public inbox for pbs-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* Re: [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema
@ 2021-04-28 16:10 Dietmar Maurer
  2021-04-28 16:34 ` Thomas Lamprecht
  0 siblings, 1 reply; 11+ messages in thread
From: Dietmar Maurer @ 2021-04-28 16:10 UTC (permalink / raw)
  To: Proxmox Backup Server development discussion, Wolfgang Bumiller

Seems DNS names in general are totally unrestricted and
may contain arbitrary binary data:

https://tools.ietf.org/html/rfc2181#section-11

Only host names and url are restricted.

?!

> On 04/28/2021 5:55 PM Dietmar Maurer <dietmar@proxmox.com> wrote:
> 
>  
> Is this the same syntax used for DNS SRV records?
> 
> https://en.wikipedia.org/wiki/SRV_record
> 
> > On 04/28/2021 1:15 PM Dietmar Maurer <dietmar@proxmox.com> wrote:
> > 
> >  
> > > On 04/28/2021 1:07 PM Wolfgang Bumiller <w.bumiller@proxmox.com> wrote:
> > > 
> > >  
> > > On Wed, Apr 28, 2021 at 12:26:11PM +0200, Dietmar Maurer wrote:
> > > > Sorry, I don't get this. Why is DNS_LABEL and DNS_ALIAS_LABEL different?
> > > 
> > > One allows underscores at the beginning, the other doesn't, as for
> > 
> > But where is it defined that an ALIAS may contain underscores?
> > Do you have a link to the corresponding RFC?
> > 
> > 
> > _______________________________________________
> > pbs-devel mailing list
> > pbs-devel@lists.proxmox.com
> > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel




^ permalink raw reply	[flat|nested] 11+ messages in thread
* Re: [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema
@ 2021-04-28 18:18 Dietmar Maurer
  2021-04-29  6:51 ` Wolfgang Bumiller
  0 siblings, 1 reply; 11+ messages in thread
From: Dietmar Maurer @ 2021-04-28 18:18 UTC (permalink / raw)
  To: Thomas Lamprecht, Proxmox Backup Server development discussion,
	Wolfgang Bumiller

So we should call it SCOPED_DNS_NAME, and require the underscore at start?

> On 04/28/2021 6:34 PM Thomas Lamprecht <t.lamprecht@proxmox.com> wrote:
> 
>  
> On 28.04.21 18:10, Dietmar Maurer wrote:
> > Seems DNS names in general are totally unrestricted and
> > may contain arbitrary binary data:
> > 
> > https://tools.ietf.org/html/rfc2181#section-11
> > 
> > Only host names and url are restricted.
> > 
> > ?!
> 
> FYI, from a off-list message from Wolfgang:
> 
> >> and why now only allow as first one?
> > mostly because that's what we did in PVE and because using underscores
> > anywhere else is silly ;-)
> > it's used for scoping, there was even an RFC draft but it's expired and only
> > marked as "best current practice" whatever that's worth:
> > https://tools.ietf.org/id/draft-ietf-dnsop-attrleaf-07.html#rfc.section.1.1
> > so basically: we used to not allow underscores, people do use leading
> > underscores for scoping, and we use it particularly for ACME aliases...
> 
> There was some confusion with which ALIAS you meant, as there's a not really
> used DNS record type named "ALIAS" too (which is unrelated to that one here).




^ permalink raw reply	[flat|nested] 11+ messages in thread
* Re: [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema
@ 2021-04-28 15:55 Dietmar Maurer
  2021-04-29  7:12 ` Wolfgang Bumiller
  0 siblings, 1 reply; 11+ messages in thread
From: Dietmar Maurer @ 2021-04-28 15:55 UTC (permalink / raw)
  To: Proxmox Backup Server development discussion, Wolfgang Bumiller

Is this the same syntax used for DNS SRV records?

https://en.wikipedia.org/wiki/SRV_record

> On 04/28/2021 1:15 PM Dietmar Maurer <dietmar@proxmox.com> wrote:
> 
>  
> > On 04/28/2021 1:07 PM Wolfgang Bumiller <w.bumiller@proxmox.com> wrote:
> > 
> >  
> > On Wed, Apr 28, 2021 at 12:26:11PM +0200, Dietmar Maurer wrote:
> > > Sorry, I don't get this. Why is DNS_LABEL and DNS_ALIAS_LABEL different?
> > 
> > One allows underscores at the beginning, the other doesn't, as for
> 
> But where is it defined that an ALIAS may contain underscores?
> Do you have a link to the corresponding RFC?
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel




^ permalink raw reply	[flat|nested] 11+ messages in thread
* Re: [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema
@ 2021-04-28 11:15 Dietmar Maurer
  2021-04-28 11:42 ` Wolfgang Bumiller
  0 siblings, 1 reply; 11+ messages in thread
From: Dietmar Maurer @ 2021-04-28 11:15 UTC (permalink / raw)
  To: Wolfgang Bumiller; +Cc: Proxmox Backup Server development discussion


> On 04/28/2021 1:07 PM Wolfgang Bumiller <w.bumiller@proxmox.com> wrote:
> 
>  
> On Wed, Apr 28, 2021 at 12:26:11PM +0200, Dietmar Maurer wrote:
> > Sorry, I don't get this. Why is DNS_LABEL and DNS_ALIAS_LABEL different?
> 
> One allows underscores at the beginning, the other doesn't, as for

But where is it defined that an ALIAS may contain underscores?
Do you have a link to the corresponding RFC?




^ permalink raw reply	[flat|nested] 11+ messages in thread
* [pbs-devel] [PATCH v2 backup 00/27] Implements ACME support for PBS
@ 2021-04-22 14:01 Wolfgang Bumiller
  2021-04-22 14:01 ` [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema Wolfgang Bumiller
  0 siblings, 1 reply; 11+ messages in thread
From: Wolfgang Bumiller @ 2021-04-22 14:01 UTC (permalink / raw)
  To: pbs-devel

Version 2 of this addresses a few raised issues:

NOTE: The widget-toolkit patch from v1 is still required. I just did not
re-send it now.

* The config file format parser does not use serde anymore as we
  a) don't need it as we have a lot of ready-to-go parsing code in the
     proxmox crate that is now being reused.
  b) is harder to read and the benefits are mostly performance related,
     while more useful things such as using structs for property strings
     in the format really would instead need more formal support on the
     schema side...

* Rebased the acme client to use the new `SimpleHttp` client.
  * and ported the changes to add the user agent string to the new api

* Fixes a few issues found by Dominic:
  * create the acme related directories if they do not exist yet
  * pipe dns plugin command output to the task log
  * made the account name optional in the register api call (since
  * pve/pmg do it too)

* Fixed a warning about a missing semicolon in the ui code.

The original patch 4 (tools/http helper) was dropped and is replaced by
patches 15 & 16. I added the main changes outlined above as separate
patches and only merged minor cleanup/style fixups into the existing
patches.

-- Original cover letter:

Reusing the ACME UI elements from the widget toolkit and therefore
providing a compatible API and pretty much the same config file layout.

Contains the async version of the acme client directly in the tree here,
though it may also be an option to move it to proxmox-acme-rs w/ a
feature-gate. (The code is also very similar to the sync version so
there's a possibility that the implementation could be wrapped in a
macro...)

The series starts out with some helpers & refactoring, followed by a
serde-driven config file format read/writer (meant to be (or become)
compatible to what we have in perl via PVE::JSONSchema::parse_config,
but without the json::Value intermediate step), followed by the config,
client & api call implementation.

(Wildcard support like stoiko just added to PMG still needs to be added,
though...)

