[pbs-devel] [PATCH proxmox-backup v2] fix #3854 paperkey import to proxmox-tape

[pbs-devel] [PATCH proxmox-backup v2] fix #3854 paperkey import to proxmox-tape

[Markus Frank]

added a parameter to the cli for reading a old paperkeyfile to restore
the key from it. For that i added a json parameter for the api and made
hint optional because hint is already in the proxmox-backupkey-json.

functionality:
proxmox-tape key paperkey [fingerprint of existing key] > paperkey.backup
proxmox-tape key create --paperkey_file paperkey.backup

for importing the key it is irrelevant, if the paperkey got exported as html
or txt.

Signed-off-by: Markus Frank <m.frank@proxmox.com>
---
version 2:
 * added format_err! and ParameterError
 * changed a few "ifs" to "match"

 src/api2/config/tape_encryption_keys.rs | 48 +++++++++++++++++++------
 src/bin/proxmox_tape/encryption_key.rs  | 42 ++++++++++++++++++++--
 2 files changed, 77 insertions(+), 13 deletions(-)

diff --git a/src/api2/config/tape_encryption_keys.rs b/src/api2/config/tape_encryption_keys.rs
index 1ad99377..c16919d2 100644
--- a/src/api2/config/tape_encryption_keys.rs
+++ b/src/api2/config/tape_encryption_keys.rs
@@ -1,9 +1,9 @@
-use anyhow::{bail, Error};
+use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 use hex::FromHex;
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, Permission};
-use proxmox_schema::api;
+use proxmox_schema::{api, ParameterError};
 
 use pbs_api_types::{
     Fingerprint, KeyInfo, Kdf,
@@ -145,6 +145,14 @@ pub fn change_passphrase(
             },
             hint: {
                 schema: PASSWORD_HINT_SCHEMA,
+                optional: true,
+            },
+            backupkey: {
+                description: "A previously exported paperkey in JSON format.",
+                type: String,
+                min_length: 300,
+                max_length: 600,
+                optional: true,
             },
         },
     },
@@ -159,7 +167,8 @@ pub fn change_passphrase(
 pub fn create_key(
     kdf: Option<Kdf>,
     password: String,
-    hint: String,
+    hint: Option<String>,
+    backupkey: Option<String>,
     _rpcenv: &mut dyn RpcEnvironment
 ) -> Result<Fingerprint, Error> {
 
@@ -169,14 +178,31 @@ pub fn create_key(
         bail!("Please specify a key derivation function (none is not allowed here).");
     }
 
-    let (key, mut key_config) = KeyConfig::new(password.as_bytes(), kdf)?;
-    key_config.hint = Some(hint);
-
-    let fingerprint = key_config.fingerprint.clone().unwrap();
-
-    insert_key(key, key_config, false)?;
-
-    Ok(fingerprint)
+    match (hint, backupkey) {
+        (_, Some(backupkey)) => {
+            let key_config: KeyConfig =
+                serde_json::from_str(&backupkey).map_err(|err| format_err!("<errmsg>: {}", err))?;
+            let password_fn = || Ok(password.as_bytes().to_vec());
+            let (key, _created, fingerprint) = key_config.decrypt(&password_fn)?;
+            insert_key(key, key_config, false)?;
+            Ok(fingerprint)
+        }
+        (Some(hint), _) => {
+            let (key, mut key_config) = KeyConfig::new(password.as_bytes(), kdf)?;
+            key_config.hint = Some(hint);
+            let fingerprint = key_config.fingerprint.clone().unwrap();
+            insert_key(key, key_config, false)?;
+            Ok(fingerprint)
+        }
+        (None, None) => {
+            let mut err = ParameterError::new();
+            err.push(
+                "hint".to_string(),
+                format_err!("Please specify either a hint or a backupkey"),
+            );
+            return Err(err.into());
+        }
+    }
 }
 
 
diff --git a/src/bin/proxmox_tape/encryption_key.rs b/src/bin/proxmox_tape/encryption_key.rs
index 156295fd..af47fef9 100644
--- a/src/bin/proxmox_tape/encryption_key.rs
+++ b/src/bin/proxmox_tape/encryption_key.rs
@@ -1,8 +1,8 @@
-use anyhow::{bail, Error};
+use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
 use proxmox_router::{cli::*, ApiHandler, RpcEnvironment};
-use proxmox_schema::api;
+use proxmox_schema::{api, ParameterError};
 use proxmox_sys::linux::tty;
 
 use pbs_api_types::{
@@ -222,6 +222,12 @@ async fn restore_key(
                 type: String,
                 min_length: 1,
                 max_length: 32,
+                optional: true,
+            },
+            paperkey_file: {
+                description: "Paperkeyfile location for importing old backupkey",
+                type: String,
+                optional: true,
             },
         },
     },
@@ -230,12 +236,44 @@ async fn restore_key(
 fn create_key(
     mut param: Value,
     rpcenv: &mut dyn RpcEnvironment,
+    paperkey_file: Option<String>,
 ) -> Result<(), Error> {
 
     if !tty::stdin_isatty() {
         bail!("no password input mechanism available");
     }
 
+    if param["hint"].is_null() && paperkey_file.is_none() {
+        let mut err = ParameterError::new();
+        err.push(
+            "hint".to_string(),
+            format_err!("Please specify either a hint or a paperkey_file"),
+        );
+        return Err(err.into());
+    }
+
+    // searching for PROXMOX BACKUP KEY if a paperkeyfile is defined
+    if let Some(paperkey_file) = paperkey_file {
+        let data = proxmox_sys::fs::file_read_string(paperkey_file)?;
+        let begin = "-----BEGIN PROXMOX BACKUP KEY-----";
+        let start = data.find(begin);
+        let end = data.find("-----END PROXMOX BACKUP KEY-----");
+        match (start, end) {
+            (Some(start), Some(end)) => {
+                if start < end {
+                    let backupkey = &data[start + begin.len()..end];
+                    param["backupkey"] = backupkey.into();
+                    println!("backupkey to import: {}", backupkey);
+                } else {
+                    bail!("paperkey-file is incorrect: End-Marker of backupkey is before Begin-Marker");
+                }
+            }
+            (_, _) => {
+                bail!("Begin/End-Marker of backupkey in paperkey-file is missing");
+            }
+        }
+    }
+
     let password = tty::read_and_verify_password("Tape Encryption Key Password: ")?;
 
     param["password"] = String::from_utf8(password)?.into();
-- 
2.30.2