src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::GuestHelpers;
   9 use PVE::INotify;
  10 use PVE::JSONSchema qw(get_standard_option);
  11 use PVE::Tools;
  12
  13 use base qw(PVE::AbstractConfig);
  14
  15 my $nodename = PVE::INotify::nodename();
  16 my $lock_handles =  {};
  17 my $lockdir = "/run/lock/lxc";
  18 mkdir $lockdir;
  19 mkdir "/etc/pve/nodes/$nodename/lxc";
  20 my $MAX_MOUNT_POINTS = 256;
  21 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  22
  23 # BEGIN implemented abstract methods from PVE::AbstractConfig
  24
  25 sub guest_type {
  26     return "CT";
  27 }
  28
  29 sub __config_max_unused_disks {
  30     my ($class) = @_;
  31
  32     return $MAX_UNUSED_DISKS;
  33 }
  34
  35 sub config_file_lock {
  36     my ($class, $vmid) = @_;
  37
  38     return "$lockdir/pve-config-${vmid}.lock";
  39 }
  40
  41 sub cfs_config_path {
  42     my ($class, $vmid, $node) = @_;
  43
  44     $node = $nodename if !$node;
  45     return "nodes/$node/lxc/$vmid.conf";
  46 }
  47
  48 sub mountpoint_backup_enabled {
  49     my ($class, $mp_key, $mountpoint) = @_;
  50
  51     return 1 if $mp_key eq 'rootfs';
  52
  53     return 0 if $mountpoint->{type} ne 'volume';
  54
  55     return 1 if $mountpoint->{backup};
  56
  57     return 0;
  58 }
  59
  60 sub has_feature {
  61     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  62     my $err;
  63
  64     $class->foreach_mountpoint($conf, sub {
  65         my ($ms, $mountpoint) = @_;
  66
  67         return if $err; # skip further test
  68         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  69
  70         $err = 1
  71             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  72                                                  $mountpoint->{volume},
  73                                                  $snapname, $running);
  74     });
  75
  76     return $err ? 0 : 1;
  77 }
  78
  79 sub __snapshot_save_vmstate {
  80     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  81     die "implement me - snapshot_save_vmstate\n";
  82 }
  83
  84 sub __snapshot_check_running {
  85     my ($class, $vmid) = @_;
  86     return PVE::LXC::check_running($vmid);
  87 }
  88
  89 sub __snapshot_check_freeze_needed {
  90     my ($class, $vmid, $config, $save_vmstate) = @_;
  91
  92     my $ret = $class->__snapshot_check_running($vmid);
  93     return ($ret, $ret);
  94 }
  95
  96 sub __snapshot_freeze {
  97     my ($class, $vmid, $unfreeze) = @_;
  98
  99     if ($unfreeze) {
 100         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 101         warn $@ if $@;
 102     } else {
 103         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 104         PVE::LXC::sync_container_namespace($vmid);
 105     }
 106 }
 107
 108 sub __snapshot_create_vol_snapshot {
 109     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 110
 111     my $storecfg = PVE::Storage::config();
 112
 113     return if $snapname eq 'vzdump' &&
 114         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 115
 116     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 117 }
 118
 119 sub __snapshot_delete_remove_drive {
 120     my ($class, $snap, $remove_drive) = @_;
 121
 122     if ($remove_drive eq 'vmstate') {
 123         die "implement me - saving vmstate\n";
 124     } else {
 125         my $value = $snap->{$remove_drive};
 126         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 127         delete $snap->{$remove_drive};
 128
 129         $class->add_unused_volume($snap, $mountpoint->{volume})
 130             if ($mountpoint->{type} eq 'volume');
 131     }
 132 }
 133
 134 sub __snapshot_delete_vmstate_file {
 135     my ($class, $snap, $force) = @_;
 136
 137     die "implement me - saving vmstate\n";
 138 }
 139
 140 sub __snapshot_delete_vol_snapshot {
 141     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 142
 143     return if $snapname eq 'vzdump' &&
 144         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 145
 146     my $storecfg = PVE::Storage::config();
 147     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 148     push @$unused, $mountpoint->{volume};
 149 }
 150
 151 sub __snapshot_rollback_vol_possible {
 152     my ($class, $mountpoint, $snapname) = @_;
 153
 154     my $storecfg = PVE::Storage::config();
 155     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 156 }
 157
 158 sub __snapshot_rollback_vol_rollback {
 159     my ($class, $mountpoint, $snapname) = @_;
 160
 161     my $storecfg = PVE::Storage::config();
 162     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 163 }
 164
 165 sub __snapshot_rollback_vm_stop {
 166     my ($class, $vmid) = @_;
 167
 168     PVE::LXC::vm_stop($vmid, 1)
 169         if $class->__snapshot_check_running($vmid);
 170 }
 171
 172 sub __snapshot_rollback_vm_start {
 173     my ($class, $vmid, $vmstate, $data);
 174
 175     die "implement me - save vmstate\n";
 176 }
 177
 178 sub __snapshot_rollback_get_unused {
 179     my ($class, $conf, $snap) = @_;
 180
 181     my $unused = [];
 182
 183     $class->__snapshot_foreach_volume($conf, sub {
 184         my ($vs, $volume) = @_;
 185
 186         return if $volume->{type} ne 'volume';
 187
 188         my $found = 0;
 189         my $volid = $volume->{volume};
 190
 191         $class->__snapshot_foreach_volume($snap, sub {
 192             my ($ms, $mountpoint) = @_;
 193
 194             return if $found;
 195             return if ($mountpoint->{type} ne 'volume');
 196
 197             $found = 1
 198                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 199         });
 200
 201         push @$unused, $volid if !$found;
 202     });
 203
 204     return $unused;
 205 }
 206
 207 sub __snapshot_foreach_volume {
 208     my ($class, $conf, $func) = @_;
 209
 210     $class->foreach_mountpoint($conf, $func);
 211 }
 212
 213 # END implemented abstract methods from PVE::AbstractConfig
 214
 215 # BEGIN JSON config code
 216
 217 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 218
 219
 220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
 221
 222 sub is_valid_mount_option {
 223     my ($option) = @_;
 224     return $option =~ $valid_mount_option_re;
 225 }
 226
 227 my $rootfs_desc = {
 228     volume => {
 229         type => 'string',
 230         default_key => 1,
 231         format => 'pve-lxc-mp-string',
 232         format_description => 'volume',
 233         description => 'Volume, device or directory to mount into the container.',
 234     },
 235     size => {
 236         type => 'string',
 237         format => 'disk-size',
 238         format_description => 'DiskSize',
 239         description => 'Volume size (read only value).',
 240         optional => 1,
 241     },
 242     acl => {
 243         type => 'boolean',
 244         description => 'Explicitly enable or disable ACL support.',
 245         optional => 1,
 246     },
 247     mountoptions => {
 248         optional => 1,
 249         type => 'string',
 250         description => 'Extra mount options for rootfs/mps.',
 251         format_description => 'opt[;opt...]',
 252         pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
 253     },
 254     ro => {
 255         type => 'boolean',
 256         description => 'Read-only mount point',
 257         optional => 1,
 258     },
 259     quota => {
 260         type => 'boolean',
 261         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 262         optional => 1,
 263     },
 264     replicate => {
 265         type => 'boolean',
 266         description => 'Will include this volume to a storage replica job.',
 267         optional => 1,
 268         default => 1,
 269     },
 270     shared => {
 271         type => 'boolean',
 272         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 273         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 274         optional => 1,
 275         default => 0,
 276     },
 277 };
 278
 279 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 280     type => 'string', format => $rootfs_desc,
 281     description => "Use volume as container root.",
 282     optional => 1,
 283 });
 284
 285 my $features_desc = {
 286     mount => {
 287         optional => 1,
 288         type => 'string',
 289         description => "Allow mounting file systems of specific types."
 290             ." This should be a list of file system types as used with the mount command."
 291             ." Note that this can have negative effects on the container's security."
 292             ." With access to a loop device, mounting a file can circumvent the mknod"
 293             ." permission of the devices cgroup, mounting an NFS file system can"
 294             ." block the host's I/O completely and prevent it from rebooting, etc.",
 295         format_description => 'fstype;fstype;...',
 296         pattern => qr/[a-zA-Z0-9_; ]+/,
 297     },
 298     nesting => {
 299         optional => 1,
 300         type => 'boolean',
 301         default => 0,
 302         description => "Allow nesting."
 303             ." Best used with unprivileged containers with additional id mapping."
 304             ." Note that this will expose procfs and sysfs contents of the host"
 305             ." to the guest.",
 306     },
 307     keyctl => {
 308         optional => 1,
 309         type => 'boolean',
 310         default => 0,
 311         description => "For unprivileged containers only: Allow the use of the keyctl() system call."
 312             ." This is required to use docker inside a container."
 313             ." By default unprivileged containers will see this system call as non-existent."
 314             ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
 315             ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
 316             ." Essentially, you can choose between running systemd-networkd or docker.",
 317     },
 318     fuse => {
 319         optional => 1,
 320         type => 'boolean',
 321         default => 0,
 322         description => "Allow using 'fuse' file systems in a container."
 323             ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
 324     },
 325 };
 326
 327 my $confdesc = {
 328     lock => {
 329         optional => 1,
 330         type => 'string',
 331         description => "Lock/unlock the VM.",
 332         enum => [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
 333     },
 334     onboot => {
 335         optional => 1,
 336         type => 'boolean',
 337         description => "Specifies whether a VM will be started during system bootup.",
 338         default => 0,
 339     },
 340     startup => get_standard_option('pve-startup-order'),
 341     template => {
 342         optional => 1,
 343         type => 'boolean',
 344         description => "Enable/disable Template.",
 345         default => 0,
 346     },
 347     arch => {
 348         optional => 1,
 349         type => 'string',
 350         enum => ['amd64', 'i386', 'arm64', 'armhf'],
 351         description => "OS architecture type.",
 352         default => 'amd64',
 353     },
 354     ostype => {
 355         optional => 1,
 356         type => 'string',
 357         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 358         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 359     },
 360     console => {
 361         optional => 1,
 362         type => 'boolean',
 363         description => "Attach a console device (/dev/console) to the container.",
 364         default => 1,
 365     },
 366     tty => {
 367         optional => 1,
 368         type => 'integer',
 369         description => "Specify the number of tty available to the container",
 370         minimum => 0,
 371         maximum => 6,
 372         default => 2,
 373     },
 374     cores => {
 375         optional => 1,
 376         type => 'integer',
 377         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 378         minimum => 1,
 379         maximum => 128,
 380     },
 381     cpulimit => {
 382         optional => 1,
 383         type => 'number',
 384         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 385         minimum => 0,
 386         maximum => 128,
 387         default => 0,
 388     },
 389     cpuunits => {
 390         optional => 1,
 391         type => 'integer',
 392         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 393         minimum => 0,
 394         maximum => 500000,
 395         default => 1024,
 396     },
 397     memory => {
 398         optional => 1,
 399         type => 'integer',
 400         description => "Amount of RAM for the VM in MB.",
 401         minimum => 16,
 402         default => 512,
 403     },
 404     swap => {
 405         optional => 1,
 406         type => 'integer',
 407         description => "Amount of SWAP for the VM in MB.",
 408         minimum => 0,
 409         default => 512,
 410     },
 411     hostname => {
 412         optional => 1,
 413         description => "Set a host name for the container.",
 414         type => 'string', format => 'dns-name',
 415         maxLength => 255,
 416     },
 417     description => {
 418         optional => 1,
 419         type => 'string',
 420         description => "Container description. Only used on the configuration web interface.",
 421     },
 422     searchdomain => {
 423         optional => 1,
 424         type => 'string', format => 'dns-name-list',
 425         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 426     },
 427     nameserver => {
 428         optional => 1,
 429         type => 'string', format => 'address-list',
 430         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 431     },
 432     rootfs => get_standard_option('pve-ct-rootfs'),
 433     parent => {
 434         optional => 1,
 435         type => 'string', format => 'pve-configid',
 436         maxLength => 40,
 437         description => "Parent snapshot name. This is used internally, and should not be modified.",
 438     },
 439     snaptime => {
 440         optional => 1,
 441         description => "Timestamp for snapshots.",
 442         type => 'integer',
 443         minimum => 0,
 444     },
 445     cmode => {
 446         optional => 1,
 447         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 448         type => 'string',
 449         enum => ['shell', 'console', 'tty'],
 450         default => 'tty',
 451     },
 452     protection => {
 453         optional => 1,
 454         type => 'boolean',
 455         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 456         default => 0,
 457     },
 458     unprivileged => {
 459         optional => 1,
 460         type => 'boolean',
 461         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 462         default => 0,
 463     },
 464     features => {
 465         optional => 1,
 466         type => 'string',
 467         format => $features_desc,
 468         description => "Allow containers access to advanced features.",
 469     },
 470     hookscript => {
 471         optional => 1,
 472         type => 'string',
 473         format => 'pve-volume-id',
 474         description => 'Script that will be exectued during various steps in the containers lifetime.',
 475     },
 476 };
 477
 478 my $valid_lxc_conf_keys = {
 479     'lxc.apparmor.profile' => 1,
 480     'lxc.apparmor.allow_incomplete' => 1,
 481     'lxc.apparmor.allow_nesting' => 1,
 482     'lxc.apparmor.raw' => 1,
 483     'lxc.selinux.context' => 1,
 484     'lxc.include' => 1,
 485     'lxc.arch' => 1,
 486     'lxc.uts.name' => 1,
 487     'lxc.signal.halt' => 1,
 488     'lxc.signal.reboot' => 1,
 489     'lxc.signal.stop' => 1,
 490     'lxc.init.cmd' => 1,
 491     'lxc.pty.max' => 1,
 492     'lxc.console.logfile' => 1,
 493     'lxc.console.path' => 1,
 494     'lxc.tty.max' => 1,
 495     'lxc.devtty.dir' => 1,
 496     'lxc.hook.autodev' => 1,
 497     'lxc.autodev' => 1,
 498     'lxc.kmsg' => 1,
 499     'lxc.mount.fstab' => 1,
 500     'lxc.mount.entry' => 1,
 501     'lxc.mount.auto' => 1,
 502     'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
 503     'lxc.rootfs.mount' => 1,
 504     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 505                             ', please use mount point options in the "rootfs" key',
 506     # lxc.cgroup.*
 507     # lxc.prlimit.*
 508     # lxc.net.*
 509     'lxc.cap.drop' => 1,
 510     'lxc.cap.keep' => 1,
 511     'lxc.seccomp.profile' => 1,
 512     'lxc.seccomp.notify.proxy' => 1,
 513     'lxc.seccomp.notify.cookie' => 1,
 514     'lxc.idmap' => 1,
 515     'lxc.hook.pre-start' => 1,
 516     'lxc.hook.pre-mount' => 1,
 517     'lxc.hook.mount' => 1,
 518     'lxc.hook.start' => 1,
 519     'lxc.hook.stop' => 1,
 520     'lxc.hook.post-stop' => 1,
 521     'lxc.hook.clone' => 1,
 522     'lxc.hook.destroy' => 1,
 523     'lxc.hook.version' => 1,
 524     'lxc.log.level' => 1,
 525     'lxc.log.file' => 1,
 526     'lxc.start.auto' => 1,
 527     'lxc.start.delay' => 1,
 528     'lxc.start.order' => 1,
 529     'lxc.group' => 1,
 530     'lxc.environment' => 1,
 531
 532     # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
 533     'lxc.sysctl.fs.mqueue' => 1,
 534     'lxc.sysctl.kernel.msgmax' => 1,
 535     'lxc.sysctl.kernel.msgmnb' => 1,
 536     'lxc.sysctl.kernel.msgmni' => 1,
 537     'lxc.sysctl.kernel.sem' => 1,
 538     'lxc.sysctl.kernel.shmall' => 1,
 539     'lxc.sysctl.kernel.shmmax' => 1,
 540     'lxc.sysctl.kernel.shmmni' => 1,
 541     'lxc.sysctl.kernel.shm_rmid_forced' => 1,
 542 };
 543
 544 my $deprecated_lxc_conf_keys = {
 545     # Deprecated (removed with lxc 3.0):
 546     'lxc.aa_profile'           => 'lxc.apparmor.profile',
 547     'lxc.aa_allow_incomplete'  => 'lxc.apparmor.allow_incomplete',
 548     'lxc.console'              => 'lxc.console.path',
 549     'lxc.devttydir'            => 'lxc.tty.dir',
 550     'lxc.haltsignal'           => 'lxc.signal.halt',
 551     'lxc.rebootsignal'         => 'lxc.signal.reboot',
 552     'lxc.stopsignal'           => 'lxc.signal.stop',
 553     'lxc.id_map'               => 'lxc.idmap',
 554     'lxc.init_cmd'             => 'lxc.init.cmd',
 555     'lxc.loglevel'             => 'lxc.log.level',
 556     'lxc.logfile'              => 'lxc.log.file',
 557     'lxc.mount'                => 'lxc.mount.fstab',
 558     'lxc.network.type'         => 'lxc.net.INDEX.type',
 559     'lxc.network.flags'        => 'lxc.net.INDEX.flags',
 560     'lxc.network.link'         => 'lxc.net.INDEX.link',
 561     'lxc.network.mtu'          => 'lxc.net.INDEX.mtu',
 562     'lxc.network.name'         => 'lxc.net.INDEX.name',
 563     'lxc.network.hwaddr'       => 'lxc.net.INDEX.hwaddr',
 564     'lxc.network.ipv4'         => 'lxc.net.INDEX.ipv4.address',
 565     'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
 566     'lxc.network.ipv6'         => 'lxc.net.INDEX.ipv6.address',
 567     'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
 568     'lxc.network.script.up'    => 'lxc.net.INDEX.script.up',
 569     'lxc.network.script.down'  => 'lxc.net.INDEX.script.down',
 570     'lxc.pts'                  => 'lxc.pty.max',
 571     'lxc.se_context'           => 'lxc.selinux.context',
 572     'lxc.seccomp'              => 'lxc.seccomp.profile',
 573     'lxc.tty'                  => 'lxc.tty.max',
 574     'lxc.utsname'              => 'lxc.uts.name',
 575 };
 576
 577 sub is_valid_lxc_conf_key {
 578     my ($vmid, $key) = @_;
 579     if ($key =~ /^lxc\.limit\./) {
 580         warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
 581         return 1;
 582     }
 583     if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
 584         warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
 585         return 1;
 586     }
 587     my $validity = $valid_lxc_conf_keys->{$key};
 588     return $validity if defined($validity);
 589     return 1 if $key =~ /^lxc\.cgroup\./  # allow all cgroup values
 590              || $key =~ /^lxc\.prlimit\./ # allow all prlimits
 591              || $key =~ /^lxc\.net\./;    # allow custom network definitions
 592     return 0;
 593 }
 594
 595 our $netconf_desc = {
 596     type => {
 597         type => 'string',
 598         optional => 1,
 599         description => "Network interface type.",
 600         enum => [qw(veth)],
 601     },
 602     name => {
 603         type => 'string',
 604         format_description => 'string',
 605         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 606         pattern => '[-_.\w\d]+',
 607     },
 608     bridge => {
 609         type => 'string',
 610         format_description => 'bridge',
 611         description => 'Bridge to attach the network device to.',
 612         pattern => '[-_.\w\d]+',
 613         optional => 1,
 614     },
 615     hwaddr => get_standard_option('mac-addr', {
 616         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 617         }),
 618     mtu => {
 619         type => 'integer',
 620         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 621         minimum => 64, # minimum ethernet frame is 64 bytes
 622         optional => 1,
 623     },
 624     ip => {
 625         type => 'string',
 626         format => 'pve-ipv4-config',
 627         format_description => '(IPv4/CIDR|dhcp|manual)',
 628         description => 'IPv4 address in CIDR format.',
 629         optional => 1,
 630     },
 631     gw => {
 632         type => 'string',
 633         format => 'ipv4',
 634         format_description => 'GatewayIPv4',
 635         description => 'Default gateway for IPv4 traffic.',
 636         optional => 1,
 637     },
 638     ip6 => {
 639         type => 'string',
 640         format => 'pve-ipv6-config',
 641         format_description => '(IPv6/CIDR|auto|dhcp|manual)',
 642         description => 'IPv6 address in CIDR format.',
 643         optional => 1,
 644     },
 645     gw6 => {
 646         type => 'string',
 647         format => 'ipv6',
 648         format_description => 'GatewayIPv6',
 649         description => 'Default gateway for IPv6 traffic.',
 650         optional => 1,
 651     },
 652     firewall => {
 653         type => 'boolean',
 654         description => "Controls whether this interface's firewall rules should be used.",
 655         optional => 1,
 656     },
 657     tag => {
 658         type => 'integer',
 659         minimum => 1,
 660         maximum => 4094,
 661         description => "VLAN tag for this interface.",
 662         optional => 1,
 663     },
 664     trunks => {
 665         type => 'string',
 666         pattern => qr/\d+(?:;\d+)*/,
 667         format_description => 'vlanid[;vlanid...]',
 668         description => "VLAN ids to pass through the interface",
 669         optional => 1,
 670     },
 671     rate => {
 672         type => 'number',
 673         format_description => 'mbps',
 674         description => "Apply rate limiting to the interface",
 675         optional => 1,
 676     },
 677 };
 678 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 679
 680 my $MAX_LXC_NETWORKS = 10;
 681 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 682     $confdesc->{"net$i"} = {
 683         optional => 1,
 684         type => 'string', format => $netconf_desc,
 685         description => "Specifies network interfaces for the container.",
 686     };
 687 }
 688
 689 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 690 sub verify_lxc_mp_string {
 691     my ($mp, $noerr) = @_;
 692
 693     # do not allow:
 694     # /./ or /../
 695     # /. or /.. at the end
 696     # ../ at the beginning
 697
 698     if($mp =~ m@/\.\.?/@ ||
 699        $mp =~ m@/\.\.?$@ ||
 700        $mp =~ m@^\.\./@) {
 701         return undef if $noerr;
 702         die "$mp contains illegal character sequences\n";
 703     }
 704     return $mp;
 705 }
 706
 707 my $mp_desc = {
 708     %$rootfs_desc,
 709     backup => {
 710         type => 'boolean',
 711         description => 'Whether to include the mount point in backups.',
 712         verbose_description => 'Whether to include the mount point in backups '.
 713                                '(only used for volume mount points).',
 714         optional => 1,
 715     },
 716     mp => {
 717         type => 'string',
 718         format => 'pve-lxc-mp-string',
 719         format_description => 'Path',
 720         description => 'Path to the mount point as seen from inside the container '.
 721                        '(must not contain symlinks).',
 722         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 723                                "NOTE: Must not contain any symlinks for security reasons."
 724     },
 725 };
 726 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 727
 728 my $unuseddesc = {
 729     optional => 1,
 730     type => 'string', format => 'pve-volume-id',
 731     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 732 };
 733
 734 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 735     $confdesc->{"mp$i"} = {
 736         optional => 1,
 737         type => 'string', format => $mp_desc,
 738         description => "Use volume as container mount point.",
 739         optional => 1,
 740     };
 741 }
 742
 743 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 744     $confdesc->{"unused$i"} = $unuseddesc;
 745 }
 746
 747 sub parse_pct_config {
 748     my ($filename, $raw) = @_;
 749
 750     return undef if !defined($raw);
 751
 752     my $res = {
 753         digest => Digest::SHA::sha1_hex($raw),
 754         snapshots => {},
 755         pending => {},
 756     };
 757
 758     $filename =~ m|/lxc/(\d+).conf$|
 759         || die "got strange filename '$filename'";
 760
 761     my $vmid = $1;
 762
 763     my $conf = $res;
 764     my $descr = '';
 765     my $section = '';
 766
 767     my @lines = split(/\n/, $raw);
 768     foreach my $line (@lines) {
 769         next if $line =~ m/^\s*$/;
 770
 771         if ($line =~ m/^\[pve:pending\]\s*$/i) {
 772             $section = 'pending';
 773             $conf->{description} = $descr if $descr;
 774             $descr = '';
 775             $conf = $res->{$section} = {};
 776             next;
 777         } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 778             $section = $1;
 779             $conf->{description} = $descr if $descr;
 780             $descr = '';
 781             $conf = $res->{snapshots}->{$section} = {};
 782             next;
 783         }
 784
 785         if ($line =~ m/^\#(.*)\s*$/) {
 786             $descr .= PVE::Tools::decode_text($1) . "\n";
 787             next;
 788         }
 789
 790         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 791             my $key = $1;
 792             my $value = $3;
 793             my $validity = is_valid_lxc_conf_key($vmid, $key);
 794             if ($validity eq 1) {
 795                 push @{$conf->{lxc}}, [$key, $value];
 796             } elsif (my $errmsg = $validity) {
 797                 warn "vm $vmid - $key: $errmsg\n";
 798             } else {
 799                 warn "vm $vmid - unable to parse config: $line\n";
 800             }
 801         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 802             $descr .= PVE::Tools::decode_text($2);
 803         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 804             $conf->{snapstate} = $1;
 805         } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
 806             my $value = $1;
 807             if ($section eq 'pending') {
 808                 $conf->{delete} = $value;
 809             } else {
 810                 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
 811             }
 812         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 813             my $key = $1;
 814             my $value = $2;
 815             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 816             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 817             $conf->{$key} = $value;
 818         } else {
 819             warn "vm $vmid - unable to parse config: $line\n";
 820         }
 821     }
 822
 823     $conf->{description} = $descr if $descr;
 824
 825     delete $res->{snapstate}; # just to be sure
 826
 827     return $res;
 828 }
 829
 830 sub write_pct_config {
 831     my ($filename, $conf) = @_;
 832
 833     delete $conf->{snapstate}; # just to be sure
 834
 835     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 836     my $used_volids = {};
 837     foreach my $vid (@$volidlist) {
 838         $used_volids->{$vid} = 1;
 839     }
 840
 841     # remove 'unusedX' settings if the volume is still used
 842     foreach my $key (keys %$conf) {
 843         my $value = $conf->{$key};
 844         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 845             delete $conf->{$key};
 846         }
 847     }
 848
 849     my $generate_raw_config = sub {
 850         my ($conf) = @_;
 851
 852         my $raw = '';
 853
 854         # add description as comment to top of file
 855         my $descr = $conf->{description} || '';
 856         foreach my $cl (split(/\n/, $descr)) {
 857             $raw .= '#' . PVE::Tools::encode_text($cl) . "\n";
 858         }
 859
 860         foreach my $key (sort keys %$conf) {
 861             next if $key eq 'digest' || $key eq 'description' ||
 862                     $key eq 'pending' || $key eq 'snapshots' ||
 863                     $key eq 'snapname' || $key eq 'lxc';
 864             my $value = $conf->{$key};
 865             die "detected invalid newline inside property '$key'\n"
 866                 if $value =~ m/\n/;
 867             $raw .= "$key: $value\n";
 868         }
 869
 870         if (my $lxcconf = $conf->{lxc}) {
 871             foreach my $entry (@$lxcconf) {
 872                 my ($k, $v) = @$entry;
 873                 $raw .= "$k: $v\n";
 874             }
 875         }
 876
 877         return $raw;
 878     };
 879
 880     my $raw = &$generate_raw_config($conf);
 881
 882     if (scalar(keys %{$conf->{pending}})){
 883         $raw .= "\n[pve:pending]\n";
 884         $raw .= &$generate_raw_config($conf->{pending});
 885     }
 886
 887     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 888         $raw .= "\n[$snapname]\n";
 889         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 890     }
 891
 892     return $raw;
 893 }
 894
 895 sub update_pct_config {
 896     my ($class, $vmid, $conf, $running, $param, $delete, $revert) = @_;
 897
 898     my $storage_cfg = PVE::Storage::config();
 899
 900     foreach my $opt (@$revert) {
 901         delete $conf->{pending}->{$opt};
 902         $class->remove_from_pending_delete($conf, $opt); # also remove from deletion queue
 903     }
 904
 905     # write updates to pending section
 906     my $modified = {}; # record modified options
 907
 908     foreach my $opt (@$delete) {
 909         if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
 910             warn "cannot delete '$opt' - not set in current configuration!\n";
 911             next;
 912         }
 913         $modified->{$opt} = 1;
 914         if ($opt eq 'memory' || $opt eq 'rootfs' || $opt eq 'ostype') {
 915             die "unable to delete required option '$opt'\n";
 916         } elsif ($opt =~ m/^unused(\d+)$/) {
 917             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 918         } elsif ($opt =~ m/^mp(\d+)$/) {
 919             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 920         } elsif ($opt eq 'unprivileged') {
 921             die "unable to delete read-only option: '$opt'\n";
 922         }
 923         $class->add_to_pending_delete($conf, $opt);
 924     }
 925
 926     my $check_content_type = sub {
 927         my ($mp) = @_;
 928         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 929         my $storage_config = PVE::Storage::storage_config($storage_cfg, $sid);
 930         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 931             if !$storage_config->{content}->{rootdir};
 932     };
 933
 934     foreach my $opt (sort keys %$param) { # add/change
 935         $modified->{$opt} = 1;
 936         my $value = $param->{$opt};
 937         if ($opt =~ m/^mp(\d+)$/ || $opt eq 'rootfs') {
 938             $class->check_protection($conf, "can't update CT $vmid drive '$opt'");
 939             my $mp = $opt eq 'rootfs' ? $class->parse_ct_rootfs($value) : $class->parse_ct_mountpoint($value);
 940             $check_content_type->($mp);
 941         } elsif ($opt eq 'hookscript') {
 942             PVE::GuestHelpers::check_hookscript($value);
 943         } elsif ($opt eq 'nameserver') {
 944             $value = PVE::LXC::verify_nameserver_list($value);
 945         } elsif ($opt eq 'searchdomain') {
 946             $value = PVE::LXC::verify_searchdomain_list($value);
 947         } elsif ($opt eq 'unprivileged') {
 948             die "unable to modify read-only option: '$opt'\n";
 949         }
 950         $conf->{pending}->{$opt} = $value;
 951         $class->remove_from_pending_delete($conf, $opt);
 952     }
 953
 954     my $changes = $class->cleanup_pending($conf);
 955
 956     my $errors = {};
 957     if ($running) {
 958         $class->vmconfig_hotplug_pending($vmid, $conf, $storage_cfg, $modified, $errors);
 959     } else {
 960         $class->vmconfig_apply_pending($vmid, $conf, $storage_cfg, $modified, $errors);
 961     }
 962
 963     return $errors;
 964 }
 965
 966 sub check_type {
 967     my ($class, $key, $value) = @_;
 968
 969     die "unknown setting '$key'\n" if !$confdesc->{$key};
 970
 971     my $type = $confdesc->{$key}->{type};
 972
 973     if (!defined($value)) {
 974         die "got undefined value\n";
 975     }
 976
 977     if ($value =~ m/[\n\r]/) {
 978         die "property contains a line feed\n";
 979     }
 980
 981     if ($type eq 'boolean') {
 982         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
 983         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
 984         die "type check ('boolean') failed - got '$value'\n";
 985     } elsif ($type eq 'integer') {
 986         return int($1) if $value =~ m/^(\d+)$/;
 987         die "type check ('integer') failed - got '$value'\n";
 988     } elsif ($type eq 'number') {
 989         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
 990         die "type check ('number') failed - got '$value'\n";
 991     } elsif ($type eq 'string') {
 992         if (my $fmt = $confdesc->{$key}->{format}) {
 993             PVE::JSONSchema::check_format($fmt, $value);
 994             return $value;
 995         }
 996         return $value;
 997     } else {
 998         die "internal error"
 999     }
1000 }
1001
1002
1003 # add JSON properties for create and set function
1004 sub json_config_properties {
1005     my ($class, $prop) = @_;
1006
1007     foreach my $opt (keys %$confdesc) {
1008         next if $opt eq 'parent' || $opt eq 'snaptime';
1009         next if $prop->{$opt};
1010         $prop->{$opt} = $confdesc->{$opt};
1011     }
1012
1013     return $prop;
1014 }
1015
1016 sub __parse_ct_mountpoint_full {
1017     my ($class, $desc, $data, $noerr) = @_;
1018
1019     $data //= '';
1020
1021     my $res;
1022     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1023     if ($@) {
1024         return undef if $noerr;
1025         die $@;
1026     }
1027
1028     if (defined(my $size = $res->{size})) {
1029         $size = PVE::JSONSchema::parse_size($size);
1030         if (!defined($size)) {
1031             return undef if $noerr;
1032             die "invalid size: $size\n";
1033         }
1034         $res->{size} = $size;
1035     }
1036
1037     $res->{type} = $class->classify_mountpoint($res->{volume});
1038
1039     return $res;
1040 };
1041
1042 sub parse_ct_rootfs {
1043     my ($class, $data, $noerr) = @_;
1044
1045     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1046
1047     $res->{mp} = '/' if defined($res);
1048
1049     return $res;
1050 }
1051
1052 sub parse_ct_mountpoint {
1053     my ($class, $data, $noerr) = @_;
1054
1055     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1056 }
1057
1058 sub print_ct_mountpoint {
1059     my ($class, $info, $nomp) = @_;
1060     my $skip = [ 'type' ];
1061     push @$skip, 'mp' if $nomp;
1062     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1063 }
1064
1065 sub print_lxc_network {
1066     my ($class, $net) = @_;
1067     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1068 }
1069
1070 sub parse_lxc_network {
1071     my ($class, $data) = @_;
1072
1073     my $res = {};
1074
1075     return $res if !$data;
1076
1077     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1078
1079     $res->{type} = 'veth';
1080     if (!$res->{hwaddr}) {
1081         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1082         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1083     }
1084
1085     return $res;
1086 }
1087
1088 sub parse_features {
1089     my ($class, $data) = @_;
1090     return {} if !$data;
1091     return PVE::JSONSchema::parse_property_string($features_desc, $data);
1092 }
1093
1094 sub option_exists {
1095     my ($class, $name) = @_;
1096
1097     return defined($confdesc->{$name});
1098 }
1099 # END JSON config code
1100
1101 my $LXC_FASTPLUG_OPTIONS= {
1102     'description' => 1,
1103     'onboot' => 1,
1104     'startup' => 1,
1105     'protection' => 1,
1106     'hostname' => 1,
1107     'hookscript' => 1,
1108     'cores' => 1,
1109     'tags' => 1,
1110     'lock' => 1,
1111 };
1112
1113 sub vmconfig_hotplug_pending {
1114     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1115
1116     my $pid = PVE::LXC::find_lxc_pid($vmid);
1117     my $rootdir = "/proc/$pid/root";
1118
1119     my $add_hotplug_error = sub {
1120         my ($opt, $msg) = @_;
1121         $errors->{$opt} = "unable to hotplug $opt: $msg";
1122     };
1123
1124     my $changes;
1125     foreach my $opt (sort keys %{$conf->{pending}}) { # add/change
1126         next if $selection && !$selection->{$opt};
1127         if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1128             $conf->{$opt} = delete $conf->{pending}->{$opt};
1129             $changes = 1;
1130         }
1131     }
1132
1133     if ($changes) {
1134         $class->write_config($vmid, $conf);
1135     }
1136
1137     # There's no separate swap size to configure, there's memory and "total"
1138     # memory (iow. memory+swap). This means we have to change them together.
