From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 768DA1FF179 for ; Wed, 1 Oct 2025 15:12:35 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 7E8D91F0AD; Wed, 1 Oct 2025 15:12:43 +0200 (CEST) Mime-Version: 1.0 Date: Wed, 01 Oct 2025 15:12:40 +0200 Message-Id: To: "Shannon Sterz" , "Thomas Lamprecht" , "Proxmox Datacenter Manager development discussion" , "Christian Ebner" , "Wolfgang Bumiller" X-Mailer: aerc 0.20.0 References: <20250930080207.111162-1-c.ebner@proxmox.com> <5jmcsjt7cdnnxghl3hxxfdph2m5euzydxrnpltt2vorp6o7b6s@6fu6j2jlsrqz> <448266d6-a81c-400e-bead-a8398801d694@proxmox.com> <4ac305a2-5d44-48f9-9286-48a2520e4369@proxmox.com> In-Reply-To: From: "Shannon Sterz" X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1759324338792 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.057 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: Re: [pdm-devel] [PATCH datacenter-manager/proxmox v2 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" On Wed Oct 1, 2025 at 11:33 AM CEST, Shannon Sterz wrote: > On Tue Sep 30, 2025 at 2:34 PM CEST, Thomas Lamprecht wrote: >> Am 30.09.25 um 14:19 schrieb Christian Ebner: >>> On 9/30/25 1:49 PM, Wolfgang Bumiller wrote: >>>> On Tue, Sep 30, 2025 at 10:02:01AM +0200, Christian Ebner wrote: >>>>> This patches fix the ticket parsing when login to instances of PBS version 3 >>>>> or lower. For this, the current pve_compat flags for `Login` and `Client` >>>>> are refactored to be an extendable enum variant instead, adding the ticket >>>>> parsing backwards compatibility. In that compatibility mode, response parsing >>>>> of the ticket does not interpret the presence of the `ticket-info` field as the >>>>> ticket being a `http-only` ticket and fallsback to the PBS version 3 and 4 >>>>> compatible parsing, as the client never used `http-only` tickets. >>>> >>>> I thought this field was introduced only with http-only tickets, so why >>>> is it not a reliable indicator and shouldn't *that* be fixed instead? >>> >>> I'm not so familiar with the actual code and the changes over time here, so that might as well be the case. >> >> FYI: Shannon is back at work tomorrow and this is not really _that_ >> pressing, so I'd wait at least until tomorrow to hopefully get some >> better rationale. > > hi everyone and sorry if i am missing something (still catching up on > mail), but i think this is basically a more in-depth approach to a fix i > send a while back: > > https://lore.proxmox.com/pbs-devel/20250520085549.56525-1-s.sterz@proxmox.com/ > > as chris has already pointed out in chat, there was a mishap on my end > when refactoring the auth api and the old authentication flow would > still send a `ticket-info` field alongside the `ticket` field. > proxmox-login would then think it is in the new HttpOnly flow and not > use the `ticket` field, even though it should. > > this was already fixed in commit f7d8b8f682 (auth-api: remove ticket > info in old create ticket endpoint) [1], but it seems at least > proxmox-backup-server 3.4.6-1 still sends the `ticket-info` as well. i > rebuild pbs from latest stable-3 and stable-bookworm and there the > parameter is correctly dropped. > > imo clients *should* use a ticket if they are provided with one and not > get confused with additional parameters. which is what the patch linked > above does. however, chris' approach to compatibility is a lot more > extensible, so we could go down that road too. > > i'll check if my patch above works as inteded still and can resend a > rebased version later today. > > [1]: https://git.proxmox.com/?p=proxmox.git;a=commitdiff;h=f7d8b8f682370cf0d8c3a0a238c958ceda2b8f7b send the updated patch now: https://lore.proxmox.com/all/20251001131102.266920-1-s.sterz@proxmox.com/T/#u _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel