Page MenuHomeVyOS Platform
Files F119064231

No OneTemporary
Actions

Size
47 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/interface-definitions/l2tp-server.xml.in b/interface-definitions/l2tp-server.xml.in
index 98c17b8b2..7fc844054 100644
--- a/interface-definitions/l2tp-server.xml.in
+++ b/interface-definitions/l2tp-server.xml.in
@@ -1,586 +1,586 @@
<?xml version="1.0"?>
<interfaceDefinition>
<node name="vpn">
<children>
<node name="l2tp" owner="${vyos_conf_scripts_dir}/accel_l2tp.py">
<properties>
<help>L2TP Virtual Private Network (VPN)</help>
</properties>
<children>
<node name="remote-access">
<properties>
<help>Remote access L2TP VPN</help>
</properties>
<children>
<leafNode name="mtu">
<properties>
<help>Maximum Transmission Unit (MTU)</help>
<constraint>
<validator name="numeric" argument="--range 128-16384"/>
</constraint>
</properties>
</leafNode>
<leafNode name="outside-address">
<properties>
<help>External IP address to which VPN clients will connect</help>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
- <leafNode name="outside-nexthop">
+ <leafNode name="gateway-address">
<properties>
- <help>Nexthop IP address for reaching the VPN clients</help>
+ <help>Gatway address uses as client tunnel termination point</help>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
<node name="dns-servers">
<properties>
<help>IPv4 Domain Name Service (DNS) server</help>
</properties>
<children>
<leafNode name="server-1">
<properties>
<help>Primary DNS server</help>
<valueHelp>
<format>ipv4</format>
<description>IPv4 address</description>
</valueHelp>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
<leafNode name="server-2">
<properties>
<help>Secondary DNS server</help>
<valueHelp>
<format>ipv4</format>
<description>IPv4 address</description>
</valueHelp>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
</children>
</node>
<leafNode name="dnsv6-servers">
<properties>
<help>IPv6 Domain Name Service (DNS) server</help>
<valueHelp>
<format>ipv6</format>
<description>IPv6 DNS address</description>
</valueHelp>
<constraint>
<validator name="ipv6-address"/>
</constraint>
<multi />
</properties>
</leafNode>
<node name="lns">
<properties>
<help>L2TP Network Server (LNS)</help>
</properties>
<children>
<leafNode name="shared-secret">
<properties>
<help>Tunnel password used to authenticate the client (LAC)</help>
</properties>
</leafNode>
</children>
</node>
<leafNode name="ccp-disable">
<properties>
<help>Disable Compression Control Protocol (CCP)</help>
<valueless />
</properties>
</leafNode>
<node name="ipsec-settings">
<properties>
<help>Internet Protocol Security (IPsec) for remote access L2TP VPN</help>
</properties>
<children>
<node name="authentication">
<properties>
<help>IPsec authentication settings</help>
</properties>
<children>
<leafNode name="mode">
<properties>
<help>Authentication mode for IPsec</help>
<valueHelp>
<format>pre-shared-secret</format>
<description>Use pre-shared secret for IPsec authentication</description>
</valueHelp>
<valueHelp>
<format>x509</format>
<description>Use X.509 certificate for IPsec authentication</description>
</valueHelp>
<constraint>
<regex>(pre-shared-secret|x509)</regex>
</constraint>
<completionHelp>
<list>pre-shared-secret x509</list>
</completionHelp>
</properties>
</leafNode>
<leafNode name="pre-shared-secret">
<properties>
<help>Pre-shared secret for IPsec</help>
</properties>
</leafNode>
<node name="x509">
<properties>
<help>X.509 certificate</help>
</properties>
<children>
<leafNode name="ca-cert-file">
<properties>
<help>File containing the X.509 certificate for the Certificate Authority (CA)</help>
<valueHelp>
<format>&lt;text&gt;</format>
<description>File in /config/auth</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="crl-file">
<properties>
<help>File containing the X.509 Certificate Revocation List (CRL)</help>
<valueHelp>
<format>&lt;text&gt;</format>
<description>File in /config/auth</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="server-cert-file">
<properties>
