] - if not c.exists(base): + conf = Config() + base_path = ['vpn', 'l2tp', 'remote-access'] + if not conf.exists(base_path): return None - c.set_level(base) + conf.set_level(base_path) l2tp = deepcopy(default_config_data) cpu = os.cpu_count() @@ -104,197 +104,210 @@ def get_config(): l2tp['thread_cnt'] = int(cpu/2) ### general options ### - if c.exists(['name-server']): - for name_server in c.return_values(['name-server']): + if conf.exists(['name-server']): + for name_server in conf.return_values(['name-server']): if is_ipv4(name_server): l2tp['dnsv4'].append(name_server) else: l2tp['dnsv6'].append(name_server) - if c.exists(['wins-server']): - l2tp['wins'] = c.return_values(['wins-server']) - - if c.exists('outside-address'): - l2tp['outside_addr'] = c.return_value('outside-address') - - # auth local - if c.exists('authentication mode local'): - if c.exists('authentication local-users username'): - for usr in c.list_nodes('authentication local-users username'): - l2tp['authentication']['local-users'].update( - { - usr: { - 'passwd': '', - 'state': 'enabled', - 'ip': '*', - 'upload': None, - 'download': None - } - } - ) - - if c.exists('authentication local-users username ' + usr + ' password'): - l2tp['authentication']['local-users'][usr]['passwd'] = c.return_value( - 'authentication local-users username ' + usr + ' password') - if c.exists('authentication local-users username ' + usr + ' disable'): - l2tp['authentication']['local-users'][usr]['state'] = 'disable' - if c.exists('authentication local-users username ' + usr + ' static-ip'): - l2tp['authentication']['local-users'][usr]['ip'] = c.return_value( - 'authentication local-users username ' + usr + ' static-ip') - if c.exists('authentication local-users username ' + usr + ' rate-limit download'): - l2tp['authentication']['local-users'][usr]['download'] = c.return_value( - 'authentication local-users username ' + usr + ' rate-limit download') - if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): - l2tp['authentication']['local-users'][usr]['upload'] = c.return_value( - 'authentication local-users username ' + usr + ' rate-limit upload') + if conf.exists(['wins-server']): + l2tp['wins'] = conf.return_values(['wins-server']) - # authentication mode radius servers and settings + if conf.exists('outside-address'): + l2tp['outside_addr'] = conf.return_value('outside-address') + + if conf.exists(['authentication', 'mode']): + l2tp['auth_mode'] = conf.return_value(['authentication', 'mode']) + + # + # local auth + if conf.exists(['authentication', 'local-users']): + for username in conf.list_nodes(['authentication', 'local-users', 'username']): + user = { + 'name' : username, + 'password' : '', + 'state' : 'enabled', + 'ip' : '*', + 'upload' : None, + 'download' : None + } + + conf.set_level(base_path + ['authentication', 'local-users', 'username', username]) + + if conf.exists(['password']): + user['password'] = conf.return_value(['password']) + + if conf.exists(['disable']): + user['state'] = 'disable' + + if conf.exists(['static-ip']): + user['ip'] = conf.return_value(['static-ip']) + + if conf.exists(['rate-limit', 'download']): + user['download'] = conf.return_value(['rate-limit', 'download']) - if c.exists('authentication mode radius'): - l2tp['authentication']['mode'] = 'radius' - rsrvs = c.list_nodes('authentication radius server') + if conf.exists(['rate-limit', 'upload']): + user['upload'] = conf.return_value(['rate-limit', 'upload']) + + l2tp['local_users'].append(user) + + conf.set_level(base_path) + # authentication mode radius servers and settings + if conf.exists('authentication mode radius'): + rsrvs = conf.list_nodes('authentication radius server') for rsrv in rsrvs: - if c.return_value('authentication radius server ' + rsrv + ' fail-time') == None: + if conf.return_value('authentication radius server ' + rsrv + ' fail-time') == None: ftime = '0' else: - ftime = str(c.return_value( + ftime = str(conf.return_value( 'authentication radius server ' + rsrv + ' fail-time')) - if c.return_value('authentication radius-server ' + rsrv + ' req-limit') == None: + if conf.return_value('authentication radius-server ' + rsrv + ' req-limit') == None: reql = '0' else: - reql = str(c.return_value( + reql = str(conf.return_value( 'authentication radius server ' + rsrv + ' req-limit')) l2tp['authentication']['radiussrv'].update( { rsrv: { - 'secret': c.return_value('authentication radius server ' + rsrv + ' key'), + 'secret': conf.return_value('authentication radius server ' + rsrv + ' key'), 'fail-time': ftime, 'req-limit': reql } } ) # Source ip address feature - if c.exists('authentication radius source-address'): - l2tp['authentication']['radius_source_address'] = c.return_value( + if conf.exists('authentication radius source-address'): + l2tp['authentication']['radius_source_address'] = conf.return_value( 'authentication radius source-address') # advanced radius-setting - if c.exists('authentication radius acct-timeout'): - l2tp['authentication']['radiusopt']['acct-timeout'] = c.return_value( + if conf.exists('authentication radius acct-timeout'): + l2tp['authentication']['radiusopt']['acct-timeout'] = conf.return_value( 'authentication radius acct-timeout') - if c.exists('authentication radius max-try'): - l2tp['authentication']['radiusopt']['max-try'] = c.return_value( + if conf.exists('authentication radius max-try'): + l2tp['authentication']['radiusopt']['max-try'] = conf.return_value( 'authentication radius max-try') - if c.exists('authentication radius timeout'): - l2tp['authentication']['radiusopt']['timeout'] = c.return_value( + if conf.exists('authentication radius timeout'): + l2tp['authentication']['radiusopt']['timeout'] = conf.return_value( 'authentication radius timeout') - if c.exists('authentication radius nas-identifier'): - l2tp['authentication']['radiusopt']['nas-id'] = c.return_value( + if conf.exists('authentication radius nas-identifier'): + l2tp['authentication']['radiusopt']['nas-id'] = conf.return_value( 'authentication radius nas-identifier') - if c.exists('authentication radius dae-server'): + if conf.exists('authentication radius dae-server'): # Set default dae-server port if not defined - if c.exists('authentication radius dae-server port'): - dae_server_port = c.return_value( + if conf.exists('authentication radius dae-server port'): + dae_server_port = conf.return_value( 'authentication radius dae-server port') else: dae_server_port = "3799" l2tp['authentication']['radiusopt'].update( { 'dae-srv': { - 'ip-addr': c.return_value('authentication radius dae-server ip-address'), + 'ip-addr': conf.return_value('authentication radius dae-server ip-address'), 'port': dae_server_port, - 'secret': str(c.return_value('authentication radius dae-server secret')) + 'secret': str(conf.return_value('authentication radius dae-server secret')) } } ) # filter-id is the internal accel default if attribute is empty # set here as default for visibility which may change in the future - if c.exists('authentication radius rate-limit enable'): - if not c.exists('authentication radius rate-limit attribute'): + if conf.exists('authentication radius rate-limit enable'): + if not conf.exists('authentication radius rate-limit attribute'): l2tp['authentication']['radiusopt']['shaper'] = { 'attr': 'Filter-Id' } else: l2tp['authentication']['radiusopt']['shaper'] = { - 'attr': c.return_value('authentication radius rate-limit attribute') + 'attr': conf.return_value('authentication radius rate-limit attribute') } - if c.exists('authentication radius rate-limit vendor'): - l2tp['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( + if conf.exists('authentication radius rate-limit vendor'): + l2tp['authentication']['radiusopt']['shaper']['vendor'] = conf.return_value( 'authentication radius rate-limit vendor') - if c.exists('client-ip-pool'): - if c.exists('client-ip-pool start') and c.exists('client-ip-pool stop'): - l2tp['client_ip_pool'] = c.return_value( - 'client-ip-pool start') + '-' + re.search('[0-9]+$', c.return_value('client-ip-pool stop')).group(0) + if conf.exists('client-ip-pool'): + if conf.exists('client-ip-pool start') and conf.exists('client-ip-pool stop'): + l2tp['client_ip_pool'] = conf.return_value( + 'client-ip-pool start') + '-' + re.search('[0-9]+$', conf.return_value('client-ip-pool stop')).group(0) - if c.exists('client-ip-pool subnet'): - l2tp['client_ip_subnets'] = c.return_values( + if conf.exists('client-ip-pool subnet'): + l2tp['client_ip_subnets'] = conf.return_values( 'client-ip-pool subnet') - if c.exists('client-ipv6-pool prefix'): - l2tp['client_ipv6_pool']['prefix'] = c.return_values( + if conf.exists('client-ipv6-pool prefix'): + l2tp['client_ipv6_pool']['prefix'] = conf.return_values( 'client-ipv6-pool prefix') l2tp['ip6_column'] = 'ip6,' - if c.exists('client-ipv6-pool delegate-prefix'): - l2tp['client_ipv6_pool']['delegate_prefix'] = c.return_values( + if conf.exists('client-ipv6-pool delegate-prefix'): + l2tp['client_ipv6_pool']['delegate_prefix'] = conf.return_values( 'client-ipv6-pool delegate-prefix') l2tp['ip6_dp_column'] = 'ip6-dp,' - if c.exists('mtu'): - l2tp['mtu'] = c.return_value('mtu') + if conf.exists('mtu'): + l2tp['mtu'] = conf.return_value('mtu') # gateway address - if c.exists('gateway-address'): - l2tp['gateway_address'] = c.return_value('gateway-address') + if conf.exists('gateway-address'): + l2tp['gateway_address'] = conf.return_value('gateway-address') else: # calculate gw-ip-address - if c.exists('client-ip-pool start'): + if conf.exists('client-ip-pool start'): # use start ip as gw-ip-address - l2tp['gateway_address'] = c.return_value( + l2tp['gateway_address'] = conf.return_value( 'client-ip-pool start') - elif c.exists('client-ip-pool subnet'): + elif conf.exists('client-ip-pool subnet'): # use first ip address from first defined pool - lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", c.return_values( + lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", conf.return_values( 'client-ip-pool subnet')[0]) l2tp['gateway_address'] = lst_ip[0] - if c.exists('authentication require'): - auth_mods = {'pap': 'pap', 'chap': 'auth_chap_md5', - 'mschap': 'auth_mschap_v1', 'mschap-v2': 'auth_mschap_v2'} - for proto in c.return_values('authentication require'): - l2tp['authentication']['auth_proto'].append( - auth_mods[proto]) + # + # authentication protocols + conf.set_level(base_path + ['authentication']) + if conf.exists(['protocols']): + auth_mods = { + 'pap': 'auth_pap', + 'chap': 'auth_chap_md5', + 'mschap': 'auth_mschap_v1', + 'mschap-v2': 'auth_mschap_v2' + } + + for proto in conf.return_values(['protocols']): + l2tp['auth_proto'].append(auth_mods[proto]) + else: - l2tp['authentication']['auth_proto'] = ['auth_mschap_v2'] + l2tp['auth_proto'] = ['auth_mschap_v2'] - if c.exists('authentication mppe'): - l2tp['authentication']['mppe'] = c.return_value( + if conf.exists('authentication mppe'): + l2tp['authentication']['mppe'] = conf.return_value( 'authentication mppe') - if c.exists('idle'): - l2tp['idle_timeout'] = c.return_value('idle') + if conf.exists('idle'): + l2tp['idle_timeout'] = conf.return_value('idle') # LNS secret - if c.exists('lns shared-secret'): - l2tp['lns_shared_secret'] = c.return_value('lns shared-secret') + if conf.exists('lns shared-secret'): + l2tp['lns_shared_secret'] = conf.return_value('lns shared-secret') - if c.exists('ccp-disable'): + if conf.exists('ccp-disable'): l2tp['ccp_disable'] = True # ppp_options ppp_options = {} - if c.exists('ppp-options'): - if c.exists('ppp-options lcp-echo-failure'): - ppp_options['lcp-echo-failure'] = c.return_value( + if conf.exists('ppp-options'): + if conf.exists('ppp-options lcp-echo-failure'): + ppp_options['lcp-echo-failure'] = conf.return_value( 'ppp-options lcp-echo-failure') - if c.exists('ppp-options lcp-echo-interval'): - ppp_options['lcp-echo-interval'] = c.return_value( + if conf.exists('ppp-options lcp-echo-interval'): + ppp_options['lcp-echo-interval'] = conf.return_value( 'ppp-options lcp-echo-interval') if len(ppp_options) != 0: l2tp['ppp_options'] = ppp_options + import pprint + pprint.pprint(l2tp) return l2tp @@ -302,24 +315,25 @@ def verify(l2tp): if l2tp == None: return None - if l2tp['authentication']['mode'] == 'local': - if not l2tp['authentication']['local-users']: - raise ConfigError( - 'l2tp-server authentication local-users required') - for usr in l2tp['authentication']['local-users']: - if not l2tp['authentication']['local-users'][usr]['passwd']: - raise ConfigError('user ' + usr + ' requires a password') + if l2tp['auth_mode'] == 'local': + if not l2tp['local_users']: + raise ConfigError('L2TP local auth mode requires local users to be configured!') - if l2tp['authentication']['mode'] == 'radius': + for user in l2tp['local_users']: + if not user['password']: + raise ConfigError(f"Password required for user {user['name']}") + + elif l2tp['auth_mode'] == 'radius': if len(l2tp['authentication']['radiussrv']) == 0: raise ConfigError('radius server required') + for rsrv in l2tp['authentication']['radiussrv']: if l2tp['authentication']['radiussrv'][rsrv]['secret'] == None: raise ConfigError('radius server ' + rsrv + ' needs a secret configured') # check for the existence of a client ip pool - if not l2tp['client_ip_pool'] and not l2tp['client_ip_subnets']: + if not (l2tp['client_ip_pool'] or l2tp['client_ip_subnets']): raise ConfigError( "set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool") @@ -337,6 +351,8 @@ def verify(l2tp): if len(l2tp['dnsv6']) > 3: raise ConfigError('Not more then three IPv6 DNS name-servers can be configured') + return None + def generate(l2tp): if l2tp == None: @@ -351,18 +367,19 @@ def generate(l2tp): config_text = tmpl.render(c) open(l2tp_conf, 'w').write(config_text) - if l2tp['authentication']['local-users']: + if l2tp['auth_mode'] == 'local': tmpl = env.get_template('chap-secrets.tmpl') - chap_secrets_txt = tmpl.render(c) + chap_secrets_txt = tmpl.render(l2tp) old_umask = os.umask(0o077) - open(chap_secrets, 'w').write(chap_secrets_txt) + with open(chap_secrets, 'w') as f: + f.write(chap_secrets_txt) os.umask(old_umask) - return c + return None -def apply(c): - if c == None: +def apply(l2tp): + if l2tp == None: if os.path.exists(pidfile): _accel_cmd('shutdown hard') if os.path.exists(pidfile): -- cgit v1.2.3 From 0dd75963e82d6f20007d523bbd8a0bbe324f1e7f Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 