cleanup structure,bak files | change peers header to match fw in rule inspect
This commit is contained in:
Nuno Duque Nunes
parent
7323bf20f1
commit
4ac25e283d
7 changed files with 8 additions and 2047 deletions
|
|
@ -1,254 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
FW_EVENTS_LOG="$(ctx::fw_events_log)"
|
||||
WG_EVENTS_LOG="$(ctx::events_log)"
|
||||
|
||||
function cmd::logs::on_load() {
|
||||
flag::register --name
|
||||
flag::register --type
|
||||
flag::register --since
|
||||
flag::register --limit
|
||||
flag::register --fw
|
||||
flag::register --wg
|
||||
flag::register --follow
|
||||
}
|
||||
|
||||
function cmd::logs::help() {
|
||||
cat <<EOF
|
||||
Usage: wgctl logs [options]
|
||||
|
||||
Show WireGuard and firewall activity logs.
|
||||
|
||||
Options:
|
||||
--name <name> Filter by client name
|
||||
--type <type> Filter by device type
|
||||
--since <time> Time filter (e.g. 1h, 24h, 7d)
|
||||
--limit <n> Max results per source (default 50)
|
||||
--fw Show only firewall drops
|
||||
--wg Show only WireGuard events
|
||||
|
||||
Examples:
|
||||
wgctl logs
|
||||
wgctl logs --name guest-test
|
||||
wgctl logs --type guest
|
||||
wgctl logs --since 1h
|
||||
wgctl logs --fw --limit 100
|
||||
EOF
|
||||
}
|
||||
|
||||
function cmd::logs::run() {
|
||||
local subcmd="${1:-show}"
|
||||
|
||||
# Check if first arg is a flag
|
||||
if [[ "$subcmd" == --* ]]; then
|
||||
subcmd="show"
|
||||
else
|
||||
shift || true
|
||||
fi
|
||||
|
||||
case "$subcmd" in
|
||||
show) cmd::logs::show "$@" ;;
|
||||
remove|rm|del) cmd::logs::remove "$@" ;;
|
||||
help) cmd::logs::help ;;
|
||||
*)
|
||||
log::error "Unknown subcommand: '${subcmd}'"
|
||||
cmd::logs::help
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
function cmd::logs::show() {
|
||||
local name="" type="" since="" limit=50
|
||||
local fw_only=false wg_only=false follow=false
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--name) name="$2"; shift 2 ;;
|
||||
--type) type="$2"; shift 2 ;;
|
||||
--since) since="$2"; shift 2 ;;
|
||||
--limit) limit="$2"; shift 2 ;;
|
||||
--fw) fw_only=true; shift ;;
|
||||
--wg) wg_only=true; shift ;;
|
||||
--follow|-f) follow=true; shift ;;
|
||||
--help) cmd::logs::help; return ;;
|
||||
*)
|
||||
log::error "Unknown flag: $1"
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -n "$name" && -n "$type" ]]; then
|
||||
name=$(peers::resolve_and_require "$name" "$type") || return 1
|
||||
fi
|
||||
|
||||
local filter_ip=""
|
||||
if [[ -n "$name" ]]; then
|
||||
filter_ip=$(peers::get_ip "$name")
|
||||
[[ -z "$filter_ip" ]] && log::error "Could not find IP for: $name" && return 1
|
||||
fi
|
||||
|
||||
if $follow; then
|
||||
cmd::logs::follow "$filter_ip" "$name" "$type" "$fw_only" "$wg_only"
|
||||
return
|
||||
fi
|
||||
|
||||
log::section "WireGuard Activity Log"
|
||||
printf "\n"
|
||||
$wg_only || cmd::logs::show_fw_events "$filter_ip" "$name" "$type" "$limit"
|
||||
$fw_only || cmd::logs::show_wg_events "$filter_ip" "$name" "$type" "$limit"
|
||||
}
|
||||
|
||||
function cmd::logs::follow() {
|
||||
local filter_ip="${1:-}" filter_name="${2:-}" filter_type="${3:-}"
|
||||
local fw_only="${4:-false}" wg_only="${5:-false}"
|
||||
local filter_peers="${6:-}"
|
||||
|
||||
local clients_dir
|
||||
clients_dir="$(ctx::clients)"
|
||||
|
||||
local wg_log="$WG_EVENTS_LOG"
|
||||
local fw_log="$FW_EVENTS_LOG"
|
||||
$fw_only && wg_log=""
|
||||
$wg_only && fw_log=""
|
||||
|
||||
log::section "WireGuard Live Log (Ctrl+C to stop)"
|
||||
printf "\n %-20s %-8s %-20s %-25s %s\n" \
|
||||
"TIME" "SOURCE" "CLIENT" "DESTINATION/ENDPOINT" "EVENT"
|
||||
printf " %s\n" "$(printf '─%.0s' {1..90})"
|
||||
|
||||
while IFS="|" read -r source ts client dst_or_endpoint event; do
|
||||
if [[ "$source" == "fw" ]]; then
|
||||
local colored_event
|
||||
case "$event" in
|
||||
tcp) colored_event="\033[1;33mtcp\033[0m" ;;
|
||||
udp) colored_event="\033[0;36mudp\033[0m" ;;
|
||||
icmp) colored_event="\033[0;37micmp\033[0m" ;;
|
||||
*) colored_event="$event" ;;
|
||||
esac
|
||||
printf " %-20s %-8s %-20s %-25s %b\n" \
|
||||
"$ts" "firewall" "$client" "$dst_or_endpoint" "$colored_event"
|
||||
else
|
||||
local colored_event
|
||||
case "$event" in
|
||||
attempt) colored_event="\033[1;31mattempt\033[0m" ;;
|
||||
handshake) colored_event="\033[1;32mhandshake\033[0m" ;;
|
||||
*) colored_event="$event" ;;
|
||||
esac
|
||||
printf " %-20s %-8s %-20s %-25s %b\n" \
|
||||
"$ts" "wireguard" "$client" "$dst_or_endpoint" "$colored_event"
|
||||
fi
|
||||
done < <(json::follow_logs "$fw_log" "$wg_log" "$filter_ip" "$filter_type" "$clients_dir" "$filter_peers")
|
||||
}
|
||||
|
||||
function cmd::logs::remove() {
|
||||
local name="" type="" force=false
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--name) name="$2"; shift 2 ;;
|
||||
--type) type="$2"; shift 2 ;;
|
||||
--force) force=true; shift ;;
|
||||
--help) cmd::logs::help; return ;;
|
||||
*)
|
||||
log::error "Unknown flag: $1"
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -z "$name" ]]; then
|
||||
log::error "Missing required flag: --name"
|
||||
return 1
|
||||
fi
|
||||
|
||||
name=$(peers::resolve_and_require "$name" "$type") || return 1
|
||||
|
||||
local client_ip
|
||||
client_ip=$(peers::get_ip "$name")
|
||||
|
||||
local before_wg before_fw after_wg after_fw
|
||||
before_wg=$(wc -l < "$WG_EVENTS_LOG" 2>/dev/null || echo 0)
|
||||
before_fw=$(wc -l < "$FW_EVENTS_LOG" 2>/dev/null || echo 0)
|
||||
|
||||
json::remove_events "$WG_EVENTS_LOG" "$name"
|
||||
json::remove_events "$FW_EVENTS_LOG" "$client_ip"
|
||||
|
||||
after_wg=$(wc -l < "$WG_EVENTS_LOG" 2>/dev/null || echo 0)
|
||||
after_fw=$(wc -l < "$FW_EVENTS_LOG" 2>/dev/null || echo 0)
|
||||
|
||||
local removed=$(( (before_wg - after_wg) + (before_fw - after_fw) ))
|
||||
if [[ "$removed" -eq 0 ]]; then
|
||||
log::wg_warning "No log entries found for: ${name}"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if ! $force; then
|
||||
read -r -p "Remove all log entries for '${name}'? [y/N] " confirm
|
||||
case "$confirm" in
|
||||
[yY][eE][sS]|[yY]) ;;
|
||||
*) log::info "Aborted"; return 0 ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
log::wg_success "Removed ${removed} log entries for: ${name}"
|
||||
|
||||
json::remove_events "$WG_EVENTS_LOG" "$name"
|
||||
json::remove_events "$FW_EVENTS_LOG" "$client_ip"
|
||||
|
||||
log::wg_success "Removed log entries for: ${name}"
|
||||
}
|
||||
|
||||
function cmd::logs::show_wg_events() {
|
||||
local filter_ip="$1" filter_name="$2" filter_type="$3" limit="$4"
|
||||
|
||||
[[ ! -f "$WG_EVENTS_LOG" ]] && return 0
|
||||
|
||||
printf " WireGuard Events:\n"
|
||||
printf " %-20s %-20s %-18s %s\n" "TIME" "CLIENT" "ENDPOINT" "EVENT"
|
||||
printf " %s\n" "$(printf '─%.0s' {1..75})"
|
||||
|
||||
local found=false
|
||||
while IFS="|" read -r ts client endpoint event; do
|
||||
[[ -z "$ts" ]] && continue
|
||||
local colored_event
|
||||
case "$event" in
|
||||
attempt) colored_event="\033[1;31mattempt\033[0m" ;;
|
||||
handshake) colored_event="\033[1;32mhandshake\033[0m" ;;
|
||||
*) colored_event="$event" ;;
|
||||
esac
|
||||
printf " %-20s %-20s %-18s %b\n" "$ts" "$client" "$endpoint" "$colored_event"
|
||||
found=true
|
||||
done < <(json::wg_events "$WG_EVENTS_LOG" "$filter_name" "$filter_type" "$limit")
|
||||
|
||||
$found || printf " —\n"
|
||||
printf "\n"
|
||||
}
|
||||
|
||||
function cmd::logs::show_fw_events() {
|
||||
local filter_ip="$1" filter_name="$2" filter_type="$3" limit="$4"
|
||||
|
||||
[[ ! -f "$FW_EVENTS_LOG" ]] && return 0
|
||||
|
||||
printf " Firewall Drops:\n"
|
||||
printf " %-20s %-18s %-25s %s\n" "TIME" "CLIENT" "DESTINATION" "PROTOCOL"
|
||||
printf " %s\n" "$(printf '─%.0s' {1..75})"
|
||||
|
||||
local found=false
|
||||
while IFS="|" read -r ts client dst proto; do
|
||||
[[ -z "$ts" ]] && continue
|
||||
local colored_proto
|
||||
case "$proto" in
|
||||
tcp) colored_proto="\033[1;33mtcp\033[0m" ;;
|
||||
udp) colored_proto="\033[1;36mudp\033[0m" ;;
|
||||
icmp) colored_proto="\033[0;37micmp\033[0m" ;;
|
||||
*) colored_proto="$proto" ;;
|
||||
esac
|
||||
printf " %-20s %-18s %-25s %b\n" "$ts" "$client" "$dst" "$colored_proto"
|
||||
found=true
|
||||
done < <(json::fw_events "$FW_EVENTS_LOG" "$filter_ip" "$filter_type" "$(ctx::clients)" "$limit")
|
||||
|
||||
$found || printf " —\n"
|
||||
printf "\n"
|
||||
}
|
||||
|
|
@ -313,215 +313,6 @@ function cmd::rule::list() {
|
|||
# Show
|
||||
# ============================================
|
||||
|
||||
# function cmd::rule::show() {
|
||||
# local name="" show_peers=true color=false show_resolved=false
|
||||
|
||||
# while [[ $# -gt 0 ]]; do
|
||||
# case "$1" in
|
||||
# --name) util::require_flag "--name" "${2:-}" || return 1
|
||||
# name="$2"; shift 2 ;;
|
||||
# --no-peers) show_peers=false; shift ;;
|
||||
# --color) color=true; shift ;;
|
||||
# --resolved) show_resolved=true; shift ;;
|
||||
# --help) cmd::rule::help; return ;;
|
||||
# *) log::error "Unknown flag: $1"; return 1 ;;
|
||||
# esac
|
||||
# done
|
||||
|
||||
# [[ -z "$name" ]] && log::error "Missing required flag: --name" && return 1
|
||||
# rule::require_exists "$name" || return 1
|
||||
|
||||
# local rule_file
|
||||
# rule_file="$(rule::path "$name")"
|
||||
|
||||
# local dns_redirect
|
||||
# dns_redirect=$(rule::get_own "$name" "dns_redirect")
|
||||
# dns_redirect="${dns_redirect:-false}"
|
||||
|
||||
# local resolved_dns
|
||||
# resolved_dns=$(rule::get "$name" "dns_redirect")
|
||||
# resolved_dns="${resolved_dns:-false}"
|
||||
|
||||
# local dns_display
|
||||
# if [[ "${resolved_dns,,}" == "true" && "${dns_redirect,,}" != "true" ]]; then
|
||||
# dns_display="true (inherited)"
|
||||
# elif [[ "${dns_redirect,,}" == "true" ]]; then
|
||||
# dns_display="true"
|
||||
# else
|
||||
# dns_display="false"
|
||||
# fi
|
||||
|
||||
|
||||
# log::section "Rule: ${name}"
|
||||
# printf "\n"
|
||||
|
||||
# # ── Header info ──────────────────────────────
|
||||
# local desc group dns_redirect
|
||||
# desc=$(json::get "$rule_file" "desc")
|
||||
# group=$(json::get "$rule_file" "group")
|
||||
|
||||
# ui::row "Description" "${desc:-—}"
|
||||
# ui::row "Group" "${group:-—}"
|
||||
# ui::row "DNS" "$dns_display"
|
||||
|
||||
# # ── Extends section ──────────────────────────
|
||||
# local extends_raw=()
|
||||
# mapfile -t extends_raw < <(json::get "$rule_file" "extends" 2>/dev/null || true)
|
||||
|
||||
# if [[ ${#extends_raw[@]} -gt 0 && -n "${extends_raw[0]}" ]]; then
|
||||
# cmd::rule::_show_section "Extends"
|
||||
|
||||
# for base_name in "${extends_raw[@]}"; do
|
||||
# [[ -z "$base_name" ]] && continue
|
||||
# printf "\n \033[0;37m↳ %s\033[0m\n" "$base_name"
|
||||
|
||||
# # Show resolved entries for this base
|
||||
# local base_allow_ports base_allow_ips base_block_ips base_block_ports base_dns
|
||||
# base_allow_ports=$(rule::get "$base_name" "allow_ports" 2>/dev/null || true)
|
||||
# base_allow_ips=$(rule::get "$base_name" "allow_ips" 2>/dev/null || true)
|
||||
# base_block_ips=$(rule::get "$base_name" "block_ips" 2>/dev/null || true)
|
||||
# base_block_ports=$(rule::get "$base_name" "block_ports" 2>/dev/null || true)
|
||||
# base_dns=$(json::get "$(rule::path "$base_name")" "dns_redirect" 2>/dev/null || true)
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "+" "$e"
|
||||
# done <<< "$base_allow_ports"
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "-" "$e"
|
||||
# done <<< "$base_allow_ips"
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "-" "$e"
|
||||
# done <<< "$base_block_ips"
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "-" "$e"
|
||||
# done <<< "$base_block_ports"
|
||||
|
||||
# [[ "$base_dns" == "true" ]] && \
|
||||
# printf " \033[0;36m↺\033[0m DNS → %s\n" "$(config::dns)"
|
||||
# done
|
||||
# fi
|
||||
|
||||
# # ── Own Rules section ─────────────────────────
|
||||
# local own_allow_ports own_allow_ips own_block_ips own_block_ports
|
||||
# own_allow_ports=$(json::get "$rule_file" "allow_ports")
|
||||
# own_allow_ips=$(json::get "$rule_file" "allow_ips")
|
||||
# own_block_ips=$(json::get "$rule_file" "block_ips")
|
||||
# own_block_ports=$(json::get "$rule_file" "block_ports")
|
||||
|
||||
# local has_own=false
|
||||
# [[ -n "$own_allow_ports" || -n "$own_allow_ips" || \
|
||||
# -n "$own_block_ips" || -n "$own_block_ports" ]] && has_own=true
|
||||
|
||||
# if $has_own; then
|
||||
# if [[ ${#extends_raw[@]} -gt 0 && -n "${extends_raw[0]}" ]]; then
|
||||
# cmd::rule::_show_section "Own Rules"
|
||||
# printf "\n"
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "+" "$e"
|
||||
# done <<< "$own_allow_ports"
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "+" "$e"
|
||||
# done <<< "$own_allow_ips"
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "-" "$e"
|
||||
# done <<< "$own_block_ips"
|
||||
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# net::print_entry "-" "$e"
|
||||
# done <<< "$own_block_ports"
|
||||
|
||||
# [[ "$dns_redirect" == "true" ]] && \
|
||||
# printf " \033[0;36m↺\033[0m DNS → %s\n" "$(config::dns)"
|
||||
# else
|
||||
# # No inheritance — use Allow/Block sections
|
||||
# if [[ -n "$own_allow_ports" || -n "$own_allow_ips" ]]; then
|
||||
# cmd::rule::_show_section "Allow"
|
||||
# printf "\n"
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# printf " \033[0;32m+\033[0m %s\n" "$e"
|
||||
# done <<< "$own_allow_ports"
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# printf " \033[0;32m+\033[0m %s\n" "$e"
|
||||
# done <<< "$own_allow_ips"
|
||||
# fi
|
||||
|
||||
# if [[ -n "$own_block_ips" || -n "$own_block_ports" ]]; then
|
||||
# cmd::rule::_show_section "Block"
|
||||
# printf "\n"
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# printf " \033[0;31m-\033[0m %s\n" "$e"
|
||||
# done <<< "$own_block_ips"
|
||||
# while IFS= read -r e; do
|
||||
# [[ -z "$e" ]] && continue
|
||||
# printf " \033[0;31m-\033[0m %s\n" "$e"
|
||||
# done <<< "$own_block_ports"
|
||||
# fi
|
||||
|
||||
# if [[ "$dns_redirect" == "true" ]]; then
|
||||
# cmd::rule::_show_section "DNS"
|
||||
# printf "\n \033[0;36m↺\033[0m Redirect all DNS → %s\n" "$(config::dns)"
|
||||
# fi
|
||||
# fi
|
||||
# elif [[ ${#extends_raw[@]} -eq 0 || -z "${extends_raw[0]}" ]]; then
|
||||
# printf "\n"
|
||||
# ui::row "Access" "full (no restrictions)"
|
||||
# fi
|
||||
|
||||
# # ── Resolved section (optional) ──────────────
|
||||
# if $show_resolved; then
|
||||
# cmd::rule::_show_section "Resolved (applied to peers)"
|
||||
# local res_allow_ports res_allow_ips res_block_ips res_block_ports
|
||||
# res_allow_ports=$(rule::get "$name" "allow_ports")
|
||||
# res_allow_ips=$(rule::get "$name" "allow_ips")
|
||||
# res_block_ips=$(rule::get "$name" "block_ips")
|
||||
# res_block_ports=$(rule::get "$name" "block_ports")
|
||||
|
||||
# while IFS= read -r e; do [[ -n "$e" ]] && \
|
||||
# printf " \033[0;32m+\033[0m %s\n" "$e"; done <<< "$res_allow_ports"
|
||||
# while IFS= read -r e; do [[ -n "$e" ]] && \
|
||||
# printf " \033[0;32m+\033[0m %s\n" "$e"; done <<< "$res_allow_ips"
|
||||
# while IFS= read -r e; do [[ -n "$e" ]] && \
|
||||
# printf " \033[0;31m-\033[0m %s\n" "$e"; done <<< "$res_block_ips"
|
||||
# while IFS= read -r e; do [[ -n "$e" ]] && \
|
||||
# printf " \033[0;31m-\033[0m %s\n" "$e"; done <<< "$res_block_ports"
|
||||
# fi
|
||||
|
||||
# # ── Peers section ─────────────────────────────
|
||||
# cmd::rule::_show_section "Peers"
|
||||
|
||||
# local peer_list=()
|
||||
# mapfile -t peer_list < <(peers::with_rule "$name")
|
||||
# local peer_count=${#peer_list[@]}
|
||||
# ui::row "Assigned" "$peer_count"
|
||||
|
||||
# if $show_peers && [[ $peer_count -gt 0 ]]; then
|
||||
# printf "\n"
|
||||
# for peer_name in "${peer_list[@]}"; do
|
||||
# local ip
|
||||
# ip=$(peers::get_ip "$peer_name")
|
||||
# printf " %-28s %s\n" "$peer_name" "$ip"
|
||||
# done
|
||||
# fi
|
||||
|
||||
# printf "\n"
|
||||
# }
|
||||
|
||||
function cmd::rule::show() {
|
||||
local name="" show_peers=true show_resolved=false
|
||||
|
||||
|
|
@ -589,16 +380,21 @@ function cmd::rule::show() {
|
|||
<<< "$res_allow_ports"$'\n'"$res_allow_ips"
|
||||
while IFS= read -r e; do [[ -n "$e" ]] && net::print_entry "-" "$e"; done \
|
||||
<<< "$res_block_ips"$'\n'"$res_block_ports"
|
||||
printf "\n"
|
||||
|
||||
fi
|
||||
|
||||
# ── Peers ─────────────────────────────────────
|
||||
cmd::rule::_show_section "Peers"
|
||||
local peer_list=()
|
||||
mapfile -t peer_list < <(peers::with_rule "$name")
|
||||
|
||||
local peer_count=${#peer_list[@]}
|
||||
ui::row "Assigned" "$peer_count"
|
||||
|
||||
printf "\033[0;37m── Peers (%s) \033[0m%s\n\n" \
|
||||
"$(color::gray "${peer_count}")" \
|
||||
"$(printf '\033[0;37m─%.0s' {1..35})"
|
||||
|
||||
if $show_peers && [[ $peer_count -gt 0 ]]; then
|
||||
printf "\n"
|
||||
for peer_name in "${peer_list[@]}"; do
|
||||
local ip
|
||||
ip=$(peers::get_ip "$peer_name")
|
||||
|
|
|
|||
|
|
@ -1,164 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# ============================================
|
||||
# Private helpers
|
||||
# ============================================
|
||||
|
||||
function cmd::shell::_prompt() {
|
||||
local user host dir
|
||||
user=$(whoami)
|
||||
host=$(hostname -s)
|
||||
dir=$(basename "$PWD")
|
||||
printf "\033[1;32m%s@%s\033[0m:\033[0;36m%s\033[0m \033[1;34mwgctl\033[0m> " \
|
||||
"$user" "$host" "$dir"
|
||||
}
|
||||
|
||||
function cmd::shell::_is_wgctl_command() {
|
||||
local cmd="$1"
|
||||
# Check against known wgctl commands
|
||||
local known=(
|
||||
list add remove rm inspect block unblock
|
||||
rule group audit logs watch fw config qr
|
||||
rename keys ip service shell help
|
||||
)
|
||||
local c
|
||||
for c in "${known[@]}"; do
|
||||
[[ "$c" == "$cmd" ]] && return 0
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
function cmd::shell::_handle_builtin() {
|
||||
local input="$1"
|
||||
local first="${input%% *}"
|
||||
|
||||
case "$first" in
|
||||
cd)
|
||||
local dir="${input#cd }"
|
||||
[[ "$dir" == "$input" ]] && dir="$HOME"
|
||||
cd "$dir" 2>/dev/null || log::error "cd: $dir: No such file or directory"
|
||||
return 0
|
||||
;;
|
||||
cd*) eval "$input" ;; # eval preserves shell state for cd
|
||||
export|unset|source|.)
|
||||
eval "$input"
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
return 1 # not a builtin
|
||||
}
|
||||
|
||||
function cmd::shell::_execute() {
|
||||
local input="$1"
|
||||
local first="${input%% *}"
|
||||
local rest="${input#"$first"}"
|
||||
rest="${rest# }"
|
||||
|
||||
# Handle shell builtins first
|
||||
cmd::shell::_handle_builtin "$input" && return 0
|
||||
|
||||
# Try as wgctl command via dispatcher
|
||||
if cmd::shell::_is_wgctl_command "$first"; then
|
||||
if [[ -n "$rest" ]]; then
|
||||
wgctl::dispatch "$first" $rest || true # never exit REPL on failure
|
||||
else
|
||||
wgctl::dispatch "$first" || true
|
||||
fi
|
||||
return 0 # Always 0 to keep REPL running
|
||||
fi
|
||||
|
||||
# Fall back to bash
|
||||
bash -c "$input" || true # same for bash commands
|
||||
}
|
||||
|
||||
function cmd::shell::_setup_history() {
|
||||
HISTFILE="${HOME}/.wgctl_history"
|
||||
HISTSIZE=1000
|
||||
HISTFILESIZE=2000
|
||||
history -r 2>/dev/null || true
|
||||
}
|
||||
|
||||
function cmd::shell::_save_history() {
|
||||
history -w 2>/dev/null || true
|
||||
}
|
||||
|
||||
function cmd::shell::_banner() {
|
||||
ui::section "wgctl shell"
|
||||
printf "\n"
|
||||
printf " Type wgctl commands directly, or any bash command.\n"
|
||||
printf " Type \033[1mexit\033[0m or \033[1mquit\033[0m to leave.\n"
|
||||
printf " Type \033[1mhelp\033[0m for wgctl commands.\n"
|
||||
printf "\n"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Run
|
||||
# ============================================
|
||||
|
||||
function cmd::shell::on_load() {
|
||||
: # no flags needed
|
||||
}
|
||||
|
||||
function cmd::shell::help() {
|
||||
cat <<EOF
|
||||
Usage: wgctl shell
|
||||
|
||||
Start an interactive wgctl shell. Supports all wgctl commands
|
||||
directly (no 'wgctl' prefix needed), plus any bash command.
|
||||
|
||||
Builtins handled: cd, export, unset, source
|
||||
Everything else: passed to bash
|
||||
|
||||
Examples:
|
||||
wgctl shell
|
||||
wgctl> list
|
||||
wgctl> inspect --name phone-nuno
|
||||
wgctl> ls /etc/wireguard
|
||||
wgctl> exit
|
||||
EOF
|
||||
}
|
||||
|
||||
function cmd::shell::run() {
|
||||
cmd::shell::_banner
|
||||
cmd::shell::_setup_history
|
||||
|
||||
while true; do
|
||||
local input
|
||||
# Read with readline support (-e) and custom prompt
|
||||
IFS= read -r -e -p "$(cmd::shell::_prompt)" input || break
|
||||
|
||||
# Handle empty input
|
||||
[[ -z "${input// }" ]] && continue
|
||||
|
||||
# Add to history
|
||||
history -s "$input"
|
||||
|
||||
# Handle exit
|
||||
case "${input%% *}" in
|
||||
exit|quit) break ;;
|
||||
esac
|
||||
|
||||
# Execute
|
||||
cmd::shell::_execute "$input"
|
||||
done
|
||||
|
||||
cmd::shell::_save_history
|
||||
printf "\n Goodbye!\n\n"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Tab completion (loaded when shell starts)
|
||||
# ============================================
|
||||
|
||||
function cmd::shell::_setup_completion() {
|
||||
local commands="list add remove inspect block unblock rule group audit logs watch fw config qr rename shell help"
|
||||
|
||||
function _wgctl_shell_complete() {
|
||||
local cur="${COMP_WORDS[COMP_CWORD]}"
|
||||
COMPREPLY=( $(compgen -W "$commands" -- "$cur") )
|
||||
}
|
||||
|
||||
# Bind completion to the read prompt
|
||||
bind 'set show-all-if-ambiguous on' 2>/dev/null || true
|
||||
bind 'set completion-ignore-case on' 2>/dev/null || true
|
||||
}
|
||||
|
|
@ -1,790 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
"""
|
||||
wgctl JSON helper — called by shell functions to read/write JSON files.
|
||||
Usage: json_helper.py <command> <file> [key] [value]
|
||||
"""
|
||||
|
||||
import sys
|
||||
import json
|
||||
import os
|
||||
|
||||
DATETIME_FMT = os.environ.get('WGCTL_DATETIME_FMT', '%Y-%m-%d %H:%M')
|
||||
|
||||
def get(file, key):
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
val = data.get(key, [])
|
||||
if isinstance(val, bool):
|
||||
print(str(val).lower()) # true/false not True/False
|
||||
elif isinstance(val, list):
|
||||
if val:
|
||||
print('\n'.join(str(v) for v in val))
|
||||
else:
|
||||
if val:
|
||||
print(val)
|
||||
except:
|
||||
sys.exit(0)
|
||||
|
||||
def set_key(file, key, value):
|
||||
try:
|
||||
data = {}
|
||||
if os.path.exists(file):
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
# Try to parse as JSON value first (for arrays/bools)
|
||||
try:
|
||||
data[key] = json.loads(value)
|
||||
except:
|
||||
data[key] = value
|
||||
with open(file, 'w') as f:
|
||||
json.dump(data, f, indent=2)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def delete_key(file, key):
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
data.pop(key, None)
|
||||
with open(file, 'w') as f:
|
||||
json.dump(data, f, indent=2)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def append(file, key, value):
|
||||
try:
|
||||
data = {}
|
||||
if os.path.exists(file):
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
if key not in data:
|
||||
data[key] = []
|
||||
if value not in data[key]:
|
||||
data[key].append(value)
|
||||
with open(file, 'w') as f:
|
||||
json.dump(data, f, indent=2)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def remove_value(file, key, value):
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
if key in data and value in data[key]:
|
||||
data[key].remove(value)
|
||||
with open(file, 'w') as f:
|
||||
json.dump(data, f, indent=2)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def cat(file):
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
print(json.dumps(data, indent=2))
|
||||
except Exception as e:
|
||||
sys.exit(1)
|
||||
|
||||
def has_key(file, key):
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
sys.exit(0 if key in data else 1)
|
||||
except:
|
||||
sys.exit(1)
|
||||
|
||||
def filter_values(file, key, value):
|
||||
"""Remove all entries where value matches"""
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
data = {k: v for k, v in data.items() if v != value}
|
||||
with open(file, 'w') as f:
|
||||
json.dump(data, f, indent=2)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def last_event(file, key, field, client):
|
||||
"""Get last event field for a client"""
|
||||
try:
|
||||
last = None
|
||||
with open(file) as f:
|
||||
for line in f:
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
if e.get(key) == client:
|
||||
last = e
|
||||
except:
|
||||
pass
|
||||
if last:
|
||||
print(last.get(field, ''))
|
||||
except:
|
||||
pass
|
||||
|
||||
def events_for(file, ip, limit):
|
||||
"""Format events for a given IP"""
|
||||
try:
|
||||
from datetime import datetime
|
||||
events = []
|
||||
with open(file) as f:
|
||||
for line in f:
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
if e.get('ip') == ip:
|
||||
events.append(e)
|
||||
except:
|
||||
pass
|
||||
for e in events[-int(limit):]:
|
||||
ts = e.get('timestamp', '')
|
||||
try:
|
||||
dt = datetime.fromisoformat(ts)
|
||||
ts = dt.strftime(DATETIME_FMT)
|
||||
except:
|
||||
pass
|
||||
endpoint = e.get('endpoint', '—')
|
||||
client = e.get('client', '—')
|
||||
event = e.get('event', '—')
|
||||
print(f' {ts} {client:<20} {endpoint:<20} {event}')
|
||||
except:
|
||||
pass
|
||||
|
||||
def fw_events(file, filter_ip, filter_type, clients_dir, limit):
|
||||
"""Format firewall drop events"""
|
||||
import glob
|
||||
|
||||
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
|
||||
|
||||
# Build ip->name map
|
||||
ip_to_name = {}
|
||||
for conf in glob.glob(f"{clients_dir}/*.conf"):
|
||||
name = os.path.basename(conf).replace('.conf', '')
|
||||
try:
|
||||
with open(conf) as f:
|
||||
for line in f:
|
||||
if line.startswith('Address'):
|
||||
ip = line.split('=')[1].strip().split('/')[0]
|
||||
ip_to_name[ip] = name
|
||||
except:
|
||||
pass
|
||||
|
||||
events = []
|
||||
last_seen = {} # (src, dst, port, proto) -> last timestamp
|
||||
|
||||
try:
|
||||
with open(file) as f:
|
||||
for line in f:
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
src = e.get('src_ip', '')
|
||||
if not src:
|
||||
continue
|
||||
if filter_ip and src != filter_ip:
|
||||
continue
|
||||
|
||||
# Dedup key
|
||||
dst = e.get('dest_ip', '')
|
||||
port = e.get('dest_port', '')
|
||||
proto = e.get('ip.protocol', 0)
|
||||
key = (src, dst, port, proto)
|
||||
|
||||
ts_str = e.get('timestamp', '')
|
||||
try:
|
||||
from datetime import datetime
|
||||
ts = datetime.fromisoformat(ts_str).timestamp()
|
||||
except:
|
||||
ts = 0
|
||||
|
||||
# Protocol-aware dedup window
|
||||
dedup_windows = {1: 5, 6: 30, 17: 10} # icmp=5s, tcp=30s, udp=10s
|
||||
window = dedup_windows.get(proto, 10)
|
||||
|
||||
# Skip if same event within protocol window
|
||||
if key in last_seen and (ts - last_seen[key]) < window:
|
||||
continue
|
||||
last_seen[key] = ts
|
||||
|
||||
events.append(e)
|
||||
except:
|
||||
pass
|
||||
except:
|
||||
pass
|
||||
|
||||
for e in events[-int(limit):]:
|
||||
ts = e.get('timestamp', '')
|
||||
try:
|
||||
from datetime import datetime
|
||||
dt = datetime.fromisoformat(ts)
|
||||
ts = dt.strftime(DATETIME_FMT)
|
||||
except:
|
||||
pass
|
||||
src = e.get('src_ip', '—')
|
||||
dst = e.get('dest_ip', '—')
|
||||
port = e.get('dest_port', '')
|
||||
proto_num = e.get('ip.protocol', 0)
|
||||
proto = proto_map.get(proto_num, str(proto_num))
|
||||
dst_str = f"{dst}:{port}" if port else dst
|
||||
client = ip_to_name.get(src, src)
|
||||
|
||||
if filter_type and not client.startswith(filter_type + '-'):
|
||||
continue
|
||||
|
||||
print(f"{ts}|{client}|{dst_str}|{proto}")
|
||||
|
||||
def wg_events(file, filter_client, filter_type, limit):
|
||||
"""Format WireGuard events from events.log"""
|
||||
events = []
|
||||
try:
|
||||
with open(file) as f:
|
||||
for line in f:
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
client = e.get('client', '')
|
||||
if not client:
|
||||
continue
|
||||
if filter_client and client != filter_client:
|
||||
continue
|
||||
if filter_type and not client.startswith(filter_type + '-'):
|
||||
continue
|
||||
events.append(e)
|
||||
except:
|
||||
pass
|
||||
except:
|
||||
pass
|
||||
|
||||
for e in events[-int(limit):]:
|
||||
ts = e.get('timestamp', '')
|
||||
try:
|
||||
from datetime import datetime
|
||||
dt = datetime.fromisoformat(ts)
|
||||
ts = dt.strftime(DATETIME_FMT)
|
||||
except:
|
||||
pass
|
||||
client = e.get('client', '—')
|
||||
endpoint = e.get('endpoint', '—')
|
||||
event = e.get('event', '—')
|
||||
print(f"{ts}|{client}|{endpoint}|{event}")
|
||||
|
||||
def format_fw_event(line, clients_dir):
|
||||
"""Format a single fw_event line"""
|
||||
import glob
|
||||
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
|
||||
|
||||
# Build ip->name map
|
||||
ip_to_name = {}
|
||||
for conf in glob.glob(f"{clients_dir}/*.conf"):
|
||||
name = os.path.basename(conf).replace('.conf', '')
|
||||
try:
|
||||
with open(conf) as f:
|
||||
for l in f:
|
||||
if l.startswith('Address'):
|
||||
ip = l.split('=')[1].strip().split('/')[0]
|
||||
ip_to_name[ip] = name
|
||||
except:
|
||||
pass
|
||||
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
src = e.get('src_ip', '')
|
||||
if not src:
|
||||
return None
|
||||
ts = e.get('timestamp', '')
|
||||
try:
|
||||
from datetime import datetime
|
||||
dt = datetime.fromisoformat(ts)
|
||||
ts = dt.strftime(DATETIME_FMT)
|
||||
except:
|
||||
pass
|
||||
dst = e.get('dest_ip', '—')
|
||||
port = e.get('dest_port', '')
|
||||
proto_num = e.get('ip.protocol', 0)
|
||||
proto = proto_map.get(proto_num, str(proto_num))
|
||||
dst_str = f"{dst}:{port}" if port else dst
|
||||
client = ip_to_name.get(src, src)
|
||||
return f"{ts}|{client}|{dst_str}|{proto}"
|
||||
except:
|
||||
return None
|
||||
|
||||
def format_wg_event(line):
|
||||
"""Format a single wg_event line"""
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
client = e.get('client', '')
|
||||
if not client:
|
||||
return None
|
||||
ts = e.get('timestamp', '')
|
||||
try:
|
||||
from datetime import datetime
|
||||
dt = datetime.fromisoformat(ts)
|
||||
ts = dt.strftime(DATETIME_FMT)
|
||||
except:
|
||||
pass
|
||||
endpoint = e.get('endpoint', '—')
|
||||
event = e.get('event', '—')
|
||||
return f"{ts}|{client}|{endpoint}|{event}|wg"
|
||||
except:
|
||||
return None
|
||||
|
||||
def remove_events(file, identifier):
|
||||
"""Remove all events for a client/ip from a JSONL file"""
|
||||
try:
|
