From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 8B2311FF0AF for ; Fri, 23 Oct 2026 20:58:21 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 3A0B321610; Fri, 23 Oct 2026 20:58:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wolfssl-com.20251104.gappssmtp.com; s=20251104; t=1792781877; x=1793386677; darn=lists.proxmox.com; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2oX/6Qza8sFmQQBTF6VtODeDSgQoiCrAZHczo6XeMAU=; b=dUX2VywmtoeywnVbV9Zh8NuLTHjeXZmasgTHJQO4xqprw6gg8ZvUwnmEOjRvzYSLUZ 8muHLVGAvTVIredsZm6v/srIcDJgWFiHKHW+ZwtFtUOEwqu+hF5SNpTjEyCSI5i/ZH64 FD39vRkWqSuSduKrfwoMMzQvGcaocp+1XcFoTNlmPpJdf1WXy+P+25+D/NAk3wzCI6zb NkeXPlK4unV9hMC37M7jGNMYY4+hs0YgXz907c7lIvjncS1v4LVI7RlnYZ65TWSTq3TY tLNwkpzoC7BfXeODuXDYNiWUnodkOLg8XhnYeIF3zyCvCaNakbKWS3hANFqCYWsaX5FY l8LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792781877; x=1793386677; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2oX/6Qza8sFmQQBTF6VtODeDSgQoiCrAZHczo6XeMAU=; b=LzP7mArE9Nd2cdt4DdU02YdHXl/LZJeWmWHEDPCzRIZSxnTOutrKUFJf/LqFCx2sPE 7Btc6OTX/B0AX9AawlJZSj6FQwB+33lS0tzPR5igr2Hlhbqb/II7K4AYc6G9PTvW187B TbnoXQ7rxw9zKhcb698/soXqVReAQUK/ojiWKmTR5KHeeBz4EWn3FcJq0Riwh/ywJB9m 8xDPmbxTCMM7OB+l2duf40nUvKZH1pW9P9mKcx0Wqjz8Rata+qQtt5HVCGGkBle25GWa NRHgyY3aSVyUsswnhUItv18/2WOHlEnNny11MstPhH732nN8eiDQKwGWbXCoLCMk1AKa uLFQ== X-Gm-Message-State: AFq9FYKUeyJ1yEBQFjXqPU5OMIX/4ms94434l1Bn38nvUq+jbN8OXa6m xRU+tXaOsj/jtUclnmLpZBPlWCIDmOgrSCEugl0hN1HhkpUTFjYJjK+XVhUclNtYSG/2NUEubdU jq7SJ X-Gm-Gg: AYBFou3Kpi92vRTc+HhgqR392T6qt72TIjDTH5YJZvJcUc5HMj93zcp5e0N3xMQC5HU xOKStsd5m5XaOhXRraDqlUZ6hjQm76J3/ycid8c+sgTA3IipziQTVWpzA6ghppakWWzYF+j8/z1 WA+OqVUfTh+qen1atASYNNCw2s/H0qOnnJ3q2uWv+UeqARZUC05MpsIYopridE+i+e9SD1BXwcw gUYgena0Z8UjsQ86KNZwer9yUmoj1lJUwUvzghBZZwHxEEDFHaRKVUqxD5DQzwCN5m6DIzJkwsz 59gKun301z3flo67htTFBoe9qJ6AirU3tYR48KZGiK542d+QT6UEsXa+ldMWyMWIQePHl3tBzpC d2FXSDOcKzA4RcLe48QMrb9cUniiS+HLXYvkl+rlX0YM90I6GIN25XrvpyRkdLXyhJP/xoBc+C0 QktHtJ4oPa9naS3/GlN2o7Y+WM3z/XKetRx8au1iPCipZrXtn9kNnGlAew9sxvCdJbqqiRCUCBr eo5uwIGjo+QPlnuyyyakVVSvFDEFmG+zLNtPr2xfZoLLMC2X/bXrOARmuHtTsPvEXcd3h2nuYmq +bLrS0Uab1oih9VuibOAAbE4SlQ/4Th4auuxknnY+2CJ+k2/WsIRnHVY7wvjFCifLgo1mZQuJci oYzk04ugxF2DZvzR5OajE7+KyMK5F7G464+pH2T+6gonR+mJQnBNHvcZnUIHUbdqjfUj1baSJ X-Received: by 2002:a17:90b:35c6:b0:3ac:8897:7baa with SMTP id 98e67ed59e1d1-3adeae64f23mr134337a91.40.1792781877054; Fri, 23 Oct 2026 11:57:57 -0700 (PDT) From: Mark Atwood To: pve-devel@lists.proxmox.com Subject: [PATCH access-control] csrf: drop leftover SHA-1 token fallback Date: Fri, 23 Oct 2026 11:57:55 -0700 Message-ID: <20261023185755.541328-1-mark@wolfssl.com> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.000 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DMARC_PASS -0.1 DMARC pass policy RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: TLUCE6KQKBJDJQ56LVVRNNYRPO3KXZHR X-Message-ID-Hash: TLUCE6KQKBJDJQ56LVVRNNYRPO3KXZHR X-MailFrom: mark@wolfssl.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: verify_csrf_prevention_token still derives a SHA-1 based secret from the www key and switches to it for tokens with a 27 character signature, as issued by PVE 5 and older. This fallback stopped working when pve-common commit ff39327 ("ticket: remove fallback for SHA1-base64 CSRF prevention tokens") made PVE::Ticket::verify_csrf_prevention_token always compute an HMAC-SHA-256, whose 43 character signature can never match a 27 character one. Such tokens are therefore rejected either way, and the build dependency on libpve-common-perl (>= 9.1.11) already pulls in that change. Remove the dead code, including the FIXME that asked for its removal with PVE 7. This also drops the last SHA-1 use from CSRF handling. Signed-off-by: Mark Atwood --- src/PVE/AccessControl.pm | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index 8879ab8..68c253b 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -322,12 +322,10 @@ sub pve_verify_tokenid { } my $csrf_prevention_secret; -my $csrf_prevention_secret_legacy; my $get_csrfr_secret = sub { if (!$csrf_prevention_secret) { my $input = PVE::Tools::file_get_contents($pve_www_key_fn); $csrf_prevention_secret = Digest::SHA::hmac_sha256_base64($input); - $csrf_prevention_secret_legacy = Digest::SHA::sha1_base64($input); } return $csrf_prevention_secret; }; @@ -345,15 +343,6 @@ sub verify_csrf_prevention_token { my $secret = $get_csrfr_secret->(); - # FIXME: remove with PVE 7 and/or refactor all into PVE::Ticket ? - if ($token =~ m/^([A-Z0-9]{8}):(\S+)\z/) { - my $sig = $2; - if (length($sig) == 27) { - # the legacy secret got populated by above get_csrfr_secret call - $secret = $csrf_prevention_secret_legacy; - } - } - return PVE::Ticket::verify_csrf_prevention_token( $secret, $username, $token, -$auth_graceperiod, $ticket_lifetime, $noerr, ); base-commit: dff26b458651b4e1141ff0a41a296d2904b16228 -- 2.55.0