perl API client

milanc · Tue Aug 23, 2011 3:43 am

It works, thank you very much. Just the following warning is written...

Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
Use of uninitialized value in hash element at /usr/local/lib/perl5/site_perl/5.10.1/Mtik.pm line 414.
$VAR1 = {
          '' => {
                  'rtc-running' => 'false',
                  'battery-voltage' => '2760',
                  'smart-boost' => 'false',
                  'on-battery' => 'false',
                  'overload' => 'false',
                  'runtime-left' => '02:31:00',
                  'transfer-cause' => 'Line voltage notch or spike',
                  'smart-trim' => 'false',
                  'replace-battery' => 'false',
                  'frequency' => '50',
                  'line-voltage' => '24050',
                  'on-line' => 'true',
                  'low-battery' => 'false',
                  'load' => '5',
                  'output-voltage' => '24050',
                  'temperature' => '5620',
                  'battery-charge' => '100'
                }
        };

Chupaka · Wed Aug 24, 2011 1:50 am

and what's on line 414? =)

milanc · Sun Aug 28, 2011 4:29 am

Hi, is in function get_by_key

    foreach (@results) {
        my $item = $_;

        foreach my $result_key (keys (%$item)) {
            if (exists($item->{$key})) {
                if ($key eq $result_key) {
                    $result_hash->{ $item->{$key} } = $item
                }
            }
            else {
                $result_hash->{ $item->{'.id'} } = $item  <--- HERE
            }
        }
    }

Thanks.

nightsnake · Thu Jun 28, 2012 1:33 pm

Hello!

Download this module, but it's don't connect to my RB:

>>> /login
start read_len
read_len got 5
recv 5
<<< !done
start read_len
read_len got 37
recv 37
<<< =ret=5d6f57de5c78f9305a19e17e11ff47cf
start read_len
read_len got 0
Use of uninitialized value in pack at Mtik.pm line 292.
>>> /login
>>> =name=admin
>>> =response=0088d75a26cd50e9304521a8b0bba09a85
start read_len
read_len got 5
recv 5
<<< !trap
start read_len
read_len got 22
recv 22
<<< =message=cannot log in
start read_len
read_len got 0

janisk · Mon Jul 02, 2012 11:50 am

Hello!

Download this module, but it's don't connect to my RB:

is API service enabled?

Chupaka · Tue Jul 03, 2012 1:54 am

is API service enabled?

seems like it is:

=ret=5d6f57de5c78f9305a19e17e11ff47cf

mmino7 · Wed Sep 12, 2012 8:51 pm

Hi all,

where can I find last release of perl API.

janisk · Fri Sep 14, 2012 4:19 pm

check the first post of this thread. Also, if you check

http://wiki.mikrotik.com/wiki/Manual:API

it has link where the code/binaries can be found

savage · Fri May 10, 2013 4:15 pm

Hi,

I currently use telnet to (rather frequently) fetch /ip firewall connection print count-only where src-address~"x.x.x.x:" assured

How would I be sending this via the API? I'm not having much success...

Chupaka · Thu May 16, 2013 4:33 pm

unfortunately, there's no 'regexp' query in API, so you cannot do this

MT Staff, a little feature request: split that 'src-address' to 'src-address' and 'src-port', so it be possible to make queries to /ip firewall connections via API

or maybe some additional query operators to match '*-address' not only by address part but also by IP subnet.

noyo · Wed Aug 14, 2013 11:40 pm

how to incorporate timeout? / how to set timeout? in script api mt perl

Chupaka · Thu Aug 15, 2013 11:44 am

what timeout?

noyo · Thu Aug 15, 2013 11:49 am

Timeout when no response from mikrotik.

I worked it out.

edit Mtik.pm end:

my $sock = new IO::Socket::INET(
PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp',
Timeout => 3);

it works

efaden · Tue Aug 27, 2013 4:05 pm

Trying to get source from a script hangs... Anyone help? I am trying to get/set script source content from the API. Not sure if it is possible.

This Hangs:

perl code

my (%attrs);
$attrs{'.proplist'} = ".id,name,source";
	
my (%queries);
$queries{'name'} = "MyScript";

my($retval,@results) = Mtik::mtik_query('/system/script/print',\%attrs,\%queries);

print Dumper(\@results);

This Doesn't:

perl code

my (%attrs);
$attrs{'.proplist'} = ".id,name";
	
my (%queries);
$queries{'name'} = "MyScript";

my($retval,@results) = Mtik::mtik_query('/system/script/print',\%attrs,\%queries);

print Dumper(\@results);

Added to Mtik.pm:

perl code

sub mtik_query
{
    my($cmd) = shift;
    my(%attrs) = %{(shift)};
	my(%queries) = %{(shift)};
    $error_msg = '';
    my(@command);
    push(@command,$cmd);
    foreach my $attr (keys (%attrs))
    {
        push(@command,'=' . $attr . '=' . $attrs{$attr});
    }
    foreach my $query (keys (%queries))
    {
        push(@command,'?' . $query . '=' . $queries{$query});
    }
    my($retval,@results) = talk(\@command);
    if ($retval > 1)
    {
        $error_msg = $results[0]{'message'};
    }
    return ($retval,@results);
}

janisk · Tue Aug 27, 2013 4:15 pm

using python (3) client:

/system/script/print

<<< /system/script/print
<<< 
>>> !re
>>> =.id=*1
>>> =name=script1
>>> =owner=admin
>>> =policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api
>>> =run-count=0
>>> =source=asdfasdfasdfsadf
>>> =invalid=false
>>> 
>>> !done
>>>

source is just fast example of error:
asdfasdfasdfsadf

so this is language specific.

efaden · Tue Aug 27, 2013 4:24 pm

using python (3) client:
Code: Select all
/system/script/print

<<< /system/script/print
<<< 
>>> !re
>>> =.id=*1
>>> =name=script1
>>> =owner=admin
>>> =policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api
>>> =run-count=0
>>> =source=asdfasdfasdfsadf
>>> =invalid=false
>>> 
>>> !done
>>> 
source is just fast example of error:
asdfasdfasdfsadf

so this is language specific.

Yeah... I think I narrowed it down. I am pretty sure there is an error in the reading of the line length somewhere.... So yes.. it is library specific. Now if I could find the bug.

Tue Aug 27, 2013 4:36 pm

Yeah... I think I narrowed it down. I am pretty sure there is an error in the reading of the line length somewhere.... So yes.. it is library specific. Now if I could find the bug.

Given that most words are read fine, and only the last one is the problem, length decoding is probably not the issue.

It appers the real culprit may be the lack of socket buffering, which most API clients don't do. In the vast majority of cases, this is a problem only when you have large words, but if the speed of your connection to the router is low enough, you can experience it even with just a few bytes, as the case here. I think other than my client, there was only one other which did such buffering, but I don't remember which one it was... I think maybe Ruby, or ActionScript.

efaden · Tue Aug 27, 2013 4:42 pm

Yeah... I think I narrowed it down. I am pretty sure there is an error in the reading of the line length somewhere.... So yes.. it is library specific. Now if I could find the bug.
Given that most words are read fine, and only the last one is the problem, length decoding is probably not the issue.

It appers the real culprit may be the lack of socket buffering, which most API clients don't do. In the vast majority of cases, this is a problem only when you have large words, but if the speed of your connection to the router is low enough, you can experience it even with just a few bytes, as the case here. I think other than my client, there was only one other which did such buffering, but I don't remember which one it was... I think maybe Ruby, or ActionScript.

Interesting.... I wonder the best way to fix it. It is getting to the last word... reading part of it... reading "!do" then reads the length of the next word as "ne" and is trying to read 111 bytes... only finds 2 and fails.

Tue Aug 27, 2013 4:44 pm

It needs to be fixed in a generic fashion - the procedure that reads words needs to try read some data, then check out how much data it ACTUALLY received, and substract THAT from the length, and retry the remaining bytes.

What most clients do instead is that they read the length as, say "5 bytes", then they ask for 5 bytes, and assume they got what they asked for, when in fact, they got just 3 bytes.

efaden · Tue Aug 27, 2013 4:47 pm

It needs to be fixed in a generic fashion - the procedure that reads words needs to try read some data, then check out how much data it ACTUALLY received, and substract THAT from the length, and retry the remaining bytes.

What most clients do instead is that they read the length as, say "5 bytes", then they ask for 5 bytes, and assume they got what they asked for, when in fact, they got just 3 bytes.

It is theoretically doing that....

janisk · Tue Aug 27, 2013 4:51 pm

i really doubt that he is running out of TCP buffers set by OS. Unless perl uses something different. And usually TCP buffer is enough.

Tue Aug 27, 2013 5:01 pm

i really doubt that he is running out of TCP buffers set by OS. Unless perl uses something different. And usually TCP buffer is enough.

It's not about "runinng out" per se, but about not addressing how OS socket functions work - i.e. them being unreliable in terms of fetching what you ask for. People look at receivers like "give me N bytes", when in fact, they work as "give me all you've got, even if it's just 1 byte... just don't give me more than N bytes".

But after looking at the source, it appears efaden is right, and the Perl client is actually THE very other client which does such buffering, and I failed to remember (I'm terrible... I apologize).

The problem then seems to be in the recursive read_len calls - if you have a two byte length such as "10000001 100000000", instead of being decoded as "00000001 100000000" (384), it will be read as a three byte length, with the start of the second byte indicating a third length byte, which can become even more problematic if the next byte also starts with "1". Eventually, the client will start demanding more bytes then actually exist, and will hang because it will keep retrying for bytes that ultimately will never come. The problem would occur if ANY word in the stream has such sort of a length, which in this case is likely one of the scripts' source.

Within read_len, replace all read_len calls with a simple ord($sock->recv($line,1)), and things should be back to normal.

P.S. It's times like this that make me ask why aren't projects like this on GitHub. I would've made a pull request about this already by now.

efaden · Tue Aug 27, 2013 5:40 pm

There was a bug in read_len... I thought I fixed it, but there is still a bug. Fixing it... or trying to.

Tue Aug 27, 2013 5:45 pm

There was a bug in read_len... I thought I fixed it, but there is still a bug. Fixing it... or trying to.

I saw the source for the brief time you posted it - do the "<<= 8" first, and THEN "+=" the new byte, not the other way around.

efaden · Tue Aug 27, 2013 6:23 pm

FIXED, Any length > 128 was reading incorrectly. Basically I modified it to mirror the Python code. There were several issues. It works now.

See the next post for the updated PM file.

efaden · Tue Aug 27, 2013 9:31 pm

Updated a few things....

Added the timeout parameter, fixed write_len for lengths > 0x80, fixed read_len for lengths > 0x80, and fixed allowing of newlines in the read_sentence.

I am now able to read and write scripts... woot!

I think I got all of my debugging out of the pm file. Let me know if you see anything else.

-Eric

farnsworth78 · Fri Oct 18, 2013 7:36 am

Updated a few things....

Added the timeout parameter, fixed write_len for lengths > 0x80, fixed read_len for lengths > 0x80, and fixed allowing of newlines in the read_sentence.

I am now able to read and write scripts... woot!

I think I got all of my debugging out of the pm file. Let me know if you see anything else.

-Eric

Can you add $sock->autoflush(0) ?
I wrote test program (it add 250 ips to address-list "using Mtik::mtik_cmd('/ip/firewall/address-list/add',\%attr);")
with $sock->autoflush(1) it takes ~60 sec .
with $sock->autoflush(0) it takes ~27 sec .

==== some changes
sub mtik_connect
{
my($host) = shift;
my($port) = shift || 8728;
if (!($host))
{
print "no host!\n";
return 0;
}
my($sock) = new IO::Socket::INET(
PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp');
if (!($sock))
{
print "no socket :$!\n";
return 0;
}
$sock->autoflush(0); #<---- ADD THIS LINE
return $sock;
}
sub write_sentence {
my($sentence_ref) = shift;
my(@sentence) = @$sentence_ref;
foreach my $word (@sentence)
{
write_word($word);
if ($debug > 2)
{
print ">>> $word\n";
}
}
write_word('');
$sock->flush(); #<---- ADD THIS LINE
}

How to add ips to address list at once (like "enable/disable/remove" do )?

efaden · Fri Oct 18, 2013 1:18 pm

Updated a few things....

Added the timeout parameter, fixed write_len for lengths > 0x80, fixed read_len for lengths > 0x80, and fixed allowing of newlines in the read_sentence.

I am now able to read and write scripts... woot!

I think I got all of my debugging out of the pm file. Let me know if you see anything else.

-Eric
Can you add $sock->autoflush(0) ?
I wrote test program (it add 250 ips to address-list "using Mtik::mtik_cmd('/ip/firewall/address-list/add',\%attr);")
with $sock->autoflush(1) it takes ~60 sec .
with $sock->autoflush(0) it takes ~27 sec .

