src/PVE/LXC/Config.pm

   1 package PVE::LXC::Config;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AbstractConfig;
   7 use PVE::Cluster qw(cfs_register_file);
   8 use PVE::INotify;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::Tools;
  11
  12 use base qw(PVE::AbstractConfig);
  13
  14 my $nodename = PVE::INotify::nodename();
  15 my $lock_handles =  {};
  16 my $lockdir = "/run/lock/lxc";
  17 mkdir $lockdir;
  18 mkdir "/etc/pve/nodes/$nodename/lxc";
  19 my $MAX_MOUNT_POINTS = 10;
  20 my $MAX_UNUSED_DISKS = $MAX_MOUNT_POINTS;
  21
  22 # BEGIN implemented abstract methods from PVE::AbstractConfig
  23
  24 sub guest_type {
  25     return "CT";
  26 }
  27
  28 sub __config_max_unused_disks {
  29     my ($class) = @_;
  30
  31     return $MAX_UNUSED_DISKS;
  32 }
  33
  34 sub config_file_lock {
  35     my ($class, $vmid) = @_;
  36
  37     return "$lockdir/pve-config-${vmid}.lock";
  38 }
  39
  40 sub cfs_config_path {
  41     my ($class, $vmid, $node) = @_;
  42
  43     $node = $nodename if !$node;
  44     return "nodes/$node/lxc/$vmid.conf";
  45 }
  46
  47 sub has_feature {
  48     my ($class, $feature, $conf, $storecfg, $snapname, $running, $backup_only) = @_;
  49     my $err;
  50
  51     $class->foreach_mountpoint($conf, sub {
  52         my ($ms, $mountpoint) = @_;
  53
  54         return if $err; # skip further test
  55         return if $backup_only && $ms ne 'rootfs' && !$mountpoint->{backup};
  56
  57         $err = 1
  58             if !PVE::Storage::volume_has_feature($storecfg, $feature,
  59                                                  $mountpoint->{volume},
  60                                                  $snapname, $running);
  61     });
  62
  63     return $err ? 0 : 1;
  64 }
  65
  66 sub __snapshot_save_vmstate {
  67     my ($class, $vmid, $conf, $snapname, $storecfg) = @_;
  68     die "implement me - snapshot_save_vmstate\n";
  69 }
  70
  71 sub __snapshot_check_running {
  72     my ($class, $vmid) = @_;
  73     return PVE::LXC::check_running($vmid);
  74 }
  75
  76 sub __snapshot_check_freeze_needed {
  77     my ($class, $vmid, $config, $save_vmstate) = @_;
  78
  79     my $ret = $class->__snapshot_check_running($vmid);
  80     return ($ret, $ret);
  81 }
  82
  83 sub __snapshot_freeze {
  84     my ($class, $vmid, $unfreeze) = @_;
  85
  86     if ($unfreeze) {
  87         eval { PVE::Tools::run_command(['/usr/bin/lxc-unfreeze', '-n', $vmid]); };
  88         warn $@ if $@;
  89     } else {
  90         PVE::Tools::run_command(['/usr/bin/lxc-freeze', '-n', $vmid]);
  91         PVE::LXC::sync_container_namespace($vmid);
  92     }
  93 }
  94
  95 sub __snapshot_create_vol_snapshot {
  96     my ($class, $vmid, $ms, $mountpoint, $snapname) = @_;
  97
  98     my $storecfg = PVE::Storage::config();
  99
 100     return if $snapname eq 'vzdump' && $ms ne 'rootfs' && !$mountpoint->{backup};
 101     PVE::Storage::volume_snapshot($storecfg, $mountpoint->{volume}, $snapname);
 102 }
 103
 104 sub __snapshot_delete_remove_drive {
 105     my ($class, $snap, $remove_drive) = @_;
 106
 107     if ($remove_drive eq 'vmstate') {
 108         die "implement me - saving vmstate\n";
 109     } else {
 110         my $value = $snap->{$remove_drive};
 111         my $mountpoint = $remove_drive eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
 112         delete $snap->{$remove_drive};
 113         $class->add_unused_volume($snap, $mountpoint->{volume});
 114     }
 115 }
 116
 117 sub __snapshot_delete_vmstate_file {
 118     my ($class, $snap, $force) = @_;
 119
 120     die "implement me - saving vmstate\n";
 121 }
 122
 123 sub __snapshot_delete_vol_snapshot {
 124     my ($class, $vmid, $ms, $mountpoint, $snapname, $unused) = @_;
 125
 126     my $storecfg = PVE::Storage::config();
 127     PVE::Storage::volume_snapshot_delete($storecfg, $mountpoint->{volume}, $snapname);
 128     push @$unused, $mountpoint->{volume};
 129 }
 130
 131 sub __snapshot_rollback_vol_possible {
 132     my ($class, $mountpoint, $snapname) = @_;
 133
 134     my $storecfg = PVE::Storage::config();
 135     PVE::Storage::volume_rollback_is_possible($storecfg, $mountpoint->{volume}, $snapname);
 136 }
 137
 138 sub __snapshot_rollback_vol_rollback {
 139     my ($class, $mountpoint, $snapname) = @_;
 140
 141     my $storecfg = PVE::Storage::config();
 142     PVE::Storage::volume_snapshot_rollback($storecfg, $mountpoint->{volume}, $snapname);
 143 }
 144
 145 sub __snapshot_rollback_vm_stop {
 146     my ($class, $vmid) = @_;
 147
 148     PVE::Tools::run_command(['/usr/bin/lxc-stop', '-n', $vmid, '--kill'])
 149         if $class->__snapshot_check_running($vmid);
 150 }
 151
 152 sub __snapshot_rollback_vm_start {
 153     my ($class, $vmid, $vmstate, $forcemachine);
 154
 155     die "implement me - save vmstate\n";
 156 }
 157
 158 sub __snapshot_foreach_volume {
 159     my ($class, $conf, $func) = @_;
 160
