Class: Nexpose::APIRequest

Inherits:
Object
  • Object
show all
Includes:
XMLUtils
Defined in:
lib/nexpose/api_request.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from XMLUtils

#make_xml, #parse_xml, success?

Constructor Details

#initialize(req, url, api_version = '1.1', trust_store = nil) ⇒ APIRequest

Returns a new instance of APIRequest.



22
23
24
25
26
27
28
29
 
# File 'lib/nexpose/api_request.rb', line 22

def initialize(req, url, api_version = '1.1', trust_store = nil)
  @url = url
  @req = req
  @api_version = api_version
  @url = @url.sub('API_VERSION', @api_version)
  @trust_store = trust_store
  prepare_http_client
end

Instance Attribute Details

#error ⇒ Object (readonly)

Returns the value of attribute error.



14
15
16
 
# File 'lib/nexpose/api_request.rb', line 14

def error
  @error
end

#headers ⇒ Object (readonly)

Returns the value of attribute headers.



7
8
9
 
# File 'lib/nexpose/api_request.rb', line 7

def headers
  @headers
end

#http ⇒ Object (readonly)

Returns the value of attribute http.



5
6
7
 
# File 'lib/nexpose/api_request.rb', line 5

def http
  @http
end

#raw_response ⇒ Object (readonly)

Returns the value of attribute raw_response.



17
18
19
 
# File 'lib/nexpose/api_request.rb', line 17

def raw_response
  @raw_response
end

#raw_response_data ⇒ Object (readonly)

Returns the value of attribute raw_response_data.



18
19
20
 
# File 'lib/nexpose/api_request.rb', line 18

def raw_response_data
  @raw_response_data
end

#req ⇒ Object (readonly)

Returns the value of attribute req.



9
10
11
 
# File 'lib/nexpose/api_request.rb', line 9

def req
  @req
end

#res ⇒ Object (readonly)

Returns the value of attribute res.



10
11
12
 
# File 'lib/nexpose/api_request.rb', line 10

def res
  @res
end

#sid ⇒ Object (readonly)

Returns the value of attribute sid.



11
12
13
 
# File 'lib/nexpose/api_request.rb', line 11

def sid
  @sid
end

#success ⇒ Object (readonly)

Returns the value of attribute success.



12
13
14
 
# File 'lib/nexpose/api_request.rb', line 12

def success
  @success
end

#trace ⇒ Object (readonly)

Returns the value of attribute trace.



15
16
17
 
# File 'lib/nexpose/api_request.rb', line 15

def trace
  @trace
end

#trust_store ⇒ Object (readonly)

Returns the value of attribute trust_store.



20
21
22
 
# File 'lib/nexpose/api_request.rb', line 20

def trust_store
  @trust_store
end

#uri ⇒ Object (readonly)

Returns the value of attribute uri.



6
7
8
 
# File 'lib/nexpose/api_request.rb', line 6

def uri
  @uri
end

Class Method Details

.execute(url, req, api_version = '1.1', options = {}, trust_store = nil) ⇒ Object

Raises:



143
144
145
146
147
148
 
# File 'lib/nexpose/api_request.rb', line 143

def self.execute(url, req, api_version = '1.1', options = {}, trust_store = nil)
  obj = self.new(req.to_s, url, api_version, trust_store)
  obj.execute(options)
  raise APIError.new(obj, "Action failed: #{obj.error}") unless obj.success
  obj
end

Instance Method Details

#attributes(*args) ⇒ Object 



138
139
140
141
 
# File 'lib/nexpose/api_request.rb', line 138

def attributes(*args)
  return if not @res.root
  @res.root.attributes(*args)
end

#execute(options = {}) ⇒ Object 



49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/nexpose/api_request.rb', line 49

def execute(options = {})
  @conn_tries = 0

  begin
    prepare_http_client
    @http.read_timeout = options[:timeout] if options.key? :timeout
    @raw_response = @http.post(@uri.path, @req, @headers)
    @raw_response_data = @raw_response.read_body

    # Allow the :raw keyword to bypass XML parsing.
    if options[:raw]
      if raw_response_data =~ /success="1"/
        @success = true
      else
        @success = false
        @error = "User requested raw XML response. Not parsing failures."
      end
    else
      @res = parse_xml(@raw_response_data)

      unless @res.root
        @error = 'Nexpose service returned invalid XML.'
        return @sid
      end

      @sid = attributes['session-id']

      if (attributes['success'] and attributes['success'].to_i == 1)
        @success = true
      elsif @api_version =~ /1.2/ and @res and (@res.get_elements '//Exception').count < 1
        @success = true
      else
        @success = false
        if @api_version =~ /1.2/
          @res.elements.each('//Exception/Message') do |message|
          @error = message.text.sub(/.*Exception: */, '')
          end
        @res.elements.each('//Exception/Stacktrace') do |stacktrace|
          @trace = stacktrace.text
        end
        else
          @res.elements.each('//message') do |message|
            @error = message.text.sub(/.*Exception: */, '')
          end
          @res.elements.each('//stacktrace') do |stacktrace|
            @trace = stacktrace.text
          end
        end
      end
    end
    # This is a hack to handle corner cases where a heavily loaded Nexpose instance
    # drops our HTTP connection before processing. We try 5 times to establish a
    # connection in these situations. The actual exception occurs in the Ruby
    # http library, which is why we use such generic error classes.
  rescue OpenSSL::SSL::SSLError => e
    if @conn_tries < 5
      @conn_tries += 1
      retry
    end
  rescue ::ArgumentError, ::NoMethodError => e
    if @conn_tries < 5
      @conn_tries += 1
      retry
    end
  rescue ::Timeout::Error
    if @conn_tries < 5
      @conn_tries += 1
      # If an explicit timeout is set, don't retry.
      retry unless options.key? :timeout
    end
    @error = "Nexpose did not respond within #{@http.read_timeout} seconds."
  rescue ::Errno::EHOSTUNREACH, ::Errno::ENETDOWN, ::Errno::ENETUNREACH, ::Errno::ENETRESET, ::Errno::EHOSTDOWN, ::Errno::EACCES, ::Errno::EINVAL, ::Errno::EADDRNOTAVAIL
    @error = 'Nexpose host is unreachable.'
    # Handle console-level interrupts
  rescue ::Interrupt
    @error = 'Received a user interrupt.'
  rescue ::Errno::ECONNRESET, ::Errno::ECONNREFUSED, ::Errno::ENOTCONN, ::Errno::ECONNABORTED
    @error = 'Nexpose service is not available.'
  rescue ::REXML::ParseException => exc
    @error = "Error parsing response: #{exc.message}"
  end

  if !(@success or @error)
    @error = "Nexpose service returned an unrecognized response: #{@raw_response_data.inspect}"
  end

  @sid
end

#prepare_http_client ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/nexpose/api_request.rb', line 31

def prepare_http_client
  @uri = URI.parse(@url)
  @http = Net::HTTP.new(@uri.host, @uri.port)
  @http.use_ssl = true
  #
  # XXX: This is obviously a security issue, however, we handle this at the client level by forcing
  #      a confirmation when the nexpose host is not localhost. In a perfect world, we would present
  #      the server signature before accepting it, but this requires either a direct callback inside
  #      of this module back to whatever UI, or opens a race condition between accept and attempt.
  if @trust_store.nil?
    @http.verify_mode = OpenSSL::SSL::VERIFY_NONE
  else
    @http.cert_store = @trust_store
  end
  @headers = {'Content-Type' => 'text/xml'}
  @success = false
end