src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::GuestHelpers;
   9 use PVE::INotify;
  10 use PVE::JSONSchema qw(get_standard_option);
  11 use PVE::Tools;
  12
  13 use base qw(PVE::AbstractConfig);
  14
  15 my $nodename = PVE::INotify::nodename();
  16 my $lock_handles =  {};
  17 my $lockdir = "/run/lock/lxc";
  18 mkdir $lockdir;
  19 mkdir "/etc/pve/nodes/$nodename/lxc";
  20 my $MAX_MOUNT_POINTS = 256;
  21 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  22
  23 # BEGIN implemented abstract methods from PVE::AbstractConfig
  24
  25 sub guest_type {
  26     return "CT";
  27 }
  28
  29 sub __config_max_unused_disks {
  30     my ($class) = @_;
  31
  32     return $MAX_UNUSED_DISKS;
  33 }
  34
  35 sub config_file_lock {
  36     my ($class, $vmid) = @_;
  37
  38     return "$lockdir/pve-config-${vmid}.lock";
  39 }
  40
  41 sub cfs_config_path {
  42     my ($class, $vmid, $node) = @_;
  43
  44     $node = $nodename if !$node;
  45     return "nodes/$node/lxc/$vmid.conf";
  46 }
  47
  48 sub mountpoint_backup_enabled {
  49     my ($class, $mp_key, $mountpoint) = @_;
  50
  51     return 1 if $mp_key eq 'rootfs';
  52
  53     return 0 if $mountpoint->{type} ne 'volume';
  54
  55     return 1 if $mountpoint->{backup};
  56
  57     return 0;
  58 }
  59
  60 sub has_feature {
  61     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  62     my $err;
  63
  64     $class->foreach_mountpoint($conf, sub {
  65         my ($ms, $mountpoint) = @_;
  66
  67         return if $err; # skip further test
  68         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  69
  70         $err = 1
  71             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  72                                                  $mountpoint->{volume},
  73                                                  $snapname, $running);
  74     });
  75
  76     return $err ? 0 : 1;
  77 }
  78
  79 sub __snapshot_save_vmstate {
  80     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  81     die "implement me - snapshot_save_vmstate\n";
  82 }
  83
  84 sub __snapshot_check_running {
  85     my ($class, $vmid) = @_;
  86     return PVE::LXC::check_running($vmid);
  87 }
  88
  89 sub __snapshot_check_freeze_needed {
  90     my ($class, $vmid, $config, $save_vmstate) = @_;
  91
  92     my $ret = $class->__snapshot_check_running($vmid);
  93     return ($ret, $ret);
  94 }
  95
  96 sub __snapshot_freeze {
  97     my ($class, $vmid, $unfreeze) = @_;
  98
  99     if ($unfreeze) {
 100         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 101         warn $@ if $@;
 102     } else {
 103         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 104         PVE::LXC::sync_container_namespace($vmid);
 105     }
 106 }
 107
 108 sub __snapshot_create_vol_snapshot {
 109     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 110
 111     my $storecfg = PVE::Storage::config();
 112
 113     return if $snapname eq 'vzdump' &&
 114         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 115
 116     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 117 }
 118
 119 sub __snapshot_delete_remove_drive {
 120     my ($class, $snap, $remove_drive) = @_;
 121
 122     if ($remove_drive eq 'vmstate') {
 123         die "implement me - saving vmstate\n";
 124     } else {
 125         my $value = $snap->{$remove_drive};
 126         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 127         delete $snap->{$remove_drive};
 128
 129         $class->add_unused_volume($snap, $mountpoint->{volume})
 130             if ($mountpoint->{type} eq 'volume');
 131     }
 132 }
 133
 134 sub __snapshot_delete_vmstate_file {
 135     my ($class, $snap, $force) = @_;
 136
 137     die "implement me - saving vmstate\n";
 138 }
 139
 140 sub __snapshot_delete_vol_snapshot {
 141     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 142
 143     return if $snapname eq 'vzdump' &&
 144         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 145
 146     my $storecfg = PVE::Storage::config();
 147     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 148     push @$unused, $mountpoint->{volume};
 149 }
 150
 151 sub __snapshot_rollback_vol_possible {
 152     my ($class, $mountpoint, $snapname) = @_;
 153
 154     my $storecfg = PVE::Storage::config();
 155     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 156 }
 157
 158 sub __snapshot_rollback_vol_rollback {
 159     my ($class, $mountpoint, $snapname) = @_;
 160
 161     my $storecfg = PVE::Storage::config();
 162     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 163 }
 164
 165 sub __snapshot_rollback_vm_stop {
 166     my ($class, $vmid) = @_;
 167
 168     PVE::LXC::vm_stop($vmid, 1)
 169         if $class->__snapshot_check_running($vmid);
 170 }
 171
 172 sub __snapshot_rollback_vm_start {
 173     my ($class, $vmid, $vmstate, $data);
 174
 175     die "implement me - save vmstate\n";
 176 }
 177
 178 sub __snapshot_rollback_get_unused {
 179     my ($class, $conf, $snap) = @_;
 180
 181     my $unused = [];
 182
 183     $class->__snapshot_foreach_volume($conf, sub {
 184         my ($vs, $volume) = @_;
 185
 186         return if $volume->{type} ne 'volume';
 187
 188         my $found = 0;
 189         my $volid = $volume->{volume};
 190
 191         $class->__snapshot_foreach_volume($snap, sub {
 192             my ($ms, $mountpoint) = @_;
 193
 194             return if $found;
 195             return if ($mountpoint->{type} ne 'volume');
 196
 197             $found = 1
 198                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 199         });
 200
 201         push @$unused, $volid if !$found;
 202     });
 203
 204     return $unused;
 205 }
 206
 207 sub __snapshot_foreach_volume {
 208     my ($class, $conf, $func) = @_;
 209
 210     $class->foreach_mountpoint($conf, $func);
 211 }
 212
 213 # END implemented abstract methods from PVE::AbstractConfig
 214
 215 # BEGIN JSON config code
 216
 217 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 218
 219
 220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
 221
 222 sub is_valid_mount_option {
 223     my ($option) = @_;
 224     return $option =~ $valid_mount_option_re;
 225 }
 226
 227 my $rootfs_desc = {
 228     volume => {
 229         type => 'string',
 230         default_key => 1,
 231         format => 'pve-lxc-mp-string',
 232         format_description => 'volume',
 233         description => 'Volume, device or directory to mount into the container.',
 234     },
 235     size => {
 236         type => 'string',
 237         format => 'disk-size',
 238         format_description => 'DiskSize',
 239         description => 'Volume size (read only value).',
 240         optional => 1,
 241     },
 242     acl => {
 243         type => 'boolean',
 244         description => 'Explicitly enable or disable ACL support.',
 245         optional => 1,
 246     },
 247     mountoptions => {
 248         optional => 1,
 249         type => 'string',
 250         description => 'Extra mount options for rootfs/mps.',
 251         format_description => 'opt[;opt...]',
 252         pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
 253     },
 254     ro => {
 255         type => 'boolean',
 256         description => 'Read-only mount point',
 257         optional => 1,
 258     },
 259     quota => {
 260         type => 'boolean',
 261         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 262         optional => 1,
 263     },
 264     replicate => {
 265         type => 'boolean',
 266         description => 'Will include this volume to a storage replica job.',
 267         optional => 1,
 268         default => 1,
 269     },
 270     shared => {
 271         type => 'boolean',
 272         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 273         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 274         optional => 1,
 275         default => 0,
 276     },
 277 };
 278
 279 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 280     type => 'string', format => $rootfs_desc,
 281     description => "Use volume as container root.",
 282     optional => 1,
 283 });
 284
 285 my $features_desc = {
 286     mount => {
 287         optional => 1,
 288         type => 'string',
 289         description => "Allow mounting file systems of specific types."
