mirror of
https://github.com/hansjone/netx.git
synced 2026-10-09 03:10:46 +08:00
oliver
302ebfac23
Only audit interactive commands from frontend audit_line with a CLI prompt prefix; skip prompt-sync Enter and device error echoes; join wrapped xterm rows for long commands. Co-authored-by: Cursor <cursoragent@cursor.com>
736 lines
24 KiB
Python
736 lines
24 KiB
Python
"""WebCRT channel helpers: keymap, prompt heuristics, encoding, queues."""
|
|
from __future__ import annotations
|
|
|
|
import io
|
|
import json
|
|
import logging
|
|
import queue
|
|
import re
|
|
import threading
|
|
import time
|
|
from datetime import datetime, timezone
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
from netmiko import ConnectHandler
|
|
|
|
from .config import settings
|
|
|
|
_log = logging.getLogger("netx.webcrt")
|
|
|
|
_NETWORK_CLI_KEY_SEQS: tuple[tuple[str, str], ...] = (
|
|
("\x1b[1~", "\x01"), # Home -> Ctrl-A
|
|
("\x1b[3~", "\x04"), # Delete key -> Ctrl-D
|
|
("\x1b[4~", "\x05"), # End -> Ctrl-E
|
|
("\x1b[H", "\x01"),
|
|
("\x1b[F", "\x05"),
|
|
("\x1bOH", "\x01"),
|
|
("\x1bOF", "\x05"),
|
|
("\x1bOA", "\x1b[A"), # App Up -> CSI Up
|
|
("\x1bOB", "\x1b[B"),
|
|
("\x1bOC", "\x1b[C"),
|
|
("\x1bOD", "\x1b[D"), # App Left -> CSI Left
|
|
("\x7f", "\x08"), # DEL -> BS
|
|
)
|
|
|
|
|
|
def uses_network_cli_keymap(device_type: str = "", vendor: str = "") -> bool:
|
|
blob = f"{device_type} {vendor}".strip().lower()
|
|
if not blob:
|
|
return True
|
|
for token in ("linux", "ubuntu", "centos", "debian", "redhat", "unix", "generic_telnet", "generic"):
|
|
if token in blob:
|
|
return False
|
|
return True
|
|
|
|
|
|
def map_network_cli_keys(
|
|
data: str,
|
|
*,
|
|
device_type: str = "",
|
|
vendor: str = "",
|
|
protocol: str = "",
|
|
) -> str:
|
|
"""Rewrite xterm key sequences for network-device CLIs."""
|
|
del device_type, vendor, protocol # protocol kept for call-site compatibility
|
|
text = str(data or "")
|
|
if not text:
|
|
return text
|
|
out: list[str] = []
|
|
i = 0
|
|
n = len(text)
|
|
while i < n:
|
|
matched = False
|
|
for seq, repl in _NETWORK_CLI_KEY_SEQS:
|
|
if text.startswith(seq, i):
|
|
out.append(repl)
|
|
i += len(seq)
|
|
matched = True
|
|
break
|
|
if not matched:
|
|
out.append(text[i])
|
|
i += 1
|
|
return "".join(out)
|
|
|
|
|
|
def channel_return(conn: ConnectHandler | None) -> str:
|
|
"""Netmiko line ending for this session (SSH usually \\n, Telnet often \\r\\n)."""
|
|
if conn is None:
|
|
return "\n"
|
|
ret = getattr(conn, "RETURN", None)
|
|
if isinstance(ret, str) and ret:
|
|
return ret
|
|
return "\n"
|
|
|
|
|
|
def map_network_cli_enter(data: str, conn: ConnectHandler | None) -> str:
|
|
"""Map xterm Enter (\\r) to the device's Netmiko RETURN."""
|
|
text = str(data or "")
|
|
if not text:
|
|
return text
|
|
ret = channel_return(conn)
|
|
if ret == "\r":
|
|
return text
|
|
# Prefer replacing CRLF first so Telnet RETURN \\r\\n does not double-expand.
|
|
return text.replace("\r\n", ret).replace("\r", ret)
|
|
|
|
|
|
def _drain_channel(conn: ConnectHandler, *, rounds: int = 6, wait: float = 0.06) -> str:
|
|
"""Read whatever is already sitting on the channel after login."""
|
|
chunks: list[str] = []
|
|
empty_streak = 0
|
|
for _ in range(max(1, rounds)):
|
|
time.sleep(wait)
|
|
try:
|
|
part = conn.read_channel()
|
|
except Exception:
|
|
break
|
|
if part:
|
|
chunks.append(str(part))
|
|
empty_streak = 0
|
|
else:
|
|
empty_streak += 1
|
|
if empty_streak >= 2 and chunks:
|
|
break
|
|
return "".join(chunks)
|
|
|
|
|
|
def _session_log_text(buf: io.BytesIO | None) -> str:
|
|
"""Decode Netmiko session_log buffer into display text."""
|
|
if buf is None:
|
|
return ""
|
|
try:
|
|
raw = buf.getvalue()
|
|
except Exception:
|
|
return ""
|
|
if isinstance(raw, bytes):
|
|
return raw.decode("utf-8", errors="replace")
|
|
return str(raw or "")
|
|
|
|
|
|
def _cli_prompt_candidate_lines(text: str) -> list[str]:
|
|
"""Non-empty transcript lines, stripping ANSI and ignoring trailing ``[netx]`` markers."""
|
|
s = str(text or "").replace("\r\n", "\n").replace("\r", "\n")
|
|
s = re.sub(r"\x1b\[[0-9;?]*[A-Za-z]", "", s)
|
|
lines = [ln.strip() for ln in s.split("\n") if ln.strip()]
|
|
while lines and lines[-1].startswith("[netx]"):
|
|
lines.pop()
|
|
return lines
|
|
|
|
|
|
def _line_looks_like_cli_prompt(line: str) -> bool:
|
|
last = str(line or "").strip()
|
|
if not last:
|
|
return False
|
|
# Buffer races: ``<r1>:`` (stray from [Y/N]:) or ``<r1>N`` (password-change answer glued).
|
|
if last.endswith(":") and (">" in last or "]" in last):
|
|
last = last[:-1].rstrip()
|
|
if len(last) >= 2 and last[-1] in "NYny" and (last[-2] in ">]" or last.endswith(">")):
|
|
# ``<r1>N`` / ``[HW]Y`` after Change-now answer — treat as prompted.
|
|
last = last[:-1].rstrip()
|
|
return bool(re.search(r"(?:[>\]]|#)\s*$", last)) or bool(re.search(r"<[^>\r\n]+>\s*$", last))
|
|
|
|
|
|
def _looks_like_cli_prompt(text: str) -> bool:
|
|
lines = _cli_prompt_candidate_lines(text)
|
|
if not lines:
|
|
return False
|
|
return _line_looks_like_cli_prompt(lines[-1])
|
|
|
|
|
|
def _looks_like_login_prompt(text: str) -> bool:
|
|
"""True when the transcript ends at Username:/Login:/Password: (interactive auth)."""
|
|
lines = _cli_prompt_candidate_lines(text)
|
|
if not lines:
|
|
return False
|
|
last = lines[-1]
|
|
return bool(re.search(r"(?i)(user\s*name|login|password)\s*:\s*$", last))
|
|
|
|
|
|
_PASSWORD_CHANGE_LINE_RE = re.compile(
|
|
r"(?i)(change\s*now|please\s*choose|password\s+needs\s+to\s+be\s+changed).{0,80}:\s*$"
|
|
)
|
|
|
|
|
|
def _looks_like_password_change_prompt(text: str) -> bool:
|
|
"""Huawei/VRP post-auth ``Change now? [Y/N]:`` (Netmiko already answers N).
