From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 1EB4D1FF15C for ; Fri, 22 Aug 2025 10:54:36 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 43196B5AD; Fri, 22 Aug 2025 10:54:23 +0200 (CEST) From: Dominik Csapak To: pdm-devel@lists.proxmox.com Date: Fri, 22 Aug 2025 10:32:41 +0200 Message-ID: <20250822085409.1139639-24-d.csapak@proxmox.com> X-Mailer: git-send-email 2.47.2 In-Reply-To: <20250822085409.1139639-1-d.csapak@proxmox.com> References: <20250822085409.1139639-1-d.csapak@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.022 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pdm-devel] [PATCH datacenter-manager v4 23/23] ui: pve wizard: connect: add certificate confirmation dialog X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" In case the user did not enter a fingerprint, but the certificate is untrusted, show them a dialog with the certificate information and allow them to progress by confirming it. Signed-off-by: Dominik Csapak --- ui/Cargo.toml | 1 + ui/src/remotes/wizard_page_connect.rs | 140 ++++++++++++++++++++++---- 2 files changed, 122 insertions(+), 19 deletions(-) diff --git a/ui/Cargo.toml b/ui/Cargo.toml index b6b6dd3..ef66020 100644 --- a/ui/Cargo.toml +++ b/ui/Cargo.toml @@ -32,6 +32,7 @@ pwt-macros = "0.4" proxmox-yew-comp = { version = "0.5.6", features = ["apt", "dns", "network", "rrd"] } +proxmox-acme-api = "1" proxmox-client = "1" proxmox-human-byte = "1" proxmox-login = "1" diff --git a/ui/src/remotes/wizard_page_connect.rs b/ui/src/remotes/wizard_page_connect.rs index 5122743..d05dab2 100644 --- a/ui/src/remotes/wizard_page_connect.rs +++ b/ui/src/remotes/wizard_page_connect.rs @@ -2,19 +2,21 @@ use std::rc::Rc; use anyhow::{bail, Error}; use serde::{Deserialize, Serialize}; +use serde_json::Value; use yew::html::IntoEventCallback; use yew::virtual_dom::{Key, VComp, VNode}; -use pwt::css::FlexFit; +use pwt::css::{FlexFit, JustifyContent}; use pwt::widget::form::{Field, FormContext, FormContextObserver}; -use pwt::widget::{error_message, Column, InputPanel, Mask}; +use pwt::widget::{error_message, Button, Column, Container, Dialog, InputPanel, Mask, Row}; use pwt::{prelude::*, AsyncAbortGuard}; use pwt_macros::builder; -use proxmox_yew_comp::{SchemaValidation, WizardPageRenderInfo}; +use proxmox_yew_comp::{KVGrid, KVGridRow, SchemaValidation, WizardPageRenderInfo}; use pdm_api_types::remotes::{RemoteType, TlsProbeOutcome}; use pdm_api_types::CERT_FINGERPRINT_SHA256_SCHEMA; +use proxmox_acme_api::CertificateInfo; #[derive(Clone, PartialEq, Properties)] #[builder] @@ -47,16 +49,10 @@ async fn connect(form_ctx: FormContext, remote_type: RemoteType) -> Result { let hostname = normalize_hostname(form_ctx.read().get_field_text("hostname")); let fingerprint = get_fingerprint(&form_ctx); - let res = crate::pdm_client() + crate::pdm_client() .pve_probe_tls(&hostname, fingerprint.as_deref()) .await - .map_err(Error::from); - - if let Ok(TlsProbeOutcome::UntrustedCertificate(_)) = &res { - bail!("Untrusted Certificate, please enter fingerprint"); - } - - res + .map_err(Error::from) } RemoteType::Pbs => bail!("not implemented"), } @@ -64,6 +60,7 @@ async fn connect(form_ctx: FormContext, remote_type: RemoteType) -> Result), } @@ -72,6 +69,58 @@ pub struct PdmWizardPageConnect { loading: bool, scan_result: Option>, scan_guard: Option, + rows: Rc>, +} + +impl PdmWizardPageConnect { + fn create_certificate_confirmation_dialog(&self, ctx: &Context) -> Option { + let link = ctx.link(); + let certificate = match &self.scan_result { + Some(Ok(TlsProbeOutcome::UntrustedCertificate(info))) => info.clone(), + _ => return None, + }; + Some( + Dialog::new(tr!("Connection Certificate")) + .on_close(link.callback(|_| Msg::ConfirmResult(false))) + .with_child( + Column::new() + .padding(2) + .gap(2) + .class(FlexFit) + .with_child(Container::new().with_child(tr!( + "The certificate of the remote server is not trusted." + ))) + .with_child( + Container::new().with_child(tr!