use warnings;
use File::Basename;
use File::Path;
-use Data::Dumper;
+use Fcntl;
use PVE::Storage;
use PVE::LXC;
use PVE::LXC::Setup;
use PVE::VZDump::ConvertOVZ;
+use PVE::Tools;
+use POSIX;
-sub next_free_nbd_dev {
-
- for(my $i = 0;;$i++) {
- my $dev = "/dev/nbd$i";
- last if ! -b $dev;
- next if -f "/sys/block/nbd$i/pid"; # busy
- return $dev;
- }
- die "unable to find free nbd device\n";
-}
-
-sub restore_archive {
- my ($archive, $rootdir, $conf) = @_;
-
- my $userns_cmd = [];
-
-# we always use the same mapping: 'b:0:100000:65536'
-# if ($conf->{'lxc.id_map'}) {
-# $userns_cmd = ['lxc-usernsexec', '-m', 'b:0:100000:65536', '--'];
-# PVE::Tools::run_command(['chown', '-R', '100000:100000', $rootdir]);
-# }
-
- my $cmd = [@$userns_cmd, 'tar', 'xpf', $archive, '--numeric-owner', '--totals',
- '--sparse', '-C', $rootdir];
-
- push @$cmd, '--anchored';
- push @$cmd, '--exclude' , './dev/*';
-
- if ($archive eq '-') {
- print "extracting archive from STDIN\n";
- PVE::Tools::run_command($cmd, input => "<&STDIN");
- } else {
- print "extracting archive '$archive'\n";
- PVE::Tools::run_command($cmd);
- }
-
- # determine file type of /usr/bin/file itself to get guests' architecture
- $cmd = [@$userns_cmd, '/usr/bin/file', '-b', '-L', "$rootdir/usr/bin/file"];
- PVE::Tools::run_command($cmd, outfunc => sub {
- shift =~ /^ELF (\d{2}-bit)/; # safely assumes x86 linux
- my $arch_str = $1;
- $conf->{'arch'} = 'amd64'; # defaults to 64bit
- if(defined($arch_str)) {
- $conf->{'arch'} = 'i386' if $arch_str =~ /32/;
- print "Detected container architecture: $conf->{'arch'}\n";
- } else {
- print "CT architecture detection failed, falling back to amd64.\n" .
- "Edit the config in /etc/pve/nodes/{node}/lxc/{vmid}/config " .
- "to set another architecture.\n";
- }
- });
-}
+sub detect_architecture {
+ my ($rootdir) = @_;
-sub tar_archive_search_conf {
- my ($archive) = @_;
+ # see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
- die "ERROR: file '$archive' does not exist\n" if ! -f $archive;
+ my $supported_elf_machine = {
+ 0x03 => 'i386',
+ 0x3e => 'amd64',
+ 0x28 => 'armhf',
+ 0xb7 => 'arm64',
+ };
- my $pid = open(my $fh, '-|', 'tar', 'tf', $archive) ||
- die "unable to open file '$archive'\n";
+ my $elf_fn = '/bin/sh'; # '/bin/sh' is POSIX mandatory
+ my $detect_arch = sub {
+ # chroot avoids a problem where we check the binary of the host system
+ # if $elf_fn is an absolut symlink (e.g. $rootdir/bin/sh -> /bin/bash)
+ chroot($rootdir) or die "chroot '$rootdir' failed: $!\n";
+ chdir('/') or die "failed to change to root directory\n";
- my $file;
- while (defined($file = <$fh>)) {
- if ($file =~ m!^(\./etc/vzdump/(pct|vps)\.conf)$!) {
- $file = $1; # untaint
- last;
- }
- }
+ open(my $fh, "<", $elf_fn) or die "open '$elf_fn' failed: $!\n";
+ binmode($fh);
- kill 15, $pid;
- waitpid $pid, 0;
- close $fh;
+ my $length = read($fh, my $data, 20) or die "read failed: $!\n";
- die "ERROR: archive contains no configuration file\n" if !$file;
- chomp $file;
+ # 4 bytes ELF magic number and 1 byte ELF class, padding, machine
+ my ($magic, $class, undef, $machine) = unpack("A4CA12n", $data);
- return $file;
-}
+ die "'$elf_fn' does not resolve to an ELF!\n"
+ if (!defined($class) || !defined($magic) || $magic ne "\177ELF");
-sub recover_config {
- my ($archive) = @_;
+ my $arch = $supported_elf_machine->{$machine};
+ die "'$elf_fn' has unknown ELF machine '$machine'!\n"
+ if !defined($arch);
- my $conf_file = tar_archive_search_conf($archive);
-
- my $raw = '';
- my $out = sub {
- my $output = shift;
- $raw .= "$output\n";
+ return $arch;
};
- PVE::Tools::run_command(['tar', '-xpOf', $archive, $conf_file, '--occurrence'], outfunc => $out);
-
- my $conf;
- my $disksize;
-
- if ($conf_file =~ m/pct\.conf/) {
-
- $conf = PVE::LXC::parse_pct_config("/lxc/0.conf" , $raw);
-
- delete $conf->{snapshots};
- delete $conf->{template}; # restored CT is never a template
-
- if (defined($conf->{rootfs})) {
- my $rootinfo = PVE::LXC::parse_ct_mountpoint($conf->{rootfs});
- $disksize = $rootinfo->{size} if defined($rootinfo->{size});
- }
-
- } elsif ($conf_file =~ m/vps\.conf/) {
-
- ($conf, $disksize) = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
-
+ my $arch = eval { PVE::Tools::run_fork_with_timeout(5, $detect_arch) };
+ if (my $err = $@) {
+ $arch = 'amd64';
+ print "Architecture detection failed: $err\nFalling back to amd64.\n" .
+ "Use `pct set VMID --arch ARCH` to change.\n";
} else {
-
- die "internal error";
+ print "Detected container architecture: $arch\n";
}
- return wantarray ? ($conf, $disksize) : $conf;
+ return $arch;
}
-sub restore_and_configure {
- my ($vmid, $archive, $rootdir, $conf, $password, $restore) = @_;
-
- restore_archive($archive, $rootdir, $conf);
-
- if (!$restore) {
- my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
-
- PVE::LXC::write_config($vmid, $conf); # safe config (after OS detection)
- $lxc_setup->post_create_hook($password);
- } else {
- # restore: try to extract configuration from archive
-
- my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf";
- my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf";
- if (-f $pct_cfg_fn) {
- my $raw = PVE::Tools::file_get_contents($pct_cfg_fn);
- my $oldconf = PVE::LXC::parse_pct_config("/lxc/$vmid.conf", $raw);
-
- foreach my $key (keys %$oldconf) {
- next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots';
- $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
- }
-
- } elsif (-f $ovz_cfg_fn) {
- print "###########################################################\n";
- print "Converting OpenVZ configuration to LXC.\n";
- print "Please check the configuration and reconfigure the network.\n";
- print "###########################################################\n";
-
- my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn);
- my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
- foreach my $key (keys %$oldconf) {
- $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
+sub restore_archive {
+ my ($archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
+
+ my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
+ my $userns_cmd = PVE::LXC::userns_command($id_map);
+
+ my $archive_fh;
+ my $tar_input = '<&STDIN';
+ my @compression_opt;
+ if ($archive ne '-') {
+ # GNU tar refuses to autodetect this... *sigh*
+ my %compression_map = (
+ '.gz' => '-z',
+ '.bz2' => '-j',
+ '.xz' => '-J',
+ '.lzo' => '--lzop',
+ );
+ if ($archive =~ /\.tar(\.[^.]+)?$/) {
+ if (defined($1)) {
+ die "unrecognized compression format: $1\n" if !defined($compression_map{$1});
+ @compression_opt = $compression_map{$1};
}
-
} else {
- print "###########################################################\n";
- print "Backup archive does not contain any configuration\n";
- print "###########################################################\n";
+ die "file does not look like a template archive: $archive\n";
}
+ sysopen($archive_fh, $archive, O_RDONLY)
+ or die "failed to open '$archive': $!\n";
+ my $flags = $archive_fh->fcntl(Fcntl::F_GETFD(), 0);
+ $archive_fh->fcntl(Fcntl::F_SETFD(), $flags & ~(Fcntl::FD_CLOEXEC()));
+ $tar_input = '<&'.fileno($archive_fh);
}
-}
-# use new subvolume API
-sub create_rootfs_subvol {
- my ($storage_conf, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_;
+ my $cmd = [@$userns_cmd, 'tar', 'xpf', '-', @compression_opt, '--totals',
+ @PVE::Storage::Plugin::COMMON_TAR_FLAGS,
+ '-C', $rootdir];
- my $private = PVE::Storage::path($storage_conf, $volid);
- (-d $private) || die "unable to get container private dir '$private' - $!\n";
+ # skip-old-files doesn't have anything to do with time (old/new), but is
+ # simply -k (annoyingly also called --keep-old-files) without the 'treat
+ # existing files as errors' part... iow. it's bsdtar's interpretation of -k
+ # *sigh*, gnu...
+ push @$cmd, '--skip-old-files';
+ push @$cmd, '--anchored';
+ push @$cmd, '--exclude' , './dev/*';
- restore_and_configure($vmid, $archive, $private, $conf, $password, $restore);
-}
+ if (defined($bwlimit)) {
+ $cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ];
+ }
-# direct mount
-sub create_rootfs_dev {
- my ($storage_conf, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_;
+ if ($archive eq '-') {
+ print "extracting archive from STDIN\n";
+ } else {
+ print "extracting archive '$archive'\n";
+ }
+ eval { PVE::Tools::run_command($cmd, input => $tar_input); };
+ my $err = $@;
+ close($archive_fh) if defined $archive_fh;
+ die $err if $err && !$no_unpack_error;
- my $image_path = PVE::Storage::path($storage_conf, $volid);
-
- my $cmd = ['mkfs.ext4', $image_path];
- PVE::Tools::run_command($cmd);
+ # if arch is set, we do not try to autodetect it
+ return if defined($conf->{arch});
- my $mountpoint;
+ $conf->{arch} = detect_architecture($rootdir);
+}
- eval {
- my $tmp = "/var/lib/lxc/$vmid/rootfs";
- File::Path::mkpath($tmp);
- PVE::Tools::run_command(['mount', '-t', 'ext4', $image_path, $tmp]);
- $mountpoint = $tmp;
+sub recover_config {
+ my ($archive) = @_;
- restore_and_configure($vmid, $archive, $mountpoint, $conf, $password, $restore);
- };
- if (my $err = $@) {
- if ($mountpoint) {
- eval { PVE::Tools::run_command(['umount', $mountpoint]) };
- warn $@ if $@;
- }
- die $err;
- }
+ my ($raw, $conf_file) = PVE::Storage::extract_vzdump_config_tar($archive, qr!(\./etc/vzdump/(pct|vps)\.conf)$!);
+ my $conf;
+ my $mp_param = {};
- PVE::Tools::run_command(['umount', '-l', $mountpoint]);
-}
+ if ($conf_file =~ m/pct\.conf/) {
-# create a raw file, then loop mount
-sub create_rootfs_dir_loop {
- my ($storage_conf, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_;
+ $conf = PVE::LXC::Config::parse_pct_config("/lxc/0.conf" , $raw);
- my $image_path = PVE::Storage::path($storage_conf, $volid);
+ delete $conf->{snapshots};
- my $cmd = ['mkfs.ext4', $image_path];
- PVE::Tools::run_command($cmd);
+ PVE::LXC::Config->foreach_mountpoint($conf, sub {
+ my ($ms, $mountpoint) = @_;
+ $mp_param->{$ms} = $conf->{$ms};
+ });
- my $mountpoint;
+ } elsif ($conf_file =~ m/vps\.conf/) {
- my $loopdev;
- eval {
- my $parser = sub {
- my $line = shift;
- $loopdev = $line if $line =~m|^/dev/loop\d+$|;
- };
- PVE::Tools::run_command(['losetup', '--find', '--show', $image_path], outfunc => $parser);
+ ($conf, $mp_param) = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
- my $tmp = "/var/lib/lxc/$vmid/rootfs";
- File::Path::mkpath($tmp);
- PVE::Tools::run_command(['mount', '-t', 'ext4', $loopdev, $tmp]);
- $mountpoint = $tmp;
+ } else {
- restore_and_configure($vmid, $archive, $mountpoint, $conf, $password, $restore);
- };
- if (my $err = $@) {
- if ($mountpoint) {
- eval { PVE::Tools::run_command(['umount', '-d', $mountpoint]) };
- warn $@ if $@;
- } else {
- eval { PVE::Tools::run_command(['losetup', '-d', $loopdev]) if $loopdev; };
- warn $@ if $@;
- }
- die $err;
+ die "internal error";
}
- PVE::Tools::run_command(['umount', '-l', '-d', $mountpoint]);
+ return wantarray ? ($conf, $mp_param) : $conf;
}
-sub create_rootfs {
- my ($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore) = @_;
-
- my $config_fn = PVE::LXC::config_file($vmid);
- if (-f $config_fn) {
- die "container exists" if !$restore; # just to be sure
-
- my $old_conf = PVE::LXC::load_config($vmid);
-
- # destroy old container volume
- PVE::LXC::destory_lxc_container($storage_cfg, $vmid, $old_conf);
+sub restore_configuration {
+ my ($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
+
+ # restore: try to extract configuration from archive
+
+ my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf";
+ my $pct_fwcfg_fn = "$rootdir/etc/vzdump/pct.fw";
+ my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf";
+ if (-f $pct_cfg_fn) {
+ my $raw = PVE::Tools::file_get_contents($pct_cfg_fn);
+ my $oldconf = PVE::LXC::Config::parse_pct_config("/lxc/$vmid.conf", $raw);
+
+ foreach my $key (keys %$oldconf) {
+ next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots' || $key eq 'unprivileged' || $key eq 'parent';
+ next if $key =~ /^mp\d+$/; # don't recover mountpoints
+ next if $key =~ /^unused\d+$/; # don't recover unused disks
+ # we know if it was a template in the restore API call and check if the target
+ # storage supports creating a template there
+ next if $key =~ /^template$/;
+
+ if ($key eq 'lxc') {
+ my $lxc_list = $oldconf->{'lxc'};
+ if ($restricted) {
+ warn "skipping custom lxc options, restore manually as root:\n";
+ warn "--------------------------------\n";
+ foreach my $lxc_opt (@$lxc_list) {
+ warn "$lxc_opt->[0]: $lxc_opt->[1]\n"
+ }
+ warn "--------------------------------\n";
+ } else {
+ @{$conf->{$key}} = (@$lxc_list, @{$conf->{$key}});
+ }
+ next;
+ }
- # do not copy all settings to restored container
- foreach my $opt (qw(rootfs digest snapshots)) {
- delete $old_conf->{$opt};
+ if ($unique && $key =~ /^net\d+$/) {
+ my $net = PVE::LXC::Config->parse_lxc_network($oldconf->{$key});
+ my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
+ $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
+ $conf->{$key} = PVE::LXC::Config->print_lxc_network($net);
+ next;
+ }
+ $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
+ }
+ unlink($pct_cfg_fn);
+
+ # note: this file is possibly from the container itself in backups
+ # created prior to pve-container 2.0-40 (PVE 5.x) / 3.0-5 (PVE 6.x)
+ # only copy non-empty, non-symlink files, and only if the user is
+ # allowed to modify the firewall config anyways
+ if (-f $pct_fwcfg_fn && ! -l $pct_fwcfg_fn && -s $pct_fwcfg_fn) {
+ my $pve_firewall_dir = '/etc/pve/firewall';
+ my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
+ if ($skip_fw) {
+ warn "ignoring firewall config from backup archive's '$pct_fwcfg_fn', lacking API permission to modify firewall.\n";
+ warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
+ if -e $pct_fwcfg_target;
+ } else {
+ mkdir $pve_firewall_dir; # make sure the directory exists
+ PVE::Tools::file_copy($pct_fwcfg_fn, $pct_fwcfg_target);
+ }
+ unlink $pct_fwcfg_fn;
}
- PVE::LXC::update_pct_config($vmid, $conf, 0, $old_conf);
-
- PVE::LXC::create_config($vmid, $conf);
- } else {
-
- PVE::LXC::create_config($vmid, $conf);
- }
+ } elsif (-f $ovz_cfg_fn) {
+ print "###########################################################\n";
+ print "Converting OpenVZ configuration to LXC.\n";
+ print "Please check the configuration and reconfigure the network.\n";
+ print "###########################################################\n";
- my ($vtype, undef, undef, undef, undef, $isBase, $format) =
- PVE::Storage::parse_volname($storage_cfg, $volid);
-
- die "got strange vtype '$vtype'\n" if $vtype ne 'images';
-
- die "unable to install into base volume" if $isBase;
-
- if ($format eq 'subvol') {
- create_rootfs_subvol($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore);
- } elsif ($format eq 'raw') {
- my $scfg = PVE::Storage::storage_config($storage_cfg, $storage);
- PVE::Storage::activate_storage($storage_cfg, $storage);
- PVE::Storage::activate_volumes($storage_cfg, [$volid]);
- if ($scfg->{path}) {
- create_rootfs_dir_loop($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore);
- } elsif ($scfg->{type} eq 'drbd' || $scfg->{type} eq 'rbd') {
- create_rootfs_dev($storage_cfg, $storage, $volid, $vmid, $conf, $archive, $password, $restore);
- } else {
- die "unable to create containers on storage type '$scfg->{type}'\n";
+ my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
+ $conf->{ostype} = $lxc_setup->{conf}->{ostype};
+ my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn);
+ my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
+ foreach my $key (keys %$oldconf) {
+ $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
}
- PVE::Storage::deactivate_volumes($storage_cfg, [$volid]);
+ unlink($ovz_cfg_fn);
+
} else {
- die "unsupported image format '$format'\n";
+ print "###########################################################\n";
+ print "Backup archive does not contain any configuration\n";
+ print "###########################################################\n";
}
}