tyler
/
proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
proxmox-backup/pbs-datastore/src/paperkey.rs

254 lines
7.4 KiB
Rust
Raw Normal View History

paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
use std::io::Write;
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
use std::process::{Command, Stdio};
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
use anyhow::{bail, format_err, Error};
use serde::{Deserialize, Serialize};
use proxmox::api::api;
moved key_derivation.rs from pbs_datastore to pbs-config/src/key_config.rs Also moved pbs-datastore/src/crypt_config.rs to pbs-tools/src/crypt_config.rs. We do not want to depend on pbs-api-types there, so I use [u8;32] instead of Fingerprint.
2021-09-07 07:22:14 +00:00
use pbs_config::key_config::KeyConfig;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
#[api()]
#[derive(Debug, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
/// Paperkey output format
pub enum PaperkeyFormat {
/// Format as Utf8 text. Includes QR codes as ascii-art.
Text,
/// Format as Html. Includes QR codes as SVG images.
Html,
}
/// Generate a paper key (html or utf8 text)
///
/// This function takes an encryption key (either RSA private key
/// text, or `KeyConfig` json), and generates a printable text or html
/// page, including a scanable QR code to recover the key.
pub fn generate_paper_key<W: Write>(
output: W,
data: &str,
subject: Option<String>,
output_format: Option<PaperkeyFormat>,
) -> Result<(), Error> {
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
let (data, is_master_key) = if data.starts_with("-----BEGIN ENCRYPTED PRIVATE KEY-----\n")
|| data.starts_with("-----BEGIN RSA PRIVATE KEY-----\n")
{
let data = data.trim_end();
if !(data.ends_with("\n-----END ENCRYPTED PRIVATE KEY-----")
|| data.ends_with("\n-----END RSA PRIVATE KEY-----"))
{
bail!("unexpected key format");
}
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
let lines: Vec<String> = data
.lines()
.map(|s| s.trim_end())
.filter(|s| !s.is_empty())
.map(String::from)
.collect();
if lines.len() < 20 {
bail!("unexpected key format");
}
(lines, true)
} else {
match serde_json::from_str::<KeyConfig>(&data) {
Ok(key_config) => {
let lines = serde_json::to_string_pretty(&key_config)?
.lines()
.map(String::from)
.collect();
(lines, false)
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
}
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
Err(err) => {
eprintln!("Couldn't parse data as KeyConfig - {}", err);
bail!("Neither a PEM-formatted private key, nor a PBS key file.");
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
}
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
};
let format = output_format.unwrap_or(PaperkeyFormat::Html);
match format {
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
PaperkeyFormat::Html => paperkey_html(output, &data, subject, is_master_key),
PaperkeyFormat::Text => paperkey_text(output, &data, subject, is_master_key),
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
}
fn paperkey_html<W: Write>(
mut output: W,
lines: &[String],
subject: Option<String>,
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
is_master: bool,
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
) -> Result<(), Error> {
let img_size_pt = 500;
writeln!(output, "<!DOCTYPE html>")?;
writeln!(output, "<html lang=\"en\">")?;
writeln!(output, "<head>")?;
writeln!(output, "<meta charset=\"utf-8\">")?;
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
writeln!(
output,
"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">"
)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
writeln!(output, "<title>Proxmox Backup Paperkey</title>")?;
writeln!(output, "<style type=\"text/css\">")?;
writeln!(output, " p {{")?;
writeln!(output, " font-size: 12pt;")?;
writeln!(output, " font-family: monospace;")?;
writeln!(output, " white-space: pre-wrap;")?;
writeln!(output, " line-break: anywhere;")?;
writeln!(output, " }}")?;
writeln!(output, "</style>")?;
writeln!(output, "</head>")?;
writeln!(output, "<body>")?;
if let Some(subject) = subject {
writeln!(output, "<p>Subject: {}</p>", subject)?;
}
paperkey: allow RSA keys without passphrase some users might want to store the plain version of their master key for long-term storage and rely on physical security instead of a passphrase to protect the paper key. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:16 +00:00
if is_master {
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
const BLOCK_SIZE: usize = 20;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
for (block_nr, block) in lines.chunks(BLOCK_SIZE).enumerate() {
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
writeln!(
output,
"<div style=\"page-break-inside: avoid;page-break-after: always\">"
)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
writeln!(output, "<p>")?;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
for (i, line) in block.iter().enumerate() {
writeln!(output, "{:02}: {}", i + block_nr * BLOCK_SIZE, line)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
writeln!(output, "</p>")?;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
let qr_code = generate_qr_code("svg", block)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
let qr_code = base64::encode_config(&qr_code, base64::STANDARD_NO_PAD);
writeln!(output, "<center>")?;
writeln!(output, "<img")?;
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
writeln!(
output,
"width=\"{}pt\" height=\"{}pt\"",
img_size_pt, img_size_pt
)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
writeln!(output, "src=\"data:image/svg+xml;base64,{}\"/>", qr_code)?;
writeln!(output, "</center>")?;
writeln!(output, "</div>")?;
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
}
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
writeln!(output, "</body>")?;
writeln!(output, "</html>")?;
return Ok(());
}
writeln!(output, "<div style=\"page-break-inside: avoid\">")?;
writeln!(output, "<p>")?;
writeln!(output, "-----BEGIN PROXMOX BACKUP KEY-----")?;
for line in lines {
writeln!(output, "{}", line)?;
}
writeln!(output, "-----END PROXMOX BACKUP KEY-----")?;
writeln!(output, "</p>")?;
let qr_code = generate_qr_code("svg", lines)?;
let qr_code = base64::encode_config(&qr_code, base64::STANDARD_NO_PAD);
writeln!(output, "<center>")?;
writeln!(output, "<img")?;
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
writeln!(
output,
"width=\"{}pt\" height=\"{}pt\"",
img_size_pt, img_size_pt
)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
writeln!(output, "src=\"data:image/svg+xml;base64,{}\"/>", qr_code)?;
writeln!(output, "</center>")?;
writeln!(output, "</div>")?;
writeln!(output, "</body>")?;
writeln!(output, "</html>")?;
Ok(())
}
fn paperkey_text<W: Write>(
mut output: W,
lines: &[String],
subject: Option<String>,
is_private: bool,
) -> Result<(), Error> {
if let Some(subject) = subject {
writeln!(output, "Subject: {}\n", subject)?;
}
if is_private {
const BLOCK_SIZE: usize = 5;
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
for (block_nr, block) in lines.chunks(BLOCK_SIZE).enumerate() {
for (i, line) in block.iter().enumerate() {
writeln!(output, "{:-2}: {}", i + block_nr * BLOCK_SIZE, line)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
}
paperkey: simplify block generation the chunk-iterator already does exactly what we want here.. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:17 +00:00
let qr_code = generate_qr_code("utf8i", block)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
let qr_code = String::from_utf8(qr_code)
.map_err(|_| format_err!("Failed to read qr code (got non-utf8 data)"))?;
writeln!(output, "{}", qr_code)?;
writeln!(output, "{}", char::from(12u8))?; // page break
}
return Ok(());
}
writeln!(output, "-----BEGIN PROXMOX BACKUP KEY-----")?;
for line in lines {
writeln!(output, "{}", line)?;
}
writeln!(output, "-----END PROXMOX BACKUP KEY-----")?;
let qr_code = generate_qr_code("utf8i", &lines)?;
let qr_code = String::from_utf8(qr_code)
.map_err(|_| format_err!("Failed to read qr code (got non-utf8 data)"))?;
writeln!(output, "{}", qr_code)?;
Ok(())
}
fn generate_qr_code(output_type: &str, lines: &[String]) -> Result<Vec<u8>, Error> {
let mut child = Command::new("qrencode")
.args(&["-t", output_type, "-m0", "-s1", "-lm", "--output", "-"])
.stdin(Stdio::piped())
.stdout(Stdio::piped())
.spawn()?;
{
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
let stdin = child
.stdin
.as_mut()
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
.ok_or_else(|| format_err!("Failed to open stdin"))?;
let data = lines.join("\n");
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
stdin
.write_all(data.as_bytes())
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
.map_err(|_| format_err!("Failed to write to stdin"))?;
}
paperkey: rustfmt Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2021-02-01 13:06:18 +00:00
let output = child
.wait_with_output()
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
.map_err(|_| format_err!("Failed to read stdout"))?;
move remaining client tools to pbs-tools/datastore pbs-datastore now ended up depending on tokio after all, but that's fine for now for the fuse code I added pbs-fuse-loop (has the old fuse_loop and its 'loopdev' module) ultimately only binaries should depend on this to avoid the library link the only thins remaining to move out the client binary are the api method return types, those will need to be moved to pbs-api-types... Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
2021-07-21 12:12:22 +00:00
let output = pbs_tools::command_output(output, None)?;
paperkey: move code to src/tools/paperkey.rs
2021-01-22 08:38:38 +00:00
Ok(output)
}