gistfile1.txt
· 106 KiB · Text
Eredeti
#!/usr/bin/env python3
"""
wgctl JSON helper — called by shell functions to read/write JSON files.
Usage: json_helper.py <command> <file> [key] [value]
"""
import sys
import json
import os
DATETIME_FMT = os.environ.get('WGCTL_DATETIME_FMT', '%Y-%m-%d %H:%M')
def get(file, key):
try:
with open(file) as f:
data = json.load(f)
val = data.get(key, [])
if isinstance(val, bool):
print(str(val).lower()) # true/false not True/False
elif isinstance(val, list):
if val:
print('\n'.join(str(v) for v in val))
else:
if val:
print(val)
except:
sys.exit(0)
def set_key(file, key, value):
try:
data = {}
if os.path.exists(file):
with open(file) as f:
data = json.load(f)
# Try to parse as JSON value first (for arrays/bools)
try:
data[key] = json.loads(value)
except:
data[key] = value
with open(file, 'w') as f:
json.dump(data, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def delete_key(file, key):
try:
with open(file) as f:
data = json.load(f)
data.pop(key, None)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def append(file, key, value):
try:
data = {}
if os.path.exists(file):
with open(file) as f:
data = json.load(f)
if key not in data:
data[key] = []
if value not in data[key]:
data[key].append(value)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def remove_value(file, key, value):
try:
with open(file) as f:
data = json.load(f)
if key in data and value in data[key]:
data[key].remove(value)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def cat(file):
try:
with open(file) as f:
data = json.load(f)
print(json.dumps(data, indent=2))
except Exception as e:
sys.exit(1)
def has_key(file, key):
try:
with open(file) as f:
data = json.load(f)
sys.exit(0 if key in data else 1)
except:
sys.exit(1)
def filter_values(file, key, value):
"""Remove all entries where value matches"""
try:
with open(file) as f:
data = json.load(f)
data = {k: v for k, v in data.items() if v != value}
with open(file, 'w') as f:
json.dump(data, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def last_event(file, key, field, client):
"""Get last event field for a client"""
try:
last = None
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
if e.get(key) == client:
last = e
except:
pass
if last:
print(last.get(field, ''))
except:
pass
def events_for(file, ip, limit):
"""Format events for a given IP"""
try:
from datetime import datetime
events = []
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
if e.get('ip') == ip:
events.append(e)
except:
pass
for e in events[-int(limit):]:
ts = e.get('timestamp', '')
try:
dt = datetime.fromisoformat(ts)
ts = dt.strftime(DATETIME_FMT)
except:
pass
endpoint = e.get('endpoint', '—')
client = e.get('client', '—')
event = e.get('event', '—')
print(f' {ts} {client:<20} {endpoint:<20} {event}')
except:
pass
def fw_events(file, filter_ip, filter_type, clients_dir, net_file, limit, collapse='1'):
"""
Format firewall drop events with dedup, counts, and service annotation.
collapse='1' (default): hourly aggregation
collapse='0': show all deduplicated events (--detailed mode)
Output per line: ts|client|dest_ip|dest_port|proto|service_name|count
"""
import glob
from datetime import datetime
from collections import defaultdict
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
do_collapse = str(collapse) != '0'
# Build ip->name map
ip_to_name = {}
for conf in glob.glob(f"{clients_dir}/*.conf"):
name = os.path.basename(conf).replace('.conf', '')
try:
with open(conf) as f:
for line in f:
if line.startswith('Address'):
ip = line.split('=')[1].strip().split('/')[0]
ip_to_name[ip] = name
except Exception:
pass
# Load net services for reverse lookup
net_data = {}
if net_file and os.path.exists(net_file):
try:
with open(net_file) as f:
net_data = json.load(f)
except Exception:
pass
def reverse_lookup(dest_ip, dest_port, proto):
for svc_name, svc in net_data.items():
if not isinstance(svc, dict):
continue
if svc.get('ip', '') != dest_ip:
continue
ports = svc.get('ports', {})
if dest_port:
for port_name, port_def in ports.items():
if not isinstance(port_def, dict):
continue
if (str(port_def.get('port', '')) == str(dest_port) and
port_def.get('proto', 'tcp') == proto):
return f"{svc_name}:{port_name}"
return svc_name
return svc_name
return ''
# Parse and first-pass dedup (within time window per key)
events = []
last_seen = {}
try:
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
src = e.get('src_ip', '')
if not src:
continue
if filter_ip and src != filter_ip:
continue
proto_num = int(e.get('ip.protocol', 0))
proto = proto_map.get(proto_num, str(proto_num))
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
key = (src, dst, port, proto_num)
ts_str = e.get('timestamp', '')
try:
ts = datetime.fromisoformat(ts_str).timestamp()
except Exception:
ts = 0
windows = {1: 5, 6: 30, 17: 10}
window = windows.get(proto_num, 10)
if key in last_seen and (ts - last_seen[key]) < window:
continue
last_seen[key] = ts
events.append(e)
except Exception:
continue
except Exception:
pass
limit = int(limit) if limit else 50
if do_collapse:
# Hourly aggregation: group by (client, dst, port, proto, date, hour)
hourly = defaultdict(int)
hourly_ts = {} # store first ts per hour bucket for output ordering
for e in events:
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
proto_num = int(e.get('ip.protocol', 0))
proto = proto_map.get(proto_num, str(proto_num))
ts_str = e.get('timestamp', '')
client = ip_to_name.get(src, src)
svc_name = reverse_lookup(dst, port, proto)
try:
dt = datetime.fromisoformat(ts_str)
hour_key = (client, dst, port, proto, svc_name,
dt.strftime('%Y-%m-%d %H'))
hourly[hour_key] += 1
if hour_key not in hourly_ts:
hourly_ts[hour_key] = dt
except Exception:
continue
# Sort by timestamp and emit last N
sorted_buckets = sorted(hourly_ts.items(), key=lambda x: x[1])
for hour_key, dt in sorted_buckets[-limit:]:
client, dst, port, proto, svc_name, _ = hour_key
count = hourly[hour_key]
ts_fmt = dt.strftime(DATETIME_FMT.replace('%M', '00'))
print(f"{ts_fmt}|{client}|{dst}|{port}|{proto}|{svc_name}|{count}")
else:
# Detailed mode — consecutive dedup only
deduped = []
counts = []
for e in events:
ts_str = e.get('timestamp', '')
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
proto_num = int(e.get('ip.protocol', 0))
key = (src, dst, port, proto_num)
if deduped:
prev = deduped[-1]
try:
prev_ts = datetime.fromisoformat(
prev.get('timestamp', '')).timestamp()
cur_ts = datetime.fromisoformat(ts_str).timestamp()
except Exception:
prev_ts = cur_ts = 0
prev_key = (
prev.get('src_ip', ''),
prev.get('dest_ip', ''),
str(prev.get('dest_port', '')),
int(prev.get('ip.protocol', 0))
)
if key == prev_key and (cur_ts - prev_ts) < 300:
counts[-1] += 1
continue
deduped.append(e)
counts.append(1)
for e, count in list(zip(deduped, counts))[-limit:]:
ts_str = e.get('timestamp', '')
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
proto_num = int(e.get('ip.protocol', 0))
proto = proto_map.get(proto_num, str(proto_num))
client = ip_to_name.get(src, src)
svc_name = reverse_lookup(dst, port, proto)
try:
dt = datetime.fromisoformat(ts_str)
ts_fmt = dt.strftime(DATETIME_FMT)
except Exception:
ts_fmt = ts_str
print(f"{ts_fmt}|{client}|{dst}|{port}|{proto}|{svc_name}|{count}")
def wg_events(file, filter_client, filter_type, limit, collapse='1'):
"""
Format WireGuard events with dedup and counts.
collapse='1' (default): hourly aggregation for attempt events
collapse='0': show all deduplicated events (--detailed mode)
Output per line: ts|client|endpoint|event|count
"""
from datetime import datetime
from collections import defaultdict
do_collapse = str(collapse) != '0'
events = []
try:
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
client = e.get('client', '')
if not client:
continue
if filter_client and client != filter_client:
continue
if filter_type and not client.startswith(filter_type + '-'):
continue
events.append(e)
except Exception:
pass
except Exception:
pass
limit = int(limit) if limit else 50
if do_collapse:
# Hourly aggregation for attempts; individual for handshakes
hourly_attempts = defaultdict(int)
hourly_ts = {}
handshakes = []
handshake_counts = []
for e in events:
ts_str = e.get('timestamp', '')
client = e.get('client', '')
endpoint = e.get('endpoint', '')
event = e.get('event', '')
try:
dt = datetime.fromisoformat(ts_str)
ts = dt.timestamp()
except Exception:
dt = None
ts = 0
if event == 'attempt':
if dt:
hour_key = (client, endpoint, event,
dt.strftime('%Y-%m-%d %H'))
hourly_attempts[hour_key] += 1
if hour_key not in hourly_ts:
hourly_ts[hour_key] = dt
else:
# Handshakes — consecutive dedup only
key = (client, event, endpoint[:15])
if handshakes:
prev = handshakes[-1]
try:
prev_ts = datetime.fromisoformat(
prev.get('timestamp', '')).timestamp()
except Exception:
prev_ts = 0
prev_key = (
prev.get('client', ''),
prev.get('event', ''),
prev.get('endpoint', '')[:15]
)
if key == prev_key and (ts - prev_ts) < 300:
handshake_counts[-1] += 1
continue
handshakes.append(e)
handshake_counts.append(1)
# Build output list: attempts (hourly) + handshakes, sorted by ts
output = []
for hour_key, dt in hourly_ts.items():
client, endpoint, event, _ = hour_key
count = hourly_attempts[hour_key]
ts_fmt = dt.strftime(DATETIME_FMT.replace('%M', '00'))
output.append((dt.timestamp(), f"{ts_fmt}|{client}|{endpoint}|{event}|{count}"))
for e, count in zip(handshakes, handshake_counts):
ts_str = e.get('timestamp', '')
client = e.get('client', '')
endpoint = e.get('endpoint', '')
event = e.get('event', '')
try:
dt = datetime.fromisoformat(ts_str)
ts_fmt = dt.strftime(DATETIME_FMT)
ts = dt.timestamp()
except Exception:
ts_fmt = ts_str
ts = 0
output.append((ts, f"{ts_fmt}|{client}|{endpoint}|{event}|{count}"))
output.sort(key=lambda x: x[0])
for _, line in output[-limit:]:
print(line)
else:
# Detailed mode — consecutive dedup only
deduped = []
counts = []
for e in events:
ts_str = e.get('timestamp', '')
client = e.get('client', '')
event = e.get('event', '')
endpoint = e.get('endpoint', '')
key = (client, event, endpoint[:15])
try:
ts = datetime.fromisoformat(ts_str).timestamp()
except Exception:
ts = 0
if deduped:
prev = deduped[-1]
try:
prev_ts = datetime.fromisoformat(
prev.get('timestamp', '')).timestamp()
except Exception:
prev_ts = 0
prev_key = (
prev.get('client', ''),
prev.get('event', ''),
prev.get('endpoint', '')[:15]
)
if key == prev_key and (ts - prev_ts) < 300:
counts[-1] += 1
continue
deduped.append(e)
counts.append(1)
for e, count in list(zip(deduped, counts))[-limit:]:
ts_str = e.get('timestamp', '')
client = e.get('client', '')
endpoint = e.get('endpoint', '')
event = e.get('event', '')
try:
dt = datetime.fromisoformat(ts_str)
ts_fmt = dt.strftime(DATETIME_FMT)
except Exception:
ts_fmt = ts_str
print(f"{ts_fmt}|{client}|{endpoint}|{event}|{count}")
def format_fw_event(line, clients_dir):
"""Format a single fw_event line"""
import glob
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
# Build ip->name map
ip_to_name = {}
for conf in glob.glob(f"{clients_dir}/*.conf"):
name = os.path.basename(conf).replace('.conf', '')
try:
with open(conf) as f:
for l in f:
if l.startswith('Address'):
ip = l.split('=')[1].strip().split('/')[0]
ip_to_name[ip] = name
except:
pass
try:
e = json.loads(line.strip())
src = e.get('src_ip', '')
if not src:
return None
ts = e.get('timestamp', '')
try:
from datetime import datetime
dt = datetime.fromisoformat(ts)
ts = dt.strftime(DATETIME_FMT)
except:
pass
dst = e.get('dest_ip', '—')
port = e.get('dest_port', '')
proto_num = e.get('ip.protocol', 0)
proto = proto_map.get(proto_num, str(proto_num))
dst_str = f"{dst}:{port}" if port else dst
client = ip_to_name.get(src, src)
return f"{ts}|{client}|{dst_str}|{proto}"
except:
return None
def format_wg_event(line):
"""Format a single wg_event line"""
try:
e = json.loads(line.strip())
client = e.get('client', '')
if not client:
return None
ts = e.get('timestamp', '')
try:
from datetime import datetime
dt = datetime.fromisoformat(ts)
ts = dt.strftime(DATETIME_FMT)
except:
pass
endpoint = e.get('endpoint', '—')
event = e.get('event', '—')
return f"{ts}|{client}|{endpoint}|{event}|wg"
except:
return None
def remove_events(file, identifier):
"""Remove all events for a client/ip from a JSONL file"""
try:
lines = []
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
if e.get('client') == identifier or e.get('src_ip') == identifier:
continue
lines.append(line)
except:
lines.append(line)
with open(file, 'w') as f:
f.writelines(lines)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def follow_logs(fw_file, wg_file, filter_ip, filter_type, clients_dir, filter_peers=""):
"""Follow both log files and output formatted events"""
import glob, time, select
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
peer_filter = set(filter_peers.split(',')) if filter_peers else set()
# Build ip->name map
ip_to_name = {}
for conf in glob.glob(f"{clients_dir}/*.conf"):
name = os.path.basename(conf).replace('.conf', '')
try:
with open(conf) as f:
for l in f:
if l.startswith('Address'):
ip = l.split('=')[1].strip().split('/')[0]
ip_to_name[ip] = name
except:
pass
# Open files and seek to end
files = {}
for label, path in [('fw', fw_file), ('wg', wg_file)]:
if path and os.path.exists(path):
f = open(path)
f.seek(0, 2) # seek to end
files[label] = f
dedup = {}
try:
while True:
for label, f in files.items():
line = f.readline()
if not line:
continue
try:
e = json.loads(line.strip())
except:
continue
if label == 'fw':
src = e.get('src_ip', '')
if not src:
continue
if filter_ip and src != filter_ip:
continue
# Filter by peer names if specified
if peer_filter:
client_name = ip_to_name.get(src, '')
if client_name not in peer_filter:
continue
dst = e.get('dest_ip', '—')
port = e.get('dest_port', '')
proto_num = e.get('ip.protocol', 0)
proto = proto_map.get(proto_num, str(proto_num))
# Dedup
key = (src, dst, port, proto_num)
windows = {1: 5, 6: 30, 17: 10}
window = windows.get(proto_num, 10)
now = time.time()
if key in dedup and (now - dedup[key]) < window:
continue
dedup[key] = now
client = ip_to_name.get(src, src)
if filter_type and not client.startswith(filter_type + '-'):
continue
dst_str = f"{dst}:{port}" if port else dst
ts = e.get('timestamp', '')[:16].replace('T', ' ')
print(f"fw|{ts}|{client}|{dst_str}|{proto}", flush=True)
elif label == 'wg':
client = e.get('client', '')
if not client:
continue
if filter_ip:
ip = ip_to_name.get(filter_ip, '')
if client != ip and client != filter_ip:
continue
if peer_filter and client not in peer_filter:
continue
if filter_type and not client.startswith(filter_type + '-'):
continue
ts = e.get('timestamp', '')[:16].replace('T', ' ')
endpoint = e.get('endpoint', '—')
event = e.get('event', '—')
print(f"wg|{ts}|{client}|{endpoint}|{event}", flush=True)
time.sleep(0.1)
except KeyboardInterrupt:
pass
def count(file, key):
try:
with open(file) as f:
data = json.load(f)
val = data.get(key, [])
print(len(val) if isinstance(val, list) else 0)
except:
print(0)
def audit_fw_counts(clients_dir):
"""Return peer_name:fw_count pairs from iptables"""
import glob, subprocess, re
try:
result = subprocess.run(
['iptables', '-L', 'FORWARD', '-n', '-v'],
capture_output=True, text=True
)
fw_lines = result.stdout.splitlines()
except Exception:
fw_lines = []
# Filter to only data lines (skip headers and blanks)
# In -v output, source IP is in column 8 (0-indexed)
# Format: pkts bytes target prot opt in out source destination [options]
rule_lines = [l for l in fw_lines if l.strip() and not l.startswith('Chain') and not l.startswith(' pkts')]
for conf in sorted(glob.glob(f"{clients_dir}/*.conf")):
name = os.path.basename(conf).replace('.conf', '')
try:
with open(conf) as f:
ip = ''
for line in f:
if line.startswith('Address'):
ip = line.split('=')[1].strip().split('/')[0]
break
if not ip:
continue
# Count lines where source column exactly matches the peer IP
count = sum(1 for l in rule_lines if re.search(r'\s' + re.escape(ip) + r'\s', l))
print(f"{name}:{count}")
except Exception:
pass
def peer_group_map(groups_dir):
"""Return peer:group pairs for all groups"""
import glob
try:
for group_file in glob.glob(f"{groups_dir}/*.group"):
try:
with open(group_file) as f:
g = json.load(f)
name = g.get('name', '')
for peer in g.get('peers', []):
if peer:
print(f"{peer}:{name}")
except:
pass
except:
pass
def peer_groups(groups_dir, peer_name):
"""Find all groups containing a peer"""
import glob
try:
for group_file in glob.glob(f"{groups_dir}/*.group"):
try:
with open(group_file) as f:
g = json.load(f)
if peer_name in g.get('peers', []):
print(g.get('name', ''))
except:
pass
except:
pass
def iso_to_ts(iso_str):
"""Convert ISO timestamp to unix timestamp"""
try:
from datetime import datetime, timezone
dt = datetime.fromisoformat(iso_str)
if dt.tzinfo is None:
dt = dt.replace(tzinfo=timezone.utc)
print(int(dt.timestamp()))
except:
print(0)
def rule_list_data(rules_dir, meta_dir):
"""Return all rule data including base rules and extends"""
import glob
rule_peer_counts = {}
for f in glob.glob(f"{meta_dir}/*.meta"):
try:
with open(f) as mf:
meta = json.load(mf)
rule = meta.get('rule', '')
if rule:
rule_peer_counts[rule] = rule_peer_counts.get(rule, 0) + 1
except:
pass
rule_files = (
sorted(glob.glob(f"{rules_dir}/*.rule")) +
sorted(glob.glob(f"{rules_dir}/base/*.rule"))
)
# Collect all data first
rules_data = []
for rule_file in rule_files:
is_base = '/base/' in rule_file
try:
with open(rule_file) as f:
r = json.load(f)
name = r.get('name', '')
desc = r.get('desc', '')
group = r.get('group', '')
extends = ','.join(r.get('extends', []))
resolved = _rule_resolve_internal(rules_dir, name)
n_allows = len(resolved.get('allow_ips', [])) + \
len(resolved.get('allow_ports', []))
n_blocks = len(resolved.get('block_ips', [])) + \
len(resolved.get('block_ports', []))
peer_count = rule_peer_counts.get(name, 0)
rules_data.append({
'name': name, 'desc': desc, 'n_allows': n_allows,
'n_blocks': n_blocks, 'peer_count': peer_count,
'extends': extends, 'is_base': is_base, 'group': group
})
except:
pass
# Sort: non-base first, then by group (empty group last within non-base),
# then by name within group
rules_data.sort(key=lambda x: (
x['is_base'],
x['group'] == '' and not x['is_base'],
x['group'],
x['name']
))
for r in rules_data:
print(f"{r['name']}|{r['desc']}|{r['n_allows']}|{r['n_blocks']}|"
f"{r['peer_count']}|{r['extends']}|{r['is_base']}|{r['group']}")
def group_list_data(groups_dir, blocks_dir, clients_dir):
"""Return group summary data in one call"""
import glob
# Get all block files
blocked_peers = set()
for f in glob.glob(f"{blocks_dir}/*.block"):
name = os.path.basename(f).replace('.block', '')
blocked_peers.add(name)
for group_file in sorted(glob.glob(f"{groups_dir}/*.group")):
try:
with open(group_file) as f:
g = json.load(f)
name = g.get('name', '')
desc = g.get('desc', '')
peers = [p for p in g.get('peers', []) if p]
valid_peers = [p for p in peers
if os.path.exists(os.path.join(clients_dir, f"{p}.conf"))]
total = len(valid_peers)
blocked = sum(1 for p in peers if p in blocked_peers)
print(f"{name}|{desc}|{total}|{blocked}")
except:
pass
def fmt_datetime(iso_str, fmt):
"""Format ISO timestamp with given strftime format"""
try:
from datetime import datetime
dt = datetime.fromisoformat(iso_str)
print(dt.strftime(fmt))
except:
print(iso_str)
def create_rule(file, name, desc, dns_redirect, allow_ips, block_ips,
block_ports, allow_ports='', extends='', group=''):
rule = {
'name': name,
'desc': desc,
'group': group,
'dns_redirect': dns_redirect == 'true',
'extends': [x for x in extends.split(',') if x] if extends else [],
'allow_ips': [x for x in allow_ips.split(',') if x] if allow_ips else [],
'allow_ports': [x for x in allow_ports.split(',') if x] if allow_ports else [],
'block_ips': [x for x in block_ips.split(',') if x] if block_ips else [],
'block_ports': [x for x in block_ports.split(',') if x] if block_ports else [],
}
with open(file, 'w') as f:
json.dump(rule, f, indent=2)
def cleanup_config(config_file):
"""Normalize blank lines in WireGuard config"""
import re
try:
with open(config_file) as f:
config = f.read()
config = re.sub(r'\n{3,}', '\n\n', config)
config = config.rstrip('\n') + '\n'
with open(config_file, 'w') as f:
f.write(config)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def remove_peer_block(config_file, name):
"""Remove a peer block from WireGuard config by name"""
import re
try:
with open(config_file) as f:
config = f.read()
pattern = r'\n\[Peer\]\n# ' + re.escape(name) + r'\n[^\n]+\n[^\n]+\n'
result = re.sub(pattern, '\n', config)
with open(config_file, 'w') as f:
f.write(result)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def create_group(file, name, desc):
"""Create a new group JSON file"""
try:
group = {'name': name, 'desc': desc, 'peers': []}
with open(file, 'w') as f:
json.dump(group, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def parse_event(line):
"""Parse a single JSON event line"""
try:
e = json.loads(line)
print(f"{e.get('timestamp','')}|{e.get('client','')}|{e.get('endpoint','')}|{e.get('event','')}")
except:
pass
def parse_fw_event(line):
"""Parse a single fw_events.log JSON line"""
try:
e = json.loads(line)
ts = e.get('timestamp', '')
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = e.get('dest_port', '')
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
proto_num = e.get('ip.protocol', 0)
proto = proto_map.get(proto_num, str(proto_num))
print(f"{ts}|{src}|{dst}|{port}|{proto}")
except:
pass
def peer_transfer(wg_interface):
"""Get total transfer bytes per peer"""
import subprocess
low = int(os.environ.get('ACTIVITY_TOTAL_LOW_BYTES', '1000000'))
med = int(os.environ.get('ACTIVITY_TOTAL_MED_BYTES', '10000000'))
high = int(os.environ.get('ACTIVITY_TOTAL_HIGH_BYTES', '100000000'))
try:
result = subprocess.run(
['wg', 'show', wg_interface, 'transfer'],
capture_output=True, text=True
)
for line in result.stdout.strip().split('\n'):
if not line:
continue
parts = line.split('\t')
if len(parts) == 3:
pubkey, rx, tx = parts
total = int(rx) + int(tx)
if total == 0: level = 'none'
elif total < low: level = 'low'
elif total < med: level = 'medium'
elif total < high: level = 'high'
else: level = 'very high'
print(f"{pubkey}|{rx}|{tx}|{level}")
except:
pass
def peer_transfer_delta(wg_interface, cache_file):
"""Calculate current transfer rate using delta from previous sample"""
import subprocess, time
low = int(os.environ.get('ACTIVITY_CURRENT_LOW_BYTES', '10000')) # 10KB/s
med = int(os.environ.get('ACTIVITY_CURRENT_MED_BYTES', '100000')) # 100KB/s
high = int(os.environ.get('ACTIVITY_CURRENT_HIGH_BYTES', '1000000')) # 1MB/s
current = {}
now = time.time()
try:
result = subprocess.run(
['wg', 'show', wg_interface, 'transfer'],
capture_output=True, text=True
)
for line in result.stdout.strip().split('\n'):
if not line:
continue
parts = line.split('\t')
if len(parts) == 3:
pubkey, rx, tx = parts
current[pubkey] = {'rx': int(rx), 'tx': int(tx), 'ts': now}
except:
pass
prev = {}
if os.path.exists(cache_file):
try:
with open(cache_file) as f:
prev = json.load(f)
except:
pass
try:
with open(cache_file, 'w') as f:
json.dump(current, f)
except:
pass
for pubkey, data in current.items():
if pubkey in prev:
dt = data['ts'] - prev[pubkey].get('ts', data['ts'])
if dt > 0:
rx_rate = max(0, (data['rx'] - prev[pubkey]['rx']) / dt)
tx_rate = max(0, (data['tx'] - prev[pubkey]['tx']) / dt)
total = rx_rate + tx_rate
if total <= 0: level = 'idle'
elif total < low: level = 'low'
elif total < med: level = 'medium'
elif total < high: level = 'high'
else: level = 'very high'
print(f"{pubkey}|{int(rx_rate)}|{int(tx_rate)}|{level}")
else:
print(f"{pubkey}|0|0|idle")
else:
print(f"{pubkey}|0|0|unknown")
def remove_events_filtered(wg_file, fw_file, filter_name, filter_ip,
filter_fw, filter_wg, before_days):
"""Remove events with filters: by name/ip, source, or age"""
import time
from datetime import datetime, timezone
cutoff_ts = None
if before_days:
cutoff_ts = time.time() - (float(before_days) * 86400)
def should_remove_wg(e):
if filter_name and e.get('client') != filter_name:
return False
if cutoff_ts:
try:
ts = datetime.fromisoformat(e.get('timestamp','')).timestamp()
return ts < cutoff_ts
except:
return False
return True
def should_remove_fw(e):
if filter_ip and e.get('src_ip') != filter_ip:
return False
if cutoff_ts:
try:
ts = datetime.fromisoformat(e.get('timestamp','')).timestamp()
return ts < cutoff_ts
except:
return False
return True
removed_wg = removed_fw = 0
if not filter_fw and os.path.exists(wg_file):
lines = []
with open(wg_file) as f:
for line in f:
try:
e = json.loads(line.strip())
if should_remove_wg(e):
removed_wg += 1
continue
except:
pass
lines.append(line)
with open(wg_file, 'w') as f:
f.writelines(lines)
if not filter_wg and os.path.exists(fw_file):
lines = []
with open(fw_file) as f:
for line in f:
try:
e = json.loads(line.strip())
if should_remove_fw(e):
removed_fw += 1
continue
except:
pass
lines.append(line)
with open(fw_file, 'w') as f:
f.writelines(lines)
print(f"{removed_wg}|{removed_fw}")
def _rule_resolve_internal(rules_dir, rule_name, visited=None):
"""Internal recursive resolver — returns dict, does not print"""
if visited is None:
visited = set()
if rule_name in visited:
raise ValueError(f"Circular dependency detected: {rule_name}")
visited.add(rule_name)
rule_file = find_rule_file(rules_dir, rule_name)
with open(rule_file) as f:
rule = json.load(f)
merged = {
'allow_ips': [],
'allow_ports': [],
'block_ips': [],
'block_ports': [],
'dns_redirect': False
}
for base_name in rule.get('extends', []):
base = _rule_resolve_internal(rules_dir, base_name, visited.copy())
merged['allow_ips'] += base.get('allow_ips', [])
merged['allow_ports'] += base.get('allow_ports', [])
merged['block_ips'] += base.get('block_ips', [])
merged['block_ports'] += base.get('block_ports', [])
if base.get('dns_redirect'):
merged['dns_redirect'] = True
# Merge own fields — use .get() with defaults for all fields
merged['allow_ips'] = list(dict.fromkeys(
merged['allow_ips'] + rule.get('allow_ips', [])))
merged['allow_ports'] = list(dict.fromkeys(
merged['allow_ports'] + rule.get('allow_ports', [])))
merged['block_ips'] = list(dict.fromkeys(
merged['block_ips'] + rule.get('block_ips', [])))
merged['block_ports'] = list(dict.fromkeys(
merged['block_ports'] + rule.get('block_ports', [])))
if rule.get('dns_redirect', False):
merged['dns_redirect'] = True
merged['name'] = rule.get('name', rule_name)
merged['desc'] = rule.get('desc', '')
merged['group'] = rule.get('group', '')
merged['extends'] = rule.get('extends', [])
return merged
def rule_resolve(rules_dir, rule_name):
"""Resolve a rule with inheritance — prints JSON"""
try:
resolved = _rule_resolve_internal(rules_dir, rule_name)
print(json.dumps(resolved))
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def rule_resolve_field(rules_dir, rule_name, field):
"""Get a single field from resolved rule — prints values one per line"""
try:
resolved = _rule_resolve_internal(rules_dir, rule_name)
