From c593bf7f597735b4b95c3923bb6ea6fc2c2ae346 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Wed, 8 Sep 2021 14:35:20 +0200
Subject: openvpn: T3805: drop privileges using systemd - required for
 rtnetlink

(cherry picked from commit 2647edc30f1e02840cae62fde8b44345d35ac720)
---
 src/etc/systemd/system/openvpn@.service.d/override.conf | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src/etc')

diff --git a/src/etc/systemd/system/openvpn@.service.d/override.conf b/src/etc/systemd/system/openvpn@.service.d/override.conf
index 7946484a3..03fe6b587 100644
--- a/src/etc/systemd/system/openvpn@.service.d/override.conf
+++ b/src/etc/systemd/system/openvpn@.service.d/override.conf
@@ -7,3 +7,7 @@ WorkingDirectory=
 WorkingDirectory=/run/openvpn
 ExecStart=
 ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
+User=openvpn
+Group=openvpn
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
-- 
cgit v1.2.3


From 65398e5c8aedf2f206bb706e97aa828e409d07b3 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 21 Sep 2021 20:29:36 +0200
Subject: vrrp: keepalived: T616: move configuration to volatile /run directory

Move keepalived configuration from /etc/keepalived to /run/keepalived.

(cherry picked from commit b243795eba1b36cadd81c3149e833bdf5c5bea70)
---
 data/templates/vrrp/keepalived.conf.tmpl                  |  3 +--
 python/vyos/ifconfig/vrrp.py                              |  8 ++++----
 smoketest/scripts/cli/test_ha_vrrp.py                     |  6 ++----
 src/conf_mode/vrrp.py                                     |  5 ++++-
 src/etc/systemd/system/keepalived.service.d/override.conf | 10 ++++++++++
 src/system/keepalived-fifo.py                             | 14 +++++++-------
 6 files changed, 28 insertions(+), 18 deletions(-)

(limited to 'src/etc')

diff --git a/data/templates/vrrp/keepalived.conf.tmpl b/data/templates/vrrp/keepalived.conf.tmpl
index 13619ca69..c9835049a 100644
--- a/data/templates/vrrp/keepalived.conf.tmpl
+++ b/data/templates/vrrp/keepalived.conf.tmpl
@@ -5,7 +5,7 @@
 global_defs {
     dynamic_interfaces
     script_user root
-    notify_fifo /run/keepalived_notify_fifo
+    notify_fifo /run/keepalived/keepalived_notify_fifo
     notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
 }
 
@@ -16,7 +16,6 @@ vrrp_script healthcheck_{{ group.name }} {
     interval {{ group.health_check_interval }}
     fall {{ group.health_check_count }}
     rise 1
-
 }
 {%   endif %}
 
diff --git a/python/vyos/ifconfig/vrrp.py b/python/vyos/ifconfig/vrrp.py
index b522cc1ab..481b0284a 100644
--- a/python/vyos/ifconfig/vrrp.py
+++ b/python/vyos/ifconfig/vrrp.py
@@ -32,14 +32,14 @@ class VRRPNoData(VRRPError):
 class VRRP(object):
     _vrrp_prefix = '00:00:5E:00:01:'
     location = {
-        'pid':      '/run/keepalived.pid',
-        'fifo':     '/run/keepalived_notify_fifo',
+        'pid':      '/run/keepalived/keepalived.pid',
+        'fifo':     '/run/keepalived/keepalived_notify_fifo',
         'state':    '/tmp/keepalived.data',
         'stats':    '/tmp/keepalived.stats',
         'json':     '/tmp/keepalived.json',
         'daemon':   '/etc/default/keepalived',
-        'config':   '/etc/keepalived/keepalived.conf',
-        'vyos':     '/run/keepalived_config.dict',
+        'config':   '/run/keepalived/keepalived.conf',
+        'vyos':     '/run/keepalived/keepalived_config.dict',
     }
 
     _signal = {
diff --git a/smoketest/scripts/cli/test_ha_vrrp.py b/smoketest/scripts/cli/test_ha_vrrp.py
index 03618c7d8..9c8d26699 100755
--- a/smoketest/scripts/cli/test_ha_vrrp.py
+++ b/smoketest/scripts/cli/test_ha_vrrp.py
@@ -14,22 +14,20 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import os
-import re
 import unittest
 
 from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.configsession import ConfigSession
 from vyos.configsession import ConfigSessionError
+from vyos.ifconfig.vrrp import VRRP
 from vyos.util import cmd
 from vyos.util import process_named_running
 from vyos.util import read_file
-
 from vyos.template import inc_ip
 
 PROCESS_NAME = 'keepalived'
-KEEPALIVED_CONF = '/etc/keepalived/keepalived.conf'
+KEEPALIVED_CONF = VRRP.location['config']
 base_path = ['high-availability', 'vrrp']
 
 vrrp_interface = 'eth1'
diff --git a/src/conf_mode/vrrp.py b/src/conf_mode/vrrp.py
index 4cee87003..cee6a9ba2 100755
--- a/src/conf_mode/vrrp.py
+++ b/src/conf_mode/vrrp.py
@@ -30,6 +30,7 @@ import vyos.config
 
 from vyos import ConfigError
 from vyos.util import call
+from vyos.util import makedir
 from vyos.template import render
 
 from vyos.ifconfig.vrrp import VRRP
@@ -136,7 +137,9 @@ def get_config(config=None):
         sync_groups.append(sync_group)
 
     # create a file with dict with proposed configuration
-    with open("{}.temp".format(VRRP.location['vyos']), 'w') as dict_file:
+    dirname = os.path.dirname(VRRP.location['vyos'])
+    makedir(dirname)
+    with open(VRRP.location['vyos'] + ".temp", 'w') as dict_file:
         dict_file.write(dumps({'vrrp_groups': vrrp_groups, 'sync_groups': sync_groups}))
 
     return (vrrp_groups, sync_groups)
diff --git a/src/etc/systemd/system/keepalived.service.d/override.conf b/src/etc/systemd/system/keepalived.service.d/override.conf
index 9fcabf652..e338b90a2 100644
--- a/src/etc/systemd/system/keepalived.service.d/override.conf
+++ b/src/etc/systemd/system/keepalived.service.d/override.conf
@@ -1,2 +1,12 @@
+[Unit]
+ConditionPathExists=
+ConditionPathExists=/run/keepalived/keepalived.conf
+After=
+After=vyos-router.service
+
 [Service]
 KillMode=process
+ExecStart=
+ExecStart=/usr/sbin/keepalived --use-file /run/keepalived/keepalived.conf --pid /run/keepalived/keepalived.pid --dont-fork $DAEMON_ARGS
+PIDFile=
+PIDFile=/run/keepalived/keepalived.pid
diff --git a/src/system/keepalived-fifo.py b/src/system/keepalived-fifo.py
index 7e2076820..1e749207b 100755
--- a/src/system/keepalived-fifo.py
+++ b/src/system/keepalived-fifo.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright (C) 2020-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -13,7 +13,6 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
 
 import os
 import time
@@ -22,11 +21,12 @@ import argparse
 import threading
 import re
 import json
-from pathlib import Path
-from queue import Queue
 import logging
+
+from queue import Queue
 from logging.handlers import SysLogHandler
 
+from vyos.ifconfig.vrrp import VRRP
 from vyos.util import cmd
 
 # configure logging
@@ -60,7 +60,7 @@ class KeepalivedFifo:
     def _config_load(self):
         try:
             # read the dictionary file with configuration
-            with open('/run/keepalived_config.dict', 'r') as dict_file:
+            with open(VRRP.location['vyos'], 'r') as dict_file:
                 vrrp_config_dict = json.load(dict_file)
             self.vrrp_config = {'vrrp_groups': {}, 'sync_groups': {}}
             # save VRRP instances to the new dictionary
@@ -93,8 +93,8 @@ class KeepalivedFifo:
 
