599 lines
29 KiB
Python
599 lines
29 KiB
Python
# --- START OF FILE mtscripter.py ---
|
|
|
|
import os
|
|
from dotenv import load_dotenv
|
|
# generate_mikrotik_CPE_script.py
|
|
import datetime # Already imported, good.
|
|
from datetime import datetime # Explicitly import datetime class for clarity
|
|
import ipaddress # For potential future validation, though not used in core generation
|
|
import json # For result formatting
|
|
|
|
# import slack
|
|
from slack_sdk.web import WebClient # Explicitly import WebClient
|
|
from slack_sdk.errors import SlackApiError
|
|
import logging
|
|
from typing import Dict, Any # Added for type hinting
|
|
|
|
# Mimic the C# GlobalVariables.AppVersion
|
|
# You might want to manage this version more dynamically in your actual project
|
|
MTSCRIPTER_VERSION = "4.1"
|
|
|
|
# Initialize Slack client
|
|
slack_client = WebClient(token=os.environ['SLACK_TOKEN'])
|
|
|
|
# --- Tool Definition (for LLM) ---
|
|
TOOL_DEFINITION = {
|
|
"name": "generate_mikrotik_CPE_script",
|
|
"description": "Generate and send a MikroTik CPE configuration script directly to the Slack channel. Ask the user to clarify any parameters not provided.",
|
|
"input_schema": {
|
|
"type": "object",
|
|
"properties": {
|
|
"channel": {
|
|
"type": "string",
|
|
"description": "The Slack channel ID to send the script to"
|
|
},
|
|
"selected_hardware": {
|
|
"type": "string",
|
|
"description": "The hardware model (e.g., 'hap ax2', 'hap ac2')"
|
|
},
|
|
"selected_mode": {
|
|
"type": "string",
|
|
"description": "The connection mode ('PPPoE', 'Bridge', 'DHCP')"
|
|
},
|
|
"wan_int": {
|
|
"type": "string",
|
|
"description": "The designated WAN interface (e.g., 'ether1'). Ignored if mode is 'Bridge'. Defaults to 'ether1' if not provided."
|
|
},
|
|
"user": {
|
|
"type": "string",
|
|
"description": "The username (PPPoE user or device identifier). Should be lowercase"
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "The password (PPPoE password or device admin password)"
|
|
},
|
|
"ssid": {
|
|
"type": "string",
|
|
"description": "The Wi-Fi network name"
|
|
},
|
|
"wpa": {
|
|
"type": "string",
|
|
"description": "The Wi-Fi WPA2/WPA3 passphrase"
|
|
},
|
|
"technician_name": {
|
|
"type": "string",
|
|
"description": "The name of the first step technician requesting the script (the name of the person prompting you from the slack channel)."
|
|
},
|
|
"has_mgt": {
|
|
"type": "boolean",
|
|
"description": "Boolean indicating if a static management IP should be configured"
|
|
},
|
|
"mgt_ip": {
|
|
"type": "string",
|
|
"description": "The static management IP address (e.g., '10.1.1.5'). Required ONLY if has_mgt is True."
|
|
},
|
|
"has_wifi": {
|
|
"type": "boolean",
|
|
"description": "Boolean indicating if Wi-Fi should be configured and enabled. Defaults to True if not provided."
|
|
}
|
|
},
|
|
# List only the truly required arguments for the tool to function at all.
|
|
# Conditional requirements (like mgt_ip) are handled in the function logic.
|
|
"required": ["channel", "selected_hardware", "selected_mode", "user", "password", "ssid", "wpa", "technician_name", "has_mgt", "has_wifi"]
|
|
}
|
|
}
|
|
# --- End Tool Definition ---
|
|
|
|
|
|
# --- Tool Implementation ---
|
|
def generate_mikrotik_CPE_script(**kwargs: Any) -> Dict[str, Any]:
|
|
"""
|
|
Generates a MikroTik CPE configuration script based on input parameters,
|
|
validates them, saves the script locally to the 'cpe-configs' folder
|
|
with a timestamp, sends the script to the specified Slack channel,
|
|
and returns a confirmation message.
|
|
|
|
Args:
|
|
**kwargs (Any): Keyword arguments matching the tool's input_schema properties.
|
|
|
|
Returns:
|
|
A dictionary with the result of the operation, containing either a success message or error details.
|
|
"""
|
|
# --- Extract Arguments and Set Defaults ---
|
|
channel = kwargs.get('channel')
|
|
selected_hardware = kwargs.get('selected_hardware')
|
|
selected_mode = kwargs.get('selected_mode')
|
|
wan_int = kwargs.get('wan_int', "ether1") # Default WAN if not provided
|
|
user = kwargs.get('user')
|
|
password = kwargs.get('password')
|
|
ssid = kwargs.get('ssid')
|
|
wpa = kwargs.get('wpa')
|
|
has_mgt = kwargs.get('has_mgt', False) # Default False if missing (handle potential None from LLM)
|
|
mgt_ip = kwargs.get('mgt_ip') # No default, checked later if has_mgt is True
|
|
has_wifi = kwargs.get('has_wifi', True) # Default True if missing (handle potential None from LLM)
|
|
technician_name = kwargs.get('technician_name') # this is for some reason failing later validation even though it should be a string
|
|
# so let's print it out for debugging
|
|
logging.info(f"[mtscripter] technician_name received: {technician_name}")
|
|
# maybe we type cast it to str here to ensure it's a string
|
|
# tech_str = str(technician_name) if technician_name else "" # Ensure it's a string or empty
|
|
|
|
# Explicitly handle None for booleans if LLM might pass it
|
|
if has_mgt is None: has_mgt = False
|
|
if has_wifi is None: has_wifi = True
|
|
|
|
|
|
# --- Input Validation Moved Here ---
|
|
validation_errors = []
|
|
required_args_from_schema = TOOL_DEFINITION["input_schema"].get("required", [])
|
|
|
|
# Check static required args first (using the extracted/defaulted values)
|
|
arg_values = { # Map arg names to their extracted/defaulted values for checking
|
|
"channel": channel, "selected_hardware": selected_hardware, "selected_mode": selected_mode,
|
|
"user": user, "password": password, "ssid": ssid, "wpa": wpa,
|
|
"has_mgt": has_mgt, "has_wifi": has_wifi, "technician_name": technician_name # Added technician_name here for check below
|
|
}
|
|
for arg_name in required_args_from_schema:
|
|
value = arg_values.get(arg_name)
|
|
# Check for None or empty string (booleans are handled by their explicit check below)
|
|
# if not isinstance(value, bool) and not value:
|
|
# explicitly exclude args handled by specific elif blocks below
|
|
if arg_name not in ["has_mgt", "has_wifi"] and not isinstance(value, bool) and not value: # Removed technician_name from exclusion
|
|
validation_errors.append(f"Missing or empty required argument: '{arg_name}'.")
|
|
# Ensure booleans are actually booleans
|
|
elif arg_name in ["has_mgt", "has_wifi"] and not isinstance(value, bool):
|
|
validation_errors.append(f"Argument '{arg_name}' must be a boolean (true/false). Received: {type(value)}")
|
|
# # specific check for technician_name (must be non-empty string) < - this is broken for some reason
|
|
# # Re-enabled technician_name check - let's see if it passes now
|
|
# # It seems technician_name was missing from arg_values dict before
|
|
elif arg_name == "technician_name" and (not value or not isinstance(value, str)):
|
|
validation_errors.append(f"Argument 'technician_name' is required and must be a non-empty string.")
|
|
|
|
|
|
# Conditional validation for mgt_ip
|
|
if has_mgt and (not mgt_ip or not isinstance(mgt_ip, str)):
|
|
validation_errors.append("Management IP ('mgt_ip') is required and must be a non-empty string when 'has_mgt' is True.")
|
|
|
|
# Validate specific values/types
|
|
if selected_hardware and not isinstance(selected_hardware, str):
|
|
validation_errors.append(f"Argument 'selected_hardware' must be a string.")
|
|
elif selected_hardware and selected_hardware.lower() not in ["hap ax2", "hap ac2"]:
|
|
# logging.warning(f"Unrecognized hardware '{selected_hardware}'. Defaulting to 'hap ax2' for script generation, but LLM should be corrected.")
|
|
# selected_hardware = "hap ax2" # Default internally, but maybe flag as warning? No, let's add error. # No longer defaulting, return error
|
|
validation_errors.append(f"Unrecognized hardware '{selected_hardware}'. Expected 'hap ax2' or 'hap ac2'.")
|
|
|
|
if selected_mode and not isinstance(selected_mode, str):
|
|
validation_errors.append(f"Argument 'selected_mode' must be a string.")
|
|
elif selected_mode and selected_mode not in ["PPPoE", "Bridge", "DHCP"]:
|
|
validation_errors.append(f"Unrecognized mode '{selected_mode}'. Expected 'PPPoE', 'Bridge', or 'DHCP'.")
|
|
|
|
# Check other types if needed (e.g., wan_int should be string)
|
|
if wan_int and not isinstance(wan_int, str):
|
|
validation_errors.append(f"Argument 'wan_int' must be a string. Received: {type(wan_int)}")
|
|
|
|
# If validation errors, return them
|
|
if validation_errors:
|
|
error_message = "Input validation failed: " + ", ".join(validation_errors)
|
|
logging.error(f"[mtscripter] {error_message}")
|
|
return {"error": error_message}
|
|
# --- End Input Validation ---
|
|
|
|
try:
|
|
# --- Variable Setup (use validated/defaulted variables) ---
|
|
# `selected_hardware` might have been defaulted above if invalid input was given and we chose to proceed -> No longer defaulting
|
|
logical_wan = wan_int # Use the defaulted or provided wan_int
|
|
mgt_wan = wan_int
|
|
# date_time = datetime.datetime.now().strftime("%Y-%m-%dT%H:%M:%S") # Use specific class
|
|
date_time = datetime.now().strftime("%Y-%m-%dT%H:%M:%S") # Simplified using explicit import
|
|
mgt_gw = ""
|
|
|
|
# Adjust WAN based on mode (after validation ensures selected_mode is valid)
|
|
if selected_mode == "Bridge":
|
|
logical_wan = "bridge"
|
|
mgt_wan = "bridge"
|
|
elif selected_mode == "PPPoE":
|
|
logical_wan = "pppoe-out1"
|
|
# else DHCP mode uses wan_int directly for logical_wan
|
|
|
|
# Calculate management GW (after validation ensures mgt_ip exists if has_mgt)
|
|
if has_mgt:
|
|
try:
|
|
ip_parts = mgt_ip.split('.')
|
|
if len(ip_parts) == 4:
|
|
mgt_gw = f"{ip_parts[0]}.{ip_parts[1]}.{ip_parts[2]}.1"
|
|
else:
|
|
# This should ideally be caught by more robust IP validation if added
|
|
raise ValueError(f"Invalid Management IP format for gateway calculation: {mgt_ip}")
|
|
except Exception as e:
|
|
# This error indicates a problem despite passing initial validation (e.g., malformed IP string)
|
|
error_msg = f"Error calculating management gateway from '{mgt_ip}': {e}"
|
|
logging.error(f"[mtscripter] {error_msg}")
|
|
return {"error": error_msg}
|
|
|
|
|
|
# --- Determine Hardware Specific Interface Names ---
|
|
interface1 = ""
|
|
interface2 = ""
|
|
interface_type = ""
|
|
|
|
hardware_lower = selected_hardware.lower() # Already validated as 'hap ax2' or 'hap ac2'
|
|
if hardware_lower == "hap ax2":
|
|
interface1 = "wifi1"
|
|
interface2 = "wifi2"
|
|
interface_type = "wifiwave2"
|
|
elif hardware_lower == "hap ac2":
|
|
interface1 = "wlan1"
|
|
interface2 = "wlan2"
|
|
interface_type = "wireless"
|
|
|
|
|
|
# --- Build Configuration Script ---
|
|
# Using f-strings for easy variable insertion
|
|
# Required arguments are guaranteed to exist and be non-empty strings/booleans by validation
|
|
user_str = str(user)
|
|
pass_str = str(password)
|
|
ssid_str = str(ssid)
|
|
wpa_str = str(wpa)
|
|
tech_str = str(technician_name) # technician_name passed validation
|
|
|
|
# --- Start of Script Generation (Identical core logic) ---
|
|
# Note: Using triple double quotes for the main script block
|
|
# and relying on f-string interpolation within it.
|
|
# This maintains the original script structure.
|
|
config_text = f"""
|
|
# Router Configuration - Copy and Paste into Terminal
|
|
### Create Configuration Script ###
|
|
/system script
|
|
add name=configure.rsc comment="default configuration" source={{
|
|
:local USER "{user_str}"
|
|
:local PASS "{pass_str}"
|
|
:local SSID "{ssid_str}"
|
|
:local WPA2 "{wpa_str}"
|
|
:local WANI "{wan_int}"
|
|
|
|
### Create Bridge ###
|
|
{{
|
|
/interface bridge
|
|
add auto-mac=yes fast-forward=no name=bridge protocol-mode=none
|
|
/interface bridge port
|
|
add bridge=bridge interface=ether1
|
|
add bridge=bridge interface=ether2
|
|
add bridge=bridge interface=ether3
|
|
add bridge=bridge interface=ether4
|
|
add bridge=bridge interface=ether5
|
|
add bridge=bridge interface={interface1}
|
|
:if ([:len [/interface {interface_type} find ]]=2) do={{ add bridge=bridge interface={interface2} }}
|
|
/log info message="bridge created"
|
|
}}
|
|
"""
|
|
|
|
# --- Mode Specific Configuration ---
|
|
if selected_mode != "Bridge":
|
|
config_text += f"""
|
|
### disable WAN port from bridge ###
|
|
/int bridge port set [find interface=$WANI] disabled=yes
|
|
"""
|
|
if selected_mode == "PPPoE":
|
|
config_text += f"""
|
|
### PPPoE ###
|
|
{{
|
|
/interface pppoe-client
|
|
add add-default-route=yes disabled=no interface=$WANI keepalive-timeout=60 \\
|
|
name=pppoe-out1 password=$PASS use-peer-dns=yes user=$USER
|
|
#Set PPP Profile VOIP workaround
|
|
/ppp profile set default on-up=":delay 5; /ip firewall connection remove [find protocol=udp and (dst-address~\\":5060\\\\\\$\\" or dst-address~\\":15062\\\\\\$\\")]"
|
|
/log info message="PPPoE Interface Configured"
|
|
}}
|
|
"""
|
|
elif selected_mode == "DHCP":
|
|
# logical_wan is already set to wan_int for DHCP mode
|
|
config_text += f"""
|
|
### DHCP Client on WAN ###
|
|
{{
|
|
/ip dhcp-client add disabled=no interface=$WANI use-peer-dns=yes add-default-route=yes
|
|
}}
|
|
"""
|
|
|
|
# Common configuration for non-Bridge modes (PPPoE, DHCP)
|
|
config_text += f"""
|
|
### DHCP and IP pool ###
|
|
{{
|
|
/ip pool
|
|
add name=dhcp ranges=192.168.88.10-192.168.88.254
|
|
/ip dhcp-server
|
|
add address-pool=dhcp authoritative=yes disabled=no interface=bridge name=standard lease-time=3d
|
|
/ip dhcp-server option
|
|
add name=VCI code=60 value="'Cambium-WiFi-AP'"
|
|
add name="cnPilot URL" code=43 value="'https://cnpilot.fsr.com'"
|
|
/ip address
|
|
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
|
|
/ip dhcp-server network
|
|
add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=192.168.88.1
|
|
/ip dns static
|
|
add address=192.168.88.1 name=router
|
|
/ip dns set allow-remote-requests=yes
|
|
/log info message="DHCP and IP Pool Configured"
|
|
}}
|
|
#### Firewall ####
|
|
{{
|
|
/interface list add name=WAN
|
|
/interface list member add list=WAN interface=$WANI
|
|
:foreach x in=[/interface pppoe-client find] do={{/interface list member add list=WAN interface=$x}}
|
|
/ip firewall filter
|
|
add action=fasttrack-connection chain=forward comment="fasttrack" \\
|
|
connection-state=established,related
|
|
add action=accept chain=forward comment="fasttrack" \\
|
|
connection-state=established,related
|
|
add action=drop chain=input comment="Drop inbound DNS requests" dst-port=53 in-interface-list=WAN protocol=udp
|
|
add action=drop chain=input comment="Drop inbound TCP DNS requests" dst-port=53 in-interface-list=WAN protocol=tcp
|
|
add action=accept chain=forward comment="accept established,related" \\
|
|
connection-state=established,related
|
|
add action=drop chain=forward comment="drop invalid" connection-state=invalid
|
|
add action=drop chain=forward comment="drop all from WAN not DSTNATed" connection-nat-state=!dstnat \\
|
|
connection-state=new in-interface-list=WAN