val = resolved.get(field, [])
if isinstance(val, list):
for v in val:
print(v)
else:
print(val)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def rule_inspect(rules_dir, rule_name):
"""Show inheritance tree for a rule"""
try:
rule_file = find_rule_file(rules_dir, rule_name)
with open(rule_file) as f:
rule = json.load(f)
resolved = _rule_resolve_internal(rules_dir, rule_name)
has_extends = bool(rule.get('extends', []))
# Own rules
for ip in rule.get('allow_ips', []):
print(f"own|allow_ip|{ip}")
for p in rule.get('allow_ports', []):
print(f"own|allow_port|{p}")
for ip in rule.get('block_ips', []):
print(f"own|block_ip|{ip}")
for p in rule.get('block_ports', []):
print(f"own|block_port|{p}")
# DNS redirect — separate section
if rule.get('dns_redirect'):
print(f"dns|dns_redirect|true")
if has_extends:
# Inherited rules per base
for base_name in rule.get('extends', []):
base = _rule_resolve_internal(rules_dir, base_name)
for ip in base.get('allow_ips', []):
print(f"inherited:{base_name}|allow_ip|{ip}")
for p in base.get('allow_ports', []):
print(f"inherited:{base_name}|allow_port|{p}")
for ip in base.get('block_ips', []):
print(f"inherited:{base_name}|block_ip|{ip}")
for p in base.get('block_ports', []):
print(f"inherited:{base_name}|block_port|{p}")
if base.get('dns_redirect'):
print(f"inherited:{base_name}|dns_redirect|true")
# Resolved summary only when inheritance exists
has_resolved = (
resolved.get('allow_ips') or resolved.get('allow_ports') or
resolved.get('block_ips') or resolved.get('block_ports') or
resolved.get('dns_redirect')
)
if has_resolved:
for ip in resolved.get('allow_ips', []):
print(f"resolved|allow_ip|{ip}")
for p in resolved.get('allow_ports', []):
print(f"resolved|allow_port|{p}")
for ip in resolved.get('block_ips', []):
print(f"resolved|block_ip|{ip}")
for p in resolved.get('block_ports', []):
print(f"resolved|block_port|{p}")
if resolved.get('dns_redirect'):
print(f"resolved|dns_redirect|true")
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def find_rule_file(rules_dir, rule_name):
"""Find rule file in rules/ or rules/base/"""
for path in [
os.path.join(rules_dir, f"{rule_name}.rule"),
os.path.join(rules_dir, "base", f"{rule_name}.rule"),
]:
if os.path.exists(path):
return path
return ""
def get_raw(file, key):
try:
with open(file) as f:
data = json.load(f)
val = data.get(key) # returns None if missing
if val is None:
pass # print nothing
elif isinstance(val, bool):
print(str(val).lower())
elif isinstance(val, list):
for v in val:
print(v)
else:
print(val)
except:
pass
def count_resolved(rules_dir, rule_name, key):
"""Count entries in resolved rule field"""
try:
resolved = _rule_resolve_internal(rules_dir, rule_name)
print(len(resolved.get(key, [])))
except:
print(0)
def _block_init(peer_ip):
"""Return empty block structure"""
return {
"peer_ip": peer_ip,
"blocked_direct": False,
"blocked_by_groups": [],
"rules": []
}
def _block_read(file):
try:
with open(file) as f:
content = f.read().strip()
if not content:
return None # empty file = no block data
try:
return json.loads(content)
except json.JSONDecodeError:
# Old format — migrate
lines = content.split('\n')
peer_ip = lines[0].split()[0] if lines else ''
new_data = {
"peer_ip": peer_ip,
"blocked_direct": True,
"blocked_by_groups": [],
"rules": [{"name": "full block", "type": "full"}]
}
with open(file, 'w') as f:
json.dump(new_data, f, indent=2)
return new_data
except FileNotFoundError:
return None
except Exception:
return None
def _block_write(file, data):
"""Write block file"""
with open(file, 'w') as f:
json.dump(data, f, indent=2)
def block_get(file):
"""Read and print block file as JSON"""
data = _block_read(file)
if data:
print(json.dumps(data))
def block_is_blocked(file):
"""Return true if peer is effectively blocked"""
data = _block_read(file)
if not data:
print("false")
return
blocked = data.get("blocked_direct", False) or \
bool(data.get("blocked_by_groups", []))
print("true" if blocked else "false")
def block_set_direct(file, peer_ip, value):
"""Set blocked_direct"""
try:
data = _block_read(file) or _block_init(peer_ip)
data["blocked_direct"] = value.lower() == "true"
data["peer_ip"] = peer_ip
_block_write(file, data)
remaining = data["blocked_direct"] or bool(data.get("blocked_by_groups", []))
pass
# print("true" if remaining else "false")
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def block_add_group(file, peer_ip, group):
"""Add group to blocked_by_groups"""
try:
data = _block_read(file) or _block_init(peer_ip)
data["peer_ip"] = peer_ip
groups = data.get("blocked_by_groups", [])
if group not in groups:
groups.append(group)
data["blocked_by_groups"] = groups
_block_write(file, data)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def block_remove_group(file, peer_ip, group):
"""Remove group from blocked_by_groups, return whether still blocked"""
try:
data = _block_read(file) or _block_init(peer_ip)
groups = data.get("blocked_by_groups", [])
if group in groups:
groups.remove(group)
data["blocked_by_groups"] = groups
_block_write(file, data)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
# print("true" if remaining else "false")
pass
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def block_add_rule(file, peer_ip, rule_type, name="", target="",
port="", proto=""):
"""Add a block rule entry"""
try:
data = _block_read(file) or _block_init(peer_ip)
data["peer_ip"] = peer_ip
rule = {"type": rule_type}
if name: rule["name"] = name
if target: rule["target"] = target
if port: rule["port"] = port
if proto: rule["proto"] = proto
rules = data.get("rules", [])
for existing in rules:
if existing.get("type") == rule_type and \
existing.get("target","") == target and \
existing.get("port","") == port and \
existing.get("proto","") == proto:
return # already exists, skip
rules.append(rule)
data["rules"] = rules
_block_write(file, data)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def block_remove_rule(file, rule_type, target="", port="", proto=""):
data = _block_read(file)
if not data:
return
rules = data.get("rules", [])
filtered = [r for r in rules if not (
r.get("type") == rule_type and
r.get("target", "") == target and
r.get("port", "") == port and
r.get("proto", "") == proto
)]
data["rules"] = filtered
_block_write(file, data)
def block_get_rules(file):
"""Print rules as pipe-separated lines: name|type|target|port|proto"""
data = _block_read(file)
if not data:
return
for r in data.get("rules", []):
print(f"{r.get('name','')}|{r.get('type','')}|"
f"{r.get('target','')}|{r.get('port','')}|{r.get('proto','')}")
def block_get_groups(file):
data = _block_read(file)
if not data:
return
print(','.join(data.get('blocked_by_groups', [])))
def block_get_direct(file):
data = _block_read(file)
if not data:
print('false')
return
print('true' if data.get('blocked_direct', False) else 'false')
# ============================================
# Net / Services
# ============================================
def _net_read(file):
"""Read services.json, return dict or empty dict"""
try:
if not os.path.exists(file):
return {}
with open(file) as f:
content = f.read().strip()
if not content:
return {}
return json.loads(content)
except Exception:
return {}
def _net_write(file, data):
"""Write services.json"""
os.makedirs(os.path.dirname(file), exist_ok=True)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
def net_list(file):
"""List all service names with IP and port count"""
data = _net_read(file)
for name, svc in sorted(data.items()):
ip = svc.get('ip', '')
desc = svc.get('desc', '')
tags = ','.join(svc.get('tags', []))
ports = len(svc.get('ports', {}))
print(f"{name}|{ip}|{desc}|{tags}|{ports}")
def net_show(file, name):
"""Show full service details"""
data = _net_read(file)
if name not in data:
print(f"Error: Service not found: {name}", file=sys.stderr)
sys.exit(1)
svc = data[name]
print(f"name|{name}")
print(f"ip|{svc.get('ip','')}")
print(f"desc|{svc.get('desc','')}")
print(f"tags|{','.join(svc.get('tags',[]))}")
for port_name, port_def in svc.get('ports', {}).items():
port = port_def.get('port', '')
proto = port_def.get('proto', 'tcp')
desc = port_def.get('desc', '')
print(f"port|{port_name}|{port}|{proto}|{desc}")
def net_exists(file, name):
"""Check if service exists"""
data = _net_read(file)
# Handle service:port syntax
if ':' in name:
svc_name, port_name = name.split(':', 1)
if port_name == 'ports':
print('true' if svc_name in data else 'false')
else:
svc = data.get(svc_name, {})
print('true' if port_name in svc.get('ports', {}) else 'false')
else:
print('true' if name in data else 'false')
def net_add_service(file, name, ip, desc='', tags=''):
"""Add or update a service"""
data = _net_read(file)
if name not in data:
data[name] = {'ip': ip, 'ports': {}}
else:
data[name]['ip'] = ip
if desc:
data[name]['desc'] = desc
if tags:
data[name]['tags'] = [t.strip() for t in tags.split(',') if t.strip()]
_net_write(file, data)
def net_add_port(file, service, port_name, port, proto='tcp', desc=''):
"""Add or update a port on a service"""
data = _net_read(file)
if service not in data:
print(f"Error: Service not found: {service}", file=sys.stderr)
sys.exit(1)
if 'ports' not in data[service]:
data[service]['ports'] = {}
entry = {'port': int(port), 'proto': proto}
if desc:
entry['desc'] = desc
data[service]['ports'][port_name] = entry
_net_write(file, data)
def net_remove(file, name):
"""Remove service or port"""
data = _net_read(file)
if ':' in name:
svc_name, port_name = name.split(':', 1)
if svc_name not in data:
print(f"Error: Service not found: {svc_name}", file=sys.stderr)
sys.exit(1)
if port_name == 'ports':
# Remove all ports
data[svc_name]['ports'] = {}
else:
if port_name not in data[svc_name].get('ports', {}):
print(f"Error: Port not found: {port_name}", file=sys.stderr)
sys.exit(1)
del data[svc_name]['ports'][port_name]
else:
if name not in data:
print(f"Error: Service not found: {name}", file=sys.stderr)
sys.exit(1)
del data[name]
_net_write(file, data)
def net_resolve(file, name):
"""Resolve service name to ip or ip:port:proto lines"""
data = _net_read(file)
if ':' in name:
svc_name, port_name = name.split(':', 1)
if svc_name not in data:
print(f"Error: Service not found: {svc_name}", file=sys.stderr)
sys.exit(1)
svc = data[svc_name]
ip = svc.get('ip', '')
if port_name == 'ports':
# All ports
for pname, pdef in svc.get('ports', {}).items():
print(f"{ip}:{pdef['port']}:{pdef.get('proto','tcp')}")
else:
if port_name not in svc.get('ports', {}):
print(f"Error: Port not found: {port_name}", file=sys.stderr)
sys.exit(1)
pdef = svc['ports'][port_name]
print(f"{ip}:{pdef['port']}:{pdef.get('proto','tcp')}")
else:
if name not in data:
print(f"Error: Service not found: {name}", file=sys.stderr)
sys.exit(1)
print(data[name].get('ip', ''))
def net_reverse_lookup(file, ip, port='', proto=''):
"""Reverse lookup IP/port to service name"""
data = _net_read(file)
for svc_name, svc in data.items():
if svc.get('ip') != ip:
continue
if not port:
print(svc_name)
return
for port_name, port_def in svc.get('ports', {}).items():
if (str(port_def.get('port','')) == str(port) and
port_def.get('proto','tcp') == proto):
print(f"{svc_name}:{port_name}")
return
# IP matched but no port match — return service name
print(svc_name)
return
def block_is_empty(file):
data = _block_read(file)
if not data:
print("true")
return
empty = (
not data.get("blocked_direct", False) and
not data.get("blocked_by_groups", []) and
not data.get("rules", []) and
not data.get("services", [])
)
print("true" if empty else "false")
def group_has_peer(file, peer_name):
try:
with open(file) as f:
data = json.load(f)
peers = data.get('peers', [])
print('true' if peer_name in peers else 'false')
except Exception:
print('false')
# ============================================
# Subnet Map
# ============================================
def _subnet_read(file):
"""Read subnets.json, return dict or empty dict"""
try:
if not os.path.exists(file):
return {}
with open(file) as f:
content = f.read().strip()
if not content:
return {}
return json.loads(content)
except Exception:
return {}
def _subnet_write(file, data):
"""Write subnets.json"""
os.makedirs(os.path.dirname(file), exist_ok=True)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
def _subnet_is_group(entry):
"""Return True if a subnet entry is a nested group (like 'guests')"""
return isinstance(entry, dict) and 'subnet' not in entry
def subnet_lookup(file, name, type_key=''):
"""
Resolve a subnet name (and optional type) to a CIDR string.
For scalar entries: subnet_lookup(file, "desktop") -> "10.1.1.0/24"
For group entries: subnet_lookup(file, "guests", "phone") -> "10.1.103.0/24"
For group with no type: subnet_lookup(file, "guests") -> "10.1.100.0/24" (none slot)
Prints the CIDR on success, nothing and exits 1 on failure.
"""
data = _subnet_read(file)
if name not in data:
sys.exit(1)
entry = data[name]
if _subnet_is_group(entry):
key = type_key if type_key else 'none'
if key not in entry:
sys.exit(1)
print(entry[key]['subnet'])
else:
print(entry['subnet'])
def subnet_type(file, name, type_key=''):
"""
Return the type string for a subnet entry.
For scalar: subnet_type(file, "desktop") -> "desktop"
For group: subnet_type(file, "guests", "phone") -> "phone"
subnet_type(file, "guests") -> "none"
"""
data = _subnet_read(file)
if name not in data:
sys.exit(1)
entry = data[name]
if _subnet_is_group(entry):
key = type_key if type_key else 'none'
if key not in entry:
sys.exit(1)
# For group entries the type IS the child key
print(key if key != 'none' else 'none')
else:
print(entry.get('type', name))
def subnet_tunnel_mode(file, name, type_key=''):
"""Return tunnel_mode for a subnet entry"""
data = _subnet_read(file)
if name not in data:
print('split') # safe default
return
entry = data[name]
if _subnet_is_group(entry):
key = type_key if type_key else 'none'
child = entry.get(key, {})
print(child.get('tunnel_mode', 'split'))
else:
print(entry.get('tunnel_mode', 'split'))
def subnet_for_ip(file, ip):
"""
Reverse lookup: given a peer IP, find which subnet name (and type) it belongs to.
Output: name|type (e.g. "guests|phone" or "desktop|desktop")
Returns nothing (exit 0) if not found — caller falls back to hardcoded map.
"""
import ipaddress
try:
peer_addr = ipaddress.ip_address(ip)
except ValueError:
return
data = _subnet_read(file)
for name, entry in data.items():
if _subnet_is_group(entry):
for type_key, child in entry.items():
try:
network = ipaddress.ip_network(child['subnet'], strict=False)
if peer_addr in network:
print(f"{name}|{type_key}")
return
except Exception:
continue
else:
try:
network = ipaddress.ip_network(entry['subnet'], strict=False)
if peer_addr in network:
peer_type = entry.get('type', name)
print(f"{name}|{peer_type}")
return
except Exception:
continue
def subnet_list(file):
"""
List all subnets for display.
Output per line: name|subnet|type|tunnel_mode|desc|is_group
For group entries, outputs one line per child: name.type|subnet|type|tunnel_mode|desc|true
"""
data = _subnet_read(file)
for name, entry in data.items():
if _subnet_is_group(entry):
for type_key, child in entry.items():
display_name = f"{name}.{type_key}" if type_key != 'none' else name
print(f"{display_name}|{child.get('subnet','')}|"
f"{type_key}|{child.get('tunnel_mode','split')}|"
f"{child.get('desc','')}|true|{name}")
else:
print(f"{name}|{entry.get('subnet','')}|"
f"{entry.get('type',name)}|{entry.get('tunnel_mode','split')}|"
f"{entry.get('desc','')}|false|{name}")
def subnet_show(file, name):
"""Show a single subnet entry (scalar or group) in detail"""
data = _subnet_read(file)
if name not in data:
print(f"Error: Subnet '{name}' not found", file=sys.stderr)
sys.exit(1)
entry = data[name]
if _subnet_is_group(entry):
print(f"name|{name}")
print(f"is_group|true")
for type_key, child in entry.items():
print(f"child|{type_key}|{child.get('subnet','')}|"
f"{child.get('tunnel_mode','split')}|{child.get('desc','')}")
else:
print(f"name|{name}")
print(f"is_group|false")
print(f"subnet|{entry.get('subnet','')}")
print(f"type|{entry.get('type',name)}")
print(f"tunnel_mode|{entry.get('tunnel_mode','split')}")
print(f"desc|{entry.get('desc','')}")
def subnet_add(file, name, subnet, type_key, tunnel_mode, desc, group_parent=''):
"""
Add a new subnet entry.
If group_parent is set, adds as a child under that group key.
Otherwise adds as a scalar entry.
"""
data = _subnet_read(file)
entry = {
'subnet': subnet,
'tunnel_mode': tunnel_mode or 'split',
'desc': desc or ''
}
if group_parent:
# Adding a child to an existing group, or creating a new group
if group_parent not in data:
data[group_parent] = {}
elif not _subnet_is_group(data[group_parent]):
print(f"Error: '{group_parent}' exists but is not a group", file=sys.stderr)
sys.exit(1)
data[group_parent][type_key or 'none'] = entry
else:
# Scalar entry — type stored explicitly
entry['type'] = type_key or name
data[name] = entry
_subnet_write(file, data)
def subnet_remove(file, name, peers_using):
"""
Remove a subnet entry. peers_using is a comma-separated list of peer names
currently using this subnet (passed in from bash after meta scan).
If non-empty, refuses with error.
"""
if peers_using:
peers = [p for p in peers_using.split(',') if p]
if peers:
print(f"Error: Subnet '{name}' is in use by: {', '.join(peers)}", file=sys.stderr)
sys.exit(1)
data = _subnet_read(file)
if '.' in name:
# Removing a group child: e.g. "guests.phone"
parent, child_key = name.split('.', 1)
if parent not in data or not _subnet_is_group(data[parent]):
print(f"Error: Group '{parent}' not found", file=sys.stderr)
sys.exit(1)
if child_key not in data[parent]:
print(f"Error: '{child_key}' not found in group '{parent}'", file=sys.stderr)
sys.exit(1)
del data[parent][child_key]
if not data[parent]:
del data[parent] # remove empty group
else:
if name not in data:
print(f"Error: Subnet '{name}' not found", file=sys.stderr)
sys.exit(1)
del data[name]
_subnet_write(file, data)
def subnet_rename(file, old_name, new_name, peers_using):
"""
Rename a subnet entry. Hard refusal if any peers reference it.
peers_using: comma-separated peer names from bash meta scan.
"""
if peers_using:
peers = [p for p in peers_using.split(',') if p]
if peers:
print(f"Error: Cannot rename subnet '{old_name}' — in use by: {', '.join(peers)}", file=sys.stderr)
sys.exit(1)
data = _subnet_read(file)
if old_name not in data:
print(f"Error: Subnet '{old_name}' not found", file=sys.stderr)
sys.exit(1)
if new_name in data:
print(f"Error: Subnet '{new_name}' already exists", file=sys.stderr)
sys.exit(1)
data[new_name] = data.pop(old_name)
_subnet_write(file, data)
def subnet_peers(meta_dir, clients_dir, subnet_name, subnets_file):
"""
Find all peers using a subnet.
Two-pass check:
1. Meta field: peer has "subnet": subnet_name in their .meta file
2. IP fallback: peer's IP falls within the subnet's CIDR(s)
(catches peers added before meta stored subnet explicitly)
Output: one peer name per line.
"""
import glob
import ipaddress
# Resolve all CIDRs covered by this subnet name
data = _subnet_read(subnets_file)
cidrs = []
if subnet_name in data:
entry = data[subnet_name]
if _subnet_is_group(entry):
for child in entry.values():
try:
cidrs.append(ipaddress.ip_network(child['subnet'], strict=False))
except Exception:
pass
else:
try:
cidrs.append(ipaddress.ip_network(entry['subnet'], strict=False))
except Exception:
pass
printed = set()
for conf in sorted(glob.glob(f"{clients_dir}/*.conf")):
peer_name = os.path.basename(conf).replace('.conf', '')
# Pass 1: check meta field
meta_file = os.path.join(meta_dir, f"{peer_name}.meta")
try:
with open(meta_file) as f:
meta = json.load(f)
if meta.get('subnet', '') == subnet_name:
if peer_name not in printed:
print(peer_name)
printed.add(peer_name)
continue
except Exception:
pass
# Pass 2: IP reverse lookup against subnet CIDRs
if not cidrs:
continue
peer_ip = ''
try:
with open(conf) as f:
for line in f:
if line.startswith('Address'):
peer_ip = line.split('=')[1].strip().split('/')[0]
break
except Exception:
continue
if not peer_ip:
continue
try:
addr = ipaddress.ip_address(peer_ip)
if any(addr in cidr for cidr in cidrs):
if peer_name not in printed:
print(peer_name)
printed.add(peer_name)
except Exception:
continue
def subnet_exists(file, name):
"""Check if a subnet name exists (scalar or group). Exits 0/1."""
data = _subnet_read(file)
if '.' in name:
parent, child_key = name.split('.', 1)
exists = parent in data and _subnet_is_group(data[parent]) and child_key in data[parent]
else:
exists = name in data
sys.exit(0 if exists else 1)
# ============================================
# Identity System
# ============================================
def identity_rules(file):
"""
Return all rules assigned to an identity, one per line.
Reads from 'rules' array (1:N). Falls back to 'rule' scalar for migration.
"""
data = _identity_read(file)
if not data:
return
# Support legacy scalar 'rule' field
rules = data.get('rules', [])
if not rules and data.get('rule'):
rules = [data['rule']]
for r in rules:
if r:
print(r)
def identity_add_rule(file, identity_name, rule_name):
"""
Add a rule to an identity's rules array.
Warns if already present (prints warning to stderr, exits 2).
Creates identity file if it doesn't exist.
"""
data = _identity_read(file) or _identity_init(identity_name)
rules = data.get('rules', [])
# Migrate legacy scalar field
if 'rule' in data and data['rule']:
if data['rule'] not in rules:
rules.append(data['rule'])
del data['rule']
if rule_name in rules:
print(f"Warning: Rule '{rule_name}' is already assigned to identity '{identity_name}'",
file=sys.stderr)
sys.exit(2)
rules.append(rule_name)
data['rules'] = rules
_identity_write(file, data)
def identity_remove_rule(file, rule_name):
"""
Remove a specific rule from an identity's rules array.
Exits 1 if rule not found.
"""
data = _identity_read(file)
if not data:
print(f"Error: Identity not found", file=sys.stderr)
sys.exit(1)
rules = data.get('rules', [])
if rule_name not in rules:
print(f"Error: Rule '{rule_name}' not assigned to this identity", file=sys.stderr)
sys.exit(1)
rules.remove(rule_name)
data['rules'] = rules
_identity_write(file, data)
def identity_clear_rules(file):
"""Remove all rules from an identity."""
data = _identity_read(file)
if not data:
return
data['rules'] = []
data.pop('rule', None) # remove legacy scalar too
_identity_write(file, data)
def identity_has_rule(file, rule_name):
"""Exit 0 if identity has this rule, 1 otherwise."""
data = _identity_read(file)
if not data:
sys.exit(1)
rules = data.get('rules', [])
if not rules and data.get('rule'):
rules = [data['rule']]
sys.exit(0 if rule_name in rules else 1)
def _identity_read(file):
"""Read an identity file, return dict or None"""
try:
if not os.path.exists(file):
return None
with open(file) as f:
content = f.read().strip()
if not content:
return None
return json.loads(content)
except Exception:
return None
def _identity_write(file, data):
"""Write an identity file"""
os.makedirs(os.path.dirname(file), exist_ok=True)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
def _identity_init(name):
"""Return empty identity structure"""
return {
'name': name,
'peers': [],
'devices': {}
}
def _parse_peer_name(peer_name):
"""
Parse a peer name into (type, identity, index).
phone-nuno -> ('phone', 'nuno', 1)
phone-nuno-2 -> ('phone', 'nuno', 2)
desktop-zephyr -> ('desktop', 'zephyr', 1)
laptop-nuno -> ('laptop', 'nuno', 1)
Returns None if name doesn't match convention.
Convention: {type}-{identity}[-{index}]
Known types: desktop, laptop, phone, tablet, server, iot, none
"""
known_types = {'desktop', 'laptop', 'phone', 'tablet', 'server', 'iot', 'none'}
parts = peer_name.split('-')
if len(parts) < 2:
return None
peer_type = parts[0]
if peer_type not in known_types:
return None
# Check if last part is a numeric index
if len(parts) >= 3 and parts[-1].isdigit():
index = int(parts[-1])
identity = '-'.join(parts[1:-1])
else:
index = 1
identity = '-'.join(parts[1:])
if not identity:
return None
return (peer_type, identity, index)
def identity_list(identities_dir):
"""
List all identities with peer count, rules and policy.
Output per line: name|peer_count|types|rules|policy
"""
import glob
for id_file in sorted(glob.glob(f"{identities_dir}/*.identity")):
try:
with open(id_file) as f:
data = json.load(f)
name = data.get('name', '')
peers = data.get('peers', [])
devices = data.get('devices', {})
rules = data.get('rules', [])
# Migrate legacy scalar rule field
if not rules and data.get('rule'):
rules = [data['rule']]
policy = data.get('policy', 'default')
types = sorted(set(
d.get('type', '') for d in devices.values() if d.get('type')
))
print(f"{name}|{len(peers)}|{','.join(types)}|{','.join(rules)}|{policy}")
except Exception:
continue
def identity_show(file):
"""Show identity details"""
data = _identity_read(file)
if not data:
print("Error: Identity not found", file=sys.stderr)
sys.exit(1)
print(f"name|{data.get('name','')}")
print(f"peer_count|{len(data.get('peers',[]))}")
for peer_name, dev in data.get('devices', {}).items():
print(f"device|{peer_name}|{dev.get('type','')}|{dev.get('index',1)}")
def identity_add_peer(file, identity_name, peer_name, peer_type, index):
"""Add a peer to an identity file, creating it if needed"""
data = _identity_read(file) or _identity_init(identity_name)
if peer_name not in data['peers']:
data['peers'].append(peer_name)
data['devices'][peer_name] = {
'type': peer_type,
'index': int(index)
}
_identity_write(file, data)
def identity_remove_peer(file, peer_name):
"""Remove a peer from an identity file"""
data = _identity_read(file)
if not data:
return
data['peers'] = [p for p in data['peers'] if p != peer_name]
data['devices'].pop(peer_name, None)
_identity_write(file, data)
def identity_remove(file):
"""Delete an identity file — existence check done in bash"""
try:
os.remove(file)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def identity_next_index(file, peer_type):
"""
Return the next available index for a given type within an identity.
phone-nuno exists (index 1) -> returns 2
No phones exist -> returns 1
"""
data = _identity_read(file)
if not data:
print(1)
return
existing = [
d.get('index', 1)
for d in data.get('devices', {}).values()
if d.get('type') == peer_type
]
if not existing:
print(1)
return
# Find lowest unused index starting from 1
used = set(existing)
i = 1
while i in used:
i += 1
print(i)
def identity_peers(file, filter_type=''):
"""
List peers belonging to an identity, optionally filtered by type.
Output: one peer name per line.
"""
data = _identity_read(file)
if not data:
return
for peer_name in data.get('peers', []):
if filter_type:
dev = data.get('devices', {}).get(peer_name, {})
if dev.get('type') != filter_type:
continue
print(peer_name)
def identity_migrate(identities_dir, clients_dir, meta_dir, dry_run):
"""
Scan all peer configs and auto-create identity files from name convention.
dry_run: 'true' -> print what would be done, no writes.
