[PATCH proxmox-backup v2 29/43] datastore/config: parse and enforce maximum retention timespan

[Christian Ebner <c.ebner@proxmox.com>]

Allows to limit the maximum retention timespan which can be set on
snapshots, so users cannot block contents for unintended extended
periods of time.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-datastore/src/datastore.rs | 34 +++++++++++++++++++++++++++++++++-
 src/api2/backup/mod.rs         |  4 ++++
 src/api2/config/datastore.rs   |  9 +++++++++
 src/server/pull.rs             | 13 +++++++++----
 4 files changed, 55 insertions(+), 5 deletions(-)

diff --git a/pbs-datastore/src/datastore.rs b/pbs-datastore/src/datastore.rs
index d5608d4da..c8f14c5d0 100644
--- a/pbs-datastore/src/datastore.rs
+++ b/pbs-datastore/src/datastore.rs
@@ -34,7 +34,7 @@ use pbs_api_types::{
     ArchiveType, Authid, BackupGroupDeleteStats, BackupNamespace, BackupType, ChunkOrder,
     DEFAULT_SNAPSHOT_TIME_SKEW_SECS, DataStoreConfig, DatastoreBackendConfig, DatastoreBackendType,
     GarbageCollectionCacheStats, GarbageCollectionStatus, MAX_NAMESPACE_DEPTH, MaintenanceMode,
-    MaintenanceType, Operation, S3Statistics, UPID,
+    MaintenanceType, Operation, RetentionTimespan, S3Statistics, UPID,
 };
 use pbs_config::s3::S3_CFG_TYPE_ID;
 use pbs_config::{BackupLockGuard, ConfigVersionCache};
@@ -213,6 +213,7 @@ pub struct DataStoreImpl {
     request_counters: Option<Arc<SharedRequestCounters>>,
     thresholds_exceeded_callback: Option<ThresholdsExceededCallback>,
     max_snapshot_time_skew: i64,
+    max_retention_timespan: Option<RetentionTimespan>,
 }
 
 impl DataStoreImpl {
@@ -232,6 +233,7 @@ impl DataStoreImpl {
             request_counters: None,
             thresholds_exceeded_callback: None,
             max_snapshot_time_skew: i64::try_from(DEFAULT_SNAPSHOT_TIME_SKEW_SECS).unwrap(),
+            max_retention_timespan: None,
         })
     }
 }
@@ -814,6 +816,7 @@ impl DataStore {
             request_counters,
             thresholds_exceeded_callback,
             max_snapshot_time_skew,
+            max_retention_timespan: config.max_retention_timespan,
         })
     }
 
@@ -859,6 +862,35 @@ impl DataStore {
         Ok(())
     }
 
+    /// Return the configured maximum retention timespan
+    pub fn max_retention_timespan(&self) -> Option<&RetentionTimespan> {
+        self.inner.max_retention_timespan.as_ref()
+    }
+
+    /// Check if the given retention timestamp is contained within the maximum
+    /// retention timespan relative to current system allowed by the datastore.
+    ///
+    /// Fails if there is no maximum retention configured for this datastore.
+    pub fn check_max_retention(&self, retain_until: i64) -> Result<(), Error> {
+        if retain_until <= proxmox_time::epoch_i64() {
+            bail!("retention timestamp must be in the future");
+        }
+        if let Some(max_retention) = self.max_retention_timespan() {
+            let max_timestamp = max_retention
+                .to_timestamp_from_systemtime()?
+                .saturating_add(self.inner.max_snapshot_time_skew);
+            if retain_until > max_timestamp {
+                bail!(
+                    "retention timestamp '{}' exceeds datastore limit of '{}'",
+                    proxmox_time::epoch_to_rfc3339_utc(retain_until)?,
+                    proxmox_time::epoch_to_rfc3339_utc(max_timestamp)?,
+                );
+            }
+            return Ok(());
+        }
+        bail!("no maximum retention timespan configured for datastore");
+    }
+
     // Requires obtaining a shared chunk store lock beforehand
     pub fn create_fixed_writer<P: AsRef<Path>>(
         &self,
diff --git a/src/api2/backup/mod.rs b/src/api2/backup/mod.rs
index 7d2236c9e..a057340ca 100644
--- a/src/api2/backup/mod.rs
+++ b/src/api2/backup/mod.rs
@@ -157,6 +157,10 @@ fn upgrade_to_backup_protocol(
             "backup"
         };
 
+        if let Some(retain_until) = retain_until {
+            datastore.check_max_retention(retain_until)?;
+        }
+
         // lock backup group to only allow one backup per group at a time
         let (owner, group_guard) = datastore.create_locked_backup_group(
             backup_group.backup_ns(),
diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs
index 350e48acc..03ff19fc3 100644
--- a/src/api2/config/datastore.rs
+++ b/src/api2/config/datastore.rs
@@ -442,6 +442,8 @@ pub enum DeletableProperty {
     CounterResetSchedule,
     /// Delete the maximum snapshot time skew property.
     MaxSnapshotTimeSkew,
+    /// Delete the max-retention-timespan
+    MaxRetentionTimespan,
 }
 
 #[api(
@@ -550,6 +552,9 @@ pub fn update_datastore(
                 DeletableProperty::MaxSnapshotTimeSkew => {
                     data.max_snapshot_time_skew = None;
                 }
+                DeletableProperty::MaxRetentionTimespan => {
+                    data.max_retention_timespan = None;
+                }
             }
         }
     }
@@ -655,6 +660,10 @@ pub fn update_datastore(
         data.max_snapshot_time_skew = update.max_snapshot_time_skew;
     }
 
+    if update.max_retention_timespan.is_some() {
+        data.max_retention_timespan = update.max_retention_timespan;
+    }
+
     config.set_data(&name, "datastore", &data)?;
 
     pbs_config::datastore::save_config(&config)?;
diff --git a/src/server/pull.rs b/src/server/pull.rs
index c1531ebda..44347c3ad 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -139,13 +139,18 @@ impl PullParameters {
         let lookup = crate::tools::lookup_with(store, Operation::Write);
         let store = DataStore::lookup_datastore(lookup)?;
         let backend = store.backend()?;
-        let target = PullTarget { store, ns, backend };
 
         let group_filter = group_filter.unwrap_or_default();
 
-        let retain_until = retention_timespan
-            .map(|timespan| timespan.to_timestamp_from_systemtime())
-            .transpose()?;
+        let retain_until = if let Some(retention) = retention_timespan {
+            let retain_until = retention.to_timestamp_from_systemtime()?;
+            (*store).check_max_retention(retain_until)?;
+            Some(retain_until)
+        } else {
+            None
+        };
+
+        let target = PullTarget { store, ns, backend };
 
         let crypt_configs = if let Some(key_ids) = &decryption_keys {
             let mut crypt_configs = Vec::with_capacity(key_ids.len());
-- 
2.47.3