|
|
}}
|
|
{{
|
|
/ip firewall nat
|
|
### no interface ###
|
|
add action=masquerade chain=srcnat comment="masquerade" out-interface-list=WAN src-address=192.168.88.0/24
|
|
/log info message="Firewall Configured"
|
|
}}
|
|
#### Enable UPNP and Configure Interfaces ####
|
|
{{
|
|
/ip upnp set enabled=yes
|
|
/ip upnp interfaces add interface={logical_wan} type=external
|
|
/ip upnp interfaces add interface=bridge type=internal
|
|
/log info message="UPNP enabled"
|
|
}}
|
|
#### IPv6 enable
|
|
{{
|
|
/ipv6 settings set disable-ipv6=no
|
|
}}
|
|
#### IPv6 LAN
|
|
{{
|
|
/ipv6 nd set [ find default=yes ] interface=bridge ra-delay=0s ra-interval=30s-45s ra-lifetime=10m
|
|
/ipv6 nd prefix default set preferred-lifetime=5m valid-lifetime=10m
|
|
/ipv6 dhcp-server add prefix-pool=isp-pd interface=bridge lease-time=1m name=default
|
|
/ipv6 address add eui-64=no address=::1 from-pool=isp-pd interface=bridge
|
|
}}
|
|
#### IPv6 WAN
|
|
{{
|
|
/ipv6 dhcp-client add add-default-route=yes interface={logical_wan} pool-name=isp-pd rapid-commit=no request=prefix
|
|
}}
|
|
#### IPv6 Firewall
|
|
{{
|
|
/ipv6 firewall address-list
|
|
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
|
|
add address=::1/128 comment="defconf: lo" list=bad_ipv6
|
|
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
|
|
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
|
|
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
|
|
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
|
|
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
|
|
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
|
|
/ipv6 firewall filter
|
|
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
|
|
add action=accept chain=forward comment="defconf: fasttrack" connection-state=established,related
|
|
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
|
|
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
|
|
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
|
|
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
|
|
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation" dst-port=546 protocol=udp src-address=fe80::/10
|
|
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
|
|
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
|
|
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
|
|
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
|
|
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" disabled=yes in-interface-list=WAN
|
|
add action=accept chain=forward comment="defconf: accept untracked" connection-state=untracked
|
|
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
|
|
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
|
|
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
|
|
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" disabled=yes hop-limit=equal:1 protocol=icmpv6
|
|
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
|
|
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
|
|
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
|
|
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
|
|
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
|
|
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
|
|
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=WAN
|
|
}}
|
|
"""
|
|
|
|
# --- Management IP Configuration ---
|
|
if has_mgt:
|
|
config_text += f"""
|
|
### Configure Static Management Address ###
|
|
{{
|
|
/ip address add address={mgt_ip}/24 comment=management-ip interface={mgt_wan}
|
|
/routing table add name=management fib
|
|
/ip route add gateway={mgt_gw} distance=10 routing-table=management
|
|
/routing rule add action=lookup-only-in-table src-address={mgt_ip} table=management
|
|
/log info message="Management IP Configured: {mgt_ip}"
|
|
}}
|
|
"""
|
|
# --- DHCP Client on Bridge (Bridge mode without static MGT IP) ---
|
|
elif not has_mgt and selected_mode == "Bridge":
|
|
config_text += f"""
|
|
### DHCP Client on Bridge ###
|
|
{{
|
|
/ip dhcp-client add disabled=no interface=bridge use-peer-dns=yes add-default-route=yes
