hp3icc
2 weeks ago
parent
cc82de74fc
commit
d778af3545
@ -0,0 +1,56 @@
|
|||||||
|
modules = ["python-3.12", "bash", "web"]
|
||||||
|
|
||||||
|
[workflows]
|
||||||
|
runButton = "Project"
|
||||||
|
|
||||||
|
[[workflows.workflow]]
|
||||||
|
name = "Project"
|
||||||
|
mode = "parallel"
|
||||||
|
author = "agent"
|
||||||
|
|
||||||
|
[[workflows.workflow.tasks]]
|
||||||
|
task = "workflow.run"
|
||||||
|
args = "FreeDMR Server"
|
||||||
|
|
||||||
|
[[workflows.workflow.tasks]]
|
||||||
|
task = "workflow.run"
|
||||||
|
args = "Password Dashboard"
|
||||||
|
|
||||||
|
[[workflows.workflow]]
|
||||||
|
name = "FreeDMR Server"
|
||||||
|
author = "agent"
|
||||||
|
|
||||||
|
[workflows.workflow.metadata]
|
||||||
|
outputType = "console"
|
||||||
|
|
||||||
|
[[workflows.workflow.tasks]]
|
||||||
|
task = "shell.exec"
|
||||||
|
args = "python bridge_master.py -c ./config/adn.cfg"
|
||||||
|
|
||||||
|
[[workflows.workflow]]
|
||||||
|
name = "Password Dashboard"
|
||||||
|
author = "agent"
|
||||||
|
|
||||||
|
[[workflows.workflow.tasks]]
|
||||||
|
task = "shell.exec"
|
||||||
|
args = "python dashboard.py"
|
||||||
|
waitForPort = 5000
|
||||||
|
|
||||||
|
[workflows.workflow.metadata]
|
||||||
|
outputType = "webview"
|
||||||
|
|
||||||
|
[[ports]]
|
||||||
|
localPort = 4321
|
||||||
|
externalPort = 3000
|
||||||
|
|
||||||
|
[[ports]]
|
||||||
|
localPort = 5000
|
||||||
|
externalPort = 80
|
||||||
|
|
||||||
|
[agent]
|
||||||
|
expertMode = true
|
||||||
|
integrations = ["github:1.0.0"]
|
||||||
|
|
||||||
|
[nix]
|
||||||
|
channel = "stable-25_05"
|
||||||
|
packages = ["cargo", "gitFull", "glibcLocales", "libiconv", "libxcrypt", "openssl", "pkg-config", "rustc", "wkhtmltopdf"]
|
||||||
|
After Width: | Height: | Size: 22 KiB |
@ -0,0 +1,161 @@
|
|||||||
|
[GLOBAL]
|
||||||
|
PATH: ./
|
||||||
|
PING_TIME: 10
|
||||||
|
MAX_MISSED: 3
|
||||||
|
USE_ACL: True
|
||||||
|
REG_ACL: PERMIT:ALL
|
||||||
|
SUB_ACL: DENY:1
|
||||||
|
TGID_TS1_ACL: PERMIT:ALL
|
||||||
|
TGID_TS2_ACL: PERMIT:ALL
|
||||||
|
GEN_STAT_BRIDGES: True
|
||||||
|
ANNOUNCEMENT_LANGUAGES:
|
||||||
|
SERVER_ID: 0000
|
||||||
|
DATA_GATEWAY: False
|
||||||
|
VALIDATE_SERVER_IDS: False
|
||||||
|
|
||||||
|
; Servidor de seguridad centralizado
|
||||||
|
URL_SECURITY:
|
||||||
|
PORT_SECURITY:
|
||||||
|
PASS_SECURITY:
|
||||||
|
USERS_PASS: user_passwords.json
|
||||||
|
HASH_ENCRYPT: encryption_key.secret
|
||||||
|
|
||||||
|
[REPORTS]
|
||||||
|
REPORT: True
|
||||||
|
REPORT_INTERVAL: 10
|
||||||
|
REPORT_PORT: 4321
|
||||||
|
REPORT_CLIENTS: 127.0.0.1
|
||||||
|
|
||||||
|
[LOGGER]
|
||||||
|
LOG_FILE: /dev/null
|
||||||
|
LOG_HANDLERS: console-timed
|
||||||
|
LOG_LEVEL: DEBUG
|
||||||
|
LOG_NAME: ADN
|
||||||
|
|
||||||
|
[ALIASES]
|
||||||
|
TRY_DOWNLOAD: True
|
||||||
|
PATH: ./data/
|
||||||
|
PEER_FILE: peer_ids.json
|
||||||
|
SUBSCRIBER_FILE: subscriber_ids.json
|
||||||
|
TGID_FILE: talkgroup_ids.json
|
||||||
|
PEER_URL: https://adn.systems/files/peer_ids.json
|
||||||
|
SUBSCRIBER_URL: https://adn.systems/files/subscriber_ids.json
|
||||||
|
TGID_URL: https://adn.systems/files/talkgroup_ids.json
|
||||||
|
SERVER_ID_URL: https://adn.systems/files/server_ids.tsv
|
||||||
|
CHECKSUM_URL: https://adn.systems/files/file_checksums.json
|
||||||
|
LOCAL_SUBSCRIBER_FILE: subscriber_ids.json
|
||||||
|
STALE_DAYS: 1
|
||||||
|
SUB_MAP_FILE: sub_map.pkl
|
||||||
|
SERVER_ID_FILE: server_ids.tsv
|
||||||
|
CHECKSUM_FILE: file_checksums.json
|
||||||
|
KEYS_FILE: keys.json
|
||||||
|
|
||||||
|
#Control server shared allstar instance via dial / AMI
|
||||||
|
[ALLSTAR]
|
||||||
|
ENABLED: False
|
||||||
|
USER:llcgi
|
||||||
|
PASS: mypass
|
||||||
|
SERVER: my.asl.server
|
||||||
|
PORT: 5038
|
||||||
|
NODE: 0000
|
||||||
|
|
||||||
|
[OBP-TEST]
|
||||||
|
MODE: OPENBRIDGE
|
