use two-argument bless

[pve-apiclient.git] / PVE / APIClient / LWP.pm

diff --git a/PVE/APIClient/LWP.pm b/PVE/APIClient/LWP.pm
index 97fd64fba4f1497614d50882958bea522b3a06b5..e988033e573a68aab51b118058adc4caab75f0b1 100755 (executable)
--- a/PVE/APIClient/LWP.pm
+++ b/PVE/APIClient/LWP.pm
@@ -2,15 +2,16 @@ package PVE::APIClient::LWP;
 
 use strict;
 use warnings;
-use URI;
+
+use Carp;
+use HTTP::Request::Common;
 use IO::Socket::SSL; # important for SSL_verify_callback
+use JSON;
 use LWP::UserAgent;
-use URI::Escape;
 use Net::SSLeay;
-use JSON;
-use Data::Dumper; # fixme: remove
-use HTTP::Request::Common;
-use Carp;
+use URI::Escape;
+use URI;
+
 use PVE::APIClient::Exception qw(raise);
 
 my $extract_data = sub {
@@ -121,7 +122,7 @@ sub login {
     my $ua = $self->{useragent};
     my $username = $self->{username} // 'unknown',
 
-    delete $self->{last_unknown_fingerprint};
+    delete $self->{fingerprint}->{last_unknown};
 
     my $exec_login = sub {
        return $ua->post($uri, {
@@ -132,7 +133,7 @@ sub login {
     my $response = $exec_login->();
 
     if (!$response->is_success) {
-       if (my $fp = delete($self->{last_unknown_fingerprint})) {
+       if (my $fp = delete($self->{fingerprint}->{last_unknown})) {
            if ($self->manual_verify_fingerprint($fp)) {
                $response = $exec_login->(); # try again
            }
@@ -175,7 +176,7 @@ sub manual_verify_fingerprint {
 
     my $valid = ($answer =~ m/^\s*yes\s*$/i) ? 1 : 0;
 
-    $self->{cached_fingerprints}->{$fingerprint} = $valid;
+    $self->{fingerprint}->{cache}->{$fingerprint} = $valid;
 
     raise("Fingerprint not verified, abort!\n") if !$valid;
 
@@ -189,15 +190,16 @@ sub manual_verify_fingerprint {
 sub call {
     my ($self, $method, $path, $param) = @_;
 
-    delete $self->{last_unknown_fingerprint};
+    delete $self->{fingerprint}->{last_unknown};
 
     my $ticket = $self->{ticket};
+    my $apitoken = $self->{apitoken};
 
     my $ua = $self->{useragent};
 
     # fixme: check ticket lifetime?
 
-    if (!$ticket && $self->{username} && $self->{password}) {
+    if (!$ticket && !$apitoken && $self->{username} && $self->{password}) {
        $self->login();
     }
 
@@ -244,14 +246,12 @@ sub call {
 
     my $response = $exec_method->();
 
-    if (my $fp = delete($self->{last_unknown_fingerprint})) {
+    if (my $fp = delete($self->{fingerprint}->{last_unknown})) {
        if ($self->manual_verify_fingerprint($fp)) {
            $response = $exec_method->(); # try again
        }
     }
 
-    #print "RESP: " . Dumper($response) . "\n";
-
     my $ct = $response->header('Content-Type') || '';
 
     if ($response->is_success) {
@@ -274,24 +274,24 @@ sub call {
     }
 }
 
-my $verify_cert_callback = sub {
-    my ($self, $cert) = @_;
+my sub verify_cert_callback {
+    my ($fingerprint, $cert, $verify_cb) = @_;
 
     # check server certificate against cache of pinned FPs
     # get fingerprint of server certificate
     my $fp = Net::SSLeay::X509_get_fingerprint($cert, 'sha256');
     return 0 if !defined($fp) || $fp eq ''; # error
 
-    my $valid = $self->{cached_fingerprints}->{$fp};
+    my $valid = $fingerprint->{cache}->{$fp};
     return $valid if defined($valid); # return cached result
 
-    if (my $cb = $self->{verify_fingerprint_cb}) {
-       $valid = $cb->($cert);
-       $self->{cached_fingerprints}->{$fp} = $valid;
+    if ($verify_cb) {
+       $valid = $verify_cb->($cert);
+       $fingerprint->{cache}->{$fp} = $valid;
        return $valid;
     }
 
-    $self->{last_unknown_fingerprint} = $fp;
+    $fingerprint->{last_unknown} = $fp;
 
     return 0;
 };
@@ -310,23 +310,27 @@ sub new {
        protocol => $param{protocol},
        cookie_name => $param{cookie_name} // 'PVEAuthCookie',
        manual_verification => $param{manual_verification},
-       cached_fingerprints => $param{cached_fingerprints} || {},
-       verify_fingerprint_cb => $param{verify_fingerprint_cb},
+       fingerprint => {
+           cache => $param{cached_fingerprints} || {},
+           last_unknown => undef,
+       },
        register_fingerprint_cb => $param{register_fingerprint_cb},
-       ssl_opts => $ssl_opts,
        timeout => $param{timeout} || 60,
     };
-    bless $self;
+    bless $self, $class;
 
     if (!$ssl_opts->{SSL_verify_callback}) {
        $ssl_opts->{'SSL_verify_mode'} = SSL_VERIFY_PEER;
+
+       my $fingerprint = $self->{fingerprint}; # avoid passing $self, that's a RC cycle!
+       my $verify_fingerprint_cb = $param{verify_fingerprint_cb};
        $ssl_opts->{'SSL_verify_callback'} = sub {
            my (undef, undef, undef, undef, $cert, $depth) = @_;
 
            # we don't care about intermediate or root certificates
            return 1 if $depth != 0;
 
-           return $verify_cert_callback->($self, $cert);
+           return verify_cert_callback($fingerprint, $cert, $verify_fingerprint_cb);
        }
     }
 
@@ -346,9 +350,26 @@ sub new {
 
     $self->{useragent}->default_header('Accept-Encoding' => 'gzip'); # allow gzip
 
-    $self->update_ticket($param{ticket}) if $param{ticket};
+    if ($param{apitoken} && $param{password}) {
+       warn "password will be ignored in favor of API token\n";
+       delete $self->{password};
+    }
+    if ($param{ticket}) {
+       if ($param{apitoken}) {
+           warn "ticket will be ignored in favor of API token\n";
+       } else {
+           $self->update_ticket($param{ticket});
+       }
+    }
     $self->update_csrftoken($param{csrftoken}) if $param{csrftoken};
 
+    if ($param{apitoken}) {
+       my $agent = $self->{useragent};
+
+       $self->{apitoken} = $param{apitoken};
+
+       $agent->default_header('Authorization', $param{apitoken});
+    }
 
     return $self;
 }