src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::GuestHelpers;
   9 use PVE::INotify;
  10 use PVE::JSONSchema qw(get_standard_option);
  11 use PVE::Tools;
  12
  13 use base qw(PVE::AbstractConfig);
  14
  15 my $nodename = PVE::INotify::nodename();
  16 my $lock_handles =  {};
  17 my $lockdir = "/run/lock/lxc";
  18 mkdir $lockdir;
  19 mkdir "/etc/pve/nodes/$nodename/lxc";
  20 my $MAX_MOUNT_POINTS = 256;
  21 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  22
  23 # BEGIN implemented abstract methods from PVE::AbstractConfig
  24
  25 sub guest_type {
  26     return "CT";
  27 }
  28
  29 sub __config_max_unused_disks {
  30     my ($class) = @_;
  31
  32     return $MAX_UNUSED_DISKS;
  33 }
  34
  35 sub config_file_lock {
  36     my ($class, $vmid) = @_;
  37
  38     return "$lockdir/pve-config-${vmid}.lock";
  39 }
  40
  41 sub cfs_config_path {
  42     my ($class, $vmid, $node) = @_;
  43
  44     $node = $nodename if !$node;
  45     return "nodes/$node/lxc/$vmid.conf";
  46 }
  47
  48 sub mountpoint_backup_enabled {
  49     my ($class, $mp_key, $mountpoint) = @_;
  50
  51     return 1 if $mp_key eq 'rootfs';
  52
  53     return 0 if $mountpoint->{type} ne 'volume';
  54
  55     return 1 if $mountpoint->{backup};
  56
  57     return 0;
  58 }
  59
  60 sub has_feature {
  61     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  62     my $err;
  63
  64     $class->foreach_mountpoint($conf, sub {
  65         my ($ms, $mountpoint) = @_;
  66
  67         return if $err; # skip further test
  68         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  69
  70         $err = 1
  71             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  72                                                  $mountpoint->{volume},
  73                                                  $snapname, $running);
  74     });
  75
  76     return $err ? 0 : 1;
  77 }
  78
  79 sub __snapshot_save_vmstate {
  80     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  81     die "implement me - snapshot_save_vmstate\n";
  82 }
  83
  84 sub __snapshot_check_running {
  85     my ($class, $vmid) = @_;
  86     return PVE::LXC::check_running($vmid);
  87 }
  88
  89 sub __snapshot_check_freeze_needed {
  90     my ($class, $vmid, $config, $save_vmstate) = @_;
  91
  92     my $ret = $class->__snapshot_check_running($vmid);
  93     return ($ret, $ret);
  94 }
  95
  96 sub __snapshot_freeze {
  97     my ($class, $vmid, $unfreeze) = @_;
  98
  99     if ($unfreeze) {
 100         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 101         warn $@ if $@;
 102     } else {
 103         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 104         PVE::LXC::sync_container_namespace($vmid);
 105     }
 106 }
 107
 108 sub __snapshot_create_vol_snapshot {
 109     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 110
 111     my $storecfg = PVE::Storage::config();
 112
 113     return if $snapname eq 'vzdump' &&
 114         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 115
 116     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 117 }
 118
 119 sub __snapshot_delete_remove_drive {
 120     my ($class, $snap, $remove_drive) = @_;
 121
 122     if ($remove_drive eq 'vmstate') {
 123         die "implement me - saving vmstate\n";
 124     } else {
 125         my $value = $snap->{$remove_drive};
 126         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 127         delete $snap->{$remove_drive};
 128
 129         $class->add_unused_volume($snap, $mountpoint->{volume})
 130             if ($mountpoint->{type} eq 'volume');
 131     }
 132 }
 133
 134 sub __snapshot_delete_vmstate_file {
 135     my ($class, $snap, $force) = @_;
 136
 137     die "implement me - saving vmstate\n";
 138 }
 139
 140 sub __snapshot_delete_vol_snapshot {
 141     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 142
 143     return if $snapname eq 'vzdump' &&
 144         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 145
 146     my $storecfg = PVE::Storage::config();
 147     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 148     push @$unused, $mountpoint->{volume};
 149 }
 150
 151 sub __snapshot_rollback_vol_possible {
 152     my ($class, $mountpoint, $snapname) = @_;
 153
 154     my $storecfg = PVE::Storage::config();
 155     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 156 }
 157
 158 sub __snapshot_rollback_vol_rollback {
 159     my ($class, $mountpoint, $snapname) = @_;
 160
 161     my $storecfg = PVE::Storage::config();
 162     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 163 }
 164
 165 sub __snapshot_rollback_vm_stop {
 166     my ($class, $vmid) = @_;
 167
 168     PVE::LXC::vm_stop($vmid, 1)
 169         if $class->__snapshot_check_running($vmid);
 170 }
 171
 172 sub __snapshot_rollback_vm_start {
 173     my ($class, $vmid, $vmstate, $data);
 174
 175     die "implement me - save vmstate\n";
 176 }
 177
 178 sub __snapshot_rollback_get_unused {
 179     my ($class, $conf, $snap) = @_;
 180
 181     my $unused = [];
 182
 183     $class->__snapshot_foreach_volume($conf, sub {
 184         my ($vs, $volume) = @_;
 185
 186         return if $volume->{type} ne 'volume';
 187
 188         my $found = 0;
 189         my $volid = $volume->{volume};
 190
 191         $class->__snapshot_foreach_volume($snap, sub {
 192             my ($ms, $mountpoint) = @_;
 193
 194             return if $found;
 195             return if ($mountpoint->{type} ne 'volume');
 196
 197             $found = 1
 198                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 199         });
 200
 201         push @$unused, $volid if !$found;
 202     });
 203
 204     return $unused;
 205 }
 206
 207 sub __snapshot_foreach_volume {
 208     my ($class, $conf, $func) = @_;
 209
 210     $class->foreach_mountpoint($conf, $func);
 211 }
 212
 213 # END implemented abstract methods from PVE::AbstractConfig
 214
 215 # BEGIN JSON config code
 216
 217 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 218
 219
 220 my $valid_mount_option_re = qr/(noatime|nodev|nosuid|noexec)/;
 221
 222 sub is_valid_mount_option {
 223     my ($option) = @_;
 224     return $option =~ $valid_mount_option_re;
 225 }
 226
 227 my $rootfs_desc = {
 228     volume => {
 229         type => 'string',
 230         default_key => 1,
 231         format => 'pve-lxc-mp-string',
 232         format_description => 'volume',
 233         description => 'Volume, device or directory to mount into the container.',
 234     },
 235     size => {
 236         type => 'string',
 237         format => 'disk-size',
 238         format_description => 'DiskSize',
 239         description => 'Volume size (read only value).',
 240         optional => 1,
 241     },
 242     acl => {
 243         type => 'boolean',
 244         description => 'Explicitly enable or disable ACL support.',
 245         optional => 1,
 246     },
 247     mountoptions => {
 248         optional => 1,
 249         type => 'string',
 250         description => 'Extra mount options for rootfs/mps.',
 251         format_description => 'opt[;opt...]',
 252         pattern => qr/$valid_mount_option_re(;$valid_mount_option_re)*/,
 253     },
 254     ro => {
 255         type => 'boolean',
 256         description => 'Read-only mount point',
 257         optional => 1,
 258     },
 259     quota => {
 260         type => 'boolean',
 261         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 262         optional => 1,
 263     },
 264     replicate => {
 265         type => 'boolean',
 266         description => 'Will include this volume to a storage replica job.',
 267         optional => 1,
 268         default => 1,
 269     },
 270     shared => {
 271         type => 'boolean',
 272         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 273         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 274         optional => 1,
 275         default => 0,
 276     },
 277 };
 278
 279 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 280     type => 'string', format => $rootfs_desc,
 281     description => "Use volume as container root.",
 282     optional => 1,
 283 });
 284
 285 my $features_desc = {
 286     mount => {
 287         optional => 1,
 288         type => 'string',
 289         description => "Allow mounting file systems of specific types."
 290             ." This should be a list of file system types as used with the mount command."
 291             ." Note that this can have negative effects on the container's security."
 292             ." With access to a loop device, mounting a file can circumvent the mknod"
 293             ." permission of the devices cgroup, mounting an NFS file system can"
 294             ." block the host's I/O completely and prevent it from rebooting, etc.",
 295         format_description => 'fstype;fstype;...',
 296         pattern => qr/[a-zA-Z0-9_; ]+/,
 297     },
 298     nesting => {
 299         optional => 1,
 300         type => 'boolean',
 301         default => 0,
 302         description => "Allow nesting."
 303             ." Best used with unprivileged containers with additional id mapping."
 304             ." Note that this will expose procfs and sysfs contents of the host"
 305             ." to the guest.",
 306     },
 307     keyctl => {
 308         optional => 1,
 309         type => 'boolean',
 310         default => 0,
 311         description => "For unprivileged containers only: Allow the use of the keyctl() system call."
 312             ." This is required to use docker inside a container."
 313             ." By default unprivileged containers will see this system call as non-existent."
 314             ." This is mostly a workaround for systemd-networkd, as it will treat it as a fatal"
 315             ." error when some keyctl() operations are denied by the kernel due to lacking permissions."
 316             ." Essentially, you can choose between running systemd-networkd or docker.",
 317     },
 318     fuse => {
 319         optional => 1,
 320         type => 'boolean',
 321         default => 0,
 322         description => "Allow using 'fuse' file systems in a container."
 323             ." Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.",
 324     },
 325 };
 326
 327 my $confdesc = {
 328     lock => {
 329         optional => 1,
 330         type => 'string',
 331         description => "Lock/unlock the VM.",
 332         enum => [qw(backup create disk fstrim migrate mounted rollback snapshot snapshot-delete)],
 333     },
 334     onboot => {
 335         optional => 1,
 336         type => 'boolean',
 337         description => "Specifies whether a VM will be started during system bootup.",
 338         default => 0,
 339     },
 340     startup => get_standard_option('pve-startup-order'),
 341     template => {
 342         optional => 1,
 343         type => 'boolean',
 344         description => "Enable/disable Template.",
 345         default => 0,
 346     },
 347     arch => {
 348         optional => 1,
 349         type => 'string',
 350         enum => ['amd64', 'i386', 'arm64', 'armhf'],
 351         description => "OS architecture type.",
 352         default => 'amd64',
 353     },
 354     ostype => {
 355         optional => 1,
 356         type => 'string',
 357         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 358         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 359     },
 360     console => {
 361         optional => 1,
 362         type => 'boolean',
 363         description => "Attach a console device (/dev/console) to the container.",
 364         default => 1,
 365     },
 366     tty => {
 367         optional => 1,
 368         type => 'integer',
 369         description => "Specify the number of tty available to the container",
 370         minimum => 0,
 371         maximum => 6,
 372         default => 2,
 373     },
 374     cores => {
 375         optional => 1,
 376         type => 'integer',
 377         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 378         minimum => 1,
 379         maximum => 128,
 380     },
 381     cpulimit => {
 382         optional => 1,
 383         type => 'number',
 384         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 385         minimum => 0,
 386         maximum => 128,
 387         default => 0,
 388     },
 389     cpuunits => {
 390         optional => 1,
 391         type => 'integer',
 392         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 393         minimum => 0,
 394         maximum => 500000,
 395         default => 1024,
 396     },
 397     memory => {
 398         optional => 1,
 399         type => 'integer',
 400         description => "Amount of RAM for the VM in MB.",
 401         minimum => 16,
 402         default => 512,
 403     },
 404     swap => {
 405         optional => 1,
 406         type => 'integer',
 407         description => "Amount of SWAP for the VM in MB.",
 408         minimum => 0,
 409         default => 512,
 410     },
 411     hostname => {
 412         optional => 1,
 413         description => "Set a host name for the container.",
 414         type => 'string', format => 'dns-name',
 415         maxLength => 255,
 416     },
 417     description => {
 418         optional => 1,
 419         type => 'string',
 420         description => "Container description. Only used on the configuration web interface.",
 421     },
 422     searchdomain => {
 423         optional => 1,
 424         type => 'string', format => 'dns-name-list',
 425         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 426     },
 427     nameserver => {
 428         optional => 1,
 429         type => 'string', format => 'address-list',
 430         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 431     },
 432     rootfs => get_standard_option('pve-ct-rootfs'),
 433     parent => {
 434         optional => 1,
 435         type => 'string', format => 'pve-configid',
 436         maxLength => 40,
 437         description => "Parent snapshot name. This is used internally, and should not be modified.",
 438     },
 439     snaptime => {
 440         optional => 1,
 441         description => "Timestamp for snapshots.",
 442         type => 'integer',
 443         minimum => 0,
 444     },
 445     cmode => {
 446         optional => 1,
 447         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 448         type => 'string',
 449         enum => ['shell', 'console', 'tty'],
 450         default => 'tty',
 451     },
 452     protection => {
 453         optional => 1,
 454         type => 'boolean',
 455         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 456         default => 0,
 457     },
 458     unprivileged => {
 459         optional => 1,
 460         type => 'boolean',
 461         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 462         default => 0,
 463     },
 464     features => {
 465         optional => 1,
 466         type => 'string',
 467         format => $features_desc,
 468         description => "Allow containers access to advanced features.",
 469     },
 470     hookscript => {
 471         optional => 1,
 472         type => 'string',
 473         format => 'pve-volume-id',
 474         description => 'Script that will be exectued during various steps in the containers lifetime.',
 475     },
 476 };
 477
 478 my $valid_lxc_conf_keys = {
 479     'lxc.apparmor.profile' => 1,
 480     'lxc.apparmor.allow_incomplete' => 1,
 481     'lxc.apparmor.allow_nesting' => 1,
 482     'lxc.apparmor.raw' => 1,
 483     'lxc.selinux.context' => 1,
 484     'lxc.include' => 1,
 485     'lxc.arch' => 1,
 486     'lxc.uts.name' => 1,
 487     'lxc.signal.halt' => 1,
 488     'lxc.signal.reboot' => 1,
 489     'lxc.signal.stop' => 1,
 490     'lxc.init.cmd' => 1,
 491     'lxc.pty.max' => 1,
 492     'lxc.console.logfile' => 1,
 493     'lxc.console.path' => 1,
 494     'lxc.tty.max' => 1,
 495     'lxc.devtty.dir' => 1,
 496     'lxc.hook.autodev' => 1,
 497     'lxc.autodev' => 1,
 498     'lxc.kmsg' => 1,
 499     'lxc.mount.fstab' => 1,
 500     'lxc.mount.entry' => 1,
 501     'lxc.mount.auto' => 1,
 502     'lxc.rootfs.path' => 'lxc.rootfs.path is auto generated from rootfs',
 503     'lxc.rootfs.mount' => 1,
 504     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 505                             ', please use mount point options in the "rootfs" key',
 506     # lxc.cgroup.*
 507     # lxc.prlimit.*
 508     # lxc.net.*
 509     'lxc.cap.drop' => 1,
 510     'lxc.cap.keep' => 1,
 511     'lxc.seccomp.profile' => 1,
 512     'lxc.idmap' => 1,
 513     'lxc.hook.pre-start' => 1,
 514     'lxc.hook.pre-mount' => 1,
 515     'lxc.hook.mount' => 1,
 516     'lxc.hook.start' => 1,
 517     'lxc.hook.stop' => 1,
 518     'lxc.hook.post-stop' => 1,
 519     'lxc.hook.clone' => 1,
 520     'lxc.hook.destroy' => 1,
 521     'lxc.log.level' => 1,
 522     'lxc.log.file' => 1,
 523     'lxc.start.auto' => 1,
 524     'lxc.start.delay' => 1,
 525     'lxc.start.order' => 1,
 526     'lxc.group' => 1,
 527     'lxc.environment' => 1,
 528
 529     # All these are namespaced via CLONE_NEWIPC (see namespaces(7)).
 530     'lxc.sysctl.fs.mqueue' => 1,
 531     'lxc.sysctl.kernel.msgmax' => 1,
 532     'lxc.sysctl.kernel.msgmnb' => 1,
 533     'lxc.sysctl.kernel.msgmni' => 1,
 534     'lxc.sysctl.kernel.sem' => 1,
 535     'lxc.sysctl.kernel.shmall' => 1,
 536     'lxc.sysctl.kernel.shmmax' => 1,
 537     'lxc.sysctl.kernel.shmmni' => 1,
 538     'lxc.sysctl.kernel.shm_rmid_forced' => 1,
 539 };
 540
 541 my $deprecated_lxc_conf_keys = {
 542     # Deprecated (removed with lxc 3.0):
 543     'lxc.aa_profile'           => 'lxc.apparmor.profile',
 544     'lxc.aa_allow_incomplete'  => 'lxc.apparmor.allow_incomplete',
 545     'lxc.console'              => 'lxc.console.path',
 546     'lxc.devttydir'            => 'lxc.tty.dir',
 547     'lxc.haltsignal'           => 'lxc.signal.halt',
 548     'lxc.rebootsignal'         => 'lxc.signal.reboot',
 549     'lxc.stopsignal'           => 'lxc.signal.stop',
 550     'lxc.id_map'               => 'lxc.idmap',
 551     'lxc.init_cmd'             => 'lxc.init.cmd',
 552     'lxc.loglevel'             => 'lxc.log.level',
 553     'lxc.logfile'              => 'lxc.log.file',
 554     'lxc.mount'                => 'lxc.mount.fstab',
 555     'lxc.network.type'         => 'lxc.net.INDEX.type',
 556     'lxc.network.flags'        => 'lxc.net.INDEX.flags',
 557     'lxc.network.link'         => 'lxc.net.INDEX.link',
 558     'lxc.network.mtu'          => 'lxc.net.INDEX.mtu',
 559     'lxc.network.name'         => 'lxc.net.INDEX.name',
 560     'lxc.network.hwaddr'       => 'lxc.net.INDEX.hwaddr',
 561     'lxc.network.ipv4'         => 'lxc.net.INDEX.ipv4.address',
 562     'lxc.network.ipv4.gateway' => 'lxc.net.INDEX.ipv4.gateway',
 563     'lxc.network.ipv6'         => 'lxc.net.INDEX.ipv6.address',
 564     'lxc.network.ipv6.gateway' => 'lxc.net.INDEX.ipv6.gateway',
 565     'lxc.network.script.up'    => 'lxc.net.INDEX.script.up',
 566     'lxc.network.script.down'  => 'lxc.net.INDEX.script.down',
 567     'lxc.pts'                  => 'lxc.pty.max',
 568     'lxc.se_context'           => 'lxc.selinux.context',
 569     'lxc.seccomp'              => 'lxc.seccomp.profile',
 570     'lxc.tty'                  => 'lxc.tty.max',
 571     'lxc.utsname'              => 'lxc.uts.name',
 572 };
 573
 574 sub is_valid_lxc_conf_key {
 575     my ($vmid, $key) = @_;
 576     if ($key =~ /^lxc\.limit\./) {
 577         warn "vm $vmid - $key: lxc.limit.* was renamed to lxc.prlimit.*\n";
 578         return 1;
 579     }
 580     if (defined(my $new_name = $deprecated_lxc_conf_keys->{$key})) {
 581         warn "vm $vmid - $key is deprecated and was renamed to $new_name\n";
 582         return 1;
 583     }
 584     my $validity = $valid_lxc_conf_keys->{$key};
 585     return $validity if defined($validity);
 586     return 1 if $key =~ /^lxc\.cgroup\./  # allow all cgroup values
 587              || $key =~ /^lxc\.prlimit\./ # allow all prlimits
 588              || $key =~ /^lxc\.net\./;    # allow custom network definitions
 589     return 0;
 590 }
 591
 592 our $netconf_desc = {
 593     type => {
 594         type => 'string',
 595         optional => 1,
 596         description => "Network interface type.",
 597         enum => [qw(veth)],
 598     },
 599     name => {
 600         type => 'string',
 601         format_description => 'string',
 602         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 603         pattern => '[-_.\w\d]+',
 604     },
 605     bridge => {
 606         type => 'string',
 607         format_description => 'bridge',
 608         description => 'Bridge to attach the network device to.',
 609         pattern => '[-_.\w\d]+',
 610         optional => 1,
 611     },
 612     hwaddr => get_standard_option('mac-addr', {
 613         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 614         }),
 615     mtu => {
 616         type => 'integer',
 617         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 618         minimum => 64, # minimum ethernet frame is 64 bytes
 619         optional => 1,
 620     },
 621     ip => {
 622         type => 'string',
 623         format => 'pve-ipv4-config',
 624         format_description => '(IPv4/CIDR|dhcp|manual)',
 625         description => 'IPv4 address in CIDR format.',
 626         optional => 1,
 627     },
 628     gw => {
 629         type => 'string',
 630         format => 'ipv4',
 631         format_description => 'GatewayIPv4',
 632         description => 'Default gateway for IPv4 traffic.',
 633         optional => 1,
 634     },
 635     ip6 => {
 636         type => 'string',
 637         format => 'pve-ipv6-config',
 638         format_description => '(IPv6/CIDR|auto|dhcp|manual)',
 639         description => 'IPv6 address in CIDR format.',
 640         optional => 1,
 641     },
 642     gw6 => {
 643         type => 'string',
 644         format => 'ipv6',
 645         format_description => 'GatewayIPv6',
 646         description => 'Default gateway for IPv6 traffic.',
 647         optional => 1,
 648     },
 649     firewall => {
 650         type => 'boolean',
 651         description => "Controls whether this interface's firewall rules should be used.",
 652         optional => 1,
 653     },
 654     tag => {
 655         type => 'integer',
 656         minimum => 1,
 657         maximum => 4094,
 658         description => "VLAN tag for this interface.",
 659         optional => 1,
 660     },
 661     trunks => {
 662         type => 'string',
 663         pattern => qr/\d+(?:;\d+)*/,
 664         format_description => 'vlanid[;vlanid...]',
 665         description => "VLAN ids to pass through the interface",
 666         optional => 1,
 667     },
 668     rate => {
 669         type => 'number',
 670         format_description => 'mbps',
 671         description => "Apply rate limiting to the interface",
 672         optional => 1,
 673     },
 674 };
 675 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 676
 677 my $MAX_LXC_NETWORKS = 10;
 678 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 679     $confdesc->{"net$i"} = {
 680         optional => 1,
 681         type => 'string', format => $netconf_desc,
 682         description => "Specifies network interfaces for the container.",
 683     };
 684 }
 685
 686 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 687 sub verify_lxc_mp_string {
 688     my ($mp, $noerr) = @_;
 689
 690     # do not allow:
 691     # /./ or /../
 692     # /. or /.. at the end
 693     # ../ at the beginning
 694
 695     if($mp =~ m@/\.\.?/@ ||
 696        $mp =~ m@/\.\.?$@ ||
 697        $mp =~ m@^\.\./@) {
 698         return undef if $noerr;
 699         die "$mp contains illegal character sequences\n";
 700     }
 701     return $mp;
 702 }
 703
 704 my $mp_desc = {
 705     %$rootfs_desc,
 706     backup => {
 707         type => 'boolean',
 708         description => 'Whether to include the mount point in backups.',
 709         verbose_description => 'Whether to include the mount point in backups '.
 710                                '(only used for volume mount points).',
 711         optional => 1,
 712     },
 713     mp => {
 714         type => 'string',
 715         format => 'pve-lxc-mp-string',
 716         format_description => 'Path',
 717         description => 'Path to the mount point as seen from inside the container '.
 718                        '(must not contain symlinks).',
 719         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 720                                "NOTE: Must not contain any symlinks for security reasons."
