Subversion Repositories web_pages

# Copyright (c) 2025, Daily Data, Inc.

# All rights reserved.

#

# Redistribution and use in source and binary forms, with or without modification,

# are permitted provided that the following conditions are met:

# 1. Redistributions of source code must retain the above copyright notice, this list

#    of conditions and the following disclaimer.

# 2. Redistributions in binary form must reproduce the above copyright notice, this

#    list of conditions and the following disclaimer in the documentation and/or other

#    materials provided with the distribution.

# 3. Neither the name of Daily Data, Inc. nor the names of its contributors may be

#    used to endorse or promote products derived from this software without specific

#    prior written permission.

#

# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY

# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT

# SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,

# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED

# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN

# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH

# DAMAGE.

#

# Script which will read information from an OPNsense router via its API

# and create/update user OTP secrets, QR codes, and OpenVPN configuration files

# for each user with a VPN certificate.

# Change History:

#  v1.0 2025-10-01 - Initial version RWR

#     Initial Release

#  v1.0.1 2025-10-01 RWR

#     Added a lock file to not allow the script to run if it is already running. If we can not

#       get an exclusive lock on $lockFile in $lockRetryTime*$lockRetries seconds, script will abort

#     Added both the full path to the data directories as well as the relative, to help

#       the web site (relative) and the script (full path, even if we're running from a different)

#       location to work easily (less code)

# use libraries from the directory this script is in

BEGIN {

   use FindBin;

   use File::Spec;

   use Cwd 'abs_path';

   use File::Basename;

   use lib dirname( abs_path( __FILE__ ) );

}

#-----------------------------

# Configuration Variables

#-----------------------------

# Location of the configuration files and directories where we will store data

# relative to the script directory as written

my $scriptDir = $FindBin::RealBin;

my $configFile = $scriptDir . '/routers.json';

my $usersFile = $scriptDir . '/users.json';

my $qrLocation =  './qrcodes';

my $ovpnFileLocation =  './openvpn_configs';

# size of the QR code modules, basically a magnification factor

my $moduleSize = 10;

my $additionalOvpnStrings = "static-challenge 'Enter Auth Code' 0\nauth-nocache\n";

# using a lock file to ensure script does not run while another request has it running

my $lockFile = '/tmp/opnsense.lock';

my $lockRetryTime = 10; # number of seconds between subsequent tries for a lock

my $lockRetries = 6; # number of times we will attempt to get a lock before failing

#-----------------------------

# slurpFile: Reads in the entire contents of a file and returns it as a string

# $file - name of file to read

# returns the contents of the file as a string, or empty string if file does not exist

# since we do this a lot, make it a separate function. This is likely the most efficient way

# to read a file in Perl

#-----------------------------

#-----------------------------

# loadConfig: Load router configuration from config file

# $file - name of file to read

# $entry - name of the router entry to load

# returns a reference to the data structure for the router, or empty hash if not found

#-----------------------------

sub loadConfig {

   my ($file, $entry) = @_;

   my $return = &slurpFile($file);

   return {} unless $return && $return ne '';

   my $data = decode_json($return);

   return $data->{$entry} if (exists $data->{$entry});

   return {};

}

#-----------------------------

# loadUsers: Load users data structure from file

# $file - name of file to read

# returns a reference to the data structure

# $file assumed to be in JSON format

#-----------------------------

sub loadUsers {

   my ($file) = @_;

   my $data = &slurpFile($file);

   return {} unless $data && $data ne '';

   my $return = decode_json($data);

   return {} unless $return && ref($return) eq 'HASH';

   return $return;

}

#-----------------------------

# $file - name of file to write

# $data - reference to the data to write

# $timeStampFile - optional name of a file to write the current timestamp to

# writes the data in JSON format

#-----------------------------

#-----------------------------

# $secret - OTP secret

# $moduleSize - size of the QR code modules

#-----------------------------

   # Creates a QR code image for the user's OTP secret

# $contents - reference to the hash containing the 'content' key with base64 encoded ovpn file

# $userName - name of the user (used in filename)

# $ovpnLocation - The relative path to the output directory

# $absDir - The absolute path to the output directory

# $additionalOvpnStrings - additional strings to add to the ovpn file if not already present

# returns the filename of the created ovpn file

#-----------------------------

   # This allows us to retain the relative file path for storage, but ensuring we write the file to 

   # the correct path even if we are not running the script from the script directory.

}

# cleanOldDataFiles: Deletes old data files in the specified directory matching the given pattern

# $directory - directory to scan for old files

# $pattern - regex pattern to match files to delete

# simply removes all files matching the pattern

#-----------------------------

sub cleanOldDataFiles {

   my ( $directory, $pattern ) = @_;

   opendir(my $dh, $directory) or die "Cannot open directory $directory: $!";

   while (my $file = readdir($dh)) {

      next if ($file =~ /^\./);

      if ($file =~ /$pattern/) {

         unlink "$directory/$file" or warn "Could not delete $directory/$file: $!";

      }

   }

   closedir($dh);

#-----------------------------

#-----------------------------

# make sure script does not run more than once at the same time

# Open the lock file

open(my $fh, '>', $lockFile) or die "Cannot open lock file $lockFile: $!";

# Attempt to acquire an exclusive lock. We will try $lockTimeOut times, each

# waiting $lockRetryTime

while ( $lockRetries-- ) {

   if (flock($fh, LOCK_EX | LOCK_NB)) {

      last;

   } else {

      sleep($lockRetryTime);

   }

}

# if $lockTimeOut is zero, we could not get a lock in, so die

die "Another instance of the script is already running and retries exceeded!\n" unless ( $lockRetries );

# and get the location on the file system in case we are not running the script from the script directory

$users->{$router}->{'qrLocationFileystem'} = abs_path( $scriptDir . '/' . $qrLocation )

   unless exists $users->{$router}->{'qrLocationFileystem'};

$users->{$router}->{'ovpnLocationFileSystem'} = abs_path( $scriptDir . '/' . $ovpnFileLocation )

   unless exists $users->{$router}->{'ovpnLocationFileSystem'};

# instead of actually going through and cleaning files no longer in the users list,

# just delete all files for this router and recreate them

&cleanOldDataFiles( $users->{$router}->{'qrLocationFileystem'}, qr/^\Q$router\E_.*\.png$/ );

&cleanOldDataFiles( $users->{$router}->{'ovpnLocationFileSystem'}, qr/^\Q$router\E_.*\.ovpn$/ );

   # Create the QR code file and store the filename in the data structure

   # If there is no secret, do not create a QR code

      $secret && $secret ne '' ?

      &makeQR(

            $router,

            $account,

            $secret,

            $moduleSize,

            $users->{$router}->{'qrLocationFileystem'}

            ) :

      '';

   # Create the VPN configuration file, if it exists. If multiple certs, only create the first one

   # warn user if there are multiple certs

      &makeVPNConfigFile( 

         $cert,

         $router,

         $entry,

         $users->{$router}->{'ovpnLocation'},

         $additionalOvpnStrings );

# update the timestamp for the current router

$users->{$router}->{'lastUpdate'} = time;

# Remove the lock file so the script can run again

close($fh);

unlink($lockFile) or warn "Could not unlink lock file: $!";

1;