]>
git.proxmox.com Git - pve-cluster.git/blob - data/PVE/Cluster.pm
7 use Storable
qw(dclone);
10 use Digest
::HMAC_SHA1
;
26 use Data
::Dumper
; # fixme: remove
28 # x509 certificate utils
30 my $basedir = "/etc/pve";
31 my $authdir = "$basedir/priv";
32 my $lockdir = "/etc/pve/priv/lock";
34 my $authprivkeyfn = "$authdir/authkey.key";
35 my $authpubkeyfn = "$basedir/authkey.pub";
36 my $pveca_key_fn = "$authdir/pve-root-ca.key";
37 my $pveca_srl_fn = "$authdir/pve-root-ca.srl";
38 my $pveca_cert_fn = "$basedir/pve-root-ca.pem";
39 # this is just a secret accessable by the web browser
40 # and is used for CSRF prevention
41 my $pvewww_key_fn = "$basedir/pve-www.key";
44 my $ssh_rsa_id_priv = "/root/.ssh/id_rsa";
45 my $ssh_rsa_id = "/root/.ssh/id_rsa.pub";
46 my $ssh_host_rsa_id = "/etc/ssh/ssh_host_rsa_key.pub";
47 my $sshglobalknownhosts = "/etc/ssh/ssh_known_hosts";
48 my $sshknownhosts = "/etc/pve/priv/known_hosts";
49 my $sshauthkeys = "/etc/pve/priv/authorized_keys";
50 my $rootsshauthkeys = "/root/.ssh/authorized_keys";
55 'datacenter.cfg' => 1,
59 'priv/shadow.cfg' => 1,
64 # only write output if something fails
70 my $record_output = sub {
76 PVE
::Tools
::run_command
($cmd, outfunc
=> $record_output,
77 errfunc
=> $record_output);
88 sub check_cfs_quorum
{
91 # note: -w filename always return 1 for root, so wee need
92 # to use File::lstat here
93 my $st = File
::stat::lstat("$basedir/local");
94 my $quorate = ($st && (($st->mode & 0200) != 0));
96 die "cluster not ready - no quorum?\n" if !$quorate && !$noerr;
101 sub check_cfs_is_mounted
{
104 my $res = -l
"$basedir/local";
106 die "pve configuration filesystem not mounted\n"
115 check_cfs_is_mounted
();
117 my @required_dirs = (
120 "$basedir/nodes/$nodename",
121 "$basedir/nodes/$nodename/qemu-server",
122 "$basedir/nodes/$nodename/openvz",
123 "$basedir/nodes/$nodename/priv");
125 foreach my $dir (@required_dirs) {
127 mkdir($dir) || die "unable to create directory '$dir' - $!\n";
134 return if -f
"$authprivkeyfn";
136 check_cfs_is_mounted
();
138 mkdir $authdir || die "unable to create dir '$authdir' - $!\n";
140 my $cmd = "openssl genrsa -out '$authprivkeyfn' 2048";
141 run_silent_cmd
($cmd);
143 $cmd = "openssl rsa -in '$authprivkeyfn' -pubout -out '$authpubkeyfn'";
149 return if -f
$pveca_key_fn;
152 run_silent_cmd
(['openssl', 'genrsa', '-out', $pveca_key_fn, '2048']);
155 die "unable to generate pve ca key:\n$@" if $@;
160 if (-f
$pveca_key_fn && -f
$pveca_cert_fn) {
166 # we try to generate an unique 'subject' to avoid browser problems
167 # (reused serial numbers, ..)
168 my $nid = (split (/\s/, `md5sum '$pveca_key_fn'`))[0] || time();
171 run_silent_cmd
(['openssl', 'req', '-batch', '-days', '3650', '-new',
172 '-x509', '-nodes', '-key',
173 $pveca_key_fn, '-out', $pveca_cert_fn, '-subj',
174 "/CN=Proxmox Virtual Environment/OU=$nid/O=PVE Cluster Manager CA/"]);
177 die "generating pve root certificate failed:\n$@" if $@;
182 sub gen_pve_ssl_key
{
185 die "no node name specified" if !$nodename;
187 my $pvessl_key_fn = "$basedir/nodes/$nodename/pve-ssl.key";
189 return if -f
$pvessl_key_fn;
192 run_silent_cmd
(['openssl', 'genrsa', '-out', $pvessl_key_fn, '2048']);
195 die "unable to generate pve ssl key for node '$nodename':\n$@" if $@;
198 sub gen_pve_www_key
{
200 return if -f
$pvewww_key_fn;
203 run_silent_cmd
(['openssl', 'genrsa', '-out', $pvewww_key_fn, '2048']);
206 die "unable to generate pve www key:\n$@" if $@;
212 PVE
::Tools
::file_set_contents
($pveca_srl_fn, $serial);
215 sub gen_pve_ssl_cert
{
216 my ($force, $nodename, $ip) = @_;
218 die "no node name specified" if !$nodename;
219 die "no IP specified" if !$ip;
221 my $pvessl_cert_fn = "$basedir/nodes/$nodename/pve-ssl.pem";
223 return if !$force && -f
$pvessl_cert_fn;
225 my $names = "IP:127.0.0.1,DNS:localhost";
227 my $rc = PVE
::INotify
::read_file
('resolvconf');
231 my $fqdn = $nodename;
233 $names .= ",DNS:$nodename";
235 if ($rc && $rc->{search
}) {
236 $fqdn = $nodename . "." . $rc->{search
};
237 $names .= ",DNS:$fqdn";
240 my $sslconf = <<__EOD;
241 RANDFILE = /root/.rnd
246 distinguished_name = req_distinguished_name
247 req_extensions = v3_req
249 string_mask = nombstr
251 [ req_distinguished_name ]
252 organizationalUnitName = PVE Cluster Node
253 organizationName = Proxmox Virtual Environment
257 basicConstraints = CA:FALSE
259 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
260 subjectAltName = $names
263 my $cfgfn = "/tmp/pvesslconf-$$.tmp";
264 my $fh = IO
::File-
>new ($cfgfn, "w");
268 my $reqfn = "/tmp/pvecertreq-$$.tmp";
271 my $pvessl_key_fn = "$basedir/nodes/$nodename/pve-ssl.key";
273 run_silent_cmd
(['openssl', 'req', '-batch', '-new', '-config', $cfgfn,
274 '-key', $pvessl_key_fn, '-out', $reqfn]);
280 die "unable to generate pve certificate request:\n$err";
283 update_serial
("0000000000000000") if ! -f
$pveca_srl_fn;
286 run_silent_cmd
(['openssl', 'x509', '-req', '-in', $reqfn, '-days', '3650',
287 '-out', $pvessl_cert_fn, '-CAkey', $pveca_key_fn,
288 '-CA', $pveca_cert_fn, '-CAserial', $pveca_srl_fn,
289 '-extfile', $cfgfn]);
295 die "unable to generate pve ssl certificate:\n$err";
302 sub gen_pve_node_files
{
303 my ($nodename, $ip, $opt_force) = @_;
305 gen_local_dirs
($nodename);
309 # make sure we have a (cluster wide) secret
310 # for CSRFR prevention
313 # make sure we have a (per node) private key
314 gen_pve_ssl_key
($nodename);
316 # make sure we have a CA
317 my $force = gen_pveca_cert
();
319 $force = 1 if $opt_force;
321 gen_pve_ssl_cert
($force, $nodename, $ip);
324 my $vzdump_cron_dummy = <<__EOD;
325 # cluster wide vzdump cron schedule
326 # Atomatically generated file - do not edit
328 PATH="/usr/sbin:/usr/bin:/sbin:/bin"
332 sub gen_pve_vzdump_symlink
{
334 my $filename = "/etc/pve/vzdump.cron";
336 my $link_fn = "/etc/cron.d/vzdump";
338 if ((-f
$filename) && (! -l
$link_fn)) {
339 rename($link_fn, "/root/etc_cron_vzdump.org"); # make backup if file exists
340 symlink($filename, $link_fn);
344 sub gen_pve_vzdump_files
{
346 my $filename = "/etc/pve/vzdump.cron";
348 PVE
::Tools
::file_set_contents
($filename, $vzdump_cron_dummy)