||||||
|
ENABLED: False
|
||||||
|
IP:
|
||||||
|
PORT: 62044
|
||||||
|
NETWORK_ID: 1
|
||||||
|
PASSPHRASE: mypass
|
||||||
|
TARGET_IP:
|
||||||
|
TARGET_PORT: 62044
|
||||||
|
USE_ACL: True
|
||||||
|
SUB_ACL: DENY:1
|
||||||
|
TGID_ACL: DENY:0-82,92-199,800-899,9990-9999,900999
|
||||||
|
RELAX_CHECKS: True
|
||||||
|
ENHANCED_OBP: True
|
||||||
|
PROTO_VER: 5
|
||||||
|
|
||||||
|
[SYSTEM]
|
||||||
|
MODE: MASTER
|
||||||
|
ENABLED: True
|
||||||
|
REPEAT: True
|
||||||
|
MAX_PEERS: 1
|
||||||
|
EXPORT_AMBE: False
|
||||||
|
IP:
|
||||||
|
PORT: 56400
|
||||||
|
PASSPHRASE: passw0rd
|
||||||
|
GROUP_HANGTIME: 5
|
||||||
|
USE_ACL: True
|
||||||
|
REG_ACL: DENY:1
|
||||||
|
SUB_ACL: DENY:1
|
||||||
|
TGID_TS1_ACL: PERMIT:ALL
|
||||||
|
TGID_TS2_ACL: PERMIT:ALL
|
||||||
|
DEFAULT_UA_TIMER: 60
|
||||||
|
SINGLE_MODE: False
|
||||||
|
VOICE_IDENT: False
|
||||||
|
TS1_STATIC:
|
||||||
|
TS2_STATIC:
|
||||||
|
DEFAULT_REFLECTOR: 0
|
||||||
|
ANNOUNCEMENT_LANGUAGE: es_ES
|
||||||
|
GENERATOR: 100
|
||||||
|
ALLOW_UNREG_ID: False
|
||||||
|
PROXY_CONTROL: True
|
||||||
|
OVERRIDE_IDENT_TG:
|
||||||
|
|
||||||
|
|
||||||
|
[ECHO]
|
||||||
|
MODE: MASTER
|
||||||
|
ENABLED: True
|
||||||
|
REPEAT: True
|
||||||
|
MAX_PEERS: 1
|
||||||
|
EXPORT_AMBE: False
|
||||||
|
IP: 127.0.0.1
|
||||||
|
PORT: 54917
|
||||||
|
PASSPHRASE: passw0rd
|
||||||
|
GROUP_HANGTIME: 5
|
||||||
|
USE_ACL: True
|
||||||
|
REG_ACL: DENY:1
|
||||||
|
SUB_ACL: DENY:1
|
||||||
|
TGID_TS1_ACL: DENY:ALL
|
||||||
|
TGID_TS2_ACL: PERMIT:9990
|
||||||
|
DEFAULT_UA_TIMER: 1
|
||||||
|
SINGLE_MODE: True
|
||||||
|
VOICE_IDENT: False
|
||||||
|
TS1_STATIC:
|
||||||
|
TS2_STATIC:9990
|
||||||
|
DEFAULT_REFLECTOR: 0
|
||||||
|
ANNOUNCEMENT_LANGUAGE: en_GB
|
||||||
|
GENERATOR: 0
|
||||||
|
ALLOW_UNREG_ID: True
|
||||||
|
PROXY_CONTROL: False
|
||||||
|
OVERRIDE_IDENT_TG:
|
||||||
|
|
||||||
|
[D-APRS]
|
||||||
|
MODE: MASTER
|
||||||
|
ENABLED: True
|
||||||
|
REPEAT: False
|
||||||
|
MAX_PEERS: 1
|
||||||
|
EXPORT_AMBE: False
|
||||||
|
IP:
|
||||||
|
PORT: 52555
|
||||||
|
PASSPHRASE: passw0rd
|
||||||
|
GROUP_HANGTIME: 0
|
||||||
|
USE_ACL: True
|
||||||
|
REG_ACL: DENY:1
|
||||||
|
SUB_ACL: DENY:1
|
||||||
|
TGID_TS1_ACL: PERMIT:ALL
|
||||||
|
TGID_TS2_ACL: PERMIT:ALL
|
||||||
|
DEFAULT_UA_TIMER: 10
|
||||||
|
SINGLE_MODE: False
|
||||||
|
VOICE_IDENT: False
|
||||||
|
TS1_STATIC:
|
||||||
|
TS2_STATIC:
|
||||||
|
DEFAULT_REFLECTOR: 0
|
||||||
|
ANNOUNCEMENT_LANGUAGE: es_ES
|
||||||
|
GENERATOR: 2
|
||||||
|
ALLOW_UNREG_ID: True
|
||||||
|
PROXY_CONTROL: False
|
||||||
|
OVERRIDE_IDENT_TG:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -0,0 +1 @@
|
|||||||
|
{"subscriber_ids":"e3d7df1cea54b717e670ae310d92aa7fbb5230c18a5e42a5063b38d396562706f12ee487c5e6c61afa71bebbd01db267d68570bc11e877b088e5b5058220e77a","peer_ids":"d223516beafe7b427402f86642477a5d1d1479c88ae7368f1e8ba7f0728a0355271fbe59ba4e85773759e8824015aaa663a117b1d5e704f3886bf9e27e790e66","talkgroup_ids":"143624f8278a654d4d30769ccc18cdc77e135c6f372216cdad35b6fbfcf767043c38e886c150d3ae4757ce8125c49212b362a949de4b6d7e58e0b88f02bba5a1","server_ids":"536c1a52705bad24a3eb5167b1ea2af9f07e08618039c5e1ef49b65f361911b2c968bb58506ffe99798758c60c49b0de8660f2d924a2a66246a5b11dd0062893","timestamp":1767603901}
|
||||||
@ -0,0 +1 @@
|
|||||||
|
{}
|
||||||
|
@ -0,0 +1,76 @@
|
|||||||
|
# Servicios Systemd para ADN Systems DMR
|
||||||
|
|
||||||
|
## Archivos de Servicio
|
||||||
|
|
||||||
|
- **adn-bridge.service** - Servidor DMR principal (bridge_master.py)
|
||||||
|
- **adn-dashboard.service** - Panel de administración de contraseñas (dashboard.py)
|
||||||
|
|
||||||
|
## Instalación
|
||||||
|
|
||||||
|
### 1. Copiar el proyecto a /opt/adn-dmr
|
||||||
|
```bash
|
||||||
|
sudo mkdir -p /opt/adn-dmr
|
||||||
|
sudo cp -r /ruta/del/proyecto/* /opt/adn-dmr/
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Copiar los servicios a systemd
|
||||||
|
```bash
|
||||||
|
sudo cp adn-bridge.service /etc/systemd/system/
|
||||||
|
sudo cp adn-dashboard.service /etc/systemd/system/
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Recargar systemd
|
||||||
|
```bash
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. Habilitar servicios para arranque automático
|
||||||
|
```bash
|
||||||
|
sudo systemctl enable adn-bridge.service
|
||||||
|
sudo systemctl enable adn-dashboard.service
|
||||||
|
```
|
||||||
|
|
||||||
|
### 5. Iniciar los servicios
|
||||||
|
```bash
|
||||||
|
sudo systemctl start adn-bridge.service
|
||||||
|
sudo systemctl start adn-dashboard.service
|
||||||
|
```
|
||||||
|
|
||||||
|
## Comandos Útiles
|
||||||
|
|
||||||
|
### Ver estado de los servicios
|
||||||
|
```bash
|
||||||
|
sudo systemctl status adn-bridge.service
|
||||||
|
sudo systemctl status adn-dashboard.service
|
||||||
|
```
|
||||||
|
|
||||||
|
### Ver logs en tiempo real
|
||||||
|
```bash
|
||||||
|
sudo journalctl -u adn-bridge.service -f
|
||||||
|
sudo journalctl -u adn-dashboard.service -f
|
||||||
|
```
|
||||||
|
|
||||||
|
### Reiniciar servicios
|
||||||
|
```bash
|
||||||
|
sudo systemctl restart adn-bridge.service
|
||||||
|
sudo systemctl restart adn-dashboard.service
|
||||||
|
```
|
||||||
|
|
||||||
|
### Detener servicios
|
||||||
|
```bash
|
||||||
|
sudo systemctl stop adn-bridge.service
|
||||||
|
sudo systemctl stop adn-dashboard.service
|
||||||
|
```
|
||||||
|
|
||||||
|
### Deshabilitar arranque automático
|
||||||
|
```bash
|
||||||
|
sudo systemctl disable adn-bridge.service
|
||||||
|
sudo systemctl disable adn-dashboard.service
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notas
|
||||||
|
|
||||||
|
- Los servicios asumen que el proyecto está instalado en `/opt/adn-dmr`
|
||||||
|
- Si usas otra ruta, edita `WorkingDirectory` en los archivos .service
|
||||||
|
- El dashboard escucha en el puerto 5000
|
||||||
|
- Asegúrate de tener las dependencias Python instaladas antes de iniciar
|
||||||
@ -0,0 +1,16 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=ADN Systems DMR Bridge Master - Servidor DMR principal
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=root
|
||||||
|
WorkingDirectory=/opt/adn-dmr
|
||||||
|
ExecStart=/usr/bin/python3 bridge_master.py -c ./config/adn.cfg
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
StandardOutput=journal
|
||||||
|
StandardError=journal
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@ -0,0 +1,55 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# Script de instalacion para ADN Systems DMR Peer Server
|
||||||
|
# Debian 13 (Trixie) - ARM64/ARMv7
|
||||||
|
#
|
||||||
|
# Este script instala las dependencias necesarias para compilar
|
||||||
|
# y ejecutar el servidor DMR en sistemas ARM con Debian 13
|
||||||
|
#
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
echo "=============================================="
|
||||||
|
echo " ADN Systems DMR Peer Server"
|
||||||
|
echo " Instalador para Debian 13 (Trixie) ARM"
|
||||||
|
echo "=============================================="
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [ "$EUID" -ne 0 ]; then
|
||||||
|
echo "Error: Este script debe ejecutarse como root (sudo)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[1/4] Actualizando repositorios..."
|
||||||
|
apt-get update
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[2/4] Instalando dependencias de compilacion..."
|
||||||
|
apt-get install -y \
|
||||||
|
build-essential \
|
||||||
|
python3-dev \
|
||||||
|
python3-pip \
|
||||||
|
python3-venv \
|
||||||
|
libffi-dev \
|
||||||
|
libssl-dev \
|
||||||
|
git
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[3/4] Instalando dependencias de Python..."
|
||||||
|
pip3 install --break-system-packages -r requirements.txt
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[4/4] Verificando instalacion..."
|
||||||
|
python3 -c "import bitarray; import twisted; import flask; print('Todas las dependencias instaladas correctamente')"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=============================================="
|
||||||
|
echo " Instalacion completada exitosamente"
|
||||||
|
echo "=============================================="
|
||||||
|
echo ""
|
||||||
|
echo "Para iniciar el servidor:"
|
||||||
|
echo " python3 bridge_master.py -c ./config/adn.cfg"
|
||||||
|
echo ""
|
||||||
|
echo "Para iniciar el dashboard:"
|
||||||
|
echo " python3 dashboard.py"
|
||||||
|
echo ""
|
||||||
@ -0,0 +1,48 @@
|
|||||||
|
from cryptography.fernet import Fernet
|
||||||
|
import os
|
||||||
|
import base64
|
||||||
|
import hashlib
|
||||||
|
|
||||||
|
ENCRYPTION_KEY_FILE = 'config/encryption_key.secret'
|
||||||
|
|
||||||
|
def get_or_create_key():
|
||||||
|
if os.path.exists(ENCRYPTION_KEY_FILE):
|
||||||
|
with open(ENCRYPTION_KEY_FILE, 'rb') as f:
|
||||||
|
return f.read()
|
||||||
|
else:
|
||||||
|
key = Fernet.generate_key()
|
||||||
|
os.makedirs(os.path.dirname(ENCRYPTION_KEY_FILE), exist_ok=True)
|
||||||
|
with open(ENCRYPTION_KEY_FILE, 'wb') as f:
|
||||||
|
f.write(key)
|
||||||
|
return key
|
||||||
|
|
||||||
|
def get_fernet():
|
||||||
|
key = get_or_create_key()
|
||||||
|
return Fernet(key)
|
||||||
|
|
||||||
|
def encrypt_password(password):
|
||||||
|
if not password:
|
||||||
|
return password
|
||||||
|
fernet = get_fernet()
|
||||||
|
encrypted = fernet.encrypt(password.encode('utf-8'))
|
||||||
|
return encrypted.decode('utf-8')
|
||||||
|
|
||||||
|
def decrypt_password(encrypted_password):
|
||||||
|
if not encrypted_password:
|
||||||
|
return encrypted_password
|
||||||
|
try:
|
||||||
|
fernet = get_fernet()
|
||||||
|
decrypted = fernet.decrypt(encrypted_password.encode('utf-8'))
|
||||||
|
return decrypted.decode('utf-8')
|
||||||
|
except Exception:
|
||||||
|
return encrypted_password
|
||||||
|
|
||||||
|
def is_encrypted(value):
|
||||||
|
if not value:
|
||||||
|
return False
|
||||||
|
try:
|
||||||
|
fernet = get_fernet()
|
||||||
|
fernet.decrypt(value.encode('utf-8'))
|
||||||
|
return True
|
||||||
|
except Exception:
|
||||||
|
return False
|
||||||
@ -0,0 +1,209 @@
|
|||||||
|
# ADN Systems DMR Peer Server
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
ADN Systems DMR Peer Server is a fork of FreeDMR, implementing a Digital Mobile Radio (DMR) network server. Launched in April 2024 by international amateur radio enthusiasts, it operates on an Open Bridge Protocol (OBP) fostering a decentralized network architecture. The system handles DMR voice and data communication, acting as a conference bridge/reflector that routes traffic between connected systems (repeaters, hotspots, peers) based on configurable bridge rules.
|
||||||
|
|
||||||
|
## User Preferences
|
||||||
|
|
||||||
|
Preferred communication style: Simple, everyday language.
|
||||||
|
|
||||||
|
## System Architecture
|
||||||
|
|
||||||
|
### Core Protocol Implementation
|
||||||
|
|
||||||
|
**Problem**: Need to implement HomeBrew Repeater Protocol (HBP) and Open Bridge Protocol for DMR communication
|
||||||
|
**Solution**: Python-based protocol handlers using Twisted framework for asynchronous networking
|
||||||
|
- `hblink.py` serves as the core protocol engine implementing HBSYSTEM and OPENBRIDGE classes
|
||||||
|
- Supports both peer and master/server modes for network topology flexibility
|
||||||
|
- Uses DatagramProtocol for UDP-based DMR packet handling
|
||||||
|
- Implements custom authentication using SHA256/BLAKE2b hashing with HMAC for security
|
||||||
|
|
||||||
|
**Rationale**: Twisted provides battle-tested async I/O suitable for handling multiple simultaneous connections with low latency requirements critical for voice communication.
|
||||||
|
|
||||||
|
### Bridge/Routing Architecture
|
||||||
|
|
||||||
|
**Problem**: Route voice traffic between multiple DMR systems based on talkgroups and timeslots
|
||||||
|
**Solution**: Conference bridge pattern implemented in `bridge_master.py` and `bridge.py`
|
||||||
|
- Traffic routing based on rules defined in `rules.py` configuration
|
||||||
|
- Systems can be dynamically activated/deactivated on conference bridges
|
||||||
|
- Supports timeout-based automatic disconnection
|
||||||
|
- Static routing option available for permanent connections
|
||||||
|
|
||||||
|
**Alternatives Considered**: End-to-end routing was rejected in favor of conference bridge approach for better scalability and simpler management.