Output per action: action|identity|peer|type|index
"""
import glob
is_dry = dry_run == 'true'
grouped = {} # identity_name -> [(peer_name, type, index)]
for conf in sorted(glob.glob(f"{clients_dir}/*.conf")):
peer_name = os.path.basename(conf).replace('.conf', '')
parsed = _parse_peer_name(peer_name)
if not parsed:
print(f"skip|{peer_name}")
continue
peer_type, identity_name, index = parsed
if identity_name not in grouped:
grouped[identity_name] = []
grouped[identity_name].append((peer_name, peer_type, index))
for identity_name, peers in sorted(grouped.items()):
id_file = os.path.join(identities_dir, f"{identity_name}.identity")
for peer_name, peer_type, index in peers:
print(f"create|{identity_name}|{peer_name}|{peer_type}|{index}")
if not is_dry:
identity_add_peer(id_file, identity_name, peer_name, peer_type, index)
def identity_infer(peer_name):
"""
Parse a peer name and print identity|type|index, or nothing if no match.
Used by add.command.sh to auto-attach on vanilla wgctl add.
"""
parsed = _parse_peer_name(peer_name)
if parsed:
peer_type, identity_name, index = parsed
print(f"{identity_name}|{peer_type}|{index}")
def identity_exists(file):
"""Exit 0 if identity file exists and is valid, else exit 1"""
data = _identity_read(file)
sys.exit(0 if data is not None else 1)
# ============================================
# peer_data update — adds type field from meta
# ============================================
# NOTE: This replaces the existing peer_data function.
# The new version reads 'type' from meta directly.
# Output format: name|ip|rule|type|last_ts|last_evt|main_group
def peer_data(clients_dir, meta_dir, events_log):
"""
Updated peer_data that reads 'type' from meta.
Output: name|ip|rule|type|last_ts|last_evt|main_group
"""
import glob
meta = {}
for f in glob.glob(f"{meta_dir}/*.meta"):
name = os.path.basename(f).replace('.meta', '')
try:
with open(f) as mf:
meta[name] = json.load(mf)
except Exception:
meta[name] = {}
last_events = {}
try:
with open(events_log) as f:
for line in f:
try:
e = json.loads(line.strip())
client = e.get('client', '')
if client:
last_events[client] = e
except Exception:
pass
except Exception:
pass
for conf in sorted(glob.glob(f"{clients_dir}/*.conf")):
name = os.path.basename(conf).replace('.conf', '')
ip = ''
try:
with open(conf) as f:
for line in f:
if line.startswith('Address'):
ip = line.split('=')[1].strip().split('/')[0]
break
except Exception:
pass
m = meta.get(name, {})
rule = m.get('rule', '')
peer_type = m.get('type', '')
main_group = m.get('main_group', '')
last_event = last_events.get(name, {})
last_ts = last_event.get('timestamp', '')
last_evt = last_event.get('event', '')
print(f"{name}|{ip}|{rule}|{peer_type}|{last_ts}|{last_evt}|{main_group}")
def subnet_default_rule(file, name, type_key=''):
"""
Return the default_rule for a subnet entry, or empty string if none set.
For scalar: subnet_default_rule(file, "desktop") -> ""
For group: subnet_default_rule(file, "guests", "phone") -> "guest"
"""
data = _subnet_read(file)
if name not in data:
print('')
return
entry = data[name]
if _subnet_is_group(entry):
key = type_key if type_key else 'none'
child = entry.get(key, {})
print(child.get('default_rule', ''))
else:
print(entry.get('default_rule', ''))
def subnet_list_names(file):
"""
List all top-level subnet names, one per line.
Used for dynamic flag registration in commands.
Output: one name per line (e.g. desktop, laptop, guests, servers, iot)
"""
data = _subnet_read(file)
for name in data.keys():
print(name)
# ============================================
# Policy System
# ============================================
_POLICY_DEFAULTS = {
"default": {
"tunnel_mode": "split",
"default_rule": None,
"strict_rule": False,
"auto_apply": True,
"desc": "Default policy"
},
"guest": {
"tunnel_mode": "split",
"default_rule": "guest",
"strict_rule": True,
"auto_apply": True,
"desc": "Guest access policy"
},
"trusted": {
"tunnel_mode": "split",
"default_rule": None,
"strict_rule": False,
"auto_apply": True,
"desc": "Trusted device policy"
},
"server": {
"tunnel_mode": "split",
"default_rule": None,
"strict_rule": False,
"auto_apply": True,
"desc": "Server policy"
},
"iot": {
"tunnel_mode": "split",
"default_rule": None,
"strict_rule": False,
"auto_apply": True,
"desc": "IoT device policy"
}
}
def _policy_read(file):
"""Read policies.json, fall back to hardcoded defaults if missing."""
try:
if not os.path.exists(file):
return dict(_POLICY_DEFAULTS)
with open(file) as f:
content = f.read().strip()
if not content:
return dict(_POLICY_DEFAULTS)
data = json.loads(content)
# Merge with defaults so hardcoded policies always exist
merged = dict(_POLICY_DEFAULTS)
merged.update(data)
return merged
except Exception:
return dict(_POLICY_DEFAULTS)
def _policy_write(file, data):
"""Write policies.json."""
os.makedirs(os.path.dirname(file), exist_ok=True)
with open(file, 'w') as f:
json.dump(data, f, indent=2)
def _policy_get_entry(data, name):
"""Get a policy entry, falling back to 'default' policy values for missing fields."""
entry = data.get(name, {})
default = data.get('default', _POLICY_DEFAULTS.get('default', {}))
# Merge: entry fields override default
resolved = dict(default)
resolved.update(entry)
return resolved
def policy_get(file, name, field=''):
"""
Get a policy entry or a specific field from it.
policy_get(file, "guest") -> prints all fields as key|value lines
policy_get(file, "guest", "tunnel_mode") -> prints "split"
policy_get(file, "guest", "strict_rule") -> prints "true" or "false"
"""
data = _policy_read(file)
entry = _policy_get_entry(data, name)
if field:
val = entry.get(field)
if val is None:
print('')
elif isinstance(val, bool):
print('true' if val else 'false')
else:
print(val)
else:
for k, v in entry.items():
if isinstance(v, bool):
print(f"{k}|{'true' if v else 'false'}")
elif v is None:
print(f"{k}|")
else:
print(f"{k}|{v}")
def policy_list(file):
"""
List all policies.
Output per line: name|tunnel_mode|default_rule|strict_rule|auto_apply|desc
"""
data = _policy_read(file)
for name, raw_entry in data.items():
entry = _policy_get_entry(data, name)
tunnel_mode = entry.get('tunnel_mode', 'split')
default_rule = entry.get('default_rule') or ''
strict_rule = 'true' if entry.get('strict_rule', False) else 'false'
auto_apply = 'true' if entry.get('auto_apply', True) else 'false'
desc = entry.get('desc', '')
print(f"{name}|{tunnel_mode}|{default_rule}|{strict_rule}|{auto_apply}|{desc}")
def policy_exists(file, name):
"""Exit 0 if policy exists, 1 otherwise."""
data = _policy_read(file)
sys.exit(0 if name in data else 1)
def policy_add(file, name, tunnel_mode, default_rule, strict_rule, auto_apply, desc):
"""Add or update a policy entry."""
data = _policy_read(file)
data[name] = {
'tunnel_mode': tunnel_mode or 'split',
'default_rule': default_rule if default_rule else None,
'strict_rule': strict_rule == 'true',
'auto_apply': auto_apply != 'false',
'desc': desc or ''
}
_policy_write(file, data)
def policy_remove(file, name):
"""Remove a policy. Refuses to remove hardcoded defaults."""
if name in _POLICY_DEFAULTS:
print(f"Error: Cannot remove built-in policy '{name}'", file=sys.stderr)
sys.exit(1)
data = _policy_read(file)
if name not in data:
print(f"Error: Policy '{name}' not found", file=sys.stderr)
sys.exit(1)
del data[name]
_policy_write(file, data)
def policy_set_field(file, name, field, value):
"""Set a single field on an existing policy."""
data = _policy_read(file)
if name not in data:
print(f"Error: Policy '{name}' not found", file=sys.stderr)
sys.exit(1)
entry = data[name]
if field in ('strict_rule', 'auto_apply'):
entry[field] = value == 'true'
elif field == 'default_rule':
entry[field] = value if value else None
else:
entry[field] = value
data[name] = entry
_policy_write(file, data)
def subnet_policy(subnets_file, subnet_name, type_key=''):
"""
Get the policy name for a subnet entry.
Falls back to 'default' if no policy set.
"""
data = _subnet_read(subnets_file)
if subnet_name not in data:
print('default')
return
entry = data[subnet_name]
if _subnet_is_group(entry):
key = type_key if type_key else 'none'
child = entry.get(key, {})
print(child.get('policy', 'default'))
else:
print(entry.get('policy', 'default'))
def json_get_nested(file, *keys):
"""
Get a nested field from a JSON file.
json_get_nested(file, "rule_flags", "strict_rule")
Output: the value as a string, or empty string if not found.
"""
try:
with open(file) as f:
data = json.load(f)
val = data
for key in keys:
if not isinstance(val, dict):
print('')
return
val = val.get(key)
if val is None:
print('')
return
if isinstance(val, bool):
print('true' if val else 'false')
elif val is None:
print('')
else:
print(val)
except Exception:
print('')
def json_set_nested(file, *args):
"""
Set a nested field in a JSON file.
Args: file, key1, key2, ..., value
json_set_nested(file, "rule_flags", "strict_rule", "true")
Creates intermediate dicts as needed.
"""
if len(args) < 2:
return
keys = args[:-1]
value = args[-1]
try:
if os.path.exists(file):
with open(file) as f:
data = json.load(f)
else:
data = {}
# Navigate/create nested structure
target = data
for key in keys[:-1]:
if key not in target or not isinstance(target[key], dict):
target[key] = {}
target = target[key]
# Coerce value types
final_key = keys[-1]
if value == 'true':
target[final_key] = True
elif value == 'false':
target[final_key] = False
else:
target[final_key] = value
with open(file, 'w') as f:
json.dump(data, f, indent=2)
except Exception as e:
print(f"Error: {e}", file=sys.stderr)
sys.exit(1)
def activity_aggregate(fw_file, wg_file, wg_interface, net_file,
clients_dir, meta_dir, hours, filter_peer, filter_service_ip):
"""
Aggregate activity data for wgctl activity.
Output:
peer|name|rx_bytes|tx_bytes|drop_count
service|peer_name|dest_display|drop_count
"""
import glob
import subprocess
from datetime import datetime, timezone, timedelta
from collections import defaultdict
hours = int(hours) if hours else 24
cutoff = None
if hours > 0:
cutoff = datetime.now(timezone.utc) - timedelta(hours=hours)
# Build ip -> peer name map
ip_to_peer = {}
for conf in sorted(glob.glob(f"{clients_dir}/*.conf")):
name = os.path.basename(conf).replace('.conf', '')
try:
with open(conf) as f:
for line in f:
if line.startswith('Address'):
ip = line.split('=')[1].strip().split('/')[0]
ip_to_peer[ip] = name
break
except Exception:
continue
# Build pubkey -> peer name map
pubkey_to_peer = {}
for kf in glob.glob(f"{clients_dir}/*_public.key"):
name = os.path.basename(kf).replace('_public.key', '')
try:
with open(kf) as f:
key = f.read().strip()
if key:
pubkey_to_peer[key] = name
except Exception:
continue
# Get WireGuard transfer totals
peer_rx = defaultdict(int)
peer_tx = defaultdict(int)
try:
result = subprocess.run(
['wg', 'show', wg_interface, 'transfer'],
capture_output=True, text=True
)
for line in result.stdout.strip().splitlines():
parts = line.split()
if len(parts) >= 3:
pubkey, rx, tx = parts[0], int(parts[1]), int(parts[2])
peer = pubkey_to_peer.get(pubkey)
if peer:
peer_rx[peer] += rx
peer_tx[peer] += tx
except Exception:
pass
# Load net services for reverse lookup
net_data = {}
if os.path.exists(net_file):
try:
with open(net_file) as f:
net_data = json.load(f)
except Exception:
pass
def reverse_lookup(dest_ip, dest_port, proto):
for svc_name, svc in net_data.items():
if not isinstance(svc, dict):
continue
if svc.get('ip', '') != dest_ip:
continue
ports = svc.get('ports', {})
if dest_port:
for port_name, port_def in ports.items():
if not isinstance(port_def, dict):
continue
if (str(port_def.get('port', '')) == str(dest_port) and
port_def.get('proto', 'tcp') == proto):
return f"{svc_name}:{port_name}"
return svc_name
return svc_name
return ''
# Parse and first-pass dedup (within time window per key)
events = []
last_seen = {}
try:
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
src = e.get('src_ip', '')
if not src:
continue
if filter_ip and src != filter_ip:
continue
proto_num = int(e.get('ip.protocol', 0))
proto = proto_map.get(proto_num, str(proto_num))
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
key = (src, dst, port, proto_num)
ts_str = e.get('timestamp', '')
try:
ts = datetime.fromisoformat(ts_str).timestamp()
except Exception:
ts = 0
windows = {1: 5, 6: 30, 17: 10}
window = windows.get(proto_num, 10)
if key in last_seen and (ts - last_seen[key]) < window:
continue
last_seen[key] = ts
events.append(e)
except Exception:
pass
except Exception:
pass
# Second-pass dedup consecutive same events with count
deduped = []
counts = []
for e in events:
ts_str = e.get('timestamp', '')
try:
ts = datetime.fromisoformat(ts_str).timestamp()
except Exception:
ts = 0
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
proto_num = int(e.get('ip.protocol', 0))
key = (src, dst, port, proto_num)
if deduped:
prev = deduped[-1]
try:
prev_ts = datetime.fromisoformat(prev.get('timestamp', '')).timestamp()
except Exception:
prev_ts = 0
prev_key = (
prev.get('src_ip', ''),
prev.get('dest_ip', ''),
str(prev.get('dest_port', '')),
int(prev.get('ip.protocol', 0))
)
if key == prev_key and (ts - prev_ts) < 300:
counts[-1] += 1
continue
deduped.append(e)
counts.append(1)
limit = int(limit) if limit else 50
for e, count in list(zip(deduped, counts))[-limit:]:
ts_str = e.get('timestamp', '')
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = str(e.get('dest_port', ''))
proto_num = int(e.get('ip.protocol', 0))
proto = proto_map.get(proto_num, str(proto_num))
client = ip_to_name.get(src, src)
svc_name = reverse_lookup(dst, port, proto)
try:
dt = datetime.fromisoformat(ts_str)
ts_fmt = dt.strftime(DATETIME_FMT)
except Exception:
ts_fmt = ts_str
print(f"{ts_fmt}|{client}|{dst}|{port}|{proto}|{svc_name}|{count}")
def make_dest_display(dest_ip, dest_port, proto, svc_name):
if svc_name:
return svc_name
if dest_port:
display = f"{dest_ip}:{dest_port}"
else:
display = dest_ip
if proto and proto not in ('tcp', '6'):
display += f" ({proto})"
return display
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
# Parse fw_events for drops
peer_drops = defaultdict(int)
service_drops = defaultdict(lambda: defaultdict(int))
if os.path.exists(fw_file):
try:
with open(fw_file) as f:
for line in f:
line = line.strip()
if not line:
continue
try:
ev = json.loads(line)
if cutoff:
ts_str = ev.get('timestamp', '')
try:
ts = datetime.fromisoformat(ts_str)
if ts.tzinfo is None:
ts = ts.replace(tzinfo=timezone.utc)
if ts < cutoff:
continue
except Exception:
pass
src_ip = ev.get('src_ip', '')
if not src_ip:
continue
dest_ip = ev.get('dest_ip', '')
dest_port = str(ev.get('dest_port', ''))
proto_num = ev.get('ip.protocol', 0)
proto = proto_map.get(int(proto_num), str(proto_num))
peer = ip_to_peer.get(src_ip)
if not peer:
continue
if filter_peer and peer != filter_peer:
continue
if filter_service_ip and dest_ip != filter_service_ip:
continue
svc_name = reverse_lookup(dest_ip, dest_port, proto)
dest_display = make_dest_display(dest_ip, dest_port, proto, svc_name)
peer_drops[peer] += 1
service_drops[peer][dest_display] += 1
except Exception:
continue
except Exception:
pass
# Collect peers with any activity
all_peers = set()
all_peers.update(k for k in peer_rx if peer_rx[k] > 0)
all_peers.update(k for k in peer_tx if peer_tx[k] > 0)
all_peers.update(peer_drops.keys())
if filter_peer:
all_peers = {p for p in all_peers if p == filter_peer}
for peer in sorted(all_peers):
rx = peer_rx.get(peer, 0)
tx = peer_tx.get(peer, 0)
drops = peer_drops.get(peer, 0)
print(f"peer|{peer}|{rx}|{tx}|{drops}")
svc_map = service_drops.get(peer, {})
for dest_display, count in sorted(svc_map.items(), key=lambda x: -x[1]):
print(f"service|{peer}|{dest_display}|{count}")
def _hosts_read(file):
if not os.path.exists(file):
return {"hosts": {}, "subnets": {}, "ports": {}}
try:
with open(file) as f:
data = json.load(f)
# Ensure all sections exist
data.setdefault("hosts", {})
data.setdefault("subnets", {})
data.setdefault("ports", {})
return data
except Exception:
return {"hosts": {}, "subnets": {}, "ports": {}}
def _hosts_write(file, data):
with open(file, 'w') as f:
json.dump(data, f, indent=2)
def hosts_list(file):
"""
List all host entries.
Output per line: type|key|name|desc|tags
"""
data = _hosts_read(file)
for ip, entry in sorted(data["hosts"].items()):
if isinstance(entry, dict):
name = entry.get("name", "")
desc = entry.get("desc", "")
tags = ",".join(entry.get("tags", []))
else:
name = str(entry)
desc = ""
tags = ""
print(f"host|{ip}|{name}|{desc}|{tags}")
for subnet, entry in sorted(data["subnets"].items()):
if isinstance(entry, dict):
name = entry.get("name", "")
desc = entry.get("desc", "")
tags = ",".join(entry.get("tags", []))
else:
name = str(entry)
desc = ""
tags = ""
print(f"subnet|{subnet}|{name}|{desc}|{tags}")
for port, entry in sorted(data["ports"].items()):
if isinstance(entry, dict):
name = entry.get("name", "")
desc = entry.get("desc", "")
tags = ",".join(entry.get("tags", []))
else:
name = str(entry)
desc = ""
tags = ""
print(f"port|{port}|{name}|{desc}|{tags}")
def hosts_show(file, key, entry_type):
"""Show a single host entry. type: host|subnet|port"""
data = _hosts_read(file)
section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"}
section = section_map.get(entry_type, "hosts")
entry = data[section].get(key)
if not entry:
print(f"Error: not found: {key}", file=sys.stderr)
sys.exit(1)
if isinstance(entry, dict):
print(f"name|{entry.get('name', '')}")
print(f"desc|{entry.get('desc', '')}")
print(f"tags|{','.join(entry.get('tags', []))}")
else:
print(f"name|{entry}")
print(f"desc|")
print(f"tags|")
def hosts_add(file, entry_type, key, name, desc, tags):
"""
Add a host entry.
entry_type: host|subnet|port
key: IP, subnet CIDR, or port number
"""
data = _hosts_read(file)
section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"}
section = section_map.get(entry_type, "hosts")
tag_list = [t.strip() for t in tags.split(",") if t.strip()] if tags else []
data[section][key] = {
"name": name,
"desc": desc,
"tags": tag_list
}
_hosts_write(file, data)
def hosts_remove(file, entry_type, key):
"""Remove a host entry."""
data = _hosts_read(file)
section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"}
section = section_map.get(entry_type, "hosts")
if key not in data[section]:
print(f"Error: not found: {key}", file=sys.stderr)
sys.exit(1)
del data[section][key]
_hosts_write(file, data)
def hosts_exists(file, entry_type, key):
"""Check if a host entry exists."""
data = _hosts_read(file)
section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"}
section = section_map.get(entry_type, "hosts")
print("true" if key in data[section] else "false")
def hosts_lookup(file, ip):
"""
Resolve an IP to a display name.
Checks hosts section only (exact match).
Returns name or empty string.
