# 1️⃣ Create a virtual environment (recommended)
python3 -m venv mikrotik-env
source mikrotik-env/bin/activate   # on Windows: mikrotik-env\Scripts\activate

# 2️⃣ Install the RouterOS API client
pip install --upgrade routeros-api   # official, maintained client
# Alternative: pip install mikrotik-routeros-api

# 3️⃣ (Optional) Install python-dotenv for .env handling
pip install python-dotenv

# 1️⃣ Initialise a new npm project (skip if you already have one)
npm init -y

# 2️⃣ Install the RouterOS API client for Node.js
npm install routeros-api   # same name as the Python package, works for Node
# For TypeScript you also need the types:
npm install --save-dev @types/node typescript ts-node

# 3️⃣ (Optional) Install dotenv for .env loading
npm install dotenv

#!/usr/bin/env python3
"""
MikroTik RouterOS critical‑patch checker & updater.

- Reads connection details from environment variables.
- Uses the `routeros-api` client.
- Exits with a non‑zero code if the device is vulnerable and upgrade fails.
"""

import os
import sys
import logging
from typing import List

from routeros_api import RouterOsApiPool  # type: ignore
from routeros_api.exceptions import RouterOsApiConnectionError, RouterOsApiCommunicationError  # type: ignore

# -------------------------------------------------
# Configuration (loaded from env)
# -------------------------------------------------
MIKROTIK_HOST = os.getenv("MIKROTIK_HOST", "192.168.88.1")
MIKROTIK_PORT = int(os.getenv("MIKROTIK_PORT", "8728"))
MIKROTIK_USER = os.getenv("MIKROTIK_USER", "")
MIKROTIK_PASS = os.getenv("MIKROTIK_PASS", "")
USE_SSL = os.getenv("MIKROTIK_USE_SSL", "false").lower() in ("1", "true", "yes")
SSL_VERIFY = os.getenv("MIKROTIK_SSL_VERIFY", "true").lower() not in ("0", "false", "no")

# List of versions known to be affected by the recent chained flaws.
# Format: major.minor.patch (as reported by RouterOS)
VULNERABLE_VERSIONS: List[str] = [
    "6.45.0",
    "6.45.1",
    "6.45.2",
    "6.46.0",
    "6.46.1",
    # Add more as MikroTik releases advisories
]

# -------------------------------------------------
# Logging setup
# -------------------------------------------------
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(name)s - %(message)s",
)
log = logging.getLogger("mikrotik-patch")

# -------------------------------------------------
# Helper functions
# -------------------------------------------------
def get_version(api) -> str:
    """Fetch RouterOS version string from /system/resource."""
    resource = api.get_resource("/system/resource")
    data = resource.get()
    # Example response: [{'version': '6.48.3', 'board-name': 'RB4011', ...}]
    version = data[0].get("version", "").strip()
    log.info("Detected RouterOS version: %s", version)
    return version

def is_vulnerable(version: str) -> bool:
    """Simple prefix check – adjust if you need semantic versioning."""
    return any(version.startswith(v) for v in VULNERABLE_VERSIONS)

def upgrade_routeros(api) -> bool:
    """
    Trigger a RouterOS upgrade.
    Returns True if the upgrade command was accepted.
    Note: The actual download/install happens asynchronously;
    you may want to poll /system/resource later to confirm.
    """
    try:
        update = api.get_resource("/system/package/update")
        # Set channel to 'stable' (or 'long-term', 'testing' as needed)
        update.set(**{"channel": "stable"})
        # Start checking for new version
        update.call("check-for-updates")
        log.info("Upgrade check initiated.")
        # Optionally, you can immediately start download/install:
        # update.call("install")
        return True
    except Exception as exc:
        log.error("Failed to initiate upgrade: %s", exc)
        return False

# -------------------------------------------------
# Main workflow
# -------------------------------------------------
def main() -> int:
    if not MIKROTIK_USER or not MIKROTIK_PASS:
        log.error("MIKROTIK_USER and MIKROTIK_PASS must be set.")
        return 1

    try:
        pool = RouterOsApiPool(
            host=MIKROTIK_HOST,
            username=MIKROTIK_USER,
            password=MIKROTIK_PASS,
            port=MIKROTIK_PORT,
            use_ssl=USE_SSL,
            ssl_verify=SSL_VERIFY,
            plaintext_login=True,  # RouterOS API expects plaintext over TLS
        )
        api = pool.get_api()
        log.info("Connected to %s:%s", MIKROTIK_HOST, MIKROTIK_PORT)

        version = get_version(api)
        if is_vulnerable(version):
            log.warning("Version %s is vulnerable!", version)
            if upgrade_routeros(api):
                log.info("Upgrade process started. Verify later.")
                return 0
            else:
                log.error("Upgrade could not be started.")
                return 1
        else:
            log.info("Version %s is NOT in the vulnerable list.", version)
            return 0

    except RouterOsApiConnectionError as conn_err:
        log.error("Cannot connect to MikroTik: %s", conn_err)
        return 1
    except RouterOsApiCommunicationError as comm_err:
        log.error("API communication error: %s", comm_err)
        return 1
    except Exception as exc:  # pragma: no cover
        log.exception("Unexpected error: %s", exc)
        return 1
    finally:
        try:
            pool.disconnect()
        except Exception:
            pass

if __name__ == "__main__":
    sys.exit(main())

export MIKROTIK_HOST=10.0.0.1
export MIKROTIK_USER=admin
export MIKROTIK_PASS=SuperSecret!   # <-- use a secret manager in prod
export MIKROTIK_USE_SSL=true
export MIKROTIK_SSL_VERIFY=false   # set true if you have a trusted cert
python mikrotik_patch_check.py

#!/usr/bin/env node
/**
 * MikroTik RouterOS critical‑patch checker & updater (Node/TS).
 *
 * Reads connection details from environment variables.
 * Uses the `routeros-api` npm package.
 */

import { RouterOsApiPool } from "routeros-api";
import * as dotenv from "dotenv";

// Load .env file (optional but handy for local dev)
dotenv.config();

// -------------------------------------------------
// Configuration from environment
// -------------------------------------------------
const HOST = process.env.MIKROTIK_HOST ?? "192.168.88.1";
const PORT = parseInt(process.env.MIKROTIK_PORT ?? "8728", 10);
const USER = process.env.MIKROTIK_USER ?? "";
const PASS = process.env.MIKROTIK_PASS ?? "";
const USE_SSL = process.env.MIKROTIK_USE_SSL?.toLowerCase() === "true";
const SSL_VERIFY = process.env.MIKROTIK_SSL_VERIFY?.toLowerCase() !== "false";

const VULNERABLE_VERSIONS: string[] = [
  "6.45.0",
  "6.45.1",
  "6.45.2",
  "6.46.0",
  "6.46.1",
  // extend as needed
];

// -------------------------------------------------
// Logging helper (simple console)
// -------------------------------------------------
function log(level: "info" | "warn" | "error", msg: string, meta?: any) {
  const timestamp = new Date().toISOString();
  console[level](`[${timestamp}] ${level.toUpperCase()} - ${msg}`, meta || "");
}

// -------------------------------------------------
// Core functions
// -------------------------------------------------
async function getVersion(api: any): Promise<string> {
  const resource = api.getResource("/system/resource");
  const data = await resource.get();
  const version = (data[0]?.version ?? "").trim();
  log("info", `Detected RouterOS version: ${version}`);
  return version;
}

function isVulnerable(version: string): boolean {
  return VULNERABLE_VERSIONS.some(v => version.startsWith(v));
}

async function upgradeRouterOS(api: any): Promise<boolean> {
  try {
    const update = api.getResource("/system/package/update");
    // Choose update channel (stable, long-term, testing)
    await update.set({ channel: "stable" });
    // Trigger a check for new version
    await update.call("check-for-updates");
    log("info", "Upgrade check initiated.");
    // If you want to start install immediately, uncomment:
    // await update.call("install");
    return true;
  } catch (err) {
    log("error", "Failed to initiate upgrade", err);
    return false;
  }
}

// -------------------------------------------------
// Main async workflow
// -------------------------------------------------
async function main(): Promise<number> {
  if (!USER || !PASS) {
    log("error", "MIKROTIK_USER and MIKROTIK_PASS must be set.");
    return 1;
  }

  let pool: RouterOsApiPool | undefined;
  try {
    pool = new RouterOsApiPool({
      host: HOST,
      username: USER,
      password: PASS,
      port: PORT,
      use_ssl: USE_SSL,
      ssl_verify: SSL_VERIFY,
      plaintext_login: true,
    });

    const api = pool.getApi();
    log("info", `Connected to ${HOST}:${PORT}`);

    const version = await getVersion(api);
    if (isVulnerable(version)) {
      log("warn", `Version ${version} appears vulnerable!`);
      const ok = await upgradeRouterOS(api);
      return ok ? 0 : 1;
    } else {
      log("info", `Version ${version} is NOT in the vulnerable list.`);
      return 0;
    }
  } catch (err: any) {
    if (err?.code === "ENOTFOUND" || err?.message?.includes("connection")) {
      log("error", "Cannot connect to MikroTik", err);
    } else {
      log("error", "Unexpected error", err);
    }
    return 1;
  } finally {
    await pool?.close();
  }
}

// -------------------------------------------------
// Entry point
// -------------------------------------------------
main().then(code => process.exit(code));

# 1️⃣ Install dependencies (if not done already)
npm install

# 2️⃣ Set environment variables (or create a .env file)
cat > .env <<EOF
MIKROTIK_HOST=10.0.0.1
MIKROTIK_USER=admin
MIKROTIK_PASS=SuperSecret!
MIKROTIK_USE_SSL=true
MIKROTIK_SSL_VERIFY=false
EOF

# 3️⃣ Run (ts-node will compile on‑the‑fly)
npx ts-node mikrotik-patch-check.ts
# Or compile first:
# npx tsc mikrotik-patch-check.ts && node mikrotik-patch-check.js

from packaging import version
if version.parse(current) < version.parse("6.47.0"):
    # vulnerable

import semver from "semver";
if (semver.lt(current, "6.47.0")) { /* vulnerable */ }

import time
deadline = time.time() + 300  # 5 min timeout
while time.time() < deadline:
    if get_version(api) != current_version:
        log.info("Upgrade completed, new version: %s", get_version(api))
        break
    time.sleep(10)
else:
    log.warning("Upgrade timeout – verify manually.")

pool = RouterOsApiPool(..., debug_level=2)  # 0=none, 1=errors, 2=full

const pool = new RouterOsApiPool({ ..., logger: console }); // prints requests/responses