From 77dde087219467ce8bfcf64a9f7452ca74d66c0c Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 16:39:50 +0100 Subject: sstp: T2008: move to vpn node --- src/conf_mode/accel_sstp.py | 469 -------------------------------------------- src/conf_mode/vpn_sstp.py | 468 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 468 insertions(+), 469 deletions(-) delete mode 100755 src/conf_mode/accel_sstp.py create mode 100755 src/conf_mode/vpn_sstp.py (limited to 'src/conf_mode') diff --git a/src/conf_mode/accel_sstp.py b/src/conf_mode/accel_sstp.py deleted file mode 100755 index 1317a32db..000000000 --- a/src/conf_mode/accel_sstp.py +++ /dev/null @@ -1,469 +0,0 @@ -#!/usr/bin/env python3 -# -# Copyright (C) 2018 VyOS maintainers and contributors -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . -# -# - -import sys -import os -import re -import subprocess -import jinja2 -import socket -import time -import syslog as sl - -from vyos.config import Config -from vyos import ConfigError - -pidfile = r'/var/run/accel_sstp.pid' -sstp_cnf_dir = r'/etc/accel-ppp/sstp' -chap_secrets = sstp_cnf_dir + '/chap-secrets' -sstp_conf = sstp_cnf_dir + '/sstp.config' -ssl_cert_dir = r'/config/user-data/sstp' - -### config path creation -if not os.path.exists(sstp_cnf_dir): - os.makedirs(sstp_cnf_dir) - sl.syslog(sl.LOG_NOTICE, sstp_cnf_dir + " created") - -if not os.path.exists(ssl_cert_dir): - os.makedirs(ssl_cert_dir) - sl.syslog(sl.LOG_NOTICE, ssl_cert_dir + " created") - -sstp_config = ''' -### generated by accel_sstp.py ### -[modules] -log_syslog -sstp -ippool -shaper -{% if authentication['mode'] == 'local' %} -chap-secrets -{% endif -%} -{% for proto in authentication['auth_proto'] %} -{{proto}} -{% endfor %} -{% if authentication['mode'] == 'radius' %} -radius -{% endif %} - -[core] -thread-count={{thread_cnt}} - -[common] -single-session=replace - -[log] -syslog=accel-sstp,daemon -copy=1 -level=5 - -[client-ip-range] -disable - -[sstp] -verbose=1 -accept=ssl -{% if certs %} -ssl-ca-file=/config/user-data/sstp/{{certs['ca']}} -ssl-pemfile=/config/user-data/sstp/{{certs['server-cert']}} -ssl-keyfile=/config/user-data/sstp/{{certs['server-key']}} -{% endif %} - -{%if ip_pool %} -[ip-pool] -gw-ip-address={{gw}} -{% for sn in ip_pool %} -{{sn}} -{% endfor %} -{% endif %} - -{% if dnsv4 %} -[dns] -{% if dnsv4['primary'] %} -dns1={{dnsv4['primary']}} -{% endif -%} -{% if dnsv4['secondary'] %} -dns2={{dnsv4['secondary']}} -{% endif -%} -{% endif %} - -{% if authentication['mode'] == 'local' %} -[chap-secrets] -chap-secrets=/etc/accel-ppp/sstp/chap-secrets -{% endif %} - -{%- if authentication['mode'] == 'radius' %} -[radius] -verbose=1 -{% for rsrv in authentication['radius-srv']: %} -server={{rsrv}},{{authentication['radius-srv'][rsrv]['secret']}},\ -req-limit={{authentication['radius-srv'][rsrv]['req-limit']}},\ -fail-time={{authentication['radius-srv'][rsrv]['fail-time']}} -{% endfor -%} -{% if authentication['radiusopt']['acct-timeout'] %} -acct-timeout={{authentication['radiusopt']['acct-timeout']}} -{% endif -%} -{% if authentication['radiusopt']['timeout'] %} -timeout={{authentication['radiusopt']['timeout']}} -{% endif -%} -{% if authentication['radiusopt']['max-try'] %} -max-try={{authentication['radiusopt']['max-try']}} -{% endif -%} -{% if authentication['radiusopt']['nas-id'] %} -nas-identifier={{authentication['radiusopt']['nas-id']}} -{% endif -%} -{% if authentication['radiusopt']['nas-ip'] %} -nas-ip-address={{authentication['radiusopt']['nas-ip']}} -{% endif -%} -{% if authentication['radiusopt']['dae-srv'] %} -dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\ -{{authentication['radiusopt']['dae-srv']['port']}},\ -{{authentication['radiusopt']['dae-srv']['secret']}} -{% endif -%} -{% endif %} - -[ppp] -verbose=1 -check-ip=1 -{% if mtu %} -mtu={{mtu}} -{% endif -%} -{% if ppp['mppe'] %} -mppe={{ppp['mppe']}} -{% endif -%} -{% if ppp['lcp-echo-interval'] %} -lcp-echo-interval={{ppp['lcp-echo-interval']}} -{% endif -%} -{% if ppp['lcp-echo-failure'] %} -lcp-echo-failure={{ppp['lcp-echo-failure']}} -{% endif -%} -{% if ppp['lcp-echo-timeout'] %} -lcp-echo-timeout={{ppp['lcp-echo-timeout']}} -{% endif %} - -{% if authentication['radiusopt']['shaper'] %} -[shaper] -verbose=1 -attr={{authentication['radiusopt']['shaper']['attr']}} -{% if authentication['radiusopt']['shaper']['vendor'] %} -vendor={{authentication['radiusopt']['shaper']['vendor']}} -{% endif -%} -{% endif %} - -[cli] -tcp=127.0.0.1:2005 -''' - -### sstp chap secrets -chap_secrets_conf = ''' -# username server password acceptable local IP addresses shaper -{% for user in authentication['local-users'] %} -{% if authentication['local-users'][user]['state'] == 'enabled' %} -{% if (authentication['local-users'][user]['upload']) and (authentication['local-users'][user]['download']) %} -{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}}\t\ -{{authentication['local-users'][user]['download']}}/{{authentication['local-users'][user]['upload']}} -{% else %} -{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}} -{% endif %} -{% endif %} -{% endfor %} -''' -### -# inline helper functions -### -# depending on hw and threads, daemon needs a little to start -# if it takes longer than 100 * 0.5 secs, exception is being raised -# not sure if that's the best way to check it, but it worked so far quite well -### -def chk_con(): - cnt = 0 - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - while True: - try: - s.connect(("127.0.0.1", 2005)) - s.close() - break - except ConnectionRefusedError: - time.sleep(0.5) - cnt +=1 - if cnt == 100: - raise("failed to start sstp server") - break - -### chap_secrets file if auth mode local -def write_chap_secrets(c): - tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) - chap_secrets_txt = tmpl.render(c) - old_umask = os.umask(0o077) - open(chap_secrets,'w').write(chap_secrets_txt) - os.umask(old_umask) - sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') - -def accel_cmd(cmd=''): - if not cmd: - return None - try: - ret = subprocess.check_output(['/usr/bin/accel-cmd','-p','2005',cmd]).decode().strip() - return ret - except: - return 1 - -#### check ig local-ip is in client pool subnet - - -### -# inline helper functions end -### - -def get_config(): - c = Config() - if not c.exists('service sstp-server'): - return None - - c.set_level('service sstp-server') - - config_data = { - 'authentication' : { - 'local-users' : { - }, - 'mode' : 'local', - 'auth_proto' : [], - 'radius-srv' : {}, - 'radiusopt' : {}, - 'dae-srv' : {} - }, - 'certs' : { - 'ca' : None, - 'server-key' : None, - 'server-cert' : None - }, - 'ip_pool' : [], - 'gw' : None, - 'dnsv4' : {}, - 'mtu' : None, - 'ppp' : {}, - } - - ### local auth - if c.exists('authentication mode local'): - if c.exists('authentication local-users'): - for usr in c.list_nodes('authentication local-users username'): - config_data['authentication']['local-users'].update( - { - usr : { - 'passwd' : None, - 'state' : 'enabled', - 'ip' : '*', - 'upload' : None, - 'download' : None - } - } - ) - if c.exists('authentication local-users username ' + usr + ' password'): - config_data['authentication']['local-users'][usr]['passwd'] = c.return_value('authentication local-users username ' + usr + ' password') - if c.exists('authentication local-users username ' + usr + ' disable'): - config_data['authentication']['local-users'][usr]['state'] = 'disable' - if c.exists('authentication local-users username ' + usr + ' static-ip'): - config_data['authentication']['local-users'][usr]['ip'] = c.return_value('authentication local-users username ' + usr + ' static-ip') - if c.exists('authentication local-users username ' + usr + ' rate-limit download'): - config_data['authentication']['local-users'][usr]['download'] = c.return_value('authentication local-users username ' + usr + ' rate-limit download') - if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): - config_data['authentication']['local-users'][usr]['upload'] = c.return_value('authentication local-users username ' + usr + ' rate-limit upload') - - if c.exists('authentication protocols'): - auth_mods = {'pap' : 'pap','chap' : 'auth_chap_md5', 'mschap' : 'auth_mschap_v1', 'mschap-v2' : 'auth_mschap_v2'} - for proto in c.return_values('authentication protocols'): - config_data['authentication']['auth_proto'].append(auth_mods[proto]) - else: - config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] - - #### RADIUS auth and settings - if c.exists('authentication mode radius'): - config_data['authentication']['mode'] = c.return_value('authentication mode') - if c.exists('authentication radius-server'): - for rsrv in c.list_nodes('authentication radius-server'): - config_data['authentication']['radius-srv'][rsrv] = {} - if c.exists('authentication radius-server ' + rsrv + ' secret'): - config_data['authentication']['radius-srv'][rsrv]['secret'] = c.return_value('authentication radius-server ' + rsrv + ' secret') - else: - config_data['authentication']['radius-srv'][rsrv]['secret'] = None - if c.exists('authentication radius-server ' + rsrv + ' fail-time'): - config_data['authentication']['radius-srv'][rsrv]['fail-time'] = c.return_value('authentication radius-server ' + rsrv + ' fail-time') - else: - config_data['authentication']['radius-srv'][rsrv]['fail-time'] = 0 - if c.exists('authentication radius-server ' + rsrv + ' req-limit'): - config_data['authentication']['radius-srv'][rsrv]['req-limit'] = c.return_value('authentication radius-server ' + rsrv + ' req-limit') - else: - config_data['authentication']['radius-srv'][rsrv]['req-limit'] = 0 - - #### advanced radius-setting - if c.exists('authentication radius-settings'): - if c.exists('authentication radius-settings acct-timeout'): - config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value('authentication radius-settings acct-timeout') - if c.exists('authentication radius-settings max-try'): - config_data['authentication']['radiusopt']['max-try'] = c.return_value('authentication radius-settings max-try') - if c.exists('authentication radius-settings timeout'): - config_data['authentication']['radiusopt']['timeout'] = c.return_value('authentication radius-settings timeout') - if c.exists('authentication radius-settings nas-identifier'): - config_data['authentication']['radiusopt']['nas-id'] = c.return_value('authentication radius-settings nas-identifier') - if c.exists('authentication radius-settings nas-ip-address'): - config_data['authentication']['radiusopt']['nas-ip'] = c.return_value('authentication radius-settings nas-ip-address') - if c.exists('authentication radius-settings dae-server'): - config_data['authentication']['radiusopt'].update( - { - 'dae-srv' : { - 'ip-addr' : c.return_value('authentication radius-settings dae-server ip-address'), - 'port' : c.return_value('authentication radius-settings dae-server port'), - 'secret' : str(c.return_value('authentication radius-settings dae-server secret')) - } - } - ) - if c.exists('authentication radius-settings rate-limit enable'): - if not c.exists('authentication radius-settings rate-limit attribute'): - config_data['authentication']['radiusopt']['shaper'] = { 'attr' : 'Filter-Id' } - else: - config_data['authentication']['radiusopt']['shaper'] = { - 'attr' : c.return_value('authentication radius-settings rate-limit attribute') - } - if c.exists('authentication radius-settings rate-limit vendor'): - config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value('authentication radius-settings rate-limit vendor') - - if c.exists('sstp-settings ssl-certs ca'): - config_data['certs']['ca'] = c.return_value('sstp-settings ssl-certs ca') - if c.exists('sstp-settings ssl-certs server-cert'): - config_data['certs']['server-cert'] = c.return_value('sstp-settings ssl-certs server-cert') - if c.exists('sstp-settings ssl-certs server-key'): - config_data['certs']['server-key'] = c.return_value('sstp-settings ssl-certs server-key') - - if c.exists('network-settings client-ip-settings subnet'): - config_data['ip_pool'] = c.return_values('network-settings client-ip-settings subnet') - if c.exists('network-settings client-ip-settings gateway-address'): - config_data['gw'] = c.return_value('network-settings client-ip-settings gateway-address') - if c.exists('network-settings dns-server primary-dns'): - config_data['dnsv4']['primary'] = c.return_value('network-settings dns-server primary-dns') - if c.exists('network-settings dns-server secondary-dns'): - config_data['dnsv4']['secondary'] = c.return_value('network-settings dns-server secondary-dns') - if c.exists('network-settings mtu'): - config_data['mtu'] = c.return_value('network-settings mtu') - - #### ppp - if c.exists('ppp-settings mppe'): - config_data['ppp']['mppe'] = c.return_value('ppp-settings mppe') - if c.exists('ppp-settings lcp-echo-failure'): - config_data['ppp']['lcp-echo-failure'] = c.return_value('ppp-settings lcp-echo-failure') - if c.exists('ppp-settings lcp-echo-interval'): - config_data['ppp']['lcp-echo-interval'] = c.return_value('ppp-settings lcp-echo-interval') - if c.exists('ppp-settings