-use std::collections::{HashSet, HashMap};
+//! Datastore Management
+
+use std::collections::HashSet;
use std::ffi::OsStr;
use std::os::unix::ffi::OsStrExt;
-use std::sync::{Arc, Mutex};
use anyhow::{bail, format_err, Error};
use futures::*;
use hyper::http::request::Parts;
use hyper::{header, Body, Response, StatusCode};
use serde_json::{json, Value};
+use tokio_stream::wrappers::ReceiverStream;
use proxmox::api::{
api, ApiResponseFuture, ApiHandler, ApiMethod, Router,
RpcEnvironment, RpcEnvironmentType, Permission
};
-use proxmox::api::router::SubdirMap;
+use proxmox::api::router::{ReturnType, SubdirMap};
use proxmox::api::schema::*;
use proxmox::tools::fs::{replace_file, CreateOptions};
use proxmox::{http_err, identity, list_subdirs_api_method, sortable};
use crate::api2::types::*;
use crate::api2::node::rrd::create_value_from_rrd;
+use crate::api2::helpers;
use crate::backup::*;
use crate::config::datastore;
use crate::config::cached_user_info::CachedUserInfo;
+use crate::pxar::create_zip;
+
+use crate::server::{jobstate::Job, WorkerTask};
+use crate::tools::{
+ self,
+ AsyncChannelWriter, AsyncReaderStream, WrappedReaderStream,
+};
-use crate::server::WorkerTask;
-use crate::tools::{self, AsyncReaderStream, WrappedReaderStream};
use crate::config::acl::{
PRIV_DATASTORE_AUDIT,
PRIV_DATASTORE_MODIFY,
PRIV_DATASTORE_READ,
PRIV_DATASTORE_PRUNE,
PRIV_DATASTORE_BACKUP,
+ PRIV_DATASTORE_VERIFY,
};
-fn check_backup_owner(
+fn check_priv_or_backup_owner(
store: &DataStore,
group: &BackupGroup,
- userid: &Userid,
+ auth_id: &Authid,
+ required_privs: u64,
+) -> Result<(), Error> {
+ let user_info = CachedUserInfo::new()?;
+ let privs = user_info.lookup_privs(&auth_id, &["datastore", store.name()]);
+
+ if privs & required_privs == 0 {
+ let owner = store.get_owner(group)?;
+ check_backup_owner(&owner, auth_id)?;
+ }
+ Ok(())
+}
+
+fn check_backup_owner(
+ owner: &Authid,
+ auth_id: &Authid,
) -> Result<(), Error> {
- let owner = store.get_owner(group)?;
- if &owner != userid {
- bail!("backup owner check failed ({} != {})", userid, owner);
+ let correct_owner = owner == auth_id
+ || (owner.is_token() && &Authid::from(owner.user().clone()) == auth_id);
+ if !correct_owner {
+ bail!("backup owner check failed ({} != {})", auth_id, owner);
}
Ok(())
}
Ok((manifest, files))
}
-fn group_backups(backup_list: Vec<BackupInfo>) -> HashMap<String, Vec<BackupInfo>> {
-
- let mut group_hash = HashMap::new();
-
- for info in backup_list {
- let group_id = info.backup_dir.group().group_path().to_str().unwrap().to_owned();
- let time_list = group_hash.entry(group_id).or_insert(vec![]);
- time_list.push(info);
- }
-
- group_hash
-}
-
#[api(
input: {
properties: {
},
)]
/// List backup groups.
-fn list_groups(
+pub fn list_groups(
store: String,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<GroupListItem>, Error> {
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let user_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
let datastore = DataStore::lookup_datastore(&store)?;
+ let list_all = (user_privs & PRIV_DATASTORE_AUDIT) != 0;
+
+ let backup_groups = BackupInfo::list_backup_groups(&datastore.base_path())?;
+
+ let group_info = backup_groups
+ .into_iter()
+ .fold(Vec::new(), |mut group_info, group| {
+ let owner = match datastore.get_owner(&group) {
+ Ok(auth_id) => auth_id,
+ Err(err) => {
+ eprintln!("Failed to get owner of group '{}/{}' - {}",
+ &store,
+ group,
+ err);
+ return group_info;
+ },
+ };
+ if !list_all && check_backup_owner(&owner, &auth_id).is_err() {
+ return group_info;
+ }
- let backup_list = BackupInfo::list_backups(&datastore.base_path())?;
+ let snapshots = match group.list_backups(&datastore.base_path()) {
+ Ok(snapshots) => snapshots,
+ Err(_) => {
+ return group_info;
+ },
+ };
- let group_hash = group_backups(backup_list);
+ let backup_count: u64 = snapshots.len() as u64;
+ if backup_count == 0 {
+ return group_info;
+ }
- let mut groups = Vec::new();
+ let last_backup = snapshots
+ .iter()
+ .fold(&snapshots[0], |last, curr| {
+ if curr.is_finished()
+ && curr.backup_dir.backup_time() > last.backup_dir.backup_time() {
+ curr
+ } else {
+ last
+ }
+ })
+ .to_owned();
+
+ group_info.push(GroupListItem {
+ backup_type: group.backup_type().to_string(),
+ backup_id: group.backup_id().to_string(),
+ last_backup: last_backup.backup_dir.backup_time(),
+ owner: Some(owner),
+ backup_count,
+ files: last_backup.files,
+ });
- for (_group_id, mut list) in group_hash {
+ group_info
+ });
+
+ Ok(group_info)
+}
- BackupInfo::sort_list(&mut list, false);
+#[api(
+ input: {
+ properties: {
+ store: {
+ schema: DATASTORE_SCHEMA,
+ },
+ "backup-type": {
+ schema: BACKUP_TYPE_SCHEMA,
+ },
+ "backup-id": {
+ schema: BACKUP_ID_SCHEMA,
+ },
+ },
+ },
+ access: {
+ permission: &Permission::Privilege(
+ &["datastore", "{store}"],
+ PRIV_DATASTORE_MODIFY| PRIV_DATASTORE_PRUNE,
+ true),
+ },
+)]
+/// Delete backup group including all snapshots.
+pub fn delete_group(
+ store: String,
+ backup_type: String,
+ backup_id: String,
+ _info: &ApiMethod,
+ rpcenv: &mut dyn RpcEnvironment,
+) -> Result<Value, Error> {
- let info = &list[0];
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
- let group = info.backup_dir.group();
+ let group = BackupGroup::new(backup_type, backup_id);
+ let datastore = DataStore::lookup_datastore(&store)?;
- let list_all = (user_privs & PRIV_DATASTORE_AUDIT) != 0;
- let owner = datastore.get_owner(group)?;
- if !list_all {
- if owner != userid { continue; }
- }
+ check_priv_or_backup_owner(&datastore, &group, &auth_id, PRIV_DATASTORE_MODIFY)?;
- let result_item = GroupListItem {
- backup_type: group.backup_type().to_string(),
- backup_id: group.backup_id().to_string(),
- last_backup: info.backup_dir.backup_time(),
- backup_count: list.len() as u64,
- files: info.files.clone(),
- owner: Some(owner),
- };
- groups.push(result_item);
- }
+ datastore.remove_backup_group(&group)?;
- Ok(groups)
+ Ok(Value::Null)
}
#[api(
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<BackupContent>, Error> {
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
-
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let datastore = DataStore::lookup_datastore(&store)?;
let snapshot = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & (PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_READ)) != 0;
- if !allowed { check_backup_owner(&datastore, snapshot.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, snapshot.group(), &auth_id, PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_READ)?;
let info = BackupInfo::new(&datastore.base_path(), snapshot)?;
},
)]
/// Delete backup snapshot.
-fn delete_snapshot(
+pub fn delete_snapshot(
store: String,
backup_type: String,
backup_id: String,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Value, Error> {
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let snapshot = BackupDir::new(backup_type, backup_id, backup_time)?;
-
let datastore = DataStore::lookup_datastore(&store)?;
- let allowed = (user_privs & PRIV_DATASTORE_MODIFY) != 0;
- if !allowed { check_backup_owner(&datastore, snapshot.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, snapshot.group(), &auth_id, PRIV_DATASTORE_MODIFY)?;
datastore.remove_backup_dir(&snapshot, false)?;
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<SnapshotListItem>, Error> {
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let user_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
+
+ let list_all = (user_privs & PRIV_DATASTORE_AUDIT) != 0;
let datastore = DataStore::lookup_datastore(&store)?;
let base_path = datastore.base_path();
- let backup_list = BackupInfo::list_backups(&base_path)?;
-
- let mut snapshots = vec![];
-
- for info in backup_list {
- let group = info.backup_dir.group();
- if let Some(ref backup_type) = backup_type {
- if backup_type != group.backup_type() { continue; }
- }
- if let Some(ref backup_id) = backup_id {
- if backup_id != group.backup_id() { continue; }
- }
-
- let list_all = (user_privs & PRIV_DATASTORE_AUDIT) != 0;
- let owner = datastore.get_owner(group)?;
-
- if !list_all {
- if owner != userid { continue; }
- }
+ let groups = match (backup_type, backup_id) {
+ (Some(backup_type), Some(backup_id)) => {
+ let mut groups = Vec::with_capacity(1);
+ groups.push(BackupGroup::new(backup_type, backup_id));
+ groups
+ },
+ (Some(backup_type), None) => {
+ BackupInfo::list_backup_groups(&base_path)?
+ .into_iter()
+ .filter(|group| group.backup_type() == backup_type)
+ .collect()
+ },
+ (None, Some(backup_id)) => {
+ BackupInfo::list_backup_groups(&base_path)?
+ .into_iter()
+ .filter(|group| group.backup_id() == backup_id)
+ .collect()
+ },
+ _ => BackupInfo::list_backup_groups(&base_path)?,
+ };
- let mut size = None;
+ let info_to_snapshot_list_item = |group: &BackupGroup, owner, info: BackupInfo| {
+ let backup_type = group.backup_type().to_string();
+ let backup_id = group.backup_id().to_string();
+ let backup_time = info.backup_dir.backup_time();
- let (comment, verification, files) = match get_all_snapshot_files(&datastore, &info) {
+ match get_all_snapshot_files(&datastore, &info) {
Ok((manifest, files)) => {
- size = Some(files.iter().map(|x| x.size.unwrap_or(0)).sum());
// extract the first line from notes
let comment: Option<String> = manifest.unprotected["notes"]
.as_str()
.and_then(|notes| notes.lines().next())
.map(String::from);
- let verify = manifest.unprotected["verify_state"].clone();
- let verify: Option<SnapshotVerifyState> = match serde_json::from_value(verify) {
+ let fingerprint = match manifest.fingerprint() {
+ Ok(fp) => fp,
+ Err(err) => {
+ eprintln!("error parsing fingerprint: '{}'", err);
+ None
+ },
+ };
+
+ let verification = manifest.unprotected["verify_state"].clone();
+ let verification: Option<SnapshotVerifyState> = match serde_json::from_value(verification) {
Ok(verify) => verify,
Err(err) => {
eprintln!("error parsing verification state : '{}'", err);
}
};
- (comment, verify, files)
+ let size = Some(files.iter().map(|x| x.size.unwrap_or(0)).sum());
+
+ SnapshotListItem {
+ backup_type,
+ backup_id,
+ backup_time,
+ comment,
+ verification,
+ fingerprint,
+ files,
+ size,
+ owner,
+ }
},
Err(err) => {
eprintln!("error during snapshot file listing: '{}'", err);
- (
- None,
- None,
- info
+ let files = info
.files
- .iter()
- .map(|x| BackupContent {
- filename: x.to_string(),
+ .into_iter()
+ .map(|filename| BackupContent {
+ filename,
size: None,
crypt_mode: None,
})
- .collect()
- )
+ .collect();
+
+ SnapshotListItem {
+ backup_type,
+ backup_id,
+ backup_time,
+ comment: None,
+ verification: None,
+ fingerprint: None,
+ files,
+ size: None,
+ owner,
+ }
},
- };
+ }
+ };
- let result_item = SnapshotListItem {
- backup_type: group.backup_type().to_string(),
- backup_id: group.backup_id().to_string(),
- backup_time: info.backup_dir.backup_time(),
- comment,
- verification,
- files,
- size,
- owner: Some(owner),
- };
+ groups
+ .iter()
+ .try_fold(Vec::new(), |mut snapshots, group| {
+ let owner = match datastore.get_owner(group) {
+ Ok(auth_id) => auth_id,
+ Err(err) => {
+ eprintln!("Failed to get owner of group '{}/{}' - {}",
+ &store,
+ group,
+ err);
+ return Ok(snapshots);
+ },
+ };
- snapshots.push(result_item);
- }
+ if !list_all && check_backup_owner(&owner, &auth_id).is_err() {
+ return Ok(snapshots);
+ }
+
+ let group_backups = group.list_backups(&datastore.base_path())?;
+
+ snapshots.extend(
+ group_backups
+ .into_iter()
+ .map(|info| info_to_snapshot_list_item(&group, Some(owner.clone()), info))
+ );
+
+ Ok(snapshots)
+ })
+}
+
+fn get_snapshots_count(store: &DataStore, filter_owner: Option<&Authid>) -> Result<Counts, Error> {
+ let base_path = store.base_path();
+ let groups = BackupInfo::list_backup_groups(&base_path)?;
+
+ groups.iter()
+ .filter(|group| {
+ let owner = match store.get_owner(&group) {
+ Ok(owner) => owner,
+ Err(err) => {
+ eprintln!("Failed to get owner of group '{}/{}' - {}",
+ store.name(),
+ group,
+ err);
+ return false;
+ },
+ };
+
+ match filter_owner {
+ Some(filter) => check_backup_owner(&owner, filter).is_ok(),
+ None => true,
+ }
+ })
+ .try_fold(Counts::default(), |mut counts, group| {
+ let snapshot_count = group.list_backups(&base_path)?.len() as u64;
+
+ let type_count = match group.backup_type() {
+ "ct" => counts.ct.get_or_insert(Default::default()),
+ "vm" => counts.vm.get_or_insert(Default::default()),
+ "host" => counts.host.get_or_insert(Default::default()),
+ _ => counts.other.get_or_insert(Default::default()),
+ };
+
+ type_count.groups += 1;
+ type_count.snapshots += snapshot_count;
- Ok(snapshots)
+ Ok(counts)
+ })
}
#[api(
store: {
schema: DATASTORE_SCHEMA,
},
+ verbose: {
+ type: bool,
+ default: false,
+ optional: true,
+ description: "Include additional information like snapshot counts and GC status.",
+ },
},
+
},
returns: {
- type: StorageStatus,
+ type: DataStoreStatus,
},
access: {
permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
/// Get datastore status.
pub fn status(
store: String,
+ verbose: bool,
_info: &ApiMethod,
- _rpcenv: &mut dyn RpcEnvironment,
-) -> Result<StorageStatus, Error> {
+ rpcenv: &mut dyn RpcEnvironment,
+) -> Result<DataStoreStatus, Error> {
let datastore = DataStore::lookup_datastore(&store)?;
- crate::tools::disks::disk_usage(&datastore.base_path())
+ let storage = crate::tools::disks::disk_usage(&datastore.base_path())?;
+ let (counts, gc_status) = if verbose {
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
+ let user_info = CachedUserInfo::new()?;
+
+ let store_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
+ let filter_owner = if store_privs & PRIV_DATASTORE_AUDIT != 0 {
+ None
+ } else {
+ Some(&auth_id)
+ };
+
+ let counts = Some(get_snapshots_count(&datastore, filter_owner)?);
+ let gc_status = Some(datastore.last_gc_status());
+
+ (counts, gc_status)
+ } else {
+ (None, None)
+ };
+
+ Ok(DataStoreStatus {
+ total: storage.total,
+ used: storage.used,
+ avail: storage.avail,
+ gc_status,
+ counts,
+ })
}
#[api(
schema: BACKUP_ID_SCHEMA,
optional: true,
},
+ "ignore-verified": {
+ schema: IGNORE_VERIFIED_BACKUPS_SCHEMA,
+ optional: true,
+ },
+ "outdated-after": {
+ schema: VERIFICATION_OUTDATED_AFTER_SCHEMA,
+ optional: true,
+ },
"backup-time": {
schema: BACKUP_TIME_SCHEMA,
optional: true,
schema: UPID_SCHEMA,
},
access: {
- permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP, true), // fixme
+ permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_VERIFY | PRIV_DATASTORE_BACKUP, true),
},
)]
/// Verify backups.
backup_type: Option<String>,
backup_id: Option<String>,
backup_time: Option<i64>,
+ ignore_verified: Option<bool>,
+ outdated_after: Option<i64>,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Value, Error> {
let datastore = DataStore::lookup_datastore(&store)?;
+ let ignore_verified = ignore_verified.unwrap_or(true);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let worker_id;
let mut backup_dir = None;
let mut backup_group = None;
+ let mut worker_type = "verify";
match (backup_type, backup_id, backup_time) {
(Some(backup_type), Some(backup_id), Some(backup_time)) => {
- worker_id = format!("{}_{}_{}_{:08X}", store, backup_type, backup_id, backup_time);
+ worker_id = format!("{}:{}/{}/{:08X}", store, backup_type, backup_id, backup_time);
let dir = BackupDir::new(backup_type, backup_id, backup_time)?;
+
+ check_priv_or_backup_owner(&datastore, dir.group(), &auth_id, PRIV_DATASTORE_VERIFY)?;
+
backup_dir = Some(dir);
+ worker_type = "verify_snapshot";
}
(Some(backup_type), Some(backup_id), None) => {
- worker_id = format!("{}_{}_{}", store, backup_type, backup_id);
+ worker_id = format!("{}:{}/{}", store, backup_type, backup_id);
let group = BackupGroup::new(backup_type, backup_id);
+
+ check_priv_or_backup_owner(&datastore, &group, &auth_id, PRIV_DATASTORE_VERIFY)?;
+
backup_group = Some(group);
+ worker_type = "verify_group";
}
(None, None, None) => {
worker_id = store.clone();
_ => bail!("parameters do not specify a backup group or snapshot"),
}
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let to_stdout = if rpcenv.env_type() == RpcEnvironmentType::CLI { true } else { false };
+ let to_stdout = rpcenv.env_type() == RpcEnvironmentType::CLI;
let upid_str = WorkerTask::new_thread(
- "verify",
- Some(worker_id.clone()),
- userid,
+ worker_type,
+ Some(worker_id),
+ auth_id.clone(),
to_stdout,
move |worker| {
- let verified_chunks = Arc::new(Mutex::new(HashSet::with_capacity(1024*16)));
- let corrupt_chunks = Arc::new(Mutex::new(HashSet::with_capacity(64)));
-
+ let verify_worker = crate::backup::VerifyWorker::new(worker.clone(), datastore);
let failed_dirs = if let Some(backup_dir) = backup_dir {
let mut res = Vec::new();
if !verify_backup_dir(
- datastore,
+ &verify_worker,
&backup_dir,
- verified_chunks,
- corrupt_chunks,
- worker.clone(),
worker.upid().clone(),
+ Some(&move |manifest| {
+ verify_filter(ignore_verified, outdated_after, manifest)
+ }),
)? {
res.push(backup_dir.to_string());
}
res
} else if let Some(backup_group) = backup_group {
- let (_count, failed_dirs) = verify_backup_group(
- datastore,
+ let failed_dirs = verify_backup_group(
+ &verify_worker,
&backup_group,
- verified_chunks,
- corrupt_chunks,
- None,
- worker.clone(),
+ &mut StoreProgress::new(1),
worker.upid(),
+ Some(&move |manifest| {
+ verify_filter(ignore_verified, outdated_after, manifest)
+ }),
)?;
failed_dirs
} else {
- verify_all_backups(datastore, worker.clone(), worker.upid())?
