summaryrefslogtreecommitdiffhomepage
path: root/applications/luci-app-fwknopd/htdocs/luci-static/resources
diff options
context:
space:
mode:
Diffstat (limited to 'applications/luci-app-fwknopd/htdocs/luci-static/resources')
-rw-r--r--applications/luci-app-fwknopd/htdocs/luci-static/resources/view/fwknopd.js607
1 files changed, 607 insertions, 0 deletions
diff --git a/applications/luci-app-fwknopd/htdocs/luci-static/resources/view/fwknopd.js b/applications/luci-app-fwknopd/htdocs/luci-static/resources/view/fwknopd.js
new file mode 100644
index 0000000000..9a22690170
--- /dev/null
+++ b/applications/luci-app-fwknopd/htdocs/luci-static/resources/view/fwknopd.js
@@ -0,0 +1,607 @@
+'use strict';
+'require fs';
+'require dom';
+'require view';
+'require form';
+'require ui';
+'require tools.widgets as widgets';
+
+var domparser = new DOMParser();
+var QRCODE_VARIABLES = ['KEY_BASE64', 'KEY', 'HMAC_KEY_BASE64', 'HMAC_KEY'];
+var INVALID_KEYS = ['__CHANGEME__', 'CHANGEME'];
+
+function setOptionValue(map, section_id, option, value) {
+ var option = L.toArray(map.lookupOption(option, section_id))[0];
+ var uiEl = option ? option.getUIElement(section_id) : null;
+ if (uiEl)
+ uiEl.setValue(value);
+}
+
+function lines(content) {
+ return content.split(/\r?\n/);
+}
+
+function parseLine(rawLine) {
+ if (rawLine[0] != '#' && rawLine[0] != ';') {
+ var line = rawLine.split(/ ([^;]*)/, 2);
+ if (line.length == 2) {
+ var key = line[0].trim();
+ var value = line[1].trim();
+ if (key && value)
+ return [key, value];
+ }
+ }
+ return null;
+}
+
+function parseKeys(content) {
+ var l = lines(content);
+ var keys = {};
+ for (var i = 0; i < l.length; i++) {
+ var p = l[i].split(/:(.*)/, 2);
+ if (p.length == 2)
+ keys[p[0].trim()] = p[1].trim();
+ }
+ return keys;
+}
+
+var KeyTypeValue = form.ListValue.extend({
+ __init__: function() {
+ this.super('__init__', arguments);
+ this.hidden = false;
+ },
+
+ cfgvalue: function(section_id) {
+ for (var i = 0; i < this.keylist.length; i++) {
+ var value = this.map.data.get(
+ this.uciconfig || this.section.uciconfig || this.map.config,
+ this.ucisection || section_id,
+ this.keylist[i]
+ );
+ if (value)
+ return this.keylist[i];
+ }
+ return this.keylist[0];
+ },
+
+ render: function(section_id, option_index, cfgvalue) {
+ return this.super('render', arguments)
+ .then(L.bind(function(el) {
+ // Use direct style to hide, because class .hidden
+ // is used by this.isActive(). We want full functionality,
+ // but hidden field
+ if (this.hidden)
+ el.style.display = 'none';
+ return el;
+ }, this));
+ },
+
+ remove: function() {
+ // Ignore
+ },
+
+ write: function() {
+ // Ignore
+ },
+});
+
+var YNValue = form.Flag.extend({
+ __init__: function() {
+ this.super('__init__', arguments);
+ this.enabled = 'Y';
+ this.disabled = 'N';
+ this.default = 'N';
+ },
+
+ cfgvalue: function(section_id) {
+ var value = this.super('cfgvalue', arguments);
+ return value ? String(value).toUpperCase() : value;
+ },
+
+ parse: function(section_id) {
+ var active = this.isActive(section_id),
+ cval = this.cfgvalue(section_id),
+ fval = active ? this.formvalue(section_id) : null;
+
+ if (String(fval).toUpperCase() != cval) {
+ if (fval == 'Y')
+ return Promise.resolve(this.write(section_id, fval));
+ else if (cval !== undefined)
+ return Promise.resolve(this.remove(section_id));
+ }
+ },
+});
+
+var QrCodeValue = form.DummyValue.extend({
+ __init__: function() {
+ this.super('__init__', arguments);
+ this.needsRefresh = {};
+
+ this.components = [];
+ QRCODE_VARIABLES.forEach(L.bind(function(option) {
+ this.components.push(option);
+ var dep = {};
+ dep[option] = /.+/;
+ this.depends(dep);
+ }, this));
+ },
+
+ cfgQrCode: function(section_id) {
+ var qr = [];
+ for (var i = 0; i < this.components.length; i++) {
+ var value = this.map.data.get(
+ this.uciconfig || this.section.uciconfig || this.map.config,
+ this.ucisection || section_id,
+ this.components[i]
+ );
+
+ if (value)
+ qr.push(this.components[i] + ':' + value);
+ }
+ return qr ? qr.join(' ') : null;
+ },
+
+ formQrCode: function(section_id) {
+ var qr = [];
+ for (var i = 0; i < this.components.length; i++) {
+ var value = null;
+
+ var uiEl = L.toArray(this.map.lookupOption(this.components[i], section_id))[0];
+ if (uiEl) {
+ if (uiEl.isActive(section_id))
+ value = uiEl.formvalue(section_id);
+ }
+
+ if (value)
+ qr.push(this.components[i] + ':' + value);
+ }
+ return qr ? qr.join(' ') : null;
+ },
+
+ onchange: function(ev, section_id) {
+ if (this.needsRefresh[section_id] !== undefined)
+ this.needsRefresh[section_id] = true;
+ else {
+ this.refresh(section_id);
+ }
+ },
+
+ refresh: function(section_id) {
+ var qrcode = this.formQrCode(section_id);
+ var formvalue = this.formvalue(section_id);
+ if (formvalue != qrcode) {
+ this.getUIElement(section_id).setValue(qrcode);
+ var uiEl = document.getElementById(this.cbid(section_id));
+ if (uiEl) {
+ var contentEl = uiEl.nextSibling;
+ if (contentEl.childNodes.length == 1) {
+ dom.append(contentEl, E('em', { 'class': 'spinning', }, [ _('Loading…') ]));
+ }
+
+ this.needsRefresh[section_id] = false;
+
+ // Render QR code
+ return this.renderSvg(qrcode)
+ .then(L.bind(function(svgEl) {
+ dom.content(contentEl, svgEl || E('div'));
+
+ var needsAnotherRefresh = this.needsRefresh[section_id];
+ delete this.needsRefresh[section_id];
+
+ if (needsAnotherRefresh) {
+ this.refresh(section_id);
+ }
+ }, this)).finally(L.bind(function() {
+ if (this.needsRefresh[section_id] === undefined) {
+ if (contentEl.childNodes.length == 2)
+ contentEl.removeChild(contentEl.lastChild);
+ delete this.needsRefresh[section_id];
+ }
+ }, this)).catch(L.error);
+ }
+ }
+ // Nothing to render
+ return Promise.resolve(null);
+ },
+
+ renderWidget: function(section_id) {
+ var qrcode = this.cfgQrCode(section_id);
+ return this.renderSvg(qrcode)
+ .then(L.bind(function(svgEl) {
+ var uiEl = new ui.Hiddenfield(qrcode, { id: this.cbid(section_id) });
+ return E([
+ uiEl.render(),
+ E('div', {}, svgEl || E('div'))
+ ]);
+ }, this));
+ },
+
+ qrEncodeSvg: function(qrcode) {
+ return fs.exec('/usr/bin/qrencode', ['--type', 'svg', '--inline', '-o', '-', qrcode])
+ .then(function(response) {
+ return response.stdout;
+ });
+ },
+
+ renderSvg: function(qrcode) {
+ if (qrcode)
+ return this.qrEncodeSvg(qrcode)
+ .then(function(rawsvg) {
+ return domparser.parseFromString(rawsvg, 'image/svg+xml')
+ .querySelector('svg');
+ });
+ else
+ return Promise.resolve(null);
+ },
+});
+
+var GenerateButton = form.Button.extend({
+ __init__: function() {
+ this.super('__init__', arguments);
+ this.onclick = L.bind(this.generateKeys, this);
+ this.keytypes = {};
+ },
+
+ keytype: function(key, regex) {
+ this.keytypes[key] = regex;
+ },
+