||||
lines = []
|
||||
with open(file) as f:
|
||||
for line in f:
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
if e.get('client') == identifier or e.get('src_ip') == identifier:
|
||||
continue
|
||||
lines.append(line)
|
||||
except:
|
||||
lines.append(line)
|
||||
with open(file, 'w') as f:
|
||||
f.writelines(lines)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def follow_logs(fw_file, wg_file, filter_ip, filter_type, clients_dir, filter_peers=""):
|
||||
"""Follow both log files and output formatted events"""
|
||||
import glob, time, select
|
||||
|
||||
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
|
||||
peer_filter = set(filter_peers.split(',')) if filter_peers else set()
|
||||
import sys
|
||||
print(f"DEBUG follow_logs: peer_filter={peer_filter}", file=sys.stderr, flush=True)
|
||||
|
||||
# Build ip->name map
|
||||
ip_to_name = {}
|
||||
for conf in glob.glob(f"{clients_dir}/*.conf"):
|
||||
name = os.path.basename(conf).replace('.conf', '')
|
||||
try:
|
||||
with open(conf) as f:
|
||||
for l in f:
|
||||
if l.startswith('Address'):
|
||||
ip = l.split('=')[1].strip().split('/')[0]
|
||||
ip_to_name[ip] = name
|
||||
except:
|
||||
pass
|
||||
|
||||
# Open files and seek to end
|
||||
files = {}
|
||||
for label, path in [('fw', fw_file), ('wg', wg_file)]:
|
||||
if path and os.path.exists(path):
|
||||
f = open(path)
|
||||
f.seek(0, 2) # seek to end
|
||||
files[label] = f
|
||||
|
||||
dedup = {}
|
||||
|
||||
try:
|
||||
while True:
|
||||
for label, f in files.items():
|
||||
line = f.readline()
|
||||
if not line:
|
||||
continue
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
except:
|
||||
continue
|
||||
|
||||
if label == 'fw':
|
||||
src = e.get('src_ip', '')
|
||||
if not src:
|
||||
continue
|
||||
if filter_ip and src != filter_ip:
|
||||
continue
|
||||
|
||||
# Filter by peer names if specified
|
||||
if peer_filter:
|
||||
client_name = ip_to_name.get(src, '')
|
||||
if client_name not in peer_filter:
|
||||
continue
|
||||
dst = e.get('dest_ip', '—')
|
||||
port = e.get('dest_port', '')
|
||||
proto_num = e.get('ip.protocol', 0)
|
||||
proto = proto_map.get(proto_num, str(proto_num))
|
||||
|
||||
# Dedup
|
||||
key = (src, dst, port, proto_num)
|
||||
windows = {1: 5, 6: 30, 17: 10}
|
||||
window = windows.get(proto_num, 10)
|
||||
now = time.time()
|
||||
if key in dedup and (now - dedup[key]) < window:
|
||||
continue
|
||||
dedup[key] = now
|
||||
|
||||
client = ip_to_name.get(src, src)
|
||||
if filter_type and not client.startswith(filter_type + '-'):
|
||||
continue
|
||||
dst_str = f"{dst}:{port}" if port else dst
|
||||
ts = e.get('timestamp', '')[:16].replace('T', ' ')
|
||||
print(f"fw|{ts}|{client}|{dst_str}|{proto}", flush=True)
|
||||
|
||||
elif label == 'wg':
|
||||
client = e.get('client', '')
|
||||
if not client:
|
||||
continue
|
||||
if filter_ip:
|
||||
ip = ip_to_name.get(filter_ip, '')
|
||||
if client != ip and client != filter_ip:
|
||||
continue
|
||||
|
||||
if peer_filter and client not in peer_filter:
|
||||
continue
|
||||
if filter_type and not client.startswith(filter_type + '-'):
|
||||
continue
|
||||
ts = e.get('timestamp', '')[:16].replace('T', ' ')
|
||||
endpoint = e.get('endpoint', '—')
|
||||
event = e.get('event', '—')
|
||||
print(f"wg|{ts}|{client}|{endpoint}|{event}", flush=True)
|
||||
|
||||
time.sleep(0.1)
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
|
||||
def count(file, key):
|
||||
try:
|
||||
with open(file) as f:
|
||||
data = json.load(f)
|
||||
val = data.get(key, [])
|
||||
print(len(val) if isinstance(val, list) else 0)
|
||||
except:
|
||||
print(0)
|
||||
|
||||
def audit_fw_counts(clients_dir):
|
||||
"""Return peer_name:fw_count pairs from iptables and client configs"""
|
||||
import glob, subprocess
|
||||
|
||||
# Get iptables output once
|
||||
try:
|
||||
result = subprocess.run(
|
||||
['iptables', '-L', 'FORWARD', '-n'],
|
||||
capture_output=True, text=True
|
||||
)
|
||||
fw_output = result.stdout
|
||||
except:
|
||||
fw_output = ""
|
||||
|
||||
# Build ip->name and count rules
|
||||
for conf in glob.glob(f"{clients_dir}/*.conf"):
|
||||
name = os.path.basename(conf).replace('.conf', '')
|
||||
try:
|
||||
with open(conf) as f:
|
||||
for line in f:
|
||||
if line.startswith('Address'):
|
||||
ip = line.split('=')[1].strip().split('/')[0]
|
||||
count = fw_output.count(ip)
|
||||
print(f"{name}:{count}")
|
||||
break
|
||||
except:
|
||||
pass
|
||||
|
||||
def peer_group_map(groups_dir):
|
||||
"""Return peer:group pairs for all groups"""
|
||||
import glob
|
||||
try:
|
||||
for group_file in glob.glob(f"{groups_dir}/*.group"):
|
||||
try:
|
||||
with open(group_file) as f:
|
||||
g = json.load(f)
|
||||
name = g.get('name', '')
|
||||
for peer in g.get('peers', []):
|
||||
if peer:
|
||||
print(f"{peer}:{name}")
|
||||
except:
|
||||
pass
|
||||
except:
|
||||
pass
|
||||
|
||||
def peer_groups(groups_dir, peer_name):
|
||||
"""Find all groups containing a peer"""
|
||||
import glob
|
||||
try:
|
||||
for group_file in glob.glob(f"{groups_dir}/*.group"):
|
||||
try:
|
||||
with open(group_file) as f:
|
||||
g = json.load(f)
|
||||
if peer_name in g.get('peers', []):
|
||||
print(g.get('name', ''))
|
||||
except:
|
||||
pass
|
||||
except:
|
||||
pass
|
||||
|
||||
def peer_data(clients_dir, meta_dir, events_log):
|
||||
import glob
|
||||
|
||||
meta = {}
|
||||
for f in glob.glob(f"{meta_dir}/*.meta"):
|
||||
name = os.path.basename(f).replace('.meta', '')
|
||||
try:
|
||||
with open(f) as mf:
|
||||
meta[name] = json.load(mf)
|
||||
except:
|
||||
meta[name] = {}
|
||||
|
||||
last_events = {}
|
||||
try:
|
||||
with open(events_log) as f:
|
||||
for line in f:
|
||||
try:
|
||||
e = json.loads(line.strip())
|
||||
client = e.get('client', '')
|
||||
if client:
|
||||
last_events[client] = e
|
||||
except:
|
||||
pass
|
||||
except:
|
||||
pass
|
||||
|
||||
for conf in sorted(glob.glob(f"{clients_dir}/*.conf")):
|
||||
name = os.path.basename(conf).replace('.conf', '')
|
||||
ip = ''
|
||||
try:
|
||||
with open(conf) as f:
|
||||
for line in f:
|
||||
if line.startswith('Address'):
|
||||
ip = line.split('=')[1].strip().split('/')[0]
|
||||
break
|
||||
except:
|
||||
pass
|
||||
|
||||
m = meta.get(name, {})
|
||||
rule = m.get('rule', '')
|
||||
subtype = m.get('subtype', '')
|
||||
|
||||
last_event = last_events.get(name, {})
|
||||
last_ts = last_event.get('timestamp', '') # raw ISO, no formatting
|
||||
last_evt = last_event.get('event', '') # fixed: was last_event
|
||||
|
||||
print(f"{name}|{ip}|{rule}|{subtype}|{last_ts}|{last_evt}")
|
||||
|
||||
def iso_to_ts(iso_str):
|
||||
"""Convert ISO timestamp to unix timestamp"""
|
||||
try:
|
||||
from datetime import datetime, timezone
|
||||
dt = datetime.fromisoformat(iso_str)
|
||||
if dt.tzinfo is None:
|
||||
dt = dt.replace(tzinfo=timezone.utc)
|
||||
print(int(dt.timestamp()))
|
||||
except:
|
||||
print(0)
|
||||
|
||||
def rule_list_data(rules_dir, meta_dir):
|
||||
"""Return all rule data for list display in one call"""
|
||||
import glob
|
||||
|
||||
# Count peers per rule from meta files
|
||||
rule_peer_counts = {}
|
||||
for f in glob.glob(f"{meta_dir}/*.meta"):
|
||||
try:
|
||||
with open(f) as mf:
|
||||
meta = json.load(mf)
|
||||
rule = meta.get('rule', '')
|
||||
if rule:
|
||||
rule_peer_counts[rule] = rule_peer_counts.get(rule, 0) + 1
|
||||
except:
|
||||
pass
|
||||
|
||||
# Read each rule file
|
||||
for rule_file in sorted(glob.glob(f"{rules_dir}/*.rule")):
|
||||
try:
|
||||
with open(rule_file) as f:
|
||||
r = json.load(f)
|
||||
name = r.get('name', '')
|
||||
desc = r.get('desc', '')
|
||||
n_allows = len(r.get('allow_ips', [])) + len(r.get('allow_ports', []))
|
||||
n_blocks = len(r.get('block_ips', [])) + len(r.get('block_ports', []))
|
||||
peer_count = rule_peer_counts.get(name, 0)
|
||||
print(f"{name}|{desc}|{n_allows}|{n_blocks}|{peer_count}")
|
||||
except:
|
||||
pass
|
||||
|
||||
def group_list_data(groups_dir, blocks_dir):
|
||||
"""Return group summary data in one call"""
|
||||
import glob
|
||||
|
||||
# Get all block files
|
||||
blocked_peers = set()
|
||||
for f in glob.glob(f"{blocks_dir}/*.block"):
|
||||
name = os.path.basename(f).replace('.block', '')
|
||||
blocked_peers.add(name)
|
||||
|
||||
for group_file in sorted(glob.glob(f"{groups_dir}/*.group")):
|
||||
try:
|
||||
with open(group_file) as f:
|
||||
g = json.load(f)
|
||||
name = g.get('name', '')
|
||||
desc = g.get('desc', '')
|
||||
peers = [p for p in g.get('peers', []) if p]
|
||||
total = len(peers)
|
||||
blocked = sum(1 for p in peers if p in blocked_peers)
|
||||
print(f"{name}|{desc}|{total}|{blocked}")
|
||||
except:
|
||||
pass
|
||||
|
||||
def fmt_datetime(iso_str, fmt):
|
||||
"""Format ISO timestamp with given strftime format"""
|
||||
try:
|
||||
from datetime import datetime
|
||||
dt = datetime.fromisoformat(iso_str)
|
||||
print(dt.strftime(fmt))
|
||||
except:
|
||||
print(iso_str)
|
||||
|
||||
def create_rule(file, name, desc, dns_redirect, allow_ips, block_ips, block_ports):
|
||||
rule = {
|
||||
'name': name,
|
||||
'desc': desc,
|
||||
'dns_redirect': dns_redirect == 'true',
|
||||
'allow_ips': [x for x in allow_ips.split(',') if x] if allow_ips else [],
|
||||
'block_ips': [x for x in block_ips.split(',') if x] if block_ips else [],
|
||||
'block_ports': [x for x in block_ports.split(',') if x] if block_ports else [],
|
||||
'allow_ports': []
|
||||
}
|
||||
with open(file, 'w') as f:
|
||||
json.dump(rule, f, indent=2)
|
||||
|
||||
def cleanup_config(config_file):
|
||||
"""Normalize blank lines in WireGuard config"""
|
||||
import re
|
||||
try:
|
||||
with open(config_file) as f:
|
||||
config = f.read()
|
||||
config = re.sub(r'\n{3,}', '\n\n', config)
|
||||
config = config.rstrip('\n') + '\n'
|
||||
with open(config_file, 'w') as f:
|
||||
f.write(config)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def remove_peer_block(config_file, name):
|
||||
"""Remove a peer block from WireGuard config by name"""
|
||||
import re
|
||||
try:
|
||||
with open(config_file) as f:
|
||||
config = f.read()
|
||||
pattern = r'\n\[Peer\]\n# ' + re.escape(name) + r'\n[^\n]+\n[^\n]+\n'
|
||||
result = re.sub(pattern, '\n', config)
|
||||
with open(config_file, 'w') as f:
|
||||
f.write(result)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def create_group(file, name, desc):
|
||||
"""Create a new group JSON file"""
|
||||
try:
|
||||
group = {'name': name, 'desc': desc, 'peers': []}
|
||||
with open(file, 'w') as f:
|
||||
json.dump(group, f, indent=2)
|
||||
except Exception as e:
|
||||
print(f"Error: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
def parse_event(line):
|
||||
"""Parse a single JSON event line"""
|
||||
try:
|
||||
e = json.loads(line)
|
||||
print(f"{e.get('timestamp','')}|{e.get('client','')}|{e.get('endpoint','')}|{e.get('event','')}")
|
||||
except:
|
||||
pass
|
||||
|
||||
def parse_fw_event(line):
|
||||
"""Parse a single fw_events.log JSON line"""
|
||||
try:
|
||||
e = json.loads(line)
|
||||
ts = e.get('timestamp', '')
|
||||
src = e.get('src_ip', '')
|
||||
dst = e.get('dest_ip', '')
|
||||
port = e.get('dest_port', '')
|
||||
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
|
||||
proto_num = e.get('ip.protocol', 0)
|
||||
proto = proto_map.get(proto_num, str(proto_num))
|
||||
print(f"{ts}|{src}|{dst}|{port}|{proto}")
|
||||
except:
|
||||
pass
|
||||
|
||||
def peer_transfer(wg_interface):
|
||||
"""Get transfer bytes per peer from wg show"""
|
||||
import subprocess
|
||||
try:
|
||||
result = subprocess.run(
|
||||
['wg', 'show', wg_interface, 'transfer'],
|
||||
capture_output=True, text=True
|
||||
)
|
||||
for line in result.stdout.strip().split('\n'):
|
||||
if not line:
|
||||
continue
|
||||
parts = line.split('\t')
|
||||
if len(parts) == 3:
|
||||
pubkey, rx, tx = parts
|
||||
total = int(rx) + int(tx)
|
||||
if total == 0:
|
||||
level = 'none'
|
||||
elif total < 1_000_000:
|
||||
level = 'low'
|
||||
elif total < 10_000_000:
|
||||
level = 'medium'
|
||||
elif total < 100_000_000:
|
||||
level = 'high'
|
||||
else:
|
||||
level = 'very high'
|
||||
print(f"{pubkey}|{rx}|{tx}|{level}")
|
||||
except:
|
||||
pass
|
||||
|
||||
commands = {
|
||||
'get': lambda args: get(args[0], args[1]),
|
||||
'set': lambda args: set_key(args[0], args[1], args[2]),
|
||||
'delete': lambda args: delete_key(args[0], args[1]),
|
||||
'append': lambda args: append(args[0], args[1], args[2]),
|
||||
'remove': lambda args: remove_value(args[0], args[1], args[2]),
|
||||
'cat': lambda args: cat(args[0]),
|
||||
'has_key': lambda args: has_key(args[0], args[1]),
|
||||
'filter_values': lambda args: filter_values(args[0], args[1], args[2]),
|
||||
'last_event': lambda args: last_event(args[0], args[1], args[2], args[3]),
|
||||
'events_for': lambda args: events_for(args[0], args[1], args[2]),
|
||||
'fw_events': lambda args: fw_events(args[0], args[1], args[2], args[3], args[4]),
|
||||
'wg_events': lambda args: wg_events(args[0], args[1], args[2], args[3]),
|
||||
'format_fw_event': lambda args: format_fw_event(sys.stdin.read(), args[0]),
|
||||
'format_wg_event': lambda args: format_wg_event(sys.stdin.read()),
|
||||
'remove_events': lambda args: remove_events(args[0], args[1]),
|
||||
'follow_logs': lambda args: follow_logs(args[0], args[1], args[2], args[3], args[4], args[5]),
|
||||
'count': lambda args: count(args[0], args[1]),
|
||||
'audit_fw_counts': lambda args: audit_fw_counts(args[0]),
|
||||
'peer_group_map': lambda args: peer_group_map(args[0]),
|
||||
'peer_groups': lambda args: peer_groups(args[0], args[1]),
|
||||
'peer_data': lambda args: peer_data(args[0], args[1], args[2]),
|
||||
'iso_to_ts': lambda args: iso_to_ts(args[0]),
|
||||
'rule_list_data': lambda args: rule_list_data(args[0], args[1]),
|
||||
'group_list_data': lambda args: group_list_data(args[0], args[1]),
|
||||
'fmt_datetime': lambda args: fmt_datetime(args[0], args[1]),
|
||||
'create_rule': lambda args: create_rule(args[0], args[1], args[2], args[3], args[4], args[5], args[6]),
|
||||
'cleanup_config': lambda args: cleanup_config(args[0]),
|
||||
'remove_peer_block': lambda args: remove_peer_block(args[0], args[1]),
|
||||
'create_group': lambda args: create_group(args[0], args[1], args[2]),
|
||||
'parse_event': lambda args: parse_event(args[0]),
|
||||
'parse_fw_event': lambda args: parse_fw_event(args[0]),
|
||||
'peer_transfer': lambda args: peer_transfer(args[0]),
|
||||
}
|
||||
|
||||
if __name__ == '__main__':
|
||||
if len(sys.argv) < 2:
|
||||
print("Usage: json_helper.py <command> <file> [key] [value]", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
cmd = sys.argv[1]
|
||||
args = sys.argv[2:]
|
||||
|
||||
if cmd not in commands:
|
||||
print(f"Unknown command: {cmd}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
commands[cmd](args)
|
||||
|
|
@ -1,109 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# ============================================
|
||||
# Lifecycle
|
||||
# ============================================
|
||||
|
||||
function config::on_load() {
|
||||
config::validate
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Server
|
||||
# ============================================
|
||||
|
||||
WG_INTERFACE="wg0"
|
||||
WG_CONFIG="$(ctx::wg)/${WG_INTERFACE}.conf"
|
||||
WG_SERVER_PUBLIC_KEY_FILE="$(ctx::wg)/server_public.key"
|
||||
WG_SERVER_PRIVATE_KEY_FILE="$(ctx::wg)/server_private.key"
|
||||
WG_ENDPOINT="wg.krilio.net:51820"
|
||||
WG_DNS="10.0.0.103"
|
||||
WG_LISTEN_PORT="51820"
|
||||
WG_SUBNET="10.1.0.0/16"
|
||||
|
||||
# ============================================
|
||||
# Device Type → Subnet Mapping
|
||||
# ============================================
|
||||
|
||||
declare -gA DEVICE_SUBNETS=(
|
||||
[desktop]="10.1.1"
|
||||
[laptop]="10.1.2"
|
||||
[phone]="10.1.3"
|
||||
[tablet]="10.1.4"
|
||||
[guest]="10.1.100"
|
||||
)
|
||||
|
||||
# ============================================
|
||||
# Device Type → Default AllowedIPs
|
||||
# ============================================
|
||||
|
||||
declare -gA DEVICE_ALLOWED_IPS=(
|
||||
[desktop]="0.0.0.0/0"
|
||||
[laptop]="0.0.0.0/0"
|
||||
[phone]="0.0.0.0/0"
|
||||
[tablet]="0.0.0.0/0"
|
||||
[guest]="0.0.0.0/0"
|
||||
)
|
||||
|
||||
# ============================================
|
||||
# Accessors
|
||||
# ============================================
|
||||
|
||||
function config::interface() { echo "$WG_INTERFACE"; }
|
||||
function config::config_file() { echo "$WG_CONFIG"; }
|
||||
function config::endpoint() { echo "$WG_ENDPOINT"; }
|
||||
function config::dns() { echo "$WG_DNS"; }
|
||||
function config::listen_port() { echo "$WG_LISTEN_PORT"; }
|
||||
function config::subnet() { echo "$WG_SUBNET"; }
|
||||
|
||||
function config::server_public_key() {
|
||||
cat "$WG_SERVER_PUBLIC_KEY_FILE"
|
||||
}
|
||||
|
||||
function config::device_types() {
|
||||
local types
|
||||
{ set +u; types="${!DEVICE_SUBNETS[@]}"; set -u; }
|
||||
echo "$types"
|
||||
}
|
||||
|
||||
function config::is_valid_type() {
|
||||
local type="$1"
|
||||
local subnet
|
||||
subnet=$(config::subnet_for "$type")
|
||||
[[ -n "$subnet" ]]
|
||||
}
|
||||
|
||||
function config::subnet_for() {
|
||||
local type="$1"
|
||||
local result
|
||||
{ set +u; result="${DEVICE_SUBNETS[$type]:-}"; set -u; }
|
||||
echo "$result"
|
||||
}
|
||||
|
||||
function config::allowed_ips_for() {
|
||||
local type="$1"
|
||||
local result
|
||||
{ set +u; result="${DEVICE_ALLOWED_IPS[$type]:-0.0.0.0/0}"; set -u; }
|
||||
echo "$result"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Validation
|
||||
# ============================================
|
||||
|
||||
function config::validate() {
|
||||
if [[ ! -f "$WG_SERVER_PUBLIC_KEY_FILE" ]]; then
|
||||
log::error "Server public key not found: ${WG_SERVER_PUBLIC_KEY_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$WG_SERVER_PRIVATE_KEY_FILE" ]]; then
|
||||
log::error "Server private key not found: ${WG_SERVER_PRIVATE_KEY_FILE}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$WG_CONFIG" ]]; then
|
||||
log::error "WireGuard config not found: ${WG_CONFIG}"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
|
@ -1,326 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# ============================================
|
||||
# Core
|
||||
# ============================================
|
||||
|
||||
LOG_LEVEL=${LOG_LEVEL:-INFO}
|
||||
|
||||
# ============================================
|
||||
# Internal
|
||||
# ============================================
|
||||
|
||||
function internal::get_log_priority() {
|
||||
case "$1" in
|
||||
DEBUG) echo 0 ;;
|
||||
INFO) echo 1 ;;
|
||||
SUCCESS) echo 1 ;; # FIX: SUCCESS is informational, not above ERROR
|
||||
WARN) echo 2 ;;
|
||||
ERROR) echo 3 ;;
|
||||
*) echo 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
function internal::log() {
|
||||
local level="$1"
|
||||
shift
|
||||
|
||||
local current_priority
|
||||
local message_priority
|
||||
|
||||
current_priority=$(internal::get_log_priority "$LOG_LEVEL")
|
||||
message_priority=$(internal::get_log_priority "$level")
|
||||
|
||||
if (( message_priority < current_priority )); then
|
||||
return 0
|
||||
fi
|
||||
|
||||
local color
|
||||
case "$level" in
|
||||
DEBUG) color="\033[0;36m" ;; # FIX: actual cyan (was white \033[0;37m)
|
||||
INFO) color="\033[1;34m" ;; # blue
|
||||
WARN) color="\033[1;33m" ;; # yellow
|
||||
ERROR) color="\033[1;31m" ;; # red
|
||||
SUCCESS) color="\033[1;32m" ;; # green
|
||||
esac
|
||||
|
||||
echo -e "${color}=> ${level}:\033[0m $*"
|
||||
}
|
||||
|
||||
function internal::icon() {
|
||||
local context="$1"
|
||||
local action="$2"
|
||||
|
||||
case "$context:$action" in
|
||||
docker:log) echo "🐳 " ;;
|
||||
docker:start) echo "🟢 🐳 " ;;
|
||||
docker:stop) echo "🔴 🐳 " ;;
|
||||
docker:success) echo "✅ 🐳 " ;;
|
||||
docker:warning) echo "⚠️ 🐳 " ;;
|
||||
docker:error) echo "❌ 🐳 " ;;
|
||||
docker:logs) echo "📜 🐳 " ;;
|
||||
docker:list) echo "🔍 🐳 " ;;
|
||||
docker:build) echo "📦 🐳 " ;;
|
||||
|
||||
build:log) echo "🏗️ " ;;
|
||||
build:start) echo "🟢 🏗️ " ;;
|
||||
build:stop) echo "🔴 🏗️ " ;;
|
||||
build:success) echo "✅ 🏗️ " ;;
|
||||
build:warning) echo "⚠️ 🏗️ " ;;
|
||||
build:error) echo "❌ 🏗️ " ;;
|
||||
|
||||
network:log) echo "🌐 " ;;
|
||||
network:setup) echo "⚙️ 🌐 " ;;
|
||||
network:stop) echo "🔴 🌐 " ;;
|
||||
network:success) echo "✅ 🌐 " ;;
|
||||
network:warning) echo "⚠️ 🌐 " ;;
|
||||
network:error) echo "❌ 🌐 " ;;
|
||||
|
||||
auth:log) echo "🔑 " ;;
|
||||
auth:setup) echo "⚙️ 🔑 " ;;
|
||||
auth:login) echo "🔐 🔑 " ;;
|
||||
auth:success) echo "✅ 🔑 " ;;
|
||||
auth:warning) echo "⚠️ 🔑 " ;;
|
||||
auth:error) echo "❌ 🔑 " ;;
|
||||
|
||||
env:log) echo "⚙️ " ;;
|
||||
env:load) echo "📥 ⚙️ " ;;
|
||||
env:success) echo "✅ ⚙️ " ;;
|
||||
env:warning) echo "⚠️ ⚙️ " ;;
|
||||
env:error) echo "❌ ⚙️ " ;;
|
||||
|
||||
fs:log) echo "📁 " ;;
|
||||
fs:read) echo "📥 📁 " ;;
|
||||
fs:write) echo "📤 📁 " ;;
|
||||
fs:success) echo "✅ 📁 " ;;
|
||||
fs:warning) echo "⚠️ 📁 " ;;
|
||||
fs:error) echo "❌ 📁 " ;;
|
||||
|
||||
db:log) echo "🗄️ " ;;
|
||||
db:start) echo "🟢 🗄️ " ;;
|
||||
db:migrate) echo "📜 🗄️ " ;;
|
||||
db:success) echo "✅ 🗄️ " ;;
|
||||
db:warning) echo "⚠️ 🗄️ " ;;
|
||||
db:error) echo "❌ 🗄️ " ;;
|
||||
|
||||
# ADDED: WireGuard context
|
||||
wg:log) echo "🔒 " ;;
|
||||
wg:start) echo "🟢 🔒 " ;;
|
||||
wg:stop) echo "🔴 🔒 " ;;
|
||||
wg:add) echo "➕ 🔒 " ;;
|
||||
wg:remove) echo "➖ 🔒 " ;;
|
||||
wg:block) echo "🚫 🔒 " ;;
|
||||
wg:unblock) echo "✅ 🔒 " ;;
|
||||
wg:key) echo "🔑 🔒 " ;;
|
||||
wg:success) echo "✅ 🔒 " ;;
|
||||
wg:warning) echo "⚠️ 🔒 " ;;
|
||||
wg:error) echo "❌ 🔒 " ;;
|
||||
wg:list) echo "🔍 🔒 " ;;
|
||||
wg:qr) echo "📱 🔒 " ;;
|
||||
wg:preset) echo "📋 🔒 " ;;
|
||||
|
||||
log:info) echo "🔹 " ;;
|
||||
log:warn) echo "⚠️ " ;;
|
||||
log:error) echo "❌ " ;;
|
||||
log:success) echo "✅ " ;;
|
||||
log:debug) echo "🔍 " ;; # FIX: was missing, caused fallthrough
|
||||
|
||||
*) echo "🔹" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
function internal::get_context_icon() {
|
||||
case "$1" in
|
||||
docker) echo "🐳" ;;
|
||||
build) echo "🏗️" ;;
|
||||
network) echo "🌐" ;;
|
||||
auth) echo "🔑" ;;
|
||||
env) echo "⚙️" ;;
|
||||
fs) echo "📁" ;;
|
||||
db) echo "🗄️" ;;
|
||||
wg) echo "🔒" ;; # ADDED: missing from original
|
||||
log) echo "🔹" ;; # ADDED: missing from original
|
||||
*) echo "🔹" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Loggers
|
||||
# ============================================
|
||||
|
||||
function internal::log::info() { internal::log INFO "$*"; }
|
||||
function internal::log::warn() { internal::log WARN "$*"; }
|
||||
function internal::log::error() { internal::log ERROR "$*"; }
|
||||
function internal::log::success() { internal::log SUCCESS "$*"; }
|
||||
function internal::log::debug() { internal::log DEBUG "$*"; }
|
||||
|
||||
# ============================================
|
||||
# Context Loggers
|
||||
# ============================================
|
||||
|
||||
function log::context() {
|
||||
local context="$1"
|
||||
local action="$2"
|
||||
shift 2
|
||||
internal::log::info "$(internal::icon "$context" "$action") $*"
|
||||
}
|
||||
|
||||
function log::warn_context() {
|
||||
local context="$1"
|
||||
local action="$2"
|
||||
shift 2
|
||||
internal::log::warn "$(internal::icon "$context" "$action") $*"
|
||||
}
|
||||
|
||||
function log::error_context() {
|
||||
local context="$1"
|
||||
local action="$2"
|
||||
shift 2
|
||||
internal::log::error "$(internal::icon "$context" "$action") $*"
|
||||
}
|
||||
|
||||
function log::success_context() {
|
||||
local context="$1"
|
||||
local action="$2"
|
||||
shift 2
|
||||
internal::log::success "$(internal::icon "$context" "$action") $*"
|
||||
}
|
||||
|
||||
function log::debug_context() {
|
||||
local context="$1"
|
||||
local action="$2"
|
||||
shift 2
|
||||
internal::log::debug "$(internal::icon "$context" "$action") $*"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Logger Helpers
|
||||
# ============================================
|
||||
|
||||
function log::info() { log::context log info "$@"; }
|
||||
function log::warn() { log::warn_context log warn "$@"; }
|
||||
function log::error() { log::error_context log error "$@"; }
|
||||
function log::success() { log::success_context log success "$@"; }
|
||||
function log::debug() { log::debug_context log debug "$@"; } # FIX: was calling warn_context
|
||||
|
||||
# ADDED: section separator for visual grouping in output
|
||||
function log::section() {
|
||||
local label="$1"
|
||||
local width=48
|
||||
local line
|
||||
line=$(printf '─%.0s' $(seq 1 $width))
|
||||
echo -e "\n\033[1;34m${line}\033[0m"
|
||||
echo -e "\033[1;34m $label\033[0m"
|
||||
echo -e "\033[1;34m${line}\033[0m"
|
||||
}
|
||||
|
||||
function log::docker() { log::context docker log "$@"; }
|
||||
function log::docker_start() { log::context docker start "$@"; }
|
||||
function log::docker_stop() { log::context docker stop "$@"; }
|
||||
function log::docker_success() { log::success_context docker success "$@"; } # FIX: was using context not success_context
|
||||
function log::docker_logs() { log::context docker logs "$@"; }
|
||||
function log::docker_list() { log::context docker list "$@"; }
|
||||
function log::docker_build() { log::context docker build "$@"; }
|
||||
function log::docker_warning() { log::warn_context docker warning "$@"; }
|
||||
function log::docker_error() { log::error_context docker error "$@"; }
|
||||
|
||||
function log::build() { log::context build log "$@"; }
|
||||
function log::build_start() { log::context build start "$@"; }
|
||||
function log::build_stop() { log::context build stop "$@"; }
|
||||
function log::build_success() { log::success_context build success "$@"; }
|
||||
function log::build_warning() { log::warn_context build warning "$@"; }
|
||||
function log::build_error() { log::error_context build error "$@"; }
|
||||
|
||||
function log::network() { log::context network log "$@"; }
|
||||
function log::network_setup() { log::context network setup "$@"; }
|
||||
function log::network_stop() { log::context network stop "$@"; }
|
||||
function log::network_success() { log::success_context network success "$@"; }
|
||||
function log::network_warning() { log::warn_context network warning "$@"; }
|
||||
function log::network_error() { log::error_context network error "$@"; }
|
||||
|
||||
