feature: site_to_site holds any number of named site-to-site connections, which /site-to-site lists, adds, changes and removes.

debian-package/src/usr/lib/vpn-router/web

@@ -17,6 +17,9 @@ Pages:
            add and take out members (see groups())
   /account the account of the signed-in user: its details, its password and its TOTP
            enrolment (see account())
+  /site-to-site
+           the site-to-site connections of the configuration: list, add, change and remove,
+           applied by vpn-router-setup (see site_to_site())
   /auth    sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
   /metrics/history
            the metrics the metrics service keeps, for a view: hour, day, month or year (see
@@ -25,7 +28,7 @@ Pages:
            the databases of each PostgreSQL cluster on the router with their sizes, as JSON (see
            postgresql_databases()); /config has the clusters' settings
 
-/config, /metrics/history, /postgresql, /users, /groups and /account need an HS256 JWT in an Authorization: Bearer header signed
+/config, /metrics/history, /postgresql, /users, /groups, /site-to-site and /account need an HS256 JWT in an Authorization: Bearer header signed
 with vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names a user in sub;
 /account serves that user, and the other paths need a member of vpnrouter_users.ADMIN_GROUP. A
 token of vpn-router-token has the admin claim and names no user; it may call every path but
@@ -39,7 +42,7 @@ default the address the call came in on, is the last entry of its X-Forwarded-Fo
 default, the overall status, the time and the client's address (its address as for the rate limit
 below); standard also the package version, the installed version of vpn-router-manager
 (manager_version, null when it is not installed) and the number of active and other services; full
-whether each service runs, whether Docker is installed, and the state of site-to-site, road-warrior
+whether each service runs, whether Docker is installed, and the state of each site-to-site connection, road-warrior
 (IPsec P2S), OpenVPN and WireGuard. No configuration data or key is shown, and no address but the
 client's.
 
@@ -80,7 +83,7 @@ import vpnrouter_metrics
 import vpnrouter_net
 import vpnrouter_serve
 import vpnrouter_users
-from vpnrouter_status import established, openvpn_clients, run, swanctl, wireguard_peers
+from vpnrouter_status import established, established_each, openvpn_clients, run, swanctl, wireguard_peers
 
 STATE_FILE = '/run/vpn-router/web.json'
 CONFIG_FILE = '/etc/vpn-router/vpn-router.json'
@@ -111,6 +114,9 @@ POSTGRESQL_SETTINGS = ('server_version', 'listen_addresses', 'port', 'max_connec
 #: The largest request body accepted, in bytes.
 BODY_LIMIT = 4096
 
+#: The settings of a site_to_site connection that /site-to-site adds and changes.
+CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'psk')
+
 #: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
 USER_STATUS = {2: 400, 3: 404, 4: 409, 5: 401}
 
@@ -202,9 +208,10 @@ def collect(state):
         'units': units,
         'docker': docker_status(),
     }
-    if state.get('site_to_site'):
-        count = established('remote-site')
-        status['site_to_site'] = {'established': None if count is None else count > 0}
+    names = state.get('site_to_site')
+    if isinstance(names, list) and names:
+        status['site_to_site'] = {'connections': {name: None if count is None else count > 0
+                                                  for name, count in established_each(names).items()}}
     if state.get('p2s'):
         status['p2s'] = {'clients': established('road-warrior')}
     if state.get('wireguard'):
@@ -365,9 +372,8 @@ def text_of(status):
         docker = status['docker']
         lines.append('Docker: not installed' if not docker['installed']
                      else f'Docker: installed, service {docker["service"]}, rules {docker["rules"]}')
-    if 'site_to_site' in status:
-        value = status['site_to_site']['established']
-        lines.append(f'Site to site: {"unknown" if value is None else "established" if value else "not established"}')
+    for name, value in status.get('site_to_site', {}).get('connections', {}).items():
+        lines.append(f'Site to site {name}: {"unknown" if value is None else "established" if value else "not established"}')
     if 'p2s' in status:
         clients = status['p2s']['clients']
         lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
@@ -527,6 +533,81 @@ def groups(state, method, path, body):
     return (201 if route == ('POST', 1, None) else 200), document
 
 
+def connection_of(name, connection, count):
+    """A site_to_site connection as /site-to-site shows it: its settings but psk, psk_set and established.
+
+    count is the number of its established IKE SAs, None when it is not known.
+    """
+    return {'name': name, **{option: value for option, value in connection.items() if option != 'psk'},
+            'psk_set': bool(connection['psk']), 'established': None if count is None else count > 0}
+
+
+def site_to_site(method, path, body):
+    """Answer a /site-to-site request: the HTTP status and the JSON document.
+
+      GET    /site-to-site          the connections, {"connections": [...]}: each with its settings but psk, with
+                                    psk_set, whether psk holds a key, and established, whether its tunnel is up,
+                                    null when swanctl cannot be asked
+      POST   /site-to-site          add a connection: {"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode",
+                                    "psk"}; psk is required, and an existing name is 409
+      PUT    /site-to-site/<name>   change any of the settings of POST but name; an empty or absent psk keeps the
+                                    current key, and a psk given replaces psk_file
+      DELETE /site-to-site/<name>   remove the connection
+
+    A change is made holding vpnrouter.config_lock, checked as vpn-router-setup checks the configuration (400 with
+    the reason), written with vpnrouter.save_config, and applied by restarting vpn-router-setup without waiting for it.
+    """
+    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
+        return 400, {'error': 'the body must be a JSON object'}
+    body = body or {}
+    parts = path.strip('/').split('/')
+    name = parts[1] if len(parts) == 2 else None
+    if (method, len(parts)) not in (('GET', 1), ('POST', 1), ('PUT', 2), ('DELETE', 2)):
+        return 404, {'error': f'no route {method} {path}'}
+    try:
+        if method == 'GET':
+            connections = vpnrouter.load_config()['site_to_site']
+            counts = established_each(connections)
+            return 200, {'connections': [connection_of(key, value, counts[key]) for key, value in connections.items()]}
+        settings = {option: body[option] for option in CONNECTION_SETTINGS if option in body}
+        with vpnrouter.config_lock():
+            data = vpnrouter.read_settings()
+            connections = data.setdefault('site_to_site', {})
+            if method == 'POST':
+                name = body.get('name')
+                if not isinstance(name, str) or not name:
+                    return 400, {'error': 'name is required'}
+                if name in connections:
+                    return 409, {'error': f'connection {name} exists'}
+                if not isinstance(settings.get('psk'), str) or not settings['psk']:
+                    return 400, {'error': 'psk is required'}
+                connections[name] = settings
+            elif name not in connections:
+                return 404, {'error': f'no connection {name}'}
+            elif method == 'PUT':
+                connection = dict(connections[name]) if isinstance(connections[name], dict) else {}
+                if settings.get('psk'):
+                    connection.pop('psk_file', None)
+                else:
+                    settings.pop('psk', None)
+                connections[name] = {**connection, **settings}
+            else:
+                del connections[name]
+            cfg = vpnrouter.with_defaults(data)
+            vpnrouter.validate(cfg)
+            vpnrouter.save_config(data)
+    except vpnrouter.ConfigError as exc:
+        return 400, {'error': str(exc)}
+    except OSError as exc:
+        return 500, {'error': f'the configuration cannot be written: {exc}'}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+    run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
+    if method == 'DELETE':
+        return 200, {'name': name, 'removed': True}
+    return (201 if method == 'POST' else 200), connection_of(name, cfg['site_to_site'][name], None)
+
+
 def account(name, method, path, body):
     """Answer an /account request of the user named by the token with vpnrouter_users: the HTTP status and the JSON document.
 
@@ -714,7 +795,8 @@ class Handler(BaseHTTPRequestHandler):
         # A body that is not read must not be taken for the next request.
         if self.command not in ('GET', 'HEAD'):
             self.close_connection = True
-        directory = next((name for name in ('users', 'groups', 'account') if path == f'/{name}' or path.startswith(f'/{name}/')), None)
+        directory = next((name for name in ('users', 'groups', 'account', 'site-to-site')
+                          if path == f'/{name}' or path.startswith(f'/{name}/')), None)
         protected = path in ('/config', '/metrics/history', '/postgresql') or directory is not None
         signing = path in ('/auth', '/auth/refresh', '/auth/logout')
         state = current() if protected or signing else {}
@@ -751,6 +833,9 @@ class Handler(BaseHTTPRequestHandler):
         elif directory == 'account':
             code, document = account(claims['sub'], self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
+        elif directory == 'site-to-site':
+            code, document = site_to_site(self.command, path, payload)
+            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif directory is not None:
             code, document = (users if directory == 'users' else groups)(state, self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'