+ qrcode: function(option) {
+ this.qrcode = option;
+ },
+
+ generateKeys: function(ev, section_id) {
+ return fs.exec('/usr/sbin/fwknopd', ['--key-gen'])
+ .then(function(response) { return parseKeys(response.stdout); })
+ .then(L.bind(this.applyKeys, this, section_id))
+ .catch(L.error);
+ },
+
+ applyKeys: function(section_id, keys) {
+ for (var key in keys) {
+ setOptionValue(this.map, section_id, key, keys[key]);
+ for (var type in this.keytypes) {
+ if (this.keytypes[type].test(key))
+ setOptionValue(this.map, section_id, type, key);
+ }
+ }
+
+ // Force update of dependencies (element visibility)
+ this.map.checkDepends();
+
+ // Refresh QR code
+ var option = L.toArray(this.map.lookupOption(this.qrcode, section_id))[0];
+ if (option)
+ return option.refresh(section_id);
+ else
+ return Promise.resolve(null);
+ },
+});
+
+var ParseButton = form.Button.extend({
+ __init__: function() {
+ this.super('__init__', arguments);
+ this.onclick = L.bind(this.parseAccessConf, this);
+ },
+
+ parseAccessConf: function() {
+ this.stanzas = [];
+ var ctx = {
+ processLine: L.bind(this.processAccessLine, this),
+ remainingLines: [],
+ stanzas: {
+ last: {},
+ all: []
+ }
+ };
+ return fs.read('/etc/fwknop/access.conf')
+ .then(L.bind(this.parseFile, this, ctx))
+ .then(L.bind(function() {
+ if (ctx.stanzas.all.length > 0)
+ return this.renderStanzas(ctx.stanzas.all)
+ .then(function(topEl) {
+ var dlg = ui.showModal(_('Firewall Knock Operator Daemon'), [
+ topEl,
+ E('button', {
+ 'class': 'cbi-button cbi-button-neutral',
+ 'click': ui.hideModal
+ }, _('Close'))
+ ], 'cbi-modal');
+ dlg.querySelector('button').focus();
+ dlg.parentNode.scrollTop = 0;
+ });
+ else {
+ var dlg = ui.showModal(_('Firewall Knock Operator Daemon'), [
+ E('p', _("No stanza found.")),
+ E('button', {
+ 'class': 'cbi-button cbi-button-neutral',
+ 'click': ui.hideModal
+ }, _('Close'))
+ ]);
+ dlg.querySelector('button').focus();
+ }
+ }, this))
+ .catch(function(err) {
+ L.error(err);
+ });
+ },
+
+ parseFile: function(ctx, content) {
+ ctx.remainingLines.unshift.apply(ctx.remainingLines, lines(content));
+ return this.parseLines(ctx);
+ },
+
+ parseFolder: function(ctx, folder, entries) {
+ // Parse and process files in order
+ var parseJobs = [];
+ var parsedLines = [];
+ entries.sort(function(el1, el2) {
+ return (el1.name > el2.name) ? 1
+ : (el1.name < el2.name) ? -1
+ : 0;
+ });
+ entries.forEach(L.bind(function(entry) {
+ var ctxLines = [];
+ parsedLines.unshift(ctxLines);
+ parseJobs.push(fs.read(folder + '/' + entry.name)
+ .then(function(content) {
+ ctxLines.push.apply(ctxLines, lines(content));
+ }));
+ }, this));
+ return Promise.all(parseJobs)
+ .then(L.bind(function(ctx) {
+ parsedLines.forEach(function(lines) {
+ ctx.remainingLines.unshift.apply(ctx.remainingLines, lines);
+ });
+ }, this, ctx))
+ .then(L.bind(this.parseLines, this, ctx));
+ },
+
+ parseLines: function(ctx) {
+ while (ctx.remainingLines.length > 0) {
+ var line = parseLine(ctx.remainingLines.shift());
+ if (line) {
+ var result = ctx.processLine.call(this, ctx, line[0], line[1]);
+ if (result)
+ return result;
+ }
+ }
+ },
+
+ processAccessLine: function(ctx, key, value) {
+ if (key.endsWith(':')) {
+ key = key.slice(0, -1);
+ }
+ if (key == "%include") {
+ return fs.read(value)
+ .then(L.bind(this.parseFile, this, ctx));
+ } else if (key == "%include_folder") {