351 gen_pve_vzdump_symlink
();
358 my $ipcc_send_rec = sub {
359 my ($msgid, $data) = @_;
361 my $res = PVE
::IPCC
::ipcc_send_rec
($msgid, $data);
363 die "ipcc_send_rec failed: $!\n" if !defined($res) && ($! != 0);
368 my $ipcc_send_rec_json = sub {
369 my ($msgid, $data) = @_;
371 my $res = PVE
::IPCC
::ipcc_send_rec
($msgid, $data);
373 die "ipcc_send_rec failed: $!\n" if !defined($res) && ($! != 0);
375 return decode_json
($res);
378 my $ipcc_get_config = sub {
381 my $bindata = pack "Z*", $path;
382 my $res = PVE
::IPCC
::ipcc_send_rec
(6, $bindata);
383 if (!defined($res)) {
384 return undef if ($! != 0);
391 my $ipcc_get_status = sub {
392 my ($name, $nodename) = @_;
394 my $bindata = pack "Z[256]Z[256]", $name, ($nodename || "");
395 return PVE
::IPCC
::ipcc_send_rec
(5, $bindata);
398 my $ipcc_update_status = sub {
399 my ($name, $data) = @_;
401 my $raw = ref($data) ? encode_json
($data) : $data;
403 my $bindata = pack "Z[256]Z*", $name, $raw;
405 return &$ipcc_send_rec(4, $bindata);
409 my ($priority, $ident, $tag, $msg) = @_;
411 my $bindata = pack "CCCZ*Z*Z*", $priority, bytes
::length($ident) + 1,
412 bytes
::length($tag) + 1, $ident, $tag, $msg;
414 return &$ipcc_send_rec(7, $bindata);
417 my $ipcc_get_cluster_log = sub {
418 my ($user, $max) = @_;
420 $max = 0 if !defined($max);
422 my $bindata = pack "VVVVZ*", $max, 0, 0, 0, ($user || "");
423 return &$ipcc_send_rec(8, $bindata);
430 my $res = &$ipcc_send_rec_json(1);
431 #warn "GOT1: " . Dumper($res);
432 die "no starttime\n" if !$res->{starttime
};
434 if (!$res->{starttime
} || !$versions->{starttime
} ||
435 $res->{starttime
} != $versions->{starttime
}) {
436 #print "detected changed starttime\n";
454 if (!$clinfo->{version
} || $clinfo->{version
} != $versions->{clinfo
}) {
455 #warn "detected new clinfo\n";
456 $clinfo = &$ipcc_send_rec_json(2);
466 if (!$vmlist->{version
} || $vmlist->{version
} != $versions->{vmlist
}) {
467 #warn "detected new vmlist1\n";
468 $vmlist = &$ipcc_send_rec_json(3);
487 return $clinfo->{nodelist
};
492 my $nodelist = $clinfo->{nodelist
};
496 my $nodename = PVE
::INotify
::nodename
();
498 if (!$nodelist || !$nodelist->{$nodename}) {
499 return [ $nodename ];
502 return [ keys %$nodelist ];
505 sub broadcast_tasklist
{
509 &$ipcc_update_status("tasklist", $data);
515 my $tasklistcache = {};
520 my $kvstore = $versions->{kvstore
} || {};
522 my $nodelist = get_nodelist
();
525 foreach my $node (@$nodelist) {
526 next if $nodename && ($nodename ne $node);
528 my $ver = $kvstore->{$node}->{tasklist
} if $kvstore->{$node};
529 my $cd = $tasklistcache->{$node};
530 if (!$cd || !$ver || ($cd->{version
} != $ver)) {
531 my $raw = &$ipcc_get_status("tasklist", $node) || '[]';
532 my $data = decode_json
($raw);
534 $cd = $tasklistcache->{$node} = {
538 } elsif ($cd && $cd->{data
}) {
539 push @$res, @{$cd->{data
}};
543 syslog
('err', $err) if $err;
550 my ($rrdid, $data) = @_;
553 &$ipcc_update_status("rrd/$rrdid", $data);
560 my $last_rrd_dump = 0;
561 my $last_rrd_data = "";
567 my $diff = $ctime - $last_rrd_dump;
569 return $last_rrd_data;
574 $raw = &$ipcc_send_rec(10);
585 while ($raw =~ s/^(.*)\n//) {
586 my ($key, @ela) = split(/:/, $1);
588 next if !(scalar(@ela) > 1);
589 $res->{$key} = \
@ela;
592 $last_rrd_dump = $ctime;
593 $last_rrd_data = $res;
598 sub create_rrd_data
{
599 my ($rrdname, $timeframe, $cf) = @_;
601 my $rrddir = "/var/lib/rrdcached/db";
603 my $rrd = "$rrddir/$rrdname";
607 day
=> [ 60*30, 70 ],
608 week
=> [ 60*180, 70 ],
609 month
=> [ 60*720, 70 ],
610 year
=> [ 60*10080, 70 ],
613 my ($reso, $count) = @{$setup->{$timeframe}};
614 my $ctime = $reso*int(time()/$reso);
615 my $req_start = $ctime - $reso*$count;
617 $cf = "AVERAGE" if !$cf;
625 my $socket = "/var/run/rrdcached.sock";
626 push @args, "--daemon" => "unix:$socket" if -S
$socket;
628 my ($start, $step, $names, $data) = RRDs
::fetch
($rrd, $cf, @args);
630 my $err = RRDs
::error
;
631 die "RRD error: $err\n" if $err;
633 die "got wrong time resolution ($step != $reso)\n"
637 my $fields = scalar(@$names);
638 for my $line (@$data) {
639 my $entry = { 'time' => $start };
642 for (my $i = 0; $i < $fields; $i++) {
643 my $name = $names->[$i];
644 if (defined(my $val = $line->[$i])) {
645 $entry->{$name} = $val;
647 # we only add entryies with all data defined
648 # extjs chart has problems with undefined values
652 push @$res, $entry if !$found_undefs;
658 sub create_rrd_graph
{
659 my ($rrdname, $timeframe, $ds, $cf) = @_;
661 # Using RRD graph is clumsy - maybe it
662 # is better to simply fetch the data, and do all display
663 # related things with javascript (new extjs html5 graph library).
665 my $rrddir = "/var/lib/rrdcached/db";
667 my $rrd = "$rrddir/$rrdname";
669 my $filename = "$rrd.png";
673 day
=> [ 60*30, 70 ],
674 week
=> [ 60*180, 70 ],
675 month
=> [ 60*720, 70 ],
676 year
=> [ 60*10080, 70 ],
679 my ($reso, $count) = @{$setup->{$timeframe}};
682 "--imgformat" => "PNG",
686 "--start" => - $reso*$count,
690 my $socket = "/var/run/rrdcached.sock";
691 push @args, "--daemon" => "unix:$socket" if -S
$socket;
693 my @ids = PVE
::Tools
::split_list
($ds);
695 my @coldef = ('#00ddff', '#ff0000');
697 $cf = "AVERAGE" if !$cf;
700 foreach my $id (@ids) {
701 my $col = $coldef[$i++] || die "fixme: no color definition";
702 push @args, "DEF:${id}=$rrd:${id}:$cf";
704 if ($id eq 'cpu' || $id eq 'iowait') {
705 push @args, "CDEF:${id}_per=${id},100,*";
706 $dataid = "${id}_per";
708 push @args, "LINE2:${dataid}${col}:${id}";
711 RRDs
::graph
($filename, @args);
713 my $err = RRDs
::error
;
714 die "RRD error: $err\n" if $err;
716 return { filename
=> $filename };
719 # a fast way to read files (avoid fuse overhead)
723 return &$ipcc_get_config($path);
726 sub get_cluster_log
{
727 my ($user, $max) = @_;
729 return &$ipcc_get_cluster_log($user, $max);
734 sub cfs_register_file
{
735 my ($filename, $parser, $writer) = @_;
737 $observed->{$filename} || die "unknown file '$filename'";
739 die "file '$filename' already registered" if $file_info->{$filename};
741 $file_info->{$filename} = {
747 my $ccache_read = sub {
748 my ($filename, $parser, $version) = @_;
750 $ccache->{$filename} = {} if !$ccache->{$filename};
752 my $ci = $ccache->{$filename};
754 if (!$ci->{version
} || !$version || $ci->{version
} != $version) {
755 # we always call the parser, even when the file does not exists
756 # (in that case $data is undef)
757 my $data = get_config
($filename);
758 $ci->{data
} = &$parser("/etc/pve/$filename", $data);
759 $ci->{version
} = $version;
762 my $res = ref($ci->{data
}) ? dclone
($ci->{data
}) : $ci->{data
};
767 sub cfs_file_version
{
772 if ($filename =~ m!^nodes/[^/]+/(openvz|qemu-server)/(\d+)\.conf$!) {
773 my ($type, $vmid) = ($1, $2);
774 if ($vmlist && $vmlist->{ids
} && $vmlist->{ids
}->{$vmid}) {
775 $version = $vmlist->{ids
}->{$vmid}->{version
};
777 $infotag = "/$type/";
779 $infotag = $filename;
780 $version = $versions->{$filename};
783 my $info = $file_info->{$infotag} ||
784 die "unknown file type '$filename'\n";
786 return wantarray ?
($version, $info) : $version;
792 my ($version, $info) = cfs_file_version
($filename);
793 my $parser = $info->{parser
};
795 return &$ccache_read($filename, $parser, $version);
799 my ($filename, $data) = @_;
801 my $info = $file_info->{$filename} || die "unknown file '$filename'";
803 my $writer = $info->{writer
} || die "no writer defined";
805 my $fsname = "/etc/pve/$filename";
807 my $raw = &$writer($fsname, $data);
809 if (my $ci = $ccache->{$filename}) {
810 $ci->{version
} = undef;
813 PVE
::Tools
::file_set_contents
($fsname, $raw);
817 my ($lockid, $timeout, $code, @param) = @_;
821 # this timeout is for aquire the lock
822 $timeout = 10 if !$timeout;
824 my $filename = "$lockdir/$lockid";
826 my $msg = "can't aquire cfs lock '$lockid'";
833 die "$msg: pve cluster filesystem not online.\n";
836 local $SIG{ALRM
} = sub { die "got lock request timeout\n"; };
840 if (!(mkdir $filename)) {
841 print STDERR
"trying to aquire cfs lock '$lockid' ...";
843 if (!(mkdir $filename)) {
844 (utime 0, 0, $filename); # cfs unlock request
846 print STDERR
" OK\n";
853 # fixed command timeout: cfs locks have a timeout of 120
854 # using 60 gives us another 60 seconds to abort the task
856 local $SIG{ALRM
} = sub { die "got lock timeout - aborting command\n"; };
858 $res = &$code(@param);
867 if ($err && ($err eq "got lock request timeout\n") &&
868 !check_cfs_quorum
()){
869 $err = "$msg: no quorum!\n";
872 if (!$err || $err !~ /^got lock timeout -/) {
873 rmdir $filename; # cfs unlock
887 my ($filename, $timeout, $code, @param) = @_;
889 my $info = $observed->{$filename} || die "unknown file '$filename'";
891 my $lockid = "file-$filename";
892 $lockid =~ s/[.\/]/_
/g
;
894 &$cfs_lock($lockid, $timeout, $code, @param);
897 sub cfs_lock_storage
{
898 my ($storeid, $timeout, $code, @param) = @_;
900 my $lockid = "storage-$storeid";
902 &$cfs_lock($lockid, $timeout, $code, @param);
920 my ($priority, $ident, $msg) = @_;
922 if (my $tmp = $log_levels->{$priority}) {
926 die "need numeric log priority" if $priority !~ /^\d+$/;
928 my $tag = PVE
::SafeSyslog
::tag
();
930 $msg = "empty message" if !$msg;
932 $ident = "" if !$ident;
933 $ident = encode
("ascii", decode_utf8
($ident),
934 sub { sprintf "\\u%04x", shift });
936 my $utf8 = decode_utf8
($msg);
938 my $ascii = encode
("ascii", $utf8, sub { sprintf "\\u%04x", shift });
941 syslog
($priority, "<%s> %s", $ident, $ascii);
943 syslog
($priority, "%s", $ascii);
946 eval { &$ipcc_log($priority, $ident, $tag, $ascii); };
948 syslog
("err", "writing cluster log failed: $@") if $@;
951 sub check_node_exists
{
952 my ($nodename, $noerr) = @_;
954 my $nodelist = $clinfo->{nodelist
};
955 return 1 if $nodelist && $nodelist->{$nodename};
957 return undef if $noerr;
959 die "no such cluster node '$nodename'\n";
962 # this is also used to get the IP of the local node
964 my ($nodename, $noerr) = @_;
966 my $nodelist = $clinfo->{nodelist
};
967 if ($nodelist && $nodelist->{$nodename}) {
968 if (my $ip = $nodelist->{$nodename}->{ip
}) {
973 # fallback: try to get IP by other means
974 my $packed_ip = gethostbyname($nodename);
975 if (defined $packed_ip) {
976 my $ip = inet_ntoa
($packed_ip);
978 if ($ip =~ m/^127\./) {
979 die "hostname lookup failed - got local IP address ($nodename = $ip)\n" if !$noerr;
986 die "unable to get IP for node '$nodename' - node offline?\n" if !$noerr;
991 # ssh related utility functions
994 # remove duplicate keys in $sshauthkeys
995 # ssh-copy-id simply add keys, so the file can grow to large
998 if (-f
$sshauthkeys) {
999 $data = PVE
::Tools
::file_get_contents
($sshauthkeys, 128*1024);
1003 # always add ourself
1004 if (-f
$ssh_rsa_id) {
1005 my $pub = PVE
::Tools
::file_get_contents
($ssh_rsa_id);
1007 $data .= "\n$pub\n";
1012 while ($data && $data =~ s/^((.*?)(\n|$))//) {
1014 if ($line =~ m/^ssh-rsa\s+\S+\s+(\S+)$/) {
1015 $vhash->{$1} = $line;
1021 $newdata .= join("", values(%$vhash));
1023 PVE
::Tools
::file_set_contents
($sshauthkeys, $newdata, 0600);
1026 sub setup_ssh_keys
{
1028 # create ssh key if it does not exist
1029 if (! -f
$ssh_rsa_id) {
1030 mkdir '/root/.ssh/';
1031 system ("echo|ssh-keygen -t rsa -N '' -b 2048 -f ${ssh_rsa_id_priv}");
1036 if (! -f
$sshauthkeys) {
1037 if (my $fh = IO
::File-
>new ($sshauthkeys, O_CREAT
|O_WRONLY
|O_EXCL
, 0400)) {
1042 warn "can't create shared ssh key database '$sshauthkeys'\n"
1043 if ! -f
$sshauthkeys;
1045 if (-f
$rootsshauthkeys) {
1046 system("mv '$rootsshauthkeys' '$rootsshauthkeys.org'");
1049 if (! -l
$rootsshauthkeys) {
1050 symlink $sshauthkeys, $rootsshauthkeys;
1052 warn "can't create symlink for ssh keys '$rootsshauthkeys' -> '$sshauthkeys'\n"
1053 if ! -l
$rootsshauthkeys;
1057 sub ssh_unmerge_known_hosts
{
1058 return if ! -l
$sshglobalknownhosts;
1061 $old = PVE
::Tools
::file_get_contents
($sshknownhosts, 128*1024)
1062 if -f
$sshknownhosts;
1064 PVE
::Tools
::file_set_contents
($sshglobalknownhosts, $old);
1067 sub ssh_merge_known_hosts
{
1068 my ($nodename, $ip_address, $createLink) = @_;
1070 die "no node name specified" if !$nodename;
1071 die "no ip address specified" if !$ip_address;
1075 if (! -f
$sshknownhosts) {
1076 if (my $fh = IO
::File-
>new($sshknownhosts, O_CREAT
|O_WRONLY
|O_EXCL
, 0600)) {
1081 my $old = PVE
::Tools
::file_get_contents
($sshknownhosts, 128*1024);
1085 if ((! -l
$sshglobalknownhosts) && (-f
$sshglobalknownhosts)) {
1086 $new = PVE
::Tools
::file_get_contents
($sshglobalknownhosts, 128*1024);
1089 my $hostkey = PVE
::Tools
::file_get_contents
($ssh_host_rsa_id);
1090 die "can't parse $ssh_rsa_id" if $hostkey !~ m/^(ssh-rsa\s\S+)(\s.*)?$/;
1099 my $merge_line = sub {
1100 my ($line, $all) = @_;
1102 if ($line =~ m/^(\S+)\s(ssh-rsa\s\S+)(\s.*)?$/) {
1105 if (!$vhash->{$key}) {
1107 if ($key =~ m/\|1\|([^\|\s]+)\|([^\|\s]+)$/) {
1108 my $salt = decode_base64
($1);
1110 my $hmac = Digest
::HMAC_SHA1-
>new($salt);
1111 $hmac->add($nodename);
1112 my $hd = $hmac->b64digest . '=';
1113 if ($digest eq $hd) {
1114 if ($rsakey eq $hostkey) {
1115 $found_nodename = 1;
1120 $hmac = Digest
::HMAC_SHA1-
>new($salt);
1121 $hmac->add($ip_address);
1122 $hd = $hmac->b64digest . '=';
1123 if ($digest eq $hd) {
1124 if ($rsakey eq $hostkey) {
1125 $found_local_ip = 1;
1138 while ($old && $old =~ s/^((.*?)(\n|$))//) {
1140 next if $line =~ m/^\s*$/; # skip empty lines
1141 next if $line =~ m/^#/; # skip comments
1142 &$merge_line($line, 1);
1145 while ($new && $new =~ s/^((.*?)(\n|$))//) {
1147 next if $line =~ m/^\s*$/; # skip empty lines
1148 next if $line =~ m/^#/; # skip comments
1149 &$merge_line($line);
1153 my $add_known_hosts_entry = sub {
1154 my ($name, $hostkey) = @_;
1156 my $hmac = Digest
::HMAC_SHA1-
>new("$addIndex" . time());
1157 my $b64salt = $hmac->b64digest . '=';
1158 $hmac = Digest
::HMAC_SHA1-
>new(decode_base64
($b64salt));
1160 my $digest = $hmac->b64digest . '=';
1161 $data .= "|1|$b64salt|$digest $hostkey\n";
1164 if (!$found_nodename || !$found_local_ip) {
1165 &$add_known_hosts_entry($nodename, $hostkey) if !$found_nodename;
1166 &$add_known_hosts_entry($ip_address, $hostkey) if !$found_local_ip;
1169 PVE
::Tools
::file_set_contents
($sshknownhosts, $data);
1171 return if !$createLink;
1173 unlink $sshglobalknownhosts;
1174 symlink $sshknownhosts, $sshglobalknownhosts;
1176 warn "can't create symlink for ssh known hosts '$sshglobalknownhosts' -> '$sshknownhosts'\n"
1177 if ! -l
$sshglobalknownhosts;
1181 my $keymaphash = PVE
::Tools
::kvmkeymaps
();
1182 my $datacenter_schema = {
1184 additionalProperties
=> 0,
1189 description
=> "Default keybord layout for vnc server.",
1190 enum
=> [ keys %$keymaphash ],
1195 description
=> "Default GUI language.",
1196 enum
=> [ 'en', 'de' ],
1201 description
=> "Specify external http proxy which is used for downloads (example: 'http://username:password\@host:port/')",
1202 pattern
=> "http://.*",
1207 # make schema accessible from outside (for documentation)
1208 sub get_datacenter_schema
{ return $datacenter_schema };
1210 sub parse_datacenter_config
{
1211 my ($filename, $raw) = @_;
1213 return PVE
::JSONSchema
::parse_config
($datacenter_schema, $filename, $raw);
1216 sub write_datacenter_config
{
1217 my ($filename, $cfg) = @_;
1219 return PVE
::JSONSchema
::dump_config
($datacenter_schema, $filename, $cfg);
1222 cfs_register_file
('datacenter.cfg',
1223 \
&parse_datacenter_config
,
1224 \
&write_datacenter_config
);