From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 2150A9C46E for ; Tue, 24 Oct 2023 10:33:11 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 027F61CF13 for ; Tue, 24 Oct 2023 10:32:41 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Tue, 24 Oct 2023 10:32:40 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 2B5F144B00 for ; Tue, 24 Oct 2023 10:32:40 +0200 (CEST) Date: Tue, 24 Oct 2023 10:32:28 +0200 From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= To: Proxmox VE development discussion References: <20231023131808.172494-1-f.gleumes@proxmox.com> <20231023131808.172494-4-f.gleumes@proxmox.com> In-Reply-To: <20231023131808.172494-4-f.gleumes@proxmox.com> MIME-Version: 1.0 User-Agent: astroid/0.16.0 (https://github.com/astroidmail/astroid) Message-Id: <1698134740.taq5fv2f4f.astroid@yuna.none> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-SPAM-LEVEL: Spam detection results: 0 AWL -0.088 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: Re: [pve-devel] [PATCH manager 3/5] fix #4497: api/acme: deprecate tos endpoint in favor of meta X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2023 08:33:11 -0000 On October 23, 2023 3:18 pm, Folke Gleumes wrote: > The ToS endpoint ignored data that is needed to detect if EAB needs to > be used. Instead of adding a new endpoint that does the same request, > the tos endpoint is deprecated and replaced by the meta endpoint, > that returns all information returned by the directory. not opposed to this, but we could also get away for the time being without this patch and just make users that want to use EAB to explicitly opt-in. any CA that requires EABs has to error out if an attempt to register is made without a binding. the spec also allows CAs to optionally allow bindings without requiring them (e.g., to support both short-lived auto-validated, and longer-lived manually pre-validated certs), or to ignore the EAB part of account registrations with (unwanted or invalid) EABs by just discarding the binding/not persisting it in the created account. so basically every combination of CA indicating EAB requirements and EAB being provided upon registration *might* work, except for EAB being required and not provided. >=20 > Signed-off-by: Folke Gleumes > --- > PVE/API2/ACMEAccount.pm | 46 ++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 45 insertions(+), 1 deletion(-) >=20 > diff --git a/PVE/API2/ACMEAccount.pm b/PVE/API2/ACMEAccount.pm > index daae18d8..bfe76734 100644 > --- a/PVE/API2/ACMEAccount.pm > +++ b/PVE/API2/ACMEAccount.pm > @@ -62,6 +62,7 @@ __PACKAGE__->register_method ({ > return [ > { name =3D> 'account' }, > { name =3D> 'tos' }, > + { name =3D> 'meta' }, > { name =3D> 'directories' }, > { name =3D> 'plugins' }, > { name =3D> 'challenge-schema' }, > @@ -333,11 +334,12 @@ __PACKAGE__->register_method ({ > return $update_account->($param, 'deactivate', status =3D> 'deactivated= '); > }}); > =20 > +# TODO: deprecated, remove with pve 9 > __PACKAGE__->register_method ({ > name =3D> 'get_tos', > path =3D> 'tos', > method =3D> 'GET', > - description =3D> "Retrieve ACME TermsOfService URL from CA.", > + description =3D> "Retrieve ACME TermsOfService URL from CA. Deprecat= ed, please use /cluster/acme/meta.", > permissions =3D> { user =3D> 'all' }, > parameters =3D> { > additionalProperties =3D> 0, > @@ -364,6 +366,48 @@ __PACKAGE__->register_method ({ > return $meta ? $meta->{termsOfService} : undef; > }}); > =20 > +__PACKAGE__->register_method ({ > + name =3D> 'get_meta', > + path =3D> 'meta', > + method =3D> 'GET', > + description =3D> "Retrieve ACME Directory Meta Information", > + permissions =3D> { user =3D> 'all' }, > + parameters =3D> { > + additionalProperties =3D> 0, > + properties =3D> { > + directory =3D> get_standard_option('pve-acme-directory-url', { > + default =3D> $acme_default_directory_url, > + optional =3D> 1, > + }), > + }, > + }, > + returns =3D> { > + type =3D> 'object', > + additionalProperties =3D> 0, > + properties =3D> { > + termsOfService =3D> { > + type =3D> 'string', > + optional =3D> 1, > + description =3D> 'ACME TermsOfService URL.', > + }, > + externalAccountRequired =3D> { > + type =3D> 'boolean', > + optional =3D> 1, > + description =3D> 'EAB Required' > + }, the RFC has a few more, so we should maybe add the known ones here as well, and for sure set additionalProperties to 1. > + }, > + }, > + code =3D> sub { > + my ($param) =3D @_; > + > + my $directory =3D extract_param($param, 'directory') // $acme_default_d= irectory_url; > + > + my $acme =3D PVE::ACME->new(undef, $directory); > + my $meta =3D $acme->get_meta(); > + > + return $meta; > + }}); > + > __PACKAGE__->register_method ({ > name =3D> 'get_directories', > path =3D> 'directories', > --=20 > 2.39.2 >=20 >=20 >=20 > _______________________________________________ > pve-devel mailing list > pve-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel >=20 >=20 >=20