+ return fs.list(value)
+ .then(L.bind(this.parseFolder, this, ctx, value));
+ } else if (key == "%include_keys") {
+ var keysCtx = {
+ processLine: L.bind(this.processKeysLine, this),
+ remainingLines: [],
+ stanzas: ctx.stanzas
+ };
+ return fs.read(value)
+ .then(L.bind(this.parseFile, this, keysCtx))
+ .then(L.bind(this.parseLines, this, ctx));
+ } else {
+ if (key == 'SOURCE') {
+ ctx.stanzas.last = {};
+ ctx.stanzas.all.push(ctx.stanzas.last);
+ }
+ ctx.stanzas.last[key] = value;
+ }
+ },
+
+ processKeysLine: function(ctx, key, value) {
+ // Simplification - accept only KEY arguments
+ if (ctx.stanzas.last && key.match(/KEY/))
+ ctx.stanzas.last[key] = value;
+ },
+
+ renderStanzas: function(stanzas) {
+ var svgJobs = [];
+ var config = {};
+ config.access = stanzas;
+
+ var m, s, o;
+
+ var accessSection;
+ var sourceValue;
+
+ m = new form.JSONMap(config, null, _('Custom configuration read from /etc/fwknop/access.conf.'));
+ m.readonly = true;
+
+ // set the access.conf settings
+ accessSection = s = m.section(form.TypedSection, 'access', _('access.conf stanzas'));
+ s.anonymous = true;
+
+ var qrCode = s.option(QrCodeValue, 'qr', _('QR code'), ('QR code to configure fwknopd Android application.'));
+
+ sourceValue = s.option(form.Value, 'SOURCE', 'SOURCE');
+ s.option(form.Value, 'DESTINATION', 'DESTINATION');
+
+ o = s.option(form.Value, 'KEY', 'KEY');
+ o.depends('keytype', 'KEY');
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The symmetric key has to be specified.');
+ }
+
+ o = s.option(form.Value, 'KEY_BASE64', 'KEY_BASE64');
+ o.depends('keytype', 'KEY_BASE64');
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The symmetric key has to be specified.');
+ }
+
+ o = s.option(KeyTypeValue, 'keytype');
+ o.value('KEY', _('Normal key'));
+ o.value('KEY_BASE64', _('Base64 key'));
+ o.hidden = true;
+
+ o = s.option(form.Value, 'HMAC_KEY', 'HMAC_KEY');
+ o.depends('hkeytype', 'HMAC_KEY');
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The HMAC authentication key has to be specified.');
+ }
+
+ o = s.option(form.Value, 'HMAC_KEY_BASE64', 'HMAC_KEY_BASE64');
+ o.depends('hkeytype', 'HMAC_KEY_BASE64');
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The HMAC authentication key has to be specified.');
+ }
+
+ o = s.option(KeyTypeValue, 'hkeytype');
+ o.value('HMAC_KEY', _('Normal key'));
+ o.value('HMAC_KEY_BASE64', _('Base64 key'));
+ o.hidden = true;
+
+ return m.load()
+ .then(L.bind(m.render, m));
+ }
+});
+
+return view.extend({
+
+ load: function() {
+ return Promise.all([
+ L.resolveDefault(fs.stat('/etc/fwknop/access.conf'))
+ ]);
+ },
+
+ render: function(results) {
+ var has_access_conf = results[0];
+ var m, s, o;
+
+ m = new form.Map('fwknopd', _('Firewall Knock Operator Daemon'));
+
+ s = m.section(form.TypedSection, 'global', _('Enable Uci/Luci control'));
+ s.anonymous = true;
+ s.option(form.Flag, 'uci_enabled', _('Enable config overwrite'), _('When unchecked, the config files in /etc/fwknopd will be used as is, ignoring any settings here.'));
+
+ if ( has_access_conf ) {
+ o = s.option(ParseButton, 'parse', _('Custom configuration'), _('Parses the /etc/fwknop/access.conf file (and \
+ included files/folders/keys) and generates QR codes for all found \
+ stanzas. Handles only files in /etc/fwknop folder due to access rights \
+ restrictions.'));
+ o.inputtitle = _("Show access.conf QR codes");
+ }
+
+ s = m.section(form.TypedSection, 'network', _('Network configuration'));
+ s.anonymous = true;
+ o = s.option(widgets.NetworkSelect, 'network', _('Network'), _('The network on which the daemon listens. The daemon \
+ is automatically started when the network is up-and-running. This option \
+ has precedence over “PCAP_INTF” option.'));
+ o.unpecified = true;
+ o.nocreate = true;
+ o.rmempty = true;
+
+ // set the access.conf settings
+ s = m.section(form.TypedSection, 'access', _('access.conf stanzas'));
+ s.anonymous = true;
+ s.addremove = true;
+
+ var qrCode = s.option(QrCodeValue, 'qr', _('QR code'), ('QR code to configure fwknopd Android application.'));
+
+ o = s.option(form.Value, 'SOURCE', 'SOURCE', _('The source address from which the SPA packet will be accepted. The string “ANY” is \
+ also accepted if a valid SPA packet should be honored from any source IP. \
+ Networks should be specified in CIDR notation (e.g. “192.168.10.0/24”), \
+ and individual IP addresses can be specified as well. Multiple entries \
+ are comma-separated.'));
+ o.validate = function(section_id, value) {
+ return String(value).length > 0 ? true : _('The source address has to be specified.');
+ }
+
+ s.option(form.Value, 'DESTINATION', 'DESTINATION', _('The destination address for which the SPA packet will be accepted. The \
+ string “ANY” is also accepted if a valid SPA packet should be honored to any \
+ destination IP. Networks should be specified in CIDR notation \
+ (e.g. “192.168.10.0/24”), and individual IP addresses can be specified as well. \
+ Multiple entries are comma-separated.'));
+
+ o = s.option(GenerateButton, 'keys', _('Generate keys'), _('Generates the symmetric key used for decrypting an incoming \
+ SPA packet, that is encrypted by the fwknop client with Rijndael block cipher, \
+ and HMAC authentication key used to verify the authenticity of the incoming SPA \
+ packet before the packet is decrypted.'));
+ o.inputtitle = _("Generate Keys");
+ o.keytype('keytype', /^KEY/);
+ o.keytype('hkeytype', /^HMAC_KEY/);
+ o.qrcode('qr');
+
+ o = s.option(form.Value, 'KEY', 'KEY', _('Define the symmetric key used for decrypting an incoming SPA \
+ packet that is encrypted by the fwknop client with Rijndael.'));
+ o.depends('keytype', 'KEY');
+ o.onchange = L.bind(qrCode.onchange, qrCode);
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The symmetric key has to be specified.');
+ }
+
+ o = s.option(form.Value, 'KEY_BASE64', 'KEY_BASE64', _('Define the symmetric key (in Base64 encoding) used for \
+ decrypting an incoming SPA packet that is encrypted by the fwknop client \
+ with Rijndael.'));
+ o.depends('keytype', 'KEY_BASE64');
+ o.onchange = L.bind(qrCode.onchange, qrCode);
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The symmetric key has to be specified.');
+ }
+
+ o = s.option(KeyTypeValue, 'keytype', _('Key type'));
+ o.value('KEY', _('Normal key'));
+ o.value('KEY_BASE64', _('Base64 key'));
+ o.onchange = L.bind(qrCode.onchange, qrCode);
+
+ o = s.option(form.Value, 'HMAC_KEY', 'HMAC_KEY', _('Define the HMAC authentication key used for verifying \
+ the authenticity of the SPA packet before the packet is decrypted.'));
+ o.depends('hkeytype', 'HMAC_KEY');
+ o.onchange = L.bind(qrCode.onchange, qrCode);
