Project

General

Profile

Download (18 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
	$Id$
4

    
5
        xmlrpc.php
6
        Copyright (C) 2013-2014 Electric Sheep Fencing, LP
7
        Copyright (C) 2009, 2010 Scott Ullrich
8
        Copyright (C) 2005 Colin Smith
9
        All rights reserved.
10

    
11
        Redistribution and use in source and binary forms, with or without
12
        modification, are permitted provided that the following conditions are met:
13

    
14
        1. Redistributions of source code must retain the above copyright notice,
15
           this list of conditions and the following disclaimer.
16

    
17
        2. Redistributions in binary form must reproduce the above copyright
18
           notice, this list of conditions and the following disclaimer in the
19
           documentation and/or other materials provided with the distribution.
20

    
21
        THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
22
        INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
23
        AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24
        AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
25
        OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26
        SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27
        INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28
        CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29
        ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30
        POSSIBILITY OF SUCH DAMAGE.
31
*/
32

    
33
##|+PRIV
34
##|*IDENT=page-xmlrpclibrary
35
##|*NAME=XMLRPC Library page
36
##|*DESCR=Allow access to the 'XMLRPC Library' page.
37
##|*MATCH=xmlrpc.php*
38
##|-PRIV
39

    
40
require("config.inc");
41
require("functions.inc");
42
require_once("filter.inc");
43
require("ipsec.inc");
44
require("vpn.inc");
45
require("shaper.inc");
46
require("xmlrpc_server.inc");
47
require("xmlrpc.inc");
48
require("array_intersect_key.inc");
49

    
50
function xmlrpc_loop_detect() {
51
	global $config;
52

    
53
	/* grab sync to ip if enabled */
54
	if ($config['hasync'])
55
		$synchronizetoip = $config['hasync']['synchronizetoip'];
56
	if($synchronizetoip) {
57
		if($synchronizetoip == $_SERVER['REMOTE_ADDR'])
58
			return true;	
59
	}
60

    
61
	return false;
62
}
63

    
64
$xmlrpc_g = array(
65
	"return" => array(
66
		"true" => new XML_RPC_Response(new XML_RPC_Value(true, $XML_RPC_Boolean)),
67
		"false" => new XML_RPC_Response(new XML_RPC_Value(false, $XML_RPC_Boolean)),
68
		"authfail" => new XML_RPC_Response(new XML_RPC_Value(gettext("Authentication failed"), $XML_RPC_String))
69
	)
70
);
71

    
72
/*
73
 *   pfSense XMLRPC errors
74
 *   $XML_RPC_erruser + 1 = Auth failure
75
 */
76
$XML_RPC_erruser = 200;
77

    
78
/* EXPOSED FUNCTIONS */
79
$exec_php_doc = gettext("XMLRPC wrapper for eval(). This method must be called with two parameters: a string containing the local system\'s password followed by the PHP code to evaluate.");
80
$exec_php_sig = array(
81
	array(
82
		$XML_RPC_Boolean, // First signature element is return value.
83
		$XML_RPC_String, // password
84
		$XML_RPC_String, // shell code to exec
85
	)
86
);
87

    
88
function xmlrpc_authfail() {
89
	log_auth("webConfigurator authentication error for 'admin' from {$_SERVER['REMOTE_ADDR']}");
90
}
91

    
92
function exec_php_xmlrpc($raw_params) {
93
	global $config, $xmlrpc_g;
94

    
95
	$params = xmlrpc_params_to_php($raw_params);
96
	if(!xmlrpc_auth($params)) {
97
		xmlrpc_authfail();
98
		return $xmlrpc_g['return']['authfail'];
99
	}
100
	$exec_php = $params[0];
101
	eval($exec_php);
102
	if($toreturn) {
103
		$response = XML_RPC_encode($toreturn);
104
		return new XML_RPC_Response($response);
105
	} else
106
		return $xmlrpc_g['return']['true'];
107
}
108

    
109
/*****************************/
110
$exec_shell_doc = gettext("XMLRPC wrapper for mwexec(). This method must be called with two parameters: a string containing the local system\'s password followed by an shell command to execute.");
111
$exec_shell_sig = array(
112
	array(
113
		$XML_RPC_Boolean, // First signature element is return value.
114
		$XML_RPC_String, // password
115
		$XML_RPC_String, // shell code to exec
116
	)
117
);
118

    
119
function exec_shell_xmlrpc($raw_params) {
120
	global $config, $xmlrpc_g;
121

    
122
	$params = xmlrpc_params_to_php($raw_params);
123
	if(!xmlrpc_auth($params)) {
124
		xmlrpc_authfail();
125
		return $xmlrpc_g['return']['authfail'];
126
	}
127
	$shell_cmd = $params[0];
128
	mwexec($shell_cmd);
129

    
130
	return $xmlrpc_g['return']['true'];
131
}
132

    
133
/*****************************/
134
$backup_config_section_doc = gettext("XMLRPC wrapper for backup_config_section. This method must be called with two parameters: a string containing the local system\'s password followed by an array containing the keys to be backed up.");
135
$backup_config_section_sig = array(
136
	array(
137
		$XML_RPC_Struct, // First signature element is return value.
138
		$XML_RPC_String,
139
		$XML_RPC_Array
140
	)
141
);
142

    
143
function backup_config_section_xmlrpc($raw_params) {
144
	global $config, $xmlrpc_g;
145

    
146
	if (xmlrpc_loop_detect()) {
147
		log_error("Disallowing CARP sync loop");
148
		return;
149
	}
150

    
151
	$params = xmlrpc_params_to_php($raw_params);
152
	if(!xmlrpc_auth($params)) {
153
		xmlrpc_authfail();
154
		return $xmlrpc_g['return']['authfail'];
155
	}
156
	$val = array_intersect_key($config, array_flip($params[0]));
157

    
158
	return new XML_RPC_Response(XML_RPC_encode($val));
159
}
160

    
161
/*****************************/
162
$restore_config_section_doc = gettext("XMLRPC wrapper for restore_config_section. This method must be called with two parameters: a string containing the local system\'s password and an array to merge into the system\'s config. This function returns true upon completion.");
163
$restore_config_section_sig = array(
164
	array(
165
		$XML_RPC_Boolean,
166
		$XML_RPC_String,
167
		$XML_RPC_Struct
168
	)
169
);
170

    
171
function restore_config_section_xmlrpc($raw_params) {
172
	global $config, $xmlrpc_g;
173

    
174
	$old_config = $config;
175

    
176
	if (xmlrpc_loop_detect()) {
177
		log_error("Disallowing CARP sync loop");
178
		return;
179
	}
180

    
181
	$params = xmlrpc_params_to_php($raw_params);
182
	if(!xmlrpc_auth($params)) {
183
		xmlrpc_authfail();
184
		return $xmlrpc_g['return']['authfail'];
185
	}
186

    
187
	// Some sections should just be copied and not merged or we end
188
	//   up unable to sync the deletion of the last item in a section
189
	$sync_full = array('ipsec', 'aliases', 'wol', 'load_balancer', 'openvpn', 'cert', 'ca', 'crl', 'schedules', 'filter', 'nat', 'dhcpd', 'dhcpv6');
190
	$sync_full_done = array();
191
	foreach ($sync_full as $syncfull) {
192
		if (isset($params[0][$syncfull])) {
193
			$config[$syncfull] = $params[0][$syncfull];
194
			unset($params[0][$syncfull]);
195
			$sync_full_done[] = $syncfull;
196
		}
197
	}
198

    
199
	$vipbackup = array();
200
	$oldvips = array();
201
	if (isset($params[0]['virtualip'])) {
202
		if (is_array($config['virtualip']['vip'])) {
203
			foreach ($config['virtualip']['vip'] as $vipindex => $vip) {
204
				if ($vip['mode'] == "carp")
205
					$oldvips["{$vip['interface']}_vip{$vip['vhid']}"] = "{$vip['password']}{$vip['advskew']}{$vip['subnet']}{$vip['subnet_bits']}{$vip['advbase']}";
206
				else if ($vip['mode'] == "ipalias" && (strstr($vip['interface'], "_vip") || strstr($vip['interface'], "lo0")))
207
					$oldvips[$vip['subnet']] = "{$vip['interface']}{$vip['subnet']}{$vip['subnet_bits']}";
208
				else if (($vip['mode'] == "ipalias" || $vip['mode'] == 'proxyarp') && !(strstr($vip['interface'], "_vip") || strstr($vip['interface'], "lo0")))
209
					$vipbackup[] = $vip;
210
			}
211
		}
212
	}
213

    
214
        // For vip section, first keep items sent from the master
215
	$config = array_merge_recursive_unique($config, $params[0]);
216

    
217
        /* Then add ipalias and proxyarp types already defined on the backup */
218
	if (is_array($vipbackup) && !empty($vipbackup)) {
219
		if (!is_array($config['virtualip']))
220
			$config['virtualip'] = array();
221
		if (!is_array($config['virtualip']['vip']))
222
			$config['virtualip']['vip'] = array();
223
		foreach ($vipbackup as $vip)
224
			array_unshift($config['virtualip']['vip'], $vip);
225
	}
226

    
227
	/* Log what happened */
228
	$mergedkeys = implode(",", array_merge(array_keys($params[0]), $sync_full_done));
229
	write_config(sprintf(gettext("Merged in config (%s sections) from XMLRPC client."),$mergedkeys));
230

    
231
	/* 
232
	 * The real work on handling the vips specially
233
	 * This is a copy of intefaces_vips_configure with addition of not reloading existing/not changed carps
234
	 */
235
	if (isset($params[0]['virtualip']) && is_array($config['virtualip']) && is_array($config['virtualip']['vip'])) {
236
		$carp_setuped = false;
237
		$anyproxyarp = false;
238
		foreach ($config['virtualip']['vip'] as $vip) {
239
			if ($vip['mode'] == "carp" && isset($oldvips["{$vip['interface']}_vip{$vip['vhid']}"])) {
240
				if ($oldvips["{$vip['interface']}_vip{$vip['vhid']}"] == "{$vip['password']}{$vip['advskew']}{$vip['subnet']}{$vip['subnet_bits']}{$vip['advbase']}") {
241
					if (does_vip_exist($vip)) {
242
						unset($oldvips["{$vip['interface']}_vip{$vip['vhid']}"]);
243
						continue; // Skip reconfiguring this vips since nothing has changed.
244
					}
245
				}
246
				unset($oldvips["{$vip['interface']}_vip{$vip['vhid']}"]);
247
			} else if ($vip['mode'] == "ipalias" && strstr($vip['interface'], "_vip") && isset($oldvips[$vip['subnet']])) {
248
				if ($oldvips[$vip['subnet']] == "{$vip['interface']}{$vip['subnet']}{$vip['subnet_bits']}") {
249
					if (does_vip_exist($vip)) {
250
						unset($oldvips[$vip['subnet']]);
251
						continue; // Skip reconfiguring this vips since nothing has changed.
252
					}
253
				}
254
				unset($oldvips[$vip['subnet']]);
255
			}
256

    
257
			switch ($vip['mode']) {
258
			case "proxyarp":
259
				$anyproxyarp = true;
260
				break;
261
			case "ipalias":
262
				interface_ipalias_configure($vip);
263
				break;
264
			case "carp":
265
				if ($carp_setuped == false)
266
                                        $carp_setuped = true;
267
				interface_carp_configure($vip);
268
				break;
269
			}
270
		}
271
		/* Cleanup remaining old carps */
272
		foreach ($oldvips as $oldvipif => $oldvippar) {
273
			$oldvipif = get_real_interface($oldvippar['interface']);
274
			if (!empty($oldvipif))
275
				pfSense_interface_deladdress($oldvipif, $oldvipar['subnet']);
276
		}
277
		if ($carp_setuped == true)
278
			interfaces_sync_setup();
279
		if ($anyproxyarp == true)
280
			interface_proxyarp_configure();
281
	}
282