|
|
}}
|
|
"""
|
|
|
|
# --- Wi-Fi Configuration ---
|
|
if has_wifi: # Check the boolean flag (validated/defaulted earlier)
|
|
if hardware_lower == "hap ax2":
|
|
config_text += f"""
|
|
### Wireless for hap ax2 ###
|
|
{{
|
|
# DFS channel availability check (1 min)
|
|
/interface wifiwave2 channel
|
|
add name=5ghz band=5ghz-ax disabled=no skip-dfs-channels=10min-cac width=20/40/80mhz
|
|
add name=2ghz band=2ghz-ax disabled=no skip-dfs-channels=10min-cac width=20/40mhz
|
|
/interface wifiwave2 security
|
|
add name=$SSID authentication-types=wpa2-psk disabled=no encryption=ccmp \\
|
|
group-encryption=ccmp passphrase=$WPA2
|
|
/interface wifiwave2 configuration
|
|
add name=$SSID country="United States" disabled=no mode=ap ssid=$SSID \\
|
|
security=$SSID multicast-enhance=enabled
|
|
/interface wifiwave2
|
|
set [ find ] disabled=no configuration.mode=ap configuration=$SSID
|
|
set [ find default-name=wifi1 ] channel=5ghz
|
|
set [ find default-name=wifi2 ] channel=2ghz
|
|
/log info message="Wireless Configured for hap ax2"
|
|
}}
|
|
"""
|
|
elif hardware_lower == "hap ac2":
|
|
config_text += f"""
|
|
### Wireless for hap ac2 ###
|
|
{{
|
|
/interface wireless
|
|
set [ find ] disabled=no distance=indoors frequency=auto mode=ap-bridge \\
|
|
wireless-protocol=802.11 multicast-helper=full ssid=$SSID
|
|
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX
|
|
:if ([:len [/interface wireless find ]]=2) do={{ \\
|
|
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX }}
|
|
/interface wireless security-profiles
|
|
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \\
|
|
wpa2-pre-shared-key=$WPA2
|
|
/log info message="Wireless Configured for hap ac2"
|
|
}}
|
|
"""
|
|
|
|
# --- Standard FSR Config & Script Closing ---
|
|
# Placeholder for FSR password - this should ideally be handled securely, maybe via env var?
|
|
# fsr_password_placeholder = "xxxxxxxx" # Placeholder removed, using env var below
|
|
# Attempt to get FSR password from environment variable
|
|
fsr_admin_password = os.environ.get('MIKROTIK_CPE_PASSWORD', 'ERROR_PASSWORD_NOT_SET') # Provide default if missing
|
|
if fsr_admin_password == 'ERROR_PASSWORD_NOT_SET':
|
|
logging.warning("[mtscripter] MIKROTIK_CPE_PASSWORD environment variable not set. Using placeholder in script.")
|
|
|
|
config_text += f"""
|
|
|
|
#### Set Identity and Login Password ####
|
|
{{
|
|
/system identity
|
|
set name=("router-".$USER)
|
|
/user set 0 password=$PASS
|
|
/user add name=fsr group=full password={fsr_admin_password}; ### Password comes from env var ###
|
|
/log info message="Identity and Password Set"
|
|
}}
|
|
### SNMP ###
|
|
/snmp {{
|
|
community set [find default=yes] addresses=0.0.0.0/0 name=fsr;
|
|
set contact=sysadmin@fsr.com enabled=yes location=$USER trap-community=fsr;
|
|
}};
|
|
#### Restrict IP Services to FSR Network ####
|
|
{{
|
|
/ip service set [/ip service find] address=64.126.128.0/18,204.52.244.0/22,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12,100.64.0.0/10,2604:2a00::/32
|
|
/log info message="IP Services Restricted to FSR Network"
|
|
}}
|
|
#### Set log memory to 5000 ####
|
|
{{
|
|
/system log action set memory memory-lines=5000
|
|
}}
|
|
#### Set NTP server and time zone ####
|
|
{{
|
|
/ip cloud set update-time=no
|
|
/system ntp client set enabled=yes servers=199.245.242.36
|
|
/system clock set time-zone-name=PST8PDT
|
|
}}
|
|
#### Disable Insecure Services ####
|
|
{{
|
|
/ip service set [ find name=www ] disabled=yes
|
|
/ip service set [ find name=telnet ] disabled=yes
|
|
}}
|
|
#### Version and date comment ####
|
|
{{
|
|
/interface set [ find default-name=ether1 ] comment="configured with version {MTSCRIPTER_VERSION} on {date_time} by {tech_str}"
|
|
}}
|
|
#### Create Backup ####
|
|
{{
|
|
/file add name=flash/baseline.backup
|
|
/system backup save name=flash/baseline
|
|
}}
|
|
}}
|
|
/system script
|
|
run configure.rsc
|
|
# End of Additional Configuration
|
|
"""
|
|
# --- End of Script Generation ---
|
|
|
|
# --- Post-process config_text for LF line endings and no leading spaces ---
|
|
lines = config_text.splitlines() # Split into lines, automatically handles various line endings
|
|
processed_lines = [line.lstrip() for line in lines] # Remove leading whitespace from each line
|
|
config_text = '\r\n'.join(processed_lines) # Join back with CRLF endings
|
|
# --- End Post-processing ---
|
|
|
|
|
|
# --- Prepare Filenames (Slack and Local) ---
|
|
# Determine base filename for Slack upload
|
|
cpe_type = "router" if selected_mode in ["DHCP", "PPPoE"] else "bridge"
|
|
base_filename_slack = f"{cpe_type}-{user_str}.rsc" # Existing logic
|
|
|
|
# Determine unique filename for local save
|
|
save_dir = "cpe-configs"
|
|
timestamp_str = datetime.now().strftime("%Y%m%d_%H%M%S")
|
|
name_part, ext_part = os.path.splitext(base_filename_slack)
|
|
local_filename = f"{name_part}_{timestamp_str}{ext_part}"
|
|
save_path = os.path.join(save_dir, local_filename)
|
|
|
|
# --- Save Script Locally ---
|
|
try:
|
|
os.makedirs(save_dir, exist_ok=True) # Ensure directory exists
|
|
with open(save_path, 'w', encoding='utf-8', newline='\n') as f: # <-- Added newline='\n'
|
|
f.write(config_text)
|
|
logging.info(f"[mtscripter] Successfully saved generated script locally to: {save_path}")
|
|
except IOError as e:
|
|
# Log the error but continue to attempt Slack upload
|
|
logging.error(f"[mtscripter] Failed to save generated script locally to {save_path}: {e}")
|
|
# Optionally, you could add a note to the Slack message or return value here
|
|
# For now, we just log it.
|
|
|
|
# --- Send Script to Slack ---
|
|
try:
|
|
slack_client.files_upload_v2(
|
|
channel=channel, # Use validated channel ID
|
|
content=config_text,
|
|
filename=base_filename_slack, # Use the original base filename for Slack
|
|
initial_comment=f"MikroTik configuration script generated for `{user_str}` (Mode: {selected_mode}, Hardware: {selected_hardware}, Technician: {tech_str}).\nCopy the content below or download the attached `.rsc` file.",
|
|
title=base_filename_slack # Title matches filename
|
|
)
|
|
logging.info(f"[mtscripter] Successfully sent MikroTik script for {user_str} to channel {channel}")
|
|
|
|
except SlackApiError as e:
|
|
# Handle Slack API errors
|
|
error_message = f"Slack API error sending script to channel {channel}: {e.response['error']}"
|
|
logging.error(f"[mtscripter] {error_message}")
|
|
# Return error to LLM so it knows it failed
|
|
# Include note about local save attempt
|
|
return {"error": f"Failed to send the script to Slack. Error: {e.response['error']}. Note: Script was attempted to be saved locally to '{save_path}'."}
|
|
|
|
# Return success message to LLM
|
|
return {"message": f"Script for user '{user_str}' (Mode: {selected_mode}) has been successfully generated, saved locally as '{local_filename}', and sent to the Slack channel {channel} as '{base_filename_slack}'."}
|
|
|
|
except ValueError as ve:
|
|
# Handle specific value errors raised during script generation (like GW calculation)
|
|
error_message = str(ve)
|
|
logging.error(f"[mtscripter] Value error generating MikroTik script: {error_message}")
|
|
return {"error": error_message} # Return specific error to LLM
|
|
except Exception as e:
|
|
# Handle any other unexpected exceptions during script generation or Slack sending
|
|
error_message = f"Unexpected error generating or sending MikroTik script: {str(e)}"
|
|
logging.error(f"[mtscripter] {error_message}", exc_info=True) # Log traceback
|
|
return {"error": f"An unexpected internal error occurred while generating the script: {str(e)}"} # Return generic error
|
|
|
|
# --- End Tool Implementation ---
|
|
|
|
# --------------------------------------------------
|
|
# Tool Entrypoint (required by tool_loader)
|
|
# --------------------------------------------------
|
|
|
|
def run(**kwargs):
|
|
"""
|
|
Tool entrypoint required by the bot runtime.
|
|
This must exist so the LLM can execute the tool.
|
|
"""
|
|
return generate_mikrotik_CPE_script(**kwargs)
|
|
|
|
# --- END OF FILE mtscripter.py ---
|