PVE/API2/Network.pm

   1 package PVE::API2::Network;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Net::IP qw(:PROC);
   7 use PVE::Tools qw(extract_param);
   8 use PVE::SafeSyslog;
   9 use PVE::INotify;
  10 use PVE::Exception qw(raise_param_exc);
  11 use PVE::RESTHandler;
  12 use PVE::RPCEnvironment;
  13 use PVE::JSONSchema qw(get_standard_option);
  14 use PVE::AccessControl;
  15 use IO::File;
  16
  17 use base qw(PVE::RESTHandler);
  18
  19 my $iflockfn = "/etc/network/.pve-interfaces.lock";
  20
  21 my $bond_mode_enum = [
  22     'balance-rr',
  23     'active-backup', # OVS and Linux
  24     'balance-xor',
  25     'broadcast',
  26     '802.3ad',
  27     'balance-tlb',
  28     'balance-alb',
  29     'balance-slb', # OVS
  30     'lacp-balance-slb', # OVS
  31     'lacp-balance-tcp', # OVS
  32     ];
  33
  34 my $network_type_enum = ['bridge', 'bond', 'eth', 'alias', 'vlan',
  35                          'OVSBridge', 'OVSBond', 'OVSPort', 'OVSIntPort'];
  36
  37 my $confdesc = {
  38     type => {
  39         description => "Network interface type",
  40         type => 'string',
  41         enum => [@$network_type_enum, 'unknown'],
  42     },
  43     comments => {
  44         description => "Comments",
  45         type => 'string',
  46         optional => 1,
  47     },
  48     comments6 => {
  49         description => "Comments",
  50         type => 'string',
  51         optional => 1,
  52     },
  53     autostart => {
  54         description => "Automatically start interface on boot.",
  55         type => 'boolean',
  56         optional => 1,
  57     },
  58     bridge_vlan_aware => {
  59         description => "Enable bridge vlan support.",
  60         type => 'boolean',
  61         optional => 1,
  62     },
  63     bridge_ports => {
  64         description => "Specify the iterfaces you want to add to your bridge.",
  65         optional => 1,
  66         type => 'string', format => 'pve-iface-list',
  67     },
  68     ovs_ports => {
  69         description => "Specify the iterfaces you want to add to your bridge.",
  70         optional => 1,
  71         type => 'string', format => 'pve-iface-list',
  72     },
  73     ovs_tag => {
  74         description => "Specify a VLan tag (used by OVSPort, OVSIntPort, OVSBond)",
  75         optional => 1,
  76         type => 'integer',
  77         minimum => 1,
  78         maximum => 4094,
  79     },
  80     ovs_options => {
  81         description => "OVS interface options.",
  82         optional => 1,
  83         type => 'string',
  84         maxLength => 1024,
  85     },
  86     ovs_bridge => {
  87         description => "The OVS bridge associated with a OVS port. This is required when you create an OVS port.",
  88         optional => 1,
  89         type => 'string', format => 'pve-iface',
  90     },
  91     slaves => {
  92         description => "Specify the interfaces used by the bonding device.",
  93         optional => 1,
  94         type => 'string', format => 'pve-iface-list',
  95     },
  96     ovs_bonds => {
  97         description => "Specify the interfaces used by the bonding device.",
  98         optional => 1,
  99         type => 'string', format => 'pve-iface-list',
 100     },
 101     bond_mode => {
 102         description => "Bonding mode.",
 103         optional => 1,
 104         type => 'string', enum => $bond_mode_enum,
 105     },
 106     bond_xmit_hash_policy => {
 107         description => "Selects the transmit hash policy to use for slave selection in balance-xor and 802.3ad modes.",
 108         optional => 1,
 109         type => 'string',
 110         enum => ['layer2', 'layer2+3', 'layer3+4' ],
 111     },
 112     gateway => {
 113         description => 'Default gateway address.',
 114         type => 'string', format => 'ipv4',
 115         optional => 1,
 116     },
 117     netmask => {
 118         description => 'Network mask.',
 119         type => 'string', format => 'ipv4mask',
 120         optional => 1,
 121         requires => 'address',
 122     },
 123     address => {
 124         description => 'IP address.',
 125         type => 'string', format => 'ipv4',
 126         optional => 1,
 127         requires => 'netmask',
 128     },
 129     gateway6 => {
 130         description => 'Default ipv6 gateway address.',
 131         type => 'string', format => 'ipv6',
 132         optional => 1,
 133     },
 134     netmask6 => {
 135         description => 'Network mask.',
 136         type => 'integer', minimum => 0, maximum => 128,
 137         optional => 1,
 138         requires => 'address6',
 139     },
 140     address6 => {
 141         description => 'IP address.',
 142         type => 'string', format => 'ipv6',
 143         optional => 1,
 144         requires => 'netmask6',
 145     }
 146 };
 147
 148 sub json_config_properties {
 149     my $prop = shift;
 150
 151     foreach my $opt (keys %$confdesc) {
 152         $prop->{$opt} = $confdesc->{$opt};
 153     }
 154
 155     return $prop;
 156 }
 157
 158 __PACKAGE__->register_method({
 159     name => 'index',
 160     path => '',
 161     method => 'GET',
 162     permissions => { user => 'all' },
 163     description => "List available networks",
 164     proxyto => 'node',
 165     parameters => {
 166         additionalProperties => 0,
 167         properties => {
 168             node => get_standard_option('pve-node'),
 169             type => {
 170                 description => "Only list specific interface types.",
 171                 type => 'string',
 172                 enum => [ @$network_type_enum, 'any_bridge' ],
 173                 optional => 1,
 174             },
 175         },
 176     },
 177     returns => {
 178         type => "array",
 179         items => {
 180             type => "object",
 181             properties => {},
 182         },
 183         links => [ { rel => 'child', href => "{iface}" } ],
 184     },
 185     code => sub {
 186         my ($param) = @_;
 187
 188         my $rpcenv = PVE::RPCEnvironment::get();
 189
 190         my $tmp = PVE::INotify::read_file('interfaces', 1);
 191         my $config = $tmp->{data};
 192         my $changes = $tmp->{changes};
 193
 194         $rpcenv->set_result_attrib('changes', $changes) if $changes;
 195
 196         my $ifaces = $config->{ifaces};
 197
 198         delete $ifaces->{lo}; # do not list the loopback device
 199
 200         if ($param->{type}) {
 201             foreach my $k (keys %$ifaces) {
 202                 my $type = $ifaces->{$k}->{type};
 203                 my $match =  ($param->{type} eq $type) || (
 204                     ($param->{type} eq 'any_bridge') &&
 205                     ($type eq 'bridge' || $type eq 'OVSBridge'));
 206                 delete $ifaces->{$k} if !$match;
 207             }
 208         }
 209
 210         return PVE::RESTHandler::hash_to_array($ifaces, 'iface');
 211    }});
 212
 213 __PACKAGE__->register_method({
 214     name => 'revert_network_changes',
 215     path => '',
 216     method => 'DELETE',
 217     permissions => {
 218         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
 219     },
 220     protected => 1,
 221     description => "Revert network configuration changes.",
 222     proxyto => 'node',
 223     parameters => {
 224         additionalProperties => 0,
 225         properties => {
 226             node => get_standard_option('pve-node'),
 227         },
 228     },
 229     returns => { type => "null" },
 230     code => sub {
 231         my ($param) = @_;
 232
 233         unlink "/etc/network/interfaces.new";
 234
 235         return undef;
 236     }});
 237
 238 my $check_duplicate = sub {
 239     my ($config, $newiface, $key, $name) = @_;
 240
 241     foreach my $iface (keys %$config) {
 242         raise_param_exc({ $key => "$name already exists on interface '$iface'." })
 243             if ($newiface ne $iface) && $config->{$iface}->{$key};
 244     }
 245 };
 246
 247 my $check_duplicate_gateway = sub {
 248     my ($config, $newiface) = @_;
 249     return &$check_duplicate($config, $newiface, 'gateway', 'Default gateway');
 250 };
 251
 252 my $check_duplicate_gateway6 = sub {
 253     my ($config, $newiface) = @_;
 254     return &$check_duplicate($config, $newiface, 'gateway6', 'Default ipv6 gateway');
 255 };
 256
 257 my $check_ipv4_settings = sub {
 258     my ($address, $netmask) = @_;
 259
 260     my $binip = Net::IP::ip_iptobin($address, 4);
 261     my $binmask = Net::IP::ip_iptobin($netmask, 4);
 262     my $broadcast = Net::IP::ip_iptobin('255.255.255.255', 4);
 263     my $binhost = $binip | $binmask;
 264
 265     raise_param_exc({ address => "$address is not a valid host ip address." })
 266         if ($binhost eq $binmask) || ($binhost eq $broadcast);
 267 };
 268
 269 sub ipv6_tobin {
 270     return Net::IP::ip_iptobin(Net::IP::ip_expand_address(shift, 6), 6);
 271 }
 272
 273 my $check_ipv6_settings = sub {
 274     my ($address, $netmask) = @_;
 275
 276     raise_param_exc({ netmask => "$netmask is not a valid subnet length for ipv6" })
 277         if $netmask < 0 || $netmask > 128;
 278
 279     raise_param_exc({ address => "$address is not a valid host ip address." })
 280         if !Net::IP::ip_is_ipv6($address);
 281
 282     my $binip = ipv6_tobin($address);
 283     my $binmask = Net::IP::ip_get_mask($netmask, 6);
 284
 285     my $type = Net::IP::ip_iptypev6($binip);
 286
 287     raise_param_exc({ address => "$address is not a valid host ip address." })
 288         if ($binip eq $binmask) ||
 289            (defined($type) && $type !~ /^(?:(?:GLOBAL|(?:UNIQUE|LINK)-LOCAL)-UNICAST)$/);
 290 };
 291
 292 __PACKAGE__->register_method({
 293     name => 'create_network',
 294     path => '',
 295     method => 'POST',
 296     permissions => {
 297         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
 298     },
 299     description => "Create network device configuration",
 300     protected => 1,
 301     proxyto => 'node',
 302     parameters => {
 303         additionalProperties => 0,
 304         properties => json_config_properties({
 305             node => get_standard_option('pve-node'),
 306             iface => get_standard_option('pve-iface')}),
 307     },
 308     returns => { type => 'null' },
 309     code => sub {
 310         my ($param) = @_;
 311
 312         my $node = extract_param($param, 'node');
 313         my $iface = extract_param($param, 'iface');
 314
 315         my $code = sub {
 316             my $config = PVE::INotify::read_file('interfaces');
 317             my $ifaces = $config->{ifaces};
 318
 319             raise_param_exc({ iface => "interface already exists" })
 320                 if $ifaces->{$iface};
 321
 322             &$check_duplicate_gateway($ifaces, $iface)
 323                 if $param->{gateway};
 324             &$check_duplicate_gateway6($ifaces, $iface)
 325                 if $param->{gateway6};
 326
 327             &$check_ipv4_settings($param->{address}, $param->{netmask})
 328                 if $param->{address};
 329             &$check_ipv6_settings($param->{address6}, int($param->{netmask6}))
 330                 if $param->{address6};
 331
 332             my $families = $param->{families} = [];
 333             push @$families, 'inet'
 334                 if $param->{address} && !grep(/^inet$/, @$families);
 335             push @$families, 'inet6'
 336                 if $param->{address6} && !grep(/^inet6$/, @$families);
 337             @$families = ('inet') if !scalar(@$families);
 338
 339             $param->{method} = $param->{address} ? 'static' : 'manual';
 340             $param->{method6} = $param->{address6} ? 'static' : 'manual';
 341
 342             if ($param->{type} =~ m/^OVS/) {
 343                 -x '/usr/bin/ovs-vsctl' ||
 344                     die "Open VSwitch is not installed (need package 'openvswitch-switch')\n";
 345             }
 346
 347             if ($param->{type} eq 'OVSIntPort' || $param->{type} eq 'OVSBond') {
 348                 my $brname = $param->{ovs_bridge};
 349                 raise_param_exc({ ovs_bridge => "parameter is required" }) if !$brname;
 350                 my $br = $ifaces->{$brname};
 351                 raise_param_exc({ ovs_bridge => "bridge '$brname' does not exist" }) if !$br;
 352                 raise_param_exc({ ovs_bridge => "interface '$brname' is no OVS bridge" })
 353                     if $br->{type} ne 'OVSBridge';
 354
 355                 my @ports = split (/\s+/, $br->{ovs_ports} || '');
 356                 $br->{ovs_ports} = join(' ', @ports, $iface)
 357                     if ! grep { $_ eq $iface } @ports;
 358             }
 359
 360             $ifaces->{$iface} = $param;
 361
 362             PVE::INotify::write_file('interfaces', $config);
 363         };
 364
 365         PVE::Tools::lock_file($iflockfn, 10, $code);
 366         die $@ if $@;
 367
 368         return undef;
 369     }});
 370
 371 __PACKAGE__->register_method({
 372     name => 'update_network',
 373     path => '{iface}',
 374     method => 'PUT',
 375     permissions => {
 376         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
 377     },
 378     description => "Update network device configuration",
 379     protected => 1,
 380     proxyto => 'node',
 381     parameters => {
 382         additionalProperties => 0,
 383         properties => json_config_properties({
 384             node => get_standard_option('pve-node'),
 385             iface => get_standard_option('pve-iface'),
 386             delete => {
 387                 type => 'string', format => 'pve-configid-list',
 388                 description => "A list of settings you want to delete.",
 389                 optional => 1,
 390             }}),
 391     },
 392     returns => { type => 'null' },
 393     code => sub {
 394         my ($param) = @_;
 395
 396         my $node = extract_param($param, 'node');
 397         my $iface = extract_param($param, 'iface');
 398         my $delete = extract_param($param, 'delete');
 399
 400         my $code = sub {
 401             my $config = PVE::INotify::read_file('interfaces');
 402             my $ifaces = $config->{ifaces};
 403
 404             raise_param_exc({ iface => "interface does not exist" })
 405                 if !$ifaces->{$iface};
 406
 407             my $families = ($param->{families} ||= []);
 408             foreach my $k (PVE::Tools::split_list($delete)) {
 409                 delete $ifaces->{$iface}->{$k};
 410                 @$families = grep(!/^inet$/, @$families) if $k eq 'address';
 411                 @$families = grep(!/^inet6$/, @$families) if $k eq 'address6';
 412             }
 413
 414             &$check_duplicate_gateway($ifaces, $iface)
 415                 if $param->{gateway};
 416             &$check_duplicate_gateway6($ifaces, $iface)
 417                 if $param->{gateway6};
 418
 419             if ($param->{address}) {
 420                 &$check_ipv4_settings($param->{address}, $param->{netmask});
 421                 push @$families, 'inet' if !grep(/^inet$/, @$families);
 422             } else {
 423                 @$families = grep(!/^inet$/, @$families);
 424             }
 425             if ($param->{address6}) {
 426                 &$check_ipv6_settings($param->{address6}, int($param->{netmask6}));
 427                 push @$families, 'inet6' if !grep(/^inet6$/, @$families);
 428             } else {
 429                 @$families = grep(!/^inet6$/, @$families);
 430             }
 431             @$families = ('inet') if !scalar(@$families);
 432
 433             $param->{method} = $param->{address} ? 'static' : 'manual';
 434             $param->{method6} = $param->{address6} ? 'static' : 'manual';
 435
 436             foreach my $k (keys %$param) {
 437                 $ifaces->{$iface}->{$k} = $param->{$k};
 438             }
 439
 440             PVE::INotify::write_file('interfaces', $config);
 441         };
 442
 443         PVE::Tools::lock_file($iflockfn, 10, $code);
 444         die $@ if $@;
 445
 446         return undef;
 447     }});
 448
 449 __PACKAGE__->register_method({
 450     name => 'network_config',
 451     path => '{iface}',
 452     method => 'GET',
 453     permissions => {
 454         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
 455     },
 456     description => "Read network device configuration",
 457     proxyto => 'node',
 458     parameters => {
 459         additionalProperties => 0,
 460         properties => {
 461             node => get_standard_option('pve-node'),
 462             iface => get_standard_option('pve-iface'),
 463         },
 464     },
 465     returns => {
 466         type => "object",
 467         properties => {
 468             type => {
 469                 type => 'string',
 470             },
 471             method => {
 472                 type => 'string',
 473             },
 474         },
 475     },
 476     code => sub {
 477         my ($param) = @_;
 478
 479         my $config = PVE::INotify::read_file('interfaces');
 480         my $ifaces = $config->{ifaces};
 481
 482         raise_param_exc({ iface => "interface does not exist" })
 483             if !$ifaces->{$param->{iface}};
 484
 485         return $ifaces->{$param->{iface}};
 486    }});
 487
 488 __PACKAGE__->register_method({
 489     name => 'delete_network',
 490     path => '{iface}',
 491     method => 'DELETE',
 492     permissions => {
 493         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
 494     },
 495     description => "Delete network device configuration",
 496     protected => 1,
 497     proxyto => 'node',
 498     parameters => {
 499         additionalProperties => 0,
 500         properties => {
 501             node => get_standard_option('pve-node'),
 502             iface => get_standard_option('pve-iface'),
 503         },
 504     },
 505     returns => { type => 'null' },
 506     code => sub {
 507         my ($param) = @_;
 508
 509         my $code = sub {
 510             my $config = PVE::INotify::read_file('interfaces');
 511             my $ifaces = $config->{ifaces};
 512
 513             raise_param_exc({ iface => "interface does not exist" })
 514                 if !$ifaces->{$param->{iface}};
 515
 516             my $d = $ifaces->{$param->{iface}};
 517             if ($d->{type} eq 'OVSIntPort' || $d->{type} eq 'OVSBond') {
 518                 if (my $brname = $d->{ovs_bridge}) {
 519                     if (my $br = $ifaces->{$brname}) {
 520                         if ($br->{ovs_ports}) {
 521                             my @ports = split (/\s+/, $br->{ovs_ports});
 522                             my @new = grep { $_ ne $param->{iface} } @ports;
 523                             $br->{ovs_ports} = join(' ', @new);
 524                         }
 525                     }
 526                 }
 527             }
 528
 529             delete $ifaces->{$param->{iface}};
 530
 531             PVE::INotify::write_file('interfaces', $config);
 532         };
 533
 534         PVE::Tools::lock_file($iflockfn, 10, $code);
 535         die $@ if $@;
 536
 537         return undef;
 538     }});