slawek/linux-cloud-router
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feature: users have a first name, a last name and an e-mail address.
Release / release (push) Successful in 11s
Details

Browse Source
This commit is contained in:
slawek committed 2026-10-24 01:47:50 +02:00
1 parent b9003bacb9
commit 08693f7e68
9 files changed
+872 -290
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

debian-package/src/usr/lib/vpn-router/web
+81 -51
View File
@@ -1,8 +1,8 @@
#!/usr/bin/python3
"""Serve the status of the router on its internal address.
Run by vpn-router-web.service. It needs nothing but the Python standard library; users are
managed by running vpn-router-user.
Run by vpn-router-web.service. Users are managed with vpnrouter_users, the module that
vpn-router-user uses too.
Pages:
/ the status for people: plain text for curl and wget, a styled page
@@ -10,10 +10,13 @@ Pages:
/status the status as JSON
/config the configuration without its secrets, and what the router resolved and
runs, as JSON
/users the users in the router's directory, whether or not a P2S system is enabled: list, add, set the password, disable, enable,
remove, and the OpenVPN client profile (see users())
/users the users in the router's directory, whether or not a P2S system is enabled: list,
add, change, set the password, disable, enable, remove, and the OpenVPN client
profile (see users())
/groups the groups of the router's directory: list, add, rename or describe, remove, and
add and take out members (see groups())
/config and /users need an HS256 JWT in an Authorization: Bearer header that is signed
/config, /users and /groups need an HS256 JWT in an Authorization: Bearer header that is signed
with web.jwt_secret and expires within ten minutes; they are not served (404) while
web.jwt_secret is not set.
@@ -46,7 +49,10 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
import ldap
import vpnrouter_net
import vpnrouter_users
STATE_FILE = '/run/vpn-router/web.json'
CONFIG_FILE = '/etc/vpn-router/vpn-router.json'
@@ -70,17 +76,13 @@ TAILWIND = 'https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4'
#: Seconds after which the status page in a browser reloads itself.
REFRESH_SECONDS = 60
USER_TOOL = '/usr/sbin/vpn-router-user'
OPENVPN_STATUS = '/run/openvpn-server/status-vpn-router.log'
#: Seconds a user command may take; adding a user creates an RSA key.
USER_TIMEOUT = 120
#: The largest request body accepted, in bytes.
BODY_LIMIT = 4096
#: The HTTP status for each exit status of vpn-router-user; any other is 500.
USER_STATUS = {0: 200, 2: 400, 3: 404, 4: 409}
#: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
USER_STATUS = {2: 400, 3: 404, 4: 409}
_cache = {'at': 0.0, 'data': None}
_lock = threading.Lock()
@@ -409,24 +411,12 @@ def html_of(status):
"""
def user_tool(*args, password=None):
"""Run vpn-router-user; the HTTP status for its exit status and its JSON answer."""
try:
result = subprocess.run([USER_TOOL, *args], input='' if password is None else password + '\n',
capture_output=True, text=True, timeout=USER_TIMEOUT)
document = json.loads(result.stdout)
except (OSError, subprocess.TimeoutExpired, ValueError) as exc:
return 500, {'error': f'vpn-router-user failed: {exc}'}
if not isinstance(document, dict):
return 500, {'error': 'vpn-router-user gave no object'}
return USER_STATUS.get(result.returncode, 500), document
def users(state, method, path, body):
"""Answer a /users request: the HTTP status and the JSON document.
"""Answer a /users request with vpnrouter_users: the HTTP status and the JSON document.
