mgrotke/linuxrouter
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Development

Browse source
This commit is contained in:
Matthew Grotke 2026-05-27 15:29:23 -04:00
parent e2573fbf12
commit f0504f802e
8 changed files with 67 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

38
docker/routlin-dash/app/action_networklayout.py
View file

@ -11,7 +11,7 @@ bp = Blueprint('action_networklayout', __name__)
VIEW = '/view/view_network_layout' VIEW = '/view/view_network_layout'
_VLAN_FIELDS = ['name', 'is_vpn', 'subnet', 'subnet_mask', 'dnsmasq_log_queries', _VLAN_FIELDS = ['name', 'vlan_id', 'is_vpn', 'subnet', 'subnet_mask', 'dnsmasq_log_queries',
'radius_default', 'mdns_reflection', 'use_blocklists'] 'radius_default', 'mdns_reflection', 'use_blocklists']
@ -33,6 +33,7 @@ def _hash_ok():
@require_level('administrator') @require_level('administrator')
def networklayout_cardaddvlan_addvlan(): def networklayout_cardaddvlan_addvlan():
name = sanitize.name(request.form.get('name', '')) name = sanitize.name(request.form.get('name', ''))
vlan_id = sanitize.vlan_id(request.form.get('vlan_id', ''))
is_vpn = 'is_vpn' in request.form is_vpn = 'is_vpn' in request.form
subnet = sanitize.ip(request.form.get('subnet', '')) subnet = sanitize.ip(request.form.get('subnet', ''))
subnet_mask = sanitize.subnet_mask(request.form.get('subnet_mask', '')) subnet_mask = sanitize.subnet_mask(request.form.get('subnet_mask', ''))
@ -47,6 +48,9 @@ def networklayout_cardaddvlan_addvlan():
if not name: if not name:
flash('Name is required.', 'error') flash('Name is required.', 'error')
return redirect(VIEW) return redirect(VIEW)
if vlan_id is None:
flash('VLAN ID must be an integer between 1 and 4094.', 'error')
return redirect(VIEW)
if not subnet: if not subnet:
flash('Subnet IP is required.', 'error') flash('Subnet IP is required.', 'error')
return redirect(VIEW) return redirect(VIEW)
@ -54,19 +58,14 @@ def networklayout_cardaddvlan_addvlan():
flash('Invalid subnet prefix (must be 1-30).', 'error') flash('Invalid subnet prefix (must be 1-30).', 'error')
return redirect(VIEW) return redirect(VIEW)
vlan_id = validate.derive_vlan_id(subnet, subnet_mask)
if vlan_id is None:
flash('Cannot derive a valid VLAN ID (1-4094) from this subnet/prefix combination.', 'error')
return redirect(VIEW)
if not _hash_ok(): if not _hash_ok():
return redirect(VIEW) return redirect(VIEW)
cfg = load_config() cfg = load_config()
vlans = cfg.setdefault('vlans', []) vlans = cfg.setdefault('vlans', [])
if any(validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) == vlan_id for v in vlans): if any(v.get('vlan_id') == vlan_id for v in vlans):
flash(f'VLAN {vlan_id} (derived from subnet) already exists.', 'error') flash(f'VLAN ID {vlan_id} is already in use.', 'error')
return redirect(VIEW) return redirect(VIEW)
if radius_default and any(v.get('radius_default') for v in vlans): if radius_default and any(v.get('radius_default') for v in vlans):
flash('Only one VLAN can be the RADIUS default.', 'error') flash('Only one VLAN can be the RADIUS default.', 'error')
@ -74,6 +73,7 @@ def networklayout_cardaddvlan_addvlan():
entry = { entry = {
'name': name, 'name': name,
'vlan_id': vlan_id,
'is_vpn': is_vpn, 'is_vpn': is_vpn,
'subnet': subnet, 'subnet': subnet,
'subnet_mask': subnet_mask, 'subnet_mask': subnet_mask,
@ -111,6 +111,7 @@ def networklayout_tablevlans_edit():
