[PATCH proxmox-backup v3 22/30] sync: pull: load encryption key if given in job config

Christian Ebner
2026-04-14T12:59:10Z

If configured and passed in on PullParams construction, check access
and load the encryption key. Any snapshots matching this key
fingerprint should be decrypted during pull sync.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
changes since version 2:
- also store key id together with key config when loading associated keys, so it can be logged later.

src/api2/pull.rs | 15 +++++++++++++--
src/server/pull.rs | 19 +++++++++++++++++++
2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/src/api2/pull.rs b/src/api2/pull.rs
index 4b1fd5e60..7ca12fe99 100644
--- a/src/api2/pull.rs
+++ b/src/api2/pull.rs
@@ -7,8 +7,8 @@ use proxmox_router::{Permission, Router, RpcEnvironment};
use proxmox_schema::api;

use pbs_api_types::{
- Authid, BackupNamespace, GroupFilter, RateLimitConfig, SyncJobConfig, DATASTORE_SCHEMA,
- GROUP_FILTER_LIST_SCHEMA, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP,
+ Authid, BackupNamespace, GroupFilter, RateLimitConfig, SyncJobConfig, CRYPT_KEY_ID_SCHEMA,
+ DATASTORE_SCHEMA, GROUP_FILTER_LIST_SCHEMA, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP,
PRIV_DATASTORE_PRUNE, PRIV_REMOTE_READ, REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA,
RESYNC_CORRUPT_SCHEMA, SYNC_ENCRYPTED_ONLY_SCHEMA, SYNC_VERIFIED_ONLY_SCHEMA,
TRANSFER_LAST_SCHEMA,
@@ -91,6 +91,7 @@ impl TryFrom<&SyncJobConfig> for PullParameters {
sync_job.encrypted_only,
sync_job.verified_only,
sync_job.resync_corrupt,
+ sync_job.associated_key.clone(),
)
}
}
@@ -148,6 +149,14 @@ impl TryFrom<&SyncJobConfig> for PullParameters {
schema: RESYNC_CORRUPT_SCHEMA,
optional: true,
},
+ "decryption-keys": {
+ type: Array,
+ description: "List of decryption keys.",
+ items: {
+ schema: CRYPT_KEY_ID_SCHEMA,
+ },
+ optional: true,
+ },
},
},
access: {
@@ -175,6 +184,7 @@ async fn pull(
encrypted_only: Option<bool>,
verified_only: Option<bool>,
resync_corrupt: Option<bool>,
+ decryption_keys: Option<Vec<String>>,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<String, Error> {
let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
@@ -215,6 +225,7 @@ async fn pull(
encrypted_only,
verified_only,
resync_corrupt,
+ decryption_keys,
)?;

// fixme: set to_stdout to false?
diff --git a/src/server/pull.rs b/src/server/pull.rs
index bd3e8bef4..cc18cd973 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -8,6 +8,7 @@ use std::sync::{Arc, Mutex};
use std::time::SystemTime;

use anyhow::{bail, format_err, Context, Error};
+use pbs_tools::crypt_config::CryptConfig;
use proxmox_human_byte::HumanByte;
use tracing::{info, warn};

@@ -65,6 +66,8 @@ pub(crate) struct PullParameters {
verified_only: bool,
/// Whether to re-sync corrupted snapshots
resync_corrupt: bool,
+ /// Decryption key ids and configs to decrypt snapshots with matching key fingerprint
+ crypt_configs: Vec<(String, Arc<CryptConfig>)>,
}

impl PullParameters {
@@ -85,6 +88,7 @@ impl PullParameters {
encrypted_only: Option<bool>,
verified_only: Option<bool>,
resync_corrupt: Option<bool>,
+ decryption_keys: Option<Vec<String>>,
) -> Result<Self, Error> {
if let Some(max_depth) = max_depth {
ns.check_max_depth(max_depth)?;
@@ -126,6 +130,20 @@ impl PullParameters {

let group_filter = group_filter.unwrap_or_default();

+ let crypt_configs = if let Some(key_ids) = &decryption_keys {
+ let mut crypt_configs = Vec::with_capacity(key_ids.len());
+ for key_id in key_ids {
+ if let Some(crypt_config) =
+ crate::server::sync::check_privs_and_load_key_config(key_id, &owner, false)?
+ {
+ crypt_configs.push((key_id.to_string(), crypt_config));
+ }
+ }
+ crypt_configs
+ } else {
+ Vec::new()
+ };
+
Ok(Self {
source,
target,
@@ -137,6 +155,7 @@ impl PullParameters {
encrypted_only,
verified_only,
resync_corrupt,
+ crypt_configs,
})
}
}
--
2.47.3