print_ct_warn_log: use log_warn function from RESTEnvironment

[pve-container.git] / src / PVE / LXC.pm

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 0d0141dc483ee1ba430e410bc6fdbe1267bbfc9a..ce6d5a532aad98cd537c8b2d3cce830f9651b34d 100644 (file)
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -29,11 +29,11 @@ use PVE::Tools qw(
     $IPV4RE
     $IPV6RE
 );
-use PVE::RPCEnvironment;
 use PVE::CpuSet;
 use PVE::Network;
 use PVE::AccessControl;
 use PVE::ProcFSTools;
+use PVE::RESTEnvironment;
 use PVE::Syscall qw(:fsmount);
 use PVE::LXC::Config;
 use PVE::GuestHelpers qw(safe_string_ne safe_num_ne safe_boolean_ne);
@@ -729,7 +729,15 @@ sub update_lxc_config {
        $raw .= "lxc.net.$ind.veth.pair = veth${vmid}i${ind}\n";
        $raw .= "lxc.net.$ind.hwaddr = $d->{hwaddr}\n" if defined($d->{hwaddr});
        $raw .= "lxc.net.$ind.name = $d->{name}\n" if defined($d->{name});
-       $raw .= "lxc.net.$ind.mtu = $d->{mtu}\n" if defined($d->{mtu});
+
+       # Keep container from starting with invalid mtu configuration
+       if (my $mtu = $d->{mtu}) {
+           my $bridge_mtu = PVE::Network::read_bridge_mtu($d->{bridge});
+           die "$k: MTU size '$mtu' is bigger than bridge MTU '$bridge_mtu'\n"
+               if ($mtu > $bridge_mtu);
+
+           $raw .= "lxc.net.$ind.mtu = $mtu\n";
+       }
 
        # Starting with lxc 4.0, we do not patch lxc to execute our up-scripts.
        if ($lxc_major >= 4) {
@@ -935,7 +943,8 @@ sub update_net {
        } else {
            if (safe_string_ne($oldnet->{bridge}, $newnet->{bridge}) ||
                safe_num_ne($oldnet->{tag}, $newnet->{tag}) ||
-               safe_num_ne($oldnet->{firewall}, $newnet->{firewall})) {
+               safe_num_ne($oldnet->{firewall}, $newnet->{firewall})
+           ) {
 
                if ($oldnet->{bridge}) {
                    PVE::Network::tap_unplug($veth);
@@ -946,10 +955,14 @@ sub update_net {
                    PVE::LXC::Config->write_config($vmid, $conf);
                }
 
+               my ($bridge, $mac, $firewall, $rate) = $newnet->@{'bridge', 'hwaddr', 'firewall', 'rate'};
                if ($have_sdn) {
-                   PVE::Network::SDN::Zones::tap_plug($veth, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall}, $newnet->{trunks}, $newnet->{rate});
+                   PVE::Network::SDN::Zones::tap_plug(
+                       $veth, $bridge, $newnet->{tag}, $firewall, $newnet->{trunks}, $rate);
+                   PVE::Network::SDN::Zones::add_bridge_fdb($veth, $mac, $bridge, $firewall);
                } else {
-                   PVE::Network::tap_plug($veth, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall}, $newnet->{trunks}, $newnet->{rate});
+                   PVE::Network::tap_plug(
+                       $veth, $bridge, $newnet->{tag}, $firewall, $newnet->{trunks}, $rate, { mac => $mac });
                }
 
                # This includes the rate:
@@ -982,9 +995,11 @@ sub hotplug_net {
     if ($have_sdn) {
        PVE::Network::SDN::Zones::veth_create($veth, $vethpeer, $newnet->{bridge}, $newnet->{hwaddr});
        PVE::Network::SDN::Zones::tap_plug($veth, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall}, $newnet->{trunks}, $newnet->{rate});
+       PVE::Network::SDN::Zones::add_bridge_fdb($veth, $newnet->{hwaddr}, $newnet->{bridge}, $newnet->{firewall});
     } else {
        PVE::Network::veth_create($veth, $vethpeer, $newnet->{bridge}, $newnet->{hwaddr});
        PVE::Network::tap_plug($veth, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall}, $newnet->{trunks}, $newnet->{rate});
+       PVE::Network::add_bridge_fdb($veth, $newnet->{hwaddr}, $newnet->{firewall}); # early returns if brport has learning on
     }
 
     # attach peer in container
@@ -1332,6 +1347,10 @@ sub check_ct_modify_config_perm {
        } elsif ($opt eq 'hookscript') {
            # For now this is restricted to root@pam
            raise_perm_exc("changing the hookscript is only allowed for root\@pam");
+       } elsif ($opt eq 'tags') {
+           my $old = $oldconf->{$opt};
+           my $new = $delete ? '' : $newconf->{$opt};
+           PVE::GuestHelpers::assert_tag_permissions($vmid, $old, $new, $rpcenv, $authuser);
        } else {
            $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
        }
@@ -2312,13 +2331,8 @@ my sub print_ct_warn_log {
     my $log = eval { file_get_contents($log_fn) };
     return if !$log;
 
-    my $rpcenv = eval { PVE::RPCEnvironment::get() };
-
-    my $warn_fn = $rpcenv ? sub { $rpcenv->warn($_[0]) } : sub { print STDERR "WARN: $_[0]\n" };
-
     while ($log =~ /^\h*\s*(.*?)\h*$/gm) {
-       my $line = $1;
-       $warn_fn->($line);
+       PVE::RESTEnvironment::log_warn($1);
     }
     unlink $log_fn or warn "could not unlink '$log_fn' - $!\n";
 }