23:25:29 +0200 Subject: vpn: l2tp: T2264: use "with open()" when writing config --- src/conf_mode/vpn_l2tp.py | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 4cd28e0fe..b357be1ed 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -36,11 +36,6 @@ chap_secrets = l2tp_cnf_dir + '/chap-secrets' l2tp_conf = l2tp_cnf_dir + '/l2tp.config' -# config path creation -if not os.path.exists(l2tp_cnf_dir): - os.makedirs(l2tp_cnf_dir) - - default_config_data = { 'authentication': { 'radiussrv': {}, @@ -358,6 +353,9 @@ def generate(l2tp): if l2tp == None: return None + if not os.path.exists(l2tp_cnf_dir): + os.makedirs(l2tp_cnf_dir) + # Prepare Jinja2 template loader from files tmpl_path = os.path.join(vyos_data_dir['data'], 'templates', 'l2tp') fs_loader = FileSystemLoader(tmpl_path) @@ -365,15 +363,14 @@ def generate(l2tp): tmpl = env.get_template('l2tp.config.tmpl') config_text = tmpl.render(c) - open(l2tp_conf, 'w').write(config_text) + with open(l2tp_conf, 'w') as f: + f.write(config_text) if l2tp['auth_mode'] == 'local': tmpl = env.get_template('chap-secrets.tmpl') - chap_secrets_txt = tmpl.render(l2tp) - old_umask = os.umask(0o077) + config_text = tmpl.render(l2tp) with open(chap_secrets, 'w') as f: - f.write(chap_secrets_txt) - os.umask(old_umask) + f.write(config_text) return None -- cgit v1.2.3 From 02b4c640c8c02124ee8c1c1ee4da82c3367f20d0 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 10 Apr 2020 23:42:18 +0200 Subject: vpn: sstp: T2008: set accell default values in config dict This will remove the required if/else parts int he Jinja2 template. --- src/conf_mode/vpn_sstp.py | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 95bf12bb5..6a574dabb 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -60,7 +60,7 @@ def _accel_cmd(command): default_config_data = { 'local_users' : [], 'auth_mode' : 'local', - 'auth_proto' : [], + 'auth_proto' : ['auth_mschap_v2'], 'radius_server' : [], 'radius_acct_tmo' : '3', 'radius_max_try' : '3', @@ -77,7 +77,7 @@ default_config_data = { 'client_ip_pool' : [], 'dnsv4' : [], 'mtu' : '', - 'ppp_mppe' : '', + 'ppp_mppe' : 'prefer', 'ppp_echo_failure' : '', 'ppp_echo_interval' : '', 'ppp_echo_timeout' : '', @@ -223,9 +223,6 @@ def get_config(): for proto in conf.return_values(['protocols']): sstp['auth_proto'].append(auth_mods[proto]) - else: - sstp['auth_proto'] = ['auth_mschap_v2'] - # # read in SSL certs conf.set_level(base_path + ['ssl']) @@ -261,7 +258,7 @@ def get_config(): # read in PPP stuff conf.set_level(base_path + ['ppp-settings']) if conf.exists('mppe'): - sstp['ppp_mppe'] = conf.return_value('ppp-settings mppe') + sstp['ppp_mppe'] = conf.return_value(['ppp-settings', 'mppe']) if conf.exists(['lcp-echo-failure']): sstp['ppp_echo_failure'] = conf.return_value(['lcp-echo-failure']) -- cgit v1.2.3 From 033062f56be9d531b1911e7d7516d7986aa68b46 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 00:21:43 +0200 Subject: vpn: l2tp: T2264: migrate to new dictionary keys for radius auth --- data/templates/l2tp/l2tp.config.tmpl | 78 +++++----- src/conf_mode/vpn_l2tp.py | 276 ++++++++++++++++++----------------- 2 files changed, 177 insertions(+), 177 deletions(-) (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index cce526dd8..6ebbf1241 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -49,22 +49,22 @@ wins{{ loop.index }}={{ server }} [l2tp] verbose=1 ifname=l2tp%d -ppp-max-mtu={{mtu}} -mppe={{authentication['mppe']}} +ppp-max-mtu={{ mtu }} +mppe={{ ppp_mppe }} {% if outside_addr %} -bind={{outside_addr}} +bind={{ outside_addr }} {% endif %} {% if lns_shared_secret %} -secret={{lns_shared_secret}} +secret={{ lns_shared_secret }} {% endif %} [client-ip-range] 0.0.0.0/0 -{% if (client_ip_pool) or (client_ip_subnets) %} +{% if client_ip_pool or client_ip_subnets %} [ip-pool] {% if client_ip_pool %} -{{client_ip_pool}} +{{ client_ip_pool }} {% endif -%} {% if client_ip_subnets %} {% for sn in client_ip_subnets %} @@ -73,17 +73,34 @@ secret={{lns_shared_secret}} {% endif %} {% endif %} {% if gateway_address %} -gw-ip-address={{gateway_address}} +gw-ip-address={{ gateway_address }} {% endif %} {% if auth_mode == 'local' %} [chap-secrets] -chap-secrets=/etc/accel-ppp/l2tp/chap-secrets -{% if gateway_address %} -gw-ip-address={{gateway_address}} -{% endif %} +chap-secrets={{ chap_secrets_file }} +{% elif auth_mode == 'radius' %} +[radius] +verbose=1 +{% for r in radius_server %} +server={{ r.server }},{{ r.key }},auth-port={{ r.port }},req-limit=0,fail-time={{ r.fail_time }} +{% endfor -%} {% endif %} +acct-timeout={{ radius_acct_tmo }} +timeout={{ radius_timeout }} +max-try={{ radius_max_try }} + +{% if radius_nas_id %} +nas-identifier={{ radius_nas_id }} +{% endif -%} +{% if radius_nas_ip %} +nas-ip-address={{ radius_nas_ip }} +{% endif -%} +{% if radius_source_address %} +bind={{ radius_source_address }} +{% endif -%} + [ppp] verbose=1 check-ip=1 @@ -108,36 +125,7 @@ ccp=0 ipv6=allow {% endif %} -{% if auth_mode == 'radius' %} -[radius] -{% for rsrv in authentication['radiussrv']: %} -server={{rsrv}},{{authentication['radiussrv'][rsrv]['secret']}},\ -req-limit={{authentication['radiussrv'][rsrv]['req-limit']}},\ -fail-time={{authentication['radiussrv'][rsrv]['fail-time']}} -{% endfor %} -{% if authentication['radiusopt']['timeout'] %} -timeout={{authentication['radiusopt']['timeout']}} -{% endif %} -{% if authentication['radiusopt']['acct-timeout'] %} -acct-timeout={{authentication['radiusopt']['acct-timeout']}} -{% endif %} -{% if authentication['radiusopt']['max-try'] %} -max-try={{authentication['radiusopt']['max-try']}} -{% endif %} -{% if authentication['radiusopt']['nas-id'] %} -nas-identifier={{authentication['radiusopt']['nas-id']}} -{% endif %} -{% if authentication['radius_source_address'] %} -nas-ip-address={{authentication['radius_source_address']}} -{% endif -%} -{% if authentication['radiusopt']['dae-srv'] %} -dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\ -{{authentication['radiusopt']['dae-srv']['port']}},\ -{{authentication['radiusopt']['dae-srv']['secret']}} -{% endif -%} -gw-ip-address={{gateway_address}} -verbose=1 -{% endif -%} + {% if client_ipv6_pool %} [ipv6-pool] @@ -154,12 +142,12 @@ delegate={{prfx}} verbose=1 {% endif %} -{% if authentication['radiusopt']['shaper'] %} +{% if radius_shaper_attr %} [shaper] verbose=1 -attr={{authentication['radiusopt']['shaper']['attr']}} -{% if authentication['radiusopt']['shaper']['vendor'] %} -vendor={{authentication['radiusopt']['shaper']['vendor']}} +attr={{ radius_shaper_attr }} +{% if radius_shaper_vendor %} +vendor={{ radius_shaper_vendor }} {% endif -%} {% endif %} diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index b357be1ed..1058eeac6 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -19,6 +19,7 @@ import re from copy import deepcopy from socket import AF_INET, SOCK_STREAM, socket +from stat import S_IRUSR, S_IWUSR, S_IRGRP from sys import exit from time import sleep @@ -30,31 +31,36 @@ from vyos.util import run from vyos.validate import is_ipv4 from vyos import ConfigError -pidfile = r'/var/run/accel_l2tp.pid' -l2tp_cnf_dir = r'/etc/accel-ppp/l2tp' -chap_secrets = l2tp_cnf_dir + '/chap-secrets' -l2tp_conf = l2tp_cnf_dir + '/l2tp.config' - +pidfile = '/var/run/accel_l2tp.pid' +l2tp_conf = '/etc/accel-ppp/l2tp/l2tp.config' +l2tp_chap_secrets = '/etc/accel-ppp/l2tp/chap-secrets' default_config_data = { - 'authentication': { - 'radiussrv': {}, - 'radiusopt': {}, - 'mppe': 'prefer' - }, - 'auth_proto' : [], - 'local_users' : [], - 'auth_mode' : 'local', - 'radius_server' : [], - 'outside_addr': '', - 'gateway_address': '10.255.255.0', - 'dnsv4': [], - 'dnsv6': [], - 'wins': [], + 'auth_mode': 'local', + 'auth_ppp_mppe': 'prefer', + 'auth_proto': ['auth_mschap_v2'], + 'chap_secrets_file': l2tp_chap_secrets, 'client_ip_pool': None, 'client_ip_subnets': [], 'client_ipv6_pool': {}, + 'dnsv4': [], + 'dnsv6': [], + 'gateway_address': '10.255.255.0', + 'local_users' : [], 'mtu': '1436', + 'outside_addr': '', + 'ppp_mppe': 'prefer', + 'radius_server': [], + 'radius_acct_tmo': '3', + 'radius_max_try': '3', + 'radius_timeout': '3', + 'radius_nas_id': '', + 'radius_nas_ip': '', + 'radius_source_address': '', + 'radius_shaper_attr': '', + 'radius_shaper_vendor': '', + 'radius_dynamic_author': '', + 'wins': [], 'ip6_column': '', 'ip6_dp_column': '', 'ppp_options': {}, @@ -115,6 +121,20 @@ def get_config(): if conf.exists(['authentication', 'mode']): l2tp['auth_mode'] = conf.return_value(['authentication', 'mode']) + if conf.exists(['authentication', 'protocols']): + auth_mods = { + 'pap': 'auth_pap', + 'chap': 'auth_chap_md5', + 'mschap': 'auth_mschap_v1', + 'mschap-v2': 'auth_mschap_v2' + } + + for proto in conf.return_values(['authentication', 'protocols']): + l2tp['auth_proto'].append(auth_mods[proto]) + + if conf.exists(['authentication', 'mppe']): + l2tp['auth_ppp_mppe'] = conf.return_value(['authentication', 'mppe']) + # # local auth if conf.exists(['authentication', 'local-users']): @@ -147,93 +167,98 @@ def get_config(): l2tp['local_users'].append(user) - conf.set_level(base_path) - # authentication mode radius servers and settings - if conf.exists('authentication mode radius'): - rsrvs = conf.list_nodes('authentication radius server') - for rsrv in rsrvs: - if conf.return_value('authentication radius server ' + rsrv + ' fail-time') == None: - ftime = '0' - else: - ftime = str(conf.return_value( - 'authentication radius server ' + rsrv + ' fail-time')) - if conf.return_value('authentication radius-server ' + rsrv + ' req-limit') == None: - reql = '0' - else: - reql = str(conf.return_value( - 'authentication radius server ' + rsrv + ' req-limit')) - - l2tp['authentication']['radiussrv'].update( - { - rsrv: { - 'secret': conf.return_value('authentication radius server ' + rsrv + ' key'), - 'fail-time': ftime, - 'req-limit': reql - } - } - ) - # Source ip address feature - if conf.exists('authentication radius source-address'): - l2tp['authentication']['radius_source_address'] = conf.return_value( - 'authentication radius source-address') + # + # RADIUS auth and settings + conf.set_level(base_path + ['authentication', 'radius']) + if conf.exists(['server']): + for server in conf.list_nodes(['server']): + radius = { + 'server' : server, + 'key' : '', + 'fail_time' : 0, + 'port' : '1812' + } + + conf.set_level(base_path + ['authentication', 'radius', 'server', server]) + + if conf.exists(['fail-time']): + radius['fail-time'] = conf.return_value(['fail-time']) + + if conf.exists(['port']): + radius['port'] = conf.return_value(['port']) + + if conf.exists(['key']): + radius['key'] = conf.return_value(['key']) + if not conf.exists(['disable']): + l2tp['radius_server'].append(radius) + + # # advanced radius-setting - if conf.exists('authentication radius acct-timeout'): - l2tp['authentication']['radiusopt']['acct-timeout'] = conf.return_value( - 'authentication radius acct-timeout') - if conf.exists('authentication radius max-try'): - l2tp['authentication']['radiusopt']['max-try'] = conf.return_value( - 'authentication radius max-try') - if conf.exists('authentication radius timeout'): - l2tp['authentication']['radiusopt']['timeout'] = conf.return_value( - 'authentication radius timeout') - if conf.exists('authentication radius nas-identifier'): - l2tp['authentication']['radiusopt']['nas-id'] = conf.return_value( - 'authentication radius nas-identifier') - if conf.exists('authentication radius dae-server'): - # Set default dae-server port if not defined - if conf.exists('authentication radius dae-server port'): - dae_server_port = conf.return_value( - 'authentication radius dae-server port') - else: - dae_server_port = "3799" - l2tp['authentication']['radiusopt'].update( - { - 'dae-srv': { - 'ip-addr': conf.return_value('authentication radius dae-server ip-address'), - 'port': dae_server_port, - 'secret': str(conf.return_value('authentication radius dae-server secret')) - } - } - ) - # filter-id is the internal accel default if attribute is empty - # set here as default for visibility which may change in the future - if conf.exists('authentication radius rate-limit enable'): - if not conf.exists('authentication radius rate-limit attribute'): - l2tp['authentication']['radiusopt']['shaper'] = { - 'attr': 'Filter-Id' - } - else: - l2tp['authentication']['radiusopt']['shaper'] = { - 'attr': conf.return_value('authentication radius rate-limit attribute') - } - if conf.exists('authentication radius rate-limit vendor'): - l2tp['authentication']['radiusopt']['shaper']['vendor'] = conf.return_value( - 'authentication radius rate-limit vendor') - - if conf.exists('client-ip-pool'): - if conf.exists('client-ip-pool start') and conf.exists('client-ip-pool stop'): - l2tp['client_ip_pool'] = conf.return_value( - 'client-ip-pool start') + '-' + re.search('[0-9]+$', conf.return_value('client-ip-pool stop')).group(0) - - if conf.exists('client-ip-pool subnet'): - l2tp['client_ip_subnets'] = conf.return_values( - 'client-ip-pool subnet') - - if conf.exists('client-ipv6-pool prefix'): + conf.set_level(base_path + ['authentication', 'radius']) + + if conf.exists(['acct-timeout']): + l2tp['radius_acct_tmo'] = conf.return_value(['acct-timeout']) + + if conf.exists(['max-try']): + l2tp['radius_max_try'] = conf.return_value(['max-try']) + + if conf.exists(['timeout']): + l2tp['radius_timeout'] = conf.return_value(['timeout']) + + if conf.exists(['nas-identifier']): + l2tp['radius_nas_id'] = conf.return_value(['nas-identifier']) + + if conf.exists(['nas-ip-address']): + l2tp['radius_nas_ip'] = conf.return_value(['nas-ip-address']) + + if conf.exists(['source-address']): + l2tp['radius_source_address'] = conf.return_value(['source-address']) + + # Dynamic Authorization Extensions (DOA)/Change Of Authentication (COA) + if conf.exists(['dynamic-author']): + dae = { + 'port' : '', + 'server' : '', + 'key' : '' + } + + if conf.exists(['dynamic-author', 'server']): + dae['server'] = conf.return_value(['dynamic-author', 'server']) + + if conf.exists(['dynamic-author', 'port']): + dae['port'] = conf.return_value(['dynamic-author', 'port']) + + if conf.exists(['dynamic-author', 'key']): + dae['key'] = conf.return_value(['dynamic-author', 'key']) + + l2tp['radius_dynamic_author'] = dae + + if conf.exists(['rate-limit', 'enable']): + l2tp['radius_shaper_attr'] = 'Filter-Id' + c_attr = ['rate-limit', 'enable', 'attribute'] + if conf.exists(c_attr): + l2tp['radius_shaper_attr'] = conf.return_value(c_attr) + + c_vendor = ['rate-limit', 'enable', 'vendor'] + if conf.exists(c_vendor): + l2tp['radius_shaper_vendor'] = conf.return_value(c_vendor) + + conf.set_level(base_path) + if conf.exists(['client-ip-pool']): + if conf.exists(['client-ip-pool', 'start']) and conf.exists(['client-ip-pool', 'stop']): + start = conf.return_value(['client-ip-pool', 'start']) + stop = conf.return_value(['client-ip-pool', 'stop']) + l2tp['client_ip_pool'] = start + '-' + re.search('[0-9]+$', stop).group(0) + + if conf.exists(['client-ip-pool', 'subnet']): + l2tp['client_ip_subnets'] = conf.return_values(['client-ip-pool', 'subnet']) + + if conf.exists(['client-ipv6-pool', 'prefix']): l2tp['client_ipv6_pool']['prefix'] = conf.return_values( 'client-ipv6-pool prefix') l2tp['ip6_column'] = 'ip6,' + if conf.exists('client-ipv6-pool delegate-prefix'): l2tp['client_ipv6_pool']['delegate_prefix'] = conf.return_values( 'client-ipv6-pool delegate-prefix') @@ -257,26 +282,6 @@ def get_config(): 'client-ip-pool subnet')[0]) l2tp['gateway_address'] = lst_ip[0] - # - # authentication protocols - conf.set_level(base_path + ['authentication']) - if conf.exists(['protocols']): - auth_mods = { - 'pap': 'auth_pap', - 'chap': 'auth_chap_md5', - 'mschap': 'auth_mschap_v1', - 'mschap-v2': 'auth_mschap_v2' - } - - for proto in conf.return_values(['protocols']): - l2tp['auth_proto'].append(auth_mods[proto]) - - else: - l2tp['auth_proto'] = ['auth_mschap_v2'] - - if conf.exists('authentication mppe'): - l2tp['authentication']['mppe'] = conf.return_value( - 'authentication mppe') if conf.exists('idle'): l2tp['idle_timeout'] = conf.return_value('idle') @@ -319,13 +324,12 @@ def verify(l2tp): raise ConfigError(f"Password required for user {user['name']}") elif l2tp['auth_mode'] == 'radius': - if len(l2tp['authentication']['radiussrv']) == 0: - raise ConfigError('radius server required') + if len(l2tp['radius_server']) == 0: + raise ConfigError("RADIUS authentication requires at least one server") - for rsrv in l2tp['authentication']['radiussrv']: - if l2tp['authentication']['radiussrv'][rsrv]['secret'] == None: - raise ConfigError('radius server ' + rsrv + - ' needs a secret configured') + for radius in l2tp['radius_server']: + if not radius['key']: + raise ConfigError(f"Missing RADIUS secret for server {{ radius['key'] }}") # check for the existence of a client ip pool if not (l2tp['client_ip_pool'] or l2tp['client_ip_subnets']): @@ -350,11 +354,13 @@ def verify(l2tp): def generate(l2tp): - if l2tp == None: + if not l2tp: return None - if not os.path.exists(l2tp_cnf_dir): - os.makedirs(l2tp_cnf_dir) + # Create configuration directory if it's non existent + dirname = os.path.dirname(l2tp_conf) + if not os.path.isdir(dirname): + os.mkdir(dirname) # Prepare Jinja2 template loader from files tmpl_path = os.path.join(vyos_data_dir['data'], 'templates', 'l2tp') @@ -369,14 +375,20 @@ def generate(l2tp): if l2tp['auth_mode'] == 'local': tmpl = env.get_template('chap-secrets.tmpl') config_text = tmpl.render(l2tp) - with open(chap_secrets, 'w') as f: + with open(l2tp['chap_secrets_file'], 'w') as f: f.write(config_text) + os.chmod(l2tp['chap_secrets_file'], S_IRUSR | S_IWUSR | S_IRGRP) + + else: + if os.path.exists(l2tp['chap_secrets_file']): + os.unlink(l2tp['chap_secrets_file']) + return None def apply(l2tp): - if l2tp == None: + if not l2tp: if os.path.exists(pidfile): _accel_cmd('shutdown hard') if os.path.exists(pidfile): -- cgit v1.2.3 From 2928a338dee759d8635b87fc96abe090ebad80e5 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 00:48:09 +0200 Subject: vpn: l2tp: T2264: proper set PPP default values to ease Jinja2 template --- data/templates/l2tp/l2tp.config.tmpl | 16 +++------------ src/conf_mode/vpn_l2tp.py | 38 ++++++++++++++++-------------------- 2 files changed, 20 insertions(+), 34 deletions(-) (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index 6ebbf1241..f4746a6a1 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -105,19 +105,9 @@ bind={{ radius_source_address }} verbose=1 check-ip=1 single-session=replace -{% if idle_timeout %} -lcp-echo-timeout={{idle_timeout}} -{% endif %} -{% if ppp_options['lcp-echo-interval'] %} -lcp-echo-interval={{ppp_options['lcp-echo-interval']}} -{% else %} -lcp-echo-interval=30 -{% endif %} -{% if ppp_options['lcp-echo-failure'] %} -lcp-echo-failure={{ppp_options['lcp-echo-failure']}} -{% else %} -lcp-echo-failure=3 -{% endif %} +lcp-echo-timeout={{ ppp_echo_timeout }} +lcp-echo-interval={{ ppp_echo_interval }} +lcp-echo-failure={{ ppp_echo_failure }} {% if ccp_disable %} ccp=0 {% endif %} diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 1058eeac6..bb51b4573 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -50,6 +50,9 @@ default_config_data = { 'mtu': '1436', 'outside_addr': '', 'ppp_mppe': 'prefer', + 'ppp_echo_failure' : '3', + 'ppp_echo_interval' : '30', + 'ppp_echo_timeout': '0', 'radius_server': [], 'radius_acct_tmo': '3', 'radius_max_try': '3', @@ -282,29 +285,22 @@ def get_config(): 'client-ip-pool subnet')[0]) l2tp['gateway_address'] = lst_ip[0] + # LNS secret + if conf.exists(['lns', 'shared-secret']): + l2tp['lns_shared_secret'] = conf.return_value(['lns', 'shared-secret']) - if conf.exists('idle'): - l2tp['idle_timeout'] = conf.return_value('idle') + if conf.exists(['ccp-disable']): + l2tp[['ccp_disable']] = True - # LNS secret - if conf.exists('lns shared-secret'): - l2tp['lns_shared_secret'] = conf.return_value('lns shared-secret') - - if conf.exists('ccp-disable'): - l2tp['ccp_disable'] = True - - # ppp_options - ppp_options = {} - if conf.exists('ppp-options'): - if conf.exists('ppp-options lcp-echo-failure'): - ppp_options['lcp-echo-failure'] = conf.return_value( - 'ppp-options lcp-echo-failure') - if conf.exists('ppp-options lcp-echo-interval'): - ppp_options['lcp-echo-interval'] = conf.return_value( - 'ppp-options lcp-echo-interval') - - if len(ppp_options) != 0: - l2tp['ppp_options'] = ppp_options + # PPP options + if conf.exists(['idle']): + l2tp['ppp_echo_timeout'] = conf.return_value(['idle']) + + if conf.exists(['ppp-options', 'lcp-echo-failure']): + l2tp['ppp_echo_failure'] = conf.return_value(['ppp-options', 'lcp-echo-failure']) + + if conf.exists(['ppp-options', 'lcp-echo-interval']): + l2tp['ppp_echo_interval'] = conf.return_value(['ppp-options', 'lcp-echo-interval']) import pprint pprint.pprint(l2tp) -- cgit v1.2.3 From becda904d1c4a8995488713420265c7c85a64cb9 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 00:48:58 +0200 Subject: vpn: l2tp: T2264: remove debug pprint --- src/conf_mode/vpn_l2tp.