drop pbs_tools::auth

`pbs_client::connect_to_localhost` now requires the key as
optional parameter

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/pbs-client/src/lib.rs b/pbs-client/src/lib.rs
index d14a36170fd36994a2681ca52e5eb6bbc1a472e2..eeeff71eae2cd620657ff04967cb7887abd6693e 100644 (file)
--- a/pbs-client/src/lib.rs
+++ b/pbs-client/src/lib.rs
@@ -4,11 +4,11 @@
 //! server using https.
 
 use anyhow::Error;
+use openssl::pkey::{PKey, Private};
 
 use pbs_api_types::{Authid, Userid};
 use pbs_tools::ticket::Ticket;
 use pbs_tools::cert::CertInfo;
-use pbs_tools::auth::private_auth_key;
 
 pub mod catalog_shell;
 pub mod dynamic_index;
@@ -53,22 +53,15 @@ pub const PROXMOX_BACKUP_TCP_KEEPALIVE_TIME: u32 = 120;
 /// Connect to localhost:8007 as root@pam
 ///
 /// This automatically creates a ticket if run as 'root' user.
-pub fn connect_to_localhost() -> Result<HttpClient, Error> {
-
-    let uid = nix::unistd::Uid::current();
-
-    let client = if uid.is_root()  {
+pub fn connect_to_localhost(auth_key: Option<&PKey<Private>>) -> Result<HttpClient, Error> {
+    let options = if let Some(auth_key) = auth_key {
         let ticket = Ticket::new("PBS", Userid::root_userid())?
-            .sign(private_auth_key(), None)?;
+            .sign(auth_key, None)?;
         let fingerprint = CertInfo::new()?.fingerprint()?;
-        let options = HttpClientOptions::new_non_interactive(ticket, Some(fingerprint));
-
-        HttpClient::new("localhost", 8007, Authid::root_auth_id(), options)?
+        HttpClientOptions::new_non_interactive(ticket, Some(fingerprint))
     } else {
-        let options = HttpClientOptions::new_interactive(None, None);
-
-        HttpClient::new("localhost", 8007, Authid::root_auth_id(), options)?
+        HttpClientOptions::new_interactive(None, None)
     };
 
-    Ok(client)
+    HttpClient::new("localhost", 8007, Authid::root_auth_id(), options)
 }

diff --git a/pbs-tools/src/auth.rs b/pbs-tools/src/auth.rs
deleted file mode 100644 (file)
index 6e605dd..0000000
--- a/pbs-tools/src/auth.rs
+++ /dev/null
@@ -1,26 +0,0 @@
-//! Helpers for authentication used by both client and server.
-
-use anyhow::Error;
-use lazy_static::lazy_static;
-use openssl::pkey::{PKey, Private};
-use openssl::rsa::Rsa;
-
-use proxmox::tools::fs::file_get_contents;
-
-use pbs_buildcfg::configdir;
-
-fn load_private_auth_key() -> Result<PKey<Private>, Error> {
-    let pem = file_get_contents(configdir!("/authkey.key"))?;
-    let rsa = Rsa::private_key_from_pem(&pem)?;
-    let key = PKey::from_rsa(rsa)?;
-
-    Ok(key)
-}
-
-pub fn private_auth_key() -> &'static PKey<Private> {
-    lazy_static! {
-        static ref KEY: PKey<Private> = load_private_auth_key().unwrap();
-    }
-
-    &KEY
-}

diff --git a/pbs-tools/src/lib.rs b/pbs-tools/src/lib.rs
index 6c2f0ff5c1f704edd5476a6f04a035cacb880407..6b7b600bd80c9785449e8b6251a1913f830590f5 100644 (file)
--- a/pbs-tools/src/lib.rs
+++ b/pbs-tools/src/lib.rs
@@ -1,5 +1,4 @@
 pub mod acl;
-pub mod auth;
 pub mod blocking;
 pub mod borrow;
 pub mod broadcast_future;

diff --git a/src/api2/access/mod.rs b/src/api2/access/mod.rs
index 52963d3cf925911a48e73481eb784d6787d342a7..7e11edaa7d36e4263d7d3e7245037ecd258b2a6e 100644 (file)
--- a/src/api2/access/mod.rs
+++ b/src/api2/access/mod.rs
@@ -15,15 +15,13 @@ use pbs_api_types::{
     Userid, Authid, PASSWORD_SCHEMA, ACL_PATH_SCHEMA,
     PRIVILEGES, PRIV_PERMISSIONS_MODIFY, PRIV_SYS_AUDIT,
 };
-use pbs_tools::auth::private_auth_key;
 use pbs_tools::ticket::{self, Empty, Ticket};
 use pbs_config::acl::AclTreeNode;
+use pbs_config::CachedUserInfo;
 
 use crate::auth_helpers::*;
-use crate::server::ticket::ApiTicket;
-
-use pbs_config::CachedUserInfo;
 use crate::config::tfa::TfaChallenge;
+use crate::server::ticket::ApiTicket;
 
 pub mod acl;
 pub mod domain;

