7136 Commits

Author SHA1 Message Date
Gabriel Goller
9294ed6457 docs: updated README.rst build guide
- we use the debian 12 bookworm mirror
 - `make deb-all` doesn't exist anymore, `make deb` builds everything

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
2023-08-08 11:48:50 +02:00
Fabian Grünbichler
7d8d4061c5 Revert "fix #4380: stat() is run when file is executed"
this actually affected the matcher's ability to differentiate between directory
and file patterns, and the alternative would require matching patterns twice
for full coverage, so let's try a different approach altogether.

This reverts commit c8ed10095d4cdc01705e5f01f849f8850a0b7395.
2023-08-04 10:33:15 +02:00
Gabriel Goller
c8ed10095d fix #4380: stat() is run when file is executed
When executing `proxmox-backup-client backup ...
--exclude "test/test.txt"` it still executed stat() on "test.txt",
which won't work when the current user doesn't have access to the
file or the parent folder. Now we check if the file is excluded,
and if it is not, then we execute stat().

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
2023-08-04 09:30:55 +02:00
Fabian Grünbichler
a13b3d7e1c bump version to 3.0.2-1
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-08-01 12:01:43 +02:00
Fabian Grünbichler
1f4ae5c777 handle pve-kernel -> proxmox-kernel rename
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-08-01 11:48:26 +02:00
Wolfgang Bumiller
7b449954bb api-types: set serde defaults for UserWithTokens
since `totp_locked` is not wrapped in an `Option` we need to
explicitly tell serde about its default

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-08-01 09:12:43 +02:00
Wolfgang Bumiller
e95065f68d bump dependencies to bookworm updates
These should all be api compatible but still needed a bookworm bump.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-24 11:13:50 +02:00
Fabian Grünbichler
e61aa41076 backup: improve skipped download error message
context always helps when parsing output..

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-07-19 11:06:31 +02:00
Maximiliano Sandoval
03e71cc8be fix #4591: pbs-client: backup_writer: improve error reporting
We check if the manifest contains an index for the requested archive, if
it does not we avoid downloading it and report a more helpful error
message.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-07-19 10:49:28 +02:00
Maximiliano Sandoval
288893a6a9 pbs-client: backup-writer: use log::warn instead of eprintln!
The errors are not fatal so we only throw a warning.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-07-19 10:49:09 +02:00
Philipp Hufnagl
7804e36b2e docs: replace concrete device paths with pseudo paths
Having commonly used device paths (like /dev/sdb) in an example
command may cause damage if the user simply copies them without
checking. With a pseudo device path (like /dev/sdX), they would simply
get an error

Signed-off-by: Philipp Hufnagl <p.hufnagl@proxmox.com>
Reviewed-by: Lukas Wagner <l.wagner@proxmox.com>
2023-07-17 15:56:37 +02:00
Max Carrara
ad630fb470 proxmox-backup-client: restore: add 'ignore-extract-device-errors' flag
If this flag is provided, any errors that occur during the extraction
of a device node are silently ignored.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:49 +02:00
Max Carrara
68478bb122 pbs-client: pxar: add PxarExtractContext
This enum's purpose is to provide context to errors that occur during
the extraction of a pxar archive, making it possible to handle
extraction errors in a more granular manner.

For now, it's only implemented in `ExtractorIter::next()`, but may be
used in other places if necessary or desired.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:47 +02:00
Max Carrara
c66f2579d5 pbs-client: pxar: refactor body of extract_archive to ExtractorIter
This change factors the body of `extract_archive()` into a separate
struct named `ExtractorIter` which implements the `Iterator` trait.

This refactor has two goals:
  * Make it easier to provide and propagate errors and additional
    information via `anyhow::Context`
  * Introduce a means to handle errors that occur during extraction,
    with the possibility to continue extraction if the handler decides
    that the error is not fatal

The latter point benefits from the information provided by the former;
previously, errors could only be handled in certain locations
(e.g. application of metadata), but not on a "per-entry" basis.

Since `extract_archive()` was already using a "desugared" version of
the iterator pattern to begin with, wrapping its body up in an actual
`Iterator` made the most sense, as it didn't require changing the already
existing control flow that much.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:46 +02:00
Max Carrara
54ef4f157a pbs-client: pxar: preserve error context
In order to preserve the source(s) of errors, `anyhow::Context` is
used instead of propagating errors via `Result::map_err()` and / or
`anyhow::format_err!()`.

This makes it possible to access e.g. an underlying `io::Error` or
`nix::Errno` etc. that caused an execution path to fail.

Certain usages of `anyhow::bail!()` are also changed / replaced
in order to preserve context.

Signed-off-by: Max Carrara <m.carrara@proxmox.com>
2023-07-17 12:00:44 +02:00
Fabian Grünbichler
6afda74c33 fix pbs2to3 install
was incomplete when forward porting from stable-2.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-07-14 12:10:24 +02:00
Thomas Lamprecht
7f64a6203a sync over pbs2to3 upgrade check-list script to master
so that it's available after for post-upgrade checks

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-07-08 15:06:40 +02:00
Wolfgang Bumiller
4d351d2577 d/control fixup and zstd simplify zstd version
we transitively depend on a specific version anyway

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 15:24:23 +02:00
Wolfgang Bumiller
c4fcafbe09 bump d/control
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 15:00:14 +02:00
Wolfgang Bumiller
3e35b972cb reset tfa failure count when unlocking
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 14:58:54 +02:00
Wolfgang Bumiller
cc5f712d08 bump proxmox-tfa dep to 4.0.4
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-07-05 14:58:39 +02:00
Fabian Grünbichler
cbaabb4855 encrypted backup: fix log message
the debug representation of a repository

 'BackupRepository { auth_id: Some(Authid { user: Userid { data: "test@pbs", name_len: 4 }, tokenname: None }), host: Some("127.0.0.1"), port: None, store: "tank" }'

is rather verbose and unreadable, use the plain one

 'test@pbs@127.0.0.1:8007:tank'

intead.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2023-07-03 08:55:30 +02:00
Thomas Lamprecht
c2fa67b417 docs: update FAQ release support table, add PBS 2.x EOL date
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-28 18:57:46 +02:00
Thomas Lamprecht
f3c47efb39 bump version to 3.0.1-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 16:06:34 +02:00
Noel Ullreich
8c83b75a7c fix spelling of command line/command-line
"Commandline", "command line" & "command-line" were being used
interchangeably, which is not correct use command-line when it is an
adjective (e.g. "command-line interface") and use command line when
it is a noun (e.g. "change the setting from the command line")

Signed-off-by: Noel Ullreich <n.ullreich@proxmox.com>
 [T: fix typos in commit message and reflow ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 15:43:43 +02:00
Noel Ullreich
6aa3eeb59e consistenct of USB flash drive spelling
To be consistent, replaced all synonyms of USB flash drive (e.g. thumb
drive, drive, stick)

Signed-off-by: Noel Ullreich <n.ullreich@proxmox.com>
2023-06-27 15:32:34 +02:00
Fiona Ebner
935b69a5d7 docs: user management: use pbs realm instead of pve realm in example
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
2023-06-27 15:29:05 +02:00
Thomas Lamprecht
dd1b684447 api: node services: switch to journald and chrony instead of syslog and timesyncd
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 13:35:55 +02:00
Dominik Csapak
9bf4ff8409 ui: user view: fix refresh for totp locked column
by adding the 'totp-locked' column to the model

a diff store can only know if a column has changed if the column is
defined in the model, otherwise it'll only load it the first time
(when the 'load' called on the diff store)

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
2023-06-27 13:30:45 +02:00
Wolfgang Bumiller
e01b9c45c5 ui: add missing unlockTfa handler
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Dominik Csapak <d.csapak@proxmox.com>
Tested-by: Dominik Csapak <d.csapak@proxmox.com>
2023-06-27 13:30:32 +02:00
Thomas Lamprecht
5414850a66 cargo: bump dependency for proxmox-rest-server and proxmox-apt
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-27 13:30:21 +02:00
Thomas Lamprecht
6a47788228 bump version to 3.0.0-2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 22:13:50 +02:00
Thomas Lamprecht
94e686d650 etc/pbs-enterprise.list: change to bookworm
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 22:12:53 +02:00
Thomas Lamprecht
1300994a17 readme: update package repos for bookworm
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 22:12:26 +02:00
Thomas Lamprecht
44f9f8dec6 bump version to 3.0.0-1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:19:25 +02:00
Thomas Lamprecht
2a0fc7f32f docs: update package repos and APT release key for Bookworm
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:18:54 +02:00
Thomas Lamprecht
988a177da8 ui: user view: fix eslint error
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:09:06 +02:00
Thomas Lamprecht
c724c00667 docs: user-management: add section for TFA lockouts
adapted from pve-docs' commit 96a0d13 ("user management: document TFA
lockout")

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-26 20:07:41 +02:00
Wolfgang Bumiller
f905e05cff ui: add TFA lock status and unlock button
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
9b85fdc71d api: include tfa lock status in user list
Like in PVE.
This means that /access/users is now a 'protected' call to
get access to 'tfa.cfg'.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
c74aa900ce enable tfa lockout
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
cfc3b0ff7d manager: add 'user tfa unlock' command
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Wolfgang Bumiller
8c7b80e44f api: add /access/users/<userid>/unlock-tfa api call
Same as in PVE: unlocks a user's 2nd factors.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 19:47:16 +02:00
Stefan Sterz
5210f3b532 access: ldap check connection on creation and change
this commit makes the ldap realm endpoints check whether a new or
updated configuration works correctly. it uses the new
`check_connection` function to make sure that a configuration can be
successfully used to connect to and query an ldap directory.

doing so allows us to remove the ldap domain regex. instead of relying
on a regex to make sure that a given distinguished name (dn) could be
correct, we simply let the ldap directory tell us whether it accepts
it. this should also aid with usability as a dn that looks correct
could still be invalid.

this also implicitly removes unauthenticated binds, since the new
`check_connection` function does not support those. it will simply
bail out of the check if a `bind_dn` but no password is configured.
therefore, this is a breaking change.

Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
2023-06-26 16:08:24 +02:00
Wolfgang Bumiller
ebe2442d90 bump d/control
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 16:08:22 +02:00
Wolfgang Bumiller
309202b9fa bump proxmox-ldap to 0.2
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2023-06-26 14:52:33 +02:00
Lukas Wagner
08f8a3e5aa api-types: client: datastore: tools: use proxmox-human-bytes crate
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
2023-06-26 13:56:45 +02:00
Dominik Csapak
5e082e4fb6 try using 'pve-eslint' if it exists
but fallback to 'eslint' otherwise

Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
 [T: move into www/manager Makefile directly]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2023-06-24 17:49:44 +02:00
Maximiliano Sandoval
12c841b4d9 clippy fixes: deref which would be done by auto-deref
This unnecessarily complicates the code.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:45 +02:00
Maximiliano Sandoval
0d4b7f0271 clippy fixes: Box::new(_) of default value
From rust-lang:

> Why is this bad?
>
> First, it’s more complex, involving two calls instead of one. Second,
> Box::default() can be faster in certain cases.

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
2023-06-23 12:01:36 +02:00