From 43a8efd125cdecbc6284f1d3021b6f69afe4119b Mon Sep 17 00:00:00 2001
From: Kevin Adams <kevin.adams@ksatechnologies.com>
Date: Fri, 15 May 2026 22:51:32 -0400
Subject: [PATCH] Fix TrueNAS 25.04 compatibility: handle 404 on v1.0 API
 endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TrueNAS 25.04 removed the v1.0 REST API entirely. Previously it redirected
(302) to v2.0; now it returns 404. The plugin treated 404 as a fatal
connection failure, preventing any operation on 25.04 hosts.

Fix: extend the v1.0→v2.0 upgrade condition in freenas_api_connect to also
trigger on HTTP 404, but only while probing the v1.0 endpoint (guarded by
`$apiping =~ /v1\.0/`). A 404 on the v2.0 endpoint still fails cleanly.

Also add a syslog warn when Bearer Token auth is attempted over plain HTTP:
TrueNAS 25.04+ revokes API keys sent without SSL, causing auth failures that
are otherwise invisible in the plugin log. The warning points admins to the
"Use SSL" storage config option.

Closes #205

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 perl5/PVE/Storage/LunCmd/FreeNAS.pm | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/perl5/PVE/Storage/LunCmd/FreeNAS.pm b/perl5/PVE/Storage/LunCmd/FreeNAS.pm
index 7c34bef..6548afa 100644
--- a/perl5/PVE/Storage/LunCmd/FreeNAS.pm
+++ b/perl5/PVE/Storage/LunCmd/FreeNAS.pm
@@ -346,6 +346,9 @@ sub freenas_api_connect {
     $freenas_server_list->{$apihost}->addHeader('Content-Type', 'application/json');
     if (defined($scfg->{'truenas_token_auth'}) && $scfg->{'truenas_token_auth'}) {
         syslog("info", (caller(0))[3] . " : Authentication using Bearer Token Auth");
+        if (!$scfg->{freenas_use_ssl}) {
+            syslog("warn", (caller(0))[3] . " : Bearer Token used without SSL — TrueNAS 25.04+ revokes API keys sent over plain HTTP; enable 'Use SSL' in storage config");
+        }
         $freenas_server_list->{$apihost}->addHeader('Authorization', 'Bearer ' . $scfg->{truenas_secret});
     } else {
         syslog("info", (caller(0))[3] . " : Authentication using Basic Auth");
@@ -370,10 +373,11 @@ sub freenas_api_connect {
     } elsif ($code == 200 && ($type =~ /^text\/plain/ || $type =~ /^application\/json/)) {
         syslog("info", (caller(0))[3] . " : REST connection successful to '" . $apihost . "' using the '" . $scheme . "' protocol");
         $runawayprevent = 0;
-    # A 302 or 200 (We already check for the correct 'type' above with a 200 so why add additional conditionals).
-    # So change to v2.0 APIs.
-    } elsif ($code == 302 || $code == 200) {
-        syslog("info", (caller(0))[3] . " : Changing to v2.0 API's");
+    # A 302 or 200 (wrong content-type) means v1.0 is redirecting — upgrade to v2.0.
+    # TrueNAS 25.04+ removed v1.0 entirely and returns 404 instead of 302; treat
+    # that the same way so long as we are still probing the v1.0 endpoint.
+    } elsif ($code == 302 || $code == 200 || ($code == 404 && $apiping =~ /v1\.0/)) {
+        syslog("info", (caller(0))[3] . " : v1.0 API unavailable (HTTP $code) — upgrading to v2.0");
         $runawayprevent++;
         $apiping =~ s/v1\.0/v2\.0/;
         freenas_api_connect($scfg);