src/bin/proxmox_backup_client/mount.rs

   1 use std::path::PathBuf;
   2 use std::sync::Arc;
   3 use std::os::unix::io::RawFd;
   4 use std::path::Path;
   5 use std::ffi::OsStr;
   6 use std::collections::HashMap;
   7 use std::hash::BuildHasher;
   8
   9 use anyhow::{bail, format_err, Error};
  10 use serde_json::Value;
  11 use tokio::signal::unix::{signal, SignalKind};
  12 use nix::unistd::{fork, ForkResult, pipe};
  13 use futures::select;
  14 use futures::future::FutureExt;
  15 use futures::stream::{StreamExt, TryStreamExt};
  16
  17 use proxmox::{sortable, identity};
  18 use proxmox::api::{ApiHandler, ApiMethod, RpcEnvironment, schema::*, cli::*};
  19
  20
  21 use proxmox_backup::tools;
  22 use proxmox_backup::backup::{
  23     load_and_decrypt_key,
  24     CryptConfig,
  25     IndexFile,
  26     BackupDir,
  27     BackupGroup,
  28     BufferedDynamicReader,
  29     AsyncIndexReader,
  30 };
  31
  32 use proxmox_backup::client::*;
  33
  34 use crate::{
  35     REPO_URL_SCHEMA,
  36     extract_repository_from_value,
  37     complete_pxar_archive_name,
  38     complete_img_archive_name,
  39     complete_group_or_snapshot,
  40     complete_repository,
  41     record_repository,
  42     connect,
  43     api_datastore_latest_snapshot,
  44     BufferedDynamicReadAt,
  45 };
  46
  47 #[sortable]
  48 const API_METHOD_MOUNT: ApiMethod = ApiMethod::new(
  49     &ApiHandler::Sync(&mount),
  50     &ObjectSchema::new(
  51         "Mount pxar archive.",
  52         &sorted!([
  53             ("snapshot", false, &StringSchema::new("Group/Snapshot path.").schema()),
  54             ("archive-name", false, &StringSchema::new("Backup archive name.").schema()),
  55             ("target", false, &StringSchema::new("Target directory path.").schema()),
  56             ("repository", true, &REPO_URL_SCHEMA),
  57             ("keyfile", true, &StringSchema::new("Path to encryption key.").schema()),
  58             ("verbose", true, &BooleanSchema::new("Verbose output and stay in foreground.").default(false).schema()),
  59         ]),
  60     )
  61 );
  62
  63 #[sortable]
  64 const API_METHOD_MAP: ApiMethod = ApiMethod::new(
  65     &ApiHandler::Sync(&mount),
  66     &ObjectSchema::new(
  67         "Map a drive image from a VM backup to a local loopback device. Use 'unmap' to undo.
  68 WARNING: Only do this with *trusted* backups!",
  69         &sorted!([
  70             ("snapshot", false, &StringSchema::new("Group/Snapshot path.").schema()),
  71             ("archive-name", false, &StringSchema::new("Backup archive name.").schema()),
  72             ("repository", true, &REPO_URL_SCHEMA),
  73             ("keyfile", true, &StringSchema::new("Path to encryption key.").schema()),
  74             ("verbose", true, &BooleanSchema::new("Verbose output and stay in foreground.").default(false).schema()),
  75         ]),
  76     )
  77 );
  78
  79 #[sortable]
  80 const API_METHOD_UNMAP: ApiMethod = ApiMethod::new(
  81     &ApiHandler::Sync(&unmap),
  82     &ObjectSchema::new(
  83         "Unmap a loop device mapped with 'map' and release all resources.",
  84         &sorted!([
  85             ("name", true, &StringSchema::new(
  86                 concat!("Archive name, path to loopdev (/dev/loopX) or loop device number. ",
  87                         "Omit to list all current mappings and force cleaning up leftover instances.")
  88             ).schema()),
  89         ]),
  90     )
  91 );
  92
  93 pub fn mount_cmd_def() -> CliCommand {
  94
  95     CliCommand::new(&API_METHOD_MOUNT)
  96         .arg_param(&["snapshot", "archive-name", "target"])
  97         .completion_cb("repository", complete_repository)
  98         .completion_cb("snapshot", complete_group_or_snapshot)
  99         .completion_cb("archive-name", complete_pxar_archive_name)
 100         .completion_cb("target", tools::complete_file_name)
 101 }
 102
 103 pub fn map_cmd_def() -> CliCommand {
 104
 105     CliCommand::new(&API_METHOD_MAP)
 106         .arg_param(&["snapshot", "archive-name"])
 107         .completion_cb("repository", complete_repository)
 108         .completion_cb("snapshot", complete_group_or_snapshot)
 109         .completion_cb("archive-name", complete_img_archive_name)
 110 }
 111
 112 pub fn unmap_cmd_def() -> CliCommand {
 113
 114     CliCommand::new(&API_METHOD_UNMAP)
 115         .arg_param(&["name"])
 116         .completion_cb("name", complete_mapping_names)
 117 }
 118
 119 fn complete_mapping_names<S: BuildHasher>(_arg: &str, _param: &HashMap<String, String, S>)
 120     -> Vec<String>
 121 {
 122     match tools::fuse_loop::find_all_mappings() {
 123         Ok(mappings) => mappings
 124             .filter_map(|(name, _)| {
 125                 tools::systemd::unescape_unit(&name).ok()
 126             }).collect(),
 127         Err(_) => Vec::new()
 128     }
 129 }
 130
 131 fn mount(
 132     param: Value,
 133     _info: &ApiMethod,
 134     _rpcenv: &mut dyn RpcEnvironment,
 135 ) -> Result<Value, Error> {
 136
 137     let verbose = param["verbose"].as_bool().unwrap_or(false);
 138     if verbose {
 139         // This will stay in foreground with debug output enabled as None is
 140         // passed for the RawFd.
 141         return proxmox_backup::tools::runtime::main(mount_do(param, None));
 142     }
 143
 144     // Process should be deamonized.
 145     // Make sure to fork before the async runtime is instantiated to avoid troubles.
 146     let pipe = pipe()?;
 147     match unsafe { fork() } {
 148         Ok(ForkResult::Parent { .. }) => {
 149             nix::unistd::close(pipe.1).unwrap();
 150             // Blocks the parent process until we are ready to go in the child
 151             let _res = nix::unistd::read(pipe.0, &mut [0]).unwrap();
 152             Ok(Value::Null)
 153         }
 154         Ok(ForkResult::Child) => {
 155             nix::unistd::close(pipe.0).unwrap();
 156             nix::unistd::setsid().unwrap();
 157             proxmox_backup::tools::runtime::main(mount_do(param, Some(pipe.1)))
 158         }
 159         Err(_) => bail!("failed to daemonize process"),
 160     }
 161 }
 162
 163 async fn mount_do(param: Value, pipe: Option<RawFd>) -> Result<Value, Error> {
 164     let repo = extract_repository_from_value(&param)?;
 165     let archive_name = tools::required_string_param(&param, "archive-name")?;
 166     let client = connect(&repo)?;
 167
 168     let target = param["target"].as_str();
 169
 170     record_repository(&repo);
 171
 172     let path = tools::required_string_param(&param, "snapshot")?;
 173     let (backup_type, backup_id, backup_time) = if path.matches('/').count() == 1 {
 174         let group: BackupGroup = path.parse()?;
 175         api_datastore_latest_snapshot(&client, repo.store(), group).await?
 176     } else {
 177         let snapshot: BackupDir = path.parse()?;
 178         (snapshot.group().backup_type().to_owned(), snapshot.group().backup_id().to_owned(), snapshot.backup_time())
 179     };
 180
 181     let keyfile = param["keyfile"].as_str().map(PathBuf::from);
 182     let crypt_config = match keyfile {
 183         None => None,
 184         Some(path) => {
 185             println!("Encryption key file: '{:?}'", path);
 186             let (key, _, fingerprint) = load_and_decrypt_key(&path, &crate::key::get_encryption_key_password)?;
 187             println!("Encryption key fingerprint: '{}'", fingerprint);
 188             Some(Arc::new(CryptConfig::new(key)?))
 189         }
 190     };
 191
 192     let server_archive_name = if archive_name.ends_with(".pxar") {
 193         if let None = target {
 194             bail!("use the 'mount' command to mount pxar archives");
 195         }
 196         format!("{}.didx", archive_name)
 197     } else if archive_name.ends_with(".img") {
 198         if let Some(_) = target {
 199             bail!("use the 'map' command to map drive images");
 200         }
 201         format!("{}.fidx", archive_name)
 202     } else {
 203         bail!("Can only mount/map pxar archives and drive images.");
 204     };
 205
 206     let client = BackupReader::start(
 207         client,
 208         crypt_config.clone(),
 209         repo.store(),
 210         &backup_type,
 211         &backup_id,
 212         backup_time,
 213         true,
 214     ).await?;
 215
 216     let (manifest, _) = client.download_manifest().await?;
 217     manifest.check_fingerprint(crypt_config.as_ref().map(Arc::as_ref))?;
 218
 219     let file_info = manifest.lookup_file_info(&server_archive_name)?;
 220
 221     let daemonize = || -> Result<(), Error> {
 222         if let Some(pipe) = pipe {
 223             nix::unistd::chdir(Path::new("/")).unwrap();
 224             // Finish creation of daemon by redirecting filedescriptors.
 225             let nullfd = nix::fcntl::open(
 226                 "/dev/null",
 227                 nix::fcntl::OFlag::O_RDWR,
 228                 nix::sys::stat::Mode::empty(),
 229             ).unwrap();
 230             nix::unistd::dup2(nullfd, 0).unwrap();
 231             nix::unistd::dup2(nullfd, 1).unwrap();
 232             nix::unistd::dup2(nullfd, 2).unwrap();
 233             if nullfd > 2 {
 234                 nix::unistd::close(nullfd).unwrap();
 235             }
 236             // Signal the parent process that we are done with the setup and it can
 237             // terminate.
 238             nix::unistd::write(pipe, &[0u8])?;
 239             nix::unistd::close(pipe).unwrap();
 240         }
 241
 242         Ok(())
 243     };
 244
 245     let options = OsStr::new("ro,default_permissions");
 246
 247     // handle SIGINT and SIGTERM
 248     let mut interrupt_int = signal(SignalKind::interrupt())?;
 249     let mut interrupt_term = signal(SignalKind::terminate())?;
 250     let mut interrupt = futures::future::select(interrupt_int.next(), interrupt_term.next());
 251
 252     if server_archive_name.ends_with(".didx") {
 253         let index = client.download_dynamic_index(&manifest, &server_archive_name).await?;
 254         let most_used = index.find_most_used_chunks(8);
 255         let chunk_reader = RemoteChunkReader::new(client.clone(), crypt_config, file_info.chunk_crypt_mode(), most_used);
 256         let reader = BufferedDynamicReader::new(index, chunk_reader);
 257         let archive_size = reader.archive_size();
 258         let reader: proxmox_backup::pxar::fuse::Reader =
 259             Arc::new(BufferedDynamicReadAt::new(reader));
 260         let decoder = proxmox_backup::pxar::fuse::Accessor::new(reader, archive_size).await?;
 261
 262         let session = proxmox_backup::pxar::fuse::Session::mount(
 263             decoder,
 264             &options,
 265             false,
 266             Path::new(target.unwrap()),
 267         )
 268         .map_err(|err| format_err!("pxar mount failed: {}", err))?;
 269
 270         daemonize()?;
 271
 272         select! {
 273             res = session.fuse() => res?,
 274             _ = interrupt => {
 275                 // exit on interrupted
 276             }
 277         }
 278     } else if server_archive_name.ends_with(".fidx") {
 279         let index = client.download_fixed_index(&manifest, &server_archive_name).await?;
 280         let size = index.index_bytes();
 281         let chunk_reader = RemoteChunkReader::new(client.clone(), crypt_config, file_info.chunk_crypt_mode(), HashMap::new());
 282         let reader = AsyncIndexReader::new(index, chunk_reader);
 283
 284         let name = &format!("{}:{}/{}", repo.to_string(), path, archive_name);
 285         let name_escaped = tools::systemd::escape_unit(name, false);
 286
 287         let mut session = tools::fuse_loop::FuseLoopSession::map_loop(size, reader, &name_escaped, options).await?;
 288         let loopdev = session.loopdev_path.clone();
 289
 290         let (st_send, st_recv) = futures::channel::mpsc::channel(1);
 291         let (mut abort_send, abort_recv) = futures::channel::mpsc::channel(1);
 292         let mut st_recv = st_recv.fuse();
 293         let mut session_fut = session.main(st_send, abort_recv).boxed().fuse();
 294
 295         // poll until loop file is mapped (or errors)
 296         select! {
 297             res = session_fut => {
 298                 bail!("FUSE session unexpectedly ended before loop file mapping");
 299             },
 300             res = st_recv.try_next() => {
 301                 if let Err(err) = res {
 302                     // init went wrong, abort now
 303                     abort_send.try_send(()).map_err(|err|
 304                         format_err!("error while sending abort signal - {}", err))?;
 305                     // ignore and keep original error cause
 306                     let _ = session_fut.await;
 307                     return Err(err);
 308                 }
 309             }
 310         }
 311
 312         // daemonize only now to be able to print mapped loopdev or startup errors
 313         println!("Image '{}' mapped on {}", name, loopdev);
 314         daemonize()?;
 315
 316         // continue polling until complete or interrupted (which also happens on unmap)
 317         select! {
 318             res = session_fut => res?,
 319             _ = interrupt => {
 320                 // exit on interrupted
 321                 abort_send.try_send(()).map_err(|err|
 322                     format_err!("error while sending abort signal - {}", err))?;
 323                 session_fut.await?;
 324             }
 325         }
 326
 327         println!("Image unmapped");
 328     } else {
 329         bail!("unknown archive file extension (expected .pxar or .img)");
 330     }
 331
 332     Ok(Value::Null)
 333 }
 334
 335 fn unmap(
 336     param: Value,
 337     _info: &ApiMethod,
 338     _rpcenv: &mut dyn RpcEnvironment,
 339 ) -> Result<Value, Error> {
 340
 341     let mut name = match param["name"].as_str() {
 342         Some(name) => name.to_owned(),
 343         None => {
 344             tools::fuse_loop::cleanup_unused_run_files(None);
 345             let mut any = false;
 346             for (backing, loopdev) in tools::fuse_loop::find_all_mappings()? {
 347                 let name = tools::systemd::unescape_unit(&backing)?;
 348                 println!("{}:\t{}", loopdev.unwrap_or("(unmapped)".to_owned()), name);
 349                 any = true;
 350             }
 351             if !any {
 352                 println!("Nothing mapped.");
 353             }
 354             return Ok(Value::Null);
 355         },
 356     };
 357
 358     // allow loop device number alone
 359     if let Ok(num) = name.parse::<u8>() {
 360         name = format!("/dev/loop{}", num);
 361     }
 362
 363     if name.starts_with("/dev/loop") {
 364         tools::fuse_loop::unmap_loopdev(name)?;
 365     } else {
 366         let name = tools::systemd::escape_unit(&name, false);
 367         tools::fuse_loop::unmap_name(name)?;
 368     }
 369
 370     Ok(Value::Null)
 371 }