src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::INotify;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::Tools;
  11
  12 use base qw(PVE::AbstractConfig);
  13
  14 my $nodename = PVE::INotify::nodename();
  15 my $lock_handles =  {};
  16 my $lockdir = "/run/lock/lxc";
  17 mkdir $lockdir;
  18 mkdir "/etc/pve/nodes/$nodename/lxc";
  19 my $MAX_MOUNT_POINTS = 10;
  20 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  21
  22 # BEGIN implemented abstract methods from PVE::AbstractConfig
  23
  24 sub guest_type {
  25     return "CT";
  26 }
  27
  28 sub __config_max_unused_disks {
  29     my ($class) = @_;
  30
  31     return $MAX_UNUSED_DISKS;
  32 }
  33
  34 sub config_file_lock {
  35     my ($class, $vmid) = @_;
  36
  37     return "$lockdir/pve-config-${vmid}.lock";
  38 }
  39
  40 sub cfs_config_path {
  41     my ($class, $vmid, $node) = @_;
  42
  43     $node = $nodename if !$node;
  44     return "nodes/$node/lxc/$vmid.conf";
  45 }
  46
  47 sub mountpoint_backup_enabled {
  48     my ($class, $mp_key, $mountpoint) = @_;
  49
  50     return 1 if $mp_key eq 'rootfs';
  51
  52     return 0 if $mountpoint->{type} ne 'volume';
  53
  54     return 1 if $mountpoint->{backup};
  55
  56     return 0;
  57 }
  58
  59 sub has_feature {
  60     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  61     my $err;
  62
  63     $class->foreach_mountpoint($conf, sub {
  64         my ($ms, $mountpoint) = @_;
  65
  66         return if $err; # skip further test
  67         return if $backup_only && !$class->mountpoint_backup_enabled($ms, $mountpoint);
  68
  69         $err = 1
  70             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  71                                                  $mountpoint->{volume},
  72                                                  $snapname, $running);
  73     });
  74
  75     return $err ? 0 : 1;
  76 }
  77
  78 sub __snapshot_save_vmstate {
  79     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  80     die "implement me - snapshot_save_vmstate\n";
  81 }
  82
  83 sub __snapshot_check_running {
  84     my ($class, $vmid) = @_;
  85     return PVE::LXC::check_running($vmid);
  86 }
  87
  88 sub __snapshot_check_freeze_needed {
  89     my ($class, $vmid, $config, $save_vmstate) = @_;
  90
  91     my $ret = $class->__snapshot_check_running($vmid);
  92     return ($ret, $ret);
  93 }
  94
  95 sub __snapshot_freeze {
  96     my ($class, $vmid, $unfreeze) = @_;
  97
  98     if ($unfreeze) {
  99         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
 100         warn $@ if $@;
 101     } else {
 102         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
 103         PVE::LXC::sync_container_namespace($vmid);
 104     }
 105 }
 106
 107 sub __snapshot_create_vol_snapshot {
 108     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
 109
 110     my $storecfg = PVE::Storage::config();
 111
 112     return if $snapname eq 'vzdump' &&
 113         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 114
 115     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 116 }
 117
 118 sub __snapshot_delete_remove_drive {
 119     my ($class, $snap, $remove_drive) = @_;
 120
 121     if ($remove_drive eq 'vmstate') {
 122         die "implement me - saving vmstate\n";
 123     } else {
 124         my $value = $snap->{$remove_drive};
 125         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 126         delete $snap->{$remove_drive};
 127
 128         $class->add_unused_volume($snap, $mountpoint->{volume})
 129             if ($mountpoint->{type} eq 'volume');
 130     }
 131 }
 132
 133 sub __snapshot_delete_vmstate_file {
 134     my ($class, $snap, $force) = @_;
 135
 136     die "implement me - saving vmstate\n";
 137 }
 138
 139 sub __snapshot_delete_vol_snapshot {
 140     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 141
 142     return if $snapname eq 'vzdump' &&
 143         !$class->mountpoint_backup_enabled($ms, $mountpoint);
 144
 145     my $storecfg = PVE::Storage::config();
 146     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 147     push @$unused, $mountpoint->{volume};
 148 }
 149
 150 sub __snapshot_rollback_vol_possible {
 151     my ($class, $mountpoint, $snapname) = @_;
 152
 153     my $storecfg = PVE::Storage::config();
 154     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 155 }
 156
 157 sub __snapshot_rollback_vol_rollback {
 158     my ($class, $mountpoint, $snapname) = @_;
 159
 160     my $storecfg = PVE::Storage::config();
 161     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 162 }
 163
 164 sub __snapshot_rollback_vm_stop {
 165     my ($class, $vmid) = @_;
 166
 167     PVE::Tools::run_command(['/usr/bin/lxc-stop', '-n', $vmid, '--kill'])
 168         if $class->__snapshot_check_running($vmid);
 169 }
 170
 171 sub __snapshot_rollback_vm_start {
 172     my ($class, $vmid, $vmstate, $forcemachine);
 173
 174     die "implement me - save vmstate\n";
 175 }
 176
 177 sub __snapshot_rollback_get_unused {
 178     my ($class, $conf, $snap) = @_;
 179
 180     my $unused = [];
 181
 182     $class->__snapshot_foreach_volume($conf, sub {
 183         my ($vs, $volume) = @_;
 184
 185         return if $volume->{type} ne 'volume';
 186
 187         my $found = 0;
 188         my $volid = $volume->{volume};
 189
 190         $class->__snapshot_foreach_volume($snap, sub {
 191             my ($ms, $mountpoint) = @_;
 192
 193             return if $found;
 194             return if ($mountpoint->{type} ne 'volume');
 195
 196             $found = 1
 197                 if ($mountpoint->{volume} && $mountpoint->{volume} eq $volid);
 198         });
 199
 200         push @$unused, $volid if !$found;
 201     });
 202
 203     return $unused;
 204 }
 205
 206 sub __snapshot_foreach_volume {
 207     my ($class, $conf, $func) = @_;
 208
 209     $class->foreach_mountpoint($conf, $func);
 210 }
 211
 212 # END implemented abstract methods from PVE::AbstractConfig
 213
 214 # BEGIN JSON config code
 215
 216 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 217
 218 my $rootfs_desc = {
 219     volume => {
 220         type => 'string',
 221         default_key => 1,
 222         format => 'pve-lxc-mp-string',
 223         format_description => 'volume',
 224         description => 'Volume, device or directory to mount into the container.',
 225     },
 226     size => {
 227         type => 'string',
 228         format => 'disk-size',
 229         format_description => 'DiskSize',
 230         description => 'Volume size (read only value).',
 231         optional => 1,
 232     },
 233     acl => {
 234         type => 'boolean',
 235         description => 'Explicitly enable or disable ACL support.',
 236         optional => 1,
 237     },
 238     ro => {
 239         type => 'boolean',
 240         description => 'Read-only mount point',
 241         optional => 1,
 242     },
 243     quota => {
 244         type => 'boolean',
 245         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 246         optional => 1,
 247     },
 248     shared => {
 249         type => 'boolean',
 250         description => 'Mark this non-volume mount point as available on multiple nodes (see \'nodes\')',
 251         verbose_description => "Mark this non-volume mount point as available on all nodes.\n\nWARNING: This option does not share the mount point automatically, it assumes it is shared already!",
 252         optional => 1,
 253         default => 0,
 254     },
 255 };
 256
 257 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 258     type => 'string', format => $rootfs_desc,
 259     description => "Use volume as container root.",
 260     optional => 1,
 261 });
 262
 263 PVE::JSONSchema::register_standard_option('pve-lxc-snapshot-name', {
 264     description => "The name of the snapshot.",
 265     type => 'string', format => 'pve-configid',
 266     maxLength => 40,
 267 });
 268
 269 my $confdesc = {
 270     lock => {
 271         optional => 1,
 272         type => 'string',
 273         description => "Lock/unlock the VM.",
 274         enum => [qw(migrate backup snapshot rollback)],
 275     },
 276     onboot => {
 277         optional => 1,
 278         type => 'boolean',
 279         description => "Specifies whether a VM will be started during system bootup.",
 280         default => 0,
 281     },
 282     startup => get_standard_option('pve-startup-order'),
 283     template => {
 284         optional => 1,
 285         type => 'boolean',
 286         description => "Enable/disable Template.",
 287         default => 0,
 288     },
 289     arch => {
 290         optional => 1,
 291         type => 'string',
 292         enum => ['amd64', 'i386'],
 293         description => "OS architecture type.",
 294         default => 'amd64',
 295     },
 296     ostype => {
 297         optional => 1,
 298         type => 'string',
 299         enum => [qw(debian ubuntu centos fedora opensuse archlinux alpine gentoo unmanaged)],
 300         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 301     },
 302     console => {
 303         optional => 1,
 304         type => 'boolean',
 305         description => "Attach a console device (/dev/console) to the container.",
 306         default => 1,
 307     },
 308     tty => {
 309         optional => 1,
 310         type => 'integer',
 311         description => "Specify the number of tty available to the container",
 312         minimum => 0,
 313         maximum => 6,
 314         default => 2,
 315     },
 316     cores => {
 317         optional => 1,
 318         type => 'integer',
 319         description => "The number of cores assigned to the container. A container can use all available cores by default.",
 320         minimum => 1,
 321         maximum => 128,
 322     },
 323     cpulimit => {
 324         optional => 1,
 325         type => 'number',
 326         description => "Limit of CPU usage.\n\nNOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 327         minimum => 0,
 328         maximum => 128,
 329         default => 0,
 330     },
 331     cpuunits => {
 332         optional => 1,
 333         type => 'integer',
 334         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 335         minimum => 0,
 336         maximum => 500000,
 337         default => 1024,
 338     },
 339     memory => {
 340         optional => 1,
 341         type => 'integer',
 342         description => "Amount of RAM for the VM in MB.",
 343         minimum => 16,
 344         default => 512,
 345     },
 346     swap => {
 347         optional => 1,
 348         type => 'integer',
 349         description => "Amount of SWAP for the VM in MB.",
 350         minimum => 0,
 351         default => 512,
 352     },
 353     hostname => {
 354         optional => 1,
 355         description => "Set a host name for the container.",
 356         type => 'string', format => 'dns-name',
 357         maxLength => 255,
 358     },
 359     description => {
 360         optional => 1,
 361         type => 'string',
 362         description => "Container description. Only used on the configuration web interface.",
 363     },
 364     searchdomain => {
 365         optional => 1,
 366         type => 'string', format => 'dns-name-list',
 367         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 368     },
 369     nameserver => {
 370         optional => 1,
 371         type => 'string', format => 'address-list',
 372         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 373     },
 374     rootfs => get_standard_option('pve-ct-rootfs'),
 375     parent => {
 376         optional => 1,
 377         type => 'string', format => 'pve-configid',
 378         maxLength => 40,
 379         description => "Parent snapshot name. This is used internally, and should not be modified.",
 380     },
 381     snaptime => {
 382         optional => 1,
 383         description => "Timestamp for snapshots.",
 384         type => 'integer',
 385         minimum => 0,
 386     },
 387     cmode => {
 388         optional => 1,
 389         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 390         type => 'string',
 391         enum => ['shell', 'console', 'tty'],
 392         default => 'tty',
 393     },
 394     protection => {
 395         optional => 1,
 396         type => 'boolean',
 397         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 398         default => 0,
 399     },
 400     unprivileged => {
 401         optional => 1,
 402         type => 'boolean',
 403         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 404         default => 0,
 405     },
 406 };
 407
 408 my $valid_lxc_conf_keys = {
 409     'lxc.include' => 1,
 410     'lxc.arch' => 1,
 411     'lxc.utsname' => 1,
 412     'lxc.haltsignal' => 1,
 413     'lxc.rebootsignal' => 1,
 414     'lxc.stopsignal' => 1,
 415     'lxc.init_cmd' => 1,
 416     'lxc.network.type' => 1,
 417     'lxc.network.flags' => 1,
 418     'lxc.network.link' => 1,
 419     'lxc.network.mtu' => 1,
 420     'lxc.network.name' => 1,
 421     'lxc.network.hwaddr' => 1,
 422     'lxc.network.ipv4' => 1,
 423     'lxc.network.ipv4.gateway' => 1,
 424     'lxc.network.ipv6' => 1,
 425     'lxc.network.ipv6.gateway' => 1,
 426     'lxc.network.script.up' => 1,
 427     'lxc.network.script.down' => 1,
 428     'lxc.pts' => 1,
 429     'lxc.console.logfile' => 1,
 430     'lxc.console' => 1,
 431     'lxc.tty' => 1,
 432     'lxc.devttydir' => 1,
 433     'lxc.hook.autodev' => 1,
 434     'lxc.autodev' => 1,
 435     'lxc.kmsg' => 1,
 436     'lxc.mount' => 1,
 437     'lxc.mount.entry' => 1,
 438     'lxc.mount.auto' => 1,
 439     'lxc.rootfs' => 'lxc.rootfs is auto generated from rootfs',
 440     'lxc.rootfs.mount' => 1,
 441     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 442                             ', please use mount point options in the "rootfs" key',
 443     # lxc.cgroup.*
 444     'lxc.cap.drop' => 1,
 445     'lxc.cap.keep' => 1,
 446     'lxc.aa_profile' => 1,
 447     'lxc.aa_allow_incomplete' => 1,
 448     'lxc.se_context' => 1,
 449     'lxc.seccomp' => 1,
 450     'lxc.id_map' => 1,
 451     'lxc.hook.pre-start' => 1,
 452     'lxc.hook.pre-mount' => 1,
 453     'lxc.hook.mount' => 1,
 454     'lxc.hook.start' => 1,
 455     'lxc.hook.stop' => 1,
 456     'lxc.hook.post-stop' => 1,
 457     'lxc.hook.clone' => 1,
 458     'lxc.hook.destroy' => 1,
 459     'lxc.loglevel' => 1,
 460     'lxc.logfile' => 1,
 461     'lxc.start.auto' => 1,
