From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 2D2A21FF179 for ; Wed, 1 Oct 2025 11:33:36 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 720F81AE33; Wed, 1 Oct 2025 11:33:43 +0200 (CEST) Mime-Version: 1.0 Date: Wed, 01 Oct 2025 11:33:39 +0200 Message-Id: To: "Thomas Lamprecht" , "Proxmox Datacenter Manager development discussion" , "Christian Ebner" , "Wolfgang Bumiller" X-Mailer: aerc 0.20.0 References: <20250930080207.111162-1-c.ebner@proxmox.com> <5jmcsjt7cdnnxghl3hxxfdph2m5euzydxrnpltt2vorp6o7b6s@6fu6j2jlsrqz> <448266d6-a81c-400e-bead-a8398801d694@proxmox.com> <4ac305a2-5d44-48f9-9286-48a2520e4369@proxmox.com> In-Reply-To: <4ac305a2-5d44-48f9-9286-48a2520e4369@proxmox.com> From: "Shannon Sterz" X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1759311197275 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.057 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox.com] Subject: Re: [pdm-devel] [PATCH datacenter-manager/proxmox v2 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" On Tue Sep 30, 2025 at 2:34 PM CEST, Thomas Lamprecht wrote: > Am 30.09.25 um 14:19 schrieb Christian Ebner: >> On 9/30/25 1:49 PM, Wolfgang Bumiller wrote: >>> On Tue, Sep 30, 2025 at 10:02:01AM +0200, Christian Ebner wrote: >>>> This patches fix the ticket parsing when login to instances of PBS version 3 >>>> or lower. For this, the current pve_compat flags for `Login` and `Client` >>>> are refactored to be an extendable enum variant instead, adding the ticket >>>> parsing backwards compatibility. In that compatibility mode, response parsing >>>> of the ticket does not interpret the presence of the `ticket-info` field as the >>>> ticket being a `http-only` ticket and fallsback to the PBS version 3 and 4 >>>> compatible parsing, as the client never used `http-only` tickets. >>> >>> I thought this field was introduced only with http-only tickets, so why >>> is it not a reliable indicator and shouldn't *that* be fixed instead? >> >> I'm not so familiar with the actual code and the changes over time here, so that might as well be the case. > > FYI: Shannon is back at work tomorrow and this is not really _that_ > pressing, so I'd wait at least until tomorrow to hopefully get some > better rationale. hi everyone and sorry if i am missing something (still catching up on mail), but i think this is basically a more in-depth approach to a fix i send a while back: https://lore.proxmox.com/pbs-devel/20250520085549.56525-1-s.sterz@proxmox.com/ as chris has already pointed out in chat, there was a mishap on my end when refactoring the auth api and the old authentication flow would still send a `ticket-info` field alongside the `ticket` field. proxmox-login would then think it is in the new HttpOnly flow and not use the `ticket` field, even though it should. this was already fixed in commit f7d8b8f682 (auth-api: remove ticket info in old create ticket endpoint) [1], but it seems at least proxmox-backup-server 3.4.6-1 still sends the `ticket-info` as well. i rebuild pbs from latest stable-3 and stable-bookworm and there the parameter is correctly dropped. imo clients *should* use a ticket if they are provided with one and not get confused with additional parameters. which is what the patch linked above does. however, chris' approach to compatibility is a lot more extensible, so we could go down that road too. i'll check if my patch above works as inteded still and can resend a rebased version later today. [1]: https://git.proxmox.com/?p=proxmox.git;a=commitdiff;h=f7d8b8f682370cf0d8c3a0a238c958ceda2b8f7b _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel