[pve-container.git] / src / PVE / LXC / Create.pm

package PVE::LXC::Create;

use strict;
use warnings;
use File::Basename;
use File::Path;
use Fcntl;

use PVE::RPCEnvironment;
use PVE::Storage::PBSPlugin;
use PVE::Storage;
use PVE::DataCenterConfig;
use PVE::LXC;
use PVE::LXC::Setup;
use PVE::VZDump::ConvertOVZ;
use PVE::Tools;
use POSIX;

sub detect_architecture {
    my ($rootdir) = @_;

    # see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format

    my $supported_elf_machine = {
	0x03 => 'i386',
	0x3e => 'amd64',
	0x28 => 'armhf',
	0xb7 => 'arm64',
	0xf3 => 'riscv',
    };

    my $elf_fn = '/bin/sh'; # '/bin/sh' is POSIX mandatory
    my $detect_arch = sub {
	# chroot avoids a problem where we check the binary of the host system
	# if $elf_fn is an absolut symlink (e.g. $rootdir/bin/sh -> /bin/bash)
	chroot($rootdir) or die "chroot '$rootdir' failed: $!\n";
	chdir('/') or die "failed to change to root directory\n";

	open(my $fh, "<", $elf_fn) or die "open '$elf_fn' failed: $!\n";
	binmode($fh);

	my $length = read($fh, my $data, 20) or die "read failed: $!\n";

	# 4 bytes ELF magic number and 1 byte ELF class, padding, machine
	my ($magic, $class, undef, $machine) = unpack("A4CA12n", $data);

	die "'$elf_fn' does not resolve to an ELF!\n"
	    if (!defined($class) || !defined($magic) || $magic ne "\177ELF");

	my $arch = $supported_elf_machine->{$machine};
	die "'$elf_fn' has unknown ELF machine '$machine'!\n"
	    if !defined($arch);

	if ($arch eq 'riscv') {
	    if ($class eq 1) {
		$arch = 'riscv32';
	    } elsif ($class eq 2) {
		$arch = 'riscv64';
	    } else {
		die "'$elf_fn' has invalid class '$class'!\n";
	    }
	}

	return $arch;
    };

    my $arch = eval { PVE::Tools::run_fork_with_timeout(10, $detect_arch); };
    my $err = $@;

    if (!defined($arch) && !defined($err)) {
	# on timeout
	die "Architecture detection failed: timeout\n";
    } elsif ($err) {
	# any other error
	$arch = 'amd64';
	print "Architecture detection failed: $err\nFalling back to $arch.\n" .
	      "Use `pct set VMID --arch ARCH` to change.\n";
    } else {
	print "Detected container architecture: $arch\n";
    }

    return $arch;
}

sub restore_archive {
    my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;

    my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
    if (defined($storeid)) {
	my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
	if ($scfg->{type} eq 'pbs') {
	    return restore_proxmox_backup_archive($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
	}
    }

    $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $archive) if $archive ne '-';
    restore_tar_archive($archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
}

sub restore_proxmox_backup_archive {
    my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;

    my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
    my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);

    my ($vtype, $name, undef, undef, undef, undef, $format) =
	PVE::Storage::parse_volname($storage_cfg, $archive);

    die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';

    die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';

    my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
    my $userns_cmd = PVE::LXC::userns_command($id_map);

    my $cmd = "restore";
    my $param = [$name, "root.pxar", $rootdir, '--allow-existing-dirs'];

    PVE::Storage::PBSPlugin::run_raw_client_cmd(
	$scfg, $storeid, $cmd, $param, userns_cmd => $userns_cmd);

    # if arch is set, we do not try to autodetect it
    return if defined($conf->{arch});

    $conf->{arch} = detect_architecture($rootdir);
}

sub restore_tar_archive {
    my ($archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;

    my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
    my $userns_cmd = PVE::LXC::userns_command($id_map);

    my $archive_fh;
    my $tar_input = '<&STDIN';
    my @compression_opt;
    if ($archive ne '-') {
	# GNU tar refuses to autodetect this... *sigh*
	my %compression_map = (
	    '.gz'  => '-z',
	    '.bz2' => '-j',
	    '.xz'  => '-J',
	    '.lzo'  => '--lzop',
	    '.zst'  => '--zstd',
	);
	if ($archive =~ /\.tar(\.[^.]+)?$/) {
	    if (defined($1)) {
		die "unrecognized compression format: $1\n" if !defined($compression_map{$1});
		@compression_opt = $compression_map{$1};
	    }
	} else {
	    die "file does not look like a template archive: $archive\n";
	}
	sysopen($archive_fh, $archive, O_RDONLY)
	    or die "failed to open '$archive': $!\n";
	my $flags = $archive_fh->fcntl(Fcntl::F_GETFD(), 0);
	$archive_fh->fcntl(Fcntl::F_SETFD(), $flags & ~(Fcntl::FD_CLOEXEC()));
	$tar_input = '<&'.fileno($archive_fh);
    }

    my $cmd = [@$userns_cmd, 'tar', 'xpf', '-', @compression_opt, '--totals',
               @PVE::Storage::Plugin::COMMON_TAR_FLAGS,
               '-C', $rootdir];

    # skip-old-files doesn't have anything to do with time (old/new), but is
    # simply -k (annoyingly also called --keep-old-files) without the 'treat
    # existing files as errors' part... iow. it's bsdtar's interpretation of -k
    # *sigh*, gnu...
    push @$cmd, '--skip-old-files';
    push @$cmd, '--anchored';
    push @$cmd, '--exclude' , './dev/*';

    if (defined($bwlimit)) {
	$cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ];
    }

    if ($archive eq '-') {
	print "extracting archive from STDIN\n";
    } else {
	print "extracting archive '$archive'\n";
    }
    eval { PVE::Tools::run_command($cmd, input => $tar_input); };
    my $err = $@;
    close($archive_fh) if defined $archive_fh;
    die $err if $err && !$no_unpack_error;

    # if arch is set, we do not try to autodetect it
    return if defined($conf->{arch});

    $conf->{arch} = detect_architecture($rootdir);
}

sub recover_config {
    my ($storage_cfg, $volid, $vmid) = @_;

    my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
    if (defined($storeid)) {
	my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
	if ($scfg->{type} eq 'pbs') {
	    return recover_config_from_proxmox_backup($storage_cfg, $volid, $vmid);
	}
    }

    my $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $volid);
    recover_config_from_tar($archive, $vmid);
}

sub recover_config_from_proxmox_backup {
    my ($storage_cfg, $volid, $vmid) = @_;

    $vmid //= 0;

    my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
    my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);

    my ($vtype, $name, undef, undef, undef, undef, $format) =
	PVE::Storage::parse_volname($storage_cfg, $volid);

    die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';

    die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';

    my $cmd = "restore";
    my $param = [$name, "pct.conf", "-"];

    my $raw = '';
    my $outfunc = sub { my $line = shift; $raw .= "$line\n"; };
    PVE::Storage::PBSPlugin::run_raw_client_cmd(
	$scfg,  $storeid, $cmd, $param, outfunc => $outfunc);

    my $conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);

    delete $conf->{snapshots};

    my $mp_param = {};
    PVE::LXC::Config->foreach_volume($conf, sub {
	my ($ms, $mountpoint) = @_;
	$mp_param->{$ms} = $conf->{$ms};
    });

    return wantarray ? ($conf, $mp_param) : $conf;
}

sub recover_config_from_tar {
    my ($archive, $vmid) = @_;

    my ($raw, $conf_file) = PVE::Storage::extract_vzdump_config_tar($archive, qr!(\./etc/vzdump/(pct|vps)\.conf)$!);
    my $conf;
    my $mp_param = {};
    $vmid //= 0;

    if ($conf_file =~ m/pct\.conf/) {

	$conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);

	delete $conf->{snapshots};

	PVE::LXC::Config->foreach_volume($conf, sub {
	    my ($ms, $mountpoint) = @_;
	    $mp_param->{$ms} = $conf->{$ms};
	});

    } elsif ($conf_file =~ m/vps\.conf/) {

	($conf, $mp_param) = PVE::VZDump::ConvertOVZ::convert_ovz($raw);

