From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 1BE5A1FF0DF for ; Thu, 05 Nov 2026 14:32:12 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4B548215A1; Thu, 05 Nov 2026 14:32:09 +0100 (CET) Date: Thu, 05 Nov 2026 14:32:00 +0100 From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= Subject: applied-series: [PATCH common/proxmox-acme v4 0/3] fix #5978: pem parser: relax parsing of chain entries To: pve-devel@lists.proxmox.com, Thomas Ellmenreich References: <20260805141114.190477-1-t.ellmenreich@proxmox.com> In-Reply-To: <20260805141114.190477-1-t.ellmenreich@proxmox.com> MIME-Version: 1.0 User-Agent: astroid/0.17.0 (https://github.com/astroidmail/astroid) Message-Id: <1793885504.bskbk5fxyp.astroid@yuna.none> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793885523068 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.613 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: B7ETWOK5YTBY7VYNDEUFZSN5UFG63YHN X-Message-ID-Hash: B7ETWOK5YTBY7VYNDEUFZSN5UFG63YHN X-MailFrom: f.gruenbichler@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: with a tiny test follow-up in common On August 5, 2026 4:11 pm, Thomas Ellmenreich wrote: > According to RFC 8555, expected certchains should come > without whitespace or explanatory texts inbetween chain > entries. These two patches relax our parser to also > accept text or whitespaces inbetween chain entries. >=20 > To make sure that the acme changes work as expected I > setup the pebble acme server [1] locally, and worked > through the acme flow to get a new certificate. I then > manually modified the final certificate to contain > descriptive text which worked without issues. >=20 > changes since v3: > - check_pem was reworked to not be recursive >=20 > - the check_pem tests now also check the erroring version to > make sure that an exception is thrown >=20 > - moved the tests to their own commit >=20 > - wrapped the error message produced by check_pem when > called in proxmox-acme with chomp to avoid double newlines >=20 > - corrected the capitalization of different acronyms >=20 > changes since v2: > - cleaner implementation and correction of mistakes in > check_pem in pve-common >=20 > - get_certificate in proxmox-acme now correctly calls > check_pem with the 'multiple' option enabled >=20 > - removed ambiguity in the error messages of > get_certificate >=20 > - correction of tests, to better compare returned value > to expected value >=20 > - performed proper end-to-end test with pebble [1] >=20 > - proper formatting (hopefully) >=20 > changes since v1: > - Where in v1 check_pem was just a wrapper of split_pem, > they now perform different functions >=20 > - split_pem now purely splits the PEM chain into separate > entries and does no further validation. Returning each > entry with its leading text. >=20 > - check_pem retains the original functionality, except > when the multiple option is active, in which case it > uses split_pem to get single entries and then calls > itself recursively >=20 > - On the ACME side, errors are now captured, wrapped, > and then rethrown. >=20 > [1] https://github.com/letsencrypt/pebble >=20 >=20 > pve-common: >=20 > Thomas Ellmenreich (2): > fix #5978: pem parser: relax parsing of chain entries > pem parser: add testsuite for check_ and split_pem >=20 > src/PVE/Certificate.pm | 39 ++++- > test/Makefile | 2 + > test/check_pem_test.pl | 365 +++++++++++++++++++++++++++++++++++++++++ > test/split_pem_test.pl | 279 +++++++++++++++++++++++++++++++ > 4 files changed, 677 insertions(+), 8 deletions(-) > create mode 100755 test/check_pem_test.pl > create mode 100755 test/split_pem_test.pl >=20 >=20 > proxmox-acme: >=20 > Thomas Ellmenreich (1): > fix #5978: pem parser: relax parsing of chain entries: >=20 > src/PVE/ACME.pm | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) >=20 >=20 > Summary over all repositories: > 5 files changed, 684 insertions(+), 13 deletions(-) >=20 > --=20 > Generated by murpp 0.12.0 >=20 >=20 >=20 >=20 >=20