[pve-devel] [PATCH v4 pve-storage] fix #6900: correctly detect PBS API tokens in storage plugin

* [pve-devel] [PATCH v4 pve-storage] fix #6900: correctly detect PBS API tokens in storage plugin
@ 2025-11-20 13:09 Robert Obkircher
  2025-11-20 14:06 ` [pve-devel] applied: " Thomas Lamprecht
  0 siblings, 1 reply; 2+ messages in thread
From: Robert Obkircher @ 2025-11-20 13:09 UTC (permalink / raw)
  To: pve-devel

The PBS storage plugin used PVE code to detect if an API token was
entered in the username field. This lead to bad requests for some
valid PBS tokens which are not valid PVE tokens. Examples are
"root@pam!1234" and "root@pam!_-".

Relax the token pattern to allow token names and realms that start
with numbers or underscores. Also allow single character token names,
which are allowed on the backend even though they can't be created
through the PBS Web UI.

Signed-off-by: Robert Obkircher <r.obkircher@proxmox.com>
---
Changes in v4:
- drop commented out Rust code
- comment why the regexes are necessary and where they come from

Changes in v3: 
- drop importing now unused PVE::Auth::Plugin module

Changes in v2:
- port all regexes, not just the token name


 src/PVE/Storage/PBSPlugin.pm | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/PVE/Storage/PBSPlugin.pm b/src/PVE/Storage/PBSPlugin.pm
index 5842004..1e0e038 100644
--- a/src/PVE/Storage/PBSPlugin.pm
+++ b/src/PVE/Storage/PBSPlugin.pm
@@ -701,6 +701,20 @@ my sub snapshot_files_encrypted {
     return $any && $all;
 }
 
+# We cannot use the PVE API token regexes as we're stricter in PVE,
+# so some tokens that would be valid for PBS would get rejected.
+# Adapt over the PBS ones from proxmox-auth-api/src/types.rs:
+
+my $safe_id_regex = qr/(?:[A-Za-z0-9_][A-Za-z0-9\._\-]*)/;
+
+my $token_name_regex = $safe_id_regex;
+
+my $user_name_regex = qr/(?:[^\s:\/\p{PosixCntrl}]+)/;
+
+my $user_id_regex = qr/${user_name_regex}\@${safe_id_regex}/;
+
+my $apitoken_id_regex = qr/${user_id_regex}\!${token_name_regex}/;
+
 # TODO: use a client with native rust/proxmox-backup bindings to profit from
 # API schema checks and types
 my sub pbs_api_connect {
@@ -710,8 +724,8 @@ my sub pbs_api_connect {
 
     my $user = $scfg->{username} // 'root@pam';
 
-    if (my $tokenid = PVE::AccessControl::pve_verify_tokenid($user, 1)) {
-        $params->{apitoken} = "PBSAPIToken=${tokenid}:${password}";
+    if ($user =~ qr/^${apitoken_id_regex}$/) {
+        $params->{apitoken} = "PBSAPIToken=${user}:${password}";
     } else {
         $params->{password} = $password;
         $params->{username} = $user;
-- 
2.47.3



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


^ permalink raw reply	[flat|nested] 2+ messages in thread