From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 4DA5C1FF09B for ; Mon, 28 Sep 2026 09:16:42 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id A99CE218C4; Mon, 28 Sep 2026 09:15:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790340459; x=1790945259; darn=lists.proxmox.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=FVnuyJELjo0Zxw26cWv59cI3xIKaaZJDI4VywBqA2pg=; b=LgyQC6C7fnhl8CHIB7IB6xRwKwiXv6f7uN62gYj0XxXXnf2kyv1FKRwaN+654DBpqs fZDXiiAOJY1LaB3LV33c7TVhneCLW8LF/0MicmK9VSszbwMVBvVA1dCTlZYcQ5JbSSKh PNolaIYqeR6iExEzp52y2Dz0711wMt/l9+nm+97nSqGKwz/g43KrPCvJFXRljWJ6afPR fjK/GiFF1cTYCXtQW83hbcw7kOfeI2He+N5kbOrVvuHjPUDLcvXGJbQksw1XvjVmao0Z pZZPNly1akhAXyXnGjBsEYz4N+b+I6JaETRkC6vY9KuSc9T3vN8xwCHWIOvxZtytvoWL SmpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790340459; x=1790945259; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=FVnuyJELjo0Zxw26cWv59cI3xIKaaZJDI4VywBqA2pg=; b=rR2bOMschXpcoAbg5Gc5RZjsxpIdegPINOO5pftIiWWR14m920IvVYoxGpYeonE1AM SiZ/sqUFg2+OckRxv0buHAeXqxiqczGaF0e/lDbkqwYHsqDujmneWfW0qF6W8wPDIvOM VXUTULN9u3yGIbfk6NYzKbm8h9/r/wcSOqd9kcQxkdM7ruzvsDD40glMK1xrMGiZpd4N mRUfqoMY5q7wrQXKledMLlSXlQ4enTO7WtL4/RwIQd8WhuEXlfJojf9jEFvjefwEeVnO 3Qn4UHCZpwvHXblP3Z+zpf22Xu+A/Tdh/VwO9WiGZbkKjXNB+RLuLiYc/hZNY60Q8duD YkNA== X-Gm-Message-State: AFuF++niJv6TqxpFjnSJd43uRoFFUkvwU7XYLNJe8wL0RD3desVv1bUb won11yi/stR/8cz6nZ9nxwvHf6SBWPpQZ+MWxDKqFAjkvGiGfeaVAU5zWmLdpF69 X-Gm-Gg: AYBFou2T4+6BipkxJqmGWwLU6cNIFoEX5GajOA6rzvkWfk+vuY6NVN2QMXIXml60hht Iz8yXtC7Z4mBzDCumvVimX0HcHQxDRBfMReJrmGARslL4NwNQHL/LU2tie0sTNsNte78AHPgPLy kwHJGCB3S3Ockbw7yKZkFhRjpfiOdA9/1zVLxYBO8LgejL8+08qepAfP1Me9k2t1QYJcVa4opIu iwMYQ0KweVOvyTpQzHz9a6K1UXsM9OuiH/+AopJAaFvOjvmFghVcH5nGWdaSQbHLgiOJBpx9Srj cn/9gLtXm8X0Ux4vW67MxiUrflent23rpKANRuKoua+BuzgYnlY5AXHQGZUd3VPo831K8Uy/wTc jSwTRgINjWkpmVs7NuJMZVRlPn95oMB+Rpq6xl6buZDE4zEiByzBpkw53wPpEJR1HI5BscQ/IoY chQmUZGoYiLMVwW/6dvb2OAp79Nyf3DZPI+5Grr+O7ep+KLYJzwerQ/oFVVhbpAG0ZpEdb6aEl+ u9iRPQyBZIJR7PM5NwvbaI/U323wPTrfDuMrpCmIyyt1CRsYw== X-Received: by 2002:a5d:6f1c:0:b0:487:27f9:83b with SMTP id ffacd0b85a97d-48871718605mr10298585f8f.48.1790340459023; Fri, 25 Sep 2026 05:47:39 -0700 (PDT) From: Mathias Bartmann To: pve-devel@lists.proxmox.com Subject: [PATCH proxmox-acme 1/3] fix #7851: acme: add missing _mktemp and restore _dbase64 default Date: Fri, 25 Sep 2026 14:47:35 +0200 Message-ID: <20260925124737.42866-2-mathias.bartmann@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260925124737.42866-1-mathias.bartmann@gmail.com> References: <20260925124737.42866-1-mathias.bartmann@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.500 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FORGED_GMAIL_RCVD 1 'From' gmail.com does not match 'Received' headers FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: mathias.bartmann@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: M3BZH3QTGHI4JRNWAA4OLFJRUSEEMIYP X-Message-ID-Hash: M3BZH3QTGHI4JRNWAA4OLFJRUSEEMIYP X-Mailman-Approved-At: Mon, 28 Sep 2026 09:14:43 +0200 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The dns_oci.sh plugin cannot complete a DNS-01 challenge, because of two helpers in the proxmox-acme shim that differ from upstream acme.sh: _dbase64() only implements upstream's multiline branch and ignores its argument. Upstream decodes with '-A' by default and only drops it when called as '_dbase64 multiline'. dns_oci.sh calls it without argument to decode the single-line base64 private key, so the key decodes to an empty string ("Usage: _fingerprint privkey"). Restore the upstream conditional; dns_cyon.sh, dns_nic.sh and dns_yc.sh pass 'multiline' and keep their current behaviour. _mktemp() is not defined at all. dns_oci.sh writes the key to a temporary file to sign its requests, so every request goes out unsigned, and OCI's 404 then surfaces as the misleading "DNS Zone not found". dns_transip.sh uses _mktemp the same way. Add a test that runs these helpers through the shim and compares them with upstream semantics. Signed-off-by: Mathias Bartmann --- src/proxmox-acme | 11 ++++++++++- src/test/Makefile | 2 +- src/test/test-shim-helpers | 34 ++++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 2 deletions(-) create mode 100755 src/test/test-shim-helpers diff --git a/src/proxmox-acme b/src/proxmox-acme index 705f7df..00f4c06 100644 --- a/src/proxmox-acme +++ b/src/proxmox-acme @@ -15,8 +15,17 @@ _base64() { openssl base64 -e | tr -d '\r\n' } +#Usage: multiline _dbase64() { - openssl base64 -d + if [ "$1" ]; then + openssl base64 -d + else + openssl base64 -d -A + fi +} + +_mktemp() { + mktemp } # Usage: hashalg [outputhex] diff --git a/src/test/Makefile b/src/test/Makefile index bfa8991..b6044c6 100644 --- a/src/test/Makefile +++ b/src/test/Makefile @@ -1,6 +1,6 @@ .PHONY: test test-missing-functions -test: verify-dnsapi-plugins-in-schema.pl.t verify-acme-sources-in-makefile.pl.t test-missing-functions +test: verify-dnsapi-plugins-in-schema.pl.t verify-acme-sources-in-makefile.pl.t test-shim-helpers.t test-missing-functions %.t: % ./$< diff --git a/src/test/test-shim-helpers b/src/test/test-shim-helpers new file mode 100755 index 0000000..b625a53 --- /dev/null +++ b/src/test/test-shim-helpers @@ -0,0 +1,34 @@ +#!/bin/sh + +# Check that helpers in src/proxmox-acme behave like their acme.sh upstream +# counterparts, as the dnsapi plugins are synced unmodified from there. + +SHIM="bash ../proxmox-acme" +FAILED=0 + +fail() { + echo "FAIL: $1" >&2 + FAILED=1 +} + +# a single base64 line longer than openssl's 64 character line limit, like +# the base64-encoded private key dns_oci.sh decodes with a plain _dbase64 +PLAIN=$(head -c 1500 /dev/zero | tr '\0' 'x') +SINGLE_LINE=$(printf '%s' "$PLAIN" | openssl base64 -e | tr -d '\n') +WRAPPED=$(printf '%s' "$PLAIN" | openssl base64 -e) + +[ "$(printf '%s' "$SINGLE_LINE" | $SHIM _dbase64)" = "$PLAIN" ] || + fail "_dbase64 without argument does not decode a single long line" + +[ "$(printf '%s\n' "$WRAPPED" | $SHIM _dbase64 multiline)" = "$PLAIN" ] || + fail "_dbase64 multiline does not decode line-wrapped input" + +TMP_FILE=$($SHIM _mktemp) +if [ -f "$TMP_FILE" ] && [ -w "$TMP_FILE" ]; then + rm -f "$TMP_FILE" +else + fail "_mktemp does not create a writable temporary file" +fi + +[ "$FAILED" -eq 0 ] || exit 1 +echo "OK: proxmox-acme helpers behave like upstream acme.sh." -- 2.55.0