GET /users the users
POST /users add a user: {"name": ..., "password": ...}
POST /users add a user: {"name", "password", "first_name", "last_name", "email"}
PUT /users/<name> change any of {"first_name", "last_name", "email"}
PUT /users/<name>/password set the password: {"password": ...}
POST /users/<name>/disable lock the user out of OpenVPN
POST /users/<name>/enable let the user in again
@@ -436,31 +426,70 @@ def users(state, method, path, body):
if body == 'invalid' or (body is not None and not isinstance(body, dict)):
return 400, {'error': 'the body must be a JSON object'}
body = body or {}
password = body.get('password')
if password is not None and (not isinstance(password, str) or '\n' in password or '\r' in password):
return 400, {'error': 'the password must be a string of one line'}
parts = path.strip('/').split('/')
route = (method, len(parts), parts[2] if len(parts) == 3 else None)
if route == ('GET', 1, None):
return user_tool('list')
if route == ('POST', 1, None):
name = body.get('name')
if not isinstance(name, str) or password is None:
return 400, {'error': 'name and password are required strings'}
code, document = user_tool('add', name, password=password)
return (201 if code == 200 else code), document
if route == ('PUT', 3, 'password'):
if password is None:
return 400, {'error': 'password is a required string'}
return user_tool('passwd', parts[1], password=password)
if route in (('POST', 3, 'disable'), ('POST', 3, 'enable')):
return user_tool(parts[2], parts[1])
if route == ('DELETE', 2, None):
return user_tool('remove', parts[1])
if route == ('GET', 3, 'profile'):
return user_tool('profile', parts[1])
return 404, {'error': f'no route {method} {path}'}
name = parts[1] if len(parts) > 1 else None
actions = {
('GET', 1, None): lambda connection: vpnrouter_users.list_users(connection),
('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), body),
('PUT', 2, None): lambda connection: vpnrouter_users.update(connection, name, body),
('PUT', 3, 'password'): lambda connection: vpnrouter_users.passwd(connection, name, body.get('password')),
('POST', 3, 'disable'): lambda connection: vpnrouter_users.disable(connection, name),
('POST', 3, 'enable'): lambda connection: vpnrouter_users.enable(connection, name),
('DELETE', 2, None): lambda connection: vpnrouter_users.remove(connection, name),
('GET', 3, 'profile'): lambda connection: vpnrouter_users.profile(connection, name),
}
if route not in actions:
return 404, {'error': f'no route {method} {path}'}
try:
with vpnrouter_users.session() as connection:
document = actions[route](connection)
except vpnrouter_users.Failure as failure:
return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
except (ldap.LDAPError, OSError) as exc:
return 500, {'error': f'the user directory failed: {exc}'}
except SystemExit:
# vpnrouter ends with SystemExit on a configuration it cannot read; it has printed the reason.
return 500, {'error': 'the router configuration cannot be read'}
return (201 if route == ('POST', 1, None) else 200), document
def groups(state, method, path, body):
"""Answer a /groups request with vpnrouter_users: the HTTP status and the JSON document.
GET /groups the groups with their members
POST /groups add a group: {"name", "members": [...], "description"?}
PUT /groups/<name> rename it or change the description: {"name"?, "description"?}
DELETE /groups/<name> remove the group; its members are kept
POST /groups/<name>/members add a member: {"user": ...}
DELETE /groups/<name>/members/<user> take a member out; the last member cannot leave
"""
if body == 'invalid' or (body is not None and not isinstance(body, dict)):
return 400, {'error': 'the body must be a JSON object'}
body = body or {}
parts = path.strip('/').split('/')
name = parts[1] if len(parts) > 1 else None
route = (method, len(parts), parts[2] if len(parts) > 2 else None)
actions = {
('GET', 1, None): lambda connection: vpnrouter_users.list_groups(connection),
('POST', 1, None): lambda connection: vpnrouter_users.group_add(
connection, body.get('name'), body.get('description'), body.get('members')),
('PUT', 2, None): lambda connection: vpnrouter_users.group_update(
connection, name, body.get('name'), body.get('description')),
('DELETE', 2, None): lambda connection: vpnrouter_users.group_remove(connection, name),
('POST', 3, 'members'): lambda connection: vpnrouter_users.group_member_add(connection, name, body.get('user')),
('DELETE', 4, 'members'): lambda connection: vpnrouter_users.group_member_remove(connection, name, parts[3]),
}
if route not in actions:
return 404, {'error': f'no route {method} {path}'}
try:
with vpnrouter_users.session() as connection:
document = actions[route](connection)
except vpnrouter_users.Failure as failure:
return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
except (ldap.LDAPError, OSError) as exc:
return 500, {'error': f'the user directory failed: {exc}'}
return (201 if route == ('POST', 1, None) else 200), document
class Handler(BaseHTTPRequestHandler):
@@ -484,7 +513,8 @@ class Handler(BaseHTTPRequestHandler):
# A body that is not read must not be taken for the next request.
if self.command not in ('GET', 'HEAD'):
self.close_connection = True
protected = path == '/config' or path == '/users' or path.startswith('/users/')
directory = next((name for name in ('users', 'groups') if path == f'/{name}' or path.startswith(f'/{name}/')), None)
protected = path == '/config' or directory is not None
state = current() if protected else {}
if protected and not state['jwt_secret']:
body, kind, code = b'Not found\n', 'text/plain; charset=utf-8', 404
@@ -494,7 +524,7 @@ class Handler(BaseHTTPRequestHandler):
elif path == '/config' and self.command in ('GET', 'HEAD'):
body, kind, code = json.dumps(details(state), indent=2).encode() + b'\n', 'application/json', 200
elif protected and path != '/config':
code, document = users(state, self.command, path, self.request_body())
code, document = (users if directory == 'users' else groups)(state, self.command, path, self.request_body())
body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
elif self.command not in ('GET', 'HEAD'):
body, kind, code = b'Method not allowed\n', 'text/plain; charset=utf-8', 405