raise exception if manual fingerprint verification failed

[pve-apiclient.git] / PVE / APIClient / LWP.pm

diff --git a/PVE/APIClient/LWP.pm b/PVE/APIClient/LWP.pm
index 51112e25a22acea8228aaed9d1fb4423fc852816..20e3b56621dee188ed4cd129b2b96f31deb8ef5a 100755 (executable)
--- a/PVE/APIClient/LWP.pm
+++ b/PVE/APIClient/LWP.pm
@@ -11,6 +11,7 @@ use JSON;
 use Data::Dumper; # fixme: remove
 use HTTP::Request::Common;
 use Carp;
+use PVE::APIClient::Exception qw(raise);
 
 my $extract_data = sub {
     my ($res) = @_;
@@ -87,7 +88,7 @@ sub update_ticket {
     $self->{ticket} = $ticket;
 
     my $encticket = uri_escape($ticket);
-    my $cookie = "PVEAuthCookie=$encticket; path=/; secure;";
+    my $cookie = "$self->{cookie_name}=$encticket; path=/; secure;";
     $agent->default_header('Cookie', $cookie);
 }
 
@@ -121,7 +122,7 @@ sub login {
     }
 
     if (!$response->is_success) {
-       die $response->status_line . "\n";
+       raise($response->status_line ."\n", code => $response->code)
     }
 
     my $res = from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
@@ -138,8 +139,7 @@ sub manual_verify_fingerprint {
     my ($self, $fingerprint) = @_;
 
     if (!$self->{manual_verification}) {
-       warn "fingerprint: $fingerprint\n";
-       return 0;
+       raise("fingerprint '$fingerprint' not verified, abort!\n");
     }
 
     print "The authenticity of host '$self->{host}' can't be established.\n" .
@@ -152,6 +152,8 @@ sub manual_verify_fingerprint {
 
     $self->{cached_fingerprints}->{$fingerprint} = $valid;
 
+    raise("Fingerprint not verified, abort!\n") if !$valid;
+
     if (my $cb = $self->{register_fingerprint_cb}) {
        $cb->($fingerprint) if $valid;
     }
@@ -210,7 +212,7 @@ sub call {
        } elsif ($method eq 'DELETE') {
            $response = $ua->request(HTTP::Request::Common::DELETE($uri));
        } else {
-           die "method $method not implemented\n";
+           raise("method $method not implemented\n");
        }
        return $response;
     };
@@ -229,27 +231,21 @@ sub call {
 
     if ($response->is_success) {
 
-       die "got unexpected content type" if $ct !~ m|application/json|;
+       raise("got unexpected content type", code => $response->code)
+           if $ct !~ m|application/json|;
 
        return from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
 
     } else {
 
-       my $msg = $response->status_line . "\n";
-       eval {
+       my $msg = $response->message;
+       my $errors = eval {
            return if $ct !~ m|application/json|;
            my $res = from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
-           if (my $errors = $res->{errors}) {
-               foreach my $key (keys %$errors) {
-                   my $m = $errors->{$key};
-                   chomp($m);
-                   $m =~s/\n/ -- /g;
-                   $msg .= " $key: $m\n";
-               }
-           }
+           return $res->{errors};
        };
-       die $msg;
 
+       raise("$msg\n", code => $response->code, errors => $errors);
     }
 }
 
@@ -258,11 +254,8 @@ my $verify_cert_callback = sub {
 
     # check server certificate against cache of pinned FPs
     # get fingerprint of server certificate
-    my $fp;
-    eval {
-       $fp = Net::SSLeay::X509_get_fingerprint($cert, 'sha256');
-    };
-    return 0 if $@ || !defined($fp) || $fp eq ''; # error
+    my $fp = Net::SSLeay::X509_get_fingerprint($cert, 'sha256');
+    return 0 if !defined($fp) || $fp eq ''; # error
 
     my $valid = $self->{cached_fingerprints}->{$fp};
     return $valid if defined($valid); # return cached result
@@ -290,6 +283,7 @@ sub new {
        host => $param{host} || 'localhost',
        port => $param{port},
        protocol => $param{protocol},
+       cookie_name => $param{cookie_name} // 'PVEAuthCookie',
        manual_verification => $param{manual_verification},
        cached_fingerprints => $param{cached_fingerprints} || {},
        verify_fingerprint_cb => $param{verify_fingerprint_cb},