2 Bacula® - The Network Backup Solution
4 Copyright (C) 2000-2010 Free Software Foundation Europe e.V.
6 The main author of Bacula is Kern Sibbald, with contributions from
7 many others, a complete list can be found in the file AUTHORS.
8 This program is Free Software; you can redistribute it and/or
9 modify it under the terms of version three of the GNU Affero General Public
10 License as published by the Free Software Foundation and included
13 This program is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 General Public License for more details.
18 You should have received a copy of the GNU Affero General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
23 Bacula® is a registered trademark of Kern Sibbald.
24 The licensor of Bacula is the Free Software Foundation Europe
25 (FSFE), Fiduciary Program, Sumatrastrasse 25, 8006 Zürich,
26 Switzerland, email:ftf@fsfeurope.org.
29 * Bacula File Daemon restore.c Restorefiles.
31 * Kern Sibbald, November MM
41 const bool have_darwin_os = true;
43 const bool have_darwin_os = false;
46 #if defined(HAVE_CRYPTO)
47 const bool have_crypto = true;
49 const bool have_crypto = false;
53 const bool have_acl = true;
55 const bool have_acl = false;
59 const bool have_sha2 = true;
61 const bool have_sha2 = false;
64 #if defined(HAVE_XATTR)
65 const bool have_xattr = true;
67 const bool have_xattr = false;
71 * Data received from Storage Daemon
73 static char rec_header[] = "rechdr %ld %ld %ld %ld %ld";
76 * Forward referenced functions
78 #if defined(HAVE_LIBZ)
79 static const char *zlib_strerror(int stat);
80 const bool have_libz = true;
82 const bool have_libz = false;
85 static void deallocate_cipher(r_ctx &rctx);
86 static void deallocate_fork_cipher(r_ctx &rctx);
87 static void free_signature(r_ctx &rctx);
88 static void free_session(r_ctx &rctx);
89 static void close_previous_stream(r_ctx &rctx);
91 static bool verify_signature(JCR *jcr, r_ctx &rctx);
92 int32_t extract_data(JCR *jcr, BFILE *bfd, POOLMEM *buf, int32_t buflen,
93 uint64_t *addr, int flags, RESTORE_CIPHER_CTX *cipher_ctx);
94 bool flush_cipher(JCR *jcr, BFILE *bfd, uint64_t *addr, int flags,
95 RESTORE_CIPHER_CTX *cipher_ctx);
98 * Close a bfd check that we are at the expected file offset.
99 * Makes use of some code from set_attributes().
101 static int bclose_chksize(JCR *jcr, BFILE *bfd, boffset_t osize)
103 char ec1[50], ec2[50];
106 fsize = blseek(bfd, 0, SEEK_CUR);
108 if (fsize > 0 && fsize != osize) {
109 Qmsg3(jcr, M_ERROR, 0, _("Size of data or stream of %s not correct. Original %s, restored %s.\n"),
110 jcr->last_fname, edit_uint64(osize, ec1),
111 edit_uint64(fsize, ec2));
117 #ifdef HAVE_DARWIN_OS
118 bool restore_finderinfo(JCR *jcr, POOLMEM *buf, int32_t buflen)
120 struct attrlist attrList;
122 memset(&attrList, 0, sizeof(attrList));
123 attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
124 attrList.commonattr = ATTR_CMN_FNDRINFO;
126 Dmsg0(130, "Restoring Finder Info\n");
127 jcr->ff->flags |= FO_HFSPLUS;
129 Jmsg(jcr, M_ERROR, 0, _("Invalid length of Finder Info (got %d, not 32)\n"), buflen);
133 if (setattrlist(jcr->last_fname, &attrList, buf, buflen, 0) != 0) {
134 Jmsg(jcr, M_ERROR, 0, _("Could not set Finder Info on %s\n"), jcr->last_fname);
141 bool restore_finderinfo(JCR *jcr, POOLMEM *buf, int32_t buflen)
148 * Restore the requested files.
150 void do_restore(JCR *jcr)
153 uint32_t VolSessionId, VolSessionTime;
155 char ec1[50]; /* Buffer printing huge values */
156 uint32_t buf_size; /* client buffer size */
158 intmax_t rsrc_len = 0; /* Original length of resource fork */
161 /* ***FIXME*** make configurable */
162 crypto_digest_t signing_algorithm = have_sha2 ?
163 CRYPTO_DIGEST_SHA256 : CRYPTO_DIGEST_SHA1;
164 memset(&rctx, 0, sizeof(rctx));
168 * The following variables keep track of "known unknowns"
170 int non_support_data = 0;
171 int non_support_attr = 0;
172 int non_support_rsrc = 0;
173 int non_support_finfo = 0;
174 int non_support_acl = 0;
175 int non_support_progname = 0;
176 int non_support_crypto = 0;
177 int non_support_xattr = 0;
179 sd = jcr->store_bsock;
180 set_jcr_job_status(jcr, JS_Running);
183 CLIENT *client = (CLIENT *)GetNextRes(R_CLIENT, NULL);
186 buf_size = client->max_network_buffer_size;
188 buf_size = 0; /* use default */
190 if (!bnet_set_buffer_size(sd, buf_size, BNET_SETBUF_WRITE)) {
191 set_jcr_job_status(jcr, JS_ErrorTerminated);
194 jcr->buf_size = sd->msglen;
197 * St Bernard code goes here if implemented -- see end of file
201 uint32_t compress_buf_size = jcr->buf_size + 12 + ((jcr->buf_size+999) / 1000) + 100;
202 jcr->compress_buf = get_memory(compress_buf_size);
203 jcr->compress_buf_size = compress_buf_size;
207 rctx.cipher_ctx.buf = get_memory(CRYPTO_CIPHER_MAX_BLOCK_SIZE);
208 if (have_darwin_os) {
209 rctx.fork_cipher_ctx.buf = get_memory(CRYPTO_CIPHER_MAX_BLOCK_SIZE);
214 * Get a record from the Storage daemon. We are guaranteed to
215 * receive records in the following order:
216 * 1. Stream record header
217 * 2. Stream data (one or more of the following in the order given)
218 * a. Attributes (Unix or Win32)
219 * b. Possibly stream encryption session data (e.g., symmetric session key)
220 * c. File data for the file
221 * d. Alternate data stream (e.g. Resource Fork)
225 * h. Possibly a cryptographic signature
226 * i. Possibly MD5 or SHA1 record
229 * NOTE: We keep track of two bacula file descriptors:
230 * 1. bfd for file data.
231 * This fd is opened for non empty files when an attribute stream is
232 * encountered and closed when we find the next attribute stream.
233 * 2. fork_bfd for alternate data streams
234 * This fd is opened every time we encounter a new alternate data
235 * stream for the current file. When we find any other stream, we
237 * The expected size of the stream, fork_len, should be set when
239 * 3. Not all the stream data records are required -- e.g. if there
240 * is no fork, there is no alternate data stream, no ACL, ...
243 binit(&rctx.forkbfd);
244 attr = rctx.attr = new_attr(jcr);
246 jcr->acl_data = (acl_data_t *)malloc(sizeof(acl_data_t));
247 memset((caddr_t)jcr->acl_data, 0, sizeof(acl_data_t));
248 jcr->acl_data->content = get_pool_memory(PM_MESSAGE);
251 jcr->xattr_data = (xattr_data_t *)malloc(sizeof(xattr_data_t));
252 memset((caddr_t)jcr->xattr_data, 0, sizeof(xattr_data_t));
253 jcr->xattr_data->content = get_pool_memory(PM_MESSAGE);
256 while (bget_msg(sd) >= 0 && !job_canceled(jcr)) {
258 * Remember previous stream type
260 rctx.prev_stream = rctx.stream;
263 * First we expect a Stream Record Header
265 if (sscanf(sd->msg, rec_header, &VolSessionId, &VolSessionTime, &file_index,
266 &rctx.full_stream, &rctx.size) != 5) {
267 Jmsg1(jcr, M_FATAL, 0, _("Record header scan error: %s\n"), sd->msg);
270 /* Strip off new stream high bits */
271 rctx.stream = rctx.full_stream & STREAMMASK_TYPE;
272 Dmsg5(150, "Got hdr: Files=%d FilInx=%d size=%d Stream=%d, %s.\n",
273 jcr->JobFiles, file_index, rctx.size, rctx.stream, stream_to_ascii(rctx.stream));
276 * Now we expect the Stream Data
278 if (bget_msg(sd) < 0) {
279 Jmsg1(jcr, M_FATAL, 0, _("Data record error. ERR=%s\n"), sd->bstrerror());
282 if (rctx.size != (uint32_t)sd->msglen) {
283 Jmsg2(jcr, M_FATAL, 0, _("Actual data size %d not same as header %d\n"),
284 sd->msglen, rctx.size);
285 Dmsg2(50, "Actual data size %d not same as header %d\n",
286 sd->msglen, rctx.size);
289 Dmsg3(130, "Got stream: %s len=%d extract=%d\n", stream_to_ascii(rctx.stream),
290 sd->msglen, rctx.extract);
293 * If we change streams, close and reset alternate data streams
295 if (rctx.prev_stream != rctx.stream) {
296 if (is_bopen(&rctx.forkbfd)) {
297 deallocate_fork_cipher(rctx);
298 bclose_chksize(jcr, &rctx.forkbfd, rctx.fork_size);
301 * Use an impossible value and set a proper one below
308 * File Attributes stream
310 switch (rctx.stream) {
311 case STREAM_UNIX_ATTRIBUTES:
312 case STREAM_UNIX_ATTRIBUTES_EX:
314 * if any previous stream open, close it
316 close_previous_stream(rctx);
319 * TODO: manage deleted files
321 if (rctx.type == FT_DELETED) { /* deleted file */
325 * Restore objects should be ignored here -- they are
326 * returned at the beginning of the restore.
328 if (rctx.type == FT_RESTORE_FIRST) {
333 * Unpack attributes and do sanity check them
335 if (!unpack_attributes_record(jcr, rctx.stream, sd->msg, sd->msglen, attr)) {
339 Dmsg3(100, "File %s\nattrib=%s\nattribsEx=%s\n", attr->fname,
340 attr->attr, attr->attrEx);
341 Dmsg3(100, "=== msglen=%d attrExlen=%d msg=%s\n", sd->msglen,
342 strlen(attr->attrEx), sd->msg);
344 attr->data_stream = decode_stat(attr->attr, &attr->statp, &attr->LinkFI);
346 if (!is_restore_stream_supported(attr->data_stream)) {
347 if (!non_support_data++) {
348 Jmsg(jcr, M_ERROR, 0, _("%s stream not supported on this Client.\n"),
349 stream_to_ascii(attr->data_stream));
354 build_attr_output_fnames(jcr, attr);
357 * Try to actually create the file, which returns a status telling
358 * us if we need to extract or not.
360 jcr->num_files_examined++;
361 rctx.extract = false;
363 stat = plugin_create_file(jcr, attr, &rctx.bfd, jcr->replace);
365 stat = create_file(jcr, attr, &rctx.bfd, jcr->replace);
368 pm_strcpy(jcr->last_fname, attr->ofname);
369 jcr->last_type = attr->type;
371 Dmsg2(130, "Outfile=%s create_file stat=%d\n", attr->ofname, stat);
375 pm_strcpy(jcr->last_fname, attr->ofname);
376 jcr->last_type = attr->type;
380 * File created and we expect file data
388 * File created, but there is no content
391 print_ls_output(jcr, attr);
393 if (have_darwin_os) {
395 * Only restore the resource fork for regular files
397 from_base64(&rsrc_len, attr->attrEx);
398 if (attr->type == FT_REG && rsrc_len > 0) {
403 * Count the resource forks not as regular files being restored.
414 * set attributes now because file will not be extracted
417 plugin_set_attributes(jcr, attr, &rctx.bfd);
419 set_attributes(jcr, attr, &rctx.bfd);
429 case STREAM_ENCRYPTED_SESSION_DATA:
430 crypto_error_t cryptoerr;
433 * Is this an unexpected session data entry?
436 Jmsg0(jcr, M_ERROR, 0, _("Unexpected cryptographic session data stream.\n"));
437 rctx.extract = false;
443 * Do we have any keys at all?
445 if (!jcr->crypto.pki_recipients) {
446 Jmsg(jcr, M_ERROR, 0, _("No private decryption keys have been defined to decrypt encrypted backup data.\n"));
447 rctx.extract = false;
452 if (jcr->crypto.digest) {
453 crypto_digest_free(jcr->crypto.digest);
455 jcr->crypto.digest = crypto_digest_new(jcr, signing_algorithm);
456 if (!jcr->crypto.digest) {
457 Jmsg0(jcr, M_FATAL, 0, _("Could not create digest.\n"));
458 rctx.extract = false;
464 * Decode and save session keys.
466 cryptoerr = crypto_session_decode((uint8_t *)sd->msg, (uint32_t)sd->msglen,
467 jcr->crypto.pki_recipients, &rctx.cs);
469 case CRYPTO_ERROR_NONE:
474 case CRYPTO_ERROR_NORECIPIENT:
475 Jmsg(jcr, M_ERROR, 0, _("Missing private key required to decrypt encrypted backup data.\n"));
477 case CRYPTO_ERROR_DECRYPTION:
478 Jmsg(jcr, M_ERROR, 0, _("Decrypt of the session key failed.\n"));
484 Jmsg1(jcr, M_ERROR, 0, _("An error occurred while decoding encrypted session data stream: %s\n"), crypto_strerror(cryptoerr));
488 if (cryptoerr != CRYPTO_ERROR_NONE) {
489 rctx.extract = false;
496 case STREAM_FILE_DATA:
497 case STREAM_SPARSE_DATA:
498 case STREAM_WIN32_DATA:
499 case STREAM_GZIP_DATA:
500 case STREAM_SPARSE_GZIP_DATA:
501 case STREAM_WIN32_GZIP_DATA:
502 case STREAM_ENCRYPTED_FILE_DATA:
503 case STREAM_ENCRYPTED_WIN32_DATA:
504 case STREAM_ENCRYPTED_FILE_GZIP_DATA:
505 case STREAM_ENCRYPTED_WIN32_GZIP_DATA:
507 * Force an expected, consistent stream type here
509 if (rctx.extract && (rctx.prev_stream == rctx.stream
510 || rctx.prev_stream == STREAM_UNIX_ATTRIBUTES
511 || rctx.prev_stream == STREAM_UNIX_ATTRIBUTES_EX
512 || rctx.prev_stream == STREAM_ENCRYPTED_SESSION_DATA)) {
515 if (rctx.stream == STREAM_SPARSE_DATA ||
516 rctx.stream == STREAM_SPARSE_GZIP_DATA) {
517 rctx.flags |= FO_SPARSE;
520 if (rctx.stream == STREAM_GZIP_DATA
521 || rctx.stream == STREAM_SPARSE_GZIP_DATA
522 || rctx.stream == STREAM_WIN32_GZIP_DATA
523 || rctx.stream == STREAM_ENCRYPTED_FILE_GZIP_DATA
524 || rctx.stream == STREAM_ENCRYPTED_WIN32_GZIP_DATA) {
525 rctx.flags |= FO_GZIP;
528 if (rctx.stream == STREAM_ENCRYPTED_FILE_DATA
529 || rctx.stream == STREAM_ENCRYPTED_FILE_GZIP_DATA
530 || rctx.stream == STREAM_ENCRYPTED_WIN32_DATA
531 || rctx.stream == STREAM_ENCRYPTED_WIN32_GZIP_DATA) {
533 * Set up a decryption context
535 if (!rctx.cipher_ctx.cipher) {
537 Jmsg1(jcr, M_ERROR, 0, _("Missing encryption session data stream for %s\n"), jcr->last_fname);
538 rctx.extract = false;
543 if ((rctx.cipher_ctx.cipher = crypto_cipher_new(rctx.cs, false,
544 &rctx.cipher_ctx.block_size)) == NULL) {
545 Jmsg1(jcr, M_ERROR, 0, _("Failed to initialize decryption context for %s\n"), jcr->last_fname);
547 rctx.extract = false;
552 rctx.flags |= FO_ENCRYPT;
555 if (is_win32_stream(rctx.stream) && !have_win32_api()) {
556 set_portable_backup(&rctx.bfd);
558 * "decompose" BackupWrite data
560 rctx.flags |= FO_WIN32DECOMP;
563 if (extract_data(jcr, &rctx.bfd, sd->msg, sd->msglen, &rctx.fileAddr,
564 rctx.flags, &rctx.cipher_ctx) < 0) {
565 rctx.extract = false;
573 * Resource fork stream - only recorded after a file to be restored
574 * Silently ignore if we cannot write - we already reported that
576 case STREAM_ENCRYPTED_MACOS_FORK_DATA:
577 case STREAM_MACOS_FORK_DATA:
578 if (have_darwin_os) {
580 jcr->ff->flags |= FO_HFSPLUS;
582 if (rctx.stream == STREAM_ENCRYPTED_MACOS_FORK_DATA) {
583 rctx.fork_flags |= FO_ENCRYPT;
586 * Set up a decryption context
588 if (rctx.extract && !rctx.fork_cipher_ctx.cipher) {
590 Jmsg1(jcr, M_ERROR, 0, _("Missing encryption session data stream for %s\n"), jcr->last_fname);
591 rctx.extract = false;
596 if ((rctx.fork_cipher_ctx.cipher = crypto_cipher_new(rctx.cs, false, &rctx.fork_cipher_ctx.block_size)) == NULL) {
597 Jmsg1(jcr, M_ERROR, 0, _("Failed to initialize decryption context for %s\n"), jcr->last_fname);
599 rctx.extract = false;
607 if (rctx.prev_stream != rctx.stream) {
608 if (bopen_rsrc(&rctx.forkbfd, jcr->last_fname, O_WRONLY | O_TRUNC | O_BINARY, 0) < 0) {
609 Jmsg(jcr, M_ERROR, 0, _("Cannot open resource fork for %s.\n"), jcr->last_fname);
610 rctx.extract = false;
614 rctx.fork_size = rsrc_len;
615 Dmsg0(130, "Restoring resource fork\n");
618 if (extract_data(jcr, &rctx.forkbfd, sd->msg, sd->msglen, &rctx.fork_addr, rctx.fork_flags,
619 &rctx.fork_cipher_ctx) < 0) {
620 rctx.extract = false;
621 bclose(&rctx.forkbfd);
630 case STREAM_HFSPLUS_ATTRIBUTES:
631 if (have_darwin_os) {
632 if (!restore_finderinfo(jcr, sd->msg, sd->msglen)) {
640 case STREAM_UNIX_ACCESS_ACL:
641 case STREAM_UNIX_DEFAULT_ACL:
642 case STREAM_ACL_AIX_TEXT:
643 case STREAM_ACL_DARWIN_ACCESS_ACL:
644 case STREAM_ACL_FREEBSD_DEFAULT_ACL:
645 case STREAM_ACL_FREEBSD_ACCESS_ACL:
646 case STREAM_ACL_HPUX_ACL_ENTRY:
647 case STREAM_ACL_IRIX_DEFAULT_ACL:
648 case STREAM_ACL_IRIX_ACCESS_ACL:
649 case STREAM_ACL_LINUX_DEFAULT_ACL:
650 case STREAM_ACL_LINUX_ACCESS_ACL:
651 case STREAM_ACL_TRU64_DEFAULT_ACL:
652 case STREAM_ACL_TRU64_DEFAULT_DIR_ACL:
653 case STREAM_ACL_TRU64_ACCESS_ACL:
654 case STREAM_ACL_SOLARIS_ACLENT:
655 case STREAM_ACL_SOLARIS_ACE:
656 case STREAM_ACL_AFS_TEXT:
657 case STREAM_ACL_AIX_AIXC:
658 case STREAM_ACL_AIX_NFS4:
659 case STREAM_ACL_FREEBSD_NFS4_ACL:
661 * Do not restore ACLs when
662 * a) The current file is not extracted
663 * b) and it is not a directory (they are never "extracted")
664 * c) or the file name is empty
666 if ((!rctx.extract && jcr->last_type != FT_DIREND) || (*jcr->last_fname == 0)) {
670 pm_memcpy(jcr->acl_data->content, sd->msg, sd->msglen);
671 jcr->acl_data->content_length = sd->msglen;
672 switch (parse_acl_streams(jcr, rctx.stream)) {
673 case bacl_exit_fatal:
675 case bacl_exit_error:
677 * Non-fatal errors, count them and when the number is under ACL_REPORT_ERR_MAX_PER_JOB
678 * print the error message set by the lower level routine in jcr->errmsg.
680 if (jcr->acl_data->nr_errors < ACL_REPORT_ERR_MAX_PER_JOB) {
681 Jmsg(jcr, M_WARNING, 0, "%s", jcr->errmsg);
683 jcr->acl_data->nr_errors++;
693 case STREAM_XATTR_IRIX:
694 case STREAM_XATTR_TRU64:
695 case STREAM_XATTR_AIX:
696 case STREAM_XATTR_OPENBSD:
697 case STREAM_XATTR_SOLARIS_SYS:
698 case STREAM_XATTR_SOLARIS:
699 case STREAM_XATTR_DARWIN:
700 case STREAM_XATTR_FREEBSD:
701 case STREAM_XATTR_LINUX:
702 case STREAM_XATTR_NETBSD:
704 * Do not restore Extended Attributes when
705 * a) The current file is not extracted
706 * b) and it is not a directory (they are never "extracted")
707 * c) or the file name is empty
709 if ((!rctx.extract && jcr->last_type != FT_DIREND) || (*jcr->last_fname == 0)) {
713 pm_memcpy(jcr->xattr_data->content, sd->msg, sd->msglen);
714 jcr->xattr_data->content_length = sd->msglen;
715 switch (parse_xattr_streams(jcr, rctx.stream)) {
716 case bxattr_exit_fatal:
718 case bxattr_exit_error:
720 * Non-fatal errors, count them and when the number is under XATTR_REPORT_ERR_MAX_PER_JOB
721 * print the error message set by the lower level routine in jcr->errmsg.
723 if (jcr->xattr_data->nr_errors < XATTR_REPORT_ERR_MAX_PER_JOB) {
724 Jmsg(jcr, M_WARNING, 0, "%s", jcr->errmsg);
726 jcr->xattr_data->nr_errors++;
736 case STREAM_SIGNED_DIGEST:
738 * Is this an unexpected signature?
741 Jmsg0(jcr, M_ERROR, 0, _("Unexpected cryptographic signature data stream.\n"));
742 free_signature(rctx);
748 if (rctx.extract && (rctx.sig = crypto_sign_decode(jcr, (uint8_t *)sd->msg, (uint32_t)sd->msglen)) == NULL) {
749 Jmsg1(jcr, M_ERROR, 0, _("Failed to decode message signature for %s\n"), jcr->last_fname);
753 case STREAM_MD5_DIGEST:
754 case STREAM_SHA1_DIGEST:
755 case STREAM_SHA256_DIGEST:
756 case STREAM_SHA512_DIGEST:
759 case STREAM_PROGRAM_NAMES:
760 case STREAM_PROGRAM_DATA:
761 if (!non_support_progname) {
762 Pmsg0(000, "Got Program Name or Data Stream. Ignored.\n");
763 non_support_progname++;
767 case STREAM_PLUGIN_NAME:
768 close_previous_stream(rctx);
769 Dmsg1(50, "restore stream_plugin_name=%s\n", sd->msg);
770 plugin_name_stream(jcr, sd->msg);
773 case STREAM_RESTORE_OBJECT:
774 break; /* these are sent by Director */
777 close_previous_stream(rctx);
778 Jmsg(jcr, M_ERROR, 0, _("Unknown stream=%d ignored. This shouldn't happen!\n"),
780 Dmsg2(0, "Unknown stream=%d data=%s\n", rctx.stream, sd->msg);
782 } /* end switch(stream) */
783 } /* end while get_msg() */
786 * If output file is still open, it was the last one in the
787 * archive since we just hit an end of file, so close the file.
789 if (is_bopen(&rctx.forkbfd)) {
790 bclose_chksize(jcr, &rctx.forkbfd, rctx.fork_size);
793 close_previous_stream(rctx);
794 set_jcr_job_status(jcr, JS_Terminated);
798 set_jcr_job_status(jcr, JS_ErrorTerminated);
802 * First output the statistics.
804 Dmsg2(10, "End Do Restore. Files=%d Bytes=%s\n", jcr->JobFiles,
805 edit_uint64(jcr->JobBytes, ec1));
806 if (have_acl && jcr->acl_data->nr_errors > 0) {
807 Jmsg(jcr, M_ERROR, 0, _("Encountered %ld acl errors while doing restore\n"),
808 jcr->acl_data->nr_errors);
810 if (have_xattr && jcr->xattr_data->nr_errors > 0) {
811 Jmsg(jcr, M_ERROR, 0, _("Encountered %ld xattr errors while doing restore\n"),
812 jcr->xattr_data->nr_errors);
814 if (non_support_data > 1 || non_support_attr > 1) {
815 Jmsg(jcr, M_ERROR, 0, _("%d non-supported data streams and %d non-supported attrib streams ignored.\n"),
816 non_support_data, non_support_attr);
818 if (non_support_rsrc) {
819 Jmsg(jcr, M_INFO, 0, _("%d non-supported resource fork streams ignored.\n"), non_support_rsrc);
821 if (non_support_finfo) {
822 Jmsg(jcr, M_INFO, 0, _("%d non-supported Finder Info streams ignored.\n"), non_support_rsrc);
824 if (non_support_acl) {
825 Jmsg(jcr, M_INFO, 0, _("%d non-supported acl streams ignored.\n"), non_support_acl);
827 if (non_support_crypto) {
828 Jmsg(jcr, M_INFO, 0, _("%d non-supported crypto streams ignored.\n"), non_support_acl);
830 if (non_support_xattr) {
831 Jmsg(jcr, M_INFO, 0, _("%d non-supported xattr streams ignored.\n"), non_support_xattr);
835 * Free Signature & Crypto Data
837 free_signature(rctx);
839 if (jcr->crypto.digest) {
840 crypto_digest_free(jcr->crypto.digest);
841 jcr->crypto.digest = NULL;
845 * Free file cipher restore context
847 if (rctx.cipher_ctx.cipher) {
848 crypto_cipher_free(rctx.cipher_ctx.cipher);
849 rctx.cipher_ctx.cipher = NULL;
852 if (rctx.cipher_ctx.buf) {
853 free_pool_memory(rctx.cipher_ctx.buf);
854 rctx.cipher_ctx.buf = NULL;
858 * Free alternate stream cipher restore context
860 if (rctx.fork_cipher_ctx.cipher) {
861 crypto_cipher_free(rctx.fork_cipher_ctx.cipher);
862 rctx.fork_cipher_ctx.cipher = NULL;
864 if (rctx.fork_cipher_ctx.buf) {
865 free_pool_memory(rctx.fork_cipher_ctx.buf);
866 rctx.fork_cipher_ctx.buf = NULL;
869 if (jcr->compress_buf) {
870 free_pool_memory(jcr->compress_buf);
871 jcr->compress_buf = NULL;
872 jcr->compress_buf_size = 0;
875 if (have_acl && jcr->acl_data) {
876 free_pool_memory(jcr->acl_data->content);
878 jcr->acl_data = NULL;
881 if (have_xattr && jcr->xattr_data) {
882 free_pool_memory(jcr->xattr_data->content);
883 free(jcr->xattr_data);
884 jcr->xattr_data = NULL;
887 bclose(&rctx.forkbfd);
889 free_attr(rctx.attr);
894 * Convert ZLIB error code into an ASCII message
896 static const char *zlib_strerror(int stat)
903 return _("Zlib errno");
905 return _("Zlib stream error");
907 return _("Zlib data error");
909 return _("Zlib memory error");
911 return _("Zlib buffer error");
912 case Z_VERSION_ERROR:
913 return _("Zlib version error");
920 static int do_file_digest(JCR *jcr, FF_PKT *ff_pkt, bool top_level)
922 Dmsg1(50, "do_file_digest jcr=%p\n", jcr);
923 return (digest_file(jcr, ff_pkt, jcr->crypto.digest));
927 * Verify the signature for the last restored file
928 * Return value is either true (signature correct)
929 * or false (signature could not be verified).
930 * TODO landonf: Implement without using find_one_file and
931 * without re-reading the file.
933 static bool verify_signature(JCR *jcr, r_ctx &rctx)
935 X509_KEYPAIR *keypair;
936 DIGEST *digest = NULL;
938 uint64_t saved_bytes;
939 crypto_digest_t signing_algorithm = have_sha2 ?
940 CRYPTO_DIGEST_SHA256 : CRYPTO_DIGEST_SHA1;
941 crypto_digest_t algorithm;
942 SIGNATURE *sig = rctx.sig;
945 if (!jcr->crypto.pki_sign) {
952 if (rctx.type == FT_REGE || rctx.type == FT_REG || rctx.type == FT_RAW) {
953 Jmsg1(jcr, M_ERROR, 0, _("Missing cryptographic signature for %s\n"),
961 * Iterate through the trusted signers
963 foreach_alist(keypair, jcr->crypto.pki_signers) {
964 err = crypto_sign_get_digest(sig, jcr->crypto.pki_keypair, algorithm, &digest);
966 case CRYPTO_ERROR_NONE:
967 Dmsg0(50, "== Got digest\n");
969 * We computed jcr->crypto.digest using signing_algorithm while writing
970 * the file. If it is not the same as the algorithm used for
971 * this file, punt by releasing the computed algorithm and
972 * computing by re-reading the file.
974 if (algorithm != signing_algorithm) {
975 if (jcr->crypto.digest) {
976 crypto_digest_free(jcr->crypto.digest);
977 jcr->crypto.digest = NULL;
980 if (jcr->crypto.digest) {
982 * Use digest computed while writing the file to verify the signature
984 if ((err = crypto_sign_verify(sig, keypair, jcr->crypto.digest)) != CRYPTO_ERROR_NONE) {
985 Dmsg1(50, "Bad signature on %s\n", jcr->last_fname);
986 Jmsg2(jcr, M_ERROR, 0, _("Signature validation failed for file %s: ERR=%s\n"),
987 jcr->last_fname, crypto_strerror(err));
992 * Signature found, digest allocated. Old method,
993 * re-read the file and compute the digest
995 jcr->crypto.digest = digest;
998 * Checksum the entire file
999 * Make sure we don't modify JobBytes by saving and restoring it
1001 saved_bytes = jcr->JobBytes;
1002 if (find_one_file(jcr, jcr->ff, do_file_digest, jcr->last_fname, (dev_t)-1, 1) != 0) {
1003 Jmsg(jcr, M_ERROR, 0, _("Digest one file failed for file: %s\n"),
1005 jcr->JobBytes = saved_bytes;
1008 jcr->JobBytes = saved_bytes;
1011 * Verify the signature
1013 if ((err = crypto_sign_verify(sig, keypair, digest)) != CRYPTO_ERROR_NONE) {
1014 Dmsg1(50, "Bad signature on %s\n", jcr->last_fname);
1015 Jmsg2(jcr, M_ERROR, 0, _("Signature validation failed for file %s: ERR=%s\n"),
1016 jcr->last_fname, crypto_strerror(err));
1019 jcr->crypto.digest = NULL;
1025 Dmsg1(50, "Signature good on %s\n", jcr->last_fname);
1026 crypto_digest_free(digest);
1029 case CRYPTO_ERROR_NOSIGNER:
1031 * Signature not found, try again
1034 crypto_digest_free(digest);
1040 * Something strange happened (that shouldn't happen!)...
1042 Qmsg2(jcr, M_ERROR, 0, _("Signature validation failed for %s: %s\n"), jcr->last_fname, crypto_strerror(err));
1050 Dmsg1(50, "Could not find a valid public key for signature on %s\n", jcr->last_fname);
1054 crypto_digest_free(digest);
1059 bool sparse_data(JCR *jcr, BFILE *bfd, uint64_t *addr, char **data, uint32_t *length)
1064 unser_begin(*data, OFFSET_FADDR_SIZE);
1065 unser_uint64(faddr);
1066 if (*addr != faddr) {
1068 if (blseek(bfd, (boffset_t)*addr, SEEK_SET) < 0) {
1070 Jmsg3(jcr, M_ERROR, 0, _("Seek to %s error on %s: ERR=%s\n"),
1071 edit_uint64(*addr, ec1), jcr->last_fname,
1072 be.bstrerror(bfd->berrno));
1076 *data += OFFSET_FADDR_SIZE;
1077 *length -= OFFSET_FADDR_SIZE;
1081 bool decompress_data(JCR *jcr, char **data, uint32_t *length)
1086 char ec1[50]; /* Buffer printing huge values */
1089 * NOTE! We only use uLong and Byte because they are
1090 * needed by the zlib routines, they should not otherwise
1091 * be used in Bacula.
1093 compress_len = jcr->compress_buf_size;
1094 Dmsg2(200, "Comp_len=%d msglen=%d\n", compress_len, *length);
1095 while ((stat=uncompress((Byte *)jcr->compress_buf, &compress_len,
1096 (const Byte *)*data, (uLong)*length)) == Z_BUF_ERROR)
1099 * The buffer size is too small, try with a bigger one
1101 compress_len = jcr->compress_buf_size = jcr->compress_buf_size + (jcr->compress_buf_size >> 1);
1102 Dmsg2(200, "Comp_len=%d msglen=%d\n", compress_len, *length);
1103 jcr->compress_buf = check_pool_memory_size(jcr->compress_buf,
1107 Qmsg(jcr, M_ERROR, 0, _("Uncompression error on file %s. ERR=%s\n"),
1108 jcr->last_fname, zlib_strerror(stat));
1111 *data = jcr->compress_buf;
1112 *length = compress_len;
1113 Dmsg2(200, "Write uncompressed %d bytes, total before write=%s\n", compress_len, edit_uint64(jcr->JobBytes, ec1));
1116 Qmsg(jcr, M_ERROR, 0, _("GZIP data stream found, but GZIP not configured!\n"));
1121 static void unser_crypto_packet_len(RESTORE_CIPHER_CTX *ctx)
1124 if (ctx->packet_len == 0 && ctx->buf_len >= CRYPTO_LEN_SIZE) {
1125 unser_begin(&ctx->buf[0], CRYPTO_LEN_SIZE);
1126 unser_uint32(ctx->packet_len);
1127 ctx->packet_len += CRYPTO_LEN_SIZE;
1131 bool store_data(JCR *jcr, BFILE *bfd, char *data, const int32_t length, bool win32_decomp)
1133 if (jcr->crypto.digest) {
1134 crypto_digest_update(jcr->crypto.digest, (uint8_t *)data, length);
1137 if (!processWin32BackupAPIBlock(bfd, data, length)) {
1139 Jmsg2(jcr, M_ERROR, 0, _("Write error in Win32 Block Decomposition on %s: %s\n"),
1140 jcr->last_fname, be.bstrerror(bfd->berrno));
1143 } else if (bwrite(bfd, data, length) != (ssize_t)length) {
1145 Jmsg2(jcr, M_ERROR, 0, _("Write error on %s: %s\n"),
1146 jcr->last_fname, be.bstrerror(bfd->berrno));
1154 * In the context of jcr, write data to bfd.
1155 * We write buflen bytes in buf at addr. addr is updated in place.
1156 * The flags specify whether to use sparse files or compression.
1157 * Return value is the number of bytes written, or -1 on errors.
1159 int32_t extract_data(JCR *jcr, BFILE *bfd, POOLMEM *buf, int32_t buflen,
1160 uint64_t *addr, int flags, RESTORE_CIPHER_CTX *cipher_ctx)
1162 char *wbuf; /* write buffer */
1163 uint32_t wsize; /* write size */
1164 uint32_t rsize; /* read size */
1165 uint32_t decrypted_len = 0; /* Decryption output length */
1166 char ec1[50]; /* Buffer printing huge values */
1169 jcr->ReadBytes += rsize;
1173 if (flags & FO_ENCRYPT) {
1174 ASSERT(cipher_ctx->cipher);
1177 * NOTE: We must implement block preserving semantics for the
1178 * non-streaming compression and sparse code.
1180 * Grow the crypto buffer, if necessary.
1181 * crypto_cipher_update() will process only whole blocks,
1182 * buffering the remaining input.
1184 cipher_ctx->buf = check_pool_memory_size(cipher_ctx->buf,
1185 cipher_ctx->buf_len + wsize + cipher_ctx->block_size);
1188 * Decrypt the input block
1190 if (!crypto_cipher_update(cipher_ctx->cipher,
1191 (const u_int8_t *)wbuf,
1193 (u_int8_t *)&cipher_ctx->buf[cipher_ctx->buf_len],
1196 * Decryption failed. Shouldn't happen.
1198 Jmsg(jcr, M_FATAL, 0, _("Decryption error\n"));
1202 if (decrypted_len == 0) {
1204 * No full block of encrypted data available, write more data
1209 Dmsg2(200, "decrypted len=%d encrypted len=%d\n", decrypted_len, wsize);
1211 cipher_ctx->buf_len += decrypted_len;
1212 wbuf = cipher_ctx->buf;
1215 * If one full preserved block is available, write it to disk,
1216 * and then buffer any remaining data. This should be effecient
1217 * as long as Bacula's block size is not significantly smaller than the
1218 * encryption block size (extremely unlikely!)
1220 unser_crypto_packet_len(cipher_ctx);
1221 Dmsg1(500, "Crypto unser block size=%d\n", cipher_ctx->packet_len - CRYPTO_LEN_SIZE);
1223 if (cipher_ctx->packet_len == 0 || cipher_ctx->buf_len < cipher_ctx->packet_len) {
1225 * No full preserved block is available.
1231 * We have one full block, set up the filter input buffers
1233 wsize = cipher_ctx->packet_len - CRYPTO_LEN_SIZE;
1234 wbuf = &wbuf[CRYPTO_LEN_SIZE]; /* Skip the block length header */
1235 cipher_ctx->buf_len -= cipher_ctx->packet_len;
1236 Dmsg2(130, "Encryption writing full block, %u bytes, remaining %u bytes in buffer\n", wsize, cipher_ctx->buf_len);
1239 if ((flags & FO_SPARSE) || (flags & FO_OFFSETS)) {
1240 if (!sparse_data(jcr, bfd, addr, &wbuf, &wsize)) {
1245 if (flags & FO_GZIP) {
1246 if (!decompress_data(jcr, &wbuf, &wsize)) {
1251 if (!store_data(jcr, bfd, wbuf, wsize, (flags & FO_WIN32DECOMP) != 0)) {
1254 jcr->JobBytes += wsize;
1256 Dmsg2(130, "Write %u bytes, JobBytes=%s\n", wsize, edit_uint64(jcr->JobBytes, ec1));
1259 * Clean up crypto buffers
1261 if (flags & FO_ENCRYPT) {
1262 /* Move any remaining data to start of buffer */
1263 if (cipher_ctx->buf_len > 0) {
1264 Dmsg1(130, "Moving %u buffered bytes to start of buffer\n", cipher_ctx->buf_len);
1265 memmove(cipher_ctx->buf, &cipher_ctx->buf[cipher_ctx->packet_len],
1266 cipher_ctx->buf_len);
1269 * The packet was successfully written, reset the length so that the next
1270 * packet length may be re-read by unser_crypto_packet_len()
1272 cipher_ctx->packet_len = 0;
1282 * If extracting, close any previous stream
1284 static void close_previous_stream(r_ctx &rctx)
1287 * If extracting, it was from previous stream, so
1288 * close the output file and validate the signature.
1291 if (rctx.size > 0 && !is_bopen(&rctx.bfd)) {
1292 Jmsg0(rctx.jcr, M_ERROR, 0, _("Logic error: output file should be open\n"));
1293 Dmsg2(000, "=== logic error size=%d bopen=%d\n", rctx.size,
1294 is_bopen(&rctx.bfd));
1297 if (rctx.prev_stream != STREAM_ENCRYPTED_SESSION_DATA) {
1298 deallocate_cipher(rctx);
1299 deallocate_fork_cipher(rctx);
1302 if (rctx.jcr->plugin) {
1303 plugin_set_attributes(rctx.jcr, rctx.attr, &rctx.bfd);
1305 set_attributes(rctx.jcr, rctx.attr, &rctx.bfd);
1307 rctx.extract = false;
1310 * Verify the cryptographic signature, if any
1312 rctx.type = rctx.attr->type;
1313 verify_signature(rctx.jcr, rctx);
1318 free_signature(rctx);
1320 rctx.jcr->ff->flags = 0;
1321 Dmsg0(130, "Stop extracting.\n");
1322 } else if (is_bopen(&rctx.bfd)) {
1323 Jmsg0(rctx.jcr, M_ERROR, 0, _("Logic error: output file should not be open\n"));
1324 Dmsg0(000, "=== logic error !open\n");
1331 * In the context of jcr, flush any remaining data from the cipher context,
1332 * writing it to bfd.
1333 * Return value is true on success, false on failure.
1335 bool flush_cipher(JCR *jcr, BFILE *bfd, uint64_t *addr, int flags,
1336 RESTORE_CIPHER_CTX *cipher_ctx)
1338 uint32_t decrypted_len = 0;
1339 char *wbuf; /* write buffer */
1340 uint32_t wsize; /* write size */
1341 char ec1[50]; /* Buffer printing huge values */
1342 bool second_pass = false;
1346 * Write out the remaining block and free the cipher context
1348 cipher_ctx->buf = check_pool_memory_size(cipher_ctx->buf, cipher_ctx->buf_len +
1349 cipher_ctx->block_size);
1351 if (!crypto_cipher_finalize(cipher_ctx->cipher, (uint8_t *)&cipher_ctx->buf[cipher_ctx->buf_len],
1354 * Writing out the final, buffered block failed. Shouldn't happen.
1356 Jmsg3(jcr, M_ERROR, 0, _("Decryption error. buf_len=%d decrypt_len=%d on file %s\n"),
1357 cipher_ctx->buf_len, decrypted_len, jcr->last_fname);
1360 Dmsg2(130, "Flush decrypt len=%d buf_len=%d\n", decrypted_len, cipher_ctx->buf_len);
1362 * If nothing new was decrypted, and our output buffer is empty, return
1364 if (decrypted_len == 0 && cipher_ctx->buf_len == 0) {
1368 cipher_ctx->buf_len += decrypted_len;
1370 unser_crypto_packet_len(cipher_ctx);
1371 Dmsg1(500, "Crypto unser block size=%d\n", cipher_ctx->packet_len - CRYPTO_LEN_SIZE);
1372 wsize = cipher_ctx->packet_len - CRYPTO_LEN_SIZE;
1374 * Decrypted, possibly decompressed output here.
1376 wbuf = &cipher_ctx->buf[CRYPTO_LEN_SIZE];
1377 cipher_ctx->buf_len -= cipher_ctx->packet_len;
1378 Dmsg2(130, "Encryption writing full block, %u bytes, remaining %u bytes in buffer\n", wsize, cipher_ctx->buf_len);
1380 if ((flags & FO_SPARSE) || (flags & FO_OFFSETS)) {
1381 if (!sparse_data(jcr, bfd, addr, &wbuf, &wsize)) {
1386 if (flags & FO_GZIP) {
1387 if (!decompress_data(jcr, &wbuf, &wsize)) {
1392 Dmsg0(130, "Call store_data\n");
1393 if (!store_data(jcr, bfd, wbuf, wsize, (flags & FO_WIN32DECOMP) != 0)) {
1396 jcr->JobBytes += wsize;
1397 Dmsg2(130, "Flush write %u bytes, JobBytes=%s\n", wsize, edit_uint64(jcr->JobBytes, ec1));
1400 * Move any remaining data to start of buffer
1402 if (cipher_ctx->buf_len > 0) {
1403 Dmsg1(130, "Moving %u buffered bytes to start of buffer\n", cipher_ctx->buf_len);
1404 memmove(cipher_ctx->buf, &cipher_ctx->buf[cipher_ctx->packet_len],
1405 cipher_ctx->buf_len);
1408 * The packet was successfully written, reset the length so that the next
1409 * packet length may be re-read by unser_crypto_packet_len()
1411 cipher_ctx->packet_len = 0;
1413 if (cipher_ctx->buf_len >0 && !second_pass) {
1421 cipher_ctx->buf_len = 0;
1422 cipher_ctx->packet_len = 0;
1427 static void deallocate_cipher(r_ctx &rctx)
1430 * Flush and deallocate previous stream's cipher context
1432 if (rctx.cipher_ctx.cipher) {
1433 flush_cipher(rctx.jcr, &rctx.bfd, &rctx.fileAddr, rctx.flags, &rctx.cipher_ctx);
1434 crypto_cipher_free(rctx.cipher_ctx.cipher);
1435 rctx.cipher_ctx.cipher = NULL;
1439 static void deallocate_fork_cipher(r_ctx &rctx)
1443 * Flush and deallocate previous stream's fork cipher context
1445 if (rctx.fork_cipher_ctx.cipher) {
1446 flush_cipher(rctx.jcr, &rctx.forkbfd, &rctx.fork_addr, rctx.fork_flags, &rctx.fork_cipher_ctx);
1447 crypto_cipher_free(rctx.fork_cipher_ctx.cipher);
1448 rctx.fork_cipher_ctx.cipher = NULL;
1452 static void free_signature(r_ctx &rctx)
1455 crypto_sign_free(rctx.sig);
1460 static void free_session(r_ctx &rctx)
1463 crypto_session_free(rctx.cs);
1470 * This code if implemented goes above
1472 #ifdef stbernard_implemented
1473 / #if defined(HAVE_WIN32)
1474 bool bResumeOfmOnExit = FALSE;
1475 if (isOpenFileManagerRunning()) {
1476 if ( pauseOpenFileManager() ) {
1477 Jmsg(jcr, M_INFO, 0, _("Open File Manager paused\n") );
1478 bResumeOfmOnExit = TRUE;
1481 Jmsg(jcr, M_ERROR, 0, _("FAILED to pause Open File Manager\n") );
1485 char username[UNLEN+1];
1486 DWORD usize = sizeof(username);
1487 int privs = enable_backup_privileges(NULL, 1);
1488 if (GetUserName(username, &usize)) {
1489 Jmsg2(jcr, M_INFO, 0, _("Running as '%s'. Privmask=%#08x\n"), username,
1491 Jmsg(jcr, M_WARNING, 0, _("Failed to retrieve current UserName\n"));