Factors out the user-agent building into a separate function and then
re-uses that for get().
This has the side-effect that now for all requests issued by post() a
timeout of 60s is applied. Previously, this was only done when an
explicit fingerprint was given. Minute change and shouldn't effect
anything.
Signed-off-by: Christoph Heiss <c.he...@proxmox.com>
---
proxmox-installer-common/src/http.rs | 71 +++++++++++++++++++---------
1 file changed, 48 insertions(+), 23 deletions(-)
diff --git a/proxmox-installer-common/src/http.rs
b/proxmox-installer-common/src/http.rs
index b754ed8..f4afe14 100644
--- a/proxmox-installer-common/src/http.rs
+++ b/proxmox-installer-common/src/http.rs
@@ -4,33 +4,25 @@ use sha2::{Digest, Sha256};
use std::sync::Arc;
use ureq::{Agent, AgentBuilder};
-/// Issues a POST request with the payload (JSON). Optionally a SHA256
fingerprint can be used to
-/// check the cert against it, instead of the regular cert validation.
+/// Builds an [`Agent`] with TLS suitable set up, depending whether a custom
fingerprint was
+/// supplied or not. If a fingerprint was supplied, only matching certificates
will be accepted.
+/// Otherwise, the system certificate store is loaded.
+///
/// To gather the sha256 fingerprint you can use the following command:
/// ```no_compile
/// openssl s_client -connect <host>:443 < /dev/null 2>/dev/null | openssl
x509 -fingerprint -sha256 -noout -in /dev/stdin
/// ```
///
/// # Arguments
-/// * `url` - URL to call
/// * `fingerprint` - SHA256 cert fingerprint if certificate pinning should be
used. Optional.
-/// * `payload` - The payload to send to the server. Expected to be a JSON
formatted string.
-pub fn post(url: &str, fingerprint: Option<&str>, payload: String) ->
Result<String> {
- let answer;
-
+fn build_agent(fingerprint: Option<&str>) -> Result<Agent> {
if let Some(fingerprint) = fingerprint {
let tls_config = ClientConfig::builder()
.with_safe_defaults()
.with_custom_certificate_verifier(VerifyCertFingerprint::new(fingerprint)?)
.with_no_client_auth();
- let agent: Agent =
AgentBuilder::new().tls_config(Arc::new(tls_config)).build();
-
- answer = agent
- .post(url)
- .set("Content-Type", "application/json; charset=utf-8")
- .send_string(&payload)?
- .into_string()?;
+ Ok(AgentBuilder::new().tls_config(Arc::new(tls_config)).build())
} else {
let mut roots = rustls::RootCertStore::empty();
for cert in rustls_native_certs::load_native_certs()? {
@@ -42,18 +34,51 @@ pub fn post(url: &str, fingerprint: Option<&str>, payload:
String) -> Result<Str
.with_root_certificates(roots)
.with_no_client_auth();
- let agent = AgentBuilder::new()
+ Ok(AgentBuilder::new()
.tls_connector(Arc::new(native_tls::TlsConnector::new()?))
.tls_config(Arc::new(tls_config))
- .build();
- answer = agent
- .post(url)
- .set("Content-Type", "application/json; charset=utf-8")
- .timeout(std::time::Duration::from_secs(60))
- .send_string(&payload)?
- .into_string()?;
+ .build())
}
- Ok(answer)
+}
+
+/// Issues a GET request to the specified URL and fetches the response.
Optionally a SHA256
+/// fingerprint can be used to check the certificate against it, instead of
the regular certificate
+/// validation.
+///
+/// To gather the sha256 fingerprint you can use the following command:
+/// ```no_compile
+/// openssl s_client -connect <host>:443 < /dev/null 2>/dev/null | openssl
x509 -fingerprint -sha256 -noout -in /dev/stdin
+/// ```
+///
+/// # Arguments
+/// * `url` - URL to fetch
+/// * `fingerprint` - SHA256 cert fingerprint if certificate pinning should be
used. Optional.
+pub fn get(url: &str, fingerprint: Option<&str>) -> Result<String> {
+ Ok(build_agent(fingerprint)?
+ .get(url)
+ .timeout(std::time::Duration::from_secs(60))
+ .call()?
+ .into_string()?)
+}
+
+/// Issues a POST request with the payload (JSON). Optionally a SHA256
fingerprint can be used to
+/// check the cert against it, instead of the regular cert validation.
+/// To gather the sha256 fingerprint you can use the following command:
+/// ```no_compile
+/// openssl s_client -connect <host>:443 < /dev/null 2>/dev/null | openssl
x509 -fingerprint -sha256 -noout -in /dev/stdin
+/// ```
+///
+/// # Arguments
+/// * `url` - URL to call
+/// * `fingerprint` - SHA256 cert fingerprint if certificate pinning should be
used. Optional.
+/// * `payload` - The payload to send to the server. Expected to be a JSON
formatted string.
+pub fn post(url: &str, fingerprint: Option<&str>, payload: String) ->
Result<String> {
+ Ok(build_agent(fingerprint)?
+ .post(url)
+ .set("Content-Type", "application/json; charset=utf-8")
+ .timeout(std::time::Duration::from_secs(60))
+ .send_string(&payload)?
+ .into_string()?)
}
struct VerifyCertFingerprint {
--
2.47.0
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