"""
data = _hosts_read(file)
entry = data["hosts"].get(ip)
if not entry:
print("")
return
if isinstance(entry, dict):
print(entry.get("name", ip))
else:
print(str(entry))
commands = {
'get': lambda args: get(args[0], args[1]),
'set': lambda args: set_key(args[0], args[1], args[2]),
'delete': lambda args: delete_key(args[0], args[1]),
'append': lambda args: append(args[0], args[1], args[2]),
'remove': lambda args: remove_value(args[0], args[1], args[2]),
'cat': lambda args: cat(args[0]),
'has_key': lambda args: has_key(args[0], args[1]),
'filter_values': lambda args: filter_values(args[0], args[1], args[2]),
'last_event': lambda args: last_event(args[0], args[1], args[2], args[3]),
'events_for': lambda args: events_for(args[0], args[1], args[2]),
'fw_events': lambda args: fw_events(
args[0], args[1], args[2], args[3], args[4],
args[5] if len(args) > 5 else '50',
args[6] if len(args) > 6 else '1'),
'wg_events': lambda args: wg_events(
args[0], args[1], args[2],
args[3] if len(args) > 3 else '50',
args[4] if len(args) > 4 else '1'),
'format_fw_event': lambda args: format_fw_event(sys.stdin.read(), args[0]),
'format_wg_event': lambda args: format_wg_event(sys.stdin.read()),
'remove_events': lambda args: remove_events(args[0], args[1]),
'follow_logs': lambda args: follow_logs(args[0], args[1], args[2], args[3], args[4], args[5]),
'count': lambda args: count(args[0], args[1]),
'audit_fw_counts': lambda args: audit_fw_counts(args[0]),
'peer_group_map': lambda args: peer_group_map(args[0]),
'peer_groups': lambda args: peer_groups(args[0], args[1]),
'peer_data': lambda args: peer_data(args[0], args[1], args[2]),
'iso_to_ts': lambda args: iso_to_ts(args[0]),
'rule_list_data': lambda args: rule_list_data(args[0], args[1]),
'group_list_data': lambda args: group_list_data(args[0], args[1], args[2]),
'fmt_datetime': lambda args: fmt_datetime(args[0], args[1]),
'create_rule': lambda args: create_rule(
args[0], args[1], args[2], args[3], args[4], args[5], args[6],
args[7] if len(args) > 7 else '',
args[8] if len(args) > 8 else '',
args[9] if len(args) > 9 else ''
),
'cleanup_config': lambda args: cleanup_config(args[0]),
'remove_peer_block': lambda args: remove_peer_block(args[0], args[1]),
'create_group': lambda args: create_group(args[0], args[1], args[2]),
'parse_event': lambda args: parse_event(args[0]),
'parse_fw_event': lambda args: parse_fw_event(args[0]),
'remove_events_filtered': lambda args: remove_events_filtered(
args[0], args[1], args[2], args[3], args[4]=='true', args[5]=='true', args[6] if len(args)>6 else ''),
'peer_transfer': lambda args: peer_transfer(args[0]),
'peer_transfer_delta': lambda args: peer_transfer_delta(args[0], args[1]),
'rule_resolve': lambda args: rule_resolve(args[0], args[1]),
'rule_resolve_field': lambda args: rule_resolve_field(args[0], args[1], args[2]),
'rule_inspect': lambda args: rule_inspect(args[0], args[1]),
'find_rule_file': lambda args: print(find_rule_file(args[0], args[1])),
'get_raw': lambda args: print(get_raw(args[0], args[1])),
'count_resolved': lambda args: count_resolved(args[0], args[1], args[2]),
'block_get': lambda args: block_get(args[0]),
'block_is_blocked': lambda args: block_is_blocked(args[0]),
'block_set_direct': lambda args: block_set_direct(args[0], args[1], args[2]),
'block_add_group': lambda args: block_add_group(args[0], args[1], args[2]),
'block_remove_group': lambda args: block_remove_group(args[0], args[1], args[2]),
'block_add_rule': lambda args: block_add_rule(
args[0], args[1], args[2],
args[3] if len(args) > 3 else '',
args[4] if len(args) > 4 else '',
args[5] if len(args) > 5 else '',
args[6] if len(args) > 6 else ''
),
'block_remove_rule': lambda args: block_remove_rule(
args[0], args[1],
args[2] if len(args) > 2 else '',
args[3] if len(args) > 3 else '',
args[4] if len(args) > 4 else ''
),
'block_get_rules': lambda args: block_get_rules(args[0]),
'block_get_groups': lambda args: block_get_groups(args[0]),
'block_get_direct': lambda args: block_get_direct(args[0]),
'net_list': lambda args: net_list(args[0]),
'net_show': lambda args: net_show(args[0], args[1]),
'net_exists': lambda args: net_exists(args[0], args[1]),
'net_add_service': lambda args: net_add_service(
args[0], args[1], args[2],
args[3] if len(args) > 3 else '',
args[4] if len(args) > 4 else ''
),
'net_add_port': lambda args: net_add_port(
args[0], args[1], args[2], args[3],
args[4] if len(args) > 4 else 'tcp',
args[5] if len(args) > 5 else ''
),
'net_remove': lambda args: net_remove(args[0], args[1]),
'net_resolve': lambda args: net_resolve(args[0], args[1]),
'net_reverse_lookup': lambda args: net_reverse_lookup(
args[0], args[1],
args[2] if len(args) > 2 else '',
args[3] if len(args) > 3 else ''
),
'block_is_empty': lambda args: block_is_empty(args[0]),
'group_has_peer': lambda args: group_has_peer(args[0], args[1]),
# Subnet commands:
'subnet_lookup': lambda args: subnet_lookup(args[0], args[1], args[2] if len(args) > 2 else ''),
'subnet_type': lambda args: subnet_type(args[0], args[1], args[2] if len(args) > 2 else ''),
'subnet_tunnel_mode': lambda args: subnet_tunnel_mode(args[0], args[1], args[2] if len(args) > 2 else ''),
'subnet_for_ip': lambda args: subnet_for_ip(args[0], args[1]),
'subnet_list': lambda args: subnet_list(args[0]),
'subnet_show': lambda args: subnet_show(args[0], args[1]),
'subnet_add': lambda args: subnet_add(
args[0], args[1], args[2], args[3],
args[4] if len(args) > 4 else 'split',
args[5] if len(args) > 5 else '',
args[6] if len(args) > 6 else ''
),
'subnet_remove': lambda args: subnet_remove(args[0], args[1], args[2] if len(args) > 2 else ''),
'subnet_rename': lambda args: subnet_rename(args[0], args[1], args[2], args[3] if len(args) > 3 else ''),
'subnet_peers': lambda args: subnet_peers(args[0], args[1], args[2], args[3]),
'subnet_exists': lambda args: subnet_exists(args[0], args[1]),
# Identity commands:
'identity_list': lambda args: identity_list(args[0]),
'identity_show': lambda args: identity_show(args[0]),
'identity_add_peer': lambda args: identity_add_peer(args[0], args[1], args[2], args[3], args[4]),
'identity_remove_peer':lambda args: identity_remove_peer(args[0], args[1]),
'identity_remove': lambda args: identity_remove(args[0]),
'identity_next_index': lambda args: identity_next_index(args[0], args[1]),
'identity_peers': lambda args: identity_peers(args[0], args[1] if len(args) > 1 else ''),
'identity_migrate': lambda args: identity_migrate(args[0], args[1], args[2], args[3]),
'identity_infer': lambda args: identity_infer(args[0]),
'identity_exists': lambda args: identity_exists(args[0]),
'subnet_default_rule': lambda args: subnet_default_rule(args[0], args[1], args[2] if len(args) > 2 else ''),
'subnet_list_names': lambda args: subnet_list_names(args[0]),
# Policy commands:
'policy_get': lambda args: policy_get(args[0], args[1], args[2] if len(args) > 2 else ''),
'policy_list': lambda args: policy_list(args[0]),
'policy_exists': lambda args: policy_exists(args[0], args[1]),
'policy_add': lambda args: policy_add(args[0], args[1], args[2], args[3], args[4], args[5], args[6] if len(args) > 6 else ''),
'policy_remove': lambda args: policy_remove(args[0], args[1]),
'policy_set_field': lambda args: policy_set_field(args[0], args[1], args[2], args[3]),
'subnet_policy': lambda args: subnet_policy(args[0], args[1], args[2] if len(args) > 2 else ''),
'get_nested': lambda args: json_get_nested(args[0], *args[1:]),
'set_nested': lambda args: json_set_nested(args[0], *args[1:]),
'identity_rules': lambda args: identity_rules(args[0]),
'identity_add_rule': lambda args: identity_add_rule(args[0], args[1], args[2]),
'identity_remove_rule': lambda args: identity_remove_rule(args[0], args[1]),
'identity_clear_rules': lambda args: identity_clear_rules(args[0]),
'identity_has_rule': lambda args: identity_has_rule(args[0], args[1]),
'activity_aggregate': lambda args: activity_aggregate(
args[0], args[1], args[2], args[3], args[4], args[5],
args[6] if len(args) > 6 else '24',
args[7] if len(args) > 7 else '',
args[8] if len(args) > 8 else ''
),
'hosts_list': lambda args: hosts_list(args[0]),
'hosts_show': lambda args: hosts_show(args[0], args[1], args[2]),
'hosts_add': lambda args: hosts_add(args[0], args[1], args[2], args[3],
args[4] if len(args) > 4 else '',
args[5] if len(args) > 5 else ''),
'hosts_remove': lambda args: hosts_remove(args[0], args[1], args[2]),
'hosts_exists': lambda args: hosts_exists(args[0], args[1], args[2]),
'hosts_lookup': lambda args: hosts_lookup(args[0], args[1]),
}
if __name__ == '__main__':
if len(sys.argv) < 2:
print("Usage: json_helper.py <command> <file> [key] [value]", file=sys.stderr)
sys.exit(1)
cmd = sys.argv[1]
args = sys.argv[2:]
if cmd not in commands:
print(f"Unknown command: {cmd}", file=sys.stderr)
sys.exit(1)
commands[cmd](args)
| 1 | #!/usr/bin/env python3 |
| 2 | """ |
| 3 | wgctl JSON helper — called by shell functions to read/write JSON files. |
| 4 | Usage: json_helper.py <command> <file> [key] [value] |
| 5 | """ |
| 6 | |
| 7 | import sys |
| 8 | import json |
| 9 | import os |
| 10 | |
| 11 | DATETIME_FMT = os.environ.get('WGCTL_DATETIME_FMT', '%Y-%m-%d %H:%M') |
| 12 | |
| 13 | def get(file, key): |
| 14 | try: |
| 15 | with open(file) as f: |
| 16 | data = json.load(f) |
| 17 | val = data.get(key, []) |
| 18 | if isinstance(val, bool): |
| 19 | print(str(val).lower()) # true/false not True/False |
| 20 | elif isinstance(val, list): |
| 21 | if val: |
| 22 | print('\n'.join(str(v) for v in val)) |
| 23 | else: |
| 24 | if val: |
| 25 | print(val) |
| 26 | except: |
| 27 | sys.exit(0) |
| 28 | |
| 29 | def set_key(file, key, value): |
| 30 | try: |
| 31 | data = {} |
| 32 | if os.path.exists(file): |
| 33 | with open(file) as f: |
| 34 | data = json.load(f) |
| 35 | # Try to parse as JSON value first (for arrays/bools) |
| 36 | try: |
| 37 | data[key] = json.loads(value) |
| 38 | except: |
| 39 | data[key] = value |
| 40 | with open(file, 'w') as f: |
| 41 | json.dump(data, f, indent=2) |
| 42 | except Exception as e: |
| 43 | print(f"Error: {e}", file=sys.stderr) |
| 44 | sys.exit(1) |
| 45 | |
| 46 | def delete_key(file, key): |
| 47 | try: |
| 48 | with open(file) as f: |
| 49 | data = json.load(f) |
| 50 | data.pop(key, None) |
| 51 | with open(file, 'w') as f: |
| 52 | json.dump(data, f, indent=2) |
| 53 | except Exception as e: |
| 54 | print(f"Error: {e}", file=sys.stderr) |
| 55 | sys.exit(1) |
| 56 | |
| 57 | def append(file, key, value): |
| 58 | try: |
| 59 | data = {} |
| 60 | if os.path.exists(file): |
| 61 | with open(file) as f: |
| 62 | data = json.load(f) |
| 63 | if key not in data: |
| 64 | data[key] = [] |
| 65 | if value not in data[key]: |
| 66 | data[key].append(value) |
| 67 | with open(file, 'w') as f: |
| 68 | json.dump(data, f, indent=2) |
| 69 | except Exception as e: |
| 70 | print(f"Error: {e}", file=sys.stderr) |
| 71 | sys.exit(1) |
| 72 | |
| 73 | def remove_value(file, key, value): |
| 74 | try: |
| 75 | with open(file) as f: |
| 76 | data = json.load(f) |
| 77 | if key in data and value in data[key]: |
| 78 | data[key].remove(value) |
| 79 | with open(file, 'w') as f: |
| 80 | json.dump(data, f, indent=2) |
| 81 | except Exception as e: |
| 82 | print(f"Error: {e}", file=sys.stderr) |
| 83 | sys.exit(1) |
| 84 | |
| 85 | def cat(file): |
| 86 | try: |
| 87 | with open(file) as f: |
| 88 | data = json.load(f) |
| 89 | print(json.dumps(data, indent=2)) |
| 90 | except Exception as e: |
| 91 | sys.exit(1) |
| 92 | |
| 93 | def has_key(file, key): |
| 94 | try: |
| 95 | with open(file) as f: |
| 96 | data = json.load(f) |
| 97 | sys.exit(0 if key in data else 1) |
| 98 | except: |
| 99 | sys.exit(1) |
| 100 | |
| 101 | def filter_values(file, key, value): |
| 102 | """Remove all entries where value matches""" |
| 103 | try: |
| 104 | with open(file) as f: |
| 105 | data = json.load(f) |
| 106 | data = {k: v for k, v in data.items() if v != value} |
| 107 | with open(file, 'w') as f: |
| 108 | json.dump(data, f, indent=2) |
| 109 | except Exception as e: |
| 110 | print(f"Error: {e}", file=sys.stderr) |
| 111 | sys.exit(1) |
| 112 | |
| 113 | def last_event(file, key, field, client): |
| 114 | """Get last event field for a client""" |
| 115 | try: |
| 116 | last = None |
| 117 | with open(file) as f: |
| 118 | for line in f: |
| 119 | try: |
| 120 | e = json.loads(line.strip()) |
| 121 | if e.get(key) == client: |
| 122 | last = e |
| 123 | except: |
| 124 | pass |
| 125 | if last: |
| 126 | print(last.get(field, '')) |
| 127 | except: |
| 128 | pass |
| 129 | |
| 130 | def events_for(file, ip, limit): |
| 131 | """Format events for a given IP""" |
| 132 | try: |
| 133 | from datetime import datetime |
| 134 | events = [] |
| 135 | with open(file) as f: |
| 136 | for line in f: |
| 137 | try: |
| 138 | e = json.loads(line.strip()) |
| 139 | if e.get('ip') == ip: |
| 140 | events.append(e) |
| 141 | except: |
| 142 | pass |
| 143 | for e in events[-int(limit):]: |
| 144 | ts = e.get('timestamp', '') |
| 145 | try: |
| 146 | dt = datetime.fromisoformat(ts) |
| 147 | ts = dt.strftime(DATETIME_FMT) |
| 148 | except: |
| 149 | pass |
| 150 | endpoint = e.get('endpoint', '—') |
| 151 | client = e.get('client', '—') |
| 152 | event = e.get('event', '—') |
| 153 | print(f' {ts} {client:<20} {endpoint:<20} {event}') |
| 154 | except: |
| 155 | pass |
| 156 | |
| 157 | def fw_events(file, filter_ip, filter_type, clients_dir, net_file, limit, collapse='1'): |
| 158 | """ |
| 159 | Format firewall drop events with dedup, counts, and service annotation. |
| 160 | collapse='1' (default): hourly aggregation |
| 161 | collapse='0': show all deduplicated events (--detailed mode) |
| 162 | Output per line: ts|client|dest_ip|dest_port|proto|service_name|count |
| 163 | """ |
| 164 | import glob |
| 165 | from datetime import datetime |
| 166 | from collections import defaultdict |
| 167 | proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'} |
| 168 | do_collapse = str(collapse) != '0' |
| 169 | |
| 170 | # Build ip->name map |
| 171 | ip_to_name = {} |
| 172 | for conf in glob.glob(f"{clients_dir}/*.conf"): |
| 173 | name = os.path.basename(conf).replace('.conf', '') |
| 174 | try: |
| 175 | with open(conf) as f: |
| 176 | for line in f: |
| 177 | if line.startswith('Address'): |
| 178 | ip = line.split('=')[1].strip().split('/')[0] |
| 179 | ip_to_name[ip] = name |
| 180 | except Exception: |
| 181 | pass |
| 182 | |
| 183 | # Load net services for reverse lookup |
| 184 | net_data = {} |
| 185 | if net_file and os.path.exists(net_file): |
| 186 | try: |
| 187 | with open(net_file) as f: |
| 188 | net_data = json.load(f) |
| 189 | except Exception: |
| 190 | pass |
| 191 | |
| 192 | def reverse_lookup(dest_ip, dest_port, proto): |
| 193 | for svc_name, svc in net_data.items(): |
| 194 | if not isinstance(svc, dict): |
| 195 | continue |
| 196 | if svc.get('ip', '') != dest_ip: |
| 197 | continue |
| 198 | ports = svc.get('ports', {}) |
| 199 | if dest_port: |
| 200 | for port_name, port_def in ports.items(): |
| 201 | if not isinstance(port_def, dict): |
| 202 | continue |
| 203 | if (str(port_def.get('port', '')) == str(dest_port) and |
| 204 | port_def.get('proto', 'tcp') == proto): |
| 205 | return f"{svc_name}:{port_name}" |
| 206 | return svc_name |
| 207 | return svc_name |
| 208 | return '' |
| 209 | |
| 210 | # Parse and first-pass dedup (within time window per key) |
| 211 | events = [] |
| 212 | last_seen = {} |
| 213 | |
| 214 | try: |
| 215 | with open(file) as f: |
| 216 | for line in f: |
| 217 | try: |
| 218 | e = json.loads(line.strip()) |
| 219 | src = e.get('src_ip', '') |
| 220 | if not src: |
| 221 | continue |
| 222 | if filter_ip and src != filter_ip: |
| 223 | continue |
| 224 | |
| 225 | proto_num = int(e.get('ip.protocol', 0)) |
| 226 | proto = proto_map.get(proto_num, str(proto_num)) |
| 227 | dst = e.get('dest_ip', '') |
| 228 | port = str(e.get('dest_port', '')) |
| 229 | key = (src, dst, port, proto_num) |
| 230 | |
| 231 | ts_str = e.get('timestamp', '') |
| 232 | try: |
| 233 | ts = datetime.fromisoformat(ts_str).timestamp() |
| 234 | except Exception: |
| 235 | ts = 0 |
| 236 | |
| 237 | windows = {1: 5, 6: 30, 17: 10} |
| 238 | window = windows.get(proto_num, 10) |
| 239 | if key in last_seen and (ts - last_seen[key]) < window: |
| 240 | continue |
| 241 | last_seen[key] = ts |
| 242 | events.append(e) |
| 243 | except Exception: |
| 244 | continue |
| 245 | except Exception: |
| 246 | pass |
| 247 | |
| 248 | limit = int(limit) if limit else 50 |
| 249 | |
| 250 | if do_collapse: |
| 251 | # Hourly aggregation: group by (client, dst, port, proto, date, hour) |
| 252 | hourly = defaultdict(int) |
| 253 | hourly_ts = {} # store first ts per hour bucket for output ordering |
| 254 | |
| 255 | for e in events: |
| 256 | src = e.get('src_ip', '') |
| 257 | dst = e.get('dest_ip', '') |
| 258 | port = str(e.get('dest_port', '')) |
| 259 | proto_num = int(e.get('ip.protocol', 0)) |
| 260 | proto = proto_map.get(proto_num, str(proto_num)) |
| 261 | ts_str = e.get('timestamp', '') |
| 262 | client = ip_to_name.get(src, src) |
| 263 | svc_name = reverse_lookup(dst, port, proto) |
| 264 | |
| 265 | try: |
| 266 | dt = datetime.fromisoformat(ts_str) |
| 267 | hour_key = (client, dst, port, proto, svc_name, |
| 268 | dt.strftime('%Y-%m-%d %H')) |
| 269 | hourly[hour_key] += 1 |
| 270 | if hour_key not in hourly_ts: |
| 271 | hourly_ts[hour_key] = dt |
| 272 | except Exception: |
| 273 | continue |
| 274 | |
| 275 | # Sort by timestamp and emit last N |
| 276 | sorted_buckets = sorted(hourly_ts.items(), key=lambda x: x[1]) |
| 277 | for hour_key, dt in sorted_buckets[-limit:]: |
| 278 | client, dst, port, proto, svc_name, _ = hour_key |
| 279 | count = hourly[hour_key] |
| 280 | ts_fmt = dt.strftime(DATETIME_FMT.replace('%M', '00')) |
| 281 | print(f"{ts_fmt}|{client}|{dst}|{port}|{proto}|{svc_name}|{count}") |
| 282 | else: |
| 283 | # Detailed mode — consecutive dedup only |
| 284 | deduped = [] |
| 285 | counts = [] |
| 286 | for e in events: |
| 287 | ts_str = e.get('timestamp', '') |
| 288 | src = e.get('src_ip', '') |
| 289 | dst = e.get('dest_ip', '') |
| 290 | port = str(e.get('dest_port', '')) |
| 291 | proto_num = int(e.get('ip.protocol', 0)) |
| 292 | key = (src, dst, port, proto_num) |
| 293 | |
| 294 | if deduped: |
| 295 | prev = deduped[-1] |
| 296 | try: |
| 297 | prev_ts = datetime.fromisoformat( |
| 298 | prev.get('timestamp', '')).timestamp() |
| 299 | cur_ts = datetime.fromisoformat(ts_str).timestamp() |
| 300 | except Exception: |
| 301 | prev_ts = cur_ts = 0 |
| 302 | prev_key = ( |
| 303 | prev.get('src_ip', ''), |
| 304 | prev.get('dest_ip', ''), |
| 305 | str(prev.get('dest_port', '')), |
| 306 | int(prev.get('ip.protocol', 0)) |
| 307 | ) |
| 308 | if key == prev_key and (cur_ts - prev_ts) < 300: |
| 309 | counts[-1] += 1 |
| 310 | continue |
| 311 | |
| 312 | deduped.append(e) |
| 313 | counts.append(1) |
| 314 | |
| 315 | for e, count in list(zip(deduped, counts))[-limit:]: |
| 316 | ts_str = e.get('timestamp', '') |
| 317 | src = e.get('src_ip', '') |
| 318 | dst = e.get('dest_ip', '') |
| 319 | port = str(e.get('dest_port', '')) |
| 320 | proto_num = int(e.get('ip.protocol', 0)) |
| 321 | proto = proto_map.get(proto_num, str(proto_num)) |
| 322 | client = ip_to_name.get(src, src) |
| 323 | svc_name = reverse_lookup(dst, port, proto) |
| 324 | try: |
| 325 | dt = datetime.fromisoformat(ts_str) |
| 326 | ts_fmt = dt.strftime(DATETIME_FMT) |
| 327 | except Exception: |
| 328 | ts_fmt = ts_str |
| 329 | print(f"{ts_fmt}|{client}|{dst}|{port}|{proto}|{svc_name}|{count}") |
| 330 | |
| 331 | |
| 332 | def wg_events(file, filter_client, filter_type, limit, collapse='1'): |
| 333 | """ |
| 334 | Format WireGuard events with dedup and counts. |
| 335 | collapse='1' (default): hourly aggregation for attempt events |
| 336 | collapse='0': show all deduplicated events (--detailed mode) |
| 337 | Output per line: ts|client|endpoint|event|count |
| 338 | """ |
| 339 | from datetime import datetime |
| 340 | from collections import defaultdict |
| 341 | do_collapse = str(collapse) != '0' |
| 342 | |
| 343 | events = [] |
| 344 | try: |
| 345 | with open(file) as f: |
| 346 | for line in f: |
| 347 | try: |
| 348 | e = json.loads(line.strip()) |
| 349 | client = e.get('client', '') |
| 350 | if not client: |
| 351 | continue |
| 352 | if filter_client and client != filter_client: |
| 353 | continue |
| 354 | if filter_type and not client.startswith(filter_type + '-'): |
| 355 | continue |
| 356 | events.append(e) |
| 357 | except Exception: |
| 358 | pass |
| 359 | except Exception: |
| 360 | pass |
| 361 | |
| 362 | limit = int(limit) if limit else 50 |
| 363 | |
| 364 | if do_collapse: |
| 365 | # Hourly aggregation for attempts; individual for handshakes |
| 366 | hourly_attempts = defaultdict(int) |
| 367 | hourly_ts = {} |
| 368 | handshakes = [] |
| 369 | handshake_counts = [] |
| 370 | |
| 371 | for e in events: |
| 372 | ts_str = e.get('timestamp', '') |
| 373 | client = e.get('client', '') |
| 374 | endpoint = e.get('endpoint', '') |
| 375 | event = e.get('event', '') |
| 376 | |
| 377 | try: |
| 378 | dt = datetime.fromisoformat(ts_str) |
| 379 | ts = dt.timestamp() |
| 380 | except Exception: |
| 381 | dt = None |
| 382 | ts = 0 |
| 383 | |
| 384 | if event == 'attempt': |
| 385 | if dt: |
| 386 | hour_key = (client, endpoint, event, |
| 387 | dt.strftime('%Y-%m-%d %H')) |
| 388 | hourly_attempts[hour_key] += 1 |
| 389 | if hour_key not in hourly_ts: |
| 390 | hourly_ts[hour_key] = dt |
| 391 | else: |
| 392 | # Handshakes — consecutive dedup only |
| 393 | key = (client, event, endpoint[:15]) |
| 394 | if handshakes: |
| 395 | prev = handshakes[-1] |
| 396 | try: |
| 397 | prev_ts = datetime.fromisoformat( |
| 398 | prev.get('timestamp', '')).timestamp() |
| 399 | except Exception: |
| 400 | prev_ts = 0 |
| 401 | prev_key = ( |
| 402 | prev.get('client', ''), |
| 403 | prev.get('event', ''), |
| 404 | prev.get('endpoint', '')[:15] |
| 405 | ) |
| 406 | if key == prev_key and (ts - prev_ts) < 300: |
| 407 | handshake_counts[-1] += 1 |
| 408 | continue |
| 409 | handshakes.append(e) |
| 410 | handshake_counts.append(1) |
| 411 | |
| 412 | # Build output list: attempts (hourly) + handshakes, sorted by ts |
| 413 | output = [] |
| 414 | |
| 415 | for hour_key, dt in hourly_ts.items(): |
| 416 | client, endpoint, event, _ = hour_key |
| 417 | count = hourly_attempts[hour_key] |
| 418 | ts_fmt = dt.strftime(DATETIME_FMT.replace('%M', '00')) |
| 419 | output.append((dt.timestamp(), f"{ts_fmt}|{client}|{endpoint}|{event}|{count}")) |
| 420 | |
| 421 | for e, count in zip(handshakes, handshake_counts): |
| 422 | ts_str = e.get('timestamp', '') |
| 423 | client = e.get('client', '') |
| 424 | endpoint = e.get('endpoint', '') |
| 425 | event = e.get('event', '') |
| 426 | try: |
| 427 | dt = datetime.fromisoformat(ts_str) |
| 428 | ts_fmt = dt.strftime(DATETIME_FMT) |
| 429 | ts = dt.timestamp() |
| 430 | except Exception: |
| 431 | ts_fmt = ts_str |
| 432 | ts = 0 |
| 433 | output.append((ts, f"{ts_fmt}|{client}|{endpoint}|{event}|{count}")) |
| 434 | |
| 435 | output.sort(key=lambda x: x[0]) |
| 436 | for _, line in output[-limit:]: |
| 437 | print(line) |
| 438 | |
| 439 | else: |
| 440 | # Detailed mode — consecutive dedup only |
| 441 | deduped = [] |
| 442 | counts = [] |
| 443 | for e in events: |
| 444 | ts_str = e.get('timestamp', '') |
| 445 | client = e.get('client', '') |
| 446 | event = e.get('event', '') |
| 447 | endpoint = e.get('endpoint', '') |
| 448 | key = (client, event, endpoint[:15]) |
| 449 | |
| 450 | try: |
| 451 | ts = datetime.fromisoformat(ts_str).timestamp() |
| 452 | except Exception: |
| 453 | ts = 0 |
| 454 | |
| 455 | if deduped: |
| 456 | prev = deduped[-1] |
| 457 | try: |
| 458 | prev_ts = datetime.fromisoformat( |
| 459 | prev.get('timestamp', '')).timestamp() |
| 460 | except Exception: |
| 461 | prev_ts = 0 |
| 462 | prev_key = ( |
| 463 | prev.get('client', ''), |
| 464 | prev.get('event', ''), |
| 465 | prev.get('endpoint', '')[:15] |
| 466 | ) |
| 467 | if key == prev_key and (ts - prev_ts) < 300: |
| 468 | counts[-1] += 1 |
| 469 | continue |
| 470 | |
| 471 | deduped.append(e) |
| 472 | counts.append(1) |
| 473 | |
| 474 | for e, count in list(zip(deduped, counts))[-limit:]: |
| 475 | ts_str = e.get('timestamp', '') |
| 476 | client = e.get('client', '') |
| 477 | endpoint = e.get('endpoint', '') |
| 478 | event = e.get('event', '') |
| 479 | try: |
| 480 | dt = datetime.fromisoformat(ts_str) |
| 481 | ts_fmt = dt.strftime(DATETIME_FMT) |
| 482 | except Exception: |
| 483 | ts_fmt = ts_str |
| 484 | print(f"{ts_fmt}|{client}|{endpoint}|{event}|{count}") |
| 485 | |
| 486 | def format_fw_event(line, clients_dir): |
| 487 | """Format a single fw_event line""" |
| 488 | import glob |
| 489 | proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'} |
| 490 | |
| 491 | # Build ip->name map |
| 492 | ip_to_name = {} |
| 493 | for conf in glob.glob(f"{clients_dir}/*.conf"): |
| 494 | name = os.path.basename(conf).replace('.conf', '') |
| 495 | try: |
| 496 | with open(conf) as f: |
| 497 | for l in f: |
| 498 | if l.startswith('Address'): |
| 499 | ip = l.split('=')[1].strip().split('/')[0] |
| 500 | ip_to_name[ip] = name |
| 501 | except: |
| 502 | pass |
| 503 | |
| 504 | try: |
| 505 | e = json.loads(line.strip()) |
| 506 | src = e.get('src_ip', '') |
| 507 | if not src: |
| 508 | return None |
| 509 | ts = e.get('timestamp', '') |
| 510 | try: |
| 511 | from datetime import datetime |
| 512 | dt = datetime.fromisoformat(ts) |
| 513 | ts = dt.strftime(DATETIME_FMT) |
| 514 | except: |
| 515 | pass |
| 516 | dst = e.get('dest_ip', '—') |
| 517 | port = e.get('dest_port', '') |
| 518 | proto_num = e.get('ip.protocol', 0) |
| 519 | proto = proto_map.get(proto_num, str(proto_num)) |
| 520 | dst_str = f"{dst}:{port}" if port else dst |
| 521 | client = ip_to_name.get(src, src) |
| 522 | return f"{ts}|{client}|{dst_str}|{proto}" |
| 523 | except: |
| 524 | return None |
| 525 | |
| 526 | def format_wg_event(line): |
| 527 | """Format a single wg_event line""" |
| 528 | try: |
| 529 | e = json.loads(line.strip()) |
| 530 | client = e.get('client', '') |
| 531 | if not client: |
| 532 | return None |
| 533 | ts = e.get('timestamp', '') |
| 534 | try: |
| 535 | from datetime import datetime |
| 536 | dt = datetime.fromisoformat(ts) |
| 537 | ts = dt.strftime(DATETIME_FMT) |
| 538 | except: |
| 539 | pass |
| 540 | endpoint = e.get('endpoint', '—') |
| 541 | event = e.get('event', '—') |
| 542 | return f"{ts}|{client}|{endpoint}|{event}|wg" |
| 543 | except: |
| 544 | return None |
| 545 | |
| 546 | def remove_events(file, identifier): |
| 547 | """Remove all events for a client/ip from a JSONL file""" |
| 548 | try: |
| 549 | lines = [] |
| 550 | with open(file) as f: |
| 551 | for line in f: |
| 552 | try: |
| 553 | e = json.loads(line.strip()) |
| 554 | if e.get('client') == identifier or e.get('src_ip') == identifier: |
| 555 | continue |
| 556 | lines.append(line) |
| 557 | except: |
| 558 | lines.append(line) |
| 559 | with open(file, 'w') as f: |
| 560 | f.writelines(lines) |
| 561 | except Exception as e: |
| 562 | print(f"Error: {e}", file=sys.stderr) |
| 563 | sys.exit(1) |
| 564 | |
| 565 | def follow_logs(fw_file, wg_file, filter_ip, filter_type, clients_dir, filter_peers=""): |
| 566 | """Follow both log files and output formatted events""" |
| 567 | import glob, time, select |
| 568 | |
| 569 | proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'} |
| 570 | peer_filter = set(filter_peers.split(',')) if filter_peers else set() |
| 571 | |
| 572 | # Build ip->name map |
| 573 | ip_to_name = {} |
| 574 | for conf in glob.glob(f"{clients_dir}/*.conf"): |
| 575 | name = os.path.basename(conf).replace('.conf', '') |
| 576 | try: |
| 577 | with open(conf) as f: |
| 578 | for l in f: |
| 579 | if l.startswith('Address'): |
| 580 | ip = l.split('=')[1].strip().split('/')[0] |
| 581 | ip_to_name[ip] = name |
| 582 | except: |
| 583 | pass |
| 584 | |
| 585 | # Open files and seek to end |
| 586 | files = {} |
| 587 | for label, path in [('fw', fw_file), ('wg', wg_file)]: |
| 588 | if path and os.path.exists(path): |
| 589 | f = open(path) |
| 590 | f.seek(0, 2) # seek to end |
| 591 | files[label] = f |
| 592 | |
| 593 | dedup = {} |
| 594 | |
| 595 | try: |
| 596 | while True: |
| 597 | for label, f in files.items(): |
| 598 | line = f.readline() |
| 599 | if not line: |
| 600 | continue |
| 601 | try: |
| 602 | e = json.loads(line.strip()) |
| 603 | except: |
| 604 | continue |
| 605 | |
| 606 | if label == 'fw': |
| 607 | src = e.get('src_ip', '') |
| 608 | if not src: |
| 609 | continue |
| 610 | if filter_ip and src != filter_ip: |
| 611 | continue |
| 612 | |
| 613 | # Filter by peer names if specified |
| 614 | if peer_filter: |
| 615 | client_name = ip_to_name.get(src, '') |
| 616 | if client_name not in peer_filter: |
| 617 | continue |
| 618 | dst = e.get('dest_ip', '—') |
| 619 | port = e.get('dest_port', '') |
| 620 | proto_num = e.get('ip.protocol', 0) |
| 621 | proto = proto_map.get(proto_num, str(proto_num)) |
| 622 | |
| 623 | # Dedup |
| 624 | key = (src, dst, port, proto_num) |
| 625 | windows = {1: 5, 6: 30, 17: 10} |
| 626 | window = windows.get(proto_num, 10) |
| 627 | now = time.time() |
| 628 | if key in dedup and (now - dedup[key]) < window: |
| 629 | continue |
| 630 | dedup[key] = now |
| 631 | |
| 632 | client = ip_to_name.get(src, src) |
| 633 | if filter_type and not client.startswith(filter_type + '-'): |
| 634 | continue |
| 635 | dst_str = f"{dst}:{port}" if port else dst |
| 636 | ts = e.get('timestamp', '')[:16].replace('T', ' ') |
| 637 | print(f"fw|{ts}|{client}|{dst_str}|{proto}", flush=True) |
| 638 | |
| 639 | elif label == 'wg': |
| 640 | client = e.get('client', '') |
| 641 | if not client: |
| 642 | continue |
| 643 | if filter_ip: |
| 644 | ip = ip_to_name.get(filter_ip, '') |
| 645 | if client != ip and client != filter_ip: |
| 646 | continue |
| 647 | |
| 648 | if peer_filter and client not in peer_filter: |
| 649 | continue |
| 650 | if filter_type and not client.startswith(filter_type + '-'): |
| 651 | continue |
| 652 | ts = e.get('timestamp', '')[:16].replace('T', ' ') |
| 653 | endpoint = e.get('endpoint', '—') |
| 654 | event = e.get('event', '—') |
| 655 | print(f"wg|{ts}|{client}|{endpoint}|{event}", flush=True) |
| 656 | |
| 657 | time.sleep(0.1) |
| 658 | except KeyboardInterrupt: |
| 659 | pass |
| 660 | |
| 661 | def count(file, key): |
| 662 | try: |
| 663 | with open(file) as f: |
| 664 | data = json.load(f) |
| 665 | val = data.get(key, []) |
| 666 | print(len(val) if isinstance(val, list) else 0) |
| 667 | except: |
| 668 | print(0) |
| 669 | |
| 670 | def audit_fw_counts(clients_dir): |
| 671 | """Return peer_name:fw_count pairs from iptables""" |
| 672 | import glob, subprocess, re |
| 673 | |
| 674 | try: |
| 675 | result = subprocess.run( |
| 676 | ['iptables', '-L', 'FORWARD', '-n', '-v'], |
| 677 | capture_output=True, text=True |
| 678 | ) |
| 679 | fw_lines = result.stdout.splitlines() |
| 680 | except Exception: |
| 681 | fw_lines = [] |
| 682 | |
| 683 | # Filter to only data lines (skip headers and blanks) |
| 684 | # In -v output, source IP is in column 8 (0-indexed) |
| 685 | # Format: pkts bytes target prot opt in out source destination [options] |
| 686 | rule_lines = [l for l in fw_lines if l.strip() and not l.startswith('Chain') and not l.startswith(' pkts')] |
| 687 | |
| 688 | for conf in sorted(glob.glob(f"{clients_dir}/*.conf")): |
| 689 | name = os.path.basename(conf).replace('.conf', '') |
| 690 | try: |
| 691 | with open(conf) as f: |
| 692 | ip = '' |
| 693 | for line in f: |
| 694 | if line.startswith('Address'): |
| 695 | ip = line.split('=')[1].strip().split('/')[0] |
| 696 | break |
| 697 | if not ip: |
| 698 | continue |
| 699 | # Count lines where source column exactly matches the peer IP |
| 700 | count = sum(1 for l in rule_lines if re.search(r'\s' + re.escape(ip) + r'\s', l)) |
| 701 | print(f"{name}:{count}") |
| 702 | except Exception: |
| 703 | pass |
| 704 | |
| 705 | def peer_group_map(groups_dir): |
| 706 | """Return peer:group pairs for all groups""" |
| 707 | import glob |
| 708 | try: |
| 709 | for group_file in glob.glob(f"{groups_dir}/*.group"): |
| 710 | try: |
| 711 | with open(group_file) as f: |
| 712 | g = json.load(f) |
| 713 | name = g.get('name', '') |
| 714 | for peer in g.get('peers', []): |
| 715 | if peer: |
| 716 | print(f"{peer}:{name}") |
| 717 | except: |
| 718 | pass |
| 719 | except: |
| 720 | pass |
| 721 | |
| 722 | def peer_groups(groups_dir, peer_name): |
| 723 | """Find all groups containing a peer""" |
| 724 | import glob |
| 725 | try: |
| 726 | for group_file in glob.glob(f"{groups_dir}/*.group"): |
| 727 | try: |
| 728 | with open(group_file) as f: |
| 729 | g = json.load(f) |
| 730 | if peer_name in g.get('peers', []): |
| 731 | print(g.get('name', '')) |
| 732 | except: |
| 733 | pass |
| 734 | except: |
| 735 | pass |
| 736 | |
| 737 | def iso_to_ts(iso_str): |
| 738 | """Convert ISO timestamp to unix timestamp""" |
| 739 | try: |
| 740 | from datetime import datetime, timezone |
| 741 | dt = datetime.fromisoformat(iso_str) |
| 742 | if dt.tzinfo is None: |
| 743 | dt = dt.replace(tzinfo=timezone.utc) |
| 744 | print(int(dt.timestamp())) |
| 745 | except: |
| 746 | print(0) |
| 747 | |
| 748 | def rule_list_data(rules_dir, meta_dir): |
| 749 | """Return all rule data including base rules and extends""" |
| 750 | import glob |
| 751 | |
| 752 | rule_peer_counts = {} |
| 753 | for f in glob.glob(f"{meta_dir}/*.meta"): |
| 754 | try: |
| 755 | with open(f) as mf: |
| 756 | meta = json.load(mf) |
| 757 | rule = meta.get('rule', '') |
| 758 | if rule: |
| 759 | rule_peer_counts[rule] = rule_peer_counts.get(rule, 0) + 1 |
| 760 | except: |
| 761 | pass |
| 762 | |
| 763 | rule_files = ( |
| 764 | sorted(glob.glob(f"{rules_dir}/*.rule")) + |
| 765 | sorted(glob.glob(f"{rules_dir}/base/*.rule")) |
| 766 | ) |
| 767 | |
| 768 | # Collect all data first |
| 769 | rules_data = [] |
| 770 | for rule_file in rule_files: |
| 771 | is_base = '/base/' in rule_file |
| 772 | try: |
| 773 | with open(rule_file) as f: |
| 774 | r = json.load(f) |
| 775 | name = r.get('name', '') |
| 776 | desc = r.get('desc', '') |
| 777 | group = r.get('group', '') |
| 778 | extends = ','.join(r.get('extends', [])) |
| 779 | resolved = _rule_resolve_internal(rules_dir, name) |
| 780 | n_allows = len(resolved.get('allow_ips', [])) + \ |
| 781 | len(resolved.get('allow_ports', [])) |
| 782 | n_blocks = len(resolved.get('block_ips', [])) + \ |
| 783 | len(resolved.get('block_ports', [])) |
| 784 | peer_count = rule_peer_counts.get(name, 0) |
| 785 | rules_data.append({ |
| 786 | 'name': name, 'desc': desc, 'n_allows': n_allows, |
| 787 | 'n_blocks': n_blocks, 'peer_count': peer_count, |
| 788 | 'extends': extends, 'is_base': is_base, 'group': group |
| 789 | }) |
| 790 | except: |
| 791 | pass |
| 792 | |
| 793 | # Sort: non-base first, then by group (empty group last within non-base), |
| 794 | # then by name within group |
| 795 | rules_data.sort(key=lambda x: ( |
| 796 | x['is_base'], |
| 797 | x['group'] == '' and not x['is_base'], |
| 798 | x['group'], |
| 799 | x['name'] |
| 800 | )) |
| 801 | |
| 802 | for r in rules_data: |
| 803 | print(f"{r['name']}|{r['desc']}|{r['n_allows']}|{r['n_blocks']}|" |
| 804 | f"{r['peer_count']}|{r['extends']}|{r['is_base']}|{r['group']}") |
| 805 | |
| 806 | def group_list_data(groups_dir, blocks_dir, clients_dir): |
| 807 | """Return group summary data in one call""" |
| 808 | import glob |
| 809 | |
| 810 | # Get all block files |
| 811 | blocked_peers = set() |
| 812 | for f in glob.glob(f"{blocks_dir}/*.block"): |
| 813 | name = os.path.basename(f).replace('.block', '') |
| 814 | blocked_peers.add(name) |
| 815 | |
| 816 | for group_file in sorted(glob.glob(f"{groups_dir}/*.group")): |
| 817 | try: |
| 818 | with open(group_file) as f: |
| 819 | g = json.load(f) |
| 820 | name = g.get('name', '') |
| 821 | desc = g.get('desc', '') |
| 822 | peers = [p for p in g.get('peers', []) if p] |
| 823 | valid_peers = [p for p in peers |
| 824 | if os.path.exists(os.path.join(clients_dir, f"{p}.conf"))] |
| 825 | |
| 826 | total = len(valid_peers) |
| 827 | blocked = sum(1 for p in peers if p in blocked_peers) |
| 828 | print(f"{name}|{desc}|{total}|{blocked}") |
| 829 | except: |
| 830 | pass |
| 831 | |
| 832 | def fmt_datetime(iso_str, fmt): |
| 833 | """Format ISO timestamp with given strftime format""" |
| 834 | try: |
| 835 | from datetime import datetime |
| 836 | dt = datetime.fromisoformat(iso_str) |
| 837 | print(dt.strftime(fmt)) |
| 838 | except: |
| 839 | print(iso_str) |
| 840 | |
| 841 | def create_rule(file, name, desc, dns_redirect, allow_ips, block_ips, |
| 842 | block_ports, allow_ports='', extends='', group=''): |
| 843 | rule = { |
| 844 | 'name': name, |
| 845 | 'desc': desc, |
| 846 | 'group': group, |
| 847 | 'dns_redirect': dns_redirect == 'true', |
| 848 | 'extends': [x for x in extends.split(',') if x] if extends else [], |
| 849 | 'allow_ips': [x for x in allow_ips.split(',') if x] if allow_ips else [], |
| 850 | 'allow_ports': [x for x in allow_ports.split(',') if x] if allow_ports else [], |
| 851 | 'block_ips': [x for x in block_ips.split(',') if x] if block_ips else [], |
| 852 | 'block_ports': [x for x in block_ports.split(',') if x] if block_ports else [], |
| 853 | } |
| 854 | with open(file, 'w') as f: |
| 855 | json.dump(rule, f, indent=2) |
| 856 | |
| 857 | def cleanup_config(config_file): |
| 858 | """Normalize blank lines in WireGuard config""" |
| 859 | import re |
| 860 | try: |
| 861 | with open(config_file) as f: |
| 862 | config = f.read() |
| 863 | config = re.sub(r'\n{3,}', '\n\n', config) |
| 864 | config = config.rstrip('\n') + '\n' |
| 865 | with open(config_file, 'w') as f: |
| 866 | f.write(config) |
| 867 | except Exception as e: |
| 868 | print(f"Error: {e}", file=sys.stderr) |
| 869 | sys.exit(1) |
| 870 | |
| 871 | def remove_peer_block(config_file, name): |
| 872 | """Remove a peer block from WireGuard config by name""" |
| 873 | import re |
| 874 | try: |
| 875 | with open(config_file) as f: |
| 876 | config = f.read() |
| 877 | pattern = r'\n\[Peer\]\n# ' + re.escape(name) + r'\n[^\n]+\n[^\n]+\n' |
| 878 | result = re.sub(pattern, '\n', config) |
| 879 | with open(config_file, 'w') as f: |
| 880 | f.write(result) |
| 881 | except Exception as e: |
| 882 | print(f"Error: {e}", file=sys.stderr) |
| 883 | sys.exit(1) |
| 884 | |
| 885 | def create_group(file, name, desc): |
| 886 | """Create a new group JSON file""" |
| 887 | try: |
| 888 | group = {'name': name, 'desc': desc, 'peers': []} |
| 889 | with open(file, 'w') as f: |
| 890 | json.dump(group, f, indent=2) |
| 891 | except Exception as e: |
| 892 | print(f"Error: {e}", file=sys.stderr) |
| 893 | sys.exit(1) |
| 894 | |
| 895 | def parse_event(line): |
| 896 | """Parse a single JSON event line""" |
| 897 | try: |
| 898 | e = json.loads(line) |
| 899 | print(f"{e.get('timestamp','')}|{e.get('client','')}|{e.get('endpoint','')}|{e.get('event','')}") |
| 900 | except: |
| 901 | pass |
| 902 | |
| 903 | def parse_fw_event(line): |
| 904 | """Parse a single fw_events.log JSON line""" |
| 905 | try: |
| 906 | e = json.loads(line) |
| 907 | ts = e.get('timestamp', '') |
| 908 | src = e.get('src_ip', '') |
| 909 | dst = e.get('dest_ip', '') |
| 910 | port = e.get('dest_port', '') |
| 911 | proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'} |
| 912 | proto_num = e.get('ip.protocol', 0) |
| 913 | proto = proto_map.get(proto_num, str(proto_num)) |
| 914 | print(f"{ts}|{src}|{dst}|{port}|{proto}") |
| 915 | except: |
| 916 | pass |
| 917 | |
| 918 | def peer_transfer(wg_interface): |
| 919 | """Get total transfer bytes per peer""" |
| 920 | import subprocess |
| 921 | low = int(os.environ.get('ACTIVITY_TOTAL_LOW_BYTES', '1000000')) |
| 922 | med = int(os.environ.get('ACTIVITY_TOTAL_MED_BYTES', '10000000')) |
| 923 | high = int(os.environ.get('ACTIVITY_TOTAL_HIGH_BYTES', '100000000')) |
| 924 | try: |
| 925 | result = subprocess.run( |
| 926 | ['wg', 'show', wg_interface, 'transfer'], |
| 927 | capture_output=True, text=True |
| 928 | ) |
| 929 | for line in result.stdout.strip().split('\n'): |
| 930 | if not line: |
| 931 | continue |
| 932 | parts = line.split('\t') |
| 933 | if len(parts) == 3: |
| 934 | pubkey, rx, tx = parts |
| 935 | total = int(rx) + int(tx) |
| 936 | if total == 0: level = 'none' |
| 937 | elif total < low: level = 'low' |
| 938 | elif total < med: level = 'medium' |
| 939 | elif total < high: level = 'high' |
| 940 | else: level = 'very high' |
| 941 | print(f"{pubkey}|{rx}|{tx}|{level}") |
| 942 | except: |
| 943 | pass |
| 944 | |
| 945 | def peer_transfer_delta(wg_interface, cache_file): |
| 946 | """Calculate current transfer rate using delta from previous sample""" |
| 947 | import subprocess, time |
| 948 | |
| 949 | low = int(os.environ.get('ACTIVITY_CURRENT_LOW_BYTES', '10000')) # 10KB/s |
| 950 | med = int(os.environ.get('ACTIVITY_CURRENT_MED_BYTES', '100000')) # 100KB/s |
| 951 | high = int(os.environ.get('ACTIVITY_CURRENT_HIGH_BYTES', '1000000')) # 1MB/s |
| 952 | |
| 953 | current = {} |
| 954 | now = time.time() |
| 955 | try: |
| 956 | result = subprocess.run( |
| 957 | ['wg', 'show', wg_interface, 'transfer'], |
| 958 | capture_output=True, text=True |
| 959 | ) |
| 960 | for line in result.stdout.strip().split('\n'): |
| 961 | if not line: |
| 962 | continue |
| 963 | parts = line.split('\t') |
| 964 | if len(parts) == 3: |
| 965 | pubkey, rx, tx = parts |
| 966 | current[pubkey] = {'rx': int(rx), 'tx': int(tx), 'ts': now} |
| 967 | except: |
| 968 | pass |
| 969 | |
| 970 | prev = {} |
| 971 | if os.path.exists(cache_file): |
| 972 | try: |
| 973 | with open(cache_file) as f: |
| 974 | prev = json.load(f) |
| 975 | except: |
| 976 | pass |
| 977 | |
| 978 | try: |
| 979 | with open(cache_file, 'w') as f: |
| 980 | json.dump(current, f) |
| 981 | except: |
| 982 | pass |
| 983 | |
| 984 | for pubkey, data in current.items(): |
| 985 | if pubkey in prev: |
| 986 | dt = data['ts'] - prev[pubkey].get('ts', data['ts']) |
| 987 | if dt > 0: |
| 988 | rx_rate = max(0, (data['rx'] - prev[pubkey]['rx']) / dt) |
| 989 | tx_rate = max(0, (data['tx'] - prev[pubkey]['tx']) / dt) |
| 990 | total = rx_rate + tx_rate |
| 991 | if total <= 0: level = 'idle' |
| 992 | elif total < low: level = 'low' |
| 993 | elif total < med: level = 'medium' |
| 994 | elif total < high: level = 'high' |
| 995 | else: level = 'very high' |
| 996 | print(f"{pubkey}|{int(rx_rate)}|{int(tx_rate)}|{level}") |
| 997 | else: |
| 998 | print(f"{pubkey}|0|0|idle") |
| 999 | else: |
| 1000 | print(f"{pubkey}|0|0|unknown") |
| 1001 | |
| 1002 | def remove_events_filtered(wg_file, fw_file, filter_name, filter_ip, |
| 1003 | filter_fw, filter_wg, before_days): |
| 1004 | """Remove events with filters: by name/ip, source, or age""" |
| 1005 | import time |
| 1006 | from datetime import datetime, timezone |
| 1007 | |
| 1008 | cutoff_ts = None |
| 1009 | if before_days: |
| 1010 | cutoff_ts = time.time() - (float(before_days) * 86400) |
| 1011 | |
| 1012 | def should_remove_wg(e): |
| 1013 | if filter_name and e.get('client') != filter_name: |
| 1014 | return False |
| 1015 | if cutoff_ts: |
| 1016 | try: |
| 1017 | ts = datetime.fromisoformat(e.get('timestamp','')).timestamp() |
| 1018 | return ts < cutoff_ts |
| 1019 | except: |
| 1020 | return False |
| 1021 | return True |
| 1022 | |
| 1023 | def should_remove_fw(e): |
| 1024 | if filter_ip and e.get('src_ip') != filter_ip: |
| 1025 | return False |
| 1026 | if cutoff_ts: |
| 1027 | try: |
| 1028 | ts = datetime.fromisoformat(e.get('timestamp','')).timestamp() |
| 1029 | return ts < cutoff_ts |
| 1030 | except: |
| 1031 | return False |
| 1032 | return True |
| 1033 | |
| 1034 | removed_wg = removed_fw = 0 |
| 1035 | |
| 1036 | if not filter_fw and os.path.exists(wg_file): |
| 1037 | lines = [] |
| 1038 | with open(wg_file) as f: |
| 1039 | for line in f: |
| 1040 | try: |
| 1041 | e = json.loads(line.strip()) |
| 1042 | if should_remove_wg(e): |
| 1043 | removed_wg += 1 |
| 1044 | continue |
| 1045 | except: |
| 1046 | pass |
| 1047 | lines.append(line) |
| 1048 | with open(wg_file, 'w') as f: |
| 1049 | f.writelines(lines) |
| 1050 | |
| 1051 | if not filter_wg and os.path.exists(fw_file): |
| 1052 | lines = [] |
| 1053 | with open(fw_file) as f: |
| 1054 | for line in f: |
| 1055 | try: |
| 1056 | e = json.loads(line.strip()) |
| 1057 | if should_remove_fw(e): |
| 1058 | removed_fw += 1 |
| 1059 | continue |
| 1060 | except: |
| 1061 | pass |
| 1062 | lines.append(line) |
| 1063 | with open(fw_file, 'w') as f: |
| 1064 | f.writelines(lines) |
| 1065 | |
| 1066 | print(f"{removed_wg}|{removed_fw}") |
| 1067 | |
| 1068 | def _rule_resolve_internal(rules_dir, rule_name, visited=None): |
| 1069 | """Internal recursive resolver — returns dict, does not print""" |
| 1070 | if visited is None: |
| 1071 | visited = set() |
| 1072 | if rule_name in visited: |
| 1073 | raise ValueError(f"Circular dependency detected: {rule_name}") |
| 1074 | visited.add(rule_name) |
| 1075 | |
| 1076 | rule_file = find_rule_file(rules_dir, rule_name) |
| 1077 | with open(rule_file) as f: |
| 1078 | rule = json.load(f) |
| 1079 | |
| 1080 | merged = { |
| 1081 | 'allow_ips': [], |
| 1082 | 'allow_ports': [], |
| 1083 | 'block_ips': [], |
| 1084 | 'block_ports': [], |
| 1085 | 'dns_redirect': False |
| 1086 | } |
| 1087 | |
| 1088 | for base_name in rule.get('extends', []): |
| 1089 | base = _rule_resolve_internal(rules_dir, base_name, visited.copy()) |
| 1090 | merged['allow_ips'] += base.get('allow_ips', []) |
| 1091 | merged['allow_ports'] += base.get('allow_ports', []) |
| 1092 | merged['block_ips'] += base.get('block_ips', []) |
| 1093 | merged['block_ports'] += base.get('block_ports', []) |
| 1094 | if base.get('dns_redirect'): |
| 1095 | merged['dns_redirect'] = True |
| 1096 | |
| 1097 | # Merge own fields — use .get() with defaults for all fields |
| 1098 | merged['allow_ips'] = list(dict.fromkeys( |
| 1099 | merged['allow_ips'] + rule.get('allow_ips', []))) |
| 1100 | merged['allow_ports'] = list(dict.fromkeys( |
| 1101 | merged['allow_ports'] + rule.get('allow_ports', []))) |
| 1102 | merged['block_ips'] = list(dict.fromkeys( |
| 1103 | merged['block_ips'] + rule.get('block_ips', []))) |
| 1104 | merged['block_ports'] = list(dict.fromkeys( |
| 1105 | merged['block_ports'] + rule.get('block_ports', []))) |
| 1106 | if rule.get('dns_redirect', False): |
| 1107 | merged['dns_redirect'] = True |
| 1108 | |
| 1109 | merged['name'] = rule.get('name', rule_name) |
| 1110 | merged['desc'] = rule.get('desc', '') |
| 1111 | merged['group'] = rule.get('group', '') |
| 1112 | merged['extends'] = rule.get('extends', []) |
| 1113 | return merged |
| 1114 | |
| 1115 | def rule_resolve(rules_dir, rule_name): |
| 1116 | """Resolve a rule with inheritance — prints JSON""" |
| 1117 | try: |
| 1118 | resolved = _rule_resolve_internal(rules_dir, rule_name) |
| 1119 | print(json.dumps(resolved)) |
| 1120 | except Exception as e: |
| 1121 | print(f"Error: {e}", file=sys.stderr) |
| 1122 | sys.exit(1) |
| 1123 | |
| 1124 | def rule_resolve_field(rules_dir, rule_name, field): |
| 1125 | """Get a single field from resolved rule — prints values one per line""" |
| 1126 | try: |
| 1127 | resolved = _rule_resolve_internal(rules_dir, rule_name) |
| 1128 | val = resolved.get(field, []) |
| 1129 | if isinstance(val, list): |
| 1130 | for v in val: |
| 1131 | print(v) |
| 1132 | else: |
| 1133 | print(val) |
| 1134 | except Exception as e: |
| 1135 | print(f"Error: {e}", file=sys.stderr) |
| 1136 | sys.exit(1) |
| 1137 | |
| 1138 | def rule_inspect(rules_dir, rule_name): |
| 1139 | """Show inheritance tree for a rule""" |
| 1140 | try: |
| 1141 | rule_file = find_rule_file(rules_dir, rule_name) |
| 1142 | with open(rule_file) as f: |
| 1143 | rule = json.load(f) |
| 1144 | resolved = _rule_resolve_internal(rules_dir, rule_name) |
| 1145 | has_extends = bool(rule.get('extends', [])) |
| 1146 | |
| 1147 | # Own rules |
| 1148 | for ip in rule.get('allow_ips', []): |
| 1149 | print(f"own|allow_ip|{ip}") |
| 1150 | for p in rule.get('allow_ports', []): |
| 1151 | print(f"own|allow_port|{p}") |
| 1152 | for ip in rule.get('block_ips', []): |
| 1153 | print(f"own|block_ip|{ip}") |
| 1154 | for p in rule.get('block_ports', []): |
| 1155 | print(f"own|block_port|{p}") |
| 1156 | |
| 1157 | # DNS redirect — separate section |
| 1158 | if rule.get('dns_redirect'): |
| 1159 | print(f"dns|dns_redirect|true") |
| 1160 | |
| 1161 | if has_extends: |
| 1162 | # Inherited rules per base |
| 1163 | for base_name in rule.get('extends', []): |
| 1164 | base = _rule_resolve_internal(rules_dir, base_name) |
| 1165 | for ip in base.get('allow_ips', []): |
| 1166 | print(f"inherited:{base_name}|allow_ip|{ip}") |
| 1167 | for p in base.get('allow_ports', []): |
| 1168 | print(f"inherited:{base_name}|allow_port|{p}") |
| 1169 | for ip in base.get('block_ips', []): |
| 1170 | print(f"inherited:{base_name}|block_ip|{ip}") |
| 1171 | for p in base.get('block_ports', []): |
| 1172 | print(f"inherited:{base_name}|block_port|{p}") |
| 1173 | if base.get('dns_redirect'): |
| 1174 | print(f"inherited:{base_name}|dns_redirect|true") |
| 1175 | |
| 1176 | # Resolved summary only when inheritance exists |
| 1177 | has_resolved = ( |
| 1178 | resolved.get('allow_ips') or resolved.get('allow_ports') or |
| 1179 | resolved.get('block_ips') or resolved.get('block_ports') or |
| 1180 | resolved.get('dns_redirect') |
| 1181 | ) |
| 1182 | if has_resolved: |
| 1183 | for ip in resolved.get('allow_ips', []): |
| 1184 | print(f"resolved|allow_ip|{ip}") |
| 1185 | for p in resolved.get('allow_ports', []): |
| 1186 | print(f"resolved|allow_port|{p}") |
| 1187 | for ip in resolved.get('block_ips', []): |
| 1188 | print(f"resolved|block_ip|{ip}") |
| 1189 | for p in resolved.get('block_ports', []): |
| 1190 | print(f"resolved|block_port|{p}") |
| 1191 | if resolved.get('dns_redirect'): |
| 1192 | print(f"resolved|dns_redirect|true") |
| 1193 | |
| 1194 | except Exception as e: |
| 1195 | print(f"Error: {e}", file=sys.stderr) |
| 1196 | sys.exit(1) |
| 1197 | |
| 1198 | def find_rule_file(rules_dir, rule_name): |
| 1199 | """Find rule file in rules/ or rules/base/""" |
| 1200 | for path in [ |
| 1201 | os.path.join(rules_dir, f"{rule_name}.rule"), |
| 1202 | os.path.join(rules_dir, "base", f"{rule_name}.rule"), |
| 1203 | ]: |
| 1204 | if os.path.exists(path): |
| 1205 | return path |
| 1206 | return "" |
| 1207 | |
| 1208 | def get_raw(file, key): |
| 1209 | try: |
| 1210 | with open(file) as f: |
| 1211 | data = json.load(f) |
| 1212 | val = data.get(key) # returns None if missing |
| 1213 | if val is None: |
| 1214 | pass # print nothing |
| 1215 | elif isinstance(val, bool): |
| 1216 | print(str(val).lower()) |
| 1217 | elif isinstance(val, list): |
| 1218 | for v in val: |
| 1219 | print(v) |
| 1220 | else: |
| 1221 | print(val) |
| 1222 | except: |
| 1223 | pass |
| 1224 | |
| 1225 | def count_resolved(rules_dir, rule_name, key): |
| 1226 | """Count entries in resolved rule field""" |
| 1227 | try: |
| 1228 | resolved = _rule_resolve_internal(rules_dir, rule_name) |
| 1229 | print(len(resolved.get(key, []))) |
| 1230 | except: |
| 1231 | print(0) |
| 1232 | |
| 1233 | def _block_init(peer_ip): |
| 1234 | """Return empty block structure""" |
| 1235 | return { |
| 1236 | "peer_ip": peer_ip, |
| 1237 | "blocked_direct": False, |
| 1238 | "blocked_by_groups": [], |
| 1239 | "rules": [] |
| 1240 | } |
| 1241 | |
| 1242 | def _block_read(file): |
| 1243 | try: |
| 1244 | with open(file) as f: |
| 1245 | content = f.read().strip() |
| 1246 | if not content: |
| 1247 | return None # empty file = no block data |
| 1248 | try: |
| 1249 | return json.loads(content) |
| 1250 | except json.JSONDecodeError: |
| 1251 | # Old format — migrate |
| 1252 | lines = content.split('\n') |
| 1253 | peer_ip = lines[0].split()[0] if lines else '' |
| 1254 | new_data = { |
| 1255 | "peer_ip": peer_ip, |
| 1256 | "blocked_direct": True, |
| 1257 | "blocked_by_groups": [], |
| 1258 | "rules": [{"name": "full block", "type": "full"}] |
| 1259 | } |
| 1260 | with open(file, 'w') as f: |
| 1261 | json.dump(new_data, f, indent=2) |
| 1262 | return new_data |
| 1263 | except FileNotFoundError: |
| 1264 | return None |
| 1265 | except Exception: |
| 1266 | return None |
| 1267 | |
| 1268 | def _block_write(file, data): |
| 1269 | """Write block file""" |
| 1270 | with open(file, 'w') as f: |
| 1271 | json.dump(data, f, indent=2) |
| 1272 | |
| 1273 | def block_get(file): |
| 1274 | """Read and print block file as JSON""" |
| 1275 | data = _block_read(file) |
| 1276 | if data: |
| 1277 | print(json.dumps(data)) |
| 1278 | |
| 1279 | def block_is_blocked(file): |
| 1280 | """Return true if peer is effectively blocked""" |
| 1281 | data = _block_read(file) |
| 1282 | if not data: |
| 1283 | print("false") |
| 1284 | return |
| 1285 | blocked = data.get("blocked_direct", False) or \ |
| 1286 | bool(data.get("blocked_by_groups", [])) |
| 1287 | print("true" if blocked else "false") |
| 1288 | |
| 1289 | def block_set_direct(file, peer_ip, value): |
| 1290 | """Set blocked_direct""" |
| 1291 | try: |
| 1292 | data = _block_read(file) or _block_init(peer_ip) |
| 1293 | data["blocked_direct"] = value.lower() == "true" |
| 1294 | data["peer_ip"] = peer_ip |
| 1295 | _block_write(file, data) |
| 1296 | remaining = data["blocked_direct"] or bool(data.get("blocked_by_groups", [])) |
| 1297 | pass |
| 1298 | # print("true" if remaining else "false") |
| 1299 | except Exception as e: |
| 1300 | print(f"Error: {e}", file=sys.stderr) |
| 1301 | sys.exit(1) |
| 1302 | |
| 1303 | def block_add_group(file, peer_ip, group): |
| 1304 | """Add group to blocked_by_groups""" |
| 1305 | try: |
| 1306 | data = _block_read(file) or _block_init(peer_ip) |
| 1307 | data["peer_ip"] = peer_ip |
| 1308 | groups = data.get("blocked_by_groups", []) |
| 1309 | if group not in groups: |
| 1310 | groups.append(group) |
| 1311 | data["blocked_by_groups"] = groups |
| 1312 | _block_write(file, data) |
| 1313 | except Exception as e: |
| 1314 | print(f"Error: {e}", file=sys.stderr) |
| 1315 | sys.exit(1) |
| 1316 | |
| 1317 | def block_remove_group(file, peer_ip, group): |
| 1318 | """Remove group from blocked_by_groups, return whether still blocked""" |
| 1319 | try: |
| 1320 | data = _block_read(file) or _block_init(peer_ip) |
| 1321 | groups = data.get("blocked_by_groups", []) |
| 1322 | if group in groups: |
| 1323 | groups.remove(group) |
| 1324 | data["blocked_by_groups"] = groups |
| 1325 | _block_write(file, data) |
| 1326 | except Exception as e: |
| 1327 | print(f"Error: {e}", file=sys.stderr) |
| 1328 | sys.exit(1) |
| 1329 | # print("true" if remaining else "false") |
| 1330 | pass |
| 1331 | except Exception as e: |
| 1332 | print(f"Error: {e}", file=sys.stderr) |
| 1333 | sys.exit(1) |
| 1334 | |
| 1335 | def block_add_rule(file, peer_ip, rule_type, name="", target="", |
| 1336 | port="", proto=""): |
| 1337 | """Add a block rule entry""" |
| 1338 | try: |
| 1339 | data = _block_read(file) or _block_init(peer_ip) |
| 1340 | data["peer_ip"] = peer_ip |
| 1341 | rule = {"type": rule_type} |
| 1342 | if name: rule["name"] = name |
| 1343 | if target: rule["target"] = target |
| 1344 | if port: rule["port"] = port |
| 1345 | if proto: rule["proto"] = proto |
| 1346 | |
| 1347 | rules = data.get("rules", []) |
| 1348 | for existing in rules: |
| 1349 | if existing.get("type") == rule_type and \ |
| 1350 | existing.get("target","") == target and \ |
| 1351 | existing.get("port","") == port and \ |
| 1352 | existing.get("proto","") == proto: |
| 1353 | return # already exists, skip |
| 1354 | |
| 1355 | rules.append(rule) |
| 1356 | data["rules"] = rules |
| 1357 | _block_write(file, data) |
| 1358 | except Exception as e: |
| 1359 | print(f"Error: {e}", file=sys.stderr) |
| 1360 | sys.exit(1) |
| 1361 | |
| 1362 | def block_remove_rule(file, rule_type, target="", port="", proto=""): |
| 1363 | data = _block_read(file) |
| 1364 | if not data: |
| 1365 | return |
| 1366 | rules = data.get("rules", []) |
| 1367 | filtered = [r for r in rules if not ( |
| 1368 | r.get("type") == rule_type and |
| 1369 | r.get("target", "") == target and |
| 1370 | r.get("port", "") == port and |
| 1371 | r.get("proto", "") == proto |
| 1372 | )] |
| 1373 | data["rules"] = filtered |
| 1374 | _block_write(file, data) |
| 1375 | |
| 1376 | def block_get_rules(file): |
| 1377 | """Print rules as pipe-separated lines: name|type|target|port|proto""" |
| 1378 | data = _block_read(file) |
| 1379 | if not data: |
| 1380 | return |
| 1381 | for r in data.get("rules", []): |
| 1382 | print(f"{r.get('name','')}|{r.get('type','')}|" |
| 1383 | f"{r.get('target','')}|{r.get('port','')}|{r.get('proto','')}") |
| 1384 | |
| 1385 | def block_get_groups(file): |
| 1386 | data = _block_read(file) |
| 1387 | if not data: |
| 1388 | return |
| 1389 | print(','.join(data.get('blocked_by_groups', []))) |
| 1390 | |
| 1391 | def block_get_direct(file): |
| 1392 | data = _block_read(file) |
| 1393 | if not data: |
| 1394 | print('false') |
| 1395 | return |
| 1396 | print('true' if data.get('blocked_direct', False) else 'false') |
| 1397 | |
| 1398 | # ============================================ |
| 1399 | # Net / Services |
| 1400 | # ============================================ |
| 1401 | |
| 1402 | def _net_read(file): |
| 1403 | """Read services.json, return dict or empty dict""" |
| 1404 | try: |
| 1405 | if not os.path.exists(file): |
| 1406 | return {} |
| 1407 | with open(file) as f: |
| 1408 | content = f.read().strip() |
| 1409 | if not content: |
| 1410 | return {} |
| 1411 | return json.loads(content) |
| 1412 | except Exception: |
| 1413 | return {} |
| 1414 | |
| 1415 | def _net_write(file, data): |
| 1416 | """Write services.json""" |
| 1417 | os.makedirs(os.path.dirname(file), exist_ok=True) |
| 1418 | with open(file, 'w') as f: |
| 1419 | json.dump(data, f, indent=2) |
| 1420 | |
| 1421 | def net_list(file): |
| 1422 | """List all service names with IP and port count""" |
| 1423 | data = _net_read(file) |
| 1424 | for name, svc in sorted(data.items()): |
| 1425 | ip = svc.get('ip', '') |
| 1426 | desc = svc.get('desc', '') |
| 1427 | tags = ','.join(svc.get('tags', [])) |
| 1428 | ports = len(svc.get('ports', {})) |
| 1429 | print(f"{name}|{ip}|{desc}|{tags}|{ports}") |
| 1430 | |
| 1431 | def net_show(file, name): |
| 1432 | """Show full service details""" |
| 1433 | data = _net_read(file) |
| 1434 | if name not in data: |
| 1435 | print(f"Error: Service not found: {name}", file=sys.stderr) |
| 1436 | sys.exit(1) |
| 1437 | svc = data[name] |
| 1438 | print(f"name|{name}") |
| 1439 | print(f"ip|{svc.get('ip','')}") |
| 1440 | print(f"desc|{svc.get('desc','')}") |
| 1441 | print(f"tags|{','.join(svc.get('tags',[]))}") |
| 1442 | for port_name, port_def in svc.get('ports', {}).items(): |
| 1443 | port = port_def.get('port', '') |
| 1444 | proto = port_def.get('proto', 'tcp') |
| 1445 | desc = port_def.get('desc', '') |
| 1446 | print(f"port|{port_name}|{port}|{proto}|{desc}") |
| 1447 | |
| 1448 | def net_exists(file, name): |
| 1449 | """Check if service exists""" |
| 1450 | data = _net_read(file) |
| 1451 | # Handle service:port syntax |
| 1452 | if ':' in name: |
| 1453 | svc_name, port_name = name.split(':', 1) |
| 1454 | if port_name == 'ports': |
| 1455 | print('true' if svc_name in data else 'false') |
| 1456 | else: |
| 1457 | svc = data.get(svc_name, {}) |
| 1458 | print('true' if port_name in svc.get('ports', {}) else 'false') |
| 1459 | else: |
| 1460 | print('true' if name in data else 'false') |
| 1461 | |
| 1462 | def net_add_service(file, name, ip, desc='', tags=''): |
| 1463 | """Add or update a service""" |
| 1464 | data = _net_read(file) |
| 1465 | if name not in data: |
| 1466 | data[name] = {'ip': ip, 'ports': {}} |
| 1467 | else: |
| 1468 | data[name]['ip'] = ip |
| 1469 | if desc: |
| 1470 | data[name]['desc'] = desc |
| 1471 | if tags: |
| 1472 | data[name]['tags'] = [t.strip() for t in tags.split(',') if t.strip()] |
| 1473 | _net_write(file, data) |
| 1474 | |
| 1475 | def net_add_port(file, service, port_name, port, proto='tcp', desc=''): |
| 1476 | """Add or update a port on a service""" |
| 1477 | data = _net_read(file) |
| 1478 | if service not in data: |
| 1479 | print(f"Error: Service not found: {service}", file=sys.stderr) |
| 1480 | sys.exit(1) |
| 1481 | if 'ports' not in data[service]: |
| 1482 | data[service]['ports'] = {} |
| 1483 | entry = {'port': int(port), 'proto': proto} |
| 1484 | if desc: |
| 1485 | entry['desc'] = desc |
| 1486 | data[service]['ports'][port_name] = entry |
| 1487 | _net_write(file, data) |
| 1488 | |
| 1489 | def net_remove(file, name): |
| 1490 | """Remove service or port""" |
| 1491 | data = _net_read(file) |
| 1492 | if ':' in name: |
| 1493 | svc_name, port_name = name.split(':', 1) |
| 1494 | if svc_name not in data: |
| 1495 | print(f"Error: Service not found: {svc_name}", file=sys.stderr) |
| 1496 | sys.exit(1) |
| 1497 | if port_name == 'ports': |
| 1498 | # Remove all ports |
| 1499 | data[svc_name]['ports'] = {} |
| 1500 | else: |
| 1501 | if port_name not in data[svc_name].get('ports', {}): |
| 1502 | print(f"Error: Port not found: {port_name}", file=sys.stderr) |
| 1503 | sys.exit(1) |
| 1504 | del data[svc_name]['ports'][port_name] |
| 1505 | else: |
| 1506 | if name not in data: |
| 1507 | print(f"Error: Service not found: {name}", file=sys.stderr) |
| 1508 | sys.exit(1) |
| 1509 | del data[name] |
| 1510 | _net_write(file, data) |
| 1511 | |
| 1512 | def net_resolve(file, name): |
| 1513 | """Resolve service name to ip or ip:port:proto lines""" |
| 1514 | data = _net_read(file) |
| 1515 | if ':' in name: |
| 1516 | svc_name, port_name = name.split(':', 1) |
| 1517 | if svc_name not in data: |
| 1518 | print(f"Error: Service not found: {svc_name}", file=sys.stderr) |
| 1519 | sys.exit(1) |
| 1520 | svc = data[svc_name] |
| 1521 | ip = svc.get('ip', '') |
| 1522 | if port_name == 'ports': |
| 1523 | # All ports |
| 1524 | for pname, pdef in svc.get('ports', {}).items(): |
| 1525 | print(f"{ip}:{pdef['port']}:{pdef.get('proto','tcp')}") |
| 1526 | else: |
| 1527 | if port_name not in svc.get('ports', {}): |
| 1528 | print(f"Error: Port not found: {port_name}", file=sys.stderr) |
| 1529 | sys.exit(1) |
| 1530 | pdef = svc['ports'][port_name] |
| 1531 | print(f"{ip}:{pdef['port']}:{pdef.get('proto','tcp')}") |
| 1532 | else: |
| 1533 | if name not in data: |
| 1534 | print(f"Error: Service not found: {name}", file=sys.stderr) |
| 1535 | sys.exit(1) |
| 1536 | print(data[name].get('ip', '')) |
| 1537 | |
| 1538 | def net_reverse_lookup(file, ip, port='', proto=''): |
| 1539 | """Reverse lookup IP/port to service name""" |
| 1540 | data = _net_read(file) |
| 1541 | for svc_name, svc in data.items(): |
| 1542 | if svc.get('ip') != ip: |
| 1543 | continue |
| 1544 | if not port: |
| 1545 | print(svc_name) |
| 1546 | return |
| 1547 | for port_name, port_def in svc.get('ports', {}).items(): |
| 1548 | if (str(port_def.get('port','')) == str(port) and |
| 1549 | port_def.get('proto','tcp') == proto): |
| 1550 | print(f"{svc_name}:{port_name}") |
| 1551 | return |
| 1552 | # IP matched but no port match — return service name |
| 1553 | print(svc_name) |
| 1554 | return |
| 1555 | |
| 1556 | def block_is_empty(file): |
| 1557 | data = _block_read(file) |
| 1558 | if not data: |
| 1559 | print("true") |
| 1560 | return |
| 1561 | empty = ( |
| 1562 | not data.get("blocked_direct", False) and |
| 1563 | not data.get("blocked_by_groups", []) and |
| 1564 | not data.get("rules", []) and |
| 1565 | not data.get("services", []) |
| 1566 | ) |
| 1567 | print("true" if empty else "false") |
| 1568 | |
| 1569 | def group_has_peer(file, peer_name): |
| 1570 | try: |
| 1571 | with open(file) as f: |
| 1572 | data = json.load(f) |
| 1573 | peers = data.get('peers', []) |
| 1574 | print('true' if peer_name in peers else 'false') |
| 1575 | except Exception: |
| 1576 | print('false') |
| 1577 | |
| 1578 | # ============================================ |
| 1579 | # Subnet Map |
| 1580 | # ============================================ |
| 1581 | |
| 1582 | def _subnet_read(file): |
| 1583 | """Read subnets.json, return dict or empty dict""" |
| 1584 | try: |
| 1585 | if not os.path.exists(file): |
| 1586 | return {} |
| 1587 | with open(file) as f: |
| 1588 | content = f.read().strip() |
| 1589 | if not content: |
| 1590 | return {} |
| 1591 | return json.loads(content) |
| 1592 | except Exception: |
| 1593 | return {} |
| 1594 | |
| 1595 | def _subnet_write(file, data): |
| 1596 | """Write subnets.json""" |
| 1597 | os.makedirs(os.path.dirname(file), exist_ok=True) |
| 1598 | with open(file, 'w') as f: |
| 1599 | json.dump(data, f, indent=2) |
| 1600 | |
| 1601 | def _subnet_is_group(entry): |
| 1602 | """Return True if a subnet entry is a nested group (like 'guests')""" |
| 1603 | return isinstance(entry, dict) and 'subnet' not in entry |
| 1604 | |
| 1605 | def subnet_lookup(file, name, type_key=''): |
| 1606 | """ |
| 1607 | Resolve a subnet name (and optional type) to a CIDR string. |
| 1608 | For scalar entries: subnet_lookup(file, "desktop") -> "10.1.1.0/24" |
| 1609 | For group entries: subnet_lookup(file, "guests", "phone") -> "10.1.103.0/24" |
| 1610 | For group with no type: subnet_lookup(file, "guests") -> "10.1.100.0/24" (none slot) |
| 1611 | Prints the CIDR on success, nothing and exits 1 on failure. |
| 1612 | """ |
| 1613 | data = _subnet_read(file) |
| 1614 | if name not in data: |
| 1615 | sys.exit(1) |
| 1616 | entry = data[name] |
| 1617 | if _subnet_is_group(entry): |
| 1618 | key = type_key if type_key else 'none' |
| 1619 | if key not in entry: |
| 1620 | sys.exit(1) |
| 1621 | print(entry[key]['subnet']) |
| 1622 | else: |
| 1623 | print(entry['subnet']) |
| 1624 | |
| 1625 | def subnet_type(file, name, type_key=''): |
| 1626 | """ |
| 1627 | Return the type string for a subnet entry. |
| 1628 | For scalar: subnet_type(file, "desktop") -> "desktop" |
| 1629 | For group: subnet_type(file, "guests", "phone") -> "phone" |
| 1630 | subnet_type(file, "guests") -> "none" |
| 1631 | """ |
| 1632 | data = _subnet_read(file) |
| 1633 | if name not in data: |
| 1634 | sys.exit(1) |
| 1635 | entry = data[name] |
| 1636 | if _subnet_is_group(entry): |
| 1637 | key = type_key if type_key else 'none' |
| 1638 | if key not in entry: |
| 1639 | sys.exit(1) |
| 1640 | # For group entries the type IS the child key |
| 1641 | print(key if key != 'none' else 'none') |
| 1642 | else: |
| 1643 | print(entry.get('type', name)) |
| 1644 | |
| 1645 | def subnet_tunnel_mode(file, name, type_key=''): |
| 1646 | """Return tunnel_mode for a subnet entry""" |
| 1647 | data = _subnet_read(file) |
| 1648 | if name not in data: |
| 1649 | print('split') # safe default |
| 1650 | return |
| 1651 | entry = data[name] |
| 1652 | if _subnet_is_group(entry): |
| 1653 | key = type_key if type_key else 'none' |
| 1654 | child = entry.get(key, {}) |
| 1655 | print(child.get('tunnel_mode', 'split')) |
| 1656 | else: |
| 1657 | print(entry.get('tunnel_mode', 'split')) |
| 1658 | |
| 1659 | def subnet_for_ip(file, ip): |
| 1660 | """ |
| 1661 | Reverse lookup: given a peer IP, find which subnet name (and type) it belongs to. |
| 1662 | Output: name|type (e.g. "guests|phone" or "desktop|desktop") |
| 1663 | Returns nothing (exit 0) if not found — caller falls back to hardcoded map. |
| 1664 | """ |
| 1665 | import ipaddress |
| 1666 | try: |
| 1667 | peer_addr = ipaddress.ip_address(ip) |
| 1668 | except ValueError: |
| 1669 | return |
| 1670 | |
| 1671 | data = _subnet_read(file) |
| 1672 | for name, entry in data.items(): |
| 1673 | if _subnet_is_group(entry): |
| 1674 | for type_key, child in entry.items(): |
| 1675 | try: |
| 1676 | network = ipaddress.ip_network(child['subnet'], strict=False) |
| 1677 | if peer_addr in network: |
| 1678 | print(f"{name}|{type_key}") |
| 1679 | return |
| 1680 | except Exception: |
| 1681 | continue |
| 1682 | else: |
| 1683 | try: |
| 1684 | network = ipaddress.ip_network(entry['subnet'], strict=False) |
| 1685 | if peer_addr in network: |
| 1686 | peer_type = entry.get('type', name) |
| 1687 | print(f"{name}|{peer_type}") |
| 1688 | return |
| 1689 | except Exception: |
| 1690 | continue |
| 1691 | |
| 1692 | def subnet_list(file): |
| 1693 | """ |
| 1694 | List all subnets for display. |
| 1695 | Output per line: name|subnet|type|tunnel_mode|desc|is_group |
| 1696 | For group entries, outputs one line per child: name.type|subnet|type|tunnel_mode|desc|true |
| 1697 | """ |
| 1698 | data = _subnet_read(file) |
| 1699 | for name, entry in data.items(): |
| 1700 | if _subnet_is_group(entry): |
| 1701 | for type_key, child in entry.items(): |
| 1702 | display_name = f"{name}.{type_key}" if type_key != 'none' else name |
| 1703 | print(f"{display_name}|{child.get('subnet','')}|" |
| 1704 | f"{type_key}|{child.get('tunnel_mode','split')}|" |
| 1705 | f"{child.get('desc','')}|true|{name}") |
| 1706 | else: |
| 1707 | print(f"{name}|{entry.get('subnet','')}|" |
| 1708 | f"{entry.get('type',name)}|{entry.get('tunnel_mode','split')}|" |
| 1709 | f"{entry.get('desc','')}|false|{name}") |
| 1710 | |
| 1711 | def subnet_show(file, name): |
| 1712 | """Show a single subnet entry (scalar or group) in detail""" |
| 1713 | data = _subnet_read(file) |
| 1714 | if name not in data: |
| 1715 | print(f"Error: Subnet '{name}' not found", file=sys.stderr) |
| 1716 | sys.exit(1) |
| 1717 | entry = data[name] |
| 1718 | if _subnet_is_group(entry): |
| 1719 | print(f"name|{name}") |
| 1720 | print(f"is_group|true") |
| 1721 | for type_key, child in entry.items(): |
| 1722 | print(f"child|{type_key}|{child.get('subnet','')}|" |
| 1723 | f"{child.get('tunnel_mode','split')}|{child.get('desc','')}") |
| 1724 | else: |
| 1725 | print(f"name|{name}") |
| 1726 | print(f"is_group|false") |
| 1727 | print(f"subnet|{entry.get('subnet','')}") |
| 1728 | print(f"type|{entry.get('type',name)}") |
| 1729 | print(f"tunnel_mode|{entry.get('tunnel_mode','split')}") |
| 1730 | print(f"desc|{entry.get('desc','')}") |
| 1731 | |
| 1732 | def subnet_add(file, name, subnet, type_key, tunnel_mode, desc, group_parent=''): |
| 1733 | """ |
| 1734 | Add a new subnet entry. |
| 1735 | If group_parent is set, adds as a child under that group key. |
| 1736 | Otherwise adds as a scalar entry. |
| 1737 | """ |
| 1738 | data = _subnet_read(file) |
| 1739 | entry = { |
| 1740 | 'subnet': subnet, |
| 1741 | 'tunnel_mode': tunnel_mode or 'split', |
| 1742 | 'desc': desc or '' |
| 1743 | } |
| 1744 | if group_parent: |
| 1745 | # Adding a child to an existing group, or creating a new group |
| 1746 | if group_parent not in data: |
| 1747 | data[group_parent] = {} |
| 1748 | elif not _subnet_is_group(data[group_parent]): |
| 1749 | print(f"Error: '{group_parent}' exists but is not a group", file=sys.stderr) |
| 1750 | sys.exit(1) |
| 1751 | data[group_parent][type_key or 'none'] = entry |
| 1752 | else: |
| 1753 | # Scalar entry — type stored explicitly |
| 1754 | entry['type'] = type_key or name |
| 1755 | data[name] = entry |
| 1756 | _subnet_write(file, data) |
| 1757 | |
| 1758 | def subnet_remove(file, name, peers_using): |
| 1759 | """ |
| 1760 | Remove a subnet entry. peers_using is a comma-separated list of peer names |
| 1761 | currently using this subnet (passed in from bash after meta scan). |
| 1762 | If non-empty, refuses with error. |
| 1763 | """ |
| 1764 | if peers_using: |
| 1765 | peers = [p for p in peers_using.split(',') if p] |
| 1766 | if peers: |
| 1767 | print(f"Error: Subnet '{name}' is in use by: {', '.join(peers)}", file=sys.stderr) |
| 1768 | sys.exit(1) |
| 1769 | data = _subnet_read(file) |
| 1770 | if '.' in name: |
| 1771 | # Removing a group child: e.g. "guests.phone" |
| 1772 | parent, child_key = name.split('.', 1) |
| 1773 | if parent not in data or not _subnet_is_group(data[parent]): |
| 1774 | print(f"Error: Group '{parent}' not found", file=sys.stderr) |
| 1775 | sys.exit(1) |
| 1776 | if child_key not in data[parent]: |
| 1777 | print(f"Error: '{child_key}' not found in group '{parent}'", file=sys.stderr) |
| 1778 | sys.exit(1) |
| 1779 | del data[parent][child_key] |
| 1780 | if not data[parent]: |
| 1781 | del data[parent] # remove empty group |
| 1782 | else: |
| 1783 | if name not in data: |
| 1784 | print(f"Error: Subnet '{name}' not found", file=sys.stderr) |
| 1785 | sys.exit(1) |
| 1786 | del data[name] |
| 1787 | _subnet_write(file, data) |
| 1788 | |
| 1789 | def subnet_rename(file, old_name, new_name, peers_using): |
| 1790 | """ |
| 1791 | Rename a subnet entry. Hard refusal if any peers reference it. |
| 1792 | peers_using: comma-separated peer names from bash meta scan. |
| 1793 | """ |
| 1794 | if peers_using: |
| 1795 | peers = [p for p in peers_using.split(',') if p] |
| 1796 | if peers: |
| 1797 | print(f"Error: Cannot rename subnet '{old_name}' — in use by: {', '.join(peers)}", file=sys.stderr) |
| 1798 | sys.exit(1) |
| 1799 | data = _subnet_read(file) |
| 1800 | if old_name not in data: |
| 1801 | print(f"Error: Subnet '{old_name}' not found", file=sys.stderr) |
| 1802 | sys.exit(1) |
| 1803 | if new_name in data: |
| 1804 | print(f"Error: Subnet '{new_name}' already exists", file=sys.stderr) |
| 1805 | sys.exit(1) |
| 1806 | data[new_name] = data.pop(old_name) |
| 1807 | _subnet_write(file, data) |
| 1808 | |
| 1809 | def subnet_peers(meta_dir, clients_dir, subnet_name, subnets_file): |
| 1810 | """ |
| 1811 | Find all peers using a subnet. |
| 1812 | Two-pass check: |
| 1813 | 1. Meta field: peer has "subnet": subnet_name in their .meta file |
| 1814 | 2. IP fallback: peer's IP falls within the subnet's CIDR(s) |
| 1815 | (catches peers added before meta stored subnet explicitly) |
| 1816 | Output: one peer name per line. |
| 1817 | """ |
| 1818 | import glob |
| 1819 | import ipaddress |
| 1820 | |
| 1821 | # Resolve all CIDRs covered by this subnet name |
| 1822 | data = _subnet_read(subnets_file) |
| 1823 | cidrs = [] |
| 1824 | if subnet_name in data: |
| 1825 | entry = data[subnet_name] |
| 1826 | if _subnet_is_group(entry): |
| 1827 | for child in entry.values(): |
| 1828 | try: |
| 1829 | cidrs.append(ipaddress.ip_network(child['subnet'], strict=False)) |
| 1830 | except Exception: |
| 1831 | pass |
| 1832 | else: |
| 1833 | try: |
| 1834 | cidrs.append(ipaddress.ip_network(entry['subnet'], strict=False)) |
| 1835 | except Exception: |
| 1836 | pass |
| 1837 | |
| 1838 | printed = set() |
| 1839 | |
| 1840 | for conf in sorted(glob.glob(f"{clients_dir}/*.conf")): |
| 1841 | peer_name = os.path.basename(conf).replace('.conf', '') |
| 1842 | |
| 1843 | # Pass 1: check meta field |
| 1844 | meta_file = os.path.join(meta_dir, f"{peer_name}.meta") |
| 1845 | try: |
| 1846 | with open(meta_file) as f: |
| 1847 | meta = json.load(f) |
| 1848 | if meta.get('subnet', '') == subnet_name: |
| 1849 | if peer_name not in printed: |
| 1850 | print(peer_name) |
| 1851 | printed.add(peer_name) |
| 1852 | continue |
| 1853 | except Exception: |
| 1854 | pass |
| 1855 | |
| 1856 | # Pass 2: IP reverse lookup against subnet CIDRs |
| 1857 | if not cidrs: |
| 1858 | continue |
| 1859 | |
| 1860 | peer_ip = '' |
| 1861 | try: |
| 1862 | with open(conf) as f: |
| 1863 | for line in f: |
| 1864 | if line.startswith('Address'): |
| 1865 | peer_ip = line.split('=')[1].strip().split('/')[0] |
| 1866 | break |
| 1867 | except Exception: |
| 1868 | continue |
| 1869 | |
| 1870 | if not peer_ip: |
| 1871 | continue |
| 1872 | |
| 1873 | try: |
| 1874 | addr = ipaddress.ip_address(peer_ip) |
| 1875 | if any(addr in cidr for cidr in cidrs): |
| 1876 | if peer_name not in printed: |
| 1877 | print(peer_name) |
| 1878 | printed.add(peer_name) |
| 1879 | except Exception: |
| 1880 | continue |
| 1881 | |
| 1882 | |
| 1883 | def subnet_exists(file, name): |
| 1884 | """Check if a subnet name exists (scalar or group). Exits 0/1.""" |
| 1885 | data = _subnet_read(file) |
| 1886 | if '.' in name: |
| 1887 | parent, child_key = name.split('.', 1) |
| 1888 | exists = parent in data and _subnet_is_group(data[parent]) and child_key in data[parent] |
| 1889 | else: |
| 1890 | exists = name in data |
| 1891 | sys.exit(0 if exists else 1) |
| 1892 | |
| 1893 | |
| 1894 | # ============================================ |
| 1895 | # Identity System |
| 1896 | # ============================================ |
| 1897 | |
| 1898 | def identity_rules(file): |
| 1899 | """ |
| 1900 | Return all rules assigned to an identity, one per line. |
| 1901 | Reads from 'rules' array (1:N). Falls back to 'rule' scalar for migration. |
| 1902 | """ |
| 1903 | data = _identity_read(file) |
| 1904 | if not data: |
| 1905 | return |
| 1906 | # Support legacy scalar 'rule' field |
| 1907 | rules = data.get('rules', []) |
| 1908 | if not rules and data.get('rule'): |
| 1909 | rules = [data['rule']] |
| 1910 | for r in rules: |
| 1911 | if r: |
| 1912 | print(r) |
| 1913 | |
| 1914 | def identity_add_rule(file, identity_name, rule_name): |
| 1915 | """ |
| 1916 | Add a rule to an identity's rules array. |
| 1917 | Warns if already present (prints warning to stderr, exits 2). |
| 1918 | Creates identity file if it doesn't exist. |
| 1919 | """ |
| 1920 | data = _identity_read(file) or _identity_init(identity_name) |
| 1921 | rules = data.get('rules', []) |
| 1922 | # Migrate legacy scalar field |
| 1923 | if 'rule' in data and data['rule']: |
| 1924 | if data['rule'] not in rules: |
| 1925 | rules.append(data['rule']) |
| 1926 | del data['rule'] |
| 1927 | if rule_name in rules: |
| 1928 | print(f"Warning: Rule '{rule_name}' is already assigned to identity '{identity_name}'", |
| 1929 | file=sys.stderr) |
| 1930 | sys.exit(2) |
| 1931 | rules.append(rule_name) |
| 1932 | data['rules'] = rules |
| 1933 | _identity_write(file, data) |
| 1934 | |
| 1935 | def identity_remove_rule(file, rule_name): |
| 1936 | """ |
| 1937 | Remove a specific rule from an identity's rules array. |
| 1938 | Exits 1 if rule not found. |
| 1939 | """ |
| 1940 | data = _identity_read(file) |
| 1941 | if not data: |
| 1942 | print(f"Error: Identity not found", file=sys.stderr) |
| 1943 | sys.exit(1) |
| 1944 | rules = data.get('rules', []) |
| 1945 | if rule_name not in rules: |
| 1946 | print(f"Error: Rule '{rule_name}' not assigned to this identity", file=sys.stderr) |
| 1947 | sys.exit(1) |
| 1948 | rules.remove(rule_name) |
| 1949 | data['rules'] = rules |
| 1950 | _identity_write(file, data) |
| 1951 | |
| 1952 | def identity_clear_rules(file): |
| 1953 | """Remove all rules from an identity.""" |
| 1954 | data = _identity_read(file) |
| 1955 | if not data: |
| 1956 | return |
| 1957 | data['rules'] = [] |
| 1958 | data.pop('rule', None) # remove legacy scalar too |
| 1959 | _identity_write(file, data) |
| 1960 | |
| 1961 | def identity_has_rule(file, rule_name): |
| 1962 | """Exit 0 if identity has this rule, 1 otherwise.""" |
| 1963 | data = _identity_read(file) |
| 1964 | if not data: |
| 1965 | sys.exit(1) |
| 1966 | rules = data.get('rules', []) |
| 1967 | if not rules and data.get('rule'): |
| 1968 | rules = [data['rule']] |
| 1969 | sys.exit(0 if rule_name in rules else 1) |
| 1970 | |
| 1971 | def _identity_read(file): |
| 1972 | """Read an identity file, return dict or None""" |
| 1973 | try: |
| 1974 | if not os.path.exists(file): |
| 1975 | return None |
| 1976 | with open(file) as f: |
| 1977 | content = f.read().strip() |
| 1978 | if not content: |
| 1979 | return None |
| 1980 | return json.loads(content) |
| 1981 | except Exception: |
| 1982 | return None |
| 1983 | |
| 1984 | def _identity_write(file, data): |
| 1985 | """Write an identity file""" |
| 1986 | os.makedirs(os.path.dirname(file), exist_ok=True) |
| 1987 | with open(file, 'w') as f: |
| 1988 | json.dump(data, f, indent=2) |
| 1989 | |
| 1990 | def _identity_init(name): |
| 1991 | """Return empty identity structure""" |
| 1992 | return { |
| 1993 | 'name': name, |
| 1994 | 'peers': [], |
| 1995 | 'devices': {} |
| 1996 | } |
| 1997 | |
| 1998 | def _parse_peer_name(peer_name): |
| 1999 | """ |
| 2000 | Parse a peer name into (type, identity, index). |
| 2001 | phone-nuno -> ('phone', 'nuno', 1) |
| 2002 | phone-nuno-2 -> ('phone', 'nuno', 2) |
| 2003 | desktop-zephyr -> ('desktop', 'zephyr', 1) |
| 2004 | laptop-nuno -> ('laptop', 'nuno', 1) |
| 2005 | Returns None if name doesn't match convention. |
| 2006 | |
| 2007 | Convention: {type}-{identity}[-{index}] |
| 2008 | Known types: desktop, laptop, phone, tablet, server, iot, none |
| 2009 | """ |
| 2010 | known_types = {'desktop', 'laptop', 'phone', 'tablet', 'server', 'iot', 'none'} |
| 2011 | parts = peer_name.split('-') |
| 2012 | if len(parts) < 2: |
| 2013 | return None |
| 2014 | peer_type = parts[0] |
| 2015 | if peer_type not in known_types: |
| 2016 | return None |
| 2017 | # Check if last part is a numeric index |
| 2018 | if len(parts) >= 3 and parts[-1].isdigit(): |
| 2019 | index = int(parts[-1]) |
| 2020 | identity = '-'.join(parts[1:-1]) |
| 2021 | else: |
| 2022 | index = 1 |
| 2023 | identity = '-'.join(parts[1:]) |
| 2024 | if not identity: |
| 2025 | return None |
| 2026 | return (peer_type, identity, index) |
| 2027 | |
| 2028 | def identity_list(identities_dir): |
| 2029 | """ |
| 2030 | List all identities with peer count, rules and policy. |
| 2031 | Output per line: name|peer_count|types|rules|policy |
| 2032 | """ |
| 2033 | import glob |
| 2034 | for id_file in sorted(glob.glob(f"{identities_dir}/*.identity")): |
| 2035 | try: |
| 2036 | with open(id_file) as f: |
| 2037 | data = json.load(f) |
| 2038 | name = data.get('name', '') |
| 2039 | peers = data.get('peers', []) |
| 2040 | devices = data.get('devices', {}) |
| 2041 | rules = data.get('rules', []) |
| 2042 | # Migrate legacy scalar rule field |
| 2043 | if not rules and data.get('rule'): |
| 2044 | rules = [data['rule']] |
| 2045 | policy = data.get('policy', 'default') |
| 2046 | types = sorted(set( |
| 2047 | d.get('type', '') for d in devices.values() if d.get('type') |
| 2048 | )) |
| 2049 | print(f"{name}|{len(peers)}|{','.join(types)}|{','.join(rules)}|{policy}") |
| 2050 | except Exception: |
| 2051 | continue |
| 2052 | |
| 2053 | def identity_show(file): |
| 2054 | """Show identity details""" |
| 2055 | data = _identity_read(file) |
| 2056 | if not data: |
| 2057 | print("Error: Identity not found", file=sys.stderr) |
| 2058 | sys.exit(1) |
| 2059 | print(f"name|{data.get('name','')}") |
| 2060 | print(f"peer_count|{len(data.get('peers',[]))}") |
| 2061 | for peer_name, dev in data.get('devices', {}).items(): |
| 2062 | print(f"device|{peer_name}|{dev.get('type','')}|{dev.get('index',1)}") |
| 2063 | |
| 2064 | def identity_add_peer(file, identity_name, peer_name, peer_type, index): |
| 2065 | """Add a peer to an identity file, creating it if needed""" |
| 2066 | data = _identity_read(file) or _identity_init(identity_name) |
| 2067 | if peer_name not in data['peers']: |
| 2068 | data['peers'].append(peer_name) |
| 2069 | data['devices'][peer_name] = { |
| 2070 | 'type': peer_type, |
| 2071 | 'index': int(index) |
| 2072 | } |
| 2073 | _identity_write(file, data) |
| 2074 | |
| 2075 | def identity_remove_peer(file, peer_name): |
| 2076 | """Remove a peer from an identity file""" |
| 2077 | data = _identity_read(file) |
| 2078 | if not data: |
| 2079 | return |
| 2080 | data['peers'] = [p for p in data['peers'] if p != peer_name] |
| 2081 | data['devices'].pop(peer_name, None) |
| 2082 | _identity_write(file, data) |
| 2083 | |
| 2084 | def identity_remove(file): |
| 2085 | """Delete an identity file — existence check done in bash""" |
| 2086 | try: |
| 2087 | os.remove(file) |
| 2088 | except Exception as e: |
| 2089 | print(f"Error: {e}", file=sys.stderr) |
| 2090 | sys.exit(1) |
| 2091 | |
| 2092 | def identity_next_index(file, peer_type): |
| 2093 | """ |
| 2094 | Return the next available index for a given type within an identity. |
| 2095 | phone-nuno exists (index 1) -> returns 2 |
| 2096 | No phones exist -> returns 1 |
| 2097 | """ |
| 2098 | data = _identity_read(file) |
| 2099 | if not data: |
| 2100 | print(1) |
| 2101 | return |
| 2102 | existing = [ |
| 2103 | d.get('index', 1) |
| 2104 | for d in data.get('devices', {}).values() |
| 2105 | if d.get('type') == peer_type |
| 2106 | ] |
| 2107 | if not existing: |
| 2108 | print(1) |
| 2109 | return |
| 2110 | # Find lowest unused index starting from 1 |
| 2111 | used = set(existing) |
| 2112 | i = 1 |
| 2113 | while i in used: |
| 2114 | i += 1 |
| 2115 | print(i) |
| 2116 | |
| 2117 | def identity_peers(file, filter_type=''): |
| 2118 | """ |
| 2119 | List peers belonging to an identity, optionally filtered by type. |
| 2120 | Output: one peer name per line. |
| 2121 | """ |
| 2122 | data = _identity_read(file) |
| 2123 | if not data: |
| 2124 | return |
| 2125 | for peer_name in data.get('peers', []): |
| 2126 | if filter_type: |
| 2127 | dev = data.get('devices', {}).get(peer_name, {}) |
| 2128 | if dev.get('type') != filter_type: |
| 2129 | continue |
| 2130 | print(peer_name) |
| 2131 | |
| 2132 | def identity_migrate(identities_dir, clients_dir, meta_dir, dry_run): |
| 2133 | """ |
| 2134 | Scan all peer configs and auto-create identity files from name convention. |
| 2135 | dry_run: 'true' -> print what would be done, no writes. |
| 2136 | Output per action: action|identity|peer|type|index |
| 2137 | """ |
| 2138 | import glob |
| 2139 | |
| 2140 | is_dry = dry_run == 'true' |
| 2141 | grouped = {} # identity_name -> [(peer_name, type, index)] |
| 2142 | |
| 2143 | for conf in sorted(glob.glob(f"{clients_dir}/*.conf")): |
| 2144 | peer_name = os.path.basename(conf).replace('.conf', '') |
| 2145 | parsed = _parse_peer_name(peer_name) |
| 2146 | if not parsed: |
| 2147 | print(f"skip|{peer_name}") |
| 2148 | continue |
| 2149 | peer_type, identity_name, index = parsed |
| 2150 | if identity_name not in grouped: |
| 2151 | grouped[identity_name] = [] |
| 2152 | grouped[identity_name].append((peer_name, peer_type, index)) |
| 2153 | |
| 2154 | for identity_name, peers in sorted(grouped.items()): |
| 2155 | id_file = os.path.join(identities_dir, f"{identity_name}.identity") |
| 2156 | for peer_name, peer_type, index in peers: |
| 2157 | print(f"create|{identity_name}|{peer_name}|{peer_type}|{index}") |
| 2158 | if not is_dry: |
| 2159 | identity_add_peer(id_file, identity_name, peer_name, peer_type, index) |
| 2160 | |
| 2161 | def identity_infer(peer_name): |
| 2162 | """ |
| 2163 | Parse a peer name and print identity|type|index, or nothing if no match. |
| 2164 | Used by add.command.sh to auto-attach on vanilla wgctl add. |
| 2165 | """ |
| 2166 | parsed = _parse_peer_name(peer_name) |
| 2167 | if parsed: |
| 2168 | peer_type, identity_name, index = parsed |
| 2169 | print(f"{identity_name}|{peer_type}|{index}") |
| 2170 | |
| 2171 | def identity_exists(file): |
| 2172 | """Exit 0 if identity file exists and is valid, else exit 1""" |
| 2173 | data = _identity_read(file) |
| 2174 | sys.exit(0 if data is not None else 1) |
| 2175 | |
| 2176 | # ============================================ |
| 2177 | # peer_data update — adds type field from meta |
| 2178 | # ============================================ |
| 2179 | # NOTE: This replaces the existing peer_data function. |
| 2180 | # The new version reads 'type' from meta directly. |
| 2181 | # Output format: name|ip|rule|type|last_ts|last_evt|main_group |
| 2182 | |
| 2183 | def peer_data(clients_dir, meta_dir, events_log): |
| 2184 | """ |
| 2185 | Updated peer_data that reads 'type' from meta. |
| 2186 | Output: name|ip|rule|type|last_ts|last_evt|main_group |
| 2187 | """ |
| 2188 | import glob |
| 2189 | |
| 2190 | meta = {} |
| 2191 | for f in glob.glob(f"{meta_dir}/*.meta"): |
| 2192 | name = os.path.basename(f).replace('.meta', '') |
| 2193 | try: |
| 2194 | with open(f) as mf: |
| 2195 | meta[name] = json.load(mf) |
| 2196 | except Exception: |
| 2197 | meta[name] = {} |
| 2198 | |
| 2199 | last_events = {} |
| 2200 | try: |
| 2201 | with open(events_log) as f: |
| 2202 | for line in f: |
| 2203 | try: |
| 2204 | e = json.loads(line.strip()) |
| 2205 | client = e.get('client', '') |
| 2206 | if client: |
| 2207 | last_events[client] = e |
| 2208 | except Exception: |
| 2209 | pass |
| 2210 | except Exception: |
| 2211 | pass |
| 2212 | |
| 2213 | for conf in sorted(glob.glob(f"{clients_dir}/*.conf")): |
| 2214 | name = os.path.basename(conf).replace('.conf', '') |
| 2215 | ip = '' |
| 2216 | try: |
| 2217 | with open(conf) as f: |
| 2218 | for line in f: |
| 2219 | if line.startswith('Address'): |
| 2220 | ip = line.split('=')[1].strip().split('/')[0] |
| 2221 | break |
| 2222 | except Exception: |
| 2223 | pass |
| 2224 | |
| 2225 | m = meta.get(name, {}) |
| 2226 | rule = m.get('rule', '') |
| 2227 | peer_type = m.get('type', '') |
| 2228 | main_group = m.get('main_group', '') |
| 2229 | |
| 2230 | last_event = last_events.get(name, {}) |
| 2231 | last_ts = last_event.get('timestamp', '') |
| 2232 | last_evt = last_event.get('event', '') |
| 2233 | |
| 2234 | print(f"{name}|{ip}|{rule}|{peer_type}|{last_ts}|{last_evt}|{main_group}") |
| 2235 | |
| 2236 | def subnet_default_rule(file, name, type_key=''): |
| 2237 | """ |
| 2238 | Return the default_rule for a subnet entry, or empty string if none set. |
| 2239 | For scalar: subnet_default_rule(file, "desktop") -> "" |
| 2240 | For group: subnet_default_rule(file, "guests", "phone") -> "guest" |
| 2241 | """ |
| 2242 | data = _subnet_read(file) |
| 2243 | if name not in data: |
| 2244 | print('') |
| 2245 | return |
| 2246 | entry = data[name] |
| 2247 | if _subnet_is_group(entry): |
| 2248 | key = type_key if type_key else 'none' |
| 2249 | child = entry.get(key, {}) |
| 2250 | print(child.get('default_rule', '')) |
| 2251 | else: |
| 2252 | print(entry.get('default_rule', '')) |
| 2253 | |
| 2254 | def subnet_list_names(file): |
| 2255 | """ |
| 2256 | List all top-level subnet names, one per line. |
| 2257 | Used for dynamic flag registration in commands. |
| 2258 | Output: one name per line (e.g. desktop, laptop, guests, servers, iot) |
| 2259 | """ |
| 2260 | data = _subnet_read(file) |
| 2261 | for name in data.keys(): |
| 2262 | print(name) |
| 2263 | |
| 2264 | # ============================================ |
| 2265 | # Policy System |
| 2266 | # ============================================ |
| 2267 | |
| 2268 | _POLICY_DEFAULTS = { |
| 2269 | "default": { |
| 2270 | "tunnel_mode": "split", |
| 2271 | "default_rule": None, |
| 2272 | "strict_rule": False, |
| 2273 | "auto_apply": True, |
| 2274 | "desc": "Default policy" |
| 2275 | }, |
| 2276 | "guest": { |
| 2277 | "tunnel_mode": "split", |
| 2278 | "default_rule": "guest", |
| 2279 | "strict_rule": True, |
| 2280 | "auto_apply": True, |
| 2281 | "desc": "Guest access policy" |
| 2282 | }, |
| 2283 | "trusted": { |
| 2284 | "tunnel_mode": "split", |
| 2285 | "default_rule": None, |
| 2286 | "strict_rule": False, |
| 2287 | "auto_apply": True, |
| 2288 | "desc": "Trusted device policy" |
| 2289 | }, |
| 2290 | "server": { |
| 2291 | "tunnel_mode": "split", |
| 2292 | "default_rule": None, |
| 2293 | "strict_rule": False, |
| 2294 | "auto_apply": True, |
| 2295 | "desc": "Server policy" |
| 2296 | }, |
| 2297 | "iot": { |
| 2298 | "tunnel_mode": "split", |
| 2299 | "default_rule": None, |
| 2300 | "strict_rule": False, |
| 2301 | "auto_apply": True, |
| 2302 | "desc": "IoT device policy" |
| 2303 | } |
| 2304 | } |
| 2305 | |
| 2306 | def _policy_read(file): |
| 2307 | """Read policies.json, fall back to hardcoded defaults if missing.""" |
| 2308 | try: |
| 2309 | if not os.path.exists(file): |
| 2310 | return dict(_POLICY_DEFAULTS) |
| 2311 | with open(file) as f: |
| 2312 | content = f.read().strip() |
| 2313 | if not content: |
| 2314 | return dict(_POLICY_DEFAULTS) |
| 2315 | data = json.loads(content) |
| 2316 | # Merge with defaults so hardcoded policies always exist |
| 2317 | merged = dict(_POLICY_DEFAULTS) |
| 2318 | merged.update(data) |
| 2319 | return merged |
| 2320 | except Exception: |
| 2321 | return dict(_POLICY_DEFAULTS) |
| 2322 | |
| 2323 | def _policy_write(file, data): |
| 2324 | """Write policies.json.""" |
| 2325 | os.makedirs(os.path.dirname(file), exist_ok=True) |
| 2326 | with open(file, 'w') as f: |
| 2327 | json.dump(data, f, indent=2) |
| 2328 | |
| 2329 | def _policy_get_entry(data, name): |
| 2330 | """Get a policy entry, falling back to 'default' policy values for missing fields.""" |
| 2331 | entry = data.get(name, {}) |
| 2332 | default = data.get('default', _POLICY_DEFAULTS.get('default', {})) |
| 2333 | # Merge: entry fields override default |
| 2334 | resolved = dict(default) |
| 2335 | resolved.update(entry) |
| 2336 | return resolved |
| 2337 | |
| 2338 | def policy_get(file, name, field=''): |
| 2339 | """ |
| 2340 | Get a policy entry or a specific field from it. |
| 2341 | policy_get(file, "guest") -> prints all fields as key|value lines |
| 2342 | policy_get(file, "guest", "tunnel_mode") -> prints "split" |
| 2343 | policy_get(file, "guest", "strict_rule") -> prints "true" or "false" |
| 2344 | """ |
| 2345 | data = _policy_read(file) |
| 2346 | entry = _policy_get_entry(data, name) |
| 2347 | |
| 2348 | if field: |
| 2349 | val = entry.get(field) |
| 2350 | if val is None: |
| 2351 | print('') |
| 2352 | elif isinstance(val, bool): |
| 2353 | print('true' if val else 'false') |
| 2354 | else: |
| 2355 | print(val) |
| 2356 | else: |
| 2357 | for k, v in entry.items(): |
| 2358 | if isinstance(v, bool): |
| 2359 | print(f"{k}|{'true' if v else 'false'}") |
| 2360 | elif v is None: |
| 2361 | print(f"{k}|") |
| 2362 | else: |
| 2363 | print(f"{k}|{v}") |
| 2364 | |
| 2365 | def policy_list(file): |
| 2366 | """ |
| 2367 | List all policies. |
| 2368 | Output per line: name|tunnel_mode|default_rule|strict_rule|auto_apply|desc |
| 2369 | """ |
| 2370 | data = _policy_read(file) |
| 2371 | for name, raw_entry in data.items(): |
| 2372 | entry = _policy_get_entry(data, name) |
| 2373 | tunnel_mode = entry.get('tunnel_mode', 'split') |
| 2374 | default_rule = entry.get('default_rule') or '' |
| 2375 | strict_rule = 'true' if entry.get('strict_rule', False) else 'false' |
| 2376 | auto_apply = 'true' if entry.get('auto_apply', True) else 'false' |
| 2377 | desc = entry.get('desc', '') |
| 2378 | print(f"{name}|{tunnel_mode}|{default_rule}|{strict_rule}|{auto_apply}|{desc}") |
| 2379 | |
| 2380 | def policy_exists(file, name): |
| 2381 | """Exit 0 if policy exists, 1 otherwise.""" |
| 2382 | data = _policy_read(file) |
| 2383 | sys.exit(0 if name in data else 1) |
| 2384 | |
| 2385 | def policy_add(file, name, tunnel_mode, default_rule, strict_rule, auto_apply, desc): |
| 2386 | """Add or update a policy entry.""" |
| 2387 | data = _policy_read(file) |
| 2388 | data[name] = { |
| 2389 | 'tunnel_mode': tunnel_mode or 'split', |
| 2390 | 'default_rule': default_rule if default_rule else None, |
| 2391 | 'strict_rule': strict_rule == 'true', |
| 2392 | 'auto_apply': auto_apply != 'false', |
| 2393 | 'desc': desc or '' |
| 2394 | } |
| 2395 | _policy_write(file, data) |
| 2396 | |
| 2397 | def policy_remove(file, name): |
| 2398 | """Remove a policy. Refuses to remove hardcoded defaults.""" |
| 2399 | if name in _POLICY_DEFAULTS: |
| 2400 | print(f"Error: Cannot remove built-in policy '{name}'", file=sys.stderr) |
| 2401 | sys.exit(1) |
| 2402 | data = _policy_read(file) |
| 2403 | if name not in data: |
| 2404 | print(f"Error: Policy '{name}' not found", file=sys.stderr) |
| 2405 | sys.exit(1) |
| 2406 | del data[name] |
| 2407 | _policy_write(file, data) |
| 2408 | |
| 2409 | def policy_set_field(file, name, field, value): |
| 2410 | """Set a single field on an existing policy.""" |
| 2411 | data = _policy_read(file) |
| 2412 | if name not in data: |
| 2413 | print(f"Error: Policy '{name}' not found", file=sys.stderr) |
| 2414 | sys.exit(1) |
| 2415 | entry = data[name] |
| 2416 | if field in ('strict_rule', 'auto_apply'): |
| 2417 | entry[field] = value == 'true' |
| 2418 | elif field == 'default_rule': |
| 2419 | entry[field] = value if value else None |
| 2420 | else: |
| 2421 | entry[field] = value |
| 2422 | data[name] = entry |
| 2423 | _policy_write(file, data) |
| 2424 | |
| 2425 | def subnet_policy(subnets_file, subnet_name, type_key=''): |
| 2426 | """ |
| 2427 | Get the policy name for a subnet entry. |
| 2428 | Falls back to 'default' if no policy set. |
| 2429 | """ |
| 2430 | data = _subnet_read(subnets_file) |
| 2431 | if subnet_name not in data: |
| 2432 | print('default') |
| 2433 | return |
| 2434 | entry = data[subnet_name] |
| 2435 | if _subnet_is_group(entry): |
| 2436 | key = type_key if type_key else 'none' |
| 2437 | child = entry.get(key, {}) |
| 2438 | print(child.get('policy', 'default')) |
| 2439 | else: |
| 2440 | print(entry.get('policy', 'default')) |
| 2441 | |
| 2442 | def json_get_nested(file, *keys): |
| 2443 | """ |
| 2444 | Get a nested field from a JSON file. |
| 2445 | json_get_nested(file, "rule_flags", "strict_rule") |
| 2446 | Output: the value as a string, or empty string if not found. |
| 2447 | """ |
| 2448 | try: |
| 2449 | with open(file) as f: |
| 2450 | data = json.load(f) |
| 2451 | val = data |
| 2452 | for key in keys: |
| 2453 | if not isinstance(val, dict): |
| 2454 | print('') |
| 2455 | return |
| 2456 | val = val.get(key) |
| 2457 | if val is None: |
| 2458 | print('') |
| 2459 | return |
| 2460 | if isinstance(val, bool): |
| 2461 | print('true' if val else 'false') |
| 2462 | elif val is None: |
| 2463 | print('') |
| 2464 | else: |
| 2465 | print(val) |
| 2466 | except Exception: |
| 2467 | print('') |
| 2468 | |
| 2469 | def json_set_nested(file, *args): |
| 2470 | """ |
| 2471 | Set a nested field in a JSON file. |
| 2472 | Args: file, key1, key2, ..., value |
| 2473 | json_set_nested(file, "rule_flags", "strict_rule", "true") |
| 2474 | Creates intermediate dicts as needed. |
| 2475 | """ |
| 2476 | if len(args) < 2: |
| 2477 | return |
| 2478 | keys = args[:-1] |
| 2479 | value = args[-1] |
| 2480 | |
| 2481 | try: |
| 2482 | if os.path.exists(file): |
| 2483 | with open(file) as f: |
| 2484 | data = json.load(f) |
| 2485 | else: |
| 2486 | data = {} |
| 2487 | |
| 2488 | # Navigate/create nested structure |
| 2489 | target = data |
| 2490 | for key in keys[:-1]: |
| 2491 | if key not in target or not isinstance(target[key], dict): |
| 2492 | target[key] = {} |
| 2493 | target = target[key] |
| 2494 | |
| 2495 | # Coerce value types |
| 2496 | final_key = keys[-1] |
| 2497 | if value == 'true': |
| 2498 | target[final_key] = True |
| 2499 | elif value == 'false': |
| 2500 | target[final_key] = False |
| 2501 | else: |
| 2502 | target[final_key] = value |
| 2503 | |
| 2504 | with open(file, 'w') as f: |
| 2505 | json.dump(data, f, indent=2) |
| 2506 | except Exception as e: |
| 2507 | print(f"Error: {e}", file=sys.stderr) |
| 2508 | sys.exit(1) |
| 2509 | |
| 2510 | def activity_aggregate(fw_file, wg_file, wg_interface, net_file, |
| 2511 | clients_dir, meta_dir, hours, filter_peer, filter_service_ip): |
| 2512 | """ |
| 2513 | Aggregate activity data for wgctl activity. |
| 2514 | Output: |
| 2515 | peer|name|rx_bytes|tx_bytes|drop_count |
| 2516 | service|peer_name|dest_display|drop_count |
| 2517 | """ |
| 2518 | import glob |
| 2519 | import subprocess |
| 2520 | from datetime import datetime, timezone, timedelta |
| 2521 | from collections import defaultdict |
| 2522 | |
| 2523 | hours = int(hours) if hours else 24 |
| 2524 | cutoff = None |
| 2525 | if hours > 0: |
| 2526 | cutoff = datetime.now(timezone.utc) - timedelta(hours=hours) |
| 2527 | |
| 2528 | # Build ip -> peer name map |
| 2529 | ip_to_peer = {} |
| 2530 | for conf in sorted(glob.glob(f"{clients_dir}/*.conf")): |
| 2531 | name = os.path.basename(conf).replace('.conf', '') |
| 2532 | try: |
| 2533 | with open(conf) as f: |
| 2534 | for line in f: |
| 2535 | if line.startswith('Address'): |
| 2536 | ip = line.split('=')[1].strip().split('/')[0] |
| 2537 | ip_to_peer[ip] = name |
| 2538 | break |
| 2539 | except Exception: |
| 2540 | continue |
| 2541 | |
| 2542 | # Build pubkey -> peer name map |
| 2543 | pubkey_to_peer = {} |
| 2544 | for kf in glob.glob(f"{clients_dir}/*_public.key"): |
| 2545 | name = os.path.basename(kf).replace('_public.key', '') |
| 2546 | try: |
| 2547 | with open(kf) as f: |
| 2548 | key = f.read().strip() |
| 2549 | if key: |
| 2550 | pubkey_to_peer[key] = name |
| 2551 | except Exception: |
| 2552 | continue |
| 2553 | |
| 2554 | # Get WireGuard transfer totals |
| 2555 | peer_rx = defaultdict(int) |
| 2556 | peer_tx = defaultdict(int) |
| 2557 | try: |
| 2558 | result = subprocess.run( |
| 2559 | ['wg', 'show', wg_interface, 'transfer'], |
| 2560 | capture_output=True, text=True |
| 2561 | ) |
| 2562 | for line in result.stdout.strip().splitlines(): |
| 2563 | parts = line.split() |
| 2564 | if len(parts) >= 3: |
| 2565 | pubkey, rx, tx = parts[0], int(parts[1]), int(parts[2]) |
| 2566 | peer = pubkey_to_peer.get(pubkey) |
| 2567 | if peer: |
| 2568 | peer_rx[peer] += rx |
| 2569 | peer_tx[peer] += tx |
| 2570 | except Exception: |
| 2571 | pass |
| 2572 | |
| 2573 | # Load net services for reverse lookup |
| 2574 | net_data = {} |
| 2575 | if os.path.exists(net_file): |
| 2576 | try: |
| 2577 | with open(net_file) as f: |
| 2578 | net_data = json.load(f) |
| 2579 | except Exception: |
| 2580 | pass |
| 2581 | |
| 2582 | def reverse_lookup(dest_ip, dest_port, proto): |
| 2583 | for svc_name, svc in net_data.items(): |
| 2584 | if not isinstance(svc, dict): |
| 2585 | continue |
| 2586 | if svc.get('ip', '') != dest_ip: |
| 2587 | continue |
| 2588 | ports = svc.get('ports', {}) |
| 2589 | if dest_port: |
| 2590 | for port_name, port_def in ports.items(): |
| 2591 | if not isinstance(port_def, dict): |
| 2592 | continue |
| 2593 | if (str(port_def.get('port', '')) == str(dest_port) and |
| 2594 | port_def.get('proto', 'tcp') == proto): |
| 2595 | return f"{svc_name}:{port_name}" |
| 2596 | return svc_name |
| 2597 | return svc_name |
| 2598 | return '' |
| 2599 | |
| 2600 | # Parse and first-pass dedup (within time window per key) |
| 2601 | events = [] |
| 2602 | last_seen = {} |
| 2603 | |
| 2604 | try: |
| 2605 | with open(file) as f: |
| 2606 | for line in f: |
| 2607 | try: |
| 2608 | e = json.loads(line.strip()) |
| 2609 | src = e.get('src_ip', '') |
| 2610 | if not src: |
| 2611 | continue |
| 2612 | if filter_ip and src != filter_ip: |
| 2613 | continue |
| 2614 | |
| 2615 | proto_num = int(e.get('ip.protocol', 0)) |
| 2616 | proto = proto_map.get(proto_num, str(proto_num)) |
| 2617 | dst = e.get('dest_ip', '') |
| 2618 | port = str(e.get('dest_port', '')) |
| 2619 | key = (src, dst, port, proto_num) |
| 2620 | |
| 2621 | ts_str = e.get('timestamp', '') |
| 2622 | try: |
| 2623 | ts = datetime.fromisoformat(ts_str).timestamp() |
| 2624 | except Exception: |
| 2625 | ts = 0 |
| 2626 | |
| 2627 | windows = {1: 5, 6: 30, 17: 10} |
| 2628 | window = windows.get(proto_num, 10) |
| 2629 | if key in last_seen and (ts - last_seen[key]) < window: |
| 2630 | continue |
| 2631 | last_seen[key] = ts |
| 2632 | events.append(e) |
| 2633 | except Exception: |
| 2634 | pass |
| 2635 | except Exception: |
| 2636 | pass |
| 2637 | |
| 2638 | # Second-pass dedup consecutive same events with count |
| 2639 | deduped = [] |
| 2640 | counts = [] |
| 2641 | for e in events: |
| 2642 | ts_str = e.get('timestamp', '') |
| 2643 | try: |
| 2644 | ts = datetime.fromisoformat(ts_str).timestamp() |
| 2645 | except Exception: |
| 2646 | ts = 0 |
| 2647 | |
| 2648 | src = e.get('src_ip', '') |
| 2649 | dst = e.get('dest_ip', '') |
| 2650 | port = str(e.get('dest_port', '')) |
| 2651 | proto_num = int(e.get('ip.protocol', 0)) |
| 2652 | key = (src, dst, port, proto_num) |
| 2653 | |
| 2654 | if deduped: |
| 2655 | prev = deduped[-1] |
| 2656 | try: |
| 2657 | prev_ts = datetime.fromisoformat(prev.get('timestamp', '')).timestamp() |
| 2658 | except Exception: |
| 2659 | prev_ts = 0 |
| 2660 | prev_key = ( |
| 2661 | prev.get('src_ip', ''), |
| 2662 | prev.get('dest_ip', ''), |
| 2663 | str(prev.get('dest_port', '')), |
| 2664 | int(prev.get('ip.protocol', 0)) |
| 2665 | ) |
| 2666 | if key == prev_key and (ts - prev_ts) < 300: |
| 2667 | counts[-1] += 1 |
| 2668 | continue |
| 2669 | |
| 2670 | deduped.append(e) |
| 2671 | counts.append(1) |
| 2672 | |
| 2673 | limit = int(limit) if limit else 50 |
| 2674 | for e, count in list(zip(deduped, counts))[-limit:]: |
| 2675 | ts_str = e.get('timestamp', '') |
| 2676 | src = e.get('src_ip', '') |
| 2677 | dst = e.get('dest_ip', '') |
| 2678 | port = str(e.get('dest_port', '')) |
| 2679 | proto_num = int(e.get('ip.protocol', 0)) |
| 2680 | proto = proto_map.get(proto_num, str(proto_num)) |
| 2681 | client = ip_to_name.get(src, src) |
| 2682 | svc_name = reverse_lookup(dst, port, proto) |
| 2683 | |
| 2684 | try: |
| 2685 | dt = datetime.fromisoformat(ts_str) |
| 2686 | ts_fmt = dt.strftime(DATETIME_FMT) |
| 2687 | except Exception: |
| 2688 | ts_fmt = ts_str |
| 2689 | |
| 2690 | print(f"{ts_fmt}|{client}|{dst}|{port}|{proto}|{svc_name}|{count}") |
| 2691 | |
| 2692 | def make_dest_display(dest_ip, dest_port, proto, svc_name): |
| 2693 | if svc_name: |
| 2694 | return svc_name |
| 2695 | if dest_port: |
| 2696 | display = f"{dest_ip}:{dest_port}" |
| 2697 | else: |
| 2698 | display = dest_ip |
| 2699 | if proto and proto not in ('tcp', '6'): |
| 2700 | display += f" ({proto})" |
| 2701 | return display |
| 2702 | |
| 2703 | proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'} |
| 2704 | |
| 2705 | # Parse fw_events for drops |
| 2706 | peer_drops = defaultdict(int) |
| 2707 | service_drops = defaultdict(lambda: defaultdict(int)) |
| 2708 | |
| 2709 | if os.path.exists(fw_file): |
| 2710 | try: |
| 2711 | with open(fw_file) as f: |
| 2712 | for line in f: |
| 2713 | line = line.strip() |
| 2714 | if not line: |
| 2715 | continue |
| 2716 | try: |
| 2717 | ev = json.loads(line) |
| 2718 | if cutoff: |
| 2719 | ts_str = ev.get('timestamp', '') |
| 2720 | try: |
| 2721 | ts = datetime.fromisoformat(ts_str) |
| 2722 | if ts.tzinfo is None: |
| 2723 | ts = ts.replace(tzinfo=timezone.utc) |
| 2724 | if ts < cutoff: |
| 2725 | continue |
| 2726 | except Exception: |
| 2727 | pass |
| 2728 | |
| 2729 | src_ip = ev.get('src_ip', '') |
| 2730 | if not src_ip: |
| 2731 | continue |
| 2732 | |
| 2733 | dest_ip = ev.get('dest_ip', '') |
| 2734 | dest_port = str(ev.get('dest_port', '')) |
| 2735 | proto_num = ev.get('ip.protocol', 0) |
| 2736 | proto = proto_map.get(int(proto_num), str(proto_num)) |
| 2737 | |
| 2738 | peer = ip_to_peer.get(src_ip) |
| 2739 | if not peer: |
| 2740 | continue |
| 2741 | |
| 2742 | if filter_peer and peer != filter_peer: |
| 2743 | continue |
| 2744 | if filter_service_ip and dest_ip != filter_service_ip: |
| 2745 | continue |
| 2746 | |
| 2747 | svc_name = reverse_lookup(dest_ip, dest_port, proto) |
| 2748 | dest_display = make_dest_display(dest_ip, dest_port, proto, svc_name) |
| 2749 | |
| 2750 | peer_drops[peer] += 1 |
| 2751 | service_drops[peer][dest_display] += 1 |
| 2752 | |
| 2753 | except Exception: |
| 2754 | continue |
| 2755 | except Exception: |
| 2756 | pass |
| 2757 | |
| 2758 | # Collect peers with any activity |
| 2759 | all_peers = set() |
| 2760 | all_peers.update(k for k in peer_rx if peer_rx[k] > 0) |
| 2761 | all_peers.update(k for k in peer_tx if peer_tx[k] > 0) |
| 2762 | all_peers.update(peer_drops.keys()) |
| 2763 | if filter_peer: |
| 2764 | all_peers = {p for p in all_peers if p == filter_peer} |
| 2765 | |
| 2766 | for peer in sorted(all_peers): |
| 2767 | rx = peer_rx.get(peer, 0) |
| 2768 | tx = peer_tx.get(peer, 0) |
| 2769 | drops = peer_drops.get(peer, 0) |
| 2770 | |
| 2771 | print(f"peer|{peer}|{rx}|{tx}|{drops}") |
| 2772 | |
| 2773 | svc_map = service_drops.get(peer, {}) |
| 2774 | for dest_display, count in sorted(svc_map.items(), key=lambda x: -x[1]): |
| 2775 | print(f"service|{peer}|{dest_display}|{count}") |
| 2776 | |
| 2777 | def _hosts_read(file): |
| 2778 | if not os.path.exists(file): |
| 2779 | return {"hosts": {}, "subnets": {}, "ports": {}} |
| 2780 | try: |
| 2781 | with open(file) as f: |
| 2782 | data = json.load(f) |
| 2783 | # Ensure all sections exist |
| 2784 | data.setdefault("hosts", {}) |
| 2785 | data.setdefault("subnets", {}) |
| 2786 | data.setdefault("ports", {}) |
| 2787 | return data |
| 2788 | except Exception: |
| 2789 | return {"hosts": {}, "subnets": {}, "ports": {}} |
| 2790 | |
| 2791 | def _hosts_write(file, data): |
| 2792 | with open(file, 'w') as f: |
| 2793 | json.dump(data, f, indent=2) |
| 2794 | |
| 2795 | def hosts_list(file): |
| 2796 | """ |
| 2797 | List all host entries. |
| 2798 | Output per line: type|key|name|desc|tags |
| 2799 | """ |
| 2800 | data = _hosts_read(file) |
| 2801 | for ip, entry in sorted(data["hosts"].items()): |
| 2802 | if isinstance(entry, dict): |
| 2803 | name = entry.get("name", "") |
| 2804 | desc = entry.get("desc", "") |
| 2805 | tags = ",".join(entry.get("tags", [])) |
| 2806 | else: |
| 2807 | name = str(entry) |
| 2808 | desc = "" |
| 2809 | tags = "" |
| 2810 | print(f"host|{ip}|{name}|{desc}|{tags}") |
| 2811 | for subnet, entry in sorted(data["subnets"].items()): |
| 2812 | if isinstance(entry, dict): |
| 2813 | name = entry.get("name", "") |
| 2814 | desc = entry.get("desc", "") |
| 2815 | tags = ",".join(entry.get("tags", [])) |
| 2816 | else: |
| 2817 | name = str(entry) |
| 2818 | desc = "" |
| 2819 | tags = "" |
| 2820 | print(f"subnet|{subnet}|{name}|{desc}|{tags}") |
| 2821 | for port, entry in sorted(data["ports"].items()): |
| 2822 | if isinstance(entry, dict): |
| 2823 | name = entry.get("name", "") |
| 2824 | desc = entry.get("desc", "") |
| 2825 | tags = ",".join(entry.get("tags", [])) |
| 2826 | else: |
| 2827 | name = str(entry) |
| 2828 | desc = "" |
| 2829 | tags = "" |
| 2830 | print(f"port|{port}|{name}|{desc}|{tags}") |
| 2831 | |
| 2832 | def hosts_show(file, key, entry_type): |
| 2833 | """Show a single host entry. type: host|subnet|port""" |
| 2834 | data = _hosts_read(file) |
| 2835 | section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"} |
| 2836 | section = section_map.get(entry_type, "hosts") |
| 2837 | entry = data[section].get(key) |
| 2838 | if not entry: |
| 2839 | print(f"Error: not found: {key}", file=sys.stderr) |
| 2840 | sys.exit(1) |
| 2841 | if isinstance(entry, dict): |
| 2842 | print(f"name|{entry.get('name', '')}") |
| 2843 | print(f"desc|{entry.get('desc', '')}") |
| 2844 | print(f"tags|{','.join(entry.get('tags', []))}") |
| 2845 | else: |
| 2846 | print(f"name|{entry}") |
| 2847 | print(f"desc|") |
| 2848 | print(f"tags|") |
| 2849 | |
| 2850 | def hosts_add(file, entry_type, key, name, desc, tags): |
| 2851 | """ |
| 2852 | Add a host entry. |
| 2853 | entry_type: host|subnet|port |
| 2854 | key: IP, subnet CIDR, or port number |
| 2855 | """ |
| 2856 | data = _hosts_read(file) |
| 2857 | section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"} |
| 2858 | section = section_map.get(entry_type, "hosts") |
| 2859 | tag_list = [t.strip() for t in tags.split(",") if t.strip()] if tags else [] |
| 2860 | data[section][key] = { |
| 2861 | "name": name, |
| 2862 | "desc": desc, |
| 2863 | "tags": tag_list |
| 2864 | } |
| 2865 | _hosts_write(file, data) |
| 2866 | |
| 2867 | def hosts_remove(file, entry_type, key): |
| 2868 | """Remove a host entry.""" |
| 2869 | data = _hosts_read(file) |
| 2870 | section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"} |
| 2871 | section = section_map.get(entry_type, "hosts") |
| 2872 | if key not in data[section]: |
| 2873 | print(f"Error: not found: {key}", file=sys.stderr) |
| 2874 | sys.exit(1) |
| 2875 | del data[section][key] |
| 2876 | _hosts_write(file, data) |
| 2877 | |
| 2878 | def hosts_exists(file, entry_type, key): |
| 2879 | """Check if a host entry exists.""" |
| 2880 | data = _hosts_read(file) |
| 2881 | section_map = {"host": "hosts", "subnet": "subnets", "port": "ports"} |
| 2882 | section = section_map.get(entry_type, "hosts") |
| 2883 | print("true" if key in data[section] else "false") |
| 2884 | |
| 2885 | def hosts_lookup(file, ip): |
| 2886 | """ |
| 2887 | Resolve an IP to a display name. |
| 2888 | Checks hosts section only (exact match). |
| 2889 | Returns name or empty string. |
| 2890 | """ |
| 2891 | data = _hosts_read(file) |
| 2892 | entry = data["hosts"].get(ip) |
| 2893 | if not entry: |
| 2894 | print("") |
| 2895 | return |
| 2896 | if isinstance(entry, dict): |
| 2897 | print(entry.get("name", ip)) |
| 2898 | else: |
| 2899 | print(str(entry)) |
| 2900 | |
| 2901 | commands = { |
| 2902 | 'get': lambda args: get(args[0], args[1]), |
| 2903 | 'set': lambda args: set_key(args[0], args[1], args[2]), |
| 2904 | 'delete': lambda args: delete_key(args[0], args[1]), |
| 2905 | 'append': lambda args: append(args[0], args[1], args[2]), |
| 2906 | 'remove': lambda args: remove_value(args[0], args[1], args[2]), |
| 2907 | 'cat': lambda args: cat(args[0]), |
| 2908 | 'has_key': lambda args: has_key(args[0], args[1]), |
| 2909 | 'filter_values': lambda args: filter_values(args[0], args[1], args[2]), |
| 2910 | 'last_event': lambda args: last_event(args[0], args[1], args[2], args[3]), |
| 2911 | 'events_for': lambda args: events_for(args[0], args[1], args[2]), |
| 2912 | 'fw_events': lambda args: fw_events( |
| 2913 | args[0], args[1], args[2], args[3], args[4], |
| 2914 | args[5] if len(args) > 5 else '50', |
| 2915 | args[6] if len(args) > 6 else '1'), |
| 2916 | 'wg_events': lambda args: wg_events( |
| 2917 | args[0], args[1], args[2], |
| 2918 | args[3] if len(args) > 3 else '50', |
| 2919 | args[4] if len(args) > 4 else '1'), |
| 2920 | 'format_fw_event': lambda args: format_fw_event(sys.stdin.read(), args[0]), |
| 2921 | 'format_wg_event': lambda args: format_wg_event(sys.stdin.read()), |
| 2922 | 'remove_events': lambda args: remove_events(args[0], args[1]), |
| 2923 | 'follow_logs': lambda args: follow_logs(args[0], args[1], args[2], args[3], args[4], args[5]), |
| 2924 | 'count': lambda args: count(args[0], args[1]), |
| 2925 | 'audit_fw_counts': lambda args: audit_fw_counts(args[0]), |
| 2926 | 'peer_group_map': lambda args: peer_group_map(args[0]), |
| 2927 | 'peer_groups': lambda args: peer_groups(args[0], args[1]), |
| 2928 | 'peer_data': lambda args: peer_data(args[0], args[1], args[2]), |
| 2929 | 'iso_to_ts': lambda args: iso_to_ts(args[0]), |
| 2930 | 'rule_list_data': lambda args: rule_list_data(args[0], args[1]), |
| 2931 | 'group_list_data': lambda args: group_list_data(args[0], args[1], args[2]), |
| 2932 | 'fmt_datetime': lambda args: fmt_datetime(args[0], args[1]), |
| 2933 | 'create_rule': lambda args: create_rule( |
| 2934 | args[0], args[1], args[2], args[3], args[4], args[5], args[6], |
| 2935 | args[7] if len(args) > 7 else '', |
| 2936 | args[8] if len(args) > 8 else '', |
| 2937 | args[9] if len(args) > 9 else '' |
| 2938 | ), |
| 2939 | 'cleanup_config': lambda args: cleanup_config(args[0]), |
| 2940 | 'remove_peer_block': lambda args: remove_peer_block(args[0], args[1]), |
| 2941 | 'create_group': lambda args: create_group(args[0], args[1], args[2]), |
| 2942 | 'parse_event': lambda args: parse_event(args[0]), |
| 2943 | 'parse_fw_event': lambda args: parse_fw_event(args[0]), |
| 2944 | 'remove_events_filtered': lambda args: remove_events_filtered( |
| 2945 | args[0], args[1], args[2], args[3], args[4]=='true', args[5]=='true', args[6] if len(args)>6 else ''), |
| 2946 | 'peer_transfer': lambda args: peer_transfer(args[0]), |
| 2947 | 'peer_transfer_delta': lambda args: peer_transfer_delta(args[0], args[1]), |
| 2948 | 'rule_resolve': lambda args: rule_resolve(args[0], args[1]), |
| 2949 | 'rule_resolve_field': lambda args: rule_resolve_field(args[0], args[1], args[2]), |
| 2950 | 'rule_inspect': lambda args: rule_inspect(args[0], args[1]), |
| 2951 | 'find_rule_file': lambda args: print(find_rule_file(args[0], args[1])), |
| 2952 | 'get_raw': lambda args: print(get_raw(args[0], args[1])), |
| 2953 | 'count_resolved': lambda args: count_resolved(args[0], args[1], args[2]), |
| 2954 | 'block_get': lambda args: block_get(args[0]), |
| 2955 | 'block_is_blocked': lambda args: block_is_blocked(args[0]), |
| 2956 | 'block_set_direct': lambda args: block_set_direct(args[0], args[1], args[2]), |
| 2957 | 'block_add_group': lambda args: block_add_group(args[0], args[1], args[2]), |
| 2958 | 'block_remove_group': lambda args: block_remove_group(args[0], args[1], args[2]), |
| 2959 | 'block_add_rule': lambda args: block_add_rule( |
| 2960 | args[0], args[1], args[2], |
| 2961 | args[3] if len(args) > 3 else '', |
| 2962 | args[4] if len(args) > 4 else '', |
| 2963 | args[5] if len(args) > 5 else '', |
| 2964 | args[6] if len(args) > 6 else '' |
| 2965 | ), |
| 2966 | 'block_remove_rule': lambda args: block_remove_rule( |
| 2967 | args[0], args[1], |
| 2968 | args[2] if len(args) > 2 else '', |
| 2969 | args[3] if len(args) > 3 else '', |
| 2970 | args[4] if len(args) > 4 else '' |
| 2971 | ), |
| 2972 | 'block_get_rules': lambda args: block_get_rules(args[0]), |
| 2973 | 'block_get_groups': lambda args: block_get_groups(args[0]), |
| 2974 | 'block_get_direct': lambda args: block_get_direct(args[0]), |
| 2975 | 'net_list': lambda args: net_list(args[0]), |
| 2976 | 'net_show': lambda args: net_show(args[0], args[1]), |
| 2977 | 'net_exists': lambda args: net_exists(args[0], args[1]), |
| 2978 | 'net_add_service': lambda args: net_add_service( |
| 2979 | args[0], args[1], args[2], |
| 2980 | args[3] if len(args) > 3 else '', |
| 2981 | args[4] if len(args) > 4 else '' |
| 2982 | ), |
| 2983 | 'net_add_port': lambda args: net_add_port( |
| 2984 | args[0], args[1], args[2], args[3], |
| 2985 | args[4] if len(args) > 4 else 'tcp', |
| 2986 | args[5] if len(args) > 5 else '' |
| 2987 | ), |
| 2988 | 'net_remove': lambda args: net_remove(args[0], args[1]), |
| 2989 | 'net_resolve': lambda args: net_resolve(args[0], args[1]), |
| 2990 | 'net_reverse_lookup': lambda args: net_reverse_lookup( |
| 2991 | args[0], args[1], |
| 2992 | args[2] if len(args) > 2 else '', |
| 2993 | args[3] if len(args) > 3 else '' |
| 2994 | ), |
| 2995 | 'block_is_empty': lambda args: block_is_empty(args[0]), |
| 2996 | 'group_has_peer': lambda args: group_has_peer(args[0], args[1]), |
| 2997 | |
| 2998 | # Subnet commands: |
| 2999 | 'subnet_lookup': lambda args: subnet_lookup(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3000 | 'subnet_type': lambda args: subnet_type(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3001 | 'subnet_tunnel_mode': lambda args: subnet_tunnel_mode(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3002 | 'subnet_for_ip': lambda args: subnet_for_ip(args[0], args[1]), |
| 3003 | 'subnet_list': lambda args: subnet_list(args[0]), |
| 3004 | 'subnet_show': lambda args: subnet_show(args[0], args[1]), |
| 3005 | 'subnet_add': lambda args: subnet_add( |
| 3006 | args[0], args[1], args[2], args[3], |
| 3007 | args[4] if len(args) > 4 else 'split', |
| 3008 | args[5] if len(args) > 5 else '', |
| 3009 | args[6] if len(args) > 6 else '' |
| 3010 | ), |
| 3011 | 'subnet_remove': lambda args: subnet_remove(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3012 | 'subnet_rename': lambda args: subnet_rename(args[0], args[1], args[2], args[3] if len(args) > 3 else ''), |
| 3013 | 'subnet_peers': lambda args: subnet_peers(args[0], args[1], args[2], args[3]), |
| 3014 | 'subnet_exists': lambda args: subnet_exists(args[0], args[1]), |
| 3015 | |
| 3016 | # Identity commands: |
| 3017 | 'identity_list': lambda args: identity_list(args[0]), |
| 3018 | 'identity_show': lambda args: identity_show(args[0]), |
| 3019 | 'identity_add_peer': lambda args: identity_add_peer(args[0], args[1], args[2], args[3], args[4]), |
| 3020 | 'identity_remove_peer':lambda args: identity_remove_peer(args[0], args[1]), |
| 3021 | 'identity_remove': lambda args: identity_remove(args[0]), |
| 3022 | 'identity_next_index': lambda args: identity_next_index(args[0], args[1]), |
| 3023 | 'identity_peers': lambda args: identity_peers(args[0], args[1] if len(args) > 1 else ''), |
| 3024 | 'identity_migrate': lambda args: identity_migrate(args[0], args[1], args[2], args[3]), |
| 3025 | 'identity_infer': lambda args: identity_infer(args[0]), |
| 3026 | 'identity_exists': lambda args: identity_exists(args[0]), |
| 3027 | 'subnet_default_rule': lambda args: subnet_default_rule(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3028 | 'subnet_list_names': lambda args: subnet_list_names(args[0]), |
| 3029 | |
| 3030 | # Policy commands: |
| 3031 | 'policy_get': lambda args: policy_get(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3032 | 'policy_list': lambda args: policy_list(args[0]), |
| 3033 | 'policy_exists': lambda args: policy_exists(args[0], args[1]), |
| 3034 | 'policy_add': lambda args: policy_add(args[0], args[1], args[2], args[3], args[4], args[5], args[6] if len(args) > 6 else ''), |
| 3035 | 'policy_remove': lambda args: policy_remove(args[0], args[1]), |
| 3036 | 'policy_set_field': lambda args: policy_set_field(args[0], args[1], args[2], args[3]), |
| 3037 | 'subnet_policy': lambda args: subnet_policy(args[0], args[1], args[2] if len(args) > 2 else ''), |
| 3038 | 'get_nested': lambda args: json_get_nested(args[0], *args[1:]), |
| 3039 | 'set_nested': lambda args: json_set_nested(args[0], *args[1:]), |
| 3040 | 'identity_rules': lambda args: identity_rules(args[0]), |
| 3041 | 'identity_add_rule': lambda args: identity_add_rule(args[0], args[1], args[2]), |
| 3042 | 'identity_remove_rule': lambda args: identity_remove_rule(args[0], args[1]), |
| 3043 | 'identity_clear_rules': lambda args: identity_clear_rules(args[0]), |
| 3044 | 'identity_has_rule': lambda args: identity_has_rule(args[0], args[1]), |
| 3045 | 'activity_aggregate': lambda args: activity_aggregate( |
| 3046 | args[0], args[1], args[2], args[3], args[4], args[5], |
| 3047 | args[6] if len(args) > 6 else '24', |
| 3048 | args[7] if len(args) > 7 else '', |
| 3049 | args[8] if len(args) > 8 else '' |
| 3050 | ), |
| 3051 | 'hosts_list': lambda args: hosts_list(args[0]), |
| 3052 | 'hosts_show': lambda args: hosts_show(args[0], args[1], args[2]), |
| 3053 | 'hosts_add': lambda args: hosts_add(args[0], args[1], args[2], args[3], |
| 3054 | args[4] if len(args) > 4 else '', |
| 3055 | args[5] if len(args) > 5 else ''), |
| 3056 | 'hosts_remove': lambda args: hosts_remove(args[0], args[1], args[2]), |
| 3057 | 'hosts_exists': lambda args: hosts_exists(args[0], args[1], args[2]), |
| 3058 | 'hosts_lookup': lambda args: hosts_lookup(args[0], args[1]), |
| 3059 | } |
| 3060 | |
| 3061 | if __name__ == '__main__': |
| 3062 | if len(sys.argv) < 2: |
| 3063 | print("Usage: json_helper.py <command> <file> [key] [value]", file=sys.stderr) |
| 3064 | sys.exit(1) |
| 3065 | |
| 3066 | cmd = sys.argv[1] |
| 3067 | args = sys.argv[2:] |
| 3068 | |
| 3069 | if cmd not in commands: |
| 3070 | print(f"Unknown command: {cmd}", file=sys.stderr) |
| 3071 | sys.exit(1) |
| 3072 | |
| 3073 | commands[cmd](args) |