tyler
/
proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
proxmox-backup/src/tools/paperkey.rs

239 lines
7.2 KiB
Rust
Raw Normal View History

paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
use std::io::Write;
use std::process::{Stdio, Command};
use anyhow::{bail, format_err, Error};
use serde::{Deserialize, Serialize};
use proxmox::api::api;
use crate::backup::KeyConfig;
#[api()]
#[derive(Debug, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
/// Paperkey output format
pub enum PaperkeyFormat {
/// Format as Utf8 text. Includes QR codes as ascii-art.
Text,
/// Format as Html. Includes QR codes as SVG images.
Html,
}
/// Generate a paper key (html or utf8 text)
///
/// This function takes an encryption key (either RSA private key
/// text, or `KeyConfig` json), and generates a printable text or html
/// page, including a scanable QR code to recover the key.
pub fn generate_paper_key<W: Write>(
output: W,
data: &str,
subject: Option<String>,
output_format: Option<PaperkeyFormat>,
) -> Result<(), Error> {
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
let (data, is_master_key) = if data.starts_with("-----BEGIN ENCRYPTED PRIVATE KEY-----\n")
|| data.starts_with("-----BEGIN RSA PRIVATE KEY-----\n")
{
let data = data.trim_end();
if !(data.ends_with("\n-----END ENCRYPTED PRIVATE KEY-----")
|| data.ends_with("\n-----END RSA PRIVATE KEY-----"))
{
bail!("unexpected key format");
}
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
let lines: Vec<String> = data
.lines()
.map(|s| s.trim_end())
.filter(|s| !s.is_empty())
.map(String::from)
.collect();
if lines.len() < 20 {
bail!("unexpected key format");
}
(lines, true)
} else {
match serde_json::from_str::<KeyConfig>(&data) {
Ok(key_config) => {
let lines = serde_json::to_string_pretty(&key_config)?
.lines()
.map(String::from)
.collect();
(lines, false)
},
Err(err) => {
eprintln!("Couldn't parse data as KeyConfig - {}", err);
bail!("Neither a PEM-formatted private key, nor a PBS key file.");
},
}
};
let format = output_format.unwrap_or(PaperkeyFormat::Html);
match format {
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
PaperkeyFormat::Html => paperkey_html(output, &data, subject, is_master_key),
PaperkeyFormat::Text => paperkey_text(output, &data, subject, is_master_key),
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
}
fn paperkey_html<W: Write>(
mut output: W,
lines: &[String],
subject: Option<String>,
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
is_master: bool,
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
) -> Result<(), Error> {
let img_size_pt = 500;
writeln!(output, "<!DOCTYPE html>")?;
writeln!(output, "<html lang=\"en\">")?;
writeln!(output, "<head>")?;
writeln!(output, "<meta charset=\"utf-8\">")?;
writeln!(output, "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">")?;
writeln!(output, "<title>Proxmox Backup Paperkey</title>")?;
writeln!(output, "<style type=\"text/css\">")?;
writeln!(output, " p {{")?;
writeln!(output, " font-size: 12pt;")?;
writeln!(output, " font-family: monospace;")?;
writeln!(output, " white-space: pre-wrap;")?;
writeln!(output, " line-break: anywhere;")?;
writeln!(output, " }}")?;
writeln!(output, "</style>")?;
writeln!(output, "</head>")?;
writeln!(output, "<body>")?;
if let Some(subject) = subject {
writeln!(output, "<p>Subject: {}</p>", subject)?;
}
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
if is_master {
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
const BLOCK_SIZE: usize = 20;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
for (block_nr, block) in lines.chunks(BLOCK_SIZE).enumerate() {
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
writeln!(output, "<div style=\"page-break-inside: avoid;page-break-after: always\">")?;
writeln!(output, "<p>")?;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
for (i, line) in block.iter().enumerate() {
writeln!(output, "{:02}: {}", i + block_nr * BLOCK_SIZE, line)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
writeln!(output, "</p>")?;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
let qr_code = generate_qr_code("svg", block)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
let qr_code = base64::encode_config(&qr_code, base64::STANDARD_NO_PAD);
writeln!(output, "<center>")?;
writeln!(output, "<img")?;
writeln!(output, "width=\"{}pt\" height=\"{}pt\"", img_size_pt, img_size_pt)?;
writeln!(output, "src=\"data:image/svg+xml;base64,{}\"/>", qr_code)?;
writeln!(output, "</center>")?;
writeln!(output, "</div>")?;
}
writeln!(output, "</body>")?;
writeln!(output, "</html>")?;
return Ok(());
}
writeln!(output, "<div style=\"page-break-inside: avoid\">")?;
writeln!(output, "<p>")?;
writeln!(output, "-----BEGIN PROXMOX BACKUP KEY-----")?;
for line in lines {
writeln!(output, "{}", line)?;
}
writeln!(output, "-----END PROXMOX BACKUP KEY-----")?;
writeln!(output, "</p>")?;
let qr_code = generate_qr_code("svg", lines)?;
let qr_code = base64::encode_config(&qr_code, base64::STANDARD_NO_PAD);
writeln!(output, "<center>")?;
writeln!(output, "<img")?;
writeln!(output, "width=\"{}pt\" height=\"{}pt\"", img_size_pt, img_size_pt)?;
writeln!(output, "src=\"data:image/svg+xml;base64,{}\"/>", qr_code)?;
writeln!(output, "</center>")?;
writeln!(output, "</div>")?;
writeln!(output, "</body>")?;
writeln!(output, "</html>")?;
Ok(())
}
fn paperkey_text<W: Write>(
mut output: W,
lines: &[String],
subject: Option<String>,
is_private: bool,
) -> Result<(), Error> {
if let Some(subject) = subject {
writeln!(output, "Subject: {}\n", subject)?;
}
if is_private {
const BLOCK_SIZE: usize = 5;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
for (block_nr, block) in lines.chunks(BLOCK_SIZE).enumerate() {
for (i, line) in block.iter().enumerate() {
writeln!(output, "{:-2}: {}", i + block_nr * BLOCK_SIZE, line)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
let qr_code = generate_qr_code("utf8i", block)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
let qr_code = String::from_utf8(qr_code)
.map_err(|_| format_err!("Failed to read qr code (got non-utf8 data)"))?;
writeln!(output, "{}", qr_code)?;
writeln!(output, "{}", char::from(12u8))?; // page break
}
return Ok(());
}
writeln!(output, "-----BEGIN PROXMOX BACKUP KEY-----")?;
for line in lines {
writeln!(output, "{}", line)?;
}
writeln!(output, "-----END PROXMOX BACKUP KEY-----")?;
let qr_code = generate_qr_code("utf8i", &lines)?;
let qr_code = String::from_utf8(qr_code)
.map_err(|_| format_err!("Failed to read qr code (got non-utf8 data)"))?;
writeln!(output, "{}", qr_code)?;
Ok(())
}
fn generate_qr_code(output_type: &str, lines: &[String]) -> Result<Vec<u8>, Error> {
let mut child = Command::new("qrencode")
.args(&["-t", output_type, "-m0", "-s1", "-lm", "--output", "-"])
.stdin(Stdio::piped())
.stdout(Stdio::piped())
.spawn()?;
{
let stdin = child.stdin.as_mut()
.ok_or_else(|| format_err!("Failed to open stdin"))?;
let data = lines.join("\n");
stdin.write_all(data.as_bytes())
.map_err(|_| format_err!("Failed to write to stdin"))?;
}
let output = child.wait_with_output()
.map_err(|_| format_err!("Failed to read stdout"))?;
let output = crate::tools::command_output(output, None)?;
Ok(output)
}