Merge a366bdbf02 into ca832a9cef

CI: move linux builds to GHA, drop ADO

.azure-pipelines.yml

@@ -1,4 +0,0 @@
-jobs:
-  - template: .ci/azure-pipelines/linux.yml
-  - template: .ci/azure-pipelines/windows.yml
-  - template: .ci/azure-pipelines/macos.yml

.ci/azure-pipelines/linux.yml

@@ -1,20 +0,0 @@
-jobs:
-- job: Ubuntu_x64
-  pool:
-    vmImage: ubuntu-22.04
-  steps:
-  - checkout: self
-    submodules: true
-    persistCredentials: true
-  - script: sudo apt update && sudo apt-get -y install cmake gcc g++ ninja-build libncurses5-dev libreadline-dev libsodium-dev libssl-dev make zlib1g-dev liblz4-dev libnl-genl-3-dev
-    displayName: 'Prepare environment'
-  - script: "$(Build.SourcesDirectory)/.ci/azure-pipelines/linux_build.sh"
-    env:
-      SE_BUILD_NUMBER_TOKEN: $(BUILD_NUMBER_TOKEN)
-    displayName: 'Build'
-  - script: |
-      .ci/appveyor-deb-install-test.sh
-      sudo apt-get -y install autoconf libtool liblzo2-dev libpam-dev fping unzip libcap-ng-dev # To build OpenVPN
-      sudo BUILD_BINARIESDIRECTORY=$BUILD_BINARIESDIRECTORY .ci/start-se-openvpn.sh
-      sudo BUILD_BINARIESDIRECTORY=$BUILD_BINARIESDIRECTORY .ci/run-openvpn-tests.sh
-    displayName: 'Test'

.ci/azure-pipelines/macos.yml

@@ -1,14 +0,0 @@
-jobs:
-- job: macOS
-  pool:
-    vmImage: macOS-latest
-  steps:
-  - checkout: self
-    submodules: true
-    persistCredentials: true
-  - script: brew install pkg-config cmake ninja ncurses readline libsodium openssl zlib
-    displayName: 'Prepare environment'
-  - script: '$(Build.SourcesDirectory)/.ci/azure-pipelines/macos_build.sh'
-    env:
-      SE_BUILD_NUMBER_TOKEN: $(BUILD_NUMBER_TOKEN)
-    displayName: 'Build'

.ci/azure-pipelines/windows-steps.yml

@@ -1,41 +0,0 @@
-parameters:
-- name: architecture
-  type: string
-- name: compilerPath
-  type: string
-- name: vcpkgTriplet
-  type: string
-- name: vcvarsPath
-  type: string
-
-steps:
-- task: Cache@2
-  inputs:
-    key: '"vcpkg-manifest" | "$(Agent.OS)" | "${{parameters.vcpkgTriplet}}" | C:/vcpkg/.git/refs/heads/master'
-    path: '$(Build.BinariesDirectory)/vcpkg_installed'
-  displayName: 'Environment storage'
-- script: '$(Build.SourcesDirectory)/.ci/azure-pipelines/windows_build.bat'
-  env:
-    ARCHITECTURE: ${{parameters.architecture}}
-    COMPILER_PATH: ${{parameters.compilerPath}}
-    VCPKG_TRIPLET: ${{parameters.vcpkgTriplet}}
-    VCVARS_PATH: ${{parameters.vcvarsPath}}
-    SE_BUILD_NUMBER_TOKEN: $(BUILD_NUMBER_TOKEN)
-  displayName: 'Build'
-- powershell: |
-    . .ci/appveyor-vpntest.ps1
-  displayName: 'Test'
-- task: CopyFiles@2
-  inputs:
-    sourceFolder: '$(Build.BinariesDirectory)'
-    contents: '?(*.exe|*.se2|*.pdb)'
-    TargetFolder: '$(Build.StagingDirectory)/binaries/${{parameters.architecture}}'
-    flattenFolders: true
-- task: PublishBuildArtifacts@1
-  inputs:
-    pathtoPublish: '$(Build.StagingDirectory)/binaries/${{parameters.architecture}}'
-    artifactName: 'Binaries_${{parameters.architecture}}'
-- task: PublishBuildArtifacts@1
-  inputs:
-    pathtoPublish: '$(Build.StagingDirectory)/installers'
-    artifactName: 'Installers'

.ci/azure-pipelines/windows.yml

@@ -1,27 +0,0 @@
-jobs:
-- job: Windows_x64
-  pool:
-    vmImage: windows-latest
-  steps:
-  - checkout: self
-    submodules: true
-    persistCredentials: true
-  - template: "windows-steps.yml"
-    parameters:
-      architecture: "x64"
-      compilerPath: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin/clang-cl.exe"
-      vcpkgTriplet: "x64-windows-static"
-      vcvarsPath: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars64.bat"
-- job: Windows_x86
-  pool:
-    vmImage: windows-latest
-  steps:
-  - checkout: self
-    submodules: true
-    persistCredentials: true
-  - template: "windows-steps.yml"
-    parameters:
-      architecture: "x86"
-      compilerPath: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/bin/clang-cl.exe"
-      vcpkgTriplet: "x86-windows-static"
-      vcvarsPath: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars32.bat"

.ci/azure-pipelines/windows_build.bat

@@ -14,6 +14,12 @@ if %SE_BUILD_NUMBER_TOKEN_LENGTH% equ 64 (
 	set BUILD_NUMBER=0
 )
 
+
+if "%BUILD_BINARIESDIRECTORY%"=="" (set BUILD_BINARIESDIRECTORY=build)
+if "%BUILD_SOURCESDIRECTORY%"=="" (set BUILD_SOURCESDIRECTORY=%cd%)
+
+if not exist %BUILD_BINARIESDIRECTORY% mkdir %BUILD_BINARIESDIRECTORY%
+
 cd %BUILD_BINARIESDIRECTORY%
 
 call "%VCVARS_PATH%"
@@ -21,6 +27,7 @@ call "%VCVARS_PATH%"
 cmake -G "Ninja" -DCMAKE_TOOLCHAIN_FILE="C:\vcpkg\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=%VCPKG_TRIPLET% -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_COMPILER="%COMPILER_PATH%" -DCMAKE_CXX_COMPILER="%COMPILER_PATH%" -DBUILD_NUMBER=%BUILD_NUMBER% "%BUILD_SOURCESDIRECTORY%"
 cmake --build .
 
+if "%BUILD_STAGINGDIRECTORY%"=="" (set BUILD_STAGINGDIRECTORY=%cd%)
 mkdir "%BUILD_STAGINGDIRECTORY%\installers"
 vpnsetup /SFXMODE:vpnclient /SFXOUT:"%BUILD_STAGINGDIRECTORY%\installers\softether-vpnclient-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"
 vpnsetup /SFXMODE:vpnserver_vpnbridge /SFXOUT:"%BUILD_STAGINGDIRECTORY%\installers\softether-vpnserver_vpnbridge-%VERSION%.%BUILD_NUMBER%.%ARCHITECTURE%.exe"

.github/workflows/linux.yml

@@ -0,0 +1,34 @@
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  build_and_test:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+
+    - name: Install dependencies
+      run: sudo apt update && sudo apt-get -y install cmake gcc g++ ninja-build libncurses5-dev libreadline-dev libsodium-dev libssl-dev make zlib1g-dev liblz4-dev libnl-genl-3-dev 
+
+    - name: Build
+      run: |
+        mkdir build
+        cd build
+        cmake -G "Ninja" -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
+        cmake --build .
+
+    - name: Build deb packages
+      run: |
+        cd build
+        cpack -C Release -G DEB 
+
+    - name: Test
+      run: |
+       .ci/appveyor-deb-install-test.sh
+       sudo apt-get -y install autoconf libtool liblzo2-dev libpam-dev fping unzip libcap-ng-dev # To build OpenVPN
+       sudo .ci/start-se-openvpn.sh
+       sudo .ci/run-openvpn-tests.sh

.github/workflows/windows.yml

@@ -0,0 +1,48 @@
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  build_and_test:
+    strategy:
+      matrix:
+        platform: [
+          { ARCHITECTURE: x86, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/bin/clang-cl.exe",     VCPKG_TRIPLET: "x86-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars32.bat"},
+          { ARCHITECTURE: x64, COMPILER_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/Llvm/x64/bin/clang-cl.exe", VCPKG_TRIPLET: "x64-windows-static", VCVARS_PATH: "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/Build/vcvars64.bat"}
+        ]
+    runs-on: windows-latest
+    name: ${{ matrix.platform.ARCHITECTURE }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - name: Cache vcpkg
+      uses: actions/cache@v4
+      with:
+        path: 'build/vcpkg_installed/'
+        key: vcpkg-${{ matrix.platform.VCPKG_TRIPLET }}
+    - name: Build
+      env:
+        ARCHITECTURE: ${{ matrix.platform.ARCHITECTURE }}
+        COMPILER_PATH: ${{ matrix.platform.COMPILER_PATH }}
+        VCPKG_TRIPLET: ${{ matrix.platform.VCPKG_TRIPLET }}
+        VCVARS_PATH: ${{ matrix.platform.VCVARS_PATH }}
+      run: .ci/azure-pipelines/windows_build.bat
+    - name: Test
+      shell: powershell
+      run: |
+        . .ci/appveyor-vpntest.ps1
+    - uses: actions/upload-artifact@v4
+      with:
+        if-no-files-found: error
+        name: Binaries-${{ matrix.platform.ARCHITECTURE }}
+        path: |
+          build/*.exe
+          build/*.pdb
+          build/*.se2
+    - uses: actions/upload-artifact@v4
+      with:
+        if-no-files-found: error
+        name: Installers-${{ matrix.platform.ARCHITECTURE }}
+        path: build/installers

developer_tools/vpnserver-jsonrpc-clients/README.html

@@ -30,6 +30,7 @@
 <ul>
 <li>Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.</li>
 <li>If you want to completely disable the JSON-RPC on your VPN Server, set the <code>DisableJsonRpcWebApi</code> variable to <code>true</code> on the <code>vpn_server.config</code>.</li>
+<li>You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the <code>JsonRpcWebApiAllowedSubnet</code> variable to, for example, <code>192.168.0.0/16</code>.</li>
 </ul>
 <h3 id="json-rpc-specification">JSON-RPC specification</h3>
 <p>You must use HTTPS 1.1 <code>POST</code> method to call each of JSON-RPC APIs.<br />

developer_tools/vpnserver-jsonrpc-clients/README.md

@@ -25,6 +25,7 @@ https://<vpn_server_hostname>:<port>/api/
 
   - Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
   - If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
+  - You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the `JsonRpcWebApiAllowedSubnet` variable to, for example, `192.168.0.0/16`.
 
 
 ### JSON-RPC specification

developer_tools/vpnserver-jsonrpc-codegen/Templates/doc.txt

@@ -25,6 +25,7 @@ https://<vpn_server_hostname>:<port>/api/
 
   - Older versions of SoftEther VPN before June 2019 don't support JSON-RPC APIs.
   - If you want to completely disable the JSON-RPC on your VPN Server, set the `DisableJsonRpcWebApi` variable to `true` on the `vpn_server.config`.
+  - You may also restrict access to JSON-RPC API to a specific subnet, e.g. your internal network, by setting the `JsonRpcWebApiAllowedSubnet` variable to, for example, `192.168.0.0/16`.
 
 
 ### JSON-RPC specification

src/Cedar/Protocol.c

@@ -5740,6 +5740,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 	UINT num = 0, max = 19;
 	SERVER *server;
 	char *vpn_http_target = HTTP_VPN_TARGET2;
+	bool disableJsonRpcWebApi;
 	// Validate arguments
 	if (c == NULL)
 	{
@@ -5750,6 +5751,15 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 
 	s = c->FirstSock;
 
+	disableJsonRpcWebApi = server->DisableJsonRpcWebApi;
+	if (!disableJsonRpcWebApi && !IsZeroIP(&server->JsonRpcWebApiAllowedSubnetAddr)
+				&& !IsZeroIP(&server->JsonRpcWebApiAllowedSubnetMask)) {
+		// restrict JSON-RPC Web API to specified subnet only
+		if (!IsInSameNetwork(&s->RemoteIP, &server->JsonRpcWebApiAllowedSubnetAddr, &server->JsonRpcWebApiAllowedSubnetMask)) {
+			disableJsonRpcWebApi = true;
+		}
+	}
+
 	while (true)
 	{
 		bool not_found_error = false;
@@ -5782,7 +5792,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 			// Receive the data since it's POST
 			data_size = GetContentLength(h);
 
-			if (server->DisableJsonRpcWebApi == false)
+			if (disableJsonRpcWebApi == false)
 			{
 				if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0)
 				{
@@ -5868,7 +5878,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 		}
 		else if (StrCmpi(h->Method, "OPTIONS") == 0)
 		{
-			if (server->DisableJsonRpcWebApi == false)
+			if (disableJsonRpcWebApi == false)
 			{
 				if (StrCmpi(h->Target, "/api") == 0 || StrCmpi(h->Target, "/api/") == 0 || StartWith(h->Target, "/admin"))
 				{
@@ -5939,7 +5949,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 					BUF *b = NULL;
 					*error_detail_str = "HTTP_ROOT";
 
-					if (server->DisableJsonRpcWebApi == false)
+					if (disableJsonRpcWebApi == false)
 					{
 						b = ReadDump("|wwwroot/index.html");
 					}
@@ -6019,7 +6029,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 
 					if (b == false)
 					{
-						if (server->DisableJsonRpcWebApi == false)
+						if (disableJsonRpcWebApi == false)
 						{
 							if (StartWith(h->Target, "/api?") || StartWith(h->Target, "/api/") || StrCmpi(h->Target, "/api") == 0)
 							{

src/Cedar/Server.c

@@ -30,6 +30,7 @@
 #include "Mayaqua/Internat.h"
 #include "Mayaqua/Memory.h"
 #include "Mayaqua/Microsoft.h"
+#include "Mayaqua/Network.h"
 #include "Mayaqua/Object.h"
 #include "Mayaqua/OS.h"
 #include "Mayaqua/Pack.h"
@@ -6032,6 +6033,15 @@ void SiLoadServerCfg(SERVER *s, FOLDER *f)
 		// Disable JSON-RPC Web API
 		s->DisableJsonRpcWebApi = CfgGetBool(f, "DisableJsonRpcWebApi");
 
+		char tmpaddr[MAX_PATH];
+		if (CfgGetStr(f, "JsonRpcWebApiAllowedSubnet", tmpaddr, sizeof(tmpaddr))) {
+			IP _subnet, _mask;
+			if (ParseIpAndMask46(tmpaddr, &_subnet, &_mask)) {
+				s->JsonRpcWebApiAllowedSubnetAddr = _subnet;
+				s->JsonRpcWebApiAllowedSubnetMask = _mask;
+			}
+		}
+
 		// Bits of Diffie-Hellman parameters
 		c->DhParamBits = CfgGetInt(f, "DhParamBits");
 		if (c->DhParamBits == 0)
@@ -6365,6 +6375,11 @@ void SiWriteServerCfg(FOLDER *f, SERVER *s)
 
 		// Disable JSON-RPC Web API
 		CfgAddBool(f, "DisableJsonRpcWebApi", s->DisableJsonRpcWebApi);
+
+		char tmpaddr[MAX_PATH];
+		IPAndMaskToStr(tmpaddr, sizeof(tmpaddr),
+			&s->JsonRpcWebApiAllowedSubnetAddr, &s->JsonRpcWebApiAllowedSubnetMask);
+		CfgAddStr(f, "JsonRpcWebApiAllowedSubnet", tmpaddr);
 	}
 	Unlock(c->lock);
 }

src/Cedar/Server.h

@@ -276,6 +276,9 @@ struct SERVER
 	IP ListenIP;						// Listen IP
 	bool StrictSyslogDatetimeFormat;	// Make syslog datetime format strict RFC3164
 	bool DisableJsonRpcWebApi;					// Disable JSON-RPC Web API
+
+	IP JsonRpcWebApiAllowedSubnetAddr;  // If set, allow access to JSON-RPC Web API from
+	IP JsonRpcWebApiAllowedSubnetMask;  //   this subnet only
 };
 
 

src/Mayaqua/Microsoft.c

@@ -2568,6 +2568,7 @@ MS_ADAPTER_LIST *MsCreateAdapterListInnerExVista(bool no_info)
 				UniStrCpy(a->TitleW, sizeof(a->TitleW), title);
 				UniToStr(a->Title, sizeof(a->Title), title);
 				a->Index = r->InterfaceIndex;
+				a->MediaConnectState = r->MediaConnectState;
 				a->Type = r->Type;
 				a->Status = ConvertMidStatusVistaToXp(r->OperStatus);
 				a->Mtu = r->Mtu;

src/Mayaqua/Microsoft.h

@@ -281,6 +281,7 @@ typedef struct MS_ADAPTER
 	char Title[MAX_PATH];			// Display name
 	wchar_t TitleW[MAX_PATH];		// Display Name (Unicode)
 	UINT Index;						// Index
+	UINT MediaConnectState;			// Media Connect State
 	UINT Type;						// Type
 	UINT Status;					// Status
 	UINT Mtu;						// MTU

src/Mayaqua/Network.c

@@ -540,6 +540,13 @@ LIST *Win32GetNicList()
 
 		if (a->Type == 6 && a->AddressSize == 6)
 		{
+			// If the connection state of the interface is unknown, then exclude it.
+			// Unknown means that the device is not plugged into the local host.
+			if (a->MediaConnectState == MediaConnectStateUnknown)
+			{
+				continue;
+			}
+
 			NIC_ENTRY *e = ZeroMalloc(sizeof(NIC_ENTRY));
 
 			StrCpy(e->IfName, sizeof(e->IfName), a->Title);
@@ -6986,6 +6993,18 @@ void IPToStr6Inner(char *str, IP *ip)
 	}
 }
 
+// Format IP and subnet mask as "<ip>/<masksize>"
+void IPAndMaskToStr(char *str, UINT size, IP *ip, IP *subnet)
+{
+	int iplen;
+	UINT masksize;
+
+	IPToStr(str, size, ip);
+	iplen = StrLen(str);
+	masksize = SubnetMaskToInt(subnet);
+	Format(str + iplen, size - iplen, "/%d", masksize);
+}
+
 // Convert the string to an IP address
 bool StrToIP6(IP *ip, char *str)
 {

src/Mayaqua/Network.h

@@ -1289,6 +1289,7 @@ void IPToStr6(char *str, UINT size, IP *ip);
 void IP6AddrToStr(char *str, UINT size, IPV6_ADDR *addr);
 void IPToStr6Array(char *str, UINT size, UCHAR *bytes);
 void IPToStr6Inner(char *str, IP *ip);
+void IPAndMaskToStr(char *str, UINT size, IP *ip, IP *subnet);
 void IntToSubnetMask6(IP *ip, UINT i);
 void IPAnd6(IP *dst, IP *a, IP *b);
 void GetAllRouterMulticastAddress6(IP *ip);