removed unused stuff, changed natQ to use opnsense api
This commit is contained in:
@@ -1,5 +1,4 @@
|
||||
import { error, info, success } from "../util/Console.js";
|
||||
import { runRouterCmds } from "./sshExec.js";
|
||||
|
||||
const queue = [];
|
||||
let running = false;
|
||||
@@ -13,38 +12,95 @@ async function processQueue() {
|
||||
if (queue.length === 0) { running = false; return; }
|
||||
running = true;
|
||||
const t = queue.shift();
|
||||
try { await t(); } catch (err) { error('Queue error: ' + String(err)); }
|
||||
try { await t(); } catch (err) { error('Q error ' + err); }
|
||||
setImmediate(processQueue);
|
||||
}
|
||||
|
||||
export function enqueueCmd(fn) {
|
||||
enqueue(() => fn());
|
||||
async function opnsenseRequest(method, path, body = null) {
|
||||
const auth = Buffer.from(`${process.env.OPNSENSE_KEY}:${process.env.OPNSENSE_SECRET}`).toString('base64');
|
||||
const opts = {
|
||||
method,
|
||||
headers: {
|
||||
'Authorization': `Basic ${auth}`,
|
||||
'Content-Type': 'application/json',
|
||||
},
|
||||
};
|
||||
if (body) opts.body = JSON.stringify(body);
|
||||
const res = await fetch(`${process.env.OPNSENSE_HOST}${path}`, opts);
|
||||
const text = await res.text();
|
||||
try {
|
||||
return JSON.parse(text);
|
||||
} catch {
|
||||
error(`got non-json response: ${text}`);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
export function enqueueNatAdd(ip, port, proto='tcp') {
|
||||
async function applyRules() {
|
||||
await opnsenseRequest('POST', '/api/firewall/d_nat/apply');
|
||||
}
|
||||
|
||||
export function enqueueNatAdd(ip, port, proto = 'tcp') {
|
||||
enqueue(async () => {
|
||||
info(`NAT ADD ${proto} ${ip}:${port}`);
|
||||
await runRouterCmds([
|
||||
'conf t',
|
||||
`ip nat inside source static tcp ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
|
||||
`ip nat inside source static udp ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
|
||||
'end',
|
||||
'wr mem'
|
||||
]);
|
||||
success(`NAT ADDED ${proto} ${ip}:${port}`);
|
||||
info(`adding rule udp+tcp at ${ip}:${port}`);
|
||||
|
||||
await opnsenseRequest('POST', '/api/firewall/d_nat/addRule', {
|
||||
rule: {
|
||||
interface: 'wan',
|
||||
protocol: 'tcp',
|
||||
destination: {
|
||||
network: 'wanip',
|
||||
port: `${port}`,
|
||||
},
|
||||
target: ip,
|
||||
'local-port': `${port}`,
|
||||
descr: `pelican-${ip}-${port}-tcp`,
|
||||
disabled: '0',
|
||||
}
|
||||
});
|
||||
|
||||
await opnsenseRequest('POST', '/api/firewall/d_nat/addRule', {
|
||||
rule: {
|
||||
interface: 'wan',
|
||||
protocol: 'udp',
|
||||
destination: {
|
||||
network: 'wanip',
|
||||
port: `${port}`,
|
||||
},
|
||||
target: ip,
|
||||
'local-port': `${port}`,
|
||||
descr: `pelican-${ip}-${port}-udp`,
|
||||
disabled: '0',
|
||||
}
|
||||
});
|
||||
|
||||
await applyRules();
|
||||
success(`added rule udp+tcp at ${ip}:${port}`);
|
||||
});
|
||||
}
|
||||
|
||||
export function enqueueNatRemove(ip, port, proto='tcp') {
|
||||
export function enqueueNatRemove(ip, port, proto = 'tcp') {
|
||||
enqueue(async () => {
|
||||
info(`NAT DEL ${proto} ${ip}:${port}`);
|
||||
await runRouterCmds([
|
||||
'conf t',
|
||||
`no ip nat inside source static tcp ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
|
||||
`no ip nat inside source static udp ${ip} ${port} interface ${process.env.ROUTER_WAN_IF || 'gi0'} ${port}`,
|
||||
'end',
|
||||
'wr mem'
|
||||
]);
|
||||
success(`NAT DELETED ${proto} ${ip}:${port}`);
|
||||
info(`deleting rule udp+tcp at ${ip}:${port}`);
|
||||
|
||||
const result = await opnsenseRequest('POST', '/api/firewall/d_nat/searchRule', {
|
||||
current: 1,
|
||||
rowCount: 1000,
|
||||
searchPhrase: `pelican-${ip}-${port}`,
|
||||
})
|
||||
|
||||
const rows = result?.rows || [];
|
||||
|
||||
for (const rule of rows) {
|
||||
if (
|
||||
rule.descr === `pelican-${ip}-${port}-udp` ||
|
||||
rule.descr === `pelican-${ip}-${port}-tcp`
|
||||
) {
|
||||
await opnsenseRequest('POST', `/api/firewall/d_nat/delRule/${rule.uuid}`);
|
||||
}
|
||||
}
|
||||
|
||||
await applyRules();
|
||||
success(`deleted rule udp+tcp at ${ip}:${port}`);
|
||||
});
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
import { Client } from "ssh2";
|
||||
import { info } from "../util/Console.js";
|
||||
import fs from 'fs';
|
||||
|
||||
|
||||
export function runRouterCmds(cmds, onData) {
|
||||
const ROUTER = {
|
||||
host: process.env.ROUTER_HOST || '192.168.0.1',
|
||||
username: process.env.ROUTER_USER || 'cisco',
|
||||
password: process.env.ROUTER_PASS || '',
|
||||
wanInterface: process.env.ROUTER_WAN_IF || 'gi0'
|
||||
};
|
||||
|
||||
return new Promise((resolve, reject) => {
|
||||
const conn = new Client();
|
||||
let out = '';
|
||||
conn.on('ready', () => {
|
||||
conn.shell((err, stream) => {
|
||||
if (err) return reject(err);
|
||||
stream.on('data', d => {
|
||||
const s = d.toString();
|
||||
out += s;
|
||||
if (onData) onData(s);
|
||||
});
|
||||
stream.on('close', () => {
|
||||
conn.end();
|
||||
resolve(out);
|
||||
});
|
||||
cmds.forEach(c => stream.write(c + '\n'));
|
||||
stream.end('exit\n');
|
||||
});
|
||||
}).on('error', reject).connect({
|
||||
host: ROUTER.host,
|
||||
username: ROUTER.username,
|
||||
password: ROUTER.password,
|
||||
readyTimeout: 20000,
|
||||
algorithms: {
|
||||
kex: [
|
||||
'diffie-hellman-group14-sha1',
|
||||
'diffie-hellman-group-exchange-sha1',
|
||||
],
|
||||
cipher: [
|
||||
'aes128-ctr',
|
||||
'aes192-ctr',
|
||||
'aes256-ctr',
|
||||
],
|
||||
serverHostKey: [
|
||||
'ssh-rsa',
|
||||
],
|
||||
hmac: [
|
||||
'hmac-sha1',
|
||||
'hmac-sha2-256',
|
||||
]
|
||||
},
|
||||
hostVerifier: () => true
|
||||
});
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user