+ let privs = CachedUserInfo::new()?
+ .lookup_privs(&auth_id, &["datastore", &store]);
+
+ let owner = if privs & PRIV_DATASTORE_VERIFY == 0 {
+ Some(auth_id)
+ } else {
+ None
+ };
+
+ verify_all_backups(
+ &verify_worker,
+ worker.upid(),
+ owner,
+ Some(&move |manifest| {
+ verify_filter(ignore_verified, outdated_after, manifest)
+ }),
+ )?
};
- if failed_dirs.len() > 0 {
- worker.log("Failed to verify following snapshots:");
+ if !failed_dirs.is_empty() {
+ worker.log("Failed to verify the following snapshots/groups:");
for dir in failed_dirs {
worker.log(format!("\t{}", dir));
}
&PruneListItem::API_SCHEMA
).schema();
-const API_METHOD_PRUNE: ApiMethod = ApiMethod::new(
+pub const API_METHOD_PRUNE: ApiMethod = ApiMethod::new(
&ApiHandler::Sync(&prune),
&ObjectSchema::new(
"Prune the datastore.",
("store", false, &DATASTORE_SCHEMA),
])
))
- .returns(&API_RETURN_SCHEMA_PRUNE)
+ .returns(ReturnType::new(false, &API_RETURN_SCHEMA_PRUNE))
.access(None, &Permission::Privilege(
&["datastore", "{store}"],
PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_PRUNE,
true)
);
-fn prune(
+pub fn prune(
param: Value,
_info: &ApiMethod,
rpcenv: &mut dyn RpcEnvironment,
let backup_type = tools::required_string_param(¶m, "backup-type")?;
let backup_id = tools::required_string_param(¶m, "backup-id")?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let dry_run = param["dry-run"].as_bool().unwrap_or(false);
let datastore = DataStore::lookup_datastore(&store)?;
- let allowed = (user_privs & PRIV_DATASTORE_MODIFY) != 0;
- if !allowed { check_backup_owner(&datastore, &group, &userid)?; }
+ check_priv_or_backup_owner(&datastore, &group, &auth_id, PRIV_DATASTORE_MODIFY)?;
let prune_options = PruneOptions {
keep_last: param["keep-last"].as_u64(),
keep_yearly: param["keep-yearly"].as_u64(),
};
- let worker_id = format!("{}_{}_{}", store, backup_type, backup_id);
+ let worker_id = format!("{}:{}/{}", store, backup_type, backup_id);
let mut prune_result = Vec::new();
// We use a WorkerTask just to have a task log, but run synchrounously
- let worker = WorkerTask::new("prune", Some(worker_id), Userid::root_userid().clone(), true)?;
+ let worker = WorkerTask::new("prune", Some(worker_id), auth_id, true)?;
if keep_all {
worker.log("No prune selection - keeping all files.");
},
)]
/// Start garbage collection.
-fn start_garbage_collection(
+pub fn start_garbage_collection(
store: String,
_info: &ApiMethod,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Value, Error> {
let datastore = DataStore::lookup_datastore(&store)?;
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
- println!("Starting garbage collection on store {}", store);
+ let job = Job::new("garbage_collection", &store)
+ .map_err(|_| format_err!("garbage collection already running"))?;
- let to_stdout = if rpcenv.env_type() == RpcEnvironmentType::CLI { true } else { false };
+ let to_stdout = rpcenv.env_type() == RpcEnvironmentType::CLI;
- let upid_str = WorkerTask::new_thread(
- "garbage_collection",
- Some(store.clone()),
- Userid::root_userid().clone(),
- to_stdout,
- move |worker| {
- worker.log(format!("starting garbage collection on store {}", store));
- datastore.garbage_collection(&*worker, worker.upid())
- },
- )?;
+ let upid_str = crate::server::do_garbage_collection_job(job, datastore, &auth_id, None, to_stdout)
+ .map_err(|err| format_err!("unable to start garbage collection job on datastore {} - {}", store, err))?;
Ok(json!(upid_str))
}
returns: {
description: "List the accessible datastores.",
type: Array,
- items: {
- description: "Datastore name and description.",
- properties: {
- store: {
- schema: DATASTORE_SCHEMA,
- },
- comment: {
- optional: true,
- schema: SINGLE_LINE_COMMENT_SCHEMA,
- },
- },
- },
+ items: { type: DataStoreListItem },
},
access: {
permission: &Permission::Anybody,
},
)]
/// Datastore list
-fn get_datastore_list(
+pub fn get_datastore_list(
_param: Value,
_info: &ApiMethod,
rpcenv: &mut dyn RpcEnvironment,
-) -> Result<Value, Error> {
+) -> Result<Vec<DataStoreListItem>, Error> {
let (config, _digest) = datastore::config()?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let user_info = CachedUserInfo::new()?;
let mut list = Vec::new();
for (store, (_, data)) in &config.sections {
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let user_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
let allowed = (user_privs & (PRIV_DATASTORE_AUDIT| PRIV_DATASTORE_BACKUP)) != 0;
if allowed {
- let mut entry = json!({ "store": store });
- if let Some(comment) = data["comment"].as_str() {
- entry["comment"] = comment.into();
- }
- list.push(entry);
+ list.push(
+ DataStoreListItem {
+ store: store.clone(),
+ comment: data["comment"].as_str().map(String::from),
+ }
+ );
}
}
- Ok(list.into())
+ Ok(list)
}
#[sortable]
true)
);
-fn download_file(
+pub fn download_file(
_parts: Parts,
_req_body: Body,
param: Value,
let store = tools::required_string_param(¶m, "store")?;
let datastore = DataStore::lookup_datastore(store)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let file_name = tools::required_string_param(¶m, "file-name")?.to_owned();
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & PRIV_DATASTORE_READ) != 0;
- if !allowed { check_backup_owner(&datastore, backup_dir.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, backup_dir.group(), &auth_id, PRIV_DATASTORE_READ)?;
println!("Download {} from {} ({}/{})", file_name, store, backup_dir, file_name);
.map_err(|err| http_err!(BAD_REQUEST, "File open failed: {}", err))?;
let payload = tokio_util::codec::FramedRead::new(file, tokio_util::codec::BytesCodec::new())
- .map_ok(|bytes| hyper::body::Bytes::from(bytes.freeze()))
+ .map_ok(|bytes| bytes.freeze())
.map_err(move |err| {
eprintln!("error during streaming of '{:?}' - {}", &path, err);
err
true)
);
-fn download_file_decoded(
+pub fn download_file_decoded(
_parts: Parts,
_req_body: Body,
param: Value,
let store = tools::required_string_param(¶m, "store")?;
let datastore = DataStore::lookup_datastore(store)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let file_name = tools::required_string_param(¶m, "file-name")?.to_owned();
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & PRIV_DATASTORE_READ) != 0;
- if !allowed { check_backup_owner(&datastore, backup_dir.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, backup_dir.group(), &auth_id, PRIV_DATASTORE_READ)?;
let (manifest, files) = read_backup_index(&datastore, &backup_dir)?;
for file in files {
manifest.verify_file(&file_name, &csum, size)?;
let chunk_reader = LocalChunkReader::new(datastore, None, CryptMode::None);
- let reader = AsyncIndexReader::new(index, chunk_reader);
+ let reader = CachedChunkReader::new(chunk_reader, index, 1).seekable();
Body::wrap_stream(AsyncReaderStream::new(reader)
.map_err(move |err| {
eprintln!("error during streaming of '{:?}' - {}", path, err);
manifest.verify_file(&file_name, &csum, size)?;
let chunk_reader = LocalChunkReader::new(datastore, None, CryptMode::None);
- let reader = AsyncIndexReader::new(index, chunk_reader);
+ let reader = CachedChunkReader::new(chunk_reader, index, 1).seekable();
Body::wrap_stream(AsyncReaderStream::with_buffer_size(reader, 4*1024*1024)
.map_err(move |err| {
eprintln!("error during streaming of '{:?}' - {}", path, err);
&Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_BACKUP, false)
);
-fn upload_backup_log(
+pub fn upload_backup_log(
_parts: Parts,
req_body: Body,
param: Value,
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- check_backup_owner(&datastore, backup_dir.group(), &userid)?;
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
+ let owner = datastore.get_owner(backup_dir.group())?;
+ check_backup_owner(&owner, &auth_id)?;
let mut path = datastore.base_path();
path.push(backup_dir.relative_path());
},
)]
/// Get the entries of the given path of the catalog
-fn catalog(
+pub fn catalog(
store: String,
backup_type: String,
backup_id: String,
backup_time: i64,
filepath: String,
- _param: Value,
- _info: &ApiMethod,
rpcenv: &mut dyn RpcEnvironment,
-) -> Result<Value, Error> {
+) -> Result<Vec<ArchiveEntry>, Error> {
let datastore = DataStore::lookup_datastore(&store)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & PRIV_DATASTORE_READ) != 0;
- if !allowed { check_backup_owner(&datastore, backup_dir.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, backup_dir.group(), &auth_id, PRIV_DATASTORE_READ)?;
let file_name = CATALOG_NAME;
let reader = BufferedDynamicReader::new(index, chunk_reader);
let mut catalog_reader = CatalogReader::new(reader);
- let mut current = catalog_reader.root()?;
- let mut components = vec![];
-
-
- if filepath != "root" {
- components = base64::decode(filepath)?;
- if components.len() > 0 && components[0] == '/' as u8 {
- components.remove(0);
- }
- for component in components.split(|c| *c == '/' as u8) {
- if let Some(entry) = catalog_reader.lookup(¤t, component)? {
- current = entry;
- } else {
- bail!("path {:?} not found in catalog", &String::from_utf8_lossy(&components));
- }
- }
- }
- let mut res = Vec::new();
-
- for direntry in catalog_reader.read_dir(¤t)? {
- let mut components = components.clone();
- components.push('/' as u8);
- components.extend(&direntry.name);
- let path = base64::encode(components);
- let text = String::from_utf8_lossy(&direntry.name);
- let mut entry = json!({
- "filepath": path,
- "text": text,
- "type": CatalogEntryType::from(&direntry.attr).to_string(),
- "leaf": true,
- });
- match direntry.attr {
- DirEntryAttribute::Directory { start: _ } => {
- entry["leaf"] = false.into();
- },
- DirEntryAttribute::File { size, mtime } => {
- entry["size"] = size.into();
- entry["mtime"] = mtime.into();
- },
- _ => {},
- }
- res.push(entry);
- }
+ let path = if filepath != "root" && filepath != "/" {
+ base64::decode(filepath)?
+ } else {
+ vec![b'/']
+ };
- Ok(res.into())
+ helpers::list_dir_content(&mut catalog_reader, &path)
}
#[sortable]
true)
);
-fn pxar_file_download(
+pub fn pxar_file_download(
_parts: Parts,
_req_body: Body,
param: Value,
let store = tools::required_string_param(¶m, "store")?;
let datastore = DataStore::lookup_datastore(&store)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let filepath = tools::required_string_param(¶m, "filepath")?.to_owned();
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & PRIV_DATASTORE_READ) != 0;
- if !allowed { check_backup_owner(&datastore, backup_dir.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, backup_dir.group(), &auth_id, PRIV_DATASTORE_READ)?;
let mut components = base64::decode(&filepath)?;
- if components.len() > 0 && components[0] == '/' as u8 {
+ if !components.is_empty() && components[0] == b'/' {
components.remove(0);
}
- let mut split = components.splitn(2, |c| *c == '/' as u8);
+ let mut split = components.splitn(2, |c| *c == b'/');
let pxar_name = std::str::from_utf8(split.next().unwrap())?;
- let file_path = split.next().ok_or(format_err!("filepath looks strange '{}'", filepath))?;
+ let file_path = split.next().unwrap_or(b"/");
let (manifest, files) = read_backup_index(&datastore, &backup_dir)?;
for file in files {
if file.filename == pxar_name && file.crypt_mode == Some(CryptMode::Encrypt) {
let decoder = Accessor::new(reader, archive_size).await?;
let root = decoder.open_root().await?;
+ let path = OsStr::from_bytes(file_path).to_os_string();
let file = root
- .lookup(OsStr::from_bytes(file_path)).await?
- .ok_or(format_err!("error opening '{:?}'", file_path))?;
+ .lookup(&path).await?
+ .ok_or_else(|| format_err!("error opening '{:?}'", path))?;
- let file = match file.kind() {
- EntryKind::File { .. } => file,
- EntryKind::Hardlink(_) => {
- decoder.follow_hardlink(&file).await?
- },
- // TODO symlink
+ let body = match file.kind() {
+ EntryKind::File { .. } => Body::wrap_stream(
+ AsyncReaderStream::new(file.contents().await?).map_err(move |err| {
+ eprintln!("error during streaming of file '{:?}' - {}", filepath, err);
+ err
+ }),
+ ),
+ EntryKind::Hardlink(_) => Body::wrap_stream(
+ AsyncReaderStream::new(decoder.follow_hardlink(&file).await?.contents().await?)
+ .map_err(move |err| {
+ eprintln!(
+ "error during streaming of hardlink '{:?}' - {}",
+ path, err
+ );
+ err
+ }),
+ ),
+ EntryKind::Directory => {
+ let (sender, receiver) = tokio::sync::mpsc::channel(100);
+ let channelwriter = AsyncChannelWriter::new(sender, 1024 * 1024);
+ crate::server::spawn_internal_task(
+ create_zip(channelwriter, decoder, path.clone(), false)
+ );
+ Body::wrap_stream(ReceiverStream::new(receiver).map_err(move |err| {
+ eprintln!("error during streaming of zip '{:?}' - {}", path, err);
+ err
+ }))
+ }
other => bail!("cannot download file of type {:?}", other),
};
- let body = Body::wrap_stream(
- AsyncReaderStream::new(file.contents().await?)
- .map_err(move |err| {
- eprintln!("error during streaming of '{:?}' - {}", filepath, err);
- err
- })
- );
-
// fixme: set other headers ?
Ok(Response::builder()
.status(StatusCode::OK)
},
)]
/// Read datastore stats
-fn get_rrd_stats(
+pub fn get_rrd_stats(
store: String,
timeframe: RRDTimeFrameResolution,
cf: RRDMode,
},
},
access: {
- permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP, true),
+ permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
},
)]
/// Get "notes" for a specific backup
-fn get_notes(
+pub fn get_notes(
store: String,
backup_type: String,
backup_id: String,
) -> Result<String, Error> {
let datastore = DataStore::lookup_datastore(&store)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
-
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & PRIV_DATASTORE_READ) != 0;
- if !allowed { check_backup_owner(&datastore, backup_dir.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, backup_dir.group(), &auth_id, PRIV_DATASTORE_AUDIT)?;
- let manifest = datastore.load_manifest_json(&backup_dir)?;
+ let (manifest, _) = datastore.load_manifest(&backup_dir)?;
- let notes = manifest["unprotected"]["notes"]
+ let notes = manifest.unprotected["notes"]
.as_str()
.unwrap_or("");
},
},
access: {
- permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_MODIFY, true),
+ permission: &Permission::Privilege(&["datastore", "{store}"],
+ PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_BACKUP,
+ true),
},
)]
/// Set "notes" for a specific backup
-fn set_notes(
+pub fn set_notes(
store: String,
backup_type: String,
backup_id: String,
) -> Result<(), Error> {
let datastore = DataStore::lookup_datastore(&store)?;
- let userid: Userid = rpcenv.get_user().unwrap().parse()?;
- let user_info = CachedUserInfo::new()?;
- let user_privs = user_info.lookup_privs(&userid, &["datastore", &store]);
-
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
- let allowed = (user_privs & PRIV_DATASTORE_READ) != 0;
- if !allowed { check_backup_owner(&datastore, backup_dir.group(), &userid)?; }
+ check_priv_or_backup_owner(&datastore, backup_dir.group(), &auth_id, PRIV_DATASTORE_MODIFY)?;
- let mut manifest = datastore.load_manifest_json(&backup_dir)?;
-
- manifest["unprotected"]["notes"] = notes.into();
-
- datastore.store_manifest(&backup_dir, manifest)?;
+ datastore.update_manifest(&backup_dir,|manifest| {
+ manifest.unprotected["notes"] = notes.into();
+ }).map_err(|err| format_err!("unable to update manifest blob - {}", err))?;
Ok(())
}
#[api(
- input: {
+ input: {
properties: {
store: {
schema: DATASTORE_SCHEMA,
schema: BACKUP_ID_SCHEMA,
},
"new-owner": {
- type: Userid,
+ type: Authid,
},
},
- },
- access: {
- permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_MODIFY, true),
- },
+ },
+ access: {
+ permission: &Permission::Anybody,
+ description: "Datastore.Modify on whole datastore, or changing ownership between user and a user's token for owned backups with Datastore.Backup"
+ },
)]
/// Change owner of a backup group
-fn set_backup_owner(
+pub fn set_backup_owner(
store: String,
backup_type: String,
backup_id: String,
- new_owner: Userid,
- _rpcenv: &mut dyn RpcEnvironment,
+ new_owner: Authid,
+ rpcenv: &mut dyn RpcEnvironment,
) -> Result<(), Error> {
let datastore = DataStore::lookup_datastore(&store)?;
let backup_group = BackupGroup::new(backup_type, backup_id);
+ let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
+
let user_info = CachedUserInfo::new()?;
- if !user_info.is_active_user(&new_owner) {
- bail!("user '{}' is inactive or non-existent", new_owner);
+ let privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
+
+ let allowed = if (privs & PRIV_DATASTORE_MODIFY) != 0 {
+ // High-privilege user/token
+ true
+ } else if (privs & PRIV_DATASTORE_BACKUP) != 0 {
+ let owner = datastore.get_owner(&backup_group)?;
+
+ match (owner.is_token(), new_owner.is_token()) {
+ (true, true) => {
+ // API token to API token, owned by same user
+ let owner = owner.user();
+ let new_owner = new_owner.user();
+ owner == new_owner && Authid::from(owner.clone()) == auth_id
+ },
+ (true, false) => {
+ // API token to API token owner
+ Authid::from(owner.user().clone()) == auth_id
+ && new_owner == auth_id
+ },
+ (false, true) => {
+ // API token owner to API token
+ owner == auth_id
+ && Authid::from(new_owner.user().clone()) == auth_id
+ },
+ (false, false) => {
+ // User to User, not allowed for unprivileged users
+ false
+ },
+ }
+ } else {
+ false
+ };
+
+ if !allowed {
+ return Err(http_err!(UNAUTHORIZED,
+ "{} does not have permission to change owner of backup group '{}' to {}",
+ auth_id,
+ backup_group,
+ new_owner,
+ ));
+ }
+
+ if !user_info.is_active_auth_id(&new_owner) {
+ bail!("{} '{}' is inactive or non-existent",
+ if new_owner.is_token() {
+ "API token".to_string()
+ } else {
+ "user".to_string()
+ },
+ new_owner);
}
datastore.set_owner(&backup_group, &new_owner, true)?;
"groups",
&Router::new()
.get(&API_METHOD_LIST_GROUPS)
+ .delete(&API_METHOD_DELETE_GROUP)
),
(
"notes",