[PATCH proxmox{,-backup} 00/20] fix #7251: implement server side encryption support for push sync jobs

[Christian Ebner <c.ebner@proxmox.com>]

This patch series implements support for encrypting backup snapshots
when pushing from a source PBS instance to an untrusted remote target
PBS instance. Further, it adds support to decrypt snapshots being
encrypted on the remote source PBS when pulling the contents to the
local target PBS instance. This allows to perform full server side
encryption/decryption when syncing with a less trusted remote PBS.

In order to encrypt/decrypt snapshots, a new encryption key entity
is introduced, to be created as global instance on the PBS, placed and
managed by it's own dedicated config. Keys with secret are stored
in dedicated files so they only need to be loaded when accessing the
key, not for listing of configuration.

The sync jobs in push and pull direction are extended to receive an
additional encryption key parameter, allowing the given key to be
used for encryption/decription of snapshots, depending on the sync
direction. In order to encrypt/decrypt the contents, chunks, index
files, blobs and manifest are additionally processed, rewritten when
required.

Link to the bugtracker issue:
https://bugzilla.proxmox.com/show_bug.cgi?id=7251


proxmox:

Christian Ebner (2):
  pbs-api-types: define encryption key type and schema
  pbs-api-types: sync job: add optional encryption key to config

 pbs-api-types/src/jobs.rs           | 11 ++++++++--
 pbs-api-types/src/key_derivation.rs | 34 ++++++++++++++++++++++++++---
 pbs-api-types/src/lib.rs            |  2 +-
 3 files changed, 41 insertions(+), 6 deletions(-)


proxmox-backup:

Christian Ebner (18):
  pbs-key-config: introduce store_with() for KeyConfig
  pbs-config: implement encryption key config handling
  pbs-config: acls: add 'encryption-keys' as valid 'system' subpath
  ui: expose 'encryption-keys' as acl subpath for 'system'
  api: config: add endpoints for encryption key manipulation
  api: config: allow encryption key manipulation for sync job
  sync: push: rewrite manifest instead of pushing pre-existing one
  sync: add helper to check encryption key acls and load key
  fix #7251: api: push: encrypt snapshots using configured encryption
    key
  ui: define and expose encryption key management menu item and windows
  ui: expose assigning encryption key to sync jobs
  sync: pull: load encryption key if given in job config
  sync: expand source chunk reader trait by crypt config
  sync: pull: introduce and use decrypt index writer if crypt config
  sync: pull: extend encountered chunk by optional decrypted digest
  sync: pull: decrypt blob files on pull if encryption key is configured
  sync: pull: decrypt chunks and rewrite index file for matching key
  sync: pull: decrypt snapshots with matching encryption key fingerprint

 pbs-config/Cargo.toml              |   1 +
 pbs-config/src/acl.rs              |   4 +-
 pbs-config/src/encryption_keys.rs  | 159 +++++++++++
 pbs-config/src/lib.rs              |   1 +
 pbs-key-config/src/lib.rs          |  36 ++-
 src/api2/config/encryption_keys.rs | 115 ++++++++
 src/api2/config/mod.rs             |   2 +
 src/api2/config/sync.rs            |  10 +
 src/api2/pull.rs                   |  15 +-
 src/api2/push.rs                   |  14 +-
 src/server/pull.rs                 | 416 ++++++++++++++++++++++++-----
 src/server/push.rs                 | 222 +++++++++++----
 src/server/sync.rs                 |  57 +++-
 www/Makefile                       |   3 +
 www/NavigationTree.js              |   6 +
 www/Utils.js                       |   1 +
 www/config/EncryptionKeysView.js   | 143 ++++++++++
 www/form/EncryptionKeySelector.js  |  59 ++++
 www/form/PermissionPathSelector.js |   1 +
 www/window/EncryptionKeysEdit.js   | 382 ++++++++++++++++++++++++++
 www/window/SyncJobEdit.js          |  11 +
 21 files changed, 1512 insertions(+), 146 deletions(-)
 create mode 100644 pbs-config/src/encryption_keys.rs
 create mode 100644 src/api2/config/encryption_keys.rs
 create mode 100644 www/config/EncryptionKeysView.js
 create mode 100644 www/form/EncryptionKeySelector.js
 create mode 100644 www/window/EncryptionKeysEdit.js


Summary over all repositories:
  24 files changed, 1553 insertions(+), 152 deletions(-)

-- 
Generated by murpp 0.11.0