[PATCH proxmox-backup 4/6] sync: wire up strict encryption mode

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

enabling it requires configured encryption/decryption keys, disabling or
unsetting it does not.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 src/api2/config/sync.rs | 30 +++++++++++++++++++++++++++++-
 src/api2/pull.rs        | 13 +++++++++----
 src/api2/push.rs        | 10 ++++++++--
 src/server/sync.rs      |  2 +-
 4 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
index eb82745d9..ac1e6350e 100644
--- a/src/api2/config/sync.rs
+++ b/src/api2/config/sync.rs
@@ -276,9 +276,16 @@ pub fn create_sync_job(
         .unwrap_or_else(|| Authid::root_auth_id());
 
     if sync_direction == SyncDirection::Push {
+        if (config.strict_encryption_mode == Some(true)) != config.active_encryption_key.is_some() {
+            bail!("'strict-encryption-mode' requires encryption key");
+        }
         sync_user_can_access_optional_key(config.active_encryption_key.as_deref(), owner, true)?;
     } else {
-        for key in config.associated_key.as_deref().unwrap_or(&[]) {
+        let keys = config.associated_key.as_deref().unwrap_or(&[]);
+        if (config.strict_encryption_mode == Some(true)) == keys.is_empty() {
+            bail!("'strict-encryption-mode' requires encryption key(s)");
+        }
+        for key in keys {
             sync_user_can_access_optional_key(Some(key), owner, false)?;
         }
     }
@@ -398,6 +405,8 @@ pub enum DeletableProperty {
     ActiveEncryptionKey,
     /// Delete associated key property,
     AssociatedKey,
+    /// Delete strict encryption_mode property,
+    StrictEncryptionMode,
 }
 
 #[api(
@@ -538,6 +547,9 @@ pub fn update_sync_job(
                     // Previous active encryption key might be added as associated below.
                     data.associated_key = None;
                 }
+                DeletableProperty::StrictEncryptionMode => {
+                    data.strict_encryption_mode = None;
+                }
             }
         }
         keep_previous_key_as_associated(
@@ -654,6 +666,21 @@ pub fn update_sync_job(
         data.associated_key = Some(associated_key);
     }
 
+    if let Some(strict_encryption_mode) = update.strict_encryption_mode {
+        data.strict_encryption_mode = Some(strict_encryption_mode);
+    }
+
+    if data.sync_direction == Some(SyncDirection::Push) {
+        if (data.strict_encryption_mode == Some(true)) != data.active_encryption_key.is_some() {
+            bail!("'strict-encryption-mode' requires encryption key");
+        }
+    } else {
+        let keys = data.associated_key.as_deref().unwrap_or(&[]);
+        if (data.strict_encryption_mode == Some(true)) == keys.is_empty() {
+            bail!("'strict-encryption-mode' requires encryption key(s)");
+        }
+    }
+
     if update.limit.rate_in.is_some() {
         data.limit.rate_in = update.limit.rate_in;
     }
@@ -829,6 +856,7 @@ acl:1:/remote/remote1/remotestore1:write@pbs:RemoteSyncOperator
         worker_threads: None,
         active_encryption_key: None,
         associated_key: None,
+        strict_encryption_mode: None,
     };
 
     // should work without ACLs
diff --git a/src/api2/pull.rs b/src/api2/pull.rs
index b80bc9a7d..2d91fbc44 100644
--- a/src/api2/pull.rs
+++ b/src/api2/pull.rs
@@ -10,8 +10,8 @@ use pbs_api_types::{
     Authid, BackupNamespace, GroupFilter, RateLimitConfig, SyncJobConfig, CRYPT_KEY_ID_SCHEMA,
     DATASTORE_SCHEMA, GROUP_FILTER_LIST_SCHEMA, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP,
     PRIV_DATASTORE_PRUNE, PRIV_REMOTE_READ, REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA,
-    RESYNC_CORRUPT_SCHEMA, SYNC_ENCRYPTED_ONLY_SCHEMA, SYNC_VERIFIED_ONLY_SCHEMA,
-    SYNC_WORKER_THREADS_SCHEMA, TRANSFER_LAST_SCHEMA,
+    RESYNC_CORRUPT_SCHEMA, SYNC_ENCRYPTED_ONLY_SCHEMA, SYNC_STRICT_ENCRYPTION_MODE_SCHEMA,
+    SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA, TRANSFER_LAST_SCHEMA,
 };
 use pbs_config::CachedUserInfo;
 use proxmox_rest_server::WorkerTask;
@@ -93,7 +93,7 @@ impl TryFrom<&SyncJobConfig> for PullParameters {
             sync_job.resync_corrupt,
             sync_job.worker_threads,
             sync_job.associated_key.clone(),
-            None,
+            sync_job.strict_encryption_mode,
         )
     }
 }
@@ -163,6 +163,10 @@ impl TryFrom<&SyncJobConfig> for PullParameters {
                 },
                 optional: true,
             },
+            "strict-decryption-mode": {
+                schema: SYNC_STRICT_ENCRYPTION_MODE_SCHEMA,
+                optional: true,
+            }
         },
     },
     access: {
@@ -192,6 +196,7 @@ async fn pull(
     resync_corrupt: Option<bool>,
     worker_threads: Option<usize>,
     decryption_keys: Option<Vec<String>>,
+    strict_decryption_mode: Option<bool>,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<String, Error> {
     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
@@ -234,7 +239,7 @@ async fn pull(
         resync_corrupt,
         worker_threads,
         decryption_keys,
-        None,
+        strict_decryption_mode,
     )?;
 
     // fixme: set to_stdout to false?
diff --git a/src/api2/push.rs b/src/api2/push.rs
index 54dc1e4ee..2ec467161 100644
--- a/src/api2/push.rs
+++ b/src/api2/push.rs
@@ -6,7 +6,8 @@ use pbs_api_types::{
     GROUP_FILTER_LIST_SCHEMA, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP,
     PRIV_DATASTORE_READ, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE,
     REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA, SYNC_ENCRYPTED_ONLY_SCHEMA,
-    SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA, TRANSFER_LAST_SCHEMA,
+    SYNC_STRICT_ENCRYPTION_MODE_SCHEMA, SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA,
+    TRANSFER_LAST_SCHEMA,
 };
 use proxmox_rest_server::WorkerTask;
 use proxmox_router::{Permission, Router, RpcEnvironment};
@@ -116,6 +117,10 @@ fn check_push_privs(
                 schema: CRYPT_KEY_ID_SCHEMA,
                 optional: true,
             },
+            "strict-encryption-mode": {
+                schema: SYNC_STRICT_ENCRYPTION_MODE_SCHEMA,
+                optional: true,
+            }
         },
     },
     access: {
@@ -143,6 +148,7 @@ async fn push(
     transfer_last: Option<usize>,
     worker_threads: Option<usize>,
     encryption_key: Option<String>,
+    strict_encryption_mode: Option<bool>,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<String, Error> {
     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
@@ -176,7 +182,7 @@ async fn push(
         transfer_last,
         worker_threads,
         encryption_key,
-        None,
+        strict_encryption_mode,
     )
     .await?;
 
diff --git a/src/server/sync.rs b/src/server/sync.rs
index 590ad01eb..c78213c7f 100644
--- a/src/server/sync.rs
+++ b/src/server/sync.rs
@@ -733,7 +733,7 @@ pub fn do_sync_job(
                             sync_job.transfer_last,
                             sync_job.worker_threads,
                             sync_job.active_encryption_key,
-                            None,
+                            sync_job.strict_encryption_mode,
                         )
                         .await?;
                         push_store(push_params).await?
-- 
2.47.3