[PATCH proxmox-backup 1/1] sync: pull: refuse to overwrite pre-existing encrypted snapshot

[PATCH proxmox-backup 1/1] sync: pull: refuse to overwrite pre-existing encrypted snapshot

[Christian Ebner]

If the source snapshot is not encrypted, the target snapshot however
is pre-existing and there is no decryption key which would detect the
mismatch, the unencrypted source will overwrite the encrypted target
due to resync because of mismatching raw manifests.

Further, currently regular syncs of two potentially clashing
snapshots from different sources would lead to overwritig of the
target snapshot as well, since byte wise manifests differ.

Protect against this by extending the key matching checks, refusing
to overwrite any locally encrypted by a not decrypted source as well
as comparing content by calculating the signature using a dummy key
if both, source and pre-existing target are not encrypted.

Reported-by: Daniel Kral <d.kral@proxmox.com>
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/server/pull.rs | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/server/pull.rs b/src/server/pull.rs
index 5fa18cefa..7c4cd9332 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -942,6 +942,19 @@ async fn optionally_use_decryption_key(
     log_sender: Arc<LogLineSender>,
 ) -> Result<(Option<Arc<CryptConfig>>, bool), Error> {
     let Some(key_fp) = manifest.fingerprint().with_context(|| prefix.clone())? else {
+        if let Some(existing_manifest) = existing_target_manifest {
+            if existing_manifest.fingerprint()?.is_some() {
+                bail!("Local encrypted or signed snapshot detected, but source is not encrypted, refuse to sync");
+            } else {
+                // just used to detect unsigned source and pre-existing target clashes
+                let dummy = CryptConfig::new([0u8; 32])?;
+                if existing_manifest.signature(&dummy)? != manifest.signature(&dummy)? {
+                    // neighther source nor target encrypted, but manifests differ
+                    bail!("Different content for pre-existing local snapshot and source snapshot detected, refuse to sync");
+                }
+            }
+        }
+
         return Ok((None, false)); // no fingerprint on source, regular pull
     };
 
-- 
2.47.3

applied: [PATCH proxmox-backup 1/1] sync: pull: refuse to overwrite pre-existing encrypted snapshot

[Thomas Lamprecht]

On Wed, 29 Apr 2026 16:37:40 +0200, Christian Ebner wrote:
> If the source snapshot is not encrypted, the target snapshot however
> is pre-existing and there is no decryption key which would detect the
> mismatch, the unencrypted source will overwrite the encrypted target
> due to resync because of mismatching raw manifests.
> 
> Further, currently regular syncs of two potentially clashing
> snapshots from different sources would lead to overwritig of the
> target snapshot as well, since byte wise manifests differ.
> 
> [...]

Applied, thanks!

[1/1] sync: pull: refuse to overwrite pre-existing encrypted snapshot
      commit: acfd017b761339177e5b069695fd3737178641f9