From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 540981FF0EA for ; Fri, 14 Aug 2026 16:26:53 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D312D22626; Fri, 14 Aug 2026 16:26:52 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 14 Aug 2026 16:26:49 +0200 Message-Id: Subject: Re: [PATCH common v4 1/3] fix #5978: pem parser: relax parsing of chain entries From: "Elias Huhsovitz" To: "Thomas Ellmenreich" , X-Mailer: aerc 0.20.0 References: <20260805141114.190477-1-t.ellmenreich@proxmox.com> <20260805141114.190477-2-t.ellmenreich@proxmox.com> In-Reply-To: <20260805141114.190477-2-t.ellmenreich@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1786717590485 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.146 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: D2JI4BCWLHP6HKGBZ423PYWCVQGQ4J45 X-Message-ID-Hash: D2JI4BCWLHP6HKGBZ423PYWCVQGQ4J45 X-MailFrom: e.huhsovitz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Good refresh. IMO the iterative approach is much easier to maintain, than the previous recurive solution. Testing ------- I tested this by setting up a local Pebble ACME server and successfully ordering certificates. To verify the relaxed parsing, I injected fake interleaved text into the ACME response that the parser=20 correctly strips it and accepts the chain. Additionally I manually malformed the header/footer of the certificate which correctly throws an error. Everything seemes to work as intended. Consider this. Reviewed-by: Elias Huhsovitz Tested-by: Elias Huhsovitz On Wed Aug 5, 2026 at 4:11 PM CEST, Thomas Ellmenreich wrote: > Relaxes the parser to allow for text and whitespaces inbetween certchain > entries. The splitting of PEM chains was also reworked to split each entr= y at > its end, grouping it with its leading text. > > Signed-off-by: Thomas Ellmenreich > --- > src/PVE/Certificate.pm | 39 +++++++++++++++++++++++++++++++-------- > 1 file changed, 31 insertions(+), 8 deletions(-) > > diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm > index b8415e2..53619a3 100644 > --- a/src/PVE/Certificate.pm > +++ b/src/PVE/Certificate.pm > @@ -134,26 +134,49 @@ sub strip_leading_text { > return $content; > } > =20 > +# Splits the pem chain into entries with their leading text > sub split_pem { > my ($content, %opts) =3D @_; > - my $label =3D $opts{label} // 'CERTIFICATE'; > =20 > - my $header =3D $header_re->($label); > - return split(/(?=3D$header)/, $content); > + my $footer =3D $footer_re->($opts{label} // 'CERTIFICATE'); > + > + return $content =3D~ /(.*?$footer)/sg; > } > =20 > +# Parses the pem or pem chain for complete validity and returns > +# only the pem/pem chain removing any extra text > sub check_pem { > my ($content, %opts) =3D @_; > =20 > - $content =3D strip_leading_text($content); > + my $label =3D $opts{label} // 'CERTIFICATE'; > + my $re =3D $pem_re->($label); > + > + my @split =3D > + $opts{multiple} > + ? split_pem($content, label =3D> $label) > + : ($content); > =20 > - my $re =3D $pem_re->($opts{label} // 'CERTIFICATE'); > - $re =3D qr/($re\n+)*$re/ if $opts{multiple}; > + if (!@split) { > + return undef if $opts{noerr}; > + die "PEM chain could not be split into separate entries\n"; > + } > + > + my $result_pem =3D ""; > + for my $entry (@split) { > + my $stripped =3D strip_leading_text($entry); > + > + if ($stripped !~ /^$re$/) { > + $result_pem =3D ""; > + last; > + } > + > + $result_pem .=3D $stripped; > + } > =20 > - return $content if $content =3D~ /^$re$/; # OK > + return $result_pem if $result_pem; > =20 > return undef if $opts{noerr}; > - die "not a valid PEM-formatted string.\n"; > + die "not a valid PEM-formatted string\n"; > } > =20 > sub pem_to_der {