From 304929ac3cdbe7a124f374e84283a8e0fdf9ff99 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Fri, 24 Oct 2025 21:06:06 +0200 Subject: vyos.defaults: T7953: globally define openconnect systemd service name --- src/conf_mode/vpn_openconnect.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py index 78cdaa179..68cd363f0 100755 --- a/src/conf_mode/vpn_openconnect.py +++ b/src/conf_mode/vpn_openconnect.py @@ -21,6 +21,7 @@ from vyos.base import Warning from vyos.config import Config from vyos.configverify import verify_pki_certificate from vyos.configverify import verify_pki_ca_certificate +from vyos.defaults import systemd_services from vyos.pki import find_chain from vyos.pki import encode_certificate from vyos.pki import load_certificate @@ -386,17 +387,18 @@ def generate(ocserv): def apply(ocserv): + service_name = systemd_services['openconnect'] if not ocserv: - call('systemctl stop ocserv.service') + call(f'systemctl stop {service_name}') for file in [ocserv_conf, ocserv_passwd, ocserv_otp_usr]: if os.path.exists(file): os.unlink(file) else: - call('systemctl reload-or-restart ocserv.service') + call(f'systemctl reload-or-restart {service_name}') counter = 0 while True: # exit early when service runs - if is_systemd_service_running('ocserv.service'): + if is_systemd_service_running(service_name): break sleep(0.250) if counter > 5: -- cgit v1.2.3 From 9c8bba962298f8e91a12866f3efcb94cf8c8458b Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sun, 26 Oct 2025 16:01:31 +0100 Subject: pki: T7953: use dict_set_nested() over manually assembly of dict data --- src/conf_mode/pki.py | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'src') diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py index 98e5840a9..8f1227504 100755 --- a/src/conf_mode/pki.py +++ b/src/conf_mode/pki.py @@ -44,6 +44,7 @@ from vyos.utils.configfs import add_cli_node from vyos.utils.dict import dict_search from vyos.utils.dict import dict_search_args from vyos.utils.dict import dict_search_recursive +from vyos.utils.dict import dict_set_nested from vyos.utils.file import read_file from vyos.utils.network import check_port_availability from vyos.utils.process import call @@ -181,9 +182,8 @@ def get_config(config=None): # Check for changes to said given keys in the CLI config for key in changed_keys: tmp = node_changed(conf, base + [key], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD) - if 'changed' not in pki: - pki.update({'changed':{}}) - pki['changed'].update({key.replace('-', '_') : tmp}) + if tmp: + dict_set_nested(f'changed.{key.replace("-", "_")}', tmp, pki) # We only merge on the defaults if there is a configuration at all if conf.exists(base): @@ -208,9 +208,14 @@ def get_config(config=None): for name, cert_config in pki['certificate'].items(): if 'acme' in cert_config: renew.append(name) - # If triggered externally by certbot, certificate key is not present in changed - if 'changed' not in pki: pki.update({'changed':{}}) - pki['changed'].update({'certificate' : renew}) + if renew: + # Get the current list of changed certificates + tmp = pki.get('changed', {}).get('certificate', []) + # and extend it with the list of ACME based certificates + tmp += renew + # remove any duplicates if necessary + tmp = set(tmp) + dict_set_nested('changed.certificate', tmp, pki) # We need to get the entire system configuration to verify that we are not # deleting a certificate that is still referenced somewhere! -- cgit v1.2.3 From 406c948fe78a2a9ff4a26efa78cf172310a88ed6 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sun, 26 Oct 2025 16:24:46 +0100 Subject: pki: T7953: certbot_request() should return None --- src/conf_mode/pki.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py index 8f1227504..f82e63d93 100755 --- a/src/conf_mode/pki.py +++ b/src/conf_mode/pki.py @@ -125,13 +125,13 @@ def certbot_delete(certificate): if os.path.exists(f'{vyos_certbot_dir}/renewal/{certificate}.conf'): cmd(f'certbot delete --non-interactive --config-dir {vyos_certbot_dir} --cert-name {certificate}') -def certbot_request(name: str, config: dict, dry_run: bool=True): +def certbot_request(name: str, config: dict, dry_run: bool=True) -> None: # We do not call certbot when booting the system - there is no need to do so and # request new certificates during boot/image upgrade as the certbot configuration # is stored persistent under /config - thus we do not open the door to transient # errors if not boot_configuration_complete(): - return + return None domains = '--domains ' + ' --domains '.join(config['domain_name']) tmp = f'certbot certonly --non-interactive --config-dir {vyos_certbot_dir} --cert-name {name} '\ @@ -156,7 +156,8 @@ def certbot_request(name: str, config: dict, dry_run: bool=True): if dry_run: tmp += ' --dry-run' - cmd(tmp, raising=ConfigError, message=f'ACME certbot request failed for "{name}"!') + cmd(tmp, raising=ConfigError, message=f'Certbot request failed for "{name}"!') + return None def get_config(config=None): if config: -- cgit v1.2.3 From 4066ed80c8e8b80dba50b5fea37c88d0c7c6b5c1 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sun, 26 Oct 2025 16:26:09 +0100 Subject: pki: T7953: reword inline comments --- src/conf_mode/pki.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py index f82e63d93..bf44dcfc7 100755 --- a/src/conf_mode/pki.py +++ b/src/conf_mode/pki.py @@ -250,8 +250,11 @@ def get_config(config=None): continue path = search['path'] - path_str = ' '.join(path + found_path).replace('_','-') - Message(f'Updating configuration: "{path_str} {item_name}"') + # Only enable this for debug purposes - otherwise we will always + # print this message for ACME certificates during renew tests - + # even if they are not due for renew! + # path_str = ' '.join(path + found_path).replace('_','-') + # print(f'Updating configuration: "{path_str} {item_name}"') if path[0] == 'interfaces': ifname = found_path[0] @@ -272,6 +275,9 @@ def get_config(config=None): if not dict_search('system.load_balancing.haproxy', pki): continue # Determine which service depends on ACME issued certificates + # We only need to add services blocking the default certbot ports + # 80 and 443. For instance there won't be a conflict with strongSwan + # as it runs on different ports. used_by = [] # We start with HAProxy for cert_list, _ in dict_search_recursive( @@ -391,9 +397,9 @@ def verify(pki): raise ConfigError('Port 80 is already in use and not available '\ f'to provide ACME challenge for "{name}"!') + # Only run the ACME command if something on this entity changed, + # as this is time intensive if 'certbot_renew' not in pki: - # Only run the ACME command if something on this entity changed, - # as this is time intensive tmp = dict_search('changed.certificate', pki) if tmp != None and name in tmp: certbot_request(name, cert_conf['acme']) -- cgit v1.2.3