    } else {

       die "internal error";
    }

    return wantarray ? ($conf, $mp_param) : $conf;
}

sub restore_configuration {
    my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;

    my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
    if (defined($storeid)) {
	my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
	if ($scfg->{type} eq 'pbs') {
	    return restore_configuration_from_proxmox_backup($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw);
	}
    }
    restore_configuration_from_etc_vzdump($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw);
}

sub restore_configuration_from_proxmox_backup {
    my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;

    my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
    my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);

    my ($vtype, $name, undef, undef, undef, undef, $format) =
	PVE::Storage::parse_volname($storage_cfg, $archive);

    my $oldconf = recover_config_from_proxmox_backup($storage_cfg, $archive, $vmid);

    sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);

    my $cmd = "files";

    my $list = PVE::Storage::PBSPlugin::run_client_cmd($scfg, $storeid, "files", [$name]);
    my $has_fw_conf = grep { $_->{filename} eq 'fw.conf.blob' } @$list;

    if ($has_fw_conf) {
	my $pve_firewall_dir = '/etc/pve/firewall';
	my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
	if ($skip_fw) {
	    warn "ignoring firewall config from backup archive's 'fw.conf', lacking API permission to modify firewall.\n";
	    warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
		if -e $pct_fwcfg_target;
	} else {
	    mkdir $pve_firewall_dir; # make sure the directory exists
	    unlink $pct_fwcfg_target;

	    my $cmd = "restore";
	    my $param = [$name, "fw.conf", $pct_fwcfg_target];
	    PVE::Storage::PBSPlugin::run_raw_client_cmd($scfg, $storeid, $cmd, $param);
	}
    }
}

sub sanitize_and_merge_config {
    my ($conf, $oldconf, $restricted, $unique) = @_;

    my $rpcenv = PVE::RPCEnvironment::get();
    my $authuser = $rpcenv->get_user();

    foreach my $key (keys %$oldconf) {
	next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots' || $key eq 'unprivileged' || $key eq 'parent';
	next if $key =~ /^mp\d+$/; # don't recover mountpoints
	next if $key =~ /^unused\d+$/; # don't recover unused disks
	# we know if it was a template in the restore API call and check if the target
	# storage supports creating a template there
	next if $key =~ /^template$/;

	if ($restricted && $key eq 'features' && !$conf->{unprivileged} && $oldconf->{unprivileged}) {
	    warn "changing from unprivileged to privileged, skipping features\n";
	    next;
	}

	if ($key eq 'lxc' && $restricted) {
	    my $lxc_list = $oldconf->{'lxc'};

	    my $msg = "skipping custom lxc options, restore manually as root:\n";
	    $msg .= "--------------------------------\n";
	    foreach my $lxc_opt (@$lxc_list) {
		$msg .= "$lxc_opt->[0]: $lxc_opt->[1]\n"
	    }
	    $msg .= "--------------------------------";

	    $rpcenv->warn($msg);

	    next;
	}

	if ($key =~ /^net\d+$/ && !defined($conf->{$key})) {
	    PVE::LXC::check_bridge_access($rpcenv, $authuser, $oldconf->{$key});
	}

	if ($unique && $key =~ /^net\d+$/) {
	    my $net = PVE::LXC::Config->parse_lxc_network($oldconf->{$key});
	    my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
	    $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
	    $conf->{$key} = PVE::LXC::Config->print_lxc_network($net);
	    next;
	}
	$conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
    }
}

sub restore_configuration_from_etc_vzdump {
    my ($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;

    # restore: try to extract configuration from archive

    my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf";
    my $pct_fwcfg_fn = "$rootdir/etc/vzdump/pct.fw";
    my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf";
    if (-f $pct_cfg_fn) {
	my $raw = PVE::Tools::file_get_contents($pct_cfg_fn);
	my $oldconf = PVE::LXC::Config::parse_pct_config("/lxc/$vmid.conf", $raw);

	sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);

	unlink($pct_cfg_fn);

	# note: this file is possibly from the container itself in backups
	# created prior to pve-container 2.0-40 (PVE 5.x) / 3.0-5 (PVE 6.x)
	# only copy non-empty, non-symlink files, and only if the user is
	# allowed to modify the firewall config anyways
	if (-f $pct_fwcfg_fn && ! -l $pct_fwcfg_fn && -s $pct_fwcfg_fn) {
	    my $pve_firewall_dir = '/etc/pve/firewall';
	    my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
	    if ($skip_fw) {
		warn "ignoring firewall config from backup archive's '$pct_fwcfg_fn', lacking API permission to modify firewall.\n";
		warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
		    if -e $pct_fwcfg_target;
	    } else {
		mkdir $pve_firewall_dir; # make sure the directory exists
		PVE::Tools::file_copy($pct_fwcfg_fn, $pct_fwcfg_target);
	    }
	    unlink $pct_fwcfg_fn;
	}

    } elsif (-f $ovz_cfg_fn) {
	print "###########################################################\n";
	print "Converting OpenVZ configuration to LXC.\n";
	print "Please check the configuration and reconfigure the network.\n";
	print "###########################################################\n";

	my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
	$conf->{ostype} = $lxc_setup->{conf}->{ostype};
	my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn);
	my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
	foreach my $key (keys %$oldconf) {
	    $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
	}
	unlink($ovz_cfg_fn);

    } else {
	print "###########################################################\n";
	print "Backup archive does not contain any configuration\n";
	print "###########################################################\n";
    }
}

1;
Commit	Line	Data
7af97ad5	1	package PVE::LXC::Create;
5b4657d0 DM	2
	3	use strict;
	4	use warnings;
	5	use File::Basename;
	6	use File::Path;
07084526	7	use Fcntl;
5b4657d0	8
40761075	9	use PVE::RPCEnvironment;
99a0bcb0	10	use PVE::Storage::PBSPlugin;
5b4657d0	11	use PVE::Storage;
8b076579	12	use PVE::DataCenterConfig;
5b4657d0	13	use PVE::LXC;
7af97ad5	14	use PVE::LXC::Setup;
f507c3a7	15	use PVE::VZDump::ConvertOVZ;
580b6916	16	use PVE::Tools;
dc6e862c	17	use POSIX;
5b4657d0	18
fbb31447 TL	19	sub detect_architecture {
fbb31447 TL	20	my ($rootdir) = @_;
dc6e862c	21
e1d54a38 DM	22	# see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
	23
	24	my $supported_elf_machine = {
	25	0x03 => 'i386',
	26	0x3e => 'amd64',
	27	0x28 => 'armhf',
	28	0xb7 => 'arm64',
c7a78752	29	0xf3 => 'riscv',
fbb31447	30	};
dc6e862c	31
fbb31447 TL	32	my $elf_fn = '/bin/sh'; # '/bin/sh' is POSIX mandatory
fbb31447 TL	33	my $detect_arch = sub {
dc6e862c TL	34	# chroot avoids a problem where we check the binary of the host system
	35	# if $elf_fn is an absolut symlink (e.g. $rootdir/bin/sh -> /bin/bash)
	36	chroot($rootdir) or die "chroot '$rootdir' failed: $!\n";
	37	chdir('/') or die "failed to change to root directory\n";
	38
fbb31447	39	open(my $fh, "<", $elf_fn) or die "open '$elf_fn' failed: $!\n";
dc6e862c TL	40	binmode($fh);
dc6e862c TL	41
e1d54a38	42	my $length = read($fh, my $data, 20) or die "read failed: $!\n";
dc6e862c	43
e1d54a38 DM	44	# 4 bytes ELF magic number and 1 byte ELF class, padding, machine
e1d54a38 DM	45	my ($magic, $class, undef, $machine) = unpack("A4CA12n", $data);
dc6e862c TL	46
	47	die "'$elf_fn' does not resolve to an ELF!\n"
	48	if (!defined($class) \|\| !defined($magic) \|\| $magic ne "\177ELF");
	49
e1d54a38 DM	50	my $arch = $supported_elf_machine->{$machine};
	51	die "'$elf_fn' has unknown ELF machine '$machine'!\n"
	52	if !defined($arch);
dc6e862c	53
c7a78752 WB	54	if ($arch eq 'riscv') {
	55	if ($class eq 1) {
	56	$arch = 'riscv32';
	57	} elsif ($class eq 2) {
	58	$arch = 'riscv64';
	59	} else {
	60	die "'$elf_fn' has invalid class '$class'!\n";
	61	}
	62	}
	63
e1d54a38	64	return $arch;
fbb31447	65	};
dc6e862c	66
91749ee9 LS	67	my $arch = eval { PVE::Tools::run_fork_with_timeout(10, $detect_arch); };
	68	my $err = $@;
	69
	70	if (!defined($arch) && !defined($err)) {
	71	# on timeout
	72	die "Architecture detection failed: timeout\n";
	73	} elsif ($err) {
	74	# any other error
fbb31447	75	$arch = 'amd64';
91749ee9	76	print "Architecture detection failed: $err\nFalling back to $arch.\n" .
fbb31447	77	"Use `pct set VMID --arch ARCH` to change.\n";
dc6e862c	78	} else {
fbb31447	79	print "Detected container architecture: $arch\n";
dc6e862c TL	80	}
dc6e862c TL	81
fbb31447	82	return $arch;
dc6e862c TL	83	}
dc6e862c TL	84
5b4657d0	85	sub restore_archive {
99a0bcb0 DM	86	my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
	87
	88	my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
	89	if (defined($storeid)) {
	90	my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
	91	if ($scfg->{type} eq 'pbs') {
	92	return restore_proxmox_backup_archive($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
	93	}
	94	}
	95
	96	$archive = PVE::Storage::abs_filesystem_path($storage_cfg, $archive) if $archive ne '-';
	97	restore_tar_archive($archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
	98	}
	99
	100	sub restore_proxmox_backup_archive {
	101	my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
	102
	103	my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
	104	my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
	105
	106	my ($vtype, $name, undef, undef, undef, undef, $format) =
	107	PVE::Storage::parse_volname($storage_cfg, $archive);
	108
	109	die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';
	110
	111	die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';
	112
	113	my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
	114	my $userns_cmd = PVE::LXC::userns_command($id_map);
	115
	116	my $cmd = "restore";
	117	my $param = [$name, "root.pxar", $rootdir, '--allow-existing-dirs'];
	118
	119	PVE::Storage::PBSPlugin::run_raw_client_cmd(
	120	$scfg, $storeid, $cmd, $param, userns_cmd => $userns_cmd);
	121
	122	# if arch is set, we do not try to autodetect it
	123	return if defined($conf->{arch});
	124
	125	$conf->{arch} = detect_architecture($rootdir);
	126	}
	127
	128	sub restore_tar_archive {
f9b4407e	129	my ($archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
5b4657d0	130
c6a605f9	131	my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
01dce99b	132	my $userns_cmd = PVE::LXC::userns_command($id_map);
5b4657d0	133
07084526	134	my $archive_fh;
f70a3d47 WB	135	my $tar_input = '<&STDIN';
f70a3d47 WB	136	my @compression_opt;
07084526	137	if ($archive ne '-') {
f70a3d47 WB	138	# GNU tar refuses to autodetect this... sigh
	139	my %compression_map = (
	140	'.gz' => '-z',
	141	'.bz2' => '-j',
	142	'.xz' => '-J',
a3bdf0c9	143	'.lzo' => '--lzop',
cef90911	144	'.zst' => '--zstd',
f70a3d47 WB	145	);
	146	if ($archive =~ /\.tar(\.[^.]+)?$/) {
	147	if (defined($1)) {
68300601	148	die "unrecognized compression format: $1\n" if !defined($compression_map{$1});
539660e2	149	@compression_opt = $compression_map{$1};
f70a3d47 WB	150	}
	151	} else {
	152	die "file does not look like a template archive: $archive\n";
	153	}
07084526 WB	154	sysopen($archive_fh, $archive, O_RDONLY)
07084526 WB	155	or die "failed to open '$archive': $!\n";
07084526 WB	156	my $flags = $archive_fh->fcntl(Fcntl::F_GETFD(), 0);
07084526 WB	157	$archive_fh->fcntl(Fcntl::F_SETFD(), $flags & ~(Fcntl::FD_CLOEXEC()));
f70a3d47	158	$tar_input = '<&'.fileno($archive_fh);
07084526 WB	159	}
07084526 WB	160
f70a3d47	161	my $cmd = [@$userns_cmd, 'tar', 'xpf', '-', @compression_opt, '--totals',
5fa038ab	162	@PVE::Storage::Plugin::COMMON_TAR_FLAGS,
fc4e132e	163	'-C', $rootdir];
5b4657d0	164
112aeeb4 WB	165	# skip-old-files doesn't have anything to do with time (old/new), but is
	166	# simply -k (annoyingly also called --keep-old-files) without the 'treat
	167	# existing files as errors' part... iow. it's bsdtar's interpretation of -k
	168	# sigh, gnu...
	169	push @$cmd, '--skip-old-files';
5b4657d0 DM	170	push @$cmd, '--anchored';
	171	push @$cmd, '--exclude' , './dev/*';
	172
f9b4407e WB	173	if (defined($bwlimit)) {
	174	$cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ];
	175	}
	176
6034ae50 DM	177	if ($archive eq '-') {
6034ae50 DM	178	print "extracting archive from STDIN\n";
27916659	179	} else {
6034ae50	180	print "extracting archive '$archive'\n";
27916659	181	}
f70a3d47	182	eval { PVE::Tools::run_command($cmd, input => $tar_input); };
07084526 WB	183	my $err = $@;
	184	close($archive_fh) if defined $archive_fh;
	185	die $err if $err && !$no_unpack_error;
f31bd6ae DC	186
	187	# if arch is set, we do not try to autodetect it
	188	return if defined($conf->{arch});
	189
fbb31447	190	$conf->{arch} = detect_architecture($rootdir);
5b4657d0 DM	191	}
5b4657d0 DM	192
f507c3a7	193	sub recover_config {
12aec1d2	194	my ($storage_cfg, $volid, $vmid) = @_;
99a0bcb0 DM	195
	196	my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
	197	if (defined($storeid)) {
	198	my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
	199	if ($scfg->{type} eq 'pbs') {
12aec1d2	200	return recover_config_from_proxmox_backup($storage_cfg, $volid, $vmid);
99a0bcb0 DM	201	}
	202	}
	203
	204	my $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $volid);
12aec1d2	205	recover_config_from_tar($archive, $vmid);
99a0bcb0 DM	206	}
	207
	208	sub recover_config_from_proxmox_backup {
12aec1d2 FG	209	my ($storage_cfg, $volid, $vmid) = @_;
	210
	211	$vmid //= 0;
99a0bcb0 DM	212
	213	my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
	214	my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
	215
	216	my ($vtype, $name, undef, undef, undef, undef, $format) =
	217	PVE::Storage::parse_volname($storage_cfg, $volid);
	218
	219	die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';
	220
	221	die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';
	222
	223	my $cmd = "restore";
	224	my $param = [$name, "pct.conf", "-"];
	225
	226	my $raw = '';
	227	my $outfunc = sub { my $line = shift; $raw .= "$line\n"; };
	228	PVE::Storage::PBSPlugin::run_raw_client_cmd(
	229	$scfg, $storeid, $cmd, $param, outfunc => $outfunc);
	230
12aec1d2	231	my $conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);
99a0bcb0 DM	232
	233	delete $conf->{snapshots};
	234
	235	my $mp_param = {};
015740e6	236	PVE::LXC::Config->foreach_volume($conf, sub {
99a0bcb0 DM	237	my ($ms, $mountpoint) = @_;
	238	$mp_param->{$ms} = $conf->{$ms};
	239	});
	240
	241	return wantarray ? ($conf, $mp_param) : $conf;
	242	}
	243
	244	sub recover_config_from_tar {
12aec1d2	245	my ($archive, $vmid) = @_;
f507c3a7	246
0550795a	247	my ($raw, $conf_file) = PVE::Storage::extract_vzdump_config_tar($archive, qr!(\./etc/vzdump/(pct\|vps)\.conf)$!);
effa4f43	248	my $conf;
db18c1e4	249	my $mp_param = {};
12aec1d2	250	$vmid //= 0;
f507c3a7	251
27916659	252	if ($conf_file =~ m/pct\.conf/) {
f507c3a7	253
12aec1d2	254	$conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);
f507c3a7	255
27916659	256	delete $conf->{snapshots};
db18c1e4	257
015740e6	258	PVE::LXC::Config->foreach_volume($conf, sub {
db18c1e4 FG	259	my ($ms, $mountpoint) = @_;
	260	$mp_param->{$ms} = $conf->{$ms};
	261	});
	262
effa4f43	263	} elsif ($conf_file =~ m/vps\.conf/) {
db18c1e4 FG	264
	265	($conf, $mp_param) = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
	266
effa4f43 DM	267	} else {
effa4f43 DM	268
27916659	269	die "internal error";
f507c3a7 WL	270	}
f507c3a7 WL	271
db18c1e4	272	return wantarray ? ($conf, $mp_param) : $conf;
f507c3a7 WL	273	}
f507c3a7 WL	274
51665c2d	275	sub restore_configuration {
99a0bcb0 DM	276	my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
99a0bcb0 DM	277
3e111b4e	278	my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
99a0bcb0 DM	279	if (defined($storeid)) {
	280	my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
	281	if ($scfg->{type} eq 'pbs') {
	282	return restore_configuration_from_proxmox_backup($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw);
	283	}
	284	}
	285	restore_configuration_from_etc_vzdump($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw);
	286	}
	287
	288	sub restore_configuration_from_proxmox_backup {
	289	my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
	290
	291	my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
	292	my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
	293
	294	my ($vtype, $name, undef, undef, undef, undef, $format) =
	295	PVE::Storage::parse_volname($storage_cfg, $archive);
	296
12aec1d2	297	my $oldconf = recover_config_from_proxmox_backup($storage_cfg, $archive, $vmid);
99a0bcb0 DM	298
	299	sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);
	300
	301	my $cmd = "files";
	302
	303	my $list = PVE::Storage::PBSPlugin::run_client_cmd($scfg, $storeid, "files", [$name]);
08db7875	304	my $has_fw_conf = grep { $_->{filename} eq 'fw.conf.blob' } @$list;
99a0bcb0 DM	305
	306	if ($has_fw_conf) {
	307	my $pve_firewall_dir = '/etc/pve/firewall';
	308	my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
	309	if ($skip_fw) {
	310	warn "ignoring firewall config from backup archive's 'fw.conf', lacking API permission to modify firewall.\n";
	311	warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
	312	if -e $pct_fwcfg_target;
	313	} else {
	314	mkdir $pve_firewall_dir; # make sure the directory exists
cda704c8	315	unlink $pct_fwcfg_target;
99a0bcb0 DM	316
	317	my $cmd = "restore";
	318	my $param = [$name, "fw.conf", $pct_fwcfg_target];
	319	PVE::Storage::PBSPlugin::run_raw_client_cmd($scfg, $storeid, $cmd, $param);
	320	}
	321	}
	322	}
	323
	324	sub sanitize_and_merge_config {
	325	my ($conf, $oldconf, $restricted, $unique) = @_;
	326
40761075	327	my $rpcenv = PVE::RPCEnvironment::get();
ee81952f	328	my $authuser = $rpcenv->get_user();
40761075	329
99a0bcb0 DM	330	foreach my $key (keys %$oldconf) {
	331	next if $key eq 'digest' \|\| $key eq 'rootfs' \|\| $key eq 'snapshots' \|\| $key eq 'unprivileged' \|\| $key eq 'parent';
	332	next if $key =~ /^mp\d+$/; # don't recover mountpoints
	333	next if $key =~ /^unused\d+$/; # don't recover unused disks
	334	# we know if it was a template in the restore API call and check if the target
	335	# storage supports creating a template there
	336	next if $key =~ /^template$/;
	337
e2ccfd37 DC	338	if ($restricted && $key eq 'features' && !$conf->{unprivileged} && $oldconf->{unprivileged}) {
	339	warn "changing from unprivileged to privileged, skipping features\n";
	340	next;
	341	}
	342
99a0bcb0 DM	343	if ($key eq 'lxc' && $restricted) {
99a0bcb0 DM	344	my $lxc_list = $oldconf->{'lxc'};
40761075 FE	345
	346	my $msg = "skipping custom lxc options, restore manually as root:\n";
	347	$msg .= "--------------------------------\n";
99a0bcb0	348	foreach my $lxc_opt (@$lxc_list) {
40761075	349	$msg .= "$lxc_opt->[0]: $lxc_opt->[1]\n"
99a0bcb0	350	}
40761075 FE	351	$msg .= "--------------------------------";
	352
	353	$rpcenv->warn($msg);
	354
99a0bcb0 DM	355	next;
	356	}
	357
ee81952f FG	358	if ($key =~ /^net\d+$/ && !defined($conf->{$key})) {
	359	PVE::LXC::check_bridge_access($rpcenv, $authuser, $oldconf->{$key});
	360	}
	361
99a0bcb0 DM	362	if ($unique && $key =~ /^net\d+$/) {
	363	my $net = PVE::LXC::Config->parse_lxc_network($oldconf->{$key});
	364	my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
	365	$net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
	366	$conf->{$key} = PVE::LXC::Config->print_lxc_network($net);
	367	next;
	368	}
	369	$conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
	370	}
	371	}
	372
	373	sub restore_configuration_from_etc_vzdump {
39170644	374	my ($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
51665c2d FG	375
	376	# restore: try to extract configuration from archive
	377
	378	my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf";
	379	my $pct_fwcfg_fn = "$rootdir/etc/vzdump/pct.fw";
	380	my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf";
	381	if (-f $pct_cfg_fn) {
	382	my $raw = PVE::Tools::file_get_contents($pct_cfg_fn);
	383	my $oldconf = PVE::LXC::Config::parse_pct_config("/lxc/$vmid.conf", $raw);
	384
99a0bcb0	385	sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);
82bfeccb	386
51665c2d	387	unlink($pct_cfg_fn);
5b4657d0	388
39170644 FG	389	# note: this file is possibly from the container itself in backups
	390	# created prior to pve-container 2.0-40 (PVE 5.x) / 3.0-5 (PVE 6.x)
	391	# only copy non-empty, non-symlink files, and only if the user is
	392	# allowed to modify the firewall config anyways
	393	if (-f $pct_fwcfg_fn && ! -l $pct_fwcfg_fn && -s $pct_fwcfg_fn) {
51665c2d	394	my $pve_firewall_dir = '/etc/pve/firewall';
39170644 FG	395	my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
	396	if ($skip_fw) {
	397	warn "ignoring firewall config from backup archive's '$pct_fwcfg_fn', lacking API permission to modify firewall.\n";
	398	warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
	399	if -e $pct_fwcfg_target;
	400	} else {
	401	mkdir $pve_firewall_dir; # make sure the directory exists
	402	PVE::Tools::file_copy($pct_fwcfg_fn, $pct_fwcfg_target);
	403	}
51665c2d	404	unlink $pct_fwcfg_fn;
27916659	405	}
5b4657d0	406
51665c2d FG	407	} elsif (-f $ovz_cfg_fn) {
	408	print "###########################################################\n";
	409	print "Converting OpenVZ configuration to LXC.\n";
	410	print "Please check the configuration and reconfigure the network.\n";
	411	print "###########################################################\n";
148d1cb4	412
51665c2d FG	413	my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
	414	$conf->{ostype} = $lxc_setup->{conf}->{ostype};
	415	my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn);
	416	my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
	417	foreach my $key (keys %$oldconf) {
	418	$conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
	419	}
	420	unlink($ovz_cfg_fn);
148d1cb4	421
51665c2d FG	422	} else {
	423	print "###########################################################\n";
	424	print "Backup archive does not contain any configuration\n";
	425	print "###########################################################\n";
148d1cb4	426	}
5b4657d0 DM	427	}
	428
	429	1;