linuxrouter/docker/routlin-dash/app/action_apply_vlans.py

import copy

from flask import Blueprint, request, redirect, flash
from auth import require_level
from config_utils import load_config, save_config_with_snapshot, verify_config_hash
import sanitize
import validation as validate

bp = Blueprint('action_apply_vlans', __name__)

VIEW = '/view/view_vlans'

_VLAN_FIELDS = ['name', 'is_vpn', 'subnet', 'subnet_mask', 'dnsmasq_log_queries',
                'radius_default', 'mdns_reflection', 'use_blocklists']


def _row_index():
    try:
        return int(request.form.get('row_index', ''))
    except (ValueError, TypeError):
        return None


def _hash_ok():
    if not verify_config_hash(request.form.get('config_hash', '')):
        flash('Configuration was modified by another session. Please refresh and try again.', 'error')
        return False
    return True


@bp.route('/action/add_vlan', methods=['POST'])
@require_level('administrator')
def add_vlan():
    name               = sanitize.name(request.form.get('name', ''))
    is_vpn             = 'is_vpn' in request.form
    subnet             = sanitize.ip(request.form.get('subnet', ''))
    subnet_mask        = sanitize.subnet_mask(request.form.get('subnet_mask', ''))
    radius_default     = 'radius_default' in request.form
    mdns_reflection    = 'mdns_reflection' in request.form
    dnsmasq_log_queries = 'dnsmasq_log_queries' in request.form
    use_blocklists     = sanitize.filterlist(
        request.form.getlist('use_blocklists'),
        {b.get('name') for b in load_config().get('dns_blocking', {}).get('blocklists', [])},
    )

    if not name:
        flash('Name is required.', 'error')
        return redirect(VIEW)
    if not subnet:
        flash('Subnet IP is required.', 'error')
        return redirect(VIEW)
    if subnet_mask is None:
        flash('Invalid subnet prefix (must be 1-30).', 'error')
        return redirect(VIEW)

    vlan_id = validate.derive_vlan_id(subnet, subnet_mask)
    if vlan_id is None:
        flash('Cannot derive a valid VLAN ID (1-4094) from this subnet/prefix combination.', 'error')
        return redirect(VIEW)

    if not _hash_ok():
        return redirect(VIEW)

    cfg  = load_config()
    vlans = cfg.setdefault('vlans', [])

    if any(validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) == vlan_id for v in vlans):
        flash(f'VLAN {vlan_id} (derived from subnet) already exists.', 'error')
        return redirect(VIEW)
    if radius_default and any(v.get('radius_default') for v in vlans):
        flash('Only one VLAN can be the RADIUS default.', 'error')
        return redirect(VIEW)

    entry = {
        'name':                name,
        'is_vpn':              is_vpn,
        'subnet':              subnet,
        'subnet_mask':         subnet_mask,
        'dnsmasq_log_queries': dnsmasq_log_queries,
        'use_blocklists':      use_blocklists,
        'radius_default':      radius_default,
        'mdns_reflection':     mdns_reflection,
    }
    if is_vpn:
        entry['peers'] = []
    else:
        entry['reservations'] = []
    vlans.append(entry)
    errors = validate.validate_config(cfg)
    if errors:
        for msg in errors:
            flash(msg, 'error')
        return redirect(VIEW)

    flash(save_config_with_snapshot(
        cfg,
        path='vlans', key=name, operation='add',
        before=None, after={k: entry[k] for k in _VLAN_FIELDS if k in entry},
        description=f'Added VLAN: {name} ({subnet}/{subnet_mask})',
    ), 'success')
    return redirect(VIEW)


