[pbs-devel] applied: [PATCH proxmox-backup 6/6] manager: check if offline subscription is for the correct product

[Fabian Grünbichler]

with the bumped proxmox-subscription dependency folded in

On November 9, 2023 4:34 pm, Stefan Sterz wrote:
> previously when an offline key was set it wasn't verified that the
> subscription was for the correct product. while pom only applies
> subscriptions for the corresponding products, a user could manually
> invoke the `subscription set-offline-key` command to circumvent that.
> 
> Signed-off-by: Stefan Sterz <s.sterz at proxmox.com>
> ---
>  src/bin/proxmox_backup_manager/subscription.rs | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/src/bin/proxmox_backup_manager/subscription.rs b/src/bin/proxmox_backup_manager/subscription.rs
> index 66161af7..12f09ecf 100644
> --- a/src/bin/proxmox_backup_manager/subscription.rs
> +++ b/src/bin/proxmox_backup_manager/subscription.rs
> @@ -3,7 +3,7 @@ use serde_json::Value;
> 
>  use proxmox_router::{cli::*, ApiHandler, RpcEnvironment};
>  use proxmox_schema::api;
> -use proxmox_subscription::SubscriptionInfo;
> +use proxmox_subscription::{ProductType, SubscriptionInfo};
> 
>  use proxmox_backup::api2::{self, node::subscription::subscription_file_opts};
> 
> @@ -51,6 +51,12 @@ pub fn set_offline_subscription_key(data: String) -> Result<(), Error> {
>      if !info.is_signed() {
>          bail!("Offline subscription key must be signed!");
>      }
> +
> +    let product_type = info.get_product_type()?;
> +    if product_type != ProductType::Pbs {
> +        bail!("Subscription is not a PBS subscription ({product_type})!");
> +    }
> +
>      info.check_signature(&[proxmox_subscription::files::DEFAULT_SIGNING_KEY]);
>      info.check_age(false);
>      info.check_server_id();
> --
> 2.39.2
> 
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
>