Subversion Repositories web_pages

#! /usr/bin/env perl

use strict;

use warnings;

use lib '.'; # our libraries are in the current directory

use JSON; # for encode_json, decode_json

use Data::Dumper; # for debugging

use opnsense; # our module to handle opnsense API calls

use GD::Barcode::QRcode; # for creating the QR code images

use MIME::Base64 qw( decode_base64 ); # for decoding the ovpn file returned from the API

use File::Path qw( make_path ); # for creating directories

# Configuration file path

my $config_file = 'config.json';

# Users file path. This is shared between loadOpnSense.pl and index.php

my $users_file = 'users.json';

# Constants for creation of QR image

# this is used in URL created

my $issuer = "OPNsense";

# The size of individual "pixels" in graphics

my $moduleSize = 10;

# location to place the QR images

my $qrLocation = './qrcodes'; # cwd/qrcodes

# location to place the ovpn files

my $ovpnFileLocation = './openvpn_configs'; # cwd/openvpn

# following strings will be added to ovpn files if they don't exist

my $additionalOvpnStrings = "static-challenge 'Enter Auth Code' 0\nauth-nocache\n";

# load the configuration for the specified router from the config file

# returns a hash ref of the configuration for the specified entry (router name)

# if file does not exist or entry not found, returns empty hash ref

# file - name of file to read (default config.json if not specified)

# entry - name of the router to load configuration for

sub loadConfig {

    my ($file, $entry) = @_;

    if ( -e $file ) {

        open my $fh, '<', $file or die "Could not open '$file' $!";

        local $/;

        my $json_text = <$fh>;

        close $fh;

         my $config = decode_json($json_text);

         return $config->{$entry} if (exists $config->{$entry});

    }

    return {};

}

# load the users data structure from the specified file

sub loadUsers {

   my ( $file ) = @_;

   my $data = {};

   if ( -e $file ) {

      open( my $fh, '<', $file ) or die "Cannot open $file: $!";

      local $/;  # slurp mode

      my $json_text = <$fh>;

      close $fh;

      $data = decode_json($json_text);

   }

   return $data;

}

# save the users data structure to the specified file

sub saveUsers {

   my ( $file, $data ) = @_;

   open( my $fh, '>', $file ) or die "Cannot open $file: $!";

   print $fh encode_json($data);

   close $fh;

}

#

# makeQR

#

# Creates a QR file with a name of ($routername_)$account.png

# where $routername is prepended if it is set and $account is the user name

# an underscore separates the routername and the account (if routername is set)

# the contents of the qr are made up of the constants 'otpauth://totp/' followed by $issuer

# and the parameters secret (otp code) and issuer again.

sub makeQR {

   my ( $routerName, $account, $secret, $issuer, $moduleSize, $qrLocation ) = @_;

   my $otp_url = "otpauth://totp/$issuer:$account?secret=$secret&issuer=$issuer";

   # Ecc (Error Correction Code) can be one of Low, Medium, Quartile, and High

   # ModuleSize increases the actual size of each "pixel", enlarging for easier reading

   my $barcode = GD::Barcode::QRcode->new($otp_url, { Ecc => 'M', ModuleSize => $moduleSize } );

   my $image = $barcode->plot();

   # Save the image to a file. If there is a router name, prepend it to the filename with an underscore

   # allows the same user to be on two different routers

   my $outputFile = $qrLocation . '/' . ($routerName ? $routerName . '_' : '' ) . $account . '.png';

   open my $out, '>', "$outputFile" or die "Cannot write file $outputFile: $!";

   binmode $out;

   print $out $image->png;

   close $out;

   return $outputFile;

}

#

# makeVPNConfigFile

#

# Creates a configuration file for the user based on the template provided

# The template is read in and the following substitutions are made:

sub makeVPNConfigFile {

   my ( $contents, $routername, $username, $ovpnLocation, $additionalOvpnStrings ) = @_;

   # if contents is empty or does not have a content key, return empty string

   return '' unless $contents && $contents->{'content'};

   my $outputFileName = $ovpnLocation . '/' . ($routername ? $routername . '_' : '' ) . $username . '.ovpn';

   $contents->{'content'} = decode_base64($contents->{'content'});

   $contents->{'content'} .= "\n";

   $contents->{'content'} =~ s/(\r?\n)+/\n/g; # normalize line endings

   # add any additional strings if they are not already present

   my $comment = '';

   if ( $contents->{'content'} !~ /# Added by loadOpnSense.pl/ ) {

      $comment = "# Added by loadOpnSense.pl\n";

   }

   foreach my $string ( split( /\n/, $additionalOvpnStrings ) ) {

      unless ( $contents->{'content'} =~ /\$string/ ) {

         $contents->{'content'} .= "$comment$string\n";

         $comment = ''; # only add comment once

      }

   }

   open my $out, '>', "$outputFileName" or die "Cannot write file $outputFileName: $!";

   print $out $contents->{'content'};

   close $out;

   return $outputFileName;

}

### Main program

# get the router name from the command line

my $router = shift @ARGV or die "Usage: $0 <router_name>\n";

# Load existing configuration or initialize a new one

my $config = &loadConfig($config_file, $router );

die "Configuration for router $router not found in $config_file\n" unless $config && ref($config) eq 'HASH';

# load the users file. We will update the entry for this router

my $users = &loadUsers( $users_file );

# if there is no entry for this router, create an empty one

$users->{$router} = {} unless exists $users->{$router};

$users->{$router}->{'qrLocation'} = $qrLocation unless exists $users->{$router}->{'qrLocation'};

$users->{$router}->{'ovpnLocation'} = $ovpnFileLocation unless exists $users->{$router}->{'ovpnLocation'};

$users->{$router}->{'users'} = {}; # clean out the users list, we will reload it

# ensure the directories exist and give them full access

make_path( $users->{$router}->{'qrLocation'}, 0777 ) unless -d $users->{$router}->{'qrLocation'};

make_path( $users->{$router}->{'ovpnLocation'}, 0777 ) unless -d $users->{$router}->{'ovpnLocation'};

# this does most of the work, all the API calls are handled in the module

# create the opnsense object

my $opnsense = new opnsense(

   url    => $config->{'url'},

   apiKey    => $config->{'apiKey'},

   apiSecret => $config->{'apiSecret'},

   ovpnIndex  => $config->{'ovpnIndex'},

   localport => $config->{'localport'},

   template  => $config->{'template'},

   hostname  => $config->{'hostname'}, 

);

# get the VPN users. This is a hashref keyed by cert name, value is username

my $vpnCerts = $opnsense->get_vpn_users();

# convert the cert-"user" to username->certs, array ref of certs as not sure if multiple certs per user allowed

foreach my $cert ( keys %$vpnCerts ) {

   push @{$users->{$router}->{'users'}->{$vpnCerts->{$cert}}->{'certs'}}, $cert;

}

# these are all of the users on the system

my $allUsers = $opnsense->get_all_users();

# for each user in the system, if they are in the vpnUsers list, copy otp_seed, cert, and password

# we'll also delete any users who are disabled

my @keys = ('otp_seed', 'cert', 'password' ); # these are the keys we want to copy

foreach my $user ( keys %$allUsers ) {

   next unless exists $users->{$router}->{'users'}->{$user}; # skip users who do not have vpn certs

   if ( $allUsers->{$user}->{'disabled'} ) { # skip users who are disabled

      delete $users->{$router}->{'users'}->{$user};

      next;

   }

   foreach my $key ( @keys ) {

      $users->{$router}->{'users'}->{$user}->{$key} = ref($allUsers->{$user}->{$key}) ? '' : $allUsers->{$user}->{$key};

   }

}

# create the QR code file and VPN configuration for each user

foreach my $entry ( keys %{$users->{$router}->{'users'}} ) {

   my $account = $entry;

   my $secret = $users->{$router}->{'users'}->{$entry}->{'otp_seed'};

   $users->{$router}->{'users'}->{$entry}->{'qrFile'} = 

      &makeQR($router, $account, $secret, $issuer, $moduleSize, $users->{$router}->{'qrLocation'});

   if ( scalar(@{$users->{$router}->{'users'}->{$entry}->{'certs'}}) > 1 ) {

      warn "$entry has multiple certs, using first one only\n";

   }

   my $cert = $opnsense->get_vpn_config( $users->{$router}->{'users'}->{$entry}->{'certs'}->[0] );

   if ( !$cert || ref($cert) ne 'HASH' || !exists $cert->{'content'} ) {

      warn "Could not get VPN configuration for $entry, cert $users->{$router}->{'users'}->{$entry}->{'certs'}->[0]\n";

      next;

   }

   $users->{$router}->{'users'}->{$entry}->{'ovpnFile'} = 

      &makeVPNConfigFile( $cert, $router, $entry, $users->{$router}->{'ovpnLocation'}, $additionalOvpnStrings );

}

# save the users file

&saveUsers( $users_file, $users );