|
||||||
|
|
||||||
|
**Pros**: Flexible routing, easy management, scalable
|
||||||
|
**Cons**: Systems must individually join bridges (not transparent end-to-end)
|
||||||
|
|
||||||
|
### Proxy Architecture
|
||||||
|
|
||||||
|
**Problem**: Allow multiple hotspots/repeaters to connect through a single public IP address
|
||||||
|
**Solution**: UDP proxy implementation in `hotspot_proxy_v2.py` and `hotspot_proxy_self_service.py`
|
||||||
|
- Dynamic port allocation for incoming connections
|
||||||
|
- Connection tracking with timeout-based cleanup
|
||||||
|
- Blacklist support for access control
|
||||||
|
- Self-service variant includes database-backed client management
|
||||||
|
|
||||||
|
**Rationale**: Many amateur radio operators are behind NAT/firewalls; proxy enables connectivity without port forwarding.
|
||||||
|
|
||||||
|
### Voice Synthesis System
|
||||||
|
|
||||||
|
**Problem**: Generate voice announcements for system events (linking, unlinking, status)
|
||||||
|
**Solution**: AMBE (Advanced Multi-Band Excitation) voice codec integration
|
||||||
|
- Pre-recorded indexed voice files in multiple languages (en_GB, es_ES, fr_FR, etc.)
|
||||||
|
- `read_ambe.py` handles reading/parsing of AMBE audio files
|
||||||
|
- `mk_voice.py` generates HBP-compliant voice packets from AMBE data
|
||||||
|
- `playback.py` and `play_ambe.py` handle voice injection into streams
|
||||||
|
|
||||||
|
**Rationale**: Provides accessible feedback to users without requiring external TTS systems, maintains compatibility with DMR audio codecs.
|
||||||
|
|
||||||
|
### Individual Password Authentication
|
||||||
|
|
||||||
|
**Problem**: Need individual password authentication per Radio ID (indicativo) for enhanced security
|
||||||
|
**Solution**: JSON-based password storage with automatic reload
|
||||||
|
- Password file: `data/user_passwords.json` stores individual passwords by Radio ID
|
||||||
|
- Web dashboard: `dashboard.py` provides admin interface for password management
|
||||||
|
- Auto-reload: Passwords are reloaded every 10 seconds without server restart
|
||||||
|
- Fallback: Global passphrase used if no individual password is configured
|
||||||
|
- Mandatory authentication: Individual or global password required (no null passphrase allowed)
|
||||||
|
|
||||||
|
**Suffix Support for Radio IDs**:
|
||||||
|
- Radio IDs of 9 digits (ej: 214501601-214501699) can use the password of their 7-digit base ID (ej: 2145016)
|
||||||
|
- Useful for users with multiple hotspots/devices using suffix extensions
|
||||||
|
- Priority: Exact ID match first, then base ID match
|
||||||
|
|
||||||
|
**Authentication Priority**:
|
||||||
|
1. Individual password for exact Radio ID (if configured)
|
||||||
|
2. Individual password for base ID (7 digits, for 9-digit IDs with suffix)
|
||||||
|
3. Global passphrase (if configured)
|
||||||
|
4. Reject connection (no valid credentials)
|
||||||
|
|
||||||
|
**Dashboard Credentials**: Stored in `config/dashboard_credentials.json` file (not uploaded to GitHub)
|
||||||
|
- Supports multiple administrators with the following format:
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"admins": [
|
||||||
|
{"user": "admin", "password": "admin123"},
|
||||||
|
{"user": "operador1", "password": "clave456"}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
- Also supports legacy single-admin format for backwards compatibility
|
||||||
|
|
||||||
|
**Dashboard Web con Acceso Dual**:
|
||||||
|
- Pagina principal (`/`): Selector entre acceso usuario y administrador
|
||||||
|
- Acceso Usuario (`/user/login`): Login con Radio ID y contrasena para cambiar su propia contrasena
|
||||||
|
- Acceso Administrador (`/admin/login`): Login para gestionar todas las contrasenas
|
||||||
|
- Los usuarios pueden cambiar su contrasena sin necesitar al administrador
|
||||||
|
|
||||||
|
**Busqueda por Indicativo (Callsign)**:
|
||||||
|
- Descarga automatica diaria de la base de datos de RadioID.net (`data/user.csv`)
|
||||||
|
- Formato CSV con campos: RADIO_ID, CALLSIGN, FIRST_NAME, LAST_NAME, CITY, STATE, COUNTRY
|
||||||
|
- Funcion de busqueda en el panel de administracion para encontrar Radio IDs por indicativo
|
||||||
|
- Muestra toda la informacion del registro: nombre, ciudad, estado, pais
|
||||||
|
- Soporta busqueda parcial (ej: "EA4" muestra todos los indicativos que empiezan por EA4)
|
||||||
|
- Limita resultados a 20 para mejor rendimiento
|
||||||
|
- Boton "Usar ID" para autorellenar el formulario de agregar contrasena
|
||||||
|
|
||||||
|
### Servidor de Seguridad Centralizado (Rama: descentralizada)
|
||||||
|
|
||||||
|
**Problema**: Gestionar credenciales de forma centralizada desde un servidor remoto
|
||||||
|
**Solucion**: Descarga automatica de archivos de seguridad desde servidor central
|
||||||
|
|
||||||
|
**Configuracion en adn.cfg seccion [GLOBAL]**:
|
||||||
|
- `URL_SECURITY`: IP o DNS del servidor central de seguridad
|
||||||
|
- `PORT_SECURITY`: Puerto del servidor central
|
||||||
|
- `PASS_SECURITY`: Contrasena de autenticacion del administrador
|
||||||
|
- `USERS_PASS`: Nombre del archivo de contrasenas (default: user_passwords.json)
|
||||||
|
- `HASH_ENCRYPT`: Nombre del archivo de clave de encriptacion (default: encryption_key.secret)
|
||||||
|
|
||||||
|
**Comportamiento de Descarga**:
|
||||||
|
- `encryption_key.secret`: Se descarga SOLO al arrancar el servidor, sobrescribe el existente
|
||||||
|
- `user_passwords.json`: Se descarga cada 5 minutos, compara contenido antes de actualizar
|
||||||
|
|
||||||
|
**Sintaxis de Descarga (curl)**:
|
||||||
|
```
|
||||||
|
curl -L "http://URL_SECURITY:PORT_SECURITY/descargar?pass=PASS_SECURITY&encryption_key.secret"
|
||||||
|
curl -L "http://URL_SECURITY:PORT_SECURITY/descargar?pass=PASS_SECURITY&user_passwords.json"
|
||||||
|
```
|
||||||
|
|
||||||
|
**Seguridad y Tolerancia a Fallos**:
|
||||||
|
- Si la descarga falla, se conservan los archivos locales existentes
|
||||||
|
- No se permite contrasena nula (ALLOW_NULL_PASSPHRASE eliminado)
|
||||||
|
- Autenticacion obligatoria: contrasena individual o global requerida
|
||||||
|
|
||||||
|
**Archivos Descargados**:
|
||||||
|
- `config/encryption_key.secret`: Clave de encriptacion para descifrar contrasenas
|
||||||
|
- `data/user_passwords.json`: Archivo JSON con contrasenas encriptadas por Radio ID
|
||||||
|
|
||||||
|
### Configuration Management
|
||||||
|
|
||||||
|
**Problem**: Complex multi-system configuration with ACLs, bridges, and network parameters
|
||||||
|
**Solution**: INI-based configuration parsed by `config.py`
|
||||||
|
- Centralized configuration in `config/adn.cfg`
|
||||||
|
- ACL (Access Control List) processing for registration and talkgroup filtering
|
||||||
|
- Support for both whitelist and blacklist approaches
|
||||||
|
- Language preferences and multi-language support via `languages.py`
|
||||||
|
|
||||||
|
### Monitoring and Reporting
|
||||||
|
|
||||||
|
**Problem**: Need visibility into system operation, connections, and traffic
|
||||||
|
**Solution**: Network-based reporting protocol
|
||||||
|
- `report_receiver.py` and `report_sql.py` consume events from the core server
|
||||||
|
- Pickle-based serialization for config/bridge state transmission
|
||||||
|
- Opcode-based protocol defined in `reporting_const.py`
|
||||||
|
- SQL integration option for persistent event logging
|
||||||
|
|
||||||
|
**Rationale**: Separates monitoring concerns from core routing logic, enables multiple monitoring tools.
|
||||||
|
|
||||||
|
### Asterisk Integration
|
||||||
|
|
||||||
|
**Problem**: Integration with Asterisk PBX for advanced features (app_rpt)
|
||||||
|
**Solution**: Asterisk Manager Interface (AMI) client in `AMI.py`
|
||||||
|
- Sends RPT (repeater) commands to Asterisk
|
||||||
|
- Uses Twisted LineReceiver for line-based protocol handling
|
||||||
|
- Supports node-specific command routing
|
||||||
|
|
||||||
|
### API Layer
|
||||||
|
|
||||||
|
**Problem**: External systems need programmatic access to server functions
|
||||||
|
**Solution**: XML-RPC and SOAP API implementation
|
||||||
|
- `API.py` implements Spyne-based SOAP service (FD_API)
|
||||||
|
- Peer validation and authentication endpoints
|
||||||
|
- `api_client.py` provides example XML-RPC client
|
||||||
|
- Key-based authentication for peer systems
|
||||||
|
|
||||||
|
## External Dependencies
|
||||||
|
|
||||||
|
### Network Protocols
|
||||||
|
- **Twisted** (>= 16.3.0) - Asynchronous networking framework for all protocol handling
|
||||||
|
- **dmr_utils3** (>= 0.1.19) - DMR protocol utilities for packet encoding/decoding, BPTC, Golay error correction
|
||||||
|
|
||||||
|
### Database Systems
|
||||||
|
- **MySQL/MariaDB** - Via twisted.enterprise.adbapi and MySQLdb
|
||||||
|
- Used by `proxy_db.py` for self-service proxy client management
|
||||||
|
- Stores client registrations, authentication, and connection tracking
|
||||||
|
- Optional for report_sql.py event logging
|
||||||
|
|
||||||
|
### Remote Object Communication
|
||||||
|
- **Pyro5** - Python Remote Objects for inter-process communication
|
||||||
|
- Used by proxy services for distributed architecture
|
||||||
|
- Enables separation of proxy components across processes/hosts
|
||||||
|
|
||||||
|
### Third-Party Services
|
||||||
|
- **radioid.net API** - DMR ID database lookups
|
||||||
|
- `peer_ids.json`, `subscriber_ids.json`, `talkgroup_ids.json` downloaded from external sources
|
||||||
|
- Cached locally with staleness checking via `utils.py::try_download()`
|
||||||
|
- Provides callsign/name resolution for DMR IDs
|
||||||
|
|
||||||
|
### Supporting Libraries
|
||||||
|
- **bitarray/bitstring** - Binary data manipulation for DMR packet construction
|
||||||
|
- **configparser** - INI file parsing for hblink.cfg
|
||||||
|
- **setproctitle** - Process naming for easier system monitoring
|
||||||
|