 462     'lxc.start.delay' => 1,
 463     'lxc.start.order' => 1,
 464     'lxc.group' => 1,
 465     'lxc.environment' => 1,
 466 };
 467
 468 our $netconf_desc = {
 469     type => {
 470         type => 'string',
 471         optional => 1,
 472         description => "Network interface type.",
 473         enum => [qw(veth)],
 474     },
 475     name => {
 476         type => 'string',
 477         format_description => 'string',
 478         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 479         pattern => '[-_.\w\d]+',
 480     },
 481     bridge => {
 482         type => 'string',
 483         format_description => 'bridge',
 484         description => 'Bridge to attach the network device to.',
 485         pattern => '[-_.\w\d]+',
 486         optional => 1,
 487     },
 488     hwaddr => {
 489         type => 'string',
 490         format_description => "XX:XX:XX:XX:XX:XX",
 491         description => 'The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)',
 492         pattern => qr/(?:[a-f0-9]{2}:){5}[a-f0-9]{2}/i,
 493         optional => 1,
 494     },
 495     mtu => {
 496         type => 'integer',
 497         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 498         minimum => 64, # minimum ethernet frame is 64 bytes
 499         optional => 1,
 500     },
 501     ip => {
 502         type => 'string',
 503         format => 'pve-ipv4-config',
 504         format_description => 'IPv4Format/CIDR',
 505         description => 'IPv4 address in CIDR format.',
 506         optional => 1,
 507     },
 508     gw => {
 509         type => 'string',
 510         format => 'ipv4',
 511         format_description => 'GatewayIPv4',
 512         description => 'Default gateway for IPv4 traffic.',
 513         optional => 1,
 514     },
 515     ip6 => {
 516         type => 'string',
 517         format => 'pve-ipv6-config',
 518         format_description => 'IPv6Format/CIDR',
 519         description => 'IPv6 address in CIDR format.',
 520         optional => 1,
 521     },
 522     gw6 => {
 523         type => 'string',
 524         format => 'ipv6',
 525         format_description => 'GatewayIPv6',
 526         description => 'Default gateway for IPv6 traffic.',
 527         optional => 1,
 528     },
 529     firewall => {
 530         type => 'boolean',
 531         description => "Controls whether this interface's firewall rules should be used.",
 532         optional => 1,
 533     },
 534     tag => {
 535         type => 'integer',
 536         minimum => 1,
 537         maximum => 4094,
 538         description => "VLAN tag for this interface.",
 539         optional => 1,
 540     },
 541     trunks => {
 542         type => 'string',
 543         pattern => qr/\d+(?:;\d+)*/,
 544         format_description => 'vlanid[;vlanid...]',
 545         description => "VLAN ids to pass through the interface",
 546         optional => 1,
 547     },
 548     rate => {
 549         type => 'number',
 550         format_description => 'mbps',
 551         description => "Apply rate limiting to the interface",
 552         optional => 1,
 553     },
 554 };
 555 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 556
 557 my $MAX_LXC_NETWORKS = 10;
 558 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 559     $confdesc->{"net$i"} = {
 560         optional => 1,
 561         type => 'string', format => $netconf_desc,
 562         description => "Specifies network interfaces for the container.",
 563     };
 564 }
 565
 566 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 567 sub verify_lxc_mp_string {
 568     my ($mp, $noerr) = @_;
 569
 570     # do not allow:
 571     # /./ or /../
 572     # /. or /.. at the end
 573     # ../ at the beginning
 574
 575     if($mp =~ m@/\.\.?/@ ||
 576        $mp =~ m@/\.\.?$@ ||
 577        $mp =~ m@^\.\./@) {
 578         return undef if $noerr;
 579         die "$mp contains illegal character sequences\n";
 580     }
 581     return $mp;
 582 }
 583
 584 my $mp_desc = {
 585     %$rootfs_desc,
 586     backup => {
 587         type => 'boolean',
 588         description => 'Whether to include the mount point in backups.',
 589         verbose_description => 'Whether to include the mount point in backups '.
 590                                '(only used for volume mount points).',
 591         optional => 1,
 592     },
 593     mp => {
 594         type => 'string',
 595         format => 'pve-lxc-mp-string',
 596         format_description => 'Path',
 597         description => 'Path to the mount point as seen from inside the container '.
 598                        '(must not contain symlinks).',
 599         verbose_description => "Path to the mount point as seen from inside the container.\n\n".
 600                                "NOTE: Must not contain any symlinks for security reasons."
 601     },
 602 };
 603 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 604
 605 my $unuseddesc = {
 606     optional => 1,
 607     type => 'string', format => 'pve-volume-id',
 608     description => "Reference to unused volumes. This is used internally, and should not be modified manually.",
 609 };
 610
 611 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 612     $confdesc->{"mp$i"} = {
 613         optional => 1,
 614         type => 'string', format => $mp_desc,
 615         description => "Use volume as container mount point.",
 616         optional => 1,
 617     };
 618 }
 619
 620 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 621     $confdesc->{"unused$i"} = $unuseddesc;
 622 }
 623
 624 sub parse_pct_config {
 625     my ($filename, $raw) = @_;
 626
 627     return undef if !defined($raw);
 628
 629     my $res = {
 630         digest => Digest::SHA::sha1_hex($raw),
 631         snapshots => {},
 632     };
 633
 634     $filename =~ m|/lxc/(\d+).conf$|
 635         || die "got strange filename '$filename'";
 636
 637     my $vmid = $1;
 638
 639     my $conf = $res;
 640     my $descr = '';
 641     my $section = '';
 642
 643     my @lines = split(/\n/, $raw);
 644     foreach my $line (@lines) {
 645         next if $line =~ m/^\s*$/;
 646
 647         if ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 648             $section = $1;
 649             $conf->{description} = $descr if $descr;
 650             $descr = '';
 651             $conf = $res->{snapshots}->{$section} = {};
 652             next;
 653         }
 654
 655         if ($line =~ m/^\#(.*)\s*$/) {
 656             $descr .= PVE::Tools::decode_text($1) . "\n";
 657             next;
 658         }
 659
 660         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 661             my $key = $1;
 662             my $value = $3;
 663             my $validity = $valid_lxc_conf_keys->{$key} || 0;
 664             if ($validity eq 1 || $key =~ m/^lxc\.cgroup\./) {
 665                 push @{$conf->{lxc}}, [$key, $value];
 666             } elsif (my $errmsg = $validity) {
 667                 warn "vm $vmid - $key: $errmsg\n";
 668             } else {
 669                 warn "vm $vmid - unable to parse config: $line\n";
 670             }
 671         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 672             $descr .= PVE::Tools::decode_text($2);
 673         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 674             $conf->{snapstate} = $1;
 675         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 676             my $key = $1;
 677             my $value = $2;
 678             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 679             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 680             $conf->{$key} = $value;
 681         } else {
 682             warn "vm $vmid - unable to parse config: $line\n";
 683         }
 684     }
 685
 686     $conf->{description} = $descr if $descr;
 687
 688     delete $res->{snapstate}; # just to be sure
 689
 690     return $res;
 691 }
 692
 693 sub write_pct_config {
 694     my ($filename, $conf) = @_;
 695
 696     delete $conf->{snapstate}; # just to be sure
 697
 698     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 699     my $used_volids = {};
 700     foreach my $vid (@$volidlist) {
 701         $used_volids->{$vid} = 1;
 702     }
 703
 704     # remove 'unusedX' settings if the volume is still used
 705     foreach my $key (keys %$conf) {
 706         my $value = $conf->{$key};
 707         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 708             delete $conf->{$key};
 709         }
 710     }
 711
 712     my $generate_raw_config = sub {
 713         my ($conf) = @_;
 714
 715         my $raw = '';
 716
 717         # add description as comment to top of file
 718         my $descr = $conf->{description} || '';
 719         foreach my $cl (split(/\n/, $descr)) {
 720             $raw .= '#' .  PVE::Tools::encode_text($cl) . "\n";
 721         }
 722
 723         foreach my $key (sort keys %$conf) {
 724             next if $key eq 'digest' || $key eq 'description' ||
 725                     $key eq 'pending' || $key eq 'snapshots' ||
 726                     $key eq 'snapname' || $key eq 'lxc';
 727             my $value = $conf->{$key};
 728             die "detected invalid newline inside property '$key'\n"
 729                 if $value =~ m/\n/;
 730             $raw .= "$key: $value\n";
 731         }
 732
 733         if (my $lxcconf = $conf->{lxc}) {
 734             foreach my $entry (@$lxcconf) {
 735                 my ($k, $v) = @$entry;
 736                 $raw .= "$k: $v\n";
 737             }
 738         }
 739
 740         return $raw;
 741     };
 742
 743     my $raw = &$generate_raw_config($conf);
 744
 745     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 746         $raw .= "\n[$snapname]\n";
 747         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 748     }
 749
 750     return $raw;
 751 }
 752
 753 sub update_pct_config {
 754     my ($class, $vmid, $conf, $running, $param, $delete) = @_;
 755
 756     my @nohotplug;
 757
 758     my $new_disks = 0;
 759     my @deleted_volumes;
 760
 761     my $rootdir;
 762     if ($running) {
 763         my $pid = PVE::LXC::find_lxc_pid($vmid);
 764         $rootdir = "/proc/$pid/root";
 765     }
 766
 767     my $hotplug_error = sub {
 768         if ($running) {
 769             push @nohotplug, @_;
 770             return 1;
 771         } else {
 772             return 0;
 773         }
 774     };
 775
 776     if (defined($delete)) {
 777         foreach my $opt (@$delete) {