lcp-echo-timeout'): - config_data['ppp']['lcp-echo-timeout'] = c.return_value('ppp-settings lcp-echo-timeout') - - return config_data - -def verify(c): - if c == None: - return None - ### vertify auth settings - if c['authentication']['mode'] == 'local': - if not c['authentication']['local-users']: - raise ConfigError('sstp-server authentication local-users required') - - for usr in c['authentication']['local-users']: - if not c['authentication']['local-users'][usr]['passwd']: - raise ConfigError('user ' + usr + ' requires a password') - ### if up/download is set, check that both have a value - if c['authentication']['local-users'][usr]['upload']: - if not c['authentication']['local-users'][usr]['download']: - raise ConfigError('user ' + usr + ' requires download speed value') - if c['authentication']['local-users'][usr]['download']: - if not c['authentication']['local-users'][usr]['upload']: - raise ConfigError('user ' + usr + ' requires upload speed value') - - if not c['certs']['ca'] or not c['certs']['server-key'] or not c['certs']['server-cert']: - raise ConfigError('service sstp-server sstp-settings ssl-certs needs the ssl certificates set up') - else: - ssl_path = ssl_cert_dir + '/' - if not os.path.exists(ssl_path + c['certs']['ca']): - raise ConfigError('CA {0} doesn\'t exist'.format(ssl_path + c['certs']['ca'])) - if not os.path.exists(ssl_path + c['certs']['server-cert']): - raise ConfigError('SSL Cert {0} doesn\'t exist'.format(ssl_path + c['certs']['server-cert'])) - if not os.path.exists(ssl_path + c['certs']['server-cert']): - raise ConfigError('SSL Key {0} doesn\'t exist'.format(ssl_path + c['certs']['server-key'])) - - if c['authentication']['mode'] == 'radius': - if len(c['authentication']['radius-srv']) == 0: - raise ConfigError('service sstp-server authentication radius-server needs a value') - for rsrv in c['authentication']['radius-srv']: - if c['authentication']['radius-srv'][rsrv]['secret'] == None: - raise ConfigError('service sstp-server authentication radius-server {0} secret requires a value'.format(rsrv)) - - if c['authentication']['mode'] == 'local': - if not c['ip_pool']: - print ("WARNING: service sstp-server network-settings client-ip-settings subnet requires a value") - if not c['gw']: - print ("WARNING: service sstp-server network-settings client-ip-settings gateway-address requires a value") - -def generate(c): - if c == None: - return None - - ### accel-cmd reload doesn't work so any change results in a restart of the daemon - try: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - except KeyError: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - - tmpl = jinja2.Template(sstp_config, trim_blocks=True) - config_text = tmpl.render(c) - open(sstp_conf,'w').write(config_text) - - if c['authentication']['local-users']: - write_chap_secrets(c) - - return c - -def apply(c): - if c == None: - if os.path.exists(pidfile): - accel_cmd('shutdown hard') - if os.path.exists(pidfile): - os.remove(pidfile) - return None - - if not os.path.exists(pidfile): - ret = subprocess.call(['/usr/sbin/accel-pppd','-c',sstp_conf,'-p',pidfile,'-d']) - chk_con() - if ret !=0 and os.path.exists(pidfile): - os.remove(pidfile) - raise ConfigError('accel-pppd failed to start') - else: - accel_cmd('restart') - sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") - -if __name__ == '__main__': - try: - c = get_config() - verify(c) - generate(c) - apply(c) - except ConfigError as e: - print(e) - sys.exit(1) diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py new file mode 100755 index 000000000..12d62ad70 --- /dev/null +++ b/src/conf_mode/vpn_sstp.py @@ -0,0 +1,468 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2018-2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import sys +import os +import re +import subprocess +import jinja2 +import socket +import time +import syslog as sl + +from vyos.config import Config +from vyos import ConfigError + +pidfile = r'/var/run/accel_sstp.pid' +sstp_cnf_dir = r'/etc/accel-ppp/sstp' +chap_secrets = sstp_cnf_dir + '/chap-secrets' +sstp_conf = sstp_cnf_dir + '/sstp.config' +ssl_cert_dir = r'/config/user-data/sstp' + +### config path creation +if not os.path.exists(sstp_cnf_dir): + os.makedirs(sstp_cnf_dir) + sl.syslog(sl.LOG_NOTICE, sstp_cnf_dir + " created") + +if not os.path.exists(ssl_cert_dir): + os.makedirs(ssl_cert_dir) + sl.syslog(sl.LOG_NOTICE, ssl_cert_dir + " created") + +sstp_config = ''' +### generated by vpn_sstp.py ### +[modules] +log_syslog +sstp +ippool +shaper +{% if authentication['mode'] == 'local' %} +chap-secrets +{% endif -%} +{% for proto in authentication['auth_proto'] %} +{{proto}} +{% endfor %} +{% if authentication['mode'] == 'radius' %} +radius +{% endif %} + +[core] +thread-count={{thread_cnt}} + +[common] +single-session=replace + +[log] +syslog=accel-sstp,daemon +copy=1 +level=5 + +[client-ip-range] +disable + +[sstp] +verbose=1 +accept=ssl +{% if certs %} +ssl-ca-file=/config/user-data/sstp/{{certs['ca']}} +ssl-pemfile=/config/user-data/sstp/{{certs['server-cert']}} +ssl-keyfile=/config/user-data/sstp/{{certs['server-key']}} +{% endif %} + +{%if ip_pool %} +[ip-pool] +gw-ip-address={{gw}} +{% for sn in ip_pool %} +{{sn}} +{% endfor %} +{% endif %} + +{% if dnsv4 %} +[dns] +{% if dnsv4['primary'] %} +dns1={{dnsv4['primary']}} +{% endif -%} +{% if dnsv4['secondary'] %} +dns2={{dnsv4['secondary']}} +{% endif -%} +{% endif %} + +{% if authentication['mode'] == 'local' %} +[chap-secrets] +chap-secrets=/etc/accel-ppp/sstp/chap-secrets +{% endif %} + +{%- if authentication['mode'] == 'radius' %} +[radius] +verbose=1 +{% for rsrv in authentication['radius-srv']: %} +server={{rsrv}},{{authentication['radius-srv'][rsrv]['secret']}},\ +req-limit={{authentication['radius-srv'][rsrv]['req-limit']}},\ +fail-time={{authentication['radius-srv'][rsrv]['fail-time']}} +{% endfor -%} +{% if authentication['radiusopt']['acct-timeout'] %} +acct-timeout={{authentication['radiusopt']['acct-timeout']}} +{% endif -%} +{% if authentication['radiusopt']['timeout'] %} +timeout={{authentication['radiusopt']['timeout']}} +{% endif -%} +{% if authentication['radiusopt']['max-try'] %} +max-try={{authentication['radiusopt']['max-try']}} +{% endif -%} +{% if authentication['radiusopt']['nas-id'] %} +nas-identifier={{authentication['radiusopt']['nas-id']}} +{% endif -%} +{% if authentication['radiusopt']['nas-ip'] %} +nas-ip-address={{authentication['radiusopt']['nas-ip']}} +{% endif -%} +{% if authentication['radiusopt']['dae-srv'] %} +dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\ +{{authentication['radiusopt']['dae-srv']['port']}},\ +{{authentication['radiusopt']['dae-srv']['secret']}} +{% endif -%} +{% endif %} + +[ppp] +verbose=1 +check-ip=1 +{% if mtu %} +mtu={{mtu}} +{% endif -%} +{% if ppp['mppe'] %} +mppe={{ppp['mppe']}} +{% endif -%} +{% if ppp['lcp-echo-interval'] %} +lcp-echo-interval={{ppp['lcp-echo-interval']}} +{% endif -%} +{% if ppp['lcp-echo-failure'] %} +lcp-echo-failure={{ppp['lcp-echo-failure']}} +{% endif -%} +{% if ppp['lcp-echo-timeout'] %} +lcp-echo-timeout={{ppp['lcp-echo-timeout']}} +{% endif %} + +{% if authentication['radiusopt']['shaper'] %} +[shaper] +verbose=1 +attr={{authentication['radiusopt']['shaper']['attr']}} +{% if authentication['radiusopt']['shaper']['vendor'] %} +vendor={{authentication['radiusopt']['shaper']['vendor']}} +{% endif -%} +{% endif %} + +[cli] +tcp=127.0.0.1:2005 +''' + +### sstp chap secrets +chap_secrets_conf = ''' +# username server password acceptable local IP addresses shaper +{% for user in authentication['local-users'] %} +{% if authentication['local-users'][user]['state'] == 'enabled' %} +{% if (authentication['local-users'][user]['upload']) and (authentication['local-users'][user]['download']) %} +{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}}\t\ +{{authentication['local-users'][user]['download']}}/{{authentication['local-users'][user]['upload']}} +{% else %} +{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}} +{% endif %} +{% endif %} +{% endfor %} +''' +### +# inline helper functions +### +# depending on hw and threads, daemon needs a little to start +# if it takes longer than 100 * 0.5 secs, exception is being raised +# not sure if that's the best way to check it, but it worked so far quite well +### +def chk_con(): + cnt = 0 + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + while True: + try: + s.connect(("127.0.0.1", 2005)) + s.close() + break + except ConnectionRefusedError: + time.sleep(0.5) + cnt +=1 + if cnt == 100: + raise("failed to start sstp server") + break + +### chap_secrets file if auth mode local +def write_chap_secrets(c): + tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) + chap_secrets_txt = tmpl.render(c) + old_umask = os.umask(0o077) + open(chap_secrets,'w').write(chap_secrets_txt) + os.umask(old_umask) + sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') + +def accel_cmd(cmd=''): + if not cmd: + return None + try: + ret = subprocess.check_output(['/usr/bin/accel-cmd','-p','2005',cmd]).decode().strip() + return ret + except: + return 1 + +#### check ig local-ip is in client pool subnet + + +### +# inline helper functions end +### + +def get_config(): + base_path = ['vpn', 'sstp'] + c = Config() + if not c.exists(base_path): + return None + + c.set_level(base_path) + + config_data = { + 'authentication' : { + 'local-users' : { + }, + 'mode' : 'local', + 'auth_proto' : [], + 'radius-srv' : {}, + 'radiusopt' : {}, + 'dae-srv' : {} + }, + 'certs' : { + 'ca' : None, + 'server-key' : None, + 'server-cert' : None + }, + 'ip_pool' : [], + 'gw' : None, + 'dnsv4' : {}, + 'mtu' : None, + 'ppp' : {}, + } + + ### local auth + if c.exists('authentication mode local'): + if c.exists('authentication local-users'): + for usr in c.list_nodes('authentication local-users username'): + config_data['authentication']['local-users'].update( + { + usr : { + 'passwd' : None, + 'state' : 'enabled', + 'ip' : '*', + 'upload' : None, + 'download' : None + } + } + ) + if c.exists('authentication local-users username ' + usr + ' password'): + config_data['authentication']['local-users'][usr]['passwd'] = c.return_value('authentication local-users username ' + usr + ' password') + if c.exists('authentication local-users username ' + usr + ' disable'): + config_data['authentication']['local-users'][usr]['state'] = 'disable' + if c.exists('authentication local-users username ' + usr + ' static-ip'): + config_data['authentication']['local-users'][usr]['ip'] = c.return_value('authentication local-users username ' + usr + ' static-ip') + if c.exists('authentication local-users username ' + usr + ' rate-limit download'): + config_data['authentication']['local-users'][usr]['download'] = c.return_value('authentication local-users username ' + usr + ' rate-limit download') + if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): + config_data['authentication']['local-users'][usr]['upload'] = c.return_value('authentication local-users username ' + usr + ' rate-limit upload') + + if c.exists('authentication protocols'): + auth_mods = {'pap' : 'pap','chap' : 'auth_chap_md5', 'mschap' : 'auth_mschap_v1', 'mschap-v2' : 'auth_mschap_v2'} + for proto in c.return_values('authentication protocols'): + config_data['authentication']['auth_proto'].append(auth_mods[proto]) + else: + config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] + + #### RADIUS auth and settings + if c.exists('authentication mode radius'): + config_data['authentication']['mode'] = c.return_value('authentication mode') + if c.exists('authentication radius-server'): + for rsrv in c.list_nodes('authentication radius-server'): + config_data['authentication']['radius-srv'][rsrv] = {} + if c.exists('authentication radius-server ' + rsrv + ' secret'): + config_data['authentication']['radius-srv'][rsrv]['secret'] = c.return_value('authentication radius-server ' + rsrv + ' secret') + else: + config_data['authentication']['radius-srv'][rsrv]['secret'] = None + if c.exists('authentication radius-server ' + rsrv + ' fail-time'): + config_data['authentication']['radius-srv'][rsrv]['fail-time'] = c.return_value('authentication radius-server ' + rsrv + ' fail-time') + else: + config_data['authentication']['radius-srv'][rsrv]['fail-time'] = 0 + if c.exists('authentication radius-server ' + rsrv + ' req-limit'): + config_data['authentication']['radius-srv'][rsrv]['req-limit'] = c.return_value('authentication radius-server ' + rsrv + ' req-limit') + else: + config_data['authentication']['radius-srv'][rsrv]['req-limit'] = 0 + + #### advanced radius-setting + if c.exists('authentication radius-settings'): + if c.exists('authentication radius-settings acct-timeout'): + config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value('authentication radius-settings acct-timeout') + if c.exists('authentication radius-settings max-try'): + config_data['authentication']['radiusopt']['max-try'] = c.return_value('authentication radius-settings max-try') + if c.exists('authentication radius-settings timeout'): + config_data['authentication']['radiusopt']['timeout'] = c.return_value('authentication radius-settings timeout') + if c.exists('authentication radius-settings nas-identifier'): + config_data['authentication']['radiusopt']['nas-id'] = c.return_value('authentication radius-settings nas-identifier') + if c.exists('authentication radius-settings nas-ip-address'): + config_data['authentication']['radiusopt']['nas-ip'] = c.return_value('authentication radius-settings nas-ip-address') + if c.exists('authentication radius-settings dae-server'): + config_data['authentication']['radiusopt'].update( + { + 'dae-srv' : { + 'ip-addr' : c.return_value('authentication radius-settings dae-server ip-address'), + 'port' : c.return_value('authentication radius-settings dae-server port'), + 'secret' : str(c.return_value('authentication radius-settings dae-server secret')) + } + } + ) + if c.exists('authentication radius-settings rate-limit enable'): + if not c.exists('authentication radius-settings rate-limit attribute'): + config_data['authentication']['radiusopt']['shaper'] = { 'attr' : 'Filter-Id' } + else: + config_data['authentication']['radiusopt']['shaper'] = { + 'attr' : c.return_value('authentication radius-settings rate-limit attribute') + } + if c.exists('authentication radius-settings rate-limit vendor'): + config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value('authentication radius-settings rate-limit vendor') + + if c.exists('sstp-settings ssl-certs ca'): + config_data['certs']['ca'] = c.return_value('sstp-settings ssl-certs ca') + if c.exists('sstp-settings ssl-certs server-cert'): + config_data['certs']['server-cert'] = c.return_value('sstp-settings ssl-certs server-cert') + if c.exists('sstp-settings ssl-certs server-key'): + config_data['certs']['server-key'] = c.return_value('sstp-settings ssl-certs server-key') + + if c.exists('network-settings client-ip-settings subnet'): + config_data['ip_pool'] = c.return_values('network-settings client-ip-settings subnet') + if c.exists('network-settings client-ip-settings gateway-address'): + config_data['gw'] = c.return_value('network-settings client-ip-settings gateway-address') + if c.exists('network-settings dns-server primary-dns'): + config_data['dnsv4']['primary'] = c.return_value('network-settings dns-server primary-dns') + if c.exists('network-settings dns-server secondary-dns'): + config_data['dnsv4']['secondary'] = c.return_value('network-settings dns-server secondary-dns') + if c.exists('network-settings mtu'): + config_data['mtu'] = c.return_value('network-settings mtu') + + #### ppp + if c.exists('ppp-settings mppe'): + config_data['ppp']['mppe'] = c.return_value('ppp-settings mppe') + if c.exists('ppp-settings lcp-echo-failure'): + config_data['ppp']['lcp-echo-failure'] = c.return_value('ppp-settings lcp-echo-failure') + if c.exists('ppp-settings lcp-echo-interval'): + config_data['ppp']['lcp-echo-interval'] = c.return_value('ppp-settings lcp-echo-interval') + if c.exists('ppp-settings lcp-echo-timeout'): + config_data['ppp']['lcp-echo-timeout'] = c.return_value('ppp-settings lcp-echo-timeout') + + return config_data + +def verify(c): + if c == None: + return None + ### vertify auth settings + if c['authentication']['mode'] == 'local': + if not c['authentication']['local-users']: + raise ConfigError('sstp-server authentication local-users required') + + for usr in c['authentication']['local-users']: + if not c['authentication']['local-users'][usr]['passwd']: + raise ConfigError('user ' + usr + ' requires a password') + ### if up/download is set, check that both have a value + if c['authentication']['local-users'][usr]['upload']: + if not c['authentication']['local-users'][usr]['download']: + raise ConfigError('user ' + usr + ' requires download speed value') + if c['authentication']['local-users'][usr]['download']: + if not c['authentication']['local-users'][usr]['upload']: + raise ConfigError('user ' + usr + ' requires upload speed value') + + if not c['certs']['ca'] or not c['certs']['server-key'] or not c['certs']['server-cert']: + raise ConfigError('service sstp-server sstp-settings ssl-certs needs the ssl certificates set up') + else: + ssl_path = ssl_cert_dir + '/' + if not os.path.exists(ssl_path + c['certs']['ca']): + raise ConfigError('CA {0} doesn\'t exist'.format(ssl_path + c['certs']['ca'])) + if not os.path.exists(ssl_path + c['certs']['server-cert']): + raise ConfigError('SSL Cert {0} doesn\'t exist'.format(ssl_path + c['certs']['server-cert'])) + if not os.path.exists(ssl_path + c['certs']['server-cert']): + raise ConfigError('SSL Key {0} doesn\'t exist'.format(ssl_path + c['certs']['server-key'])) + + if c['authentication']['mode'] == 'radius': + if len(c['authentication']['radius-srv']) == 0: + raise ConfigError('service sstp-server authentication radius-server needs a value') + for rsrv in c['authentication']['radius-srv']: + if c['authentication']['radius-srv'][rsrv]['secret'] == None: + raise ConfigError('service sstp-server authentication radius-server {0} secret requires a value'.format(rsrv)) + + if c['authentication']['mode'] == 'local': + if not c['ip_pool']: + print ("WARNING: service sstp-server network-settings client-ip-settings subnet requires a value") + if not c['gw']: + print ("WARNING: service sstp-server network-settings client-ip-settings gateway-address requires a value") + +def generate(c): + if c == None: + return None + + ### accel-cmd reload doesn't work so any change results in a restart of the daemon + try: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + except KeyError: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + + tmpl = jinja2.Template(sstp_config, trim_blocks=True) + config_text = tmpl.render(c) + open(sstp_conf,'w').write(config_text) + + if c['authentication']['local-users']: + write_chap_secrets(c) + + return c + +def apply(c): + if c == None: + if os.path.exists(pidfile): + accel_cmd('shutdown hard') + if os.path.exists(pidfile): + os.remove(pidfile) + return None + + if not os.path.exists(pidfile): + ret = subprocess.call(['/usr/sbin/accel-pppd','-c',sstp_conf,'-p',pidfile,'-d']) + chk_con() + if ret !=0 and os.path.exists(pidfile): + os.remove(pidfile) + raise ConfigError('accel-pppd failed to start') + else: + accel_cmd('restart') + sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3 From 106406d46ba594b86056e3341314e9615a501dd5 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 17:44:25 +0100 Subject: sstp: T2008: dns: unwind configuration --- interface-definitions/vpn-sstp.xml.in | 28 +++++----------------------- src/conf_mode/vpn_sstp.py | 21 ++++++++++----------- src/migration-scripts/sstp/0-to-1 | 13 +++++++++++++ 3 files changed, 28 insertions(+), 34 deletions(-) (limited to 'src/conf_mode') diff --git a/interface-definitions/vpn-sstp.xml.in b/interface-definitions/vpn-sstp.xml.in index c7c3c3ea5..e2d6aa75e 100644 --- a/interface-definitions/vpn-sstp.xml.in +++ b/interface-definitions/vpn-sstp.xml.in @@ -5,7 +5,7 @@ Secure Socket Tunneling Protocol (SSTP) server - 900 + 901 @@ -318,14 +318,9 @@ - + DNS servers propagated to clients - - - - - Primary DNS Server ipv4 IPv4 address @@ -333,22 +328,9 @@ - - - - - Secondary DNS Server - - ipv4 - IPv4 address - - - - - - - - + + + #include diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 12d62ad70..e0ebb2ad9 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -91,12 +91,9 @@ gw-ip-address={{gw}} {% if dnsv4 %} [dns] -{% if dnsv4['primary'] %} -dns1={{dnsv4['primary']}} -{% endif -%} -{% if dnsv4['secondary'] %} -dns2={{dnsv4['secondary']}} -{% endif -%} +{% for dns in dnsv4 -%} +dns{{ loop.index }}={{ dns }} +{% endfor -%} {% endif %} {% if authentication['mode'] == 'local' %} @@ -252,7 +249,7 @@ def get_config(): }, 'ip_pool' : [], 'gw' : None, - 'dnsv4' : {}, + 'dnsv4' : [], 'mtu' : None, 'ppp' : {}, } @@ -352,10 +349,8 @@ def get_config(): config_data['ip_pool'] = c.return_values('network-settings client-ip-settings subnet') if c.exists('network-settings client-ip-settings gateway-address'): config_data['gw'] = c.return_value('network-settings client-ip-settings gateway-address') - if c.exists('network-settings dns-server primary-dns'): - config_data['dnsv4']['primary'] = c.return_value('network-settings dns-server primary-dns') - if c.exists('network-settings dns-server secondary-dns'): - config_data['dnsv4']['secondary'] = c.return_value('network-settings dns-server secondary-dns') + if c.exists('network-settings name-server'): + config_data['dnsv4'] = c.return_values('network-settings name-server') if c.exists('network-settings mtu'): config_data['mtu'] = c.return_value('network-settings mtu') @@ -374,6 +369,7 @@ def get_config(): def verify(c): if c == None: return None + ### vertify auth settings if c['authentication']['mode'] == 'local': if not c['authentication']['local-users']: @@ -390,6 +386,9 @@ def verify(c): if not c['authentication']['local-users'][usr]['upload']: raise ConfigError('user ' + usr + ' requires upload speed value') + if len(c['dnsv4']) > 2: + raise ConfigError("Only 2 DNS name-servers can be configured") + if not c['certs']['ca'] or not c['certs']['server-key'] or not c['certs']['server-cert']: raise ConfigError('service sstp-server sstp-settings ssl-certs needs the ssl certificates set up') else: diff --git a/src/migration-scripts/sstp/0-to-1 b/src/migration-scripts/sstp/0-to-1 index 0fe1a203f..88d3b4fb4 100755 --- a/src/migration-scripts/sstp/0-to-1 +++ b/src/migration-scripts/sstp/0-to-1 @@ -45,6 +45,19 @@ else: config.copy(old_base, new_base) config.delete(old_base) + # migrate DNS servers + dns_base = new_base + ['network-settings', 'dns-server'] + if config.exists(dns_base): + if config.exists(dns_base + ['primary-dns']): + dns = config.return_value(dns_base + ['primary-dns']) + config.set(new_base + ['network-settings', 'name-server'], value=dns, replace=False) + + if config.exists(dns_base + ['secondary-dns']): + dns = config.return_value(dns_base + ['secondary-dns']) + config.set(new_base + ['network-settings', 'name-server'], value=dns, replace=False) + + config.delete(dns_base) + print(config.to_string()) sys.exit(1) -- cgit v1.2.3 From 7fc6a185b599cea761817a5a9bb3ed5beb3456aa Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 17:50:38 +0100 Subject: sstp: T2008: use pep8 formatting --- src/conf_mode/vpn_sstp.py | 573 +++++++++++++++++++++++++--------------------- 1 file changed, 310 insertions(+), 263 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index e0ebb2ad9..05bf65fde 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -32,14 +32,14 @@ chap_secrets = sstp_cnf_dir + '/chap-secrets' sstp_conf = sstp_cnf_dir + '/sstp.config' ssl_cert_dir = r'/config/user-data/sstp' -### config path creation +# config path creation if not os.path.exists(sstp_cnf_dir): - os.makedirs(sstp_cnf_dir) - sl.syslog(sl.LOG_NOTICE, sstp_cnf_dir + " created") + os.makedirs(sstp_cnf_dir) + sl.syslog(sl.LOG_NOTICE, sstp_cnf_dir + " created") if not os.path.exists(ssl_cert_dir): - os.makedirs(ssl_cert_dir) - sl.syslog(sl.LOG_NOTICE, ssl_cert_dir + " created") + os.makedirs(ssl_cert_dir) + sl.syslog(sl.LOG_NOTICE, ssl_cert_dir + " created") sstp_config = ''' ### generated by vpn_sstp.py ### @@ -163,7 +163,7 @@ vendor={{authentication['radiusopt']['shaper']['vendor']}} tcp=127.0.0.1:2005 ''' -### sstp chap secrets +# sstp chap secrets chap_secrets_conf = ''' # username server password acceptable local IP addresses shaper {% for user in authentication['local-users'] %} @@ -184,40 +184,46 @@ chap_secrets_conf = ''' # if it takes longer than 100 * 0.5 secs, exception is being raised # not sure if that's the best way to check it, but it worked so far quite well ### + + def chk_con(): - cnt = 0 - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - while True: - try: - s.connect(("127.0.0.1", 2005)) - s.close() - break - except ConnectionRefusedError: - time.sleep(0.5) - cnt +=1 - if cnt == 100: - raise("failed to start sstp server") - break - -### chap_secrets file if auth mode local + cnt = 0 + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + while True: + try: + s.connect(("127.0.0.1", 2005)) + s.close() + break + except ConnectionRefusedError: + time.sleep(0.5) + cnt += 1 + if cnt == 100: + raise("failed to start sstp server") + break + +# chap_secrets file if auth mode local + + def write_chap_secrets(c): - tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) - chap_secrets_txt = tmpl.render(c) - old_umask = os.umask(0o077) - open(chap_secrets,'w').write(chap_secrets_txt) - os.umask(old_umask) - sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') + tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) + chap_secrets_txt = tmpl.render(c) + old_umask = os.umask(0o077) + open(chap_secrets, 'w').write(chap_secrets_txt) + os.umask(old_umask) + sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') + def accel_cmd(cmd=''): - if not cmd: - return None - try: - ret = subprocess.check_output(['/usr/bin/accel-cmd','-p','2005',cmd]).decode().strip() - return ret - except: - return 1 + if not cmd: + return None + try: + ret = subprocess.check_output( + ['/usr/bin/accel-cmd', '-p', '2005', cmd]).decode().strip() + return ret + except: + return 1 -#### check ig local-ip is in client pool subnet +# check ig local-ip is in client pool subnet ### @@ -225,243 +231,284 @@ def accel_cmd(cmd=''): ### def get_config(): - base_path = ['vpn', 'sstp'] - c = Config() - if not c.exists(base_path): - return None - - c.set_level(base_path) - - config_data = { - 'authentication' : { - 'local-users' : { - }, - 'mode' : 'local', - 'auth_proto' : [], - 'radius-srv' : {}, - 'radiusopt' : {}, - 'dae-srv' : {} - }, - 'certs' : { - 'ca' : None, - 'server-key' : None, - 'server-cert' : None - }, - 'ip_pool' : [], - 'gw' : None, - 'dnsv4' : [], - 'mtu' : None, - 'ppp' : {}, - } - - ### local auth - if c.exists('authentication mode local'): - if c.exists('authentication local-users'): - for usr in c.list_nodes('authentication local-users username'): - config_data['authentication']['local-users'].update( - { - usr : { - 'passwd' : None, - 'state' : 'enabled', - 'ip' : '*', - 'upload' : None, - 'download' : None - } - } - ) - if c.exists('authentication local-users username ' + usr + ' password'): - config_data['authentication']['local-users'][usr]['passwd'] = c.return_value('authentication local-users username ' + usr + ' password') - if c.exists('authentication local-users username ' + usr + ' disable'): - config_data['authentication']['local-users'][usr]['state'] = 'disable' - if c.exists('authentication local-users username ' + usr + ' static-ip'): - config_data['authentication']['local-users'][usr]['ip'] = c.return_value('authentication local-users username ' + usr + ' static-ip') - if c.exists('authentication local-users username ' + usr + ' rate-limit download'): - config_data['authentication']['local-users'][usr]['download'] = c.return_value('authentication local-users username ' + usr + ' rate-limit download') - if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): - config_data['authentication']['local-users'][usr]['upload'] = c.return_value('authentication local-users username ' + usr + ' rate-limit upload') - - if c.exists('authentication protocols'): - auth_mods = {'pap' : 'pap','chap' : 'auth_chap_md5', 'mschap' : 'auth_mschap_v1', 'mschap-v2' : 'auth_mschap_v2'} - for proto in c.return_values('authentication protocols'): - config_data['authentication']['auth_proto'].append(auth_mods[proto]) - else: - config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] - - #### RADIUS auth and settings - if c.exists('authentication mode radius'): - config_data['authentication']['mode'] = c.return_value('authentication mode') - if c.exists('authentication radius-server'): - for rsrv in c.list_nodes('authentication radius-server'): - config_data['authentication']['radius-srv'][rsrv] = {} - if c.exists('authentication radius-server ' + rsrv + ' secret'): - config_data['authentication']['radius-srv'][rsrv]['secret'] = c.return_value('authentication radius-server ' + rsrv + ' secret') - else: - config_data['authentication']['radius-srv'][rsrv]['secret'] = None - if c.exists('authentication radius-server ' + rsrv + ' fail-time'): - config_data['authentication']['radius-srv'][rsrv]['fail-time'] = c.return_value('authentication radius-server ' + rsrv + ' fail-time') - else: - config_data['authentication']['radius-srv'][rsrv]['fail-time'] = 0 - if c.exists('authentication radius-server ' + rsrv + ' req-limit'): - config_data['authentication']['radius-srv'][rsrv]['req-limit'] = c.return_value('authentication radius-server ' + rsrv + ' req-limit') - else: - config_data['authentication']['radius-srv'][rsrv]['req-limit'] = 0 - - #### advanced radius-setting - if c.exists('authentication radius-settings'): - if c.exists('authentication radius-settings acct-timeout'): - config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value('authentication radius-settings acct-timeout') - if c.exists('authentication radius-settings max-try'): - config_data['authentication']['radiusopt']['max-try'] = c.return_value('authentication radius-settings max-try') - if c.exists('authentication radius-settings timeout'): - config_data['authentication']['radiusopt']['timeout'] = c.return_value('authentication radius-settings timeout') - if c.exists('authentication radius-settings nas-identifier'): - config_data['authentication']['radiusopt']['nas-id'] = c.return_value('authentication radius-settings nas-identifier') - if c.exists('authentication radius-settings nas-ip-address'): - config_data['authentication']['radiusopt']['nas-ip'] = c.return_value('authentication radius-settings nas-ip-address') - if c.exists('authentication radius-settings dae-server'): - config_data['authentication']['radiusopt'].update( - { - 'dae-srv' : { - 'ip-addr' : c.return_value('authentication radius-settings dae-server ip-address'), - 'port' : c.return_value('authentication radius-settings dae-server port'), - 'secret' : str(c.return_value('authentication radius-settings dae-server secret')) - } - } - ) - if c.exists('authentication radius-settings rate-limit enable'): - if not c.exists('authentication radius-settings rate-limit attribute'): - config_data['authentication']['radiusopt']['shaper'] = { 'attr' : 'Filter-Id' } - else: - config_data['authentication']['radiusopt']['shaper'] = { - 'attr' : c.return_value('authentication radius-settings rate-limit attribute') - } - if c.exists('authentication radius-settings rate-limit vendor'): - config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value('authentication radius-settings rate-limit vendor') - - if c.exists('sstp-settings ssl-certs ca'): - config_data['certs']['ca'] = c.return_value('sstp-settings ssl-certs ca') - if c.exists('sstp-settings ssl-certs server-cert'): - config_data['certs']['server-cert'] = c.return_value('sstp-settings ssl-certs server-cert') - if c.exists('sstp-settings ssl-certs server-key'): - config_data['certs']['server-key'] = c.return_value('sstp-settings ssl-certs server-key') - - if c.exists('network-settings client-ip-settings subnet'): - config_data['ip_pool'] = c.return_values('network-settings client-ip-settings subnet') - if c.exists('network-settings client-ip-settings gateway-address'): - config_data['gw'] = c.return_value('network-settings client-ip-settings gateway-address') - if c.exists('network-settings name-server'): - config_data['dnsv4'] = c.return_values('network-settings name-server') - if c.exists('network-settings mtu'): - config_data['mtu'] = c.return_value('network-settings mtu') - - #### ppp - if c.exists('ppp-settings mppe'): - config_data['ppp']['mppe'] = c.return_value('ppp-settings mppe') - if c.exists('ppp-settings lcp-echo-failure'): - config_data['ppp']['lcp-echo-failure'] = c.return_value('ppp-settings lcp-echo-failure') - if c.exists('ppp-settings lcp-echo-interval'): - config_data['ppp']['lcp-echo-interval'] = c.return_value('ppp-settings lcp-echo-interval') - if c.exists('ppp-settings lcp-echo-timeout'): - config_data['ppp']['lcp-echo-timeout'] = c.return_value('ppp-settings lcp-echo-timeout') - - return config_data + base_path = ['vpn', 'sstp'] + c = Config() + if not c.exists(base_path): + return None + + c.set_level(base_path) + + config_data = { + 'authentication': { + 'local-users': { + }, + 'mode': 'local', + 'auth_proto': [], + 'radius-srv': {}, + 'radiusopt': {}, + 'dae-srv': {} + }, + 'certs': { + 'ca': None, + 'server-key': None, + 'server-cert': None + }, + 'ip_pool': [], + 'gw': None, + 'dnsv4': [], + 'mtu': None, + 'ppp': {}, + } + + # local auth + if c.exists('authentication mode local'): + if c.exists('authentication local-users'): + for usr in c.list_nodes('authentication local-users username'): + config_data['authentication']['local-users'].update( + { + usr: { + 'passwd': None, + 'state': 'enabled', + 'ip': '*', + 'upload': None, + 'download': None + } + } + ) + if c.exists('authentication local-users username ' + usr + ' password'): + config_data['authentication']['local-users'][usr]['passwd'] = c.return_value( + 'authentication local-users username ' + usr + ' password') + if c.exists('authentication local-users username ' + usr + ' disable'): + config_data['authentication']['local-users'][usr]['state'] = 'disable' + if c.exists('authentication local-users username ' + usr + ' static-ip'): + config_data['authentication']['local-users'][usr]['ip'] = c.return_value( + 'authentication local-users username ' + usr + ' static-ip') + if c.exists('authentication local-users username ' + usr + ' rate-limit download'): + config_data['authentication']['local-users'][usr]['download'] = c.return_value( + 'authentication local-users username ' + usr + ' rate-limit download') + if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): + config_data['authentication']['local-users'][usr]['upload'] = c.return_value( + 'authentication local-users username ' + usr + ' rate-limit upload') + + if c.exists('authentication protocols'): + auth_mods = {'pap': 'pap', 'chap': 'auth_chap_md5', + 'mschap': 'auth_mschap_v1', 'mschap-v2': 'auth_mschap_v2'} + for proto in c.return_values('authentication protocols'): + config_data['authentication']['auth_proto'].append( + auth_mods[proto]) + else: + config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] + + # RADIUS auth and settings + if c.exists('authentication mode radius'): + config_data['authentication']['mode'] = c.return_value( + 'authentication mode') + if c.exists('authentication radius-server'): + for rsrv in c.list_nodes('authentication radius-server'): + config_data['authentication']['radius-srv'][rsrv] = {} + if c.exists('authentication radius-server ' + rsrv + ' secret'): + config_data['authentication']['radius-srv'][rsrv]['secret'] = c.return_value( + 'authentication radius-server ' + rsrv + ' secret') + else: + config_data['authentication']['radius-srv'][rsrv]['secret'] = None + if c.exists('authentication radius-server ' + rsrv + ' fail-time'): + config_data['authentication']['radius-srv'][rsrv]['fail-time'] = c.return_value( + 'authentication radius-server ' + rsrv + ' fail-time') + else: + config_data['authentication']['radius-srv'][rsrv]['fail-time'] = 0 + if c.exists('authentication radius-server ' + rsrv + ' req-limit'): + config_data['authentication']['radius-srv'][rsrv]['req-limit'] = c.return_value( + 'authentication radius-server ' + rsrv + ' req-limit') + else: + config_data['authentication']['radius-srv'][rsrv]['req-limit'] = 0 + + # advanced radius-setting + if c.exists('authentication radius-settings'): + if c.exists('authentication radius-settings acct-timeout'): + config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value( + 'authentication radius-settings acct-timeout') + if c.exists('authentication radius-settings max-try'): + config_data['authentication']['radiusopt']['max-try'] = c.return_value( + 'authentication radius-settings max-try') + if c.exists('authentication radius-settings timeout'): + config_data['authentication']['radiusopt']['timeout'] = c.return_value( + 'authentication radius-settings timeout') + if c.exists('authentication radius-settings nas-identifier'): + config_data['authentication']['radiusopt']['nas-id'] = c.return_value( + 'authentication radius-settings nas-identifier') + if c.exists('authentication radius-settings nas-ip-address'): + config_data['authentication']['radiusopt']['nas-ip'] = c.return_value( + 'authentication radius-settings nas-ip-address') + if c.exists('authentication radius-settings dae-server'): + config_data['authentication']['radiusopt'].update( + { + 'dae-srv': { + 'ip-addr': c.return_value('authentication radius-settings dae-server ip-address'), + 'port': c.return_value('authentication radius-settings dae-server port'), + 'secret': str(c.return_value('authentication radius-settings dae-server secret')) + } + } + ) + if c.exists('authentication radius-settings rate-limit enable'): + if not c.exists('authentication radius-settings rate-limit attribute'): + config_data['authentication']['radiusopt']['shaper'] = { + 'attr': 'Filter-Id'} + else: + config_data['authentication']['radiusopt']['shaper'] = { + 'attr': c.return_value('authentication radius-settings rate-limit attribute') + } + if c.exists('authentication radius-settings rate-limit vendor'): + config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( + 'authentication radius-settings rate-limit vendor') + + if c.exists('sstp-settings ssl-certs ca'): + config_data['certs']['ca'] = c.return_value( + 'sstp-settings ssl-certs ca') + if c.exists('sstp-settings ssl-certs server-cert'): + config_data['certs']['server-cert'] = c.return_value( + 'sstp-settings ssl-certs server-cert') + if c.exists('sstp-settings ssl-certs server-key'): + config_data['certs']['server-key'] = c.return_value( + 'sstp-settings ssl-certs server-key') + + if c.exists('network-settings client-ip-settings subnet'): + config_data['ip_pool'] = c.return_values( + 'network-settings client-ip-settings subnet') + if c.exists('network-settings client-ip-settings gateway-address'): + config_data['gw'] = c.return_value( + 'network-settings client-ip-settings gateway-address') + if c.exists('network-settings name-server'): + config_data['dnsv4'] = c.return_values('network-settings name-server') + if c.exists('network-settings mtu'): + config_data['mtu'] = c.return_value('network-settings mtu') + + # ppp + if c.exists('ppp-settings mppe'): + config_data['ppp']['mppe'] = c.return_value('ppp-settings mppe') + if c.exists('ppp-settings lcp-echo-failure'): + config_data['ppp']['lcp-echo-failure'] = c.return_value( + 'ppp-settings lcp-echo-failure') + if c.exists('ppp-settings lcp-echo-interval'): + config_data['ppp']['lcp-echo-interval'] = c.return_value( + 'ppp-settings lcp-echo-interval') + if c.exists('ppp-settings lcp-echo-timeout'): + config_data['ppp']['lcp-echo-timeout'] = c.return_value( + 'ppp-settings lcp-echo-timeout') + + return config_data + def verify(c): - if c == None: - return None - - ### vertify auth settings - if c['authentication']['mode'] == 'local': - if not c['authentication']['local-users']: - raise ConfigError('sstp-server authentication local-users required') - - for usr in c['authentication']['local-users']: - if not c['authentication']['local-users'][usr]['passwd']: - raise ConfigError('user ' + usr + ' requires a password') - ### if up/download is set, check that both have a value - if c['authentication']['local-users'][usr]['upload']: - if not c['authentication']['local-users'][usr]['download']: - raise ConfigError('user ' + usr + ' requires download speed value') - if c['authentication']['local-users'][usr]['download']: - if not c['authentication']['local-users'][usr]['upload']: - raise ConfigError('user ' + usr + ' requires upload speed value') - - if len(c['dnsv4']) > 2: - raise ConfigError("Only 2 DNS name-servers can be configured") - - if not c['certs']['ca'] or not c['certs']['server-key'] or not c['certs']['server-cert']: - raise ConfigError('service sstp-server sstp-settings ssl-certs needs the ssl certificates set up') - else: - ssl_path = ssl_cert_dir + '/' - if not os.path.exists(ssl_path + c['certs']['ca']): - raise ConfigError('CA {0} doesn\'t exist'.format(ssl_path + c['certs']['ca'])) - if not os.path.exists(ssl_path + c['certs']['server-cert']): - raise ConfigError('SSL Cert {0} doesn\'t exist'.format(ssl_path + c['certs']['server-cert'])) - if not os.path.exists(ssl_path + c['certs']['server-cert']): - raise ConfigError('SSL Key {0} doesn\'t exist'.format(ssl_path + c['certs']['server-key'])) - - if c['authentication']['mode'] == 'radius': - if len(c['authentication']['radius-srv']) == 0: - raise ConfigError('service sstp-server authentication radius-server needs a value') - for rsrv in c['authentication']['radius-srv']: - if c['authentication']['radius-srv'][rsrv]['secret'] == None: - raise ConfigError('service sstp-server authentication radius-server {0} secret requires a value'.format(rsrv)) - - if c['authentication']['mode'] == 'local': - if not c['ip_pool']: - print ("WARNING: service sstp-server network-settings client-ip-settings subnet requires a value") - if not c['gw']: - print ("WARNING: service sstp-server network-settings client-ip-settings gateway-address requires a value") + if c == None: + return None + + # vertify auth settings + if c['authentication']['mode'] == 'local': + if not c['authentication']['local-users']: + raise ConfigError( + 'sstp-server authentication local-users required') + + for usr in c['authentication']['local-users']: + if not c['authentication']['local-users'][usr]['passwd']: + raise ConfigError('user ' + usr + ' requires a password') + # if up/download is set, check that both have a value + if c['authentication']['local-users'][usr]['upload']: + if not c['authentication']['local-users'][usr]['download']: + raise ConfigError( + 'user ' + usr + ' requires download speed value') + if c['authentication']['local-users'][usr]['download']: + if not c['authentication']['local-users'][usr]['upload']: + raise ConfigError( + 'user ' + usr + ' requires upload speed value') + + if len(c['dnsv4']) > 2: + raise ConfigError("Only 2 DNS name-servers can be configured") + + if not c['certs']['ca'] or not c['certs']['server-key'] or not c['certs']['server-cert']: + raise ConfigError( + 'service sstp-server sstp-settings ssl-certs needs the ssl certificates set up') + else: + ssl_path = ssl_cert_dir + '/' + if not os.path.exists(ssl_path + c['certs']['ca']): + raise ConfigError('CA {0} doesn\'t exist'.format( + ssl_path + c['certs']['ca'])) + if not os.path.exists(ssl_path + c['certs']['server-cert']): + raise ConfigError('SSL Cert {0} doesn\'t exist'.format( + ssl_path + c['certs']['server-cert'])) + if not os.path.exists(ssl_path + c['certs']['server-cert']): + raise ConfigError('SSL Key {0} doesn\'t exist'.format( + ssl_path + c['certs']['server-key'])) + + if c['authentication']['mode'] == 'radius': + if len(c['authentication']['radius-srv']) == 0: + raise ConfigError( + 'service sstp-server authentication radius-server needs a value') + for rsrv in c['authentication']['radius-srv']: + if c['authentication']['radius-srv'][rsrv]['secret'] == None: + raise ConfigError( + 'service sstp-server authentication radius-server {0} secret requires a value'.format(rsrv)) + + if c['authentication']['mode'] == 'local': + if not c['ip_pool']: + print ( + "WARNING: service sstp-server network-settings client-ip-settings subnet requires a value") + if not c['gw']: + print ( + "WARNING: service sstp-server network-settings client-ip-settings gateway-address requires a value") + def generate(c): - if c == None: - return None + if c == None: + return None - ### accel-cmd reload doesn't work so any change results in a restart of the daemon - try: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - except KeyError: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) + # accel-cmd reload doesn't work so any change results in a restart of the daemon + try: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + except KeyError: + if os.cpu_count() == 1: + c['thread_cnt'] = 1 + else: + c['thread_cnt'] = int(os.cpu_count()/2) + + tmpl = jinja2.Template(sstp_config, trim_blocks=True) + config_text = tmpl.render(c) + open(sstp_conf, 'w').write(config_text) - tmpl = jinja2.Template(sstp_config, trim_blocks=True) - config_text = tmpl.render(c) - open(sstp_conf,'w').write(config_text) + if c['authentication']['local-users']: + write_chap_secrets(c) - if c['authentication']['local-users']: - write_chap_secrets(c) + return c - return c def apply(c): - if c == None: - if os.path.exists(pidfile): - accel_cmd('shutdown hard') - if os.path.exists(pidfile): - os.remove(pidfile) - return None - - if not os.path.exists(pidfile): - ret = subprocess.call(['/usr/sbin/accel-pppd','-c',sstp_conf,'-p',pidfile,'-d']) - chk_con() - if ret !=0 and os.path.exists(pidfile): - os.remove(pidfile) - raise ConfigError('accel-pppd failed to start') - else: - accel_cmd('restart') - sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + if c == None: + if os.path.exists(pidfile): + accel_cmd('shutdown hard') + if os.path.exists(pidfile): + os.remove(pidfile) + return None + + if not os.path.exists(pidfile): + ret = subprocess.call( + ['/usr/sbin/accel-pppd', '-c', sstp_conf, '-p', pidfile, '-d']) + chk_con() + if ret != 0 and os.path.exists(pidfile): + os.remove(pidfile) + raise ConfigError('accel-pppd failed to start') + else: + accel_cmd('restart') + sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") + if __name__ == '__main__': - try: - c = get_config() - verify(c) - generate(c) - apply(c) - except ConfigError as e: - print(e) - sys.exit(1) + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + sys.exit(1) -- cgit v1.2.3 From e30294fd2ea128c127d5b6af5cad56f835080181 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 17:58:08 +0100 Subject: ntp: only import deepcopy from copy --- src/conf_mode/ntp.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/ntp.py b/src/conf_mode/ntp.py index f706d502f..c3e8d51b3 100755 --- a/src/conf_mode/ntp.py +++ b/src/conf_mode/ntp.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 # -# Copyright (C) 2018 VyOS maintainers and contributors +# Copyright (C) 2018-2020 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as @@ -13,15 +13,13 @@ # # You should have received a copy of the GNU General Public License # along with this program. If not, see . -# -# import sys import os - import jinja2 import ipaddress -import copy + +from copy import deepcopy from vyos.config import Config from vyos import ConfigError @@ -78,7 +76,7 @@ default_config_data = { } def get_config(): - ntp = copy.deepcopy(default_config_data) + ntp = deepcopy(default_config_data) conf = Config() if not conf.exists('system ntp'): return None -- cgit v1.2.3 From 806f912d8bf1af148623bd0d2e14dbdeaa059a6f Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 18:01:29 +0100 Subject: sstp: T2008: adjust config syntax to common style --- src/conf_mode/vpn_sstp.py | 707 ++++++++++++++++++++++++---------------------- 1 file changed, 365 insertions(+), 342 deletions(-) (limited to 'src/conf_mode') diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 05bf65fde..362eeddbb 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -14,14 +14,16 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . -import sys import os -import re -import subprocess import jinja2 -import socket -import time -import syslog as sl + +from time import sleep +from sys import exit +from subprocess import Popen, PIPE, check_output +from socket import socket, AF_INET, SOCK_STREAM +from copy import deepcopy +from stat import S_IRUSR, S_IWUSR, S_IRGRP +from psutil import pid_exists from vyos.config import Config from vyos import ConfigError @@ -35,28 +37,25 @@ ssl_cert_dir = r'/config/user-data/sstp' # config path creation if not os.path.exists(sstp_cnf_dir): os.makedirs(sstp_cnf_dir) - sl.syslog(sl.LOG_NOTICE, sstp_cnf_dir + " created") if not os.path.exists(ssl_cert_dir): os.makedirs(ssl_cert_dir) - sl.syslog(sl.LOG_NOTICE, ssl_cert_dir + " created") -sstp_config = ''' -### generated by vpn_sstp.py ### +sstp_config = """### generated by vpn_sstp.py ### [modules] log_syslog sstp ippool shaper -{% if authentication['mode'] == 'local' %} +{% if auth_mode == 'local' %} chap-secrets +{% elif auth_mode == 'radius' %} +radius {% endif -%} -{% for proto in authentication['auth_proto'] %} + +{% for proto in auth_proto %} {{proto}} {% endfor %} -{% if authentication['mode'] == 'radius' %} -radius -{% endif %} [core] thread-count={{thread_cnt}} @@ -75,17 +74,15 @@ disable [sstp] verbose=1 accept=ssl -{% if certs %} -ssl-ca-file=/config/user-data/sstp/{{certs['ca']}} -ssl-pemfile=/config/user-data/sstp/{{certs['server-cert']}} -ssl-keyfile=/config/user-data/sstp/{{certs['server-key']}} -{% endif %} +ssl-ca-file=/config/user-data/sstp/{{ ssl_ca }} +ssl-pemfile=/config/user-data/sstp/{{ ssl_cert }} +ssl-keyfile=/config/user-data/sstp/{{ ssl_key }} -{%if ip_pool %} +{% if client_ip_pool %} [ip-pool] -gw-ip-address={{gw}} -{% for sn in ip_pool %} -{{sn}} +gw-ip-address={{ client_gateway }} +{% for subnet in client_ip_pool %} +{{ subnet }} {% endfor %} {% endif %} @@ -96,38 +93,34 @@ dns{{ loop.index }}={{ dns }} {% endfor -%} {% endif %} -{% if authentication['mode'] == 'local' %} +{% if auth_mode == 'local' %} [chap-secrets] chap-secrets=/etc/accel-ppp/sstp/chap-secrets -{% endif %} - -{%- if authentication['mode'] == 'radius' %} +{% elif auth_mode == 'radius' %} [radius] verbose=1 -{% for rsrv in authentication['radius-srv']: %} -server={{rsrv}},{{authentication['radius-srv'][rsrv]['secret']}},\ -req-limit={{authentication['radius-srv'][rsrv]['req-limit']}},\ -fail-time={{authentication['radius-srv'][rsrv]['fail-time']}} +{% for r in radius_server %} +server={{ r.server }},{{ r.secret }},req-limit={{ r.req_limit }},fail-time={{ r.fail_time }} {% endfor -%} -{% if authentication['radiusopt']['acct-timeout'] %} -acct-timeout={{authentication['radiusopt']['acct-timeout']}} + +{% if radius_acct_tmo %} +acct-timeout={{ radius_acct_tmo }} {% endif -%} -{% if authentication['radiusopt']['timeout'] %} -timeout={{authentication['radiusopt']['timeout']}} +{% if radius_timeout %} +timeout={{ radius_timeout }} {% endif -%} -{% if authentication['radiusopt']['max-try'] %} -max-try={{authentication['radiusopt']['max-try']}} +{% if rad_max_try %} +max-try={{ rad_max_try }} {% endif -%} -{% if authentication['radiusopt']['nas-id'] %} -nas-identifier={{authentication['radiusopt']['nas-id']}} +{% if radius_nas_id %} +nas-identifier={{ radius_nas_id }} {% endif -%} -{% if authentication['radiusopt']['nas-ip'] %} -nas-ip-address={{authentication['radiusopt']['nas-ip']}} +{% if radius_nas_ip %} +nas-ip-address={{ radius_nas_ip }} {% endif -%} -{% if authentication['radiusopt']['dae-srv'] %} -dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\ -{{authentication['radiusopt']['dae-srv']['port']}},\ -{{authentication['radiusopt']['dae-srv']['secret']}} + +{% if radius_dae %} +dae-server={{ radius_dae.server }}:{{ radius_dae.port }},{{ radius_dae.secret }} {% endif -%} {% endif %} @@ -135,373 +128,403 @@ dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\ verbose=1 check-ip=1 {% if mtu %} -mtu={{mtu}} +mtu={{ mtu }} {% endif -%} -{% if ppp['mppe'] %} -mppe={{ppp['mppe']}} + +{% if ppp_mppe %} +mppe={{ ppp_mppe }} {% endif -%} -{% if ppp['lcp-echo-interval'] %} -lcp-echo-interval={{ppp['lcp-echo-interval']}} +{% if ppp_echo_interval %} +lcp-echo-interval={{ ppp_echo_interval }} {% endif -%} -{% if ppp['lcp-echo-failure'] %} -lcp-echo-failure={{ppp['lcp-echo-failure']}} +{% if ppp_echo_failure %} +lcp-echo-failure={{ ppp_echo_failure }} {% endif -%} -{% if ppp['lcp-echo-timeout'] %} -lcp-echo-timeout={{ppp['lcp-echo-timeout']}} +{% if ppp_echo_timeout %} +lcp-echo-timeout={{ ppp_echo_timeout }} {% endif %} -{% if authentication['radiusopt']['shaper'] %} +{% if radius_shaper_attr %} [shaper] verbose=1 -attr={{authentication['radiusopt']['shaper']['attr']}} -{% if authentication['radiusopt']['shaper']['vendor'] %} -vendor={{authentication['radiusopt']['shaper']['vendor']}} +attr={{ radius_shaper_attr }} +{% if radius_shaper_vendor %} +vendor={{ radius_shaper_vendor }} {% endif -%} {% endif %} [cli] tcp=127.0.0.1:2005 -''' + +""" # sstp chap secrets -chap_secrets_conf = ''' +chap_secrets_conf = """ # username server password acceptable local IP addresses shaper -{% for user in authentication['local-users'] %} -{% if authentication['local-users'][user]['state'] == 'enabled' %} -{% if (authentication['local-users'][user]['upload']) and (authentication['local-users'][user]['download']) %} -{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}}\t\ -{{authentication['local-users'][user]['download']}}/{{authentication['local-users'][user]['upload']}} +{% for user in local_users %} +{% if user.state == 'enabled' %} +{% if user.upload and user.download %} +{{ "%-12s" | format(user.name) }} * {{ "%-16s" | format(user.password) }} {{ "%-16s" | format(user.ip) }} {{ user.download }} / {{ user.upload }} {% else %} -{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}} +{{ "%-12s" | format(user.name) }} * {{ "%-16s" | format(user.password) }} {{ "%-16s" | format(user.ip) }} {% endif %} {% endif %} {% endfor %} -''' -### -# inline helper functions -### -# depending on hw and threads, daemon needs a little to start -# if it takes longer than 100 * 0.5 secs, exception is being raised -# not sure if that's the best way to check it, but it worked so far quite well -### +""" +def subprocess_cmd(command): + p = Popen(command, stdout=PIPE, shell=True) + p.communicate() def chk_con(): cnt = 0 - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s = socket(AF_INET, SOCK_STREAM) while True: try: s.connect(("127.0.0.1", 2005)) s.close() break except ConnectionRefusedError: - time.sleep(0.5) + sleep(0.5) cnt += 1 if cnt == 100: raise("failed to start sstp server") break -# chap_secrets file if auth mode local - - -def write_chap_secrets(c): - tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) - chap_secrets_txt = tmpl.render(c) - old_umask = os.umask(0o077) - open(chap_secrets, 'w').write(chap_secrets_txt) - os.umask(old_umask) - sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written') - - -def accel_cmd(cmd=''): +def accel_cmd(cmd): if not cmd: return None + try: - ret = subprocess.check_output( - ['/usr/bin/accel-cmd', '-p', '2005', cmd]).decode().strip() - return ret + ret = check_output(['/usr/bin/accel-cmd', '-p', '2005', cmd]) + return ret.decode().strip() + except: return 1 -# check ig local-ip is in client pool subnet - - -### -# inline helper functions end -### +default_config_data = { + 'local_users' : [], + 'auth_mode' : 'local', + 'auth_proto' : [], + 'radius_server' : [], + 'radius_acct_tmo' : '', + 'radius_max_try' : '', + 'radius_timeout' : '', + 'radius_nas_id' : '', + 'radius_nas_ip' : '', + 'radius_shaper_attr' : '', + 'radius_shaper_vendor': '', + 'radius_dae' : {}, + 'ssl_ca' : '', + 'ssl_cert' : '', + 'ssl_key' : '', + 'client_ip_pool' : [], + 'dnsv4' : [], + 'mtu' : '', + 'ppp_mppe' : '', + 'ppp_echo_failure' : '', + 'ppp_echo_interval' : '', + 'ppp_echo_timeout' : '', + 'thread_cnt' : '' +} def get_config(): + sstp = deepcopy(default_config_data) base_path = ['vpn', 'sstp'] - c = Config() - if not c.exists(base_path): + conf = Config() + if not conf.exists(base_path): return None - c.set_level(base_path) - - config_data = { - 'authentication': { - 'local-users': { - }, - 'mode': 'local', - 'auth_proto': [], - 'radius-srv': {}, - 'radiusopt': {}, - 'dae-srv': {} - }, - 'certs': { - 'ca': None, - 'server-key': None, - 'server-cert': None - }, - 'ip_pool': [], - 'gw': None, - 'dnsv4': [], - 'mtu': None, - 'ppp': {}, - } + conf.set_level(base_path) + cpu = int(os.cpu_count()/2) + if cpu < 1: + cpu = 1 + sstp['thread_cnt'] = cpu + + if conf.exists(['authentication', 'mode']): + sstp['auth_mode'] = conf.return_value(['authentication', 'mode']) + + # # local auth - if c.exists('authentication mode local'): - if c.exists('authentication local-users'): - for usr in c.list_nodes('authentication local-users username'): - config_data['authentication']['local-users'].update( - { - usr: { - 'passwd': None, - 'state': 'enabled', - 'ip': '*', - 'upload': None, - 'download': None - } - } - ) - if c.exists('authentication local-users username ' + usr + ' password'): - config_data['authentication']['local-users'][usr]['passwd'] = c.return_value( - 'authentication local-users username ' + usr + ' password') - if c.exists('authentication local-users username ' + usr + ' disable'): - config_data['authentication']['local-users'][usr]['state'] = 'disable' - if c.exists('authentication local-users username ' + usr + ' static-ip'): - config_data['authentication']['local-users'][usr]['ip'] = c.return_value( - 'authentication local-users username ' + usr + ' static-ip') - if c.exists('authentication local-users username ' + usr + ' rate-limit download'): - config_data['authentication']['local-users'][usr]['download'] = c.return_value( - 'authentication local-users username ' + usr + ' rate-limit download') - if c.exists('authentication local-users username ' + usr + ' rate-limit upload'): - config_data['authentication']['local-users'][usr]['upload'] = c.return_value( - 'authentication local-users username ' + usr + ' rate-limit upload') - - if c.exists('authentication protocols'): - auth_mods = {'pap': 'pap', 'chap': 'auth_chap_md5', - 'mschap': 'auth_mschap_v1', 'mschap-v2': 'auth_mschap_v2'} - for proto in c.return_values('authentication protocols'): - config_data['authentication']['auth_proto'].append( - auth_mods[proto]) - else: - config_data['authentication']['auth_proto'] = ['auth_mschap_v2'] + if conf.exists(['authentication', 'local-users']): + for username in conf.list_nodes(['authentication', 'local-users', 'username']): + user = { + 'name' : username, + 'password' : '', + 'state' : 'enabled', + 'ip' : '*', + 'upload' : None, + 'download' : None + } + + conf.set_level(base_path + ['authentication', 'local-users', 'username', username]) + + if conf.exists(['password']): + user['password'] = conf.return_value(['password']) + + if conf.exists(['disable']): + user['state'] = 'disable' + + if conf.exists(['static-ip']): + user['ip'] = conf.return_value(['static-ip']) + + if conf.exists(['rate-limit', 'download']): + user['download'] = conf.return_value(['rate-limit', 'download']) + + if conf.exists(['rate-limit', 'upload']): + user['upload'] = conf.return_value(['rate-limit', 'upload']) + + sstp['local_users'].append(user) + # # RADIUS auth and settings - if c.exists('authentication mode radius'): - config_data['authentication']['mode'] = c.return_value( - 'authentication mode') - if c.exists('authentication radius-server'): - for rsrv in c.list_nodes('authentication radius-server'): - config_data['authentication']['radius-srv'][rsrv] = {} - if c.exists('authentication radius-server ' + rsrv + ' secret'): - config_data['authentication']['radius-srv'][rsrv]['secret'] = c.return_value( - 'authentication radius-server ' + rsrv + ' secret') - else: - config_data['authentication']['radius-srv'][rsrv]['secret'] = None - if c.exists('authentication radius-server ' + rsrv + ' fail-time'): - config_data['authentication']['radius-srv'][rsrv]['fail-time'] = c.return_value( - 'authentication radius-server ' + rsrv + ' fail-time') - else: - config_data['authentication']['radius-srv'][rsrv]['fail-time'] = 0 - if c.exists('authentication radius-server ' + rsrv + ' req-limit'): - config_data['authentication']['radius-srv'][rsrv]['req-limit'] = c.return_value( - 'authentication radius-server ' + rsrv + ' req-limit') - else: - config_data['authentication']['radius-srv'][rsrv]['req-limit'] = 0 + conf.set_level(base_path) + if conf.exists(['authentication', 'radius-server']): + for server in conf.list_nodes(['authentication', 'radius-server']): + radius = { + 'server' : server, + 'secret' : '', + 'fail_time' : 0, + 'req_limit' : 0 + } + + conf.set_level(base_path + ['authentication', 'radius-server', server]) + + if conf.exists(['secret']): + radius['secret'] = conf.return_value(['secret']) + + if conf.exists(['fail-time']): + radius['fail-time'] = conf.return_value(['fail-time']) + + if conf.exists(['req-limit']): + radius['req_limit'] = conf.return_value(['req-limit']) + + sstp['radius_server'].append(radius) # advanced radius-setting - if c.exists('authentication radius-settings'): - if c.exists('authentication radius-settings acct-timeout'): - config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value( - 'authentication radius-settings acct-timeout') - if c.exists('authentication radius-settings max-try'): - config_data['authentication']['radiusopt']['max-try'] = c.return_value( - 'authentication radius-settings max-try') - if c.exists('authentication radius-settings timeout'): - config_data['authentication']['radiusopt']['timeout'] = c.return_value( - 'authentication radius-settings timeout') - if c.exists('authentication radius-settings nas-identifier'): - config_data['authentication']['radiusopt']['nas-id'] = c.return_value( - 'authentication radius-settings nas-identifier') - if c.exists('authentication radius-settings nas-ip-address'): - config_data['authentication']['radiusopt']['nas-ip'] = c.return_value( - 'authentication radius-settings nas-ip-address') - if c.exists('authentication radius-settings dae-server'): - config_data['authentication']['radiusopt'].update( - { - 'dae-srv': { - 'ip-addr': c.return_value('authentication radius-settings dae-server ip-address'), - 'port': c.return_value('authentication radius-settings dae-server port'), - 'secret': str(c.return_value('authentication radius-settings dae-server secret')) - } - } - ) - if c.exists('authentication radius-settings rate-limit enable'): - if not c.exists('authentication radius-settings rate-limit attribute'): - config_data['authentication']['radiusopt']['shaper'] = { - 'attr': 'Filter-Id'} - else: - config_data['authentication']['radiusopt']['shaper'] = { - 'attr': c.return_value('authentication radius-settings rate-limit attribute') - } - if c.exists('authentication radius-settings rate-limit vendor'): - config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value( - 'authentication radius-settings rate-limit vendor') - - if c.exists('sstp-settings ssl-certs ca'): - config_data['certs']['ca'] = c.return_value( - 'sstp-settings ssl-certs ca') - if c.exists('sstp-settings ssl-certs server-cert'): - config_data['certs']['server-cert'] = c.return_value( - 'sstp-settings ssl-certs server-cert') - if c.exists('sstp-settings ssl-certs server-key'): - config_data['certs']['server-key'] = c.return_value( - 'sstp-settings ssl-certs server-key') - - if c.exists('network-settings client-ip-settings subnet'): - config_data['ip_pool'] = c.return_values( - 'network-settings client-ip-settings subnet') - if c.exists('network-settings client-ip-settings gateway-address'): - config_data['gw'] = c.return_value( - 'network-settings client-ip-settings gateway-address') - if c.exists('network-settings name-server'): - config_data['dnsv4'] = c.return_values('network-settings name-server') - if c.exists('network-settings mtu'): - config_data['mtu'] = c.return_value('network-settings mtu') - - # ppp - if c.exists('ppp-settings mppe'): - config_data['ppp']['mppe'] = c.return_value('ppp-settings mppe') - if c.exists('ppp-settings lcp-echo-failure'): - config_data['ppp']['lcp-echo-failure'] = c.return_value( - 'ppp-settings lcp-echo-failure') - if c.exists('ppp-settings lcp-echo-interval'): - config_data['ppp']['lcp-echo-interval'] = c.return_value( - 'ppp-settings lcp-echo-interval') - if c.exists('ppp-settings lcp-echo-timeout'): - config_data['ppp']['lcp-echo-timeout'] = c.return_value( - 'ppp-settings lcp-echo-timeout') - - return config_data - - -def verify(c): - if c == None: + conf.set_level(base_path + ['authentication', 'radius-settings']) + if conf.exists([]): + if conf.exists(['acct-timeout']): + sstp['radius_acct_tmo'] = conf.return_value(['acct-timeout']) + + if conf.exists(['max-try']): + sstp['radius_max_try'] = conf.return_value(['max-try']) + + if conf.exists(['timeout']): + sstp['radius_timeout'] = conf.return_value(['timeout']) + + if conf.exists(['nas-identifier']): + sstp['radius_nas_id'] = conf.return_value(['nas-identifier']) + + if conf.exists(['nas-ip-address']): + sstp['radius_nas_ip'] = conf.return_value(['nas-ip-address']) + + # Dynamic Authorization Extensions (DOA)/ + # Change Of Authentication (COA) + if conf.exists(['dae-server']): + dae = { + 'port' : '', + 'server' : '', + 'secret' : '' + } + + if conf.exists(['ip-address']): + dae['server'] = conf.return_value(['ip-address']) + + if conf.exists(['port']): + dae['port'] = conf.return_value(['port']) + + if conf.exists(['secret']): + dae['secret'] = conf.return_value(['secret']) + + sstp['radius_dae'] = dae + + if conf.exists(['rate-limit', 'enable']): + sstp['radius_shaper_attr'] = 'Filter-Id' + c_attr = ['rate-limit', 'enable', 'attribute'] + if conf.exists(c_attr): + sstp['radius_shaper_attr'] = conf.return_value(c_attr) + + c_vendor = ['rate-limit', 'enable', 'vendor'] + if conf.exists(c_vendor): + sstp['radius_shaper_vendor'] = conf.return_value(c_vendor) + + # + # authentication protocols + conf.set_level(base_path + ['authentication']) + if conf.exists(['protocols']): + auth_mods = { + 'pap': 'auth_pap', + 'chap': 'auth_chap_md5', + 'mschap': 'auth_mschap_v1', + 'mschap-v2': 'auth_mschap_v2' + } + + for proto in conf.return_values(['protocols']): + sstp['auth_proto'].append(auth_mods[proto]) + + else: + sstp['auth_proto'] = ['auth_mschap_v2'] + + # + # read in SSL certs + conf.set_level(base_path + ['sstp-settings', 'ssl-certs']) + if conf.exists(['ca']): + sstp['ssl_ca'] = conf.return_value(['ca']) + + if conf.exists(['server-cert']): + sstp['ssl_cert'] = conf.return_value(['server-cert']) + + if conf.exists(['server-key']): + sstp['ssl_key'] = conf.return_value(['server-key']) + + + # + # read in client ip pool settings + conf.set_level(base_path + ['network-settings', 'client-ip-settings']) + if conf.exists(['subnet']): + sstp['client_ip_pool'] = conf.return_values(['subnet']) + + if conf.exists(['gateway-address']): + sstp['client_gateway'] = conf.return_value(['gateway-address']) + + # + # read in network settings + conf.set_level(base_path + ['network-settings']) + if conf.exists(['name-server']): + sstp['dnsv4'] = conf.return_values(['name-server']) + + if conf.exists(['mtu']): + sstp['mtu'] = conf.return_value(['mtu']) + + # + # read in PPP stuff + conf.set_level(base_path + ['ppp-settings']) + if conf.exists('mppe'): + sstp['ppp_mppe'] = conf.return_value('ppp-settings mppe') + + if conf.exists(['lcp-echo-failure']): + sstp['ppp_echo_failure'] = conf.return_value(['lcp-echo-failure']) + + if conf.exists(['lcp-echo-interval']): + sstp['ppp_echo_interval'] = conf.return_value(['lcp-echo-interval']) + + if conf.exists(['lcp-echo-timeout']): + sstp['ppp_echo_timeout'] = conf.return_value(['lcp-echo-timeout']) + + return sstp + + +def verify(sstp): + if sstp is None: return None # vertify auth settings - if c['authentication']['mode'] == 'local': - if not c['authentication']['local-users']: - raise ConfigError( - 'sstp-server authentication local-users required') - - for usr in c['authentication']['local-users']: - if not c['authentication']['local-users'][usr]['passwd']: - raise ConfigError('user ' + usr + ' requires a password') + if sstp['auth_mode'] == 'local': + if not sstp['local_users']: + raise ConfigError('sstp-server authentication local-users required') + + for user in sstp['local_users']: + if not user['password']: + raise ConfigError(f"Password required for user {user['name']}") + # if up/download is set, check that both have a value - if c['authentication']['local-users'][usr]['upload']: - if not c['authentication']['local-users'][usr]['download']: - raise ConfigError( - 'user ' + usr + ' requires download speed value') - if c['authentication']['local-users'][usr]['download']: - if not c['authentication']['local-users'][usr]['upload']: - raise ConfigError( - 'user ' + usr + ' requires upload speed value') - - if len(c['dnsv4']) > 2: + if user['upload'] and not user['download']: + raise ConfigError(f"Download speed value required for user {user['name']}") + + if user['download'] and not user['upload']: + raise ConfigError(f"Upload speed value required for user {user['name']}") + + if not sstp['client_ip_pool']: + raise ConfigError("Client IP subnet required") + + if not sstp['client_gateway']: + raise ConfigError("Client gateway IP address required") + + if len(sstp['dnsv4']) > 2: raise ConfigError("Only 2 DNS name-servers can be configured") - if not c['certs']['ca'] or not c['certs']['server-key'] or not c['certs']['server-cert']: - raise ConfigError( - 'service sstp-server sstp-settings ssl-certs needs the ssl certificates set up') - else: - ssl_path = ssl_cert_dir + '/' - if not os.path.exists(ssl_path + c['certs']['ca']): - raise ConfigError('CA {0} doesn\'t exist'.format( - ssl_path + c['certs']['ca'])) - if not os.path.exists(ssl_path + c['certs']['server-cert']): - raise ConfigError('SSL Cert {0} doesn\'t exist'.format( - ssl_path + c['certs']['server-cert'])) - if not os.path.exists(ssl_path + c['certs']['server-cert']): - raise ConfigError('SSL Key {0} doesn\'t exist'.format( - ssl_path + c['certs']['server-key'])) - - if c['authentication']['mode'] == 'radius': - if len(c['authentication']['radius-srv']) == 0: - raise ConfigError( - 'service sstp-server authentication radius-server needs a value') - for rsrv in c['authentication']['radius-srv']: - if c['authentication']['radius-srv'][rsrv]['secret'] == None: - raise ConfigError( - 'service sstp-server authentication radius-server {0} secret requires a value'.format(rsrv)) - - if c['authentication']['mode'] == 'local': - if not c['ip_pool']: - print ( - "WARNING: service sstp-server network-settings client-ip-settings subnet requires a value") - if not c['gw']: - print ( - "WARNING: service sstp-server network-settings client-ip-settings gateway-address requires a value") - - -def generate(c): - if c == None: + if not sstp['ssl_ca'] or not sstp['ssl_cert'] or not sstp['ssl_key']: + raise ConfigError('One or more SSL certificates missing') + + ssl_path = ssl_cert_dir + '/' + if not os.path.exists(ssl_path + sstp['ssl_ca']): + ca = ssl_path + sstp['ssl_ca'] + raise ConfigError(f'CA cert file {ca} does not exist') + + if not os.path.exists(ssl_path + sstp['ssl_cert']): + cert = ssl_path + sstp['ssl_cert'] + raise ConfigError(f'SSL cert file {cert} does not exist') + + if not os.path.exists(ssl_path + sstp['ssl_key']): + key = ssl_path + sstp['ssl_key'] + raise ConfigError(f'SSL key file {key} does not exist') + + if sstp['auth_mode'] == 'radius': + if len(sstp['radius_server']) == 0: + raise ConfigError('RADIUS authentication requires at least one server') + + for radius in sstp['radius_server']: + if not radius['secret']: + raise ConfigError(f"Missing RADIUS secret for server {{ radius['server'] }}") + +def generate(sstp): + if sstp is None: return None # accel-cmd reload doesn't work so any change results in a restart of the daemon - try: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - except KeyError: - if os.cpu_count() == 1: - c['thread_cnt'] = 1 - else: - c['thread_cnt'] = int(os.cpu_count()/2) - tmpl = jinja2.Template(sstp_config, trim_blocks=True) - config_text = tmpl.render(c) - open(sstp_conf, 'w').write(config_text) + config_text = tmpl.render(sstp) + with open(sstp_conf, 'w') as f: + f.write(config_text) + + if sstp['local_users']: + tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True) + config_text = tmpl.render(sstp) + with open(chap_secrets, 'w') as f: + f.write(config_text) + + os.chmod(chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP ) - if c['authentication']['local-users']: - write_chap_secrets(c) + return sstp - return c +def apply(sstp): + pid = 0 + if os.path.isfile(pidfile): + pid = 0 + with open(pidfile, 'r') as f: + pid = int(f.read()) + if sstp is None: + if pid_exists(pid): + cmd = 'start-stop-daemon --stop --quiet' + cmd += ' --pidfile ' + pidfile + subprocess_cmd(cmd) -def apply(c): - if c == None: if os.path.exists(pidfile): - accel_cmd('shutdown hard') - if os.path.exists(pidfile): - os.remove(pidfile) + os.remove(pidfile) + return None - if not os.path.exists(pidfile): - ret = subprocess.call( - ['/usr/sbin/accel-pppd', '-c', sstp_conf, '-p', pidfile, '-d']) - chk_con() - if ret != 0 and os.path.exists(pidfile): + if not pid_exists(pid): + if os.path.exists(pidfile): os.remove(pidfile) - raise ConfigError('accel-pppd failed to start') + + cmd = 'start-stop-daemon --start --quiet' + cmd += ' --pidfile ' + pidfile + cmd += ' --exec /usr/sbin/accel-pppd' + # now pass arguments to accel-pppd binary + cmd += ' --' + cmd += ' -c ' + sstp_conf + cmd += ' -p ' + pidfile + cmd += ' -d' + subprocess_cmd(cmd) + + chk_con() + else: accel_cmd('restart') - sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart") - if __name__ == '__main__': try: @@ -511,4 +534,4 @@ if __name__ == '__main__': apply(c) except ConfigError as e: print(e) - sys.exit(1) + exit(1) -- cgit v1.2.3 From 86e47301786da64a035156edd24ed2ec89918a49 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 21:54:05 +0100 Subject: sstp: T2110: use uniform RADIUS CLI syntax - migrate RADIUS configuration to a more uniform syntax accross the system - authentication radius-server x.x.x.x to authentication radius server x.x.x.x - authentication radius-settings to authentication radius --- interface-definitions/vpn-sstp.xml.in | 72 ++++++++----------- src/conf_mode/vpn_sstp.py | 132 ++++++++++++++++++---------------- src/migration-scripts/sstp/0-to-1 | 51 ++++++++++++- 3 files changed, 150 insertions(+), 105 deletions(-) (limited to 'src/conf_mode') diff --git a/interface-definitions/vpn-sstp.xml.in b/interface-definitions/vpn-sstp.xml.in index e2d6aa75e..1508c3313 100644 --- a/interface-definitions/vpn-sstp.xml.in +++ b/interface-definitions/vpn-sstp.xml.in @@ -113,37 +113,23 @@ - - - IP address of RADIUS server - - ipv4 - IP address of RADIUS server - - - - - - Key for accessing the specified server - - - - - Maximum number of simultaneous requests to server (default: unlimited) - - - - - If server does not responds mark it as unavailable for this time (seconds) - - - - - - - RADIUS settings - + #include + + + + + + Maximum number of simultaneous requests to server (default: unlimited) + + + + + If server does not responds mark it as unavailable for this time (seconds) + + + + Timeout to wait response from server (seconds) @@ -151,22 +137,22 @@ - Timeout to wait reply for Interim-Update packets. (default 3 seconds) + Timeout for Interim-Update packets (default 3 seconds) - Maximum number of tries to send Access-Request/Accounting-Request queries + Maximum tries for Access-Request/Accounting-Request queries - Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests. + NAS-Identifier attribute sent to RADIUS - Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also DM/CoA server will bind to that address. + NAS-IP-Address attribute sent to RADIUS @@ -175,14 +161,14 @@ ipv4 NAS-IP-Address Attribute Value - - - + + + - IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA) + Dynamic Authorization Extension/Change of Authorization server - + IP address for Dynamic Authorization Extension server (DM/CoA) @@ -207,7 +193,7 @@ - + Secret for Dynamic Authorization Extension server (DM/CoA) @@ -221,17 +207,17 @@ - Specifies which radius attribute contains rate information. (default is Filter-Id) + Specifies RADIUS attribute containing rate information (default 'Filter-Id') - Specifies the vendor dictionary. (dictionary needs to be in /usr/share/accel-ppp/radius) + Specifies vendor dictionary (needs to be in /usr/share/accel-ppp/radius) - Enables Bandwidth shaping via RADIUS + Enable RADIUS bandwidth shaping diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 362eeddbb..e8c5155dd 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -100,27 +100,26 @@ chap-secrets=/etc/accel-ppp/sstp/chap-secrets [radius] verbose=1 {% for r in radius_server %} -server={{ r.server }},{{ r.secret }},req-limit={{ r.req_limit }},fail-time={{ r.fail_time }} +server={{ r.server }},{{ r.key }},auth-port={{ r.port }},req-limit={{ r.req_limit }},fail-time={{ r.fail_time }} {% endfor -%} -{% if radius_acct_tmo %} acct-timeout={{ radius_acct_tmo }} -{% endif -%} -{% if radius_timeout %} timeout={{ radius_timeout }} -{% endif -%} -{% if rad_max_try %} -max-try={{ rad_max_try }} -{% endif -%} +max-try={{ radius_max_try }} + {% if radius_nas_id %} nas-identifier={{ radius_nas_id }} {% endif -%} {% if radius_nas_ip %} nas-ip-address={{ radius_nas_ip }} {% endif -%} +{% if radius_source_address %} +bind={{ radius_source_address }} +{% endif -%} + -{% if radius_dae %} -dae-server={{ radius_dae.server }}:{{ radius_dae.port }},{{ radius_dae.secret }} +{% if radius_dynamic_author %} +dae-server={{ radius_dynamic_author.server }}:{{ radius_dynamic_author.port }},{{ radius_dynamic_author.key }} {% endif -%} {% endif %} @@ -207,14 +206,15 @@ default_config_data = { 'auth_mode' : 'local', 'auth_proto' : [], 'radius_server' : [], - 'radius_acct_tmo' : '', - 'radius_max_try' : '', - 'radius_timeout' : '', + 'radius_acct_tmo' : '3', + 'radius_max_try' : '3', + 'radius_timeout' : '3', 'radius_nas_id' : '', 'radius_nas_ip' : '', + 'radius_source_address' : '', 'radius_shaper_attr' : '', 'radius_shaper_vendor': '', - 'radius_dae' : {}, + 'radius_dynamic_author' : '', 'ssl_ca' : '', 'ssl_cert' : '', 'ssl_key' : '', @@ -279,76 +279,84 @@ def get_config(): # # RADIUS auth and settings - conf.set_level(base_path) - if conf.exists(['authentication', 'radius-server']): - for server in conf.list_nodes(['authentication', 'radius-server']): + conf.set_level(base_path + ['authentication', 'radius']) + if conf.exists(['server']): + for server in conf.list_nodes(['server']): radius = { 'server' : server, - 'secret' : '', + 'key' : '', 'fail_time' : 0, + 'port' : '1812', 'req_limit' : 0 } - conf.set_level(base_path + ['authentication', 'radius-server', server]) - - if conf.exists(['secret']): - radius['secret'] = conf.return_value(['secret']) + conf.set_level(base_path + ['authentication', 'radius', 'server', server]) if conf.exists(['fail-time']): radius['fail-time'] = conf.return_value(['fail-time']) + if conf.exists(['port']): + radius['port'] = conf.return_value(['port']) + if conf.exists(['req-limit']): radius['req_limit'] = conf.return_value(['req-limit']) - sstp['radius_server'].append(radius) + if conf.exists(['key']): + radius['key'] = conf.return_value(['key']) + + if not conf.exists(['disable']): + sstp['radius_server'].append(radius) + # # advanced radius-setting - conf.set_level(base_path + ['authentication', 'radius-settings']) - if conf.exists([]): - if conf.exists(['acct-timeout']): - sstp['radius_acct_tmo'] = conf.return_value(['acct-timeout']) + conf.set_level(base_path + ['authentication', 'radius']) - if conf.exists(['max-try']): - sstp['radius_max_try'] = conf.return_value(['max-try']) + if conf.exists(['acct-timeout']): + sstp['radius_acct_tmo'] = conf.return_value(['acct-timeout']) - if conf.exists(['timeout']): - sstp['radius_timeout'] = conf.return_value(['timeout']) + if conf.exists(['max-try']): + sstp['radius_max_try'] = conf.return_value(['max-try']) - if conf.exists(['nas-identifier']): - sstp['radius_nas_id'] = conf.return_value(['nas-identifier']) + if conf.exists(['timeout']): + sstp['radius_timeout'] = conf.return_value(['timeout']) - if conf.exists(['nas-ip-address']): - sstp['radius_nas_ip'] = conf.return_value(['nas-ip-address']) + if conf.exists(['nas-identifier']): + sstp['radius_nas_id'] = conf.return_value(['nas-identifier']) - # Dynamic Authorization Extensions (DOA)/ - # Change Of Authentication (COA) - if conf.exists(['dae-server']): - dae = { - 'port' : '', - 'server' : '', - 'secret' : '' - } + if conf.exists(['nas-ip-address']): + sstp['radius_nas_ip'] = conf.return_value(['nas-ip-address']) - if conf.exists(['ip-address']): - dae['server'] = conf.return_value(['ip-address']) + if conf.exists(['source-address']): + sstp['radius_source_address'] = conf.return_value(['source-address']) + + # Dynamic Authorization Extensions (DOA)/Change Of Authentication (COA) + if conf.exists(['dynamic-author']): + dae = { + 'port' : '', + 'server' : '', + 'key' : '' + } - if conf.exists(['port']): - dae['port'] = conf.return_value(['port']) + if conf.exists(['dynamic-author', 'server']): + dae['server'] = conf.return_value(['dynamic-author', 'server']) - if conf.exists(['secret']): - dae['secret'] = conf.return_value(['secret']) + if conf.exists(['dynamic-author', 'port']): + dae['port'] = conf.return_value(['dynamic-author', 'port']) - sstp['radius_dae'] = dae + if conf.exists(['dynamic-author', 'key']): + dae['key'] = conf.return_value(['dynamic-author', 'key']) - if conf.exists(['rate-limit', 'enable']): - sstp['radius_shaper_attr'] = 'Filter-Id' - c_attr = ['rate-limit', 'enable', 'attribute'] - if conf.exists(c_attr): - sstp['radius_shaper_attr'] = conf.return_value(c_attr) + sstp['radius_dynamic_author'] = dae - c_vendor = ['rate-limit', 'enable', 'vendor'] - if conf.exists(c_vendor): - sstp['radius_shaper_vendor'] = conf.return_value(c_vendor) + if conf.exists(['rate-limit', 'enable']): + sstp['radius_shaper_attr'] = 'Filter-Id' + c_attr = ['rate-limit', 'enable', 'attribute'] + if conf.exists(c_attr): + sstp['radius_shaper_attr'] = conf.return_value(c_attr) + + c_vendor = ['rate-limit', 'enable', 'vendor'] + if conf.exists(c_vendor): + sstp['radius_shaper_vendor'] = conf.return_value(c_vendor) # # authentication protocols @@ -466,8 +474,8 @@ def verify(sstp): raise ConfigError('RADIUS authentication requires at least one server') for radius in sstp['radius_server']: - if not radius['secret']: - raise ConfigError(f"Missing RADIUS secret for server {{ radius['server'] }}") + if not radius['key']: + raise ConfigError(f"Missing RADIUS secret for server {{ radius['key'] }}") def generate(sstp): if sstp is None: @@ -486,6 +494,9 @@ def generate(sstp): f.write(config_text) os.chmod(chap_secrets, S_IRUSR | S_IWUSR | S_IRGRP ) + else: + if os.path.exists(chap_secrets): + os.unlink(chap_secrets) return sstp @@ -526,6 +537,7 @@ def apply(sstp): else: accel_cmd('restart') + if __name__ == '__main__': try: c = get_config() diff --git a/src/migration-scripts/sstp/0-to-1 b/src/migration-scripts/sstp/0-to-1 index 88d3b4fb4..652a2662f 100755 --- a/src/migration-scripts/sstp/0-to-1 +++ b/src/migration-scripts/sstp/0-to-1 @@ -14,7 +14,12 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . + # - migrate from "service sstp-server" to "vpn sstp" +# - remove primary/secondary identifier from nameserver +# - migrate RADIUS configuration to a more uniform syntax accross the system +# - authentication radius-server x.x.x.x to authentication radius server x.x.x.x +# - authentication radius-settings to authentication radius import os import sys @@ -58,8 +63,50 @@ else: config.delete(dns_base) - print(config.to_string()) - sys.exit(1) + + # migrate radius options - copy subtree + # thus must happen before migration of the individual RADIUS servers + old_options = new_base + ['authentication', 'radius-settings'] + new_options = new_base + ['authentication', 'radius'] + config.copy(old_options, new_options) + config.delete(old_options) + + + # migrate radius dynamic author / change of authorisation server + dae_old = new_base + ['authentication', 'radius', 'dae-server'] + if config.exists(dae_old): + config.rename(dae_old, 'dynamic-author') + dae_new = new_base + ['authentication', 'radius', 'dynamic-author'] + + if config.exists(dae_new + ['ip-address']): + config.rename(dae_new + ['ip-address'], 'server') + + if config.exists(dae_new + ['secret']): + config.rename(dae_new + ['secret'], 'key') + + + # migrate radius server + radius_server = new_base + ['authentication', 'radius-server'] + if config.exists(radius_server): + for server in config.list_nodes(radius_server): + base = radius_server + [server] + new = new_base + ['authentication', 'radius', 'server', server] + + # convert secret to key + if config.exists(base + ['secret']): + tmp = config.return_value(base + ['secret']) + config.set(new + ['key'], value=tmp) + + if config.exists(base + ['fail-time']): + tmp = config.return_value(base + ['fail-time']) + config.set(new + ['fail-time'], value=tmp) + + if config.exists(base + ['req-limit']): + tmp = config.return_value(base + ['req-limit']) + config.set(new + ['req-limit'], value=tmp) + + config.set_tag(new_base + ['authentication', 'radius', 'server']) + config.delete(radius_server) try: with open(file_name, 'w') as f: -- cgit v1.2.3 From a8920a1f13e6091355d33541802b1486c0cfa653 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 23:07:43 +0100 Subject: sstp: T2008: remove req-limit config node Limiting the amount of requests passed to a server seems to be the wrong way to tackle a problem. --- interface-definitions/vpn-sstp.xml.in | 5 ----- src/conf_mode/vpn_sstp.py | 8 ++------ src/migration-scripts/sstp/0-to-1 | 5 +---- 3 files changed, 3 insertions(+), 15 deletions(-) (limited to 'src/conf_mode') diff --git a/interface-definitions/vpn-sstp.xml.in b/interface-definitions/vpn-sstp.xml.in index 1508c3313..bb851608c 100644 --- a/interface-definitions/vpn-sstp.xml.in +++ b/interface-definitions/vpn-sstp.xml.in @@ -118,11 +118,6 @@ - - - Maximum number of simultaneous requests to server (default: unlimited) - - If server does not responds mark it as unavailable for this time (seconds) diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index e8c5155dd..09de7d112 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -100,7 +100,7 @@ chap-secrets=/etc/accel-ppp/sstp/chap-secrets [radius] verbose=1 {% for r in radius_server %} -server={{ r.server }},{{ r.key }},auth-port={{ r.port }},req-limit={{ r.req_limit }},fail-time={{ r.fail_time }} +server={{ r.server }},{{ r.key }},auth-port={{ r.port }},req-limit=0,fail-time={{ r.fail_time }} {% endfor -%} acct-timeout={{ radius_acct_tmo }} @@ -286,8 +286,7 @@ def get_config(): 'server' : server, 'key' : '', 'fail_time' : 0, - 'port' : '1812', - 'req_limit' : 0 + 'port' : '1812' } conf.set_level(base_path + ['authentication', 'radius', 'server', server]) @@ -298,9 +297,6 @@ def get_config(): if conf.exists(['port']): radius['port'] = conf.return_value(['port']) - if conf.exists(['req-limit']): - radius['req_limit'] = conf.return_value(['req-limit']) - if conf.exists(['key']): radius['key'] = conf.return_value(['key']) diff --git a/src/migration-scripts/sstp/0-to-1 b/src/migration-scripts/sstp/0-to-1 index 652a2662f..2edf76a56 100755 --- a/src/migration-scripts/sstp/0-to-1 +++ b/src/migration-scripts/sstp/0-to-1 @@ -20,6 +20,7 @@ # - migrate RADIUS configuration to a more uniform syntax accross the system # - authentication radius-server x.x.x.x to authentication radius server x.x.x.x # - authentication radius-settings to authentication radius +# - do not migrate radius server req-limit, use default of unlimited import os import sys @@ -101,10 +102,6 @@ else: tmp = config.return_value(base + ['fail-time']) config.set(new + ['fail-time'], value=tmp) - if config.exists(base + ['req-limit']): - tmp = config.return_value(base + ['req-limit']) - config.set(new + ['req-limit'], value=tmp) - config.set_tag(new_base + ['authentication', 'radius', 'server']) config.delete(radius_server) -- cgit v1.2.3 From 95c42faa4436c5dd761049a8a6e75996c815cc2c Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 20 Mar 2020 23:22:09 +0100 Subject: sstp: T2008: migrate SSL certificate nodes --- interface-definitions/vpn-sstp.xml.in | 55 +++++++++++++++-------------------- src/conf_mode/vpn_sstp.py | 14 ++++----- src/migration-scripts/sstp/0-to-1 | 17 +++++++++++ 3 files changed, 48 insertions(+), 38 deletions(-) (limited to 'src/conf_mode') diff --git a/interface-definitions/vpn-sstp.xml.in b/interface-definitions/vpn-sstp.xml.in index cf864b069..59aae9f7f 100644 --- a/interface-definitions/vpn-sstp.xml.in +++ b/interface-definitions/vpn-sstp.xml.in @@ -252,42 +252,35 @@ - + - SSTP settings + SSL Certificate, SSL Key and CA (/config/user-data/sstp) - + - SSL Certificate, SSL Key and CA (/config/user-data/sstp) + Certificate Authority certificate + + + - - - - Certificate Authority certificate - - - - - - - - Server Certificate - - - - - - - - Privat Key of the Server Certificate - - - - - - - + + + + Server Certificate + + + + + + + + Privat Key of the Server Certificate + + + + + diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py index 09de7d112..a2e7c9327 100755 --- a/src/conf_mode/vpn_sstp.py +++ b/src/conf_mode/vpn_sstp.py @@ -373,15 +373,15 @@ def get_config(): # # read in SSL certs - conf.set_level(base_path + ['sstp-settings', 'ssl-certs']) - if conf.exists(['ca']): - sstp['ssl_ca'] = conf.return_value(['ca']) + conf.set_level(base_path + ['ssl']) + if conf.exists(['ca-cert-file']): + sstp['ssl_ca'] = conf.return_value(['ca-cert-file']) - if conf.exists(['server-cert']): - sstp['ssl_cert'] = conf.return_value(['server-cert']) + if conf.exists(['cert-file']): + sstp['ssl_cert'] = conf.return_value(['cert-file']) - if conf.exists(['server-key']): - sstp['ssl_key'] = conf.return_value(['server-key']) + if conf.exists(['key-file']): + sstp['ssl_key'] = conf.return_value(['key-file']) # diff --git a/src/migration-scripts/sstp/0-to-1 b/src/migration-scripts/sstp/0-to-1 index 2edf76a56..1d1bea51f 100755 --- a/src/migration-scripts/sstp/0-to-1 +++ b/src/migration-scripts/sstp/0-to-1 @@ -21,6 +21,7 @@ # - authentication radius-server x.x.x.x to authentication radius server x.x.x.x # - authentication radius-settings to authentication radius # - do not migrate radius server req-limit, use default of unlimited +# - migrate SSL certificate path import os import sys @@ -105,6 +106,22 @@ else: config.set_tag(new_base + ['authentication', 'radius', 'server']) config.delete(radius_server) + # migrate SSL certificates + old_ssl = new_base + ['sstp-settings', 'ssl-certs'] + new_ssl = new_base + ['ssl'] + config.copy(old_ssl, new_ssl) + config.delete(old_ssl) + + if config.exists(new_ssl + ['ca']): + config.rename(new_ssl + ['ca'], 'ca-cert-file') + + if config.exists(new_ssl + ['server-cert']): + config.rename(new_ssl + ['server-cert'], 'cert-file') + + if config.exists(new_ssl + ['server-key']): + config.rename(new_ssl + ['server-key'], 'key-file') + + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3