pbs: die if master key is missing

[pve-storage.git] / PVE / Storage / PBSPlugin.pm

diff --git a/PVE/Storage/PBSPlugin.pm b/PVE/Storage/PBSPlugin.pm
index 06ebfa76f6b6adec1dfe45731368a3d5fab86254..afc6ea408d282a6fbc4c4375b4c219bef24f4688 100644 (file)
--- a/PVE/Storage/PBSPlugin.pm
+++ b/PVE/Storage/PBSPlugin.pm
@@ -63,6 +63,7 @@ sub options {
     return {
        server => { fixed => 1 },
        datastore => { fixed => 1 },
+       namespace => { optional => 1 },
        port => { optional => 1 },
        nodes => { optional => 1},
        disable => { optional => 1},
@@ -73,6 +74,7 @@ sub options {
        'master-pubkey' => { optional => 1 },
        maxfiles => { optional => 1 },
        'prune-backups' => { optional => 1 },
+       'max-protected-backups' => { optional => 1 },
        fingerprint => { optional => 1 },
     };
 }
@@ -153,7 +155,12 @@ sub pbs_open_encryption_key {
 
     my $keyfd;
     if (!open($keyfd, '<', $encryption_key_file)) {
-       return undef if $! == ENOENT;
+       if ($! == ENOENT) {
+           my $encryption_fp = $scfg->{'encryption-key'};
+           die "encryption configured ('$encryption_fp') but no encryption key file found!\n"
+               if $encryption_fp;
+           return undef;
+       }
        die "failed to open encryption key: $encryption_key_file: $!\n";
     }
 
@@ -203,7 +210,11 @@ sub pbs_open_master_pubkey {
 
     my $keyfd;
     if (!open($keyfd, '<', $master_pubkey_file)) {
-       return undef if $! == ENOENT;
+       if ($! == ENOENT) {
+           die "master public key configured but no key file found!\n"
+               if $scfg->{'master-pubkey'};
+           return undef;
+       }
        die "failed to open master public key: $master_pubkey_file: $!\n";
     }
 
@@ -219,9 +230,15 @@ sub print_volid {
     return "${storeid}:${volname}";
 }
 
+my sub ns : prototype($$) {
+    my ($scfg, $name) = @_;
+    my $ns = $scfg->{namespace};
+    return defined($ns) ? ($name, $ns) : ();
+}
+
 # essentially the inverse of print_volid
-sub api_param_from_volname {
-    my ($class, $volname) = @_;
+my sub api_param_from_volname : prototype($$$) {
+    my ($class, $scfg, $volname) = @_;
 
     my $name = ($class->parse_volname($volname))[1];
 
@@ -243,6 +260,7 @@ sub api_param_from_volname {
     }
 
     return {
+       (ns($scfg, 'ns')),
        'backup-type' => $btype,
        'backup-id' => $bid,
        'backup-time' => $btime,
@@ -303,6 +321,9 @@ my sub do_raw_client_cmd {
     push @$cmd, @$param if defined($param);
 
     push @$cmd, "--repository", $repo;
+    if ($client_cmd ne 'status' && defined(my $ns = $scfg->{namespace})) {
+       push @$cmd, '--ns', $ns;
+    }
 
     local $ENV{PBS_PASSWORD} = pbs_get_password($scfg, $storeid);
 
@@ -601,6 +622,10 @@ sub path {
 
     # artificial url - we currently do not use that anywhere
     my $path = "pbs://$repo/$name";
+    if (defined(my $ns = $scfg->{namespace})) {
+       $ns =~ s|/|%2f|g; # other characters to escape aren't allowed in the namespace schema
+       $path .= "?ns=$ns";
+    }
 
     return ($path, $vmid, $vtype);
 }
@@ -660,6 +685,37 @@ my sub snapshot_files_encrypted {
     return $any && $all;
 }
 
+# TODO: use a client with native rust/proxmox-backup bindings to profit from
+# API schema checks and types
+my sub pbs_api_connect {
+    my ($scfg, $password) = @_;
+
+    my $params = {};
+
+    my $user = $scfg->{username} // 'root@pam';
+
+    if (my $tokenid = PVE::AccessControl::pve_verify_tokenid($user, 1)) {
+       $params->{apitoken} = "PBSAPIToken=${tokenid}:${password}";
+    } else {
+       $params->{password} = $password;
+       $params->{username} = $user;
+    }
+
+    if (my $fp = $scfg->{fingerprint}) {
+       $params->{cached_fingerprints}->{uc($fp)} = 1;
+    }
+
+    my $conn = PVE::APIClient::LWP->new(
+       %$params,
+       host => $scfg->{server},
+       port => $scfg->{port} // 8007,
+       timeout => 7, # cope with a 401 (3s api delay) and high latency
+       cookie_name => 'PBSAuthCookie',
+    );
+
+    return $conn;
+}
+
 sub list_volumes {
     my ($class, $storeid, $scfg, $vmid, $content_types) = @_;
 
@@ -667,7 +723,15 @@ sub list_volumes {
 
     return $res if !grep { $_ eq 'backup' } @$content_types;
 
-    my $data = run_client_cmd($scfg, $storeid, "snapshots");
+    my $password = pbs_get_password($scfg, $storeid);
+    my $conn = pbs_api_connect($scfg, $password);
+    my $datastore = $scfg->{datastore};
+
+    my $param = {};
+    $param->{'backup-id'} = "$vmid" if defined($vmid);
+    $param->{'ns'} = "$scfg->{namespace}" if defined($scfg->{namespace});
+    my $data = eval { $conn->get("/api2/json/admin/datastore/$datastore/snapshots", $param); };
+    die "error listing snapshots - $@" if $@;
 
     foreach my $item (@$data) {
        my $btype = $item->{"backup-type"};
@@ -688,6 +752,7 @@ sub list_volumes {
            content => 'backup',
            vmid => int($bid),
            ctime => $epoch,
+           subtype => $btype eq 'vm' ? 'qemu' : 'lxc', # convert to PVE backup type
        };
 
        $info->{verification} = $item->{verification} if defined($item->{verification});
@@ -728,37 +793,6 @@ sub status {
     return ($total, $free, $used, $active);
 }
 
-# TODO: use a client with native rust/proxmox-backup bindings to profit from
-# API schema checks and types
-my sub pbs_api_connect {
-    my ($scfg, $password) = @_;
-
-    my $params = {};
-
-    my $user = $scfg->{username} // 'root@pam';
-
-    if (my $tokenid = PVE::AccessControl::pve_verify_tokenid($user, 1)) {
-       $params->{apitoken} = "PBSAPIToken=${tokenid}:${password}";
-    } else {
-       $params->{password} = $password;
-       $params->{username} = $user;
-    }
-
-    if (my $fp = $scfg->{fingerprint}) {
-       $params->{cached_fingerprints}->{uc($fp)} = 1;
-    }
-
-    my $conn = PVE::APIClient::LWP->new(
-       %$params,
-       host => $scfg->{server},
-       port => $scfg->{port} // 8007,
-       timeout => 7, # cope with a 401 (3s api delay) and high latency
-       cookie_name => 'PBSAuthCookie',
-    );
-
-    return $conn;
-}
-
 # can also be used for not (yet) added storages, pass $scfg with
 # {
 #   server
@@ -849,7 +883,7 @@ sub get_volume_attribute {
     }
 
     if ($attribute eq 'protected') {
-       my $param = $class->api_param_from_volname($volname);
+       my $param = api_param_from_volname($class, $scfg, $volname);
 
        my $password = pbs_get_password($scfg, $storeid);
        my $conn = pbs_api_connect($scfg, $password);
@@ -874,14 +908,19 @@ sub update_volume_attribute {
     }
 
     if ($attribute eq 'protected') {
-       my $param = $class->api_param_from_volname($volname);
+       my $param = api_param_from_volname($class, $scfg, $volname);
        $param->{$attribute} = $value;
 
        my $password = pbs_get_password($scfg, $storeid);
        my $conn = pbs_api_connect($scfg, $password);
        my $datastore = $scfg->{datastore};
 
-       $conn->put("/api2/json/admin/datastore/$datastore/$attribute", $param);
+       eval { $conn->put("/api2/json/admin/datastore/$datastore/$attribute", $param); };
+       if (my $err = $@) {
+           die "Server is not recent enough to support feature '$attribute'\n"
+               if $err->{code} == 404;
+           die $err;
+       }
        return;
     }