function log::auth() { log::context auth log "$@"; }
|
||||
function log::auth_setup() { log::context auth setup "$@"; }
|
||||
function log::auth_login() { log::context auth login "$@"; }
|
||||
function log::auth_success() { log::success_context auth success "$@"; }
|
||||
function log::auth_warning() { log::warn_context auth warning "$@"; }
|
||||
function log::auth_error() { log::error_context auth error "$@"; }
|
||||
|
||||
function log::env() { log::context env log "$@"; }
|
||||
function log::env_load() { log::context env load "$@"; }
|
||||
function log::env_success() { log::success_context env success "$@"; }
|
||||
function log::env_warning() { log::warn_context env warning "$@"; }
|
||||
function log::env_error() { log::error_context env error "$@"; }
|
||||
|
||||
function log::fs() { log::context fs log "$@"; }
|
||||
function log::fs_read() { log::context fs read "$@"; }
|
||||
function log::fs_write() { log::context fs write "$@"; }
|
||||
function log::fs_success() { log::success_context fs success "$@"; }
|
||||
function log::fs_warning() { log::warn_context fs warning "$@"; }
|
||||
function log::fs_error() { log::error_context fs error "$@"; }
|
||||
|
||||
function log::db() { log::context db log "$@"; }
|
||||
function log::db_start() { log::context db start "$@"; }
|
||||
function log::db_migrate() { log::context db migrate "$@"; }
|
||||
function log::db_success() { log::success_context db success "$@"; }
|
||||
function log::db_warning() { log::warn_context db warning "$@"; }
|
||||
function log::db_error() { log::error_context db error "$@"; }
|
||||
|
||||
# ADDED: WireGuard context helpers
|
||||
function log::wg() { log::context wg log "$@"; }
|
||||
function log::wg_start() { log::context wg start "$@"; }
|
||||
function log::wg_stop() { log::context wg stop "$@"; }
|
||||
function log::wg_add() { log::context wg add "$@"; }
|
||||
function log::wg_remove() { log::context wg remove "$@"; }
|
||||
function log::wg_block() { log::context wg block "$@"; }
|
||||
function log::wg_unblock() { log::context wg unblock "$@"; }
|
||||
function log::wg_key() { log::context wg key "$@"; }
|
||||
function log::wg_list() { log::context wg list "$@"; }
|
||||
function log::wg_qr() { log::context wg qr "$@"; }
|
||||
function log::wg_preset() { log::context wg preset "$@"; }
|
||||
function log::wg_success() { log::success_context wg success "$@"; }
|
||||
function log::wg_warning() { log::warn_context wg warning "$@"; }
|
||||
function log::wg_error() { log::error_context wg error "$@"; }
|
||||
|
||||
function log::run_step() {
|
||||
local context="$1"
|
||||
local mode="strict"
|
||||
local description
|
||||
|
||||
shift
|
||||
|
||||
if [[ "$1" == "soft" || "$1" == "strict" || "$1" == "info" ]]; then
|
||||
mode="$1"
|
||||
shift
|
||||
fi
|
||||
|
||||
description="$1"
|
||||
shift
|
||||
|
||||
local icon
|
||||
icon=$(internal::get_context_icon "$context")
|
||||
|
||||
if [[ "$mode" == "info" ]]; then
|
||||
internal::log::info "$icon $description"
|
||||
else
|
||||
internal::log::info "🔄 $icon $description"
|
||||
fi
|
||||
|
||||
"$@"
|
||||
local status=$?
|
||||
|
||||
if [[ $status -eq 0 ]]; then
|
||||
if [[ "$mode" == "info" ]]; then
|
||||
return 0
|
||||
fi
|
||||
internal::log::success "✅ $icon $description"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [[ "$mode" == "soft" || "$mode" == "info" ]]; then
|
||||
internal::log::warn "⚠️ $icon $description → skipped"
|
||||
return 0
|
||||
fi
|
||||
|
||||
internal::log::error "❌ $icon $description → failed"
|
||||
return $status
|
||||
}
|
||||
|
|
@ -1,192 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# ============================================
|
||||
# Client Config
|
||||
# ============================================
|
||||
|
||||
function peers::create_client_config() {
|
||||
local name="$1"
|
||||
local type="$2"
|
||||
local ip="$3"
|
||||
local allowed_ips="${4:-$(config::allowed_ips_for "$type")}"
|
||||
|
||||
local conf
|
||||
conf="$(ctx::clients)/${name}.conf"
|
||||
|
||||
if [[ -f "$conf" ]]; then
|
||||
log::wg_warning "Client config already exists: ${name}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local private_key
|
||||
private_key=$(keys::private "$name")
|
||||
|
||||
local server_public_key
|
||||
server_public_key=$(config::server_public_key)
|
||||
|
||||
cat > "$conf" <<EOF
|
||||
[Interface]
|
||||
PrivateKey = ${private_key}
|
||||
Address = ${ip}/32
|
||||
DNS = $(config::dns)
|
||||
|
||||
[Peer]
|
||||
PublicKey = ${server_public_key}
|
||||
Endpoint = $(config::endpoint)
|
||||
AllowedIPs = ${allowed_ips}
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
chmod 600 "$conf"
|
||||
log::wg_add "Created client config: ${name} (${ip})"
|
||||
}
|
||||
|
||||
function peers::remove_client_config() {
|
||||
local name="$1"
|
||||
local conf
|
||||
conf="$(ctx::clients)/${name}.conf"
|
||||
|
||||
if [[ ! -f "$conf" ]]; then
|
||||
log::wg_warning "Client config not found: ${name}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
rm -f "$conf"
|
||||
log::wg_remove "Removed client config: ${name}"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Server Config (wg0.conf) Peer Management
|
||||
# ============================================
|
||||
|
||||
function peers::cleanup_config() {
|
||||
local config
|
||||
config=$(config::config_file)
|
||||
|
||||
python3 -c "
|
||||
import re
|
||||
config = open('${config}').read()
|
||||
|
||||
# Normalize multiple blank lines to single blank line
|
||||
config = re.sub(r'\n{3,}', '\n\n', config)
|
||||
|
||||
# Ensure file ends with single newline
|
||||
config = config.rstrip('\n') + '\n'
|
||||
|
||||
open('${config}', 'w').write(config)
|
||||
"
|
||||
}
|
||||
|
||||
function peers::add_to_server() {
|
||||
local name="$1"
|
||||
local public_key="$2"
|
||||
local ip="$3"
|
||||
|
||||
local config
|
||||
config=$(config::config_file)
|
||||
|
||||
cat >> "$config" <<EOF
|
||||
|
||||
[Peer]
|
||||
# ${name}
|
||||
PublicKey = ${public_key}
|
||||
AllowedIPs = ${ip}/32
|
||||
EOF
|
||||
|
||||
log::wg_add "Added peer to server config: ${name}"
|
||||
}
|
||||
|
||||
function peers::remove_block() {
|
||||
local name="$1"
|
||||
local config
|
||||
config=$(config::config_file)
|
||||
|
||||
python3 -c "
|
||||
import re
|
||||
config = open('${config}').read()
|
||||
pattern = r'\n\[Peer\]\n# ${name}\n[^\n]+\n[^\n]+\n'
|
||||
result = re.sub(pattern, '\n', config)
|
||||
open('${config}', 'w').write(result)
|
||||
"
|
||||
}
|
||||
|
||||
function peers::remove_from_server() {
|
||||
local name="$1"
|
||||
peers::remove_block "$name"
|
||||
peers::cleanup_config
|
||||
log::wg_remove "Removed peer from server config: ${name}"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Listing
|
||||
# ============================================
|
||||
|
||||
function peers::list() {
|
||||
local dir
|
||||
dir="$(ctx::clients)"
|
||||
|
||||
if [[ -z "$(ls -A "$dir"/*.conf 2>/dev/null)" ]]; then
|
||||
log::wg_list "No clients configured"
|
||||
return 0
|
||||
fi
|
||||
|
||||
for conf in "${dir}"/*.conf; do
|
||||
local client_name
|
||||
client_name=$(basename "$conf" .conf)
|
||||
|
||||
local ip
|
||||
ip=$(grep "^Address" "$conf" | awk '{print $3}' | cut -d'/' -f1)
|
||||
|
||||
local public_key
|
||||
public_key=$(keys::public "$client_name" 2>/dev/null || echo "unknown")
|
||||
|
||||
# Determine type from IP
|
||||
local type="unknown"
|
||||
for t in $(config::device_types); do
|
||||
local subnet
|
||||
subnet=$(config::subnet_for "$t")
|
||||
if string::starts_with "$ip" "$subnet"; then
|
||||
type="$t"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
printf " %-30s %-15s %-10s %s\n" \
|
||||
"$client_name" "$ip" "$type" "$public_key"
|
||||
done
|
||||
}
|
||||
|
||||
function peers::list_by_type() {
|
||||
local filter_type="$1"
|
||||
local dir
|
||||
dir="$(ctx::clients)"
|
||||
|
||||
for conf in "${dir}"/*.conf; do
|
||||
local client_name
|
||||
client_name=$(basename "$conf" .conf)
|
||||
|
||||
local ip
|
||||
ip=$(grep "^Address" "$conf" | awk '{print $3}' | cut -d'/' -f1)
|
||||
|
||||
local subnet
|
||||
subnet=$(config::subnet_for "$filter_type")
|
||||
|
||||
if string::starts_with "$ip" "$subnet"; then
|
||||
printf " %-30s %-15s\n" "$client_name" "$ip"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
function peers::exists_in_server() {
|
||||
local name="$1"
|
||||
grep -q "^# ${name}$" "$(config::config_file)"
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# Live Reload
|
||||
# ============================================
|
||||
|
||||
function peers::reload() {
|
||||
wg syncconf "$(config::interface)" <(wg-quick strip "$(config::interface)")
|
||||
log::wg_success "WireGuard config reloaded"
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue