diff --git a/backend/package-lock.json b/backend/package-lock.json index d764bb5..d497f79 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -17,7 +17,6 @@ "express": "^4.19.2", "express-rate-limit": "^6.11.2", "helmet": "^7.1.0", - "node-routeros": "^1.6.8", "pino": "^9.4.0", "pino-http": "^10.3.0", "prom-client": "^15.1.3" @@ -1990,6 +1989,7 @@ "version": "4.4.1", "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz", "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==", + "dev": true, "license": "MIT", "dependencies": { "ms": "^2.1.3" @@ -2631,16 +2631,6 @@ "node": ">= 0.6" } }, - "node_modules/node-routeros": { - "version": "1.6.8", - "resolved": "https://registry.npmjs.org/node-routeros/-/node-routeros-1.6.8.tgz", - "integrity": "sha512-6N1N60mAsT8ALpbURMuLVGZ1tJAYislu8n1KBZ1TFBFXKO92krz+U92+xdMhu09RfPh8QQ8CyI5Fp9UznruhkA==", - "license": "MIT", - "dependencies": { - "debug": "*", - "iconv-lite": "*" - } - }, "node_modules/nodemon": { "version": "3.1.10", "resolved": "https://registry.npmjs.org/nodemon/-/nodemon-3.1.10.tgz", diff --git a/backend/package.json b/backend/package.json index afcbf8d..1216f2c 100644 --- a/backend/package.json +++ b/backend/package.json @@ -24,7 +24,6 @@ "express": "^4.19.2", "express-rate-limit": "^6.11.2", "helmet": "^7.1.0", - "node-routeros": "^1.6.8", "pino": "^9.4.0", "pino-http": "^10.3.0", "prom-client": "^15.1.3" diff --git a/backend/routes/mikrotikConfigRoutes.js b/backend/routes/mikrotikConfigRoutes.js new file mode 100644 index 0000000..c21d105 --- /dev/null +++ b/backend/routes/mikrotikConfigRoutes.js @@ -0,0 +1,281 @@ +/** + * Роуты для генерации и применения конфигурации MikroTik + * Использует RouterOS REST API — требует RouterOS 7.1+ с www-ssl (443) или www (80) + */ + +const { GetObjectCommand } = require('@aws-sdk/client-s3'); +const { s3, BUCKET_NAME, streamToString, readS3TextObject } = require('../services/s3Service'); +const { sendError, sendOk } = require('../middleware/errorHandler'); +const { decrypt } = require('../utils/encryption'); +const { readServersFromS3 } = require('./serversRoutes'); +const { + buildMikrotikConfig, + buildMikrotikInterfaceBlocks, + buildMikrotikRecursiveRoutes, +} = require('../utils/mikrotikInterfaceGenerator'); +const { createRosClient, applyBlock } = require('../services/mikrotikApplyService'); + +const IPSEC_PASSWORDS_KEY = 'network-config/ipsec-passwords.json'; +const NETWORK_CONFIG_KEY = 'network-config.json'; + +/** Загрузить network-config из S3 */ +async function loadNetworkConfig() { + try { + const data = await s3.send(new GetObjectCommand({ Bucket: BUCKET_NAME, Key: NETWORK_CONFIG_KEY })); + const body = await streamToString(data.Body); + const parsed = JSON.parse(body || '{}'); + return parsed && typeof parsed === 'object' ? parsed : {}; + } catch (e) { + if (e?.name === 'NoSuchKey' || e?.$metadata?.httpStatusCode === 404) return {}; + throw e; + } +} + +/** Загрузить и расшифровать IPSec пароли → { id: password } */ +async function loadPasswordMap() { + const map = {}; + try { + const data = await readS3TextObject(IPSEC_PASSWORDS_KEY).catch(() => ({ body: '[]' })); + const passwords = JSON.parse(data.body || '[]'); + if (!Array.isArray(passwords)) return map; + for (const p of passwords) { + if (p.id && p.encryptedPassword) { + try { + map[p.id] = decrypt(p.encryptedPassword); + } catch (_) { + // пропускаем при ошибке расшифровки + } + } + } + } catch (_) {} + return map; +} + +/** Получить MikroTik credentials из сервера (jumphost) */ +function getMikrotikCredentials(server) { + if (!server || server.type !