[pmg-devel] [PATCH acme 0/1] Fix EBA MAC key decoding

[pmg-devel] [PATCH acme 0/1] Fix EBA MAC key decoding

[LoveSy]

Accroding to RFC 8555:
> The MAC key SHOULD be provided in base64url-encoded form...

However, currently we are only decoding the MAC key as base64.
This patch uses the correct function to decode the user provided
MAC key as base64url format.

 src/PVE/ACME.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.39.3 (Apple Git-145)

[pmg-devel] [PATCH acme 1/1] Fix EBA MAC key decoding

[LoveSy]

From: YU Jincheng <shana@zju.edu.cn>

Accroding to RFC 8555:
> The MAC key SHOULD be provided in base64url-encoded form...

However, currently we are only decoding the MAC key as base64.
This patch uses the correct function to decode the user provided
MAC key as base64url format.

Signed-off-by: YU Jincheng <shana@zju.edu.cn>
---
 src/PVE/ACME.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index bf5410d..428cdda 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -7,7 +7,7 @@ use POSIX;
 
 use Data::Dumper;
 use Date::Parse;
-use MIME::Base64 qw(encode_base64url decode_base64);
+use MIME::Base64 qw(encode_base64url decode_base64url);
 use File::Path qw(make_path);
 use JSON;
 use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
@@ -365,7 +365,7 @@ sub new_account {
     my %payload = ( contact => $info{contact} );
 
     if (defined($info{eab})) {
-	my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
+	my $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
 	$payload{externalAccountBinding} = external_account_binding_jws(
 	    $info{eab}->{kid},
 	    $eab_hmac_key,
-- 
2.39.3 (Apple Git-145)

Re: [pmg-devel] [PATCH acme 1/1] Fix EBA MAC key decoding

[Fiona Ebner]

Am 16.01.24 um 18:43 schrieb LoveSy:
> From: YU Jincheng <shana@zju.edu.cn>
>

Thank you for the contribution!

> Accroding to RFC 8555:
>> The MAC key SHOULD be provided in base64url-encoded form...
> 
> However, currently we are only decoding the MAC key as base64.
> This patch uses the correct function to decode the user provided
> MAC key as base64url format.
> 

The encoding is already done with encode_base64url(). Your change is for
the MAC provided via the Proxmox API, so it doesn't necessarily need to
adhere to the RFC. If it's a backwards-compatible change, it can still
be worth it of course.

> Signed-off-by: YU Jincheng <shana@zju.edu.cn>
> ---
>  src/PVE/ACME.pm | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 

If I'm not missing something, PMG doesn't use this implementation but a
Rust-based one, see:
https://git.proxmox.com/?p=pmg-api.git;a=blob;f=src/PMG/API2/ACME.pm;h=1eab74da209f97460b3ef584b2bb8eba7b19e6ec;hb=HEAD#l153
https://git.proxmox.com/?p=proxmox-perl-rs.git;a=blob;f=pmg-rs/src/acme.rs;h=06281da6f2955475f2e85023e3241e496c4c7eba;hb=27a7f2e2529770de8802ce92bc096a67c18b9fa6
https://git.proxmox.com/?p=proxmox-acme.git;a=summary

Did you intend to send this patch to pve-devel instead, which does use
this Perl module?

If you haven't done already, you need to agree to the Harmony CLA before
we can accept your contribution:

https://pve.proxmox.com/wiki/Developer_Documentation#Software_License_and_Copyright

> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index bf5410d..428cdda 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -7,7 +7,7 @@ use POSIX;
>  
>  use Data::Dumper;
>  use Date::Parse;
> -use MIME::Base64 qw(encode_base64url decode_base64);
> +use MIME::Base64 qw(encode_base64url decode_base64url);
>  use File::Path qw(make_path);
>  use JSON;
>  use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
> @@ -365,7 +365,7 @@ sub new_account {
>      my %payload = ( contact => $info{contact} );
>  
>      if (defined($info{eab})) {
> -	my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
> +	my $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
>  	$payload{externalAccountBinding} = external_account_binding_jws(
>  	    $info{eab}->{kid},
>  	    $eab_hmac_key,