From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <t.lamprecht@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id 258DE6084F
for <pbs-devel@lists.proxmox.com>; Tue, 17 Nov 2020 19:38:06 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 1557114106
for <pbs-devel@lists.proxmox.com>; Tue, 17 Nov 2020 19:38:06 +0100 (CET)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
[212.186.127.180])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS id 82C3D140FB
for <pbs-devel@lists.proxmox.com>; Tue, 17 Nov 2020 19:38:05 +0100 (CET)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 461D043756
for <pbs-devel@lists.proxmox.com>; Tue, 17 Nov 2020 19:38:05 +0100 (CET)
To: Proxmox Backup Server development discussion <pbs-devel@lists.proxmox.com>,
=?UTF-8?Q?Fabian_Gr=c3=bcnbichler?= <f.gruenbichler@proxmox.com>
References: <20201117175725.3634238-1-f.gruenbichler@proxmox.com>
<20201117175725.3634238-4-f.gruenbichler@proxmox.com>
From: Thomas Lamprecht <t.lamprecht@proxmox.com>
Message-ID: <9c59b316-1768-9549-b90a-d69307f4260c@proxmox.com>
Date: Tue, 17 Nov 2020 19:38:04 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101
Thunderbird/83.0
MIME-Version: 1.0
In-Reply-To: <20201117175725.3634238-4-f.gruenbichler@proxmox.com>
Content-Type: text/plain; charset=UTF-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.089 Adjusted score from AWL reputation of From: address
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
NICE_REPLY_A -0.001 Looks like a legit reply (A)
RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/,
medium trust
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more
information. [proxmox-backup-client.rs, mount.rs]
Subject: Re: [pbs-devel] [PATCH proxmox-backup 3/7] client: print key
fingerprint and master key
X-BeenThere: pbs-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox Backup Server development discussion
<pbs-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pbs-devel>,
<mailto:pbs-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pbs-devel/>
List-Post: <mailto:pbs-devel@lists.proxmox.com>
List-Help: <mailto:pbs-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel>,
<mailto:pbs-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 17 Nov 2020 18:38:06 -0000
On 17.11.20 18:57, Fabian Gr=C3=BCnbichler wrote:
> for operations where it makes sense.
>=20
> Signed-off-by: Fabian Gr=C3=BCnbichler <f.gruenbichler@proxmox.com>
> ---
> src/bin/proxmox-backup-client.rs | 11 +++++++++--
> src/bin/proxmox_backup_client/mount.rs | 6 +++++-
> 2 files changed, 14 insertions(+), 3 deletions(-)
>=20
> diff --git a/src/bin/proxmox-backup-client.rs b/src/bin/proxmox-backup-=
client.rs
> index c63c7eb6..54f7911d 100644
> --- a/src/bin/proxmox-backup-client.rs
> +++ b/src/bin/proxmox-backup-client.rs
> @@ -1069,7 +1069,9 @@ async fn create_backup(
> let (crypt_config, rsa_encrypted_key) =3D match keydata {
> None =3D> (None, None),
> Some(key) =3D> {
> - let (key, created, _fingerprint) =3D decrypt_key(&key, &ke=
y::get_encryption_key_password)?;
> + let (key, created, fingerprint) =3D decrypt_key(&key, &key=
::get_encryption_key_password)?;
> + println!("Encryption key fingerprint: {}",
> + crate::tools::format::as_fingerprint(&fingerprint=
));
> =20
> let crypt_config =3D CryptConfig::new(key)?;
> =20
> @@ -1078,6 +1080,9 @@ async fn create_backup(
> let pem_data =3D file_get_contents(path)?;
> let rsa =3D openssl::rsa::Rsa::public_key_from_pem=
(&pem_data)?;
> let enc_key =3D crypt_config.generate_rsa_encoded_=
key(rsa, created)?;
> + println!("Master key '{:?}'",
> + path);
nit, above would better fit in the same line as the println!
(just as reminder for whoever applies this series, or you if a v2 is warr=
anted
for other reasons)
> +
> (Some(Arc::new(crypt_config)), Some(enc_key))
> }
> _ =3D> (Some(Arc::new(crypt_config)), None),
> @@ -1380,7 +1385,9 @@ async fn restore(param: Value) -> Result<Value, E=
rror> {
> let crypt_config =3D match keydata {
> None =3D> None,
> Some(key) =3D> {
> - let (key, _, _) =3D decrypt_key(&key, &key::get_encryption=
_key_password)?;
> + let (key, _, fingerprint) =3D decrypt_key(&key, &key::get_=
encryption_key_password)?;
> + println!("Encryption key fingerprint: '{}'",
> + crate::tools::format::as_fingerprint(&fingerprint=
));
> Some(Arc::new(CryptConfig::new(key)?))
> }
> };
> diff --git a/src/bin/proxmox_backup_client/mount.rs b/src/bin/proxmox_b=
ackup_client/mount.rs
> index 6283961e..a1c2ed86 100644
> --- a/src/bin/proxmox_backup_client/mount.rs
> +++ b/src/bin/proxmox_backup_client/mount.rs
> @@ -182,7 +182,11 @@ async fn mount_do(param: Value, pipe: Option<RawFd=
>) -> Result<Value, Error> {
> let crypt_config =3D match keyfile {
> None =3D> None,
> Some(path) =3D> {
> - let (key, _, _) =3D load_and_decrypt_key(&path, &crate::ke=
y::get_encryption_key_password)?;
> + println!("Encryption key file: '{:?}'",
> + path);
> + let (key, _, fingerprint) =3D load_and_decrypt_key(&path, =
&crate::key::get_encryption_key_password)?;
> + println!("Encryption key fingerprint: '{}'",
> + crate::tools::format::as_fingerprint(&fingerprint=
));
> Some(Arc::new(CryptConfig::new(key)?))
> }
> };
>=20