From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id E57911FF140 for ; Fri, 10 Apr 2026 19:03:44 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id D55B724A3C; Fri, 10 Apr 2026 19:04:29 +0200 (CEST) From: Christian Ebner To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup v2 16/27] sync: push: optionally encrypt client log on upload if key is given Date: Fri, 10 Apr 2026 18:54:43 +0200 Message-ID: <20260410165454.1578501-17-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260410165454.1578501-1-c.ebner@proxmox.com> References: <20260410165454.1578501-1-c.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1775840039097 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.069 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: BJHAXXRXCPIH7RFV63YAAGVIMWMOUD2T X-Message-ID-Hash: BJHAXXRXCPIH7RFV63YAAGVIMWMOUD2T X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Encrypt the client log blob with given encryption key during syncs in push direction, if given. The client log is not part of the manifest and therefore needs to be handled separately. Signed-off-by: Christian Ebner --- src/server/push.rs | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/src/server/push.rs b/src/server/push.rs index 7ce47e32e..02718b7b6 100644 --- a/src/server/push.rs +++ b/src/server/push.rs @@ -1018,13 +1018,23 @@ pub(crate) async fn push_snapshot( let client_log_name = &CLIENT_LOG_BLOB_NAME; client_log_path.push(client_log_name.as_ref()); if client_log_path.is_file() { - backup_writer - .upload_blob_from_file( - &client_log_path, - client_log_name.as_ref(), - upload_options.clone(), + if encrypt_using_key.is_some() { + reencode_encrypted_and_upload_blob( + client_log_path, + client_log_name, + &backup_writer, + &upload_options, ) .await?; + } else { + backup_writer + .upload_blob_from_file( + &client_log_path, + client_log_name.as_ref(), + upload_options.clone(), + ) + .await?; + } } // Rewrite manifest for pushed snapshot, recreating manifest from source on target, -- 2.47.3