src/PVE/PBSClient.pm

   1 package PVE::PBSClient;
   2 # utility functions for interaction with Proxmox Backup client CLI executable
   3
   4 use strict;
   5 use warnings;
   6
   7 use Fcntl qw(F_GETFD F_SETFD FD_CLOEXEC);
   8 use File::Temp qw(tempdir);
   9 use IO::File;
  10 use JSON;
  11 use POSIX qw(mkfifo strftime ENOENT);
  12
  13 use PVE::JSONSchema qw(get_standard_option);
  14 use PVE::Tools qw(run_command file_set_contents file_get_contents file_read_firstline $IPV6RE);
  15
  16 # returns a repository string suitable for proxmox-backup-client, pbs-restore, etc.
  17 # $scfg must have the following structure:
  18 # {
  19 #     datastore
  20 #     server
  21 #     port        (optional defaults to 8007)
  22 #     username    (optional defaults to 'root@pam')
  23 # }
  24 sub get_repository {
  25     my ($scfg) = @_;
  26
  27     my $server = $scfg->{server};
  28     die "no server given\n" if !defined($server);
  29
  30     $server = "[$server]" if $server =~ /^$IPV6RE$/;
  31
  32     if (my $port = $scfg->{port}) {
  33         $server .= ":$port" if $port != 8007;
  34     }
  35
  36     my $datastore = $scfg->{datastore};
  37     die "no datastore given\n" if !defined($datastore);
  38
  39     my $username = $scfg->{username} // 'root@pam';
  40
  41     return "$username\@$server:$datastore";
  42 }
  43
  44 sub new {
  45     my ($class, $scfg, $storeid, $sdir) = @_;
  46
  47     die "no section config provided\n" if ref($scfg) eq '';
  48     die "undefined store id\n" if !defined($storeid);
  49
  50     my $secret_dir = $sdir // '/etc/pve/priv/storage';
  51
  52     my $self = bless {
  53         scfg => $scfg,
  54         storeid => $storeid,
  55         secret_dir => $secret_dir
  56     }, $class;
  57     return $self;
  58 }
  59
  60 my sub password_file_name {
  61     my ($self) = @_;
  62
  63     return "$self->{secret_dir}/$self->{storeid}.pw";
  64 }
  65
  66 sub set_password {
  67     my ($self, $password) = @_;
  68
  69     my $pwfile = password_file_name($self);
  70     mkdir $self->{secret_dir};
  71
  72     PVE::Tools::file_set_contents($pwfile, "$password\n", 0600);
  73 };
  74
  75 sub delete_password {
  76     my ($self) = @_;
  77
  78     my $pwfile = password_file_name($self);
  79
  80     unlink $pwfile or $! == ENOENT or die "deleting password file failed - $!\n";
  81 };
  82
  83 sub get_password {
  84     my ($self) = @_;
  85
  86     my $pwfile = password_file_name($self);
  87
  88     return PVE::Tools::file_read_firstline($pwfile);
  89 }
  90
  91 sub encryption_key_file_name {
  92     my ($self) = @_;
  93
  94     return "$self->{secret_dir}/$self->{storeid}.enc";
  95 };
  96
  97 sub set_encryption_key {
  98     my ($self, $key) = @_;
  99
 100     my $encfile = $self->encryption_key_file_name();
 101     mkdir $self->{secret_dir};
 102
 103     PVE::Tools::file_set_contents($encfile, "$key\n", 0600);
 104 };
 105
 106 sub delete_encryption_key {
 107     my ($self) = @_;
 108
 109     my $encfile = $self->encryption_key_file_name();
 110
 111     if (!unlink $encfile) {
 112         return if $! == ENOENT;
 113         die "failed to delete encryption key! $!\n";
 114     }
 115 };
 116
 117 # Returns a file handle if there is an encryption key, or `undef` if there is not. Dies on error.
 118 my sub open_encryption_key {
 119     my ($self) = @_;
 120
 121     my $encryption_key_file = $self->encryption_key_file_name();
 122
 123     my $keyfd;
 124     if (!open($keyfd, '<', $encryption_key_file)) {
 125         return undef if $! == ENOENT;
 126         die "failed to open encryption key: $encryption_key_file: $!\n";
 127     }
 128
 129     return $keyfd;
 130 }
 131
 132 my $USE_CRYPT_PARAMS = {
 133     'proxmox-backup-client' => {
 134         backup => 1,
 135         restore => 1,
 136         'upload-log' => 1,
 137     },
 138     'proxmox-file-restore' => {
 139         list => 1,
 140         extract => 1,
 141     },
 142 };
 143
 144 my sub do_raw_client_cmd {
 145     my ($self, $client_cmd, $param, %opts) = @_;
 146
 147     my $client_bin = (delete $opts{binary}) || 'proxmox-backup-client';
 148     my $use_crypto = $USE_CRYPT_PARAMS->{$client_bin}->{$client_cmd} // 0;
 149
 150     my $client_exe = "/usr/bin/$client_bin";
 151     die "executable not found '$client_exe'! $client_bin not installed?\n" if ! -x $client_exe;
 152
 153     my $scfg = $self->{scfg};
 154     my $repo = get_repository($scfg);
 155
 156     my $userns_cmd = delete $opts{userns_cmd};
 157
 158     my $cmd = [];
 159
 160     push @$cmd, @$userns_cmd if defined($userns_cmd);
 161
 162     push @$cmd, $client_exe, $client_cmd;
 163
 164     # This must live in the top scope to not get closed before the `run_command`
 165     my $keyfd;
 166     if ($use_crypto) {
 167         if (defined($keyfd = open_encryption_key($self))) {
 168             my $flags = fcntl($keyfd, F_GETFD, 0)
 169                 // die "failed to get file descriptor flags: $!\n";
 170             fcntl($keyfd, F_SETFD, $flags & ~FD_CLOEXEC)
 171                 or die "failed to remove FD_CLOEXEC from encryption key file descriptor\n";
 172             push @$cmd, '--crypt-mode=encrypt', '--keyfd='.fileno($keyfd);
 173         } else {
 174             push @$cmd, '--crypt-mode=none';
 175         }
 176     }
 177
 178     push @$cmd, @$param if defined($param);
 179
 180     push @$cmd, "--repository", $repo;
 181     if (defined(my $ns = delete($opts{namespace}))) {
 182         push @$cmd, '--ns', $ns;
 183     }
 184
 185     local $ENV{PBS_PASSWORD} = $self->get_password();
 186
 187     local $ENV{PBS_FINGERPRINT} = $scfg->{fingerprint};
 188
 189     # no ascii-art on task logs
 190     local $ENV{PROXMOX_OUTPUT_NO_BORDER} = 1;
 191     local $ENV{PROXMOX_OUTPUT_NO_HEADER} = 1;
 192
 193     if (my $logfunc = $opts{logfunc}) {
 194         $logfunc->("run: " . join(' ', @$cmd));
 195     }
 196
 197     run_command($cmd, %opts);
 198 }
 199
 200 my sub run_raw_client_cmd : prototype($$$%) {
 201     my ($self, $client_cmd, $param, %opts) = @_;
 202     return do_raw_client_cmd($self, $client_cmd, $param, %opts);
 203 }
 204
 205 my sub run_client_cmd : prototype($$;$$$$) {
 206     my ($self, $client_cmd, $param, $no_output, $binary, $namespace) = @_;
 207
 208     my $json_str = '';
 209     my $outfunc = sub { $json_str .= "$_[0]\n" };
 210
 211     $binary //= 'proxmox-backup-client';
 212
 213     $param = [] if !defined($param);
 214     $param = [ $param ] if !ref($param);
 215
 216     $param = [@$param, '--output-format=json'] if !$no_output;
 217
 218     do_raw_client_cmd(
 219         $self,
 220         $client_cmd,
 221         $param,
 222         outfunc => $outfunc,
 223         errmsg => "$binary failed",
 224         binary => $binary,
 225         namespace => $namespace,
 226     );
 227
 228     return undef if $no_output;
 229
 230     my $res = decode_json($json_str);
 231
 232     return $res;
 233 }
 234
 235 sub autogen_encryption_key {
 236     my ($self) = @_;
 237     my $encfile = $self->encryption_key_file_name();
 238     run_command(
 239         ['proxmox-backup-client', 'key', 'create', '--kdf', 'none', $encfile],
 240         errmsg => 'failed to create encryption key'
 241     );
 242     return file_get_contents($encfile);
 243 };
 244
 245 # TODO remove support for namespaced parameters. Needs Breaks for pmg-api and libpve-storage-perl.
 246 # Deprecated! The namespace should be passed in as part of the config in new().
 247 # Snapshot or group parameters can be either just a string and will then default to the namespace
 248 # that's part of the initial configuration in new(), or a tuple of `[namespace, snapshot]`.
 249 my sub split_namespaced_parameter : prototype($$) {
 250     my ($self, $snapshot) = @_;
 251     return ($self->{scfg}->{namespace}, $snapshot) if !ref($snapshot);
 252
 253     (my $namespace, $snapshot) = @$snapshot;
 254     return ($namespace, $snapshot);
 255 }
 256
 257 # lists all snapshots, optionally limited to a specific group
 258 sub get_snapshots {
 259     my ($self, $group) = @_;
 260
 261     my $namespace;
 262     if (defined($group)) {
 263         ($namespace, $group) = split_namespaced_parameter($self, $group);
 264     } else {
 265         $namespace = $self->{scfg}->{namespace};
 266     }
 267
 268     my $param = [];
 269     push @$param, $group if defined($group);
 270
 271     return run_client_cmd($self, "snapshots", $param, undef, undef, $namespace);
 272 };
 273
 274 # create a new PXAR backup of a FS directory tree - doesn't cross FS boundary
 275 # by default.
 276 sub backup_fs_tree {
 277     my ($self, $root, $id, $pxarname, $cmd_opts) = @_;
 278
 279     die "backup-id not provided\n" if !defined($id);
 280     die "backup root dir not provided\n" if !defined($root);
 281     die "archive name not provided\n" if !defined($pxarname);
 282
 283     my $param = [
 284         "$pxarname.pxar:$root",
 285         '--backup-type', 'host',
 286         '--backup-id', $id,
 287     ];
 288
 289     $cmd_opts //= {};
 290
 291     $cmd_opts->{namespace} = $self->{scfg}->{namespace} if defined($self->{scfg}->{namespace});
 292
 293     return run_raw_client_cmd($self, 'backup', $param, %$cmd_opts);
 294 };
 295
 296 sub restore_pxar {
 297     my ($self, $snapshot, $pxarname, $target, $cmd_opts) = @_;
 298
 299     die "snapshot not provided\n" if !defined($snapshot);
 300     die "archive name not provided\n" if !defined($pxarname);
 301     die "restore-target not provided\n" if !defined($target);
 302
 303     (my $namespace, $snapshot) = split_namespaced_parameter($self, $snapshot);
 304
 305     my $param = [
 306         "$snapshot",
 307         "$pxarname.pxar",
 308         "$target",
 309         "--allow-existing-dirs", 0,
 310     ];
 311     $cmd_opts //= {};
 312
 313     $cmd_opts->{namespace} = $namespace;
 314
 315     return run_raw_client_cmd($self, 'restore', $param, %$cmd_opts);
 316 };
 317
 318 sub forget_snapshot {
 319     my ($self, $snapshot) = @_;
 320
 321     die "snapshot not provided\n" if !defined($snapshot);
 322
 323     (my $namespace, $snapshot) = split_namespaced_parameter($self, $snapshot);
 324
 325     return run_client_cmd($self, 'forget', ["$snapshot"], 1, undef, $namespace)
 326 };
 327
 328 sub prune_group {
 329     my ($self, $opts, $prune_opts, $group) = @_;
 330
 331     die "group not provided\n" if !defined($group);
 332
 333     (my $namespace, $group) = split_namespaced_parameter($self, $group);
 334
 335     # do nothing if no keep options specified for remote
 336     return [] if scalar(keys %$prune_opts) == 0;
 337
 338     my $param = [];
 339
 340     push @$param, "--quiet";
 341
 342     if (defined($opts->{'dry-run'}) && $opts->{'dry-run'}) {
 343         push @$param, "--dry-run", $opts->{'dry-run'};
 344     }
 345
 346     foreach my $keep_opt (keys %$prune_opts) {
 347         push @$param, "--$keep_opt", $prune_opts->{$keep_opt};
 348     }
 349     push @$param, "$group";
 350
 351     return run_client_cmd($self, 'prune', $param, undef, undef, $namespace);
 352 };
 353
 354 sub status {
 355     my ($self) = @_;
 356
 357     my $total = 0;
 358     my $free = 0;
 359     my $used = 0;
 360     my $active = 0;
 361
 362     eval {
 363         my $res = run_client_cmd($self, "status");
 364
 365         $active = 1;
 366         $total = $res->{total};
 367         $used = $res->{used};
 368         $free = $res->{avail};
 369     };
 370     if (my $err = $@) {
 371         warn $err;
 372     }
 373
 374     return ($total, $free, $used, $active);
 375 };
 376
 377 sub file_restore_list {
 378     my ($self, $snapshot, $filepath, $base64, $extra_params) = @_;
 379
 380     (my $namespace, $snapshot) = split_namespaced_parameter($self, $snapshot);
 381     my $cmd = [ $snapshot, $filepath, "--base64", $base64 ? 1 : 0];
 382
 383     if (my $timeout = $extra_params->{timeout}) {
 384         push $cmd->@*, '--timeout', $timeout;
 385     }
 386
 387     return run_client_cmd(
 388         $self,
 389         "list",
 390         $cmd,
 391         0,
 392         "proxmox-file-restore",
 393         $namespace,
 394     );
 395 }
 396
 397 # call sync from API, returns a fifo path for streaming data to clients,
 398 # pass it to file_restore_extract to start transfering data
 399 sub file_restore_extract_prepare {
 400     my ($self) = @_;
 401
 402     my $tmpdir = tempdir();
 403     mkfifo("$tmpdir/fifo", 0600)
 404         or die "creating file download fifo '$tmpdir/fifo' failed: $!\n";
 405
 406     # allow reading data for proxy user
 407     my $wwwid = getpwnam('www-data') ||
 408         die "getpwnam failed";
 409     chown $wwwid, -1, "$tmpdir"
 410         or die "changing permission on fifo dir '$tmpdir' failed: $!\n";
 411     chown $wwwid, -1, "$tmpdir/fifo"
 412         or die "changing permission on fifo '$tmpdir/fifo' failed: $!\n";
 413
 414     return "$tmpdir/fifo";
 415 }
 416
 417 # this blocks while data is transfered, call this from a background worker
 418 sub file_restore_extract {
 419     my ($self, $output_file, $snapshot, $filepath, $base64, $tar) = @_;
 420
 421     (my $namespace, $snapshot) = split_namespaced_parameter($self, $snapshot);
 422
 423     my $ret = eval {
 424         local $SIG{ALRM} = sub { die "got timeout\n" };
 425         alarm(30);
 426         sysopen(my $fh, "$output_file", O_WRONLY)
 427             or die "open target '$output_file' for writing failed: $!\n";
 428         alarm(0);
 429
 430         my $fn = fileno($fh);
 431         my $errfunc = sub { print $_[0], "\n"; };
 432
 433         my $cmd = [ $snapshot, $filepath, "-", "--base64", $base64 ? 1 : 0];
 434         if ($tar) {
 435             push @$cmd, '--format', 'tar', '--zstd', 1;
 436         }
 437
 438         return run_raw_client_cmd(
 439             $self,
 440             "extract",
 441             $cmd,
 442             binary => "proxmox-file-restore",
 443             namespace => $namespace,
 444             errfunc => $errfunc,
 445             output => ">&$fn",
 446         );
 447     };
 448     my $err = $@;
 449
 450     unlink($output_file);
 451     $output_file =~ s/fifo$//;
 452     rmdir($output_file) if -d $output_file;
 453
 454     die "file restore task failed: $err" if $err;
 455     return $ret;
 456 }
 457
 458 1;