<help>File containing the X.509 certificate for the remote access VPN server (this host)</help>
<valueHelp>
<format>&lt;text&gt;</format>
<description>File in /config/auth</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="server-key-file">
<properties>
<help>File containing the private key for the X.509 certificate for the remote access VPN server (this host)</help>
<valueHelp>
<format>&lt;text&gt;</format>
<description>File in /config/auth</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="server-key-password">
<properties>
<help>Password that protects the private key</help>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
<leafNode name="ike-lifetime">
<properties>
<help>IKE lifetime</help>
<valueHelp>
<format>&lt;30-86400&gt;</format>
<description>IKE lifetime in seconds (default 3600)</description>
</valueHelp>
<constraint>
<validator name="numeric" argument="--range 30-86400"/>
</constraint>
</properties>
</leafNode>
<leafNode name="lifetime">
<properties>
<help>ESP lifetime</help>
<valueHelp>
<format>&lt;30-86400&gt;</format>
<description>IKE lifetime in seconds (default 3600)</description>
</valueHelp>
<constraint>
<validator name="numeric" argument="--range 30-86400"/>
</constraint>
</properties>
</leafNode>
</children>
</node>
<node name="wins-servers">
<properties>
<help>Windows Internet Name Service (WINS) server settings</help>
</properties>
<children>
<leafNode name="server-1">
<properties>
<help>Primary WINS server</help>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
<leafNode name="server-2">
<properties>
<help>Secondary WINS server</help>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
</children>
</node>
<node name="client-ip-pool">
<properties>
<help>Pool of client IP addresses (must be within a /24)</help>
</properties>
<children>
<leafNode name="start">
<properties>
<help>First IP address in the pool (will be used as gateway address)</help>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
<leafNode name="stop">
<properties>
<help>Last IP address in the pool</help>
<constraint>
<validator name="ipv4-address"/>
</constraint>
</properties>
</leafNode>
<leafNode name="subnet">
<properties>
<help>Client IP subnet (CIDR notation)</help>
<constraint>
<validator name="ipv4-prefix"/>
</constraint>
<constraintErrorMessage>Not a valid CIDR formatted prefix</constraintErrorMessage>
<valueHelp>
<format>ipv4net</format>
<description>IPv4 subnet address</description>
</valueHelp>
<multi />
</properties>
</leafNode>
</children>
</node>
<node name="client-ipv6-pool">
<properties>
<help>Pool of client IPv6 addresses</help>
</properties>
<children>
<leafNode name="prefix">
<properties>
<help>IPV6 prefix delegation</help>
<valueHelp>
<format>ipv6prefix/mask,prefix_len</format>
<description>e.g.: fc00:0:1::/48,64 - divides prefix into /64 subnets for clients</description>
</valueHelp>
<multi />
</properties>
</leafNode>
<leafNode name="delegate-prefix">
<properties>
<help>DHCPv6 prefix delegation - rfc3633</help>
<valueHelp>
<format>ipv6prefix/mask,prefix_len</format>
<description>Delegate to clients through DHCPv6 prefix delegation - rfc3633</description>
</valueHelp>
<multi />
</properties>
</leafNode>
</children>
</node>
<leafNode name="description">
<properties>
<help>Description for L2TP remote-access settings</help>
</properties>
</leafNode>
<leafNode name="dhcp-interface">
<properties>
<help>DHCP interface to listen on</help>
</properties>
</leafNode>
<leafNode name="idle">
<properties>
<help>PPP idle timeout</help>
<valueHelp>
<format>&lt;30-86400&gt;</format>
<description>PPP idle timeout in seconds (default 1800)</description>
</valueHelp>
<constraint>
<validator name="numeric" argument="--range 30-86400"/>
</constraint>
</properties>
</leafNode>
<node name="authentication">
<properties>
<help>Authentication for remote access L2TP VPN</help>
</properties>
<children>
<leafNode name="require">
<properties>
<help>Authentication protocol for remote access peer L2TP VPN</help>
<valueHelp>
<format>pap</format>