 290             ." This should be a list of file system types as used with the mount command."
 291             ." Note that this can have negative effects on the container's security."
 292             ." With access to a loop device, mounting a file can circumvent the mknod"
 293             ." permission of the devices cgroup, mounting an NFS file system can"
 294             ." block the host's I/O completely and prevent it from rebooting, etc.",
 295         format_description => 'fstype;fstype;...',
 296         pattern => qr/[a-zA-Z0-9_; ]+/,
 297     },
 298     nesting => {
 299         optional => 1,
 300         type => 'boolean',
 301         default => 0,
 302         description => "Allow nesting."
 303             ." Best used with unprivileged containers with additional id mapping."
 304             ." Note that this will expose procfs and sysfs contents of the host"
 305             ." to the guest.",
 306     },
 307     keyctl => {
 308         optional => 1,
 309         type => 'boolean',
 310         default => 0,
 311         description => "For unprivileged containers only: Allow the use of the keyctl() system call."
 312             ." This is required to use docker inside a container."
 313             ." By default unprivileged containers will see this system call as non-existent."
 314             ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
 315             ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
 316             ." Essentially, you can choose between running systemd-networkd or docker.",
 317     },
 318     fuse => {
 319         optional => 1,
 320         type => 'boolean',
 321         default => 0,
 322         description => "Allow using 'fuse' file systems in a container."
 323             ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
 324     },
 325 };
 326
 327 my $confdesc = {
 328     lock => {
 329         optional => 1,
 330         type => 'string',
 331         description => "Lock/unlock the VM.",
 332         enum => [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
 333     },
 334     onboot => {
 335         optional => 1,
 336         type => 'boolean',
 337         description => "Specifies whether a VM will be started during system bootup.",
 338         default => 0,
 339     },
 340     startup => get_standard_option('pve-startup-order'),
 341     template => {
 342         optional => 1,
 343         type => 'boolean',
 344         description => "Enable/disable Template.",
 345         default => 0,
 346     },
 347     arch => {
 348         optional => 1,
 349         type => 'string',
 350         enum => ['amd64', 'i386', 'arm64', 'armhf'],
 351         description => "OS architecture type.",
 352         default => 'amd64',
 353     },
 354     ostype => {
 355         optional => 1,
 356         type => 'string',
 357         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 358         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 359     },
 360     console => {
 361         optional => 1,
 362         type => 'boolean',
 363         description => "Attach a console device (/dev/console) to the container.",
 364         default => 1,
 365     },
 366     tty => {
 367         optional => 1,
 368         type => 'integer',
 369         description => "Specify the number of tty available to the container",
 370         minimum => 0,
 371         maximum => 6,
 372         default => 2,
 373     },
 374     cores => {
 375         optional => 1,
 376         type => 'integer',
 377         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 378         minimum => 1,
 379         maximum => 128,
 380     },
 381     cpulimit => {
 382         optional => 1,
 383         type => 'number',
 384         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 385         minimum => 0,
 386         maximum => 128,
 387         default => 0,
 388     },
 389     cpuunits => {
 390         optional => 1,
 391         type => 'integer',
 392         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 393         minimum => 0,
 394         maximum => 500000,
 395         default => 1024,
 396     },
 397     memory => {
 398         optional => 1,
 399         type => 'integer',
 400         description => "Amount of RAM for the VM in MB.",
 401         minimum => 16,
 402         default => 512,
 403     },
 404     swap => {
 405         optional => 1,
 406         type => 'integer',
 407         description => "Amount of SWAP for the VM in MB.",
 408         minimum => 0,
 409         default => 512,
 410     },
 411     hostname => {
 412         optional => 1,
 413         description => "Set a host name for the container.",
 414         type => 'string', format => 'dns-name',
 415         maxLength => 255,
 416     },
 417     description => {
 418         optional => 1,
 419         type => 'string',
 420         description => "Container description. Only used on the configuration web interface.",
 421     },
 422     searchdomain => {
 423         optional => 1,
 424         type => 'string', format => 'dns-name-list',
 425         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 426     },
 427     nameserver => {
 428         optional => 1,
 429         type => 'string', format => 'address-list',
 430         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 431     },
 432     rootfs => get_standard_option('pve-ct-rootfs'),
 433     parent => {
 434         optional => 1,
 435         type => 'string', format => 'pve-configid',
 436         maxLength => 40,
 437         description => "Parent snapshot name. This is used internally, and should not be modified.",
 438     },
 439     snaptime => {
 440         optional => 1,
 441         description => "Timestamp for snapshots.",
 442         type => 'integer',
 443         minimum => 0,
 444     },
 445     cmode => {
 446         optional => 1,
 447         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 448         type => 'string',
 449         enum => ['shell', 'console', 'tty'],
 450         default => 'tty',
 451     },
 452     protection => {
 453         optional => 1,
 454         type => 'boolean',
 455         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 456         default => 0,
 457     },
 458     unprivileged => {
 459         optional => 1,
 460         type => 'boolean',
 461         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 462         default => 0,
 463     },
 464     features => {
 465         optional => 1,
 466         type => 'string',
 467         format => $features_desc,
 468         description => "Allow containers access to advanced features.",
 469     },
 470     hookscript => {
 471         optional => 1,
 472         type => 'string',
 473         format => 'pve-volume-id',
 474         description => 'Script that will be exectued during various steps in the containers lifetime.',
 475     },
 476 };
 477
 478 my $valid_lxc_conf_keys = {
 479     'lxc.apparmor.profile' => 1,
 480     'lxc.apparmor.allow_incomplete' => 1,
 481     'lxc.apparmor.allow_nesting' => 1,
 482     'lxc.apparmor.raw' => 1,
 483     'lxc.selinux.context' => 1,
 484     'lxc.include' => 1,
 485     'lxc.arch' => 1,
 486     'lxc.uts.name' => 1,
 487     'lxc.signal.halt' => 1,
 488     'lxc.signal.reboot' => 1,
 489     'lxc.signal.stop' => 1,
 490     'lxc.init.cmd' => 1,
 491     'lxc.pty.max' => 1,
 492     'lxc.console.logfile' => 1,
 493     'lxc.console.path' => 1,
 494     'lxc.tty.max' => 1,
 495     'lxc.devtty.dir' => 1,
 496     'lxc.hook.autodev' => 1,
 497     'lxc.autodev' => 1,
 498     'lxc.kmsg' => 1,
 499     'lxc.mount.fstab' => 1,
 500     'lxc.mount.entry' => 1,
 501     'lxc.mount.auto' => 1,
 502     'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
 503     'lxc.rootfs.mount' => 1,
 504     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 505                             ', please use mount point options in the "rootfs" key',
 506     # lxc.cgroup.*
 507     # lxc.prlimit.*
 508     # lxc.net.*
 509     'lxc.cap.drop' => 1,
 510     'lxc.cap.keep' => 1,
 511     'lxc.seccomp.profile' => 1,
 512     'lxc.seccomp.notify.proxy' => 1,
 513     'lxc.seccomp.notify.cookie' => 1,
 514     'lxc.idmap' => 1,
 515     'lxc.hook.pre-start' => 1,
 516     'lxc.hook.pre-mount' => 1,
 517     'lxc.hook.mount' => 1,
 518     'lxc.hook.start' => 1,
 519     'lxc.hook.stop' => 1,
 520     'lxc.hook.post-stop' => 1,
 521     'lxc.hook.clone' => 1,
 522     'lxc.hook.destroy' => 1,
 523     'lxc.log.level' => 1,
 524     'lxc.log.file' => 1,
 525     'lxc.start.auto' => 1,
 526     'lxc.start.delay' => 1,
 527     'lxc.start.order' => 1,
 528     'lxc.group' => 1,
 529     'lxc.environment' => 1,
 530
 531     # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
 532     'lxc.sysctl.fs.mqueue' => 1,
 533     'lxc.sysctl.kernel.msgmax' => 1,
 534     'lxc.sysctl.kernel.msgmnb' => 1,
 535     'lxc.sysctl.kernel.msgmni' => 1,
 536     'lxc.sysctl.kernel.sem' => 1,
 537     'lxc.sysctl.kernel.shmall' => 1,
 538     'lxc.sysctl.kernel.shmmax' => 1,
 539     'lxc.sysctl.kernel.shmmni' => 1,
 540     'lxc.sysctl.kernel.shm_rmid_forced' => 1,
 541 };
 542
 543 my $deprecated_lxc_conf_keys = {
 544     # Deprecated (removed with lxc 3.0):
 545     'lxc.aa_profile'           => 'lxc.apparmor.profile',
 546     'lxc.aa_allow_incomplete'  => 'lxc.apparmor.allow_incomplete',
 547     'lxc.console'              => 'lxc.console.path',
 548     'lxc.devttydir'            => 'lxc.tty.dir',
 549     'lxc.haltsignal'           => 'lxc.signal.halt',
 550     'lxc.rebootsignal'         => 'lxc.signal.reboot',
 551     'lxc.stopsignal'           => 'lxc.signal.stop',
 552     'lxc.id_map'               => 'lxc.idmap',
 553     'lxc.init_cmd'             => 'lxc.init.cmd',
 554     'lxc.loglevel'             => 'lxc.log.level',
 555     'lxc.logfile'              => 'lxc.log.file',
 556     'lxc.mount'                => 'lxc.mount.fstab',
 557     'lxc.network.type'         => 'lxc.net.INDEX.type',
 558     'lxc.network.flags'        => 'lxc.net.INDEX.flags',
 559     'lxc.network.link'         => 'lxc.net.INDEX.link',
 560     'lxc.network.mtu'          => 'lxc.net.INDEX.mtu',
 561     'lxc.network.name'         => 'lxc.net.INDEX.name',
 562     'lxc.network.hwaddr'       => 'lxc.net.INDEX.hwaddr',
 563     'lxc.network.ipv4'         => 'lxc.net.INDEX.ipv4.address',
 564     'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
 565     'lxc.network.ipv6'         => 'lxc.net.INDEX.ipv6.address',
 566     'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
 567     'lxc.network.script.up'    => 'lxc.net.INDEX.script.up',
 568     'lxc.network.script.down'  => 'lxc.net.INDEX.script.down',
 569     'lxc.pts'                  => 'lxc.pty.max',
 570     'lxc.se_context'           => 'lxc.selinux.context',
 571     'lxc.seccomp'              => 'lxc.seccomp.profile',
 572     'lxc.tty'                  => 'lxc.tty.max',
 573     'lxc.utsname'              => 'lxc.uts.name',
 574 };
 575
 576 sub is_valid_lxc_conf_key {
 577     my ($vmid, $key) = @_;
 578     if ($key =~ /^lxc\.limit\./) {
 579         warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
 580         return 1;
 581     }
 582     if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
 583         warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
 584         return 1;
 585     }
 586     my $validity = $valid_lxc_conf_keys->{$key};
 587     return $validity if defined($validity);
 588     return 1 if $key =~ /^lxc\.cgroup\./  # allow all cgroup values
 589              || $key =~ /^lxc\.prlimit\./ # allow all prlimits
 590              || $key =~ /^lxc\.net\./;    # allow custom network definitions
 591     return 0;
 592 }
 593
 594 our $netconf_desc = {
 595     type => {
 596         type => 'string',
 597         optional => 1,
 598         description => "Network interface type.",
 599         enum => [qw(veth)],
 600     },
 601     name => {
 602         type => 'string',
 603         format_description => 'string',
 604         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 605         pattern => '[-_.\w\d]+',
 606     },
 607     bridge => {
 608         type => 'string',
 609         format_description => 'bridge',
 610         description => 'Bridge to attach the network device to.',
 611         pattern => '[-_.\w\d]+',
 612         optional => 1,
 613     },
 614     hwaddr => get_standard_option('mac-addr', {
 615         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 616         }),
 617     mtu => {
 618         type => 'integer',
 619         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 620         minimum => 64, # minimum ethernet frame is 64 bytes
 621         optional => 1,
 622     },
 623     ip => {
 624         type => 'string',
 625         format => 'pve-ipv4-config',
 626         format_description => '(IPv4/CIDR|dhcp|manual)',
 627         description => 'IPv4 address in CIDR format.',
 628         optional => 1,
 629     },
 630     gw => {
 631         type => 'string',
 632         format => 'ipv4',
 633         format_description => 'GatewayIPv4',
 634         description => 'Default gateway for IPv4 traffic.',
 635         optional => 1,
 636     },
 637     ip6 => {
 638         type => 'string',
 639         format => 'pve-ipv6-config',
 640         format_description => '(IPv6/CIDR|auto|dhcp|manual)',
 641         description => 'IPv6 address in CIDR format.',
 642         optional => 1,
 643     },
 644     gw6 => {
 645         type => 'string',
 646         format => 'ipv6',
 647         format_description => 'GatewayIPv6',
 648         description => 'Default gateway for IPv6 traffic.',
 649         optional => 1,
 650     },
 651     firewall => {
 652         type => 'boolean',
 653         description => "Controls whether this interface's firewall rules should be used.",
 654         optional => 1,
 655     },
 656     tag => {
 657         type => 'integer',
 658         minimum => 1,
 659         maximum => 4094,
 660         description => "VLAN tag for this interface.",
 661         optional => 1,
 662     },
 663     trunks => {
 664         type => 'string',
 665         pattern => qr/\d+(?:;\d+)*/,
 666         format_description => 'vlanid[;vlanid...]',
 667         description => "VLAN ids to pass through the interface",
 668         optional => 1,
 669     },
 670     rate => {
 671         type => 'number',
 672         format_description => 'mbps',
 673         description => "Apply rate limiting to the interface",
 674         optional => 1,
 675     },
 676 };
 677 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 678
 679 my $MAX_LXC_NETWORKS = 10;
 680 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 681     $confdesc->{"net$i"} = {
 682         optional => 1,
 683         type => 'string', format => $netconf_desc,
 684         description => "Specifies network interfaces for the container.",
 685     };
 686 }
 687
 688 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 689 sub verify_lxc_mp_string {
 690     my ($mp, $noerr) = @_;
 691
 692     # do not allow:
 693     # /./ or /../
 694     # /. or /.. at the end
 695     # ../ at the beginning
 696
 697     if($mp =~ m@/\.\.?/@ ||
 698        $mp =~ m@/\.\.?$@ ||
 699        $mp =~ m@^\.\./@) {
 700         return undef if $noerr;
 701         die "$mp contains illegal character sequences\n";
 702     }
 703     return $mp;
 704 }
 705
 706 my $mp_desc = {
 707     %$rootfs_desc,
 708     backup => {
 709         type => 'boolean',
 710         description => 'Whether to include the mount point in backups.',
 711         verbose_description => 'Whether to include the mount point in backups '.
 712                                '(only used for volume mount points).',
 713         optional => 1,
 714     },
 715     mp => {
 716         type => 'string',
 717         format => 'pve-lxc-mp-string',
 718         format_description => 'Path',
 719         description => 'Path to the mount point as seen from inside the container '.
 720                        '(must not contain symlinks).',
 721         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 722                                "NOTE: Must not contain any symlinks for security reasons."
 723     },
 724 };
 725 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 726
 727 my $unuseddesc = {
 728     optional => 1,
 729     type => 'string', format => 'pve-volume-id',
 730     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 731 };
 732
 733 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 734     $confdesc->{"mp$i"} = {
 735         optional => 1,
 736         type => 'string', format => $mp_desc,
 737         description => "Use volume as container mount point.",
 738         optional => 1,
 739     };
 740 }
 741
 742 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 743     $confdesc->{"unused$i"} = $unuseddesc;
 744 }
 745
 746 sub parse_pct_config {
 747     my ($filename, $raw) = @_;
 748
 749     return undef if !defined($raw);
 750
 751     my $res = {
 752         digest => Digest::SHA::sha1_hex($raw),
 753         snapshots => {},
 754         pending => {},
 755     };
 756
 757     $filename =~ m|/lxc/(\d+).conf$|
 758         || die "got strange filename '$filename'";
 759
 760     my $vmid = $1;
 761
 762     my $conf = $res;
 763     my $descr = '';
 764     my $section = '';
 765
 766     my @lines = split(/\n/, $raw);
 767     foreach my $line (@lines) {
 768         next if $line =~ m/^\s*$/;
 769
 770         if ($line =~ m/^\[pve:pending\]\s*$/i) {
 771             $section = 'pending';
 772             $conf->{description} = $descr if $descr;
 773             $descr = '';
 774             $conf = $res->{$section} = {};
 775             next;
 776         } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 777             $section = $1;
 778             $conf->{description} = $descr if $descr;
 779             $descr = '';
 780             $conf = $res->{snapshots}->{$section} = {};
 781             next;
 782         }
 783
 784         if ($line =~ m/^\#(.*)\s*$/) {
 785             $descr .= PVE::Tools::decode_text($1) . "\n";
 786             next;
 787         }
 788
 789         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 790             my $key = $1;
 791             my $value = $3;
 792             my $validity = is_valid_lxc_conf_key($vmid, $key);
 793             if ($validity eq 1) {
 794                 push @{$conf->{lxc}}, [$key, $value];
 795             } elsif (my $errmsg = $validity) {
 796                 warn "vm $vmid - $key: $errmsg\n";
 797             } else {
 798                 warn "vm $vmid - unable to parse config: $line\n";
 799             }
 800         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 801             $descr .= PVE::Tools::decode_text($2);
 802         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 803             $conf->{snapstate} = $1;
 804         } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
 805             my $value = $1;
 806             if ($section eq 'pending') {
 807                 $conf->{delete} = $value;
 808             } else {
 809                 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
 810             }
 811         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 812             my $key = $1;
 813             my $value = $2;
 814             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 815             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 816             $conf->{$key} = $value;
 817         } else {
 818             warn "vm $vmid - unable to parse config: $line\n";
 819         }
 820     }
 821
 822     $conf->{description} = $descr if $descr;
 823
 824     delete $res->{snapstate}; # just to be sure
 825
 826     return $res;
 827 }
 828
 829 sub write_pct_config {
 830     my ($filename, $conf) = @_;
 831
 832     delete $conf->{snapstate}; # just to be sure
 833
 834     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 835     my $used_volids = {};
 836     foreach my $vid (@$volidlist) {
 837         $used_volids->{$vid} = 1;
 838     }
 839
 840     # remove 'unusedX' settings if the volume is still used
 841     foreach my $key (keys %$conf) {
 842         my $value = $conf->{$key};
 843         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 844             delete $conf->{$key};
 845         }
 846     }
 847
 848     my $generate_raw_config = sub {
 849         my ($conf) = @_;
 850
 851         my $raw = '';
 852
 853         # add description as comment to top of file
 854         my $descr = $conf->{description} || '';
 855         foreach my $cl (split(/\n/, $descr)) {
 856             $raw .= '#' . PVE::Tools::encode_text($cl) . "\n";
 857         }
 858
 859         foreach my $key (sort keys %$conf) {
 860             next if $key eq 'digest' || $key eq 'description' ||
 861                     $key eq 'pending' || $key eq 'snapshots' ||
 862                     $key eq 'snapname' || $key eq 'lxc';
 863             my $value = $conf->{$key};
 864             die "detected invalid newline inside property '$key'\n"
 865                 if $value =~ m/\n/;
 866             $raw .= "$key: $value\n";
 867         }
 868
 869         if (my $lxcconf = $conf->{lxc}) {
 870             foreach my $entry (@$lxcconf) {
 871                 my ($k, $v) = @$entry;
 872                 $raw .= "$k: $v\n";
 873             }
 874         }
 875
 876         return $raw;
 877     };
 878
 879     my $raw = &$generate_raw_config($conf);
 880
 881     if (scalar(keys %{$conf->{pending}})){
 882         $raw .= "\n[pve:pending]\n";
 883         $raw .= &$generate_raw_config($conf->{pending});
 884     }
 885
 886     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 887         $raw .= "\n[$snapname]\n";
 888         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 889     }
 890
 891     return $raw;
 892 }
 893
 894 sub update_pct_config {
 895     my ($class, $vmid, $conf, $running, $param, $delete, $revert) = @_;
 896
 897     my $storage_cfg = PVE::Storage::config();
 898
 899     foreach my $opt (@$revert) {
 900         delete $conf->{pending}->{$opt};
 901         $class->remove_from_pending_delete($conf, $opt); # also remove from deletion queue
 902     }
 903
 904     # write updates to pending section
 905     my $modified = {}; # record modified options
 906
 907     foreach my $opt (@$delete) {
 908         if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
 909             warn "cannot delete '$opt' - not set in current configuration!\n";
 910             next;
 911         }
 912         $modified->{$opt} = 1;
 913         if ($opt eq 'memory' || $opt eq 'rootfs' || $opt eq 'ostype') {
 914             die "unable to delete required option '$opt'\n";
 915         } elsif ($opt =~ m/^unused(\d+)$/) {
 916             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 917         } elsif ($opt =~ m/^mp(\d+)$/) {
 918             $class->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 919         } elsif ($opt eq 'unprivileged') {
 920             die "unable to delete read-only option: '$opt'\n";
 921         }
 922         $class->add_to_pending_delete($conf, $opt);
 923     }
 924
 925     my $check_content_type = sub {
 926         my ($mp) = @_;
 927         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 928         my $storage_config = PVE::Storage::storage_config($storage_cfg, $sid);
 929         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 930             if !$storage_config->{content}->{rootdir};
 931     };
 932
 933     foreach my $opt (keys %$param) { # add/change
 934         $modified->{$opt} = 1;
 935         my $value = $param->{$opt};
 936         if ($opt =~ m/^mp(\d+)$/ || $opt eq 'rootfs') {
 937             $class->check_protection($conf, "can't update CT $vmid drive '$opt'");
 938             my $mp = $opt eq 'rootfs' ? $class->parse_ct_rootfs($value) : $class->parse_ct_mountpoint($value);
 939             $check_content_type->($mp);
 940         } elsif ($opt eq 'hookscript') {
 941             PVE::GuestHelpers::check_hookscript($value);
 942         } elsif ($opt eq 'nameserver') {
 943             $value = PVE::LXC::verify_nameserver_list($value);
 944         } elsif ($opt eq 'searchdomain') {
 945             $value = PVE::LXC::verify_searchdomain_list($value);
 946         } elsif ($opt eq 'unprivileged') {
 947             die "unable to modify read-only option: '$opt'\n";
 948         }
 949         $conf->{pending}->{$opt} = $value;
 950         $class->remove_from_pending_delete($conf, $opt);
 951     }
 952
 953     my $changes = $class->cleanup_pending($conf);
 954
 955     my $errors = {};
 956     if ($running) {
 957         $class->vmconfig_hotplug_pending($vmid, $conf, $storage_cfg, $modified, $errors);
 958     } else {
 959         $class->vmconfig_apply_pending($vmid, $conf, $storage_cfg, $modified, $errors);
 960     }
 961
 962     return $errors;
 963 }
 964
 965 sub check_type {
 966     my ($class, $key, $value) = @_;
 967
 968     die "unknown setting '$key'\n" if !$confdesc->{$key};
 969
 970     my $type = $confdesc->{$key}->{type};
 971
 972     if (!defined($value)) {
 973         die "got undefined value\n";
 974     }
 975
 976     if ($value =~ m/[\n\r]/) {
 977         die "property contains a line feed\n";
 978     }
 979
 980     if ($type eq 'boolean') {
 981         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
 982         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
 983         die "type check ('boolean') failed - got '$value'\n";
 984     } elsif ($type eq 'integer') {
 985         return int($1) if $value =~ m/^(\d+)$/;
 986         die "type check ('integer') failed - got '$value'\n";
 987     } elsif ($type eq 'number') {
 988         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
 989         die "type check ('number') failed - got '$value'\n";
 990     } elsif ($type eq 'string') {
 991         if (my $fmt = $confdesc->{$key}->{format}) {
 992             PVE::JSONSchema::check_format($fmt, $value);
 993             return $value;
 994         }
 995         return $value;
 996     } else {
 997         die "internal error"
 998     }
 999 }
1000
1001
1002 # add JSON properties for create and set function
1003 sub json_config_properties {
1004     my ($class, $prop) = @_;
1005
1006     foreach my $opt (keys %$confdesc) {
1007         next if $opt eq 'parent' || $opt eq 'snaptime';
1008         next if $prop->{$opt};
1009         $prop->{$opt} = $confdesc->{$opt};
1010     }
1011
1012     return $prop;
1013 }
1014
1015 sub __parse_ct_mountpoint_full {
1016     my ($class, $desc, $data, $noerr) = @_;
1017
1018     $data //= '';
1019
1020     my $res;
1021     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1022     if ($@) {
1023         return undef if $noerr;
1024         die $@;
1025     }
1026
1027     if (defined(my $size = $res->{size})) {
1028         $size = PVE::JSONSchema::parse_size($size);
1029         if (!defined($size)) {
1030             return undef if $noerr;
1031             die "invalid size: $size\n";
1032         }
1033         $res->{size} = $size;
1034     }
1035
1036     $res->{type} = $class->classify_mountpoint($res->{volume});
1037
1038     return $res;
1039 };
1040
1041 sub parse_ct_rootfs {
1042     my ($class, $data, $noerr) = @_;
1043
1044     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1045
1046     $res->{mp} = '/' if defined($res);
1047
1048     return $res;
1049 }
1050
1051 sub parse_ct_mountpoint {
1052     my ($class, $data, $noerr) = @_;
1053
1054     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1055 }
1056
1057 sub print_ct_mountpoint {
1058     my ($class, $info, $nomp) = @_;
1059     my $skip = [ 'type' ];
1060     push @$skip, 'mp' if $nomp;
1061     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1062 }
1063
1064 sub print_lxc_network {
1065     my ($class, $net) = @_;
1066     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1067 }
1068
1069 sub parse_lxc_network {
1070     my ($class, $data) = @_;
1071
1072     my $res = {};
1073
1074     return $res if !$data;
1075
1076     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1077
1078     $res->{type} = 'veth';
1079     if (!$res->{hwaddr}) {
1080         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1081         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1082     }
1083
1084     return $res;
1085 }
1086
1087 sub parse_features {
1088     my ($class, $data) = @_;
1089     return {} if !$data;
1090     return PVE::JSONSchema::parse_property_string($features_desc, $data);
1091 }
1092
1093 sub option_exists {
1094     my ($class, $name) = @_;
1095
1096     return defined($confdesc->{$name});
1097 }
1098 # END JSON config code
1099
1100 my $LXC_FASTPLUG_OPTIONS= {
1101     'description' => 1,
1102     'onboot' => 1,
1103     'startup' => 1,
1104     'protection' => 1,
1105     'hostname' => 1,
1106     'hookscript' => 1,
1107     'cores' => 1,
1108     'tags' => 1,
1109 };
1110
1111 sub vmconfig_hotplug_pending {
1112     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1113
1114     my $pid = PVE::LXC::find_lxc_pid($vmid);
1115     my $rootdir = "/proc/$pid/root";
1116
1117     my $add_hotplug_error = sub {
1118         my ($opt, $msg) = @_;
1119         $errors->{$opt} = "unable to hotplug $opt: $msg";
1120     };
1121
1122     my $changes;
1123     foreach my $opt (keys %{$conf->{pending}}) { # add/change
1124         next if $selection && !$selection->{$opt};
1125         if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1126             $conf->{$opt} = delete $conf->{pending}->{$opt};
1127             $changes = 1;
1128         }
1129     }
1130
1131     if ($changes) {
1132         $class->write_config($vmid, $conf);
1133     }
1134
1135     # There's no separate swap size to configure, there's memory and "total"
1136     # memory (iow. memory+swap). This means we have to change them together.
1137     my $hotplug_memory_done;
1138     my $hotplug_memory = sub {
1139         my ($wanted_memory, $wanted_swap) = @_;
1140         my $old_memory = ($conf->{memory} || $confdesc->{memory}->{default});
1141         my $old_swap = ($conf->{swap} || $confdesc->{swap}->{default});
1142
1143         $wanted_memory //= $old_memory;
1144         $wanted_swap //= $old_swap;
1145
1146         my $total = $wanted_memory + $wanted_swap;
1147         my $old_total = $old_memory + $old_swap;
1148
1149         if ($total > $old_total) {
1150             PVE::LXC::write_cgroup_value("memory", $vmid,
1151                                          "memory.memsw.limit_in_bytes",
1152                                          int($total*1024*1024));
1153             PVE::LXC::write_cgroup_value("memory", $vmid,
1154                                          "memory.limit_in_bytes",
1155                                          int($wanted_memory*1024*1024));
1156         } else {
1157             PVE::LXC::write_cgroup_value("memory", $vmid,
1158                                          "memory.limit_in_bytes",
1159                                          int($wanted_memory*1024*1024));
1160             PVE::LXC::write_cgroup_value("memory", $vmid,
1161                                          "memory.memsw.limit_in_bytes",
1162                                          int($total*1024*1024));
1163         }
1164         $hotplug_memory_done = 1;
1165     };
1166
1167     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1168     # FIXME: $force deletion is not implemented for CTs
1169     foreach my $opt (keys %$pending_delete_hash) {
1170         next if $selection && !$selection->{$opt};
1171         eval {
1172             if ($LXC_FASTPLUG_OPTIONS->{$opt}) {
1173                 # pass
1174             } elsif ($opt =~ m/^unused(\d+)$/) {
1175                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1176                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1177             } elsif ($opt eq 'swap') {
1178                 $hotplug_memory->(undef, 0);
1179             } elsif ($opt eq 'cpulimit') {
1180                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", -1);
1181                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1182             } elsif ($opt eq 'cpuunits') {
1183                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shared", $confdesc->{cpuunits}->{default});
1184             } elsif ($opt =~ m/^net(\d)$/) {
1185                 my $netid = $1;
1186                 PVE::Network::veth_delete("veth${vmid}i$netid");
1187             } else {
1188                 die "skip\n"; # skip non-hotpluggable opts
1189             }
1190         };
1191         if (my $err = $@) {
1192             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1193         } else {
1194             delete $conf->{$opt};
1195             $class->remove_from_pending_delete($conf, $opt);
1196         }
1197     }
1198
1199     foreach my $opt (keys %{$conf->{pending}}) {
1200         next if $opt eq 'delete'; # just to be sure
1201         next if $selection && !$selection->{$opt};
1202         my $value = $conf->{pending}->{$opt};
1203         eval {
1204             if ($opt eq 'cpulimit') {
1205                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_period_us", 100000);
1206                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1207             } elsif ($opt eq 'cpuunits') {
1208                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1209             } elsif ($opt =~ m/^net(\d+)$/) {
1210                 my $netid = $1;
1211                 my $net = $class->parse_lxc_network($value);
1212                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1213             } elsif ($opt eq 'memory' || $opt eq 'swap') {
1214                 if (!$hotplug_memory_done) { # don't call twice if both opts are passed
1215                     $hotplug_memory->($conf->{pending}->{memory}, $conf->{pending}->{swap});
1216                 }
1217             } else {
1218                 die "skip\n"; # skip non-hotpluggable
1219             }
1220         };
1221         if (my $err = $@) {
1222             $add_hotplug_error->($opt, $err) if $err ne "skip\n";
1223         } else {
1224             $conf->{$opt} = $value;
1225             delete $conf->{pending}->{$opt};
1226         }
1227     }
1228
1229     $class->write_config($vmid, $conf);
1230 }
1231
1232 sub vmconfig_apply_pending {
1233     my ($class, $vmid, $conf, $storecfg, $selection, $errors) = @_;
1234
1235     my $add_apply_error = sub {
1236         my ($opt, $msg) = @_;
1237         my $err_msg = "unable to apply pending change $opt : $msg";
1238         $errors->{$opt} = $err_msg;
1239         warn $err_msg;
1240     };
1241
1242     my $rescan_volume = sub {
1243         my ($mp) = @_;
1244         eval {
1245             $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5)
1246                 if !defined($mp->{size});
1247         };
1248         warn "Could not rescan volume size - $@\n" if $@;
1249     };
1250
1251     my $pending_delete_hash = $class->parse_pending_delete($conf->{pending}->{delete});
1252     # FIXME: $force deletion is not implemented for CTs
1253     foreach my $opt (keys %$pending_delete_hash) {
1254         next if $selection && !$selection->{$opt};
1255         $class->cleanup_pending($conf);
1256         eval {
1257             if ($opt =~ m/^mp(\d+)$/) {
1258                 my $mp = $class->parse_ct_mountpoint($conf->{$opt});
1259                 if ($mp->{type} eq 'volume') {
1260                     $class->add_unused_volume($conf, $mp->{volume})
1261                         if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1262                 }
1263             } elsif ($opt =~ m/^unused(\d+)$/) {
1264                 PVE::LXC::delete_mountpoint_volume($storecfg, $vmid, $conf->{$opt})
1265                     if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1266             }
1267         };
1268         if (my $err = $@) {
1269             $add_apply_error->($opt, $err);
1270         } else {
1271             delete $conf->{$opt};
1272             $class->remove_from_pending_delete($conf, $opt);
1273         }
1274     }
1275
1276     foreach my $opt (keys %{$conf->{pending}}) { # add/change
1277         next if $opt eq 'delete'; # just to be sure
1278         next if $selection && !$selection->{$opt};
1279         eval {
1280             if ($opt =~ m/^mp(\d+)$/) {
1281                 my $mp = $class->parse_ct_mountpoint($conf->{pending}->{$opt});
1282                 my $old = $conf->{$opt};
1283                 if ($mp->{type} eq 'volume') {
1284                     if ($mp->{volume} =~ $PVE::LXC::NEW_DISK_RE) {
1285                         PVE::LXC::create_disks($storecfg, $vmid, { $opt => $conf->{pending}->{$opt} }, $conf, 1);
1286                     } else {
1287                         $rescan_volume->($mp);
1288                         $conf->{pending}->{$opt} = $class->print_ct_mountpoint($mp);
1289                     }
1290                 }
1291                 if (defined($old)) {
1292                     my $mp = $class->parse_ct_mountpoint($old);
1293                     if ($mp->{type} eq 'volume') {
1294                         $class->add_unused_volume($conf, $mp->{volume})
1295                             if !$class->is_volume_in_use($conf, $conf->{$opt}, 1, 1);
1296                     }
1297                 }
1298             }
1299         };
1300         if (my $err = $@) {
1301             $add_apply_error->($opt, $err);
1302         } else {
1303             $class->cleanup_pending($conf);
1304             $conf->{$opt} = delete $conf->{pending}->{$opt};
1305         }
1306     }
1307
1308     $class->write_config($vmid, $conf);
1309 }
1310
1311 sub classify_mountpoint {
1312     my ($class, $vol) = @_;
1313     if ($vol =~ m!^/!) {
1314         return 'device' if $vol =~ m!^/dev/!;
1315         return 'bind';
1316     }
1317     return 'volume';
1318 }
1319
1320 my $__is_volume_in_use = sub {
1321     my ($class, $config, $volid) = @_;
1322     my $used = 0;
1323
1324     $class->foreach_mountpoint($config, sub {
1325         my ($ms, $mountpoint) = @_;
1326         return if $used;
1327         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1328     });
1329
1330     return $used;
1331 };
1332
1333 sub is_volume_in_use_by_snapshots {
1334     my ($class, $config, $volid) = @_;
1335
1336     if (my $snapshots = $config->{snapshots}) {
1337         foreach my $snap (keys %$snapshots) {
1338             return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1339         }
1340     }
1341
1342     return 0;
1343 }
1344
1345 sub is_volume_in_use {
1346     my ($class, $config, $volid, $include_snapshots, $include_pending) = @_;
1347     return 1 if $__is_volume_in_use->($class, $config, $volid);
1348     return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1349     return 1 if $include_pending && $__is_volume_in_use->($class, $config->{pending}, $volid);
1350     return 0;
1351 }
1352
1353 sub has_dev_console {
1354     my ($class, $conf) = @_;
1355
1356     return !(defined($conf->{console}) && !$conf->{console});
1357 }
1358
1359 sub has_lxc_entry {
1360     my ($class, $conf, $keyname) = @_;
1361
1362     if (my $lxcconf = $conf->{lxc}) {
1363         foreach my $entry (@$lxcconf) {
1364             my ($key, undef) = @$entry;
1365             return 1 if $key eq $keyname;
1366         }
1367     }
1368
1369     return 0;
1370 }
1371
1372 sub get_tty_count {
1373     my ($class, $conf) = @_;
1374
1375     return $conf->{tty} // $confdesc->{tty}->{default};
1376 }
1377
1378 sub get_cmode {
1379     my ($class, $conf) = @_;
1380
1381     return $conf->{cmode} // $confdesc->{cmode}->{default};
1382 }
1383
1384 sub mountpoint_names {
1385     my ($class, $reverse) = @_;
1386
1387     my @names = ('rootfs');
1388
1389     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1390         push @names, "mp$i";
1391     }
1392
1393     return $reverse ? reverse @names : @names;
1394 }
1395
1396 sub foreach_mountpoint_full {
1397     my ($class, $conf, $reverse, $func, @param) = @_;
1398
1399     my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1400     foreach my $key (@$mps) {
1401         my $value = $conf->{$key};
1402         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1403         next if !defined($mountpoint);
1404
1405         &$func($key, $mountpoint, @param);
1406     }
1407 }
1408
1409 sub foreach_mountpoint {
1410     my ($class, $conf, $func, @param) = @_;
1411
1412     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1413 }
1414
1415 sub foreach_mountpoint_reverse {
1416     my ($class, $conf, $func, @param) = @_;
1417
1418     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1419 }
1420
1421 sub get_vm_volumes {
1422     my ($class, $conf, $excludes) = @_;
1423
1424     my $vollist = [];
1425
1426     $class->foreach_mountpoint($conf, sub {
1427         my ($ms, $mountpoint) = @_;
1428
1429         return if $excludes && $ms eq $excludes;
1430
1431         my $volid = $mountpoint->{volume};
1432         return if !$volid || $mountpoint->{type} ne 'volume';
1433
1434         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1435         return if !$sid;
1436
1437         push @$vollist, $volid;
1438     });
1439
1440     return $vollist;
1441 }
1442
1443 sub get_replicatable_volumes {
1444     my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1445
1446     my $volhash = {};
1447
1448     my $test_volid = sub {
1449         my ($volid, $mountpoint) = @_;
1450
1451         return if !$volid;
1452
1453         my $mptype = $mountpoint->{type};
1454         my $replicate = $mountpoint->{replicate} // 1;
1455
1456         if ($mptype ne 'volume') {
1457             # skip bindmounts if replicate = 0 even for cleanup,
1458             # since bind mounts could not have been replicated ever
1459             return if !$replicate;
1460             die "unable to replicate mountpoint type '$mptype'\n";
1461         }
1462
1463         my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1464         return if !$storeid;
1465
1466         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1467         return if $scfg->{shared};
1468
1469         my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1470         return if !$owner || ($owner != $vmid);
1471
1472         die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1473
1474         return if !$cleanup && !$replicate;
1475
1476         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1477             return if $cleanup || $noerr;
1478             die "missing replicate feature on volume '$volid'\n";
1479         }
1480
1481         $volhash->{$volid} = 1;
1482     };
1483
1484     $class->foreach_mountpoint($conf, sub {
1485         my ($ms, $mountpoint) = @_;
1486         $test_volid->($mountpoint->{volume}, $mountpoint);
1487     });
1488
1489     foreach my $snapname (keys %{$conf->{snapshots}}) {
1490         my $snap = $conf->{snapshots}->{$snapname};
1491         $class->foreach_mountpoint($snap, sub {
1492             my ($ms, $mountpoint) = @_;
1493             $test_volid->($mountpoint->{volume}, $mountpoint);
1494         });
1495     }
1496
1497     # add 'unusedX' volumes to volhash
1498     foreach my $key (keys %$conf) {
1499         if ($key =~ m/^unused/) {
1500             $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1501         }
1502     }
1503
1504     return $volhash;
1505 }
1506
1507 1;