- **resettabletimer** - Timeout management for connection tracking
|
||||||
|
- **hashlib/hmac** - Cryptographic functions for authentication
|
||||||
|
|
||||||
|
### Language/Voice Assets
|
||||||
|
- Pre-recorded AMBE voice files in Audio/ directory
|
||||||
|
- Multiple language support (en_GB, es_ES, fr_FR, de_DE, dk_DK, it_IT, no_NO, pl_PL, se_SE, pt_PT, cy_GB, el_GR, th_TH, CW)
|
||||||
|
- Voice file indexing via i8n_voice_map.py
|
||||||
@ -0,0 +1,210 @@
|
|||||||
|
#!/usr/bin/env python
|
||||||
|
import os
|
||||||
|
import logging
|
||||||
|
import urllib.request
|
||||||
|
import urllib.error
|
||||||
|
import tempfile
|
||||||
|
import shutil
|
||||||
|
import socket
|
||||||
|
from time import time
|
||||||
|
|
||||||
|
logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
DOWNLOAD_INTERVAL_PASSWORDS = 300
|
||||||
|
DOWNLOAD_INTERVAL_ENCRYPTION = None
|
||||||
|
|
||||||
|
_last_passwords_download = 0
|
||||||
|
_last_passwords_size = 0
|
||||||
|
_last_passwords_content = None
|
||||||
|
|
||||||
|
def resolve_hostname(hostname, timeout=10):
|
||||||
|
try:
|
||||||
|
old_timeout = socket.getdefaulttimeout()
|
||||||
|
socket.setdefaulttimeout(timeout)
|
||||||
|
ip = socket.gethostbyname(hostname)
|
||||||
|
socket.setdefaulttimeout(old_timeout)
|
||||||
|
logger.debug('(SECURITY) Resolved %s to %s', hostname, ip)
|
||||||
|
return ip
|
||||||
|
except socket.gaierror as e:
|
||||||
|
logger.error('(SECURITY) DNS resolution failed for %s: %s', hostname, str(e))
|
||||||
|
return None
|
||||||
|
except Exception as e:
|
||||||
|
logger.error('(SECURITY) Unexpected error resolving %s: %s', hostname, str(e))
|
||||||
|
return None
|
||||||
|
|
||||||
|
def build_download_url(config, filename):
|
||||||
|
url_security = config['GLOBAL'].get('URL_SECURITY', '').strip()
|
||||||
|
port_security = config['GLOBAL'].get('PORT_SECURITY', '').strip()
|
||||||
|
pass_security = config['GLOBAL'].get('PASS_SECURITY', '').strip()
|
||||||
|
|
||||||
|
if not url_security or not port_security or not pass_security:
|
||||||
|
return None, None
|
||||||
|
|
||||||
|
try:
|
||||||
|
socket.inet_aton(url_security)
|
||||||
|
host = url_security
|
||||||
|
except socket.error:
|
||||||
|
host = resolve_hostname(url_security)
|
||||||
|
if not host:
|
||||||
|
logger.error('(SECURITY) Could not resolve hostname: %s', url_security)
|
||||||
|
return None, None
|
||||||
|
|
||||||
|
url = f"http://{host}:{port_security}/descargar?pass={pass_security}&file={filename}"
|
||||||
|
return url, url_security
|
||||||
|
|
||||||
|
def download_file_safely(url, dest_path, timeout=60):
|
||||||
|
try:
|
||||||
|
temp_fd, temp_path = tempfile.mkstemp()
|
||||||
|
os.close(temp_fd)
|
||||||
|
|
||||||
|
try:
|
||||||
|
logger.debug('(SECURITY) Attempting download from: %s', url)
|
||||||
|
req = urllib.request.Request(url)
|
||||||
|
req.add_header('User-Agent', 'ADN-Systems-DMR/1.0')
|
||||||
|
|
||||||
|
with urllib.request.urlopen(req, timeout=timeout) as response:
|
||||||
|
content = response.read()
|
||||||
|
|
||||||
|
if len(content) == 0:
|
||||||
|
logger.warning('(SECURITY) Downloaded file is empty, keeping existing: %s', dest_path)
|
||||||
|
os.unlink(temp_path)
|
||||||
|
return False
|
||||||
|
|
||||||
|
with open(temp_path, 'wb') as f:
|
||||||
|
f.write(content)
|
||||||
|
|
||||||
|
os.makedirs(os.path.dirname(dest_path), exist_ok=True)
|
||||||
|
shutil.move(temp_path, dest_path)
|
||||||
|
logger.info('(SECURITY) Successfully downloaded: %s (%d bytes)', dest_path, len(content))
|
||||||
|
return True
|
||||||
|
|
||||||
|
except urllib.error.HTTPError as e:
|
||||||
|
logger.error('(SECURITY) HTTP error downloading %s: %s (Code: %d)', dest_path, str(e), e.code)
|
||||||
|
if os.path.exists(temp_path):
|
||||||
|
os.unlink(temp_path)
|
||||||
|
return False
|
||||||
|
except urllib.error.URLError as e:
|
||||||
|
logger.error('(SECURITY) URL error downloading %s: %s', dest_path, str(e.reason))
|
||||||
|
if os.path.exists(temp_path):
|
||||||
|
os.unlink(temp_path)
|
||||||
|
return False
|
||||||
|
except socket.timeout:
|
||||||
|
logger.error('(SECURITY) Timeout downloading %s', dest_path)
|
||||||
|
if os.path.exists(temp_path):
|
||||||
|
os.unlink(temp_path)
|
||||||
|
return False
|
||||||
|
|
||||||
|
except Exception as e:
|
||||||
|
logger.error('(SECURITY) Unexpected error downloading %s: %s', dest_path, str(e))
|
||||||
|
return False
|
||||||
|
|
||||||
|
def download_encryption_key(config):
|
||||||
|
hash_encrypt = config['GLOBAL'].get('HASH_ENCRYPT', 'encryption_key.secret').strip()
|
||||||
|
dest_path = os.path.join('config', hash_encrypt)
|
||||||
|
|
||||||
|
url, original_host = build_download_url(config, hash_encrypt)
|
||||||
|
if not url:
|
||||||
|
logger.debug('(SECURITY) Security server not configured, skipping encryption key download')
|
||||||
|
return False
|
||||||
|
|
||||||
|
logger.info('(SECURITY) Downloading encryption key from central server...')
|
||||||
|
return download_file_safely(url, dest_path)
|
||||||
|
|
||||||
|
def download_user_passwords(config, force=False):
|
||||||
|
global _last_passwords_download, _last_passwords_size, _last_passwords_content
|
||||||
|
|
||||||
|
current_time = time()
|
||||||
|
if not force and (current_time - _last_passwords_download) < DOWNLOAD_INTERVAL_PASSWORDS:
|
||||||
|
return False
|
||||||
|
|
||||||
|
users_pass = config['GLOBAL'].get('USERS_PASS', 'user_passwords.json').strip()
|
||||||
|
dest_path = os.path.join('data', users_pass)
|
||||||
|
|
||||||
|
url, original_host = build_download_url(config, users_pass)
|
||||||
|
if not url:
|
||||||
|
logger.debug('(SECURITY) Security server not configured, skipping passwords download')
|
||||||
|
return False
|
||||||
|
|
||||||
|
try:
|
||||||
|
logger.debug('(SECURITY) Downloading passwords from: %s', url)
|
||||||
|
req = urllib.request.Request(url)
|
||||||
|
req.add_header('User-Agent', 'ADN-Systems-DMR/1.0')
|
||||||
|
|
||||||
|
with urllib.request.urlopen(req, timeout=60) as response:
|
||||||
|
new_content = response.read()
|
||||||
|
new_size = len(new_content)
|
||||||
|
|
||||||
|
if new_size == 0:
|
||||||
|
logger.warning('(SECURITY) Downloaded passwords file is empty, keeping existing')
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
return False
|
||||||
|
|
||||||
|
if _last_passwords_content is not None:
|
||||||
|
if new_content == _last_passwords_content:
|
||||||
|
logger.debug('(SECURITY) Passwords file unchanged, no update needed')
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
return False
|
||||||
|
|
||||||
|
temp_fd, temp_path = tempfile.mkstemp()
|
||||||
|
os.close(temp_fd)
|
||||||
|
|
||||||
|
with open(temp_path, 'wb') as f:
|
||||||
|
f.write(new_content)
|
||||||
|
|
||||||
|
os.makedirs(os.path.dirname(dest_path), exist_ok=True)
|
||||||
|
shutil.move(temp_path, dest_path)
|
||||||
|
|
||||||
|
_last_passwords_content = new_content
|
||||||
|
_last_passwords_size = new_size
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
|
||||||
|
logger.info('(SECURITY) Successfully updated passwords file: %s (%d bytes)', dest_path, new_size)
|
||||||
|
return True
|
||||||
|
|
||||||
|
except urllib.error.HTTPError as e:
|
||||||
|
logger.error('(SECURITY) HTTP error downloading passwords: %s (Code: %d)', str(e), e.code)
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
return False
|
||||||
|
except urllib.error.URLError as e:
|
||||||
|
logger.error('(SECURITY) URL error downloading passwords: %s', str(e.reason))
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
return False
|
||||||
|
except socket.timeout:
|
||||||
|
logger.error('(SECURITY) Timeout downloading passwords')
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
return False
|
||||||
|
except Exception as e:
|
||||||
|
logger.error('(SECURITY) Unexpected error downloading passwords: %s', str(e))
|
||||||
|
_last_passwords_download = current_time
|
||||||
|
return False
|
||||||
|
|
||||||
|
def init_security_downloads(config):
|
||||||
|
url_security = config['GLOBAL'].get('URL_SECURITY', '').strip()
|
||||||
|
if not url_security:
|
||||||
|
logger.info('(SECURITY) Central security server not configured')
|
||||||
|
return False
|
||||||
|
|
||||||
|
port_security = config['GLOBAL'].get('PORT_SECURITY', '').strip()
|
||||||
|
|
||||||
|
logger.info('(SECURITY) Initializing centralized security downloads...')
|
||||||
|
logger.info('(SECURITY) Security server: %s:%s', url_security, port_security)
|
||||||
|
|
||||||
|
try:
|
||||||
|
socket.inet_aton(url_security)
|
||||||
|
logger.info('(SECURITY) Using IP address: %s', url_security)
|
||||||
|
except socket.error:
|
||||||
|
resolved_ip = resolve_hostname(url_security)
|
||||||
|
if resolved_ip:
|
||||||
|
logger.info('(SECURITY) Resolved hostname %s to IP: %s', url_security, resolved_ip)
|
||||||
|
else:
|
||||||
|
logger.error('(SECURITY) Failed to resolve hostname: %s', url_security)
|
||||||
|
return False
|
||||||
|
|
||||||
|
download_encryption_key(config)
|
||||||
|
|
||||||
|
download_user_passwords(config, force=True)
|
||||||
|
|
||||||
|
return True
|
||||||
|
|
||||||
|
def periodic_password_download(config):
|
||||||
|
download_user_passwords(config)
|
||||||
Loading…
Reference in new issue