proxmox-mirrors/proxmox-acme
1
0
Fork 0
mirror of https://git.proxmox.com/git/proxmox-acme synced 2025-04-28 14:01:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

eba: support decoding MAC key provided in base64url format

Browse Source 
According to RFC 8555:

> The MAC key SHOULD be provided in base64url-encoded form...

However, currently we are only decoding the MAC key as base64.
This patch chooses the correct function to decode the user provided
MAC key. This can fix authentication error when a user uses command
`pvenode acme account register` and paste the EBA MAC key as prompted.

Signed-off-by: YU Jincheng <shana@zju.edu.cn>
Tested-by: Folke Gleumes <f.gleumes@proxmox.com>
 [ TL: fix typo in message, reword subject ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
YU Jincheng 2024-01-25 16:28:01 +08:00 committed by Thomas Lamprecht
parent a75d50b847
commit 5cff218218
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/PVE/ACME.pm
View File

@ -7,7 +7,7 @@ use POSIX;
use Data::Dumper;
use Date::Parse;
use MIME::Base64 qw(encode_base64url decode_base64);
use MIME::Base64 qw(encode_base64url decode_base64 decode_base64url);
use File::Path qw(make_path);
use JSON;
use Digest::SHA qw(sha256 sha256_hex hmac_sha256);
@ -365,7 +365,12 @@ sub new_account {
my %payload = ( contact => $info{contact} );
if (defined($info{eab})) {
my $eab_hmac_key = decode_base64($info{eab}->{hmac_key});
my $eab_hmac_key;
if ($info{eab}->{hmac_key} =~ m/[+\/]/) {
$eab_hmac_key = decode_base64($info{eab}->{hmac_key});
} else {
$eab_hmac_key = decode_base64url($info{eab}->{hmac_key});
}
$payload{externalAccountBinding} = external_account_binding_jws(
$info{eab}->{kid},
$eab_hmac_key,