[pve-devel] [PATCH acme] Fix EBA MAC key decoding

[pve-devel] [PATCH acme] Fix EBA MAC key decoding

[YU Jincheng]

Accroding to RFC 8555:
> The MAC key SHOULD be provided in base64url-encoded form...

However, currently we are only decoding the MAC key as base64.
This patch uses the correct function to decode the user provided
MAC key as base64url format. This can fix authentication error
when a user uses command `pvenode acme account register` and paste
the EBA MAC key as prompted.

Signed-off-by: YU Jincheng <shana@zju.edu.cn>
---
 src/PVE/ACME.pm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index bf5410d..428cdda 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -7,7 +7,7 @@ use POSIX;
 
 use Data::Dumper;
 use Date::Parse;
-use MIME::Base64 qw(encode_base64url decode_base64);
+use MIME::Base64 qw(encode_base64url decode_base64url);
 use File::Path qw(make_path);
 use JSON;
 use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
@@ -365,7 +365,7 @@ sub new_account {
     my %payload = ( contact => $info{contact} );
 
     if (defined($info{eab})) {
-	my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
+	my $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
 	$payload{externalAccountBinding} = external_account_binding_jws(
 	    $info{eab}->{kid},
 	    $eab_hmac_key,
-- 
2.39.3 (Apple Git-145)

Re: [pve-devel] [PATCH acme] Fix EBA MAC key decoding

[Folke Gleumes]

Hey,

thanks for contributing!

Your right, the RFC suggests that the key the user supplies should be
interpreted as base64url and not base64. Since I'm not the first and
probably won't be the last to run into this mistake, I wonder if it
might be worth to be a bit more lenient and implement a simple check on
the '/' and '+' characters, to check if base64 or base64url has been
used to encode the key.

Tested-By: Folke Gleumes <f.gleumes@proxmox.com>

On Thu, 2024-01-18 at 18:40 +0800, YU Jincheng wrote:
> Accroding to RFC 8555:
> > The MAC key SHOULD be provided in base64url-encoded form...
> 
> However, currently we are only decoding the MAC key as base64.
> This patch uses the correct function to decode the user provided
> MAC key as base64url format. This can fix authentication error
> when a user uses command `pvenode acme account register` and paste
> the EBA MAC key as prompted.
> 
> Signed-off-by: YU Jincheng <shana@zju.edu.cn>
> ---
>  src/PVE/ACME.pm | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index bf5410d..428cdda 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -7,7 +7,7 @@ use POSIX;
>  
>  use Data::Dumper;
>  use Date::Parse;
> -use MIME::Base64 qw(encode_base64url decode_base64);
> +use MIME::Base64 qw(encode_base64url decode_base64url);
>  use File::Path qw(make_path);
>  use JSON;
>  use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
> @@ -365,7 +365,7 @@ sub new_account {
>      my %payload = ( contact => $info{contact} );
>  
>      if (defined($info{eab})) {
> -       my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
> +       my $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
>         $payload{externalAccountBinding} =
> external_account_binding_jws(
>             $info{eab}->{kid},
>             $eab_hmac_key,

[pve-devel] [PATCH v2 acme] Fix EBA MAC key decoding

[YU Jincheng]

Accroding to RFC 8555:

> The MAC key SHOULD be provided in base64url-encoded form...

However, currently we are only decoding the MAC key as base64.
This patch chooses the correct function to decode the user provided
MAC key. This can fix authentication error when a user uses command
`pvenode acme account register` and paste the EBA MAC key as prompted.

Signed-off-by: YU Jincheng <shana@zju.edu.cn>
---
 src/PVE/ACME.pm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index bf5410d..65094c2 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -7,7 +7,7 @@ use POSIX;
 
 use Data::Dumper;
 use Date::Parse;
-use MIME::Base64 qw(encode_base64url decode_base64);
+use MIME::Base64 qw(encode_base64url decode_base64 decode_base64url);
 use File::Path qw(make_path);
 use JSON;
 use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
@@ -365,7 +365,12 @@ sub new_account {
     my %payload = ( contact => $info{contact} );
 
     if (defined($info{eab})) {
-	my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
+	my $eab_hmac_key;
+	if ($info{eab}->{hmac_key} =~ m/[+\/]/) {
+	    $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
+	} else {
+	    $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
+	}
 	$payload{externalAccountBinding} = external_account_binding_jws(
 	    $info{eab}->{kid},
 	    $eab_hmac_key,
-- 
2.34.1

Re: [pve-devel] [PATCH v2 acme] Fix EBA MAC key decoding

[Folke Gleumes]

On Thu, 2024-01-25 at 16:28 +0800, YU Jincheng wrote:
> Accroding to RFC 8555:
> 
> > The MAC key SHOULD be provided in base64url-encoded form...
> 
> However, currently we are only decoding the MAC key as base64.
> This patch chooses the correct function to decode the user provided
> MAC key. This can fix authentication error when a user uses command
> `pvenode acme account register` and paste the EBA MAC key as
> prompted.
> 
> Signed-off-by: YU Jincheng <shana@zju.edu.cn>
> ---
>  src/PVE/ACME.pm | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index bf5410d..65094c2 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -7,7 +7,7 @@ use POSIX;
>  
>  use Data::Dumper;
>  use Date::Parse;
> -use MIME::Base64 qw(encode_base64url decode_base64);
> +use MIME::Base64 qw(encode_base64url decode_base64
> decode_base64url);
>  use File::Path qw(make_path);
>  use JSON;
>  use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
> @@ -365,7 +365,12 @@ sub new_account {
>      my %payload = ( contact => $info{contact} );
>  
>      if (defined($info{eab})) {
> -       my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
> +       my $eab_hmac_key;
> +       if ($info{eab}->{hmac_key} =~ m/[+\/]/) {
> +           $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
> +       } else {
> +           $eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
> +       }
>         $payload{externalAccountBinding} =
> external_account_binding_jws(
>             $info{eab}->{kid},
>             $eab_hmac_key,

Thanks!

Works as intended, tested with base64, base64url and strings that would
be valid for both.

Tested-by: Folke Gleumes <f.gleumes@proxmox.com>

[pve-devel] applied: [PATCH v2 acme] Fix EBA MAC key decoding

[Thomas Lamprecht]

Am 25/01/2024 um 09:28 schrieb YU Jincheng:
> Accroding to RFC 8555:
> 
>> The MAC key SHOULD be provided in base64url-encoded form...
> 
> However, currently we are only decoding the MAC key as base64.
> This patch chooses the correct function to decode the user provided
> MAC key. This can fix authentication error when a user uses command
> `pvenode acme account register` and paste the EBA MAC key as prompted.
> 
> Signed-off-by: YU Jincheng <shana@zju.edu.cn>
> ---
>  src/PVE/ACME.pm | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
>

applied, with Folke's T-b, thanks!

I fixed a small typo in the commit message and while at it I
reworded the commit subject to better fit our style (and to make
it easier to write a debian/changelog entry from this).