okay. so the config's cleaned up, and we now create a sparse example config file.

This commit is contained in:
brent s. 2020-05-16 03:48:02 -04:00
parent a0d5071a8d
commit 5f2883a698
Signed by: bts
GPG Key ID: 8C004C2F93481F6B
3 changed files with 128 additions and 55 deletions

View File

@ -1,53 +1,71 @@
import collections import collections
import copy import copy
import ipaddress
import os import os
import re import re
## ##
import netaddr
import requests import requests
import requests.auth import requests.auth
from lxml import etree from lxml import etree
from pyroute2 import IPRoute
## ##
from . import tunnel from . import tunnel




def create_default_cfg(): def create_default_cfg():
# Create a stripped sample config. # Create a stripped sample config.
nsmap = {None: 'https://tunnelbroker.net/', ws_re = re.compile(r'^\s*$')
'xsi': 'http://www.w3.org/2001/XMLSchema-instance'} cur_dir = os.path.dirname(os.path.abspath(os.path.expanduser(__file__)))
attr_qname = etree.QName('http://www.w3.org/2001/XMLSchema-instance', 'schemaLocation') xtbxml = os.path.join(cur_dir, 'example.tunnelbroker.xml')
schema_url = 'http://schema.xml.r00t2.io/projects/he_ipv6.xsd' with open(xtbxml, 'rb') as fh:
schema_loc = '{0} {1}'.format(nsmap[None], schema_url) xml = etree.fromstring(fh.read())
xml = etree.Element('heIPv6', # Create a stripped sample config.
{attr_qname: schema_loc}, # First we strip comments (and fix the ensuing whitespace).
nsmap = nsmap) # etree has a .canonicalize(), but it chokes on a default namespace.
xml.append(etree.Comment(('See example.tunnelbroker.xml for an extensively commented sample config.'))) # https://bugs.launchpad.net/lxml/+bug/1869455
creds = etree.SubElement(xml, 'creds') # So everything we do is kind of a hack.
creds.append(etree.Comment(('Your tunnelbroker.net *login*. You can specify multiple credentials via multiple ' # for c in xml.xpath("//comment()"):
'"cred" items. The "id" attribute is up to you but it must be unique.'))) # parent = c.getparent()
cred = etree.SubElement(creds, 'cred') # parent.remove(c)
cred.attrib['id'] = '' xmlstr = etree.tostring(xml, with_comments = False, method = 'c14n', pretty_print = True).decode('utf-8')
user = etree.SubElement(cred, 'user') newstr = []
user.text = '' for line in xmlstr.splitlines():
password = etree.SubElement(cred, 'password') r = ws_re.search(line)
password.text = '' if not r:
tunnels = etree.SubElement(xml, 'tunnels') newstr.append(line.strip())
tunnels.append(etree.Comment(('You can have define multiple tunnels via multiple "tunnel" items. You should most ' xml = etree.fromstring(''.join(newstr).encode('utf-8'))
'likely only run one at a time.'))) # Remove text and attr text.
tunnel = etree.SubElement(tunnels, 'tunnel') xpathq = "descendant-or-self::*[namespace-uri()!='']"
tunnel.append(etree.Comment(('The "id" attribute should match the id number of a tunnel on your tunnelbroker.net ' for e in xml.xpath(xpathq):
'account. The "creds" attribute references a cred item id attribute.'))) if e.tag == '{{{0}}}heIPv6'.format(xml.nsmap[None]):
tunnel.attrib['id'] = '' continue
tunnel.attrib['creds'] = '' if e.text is not None and e.text.strip() != '':
ukey = etree.SubElement(tunnel, '') e.text = ''
return (etree.tostring(xml, for k, v in e.attrib.items():
encoding = 'UTF-8', if v is not None:
xml_declaration = True, e.attrib[k] = ''
# Remove multiple children of same type to simplify.
for e in xml.xpath(xpathq):
if e.tag == '{{{0}}}heIPv6'.format(xml.nsmap[None]):
continue
parent = e.getparent()
try:
for idx, child in enumerate(parent.findall(e.tag)):
if idx == 0:
continue
parent.remove(child)
except AttributeError:
pass
# And add a comment pointing them to the fully commented config.
xml.insert(0, etree.Comment(('\n Please reference the fully commented example.tunnelbroker.xml found either '
'at:\n '
' * {0}\n * https://git.square-r00t.net/RouterBox/tree/utils/he_ipv6/'
'example.tunnelbroker.xml\n and then configure this according to those '
'instructions.\n ').format(xtbxml)))
return(etree.tostring(xml,
pretty_print = True, pretty_print = True,
with_comments = True,
with_tail = True, with_tail = True,
with_comments = True)) encoding = 'UTF-8',
xml_declaration = True))




class Credential(object): class Credential(object):
@ -189,7 +207,10 @@ class Config(BaseConfig):
def __init__(self, xml_path, *args, **kwargs): def __init__(self, xml_path, *args, **kwargs):
self.xml_path = os.path.abspath(os.path.expanduser(xml_path)) self.xml_path = os.path.abspath(os.path.expanduser(xml_path))
if not os.path.isfile(self.xml_path): if not os.path.isfile(self.xml_path):
raise ValueError('xml_path does not exist') with open(self.xml_path, 'wb') as fh:
fh.write(create_default_cfg())
raise ValueError('xml_path does not exist; '
'a sample configuration has been generated (be sure to configure it)')
else: else:
with open(xml_path, 'rb') as fh: with open(xml_path, 'rb') as fh:
raw_xml = fh.read() raw_xml = fh.read()

View File

@ -8,7 +8,8 @@
https://www.tunnelbroker.net/tunnel_detail.php?tid=584532 https://www.tunnelbroker.net/tunnel_detail.php?tid=584532
I highly recommend their (free) certification as well if you're brand-new to IPv6: I highly recommend their (free) certification as well if you're brand-new to IPv6:
https://ipv6.he.net/certification/ https://ipv6.he.net/certification/
**It is VERY highly encouraged to only use one tunnel at a time on a machine.** **It is VERY highly encouraged to only use one tunnel at a time on a machine. Completely unpredictable results will
incur if this is not heeded.**
--> -->
<creds> <creds>
<!-- <!--
@ -39,10 +40,14 @@
--> -->
<updateKey>xXxXxXxXxXxXxXXX</updateKey> <updateKey>xXxXxXxXxXxXxXXX</updateKey>
<!-- <!--
Where to assign your allocations. The default allocation prefix is a /64 (prefix="64"), since that's what SLAAC Where to assign your allocations. The default allocation prefix is a /64 (prefix="64"), since that's what
recommends. SLAAC (RFC 2462) recommends.
It has one optional attribute, "raProvider", which can be "dnsmasq" or "radvd". Further system configuration may It has one optional attribute, "raProvider", which can be "dnsmasq" or "radvd". Its configuration file will be
be required. If not specified, the default is to not send router advertisements. regenerated and the service restarted after the addresses are allocated to interfaces. Further system
configuration may be required. If not specified, the default is to not send router advertisements (RFC 4861). See
the "ra" child element under <assign> for further details.
If you are using dnsmasq, you will want to edit dnsmasq.conf to *include* the generated file, most likely, as it
only generates configuration for IPv6 options.
--> -->
<assignments raProvider="dnsmasq"> <assignments raProvider="dnsmasq">
<!-- <!--
@ -60,24 +65,52 @@
--> -->
<assign prefix="64" alloc="64" iface="eth0"> <assign prefix="64" alloc="64" iface="eth0">
<!-- <!--
Each assignment can have an "ra" child. The default is to not implement RA for this interface if not Each assignment CAN have an "ra" child. The default is to not implement RA for this interface if an ra element
present. is not present.
It takes one optional attribute, which is only used for raProvider="dnsmasq", "tag", which is the tag name for
the interface (this should be set in an earlier included conf/the main dnsmasq.conf).
--> -->
<ra> <ra tag="main">
<dns>true</dns> <!--
<dhcpv6>true</dhcpv6> Specify RDNSS (RFC 8106). If specified, this allocation's "router IP" (<PREFIX>::1) will be passed as a
resolver via RDNSS.
It takes one (optional) attribute, "domains", which is a space-separated list of search domains, referred
to in IPv6 as DNSSL (RFC 6106).
Note that Windows does not support DNSSL, and as such you must use dhcpv6's "domains" attribute if you wish
to do that.
If "domains" is specified but the element is false, the configuration will only advertise DNSSL and not
RDNSS.
-->
<dns domains="foo.com bar.com">true</dns>
<!--
Enable DHCPv6 for this assignment. Only used for dnsmasq, has no effect for radvd. As mentioned above, you
can also specify the "domains" attribute here as well, which will pass them via a regular DHCPv6 option.
If "domains" is specified but the element is false, only the domains will be passed.
Again, this only pertains to dnsmasq since radvd offers no DHCPv6 capabilities whatsoever.
-->
<dhcpv6 domains="foo.com bar.com">true</dhcpv6>
</ra> </ra>
</assign> </assign>
<!-- Disable RA for this set (no "ra" chiled specified). -->
<assign prefix="64" alloc="48" iface="eth0"/> <assign prefix="64" alloc="48" iface="eth0"/>
<assign prefix="64" alloc="48" iface="eth1"> <assign prefix="64" alloc="48" iface="eth1">

<ra tag="vmlan">
<!-- This will use strictly SLAAC (if using dnsmasq, obviously - radvd only does SLAAC). -->
<dhcpv6>false</dhcpv6>
<!-- And let clients choose their own resolver. -->
<dns>false</dns>
</ra>
</assign>
<assign prefix="64" alloc="48" iface="eth2">
<ra tag="wlan">
<!-- Only pass RDNSS resolvers. -->
<dns>true</dns>
<dhcpv6>false</dhcpv6>
</ra>
</assign> </assign>
<assign prefix="64" alloc="48" iface="eth2"/>
</assignments> </assignments>
</tunnel> </tunnel>
<!-- <!-- And you can, of course, specify multiple tunnels. -->
And you can, of course, specify multiple tunnels.
-->
<tunnel id="54321" creds="anotheruser"> <tunnel id="54321" creds="anotheruser">
<updateKey>0000000000000000</updateKey> <updateKey>0000000000000000</updateKey>
<assignments> <assignments>

View File

@ -1,4 +1,4 @@
## General Info/Networking Configuration ## General Info/Networking Configuration ##
# https://wiki.archlinux.org/index.php/IPv6_tunnel_broker_setup # https://wiki.archlinux.org/index.php/IPv6_tunnel_broker_setup
# https://gist.github.com/pklaus/960672 # https://gist.github.com/pklaus/960672
# https://genneko.github.io/playing-with-bsd/networking/freebsd-tunnelv6-he # https://genneko.github.io/playing-with-bsd/networking/freebsd-tunnelv6-he
@ -8,8 +8,27 @@
# https://shorewall.org/6to4.htm#idm143 # https://shorewall.org/6to4.htm#idm143
# https://shorewall.org/6to4.htm#SixInFour # https://shorewall.org/6to4.htm#SixInFour
# https://wiki.ubuntu.com/IPv6#Configure_your_Ubuntu_box_as_a_IPv6_router # https://wiki.ubuntu.com/IPv6#Configure_your_Ubuntu_box_as_a_IPv6_router
# http://koo.fi/blog/2013/03/20/linux-ipv6-router-radvd-dhcpv6/


## Tunnelbroker API ## Tunnelbroker API ##
# https://forums.he.net/index.php?topic=3153.0 ("The following scripts conform to the Dyn DNS Update API (as documented at http://dyn.com/support/developers/api/).") # https://forums.he.net/index.php?topic=3153.0 ("The following scripts conform to the Dyn DNS Update API (as documented at http://dyn.com/support/developers/api/).")
# https://help.dyn.com/remote-access-api/return-codes/ # https://help.dyn.com/remote-access-api/return-codes/
#
## DNSMASQ ##
# https://hveem.no/using-dnsmasq-for-dhcpv6

## RFCs ##
# DNSSL #
# https://tools.ietf.org/html/rfc6106
# https://tools.ietf.org/html/rfc8106
# RDNSS #
# https://tools.ietf.org/html/rfc5006 (see also 6106, 8106)
# SLAAC
# https://tools.ietf.org/html/rfc2462
# https://tools.ietf.org/html/rfc4862
# https://tools.ietf.org/html/rfc8064
# Router Advertisements
# https://tools.ietf.org/html/rfc4861
# https://tools.ietf.org/html/rfc5175
# https://tools.ietf.org/html/rfc6104
# https://tools.ietf.org/html/rfc7772