From f57eef6751a32d7cfd59485e980855f10e8e1d07 Mon Sep 17 00:00:00 2001
From: Viacheslav <v.gletenko@vyos.io>
Date: Thu, 13 Jan 2022 00:49:08 +0000
Subject: monitoring: T3872: Rewrite input filter custom_script

Rewrite and improve the custom input filter telegraf script
"show_interfaces_input_filter.py" to more readable and clear format
Fix bug when it failed with configured tunnel "tunX" interfaces
---
 .../custom_scripts/show_interfaces_input_filter.py | 123 ++++++++++++++-------
 1 file changed, 82 insertions(+), 41 deletions(-)

(limited to 'src/etc')

diff --git a/src/etc/telegraf/custom_scripts/show_interfaces_input_filter.py b/src/etc/telegraf/custom_scripts/show_interfaces_input_filter.py
index 0f5e366cd..0c7474156 100755
--- a/src/etc/telegraf/custom_scripts/show_interfaces_input_filter.py
+++ b/src/etc/telegraf/custom_scripts/show_interfaces_input_filter.py
@@ -1,47 +1,88 @@
 #!/usr/bin/env python3
 
-import subprocess
+from vyos.ifconfig import Section
+from vyos.ifconfig import Interface
+
 import time
 
-def status_to_int(status):
-    switcher={
-        'u':'0',
-        'D':'1',
-        'A':'2'
-        }
-    return switcher.get(status,"")
-
-def description_check(line):
-    desc=" ".join(line[3:])
-    if desc == "":
+def get_interfaces(type='', vlan=True):
+    """
+    Get interfaces:
+    ['dum0', 'eth0', 'eth1', 'eth1.5', 'lo', 'tun0']
+    """
+    interfaces = []
+    ifaces = Section.interfaces(type)
+    for iface in ifaces:
+        if vlan == False and '.' in iface:
+            continue
+        interfaces.append(iface)
+
+    return interfaces
+
+def get_interface_addresses(iface, link_local_v6=False):
+    """
+    Get IP and IPv6 addresses from interface in one string
+    By default don't get IPv6 link-local addresses
+    If interface doesn't have address, return "-"
+    """
+    addresses = []
+    addrs = Interface(iface).get_addr()
+
+    for addr in addrs:
+        if link_local_v6 == False:
+            if addr.startswith('fe80::'):
+                continue
+        addresses.append(addr)
+
+    if not addresses:
+        return "-"
+
+    return (" ".join(addresses))
+
+def get_interface_description(iface):
+    """
+    Get interface description
+    If none return "empty"
+    """
+    description = Interface(iface).get_alias()
+
+    if not description:
         return "empty"
+
+    return description
+
+def get_interface_admin_state(iface):
+    """
+    Interface administrative state
+    up => 0, down => 2
+    """
+    state = Interface(iface).get_admin_state()
+    if state == 'up':
+        admin_state = 0
+    if state == 'down':
+        admin_state = 2
+
+    return admin_state
+
+def get_interface_oper_state(iface):
+    """
+    Interface operational state
+    up => 0, down => 1
+    """
+    state = Interface(iface).operational.get_state()
+    if state == 'down':
+        oper_state = 1
     else:
-        return desc
-
-def gen_ip_list(index,interfaces):
-    line=interfaces[index].split()
-    ip_list=line[1]
-    if index < len(interfaces):
-        index += 1
-        while len(interfaces[index].split())==1:
-            ip = interfaces[index].split()
-            ip_list = ip_list + " " + ip[0]
-            index += 1
-            if index == len(interfaces):
-                break
-    return ip_list
-
-interfaces = subprocess.check_output("/usr/libexec/vyos/op_mode/show_interfaces.py --action=show-brief", shell=True).decode('utf-8').splitlines()
-del interfaces[:3]
-lines_count=len(interfaces)
-index=0
-while index<lines_count:
-    line=interfaces[index].split()
-    if len(line)>1:
-        print(f'show_interfaces,interface={line[0]} '
-              f'ip_addresses="{gen_ip_list(index,interfaces)}",'
-              f'state={status_to_int(line[2][0])}i,'
-              f'link={status_to_int(line[2][2])}i,'
-              f'description="{description_check(line)}" '
-              f'{str(int(time.time()))}000000000')
-    index += 1
+        oper_state = 0
+
+    return oper_state
+
+interfaces = get_interfaces()
+
+for iface in interfaces:
+    print(f'show_interfaces,interface={iface} '
+          f'ip_addresses="{get_interface_addresses(iface)}",'
+          f'state={get_interface_admin_state(iface)}i,'
+          f'link={get_interface_oper_state(iface)}i,'
+          f'description="{get_interface_description(iface)}" '
+          f'{str(int(time.time()))}000000000')
-- 
cgit v1.2.3


From 78b247b724f74bdabab0706aaa7f5b00e5809bc1 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 28 Jan 2022 22:15:29 +0100
Subject: dhclient: T3392: remove /usr/sbin prefix from iproute2 ip command

---
 src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper | 16 ++++++++--------
 src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup    |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

(limited to 'src/etc')

diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper b/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper
index 74a7e83bf..9d5505758 100644
--- a/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper
@@ -4,7 +4,7 @@
 IF_METRIC=${IF_METRIC:-210}
 
 # Check if interface is inside a VRF
-VRF_OPTION=$(/usr/sbin/ip -j -d link show ${interface} | awk '{if(match($0, /.*"master":"(\w+)".*"info_slave_kind":"vrf"/, IFACE_DETAILS)) printf("vrf %s", IFACE_DETAILS[1])}')
+VRF_OPTION=$(ip -j -d link show ${interface} | awk '{if(match($0, /.*"master":"(\w+)".*"info_slave_kind":"vrf"/, IFACE_DETAILS)) printf("vrf %s", IFACE_DETAILS[1])}')
 
 # get status of FRR
 function frr_alive () {
@@ -66,9 +66,9 @@ function iptovtysh () {
 # delete the same route from kernel before adding new one
 function delroute () {
     logmsg info "Checking if the route presented in kernel: $@ $VRF_OPTION"
-    if /usr/sbin/ip route show $@ $VRF_OPTION | grep -qx "$1 " ; then
-        logmsg info "Deleting IP route: \"/usr/sbin/ip route del $@ $VRF_OPTION\""
-        /usr/sbin/ip route del $@ $VRF_OPTION
+    if ip route show $@ $VRF_OPTION | grep -qx "$1 " ; then
+        logmsg info "Deleting IP route: \"ip route del $@ $VRF_OPTION\""
+        ip route del $@ $VRF_OPTION
     fi
 }
 
@@ -76,8 +76,8 @@ function delroute () {
 function ip () {
     # pass comand to system `ip` if this is not related to routes change
     if [ "$2" != "route" ] ; then
-        logmsg info "Passing command to /usr/sbin/ip: \"$@\""
-        /usr/sbin/ip $@
+        logmsg info "Passing command to iproute2: \"$@\""
+        ip $@
     else
         # if we want to work with routes, try to use FRR first
         if frr_alive ; then
@@ -87,8 +87,8 @@ function ip () {
             vtysh -c "conf t" -c "$VTYSH_CMD"
         else
             # add ip route to kernel
-            logmsg info "Modifying routes in kernel: \"/usr/sbin/ip $@\""
-            /usr/sbin/ip $@ $VRF_OPTION
+            logmsg info "Modifying routes in kernel: \"ip $@\""
+            ip $@ $VRF_OPTION
         fi
     fi
 }
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
index ad6a1d5eb..a6989441b 100644
--- a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
@@ -1,7 +1,7 @@
 ##
 ## VyOS cleanup
 ##
-# NOTE: here we use 'ip' wrapper, therefore a route will be actually deleted via /usr/sbin/ip or vtysh, according to the system state
+# NOTE: here we use 'ip' wrapper, therefore a route will be actually deleted via ip or vtysh, according to the system state
 hostsd_client="/usr/bin/vyos-hostsd-client"
 hostsd_changes=
 # check vyos-hostsd status
-- 
cgit v1.2.3


From bf549b34e7daab7e843176bc1c8a8d03148f3840 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 1 Feb 2022 08:00:58 +0100
Subject: Revert "dhclient: T3392: remove /usr/sbin prefix from iproute2 ip
 command"

This reverts commit 78b247b724f74bdabab0706aaa7f5b00e5809bc1.
---
 src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper | 16 ++++++++--------
 src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup    |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

(limited to 'src/etc')

diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper b/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper
index 9d5505758..74a7e83bf 100644
--- a/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/03-vyos-ipwrapper
@@ -4,7 +4,7 @@
 IF_METRIC=${IF_METRIC:-210}
 
 # Check if interface is inside a VRF
-VRF_OPTION=$(ip -j -d link show ${interface} | awk '{if(match($0, /.*"master":"(\w+)".*"info_slave_kind":"vrf"/, IFACE_DETAILS)) printf("vrf %s", IFACE_DETAILS[1])}')
+VRF_OPTION=$(/usr/sbin/ip -j -d link show ${interface} | awk '{if(match($0, /.*"master":"(\w+)".*"info_slave_kind":"vrf"/, IFACE_DETAILS)) printf("vrf %s", IFACE_DETAILS[1])}')
 
 # get status of FRR
 function frr_alive () {
@@ -66,9 +66,9 @@ function iptovtysh () {
 # delete the same route from kernel before adding new one
 function delroute () {
     logmsg info "Checking if the route presented in kernel: $@ $VRF_OPTION"
-    if ip route show $@ $VRF_OPTION | grep -qx "$1 " ; then
-        logmsg info "Deleting IP route: \"ip route del $@ $VRF_OPTION\""
-        ip route del $@ $VRF_OPTION
+    if /usr/sbin/ip route show $@ $VRF_OPTION | grep -qx "$1 " ; then
+        logmsg info "Deleting IP route: \"/usr/sbin/ip route del $@ $VRF_OPTION\""
+        /usr/sbin/ip route del $@ $VRF_OPTION
     fi
 }
 
@@ -76,8 +76,8 @@ function delroute () {
 function ip () {
     # pass comand to system `ip` if this is not related to routes change
     if [ "$2" != "route" ] ; then
-        logmsg info "Passing command to iproute2: \"$@\""
-        ip $@
+        logmsg info "Passing command to /usr/sbin/ip: \"$@\""
+        /usr/sbin/ip $@
     else
         # if we want to work with routes, try to use FRR first
         if frr_alive ; then
@@ -87,8 +87,8 @@ function ip () {
             vtysh -c "conf t" -c "$VTYSH_CMD"
         else
             # add ip route to kernel
-            logmsg info "Modifying routes in kernel: \"ip $@\""
-            ip $@ $VRF_OPTION
+            logmsg info "Modifying routes in kernel: \"/usr/sbin/ip $@\""
+            /usr/sbin/ip $@ $VRF_OPTION
         fi
     fi
 }
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
index a6989441b..ad6a1d5eb 100644
--- a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
@@ -1,7 +1,7 @@
 ##
 ## VyOS cleanup
 ##
-# NOTE: here we use 'ip' wrapper, therefore a route will be actually deleted via ip or vtysh, according to the system state
+# NOTE: here we use 'ip' wrapper, therefore a route will be actually deleted via /usr/sbin/ip or vtysh, according to the system state
 hostsd_client="/usr/bin/vyos-hostsd-client"
 hostsd_changes=
 # check vyos-hostsd status
-- 
cgit v1.2.3


From 4ddfe9b7e72e4f1e1fc8e70c5239bf09644e6d9b Mon Sep 17 00:00:00 2001
From: Viacheslav Hletenko <v.gletenko@vyos.io>
Date: Tue, 8 Feb 2022 08:38:12 +0000
Subject: monitoring: T3872: Add input filter for firewall InfluxDB2

Input filter for firewall allows to get bytes/counters from
nftables in format, required for InfluxDB2
---
 data/templates/monitoring/telegraf.tmpl            |  3 +-
 .../custom_scripts/show_firewall_input_filter.py   | 73 ++++++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100755 src/etc/telegraf/custom_scripts/show_firewall_input_filter.py

(limited to 'src/etc')

diff --git a/data/templates/monitoring/telegraf.tmpl b/data/templates/monitoring/telegraf.tmpl
index 465b58c80..d3145a500 100644
--- a/data/templates/monitoring/telegraf.tmpl
+++ b/data/templates/monitoring/telegraf.tmpl
@@ -17,7 +17,7 @@
 [[outputs.influxdb_v2]]
   urls = ["{{ url }}:{{ port }}"]
   insecure_skip_verify = true
-  token = "{{ authentication.token }}"
+  token = "$INFLUX_TOKEN"
   organization = "{{ authentication.organization }}"
   bucket = "{{ bucket }}"
 [[inputs.cpu]]
@@ -52,6 +52,7 @@
   syslog_standard = "RFC3164"
 [[inputs.exec]]
   commands = [
+    "{{ custom_scripts_dir }}/show_firewall_input_filter.py",
     "{{ custom_scripts_dir }}/show_interfaces_input_filter.py",
     "{{ custom_scripts_dir }}/vyos_services_input_filter.py"
   ]
diff --git a/src/etc/telegraf/custom_scripts/show_firewall_input_filter.py b/src/etc/telegraf/custom_scripts/show_firewall_input_filter.py
new file mode 100755
index 000000000..bf4bfd05d
--- /dev/null
+++ b/src/etc/telegraf/custom_scripts/show_firewall_input_filter.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+
+import json
+import re
+import time
+
+from vyos.util import cmd
+
+
+def get_nft_filter_chains():
+    """
+    Get list of nft chains for table filter
+    """
+    nft = cmd('/usr/sbin/nft --json list table ip filter')
+    nft = json.loads(nft)
+    chain_list = []
+
+    for output in nft['nftables']:
+        if 'chain' in output:
+            chain = output['chain']['name']
+            chain_list.append(chain)
+
+    return chain_list
+
+
+def get_nftables_details(name):
+    """
+    Get dict, counters packets and bytes for chain
+    """
+    command = f'/usr/sbin/nft list chain ip filter {name}'
+    try:
+        results = cmd(command)
+    except:
+        return {}
+
+    # Trick to remove 'NAME_' from chain name in the comment
+    # It was added to any chain T4218
+    # counter packets 0 bytes 0 return comment "FOO default-action accept"
+    comment_name = name.replace("NAME_", "")
+    out = {}
+    for line in results.split('\n'):
+        comment_search = re.search(rf'{comment_name}[\- ](\d+|default-action)', line)
+        if not comment_search:
+            continue
+
+        rule = {}
+        rule_id = comment_search[1]
+        counter_search = re.search(r'counter packets (\d+) bytes (\d+)', line)
+        if counter_search:
+            rule['packets'] = counter_search[1]
+            rule['bytes'] = counter_search[2]
+
+        rule['conditions'] = re.sub(r'(\b(counter packets \d+ bytes \d+|drop|reject|return|log)\b|comment "[\w\-]+")', '', line).strip()
+        out[rule_id] = rule
+    return out
+
+
+def get_nft_telegraf(name):
+    """
+    Get data for telegraf in influxDB format
+    """
+    for rule, rule_config in get_nftables_details(name).items():
+        print(f'nftables,table=filter,chain={name},'
+              f'ruleid={rule} '
+              f'pkts={rule_config["packets"]}i,'
+              f'bytes={rule_config["bytes"]}i '
+              f'{str(int(time.time()))}000000000')
+
+
+chains = get_nft_filter_chains()
+
+for chain in chains:
+    get_nft_telegraf(chain)
-- 
cgit v1.2.3


From 1cbcbf40b7721849f9696c05fac65db010a66b7c Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Thu, 17 Feb 2022 20:58:02 +0100
Subject: openvpn: T4230: globally enable ip_nonlocal_bind

---
 src/conf_mode/interfaces-openvpn.py         | 7 -------
 src/etc/sysctl.d/33-vyos-nonlocal-bind.conf | 8 ++++++++
 2 files changed, 8 insertions(+), 7 deletions(-)
 create mode 100644 src/etc/sysctl.d/33-vyos-nonlocal-bind.conf

(limited to 'src/etc')

diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 329399274..29a25eedc 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -649,13 +649,6 @@ def apply(openvpn):
 
         return None
 
-    # verify specified IP address is present on any interface on this system
-    # Allow to bind service to nonlocal address, if it virtaual-vrrp address
-    # or if address will be assign later
-    if 'local_host' in openvpn:
-        if not is_addr_assigned(openvpn['local_host']):
-            cmd('sysctl -w net.ipv4.ip_nonlocal_bind=1')
-
     # No matching OpenVPN process running - maybe it got killed or none
     # existed - nevertheless, spawn new OpenVPN process
     call(f'systemctl reload-or-restart openvpn@{interface}.service')
diff --git a/src/etc/sysctl.d/33-vyos-nonlocal-bind.conf b/src/etc/sysctl.d/33-vyos-nonlocal-bind.conf
new file mode 100644
index 000000000..aa81b5336
--- /dev/null
+++ b/src/etc/sysctl.d/33-vyos-nonlocal-bind.conf
@@ -0,0 +1,8 @@
+### Added by vyos-1x ###
+#
+# ip_nonlocal_bind - BOOLEAN
+#     If set, allows processes to bind() to non-local IP addresses,
+#     which can be quite useful - but may break some applications.
+#     Default: 0
+net.ipv4.ip_nonlocal_bind = 1
+net.ipv6.ip_nonlocal_bind = 1
-- 
cgit v1.2.3


From 42c011224e5aef3c27f9de6b5a74e594a404131e Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 1 Mar 2022 19:09:12 +0100
Subject: flow-accounting: T4277: support sending flow-data via VRF interface

It should be possible to send the gathered data via a VRF bound interface to
the collector. This is somehow related to T3981 but it's the opposite side of
the netflow process.

set system flow-accounting vrf <name>
---
 data/templates/netflow/uacctd.conf.tmpl            | 74 ----------------------
 data/templates/pmacct/override.conf.tmpl           | 17 +++++
 data/templates/pmacct/uacctd.conf.tmpl             | 74 ++++++++++++++++++++++
 interface-definitions/flow-accounting-conf.xml.in  |  1 +
 .../scripts/cli/test_system_flow-accounting.py     |  5 +-
 src/conf_mode/flow_accounting_conf.py              | 14 ++--
 .../systemd/system/uacctd.service.d/override.conf  | 14 ----
 7 files changed, 106 insertions(+), 93 deletions(-)
 delete mode 100644 data/templates/netflow/uacctd.conf.tmpl
 create mode 100644 data/templates/pmacct/override.conf.tmpl
 create mode 100644 data/templates/pmacct/uacctd.conf.tmpl
 delete mode 100644 src/etc/systemd/system/uacctd.service.d/override.conf

(limited to 'src/etc')

diff --git a/data/templates/netflow/uacctd.conf.tmpl b/data/templates/netflow/uacctd.conf.tmpl
deleted file mode 100644
index f81002dc1..000000000
--- a/data/templates/netflow/uacctd.conf.tmpl
+++ /dev/null
@@ -1,74 +0,0 @@
-# Genereated from VyOS configuration
-daemonize: true
-promisc: false
-pidfile: /run/pmacct/uacctd.pid
-uacctd_group: 2
-uacctd_nl_size: 2097152
-snaplen: {{ packet_length }}
-aggregate: in_iface{{ ',out_iface' if enable_egress is defined }},src_mac,dst_mac,vlan,src_host,dst_host,src_port,dst_port,proto,tos,flows
-{% set pipe_size = buffer_size | int *1024 *1024 %}
-plugin_pipe_size: {{ pipe_size }}
-{# We need an integer division (//) without any remainder or fraction #}
-plugin_buffer_size: {{ pipe_size // 1000 }}
-{% if syslog_facility is defined and syslog_facility is not none %}
-syslog: {{ syslog_facility }}
-{% endif %}
-{% if disable_imt is not defined %}
-imt_path: /tmp/uacctd.pipe
-imt_mem_pools_number: 169
-{% endif %}
-
-{% set plugin = [] %}
-{% if disable_imt is not defined %}
-{%   set plugin = ['memory'] %}
-{% endif %}
-{% if netflow is defined and netflow.server is defined and netflow.server is not none %}
-{%   for server in netflow.server %}
-{%     set plugin = plugin.append('nfprobe[nf_' ~ server ~ ']') %}
-{%   endfor %}
-{% endif %}
-{% if sflow is defined and sflow.server is defined and sflow.server is not none %}
-{%   for server in sflow.server %}
-{%     set plugin = plugin.append('sfprobe[sf_' ~ server ~ ']') %}
-{%   endfor %}
-{% endif %}
-plugins: {{ plugin | join(',') }}
-
-{% if netflow is defined and netflow.server is defined and netflow.server is not none %}
-# NetFlow servers
-{%   for server, server_config in netflow.server.items() %}
-nfprobe_receiver[nf_{{ server }}]: {{ server }}:{{ server_config.port }}
-nfprobe_version[nf_{{ server }}]: {{ netflow.version }}
-{%     if netflow.engine_id is defined and netflow.engine_id is not none %}
-nfprobe_engine[nf_{{ server }}]: {{ netflow.engine_id }}
-{%     endif %}
-{%     if netflow.max_flows is defined and netflow.max_flows is not none %}
-nfprobe_maxflows[nf_{{ server }}]: {{ netflow.max_flows }}
-{%     endif %}
-{%     if netflow.sampling_rate is defined and netflow.sampling_rate is not none %}
-sampling_rate[nf_{{ server }}]: {{ netflow.sampling_rate }}
-{%     endif %}
-{%     if netflow.source_address is defined and netflow.source_address is not none %}
-nfprobe_source_ip[nf_{{ server }}]: {{ netflow.source_address }}
-{%     endif %}
-{%     if netflow.timeout is defined and netflow.timeout is not none %}
-nfprobe_timeouts[nf_{{ server }}]: expint={{ netflow.timeout.expiry_interval }}:general={{ netflow.timeout.flow_generic }}:icmp={{ netflow.timeout.icmp }}:maxlife={{ netflow.timeout.max_active_life }}:tcp.fin={{ netflow.timeout.tcp_fin }}:tcp={{ netflow.timeout.tcp_generic }}:tcp.rst={{ netflow.timeout.tcp_rst }}:udp={{ netflow.timeout.udp }}
-{%     endif %}
-
-{%   endfor %}
-{% endif %}
-
-{% if sflow is defined and sflow.server is defined and sflow.server is not none %}
-# sFlow servers
-{%   for server, server_config in sflow.server.items() %}
-sfprobe_receiver[sf_{{ server }}]: {{ server }}:{{ server_config.port }}
-sfprobe_agentip[sf_{{ server }}]: {{ sflow.agent_address }}
-{%     if sflow.sampling_rate is defined and sflow.sampling_rate is not none %}
-sampling_rate[sf_{{ server }}]: {{ sflow.sampling_rate }}
-{%     endif %}
-{%     if sflow.source_address is defined and sflow.source_address is not none %}
-sfprobe_source_ip[sf_{{ server }}]: {{ sflow.source_address }}
-{%     endif %}
-
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/pmacct/override.conf.tmpl b/data/templates/pmacct/override.conf.tmpl
new file mode 100644
index 000000000..216927666
--- /dev/null
+++ b/data/templates/pmacct/override.conf.tmpl
@@ -0,0 +1,17 @@
+{% set vrf_command = 'ip vrf exec ' + vrf + ' ' if vrf is defined else '' %}
+[Unit]
+After=
+After=vyos-router.service
+ConditionPathExists=
+ConditionPathExists=/run/pmacct/uacctd.conf
+
+[Service]
+EnvironmentFile=
+ExecStart=
+ExecStart={{vrf_command}}/usr/sbin/uacctd -f /run/pmacct/uacctd.conf
+WorkingDirectory=
+WorkingDirectory=/run/pmacct
+PIDFile=
+PIDFile=/run/pmacct/uacctd.pid
+Restart=always
+RestartSec=10
diff --git a/data/templates/pmacct/uacctd.conf.tmpl b/data/templates/pmacct/uacctd.conf.tmpl
new file mode 100644
index 000000000..b58f7c796
--- /dev/null
+++ b/data/templates/pmacct/uacctd.conf.tmpl
@@ -0,0 +1,74 @@
+# Genereated from VyOS configuration
+daemonize: true
+promisc: false
+pidfile: /run/pmacct/uacctd.pid
+uacctd_group: 2
+uacctd_nl_size: 2097152
+snaplen: {{ packet_length }}
+aggregate: in_iface{{ ',out_iface' if enable_egress is defined }},src_mac,dst_mac,vlan,src_host,dst_host,src_port,dst_port,proto,tos,flows
+{% set pipe_size = buffer_size | int *1024 *1024 %}
+plugin_pipe_size: {{ pipe_size }}
+{# We need an integer division (//) without any remainder or fraction #}
+plugin_buffer_size: {{ pipe_size // 1000 }}
+{% if syslog_facility is defined and syslog_facility is not none %}
+syslog: {{ syslog_facility }}
+{% endif %}
+{% if disable_imt is not defined %}
+imt_path: /tmp/uacctd.pipe
+imt_mem_pools_number: 169
+{% endif %}
+
+{% set plugin = [] %}
+{% if netflow is defined and netflow.server is defined and netflow.server is not none %}
+{%   for server in netflow.server %}
+{%     set _ = plugin.append('nfprobe[nf_' ~ server ~ ']') %}
+{%   endfor %}
+{% endif %}
+{% if sflow is defined and sflow.server is defined and sflow.server is not none %}
+{%   for server in sflow.server %}
+{%     set _ = plugin.append('sfprobe[sf_' ~ server ~ ']') %}
+{%   endfor %}
+{% endif %}
+{% if disable_imt is not defined %}
+{%     set _ = plugin.append('memory') %}
+{% endif %}
+plugins: {{ plugin | join(',') }}
+
+{% if netflow is defined and netflow.server is defined and netflow.server is not none %}
+# NetFlow servers
+{%   for server, server_config in netflow.server.items() %}
+nfprobe_receiver[nf_{{ server }}]: {{ server }}:{{ server_config.port }}
+nfprobe_version[nf_{{ server }}]: {{ netflow.version }}
+{%     if netflow.engine_id is defined and netflow.engine_id is not none %}
+nfprobe_engine[nf_{{ server }}]: {{ netflow.engine_id }}
+{%     endif %}
+{%     if netflow.max_flows is defined and netflow.max_flows is not none %}
+nfprobe_maxflows[nf_{{ server }}]: {{ netflow.max_flows }}
+{%     endif %}
+{%     if netflow.sampling_rate is defined and netflow.sampling_rate is not none %}
+sampling_rate[nf_{{ server }}]: {{ netflow.sampling_rate }}
+{%     endif %}
+{%     if netflow.source_address is defined and netflow.source_address is not none %}
+nfprobe_source_ip[nf_{{ server }}]: {{ netflow.source_address }}
+{%     endif %}
+{%     if netflow.timeout is defined and netflow.timeout is not none %}
+nfprobe_timeouts[nf_{{ server }}]: expint={{ netflow.timeout.expiry_interval }}:general={{ netflow.timeout.flow_generic }}:icmp={{ netflow.timeout.icmp }}:maxlife={{ netflow.timeout.max_active_life }}:tcp.fin={{ netflow.timeout.tcp_fin }}:tcp={{ netflow.timeout.tcp_generic }}:tcp.rst={{ netflow.timeout.tcp_rst }}:udp={{ netflow.timeout.udp }}
+{%     endif %}
+
+{%   endfor %}
+{% endif %}
+
+{% if sflow is defined and sflow.server is defined and sflow.server is not none %}
+# sFlow servers
+{%   for server, server_config in sflow.server.items() %}
+sfprobe_receiver[sf_{{ server }}]: {{ server }}:{{ server_config.port }}
+sfprobe_agentip[sf_{{ server }}]: {{ sflow.agent_address }}
+{%     if sflow.sampling_rate is defined and sflow.sampling_rate is not none %}
+sampling_rate[sf_{{ server }}]: {{ sflow.sampling_rate }}
+{%     endif %}
+{%     if sflow.source_address is defined and sflow.source_address is not none %}
+sfprobe_source_ip[sf_{{ server }}]: {{ sflow.source_address }}
+{%     endif %}
+
+{%   endfor %}
+{% endif %}
diff --git a/interface-definitions/flow-accounting-conf.xml.in b/interface-definitions/flow-accounting-conf.xml.in
index 05cf5e170..133e45c72 100644
--- a/interface-definitions/flow-accounting-conf.xml.in
+++ b/interface-definitions/flow-accounting-conf.xml.in
@@ -431,6 +431,7 @@
               #include <include/source-address-ipv4-ipv6.xml.i>
             </children>
           </node>
+          #include <include/interface/vrf.xml.i>
         </children>
       </node>
     </children>
diff --git a/smoketest/scripts/cli/test_system_flow-accounting.py b/smoketest/scripts/cli/test_system_flow-accounting.py
index 857df1be6..84f17bcb0 100755
--- a/smoketest/scripts/cli/test_system_flow-accounting.py
+++ b/smoketest/scripts/cli/test_system_flow-accounting.py
@@ -39,6 +39,9 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase):
         cls.cli_delete(cls, base_path)
 
     def tearDown(self):
+        # after service removal process must no longer run
+        self.assertTrue(process_named_running(PROCESS_NAME))
+
         self.cli_delete(base_path)
         self.cli_commit()
 
@@ -213,9 +216,9 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase):
         uacctd = read_file(uacctd_conf)
 
         tmp = []
-        tmp.append('memory')
         for server, server_config in netflow_server.items():
             tmp.append(f'nfprobe[nf_{server}]')
+        tmp.append('memory')
         self.assertIn('plugins: ' + ','.join(tmp), uacctd)
 
         for server, server_config in netflow_server.items():
diff --git a/src/conf_mode/flow_accounting_conf.py b/src/conf_mode/flow_accounting_conf.py
index 975f19acf..25bf54790 100755
--- a/src/conf_mode/flow_accounting_conf.py
+++ b/src/conf_mode/flow_accounting_conf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2021 VyOS maintainers and contributors
+# Copyright (C) 2018-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -27,6 +27,7 @@ from vyos.configdict import dict_merge
 from vyos.ifconfig import Section
 from vyos.ifconfig import Interface
 from vyos.template import render
+from vyos.util import call
 from vyos.util import cmd
 from vyos.validate import is_addr_assigned
 from vyos.xml import defaults
@@ -35,6 +36,8 @@ from vyos import airbag
 airbag.enable()
 
 uacctd_conf_path = '/run/pmacct/uacctd.conf'
+systemd_service = 'uacctd.service'
+systemd_override = f'/etc/systemd/system/{systemd_service}.d/override.conf'
 nftables_nflog_table = 'raw'
 nftables_nflog_chain = 'VYOS_CT_PREROUTING_HOOK'
 egress_nftables_nflog_table = 'inet mangle'
@@ -236,7 +239,10 @@ def generate(flow_config):
     if not flow_config:
         return None
 
-    render(uacctd_conf_path, 'netflow/uacctd.conf.tmpl', flow_config)
+    render(uacctd_conf_path, 'pmacct/uacctd.conf.tmpl', flow_config)
+    render(systemd_override, 'pmacct/override.conf.tmpl', flow_config)
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
 
 def apply(flow_config):
     action = 'restart'
@@ -246,13 +252,13 @@ def apply(flow_config):
         _nftables_config([], 'egress')
 
         # Stop flow-accounting daemon and remove configuration file
-        cmd('systemctl stop uacctd.service')
+        call(f'systemctl stop {systemd_service}')
         if os.path.exists(uacctd_conf_path):
             os.unlink(uacctd_conf_path)
         return
 
     # Start/reload flow-accounting daemon
-    cmd(f'systemctl restart uacctd.service')
+    call(f'systemctl restart {systemd_service}')
 
     # configure nftables rules for defined interfaces
     if 'interface' in flow_config:
diff --git a/src/etc/systemd/system/uacctd.service.d/override.conf b/src/etc/systemd/system/uacctd.service.d/override.conf
deleted file mode 100644
index 38bcce515..000000000
--- a/src/etc/systemd/system/uacctd.service.d/override.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-After=
-After=vyos-router.service
-ConditionPathExists=
-ConditionPathExists=/run/pmacct/uacctd.conf
-
-[Service]
-EnvironmentFile=
-ExecStart=
-ExecStart=/usr/sbin/uacctd -f /run/pmacct/uacctd.conf
-WorkingDirectory=
-WorkingDirectory=/run/pmacct
-PIDFile=
-PIDFile=/run/pmacct/uacctd.pid
-- 
cgit v1.2.3


From 2c94c3ec72a559de405b29b4399250db3085717e Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sat, 5 Mar 2022 09:40:32 +0100
Subject: conntrackd: T4259: prevent startup of multiple daemon instances

---
 debian/vyos-1x.preinst         | 2 +-
 src/etc/logrotate.d/conntrackd | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 src/etc/logrotate.d/conntrackd

(limited to 'src/etc')

diff --git a/debian/vyos-1x.preinst b/debian/vyos-1x.preinst
index 45440bf64..71750b3a1 100644
--- a/debian/vyos-1x.preinst
+++ b/debian/vyos-1x.preinst
@@ -1,4 +1,4 @@
 dpkg-divert --package vyos-1x --add --rename /etc/securetty
 dpkg-divert --package vyos-1x --add --rename /etc/security/capability.conf
 dpkg-divert --package vyos-1x --add --rename /lib/systemd/system/lcdproc.service
-
+dpkg-divert --package vyos-1x --add --rename /etc/logrotate.d/conntrackd
diff --git a/src/etc/logrotate.d/conntrackd b/src/etc/logrotate.d/conntrackd
new file mode 100644
index 000000000..b0b09dec1
--- /dev/null
+++ b/src/etc/logrotate.d/conntrackd
@@ -0,0 +1,9 @@
+/var/log/conntrackd-stats.log {
+    weekly
+    rotate 2
+    missingok
+
+    postrotate
+        systemctl restart conntrackd.service > /dev/null
+    endscript
+}
-- 
cgit v1.2.3


From ebb524702e1cd60a74b00727b7bd24d375648c78 Mon Sep 17 00:00:00 2001
From: zsdc <taras@vyos.io>
Date: Mon, 7 Mar 2022 18:20:53 +0200
Subject: logrotate: T4250: Fixed logrotate config generation

* Removed `/var/log/auth.log` and `/var/log/messages` from
`/etc/logrotate.d/rsyslog`, because they conflict with VyOS-controlled
items what leads to service error.
* Removed generation config file for `/var/log/messages` from
`system-syslog.py` - this should be done from `syslom logs` now.
* Generate each logfile from `system syslog file` to a dedicated
logrotate config file.
* Fixed logrotate config file names in
`/etc/rsyslog.d/vyos-rsyslog.conf`.
* Added default logrotate settins for `/var/log/messages`
---
 data/templates/syslog/logrotate.tmpl |  9 ++++-----
 debian/vyos-1x.postinst              |  4 ++++
 src/conf_mode/system-syslog.py       | 14 +++++++++++---
 src/etc/logrotate.d/vyos-rsyslog     | 12 ++++++++++++
 4 files changed, 31 insertions(+), 8 deletions(-)
 create mode 100644 src/etc/logrotate.d/vyos-rsyslog

(limited to 'src/etc')

diff --git a/data/templates/syslog/logrotate.tmpl b/data/templates/syslog/logrotate.tmpl
index f758265e4..c1b951e8b 100644
--- a/data/templates/syslog/logrotate.tmpl
+++ b/data/templates/syslog/logrotate.tmpl
@@ -1,12 +1,11 @@
-{% for file in files %}
-{{files[file]['log-file']}} {
+{{ config_render['log-file'] }} {
   missingok
   notifempty
   create
-  rotate {{files[file]['max-files']}}
-  size={{files[file]['max-size']//1024}}k
+  rotate {{ config_render['max-files'] }}
+  size={{ config_render['max-size'] // 1024 }}k
   postrotate
     invoke-rc.d rsyslog rotate > /dev/null
   endscript
 }
-{% endfor %}
+
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst
index 1a4c830cc..1ca6687a3 100644
--- a/debian/vyos-1x.postinst
+++ b/debian/vyos-1x.postinst
@@ -93,3 +93,7 @@ for file in $DELETE; do
         rm -f ${file}
     fi
 done
+
+# Remove logrotate items controlled via CLI and VyOS defaults
+sed -i '/^\/var\/log\/messages$/d' /etc/logrotate.d/rsyslog
+sed -i '/^\/var\/log\/auth.log$/d' /etc/logrotate.d/rsyslog
diff --git a/src/conf_mode/system-syslog.py b/src/conf_mode/system-syslog.py
index 3d8a51cd8..309b4bdb0 100755
--- a/src/conf_mode/system-syslog.py
+++ b/src/conf_mode/system-syslog.py
@@ -17,6 +17,7 @@
 import os
 import re
 
+from pathlib import Path
 from sys import exit
 
 from vyos.config import Config
@@ -89,7 +90,7 @@ def get_config(config=None):
                     filename: {
                         'log-file': '/var/log/user/' + filename,
                         'max-files': '5',
-                        'action-on-max-size': '/usr/sbin/logrotate /etc/logrotate.d/' + filename,
+                        'action-on-max-size': '/usr/sbin/logrotate /etc/logrotate.d/vyos-rsyslog-generated-' + filename,
                         'selectors': '*.err',
                         'max-size': 262144
                     }
@@ -205,10 +206,17 @@ def generate(c):
     conf = '/etc/rsyslog.d/vyos-rsyslog.conf'
     render(conf, 'syslog/rsyslog.conf.tmpl', c)
 
+    # cleanup current logrotate config files
+    logrotate_files = Path('/etc/logrotate.d/').glob('vyos-rsyslog-generated-*')
+    for file in logrotate_files:
+        file.unlink()
+
     # eventually write for each file its own logrotate file, since size is
     # defined it shouldn't matter
-    conf = '/etc/logrotate.d/vyos-rsyslog'
-    render(conf, 'syslog/logrotate.tmpl', c)
+    for filename, fileconfig in c.get('files', {}).items():
+        if fileconfig['log-file'].startswith('/var/log/user/'):
+            conf = '/etc/logrotate.d/vyos-rsyslog-generated-' + filename
+            render(conf, 'syslog/logrotate.tmpl', { 'config_render': fileconfig })
 
 
 def verify(c):
diff --git a/src/etc/logrotate.d/vyos-rsyslog b/src/etc/logrotate.d/vyos-rsyslog
new file mode 100644
index 000000000..3c087b94e
--- /dev/null
+++ b/src/etc/logrotate.d/vyos-rsyslog
@@ -0,0 +1,12 @@
+/var/log/messages {
+    create
+    missingok
+    nomail
+    notifempty
+    rotate 10
+    size 1M
+    postrotate
+        # inform rsyslog service about rotation
+        /usr/lib/rsyslog/rsyslog-rotate
+    endscript
+}
-- 
cgit v1.2.3


From 60f093464692f08c1c32c9e31513a6ae98636617 Mon Sep 17 00:00:00 2001
From: Daniil Baturin <daniil@vyos.io>
Date: Mon, 28 Mar 2022 10:46:30 +0300
Subject: Revert "openvpn: T4230: globally enable ip_nonlocal_bind"

This reverts commit 1cbcbf40b7721849f9696c05fac65db010a66b7c.
---
 src/conf_mode/interfaces-openvpn.py         | 7 +++++++
 src/etc/sysctl.d/33-vyos-nonlocal-bind.conf | 8 --------
 2 files changed, 7 insertions(+), 8 deletions(-)
 delete mode 100644 src/etc/sysctl.d/33-vyos-nonlocal-bind.conf

(limited to 'src/etc')

diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index c30c0bdd0..8f9c0b3f1 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -653,6 +653,13 @@ def apply(openvpn):
 
         return None
 
+    # verify specified IP address is present on any interface on this system
+    # Allow to bind service to nonlocal address, if it virtaual-vrrp address
+    # or if address will be assign later
+    if 'local_host' in openvpn:
+        if not is_addr_assigned(openvpn['local_host']):
+            cmd('sysctl -w net.ipv4.ip_nonlocal_bind=1')
+
     # No matching OpenVPN process running - maybe it got killed or none
     # existed - nevertheless, spawn new OpenVPN process
     action = 'reload-or-restart'
diff --git a/src/etc/sysctl.d/33-vyos-nonlocal-bind.conf b/src/etc/sysctl.d/33-vyos-nonlocal-bind.conf
deleted file mode 100644
index aa81b5336..000000000
--- a/src/etc/sysctl.d/33-vyos-nonlocal-bind.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-### Added by vyos-1x ###
-#
-# ip_nonlocal_bind - BOOLEAN
-#     If set, allows processes to bind() to non-local IP addresses,
-#     which can be quite useful - but may break some applications.
-#     Default: 0
-net.ipv4.ip_nonlocal_bind = 1
-net.ipv6.ip_nonlocal_bind = 1
-- 
cgit v1.2.3


From 5faeacd1111a83e5859b98ccc4193cb6017cdba8 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sat, 2 Apr 2022 14:38:11 +0200
Subject: wwan: T4324: cronjob is setup via interfaces-wwan.py - drop dedicated
 cron file

---
 debian/vyos-1x.install    | 1 -
 src/etc/cron.d/check-wwan | 1 -
 2 files changed, 2 deletions(-)
 delete mode 100644 src/etc/cron.d/check-wwan

(limited to 'src/etc')

diff --git a/debian/vyos-1x.install b/debian/vyos-1x.install
index 63dff43a5..493c896eb 100644
--- a/debian/vyos-1x.install
+++ b/debian/vyos-1x.install
@@ -1,4 +1,3 @@
-etc/cron.d
 etc/cron.hourly
 etc/dhcp
 etc/ipsec.d
diff --git a/src/etc/cron.d/check-wwan b/src/etc/cron.d/check-wwan
deleted file mode 100644
index 28190776f..000000000
--- a/src/etc/cron.d/check-wwan
+++ /dev/null
@@ -1 +0,0 @@
-*/5 * * * * root /usr/libexec/vyos/vyos-check-wwan.py
-- 
cgit v1.2.3