return redirect(VIEW) return redirect(VIEW)
name = sanitize.name(request.form.get('name', '')) name = sanitize.name(request.form.get('name', ''))
vlan_id = sanitize.vlan_id(request.form.get('vlan_id', ''))
subnet = sanitize.ip(request.form.get('subnet', '')) subnet = sanitize.ip(request.form.get('subnet', ''))
radius_default = 'radius_default' in request.form radius_default = 'radius_default' in request.form
mdns_reflection = 'mdns_reflection' in request.form mdns_reflection = 'mdns_reflection' in request.form
@ -142,6 +143,9 @@ def networklayout_tablevlans_edit():
if not name: if not name:
flash('Name is required.', 'error') flash('Name is required.', 'error')
return redirect(VIEW) return redirect(VIEW)
if vlan_id is None:
flash('VLAN ID must be an integer between 1 and 4094.', 'error')
return redirect(VIEW)
if not subnet: if not subnet:
flash('Subnet IP is required.', 'error') flash('Subnet IP is required.', 'error')
return redirect(VIEW) return redirect(VIEW)
@ -165,21 +169,13 @@ def networklayout_tablevlans_edit():
flash(f"Server identity IP '{_ip}' is not in the VLAN subnet ({subnet}/{final_mask}).", 'error') flash(f"Server identity IP '{_ip}' is not in the VLAN subnet ({subnet}/{final_mask}).", 'error')
return redirect(VIEW) return redirect(VIEW)
vlan_id = validate.derive_vlan_id(subnet, final_mask) current_id = existing.get('vlan_id')
if vlan_id is None:
flash('Cannot derive a valid VLAN ID (1-4094) from this subnet/prefix combination.', 'error')
return redirect(VIEW)
current_id = validate.derive_vlan_id(existing.get('subnet', ''), existing.get('subnet_mask', 24))
if current_id == 1 and vlan_id != 1: if current_id == 1 and vlan_id != 1:
flash('VLAN 1 is the physical interface; change its subnet so the derived ID remains 1.', 'error') flash('VLAN 1 is the physical interface and cannot change its ID.', 'error')
return redirect(VIEW) return redirect(VIEW)
if vlan_id != current_id and any( if vlan_id != current_id and any(v.get('vlan_id') == vlan_id for i, v in enumerate(vlans) if i != idx):
validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) == vlan_id flash(f'VLAN ID {vlan_id} is already in use.', 'error')
for i, v in enumerate(vlans) if i != idx
):
flash(f'VLAN {vlan_id} (derived from subnet) already exists.', 'error')
return redirect(VIEW) return redirect(VIEW)
if radius_default and any(i != idx and v.get('radius_default') for i, v in enumerate(vlans)): if radius_default and any(i != idx and v.get('radius_default') for i, v in enumerate(vlans)):
@ -274,6 +270,7 @@ def networklayout_tablevlans_edit():
) )
) )
if (name == existing.get('name', '') if (name == existing.get('name', '')
and vlan_id == existing.get('vlan_id')
and subnet == existing.get('subnet', '') and subnet == existing.get('subnet', '')
and final_mask == existing.get('subnet_mask', 24) and final_mask == existing.get('subnet_mask', 24)
and dnsmasq_log_queries == bool(existing.get('dnsmasq_log_queries', False)) and dnsmasq_log_queries == bool(existing.get('dnsmasq_log_queries', False))
@ -290,6 +287,7 @@ def networklayout_tablevlans_edit():
before = {k: existing.get(k) for k in _VLAN_FIELDS} before = {k: existing.get(k) for k in _VLAN_FIELDS}
existing.update({ existing.update({
'name': name, 'name': name,
'vlan_id': vlan_id,
'is_vpn': is_vpn, 'is_vpn': is_vpn,
'subnet': subnet, 'subnet': subnet,
'subnet_mask': final_mask, 'subnet_mask': final_mask,