 721     },
 722 };
 723 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 724
 725 my $unuseddesc = {
 726     optional => 1,
 727     type => 'string', format => 'pve-volume-id',
 728     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 729 };
 730
 731 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 732     $confdesc->{"mp$i"} = {
 733         optional => 1,
 734         type => 'string', format => $mp_desc,
 735         description => "Use volume as container mount point.",
 736         optional => 1,
 737     };
 738 }
 739
 740 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 741     $confdesc->{"unused$i"} = $unuseddesc;
 742 }
 743
 744 sub parse_pct_config {
 745     my ($filename, $raw) = @_;
 746
 747     return undef if !defined($raw);
 748
 749     my $res = {
 750         digest => Digest::SHA::sha1_hex($raw),
 751         snapshots => {},
 752     };
 753
 754     $filename =~ m|/lxc/(\d+).conf$|
 755         || die "got strange filename '$filename'";
 756
 757     my $vmid = $1;
 758
 759     my $conf = $res;
 760     my $descr = '';
 761     my $section = '';
 762
 763     my @lines = split(/\n/, $raw);
 764     foreach my $line (@lines) {
 765         next if $line =~ m/^\s*$/;
 766
 767         if ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 768             $section = $1;
 769             $conf->{description} = $descr if $descr;
 770             $descr = '';
 771             $conf = $res->{snapshots}->{$section} = {};
 772             next;
 773         }
 774
 775         if ($line =~ m/^\#(.*)\s*$/) {
 776             $descr .= PVE::Tools::decode_text($1) . "\n";
 777             next;
 778         }
 779
 780         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 781             my $key = $1;
 782             my $value = $3;
 783             my $validity = is_valid_lxc_conf_key($vmid, $key);
 784             if ($validity eq 1) {
 785                 push @{$conf->{lxc}}, [$key, $value];
 786             } elsif (my $errmsg = $validity) {
 787                 warn "vm $vmid - $key: $errmsg\n";
 788             } else {
 789                 warn "vm $vmid - unable to parse config: $line\n";
 790             }
 791         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 792             $descr .= PVE::Tools::decode_text($2);
 793         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 794             $conf->{snapstate} = $1;
 795         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 796             my $key = $1;
 797             my $value = $2;
 798             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 799             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 800             $conf->{$key} = $value;
 801         } else {
 802             warn "vm $vmid - unable to parse config: $line\n";
 803         }
 804     }
 805
 806     $conf->{description} = $descr if $descr;
 807
 808     delete $res->{snapstate}; # just to be sure
 809
 810     return $res;
 811 }
 812
 813 sub write_pct_config {
 814     my ($filename, $conf) = @_;
 815
 816     delete $conf->{snapstate}; # just to be sure
 817
 818     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 819     my $used_volids = {};
 820     foreach my $vid (@$volidlist) {
 821         $used_volids->{$vid} = 1;
 822     }
 823
 824     # remove 'unusedX' settings if the volume is still used
 825     foreach my $key (keys %$conf) {
 826         my $value = $conf->{$key};
 827         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 828             delete $conf->{$key};
 829         }
 830     }
 831
 832     my $generate_raw_config = sub {
 833         my ($conf) = @_;
 834
 835         my $raw = '';
 836
 837         # add description as comment to top of file
 838         my $descr = $conf->{description} || '';
 839         foreach my $cl (split(/\n/, $descr)) {
 840             $raw .= '#' .  PVE::Tools::encode_text($cl) . "\n";
 841         }
 842
 843         foreach my $key (sort keys %$conf) {
 844             next if $key eq 'digest' || $key eq 'description' ||
 845                     $key eq 'pending' || $key eq 'snapshots' ||
 846                     $key eq 'snapname' || $key eq 'lxc';
 847             my $value = $conf->{$key};
 848             die "detected invalid newline inside property '$key'\n"
 849                 if $value =~ m/\n/;
 850             $raw .= "$key: $value\n";
 851         }
 852
 853         if (my $lxcconf = $conf->{lxc}) {
 854             foreach my $entry (@$lxcconf) {
 855                 my ($k, $v) = @$entry;
 856                 $raw .= "$k: $v\n";
 857             }
 858         }
 859
 860         return $raw;
 861     };
 862
 863     my $raw = &$generate_raw_config($conf);
 864
 865     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 866         $raw .= "\n[$snapname]\n";
 867         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 868     }
 869
 870     return $raw;
 871 }
 872
 873 sub update_pct_config {
 874     my ($class, $vmid, $conf, $running, $param, $delete) = @_;
 875
 876     my @nohotplug;
 877
 878     my $new_disks = 0;
 879     my @deleted_volumes;
 880
 881     my $rootdir;
 882     if ($running) {
 883         my $pid = PVE::LXC::find_lxc_pid($vmid);
 884         $rootdir = "/proc/$pid/root";
 885     }
 886
 887     my $hotplug_error = sub {
 888         if ($running) {
 889             push @nohotplug, @_;
 890             return 1;
 891         } else {
 892             return 0;
 893         }
 894     };
 895
 896     if (defined($delete)) {
 897         foreach my $opt (@$delete) {
 898             if (!exists($conf->{$opt})) {
 899                 # silently ignore
 900                 next;
 901             }
 902
 903             if ($opt eq 'memory' || $opt eq 'rootfs') {
 904                 die "unable to delete required option '$opt'\n";
 905             } elsif ($opt eq 'hostname') {
 906                 delete $conf->{$opt};
 907             } elsif ($opt eq 'swap') {
 908                 delete $conf->{$opt};
 909                 PVE::LXC::write_cgroup_value("memory", $vmid,
 910                                              "memory.memsw.limit_in_bytes", -1);
 911             } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup' || $opt eq 'hookscript') {
 912                 delete $conf->{$opt};
 913             } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
 914                      $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 915                 next if $hotplug_error->($opt);
 916                 delete $conf->{$opt};
 917             } elsif ($opt eq 'cores') {
 918                 delete $conf->{$opt}; # rest is handled by pvestatd
 919             } elsif ($opt eq 'cpulimit') {
 920                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 921                 delete $conf->{$opt};
 922             } elsif ($opt eq 'cpuunits') {
 923                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
 924                 delete $conf->{$opt};
 925             } elsif ($opt =~ m/^net(\d)$/) {
 926                 delete $conf->{$opt};
 927                 next if !$running;
 928                 my $netid = $1;
 929                 PVE::Network::veth_delete("veth${vmid}i$netid");
 930             } elsif ($opt eq 'protection') {
 931                 delete $conf->{$opt};
 932             } elsif ($opt =~ m/^unused(\d+)$/) {
 933                 next if $hotplug_error->($opt);
 934                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 935                 push @deleted_volumes, $conf->{$opt};
 936                 delete $conf->{$opt};
 937             } elsif ($opt =~ m/^mp(\d+)$/) {
 938                 next if $hotplug_error->($opt);
 939                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 940                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
 941                 delete $conf->{$opt};
 942                 if ($mp->{type} eq 'volume') {
 943                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 944                 }
 945             } elsif ($opt eq 'unprivileged') {
 946                 die "unable to delete read-only option: '$opt'\n";
 947             } elsif ($opt eq 'features') {
 948                 next if $hotplug_error->($opt);
 949                 delete $conf->{$opt};
 950             } else {
 951                 die "implement me (delete: $opt)"
 952             }
 953             PVE::LXC::Config->write_config($vmid, $conf) if $running;
 954         }
 955     }
 956
 957     # There's no separate swap size to configure, there's memory and "total"
 958     # memory (iow. memory+swap). This means we have to change them together.
 959     my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
 960     my $wanted_swap =  PVE::Tools::extract_param($param, 'swap');
 961     if (defined($wanted_memory) || defined($wanted_swap)) {
 962
 963         my $old_memory = ($conf->{memory} || 512);
 964         my $old_swap = ($conf->{swap} || 0);
 965
 966         $wanted_memory //= $old_memory;
 967         $wanted_swap //= $old_swap;
 968
 969         my $total = $wanted_memory + $wanted_swap;
 970         if ($running) {
 971             my $old_total = $old_memory + $old_swap;
 972             if ($total > $old_total) {
 973                 PVE::LXC::write_cgroup_value("memory", $vmid,
 974                                              "memory.memsw.limit_in_bytes",
 975                                              int($total*1024*1024));
 976                 PVE::LXC::write_cgroup_value("memory", $vmid,
 977                                              "memory.limit_in_bytes",
 978                                              int($wanted_memory*1024*1024));
 979             } else {
 980                 PVE::LXC::write_cgroup_value("memory", $vmid,
 981                                              "memory.limit_in_bytes",
 982                                              int($wanted_memory*1024*1024));
 983                 PVE::LXC::write_cgroup_value("memory", $vmid,
 984                                              "memory.memsw.limit_in_bytes",
 985                                              int($total*1024*1024));
 986             }
 987         }
 988         $conf->{memory} = $wanted_memory;
 989         $conf->{swap} = $wanted_swap;
 990
 991         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 992     }
 993
 994     my $storecfg = PVE::Storage::config();
 995
 996     my $used_volids = {};
 997     my $check_content_type = sub {
 998         my ($mp) = @_;
 999         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
1000         my $storage_config = PVE::Storage::storage_config($storecfg, $sid);
1001         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
1002             if !$storage_config->{content}->{rootdir};
1003     };
1004
1005     my $rescan_volume = sub {
1006         my ($mp) = @_;
1007         eval {
1008             $mp->{size} = PVE::Storage::volume_size_info($storecfg, $mp->{volume}, 5)
1009                 if !defined($mp->{size});
1010         };
1011         warn "Could not rescan volume size - $@\n" if $@;
1012     };
1013
1014     foreach my $opt (keys %$param) {
1015         my $value = $param->{$opt};
1016         my $check_protection_msg = "can't update CT $vmid drive '$opt'";
1017         if ($opt eq 'hostname' || $opt eq 'arch') {
1018             $conf->{$opt} = $value;
1019         } elsif ($opt eq 'onboot') {
1020             $conf->{$opt} = $value ? 1 : 0;
1021         } elsif ($opt eq 'startup') {
1022             $conf->{$opt} = $value;
1023         } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
1024             next if $hotplug_error->($opt);
1025             $conf->{$opt} = $value;
1026         } elsif ($opt eq 'nameserver') {
1027             next if $hotplug_error->($opt);
1028             my $list = PVE::LXC::verify_nameserver_list($value);
1029             $conf->{$opt} = $list;
1030         } elsif ($opt eq 'searchdomain') {
1031             next if $hotplug_error->($opt);
1032             my $list = PVE::LXC::verify_searchdomain_list($value);
1033             $conf->{$opt} = $list;
1034         } elsif ($opt eq 'cores') {
1035             $conf->{$opt} = $value;# rest is handled by pvestatd
1036         } elsif ($opt eq 'cpulimit') {
1037             if ($value == 0) {
1038                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
1039             } else {
1040                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
1041             }
1042             $conf->{$opt} = $value;
1043         } elsif ($opt eq 'cpuunits') {
1044             $conf->{$opt} = $value;
1045             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
1046         } elsif ($opt eq 'description') {
1047             $conf->{$opt} = $value;
1048         } elsif ($opt =~ m/^net(\d+)$/) {
1049             my $netid = $1;
1050             my $net = PVE::LXC::Config->parse_lxc_network($value);
1051             if (!$running) {
1052                 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
1053             } else {
1054                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
1055             }
1056         } elsif ($opt eq 'protection') {
1057             $conf->{$opt} = $value ? 1 : 0;
1058         } elsif ($opt =~ m/^mp(\d+)$/) {
1059             next if $hotplug_error->($opt);
1060             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
1061             my $old = $conf->{$opt};
1062             my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
1063             if ($mp->{type} eq 'volume') {
1064                 &$check_content_type($mp);
1065                 $used_volids->{$mp->{volume}} = 1;
1066                 &$rescan_volume($mp);
1067                 $conf->{$opt} = PVE::LXC::Config->print_ct_mountpoint($mp);
1068             } else {
1069                 $conf->{$opt} = $value;
1070             }
1071             if (defined($old)) {
1072                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
1073                 if ($mp->{type} eq 'volume') {
1074                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
1075                 }
1076             }
1077             $new_disks = 1;
1078         } elsif ($opt eq 'rootfs') {
1079             next if $hotplug_error->($opt);
1080             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
1081             my $old = $conf->{$opt};
1082             my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
1083             if ($mp->{type} eq 'volume') {
1084                 &$check_content_type($mp);
1085                 $used_volids->{$mp->{volume}} = 1;
1086                 &$rescan_volume($mp);
1087                 $conf->{$opt} = PVE::LXC::Config->print_ct_mountpoint($mp, 1);
1088             } else {
1089                 $conf->{$opt} = $value;
1090             }
1091             if (defined($old)) {
1092                 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
1093                 if ($mp->{type} eq 'volume') {
1094                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
1095                 }
1096             }
1097             $new_disks = 1;
1098         } elsif ($opt eq 'unprivileged') {
1099             die "unable to modify read-only option: '$opt'\n";
1100         } elsif ($opt eq 'ostype') {
1101             next if $hotplug_error->($opt);
1102             $conf->{$opt} = $value;
1103         } elsif ($opt eq 'features') {
1104             next if $hotplug_error->($opt);
1105             $conf->{$opt} = $value;
1106         } elsif ($opt eq 'hookscript') {
1107             PVE::GuestHelpers::check_hookscript($value);
1108             $conf->{$opt} = $value;
1109         } else {
1110             die "implement me: $opt";
1111         }
1112
1113         PVE::LXC::Config->write_config($vmid, $conf) if $running;
1114     }
1115
1116     # Apply deletions and creations of new volumes
1117     if (@deleted_volumes) {
1118         my $storage_cfg = PVE::Storage::config();
1119         foreach my $volume (@deleted_volumes) {
1120             next if $used_volids->{$volume}; # could have been re-added, too
1121             # also check for references in snapshots
1122             next if $class->is_volume_in_use($conf, $volume, 1);
1123             PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
1124         }
1125     }
1126
1127     if ($new_disks) {
1128         my $storage_cfg = PVE::Storage::config();
1129         PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
1130     }
1131
1132     # This should be the last thing we do here
1133     if ($running && scalar(@nohotplug)) {
1134         die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
1135     }
1136 }
1137
1138 sub check_type {
1139     my ($class, $key, $value) = @_;
1140
1141     die "unknown setting '$key'\n" if !$confdesc->{$key};
1142
1143     my $type = $confdesc->{$key}->{type};
1144
1145     if (!defined($value)) {
1146         die "got undefined value\n";
1147     }
1148
1149     if ($value =~ m/[\n\r]/) {
1150         die "property contains a line feed\n";
1151     }
1152
1153     if ($type eq 'boolean') {
1154         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1155         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1156         die "type check ('boolean') failed - got '$value'\n";
1157     } elsif ($type eq 'integer') {
1158         return int($1) if $value =~ m/^(\d+)$/;
1159         die "type check ('integer') failed - got '$value'\n";
1160     } elsif ($type eq 'number') {
1161         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1162         die "type check ('number') failed - got '$value'\n";
1163     } elsif ($type eq 'string') {
1164         if (my $fmt = $confdesc->{$key}->{format}) {
1165             PVE::JSONSchema::check_format($fmt, $value);
1166             return $value;
1167         }
1168         return $value;
1169     } else {
1170         die "internal error"
1171     }
1172 }
1173
1174
1175 # add JSON properties for create and set function
1176 sub json_config_properties {
1177     my ($class, $prop) = @_;
1178
1179     foreach my $opt (keys %$confdesc) {
1180         next if $opt eq 'parent' || $opt eq 'snaptime';
1181         next if $prop->{$opt};
1182         $prop->{$opt} = $confdesc->{$opt};
1183     }
1184
1185     return $prop;
1186 }
1187
1188 sub __parse_ct_mountpoint_full {
1189     my ($class, $desc, $data, $noerr) = @_;
1190
1191     $data //= '';
1192
1193     my $res;
1194     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1195     if ($@) {
1196         return undef if $noerr;
1197         die $@;
1198     }
1199
1200     if (defined(my $size = $res->{size})) {
1201         $size = PVE::JSONSchema::parse_size($size);
1202         if (!defined($size)) {
1203             return undef if $noerr;
1204             die "invalid size: $size\n";
1205         }
1206         $res->{size} = $size;
1207     }
1208
1209     $res->{type} = $class->classify_mountpoint($res->{volume});
1210
1211     return $res;
1212 };
1213
1214 sub parse_ct_rootfs {
1215     my ($class, $data, $noerr) = @_;
1216
1217     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1218
1219     $res->{mp} = '/' if defined($res);
1220
1221     return $res;
1222 }
1223
1224 sub parse_ct_mountpoint {
1225     my ($class, $data, $noerr) = @_;
1226
1227     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1228 }
1229
1230 sub print_ct_mountpoint {
1231     my ($class, $info, $nomp) = @_;
1232     my $skip = [ 'type' ];
1233     push @$skip, 'mp' if $nomp;
1234     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1235 }
1236
1237 sub print_lxc_network {
1238     my ($class, $net) = @_;
1239     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1240 }
1241
1242 sub parse_lxc_network {
1243     my ($class, $data) = @_;
1244
1245     my $res = {};
1246
1247     return $res if !$data;
1248
1249     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1250
1251     $res->{type} = 'veth';
1252     if (!$res->{hwaddr}) {
1253         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1254         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1255     }
1256
1257     return $res;
1258 }
1259
1260 sub parse_features {
1261     my ($class, $data) = @_;
1262     return {} if !$data;
1263     return PVE::JSONSchema::parse_property_string($features_desc, $data);
1264 }
1265
1266 sub option_exists {
1267     my ($class, $name) = @_;
1268
1269     return defined($confdesc->{$name});
1270 }
1271 # END JSON config code
1272
1273 sub classify_mountpoint {
1274     my ($class, $vol) = @_;
1275     if ($vol =~ m!^/!) {
1276         return 'device' if $vol =~ m!^/dev/!;
1277         return 'bind';
1278     }
1279     return 'volume';
1280 }
1281
1282 my $is_volume_in_use = sub {
1283     my ($class, $config, $volid) = @_;
1284     my $used = 0;
1285
1286     $class->foreach_mountpoint($config, sub {
1287         my ($ms, $mountpoint) = @_;
1288         return if $used;
1289         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1290     });
1291
1292     return $used;
1293 };
1294
1295 sub is_volume_in_use_by_snapshots {
1296     my ($class, $config, $volid) = @_;
1297
1298     if (my $snapshots = $config->{snapshots}) {
1299         foreach my $snap (keys %$snapshots) {
1300             return 1 if $is_volume_in_use->($class, $snapshots->{$snap}, $volid);
1301         }
1302     }
1303
1304     return 0;
1305 };
1306
1307 sub is_volume_in_use {
1308     my ($class, $config, $volid, $include_snapshots) = @_;
1309     return 1 if $is_volume_in_use->($class, $config, $volid);
1310     return 1 if $include_snapshots && $class->is_volume_in_use_by_snapshots($config, $volid);
1311     return 0;
1312 }
1313
1314 sub has_dev_console {
1315     my ($class, $conf) = @_;
1316
1317     return !(defined($conf->{console}) && !$conf->{console});
1318 }
1319
1320 sub has_lxc_entry {
1321     my ($class, $conf, $keyname) = @_;
1322
1323     if (my $lxcconf = $conf->{lxc}) {
1324         foreach my $entry (@$lxcconf) {
1325             my ($key, undef) = @$entry;
1326             return 1 if $key eq $keyname;
1327         }
1328     }
1329
1330     return 0;
1331 }
1332
1333 sub get_tty_count {
1334     my ($class, $conf) = @_;
1335
1336     return $conf->{tty} // $confdesc->{tty}->{default};
1337 }
1338
1339 sub get_cmode {
1340     my ($class, $conf) = @_;
1341
1342     return $conf->{cmode} // $confdesc->{cmode}->{default};
1343 }
1344
1345 sub mountpoint_names {
1346     my ($class, $reverse) = @_;
1347
1348     my @names = ('rootfs');
1349
1350     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1351         push @names, "mp$i";
1352     }
1353
1354     return $reverse ? reverse @names : @names;
1355 }
1356
1357 sub foreach_mountpoint_full {
1358     my ($class, $conf, $reverse, $func, @param) = @_;
1359
1360     my $mps = [ grep { defined($conf->{$_}) } $class->mountpoint_names($reverse) ];
1361     foreach my $key (@$mps) {
1362         my $value = $conf->{$key};
1363         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1364         next if !defined($mountpoint);
1365
1366         &$func($key, $mountpoint, @param);
1367     }
1368 }
1369
1370 sub foreach_mountpoint {
1371     my ($class, $conf, $func, @param) = @_;
1372
1373     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1374 }
1375
1376 sub foreach_mountpoint_reverse {
1377     my ($class, $conf, $func, @param) = @_;
1378
1379     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1380 }
1381
1382 sub get_vm_volumes {
1383     my ($class, $conf, $excludes) = @_;
1384
1385     my $vollist = [];
1386
1387     $class->foreach_mountpoint($conf, sub {
1388         my ($ms, $mountpoint) = @_;
1389
1390         return if $excludes && $ms eq $excludes;
1391
1392         my $volid = $mountpoint->{volume};
1393         return if !$volid || $mountpoint->{type} ne 'volume';
1394
1395         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1396         return if !$sid;
1397
1398         push @$vollist, $volid;
1399     });
1400
1401     return $vollist;
1402 }
1403
1404 sub get_replicatable_volumes {
1405     my ($class, $storecfg, $vmid, $conf, $cleanup, $noerr) = @_;
1406
1407     my $volhash = {};
1408
1409     my $test_volid = sub {
1410         my ($volid, $mountpoint) = @_;
1411
1412         return if !$volid;
1413
1414         my $mptype = $mountpoint->{type};
1415         my $replicate = $mountpoint->{replicate} // 1;
1416
1417         if ($mptype ne 'volume') {
1418             # skip bindmounts if replicate = 0 even for cleanup,
1419             # since bind mounts could not have been replicated ever
1420             return if !$replicate;
1421             die "unable to replicate mountpoint type '$mptype'\n";
1422         }
1423
1424         my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, $noerr);
1425         return if !$storeid;
1426
1427         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1428         return if $scfg->{shared};
1429
1430         my ($path, $owner, $vtype) = PVE::Storage::path($storecfg, $volid);
1431         return if !$owner || ($owner != $vmid);
1432
1433         die "unable to replicate volume '$volid', type '$vtype'\n" if $vtype ne 'images';
1434
1435         return if !$cleanup && !$replicate;
1436
1437         if (!PVE::Storage::volume_has_feature($storecfg, 'replicate', $volid)) {
1438             return if $cleanup || $noerr;
1439             die "missing replicate feature on volume '$volid'\n";
1440         }
1441
1442         $volhash->{$volid} = 1;
1443     };
1444
1445     $class->foreach_mountpoint($conf, sub {
1446         my ($ms, $mountpoint) = @_;
1447         $test_volid->($mountpoint->{volume}, $mountpoint);
1448     });
1449
1450     foreach my $snapname (keys %{$conf->{snapshots}}) {
1451         my $snap = $conf->{snapshots}->{$snapname};
1452         $class->foreach_mountpoint($snap, sub {
1453             my ($ms, $mountpoint) = @_;
1454             $test_volid->($mountpoint->{volume}, $mountpoint);
1455         });
1456     }
1457
1458     # add 'unusedX' volumes to volhash
1459     foreach my $key (keys %$conf) {
1460         if ($key =~ m/^unused/) {
1461             $test_volid->($conf->{$key}, { type => 'volume', replicate => 1 });
1462         }
1463     }
1464
1465     return $volhash;
1466 }
1467
1468 1;