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The HMAC authentication key has to be specified.');
+ }
+
+ o = s.option(form.Value, 'HMAC_KEY_BASE64', 'HMAC_KEY_BASE64', _('Define the HMAC authentication key \
+ (in Base64 encoding) used for verifying the authenticity of the SPA \
+ packet before the packet is decrypted.'));
+ o.depends('hkeytype', 'HMAC_KEY_BASE64');
+ o.onchange = L.bind(qrCode.onchange, qrCode);
+ o.validate = function(section_id, value) {
+ return (String(value).length > 0 && !INVALID_KEYS.includes(value)) ? true : _('The HMAC authentication key has to be specified.');
+ }
+
+ o = s.option(KeyTypeValue, 'hkeytype', _('HMAC key type'));
+ o.value('HMAC_KEY', _('Normal key'));
+ o.value('HMAC_KEY_BASE64', _('Base64 key'));
+ o.onchange = L.bind(qrCode.onchange, qrCode);
+
+ o = s.option(form.Value, 'OPEN_PORTS', 'OPEN_PORTS', _('Define a set of ports and protocols (tcp or udp) that will be opened if a valid knock sequence is seen. \
+ If this entry is not set, fwknopd will attempt to honor any proto/port request specified in the SPA data \
+ (unless of it matches any “RESTRICT_PORTS” entries). Multiple entries are comma-separated.'));
+ o.placeholder = "protocol/port,...";
+
+ o = s.option(form.Value, 'RESTRICT_PORTS', 'RESTRICT_PORTS', _('Define a set of ports and protocols (tcp or udp) that are explicitly not allowed \
+ regardless of the validity of the incoming SPA packet. Multiple entries are comma-separated.'));
+ o.placeholder = "protocol/port,...";
+
+ o = s.option(form.Value, 'FW_ACCESS_TIMEOUT', 'FW_ACCESS_TIMEOUT', _('Define the length of time access will be granted by fwknopd through the firewall after a \
+ valid knock sequence from a source IP address. If “FW_ACCESS_TIMEOUT” is not set then the default \
+ timeout of 30 seconds will automatically be set.'));
+ o.placeholder = "30";
+
+ s.option(YNValue, 'REQUIRE_SOURCE_ADDRESS', 'REQUIRE_SOURCE_ADDRESS', _('Force all SPA packets to contain a real IP address within the encrypted data. \
+ This makes it impossible to use the -s command line argument on the fwknop client command line, so either -R \
+ has to be used to automatically resolve the external address (if the client behind a NAT) or the client must \
+ know the external IP and set it via the -a argument.'));
+ s.option(YNValue, 'ENABLE_CMD_EXEC', 'ENABLE_CMD_EXEC', _('This instructs fwknopd to accept complete commands that are contained within an authorization packet. \
+ Any such command will be executed on the fwknopd server as the user specified by the “CMD_EXEC_USER” or as the user \
+ that started fwknopd if that is not set.'));
+
+ s = m.section(form.TypedSection, 'config', _('fwknopd.conf config options'));
+ s.anonymous=true;
+ s.option(form.Value, 'MAX_SPA_PACKET_AGE', 'MAX_SPA_PACKET_AGE', _('Maximum age in seconds that an SPA packet will be accepted. Defaults to 120 seconds.'));
+ s.option(form.Value, 'PCAP_INTF', 'PCAP_INTF', _('Specify the ethernet interface on which fwknopd will sniff packets.'));
+ s.option(YNValue, 'ENABLE_IPT_FORWARDING', 'ENABLE_IPT_FORWARDING', _('Allow SPA clients to request access to services through an iptables firewall instead of just to it.'));
+ s.option(YNValue, 'ENABLE_NAT_DNS', 'ENABLE_NAT_DNS', _('Allow SPA clients to request forwarding destination by DNS name.'));
+
+ return m.render();
+ }
+});
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-10 02:05:49 +0000