src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::GuestHelpers;
   9 use PVE::INotify;
  10 use PVE::JSONSchema qw(get_standard_option);
  11 use PVE::Tools;
  12
  13 use base qw(PVE::AbstractConfig);
  14
  15 my $nodename = PVE::INotify::nodename();
  16 my $lock_handles =  {};
  17 my $lockdir = "/run/lock/lxc";
  18 mkdir $lockdir;
  19 mkdir "/etc/pve/nodes/$nodename/lxc";
  20 my $MAX_MOUNT_POINTS = 256;
  21 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  22
  23 # BEGIN implemented abstract methods from PVE::AbstractConfig
  24
  25 sub guest_type {
  26     return "CT";
  27 }
  28
  29 sub __config_max_unused_disks {
  30     my ($class) = @_;
  31
  32     return $MAX_UNUSED_DISKS;
  33 }
  34
  35 sub config_file_lock {
  36     my ($class, $vmid) = @_;
  37
  38     return "$lockdir/pve-config-${vmid}.lock";
  39 }
  40
  41 sub cfs_config_path {
  42     my ($class, $vmid, $node) = @_;
  43
  44     $node = $nodename if !$node;
  45     return "nodes/$node/lxc/$vmid.conf";
  46 }
  47
  48 sub mountpoint_backup_enabled {
  49     my ($class, $mp_key, $mountpoint) = @_;
  50
  51     return 1 if $mp_key eq 'rootfs';
  52
  53     return 0 if $mountpoint->{type} ne 'volume';
  54
  55     return 1 if $mountpoint->{backup};
  56
  57     return 0;
  58 }
  59
  60 sub has_feature {
  61     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  62     my $err;
  63
  64     $class->foreach_mountpoint($conf, sub {
  65         my ($ms, $mountpoint) = @_;
  66
  67         return if $err; # skip further test
  68         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  69
  70         $err = 1
  71             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  72                                                  $mountpoint->{volume},
  73                                                  $snapname, $running);
  74     });
  75
  76     return $err ? 0 : 1;
  77 }
  78
  79 sub __snapshot_save_vmstate {
  80     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  81     die "implement me - snapshot_save_vmstate\n";
  82 }
  83
  84 sub __snapshot_check_running {
  85     my ($class, $vmid) = @_;
  86     return PVE::LXC::check_running($vmid);
  87 }
  88
  89 sub __snapshot_check_freeze_needed {
  90     my ($class, $vmid, $config, $save_vmstate) = @_;
  91
  92     my $ret = $class->__snapshot_check_running($vmid);
  93     return ($ret, $ret);
  94 }
  95
  96 sub __snapshot_freeze {
  97     my ($class, $vmid, $unfreeze) = @_;
  98
  99     if ($unfreeze) {
 100         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 101         warn $@ if $@;
 102     } else {
 103         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 104         PVE::LXC::sync_container_namespace($vmid);
 105     }
 106 }
 107
 108 sub __snapshot_create_vol_snapshot {
 109     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 110
 111     my $storecfg = PVE::Storage::config();
 112
 113     return if $snapname eq 'vzdump' &&
 114         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 115
 116     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 117 }
 118
 119 sub __snapshot_delete_remove_drive {
 120     my ($class, $snap, $remove_drive) = @_;
 121
 122     if ($remove_drive eq 'vmstate') {
 123         die "implement me - saving vmstate\n";
 124     } else {
 125         my $value = $snap->{$remove_drive};
 126         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 127         delete $snap->{$remove_drive};
 128
 129         $class->add_unused_volume($snap, $mountpoint->{volume})
 130             if ($mountpoint->{type} eq 'volume');
 131     }
 132 }
 133
 134 sub __snapshot_delete_vmstate_file {
 135     my ($class, $snap, $force) = @_;
 136
 137     die "implement me - saving vmstate\n";
 138 }
 139
 140 sub __snapshot_delete_vol_snapshot {
 141     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 142
 143     return if $snapname eq 'vzdump' &&
 144         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 145
 146     my $storecfg = PVE::Storage::config();
 147     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 148     push @$unused, $mountpoint->{volume};
 149 }
 150
 151 sub __snapshot_rollback_vol_possible {
 152     my ($class, $mountpoint, $snapname) = @_;
 153
 154     my $storecfg = PVE::Storage::config();
 155     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 156 }
 157
 158 sub __snapshot_rollback_vol_rollback {
 159     my ($class, $mountpoint, $snapname) = @_;
 160
 161     my $storecfg = PVE::Storage::config();
 162     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 163 }
 164
 165 sub __snapshot_rollback_vm_stop {
 166     my ($class, $vmid) = @_;
 167
 168     PVE::LXC::vm_stop($vmid, 1)
 169         if $class->__snapshot_check_running($vmid);
 170 }
 171
 172 sub __snapshot_rollback_vm_start {
 173     my ($class, $vmid, $vmstate, $data);
 174
 175     die "implement me - save vmstate\n";
 176 }
 177
 178 sub __snapshot_rollback_get_unused {
 179     my ($class, $conf, $snap) = @_;
 180
 181     my $unused = [];
 182
 183     $class->__snapshot_foreach_volume($conf, sub {
 184         my ($vs, $volume) = @_;
 185
 186         return if $volume->{type} ne 'volume';
 187
 188         my $found = 0;
 189         my $volid = $volume->{volume};
 190
 191         $class->__snapshot_foreach_volume($snap, sub {
 192             my ($ms, $mountpoint) = @_;
 193
 194             return if $found;
 195             return if ($mountpoint->{type} ne 'volume');
 196
 197             $found = 1
 198                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 199         });
 200
 201         push @$unused, $volid if !$found;
 202     });
 203
 204     return $unused;
 205 }
 206
 207 sub __snapshot_foreach_volume {
 208     my ($class, $conf, $func) = @_;
 209
 210     $class->foreach_mountpoint($conf, $func);
 211 }
 212
 213 # END implemented abstract methods from PVE::AbstractConfig
 214
 215 # BEGIN JSON config code
 216
 217 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 218
 219
 220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
 221
 222 sub is_valid_mount_option {
 223     my ($option) = @_;
 224     return $option =~ $valid_mount_option_re;
 225 }
 226
 227 my $rootfs_desc = {
 228     volume => {
 229         type => 'string',
 230         default_key => 1,
 231         format => 'pve-lxc-mp-string',
 232         format_description => 'volume',
 233         description => 'Volume, device or directory to mount into the container.',
 234     },
 235     size => {
 236         type => 'string',
 237         format => 'disk-size',
 238         format_description => 'DiskSize',
 239         description => 'Volume size (read only value).',
 240         optional => 1,
 241     },
 242     acl => {
 243         type => 'boolean',
 244         description => 'Explicitly enable or disable ACL support.',
 245         optional => 1,
 246     },
 247     mountoptions => {
 248         optional => 1,
 249         type => 'string',
 250         description => 'Extra mount options for rootfs/mps.',
 251         format_description => 'opt[;opt...]',
 252         pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
 253     },
 254     ro => {
 255         type => 'boolean',
 256         description => 'Read-only mount point',
 257         optional => 1,
 258     },
 259     quota => {
 260         type => 'boolean',
 261         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 262         optional => 1,
 263     },
 264     replicate => {
 265         type => 'boolean',
 266         description => 'Will include this volume to a storage replica job.',
 267         optional => 1,
 268         default => 1,
 269     },
 270     shared => {
 271         type => 'boolean',
 272         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 273         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 274         optional => 1,
 275         default => 0,
 276     },
 277 };
 278
 279 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 280     type => 'string', format => $rootfs_desc,
 281     description => "Use volume as container root.",
 282     optional => 1,
 283 });
 284
 285 my $features_desc = {
 286     mount => {
 287         optional => 1,
 288         type => 'string',
 289         description => "Allow mounting file systems of specific types."
 290             ." This should be a list of file system types as used with the mount command."
 291             ." Note that this can have negative effects on the container's security."
 292             ." With access to a loop device, mounting a file can circumvent the mknod"
 293             ." permission of the devices cgroup, mounting an NFS file system can"
 294             ." block the host's I/O completely and prevent it from rebooting, etc.",
 295         format_description => 'fstype;fstype;...',
 296         pattern => qr/[a-zA-Z0-9_; ]+/,
 297     },
 298     nesting => {
 299         optional => 1,
 300         type => 'boolean',
 301         default => 0,
 302         description => "Allow nesting."
 303             ." Best used with unprivileged containers with additional id mapping."
 304             ." Note that this will expose procfs and sysfs contents of the host"
 305             ." to the guest.",
 306     },
 307     keyctl => {
 308         optional => 1,
 309         type => 'boolean',
 310         default => 0,
 311         description => "For unprivileged containers only: Allow the use of the keyctl() system call."
 312             ." This is required to use docker inside a container."
 313             ." By default unprivileged containers will see this system call as non-existent."
 314             ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
 315             ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
 316             ." Essentially, you can choose between running systemd-networkd or docker.",
 317     },
 318     fuse => {
 319         optional => 1,
 320         type => 'boolean',
 321         default => 0,
 322         description => "Allow using 'fuse' file systems in a container."
 323             ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
 324     },
 325 };
 326
 327 my $confdesc = {
 328     lock => {
 329         optional => 1,
 330         type => 'string',
 331         description => "Lock/unlock the VM.",
 332         enum => [qw(backup create destroyed disk fstrim migrate mounted rollback snapshot snapshot-delete)],
 333     },
 334     onboot => {
 335         optional => 1,
 336         type => 'boolean',
 337         description => "Specifies whether a VM will be started during system bootup.",
 338         default => 0,
 339     },
 340     startup => get_standard_option('pve-startup-order'),
 341     template => {
 342         optional => 1,
 343         type => 'boolean',
 344         description => "Enable/disable Template.",
 345         default => 0,
 346     },
 347     arch => {
 348         optional => 1,
 349         type => 'string',
 350         enum => ['amd64', 'i386', 'arm64', 'armhf'],
 351         description => "OS architecture type.",
 352         default => 'amd64',
 353     },
 354     ostype => {
 355         optional => 1,
 356         type => 'string',
 357         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 358         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 359     },
 360     console => {
 361         optional => 1,
 362         type => 'boolean',
 363         description => "Attach a console device (/dev/console) to the container.",
 364         default => 1,
 365     },
 366     tty => {
 367         optional => 1,
 368         type => 'integer',
 369         description => "Specify the number of tty available to the container",
 370         minimum => 0,
 371         maximum => 6,
 372         default => 2,
 373     },
 374     cores => {
 375         optional => 1,
 376         type => 'integer',
 377         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 378         minimum => 1,
 379         maximum => 128,
 380     },
 381     cpulimit => {
 382         optional => 1,
 383         type => 'number',
 384         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 385         minimum => 0,
 386         maximum => 128,
 387         default => 0,
 388     },
 389     cpuunits => {
 390         optional => 1,
 391         type => 'integer',
 392         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 393         minimum => 0,
 394         maximum => 500000,
 395         default => 1024,
 396     },
 397     memory => {
 398         optional => 1,
 399         type => 'integer',
 400         description => "Amount of RAM for the VM in MB.",
 401         minimum => 16,
 402         default => 512,
 403     },
 404     swap => {
 405         optional => 1,
 406         type => 'integer',
 407         description => "Amount of SWAP for the VM in MB.",
 408         minimum => 0,
 409         default => 512,
 410     },
 411     hostname => {
 412         optional => 1,
 413         description => "Set a host name for the container.",
 414         type => 'string', format => 'dns-name',
 415         maxLength => 255,
 416     },
 417     description => {
 418         optional => 1,
 419         type => 'string',
 420         description => "Container description. Only used on the configuration web interface.",
 421     },
 422     searchdomain => {
 423         optional => 1,
 424         type => 'string', format => 'dns-name-list',
 425         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 426     },
 427     nameserver => {
 428         optional => 1,
 429         type => 'string', format => 'address-list',
 430         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 431     },
 432     rootfs => get_standard_option('pve-ct-rootfs'),
 433     parent => {
 434         optional => 1,
 435         type => 'string', format => 'pve-configid',
 436         maxLength => 40,
 437         description => "Parent snapshot name. This is used internally, and should not be modified.",
 438     },
 439     snaptime => {
 440         optional => 1,
 441         description => "Timestamp for snapshots.",
 442         type => 'integer',
 443         minimum => 0,
 444     },
 445     cmode => {
 446         optional => 1,
 447         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 448         type => 'string',
 449         enum => ['shell', 'console', 'tty'],
 450         default => 'tty',
 451     },
 452     protection => {
 453         optional => 1,
 454         type => 'boolean',
 455         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 456         default => 0,
 457     },
 458     unprivileged => {
 459         optional => 1,
 460         type => 'boolean',
 461         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 462         default => 0,
 463     },
 464     features => {
 465         optional => 1,
 466         type => 'string',
 467         format => $features_desc,
 468         description => "Allow containers access to advanced features.",
 469     },
 470     hookscript => {
 471         optional => 1,
 472         type => 'string',
 473         format => 'pve-volume-id',
 474         description => 'Script that will be exectued during various steps in the containers lifetime.',
 475     },
 476 };
 477
 478 my $valid_lxc_conf_keys = {
 479     'lxc.apparmor.profile' => 1,
 480     'lxc.apparmor.allow_incomplete' => 1,
 481     'lxc.apparmor.allow_nesting' => 1,
 482     'lxc.apparmor.raw' => 1,
 483     'lxc.selinux.context' => 1,
 484     'lxc.include' => 1,
 485     'lxc.arch' => 1,
 486     'lxc.uts.name' => 1,
 487     'lxc.signal.halt' => 1,
 488     'lxc.signal.reboot' => 1,
 489     'lxc.signal.stop' => 1,
 490     'lxc.init.cmd' => 1,
 491     'lxc.pty.max' => 1,
 492     'lxc.console.logfile' => 1,
 493     'lxc.console.path' => 1,
 494     'lxc.tty.max' => 1,
 495     'lxc.devtty.dir' => 1,
 496     'lxc.hook.autodev' => 1,
 497     'lxc.autodev' => 1,
 498     'lxc.kmsg' => 1,
 499     'lxc.mount.fstab' => 1,
 500     'lxc.mount.entry' => 1,
 501     'lxc.mount.auto' => 1,
 502     'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
 503     'lxc.rootfs.mount' => 1,
 504     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 505                             ', please use mount point options in the "rootfs" key',
 506     # lxc.cgroup.*
 507     # lxc.prlimit.*
 508     # lxc.net.*
 509     'lxc.cap.drop' => 1,
 510     'lxc.cap.keep' => 1,
 511     'lxc.seccomp.profile' => 1,
 512     'lxc.seccomp.notify.proxy' => 1,
 513     'lxc.seccomp.notify.cookie' => 1,
 514     'lxc.idmap' => 1,
 515     'lxc.hook.pre-start' => 1,
 516     'lxc.hook.pre-mount' => 1,
 517     'lxc.hook.mount' => 1,
 518     'lxc.hook.start' => 1,
 519     'lxc.hook.stop' => 1,
 520     'lxc.hook.post-stop' => 1,
 521     'lxc.hook.clone' => 1,
 522     'lxc.hook.destroy' => 1,
 523     'lxc.log.level' => 1,
 524     'lxc.log.file' => 1,
 525     'lxc.start.auto' => 1,
 526     'lxc.start.delay' => 1,
 527     'lxc.start.order' => 1,
 528     'lxc.group' => 1,
 529     'lxc.environment' => 1,
 530
 531     # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
 532     'lxc.sysctl.fs.mqueue' => 1,
 533     'lxc.sysctl.kernel.msgmax' => 1,
 534     'lxc.sysctl.kernel.msgmnb' => 1,
 535     'lxc.sysctl.kernel.msgmni' => 1,
 536     'lxc.sysctl.kernel.sem' => 1,
 537     'lxc.sysctl.kernel.shmall' => 1,
 538     'lxc.sysctl.kernel.shmmax' => 1,
 539     'lxc.sysctl.kernel.shmmni' => 1,
 540     'lxc.sysctl.kernel.shm_rmid_forced' => 1,
 541 };
 542
 543 my $deprecated_lxc_conf_keys = {
 544     # Deprecated (removed with lxc 3.0):
 545     'lxc.aa_profile'           => 'lxc.apparmor.profile',
 546     'lxc.aa_allow_incomplete'  => 'lxc.apparmor.allow_incomplete',
 547     'lxc.console'              => 'lxc.console.path',
 548     'lxc.devttydir'            => 'lxc.tty.dir',
 549     'lxc.haltsignal'           => 'lxc.signal.halt',
 550     'lxc.rebootsignal'         => 'lxc.signal.reboot',
 551     'lxc.stopsignal'           => 'lxc.signal.stop',
 552     'lxc.id_map'               => 'lxc.idmap',
 553     'lxc.init_cmd'             => 'lxc.init.cmd',
 554     'lxc.loglevel'             => 'lxc.log.level',
 555     'lxc.logfile'              => 'lxc.log.file',
 556     'lxc.mount'                => 'lxc.mount.fstab',
 557     'lxc.network.type'         => 'lxc.net.INDEX.type',
 558     'lxc.network.flags'        => 'lxc.net.INDEX.flags',
