JUNOS的官网上关于API的介绍，无论是GET还是POST，所举的例子都是get-xxx-information这样的operation，而没有添加/删除配置的知道。幸亏CTF群中大佬指点，终于操作成功，特记录如下。
准备
- vMX的管理接口的IP为192.168.122.102
- 假设已经添加了用户netops(密码Test123)，拥有相关权限
- 另外主机192.168.122.1可以和vMX直接通信
- 手动给lo0配置IP地址，并提交配置
[edit]
root@vMX-2# set interfaces lo0 unit 0 family inet address 2.2.2.2/32
[edit]
root@vMX-2# commit
commit complete
[edit]
root@vMX-2#
- 获取相关配置的xml rpc
root@vMX-2> show configuration interfaces lo0 | display xml
<rpc-reply xmlns:junos="http://xml.juniper.net/junos/18.2R2/junos">
<configuration junos:commit-seconds="1587546403" junos:commit-localtime="2020-04-22 09:06:43 UTC" junos:commit-user="root">
<interfaces>
<interface>
<name>lo0</name>
<unit>
<name>0</name>
<family>
<inet>
<address>
<name>2.2.2.2/32</name>
</address>
</inet>
</family>
</unit>
</interface>
</interfaces>
</configuration>
<cli>
<banner></banner>
</cli>
</rpc-reply>
root@vMX-2>
- 提取出<configuration></configuration>以及之间的部分,后续作为rpc的Request body
<load-configuration format="xml">
<configuration>
<interfaces>
<interface>
<name>lo0</name>
<unit>
<name>0</name>
<family>
<inet>
<address>
<name>2.2.2.2/32</name>
</address>
</inet>
</family>
</unit>
</interface>
</interfaces>
</configuration>
</load-configuration>
- 将l0的IP地址删除掉并提交
[edit]
root@vMX-2# delete interfaces lo0 unit 0 family inet address 2.2.2.2/32
[edit]
root@vMX-2# commit
commit complete
- 使能JUNOS API Explorer(http)
set system services rest http addresses 192.168.122.102
set system services rest control allowed-sources 192.168.122.1
set system services rest enable-explorer
通过REST API下发配置
- 在192.168.122.1打开下面的网址 http://192.168.122.102:3000/
- HTTP Method设置为POST
- Input data type设置为xml
- username/password:netops/Test123
- Request body填入之前提取的config内容
- 点击submit
- 查看web上的结果
- Request Header
- cURL request(可以直接复制后在Linux bash上执行)
-
右侧的Response Headers和Response body(没有报错)
- 检查vMX上的配置
[edit]
root@vMX-2# show | display set | match lo0
set interfaces lo0 unit 0 family inet address 2.2.2.2/32
[edit]
root@vMX-2#
[edit]
root@vMX-2# show | compare rollback 2
[edit interfaces lo0 unit 0 family inet]
+ address 2.2.2.2/32;
[edit]
root@vMX-2#
- 至此通过REST API添加配置成功
通过REST API下发删除配置
- 对Explorer中的Requst body进行一点修改
- <address>
+ <address delete=" delete">
-
重新点击submit
- 查看vMX上的配置
[edit]
root@vMX-2# show | display set | match lo0
set interfaces lo0 unit 0 family inet
root@vMX-2# show | compare rollback 1
[edit interfaces lo0 unit 0 family inet]
- address 2.2.2.2/32;
- 注意，这里只是删除了l0的IP地址，并没有删除这个接口
- 怎么能没有python-request的实现脚本呢
# cat post_demo.py
import requests
from requests.auth import HTTPBasicAuth
import json
class juniperRestApi:
def __init__(self, devip, devport, user, password):
self.devip = devip
self.devport = devport
self.user = user
self.password = password
def getRestapi(self, rpc):
headers = { 'Accept' : 'application/json' }
url = "http://{}:{}/rpc/{}".format(self.devip, self.devport, rpc)
r = requests.get(url, headers=headers, auth=(self.user, self.password))
jsonresult = json.loads(r.text)
return jsonresult
def configRestapi(self, configlet):
headers = { 'content-type' : 'application/xml' }
url = "http://{}:{}/rpc".format(self.devip, self.devport)
q = requests.post(url, headers=headers, auth=(self.user, self.password), data=configlet)
return q.status_code
client = juniperRestApi('192.168.122.102', '3000', 'netops', 'Test123')
rpc = \
"""
<load-configuration format="xml">
<configuration>
<interfaces>
<interface>
<name>lo0</name>
<unit>
<name>0</name>
<family>
<inet>
<address>
<name>2.2.2.2/32</name>
</address>
</inet>
</family>
</unit>
</interface>
</interfaces>
</configuration>
</load-configuration>
"""
print(client.configRestapi(rpc))
修改配置
- 对于hostname这样唯一性的值，重新POST赋值就是修改配置
- 其它情况可以分解成：删除/添加，这两步执行
其它
- JUNOS真的是太强了
- 各种形式的输出
# Plain Text
root@vMX-2> show arp
MAC Address Address Name Interface Flags
52:54:00:4c:cc:57 192.168.122.1 192.168.122.1 vtnet2.0 none
00:50:00:00:04:00 192.168.122.177 192.168.122.177 vtnet2.0 none
Total entries: 2
root@vMX-2>
#XML格式
root@vMX-2> show arp | display xml
<rpc-reply xmlns:junos="http://xml.juniper.net/junos/18.2R2/junos">
<arp-table-information xmlns="http://xml.juniper.net/junos/18.2R2/junos-arp" junos:style="normal">
<arp-table-entry>
<mac-address>52:54:00:4c:cc:57</mac-address>
<ip-address>192.168.122.1</ip-address>
<hostname>192.168.122.1</hostname>
<interface-name>vtnet2.0</interface-name>
<arp-table-entry-flags>
<none/>
</arp-table-entry-flags>
</arp-table-entry>
<arp-table-entry>
<mac-address>00:50:00:00:04:00</mac-address>
<ip-address>192.168.122.177</ip-address>
<hostname>192.168.122.177</hostname>
<interface-name>vtnet2.0</interface-name>
<arp-table-entry-flags>
<none/>
</arp-table-entry-flags>
</arp-table-entry>
<arp-entry-count>2</arp-entry-count>
</arp-table-information>
<cli>
<banner></banner>
</cli>
</rpc-reply>
# JSON
root@vMX-2> show arp | display json
{
"arp-table-information" : [
{
"attributes" : {"xmlns" : "http://xml.juniper.net/junos/18.2R2/junos-arp",
"junos:style" : "normal"
},
"arp-table-entry" : [
{
"mac-address" : [
{
"data" : "52:54:00:4c:cc:57"
}
],
"ip-address" : [
{
"data" : "192.168.122.1"
}
],
"hostname" : [
{
"data" : "192.168.122.1"
}
],
"interface-name" : [
{
"data" : "vtnet2.0"
}
],
"arp-table-entry-flags" : [
{
"none" : [
{
"data" : [null]
}
]
}
]
},
{
"mac-address" : [
{
"data" : "00:50:00:00:04:00"
}
],
"ip-address" : [
{
"data" : "192.168.122.177"
}
],
"hostname" : [
{
"data" : "192.168.122.177"
}
],
"interface-name" : [
{
"data" : "vtnet2.0"
}
],
"arp-table-entry-flags" : [
{
"none" : [
{
"data" : [null]
}
]
}
]
}
],
"arp-entry-count" : [
{
"data" : "2"
}
]
}
]
}
- 轻松输出rpc body
root@vMX-2> show version | display xml rpc
<rpc-reply xmlns:junos="http://xml.juniper.net/junos/18.2R2/junos">
<rpc>
<get-software-information>
</get-software-information>
</rpc>
<cli>
<banner></banner>
</cli>
</rpc-reply>
root@vMX-2>
-
Explorer方便输出cURL命令
