data/PVE/Cluster.pm

   1 package PVE::Cluster;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Encode;
   7 use File::stat qw();
   8 use JSON;
   9 use Net::SSLeay;
  10 use POSIX qw(ENOENT);
  11 use Socket;
  12 use Storable qw(dclone);
  13
  14 use PVE::Certificate;
  15 use PVE::INotify;
  16 use PVE::IPCC;
  17 use PVE::JSONSchema;
  18 use PVE::Network;
  19 use PVE::SafeSyslog;
  20 use PVE::Tools qw(run_command);
  21
  22 use PVE::Cluster::IPCConst;
  23
  24 use base 'Exporter';
  25
  26 our @EXPORT_OK = qw(
  27 cfs_read_file
  28 cfs_write_file
  29 cfs_register_file
  30 cfs_lock_file);
  31
  32 # x509 certificate utils
  33
  34 my $basedir = "/etc/pve";
  35 my $authdir = "$basedir/priv";
  36 my $lockdir = "/etc/pve/priv/lock";
  37
  38 # cfs and corosync files
  39 my $dbfile = "/var/lib/pve-cluster/config.db";
  40 my $dbbackupdir = "/var/lib/pve-cluster/backup";
  41
  42 # this is just a readonly copy, the relevant one is in status.c from pmxcfs
  43 # observed files are the one we can get directly through IPCC, they are cached
  44 # using a computed version and only those can be used by the cfs_*_file methods
  45 my $observed = {
  46     'vzdump.cron' => 1,
  47     'storage.cfg' => 1,
  48     'datacenter.cfg' => 1,
  49     'replication.cfg' => 1,
  50     'corosync.conf' => 1,
  51     'corosync.conf.new' => 1,
  52     'user.cfg' => 1,
  53     'domains.cfg' => 1,
  54     'priv/shadow.cfg' => 1,
  55     'priv/tfa.cfg' => 1,
  56     'priv/token.cfg' => 1,
  57     '/qemu-server/' => 1,
  58     '/openvz/' => 1,
  59     '/lxc/' => 1,
  60     'ha/crm_commands' => 1,
  61     'ha/manager_status' => 1,
  62     'ha/resources.cfg' => 1,
  63     'ha/groups.cfg' => 1,
  64     'ha/fence.cfg' => 1,
  65     'status.cfg' => 1,
  66     'ceph.conf' => 1,
  67     'sdn/vnets.cfg' => 1,
  68     'sdn/vnets.cfg.new' => 1,
  69     'sdn/zones.cfg' => 1,
  70     'sdn/zones.cfg.new' => 1,
  71     'sdn/controllers.cfg' => 1,
  72     'sdn/controllers.cfg.new' => 1,
  73     'virtual-guest/cpu-models.conf' => 1,
  74 };
  75
  76 sub base_dir {
  77     return $basedir;
  78 }
  79
  80 sub auth_dir {
  81     return $authdir;
  82 }
  83
  84 sub check_cfs_quorum {
  85     my ($noerr) = @_;
  86
  87     # note: -w filename always return 1 for root, so wee need
  88     # to use File::lstat here
  89     my $st = File::stat::lstat("$basedir/local");
  90     my $quorate = ($st && (($st->mode & 0200) != 0));
  91
  92     die "cluster not ready - no quorum?\n" if !$quorate && !$noerr;
  93
  94     return $quorate;
  95 }
  96
  97 sub check_cfs_is_mounted {
  98     my ($noerr) = @_;
  99
 100     my $res = -l "$basedir/local";
 101
 102     die "pve configuration filesystem not mounted\n"
 103         if !$res && !$noerr;
 104
 105     return $res;
 106 }
 107
 108 my $versions = {};
 109 my $vmlist = {};
 110 my $clinfo = {};
 111
 112 my $ipcc_send_rec = sub {
 113     my ($msgid, $data) = @_;
 114
 115     my $res = PVE::IPCC::ipcc_send_rec($msgid, $data);
 116
 117     die "ipcc_send_rec[$msgid] failed: $!\n" if !defined($res) && ($! != 0);
 118
 119     return $res;
 120 };
 121
 122 my $ipcc_send_rec_json = sub {
 123     my ($msgid, $data) = @_;
 124
 125     my $res = PVE::IPCC::ipcc_send_rec($msgid, $data);
 126
 127     die "ipcc_send_rec[$msgid] failed: $!\n" if !defined($res) && ($! != 0);
 128
 129     return decode_json($res);
 130 };
 131
 132 my $ipcc_get_config = sub {
 133     my ($path) = @_;
 134
 135     my $bindata = pack "Z*", $path;
 136     my $res = PVE::IPCC::ipcc_send_rec(CFS_IPC_GET_CONFIG, $bindata);
 137     if (!defined($res)) {
 138         if ($! != 0) {
 139             return undef if $! == ENOENT;
 140             die "$!\n";
 141         }
 142         return '';
 143     }
 144
 145     return $res;
 146 };
 147
 148 my $ipcc_get_status = sub {
 149     my ($name, $nodename) = @_;
 150
 151     my $bindata = pack "Z[256]Z[256]", $name, ($nodename || "");
 152     return PVE::IPCC::ipcc_send_rec(CFS_IPC_GET_STATUS, $bindata);
 153 };
 154
 155 my $ipcc_remove_status = sub {
 156     my ($name) = @_;
 157     # we just omit the data payload, pmxcfs takes this as hint and removes this
 158     # key from the status hashtable
 159     my $bindata = pack "Z[256]", $name;
 160     return &$ipcc_send_rec(CFS_IPC_SET_STATUS, $bindata);
 161 };
 162
 163 my $ipcc_update_status = sub {
 164     my ($name, $data) = @_;
 165
 166     my $raw = ref($data) ? encode_json($data) : $data;
 167     # update status
 168     my $bindata = pack "Z[256]Z*", $name, $raw;
 169
 170     return &$ipcc_send_rec(CFS_IPC_SET_STATUS, $bindata);
 171 };
 172
 173 my $ipcc_log = sub {
 174     my ($priority, $ident, $tag, $msg) = @_;
 175
 176     my $bindata = pack "CCCZ*Z*Z*", $priority, bytes::length($ident) + 1,
 177     bytes::length($tag) + 1, $ident, $tag, $msg;
 178
 179     return &$ipcc_send_rec(CFS_IPC_LOG_CLUSTER_MSG, $bindata);
 180 };
 181
 182 my $ipcc_get_cluster_log = sub {
 183     my ($user, $max) = @_;
 184
 185     $max = 0 if !defined($max);
 186
 187     my $bindata = pack "VVVVZ*", $max, 0, 0, 0, ($user || "");
 188     return &$ipcc_send_rec(CFS_IPC_GET_CLUSTER_LOG, $bindata);
 189 };
 190
 191 my $ipcc_verify_token = sub {
 192     my ($full_token) = @_;
 193
 194     my $bindata = pack "Z*", $full_token;
 195     my $res = PVE::IPCC::ipcc_send_rec(CFS_IPC_VERIFY_TOKEN, $bindata);
 196
 197     return 1 if $! == 0;
 198     return 0 if $! == ENOENT;
 199
 200     die "$!\n";
 201 };
 202
 203 my $ccache = {};
 204
 205 sub cfs_update {
 206     my ($fail) = @_;
 207     eval {
 208         my $res = &$ipcc_send_rec_json(CFS_IPC_GET_FS_VERSION);
 209         die "no starttime\n" if !$res->{starttime};
 210
 211         if (!$res->{starttime} || !$versions->{starttime} ||
 212             $res->{starttime} != $versions->{starttime}) {
 213             #print "detected changed starttime\n";
 214             $vmlist = {};
 215             $clinfo = {};
 216             $ccache = {};
 217         }
 218
 219         $versions = $res;
 220     };
 221     my $err = $@;
 222     if ($err) {
 223         $versions = {};
 224         $vmlist = {};