 559     'lxc.network.link'         => 'lxc.net.INDEX.link',
 560     'lxc.network.mtu'          => 'lxc.net.INDEX.mtu',
 561     'lxc.network.name'         => 'lxc.net.INDEX.name',
 562     'lxc.network.hwaddr'       => 'lxc.net.INDEX.hwaddr',
 563     'lxc.network.ipv4'         => 'lxc.net.INDEX.ipv4.address',
 564     'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
 565     'lxc.network.ipv6'         => 'lxc.net.INDEX.ipv6.address',
 566     'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
 567     'lxc.network.script.up'    => 'lxc.net.INDEX.script.up',
 568     'lxc.network.script.down'  => 'lxc.net.INDEX.script.down',
 569     'lxc.pts'                  => 'lxc.pty.max',
 570     'lxc.se_context'           => 'lxc.selinux.context',
 571     'lxc.seccomp'              => 'lxc.seccomp.profile',
 572     'lxc.tty'                  => 'lxc.tty.max',
 573     'lxc.utsname'              => 'lxc.uts.name',
 574 };
 575
 576 sub is_valid_lxc_conf_key {
 577     my ($vmid, $key) = @_;
 578     if ($key =~ /^lxc\.limit\./) {
 579         warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
 580         return 1;
 581     }
 582     if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
 583         warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
 584         return 1;
 585     }
 586     my $validity = $valid_lxc_conf_keys->{$key};
 587     return $validity if defined($validity);
 588     return 1 if $key =~ /^lxc\.cgroup\./  # allow all cgroup values
 589              || $key =~ /^lxc\.prlimit\./ # allow all prlimits
 590              || $key =~ /^lxc\.net\./;    # allow custom network definitions
 591     return 0;
 592 }
 593
 594 our $netconf_desc = {
 595     type => {
 596         type => 'string',
 597         optional => 1,
 598         description => "Network interface type.",
 599         enum => [qw(veth)],
 600     },
 601     name => {
 602         type => 'string',
 603         format_description => 'string',
 604         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 605         pattern => '[-_.\w\d]+',
 606     },
 607     bridge => {
 608         type => 'string',
 609         format_description => 'bridge',
 610         description => 'Bridge to attach the network device to.',
 611         pattern => '[-_.\w\d]+',
 612         optional => 1,
 613     },
 614     hwaddr => get_standard_option('mac-addr', {
 615         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 616         }),
 617     mtu => {
 618         type => 'integer',
 619         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 620         minimum => 64, # minimum ethernet frame is 64 bytes
 621         optional => 1,
 622     },
 623     ip => {
 624         type => 'string',
 625         format => 'pve-ipv4-config',
 626         format_description => '(IPv4/CIDR|dhcp|manual)',
 627         description => 'IPv4 address in CIDR format.',
 628         optional => 1,
 629     },
 630     gw => {
 631         type => 'string',
 632         format => 'ipv4',
 633         format_description => 'GatewayIPv4',
 634         description => 'Default gateway for IPv4 traffic.',
 635         optional => 1,
 636     },
 637     ip6 => {
 638         type => 'string',
 639         format => 'pve-ipv6-config',
 640         format_description => '(IPv6/CIDR|auto|dhcp|manual)',
 641         description => 'IPv6 address in CIDR format.',
 642         optional => 1,
 643     },
 644     gw6 => {
 645         type => 'string',
 646         format => 'ipv6',
 647         format_description => 'GatewayIPv6',
 648         description => 'Default gateway for IPv6 traffic.',
 649         optional => 1,
 650     },
 651     firewall => {
 652         type => 'boolean',
 653         description => "Controls whether this interface's firewall rules should be used.",
 654         optional => 1,
 655     },
 656     tag => {
 657         type => 'integer',
 658         minimum => 1,
 659         maximum => 4094,
 660         description => "VLAN tag for this interface.",
 661         optional => 1,
 662     },
 663     trunks => {
 664         type => 'string',
 665         pattern => qr/\d+(?:;\d+)*/,
 666         format_description => 'vlanid[;vlanid...]',
 667         description => "VLAN ids to pass through the interface",
 668         optional => 1,
 669     },
 670     rate => {
 671         type => 'number',
 672         format_description => 'mbps',
 673         description => "Apply rate limiting to the interface",
 674         optional => 1,
 675     },
 676 };
 677 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 678
 679 my $MAX_LXC_NETWORKS = 10;
 680 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 681     $confdesc->{"net$i"} = {
 682         optional => 1,
 683         type => 'string', format => $netconf_desc,
 684         description => "Specifies network interfaces for the container.",
 685     };
 686 }
 687
 688 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 689 sub verify_lxc_mp_string {
 690     my ($mp, $noerr) = @_;
 691
 692     # do not allow:
 693     # /./ or /../
 694     # /. or /.. at the end
 695     # ../ at the beginning
 696
 697     if($mp =~ m@/\.\.?/@ ||
 698        $mp =~ m@/\.\.?$@ ||
 699        $mp =~ m@^\.\./@) {
 700         return undef if $noerr;
 701         die "$mp contains illegal character sequences\n";
 702     }
 703     return $mp;
 704 }
 705
 706 my $mp_desc = {
 707     %$rootfs_desc,
 708     backup => {
 709         type => 'boolean',
 710         description => 'Whether to include the mount point in backups.',
 711         verbose_description => 'Whether to include the mount point in backups '.
 712                                '(only used for volume mount points).',
 713         optional => 1,
 714     },
 715     mp => {
 716         type => 'string',
 717         format => 'pve-lxc-mp-string',
 718         format_description => 'Path',
 719         description => 'Path to the mount point as seen from inside the container '.
 720                        '(must not contain symlinks).',
 721         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 722                                "NOTE: Must not contain any symlinks for security reasons."
