File Coverage

blib/lib/Net/SecurityCenter/REST.pm

Criterion	Covered	Total	%
statement	150	201	74.6
branch	34	74	45.9
condition	25	77	32.4
subroutine	20	26	76.9
pod	12	13	92.3
total	241	391	61.6

package Net::SecurityCenter::REST;

use warnings;
use strict;

use version;
use Carp ();
use HTTP::Cookies;
use JSON;
use LWP::UserAgent;

use Net::SecurityCenter::Error;
use Net::SecurityCenter::Utils qw(trim dumper);

our $VERSION = '0.300';
our $ERROR;

#-------------------------------------------------------------------------------
# CONSTRUCTOR
#-------------------------------------------------------------------------------

sub new {

    my ( $class, $host, $options ) = @_;

    if ( !$host ) {
        Carp::croak 'Specify the Tenable.sc hostname or IP address';
    }

    my $agent      = LWP::UserAgent->new();
    my $cookie_jar = HTTP::Cookies->new();

    $agent->agent( _agent() );
    $agent->ssl_opts( verify_hostname => 0 );

    my $timeout  = delete( $options->{'timeout'} );
    my $ssl_opts = delete( $options->{'ssl_options'} ) || {};
    my $logger   = delete( $options->{'logger'} ) || undef;
    my $scheme   = delete( $options->{'scheme'} ) || 'https';

    my $url = "$scheme://$host/rest";

    if ($timeout) {
        $agent->timeout($timeout);
    }

    if ($ssl_opts) {
        $agent->ssl_opts($ssl_opts);
    }

    $agent->cookie_jar($cookie_jar);

    my $self = {
        host    => $host,
        options => $options,
        url     => $url,
        token   => undef,
        api_key => undef,
        agent   => $agent,
        logger  => $logger,
        error   => undef,
    };

    bless $self, $class;

    if ( !$self->_check ) {
        Carp::croak $self->{error}->message;
    }

    return $self;

}

#-------------------------------------------------------------------------------
# UTILS
#-------------------------------------------------------------------------------

sub _agent {

    my $class = __PACKAGE__;
    ( my $agent = $class ) =~ s{::}{-}g;

    return "$agent/" . $class->VERSION;

}

#-------------------------------------------------------------------------------

sub _check {

    my ($self) = @_;

    my $response = $self->request( 'GET', '/system' );

    if ( !$response ) {
        $self->error( 'Failed to connect to Tenable.sc (' . $self->{'host'} . ')', 500 );
        return;
    }

    $self->{'version'}  = $response->{'version'};
    $self->{'build_id'} = $response->{'buildID'};
    $self->{'license'}  = $response->{'licenseStatus'};
    $self->{'uuid'}     = $response->{'uuid'};

    $self->logger( 'info', 'Tenable.sc ' . $self->{'version'} . ' (Build ID:' . $self->{'build_id'} . ')' );
    return 1;

}

#-------------------------------------------------------------------------------

sub error {

    my ( $self, $message, $code ) = @_;

    if ( defined $message ) {
        $self->{error} = Net::SecurityCenter::Error->new( $message, $code );
        return;
    } else {
        return $self->{error};
    }

}

#-------------------------------------------------------------------------------
# REST HELPER METHODS (get, head, put, post, delete and patch)
#-------------------------------------------------------------------------------

for my $sub_name (qw/get head put post delete patch/) {

    my $req_method = uc $sub_name;
    no strict 'refs';    ## no critic
    eval <<"HERE";       ## no critic
    sub $sub_name {
        my ( \$self, \$path, \$params ) = \@_;
        my \$class = ref \$self;
        ( \@_ == 2 || ( \@_ == 3 && ref \$params eq 'HASH' ) )
            or Carp::croak("Usage: \$class->$sub_name( PATH, [HASHREF] )\n");
        return \$self->request('$req_method', \$path, \$params || {});
    }
HERE

}

#-------------------------------------------------------------------------------

sub request {

    my ( $self, $method, $path, $params ) = @_;

    ( @_ == 3 || @_ == 4 )
        or Carp::croak( 'Usage: ' . __PACKAGE__ . '->request(GET|POST|PUT|DELETE|PATCH, $PATH, [\%PARAMS])' );

    $method = uc($method);
    $path =~ s{^/}{};

    if ( $method !~ m/(?:GET|POST|PUT|DELETE|PATCH)/ ) {
        Carp::carp( $method . ' is an unsupported request method' );
        Croak::croak( 'Usage: ' . __PACKAGE__ . '->request(GET|POST|PUT|DELETE|PATCH, $PATH, [\%PARAMS])' );
    }

    my $url     = $self->{'url'} . "/$path";
    my $agent   = $self->{'agent'};
    my $request = HTTP::Request->new( $method => $url );

    $self->logger( 'debug', "Method: $method" );
    $self->logger( 'debug', "Path: $path" );
    $self->logger( 'debug', "URL: $url" );

    # Don't log credential
    if ( $path !~ /token/ ) {
        $self->logger( 'debug', "Params: " . dumper($params) );
    }

    if ( $params->{'file'} ) {

        require HTTP::Request::Common;

        $request = HTTP::Request::Common::POST(
            $url,
            'Content-Type' => 'multipart/form-data',
            'Content'      => [
                Filedata => [ $params->{'file'}, undef, 'Content-Type' => 'application/octet-stream' ]
            ],
        );

    } else {

        $request->header( 'Content-Type', 'application/json' );

        if ($params) {
            $request->content( encode_json($params) );
        }

    }

    # Reset error
    $self->{'error'} = undef;

    my $response         = $agent->request($request);
    my $response_content = $response->content();
    my $response_ctype   = $response->headers->{'content-type'};
    my $response_code    = $response->code();

    my $result  = {};
    my $is_json = ( $response_ctype =~ /application\/json/ );

    # Force JSON decode for 403 Forbidden message without JSON Content-Type header
    if ( $response_code == 403 && $response_ctype !~ /application\/json/ ) {
        $is_json = 1;
    }

    if ($is_json) {
        $result = eval { decode_json($response_content) };
    }

    $self->logger( 'debug', 'Response status: ' . $response->status_line );

    if ( ref $result->{warnings} eq 'ARRAY' ) {
        foreach my $warning ( @{ $result->{'warnings'} } ) {
            Carp::carp( $warning->{code} . ': ' . $warning->{warning} );
        }
    }

    if ( $response->is_success() ) {

        if ($is_json) {

            if ( defined( $result->{'response'} ) ) {
                return $result->{'response'};

            } elsif ( $result->{'error_msg'} ) {

                my $error_msg = trim( $result->{'error_msg'} );

                $self->logger( 'error', $error_msg );
                $self->error( $error_msg, $response_code );

                return;

            }

        }

        return $response_content;

    }

    if ( $is_json && exists( $result->{'error_msg'} ) ) {

        my $error_msg = trim( $result->{'error_msg'} );

        $self->logger( 'error', $error_msg );
        $self->error( $error_msg, $response_code );

        return;

    }

    $self->logger( 'error', $response_content );
    $self->error( $response_content, $response_code );

    return;

}

#-------------------------------------------------------------------------------
# HELPER METHODS
#-------------------------------------------------------------------------------

sub upload {

    my ( $self, $file ) = @_;

    ( @_ == 2 )
        or Carp::croak( 'Usage: ' . __PACKAGE__ . '->upload( $FILE )' );

    return $self->request( 'POST', '/file/upload', { 'file' => $file } );

}

#-------------------------------------------------------------------------------

sub logger {

    my ( $self, $level, $message ) = @_;

    return if ( !$self->{'logger'} );

    $level = lc($level);

    my $caller = ( caller(1) )[3] || q{};
    $caller =~ s/(::)(\w+)$/->$2/;

    $self->{'logger'}->$level("$caller - $message");

    return 1;

}

#-------------------------------------------------------------------------------

sub login {

    my ( $self, %args ) = @_;

    # Detect "flat" login argument with username and password
    if (   !( defined( $args{'access_key'} ) && defined( $args{'secret_key'} ) )
        && !( defined( $args{'username'} ) && defined( $args{'password'} ) ) )
    {

        my $username = ( keys %args )[0];
        my $password = $args{$username};

        %args = (
            username => $username,
            password => $password,
        );

    }

    my $username   = delete( $args{'username'} );
    my $password   = delete( $args{'password'} );
    my $access_key = delete( $args{'access_key'} );
    my $secret_key = delete( $args{'secret_key'} );

    if ( !$username && !$access_key ) {
        Carp::croak('Specify username/password or API Key');
    }

    if ($username) {

        my $response = $self->request(
            'POST', '/token',
            {
                username => $username,
                password => $password
            }
        );

        return if ( !$response );

        $self->{'token'} = $response->{'token'};
        $self->{'agent'}->default_header( 'X-SecurityCenter', $self->{'token'} );

        $self->logger( 'info',  'Connected to Tenable.sc (' . $self->{'host'} . ')' );
        $self->logger( 'debug', "User: $username" );

    }

    if ($access_key) {

        my $version_check = ( version->parse( $self->{'version'} ) <=> version->parse('5.13.0') );

        if ( $version_check < 0 ) {
            Carp::croak "API Key Authentication require Tenable.sc v5.13.0 or never";
        }

        $self->{'api_key'} = 1;
        $self->{'agent'}->default_header( 'X-APIKey', "accessKey=$access_key; secretKey=$secret_key" );

        my $response = $self->request( 'GET', '/currentUser' );

        return if ( !$response );

        $self->logger( 'info', 'Connected to Tenable.sc (' . $self->{'host'} . ') using API Key' );

    }

    return 1;

}

#-------------------------------------------------------------------------------

sub logout {

    my ($self) = @_;

    if ( $self->{'token'} ) {
        $self->request( 'DELETE', '/token' );
        $self->{'token'} = undef;
    }

    if ( $self->{'api_key'} ) {
        $self->{'agent'}->default_header( 'X-APIKey', undef );
        $self->{'api_key'} = undef;
    }

    $self->logger( 'info', 'Disconnected from Tenable.sc (' . $self->{'host'} . ')' );

    return 1;

}

#-------------------------------------------------------------------------------

sub DESTROY {

    my ($self) = @_;

    if ( $self->{'token'} ) {
        $self->logout();
    }

    return;

}

#-------------------------------------------------------------------------------

1;

__END__