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index bb51b4573..fa336f6de 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -302,13 +302,11 @@ def get_config(): if conf.exists(['ppp-options', 'lcp-echo-interval']): l2tp['ppp_echo_interval'] = conf.return_value(['ppp-options', 'lcp-echo-interval']) - import pprint - pprint.pprint(l2tp) return l2tp def verify(l2tp): - if l2tp == None: + if not l2tp: return None if l2tp['auth_mode'] == 'local': -- cgit v1.2.3 From fb40f020bcd2bdb0e2fbbbd13d4557e7e4da030d Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 01:05:35 +0200 Subject: vpn: l2tp: T2264: migrate from SysVinit -> systemd --- src/conf_mode/vpn_l2tp.py | 70 +++++++-------------------- src/etc/systemd/system/accel-ppp-l2tp.service | 14 ++++++ 2 files changed, 31 insertions(+), 53 deletions(-) create mode 100644 src/etc/systemd/system/accel-ppp-l2tp.service (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index fa336f6de..fbccc93d1 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -18,7 +18,6 @@ import os import re from copy import deepcopy -from socket import AF_INET, SOCK_STREAM, socket from stat import S_IRUSR, S_IWUSR, S_IRGRP from sys import exit from time import sleep @@ -27,19 +26,18 @@ from jinja2 import FileSystemLoader, Environment from vyos.config import Config from vyos.defaults import directories as vyos_data_dir -from vyos.util import run +from vyos.util import call from vyos.validate import is_ipv4 from vyos import ConfigError -pidfile = '/var/run/accel_l2tp.pid' -l2tp_conf = '/etc/accel-ppp/l2tp/l2tp.config' -l2tp_chap_secrets = '/etc/accel-ppp/l2tp/chap-secrets' +l2tp_conf = '/etc/accel-ppp/l2tp.conf' +l2tp_chap_secrets = '/etc/accel-ppp/l2tp.chap-secrets' default_config_data = { 'auth_mode': 'local', 'auth_ppp_mppe': 'prefer', 'auth_proto': ['auth_mschap_v2'], - 'chap_secrets_file': l2tp_chap_secrets, + 'chap_secrets_file': l2tp_chap_secrets, # used in Jinja2 template 'client_ip_pool': None, 'client_ip_subnets': [], 'client_ipv6_pool': {}, @@ -70,30 +68,6 @@ default_config_data = { 'thread_cnt': 1 } -def chk_con(): - """ - Depending on hardware and threads, daemon needs a little to start if it - takes longer than 100 * 0.5 secs, exception is being raised not sure if - that's the best way to check it, but it worked so far quite well - """ - cnt = 0 - s = socket(AF_INET, SOCK_STREAM) - while True: - try: - s.connect(("127.0.0.1", 2004)) - break - except ConnectionRefusedError: - sleep(0.5) - cnt += 1 - if cnt == 100: - raise("failed to start l2tp server") - break - - -def _accel_cmd(command): - return run(f'/usr/bin/accel-cmd -p 2004 {command}') - - def get_config(): conf = Config() base_path = ['vpn', 'l2tp', 'remote-access'] @@ -351,11 +325,6 @@ def generate(l2tp): if not l2tp: return None - # Create configuration directory if it's non existent - dirname = os.path.dirname(l2tp_conf) - if not os.path.isdir(dirname): - os.mkdir(dirname) - # Prepare Jinja2 template loader from files tmpl_path = os.path.join(vyos_data_dir['data'], 'templates', 'l2tp') fs_loader = FileSystemLoader(tmpl_path) @@ -369,36 +338,31 @@ def generate(l2tp): if l2tp['auth_mode'] == 'local': tmpl = env.get_template('chap-secrets.tmpl') config_text = tmpl.render(l2tp) - with open(l2tp['chap_secrets_file'], 'w') as f: + with open(l2tp_chap_secrets, 'w') as f: f.write(config_text) - os.chmod(l2tp['chap_secrets_file'], S_IRUSR | S_IWUSR | S_IRGRP) + os.chmod(l2tp_chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP) else: - if os.path.exists(l2tp['chap_secrets_file']): - os.unlink(l2tp['chap_secrets_file']) + if os.path.exists(l2tp_chap_secrets): + os.unlink(l2tp_chap_secrets) return None def apply(l2tp): if not l2tp: - if os.path.exists(pidfile): - _accel_cmd('shutdown hard') - if os.path.exists(pidfile): - os.remove(pidfile) - return None + call('systemctl stop accel-ppp-l2tp.service') - if not os.path.exists(pidfile): - ret = run(f'/usr/sbin/accel-pppd -c {l2tp_conf} -p {pidfile} -d') - chk_con() - if ret != 0 and os.path.exists(pidfile): - os.remove(pidfile) - raise ConfigError('accel-pppd failed to start') - else: - # if gw ip changes, only restart doesn't work - _accel_cmd('restart') + if os.path.exists(l2tp_conf): + os.unlink(l2tp_conf) + + if os.path.exists(l2tp_chap_secrets): + os.unlink(l2tp_chap_secrets) + + return None + call('systemctl restart accel-ppp-l2tp.service') if __name__ == '__main__': try: diff --git a/src/etc/systemd/system/accel-ppp-l2tp.service b/src/etc/systemd/system/accel-ppp-l2tp.service new file mode 100644 index 000000000..27f0cc8c0 --- /dev/null +++ b/src/etc/systemd/system/accel-ppp-l2tp.service @@ -0,0 +1,14 @@ +[Unit] +Description=Accel-PPP/L2TP +After=vyos-router.service + +[Service] +ExecStart=/usr/sbin/accel-pppd -d -p /run/accel-pppd-l2tp.pid -c /etc/accel-ppp/l2tp.conf +ExecReload=/bin/kill -SIGUSR1 $MAINPID +PIDFile=/run/accel-pppd-l2tp.pid +Type=forking +Restart=always + +[Install] +WantedBy=multi-user.target +Alias=accel-ppp-l2tp.service -- cgit v1.2.3 From 7f648cb2348ebe790757a98ef1d51275d0377650 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 11:20:37 +0200 Subject: vpn: sstp: T2008: bugfix KeyError 'client_gateway' --- src/conf_mode/vpn_sstp.py | 1 + 1 file changed, 1 insertion(+) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 6a574dabb..13a24675d 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -61,6 +61,7 @@ default_config_data = { 'local_users' : [], 'auth_mode' : 'local', 'auth_proto' : ['auth_mschap_v2'], + 'client_gateway': '', 'radius_server' : [], 'radius_acct_tmo' : '3', 'radius_max_try' : '3', -- cgit v1.2.3 From 13510cac5a4aadc3f6ca79c8c7fd7276abe95be3 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 11:24:46 +0200 Subject: vpn: sstp: T2008: migrate from SysVinit -> systemd --- data/templates/sstp/sstp.config.tmpl | 2 +- src/conf_mode/vpn_sstp.py | 85 ++++++--------------------- src/etc/systemd/system/accel-ppp-sstp.service | 14 +++++ 3 files changed, 33 insertions(+), 68 deletions(-) create mode 100644 src/etc/systemd/system/accel-ppp-sstp.service (limited to 'src/conf_mode') diff --git a/data/templates/sstp/sstp.config.tmpl b/data/templates/sstp/sstp.config.tmpl index 19805358e..d5f55b2df 100644 --- a/data/templates/sstp/sstp.config.tmpl +++ b/data/templates/sstp/sstp.config.tmpl @@ -52,7 +52,7 @@ dns{{ loop.index }}={{ dns }} {% if auth_mode == 'local' %} [chap-secrets] -chap-secrets=/etc/accel-ppp/sstp/chap-secrets +chap-secrets={{ sstp_chap_secrets }} {% elif auth_mode == 'radius' %} [radius] verbose=1 diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 13a24675d..a0bcb1acf 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -18,7 +18,6 @@ import os from time import sleep from sys import exit -from socket import socket, AF_INET, SOCK_STREAM from copy import deepcopy from stat import S_IRUSR, S_IWUSR, S_IRGRP from jinja2 import FileSystemLoader, Environment @@ -26,41 +25,16 @@ from jinja2 import FileSystemLoader, Environment from vyos.config import Config from vyos import ConfigError from vyos.defaults import directories as vyos_data_dir -from vyos.util import process_running -from vyos.util import process_running, cmd, run - -pidfile = r'/var/run/accel_sstp.pid' -sstp_cnf_dir = r'/etc/accel-ppp/sstp' -chap_secrets = sstp_cnf_dir + '/chap-secrets' -sstp_conf = sstp_cnf_dir + '/sstp.config' - -# config path creation -if not os.path.exists(sstp_cnf_dir): - os.makedirs(sstp_cnf_dir) - -def chk_con(): - cnt = 0 - s = socket(AF_INET, SOCK_STREAM) - while True: - try: - s.connect(("127.0.0.1", 2005)) - s.close() - break - except ConnectionRefusedError: - sleep(0.5) - cnt += 1 - if cnt == 100: - raise("failed to start sstp server") - break - - -def _accel_cmd(command): - return run(f'/usr/bin/accel-cmd -p 2005 {command}') +from vyos.util import call, run + +sstp_conf = '/etc/accel-ppp/sstp.conf' +sstp_chap_secrets = '/etc/accel-ppp/sstp.chap-secrets' default_config_data = { 'local_users' : [], 'auth_mode' : 'local', 'auth_proto' : ['auth_mschap_v2'], + 'chap_secrets_file': sstp_chap_secrets, # used in Jinja2 template 'client_gateway': '', 'radius_server' : [], 'radius_acct_tmo' : '3', @@ -340,52 +314,29 @@ def generate(sstp): if sstp['local_users']: tmpl = env.get_template('chap-secrets.tmpl') config_text = tmpl.render(sstp) - with open(chap_secrets, 'w') as f: - f.write(config_text) + with open(sstp_chap_secrets, 'w') as f: + f.write(sstp_chap_secrets) - os.chmod(chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP) + os.chmod(sstp_chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP) else: - if os.path.exists(chap_secrets): - os.unlink(chap_secrets) + if os.path.exists(sstp_chap_secrets): + os.unlink(sstp_chap_secrets) return sstp def apply(sstp): - if sstp is None: - if process_running(pidfile): - command = 'start-stop-daemon' - command += ' --stop ' - command += ' --quiet' - command += ' --oknodo' - command += ' --pidfile ' + pidfile - cmd(command) + if not sstp: + call('systemctl stop accel-ppp-sstp.service') - if os.path.exists(pidfile): - os.remove(pidfile) + if os.path.exists(sstp_conf): + os.unlink(sstp_conf) - return None + if os.path.exists(sstp_chap_secrets): + os.unlink(sstp_chap_secrets) - if not process_running(pidfile): - if os.path.exists(pidfile): - os.remove(pidfile) - - command = 'start-stop-daemon' - command += ' --start ' - command += ' --quiet' - command += ' --oknodo' - command += ' --pidfile ' + pidfile - command += ' --exec /usr/sbin/accel-pppd' - # now pass arguments to accel-pppd binary - command += ' --' - command += ' -c ' + sstp_conf - command += ' -p ' + pidfile - command += ' -d' - cmd(command) - - chk_con() + return None - else: - _accel_cmd('restart') + call('systemctl restart accel-ppp-sstp.service') if __name__ == '__main__': diff --git a/src/etc/systemd/system/accel-ppp-sstp.service b/src/etc/systemd/system/accel-ppp-sstp.service new file mode 100644 index 000000000..03bd7f99c --- /dev/null +++ b/src/etc/systemd/system/accel-ppp-sstp.service @@ -0,0 +1,14 @@ +[Unit] +Description=Accel-PPP/SSTP +After=vyos-router.service + +[Service] +ExecStart=/usr/sbin/accel-pppd -d -p /run/accel-pppd-sstp.pid -c /etc/accel-ppp/sstp.conf +ExecReload=/bin/kill -SIGUSR1 $MAINPID +PIDFile=/run/accel-pppd-sstp.pid +Type=forking +Restart=always + +[Install] +WantedBy=multi-user.target +Alias=accel-ppp-sstp.service -- cgit v1.2.3 From f8e9d1ecea05aa40555b7eb7e337f7fb9e495bae Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 13:12:09 +0200 Subject: vpn: l2tp: T2264: simplify IPv6 config dictionary elements --- data/templates/l2tp/l2tp.config.tmpl | 14 +++++------ src/conf_mode/vpn_l2tp.py | 47 +++++++++++++++++------------------- 2 files changed, 29 insertions(+), 32 deletions(-) (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index f4746a6a1..0dcff1371 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -116,18 +116,18 @@ ipv6=allow {% endif %} - {% if client_ipv6_pool %} [ipv6-pool] -{% for prfx in client_ipv6_pool.prefix: %} -{{prfx}} +{% for prefix in client_ipv6_pool %} +{{ prefix }} {% endfor %} -{% for prfx in client_ipv6_pool.delegate_prefix: %} -delegate={{prfx}} +{% for prefix in client_ipv6_delegate_prefix %} +delegate={{ prefix }} {% endfor %} + {% endif %} -{% if client_ipv6_pool['delegate_prefix'] %} +{% if client_ipv6_delegate_prefix %} [ipv6-dhcp] verbose=1 {% endif %} @@ -143,5 +143,5 @@ vendor={{ radius_shaper_vendor }} [cli] tcp=127.0.0.1:2004 -sessions-columns=ifname,username,calling-sid,ip,{{ip6_column}}{{ip6_dp_column}}rate-limit,type,comp,state,rx-bytes,tx-bytes,uptime +sessions-columns=ifname,username,calling-sid,ip,{{ ip6_column | join(',') }}{{ ',' if ip6_column }}rate-limit,type,comp,state,rx-bytes,tx-bytes,uptime diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index fbccc93d1..08654e2ff 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -22,6 +22,7 @@ from stat import S_IRUSR, S_IWUSR, S_IRGRP from sys import exit from time import sleep +from ipaddress import ip_network from jinja2 import FileSystemLoader, Environment from vyos.config import Config @@ -40,7 +41,8 @@ default_config_data = { 'chap_secrets_file': l2tp_chap_secrets, # used in Jinja2 template 'client_ip_pool': None, 'client_ip_subnets': [], - 'client_ipv6_pool': {}, + 'client_ipv6_pool': [], + 'client_ipv6_delegate_prefix': [], 'dnsv4': [], 'dnsv6': [], 'gateway_address': '10.255.255.0', @@ -62,9 +64,7 @@ default_config_data = { 'radius_shaper_vendor': '', 'radius_dynamic_author': '', 'wins': [], - 'ip6_column': '', - 'ip6_dp_column': '', - 'ppp_options': {}, + 'ip6_column': [], 'thread_cnt': 1 } @@ -232,32 +232,30 @@ def get_config(): l2tp['client_ip_subnets'] = conf.return_values(['client-ip-pool', 'subnet']) if conf.exists(['client-ipv6-pool', 'prefix']): - l2tp['client_ipv6_pool']['prefix'] = conf.return_values( - 'client-ipv6-pool prefix') - l2tp['ip6_column'] = 'ip6,' + l2tp['client_ipv6_pool'] = conf.return_values(['client-ipv6-pool', 'prefix']) + l2tp['ip6_column'].append('ip6') - if conf.exists('client-ipv6-pool delegate-prefix'): - l2tp['client_ipv6_pool']['delegate_prefix'] = conf.return_values( - 'client-ipv6-pool delegate-prefix') - l2tp['ip6_dp_column'] = 'ip6-dp,' + if conf.exists(['client-ipv6-pool', 'delegate-prefix']): + l2tp['client_ipv6_delegate_prefix'] = conf.return_values(['client-ipv6-pool', 'delegate-prefix']) + l2tp['ip6_column'].append('ip6-dp') - if conf.exists('mtu'): - l2tp['mtu'] = conf.return_value('mtu') + if conf.exists(['mtu']): + l2tp['mtu'] = conf.return_value(['mtu']) # gateway address - if conf.exists('gateway-address'): - l2tp['gateway_address'] = conf.return_value('gateway-address') + if conf.exists(['gateway-address']): + l2tp['gateway_address'] = conf.return_value(['gateway-address']) else: # calculate gw-ip-address - if conf.exists('client-ip-pool start'): + if conf.exists(['client-ip-pool', 'start']): # use start ip as gw-ip-address - l2tp['gateway_address'] = conf.return_value( - 'client-ip-pool start') - elif conf.exists('client-ip-pool subnet'): + l2tp['gateway_address'] = conf.return_value(['client-ip-pool', 'start']) + + elif conf.exists(['client-ip-pool', 'subnet']): # use first ip address from first defined pool - lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", conf.return_values( - 'client-ip-pool subnet')[0]) - l2tp['gateway_address'] = lst_ip[0] + subnet = conf.return_values(['client-ip-pool', 'subnet'])[0] + subnet = ip_network(subnet) + l2tp['gateway_address'] = str(list(subnet.hosts())[0]) # LNS secret if conf.exists(['lns', 'shared-secret']): @@ -305,9 +303,8 @@ def verify(l2tp): "set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool") # check ipv6 - if 'delegate_prefix' in l2tp['client_ipv6_pool'] and not 'prefix' in l2tp['client_ipv6_pool']: - raise ConfigError( - "\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ") + if l2tp['client_ipv6_delegate_prefix'] and not l2tp['client_ipv6_pool']: + raise ConfigError('IPv6 prefix delegation requires