section config: use croak so that the error is from the callers POV

[pve-common.git] / src / PVE / ACME.pm

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index 0c7aa23dad05d421ac8dd45398e25cc3ab728e74..114eb41ca8ef00de4e0389887761b3557c8a4438 100644 (file)
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -152,7 +152,9 @@ sub load {
     my ($self) = @_;
     return if $self->{loaded};
     $self->{loaded} = 1;
-    my $data = fromjs(file_get_contents($self->{path}));
+    my $raw = file_get_contents($self->{path});
+    if ($raw =~ m/^(.*)$/s) { $raw = $1; }  # untaint
+    my $data = fromjs($raw);
     $self->{$_} = $data->{$_} for @SAVED_VALUES;
     if (defined(my $keystr = $data->{key})) {
        my $key = Crypt::OpenSSL::RSA->new_private_key($keystr);
@@ -200,7 +202,7 @@ sub jws {
     my $key = $self->{key}
        or die "No key was generated yet\n";
 
-    my $payload = encode(tojs($data));
+    my $payload = $data ne '' ? encode(tojs($data)) : $data;
 
     if (!defined($self->{nonce})) {
        my $method = $self->_method('newNonce');
@@ -242,7 +244,7 @@ sub jws {
 sub __get_result {
     my ($resp, $code, $plain) = @_;
 
-    die "expected code '$code', received '".$resp->code."'"
+    die "expected code '$code', received '".$resp->code."'\n"
        if $resp->code != $code;
 
     return $plain ? $resp->decoded_content : fromjs($resp->decoded_content);
@@ -370,7 +372,7 @@ sub new_order {
     my ($order_url, $order);
     eval {
        $order_url = $r->header('Location')
-           or die "did not receive an order URL";
+           or die "did not receive an order URL\n";
        $order = __get_result($r, 201)
     };
     $self->fatal("POST to '$url' failed - $@", $r) if $@;
@@ -394,27 +396,27 @@ sub finalize_order {
 }
 
 # Get order status
-# GET to order URL
+# GET-as-POST to order URL
 # Expects a '200 OK' reply
 # returns order object
 sub get_order {
     my ($self, $order_url) = @_;
-    my $r = $self->do(GET => $order_url);
+    my $r = $self->do(POST => $order_url, '');
     my $return = eval { __get_result($r, 200); };
-    $self->fatal("GET of '$order_url' failed - $@", $r) if $@;
+    $self->fatal("POST of '$order_url' failed - $@", $r) if $@;
     return $return;
 }
 
 # Gets authorization object
-# GET to authorization URL
+# GET-as-POST to authorization URL
 # Expects a '200 OK' reply
 # returns authorization object, including challenges array
 sub get_authorization {
     my ($self, $auth_url) = @_;
 
-    my $r = $self->do(GET => $auth_url);
+    my $r = $self->do(POST => $auth_url, '');
     my $return = eval { __get_result($r, 200); };
-    $self->fatal("GET of '$auth_url' failed - $@", $r) if $@;
+    $self->fatal("POST of '$auth_url' failed - $@", $r) if $@;
     return $return;
 }
 
@@ -435,7 +437,7 @@ sub deactivate_authorization {
 }
 
 # Get certificate
-# GET to order's certificate URL
+# GET-as-POST to order's certificate URL
 # Expects a '200 OK' reply
 # returns certificate chain in PEM format
 sub get_certificate {
@@ -444,9 +446,9 @@ sub get_certificate {
     $self->fatal("no certificate URL available (yet?)", $order)
        if !$order->{certificate};
 
-    my $r = $self->do(GET => $order->{certificate});
+    my $r = $self->do(POST => $order->{certificate}, '');
     my $return = eval { __get_result($r, 200, 1); };
-    $self->fatal("GET of '$order->{certificate}' failed - $@", $r) if $@;
+    $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
     return $return;
 }
 
@@ -471,7 +473,7 @@ sub revoke_certificate {
     # TODO: set use_jwk if revoking with certificate key
     my $r = $self->do(POST => $url, $req);
     eval {
-       die "unexpected code $r->code" if $r->code != 200;
+       die "unexpected code $r->code\n" if $r->code != 200;
     };
     $self->fatal("POST to '$url' failed - $@", $r) if $@;
 }
@@ -501,7 +503,7 @@ sub do {
 
     my $headers = HTTP::Headers->new();
     $headers->header('Content-Type' => 'application/jose+json');
-    my $content = $self->jws($use_jwk, $data, $url) if defined($data);
+    my $content = defined($data) ? $self->jws($use_jwk, $data, $url) : undef;
     my $request;
     if (defined($content)) {
        $content = tojs($content);
@@ -515,7 +517,7 @@ sub do {
        if ($res->code == 400 && $res->decoded_content) {
            my $parsed_content = fromjs($res->decoded_content);
            if ($parsed_content->{type} eq 'urn:ietf:params:acme:error:badNonce') {
-               warn("bad Nonce, retrying");
+               warn("bad Nonce, retrying\n");
                $self->{nonce} = $res->header('Replay-Nonce');
                return $self->do($method, $url, $data, $use_jwk);
            }