|
|
|
|
Do not match bare ``[Y/N]:`` — stelnet host-key trust prompts share that suffix
|
|
and are answered in ``_interactive_target_auth``, not by skipping Enter here.
|
|
"""
|
|
lines = _cli_prompt_candidate_lines(text)
|
|
if not lines:
|
|
return False
|
|
return bool(_PASSWORD_CHANGE_LINE_RE.search(lines[-1]))
|
|
|
|
|
|
def _password_change_still_pending(text: str) -> bool:
|
|
"""True only when Change-now is still awaiting an answer.
|
|
|
|
Netmiko ``HuaweiTelnet.telnet_login`` often already sent ``N`` before WebCRT
|
|
``_finish_connect`` runs. Re-sending ``N`` lands as a command on ``<r1>``.
|
|
Treat a lone ``N``/``Y`` echo (or a later CLI prompt) as already answered.
|
|
"""
|
|
lines = _cli_prompt_candidate_lines(text)
|
|
if not lines:
|
|
return False
|
|
last_change = -1
|
|
for i, ln in enumerate(lines):
|
|
if _PASSWORD_CHANGE_LINE_RE.search(ln):
|
|
last_change = i
|
|
if last_change < 0:
|
|
return False
|
|
after = lines[last_change + 1 :]
|
|
if not after:
|
|
# Still sitting on Change now? [Y/N]:
|
|
return True
|
|
if any(_line_looks_like_cli_prompt(ln) for ln in after):
|
|
return False
|
|
# Device already echoed N/Y from Netmiko (or a prior answer) — do not send again.
|
|
if any(ln.strip().upper() in {"N", "Y"} for ln in after):
|
|
return False
|
|
# Banner / last-login text after Change-now without a prompt yet: Netmiko may still
|
|
# be draining; do not inject a second N (would race onto the prompt).
|
|
return False
|
|
|
|
|
|
# Cisco/Netmiko often yields "R2#R2#" when a sync Enter is appended without a newline.
|
|
_GLUED_PROMPT_RE = re.compile(r"(?<=[#>])(?=(?:[A-Za-z0-9][\w.\-:]{0,62})[#>])")
|
|
|
|
|
|
def normalize_cli_transcript(text: str) -> str:
|
|
"""Normalize login transcript for xterm (convertEol) and un-glue prompts."""
|
|
s = str(text or "").replace("\r\n", "\n").replace("\r", "\n")
|
|
s = _GLUED_PROMPT_RE.sub("\n", s)
|
|
lines = s.split("\n")
|
|
while lines and not str(lines[-1]).strip():
|
|
lines.pop()
|
|
# Drop blank lines immediately before a final prompt (banner\n\nR2# -> banner\nR2#).
|
|
while len(lines) >= 2 and not str(lines[-2]).strip() and _looks_like_cli_prompt(lines[-1]):
|
|
lines.pop(-2)
|
|
# Collapse trailing duplicate prompt lines (slow VMs often echo R2# several times).
|
|
while len(lines) >= 2 and str(lines[-1]).strip() == str(lines[-2]).strip() and _looks_like_cli_prompt(lines[-1]):
|
|
lines.pop()
|
|
return "\n".join(lines)
|
|
|
|
|
|
def prepare_bootstrap_output(text: str) -> str:
|
|
"""Full login transcript for UI replay; keep final prompt, no trailing newline after it.
|
|
|
|
Trailing newline would leave the cursor on a blank line so the first typed line
|
|
looks wrong; cursor should sit after the prompt like a real CRT.
|
|
"""
|
|
s = normalize_cli_transcript(text)
|
|
# Drop a stray ':' glued onto Huawei ``<host>`` after ``[Y/N]:`` buffer races.
|
|
s = re.sub(r"(<[^\r\n>]+>):\s*$", r"\1", s)
|
|
return s
|
|
|
|
|
|
def _capture_raw_channel(conn: ConnectHandler, *, duration: float = 0.5) -> str:
|
|
"""Read leftover PTY bytes into text (banner/MOTD after SSH auth).
|
|
|
|
Interactive WebCRT skips Netmiko session_preparation, so the post-auth banner
|
|
often never lands in ``session_log`` and must be pulled from the live channel.
|
|
"""
|
|
chunks: list[str] = []
|
|
channel = getattr(conn, "remote_conn", None)
|
|
if channel is None:
|
|
try:
|
|
return _drain_channel(conn, rounds=max(2, int(duration / 0.05)), wait=0.05)
|
|
except Exception:
|
|
return ""
|
|
end = time.time() + max(0.1, float(duration))
|
|
while time.time() < end:
|
|
got = False
|
|
try:
|
|
# Paramiko SSH channel
|
|
if hasattr(channel, "recv_ready") and hasattr(channel, "recv"):
|
|
if channel.recv_ready():
|
|
raw = channel.recv(65535)
|
|
if raw:
|
|
got = True
|
|
if isinstance(raw, bytes):
|
|
chunks.append(raw.decode("utf-8", errors="replace"))
|
|
else:
|
|
chunks.append(str(raw))
|
|
# telnetlib-style
|
|
elif callable(getattr(channel, "read_very_eager", None)):
|
|
data = channel.read_very_eager()
|
|
if data:
|
|
got = True
|
|
if isinstance(data, bytes):
|
|
chunks.append(data.decode("utf-8", errors="replace"))
|
|
else:
|
|
chunks.append(str(data))
|
|
else:
|
|
part = conn.read_channel()
|
|
if part:
|
|
got = True
|
|
chunks.append(str(part))
|
|
except Exception:
|
|
break
|
|
if not got:
|
|
time.sleep(0.04)
|
|
return "".join(chunks)
|
|
|
|
|
|
def _drain_raw_channel(conn: ConnectHandler, *, duration: float = 0.5) -> None:
|
|
"""Discard leftover bytes on the live channel (SSH/Telnet) after login priming."""
|
|
_capture_raw_channel(conn, duration=duration)
|
|
|
|
|
|
def _prime_interactive_channel(conn: ConnectHandler, *, already_prompted: bool = False) -> str:
|
|
"""Sync interactive channel after login; return captured banner/prompt text.
|
|
|
|
Skip the sync Enter when the login transcript already ends with a CLI prompt —
|
|
otherwise slow Cisco VMs accumulate duplicate ``R2#`` lines in the bootstrap.
|
|
"""
|
|
parts: list[str] = []
|
|
try:
|
|
parts.append(_capture_raw_channel(conn, duration=0.25))
|
|
except Exception:
|
|
pass
|
|
if not already_prompted:
|
|
try:
|
|
conn.write_channel(channel_return(conn))
|
|
except Exception:
|
|
try:
|
|
conn.write_channel("\n")
|
|
except Exception:
|
|
return "".join(parts)
|
|
try:
|
|
parts.append(_drain_channel(conn, rounds=6, wait=0.08))
|
|
except Exception:
|
|
pass
|
|
try:
|
|
parts.append(_capture_raw_channel(conn, duration=0.35))
|
|
except Exception:
|
|
pass
|
|
return "".join(parts)
|
|
|
|
|
|
def _is_prompt_only_echo(text: str, prompt_hint: str = "") -> bool:
|
|
"""True when chunk is only whitespace / CR / a repeated prompt (safe to drop after bootstrap)."""