client-ipv6-pool prefix') if len(l2tp['wins']) > 2: raise ConfigError('Not more then two IPv4 WINS name-servers can be configured') -- cgit v1.2.3 From 07080afd4015a900fb7474e1c81008f58b478565 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 15:12:52 +0200 Subject: vpn: l2tp: T2264: migrate IPv6 prefix node to common CLI style Combining multiple options into a single CLI node is considered bad practice. IPv6 prefixes consited of the prefix itself and a mask send to the client in one node only. The following CLI parts have been migrated from client-ipv6-pool { delegate-prefix fc00:0:1::/48,64 prefix 2001:db8::/64,64 } to client-ipv6-pool { delegate fc00:0:1::/48 { delegation-prefix 48 } prefix 2001:db8::/48 { mask 64 } } Thus regular validation steps from the VyOS CLI can be used when a prefix is configured. --- data/templates/l2tp/l2tp.config.tmpl | 8 ++--- interface-definitions/vpn-l2tp.xml.in | 56 +++++++++++++++++++++++++++-------- src/conf_mode/vpn_l2tp.py | 30 ++++++++++++++++--- src/migration-scripts/l2tp/2-to-3 | 28 ++++++++++++++++++ 4 files changed, 102 insertions(+), 20 deletions(-) (limited to 'src/conf_mode') diff --git a/data/templates/l2tp/l2tp.config.tmpl b/data/templates/l2tp/l2tp.config.tmpl index 0dcff1371..ba78cadcd 100644 --- a/data/templates/l2tp/l2tp.config.tmpl +++ b/data/templates/l2tp/l2tp.config.tmpl @@ -118,11 +118,11 @@ ipv6=allow {% if client_ipv6_pool %} [ipv6-pool] -{% for prefix in client_ipv6_pool %} -{{ prefix }} +{% for p in client_ipv6_pool %} +{{ p.prefix }},{{ p.mask }} {% endfor %} -{% for prefix in client_ipv6_delegate_prefix %} -delegate={{ prefix }} +{% for p in client_ipv6_delegate_prefix %} +delegate={{ p.prefix }},{{ p.mask }} {% endfor %} {% endif %} diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in index 84dd8187c..d4286a810 100644 --- a/interface-definitions/vpn-l2tp.xml.in +++ b/interface-definitions/vpn-l2tp.xml.in @@ -237,26 +237,58 @@ Pool of client IPv6 addresses - + - IPV6 prefix delegation + Pool of addresses used to assign to clients - ipv6prefix/mask,prefix_len - e.g.: fc00:0:1::/48,64 - divides prefix into /64 subnets for clients + ipv6net + IPv6 address and prefix length - + + + - - + + + + Prefix length used for individual client + + <48-128> + Client prefix length (default: 64) + + + + + + + + + - DHCPv6 prefix delegation - rfc3633 + Subnet used to delegate prefix through DHCPv6-PD (RFC3633) - ipv6prefix/mask,prefix_len - Delegate to clients through DHCPv6 prefix delegation - rfc3633 + ipv6net + IPv6 address and prefix length - + + + - + + + + Prefix length delegated to client + + <32-64> + Delegated prefix length + + + + + + + + diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 08654e2ff..7cfb4e74e 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -232,12 +232,30 @@ def get_config(): l2tp['client_ip_subnets'] = conf.return_values(['client-ip-pool', 'subnet']) if conf.exists(['client-ipv6-pool', 'prefix']): - l2tp['client_ipv6_pool'] = conf.return_values(['client-ipv6-pool', 'prefix']) l2tp['ip6_column'].append('ip6') + for prefix in conf.list_nodes(['client-ipv6-pool', 'prefix']): + tmp = { + 'prefix': prefix, + 'mask': '64' + } + + if conf.exists(['client-ipv6-pool', 'prefix', prefix, 'mask']): + tmp['mask'] = conf.return_value(['client-ipv6-pool', 'prefix', prefix, 'mask']) - if conf.exists(['client-ipv6-pool', 'delegate-prefix']): - l2tp['client_ipv6_delegate_prefix'] = conf.return_values(['client-ipv6-pool', 'delegate-prefix']) - l2tp['ip6_column'].append('ip6-dp') + l2tp['client_ipv6_pool'].append(tmp) + + if conf.exists(['client-ipv6-pool', 'delegate']): + l2tp['ip6_column'].append('ip6-db') + for prefix in conf.list_nodes(['client-ipv6-pool', 'delegate']): + tmp = { + 'prefix': prefix, + 'mask': '' + } + + if conf.exists(['client-ipv6-pool', 'delegate', prefix, 'mask']): + tmp['mask'] = conf.return_value(['client-ipv6-pool', 'delegate', prefix, 'delegation-prefix']) + + l2tp['client_ipv6_delegate_prefix'].append(tmp) if conf.exists(['mtu']): l2tp['mtu'] = conf.return_value(['mtu']) @@ -306,6 +324,10 @@ def verify(l2tp): if l2tp['client_ipv6_delegate_prefix'] and not l2tp['client_ipv6_pool']: raise ConfigError('IPv6 prefix delegation requires client-ipv6-pool prefix') + for prefix in l2tp['client_ipv6_delegate_prefix']: + if not prefix['mask']: + raise ConfigError('Delegation-prefix required for individual delegated networks') + if len(l2tp['wins']) > 2: raise ConfigError('Not more then two IPv4 WINS name-servers can be configured') diff --git a/src/migration-scripts/l2tp/2-to-3 b/src/migration-scripts/l2tp/2-to-3 index e24d1ffa9..bd0839e03 100755 --- a/src/migration-scripts/l2tp/2-to-3 +++ b/src/migration-scripts/l2tp/2-to-3 @@ -75,6 +75,34 @@ else: if config.exists(radius_base + ['server', server, 'req-limit']): config.delete(radius_base + ['server', server, 'req-limit']) + # Migrate IPv6 prefixes + ipv6_base = base + ['client-ipv6-pool'] + if config.exists(ipv6_base + ['prefix']): + prefix_old = config.return_values(ipv6_base + ['prefix']) + # delete old prefix CLI nodes + config.delete(ipv6_base + ['prefix']) + # create ned prefix tag node + config.set(ipv6_base + ['prefix']) + config.set_tag(ipv6_base + ['prefix']) + + for p in prefix_old: + prefix = p.split(',')[0] + mask = p.split(',')[1] + config.set(ipv6_base + ['prefix', prefix, 'mask'], value=mask) + + if config.exists(ipv6_base + ['delegate-prefix']): + prefix_old = config.return_values(ipv6_base + ['delegate-prefix']) + # delete old delegate prefix CLI nodes + config.delete(ipv6_base + ['delegate-prefix']) + # create ned delegation tag node + config.set(ipv6_base + ['delegate ']) + config.set_tag(ipv6_base + ['delegate ']) + + for p in prefix_old: + prefix = p.split(',')[0] + mask = p.split(',')[1] + config.set(ipv6_base + ['delegate', prefix, 'mask'], value=mask) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3 From 0edca98b751faa3f3817fe4899d2822daade4212 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sat, 11 Apr 2020 19:13:39 +0200 Subject: vpn: l2tp: sstp: T2264: create config dir on demand --- src/conf_mode/vpn_l2tp.py | 4 ++++ src/conf_mode/vpn_sstp.py | 4 ++++ 2 files changed, 8 insertions(+) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py index 7cfb4e74e..7ecd8b2a4 100755 --- a/src/conf_mode/vpn_l2tp.py +++ b/src/conf_mode/vpn_l2tp.py @@ -349,6 +349,10 @@ def generate(l2tp): fs_loader = FileSystemLoader(tmpl_path) env = Environment(loader=fs_loader, trim_blocks=True) + dirname = os.path.dirname(l2tp_conf) + if not os.path.exists(dirname): + os.mkdir(dirname) + tmpl = env.get_template('l2tp.config.tmpl') config_text = tmpl.render(c) with open(l2tp_conf, 'w') as f: diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index a0bcb1acf..b2eb5bdcb 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -305,6 +305,10 @@ def generate(sstp): fs_loader = FileSystemLoader(tmpl_path) env = Environment(loader=fs_loader, trim_blocks=True) + dirname = os.path.dirname(sstp_conf) + if not os.path.exists(dirname): + os.mkdir(dirname) + # accel-cmd reload doesn't work so any change results in a restart of the daemon tmpl = env.get_template('sstp.config.tmpl') config_text = tmpl.render(sstp) -- cgit v1.2.3