== 'jumphost') return null; + const host = server.mikrotikHost || server.ip || server.dns; + if (!host) return null; + const port = server.mikrotikPort; + // REST API: порт 80 (HTTP, www) или 443 (HTTPS, www-ssl). Если 8728 (старый API) — по умолчанию 443 + const restPort = (port === 80 || port === 443 || port === 8443) ? port : 443; + const user = server.mikrotikUser || 'admin'; + let password = ''; + if (server.encryptedMikrotikPassword) { + try { + password = decrypt(server.encryptedMikrotikPassword); + } catch (_) { + return null; + } + } + return { host, port: restPort, user, password, secure: false }; +} + +/** + * POST /api/mikrotik/generate + * Body: { format?, type?, serverId?, config?, servers? } + */ +async function generateMikrotikConfig(req, res) { + try { + const { format = 'text', type = 'all', serverId, config: bodyConfig, servers: bodyServers } = req.body || {}; + const fmt = String(format).toLowerCase(); + const typ = String(type).toLowerCase(); + + let config = bodyConfig; + let servers = bodyServers; + let passwordMap = {}; + + if (!config) config = await loadNetworkConfig(); + if (!Array.isArray(servers)) servers = await readServersFromS3(); + if (typ !== 'recursive') passwordMap = await loadPasswordMap(); + + const opts = { + format: fmt === 'json' ? 'json' : 'text', + serverId: serverId || undefined, + includeInterfaces: typ === 'interfaces' || typ === 'all', + includeRecursive: typ === 'recursive' || typ === 'all', + }; + + const blocks = await buildMikrotikConfig(config, servers, passwordMap, opts); + return res.json({ blocks }); + } catch (error) { + console.error('generateMikrotikConfig:', error); + return sendError(res, 500, error.message || 'Error generating config', 'E_GENERATE'); + } +} + +/** + * GET /api/mikrotik/generate-interfaces?format=text|json&serverId= + */ +async function generateInterfaces(req, res) { + try { + const format = (req.query.format || 'text').toLowerCase(); + const serverId = req.query.serverId || undefined; + + const config = await loadNetworkConfig(); + const servers = await readServersFromS3(); + const passwordMap = await loadPasswordMap(); + + const blocks = await buildMikrotikInterfaceBlocks(config, servers, passwordMap, { + format: format === 'json' ? 'json' : 'text', + serverId, + }); + return res.json({ blocks }); + } catch (error) { + console.error('generateInterfaces:', error); + return sendError(res, 500, error.message || 'Error generating interfaces', 'E_GENERATE'); + } +} + +/** + * GET /api/mikrotik/generate-recursive-routes?format=text|json&serverId= + */ +async function generateRecursiveRoutes(req, res) { + try { + const format = (req.query.format || 'text').toLowerCase(); + const serverId = req.query.serverId || undefined; + + const config = await loadNetworkConfig(); + const servers = await readServersFromS3(); + + const blocks = await buildMikrotikRecursiveRoutes(config, servers, { + format: format === 'json' ? 'json' : 'text', + serverId, + }); + return res.json({ blocks }); + } catch (error) { + console.error('generateRecursiveRoutes:', error); + return sendError(res, 500, error.message || 'Error generating routes', 'E_GENERATE'); + } +} + +/** + * POST /api/mikrotik/test-connection + * Body: { serverId } или { host, port?, user?, password } + */ +async function testMikrotikConnection(req, res) { + try { + const { serverId, host, port, user, password } = req.body || {}; + + let creds; + if (serverId) { + const servers = await readServersFromS3(); + const server = servers.find(s => (s.id || s.dns || s.ip) === serverId); + if (!server || server.type !== 'jumphost') { + return sendError(res, 400, 'Jumphost server not found', 'E_NOT_FOUND'); + } + creds = getMikrotikCredentials(server); + if (!creds) { + return sendError(res, 400, 'MikroTik credentials not configured', 'E_CREDENTIALS'); + } + } else if (host && user !