ce7cb702218693d08ea6d83464d2457c9250027c

services/short/wan/client.go

@@ -0,0 +1,89 @@
+package wan
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"os"
+	"strings"
+	"time"
+)
+
+type Client struct {
+	URL    string
+	Key    string
+	Secret string
+	HTTP   *http.Client
+}
+
+func New(url, directory string) (*Client, error) {
+	key, err := os.ReadFile(directory + "/key")
+	if err != nil {
+		return nil, err
+	}
+	secret, err := os.ReadFile(directory + "/secret")
+	if err != nil {
+		return nil, err
+	}
+	ca, err := os.ReadFile(directory + "/ca.crt")
+	if err != nil {
+		return nil, err
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(ca) {
+		return nil, fmt.Errorf("invalid OPNsense CA")
+	}
+	return &Client{URL: url, Key: strings.TrimSpace(string(key)), Secret: strings.TrimSpace(string(secret)), HTTP: &http.Client{
+		Timeout: 10 * time.Second, Transport: &http.Transport{TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}},
+	}}, nil
+}
+
+func (c *Client) Address(ctx context.Context) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, strings.TrimRight(c.URL, "/")+"/api/interfaces/overview/interfaces_info", nil)
+	if err != nil {
+		return "", err
+	}
+	req.SetBasicAuth(c.Key, c.Secret)
+	resp, err := c.HTTP.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("OPNsense HTTP %d", resp.StatusCode)
+	}
+	var response struct {
+		Rows []struct {
+			Identifier  string `json:"identifier"`
+			Description string `json:"description"`
+			IPv4        []struct {
+				Address string `json:"ipaddr"`
+			} `json:"ipv4"`
+		} `json:"rows"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&response); err != nil {
+		return "", err
+	}
+	var found []string
+	for _, row := range response.Rows {
+		if row.Identifier != "WAN" && row.Description != "WAN" {
+			continue
+		}
+		for _, entry := range row.IPv4 {
+			value := strings.Split(entry.Address, "/")[0]
+			ip, err := netip.ParseAddr(value)
+			if err == nil && ip.Is4() && ip.IsGlobalUnicast() && !ip.IsPrivate() {
+				found = append(found, ip.String())
+			}
+		}
+	}
+	if len(found) != 1 {
+		return "", fmt.Errorf("expected one public WAN IPv4")
+	}
+	return found[0], nil
+}