1<?php 2/* 3** Zabbix 4** Copyright (C) 2001-2021 Zabbix SIA 5** 6** This program is free software; you can redistribute it and/or modify 7** it under the terms of the GNU General Public License as published by 8** the Free Software Foundation; either version 2 of the License, or 9** (at your option) any later version. 10** 11** This program is distributed in the hope that it will be useful, 12** but WITHOUT ANY WARRANTY; without even the implied warranty of 13** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14** GNU General Public License for more details. 15** 16** You should have received a copy of the GNU General Public License 17** along with this program; if not, write to the Free Software 18** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 19**/ 20 21 22/** 23 * Class containing methods for operations with autoregistration. 24 */ 25class CAutoregistration extends CApiService { 26 27 protected $tableName = 'config'; 28 protected $tableAlias = 'c'; 29 30 /** 31 * @param array $options 32 * 33 * @throws APIException if the input is invalid. 34 * 35 * @return array 36 */ 37 public function get(array $options) { 38 $api_input_rules = ['type' => API_OBJECT, 'fields' => [ 39 'output' => ['type' => API_OUTPUT, 'in' => 'tls_accept', 'default' => API_OUTPUT_EXTEND] 40 ]]; 41 if (!CApiInputValidator::validate($api_input_rules, $options, '/', $error)) { 42 self::exception(ZBX_API_ERROR_PARAMETERS, $error); 43 } 44 45 if (self::$userData['type'] != USER_TYPE_SUPER_ADMIN) { 46 return []; 47 } 48 49 if ($options['output'] === API_OUTPUT_EXTEND) { 50 $options['output'] = ['tls_accept']; 51 } 52 53 $options['output'] = preg_replace("/^(tls_accept)$/", "autoreg_$1", $options['output']); 54 55 $db_autoreg = []; 56 57 $result = DBselect($this->createSelectQuery($this->tableName(), $options)); 58 while ($row = DBfetch($result)) { 59 $db_autoreg[] = $row; 60 } 61 if ($this->outputIsRequested('autoreg_tls_accept', $options['output'])) { 62 $db_autoreg = CArrayHelper::renameObjectsKeys($db_autoreg, ['autoreg_tls_accept' => 'tls_accept']); 63 } 64 $db_autoreg = $this->unsetExtraFields($db_autoreg, ['configid'], []); 65 66 return $db_autoreg[0]; 67 } 68 69 /** 70 * @param array $autoreg 71 * 72 * @return bool 73 */ 74 public function update(array $autoreg) { 75 $this->validateUpdate($autoreg, $db_autoreg); 76 77 $upd_config = []; 78 $upd_config_autoreg_tls = []; 79 80 if (array_key_exists('tls_accept', $autoreg) && $autoreg['tls_accept'] != $db_autoreg['tls_accept']) { 81 $upd_config['autoreg_tls_accept'] = $autoreg['tls_accept']; 82 } 83 84 // strings 85 foreach (['tls_psk_identity', 'tls_psk'] as $field_name) { 86 if (array_key_exists($field_name, $autoreg) && $autoreg[$field_name] !== $db_autoreg[$field_name]) { 87 $upd_config_autoreg_tls[$field_name] = $autoreg[$field_name]; 88 } 89 } 90 91 if ($upd_config) { 92 DB::update('config', [ 93 'values' => $upd_config, 94 'where' => ['configid' => $db_autoreg['configid']] 95 ]); 96 } 97 98 if ($upd_config_autoreg_tls) { 99 DB::update('config_autoreg_tls', [ 100 'values' => $upd_config_autoreg_tls, 101 'where' => ['autoreg_tlsid' => $db_autoreg['autoreg_tlsid']] 102 ]); 103 } 104 105 $this->addAuditBulk(AUDIT_ACTION_UPDATE, AUDIT_RESOURCE_AUTOREGISTRATION, 106 [['configid' => $db_autoreg['configid']] + $autoreg], [$db_autoreg['configid'] => $db_autoreg] 107 ); 108 109 return true; 110 } 111 112 /** 113 * @param array $autoreg 114 * @param array $db_autoreg 115 * 116 * @throws APIException if the input is invalid. 117 */ 118 protected function validateUpdate(array &$autoreg, array &$db_autoreg = null) { 119 $api_input_rules = ['type' => API_OBJECT, 'flags' => API_NOT_EMPTY, 'fields' => [ 120 'tls_accept' => ['type' => API_INT32, 'in' => HOST_ENCRYPTION_NONE.':'.(HOST_ENCRYPTION_NONE | HOST_ENCRYPTION_PSK)], 121 'tls_psk_identity' => ['type' => API_STRING_UTF8, 'length' => DB::getFieldLength('config_autoreg_tls', 'tls_psk_identity')], 122 'tls_psk' => ['type' => API_PSK, 'length' => DB::getFieldLength('config_autoreg_tls', 'tls_psk')] 123 ]]; 124 if (!CApiInputValidator::validate($api_input_rules, $autoreg, '/', $error)) { 125 self::exception(ZBX_API_ERROR_PARAMETERS, $error); 126 } 127 128 // Check permissions. 129 if (self::$userData['type'] != USER_TYPE_SUPER_ADMIN) { 130 self::exception(ZBX_API_ERROR_PERMISSIONS, _('No permissions to referred object or it does not exist!')); 131 } 132 133 $db_autoreg = DBfetch(DBselect( 134 "SELECT c.configid,c.autoreg_tls_accept AS tls_accept,ca.autoreg_tlsid,ca.tls_psk_identity,ca.tls_psk". 135 " FROM config c,config_autoreg_tls ca" 136 )); 137 138 $tls_accept = array_key_exists('tls_accept', $autoreg) ? $autoreg['tls_accept'] : $db_autoreg['tls_accept']; 139 140 // PSK validation. 141 foreach (['tls_psk_identity', 'tls_psk'] as $field_name) { 142 if ($tls_accept & HOST_ENCRYPTION_PSK) { 143 if (!array_key_exists($field_name, $autoreg) && $db_autoreg[$field_name] === '') { 144 self::exception(ZBX_API_ERROR_PARAMETERS, 145 _s('Invalid parameter "%1$s": %2$s.', '/', _s('the parameter "%1$s" is missing', $field_name)) 146 ); 147 } 148 149 if (array_key_exists($field_name, $autoreg) && $autoreg[$field_name] === '') { 150 self::exception(ZBX_API_ERROR_PARAMETERS, 151 _s('Invalid parameter "%1$s": %2$s.', '/'.$field_name, _('cannot be empty')) 152 ); 153 } 154 } 155 else { 156 if (array_key_exists($field_name, $autoreg) && $autoreg[$field_name] !== '') { 157 self::exception(ZBX_API_ERROR_PARAMETERS, 158 _s('Invalid parameter "%1$s": %2$s.', '/'.$field_name, _('should be empty')) 159 ); 160 } 161 162 if (!array_key_exists($field_name, $autoreg) && $db_autoreg[$field_name] !== '') { 163 $autoreg[$field_name] = ''; 164 } 165 } 166 } 167 } 168} 169