8
docker/routlin-dash/app/sanitize.py
View file

@ -223,6 +223,14 @@ _DOTTED_TO_PREFIX = {
'255.255.255.248': 29, '255.255.255.252': 30, '255.255.255.248': 29, '255.255.255.252': 30,
} }
def vlan_id(value):
"""VLAN ID integer 1-4094. Returns int or None."""
try:
n = int(str(value).strip())
return n if 1 <= n <= 4094 else None
except (ValueError, TypeError):
return None
def subnet_mask(value): def subnet_mask(value):
"""Subnet prefix length 1-30 (integer). Also accepts legacy dotted notation. """Subnet prefix length 1-30 (integer). Also accepts legacy dotted notation.
Returns int on success, None if invalid.""" Returns int on success, None if invalid."""

25
docker/routlin-dash/app/view_page.py
View file

@ -158,17 +158,14 @@ def _iface_status(iface):
def _resolve_iface(vlan, cfg): def _resolve_iface(vlan, cfg):
"""Compute interface name from is_vpn + derived vlan_id + general.lan_interface.""" """Compute interface name from is_vpn + stored vlan_id + general.lan_interface."""
if vlan.get('is_vpn'): if vlan.get('is_vpn'):
wg_vlans = [v for v in cfg.get('vlans', []) if v.get('is_vpn')] wg_vlans = [v for v in cfg.get('vlans', []) if v.get('is_vpn')]
wg_sorted = sorted(wg_vlans, key=lambda v: ( wg_sorted = sorted(wg_vlans, key=lambda v: (v.get('vlan_id') is None, v.get('vlan_id') or 0))
validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) is None,
validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) or 0,
))
idx = next((i for i, v in enumerate(wg_sorted) if v is vlan), 0) idx = next((i for i, v in enumerate(wg_sorted) if v is vlan), 0)
return f'wg{idx}' return f'wg{idx}'
lan = cfg.get('network_interfaces', {}).get('lan_interface', 'eth0') lan = cfg.get('network_interfaces', {}).get('lan_interface', 'eth0')
vid = validate.derive_vlan_id(vlan.get('subnet', ''), vlan.get('subnet_mask', 24)) or 1 vid = vlan.get('vlan_id') or 1
return lan if vid == 1 else f'{lan}.{vid}' return lan if vid == 1 else f'{lan}.{vid}'
@ -298,9 +295,9 @@ def _config_datasource(name):
if name == 'vlans': if name == 'vlans':
bl_desc = {b['name']: b.get('description', b['name']) for b in cfg.get('dns_blocking', {}).get('blocklists', []) if 'name' in b} bl_desc = {b['name']: b.get('description', b['name']) for b in cfg.get('dns_blocking', {}).get('blocklists', []) if 'name' in b}
rows = [] rows = []
for v in sorted(vlans, key=lambda x: validate.derive_vlan_id(x.get('subnet', ''), x.get('subnet_mask', 24)) or 0): for v in sorted(vlans, key=lambda x: x.get('vlan_id') or 0):
row = {k: v.get(k) for k in ('name', 'subnet', 'subnet_mask', 'radius_default', 'mdns_reflection', 'is_vpn', 'dnsmasq_log_queries')} row = {k: v.get(k) for k in ('name', 'subnet', 'subnet_mask', 'radius_default', 'mdns_reflection', 'is_vpn', 'dnsmasq_log_queries')}
row['vlan_id'] = validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) row['vlan_id'] = v.get('vlan_id')
row['interface'] = _resolve_iface(v, cfg) row['interface'] = _resolve_iface(v, cfg)
row['use_blocklists'] = json.dumps([ row['use_blocklists'] = json.dumps([
