Subversion Repositories web_pages

#! /usr/bin/env perl

#    Copyright (c) 2025, Daily Data, Inc.

#

#    Redistribution and use in source and binary forms, with or without modification, 

#    are permitted provided that the following conditions are met:

#

#        Redistributions of source code must retain the above copyright notice, this

#          list of conditions and the following disclaimer.

#        Redistributions in binary form must reproduce the above copyright notice, 

#          this list of conditions and the following disclaimer in the documentation 

#           and/or other materials provided with the distribution.

#

#    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 

#    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 

#    WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

#    IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,

#    INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

#    NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,

#    OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,

#    WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

#    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

#    OF SUCH DAMAGE.

# script will read configuration file exported from opnSense 

# (System | Configuration | Backups | Download Configuration)

# and parse the users configuration. It will generate a png image of the QR code for the otp key,

# saving it on disk as routername_username.png, and store store the 

# routername/username/password/otp code and qr file name to a tab separated file named users.csv 

# ($csvFile hard coded below)

# if processing a router which already exists, will clean up first by removing all existing entries

# and qr files for that router.

#

# requires modules XML::Simple GD::Barcode::QRcode, which can be installed in Debian derivatives

# with 

# apt install libxml-simple-perl libgd-barcode-perl

# or via cpan with

# cpan XML::Simple GD::Barcode::QRcode

#

# Tested with

#    OPNSense 25.1.12

#    Microsoft Authenticator 6.2509.5952

#    FreeOTP v2.0.5

#

# Version 1.0.0  RWR 2025-09-21

#    initial release

use strict;

use warnings;

use XML::Simple;

use GD::Barcode::QRcode;

our $VERSION = '1.0.0';

my $csvFile = 'users.csv';

# Constants for creation of QR image

# this is used in URL created

my $issuer = "OPNsense";

# The size of individual "pixels" in graphics

my $moduleSize = 10;

#

# makeQR

#

# Creates a QR file with a name of ($routername_)$account.png

# where $routername is prepended if it is set and $account is the user name

# an underscore separates the routername and the account (if routername is set)

# the contents of the qr are made up of the constants 'otpauth://totp/' followed by $issuer

# and the parameters secret (otp code) and issuer again.

sub makeQR {

   my ( $routerName, $account, $secret, $issuer, $moduleSize ) = @_;

   my $otp_url = "otpauth://totp/$issuer:$account?secret=$secret&issuer=$issuer";

   # Ecc (Error Correction Code) can be one of Low, Medium, Quartile, and High

   # ModuleSize increases the actual size of each "pixel", enlarging for easier reading

   my $barcode = GD::Barcode::QRcode->new($otp_url, { Ecc => 'M', ModuleSize => $moduleSize } );

   my $image = $barcode->plot();

   # Save the image to a file. If there is a router name, prepend it to the filename with an underscore

   # allows the same user to be on two different routers

   my $outputFile = ($routerName ? $routerName . '_' : '' ) . $account . '.png';

   open my $out, '>', "$outputFile" or die "Cannot write file $outputFile: $!";

   binmode $out;

   print $out $image->png;

   close $out;

   return $outputFile;

}

# loads the CSV file into an array, removing any entry for $routerName and 

# removing all associated image files

sub loadCSV {

   my ( $filename, $routerName) = @_;

   my @data;

   if ( -e $filename ) { # if the file exists

      open DATA, "<$filename" or die "Could not read $filename: $!\n";

      my $line = <DATA>; # first line is the header

      chomp $line;

      push @data, $line; # preserve header

      while ( $line = <DATA> ) {

         chomp $line;

         # break apart so we can process fast

         my ($router, $name, $otp, $password, $filename ) = split( "\t", $line );

         # if this is the router we are working on, remove the filename associated

         if ( $router eq $routerName ) {

            if ( -e $filename ) {

               unlink( $filename );

            } else {

               warn "Can not unlink $filename, not found\n";

            }

         } else { # nope, not the current router, so just preserve the line

            push @data, $line;

         }

      }

   } else { # file doesn't exist, so just create empty list with header

      warn "$filename does not exist, creating\n";

      push @data, "router\tname\totp\tpassword\tfilename";

   }

   return \@data;

}

# Load the XML file into 

my $xmlFileName = shift;

my $routerName = shift;

die "Usage: $0 configfilename [routername]\n" unless $xmlFileName && $routerName;

#warn "Not using separate router names\n" unless $routerName;

my $xml = XML::Simple->new();

# Parse the XML file into a hash

my $data = $xml->XMLin($xmlFileName, ForceArray => 0, KeyAttr => []);

# we only want the user data, which is an array ref under system->user

my $users = $data->{'system'}->{'user'};

# if there is a router name, prepend to the csv file name

# $csvFile = $routerName . '_' . $csvFile if $routerName;

my $output = &loadCSV( $csvFile, $routerName );

# process each element in the array. Each array element is a hashref containing the information we need

foreach my $user ( @$users ) {

   if ( ref( $user->{'otp_seed'} ) ) { # otp_seed is a ref to an empty hash if no key has been defined

      # that is not an error, as some accounts do not have access

      warn "$user->{name} has no otp seed\n";

   } else { # this is a user with an otp seed

      # create the QR File and get the name of it into $filename

      my $filename = makeQR( $routerName, $user->{'name'}, $user->{'otp_seed'}, $issuer, $moduleSize );

      # add a row to the CSV

      push @$output,  join( "\t", ( $routerName, $user->{'name'}, $user->{'otp_seed'}, $user->{'password'}, $filename ) );

   }

}

# store data in a tab separated value file

open USERS,">$csvFile" or die "Could not create $csvFile: $!\n";

# put in a header so we can find things easily

print USERS join( "\n", @$output );

close USERS;

#use Data::Dumper;

# print Dumper( $users );