[QUESTION]: API permissions for api/diagnostics/interface/getProtocolStatistics

[hslabbert]

With applying all of the permissions listed in the README, I still get a permissions issue on the api/diagnostics/interface/getProtocolStatistics path:

level=ERROR source=collector.go:234 msg="failed to update" component=collector collector_name=protocol err="opnsense-client api call error: endpoint: api/diagnostics/interface/getProtocolStatistics; failed status code: 403; msg: {\"status\":403,\"message\":\"Forbidden\"}"

This goes away if I give the user admin access to test. This then shows up as missing stats in the Received or Transmitted Bytes panels for rates.

I can't track down what permissions group this corresponds to, though. Is there something I missed in the permissions set? Diagnostics: Netstat, Reporting: Traffic, etc are all definitely selected for access for the user.

opnsense is currently 25.7.1. Using latest tag for opnsense-exporter, which currently then shows as v0.0.10 in logs.

[Finkregh]

All the API routes have been renamed, it is now called get_protocol_statistics: https://docs.opnsense.org/development/api/core/diagnostics.html#id6

[hslabbert]

Is this a gap in the permissions sets in opnsense at the moment, then? Under System > Access > Privileges I don't see any groups that target something like ui/diagnostics/protocol.

Wait, but Diagnostics: Netstat does show api/diagnostics/interface/get_protocol_statistics in there. Which should be sufficient.

Is the issue that the exporter is still trying to use the old path, and that old path is not covered in the API permissions and so needs admin rights in order to access it?

That appears to be the case, if I'm reading this correctly:

opnsense-exporter/opnsense/client.go

Line 70 in edf6195

"protocolStatistics": "api/diagnostics/interface/getProtocolStatistics",

Does this maybe change to a bug, then, that the protocolStatistics fetch should get updated to use the new api/diagnostics/interface/get_protocol_statistics endpoint?

[Finkregh]

Wild guess: change api path ^^

[hslabbert]

Yes, but do you mean in the permissions or in the client? I would say the latter, which is why I'm asking if this should now be a bug to get that changed. And for the former, the definitions of the permission sets in opnsense are read-only, not something user-configurable.

[Finkregh]

Ah that way, in the client? I didn't test it yet, but there was also something in the release notes afair.

[hslabbert]

Hmm...in v0.0.8...v0.0.10?

I see the bit re: the system status API, but don't see other API bits in there. I guess I'll wait to see if someone in the maintainers picks this up, or otherwise look at what's involved in the change & cutting a PR.