     # create FIFO pipe
     def pipe_create(self):
-        if Path(self.pipe_path).exists():
-            logger.info("PIPE already exist: {}".format(self.pipe_path))
+        if os.path.exists(self.pipe_path):
+            logger.info(f"PIPE already exist: {self.pipe_path}")
         else:
             os.mkfifo(self.pipe_path)
 
-- 
cgit v1.2.3


From 260f383221ea1b23e644b0c50f45eeb300e9bc24 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 21 Sep 2021 22:33:07 +0200
Subject: vrrp: keepalived: T616: drop /etc/default/keepalived

This is a follow-up commit to 65398e5c8 ("vrrp: keepalived: T616: move
configuration to volatile /run directory") as it makes no sense to store a
static /etc/default/keepalived file marked as "Autogenerated by VyOS" that only
enabled the SNMP option to keepalived.

Better pass the --snmp switch via the systemd override file and drop all other
references/files.
---
 data/templates/vrrp/daemon.tmpl                           | 5 -----
 python/vyos/ifconfig/vrrp.py                              | 1 -
 src/conf_mode/vrrp.py                                     | 1 -
 src/etc/systemd/system/keepalived.service.d/override.conf | 2 +-
 4 files changed, 1 insertion(+), 8 deletions(-)
 delete mode 100644 data/templates/vrrp/daemon.tmpl

(limited to 'src/etc')

diff --git a/data/templates/vrrp/daemon.tmpl b/data/templates/vrrp/daemon.tmpl
deleted file mode 100644
index c9dbea72d..000000000
--- a/data/templates/vrrp/daemon.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-# Autogenerated by VyOS
-# Options to pass to keepalived
-
-# DAEMON_ARGS are appended to the keepalived command-line
-DAEMON_ARGS="--snmp"
diff --git a/python/vyos/ifconfig/vrrp.py b/python/vyos/ifconfig/vrrp.py
index 481b0284a..3d6f4d7c6 100644
--- a/python/vyos/ifconfig/vrrp.py
+++ b/python/vyos/ifconfig/vrrp.py
@@ -37,7 +37,6 @@ class VRRP(object):
         'state':    '/tmp/keepalived.data',
         'stats':    '/tmp/keepalived.stats',
         'json':     '/tmp/keepalived.json',
-        'daemon':   '/etc/default/keepalived',
         'config':   '/run/keepalived/keepalived.conf',
         'vyos':     '/run/keepalived/keepalived_config.dict',
     }
diff --git a/src/conf_mode/vrrp.py b/src/conf_mode/vrrp.py
index cee6a9ba2..55c4cc67a 100755
--- a/src/conf_mode/vrrp.py
+++ b/src/conf_mode/vrrp.py
@@ -231,7 +231,6 @@ def generate(data):
 
     render(VRRP.location['config'], 'vrrp/keepalived.conf.tmpl',
             {"groups": vrrp_groups, "sync_groups": sync_groups})
-    render(VRRP.location['daemon'], 'vrrp/daemon.tmpl', {})
     return None
 
 
diff --git a/src/etc/systemd/system/keepalived.service.d/override.conf b/src/etc/systemd/system/keepalived.service.d/override.conf
index e338b90a2..c18ae0c29 100644
--- a/src/etc/systemd/system/keepalived.service.d/override.conf
+++ b/src/etc/systemd/system/keepalived.service.d/override.conf
@@ -7,6 +7,6 @@ After=vyos-router.service
 [Service]
 KillMode=process
 ExecStart=
-ExecStart=/usr/sbin/keepalived --use-file /run/keepalived/keepalived.conf --pid /run/keepalived/keepalived.pid --dont-fork $DAEMON_ARGS
+ExecStart=/usr/sbin/keepalived --use-file /run/keepalived/keepalived.conf --pid /run/keepalived/keepalived.pid --dont-fork --snmp
 PIDFile=
 PIDFile=/run/keepalived/keepalived.pid
-- 
cgit v1.2.3


From 2224130742d2867bb12b81deac8972d17920d9d7 Mon Sep 17 00:00:00 2001
From: zsdc <taras@vyos.io>
Date: Tue, 28 Sep 2021 12:50:30 +0300
Subject: dhclient: T3852: Fixed dhclient processes search

Backported commits:
13abffe43b2a5c41bb4ec4675c227f6cf1f868da
01158a8eaa574c48c726c20693479e4aa6e18ee6

This allows finding all running dhclient processes properly.
---
 .../dhclient-enter-hooks.d/02-vyos-stopdhclient    | 23 +++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

(limited to 'src/etc')

diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient b/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
index 939055a63..f737148dc 100644
--- a/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
@@ -2,26 +2,35 @@
 if [ -z ${CONTROLLED_STOP} ] ; then
     # stop dhclient for this interface, if it is not current one
     # get PID for current dhclient
-    current_dhclient=`ps --no-headers --format ppid --pid $$ | awk '{ print $1 }'`
+    current_dhclient=`ps --no-headers --format ppid --pid $$ | awk '{ print \$1 }'`
 
     # get PID for master process (current can be a fork)
-    master_dhclient=`ps --no-headers --format ppid --pid $current_dhclient | awk '{ print $1 }'`
+    master_dhclient=`ps --no-headers --format ppid --pid $current_dhclient | awk '{ print \$1 }'`
 
     # get IP version for current dhclient
-    ipversion_arg=`ps --no-headers --format args --pid $current_dhclient | awk '{ print $2 }'`
+    ipversion_arg=`ps --no-headers --format args --pid $current_dhclient | awk 'match(\$0, /\s-(4|6)\s/, IPV) { printf("%s", IPV[1]) }'`
 
     # get list of all dhclient running for current interface
-    dhclients_pids=(`pgrep -f "dhclient $ipversion_arg.* $interface(\s|$)"`)
+    if [[ $ipversion_arg == "6" ]]; then
+        dhclients_pids=(`pgrep -f "dhclient.*\s-6\s.*\s$interface(\s|$)"`)
+    else
+        dhclients_pids=(`ps --no-headers --format pid,args -C dhclient | awk "{ if(match(\\$0, /\s${interface}(\s|$)/) && !match(\\$0, /\s-6\s/)) printf(\"%s\n\", \\$1) }"`)
+    fi
 
     logmsg info "Current dhclient PID: $current_dhclient, Parent PID: $master_dhclient, IP version: $ipversion_arg, All dhclients for interface $interface: ${dhclients_pids[@]}"
     # stop all dhclients for current interface, except current one
     for dhclient in ${dhclients_pids[@]}; do
         if ([ $dhclient -ne $current_dhclient ] && [ $dhclient -ne $master_dhclient ]); then
-            logmsg info "Stopping dhclient with PID: ${dhclient}"
             # get path to PID-file of dhclient process
-            local dhclient_pidfile=`ps --no-headers --format args --pid $dhclient | awk 'match($0, ".*-pf (/.*pid) .*", PF) { print PF[1] }'`
+            local dhclient_pidfile=`ps --no-headers --format args --pid $dhclient | awk 'match(\$0, ".*-pf (/.*pid) .*", PF) { print PF[1] }'`
             # stop dhclient with native command - this will run dhclient-script with correct reason unlike simple kill
-            dhclient -e CONTROLLED_STOP=yes -x -pf $dhclient_pidfile
+            logmsg info "Stopping dhclient with PID: ${dhclient}, PID file: $dhclient_pidfile"
+            if [[ -e $dhclient_pidfile ]]; then
+                dhclient -e CONTROLLED_STOP=yes -x -pf $dhclient_pidfile
+            else
+                logmsg error "PID file $dhclient_pidfile does not exists, killing dhclient with SIGTERM signal"
+                kill -s 15 ${dhclient}
+            fi
         fi
     done
 fi
-- 
cgit v1.2.3


From 67b3dd6b4715fef266eb47e68623944f8be617e0 Mon Sep 17 00:00:00 2001
From: Ross Dougherty <ross@dougherty.id.au>
Date: Wed, 20 Oct 2021 23:50:51 +1100
Subject: dhclient hooks: T3920: avoid 'too many args' error when no vrf

---
 src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/etc')

diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
index edb7c7b27..f060c6ee8 100644
--- a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
@@ -19,7 +19,7 @@ if [[ $reason =~ (EXPIRE|FAIL|RELEASE|STOP) ]]; then
     for router in $old_routers; do
         # check if we are bound to a VRF
         local vrf_name=$(basename /sys/class/net/${interface}/upper_* | sed -e 's/upper_//')
-        if [ -n $vrf_name ]; then
+        if [ "$vrf_name" != "*" ]; then
             vrf="vrf $vrf_name"
         fi
 
-- 
cgit v1.2.3


From 60775392123a0253863ab7af5accd3b61285d84e Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sun, 31 Oct 2021 13:48:22 +0100
Subject: console: udev: T3954: adjust rule script to new systemd-udev version

We can no longer use bash veriable string code vor string manipulation. Move to
a more robust "cut" implementation.

(cherry picked from commit 513e951f3e1358ec6ff5424d03e8f4e9aa7c3388)
---
 src/etc/udev/rules.d/90-vyos-serial.rules | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/etc')

diff --git a/src/etc/udev/rules.d/90-vyos-serial.rules b/src/etc/udev/rules.d/90-vyos-serial.rules
index 3f10f4924..5cca89e89 100644
--- a/src/etc/udev/rules.d/90-vyos-serial.rules
+++ b/src/etc/udev/rules.d/90-vyos-serial.rules
@@ -22,7 +22,7 @@ IMPORT{builtin}="path_id", IMPORT{builtin}="usb_id"
 #   (tr -d -) does the replacement
 # - Replace the first group after ":" to represent the bus relation (sed -e 0,/:/s//b/) indicated by "b"
 # - Replace the next group after ":" to represent the port relation (sed -e 0,/:/s//p/) indicated by "p"
-ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="",   PROGRAM="/bin/sh -c 'D=$env{ID_PATH}; echo ${D:17} | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
-ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="?*", PROGRAM="/bin/sh -c 'D=$env{ID_PATH}; echo ${D:17} | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
+ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="",   PROGRAM="/bin/sh -c 'echo $env{ID_PATH} | cut -d- -f3- | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
+ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="?*", PROGRAM="/bin/sh -c 'echo $env{ID_PATH} | cut -d- -f3- | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
 
 LABEL="serial_end"
-- 
cgit v1.2.3


From 0c2384114e8abbd9c883a57729564c70c0a86eec Mon Sep 17 00:00:00 2001
From: zsdc <taras@vyos.io>
Date: Mon, 25 Oct 2021 21:44:00 +0300
Subject: dhclient: T3940: Added lease file argument to the `dhclient -x` call

When `dhclient` with the `-x` option is used to stop running DHCP client
with a lease file that is not the same as in the new `dhclient` process,
it requires a `-lf` argument with a path to the old lease file to find
information about old/active leases and process them according to
instructions and config.

This commit adds the option to the `02-vyos-stopdhclient` hook, which
allows to properly process `dhclient` instances started in different
ways.

(cherry picked from commit 393970f9ee5b3dfc58e0e999d3d5941a198b2c6f)
---
 src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/etc')

diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient b/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
index f737148dc..ae6bf9f16 100644
--- a/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
@@ -23,10 +23,12 @@ if [ -z ${CONTROLLED_STOP} ] ; then
         if ([ $dhclient -ne $current_dhclient ] && [ $dhclient -ne $master_dhclient ]); then
             # get path to PID-file of dhclient process
             local dhclient_pidfile=`ps --no-headers --format args --pid $dhclient | awk 'match(\$0, ".*-pf (/.*pid) .*", PF) { print PF[1] }'`
+            # get path to lease-file of dhclient process
+            local dhclient_leasefile=`ps --no-headers --format args --pid $dhclient | awk 'match(\$0, ".*-lf (/\\\S*leases) .*", LF) { print LF[1] }'`
             # stop dhclient with native command - this will run dhclient-script with correct reason unlike simple kill
-            logmsg info "Stopping dhclient with PID: ${dhclient}, PID file: $dhclient_pidfile"
+            logmsg info "Stopping dhclient with PID: ${dhclient}, PID file: ${dhclient_pidfile}, Leases file: ${dhclient_leasefile}"
             if [[ -e $dhclient_pidfile ]]; then
-                dhclient -e CONTROLLED_STOP=yes -x -pf $dhclient_pidfile
+                dhclient -e CONTROLLED_STOP=yes -x -pf $dhclient_pidfile -lf $dhclient_leasefile
             else
                 logmsg error "PID file $dhclient_pidfile does not exists, killing dhclient with SIGTERM signal"
                 kill -s 15 ${dhclient}
-- 
cgit v1.2.3


From 50a1b4a1170182864760613216b68322f165a749 Mon Sep 17 00:00:00 2001
From: zsdc <taras@vyos.io>
Date: Mon, 4 Oct 2021 10:40:31 +0300
Subject: OpenVPN: T3350: Changed custom options for OpenVPN processing

Custom OpenVPN options moved back to the command line from a
configuration file. This should keep full compatibility with the
`crux` branch, and allows to avoid mistakes with parsing options
that contain `--` in the middle.
The only smart part of this - handling a `push` option. Because
of internal changes in OpenVPN, previously it did not require an
argument in the double-quotes, but after version update in
`equuleus` and `sagitta` old syntax became invalid. So, all the
`push` options are processed to add quotes. The solution is still
not complete, because if a single config line contains `push` with
other options, it will not work, but it is better than nothing.

(cherry picked from commit 3fd2ff423b6c6e992b2ed531c7ba99fb9e1a2123)
---
 data/templates/openvpn/server.conf.tmpl              | 13 -------------
 data/templates/openvpn/service-override.conf.tmpl    | 20 ++++++++++++++++++++
 src/conf_mode/interfaces-openvpn.py                  | 12 ++++++++++++
 .../system/openvpn@.service.d/10-override.conf       | 13 +++++++++++++
 .../systemd/system/openvpn@.service.d/override.conf  | 13 -------------
 5 files changed, 45 insertions(+), 26 deletions(-)
 create mode 100644 data/templates/openvpn/service-override.conf.tmpl
 create mode 100644 src/etc/systemd/system/openvpn@.service.d/10-override.conf
 delete mode 100644 src/etc/systemd/system/openvpn@.service.d/override.conf

(limited to 'src/etc')

diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl
index c96b57fb8..c2b0c2ef9 100644
--- a/data/templates/openvpn/server.conf.tmpl
+++ b/data/templates/openvpn/server.conf.tmpl
@@ -257,16 +257,3 @@ auth {{ hash }}
 auth-user-pass {{ auth_user_pass_file }}
 auth-retry nointeract
 {% endif %}
-
-{% if openvpn_option is defined and openvpn_option is not none %}
-#
-# Custom options added by user (not validated)
-#
-{%   for option in openvpn_option %}
-{%     for argument in option.split('--') %}
-{%       if argument is defined and argument != '' %}
---{{ argument }}
-{%       endif %}
-{%     endfor %}
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/openvpn/service-override.conf.tmpl b/data/templates/openvpn/service-override.conf.tmpl
new file mode 100644
index 000000000..069bdbd08
--- /dev/null
+++ b/data/templates/openvpn/service-override.conf.tmpl
@@ -0,0 +1,20 @@
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
+{%- if openvpn_option is defined and openvpn_option is not none %}
+{%   for option in openvpn_option %}
+{#     Remove the '--' prefix from variable if it is presented #}
+{%     if option.startswith('--') %}
+{%       set option = option.split('--', maxsplit=1)[1] %}
+{%     endif %}
+{#     Workaround to pass '--push' options properly. Previously openvpn accepted this option without values in double-quotes #}
+{#     But now it stopped doing this, so we need to add them for compatibility #}
+{#     HOWEVER! This is a raw option and we do not promise that this or any other trick will work for all the cases. #}
+{#     Using 'openvpn-option' you take all responsibility for compatibility for yourself. #}
+{%     if option.startswith('push') and not (option.startswith('push "') and option.endswith('"')) %}
+{%       set option = 'push \"%s\"'|format(option.split('push ', maxsplit=1)[1]) %}
+{%     endif %}
+ --{{ option }}
+{%-   endfor %}
+{% endif %}
+
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 5d537dadf..4e3c19be2 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -51,6 +51,7 @@ user = 'openvpn'
 group = 'openvpn'
 
 cfg_file = '/run/openvpn/{ifname}.conf'
+service_file = '/run/systemd/system/openvpn@{ifname}.service.d/20-override.conf'
 
 def checkCertHeader(header, filename):
     """
@@ -434,6 +435,11 @@ def generate(openvpn):
     if os.path.isdir(ccd_dir):
         rmtree(ccd_dir, ignore_errors=True)
 
+    # Remove systemd directories with overrides
+    service_dir = os.path.dirname(service_file.format(**openvpn))
+    if os.path.isdir(service_dir):
+        rmtree(service_dir, ignore_errors=True)
+
     if 'deleted' in openvpn or 'disable' in openvpn:
         return None
 
@@ -477,6 +483,12 @@ def generate(openvpn):
     render(cfg_file.format(**openvpn), 'openvpn/server.conf.tmpl', openvpn,
            formater=lambda _: _.replace("&quot;", '"'), user=user, group=group)
 
+    # Render 20-override.conf for OpenVPN service
+    render(service_file.format(**openvpn), 'openvpn/service-override.conf.tmpl', openvpn,
+           formater=lambda _: _.replace("&quot;", '"'), user=user, group=group)
+    # Reload systemd services config to apply an override
+    call(f'systemctl daemon-reload')
+
     return None
 
 def apply(openvpn):
diff --git a/src/etc/systemd/system/openvpn@.service.d/10-override.conf b/src/etc/systemd/system/openvpn@.service.d/10-override.conf
new file mode 100644
index 000000000..03fe6b587
--- /dev/null
+++ b/src/etc/systemd/system/openvpn@.service.d/10-override.conf
@@ -0,0 +1,13 @@
+[Unit]
+After=
+After=vyos-router.service
+
+[Service]
+WorkingDirectory=
+WorkingDirectory=/run/openvpn
+ExecStart=
+ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
+User=openvpn
+Group=openvpn
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
diff --git a/src/etc/systemd/system/openvpn@.service.d/override.conf b/src/etc/systemd/system/openvpn@.service.d/override.conf
deleted file mode 100644
index 03fe6b587..000000000
--- a/src/etc/systemd/system/openvpn@.service.d/override.conf
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-After=
-After=vyos-router.service
-
-[Service]
-WorkingDirectory=
-WorkingDirectory=/run/openvpn
-ExecStart=
-ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
-User=openvpn
-Group=openvpn
-AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
-- 
cgit v1.2.3


From b618790b9e5ab51e5d4f65e6756fedca70882cba Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 15 Nov 2021 21:19:51 +0100
Subject: openvpn: T3995: implement systemd reload support

(cherry picked from commit eceaa3a787929f5a514b9c45da52936c0d4d4a54)
---
 src/conf_mode/interfaces-openvpn.py                        | 4 ++--
 src/etc/systemd/system/openvpn@.service.d/10-override.conf | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/etc')

diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 4e3c19be2..ae35ed3c4 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -493,10 +493,10 @@ def generate(openvpn):
 
 def apply(openvpn):
     interface = openvpn['ifname']
-    call(f'systemctl stop openvpn@{interface}.service')
 
     # Do some cleanup when OpenVPN is disabled/deleted
     if 'deleted' in openvpn or 'disable' in openvpn:
+        call(f'systemctl stop openvpn@{interface}.service')
         for cleanup_file in glob(f'/run/openvpn/{interface}.*'):
             if os.path.isfile(cleanup_file):
                 os.unlink(cleanup_file)
@@ -508,7 +508,7 @@ def apply(openvpn):
 
     # No matching OpenVPN process running - maybe it got killed or none
     # existed - nevertheless, spawn new OpenVPN process
-    call(f'systemctl start openvpn@{interface}.service')
+    call(f'systemctl reload-or-restart openvpn@{interface}.service')
 
     conf = VTunIf.get_config()
     conf['device_type'] = openvpn['device_type']
diff --git a/src/etc/systemd/system/openvpn@.service.d/10-override.conf b/src/etc/systemd/system/openvpn@.service.d/10-override.conf
index 03fe6b587..775a2d7ba 100644
--- a/src/etc/systemd/system/openvpn@.service.d/10-override.conf
+++ b/src/etc/systemd/system/openvpn@.service.d/10-override.conf
@@ -7,6 +7,7 @@ WorkingDirectory=
 WorkingDirectory=/run/openvpn
 ExecStart=
 ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
+ExecReload=/bin/kill -HUP $MAINPID
 User=openvpn
 Group=openvpn
 AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
-- 
cgit v1.2.3


From eb6247e4b464c36fa7441627b221d0db39429251 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Thu, 18 Nov 2021 17:58:44 +0100
Subject: wwan: T3795: periodically check if WWAN connection needs a reconnect

---
 debian/vyos-1x.install         |  1 +
 src/etc/cron.d/check-wwan      |  1 +
 src/helpers/vyos-check-wwan.py | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+)
 create mode 100644 src/etc/cron.d/check-wwan
 create mode 100755 src/helpers/vyos-check-wwan.py

(limited to 'src/etc')

diff --git a/debian/vyos-1x.install b/debian/vyos-1x.install
index c075db898..0c0c203ea 100644
--- a/debian/vyos-1x.install
+++ b/debian/vyos-1x.install
@@ -1,3 +1,4 @@
+etc/cron.d
 etc/dhcp
 etc/netplug
 etc/ppp
diff --git a/src/etc/cron.d/check-wwan b/src/etc/cron.d/check-wwan
new file mode 100644
index 000000000..28190776f
--- /dev/null
+++ b/src/etc/cron.d/check-wwan
@@ -0,0 +1 @@
+*/5 * * * * root /usr/libexec/vyos/vyos-check-wwan.py
diff --git a/src/helpers/vyos-check-wwan.py b/src/helpers/vyos-check-wwan.py
new file mode 100755
index 000000000..c6e6c54b7
--- /dev/null
+++ b/src/helpers/vyos-check-wwan.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from vyos.configquery import VbashOpRun
+from vyos.configquery import ConfigTreeQuery
+
+from vyos.util import is_wwan_connected
+from vyos.util import call
+
+conf = ConfigTreeQuery()
+dict = conf.get_config_dict(['interfaces', 'wwan'], key_mangling=('-', '_'),
+                            get_first_key=True)
+
+for interface, interface_config in dict.items():
+    if not is_wwan_connected(interface):
+        if 'disable' in interface_config:
+            # do not restart this interface as it's disabled by the user
+            continue
+
+        #op = VbashOpRun()
+        #op.run(['connect', 'interface', interface])
+        call(f'VYOS_TAGNODE_VALUE={interface} /usr/libexec/vyos/conf_mode/interfaces-wwan.py')
+
+exit(0)
-- 
cgit v1.2.3