== undefined) { + creds = { + host, + port: port || 443, + user, + password: password || '', + secure: false, + }; + } else { + return sendError(res, 400, 'Provide serverId or (host, user, password)', 'E_BAD_REQUEST'); + } + + const client = createRosClient(creds); + await client.print('system/resource'); + + return sendOk(res, { ok: true, message: 'Connection successful' }); + } catch (error) { + const msg = error.response?.data?.message || error.message || 'Connection failed'; + const status = error.response?.status; + console.error('testMikrotikConnection:', error); + return sendError(res, status && status >= 400 ? status : 502, msg, 'E_CONNECTION'); + } +} + +/** + * POST /api/mikrotik/apply + * Body: { serverId, type?: 'interfaces'|'recursive'|'all', dryRun?: boolean } + */ +async function applyMikrotikConfig(req, res) { + try { + const { serverId, type = 'all', dryRun = true } = req.body || {}; + if (!serverId) { + return sendError(res, 400, 'serverId is required', 'E_BAD_REQUEST'); + } + + const servers = await readServersFromS3(); + const server = servers.find(s => (s.id || s.dns || s.ip) === serverId); + if (!server || server.type !== 'jumphost') { + return sendError(res, 400, 'Jumphost server not found', 'E_NOT_FOUND'); + } + + const creds = getMikrotikCredentials(server); + if (!creds) { + return sendError(res, 400, 'MikroTik credentials not configured for this server', 'E_CREDENTIALS'); + } + + const config = await loadNetworkConfig(); + const passwordMap = await loadPasswordMap(); + + const typ = String(type).toLowerCase(); + const opts = { + format: 'json', + serverId, + includeInterfaces: typ === 'interfaces' || typ === 'all', + includeRecursive: typ === 'recursive' || typ === 'all', + }; + + const blocks = await buildMikrotikConfig(config, servers, passwordMap, opts); + const blocksWithOps = blocks.filter(b => Array.isArray(b.operations) && b.operations.length > 0); + + if (blocksWithOps.length === 0) { + return res.json({ + ok: true, + dryRun: !!dryRun, + summary: { created: 0, updated: 0, skipped: 0, errors: [] }, + results: [], + message: 'No operations to apply', + }); + } + + const client = createRosClient(creds); + const allResults = []; + const mikrotikRequests = []; + + for (const block of blocksWithOps) { + mikrotikRequests.push({ + block: block.type || 'unknown', + serverName: block.serverName, + operationCount: block.operations?.length || 0, + }); + const blockResults = await applyBlock(client, block, !!dryRun); + allResults.push({ block: block.type || block.serverName, results: blockResults }); + } + + const summary = { + created: allResults.flatMap(r => r.results).filter(r => r.status === 'created').length, + updated: allResults.flatMap(r => r.results).filter(r => r.status === 'updated').length, + skipped: allResults.flatMap(r => r.results).filter(r => r.status === 'skip' || r.status === 'skipped' || r.status === 'would_create' || r.status === 'would_update' || r.status === 'would_remove').length, + errors: allResults.flatMap(r => r.results).filter(r => r.status === 'error').map(r => r.error), + }; + + return res.json({ + ok: summary.errors.length === 0, + dryRun: !!dryRun, + summary, + results: allResults, + mikrotikRequests, + }); + } catch (error) { + console.error('applyMikrotikConfig:', error); + return sendError(res, 500, error.message || 'Error applying config', 'E_APPLY'); + } +} + +module.exports = { + generateMikrotikConfig, + generateInterfaces, + generateRecursiveRoutes, + testMikrotikConnection, + applyMikrotikConfig, +}; diff --git a/backend/services/mikrotikApplyService.js b/backend/services/mikrotikApplyService.js index 606eda9..011f5d4 100644 --- a/backend/services/mikrotikApplyService.js +++ b/backend/services/mikrotikApplyService.js @@ -1,58 +1,164 @@ /** - * Сервис применения конфигурации MikroTik через RouterOS API + * Сервис применения конфигурации MikroTik через RouterOS REST API * Идемпотентная логика: create / update / skip + * Требует RouterOS 7.1+ с www-ssl (HTTPS, порт 443) или www (HTTP, порт 80) */ -const { RouterOSAPI } = require('node-routeros'); +const http = require('http'); +const https = require('https'); /** - * Преобразование params в массив для node-routeros: ['=key=value', ...] + * Создать REST API клиент для MikroTik + * Поддерживает HTTP (порт 80) и HTTPS (порт 443) + * @param {object} opts - { host, port?, user, password, secure? } + * @returns {object} client с методами print, add, set, remove, command */ -function paramsToRosArray(params) { - if (!params || typeof params !== 'object') return []; - return Object.entries(params) - .filter(([, v]) => v != null && v !== '') - .map(([k, v]) => `=${k}=${String(v)}`); +function createRosClient(opts) { + const { host, port = 443, user, password, secure = false } = opts; + const useHttp = port === 80; + const protocol = useHttp ? http : https; + + const makeRequest = (method, urlPath, body = null) => { + return new Promise((resolve, reject) => { + const auth = Buffer.from(`${user}:${password || ''}`).toString('base64'); + const cleanPath = (urlPath.startsWith('/') ? urlPath.slice(1) : urlPath).replace(/\\/g, '/'); + const pathStr = `/rest/${cleanPath}`.replace(/\/+/g, '/'); + const options = { + hostname: host, + port, + path: pathStr, + method, + headers: { + 'Content-Type': 'application/json', + 'Accept': 'application/json', + 'Authorization': `Basic ${auth}`, + }, + rejectUnauthorized: secure, + }; + + const req = protocol.request(options, (res) => { + let data = ''; + res.on('data', (chunk) => { data += chunk; }); + res.on('end', () => { + if ([200, 201, 204].includes(res.statusCode)) { + const parsed = data ? (() => { try { return JSON.parse(data); } catch { return data; } })() : null; + resolve({ data: parsed, code: res.statusCode }); + } else { + let errMsg = res.statusMessage || 'Request failed'; + try { + const errBody = JSON.parse(data); + errMsg = errBody.detail || errBody.message || errMsg; + } catch (_) {} + const err = new Error(errMsg); + err.response = { status: res.statusCode, data }; + reject(err); + } + }); + }); + + req.on('error', reject); + if (body !== null && body !== undefined) { + req.write(JSON.stringify(body)); + } + req.end(); + }); + }; + + return { + print: (p) => makeRequest('GET', p), + add: (p, body) => makeRequest('PUT', p, body), + set: (p, body) => makeRequest('PATCH', p, body), + remove: (p) => makeRequest('DELETE', p), + command: (p, body) => makeRequest('POST', p, body), + }; +} + +/** + * Нормализовать path: убрать ведущий слэш + */ +function normalizePath(path) { + return (path || '').replace(/^\//, ''); } /** * Выполнить print с фильтром - * @param {object} conn - RouterOSAPI instance - * @param {string} path - e.g. '/interface/gre' - * @param {object} filter - e.g. { name: 'gre1' } + * @param {object} client - ros-rest client + * @param {string} path - e.g. '/interface/gre' или 'interface/gre' + * @param {object} filter - e.g. { name: 'gre1' } или { '~comment': 'Recursive' } */ -async function rosPrint(conn, path, filter = {}) { - const pathClean = path.replace(/^\//, '').replace(/\//g, '/'); - const fullPath = `/${pathClean}/print`; - const args = Object.entries(filter) - .filter(([, v]) => v != null && v !== '') - .map(([k, v]) => { - const key = k.startsWith('~') ? k.slice(1) : k; - const prefix = k.startsWith('~') ? '?~' : '?'; - return `${prefix}${key}=${String(v)}`; +async function rosPrint(client, path, filter = {}) { + const pathClean = normalizePath(path); + const entries = Object.entries(filter).filter(([, v]) => v != null && v !== ''); + let fullPath = pathClean; + if (entries.length > 0) { + const queryParts = entries.map(([k, v]) => { + const key = k.startsWith('~') ? `~${k.slice(1)}` : k; + return `${encodeURIComponent(key)}=${encodeURIComponent(String(v))}`; }); - const result = args.length > 0 ? await conn.write(fullPath, args) : await conn.write(fullPath); - return Array.isArray(result) ? result : []; + fullPath = `${pathClean}?