7124 Commits

Author SHA1 Message Date
Max Carrara
68478bb122 pbs-client: pxar: add PxarExtractContext
This enum's purpose is to provide context to errors that occur during
the extraction of a pxar archive, making it possible to handle
extraction errors in a more granular manner.

For now, it's only implemented in `ExtractorIter::next()`, but may be
used in other places if necessary or desired.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:47 +02:00
Max Carrara
c66f2579d5 pbs-client: pxar: refactor body of extract_archive to ExtractorIter
This change factors the body of `extract_archive()` into a separate
struct named `ExtractorIter` which implements the `Iterator` trait.

This refactor has two goals:
  * Make it easier to provide and propagate errors and additional
    information via `anyhow::Context`
  * Introduce a means to handle errors that occur during extraction,
    with the possibility to continue extraction if the handler decides
    that the error is not fatal

The latter point benefits from the information provided by the former;
previously, errors could only be handled in certain locations
(e.g. application of metadata), but not on a "per-entry" basis.

Since `extract_archive()` was already using a "desugared" version of
the iterator pattern to begin with, wrapping its body up in an actual
`Iterator` made the most sense, as it didn't require changing the already
existing control flow that much.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:46 +02:00
Max Carrara
54ef4f157a pbs-client: pxar: preserve error context
In order to preserve the source(s) of errors, `anyhow::Context` is
used instead of propagating errors via `Result::map_err()` and / or
`anyhow::format_err!()`.

This makes it possible to access e.g. an underlying `io::Error` or
`nix::Errno` etc. that caused an execution path to fail.

Certain usages of `anyhow::bail!()` are also changed / replaced
in order to preserve context.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:44 +02:00
Fabian Grünbichler
6afda74c33 fix pbs2to3 install
was incomplete when forward porting from stable-2.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-07-14 12:10:24 +02:00
Thomas Lamprecht
7f64a6203a sync over pbs2to3 upgrade check-list script to master
so that it's available after for post-upgrade checks

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-07-08 15:06:40 +02:00
Wolfgang Bumiller
4d351d2577 d/control fixup and zstd simplify zstd version
we transitively depend on a specific version anyway

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 15:24:23 +02:00
Wolfgang Bumiller
c4fcafbe09 bump d/control
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 15:00:14 +02:00
Wolfgang Bumiller
3e35b972cb reset tfa failure count when unlocking
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 14:58:54 +02:00
Wolfgang Bumiller
cc5f712d08 bump proxmox-tfa dep to 4.0.4
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 14:58:39 +02:00
Fabian Grünbichler
cbaabb4855 encrypted backup: fix log message
the debug representation of a repository

 'BackupRepository { auth_id: Some(Authid { user: Userid { data: "test@pbs", name_len: 4 }, tokenname: None }), host: Some("127.0.0.1"), port: None, store: "tank" }'

is rather verbose and unreadable, use the plain one

 'test@pbs@127.0.0.1:8007:tank'

intead.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-07-03 08:55:30 +02:00
Thomas Lamprecht
c2fa67b417 docs: update FAQ release support table, add PBS 2.x EOL date
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-28 18:57:46 +02:00
Thomas Lamprecht
f3c47efb39 bump version to 3.0.1-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 16:06:34 +02:00
Noel Ullreich
8c83b75a7c fix spelling of command line/command-line
"Commandline", "command line" & "command-line" were being used
interchangeably, which is not correct use command-line when it is an
adjective (e.g. "command-line interface") and use command line when
it is a noun (e.g. "change the setting from the command line")

Signed-off-by: Noel Ullreich <n.ullreich@proxmox.com>
 [T: fix typos in commit message and reflow ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 15:43:43 +02:00
Noel Ullreich
6aa3eeb59e consistenct of USB flash drive spelling
To be consistent, replaced all synonyms of USB flash drive (e.g. thumb
drive, drive, stick)

Signed-off-by: Noel Ullreich <n.ullreich@proxmox.com>
2023-06-27 15:32:34 +02:00
Fiona Ebner
935b69a5d7 docs: user management: use pbs realm instead of pve realm in example
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
2023-06-27 15:29:05 +02:00
Thomas Lamprecht
dd1b684447 api: node services: switch to journald and chrony instead of syslog and timesyncd
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 13:35:55 +02:00
Dominik Csapak
9bf4ff8409 ui: user view: fix refresh for totp locked column
by adding the 'totp-locked' column to the model

a diff store can only know if a column has changed if the column is
defined in the model, otherwise it'll only load it the first time
(when the 'load' called on the diff store)

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
2023-06-27 13:30:45 +02:00
Wolfgang Bumiller
e01b9c45c5 ui: add missing unlockTfa handler
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Dominik Csapak <d.csapak@proxmox.com>
Tested-by: Dominik Csapak <d.csapak@proxmox.com>
2023-06-27 13:30:32 +02:00
Thomas Lamprecht
5414850a66 cargo: bump dependency for proxmox-rest-server and proxmox-apt
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 13:30:21 +02:00
Thomas Lamprecht
6a47788228 bump version to 3.0.0-2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 22:13:50 +02:00
Thomas Lamprecht
94e686d650 etc/pbs-enterprise.list: change to bookworm
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 22:12:53 +02:00
Thomas Lamprecht
1300994a17 readme: update package repos for bookworm
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 22:12:26 +02:00
Thomas Lamprecht
44f9f8dec6 bump version to 3.0.0-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:19:25 +02:00
Thomas Lamprecht
2a0fc7f32f docs: update package repos and APT release key for Bookworm
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:18:54 +02:00
Thomas Lamprecht
988a177da8 ui: user view: fix eslint error
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:09:06 +02:00
Thomas Lamprecht
c724c00667 docs: user-management: add section for TFA lockouts
adapted from pve-docs' commit 96a0d13 ("user management: document TFA
lockout")

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:07:41 +02:00
Wolfgang Bumiller
f905e05cff ui: add TFA lock status and unlock button
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
9b85fdc71d api: include tfa lock status in user list
Like in PVE.
This means that /access/users is now a 'protected' call to
get access to 'tfa.cfg'.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
c74aa900ce enable tfa lockout
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
cfc3b0ff7d manager: add 'user tfa unlock' command
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
8c7b80e44f api: add /access/users/<userid>/unlock-tfa api call
Same as in PVE: unlocks a user's 2nd factors.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Stefan Sterz
5210f3b532 access: ldap check connection on creation and change
this commit makes the ldap realm endpoints check whether a new or
updated configuration works correctly. it uses the new
`check_connection` function to make sure that a configuration can be
successfully used to connect to and query an ldap directory.

doing so allows us to remove the ldap domain regex. instead of relying
on a regex to make sure that a given distinguished name (dn) could be
correct, we simply let the ldap directory tell us whether it accepts
it. this should also aid with usability as a dn that looks correct
could still be invalid.

this also implicitly removes unauthenticated binds, since the new
`check_connection` function does not support those. it will simply
bail out of the check if a `bind_dn` but no password is configured.
therefore, this is a breaking change.

Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
2023-06-26 16:08:24 +02:00
Wolfgang Bumiller
ebe2442d90 bump d/control
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 16:08:22 +02:00
Wolfgang Bumiller
309202b9fa bump proxmox-ldap to 0.2
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 14:52:33 +02:00
Lukas Wagner
08f8a3e5aa api-types: client: datastore: tools: use proxmox-human-bytes crate
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
2023-06-26 13:56:45 +02:00
Dominik Csapak
5e082e4fb6 try using 'pve-eslint' if it exists
but fallback to 'eslint' otherwise

Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
 [T: move into www/manager Makefile directly]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-24 17:49:44 +02:00
Maximiliano Sandoval
12c841b4d9 clippy fixes: deref which would be done by auto-deref
This unnecessarily complicates the code.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:45 +02:00
Maximiliano Sandoval
0d4b7f0271 clippy fixes: Box::new(_) of default value
From rust-lang:

> Why is this bad?
>
> First, it’s more complex, involving two calls instead of one. Second,
> Box::default() can be faster in certain cases.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:36 +02:00
Maximiliano Sandoval
f7c8903e22 clippy fixes: casting to the same type is unnecessary
Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:33 +02:00
Maximiliano Sandoval
c78df869e1 clippy fixes: use of ok_or followed by a function call
The function will always be called. This is only bad if it allocates or does some non-trivial amount of work.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:31 +02:00
Maximiliano Sandoval
cd0daa8b33 clippy fixes: the borrowed expression implements the required traits
Suggests that the receiver of the expression borrows the expression.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:29 +02:00
Fabian Grünbichler
f3b89f3a70 d/rules: fix dh_installsystemd invocation
the services should definitely not be stopped in preinst!

relevant debdiff with this change:

 Preinst files: lines which differ (wdiff format)
 ------------------------------------------------
 [-# Automatically added by dh_installsystemd/13.11.4-]
 [-if [ -z "${DPKG_ROOT:-}" ] && [ "$1" = upgrade ] && [ -d /run/systemd/system ] ; then-]
 [-      deb-systemd-invoke stop 'proxmox-backup-banner.service' 'proxmox-backup-daily-update.service' 'proxmox-backup-daily-update.timer' 'proxmox-backup-proxy.service' 'proxmox-backup.service' >/dev/null || true-]
 [-fi-]
 [-# End automatically added section-]

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-06-23 11:53:51 +02:00
Maximiliano Sandoval
9c85840fe2 fix : manager: add user tfa {list, delete} commands
Adds the commands

    proxmox-backup-manager user tfa list <userid>
    proxmox-backup-manager user tfa delete <userid> <id>

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 11:06:06 +02:00
Maximiliano Sandoval
223842887f api: Fix schema return annotation of tfa_update_auth
In the next commit we expose a command to list the tfa methods of a
user. Without this annotation one would get the following error

    unable to format result: got unexpected data (expected null).

when running the proposed cli command.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 07:52:56 +02:00
Maximiliano Sandoval
b4b230fdff file restore: qemu helper: run rustfmt
Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
 [T: fix commit subject ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-16 10:00:26 +02:00
Thomas Lamprecht
950fba5a47 file-restore: factor out detecting debug mode
to avoid that the detection logic gets out of sync

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-15 18:08:41 +02:00
Stoiko Ivanov
39531dfc80 file-restore: set loglevel considering PBS_QEMU_DEBUG
during some tests recently I wondered why a debug log-message was not
printed, despite running with PBS_QEMU_DEBUG.

This patch sets the loglevel for the cli logger to debug if the
variable is present and not-empty (see qemu_helper.rs for the other
usage).

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
2023-06-15 13:03:36 +02:00
Stoiko Ivanov
ce3f15aeac file-restore: set zfs_arc_min to current minimum of 32M
zfs_arc_min was raised to 32M (for linux) in zfs-commit
121b3cae742a0670d902a51bc61d49dc4a3e4445

while the current logic would still set the min_size to 32M (it's
max(32M, allmem/32), which results to 32M for memory sizes up to
1024M), setting it explicitly to the minimum makes it clear, and will
still be kept should the restore vm have more than 1G of memory at
some point.

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
2023-06-15 13:03:36 +02:00
Stoiko Ivanov
18844d6e3c file-restore: add zfs. prefix to arc_min/max settings
Currently the values set for zfs_arc_min and zfs_arc_max are ignored
by the kernel:
```
Unknown kernel command line parameters... will be passed to user space
```
module parameters provided on the commandline usually need to be
prefixed with the modulename (e.g. zfs.zfs_arc_min, see [0] for a bit
on related information (the issue itself is not related)).

Paradoxically currently ZFS will print spurious warnings about
settings being ignored when they are actually set - see [1].

Booting the debug image and connecting the shell on the serial console
confirmed that the values did not seem to be set:
`grep '^c_' /proc/spl/kstat/zfs/arcstats` showed half of the memory
for c_max.

[0] https://github.com/openzfs/zfs/issues/698
[1] https://github.com/openzfs/zfs/issues/12504

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
2023-06-15 13:03:36 +02:00
Wolfgang Bumiller
038b0c48b4 drop pam and pam-sys dependencies
we don't directly use them anymore

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-14 09:58:57 +02:00