Claude
130baf9303
Firewall policy matrix: - VLAN-to-VLAN policies: full, internet-only, blocked, service, custom - Generates both switch ACLs AND OPNsense firewall rules - Printer VLAN preset: one-way access (staff can print, printers can't initiate connections back) on ports 9100/631/443/80 - Additional presets: LAN-access-all, IoT-isolated, Guest-isolated, Camera-NVR-only - Preview endpoint shows generated commands before pushing - Push endpoint applies to both devices with backup + safety check Port forwarding: - Create/delete OPNsense NAT port forwards via API - Tracks rule UUIDs for clean removal - Companion firewall rules auto-created Network topology: - /api/topology returns router, switch, VLANs, port states, devices - Auto-generated from live cached data PoE budget dashboard: - /api/poe/budget parses cached PoE status - Total/used/remaining watts, percent used, per-port draw https://claude.ai/code/session_01Do9bsN39MTuy2GVv7yzSrE
5814 lines
229 KiB
Python
5814 lines
229 KiB
Python
"""
|
||
ERS 59100GTS-PWR+ Switch Manager — Backend v3
|
||
────────────────────────────────────────────────────────────────────────
|
||
Changes from v2:
|
||
- Connection pool (30s lifetime, liveness check, auto-invalidate)
|
||
- Visitor-aware polling — starts when someone hits the page,
|
||
pauses when no active visitors, stops completely when idle
|
||
- Hard-block danger patterns (no force override for lethal commands)
|
||
- Session-based TOTP (one auth → session token → many pushes)
|
||
- Per-command execution with stop-on-error
|
||
- Config saved only on full success
|
||
|
||
Requirements:
|
||
pip install fastapi uvicorn paramiko pyotp
|
||
|
||
Run:
|
||
python switch_backend.py # start server
|
||
python switch_backend.py --setup-totp # first-time TOTP setup
|
||
────────────────────────────────────────────────────────────────────────
|
||
"""
|
||
|
||
import re, sys, time, secrets, logging, threading, os
|
||
from pathlib import Path
|
||
from typing import Optional
|
||
|
||
import paramiko, pyotp
|
||
from fastapi import FastAPI, HTTPException, Request
|
||
from fastapi.middleware.cors import CORSMiddleware
|
||
from fastapi.responses import JSONResponse
|
||
from fastapi.staticfiles import StaticFiles
|
||
from pydantic import BaseModel, field_validator
|
||
|
||
logging.basicConfig(level=logging.INFO,
|
||
format="%(asctime)s [%(levelname)s] %(message)s")
|
||
log = logging.getLogger("switch-manager")
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# CONFIG
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
SWITCH_HOST = "192.168.99.1"
|
||
SWITCH_PORT = 22
|
||
SWITCH_USER = "admin"
|
||
KEY_PATH = "/etc/switch-manager/ers59100_key"
|
||
KNOWN_HOSTS = "/etc/switch-manager/known_hosts"
|
||
TOTP_FILE = "/etc/switch-manager/totp_secret"
|
||
STATIC_DIR = "./frontend/dist"
|
||
|
||
POLL_ACTIVE_S = 15 # poll interval when visitors present
|
||
POLL_BG_S = 60 # poll interval when tab backgrounded
|
||
POLL_IDLE_AFTER = 300 # stop polling after this many seconds with no visitors
|
||
CONN_POOL_MAX_S = 25 # max connection age before refresh (< switch idle timeout)
|
||
SESSION_TTL_S = 600 # TOTP session — 10 minutes, reset on activity
|
||
|
||
ALLOWED_ORIGINS = ["*"] # tighten to http://192.168.99.X in production
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# TOTP
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
def get_or_create_totp_secret() -> str:
|
||
p = Path(TOTP_FILE)
|
||
if p.exists():
|
||
return p.read_text().strip()
|
||
secret = pyotp.random_base32()
|
||
p.parent.mkdir(parents=True, exist_ok=True)
|
||
p.write_text(secret)
|
||
p.chmod(0o600)
|
||
log.info(f"New TOTP secret created at {TOTP_FILE}")
|
||
return secret
|
||
|
||
def setup_totp():
|
||
secret = get_or_create_totp_secret()
|
||
uri = pyotp.TOTP(secret).provisioning_uri(
|
||
name="ERS59100", issuer_name="SwitchManager")
|
||
print("\n══════════════════════════════════════════════════")
|
||
print(" ERS 59100GTS-PWR+ Switch Manager — TOTP Setup")
|
||
print("══════════════════════════════════════════════════")
|
||
print(f"\n Manual entry secret:\n {secret}")
|
||
print(f"\n Provisioning URI (paste into authenticator app):\n {uri}")
|
||
print("\n Or generate a QR code:")
|
||
print(f" python -c \"import qrcode; qrcode.make('{uri}').show()\"")
|
||
print("\n══════════════════════════════════════════════════\n")
|
||
|
||
TOTP_SECRET: str = ""
|
||
|
||
# ── Session tokens (one TOTP → session, multiple pushes) ──────────────
|
||
# { token: { expires: float, last_activity: float } }
|
||
_sessions: dict[str, dict] = {}
|
||
_sessions_lock = threading.Lock()
|
||
|
||
def create_session() -> str:
|
||
token = secrets.token_hex(32)
|
||
now = time.time()
|
||
with _sessions_lock:
|
||
_sessions[token] = {"expires": now + SESSION_TTL_S, "last_activity": now}
|
||
return token
|
||
|
||
def validate_session(token: str) -> bool:
|
||
"""Returns True and refreshes activity timestamp if session is valid."""
|
||
now = time.time()
|
||
with _sessions_lock:
|
||
# Prune expired
|
||
expired = [t for t, s in _sessions.items() if s["expires"] < now]
|
||
for t in expired:
|
||
del _sessions[t]
|
||
if token not in _sessions:
|
||
return False
|
||
# Refresh on activity
|
||
_sessions[token]["last_activity"] = now
|
||
_sessions[token]["expires"] = now + SESSION_TTL_S
|
||
return True
|
||
|
||
def session_remaining(token: str) -> Optional[int]:
|
||
with _sessions_lock:
|
||
s = _sessions.get(token)
|
||
if not s:
|
||
return None
|
||
return max(0, int(s["expires"] - time.time()))
|
||
|
||
def revoke_session(token: str):
|
||
with _sessions_lock:
|
||
_sessions.pop(token, None)
|
||
|
||
def require_session(token: str):
|
||
if not validate_session(token):
|
||
raise HTTPException(401, "Session expired or invalid — re-authenticate with TOTP")
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# DANGER DETECTION
|
||
# Two tiers:
|
||
# HARD_BLOCK — refused entirely, must run at console
|
||
# WARN — flagged, push still offered with explicit override
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
HARD_BLOCK_PATTERNS = [
|
||
# Management VLAN removal — all variants
|
||
(re.compile(r'no\s+vlan\s+99\b', re.I), "Deletes management VLAN 99"),
|
||
(re.compile(r'vlan\s+members\s+remove\b.*\b99\b', re.I), "Removes VLAN 99 from a port — kills management trunk"),
|
||
(re.compile(r'no\s+vlan\s+tagging\b.*\b99\b', re.I), "Removes VLAN 99 tagging — kills management trunk"),
|
||
(re.compile(r'vlan\s+pvid\s+\S+\s+\S+', re.I), "Changes native VLAN — verify not management port"),
|
||
# SSH / IP removal
|
||
(re.compile(r'no\s+ip\s+ssh', re.I), "Disables SSH entirely — permanent lockout"),
|
||
(re.compile(r'no\s+ip\s+address\b', re.I), "Removes IP address — will lose connectivity"),
|
||
# Management interface
|
||
(re.compile(r'interface\s+vlan\s+99\b', re.I), "Modifies management VLAN interface — run at console"),
|
||
# Boot / factory
|
||
(re.compile(r'boot\s+config\s+flags\s+factory', re.I), "Factory reset — run at console"),
|
||
]
|
||
|
||
WARN_PATTERNS = [
|
||
(re.compile(r'\bshutdown\b', re.I), "Shuts down an interface — confirm it is not your uplink"),
|
||
(re.compile(r'default\s+interface\b', re.I), "Resets interface to defaults"),
|
||
(re.compile(r'no\s+vlan\s+\d+\b', re.I), "Deletes a VLAN — confirm no active ports depend on it"),
|
||
(re.compile(r'spanning-tree\s+.*\s+disable', re.I), "Disables spanning tree — loop risk"),
|
||
]
|
||
|
||
def check_danger(commands: list[str]) -> dict:
|
||
"""
|
||
Scan a list of CLI commands for dangerous patterns.
|
||
|
||
Returns a dict with:
|
||
hard_blocked — commands that are refused entirely (e.g. no vlan 99, no ip ssh)
|
||
warnings — commands that are allowed but flagged (e.g. shutdown)
|
||
has_hard_block, has_warnings — convenience booleans
|
||
"""
|
||
hard, warn = [], []
|
||
for cmd in commands:
|
||
for pat, reason in HARD_BLOCK_PATTERNS:
|
||
if pat.search(cmd):
|
||
hard.append({"command": cmd, "reason": reason})
|
||
break
|
||
else:
|
||
for pat, reason in WARN_PATTERNS:
|
||
if pat.search(cmd):
|
||
warn.append({"command": cmd, "reason": reason})
|
||
break
|
||
return {
|
||
"hard_blocked": hard,
|
||
"warnings": warn,
|
||
"has_hard_block": bool(hard),
|
||
"has_warnings": bool(warn),
|
||
}
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# SANITIZATION
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
_BAD_CHARS = re.compile(r'[;&|`$<>(){}\\"\']')
|
||
_BAD_PATS = [re.compile(p) for p in [r'\n', r'\r', r'--', r'/\*']]
|
||
_RE_VID = re.compile(r'^\d{1,4}$')
|
||
_RE_VNAME = re.compile(r'^[a-zA-Z0-9\-_]{1,32}$')
|
||
_RE_MODE = re.compile(r'^(access|trunk|disabled)$')
|
||
_RE_ANAME = re.compile(r'^[a-zA-Z0-9\-_]{1,32}$')
|
||
_RE_DIR = re.compile(r'^(in|out)$')
|
||
_RE_PROTO = re.compile(r'^(ip|tcp|udp|icmp)$')
|
||
_RE_ACTION = re.compile(r'^(permit|deny)$')
|
||
_RE_DESC = re.compile(r'^[a-zA-Z0-9\-_ ]{0,64}$')
|
||
_RE_IP = re.compile(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$')
|
||
|
||
def _san(v: str, pat: re.Pattern, field: str) -> str:
|
||
"""Reject shell-injection characters and check value against an allow-list regex."""
|
||
if _BAD_CHARS.search(v):
|
||
raise ValueError(f"{field}: disallowed characters")
|
||
for p in _BAD_PATS:
|
||
if p.search(v):
|
||
raise ValueError(f"{field}: injection pattern")
|
||
if not pat.match(v):
|
||
raise ValueError(f"{field}: invalid format — {repr(v)}")
|
||
return v
|
||
|
||
def san_vid(v, field="vlan_id") -> int:
|
||
"""Validate and return a VLAN ID integer (1–4094)."""
|
||
_san(str(v), _RE_VID, field)
|
||
vid = int(v)
|
||
if not 1 <= vid <= 4094:
|
||
raise ValueError(f"{field}: must be 1–4094")
|
||
return vid
|
||
|
||
def san_port(v) -> int:
|
||
"""Validate and return a port number (1–100 for the ERS 59100GTS-PWR+)."""
|
||
p = int(v)
|
||
if not 1 <= p <= 100:
|
||
raise ValueError("port: must be 1–100")
|
||
return p
|
||
|
||
_ALLOWED_CMD_RE = [
|
||
re.compile(r'^vlan\s+(create|members|tagging|pvid)\s'),
|
||
re.compile(r'^no\s+vlan\s+\d+$'),
|
||
re.compile(r'^interface\s+(GigabitEthernet\s+1/\d+|vlan\s+\d+)$'),
|
||
re.compile(r'^\s+(name|no\s+shutdown|poe|speed|duplex|ip\s+access-group|shutdown)\b'),
|
||
re.compile(r'^hostname\s+\S+$'),
|
||
re.compile(r'^ip\s+access-list\s+extended\s'),
|
||
re.compile(r'^\s+\d+\s+(permit|deny)\s'),
|
||
re.compile(r'^!\s*'), re.compile(r'^\s*$'),
|
||
]
|
||
|
||
def is_allowed(cmd: str) -> bool:
|
||
"""Return True if cmd matches the CLI allow-list (whitelist of safe command patterns)."""
|
||
return any(p.match(cmd) for p in _ALLOWED_CMD_RE)
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# CONNECTION POOL
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
class SwitchConnectionPool:
|
||
"""
|
||
Keeps one SSH connection alive for up to CONN_POOL_MAX_S seconds.
|
||
On liveness check failure or expiry → opens a fresh connection.
|
||
Thread-safe.
|
||
"""
|
||
def __init__(self):
|
||
self._conn: Optional[paramiko.SSHClient] = None
|
||
self._born: float = 0
|
||
self._lock = threading.Lock()
|
||
|
||
def get(self) -> paramiko.SSHClient:
|
||
with self._lock:
|
||
now = time.time()
|
||
age = now - self._born
|
||
if self._conn and age < CONN_POOL_MAX_S:
|
||
try:
|
||
transport = self._conn.get_transport()
|
||
if transport and transport.is_active():
|
||
transport.send_ignore() # lightweight liveness ping
|
||
return self._conn
|
||
except Exception:
|
||
log.info("Pool: liveness check failed — opening fresh connection")
|
||
self._close_unsafe()
|
||
self._conn = _open_connection()
|
||
self._born = time.time()
|
||
log.info("Pool: new connection opened")
|
||
return self._conn
|
||
|
||
def invalidate(self):
|
||
with self._lock:
|
||
self._close_unsafe()
|
||
|
||
def _close_unsafe(self):
|
||
if self._conn:
|
||
try:
|
||
self._conn.close()
|
||
except Exception:
|
||
pass
|
||
self._conn = None
|
||
self._born = 0
|
||
|
||
_pool = SwitchConnectionPool()
|
||
|
||
|
||
def _open_connection() -> paramiko.SSHClient:
|
||
client = paramiko.SSHClient()
|
||
known = Path(KNOWN_HOSTS)
|
||
if known.exists():
|
||
client.load_host_keys(str(known))
|
||
client.set_missing_host_key_policy(paramiko.RejectPolicy())
|
||
else:
|
||
log.warning("No known_hosts — trust on first use")
|
||
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||
try:
|
||
client.connect(
|
||
hostname=SWITCH_HOST, port=SWITCH_PORT, username=SWITCH_USER,
|
||
key_filename=KEY_PATH, look_for_keys=False, allow_agent=False,
|
||
timeout=10, banner_timeout=10,
|
||
)
|
||
except paramiko.AuthenticationException:
|
||
raise HTTPException(503, "SSH auth failed — is the public key loaded on the switch?")
|
||
except Exception as e:
|
||
raise HTTPException(503, f"Cannot reach switch at {SWITCH_HOST}: {e}")
|
||
if not known.exists():
|
||
known.parent.mkdir(parents=True, exist_ok=True)
|
||
client.save_host_keys(str(known))
|
||
log.info("Host key pinned to known_hosts")
|
||
return client
|
||
|
||
|
||
def read_cmd(cmd: str) -> str:
|
||
"""Run a read-only command in enable mode via interactive shell channel."""
|
||
try:
|
||
conn = _pool.get()
|
||
ch = conn.invoke_shell()
|
||
ch.settimeout(10)
|
||
time.sleep(0.4)
|
||
if ch.recv_ready():
|
||
ch.recv(4096) # drain login banner
|
||
for setup in ["terminal length 0", "enable"]:
|
||
ch.send(setup + "\n")
|
||
time.sleep(0.3)
|
||
if ch.recv_ready():
|
||
ch.recv(4096) # drain prompt output
|
||
ch.send(cmd + "\n")
|
||
out = ""
|
||
deadline = time.time() + 8
|
||
while time.time() < deadline:
|
||
if ch.recv_ready():
|
||
out += ch.recv(4096).decode("utf-8", errors="replace")
|
||
time.sleep(0.1)
|
||
else:
|
||
if out:
|
||
break
|
||
time.sleep(0.1)
|
||
ch.close()
|
||
return out
|
||
except HTTPException:
|
||
raise
|
||
except Exception as e:
|
||
log.warning(f"read_cmd failed ({cmd}): {e} — invalidating pool")
|
||
_pool.invalidate()
|
||
raise HTTPException(503, f"Switch read failed: {e}")
|
||
|
||
|
||
# ── Per-command interactive push ───────────────────────────────────────
|
||
|
||
_SWITCH_ERR = re.compile(
|
||
r'%\s*(invalid|error|unknown|bad|failed|cannot|not\s+found|does\s+not\s+exist'
|
||
r'|incomplete|ambiguous|out\s+of\s+range|already\s+exists)',
|
||
re.I
|
||
)
|
||
|
||
def _run_one(channel, cmd: str) -> tuple[str, bool]:
|
||
channel.send(cmd + "\n")
|
||
time.sleep(0.35)
|
||
out, deadline = "", time.time() + 6
|
||
while time.time() < deadline:
|
||
if channel.recv_ready():
|
||
out += channel.recv(4096).decode("utf-8", errors="replace")
|
||
time.sleep(0.1)
|
||
else:
|
||
if out:
|
||
break
|
||
time.sleep(0.1)
|
||
return out.strip(), bool(_SWITCH_ERR.search(out))
|
||
|
||
|
||
def push_one_by_one(commands: list[str]) -> dict:
|
||
"""
|
||
Opens a FRESH dedicated connection for push (not from pool —
|
||
we don't want a push session to corrupt the pool's read connection).
|
||
Runs commands one at a time, stops on first error.
|
||
Saves config only on full success.
|
||
"""
|
||
_pool.invalidate() # invalidate pool — switch will be busy during push
|
||
client = _open_connection()
|
||
results = []
|
||
stopped_at = None
|
||
try:
|
||
ch = client.invoke_shell()
|
||
ch.settimeout(10)
|
||
time.sleep(0.5)
|
||
if ch.recv_ready():
|
||
ch.recv(4096) # drain banner
|
||
|
||
for setup in ["terminal length 0", "enable", "configure terminal"]:
|
||
out, err = _run_one(ch, setup)
|
||
if err:
|
||
return {"success": False, "saved": False,
|
||
"error": f"Failed entering config mode: {out}",
|
||
"results": [], "hint": "Check switch is reachable and credentials are correct"}
|
||
|
||
for i, cmd in enumerate(commands):
|
||
s = cmd.strip()
|
||
if not s or s.startswith("!"):
|
||
results.append({"index": i, "command": cmd,
|
||
"output": "", "success": True, "skipped": True})
|
||
continue
|
||
log.info(f" [{i+1}/{len(commands)}] {s}")
|
||
out, had_err = _run_one(ch, s)
|
||
results.append({"index": i, "command": cmd,
|
||
"output": out, "success": not had_err, "skipped": False})
|
||
if had_err:
|
||
stopped_at = i
|
||
log.warning(f" Error at command {i+1}: {out}")
|
||
break
|
||
|
||
_run_one(ch, "end")
|
||
saved = False
|
||
if stopped_at is None:
|
||
_, save_err = _run_one(ch, "save config")
|
||
saved = not save_err
|
||
if saved:
|
||
log.info("Config saved to NVRAM")
|
||
else:
|
||
log.warning("Config save may have failed — verify at console")
|
||
else:
|
||
log.warning("Config NOT saved — push stopped on error")
|
||
|
||
ch.close()
|
||
return {
|
||
"success": stopped_at is None,
|
||
"saved": saved,
|
||
"commands_total": len(commands),
|
||
"commands_sent": len([r for r in results if not r.get("skipped")]),
|
||
"stopped_at": stopped_at,
|
||
"error": results[stopped_at]["output"] if stopped_at is not None else None,
|
||
"hint": "Remaining commands must be run at the switch console" if stopped_at is not None else None,
|
||
"results": results,
|
||
}
|
||
finally:
|
||
client.close()
|
||
# Pool will reopen on next poll naturally
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# VISITOR-AWARE POLLER
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
_cache: dict = {
|
||
"port_status": None, "poe_status": None,
|
||
"vlan_members": None, "sys_info": None,
|
||
"last_poll": 0, "poll_error": None,
|
||
}
|
||
_cache_lock = threading.Lock()
|
||
|
||
# Visitor tracking
|
||
_visitors: dict[str, float] = {} # { visitor_id: last_seen }
|
||
_visitors_lock = threading.Lock()
|
||
_poll_mode = "idle" # idle | active | background
|
||
|
||
def heartbeat(visitor_id: str, mode: str = "active"):
|
||
"""Called by frontend to indicate a visitor is present."""
|
||
global _poll_mode
|
||
with _visitors_lock:
|
||
_visitors[visitor_id] = time.time()
|
||
_poll_mode = mode
|
||
|
||
def prune_visitors():
|
||
"""Remove visitors not seen for POLL_IDLE_AFTER seconds and set mode to idle if none remain."""
|
||
global _poll_mode
|
||
with _visitors_lock:
|
||
now = time.time()
|
||
gone = [v for v, t in _visitors.items() if now - t > POLL_IDLE_AFTER]
|
||
for v in gone:
|
||
del _visitors[v]
|
||
if not _visitors:
|
||
_poll_mode = "idle"
|
||
|
||
def _poll_loop():
|
||
"""
|
||
Background thread: polls the switch for live status at a visitor-adaptive interval.
|
||
|
||
When visitors are active: polls every POLL_ACTIVE_S seconds.
|
||
When visitors have the tab backgrounded: polls every POLL_BG_S seconds.
|
||
When no visitors for POLL_IDLE_AFTER seconds: sleeps without polling.
|
||
Results cached in _cache; poll_error set on SSH failure.
|
||
"""
|
||
log.info("Poller thread started")
|
||
while True:
|
||
prune_visitors()
|
||
with _visitors_lock:
|
||
mode = _poll_mode
|
||
has_visitors = bool(_visitors)
|
||
|
||
if not has_visitors:
|
||
# No visitors — sleep and check again, don't poll switch
|
||
time.sleep(30)
|
||
continue
|
||
|
||
# Poll the switch
|
||
try:
|
||
data = {
|
||
"port_status": read_cmd("show interfaces"),
|
||
"poe_status": read_cmd("show poe-main-status"),
|
||
"vlan_members": read_cmd("show vlan"),
|
||
"sys_info": read_cmd("show sys-info"),
|
||
}
|
||
with _cache_lock:
|
||
_cache.update(data)
|
||
_cache["last_poll"] = time.time()
|
||
_cache["poll_error"] = None
|
||
except Exception as e:
|
||
with _cache_lock:
|
||
_cache["poll_error"] = str(e)
|
||
log.warning(f"Poll error: {e}")
|
||
|
||
# Check alert conditions after each poll
|
||
try:
|
||
_check_and_alert()
|
||
except Exception:
|
||
pass # alerts are best-effort, never crash the poller
|
||
|
||
interval = POLL_ACTIVE_S if mode == "active" else POLL_BG_S
|
||
time.sleep(interval)
|
||
|
||
def start_poller():
|
||
"""Launch the background polling thread as a daemon (exits when main process exits)."""
|
||
t = threading.Thread(target=_poll_loop, daemon=True)
|
||
t.start()
|
||
log.info("Poller started")
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# PYDANTIC MODELS
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
class TotpVerify(BaseModel):
|
||
code: str
|
||
|
||
class SessionCheck(BaseModel):
|
||
token: str
|
||
|
||
class SessionRevoke(BaseModel):
|
||
token: str
|
||
|
||
class Heartbeat(BaseModel):
|
||
visitor_id: str
|
||
mode: str = "active" # active | background
|
||
|
||
class PushBatch(BaseModel):
|
||
token: str
|
||
commands: list[str]
|
||
|
||
class VlanCreate(BaseModel):
|
||
token: str
|
||
vlan_id: int
|
||
name: str
|
||
@field_validator("vlan_id")
|
||
@classmethod
|
||
def cv(cls, v): return san_vid(v)
|
||
@field_validator("name")
|
||
@classmethod
|
||
def cn(cls, v): return _san(v, _RE_VNAME, "name")
|
||
|
||
class VlanDelete(BaseModel):
|
||
token: str
|
||
vlan_id: int
|
||
@field_validator("vlan_id")
|
||
@classmethod
|
||
def cv(cls, v):
|
||
vid = san_vid(v)
|
||
if vid == 1: raise ValueError("Cannot delete VLAN 1")
|
||
return vid
|
||
|
||
class VlanProvision(BaseModel):
|
||
token: str
|
||
vlan_id: int
|
||
name: str
|
||
subnet: str # e.g. "192.168.20.0/24"
|
||
gateway: str # OPNsense IP on this VLAN, e.g. "192.168.20.1"
|
||
dhcp_start: str # e.g. "192.168.20.100"
|
||
dhcp_end: str # e.g. "192.168.20.200"
|
||
parent_if: str # OPNsense physical parent, e.g. "em0" or "igb0"
|
||
opnsense_if: Optional[str] = "" # assigned interface name, e.g. "opt2"
|
||
allow_internet: bool = True # add default allow-out firewall rule
|
||
@field_validator("vlan_id")
|
||
@classmethod
|
||
def cv(cls, v):
|
||
vid = san_vid(v)
|
||
if vid in (1, 99): raise ValueError("VLAN 1 and 99 are reserved")
|
||
return vid
|
||
@field_validator("name")
|
||
@classmethod
|
||
def cn(cls, v): return _san(v, _RE_VNAME, "name")
|
||
|
||
class AclRule(BaseModel):
|
||
action: str
|
||
proto: str
|
||
src: Optional[str] = "any"
|
||
src_mask: Optional[str] = "0.0.0.255"
|
||
src_any: Optional[bool] = True
|
||
dst: Optional[str] = "any"
|
||
dst_mask: Optional[str] = "0.0.0.255"
|
||
dst_any: Optional[bool] = True
|
||
port: Optional[str] = ""
|
||
port_end: Optional[str] = "" # when set, generates "range port port_end"
|
||
@field_validator("action")
|
||
@classmethod
|
||
def ca(cls, v): return _san(v, _RE_ACTION, "action")
|
||
@field_validator("proto")
|
||
@classmethod
|
||
def cp(cls, v): return _san(v, _RE_PROTO, "proto")
|
||
|
||
class AclCreate(BaseModel):
|
||
token: str
|
||
name: str
|
||
apply_vlan: int
|
||
direction: str
|
||
rules: list[AclRule]
|
||
@field_validator("name")
|
||
@classmethod
|
||
def cn(cls, v): return _san(v, _RE_ANAME, "name")
|
||
@field_validator("direction")
|
||
@classmethod
|
||
def cd(cls, v): return _san(v, _RE_DIR, "direction")
|
||
|
||
class PortConfig(BaseModel):
|
||
token: str
|
||
port: int
|
||
mode: str
|
||
access_vlan: Optional[int] = 1
|
||
tagged_vlans: Optional[list[int]] = []
|
||
native_vlan: Optional[int] = 1
|
||
poe: Optional[bool] = True
|
||
poe_limit_mw: Optional[int] = 30000
|
||
description: Optional[str] = ""
|
||
@field_validator("port")
|
||
@classmethod
|
||
def cp(cls, v): return san_port(v)
|
||
@field_validator("mode")
|
||
@classmethod
|
||
def cm(cls, v): return _san(v, _RE_MODE, "mode")
|
||
@field_validator("poe_limit_mw")
|
||
@classmethod
|
||
def cpoe(cls, v):
|
||
if v is not None and not 1000 <= v <= 30000:
|
||
raise ValueError("PoE limit: 1000–30000 mW")
|
||
return v
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# COMMAND BUILDERS
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
def build_port(cfg: PortConfig) -> list[str]:
|
||
"""
|
||
Generate ERS 59100GTS-PWR+ CLI commands for a port configuration change.
|
||
|
||
Ports 1–96 are GigabitEthernet copper (PoE capable); ports 97–100 are SFP+ uplinks (no PoE).
|
||
All interfaces use slot/port notation: GigabitEthernet 1/{p}.
|
||
Returns a list of CLI command strings ready for push_one_by_one().
|
||
"""
|
||
p = cfg.port
|
||
iface = f"FastEthernet {p}"
|
||
cmds = []
|
||
if cfg.description:
|
||
cmds += [f"interface {iface}", f' name "{cfg.description}"']
|
||
if cfg.mode == "disabled":
|
||
cmds += [f"interface {iface}", " shutdown"]
|
||
elif cfg.mode == "access":
|
||
vid = san_vid(cfg.access_vlan, "access_vlan")
|
||
cmds += [f"vlan members add {vid} {p}", f"vlan pvid {p} {vid}"]
|
||
elif cfg.mode == "trunk":
|
||
native = san_vid(cfg.native_vlan, "native_vlan")
|
||
tagged = [san_vid(v, f"tagged_{v}") for v in (cfg.tagged_vlans or [])]
|
||
if tagged:
|
||
ts = ",".join(str(v) for v in tagged)
|
||
cmds += [f"vlan members add {ts} {p}", f"vlan tagging {ts} {p}"]
|
||
cmds.append(f"vlan pvid {p} {native}")
|
||
if p <= 96:
|
||
cmds += [f"interface {iface}",
|
||
" poe enable" if cfg.poe else " no poe enable"]
|
||
if cfg.poe:
|
||
cmds.append(f" poe poe-limit {cfg.poe_limit_mw}")
|
||
return cmds
|
||
|
||
def build_acl(acl: AclCreate) -> list[str]:
|
||
"""
|
||
Generate ERS 59100GTS-PWR+ CLI commands to create an extended IP ACL and apply it to a VLAN interface.
|
||
|
||
Rules are numbered sequentially starting from 1.
|
||
The ACL is applied to the VLAN's Layer 3 interface in the specified direction (in/out).
|
||
"""
|
||
cmds = [f"ip access-list extended {acl.name}"]
|
||
for i, r in enumerate(acl.rules):
|
||
src = "any" if r.src_any else f"{r.src} {r.src_mask}"
|
||
dst = "any" if r.dst_any else f"{r.dst} {r.dst_mask}"
|
||
if r.port and r.port_end:
|
||
port_str = f" range {r.port} {r.port_end}"
|
||
elif r.port:
|
||
port_str = f" eq {r.port}"
|
||
else:
|
||
port_str = ""
|
||
cmds.append(f" {i+1} {r.action} {r.proto} {src} {dst}{port_str}")
|
||
vid = san_vid(acl.apply_vlan, "apply_vlan")
|
||
cmds += [f"interface vlan {vid}",
|
||
f" ip access-group {acl.name} {acl.direction}"]
|
||
return cmds
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# APP
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
app = FastAPI(title="ERS 59100GTS-PWR+ Switch Manager", version="3.0.0",
|
||
docs_url="/api/docs", redoc_url=None)
|
||
|
||
app.add_middleware(CORSMiddleware, allow_origins=ALLOWED_ORIGINS,
|
||
allow_methods=["GET","POST","DELETE"],
|
||
allow_headers=["Content-Type"])
|
||
|
||
@app.exception_handler(ValueError)
|
||
async def val_err(req: Request, exc: ValueError):
|
||
return JSONResponse(400, {"detail": str(exc)})
|
||
|
||
@app.on_event("startup")
|
||
def startup():
|
||
global TOTP_SECRET
|
||
TOTP_SECRET = get_or_create_totp_secret()
|
||
log.info("TOTP secret loaded")
|
||
start_poller()
|
||
|
||
# ── Heartbeat (visitor tracking) ──────────────────────────────────────
|
||
|
||
@app.post("/api/heartbeat")
|
||
def hb(body: Heartbeat):
|
||
"""
|
||
Frontend calls this every 30s to indicate visitor is present.
|
||
mode = 'active' when tab is visible, 'background' when hidden.
|
||
Poller adjusts interval accordingly.
|
||
"""
|
||
heartbeat(body.visitor_id, body.mode)
|
||
with _cache_lock:
|
||
last = _cache["last_poll"]
|
||
err = _cache["poll_error"]
|
||
return {
|
||
"poll_mode": _poll_mode,
|
||
"last_poll": last,
|
||
"poll_age": round(time.time() - last, 1) if last else None,
|
||
"poll_error": err,
|
||
}
|
||
|
||
# ── Auth ───────────────────────────────────────────────────────────────
|
||
|
||
@app.post("/api/auth/verify")
|
||
def verify_totp(body: TotpVerify):
|
||
"""Verify TOTP code — returns session token for multiple pushes."""
|
||
if not pyotp.TOTP(TOTP_SECRET).verify(body.code.strip(), valid_window=1):
|
||
log.warning("TOTP verify failed")
|
||
raise HTTPException(401, "Invalid TOTP code")
|
||
token = create_session()
|
||
log.info("TOTP OK — session created")
|
||
return {
|
||
"token": token,
|
||
"expires_in": SESSION_TTL_S,
|
||
"message": "Session active — re-authenticates on expiry or manual lock"
|
||
}
|
||
|
||
@app.post("/api/auth/check")
|
||
def check_session(body: SessionCheck):
|
||
"""Check if a session is still valid. Returns remaining seconds."""
|
||
remaining = session_remaining(body.token)
|
||
if remaining is None:
|
||
raise HTTPException(401, "Session expired")
|
||
return {"valid": True, "remaining": remaining}
|
||
|
||
@app.post("/api/auth/revoke")
|
||
def revoke(body: SessionRevoke):
|
||
"""Manually lock — invalidates the session immediately."""
|
||
revoke_session(body.token)
|
||
log.info("Session manually revoked")
|
||
return {"revoked": True}
|
||
|
||
# ── Read endpoints (no auth) ───────────────────────────────────────────
|
||
|
||
@app.get("/api/status")
|
||
def status():
|
||
"""Backend and switch connectivity summary (no auth required)."""
|
||
with _cache_lock:
|
||
return {
|
||
"backend": "online",
|
||
"switch_host": SWITCH_HOST,
|
||
"key_exists": Path(KEY_PATH).exists(),
|
||
"known_hosts_pinned": Path(KNOWN_HOSTS).exists(),
|
||
"last_poll": _cache["last_poll"],
|
||
"poll_age": round(time.time() - _cache["last_poll"], 1)
|
||
if _cache["last_poll"] else None,
|
||
"poll_error": _cache["poll_error"],
|
||
"poll_mode": _poll_mode,
|
||
}
|
||
|
||
@app.get("/api/live")
|
||
def live():
|
||
"""Cached live switch data — updated by background poller."""
|
||
with _cache_lock:
|
||
age = time.time() - _cache["last_poll"] if _cache["last_poll"] else None
|
||
return {
|
||
**_cache,
|
||
"stale": age is None or age > max(POLL_ACTIVE_S, POLL_BG_S) * 3
|
||
}
|
||
|
||
@app.get("/api/switch/config")
|
||
def running_config():
|
||
"""Fetch and return the full switch running config (read-only, no auth)."""
|
||
out = read_cmd("show config")
|
||
return {"config": out, "lines": len(out.splitlines())}
|
||
|
||
|
||
# ── Capability probe ────────────────────────────────────────────────────
|
||
|
||
_caps_cache: dict = {}
|
||
_caps_ts: float = 0.0
|
||
_caps_lock = threading.Lock()
|
||
_CAPS_TTL = 300 # seconds — re-probe every 5 min; license won't change mid-session
|
||
|
||
|
||
def _probe_capabilities() -> dict:
|
||
"""
|
||
Non-destructive read-only probes to detect which features the switch
|
||
supports under its current software license.
|
||
|
||
Base Software: ACL and L3 VLAN commands return '% Invalid input detected'.
|
||
Advanced License: commands succeed (may show empty output, but no error).
|
||
"""
|
||
acl_out = read_cmd("show ip access-list")
|
||
vlan_out = read_cmd("show interface vlan 1")
|
||
acl_ok = not _SWITCH_ERR.search(acl_out)
|
||
l3_ok = not _SWITCH_ERR.search(vlan_out)
|
||
return {
|
||
"acl": acl_ok,
|
||
"l3_vlan": l3_ok,
|
||
"dhcp_relay_config": l3_ok, # relay config uses 'interface vlan'
|
||
"management_pinholes": acl_ok,
|
||
"dns_enforce_acls": acl_ok,
|
||
"license_tier": "advanced" if acl_ok else "base",
|
||
}
|
||
|
||
|
||
def _require_advanced_license():
|
||
"""Raise 402 if the switch reports Base Software (no ACL/L3 support)."""
|
||
global _caps_ts
|
||
with _caps_lock:
|
||
cached = _caps_cache.copy() if _caps_cache else {}
|
||
# If we have a cached result use it; otherwise probe now
|
||
if not cached:
|
||
try:
|
||
cached = _probe_capabilities()
|
||
with _caps_lock:
|
||
_caps_cache.update(cached)
|
||
_caps_ts = time.time()
|
||
except HTTPException:
|
||
return # can't reach switch — let the push fail with its own error
|
||
if cached.get("license_tier") == "base":
|
||
raise HTTPException(
|
||
402,
|
||
"This feature requires the Advanced Software License. "
|
||
"The switch reported Base Software — ACLs and L3 VLAN interfaces are not available."
|
||
)
|
||
|
||
|
||
@app.get("/api/switch/capabilities")
|
||
def switch_capabilities():
|
||
"""
|
||
Probe the switch to determine which features are available under its
|
||
current software license. Results are cached for 5 minutes.
|
||
|
||
Base Software supports L2 only (VLANs, ports, PoE, show commands).
|
||
Advanced License adds ACLs and L3 VLAN interfaces.
|
||
|
||
Affected endpoints when license_tier == 'base':
|
||
- POST /api/switch/acl (acl)
|
||
- POST /api/ctrld/dns-enforce-acls (dns_enforce_acls)
|
||
"""
|
||
global _caps_cache, _caps_ts
|
||
with _caps_lock:
|
||
if time.time() - _caps_ts < _CAPS_TTL and _caps_cache:
|
||
return {**_caps_cache, "cached": True}
|
||
try:
|
||
caps = _probe_capabilities()
|
||
except HTTPException as e:
|
||
return {
|
||
"error": e.detail,
|
||
"acl": False, "l3_vlan": False,
|
||
"dhcp_relay_config": False,
|
||
"management_pinholes": False,
|
||
"dns_enforce_acls": False,
|
||
"license_tier": "unknown",
|
||
"cached": False,
|
||
}
|
||
with _caps_lock:
|
||
_caps_cache = caps
|
||
_caps_ts = time.time()
|
||
return {**caps, "cached": False}
|
||
|
||
# ── Danger pre-flight (no auth — check before prompting TOTP) ─────────
|
||
|
||
@app.post("/api/check/danger")
|
||
def danger_check(body: dict):
|
||
"""
|
||
Pre-flight danger check — call this before showing TOTP prompt.
|
||
|
||
Returns hard_blocked, warnings, and safe_to_push flag.
|
||
No auth required so the user sees danger info before authenticating.
|
||
"""
|
||
cmds = body.get("commands", [])
|
||
result = check_danger(cmds)
|
||
rejected = [c for c in cmds if not is_allowed(c)]
|
||
result["rejected_by_allowlist"] = rejected
|
||
result["safe_to_push"] = (
|
||
not result["has_hard_block"] and not rejected
|
||
)
|
||
return result
|
||
|
||
# ── Push endpoints (require session token) ────────────────────────────
|
||
|
||
@app.post("/api/switch/push")
|
||
def push(body: PushBatch):
|
||
"""
|
||
Push CLI batch one command at a time.
|
||
Requires valid session token.
|
||
Hard-blocked commands are refused — no override.
|
||
Warn-level commands proceed (user was already shown the warning).
|
||
Stops on first switch error. Config saved only on full success.
|
||
"""
|
||
require_session(body.token)
|
||
|
||
danger = check_danger(body.commands)
|
||
if danger["has_hard_block"]:
|
||
raise HTTPException(400, {
|
||
"message": "Hard-blocked commands detected — these must be run at the switch console",
|
||
"blocked": danger["hard_blocked"],
|
||
})
|
||
|
||
rejected = [c for c in body.commands if not is_allowed(c)]
|
||
if rejected:
|
||
raise HTTPException(400, {
|
||
"message": "Commands failed allowlist validation",
|
||
"rejected": rejected[:10],
|
||
})
|
||
|
||
log.info(f"Push: {len(body.commands)} commands")
|
||
return push_one_by_one(body.commands)
|
||
|
||
@app.post("/api/switch/vlan")
|
||
def create_vlan(body: VlanCreate):
|
||
"""Create a new VLAN on the switch (type port = standard Layer 2 VLAN)."""
|
||
require_session(body.token)
|
||
return push_one_by_one(
|
||
[f'vlan create {body.vlan_id} name "{body.name}" type port'])
|
||
|
||
@app.delete("/api/switch/vlan/{vlan_id}")
|
||
def delete_vlan(vlan_id: int, token: str):
|
||
"""Delete a VLAN by ID. VLAN 1 is blocked at model level; VLAN 99 is blocked by danger check."""
|
||
require_session(token)
|
||
return push_one_by_one([f"no vlan {san_vid(vlan_id)}"])
|
||
|
||
@app.post("/api/switch/port")
|
||
def configure_port(body: PortConfig):
|
||
"""Apply port configuration: mode (access/trunk/disabled), VLAN, PoE, description."""
|
||
require_session(body.token)
|
||
return push_one_by_one(build_port(body))
|
||
|
||
@app.post("/api/switch/acl")
|
||
def create_acl(body: AclCreate):
|
||
"""Create an extended IP ACL and apply it to a VLAN interface. Requires Advanced License."""
|
||
require_session(body.token)
|
||
_require_advanced_license()
|
||
return push_one_by_one(build_acl(body))
|
||
|
||
@app.post("/api/vlan/provision")
|
||
def provision_vlan(body: VlanProvision):
|
||
"""
|
||
End-to-end VLAN provisioning: switch VLAN + OPNsense interface tag +
|
||
DHCP scope + optional internet-allow firewall rule.
|
||
|
||
Steps performed:
|
||
1. Create VLAN on switch
|
||
2. Create VLAN tag on OPNsense (interfaces/vlan_settings)
|
||
3. Apply OPNsense VLAN config
|
||
4. If opnsense_if provided: create DHCP subnet + apply
|
||
5. If opnsense_if + allow_internet: add allow-outbound firewall rule + apply
|
||
|
||
Returns steps_done, pending_steps (anything needing manual finish in OPNsense UI).
|
||
"""
|
||
import ipaddress as _ipaddr
|
||
require_session(body.token)
|
||
|
||
steps_done: list[str] = []
|
||
pending_steps: list[str] = []
|
||
|
||
# Validate subnet/gateway/range are sane
|
||
try:
|
||
net = _ipaddr.ip_network(body.subnet, strict=False)
|
||
_ipaddr.ip_address(body.gateway)
|
||
_ipaddr.ip_address(body.dhcp_start)
|
||
_ipaddr.ip_address(body.dhcp_end)
|
||
except ValueError as e:
|
||
raise HTTPException(400, f"Invalid address: {e}")
|
||
|
||
# ── Step 1: Switch VLAN ────────────────────────────────────────────
|
||
result = push_one_by_one([f'vlan create {body.vlan_id} name "{body.name}" type port'])
|
||
if not result.get("success"):
|
||
raise HTTPException(502, {"message": "Switch VLAN create failed", "detail": result})
|
||
steps_done.append(f"switch: vlan {body.vlan_id} '{body.name}' created")
|
||
|
||
# ── Steps 2–5: OPNsense ───────────────────────────────────────────
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("key"):
|
||
pending_steps += [
|
||
f"OPNsense: create VLAN tag {body.vlan_id} on {body.parent_if}",
|
||
f"OPNsense: assign VLAN interface, set IP {body.gateway}/{net.prefixlen}",
|
||
f"OPNsense: create DHCP scope {body.dhcp_start}–{body.dhcp_end}",
|
||
]
|
||
if body.allow_internet:
|
||
pending_steps.append("OPNsense: add allow-outbound firewall rule for VLAN")
|
||
return {"success": True, "steps_done": steps_done, "pending_steps": pending_steps,
|
||
"note": "OPNsense not configured — connect it under DHCP settings to automate these steps"}
|
||
|
||
errors: list[str] = []
|
||
|
||
# Step 2: create VLAN tag
|
||
try:
|
||
vlan_r = _opnsense_request(cfg, "interfaces/vlan_settings/addItem", "POST", {
|
||
"vlan": {"if": body.parent_if, "tag": str(body.vlan_id), "pcp": "0", "descr": body.name}
|
||
})
|
||
vlan_uuid = vlan_r.get("uuid", "")
|
||
steps_done.append(f"OPNsense: VLAN tag {body.vlan_id} created on {body.parent_if} (uuid={vlan_uuid})")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense VLAN tag: {e}")
|
||
vlan_uuid = ""
|
||
|
||
# Step 3: apply VLAN config
|
||
if vlan_uuid:
|
||
try:
|
||
_opnsense_request(cfg, "interfaces/vlan_settings/reconfigure", "POST")
|
||
steps_done.append("OPNsense: VLAN config applied")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense VLAN apply: {e}")
|
||
|
||
# Interface assignment must be done in OPNsense UI unless opnsense_if is provided
|
||
if not body.opnsense_if:
|
||
pending_steps += [
|
||
f"OPNsense UI: assign {body.parent_if}.{body.vlan_id} as a new interface, "
|
||
f"set static IP {body.gateway}/{net.prefixlen}, note the interface name (e.g. opt2)",
|
||
f"OPNsense: create DHCP scope {body.dhcp_start}–{body.dhcp_end} once interface is assigned",
|
||
]
|
||
if body.allow_internet:
|
||
pending_steps.append("OPNsense: add allow-outbound firewall rule for new interface")
|
||
else:
|
||
# Step 4: DHCP scope
|
||
try:
|
||
_opnsense_request(cfg, "dhcpv4/settings/addSubnet", "POST", {
|
||
"subnet": {
|
||
"interface": body.opnsense_if,
|
||
"subnet": str(net),
|
||
"gateway": body.gateway,
|
||
"dns_servers": body.gateway,
|
||
"range": {"from": body.dhcp_start, "to": body.dhcp_end},
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "dhcpv4/service/reconfigure", "POST")
|
||
steps_done.append(
|
||
f"OPNsense: DHCP scope {body.dhcp_start}–{body.dhcp_end} on {body.opnsense_if} created")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense DHCP scope: {e}")
|
||
|
||
# Step 5: firewall allow-outbound
|
||
if body.allow_internet:
|
||
try:
|
||
fw_r = _opnsense_request(cfg, "firewall/filter/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1",
|
||
"action": "pass",
|
||
"interface": body.opnsense_if,
|
||
"direction": "in",
|
||
"ipprotocol": "inet",
|
||
"protocol": "any",
|
||
"source": {"network": f"{body.opnsense_if}net"},
|
||
"destination":{"any": "1"},
|
||
"descr": f"Allow VLAN {body.vlan_id} {body.name} outbound",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
steps_done.append(
|
||
f"OPNsense: allow-outbound rule for {body.opnsense_if} added (uuid={fw_r.get('uuid','')})")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense firewall rule: {e}")
|
||
|
||
# Persist VLAN→interface mapping for push-reservation lookups
|
||
vmap = _load_vlan_if_map()
|
||
vmap[str(body.vlan_id)] = body.opnsense_if
|
||
_save_vlan_if_map(vmap)
|
||
|
||
return {
|
||
"success": len(errors) == 0,
|
||
"steps_done": steps_done,
|
||
"pending_steps": pending_steps,
|
||
"errors": errors,
|
||
}
|
||
|
||
# ── Serve React app ────────────────────────────────────────────────────
|
||
if os.path.isdir(STATIC_DIR):
|
||
app.mount("/", StaticFiles(directory=STATIC_DIR, html=True), name="frontend")
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
if __name__ == "__main__":
|
||
if "--setup-totp" in sys.argv:
|
||
setup_totp()
|
||
sys.exit(0)
|
||
import uvicorn
|
||
uvicorn.run("switch_backend:app", host="0.0.0.0", port=8765,
|
||
log_level="info")
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# DEVICE ACCESS — DHCP LEASES, MAC RESERVATIONS, ACL PINHOLES
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
import json as _json
|
||
from pathlib import Path as _Path
|
||
|
||
DEVICES_FILE = _Path("/etc/switch-manager/devices.json")
|
||
|
||
def _load_devices() -> list:
|
||
"""Load the saved device list from devices.json, returning [] on missing or corrupt file."""
|
||
if DEVICES_FILE.exists():
|
||
try: return _json.loads(DEVICES_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
def _save_devices(devices: list):
|
||
"""Persist the device list to devices.json with 2-space indentation."""
|
||
DEVICES_FILE.write_text(_json.dumps(devices, indent=2))
|
||
|
||
def _parse_dhcp_leases(raw: str) -> list:
|
||
"""Parse ERS 59100GTS-PWR+ 'show dhcp-server leases' output."""
|
||
import re
|
||
leases = []
|
||
for line in raw.splitlines():
|
||
# Format: IP MAC State Remaining Hostname
|
||
m = re.match(
|
||
r'\s*(\d+\.\d+\.\d+\.\d+)\s+'
|
||
r'([0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2}'
|
||
r'[:\-][0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2})\s+'
|
||
r'(\S+)\s+(\S+)\s*(.*)', line)
|
||
if m:
|
||
leases.append({
|
||
"ip": m.group(1),
|
||
"mac": m.group(2).lower().replace('-',':'),
|
||
"state": m.group(3),
|
||
"remaining": m.group(4),
|
||
"hostname": m.group(5).strip() or "unknown",
|
||
})
|
||
return leases
|
||
|
||
def _parse_arp_table(raw: str) -> list:
|
||
"""Parse 'show arp' for additional device discovery."""
|
||
import re
|
||
entries = []
|
||
for line in raw.splitlines():
|
||
m = re.match(
|
||
r'\s*(\d+\.\d+\.\d+\.\d+)\s+'
|
||
r'([0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2}'
|
||
r'[:\-][0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2}[:\-][0-9a-fA-F]{2})',
|
||
line)
|
||
if m:
|
||
entries.append({
|
||
"ip": m.group(1),
|
||
"mac": m.group(2).lower().replace('-',':'),
|
||
"state": "arp",
|
||
"remaining": "-",
|
||
"hostname": "",
|
||
})
|
||
return entries
|
||
|
||
class DeviceEntry(BaseModel):
|
||
name: str
|
||
mac: str
|
||
ip: str
|
||
vlan: int = 10
|
||
management_access: bool = False
|
||
static_ip: bool = False
|
||
notes: Optional[str] = ""
|
||
|
||
class DeviceUpdate(BaseModel):
|
||
token: str
|
||
device: DeviceEntry
|
||
|
||
class DeviceDelete(BaseModel):
|
||
token: str
|
||
mac: str
|
||
|
||
class PinholeRequest(BaseModel):
|
||
token: str
|
||
mac: str
|
||
allow: bool = True
|
||
|
||
def _build_dhcp_reservation_cmds(device: DeviceEntry) -> list:
|
||
"""Generate ERS 59100GTS-PWR+ CLI for DHCP static binding."""
|
||
mac_clean = device.mac.replace(':','-').upper()
|
||
return [
|
||
f"ip dhcp-server static-binding {device.ip}",
|
||
f" mac-address {mac_clean}",
|
||
f" client-name \"{device.name}\"",
|
||
]
|
||
|
||
def _build_pinhole_acl_cmds(device: DeviceEntry, mgmt_ip: str, allow: bool) -> list:
|
||
"""Generate ACL commands to allow/deny a device IP to reach management."""
|
||
acl_name = f"MGMT-ACCESS"
|
||
if allow:
|
||
return [
|
||
f"ip access-list extended {acl_name}",
|
||
f" permit tcp host {device.ip} host {mgmt_ip} eq 443",
|
||
f" permit tcp host {device.ip} host {mgmt_ip} eq 8765",
|
||
]
|
||
else:
|
||
return [
|
||
f"ip access-list extended {acl_name}",
|
||
f" no permit tcp host {device.ip} host {mgmt_ip}",
|
||
]
|
||
|
||
@app.get("/api/devices")
|
||
def get_devices():
|
||
"""Return saved device list plus live DHCP leases and ARP from switch."""
|
||
saved = _load_devices()
|
||
live_leases = []
|
||
try:
|
||
arp_raw = read_cmd("show arp")
|
||
live_leases = _parse_arp_table(arp_raw)
|
||
try:
|
||
dhcp_raw = read_cmd("show ip dhcp-server leases")
|
||
dhcp_leases = _parse_dhcp_leases(dhcp_raw)
|
||
lease_ips = {l["ip"] for l in dhcp_leases}
|
||
live_leases = dhcp_leases + [e for e in live_leases if e["ip"] not in lease_ips]
|
||
except Exception:
|
||
pass # DHCP server may not be enabled
|
||
except Exception as e:
|
||
log.warning(f"Could not pull ARP from switch: {e}")
|
||
return {
|
||
"saved": saved,
|
||
"live": live_leases,
|
||
"mgmt_ip": SWITCH_HOST,
|
||
}
|
||
|
||
@app.post("/api/devices/save")
|
||
def save_device(body: DeviceUpdate):
|
||
"""Save or update a device entry (upsert by MAC address)."""
|
||
require_session(body.token)
|
||
devices = _load_devices()
|
||
existing = next((i for i, d in enumerate(devices) if d["mac"] == body.device.mac), None)
|
||
device_dict = body.device.dict()
|
||
if existing is not None:
|
||
devices[existing] = device_dict
|
||
else:
|
||
devices.append(device_dict)
|
||
_save_devices(devices)
|
||
log.info(f"Device saved: {body.device.name} ({body.device.mac})")
|
||
return {"success": True, "devices": devices}
|
||
|
||
@app.post("/api/devices/delete")
|
||
def delete_device(body: DeviceDelete):
|
||
"""Remove a device from the saved list by MAC address."""
|
||
require_session(body.token)
|
||
devices = [d for d in _load_devices() if d["mac"] != body.mac]
|
||
_save_devices(devices)
|
||
return {"success": True}
|
||
|
||
@app.post("/api/devices/push-reservation")
|
||
def push_reservation(body: DeviceUpdate):
|
||
"""
|
||
Push a DHCP static reservation for this device.
|
||
|
||
Routes to OPNsense if configured (preferred — no license required).
|
||
Falls back to switch DHCP CLI only if OPNsense is not configured, which
|
||
requires Advanced License on the switch.
|
||
"""
|
||
require_session(body.token)
|
||
device = body.device
|
||
cfg = _load_opnsense_cfg()
|
||
|
||
if cfg.get("key"):
|
||
# Derive OPNsense interface from stored VLAN→interface map
|
||
vmap = _load_vlan_if_map()
|
||
iface = vmap.get(str(device.vlan), "")
|
||
try:
|
||
result = _opnsense_request(cfg, "dhcpv4/reservations/addReservation", "POST", {
|
||
"reservation": {
|
||
"interface": iface,
|
||
"mac": device.mac,
|
||
"ipaddr": device.ip,
|
||
"hostname": device.name,
|
||
"descr": f"Added by switch-manager",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "dhcpv4/service/reconfigure", "POST")
|
||
log.info(f"OPNsense DHCP reservation pushed: {device.name} ({device.mac}) → {device.ip}")
|
||
return {"success": True, "target": "opnsense", "result": result}
|
||
except ValueError as e:
|
||
raise HTTPException(400, str(e))
|
||
else:
|
||
# Switch DHCP — requires Advanced License
|
||
cmds = _build_dhcp_reservation_cmds(device)
|
||
danger = check_danger(cmds)
|
||
if danger["has_hard_block"]:
|
||
raise HTTPException(400, {"message": "Blocked", "blocked": danger["hard_blocked"]})
|
||
log.info(f"Switch DHCP reservation pushed: {device.name}")
|
||
result = push_one_by_one(cmds)
|
||
result["target"] = "switch"
|
||
return result
|
||
|
||
@app.post("/api/devices/push-pinhole")
|
||
def push_pinhole(body: PinholeRequest):
|
||
"""
|
||
Add or remove a management-access firewall pinhole for a device.
|
||
|
||
Uses OPNsense firewall API if configured. Rule UUIDs are stored locally
|
||
so the same device can be cleanly de-pinholed later.
|
||
"""
|
||
require_session(body.token)
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("key"):
|
||
raise HTTPException(503, "OPNsense not configured — connect it under DHCP settings")
|
||
|
||
devices = _load_devices()
|
||
device = next((DeviceEntry(**d) for d in devices if d["mac"] == body.mac), None)
|
||
if not device:
|
||
raise HTTPException(404, "Device not found — save it first")
|
||
|
||
import socket
|
||
try:
|
||
mgmt_ip = socket.gethostbyname(socket.gethostname())
|
||
except Exception:
|
||
mgmt_ip = SWITCH_HOST.rsplit('.', 1)[0] + '.50'
|
||
|
||
pinholes = _load_pinholes()
|
||
|
||
if body.allow:
|
||
# Look up OPNsense interface for device VLAN
|
||
vmap = _load_vlan_if_map()
|
||
iface = vmap.get(str(device.vlan), "")
|
||
try:
|
||
r = _opnsense_request(cfg, "firewall/filter/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1",
|
||
"action": "pass",
|
||
"interface": iface,
|
||
"direction": "in",
|
||
"ipprotocol": "inet",
|
||
"protocol": "tcp",
|
||
"source": {"address": device.ip},
|
||
"destination": {"address": mgmt_ip, "port": "8765"},
|
||
"descr": f"switch-manager pinhole {device.name}",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
pinholes[device.mac] = r.get("uuid", "")
|
||
_save_pinholes(pinholes)
|
||
log.info(f"Pinhole allow: {device.name} ({device.ip}) → {mgmt_ip}:8765")
|
||
return {"success": True, "action": "allow", "uuid": r.get("uuid", "")}
|
||
except ValueError as e:
|
||
raise HTTPException(400, str(e))
|
||
else:
|
||
uuid = pinholes.get(device.mac, "")
|
||
if not uuid:
|
||
raise HTTPException(404, "No pinhole rule found for this device")
|
||
try:
|
||
_opnsense_request(cfg, f"firewall/filter/delRule/{uuid}", "POST")
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
pinholes.pop(device.mac, None)
|
||
_save_pinholes(pinholes)
|
||
log.info(f"Pinhole removed: {device.name} ({device.ip})")
|
||
return {"success": True, "action": "deny", "uuid": uuid}
|
||
except ValueError as e:
|
||
raise HTTPException(400, str(e))
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# WIREGUARD PEER MANAGEMENT
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
WG_CLIENT_DIR_API = _Path("/etc/switch-manager/clients")
|
||
WG_CONF_PATH = _Path("/etc/wireguard/wg0.conf")
|
||
|
||
class WGClientRequest(BaseModel):
|
||
token: str
|
||
name: str
|
||
|
||
class WGRevokeRequest(BaseModel):
|
||
token: str
|
||
name: str
|
||
|
||
def _wg_genkey_api():
|
||
"""Generate a WireGuard private/public keypair using the system wg tool."""
|
||
import subprocess as _sp
|
||
priv = _sp.run(["wg","genkey"], capture_output=True, text=True).stdout.strip()
|
||
pub = _sp.run(["wg","pubkey"], input=priv, capture_output=True, text=True).stdout.strip()
|
||
return priv, pub
|
||
|
||
def _wg_status() -> dict:
|
||
"""Return parsed WireGuard interface status including connected peers."""
|
||
import subprocess as _sp
|
||
try:
|
||
raw = _sp.run(["wg","show"], capture_output=True, text=True).stdout
|
||
peers = []
|
||
current = {}
|
||
for line in raw.splitlines():
|
||
line = line.strip()
|
||
if line.startswith("peer:"):
|
||
if current: peers.append(current)
|
||
current = {"public_key": line.split(":",1)[1].strip()}
|
||
elif line.startswith("endpoint:"):
|
||
current["endpoint"] = line.split(":",1)[1].strip()
|
||
elif line.startswith("latest handshake:"):
|
||
current["last_handshake"] = line.split(":",1)[1].strip()
|
||
elif line.startswith("transfer:"):
|
||
current["transfer"] = line.split(":",1)[1].strip()
|
||
elif line.startswith("allowed ips:"):
|
||
current["allowed_ips"] = line.split(":",1)[1].strip()
|
||
if current: peers.append(current)
|
||
|
||
# Match peers to named client files
|
||
named = {}
|
||
if WG_CLIENT_DIR_API.exists():
|
||
for f in WG_CLIENT_DIR_API.glob("*.conf"):
|
||
txt = f.read_text()
|
||
import re
|
||
m = re.search(r'PublicKey\s*=\s*(\S+)', txt)
|
||
if m: named[m.group(1)] = f.stem
|
||
|
||
for p in peers:
|
||
p["name"] = named.get(p.get("public_key",""), "unknown")
|
||
|
||
return {"running": True, "peers": peers}
|
||
except Exception as e:
|
||
return {"running": False, "error": str(e), "peers": []}
|
||
|
||
@app.get("/api/wireguard/status")
|
||
def wg_status():
|
||
return _wg_status()
|
||
|
||
@app.get("/api/wireguard/clients")
|
||
def wg_clients():
|
||
clients = []
|
||
if WG_CLIENT_DIR_API.exists():
|
||
for f in sorted(WG_CLIENT_DIR_API.glob("*.conf")):
|
||
clients.append({"name": f.stem, "file": str(f)})
|
||
return {"clients": clients}
|
||
|
||
@app.post("/api/wireguard/add-client")
|
||
def wg_add_client(body: WGClientRequest):
|
||
require_session(body.token)
|
||
if not WG_CONF_PATH.exists():
|
||
raise HTTPException(503, "WireGuard not configured on this machine")
|
||
|
||
import re, subprocess as _sp, socket
|
||
|
||
# Next available IP
|
||
conf_text = WG_CONF_PATH.read_text()
|
||
used = set()
|
||
for m in re.finditer(r'AllowedIPs\s*=\s*(\S+)', conf_text):
|
||
used.add(m.group(1).split('/')[0])
|
||
|
||
subnet = "10.99.0"
|
||
num = 2
|
||
while f"{subnet}.{num}" in used and num < 254: num += 1
|
||
client_ip = f"{subnet}.{num}"
|
||
|
||
# Server public key
|
||
server_pub_path = _Path("/etc/switch-manager/wg_server_public")
|
||
if not server_pub_path.exists():
|
||
raise HTTPException(503, "Server public key not found")
|
||
server_pub = server_pub_path.read_text().strip()
|
||
|
||
# Client keys
|
||
c_priv, c_pub = _wg_genkey_api()
|
||
|
||
# Peer entry in server config
|
||
peer = f"\n[Peer]\n# {body.name}\nPublicKey = {c_pub}\nAllowedIPs = {client_ip}/32\n"
|
||
with open(WG_CONF_PATH, 'a') as f:
|
||
f.write(peer)
|
||
|
||
# Reload live
|
||
_sp.run(["wg","addconf","wg0","/dev/stdin"],
|
||
input=f"[Peer]\nPublicKey = {c_pub}\nAllowedIPs = {client_ip}/32\n",
|
||
capture_output=True, text=True)
|
||
|
||
# Public IP for endpoint
|
||
try:
|
||
pub_ip = _sp.run(["curl","-s","--max-time","5","https://api.ipify.org"],
|
||
capture_output=True, text=True).stdout.strip()
|
||
except Exception:
|
||
pub_ip = socket.gethostbyname(socket.gethostname())
|
||
|
||
# Get management IP from switch config
|
||
mgmt_subnet = '.'.join(SWITCH_HOST.split('.')[:3]) + '.0/24'
|
||
|
||
client_conf = (
|
||
f"[Interface]\nPrivateKey = {c_priv}\nAddress = {client_ip}/24\n"
|
||
f"DNS = {subnet}.1\n\n"
|
||
f"[Peer]\nPublicKey = {server_pub}\n"
|
||
f"Endpoint = {pub_ip}:51820\n"
|
||
f"AllowedIPs = {mgmt_subnet}, {subnet}.0/24\n"
|
||
f"PersistentKeepalive = 25\n"
|
||
)
|
||
|
||
WG_CLIENT_DIR_API.mkdir(exist_ok=True)
|
||
client_file = WG_CLIENT_DIR_API / f"{body.name}.conf"
|
||
client_file.write_text(client_conf)
|
||
client_file.chmod(0o600)
|
||
|
||
log.info(f"WireGuard client added: {body.name} → {client_ip}")
|
||
return {
|
||
"success": True,
|
||
"name": body.name,
|
||
"client_ip": client_ip,
|
||
"config": client_conf,
|
||
"file": str(client_file),
|
||
}
|
||
|
||
@app.post("/api/wireguard/revoke-client")
|
||
def wg_revoke_client(body: WGRevokeRequest):
|
||
require_session(body.token)
|
||
import re, subprocess as _sp
|
||
|
||
client_file = WG_CLIENT_DIR_API / f"{body.name}.conf"
|
||
if not client_file.exists():
|
||
raise HTTPException(404, f"Client '{body.name}' not found")
|
||
|
||
# Get client public key
|
||
txt = client_file.read_text()
|
||
m = re.search(r'\[Peer\].*?PublicKey\s*=\s*(\S+)', txt, re.DOTALL)
|
||
client_pub = m.group(1) if m else None
|
||
|
||
# Remove from server config
|
||
if WG_CONF_PATH.exists():
|
||
conf = WG_CONF_PATH.read_text()
|
||
# Remove the [Peer] block for this client
|
||
cleaned = re.sub(
|
||
rf'\n\[Peer\]\n# {re.escape(body.name)}\n.*?(?=\n\[Peer\]|\Z)',
|
||
'', conf, flags=re.DOTALL
|
||
)
|
||
WG_CONF_PATH.write_text(cleaned)
|
||
|
||
# Remove live peer
|
||
if client_pub:
|
||
_sp.run(["wg","set","wg0","peer",client_pub,"remove"],
|
||
capture_output=True, text=True)
|
||
|
||
# Delete client file
|
||
client_file.unlink()
|
||
log.info(f"WireGuard client revoked: {body.name}")
|
||
return {"success": True}
|
||
|
||
@app.get("/api/wireguard/client-qr/{name}")
|
||
def wg_client_qr(name: str):
|
||
"""Return client config as text for QR generation in frontend."""
|
||
client_file = WG_CLIENT_DIR_API / f"{name}.conf"
|
||
if not client_file.exists():
|
||
raise HTTPException(404, f"Client '{name}' not found")
|
||
return {"name": name, "config": client_file.read_text()}
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# DHCP MANAGEMENT — SWITCH + OPNSENSE UNIFIED VIEW
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
import urllib.request as _urlreq
|
||
import urllib.error as _urlerr
|
||
import ssl as _ssl
|
||
import base64 as _b64
|
||
|
||
OPNSENSE_FILE = _Path("/etc/switch-manager/opnsense.json")
|
||
VLAN_IF_MAP_FILE = _Path("/etc/switch-manager/vlan-if-map.json")
|
||
PINHOLE_FILE = _Path("/etc/switch-manager/pinholes.json")
|
||
|
||
def _load_vlan_if_map() -> dict:
|
||
"""Return {vlan_id_str: opnsense_if_name} e.g. {"20": "opt2"}."""
|
||
if VLAN_IF_MAP_FILE.exists():
|
||
try: return _json.loads(VLAN_IF_MAP_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_vlan_if_map(m: dict):
|
||
VLAN_IF_MAP_FILE.write_text(_json.dumps(m, indent=2))
|
||
|
||
def _load_pinholes() -> dict:
|
||
"""Return {mac: rule_uuid} for OPNsense firewall pinholes."""
|
||
if PINHOLE_FILE.exists():
|
||
try: return _json.loads(PINHOLE_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_pinholes(m: dict):
|
||
PINHOLE_FILE.write_text(_json.dumps(m, indent=2))
|
||
PINHOLE_FILE.chmod(0o600)
|
||
|
||
def _load_opnsense_cfg() -> dict:
|
||
"""Load saved OPNsense API credentials from opnsense.json, returning {} if absent."""
|
||
if OPNSENSE_FILE.exists():
|
||
try: return _json.loads(OPNSENSE_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_opnsense_cfg(cfg: dict):
|
||
"""Persist OPNsense API credentials to opnsense.json (chmod 600 — contains secrets)."""
|
||
OPNSENSE_FILE.write_text(_json.dumps(cfg, indent=2))
|
||
OPNSENSE_FILE.chmod(0o600)
|
||
|
||
def _opnsense_request(cfg: dict, path: str, method="GET", body=None) -> dict:
|
||
"""Make an authenticated request to the OPNsense API."""
|
||
host = cfg.get("host","")
|
||
key = cfg.get("key","")
|
||
secret = cfg.get("secret","")
|
||
if not host or not key or not secret:
|
||
raise ValueError("OPNsense not configured")
|
||
url = f"https://{host}/api/{path}"
|
||
creds = _b64.b64encode(f"{key}:{secret}".encode()).decode()
|
||
ctx = _ssl.create_default_context()
|
||
ctx.check_hostname = False
|
||
ctx.verify_mode = _ssl.CERT_NONE
|
||
headers = {
|
||
"Authorization": f"Basic {creds}",
|
||
"Content-Type": "application/json",
|
||
}
|
||
data = _json.dumps(body).encode() if body else None
|
||
req = _urlreq.Request(url, data=data, headers=headers, method=method)
|
||
try:
|
||
with _urlreq.urlopen(req, timeout=5, context=ctx) as r:
|
||
return _json.loads(r.read().decode())
|
||
except _urlerr.HTTPError as e:
|
||
raise ValueError(f"OPNsense API error {e.code}: {e.reason}")
|
||
except Exception as e:
|
||
raise ValueError(f"OPNsense unreachable: {e}")
|
||
|
||
def _detect_opnsense_host(gateway_ip: str) -> str | None:
|
||
"""Try to reach OPNsense API at the gateway IP."""
|
||
try:
|
||
ctx = _ssl.create_default_context()
|
||
ctx.check_hostname = False
|
||
ctx.verify_mode = _ssl.CERT_NONE
|
||
url = f"https://{gateway_ip}/api/core/firmware/status"
|
||
req = _urlreq.Request(url, headers={"User-Agent":"switch-manager/1"})
|
||
_urlreq.urlopen(req, timeout=3, context=ctx)
|
||
return gateway_ip
|
||
except Exception:
|
||
return None
|
||
|
||
OPNSENSE_KNOWN_HOSTS = _Path("/etc/switch-manager/opnsense_known_hosts")
|
||
OPNSENSE_SSH_KEY = _Path("/etc/switch-manager/opnsense_key")
|
||
UNBOUND_ETC = "/var/unbound/etc"
|
||
|
||
def _opnsense_ssh_run(cfg: dict, cmd: str, timeout: int = 30) -> tuple:
|
||
"""Run a shell command on OPNsense via SSH. Returns (stdout, stderr, exit_code).
|
||
|
||
Uses exec_command() which bypasses the OPNsense console menu — the menu
|
||
only appears for interactive login sessions, not for exec_command calls.
|
||
"""
|
||
host = cfg.get("host", "")
|
||
ssh_user = cfg.get("ssh_user", "root")
|
||
key_path = cfg.get("ssh_key_path", "")
|
||
if not host or not key_path:
|
||
raise ValueError("OPNsense SSH not configured — set host and ssh_key_path")
|
||
client = paramiko.SSHClient()
|
||
if OPNSENSE_KNOWN_HOSTS.exists():
|
||
client.load_host_keys(str(OPNSENSE_KNOWN_HOSTS))
|
||
else:
|
||
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||
try:
|
||
client.connect(
|
||
hostname=host,
|
||
username=ssh_user,
|
||
key_filename=key_path,
|
||
timeout=10,
|
||
look_for_keys=False,
|
||
allow_agent=False,
|
||
)
|
||
_, stdout, stderr = client.exec_command(cmd, timeout=timeout)
|
||
exit_code = stdout.channel.recv_exit_status()
|
||
return stdout.read().decode(), stderr.read().decode(), exit_code
|
||
finally:
|
||
client.close()
|
||
|
||
def _opnsense_sftp_write(cfg: dict, remote_path: str, content: str):
|
||
"""Write a file on OPNsense via SFTP (avoids shell quoting issues)."""
|
||
host = cfg.get("host", "")
|
||
ssh_user = cfg.get("ssh_user", "root")
|
||
key_path = cfg.get("ssh_key_path", "")
|
||
if not host or not key_path:
|
||
raise ValueError("OPNsense SSH not configured")
|
||
client = paramiko.SSHClient()
|
||
if OPNSENSE_KNOWN_HOSTS.exists():
|
||
client.load_host_keys(str(OPNSENSE_KNOWN_HOSTS))
|
||
else:
|
||
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||
try:
|
||
client.connect(
|
||
hostname=host,
|
||
username=ssh_user,
|
||
key_filename=key_path,
|
||
timeout=10,
|
||
look_for_keys=False,
|
||
allow_agent=False,
|
||
)
|
||
sftp = client.open_sftp()
|
||
with sftp.open(remote_path, "w") as f:
|
||
f.write(content)
|
||
sftp.close()
|
||
finally:
|
||
client.close()
|
||
|
||
def _opnsense_ssh_test(cfg: dict) -> dict:
|
||
"""Test SSH connectivity to OPNsense. Returns {ok, version, error}."""
|
||
try:
|
||
out, err, code = _opnsense_ssh_run(cfg, "uname -sr")
|
||
return {"ok": code == 0, "version": out.strip(), "error": err.strip() if code != 0 else ""}
|
||
except Exception as e:
|
||
return {"ok": False, "version": "", "error": str(e)}
|
||
|
||
def _get_opnsense_reservations(cfg: dict) -> list:
|
||
"""Fetch DHCP static mappings from OPNsense."""
|
||
try:
|
||
data = _opnsense_request(cfg, "dhcpv4/leases/searchReservation")
|
||
rows = data.get("rows", [])
|
||
return [
|
||
{
|
||
"ip": r.get("ipaddr",""),
|
||
"mac": r.get("mac","").lower(),
|
||
"hostname": r.get("hostname",""),
|
||
"descr": r.get("descr",""),
|
||
"if": r.get("if",""),
|
||
"source": "opnsense",
|
||
"uuid": r.get("uuid",""),
|
||
}
|
||
for r in rows if r.get("mac")
|
||
]
|
||
except Exception as e:
|
||
log.warning(f"OPNsense reservations fetch failed: {e}")
|
||
return []
|
||
|
||
def _get_opnsense_leases(cfg: dict) -> list:
|
||
"""Fetch active DHCP leases from OPNsense."""
|
||
try:
|
||
data = _opnsense_request(cfg, "dhcpv4/leases/searchLease")
|
||
rows = data.get("rows", [])
|
||
return [
|
||
{
|
||
"ip": r.get("address",""),
|
||
"mac": r.get("mac","").lower(),
|
||
"hostname": r.get("hostname",""),
|
||
"state": r.get("state",""),
|
||
"if": r.get("if",""),
|
||
"source": "opnsense_lease",
|
||
}
|
||
for r in rows if r.get("mac")
|
||
]
|
||
except Exception as e:
|
||
log.warning(f"OPNsense leases fetch failed: {e}")
|
||
return []
|
||
|
||
def _get_switch_reservations() -> list:
|
||
"""Fetch DHCP static bindings from ERS 59100GTS-PWR+.
|
||
|
||
Requires ip dhcp-server to be enabled on the switch.
|
||
Returns empty list if DHCP server is not enabled/licensed.
|
||
"""
|
||
import re as _re
|
||
try:
|
||
raw = read_cmd("show ip dhcp-server static-binding")
|
||
bindings = []
|
||
current = {}
|
||
for line in raw.splitlines():
|
||
m = _re.match(r'\s*IP Address:\s*(\S+)', line)
|
||
if m:
|
||
if current: bindings.append(current)
|
||
current = {"ip": m.group(1), "mac":"", "hostname":"", "source":"switch"}
|
||
m2 = _re.match(r'\s*MAC Address:\s*(\S+)', line)
|
||
if m2 and current:
|
||
current["mac"] = m2.group(1).lower().replace('-',':')
|
||
m3 = _re.match(r'\s*Client Name:\s*(\S+)', line)
|
||
if m3 and current:
|
||
current["hostname"] = m3.group(1)
|
||
if current and current.get("ip"):
|
||
bindings.append(current)
|
||
return bindings
|
||
except Exception as e:
|
||
log.warning(f"Switch DHCP reservation fetch failed: {e}")
|
||
return []
|
||
|
||
def _get_switch_dhcp_status() -> dict:
|
||
"""Check if switch DHCP server is running and which VLANs it serves.
|
||
|
||
Requires ip dhcp-server to be enabled on the switch.
|
||
"""
|
||
import re as _re
|
||
try:
|
||
raw = read_cmd("show ip dhcp-server")
|
||
running = "enabled" in raw.lower() or "active" in raw.lower()
|
||
vlans = _re.findall(r'VLAN\s+(\d+)', raw, _re.I)
|
||
return {"running": running, "vlans": list(set(vlans))}
|
||
except Exception:
|
||
return {"running": False, "vlans": []}
|
||
|
||
def _find_conflicts(switch_res: list, opnsense_res: list) -> list:
|
||
"""
|
||
Find same MAC in both switch and OPNsense.
|
||
Flag if IPs differ (conflict) or same (duplicate — harmless but messy).
|
||
"""
|
||
switch_by_mac = {r["mac"]: r for r in switch_res if r.get("mac")}
|
||
conflicts = []
|
||
for r in opnsense_res:
|
||
mac = r.get("mac","")
|
||
if mac and mac in switch_by_mac:
|
||
sw = switch_by_mac[mac]
|
||
conflicts.append({
|
||
"mac": mac,
|
||
"hostname": r.get("hostname") or sw.get("hostname",""),
|
||
"switch_ip": sw["ip"],
|
||
"opnsense_ip": r["ip"],
|
||
"ip_conflict": sw["ip"] != r["ip"],
|
||
"opnsense_uuid": r.get("uuid",""),
|
||
})
|
||
return conflicts
|
||
|
||
# ── OPNsense config models ─────────────────────────────────────────────────
|
||
|
||
class OPNsenseConfig(BaseModel):
|
||
host: str
|
||
key: str
|
||
secret: str
|
||
|
||
class OPNsenseSSHConfig(BaseModel):
|
||
ssh_key_path: str
|
||
ssh_user: str = "root"
|
||
pin_host_key: bool = True
|
||
|
||
class OPNsenseReservationPush(BaseModel):
|
||
token: str
|
||
mac: str
|
||
ip: str
|
||
hostname: str
|
||
descr: Optional[str] = ""
|
||
iface: Optional[str] = "lan"
|
||
|
||
class SyncRequest(BaseModel):
|
||
token: str
|
||
mac: str
|
||
direction: str # "to_switch" | "to_opnsense" | "remove_switch" | "remove_opnsense"
|
||
|
||
|
||
# ── DHCP endpoints ─────────────────────────────────────────────────────────
|
||
|
||
@app.get("/api/dhcp/overview")
|
||
def dhcp_overview():
|
||
"""
|
||
Unified DHCP view:
|
||
- Switch static bindings + active leases
|
||
- OPNsense reservations + leases (if configured)
|
||
- Conflicts (same MAC, different IP)
|
||
- Which DHCP server is active per VLAN
|
||
"""
|
||
switch_res = _get_switch_reservations()
|
||
switch_leases = []
|
||
switch_status = _get_switch_dhcp_status()
|
||
|
||
# Discover devices via DHCP leases + ARP
|
||
try:
|
||
arp_raw = read_cmd("show arp")
|
||
switch_leases = _parse_arp_table(arp_raw)
|
||
try:
|
||
dhcp_raw = read_cmd("show ip dhcp-server leases")
|
||
dhcp_leases = _parse_dhcp_leases(dhcp_raw)
|
||
lease_ips = {l["ip"] for l in dhcp_leases}
|
||
# Merge ARP entries not already in leases
|
||
switch_leases = dhcp_leases + [e for e in switch_leases if e["ip"] not in lease_ips]
|
||
except Exception:
|
||
pass # DHCP server may not be enabled
|
||
except Exception as e:
|
||
log.warning(f"Switch ARP fetch failed: {e}")
|
||
|
||
cfg = _load_opnsense_cfg()
|
||
opnsense_res = _get_opnsense_reservations(cfg) if cfg.get("key") else []
|
||
opnsense_leases = _get_opnsense_leases(cfg) if cfg.get("key") else []
|
||
conflicts = _find_conflicts(switch_res, opnsense_res)
|
||
|
||
opnsense_ifaces = list({r.get("if","") for r in opnsense_res + opnsense_leases if r.get("if")})
|
||
|
||
return {
|
||
"switch": {
|
||
"status": switch_status,
|
||
"reservations": switch_res,
|
||
"leases": switch_leases,
|
||
},
|
||
"opnsense": {
|
||
"configured": bool(cfg.get("key")),
|
||
"host": cfg.get("host",""),
|
||
"reservations": opnsense_res,
|
||
"leases": opnsense_leases,
|
||
"interfaces": opnsense_ifaces,
|
||
},
|
||
"conflicts": conflicts,
|
||
"has_conflicts": len(conflicts) > 0,
|
||
}
|
||
|
||
@app.get("/api/dhcp/detect-opnsense")
|
||
def detect_opnsense_endpoint():
|
||
"""Auto-detect OPNsense at the gateway IP."""
|
||
import re as _re
|
||
try:
|
||
route = read_cmd("show ip route")
|
||
# Look for default route: DST=0.0.0.0, MASK=0.0.0.0 — NEXT column is gateway
|
||
m = _re.search(r'^0\.0\.0\.0\s+0\.0\.0\.0\s+(\d+\.\d+\.\d+\.\d+)', route, _re.MULTILINE)
|
||
gateway = m.group(1) if m else None
|
||
except Exception:
|
||
gateway = None
|
||
|
||
if not gateway:
|
||
# Try from switch management IP
|
||
parts = SWITCH_HOST.split('.')
|
||
parts[-1] = '1'
|
||
gateway = '.'.join(parts)
|
||
|
||
host = _detect_opnsense_host(gateway)
|
||
return {
|
||
"detected": host is not None,
|
||
"host": host,
|
||
"gateway": gateway,
|
||
"configured": bool(_load_opnsense_cfg().get("key")),
|
||
}
|
||
|
||
@app.post("/api/dhcp/configure-opnsense")
|
||
def configure_opnsense(body: OPNsenseConfig):
|
||
"""Save OPNsense API credentials. Tests connectivity first."""
|
||
cfg = {"host": body.host, "key": body.key, "secret": body.secret}
|
||
try:
|
||
result = _opnsense_request(cfg, "core/firmware/status")
|
||
_save_opnsense_cfg(cfg)
|
||
log.info(f"OPNsense configured: {body.host}")
|
||
return {"success": True, "version": result.get("product_version","unknown")}
|
||
except ValueError as e:
|
||
raise HTTPException(400, str(e))
|
||
|
||
@app.delete("/api/dhcp/configure-opnsense")
|
||
def remove_opnsense_config():
|
||
"""Remove OPNsense API credentials."""
|
||
if OPNSENSE_FILE.exists():
|
||
OPNSENSE_FILE.unlink()
|
||
return {"success": True}
|
||
|
||
@app.post("/api/dhcp/push-to-opnsense")
|
||
def push_reservation_to_opnsense(body: OPNsenseReservationPush):
|
||
"""Create a DHCP static mapping in OPNsense."""
|
||
require_session(body.token)
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("key"):
|
||
raise HTTPException(503, "OPNsense not configured")
|
||
try:
|
||
result = _opnsense_request(cfg, "dhcpv4/reservations/addReservation", "POST", {
|
||
"reservation": {
|
||
"interface": body.iface,
|
||
"mac": body.mac,
|
||
"ipaddr": body.ip,
|
||
"hostname": body.hostname,
|
||
"descr": body.descr or f"Added by switch-manager",
|
||
}
|
||
})
|
||
# Apply changes
|
||
_opnsense_request(cfg, "dhcpv4/service/reconfigure", "POST")
|
||
log.info(f"OPNsense reservation pushed: {body.mac} → {body.ip}")
|
||
return {"success": True, "result": result}
|
||
except ValueError as e:
|
||
raise HTTPException(400, str(e))
|
||
|
||
@app.post("/api/dhcp/sync")
|
||
def sync_reservation(body: SyncRequest):
|
||
"""
|
||
Sync a reservation between switch and OPNsense.
|
||
Directions:
|
||
to_switch — copy OPNsense reservation to switch
|
||
to_opnsense — copy switch reservation to OPNsense
|
||
remove_switch — remove from switch only
|
||
remove_opnsense — remove from OPNsense only
|
||
"""
|
||
require_session(body.token)
|
||
cfg = _load_opnsense_cfg()
|
||
overview = dhcp_overview()
|
||
|
||
# Find the device in both sources
|
||
sw_res = next((r for r in overview["switch"]["reservations"] if r["mac"]==body.mac), None)
|
||
ops_res = next((r for r in overview["opnsense"]["reservations"] if r["mac"]==body.mac), None)
|
||
|
||
if body.direction == "to_switch":
|
||
if not ops_res:
|
||
raise HTTPException(404, "OPNsense reservation not found")
|
||
cmds = _build_dhcp_reservation_cmds(type('D',(),{
|
||
"ip": ops_res["ip"], "mac": ops_res["mac"], "name": ops_res.get("hostname","")
|
||
})())
|
||
return push_one_by_one(cmds)
|
||
|
||
elif body.direction == "to_opnsense":
|
||
if not sw_res:
|
||
raise HTTPException(404, "Switch reservation not found")
|
||
if not cfg.get("key"):
|
||
raise HTTPException(503, "OPNsense not configured")
|
||
result = _opnsense_request(cfg, "dhcpv4/reservations/addReservation", "POST", {
|
||
"reservation": {
|
||
"mac": sw_res["mac"], "ipaddr": sw_res["ip"],
|
||
"hostname": sw_res.get("hostname",""), "descr": "Synced from switch",
|
||
"interface": "lan",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "dhcpv4/service/reconfigure", "POST")
|
||
return {"success": True, "result": result}
|
||
|
||
elif body.direction == "remove_switch":
|
||
if not sw_res:
|
||
raise HTTPException(404, "Switch reservation not found")
|
||
return push_one_by_one([f"no ip dhcp-server static-binding {sw_res['ip']}"])
|
||
|
||
elif body.direction == "remove_opnsense":
|
||
if not ops_res or not ops_res.get("uuid"):
|
||
raise HTTPException(404, "OPNsense reservation not found or missing UUID")
|
||
if not cfg.get("key"):
|
||
raise HTTPException(503, "OPNsense not configured")
|
||
_opnsense_request(cfg, f"dhcpv4/reservations/delReservation/{ops_res['uuid']}", "DELETE")
|
||
_opnsense_request(cfg, "dhcpv4/service/reconfigure", "POST")
|
||
return {"success": True}
|
||
|
||
raise HTTPException(400, f"Unknown direction: {body.direction}")
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# CONTROL D / ctrld DNS MANAGEMENT
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
CTRLD_FILE = _Path("/etc/switch-manager/ctrld.json")
|
||
# NOTE: /usr/local/bin/ctrld is the Linux default path.
|
||
# On OPNsense (FreeBSD) ctrld installs to /usr/local/sbin/ctrld.
|
||
# For local-mode installs this path is checked at runtime, so it's fine.
|
||
# For OPNsense mode the binary runs on the router, not here — the path is irrelevant.
|
||
CTRLD_BIN = _Path("/usr/local/bin/ctrld")
|
||
|
||
def _load_ctrld_cfg() -> dict:
|
||
"""Load saved ctrld configuration (mode, vlan_profiles) from ctrld.json."""
|
||
if CTRLD_FILE.exists():
|
||
try: return _json.loads(CTRLD_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_ctrld_cfg(cfg: dict):
|
||
"""Persist ctrld configuration to ctrld.json (chmod 600 — contains Resolver IDs)."""
|
||
CTRLD_FILE.write_text(_json.dumps(cfg, indent=2))
|
||
CTRLD_FILE.chmod(0o600)
|
||
|
||
def _ctrld_status() -> dict:
|
||
"""Check if ctrld is running and which mode."""
|
||
import subprocess as _sp
|
||
try:
|
||
r = _sp.run([str(CTRLD_BIN), "status"],
|
||
capture_output=True, text=True, timeout=5)
|
||
running = r.returncode == 0
|
||
return {
|
||
"installed": CTRLD_BIN.exists(),
|
||
"running": running,
|
||
"output": r.stdout.strip() or r.stderr.strip(),
|
||
}
|
||
except Exception as e:
|
||
return {
|
||
"installed": CTRLD_BIN.exists(),
|
||
"running": False,
|
||
"output": str(e),
|
||
}
|
||
|
||
def _ctrld_config_path() -> _Path:
|
||
"""Find ctrld config file location."""
|
||
candidates = [
|
||
_Path("/etc/controld/ctrld.toml"),
|
||
_Path("/usr/local/etc/controld/ctrld.toml"),
|
||
_Path.home() / ".config" / "controld" / "ctrld.toml",
|
||
]
|
||
for p in candidates:
|
||
if p.exists(): return p
|
||
return candidates[0] # default for new install
|
||
|
||
def _build_ctrld_toml(vlan_profiles: list, ctrld_port: int = 5354,
|
||
deploy_mode: str = "router") -> str:
|
||
"""
|
||
Build a ctrld.toml using flat dotted-key section headers.
|
||
|
||
Confirmed working architecture on OPNsense (verified after reboot):
|
||
Clients → Unbound (:53) → [Query Forwarding] → ctrld (127.0.0.1:5354) → ControlD
|
||
|
||
Unbound stays on port 53 — never moved. ctrld binds to localhost only
|
||
on port 5354 so it cannot conflict with Unbound at startup. Unbound's
|
||
Query Forwarding sends all external queries through ctrld. Local DNS
|
||
(host overrides, local zones) is handled entirely by Unbound before any
|
||
query reaches ctrld, so no split-horizon rules are needed here.
|
||
|
||
deploy_mode="router" — single listener on 127.0.0.1:ctrld_port.
|
||
Unbound forwards upstream queries here via Query Forwarding.
|
||
Per-VLAN policy differentiation is handled by Unbound (forward different
|
||
domains to different ctrld instances on different ports if needed).
|
||
|
||
deploy_mode="proxy" — single listener on 0.0.0.0:ctrld_port.
|
||
Use when ctrld runs on a management host (not the router) and clients
|
||
point directly at ctrld — CIDR-based policy routing applies.
|
||
|
||
Flat header rule: never write a parent [listener] / [network] / [upstream]
|
||
before the dotted subtables — Go's TOML v2 panics on table redefinition.
|
||
"""
|
||
BOOTSTRAP = "76.76.2.0"
|
||
|
||
active = [vp for vp in vlan_profiles
|
||
if vp.get("resolver_id", "").strip() or vp.get("endpoint_url", "").strip()]
|
||
|
||
lines = [
|
||
"# ctrld configuration — generated by Avaya 59100GTS-PWR+ Switch Manager",
|
||
"# Architecture: Unbound (:53) → Query Forwarding → ctrld (127.0.0.1:{}) → ControlD".format(ctrld_port),
|
||
"# Docs: https://docs.controld.com/docs/ctrld",
|
||
"",
|
||
"[service]",
|
||
" log_level = \'info\'",
|
||
" log_path = \'/tmp/ctrld.log\'",
|
||
"",
|
||
]
|
||
|
||
# ── Upstream sections ─────────────────────────────────────────────────────
|
||
for i, vp in enumerate(active):
|
||
vid = vp["vlan_id"]
|
||
name = vp.get("name", f"VLAN{vid}")
|
||
protocol = (vp.get("protocol") or "doh3").strip()
|
||
rid = vp.get("resolver_id", "").strip()
|
||
endpoint = (
|
||
vp.get("endpoint_url", "").strip()
|
||
or f"https://dns.controld.com/{rid}"
|
||
)
|
||
lines += [
|
||
f"# VLAN {vid} — {name}",
|
||
f"[upstream.{i}]",
|
||
f" name = \'VLAN {vid} {name}\'",
|
||
f" type = \'{protocol}\'",
|
||
f" endpoint = \'{endpoint}\'",
|
||
f" bootstrap_ip = \'{BOOTSTRAP}\'",
|
||
f" timeout = 5000",
|
||
"",
|
||
]
|
||
|
||
# ── ROUTER MODE: localhost listener, Unbound forwards here ───────────────
|
||
if deploy_mode == "router":
|
||
# Single listener on localhost — Unbound's Query Forwarding points here.
|
||
# No per-VLAN listeners needed: Unbound handles all local resolution
|
||
# before queries arrive; ctrld just proxies external queries upstream.
|
||
lines += [
|
||
"# Listens on localhost only — Unbound Query Forwarding sends external queries here",
|
||
"[listener.0]",
|
||
f" ip = \'127.0.0.1\'",
|
||
f" port = {ctrld_port}",
|
||
"",
|
||
" [listener.0.policy]",
|
||
" name = \'Default Policy\'",
|
||
" networks = []",
|
||
" rules = []",
|
||
]
|
||
if active:
|
||
lines[-1] = f" default = [\'upstream.0\']"
|
||
lines.append("")
|
||
|
||
# ── PROXY MODE: 0.0.0.0 listener + CIDR network policies ─────────────────
|
||
else:
|
||
lines += [
|
||
"[listener.0]",
|
||
f" ip = \'0.0.0.0\'",
|
||
f" port = {ctrld_port}",
|
||
"",
|
||
" [listener.0.policy]",
|
||
" name = \'VLAN Policy\'",
|
||
]
|
||
|
||
if active:
|
||
net_entries = [
|
||
" { " + f"\'network.{i}\' = [\'upstream.{i}\']" + " },"
|
||
for i in range(len(active))
|
||
]
|
||
lines += [" networks = ["] + net_entries + [" ]"]
|
||
else:
|
||
lines += [" networks = []"]
|
||
|
||
lines += [" rules = []", ""]
|
||
|
||
# Network sections for CIDR routing
|
||
for i, vp in enumerate(active):
|
||
vid = vp["vlan_id"]
|
||
name = vp.get("name", f"VLAN{vid}")
|
||
subnet = vp.get("subnet", f"192.168.{vid}.0/24")
|
||
lines += [
|
||
f"# VLAN {vid} — {name}",
|
||
f"[network.{i}]",
|
||
f" name = \'{name}\'",
|
||
f" cidrs = [\'{subnet}\']",
|
||
"",
|
||
]
|
||
|
||
return "\n".join(lines)
|
||
|
||
|
||
|
||
# ── ctrld API models ─────────────────────────────────────────────────────────
|
||
|
||
class CtrldVlanProfile(BaseModel):
|
||
vlan_id: int
|
||
name: str
|
||
subnet: str
|
||
resolver_id: str # ControlD Resolver ID (path suffix)
|
||
endpoint_url: Optional[str] = "" # full URL — overrides resolver_id if set
|
||
protocol: Optional[str] = "doh3" # doh3 | doh | dot | doq | legacy
|
||
gateway: Optional[str] = "" # VLAN gateway IP on the router (e.g. "192.168.10.1")
|
||
# Required for router-mode multi-listener TOML
|
||
|
||
class CtrldConfig(BaseModel):
|
||
mode: str # "local" | "opnsense" | "manual"
|
||
deploy_mode: Optional[str] = "router" # "router" (OPNsense, localhost) | "proxy" (management host, 0.0.0.0)
|
||
vlan_profiles: list[CtrldVlanProfile]
|
||
opnsense_host: Optional[str] = ""
|
||
ctrld_port: Optional[int] = 5354 # port ctrld listens on (Unbound Query Forwarding points here)
|
||
local_domain: Optional[str] = "lan" # local domain handled by Unbound (not forwarded to ctrld)
|
||
|
||
class CtrldInstallRequest(BaseModel):
|
||
token: str
|
||
config: CtrldConfig
|
||
|
||
class CtrldUpdateProfile(BaseModel):
|
||
token: str
|
||
vlan_profiles: list[CtrldVlanProfile]
|
||
|
||
# ── ctrld endpoints ───────────────────────────────────────────────────────────
|
||
|
||
@app.get("/api/ctrld/status")
|
||
def ctrld_status():
|
||
"""Return ctrld installation and running status."""
|
||
cfg = _load_ctrld_cfg()
|
||
status = _ctrld_status()
|
||
return {
|
||
**status,
|
||
"configured": bool(cfg.get("mode")),
|
||
"mode": cfg.get("mode",""),
|
||
"vlan_profiles": cfg.get("vlan_profiles",[]),
|
||
"opnsense_host": cfg.get("opnsense_host",""),
|
||
"config_path": str(_ctrld_config_path()),
|
||
"docs_url": "https://docs.controld.com/docs/ctrld",
|
||
}
|
||
|
||
def _validate_doh_endpoint(endpoint_url: str) -> dict:
|
||
"""
|
||
Test a DoH endpoint using a plain HTTPS GET query (RFC 8484).
|
||
|
||
Works for both DoH and DoH3 endpoints — ControlD and most public resolvers
|
||
serve DoH over HTTPS/2 at the same URL they use for DoH3, so a successful
|
||
HTTP response proves the URL is live and well-formed before ctrld ever
|
||
touches it.
|
||
|
||
Sends: GET {url}?dns=<base64url(A? ping.controld.com)>
|
||
Expects: 200, Content-Type: application/dns-message
|
||
|
||
Returns: {ok, latency_ms, status_code, error}
|
||
"""
|
||
import struct, base64, time, urllib.request, urllib.error
|
||
|
||
# Build a minimal DNS A query for "ping.controld.com" in wire format
|
||
def _make_query(domain: str = "ping.controld.com") -> bytes:
|
||
hdr = struct.pack(">HHHHHH", 0x1234, 0x0100, 1, 0, 0, 0)
|
||
qname = b""
|
||
for label in domain.rstrip(".").split("."):
|
||
qname += bytes([len(label)]) + label.encode()
|
||
qname += b"\x00"
|
||
qtype = struct.pack(">HH", 1, 1) # A IN
|
||
return hdr + qname + qtype
|
||
|
||
dns_bytes = _make_query()
|
||
dns_b64 = base64.urlsafe_b64encode(dns_bytes).rstrip(b"=").decode()
|
||
test_url = f"{endpoint_url.rstrip('/')}?dns={dns_b64}"
|
||
t0 = time.monotonic()
|
||
|
||
try:
|
||
req = urllib.request.Request(
|
||
test_url,
|
||
headers={"Accept": "application/dns-message"},
|
||
)
|
||
with urllib.request.urlopen(req, timeout=8) as resp:
|
||
latency_ms = int((time.monotonic() - t0) * 1000)
|
||
ct = resp.headers.get("Content-Type", "")
|
||
body = resp.read(12) # just enough to check it's a DNS response
|
||
ok = resp.status == 200 and "dns-message" in ct
|
||
return {
|
||
"ok": ok,
|
||
"latency_ms": latency_ms,
|
||
"status_code": resp.status,
|
||
"error": "" if ok else f"Unexpected Content-Type: {ct}",
|
||
}
|
||
except urllib.error.HTTPError as e:
|
||
latency_ms = int((time.monotonic() - t0) * 1000)
|
||
return {"ok": False, "latency_ms": latency_ms,
|
||
"status_code": e.code, "error": str(e)}
|
||
except Exception as e:
|
||
latency_ms = int((time.monotonic() - t0) * 1000)
|
||
return {"ok": False, "latency_ms": latency_ms,
|
||
"status_code": 0, "error": str(e)}
|
||
|
||
|
||
class CtrldValidateRequest(BaseModel):
|
||
vlan_profiles: list[CtrldVlanProfile]
|
||
|
||
|
||
@app.post("/api/ctrld/validate-endpoints")
|
||
def ctrld_validate_endpoints(body: CtrldValidateRequest):
|
||
"""
|
||
Test each profile's DoH/DoH3 endpoint URL before writing any config.
|
||
Returns per-profile results plus an overall ok flag.
|
||
Intended to be called from the UI before calling save-config.
|
||
"""
|
||
results = []
|
||
for vp in body.vlan_profiles:
|
||
p = vp.dict()
|
||
url = (p.get("endpoint_url") or "").strip()
|
||
rid = (p.get("resolver_id") or "").strip()
|
||
if not url and rid:
|
||
url = f"https://dns.controld.com/{rid}"
|
||
if not url:
|
||
results.append({
|
||
"vlan_id": p["vlan_id"],
|
||
"name": p.get("name", ""),
|
||
"ok": False,
|
||
"error": "No endpoint URL or resolver_id provided",
|
||
})
|
||
continue
|
||
probe = _validate_doh_endpoint(url)
|
||
results.append({
|
||
"vlan_id": p["vlan_id"],
|
||
"name": p.get("name", ""),
|
||
"url": url,
|
||
**probe,
|
||
})
|
||
|
||
# Also validate the generated TOML can be parsed (catches structural issues)
|
||
toml_ok = True
|
||
toml_error = ""
|
||
try:
|
||
import sys
|
||
if sys.version_info >= (3, 11):
|
||
import tomllib
|
||
tomllib.loads(_build_ctrld_toml([p.dict() for p in body.vlan_profiles]))
|
||
# tomllib not available in 3.10 — skip structural check
|
||
except Exception as e:
|
||
toml_ok = False
|
||
toml_error = str(e)
|
||
|
||
return {
|
||
"all_ok": all(r["ok"] for r in results) and toml_ok,
|
||
"results": results,
|
||
"toml_ok": toml_ok,
|
||
"toml_error": toml_error,
|
||
"toml_preview": _build_ctrld_toml([p.dict() for p in body.vlan_profiles]),
|
||
}
|
||
|
||
|
||
@app.get("/api/ctrld/toml-preview")
|
||
def ctrld_toml_preview():
|
||
"""Generate and return the ctrld.toml without installing it."""
|
||
cfg = _load_ctrld_cfg()
|
||
profiles = cfg.get("vlan_profiles", [])
|
||
deploy_mode = cfg.get("deploy_mode", "router")
|
||
ctrld_port = cfg.get("ctrld_port", 5354)
|
||
if not profiles:
|
||
raise HTTPException(400, "No VLAN profiles configured yet")
|
||
toml = _build_ctrld_toml(profiles, ctrld_port=ctrld_port, deploy_mode=deploy_mode)
|
||
return {"toml": toml, "deploy_mode": deploy_mode, "ctrld_port": ctrld_port}
|
||
|
||
@app.post("/api/ctrld/save-config")
|
||
def ctrld_save_config(body: CtrldInstallRequest):
|
||
"""
|
||
Save ctrld configuration.
|
||
Validates all endpoints before writing anything — returns 400 with per-profile
|
||
probe results if any endpoint is unreachable so the user can fix it first.
|
||
For 'local' mode: installs ctrld on this machine, writes config, starts service.
|
||
For 'opnsense' mode: generates the SSH install command.
|
||
For 'manual' mode: saves config for reference, generates toml only.
|
||
"""
|
||
require_session(body.token)
|
||
|
||
profiles = [p.dict() for p in body.config.vlan_profiles]
|
||
|
||
# ── Endpoint validation — block on failure ────────────────────────────────
|
||
validation = ctrld_validate_endpoints(
|
||
CtrldValidateRequest(vlan_profiles=body.config.vlan_profiles)
|
||
)
|
||
if not validation["all_ok"]:
|
||
raise HTTPException(400, {
|
||
"message": "One or more DNS endpoints failed validation — fix before saving",
|
||
"results": validation["results"],
|
||
"toml_error": validation.get("toml_error", ""),
|
||
})
|
||
|
||
deploy_mode = body.config.deploy_mode or "router"
|
||
ctrld_port = body.config.ctrld_port or 5354
|
||
local_domain = body.config.local_domain or "lan"
|
||
cfg_dict = {
|
||
"mode": body.config.mode,
|
||
"deploy_mode": deploy_mode,
|
||
"vlan_profiles": profiles,
|
||
"opnsense_host": body.config.opnsense_host,
|
||
"ctrld_port": ctrld_port,
|
||
"local_domain": local_domain,
|
||
}
|
||
_save_ctrld_cfg(cfg_dict)
|
||
|
||
toml = _build_ctrld_toml(profiles, ctrld_port=ctrld_port, deploy_mode=deploy_mode)
|
||
|
||
if body.config.mode == "local":
|
||
return _ctrld_install_local(toml, profiles)
|
||
elif body.config.mode == "opnsense":
|
||
return _ctrld_generate_opnsense_cmd(
|
||
body.config.opnsense_host, profiles, deploy_mode,
|
||
ctrld_port=ctrld_port, local_domain=local_domain,
|
||
)
|
||
else:
|
||
# Manual — just return the toml and instructions
|
||
return {
|
||
"success": True,
|
||
"mode": "manual",
|
||
"toml": toml,
|
||
"message": "Config saved. Install ctrld manually and use the toml below.",
|
||
"install_cmd": "sh -c 'sh -c \"$(curl -sL https://api.controld.com/dl)\"'",
|
||
"config_path": str(_ctrld_config_path()),
|
||
}
|
||
|
||
def _fix_port53_conflict() -> dict:
|
||
"""
|
||
Detect and fix systemd-resolved holding port 53 (common on Ubuntu/Debian).
|
||
|
||
systemd-resolved's stub listener binds 127.0.0.53:53 and sometimes 0.0.0.0:53,
|
||
which blocks ctrld from binding port 53. The right fix is to disable only the
|
||
stub listener — NOT the service itself (the service still handles /etc/resolv.conf
|
||
and local hostname resolution).
|
||
|
||
Returns a dict with keys: needed (bool), fixed (bool), message (str).
|
||
"""
|
||
import subprocess as _sp
|
||
|
||
# Check if systemd-resolved is running and holding port 53
|
||
try:
|
||
ss_out = _sp.run(
|
||
["ss", "-tlnp", "sport", "=", ":53"],
|
||
capture_output=True, text=True, timeout=5
|
||
).stdout
|
||
if "systemd-resolve" not in ss_out and "resolved" not in ss_out:
|
||
return {"needed": False, "fixed": False,
|
||
"message": "No port 53 conflict detected"}
|
||
except Exception:
|
||
return {"needed": False, "fixed": False,
|
||
"message": "Could not check port 53 status (ss not available)"}
|
||
|
||
log.info("systemd-resolved is holding port 53 — disabling stub listener")
|
||
|
||
resolved_conf = _Path("/etc/systemd/resolved.conf")
|
||
try:
|
||
current = resolved_conf.read_text() if resolved_conf.exists() else ""
|
||
except Exception as e:
|
||
return {"needed": True, "fixed": False,
|
||
"message": f"Cannot read {resolved_conf}: {e}"}
|
||
|
||
# Already fixed?
|
||
if "DNSStubListener=no" in current:
|
||
_sp.run(["systemctl", "restart", "systemd-resolved"], capture_output=True)
|
||
return {"needed": True, "fixed": True,
|
||
"message": "DNSStubListener=no already present — restarted systemd-resolved"}
|
||
|
||
# Add the setting under [Resolve], creating the section if needed
|
||
if "[Resolve]" in current:
|
||
new_conf = current.rstrip() + "\nDNSStubListener=no\n"
|
||
else:
|
||
new_conf = current.rstrip() + "\n[Resolve]\nDNSStubListener=no\n"
|
||
|
||
try:
|
||
resolved_conf.write_text(new_conf)
|
||
except PermissionError:
|
||
return {"needed": True, "fixed": False,
|
||
"message": "Permission denied writing /etc/systemd/resolved.conf — run backend as root or with sudo"}
|
||
|
||
restart = _sp.run(["systemctl", "restart", "systemd-resolved"],
|
||
capture_output=True, text=True)
|
||
if restart.returncode != 0:
|
||
return {"needed": True, "fixed": False,
|
||
"message": f"Added DNSStubListener=no but systemd-resolved restart failed: {restart.stderr}"}
|
||
|
||
log.info("Port 53 conflict resolved — systemd-resolved stub listener disabled")
|
||
return {"needed": True, "fixed": True,
|
||
"message": "Disabled systemd-resolved stub listener (DNSStubListener=no) and restarted service"}
|
||
|
||
|
||
def _ctrld_install_local(toml: str, profiles: list) -> dict:
|
||
"""Download and install ctrld on this machine, write config, start service."""
|
||
import subprocess as _sp, platform as _platform
|
||
|
||
# Detect architecture
|
||
arch = _platform.machine().lower()
|
||
os_name = _platform.system().lower()
|
||
|
||
if os_name != "linux":
|
||
return {
|
||
"success": False,
|
||
"mode": "local",
|
||
"message": f"Auto-install only supported on Linux. "
|
||
f"Download ctrld from https://github.com/Control-D-Inc/ctrld/releases",
|
||
"toml": toml,
|
||
}
|
||
|
||
# Use ctrld's own installer with the first profile's resolver ID
|
||
first_rid = next((p["resolver_id"] for p in profiles if p.get("resolver_id")), None)
|
||
if not first_rid:
|
||
return {"success": False, "message": "No Resolver ID provided"}
|
||
|
||
# Fix port 53 conflict BEFORE installing ctrld — on Ubuntu/Debian, systemd-resolved
|
||
# holds port 53 and ctrld cannot bind. Disabling the stub listener is safe:
|
||
# systemd-resolved keeps running for /etc/resolv.conf management.
|
||
port53_fix = _fix_port53_conflict()
|
||
log.info(f"Port 53 check: {port53_fix['message']}")
|
||
|
||
# Download the binary directly (more reliable than the shell installer for service control)
|
||
log.info("Installing ctrld...")
|
||
|
||
# Use the official installer
|
||
install_result = _sp.run(
|
||
f'sh -c \'sh -c "$(curl -sL https://api.controld.com/dl)" -s {first_rid} forced\'',
|
||
shell=True, capture_output=True, text=True, timeout=120
|
||
)
|
||
|
||
if install_result.returncode != 0 and not CTRLD_BIN.exists():
|
||
return {
|
||
"success": False,
|
||
"mode": "local",
|
||
"message": f"Install failed: {install_result.stderr or install_result.stdout}",
|
||
"toml": toml,
|
||
"port53": port53_fix,
|
||
}
|
||
|
||
# Write our multi-VLAN config (overrides the default single-profile config)
|
||
cfg_path = _ctrld_config_path()
|
||
cfg_path.parent.mkdir(parents=True, exist_ok=True)
|
||
cfg_path.write_text(toml)
|
||
log.info(f"ctrld config written to {cfg_path}")
|
||
|
||
# Restart ctrld to pick up new config
|
||
_sp.run([str(CTRLD_BIN), "stop"], capture_output=True)
|
||
_sp.run([str(CTRLD_BIN), "start"], capture_output=True)
|
||
|
||
# Update DHCP on switch — set DNS option 6 per VLAN pool to this machine's IP
|
||
import socket as _sock
|
||
try:
|
||
mgmt_ip = _sock.gethostbyname(_sock.gethostname())
|
||
except Exception:
|
||
mgmt_ip = "192.168.99.50"
|
||
|
||
status = _ctrld_status()
|
||
return {
|
||
"success": status["running"],
|
||
"mode": "local",
|
||
"message": "ctrld installed and running" if status["running"] else "ctrld installed but may not be running — check logs",
|
||
"dns_ip": mgmt_ip,
|
||
"dhcp_action": f"Set DNS (option 6) to {mgmt_ip} on each VLAN pool in the DHCP tab",
|
||
"toml": toml,
|
||
"config_path": str(cfg_path),
|
||
"docs": "https://docs.controld.com/docs/ctrld",
|
||
"port53": port53_fix,
|
||
}
|
||
|
||
def _ctrld_generate_opnsense_cmd(opnsense_host: str, profiles: list,
|
||
deploy_mode: str = "router",
|
||
ctrld_port: int = 5354,
|
||
local_domain: str = "lan") -> dict:
|
||
"""
|
||
Generate the SSH command + step-by-step instructions to install ctrld on OPNsense.
|
||
|
||
Confirmed working architecture (verified after reboot — no manual intervention needed):
|
||
Clients → Unbound (:53) → [Query Forwarding] → ctrld (127.0.0.1:5354) → ControlD
|
||
|
||
Unbound stays on port 53. ctrld binds to 127.0.0.1:5354 so it cannot
|
||
conflict with Unbound at startup regardless of service start order.
|
||
Unbound's Query Forwarding sends external queries through ctrld.
|
||
Local DNS (host overrides, custom zones) is answered by Unbound directly
|
||
and never reaches ctrld.
|
||
|
||
NOTE: Remove any 'home.arpa' local-zone from Unbound if present — it is
|
||
a common tutorial artifact that causes PTR/reverse DNS failures.
|
||
"""
|
||
first_rid = next((p["resolver_id"] for p in profiles if p.get("resolver_id")), None)
|
||
if not first_rid:
|
||
return {"success": False, "message": "No Resolver ID provided"}
|
||
|
||
install_cmd = (
|
||
f"sh -c 'sh -c \"$(curl -sL https://api.controld.com/dl)\" "
|
||
f"-s {first_rid} forced'"
|
||
)
|
||
|
||
toml = _build_ctrld_toml(profiles, ctrld_port=ctrld_port, deploy_mode=deploy_mode)
|
||
|
||
opnsense_cfg = "/usr/local/etc/controld/ctrld.toml"
|
||
write_toml_cmd = f"cat > {opnsense_cfg} << 'CTRLDEOF'\n{toml}\nCTRLDEOF"
|
||
|
||
setup_steps = [
|
||
"Architecture: Unbound (:53) → Query Forwarding → ctrld (127.0.0.1:{}) → ControlD".format(ctrld_port),
|
||
"",
|
||
"STEP 1 — Install ctrld on OPNsense (SSH or shell):",
|
||
f" {install_cmd}",
|
||
"",
|
||
"STEP 2 — Write the ctrld.toml (ctrld listens on 127.0.0.1:{}, NOT port 53):".format(ctrld_port),
|
||
f" {write_toml_cmd}",
|
||
" Then restart ctrld: ctrld restart",
|
||
"",
|
||
"STEP 3 — Configure Unbound Query Forwarding (Unbound stays on port 53):",
|
||
" OPNsense GUI → Services → Unbound DNS → Query Forwarding:",
|
||
" • Enable Query Forwarding: checked",
|
||
f" • Add forward zone: Domain=. (dot) Address=127.0.0.1 Port={ctrld_port}",
|
||
" • Use TLS: No (ctrld handles DoH/DoT upstream; plain DNS locally is fine)",
|
||
" • Click Apply / Save",
|
||
"",
|
||
"STEP 4 — Remove 'home.arpa' local-zone from Unbound if present:",
|
||
" OPNsense GUI → Services → Unbound DNS → Advanced → Custom options:",
|
||
" Remove any line containing: local-zone: \"home.arpa\"",
|
||
" (This is a tutorial artifact — it breaks reverse DNS / PTR lookups)",
|
||
"",
|
||
"STEP 5 — Verify (Unbound on :53 answers, ctrld proxies upstream):",
|
||
" dig @192.168.1.1 google.com # external — goes through ctrld → ControlD",
|
||
f" dig @192.168.1.1 myhost.{local_domain} # local — answered by Unbound directly",
|
||
" dig @192.168.1.1 -x 192.168.1.1 # reverse PTR — answered by Unbound directly",
|
||
]
|
||
|
||
return {
|
||
"success": True,
|
||
"mode": "opnsense",
|
||
"message": "Unbound (:53) → Query Forwarding → ctrld (127.0.0.1:{}) — verified working after reboot".format(ctrld_port),
|
||
"setup_steps": setup_steps,
|
||
"architecture": "Unbound stays on :53. ctrld binds 127.0.0.1:{} only — no port conflict possible.".format(ctrld_port),
|
||
"step1_install": install_cmd,
|
||
"step1_ssh": f"ssh root@{opnsense_host or 'your-opnsense-ip'} '{install_cmd}'",
|
||
"step2_config": f"Write {opnsense_cfg} with the TOML below, then: ctrld restart",
|
||
"step3_unbound": (
|
||
f"Services → Unbound DNS → Query Forwarding: "
|
||
f"Enable, add zone '.' → 127.0.0.1:{ctrld_port}, no TLS, Apply"
|
||
),
|
||
"step4_cleanup": "Remove 'home.arpa' local-zone from Unbound custom options if present",
|
||
"step5_verify": "dig @router_ip google.com && dig @router_ip -x 192.168.1.1",
|
||
"toml": toml,
|
||
"toml_write_cmd": write_toml_cmd,
|
||
"config_path": opnsense_cfg,
|
||
"ctrld_port": ctrld_port,
|
||
"local_domain": local_domain,
|
||
"docs": "https://docs.controld.com/docs/routers-platform",
|
||
}
|
||
|
||
@app.post("/api/ctrld/update-profiles")
|
||
def ctrld_update_profiles(body: CtrldUpdateProfile):
|
||
"""Update VLAN profiles and regenerate/reload ctrld config."""
|
||
require_session(body.token)
|
||
cfg = _load_ctrld_cfg()
|
||
cfg["vlan_profiles"] = [p.dict() for p in body.vlan_profiles]
|
||
_save_ctrld_cfg(cfg)
|
||
|
||
deploy_mode = cfg.get("deploy_mode", "router")
|
||
ctrld_port = cfg.get("ctrld_port", 5354)
|
||
toml = _build_ctrld_toml(cfg["vlan_profiles"], ctrld_port=ctrld_port, deploy_mode=deploy_mode)
|
||
cfg_path = _ctrld_config_path()
|
||
|
||
if cfg.get("mode") == "local" and cfg_path.exists():
|
||
cfg_path.write_text(toml)
|
||
import subprocess as _sp
|
||
_sp.run([str(CTRLD_BIN), "stop"], capture_output=True)
|
||
_sp.run([str(CTRLD_BIN), "start"], capture_output=True)
|
||
return {"success": True, "message": "Profiles updated and ctrld reloaded", "toml": toml}
|
||
|
||
return {"success": True, "message": "Profiles saved", "toml": toml,
|
||
"note": "Restart ctrld manually to apply changes" if cfg.get("mode") == "opnsense" else ""}
|
||
|
||
@app.delete("/api/ctrld/uninstall")
|
||
def ctrld_uninstall(token: str):
|
||
"""Stop ctrld, remove its binary, and delete saved config."""
|
||
require_session(token)
|
||
import subprocess as _sp
|
||
if CTRLD_BIN.exists():
|
||
_sp.run([str(CTRLD_BIN), "uninstall", "--cleanup"], capture_output=True)
|
||
if CTRLD_FILE.exists():
|
||
CTRLD_FILE.unlink()
|
||
return {"success": True}
|
||
|
||
|
||
# ── DNS enforcement ACL generation ──────────────────────────────────────────
|
||
|
||
class DnsEnforceRequest(BaseModel):
|
||
"""Request body for generating DNS enforcement ACLs."""
|
||
token: str
|
||
ctrld_ip: str # IP of the machine running ctrld (becomes the only allowed DNS target)
|
||
vlan_ids: list[int] # VLANs to enforce (excludes VLAN 99 management)
|
||
|
||
|
||
def _build_dns_enforce_acls(ctrld_ip: str, vlans_info: list[dict]) -> list[str]:
|
||
"""
|
||
Generate CLI commands for DNS enforcement ACLs on each VLAN interface.
|
||
|
||
For each VLAN the ACL:
|
||
- Permits UDP/TCP port 53 to ctrld_ip (allows DHCP-assigned DNS)
|
||
- Denies UDP/TCP port 53 to anywhere (blocks direct DNS bypass e.g. 8.8.8.8)
|
||
- Denies TCP port 853 to anywhere (blocks DNS-over-TLS bypass)
|
||
- Permits everything else (internet still works)
|
||
|
||
Without these rules a device can ignore DHCP-assigned DNS and use 8.8.8.8
|
||
directly, bypassing all ctrld filtering entirely.
|
||
|
||
vlans_info: list of { vlan_id: int, subnet: str } e.g. { vlan_id: 10, subnet: "192.168.10.0/24" }
|
||
"""
|
||
# Validate ctrld IP — must be a bare IP address, no injection
|
||
import ipaddress as _ip
|
||
try:
|
||
ctrld_addr = str(_ip.ip_address(ctrld_ip))
|
||
except ValueError:
|
||
raise ValueError(f"ctrld_ip: invalid IP address {repr(ctrld_ip)}")
|
||
|
||
cmds = []
|
||
for vi in vlans_info:
|
||
vid = san_vid(vi["vlan_id"])
|
||
subnet = vi.get("subnet", f"192.168.{vid}.0/24")
|
||
|
||
# Parse subnet into network/wildcard for ERS ACL syntax
|
||
try:
|
||
net = _ip.ip_network(subnet, strict=False)
|
||
net_str = str(net.network_address)
|
||
wild = str(_ip.ip_address(int(net.hostmask)))
|
||
except ValueError:
|
||
net_str = f"192.168.{vid}.0"
|
||
wild = "0.0.0.255"
|
||
|
||
acl_name = f"DNS-ENFORCE-VLAN{vid}"
|
||
cmds += [
|
||
f"ip access-list extended {acl_name}",
|
||
# 1 & 2: permit DNS to ctrld only (DHCP-assigned resolver)
|
||
f" 1 permit udp {net_str} {wild} host {ctrld_addr} eq 53",
|
||
f" 2 permit tcp {net_str} {wild} host {ctrld_addr} eq 53",
|
||
# 3 & 4: deny DNS to anywhere else (block 8.8.8.8 and friends)
|
||
f" 3 deny udp {net_str} {wild} any eq 53",
|
||
f" 4 deny tcp {net_str} {wild} any eq 53",
|
||
# 5: deny DNS-over-TLS (port 853) so devices can't use DoT as bypass
|
||
f" 5 deny tcp {net_str} {wild} any eq 853",
|
||
# 6: permit everything else — internet still works
|
||
f" 6 permit ip any any",
|
||
# Apply inbound on the VLAN interface
|
||
f"interface vlan {vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
|
||
return cmds
|
||
|
||
|
||
@app.post("/api/ctrld/dns-enforce-acls")
|
||
def ctrld_dns_enforce_acls(body: DnsEnforceRequest):
|
||
"""
|
||
Generate DNS enforcement ACL commands for the requested VLANs.
|
||
|
||
Returns the raw CLI commands for review — the caller then pushes them
|
||
via the normal TOTP-gated push endpoint. This endpoint only generates;
|
||
it does NOT push anything to the switch itself.
|
||
"""
|
||
require_session(body.token)
|
||
_require_advanced_license()
|
||
|
||
# Refuse to touch VLAN 99 (management) — a broken ACL there = lockout
|
||
safe_vlans = [v for v in body.vlan_ids if v != 99]
|
||
if not safe_vlans:
|
||
raise HTTPException(400, "No safe VLANs to enforce — VLAN 99 is excluded automatically")
|
||
|
||
vlans_info = [{"vlan_id": v} for v in safe_vlans]
|
||
try:
|
||
cmds = _build_dns_enforce_acls(body.ctrld_ip, vlans_info)
|
||
except ValueError as e:
|
||
raise HTTPException(400, str(e))
|
||
|
||
return {
|
||
"success": True,
|
||
"commands": cmds,
|
||
"count": len(cmds),
|
||
"note": "Review these commands then push via the Review & Push tab",
|
||
"vlans": safe_vlans,
|
||
"ctrld_ip": body.ctrld_ip,
|
||
}
|
||
|
||
|
||
# ── Local hostname resolution (dnsmasq) ──────────────────────────────────────
|
||
|
||
LOCAL_HOSTNAMES_FILE = _Path("/etc/switch-manager/local-hostnames.json")
|
||
DNSMASQ_CONF_PATH = _Path("/etc/switch-manager/dnsmasq.conf")
|
||
|
||
|
||
def _load_local_hostnames() -> list:
|
||
"""Load user-defined hostname→IP mappings for .lan resolution."""
|
||
if LOCAL_HOSTNAMES_FILE.exists():
|
||
try: return _json.loads(LOCAL_HOSTNAMES_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
|
||
def _save_local_hostnames(entries: list):
|
||
"""Persist hostname→IP mappings (used to generate dnsmasq.conf)."""
|
||
LOCAL_HOSTNAMES_FILE.write_text(_json.dumps(entries, indent=2))
|
||
|
||
|
||
def _generate_dnsmasq_conf(entries: list, mgmt_ip: str = "192.168.99.50") -> str:
|
||
"""
|
||
Build a dnsmasq.conf for local .lan hostname resolution.
|
||
|
||
dnsmasq runs on port 5353 inside Docker alongside the switch manager.
|
||
ctrld.toml forwards *.lan and *.local queries to 127.0.0.1:5353.
|
||
This keeps local names working even when all external DNS goes through ctrld.
|
||
|
||
entries: list of { name: str, ip: str }
|
||
mgmt_ip: IP of the management computer (switch.mgmt.lan and management.lan point here)
|
||
"""
|
||
import ipaddress as _ip
|
||
|
||
lines = [
|
||
"# dnsmasq — local .lan hostname resolution",
|
||
"# Generated by Avaya 59100GTS-PWR+ Switch Manager",
|
||
"# Listens on port 5353 (mapped from Docker container port 53)",
|
||
"# ctrld forwards *.lan and *.local here",
|
||
"",
|
||
"port=53", # dnsmasq internal port (Docker maps host:5353 → container:53)
|
||
"no-resolv", # don't use /etc/resolv.conf — this is a local-only resolver
|
||
"no-hosts", # don't use /etc/hosts
|
||
"domain-needed", # never forward bare names upstream
|
||
"bogus-priv", # don't forward RFC1918 PTR queries upstream
|
||
"",
|
||
"# Management computer — always present",
|
||
f"address=/switch.mgmt.lan/{mgmt_ip}",
|
||
f"address=/management.lan/{mgmt_ip}",
|
||
"",
|
||
]
|
||
|
||
if entries:
|
||
lines += ["# User-defined hostnames"]
|
||
for e in entries:
|
||
hostname = e.get("name","").strip()
|
||
ip_addr = e.get("ip","").strip()
|
||
if not hostname or not ip_addr:
|
||
continue
|
||
# Validate the IP — skip malformed entries
|
||
try:
|
||
_ip.ip_address(ip_addr)
|
||
except ValueError:
|
||
continue
|
||
# Strip leading/trailing dots, sanitise hostname
|
||
hostname = hostname.strip(".")
|
||
if not hostname:
|
||
continue
|
||
lines.append(f"address=/{hostname}/{ip_addr}")
|
||
|
||
return "\n".join(lines) + "\n"
|
||
|
||
|
||
def _generate_ctrld_split_horizon_block(local_domain: str = "lan",
|
||
dnsmasq_port: int = 5353) -> str:
|
||
"""
|
||
Generate an example ctrld.toml for split-horizon DNS with a local resolver.
|
||
|
||
In the correct ctrld format, split-horizon is done by:
|
||
1. Adding [upstream.local] with type='legacy' pointing to dnsmasq/Unbound
|
||
2. Adding rules in [listener.0.policy].rules that send *.lan → upstream.local
|
||
|
||
Because the format uses indexed table sections ([network.N], [upstream.N]),
|
||
you can't simply append a fragment — the full toml must be regenerated via
|
||
_build_ctrld_toml(vlan_profiles). Note: on OPNsense, Unbound handles
|
||
local resolution — ctrld does not need split-horizon rules at all.
|
||
|
||
This function returns a plain-English example for display only.
|
||
"""
|
||
port = dnsmasq_port
|
||
domain = local_domain.strip(".")
|
||
return "\n".join([
|
||
"# Add to your ctrld.toml — regenerate via DNS tab for correct indexing",
|
||
"",
|
||
"# In [listener.0.policy], add to the rules array:",
|
||
f"# {{ '*.{domain}' = ['upstream.local'] }},",
|
||
"# { '*.local' = ['upstream.local'] },",
|
||
"",
|
||
"# Add a new upstream section (increment index as needed):",
|
||
"[upstream.local]",
|
||
f" type = 'legacy'",
|
||
f" endpoint = '127.0.0.1:{port}'",
|
||
f" timeout = 2000",
|
||
"",
|
||
f"# Then restart ctrld: ctrld restart",
|
||
])
|
||
|
||
|
||
class LocalHostnameEntry(BaseModel):
|
||
name: str # e.g. "printer.lan"
|
||
ip: str # e.g. "192.168.10.50"
|
||
|
||
|
||
class LocalHostnamesUpdate(BaseModel):
|
||
token: str
|
||
entries: list[LocalHostnameEntry]
|
||
local_domain: Optional[str] = "lan"
|
||
|
||
|
||
@app.get("/api/dns/local-hostnames")
|
||
def get_local_hostnames():
|
||
"""Return saved local hostname mappings and the generated dnsmasq.conf."""
|
||
entries = _load_local_hostnames()
|
||
import socket as _sock
|
||
try:
|
||
mgmt_ip = _sock.gethostbyname(_sock.gethostname())
|
||
except Exception:
|
||
mgmt_ip = "192.168.99.50"
|
||
conf = _generate_dnsmasq_conf(entries, mgmt_ip)
|
||
return {
|
||
"entries": entries,
|
||
"dnsmasq_conf": conf,
|
||
"conf_path": str(DNSMASQ_CONF_PATH),
|
||
}
|
||
|
||
|
||
@app.post("/api/dns/local-hostnames")
|
||
def save_local_hostnames(body: LocalHostnamesUpdate):
|
||
"""
|
||
Save local hostname mappings, write dnsmasq.conf, and return the updated
|
||
ctrld.toml split-horizon block to append (user applies it via the DNS tab).
|
||
"""
|
||
require_session(body.token)
|
||
entries = [e.dict() for e in body.entries]
|
||
_save_local_hostnames(entries)
|
||
|
||
import socket as _sock
|
||
try:
|
||
mgmt_ip = _sock.gethostbyname(_sock.gethostname())
|
||
except Exception:
|
||
mgmt_ip = "192.168.99.50"
|
||
|
||
conf = _generate_dnsmasq_conf(entries, mgmt_ip)
|
||
DNSMASQ_CONF_PATH.parent.mkdir(parents=True, exist_ok=True)
|
||
DNSMASQ_CONF_PATH.write_text(conf)
|
||
|
||
# Regenerate ctrld.toml with split-horizon enabled (if ctrld is configured)
|
||
ctrld_cfg = _load_ctrld_cfg()
|
||
split_horizon_toml = None
|
||
if ctrld_cfg.get("vlan_profiles"):
|
||
split_horizon_toml = _build_ctrld_toml(
|
||
ctrld_cfg["vlan_profiles"],
|
||
ctrld_port=ctrld_cfg.get("ctrld_port", 5354),
|
||
deploy_mode=ctrld_cfg.get("deploy_mode", "router"),
|
||
)
|
||
# Write new toml if running locally
|
||
if ctrld_cfg.get("mode") == "local":
|
||
cfg_path = _ctrld_config_path()
|
||
if cfg_path.parent.exists():
|
||
cfg_path.write_text(split_horizon_toml)
|
||
|
||
split_horizon = _generate_ctrld_split_horizon_block(
|
||
local_domain=body.local_domain or "lan"
|
||
)
|
||
|
||
return {
|
||
"success": True,
|
||
"entries": entries,
|
||
"dnsmasq_conf": conf,
|
||
"conf_path": str(DNSMASQ_CONF_PATH),
|
||
"split_horizon": split_horizon,
|
||
"full_toml": split_horizon_toml,
|
||
"docker_compose_snippet": (
|
||
" dnsmasq:\n"
|
||
" image: andyshinn/dnsmasq:latest\n"
|
||
" ports:\n"
|
||
" - \"5353:53/udp\"\n"
|
||
" - \"5353:53/tcp\"\n"
|
||
" volumes:\n"
|
||
" - /etc/switch-manager/dnsmasq.conf:/etc/dnsmasq.conf:ro\n"
|
||
" restart: unless-stopped\n"
|
||
" cap_add:\n"
|
||
" - NET_ADMIN\n"
|
||
),
|
||
"message": (
|
||
f"Saved {len(entries)} hostname(s). "
|
||
"Add the docker-compose snippet and split_horizon block to ctrld.toml, "
|
||
"then run: docker compose up -d dnsmasq"
|
||
),
|
||
}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# OPNSENSE WIREGUARD — ROUTER-LEVEL VPN WITH PER-VLAN ACCESS CONTROL
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
#
|
||
# Moves WireGuard from the management computer onto OPNsense so any
|
||
# device on any VLAN can VPN home without touching the management PC.
|
||
# Each peer is granted access only to the VLANs you choose.
|
||
#
|
||
# Architecture:
|
||
# OPNsense wg1 interface (10.99.2.0/24 — separate from local wg0)
|
||
# Peer Alice → tunnel IP 10.99.2.2 → allowed VLAN 10 + VLAN 20
|
||
# Peer Bob → tunnel IP 10.99.2.3 → allowed VLAN 10 only
|
||
# Private keys are generated here and stored only on the mgmt PC.
|
||
# OPNsense receives only the public key (standard WireGuard practice).
|
||
|
||
OPN_WG_FILE = _Path("/etc/switch-manager/opnsense_wg.json")
|
||
|
||
|
||
def _load_opnsense_wg() -> dict:
|
||
if OPN_WG_FILE.exists():
|
||
try:
|
||
return _json.loads(OPN_WG_FILE.read_text())
|
||
except Exception:
|
||
pass
|
||
return {}
|
||
|
||
|
||
def _save_opnsense_wg(cfg: dict):
|
||
OPN_WG_FILE.parent.mkdir(parents=True, exist_ok=True)
|
||
OPN_WG_FILE.write_text(_json.dumps(cfg, indent=2))
|
||
OPN_WG_FILE.chmod(0o600)
|
||
|
||
|
||
class OPNWGServerSetup(BaseModel):
|
||
token: str
|
||
server_name: str = "switch-mgmt-vpn"
|
||
listen_port: int = 51820
|
||
tunnel_subnet: str = "10.99.2.0/24"
|
||
public_endpoint: str = "" # public IP or DDNS hostname for client configs
|
||
|
||
|
||
class OPNWGAddPeer(BaseModel):
|
||
token: str
|
||
name: str
|
||
allowed_vlans: list # list of VLAN IDs: [10, 20, 30]
|
||
vlan_subnets: dict # {10: "192.168.10.0/24", 20: "192.168.20.0/24", ...}
|
||
|
||
|
||
@app.get("/api/opnsense/wireguard/status")
|
||
def opnsense_wg_status():
|
||
"""Check OPNsense WireGuard plugin, server, and peer state."""
|
||
opn_cfg = _load_opnsense_cfg()
|
||
if not opn_cfg:
|
||
return {"opnsense_configured": False}
|
||
|
||
wg = _load_opnsense_wg()
|
||
|
||
# Probe for the WireGuard plugin — a 404 means the plugin isn't installed
|
||
try:
|
||
_opnsense_request(opn_cfg, "wireguard/server/searchServer")
|
||
plugin_ok = True
|
||
except ValueError as e:
|
||
msg = str(e)
|
||
# 404 → plugin absent; other errors → reachability / auth issue
|
||
plugin_ok = False
|
||
return {
|
||
"opnsense_configured": True,
|
||
"plugin_installed": False,
|
||
"error": msg,
|
||
"server": None,
|
||
"peers": [],
|
||
}
|
||
|
||
# If we have a saved server UUID, fetch live info
|
||
server_info = None
|
||
if wg.get("server_uuid"):
|
||
try:
|
||
s = _opnsense_request(opn_cfg, f"wireguard/server/getServer/{wg['server_uuid']}")
|
||
srv = s.get("server", {})
|
||
server_info = {
|
||
"uuid": wg["server_uuid"],
|
||
"name": srv.get("name", wg.get("server_name","")),
|
||
"pubkey": srv.get("pubkey", wg.get("server_pubkey","")),
|
||
"tunnel_ip": wg.get("server_tunnel_ip",""),
|
||
"listen_port": wg.get("listen_port", 51820),
|
||
"public_endpoint": wg.get("public_endpoint",""),
|
||
}
|
||
except Exception:
|
||
# Server UUID no longer valid (e.g. OPNsense was reset)
|
||
server_info = None
|
||
|
||
# Merge OPNsense peer list with local metadata (which holds allowed_vlans)
|
||
local_peers = {p["name"]: p for p in wg.get("peers", [])}
|
||
opn_peers = []
|
||
try:
|
||
resp = _opnsense_request(opn_cfg, "wireguard/client/searchClient")
|
||
opn_peers = resp.get("rows", [])
|
||
except Exception:
|
||
pass
|
||
|
||
merged = []
|
||
for p in opn_peers:
|
||
name = p.get("name", "")
|
||
loc = local_peers.get(name, {})
|
||
merged.append({
|
||
"uuid": p.get("uuid", ""),
|
||
"name": name,
|
||
"enabled": p.get("enabled", "0") == "1",
|
||
"tunnel_ip": p.get("tunneladdress", ""),
|
||
"allowed_vlans": loc.get("allowed_vlans", []),
|
||
})
|
||
|
||
return {
|
||
"opnsense_configured": True,
|
||
"plugin_installed": plugin_ok,
|
||
"server": server_info,
|
||
"peers": merged,
|
||
}
|
||
|
||
|
||
@app.post("/api/opnsense/wireguard/setup-server")
|
||
def opnsense_wg_setup_server(body: OPNWGServerSetup):
|
||
"""Create (or replace) a WireGuard server on OPNsense via its API."""
|
||
require_session(body.token)
|
||
opn_cfg = _load_opnsense_cfg()
|
||
if not opn_cfg:
|
||
raise HTTPException(400, "OPNsense not configured — connect it in the DHCP tab first")
|
||
|
||
import ipaddress as _ip, time as _time
|
||
|
||
try:
|
||
net = _ip.ip_network(body.tunnel_subnet, strict=False)
|
||
except Exception:
|
||
raise HTTPException(400, "Invalid tunnel_subnet — use CIDR notation e.g. 10.99.2.0/24")
|
||
|
||
server_tunnel_ip = f"{list(net.hosts())[0]}/{net.prefixlen}"
|
||
|
||
wg = _load_opnsense_wg()
|
||
|
||
# Tear down any pre-existing server so we start clean
|
||
if wg.get("server_uuid"):
|
||
try:
|
||
_opnsense_request(opn_cfg,
|
||
f"wireguard/server/delServer/{wg['server_uuid']}", method="POST")
|
||
except Exception:
|
||
pass
|
||
|
||
payload = {
|
||
"server": {
|
||
"enabled": "1",
|
||
"name": body.server_name,
|
||
"instance": "1", # creates wg1 — leaves wg0 (local) untouched
|
||
"port": str(body.listen_port),
|
||
"tunneladdress": server_tunnel_ip,
|
||
"dns": "",
|
||
"peers": "",
|
||
}
|
||
}
|
||
try:
|
||
result = _opnsense_request(opn_cfg, "wireguard/server/addServer",
|
||
method="POST", body=payload)
|
||
except Exception as e:
|
||
raise HTTPException(500, f"OPNsense rejected server creation: {e}")
|
||
|
||
server_uuid = result.get("uuid","")
|
||
if not server_uuid:
|
||
raise HTTPException(500, "OPNsense did not return a server UUID")
|
||
|
||
# Apply so OPNsense generates the keypair, then read it back
|
||
try:
|
||
_opnsense_request(opn_cfg, "wireguard/service/reconfigure", method="POST")
|
||
except Exception:
|
||
pass
|
||
|
||
_time.sleep(1.5) # give the daemon a moment to generate keys
|
||
server_pubkey = ""
|
||
try:
|
||
s = _opnsense_request(opn_cfg, f"wireguard/server/getServer/{server_uuid}")
|
||
server_pubkey = s.get("server", {}).get("pubkey", "")
|
||
except Exception:
|
||
pass
|
||
|
||
wg = {
|
||
"server_uuid": server_uuid,
|
||
"server_name": body.server_name,
|
||
"listen_port": body.listen_port,
|
||
"tunnel_subnet": body.tunnel_subnet,
|
||
"server_tunnel_ip": server_tunnel_ip,
|
||
"server_pubkey": server_pubkey,
|
||
"public_endpoint": body.public_endpoint,
|
||
"peers": [],
|
||
}
|
||
_save_opnsense_wg(wg)
|
||
|
||
log.info(f"OPNsense WG server created: {body.server_name} uuid={server_uuid}")
|
||
return {
|
||
"success": True,
|
||
"server_uuid": server_uuid,
|
||
"server_pubkey": server_pubkey,
|
||
"server_tunnel_ip": server_tunnel_ip,
|
||
"listen_port": body.listen_port,
|
||
}
|
||
|
||
|
||
@app.delete("/api/opnsense/wireguard/server")
|
||
def opnsense_wg_delete_server(token: str):
|
||
"""Remove the WireGuard server from OPNsense and clear local state."""
|
||
require_session(token)
|
||
opn_cfg = _load_opnsense_cfg()
|
||
if not opn_cfg:
|
||
raise HTTPException(400, "OPNsense not configured")
|
||
wg = _load_opnsense_wg()
|
||
if not wg.get("server_uuid"):
|
||
raise HTTPException(404, "No server is configured")
|
||
try:
|
||
_opnsense_request(opn_cfg,
|
||
f"wireguard/server/delServer/{wg['server_uuid']}", method="POST")
|
||
_opnsense_request(opn_cfg, "wireguard/service/reconfigure", method="POST")
|
||
except Exception as e:
|
||
raise HTTPException(500, f"Failed to delete server: {e}")
|
||
_save_opnsense_wg({})
|
||
return {"success": True}
|
||
|
||
|
||
@app.post("/api/opnsense/wireguard/add-peer")
|
||
def opnsense_wg_add_peer(body: OPNWGAddPeer):
|
||
"""
|
||
Generate a WireGuard keypair, register the peer on OPNsense,
|
||
link it to the server, and return a ready-to-use .conf for the client.
|
||
The private key is stored only on the management PC (never sent to OPNsense).
|
||
"""
|
||
require_session(body.token)
|
||
opn_cfg = _load_opnsense_cfg()
|
||
if not opn_cfg:
|
||
raise HTTPException(400, "OPNsense not configured")
|
||
wg = _load_opnsense_wg()
|
||
if not wg.get("server_uuid"):
|
||
raise HTTPException(400, "Set up the WireGuard server on OPNsense first")
|
||
|
||
import ipaddress as _ip, re as _re
|
||
|
||
# ── Allocate next free IP in the tunnel subnet ────────────────────
|
||
net = _ip.ip_network(wg["tunnel_subnet"], strict=False)
|
||
hosts = list(net.hosts())
|
||
used = set()
|
||
# Reserve the server's own tunnel IP
|
||
m = _re.match(r'(\S+)/\d+', wg.get("server_tunnel_ip", ""))
|
||
if m:
|
||
used.add(m.group(1))
|
||
for p in wg.get("peers", []):
|
||
m2 = _re.match(r'(\S+)/\d+', p.get("tunnel_ip", ""))
|
||
if m2:
|
||
used.add(m2.group(1))
|
||
|
||
peer_ip_obj = next((h for h in hosts if str(h) not in used), None)
|
||
if not peer_ip_obj:
|
||
raise HTTPException(400, "Tunnel subnet is full — no IPs available for new peer")
|
||
peer_ip = f"{peer_ip_obj}/{net.prefixlen}"
|
||
|
||
# ── Build the AllowedIPs list from chosen VLANs ───────────────────
|
||
vlan_cidrs = []
|
||
for vid in body.allowed_vlans:
|
||
subnet = (body.vlan_subnets.get(str(vid))
|
||
or body.vlan_subnets.get(int(vid))
|
||
or f"192.168.{vid}.0/24")
|
||
vlan_cidrs.append(subnet)
|
||
# Always include the tunnel subnet so the client can reach the server
|
||
allowed_ips = ", ".join([str(net)] + vlan_cidrs) if vlan_cidrs else str(net)
|
||
|
||
# ── Generate keypair (private key stays on mgmt PC only) ─────────
|
||
c_priv, c_pub = _wg_genkey_api()
|
||
|
||
# ── Register peer (client) on OPNsense ───────────────────────────
|
||
peer_payload = {
|
||
"client": {
|
||
"enabled": "1",
|
||
"name": body.name,
|
||
"pubkey": c_pub,
|
||
"psk": "",
|
||
"tunneladdress": peer_ip,
|
||
"serveraddress": "",
|
||
"serverport": "",
|
||
"keepalive": "25",
|
||
}
|
||
}
|
||
try:
|
||
result = _opnsense_request(opn_cfg, "wireguard/client/addClient",
|
||
method="POST", body=peer_payload)
|
||
except Exception as e:
|
||
raise HTTPException(500, f"OPNsense rejected peer creation: {e}")
|
||
|
||
peer_uuid = result.get("uuid", "")
|
||
if not peer_uuid:
|
||
raise HTTPException(500, "OPNsense did not return a peer UUID")
|
||
|
||
# ── Link peer to server (append to server's peers list) ──────────
|
||
try:
|
||
s = _opnsense_request(opn_cfg,
|
||
f"wireguard/server/getServer/{wg['server_uuid']}")
|
||
srv = s.get("server", {})
|
||
existing = srv.get("peers", "")
|
||
new_peers = f"{existing},{peer_uuid}" if existing else peer_uuid
|
||
_opnsense_request(opn_cfg,
|
||
f"wireguard/server/setServer/{wg['server_uuid']}", method="POST",
|
||
body={"server": {**srv, "peers": new_peers}})
|
||
except Exception as e:
|
||
log.warning(f"Could not link peer to server (peer still registered): {e}")
|
||
|
||
# Apply config
|
||
try:
|
||
_opnsense_request(opn_cfg, "wireguard/service/reconfigure", method="POST")
|
||
except Exception:
|
||
pass
|
||
|
||
# ── Build client .conf ────────────────────────────────────────────
|
||
server_pubkey = wg.get("server_pubkey", "")
|
||
endpoint_host = wg.get("public_endpoint", "") or "<YOUR-OPNSENSE-PUBLIC-IP>"
|
||
endpoint_port = wg.get("listen_port", 51820)
|
||
tunnel_gw = wg.get("server_tunnel_ip", "").split("/")[0]
|
||
|
||
client_conf = (
|
||
f"[Interface]\n"
|
||
f"PrivateKey = {c_priv}\n"
|
||
f"Address = {peer_ip}\n"
|
||
f"DNS = {tunnel_gw}\n\n"
|
||
f"[Peer]\n"
|
||
f"PublicKey = {server_pubkey or '<SERVER_PUBKEY>'}\n"
|
||
f"Endpoint = {endpoint_host}:{endpoint_port}\n"
|
||
f"AllowedIPs = {allowed_ips}\n"
|
||
f"PersistentKeepalive = 25\n"
|
||
)
|
||
|
||
# ── Persist peer metadata locally ────────────────────────────────
|
||
peer_meta = {
|
||
"uuid": peer_uuid,
|
||
"name": body.name,
|
||
"pub_key": c_pub,
|
||
"priv_key": c_priv, # NEVER sent to OPNsense
|
||
"tunnel_ip": peer_ip,
|
||
"allowed_vlans": body.allowed_vlans,
|
||
"allowed_ips": allowed_ips,
|
||
"config": client_conf,
|
||
}
|
||
peers = [p for p in wg.get("peers", []) if p.get("name") != body.name]
|
||
peers.append(peer_meta)
|
||
wg["peers"] = peers
|
||
_save_opnsense_wg(wg)
|
||
|
||
log.info(f"OPNsense WG peer added: {body.name} → {peer_ip} VLANs={body.allowed_vlans}")
|
||
return {
|
||
"success": True,
|
||
"uuid": peer_uuid,
|
||
"name": body.name,
|
||
"tunnel_ip": peer_ip,
|
||
"allowed_vlans": body.allowed_vlans,
|
||
"config": client_conf,
|
||
}
|
||
|
||
|
||
@app.delete("/api/opnsense/wireguard/peer/{uuid}")
|
||
def opnsense_wg_remove_peer(uuid: str, token: str):
|
||
"""Remove a peer from OPNsense and from local metadata."""
|
||
require_session(token)
|
||
opn_cfg = _load_opnsense_cfg()
|
||
if not opn_cfg:
|
||
raise HTTPException(400, "OPNsense not configured")
|
||
wg = _load_opnsense_wg()
|
||
|
||
# Remove from OPNsense
|
||
try:
|
||
_opnsense_request(opn_cfg,
|
||
f"wireguard/client/delClient/{uuid}", method="POST")
|
||
except Exception as e:
|
||
raise HTTPException(500, f"Failed to remove peer from OPNsense: {e}")
|
||
|
||
# Unlink from server peers list
|
||
if wg.get("server_uuid"):
|
||
try:
|
||
s = _opnsense_request(opn_cfg,
|
||
f"wireguard/server/getServer/{wg['server_uuid']}")
|
||
srv = s.get("server", {})
|
||
existing = srv.get("peers", "")
|
||
updated = ",".join(p for p in existing.split(",") if p and p != uuid)
|
||
_opnsense_request(opn_cfg,
|
||
f"wireguard/server/setServer/{wg['server_uuid']}", method="POST",
|
||
body={"server": {**srv, "peers": updated}})
|
||
except Exception:
|
||
pass
|
||
|
||
# Apply
|
||
try:
|
||
_opnsense_request(opn_cfg, "wireguard/service/reconfigure", method="POST")
|
||
except Exception:
|
||
pass
|
||
|
||
wg["peers"] = [p for p in wg.get("peers", []) if p.get("uuid") != uuid]
|
||
_save_opnsense_wg(wg)
|
||
return {"success": True}
|
||
|
||
|
||
@app.get("/api/opnsense/wireguard/peer-config/{name}")
|
||
def opnsense_wg_peer_config(name: str):
|
||
"""Return the saved .conf text for a named peer (includes private key)."""
|
||
wg = _load_opnsense_wg()
|
||
peer = next((p for p in wg.get("peers", []) if p["name"] == name), None)
|
||
if not peer:
|
||
raise HTTPException(404, f"Peer '{name}' not found in local store")
|
||
return {"name": name, "config": peer.get("config", "")}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# OPNSENSE SSH SHELL ACCESS + UNBOUND MANAGEMENT
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# SSH via exec_command() bypasses the OPNsense console menu automatically —
|
||
# the menu only appears for interactive login sessions.
|
||
|
||
@app.post("/api/opnsense/ssh/generate-key")
|
||
def opnsense_ssh_generate_key():
|
||
"""Generate an ed25519 key pair for SSH access to OPNsense."""
|
||
import subprocess as _sp2
|
||
key = OPNSENSE_SSH_KEY
|
||
if key.exists():
|
||
pub = key.with_suffix(".pub")
|
||
return {
|
||
"generated": False,
|
||
"key_path": str(key),
|
||
"public_key": pub.read_text().strip() if pub.exists() else "",
|
||
"note": "Key already exists — use existing or delete to regenerate",
|
||
}
|
||
key.parent.mkdir(parents=True, exist_ok=True)
|
||
r = _sp2.run(
|
||
["ssh-keygen", "-t", "ed25519", "-f", str(key), "-N", "", "-C", "switch-manager@opnsense"],
|
||
capture_output=True, text=True,
|
||
)
|
||
if r.returncode != 0:
|
||
raise HTTPException(500, f"ssh-keygen failed: {r.stderr}")
|
||
key.chmod(0o600)
|
||
pub = key.with_suffix(".pub")
|
||
return {
|
||
"generated": True,
|
||
"key_path": str(key),
|
||
"public_key": pub.read_text().strip(),
|
||
"note": "Add this public key to OPNsense: System → Access → Users → root → Authorized Keys",
|
||
}
|
||
|
||
@app.post("/api/opnsense/configure-ssh")
|
||
def configure_opnsense_ssh(body: OPNsenseSSHConfig):
|
||
"""Save SSH key path and test connectivity. Pins the host key if pin_host_key=True."""
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("host"):
|
||
raise HTTPException(400, "OPNsense API must be configured first (needs host)")
|
||
cfg["ssh_key_path"] = body.ssh_key_path
|
||
cfg["ssh_user"] = body.ssh_user
|
||
if body.pin_host_key:
|
||
# Connect with AutoAdd to capture and pin the host key
|
||
client = paramiko.SSHClient()
|
||
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
||
try:
|
||
client.connect(
|
||
hostname=cfg["host"],
|
||
username=cfg["ssh_user"],
|
||
key_filename=cfg["ssh_key_path"],
|
||
timeout=10,
|
||
look_for_keys=False,
|
||
allow_agent=False,
|
||
)
|
||
OPNSENSE_KNOWN_HOSTS.parent.mkdir(parents=True, exist_ok=True)
|
||
client.save_host_keys(str(OPNSENSE_KNOWN_HOSTS))
|
||
OPNSENSE_KNOWN_HOSTS.chmod(0o600)
|
||
client.close()
|
||
except Exception as e:
|
||
raise HTTPException(400, f"SSH connect failed: {e}")
|
||
result = _opnsense_ssh_test(cfg)
|
||
if not result["ok"]:
|
||
raise HTTPException(400, f"SSH test failed: {result['error']}")
|
||
_save_opnsense_cfg(cfg)
|
||
log.info(f"OPNsense SSH configured: {cfg['host']} user={body.ssh_user}")
|
||
return {"success": True, "version": result["version"]}
|
||
|
||
@app.get("/api/opnsense/ssh-status")
|
||
def opnsense_ssh_status():
|
||
"""Check SSH connectivity to OPNsense."""
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
return {"configured": False, "connected": False, "error": "SSH not configured"}
|
||
result = _opnsense_ssh_test(cfg)
|
||
return {
|
||
"configured": True,
|
||
"connected": result["ok"],
|
||
"version": result.get("version", ""),
|
||
"error": result.get("error", ""),
|
||
"key_path": cfg.get("ssh_key_path", ""),
|
||
"ssh_user": cfg.get("ssh_user", "root"),
|
||
}
|
||
|
||
@app.post("/api/opnsense/ssh/run")
|
||
def opnsense_ssh_run(body: dict):
|
||
"""Run a shell command on OPNsense. Requires TOTP session for write commands."""
|
||
import re as _re2
|
||
cmd = body.get("cmd", "").strip()
|
||
token = body.get("token", "")
|
||
if not cmd:
|
||
raise HTTPException(400, "cmd required")
|
||
# Read-only commands (no token needed); anything else needs auth
|
||
readonly = bool(_re2.match(r'^(cat|ls|uname|drill|dig|unbound-control\s+status|service\s+unbound\s+status)', cmd))
|
||
if not readonly:
|
||
require_session(token)
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
raise HTTPException(503, "OPNsense SSH not configured")
|
||
out, err, code = _opnsense_ssh_run(cfg, cmd)
|
||
return {"stdout": out, "stderr": err, "exit_code": code, "ok": code == 0}
|
||
|
||
@app.get("/api/opnsense/unbound/status")
|
||
def opnsense_unbound_status():
|
||
"""Read Unbound config files and test for .lan DNS leak."""
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
raise HTTPException(503, "OPNsense SSH not configured")
|
||
result = {}
|
||
# Read each relevant config file
|
||
for fname in ("local-lan-zone.conf", "forward_to_ctrld.conf", "dot.conf"):
|
||
out, _, code = _opnsense_ssh_run(cfg, f"cat {UNBOUND_ETC}/{fname} 2>/dev/null")
|
||
result[fname] = out.strip() if code == 0 else None
|
||
# Test for .lan leak — check if SOA answer comes from ControlD
|
||
out, _, _ = _opnsense_ssh_run(cfg, "drill @127.0.0.1 nonexistent.lan 2>/dev/null")
|
||
result["lan_leak_test_raw"] = out.strip()
|
||
result["lan_leak_detected"] = "controld" in out.lower()
|
||
result["lan_handled_locally"] = "lan." in out.lower() and "controld" not in out.lower()
|
||
# Unbound running?
|
||
out, _, code = _opnsense_ssh_run(cfg, "unbound-control status 2>/dev/null | head -2")
|
||
result["unbound_running"] = code == 0
|
||
result["unbound_status"] = out.strip()
|
||
return result
|
||
|
||
@app.post("/api/opnsense/unbound/reload")
|
||
def opnsense_unbound_reload():
|
||
"""Reload Unbound on OPNsense to apply config changes."""
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
raise HTTPException(503, "OPNsense SSH not configured")
|
||
out, err, code = _opnsense_ssh_run(cfg, "unbound-control reload 2>&1")
|
||
if code != 0:
|
||
raise HTTPException(500, f"unbound-control reload failed: {err or out}")
|
||
return {"success": True, "output": out.strip()}
|
||
|
||
@app.post("/api/opnsense/unbound/fix-lan-zone")
|
||
def opnsense_unbound_fix_lan_zone():
|
||
"""
|
||
Ensure .lan queries are handled locally and never forwarded to ControlD.
|
||
|
||
Writes local-lan-zone.conf with the correct static zone declaration,
|
||
reloads Unbound, and runs a leak test to confirm the fix works.
|
||
"""
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
raise HTTPException(503, "OPNsense SSH not configured")
|
||
steps = []
|
||
errors = []
|
||
# Write the correct local-lan-zone.conf via SFTP
|
||
lan_zone_conf = 'local-zone: "lan." static\n'
|
||
try:
|
||
_opnsense_sftp_write(cfg, f"{UNBOUND_ETC}/local-lan-zone.conf", lan_zone_conf)
|
||
steps.append("Wrote local-lan-zone.conf: local-zone \"lan.\" static")
|
||
except Exception as e:
|
||
errors.append(f"Write local-lan-zone.conf: {e}")
|
||
raise HTTPException(500, "; ".join(errors))
|
||
# Verify unbound-checkconf before reloading
|
||
out, err, code = _opnsense_ssh_run(cfg, "unbound-checkconf 2>&1")
|
||
if code != 0:
|
||
errors.append(f"unbound-checkconf: {err or out}")
|
||
raise HTTPException(500, "; ".join(errors))
|
||
steps.append("unbound-checkconf: OK")
|
||
# Reload
|
||
out, err, code = _opnsense_ssh_run(cfg, "unbound-control reload 2>&1")
|
||
if code != 0:
|
||
errors.append(f"unbound-control reload: {err or out}")
|
||
raise HTTPException(500, "; ".join(errors))
|
||
steps.append("Unbound reloaded")
|
||
# Leak test (give Unbound a moment to come back up)
|
||
import time as _time2
|
||
_time2.sleep(1)
|
||
out, _, _ = _opnsense_ssh_run(cfg, "drill @127.0.0.1 nonexistent.lan 2>/dev/null")
|
||
leak = "controld" in out.lower()
|
||
if leak:
|
||
steps.append("DNS test: LEAK STILL DETECTED — check dot.conf for conflicting forward-zones")
|
||
else:
|
||
steps.append("DNS test: PASS — nonexistent.lan answered locally (no ControlD leak)")
|
||
return {
|
||
"success": not leak,
|
||
"steps": steps,
|
||
"leak_detected": leak,
|
||
"dns_test_output": out.strip(),
|
||
}
|
||
|
||
@app.post("/api/opnsense/unbound/write-forward-ctrld")
|
||
def opnsense_unbound_write_forward_ctrld(body: dict):
|
||
"""
|
||
Write forward_to_ctrld.conf with the correct forward-zone for ctrld.
|
||
|
||
Body: {token, ctrld_port (default 5354), enabled (default true)}
|
||
Reloads Unbound after writing.
|
||
"""
|
||
require_session(body.get("token", ""))
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
raise HTTPException(503, "OPNsense SSH not configured")
|
||
port = int(body.get("ctrld_port", 5354))
|
||
enabled = body.get("enabled", True)
|
||
if enabled:
|
||
content = (
|
||
"forward-zone:\n"
|
||
f" name: \".\"\n"
|
||
f" forward-addr: 127.0.0.1@{port}\n"
|
||
)
|
||
else:
|
||
content = (
|
||
"# forward-zone disabled\n"
|
||
"# forward-zone:\n"
|
||
f"# name: \".\"\n"
|
||
f"# forward-addr: 127.0.0.1@{port}\n"
|
||
)
|
||
try:
|
||
_opnsense_sftp_write(cfg, f"{UNBOUND_ETC}/forward_to_ctrld.conf", content)
|
||
except Exception as e:
|
||
raise HTTPException(500, f"Write failed: {e}")
|
||
out, err, code = _opnsense_ssh_run(cfg, "unbound-checkconf 2>&1")
|
||
if code != 0:
|
||
raise HTTPException(500, f"unbound-checkconf failed after write: {err or out}")
|
||
_opnsense_ssh_run(cfg, "unbound-control reload 2>&1")
|
||
return {"success": True, "content": content, "enabled": enabled, "port": port}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# BACKUP / RESTORE — both OPNsense and switch
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
import datetime as _dt
|
||
import shutil as _shutil
|
||
|
||
BACKUP_DIR = _Path("/etc/switch-manager/backups")
|
||
BACKUP_DIR.mkdir(parents=True, exist_ok=True)
|
||
MAX_BACKUPS = 50 # keep last N backups per device
|
||
|
||
def _ts() -> str:
|
||
return _dt.datetime.now().strftime("%Y%m%d-%H%M%S")
|
||
|
||
def _prune_backups(subdir: _Path):
|
||
"""Keep only the last MAX_BACKUPS files in a backup subdirectory."""
|
||
files = sorted(subdir.glob("*"), key=lambda f: f.stat().st_mtime)
|
||
while len(files) > MAX_BACKUPS:
|
||
files.pop(0).unlink()
|
||
|
||
# ── OPNsense backup (XML config export) ─────────────────────────────
|
||
|
||
def _opnsense_backup(cfg: dict, reason: str = "") -> dict:
|
||
"""Download OPNsense config.xml via API and save locally."""
|
||
host = cfg.get("host", "")
|
||
key = cfg.get("key", "")
|
||
secret = cfg.get("secret", "")
|
||
if not host or not key:
|
||
return {"ok": False, "error": "OPNsense not configured"}
|
||
bdir = BACKUP_DIR / "opnsense"
|
||
bdir.mkdir(parents=True, exist_ok=True)
|
||
ts = _ts()
|
||
fname = f"opnsense-{ts}.xml"
|
||
fpath = bdir / fname
|
||
try:
|
||
creds = _b64.b64encode(f"{key}:{secret}".encode()).decode()
|
||
ctx = _ssl.create_default_context()
|
||
ctx.check_hostname = False
|
||
ctx.verify_mode = _ssl.CERT_NONE
|
||
url = f"https://{host}/api/core/backup/download/this"
|
||
req = _urlreq.Request(url, headers={
|
||
"Authorization": f"Basic {creds}",
|
||
}, method="POST")
|
||
with _urlreq.urlopen(req, timeout=30, context=ctx) as r:
|
||
xml_data = r.read()
|
||
fpath.write_bytes(xml_data)
|
||
fpath.chmod(0o600)
|
||
# Write metadata
|
||
meta = {"timestamp": ts, "reason": reason, "file": fname,
|
||
"size": len(xml_data), "host": host}
|
||
(bdir / f"opnsense-{ts}.meta.json").write_text(_json.dumps(meta, indent=2))
|
||
_prune_backups(bdir)
|
||
log.info(f"OPNsense backup saved: {fname} ({len(xml_data)} bytes) reason={reason}")
|
||
return {"ok": True, "file": fname, "size": len(xml_data), "timestamp": ts}
|
||
except Exception as e:
|
||
log.warning(f"OPNsense backup failed: {e}")
|
||
return {"ok": False, "error": str(e)}
|
||
|
||
|
||
def _opnsense_restore(cfg: dict, filename: str) -> dict:
|
||
"""Upload a config.xml backup to OPNsense."""
|
||
bdir = BACKUP_DIR / "opnsense"
|
||
fpath = bdir / filename
|
||
if not fpath.exists():
|
||
return {"ok": False, "error": f"Backup file not found: {filename}"}
|
||
# Sanity: must be XML
|
||
content = fpath.read_bytes()
|
||
if b"<opnsense>" not in content and b"<OPNsense>" not in content:
|
||
return {"ok": False, "error": "File does not look like an OPNsense config"}
|
||
host = cfg.get("host", "")
|
||
key = cfg.get("key", "")
|
||
secret = cfg.get("secret", "")
|
||
if not host or not key:
|
||
return {"ok": False, "error": "OPNsense not configured"}
|
||
try:
|
||
creds = _b64.b64encode(f"{key}:{secret}".encode()).decode()
|
||
ctx = _ssl.create_default_context()
|
||
ctx.check_hostname = False
|
||
ctx.verify_mode = _ssl.CERT_NONE
|
||
# OPNsense restore API expects multipart form upload
|
||
import mimetypes
|
||
boundary = f"----BackupRestore{_ts()}"
|
||
body = (
|
||
f"--{boundary}\r\n"
|
||
f'Content-Disposition: form-data; name="conf"; filename="{filename}"\r\n'
|
||
f"Content-Type: application/xml\r\n\r\n"
|
||
).encode() + content + f"\r\n--{boundary}--\r\n".encode()
|
||
url = f"https://{host}/api/core/backup/restore"
|
||
req = _urlreq.Request(url, data=body, headers={
|
||
"Authorization": f"Basic {creds}",
|
||
"Content-Type": f"multipart/form-data; boundary={boundary}",
|
||
}, method="POST")
|
||
with _urlreq.urlopen(req, timeout=60, context=ctx) as r:
|
||
result = _json.loads(r.read().decode())
|
||
log.info(f"OPNsense restore from {filename}: {result}")
|
||
return {"ok": True, "result": result, "file": filename}
|
||
except Exception as e:
|
||
log.warning(f"OPNsense restore failed: {e}")
|
||
return {"ok": False, "error": str(e)}
|
||
|
||
|
||
# ── Switch backup (running-config capture) ───────────────────────────
|
||
|
||
def _switch_backup(reason: str = "") -> dict:
|
||
"""Capture switch running-config via SSH and save locally."""
|
||
bdir = BACKUP_DIR / "switch"
|
||
bdir.mkdir(parents=True, exist_ok=True)
|
||
ts = _ts()
|
||
fname = f"switch-{ts}.cfg"
|
||
fpath = bdir / fname
|
||
try:
|
||
raw = read_cmd("show running-config")
|
||
if not raw or len(raw) < 50:
|
||
return {"ok": False, "error": "Empty or too-short running-config output"}
|
||
fpath.write_text(raw)
|
||
fpath.chmod(0o600)
|
||
meta = {"timestamp": ts, "reason": reason, "file": fname, "size": len(raw)}
|
||
(bdir / f"switch-{ts}.meta.json").write_text(_json.dumps(meta, indent=2))
|
||
_prune_backups(bdir)
|
||
log.info(f"Switch backup saved: {fname} ({len(raw)} bytes) reason={reason}")
|
||
return {"ok": True, "file": fname, "size": len(raw), "timestamp": ts}
|
||
except Exception as e:
|
||
log.warning(f"Switch backup failed: {e}")
|
||
return {"ok": False, "error": str(e)}
|
||
|
||
|
||
# ── Pre-change backup (called automatically before any push) ─────────
|
||
|
||
def _pre_change_backup(reason: str) -> dict:
|
||
"""Backup both devices before making changes. Returns status for each."""
|
||
results = {"switch": None, "opnsense": None}
|
||
# Always backup switch
|
||
results["switch"] = _switch_backup(reason=reason)
|
||
# Backup OPNsense if configured
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key"):
|
||
results["opnsense"] = _opnsense_backup(cfg, reason=reason)
|
||
return results
|
||
|
||
|
||
# ── Connectivity safety check ────────────────────────────────────────
|
||
|
||
def _check_connectivity() -> dict:
|
||
"""Verify SSH reachability to switch and OPNsense. Non-destructive probe."""
|
||
result = {"switch": {"ok": False, "error": ""}, "opnsense": {"ok": False, "error": "", "configured": False}}
|
||
|
||
# Check switch
|
||
try:
|
||
conn = _pool.get()
|
||
transport = conn.get_transport()
|
||
if transport and transport.is_active():
|
||
transport.send_ignore()
|
||
result["switch"]["ok"] = True
|
||
else:
|
||
result["switch"]["error"] = "SSH transport not active"
|
||
except Exception as e:
|
||
result["switch"]["error"] = str(e)
|
||
|
||
# Check OPNsense (if configured)
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key"):
|
||
result["opnsense"]["configured"] = True
|
||
try:
|
||
_opnsense_request(cfg, "core/firmware/status")
|
||
result["opnsense"]["ok"] = True
|
||
except Exception as e:
|
||
result["opnsense"]["error"] = str(e)
|
||
if cfg.get("ssh_key_path"):
|
||
try:
|
||
test = _opnsense_ssh_test(cfg)
|
||
result["opnsense"]["ssh_ok"] = test.get("ok", False)
|
||
except Exception:
|
||
result["opnsense"]["ssh_ok"] = False
|
||
|
||
return result
|
||
|
||
|
||
# ── API endpoints ────────────────────────────────────────────────────
|
||
|
||
@app.get("/api/backup/list")
|
||
def backup_list():
|
||
"""List all available backups for both devices."""
|
||
backups = {"switch": [], "opnsense": []}
|
||
for device in ["switch", "opnsense"]:
|
||
bdir = BACKUP_DIR / device
|
||
if not bdir.exists():
|
||
continue
|
||
for meta_file in sorted(bdir.glob("*.meta.json"), reverse=True):
|
||
try:
|
||
meta = _json.loads(meta_file.read_text())
|
||
meta["exists"] = (bdir / meta["file"]).exists()
|
||
backups[device].append(meta)
|
||
except Exception:
|
||
continue
|
||
return backups
|
||
|
||
|
||
@app.post("/api/backup/create")
|
||
def backup_create(body: dict):
|
||
"""Manually trigger a backup of one or both devices."""
|
||
require_session(body.get("token", ""))
|
||
device = body.get("device", "both") # "switch", "opnsense", or "both"
|
||
reason = body.get("reason", "manual backup")
|
||
results = {}
|
||
if device in ("switch", "both"):
|
||
results["switch"] = _switch_backup(reason=reason)
|
||
if device in ("opnsense", "both"):
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key"):
|
||
results["opnsense"] = _opnsense_backup(cfg, reason=reason)
|
||
else:
|
||
results["opnsense"] = {"ok": False, "error": "OPNsense not configured"}
|
||
return results
|
||
|
||
|
||
@app.post("/api/backup/restore")
|
||
def backup_restore(body: dict):
|
||
"""Restore a backup to a device. Creates a new backup first as safety net."""
|
||
require_session(body.get("token", ""))
|
||
device = body.get("device", "")
|
||
filename = body.get("filename", "")
|
||
if not device or not filename:
|
||
raise HTTPException(400, "device and filename required")
|
||
if device not in ("switch", "opnsense"):
|
||
raise HTTPException(400, "device must be 'switch' or 'opnsense'")
|
||
|
||
# Safety: backup current state first
|
||
safety = _pre_change_backup(reason=f"pre-restore safety backup before restoring {filename}")
|
||
|
||
if device == "opnsense":
|
||
cfg = _load_opnsense_cfg()
|
||
result = _opnsense_restore(cfg, filename)
|
||
return {"result": result, "safety_backup": safety}
|
||
elif device == "switch":
|
||
# Switch restore = parse config and push commands
|
||
bdir = BACKUP_DIR / "switch"
|
||
fpath = bdir / filename
|
||
if not fpath.exists():
|
||
raise HTTPException(404, f"Backup file not found: {filename}")
|
||
return {
|
||
"result": {"ok": True, "note": "Switch config restore requires manual review. "
|
||
"Download the backup file and apply commands via Review & Push tab."},
|
||
"safety_backup": safety,
|
||
"config_preview": fpath.read_text()[:5000],
|
||
}
|
||
|
||
|
||
@app.get("/api/backup/download/{device}/{filename}")
|
||
def backup_download(device: str, filename: str):
|
||
"""Download a backup file."""
|
||
if device not in ("switch", "opnsense"):
|
||
raise HTTPException(400, "device must be 'switch' or 'opnsense'")
|
||
# Prevent path traversal
|
||
if "/" in filename or ".." in filename:
|
||
raise HTTPException(400, "Invalid filename")
|
||
fpath = BACKUP_DIR / device / filename
|
||
if not fpath.exists():
|
||
raise HTTPException(404, "Backup not found")
|
||
from fastapi.responses import FileResponse
|
||
return FileResponse(fpath, filename=filename)
|
||
|
||
|
||
@app.get("/api/connectivity/check")
|
||
def connectivity_check():
|
||
"""Check SSH/API reachability to both switch and OPNsense."""
|
||
return _check_connectivity()
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# UNIFIED NETWORK PROVISIONING — one operation for both devices
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
class UnifiedVlanProvision(BaseModel):
|
||
token: str
|
||
vlan_id: int
|
||
name: str
|
||
subnet: str # e.g. "192.168.60.0/24"
|
||
gateway: str # e.g. "192.168.60.1"
|
||
dhcp_start: str # e.g. "192.168.60.100"
|
||
dhcp_end: str # e.g. "192.168.60.200"
|
||
parent_if: str # OPNsense physical parent, e.g. "igb0"
|
||
opnsense_if: Optional[str] = ""
|
||
allow_internet: bool = True
|
||
# Port assignments
|
||
ports: list[dict] = [] # [{"port": 1, "poe": true}, {"port": 5, "poe": false}]
|
||
# Trunk uplink ports (these get the new VLAN tagged)
|
||
trunk_ports: list[int] = []
|
||
|
||
@field_validator("vlan_id")
|
||
@classmethod
|
||
def cv(cls, v):
|
||
vid = san_vid(v)
|
||
if vid in (1, 99):
|
||
raise ValueError("VLAN 1 and 99 are reserved")
|
||
return vid
|
||
@field_validator("name")
|
||
@classmethod
|
||
def cn(cls, v): return _san(v, _RE_VNAME, "name")
|
||
|
||
|
||
@app.post("/api/network/provision")
|
||
def unified_provision(body: UnifiedVlanProvision):
|
||
"""
|
||
Unified VLAN + port + OPNsense provisioning in one operation.
|
||
|
||
1. Pre-change backup of both devices
|
||
2. Connectivity check
|
||
3. Create VLAN on switch + assign ports + set PoE
|
||
4. Create VLAN on OPNsense + DHCP scope + firewall rule
|
||
5. Post-change connectivity verify
|
||
"""
|
||
import ipaddress as _ipaddr
|
||
require_session(body.token)
|
||
|
||
steps_done: list[str] = []
|
||
errors: list[str] = []
|
||
pending_steps: list[str] = []
|
||
|
||
# Validate addresses
|
||
try:
|
||
net = _ipaddr.ip_network(body.subnet, strict=False)
|
||
_ipaddr.ip_address(body.gateway)
|
||
_ipaddr.ip_address(body.dhcp_start)
|
||
_ipaddr.ip_address(body.dhcp_end)
|
||
except ValueError as e:
|
||
raise HTTPException(400, f"Invalid address: {e}")
|
||
|
||
# ── Step 0: Pre-change connectivity check ────────────────────────
|
||
conn = _check_connectivity()
|
||
if not conn["switch"]["ok"]:
|
||
raise HTTPException(503, f"Switch unreachable — aborting: {conn['switch']['error']}")
|
||
steps_done.append("connectivity: switch reachable")
|
||
|
||
# ── Step 1: Pre-change backup ────────────────────────────────────
|
||
backup = _pre_change_backup(reason=f"pre-provision VLAN {body.vlan_id} '{body.name}'")
|
||
if backup["switch"] and backup["switch"].get("ok"):
|
||
steps_done.append(f"backup: switch config saved ({backup['switch']['file']})")
|
||
else:
|
||
errors.append(f"backup: switch backup failed — {backup['switch'].get('error', 'unknown')}")
|
||
# Non-fatal but warn
|
||
if backup.get("opnsense") and backup["opnsense"].get("ok"):
|
||
steps_done.append(f"backup: OPNsense config saved ({backup['opnsense']['file']})")
|
||
|
||
# ── Step 2: Create VLAN on switch ────────────────────────────────
|
||
switch_cmds = [f'vlan create {body.vlan_id} name "{body.name}" type port']
|
||
|
||
# Assign access ports
|
||
for pa in body.ports:
|
||
p = san_port(pa["port"])
|
||
vid = body.vlan_id
|
||
switch_cmds += [
|
||
f"vlan members add {vid} {p}",
|
||
f"vlan pvid {p} {vid}",
|
||
]
|
||
iface = f"FastEthernet {p}" if p <= 48 else f"GigabitEthernet {p}"
|
||
if p <= 96:
|
||
switch_cmds.append(f"interface {iface}")
|
||
if pa.get("poe", True):
|
||
switch_cmds += [" poe enable", f" poe poe-limit {pa.get('poe_limit', 30000)}"]
|
||
else:
|
||
switch_cmds += [" no poe enable"]
|
||
|
||
# Add VLAN to trunk uplinks
|
||
for tp in body.trunk_ports:
|
||
tp = san_port(tp)
|
||
switch_cmds += [
|
||
f"vlan members add {body.vlan_id} {tp}",
|
||
f"vlan tagging {body.vlan_id} {tp}",
|
||
]
|
||
|
||
# Danger check before push
|
||
danger = check_danger(switch_cmds)
|
||
if danger["has_hard_block"]:
|
||
raise HTTPException(400, {
|
||
"message": "Hard-blocked commands detected",
|
||
"blocked": danger["hard_blocked"],
|
||
})
|
||
|
||
result = push_one_by_one(switch_cmds)
|
||
if result.get("success"):
|
||
steps_done.append(f"switch: VLAN {body.vlan_id} created, {len(body.ports)} ports assigned, "
|
||
f"{len(body.trunk_ports)} trunk ports updated")
|
||
else:
|
||
errors.append(f"switch: push failed at command {result.get('stopped_at', '?')}: "
|
||
f"{result.get('error', 'unknown')}")
|
||
# Return early — don't configure OPNsense for a VLAN the switch doesn't have
|
||
return {
|
||
"success": False, "steps_done": steps_done, "errors": errors,
|
||
"pending_steps": [], "backup": backup, "switch_result": result,
|
||
}
|
||
|
||
# ── Step 3: OPNsense VLAN + DHCP + firewall ─────────────────────
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("key"):
|
||
pending_steps += [
|
||
f"OPNsense: create VLAN tag {body.vlan_id} on {body.parent_if}",
|
||
f"OPNsense: assign interface, set IP {body.gateway}/{net.prefixlen}",
|
||
f"OPNsense: create DHCP scope {body.dhcp_start}–{body.dhcp_end}",
|
||
]
|
||
if body.allow_internet:
|
||
pending_steps.append("OPNsense: add allow-outbound firewall rule")
|
||
else:
|
||
# Create VLAN tag
|
||
try:
|
||
vlan_r = _opnsense_request(cfg, "interfaces/vlan_settings/addItem", "POST", {
|
||
"vlan": {"if": body.parent_if, "tag": str(body.vlan_id),
|
||
"pcp": "0", "descr": body.name}
|
||
})
|
||
_opnsense_request(cfg, "interfaces/vlan_settings/reconfigure", "POST")
|
||
steps_done.append(f"OPNsense: VLAN tag {body.vlan_id} created on {body.parent_if}")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense VLAN tag: {e}")
|
||
|
||
if body.opnsense_if:
|
||
# DHCP scope
|
||
try:
|
||
_opnsense_request(cfg, "dhcpv4/settings/addSubnet", "POST", {
|
||
"subnet": {
|
||
"interface": body.opnsense_if,
|
||
"subnet": str(net),
|
||
"gateway": body.gateway,
|
||
"dns_servers": body.gateway,
|
||
"range": {"from": body.dhcp_start, "to": body.dhcp_end},
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "dhcpv4/service/reconfigure", "POST")
|
||
steps_done.append(f"OPNsense: DHCP scope {body.dhcp_start}–{body.dhcp_end}")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense DHCP: {e}")
|
||
|
||
# Firewall rule
|
||
if body.allow_internet:
|
||
try:
|
||
_opnsense_request(cfg, "firewall/filter/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"interface": body.opnsense_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{body.opnsense_if}net"},
|
||
"destination": {"any": "1"},
|
||
"descr": f"Allow VLAN {body.vlan_id} {body.name} outbound",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
steps_done.append(f"OPNsense: allow-outbound firewall rule added")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense firewall: {e}")
|
||
|
||
# Persist mapping
|
||
vmap = _load_vlan_if_map()
|
||
vmap[str(body.vlan_id)] = body.opnsense_if
|
||
_save_vlan_if_map(vmap)
|
||
else:
|
||
pending_steps += [
|
||
f"OPNsense UI: assign {body.parent_if}.{body.vlan_id} as interface, "
|
||
f"set IP {body.gateway}/{net.prefixlen}",
|
||
f"Then re-run with opnsense_if set to create DHCP + firewall",
|
||
]
|
||
|
||
# ── Step 4: Post-change connectivity verify ──────────────────────
|
||
post_conn = _check_connectivity()
|
||
if not post_conn["switch"]["ok"]:
|
||
errors.append("POST-CHANGE WARNING: switch SSH connectivity lost! "
|
||
f"Backup available: {backup['switch'].get('file', 'N/A')}")
|
||
|
||
return {
|
||
"success": len(errors) == 0,
|
||
"steps_done": steps_done,
|
||
"pending_steps": pending_steps,
|
||
"errors": errors,
|
||
"backup": backup,
|
||
"switch_result": result,
|
||
"post_connectivity": post_conn,
|
||
}
|
||
|
||
|
||
# ── Wrap existing push to auto-backup ────────────────────────────────
|
||
|
||
_original_push = push_one_by_one
|
||
|
||
def push_one_by_one_with_backup(commands: list[str]) -> dict:
|
||
"""Wraps push_one_by_one to create a backup before pushing."""
|
||
backup = _pre_change_backup(reason=f"pre-push ({len(commands)} commands)")
|
||
result = _original_push(commands)
|
||
result["backup"] = backup
|
||
return result
|
||
|
||
# Monkey-patch: the push endpoint calls push_one_by_one directly
|
||
# We leave push_one_by_one as-is (it's used internally) and
|
||
# add the backup in the API endpoint wrapper below.
|
||
|
||
@app.post("/api/switch/push-safe")
|
||
def push_safe(body: PushBatch):
|
||
"""Push with automatic pre-change backup and post-change connectivity check."""
|
||
require_session(body.token)
|
||
|
||
# Danger check
|
||
danger = check_danger(body.commands)
|
||
if danger["has_hard_block"]:
|
||
raise HTTPException(400, {
|
||
"message": "Hard-blocked commands — must be run at console",
|
||
"blocked": danger["hard_blocked"],
|
||
})
|
||
|
||
# Pre-check
|
||
conn = _check_connectivity()
|
||
if not conn["switch"]["ok"]:
|
||
raise HTTPException(503, "Switch unreachable — refusing to push")
|
||
|
||
# Backup
|
||
backup = _pre_change_backup(reason=f"pre-push ({len(body.commands)} commands)")
|
||
|
||
# Push
|
||
result = push_one_by_one(body.commands)
|
||
|
||
# Post-check
|
||
post_conn = _check_connectivity()
|
||
if not post_conn["switch"]["ok"]:
|
||
result["connectivity_warning"] = (
|
||
"Switch SSH lost after push! "
|
||
f"Backup: {backup['switch'].get('file', 'N/A')}"
|
||
)
|
||
|
||
result["backup"] = backup
|
||
result["post_connectivity"] = post_conn
|
||
return result
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# FIREWALL POLICY MATRIX — inter-VLAN access control
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
POLICIES_FILE = _Path("/etc/switch-manager/vlan-policies.json")
|
||
|
||
# Policy types:
|
||
# "block" — deny all traffic between VLANs
|
||
# "allow" — permit all traffic between VLANs
|
||
# "one-way" — src VLAN can reach dst VLAN, but not reverse
|
||
# "services" — src can reach dst on specific ports only
|
||
# "printer" — other VLANs can print (reach ports 9100,631,443), printer can't initiate
|
||
|
||
POLICY_PRESETS = {
|
||
"block": {
|
||
"label": "Blocked",
|
||
"description": "No traffic allowed between these VLANs",
|
||
},
|
||
"allow": {
|
||
"label": "Full Access",
|
||
"description": "All traffic permitted between these VLANs",
|
||
},
|
||
"one-way": {
|
||
"label": "One-Way Access",
|
||
"description": "Source VLAN can reach destination, but not reverse",
|
||
},
|
||
"printer": {
|
||
"label": "Printer Access",
|
||
"description": "Other VLANs can reach printers (ports 9100/631/443/515), printers cannot initiate connections back",
|
||
"ports": [9100, 631, 443, 515],
|
||
},
|
||
"services": {
|
||
"label": "Service Ports Only",
|
||
"description": "Access limited to specified TCP/UDP ports",
|
||
},
|
||
}
|
||
|
||
|
||
def _load_policies() -> list:
|
||
if POLICIES_FILE.exists():
|
||
try: return _json.loads(POLICIES_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
|
||
def _save_policies(policies: list):
|
||
POLICIES_FILE.write_text(_json.dumps(policies, indent=2))
|
||
POLICIES_FILE.chmod(0o600)
|
||
|
||
|
||
def _build_policy_acls(policy: dict) -> dict:
|
||
"""
|
||
Generate switch ACL commands AND OPNsense firewall rule payloads for a policy.
|
||
|
||
Returns {switch_cmds: [...], opnsense_rules: [...], description: str}
|
||
"""
|
||
ptype = policy.get("type", "block")
|
||
src_vid = policy.get("src_vlan")
|
||
dst_vid = policy.get("dst_vlan")
|
||
ports = policy.get("ports", [])
|
||
src_sub = f"192.168.{src_vid}.0"
|
||
dst_sub = f"192.168.{dst_vid}.0"
|
||
mask = "0.0.0.255"
|
||
acl_name = f"POLICY-V{src_vid}-V{dst_vid}"
|
||
|
||
switch_cmds = []
|
||
opnsense_rules = []
|
||
|
||
if ptype == "block":
|
||
switch_cmds = [
|
||
f"ip access-list extended {acl_name}",
|
||
f" 1 deny ip {src_sub} {mask} {dst_sub} {mask}",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "block",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_sub}/{24}"},
|
||
"destination": {"network": f"{dst_sub}/24"},
|
||
"descr": f"Block VLAN {src_vid} → VLAN {dst_vid}",
|
||
}
|
||
})
|
||
|
||
elif ptype == "allow":
|
||
switch_cmds = [
|
||
f"ip access-list extended {acl_name}",
|
||
f" 1 permit ip {src_sub} {mask} {dst_sub} {mask}",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
# OPNsense: explicit allow (usually default, but good to be explicit)
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_sub}/24"},
|
||
"destination": {"network": f"{dst_sub}/24"},
|
||
"descr": f"Allow VLAN {src_vid} → VLAN {dst_vid}",
|
||
}
|
||
})
|
||
|
||
elif ptype == "one-way":
|
||
# Allow src→dst, block dst→src (reverse ACL on dst VLAN)
|
||
switch_cmds = [
|
||
f"ip access-list extended {acl_name}",
|
||
f" 1 permit ip {src_sub} {mask} {dst_sub} {mask}",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
f"ip access-list extended {acl_name}-REV",
|
||
f" 1 deny ip {dst_sub} {mask} {src_sub} {mask}",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {dst_vid}",
|
||
f" ip access-group {acl_name}-REV in",
|
||
]
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_sub}/24"},
|
||
"destination": {"network": f"{dst_sub}/24"},
|
||
"descr": f"Allow VLAN {src_vid} → VLAN {dst_vid} (one-way)",
|
||
}
|
||
})
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "block",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{dst_sub}/24"},
|
||
"destination": {"network": f"{src_sub}/24"},
|
||
"descr": f"Block VLAN {dst_vid} → VLAN {src_vid} (one-way reverse)",
|
||
}
|
||
})
|
||
|
||
elif ptype == "printer":
|
||
# Other VLANs can reach printer VLAN on print ports; printers can't initiate
|
||
printer_ports = ports or [9100, 631, 443, 515]
|
||
rule_num = 1
|
||
switch_cmds = [f"ip access-list extended {acl_name}"]
|
||
for port in printer_ports:
|
||
switch_cmds.append(
|
||
f" {rule_num} permit tcp {src_sub} {mask} {dst_sub} {mask} eq {port}")
|
||
rule_num += 1
|
||
switch_cmds += [
|
||
f" {rule_num} deny ip {src_sub} {mask} {dst_sub} {mask}",
|
||
f" {rule_num+1} permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
# Reverse: block printers from initiating to src VLAN
|
||
switch_cmds += [
|
||
f"ip access-list extended {acl_name}-REV",
|
||
f" 1 deny ip {dst_sub} {mask} {src_sub} {mask}",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {dst_vid}",
|
||
f" ip access-group {acl_name}-REV in",
|
||
]
|
||
# OPNsense rules
|
||
for port in printer_ports:
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"ipprotocol": "inet", "protocol": "tcp",
|
||
"source": {"network": f"{src_sub}/24"},
|
||
"destination": {"network": f"{dst_sub}/24", "port": str(port)},
|
||
"descr": f"VLAN {src_vid} → printer VLAN {dst_vid} port {port}",
|
||
}
|
||
})
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "block",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{dst_sub}/24"},
|
||
"destination": {"network": f"{src_sub}/24"},
|
||
"descr": f"Block printer VLAN {dst_vid} → VLAN {src_vid}",
|
||
}
|
||
})
|
||
|
||
elif ptype == "services":
|
||
rule_num = 1
|
||
switch_cmds = [f"ip access-list extended {acl_name}"]
|
||
for port in ports:
|
||
switch_cmds.append(
|
||
f" {rule_num} permit tcp {src_sub} {mask} {dst_sub} {mask} eq {port}")
|
||
rule_num += 1
|
||
switch_cmds += [
|
||
f" {rule_num} deny ip {src_sub} {mask} {dst_sub} {mask}",
|
||
f" {rule_num+1} permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
for port in ports:
|
||
opnsense_rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"ipprotocol": "inet", "protocol": "tcp",
|
||
"source": {"network": f"{src_sub}/24"},
|
||
"destination": {"network": f"{dst_sub}/24", "port": str(port)},
|
||
"descr": f"VLAN {src_vid} → VLAN {dst_vid} port {port}",
|
||
}
|
||
})
|
||
|
||
return {
|
||
"switch_cmds": switch_cmds,
|
||
"opnsense_rules": opnsense_rules,
|
||
"acl_name": acl_name,
|
||
"description": f"{POLICY_PRESETS.get(ptype,{}).get('label','Custom')} — "
|
||
f"VLAN {src_vid} → VLAN {dst_vid}",
|
||
}
|
||
|
||
|
||
@app.get("/api/firewall/policies")
|
||
def get_policies():
|
||
"""Return saved inter-VLAN policies and available presets."""
|
||
return {"policies": _load_policies(), "presets": POLICY_PRESETS}
|
||
|
||
|
||
@app.post("/api/firewall/policies")
|
||
def save_policy(body: dict):
|
||
"""Save or update an inter-VLAN policy."""
|
||
require_session(body.get("token", ""))
|
||
policy = body.get("policy", {})
|
||
if not policy.get("src_vlan") or not policy.get("dst_vlan") or not policy.get("type"):
|
||
raise HTTPException(400, "src_vlan, dst_vlan, and type required")
|
||
|
||
policies = _load_policies()
|
||
# Replace existing policy for this VLAN pair
|
||
policies = [p for p in policies
|
||
if not (p["src_vlan"] == policy["src_vlan"] and p["dst_vlan"] == policy["dst_vlan"])]
|
||
policies.append(policy)
|
||
_save_policies(policies)
|
||
return {"success": True, "policies": policies}
|
||
|
||
|
||
@app.delete("/api/firewall/policies")
|
||
def delete_policy(body: dict):
|
||
"""Remove an inter-VLAN policy."""
|
||
require_session(body.get("token", ""))
|
||
src = body.get("src_vlan")
|
||
dst = body.get("dst_vlan")
|
||
policies = _load_policies()
|
||
policies = [p for p in policies if not (p["src_vlan"] == src and p["dst_vlan"] == dst)]
|
||
_save_policies(policies)
|
||
return {"success": True, "policies": policies}
|
||
|
||
|
||
@app.post("/api/firewall/preview")
|
||
def preview_policy(body: dict):
|
||
"""Preview generated ACLs/rules for a policy without pushing."""
|
||
policy = body.get("policy", {})
|
||
if not policy.get("src_vlan") or not policy.get("dst_vlan") or not policy.get("type"):
|
||
raise HTTPException(400, "src_vlan, dst_vlan, and type required")
|
||
return _build_policy_acls(policy)
|
||
|
||
|
||
@app.post("/api/firewall/push")
|
||
def push_policy(body: dict):
|
||
"""Push a firewall policy to both switch and OPNsense."""
|
||
require_session(body.get("token", ""))
|
||
policy = body.get("policy", {})
|
||
if not policy.get("src_vlan") or not policy.get("dst_vlan") or not policy.get("type"):
|
||
raise HTTPException(400, "src_vlan, dst_vlan, and type required")
|
||
|
||
generated = _build_policy_acls(policy)
|
||
steps_done = []
|
||
errors = []
|
||
|
||
# Pre-backup
|
||
backup = _pre_change_backup(
|
||
reason=f"pre-policy VLAN {policy['src_vlan']}→{policy['dst_vlan']} ({policy['type']})")
|
||
|
||
# Push switch ACLs
|
||
if generated["switch_cmds"]:
|
||
danger = check_danger(generated["switch_cmds"])
|
||
if danger["has_hard_block"]:
|
||
raise HTTPException(400, {"message": "Hard-blocked", "blocked": danger["hard_blocked"]})
|
||
result = push_one_by_one(generated["switch_cmds"])
|
||
if result.get("success"):
|
||
steps_done.append(f"switch: ACL {generated['acl_name']} applied")
|
||
else:
|
||
errors.append(f"switch: {result.get('error', 'push failed')}")
|
||
|
||
# Push OPNsense rules
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key") and generated["opnsense_rules"]:
|
||
vmap = _load_vlan_if_map()
|
||
src_if = vmap.get(str(policy["src_vlan"]), "")
|
||
for rule_data in generated["opnsense_rules"]:
|
||
if src_if:
|
||
rule_data["rule"]["interface"] = src_if
|
||
rule_data["rule"]["direction"] = "in"
|
||
try:
|
||
_opnsense_request(cfg, "firewall/filter/addRule", "POST", rule_data)
|
||
steps_done.append(f"OPNsense: {rule_data['rule']['descr']}")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense: {e}")
|
||
try:
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
steps_done.append("OPNsense: firewall rules applied")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense apply: {e}")
|
||
|
||
# Save policy to local state
|
||
policies = _load_policies()
|
||
policies = [p for p in policies
|
||
if not (p["src_vlan"] == policy["src_vlan"] and p["dst_vlan"] == policy["dst_vlan"])]
|
||
policy["pushed"] = True
|
||
policy["pushed_at"] = _ts()
|
||
policies.append(policy)
|
||
_save_policies(policies)
|
||
|
||
return {
|
||
"success": len(errors) == 0,
|
||
"steps_done": steps_done,
|
||
"errors": errors,
|
||
"backup": backup,
|
||
"generated": generated,
|
||
}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# SERVICE ACCESS — manage Caddy config + OPNsense port forwards + NAT reflection
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
#
|
||
# Architecture:
|
||
# Caddy runs on the LAN management computer. It is the reverse proxy for
|
||
# all services — only port 443 is forwarded from WAN, and Caddy routes
|
||
# by hostname (SNI) to the correct backend. Service ports (32400, 8123,
|
||
# etc.) are NEVER exposed on WAN.
|
||
#
|
||
# For LAN devices: they reach services directly via Caddy on the LAN.
|
||
# For isolated VLANs (IoT, Guest, etc.): they use the public FQDN
|
||
# (e.g. plex.mydomain.com). OPNsense NAT reflection handles this
|
||
# internally — traffic never actually leaves the network. The isolated
|
||
# VLAN device is treated exactly like an external user.
|
||
#
|
||
# This preserves full VLAN isolation. No pinholes, no cross-VLAN access.
|
||
# IoT = untrusted = same access as someone on the internet.
|
||
|
||
SERVICES_FILE = _Path("/etc/switch-manager/service-proxies.json")
|
||
CADDYFILE_EXTRA = _Path("/etc/switch-manager/Caddyfile.services")
|
||
|
||
def _load_services() -> list:
|
||
if SERVICES_FILE.exists():
|
||
try: return _json.loads(SERVICES_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
def _save_services(services: list):
|
||
SERVICES_FILE.write_text(_json.dumps(services, indent=2))
|
||
SERVICES_FILE.chmod(0o600)
|
||
|
||
|
||
def _generate_caddyfile_services(services: list) -> str:
|
||
"""Generate Caddyfile blocks for the LAN management computer's Caddy.
|
||
|
||
Each service FQDN gets a reverse_proxy block. Caddy handles TLS
|
||
termination and routes by hostname. Only port 443 needs to be
|
||
forwarded from WAN to this machine.
|
||
"""
|
||
blocks = ["# Auto-generated by switch-manager — service reverse proxy entries\n",
|
||
"# Add to your Caddyfile or use: import /etc/switch-manager/Caddyfile.services\n"]
|
||
for svc in services:
|
||
fqdn = svc.get("fqdn", "")
|
||
backend_url = svc.get("backend_url", "")
|
||
if not fqdn or not backend_url:
|
||
continue
|
||
blocks.append(f"{fqdn} {{")
|
||
blocks.append(f" reverse_proxy {backend_url}")
|
||
blocks.append(f"}}\n")
|
||
return "\n".join(blocks)
|
||
|
||
|
||
@app.get("/api/services")
|
||
def get_services():
|
||
"""List configured service proxies."""
|
||
return {"services": _load_services()}
|
||
|
||
|
||
@app.post("/api/services")
|
||
def save_service(body: dict):
|
||
"""Add or update a service proxy entry."""
|
||
require_session(body.get("token", ""))
|
||
svc = body.get("service", {})
|
||
if not svc.get("fqdn") or not svc.get("backend_url"):
|
||
raise HTTPException(400, "fqdn and backend_url required")
|
||
|
||
services = _load_services()
|
||
services = [s for s in services if s["fqdn"] != svc["fqdn"]]
|
||
services.append(svc)
|
||
_save_services(services)
|
||
return {"success": True, "services": services}
|
||
|
||
|
||
@app.delete("/api/services")
|
||
def delete_service(body: dict):
|
||
"""Remove a service proxy entry."""
|
||
require_session(body.get("token", ""))
|
||
fqdn = body.get("fqdn", "")
|
||
services = _load_services()
|
||
services = [s for s in services if s["fqdn"] != fqdn]
|
||
_save_services(services)
|
||
return {"success": True, "services": services}
|
||
|
||
|
||
SERVICES_RULE_FILE = _Path("/etc/switch-manager/service-nat-rules.json")
|
||
|
||
def _load_service_rules() -> dict:
|
||
"""Load tracked OPNsense NAT rule UUIDs for service port forwards."""
|
||
if SERVICES_RULE_FILE.exists():
|
||
try: return _json.loads(SERVICES_RULE_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_service_rules(rules: dict):
|
||
SERVICES_RULE_FILE.write_text(_json.dumps(rules, indent=2))
|
||
SERVICES_RULE_FILE.chmod(0o600)
|
||
|
||
|
||
def _get_mgmt_ip() -> str:
|
||
"""Best-effort detection of management computer LAN IP."""
|
||
import socket as _sock
|
||
try:
|
||
s = _sock.socket(_sock.AF_INET, _sock.SOCK_DGRAM)
|
||
s.connect(("8.8.8.8", 80))
|
||
ip = s.getsockname()[0]
|
||
s.close()
|
||
return ip
|
||
except Exception:
|
||
return ""
|
||
|
||
|
||
@app.get("/api/services/status")
|
||
def services_status():
|
||
"""Full status check: Caddy import, NAT reflection, port forward, services."""
|
||
services = _load_services()
|
||
cfg = _load_opnsense_cfg()
|
||
result = {
|
||
"services": services,
|
||
"mgmt_ip": _get_mgmt_ip(),
|
||
"caddy_file_exists": CADDYFILE_EXTRA.exists(),
|
||
"nat_reflection": None,
|
||
"port_forward_443": None,
|
||
"opnsense_configured": bool(cfg.get("key")),
|
||
"opnsense_ssh": bool(cfg.get("ssh_key_path")),
|
||
}
|
||
|
||
# Check NAT reflection
|
||
if cfg.get("ssh_key_path"):
|
||
try:
|
||
out, _, _ = _opnsense_ssh_run(cfg,
|
||
"grep -c 'enablenatreflectionhelper' /conf/config.xml 2>/dev/null || echo 0")
|
||
result["nat_reflection"] = "1" in out.strip() or (out.strip().isdigit() and int(out.strip()) > 0)
|
||
except Exception as e:
|
||
result["nat_reflection_error"] = str(e)
|
||
|
||
# Check for existing WAN port forward to 443
|
||
if cfg.get("key"):
|
||
try:
|
||
nat_rules = _opnsense_request(cfg, "firewall/source_nat/searchRule")
|
||
# OPNsense 24+ uses source_nat; older uses legacy — try both
|
||
except Exception:
|
||
nat_rules = {}
|
||
if not nat_rules:
|
||
try:
|
||
nat_rules = _opnsense_request(cfg, "firewall/filter/searchRule")
|
||
except Exception:
|
||
nat_rules = {}
|
||
# We can't reliably parse NAT rules from the filter API —
|
||
# mark as "needs verification" unless we've created one ourselves
|
||
tracked = _load_service_rules()
|
||
result["port_forward_443"] = bool(tracked.get("wan_443_uuid"))
|
||
result["tracked_rules"] = tracked
|
||
|
||
return result
|
||
|
||
|
||
@app.post("/api/services/enable-nat-reflection")
|
||
def enable_nat_reflection(body: dict):
|
||
"""Enable NAT reflection on OPNsense via SSH (modifies config.xml)."""
|
||
require_session(body.get("token", ""))
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("ssh_key_path"):
|
||
raise HTTPException(503, "OPNsense SSH not configured")
|
||
|
||
backup = _pre_change_backup(reason="pre-NAT-reflection-enable")
|
||
|
||
# OPNsense stores NAT reflection settings in /conf/config.xml under <system>
|
||
# The cleanest way is via the API if available, or configctl
|
||
try:
|
||
# Try the OPNsense API approach first (Firewall > Settings)
|
||
# The setting is under system > disablenatreflection (absent = enabled)
|
||
# and system > enablenatreflectionhelper (present = enabled)
|
||
out, err, code = _opnsense_ssh_run(cfg, (
|
||
"configctl firmware configure 2>/dev/null; "
|
||
"echo 'NAT reflection: checking current state'; "
|
||
"grep -c 'enablenatreflectionhelper' /conf/config.xml 2>/dev/null || echo 0"
|
||
))
|
||
already_enabled = "1" in out.strip().split('\n')[-1]
|
||
if already_enabled:
|
||
return {"success": True, "already_enabled": True, "backup": backup}
|
||
|
||
# Enable via configctl / direct XML edit
|
||
# OPNsense 24+: use pluginctl or direct config edit
|
||
cmds = [
|
||
# Add enablenatreflectionhelper if not present
|
||
"sed -i '' '/<\\/system>/i\\ <enablenatreflectionhelper>1<\\/enablenatreflectionhelper>' /conf/config.xml 2>/dev/null || "
|
||
"sed -i '/<\\/system>/i\\ <enablenatreflectionhelper>1<\\/enablenatreflectionhelper>' /conf/config.xml",
|
||
# Remove disablenatreflection if present
|
||
"sed -i '' '/<disablenatreflection>/d' /conf/config.xml 2>/dev/null || "
|
||
"sed -i '/<disablenatreflection>/d' /conf/config.xml",
|
||
# Reload filter
|
||
"configctl filter reload",
|
||
]
|
||
for cmd in cmds:
|
||
_opnsense_ssh_run(cfg, cmd)
|
||
|
||
# Verify
|
||
out, _, _ = _opnsense_ssh_run(cfg,
|
||
"grep -c 'enablenatreflectionhelper' /conf/config.xml 2>/dev/null || echo 0")
|
||
enabled = "1" in out.strip() or (out.strip().isdigit() and int(out.strip()) > 0)
|
||
|
||
return {"success": enabled, "backup": backup,
|
||
"note": "Firewall filter reloaded" if enabled else "May need manual verification"}
|
||
except Exception as e:
|
||
raise HTTPException(500, f"NAT reflection enable failed: {e}")
|
||
|
||
|
||
@app.post("/api/services/create-port-forward")
|
||
def create_wan_port_forward(body: dict):
|
||
"""
|
||
Create WAN port forward: TCP 443 → management computer (Caddy).
|
||
|
||
Uses OPNsense firewall NAT API. Only creates the rule if we haven't
|
||
already (tracked by UUID in service-nat-rules.json).
|
||
"""
|
||
require_session(body.get("token", ""))
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("key"):
|
||
raise HTTPException(503, "OPNsense API not configured")
|
||
|
||
mgmt_ip = body.get("mgmt_ip", _get_mgmt_ip())
|
||
if not mgmt_ip:
|
||
raise HTTPException(400, "Cannot determine management computer IP — provide mgmt_ip")
|
||
|
||
tracked = _load_service_rules()
|
||
if tracked.get("wan_443_uuid"):
|
||
return {"success": True, "already_exists": True, "uuid": tracked["wan_443_uuid"],
|
||
"mgmt_ip": mgmt_ip}
|
||
|
||
backup = _pre_change_backup(reason="pre-WAN-port-forward-443")
|
||
|
||
try:
|
||
# Create NAT port forward rule: WAN TCP 443 → mgmt_ip:443
|
||
r = _opnsense_request(cfg, "firewall/source_nat/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1",
|
||
"interface": "wan",
|
||
"protocol": "tcp",
|
||
"source": {"any": "1"},
|
||
"destination": {"any": "1", "port": "443"},
|
||
"target": {"address": mgmt_ip, "port": "443"},
|
||
"descr": "switch-manager: WAN 443 → Caddy reverse proxy",
|
||
"nordr": "0",
|
||
}
|
||
})
|
||
uuid = r.get("uuid", "")
|
||
|
||
# If source_nat didn't work, try legacy firewall NAT API
|
||
if not uuid:
|
||
# OPNsense legacy NAT — different endpoint
|
||
r = _opnsense_request(cfg, "firewall/filter/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1",
|
||
"action": "pass",
|
||
"interface": "wan",
|
||
"direction": "in",
|
||
"ipprotocol": "inet",
|
||
"protocol": "tcp",
|
||
"source": {"any": "1"},
|
||
"destination": {"address": mgmt_ip, "port": "443"},
|
||
"descr": "switch-manager: allow WAN → Caddy:443 (pair with NAT rule)",
|
||
}
|
||
})
|
||
uuid = r.get("uuid", "")
|
||
|
||
# Apply changes
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
|
||
tracked["wan_443_uuid"] = uuid
|
||
tracked["mgmt_ip"] = mgmt_ip
|
||
_save_service_rules(tracked)
|
||
|
||
return {"success": True, "uuid": uuid, "mgmt_ip": mgmt_ip, "backup": backup,
|
||
"note": "If this is the first time, also verify in OPNsense UI: "
|
||
"Firewall > NAT > Port Forward that the rule looks correct. "
|
||
"The OPNsense NAT API varies between versions."}
|
||
except Exception as e:
|
||
raise HTTPException(500, f"Port forward creation failed: {e}")
|
||
|
||
|
||
@app.post("/api/services/deploy")
|
||
def deploy_services(body: dict):
|
||
"""
|
||
Full deploy: write Caddyfile, reload Caddy, ensure NAT reflection
|
||
and port forward are configured on OPNsense.
|
||
|
||
Steps:
|
||
1. Pre-change backup
|
||
2. Write Caddyfile.services with reverse proxy entries
|
||
3. Reload Caddy (docker compose exec or systemctl)
|
||
4. Check/enable NAT reflection on OPNsense
|
||
5. Check/create WAN port forward 443 → Caddy
|
||
6. Return status of each step
|
||
"""
|
||
require_session(body.get("token", ""))
|
||
services = _load_services()
|
||
if not services:
|
||
raise HTTPException(400, "No services configured")
|
||
|
||
steps_done = []
|
||
errors = []
|
||
pending_steps = []
|
||
|
||
backup = _pre_change_backup(reason="pre-service-deploy")
|
||
|
||
mgmt_ip = body.get("mgmt_ip", _get_mgmt_ip())
|
||
|
||
# ── Step 1: Write Caddyfile.services ─────────────────────────────
|
||
caddy_content = _generate_caddyfile_services(services)
|
||
try:
|
||
CADDYFILE_EXTRA.write_text(caddy_content)
|
||
steps_done.append(f"Wrote Caddyfile.services ({len(services)} services)")
|
||
except Exception as e:
|
||
errors.append(f"Caddyfile write: {e}")
|
||
|
||
# ── Step 2: Reload Caddy ─────────────────────────────────────────
|
||
import subprocess as _sp
|
||
caddy_reloaded = False
|
||
# Try docker compose first
|
||
try:
|
||
r = _sp.run(["docker", "compose", "exec", "caddy", "caddy", "reload",
|
||
"--config", "/etc/caddy/Caddyfile"],
|
||
capture_output=True, text=True, timeout=15,
|
||
cwd=str(_Path(__file__).parent))
|
||
if r.returncode == 0:
|
||
steps_done.append("Caddy reloaded via docker compose")
|
||
caddy_reloaded = True
|
||
else:
|
||
# Try docker exec with container name pattern
|
||
r2 = _sp.run(["docker", "compose", "restart", "caddy"],
|
||
capture_output=True, text=True, timeout=30,
|
||
cwd=str(_Path(__file__).parent))
|
||
if r2.returncode == 0:
|
||
steps_done.append("Caddy restarted via docker compose")
|
||
caddy_reloaded = True
|
||
else:
|
||
errors.append(f"Docker caddy reload failed: {r.stderr.strip()}")
|
||
except Exception:
|
||
pass
|
||
|
||
if not caddy_reloaded:
|
||
# Try systemctl
|
||
try:
|
||
r = _sp.run(["systemctl", "reload", "caddy"],
|
||
capture_output=True, text=True, timeout=10)
|
||
if r.returncode == 0:
|
||
steps_done.append("Caddy reloaded via systemctl")
|
||
caddy_reloaded = True
|
||
except Exception:
|
||
pass
|
||
|
||
if not caddy_reloaded:
|
||
pending_steps.append(
|
||
"Reload Caddy manually: docker compose restart caddy "
|
||
"(or: systemctl reload caddy)")
|
||
|
||
# ── Step 3: NAT reflection ───────────────────────────────────────
|
||
cfg = _load_opnsense_cfg()
|
||
nat_status = None
|
||
if cfg.get("ssh_key_path"):
|
||
try:
|
||
out, _, _ = _opnsense_ssh_run(cfg,
|
||
"grep -c 'enablenatreflectionhelper' /conf/config.xml 2>/dev/null || echo 0")
|
||
nat_enabled = "1" in out.strip() or (out.strip().isdigit() and int(out.strip()) > 0)
|
||
nat_status = nat_enabled
|
||
if nat_enabled:
|
||
steps_done.append("NAT reflection: already enabled")
|
||
else:
|
||
pending_steps.append(
|
||
"Enable NAT reflection: OPNsense > Firewall > Settings > Advanced > "
|
||
"Reflection for port forwards = Enable. "
|
||
"Or use the 'Enable NAT Reflection' button above.")
|
||
except Exception as e:
|
||
errors.append(f"NAT reflection check: {e}")
|
||
else:
|
||
pending_steps.append("Configure OPNsense SSH to auto-check NAT reflection")
|
||
|
||
# ── Step 4: WAN port forward ─────────────────────────────────────
|
||
tracked = _load_service_rules()
|
||
if tracked.get("wan_443_uuid"):
|
||
steps_done.append(f"WAN port forward 443 → {tracked.get('mgmt_ip', mgmt_ip)}:443 (tracked)")
|
||
else:
|
||
pending_steps.append(
|
||
f"Create WAN port forward: OPNsense > Firewall > NAT > Port Forward — "
|
||
f"WAN TCP 443 → {mgmt_ip}:443 (Caddy). "
|
||
f"Or use the 'Create Port Forward' button above.")
|
||
|
||
return {
|
||
"success": len(errors) == 0,
|
||
"steps_done": steps_done,
|
||
"pending_steps": pending_steps,
|
||
"errors": errors,
|
||
"backup": backup,
|
||
"caddy_content": caddy_content,
|
||
"mgmt_ip": mgmt_ip,
|
||
"nat_reflection_enabled": nat_status,
|
||
}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# NTFY ALERTS — push notifications for network events
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
NTFY_FILE = _Path("/etc/switch-manager/ntfy.json")
|
||
|
||
def _load_ntfy_cfg() -> dict:
|
||
if NTFY_FILE.exists():
|
||
try: return _json.loads(NTFY_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_ntfy_cfg(cfg: dict):
|
||
NTFY_FILE.write_text(_json.dumps(cfg, indent=2))
|
||
NTFY_FILE.chmod(0o600)
|
||
|
||
|
||
def _ntfy_send(title: str, message: str, priority: str = "default", tags: str = ""):
|
||
"""Send a notification via ntfy. Non-blocking, fire-and-forget."""
|
||
cfg = _load_ntfy_cfg()
|
||
url = cfg.get("url", "")
|
||
topic = cfg.get("topic", "")
|
||
if not url or not topic:
|
||
return
|
||
try:
|
||
full_url = f"{url.rstrip('/')}/{topic}"
|
||
headers = {
|
||
"Title": title,
|
||
"Priority": priority,
|
||
}
|
||
if tags:
|
||
headers["Tags"] = tags
|
||
token = cfg.get("token", "")
|
||
if token:
|
||
headers["Authorization"] = f"Bearer {token}"
|
||
data = message.encode("utf-8")
|
||
req = _urlreq.Request(full_url, data=data, headers=headers, method="POST")
|
||
ctx = _ssl.create_default_context()
|
||
ctx.check_hostname = False
|
||
ctx.verify_mode = _ssl.CERT_NONE
|
||
_urlreq.urlopen(req, timeout=5, context=ctx)
|
||
log.info(f"ntfy alert sent: {title}")
|
||
except Exception as e:
|
||
log.warning(f"ntfy send failed: {e}")
|
||
|
||
|
||
@app.get("/api/alerts/config")
|
||
def get_ntfy_config():
|
||
"""Return ntfy configuration (without token)."""
|
||
cfg = _load_ntfy_cfg()
|
||
return {
|
||
"url": cfg.get("url", ""),
|
||
"topic": cfg.get("topic", ""),
|
||
"has_token": bool(cfg.get("token", "")),
|
||
"enabled": cfg.get("enabled", False),
|
||
"events": cfg.get("events", {
|
||
"connectivity_lost": True,
|
||
"backup_failed": True,
|
||
"push_failed": True,
|
||
"poe_budget_warning": True,
|
||
"port_down": False,
|
||
}),
|
||
}
|
||
|
||
|
||
@app.post("/api/alerts/config")
|
||
def save_ntfy_config(body: dict):
|
||
"""Save ntfy configuration."""
|
||
require_session(body.get("token_session", body.get("token", "")))
|
||
cfg = {
|
||
"url": body.get("url", "https://ntfy.sh"),
|
||
"topic": body.get("topic", ""),
|
||
"token": body.get("ntfy_token", ""),
|
||
"enabled": body.get("enabled", False),
|
||
"events": body.get("events", {}),
|
||
}
|
||
_save_ntfy_cfg(cfg)
|
||
return {"success": True}
|
||
|
||
|
||
@app.post("/api/alerts/test")
|
||
def test_ntfy(body: dict):
|
||
"""Send a test notification."""
|
||
require_session(body.get("token", ""))
|
||
_ntfy_send(
|
||
title="Switch Manager Test",
|
||
message="If you see this, ntfy alerts are working!",
|
||
priority="low",
|
||
tags="white_check_mark,test_tube",
|
||
)
|
||
return {"success": True}
|
||
|
||
|
||
# ── Alert integration into polling ───────────────────────────────────
|
||
|
||
_last_alert_state: dict = {}
|
||
|
||
def _check_and_alert():
|
||
"""Called from the poll loop to detect alertable conditions."""
|
||
cfg = _load_ntfy_cfg()
|
||
if not cfg.get("enabled"):
|
||
return
|
||
events = cfg.get("events", {})
|
||
global _last_alert_state
|
||
|
||
with _cache_lock:
|
||
poll_err = _cache.get("poll_error")
|
||
port_status = _cache.get("port_status", "")
|
||
poe_status = _cache.get("poe_status", "")
|
||
|
||
# Connectivity lost
|
||
if events.get("connectivity_lost") and poll_err:
|
||
if not _last_alert_state.get("conn_lost"):
|
||
_ntfy_send("Switch Offline", f"Cannot reach switch: {poll_err}",
|
||
priority="urgent", tags="rotating_light,warning")
|
||
_last_alert_state["conn_lost"] = True
|
||
else:
|
||
if _last_alert_state.get("conn_lost"):
|
||
_ntfy_send("Switch Back Online", "Connectivity restored",
|
||
priority="default", tags="white_check_mark")
|
||
_last_alert_state["conn_lost"] = False
|
||
|
||
# PoE budget warning (parse from poe_status if available)
|
||
if events.get("poe_budget_warning") and poe_status:
|
||
import re as _re_alert
|
||
watts_match = _re_alert.findall(r'(\d+)\s*[Ww]atts?\s*(used|consumed)', poe_status)
|
||
budget_match = _re_alert.findall(r'(\d+)\s*[Ww]atts?\s*(available|budget|maximum)', poe_status)
|
||
if watts_match and budget_match:
|
||
try:
|
||
used = int(watts_match[0][0])
|
||
budget = int(budget_match[0][0])
|
||
pct = (used / budget * 100) if budget > 0 else 0
|
||
if pct > 85 and not _last_alert_state.get("poe_warn"):
|
||
_ntfy_send("PoE Budget Warning",
|
||
f"PoE usage at {pct:.0f}% ({used}W / {budget}W)",
|
||
priority="high", tags="zap,warning")
|
||
_last_alert_state["poe_warn"] = True
|
||
elif pct <= 80:
|
||
_last_alert_state["poe_warn"] = False
|
||
except (ValueError, IndexError):
|
||
pass
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# SCHEDULED OPERATIONS — cron-like scheduler for backups and VLAN ops
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
SCHEDULES_FILE = _Path("/etc/switch-manager/schedules.json")
|
||
_scheduler_thread = None
|
||
|
||
def _load_schedules() -> list:
|
||
if SCHEDULES_FILE.exists():
|
||
try: return _json.loads(SCHEDULES_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
def _save_schedules(schedules: list):
|
||
SCHEDULES_FILE.write_text(_json.dumps(schedules, indent=2))
|
||
SCHEDULES_FILE.chmod(0o600)
|
||
|
||
|
||
def _should_run_now(schedule: dict) -> bool:
|
||
"""Check if a schedule should run based on current time and its cron-like fields."""
|
||
now = _dt.datetime.now()
|
||
hour = schedule.get("hour", "*")
|
||
minute = schedule.get("minute", "0")
|
||
days = schedule.get("days", "*") # "mon,tue,wed" or "*"
|
||
|
||
if hour != "*" and now.hour != int(hour):
|
||
return False
|
||
if minute != "*" and now.minute != int(minute):
|
||
return False
|
||
if days != "*":
|
||
day_names = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"]
|
||
today = day_names[now.weekday()]
|
||
if today not in days.lower().split(","):
|
||
return False
|
||
return True
|
||
|
||
|
||
def _run_scheduled_task(schedule: dict):
|
||
"""Execute a scheduled task."""
|
||
action = schedule.get("action", "")
|
||
name = schedule.get("name", "unnamed")
|
||
log.info(f"Scheduler: running '{name}' (action={action})")
|
||
|
||
try:
|
||
if action == "backup":
|
||
device = schedule.get("device", "both")
|
||
result = {}
|
||
if device in ("switch", "both"):
|
||
result["switch"] = _switch_backup(reason=f"scheduled: {name}")
|
||
if device in ("opnsense", "both"):
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key"):
|
||
result["opnsense"] = _opnsense_backup(cfg, reason=f"scheduled: {name}")
|
||
log.info(f"Scheduled backup '{name}': {result}")
|
||
_ntfy_send(f"Scheduled Backup: {name}",
|
||
f"Switch: {'OK' if result.get('switch',{}).get('ok') else 'FAIL'}, "
|
||
f"OPNsense: {'OK' if result.get('opnsense',{}).get('ok') else 'N/A'}",
|
||
tags="floppy_disk")
|
||
|
||
elif action == "connectivity_check":
|
||
conn = _check_connectivity()
|
||
if not conn["switch"]["ok"]:
|
||
_ntfy_send("Scheduled Check: Switch Offline",
|
||
f"Switch unreachable: {conn['switch'].get('error','')}",
|
||
priority="urgent", tags="rotating_light")
|
||
|
||
elif action == "vlan_enable":
|
||
# Re-enable a VLAN's internet access on OPNsense by adding allow-out rule
|
||
vlan_id = schedule.get("vlan_id")
|
||
vlan_name = schedule.get("vlan_name", f"VLAN {vlan_id}")
|
||
cfg = _load_opnsense_cfg()
|
||
vmap = _load_vlan_if_map()
|
||
iface = vmap.get(str(vlan_id), "")
|
||
if cfg.get("key") and iface:
|
||
try:
|
||
r = _opnsense_request(cfg, "firewall/filter/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"interface": iface, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{iface}net"},
|
||
"destination": {"any": "1"},
|
||
"descr": f"Scheduled: allow {vlan_name} outbound",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
# Track the rule UUID for later disable
|
||
_vlan_schedule_rules = _load_vlan_schedule_rules()
|
||
_vlan_schedule_rules[str(vlan_id)] = r.get("uuid", "")
|
||
_save_vlan_schedule_rules(_vlan_schedule_rules)
|
||
log.info(f"Scheduled VLAN enable: {vlan_name} ({vlan_id})")
|
||
_ntfy_send(f"VLAN Enabled: {vlan_name}",
|
||
f"Internet access restored for {vlan_name} (scheduled)",
|
||
tags="white_check_mark,globe_with_meridians")
|
||
except Exception as e:
|
||
log.warning(f"VLAN enable failed: {e}")
|
||
_ntfy_send(f"VLAN Enable Failed: {vlan_name}", str(e),
|
||
priority="high", tags="x")
|
||
|
||
elif action == "vlan_disable":
|
||
# Disable a VLAN's internet access by removing allow-out rule
|
||
vlan_id = schedule.get("vlan_id")
|
||
vlan_name = schedule.get("vlan_name", f"VLAN {vlan_id}")
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key"):
|
||
_vlan_schedule_rules = _load_vlan_schedule_rules()
|
||
uuid = _vlan_schedule_rules.get(str(vlan_id), "")
|
||
if uuid:
|
||
try:
|
||
_opnsense_request(cfg, f"firewall/filter/delRule/{uuid}", "POST")
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
_vlan_schedule_rules.pop(str(vlan_id), None)
|
||
_save_vlan_schedule_rules(_vlan_schedule_rules)
|
||
log.info(f"Scheduled VLAN disable: {vlan_name} ({vlan_id})")
|
||
_ntfy_send(f"VLAN Disabled: {vlan_name}",
|
||
f"Internet access blocked for {vlan_name} (scheduled)",
|
||
tags="no_entry,moon")
|
||
except Exception as e:
|
||
log.warning(f"VLAN disable failed: {e}")
|
||
_ntfy_send(f"VLAN Disable Failed: {vlan_name}", str(e),
|
||
priority="high", tags="x")
|
||
else:
|
||
# No tracked rule — try to find and disable by description
|
||
log.warning(f"No tracked rule UUID for VLAN {vlan_id} — "
|
||
f"block rule must be added manually or via firewall policy")
|
||
|
||
except Exception as e:
|
||
log.warning(f"Scheduled task '{name}' failed: {e}")
|
||
_ntfy_send(f"Scheduled Task Failed: {name}", str(e),
|
||
priority="high", tags="x")
|
||
|
||
|
||
# VLAN schedule rule tracking (which firewall rules we created for enable/disable)
|
||
VLAN_SCHED_RULES_FILE = _Path("/etc/switch-manager/vlan-schedule-rules.json")
|
||
|
||
def _load_vlan_schedule_rules() -> dict:
|
||
if VLAN_SCHED_RULES_FILE.exists():
|
||
try: return _json.loads(VLAN_SCHED_RULES_FILE.read_text())
|
||
except: pass
|
||
return {}
|
||
|
||
def _save_vlan_schedule_rules(rules: dict):
|
||
VLAN_SCHED_RULES_FILE.write_text(_json.dumps(rules, indent=2))
|
||
VLAN_SCHED_RULES_FILE.chmod(0o600)
|
||
|
||
|
||
def _scheduler_loop():
|
||
"""Background thread: check schedules every 60 seconds."""
|
||
log.info("Scheduler thread started")
|
||
last_runs: dict[str, str] = {} # {schedule_name: "YYYYMMDD-HHMM"}
|
||
while True:
|
||
time.sleep(60)
|
||
schedules = _load_schedules()
|
||
now_key = _dt.datetime.now().strftime("%Y%m%d-%H%M")
|
||
for sched in schedules:
|
||
if not sched.get("enabled", True):
|
||
continue
|
||
name = sched.get("name", "")
|
||
# Don't run the same schedule twice in the same minute
|
||
if last_runs.get(name) == now_key:
|
||
continue
|
||
if _should_run_now(sched):
|
||
last_runs[name] = now_key
|
||
try:
|
||
_run_scheduled_task(sched)
|
||
except Exception as e:
|
||
log.warning(f"Scheduler error for '{name}': {e}")
|
||
|
||
|
||
def start_scheduler():
|
||
global _scheduler_thread
|
||
if _scheduler_thread is None or not _scheduler_thread.is_alive():
|
||
_scheduler_thread = threading.Thread(target=_scheduler_loop, daemon=True, name="scheduler")
|
||
_scheduler_thread.start()
|
||
|
||
|
||
# Start scheduler on import (alongside poller)
|
||
start_scheduler()
|
||
|
||
|
||
@app.get("/api/schedules")
|
||
def get_schedules():
|
||
return {"schedules": _load_schedules()}
|
||
|
||
|
||
@app.post("/api/schedules")
|
||
def save_schedule(body: dict):
|
||
require_session(body.get("token", ""))
|
||
sched = body.get("schedule", {})
|
||
if not sched.get("name") or not sched.get("action"):
|
||
raise HTTPException(400, "name and action required")
|
||
|
||
schedules = _load_schedules()
|
||
schedules = [s for s in schedules if s["name"] != sched["name"]]
|
||
schedules.append(sched)
|
||
_save_schedules(schedules)
|
||
return {"success": True, "schedules": schedules}
|
||
|
||
|
||
@app.delete("/api/schedules")
|
||
def delete_schedule(body: dict):
|
||
require_session(body.get("token", ""))
|
||
name = body.get("name", "")
|
||
schedules = _load_schedules()
|
||
schedules = [s for s in schedules if s["name"] != name]
|
||
_save_schedules(schedules)
|
||
return {"success": True, "schedules": schedules}
|
||
|
||
|
||
@app.post("/api/schedules/run-now")
|
||
def run_schedule_now(body: dict):
|
||
"""Manually trigger a scheduled task immediately."""
|
||
require_session(body.get("token", ""))
|
||
name = body.get("name", "")
|
||
schedules = _load_schedules()
|
||
sched = next((s for s in schedules if s["name"] == name), None)
|
||
if not sched:
|
||
raise HTTPException(404, f"Schedule '{name}' not found")
|
||
_run_scheduled_task(sched)
|
||
return {"success": True, "ran": name}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# FIREWALL POLICY MATRIX — inter-VLAN access control
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
#
|
||
# Manages both switch ACLs AND OPNsense firewall rules together.
|
||
# Policies define what each VLAN pair can do:
|
||
# - full: all traffic allowed between VLANs
|
||
# - internet: VLAN gets internet only, no RFC1918 access
|
||
# - blocked: no traffic between these VLANs
|
||
# - service: one-way access (A can reach B, but B cannot reach A)
|
||
# - custom: user-defined rules
|
||
#
|
||
# "service" is the printer pattern: Staff can print, but printers
|
||
# can't initiate connections to Staff.
|
||
|
||
POLICIES_FILE = _Path("/etc/switch-manager/vlan-policies.json")
|
||
|
||
_POLICY_TYPES = {"full", "internet", "blocked", "service", "custom"}
|
||
|
||
def _load_policies() -> list:
|
||
if POLICIES_FILE.exists():
|
||
try: return _json.loads(POLICIES_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
def _save_policies(policies: list):
|
||
POLICIES_FILE.write_text(_json.dumps(policies, indent=2))
|
||
POLICIES_FILE.chmod(0o600)
|
||
|
||
|
||
def _policy_to_switch_acl(policy: dict) -> list:
|
||
"""Generate ERS switch ACL commands for a VLAN policy."""
|
||
ptype = policy.get("type", "blocked")
|
||
src_vid = policy.get("src_vlan")
|
||
dst_vid = policy.get("dst_vlan")
|
||
src_sub = policy.get("src_subnet", f"192.168.{src_vid}.0")
|
||
dst_sub = policy.get("dst_subnet", f"192.168.{dst_vid}.0")
|
||
acl_name = f"POLICY-V{src_vid}-V{dst_vid}"
|
||
cmds = []
|
||
|
||
if ptype == "blocked":
|
||
cmds = [
|
||
f"ip access-list extended {acl_name}",
|
||
f" 1 deny ip {src_sub} 0.0.0.255 {dst_sub} 0.0.0.255",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
elif ptype == "full":
|
||
cmds = [
|
||
f"ip access-list extended {acl_name}",
|
||
f" 1 permit ip {src_sub} 0.0.0.255 {dst_sub} 0.0.0.255",
|
||
f" 2 permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
elif ptype == "internet":
|
||
cmds = [
|
||
f"ip access-list extended {acl_name}",
|
||
f" 1 deny ip {src_sub} 0.0.0.255 10.0.0.0 0.255.255.255",
|
||
f" 2 deny ip {src_sub} 0.0.0.255 172.16.0.0 0.15.255.255",
|
||
f" 3 deny ip {src_sub} 0.0.0.255 192.168.0.0 0.0.255.255",
|
||
f" 4 permit ip any any",
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
elif ptype == "service":
|
||
# One-way: src can reach dst on specified ports, dst cannot initiate to src
|
||
ports = policy.get("ports", [])
|
||
cmds = [f"ip access-list extended {acl_name}"]
|
||
rule_num = 1
|
||
for p in ports:
|
||
proto = p.get("proto", "tcp")
|
||
port = p.get("port", "")
|
||
if port:
|
||
cmds.append(
|
||
f" {rule_num} permit {proto} {src_sub} 0.0.0.255 "
|
||
f"{dst_sub} 0.0.0.255 eq {port}")
|
||
else:
|
||
cmds.append(
|
||
f" {rule_num} permit {proto} {src_sub} 0.0.0.255 "
|
||
f"{dst_sub} 0.0.0.255")
|
||
rule_num += 1
|
||
# Deny all other traffic to that VLAN
|
||
cmds.append(f" {rule_num} deny ip {src_sub} 0.0.0.255 {dst_sub} 0.0.0.255")
|
||
rule_num += 1
|
||
cmds.append(f" {rule_num} permit ip any any")
|
||
cmds += [
|
||
f"interface vlan {src_vid}",
|
||
f" ip access-group {acl_name} in",
|
||
]
|
||
|
||
return cmds
|
||
|
||
|
||
def _policy_to_opnsense_rules(policy: dict, cfg: dict) -> list:
|
||
"""Generate OPNsense firewall API calls for a VLAN policy.
|
||
Returns list of {method, path, body} dicts."""
|
||
ptype = policy.get("type", "blocked")
|
||
src_vid = policy.get("src_vlan")
|
||
dst_vid = policy.get("dst_vlan")
|
||
vmap = _load_vlan_if_map()
|
||
src_if = vmap.get(str(src_vid), "")
|
||
dst_if = vmap.get(str(dst_vid), "")
|
||
src_sub = policy.get("src_subnet", f"192.168.{src_vid}.0/24")
|
||
dst_sub = policy.get("dst_subnet", f"192.168.{dst_vid}.0/24")
|
||
rules = []
|
||
|
||
if not src_if:
|
||
return rules # Can't create OPNsense rules without interface mapping
|
||
|
||
if ptype == "blocked":
|
||
rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "block",
|
||
"interface": src_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_if}net"},
|
||
"destination": {"address": dst_sub},
|
||
"descr": f"Policy: block V{src_vid} → V{dst_vid}",
|
||
}
|
||
})
|
||
elif ptype == "full":
|
||
rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"interface": src_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_if}net"},
|
||
"destination": {"address": dst_sub},
|
||
"descr": f"Policy: allow V{src_vid} → V{dst_vid}",
|
||
}
|
||
})
|
||
elif ptype == "internet":
|
||
# Block all RFC1918, permit everything else
|
||
for net in ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]:
|
||
rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "block",
|
||
"interface": src_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_if}net"},
|
||
"destination": {"address": net},
|
||
"descr": f"Policy: V{src_vid} internet-only (block {net})",
|
||
}
|
||
})
|
||
rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"interface": src_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_if}net"},
|
||
"destination": {"any": "1"},
|
||
"descr": f"Policy: V{src_vid} internet-only (allow out)",
|
||
}
|
||
})
|
||
elif ptype == "service":
|
||
ports = policy.get("ports", [])
|
||
for p in ports:
|
||
proto = p.get("proto", "tcp")
|
||
port = p.get("port", "")
|
||
rule = {
|
||
"enabled": "1", "action": "pass",
|
||
"interface": src_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": proto,
|
||
"source": {"network": f"{src_if}net"},
|
||
"destination": {"address": dst_sub},
|
||
"descr": f"Policy: V{src_vid} → V{dst_vid} service {proto}/{port}",
|
||
}
|
||
if port:
|
||
rule["destination"]["port"] = str(port)
|
||
rules.append({"rule": rule})
|
||
# Block everything else to that VLAN
|
||
rules.append({
|
||
"rule": {
|
||
"enabled": "1", "action": "block",
|
||
"interface": src_if, "direction": "in",
|
||
"ipprotocol": "inet", "protocol": "any",
|
||
"source": {"network": f"{src_if}net"},
|
||
"destination": {"address": dst_sub},
|
||
"descr": f"Policy: block V{src_vid} → V{dst_vid} (except services above)",
|
||
}
|
||
})
|
||
|
||
return rules
|
||
|
||
|
||
# ── Policy presets ──────────────────────────────────────────────────
|
||
|
||
POLICY_PRESETS = [
|
||
{
|
||
"id": "printer",
|
||
"label": "Printer VLAN — other VLANs can print, printers can't reach out",
|
||
"description": "Allows printing (TCP 9100 RAW, TCP 631 IPP, UDP 631 IPP) "
|
||
"from source VLAN to printer VLAN. Printers cannot initiate "
|
||
"connections back. Printers get internet for firmware updates.",
|
||
"type": "service",
|
||
"ports": [
|
||
{"proto": "tcp", "port": "9100"}, # RAW printing
|
||
{"proto": "tcp", "port": "631"}, # IPP
|
||
{"proto": "udp", "port": "631"}, # IPP discovery
|
||
{"proto": "tcp", "port": "443"}, # HTTPS (web UI, cloud print)
|
||
{"proto": "tcp", "port": "80"}, # HTTP (web UI)
|
||
],
|
||
"bidirectional": False,
|
||
},
|
||
{
|
||
"id": "lan_access_all",
|
||
"label": "LAN can reach all VLANs",
|
||
"description": "LAN (trusted) has full access to all other VLANs. "
|
||
"Other VLANs cannot reach LAN.",
|
||
"type": "full",
|
||
"bidirectional": False,
|
||
},
|
||
{
|
||
"id": "iot_isolated",
|
||
"label": "IoT — internet only, full isolation",
|
||
"description": "Blocks ALL private IP ranges. Devices get internet only. "
|
||
"Cannot reach any VLAN, server, NAS, or management network.",
|
||
"type": "internet",
|
||
"bidirectional": False,
|
||
},
|
||
{
|
||
"id": "guest_isolated",
|
||
"label": "Guest — internet only, strict",
|
||
"description": "Same as IoT isolation. Guest devices get internet only.",
|
||
"type": "internet",
|
||
"bidirectional": False,
|
||
},
|
||
{
|
||
"id": "camera_nvr",
|
||
"label": "Camera VLAN — NVR access only",
|
||
"description": "Cameras can only reach the NVR IP. No internet, no other VLANs.",
|
||
"type": "service",
|
||
"ports": [{"proto": "tcp", "port": ""}], # All TCP to NVR
|
||
"bidirectional": False,
|
||
"needs_target_ip": True,
|
||
},
|
||
]
|
||
|
||
|
||
@app.get("/api/policies")
|
||
def get_policies():
|
||
"""List all VLAN policies and available presets."""
|
||
return {
|
||
"policies": _load_policies(),
|
||
"presets": POLICY_PRESETS,
|
||
}
|
||
|
||
|
||
@app.post("/api/policies")
|
||
def save_policy(body: dict):
|
||
"""Add or update a VLAN-to-VLAN policy."""
|
||
require_session(body.get("token", ""))
|
||
policy = body.get("policy", {})
|
||
if not policy.get("src_vlan") or not policy.get("type"):
|
||
raise HTTPException(400, "src_vlan and type required")
|
||
if policy["type"] not in _POLICY_TYPES:
|
||
raise HTTPException(400, f"Invalid type: {policy['type']}")
|
||
|
||
policies = _load_policies()
|
||
# Replace existing policy for same src→dst pair
|
||
key = (policy["src_vlan"], policy.get("dst_vlan"))
|
||
policies = [p for p in policies if (p["src_vlan"], p.get("dst_vlan")) != key]
|
||
policies.append(policy)
|
||
_save_policies(policies)
|
||
return {"success": True, "policies": policies}
|
||
|
||
|
||
@app.delete("/api/policies")
|
||
def delete_policy(body: dict):
|
||
"""Remove a VLAN policy."""
|
||
require_session(body.get("token", ""))
|
||
src = body.get("src_vlan")
|
||
dst = body.get("dst_vlan")
|
||
policies = _load_policies()
|
||
policies = [p for p in policies if not (p["src_vlan"] == src and p.get("dst_vlan") == dst)]
|
||
_save_policies(policies)
|
||
return {"success": True, "policies": policies}
|
||
|
||
|
||
@app.post("/api/policies/preview")
|
||
def preview_policy(body: dict):
|
||
"""Preview the switch ACL + OPNsense rules that a policy would generate."""
|
||
policy = body.get("policy", {})
|
||
if not policy.get("src_vlan") or not policy.get("type"):
|
||
raise HTTPException(400, "src_vlan and type required")
|
||
|
||
switch_cmds = _policy_to_switch_acl(policy)
|
||
cfg = _load_opnsense_cfg()
|
||
opnsense_rules = _policy_to_opnsense_rules(policy, cfg)
|
||
|
||
return {
|
||
"switch_commands": switch_cmds,
|
||
"opnsense_rules": [r["rule"]["descr"] for r in opnsense_rules],
|
||
"opnsense_rule_count": len(opnsense_rules),
|
||
}
|
||
|
||
|
||
@app.post("/api/policies/push")
|
||
def push_policy(body: dict):
|
||
"""Push a policy to both switch and OPNsense."""
|
||
require_session(body.get("token", ""))
|
||
policy = body.get("policy", {})
|
||
if not policy.get("src_vlan") or not policy.get("type"):
|
||
raise HTTPException(400, "src_vlan and type required")
|
||
|
||
steps_done = []
|
||
errors = []
|
||
|
||
backup = _pre_change_backup(reason=f"pre-policy V{policy['src_vlan']}→V{policy.get('dst_vlan','*')}")
|
||
|
||
# Push switch ACLs
|
||
switch_cmds = _policy_to_switch_acl(policy)
|
||
if switch_cmds:
|
||
danger = check_danger(switch_cmds)
|
||
if danger["has_hard_block"]:
|
||
raise HTTPException(400, {"message": "Hard-blocked commands", "blocked": danger["hard_blocked"]})
|
||
result = push_one_by_one(switch_cmds)
|
||
if result.get("success"):
|
||
steps_done.append(f"Switch: {len(switch_cmds)} ACL commands pushed")
|
||
else:
|
||
errors.append(f"Switch push failed: {result.get('error', 'unknown')}")
|
||
|
||
# Push OPNsense rules
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key"):
|
||
opnsense_rules = _policy_to_opnsense_rules(policy, cfg)
|
||
for rule_body in opnsense_rules:
|
||
try:
|
||
_opnsense_request(cfg, "firewall/filter/addRule", "POST", rule_body)
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense rule: {e}")
|
||
if opnsense_rules:
|
||
try:
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
steps_done.append(f"OPNsense: {len(opnsense_rules)} firewall rules applied")
|
||
except ValueError as e:
|
||
errors.append(f"OPNsense apply: {e}")
|
||
|
||
# Save policy
|
||
policies = _load_policies()
|
||
key = (policy["src_vlan"], policy.get("dst_vlan"))
|
||
policies = [p for p in policies if (p["src_vlan"], p.get("dst_vlan")) != key]
|
||
policy["pushed"] = True
|
||
policy["pushed_at"] = _ts()
|
||
policies.append(policy)
|
||
_save_policies(policies)
|
||
|
||
# Post-connectivity check
|
||
post_conn = _check_connectivity()
|
||
if not post_conn["switch"]["ok"]:
|
||
errors.append(f"WARNING: Switch connectivity lost after push! Backup: {backup['switch'].get('file','N/A')}")
|
||
|
||
return {
|
||
"success": len(errors) == 0,
|
||
"steps_done": steps_done,
|
||
"errors": errors,
|
||
"backup": backup,
|
||
"post_connectivity": post_conn,
|
||
}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# PORT FORWARDING — manage OPNsense NAT port forwards
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
PORT_FWD_FILE = _Path("/etc/switch-manager/port-forwards.json")
|
||
|
||
def _load_port_forwards() -> list:
|
||
if PORT_FWD_FILE.exists():
|
||
try: return _json.loads(PORT_FWD_FILE.read_text())
|
||
except: pass
|
||
return []
|
||
|
||
def _save_port_forwards(fwds: list):
|
||
PORT_FWD_FILE.write_text(_json.dumps(fwds, indent=2))
|
||
PORT_FWD_FILE.chmod(0o600)
|
||
|
||
|
||
@app.get("/api/port-forwards")
|
||
def get_port_forwards():
|
||
return {"forwards": _load_port_forwards()}
|
||
|
||
|
||
@app.post("/api/port-forwards")
|
||
def create_port_forward(body: dict):
|
||
"""Create a NAT port forward on OPNsense + companion firewall rule."""
|
||
require_session(body.get("token", ""))
|
||
fwd = body.get("forward", {})
|
||
proto = fwd.get("proto", "tcp")
|
||
wan_port = fwd.get("wan_port", "")
|
||
target_ip = fwd.get("target_ip", "")
|
||
target_port = fwd.get("target_port", wan_port)
|
||
description = fwd.get("description", "")
|
||
|
||
if not wan_port or not target_ip:
|
||
raise HTTPException(400, "wan_port and target_ip required")
|
||
|
||
cfg = _load_opnsense_cfg()
|
||
if not cfg.get("key"):
|
||
raise HTTPException(503, "OPNsense API not configured")
|
||
|
||
backup = _pre_change_backup(reason=f"pre-port-forward {proto}/{wan_port}→{target_ip}:{target_port}")
|
||
|
||
try:
|
||
# Create firewall pass rule for the forwarded traffic
|
||
r = _opnsense_request(cfg, "firewall/filter/addRule", "POST", {
|
||
"rule": {
|
||
"enabled": "1", "action": "pass",
|
||
"interface": "wan", "direction": "in",
|
||
"ipprotocol": "inet", "protocol": proto,
|
||
"source": {"any": "1"},
|
||
"destination": {"address": target_ip, "port": str(target_port)},
|
||
"descr": f"Port forward: WAN {proto}/{wan_port} → {target_ip}:{target_port}"
|
||
f"{' — ' + description if description else ''}",
|
||
}
|
||
})
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
uuid = r.get("uuid", "")
|
||
|
||
fwd_entry = {
|
||
"proto": proto, "wan_port": wan_port,
|
||
"target_ip": target_ip, "target_port": target_port,
|
||
"description": description, "uuid": uuid,
|
||
"created_at": _ts(),
|
||
}
|
||
fwds = _load_port_forwards()
|
||
fwds.append(fwd_entry)
|
||
_save_port_forwards(fwds)
|
||
|
||
return {"success": True, "forward": fwd_entry, "backup": backup,
|
||
"note": "Firewall rule created. Also verify NAT port forward exists: "
|
||
f"OPNsense > Firewall > NAT > Port Forward — WAN {proto} {wan_port} → {target_ip}:{target_port}"}
|
||
except Exception as e:
|
||
raise HTTPException(500, f"Port forward creation failed: {e}")
|
||
|
||
|
||
@app.delete("/api/port-forwards")
|
||
def delete_port_forward(body: dict):
|
||
"""Remove a port forward and its firewall rule."""
|
||
require_session(body.get("token", ""))
|
||
uuid = body.get("uuid", "")
|
||
if not uuid:
|
||
raise HTTPException(400, "uuid required")
|
||
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("key") and uuid:
|
||
try:
|
||
_opnsense_request(cfg, f"firewall/filter/delRule/{uuid}", "POST")
|
||
_opnsense_request(cfg, "firewall/filter/apply", "POST")
|
||
except Exception as e:
|
||
log.warning(f"Port forward rule delete failed: {e}")
|
||
|
||
fwds = _load_port_forwards()
|
||
fwds = [f for f in fwds if f.get("uuid") != uuid]
|
||
_save_port_forwards(fwds)
|
||
return {"success": True}
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# NETWORK TOPOLOGY — auto-generated from live data
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
@app.get("/api/topology")
|
||
def get_topology():
|
||
"""Build network topology from live switch + OPNsense data."""
|
||
topology = {
|
||
"router": {"ip": "", "hostname": "OPNsense", "connected": False},
|
||
"switch": {"ip": SWITCH_HOST, "hostname": "ERS-5952", "connected": False},
|
||
"vlans": [],
|
||
"ports": [],
|
||
"devices": [],
|
||
}
|
||
|
||
# Switch connectivity
|
||
try:
|
||
conn = _pool.get()
|
||
transport = conn.get_transport()
|
||
if transport and transport.is_active():
|
||
topology["switch"]["connected"] = True
|
||
except Exception:
|
||
pass
|
||
|
||
# OPNsense
|
||
cfg = _load_opnsense_cfg()
|
||
if cfg.get("host"):
|
||
topology["router"]["ip"] = cfg["host"]
|
||
try:
|
||
fw = _opnsense_request(cfg, "core/firmware/status")
|
||
topology["router"]["connected"] = True
|
||
topology["router"]["version"] = fw.get("product_version", "")
|
||
except Exception:
|
||
pass
|
||
|
||
# VLANs from cache
|
||
with _cache_lock:
|
||
vlan_raw = _cache.get("vlan_members", "")
|
||
port_raw = _cache.get("port_status", "")
|
||
|
||
# Parse port status for link state
|
||
if port_raw:
|
||
for line in port_raw.splitlines():
|
||
import re as _re_topo
|
||
m = _re_topo.match(r'\s*(\d+)\s+(\S+)\s+(\S+)\s+(\S+)', line)
|
||
if m:
|
||
port_id = int(m.group(1))
|
||
link = m.group(3).lower()
|
||
topology["ports"].append({
|
||
"id": port_id,
|
||
"link": "up" if "up" in link else "down",
|
||
})
|
||
|
||
# Devices from saved list
|
||
try:
|
||
topology["devices"] = _load_devices()[:50] # Cap at 50
|
||
except Exception:
|
||
pass
|
||
|
||
# VLAN info
|
||
vmap = _load_vlan_if_map()
|
||
topology["vlan_interface_map"] = vmap
|
||
|
||
return topology
|
||
|
||
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
# POE BUDGET DASHBOARD — power consumption overview
|
||
# ══════════════════════════════════════════════════════════════════════
|
||
|
||
@app.get("/api/poe/budget")
|
||
def poe_budget():
|
||
"""Parse PoE status from cached switch data."""
|
||
with _cache_lock:
|
||
poe_raw = _cache.get("poe_status", "")
|
||
|
||
if not poe_raw:
|
||
return {"available": False, "error": "No PoE data cached — switch may be offline"}
|
||
|
||
import re as _re_poe
|
||
result = {
|
||
"available": True,
|
||
"raw": poe_raw[:2000],
|
||
"total_watts": None,
|
||
"used_watts": None,
|
||
"remaining_watts": None,
|
||
"percent_used": None,
|
||
"ports": [],
|
||
}
|
||
|
||
# Parse total/used from various ERS output formats
|
||
budget_m = _re_poe.findall(r'(\d+)\s*[Ww]atts?\s*(available|budget|maximum|total)', poe_raw, _re_poe.I)
|
||
used_m = _re_poe.findall(r'(\d+)\s*[Ww]atts?\s*(used|consumed|delivering)', poe_raw, _re_poe.I)
|
||
if budget_m:
|
||
result["total_watts"] = int(budget_m[0][0])
|
||
if used_m:
|
||
result["used_watts"] = int(used_m[0][0])
|
||
if result["total_watts"] and result["used_watts"]:
|
||
result["remaining_watts"] = result["total_watts"] - result["used_watts"]
|
||
result["percent_used"] = round(result["used_watts"] / result["total_watts"] * 100, 1)
|
||
|
||
# Parse per-port PoE
|
||
for line in poe_raw.splitlines():
|
||
pm = _re_poe.match(
|
||
r'\s*(\d+)\s+\S+\s+(\S+)\s+\S+\s+(\d+(?:\.\d+)?)\s*[Ww]', line)
|
||
if pm:
|
||
result["ports"].append({
|
||
"port": int(pm.group(1)),
|
||
"status": pm.group(2),
|
||
"watts": float(pm.group(3)),
|
||
})
|
||
|
||
return result
|