{'n': bl, 'd': bl_desc.get(bl, bl)} for bl in v.get('use_blocklists', []) {'n': bl, 'd': bl_desc.get(bl, bl)} for bl in v.get('use_blocklists', [])
@ -380,12 +377,11 @@ def _config_datasource(name):
rows = [] rows = []
_wg_sorted = sorted( _wg_sorted = sorted(
[v for v in vlans if v.get('is_vpn')], [v for v in vlans if v.get('is_vpn')],
key=lambda v: (validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) is None, key=lambda v: (v.get('vlan_id') is None, v.get('vlan_id') or 0)
validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) or 0)
) )
for i, vlan in enumerate(_wg_sorted): for i, vlan in enumerate(_wg_sorted):
iface = f'wg{i}' iface = f'wg{i}'
vlan_display = f'{iface} (VLAN {validate.derive_vlan_id(vlan.get("subnet", ""), vlan.get("subnet_mask", 24)) or "?"})' vlan_display = f'{iface} (VLAN {vlan.get("vlan_id") or "?"})'
for peer in vlan.get('peers', []): for peer in vlan.get('peers', []):
row = dict(peer) row = dict(peer)
row['vlan_display'] = vlan_display row['vlan_display'] = vlan_display
@ -794,7 +790,7 @@ def collect_tokens():
tokens['VLAN_FILTER_OPTIONS'] = filter_opts tokens['VLAN_FILTER_OPTIONS'] = filter_opts
tokens['VLAN_NAMES_AS_OPTIONS'] = json.dumps([{'value': n, 'label': n} for n in vlan_names]) tokens['VLAN_NAMES_AS_OPTIONS'] = json.dumps([{'value': n, 'label': n} for n in vlan_names])
tokens['VPN_VLAN_COUNT'] = str(sum(1 for v in vlans if v.get('is_vpn'))) tokens['VPN_VLAN_COUNT'] = str(sum(1 for v in vlans if v.get('is_vpn')))
tokens['EXISTING_VLAN_IDS_JSON'] = json.dumps([validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) for v in vlans]) tokens['EXISTING_VLAN_IDS_JSON'] = json.dumps([v.get('vlan_id') for v in vlans])
tokens['EXISTING_VLAN_NAMES_JSON'] = json.dumps([v.get('name', '') for v in vlans]) tokens['EXISTING_VLAN_NAMES_JSON'] = json.dumps([v.get('name', '') for v in vlans])
tokens['EXISTING_VLAN_INTERFACES_JSON'] = json.dumps([_resolve_iface(v, cfg) for v in vlans]) tokens['EXISTING_VLAN_INTERFACES_JSON'] = json.dumps([_resolve_iface(v, cfg) for v in vlans])
tokens['STAT_BANNED_IP_COUNT'] = str(sum(1 for b in cfg.get('banned_ips', []) if b.get('enabled', True))) tokens['STAT_BANNED_IP_COUNT'] = str(sum(1 for b in cfg.get('banned_ips', []) if b.get('enabled', True)))
@ -825,11 +821,10 @@ def collect_tokens():
wg_vlans_list = sorted( wg_vlans_list = sorted(
[v for v in vlans if v.get('is_vpn')], [v for v in vlans if v.get('is_vpn')],
key=lambda v: (validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) is None, key=lambda v: (v.get('vlan_id') is None, v.get('vlan_id') or 0)
validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) or 0)
) )
tokens['VPN_VLAN_OPTIONS'] = json.dumps([ tokens['VPN_VLAN_OPTIONS'] = json.dumps([
{'value': v.get('name', ''), 'label': f'wg{i} (VLAN {validate.derive_vlan_id(v.get("subnet", ""), v.get("subnet_mask", 24)) or "?"})'} {'value': v.get('name', ''), 'label': f'wg{i} (VLAN {v.get("vlan_id") or "?"})'}
for i, v in enumerate(wg_vlans_list) for i, v in enumerate(wg_vlans_list)
]) ])
wg_vlan = wg_vlans_list[0] if wg_vlans_list else {} wg_vlan = wg_vlans_list[0] if wg_vlans_list else {}

11
docker/routlin-dash/data/page_content.json
View file

@ -1676,11 +1676,12 @@
{ {
"type": "field", "type": "field",
"label": "VLAN ID", "label": "VLAN ID",
"name": "", "name": "vlan_id",
"input_type": "text", "input_type": "number",
"readonly": true, "min": 1,
"class": "vlan-derived-id-preview form-input-mono", "max": 4094,
"value": "" "class": "vlan-id-input form-input-mono",
"hint": "Unique integer 1–4094. Sets the 802.1Q tag and interface name."
}, },
{ {
"type": "field", "type": "field",

5
routlin/config.json
View file

@ -264,6 +264,7 @@
"vlans": [ "vlans": [
{ {
"name": "trusted", "name": "trusted",
"vlan_id": 1,
"subnet": "192.168.1.0", "subnet": "192.168.1.0",
"subnet_mask": 24, "subnet_mask": 24,
"is_vpn": false, "is_vpn": false,
@ -368,6 +369,7 @@
}, },
{ {
"name": "iot", "name": "iot",
"vlan_id": 10,
"subnet": "192.168.10.0", "subnet": "192.168.10.0",
"subnet_mask": 24, "subnet_mask": 24,
"is_vpn": false, "is_vpn": false,
@ -472,6 +474,7 @@
}, },
{ {
"name": "guest", "name": "guest",
"vlan_id": 20,
"subnet": "192.168.20.0", "subnet": "192.168.20.0",
"subnet_mask": 24, "subnet_mask": 24,
"is_vpn": false, "is_vpn": false,
@ -534,6 +537,7 @@
}, },
{ {
"name": "kids", "name": "kids",
"vlan_id": 30,
"subnet": "192.168.30.0", "subnet": "192.168.30.0",
"subnet_mask": 24, "subnet_mask": 24,
"is_vpn": false, "is_vpn": false,
@ -611,6 +615,7 @@
}, },
{ {
"name": "vpn", "name": "vpn",
"vlan_id": 40,
"subnet": "192.168.40.0", "subnet": "192.168.40.0",
"subnet_mask": 24, "subnet_mask": 24,
"is_vpn": true, "is_vpn": true,

16
routlin/core.py
View file

@ -99,7 +99,7 @@ from validation import (
VALID_PROTOCOLS, VALID_BLOCKLIST_FORMATS, VALID_PROTOCOLS, VALID_BLOCKLIST_FORMATS,
int_range, domainname, int_range, domainname,
is_wg, is_dynamic_ip, is_wg, is_dynamic_ip,
derive_vlan_id, derive_interface, validate_config, derive_interface, validate_config,
) )
PRODUCT_NAME = "routlin" PRODUCT_NAME = "routlin"
@ -210,7 +210,7 @@ def resolve_vlan_options(vlan):
} }
def is_physical(vlan): def is_physical(vlan):
return derive_vlan_id(vlan.get("subnet", ""), vlan.get("subnet_mask", 24)) == 1 return vlan.get("vlan_id") == 1
def networkd_stem(vlan): def networkd_stem(vlan):
return f"10-{PRODUCT_NAME}-{vlan['name']}" return f"10-{PRODUCT_NAME}-{vlan['name']}"
@ -329,7 +329,7 @@ def apply_networkd(data, dry_run=False, only_if_changed=False):
If only_if_changed=True, write files only when content differs from disk If only_if_changed=True, write files only when content differs from disk
and skip the networkd reload if nothing changed. Used by --apply mode. and skip the networkd reload if nothing changed. Used by --apply mode.
""" """
all_vlan_ids = [derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) for v in data["vlans"] if not is_wg(v)] all_vlan_ids = [v.get('vlan_id') for v in data["vlans"] if not is_wg(v)]
managed_ifaces = [derive_interface(v, data) for v in data["vlans"]] managed_ifaces = [derive_interface(v, data) for v in data["vlans"]]
changed = False changed = False
@ -347,7 +347,7 @@ def apply_networkd(data, dry_run=False, only_if_changed=False):
if is_wg(vlan): if is_wg(vlan):
continue continue
iface = derive_interface(vlan, data) iface = derive_interface(vlan, data)
vid = derive_vlan_id(vlan.get('subnet', ''), vlan.get('subnet_mask', 24)) vid = vlan.get('vlan_id')
stem = networkd_stem(vlan) stem = networkd_stem(vlan)
if not is_physical(vlan): if not is_physical(vlan):
@ -453,7 +453,7 @@ def build_vlan_dnsmasq_conf(vlan, data, iface):
line("# Generated by core.py -- do not edit manually.") line("# Generated by core.py -- do not edit manually.")
line("# Edit config.json and re-run: sudo python3 core.py --apply") line("# Edit config.json and re-run: sudo python3 core.py --apply")
line(f"# VLAN: {name} (vlan_id={derive_vlan_id(vlan.get('subnet', ''), vlan.get('subnet_mask', 24))})") line(f"# VLAN: {name} (vlan_id={vlan.get('vlan_id')})")
line() line()
line(f"pid-file={vlan_pid_file(vlan)}") line(f"pid-file={vlan_pid_file(vlan)}")
if not is_wg(vlan): if not is_wg(vlan):
@ -1872,7 +1872,7 @@ def build_radius_users(data):
] ]
for vlan in data["vlans"]: for vlan in data["vlans"]:
vlan_id = derive_vlan_id(vlan.get('subnet', ''), vlan.get('subnet_mask', 24)) vlan_id = vlan.get('vlan_id')
for r in vlan.get("reservations", []): for r in vlan.get("reservations", []):
if r.get("enabled") is not True: if r.get("enabled") is not True:
continue continue
@ -1888,7 +1888,7 @@ def build_radius_users(data):
"", "",
] ]
default_id = derive_vlan_id(default_vlan.get('subnet', ''), default_vlan.get('subnet_mask', 24)) default_id = default_vlan.get('vlan_id')
lines += [ lines += [
f"# Default -- unknown MACs land on VLAN {default_id} ({default_vlan['name']})", f"# Default -- unknown MACs land on VLAN {default_id} ({default_vlan['name']})",
"DEFAULT Auth-Type := Accept", "DEFAULT Auth-Type := Accept",
@ -2913,7 +2913,7 @@ def cmd_apply(data, dry_run=False):
print(f" Would write: {RADIUS_USERS_FILE}") print(f" Would write: {RADIUS_USERS_FILE}")
print(f" {total_macs} MAC reservation(s)") print(f" {total_macs} MAC reservation(s)")
if default_vlan: if default_vlan:
print(f" DEFAULT -> VLAN {derive_vlan_id(default_vlan.get('subnet', ''), default_vlan.get('subnet_mask', 24))} ({default_vlan['name']})") print(f" DEFAULT -> VLAN {default_vlan.get('vlan_id')} ({default_vlan['name']})")
print(f" Would ensure freeradius is running") print(f" Would ensure freeradius is running")
if avahi_enabled(data): if avahi_enabled(data):
print() print()