@bp.route('/action/edit_vlan', methods=['POST'])
@require_level('administrator')
def edit_vlan():
    idx = _row_index()
    if idx is None:
        flash('Invalid request.', 'error')
        return redirect(VIEW)

    name               = sanitize.name(request.form.get('name', ''))
    subnet             = sanitize.ip(request.form.get('subnet', ''))
    radius_default     = 'radius_default' in request.form
    mdns_reflection    = 'mdns_reflection' in request.form
    dnsmasq_log_queries = 'dnsmasq_log_queries' in request.form
    use_blocklists     = sanitize.filterlist(
        request.form.getlist('use_blocklists'),
        {b.get('name') for b in load_config().get('dns_blocking', {}).get('blocklists', [])},
    )

    subnet_mask_raw = request.form.get('subnet_mask')
    if subnet_mask_raw is not None:
        subnet_mask = sanitize.subnet_mask(subnet_mask_raw)
        if subnet_mask is None:
            flash('Invalid subnet prefix (must be 1-30).', 'error')
            return redirect(VIEW)
    else:
        subnet_mask = None

    if not name:
        flash('Name is required.', 'error')
        return redirect(VIEW)
    if not subnet:
        flash('Subnet IP is required.', 'error')
        return redirect(VIEW)
    if not _hash_ok():
        return redirect(VIEW)

    cfg  = load_config()
    vlans = cfg.get('vlans', [])
    if idx < 0 or idx >= len(vlans):
        flash('VLAN not found.', 'error')
        return redirect(VIEW)

    existing   = vlans[idx]
    is_vpn     = existing.get('is_vpn', False)
    final_mask = subnet_mask if subnet_mask is not None else existing.get('subnet_mask', 24)

    vlan_id = validate.derive_vlan_id(subnet, final_mask)
    if vlan_id is None:
        flash('Cannot derive a valid VLAN ID (1-4094) from this subnet/prefix combination.', 'error')
        return redirect(VIEW)

    current_id = validate.derive_vlan_id(existing.get('subnet', ''), existing.get('subnet_mask', 24))
    if current_id == 1 and vlan_id != 1:
        flash('VLAN 1 is the physical interface; change its subnet so the derived ID remains 1.', 'error')
        return redirect(VIEW)

    if vlan_id != current_id and any(
        validate.derive_vlan_id(v.get('subnet', ''), v.get('subnet_mask', 24)) == vlan_id
        for i, v in enumerate(vlans) if i != idx
    ):
        flash(f'VLAN {vlan_id} (derived from subnet) already exists.', 'error')
        return redirect(VIEW)

    if radius_default and any(i != idx and v.get('radius_default') for i, v in enumerate(vlans)):
        flash('Only one VLAN can be the RADIUS default.', 'error')
        return redirect(VIEW)

    before = {k: existing.get(k) for k in _VLAN_FIELDS}
    existing.update({
        'name':                name,
        'is_vpn':              is_vpn,
        'subnet':              subnet,
        'subnet_mask':         final_mask,
        'dnsmasq_log_queries': dnsmasq_log_queries,
        'radius_default':      radius_default,
        'mdns_reflection':     mdns_reflection,
        'use_blocklists':      use_blocklists,
    })
    errors = validate.validate_config(cfg)
    if errors:
        for msg in errors:
            flash(msg, 'error')
        return redirect(VIEW)

    flash(save_config_with_snapshot(
        cfg,
        path='vlans', key=name, operation='edit',
        before=before, after={k: existing.get(k) for k in _VLAN_FIELDS},
        description=f'Edited VLAN: {name}',
    ), 'success')
    return redirect(VIEW)


@bp.route('/action/delete_vlan', methods=['POST'])
@require_level('administrator')
def delete_vlan():
    idx = _row_index()
    if idx is None:
        flash('Invalid request.', 'error')
        return redirect(VIEW)
    if not _hash_ok():
        return redirect(VIEW)

    cfg  = load_config()
    vlans = cfg.get('vlans', [])
    if idx < 0 or idx >= len(vlans):
        flash('VLAN not found.', 'error')
        return redirect(VIEW)

    removed = vlans.pop(idx)
    errors = validate.validate_config(cfg)
    if errors:
        for msg in errors:
            flash(msg, 'error')
        return redirect(VIEW)

    flash(save_config_with_snapshot(
        cfg,
        path='vlans', key=removed['name'], operation='delete',
        before={k: removed.get(k) for k in _VLAN_FIELDS},
        after=None,
        description=f'Deleted VLAN: {removed["name"]}',
    ), 'success')
    return redirect(VIEW)