8 use Storable
qw(dclone);
13 use Digest
::HMAC_SHA1
;
30 use Data
::Dumper
; # fixme: remove
32 # x509 certificate utils
34 my $basedir = "/etc/pve";
35 my $authdir = "$basedir/priv";
36 my $lockdir = "/etc/pve/priv/lock";
38 my $authprivkeyfn = "$authdir/authkey.key";
39 my $authpubkeyfn = "$basedir/authkey.pub";
40 my $pveca_key_fn = "$authdir/pve-root-ca.key";
41 my $pveca_srl_fn = "$authdir/pve-root-ca.srl";
42 my $pveca_cert_fn = "$basedir/pve-root-ca.pem";
43 # this is just a secret accessable by the web browser
44 # and is used for CSRF prevention
45 my $pvewww_key_fn = "$basedir/pve-www.key";
48 my $ssh_rsa_id_priv = "/root/.ssh/id_rsa";
49 my $ssh_rsa_id = "/root/.ssh/id_rsa.pub";
50 my $ssh_host_rsa_id = "/etc/ssh/ssh_host_rsa_key.pub";
51 my $sshglobalknownhosts = "/etc/ssh/ssh_known_hosts";
52 my $sshknownhosts = "/etc/pve/priv/known_hosts";
53 my $sshauthkeys = "/etc/pve/priv/authorized_keys";
54 my $rootsshauthkeys = "/root/.ssh/authorized_keys";
55 my $rootsshauthkeysbackup = "${rootsshauthkeys}.org";
56 my $rootsshconfig = "/root/.ssh/config";
61 'datacenter.cfg' => 1,
63 'cluster.conf.new' => 1,
66 'priv/shadow.cfg' => 1,
71 # only write output if something fails
77 my $record_output = sub {
83 PVE
::Tools
::run_command
($cmd, outfunc
=> $record_output,
84 errfunc
=> $record_output);
95 sub check_cfs_quorum
{
98 # note: -w filename always return 1 for root, so wee need
99 # to use File::lstat here
100 my $st = File
::stat::lstat("$basedir/local");
101 my $quorate = ($st && (($st->mode & 0200) != 0));
103 die "cluster not ready - no quorum?\n" if !$quorate && !$noerr;
108 sub check_cfs_is_mounted
{
111 my $res = -l
"$basedir/local";
113 die "pve configuration filesystem not mounted\n"
122 check_cfs_is_mounted
();
124 my @required_dirs = (
127 "$basedir/nodes/$nodename",
128 "$basedir/nodes/$nodename/qemu-server",
129 "$basedir/nodes/$nodename/openvz",
130 "$basedir/nodes/$nodename/priv");
132 foreach my $dir (@required_dirs) {
134 mkdir($dir) || $! == EEXIST
|| die "unable to create directory '$dir' - $!\n";
141 return if -f
"$authprivkeyfn";
143 check_cfs_is_mounted
();
145 mkdir $authdir || $! == EEXIST
|| die "unable to create dir '$authdir' - $!\n";
147 my $cmd = "openssl genrsa -out '$authprivkeyfn' 2048";
148 run_silent_cmd
($cmd);
150 $cmd = "openssl rsa -in '$authprivkeyfn' -pubout -out '$authpubkeyfn'";
156 return if -f
$pveca_key_fn;
159 run_silent_cmd
(['openssl', 'genrsa', '-out', $pveca_key_fn, '2048']);
162 die "unable to generate pve ca key:\n$@" if $@;
167 if (-f
$pveca_key_fn && -f
$pveca_cert_fn) {
173 # we try to generate an unique 'subject' to avoid browser problems
174 # (reused serial numbers, ..)
175 my $nid = (split (/\s/, `md5sum '$pveca_key_fn'`))[0] || time();
178 run_silent_cmd
(['openssl', 'req', '-batch', '-days', '3650', '-new',
179 '-x509', '-nodes', '-key',
180 $pveca_key_fn, '-out', $pveca_cert_fn, '-subj',
181 "/CN=Proxmox Virtual Environment/OU=$nid/O=PVE Cluster Manager CA/"]);
184 die "generating pve root certificate failed:\n$@" if $@;
189 sub gen_pve_ssl_key
{
192 die "no node name specified" if !$nodename;
194 my $pvessl_key_fn = "$basedir/nodes/$nodename/pve-ssl.key";
196 return if -f
$pvessl_key_fn;
199 run_silent_cmd
(['openssl', 'genrsa', '-out', $pvessl_key_fn, '2048']);
202 die "unable to generate pve ssl key for node '$nodename':\n$@" if $@;
205 sub gen_pve_www_key
{
207 return if -f
$pvewww_key_fn;
210 run_silent_cmd
(['openssl', 'genrsa', '-out', $pvewww_key_fn, '2048']);
213 die "unable to generate pve www key:\n$@" if $@;
219 PVE
::Tools
::file_set_contents
($pveca_srl_fn, $serial);
222 sub gen_pve_ssl_cert
{
223 my ($force, $nodename, $ip) = @_;
225 die "no node name specified" if !$nodename;
226 die "no IP specified" if !$ip;
228 my $pvessl_cert_fn = "$basedir/nodes/$nodename/pve-ssl.pem";
230 return if !$force && -f
$pvessl_cert_fn;
232 my $names = "IP:127.0.0.1,DNS:localhost";
234 my $rc = PVE
::INotify
::read_file
('resolvconf');
238 my $fqdn = $nodename;
240 $names .= ",DNS:$nodename";
242 if ($rc && $rc->{search
}) {
243 $fqdn = $nodename . "." . $rc->{search
};
244 $names .= ",DNS:$fqdn";
247 my $sslconf = <<__EOD;
248 RANDFILE = /root/.rnd
253 distinguished_name = req_distinguished_name
254 req_extensions = v3_req
256 string_mask = nombstr
258 [ req_distinguished_name ]
259 organizationalUnitName = PVE Cluster Node
260 organizationName = Proxmox Virtual Environment
264 basicConstraints = CA:FALSE
266 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
267 subjectAltName = $names
270 my $cfgfn = "/tmp/pvesslconf-$$.tmp";
271 my $fh = IO
::File-
>new ($cfgfn, "w");
275 my $reqfn = "/tmp/pvecertreq-$$.tmp";
278 my $pvessl_key_fn = "$basedir/nodes/$nodename/pve-ssl.key";
280 run_silent_cmd
(['openssl', 'req', '-batch', '-new', '-config', $cfgfn,
281 '-key', $pvessl_key_fn, '-out', $reqfn]);
287 die "unable to generate pve certificate request:\n$err";
290 update_serial
("0000000000000000") if ! -f
$pveca_srl_fn;
293 run_silent_cmd
(['openssl', 'x509', '-req', '-in', $reqfn, '-days', '3650',
294 '-out', $pvessl_cert_fn, '-CAkey', $pveca_key_fn,
295 '-CA', $pveca_cert_fn, '-CAserial', $pveca_srl_fn,
296 '-extfile', $cfgfn]);
302 die "unable to generate pve ssl certificate:\n$err";
309 sub gen_pve_node_files
{
310 my ($nodename, $ip, $opt_force) = @_;
312 gen_local_dirs
($nodename);
316 # make sure we have a (cluster wide) secret
317 # for CSRFR prevention
320 # make sure we have a (per node) private key
321 gen_pve_ssl_key
($nodename);
323 # make sure we have a CA
324 my $force = gen_pveca_cert
();
326 $force = 1 if $opt_force;
328 gen_pve_ssl_cert
($force, $nodename, $ip);
331 my $vzdump_cron_dummy = <<__EOD;
332 # cluster wide vzdump cron schedule
333 # Atomatically generated file - do not edit
335 PATH="/usr/sbin:/usr/bin:/sbin:/bin"
339 sub gen_pve_vzdump_symlink
{
341 my $filename = "/etc/pve/vzdump.cron";
343 my $link_fn = "/etc/cron.d/vzdump";
345 if ((-f
$filename) && (! -l
$link_fn)) {
346 rename($link_fn, "/root/etc_cron_vzdump.org"); # make backup if file exists
347 symlink($filename, $link_fn);
351 sub gen_pve_vzdump_files
{
353 my $filename = "/etc/pve/vzdump.cron";
355 PVE
::Tools
::file_set_contents
($filename, $vzdump_cron_dummy)
358 gen_pve_vzdump_symlink
();
365 my $ipcc_send_rec = sub {
366 my ($msgid, $data) = @_;
368 my $res = PVE
::IPCC
::ipcc_send_rec
($msgid, $data);
370 die "ipcc_send_rec failed: $!\n" if !defined($res) && ($! != 0);
375 my $ipcc_send_rec_json = sub {
376 my ($msgid, $data) = @_;
378 my $res = PVE
::IPCC
::ipcc_send_rec
($msgid, $data);
380 die "ipcc_send_rec failed: $!\n" if !defined($res) && ($! != 0);
382 return decode_json
($res);
385 my $ipcc_get_config = sub {
388 my $bindata = pack "Z*", $path;
389 my $res = PVE
::IPCC
::ipcc_send_rec
(6, $bindata);
390 if (!defined($res)) {
391 return undef if ($! != 0);
398 my $ipcc_get_status = sub {
399 my ($name, $nodename) = @_;
401 my $bindata = pack "Z[256]Z[256]", $name, ($nodename || "");
402 return PVE
::IPCC
::ipcc_send_rec
(5, $bindata);
405 my $ipcc_update_status = sub {
406 my ($name, $data) = @_;
408 my $raw = ref($data) ? encode_json
($data) : $data;
410 my $bindata = pack "Z[256]Z*", $name, $raw;
412 return &$ipcc_send_rec(4, $bindata);
416 my ($priority, $ident, $tag, $msg) = @_;
418 my $bindata = pack "CCCZ*Z*Z*", $priority, bytes
::length($ident) + 1,
419 bytes
::length($tag) + 1, $ident, $tag, $msg;
421 return &$ipcc_send_rec(7, $bindata);
424 my $ipcc_get_cluster_log = sub {
425 my ($user, $max) = @_;
427 $max = 0 if !defined($max);
429 my $bindata = pack "VVVVZ*", $max, 0, 0, 0, ($user || "");
430 return &$ipcc_send_rec(8, $bindata);
437 my $res = &$ipcc_send_rec_json(1);
438 #warn "GOT1: " . Dumper($res);
439 die "no starttime\n" if !$res->{starttime
};
441 if (!$res->{starttime
} || !$versions->{starttime
} ||
442 $res->{starttime
} != $versions->{starttime
}) {
443 #print "detected changed starttime\n";
461 if (!$clinfo->{version
} || $clinfo->{version
} != $versions->{clinfo
}) {
462 #warn "detected new clinfo\n";
463 $clinfo = &$ipcc_send_rec_json(2);
473 if (!$vmlist->{version
} || $vmlist->{version
} != $versions->{vmlist
}) {
474 #warn "detected new vmlist1\n";
475 $vmlist = &$ipcc_send_rec_json(3);
494 return $clinfo->{nodelist
};
499 my $nodelist = $clinfo->{nodelist
};
503 my $nodename = PVE
::INotify
::nodename
();
505 if (!$nodelist || !$nodelist->{$nodename}) {
506 return [ $nodename ];
509 return [ keys %$nodelist ];
512 sub broadcast_tasklist
{
516 &$ipcc_update_status("tasklist", $data);
522 my $tasklistcache = {};
527 my $kvstore = $versions->{kvstore
} || {};
529 my $nodelist = get_nodelist
();
532 foreach my $node (@$nodelist) {
533 next if $nodename && ($nodename ne $node);
535 my $ver = $kvstore->{$node}->{tasklist
} if $kvstore->{$node};
536 my $cd = $tasklistcache->{$node};
537 if (!$cd || !$ver || !$cd->{version
} ||
538 ($cd->{version
} != $ver)) {
539 my $raw = &$ipcc_get_status("tasklist", $node) || '[]';
540 my $data = decode_json
($raw);
542 $cd = $tasklistcache->{$node} = {
546 } elsif ($cd && $cd->{data
}) {
547 push @$res, @{$cd->{data
}};
551 syslog
('err', $err) if $err;
558 my ($rrdid, $data) = @_;
561 &$ipcc_update_status("rrd/$rrdid", $data);
568 my $last_rrd_dump = 0;
569 my $last_rrd_data = "";
575 my $diff = $ctime - $last_rrd_dump;
577 return $last_rrd_data;
582 $raw = &$ipcc_send_rec(10);
594 while ($raw =~ s/^(.*)\n//) {
595 my ($key, @ela) = split(/:/, $1);
597 next if !(scalar(@ela) > 1);
598 $res->{$key} = \
@ela;
602 $last_rrd_dump = $ctime;
603 $last_rrd_data = $res;
608 sub create_rrd_data
{
609 my ($rrdname, $timeframe, $cf) = @_;
611 my $rrddir = "/var/lib/rrdcached/db";
613 my $rrd = "$rrddir/$rrdname";
617 day
=> [ 60*30, 70 ],
618 week
=> [ 60*180, 70 ],
619 month
=> [ 60*720, 70 ],
620 year
=> [ 60*10080, 70 ],
623 my ($reso, $count) = @{$setup->{$timeframe}};
624 my $ctime = $reso*int(time()/$reso);
625 my $req_start = $ctime - $reso*$count;
627 $cf = "AVERAGE" if !$cf;
635 my $socket = "/var/run/rrdcached.sock";
636 push @args, "--daemon" => "unix:$socket" if -S
$socket;
638 my ($start, $step, $names, $data) = RRDs
::fetch
($rrd, $cf, @args);
640 my $err = RRDs
::error
;
641 die "RRD error: $err\n" if $err;
643 die "got wrong time resolution ($step != $reso)\n"
647 my $fields = scalar(@$names);
648 for my $line (@$data) {
649 my $entry = { 'time' => $start };
652 for (my $i = 0; $i < $fields; $i++) {
653 my $name = $names->[$i];
654 if (defined(my $val = $line->[$i])) {
655 $entry->{$name} = $val;
657 # we only add entryies with all data defined
658 # extjs chart has problems with undefined values
662 push @$res, $entry if !$found_undefs;
668 sub create_rrd_graph
{
669 my ($rrdname, $timeframe, $ds, $cf) = @_;
671 # Using RRD graph is clumsy - maybe it
672 # is better to simply fetch the data, and do all display
673 # related things with javascript (new extjs html5 graph library).
675 my $rrddir = "/var/lib/rrdcached/db";
677 my $rrd = "$rrddir/$rrdname";
679 my @ids = PVE
::Tools
::split_list
($ds);
681 my $ds_txt = join('_', @ids);
683 my $filename = "${rrd}_${ds_txt}.png";
687 day
=> [ 60*30, 70 ],
688 week
=> [ 60*180, 70 ],
689 month
=> [ 60*720, 70 ],
690 year
=> [ 60*10080, 70 ],
693 my ($reso, $count) = @{$setup->{$timeframe}};
696 "--imgformat" => "PNG",
700 "--start" => - $reso*$count,
704 my $socket = "/var/run/rrdcached.sock";
705 push @args, "--daemon" => "unix:$socket" if -S
$socket;
707 my @coldef = ('#00ddff', '#ff0000');
709 $cf = "AVERAGE" if !$cf;
712 foreach my $id (@ids) {
713 my $col = $coldef[$i++] || die "fixme: no color definition";
714 push @args, "DEF:${id}=$rrd:${id}:$cf";
716 if ($id eq 'cpu' || $id eq 'iowait') {
717 push @args, "CDEF:${id}_per=${id},100,*";
718 $dataid = "${id}_per";
720 push @args, "LINE2:${dataid}${col}:${id}";
723 push @args, '--full-size-mode';
725 # we do not really store data into the file
726 my $res = RRDs
::graphv
('', @args);
728 my $err = RRDs
::error
;
729 die "RRD error: $err\n" if $err;
731 return { filename
=> $filename, image
=> $res->{image
} };
734 # a fast way to read files (avoid fuse overhead)
738 return &$ipcc_get_config($path);
741 sub get_cluster_log
{
742 my ($user, $max) = @_;
744 return &$ipcc_get_cluster_log($user, $max);
749 sub cfs_register_file
{
750 my ($filename, $parser, $writer) = @_;
752 $observed->{$filename} || die "unknown file '$filename'";
754 die "file '$filename' already registered" if $file_info->{$filename};
756 $file_info->{$filename} = {
762 my $ccache_read = sub {
763 my ($filename, $parser, $version) = @_;
765 $ccache->{$filename} = {} if !$ccache->{$filename};
767 my $ci = $ccache->{$filename};
769 if (!$ci->{version
} || !$version || $ci->{version
} != $version) {
770 # we always call the parser, even when the file does not exists
771 # (in that case $data is undef)
772 my $data = get_config
($filename);
773 $ci->{data
} = &$parser("/etc/pve/$filename", $data);
774 $ci->{version
} = $version;
777 my $res = ref($ci->{data
}) ? dclone
($ci->{data
}) : $ci->{data
};
782 sub cfs_file_version
{
787 if ($filename =~ m!^nodes/[^/]+/(openvz|qemu-server)/(\d+)\.conf$!) {
788 my ($type, $vmid) = ($1, $2);
789 if ($vmlist && $vmlist->{ids
} && $vmlist->{ids
}->{$vmid}) {
790 $version = $vmlist->{ids
}->{$vmid}->{version
};
792 $infotag = "/$type/";
794 $infotag = $filename;
795 $version = $versions->{$filename};
798 my $info = $file_info->{$infotag} ||
799 die "unknown file type '$filename'\n";
801 return wantarray ?
($version, $info) : $version;
807 my ($version, $info) = cfs_file_version
($filename);
808 my $parser = $info->{parser
};
810 return &$ccache_read($filename, $parser, $version);
814 my ($filename, $data) = @_;
816 my ($version, $info) = cfs_file_version
($filename);
818 my $writer = $info->{writer
} || die "no writer defined";
820 my $fsname = "/etc/pve/$filename";
822 my $raw = &$writer($fsname, $data);
824 if (my $ci = $ccache->{$filename}) {
825 $ci->{version
} = undef;
828 PVE
::Tools
::file_set_contents
($fsname, $raw);
832 my ($lockid, $timeout, $code, @param) = @_;
836 # this timeout is for aquire the lock
837 $timeout = 10 if !$timeout;
839 my $filename = "$lockdir/$lockid";
841 my $msg = "can't aquire cfs lock '$lockid'";
848 die "$msg: pve cluster filesystem not online.\n";
851 local $SIG{ALRM
} = sub { die "got lock request timeout\n"; };
855 if (!(mkdir $filename)) {
856 print STDERR
"trying to aquire cfs lock '$lockid' ...";
858 if (!(mkdir $filename)) {
859 (utime 0, 0, $filename); # cfs unlock request
861 print STDERR
" OK\n";
868 # fixed command timeout: cfs locks have a timeout of 120
869 # using 60 gives us another 60 seconds to abort the task
871 local $SIG{ALRM
} = sub { die "got lock timeout - aborting command\n"; };
873 cfs_update
(); # make sure we read latest versions inside code()
875 $res = &$code(@param);
884 if ($err && ($err eq "got lock request timeout\n") &&
885 !check_cfs_quorum
()){
886 $err = "$msg: no quorum!\n";
889 if (!$err || $err !~ /^got lock timeout -/) {
890 rmdir $filename; # cfs unlock
904 my ($filename, $timeout, $code, @param) = @_;
906 my $info = $observed->{$filename} || die "unknown file '$filename'";
908 my $lockid = "file-$filename";
909 $lockid =~ s/[.\/]/_
/g
;
911 &$cfs_lock($lockid, $timeout, $code, @param);
914 sub cfs_lock_storage
{
915 my ($storeid, $timeout, $code, @param) = @_;
917 my $lockid = "storage-$storeid";
919 &$cfs_lock($lockid, $timeout, $code, @param);
937 my ($priority, $ident, $msg) = @_;
939 if (my $tmp = $log_levels->{$priority}) {
943 die "need numeric log priority" if $priority !~ /^\d+$/;
945 my $tag = PVE
::SafeSyslog
::tag
();
947 $msg = "empty message" if !$msg;
949 $ident = "" if !$ident;
950 $ident = encode
("ascii", decode_utf8
($ident),
951 sub { sprintf "\\u%04x", shift });
953 my $utf8 = decode_utf8
($msg);
955 my $ascii = encode
("ascii", $utf8, sub { sprintf "\\u%04x", shift });
958 syslog
($priority, "<%s> %s", $ident, $ascii);
960 syslog
($priority, "%s", $ascii);
963 eval { &$ipcc_log($priority, $ident, $tag, $ascii); };
965 syslog
("err", "writing cluster log failed: $@") if $@;
968 sub check_node_exists
{
969 my ($nodename, $noerr) = @_;
971 my $nodelist = $clinfo->{nodelist
};
972 return 1 if $nodelist && $nodelist->{$nodename};
974 return undef if $noerr;
976 die "no such cluster node '$nodename'\n";
979 # this is also used to get the IP of the local node
981 my ($nodename, $noerr) = @_;
983 my $nodelist = $clinfo->{nodelist
};
984 if ($nodelist && $nodelist->{$nodename}) {
985 if (my $ip = $nodelist->{$nodename}->{ip
}) {
990 # fallback: try to get IP by other means
991 my $packed_ip = gethostbyname($nodename);
992 if (defined $packed_ip) {
993 my $ip = inet_ntoa
($packed_ip);
995 if ($ip =~ m/^127\./) {
996 die "hostname lookup failed - got local IP address ($nodename = $ip)\n" if !$noerr;
1003 die "unable to get IP for node '$nodename' - node offline?\n" if !$noerr;
1008 # ssh related utility functions
1010 sub ssh_merge_keys
{
1011 # remove duplicate keys in $sshauthkeys
1012 # ssh-copy-id simply add keys, so the file can grow to large
1015 if (-f
$sshauthkeys) {
1016 $data = PVE
::Tools
::file_get_contents
($sshauthkeys, 128*1024);
1021 if (-f
$rootsshauthkeysbackup) {
1023 $data .= PVE
::Tools
::file_get_contents
($rootsshauthkeysbackup, 128*1024);
1028 # always add ourself
1029 if (-f
$ssh_rsa_id) {
1030 my $pub = PVE
::Tools
::file_get_contents
($ssh_rsa_id);
1032 $data .= "\n$pub\n";
1037 my @lines = split(/\n/, $data);
1038 foreach my $line (@lines) {
1039 if ($line !~ /^#/ && $line =~ m/(^|\s)ssh-(rsa|dsa)\s+(\S+)\s+\S+$/) {
1040 next if $vhash->{$3}++;
1042 $newdata .= "$line\n";
1045 PVE
::Tools
::file_set_contents
($sshauthkeys, $newdata, 0600);
1047 if ($found_backup && -l
$rootsshauthkeys) {
1048 # everything went well, so we can remove the backup
1049 unlink $rootsshauthkeysbackup;
1053 sub setup_rootsshconfig
{
1055 # create ssh key if it does not exist
1056 if (! -f
$ssh_rsa_id) {
1057 mkdir '/root/.ssh/';
1058 system ("echo|ssh-keygen -t rsa -N '' -b 2048 -f ${ssh_rsa_id_priv}");
1061 # create ssh config if it does not exist
1062 if (! -f
$rootsshconfig) {
1064 if (my $fh = IO
::File-
>new($rootsshconfig, O_CREAT
|O_WRONLY
|O_EXCL
, 0640)) {
1065 # this is the default ciphers list from debian openssl0.9.8 except blowfish is added as prefered
1066 print $fh "Ciphers blowfish-cbc,aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc\n";
1072 sub setup_ssh_keys
{
1078 if (! -f
$sshauthkeys) {
1080 if (-f
$rootsshauthkeys) {
1081 $old = PVE
::Tools
::file_get_contents
($rootsshauthkeys, 128*1024);
1083 if (my $fh = IO
::File-
>new ($sshauthkeys, O_CREAT
|O_WRONLY
|O_EXCL
, 0400)) {
1084 PVE
::Tools
::safe_print
($sshauthkeys, $fh, $old) if $old;
1090 warn "can't create shared ssh key database '$sshauthkeys'\n"
1091 if ! -f
$sshauthkeys;
1093 if (-f
$rootsshauthkeys && ! -l
$rootsshauthkeys) {
1094 if (!rename($rootsshauthkeys , $rootsshauthkeysbackup)) {
1095 warn "rename $rootsshauthkeys failed - $!\n";
1099 if (! -l
$rootsshauthkeys) {
1100 symlink $sshauthkeys, $rootsshauthkeys;
1103 if (! -l
$rootsshauthkeys) {
1104 warn "can't create symlink for ssh keys '$rootsshauthkeys' -> '$sshauthkeys'\n";
1106 unlink $rootsshauthkeysbackup if $import_ok;
1110 sub ssh_unmerge_known_hosts
{
1111 return if ! -l
$sshglobalknownhosts;
1114 $old = PVE
::Tools
::file_get_contents
($sshknownhosts, 128*1024)
1115 if -f
$sshknownhosts;
1117 PVE
::Tools
::file_set_contents
($sshglobalknownhosts, $old);
1120 sub ssh_merge_known_hosts
{
1121 my ($nodename, $ip_address, $createLink) = @_;
1123 die "no node name specified" if !$nodename;
1124 die "no ip address specified" if !$ip_address;
1128 if (! -f
$sshknownhosts) {
1129 if (my $fh = IO
::File-
>new($sshknownhosts, O_CREAT
|O_WRONLY
|O_EXCL
, 0600)) {
1134 my $old = PVE
::Tools
::file_get_contents
($sshknownhosts, 128*1024);
1138 if ((! -l
$sshglobalknownhosts) && (-f
$sshglobalknownhosts)) {
1139 $new = PVE
::Tools
::file_get_contents
($sshglobalknownhosts, 128*1024);
1142 my $hostkey = PVE
::Tools
::file_get_contents
($ssh_host_rsa_id);
1143 die "can't parse $ssh_rsa_id" if $hostkey !~ m/^(ssh-rsa\s\S+)(\s.*)?$/;
1152 my $merge_line = sub {
1153 my ($line, $all) = @_;
1155 if ($line =~ m/^(\S+)\s(ssh-rsa\s\S+)(\s.*)?$/) {
1158 if (!$vhash->{$key}) {
1160 if ($key =~ m/\|1\|([^\|\s]+)\|([^\|\s]+)$/) {
1161 my $salt = decode_base64
($1);
1163 my $hmac = Digest
::HMAC_SHA1-
>new($salt);
1164 $hmac->add($nodename);
1165 my $hd = $hmac->b64digest . '=';
1166 if ($digest eq $hd) {
1167 if ($rsakey eq $hostkey) {
1168 $found_nodename = 1;
1173 $hmac = Digest
::HMAC_SHA1-
>new($salt);
1174 $hmac->add($ip_address);
1175 $hd = $hmac->b64digest . '=';
1176 if ($digest eq $hd) {
1177 if ($rsakey eq $hostkey) {
1178 $found_local_ip = 1;
1191 while ($old && $old =~ s/^((.*?)(\n|$))//) {
1193 next if $line =~ m/^\s*$/; # skip empty lines
1194 next if $line =~ m/^#/; # skip comments
1195 &$merge_line($line, 1);
1198 while ($new && $new =~ s/^((.*?)(\n|$))//) {
1200 next if $line =~ m/^\s*$/; # skip empty lines
1201 next if $line =~ m/^#/; # skip comments
1202 &$merge_line($line);
1206 my $add_known_hosts_entry = sub {
1207 my ($name, $hostkey) = @_;
1209 my $hmac = Digest
::HMAC_SHA1-
>new("$addIndex" . time());
1210 my $b64salt = $hmac->b64digest . '=';
1211 $hmac = Digest
::HMAC_SHA1-
>new(decode_base64
($b64salt));
1213 my $digest = $hmac->b64digest . '=';
1214 $data .= "|1|$b64salt|$digest $hostkey\n";
1217 if (!$found_nodename || !$found_local_ip) {
1218 &$add_known_hosts_entry($nodename, $hostkey) if !$found_nodename;
1219 &$add_known_hosts_entry($ip_address, $hostkey) if !$found_local_ip;
1222 PVE
::Tools
::file_set_contents
($sshknownhosts, $data);
1224 return if !$createLink;
1226 unlink $sshglobalknownhosts;
1227 symlink $sshknownhosts, $sshglobalknownhosts;
1229 warn "can't create symlink for ssh known hosts '$sshglobalknownhosts' -> '$sshknownhosts'\n"
1230 if ! -l
$sshglobalknownhosts;
1234 my $datacenter_schema = {
1236 additionalProperties
=> 0,
1241 description
=> "Default keybord layout for vnc server.",
1242 enum
=> PVE
::Tools
::kvmkeymaplist
(),
1247 description
=> "Default GUI language.",
1248 enum
=> [ 'en', 'de' ],
1253 description
=> "Specify external http proxy which is used for downloads (example: 'http://username:password\@host:port/')",
1254 pattern
=> "http://.*",
1256 migration_unsecure
=> {
1259 description
=> "Migration is secure using SSH tunnel by default. For secure private networks you can disable it to speed up migration.",
1264 description
=> "Select the default Console viewer. You can either use the builtin java applet (VNC), an external virt-viewer comtatible application (SPICE), or an HTML5 based viewer (noVNC).",
1265 enum
=> ['applet', 'vv', 'html5'],
1270 # make schema accessible from outside (for documentation)
1271 sub get_datacenter_schema
{ return $datacenter_schema };
1273 sub parse_datacenter_config
{
1274 my ($filename, $raw) = @_;
1276 return PVE
::JSONSchema
::parse_config
($datacenter_schema, $filename, $raw);
1279 sub write_datacenter_config
{
1280 my ($filename, $cfg) = @_;
1282 return PVE
::JSONSchema
::dump_config
($datacenter_schema, $filename, $cfg);
1285 cfs_register_file
('datacenter.cfg',
1286 \
&parse_datacenter_config
,
1287 \
&write_datacenter_config
);
1289 sub parse_cluster_conf
{
1290 my ($filename, $raw) = @_;
1294 my $digest = Digest
::SHA
::sha1_hex
(defined($raw) ?
$raw : '');
1296 my $createNode = sub {
1297 my ($expat, $tag, %attrib) = @_;
1298 $expat->{NodeCount
}++;
1299 return { text
=> $tag, id
=> $expat->{NodeCount
}, %attrib };
1305 $expat->{NodeCount
} = 0;
1306 $expat->{NodeStack
} = [];
1307 $expat->{CurNode
} = $expat->{Tree
} = &$createNode($expat, 'root');
1311 delete $expat->{CurNode
};
1312 delete $expat->{NodeStack
};
1318 my $parent = $expat->{CurNode
};
1319 push @{ $expat->{NodeStack
} }, $parent;
1320 my $node = &$createNode($expat, $tag, @_);
1321 push @{$expat->{CurNode
}->{children
}}, $node;
1322 $expat->{CurNode
} = $node;
1327 my $node = pop @{ $expat->{NodeStack
} };
1328 $expat->{CurNode
} = $node;
1333 my $parser = new XML
::Parser
(Handlers
=> $handlers);
1334 $conf = $parser->parse($raw);
1337 $conf->{digest
} = $digest;
1342 sub cluster_conf_version
{
1343 my ($conf, $noerr) = @_;
1345 if ($conf && $conf->{children
} && $conf->{children
}->[0]) {
1346 my $cluster = $conf->{children
}->[0];
1347 if ($cluster && ($cluster->{text
} eq 'cluster') &&
1348 $cluster->{config_version
}) {
1349 if (my $version = int($cluster->{config_version
})) {
1350 return wantarray ?
($version, $cluster) : $version;
1355 return undef if $noerr;
1357 die "no cluster config - unable to read version\n";
1360 sub cluster_conf_lookup_cluster_section
{
1361 my ($conf, $noerr) = @_;
1363 my ($version, $cluster) = cluster_conf_version
($conf, $noerr);
1368 sub cluster_conf_lookup_rm_section
{
1369 my ($conf, $create, $noerr) = @_;
1371 my $cluster = cluster_conf_lookup_cluster_section
($conf, $noerr);
1372 return undef if !$cluster;
1375 foreach my $child (@{$cluster->{children
}}) {
1376 if ($child->{text
} eq 'rm') {
1382 return undef if $noerr;
1383 die "no resource manager section\n";
1385 $rmsec = { text
=> 'rm' };
1386 push @{$cluster->{children
}}, $rmsec;
1392 sub cluster_conf_lookup_pvevm
{
1393 my ($conf, $create, $vmid, $noerr) = @_;
1395 my $rmsec = cluster_conf_lookup_rm_section
($conf, $create, $noerr);
1396 return undef if !$rmsec;
1399 foreach my $child (@{$rmsec->{children
}}) {
1400 if ($child->{text
} eq 'pvevm' && $child->{vmid
} eq $vmid) {
1407 return undef if $noerr;
1408 die "unable to find service 'pvevm:$vmid'\n";
1410 $vmref = { text
=> 'pvevm', vmid
=> $vmid };
1411 push @{$rmsec->{children
}}, $vmref;
1413 return undef if $noerr;
1414 die "unable to create service 'pvevm:$vmid' - already exists\n";
1420 sub xml_escape_attrib
{
1423 return '' if !defined($data);
1425 $data =~ s/&/&/sg;
1426 $data =~ s/</</sg;
1427 $data =~ s/>/>/sg;
1428 $data =~ s/"/"/sg;
1433 sub __cluster_conf_dump_node
{
1434 my ($node, $indend) = @_;
1438 $indend = '' if !defined($indend);
1442 foreach my $key (sort keys %$node) {
1443 my $value = $node->{$key};
1444 next if $key eq 'id' || $key eq 'text' || $key eq 'children';
1445 $attribs .= " $key=\"" . xml_escape_attrib
($value) . "\"";
1448 my $children = $node->{children
};
1450 if ($children && scalar(@$children)) {
1451 $xml .= "$indend<$node->{text}$attribs>\n";
1452 my $childindend = "$indend ";
1453 foreach my $child (@$children) {
1454 $xml .= __cluster_conf_dump_node
($child, $childindend);
1456 $xml .= "$indend</$node->{text}>\n";
1458 $xml .= "$indend<$node->{text}$attribs/>\n";
1464 sub write_cluster_conf
{
1465 my ($filename, $cfg) = @_;
1467 my $version = cluster_conf_version
($cfg);
1469 my $res = "<?xml version=\"1.0\"?>\n";
1471 $res .= __cluster_conf_dump_node
($cfg->{children
}->[0]);
1476 # read only - use "rename cluster.conf.new cluster.conf" to write
1477 PVE
::Cluster
::cfs_register_file
('cluster.conf', \
&parse_cluster_conf
);
1478 # this is read/write
1479 PVE
::Cluster
::cfs_register_file
('cluster.conf.new', \
&parse_cluster_conf
,
1480 \
&write_cluster_conf
);