From ee439711c406be0d9e67c19037095726925ea114 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 16 Jan 2023 21:23:04 +0100 Subject: [PATCH] Configure if endpoints require authentication in a central place for better overview Signed-off-by: DL6ER --- src/api/api.c | 88 ++++++++++++++++++++-------------------- src/api/config.c | 8 ---- src/api/dns.c | 12 ------ src/api/ftl.c | 16 -------- src/api/history.c | 4 -- src/api/list.c | 4 -- src/api/network.c | 12 ------ src/api/queries.c | 8 ---- src/api/stats.c | 20 --------- src/api/stats_database.c | 24 ----------- 10 files changed, 45 insertions(+), 151 deletions(-) diff --git a/src/api/api.c b/src/api/api.c index 1c3b896f..9bf8022c 100644 --- a/src/api/api.c +++ b/src/api/api.c @@ -28,49 +28,50 @@ static struct { const char *parameters; int (*func)(struct ftl_conn *api); const bool opts[2]; + bool require_auth; enum http_method methods; } api_request[] = { - // URI ARGUMENTS FUNCTION OPTIONS ALLOWED METHODS + // URI ARGUMENTS FUNCTION OPTIONS AUTH ALLOWED METHODS // Note: The order of appearance matters here, more specific URIs have to // appear *before* less specific URIs: 1. "/a/b/c", 2. "/a/b", 3. "/a" - { "/api/dns/blocking", "", api_dns_blocking, { false, false }, HTTP_GET | HTTP_POST }, - { "/api/dns/cache", "", api_dns_cache, { false, false }, HTTP_GET }, - { "/api/dns/port", "", api_dns_port, { false, false }, HTTP_GET }, - { "/api/dns/entries", "", api_dns_entries, { false, false }, HTTP_GET }, - { "/api/dns/entries", "/{ip}/{host}", api_dns_entries, { false, false }, HTTP_PUT | HTTP_DELETE }, - { "/api/clients", "/{client}", api_list, { false, false }, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, - { "/api/domains", "/{type}/{kind}/{domain}", api_list, { false, false }, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, - { "/api/groups", "/{name}", api_list, { false, false }, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, - { "/api/lists", "/{list}", api_list, { false, false }, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, - { "/api/ftl/client", "", api_ftl_client, { false, false }, HTTP_GET }, - { "/api/ftl/logs/dns", "", api_ftl_logs_dns, { false, false }, HTTP_GET }, - { "/api/ftl/sysinfo", "", api_ftl_sysinfo, { false, false }, HTTP_GET }, - { "/api/ftl/dbinfo", "", api_ftl_dbinfo, { false, false }, HTTP_GET }, - { "/api/ftl/endpoints", "", api_ftl_endpoints, { false, false }, HTTP_GET }, - { "/api/history/clients", "", api_history_clients, { false, false }, HTTP_GET }, - { "/api/history/database/clients", "", api_history_database_clients, { false, false }, HTTP_GET }, - { "/api/history/database", "", api_history_database, { false, false }, HTTP_GET }, - { "/api/history", "", api_history, { false, false }, HTTP_GET }, - { "/api/queries/suggestions", "", api_queries_suggestions, { false, false }, HTTP_GET }, - { "/api/queries", "", api_queries, { false, false }, HTTP_GET }, - { "/api/stats/summary", "", api_stats_summary, { false, false }, HTTP_GET }, - { "/api/stats/query_types", "", api_stats_query_types, { false, false }, HTTP_GET }, - { "/api/stats/upstreams", "", api_stats_upstreams, { false, false }, HTTP_GET }, - { "/api/stats/top_domains", "", api_stats_top_domains, { false, false }, HTTP_GET }, - { "/api/stats/top_clients", "", api_stats_top_clients, { false, false }, HTTP_GET }, - { "/api/stats/recent_blocked", "", api_stats_recentblocked, { false, false }, HTTP_GET }, - { "/api/stats/database/top_domains", "", api_stats_database_top_items, { false, true }, HTTP_GET }, - { "/api/stats/database/top_clients", "", api_stats_database_top_items, { false, false }, HTTP_GET }, - { "/api/stats/database/summary", "", api_stats_database_summary, { false, false }, HTTP_GET }, - { "/api/stats/database/query_types", "", api_stats_database_query_types, { false, false }, HTTP_GET }, - { "/api/stats/database/upstreams", "", api_stats_database_upstreams, { false, false }, HTTP_GET }, - { "/api/version", "", api_version, { false, false }, HTTP_GET }, - { "/api/auth", "", api_auth, { false, false }, HTTP_GET | HTTP_POST | HTTP_DELETE }, - { "/api/config", "", api_config, { false, false }, HTTP_GET | HTTP_PATCH }, - { "/api/network/gateway", "", api_network_gateway, { false, false }, HTTP_GET }, - { "/api/network/interfaces", "", api_network_interfaces, { false, false }, HTTP_GET }, - { "/api/network/devices", "", api_network_devices, { false, false }, HTTP_GET }, - { "/api/docs", "", api_docs, { false, false }, HTTP_GET }, + { "/api/dns/blocking", "", api_dns_blocking, { false, false }, true, HTTP_GET | HTTP_POST }, + { "/api/dns/cache", "", api_dns_cache, { false, false }, true, HTTP_GET }, + { "/api/dns/port", "", api_dns_port, { false, false }, true, HTTP_GET }, + { "/api/dns/entries", "", api_dns_entries, { false, false }, true, HTTP_GET }, + { "/api/dns/entries", "/{ip}/{host}", api_dns_entries, { false, false }, true, HTTP_PUT | HTTP_DELETE }, + { "/api/clients", "/{client}", api_list, { false, false }, true, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, + { "/api/domains", "/{type}/{kind}/{domain}", api_list, { false, false }, true, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, + { "/api/groups", "/{name}", api_list, { false, false }, true, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, + { "/api/lists", "/{list}", api_list, { false, false }, true, HTTP_GET | HTTP_POST | HTTP_PUT | HTTP_DELETE }, + { "/api/ftl/client", "", api_ftl_client, { false, false }, false, HTTP_GET }, + { "/api/ftl/logs/dns", "", api_ftl_logs_dns, { false, false }, true, HTTP_GET }, + { "/api/ftl/sysinfo", "", api_ftl_sysinfo, { false, false }, true, HTTP_GET }, + { "/api/ftl/dbinfo", "", api_ftl_dbinfo, { false, false }, true, HTTP_GET }, + { "/api/ftl/endpoints", "", api_ftl_endpoints, { false, false }, true, HTTP_GET }, + { "/api/history/clients", "", api_history_clients, { false, false }, true, HTTP_GET }, + { "/api/history/database/clients", "", api_history_database_clients, { false, false }, true, HTTP_GET }, + { "/api/history/database", "", api_history_database, { false, false }, true, HTTP_GET }, + { "/api/history", "", api_history, { false, false }, true, HTTP_GET }, + { "/api/queries/suggestions", "", api_queries_suggestions, { false, false }, true, HTTP_GET }, + { "/api/queries", "", api_queries, { false, false }, true, HTTP_GET }, + { "/api/stats/summary", "", api_stats_summary, { false, false }, true, HTTP_GET }, + { "/api/stats/query_types", "", api_stats_query_types, { false, false }, true, HTTP_GET }, + { "/api/stats/upstreams", "", api_stats_upstreams, { false, false }, true, HTTP_GET }, + { "/api/stats/top_domains", "", api_stats_top_domains, { false, false }, true, HTTP_GET }, + { "/api/stats/top_clients", "", api_stats_top_clients, { false, false }, true, HTTP_GET }, + { "/api/stats/recent_blocked", "", api_stats_recentblocked, { false, false }, true, HTTP_GET }, + { "/api/stats/database/top_domains", "", api_stats_database_top_items, { false, true }, true, HTTP_GET }, + { "/api/stats/database/top_clients", "", api_stats_database_top_items, { false, false }, true, HTTP_GET }, + { "/api/stats/database/summary", "", api_stats_database_summary, { false, false }, true, HTTP_GET }, + { "/api/stats/database/query_types", "", api_stats_database_query_types, { false, false }, true, HTTP_GET }, + { "/api/stats/database/upstreams", "", api_stats_database_upstreams, { false, false }, true, HTTP_GET }, + { "/api/version", "", api_version, { false, false }, true, HTTP_GET }, + { "/api/auth", "", api_auth, { false, false }, false, HTTP_GET | HTTP_POST | HTTP_DELETE }, + { "/api/config", "", api_config, { false, false }, true, HTTP_GET | HTTP_PATCH }, + { "/api/network/gateway", "", api_network_gateway, { false, false }, true, HTTP_GET }, + { "/api/network/interfaces", "", api_network_interfaces, { false, false }, true, HTTP_GET }, + { "/api/network/devices", "", api_network_devices, { false, false }, true, HTTP_GET }, + { "/api/docs", "", api_docs, { false, false }, false, HTTP_GET }, }; int api_handler(struct mg_connection *conn, void *ignored) @@ -119,6 +120,11 @@ int api_handler(struct mg_connection *conn, void *ignored) { // Copy options to API struct memcpy(api.opts, api_request[i].opts, sizeof(api.opts)); + + // Verify requesting client is allowed to see this ressource + if(api_request[i].require_auth && check_client_auth(&api) == API_AUTH_UNAUTHORIZED) + return send_json_unauthorized(&api); + // Call the API function and get the return code log_debug(DEBUG_API, "Sending to %s", api_request[i].uri); ret = api_request[i].func(&api); @@ -166,10 +172,6 @@ int api_handler(struct mg_connection *conn, void *ignored) static int api_ftl_endpoints(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - cJSON *get = JSON_NEW_ARRAY(); cJSON *post = JSON_NEW_ARRAY(); cJSON *put = JSON_NEW_ARRAY(); diff --git a/src/api/config.c b/src/api/config.c index b7cb025c..d0cc1caa 100644 --- a/src/api/config.c +++ b/src/api/config.c @@ -333,10 +333,6 @@ static const char *getJSONvalue(struct conf_item *conf_item, cJSON *elem) static int api_config_get(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Parse query string parameters bool detailed = false; if(api->request->query_string != NULL) @@ -417,10 +413,6 @@ static int api_config_get(struct ftl_conn *api) static int api_config_patch(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Is there a payload with valid JSON data? if (api->payload.json == NULL) { return send_json_error(api, 400, diff --git a/src/api/dns.c b/src/api/dns.c index 7a5e2b37..b0730368 100644 --- a/src/api/dns.c +++ b/src/api/dns.c @@ -60,10 +60,6 @@ static int get_blocking(struct ftl_conn *api) static int set_blocking(struct ftl_conn *api) { - // Verify requesting client is allowed to access this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - if (api->payload.json == NULL) { return send_json_error(api, 400, "bad_request", @@ -131,10 +127,6 @@ int api_dns_blocking(struct ftl_conn *api) int api_dns_cache(struct ftl_conn *api) { - // Verify requesting client is allowed to access this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - struct cache_info ci = { 0 }; get_dnsmasq_cache_info(&ci); cJSON *cache = JSON_NEW_OBJECT(); @@ -449,10 +441,6 @@ static int remove_from_custom_list(struct ftl_conn *api, cJSON *entries) int api_dns_entries(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - if(api->method == HTTP_GET) { // Read list item identified by URI (or read them all) diff --git a/src/api/ftl.c b/src/api/ftl.c index 9825c6db..affd42a5 100644 --- a/src/api/ftl.c +++ b/src/api/ftl.c @@ -70,10 +70,6 @@ int api_ftl_client(struct ftl_conn *api) fifologData *fifo_log = NULL; int api_ftl_logs_dns(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - unsigned int start = 0u; if(api->request->query_string != NULL) { @@ -132,10 +128,6 @@ int api_ftl_logs_dns(struct ftl_conn *api) int api_ftl_dbinfo(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - cJSON *json = JSON_NEW_OBJECT(); // Add database stat details @@ -412,10 +404,6 @@ int get_system_obj(struct ftl_conn *api, cJSON *system) int get_ftl_obj(struct ftl_conn *api, cJSON *ftl, const bool is_locked) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - cJSON *database = JSON_NEW_OBJECT(); // Source from shared objects within lock @@ -477,10 +465,6 @@ int get_ftl_obj(struct ftl_conn *api, cJSON *ftl, const bool is_locked) int api_ftl_sysinfo(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - cJSON *json = JSON_NEW_OBJECT(); // Get system object diff --git a/src/api/history.c b/src/api/history.c index 56434f3c..6becb90f 100644 --- a/src/api/history.c +++ b/src/api/history.c @@ -87,10 +87,6 @@ int api_history_clients(struct ftl_conn *api) lock_shm(); - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Find minimum ID to send for(int slot = 0; slot < OVERTIME_SLOTS; slot++) { diff --git a/src/api/list.c b/src/api/list.c index 02e6c21e..6ad689e0 100644 --- a/src/api/list.c +++ b/src/api/list.c @@ -349,10 +349,6 @@ static int api_list_remove(struct ftl_conn *api, int api_list(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - enum gravity_list_type listtype; bool can_modify = false; if((api->item = startsWith("/api/groups", api)) != NULL) diff --git a/src/api/network.c b/src/api/network.c index 6bd17765..5b3e65cf 100644 --- a/src/api/network.c +++ b/src/api/network.c @@ -70,10 +70,6 @@ static bool getDefaultInterface(char iface[IF_NAMESIZE], in_addr_t *gw) int api_network_gateway(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - in_addr_t gw = 0; char iface[IF_NAMESIZE] = { 0 }; @@ -90,10 +86,6 @@ int api_network_gateway(struct ftl_conn *api) int api_network_interfaces(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - cJSON *json = JSON_NEW_OBJECT(); // Get interface with default route @@ -316,10 +308,6 @@ int api_network_interfaces(struct ftl_conn *api) int api_network_devices(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Does the user request a custom number of devices to be included? unsigned int device_count = 10; get_uint_var(api->request->query_string, "device_count", &device_count); diff --git a/src/api/queries.c b/src/api/queries.c index 5869c536..ae51e524 100644 --- a/src/api/queries.c +++ b/src/api/queries.c @@ -73,10 +73,6 @@ static int add_strings_to_array(struct ftl_conn *api, cJSON *array, const char * int api_queries_suggestions(struct ftl_conn *api) { int rc; - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Does the user request a custom number of records to be included? int count = 10; get_int_var(api->request->query_string, "count", &count); @@ -227,10 +223,6 @@ int api_queries(struct ftl_conn *api) JSON_SEND_OBJECT(json); } - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Lock shared memory lock_shm(); diff --git a/src/api/stats.c b/src/api/stats.c index 88dbccbb..9acd5142 100644 --- a/src/api/stats.c +++ b/src/api/stats.c @@ -119,10 +119,6 @@ int api_stats_top_domains(struct ftl_conn *api) // Get options from API struct bool blocked = api->opts[0]; // Can be overwritten by query string - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Exit before processing any data if requested via config setting if(config.misc.privacylevel.v.privacy_level >= PRIVACY_HIDE_DOMAINS) { @@ -274,10 +270,6 @@ int api_stats_top_clients(struct ftl_conn *api) // Get options from API struct bool blocked = api->opts[0]; // Can be overwritten by query string - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Exit before processing any data if requested via config setting if(config.misc.privacylevel.v.privacy_level >= PRIVACY_HIDE_DOMAINS_CLIENTS) { @@ -393,10 +385,6 @@ int api_stats_top_clients(struct ftl_conn *api) int api_stats_upstreams(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - const int forwarded = get_forwarded_count(); unsigned int totalcount = 0; int temparray[forwarded][2]; @@ -507,10 +495,6 @@ int api_stats_upstreams(struct ftl_conn *api) int api_stats_query_types(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - lock_shm(); cJSON *types = JSON_NEW_OBJECT(); @@ -530,10 +514,6 @@ int api_stats_query_types(struct ftl_conn *api) int api_stats_recentblocked(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - // Exit before processing any data if requested via config setting if(config.misc.privacylevel.v.privacy_level >= PRIVACY_HIDE_DOMAINS) { diff --git a/src/api/stats_database.c b/src/api/stats_database.c index 7c03400c..a4b1907f 100644 --- a/src/api/stats_database.c +++ b/src/api/stats_database.c @@ -25,10 +25,6 @@ int api_history_database(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - double from = 0, until = 0; const int interval = 600; if(api->request->query_string != NULL) @@ -180,10 +176,6 @@ int api_history_database(struct ftl_conn *api) int api_stats_database_top_items(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - unsigned int count = 10; double from = 0.0, until = 0.0; @@ -374,10 +366,6 @@ int api_stats_database_top_items(struct ftl_conn *api) int api_stats_database_summary(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - double from = 0, until = 0; if(api->request->query_string != NULL) { @@ -451,10 +439,6 @@ int api_stats_database_summary(struct ftl_conn *api) int api_history_database_clients(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - double from = 0, until = 0; const int interval = 600; if(api->request->query_string != NULL) @@ -676,10 +660,6 @@ int api_history_database_clients(struct ftl_conn *api) int api_stats_database_query_types(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - double from = 0, until = 0; if(api->request->query_string != NULL) { @@ -728,10 +708,6 @@ int api_stats_database_query_types(struct ftl_conn *api) int api_stats_database_upstreams(struct ftl_conn *api) { - // Verify requesting client is allowed to see this ressource - if(check_client_auth(api) == API_AUTH_UNAUTHORIZED) - return send_json_unauthorized(api); - double from = 0, until = 0; if(api->request->query_string != NULL) {