==== some changes
sub mtik_connect
{
my($host) = shift;
my($port) = shift || 8728;
if (!($host))
{
print "no host!\n";
return 0;
}
my($sock) = new IO::Socket::INET(
PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp');
if (!($sock))
{
print "no socket :$!\n";
return 0;
}
$sock->autoflush(0); #<---- ADD THIS LINE
return $sock;
}
sub write_sentence {
my($sentence_ref) = shift;
my(@sentence) = @$sentence_ref;
foreach my $word (@sentence)
{
write_word($word);
if ($debug > 2)
{
print ">>> $word\n";
}
}
write_word('');
$sock->flush(); #<---- ADD THIS LINE
}

How to add ips to address list at once (like "enable/disable/remove" do )?

Feel free to add it. I don't actually maintain the thing. I just went to use it and found a bunch of errors in it, so I fixed them.

As for adding multiple IPs.... I'm not sure you can.

dahili · Sun Nov 10, 2013 10:21 pm

To cheesegrits: If you will add this info to the wiki, I will give you a free RouterOS license!

To normis: Dear friend i am looking some one who able to make perl or php basic gui for few commands for me i will pay works! my email : atilla.o.ersoz [at] gmail.com please get in touch with me

dahili · Sun Nov 10, 2013 10:43 pm

in API, you can use shortened value names, like in CLI; e.g.

/ip/route/print
=n=*1
=val=routing-mark

instead of

/ip/route/print
=numbers=*1
=value-name=routing-mark

isn't it a bit dangerous? maybe it should be forbidden, to avoid possible future problems? API is not CLI for humans...

To forum guru i am looking some one who are able to do it perl or php little gui for me only few commands please recomend me some one my email is atilla.o.erso [at] gmail.com i am sorry for this message hire

Sun Nov 10, 2013 11:41 pm

in API, you can use shortened value names, like in CLI; e.g.

Really? Since which version? Last I checked (right now, with 6.5), that's not the case, protocol wise at least.

To forum guru i am looking some one who are able to do it perl or php little gui for me only few commands please recomend me some one my email is atilla.o.erso [at] gmail.com i am sorry for this message hire

The next version of my client (in PHP, from my signature) will provide an interactive command line utility that you can type raw commands in. You can get the current state from its develop branch on GitHub if you can't wait for a tagged release (which is held up for a few reasons, one of which is that for the console, you need to also get the current untagged PEAR2_Console_CommandLine for it to work...).

Chupaka · Wed Nov 20, 2013 4:10 pm

in API, you can use shortened value names, like in CLI; e.g.
Really? Since which version? Last I checked (right now, with 6.5), that's not the case, protocol wise at least.

it was 4,5 years ago

read the next message: "Shortened names will not be allowed in 3.25+ versions"

akschu · Sat Nov 22, 2014 12:54 am

This is a bit of a hack, but I needed something in perl so I extended this code to use ssl. Attached is the module.

noyo · Sat Jan 10, 2015 2:11 pm

Why if you accidentally give ssh port is a connection. Do not hang up just waiting for something.
Contribution to IO::Socket::INET Timeout but it does not work.

davestahr · Sun Feb 15, 2015 7:26 pm

Updated a few things....

Thanks! This fixed a problem I've been having with perl API for years.

camlost · Thu May 07, 2015 10:31 am

Finally found this repo on github

Unfortunately, it's based on original cheesegrits module, withoud efaden modifications, so I created pull-request.

Maybe, we finally can maintain and download fresh and bug-free module from github.

davestahr · Thu May 07, 2015 2:48 pm

I know there's sometimes a financial nudge that can be given to people developing and maintaining open-source software. I'd like to offer that nudge to an individual or group who might be interested in further developing and refining this perl API. Anyone interested? I'm a perl programmer, but some of the API stuff is a bit beyond the scope of my talents.

efaden · Mon May 25, 2015 12:54 pm

What needs fixing? I'm still around. I'm happy to try to fix some bugs, especially if there is money involved.

davestahr · Mon May 25, 2015 6:08 pm

Thanks for the reply, I'm glad to hear someone with more skills than me is around on here! It might not be anything more than poor implementation of code on my part, or perhaps the the information simply isn't available from the API, but I'm having difficulty getting some of the hardware stats from system->resources, such as uptime. I don't have time at the moment to go dig up what I can't see, but I'll look into it and post back here when I've got the time.

efaden · Mon May 25, 2015 7:11 pm

Let's set up a repository somewhere... Then make sure we get the latest code on there (that I fixed)... then I can start to work on it again.

