[PATCH proxmox-backup 2/6] pull: add support for strict decryption checking

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

if enabled, this mode will refuse to sync encrypted snapshots which cannot be
decrypted. the only exception are encrypted snapshots which have previously
been synced without decryption and are just resynced.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 src/api2/pull.rs   | 2 ++
 src/server/pull.rs | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/src/api2/pull.rs b/src/api2/pull.rs
index 20b73b2cc..b80bc9a7d 100644
--- a/src/api2/pull.rs
+++ b/src/api2/pull.rs
@@ -93,6 +93,7 @@ impl TryFrom<&SyncJobConfig> for PullParameters {
             sync_job.resync_corrupt,
             sync_job.worker_threads,
             sync_job.associated_key.clone(),
+            None,
         )
     }
 }
@@ -233,6 +234,7 @@ async fn pull(
         resync_corrupt,
         worker_threads,
         decryption_keys,
+        None,
     )?;
 
     // fixme: set to_stdout to false?
diff --git a/src/server/pull.rs b/src/server/pull.rs
index 5fa18cefa..fcb14b878 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -77,6 +77,8 @@ pub(crate) struct PullParameters {
     worker_threads: Option<usize>,
     /// Decryption key ids and configs to decrypt snapshots with matching key fingerprint
     crypt_configs: Vec<(String, Arc<CryptConfig>)>,
+    /// Only sync encrypted snapshots if a matching key is configured
+    strict_decryption_mode: bool,
 }
 
 impl PullParameters {
@@ -99,6 +101,7 @@ impl PullParameters {
         resync_corrupt: Option<bool>,
         worker_threads: Option<usize>,
         decryption_keys: Option<Vec<String>>,
+        strict_decryption_mode: Option<bool>,
     ) -> Result<Self, Error> {
         if let Some(max_depth) = max_depth {
             ns.check_max_depth(max_depth)?;
@@ -108,6 +111,7 @@ impl PullParameters {
         let resync_corrupt = resync_corrupt.unwrap_or(false);
         let encrypted_only = encrypted_only.unwrap_or(false);
         let verified_only = verified_only.unwrap_or(false);
+        let strict_decryption_mode = strict_decryption_mode.unwrap_or(false);
 
         let source: Arc<dyn SyncSource> = if let Some(remote) = remote {
             let (remote_config, _digest) = pbs_config::remote::config()?;
@@ -165,6 +169,7 @@ impl PullParameters {
             resync_corrupt,
             worker_threads,
             crypt_configs,
+            strict_decryption_mode,
         })
     }
 }
@@ -980,6 +985,10 @@ async fn optionally_use_decryption_key(
             bail!("No matching key found, refusing sync");
         }
 
+        if encrypted && params.strict_decryption_mode {
+            bail!("No matching key found but strict checking requests, refusing to sync");
+        }
+
         // regular sync
         if !params.crypt_configs.is_empty() {
             log_sender
-- 
2.47.3