[pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge

[pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge

[Gabriel Goller]

As already mentioned in our docs [0], wildcard domains are only
supported when the dns-challenge is used. If the dns-challenge is not
used, throw an error.

[0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
---
 src/config/node.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/config/node.rs b/src/config/node.rs
index 937beb3a125c..80a503635344 100644
--- a/src/config/node.rs
+++ b/src/config/node.rs
@@ -272,6 +272,16 @@ impl NodeConfig {
             if !domains.insert(domain.domain.to_lowercase()) {
                 bail!("duplicate domain '{}' in ACME config", domain.domain);
             }
+            if domain.domain.contains('*')
+                && domain.plugin.map_or(true, |value| {
+                    value.as_str() == "" || value.as_str() == "standalone"
+                })
+            {
+                bail!(
+                    "wildcard domains like '{}' are only usable with the DNS challenge type",
+                    domain.domain
+                );
+            }
         }
         let mut dummy_acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap();
         if let Some(ciphers) = self.ciphers_tls_1_3.as_deref() {
-- 
2.39.5



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

[pbs-devel] [PATCH] schema: add regex for dns domains with wildcard

[Gabriel Goller]

Support dns domains with wildcards, f.e. '*.proxmox.com'. This is useful
when adding ACME-domains.

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
---
 proxmox-schema/src/api_types.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/proxmox-schema/src/api_types.rs b/proxmox-schema/src/api_types.rs
index fed46257cef2..2e49936e800b 100644
--- a/proxmox-schema/src/api_types.rs
+++ b/proxmox-schema/src/api_types.rs
@@ -53,9 +53,15 @@ pub const SAFE_ID_REGEX_STR: &str = r"(?:[A-Za-z0-9_][A-Za-z0-9._\-]*)";
 #[rustfmt::skip]
 pub const DNS_LABEL_STR: &str = r"(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)";
 
+#[rustfmt::skip]
+pub const DNS_LABEL_WILDCARD_STR: &str = r"(?:[a-zA-Z0-9\*](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)";
+
 #[rustfmt::skip]
 pub const DNS_NAME_STR: &str = concatcp!(r"(?:(?:", DNS_LABEL_STR, r"\.)*", DNS_LABEL_STR, ")");
 
+#[rustfmt::skip]
+pub const DNS_NAME_WILDCARD_STR: &str = concatcp!(r"(?:(?:", DNS_LABEL_WILDCARD_STR, r"\.)*", DNS_LABEL_WILDCARD_STR, ")");
+
 #[rustfmt::skip]
 pub const DNS_ALIAS_LABEL_STR: &str = r"(?:[a-zA-Z0-9_](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)";
 
@@ -99,7 +105,7 @@ const_regex! {
     pub MULTI_LINE_COMMENT_REGEX = r"(?m)^([[:^cntrl:]]*)$";
 
     pub HOSTNAME_REGEX = r"^(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?)$";
-    pub DNS_NAME_REGEX = concatcp!(r"^", DNS_NAME_STR, r"$");
+    pub DNS_NAME_REGEX = concatcp!(r"^", DNS_NAME_WILDCARD_STR, r"$");
     pub DNS_ALIAS_REGEX = concatcp!(r"^", DNS_ALIAS_NAME_STR, r"$");
     pub DNS_NAME_OR_IP_REGEX = concatcp!(r"^(?:", DNS_NAME_STR, "|",  IPRE_STR, r")$");
     pub HOST_PORT_REGEX = concatcp!(r"^(?:", DNS_NAME_STR, "|", IPRE_BRACKET_STR, "):", PORT_REGEX_STR ,"$");
-- 
2.39.5



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge

[Christian Ebner]

Tried to generate a wildcard certificate using the cloudflare DNS plugin 
with these patches applied.

Unfortunately this fails with an error (domain obfuscated, but its the 
domain without the "*." prefix):
```
TASK ERROR: no config for domain 'mydomain'
```

So it seem there still is an issue when retrieving the domain from the 
config here:
https://git.proxmox.com/?p=proxmox-backup.git;a=blob;f=src/api2/node/certificates.rs;h=61ef910e47a71a005064d2b1e99d3d97b0d43f51;hb=HEAD#l342

Also, nit inline.