    
283
	if (isset($old_config['ipsec']['enable']) !== isset($config['ipsec']['enable']))
284
		vpn_ipsec_configure();
285

    
286
	unset($old_config);
287

    
288
	return $xmlrpc_g['return']['true'];
289
}
290

    
291
/*****************************/
292
$merge_config_section_doc = gettext("XMLRPC wrapper for merging package sections. This method must be called with two parameters: a string containing the local system\'s password and an array to merge into the system\'s config. This function returns true upon completion.");
293
$merge_config_section_sig = array(
294
	array(
295
		$XML_RPC_Boolean,
296
		$XML_RPC_String,
297
		$XML_RPC_Struct
298
	)
299
);
300

    
301
function merge_installedpackages_section_xmlrpc($raw_params) {
302
	global $config, $xmlrpc_g;
303

    
304
	if (xmlrpc_loop_detect()) {
305
		log_error("Disallowing CARP sync loop");
306
		return;
307
	}
308

    
309
	$params = xmlrpc_params_to_php($raw_params);
310
	if(!xmlrpc_auth($params)) {
311
		xmlrpc_authfail();
312
		return $xmlrpc_g['return']['authfail'];
313
	}
314
	$config['installedpackages'] = array_merge($config['installedpackages'], $params[0]);
315
	$mergedkeys = implode(",", array_keys($params[0]));
316
	write_config(sprintf(gettext("Merged in config (%s sections) from XMLRPC client."),$mergedkeys));
317

    
318
	return $xmlrpc_g['return']['true'];
319
}
320

    
321
/*****************************/
322
$merge_config_section_doc = gettext("XMLRPC wrapper for merge_config_section. This method must be called with two parameters: a string containing the local system\'s password and an array to merge into the system\'s config. This function returns true upon completion.");
323
$merge_config_section_sig = array(
324
	array(
325
		$XML_RPC_Boolean,
326
		$XML_RPC_String,
327
		$XML_RPC_Struct
328
	)
329
);
330

    
331
function merge_config_section_xmlrpc($raw_params) {
332
	global $config, $xmlrpc_g;
333

    
334
	if (xmlrpc_loop_detect()) {
335
		log_error("Disallowing CARP sync loop");
336
		return;
337
	}
338

    
339
	$params = xmlrpc_params_to_php($raw_params);
340
	if(!xmlrpc_auth($params)) {
341
		xmlrpc_authfail();
342
		return $xmlrpc_g['return']['authfail'];
343
	}
344
	$config_new = array_overlay($config, $params[0]);
345
	$config = $config_new;
346
	$mergedkeys = implode(",", array_keys($params[0]));
347
	write_config(sprintf(gettext("Merged in config (%s sections) from XMLRPC client."), $mergedkeys));
348
	return $xmlrpc_g['return']['true'];
349
}
350

    
351
/*****************************/
352
$filter_configure_doc = gettext("Basic XMLRPC wrapper for filter_configure. This method must be called with one paramater: a string containing the local system\'s password. This function returns true upon completion.");
353
$filter_configure_sig = array(
354
	array(
355
		$XML_RPC_Boolean,
356
		$XML_RPC_String
357
	)
358
);
359

    
360
function filter_configure_xmlrpc($raw_params) {
361
	global $xmlrpc_g, $config;
362

    
363
	$params = xmlrpc_params_to_php($raw_params);
364
	if(!xmlrpc_auth($params)) {
365
		xmlrpc_authfail();
366
		return $xmlrpc_g['return']['authfail'];
367
	}
368
	filter_configure();
369
	system_routing_configure();
370
	setup_gateways_monitor();
371
	relayd_configure();
372
	require_once("openvpn.inc");
373
	openvpn_resync_all();
374
	if (isset($config['dnsmasq']['enable']))
375
		services_dnsmasq_configure();
376
	elseif (isset($config['unbound']['enable']))
377
		services_unbound_configure();
378
	else
379
		# Both calls above run services_dhcpd_configure(), then we just
380
		# need to call it when them are not called to avoid restart dhcpd
381
		# twice, as described on ticket #3797
382
		services_dhcpd_configure();
383
	local_sync_accounts();
384

    
385
	return $xmlrpc_g['return']['true'];
386
}
387

    
388
/*****************************/
389
$carp_configure_doc = gettext("Basic XMLRPC wrapper for configuring CARP interfaces.");
390
$carp_configure_sig = array(
391
	array(
392
		$XML_RPC_Boolean,
393
		$XML_RPC_String
394
	)
395
);
396

    
397
function interfaces_carp_configure_xmlrpc($raw_params) {
398
	global $xmlrpc_g;
399

    
400
	if (xmlrpc_loop_detect()) {
401
		log_error("Disallowing CARP sync loop");
402
		return;
403
	}
404

    
405
	$params = xmlrpc_params_to_php($raw_params);
406
	if(!xmlrpc_auth($params)) {
407
		xmlrpc_authfail();
408
		return $xmlrpc_g['return']['authfail'];
409
	}
410
	interfaces_vips_configure();
411

    
412
	return $xmlrpc_g['return']['true'];
413
}
414

    
415
/*****************************/
416
$check_firmware_version_doc = gettext("Basic XMLRPC wrapper for check_firmware_version. This function will return the output of check_firmware_version upon completion.");
417

    
418
$check_firmware_version_sig = array(
419
	array(
420
		$XML_RPC_String,
421
		$XML_RPC_String
422
	)
423
);
424

    
425
function check_firmware_version_xmlrpc($raw_params) {
426
	global $xmlrpc_g, $XML_RPC_String;
427

    
428
	$params = xmlrpc_params_to_php($raw_params);
429
	if(!xmlrpc_auth($params)) {
430
		xmlrpc_authfail();
431
		return $xmlrpc_g['return']['authfail'];
432
	}
433
	return new XML_RPC_Response(new XML_RPC_Value(check_firmware_version(false), $XML_RPC_String));
434
}
435

    
436
/*****************************/
437
$pfsense_firmware_version_doc = gettext("Basic XMLRPC wrapper for check_firmware_version. This function will return the output of check_firmware_version upon completion.");
438

    
439
$pfsense_firmware_version_sig = array (
440
        array (
441
                $XML_RPC_Struct,
442
                $XML_RPC_String
443
        )
444
);
445

    
446
function pfsense_firmware_version_xmlrpc($raw_params) {
447
        global $xmlrpc_g;
448

    
449
        $params = xmlrpc_params_to_php($raw_params);
450
        if(!xmlrpc_auth($params)) {
451
			xmlrpc_authfail();
452
			return $xmlrpc_g['return']['authfail'];
453
		}
454
        return new XML_RPC_Response(XML_RPC_encode(host_firmware_version()));
455
}
456

    
457
/*****************************/
458
$reboot_doc = gettext("Basic XMLRPC wrapper for rc.reboot.");
459
$reboot_sig = array(array($XML_RPC_Boolean, $XML_RPC_String));
460
function reboot_xmlrpc($raw_params) {
461
	global $xmlrpc_g;
462

    
463
	$params = xmlrpc_params_to_php($raw_params);
464
	if(!xmlrpc_auth($params)) {
465
		xmlrpc_authfail();
466
		return $xmlrpc_g['return']['authfail'];
467
	}
468
	mwexec_bg("/etc/rc.reboot");
469