 225         $clinfo = {};
 226         $ccache = {};
 227         die $err if $fail;
 228         warn $err;
 229     }
 230
 231     eval {
 232         if (!$clinfo->{version} || $clinfo->{version} != $versions->{clinfo}) {
 233             #warn "detected new clinfo\n";
 234             $clinfo = &$ipcc_send_rec_json(CFS_IPC_GET_CLUSTER_INFO);
 235         }
 236     };
 237     $err = $@;
 238     if ($err) {
 239         $clinfo = {};
 240         die $err if $fail;
 241         warn $err;
 242     }
 243
 244     eval {
 245         if (!$vmlist->{version} || $vmlist->{version} != $versions->{vmlist}) {
 246             #warn "detected new vmlist1\n";
 247             $vmlist = &$ipcc_send_rec_json(CFS_IPC_GET_GUEST_LIST);
 248         }
 249     };
 250     $err = $@;
 251     if ($err) {
 252         $vmlist = {};
 253         die $err if $fail;
 254         warn $err;
 255     }
 256 }
 257
 258 sub get_vmlist {
 259     return $vmlist;
 260 }
 261
 262 sub get_clinfo {
 263     return $clinfo;
 264 }
 265
 266 sub get_members {
 267     return $clinfo->{nodelist};
 268 }
 269
 270 sub get_nodelist {
 271     my $nodelist = $clinfo->{nodelist};
 272
 273     my $nodename = PVE::INotify::nodename();
 274
 275     if (!$nodelist || !$nodelist->{$nodename}) {
 276         return [ $nodename ];
 277     }
 278
 279     return [ keys %$nodelist ];
 280 }
 281
 282 # only stored in a in-memory hashtable inside pmxcfs, local data is gone after
 283 # a restart (of pmxcfs or the node), peer data is still available then
 284 # best used for status data, like running (ceph) services, package versions, ...
 285 sub broadcast_node_kv {
 286     my ($key, $data) = @_;
 287
 288     if (!defined($data)) {
 289         eval {
 290             $ipcc_remove_status->("kv/$key");
 291         };
 292     } else {
 293         die "cannot send a reference\n" if ref($data);
 294         my $size = length($data);
 295         die "data for '$key' too big\n" if $size >= (32 * 1024); # limit from pmxfs
 296
 297         eval {
 298             $ipcc_update_status->("kv/$key", $data);
 299         };
 300     }
 301
 302     warn $@ if $@;
 303 }
 304
 305 # nodename is optional
 306 sub get_node_kv {
 307     my ($key, $nodename) = @_;
 308
 309     my $res = {};
 310     my $get_node_data = sub {
 311         my ($node) = @_;
 312         my $raw = $ipcc_get_status->("kv/$key", $node);
 313         $res->{$node} = unpack("Z*", $raw) if $raw;
 314     };
 315
 316     if ($nodename) {
 317         $get_node_data->($nodename);
 318     } else {
 319         my $nodelist = get_nodelist();
 320
 321         foreach my $node (@$nodelist) {
 322             $get_node_data->($node);
 323         }
 324     }
 325
 326     return $res;
 327 }
 328
 329 # property: a config property you want to get, e.g., this is perfect to get
 330 # the 'lock' entry of a guest _fast_ (>100 faster than manual parsing here)
 331 # vmid: optipnal, if a valid is passed we only check that one, else return all
 332 # NOTE: does *not* searches snapshot and PENDING entries sections!
 333 sub get_guest_config_property {
 334     my ($property, $vmid) = @_;
 335
 336     die "property is required" if !defined($property);
 337
 338     my $bindata = pack "VZ*", $vmid // 0, $property;
 339     my $res = $ipcc_send_rec_json->(CFS_IPC_GET_GUEST_CONFIG_PROPERTY, $bindata);
 340
 341     return $res;
 342 }
 343
 344 # $data must be a chronological descending ordered array of tasks
 345 sub broadcast_tasklist {
 346     my ($data) = @_;
 347
 348     # the serialized list may not get bigger than 32kb (CFS_MAX_STATUS_SIZE
 349     # from pmxcfs) - drop older items until we satisfy this constraint
 350     my $size = length(encode_json($data));
 351     while ($size >= (32 * 1024)) {
 352         pop @$data;
 353         $size = length(encode_json($data));
 354     }
 355
 356     eval {
 357         &$ipcc_update_status("tasklist", $data);
 358     };
 359
 360     warn $@ if $@;
 361 }
 362
 363 my $tasklistcache = {};
 364
 365 sub get_tasklist {
 366     my ($nodename) = @_;
 367
 368     my $kvstore = $versions->{kvstore} || {};
 369
 370     my $nodelist = get_nodelist();
 371
 372     my $res = [];
 373     foreach my $node (@$nodelist) {
 374         next if $nodename && ($nodename ne $node);
 375         eval {
 376             my $ver = $kvstore->{$node}->{tasklist} if $kvstore->{$node};
 377             my $cd = $tasklistcache->{$node};
 378             if (!$cd || !$ver || !$cd->{version} ||
 379                 ($cd->{version} != $ver)) {
 380                 my $raw = &$ipcc_get_status("tasklist", $node) || '[]';
 381                 my $data = decode_json($raw);
 382                 push @$res, @$data;
 383                 $cd = $tasklistcache->{$node} = {
 384                     data => $data,
 385                     version => $ver,
 386                 };
 387             } elsif ($cd && $cd->{data}) {
 388                 push @$res, @{$cd->{data}};
 389             }
 390         };
 391         my $err = $@;
 392         syslog('err', $err) if $err;
 393     }
 394
 395     return $res;
 396 }
 397
 398 sub broadcast_rrd {
 399     my ($rrdid, $data) = @_;
 400
 401     eval {
 402         &$ipcc_update_status("rrd/$rrdid", $data);
 403     };
 404     my $err = $@;
 405
 406     warn $err if $err;
 407 }
 408
 409 my $last_rrd_dump = 0;
 410 my $last_rrd_data = "";
 411
 412 sub rrd_dump {
 413
 414     my $ctime = time();
 415
 416     my $diff = $ctime - $last_rrd_dump;
 417     if ($diff < 2) {
 418         return $last_rrd_data;
 419     }
 420
 421     my $raw;
 422     eval {
 423         $raw = &$ipcc_send_rec(CFS_IPC_GET_RRD_DUMP);
 424     };
 425     my $err = $@;
 426
 427     if ($err) {
 428         warn $err;
 429         return {};
 430     }
 431
 432     my $res = {};
 433
 434     if ($raw) {
 435         while ($raw =~ s/^(.*)\n//) {
 436             my ($key, @ela) = split(/:/, $1);
 437             next if !$key;
 438             next if !(scalar(@ela) > 1);
 439             $res->{$key} = [ map { $_ eq 'U' ? undef : $_ } @ela ];
 440         }
 441     }
 442
 443     $last_rrd_dump = $ctime;
 444     $last_rrd_data = $res;
 445
 446     return $res;
 447 }
 448
 449
 450 # a fast way to read files (avoid fuse overhead)
 451 sub get_config {
 452     my ($path) = @_;
 453
 454     return &$ipcc_get_config($path);
 455 }
 456
 457 sub get_cluster_log {
 458     my ($user, $max) = @_;
 459
 460     return &$ipcc_get_cluster_log($user, $max);
 461 }
 462
 463 sub verify_token {
 464     my ($userid, $token) = @_;
 465
 466     return &$ipcc_verify_token("$userid $token");
 467 }
 468
 469 my $file_info = {};
 470
 471 sub cfs_register_file {
 472     my ($filename, $parser, $writer) = @_;
 473
 474     $observed->{$filename} || die "unknown file '$filename'";
 475
 476     die "file '$filename' already registered" if $file_info->{$filename};
 477
 478     $file_info->{$filename} = {
 479         parser => $parser,
 480         writer => $writer,
 481     };
 482 }
 483
 484 my $ccache_read = sub {
 485     my ($filename, $parser, $version) = @_;
 486
 487     $ccache->{$filename} = {} if !$ccache->{$filename};
 488
 489     my $ci = $ccache->{$filename};
 490
 491     if (!$ci->{version} || !$version || $ci->{version} != $version) {
 492         # we always call the parser, even when the file does not exist
 493         # (in that case $data is undef)
 494         my $data = get_config($filename);
 495         $ci->{data} = &$parser("/etc/pve/$filename", $data);
 496         $ci->{version} = $version;
 497     }
 498
 499     my $res = ref($ci->{data}) ? dclone($ci->{data}) : $ci->{data};
 500
 501     return $res;
 502 };
 503
 504 sub cfs_file_version {
 505     my ($filename) = @_;
 506
 507     my $version;
 508     my $infotag;
 509     if ($filename =~ m!^nodes/[^/]+/(openvz|lxc|qemu-server)/(\d+)\.conf$!) {
 510         my ($type, $vmid) = ($1, $2);
 511         if ($vmlist && $vmlist->{ids} && $vmlist->{ids}->{$vmid}) {
 512             $version = $vmlist->{ids}->{$vmid}->{version};
 513         }
 514         $infotag = "/$type/";
 515     } else {
 516         $infotag = $filename;
 517         $version = $versions->{$filename};
 518     }
 519
 520     my $info = $file_info->{$infotag} ||
 521         die "unknown file type '$filename'\n";
 522
 523     return wantarray ? ($version, $info) : $version;
 524 }
 525
 526 sub cfs_read_file {
 527     my ($filename) = @_;
 528
 529     my ($version, $info) = cfs_file_version($filename);
 530     my $parser = $info->{parser};
 531
 532     return &$ccache_read($filename, $parser, $version);
 533 }
 534
 535 sub cfs_write_file {
 536     my ($filename, $data) = @_;
 537
 538     my ($version, $info) = cfs_file_version($filename);
 539
 540     my $writer = $info->{writer} || die "no writer defined";
 541
 542     my $fsname = "/etc/pve/$filename";
 543
 544     my $raw = &$writer($fsname, $data);
 545
 546     if (my $ci = $ccache->{$filename}) {
 547         $ci->{version} = undef;
 548     }
 549
 550     PVE::Tools::file_set_contents($fsname, $raw);
 551 }
 552
 553 my $cfs_lock = sub {
 554     my ($lockid, $timeout, $code, @param) = @_;
 555
 556     my $prev_alarm = alarm(0); # suspend outer alarm early
 557
 558     my $res;
 559     my $got_lock = 0;
 560
 561     # this timeout is for acquire the lock
 562     $timeout = 10 if !$timeout;
 563
 564     my $filename = "$lockdir/$lockid";
 565
 566     eval {
 567
 568         mkdir $lockdir;
 569
 570         if (! -d $lockdir) {
 571             die "pve cluster filesystem not online.\n";
 572         }
 573
 574         my $timeout_err = sub { die "got lock request timeout\n"; };
 575         local $SIG{ALRM} = $timeout_err;
 576
 577         while (1) {
 578             alarm ($timeout);
 579             $got_lock = mkdir($filename);
 580             $timeout = alarm(0) - 1; # we'll sleep for 1s, see down below
 581
 582             last if $got_lock;
 583
 584             $timeout_err->() if $timeout <= 0;
 585
 586             print STDERR "trying to acquire cfs lock '$lockid' ...\n";
 587             utime (0, 0, $filename); # cfs unlock request
 588             sleep(1);
 589         }
 590
 591         # fixed command timeout: cfs locks have a timeout of 120
 592         # using 60 gives us another 60 seconds to abort the task
 593         local $SIG{ALRM} = sub { die "got lock timeout - aborting command\n"; };
 594         alarm(60);
 595
 596         cfs_update(); # make sure we read latest versions inside code()
 597
 598         $res = &$code(@param);
 599
 600         alarm(0);
 601     };
 602
 603     my $err = $@;
 604
 605     $err = "no quorum!\n" if !$got_lock && !check_cfs_quorum(1);
 606
 607     rmdir $filename if $got_lock; # if we held the lock always unlock again
 608
 609     alarm($prev_alarm);
 610
 611     if ($err) {
 612         if (ref($err) eq 'PVE::Exception') {
 613             # re-raise defined exceptions
 614             $@ = $err;
 615         } else {
 616             # add lock info for plain errors
 617             $@ = "error with cfs lock '$lockid': $err";
 618         }
 619         return undef;
 620     }
 621
 622     $@ = undef;
 623
 624     return $res;
 625 };
 626
 627 sub cfs_lock_file {
 628     my ($filename, $timeout, $code, @param) = @_;
 629
 630     my $info = $observed->{$filename} || die "unknown file '$filename'";
 631
 632     my $lockid = "file-$filename";
 633     $lockid =~ s/[.\/]/_/g;
 634
 635     &$cfs_lock($lockid, $timeout, $code, @param);
 636 }
 637
 638 sub cfs_lock_storage {
 639     my ($storeid, $timeout, $code, @param) = @_;
 640
 641     my $lockid = "storage-$storeid";
 642
 643     &$cfs_lock($lockid, $timeout, $code, @param);
 644 }
 645
 646 sub cfs_lock_domain {
 647     my ($domainname, $timeout, $code, @param) = @_;
 648
 649     my $lockid = "domain-$domainname";
 650
 651     &$cfs_lock($lockid, $timeout, $code, @param);
 652 }
 653
 654 sub cfs_lock_acme {
 655     my ($account, $timeout, $code, @param) = @_;
 656
 657     my $lockid = "acme-$account";
 658
 659     &$cfs_lock($lockid, $timeout, $code, @param);
 660 }
 661
 662 sub cfs_lock_authkey {
 663     my ($timeout, $code, @param) = @_;
 664
 665     $cfs_lock->('authkey', $timeout, $code, @param);
 666 }
 667
 668 sub cfs_lock_firewall {
 669     my ($scope, $timeout, $code, @param) = @_;
 670
 671     my $lockid = "firewall-$scope";
 672
 673     $cfs_lock->($lockid, $timeout, $code, @param);
 674 }
 675
 676 my $log_levels = {
 677     "emerg" => 0,
 678     "alert" => 1,
 679     "crit" => 2,
 680     "critical" => 2,
 681     "err" => 3,
 682     "error" => 3,
 683     "warn" => 4,
 684     "warning" => 4,
 685     "notice" => 5,
 686     "info" => 6,
 687     "debug" => 7,
 688 };
 689
 690 sub log_msg {
 691    my ($priority, $ident, $msg) = @_;
 692
 693    if (my $tmp = $log_levels->{$priority}) {
 694        $priority = $tmp;
 695    }
 696
 697    die "need numeric log priority" if $priority !~ /^\d+$/;
 698
 699    my $tag = PVE::SafeSyslog::tag();
 700
 701    $msg = "empty message" if !$msg;
 702
 703    $ident = "" if !$ident;
 704    $ident = encode("ascii", $ident,
 705                    sub { sprintf "\\u%04x", shift });
 706
 707    my $ascii = encode("ascii", $msg, sub { sprintf "\\u%04x", shift });
 708
 709    if ($ident) {
 710        syslog($priority, "<%s> %s", $ident, $ascii);
 711    } else {
 712        syslog($priority, "%s", $ascii);
 713    }
 714
 715    eval { &$ipcc_log($priority, $ident, $tag, $ascii); };
 716
 717    syslog("err", "writing cluster log failed: $@") if $@;
 718 }
 719
 720 sub check_vmid_unused {
 721     my ($vmid, $noerr) = @_;
 722
 723     my $vmlist = get_vmlist();
 724
 725     my $d = $vmlist->{ids}->{$vmid};
 726     return 1 if !defined($d);
 727
 728     return undef if $noerr;
 729
 730     my $vmtypestr =  $d->{type} eq 'qemu' ? 'VM' : 'CT';
 731     die "$vmtypestr $vmid already exists on node '$d->{node}'\n";
 732 }
 733
 734 sub check_node_exists {
 735     my ($nodename, $noerr) = @_;
 736
 737     my $nodelist = $clinfo->{nodelist};
 738     return 1 if $nodelist && $nodelist->{$nodename};
 739
 740     return undef if $noerr;
 741
 742     die "no such cluster node '$nodename'\n";
 743 }
 744
 745 # this is also used to get the IP of the local node
 746 sub remote_node_ip {
 747     my ($nodename, $noerr) = @_;
 748
 749     my $nodelist = $clinfo->{nodelist};
 750     if ($nodelist && $nodelist->{$nodename}) {
 751         if (my $ip = $nodelist->{$nodename}->{ip}) {
 752             return $ip if !wantarray;
 753             my $family = $nodelist->{$nodename}->{address_family};
 754             if (!$family) {
 755                 $nodelist->{$nodename}->{address_family} =
 756                     $family =
 757                     PVE::Tools::get_host_address_family($ip);
 758             }
 759             return wantarray ? ($ip, $family) : $ip;
 760         }
 761     }
 762
 763     # fallback: try to get IP by other means
 764     return PVE::Network::get_ip_from_hostname($nodename, $noerr);
 765 }
 766
 767 sub get_node_fingerprint {
 768     my ($node) = @_;
 769
 770     my $cert_path = "/etc/pve/nodes/$node/pve-ssl.pem";
 771     my $custom_cert_path = "/etc/pve/nodes/$node/pveproxy-ssl.pem";
 772
 773     $cert_path = $custom_cert_path if -f $custom_cert_path;
 774
 775     return PVE::Certificate::get_certificate_fingerprint($cert_path);
 776 }
 777
 778 # bash completion helpers
 779
 780 sub complete_next_vmid {
 781
 782     my $vmlist = get_vmlist() || {};
 783     my $idlist = $vmlist->{ids} || {};
 784
 785     for (my $i = 100; $i < 10000; $i++) {
 786         return [$i] if !defined($idlist->{$i});
 787     }
 788
 789     return [];
 790 }
 791
 792 sub complete_vmid {
 793
 794     my $vmlist = get_vmlist();
 795     my $ids = $vmlist->{ids} || {};
 796
 797     return [ keys %$ids ];
 798 }
 799
 800 sub complete_local_vmid {
 801
 802     my $vmlist = get_vmlist();
 803     my $ids = $vmlist->{ids} || {};
 804
 805     my $nodename = PVE::INotify::nodename();
 806
 807     my $res = [];
 808     foreach my $vmid (keys %$ids) {
 809         my $d = $ids->{$vmid};
 810         next if !$d->{node} || $d->{node} ne $nodename;
 811         push @$res, $vmid;
 812     }
 813
 814     return $res;
 815 }
 816
 817 sub complete_migration_target {
 818
 819     my $res = [];
 820
 821     my $nodename = PVE::INotify::nodename();
 822
 823     my $nodelist = get_nodelist();
 824     foreach my $node (@$nodelist) {
 825         next if $node eq $nodename;
 826         push @$res, $node;
 827     }
 828
 829     return $res;
 830 }
 831
 832
 833 # NOTE: filesystem must be offline here, no DB changes allowed
 834 sub cfs_backup_database {
 835     mkdir $dbbackupdir;
 836
 837     my $ctime = time();
 838     my $backup_fn = "$dbbackupdir/config-$ctime.sql.gz";
 839
 840     print "backup old database to '$backup_fn'\n";
 841
 842     my $cmd = [ ['sqlite3', $dbfile, '.dump'], ['gzip', '-', \ ">${backup_fn}"] ];
 843     run_command($cmd, 'errmsg' => "cannot backup old database\n");
 844
 845     my $maxfiles = 10; # purge older backup
 846     my $backups = [ sort { $b cmp $a } <$dbbackupdir/config-*.sql.gz> ];
 847
 848     if ((my $count = scalar(@$backups)) > $maxfiles) {
 849         foreach my $f (@$backups[$maxfiles..$count-1]) {
 850             next if $f !~ m/^(\S+)$/; # untaint
 851             print "delete old backup '$1'\n";
 852             unlink $1;
 853         }
 854     }
 855
 856     return $dbfile;
 857 }
 858
 859 1;