* [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge @ 2024-09-17 9:47 Gabriel Goller 2024-09-17 9:47 ` [pbs-devel] [PATCH] schema: add regex for dns domains with wildcard Gabriel Goller 2024-09-18 8:43 ` [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Christian Ebner 0 siblings, 2 replies; 5+ messages in thread From: Gabriel Goller @ 2024-09-17 9:47 UTC (permalink / raw) To: pbs-devel As already mentioned in our docs [0], wildcard domains are only supported when the dns-challenge is used. If the dns-challenge is not used, throw an error. [0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates Signed-off-by: Gabriel Goller <g.goller@proxmox.com> --- src/config/node.rs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/config/node.rs b/src/config/node.rs index 937beb3a125c..80a503635344 100644 --- a/src/config/node.rs +++ b/src/config/node.rs @@ -272,6 +272,16 @@ impl NodeConfig { if !domains.insert(domain.domain.to_lowercase()) { bail!("duplicate domain '{}' in ACME config", domain.domain); } + if domain.domain.contains('*') + && domain.plugin.map_or(true, |value| { + value.as_str() == "" || value.as_str() == "standalone" + }) + { + bail!( + "wildcard domains like '{}' are only usable with the DNS challenge type", + domain.domain + ); + } } let mut dummy_acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap(); if let Some(ciphers) = self.ciphers_tls_1_3.as_deref() { -- 2.39.5 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* [pbs-devel] [PATCH] schema: add regex for dns domains with wildcard 2024-09-17 9:47 [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Gabriel Goller @ 2024-09-17 9:47 ` Gabriel Goller 2024-09-18 8:43 ` [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Christian Ebner 1 sibling, 0 replies; 5+ messages in thread From: Gabriel Goller @ 2024-09-17 9:47 UTC (permalink / raw) To: pbs-devel Support dns domains with wildcards, f.e. '*.proxmox.com'. This is useful when adding ACME-domains. Signed-off-by: Gabriel Goller <g.goller@proxmox.com> --- proxmox-schema/src/api_types.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/proxmox-schema/src/api_types.rs b/proxmox-schema/src/api_types.rs index fed46257cef2..2e49936e800b 100644 --- a/proxmox-schema/src/api_types.rs +++ b/proxmox-schema/src/api_types.rs @@ -53,9 +53,15 @@ pub const SAFE_ID_REGEX_STR: &str = r"(?:[A-Za-z0-9_][A-Za-z0-9._\-]*)"; #[rustfmt::skip] pub const DNS_LABEL_STR: &str = r"(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)"; +#[rustfmt::skip] +pub const DNS_LABEL_WILDCARD_STR: &str = r"(?:[a-zA-Z0-9\*](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)"; + #[rustfmt::skip] pub const DNS_NAME_STR: &str = concatcp!(r"(?:(?:", DNS_LABEL_STR, r"\.)*", DNS_LABEL_STR, ")"); +#[rustfmt::skip] +pub const DNS_NAME_WILDCARD_STR: &str = concatcp!(r"(?:(?:", DNS_LABEL_WILDCARD_STR, r"\.)*", DNS_LABEL_WILDCARD_STR, ")"); + #[rustfmt::skip] pub const DNS_ALIAS_LABEL_STR: &str = r"(?:[a-zA-Z0-9_](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)"; @@ -99,7 +105,7 @@ const_regex! { pub MULTI_LINE_COMMENT_REGEX = r"(?m)^([[:^cntrl:]]*)$"; pub HOSTNAME_REGEX = r"^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)$"; - pub DNS_NAME_REGEX = concatcp!(r"^", DNS_NAME_STR, r"$"); + pub DNS_NAME_REGEX = concatcp!(r"^", DNS_NAME_WILDCARD_STR, r"$"); pub DNS_ALIAS_REGEX = concatcp!(r"^", DNS_ALIAS_NAME_STR, r"$"); pub DNS_NAME_OR_IP_REGEX = concatcp!(r"^(?:", DNS_NAME_STR, "|", IPRE_STR, r")$"); pub HOST_PORT_REGEX = concatcp!(r"^(?:", DNS_NAME_STR, "|", IPRE_BRACKET_STR, "):", PORT_REGEX_STR ,"$"); -- 2.39.5 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge 2024-09-17 9:47 [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Gabriel Goller 2024-09-17 9:47 ` [pbs-devel] [PATCH] schema: add regex for dns domains with wildcard Gabriel Goller @ 2024-09-18 8:43 ` Christian Ebner 2024-09-18 9:19 ` Christian Ebner 2024-09-18 12:03 ` Gabriel Goller 1 sibling, 2 replies; 5+ messages in thread From: Christian Ebner @ 2024-09-18 8:43 UTC (permalink / raw) To: Proxmox Backup Server development discussion, Gabriel Goller Tried to generate a wildcard certificate using the cloudflare DNS plugin with these patches applied. Unfortunately this fails with an error (domain obfuscated, but its the domain without the "*." prefix): ``` TASK ERROR: no config for domain 'mydomain' ``` So it seem there still is an issue when retrieving the domain from the config here: https://git.proxmox.com/?p=proxmox-backup.git;a=blob;f=src/api2/node/certificates.rs;h=61ef910e47a71a005064d2b1e99d3d97b0d43f51;hb=HEAD#l342 Also, nit inline. On 9/17/24 11:47, Gabriel Goller wrote: > As already mentioned in our docs [0], wildcard domains are only > supported when the dns-challenge is used. If the dns-challenge is not > used, throw an error. > > [0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates > > Signed-off-by: Gabriel Goller <g.goller@proxmox.com> > --- > src/config/node.rs | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/src/config/node.rs b/src/config/node.rs > index 937beb3a125c..80a503635344 100644 > --- a/src/config/node.rs > +++ b/src/config/node.rs > @@ -272,6 +272,16 @@ impl NodeConfig { > if !domains.insert(domain.domain.to_lowercase()) { > bail!("duplicate domain '{}' in ACME config", domain.domain); > } > + if domain.domain.contains('*') > + && domain.plugin.map_or(true, |value| { > + value.as_str() == "" || value.as_str() == "standalone" > + }) > + { > + bail!( > + "wildcard domains like '{}' are only usable with the DNS challenge type", nit: Above checks for standalone HTTP challenge, so instead of stating that the wildcard is only usable with DNS challenges, I think it would be better to state that it is not usable with the HTTP challenge instead. > + domain.domain > + ); > + } > } > let mut dummy_acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap(); > if let Some(ciphers) = self.ciphers_tls_1_3.as_deref() { _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge 2024-09-18 8:43 ` [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Christian Ebner @ 2024-09-18 9:19 ` Christian Ebner 2024-09-18 12:03 ` Gabriel Goller 1 sibling, 0 replies; 5+ messages in thread From: Christian Ebner @ 2024-09-18 9:19 UTC (permalink / raw) To: Proxmox Backup Server development discussion, Gabriel Goller As a side note in case you missed it: The user reporting this in the community forum [0] also opened an issue in our bugtracker [1], also mentioning issues with the certificate generation. [0] https://forum.proxmox.com/threads/154406/ [1] https://bugzilla.proxmox.com/show_bug.cgi?id=5719 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge 2024-09-18 8:43 ` [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Christian Ebner 2024-09-18 9:19 ` Christian Ebner @ 2024-09-18 12:03 ` Gabriel Goller 1 sibling, 0 replies; 5+ messages in thread From: Gabriel Goller @ 2024-09-18 12:03 UTC (permalink / raw) To: Christian Ebner; +Cc: Proxmox Backup Server development discussion On 18.09.2024 10:43, Christian Ebner wrote: >Tried to generate a wildcard certificate using the cloudflare DNS >plugin with these patches applied. > >Unfortunately this fails with an error (domain obfuscated, but its the >domain without the "*." prefix): >``` >TASK ERROR: no config for domain 'mydomain' >``` > >So it seem there still is an issue when retrieving the domain from the >config here: >https://git.proxmox.com/?p=proxmox-backup.git;a=blob;f=src/api2/node/certificates.rs;h=61ef910e47a71a005064d2b1e99d3d97b0d43f51;hb=HEAD#l342 yep, noticed this as well, will hopefully be fixed in the next version! >Also, nit inline. > >On 9/17/24 11:47, Gabriel Goller wrote: >>As already mentioned in our docs [0], wildcard domains are only >>supported when the dns-challenge is used. If the dns-challenge is not >>used, throw an error. >> >>[0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates >> >>Signed-off-by: Gabriel Goller <g.goller@proxmox.com> >>--- >> src/config/node.rs | 10 ++++++++++ >> 1 file changed, 10 insertions(+) >> >>diff --git a/src/config/node.rs b/src/config/node.rs >>index 937beb3a125c..80a503635344 100644 >>--- a/src/config/node.rs >>+++ b/src/config/node.rs >>@@ -272,6 +272,16 @@ impl NodeConfig { >> if !domains.insert(domain.domain.to_lowercase()) { >> bail!("duplicate domain '{}' in ACME config", domain.domain); >> } >>+ if domain.domain.contains('*') >>+ && domain.plugin.map_or(true, |value| { >>+ value.as_str() == "" || value.as_str() == "standalone" >>+ }) >>+ { >>+ bail!( >>+ "wildcard domains like '{}' are only usable with the DNS challenge type", > >nit: Above checks for standalone HTTP challenge, so instead of stating >that the wildcard is only usable with DNS challenges, I think it would >be better to state that it is not usable with the HTTP challenge >instead. Agree. Thanks for the review! Will send a v2 soon! _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-09-18 12:04 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2024-09-17 9:47 [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Gabriel Goller 2024-09-17 9:47 ` [pbs-devel] [PATCH] schema: add regex for dns domains with wildcard Gabriel Goller 2024-09-18 8:43 ` [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge Christian Ebner 2024-09-18 9:19 ` Christian Ebner 2024-09-18 12:03 ` Gabriel Goller
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.