| 269 | } |
| 270 | |
| 271 | std::string firewallOn(const std::string &pars) |
| 272 | { |
| 273 | std::wstring connectingIp; |
| 274 | std::vector<std::wstring> ips; |
| 275 | bool bAllowLanTraffic; |
| 276 | bool bIsCustomConfig; |
| 277 | deserializePars(pars, connectingIp, ips, bAllowLanTraffic, bIsCustomConfig); |
| 278 | |
| 279 | // connectingIp may be empty (always-on firewall before any connection); when present it must |
| 280 | // be a single IP. Rather than reject the whole request on bad input, sanitize it: drop an |
| 281 | // invalid connectingIp and any invalid IP/CIDR entries from the list. This keeps the firewall |
| 282 | // enabled (fail-closed) instead of leaving the user unprotected. |
| 283 | if (!connectingIp.empty() && !NetworkValidation::isValidIpAddress(connectingIp)) { |
| 284 | spdlog::error(L"firewallOn: clearing invalid connectingIp: \"{}\"", connectingIp); |
| 285 | connectingIp.clear(); |
| 286 | } |
| 287 | |
| 288 | ips.erase(std::remove_if(ips.begin(), ips.end(), |
| 289 | [](const std::wstring &ip) { |
| 290 | if (NetworkValidation::isValidIpOrCidr(ip)) { |
| 291 | return false; |
| 292 | } |
| 293 | spdlog::error(L"firewallOn: dropping invalid IP/CIDR: \"{}\"", ip); |
| 294 | return true; |
| 295 | }), |
| 296 | ips.end()); |
| 297 | |
| 298 | bool prevStatus = FirewallFilter::instance().currentStatus(); |
| 299 | FirewallFilter::instance().on(connectingIp.c_str(), ips, bAllowLanTraffic, bIsCustomConfig); |
| 300 | if (!prevStatus) { |
| 301 | SplitTunneling::instance().updateState(); |
| 302 | } |
| 303 | spdlog::debug("firewallOn, AllowLocalTraffic={}", bAllowLanTraffic); |
| 304 | return std::string(); |
| 305 | } |
| 306 | |
| 307 | std::string firewallOff(const std::string &pars) |
| 308 | { |
no test coverage detected