6
routlin/health.py
View file

@ -20,7 +20,7 @@ import sys
from datetime import datetime, timezone from datetime import datetime, timezone
from pathlib import Path from pathlib import Path
from validation import derive_interface, derive_vlan_id, is_wg from validation import derive_interface, is_wg
# =================================================================== # ===================================================================
# Constants (mirror core.py - no import to avoid circular dependency) # Constants (mirror core.py - no import to avoid circular dependency)
@ -295,7 +295,7 @@ def check_configurations(data):
# --- VLAN sub-interfaces --- # --- VLAN sub-interfaces ---
for vlan in non_wg: for vlan in non_wg:
iface = derive_interface(vlan, data) iface = derive_interface(vlan, data)
vid = derive_vlan_id(vlan.get("subnet", ""), vlan.get("subnet_mask", 24)) vid = vlan.get("vlan_id")
state = _iface_operstate(iface) state = _iface_operstate(iface)
id_ = f"iface_{vlan['name']}" id_ = f"iface_{vlan['name']}"
name = f"interface {iface}" name = f"interface {iface}"
@ -348,7 +348,7 @@ def check_configurations(data):
# --- systemd-networkd files --- # --- systemd-networkd files ---
for vlan in non_wg: for vlan in non_wg:
iface = derive_interface(vlan, data) iface = derive_interface(vlan, data)
vid = derive_vlan_id(vlan.get("subnet", ""), vlan.get("subnet_mask", 24)) vid = vlan.get("vlan_id")
net = NETWORKD_DIR / f"10-{PRODUCT_NAME}-{vlan['name']}.network" net = NETWORKD_DIR / f"10-{PRODUCT_NAME}-{vlan['name']}.network"
results.append(file_ok(f"networkd_net_{vlan['name']}", results.append(file_ok(f"networkd_net_{vlan['name']}",
f"networkd {net.name}", net)) f"networkd {net.name}", net))

24
routlin/validation.py
View file

@ -286,16 +286,10 @@ def derive_interface(vlan, data):
lan = data.get('network_interfaces', {}).get('lan_interface', 'eth0') lan = data.get('network_interfaces', {}).get('lan_interface', 'eth0')
if is_wg(vlan): if is_wg(vlan):
wg_vlans = [v for v in data.get('vlans', []) if is_wg(v)] wg_vlans = [v for v in data.get('vlans', []) if is_wg(v)]
wg_sorted = sorted( wg_sorted = sorted(wg_vlans, key=lambda v: (v.get('vlan_id') is None, v.get('vlan_id') or 0))
wg_vlans,
key=lambda v: (
derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) is None,
derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) or 0,
)
)
idx = next((i for i, v in enumerate(wg_sorted) if v is vlan), 0) idx = next((i for i, v in enumerate(wg_sorted) if v is vlan), 0)
return f'wg{idx}' return f'wg{idx}'
vid = derive_vlan_id(vlan.get('subnet', ''), vlan.get('subnet_mask', 24)) vid = vlan.get('vlan_id')
return lan if vid == 1 else f'{lan}.{vid}' return lan if vid == 1 else f'{lan}.{vid}'
@ -314,12 +308,9 @@ def validate_config(data):
# Pre-compute per-VLAN vlan_ids and interface names without mutating data # Pre-compute per-VLAN vlan_ids and interface names without mutating data
_lan = data.get("network_interfaces", {}).get("lan_interface", "eth0") _lan = data.get("network_interfaces", {}).get("lan_interface", "eth0")
_all_vlans = data.get("vlans", []) _all_vlans = data.get("vlans", [])
_derived_ids = [ _stored_ids = [_v.get("vlan_id") for _v in _all_vlans]
derive_vlan_id(_v.get("subnet", ""), _v.get("subnet_mask", 24))
for _v in _all_vlans
]
_wg_sorted = sorted( _wg_sorted = sorted(
[(i, _derived_ids[i]) for i, _v in enumerate(_all_vlans) if is_wg(_v)], [(i, _stored_ids[i]) for i, _v in enumerate(_all_vlans) if is_wg(_v)],
key=lambda x: (x[1] is None, x[1] or 0) key=lambda x: (x[1] is None, x[1] or 0)
) )
_wg_order = {orig_i: wg_idx for wg_idx, (orig_i, _) in enumerate(_wg_sorted)} _wg_order = {orig_i: wg_idx for wg_idx, (orig_i, _) in enumerate(_wg_sorted)}
@ -328,7 +319,7 @@ def validate_config(data):
if is_wg(_vlan): if is_wg(_vlan):
vlan_ifaces.append(f"wg{_wg_order[i]}") vlan_ifaces.append(f"wg{_wg_order[i]}")
else: else:
_vid = _derived_ids[i] _vid = _stored_ids[i]
vlan_ifaces.append(_lan if _vid == 1 else f"{_lan}.{_vid}") vlan_ifaces.append(_lan if _vid == 1 else f"{_lan}.{_vid}")
# upstream_dns block ============================================ # upstream_dns block ============================================
@ -377,10 +368,13 @@ def validate_config(data):
vlan_networks = {} # iface -> IPv4Network (used for NAT section) vlan_networks = {} # iface -> IPv4Network (used for NAT section)
for i, (vlan, iface) in enumerate(zip(_all_vlans, vlan_ifaces)): for i, (vlan, iface) in enumerate(zip(_all_vlans, vlan_ifaces)):
vlan_id = _derived_ids[i] vlan_id = _stored_ids[i]
name = vlan.get("name", "?") name = vlan.get("name", "?")
label = f"vlan '{name}' (id={vlan_id})" label = f"vlan '{name}' (id={vlan_id})"
if vlan_id is None or not isinstance(vlan_id, int) or not (1 <= vlan_id <= 4094):
errors.append(f"vlan '{name}': vlan_id must be an integer 1–4094 (got {vlan_id!r}).")
if name in seen_names: if name in seen_names:
errors.append(f"{label}: duplicate vlan name '{name}' " errors.append(f"{label}: duplicate vlan name '{name}' "
f"(also used by id={seen_names[name]}).") f"(also used by id={seen_names[name]}).")