( + "Do you want to trust it by saving it's fingerprint?" + )), + ) + .with_child( + KVGrid::new() + .class(FlexFit) + .borderless(true) + .striped(false) + .rows(self.rows.clone()) + .data(Rc::new( + serde_json::to_value(certificate).unwrap_or_default(), + )), + ) + .with_child( + Row::new() + .gap(2) + .class(JustifyContent::Center) + .with_child( + Button::new(tr!("Yes")) + .onclick(link.callback(|_| Msg::ConfirmResult(true))), + ) + .with_child( + Button::new(tr!("No")) + .onclick(link.callback(|_| Msg::ConfirmResult(false))), + ), + ), + ), + ) + } } impl Component for PdmWizardPageConnect { @@ -100,6 +149,7 @@ impl Component for PdmWizardPageConnect { loading: false, scan_result: None, scan_guard: None, + rows: Rc::new(rows()), } } @@ -137,20 +187,39 @@ impl Component for PdmWizardPageConnect { self.scan_result = Some(scan_result); match &self.scan_result { Some(Ok(TlsProbeOutcome::TrustedCertificate)) => { - call_on_connect_change(props); - self.scan_result = None; - props.info.reset_remaining_valid_pages(); - props.info.go_to_next_page(); + return ::update(self, ctx, Msg::ConfirmResult(true)); } Some(Err(_)) => props.info.page_lock(true), _ => {} } } + Msg::ConfirmResult(confirm) => { + if !confirm { + self.scan_result = None; + return true; + } + if let Some(Ok(result)) = &self.scan_result { + let connection = match result { + TlsProbeOutcome::TrustedCertificate => None, + TlsProbeOutcome::UntrustedCertificate(info) => { + props.info.form_ctx.write().set_field_value( + "fingerprint", + info.fingerprint.clone().unwrap_or_default().into(), + ); + Some(info.clone()) + } + }; + call_on_connect_change(props, connection); + self.scan_result = None; + props.info.reset_remaining_valid_pages(); + props.info.go_to_next_page(); + } + } } true } - fn view(&self, _ctx: &Context) -> Html { + fn view(&self, ctx: &Context) -> Html { let error = match &self.scan_result { Some(Err(err)) => Some(err), _ => None, @@ -177,7 +246,8 @@ impl Component for PdmWizardPageConnect { let content = Column::new() .class(FlexFit) .with_child(input_panel) - .with_optional_child(error.map(|err| error_message(&err.to_string()))); + .with_optional_child(error.map(|err| error_message(&err.to_string()))) + .with_optional_child(self.create_certificate_confirmation_dialog(ctx)); Mask::new(content) .class(FlexFit) @@ -196,12 +266,14 @@ fn get_fingerprint(form_ctx: &FormContext) -> Option { fingerprint } -fn call_on_connect_change(props: &WizardPageConnect) { +fn call_on_connect_change(props: &WizardPageConnect, certificate_info: Option) { if let Some(on_connect_change) = &props.on_connect_change { let fingerprint = get_fingerprint(&props.info.form_ctx); on_connect_change.emit(Some(ConnectParams { hostname: normalize_hostname(props.info.form_ctx.read().get_field_text("hostname")), - fingerprint, + fingerprint: certificate_info + .and_then(|cert| cert.fingerprint) + .or(fingerprint), })); } } @@ -220,6 +292,36 @@ fn normalize_hostname(hostname: String) -> String { result } +fn rows() -> Vec { + let render_date = |_name: &str, value: &Value, _record: &Value| -> Html { + match value.as_i64() { + Some(value) => html! {proxmox_yew_comp::utils::render_epoch(value)}, + None => html! {value.to_string()}, + } + }; + let value = vec![ + KVGridRow::new("fingerprint", tr!("Fingerprint")), + KVGridRow::new("issuer", tr!("Issuer")), + KVGridRow::new("subject", tr!("Subject")), + KVGridRow::new("public-key-type", tr!("Public Key Alogrithm")), + KVGridRow::new("public-key-bits", tr!("Public Key Size")), + KVGridRow::new("notbefore", tr!("Valid Since")).renderer(render_date), + KVGridRow::new("notafter", tr!("Expires")).renderer(render_date), + KVGridRow::new("san", tr!("Subject Alternative Names")).renderer( + |_name, value, _record| { + let list: Result, _> = serde_json::from_value(value.clone()); + match list { + Ok(value) => { + html! {
{&value.join("\n")}
} + } + _ => html! {value.to_string()}, + } + }, + ), + ]; + value +} + impl Into for WizardPageConnect { fn into(self) -> VNode { let comp = VComp::new::(Rc::new(self), None); -- 2.47.2 _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel