data/PVE/Cluster.pm

   1 package PVE::Cluster;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Encode;
   7 use File::stat qw();
   8 use File::Path qw(make_path);
   9 use JSON;
  10 use Net::SSLeay;
  11 use POSIX qw(ENOENT);
  12 use Socket;
  13 use Storable qw(dclone);
  14
  15 use PVE::Certificate;
  16 use PVE::INotify;
  17 use PVE::IPCC;
  18 use PVE::JSONSchema;
  19 use PVE::Network;
  20 use PVE::SafeSyslog;
  21 use PVE::Tools qw(run_command);
  22
  23 use PVE::Cluster::IPCConst;
  24
  25 use base 'Exporter';
  26
  27 our @EXPORT_OK = qw(
  28 cfs_read_file
  29 cfs_write_file
  30 cfs_register_file
  31 cfs_lock_file);
  32
  33 # x509 certificate utils
  34
  35 my $basedir = "/etc/pve";
  36 my $authdir = "$basedir/priv";
  37 my $lockdir = "/etc/pve/priv/lock";
  38
  39 # cfs and corosync files
  40 my $dbfile = "/var/lib/pve-cluster/config.db";
  41 my $dbbackupdir = "/var/lib/pve-cluster/backup";
  42
  43 # this is just a readonly copy, the relevant one is in status.c from pmxcfs
  44 # observed files are the one we can get directly through IPCC, they are cached
  45 # using a computed version and only those can be used by the cfs_*_file methods
  46 my $observed = {
  47     'vzdump.cron' => 1,
  48     'storage.cfg' => 1,
  49     'datacenter.cfg' => 1,
  50     'replication.cfg' => 1,
  51     'corosync.conf' => 1,
  52     'corosync.conf.new' => 1,
  53     'user.cfg' => 1,
  54     'domains.cfg' => 1,
  55     'priv/shadow.cfg' => 1,
  56     'priv/tfa.cfg' => 1,
  57     'priv/token.cfg' => 1,
  58     'priv/acme/plugins.cfg' => 1,
  59     '/qemu-server/' => 1,
  60     '/openvz/' => 1,
  61     '/lxc/' => 1,
  62     'ha/crm_commands' => 1,
  63     'ha/manager_status' => 1,
  64     'ha/resources.cfg' => 1,
  65     'ha/groups.cfg' => 1,
  66     'ha/fence.cfg' => 1,
  67     'status.cfg' => 1,
  68     'ceph.conf' => 1,
  69     'sdn/vnets.cfg' => 1,
  70     'sdn/zones.cfg' => 1,
  71     'sdn/controllers.cfg' => 1,
  72     'sdn/.version' => 1,
  73     'virtual-guest/cpu-models.conf' => 1,
  74 };
  75
  76 sub prepare_observed_file_basedirs {
  77
  78     if (!check_cfs_is_mounted(1)) {
  79         warn "pmxcfs isn't mounted (/etc/pve), chickening out..\n";
  80         return;
  81     }
  82
  83     for my $f (sort keys %$observed) {
  84         next if $f !~ m!^(.*)/[^/]+$!;
  85         my $dir = "$basedir/$1";
  86         next if -e $dir; # can also be a link, so just use -e xist check
  87         print "creating directory '$dir' for observerd files\n";
  88         make_path($dir);
  89     }
  90 }
  91
  92 sub base_dir {
  93     return $basedir;
  94 }
  95
  96 sub auth_dir {
  97     return $authdir;
  98 }
  99
 100 sub check_cfs_quorum {
 101     my ($noerr) = @_;
 102
 103     # note: -w filename always return 1 for root, so wee need
 104     # to use File::lstat here
 105     my $st = File::stat::lstat("$basedir/local");
 106     my $quorate = ($st && (($st->mode & 0200) != 0));
 107
 108     die "cluster not ready - no quorum?\n" if !$quorate && !$noerr;
 109
 110     return $quorate;
 111 }
 112
 113 sub check_cfs_is_mounted {
 114     my ($noerr) = @_;
 115
 116     my $res = -l "$basedir/local";
 117
 118     die "pve configuration filesystem not mounted\n"
 119         if !$res && !$noerr;
 120
 121     return $res;
 122 }
 123
 124 my $versions = {};
 125 my $vmlist = {};
 126 my $clinfo = {};
 127
 128 my $ipcc_send_rec = sub {
 129     my ($msgid, $data) = @_;
 130
 131     my $res = PVE::IPCC::ipcc_send_rec($msgid, $data);
 132
 133     die "ipcc_send_rec[$msgid] failed: $!\n" if !defined($res) && ($! != 0);
 134
 135     return $res;
 136 };
 137
 138 my $ipcc_send_rec_json = sub {
 139     my ($msgid, $data) = @_;
 140
 141     my $res = PVE::IPCC::ipcc_send_rec($msgid, $data);
 142
 143     die "ipcc_send_rec[$msgid] failed: $!\n" if !defined($res) && ($! != 0);
 144
 145     return decode_json($res);
 146 };
 147
 148 my $ipcc_get_config = sub {
 149     my ($path) = @_;
 150
 151     my $bindata = pack "Z*", $path;
 152     my $res = PVE::IPCC::ipcc_send_rec(CFS_IPC_GET_CONFIG, $bindata);
 153     if (!defined($res)) {
 154         if ($! != 0) {
 155             return undef if $! == ENOENT;
 156             die "$!\n";
 157         }
 158         return '';
 159     }
 160
 161     return $res;
 162 };
 163
 164 my $ipcc_get_status = sub {
 165     my ($name, $nodename) = @_;
 166
 167     my $bindata = pack "Z[256]Z[256]", $name, ($nodename || "");
 168     return PVE::IPCC::ipcc_send_rec(CFS_IPC_GET_STATUS, $bindata);
 169 };
 170
 171 my $ipcc_remove_status = sub {
 172     my ($name) = @_;
 173     # we just omit the data payload, pmxcfs takes this as hint and removes this
 174     # key from the status hashtable
 175     my $bindata = pack "Z[256]", $name;
 176     return &$ipcc_send_rec(CFS_IPC_SET_STATUS, $bindata);
 177 };
 178
 179 my $ipcc_update_status = sub {
 180     my ($name, $data) = @_;
 181
 182     my $raw = ref($data) ? encode_json($data) : $data;
 183     # update status
 184     my $bindata = pack "Z[256]Z*", $name, $raw;
 185
 186     return &$ipcc_send_rec(CFS_IPC_SET_STATUS, $bindata);
 187 };
 188
 189 my $ipcc_log = sub {
 190     my ($priority, $ident, $tag, $msg) = @_;
 191
 192     my $bindata = pack "CCCZ*Z*Z*", $priority, bytes::length($ident) + 1,
 193     bytes::length($tag) + 1, $ident, $tag, $msg;
 194
 195     return &$ipcc_send_rec(CFS_IPC_LOG_CLUSTER_MSG, $bindata);
 196 };
 197
 198 my $ipcc_get_cluster_log = sub {
 199     my ($user, $max) = @_;
 200
 201     $max = 0 if !defined($max);
 202
 203     my $bindata = pack "VVVVZ*", $max, 0, 0, 0, ($user || "");
 204     return &$ipcc_send_rec(CFS_IPC_GET_CLUSTER_LOG, $bindata);
 205 };
 206
 207 my $ipcc_verify_token = sub {
 208     my ($full_token) = @_;
 209
 210     my $bindata = pack "Z*", $full_token;
 211     my $res = PVE::IPCC::ipcc_send_rec(CFS_IPC_VERIFY_TOKEN, $bindata);
 212
 213     return 1 if $! == 0;
 214     return 0 if $! == ENOENT;
 215
 216     die "$!\n";
 217 };
 218
 219 my $ccache = {};
 220
 221 sub cfs_update {
 222     my ($fail) = @_;
 223     eval {
 224         my $res = &$ipcc_send_rec_json(CFS_IPC_GET_FS_VERSION);
 225         die "no starttime\n" if !$res->{starttime};
 226
 227         if (!$res->{starttime} || !$versions->{starttime} ||
 228             $res->{starttime} != $versions->{starttime}) {
 229             #print "detected changed starttime\n";
 230             $vmlist = {};
 231             $clinfo = {};