 161     $class->foreach_mountpoint($conf, $func);
 162 }
 163
 164 # END implemented abstract methods from PVE::AbstractConfig
 165
 166 # BEGIN JSON config code
 167
 168 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 169
 170 my $rootfs_desc = {
 171     volume => {
 172         type => 'string',
 173         default_key => 1,
 174         format => 'pve-lxc-mp-string',
 175         format_description => 'volume',
 176         description => 'Volume, device or directory to mount into the container.',
 177     },
 178     backup => {
 179         type => 'boolean',
 180         format_description => '[1|0]',
 181         description => 'Whether to include the mountpoint in backups.',
 182         optional => 1,
 183     },
 184     size => {
 185         type => 'string',
 186         format => 'disk-size',
 187         format_description => 'DiskSize',
 188         description => 'Volume size (read only value).',
 189         optional => 1,
 190     },
 191     acl => {
 192         type => 'boolean',
 193         format_description => 'acl',
 194         description => 'Explicitly enable or disable ACL support.',
 195         optional => 1,
 196     },
 197     ro => {
 198         type => 'boolean',
 199         format_description => 'ro',
 200         description => 'Read-only mountpoint (not supported with bind mounts)',
 201         optional => 1,
 202     },
 203     quota => {
 204         type => 'boolean',
 205         format_description => '[0|1]',
 206         description => 'Enable user quotas inside the container (not supported with zfs subvolumes)',
 207         optional => 1,
 208     },
 209 };
 210
 211 PVE::JSONSchema::register_standard_option('pve-ct-rootfs', {
 212     type => 'string', format => $rootfs_desc,
 213     description => "Use volume as container root.",
 214     optional => 1,
 215 });
 216
 217 PVE::JSONSchema::register_standard_option('pve-lxc-snapshot-name', {
 218     description => "The name of the snapshot.",
 219     type => 'string', format => 'pve-configid',
 220     maxLength => 40,
 221 });
 222
 223 my $confdesc = {
 224     lock => {
 225         optional => 1,
 226         type => 'string',
 227         description => "Lock/unlock the VM.",
 228         enum => [qw(migrate backup snapshot rollback)],
 229     },
 230     onboot => {
 231         optional => 1,
 232         type => 'boolean',
 233         description => "Specifies whether a VM will be started during system bootup.",
 234         default => 0,
 235     },
 236     startup => get_standard_option('pve-startup-order'),
 237     template => {
 238         optional => 1,
 239         type => 'boolean',
 240         description => "Enable/disable Template.",
 241         default => 0,
 242     },
 243     arch => {
 244         optional => 1,
 245         type => 'string',
 246         enum => ['amd64', 'i386'],
 247         description => "OS architecture type.",
 248         default => 'amd64',
 249     },
 250     ostype => {
 251         optional => 1,
 252         type => 'string',
 253         enum => ['debian', 'ubuntu', 'centos', 'fedora', 'opensuse', 'archlinux', 'alpine', 'unmanaged'],
 254         description => "OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.",
 255     },
 256     console => {
 257         optional => 1,
 258         type => 'boolean',
 259         description => "Attach a console device (/dev/console) to the container.",
 260         default => 1,
 261     },
 262     tty => {
 263         optional => 1,
 264         type => 'integer',
 265         description => "Specify the number of tty available to the container",
 266         minimum => 0,
 267         maximum => 6,
 268         default => 2,
 269     },
 270     cpulimit => {
 271         optional => 1,
 272         type => 'number',
 273         description => "Limit of CPU usage. Note if the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.",
 274         minimum => 0,
 275         maximum => 128,
 276         default => 0,
 277     },
 278     cpuunits => {
 279         optional => 1,
 280         type => 'integer',
 281         description => "CPU weight for a VM. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this VM gets. Number is relative to the weights of all the other running VMs.\n\nNOTE: You can disable fair-scheduler configuration by setting this to 0.",
 282         minimum => 0,
 283         maximum => 500000,
 284         default => 1024,
 285     },
 286     memory => {
 287         optional => 1,
 288         type => 'integer',
 289         description => "Amount of RAM for the VM in MB.",
 290         minimum => 16,
 291         default => 512,
 292     },
 293     swap => {
 294         optional => 1,
 295         type => 'integer',
 296         description => "Amount of SWAP for the VM in MB.",
 297         minimum => 0,
 298         default => 512,
 299     },
 300     hostname => {
 301         optional => 1,
 302         description => "Set a host name for the container.",
 303         type => 'string', format => 'dns-name',
 304         maxLength => 255,
 305     },
 306     description => {
 307         optional => 1,
 308         type => 'string',
 309         description => "Container description. Only used on the configuration web interface.",
 310     },
 311     searchdomain => {
 312         optional => 1,
 313         type => 'string', format => 'dns-name-list',
 314         description => "Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 315     },
 316     nameserver => {
 317         optional => 1,
 318         type => 'string', format => 'address-list',
 319         description => "Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.",
 320     },
 321     rootfs => get_standard_option('pve-ct-rootfs'),
 322     parent => {
 323         optional => 1,
 324         type => 'string', format => 'pve-configid',
 325         maxLength => 40,
 326         description => "Parent snapshot name. This is used internally, and should not be modified.",
 327     },
 328     snaptime => {
 329         optional => 1,
 330         description => "Timestamp for snapshots.",
 331         type => 'integer',
 332         minimum => 0,
 333     },
 334     cmode => {
 335         optional => 1,
 336         description => "Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).",
 337         type => 'string',
 338         enum => ['shell', 'console', 'tty'],
 339         default => 'tty',
 340     },
 341     protection => {
 342         optional => 1,
 343         type => 'boolean',
 344         description => "Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.",
 345         default => 0,
 346     },
 347     unprivileged => {
 348         optional => 1,
 349         type => 'boolean',
 350         description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
 351         default => 0,
 352     },
 353 };
 354
 355 my $valid_lxc_conf_keys = {
 356     'lxc.include' => 1,
 357     'lxc.arch' => 1,
 358     'lxc.utsname' => 1,
 359     'lxc.haltsignal' => 1,
 360     'lxc.rebootsignal' => 1,
 361     'lxc.stopsignal' => 1,
 362     'lxc.init_cmd' => 1,
 363     'lxc.network.type' => 1,
 364     'lxc.network.flags' => 1,
 365     'lxc.network.link' => 1,
 366     'lxc.network.mtu' => 1,
 367     'lxc.network.name' => 1,
 368     'lxc.network.hwaddr' => 1,
 369     'lxc.network.ipv4' => 1,
 370     'lxc.network.ipv4.gateway' => 1,
 371     'lxc.network.ipv6' => 1,
 372     'lxc.network.ipv6.gateway' => 1,
 373     'lxc.network.script.up' => 1,
 374     'lxc.network.script.down' => 1,
 375     'lxc.pts' => 1,
 376     'lxc.console.logfile' => 1,
 377     'lxc.console' => 1,
 378     'lxc.tty' => 1,
 379     'lxc.devttydir' => 1,
 380     'lxc.hook.autodev' => 1,
 381     'lxc.autodev' => 1,
 382     'lxc.kmsg' => 1,
 383     'lxc.mount' => 1,
 384     'lxc.mount.entry' => 1,
 385     'lxc.mount.auto' => 1,
 386     'lxc.rootfs' => 'lxc.rootfs is auto generated from rootfs',
 387     'lxc.rootfs.mount' => 1,
 388     'lxc.rootfs.options' => 'lxc.rootfs.options is not supported' .
 389                             ', please use mountpoint options in the "rootfs" key',
 390     # lxc.cgroup.*
 391     'lxc.cap.drop' => 1,
 392     'lxc.cap.keep' => 1,
 393     'lxc.aa_profile' => 1,
 394     'lxc.aa_allow_incomplete' => 1,
 395     'lxc.se_context' => 1,
 396     'lxc.seccomp' => 1,
 397     'lxc.id_map' => 1,
 398     'lxc.hook.pre-start' => 1,
 399     'lxc.hook.pre-mount' => 1,
 400     'lxc.hook.mount' => 1,
 401     'lxc.hook.start' => 1,
 402     'lxc.hook.stop' => 1,
 403     'lxc.hook.post-stop' => 1,
 404     'lxc.hook.clone' => 1,
 405     'lxc.hook.destroy' => 1,
 406     'lxc.loglevel' => 1,
 407     'lxc.logfile' => 1,
 408     'lxc.start.auto' => 1,
 409     'lxc.start.delay' => 1,
 410     'lxc.start.order' => 1,
 411     'lxc.group' => 1,
 412     'lxc.environment' => 1,
 413 };
 414
 415 my $netconf_desc = {
 416     type => {
 417         type => 'string',
 418         optional => 1,
 419         description => "Network interface type.",
 420         enum => [qw(veth)],
 421     },
 422     name => {
 423         type => 'string',
 424         format_description => 'String',
 425         description => 'Name of the network device as seen from inside the container. (lxc.network.name)',
 426         pattern => '[-_.\w\d]+',
 427     },
 428     bridge => {
 429         type => 'string',
 430         format_description => 'vmbr<Number>',
 431         description => 'Bridge to attach the network device to.',
 432         pattern => '[-_.\w\d]+',
 433         optional => 1,
 434     },
 435     hwaddr => {
 436         type => 'string',
 437         format_description => 'MAC',
 438         description => 'Bridge to attach the network device to. (lxc.network.hwaddr)',
 439         pattern => qr/(?:[a-f0-9]{2}:){5}[a-f0-9]{2}/i,
 440         optional => 1,
 441     },
 442     mtu => {
 443         type => 'integer',
 444         format_description => 'Number',
 445         description => 'Maximum transfer unit of the interface. (lxc.network.mtu)',
 446         minimum => 64, # minimum ethernet frame is 64 bytes
 447         optional => 1,
 448     },
 449     ip => {
 450         type => 'string',
 451         format => 'pve-ipv4-config',
 452         format_description => 'IPv4Format/CIDR',
 453         description => 'IPv4 address in CIDR format.',
 454         optional => 1,
 455     },
 456     gw => {
 457         type => 'string',
 458         format => 'ipv4',
 459         format_description => 'GatewayIPv4',
 460         description => 'Default gateway for IPv4 traffic.',
 461         optional => 1,
 462     },
 463     ip6 => {
 464         type => 'string',
 465         format => 'pve-ipv6-config',
 466         format_description => 'IPv6Format/CIDR',
 467         description => 'IPv6 address in CIDR format.',
 468         optional => 1,
 469     },
 470     gw6 => {
 471         type => 'string',
 472         format => 'ipv6',
 473         format_description => 'GatewayIPv6',
 474         description => 'Default gateway for IPv6 traffic.',
 475         optional => 1,
 476     },
 477     firewall => {
 478         type => 'boolean',
 479         format_description => '[1|0]',
 480         description => "Controls whether this interface's firewall rules should be used.",
 481         optional => 1,
 482     },
 483     tag => {
 484         type => 'integer',
 485         format_description => 'VlanNo',
 486         minimum => '2',
 487         maximum => '4094',
 488         description => "VLAN tag for this interface.",
 489         optional => 1,
 490     },
 491     trunks => {
 492         type => 'string',
 493         pattern => qr/\d+(?:;\d+)*/,
 494         format_description => 'vlanid[;vlanid...]',
 495         description => "VLAN ids to pass through the interface",
 496         optional => 1,
 497     },
 498     rate => {
 499         type => 'number',
 500         format_description => 'mbps',
 501         description => "Apply rate limiting to the interface",
 502         optional => 1,
 503     },
 504 };
 505 PVE::JSONSchema::register_format('pve-lxc-network', $netconf_desc);
 506
 507 my $MAX_LXC_NETWORKS = 10;
 508 for (my $i = 0; $i < $MAX_LXC_NETWORKS; $i++) {
 509     $confdesc->{"net$i"} = {
 510         optional => 1,
 511         type => 'string', format => $netconf_desc,
 512         description => "Specifies network interfaces for the container.",
 513     };
 514 }
 515
 516 PVE::JSONSchema::register_format('pve-lxc-mp-string', \&verify_lxc_mp_string);
 517 sub verify_lxc_mp_string {
 518     my ($mp, $noerr) = @_;
 519
 520     # do not allow:
 521     # /./ or /../
 522     # /. or /.. at the end
 523     # ../ at the beginning
 524
 525     if($mp =~ m@/\.\.?/@ ||
 526        $mp =~ m@/\.\.?$@ ||
 527        $mp =~ m@^\.\./@) {
 528         return undef if $noerr;
 529         die "$mp contains illegal character sequences\n";
 530     }
 531     return $mp;
 532 }
 533
 534 my $mp_desc = {
 535     %$rootfs_desc,
 536     mp => {
 537         type => 'string',
 538         format => 'pve-lxc-mp-string',
 539         format_description => 'Path',
 540         description => 'Path to the mountpoint as seen from inside the container.',
 541     },
 542 };
 543 PVE::JSONSchema::register_format('pve-ct-mountpoint', $mp_desc);
 544
 545 my $unuseddesc = {
 546     optional => 1,
 547     type => 'string', format => 'pve-volume-id',
 548     description => "Reference to unused volumes.",
 549 };
 550
 551 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 552     $confdesc->{"mp$i"} = {
 553         optional => 1,
 554         type => 'string', format => $mp_desc,
 555         description => "Use volume as container mount point (experimental feature).",
 556         optional => 1,
 557     };
 558 }
 559
 560 for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
 561     $confdesc->{"unused$i"} = $unuseddesc;
 562 }
 563
 564 sub parse_pct_config {
 565     my ($filename, $raw) = @_;
 566
 567     return undef if !defined($raw);
 568
 569     my $res = {
 570         digest => Digest::SHA::sha1_hex($raw),
 571         snapshots => {},
 572     };
 573
 574     $filename =~ m|/lxc/(\d+).conf$|
 575         || die "got strange filename '$filename'";
 576
 577     my $vmid = $1;
 578
 579     my $conf = $res;
 580     my $descr = '';
 581     my $section = '';
 582
 583     my @lines = split(/\n/, $raw);
 584     foreach my $line (@lines) {
 585         next if $line =~ m/^\s*$/;
 586
 587         if ($line =~ m/^\[([a-z][a-z0-9_\-]+)\]\s*$/i) {
 588             $section = $1;
 589             $conf->{description} = $descr if $descr;
 590             $descr = '';
 591             $conf = $res->{snapshots}->{$section} = {};
 592             next;
 593         }
 594
 595         if ($line =~ m/^\#(.*)\s*$/) {
 596             $descr .= PVE::Tools::decode_text($1) . "\n";
 597             next;
 598         }
 599
 600         if ($line =~ m/^(lxc\.[a-z0-9_\-\.]+)(:|\s*=)\s*(.*?)\s*$/) {
 601             my $key = $1;
 602             my $value = $3;
 603             my $validity = $valid_lxc_conf_keys->{$key} || 0;
 604             if ($validity eq 1 || $key =~ m/^lxc\.cgroup\./) {
 605                 push @{$conf->{lxc}}, [$key, $value];
 606             } elsif (my $errmsg = $validity) {
 607                 warn "vm $vmid - $key: $errmsg\n";
 608             } else {
 609                 warn "vm $vmid - unable to parse config: $line\n";
 610             }
 611         } elsif ($line =~ m/^(description):\s*(.*\S)\s*$/) {
 612             $descr .= PVE::Tools::decode_text($2);
 613         } elsif ($line =~ m/snapstate:\s*(prepare|delete)\s*$/) {
 614             $conf->{snapstate} = $1;
 615         } elsif ($line =~ m/^([a-z][a-z_]*\d*):\s*(\S.*)\s*$/) {
 616             my $key = $1;
 617             my $value = $2;
 618             eval { $value = PVE::LXC::Config->check_type($key, $value); };
 619             warn "vm $vmid - unable to parse value of '$key' - $@" if $@;
 620             $conf->{$key} = $value;
 621         } else {
 622             warn "vm $vmid - unable to parse config: $line\n";
 623         }
 624     }
 625
 626     $conf->{description} = $descr if $descr;
 627
 628     delete $res->{snapstate}; # just to be sure
 629
 630     return $res;
 631 }
 632
 633 sub write_pct_config {
 634     my ($filename, $conf) = @_;
 635
 636     delete $conf->{snapstate}; # just to be sure
 637
 638     my $volidlist = PVE::LXC::Config->get_vm_volumes($conf);
 639     my $used_volids = {};
 640     foreach my $vid (@$volidlist) {
 641         $used_volids->{$vid} = 1;
 642     }
 643
 644     # remove 'unusedX' settings if the volume is still used
 645     foreach my $key (keys %$conf) {
 646         my $value = $conf->{$key};
 647         if ($key =~ m/^unused/ && $used_volids->{$value}) {
 648             delete $conf->{$key};
 649         }
 650     }
 651
 652     my $generate_raw_config = sub {
 653         my ($conf) = @_;
 654
 655         my $raw = '';
 656
 657         # add description as comment to top of file
 658         my $descr = $conf->{description} || '';
 659         foreach my $cl (split(/\n/, $descr)) {
 660             $raw .= '#' .  PVE::Tools::encode_text($cl) . "\n";
 661         }
 662
 663         foreach my $key (sort keys %$conf) {
 664             next if $key eq 'digest' || $key eq 'description' ||
 665                     $key eq 'pending' || $key eq 'snapshots' ||
 666                     $key eq 'snapname' || $key eq 'lxc';
 667             my $value = $conf->{$key};
 668             die "detected invalid newline inside property '$key'\n"
 669                 if $value =~ m/\n/;
 670             $raw .= "$key: $value\n";
 671         }
 672
 673         if (my $lxcconf = $conf->{lxc}) {
 674             foreach my $entry (@$lxcconf) {
 675                 my ($k, $v) = @$entry;
 676                 $raw .= "$k: $v\n";
 677             }
 678         }
 679
 680         return $raw;
 681     };
 682
 683     my $raw = &$generate_raw_config($conf);
 684
 685     foreach my $snapname (sort keys %{$conf->{snapshots}}) {
 686         $raw .= "\n[$snapname]\n";
 687         $raw .= &$generate_raw_config($conf->{snapshots}->{$snapname});
 688     }
 689
 690     return $raw;
 691 }
 692
 693 sub update_pct_config {
 694     my ($class, $vmid, $conf, $running, $param, $delete) = @_;
 695
 696     my @nohotplug;
 697
 698     my $new_disks = 0;
 699     my @deleted_volumes;
 700
 701     my $rootdir;
 702     if ($running) {
 703         my $pid = PVE::LXC::find_lxc_pid($vmid);
 704         $rootdir = "/proc/$pid/root";
 705     }
 706
 707     my $hotplug_error = sub {
 708         if ($running) {
 709             push @nohotplug, @_;
 710             return 1;
 711         } else {
 712             return 0;
 713         }
 714     };
 715
 716     if (defined($delete)) {
 717         foreach my $opt (@$delete) {
 718             if (!exists($conf->{$opt})) {
 719                 warn "no such option: $opt\n";
 720                 next;
 721             }
 722
 723             if ($opt eq 'hostname' || $opt eq 'memory' || $opt eq 'rootfs') {
 724                 die "unable to delete required option '$opt'\n";
 725             } elsif ($opt eq 'swap') {
 726                 delete $conf->{$opt};
 727                 PVE::LXC::write_cgroup_value("memory", $vmid,
 728                                              "memory.memsw.limit_in_bytes", -1);
 729             } elsif ($opt eq 'description' || $opt eq 'onboot' || $opt eq 'startup') {
 730                 delete $conf->{$opt};
 731             } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' ||
 732                      $opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 733                 next if $hotplug_error->($opt);
 734                 delete $conf->{$opt};
 735             } elsif ($opt eq 'cpulimit') {
 736                 next if $hotplug_error->($opt); # FIXME: hotplug
 737                 delete $conf->{$opt};
 738             } elsif ($opt eq 'cpuunits') {
 739                 PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $confdesc->{cpuunits}->{default});
 740                 delete $conf->{$opt};
 741             } elsif ($opt =~ m/^net(\d)$/) {
 742                 delete $conf->{$opt};
 743                 next if !$running;
 744                 my $netid = $1;
 745                 PVE::Network::veth_delete("veth${vmid}i$netid");
 746             } elsif ($opt eq 'protection') {
 747                 delete $conf->{$opt};
 748             } elsif ($opt =~ m/^unused(\d+)$/) {
 749                 next if $hotplug_error->($opt);
 750                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 751                 push @deleted_volumes, $conf->{$opt};
 752                 delete $conf->{$opt};
 753             } elsif ($opt =~ m/^mp(\d+)$/) {
 754                 next if $hotplug_error->($opt);
 755                 PVE::LXC::Config->check_protection($conf, "can't remove CT $vmid drive '$opt'");
 756                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($conf->{$opt});
 757                 delete $conf->{$opt};
 758                 if ($mp->{type} eq 'volume') {
 759                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 760                 }
 761             } elsif ($opt eq 'unprivileged') {
 762                 die "unable to delete read-only option: '$opt'\n";
 763             } else {
 764                 die "implement me (delete: $opt)"
 765             }
 766             PVE::LXC::Config->write_config($vmid, $conf) if $running;
 767         }
 768     }
 769
 770     # There's no separate swap size to configure, there's memory and "total"
 771     # memory (iow. memory+swap). This means we have to change them together.
 772     my $wanted_memory = PVE::Tools::extract_param($param, 'memory');
 773     my $wanted_swap =  PVE::Tools::extract_param($param, 'swap');
 774     if (defined($wanted_memory) || defined($wanted_swap)) {
 775
 776         my $old_memory = ($conf->{memory} || 512);
 777         my $old_swap = ($conf->{swap} || 0);
 778
 779         $wanted_memory //= $old_memory;
 780         $wanted_swap //= $old_swap;
 781
 782         my $total = $wanted_memory + $wanted_swap;
 783         if ($running) {
 784             my $old_total = $old_memory + $old_swap;
 785             if ($total > $old_total) {
 786                 PVE::LXC::write_cgroup_value("memory", $vmid,
 787                                              "memory.memsw.limit_in_bytes",
 788                                              int($total*1024*1024));
 789                 PVE::LXC::write_cgroup_value("memory", $vmid,
 790                                              "memory.limit_in_bytes",
 791                                              int($wanted_memory*1024*1024));
 792             } else {
 793                 PVE::LXC::write_cgroup_value("memory", $vmid,
 794                                              "memory.limit_in_bytes",
 795                                              int($wanted_memory*1024*1024));
 796                 PVE::LXC::write_cgroup_value("memory", $vmid,
 797                                              "memory.memsw.limit_in_bytes",
 798                                              int($total*1024*1024));
 799             }
 800         }
 801         $conf->{memory} = $wanted_memory;
 802         $conf->{swap} = $wanted_swap;
 803
 804         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 805     }
 806
 807     my $used_volids = {};
 808
 809     foreach my $opt (keys %$param) {
 810         my $value = $param->{$opt};
 811         my $check_protection_msg = "can't update CT $vmid drive '$opt'";
 812         if ($opt eq 'hostname') {
 813             $conf->{$opt} = $value;
 814         } elsif ($opt eq 'onboot') {
 815             $conf->{$opt} = $value ? 1 : 0;
 816         } elsif ($opt eq 'startup') {
 817             $conf->{$opt} = $value;
 818         } elsif ($opt eq 'tty' || $opt eq 'console' || $opt eq 'cmode') {
 819             next if $hotplug_error->($opt);
 820             $conf->{$opt} = $value;
 821         } elsif ($opt eq 'nameserver') {
 822             next if $hotplug_error->($opt);
 823             my $list = PVE::LXC::verify_nameserver_list($value);
 824             $conf->{$opt} = $list;
 825         } elsif ($opt eq 'searchdomain') {
 826             next if $hotplug_error->($opt);
 827             my $list = PVE::LXC::verify_searchdomain_list($value);
 828             $conf->{$opt} = $list;
 829         } elsif ($opt eq 'cpulimit') {
 830             next if $hotplug_error->($opt); # FIXME: hotplug
 831             $conf->{$opt} = $value;
 832         } elsif ($opt eq 'cpuunits') {
 833             $conf->{$opt} = $value;
 834             PVE::LXC::write_cgroup_value("cpu", $vmid, "cpu.shares", $value);
 835         } elsif ($opt eq 'description') {
 836             $conf->{$opt} = PVE::Tools::encode_text($value);
 837         } elsif ($opt =~ m/^net(\d+)$/) {
 838             my $netid = $1;
 839             my $net = PVE::LXC::Config->parse_lxc_network($value);
 840             if (!$running) {
 841                 $conf->{$opt} = PVE::LXC::Config->print_lxc_network($net);
 842             } else {
 843                 PVE::LXC::update_net($vmid, $conf, $opt, $net, $netid, $rootdir);
 844             }
 845         } elsif ($opt eq 'protection') {
 846             $conf->{$opt} = $value ? 1 : 0;
 847         } elsif ($opt =~ m/^mp(\d+)$/) {
 848             next if $hotplug_error->($opt);
 849             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 850             my $old = $conf->{$opt};
 851             $conf->{$opt} = $value;
 852             if (defined($old)) {
 853                 my $mp = PVE::LXC::Config->parse_ct_mountpoint($old);
 854                 if ($mp->{type} eq 'volume') {
 855                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 856                 }
 857             }
 858             $new_disks = 1;
 859             my $mp = PVE::LXC::Config->parse_ct_mountpoint($value);
 860             $used_volids->{$mp->{volume}} = 1;
 861         } elsif ($opt eq 'rootfs') {
 862             next if $hotplug_error->($opt);
 863             PVE::LXC::Config->check_protection($conf, $check_protection_msg);
 864             my $old = $conf->{$opt};
 865             $conf->{$opt} = $value;
 866             if (defined($old)) {
 867                 my $mp = PVE::LXC::Config->parse_ct_rootfs($old);
 868                 if ($mp->{type} eq 'volume') {
 869                     PVE::LXC::Config->add_unused_volume($conf, $mp->{volume});
 870                 }
 871             }
 872             my $mp = PVE::LXC::Config->parse_ct_rootfs($value);
 873             $used_volids->{$mp->{volume}} = 1;
 874         } elsif ($opt eq 'unprivileged') {
 875             die "unable to modify read-only option: '$opt'\n";
 876         } elsif ($opt eq 'ostype') {
 877             next if $hotplug_error->($opt);
 878             $conf->{$opt} = $value;
 879         } else {
 880             die "implement me: $opt";
 881         }
 882         PVE::LXC::Config->write_config($vmid, $conf) if $running;
 883     }
 884
 885     # Apply deletions and creations of new volumes
 886     if (@deleted_volumes) {
 887         my $storage_cfg = PVE::Storage::config();
 888         foreach my $volume (@deleted_volumes) {
 889             next if $used_volids->{$volume}; # could have been re-added, too
 890             # also check for references in snapshots
 891             next if $class->is_volume_in_use($conf, $volume, 1);
 892             PVE::LXC::delete_mountpoint_volume($storage_cfg, $vmid, $volume);
 893         }
 894     }
 895
 896     if ($new_disks) {
 897         my $storage_cfg = PVE::Storage::config();
 898         PVE::LXC::create_disks($storage_cfg, $vmid, $conf, $conf);
 899     }
 900
 901     # This should be the last thing we do here
 902     if ($running && scalar(@nohotplug)) {
 903         die "unable to modify " . join(',', @nohotplug) . " while container is running\n";
 904     }
 905 }
 906
 907 sub check_type {
 908     my ($class, $key, $value) = @_;
 909
 910     die "unknown setting '$key'\n" if !$confdesc->{$key};
 911
 912     my $type = $confdesc->{$key}->{type};
 913
 914     if (!defined($value)) {
 915         die "got undefined value\n";
 916     }
 917
 918     if ($value =~ m/[\n\r]/) {
 919         die "property contains a line feed\n";
 920     }
 921
 922     if ($type eq 'boolean') {
 923         return 1 if ($value eq '1') || ($value =~ m/^(on|yes|true)$/i);
 924         return 0 if ($value eq '0') || ($value =~ m/^(off|no|false)$/i);
 925         die "type check ('boolean') failed - got '$value'\n";
 926     } elsif ($type eq 'integer') {
 927         return int($1) if $value =~ m/^(\d+)$/;
 928         die "type check ('integer') failed - got '$value'\n";
 929     } elsif ($type eq 'number') {
 930         return $value if $value =~ m/^(\d+)(\.\d+)?$/;
 931         die "type check ('number') failed - got '$value'\n";
 932     } elsif ($type eq 'string') {
 933         if (my $fmt = $confdesc->{$key}->{format}) {
 934             PVE::JSONSchema::check_format($fmt, $value);
 935             return $value;
 936         }
 937         return $value;
 938     } else {
 939         die "internal error"
 940     }
 941 }
 942
 943
 944 # add JSON properties for create and set function
 945 sub json_config_properties {
 946     my ($class, $prop) = @_;
 947
 948     foreach my $opt (keys %$confdesc) {
 949         next if $opt eq 'parent' || $opt eq 'snaptime';
 950         next if $prop->{$opt};
 951         $prop->{$opt} = $confdesc->{$opt};
 952     }
 953
 954     return $prop;
 955 }
 956
 957 sub __parse_ct_mountpoint_full {
 958     my ($class, $desc, $data, $noerr) = @_;
 959
 960     $data //= '';
 961
 962     my $res;
 963     eval { $res = PVE::JSONSchema::parse_property_string($desc, $data) };
 964     if ($@) {
 965         return undef if $noerr;
 966         die $@;
 967     }
 968
 969     if (defined(my $size = $res->{size})) {
 970         $size = PVE::JSONSchema::parse_size($size);
 971         if (!defined($size)) {
 972             return undef if $noerr;
 973             die "invalid size: $size\n";
 974         }
 975         $res->{size} = $size;
 976     }
 977
 978     $res->{type} = $class->classify_mountpoint($res->{volume});
 979
 980     return $res;
 981 };
 982
 983 sub parse_ct_rootfs {
 984     my ($class, $data, $noerr) = @_;
 985
 986     my $res =  $class->__parse_ct_mountpoint_full($rootfs_desc, $data, $noerr);
 987
 988     $res->{mp} = '/' if defined($res);
 989
 990     return $res;
 991 }
 992
 993 sub parse_ct_mountpoint {
 994     my ($class, $data, $noerr) = @_;
 995
 996     return $class->__parse_ct_mountpoint_full($mp_desc, $data, $noerr);
 997 }
 998
 999 sub print_ct_mountpoint {
1000     my ($class, $info, $nomp) = @_;
1001     my $skip = [ 'type' ];
1002     push @$skip, 'mp' if $nomp;
1003     return PVE::JSONSchema::print_property_string($info, $mp_desc, $skip);
1004 }
1005
1006 sub print_lxc_network {
1007     my ($class, $net) = @_;
1008     return PVE::JSONSchema::print_property_string($net, $netconf_desc);
1009 }
1010
1011 sub parse_lxc_network {
1012     my ($class, $data) = @_;
1013
1014     my $res = {};
1015
1016     return $res if !$data;
1017
1018     $res = PVE::JSONSchema::parse_property_string($netconf_desc, $data);
1019
1020     $res->{type} = 'veth';
1021     $res->{hwaddr} = PVE::Tools::random_ether_addr() if !$res->{hwaddr};
1022
1023     return $res;
1024 }
1025
1026 sub option_exists {
1027     my ($class, $name) = @_;
1028
1029     return defined($confdesc->{$name});
1030 }
1031 # END JSON config code
1032
1033 sub classify_mountpoint {
1034     my ($class, $vol) = @_;
1035     if ($vol =~ m!^/!) {
1036         return 'device' if $vol =~ m!^/dev/!;
1037         return 'bind';
1038     }
1039     return 'volume';
1040 }
1041
1042 sub is_volume_in_use {
1043     my ($class, $config, $volid, $include_snapshots) = @_;
1044     my $used = 0;
1045
1046     $class->foreach_mountpoint($config, sub {
1047         my ($ms, $mountpoint) = @_;
1048         return if $used;
1049         $used = $mountpoint->{type} eq 'volume' && $mountpoint->{volume} eq $volid;
1050     });
1051
1052     my $snapshots = $config->{snapshots};
1053     if ($include_snapshots && $snapshots) {
1054         foreach my $snap (keys %$snapshots) {
1055             $used ||= $class->is_volume_in_use($snapshots->{$snap}, $volid);
1056         }
1057     }
1058
1059     return $used;
1060 }
1061
1062 sub has_dev_console {
1063     my ($class, $conf) = @_;
1064
1065     return !(defined($conf->{console}) && !$conf->{console});
1066 }
1067
1068 sub get_tty_count {
1069     my ($class, $conf) = @_;
1070
1071     return $conf->{tty} // $confdesc->{tty}->{default};
1072 }
1073
1074 sub get_cmode {
1075     my ($class, $conf) = @_;
1076
1077     return $conf->{cmode} // $confdesc->{cmode}->{default};
1078 }
1079
1080 sub mountpoint_names {
1081     my ($class, $reverse) = @_;
1082
1083     my @names = ('rootfs');
1084
1085     for (my $i = 0; $i < $MAX_MOUNT_POINTS; $i++) {
1086         push @names, "mp$i";
1087     }
1088
1089     return $reverse ? reverse @names : @names;
1090 }
1091
1092 sub foreach_mountpoint_full {
1093     my ($class, $conf, $reverse, $func) = @_;
1094
1095     foreach my $key ($class->mountpoint_names($reverse)) {
1096         my $value = $conf->{$key};
1097         next if !defined($value);
1098         my $mountpoint = $key eq 'rootfs' ? $class->parse_ct_rootfs($value, 1) : $class->parse_ct_mountpoint($value, 1);
1099         next if !defined($mountpoint);
1100
1101         &$func($key, $mountpoint);
1102     }
1103 }
1104
1105 sub foreach_mountpoint {
1106     my ($class, $conf, $func) = @_;
1107
1108     $class->foreach_mountpoint_full($conf, 0, $func);
1109 }
1110
1111 sub foreach_mountpoint_reverse {
1112     my ($class, $conf, $func) = @_;
1113
1114     $class->foreach_mountpoint_full($conf, 1, $func);
1115 }
1116
1117 sub get_vm_volumes {
1118     my ($class, $conf, $excludes) = @_;
1119
1120     my $vollist = [];
1121
1122     $class->foreach_mountpoint($conf, sub {
1123         my ($ms, $mountpoint) = @_;
1124
1125         return if $excludes && $ms eq $excludes;
1126
1127         my $volid = $mountpoint->{volume};
1128         return if !$volid || $mountpoint->{type} ne 'volume';
1129
1130         my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
1131         return if !$sid;
1132
1133         push @$vollist, $volid;
1134     });
1135
1136     return $vollist;
1137 }
1138
1139 return 1;