first commit

2026-08-13 15:58:52 +02:00
commit adfdb0b86c
100 changed files with 6216 additions and 0 deletions
@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import json
+import threading
+import urllib.parse
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from typing import Callable
+
+from .config import Config
+from .store import AlertStore
+
+DASHBOARD = r'''<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>RouterOS Suricata TZSP</title>
+<style>
+body{font-family:system-ui,-apple-system,sans-serif;margin:0;background:#111827;color:#e5e7eb}
+main{max-width:1200px;margin:auto;padding:24px}.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;margin-bottom:18px}
+.card{background:#1f2937;border:1px solid #374151;border-radius:10px;padding:14px}.value{font-size:28px;font-weight:700}.muted{color:#9ca3af;font-size:13px}
+table{width:100%;border-collapse:collapse;background:#1f2937;border-radius:10px;overflow:hidden;margin-bottom:22px}th,td{padding:10px;border-bottom:1px solid #374151;text-align:left;font-size:13px}th{color:#9ca3af}.ok{color:#34d399}.bad{color:#f87171}.warn{color:#fbbf24}.off{color:#9ca3af}
+code{background:#111827;padding:2px 5px;border-radius:4px}.top{display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap}.section-title{margin-top:24px}
+.badge{display:inline-block;border:1px solid #4b5563;border-radius:999px;padding:3px 8px;font-size:12px;text-transform:uppercase;letter-spacing:.04em}
+</style>
+</head>
+<body><main>
+<div class="top"><div><h1>RouterOS Suricata TZSP</h1><div class="muted">TZSP → TAP → Suricata → EVE JSON → SQLite</div></div><div id="status">Loading…</div></div>
+<div class="cards">
+<div class="card"><div class="muted">TZSP datagrams</div><div id="tzsp" class="value">0</div></div>
+<div class="card"><div class="muted">Frames injected into TAP</div><div id="frames" class="value">0</div></div>
+<div class="card"><div class="muted">Suricata alerts</div><div id="alerts" class="value">0</div></div>
+<div class="card"><div class="muted">RouterOS blocks</div><div id="blocked" class="value">0</div></div>
+</div>
+<h2 class="section-title">System status</h2>
+<table><thead><tr><th>Component</th><th>Status</th><th>Details</th></tr></thead><tbody id="serviceRows"></tbody></table>
+<h2 class="section-title">Ports</h2>
+<table><thead><tr><th>Service</th><th>Direction</th><th>Protocol</th><th>Address</th><th>Port</th><th>Status</th></tr></thead><tbody id="portRows"></tbody></table>
+<h2 class="section-title">Recent alerts</h2>
+<table><thead><tr><th>Time</th><th>Severity</th><th>Signature</th><th>Source</th><th>Destination</th><th>Action</th></tr></thead><tbody id="rows"></tbody></table>
+<script>
+function valueOrDash(v){return (v===null||v===undefined||v==='')?'-':String(v)}
+function esc(v){return valueOrDash(v).replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]))}
+function stateClass(v){v=String(v||'').toLowerCase();if(v==='up'||v==='ok'||v==='running'||v==='configured')return'ok';if(v==='down'||v==='error'||v==='degraded')return'bad';if(v==='disabled'||v==='not configured'||v==='development')return'off';return'warn'}
+function stateBadge(v){return `<span class="badge ${stateClass(v)}">${esc(v)}</span>`}
+async function refresh(){
+ try{
+  const [statusData,summary,alertsData]=await Promise.all([fetch('/api/status').then(r=>r.json()),fetch('/api/summary').then(r=>r.json()),fetch('/api/alerts?limit=50').then(r=>r.json())]);
+  if(statusData.dev_mode){
+   document.getElementById('status').innerHTML='<span class="warn">Development mode: Web UI only</span>';
+  }else if(statusData.status==='ok'){
+   document.getElementById('status').innerHTML='<span class="ok">System operational</span>';
+  }else{
+   document.getElementById('status').innerHTML='<span class="bad">System degraded</span>';
+  }
+  document.getElementById('tzsp').textContent=valueOrDash(statusData.runtime?.tzsp_datagrams);
+  document.getElementById('frames').textContent=valueOrDash(statusData.runtime?.frames_injected);
+  document.getElementById('alerts').textContent=valueOrDash(summary.total_alerts);
+  document.getElementById('blocked').textContent=valueOrDash(summary.blocked_alerts);
+