 723     },
 724 };
 725 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 726
 727 my $unuseddesc = {
 728     optional => 1,
 729     type => 'string', format => 'pve-volume-id',
 730     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 731 };
 732
 733 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 734     $confdesc->{"mp$i"} = {
 735         optional => 1,
 736         type => 'string', format => $mp_desc,
 737         description => "Use volume as container mount point.",
 738         optional => 1,
 739     };
 740 }
 741
 742 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 743     $confdesc->{"unused$i"} = $unuseddesc;
 744 }
 745
 746 sub parse_pct_config {
 747     my ($filename, $raw) = @_;
 748
 749     return undef if !defined($raw);
 750
 751     my $res = {
 752         digest => Digest::SHA::sha1_hex($raw),
 753         snapshots => {},
 754         pending => {},
 755     };
 756
 757     $filename =~ m|/lxc/(\d+).conf$|
 758         || die "got strange filename '$filename'";
 759
 760     my $vmid = $1;
 761
 762     my $conf = $res;
 763     my $descr = '';
 764     my $section = '';
 765
 766     my @lines = split(/\n/, $raw);
 767     foreach my $line (@lines) {
 768         next if $line =~ m/^\s*$/;
 769
 770         if ($line =~ m/^\[pve:pending\]\s*$/i) {
 771             $section = 'pending';
 772             $conf->{description} = $descr if $descr;
 773             $descr = '';
 774             $conf = $res->{$section} = {};
 775             next;
 776         } elsif ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 777             $section = $1;
 778             $conf->{description} = $descr if $descr;
 779             $descr = '';
 780             $conf = $res->{snapshots}->{$section} = {};
 781             next;
 782         }
 783
 784         if ($line =~ m/^\#(.*)\s*$/) {
 785             $descr .= PVE::Tools::decode_text($1) . "\n";
 786             next;
 787         }
 788
 789         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 790             my $key = $1;
 791             my $value = $3;
 792             my $validity = is_valid_lxc_conf_key($vmid, $key);
 793             if ($validity eq 1) {
 794                 push @{$conf->{lxc}}, [$key, $value];
 795             } elsif (my $errmsg = $validity) {
 796                 warn "vm $vmid - $key: $errmsg\n";
 797             } else {
 798                 warn "vm $vmid - unable to parse config: $line\n";
 799             }
 800         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 801             $descr .= PVE::Tools::decode_text($2);
 802         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 803             $conf->{snapstate} = $1;
 804         } elsif ($line =~ m/^delete:\s*(.*\S)\s*$/) {
 805             my $value = $1;
 806             if ($section eq 'pending') {
 807                 $conf->{delete} = $value;
 808             } else {
 809                 warn "vm $vmid - property 'delete' is only allowed in [pve:pending]\n";
 810             }
 811         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 812             my $key = $1;
 813             my $value = $2;
 814             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 815             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 816             $conf->{$key} = $value;
 817         } else {
 818             warn "vm $vmid - unable to parse config: $line\n";
 819         }
 820     }
 821
 822     $conf->{description} = $descr if $descr;
 823
 824     delete $res->{snapstate}; # just to be sure
 825
 826     return $res;
 827 }
 828
 829 sub write_pct_config {
 830     my ($filename, $conf) = @_;
 831
 832     delete $conf->{snapstate}; # just to be sure
 833
 834     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 835     my $used_volids = {};
 836     foreach my $vid (@$volidlist) {
 837         $used_volids->{$vid} = 1;
 838     }
 839
 840     # remove 'unusedX' settings if the volume is still used
 841     foreach my $key (keys %$conf) {
 842         my $value = $conf->{$key};
 843         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 844             delete $conf->{$key};
 845         }
 846     }
 847
 848     my $generate_raw_config = sub {
 849         my ($conf) = @_;
 850
 851         my $raw = '';
 852
 853         # add description as comment to top of file
 854         my $descr = $conf->{description} || '';
 855         foreach my $cl (split(/\n/, $descr)) {
 856             $raw .= '#' . PVE::Tools::encode_text($cl) . "\n";
 857         }
 858
 859         foreach my $key (sort keys %$conf) {
 860             next if $key eq 'digest' || $key eq 'description' ||
 861                     $key eq 'pending' || $key eq 'snapshots' ||
 862                     $key eq 'snapname' || $key eq 'lxc';
 863             my $value = $conf->{$key};
 864             die "detected invalid newline inside property '$key'\n"
 865                 if $value =~ m/\n/;
 866             $raw .= "$key: $value\n";
 867         }
 868
 869         if (my $lxcconf = $conf->{lxc}) {
 870             foreach my $entry (@$lxcconf) {
 871                 my ($k, $v) = @$entry;
 872                 $raw .= "$k: $v\n";
 873             }
 874         }
 875
 876         return $raw;
 877     };
 878
 879     my $raw = &$generate_raw_config($conf);
 880
 881     if (scalar(keys %{$conf->{pending}})){
 882         $raw .= "\n[pve:pending]\n";
 883         $raw .= &$generate_raw_config($conf->{pending});
 884     }
 885
 886     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 887         $raw .= "\n[$snapname]\n";
 888         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 889     }
 890
 891     return $raw;
 892 }
 893
 894 sub update_pct_config {
 895     my ($class, $vmid, $conf, $running, $param, $delete) = @_;
 896
 897     my @nohotplug;
 898
 899     my $new_disks = 0;
 900     my @deleted_volumes;
 901
 902     my $rootdir;
 903     if ($running) {
 904         my $pid = PVE::LXC::find_lxc_pid($vmid);
 905         $rootdir = "/proc/$pid/root";
 906     }
 907
 908     my $hotplug_error = sub {
 909         if ($running) {
 910             push @nohotplug, @_;
 911             return 1;
 912         } else {
 913             return 0;
 914         }
 915     };
 916
 917     if (defined($delete)) {
 918         foreach my $opt (@$delete) {
 919             if (!exists($conf->{$opt})) {
 920                 # silently ignore
 921                 next;
 922             }
 923
 924             if ($opt eq 'memory' || $opt eq 'rootfs') {
 925                 die "unable to delete required option '$opt'\n";
 926             } elsif ($opt eq 'hostname') {
 927                 delete $conf->{$opt};
 928             } elsif ($opt eq 'swap') {
 929                 delete $conf->{$opt};
 930                 PVE::LXC::write_cgroup_value("memory", $vmid,
 931                                              "memory.memsw.limit_in_bytes", -1);
 932             } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup' || $opt eq 'hookscript') {
 933                 delete $conf->{$opt};
 934             } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
 935                      $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 936                 next if $hotplug_error->($opt);
 937                 delete $conf->{$opt};
 938             } elsif ($opt eq 'cores') {
 939                 delete $conf->{$opt}; # rest is handled by pvestatd
 940             } elsif ($opt eq 'cpulimit') {
 941                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 942                 delete $conf->{$opt};
 943             } elsif ($opt eq 'cpuunits') {
 944                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
 945                 delete $conf->{$opt};
 946             } elsif ($opt =~ m/^net(\d)$/) {
 947                 delete $conf->{$opt};
 948                 next if !$running;
 949                 my $netid = $1;
 950                 PVE::Network::veth_delete("veth${vmid}i$netid");
 951             } elsif ($opt eq 'protection') {
 952                 delete $conf->{$opt};
 953             } elsif ($opt =~ m/^unused(\d+)$/) {
 954                 next if $hotplug_error->($opt);
 955                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 956                 push @deleted_volumes, $conf->{$opt};
 957                 delete $conf->{$opt};
 958             } elsif ($opt =~ m/^mp(\d+)$/) {
 959                 next if $hotplug_error->($opt);
 960                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 961                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
 962                 delete $conf->{$opt};
 963                 if ($mp->{type} eq 'volume') {
 964                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 965                 }
 966             } elsif ($opt eq 'unprivileged') {
 967                 die "unable to delete read-only option: '$opt'\n";
 968             } elsif ($opt eq 'features') {
 969                 next if $hotplug_error->($opt);
 970                 delete $conf->{$opt};
 971             } else {
 972                 die "implement me (delete: $opt)"
 973             }
 974             PVE::LXC::Config->write_config($vmid, $conf) if $running;
 975         }
 976     }
 977
 978     # There's no separate swap size to configure, there's memory and "total"
 979     # memory (iow. memory+swap). This means we have to change them together.
 980     my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
 981     my $wanted_swap =  PVE::Tools::extract_param($param, 'swap');
 982     if (defined($wanted_memory) || defined($wanted_swap)) {
 983
 984         my $old_memory = ($conf->{memory} || 512);
 985         my $old_swap = ($conf->{swap} || 0);
 986
 987         $wanted_memory //= $old_memory;
 988         $wanted_swap //= $old_swap;
 989
 990         my $total = $wanted_memory + $wanted_swap;
 991         if ($running) {
 992             my $old_total = $old_memory + $old_swap;
 993             if ($total > $old_total) {
 994                 PVE::LXC::write_cgroup_value("memory", $vmid,
 995                                              "memory.memsw.limit_in_bytes",
 996                                              int($total*1024*1024));
 997                 PVE::LXC::write_cgroup_value("memory", $vmid,
 998                                              "memory.limit_in_bytes",
 999                                              int($wanted_memory*1024*1024));
1000             } else {
1001                 PVE::LXC::write_cgroup_value("memory", $vmid,
1002                                              "memory.limit_in_bytes",
1003                                              int($wanted_memory*1024*1024));
1004                 PVE::LXC::write_cgroup_value("memory", $vmid,
1005                                              "memory.memsw.limit_in_bytes",
1006                                              int($total*1024*1024));
1007             }
1008         }
1009         $conf->{memory} = $wanted_memory;
1010         $conf->{swap} = $wanted_swap;
1011
1012         PVE::LXC::Config->write_config($vmid, $conf) if $running;
1013     }
1014
1015     my $storecfg = PVE::Storage::config();
1016
1017     my $used_volids = {};
1018     my $check_content_type = sub {
1019         my ($mp) = @_;
1020         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
1021         my $storage_config = PVE::Storage::storage_config($storecfg, $sid);
1022         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
1023             if !$storage_config->{content}->{rootdir};
1024     };
1025
1026     my $rescan_volume = sub {
1027         my ($mp) = @_;
1028         eval {
1029             $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5)
1030                 if !defined($mp->{size});
1031         };
1032         warn "Could not rescan volume size - $@\n" if $@;
1033     };
1034
1035     foreach my $opt (keys %$param) {
1036         my $value = $param->{$opt};
1037         my $check_protection_msg = "can't update CT $vmid drive '$opt'";
1038         if ($opt eq 'hostname' || $opt eq 'arch') {
1039             $conf->{$opt} = $value;
1040         } elsif ($opt eq 'onboot') {
1041             $conf->{$opt} = $value ? 1 : 0;
1042         } elsif ($opt eq 'startup') {
1043             $conf->{$opt} = $value;
1044         } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
1045             next if $hotplug_error->($opt);
1046             $conf->{$opt} = $value;
1047         } elsif ($opt eq 'nameserver') {
1048             next if $hotplug_error->($opt);
1049             my $list = PVE::LXC::verify_nameserver_list($value);
1050             $conf->{$opt} = $list;
1051         } elsif ($opt eq 'searchdomain') {
1052             next if $hotplug_error->($opt);
1053             my $list = PVE::LXC::verify_searchdomain_list($value);
1054             $conf->{$opt} = $list;
1055         } elsif ($opt eq 'cores') {
1056             $conf->{$opt} = $value;# rest is handled by pvestatd
1057         } elsif ($opt eq 'cpulimit') {
1058             if ($value == 0) {
1059                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1060             } else {
1061                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1062             }
1063             $conf->{$opt} = $value;
1064         } elsif ($opt eq 'cpuunits') {
1065             $conf->{$opt} = $value;
1066             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1067         } elsif ($opt eq 'description') {
1068             $conf->{$opt} = $value;
1069         } elsif ($opt =~ m/^net(\d+)$/) {
1070             my $netid = $1;
1071             my $net = PVE::LXC::Config->parse_lxc_network($value);
1072             if (!$running) {
1073                 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1074             } else {
1075                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1076             }
1077         } elsif ($opt eq 'protection') {
1078             $conf->{$opt} = $value ? 1 : 0;
1079         } elsif ($opt =~ m/^mp(\d+)$/) {
1080             next if $hotplug_error->($opt);
1081             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
1082             my $old = $conf->{$opt};
1083             my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
1084             if ($mp->{type} eq 'volume') {
1085                 &$check_content_type($mp);
1086                 $used_volids->{$mp->{volume}} = 1;
1087                 &$rescan_volume($mp);
1088                 $conf->{$opt} = PVE::LXC::Config->print_ct_mountpoint($mp);
1089             } else {
1090                 $conf->{$opt} = $value;
1091             }
1092             if (defined($old)) {
1093                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
1094                 if ($mp->{type} eq 'volume') {
1095                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
1096                 }
1097             }
1098             $new_disks = 1;
1099         } elsif ($opt eq 'rootfs') {
1100             next if $hotplug_error->($opt);
1101             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
1102             my $old = $conf->{$opt};
1103             my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
1104             if ($mp->{type} eq 'volume') {
1105                 &$check_content_type($mp);
1106                 $used_volids->{$mp->{volume}} = 1;
1107                 &$rescan_volume($mp);
1108                 $conf->{$opt} = PVE::LXC::Config->print_ct_mountpoint($mp, 1);
1109             } else {
1110                 $conf->{$opt} = $value;
1111             }
1112             if (defined($old)) {
1113                 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
1114                 if ($mp->{type} eq 'volume') {
1115                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
1116                 }
1117             }
1118             $new_disks = 1;
1119         } elsif ($opt eq 'unprivileged') {
1120             die "unable to modify read-only option: '$opt'\n";
1121         } elsif ($opt eq 'ostype') {
1122             next if $hotplug_error->($opt);
1123             $conf->{$opt} = $value;
1124         } elsif ($opt eq 'features') {
1125             next if $hotplug_error->($opt);
1126             $conf->{$opt} = $value;
1127         } elsif ($opt eq 'hookscript') {
1128             PVE::GuestHelpers::check_hookscript($value);
1129             $conf->{$opt} = $value;
1130         } else {
1131             die "implement me: $opt";
1132         }
1133
1134         PVE::LXC::Config->write_config($vmid, $conf) if $running;
1135     }
1136
1137     # Apply deletions and creations of new volumes
1138     if (@deleted_volumes) {
1139         my $storage_cfg = PVE::Storage::config();
1140         foreach my $volume (@deleted_volumes) {
1141             next if $used_volids->{$volume}; # could have been re-added, too
1142             # also check for references in snapshots
1143             next if $class->is_volume_in_use($conf, $volume, 1);
1144             PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
1145         }
1146     }
1147
1148     if ($new_disks) {
1149         my $storage_cfg = PVE::Storage::config();
1150         PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
1151     }
1152
1153     # This should be the last thing we do here
1154     if ($running && scalar(@nohotplug)) {
1155         die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
1156     }
1157 }
1158
1159 sub check_type {
1160     my ($class, $key, $value) = @_;
1161
1162     die "unknown setting '$key'\n" if !$confdesc->{$key};
1163
1164     my $type = $confdesc->{$key}->{type};
1165
1166     if (!defined($value)) {
1167         die "got undefined value\n";
1168     }
1169
1170     if ($value =~ m/[\n\r]/) {
1171         die "property contains a line feed\n";
1172     }
1173
1174     if ($type eq 'boolean') {
1175         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1176         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1177         die "type check ('boolean') failed - got '$value'\n";
1178     } elsif ($type eq 'integer') {
1179         return int($1) if $value =~ m/^(\d+)$/;
1180         die "type check ('integer') failed - got '$value'\n";
1181     } elsif ($type eq 'number') {
1182         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1183         die "type check ('number') failed - got '$value'\n";
1184     } elsif ($type eq 'string') {
1185         if (my $fmt = $confdesc->{$key}->{format}) {
1186             PVE::JSONSchema::check_format($fmt, $value);
1187             return $value;
1188         }
1189         return $value;
1190     } else {
1191         die "internal error"
1192     }
1193 }
1194
1195
1196 # add JSON properties for create and set function
1197 sub json_config_properties {
1198     my ($class, $prop) = @_;
1199
1200     foreach my $opt (keys %$confdesc) {
1201         next if $opt eq 'parent' || $opt eq 'snaptime';
1202         next if $prop->{$opt};
1203         $prop->{$opt} = $confdesc->{$opt};
1204     }
1205
1206     return $prop;
1207 }
1208
1209 sub __parse_ct_mountpoint_full {
1210     my ($class, $desc, $data, $noerr) = @_;
1211
1212     $data //= '';
1213
1214     my $res;
1215     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1216     if ($@) {
1217         return undef if $noerr;
1218         die $@;
1219     }
1220
1221     if (defined(my $size = $res->{size})) {
1222         $size = PVE::JSONSchema::parse_size($size);
1223         if (!defined($size)) {
1224             return undef if $noerr;
1225             die "invalid size: $size\n";
1226         }
1227         $res->{size} = $size;
1228     }
1229
1230     $res->{type} = $class->classify_mountpoint($res->{volume});
1231
1232     return $res;
1233 };
1234
1235 sub parse_ct_rootfs {
1236     my ($class, $data, $noerr) = @_;
1237
1238     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1239
1240     $res->{mp} = '/' if defined($res);
1241
1242     return $res;
1243 }
1244
1245 sub parse_ct_mountpoint {
1246     my ($class, $data, $noerr) = @_;
1247
1248     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1249 }
1250
1251 sub print_ct_mountpoint {
1252     my ($class, $info, $nomp) = @_;
1253     my $skip = [ 'type' ];
1254     push @$skip, 'mp' if $nomp;
1255     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1256 }
1257
1258 sub print_lxc_network {
1259     my ($class, $net) = @_;
1260     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1261 }
1262
1263 sub parse_lxc_network {
1264     my ($class, $data) = @_;
1265
1266     my $res = {};
1267
1268     return $res if !$data;
1269
1270     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1271
1272     $res->{type} = 'veth';
1273     if (!$res->{hwaddr}) {
1274         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1275         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1276     }
1277
1278     return $res;
1279 }
1280
1281 sub parse_features {
1282     my ($class, $data) = @_;
1283     return {} if !$data;
1284     return PVE::JSONSchema::parse_property_string($features_desc, $data);
1285 }
1286
1287 sub option_exists {
1288     my ($class, $name) = @_;
1289
1290     return defined($confdesc->{$name});
1291 }
1292 # END JSON config code
1293
1294 sub classify_mountpoint {
1295     my ($class, $vol) = @_;
1296     if ($vol =~ m!^/!) {
1297         return 'device' if $vol =~ m!^/dev/!;
1298         return 'bind';
1299     }
1300     return 'volume';
1301 }
1302
1303 my $__is_volume_in_use = sub {
1304     my ($class, $config, $volid) = @_;
1305     my $used = 0;
1306
1307     $class->foreach_mountpoint($config, sub {
1308         my ($ms, $mountpoint) = @_;
1309         return if $used;
1310         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1311     });
1312
1313     return $used;
1314 };
1315
1316 sub is_volume_in_use_by_snapshots {
1317     my ($class, $config, $volid) = @_;
1318
1319     if (my $snapshots = $config->{snapshots}) {
1320         foreach my $snap (keys %$snapshots) {
1321             return 1 if $__is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1322         }
1323     }
1324
1325     return 0;
1326 }
1327
1328 sub is_volume_in_use {
1329     my ($class, $config, $volid, $include_snapshots) = @_;
1330     return 1 if $__is_volume_in_use->($class, $config, $volid);
1331     return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1332     return 0;
1333 }
1334
1335 sub has_dev_console {
1336     my ($class, $conf) = @_;
1337
1338     return !(defined($conf->{console}) && !$conf->{console});
1339 }
1340
1341 sub has_lxc_entry {
1342     my ($class, $conf, $keyname) = @_;
1343
1344     if (my $lxcconf = $conf->{lxc}) {
1345         foreach my $entry (@$lxcconf) {
1346             my ($key, undef) = @$entry;
1347             return 1 if $key eq $keyname;
1348         }
1349     }
1350
1351     return 0;
1352 }
1353
1354 sub get_tty_count {
1355     my ($class, $conf) = @_;
1356
1357     return $conf->{tty} // $confdesc->{tty}->{default};
1358 }
1359
1360 sub get_cmode {
1361     my ($class, $conf) = @_;
1362
1363     return $conf->{cmode} // $confdesc->{cmode}->{default};
1364 }
1365
1366 sub mountpoint_names {
1367     my ($class, $reverse) = @_;
1368
1369     my @names = ('rootfs');
1370
1371     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1372         push @names, "mp$i";
1373     }
1374
1375     return $reverse ? reverse @names : @names;
1376 }
1377
1378 sub foreach_mountpoint_full {
1379     my ($class, $conf, $reverse, $func, @param) = @_;
1380
1381     my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1382     foreach my $key (@$mps) {
1383         my $value = $conf->{$key};
1384         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1385         next if !defined($mountpoint);
1386
1387         &$func($key, $mountpoint, @param);
1388     }
1389 }
1390
1391 sub foreach_mountpoint {
1392     my ($class, $conf, $func, @param) = @_;
1393
1394     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1395 }
1396
1397 sub foreach_mountpoint_reverse {
1398     my ($class, $conf, $func, @param) = @_;
1399
1400     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1401 }
1402
1403 sub get_vm_volumes {
1404     my ($class, $conf, $excludes) = @_;
1405
1406     my $vollist = [];
1407
1408     $class->foreach_mountpoint($conf, sub {
1409         my ($ms, $mountpoint) = @_;
1410
1411         return if $excludes && $ms eq $excludes;
1412
1413         my $volid = $mountpoint->{volume};
1414         return if !$volid || $mountpoint->{type} ne 'volume';
1415
1416         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1417         return if !$sid;
1418
1419         push @$vollist, $volid;
1420     });
1421
1422     return $vollist;
1423 }
1424
1425 sub get_replicatable_volumes {
1426     my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1427
1428     my $volhash = {};
1429
1430     my $test_volid = sub {
1431         my ($volid, $mountpoint) = @_;
1432
1433         return if !$volid;
1434
1435         my $mptype = $mountpoint->{type};
1436         my $replicate = $mountpoint->{replicate} // 1;
1437
1438         if ($mptype ne 'volume') {
1439             # skip bindmounts if replicate = 0 even for cleanup,
1440             # since bind mounts could not have been replicated ever
1441             return if !$replicate;
1442             die "unable to replicate mountpoint type '$mptype'\n";
1443         }
1444
1445         my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1446         return if !$storeid;
1447
1448         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1449         return if $scfg->{shared};
1450
1451         my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1452         return if !$owner || ($owner != $vmid);
1453
1454         die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1455
1456         return if !$cleanup && !$replicate;
1457
1458         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1459             return if $cleanup || $noerr;
1460             die "missing replicate feature on volume '$volid'\n";
1461         }
1462
1463         $volhash->{$volid} = 1;
1464     };
1465
1466     $class->foreach_mountpoint($conf, sub {
1467         my ($ms, $mountpoint) = @_;
1468         $test_volid->($mountpoint->{volume}, $mountpoint);
1469     });
1470
1471     foreach my $snapname (keys %{$conf->{snapshots}}) {
1472         my $snap = $conf->{snapshots}->{$snapname};
1473         $class->foreach_mountpoint($snap, sub {
1474             my ($ms, $mountpoint) = @_;
1475             $test_volid->($mountpoint->{volume}, $mountpoint);
1476         });
1477     }
1478
1479     # add 'unusedX' volumes to volhash
1480     foreach my $key (keys %$conf) {
1481         if ($key =~ m/^unused/) {
1482             $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1483         }
1484     }
1485
1486     return $volhash;
1487 }
1488
1489 1;