${queryParts.join('&')}`; + } + try { + const res = await client.print(fullPath); + const data = res?.data; + return Array.isArray(data) ? data : (data ? [data] : []); + } catch (err) { + if (err?.response?.status === 404) return []; + throw err; + } +} + +/** + * Выполнить print с .query (для сложных фильтров вроде ~comment) + */ +async function rosPrintWithQuery(client, path, queryList) { + const pathClean = normalizePath(path); + const fullPath = `${pathClean}/print`; + try { + const res = await client.command(fullPath, { '.query': queryList }); + const data = res?.data; + return Array.isArray(data) ? data : (data ? [data] : []); + } catch (err) { + if (err?.response?.status === 404) return []; + throw err; + } } /** * Выполнить add */ -async function rosAdd(conn, path, params) { - const pathClean = path.replace(/^\//, '').replace(/\//g, '/'); - const fullPath = `/${pathClean}/add`; - const args = paramsToRosArray(params); - return conn.write(fullPath, args); +async function rosAdd(client, path, params) { + const pathClean = normalizePath(path); + const body = params && typeof params === 'object' + ? Object.fromEntries( + Object.entries(params).filter(([, v]) => v != null && v !== '').map(([k, v]) => [k, String(v)]) + ) + : {}; + const res = await client.add(pathClean, body); + return res?.data; } /** * Выполнить set */ -async function rosSet(conn, path, id, params) { - const pathClean = path.replace(/^\//, '').replace(/\//g, '/'); - const fullPath = `/${pathClean}/set`; - const args = [`.id=${id}`, ...paramsToRosArray(params)]; - return conn.write(fullPath, args); +async function rosSet(client, path, id, params) { + const pathClean = normalizePath(path); + const fullPath = id ? `${pathClean}/${id}` : pathClean; + const body = params && typeof params === 'object' + ? Object.fromEntries( + Object.entries(params).filter(([, v]) => v != null && v !== '').map(([k, v]) => [k, String(v)]) + ) + : {}; + const res = await client.set(fullPath, body); + return res?.data; +} + +/** + * Выполнить remove + */ +async function rosRemove(client, path, id) { + const pathClean = normalizePath(path); + const fullPath = id ? `${pathClean}/${id}` : pathClean; + await client.remove(fullPath); } /** @@ -72,12 +178,12 @@ function paramsMatch(rosItem, params, keysToCompare) { /** * Применить одну операцию с idempotent логикой */ -async function applyOperation(conn, op, dryRun) { +async function applyOperation(client, op, dryRun) { const { path, action, params, meta } = op; const result = { path, action, params: { ...params }, status: null, details: null, error: null }; if (path === '/interface/list' && action === 'add' && meta?.ensureExists) { - const existing = await rosPrint(conn, '/interface/list', { name: params.name }); + const existing = await rosPrint(client, '/interface/list', { name: params.name }); if (existing.length > 0) { result.status = 'skip'; result.details = 'Interface list already exists'; @@ -88,14 +194,14 @@ async function applyOperation(conn, op, dryRun) { result.details = `Would create interface list ${params.name}`; return result; } - await rosAdd(conn, '/interface/list', params); + await rosAdd(client, '/interface/list', params); result.status = 'created'; return result; } if (path === '/interface/gre' && action === 'add') { const name = params.name; - const existing = await rosPrint(conn, '/interface/gre', { name }); + const existing = await rosPrint(client, '/interface/gre', { name }); const compareKeys = ['remote-address', 'local-address', 'mtu', 'ipsec-secret', 'keepalive', 'allow-fast-path']; if (existing.length > 0) { const match = paramsMatch(existing[0], params, compareKeys); @@ -109,7 +215,7 @@ async function applyOperation(conn, op, dryRun) { result.details = `Would update interface ${name}`; return result; } - await rosSet(conn, '/interface/gre', existing[0]['.id'], params); + await rosSet(client, '/interface/gre', existing[0]['.id'], params); result.status = 'updated'; return result; } @@ -118,7 +224,7 @@ async function applyOperation(conn, op, dryRun) { result.details = `Would create GRE interface ${name}`; return result; } - await rosAdd(conn, '/interface/gre', params); + await rosAdd(client, '/interface/gre', params); result.status = 'created'; return result; } @@ -126,7 +232,7 @@ async function applyOperation(conn, op, dryRun) { if (path === '/interface/list/member' && action === 'add') { const iface = params.interface; const list = params.list; - const existing = await rosPrint(conn, '/interface/list/member', { list, interface: iface }); + const existing = await rosPrint(client, '/interface/list/member', { list, interface: iface }); if (existing.length > 0) { result.status = 'skip'; result.details = `Member ${iface} already in list ${list}`; @@ -137,7 +243,7 @@ async function applyOperation(conn, op, dryRun) { result.details = `Would add ${iface} to list ${list}`; return result; } - await rosAdd(conn, '/interface/list/member', params); + await rosAdd(client, '/interface/list/member', params); result.status = 'created'; return result; } @@ -145,7 +251,7 @@ async function applyOperation(conn, op, dryRun) { if (path === '/ip/address' && action === 'add') { const addr = params.address; const iface = params.interface; - const existing = await rosPrint(conn, '/ip/address', { interface: iface }); + const existing = await rosPrint(client, '/ip/address', { interface: iface }); const match = existing.find(e => (e.address || '').startsWith(addr.split('/')[0])); if (match) { result.status = 'skip'; @@ -157,14 +263,14 @@ async function applyOperation(conn, op, dryRun) { result.details = `Would add ${addr} to ${iface}`; return result; } - await rosAdd(conn, '/ip/address', params); + await rosAdd(client, '/ip/address', params); result.status = 'created'; return result; } if (path === '/ip/route') { if (action === 'remove' && meta?.findComment) { - const existing = await rosPrint(conn, '/ip/route', { '~comment': meta.findComment }); + const existing = await rosPrintWithQuery(client, '/ip/route', [`~comment=${meta.findComment}`]); const toRemove = existing; if (toRemove.length === 0) { result.status = 'skip'; @@ -177,7 +283,8 @@ async function applyOperation(conn, op, dryRun) { return result; } for (const r of toRemove) { - await conn.write('/ip/route/remove', [`.id=${r['.id']}`]); + const id = r['.id']; + if (id) await rosRemove(client, '/ip/route', id); } result.status = 'removed'; result.details = `${toRemove.length} route(s) removed`; @@ -186,7 +293,7 @@ async function applyOperation(conn, op, dryRun) { if (action === 'add') { const dst = params['dst-address']; const gw = params.gateway; - const existing = await rosPrint(conn, '/ip/route', { 'dst-address': dst }); + const existing = await rosPrint(client, '/ip/route', { 'dst-address': dst }); const match = existing.find(e => (e.gateway || '').includes((gw || '').split('%')[0])); if (match) { result.status = 'skip'; @@ -198,7 +305,7 @@ async function applyOperation(conn, op, dryRun) { result.details = `Would add route ${dst} via ${gw}`; return result; } - await rosAdd(conn, '/ip/route', params); + await rosAdd(client, '/ip/route', params); result.status = 'created'; return result; } @@ -212,12 +319,12 @@ async function applyOperation(conn, op, dryRun) { /** * Применить блок операций к MikroTik */ -async function applyBlock(conn, block, dryRun) { +async function applyBlock(client, block, dryRun) { const results = []; const ops = block.operations || []; for (const op of ops) { try { - const r = await applyOperation(conn, op, dryRun); + const r = await applyOperation(client, op, dryRun); results.push(r); } catch (err) { results.push({ @@ -233,10 +340,12 @@ async function applyBlock(conn, block, dryRun) { } module.exports = { - paramsToRosArray, + createRosClient, rosPrint, + rosPrintWithQuery, rosAdd, rosSet, + rosRemove, applyOperation, applyBlock, };