public_git
/
freenas-proxmox
mirror of https://github.com/TheGrandWazoo/freenas-proxmox.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix TrueNAS 25.04 compatibility: handle 404 on v1.0 API endpoint 

TrueNAS 25.04 removed the v1.0 REST API entirely. Previously it redirected
(302) to v2.0; now it returns 404. The plugin treated 404 as a fatal
connection failure, preventing any operation on 25.04 hosts.

Fix: extend the v1.0→v2.0 upgrade condition in freenas_api_connect to also
trigger on HTTP 404, but only while probing the v1.0 endpoint (guarded by
`$apiping =~ /v1\.0/`). A 404 on the v2.0 endpoint still fails cleanly.

Also add a syslog warn when Bearer Token auth is attempted over plain HTTP:
TrueNAS 25.04+ revokes API keys sent without SSL, causing auth failures that
are otherwise invisible in the plugin log. The warning points admins to the
"Use SSL" storage config option.

Closes #205

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Kevin Adams 2026-05-15 22:51:32 -04:00
parent 13217640ab
commit 43a8efd125
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
perl5/PVE/Storage/LunCmd/FreeNAS.pm
View File

@ -346,6 +346,9 @@ sub freenas_api_connect {
$freenas_server_list->{$apihost}->addHeader('Content-Type', 'application/json'); $freenas_server_list->{$apihost}->addHeader('Content-Type', 'application/json');
if (defined($scfg->{'truenas_token_auth'}) && $scfg->{'truenas_token_auth'}) { if (defined($scfg->{'truenas_token_auth'}) && $scfg->{'truenas_token_auth'}) {
syslog("info", (caller(0))[3] . " : Authentication using Bearer Token Auth"); syslog("info", (caller(0))[3] . " : Authentication using Bearer Token Auth");
if (!$scfg->{freenas_use_ssl}) {
syslog("warn", (caller(0))[3] . " : Bearer Token used without SSL — TrueNAS 25.04+ revokes API keys sent over plain HTTP; enable 'Use SSL' in storage config");
}
$freenas_server_list->{$apihost}->addHeader('Authorization', 'Bearer ' . $scfg->{truenas_secret}); $freenas_server_list->{$apihost}->addHeader('Authorization', 'Bearer ' . $scfg->{truenas_secret});
} else { } else {
syslog("info", (caller(0))[3] . " : Authentication using Basic Auth"); syslog("info", (caller(0))[3] . " : Authentication using Basic Auth");
@ -370,10 +373,11 @@ sub freenas_api_connect {
} elsif ($code == 200 && ($type =~ /^text\/plain/ || $type =~ /^application\/json/)) { } elsif ($code == 200 && ($type =~ /^text\/plain/ || $type =~ /^application\/json/)) {
syslog("info", (caller(0))[3] . " : REST connection successful to '" . $apihost . "' using the '" . $scheme . "' protocol"); syslog("info", (caller(0))[3] . " : REST connection successful to '" . $apihost . "' using the '" . $scheme . "' protocol");
$runawayprevent = 0; $runawayprevent = 0;
# A 302 or 200 (We already check for the correct 'type' above with a 200 so why add additional conditionals). # A 302 or 200 (wrong content-type) means v1.0 is redirecting — upgrade to v2.0.
# So change to v2.0 APIs. # TrueNAS 25.04+ removed v1.0 entirely and returns 404 instead of 302; treat
} elsif ($code == 302 || $code == 200) { # that the same way so long as we are still probing the v1.0 endpoint.
syslog("info", (caller(0))[3] . " : Changing to v2.0 API's"); } elsif ($code == 302 || $code == 200 || ($code == 404 && $apiping =~ /v1\.0/)) {
syslog("info", (caller(0))[3] . " : v1.0 API unavailable (HTTP $code) — upgrading to v2.0");
$runawayprevent++; $runawayprevent++;
$apiping =~ s/v1\.0/v2\.0/; $apiping =~ s/v1\.0/v2\.0/;
freenas_api_connect($scfg); freenas_api_connect($scfg);