diff --git a/src/api2/access/openid.rs b/src/api2/access/openid.rs
index 8fe62ad2ef46c52a4b231165811a46acbb76ae17..4da1ff04e5f533c3080307a66ceec9e61610fe68 100644 (file)
--- a/src/api2/access/openid.rs
+++ b/src/api2/access/openid.rs
@@ -13,16 +13,14 @@ use proxmox_openid::{OpenIdAuthenticator,  OpenIdConfig};
 
 use pbs_api_types::{Userid, User, REALM_ID_SCHEMA};
 use pbs_buildcfg::PROXMOX_BACKUP_RUN_DIR_M;
-use pbs_tools::auth::private_auth_key;
 use pbs_tools::ticket::Ticket;
 use pbs_config::domains::{OpenIdUserAttribute, OpenIdRealmConfig};
 
-use crate::server::ticket::ApiTicket;
 use pbs_config::CachedUserInfo;
-
 use pbs_config::open_backup_lockfile;
 
 use crate::auth_helpers::*;
+use crate::server::ticket::ApiTicket;
 
 fn openid_authenticator(realm_config: &OpenIdRealmConfig, redirect_url: &str) -> Result<OpenIdAuthenticator, Error> {
     let config = OpenIdConfig {

diff --git a/src/api2/node/mod.rs b/src/api2/node/mod.rs
index 9f2064720ff6b13c8ec523cd30977cb6b2868efd..9a427235c4397e9446b01da2e7b18d37ea76d8e9 100644 (file)
--- a/src/api2/node/mod.rs
+++ b/src/api2/node/mod.rs
@@ -20,12 +20,13 @@ use proxmox::list_subdirs_api_method;
 use proxmox::{identity, sortable};
 use proxmox_http::websocket::WebSocket;
 
+use proxmox_rest_server::WorkerTask;
+
 use pbs_api_types::{Authid, NODE_SCHEMA, PRIV_SYS_CONSOLE};
-use pbs_tools::auth::private_auth_key;
 use pbs_tools::ticket::{self, Empty, Ticket};
 
-use proxmox_rest_server::WorkerTask;
 use crate::tools;
+use crate::auth_helpers::private_auth_key;
 
 pub mod apt;
 pub mod certificates;

diff --git a/src/auth_helpers.rs b/src/auth_helpers.rs
index 890816ac307284ca6d958d02caab26dbcb5097d5..d88bf8cccbe9c615012ba06efc1a7ac0a5e54dc1 100644 (file)
--- a/src/auth_helpers.rs
+++ b/src/auth_helpers.rs
@@ -2,7 +2,7 @@ use std::path::PathBuf;
 
 use anyhow::{bail, format_err, Error};
 use lazy_static::lazy_static;
-use openssl::pkey::{PKey, Public};
+use openssl::pkey::{PKey, Private, Public};
 use openssl::rsa::Rsa;
 use openssl::sha;
 
@@ -170,3 +170,19 @@ pub fn public_auth_key() -> &'static PKey<Public> {
 
     &KEY
 }
+
+fn load_private_auth_key() -> Result<PKey<Private>, Error> {
+    let pem = file_get_contents(configdir!("/authkey.key"))?;
+    let rsa = Rsa::private_key_from_pem(&pem)?;
+    let key = PKey::from_rsa(rsa)?;
+
+    Ok(key)
+}
+
+pub fn private_auth_key() -> &'static PKey<Private> {
+    lazy_static! {
+        static ref KEY: PKey<Private> = load_private_auth_key().unwrap();
+    }
+
+    &KEY
+}

diff --git a/src/bin/proxmox-backup-api.rs b/src/bin/proxmox-backup-api.rs
index e3f2531f8b950b9cadebcd7e92350f48dad6b830..d687cda09c1548cf0b2cc5afe57cd864fec4a2f2 100644 (file)
--- a/src/bin/proxmox-backup-api.rs
+++ b/src/bin/proxmox-backup-api.rs
@@ -9,7 +9,6 @@ use proxmox::try_block;
 use proxmox::api::RpcEnvironmentType;
 use proxmox::tools::fs::CreateOptions;
 
-use pbs_tools::auth::private_auth_key;
 use proxmox_rest_server::{daemon, ApiConfig, RestServer};
 
 use proxmox_backup::server::auth::default_api_auth;

diff --git a/src/bin/proxmox-backup-manager.rs b/src/bin/proxmox-backup-manager.rs
index 9fb606919cb8ac5641ebccedf5eae4a9bb51350b..87f7034d934209c73dfe636d56b859243acfc0ba 100644 (file)
--- a/src/bin/proxmox-backup-manager.rs
+++ b/src/bin/proxmox-backup-manager.rs
@@ -7,7 +7,7 @@ use serde_json::{json, Value};
 use proxmox::api::{api, cli::*, RpcEnvironment};
 use proxmox::tools::fs::CreateOptions;
 
-use pbs_client::{connect_to_localhost, display_task_log, view_task_result};
+use pbs_client::{display_task_log, view_task_result};
 use pbs_tools::percent_encoding::percent_encode_component;
 use pbs_tools::json::required_string_param;
 use pbs_api_types::{
@@ -17,8 +17,9 @@ use pbs_api_types::{
 
 use proxmox_rest_server::wait_for_local_worker;
 
-use proxmox_backup::config;
 use proxmox_backup::api2;
+use proxmox_backup::client_helpers::connect_to_localhost;
+use proxmox_backup::config;
 
 mod proxmox_backup_manager;
 use proxmox_backup_manager::*;

diff --git a/src/bin/proxmox-tape.rs b/src/bin/proxmox-tape.rs
index 615c8a916c5c6141944fec07ac28796855d00cd3..98d28c9569357d45c35cc7403e984952687b55d1 100644 (file)
--- a/src/bin/proxmox-tape.rs
+++ b/src/bin/proxmox-tape.rs
@@ -14,7 +14,7 @@ use proxmox::{
     },
 };
 
-use pbs_client::{connect_to_localhost, view_task_result};
+use pbs_client::view_task_result;
 use pbs_tools::format::{
     HumanByte,
     render_epoch,
@@ -49,6 +49,7 @@ use proxmox_backup::{
             proxmox_tape_magic_to_text,
         },
     },
+    client_helpers::connect_to_localhost,
 };
 
 mod proxmox_tape;

diff --git a/src/bin/proxmox_backup_debug/api.rs b/src/bin/proxmox_backup_debug/api.rs
index 003f6677c273f0227f05fe73cca5cccda10d7fbd..141c0579f0c39ab946234b78dcd289b00a83460e 100644 (file)
--- a/src/bin/proxmox_backup_debug/api.rs
+++ b/src/bin/proxmox_backup_debug/api.rs
@@ -16,9 +16,11 @@ use proxmox::api::{
 };
 
 use pbs_api_types::{PROXMOX_UPID_REGEX, UPID};
-use pbs_client::{connect_to_localhost, view_task_result};
+use pbs_client::view_task_result;
 use proxmox_rest_server::normalize_uri_path;
 
+use proxmox_backup::client_helpers::connect_to_localhost;
+
 const PROG_NAME: &str = "proxmox-backup-debug api";
 const URL_ASCIISET: percent_encoding::AsciiSet = percent_encoding::NON_ALPHANUMERIC.remove(b'/');
 

diff --git a/src/bin/proxmox_backup_manager/datastore.rs b/src/bin/proxmox_backup_manager/datastore.rs
index 969e0420f71eeeca46f413c318763d21cbc13638..e5ef266034854a051602f400ee604c7aa172fd7c 100644 (file)
--- a/src/bin/proxmox_backup_manager/datastore.rs
+++ b/src/bin/proxmox_backup_manager/datastore.rs
@@ -3,10 +3,11 @@ use serde_json::Value;
 
 use proxmox::api::{api, cli::*, RpcEnvironment, ApiHandler};
 
-use pbs_client::{connect_to_localhost, view_task_result};
+use pbs_client::view_task_result;
 use pbs_api_types::{DataStoreConfig, DATASTORE_SCHEMA};
 
 use proxmox_backup::api2;
+use proxmox_backup::client_helpers::connect_to_localhost;
 
 #[api(
     input: {

diff --git a/src/bin/proxmox_tape/backup_job.rs b/src/bin/proxmox_tape/backup_job.rs
index 65e1ac4525162cc24157d5510baa38250be54039..b5662f169d9bb0b733aca5d87bce88c1c53a233e 100644 (file)
--- a/src/bin/proxmox_tape/backup_job.rs
+++ b/src/bin/proxmox_tape/backup_job.rs
@@ -4,9 +4,10 @@ use serde_json::Value;
 use proxmox::api::{api, cli::*, RpcEnvironment, ApiHandler};
 
 use pbs_api_types::JOB_ID_SCHEMA;
-use pbs_client::{connect_to_localhost, view_task_result};
+use pbs_client::view_task_result;
 
 use proxmox_backup::api2;
+use proxmox_backup::client_helpers::connect_to_localhost;
 
 #[api(
     input: {

diff --git a/src/client_helpers.rs b/src/client_helpers.rs
new file mode 100644 (file)
index 0000000..154d7fd
--- /dev/null
+++ b/src/client_helpers.rs
@@ -0,0 +1,13 @@
+use anyhow::Error;
+
+use crate::auth_helpers::private_auth_key;
+
+/// As root we have access to the private key file and can use it directly. Otherwise the connect
+/// call will interactively query the password.
+pub fn connect_to_localhost() -> Result<pbs_client::HttpClient, Error> {
+    pbs_client::connect_to_localhost(if nix::unistd::Uid::current().is_root() {
+        Some(private_auth_key())
+    } else {
+        None
+    })
+}

diff --git a/src/lib.rs b/src/lib.rs
index fcbc2e18e66f1c7408e9b6968832f742dba16e12..fa08b4fa0c823590dded8256e746c5d126c373bf 100644 (file)
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -25,3 +25,5 @@ pub mod rrd;
 pub mod tape;
 
 pub mod acme;
+
+pub mod client_helpers;