 232             $ccache = {};
 233         }
 234
 235         $versions = $res;
 236     };
 237     my $err = $@;
 238     if ($err) {
 239         $versions = {};
 240         $vmlist = {};
 241         $clinfo = {};
 242         $ccache = {};
 243         die $err if $fail;
 244         warn $err;
 245     }
 246
 247     eval {
 248         if (!$clinfo->{version} || $clinfo->{version} != $versions->{clinfo}) {
 249             #warn "detected new clinfo\n";
 250             $clinfo = &$ipcc_send_rec_json(CFS_IPC_GET_CLUSTER_INFO);
 251         }
 252     };
 253     $err = $@;
 254     if ($err) {
 255         $clinfo = {};
 256         die $err if $fail;
 257         warn $err;
 258     }
 259
 260     eval {
 261         if (!$vmlist->{version} || $vmlist->{version} != $versions->{vmlist}) {
 262             #warn "detected new vmlist1\n";
 263             $vmlist = &$ipcc_send_rec_json(CFS_IPC_GET_GUEST_LIST);
 264         }
 265     };
 266     $err = $@;
 267     if ($err) {
 268         $vmlist = {};
 269         die $err if $fail;
 270         warn $err;
 271     }
 272 }
 273
 274 sub get_vmlist {
 275     return $vmlist;
 276 }
 277
 278 sub get_clinfo {
 279     return $clinfo;
 280 }
 281
 282 sub get_members {
 283     return $clinfo->{nodelist};
 284 }
 285
 286 sub get_nodelist {
 287     my $nodelist = $clinfo->{nodelist};
 288
 289     my $nodename = PVE::INotify::nodename();
 290
 291     if (!$nodelist || !$nodelist->{$nodename}) {
 292         return [ $nodename ];
 293     }
 294
 295     return [ keys %$nodelist ];
 296 }
 297
 298 # only stored in a in-memory hashtable inside pmxcfs, local data is gone after
 299 # a restart (of pmxcfs or the node), peer data is still available then
 300 # best used for status data, like running (ceph) services, package versions, ...
 301 sub broadcast_node_kv {
 302     my ($key, $data) = @_;
 303
 304     if (!defined($data)) {
 305         eval {
 306             $ipcc_remove_status->("kv/$key");
 307         };
 308     } else {
 309         die "cannot send a reference\n" if ref($data);
 310         my $size = length($data);
 311         die "data for '$key' too big\n" if $size >= (32 * 1024); # limit from pmxfs
 312
 313         eval {
 314             $ipcc_update_status->("kv/$key", $data);
 315         };
 316     }
 317
 318     warn $@ if $@;
 319 }
 320
 321 # nodename is optional
 322 sub get_node_kv {
 323     my ($key, $nodename) = @_;
 324
 325     my $res = {};
 326     my $get_node_data = sub {
 327         my ($node) = @_;
 328         my $raw = $ipcc_get_status->("kv/$key", $node);
 329         $res->{$node} = unpack("Z*", $raw) if $raw;
 330     };
 331
 332     if ($nodename) {
 333         $get_node_data->($nodename);
 334     } else {
 335         my $nodelist = get_nodelist();
 336
 337         foreach my $node (@$nodelist) {
 338             $get_node_data->($node);
 339         }
 340     }
 341
 342     return $res;
 343 }
 344
 345 # property: a config property you want to get, e.g., this is perfect to get
 346 # the 'lock' entry of a guest _fast_ (>100 faster than manual parsing here)
 347 # vmid: optipnal, if a valid is passed we only check that one, else return all
 348 # NOTE: does *not* searches snapshot and PENDING entries sections!
 349 sub get_guest_config_property {
 350     my ($property, $vmid) = @_;
 351
 352     die "property is required" if !defined($property);
 353
 354     my $bindata = pack "VZ*", $vmid // 0, $property;
 355     my $res = $ipcc_send_rec_json->(CFS_IPC_GET_GUEST_CONFIG_PROPERTY, $bindata);
 356
 357     return $res;
 358 }
 359
 360 # $data must be a chronological descending ordered array of tasks
 361 sub broadcast_tasklist {
 362     my ($data) = @_;
 363
 364     # the serialized list may not get bigger than 32kb (CFS_MAX_STATUS_SIZE
 365     # from pmxcfs) - drop older items until we satisfy this constraint
 366     my $size = length(encode_json($data));
 367     while ($size >= (32 * 1024)) {
 368         pop @$data;
 369         $size = length(encode_json($data));
 370     }
 371
 372     eval {
 373         &$ipcc_update_status("tasklist", $data);
 374     };
 375
 376     warn $@ if $@;
 377 }
 378
 379 my $tasklistcache = {};
 380
 381 sub get_tasklist {
 382     my ($nodename) = @_;
 383
 384     my $kvstore = $versions->{kvstore} || {};
 385
 386     my $nodelist = get_nodelist();
 387
 388     my $res = [];
 389     foreach my $node (@$nodelist) {
 390         next if $nodename && ($nodename ne $node);
 391         eval {
 392             my $ver = $kvstore->{$node}->{tasklist} if $kvstore->{$node};
 393             my $cd = $tasklistcache->{$node};
 394             if (!$cd || !$ver || !$cd->{version} ||
 395                 ($cd->{version} != $ver)) {
 396                 my $raw = &$ipcc_get_status("tasklist", $node) || '[]';
 397                 my $data = decode_json($raw);
 398                 push @$res, @$data;
 399                 $cd = $tasklistcache->{$node} = {
 400                     data => $data,
 401                     version => $ver,
 402                 };
 403             } elsif ($cd && $cd->{data}) {
 404                 push @$res, @{$cd->{data}};
 405             }
 406         };
 407         my $err = $@;
 408         syslog('err', $err) if $err;
 409     }
 410
 411     return $res;
 412 }
 413
 414 sub broadcast_rrd {
 415     my ($rrdid, $data) = @_;
 416
 417     eval {
 418         &$ipcc_update_status("rrd/$rrdid", $data);
 419     };
 420     my $err = $@;
 421
 422     warn $err if $err;
 423 }
 424
 425 my $last_rrd_dump = 0;
 426 my $last_rrd_data = "";
 427
 428 sub rrd_dump {
 429
 430     my $ctime = time();
 431
 432     my $diff = $ctime - $last_rrd_dump;
 433     if ($diff < 2) {
 434         return $last_rrd_data;
 435     }
 436
 437     my $raw;
 438     eval {
 439         $raw = &$ipcc_send_rec(CFS_IPC_GET_RRD_DUMP);
 440     };
 441     my $err = $@;
 442
 443     if ($err) {
 444         warn $err;
 445         return {};
 446     }
 447
 448     my $res = {};
 449
 450     if ($raw) {
 451         while ($raw =~ s/^(.*)\n//) {
 452             my ($key, @ela) = split(/:/, $1);
 453             next if !$key;
 454             next if !(scalar(@ela) > 1);
 455             $res->{$key} = [ map { $_ eq 'U' ? undef : $_ } @ela ];
 456         }
 457     }
 458
 459     $last_rrd_dump = $ctime;
 460     $last_rrd_data = $res;
 461
 462     return $res;
 463 }
 464
 465
 466 # a fast way to read files (avoid fuse overhead)
 467 sub get_config {
 468     my ($path) = @_;
 469
 470     return &$ipcc_get_config($path);
 471 }
 472
 473 sub get_cluster_log {
 474     my ($user, $max) = @_;
 475
 476     return &$ipcc_get_cluster_log($user, $max);
 477 }
 478
 479 sub verify_token {
 480     my ($userid, $token) = @_;
 481
 482     return &$ipcc_verify_token("$userid $token");
 483 }
 484
 485 my $file_info = {};
 486
 487 sub cfs_register_file {
 488     my ($filename, $parser, $writer) = @_;
 489
 490     $observed->{$filename} || die "unknown file '$filename'";
 491
 492     die "file '$filename' already registered" if $file_info->{$filename};
 493
 494     $file_info->{$filename} = {
 495         parser => $parser,
 496         writer => $writer,
 497     };
 498 }
 499
 500 my $ccache_read = sub {
 501     my ($filename, $parser, $version) = @_;
 502
 503     $ccache->{$filename} = {} if !$ccache->{$filename};
 504
 505     my $ci = $ccache->{$filename};
 506
 507     if (!$ci->{version} || !$version || $ci->{version} != $version) {
 508         # we always call the parser, even when the file does not exist
 509         # (in that case $data is undef)
 510         my $data = get_config($filename);
 511         $ci->{data} = &$parser("/etc/pve/$filename", $data);
 512         $ci->{version} = $version;
 513     }
 514
 515     my $res = ref($ci->{data}) ? dclone($ci->{data}) : $ci->{data};
 516
 517     return $res;
 518 };
 519
 520 sub cfs_file_version {
 521     my ($filename) = @_;
 522
 523     my $version;
 524     my $infotag;
 525     if ($filename =~ m!^nodes/[^/]+/(openvz|lxc|qemu-server)/(\d+)\.conf$!) {
 526         my ($type, $vmid) = ($1, $2);
 527         if ($vmlist && $vmlist->{ids} && $vmlist->{ids}->{$vmid}) {
 528             $version = $vmlist->{ids}->{$vmid}->{version};
 529         }
 530         $infotag = "/$type/";
 531     } else {
 532         $infotag = $filename;
 533         $version = $versions->{$filename};
 534     }
 535
 536     my $info = $file_info->{$infotag} ||
 537         die "unknown file type '$filename'\n";
 538
 539     return wantarray ? ($version, $info) : $version;
 540 }
 541
 542 sub cfs_read_file {
 543     my ($filename) = @_;
 544
 545     my ($version, $info) = cfs_file_version($filename);
 546     my $parser = $info->{parser};
 547
 548     return &$ccache_read($filename, $parser, $version);
 549 }
 550
 551 sub cfs_write_file {
 552     my ($filename, $data) = @_;
 553
 554     my ($version, $info) = cfs_file_version($filename);
 555
 556     my $writer = $info->{writer} || die "no writer defined";
 557
 558     my $fsname = "/etc/pve/$filename";
 559
 560     my $raw = &$writer($fsname, $data);
 561
 562     if (my $ci = $ccache->{$filename}) {
 563         $ci->{version} = undef;
 564     }
 565
 566     PVE::Tools::file_set_contents($fsname, $raw);
 567 }
 568
 569 my $cfs_lock = sub {
 570     my ($lockid, $timeout, $code, @param) = @_;
 571
 572     my $prev_alarm = alarm(0); # suspend outer alarm early
 573
 574     my $res;
 575     my $got_lock = 0;
 576
 577     # this timeout is for acquire the lock
 578     $timeout = 10 if !$timeout;
 579
 580     my $filename = "$lockdir/$lockid";
 581
 582     eval {
 583
 584         mkdir $lockdir;
 585
 586         if (! -d $lockdir) {
 587             die "pve cluster filesystem not online.\n";
 588         }
 589
 590         my $timeout_err = sub { die "got lock request timeout\n"; };
 591         local $SIG{ALRM} = $timeout_err;
 592
 593         while (1) {
 594             alarm ($timeout);
 595             $got_lock = mkdir($filename);
 596             $timeout = alarm(0) - 1; # we'll sleep for 1s, see down below
 597
 598             last if $got_lock;
 599
 600             $timeout_err->() if $timeout <= 0;
 601
 602             print STDERR "trying to acquire cfs lock '$lockid' ...\n";
 603             utime (0, 0, $filename); # cfs unlock request
 604             sleep(1);
 605         }
 606
 607         # fixed command timeout: cfs locks have a timeout of 120
 608         # using 60 gives us another 60 seconds to abort the task
 609         local $SIG{ALRM} = sub { die "got lock timeout - aborting command\n"; };
 610         alarm(60);
 611
 612         cfs_update(); # make sure we read latest versions inside code()
 613
 614         $res = &$code(@param);
 615
 616         alarm(0);
 617     };
 618
 619     my $err = $@;
 620
 621     $err = "no quorum!\n" if !$got_lock && !check_cfs_quorum(1);
 622
 623     rmdir $filename if $got_lock; # if we held the lock always unlock again
 624
 625     alarm($prev_alarm);
 626
 627     if ($err) {
 628         if (ref($err) eq 'PVE::Exception') {
 629             # re-raise defined exceptions
 630             $@ = $err;
 631         } else {
 632             # add lock info for plain errors
 633             $@ = "error during cfs-locked '$lockid' operation: $err";
 634         }
 635         return undef;
 636     }
 637
 638     $@ = undef;
 639
 640     return $res;
 641 };
 642
 643 sub cfs_lock_file {
 644     my ($filename, $timeout, $code, @param) = @_;
 645
 646     my $info = $observed->{$filename} || die "unknown file '$filename'";
 647
 648     my $lockid = "file-$filename";
 649     $lockid =~ s/[.\/]/_/g;
 650
 651     &$cfs_lock($lockid, $timeout, $code, @param);
 652 }
 653
 654 sub cfs_lock_storage {
 655     my ($storeid, $timeout, $code, @param) = @_;
 656
 657     my $lockid = "storage-$storeid";
 658
 659     &$cfs_lock($lockid, $timeout, $code, @param);
 660 }
 661
 662 sub cfs_lock_domain {
 663     my ($domainname, $timeout, $code, @param) = @_;
 664
 665     my $lockid = "domain-$domainname";
 666
 667     &$cfs_lock($lockid, $timeout, $code, @param);
 668 }
 669
 670 sub cfs_lock_acme {
 671     my ($account, $timeout, $code, @param) = @_;
 672
 673     my $lockid = "acme-$account";
 674
 675     &$cfs_lock($lockid, $timeout, $code, @param);
 676 }
 677
 678 sub cfs_lock_authkey {
 679     my ($timeout, $code, @param) = @_;
 680
 681     $cfs_lock->('authkey', $timeout, $code, @param);
 682 }
 683
 684 sub cfs_lock_firewall {
 685     my ($scope, $timeout, $code, @param) = @_;
 686
 687     my $lockid = "firewall-$scope";
 688
 689     $cfs_lock->($lockid, $timeout, $code, @param);
 690 }
 691
 692 my $log_levels = {
 693     "emerg" => 0,
 694     "alert" => 1,
 695     "crit" => 2,
 696     "critical" => 2,
 697     "err" => 3,
 698     "error" => 3,
 699     "warn" => 4,
 700     "warning" => 4,
 701     "notice" => 5,
 702     "info" => 6,
 703     "debug" => 7,
 704 };
 705
 706 sub log_msg {
 707    my ($priority, $ident, $msg) = @_;
 708
 709    if (my $tmp = $log_levels->{$priority}) {
 710        $priority = $tmp;
 711    }
 712
 713    die "need numeric log priority" if $priority !~ /^\d+$/;
 714
 715    my $tag = PVE::SafeSyslog::tag();
 716
 717    $msg = "empty message" if !$msg;
 718
 719    $ident = "" if !$ident;
 720    $ident = encode("ascii", $ident,
 721                    sub { sprintf "\\u%04x", shift });
 722
 723    my $ascii = encode("ascii", $msg, sub { sprintf "\\u%04x", shift });
 724
 725    if ($ident) {
 726        syslog($priority, "<%s> %s", $ident, $ascii);
 727    } else {
 728        syslog($priority, "%s", $ascii);
 729    }
 730
 731    eval { &$ipcc_log($priority, $ident, $tag, $ascii); };
 732
 733    syslog("err", "writing cluster log failed: $@") if $@;
 734 }
 735
 736 sub check_vmid_unused {
 737     my ($vmid, $noerr) = @_;
 738
 739     my $vmlist = get_vmlist();
 740
 741     my $d = $vmlist->{ids}->{$vmid};
 742     return 1 if !defined($d);
 743
 744     return undef if $noerr;
 745
 746     my $vmtypestr =  $d->{type} eq 'qemu' ? 'VM' : 'CT';
 747     die "$vmtypestr $vmid already exists on node '$d->{node}'\n";
 748 }
 749
 750 sub check_node_exists {
 751     my ($nodename, $noerr) = @_;
 752
 753     my $nodelist = $clinfo->{nodelist};
 754     return 1 if $nodelist && $nodelist->{$nodename};
 755
 756     return undef if $noerr;
 757
 758     die "no such cluster node '$nodename'\n";
 759 }
 760
 761 # this is also used to get the IP of the local node
 762 sub remote_node_ip {
 763     my ($nodename, $noerr) = @_;
 764
 765     my $nodelist = $clinfo->{nodelist};
 766     if ($nodelist && $nodelist->{$nodename}) {
 767         if (my $ip = $nodelist->{$nodename}->{ip}) {
 768             return $ip if !wantarray;
 769             my $family = $nodelist->{$nodename}->{address_family};
 770             if (!$family) {
 771                 $nodelist->{$nodename}->{address_family} =
 772                     $family =
 773                     PVE::Tools::get_host_address_family($ip);
 774             }
 775             return wantarray ? ($ip, $family) : $ip;
 776         }
 777     }
 778
 779     # fallback: try to get IP by other means
 780     return PVE::Network::get_ip_from_hostname($nodename, $noerr);
 781 }
 782
 783 sub get_node_fingerprint {
 784     my ($node) = @_;
 785
 786     my $cert_path = "/etc/pve/nodes/$node/pve-ssl.pem";
 787     my $custom_cert_path = "/etc/pve/nodes/$node/pveproxy-ssl.pem";
 788
 789     $cert_path = $custom_cert_path if -f $custom_cert_path;
 790
 791     return PVE::Certificate::get_certificate_fingerprint($cert_path);
 792 }
 793
 794 # bash completion helpers
 795
 796 sub complete_next_vmid {
 797
 798     my $vmlist = get_vmlist() || {};
 799     my $idlist = $vmlist->{ids} || {};
 800
 801     for (my $i = 100; $i < 10000; $i++) {
 802         return [$i] if !defined($idlist->{$i});
 803     }
 804
 805     return [];
 806 }
 807
 808 sub complete_vmid {
 809
 810     my $vmlist = get_vmlist();
 811     my $ids = $vmlist->{ids} || {};
 812
 813     return [ keys %$ids ];
 814 }
 815
 816 sub complete_local_vmid {
 817
 818     my $vmlist = get_vmlist();
 819     my $ids = $vmlist->{ids} || {};
 820
 821     my $nodename = PVE::INotify::nodename();
 822
 823     my $res = [];
 824     foreach my $vmid (keys %$ids) {
 825         my $d = $ids->{$vmid};
 826         next if !$d->{node} || $d->{node} ne $nodename;
 827         push @$res, $vmid;
 828     }
 829
 830     return $res;
 831 }
 832
 833 sub complete_migration_target {
 834
 835     my $res = [];
 836
 837     my $nodename = PVE::INotify::nodename();
 838
 839     my $nodelist = get_nodelist();
 840     foreach my $node (@$nodelist) {
 841         next if $node eq $nodename;
 842         push @$res, $node;
 843     }
 844
 845     return $res;
 846 }
 847
 848
 849 # NOTE: filesystem must be offline here, no DB changes allowed
 850 sub cfs_backup_database {
 851     mkdir $dbbackupdir;
 852
 853     my $ctime = time();
 854     my $backup_fn = "$dbbackupdir/config-$ctime.sql.gz";
 855
 856     print "backup old database to '$backup_fn'\n";
 857
 858     my $cmd = [ ['sqlite3', $dbfile, '.dump'], ['gzip', '-', \ ">${backup_fn}"] ];
 859     run_command($cmd, 'errmsg' => "cannot backup old database\n");
 860
 861     my $maxfiles = 10; # purge older backup
 862     my $backups = [ sort { $b cmp $a } <$dbbackupdir/config-*.sql.gz> ];
 863
 864     if ((my $count = scalar(@$backups)) > $maxfiles) {
 865         foreach my $f (@$backups[$maxfiles..$count-1]) {
 866             next if $f !~ m/^(\S+)$/; # untaint
 867             print "delete old backup '$1'\n";
 868             unlink $1;
 869         }
 870     }
 871
 872     return $dbfile;
 873 }
 874
 875 1;