1139     my $hotplug_memory_done;
1140     my $hotplug_memory = sub {
1141         my ($wanted_memory, $wanted_swap) = @_;
1142         my $old_memory = ($conf->{memory} || $confdesc->{memory}->{default});
1143         my $old_swap = ($conf->{swap} || $confdesc->{swap}->{default});
1144
1145         $wanted_memory //= $old_memory;
1146         $wanted_swap //= $old_swap;
1147
1148         my $total = $wanted_memory + $wanted_swap;
1149         my $old_total = $old_memory + $old_swap;
1150
1151         if ($total > $old_total) {
1152             PVE::LXC::write_cgroup_value("memory", $vmid,
1153                                          "memory.memsw.limit_in_bytes",
1154                                          int($total*1024*1024));
1155             PVE::LXC::write_cgroup_value("memory", $vmid,
1156                                          "memory.limit_in_bytes",
1157                                          int($wanted_memory*1024*1024));
1158         } else {
1159             PVE::LXC::write_cgroup_value("memory", $vmid,
1160                                          "memory.limit_in_bytes",
1161                                          int($wanted_memory*1024*1024));
1162             PVE::LXC::write_cgroup_value("memory", $vmid,
1163                                          "memory.memsw.limit_in_bytes",
1164                                          int($total*1024*1024));
1165         }
1166         $hotplug_memory_done = 1;
1167     };
1168
1169     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1170     # FIXME: $force deletion is not implemented for CTs
1171     foreach my $opt (sort keys %$pending_delete_hash) {
1172         next if $selection && !$selection->{$opt};
1173         eval {
1174             if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1175                 # pass
1176             } elsif ($opt =~ m/^unused(\d+)$/) {
1177                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1178                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1179             } elsif ($opt eq 'swap') {
1180                 $hotplug_memory->(undef, 0);
1181             } elsif ($opt eq 'cpulimit') {
1182                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", -1);
1183                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1184             } elsif ($opt eq 'cpuunits') {
1185                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shared", $confdesc->{cpuunits}->{default});
1186             } elsif ($opt =~ m/^net(\d)$/) {
1187                 my $netid = $1;
1188                 PVE::Network::veth_delete("veth${vmid}i$netid");
1189             } else {
1190                 die "skip\n"; # skip non-hotpluggable opts
1191             }
1192         };
1193         if (my $err = $@) {
1194             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1195         } else {
1196             delete $conf->{$opt};
1197             $class->remove_from_pending_delete($conf, $opt);
1198         }
1199     }
1200
1201     foreach my $opt (sort keys %{$conf->{pending}}) {
1202         next if $opt eq 'delete'; # just to be sure
1203         next if $selection && !$selection->{$opt};
1204         my $value = $conf->{pending}->{$opt};
1205         eval {
1206             if ($opt eq 'cpulimit') {
1207                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", 100000);
1208                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1209             } elsif ($opt eq 'cpuunits') {
1210                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1211             } elsif ($opt =~ m/^net(\d+)$/) {
1212                 my $netid = $1;
1213                 my $net = $class->parse_lxc_network($value);
1214                 $value = $class->print_lxc_network($net);
1215                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1216             } elsif ($opt eq 'memory' || $opt eq 'swap') {
1217                 if (!$hotplug_memory_done) { # don't call twice if both opts are passed
1218                     $hotplug_memory->($conf->{pending}->{memory}, $conf->{pending}->{swap});
1219                 }
1220             } else {
1221                 die "skip\n"; # skip non-hotpluggable
1222             }
1223         };
1224         if (my $err = $@) {
1225             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1226         } else {
1227             $conf->{$opt} = $value;
1228             delete $conf->{pending}->{$opt};
1229         }
1230     }
1231
1232     $class->write_config($vmid, $conf);
1233 }
1234
1235 sub vmconfig_apply_pending {
1236     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1237
1238     my $add_apply_error = sub {
1239         my ($opt, $msg) = @_;
1240         my $err_msg = "unable to apply pending change $opt : $msg";
1241         $errors->{$opt} = $err_msg;
1242         warn $err_msg;
1243     };
1244
1245     my $rescan_volume = sub {
1246         my ($mp) = @_;
1247         eval {
1248             $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5)
1249                 if !defined($mp->{size});
1250         };
1251         warn "Could not rescan volume size - $@\n" if $@;
1252     };
1253
1254     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1255     # FIXME: $force deletion is not implemented for CTs
1256     foreach my $opt (sort keys %$pending_delete_hash) {
1257         next if $selection && !$selection->{$opt};
1258         $class->cleanup_pending($conf);
1259         eval {
1260             if ($opt =~ m/^mp(\d+)$/) {
1261                 my $mp = $class->parse_ct_mountpoint($conf->{$opt});
1262                 if ($mp->{type} eq 'volume') {
1263                     $class->add_unused_volume($conf, $mp->{volume})
1264                         if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1265                 }
1266             } elsif ($opt =~ m/^unused(\d+)$/) {
1267                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1268                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1269             }
1270         };
1271         if (my $err = $@) {
1272             $add_apply_error->($opt, $err);
1273         } else {
1274             delete $conf->{$opt};
1275             $class->remove_from_pending_delete($conf, $opt);
1276         }
1277     }
1278
1279     foreach my $opt (sort keys %{$conf->{pending}}) { # add/change
1280         next if $opt eq 'delete'; # just to be sure
1281         next if $selection && !$selection->{$opt};
1282         eval {
1283             if ($opt =~ m/^mp(\d+)$/) {
1284                 my $mp = $class->parse_ct_mountpoint($conf->{pending}->{$opt});
1285                 my $old = $conf->{$opt};
1286                 if ($mp->{type} eq 'volume') {
1287                     if ($mp->{volume} =~ $PVE::LXC::NEW_DISK_RE) {
1288                         PVE::LXC::create_disks($storecfg, $vmid, { $opt => $conf->{pending}->{$opt} }, $conf, 1);
1289                     } else {
1290                         $rescan_volume->($mp);
1291                         $conf->{pending}->{$opt} = $class->print_ct_mountpoint($mp);
1292                     }
1293                 }
1294                 if (defined($old)) {
1295                     my $mp = $class->parse_ct_mountpoint($old);
1296                     if ($mp->{type} eq 'volume') {
1297                         $class->add_unused_volume($conf, $mp->{volume})
1298                             if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1299                     }
1300                 }
1301             } elsif ($opt =~ m/^net(\d+)$/) {
1302                 my $netid = $1;
1303                 my $net = $class->parse_lxc_network($conf->{pending}->{$opt});
1304                 $conf->{pending}->{$opt} = $class->print_lxc_network($net);
1305             }
1306         };
1307         if (my $err = $@) {
1308             $add_apply_error->($opt, $err);
1309         } else {
1310             $class->cleanup_pending($conf);
1311             $conf->{$opt} = delete $conf->{pending}->{$opt};
1312         }
1313     }
1314
1315     $class->write_config($vmid, $conf);
1316 }
1317
1318 sub classify_mountpoint {
1319     my ($class, $vol) = @_;
1320     if ($vol =~ m!^/!) {
1321         return 'device' if $vol =~ m!^/dev/!;
1322         return 'bind';
1323     }
1324     return 'volume';
1325 }
1326
1327 my $__is_volume_in_use = sub {
1328     my ($class, $config, $volid) = @_;
1329     my $used = 0;
1330
1331     $class->foreach_mountpoint($config, sub {
1332         my ($ms, $mountpoint) = @_;
1333         return if $used;
1334         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1335     });
1336
1337     return $used;
1338 };
1339
1340 sub is_volume_in_use_by_snapshots {
1341     my ($class, $config, $volid) = @_;
1342
1343     if (my $snapshots = $config->{snapshots}) {
1344         foreach my $snap (keys %$snapshots) {
1345             return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1346         }
1347     }
1348
1349     return 0;
1350 }
1351
1352 sub is_volume_in_use {
1353     my ($class, $config, $volid, $include_snapshots, $include_pending) = @_;
1354     return 1 if $__is_volume_in_use->($class, $config, $volid);
1355     return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1356     return 1 if $include_pending && $__is_volume_in_use->($class, $config->{pending}, $volid);
1357     return 0;
1358 }
1359
1360 sub has_dev_console {
1361     my ($class, $conf) = @_;
1362
1363     return !(defined($conf->{console}) && !$conf->{console});
1364 }
1365
1366 sub has_lxc_entry {
1367     my ($class, $conf, $keyname) = @_;
1368
1369     if (my $lxcconf = $conf->{lxc}) {
1370         foreach my $entry (@$lxcconf) {
1371             my ($key, undef) = @$entry;
1372             return 1 if $key eq $keyname;
1373         }
1374     }
1375
1376     return 0;
1377 }
1378
1379 sub get_tty_count {
1380     my ($class, $conf) = @_;
1381
1382     return $conf->{tty} // $confdesc->{tty}->{default};
1383 }
1384
1385 sub get_cmode {
1386     my ($class, $conf) = @_;
1387
1388     return $conf->{cmode} // $confdesc->{cmode}->{default};
1389 }
1390
1391 sub mountpoint_names {
1392     my ($class, $reverse) = @_;
1393
1394     my @names = ('rootfs');
1395
1396     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1397         push @names, "mp$i";
1398     }
1399
1400     return $reverse ? reverse @names : @names;
1401 }
1402
1403 sub foreach_mountpoint_full {
1404     my ($class, $conf, $reverse, $func, @param) = @_;
1405
1406     my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1407     foreach my $key (@$mps) {
1408         my $value = $conf->{$key};
1409         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1410         next if !defined($mountpoint);
1411
1412         &$func($key, $mountpoint, @param);
1413     }
1414 }
1415
1416 sub foreach_mountpoint {
1417     my ($class, $conf, $func, @param) = @_;
1418
1419     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1420 }
1421
1422 sub foreach_mountpoint_reverse {
1423     my ($class, $conf, $func, @param) = @_;
1424
1425     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1426 }
1427
1428 sub get_vm_volumes {
1429     my ($class, $conf, $excludes) = @_;
1430
1431     my $vollist = [];
1432
1433     $class->foreach_mountpoint($conf, sub {
1434         my ($ms, $mountpoint) = @_;
1435
1436         return if $excludes && $ms eq $excludes;
1437
1438         my $volid = $mountpoint->{volume};
1439         return if !$volid || $mountpoint->{type} ne 'volume';
1440
1441         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1442         return if !$sid;
1443
1444         push @$vollist, $volid;
1445     });
1446
1447     return $vollist;
1448 }
1449
1450 sub get_replicatable_volumes {
1451     my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1452
1453     my $volhash = {};
1454
1455     my $test_volid = sub {
1456         my ($volid, $mountpoint) = @_;
1457
1458         return if !$volid;
1459
1460         my $mptype = $mountpoint->{type};
1461         my $replicate = $mountpoint->{replicate} // 1;
1462
1463         if ($mptype ne 'volume') {
1464             # skip bindmounts if replicate = 0 even for cleanup,
1465             # since bind mounts could not have been replicated ever
1466             return if !$replicate;
1467             die "unable to replicate mountpoint type '$mptype'\n";
1468         }
1469
1470         my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1471         return if !$storeid;
1472
1473         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1474         return if $scfg->{shared};
1475
1476         my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1477         return if !$owner || ($owner != $vmid);
1478
1479         die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1480
1481         return if !$cleanup && !$replicate;
1482
1483         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1484             return if $cleanup || $noerr;
1485             die "missing replicate feature on volume '$volid'\n";
1486         }
1487
1488         $volhash->{$volid} = 1;
1489     };
1490
1491     $class->foreach_mountpoint($conf, sub {
1492         my ($ms, $mountpoint) = @_;
1493         $test_volid->($mountpoint->{volume}, $mountpoint);
1494     });
1495
1496     foreach my $snapname (keys %{$conf->{snapshots}}) {
1497         my $snap = $conf->{snapshots}->{$snapname};
1498         $class->foreach_mountpoint($snap, sub {
1499             my ($ms, $mountpoint) = @_;
1500             $test_volid->($mountpoint->{volume}, $mountpoint);
1501         });
1502     }
1503
1504     # add 'unusedX' volumes to volhash
1505     foreach my $key (keys %$conf) {
1506         if ($key =~ m/^unused/) {
1507             $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1508         }
1509     }
1510
1511     return $volhash;
1512 }
1513
1514 1;