279 lines
10 KiB
Python
279 lines
10 KiB
Python
import copy
|
|
|
|
from flask import Blueprint, request, redirect, flash
|
|
from auth import require_level
|
|
from config_utils import load_config, save_config_with_snapshot, verify_config_hash
|
|
import sanitize
|
|
import validation as validate
|
|
|
|
bp = Blueprint('action_networklayout', __name__)
|
|
|
|
VIEW = '/view/view_network_layout'
|
|
|
|
_VLAN_FIELDS = ['name', 'is_vpn', 'subnet', 'subnet_mask', 'dnsmasq_log_queries',
|
|
'radius_default', 'mdns_reflection', 'use_blocklists']
|
|
|
|
|
|
def _row_index():
|
|
try:
|
|
return int(request.form.get('row_index', ''))
|
|
except (ValueError, TypeError):
|
|
return None
|
|
|
|
|
|
def _hash_ok():
|
|
if not verify_config_hash(request.form.get('config_hash', '')):
|
|
flash('Configuration was modified by another session. Please refresh and try again.', 'error')
|
|
return False
|
|
return True
|
|
|
|
|
|
@bp.route('/action/networklayout_cardaddvlan_addvlan', methods=['POST'])
|
|
@require_level('administrator')
|
|
def networklayout_cardaddvlan_addvlan():
|
|
name = sanitize.name(request.form.get('name', ''))
|
|
is_vpn = 'is_vpn' in request.form
|
|
subnet = sanitize.ip(request.form.get('subnet', ''))
|
|
subnet_mask = sanitize.subnet_mask(request.form.get('subnet_mask', ''))
|
|
radius_default = 'radius_default' in request.form
|
|
mdns_reflection = 'mdns_reflection' in request.form
|
|
dnsmasq_log_queries = 'dnsmasq_log_queries' in request.form
|
|
use_blocklists = sanitize.filterlist(
|
|
request.form.getlist('use_blocklists'),
|
|
{b.get('name') for b in load_config().get('dns_blocking', {}).get('blocklists', [])},
|
|
)
|
|
|
|
if not name:
|
|
flash('Name is required.', 'error')
|
|
return redirect(VIEW)
|
|
if not subnet:
|
|
flash('Subnet IP is required.', 'error')
|
|
return redirect(VIEW)
|
|
if subnet_mask is None:
|
|
flash('Invalid subnet prefix (must be 1-30).', 'error')
|
|
return redirect(VIEW)
|
|
|
|
vlan_id = validate.derive_vlan_id(subnet, subnet_mask)
|
|
if vlan_id is None:
|
|
flash('Cannot derive a valid VLAN ID (1-4094) from this subnet/prefix combination.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
if not _hash_ok():
|
|
return redirect(VIEW)
|
|
|
|
cfg = load_config()
|
|
vlans = cfg.setdefault('vlans', [])
|
|
|
|
if any(validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) == vlan_id for v in vlans):
|
|
flash(f'VLAN {vlan_id} (derived from subnet) already exists.', 'error')
|
|
return redirect(VIEW)
|
|
if radius_default and any(v.get('radius_default') for v in vlans):
|
|
flash('Only one VLAN can be the RADIUS default.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
entry = {
|
|
'name': name,
|
|
'is_vpn': is_vpn,
|
|
'subnet': subnet,
|
|
'subnet_mask': subnet_mask,
|
|
'dnsmasq_log_queries': dnsmasq_log_queries,
|
|
'use_blocklists': use_blocklists,
|
|
'radius_default': radius_default,
|
|
'mdns_reflection': mdns_reflection,
|
|
}
|
|
if is_vpn:
|
|
entry['peers'] = []
|
|
else:
|
|
entry['reservations'] = []
|
|
vlans.append(entry)
|
|
errors = validate.validate_config(cfg)
|
|
if errors:
|
|
for msg in errors:
|
|
flash(msg, 'error')
|
|
return redirect(VIEW)
|
|
|
|
flash(save_config_with_snapshot(
|
|
cfg,
|
|
path='vlans', key=name, operation='add',
|
|
before=None, after={k: entry[k] for k in _VLAN_FIELDS if k in entry},
|
|
description=f'Added VLAN: {name} ({subnet}/{subnet_mask})',
|
|
), 'success')
|
|
return redirect(VIEW)
|
|
|
|
|
|
@bp.route('/action/networklayout_tablevlans_edit', methods=['POST'])
|
|
@require_level('administrator')
|
|
def networklayout_tablevlans_edit():
|
|
idx = _row_index()
|
|
if idx is None:
|
|
flash('Invalid request.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
name = sanitize.name(request.form.get('name', ''))
|
|
subnet = sanitize.ip(request.form.get('subnet', ''))
|
|
radius_default = 'radius_default' in request.form
|
|
mdns_reflection = 'mdns_reflection' in request.form
|
|
dnsmasq_log_queries = 'dnsmasq_log_queries' in request.form
|
|
use_blocklists = sanitize.filterlist(
|
|
request.form.getlist('use_blocklists'),
|
|
{b.get('name') for b in load_config().get('dns_blocking', {}).get('blocklists', [])},
|
|
)
|
|
identity_ips_raw = [line.strip() for line in request.form.get('server_identity_ips', '').splitlines() if line.strip()]
|
|
identity_ips = []
|
|
for raw_ip in identity_ips_raw:
|
|
clean = sanitize.ip(raw_ip)
|
|
if not clean:
|
|
flash(f"'{raw_ip}' is not a valid IP address.", 'error')
|
|
return redirect(VIEW)
|
|
identity_ips.append(clean)
|
|
identity_descs = request.form.get('server_identity_descriptions', '').splitlines()
|
|
identity_hostnames = request.form.get('server_identity_hostnames', '').splitlines()
|
|
|
|
subnet_mask_raw = request.form.get('subnet_mask')
|
|
if subnet_mask_raw is not None:
|
|
subnet_mask = sanitize.subnet_mask(subnet_mask_raw)
|
|
if subnet_mask is None:
|
|
flash('Invalid subnet prefix (must be 1-30).', 'error')
|
|
return redirect(VIEW)
|
|
else:
|
|
subnet_mask = None
|
|
|
|
if not name:
|
|
flash('Name is required.', 'error')
|
|
return redirect(VIEW)
|
|
if not subnet:
|
|
flash('Subnet IP is required.', 'error')
|
|
return redirect(VIEW)
|
|
if not _hash_ok():
|
|
return redirect(VIEW)
|
|
|
|
cfg = load_config()
|
|
vlans = cfg.get('vlans', [])
|
|
if idx < 0 or idx >= len(vlans):
|
|
flash('VLAN not found.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
existing = vlans[idx]
|
|
is_vpn = existing.get('is_vpn', False)
|
|
final_mask = subnet_mask if subnet_mask is not None else existing.get('subnet_mask', 24)
|
|
|
|
vlan_id = validate.derive_vlan_id(subnet, final_mask)
|
|
if vlan_id is None:
|
|
flash('Cannot derive a valid VLAN ID (1-4094) from this subnet/prefix combination.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
current_id = validate.derive_vlan_id(existing.get('subnet', ''), existing.get('subnet_mask', 24))
|
|
if current_id == 1 and vlan_id != 1:
|
|
flash('VLAN 1 is the physical interface; change its subnet so the derived ID remains 1.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
if vlan_id != current_id and any(
|
|
validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) == vlan_id
|
|
for i, v in enumerate(vlans) if i != idx
|
|
):
|
|
flash(f'VLAN {vlan_id} (derived from subnet) already exists.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
if radius_default and any(i != idx and v.get('radius_default') for i, v in enumerate(vlans)):
|
|
flash('Only one VLAN can be the RADIUS default.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
old_identities = existing.get('server_identities', [])
|
|
new_identities = []
|
|
for i, ip in enumerate(identity_ips):
|
|
entry = dict(old_identities[i]) if i < len(old_identities) else {}
|
|
entry['ip'] = ip
|
|
desc = identity_descs[i].strip() if i < len(identity_descs) else ''
|
|
if desc:
|
|
entry['description'] = desc
|
|
else:
|
|
entry.pop('description', None)
|
|
hostname_raw = identity_hostnames[i].strip() if i < len(identity_hostnames) else ''
|
|
if hostname_raw:
|
|
clean_hostname = sanitize.hostname(hostname_raw)
|
|
if clean_hostname is None:
|
|
flash(f"'{hostname_raw}' is not a valid hostname.", 'error')
|
|
return redirect(VIEW)
|
|
entry['hostname'] = clean_hostname
|
|
else:
|
|
entry.pop('hostname', None)
|
|
new_identities.append(entry)
|
|
|
|
_ids_unchanged = (
|
|
len(new_identities) == len(old_identities) and
|
|
all(
|
|
n.get('ip') == o.get('ip') and
|
|
n.get('description', '') == o.get('description', '') and
|
|
n.get('hostname', '') == o.get('hostname', '')
|
|
for n, o in zip(new_identities, old_identities)
|
|
)
|
|
)
|
|
if (name == existing.get('name', '')
|
|
and subnet == existing.get('subnet', '')
|
|
and final_mask == existing.get('subnet_mask', 24)
|
|
and dnsmasq_log_queries == bool(existing.get('dnsmasq_log_queries', False))
|
|
and radius_default == bool(existing.get('radius_default', False))
|
|
and mdns_reflection == bool(existing.get('mdns_reflection', False))
|
|
and sorted(use_blocklists) == sorted(existing.get('use_blocklists', []))
|
|
and _ids_unchanged):
|
|
flash('No changes were made.', 'info')
|
|
return redirect(VIEW)
|
|
|
|
before = {k: existing.get(k) for k in _VLAN_FIELDS}
|
|
existing.update({
|
|
'name': name,
|
|
'is_vpn': is_vpn,
|
|
'subnet': subnet,
|
|
'subnet_mask': final_mask,
|
|
'dnsmasq_log_queries': dnsmasq_log_queries,
|
|
'radius_default': radius_default,
|
|
'mdns_reflection': mdns_reflection,
|
|
'use_blocklists': use_blocklists,
|
|
'server_identities': new_identities,
|
|
})
|
|
errors = validate.validate_config(cfg)
|
|
if errors:
|
|
for msg in errors:
|
|
flash(msg, 'error')
|
|
return redirect(VIEW)
|
|
|
|
flash(save_config_with_snapshot(
|
|
cfg,
|
|
path='vlans', key=name, operation='edit',
|
|
before=before, after={k: existing.get(k) for k in _VLAN_FIELDS},
|
|
description=f'Edited VLAN: {name}',
|
|
), 'success')
|
|
return redirect(VIEW)
|
|
|
|
|
|
@bp.route('/action/networklayout_tablevlans_delete', methods=['POST'])
|
|
@require_level('administrator')
|
|
def networklayout_tablevlans_delete():
|
|
idx = _row_index()
|
|
if idx is None:
|
|
flash('Invalid request.', 'error')
|
|
return redirect(VIEW)
|
|
if not _hash_ok():
|
|
return redirect(VIEW)
|
|
|
|
cfg = load_config()
|
|
vlans = cfg.get('vlans', [])
|
|
if idx < 0 or idx >= len(vlans):
|
|
flash('VLAN not found.', 'error')
|
|
return redirect(VIEW)
|
|
|
|
removed = vlans.pop(idx)
|
|
errors = validate.validate_config(cfg)
|
|
if errors:
|
|
for msg in errors:
|
|
flash(msg, 'error')
|
|
return redirect(VIEW)
|
|
|
|
flash(save_config_with_snapshot(
|
|
cfg,
|
|
path='vlans', key=removed['name'], operation='delete',
|
|
before={k: removed.get(k) for k in _VLAN_FIELDS},
|
|
after=None,
|
|
description=f'Deleted VLAN: {removed["name"]}',
|
|
), 'success')
|
|
return redirect(VIEW)
|