<description>Require the peer to authenticate itself using PAP [Password Authentication Protocol].</description>
</valueHelp>
<valueHelp>
<format>chap</format>
<description>Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol].</description>
</valueHelp>
<valueHelp>
<format>mschap</format>
<description>Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol].</description>
</valueHelp>
<valueHelp>
<format>mschap-v2</format>
<description>Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2].</description>
</valueHelp>
<constraint>
<regex>(pap|chap|mschap|mschap-v2)</regex>
</constraint>
<completionHelp>
<list>pap chap mschap mschap-v2</list>
</completionHelp>
<multi />
</properties>
</leafNode>
<leafNode name="mppe">
<properties>
<help>Specifies mppe negotioation preference. (default require mppe 128-bit stateless</help>
<valueHelp>
<format>deny</format>
<description>deny mppe</description>
</valueHelp>
<valueHelp>
<format>prefer</format>
<description>Ask client for mppe, if it rejects do not fail</description>
</valueHelp>
<valueHelp>
<format>require</format>
<description>ask client for mppe, if it rejects drop connection</description>
</valueHelp>
<constraint>
<regex>(deny|prefer|require)</regex>
</constraint>
<completionHelp>
<list>deny prefer require</list>
</completionHelp>
</properties>
</leafNode>
<leafNode name="mode">
<properties>
<help>Authentication mode for remote access L2TP VPN</help>
<valueHelp>
<format>local</format>
<description>Use local username/password configuration</description>
</valueHelp>
<valueHelp>
<format>radius</format>
<description>Use a RADIUS server to autenticate users</description>
</valueHelp>
<constraint>
<regex>(local|radius)</regex>
</constraint>
<completionHelp>
<list>local radius</list>
</completionHelp>
</properties>
</leafNode>
<node name="local-users">
<properties>
<help>Local user authentication for remote access L2TP VPN</help>
</properties>
<children>
<tagNode name="username">
<properties>
<help>User name for authentication</help>
</properties>
<children>
<leafNode name="disable">
<properties>
<help>Option to disable a L2TP Server user</help>
<valueless/>
</properties>
</leafNode>
<leafNode name="password">
<properties>
<help>Password for authentication</help>
</properties>
</leafNode>
<leafNode name="static-ip">
<properties>
<help>Static client IP address</help>
</properties>
</leafNode>
<node name="rate-limit">
<properties>
<help>Upload/Download speed limits</help>
</properties>
<children>
<leafNode name="upload">
<properties>
<help>Upload bandwidth limit in kbits/sec</help>
<constraint>
<validator name="numeric" argument="--range 1-65535"/>
</constraint>
</properties>
</leafNode>
<leafNode name="download">
<properties>
<help>Download bandwidth limit in kbits/sec</help>
<constraint>
<validator name="numeric" argument="--range 1-65535"/>
</constraint>
</properties>
</leafNode>
</children>
</node>
</children>
</tagNode>
</children>
</node>
<node name="radius">
<properties>
<help>RADIUS specific configuration</help>
</properties>
<children>
<tagNode name="server">
<properties>
<help>IP address of RADIUS server</help>
<valueHelp>
<format>ipv4</format>
<description>IPv4 address of RADIUS server</description>
</valueHelp>
</properties>
<children>
<leafNode name="key">
<properties>
<help>Key for accessing the specified server</help>
</properties>
</leafNode>
<leafNode name="req-limit">
<properties>
<help>Maximum number of simultaneous requests to server (default: unlimited)</help>
</properties>
</leafNode>
<leafNode name="fail-time">
<properties>
<help>If server doesn not responds mark it unavailable for this time (seconds)</help>
</properties>
</leafNode>
</children>
</tagNode>
<leafNode name="source-address">
<properties>
<help>Local RADIUS client address from which packets are sent.</help>
<valueHelp>
<format>&lt;x.x.x.x&gt;</format>
<description>Local RADIUS client address from which packets are sent</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="timeout">
<properties>
<help>Timeout to wait response from server (seconds)</help>
</properties>
</leafNode>
