PVE/NodeConfig.pm

   1 package PVE::NodeConfig;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::CertHelpers;
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Tools qw(file_get_contents file_set_contents lock_file);
   9 use PVE::ACME;
  10
  11 use PVE::API2::ACMEPlugin;
  12
  13 # register up to 5 domain names per node for now
  14 my $MAXDOMAINS = 5;
  15
  16 my $node_config_lock = '/var/lock/pvenode.lock';
  17
  18 PVE::JSONSchema::register_format('pve-acme-domain', sub {
  19     my ($domain, $noerr) = @_;
  20
  21     my $label = qr/[a-z0-9][a-z0-9_-]*/i;
  22
  23     return $domain if $domain =~ /^$label(?:\.$label)+$/;
  24     return undef if $noerr;
  25     die "value '$domain' does not look like a valid domain name!\n";
  26 });
  27
  28 PVE::JSONSchema::register_format('pve-acme-alias', sub {
  29     my ($alias, $noerr) = @_;
  30
  31     my $label = qr/[a-z0-9_][a-z0-9_-]*/i;
  32
  33     return $alias if $alias =~ /^$label(?:\.$label)+$/;
  34     return undef if $noerr;
  35     die "value '$alias' does not look like a valid alias name!\n";
  36 });
  37
  38 sub config_file {
  39     my ($node) = @_;
  40
  41     return "/etc/pve/nodes/${node}/config";
  42 }
  43
  44 sub load_config {
  45     my ($node) = @_;
  46
  47     my $filename = config_file($node);
  48     my $raw = eval { PVE::Tools::file_get_contents($filename); };
  49     return {} if !$raw;
  50
  51     return parse_node_config($raw);
  52 }
  53
  54 sub write_config {
  55     my ($node, $conf) = @_;
  56
  57     my $filename = config_file($node);
  58
  59     my $raw = write_node_config($conf);
  60
  61     PVE::Tools::file_set_contents($filename, $raw);
  62 }
  63
  64 sub lock_config {
  65     my ($node, $realcode, @param) = @_;
  66
  67     # make sure configuration file is up-to-date
  68     my $code = sub {
  69         PVE::Cluster::cfs_update();
  70         $realcode->(@_);
  71     };
  72
  73     my $res = lock_file($node_config_lock, 10, $code, @param);
  74
  75     die $@ if $@;
  76
  77     return $res;
  78 }
  79
  80 my $confdesc = {
  81     description => {
  82         type => 'string',
  83         description => "Description for the Node. Shown in the web-interface node notes panel."
  84             ." This is saved as comment inside the configuration file.",
  85         maxLength => 64 * 1024,
  86         optional => 1,
  87     },
  88     wakeonlan => {
  89         type => 'string',
  90         description => 'MAC address for wake on LAN',
  91         format => 'mac-addr',
  92         optional => 1,
  93     },
  94     'startall-onboot-delay' => {
  95         description => 'Initial delay in seconds, before starting all the Virtual Guests with on-boot enabled.',
  96         type => 'integer',
  97         minimum => 0,
  98         maximum => 300,
  99         default => 0,
 100         optional => 1,
 101     },
 102 };
 103
 104 my $acme_domain_desc = {
 105     domain => {
 106         type => 'string',
 107         format => 'pve-acme-domain',
 108         format_description => 'domain',
 109         description => 'domain for this node\'s ACME certificate',
 110         default_key => 1,
 111     },
 112     plugin => {
 113         type => 'string',
 114         format => 'pve-configid',
 115         description => 'The ACME plugin ID',
 116         format_description => 'name of the plugin configuration',
 117         optional => 1,
 118         default => 'standalone',
 119     },
 120     alias => {
 121         type => 'string',
 122         format => 'pve-acme-alias',
 123         format_description => 'domain',
 124         description => 'Alias for the Domain to verify ACME Challenge over DNS',
 125         optional => 1,
 126     },
 127 };
 128
 129 my $acmedesc = {
 130     account => get_standard_option('pve-acme-account-name'),
 131     domains => {
 132         type => 'string',
 133         format => 'pve-acme-domain-list',
 134         format_description => 'domain[;domain;...]',
 135         description => 'List of domains for this node\'s ACME certificate',
 136         optional => 1,
 137     },
 138 };
 139
 140 $confdesc->{acme} = {
 141     type => 'string',
 142     description => 'Node specific ACME settings.',
 143     format => $acmedesc,
 144     optional => 1,
 145 };
 146
 147 for my $i (0..$MAXDOMAINS) {
 148     $confdesc->{"acmedomain$i"} = {
 149         type => 'string',
 150         description => 'ACME domain and validation plugin',
 151         format => $acme_domain_desc,
 152         optional => 1,
 153     };
 154 };
 155
 156 sub check_type {
 157     my ($key, $value) = @_;
 158
 159     die "unknown setting '$key'\n" if !$confdesc->{$key};
 160
 161     my $type = $confdesc->{$key}->{type};
 162
 163     if (!defined($value)) {
 164         die "got undefined value\n";
 165     }
 166
 167     if ($value =~ m/[\n\r]/) {
 168         die "property contains a line feed\n";
 169     }
 170
 171     if ($type eq 'boolean') {
 172         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
 173         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
 174         die "type check ('boolean') failed - got '$value'\n";
 175     } elsif ($type eq 'integer') {
 176         return int($1) if $value =~ m/^(\d+)$/;
 177         die "type check ('integer') failed - got '$value'\n";
 178     } elsif ($type eq 'number') {
 179         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
 180         die "type check ('number') failed - got '$value'\n";
 181     } elsif ($type eq 'string') {
 182         if (my $fmt = $confdesc->{$key}->{format}) {
 183             PVE::JSONSchema::check_format($fmt, $value);
 184             return $value;
 185         } elsif (my $pattern = $confdesc->{$key}->{pattern}) {
 186             if ($value !~ m/^$pattern$/) {
 187                 die "value does not match the regex pattern\n";
 188             }
 189         }
 190         return $value;
 191     } else {
 192         die "internal error"
 193     }
 194 }
 195
 196 sub parse_node_config {
 197     my ($content) = @_;
 198
 199     return undef if !defined($content);
 200
 201     my $conf = {
 202         digest => Digest::SHA::sha1_hex($content),
 203     };
 204     my $descr = '';
 205
 206     my @lines = split(/\n/, $content);
 207     foreach my $line (@lines) {
 208         if ($line =~ /^\#(.*)\s*$/ || $line =~ /^description:\s*(.*\S)\s*$/) {
 209             $descr .= PVE::Tools::decode_text($1) . "\n";
 210             next;
 211         }
 212         if ($line =~ /^([a-z][a-z-_]*\d*):\s*(\S.*)\s*$/) {
 213             my $key = $1;
 214             my $value = $2;
 215             $value = eval { check_type($key, $value) };
 216             die "cannot parse value of '$key' in node config: $@" if $@;
 217             $conf->{$key} = $value;
 218         } else {
 219             warn "cannot parse line '$line' in node config\n";
 220         }
 221     }
 222
 223     $conf->{description} = $descr if $descr;
 224
 225     return $conf;
 226 }
 227
 228 sub write_node_config {
 229     my ($conf) = @_;
 230
 231     my $raw = '';
 232     # add description as comment to top of file
 233     my $descr = $conf->{description} || '';
 234     foreach my $cl (split(/\n/, $descr)) {
 235         $raw .= '#' .  PVE::Tools::encode_text($cl) . "\n";
 236     }
 237
 238     for my $key (sort keys %$conf) {
 239         next if ($key eq 'description');
 240         next if ($key eq 'digest');
 241
 242         my $value = $conf->{$key};
 243         die "detected invalid newline inside property '$key'\n"
 244             if $value =~ m/\n/;
 245         $raw .= "$key: $value\n";
 246     }
 247
 248     return $raw;
 249 }
 250
 251 # we always convert domain values to lower case, since DNS entries are not case
 252 # sensitive and ACME implementations might convert the ordered identifiers
 253 # to lower case
 254 sub get_acme_conf {
 255     my ($node_conf, $noerr) = @_;
 256
 257     $node_conf //= {};
 258
 259     my $res = {};
 260     if (defined($node_conf->{acme})) {
 261         $res = eval {
 262             PVE::JSONSchema::parse_property_string($acmedesc, $node_conf->{acme})
 263         };
 264         if (my $err = $@) {
 265             return undef if $noerr;
 266             die $err;
 267         }
 268         my $standalone_domains = delete($res->{domains}) // '';
 269         $res->{domains} = {};
 270         for my $domain (split(";", $standalone_domains)) {
 271             $domain = lc($domain);
 272             die "duplicate domain '$domain' in ACME config properties\n"
 273                 if defined($res->{domains}->{$domain});
 274
 275             $res->{domains}->{$domain}->{plugin} = 'standalone';
 276             $res->{domains}->{$domain}->{_configkey} = 'acme';
 277         }
 278     }
 279
 280     $res->{account} //= 'default';
 281
 282     for my $index (0..$MAXDOMAINS) {
 283         my $domain_rec = $node_conf->{"acmedomain$index"};
 284         next if !defined($domain_rec);
 285
 286         my $parsed = eval {
 287             PVE::JSONSchema::parse_property_string($acme_domain_desc, $domain_rec)
 288         };
 289         if (my $err = $@) {
 290             return undef if $noerr;
 291             die $err;
 292         }
 293         my $domain = lc(delete $parsed->{domain});
 294         if (my $exists = $res->{domains}->{$domain}) {
 295             return undef if $noerr;
 296             die "duplicate domain '$domain' in ACME config properties"
 297                 ." 'acmedomain$index' and '$exists->{_configkey}'\n";
 298         }
 299         $parsed->{plugin} //= 'standalone';
 300
 301         my $plugin_id = $parsed->{plugin};
 302         if ($plugin_id ne 'standalone') {
 303             my $plugins = PVE::API2::ACMEPlugin::load_config();
 304             die "plugin '$plugin_id' for domain '$domain' not found!\n"
 305                 if !$plugins->{ids}->{$plugin_id};
 306         }
 307
 308         $parsed->{_configkey} = "acmedomain$index";
 309         $res->{domains}->{$domain} = $parsed;
 310     }
 311
 312     return $res;
 313 }
 314
 315 # expects that basic format verification was already done, this is more higher
 316 # level verification
 317 sub verify_conf {
 318     my ($node_conf) = @_;
 319
 320     # verify ACME domain uniqueness
 321     my $tmp = get_acme_conf($node_conf);
 322
 323     # TODO: what else?
 324
 325     return 1; # OK
 326 }
 327
 328 sub get_nodeconfig_schema {
 329     return $confdesc;
 330 }
 331
 332 1;