    
470
	return $xmlrpc_g['return']['true'];
471
}
472

    
473
/*****************************/
474
$get_notices_sig = array(
475
	array(
476
		$XML_RPC_Array,
477
		$XML_RPC_String
478
	),
479
	array(
480
		$XML_RPC_Array
481
	)
482
);
483

    
484
function get_notices_xmlrpc($raw_params) {
485
	global $g, $xmlrpc_g;
486

    
487
	$params = xmlrpc_params_to_php($raw_params);
488
	if(!xmlrpc_auth($params)) {
489
		xmlrpc_authfail();
490
		return $xmlrpc_g['return']['authfail'];
491
	}
492
	if(!function_exists("get_notices"))
493
		require("notices.inc");
494
	if(!$params) {
495
		$toreturn = get_notices();
496
	} else {
497
		$toreturn = get_notices($params);
498
	}
499
	$response = new XML_RPC_Response(XML_RPC_encode($toreturn));
500

    
501
	return $response;
502
}
503

    
504
$xmlrpclockkey = lock('xmlrpc', LOCK_EX);
505

    
506
/*****************************/
507
$server = new XML_RPC_Server(
508
        array(
509
		'pfsense.exec_shell' => array('function' => 'exec_shell_xmlrpc',
510
			'signature' => $exec_shell_sig,
511
			'docstring' => $exec_shell_doc),
512
		'pfsense.exec_php' => array('function' => 'exec_php_xmlrpc',
513
			'signature' => $exec_php_sig,
514
			'docstring' => $exec_php_doc),	
515
		'pfsense.filter_configure' => array('function' => 'filter_configure_xmlrpc',
516
			'signature' => $filter_configure_sig,
517
			'docstring' => $filter_configure_doc),
518
		'pfsense.interfaces_carp_configure' => array('function' => 'interfaces_carp_configure_xmlrpc',
519
			'docstring' => $carp_configure_sig),
520
		'pfsense.backup_config_section' => array('function' => 'backup_config_section_xmlrpc',
521
			'signature' => $backup_config_section_sig,
522
			'docstring' => $backup_config_section_doc),
523
		'pfsense.restore_config_section' => array('function' => 'restore_config_section_xmlrpc',
524
			'signature' => $restore_config_section_sig,
525
			'docstring' => $restore_config_section_doc),
526
		'pfsense.merge_config_section' => array('function' => 'merge_config_section_xmlrpc',
527
			'signature' => $merge_config_section_sig,
528
			'docstring' => $merge_config_section_doc),
529
		'pfsense.merge_installedpackages_section_xmlrpc' => array('function' => 'merge_installedpackages_section_xmlrpc',
530
			'signature' => $merge_config_section_sig,
531
			'docstring' => $merge_config_section_doc),							
532
		'pfsense.check_firmware_version' => array('function' => 'check_firmware_version_xmlrpc',
533
			'signature' => $check_firmware_version_sig,
534
			'docstring' => $check_firmware_version_doc),
535
		'pfsense.host_firmware_version' => array('function' => 'pfsense_firmware_version_xmlrpc',
536
			'signature' => $pfsense_firmware_version_sig,
537
			'docstring' => $host_firmware_version_doc),
538
		'pfsense.reboot' => array('function' => 'reboot_xmlrpc',
539
			'signature' => $reboot_sig,
540
			'docstring' => $reboot_doc),
541
		'pfsense.get_notices' => array('function' => 'get_notices_xmlrpc',
542
			'signature' => $get_notices_sig)
543
        )
544
);
545

    
546
unlock($xmlrpclockkey);
547

    
548
    function array_overlay($a1,$a2)
549
    {
550
        foreach($a1 as $k => $v) {
551
            if(!array_key_exists($k,$a2)) continue;
552
            if(is_array($v) && is_array($a2[$k])){
553
                $a1[$k] = array_overlay($v,$a2[$k]);
554
            }else{
555
                $a1[$k] = $a2[$k];
556
            }
557
        }
558
        return $a1;
559
    }
560

    
561
?>
(256-256/256)