Skip to content

Commit bc7cfa7

Browse files
jaredhendrickson13jaredhendrickson13
committed
- Added endpoint for /interfaces/delete/
- Added endpoint for /system/certificates/ to read all system SSL certificates - Added endpoint for /system/certifciates/add to import a new SSL certificate - Added endpoint for /system/certificates/delete to delete an existing SSL certificate - Added endpoint for /users/authservers/ to read all LDAP and RADIUS authentication server configurations - Added endpoint for /users/authservers/ldap/ to read LDAP authentication server configurations - Added endpoint for /users/authservers/radius/ to read RADIUS authentication server configurations - Changed default API token hash algorithm to SHA256 - Added SHA512 to allow API token hash algorithms - Added snippet to check if a user is disabled before allowing API access
1 parent 88feed1 commit bc7cfa7

15 files changed

Lines changed: 582 additions & 12 deletions

File tree

‎pfSense-pkg-API/Makefile‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,18 @@ do-install:
7171
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/users/modify
7272
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/users/modify/index.php \
7373
${STAGEDIR}${PREFIX}/www/api/v1/users/modify
74-
74+
# Authservers base
75+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/users/authservers
76+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/users/authservers/index.php \
77+
${STAGEDIR}${PREFIX}/www/api/v1/users/authservers
78+
# Authservers ldap
79+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/users/authservers/ldap
80+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/users/authservers/ldap/index.php \
81+
${STAGEDIR}${PREFIX}/www/api/v1/users/authservers/ldap
82+
# Authservers radius
83+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/users/authservers/radius
84+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/users/authservers/radius/index.php \
85+
${STAGEDIR}${PREFIX}/www/api/v1/users/authservers/radius
7586
# SYSTEM API ENDPOINTS----------------------------------------
7687
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/system/
7788
# Version base
@@ -98,6 +109,18 @@ do-install:
98109
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/system/hostname/modify
99110
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/system/hostname/modify/index.php \
100111
${STAGEDIR}${PREFIX}/www/api/v1/system/hostname/modify
112+
# Certificates base
113+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/system/certificates
114+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/system/certificates/index.php \
115+
${STAGEDIR}${PREFIX}/www/api/v1/system/certificates
116+
# Certificates add
117+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/system/certificates/add
118+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/system/certificates/add/index.php \
119+
${STAGEDIR}${PREFIX}/www/api/v1/system/certificates/add
120+
# Certificates delete
121+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/system/certificates/delete
122+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/system/certificates/delete/index.php \
123+
${STAGEDIR}${PREFIX}/www/api/v1/system/certificates/delete
101124
# STATUS API ENDPOINTS----------------------------------------
102125
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/status/
103126
# CARP base
@@ -118,6 +141,10 @@ do-install:
118141
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/interfaces/add
119142
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/interfaces/add/index.php \
120143
${STAGEDIR}${PREFIX}/www/api/v1/interfaces/add
144+
# Interfaces delete
145+
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/interfaces/delete
146+
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/interfaces/delete/index.php \
147+
${STAGEDIR}${PREFIX}/www/api/v1/interfaces/delete
121148
# Vlans base
122149
${MKDIR} ${STAGEDIR}${PREFIX}/www/api/v1/interfaces/vlans
123150
${INSTALL_DATA} ${FILESDIR}${PREFIX}/www/api/v1/interfaces/vlans/index.php \

‎pfSense-pkg-API/files/etc/inc/api.inc‎

Lines changed: 78 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,14 @@ function str_starts_with($needle, $haystack) {
4747
return (substr($haystack, 0, $length) === $needle);
4848
}
4949

50+
// Restarts the pfSense webConfigurator
51+
function restart_webconfigurator() {
52+
ob_flush();
53+
flush();
54+
log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
55+
send_event("service restart webgui");
56+
}
57+
5058
// API authentication debug function
5159
function api_auth_debug($req_privs=array()) {
5260
global $client_id, $client_params, $read_priv;
@@ -129,9 +137,10 @@ function api_authenticate_token($cid, $ctoken) {
129137
// Check if user authenticates successfully
130138
function api_authenticate() {
131139
// Local variables
132-
global $client_id, $client_token;
140+
global $config, $client_id, $client_token;
133141
$authenticated = false;
134142
$api_config = get_api_configuration()[1];
143+
$users = index_users();
135144
// Format our client ID and token based on our configured auth mode
136145
if ($api_config["authmode"] === "base64") {
137146
$client_id = base64_decode($client_id);
@@ -148,14 +157,18 @@ function api_authenticate() {
148157
$authenticated = true;
149158
}
150159
} else {
151-
// Check AUTHENTICATION-------------------------------------------------------------------
160+
// Check local auth
152161
$local_auth = authenticate_user($client_id, $client_token); // Test auth locally
153162
if ($local_auth === true) {
154163
unset($_SESSION["Username"]);
155164
$_SESSION["Username"] = $client_id;
156165
$authenticated = true;
157166
}
158167
}
168+
// Check if user is disabled
169+
if (array_key_exists("disabled", $config["system"]["user"][$users[$client_id]])) {
170+
$authenticated = false;
171+
}
159172
return $authenticated;
160173
}
161174

@@ -1046,6 +1059,69 @@ function apply_interface_config($if_conf) {
10461059
return true;
10471060
}
10481061

1062+
// Delete an interface
1063+
function destroy_interface($id) {
1064+
// Local variables
1065+
global $config;
1066+
$err_msg = "";
1067+
$success = false;
1068+
if ($id === "wan") {
1069+
$err_msg = "wan interface cannot be deleted";
1070+
} elseif (link_interface_to_group($id)) {
1071+
$err_msg = "interface member of group";
1072+
} elseif (link_interface_to_bridge($id)) {
1073+
$err_msg = "interface member of bridge";
1074+
} elseif (link_interface_to_gre($id)) {
1075+
$err_msg = "interface member of gre tunnel";
1076+
} elseif (link_interface_to_gif($id)) {
1077+
$err_msg = "interface member of gif tunnel";
1078+
} elseif (interface_has_queue($id)) {
1079+
$err_msg = "interface traffic shaper configured";
1080+
} else {
1081+
unset($config['interfaces'][$id]['enable']);
1082+
$realid = get_real_interface($id);
1083+
interface_bring_down($id); // Bring down interface
1084+
unset($config['interfaces'][$id]); // Delete our interface from configuration
1085+
// Remove DHCP config for interface
1086+
if (is_array($config['dhcpd']) && is_array($config['dhcpd'][$id])) {
1087+
unset($config['dhcpd'][$id]);
1088+
services_dhcpd_configure('inet');
1089+
}
1090+
// Removed interface config for dhcp6
1091+
if (is_array($config['dhcpdv6']) && is_array($config['dhcpdv6'][$id])) {
1092+
unset($config['dhcpdv6'][$id]);
1093+
services_dhcpd_configure('inet6');
1094+
}
1095+
// Remove ACL for interface
1096+
if (count($config['filter']['rule']) > 0) {
1097+
foreach ($config['filter']['rule'] as $x => $rule) {
1098+
if ($rule['interface'] == $id) {
1099+
unset($config['filter']['rule'][$x]);
1100+
}
1101+
}
1102+
}
1103+
// Remove NAT config for interface
1104+
if (is_array($config['nat']['rule']) && count($config['nat']['rule']) > 0) {
1105+
foreach ($config['nat']['rule'] as $x => $rule) {
1106+
if ($rule['interface'] == $id) {
1107+
unset($config['nat']['rule'][$x]['interface']);
1108+
}
1109+
}
1110+
}
1111+
$change_note = " Deleted interface via API"; // Add a change note
1112+
write_config(sprintf(gettext($change_note))); // Apply our configuration change
1113+
// Disable DHCP if last interface
1114+
if ($config['interfaces']['lan'] && $config['dhcpd']['wan']) {
1115+
unset($config['dhcpd']['wan']);
1116+
}
1117+
// Update VLAN assignments
1118+
link_interface_to_vlans($realid, "update");
1119+
// Write success return
1120+
$success = true;
1121+
}
1122+
return array("status" => $success, "msg" => $err_msg);
1123+
}
1124+
10491125
// Check if CARP is enabled for disabled
10501126
function is_carp_enabled() {
10511127
// Check current CARP status

0 commit comments

Comments
 (0)