Mon May 25, 2015 7:13 pm

Let's set up a repository somewhere... Then make sure we get the latest code on there (that I fixed)... then I can start to work on it again.

As camlost said above, there is a repo on GitHub, but without your modifications.

Maybe you could fork it, apply your mod, and keep maintaining it from that point (no PRs to the "original")?

efaden · Mon May 25, 2015 8:35 pm

Set up a new repository with my changes in it... https://github.com/efaden/MikroTikPerl

Let me know if you want access.

akschu · Thu Aug 27, 2015 9:54 pm

I think the code that Efaden put on github is probably the best bet since it fixes the length issue, as well as gives us a place to track change, but it didn't have port or ssl support. I forked his code and added those featuers:

https://github.com/akschu/MikroTikPerl

Efaden, please consider merging my pull request.

noyo · Thu Aug 27, 2015 10:01 pm

I think the code that Efaden put on github is probably the best bet since it fixes the length issue, as well as gives us a place to track change, but it didn't have port or ssl support. I forked his code and added those featuers:

https://github.com/akschu/MikroTikPerl

Efaden, please consider merging my pull request.

I modified it because some things were missing. Also, I added ssl. This can be done simply by reviewing client @akschu.

efaden · Thu Aug 27, 2015 11:25 pm

Merged. And added you as a collaborator.

camlost · Mon Sep 28, 2015 4:27 pm

I have plans and time to add object-oriented interface to module and publish it in CPAN.

2 efaden:
Will you accept PR which implelents it?

marting · Mon Dec 07, 2015 4:02 pm

Hi camlost,
did you make any progress and are you willing to share it?
I will have to do the same, the current version is nearly unusable in larger projects.
Regards
Martin

marting · Wed Dec 09, 2015 8:07 pm

I reworked it to OO and published it at github. See http://forum.mikrotik.com/viewtopic.php?f=9&t=102923 for more details.

hknet · Fri Aug 05, 2016 11:46 pm

well, I'm a bit lost, anyone knowing which perl API might be maintained?
it seems the later "MikroTik.pm" is no more working for scripts originally based on the "Mtik.pm" by Hugh.

our nagios checks use the older lib.

now I ran into a problem - I'm trying to implement something like:
/ip/route/print count where routing-mark=VRF
so we could alert if we loose routes or get a lot more than planned for

the printing works with our old-style Mtik.pm programming, but options like count and where?

any lead appreciated.

regards,
hk

efaden · Sat Aug 06, 2016 12:07 am

I haven't updated it in a while.... but

https://github.com/efaden/MikroTikPerl

was working last time I looked.

bbs2web · Mon Jan 29, 2018 2:47 pm

Many thanks to all that have contributed to the MikroTik Perl API.

We previously used the ported OO version, as it had the nicest interface and was in CPAN (Comprehensive Perl Archive Network). We however needed to reduce overheads as the OO version utilises the Perl Moose library and subsequently retrieved the version the efaden posted and applied minimal changes from the OO ported version.

Perl OO version, in CPAN: https://metacpan.org/release/MikroTik-API
Latest patched version (efaden): https://github.com/efaden/MikroTikPerl

Herewith our version, which essentially makes minor changes to efaden's version:

API2.zip

Changes:

3 second timeout on connections
specify whether or not you want SSL (efaden's would switch to SSL when port was 8729)
custom port specification (efaden's version couldn't use any port other than 8729 for SSL)
return '$retval' when not '!done', '!trap' or '!fatal'

Performance comparison:

OO version from CPAN (primarily due to it including the 'Moose' library):
Code: Select all
```
Total Elapsed Time = 2.998272 Seconds
  User+System Time = 0.508272 Seconds
```

efaden's version:

Total Elapsed Time = 0.077465 Seconds
  User+System Time = 0.077465 Seconds

To install, create a directory such as '/usr/local/share/perl5/MikroTik' and place API2.pm in that directory. Then simply include 'use MikroTik::API2;' in your script.

For those converting from the OO version of the MikroTik API on CPAN to efaden's one, herewith a sample diff:

--- /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_old.pl      2017-04-04 05:53:43.547467546 +0200
+++ /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status.pl  2018-01-28 08:50:56.437834735 +0200
@@ -1,10 +1,11 @@
 #!/usr/bin/perl
 use strict;
 use warnings;
-use MikroTik::API;     # http://search.cpan.org/~martingo/MikroTik-API/lib/MikroTik/API/Examples.pm
+use MikroTik::API2;    # https://github.com/efaden/MikroTikPerl/blob/master/MikroTik.pm
 use Fcntl qw(:flock);
 use Storable qw(lock_store lock_nstore lock_retrieve);

+my $use_ssl = 1;
 my ($router, $api_user, $api_passwd, $command, $peer, $key) = @ARGV;
 if (not defined $router) { print STDERR "Need router FQDN or IP, as first parameter.\n"; exit 3 };
 if (not defined $api_user) { print STDERR "Need MikroTik API username, as second parameter.\n"; exit 4 };
@@ -25,16 +26,6 @@
   return ($years*31536000)+($weeks*604800)+($days*86400)+($hours*3600)+($minutes*60)+$seconds;
 }

-my $api = MikroTik::API->new (
-  {
-    host        => $router,
-    username    => $api_user,
-    password    => $api_passwd,
-    use_ssl     => 1,
-    autoconnect => 0,
-  }
-);
-
 my %bgp_peer;
 my $cached = 0;
 my $modified = (stat($cachefile))[9];
@@ -46,10 +37,9 @@
 }
 if ($cached == 0) {
   if (!flock $lockfile, LOCK_EX | LOCK_NB) { print STDERR "Another process is already using MikroTik API.\n"; exit 6 };
-  $api->connect();
-  $api->login();
-  %bgp_peer = $api->get_by_key('/routing/bgp/peer/print', 'name');
-  $api->logout();
+  MikroTik::login($router, $api_user, $api_passwd, $use_ssl);
+  %bgp_peer = MikroTik::get_by_key('/routing/bgp/peer/print', 'name');
+  MikroTik::logout;
   lock_nstore \%bgp_peer, $cachefile;
   chmod 0660, $cachefile;
   flock $lockfile, LOCK_UN;

bbs2web · Tue Jan 30, 2018 10:29 pm

The following is however again much faster:

real    0m0.003s
user    0m0.003s
sys     0m0.001s

An improvement of over 7700%.

We work around Perl's compilation overheads:

Convert script to TCP server which compiles once, listens on port 7890 and then forks children

Replace existing script with simple netcat wrapper:

[root@zabbix ~]# /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms 'FakeP@ssw0rd' -d; echo $?
{
        "data": [
                { "{#BGPPEER}": "iOnline" }
        ]
}
0
[root@zabbix ~]# cat /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh
#!/bin/sh
echo "'$1'" "'$2'" "'$3'" "'$4'" "'$5'" "'$6'" | /usr/bin/nc -w 3 127.0.0.1 7890;
exit $?;

Changes to convert script itself to a standalone tcp server:

Alter all print statements (eg 'print', 'print STDERR', and 'printf') to output to '$client'

-print STDERR "Another ...
+print $client "Another ...
-printf ("%-25.25s ...
+printf $client ("%-25.25s ...

Encapsulate script's previous main section by starting with the following subroutine definition and appending '}'. These changes result in the tcp server reading up to 250 characters worth of commands, instead of them being supplied directly as script arguments:
Code: Select all
```
sub handle_client {
  my $client = shift;
  my $msg;
  $client->recv($msg, 250);
  my ($router, $api_user, $api_passwd, $command, $peer, $key) = quotewords('\s+', 0, $msg);
  #my ($router, $api_user, $api_passwd, $command, $peer, $key) = @ARGV;
```

New main body listens for tcp connections on port 7890 on the loopback adapter and forks child for each connection:

use IO::Socket::INET;
use Text::ParseWords;

$SIG{CHLD} = 'IGNORE';
STDOUT->autoflush(1);
my $server = IO::Socket::INET->new(
  LocalAddr => '127.0.0.1',
  LocalPort => '7890',
  Listen    => SOMAXCONN,
  Type      => SOCK_STREAM,
  Reuse     => 1) or die "could not open port: $!";
while (my $client = $server->accept) {
  next if my $pid = fork;
  die "fork: $!" unless defined $pid;
  $client->autoflush(1);
  close $server;
  handle_client($client);
} continue {
  close $client;
}

mikrotik-api-bgp-status.zip

Contains:

init.d launch script for tcp server
perl tcp server which listens on port 7890 and connects to MikroTik using API to retrieve BGP peer status information. Information is cached for 55 seconds so speed up subsequent queries
client app which is really simply a netcat wrapper

Available commands:

[root@zabbix ~]# /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms 'FakeP@ssw0rd'
Missing or invalid command. Usage /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh <router> <api username> <api password> <command> [<peer>] :
  -d|--discover         Zabbix LLD (low level discovery). In JSON format.
  -c|--croak            Dumps all available data. Usable as $bgp_peer{'$peer'}->{'key'}
  -t|--table            Displays tabled overview
  -g|--get <peer> <key> example: -g "Syrex - Primary" state

  Examples:
    Discovery   : /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms "FakeP@ssw0rd" -d
    Sample      : {
                    "data": [
                      { "{#BGPPEER}": "Syrex - Primary" },
                      { "{#BGPPEER}": "Syrex - Secondary" }
                    ]
                  }

    Get item    : /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms "FakeP@ssw0rd" "Syrex - Primary" state
    Sample      : established

Zabbix low level item discovery:

[root@zabbix ~]# /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms 'FakeP@ssw0rd' -d
{
        "data": [
                { "{#BGPPEER}": "iOnline" }
        ]
}

Tabled output:

[root@zabbix ~]# /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms 'FakeP@ssw0rd' -t
Peer                      Active   Prefixes       Remote IP Remote AS             Uptime State
iOnline                   yes             2     172.18.0.17    327909       4w1d12h20m3s established

Dump all values (croak):

[root@zabbix ~]# /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms 'FakeP@ssw0rd' -c
peer: iOnline

=
  .id=*0
  address-families=ip
  as-override=false
  as4-capability=true
  default-originate=if-installed
  disabled=false
  established=true
  hold-time=3m
  in-filter=ionline-in
  instance=mpls
  local-address=172.18.0.20
  multihop=false
  name=iOnline
  nexthop-choice=default
  out-filter=ionline-out
  passive=false
  prefix-count=2
  refresh-capability=true
  remote-address=172.18.0.17
  remote-as=329709
  remote-hold-time=3m
  remote-id=145.23.110.26
  remove-private-as=false
  route-reflect=false
  state=established
  tcp-md5-key=secret123
  ttl=default
  updates-received=6
  updates-sent=1
  uptime=4w1d12h21m3s
  use-bfd=false
  used-hold-time=3m
  used-keepalive-time=1m
  withdrawn-received=0
  withdrawn-sent=0

Retrieve specific item value (uptime in MikroTik format is converted to uptime seconds):

[root@zabbix ~]# /usr/lib/zabbix/externalscripts/mikrotik-api-bgp_status_client.sh 10.0.0.1 syrexnms 'FakeP@ssw0rd' -g iOnline uptime
2550183

Sample BGP peer uptime graph:

zabbix_bgp_uptime_sample.jpg

Sample BGP prefix activity graph:

zabbix_bgp_activity_sample.jpg

Sample BGP status graph:

zabbix_bgp_status_sample.jpg

rafaelbarboza · Thu Apr 12, 2018 3:14 pm

@bbs2web, thank you!

It's possible to share this Zabbix Template for use?

savage · Thu Oct 31, 2019 10:16 am

Can we get these libs updated please?

They no longer work after the recent changes made by Mikrotik.

useopenid · Thu Mar 05, 2020 12:49 am

According to the docs, the challenge/response login mechanism is no longer available after 6.45.1, however, 6.45.8 returns a challenge after sending the new username/password style parameters, and sending the md5 response results in "invalid username or password". Given that the connection is not encrypted, deprecating the challenge/response login is unfortunate.

Longsdale · Thu Mar 05, 2020 3:08 am

According to the docs, the challenge/response login mechanism is no longer available after 6.45.1, however, 6.45.8 returns a challenge after sending the new username/password style parameters, and sending the md5 response results in "invalid username or password". Given that the connection is not encrypted, deprecating the challenge/response login is unfortunate.

The legacy challenge-response authentication is not a measure of good protection. You can set the router to encrypt the connection.

useopenid · Thu Mar 05, 2020 3:18 am

OK, that's good to hear, now if the plain login actually worked...

abatie · Fri Mar 06, 2020 2:36 am

Never mind, I found a bug in the parameters I was passing...

webasdf · Tue Mar 02, 2021 9:57 pm

Not sure if anyone needs this or if it's already been done, but I fixed it.

https://pastebin.com/fUSxZkC3

bbs2web · Tue Oct 11, 2022 3:44 pm

Just some information for anyone that comes across this, after upgrading our Zabbix server and subsequently updating to the latest perl MikroTik API (v2.0.1) available here:
https://metacpan.org/pod/MikroTik::API

We utilise API-SSL but do not deploy certificates to all monitored routers, using anonymous ciphers to secure the connections. Debian 11 ships with SECLEVEL=2 which prevents these connections from establishing, validated via openssl client on the CLI:

[admin@zabbix ~]# openssl s_client -host router1.domain.com -port 8729
CONNECTED(00000003)
140139476116800:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1543:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 317 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Solution is to allow the client to use SECLEVEL=0, which then allows anonymous ciphers, whilst still encrypting the connection. This does not offer verification of any kind so deploying certificates is still highly recommended!

Herewith a subsequent test where one can validate that the connection negotiates TLS v1.2 by allowing anonymous ciphers:

[admin@zabbix ~]# openssl s_client -host router1.domain.com -port 8729 -cipher HIGH:@SECLEVEL=0
CONNECTED(00000003)
---
no peer certificate available
---
No client certificate CA names sent
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 853 bytes and written 753 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ADH-AES256-GCM-SHA384
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ADH-AES256-GCM-SHA384
    Session-ID: 935F72E228A4CEA71F519C4F3B9A55F75E027483F0992538D2ACB0CB64038438
    Session-ID-ctx:
    Master-Key: 273B26E476DDA0E4ADCD85816518118256EC129D742640433553F92C0F6D867AD362BACC90625284A1B6181CE0C737F0
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 37 d0 be 7a e1 80 57 0f-bb 39 35 a4 88 ad c9 1a   7..z..W..95.....
    0010 - 96 4c 04 98 44 23 11 92-28 53 56 47 a5 69 d4 d7   .L..D#..(SVG.i..
    0020 - b3 e4 f5 c7 f8 e4 9b 4f-2b 0b 30 c0 83 0a e5 75   .......O+.0....u
    0030 - dc aa 74 7a 2c d3 c9 dd-57 67 47 3c 8b a9 09 86   ..tz,...WgG<....
    0040 - 41 b3 56 50 33 25 51 fa-a9 a8 97 b8 e5 1c 4c 42   A.VP3%Q.......LB
    0050 - 30 fb 7b 9b 09 5b 52 4c-53 a8 9f 45 9b 55 32 ea   0.{..[RLS..E.U2.
    0060 - da 4a 51 d6 02 bb d0 b8-9e d2 45 b5 b1 e8 28 07   .JQ.......E...(.
    0070 - ac 77 e3 65 cb af c9 67-57 a8 57 db 07 55 5c 8e   .w.e...gW.W..U\.
    0080 - 17 5a e2 76 b7 7a a4 b6-b4 97 03 e9 d1 69 83 e4   .Z.v.z.......i..
    0090 - c2 64 87 54 86 e7 d2 b7-fc 97 56 3d 3d 40 8d 65   .d.T......V==@.e
    00a0 - 35 19 9a da a1 10 94 dd-e6 8a 25 42 cb 7c 02 95   5.........%B.|..
    00b0 - 7b d3 fb d0 a6 21 3b 74-5c 01 3b 9c ae 1a e6 60   {....!;t\.;....`

    Start Time: 1665492017
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Herewith the code change to the API.pm perl library, to allow 'anonymous API-SSL':

[admin@zabbix ~]# diff -uNr /usr/share/perl5/MikroTik/API.pm_v2.0.1.orig /usr/share/perl5/MikroTik/API.pm
--- /usr/share/perl5/MikroTik/API.pm_v2.0.1.orig        2022-10-10 21:35:36.261712950 +0200
+++ /usr/share/perl5/MikroTik/API.pm    2022-10-10 23:09:32.948755784 +0200
@@ -110,7 +110,7 @@
                     PeerHost        => $self->get_host,
                     PeerPort        => $self->get_port,
                     Proto           => 'tcp',
-                    SSL_cipher_list => 'HIGH',
+                    SSL_cipher_list => 'HIGH:@SECLEVEL=0',
                     SSL_verify_mode => $self->get_ssl_verify(),
                     Timeout         => $self->get_timeout,
                 );

perl code

perl code

perl code

Who is online