+  const serviceRows=Object.entries(statusData.services||{}).map(([name,item])=>`<tr><td>${esc(item.name||name)}</td><td>${stateBadge(item.status)}</td><td>${esc(item.details)}</td></tr>`).join('');
+  document.getElementById('serviceRows').innerHTML=serviceRows||'<tr><td colspan="3" class="muted">No service status data available.</td></tr>';
+
+  const portRows=(statusData.ports||[]).map(item=>`<tr><td>${esc(item.name)}</td><td>${esc(item.direction)}</td><td>${esc(item.protocol)}</td><td>${esc(item.address)}</td><td>${esc(item.port)}</td><td>${stateBadge(item.status)}</td></tr>`).join('');
+  document.getElementById('portRows').innerHTML=portRows||'<tr><td colspan="6" class="muted">No port status data available.</td></tr>';
+
+  const rows=(alertsData.alerts||[]).map(x=>`<tr><td>${esc(x.timestamp)}</td><td>${esc(x.severity)}</td><td>${esc(x.signature)}<br><span class="muted">SID ${esc(x.signature_id)}</span></td><td>${esc(x.src_ip)}:${esc(x.src_port)}</td><td>${esc(x.dest_ip)}:${esc(x.dest_port)}</td><td>${x.blocked?'<span class="bad">BLOCK '+esc(x.block_target)+'</span>':'<span class="muted">'+esc(x.block_reason)+'</span>'}</td></tr>`).join('');
+  document.getElementById('rows').innerHTML=rows||'<tr><td colspan="6" class="muted">No alerts yet. Run scripts/selftest.sh for a full-stack test or start dev mode with DEV_SEED_DATA=true.</td></tr>';
+ }catch(err){document.getElementById('status').innerHTML='<span class="bad">Application unavailable</span>'}
+}
+refresh();setInterval(refresh,2500);
+</script>
+</main></body></html>'''
+
+
+class WebServer:
+    def __init__(
+        self,
+        config: Config,
+        store: AlertStore,
+        health_provider: Callable[[], dict],
+    ) -> None:
+        self.config = config
+        self.store = store
+        self.health_provider = health_provider
+        self.server = ThreadingHTTPServer((config.web_bind, config.web_port), self._handler())
+        self.thread = threading.Thread(target=self.server.serve_forever, name="web-ui", daemon=True)
+
+    def _handler(self):
+        store = self.store
+        config = self.config
+        health_provider = self.health_provider
+
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):
+                parsed = urllib.parse.urlparse(self.path)
+                if parsed.path == "/":
+                    self._send(200, DASHBOARD.encode("utf-8"), "text/html; charset=utf-8")
+                    return
+                if parsed.path in {"/api/health", "/api/status"}:
+                    self._json(health_provider())
+                    return
+                if parsed.path == "/api/summary":
+                    self._json(store.summary())
+                    return
+                if parsed.path == "/api/config":
+                    self._json(config.public_dict())
+                    return
+                if parsed.path == "/api/alerts":
+                    query = urllib.parse.parse_qs(parsed.query)
+                    try:
+                        limit = int(query.get("limit", ["100"])[0])
+                    except ValueError:
+                        limit = 100
+                    self._json({"alerts": store.recent(limit)})
+                    return
+                self._json({"error": "not found"}, status=404)
+
+            def _json(self, obj, status: int = 200):
+                data = json.dumps(obj, ensure_ascii=False).encode("utf-8")
+                self._send(status, data, "application/json; charset=utf-8")
+
+            def _send(self, status: int, data: bytes, content_type: str):
+                self.send_response(status)
+                self.send_header("Content-Type", content_type)
+                self.send_header("Content-Length", str(len(data)))
+                self.send_header("Cache-Control", "no-store")
+                self.end_headers()
+                self.wfile.write(data)
+
+            def log_message(self, fmt, *args):
+                return
+
+        return Handler
+
+    def start(self) -> None:
+        self.thread.start()
+        print(f"[web] dashboard on http://{self.config.web_bind}:{self.config.web_port}", flush=True)
+
+    def stop(self) -> None:
+        self.server.shutdown()
+        self.server.server_close()