Wolfgang Bumiller (27):
  systemd: add reload_unit
  add dns alias schema
  tools::fs::scan_subdir: use nix::Error instead of anyhow
  config: factor out certificate writing
  CertInfo: add not_{after,before}_unix
  CertInfo: add is_expired_after_epoch
  tools: add ControlFlow type
  catalog shell: replace LoopState with ControlFlow
  Cargo.toml: depend on proxmox-acme-rs
  bump d/control
  config::acl: make /system/certificates a valid path
  add 'config file format' to tools::config
  add node config
  add acme config
  tools/http: dedup user agent string
  tools/http: add request_with_agent helper
  add async acme client implementation
  add config/acme api path
  add node/{node}/certificates api call
  add node/{node}/config api path
  add acme commands to proxmox-backup-manager
  implement standalone acme validation
  ui: add certificate & acme view
  daily-update: check acme certificates
  acme: create directories as needed
  acme: pipe plugin output to task log
  api: acme: make account name optional in register call

 Cargo.toml                             |   3 +
 debian/control                         |   2 +
 src/acme/client.rs                     | 672 +++++++++++++++++++++++
 src/acme/mod.rs                        |   2 +
 src/api2/config.rs                     |   2 +
 src/api2/config/acme.rs                | 725 +++++++++++++++++++++++++
 src/api2/node.rs                       |   4 +
 src/api2/node/certificates.rs          | 577 ++++++++++++++++++++
 src/api2/node/config.rs                |  81 +++
 src/api2/types/mod.rs                  |  10 +
 src/backup/catalog_shell.rs            |  18 +-
 src/bin/proxmox-backup-manager.rs      |   1 +
 src/bin/proxmox-daily-update.rs        |  30 +-
 src/bin/proxmox_backup_manager/acme.rs | 415 ++++++++++++++
 src/bin/proxmox_backup_manager/mod.rs  |   2 +
 src/config.rs                          |  55 +-
 src/config/acl.rs                      |   2 +-
 src/config/acme/mod.rs                 | 237 ++++++++
 src/config/acme/plugin.rs              | 532 ++++++++++++++++++
 src/config/node.rs                     | 225 ++++++++
 src/lib.rs                             |   2 +
 src/tools.rs                           |  12 +
 src/tools/cert.rs                      |  41 +-
 src/tools/config.rs                    | 171 ++++++
 src/tools/fs.rs                        |   2 +-
 src/tools/http.rs                      |  15 +-
 src/tools/systemd.rs                   |  11 +
 www/Makefile                           |   1 +
 www/NavigationTree.js                  |   6 +
 www/config/CertificateView.js          |  80 +++
 30 files changed, 3897 insertions(+), 39 deletions(-)
 create mode 100644 src/acme/client.rs
 create mode 100644 src/acme/mod.rs
 create mode 100644 src/api2/config/acme.rs
 create mode 100644 src/api2/node/certificates.rs
 create mode 100644 src/api2/node/config.rs
 create mode 100644 src/bin/proxmox_backup_manager/acme.rs
 create mode 100644 src/config/acme/mod.rs
 create mode 100644 src/config/acme/plugin.rs
 create mode 100644 src/config/node.rs
 create mode 100644 src/tools/config.rs
 create mode 100644 www/config/CertificateView.js

-- 
2.20.1





^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2021-04-29  7:12 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-28 16:10 [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema Dietmar Maurer
2021-04-28 16:34 ` Thomas Lamprecht
  -- strict thread matches above, loose matches on Subject: below --
2021-04-28 18:18 Dietmar Maurer
2021-04-29  6:51 ` Wolfgang Bumiller
2021-04-28 15:55 Dietmar Maurer
2021-04-29  7:12 ` Wolfgang Bumiller
2021-04-28 11:15 Dietmar Maurer
2021-04-28 11:42 ` Wolfgang Bumiller
2021-04-22 14:01 [pbs-devel] [PATCH v2 backup 00/27] Implements ACME support for PBS Wolfgang Bumiller
2021-04-22 14:01 ` [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema Wolfgang Bumiller
2021-04-28 10:26   ` Dietmar Maurer
2021-04-28 11:07     ` Wolfgang Bumiller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal