]>
Commit | Line | Data |
---|---|---|
57f93db1 DM |
1 | package PVE::HTTPServer; |
2 | ||
3 | use strict; | |
4 | use warnings; | |
d06a1c62 | 5 | |
b996e6c0 DM |
6 | use PVE::SafeSyslog; |
7 | use PVE::INotify; | |
8 | use PVE::Tools; | |
9 | use PVE::APIServer::AnyEvent; | |
46095dd4 | 10 | use PVE::Exception qw(raise_param_exc raise); |
c2e9823c | 11 | |
b996e6c0 DM |
12 | use PVE::RPCEnvironment; |
13 | use PVE::AccessControl; | |
14 | use PVE::Cluster; | |
3c54bc91 | 15 | use PVE::API2Tools; |
c2e9823c | 16 | |
b996e6c0 | 17 | use Data::Dumper; |
57f93db1 | 18 | |
b996e6c0 | 19 | use base('PVE::APIServer::AnyEvent'); |
353fef24 | 20 | |
b996e6c0 | 21 | use HTTP::Status qw(:constants); |
353fef24 | 22 | |
57f93db1 DM |
23 | sub new { |
24 | my ($this, %args) = @_; | |
25 | ||
26 | my $class = ref($this) || $this; | |
27 | ||
b996e6c0 DM |
28 | my $self = $class->SUPER::new(%args); |
29 | ||
f91072d5 | 30 | $self->{rpcenv} = PVE::RPCEnvironment->init( |
353fef24 | 31 | $self->{trusted_env} ? 'priv' : 'pub', atfork => sub { $self-> atfork_handler() }); |
f91072d5 | 32 | |
b996e6c0 DM |
33 | return $self; |
34 | } | |
02667982 | 35 | |
b996e6c0 DM |
36 | sub verify_spice_connect_url { |
37 | my ($self, $connect_str) = @_; | |
57f93db1 | 38 | |
9d3f059f DM |
39 | my $rpcenv = $self->{rpcenv}; |
40 | ||
41 | $rpcenv->init_request(); | |
42 | ||
b996e6c0 | 43 | my ($vmid, $node, $port) = PVE::AccessControl::verify_spice_connect_url($connect_str); |
57f93db1 | 44 | |
b996e6c0 DM |
45 | return ($vmid, $node, $port); |
46 | } | |
57f93db1 | 47 | |
b996e6c0 DM |
48 | sub generate_csrf_prevention_token { |
49 | my ($username) = @_; | |
f91072d5 | 50 | |
b996e6c0 | 51 | return PVE::AccessControl::assemble_csrf_prevention_token($username); |
57f93db1 DM |
52 | } |
53 | ||
430b554f | 54 | sub auth_handler { |
9d3f059f | 55 | my ($self, $method, $rel_uri, $ticket, $token, $peer_host) = @_; |
430b554f DM |
56 | |
57 | my $rpcenv = $self->{rpcenv}; | |
58 | ||
9d3f059f DM |
59 | # set environment variables |
60 | $rpcenv->set_user(undef); | |
61 | $rpcenv->set_language('C'); | |
62 | $rpcenv->set_client_ip($peer_host); | |
63 | ||
46095dd4 TL |
64 | eval { $rpcenv->init_request() }; |
65 | raise("RPCEnvironment init request failed: $@\n") if $@; | |
a2e669fe | 66 | |
430b554f DM |
67 | my $require_auth = 1; |
68 | ||
69 | # explicitly allow some calls without auth | |
70 | if (($rel_uri eq '/access/domains' && $method eq 'GET') || | |
71 | ($rel_uri eq '/access/ticket' && ($method eq 'GET' || $method eq 'POST'))) { | |
72 | $require_auth = 0; | |
73 | } | |
74 | ||
75 | my ($username, $age); | |
76 | ||
77 | my $isUpload = 0; | |
78 | ||
79 | if ($require_auth) { | |
80 | ||
81 | die "No ticket\n" if !$ticket; | |
82 | ||
83 | ($username, $age) = PVE::AccessControl::verify_ticket($ticket); | |
84 | ||
85 | $rpcenv->set_user($username); | |
86 | ||
87 | if ($method eq 'POST' && $rel_uri =~ m|^/nodes/([^/]+)/storage/([^/]+)/upload$|) { | |
88 | my ($node, $storeid) = ($1, $2); | |
89 | # we disable CSRF checks if $isUpload is set, | |
90 | # to improve security we check user upload permission here | |
91 | my $perm = { check => ['perm', "/storage/$storeid", ['Datastore.AllocateTemplate']] }; | |
92 | $rpcenv->check_api2_permissions($perm, $username, {}); | |
93 | $isUpload = 1; | |
94 | } | |
95 | ||
96 | # we skip CSRF check for file upload, because it is | |
97 | # difficult to pass CSRF HTTP headers with native html forms, | |
98 | # and it should not be necessary at all. | |
99 | my $euid = $>; | |
100 | PVE::AccessControl::verify_csrf_prevention_token($username, $token) | |
101 | if !$isUpload && ($euid != 0) && ($method ne 'GET'); | |
102 | } | |
103 | ||
104 | return { | |
105 | ticket => $ticket, | |
106 | token => $token, | |
107 | userid => $username, | |
108 | age => $age, | |
109 | isUpload => $isUpload, | |
110 | }; | |
111 | } | |
112 | ||
2261f249 DM |
113 | sub rest_handler { |
114 | my ($self, $clientip, $method, $rel_uri, $auth, $params) = @_; | |
115 | ||
116 | my $rpcenv = $self->{rpcenv}; | |
117 | ||
70473e51 DM |
118 | my $resp = { |
119 | status => HTTP_NOT_IMPLEMENTED, | |
120 | message => "Method '$method $rel_uri' not implemented", | |
121 | }; | |
122 | ||
123 | my ($handler, $info); | |
124 | ||
125 | eval { | |
126 | my $uri_param = {}; | |
127 | ($handler, $info) = PVE::API2->find_handler($method, $rel_uri, $uri_param); | |
128 | return if !$handler || !$info; | |
2261f249 | 129 | |
70473e51 DM |
130 | foreach my $p (keys %{$params}) { |
131 | if (defined($uri_param->{$p})) { | |
132 | raise_param_exc({$p => "duplicate parameter (already defined in URI)"}); | |
133 | } | |
134 | $uri_param->{$p} = $params->{$p}; | |
2261f249 | 135 | } |
2261f249 | 136 | |
70473e51 DM |
137 | # check access permissions |
138 | $rpcenv->check_api2_permissions($info->{permissions}, $auth->{userid}, $uri_param); | |
2261f249 | 139 | |
3c54bc91 DM |
140 | if ($info->{proxyto} || $info->{proxyto_callback}) { |
141 | my $node = PVE::API2Tools::resolve_proxyto( | |
142 | $rpcenv, $info->{proxyto_callback}, $info->{proxyto}, $uri_param); | |
2261f249 DM |
143 | |
144 | if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) { | |
145 | die "unable to proxy file uploads" if $auth->{isUpload}; | |
70473e51 DM |
146 | my $remip = $self->remote_node_ip($node); |
147 | $resp = { proxy => $remip, proxynode => $node, proxy_params => $params }; | |
148 | return; | |
2261f249 | 149 | } |
2261f249 | 150 | } |
2261f249 | 151 | |
70473e51 DM |
152 | my $euid = $>; |
153 | if ($info->{protected} && ($euid != 0)) { | |
154 | $resp = { proxy => 'localhost' , proxy_params => $params }; | |
155 | return; | |
156 | } | |
2261f249 | 157 | |
70473e51 DM |
158 | $resp = { |
159 | data => $handler->handle($info, $uri_param), | |
160 | info => $info, # useful to format output | |
161 | status => HTTP_OK, | |
162 | }; | |
2261f249 DM |
163 | |
164 | if (my $count = $rpcenv->get_result_attrib('total')) { | |
165 | $resp->{total} = $count; | |
166 | } | |
70473e51 | 167 | |
2261f249 DM |
168 | if (my $diff = $rpcenv->get_result_attrib('changes')) { |
169 | $resp->{changes} = $diff; | |
170 | } | |
171 | }; | |
70473e51 | 172 | my $err = $@; |
2261f249 | 173 | |
9d3f059f | 174 | $rpcenv->set_user(undef); # clear after request |
70473e51 DM |
175 | |
176 | if ($err) { | |
177 | $resp = { info => $info }; | |
178 | if (ref($err) eq "PVE::Exception") { | |
179 | $resp->{status} = $err->{code} || HTTP_INTERNAL_SERVER_ERROR; | |
180 | $resp->{errors} = $err->{errors} if $err->{errors}; | |
181 | $resp->{message} = $err->{msg}; | |
182 | } else { | |
183 | $resp->{status} = HTTP_INTERNAL_SERVER_ERROR; | |
184 | $resp->{message} = $err; | |
185 | } | |
186 | } | |
187 | ||
2261f249 DM |
188 | return $resp; |
189 | } | |
430b554f | 190 | |
7e5f7c61 DM |
191 | sub check_cert_fingerprint { |
192 | my ($self, $cert) = @_; | |
193 | ||
194 | return PVE::Cluster::check_cert_fingerprint($cert); | |
195 | } | |
196 | ||
197 | sub initialize_cert_cache { | |
198 | my ($self, $node) = @_; | |
199 | ||
200 | PVE::Cluster::initialize_cert_cache($node); | |
201 | } | |
202 | ||
203 | sub remote_node_ip { | |
204 | my ($self, $node) = @_; | |
205 | ||
206 | my $remip = PVE::Cluster::remote_node_ip($node); | |
207 | ||
208 | die "unable to get remote IP address for node '$node'\n" if !$remip; | |
209 | ||
210 | return $remip; | |
211 | } | |
212 | ||
57f93db1 | 213 | 1; |