From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 1D4661FF17A for ; Tue, 28 Oct 2025 20:33:44 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 756BB218E1; Tue, 28 Oct 2025 20:34:13 +0100 (CET) From: Samuel Rufinatscha To: pbs-devel@lists.proxmox.com Date: Tue, 28 Oct 2025 16:22:01 +0100 Message-ID: <20251028152201.216603-3-s.rufinatscha@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251028152201.216603-1-s.rufinatscha@proxmox.com> References: <20251028152201.216603-1-s.rufinatscha@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1761664918612 X-SPAM-LEVEL: Spam detection results: 0 BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [client.rs] X-Mailman-Approved-At: Tue, 28 Oct 2025 20:34:12 +0100 Subject: [pbs-devel] [PATCH proxmox-backup 1/1] fix #6939: acme: accept HTTP 204 from newNonce endpoint X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Backup Server development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pbs-devel-bounces@lists.proxmox.com Sender: "pbs-devel" When registering an ACME account, PBS fetches a fresh nonce by issuing a HEAD request to the server's newNonce URL. Until now we assumed this request would return HTTP 200 OK. In practice, some ACME servers respond with HTTP 204 No Content for this HEAD request while still providing a valid Replay-Nonce header. This causes PBS to abort registration with "ACME server responded with unexpected status code: 204", even though the server would otherwise issue certificates correctly. Adjust the ACME client code in PBS to accept both 200 OK and 204 No Content as successful results for the newNonce step. We continue to reject other status codes so we don't silently accept arbitrary 2xx responses. This restores interoperability with ACME servers that send 204 for newNonce, and aligns PBS' behavior with the updated proxmox-acme library as well as PVE's more tolerant ACME client. Fixes: #6939 Signed-off-by: Samuel Rufinatscha --- src/acme/client.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/acme/client.rs b/src/acme/client.rs index 1c12a4b9..0dabf676 100644 --- a/src/acme/client.rs +++ b/src/acme/client.rs @@ -530,7 +530,7 @@ impl AcmeClient { }; if parts.status.is_success() { - if status != request.expected { + if !request.expected.contains(&status) { return Err(Error::InvalidApi(format!( "ACME server responded with unexpected status code: {:?}", parts.status @@ -609,7 +609,7 @@ impl AcmeClient { method: "GET", content_type: "", body: String::new(), - expected: 200, + expected: vec![200], }, nonce, ) @@ -657,7 +657,7 @@ impl AcmeClient { method: "HEAD", content_type: "", body: String::new(), - expected: 200, + expected: vec![200, 204], }, nonce, ) -- 2.47.3 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel