pbs: die if master key is missing

[pve-storage.git] / PVE / Storage / PBSPlugin.pm

diff --git a/PVE/Storage/PBSPlugin.pm b/PVE/Storage/PBSPlugin.pm
index 2da939b7eaceadb0d6f406d89a736c28257e39d3..afc6ea408d282a6fbc4c4375b4c219bef24f4688 100644 (file)
--- a/PVE/Storage/PBSPlugin.pm
+++ b/PVE/Storage/PBSPlugin.pm
@@ -155,7 +155,12 @@ sub pbs_open_encryption_key {
 
     my $keyfd;
     if (!open($keyfd, '<', $encryption_key_file)) {
-       return undef if $! == ENOENT;
+       if ($! == ENOENT) {
+           my $encryption_fp = $scfg->{'encryption-key'};
+           die "encryption configured ('$encryption_fp') but no encryption key file found!\n"
+               if $encryption_fp;
+           return undef;
+       }
        die "failed to open encryption key: $encryption_key_file: $!\n";
     }
 
@@ -205,7 +210,11 @@ sub pbs_open_master_pubkey {
 
     my $keyfd;
     if (!open($keyfd, '<', $master_pubkey_file)) {
-       return undef if $! == ENOENT;
+       if ($! == ENOENT) {
+           die "master public key configured but no key file found!\n"
+               if $scfg->{'master-pubkey'};
+           return undef;
+       }
        die "failed to open master public key: $master_pubkey_file: $!\n";
     }
 
@@ -251,7 +260,7 @@ my sub api_param_from_volname : prototype($$$) {
     }
 
     return {
-       (ns($scfg, 'backup-ns')),
+       (ns($scfg, 'ns')),
        'backup-type' => $btype,
        'backup-id' => $bid,
        'backup-time' => $btime,
@@ -676,6 +685,37 @@ my sub snapshot_files_encrypted {
     return $any && $all;
 }
 
+# TODO: use a client with native rust/proxmox-backup bindings to profit from
+# API schema checks and types
+my sub pbs_api_connect {
+    my ($scfg, $password) = @_;
+
+    my $params = {};
+
+    my $user = $scfg->{username} // 'root@pam';
+
+    if (my $tokenid = PVE::AccessControl::pve_verify_tokenid($user, 1)) {
+       $params->{apitoken} = "PBSAPIToken=${tokenid}:${password}";
+    } else {
+       $params->{password} = $password;
+       $params->{username} = $user;
+    }
+
+    if (my $fp = $scfg->{fingerprint}) {
+       $params->{cached_fingerprints}->{uc($fp)} = 1;
+    }
+
+    my $conn = PVE::APIClient::LWP->new(
+       %$params,
+       host => $scfg->{server},
+       port => $scfg->{port} // 8007,
+       timeout => 7, # cope with a 401 (3s api delay) and high latency
+       cookie_name => 'PBSAuthCookie',
+    );
+
+    return $conn;
+}
+
 sub list_volumes {
     my ($class, $storeid, $scfg, $vmid, $content_types) = @_;
 
@@ -683,7 +723,15 @@ sub list_volumes {
 
     return $res if !grep { $_ eq 'backup' } @$content_types;
 
-    my $data = run_client_cmd($scfg, $storeid, "snapshots");
+    my $password = pbs_get_password($scfg, $storeid);
+    my $conn = pbs_api_connect($scfg, $password);
+    my $datastore = $scfg->{datastore};
+
+    my $param = {};
+    $param->{'backup-id'} = "$vmid" if defined($vmid);
+    $param->{'ns'} = "$scfg->{namespace}" if defined($scfg->{namespace});
+    my $data = eval { $conn->get("/api2/json/admin/datastore/$datastore/snapshots", $param); };
+    die "error listing snapshots - $@" if $@;
 
     foreach my $item (@$data) {
        my $btype = $item->{"backup-type"};
@@ -745,37 +793,6 @@ sub status {
     return ($total, $free, $used, $active);
 }
 
-# TODO: use a client with native rust/proxmox-backup bindings to profit from
-# API schema checks and types
-my sub pbs_api_connect {
-    my ($scfg, $password) = @_;
-
-    my $params = {};
-
-    my $user = $scfg->{username} // 'root@pam';
-
-    if (my $tokenid = PVE::AccessControl::pve_verify_tokenid($user, 1)) {
-       $params->{apitoken} = "PBSAPIToken=${tokenid}:${password}";
-    } else {
-       $params->{password} = $password;
-       $params->{username} = $user;
-    }
-
-    if (my $fp = $scfg->{fingerprint}) {
-       $params->{cached_fingerprints}->{uc($fp)} = 1;
-    }
-
-    my $conn = PVE::APIClient::LWP->new(
-       %$params,
-       host => $scfg->{server},
-       port => $scfg->{port} // 8007,
-       timeout => 7, # cope with a 401 (3s api delay) and high latency
-       cookie_name => 'PBSAuthCookie',
-    );
-
-    return $conn;
-}
-
 # can also be used for not (yet) added storages, pass $scfg with
 # {
 #   server