|
|
s = str(text or "").replace("\r\n", "\n").replace("\r", "\n").strip()
|
|
if not s:
|
|
return True
|
|
hint = str(prompt_hint or "").strip()
|
|
if hint and s == hint:
|
|
return True
|
|
# Single-line prompt echo only.
|
|
if "\n" not in s and _looks_like_cli_prompt(s):
|
|
return True
|
|
if hint and all(line.strip() in ("", hint) for line in s.split("\n")):
|
|
return True
|
|
return False
|
|
|
|
|
|
def _normalize_encoding(name: str) -> str:
|
|
enc = str(name or "utf-8").strip().lower().replace("_", "-")
|
|
if enc in ("gbk", "gb2312", "gb18030", "cp936"):
|
|
return "gbk"
|
|
return "utf-8"
|
|
|
|
|
|
def _decode_bytes(data: bytes, encoding: str) -> str:
|
|
enc = _normalize_encoding(encoding)
|
|
try:
|
|
return data.decode(enc, errors="replace")
|
|
except Exception:
|
|
return data.decode("utf-8", errors="replace")
|
|
|
|
|
|
def _encode_text(text: str, encoding: str) -> bytes:
|
|
enc = _normalize_encoding(encoding)
|
|
try:
|
|
return text.encode(enc, errors="replace")
|
|
except Exception:
|
|
return text.encode("utf-8", errors="replace")
|
|
|
|
|
|
class _BoundedByteQueue:
|
|
"""Thread-safe queue that drops oldest chunks when full (backpressure)."""
|
|
|
|
def __init__(self, maxsize: int = 2000) -> None:
|
|
self._q: queue.Queue[bytes | None] = queue.Queue()
|
|
self._max = max(8, int(maxsize or 2000))
|
|
self._cond = threading.Condition()
|
|
self.dropped = 0
|
|
self._reported = 0
|
|
|
|
def put(self, item: bytes | None) -> None:
|
|
with self._cond:
|
|
while self._q.qsize() >= self._max:
|
|
try:
|
|
self._q.get_nowait()
|
|
self.dropped += 1
|
|
except queue.Empty:
|
|
break
|
|
self._q.put(item)
|
|
self._cond.notify()
|
|
|
|
def put_nowait(self, item: bytes | None) -> None:
|
|
self.put(item)
|
|
|
|
def get_nowait(self) -> bytes | None:
|
|
with self._cond:
|
|
return self._q.get_nowait()
|
|
|
|
def get(self, timeout: float = 0.25) -> bytes | None:
|
|
"""Block until a chunk is available or timeout (raises queue.Empty)."""
|
|
deadline = time.time() + max(0.0, float(timeout))
|
|
with self._cond:
|
|
while self._q.empty():
|
|
remaining = deadline - time.time()
|
|
if remaining <= 0:
|
|
raise queue.Empty
|
|
self._cond.wait(timeout=remaining)
|
|
return self._q.get_nowait()
|
|
|
|
def qsize(self) -> int:
|
|
with self._cond:
|
|
return self._q.qsize()
|
|
|
|
def take_drop_delta(self) -> int:
|
|
"""Return newly dropped chunk count since last call (for client notice)."""
|
|
with self._cond:
|
|
delta = int(self.dropped) - int(self._reported)
|
|
if delta <= 0:
|
|
return 0
|
|
self._reported = int(self.dropped)
|
|
return delta
|
|
|
|
|
|
def _utc_now() -> datetime:
|
|
return datetime.now(timezone.utc)
|
|
|
|
|
|
def _utc_iso() -> str:
|
|
return _utc_now().isoformat()
|
|
|
|
|
|
def webcrt_data_root() -> Path:
|
|
root = Path(str(settings.webcrt_data_dir or "data/webcrt"))
|
|
root.mkdir(parents=True, exist_ok=True)
|
|
return root.resolve()
|
|
|
|
|
|
def _session_log_path(session_id: str) -> Path:
|
|
folder = webcrt_data_root() / "sessions"
|
|
folder.mkdir(parents=True, exist_ok=True)
|
|
return folder / f"{session_id}.log"
|
|
|
|
|
|
def read_session_log_tail(session_id: str, *, max_bytes: int = 49152) -> str:
|
|
"""Best-effort UTF-8 tail of the on-disk session transcript (for WS re-attach)."""
|
|
path = _session_log_path(session_id)
|
|
try:
|
|
if not path.is_file():
|
|
return ""
|
|
size = path.stat().st_size
|
|
take = max(1024, min(int(max_bytes or 49152), 256 * 1024))
|
|
with path.open("rb") as fh:
|
|
if size > take:
|
|
fh.seek(size - take)
|
|
raw = fh.read()
|
|
# Drop partial first line after seek.
|
|
nl = raw.find(b"\n")
|
|
if 0 <= nl < len(raw) - 1:
|
|
raw = raw[nl + 1 :]
|
|
else:
|
|
raw = fh.read()
|
|
text = raw.decode("utf-8", errors="replace")
|
|
# Strip header comment lines from the visible replay.
|
|
lines = [ln for ln in text.splitlines(keepends=True) if not ln.startswith("# session=")]
|
|
return "".join(lines)
|
|
except Exception:
|
|
_log.debug("webcrt session log tail failed session=%s", session_id, exc_info=True)
|
|
return ""
|
|
|
|
|
|
# Lifecycle + command events also land in audit_log (ops UI). Attach/detach/sftp stay file-only.
|
|
_DB_AUDIT_EVENTS = frozenset(
|
|
{
|
|
"session_connecting",
|
|
"session_created",
|
|
"session_open_failed",
|
|
"session_closed",
|
|
"command",
|
|
}
|
|
)
|
|
|
|
_PASSWORD_PROMPT_RE = re.compile(
|
|
r"(?:enter\s+)?(?:password|密码|passwd)\s*[:>]\s*$",
|
|
re.IGNORECASE,
|
|
)
|
|
|
|
|
|
def looks_like_password_prompt(text: str) -> bool:
|
|
"""True when device stdout tail asks for a password (interactive auth)."""
|
|
s = str(text or "").replace("\r\n", "\n").replace("\r", "\n")
|
|
# Drop ANSI so prompt detection is stable.
|
|
s = re.sub(r"\x1b\[[0-9;?]*[A-Za-z]|\x1b\].*?\x07|\x1b.", "", s)
|
|
parts = [ln.strip() for ln in s.split("\n") if ln.strip()]
|
|
if not parts:
|
|
return False
|
|
return bool(_PASSWORD_PROMPT_RE.search(parts[-1]))
|
|
|
|
|
|
def normalize_audit_line(line: str) -> str:
|
|
"""Normalize xterm-visible input line for audit (keep device prompt prefix)."""
|
|
s = re.sub(r"\x1b\[[0-9;?]*[A-Za-z]|\x1b\].*?\x07|\x1b.", "", str(line or ""))
|
|
return s.replace("\r", "").rstrip()
|
|
|
|
|
|
def finalize_audit_line(line: str) -> str:
|
|
"""Apply echoed backspaces then normalize (PTY stdout fallback only)."""
|
|
s = _strip_ansi(str(line or ""))
|
|
out: list[str] = []
|
|
for ch in s:
|
|
if ch in ("\b", "\x7f"):
|
|
if out:
|
|
out.pop()
|
|
continue
|
|
if ord(ch) < 32 and ch != "\t":
|
|
continue
|
|
out.append(ch)
|
|
return normalize_audit_line("".join(out))
|
|
|
|
|
|
def _strip_ansi(text: str) -> str:
|
|
return re.sub(r"\x1b\[[0-9;?]*[A-Za-z]|\x1b\].*?\x07|\x1b.", "", str(text or ""))
|
|
|
|
|
|
def _is_prompt_command_line(line: str) -> bool:
|
|
"""True when line looks like ``hostname#command`` (non-empty command tail)."""
|
|
s = str(line or "").strip()
|
|
if not s:
|
|
return False
|
|
return bool(
|
|
re.match(
|
|
r"^(?:"
|
|
r"[\w.-]+(?:\([^)]+\))*[#>]\s*\S"
|
|
r"|<[^>]+>\s*\S"
|
|
r"|\[[^\]]+\]\s*\S"
|
|
r")",
|
|
s,
|
|
flags=re.I,
|
|
)
|
|
)
|
|
|
|
|
|
def _has_cli_prompt_prefix(line: str) -> bool:
|
|
s = normalize_audit_line(line)
|
|
return bool(
|
|
re.match(
|
|
r"^(?:"
|
|
r"[\w.-]+(?:\([^)]+\))*[#>]"
|
|
r"|>[\w.-]+"
|
|
r"|<[^>]+>"
|
|
r"|\[[^\]]+\]"
|
|
r")",
|
|
s,
|
|
flags=re.I,
|
|
)
|
|
)
|
|
|
|
|
|
def _is_device_output_line(line: str) -> bool:
|
|
"""Device error/warning echo — never an operator-typed command."""
|
|
s = normalize_audit_line(line).strip()
|
|
if not s:
|
|
return False
|
|
low = s.lower()
|
|
if low.startswith("%error") or low.startswith("%warning"):
|
|
return True
|
|
if "invalid input detected" in low:
|
|
return True
|
|
if re.match(r"^\^+\s*$", s):
|
|
return True
|
|
if re.match(r"^enter configuration commands", low):
|
|
return True
|
|
return False
|
|
|
|
|
|
def is_auditable_command_line(line: str) -> bool:
|
|
"""False for empty Enter, device output, or lines without a CLI prompt prefix."""
|
|
s = normalize_audit_line(line)
|
|
if not s.strip():
|
|
return False
|
|
if _is_prompt_only_line(s):
|
|
return False
|
|
if _is_device_output_line(s):
|
|
return False
|
|
return _has_cli_prompt_prefix(s)
|
|
|
|
|
|
def _is_prompt_only_line(line: str) -> bool:
|
|
"""True when line is a device prompt with no command typed."""
|
|
s = normalize_audit_line(line)
|
|
if not s:
|
|
return True
|
|
return bool(
|
|
re.match(
|
|
r"^(?:"
|
|
r"[\w.-]+(?:\([^)]+\))*[#>]\s*"
|
|
r"|<[^>]+>\s*"
|
|
r"|\[[^\]]+\]\s*"
|
|
r")$",
|
|
s,
|
|
flags=re.I,
|
|
)
|
|
)
|
|
|
|
|
|
def extract_last_prompt_command(text: str) -> str | None:
|
|
"""Last prompt+command line in PTY transcript (tab-complete redraw aware).
|
|
|
|
Network devices often refresh the current input with ``\\r`` after tab; the
|
|
final segment after the last carriage return is the ground truth for audit.
|
|
"""
|
|
s = _strip_ansi(text)
|
|
if not s.strip():
|
|
return None
|
|
# Prefer the tail after the last in-line refresh (tab completion / prompt rewrite).
|
|
tail = s.rsplit("\r", 1)[-1]
|
|
tail_line = tail.split("\n")[-1].rstrip()
|
|
if _is_prompt_command_line(tail_line):
|
|
return finalize_audit_line(tail_line)[:512]
|
|
for frag in reversed(re.split(r"[\r\n]+", s)):
|
|
line = frag.strip()
|
|
if line and _is_prompt_command_line(line):
|
|
return finalize_audit_line(line)[:512]
|
|
return None
|
|
|
|
|
|
def feed_command_line_buffer(buf: str, data: str, *, max_line: int = 512) -> tuple[str, list[str]]:
|
|
"""Accumulate stdin into completed command lines (Enter / CR / LF).
|
|
|
|
Handles backspace, ignores most control chars, truncates over-long lines.
|
|
Returns ``(new_buffer, completed_lines)``.
|
|
"""
|
|
cur = str(buf or "")
|
|
completed: list[str] = []
|
|
limit = max(64, min(int(max_line or 512), 4096))
|
|
raw = str(data or "")
|
|
i = 0
|
|
while i < len(raw):
|
|
ch = raw[i]
|
|
if ch == "\x1b" and i + 1 < len(raw):
|
|
# Skip CSI / SS3 cursor-key sequences (Delete, arrows, etc.).
|
|
if raw[i + 1] == "[":
|
|
j = i + 2
|
|
while j < len(raw) and raw[j] not in "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz~":
|
|
j += 1
|
|
i = j + 1 if j < len(raw) else len(raw)
|
|
continue
|
|
if raw[i + 1] == "O" and i + 2 < len(raw):
|
|
i += 3
|
|
continue
|
|
if ch in ("\r", "\n"):
|
|
if cur:
|
|
completed.append(cur[:limit])
|
|
cur = ""
|
|
i += 1
|
|
continue
|
|
if ch in ("\b", "\x7f"):
|
|
cur = cur[:-1] if cur else ""
|
|
i += 1
|
|
continue
|
|
if ch == "\x03": # Ctrl-C — abandon current line
|
|
cur = ""
|
|
i += 1
|
|
continue
|
|
if ord(ch) < 32 and ch != "\t":
|
|
i += 1
|
|
continue
|
|
if len(cur) < limit:
|
|
cur += ch
|
|
i += 1
|
|
return cur, completed
|
|
|
|
|
|
def _audit(event: str, **fields: Any) -> None:
|
|
"""Write WebCRT audit to jsonl; dual-write selected events into audit_log."""
|
|
# Enrich actor / device fields from the live session when callers omit them.
|
|
sid = str(fields.get("session_id") or "").strip()
|
|
if sid and (
|
|
not fields.get("owner_user_id")
|
|
or not fields.get("owner_username")
|
|
or not fields.get("ne_name")
|
|
or "protocol" not in fields
|
|
):
|
|
try:
|
|
from .webcrt_session_registry import get_session
|
|
|
|
sess = get_session(sid)
|
|
if sess is not None:
|
|
fields.setdefault("owner_user_id", sess.owner_user_id)
|
|
fields.setdefault("owner_username", sess.owner_username)
|
|
fields.setdefault("ne_id", sess.ne_id)
|
|
fields.setdefault("ne_name", sess.ne_name)
|
|
fields.setdefault("ne_ip", sess.ne_ip)
|
|
fields.setdefault("protocol", sess.protocol)
|
|
except Exception:
|
|
pass
|
|
|
|
record = {"ts": _utc_iso(), "event": event, **fields}
|
|
try:
|
|
path = webcrt_data_root() / "audit.jsonl"
|
|
with path.open("a", encoding="utf-8") as fh:
|
|
fh.write(json.dumps(record, ensure_ascii=False) + "\n")
|
|
except Exception:
|
|
_log.exception("webcrt audit write failed")
|
|
_log.info("webcrt.%s %s", event, {k: v for k, v in fields.items() if k != "detail"})
|
|
|
|
if str(event or "") not in _DB_AUDIT_EVENTS:
|
|
return
|
|
try:
|
|
from .audit_async import enqueue_audit
|
|
|
|
actor_uid = str(fields.get("owner_user_id") or fields.get("actor_user_id") or "")
|
|
actor_name = str(fields.get("owner_username") or fields.get("actor_username") or "")
|
|
detail = {
|
|
k: v
|
|
for k, v in fields.items()
|
|
if k
|
|
not in {
|
|
"owner_user_id",
|
|
"owner_username",
|
|
"actor_user_id",
|
|
"actor_username",
|
|
}
|
|
}
|
|
enqueue_audit(
|
|
action=f"webcrt.{event}",
|
|
actor_user_id=actor_uid,
|
|
actor_username=actor_name,
|
|
method="",
|
|
path=f"/v1/webcrt/sessions/{sid}" if sid else "/v1/webcrt",
|
|
status_code=0,
|
|
client_ip=str(fields.get("client_ip") or ""),
|
|
user_agent=str(fields.get("client") or "")[:512],
|
|
detail=detail,
|
|
)
|
|
except Exception:
|
|
_log.exception("webcrt audit_log enqueue failed event=%s", event)
|