 778             if (!exists($conf->{$opt})) {
 779                 # silently ignore
 780                 next;
 781             }
 782
 783             if ($opt eq 'memory' || $opt eq 'rootfs') {
 784                 die "unable to delete required option '$opt'\n";
 785             } elsif ($opt eq 'hostname') {
 786                 delete $conf->{$opt};
 787             } elsif ($opt eq 'swap') {
 788                 delete $conf->{$opt};
 789                 PVE::LXC::write_cgroup_value("memory", $vmid,
 790                                              "memory.memsw.limit_in_bytes", -1);
 791             } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup') {
 792                 delete $conf->{$opt};
 793             } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
 794                      $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 795                 next if $hotplug_error->($opt);
 796                 delete $conf->{$opt};
 797             } elsif ($opt eq 'cores') {
 798                 delete $conf->{$opt}; # rest is handled by pvestatd
 799             } elsif ($opt eq 'cpulimit') {
 800                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 801                 delete $conf->{$opt};
 802             } elsif ($opt eq 'cpuunits') {
 803                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
 804                 delete $conf->{$opt};
 805             } elsif ($opt =~ m/^net(\d)$/) {
 806                 delete $conf->{$opt};
 807                 next if !$running;
 808                 my $netid = $1;
 809                 PVE::Network::veth_delete("veth${vmid}i$netid");
 810             } elsif ($opt eq 'protection') {
 811                 delete $conf->{$opt};
 812             } elsif ($opt =~ m/^unused(\d+)$/) {
 813                 next if $hotplug_error->($opt);
 814                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 815                 push @deleted_volumes, $conf->{$opt};
 816                 delete $conf->{$opt};
 817             } elsif ($opt =~ m/^mp(\d+)$/) {
 818                 next if $hotplug_error->($opt);
 819                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 820                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
 821                 delete $conf->{$opt};
 822                 if ($mp->{type} eq 'volume') {
 823                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 824                 }
 825             } elsif ($opt eq 'unprivileged') {
 826                 die "unable to delete read-only option: '$opt'\n";
 827             } else {
 828                 die "implement me (delete: $opt)"
 829             }
 830             PVE::LXC::Config->write_config($vmid, $conf) if $running;
 831         }
 832     }
 833
 834     # There's no separate swap size to configure, there's memory and "total"
 835     # memory (iow. memory+swap). This means we have to change them together.
 836     my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
 837     my $wanted_swap =  PVE::Tools::extract_param($param, 'swap');
 838     if (defined($wanted_memory) || defined($wanted_swap)) {
 839
 840         my $old_memory = ($conf->{memory} || 512);
 841         my $old_swap = ($conf->{swap} || 0);
 842
 843         $wanted_memory //= $old_memory;
 844         $wanted_swap //= $old_swap;
 845
 846         my $total = $wanted_memory + $wanted_swap;
 847         if ($running) {
 848             my $old_total = $old_memory + $old_swap;
 849             if ($total > $old_total) {
 850                 PVE::LXC::write_cgroup_value("memory", $vmid,
 851                                              "memory.memsw.limit_in_bytes",
 852                                              int($total*1024*1024));
 853                 PVE::LXC::write_cgroup_value("memory", $vmid,
 854                                              "memory.limit_in_bytes",
 855                                              int($wanted_memory*1024*1024));
 856             } else {
 857                 PVE::LXC::write_cgroup_value("memory", $vmid,
 858                                              "memory.limit_in_bytes",
 859                                              int($wanted_memory*1024*1024));
 860                 PVE::LXC::write_cgroup_value("memory", $vmid,
 861                                              "memory.memsw.limit_in_bytes",
 862                                              int($total*1024*1024));
 863             }
 864         }
 865         $conf->{memory} = $wanted_memory;
 866         $conf->{swap} = $wanted_swap;
 867
 868         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 869     }
 870
 871     my $used_volids = {};
 872     my $check_content_type = sub {
 873         my ($mp) = @_;
 874         my $sid = PVE::Storage::parse_volume_id($mp->{volume});
 875         my $scfg = PVE::Storage::config();
 876         my $storage_config = PVE::Storage::storage_config($scfg, $sid);
 877         die "storage '$sid' does not allow content type 'rootdir' (Container)\n"
 878             if !$storage_config->{content}->{rootdir};
 879     };
 880
 881     foreach my $opt (keys %$param) {
 882         my $value = $param->{$opt};
 883         my $check_protection_msg = "can't update CT $vmid drive '$opt'";
 884         if ($opt eq 'hostname' || $opt eq 'arch') {
 885             $conf->{$opt} = $value;
 886         } elsif ($opt eq 'onboot') {
 887             $conf->{$opt} = $value ? 1 : 0;
 888         } elsif ($opt eq 'startup') {
 889             $conf->{$opt} = $value;
 890         } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 891             next if $hotplug_error->($opt);
 892             $conf->{$opt} = $value;
 893         } elsif ($opt eq 'nameserver') {
 894             next if $hotplug_error->($opt);
 895             my $list = PVE::LXC::verify_nameserver_list($value);
 896             $conf->{$opt} = $list;
 897         } elsif ($opt eq 'searchdomain') {
 898             next if $hotplug_error->($opt);
 899             my $list = PVE::LXC::verify_searchdomain_list($value);
 900             $conf->{$opt} = $list;
 901         } elsif ($opt eq 'cores') {
 902             $conf->{$opt} = $value;# rest is handled by pvestatd
 903         } elsif ($opt eq 'cpulimit') {
 904             if ($value == 0) {
 905                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", -1);
 906             } else {
 907                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.cfs_quota_us", int(100000*$value));
 908             }
 909             $conf->{$opt} = $value;
 910         } elsif ($opt eq 'cpuunits') {
 911             $conf->{$opt} = $value;
 912             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
 913         } elsif ($opt eq 'description') {
 914             $conf->{$opt} = PVE::Tools::encode_text($value);
 915         } elsif ($opt =~ m/^net(\d+)$/) {
 916             my $netid = $1;
 917             my $net = PVE::LXC::Config->parse_lxc_network($value);
 918             if (!$running) {
 919                 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
 920             } else {
 921                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
 922             }
 923         } elsif ($opt eq 'protection') {
 924             $conf->{$opt} = $value ? 1 : 0;
 925         } elsif ($opt =~ m/^mp(\d+)$/) {
 926             next if $hotplug_error->($opt);
 927             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 928             my $old = $conf->{$opt};
 929             my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
 930             if ($mp->{type} eq 'volume') {
 931                 &$check_content_type($mp);
 932                 $used_volids->{$mp->{volume}} = 1;
 933             }
 934             $conf->{$opt} = $value;
 935             if (defined($old)) {
 936                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
 937                 if ($mp->{type} eq 'volume') {
 938                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 939                 }
 940             }
 941             $new_disks = 1;
 942         } elsif ($opt eq 'rootfs') {
 943             next if $hotplug_error->($opt);
 944             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 945             my $old = $conf->{$opt};
 946             $conf->{$opt} = $value;
 947             my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
 948             if ($mp->{type} eq 'volume') {
 949                 &$check_content_type($mp);
 950                 $used_volids->{$mp->{volume}} = 1;
 951             }
 952             if (defined($old)) {
 953                 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
 954                 if ($mp->{type} eq 'volume') {
 955                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 956                 }
 957             }
 958             $new_disks = 1;
 959         } elsif ($opt eq 'unprivileged') {
 960             die "unable to modify read-only option: '$opt'\n";
 961         } elsif ($opt eq 'ostype') {
 962             next if $hotplug_error->($opt);
 963             $conf->{$opt} = $value;
 964         } else {
 965             die "implement me: $opt";
 966         }
 967         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 968     }
 969
 970     # Apply deletions and creations of new volumes
 971     if (@deleted_volumes) {
 972         my $storage_cfg = PVE::Storage::config();
 973         foreach my $volume (@deleted_volumes) {
 974             next if $used_volids->{$volume}; # could have been re-added, too
 975             # also check for references in snapshots
 976             next if $class->is_volume_in_use($conf, $volume, 1);
 977             PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
 978         }
 979     }
 980
 981     if ($new_disks) {
 982         my $storage_cfg = PVE::Storage::config();
 983         PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
 984     }
 985
 986     # This should be the last thing we do here
 987     if ($running && scalar(@nohotplug)) {
 988         die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
 989     }
 990 }
 991
 992 sub check_type {
 993     my ($class, $key, $value) = @_;
 994
 995     die "unknown setting '$key'\n" if !$confdesc->{$key};
 996
 997     my $type = $confdesc->{$key}->{type};
 998
 999     if (!defined($value)) {
1000         die "got undefined value\n";
1001     }
1002
1003     if ($value =~ m/[\n\r]/) {
1004         die "property contains a line feed\n";
1005     }
1006
1007     if ($type eq 'boolean') {
1008         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
1009         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
1010         die "type check ('boolean') failed - got '$value'\n";
1011     } elsif ($type eq 'integer') {
1012         return int($1) if $value =~ m/^(\d+)$/;
1013         die "type check ('integer') failed - got '$value'\n";
1014     } elsif ($type eq 'number') {
1015         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
1016         die "type check ('number') failed - got '$value'\n";
1017     } elsif ($type eq 'string') {
1018         if (my $fmt = $confdesc->{$key}->{format}) {
1019             PVE::JSONSchema::check_format($fmt, $value);
1020             return $value;
1021         }
1022         return $value;
1023     } else {
1024         die "internal error"
1025     }
1026 }
1027
1028
1029 # add JSON properties for create and set function
1030 sub json_config_properties {
1031     my ($class, $prop) = @_;
1032
1033     foreach my $opt (keys %$confdesc) {
1034         next if $opt eq 'parent' || $opt eq 'snaptime';
1035         next if $prop->{$opt};
1036         $prop->{$opt} = $confdesc->{$opt};
1037     }
1038
1039     return $prop;
1040 }
1041
1042 sub __parse_ct_mountpoint_full {
1043     my ($class, $desc, $data, $noerr) = @_;
1044
1045     $data //= '';
1046
1047     my $res;
1048     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
1049     if ($@) {
1050         return undef if $noerr;
1051         die $@;
1052     }
1053
1054     if (defined(my $size = $res->{size})) {
1055         $size = PVE::JSONSchema::parse_size($size);
1056         if (!defined($size)) {
1057             return undef if $noerr;
1058             die "invalid size: $size\n";
1059         }
1060         $res->{size} = $size;
1061     }
1062
1063     $res->{type} = $class->classify_mountpoint($res->{volume});
1064
1065     return $res;
1066 };
1067
1068 sub parse_ct_rootfs {
1069     my ($class, $data, $noerr) = @_;
1070
1071     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
1072
1073     $res->{mp} = '/' if defined($res);
1074
1075     return $res;
1076 }
1077
1078 sub parse_ct_mountpoint {
1079     my ($class, $data, $noerr) = @_;
1080
1081     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
1082 }
1083
1084 sub print_ct_mountpoint {
1085     my ($class, $info, $nomp) = @_;
1086     my $skip = [ 'type' ];
1087     push @$skip, 'mp' if $nomp;
1088     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1089 }
1090
1091 sub print_lxc_network {
1092     my ($class, $net) = @_;
1093     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1094 }
1095
1096 sub parse_lxc_network {
1097     my ($class, $data) = @_;
1098
1099     my $res = {};
1100
1101     return $res if !$data;
1102
1103     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1104
1105     $res->{type} = 'veth';
1106     if (!$res->{hwaddr}) {
1107         my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
1108         $res->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
1109     }
1110
1111     return $res;
1112 }
1113
1114 sub option_exists {
1115     my ($class, $name) = @_;
1116
1117     return defined($confdesc->{$name});
1118 }
1119 # END JSON config code
1120
1121 sub classify_mountpoint {
1122     my ($class, $vol) = @_;
1123     if ($vol =~ m!^/!) {
1124         return 'device' if $vol =~ m!^/dev/!;
1125         return 'bind';
1126     }
1127     return 'volume';
1128 }
1129
1130 sub is_volume_in_use {
1131     my ($class, $config, $volid, $include_snapshots) = @_;
1132     my $used = 0;
1133
1134     $class->foreach_mountpoint($config, sub {
1135         my ($ms, $mountpoint) = @_;
1136         return if $used;
1137         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1138     });
1139
1140     my $snapshots = $config->{snapshots};
1141     if ($include_snapshots && $snapshots) {
1142         foreach my $snap (keys %$snapshots) {
1143             $used ||= $class->is_volume_in_use($snapshots->{$snap}, $volid);
1144         }
1145     }
1146
1147     return $used;
1148 }
1149
1150 sub has_dev_console {
1151     my ($class, $conf) = @_;
1152
1153     return !(defined($conf->{console}) && !$conf->{console});
1154 }
1155
1156 sub has_lxc_entry {
1157     my ($class, $conf, $keyname) = @_;
1158
1159     if (my $lxcconf = $conf->{lxc}) {
1160         foreach my $entry (@$lxcconf) {
1161             my ($key, undef) = @$entry;
1162             return 1 if $key eq $keyname;
1163         }
1164     }
1165
1166     return 0;
1167 }
1168
1169 sub get_tty_count {
1170     my ($class, $conf) = @_;
1171
1172     return $conf->{tty} // $confdesc->{tty}->{default};
1173 }
1174
1175 sub get_cmode {
1176     my ($class, $conf) = @_;
1177
1178     return $conf->{cmode} // $confdesc->{cmode}->{default};
1179 }
1180
1181 sub mountpoint_names {
1182     my ($class, $reverse) = @_;
1183
1184     my @names = ('rootfs');
1185
1186     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1187         push @names, "mp$i";
1188     }
1189
1190     return $reverse ? reverse @names : @names;
1191 }
1192
1193 sub foreach_mountpoint_full {
1194     my ($class, $conf, $reverse, $func, @param) = @_;
1195
1196     foreach my $key ($class->mountpoint_names($reverse)) {
1197         my $value = $conf->{$key};
1198         next if !defined($value);
1199         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1200         next if !defined($mountpoint);
1201
1202         &$func($key, $mountpoint, @param);
1203     }
1204 }
1205
1206 sub foreach_mountpoint {
1207     my ($class, $conf, $func, @param) = @_;
1208
1209     $class->foreach_mountpoint_full($conf, 0, $func, @param);
1210 }
1211
1212 sub foreach_mountpoint_reverse {
1213     my ($class, $conf, $func, @param) = @_;
1214
1215     $class->foreach_mountpoint_full($conf, 1, $func, @param);
1216 }
1217
1218 sub get_vm_volumes {
1219     my ($class, $conf, $excludes) = @_;
1220
1221     my $vollist = [];
1222
1223     $class->foreach_mountpoint($conf, sub {
1224         my ($ms, $mountpoint) = @_;
1225
1226         return if $excludes && $ms eq $excludes;
1227
1228         my $volid = $mountpoint->{volume};
1229         return if !$volid || $mountpoint->{type} ne 'volume';
1230
1231         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1232         return if !$sid;
1233
1234         push @$vollist, $volid;
1235     });
1236
1237     return $vollist;
1238 }
1239
1240 return 1;