<leafNode name="acct-timeout">
<properties>
<help>Timeout to wait reply for Interim-Update packets. (default 3 seconds)</help>
</properties>
</leafNode>
<leafNode name="max-try">
<properties>
<help>Maximum number of tries to send Access-Request/Accounting-Request queries</help>
</properties>
</leafNode>
<leafNode name="nas-identifier">
<properties>
<help>Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.</help>
</properties>
</leafNode>
<node name="dae-server">
<properties>
<help>IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA)</help>
</properties>
<children>
<leafNode name="ip-address">
<properties>
<help>IP address for Dynamic Authorization Extension server (DM/CoA)</help>
</properties>
</leafNode>
<leafNode name="port">
<properties>
<help>Port for Dynamic Authorization Extension server (DM/CoA)</help>
</properties>
</leafNode>
<leafNode name="secret">
<properties>
<help>Secret for Dynamic Authorization Extension server (DM/CoA)</help>
</properties>
</leafNode>
</children>
</node>
<node name="rate-limit">
<properties>
<help>Upload/Download speed limits</help>
</properties>
<children>
<leafNode name="attribute">
<properties>
<help>Specifies which radius attribute contains rate information. (default is Filter-Id)</help>
</properties>
</leafNode>
<leafNode name="vendor">
<properties>
<help>Specifies the vendor dictionary. (dictionary needs to be in /usr/share/accel-ppp/radius)</help>
</properties>
</leafNode>
<leafNode name="enable">
<properties>
<help>Enables Bandwidth shaping via RADIUS</help>
<valueless />
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</children>
</node>
<node name="ppp-options">
<properties>
<help>Advanced protocol options</help>
</properties>
<children>
<leafNode name="lcp-echo-interval">
<properties>
<help>LCP echo-requests/sec</help>
<constraint>
<validator name="numeric" argument="--positive"/>
</constraint>
</properties>
</leafNode>
<leafNode name="lcp-echo-failure">
<properties>
<help>Maximum number of Echo-Requests may be sent without valid reply</help>
<constraint>
<validator name="numeric" argument="--positive"/>
</constraint>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</children>
</node>
</children>
</node>
</interfaceDefinition>
diff --git a/src/conf_mode/accel_l2tp.py b/src/conf_mode/accel_l2tp.py
index 37fda2029..a7af9cc68 100755
--- a/src/conf_mode/accel_l2tp.py
+++ b/src/conf_mode/accel_l2tp.py
@@ -1,563 +1,559 @@
#!/usr/bin/env python3
#
# Copyright (C) 2019 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
#
import sys
import os
import re
import subprocess
import jinja2
import socket
import time
import syslog as sl
from vyos.config import Config
from vyos import ConfigError
pidfile = r'/var/run/accel_l2tp.pid'
l2tp_cnf_dir = r'/etc/accel-ppp/l2tp'
chap_secrets = l2tp_cnf_dir + '/chap-secrets'
l2tp_conf = l2tp_cnf_dir + '/l2tp.config'
# accel-pppd -d -c /etc/accel-ppp/l2tp/l2tp.config -p /var/run/accel_l2tp.pid
### config path creation
if not os.path.exists(l2tp_cnf_dir):
os.makedirs(l2tp_cnf_dir)
sl.syslog(sl.LOG_NOTICE, l2tp_cnf_dir + " created")
l2tp_config = '''
### generated by accel_l2tp.py ###
[modules]
log_syslog
l2tp
chap-secrets
{% for proto in authentication['auth_proto']: %}
{{proto}}
{% endfor%}
{% if authentication['mode'] == 'radius' %}
radius
{% endif -%}
ippool
shaper
ipv6pool
ipv6_nd
ipv6_dhcp
[core]
thread-count={{thread_cnt}}
[log]
syslog=accel-l2tp,daemon
copy=1
level=5
{% if dns %}
[dns]
{% if dns[0] %}
dns1={{dns[0]}}
{% endif %}
{% if dns[1] %}
dns2={{dns[1]}}
{% endif %}
{% endif -%}
{% if dnsv6 %}
[ipv6-dns]
{% for srv in dnsv6: %}
{{srv}}
{% endfor %}
{% endif %}
{% if wins %}
[wins]
{% if wins[0] %}
wins1={{wins[0]}}
{% endif %}
{% if wins[1] %}
wins2={{wins[1]}}
{% endif %}
{% endif -%}
[l2tp]
verbose=1
ifname=l2tp%d
ppp-max-mtu={{mtu}}
mppe={{authentication['mppe']}}
{% if outside_addr %}
bind={{outside_addr}}
{% endif %}
{% if lns_shared_secret %}
secret={{lns_shared_secret}}
{% endif %}
[client-ip-range]
0.0.0.0/0
{% if (client_ip_pool) or (client_ip_subnets) %}
[ip-pool]
{% if client_ip_pool %}
{{client_ip_pool}}
{% endif -%}
{% if client_ip_subnets %}
{% for sn in client_ip_subnets %}
{{sn}}
{% endfor -%}
{% endif %}
{% endif %}
-{% if outside_nexthop %}
-gw-ip-address={{outside_nexthop}}
+{% if gateway_address %}
+gw-ip-address={{gateway_address}}
{% endif %}
{% if authentication['mode'] == 'local' %}
[chap-secrets]
chap-secrets=/etc/accel-ppp/l2tp/chap-secrets
-{% if outside_nexthop %}
-gw-ip-address={{outside_nexthop}}
+{% if gateway_address %}
+gw-ip-address={{gateway_address}}
{% endif %}
{% endif %}
[ppp]
verbose=1
check-ip=1
single-session=replace
{% if idle_timeout %}
lcp-echo-timeout={{idle_timeout}}
{% endif %}
{% if ppp_options['lcp-echo-interval'] %}
lcp-echo-interval={{ppp_options['lcp-echo-interval']}}
{% else %}
lcp-echo-interval=30
{% endif %}
{% if ppp_options['lcp-echo-failure'] %}
lcp-echo-failure={{ppp_options['lcp-echo-failure']}}
{% else %}
lcp-echo-failure=3
{% endif %}
{% if ccp_disable %}
ccp=0
{% endif %}
{% if client_ipv6_pool %}
ipv6=allow
{% endif %}
{% if authentication['mode'] == 'radius' %}
[radius]
{% for rsrv in authentication['radiussrv']: %}
server={{rsrv}},{{authentication['radiussrv'][rsrv]['secret']}},\
req-limit={{authentication['radiussrv'][rsrv]['req-limit']}},\
fail-time={{authentication['radiussrv'][rsrv]['fail-time']}}
{% endfor %}
{% if authentication['radiusopt']['timeout'] %}
timeout={{authentication['radiusopt']['timeout']}}
{% endif %}
{% if authentication['radiusopt']['acct-timeout'] %}
acct-timeout={{authentication['radiusopt']['acct-timeout']}}
{% endif %}
{% if authentication['radiusopt']['max-try'] %}
max-try={{authentication['radiusopt']['max-try']}}
{% endif %}
{% if authentication['radiusopt']['nas-id'] %}
nas-identifier={{authentication['radiusopt']['nas-id']}}
{% endif %}
{% if authentication['radius_source_address'] %}
nas-ip-address={{authentication['radius_source_address']}}
{% endif -%}
{% if authentication['radiusopt']['dae-srv'] %}
dae-server={{authentication['radiusopt']['dae-srv']['ip-addr']}}:\
{{authentication['radiusopt']['dae-srv']['port']}},\
{{authentication['radiusopt']['dae-srv']['secret']}}
{% endif -%}
-gw-ip-address={{outside_nexthop}}
+gw-ip-address={{gateway_address}}
verbose=1
{% endif -%}
{% if client_ipv6_pool %}
[ipv6-pool]
{% for prfx in client_ipv6_pool.prefix: %}
{{prfx}}
{% endfor %}
{% for prfx in client_ipv6_pool.delegate_prefix: %}
delegate={{prfx}}
{% endfor %}
{% endif %}
{% if client_ipv6_pool['delegate_prefix'] %}
[ipv6-dhcp]
verbose=1
{% endif %}
{% if authentication['radiusopt']['shaper'] %}
[shaper]
verbose=1
attr={{authentication['radiusopt']['shaper']['attr']}}
{% if authentication['radiusopt']['shaper']['vendor'] %}
vendor={{authentication['radiusopt']['shaper']['vendor']}}
{% endif -%}
{% endif %}
[cli]
tcp=127.0.0.1:2004
sessions-columns=ifname,username,calling-sid,ip,{{ip6_column}}{{ip6_dp_column}}rate-limit,type,comp,state,rx-bytes,tx-bytes,uptime
'''
### l2tp chap secrets
chap_secrets_conf = '''
# username server password acceptable local IP addresses shaper
{% for user in authentication['local-users'] %}
{% if authentication['local-users'][user]['state'] == 'enabled' %}
{% if (authentication['local-users'][user]['upload']) and (authentication['local-users'][user]['download']) %}
{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}}\t\
{{authentication['local-users'][user]['download']}}/{{authentication['local-users'][user]['upload']}}
{% else %}
{{user}}\t*\t{{authentication['local-users'][user]['passwd']}}\t{{authentication['local-users'][user]['ip']}}
{% endif %}
{% endif %}
{% endfor %}
'''
###
# inline helper functions
###
# depending on hw and threads, daemon needs a little to start
# if it takes longer than 100 * 0.5 secs, exception is being raised
# not sure if that's the best way to check it, but it worked so far quite well
###
def chk_con():
cnt = 0
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
while True:
try:
s.connect(("127.0.0.1", 2004))
break
except ConnectionRefusedError:
time.sleep(0.5)
cnt +=1
if cnt == 100:
raise("failed to start l2tp server")
break
### chap_secrets file if auth mode local
def write_chap_secrets(c):
tmpl = jinja2.Template(chap_secrets_conf, trim_blocks=True)
chap_secrets_txt = tmpl.render(c)
old_umask = os.umask(0o077)
open(chap_secrets,'w').write(chap_secrets_txt)
os.umask(old_umask)
sl.syslog(sl.LOG_NOTICE, chap_secrets + ' written')
def accel_cmd(cmd=''):
if not cmd:
return None
try:
ret = subprocess.check_output(['/usr/bin/accel-cmd','-p','2004',cmd]).decode().strip()
return ret
except:
return 1
###
# inline helper functions end
###
def get_config():
c = Config()
if not c.exists('vpn l2tp remote-access '):
return None
c.set_level('vpn l2tp remote-access')
config_data = {
'authentication' : {
'mode' : 'local',
'local-users' : {
},
'radiussrv' : {},
'radiusopt' : {},
'auth_proto' : [],
'mppe' : 'prefer'
},
'outside_addr' : '',
- 'outside_nexthop' : '10.255.255.0',
+ 'gateway_address' : '10.255.255.0',
'dns' : [],
'dnsv6' : [],
'wins' : [],
'client_ip_pool' : None,
'client_ip_subnets' : [],
'client_ipv6_pool' : {},
'mtu' : '1436',
'ip6_column' : '',
'ip6_dp_column' : '',
'ppp_options' : {},
}
### general options ###
if c.exists('dns-servers server-1'):
config_data['dns'].append( c.return_value('dns-servers server-1'))
if c.exists('dns-servers server-2'):
config_data['dns'].append( c.return_value('dns-servers server-2'))
if c.exists('dnsv6-servers'):
for dns6_server in c.return_values('dnsv6-servers'):
config_data['dnsv6'].append(dns6_server)
if c.exists('wins-servers server-1'):
config_data['wins'].append( c.return_value('wins-servers server-1'))
if c.exists('wins-servers server-2'):
config_data['wins'].append( c.return_value('wins-servers server-2'))
if c.exists('outside-address'):
config_data['outside_addr'] = c.return_value('outside-address')
### auth local
if c.exists('authentication mode local'):
if c.exists('authentication local-users username'):
for usr in c.list_nodes('authentication local-users username'):
config_data['authentication']['local-users'].update(
{
usr : {
'passwd' : '',
'state' : 'enabled',
'ip' : '*',
'upload' : None,
'download' : None
}
}
)
if c.exists('authentication local-users username ' + usr + ' password'):
config_data['authentication']['local-users'][usr]['passwd'] = c.return_value('authentication local-users username ' + usr + ' password')
if c.exists('authentication local-users username ' + usr + ' disable'):
config_data['authentication']['local-users'][usr]['state'] = 'disable'
if c.exists('authentication local-users username ' + usr + ' static-ip'):
config_data['authentication']['local-users'][usr]['ip'] = c.return_value('authentication local-users username ' + usr + ' static-ip')
if c.exists('authentication local-users username ' + usr + ' rate-limit download'):
config_data['authentication']['local-users'][usr]['download'] = c.return_value('authentication local-users username ' + usr + ' rate-limit download')
if c.exists('authentication local-users username ' + usr + ' rate-limit upload'):
config_data['authentication']['local-users'][usr]['upload'] = c.return_value('authentication local-users username ' + usr + ' rate-limit upload')
### authentication mode radius servers and settings
if c.exists('authentication mode radius'):
config_data['authentication']['mode'] = 'radius'
rsrvs = c.list_nodes('authentication radius server')
for rsrv in rsrvs:
if c.return_value('authentication radius server ' + rsrv + ' fail-time') == None:
ftime = '0'
else:
ftime = str(c.return_value('authentication radius server ' + rsrv + ' fail-time'))
if c.return_value('authentication radius-server ' + rsrv + ' req-limit') == None:
reql = '0'
else:
reql = str(c.return_value('authentication radius server ' + rsrv + ' req-limit'))
config_data['authentication']['radiussrv'].update(
{
rsrv : {
'secret' : c.return_value('authentication radius server ' + rsrv + ' key'),
'fail-time' : ftime,
'req-limit' : reql
}
}
)
### Source ip address feature
if c.exists('authentication radius source-address'):
config_data['authentication']['radius_source_address'] = c.return_value('authentication radius source-address')
#### advanced radius-setting
if c.exists('authentication radius acct-timeout'):
config_data['authentication']['radiusopt']['acct-timeout'] = c.return_value('authentication radius acct-timeout')
if c.exists('authentication radius max-try'):
config_data['authentication']['radiusopt']['max-try'] = c.return_value('authentication radius max-try')
if c.exists('authentication radius timeout'):
config_data['authentication']['radiusopt']['timeout'] = c.return_value('authentication radius timeout')
if c.exists('authentication radius nas-identifier'):
config_data['authentication']['radiusopt']['nas-id'] = c.return_value('authentication radius nas-identifier')
if c.exists('authentication radius dae-server'):
# Set default dae-server port if not defined
if c.exists('authentication radius dae-server port'):
dae_server_port = c.return_value('authentication radius dae-server port')
else:
dae_server_port = "3799"
config_data['authentication']['radiusopt'].update(
{
'dae-srv' : {
'ip-addr' : c.return_value('authentication radius dae-server ip-address'),
'port' : dae_server_port,
'secret' : str(c.return_value('authentication radius dae-server secret'))
}
}
)
#### filter-id is the internal accel default if attribute is empty
#### set here as default for visibility which may change in the future
if c.exists('authentication radius rate-limit enable'):
if not c.exists('authentication radius rate-limit attribute'):
config_data['authentication']['radiusopt']['shaper'] = {
'attr' : 'Filter-Id'
}
else:
config_data['authentication']['radiusopt']['shaper'] = {
'attr' : c.return_value('authentication radius rate-limit attribute')
}
if c.exists('authentication radius rate-limit vendor'):
config_data['authentication']['radiusopt']['shaper']['vendor'] = c.return_value('authentication radius rate-limit vendor')
if c.exists('client-ip-pool'):
if c.exists('client-ip-pool start') and c.exists('client-ip-pool stop'):
config_data['client_ip_pool'] = c.return_value('client-ip-pool start') + '-' + re.search('[0-9]+$', c.return_value('client-ip-pool stop')).group(0)
if c.exists('client-ip-pool subnet'):
config_data['client_ip_subnets'] = c.return_values('client-ip-pool subnet')
if c.exists('client-ipv6-pool prefix'):
config_data['client_ipv6_pool']['prefix'] = c.return_values('client-ipv6-pool prefix')
config_data['ip6_column'] = 'ip6,'
if c.exists('client-ipv6-pool delegate-prefix'):
config_data['client_ipv6_pool']['delegate_prefix'] = c.return_values('client-ipv6-pool delegate-prefix')
config_data['ip6_dp_column'] = 'ip6-dp,'
if c.exists('mtu'):
config_data['mtu'] = c.return_value('mtu')
### gateway address
- if c.exists('outside-nexthop'):
- config_data['outside_nexthop'] = c.return_value('outside-nexthop')
+ if c.exists('gateway-address'):
+ config_data['gateway_address'] = c.return_value('gateway-address')
else:
### calculate gw-ip-address
if c.exists('client-ip-pool start'):
### use start ip as gw-ip-address
- config_data['outside_nexthop'] = c.return_value('client-ip-pool start')
+ config_data['gateway_address'] = c.return_value('client-ip-pool start')
elif c.exists('client-ip-pool subnet'):
### use first ip address from first defined pool
lst_ip = re.findall("\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", c.return_values('client-ip-pool subnet')[0])
- config_data['outside_nexthop'] = lst_ip[0]
+ config_data['gateway_address'] = lst_ip[0]
if c.exists('authentication require'):
auth_mods = {'pap' : 'pap','chap' : 'auth_chap_md5', 'mschap' : 'auth_mschap_v1', 'mschap-v2' : 'auth_mschap_v2'}
for proto in c.return_values('authentication require'):
config_data['authentication']['auth_proto'].append(auth_mods[proto])
else:
config_data['authentication']['auth_proto'] = ['auth_mschap_v2']
if c.exists('authentication mppe'):
config_data['authentication']['mppe'] = c.return_value('authentication mppe')
if c.exists('idle'):
config_data['idle_timeout'] = c.return_value('idle')
### LNS secret
if c.exists('lns shared-secret'):
config_data['lns_shared_secret'] = c.return_value('lns shared-secret')
if c.exists('ccp-disable'):
config_data['ccp_disable'] = True
### ppp_options
ppp_options = {}
if c.exists('ppp-options'):
if c.exists('ppp-options lcp-echo-failure'):
ppp_options['lcp-echo-failure'] = c.return_value('ppp-options lcp-echo-failure')
if c.exists('ppp-options lcp-echo-interval'):
ppp_options['lcp-echo-interval'] = c.return_value('ppp-options lcp-echo-interval')
if len(ppp_options) !=0:
config_data['ppp_options'] = ppp_options
return config_data
def verify(c):
if c == None:
return None
if c['authentication']['mode'] == 'local':
if not c['authentication']['local-users']:
raise ConfigError('l2tp-server authentication local-users required')
for usr in c['authentication']['local-users']:
if not c['authentication']['local-users'][usr]['passwd']:
raise ConfigError('user ' + usr + ' requires a password')
if c['authentication']['mode'] == 'radius':
if len(c['authentication']['radiussrv']) == 0:
raise ConfigError('radius server required')
for rsrv in c['authentication']['radiussrv']:
if c['authentication']['radiussrv'][rsrv]['secret'] == None:
raise ConfigError('radius server ' + rsrv + ' needs a secret configured')
### check for the existence of a client ip pool
if not c['client_ip_pool'] and not c['client_ip_subnets']:
raise ConfigError("set vpn l2tp remote-access client-ip-pool requires subnet or start/stop IP pool")
- if not c['outside_nexthop']:
- #raise ConfigError('set vpn l2tp remote-access outside-nexthop required')
- print ("WARMING: set vpn l2tp remote-access outside-nexthop required")
-
## check ipv6
if 'delegate_prefix' in c['client_ipv6_pool'] and not 'prefix' in c['client_ipv6_pool']:
raise ConfigError("\"set vpn l2tp remote-access client-ipv6-pool prefix\" required for delegate-prefix ")
if len(c['dnsv6']) > 3:
raise ConfigError("Maximum allowed dnsv6-servers addresses is 3")
def generate(c):
if c == None:
return None
### accel-cmd reload doesn't work so any change results in a restart of the daemon
try:
if os.cpu_count() == 1:
c['thread_cnt'] = 1
else:
c['thread_cnt'] = int(os.cpu_count()/2)
except KeyError:
if os.cpu_count() == 1:
c['thread_cnt'] = 1
else:
c['thread_cnt'] = int(os.cpu_count()/2)
tmpl = jinja2.Template(l2tp_config, trim_blocks=True)
config_text = tmpl.render(c)
open(l2tp_conf,'w').write(config_text)
if c['authentication']['local-users']:
write_chap_secrets(c)
return c
def apply(c):
if c == None:
if os.path.exists(pidfile):
accel_cmd('shutdown hard')
if os.path.exists(pidfile):
os.remove(pidfile)
return None
if not os.path.exists(pidfile):
ret = subprocess.call(['/usr/sbin/accel-pppd','-c',l2tp_conf,'-p',pidfile,'-d'])
chk_con()
if ret !=0 and os.path.exists(pidfile):
os.remove(pidfile)
raise ConfigError('accel-pppd failed to start')
else:
### if gw ip changes, only restart doesn't work
accel_cmd('restart')
sl.syslog(sl.LOG_NOTICE, "reloading config via daemon restart")
if __name__ == '__main__':
try:
c = get_config()
verify(c)
generate(c)
apply(c)
except ConfigError as e:
print(e)
sys.exit(1)
diff --git a/src/migration-scripts/l2tp/1-to-2 b/src/migration-scripts/l2tp/1-to-2
new file mode 100755
index 000000000..c46eba8f8
--- /dev/null
+++ b/src/migration-scripts/l2tp/1-to-2
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+
+# Delete depricated outside-nexthop address
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+ print("Must specify file name!")
+ sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+ config_file = f.read()
+
+config = ConfigTree(config_file)
+
+cfg_base = ['vpn', 'l2tp', 'remote-access']
+if not config.exists(cfg_base):
+ # Nothing to do
+ sys.exit(0)
+else:
+ if config.exists(cfg_base + ['outside-nexthop']):
+ config.delete(cfg_base + ['outside-nexthop'])
+
+ try:
+ with open(file_name, 'w') as f:
+ f.write(config.to_string())
+ except OSError as e:
+ print("Failed to save the modified config: {}".format(e))
+ sys.exit(1)

File Metadata

Mime Type
text/x-diff
Expires
Fri, Nov 6, 9:41 AM (7 h, 28 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4654004
Default Alt Text
(47 KB)

Event Timeline