From: Fiona Ebner <f.ebner@proxmox.com>
To: LoveSy <shana@zju.edu.cn>, pmg-devel@lists.proxmox.com
Subject: Re: [pmg-devel] [PATCH acme 1/1] Fix EBA MAC key decoding
Date: Thu, 18 Jan 2024 10:31:00 +0100 [thread overview]
Message-ID: <dbd9d449-0f75-459c-bb9d-b0544bdf11ed@proxmox.com> (raw)
In-Reply-To: <20240116174328.75567-2-shana@zju.edu.cn>
Am 16.01.24 um 18:43 schrieb LoveSy:
> From: YU Jincheng <shana@zju.edu.cn>
>
Thank you for the contribution!
> Accroding to RFC 8555:
>> The MAC key SHOULD be provided in base64url-encoded form...
>
> However, currently we are only decoding the MAC key as base64.
> This patch uses the correct function to decode the user provided
> MAC key as base64url format.
>
The encoding is already done with encode_base64url(). Your change is for
the MAC provided via the Proxmox API, so it doesn't necessarily need to
adhere to the RFC. If it's a backwards-compatible change, it can still
be worth it of course.
> Signed-off-by: YU Jincheng <shana@zju.edu.cn>
> ---
> src/PVE/ACME.pm | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
If I'm not missing something, PMG doesn't use this implementation but a
Rust-based one, see:
https://git.proxmox.com/?p=pmg-api.git;a=blob;f=src/PMG/API2/ACME.pm;h=1eab74da209f97460b3ef584b2bb8eba7b19e6ec;hb=HEAD#l153
https://git.proxmox.com/?p=proxmox-perl-rs.git;a=blob;f=pmg-rs/src/acme.rs;h=06281da6f2955475f2e85023e3241e496c4c7eba;hb=27a7f2e2529770de8802ce92bc096a67c18b9fa6
https://git.proxmox.com/?p=proxmox-acme.git;a=summary
Did you intend to send this patch to pve-devel instead, which does use
this Perl module?
If you haven't done already, you need to agree to the Harmony CLA before
we can accept your contribution:
https://pve.proxmox.com/wiki/Developer_Documentation#Software_License_and_Copyright
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index bf5410d..428cdda 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -7,7 +7,7 @@ use POSIX;
>
> use Data::Dumper;
> use Date::Parse;
> -use MIME::Base64 qw(encode_base64url decode_base64);
> +use MIME::Base64 qw(encode_base64url decode_base64url);
> use File::Path qw(make_path);
> use JSON;
> use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
> @@ -365,7 +365,7 @@ sub new_account {
> my %payload = ( contact => $info{contact} );
>
> if (defined($info{eab})) {
> - my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
> + my $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
> $payload{externalAccountBinding} = external_account_binding_jws(
> $info{eab}->{kid},
> $eab_hmac_key,
prev parent reply other threads:[~2024-01-18 9:31 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-16 17:43 [pmg-devel] [PATCH acme 0/1] " LoveSy
2024-01-16 17:43 ` [pmg-devel] [PATCH acme 1/1] " LoveSy
2024-01-18 9:31 ` Fiona Ebner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dbd9d449-0f75-459c-bb9d-b0544bdf11ed@proxmox.com \
--to=f.ebner@proxmox.com \
--cc=pmg-devel@lists.proxmox.com \
--cc=shana@zju.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox