mirror of
https://github.com/SoftEtherVPN/SoftEtherVPN.git
synced 2024-11-06 01:30:40 +03:00
Merge a366bdbf02
into 36456e63a6
This commit is contained in:
commit
f6513a91e3
@ -30,6 +30,7 @@
|
|||||||
<ul>
|
<ul>
|
||||||
<li>Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.</li>
|
<li>Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.</li>
|
||||||
<li>If you want to completely disable the JSON-RPC on your VPN Server, set the <code>DisableJsonRpcWebApi</code> variable to <code>true</code> on the <code>vpn_server.config</code>.</li>
|
<li>If you want to completely disable the JSON-RPC on your VPN Server, set the <code>DisableJsonRpcWebApi</code> variable to <code>true</code> on the <code>vpn_server.config</code>.</li>
|
||||||
|
<li>You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the <code>JsonRpcWebApiAllowedSubnet</code> variable to, for example, <code>192.168.0.0/16</code>.</li>
|
||||||
</ul>
|
</ul>
|
||||||
<h3 id="json-rpc-specification">JSON-RPC specification</h3>
|
<h3 id="json-rpc-specification">JSON-RPC specification</h3>
|
||||||
<p>You must use HTTPS 1.1 <code>POST</code> method to call each of JSON-RPC APIs.<br />
|
<p>You must use HTTPS 1.1 <code>POST</code> method to call each of JSON-RPC APIs.<br />
|
||||||
|
@ -25,6 +25,7 @@ https://<vpn_server_hostname>:<port>/api/
|
|||||||
|
|
||||||
- Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
|
- Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
|
||||||
- If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
|
- If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
|
||||||
|
- You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the `JsonRpcWebApiAllowedSubnet` variable to, for example, `192.168.0.0/16`.
|
||||||
|
|
||||||
|
|
||||||
### JSON-RPC specification
|
### JSON-RPC specification
|
||||||
|
@ -25,6 +25,7 @@ https://<vpn_server_hostname>:<port>/api/
|
|||||||
|
|
||||||
- Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
|
- Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
|
||||||
- If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
|
- If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
|
||||||
|
- You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the `JsonRpcWebApiAllowedSubnet` variable to, for example, `192.168.0.0/16`.
|
||||||
|
|
||||||
|
|
||||||
### JSON-RPC specification
|
### JSON-RPC specification
|
||||||
|
@ -5740,6 +5740,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
|
|||||||
UINT num = 0, max = 19;
|
UINT num = 0, max = 19;
|
||||||
SERVER *server;
|
SERVER *server;
|
||||||
char *vpn_http_target = HTTP_VPN_TARGET2;
|
char *vpn_http_target = HTTP_VPN_TARGET2;
|
||||||
|
bool disableJsonRpcWebApi;
|
||||||
// Validate arguments
|
// Validate arguments
|
||||||
if (c == NULL)
|
if (c == NULL)
|
||||||
{
|
{
|
||||||
@ -5750,6 +5751,15 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
|
|||||||
|
|
||||||
s = c->FirstSock;
|
s = c->FirstSock;
|
||||||
|
|
||||||
|
disableJsonRpcWebApi = server->DisableJsonRpcWebApi;
|
||||||
|
if (!disableJsonRpcWebApi && !IsZeroIP(&server->JsonRpcWebApiAllowedSubnetAddr)
|
||||||
|
&& !IsZeroIP(&server->JsonRpcWebApiAllowedSubnetMask)) {
|
||||||
|
// restrict JSON-RPC Web API to specified subnet only
|
||||||
|
if (!IsInSameNetwork(&s->RemoteIP, &server->JsonRpcWebApiAllowedSubnetAddr, &server->JsonRpcWebApiAllowedSubnetMask)) {
|
||||||
|
disableJsonRpcWebApi = true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
while (true)
|
while (true)
|
||||||
{
|
{
|
||||||
bool not_found_error = false;
|
bool not_found_error = false;
|
||||||
@ -5782,7 +5792,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
|
|||||||
// Receive the data since it's POST
|
// Receive the data since it's POST
|
||||||
data_size = GetContentLength(h);
|
data_size = GetContentLength(h);
|
||||||
|
|
||||||
if (server->DisableJsonRpcWebApi == false)
|
if (disableJsonRpcWebApi == false)
|
||||||
{
|
{
|
||||||
if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0)
|
if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0)
|
||||||
{
|
{
|
||||||
@ -5868,7 +5878,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
|
|||||||
}
|
}
|
||||||
else if (StrCmpi(h->Method, "OPTIONS") == 0)
|
else if (StrCmpi(h->Method, "OPTIONS") == 0)
|
||||||
{
|
{
|
||||||
if (server->DisableJsonRpcWebApi == false)
|
if (disableJsonRpcWebApi == false)
|
||||||
{
|
{
|
||||||
if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0 || StartWith(h->Target, "/admin"))
|
if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0 || StartWith(h->Target, "/admin"))
|
||||||
{
|
{
|
||||||
@ -5939,7 +5949,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
|
|||||||
BUF *b = NULL;
|
BUF *b = NULL;
|
||||||
*error_detail_str = "HTTP_ROOT";
|
*error_detail_str = "HTTP_ROOT";
|
||||||
|
|
||||||
if (server->DisableJsonRpcWebApi == false)
|
if (disableJsonRpcWebApi == false)
|
||||||
{
|
{
|
||||||
b = ReadDump("|wwwroot/index.html");
|
b = ReadDump("|wwwroot/index.html");
|
||||||
}
|
}
|
||||||
@ -6019,7 +6029,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
|
|||||||
|
|
||||||
if (b == false)
|
if (b == false)
|
||||||
{
|
{
|
||||||
if (server->DisableJsonRpcWebApi == false)
|
if (disableJsonRpcWebApi == false)
|
||||||
{
|
{
|
||||||
if (StartWith(h->Target, "/api?") || StartWith(h->Target, "/api/") || StrCmpi(h->Target, "/api") == 0)
|
if (StartWith(h->Target, "/api?") || StartWith(h->Target, "/api/") || StrCmpi(h->Target, "/api") == 0)
|
||||||
{
|
{
|
||||||
|
@ -30,6 +30,7 @@
|
|||||||
#include "Mayaqua/Internat.h"
|
#include "Mayaqua/Internat.h"
|
||||||
#include "Mayaqua/Memory.h"
|
#include "Mayaqua/Memory.h"
|
||||||
#include "Mayaqua/Microsoft.h"
|
#include "Mayaqua/Microsoft.h"
|
||||||
|
#include "Mayaqua/Network.h"
|
||||||
#include "Mayaqua/Object.h"
|
#include "Mayaqua/Object.h"
|
||||||
#include "Mayaqua/OS.h"
|
#include "Mayaqua/OS.h"
|
||||||
#include "Mayaqua/Pack.h"
|
#include "Mayaqua/Pack.h"
|
||||||
@ -6032,6 +6033,15 @@ void SiLoadServerCfg(SERVER *s, FOLDER *f)
|
|||||||
// Disable JSON-RPC Web API
|
// Disable JSON-RPC Web API
|
||||||
s->DisableJsonRpcWebApi = CfgGetBool(f, "DisableJsonRpcWebApi");
|
s->DisableJsonRpcWebApi = CfgGetBool(f, "DisableJsonRpcWebApi");
|
||||||
|
|
||||||
|
char tmpaddr[MAX_PATH];
|
||||||
|
if (CfgGetStr(f, "JsonRpcWebApiAllowedSubnet", tmpaddr, sizeof(tmpaddr))) {
|
||||||
|
IP _subnet, _mask;
|
||||||
|
if (ParseIpAndMask46(tmpaddr, &_subnet, &_mask)) {
|
||||||
|
s->JsonRpcWebApiAllowedSubnetAddr = _subnet;
|
||||||
|
s->JsonRpcWebApiAllowedSubnetMask = _mask;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
// Bits of Diffie-Hellman parameters
|
// Bits of Diffie-Hellman parameters
|
||||||
c->DhParamBits = CfgGetInt(f, "DhParamBits");
|
c->DhParamBits = CfgGetInt(f, "DhParamBits");
|
||||||
if (c->DhParamBits == 0)
|
if (c->DhParamBits == 0)
|
||||||
@ -6365,6 +6375,11 @@ void SiWriteServerCfg(FOLDER *f, SERVER *s)
|
|||||||
|
|
||||||
// Disable JSON-RPC Web API
|
// Disable JSON-RPC Web API
|
||||||
CfgAddBool(f, "DisableJsonRpcWebApi", s->DisableJsonRpcWebApi);
|
CfgAddBool(f, "DisableJsonRpcWebApi", s->DisableJsonRpcWebApi);
|
||||||
|
|
||||||
|
char tmpaddr[MAX_PATH];
|
||||||
|
IPAndMaskToStr(tmpaddr, sizeof(tmpaddr),
|
||||||
|
&s->JsonRpcWebApiAllowedSubnetAddr, &s->JsonRpcWebApiAllowedSubnetMask);
|
||||||
|
CfgAddStr(f, "JsonRpcWebApiAllowedSubnet", tmpaddr);
|
||||||
}
|
}
|
||||||
Unlock(c->lock);
|
Unlock(c->lock);
|
||||||
}
|
}
|
||||||
|
@ -276,6 +276,9 @@ struct SERVER
|
|||||||
IP ListenIP; // Listen IP
|
IP ListenIP; // Listen IP
|
||||||
bool StrictSyslogDatetimeFormat; // Make syslog datetime format strict RFC3164
|
bool StrictSyslogDatetimeFormat; // Make syslog datetime format strict RFC3164
|
||||||
bool DisableJsonRpcWebApi; // Disable JSON-RPC Web API
|
bool DisableJsonRpcWebApi; // Disable JSON-RPC Web API
|
||||||
|
|
||||||
|
IP JsonRpcWebApiAllowedSubnetAddr; // If set, allow access to JSON-RPC Web API from
|
||||||
|
IP JsonRpcWebApiAllowedSubnetMask; // this subnet only
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
|
@ -6986,6 +6986,18 @@ void IPToStr6Inner(char *str, IP *ip)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Format IP and subnet mask as "<ip>/<masksize>"
|
||||||
|
void IPAndMaskToStr(char *str, UINT size, IP *ip, IP *subnet)
|
||||||
|
{
|
||||||
|
int iplen;
|
||||||
|
UINT masksize;
|
||||||
|
|
||||||
|
IPToStr(str, size, ip);
|
||||||
|
iplen = StrLen(str);
|
||||||
|
masksize = SubnetMaskToInt(subnet);
|
||||||
|
Format(str + iplen, size - iplen, "/%d", masksize);
|
||||||
|
}
|
||||||
|
|
||||||
// Convert the string to an IP address
|
// Convert the string to an IP address
|
||||||
bool StrToIP6(IP *ip, char *str)
|
bool StrToIP6(IP *ip, char *str)
|
||||||
{
|
{
|
||||||
|
@ -1289,6 +1289,7 @@ void IPToStr6(char *str, UINT size, IP *ip);
|
|||||||
void IP6AddrToStr(char *str, UINT size, IPV6_ADDR *addr);
|
void IP6AddrToStr(char *str, UINT size, IPV6_ADDR *addr);
|
||||||
void IPToStr6Array(char *str, UINT size, UCHAR *bytes);
|
void IPToStr6Array(char *str, UINT size, UCHAR *bytes);
|
||||||
void IPToStr6Inner(char *str, IP *ip);
|
void IPToStr6Inner(char *str, IP *ip);
|
||||||
|
void IPAndMaskToStr(char *str, UINT size, IP *ip, IP *subnet);
|
||||||
void IntToSubnetMask6(IP *ip, UINT i);
|
void IntToSubnetMask6(IP *ip, UINT i);
|
||||||
void IPAnd6(IP *dst, IP *a, IP *b);
|
void IPAnd6(IP *dst, IP *a, IP *b);
|
||||||
void GetAllRouterMulticastAddress6(IP *ip);
|
void GetAllRouterMulticastAddress6(IP *ip);
|
||||||
|
Loading…
Reference in New Issue
Block a user