On 9/17/24 11:47, Gabriel Goller wrote:
> As already mentioned in our docs [0], wildcard domains are only
> supported when the dns-challenge is used. If the dns-challenge is not
> used, throw an error.
> 
> [0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates
> 
> Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
> ---
>   src/config/node.rs | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/src/config/node.rs b/src/config/node.rs
> index 937beb3a125c..80a503635344 100644
> --- a/src/config/node.rs
> +++ b/src/config/node.rs
> @@ -272,6 +272,16 @@ impl NodeConfig {
>               if !domains.insert(domain.domain.to_lowercase()) {
>                   bail!("duplicate domain '{}' in ACME config", domain.domain);
>               }
> +            if domain.domain.contains('*')
> +                && domain.plugin.map_or(true, |value| {
> +                    value.as_str() == "" || value.as_str() == "standalone"
> +                })
> +            {
> +                bail!(
> +                    "wildcard domains like '{}' are only usable with the DNS challenge type",

nit: Above checks for standalone HTTP challenge, so instead of stating 
that the wildcard is only usable with DNS challenges, I think it would 
be better to state that it is not usable with the HTTP challenge instead.

> +                    domain.domain
> +                );
> +            }
>           }
>           let mut dummy_acceptor = SslAcceptor::mozilla_intermediate_v5(SslMethod::tls()).unwrap();
>           if let Some(ciphers) = self.ciphers_tls_1_3.as_deref() {



_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge

[Christian Ebner]

As a side note in case you missed it: The user reporting this in the 
community forum [0] also opened an issue in our bugtracker [1], also 
mentioning issues with the certificate generation.

[0] https://forum.proxmox.com/threads/154406/
[1] https://bugzilla.proxmox.com/show_bug.cgi?id=5719


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel

Re: [pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge

[Gabriel Goller]

On 18.09.2024 10:43, Christian Ebner wrote:
>Tried to generate a wildcard certificate using the cloudflare DNS 
>plugin with these patches applied.
>
>Unfortunately this fails with an error (domain obfuscated, but its the 
>domain without the "*." prefix):
>```
>TASK ERROR: no config for domain 'mydomain'
>```
>
>So it seem there still is an issue when retrieving the domain from the 
>config here:
>https://git.proxmox.com/?p=proxmox-backup.git;a=blob;f=src/api2/node/certificates.rs;h=61ef910e47a71a005064d2b1e99d3d97b0d43f51;hb=HEAD#l342

yep, noticed this as well, will hopefully be fixed in the next version!

>Also, nit inline.
>
>On 9/17/24 11:47, Gabriel Goller wrote:
>>As already mentioned in our docs [0], wildcard domains are only
>>supported when the dns-challenge is used. If the dns-challenge is not
>>used, throw an error.
>>
>>[0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates
>>
>>Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
>>---
>>  src/config/node.rs | 10 ++++++++++
>>  1 file changed, 10 insertions(+)
>>
>>diff --git a/src/config/node.rs b/src/config/node.rs
>>index 937beb3a125c..80a503635344 100644
>>--- a/src/config/node.rs
>>+++ b/src/config/node.rs
>>@@ -272,6 +272,16 @@ impl NodeConfig {
>>              if !domains.insert(domain.domain.to_lowercase()) {
>>                  bail!("duplicate domain '{}' in ACME config", domain.domain);
>>              }
>>+            if domain.domain.contains('*')
>>+                && domain.plugin.map_or(true, |value| {
>>+                    value.as_str() == "" || value.as_str() == "standalone"
>>+                })
>>+            {
>>+                bail!(
>>+                    "wildcard domains like '{}' are only usable with the DNS challenge type",
>
>nit: Above checks for standalone HTTP challenge, so instead of stating 
>that the wildcard is only usable with DNS challenges, I think it would 
>be better to state that it is not usable with the HTTP challenge 
>instead.

Agree.

Thanks for the review! Will send a v2 soon!


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel