PVE/API2/Nodes.pm

   1 package PVE::API2::Nodes::Nodeinfo;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Digest::MD5;
   7 use Digest::SHA;
   8 use Filesys::Df;
   9 use HTTP::Status qw(:constants);
  10 use JSON;
  11 use POSIX qw(LONG_MAX);
  12 use Time::Local qw(timegm_nocheck);
  13 use Socket;
  14 use IO::Socket::SSL;
  15
  16 use PVE::API2Tools;
  17 use PVE::APLInfo;
  18 use PVE::AccessControl;
  19 use PVE::Cluster qw(cfs_read_file);
  20 use PVE::DataCenterConfig;
  21 use PVE::Exception qw(raise raise_perm_exc raise_param_exc);
  22 use PVE::Firewall;
  23 use PVE::HA::Config;
  24 use PVE::HA::Env::PVE2;
  25 use PVE::INotify;
  26 use PVE::JSONSchema qw(get_standard_option);
  27 use PVE::LXC;
  28 use PVE::NodeConfig;
  29 use PVE::ProcFSTools;
  30 use PVE::QemuConfig;
  31 use PVE::QemuServer;
  32 use PVE::RESTEnvironment qw(log_warn);
  33 use PVE::RESTHandler;
  34 use PVE::RPCEnvironment;
  35 use PVE::RRD;
  36 use PVE::Report;
  37 use PVE::SafeSyslog;
  38 use PVE::Storage;
  39 use PVE::Tools qw(file_get_contents);
  40 use PVE::pvecfg;
  41
  42 use PVE::API2::APT;
  43 use PVE::API2::Capabilities;
  44 use PVE::API2::Ceph;
  45 use PVE::API2::Certificates;
  46 use PVE::API2::Disks;
  47 use PVE::API2::Firewall::Host;
  48 use PVE::API2::Hardware;
  49 use PVE::API2::LXC::Status;
  50 use PVE::API2::LXC;
  51 use PVE::API2::Network;
  52 use PVE::API2::NodeConfig;
  53 use PVE::API2::Qemu::CPU;
  54 use PVE::API2::Qemu;
  55 use PVE::API2::Replication;
  56 use PVE::API2::Services;
  57 use PVE::API2::Storage::Scan;
  58 use PVE::API2::Storage::Status;
  59 use PVE::API2::Subscription;
  60 use PVE::API2::Tasks;
  61 use PVE::API2::VZDump;
  62
  63 my $have_sdn;
  64 eval {
  65     require PVE::API2::Network::SDN::Zones::Status;
  66     $have_sdn = 1;
  67 };
  68
  69 use base qw(PVE::RESTHandler);
  70
  71 my $verify_command_item_desc = {
  72     description => "An array of objects describing endpoints, methods and arguments.",
  73     type => "array",
  74     items => {
  75         type => "object",
  76         properties => {
  77             path => {
  78                 description => "A relative path to an API endpoint on this node.",
  79                 type => "string",
  80                 optional => 0,
  81             },
  82             method => {
  83                 description => "A method related to the API endpoint (GET, POST etc.).",
  84                 type => "string",
  85                 pattern => "(GET|POST|PUT|DELETE)",
  86                 optional => 0,
  87             },
  88             args => {
  89                 description => "A set of parameter names and their values.",
  90                 type => "object",
  91                 optional => 1,
  92             },
  93         },
  94     }
  95 };
  96
  97 PVE::JSONSchema::register_format('pve-command-batch', \&verify_command_batch);
  98 sub verify_command_batch {
  99     my ($value, $noerr) = @_;
 100     my $commands = eval { decode_json($value); };
 101
 102     return if $noerr && $@;
 103     die "commands param did not contain valid JSON: $@" if $@;
 104
 105     eval { PVE::JSONSchema::validate($commands, $verify_command_item_desc) };
 106
 107     return $commands if !$@;
 108
 109     return if $noerr;
 110     die "commands is not a valid array of commands: $@";
 111 }
 112
 113 __PACKAGE__->register_method ({
 114     subclass => "PVE::API2::Qemu",
 115     path => 'qemu',
 116 });
 117
 118 __PACKAGE__->register_method ({
 119     subclass => "PVE::API2::LXC",
 120     path => 'lxc',
 121 });
 122
 123 __PACKAGE__->register_method ({
 124     subclass => "PVE::API2::Ceph",
 125     path => 'ceph',
 126 });
 127
 128 __PACKAGE__->register_method ({
 129     subclass => "PVE::API2::VZDump",
 130     path => 'vzdump',
 131 });
 132
 133 __PACKAGE__->register_method ({
 134     subclass => "PVE::API2::Services",
 135     path => 'services',
 136 });
 137
 138 __PACKAGE__->register_method ({
 139     subclass => "PVE::API2::Subscription",
 140     path => 'subscription',
 141 });
 142
 143 __PACKAGE__->register_method ({
 144     subclass => "PVE::API2::Network",
 145     path => 'network',
 146 });
 147
 148 __PACKAGE__->register_method ({
 149     subclass => "PVE::API2::Tasks",
 150     path => 'tasks',
 151 });
 152
 153 __PACKAGE__->register_method ({
 154     subclass => "PVE::API2::Storage::Scan",
 155     path => 'scan',
 156 });
 157
 158 __PACKAGE__->register_method ({
 159     subclass => "PVE::API2::Hardware",
 160     path => 'hardware',
 161 });
 162
 163 __PACKAGE__->register_method ({
 164     subclass => "PVE::API2::Capabilities",
 165     path => 'capabilities',
 166 });
 167
 168 __PACKAGE__->register_method ({
 169     subclass => "PVE::API2::Storage::Status",
 170     path => 'storage',
 171 });
 172
 173 __PACKAGE__->register_method ({
 174    subclass => "PVE::API2::Disks",
 175    path => 'disks',
 176 });
 177
 178 __PACKAGE__->register_method ({
 179     subclass => "PVE::API2::APT",
 180     path => 'apt',
 181 });
 182
 183 __PACKAGE__->register_method ({
 184     subclass => "PVE::API2::Firewall::Host",
 185     path => 'firewall',
 186 });
 187
 188 __PACKAGE__->register_method ({
 189     subclass => "PVE::API2::Replication",
 190     path => 'replication',
 191 });
 192
 193 __PACKAGE__->register_method ({
 194     subclass => "PVE::API2::Certificates",
 195     path => 'certificates',
 196 });
 197
 198
 199 __PACKAGE__->register_method ({
 200     subclass => "PVE::API2::NodeConfig",
 201     path => 'config',
 202 });
 203
 204 if ($have_sdn) {
 205     __PACKAGE__->register_method ({
 206         subclass => "PVE::API2::Network::SDN::Zones::Status",
 207         path => 'sdn/zones',
 208     });
 209
 210 __PACKAGE__->register_method ({
 211     name => 'sdnindex',
 212     path => 'sdn',
 213     method => 'GET',
 214     permissions => { user => 'all' },
 215     description => "SDN index.",
 216     parameters => {
 217         additionalProperties => 0,
 218         properties => {
 219             node => get_standard_option('pve-node'),
 220         },
 221     },
 222     returns => {
 223         type => 'array',
 224         items => {
 225             type => "object",
 226             properties => {},
 227         },
 228         links => [ { rel => 'child', href => "{name}" } ],
 229     },
 230     code => sub {
 231         my ($param) = @_;
 232
 233         my $result = [
 234             { name => 'zones' },
 235         ];
 236         return $result;
 237     }});
 238 }
 239
 240 __PACKAGE__->register_method ({
 241     name => 'index',
 242     path => '',
 243     method => 'GET',
 244     permissions => { user => 'all' },
 245     description => "Node index.",
 246     parameters => {
 247         additionalProperties => 0,
 248         properties => {
 249             node => get_standard_option('pve-node'),
 250         },
 251     },
 252     returns => {
 253         type => 'array',
 254         items => {
 255             type => "object",
 256             properties => {},
 257         },
 258         links => [ { rel => 'child', href => "{name}" } ],
 259     },
 260     code => sub {
 261         my ($param) = @_;
 262
 263         my $result = [
 264             { name => 'aplinfo' },
 265             { name => 'apt' },
 266             { name => 'capabilities' },
 267             { name => 'ceph' },
 268             { name => 'certificates' },
 269             { name => 'config' },
 270             { name => 'disks' },
 271             { name => 'dns' },
 272             { name => 'firewall' },
 273             { name => 'hardware' },
 274             { name => 'hosts' },
 275             { name => 'journal' },
 276             { name => 'lxc' },
 277             { name => 'migrateall' },
 278             { name => 'netstat' },
 279             { name => 'network' },
 280             { name => 'qemu' },
 281             { name => 'query-url-metadata' },
 282             { name => 'replication' },
 283             { name => 'report' },
 284             { name => 'rrd' }, # fixme: remove?
 285             { name => 'rrddata' },# fixme: remove?
 286             { name => 'scan' },
 287             { name => 'services' },
 288             { name => 'spiceshell' },
 289             { name => 'startall' },
 290             { name => 'status' },
 291             { name => 'stopall' },
 292             { name => 'storage' },
 293             { name => 'subscription' },
 294             { name => 'suspendall' },
 295             { name => 'syslog' },
 296             { name => 'tasks' },
 297             { name => 'termproxy' },
 298             { name => 'time' },
 299             { name => 'version' },
 300             { name => 'vncshell' },
 301             { name => 'vzdump' },
 302             { name => 'wakeonlan' },
 303         ];
 304
 305         push @$result, { name => 'sdn' } if $have_sdn;
 306
 307         return $result;
 308     }});
 309
 310 __PACKAGE__->register_method ({
 311     name => 'version',
 312     path => 'version',
 313     method => 'GET',
 314     proxyto => 'node',
 315     permissions => { user => 'all' },
 316     description => "API version details",
 317     parameters => {
 318         additionalProperties => 0,
 319         properties => {
 320             node => get_standard_option('pve-node'),
 321         },
 322     },
 323     returns => {
 324         type => "object",
 325         properties => {
 326             version => {
 327                 type => 'string',
 328                 description => 'The current installed pve-manager package version',
 329             },
 330             release => {
 331                 type => 'string',
 332                 description => 'The current installed Proxmox VE Release',
 333             },
 334             repoid => {
 335                 type => 'string',
 336                 description => 'The short git commit hash ID from which this version was build',
 337             },
 338         },
 339     },
 340     code => sub {
 341         my ($resp, $param) = @_;
 342
 343         return PVE::pvecfg::version_info();
 344     }});
 345
 346 my sub get_current_kernel_info {
 347     my ($sysname, $nodename, $release, $version, $machine) = POSIX::uname();
 348
 349     my $kernel_version_string = "$sysname $release $version"; # for legacy compat
 350     my $current_kernel = {
 351         sysname => $sysname,
 352         release => $release,
 353         version => $version,
 354         machine => $machine,
 355     };
 356     return ($current_kernel, $kernel_version_string);
 357 }
 358
 359 my $boot_mode_info_cache;
 360 my sub get_boot_mode_info {
 361     return $boot_mode_info_cache if defined($boot_mode_info_cache);
 362
 363     my $is_efi_booted = -d "/sys/firmware/efi";
 364
 365     $boot_mode_info_cache = {
 366         mode => $is_efi_booted ? 'efi' : 'legacy-bios',
 367     };
 368
 369     my $efi_var = "/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c";
 370
 371     if ($is_efi_booted && -e $efi_var) {
 372         my $efi_var_sec_boot_entry = eval { file_get_contents($efi_var) };
 373         if ($@) {
 374             warn "Failed to read secure boot state: $@\n";
 375         } else {
 376             my @secureboot = unpack("CCCCC", $efi_var_sec_boot_entry);
 377             $boot_mode_info_cache->{secureboot} = $secureboot[4] == 1 ? 1 : 0;
 378         }
 379     }
 380     return $boot_mode_info_cache;
 381 }
 382
 383 __PACKAGE__->register_method({
 384     name => 'status',
 385     path => 'status',
 386     method => 'GET',
 387     permissions => {
 388         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
 389     },
 390     description => "Read node status",
 391     proxyto => 'node',
 392     parameters => {
 393         additionalProperties => 0,
 394         properties => {
 395             node => get_standard_option('pve-node'),
 396         },
 397     },
 398     returns => {
 399         type => "object",
 400         additionalProperties => 1,
 401         properties => {
 402             # TODO: document remaing ones
 403             'boot-info' => {
 404                 description => "Meta-information about the boot mode.",
 405                 type => 'object',
 406                 properties => {
 407                     mode => {
 408                         description => 'Through which firmware the system got booted.',
 409                         type => 'string',
 410                         enum => [qw(efi legacy-bios)],
 411                     },
 412                     secureboot => {
 413                         description => 'System is booted in secure mode, only applicable for the "efi" mode.',
 414                         type => 'boolean',
 415                         optional => 1,
 416                     },
 417                 },
 418             },
 419             'current-kernel' => {
 420                 description => "The uptime of the system in seconds.",
 421                 type => 'object',
 422                 properties => {
 423                     sysname => {
 424                         description => 'OS kernel name (e.g., "Linux")',
 425                         type => 'string',
 426                     },
 427                     release => {
 428                         description => 'OS kernel release (e.g., "6.8.0")',
 429                         type => 'string',
 430                     },
 431                     version => {
 432                         description => 'OS kernel version with build info',
 433                         type => 'string',
 434                     },
 435                     machine => {
 436                         description => 'Hardware (architecture) type',
 437                         type => 'string',
 438                     },
 439                 },
 440             },
 441         },
 442     },
 443     code => sub {
 444         my ($param) = @_;
 445
 446         my $res = {
 447             uptime => 0,
 448             idle => 0,
 449         };
 450
 451         my ($uptime, $idle) = PVE::ProcFSTools::read_proc_uptime();
 452         $res->{uptime} = $uptime;
 453
 454         my ($avg1, $avg5, $avg15) = PVE::ProcFSTools::read_loadavg();
 455         $res->{loadavg} = [ $avg1, $avg5, $avg15];
 456
 457         my ($current_kernel_info, $kversion_string) = get_current_kernel_info();
 458         $res->{kversion} = $kversion_string;
 459         $res->{'current-kernel'} = $current_kernel_info;
 460
 461         $res->{'boot-info'} = get_boot_mode_info();
 462
 463         $res->{cpuinfo} = PVE::ProcFSTools::read_cpuinfo();
 464
 465         my $stat = PVE::ProcFSTools::read_proc_stat();
 466         $res->{cpu} = $stat->{cpu};
 467         $res->{wait} = $stat->{wait};
 468
 469         my $meminfo = PVE::ProcFSTools::read_meminfo();
 470         $res->{memory} = {
 471             free => $meminfo->{memfree},
 472             total => $meminfo->{memtotal},
 473             used => $meminfo->{memused},
 474         };
 475
 476         $res->{ksm} = {
 477             shared => $meminfo->{memshared},
 478         };
 479
 480         $res->{swap} = {
 481             free => $meminfo->{swapfree},
 482             total => $meminfo->{swaptotal},
 483             used => $meminfo->{swapused},
 484         };
 485
 486         $res->{pveversion} = PVE::pvecfg::package() . "/" .
 487             PVE::pvecfg::version_text();
 488
 489         my $dinfo = df('/', 1);     # output is bytes
 490
 491         $res->{rootfs} = {
 492             total => $dinfo->{blocks},
 493             avail => $dinfo->{bavail},
 494             used => $dinfo->{used},
 495             free => $dinfo->{blocks} - $dinfo->{used},
 496         };
 497
 498         return $res;
 499     }});
 500
 501 __PACKAGE__->register_method({
 502     name => 'netstat',
 503     path => 'netstat',
 504     method => 'GET',
 505     permissions => {
 506         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
 507     },
 508     description => "Read tap/vm network device interface counters",
 509     proxyto => 'node',
 510     parameters => {
 511         additionalProperties => 0,
 512         properties => {
 513             node => get_standard_option('pve-node'),
 514         },
 515     },
 516     returns => {
 517         type => "array",
 518         items => {
 519             type => "object",
 520             properties => {},
 521         },
 522     },
 523     code => sub {
 524         my ($param) = @_;
 525
 526         my $res = [ ];
 527
 528         my $netdev = PVE::ProcFSTools::read_proc_net_dev();
 529         foreach my $dev (sort keys %$netdev) {
 530             next if $dev !~ m/^(?:tap|veth)([1-9]\d*)i(\d+)$/;
 531             my ($vmid, $netid) = ($1, $2);
 532
 533             push @$res, {
 534                 vmid => $vmid,
 535                 dev  => "net$netid",
 536                 in   => $netdev->{$dev}->{transmit},
 537                 out  => $netdev->{$dev}->{receive},
 538             };
 539         }
 540
 541         return $res;
 542     }});
 543
 544 __PACKAGE__->register_method({
 545     name => 'execute',
 546     path => 'execute',
 547     method => 'POST',
 548     description => "Execute multiple commands in order, root only.",
 549     proxyto => 'node',
 550     protected => 1, # avoid problems with proxy code
 551     parameters => {
 552         additionalProperties => 0,
 553         properties => {
 554             node => get_standard_option('pve-node'),
 555             commands => {
 556                 description => "JSON encoded array of commands.",
 557                 type => "string",
 558                 verbose_description => "JSON encoded array of commands, where each command is an object with the following properties:\n"
 559                  . PVE::RESTHandler::dump_properties($verify_command_item_desc->{items}->{properties}, 'full'),
 560                 format => "pve-command-batch",
 561             }
 562         },
 563     },
 564     returns => {
 565         type => 'array',
 566         items => {
 567             type => "object",
 568             properties => {},
 569         },
 570     },
 571     code => sub {
 572         my ($param) = @_;
 573         my $res = [];
 574
 575         my $rpcenv = PVE::RPCEnvironment::get();
 576         my $user = $rpcenv->get_user();
 577         # just parse the json again, it should already be validated
 578         my $commands = eval { decode_json($param->{commands}); };
 579
 580         foreach my $cmd (@$commands) {
 581             eval {
 582                 $cmd->{args} //= {};
 583
 584                 my $path = "nodes/$param->{node}/$cmd->{path}";
 585
 586                 my $uri_param = {};
 587                 my ($handler, $info) = PVE::API2->find_handler($cmd->{method}, $path, $uri_param);
 588                 if (!$handler || !$info) {
 589                     die "no handler for '$path'\n";
 590                 }
 591
 592                 foreach my $p (keys %{$cmd->{args}}) {
 593                     raise_param_exc({ $p => "duplicate parameter" }) if defined($uri_param->{$p});
 594                     $uri_param->{$p} = $cmd->{args}->{$p};
 595                 }
 596
 597                 # check access permissions
 598                 $rpcenv->check_api2_permissions($info->{permissions}, $user, $uri_param);
 599
 600                 push @$res, {
 601                     status => HTTP_OK,
 602                     data => $handler->handle($info, $uri_param),
 603                 };
 604             };
 605             if (my $err = $@) {
 606                 my $resp = { status => HTTP_INTERNAL_SERVER_ERROR };
 607                 if (ref($err) eq "PVE::Exception") {
 608                     $resp->{status} = $err->{code} if $err->{code};
 609                     $resp->{errors} = $err->{errors} if $err->{errors};
 610                     $resp->{message} = $err->{msg};
 611                 } else {
 612                     $resp->{message} = $err;
 613                 }
 614                 push @$res, $resp;
 615             }
 616         }
 617
 618         return $res;
 619     }});
 620
 621
 622 __PACKAGE__->register_method({
 623     name => 'node_cmd',
 624     path => 'status',
 625     method => 'POST',
 626     permissions => {
 627         check => ['perm', '/nodes/{node}', [ 'Sys.PowerMgmt' ]],
 628     },
 629     protected => 1,
 630     description => "Reboot or shutdown a node.",
 631     proxyto => 'node',
 632     parameters => {
 633         additionalProperties => 0,
 634         properties => {
 635             node => get_standard_option('pve-node'),
 636             command => {
 637                 description => "Specify the command.",
 638                 type => 'string',
 639                 enum => [qw(reboot shutdown)],
 640             },
 641         },
 642     },
 643     returns => { type => "null" },
 644     code => sub {
 645         my ($param) = @_;
 646
 647         if ($param->{command} eq 'reboot') {
 648             system ("(sleep 2;/sbin/reboot)&");
 649         } elsif ($param->{command} eq 'shutdown') {
 650             system ("(sleep 2;/sbin/poweroff)&");
 651         }
 652
 653         return;
 654     }});
 655
 656 __PACKAGE__->register_method({
 657     name => 'wakeonlan',
 658     path => 'wakeonlan',
 659     method => 'POST',
 660     permissions => {
 661         check => ['perm', '/nodes/{node}', [ 'Sys.PowerMgmt' ]],
 662     },
 663     protected => 1,
 664     description => "Try to wake a node via 'wake on LAN' network packet.",
 665     parameters => {
 666         additionalProperties => 0,
 667         properties => {
 668             node => get_standard_option('pve-node', {
 669                 description => 'target node for wake on LAN packet',
 670                 completion => sub {
 671                     my $members = PVE::Cluster::get_members();
 672                     return [ grep { !$members->{$_}->{online} } keys %$members ];
 673                 }
 674             }),
 675         },
 676     },
 677     returns => {
 678         type => 'string',
 679         format => 'mac-addr',
 680         description => 'MAC address used to assemble the WoL magic packet.',
 681     },
 682     code => sub {
 683         my ($param) = @_;
 684
 685         my $node = $param->{node};
 686         my $local_node = PVE::INotify::nodename();
 687
 688         die "'$node' is local node, cannot wake my self!\n"
 689             if $node eq 'localhost' || $node eq $local_node;
 690
 691         PVE::Cluster::check_node_exists($node);
 692
 693         my $config = PVE::NodeConfig::load_config($node);
 694         my $wol_config = PVE::NodeConfig::get_wakeonlan_config($config);
 695         my $mac_addr = $wol_config->{mac};
 696         if (!defined($mac_addr)) {
 697             die "No wake on LAN MAC address defined for '$node'!\n";
 698         }
 699
 700         my $local_config = PVE::NodeConfig::load_config($local_node);
 701         my $local_wol_config = PVE::NodeConfig::get_wakeonlan_config($local_config);
 702         my $broadcast_addr = $local_wol_config->{'broadcast-address'} // '255.255.255.255';
 703
 704         $mac_addr =~ s/://g;
 705         my $packet = chr(0xff) x 6 . pack('H*', $mac_addr) x 16;
 706
 707         my $addr = gethostbyname($broadcast_addr);
 708         my $port = getservbyname('discard', 'udp');
 709         my $to = Socket::pack_sockaddr_in($port, $addr);
 710
 711         socket(my $sock, Socket::AF_INET, Socket::SOCK_DGRAM, Socket::IPPROTO_UDP)
 712             || die "Unable to open socket: $!\n";
 713         setsockopt($sock, Socket::SOL_SOCKET, Socket::SO_BROADCAST, 1)
 714             || die "Unable to set socket option: $!\n";
 715
 716         if (defined(my $bind_iface = $local_wol_config->{'bind-interface'})) {
 717             my $bind_iface_raw = pack('Z*', $bind_iface); # Null terminated interface name
 718             setsockopt($sock, Socket::SOL_SOCKET, Socket::SO_BINDTODEVICE, $bind_iface_raw)
 719                 || die "Unable to bind socket to interface '$bind_iface': $!\n";
 720         }
 721
 722         send($sock, $packet, 0, $to)
 723             || die "Unable to send packet: $!\n";
 724
 725         close($sock);
 726
 727         return $wol_config->{mac};
 728     }});
 729
 730 __PACKAGE__->register_method({
 731     name => 'rrd',
 732     path => 'rrd',
 733     method => 'GET',
 734     protected => 1, # fixme: can we avoid that?
 735     permissions => {
 736         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
 737     },
 738     description => "Read node RRD statistics (returns PNG)",
 739     parameters => {
 740         additionalProperties => 0,
 741         properties => {
 742             node => get_standard_option('pve-node'),
 743             timeframe => {
 744                 description => "Specify the time frame you are interested in.",
 745                 type => 'string',
 746                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 747             },
 748             ds => {
 749                 description => "The list of datasources you want to display.",
 750                 type => 'string', format => 'pve-configid-list',
 751             },
 752             cf => {
 753                 description => "The RRD consolidation function",
 754                 type => 'string',
 755                 enum => [ 'AVERAGE', 'MAX' ],
 756                 optional => 1,
 757             },
 758         },
 759     },
 760     returns => {
 761         type => "object",
 762         properties => {
 763             filename => { type => 'string' },
 764         },
 765     },
 766     code => sub {
 767         my ($param) = @_;
 768
 769         return PVE::RRD::create_rrd_graph(
 770             "pve2-node/$param->{node}", $param->{timeframe},
 771             $param->{ds}, $param->{cf});
 772
 773     }});
 774
 775 __PACKAGE__->register_method({
 776     name => 'rrddata',
 777     path => 'rrddata',
 778     method => 'GET',
 779     protected => 1, # fixme: can we avoid that?
 780     permissions => {
 781         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
 782     },
 783     description => "Read node RRD statistics",
 784     parameters => {
 785         additionalProperties => 0,
 786         properties => {
 787             node => get_standard_option('pve-node'),
 788             timeframe => {
 789                 description => "Specify the time frame you are interested in.",
 790                 type => 'string',
 791                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 792             },
 793             cf => {
 794                 description => "The RRD consolidation function",
 795                 type => 'string',
 796                 enum => [ 'AVERAGE', 'MAX' ],
 797                 optional => 1,
 798             },
 799         },
 800     },
 801     returns => {
 802         type => "array",
 803         items => {
 804             type => "object",
 805             properties => {},
 806         },
 807     },
 808     code => sub {
 809         my ($param) = @_;
 810
 811         return PVE::RRD::create_rrd_data(
 812             "pve2-node/$param->{node}", $param->{timeframe}, $param->{cf});
 813     }});
 814
 815 __PACKAGE__->register_method({
 816     name => 'syslog',
 817     path => 'syslog',
 818     method => 'GET',
 819     description => "Read system log",
 820     proxyto => 'node',
 821     permissions => {
 822         check => ['perm', '/nodes/{node}', [ 'Sys.Syslog' ]],
 823     },
 824     protected => 1,
 825     parameters => {
 826         additionalProperties => 0,
 827         properties => {
 828             node => get_standard_option('pve-node'),
 829             start => {
 830                 type => 'integer',
 831                 minimum => 0,
 832                 optional => 1,
 833             },
 834             limit => {
 835                 type => 'integer',
 836                 minimum => 0,
 837                 optional => 1,
 838             },
 839             since => {
 840                 type=> 'string',
 841                 pattern => '^\d{4}-\d{2}-\d{2}( \d{2}:\d{2}(:\d{2})?)?$',
 842                 description => "Display all log since this date-time string.",
 843                 optional => 1,
 844             },
 845             until => {
 846                 type=> 'string',
 847                 pattern => '^\d{4}-\d{2}-\d{2}( \d{2}:\d{2}(:\d{2})?)?$',
 848                 description => "Display all log until this date-time string.",
 849                 optional => 1,
 850             },
 851             service => {
 852                 description => "Service ID",
 853                 type => 'string',
 854                 maxLength => 128,
 855                 optional => 1,
 856             },
 857         },
 858     },
 859     returns => {
 860         type => 'array',
 861         items => {
 862             type => "object",
 863             properties => {
 864                 n => {
 865                   description=>  "Line number",
 866                   type=> 'integer',
 867                 },
 868                 t => {
 869                   description=>  "Line text",
 870                   type => 'string',
 871                 }
 872             }
 873         }
 874     },
 875     code => sub {
 876         my ($param) = @_;
 877
 878         my $rpcenv = PVE::RPCEnvironment::get();
 879         my $user = $rpcenv->get_user();
 880         my $node = $param->{node};
 881         my $service;
 882
 883         if ($param->{service}) {
 884             my $service_aliases = {
 885                 'postfix' => 'postfix@-',
 886             };
 887
 888             $service = $service_aliases->{$param->{service}} // $param->{service};
 889         }
 890
 891         my ($count, $lines) = PVE::Tools::dump_journal($param->{start}, $param->{limit},
 892                                                        $param->{since}, $param->{until}, $service);
 893
 894         $rpcenv->set_result_attrib('total', $count);
 895
 896         return $lines;
 897     }});
 898
 899 __PACKAGE__->register_method({
 900     name => 'journal',
 901     path => 'journal',
 902     method => 'GET',
 903     description => "Read Journal",
 904     proxyto => 'node',
 905     permissions => {
 906         check => ['perm', '/nodes/{node}', [ 'Sys.Syslog' ]],
 907     },
 908     protected => 1,
 909     parameters => {
 910         additionalProperties => 0,
 911         properties => {
 912             node => get_standard_option('pve-node'),
 913             since => {
 914                 type=> 'integer',
 915                 minimum => 0,
 916                 description => "Display all log since this UNIX epoch. Conflicts with 'startcursor'.",
 917                 optional => 1,
 918             },
 919             until => {
 920                 type=> 'integer',
 921                 minimum => 0,
 922                 description => "Display all log until this UNIX epoch. Conflicts with 'endcursor'.",
 923                 optional => 1,
 924             },
 925             lastentries => {
 926                 description => "Limit to the last X lines. Conflicts with a range.",
 927                 type => 'integer',
 928                 minimum => 0,
 929                 optional => 1,
 930             },
 931             startcursor => {
 932                 description => "Start after the given Cursor. Conflicts with 'since'",
 933                 type => 'string',
 934                 optional => 1,
 935             },
 936             endcursor => {
 937                 description => "End before the given Cursor. Conflicts with 'until'",
 938                 type => 'string',
 939                 optional => 1,
 940             },
 941         },
 942     },
 943     returns => {
 944         type => 'array',
 945         items => {
 946             type => "string",
 947         }
 948     },
 949     code => sub {
 950         my ($param) = @_;
 951
 952         my $rpcenv = PVE::RPCEnvironment::get();
 953         my $user = $rpcenv->get_user();
 954
 955         my $cmd = ["/usr/bin/mini-journalreader", "-j"];
 956         push @$cmd, '-n', $param->{lastentries} if $param->{lastentries};
 957         push @$cmd, '-b', $param->{since} if $param->{since};
 958         push @$cmd, '-e', $param->{until} if $param->{until};
 959         push @$cmd, '-f', PVE::Tools::shellquote($param->{startcursor}) if $param->{startcursor};
 960         push @$cmd, '-t', PVE::Tools::shellquote($param->{endcursor}) if $param->{endcursor};
 961         push @$cmd, ' | gzip ';
 962
 963         open(my $fh, "-|", join(' ', @$cmd))
 964             or die "could not start mini-journalreader";
 965
 966         return {
 967             download => {
 968                 fh => $fh,
 969                 stream => 1,
 970                 'content-type' => 'application/json',
 971                 'content-encoding' => 'gzip',
 972             },
 973         },
 974     }});
 975
 976 my $sslcert;
 977
 978 my $shell_cmd_map = {
 979     'login' => {
 980         cmd => [ '/bin/login', '-f', 'root' ],
 981     },
 982     'upgrade' => {
 983         cmd => [ '/usr/bin/pveupgrade', '--shell' ],
 984     },
 985     'ceph_install' => {
 986         cmd => [ '/usr/bin/pveceph', 'install' ],
 987         allow_args => 1,
 988     },
 989 };
 990
 991 sub get_shell_command  {
 992     my ($user, $shellcmd, $args) = @_;
 993
 994     my $cmd;
 995     if ($user eq 'root@pam') {
 996         if (defined($shellcmd) && exists($shell_cmd_map->{$shellcmd})) {
 997             my $def = $shell_cmd_map->{$shellcmd};
 998             $cmd = [ @{$def->{cmd}} ]; # clone
 999             if (defined($args) && $def->{allow_args}) {
1000                 push @$cmd, split("\0", $args);
1001             }
1002         } else {
1003             $cmd = [ '/bin/login', '-f', 'root' ];
1004         }
1005     } else {
1006         # non-root must always login for now, we do not have a superuser role!
1007         $cmd = [ '/bin/login' ];
1008     }
1009     return $cmd;
1010 }
1011
1012 my $get_vnc_connection_info = sub {
1013     my $node = shift;
1014
1015     my $remote_cmd = [];
1016
1017     my ($remip, $family);
1018     if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1019         ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1020         $remote_cmd = PVE::SSHInfo::ssh_info_to_command({ ip => $remip, name => $node }, ('-t'));
1021         push @$remote_cmd, '--';
1022     } else {
1023         $family = PVE::Tools::get_host_address_family($node);
1024     }
1025     my $port = PVE::Tools::next_vnc_port($family);
1026
1027     return ($port, $remote_cmd);
1028 };
1029
1030 __PACKAGE__->register_method ({
1031     name => 'vncshell',
1032     path => 'vncshell',
1033     method => 'POST',
1034     protected => 1,
1035     permissions => {
1036         check => ['perm', '/nodes/{node}', [ 'Sys.Console' ]],
1037     },
1038     description => "Creates a VNC Shell proxy.",
1039     parameters => {
1040         additionalProperties => 0,
1041         properties => {
1042             node => get_standard_option('pve-node'),
1043             cmd => {
1044                 type => 'string',
1045                 description => "Run specific command or default to login (requires 'root\@pam')",
1046                 enum => [keys %$shell_cmd_map],
1047                 optional => 1,
1048                 default => 'login',
1049             },
1050             'cmd-opts' => {
1051                 type => 'string',
1052                 description => "Add parameters to a command. Encoded as null terminated strings.",
1053                 requires => 'cmd',
1054                 optional => 1,
1055                 default => '',
1056             },
1057             websocket => {
1058                 optional => 1,
1059                 type => 'boolean',
1060                 description => "use websocket instead of standard vnc.",
1061             },
1062             width => {
1063                 optional => 1,
1064                 description => "sets the width of the console in pixels.",
1065                 type => 'integer',
1066                 minimum => 16,
1067                 maximum => 4096,
1068             },
1069             height => {
1070                 optional => 1,
1071                 description => "sets the height of the console in pixels.",
1072                 type => 'integer',
1073                 minimum => 16,
1074                 maximum => 2160,
1075             },
1076         },
1077     },
1078     returns => {
1079         additionalProperties => 0,
1080         properties => {
1081             user => { type => 'string' },
1082             ticket => { type => 'string' },
1083             cert => { type => 'string' },
1084             port => { type => 'integer' },
1085             upid => { type => 'string' },
1086         },
1087     },
1088     code => sub {
1089         my ($param) = @_;
1090
1091         my $rpcenv = PVE::RPCEnvironment::get();
1092         my ($user, undef, $realm) = PVE::AccessControl::verify_username($rpcenv->get_user());
1093
1094
1095         if (defined($param->{cmd}) && $param->{cmd} ne 'login' && $user ne 'root@pam') {
1096             raise_perm_exc('user != root@pam');
1097         }
1098
1099         my $node = $param->{node};
1100
1101         my $authpath = "/nodes/$node";
1102         my $ticket = PVE::AccessControl::assemble_vnc_ticket($user, $authpath);
1103
1104         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1105             if !$sslcert;
1106
1107         my ($port, $remcmd) = $get_vnc_connection_info->($node);
1108
1109         my $shcmd = get_shell_command($user, $param->{cmd}, $param->{'cmd-opts'});
1110
1111         my $timeout = 10;
1112
1113         my $cmd = ['/usr/bin/vncterm',
1114             '-rfbport', $port,
1115             '-timeout', $timeout,
1116             '-authpath', $authpath,
1117             '-perm', 'Sys.Console',
1118         ];
1119
1120         push @$cmd, '-width', $param->{width} if $param->{width};
1121         push @$cmd, '-height', $param->{height} if $param->{height};
1122
1123         if ($param->{websocket}) {
1124             $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
1125             push @$cmd, '-notls', '-listen', 'localhost';
1126         }
1127
1128         push @$cmd, '-c', @$remcmd, @$shcmd;
1129
1130         my $realcmd = sub {
1131             my $upid = shift;
1132
1133             syslog ('info', "starting vnc proxy $upid\n");
1134
1135             my $cmdstr = join (' ', @$cmd);
1136             syslog ('info', "launch command: $cmdstr");
1137
1138             eval {
1139                 foreach my $k (keys %ENV) {
1140                     next if $k eq 'PVE_VNC_TICKET';
1141                     next if $k eq 'PATH' || $k eq 'TERM' || $k eq 'USER' || $k eq 'HOME' || $k eq 'LANG' || $k eq 'LANGUAGE';
1142                     delete $ENV{$k};
1143                 }
1144                 $ENV{PWD} = '/';
1145
1146                 PVE::Tools::run_command($cmd, errmsg => "vncterm failed", keeplocale => 1);
1147             };
1148             if (my $err = $@) {
1149                 syslog ('err', $err);
1150             }
1151
1152             return;
1153         };
1154
1155         my $upid = $rpcenv->fork_worker('vncshell', "", $user, $realcmd);
1156
1157         PVE::Tools::wait_for_vnc_port($port);
1158
1159         return {
1160             user => $user,
1161             ticket => $ticket,
1162             port => $port,
1163             upid => $upid,
1164             cert => $sslcert,
1165         };
1166     }});
1167
1168 __PACKAGE__->register_method ({
1169     name => 'termproxy',
1170     path => 'termproxy',
1171     method => 'POST',
1172     protected => 1,
1173     permissions => {
1174         check => ['perm', '/nodes/{node}', [ 'Sys.Console' ]],
1175     },
1176     description => "Creates a VNC Shell proxy.",
1177     parameters => {
1178         additionalProperties => 0,
1179         properties => {
1180             node => get_standard_option('pve-node'),
1181             cmd => {
1182                 type => 'string',
1183                 description => "Run specific command or default to login (requires 'root\@pam')",
1184                 enum => [keys %$shell_cmd_map],
1185                 optional => 1,
1186                 default => 'login',
1187             },
1188             'cmd-opts' => {
1189                 type => 'string',
1190                 description => "Add parameters to a command. Encoded as null terminated strings.",
1191                 requires => 'cmd',
1192                 optional => 1,
1193                 default => '',
1194             },
1195         },
1196     },
1197     returns => {
1198         additionalProperties => 0,
1199         properties => {
1200             user => { type => 'string' },
1201             ticket => { type => 'string' },
1202             port => { type => 'integer' },
1203             upid => { type => 'string' },
1204         },
1205     },
1206     code => sub {
1207         my ($param) = @_;
1208
1209         my $rpcenv = PVE::RPCEnvironment::get();
1210         my ($user, undef, $realm) = PVE::AccessControl::verify_username($rpcenv->get_user());
1211
1212         my $node = $param->{node};
1213         my $authpath = "/nodes/$node";
1214         my $ticket = PVE::AccessControl::assemble_vnc_ticket($user, $authpath);
1215
1216         my ($port, $remcmd) = $get_vnc_connection_info->($node);
1217
1218         my $shcmd = get_shell_command($user, $param->{cmd}, $param->{'cmd-opts'});
1219
1220         my $realcmd = sub {
1221             my $upid = shift;
1222
1223             syslog ('info', "starting termproxy $upid\n");
1224
1225             my $cmd = [
1226                 '/usr/bin/termproxy',
1227                 $port,
1228                 '--path', $authpath,
1229                 '--perm', 'Sys.Console',
1230                 '--'
1231             ];
1232             push  @$cmd, @$remcmd, @$shcmd;
1233
1234             PVE::Tools::run_command($cmd);
1235         };
1236         my $upid = $rpcenv->fork_worker('vncshell', "", $user, $realcmd);
1237
1238         PVE::Tools::wait_for_vnc_port($port);
1239
1240         return {
1241             user => $user,
1242             ticket => $ticket,
1243             port => $port,
1244             upid => $upid,
1245         };
1246     }});
1247
1248 __PACKAGE__->register_method({
1249     name => 'vncwebsocket',
1250     path => 'vncwebsocket',
1251     method => 'GET',
1252     permissions => {
1253         description => "You also need to pass a valid ticket (vncticket).",
1254         check => ['perm', '/nodes/{node}', [ 'Sys.Console' ]],
1255     },
1256     description => "Opens a websocket for VNC traffic.",
1257     parameters => {
1258         additionalProperties => 0,
1259         properties => {
1260             node => get_standard_option('pve-node'),
1261             vncticket => {
1262                 description => "Ticket from previous call to vncproxy.",
1263                 type => 'string',
1264                 maxLength => 512,
1265             },
1266             port => {
1267                 description => "Port number returned by previous vncproxy call.",
1268                 type => 'integer',
1269                 minimum => 5900,
1270                 maximum => 5999,
1271             },
1272         },
1273     },
1274     returns => {
1275         type => "object",
1276         properties => {
1277             port => { type => 'string' },
1278         },
1279     },
1280     code => sub {
1281         my ($param) = @_;
1282
1283         my $rpcenv = PVE::RPCEnvironment::get();
1284
1285         my ($user, undef, $realm) = PVE::AccessControl::verify_username($rpcenv->get_user());
1286
1287         my $authpath = "/nodes/$param->{node}";
1288
1289         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $user, $authpath);
1290
1291         my $port = $param->{port};
1292
1293         return { port => $port };
1294     }});
1295
1296 __PACKAGE__->register_method ({
1297     name => 'spiceshell',
1298     path => 'spiceshell',
1299     method => 'POST',
1300     protected => 1,
1301     proxyto => 'node',
1302     permissions => {
1303         check => ['perm', '/nodes/{node}', [ 'Sys.Console' ]],
1304     },
1305     description => "Creates a SPICE shell.",
1306     parameters => {
1307         additionalProperties => 0,
1308         properties => {
1309             node => get_standard_option('pve-node'),
1310             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1311             cmd => {
1312                 type => 'string',
1313                 description => "Run specific command or default to login (requires 'root\@pam')",
1314                 enum => [keys %$shell_cmd_map],
1315                 optional => 1,
1316                 default => 'login',
1317             },
1318             'cmd-opts' => {
1319                 type => 'string',
1320                 description => "Add parameters to a command. Encoded as null terminated strings.",
1321                 requires => 'cmd',
1322                 optional => 1,
1323                 default => '',
1324             },
1325         },
1326     },
1327     returns => get_standard_option('remote-viewer-config'),
1328     code => sub {
1329         my ($param) = @_;
1330
1331         my $rpcenv = PVE::RPCEnvironment::get();
1332         my $authuser = $rpcenv->get_user();
1333
1334         my ($user, undef, $realm) = PVE::AccessControl::verify_username($authuser);
1335
1336
1337         if (defined($param->{cmd}) && $param->{cmd} ne 'login' && $user ne 'root@pam') {
1338             raise_perm_exc('user != root@pam');
1339         }
1340
1341         my $node = $param->{node};
1342         my $proxy = $param->{proxy};
1343
1344         my $authpath = "/nodes/$node";
1345         my $permissions = 'Sys.Console';
1346
1347         my $shcmd = get_shell_command($user, $param->{cmd}, $param->{'cmd-opts'});
1348
1349         my $title = "Shell on '$node'";
1350
1351         return PVE::API2Tools::run_spiceterm($authpath, $permissions, 0, $node, $proxy, $title, $shcmd);
1352     }});
1353
1354 __PACKAGE__->register_method({
1355     name => 'dns',
1356     path => 'dns',
1357     method => 'GET',
1358     permissions => {
1359         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
1360     },
1361     description => "Read DNS settings.",
1362     proxyto => 'node',
1363     parameters => {
1364         additionalProperties => 0,
1365         properties => {
1366             node => get_standard_option('pve-node'),
1367         },
1368     },
1369     returns => {
1370         type => "object",
1371         additionalProperties => 0,
1372         properties => {
1373             search => {
1374                 description => "Search domain for host-name lookup.",
1375                 type => 'string',
1376                 optional => 1,
1377             },
1378             dns1 => {
1379                 description => 'First name server IP address.',
1380                 type => 'string',
1381                 optional => 1,
1382             },
1383             dns2 => {
1384                 description => 'Second name server IP address.',
1385                 type => 'string',
1386                 optional => 1,
1387             },
1388             dns3 => {
1389                 description => 'Third name server IP address.',
1390                 type => 'string',
1391                 optional => 1,
1392             },
1393         },
1394     },
1395     code => sub {
1396         my ($param) = @_;
1397
1398         my $res = PVE::INotify::read_file('resolvconf');
1399
1400         return $res;
1401     }});
1402
1403 __PACKAGE__->register_method({
1404     name => 'update_dns',
1405     path => 'dns',
1406     method => 'PUT',
1407     description => "Write DNS settings.",
1408     permissions => {
1409         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
1410     },
1411     proxyto => 'node',
1412     protected => 1,
1413     parameters => {
1414         additionalProperties => 0,
1415         properties => {
1416             node => get_standard_option('pve-node'),
1417             search => {
1418                 description => "Search domain for host-name lookup.",
1419                 type => 'string',
1420             },
1421             dns1 => {
1422                 description => 'First name server IP address.',
1423                 type => 'string', format => 'ip',
1424                 optional => 1,
1425             },
1426             dns2 => {
1427                 description => 'Second name server IP address.',
1428                 type => 'string', format => 'ip',
1429                 optional => 1,
1430             },
1431             dns3 => {
1432                 description => 'Third name server IP address.',
1433                 type => 'string', format => 'ip',
1434                 optional => 1,
1435             },
1436         },
1437     },
1438     returns => { type => "null" },
1439     code => sub {
1440         my ($param) = @_;
1441
1442         PVE::INotify::update_file('resolvconf', $param);
1443
1444         return;
1445     }});
1446
1447 __PACKAGE__->register_method({
1448     name => 'time',
1449     path => 'time',
1450     method => 'GET',
1451     permissions => {
1452         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
1453    },
1454     description => "Read server time and time zone settings.",
1455     proxyto => 'node',
1456     parameters => {
1457         additionalProperties => 0,
1458         properties => {
1459             node => get_standard_option('pve-node'),
1460         },
1461     },
1462     returns => {
1463         type => "object",
1464         additionalProperties => 0,
1465         properties => {
1466             timezone => {
1467                 description => "Time zone",
1468                 type => 'string',
1469             },
1470             time => {
1471                 description => "Seconds since 1970-01-01 00:00:00 UTC.",
1472                 type => 'integer',
1473                 minimum => 1297163644,
1474                 renderer => 'timestamp',
1475             },
1476             localtime => {
1477                 description => "Seconds since 1970-01-01 00:00:00 (local time)",
1478                 type => 'integer',
1479                 minimum => 1297163644,
1480                 renderer => 'timestamp_gmt',
1481             },
1482         },
1483     },
1484     code => sub {
1485         my ($param) = @_;
1486
1487         my $ctime = time();
1488         my $ltime = timegm_nocheck(localtime($ctime));
1489         my $res = {
1490             timezone => PVE::INotify::read_file('timezone'),
1491             time => $ctime,
1492             localtime => $ltime,
1493         };
1494
1495         return $res;
1496     }});
1497
1498 __PACKAGE__->register_method({
1499     name => 'set_timezone',
1500     path => 'time',
1501     method => 'PUT',
1502     description => "Set time zone.",
1503     permissions => {
1504         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
1505     },
1506     proxyto => 'node',
1507     protected => 1,
1508     parameters => {
1509         additionalProperties => 0,
1510         properties => {
1511             node => get_standard_option('pve-node'),
1512             timezone => {
1513                 description => "Time zone. The file '/usr/share/zoneinfo/zone.tab' contains the list of valid names.",
1514                 type => 'string',
1515             },
1516         },
1517     },
1518     returns => { type => "null" },
1519     code => sub {
1520         my ($param) = @_;
1521
1522         PVE::INotify::write_file('timezone', $param->{timezone});
1523
1524         return;
1525     }});
1526
1527 __PACKAGE__->register_method({
1528     name => 'aplinfo',
1529     path => 'aplinfo',
1530     method => 'GET',
1531     permissions => {
1532         user => 'all',
1533     },
1534     description => "Get list of appliances.",
1535     proxyto => 'node',
1536     parameters => {
1537         additionalProperties => 0,
1538         properties => {
1539             node => get_standard_option('pve-node'),
1540         },
1541     },
1542     returns => {
1543         type => 'array',
1544         items => {
1545             type => "object",
1546             properties => {},
1547         },
1548     },
1549     code => sub {
1550         my ($param) = @_;
1551
1552         my $list = PVE::APLInfo::load_data();
1553
1554         my $res = [];
1555         for my $appliance (values %{$list->{all}}) {
1556             next if $appliance->{'package'} eq 'pve-web-news';
1557             push @$res, $appliance;
1558         }
1559
1560         return $res;
1561     }});
1562
1563 __PACKAGE__->register_method({
1564     name => 'apl_download',
1565     path => 'aplinfo',
1566     method => 'POST',
1567     permissions => {
1568         check => ['perm', '/storage/{storage}', ['Datastore.AllocateTemplate']],
1569     },
1570     description => "Download appliance templates.",
1571     proxyto => 'node',
1572     protected => 1,
1573     parameters => {
1574         additionalProperties => 0,
1575         properties => {
1576             node => get_standard_option('pve-node'),
1577             storage => get_standard_option('pve-storage-id', {
1578                 description => "The storage where the template will be stored",
1579                 completion => \&PVE::Storage::complete_storage_enabled,
1580             }),
1581             template => {
1582                 type => 'string',
1583                 description => "The template which will downloaded",
1584                 maxLength => 255,
1585                 completion => \&complete_templet_repo,
1586             },
1587         },
1588     },
1589     returns => { type => "string" },
1590     code => sub {
1591         my ($param) = @_;
1592
1593         my $rpcenv = PVE::RPCEnvironment::get();
1594         my $user = $rpcenv->get_user();
1595
1596         my $node = $param->{node};
1597         my $template = $param->{template};
1598
1599         my $list = PVE::APLInfo::load_data();
1600         my $appliance = $list->{all}->{$template};
1601         raise_param_exc({ template => "no such template"}) if !$appliance;
1602
1603         my $cfg = PVE::Storage::config();
1604         my $scfg = PVE::Storage::storage_check_enabled($cfg, $param->{storage}, $node);
1605
1606         die "unknown template type '$appliance->{type}'\n"
1607             if !($appliance->{type} eq 'openvz' || $appliance->{type} eq 'lxc');
1608
1609         die "storage '$param->{storage}' does not support templates\n"
1610             if !$scfg->{content}->{vztmpl};
1611
1612         my $tmpldir = PVE::Storage::get_vztmpl_dir($cfg, $param->{storage});
1613
1614         my $worker = sub {
1615             my $dccfg = PVE::Cluster::cfs_read_file('datacenter.cfg');
1616
1617             PVE::Tools::download_file_from_url("$tmpldir/$template", $appliance->{location}, {
1618                 hash_required => 1,
1619                 sha512sum => $appliance->{sha512sum},
1620                 md5sum => $appliance->{md5sum},
1621                 http_proxy => $dccfg->{http_proxy},
1622             });
1623         };
1624
1625         my $upid = $rpcenv->fork_worker('download', $template, $user, $worker);
1626
1627         return $upid;
1628     }});
1629
1630 __PACKAGE__->register_method({
1631     name => 'query_url_metadata',
1632     path => 'query-url-metadata',
1633     method => 'GET',
1634     description => "Query metadata of an URL: file size, file name and mime type.",
1635     proxyto => 'node',
1636     permissions => {
1637         check => ['or',
1638             ['perm', '/', [ 'Sys.Audit', 'Sys.Modify' ]],
1639             ['perm', '/nodes/{node}', [ 'Sys.AccessNetwork' ]],
1640         ],
1641     },
1642     parameters => {
1643         additionalProperties => 0,
1644         properties => {
1645             node => get_standard_option('pve-node'),
1646             url => {
1647                 description => "The URL to query the metadata from.",
1648                 type => 'string',
1649                 pattern => 'https?://.*',
1650             },
1651             'verify-certificates' => {
1652                 description => "If false, no SSL/TLS certificates will be verified.",
1653                 type => 'boolean',
1654                 optional => 1,
1655                 default => 1,
1656             },
1657         },
1658     },
1659     returns => {
1660         type => "object",
1661         properties => {
1662             filename => {
1663                 type => 'string',
1664                 optional => 1,
1665             },
1666             size => {
1667                 type => 'integer',
1668                 renderer => 'bytes',
1669                 optional => 1,
1670             },
1671             mimetype => {
1672                 type => 'string',
1673                 optional => 1,
1674             },
1675         },
1676     },
1677     code => sub {
1678         my ($param) = @_;
1679
1680         my $url = $param->{url};
1681
1682         my $ua = LWP::UserAgent->new();
1683         $ua->agent("Proxmox VE");
1684
1685         my $dccfg = PVE::Cluster::cfs_read_file('datacenter.cfg');
1686         if ($dccfg->{http_proxy}) {
1687             $ua->proxy('http', $dccfg->{http_proxy});
1688         }
1689
1690         my $verify = $param->{'verify-certificates'} // 1;
1691         if (!$verify) {
1692             $ua->ssl_opts(
1693                 verify_hostname => 0,
1694                 SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE,
1695             );
1696         }
1697
1698         my $req = HTTP::Request->new(HEAD => $url);
1699         my $res = $ua->request($req);
1700
1701         die "invalid server response: '" . $res->status_line() . "'\n" if ($res->code() != 200);
1702
1703         my $size = $res->header("Content-Length");
1704         my $disposition = $res->header("Content-Disposition");
1705         my $type = $res->header("Content-Type");
1706
1707         my $filename;
1708
1709         if ($disposition && ($disposition =~ m/filename="([^"]*)"/ || $disposition =~ m/filename=([^;]*)/)) {
1710             $filename = $1;
1711         } elsif ($url =~ m!^[^?]+/([^?/]*)(?:\?.*)?$!) {
1712             $filename = $1;
1713         }
1714
1715         # Content-Type: text/html; charset=utf-8
1716         if ($type && $type =~ m/^([^;]+);/) {
1717             $type = $1;
1718         }
1719
1720         my $ret = {};
1721         $ret->{filename} = $filename if $filename;
1722         $ret->{size} = $size + 0 if $size;
1723         $ret->{mimetype} = $type if $type;
1724
1725         return $ret;
1726     }});
1727
1728 __PACKAGE__->register_method({
1729     name => 'report',
1730     path => 'report',
1731     method => 'GET',
1732     permissions => {
1733         check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
1734     },
1735     protected => 1,
1736     description => "Gather various systems information about a node",
1737     proxyto => 'node',
1738     parameters => {
1739         additionalProperties => 0,
1740         properties => {
1741             node => get_standard_option('pve-node'),
1742         },
1743     },
1744     returns => {
1745         type => 'string',
1746     },
1747     code => sub {
1748         return PVE::Report::generate();
1749     }});
1750
1751 # returns a list of VMIDs, those can be filtered by
1752 # * current parent node
1753 # * vmid whitelist
1754 # * guest is a template (default: skip)
1755 # * guest is HA manged (default: skip)
1756 my $get_filtered_vmlist = sub {
1757     my ($nodename, $vmfilter, $templates, $ha_managed) = @_;
1758
1759     my $vmlist = PVE::Cluster::get_vmlist();
1760
1761     my $vms_allowed;
1762     if (defined($vmfilter)) {
1763         $vms_allowed = { map { $_ => 1 } PVE::Tools::split_list($vmfilter) };
1764     }
1765
1766     my $res = {};
1767     foreach my $vmid (keys %{$vmlist->{ids}}) {
1768         next if defined($vms_allowed) && !$vms_allowed->{$vmid};
1769
1770         my $d = $vmlist->{ids}->{$vmid};
1771         next if $nodename && $d->{node} ne $nodename;
1772
1773         eval {
1774             my $class;
1775             if ($d->{type} eq 'lxc') {
1776                 $class = 'PVE::LXC::Config';
1777             } elsif ($d->{type} eq 'qemu') {
1778                 $class = 'PVE::QemuConfig';
1779             } else {
1780                 die "unknown virtual guest type '$d->{type}'\n";
1781             }
1782
1783             my $conf = $class->load_config($vmid);
1784             return if !$templates && $class->is_template($conf);
1785             return if !$ha_managed && PVE::HA::Config::vm_is_ha_managed($vmid);
1786
1787             $res->{$vmid}->{conf} = $conf;
1788             $res->{$vmid}->{type} = $d->{type};
1789             $res->{$vmid}->{class} = $class;
1790         };
1791         warn $@ if $@;
1792     }
1793
1794     return $res;
1795 };
1796
1797 # return all VMs which should get started/stopped on power up/down
1798 my $get_start_stop_list = sub {
1799     my ($nodename, $autostart, $vmfilter) = @_;
1800
1801     # do not skip HA vms on force or if a specific VMID set is wanted
1802     my $include_ha_managed = defined($vmfilter) ? 1 : 0;
1803
1804     my $vmlist = $get_filtered_vmlist->($nodename, $vmfilter, undef, $include_ha_managed);
1805
1806     my $resList = {};
1807     foreach my $vmid (keys %$vmlist) {
1808         my $conf = $vmlist->{$vmid}->{conf};
1809         next if $autostart && !$conf->{onboot};
1810
1811         my $startup = $conf->{startup} ? PVE::JSONSchema::pve_parse_startup_order($conf->{startup}) : {};
1812         my $order = $startup->{order} = $startup->{order} // LONG_MAX;
1813
1814         $resList->{$order}->{$vmid} = $startup;
1815         $resList->{$order}->{$vmid}->{type} = $vmlist->{$vmid}->{type};
1816     }
1817
1818     return $resList;
1819 };
1820
1821 my $remove_locks_on_startup = sub {
1822     my ($nodename) = @_;
1823
1824     my $vmlist = &$get_filtered_vmlist($nodename, undef, undef, 1);
1825
1826     foreach my $vmid (keys %$vmlist) {
1827         my $conf = $vmlist->{$vmid}->{conf};
1828         my $class = $vmlist->{$vmid}->{class};
1829
1830         eval {
1831             if ($class->has_lock($conf, 'backup')) {
1832                 $class->remove_lock($vmid, 'backup');
1833                 my $msg =  "removed left over backup lock from '$vmid'!";
1834                 warn "$msg\n"; # prints to task log
1835                 syslog('warning', $msg);
1836             }
1837         }; warn $@ if $@;
1838     }
1839 };
1840
1841 __PACKAGE__->register_method ({
1842     name => 'startall',
1843     path => 'startall',
1844     method => 'POST',
1845     protected => 1,
1846     permissions => {
1847         description => "The 'VM.PowerMgmt' permission is required on '/' or on '/vms/<ID>' for "
1848             ."each ID passed via the 'vms' parameter.",
1849         user => 'all',
1850     },
1851     proxyto => 'node',
1852     description => "Start all VMs and containers located on this node (by default only those with onboot=1).",
1853     parameters => {
1854         additionalProperties => 0,
1855         properties => {
1856             node => get_standard_option('pve-node'),
1857             force => {
1858                 optional => 1,
1859                 type => 'boolean',
1860                 default => 'off',
1861                 description => "Issue start command even if virtual guest have 'onboot' not set or set to off.",
1862             },
1863             vms => {
1864                 description => "Only consider guests from this comma separated list of VMIDs.",
1865                 type => 'string',  format => 'pve-vmid-list',
1866                 optional => 1,
1867             },
1868         },
1869     },
1870     returns => {
1871         type => 'string',
1872     },
1873     code => sub {
1874         my ($param) = @_;
1875
1876         my $rpcenv = PVE::RPCEnvironment::get();
1877         my $authuser = $rpcenv->get_user();
1878
1879         if (!$rpcenv->check($authuser, "/", [ 'VM.PowerMgmt' ], 1)) {
1880             my @vms = PVE::Tools::split_list($param->{vms});
1881             if (scalar(@vms) > 0) {
1882                 $rpcenv->check($authuser, "/vms/$_", [ 'VM.PowerMgmt' ]) for @vms;
1883             } else {
1884                 raise_perm_exc("/, VM.PowerMgmt");
1885             }
1886         }
1887
1888         my $nodename = $param->{node};
1889         $nodename = PVE::INotify::nodename() if $nodename eq 'localhost';
1890
1891         my $force = $param->{force};
1892
1893         my $code = sub {
1894             $rpcenv->{type} = 'priv'; # to start tasks in background
1895
1896             if (!PVE::Cluster::check_cfs_quorum(1)) {
1897                 print "waiting for quorum ...\n";
1898                 do {
1899                     sleep(1);
1900                 } while (!PVE::Cluster::check_cfs_quorum(1));
1901                 print "got quorum\n";
1902             }
1903
1904             eval { # remove backup locks, but avoid running into a scheduled backup job
1905                 PVE::Tools::lock_file('/var/run/vzdump.lock', 10, $remove_locks_on_startup, $nodename);
1906             };
1907             warn $@ if $@;
1908
1909             my $autostart = $force ? undef : 1;
1910             my $startList = $get_start_stop_list->($nodename, $autostart, $param->{vms});
1911
1912             # Note: use numeric sorting with <=>
1913             for my $order (sort {$a <=> $b} keys %$startList) {
1914                 my $vmlist = $startList->{$order};
1915
1916                 for my $vmid (sort {$a <=> $b} keys %$vmlist) {
1917                     my $d = $vmlist->{$vmid};
1918
1919                     PVE::Cluster::check_cfs_quorum(); # abort when we loose quorum
1920
1921                     eval {
1922                         my $default_delay = 0;
1923                         my $upid;
1924
1925                         if ($d->{type} eq 'lxc') {
1926                             return if PVE::LXC::check_running($vmid);
1927                             print STDERR "Starting CT $vmid\n";
1928                             $upid = PVE::API2::LXC::Status->vm_start({node => $nodename, vmid => $vmid });
1929                         } elsif ($d->{type} eq 'qemu') {
1930                             $default_delay = 3; # to reduce load
1931                             return if PVE::QemuServer::check_running($vmid, 1);
1932                             print STDERR "Starting VM $vmid\n";
1933                             $upid = PVE::API2::Qemu->vm_start({node => $nodename, vmid => $vmid });
1934                         } else {
1935                             die "unknown VM type '$d->{type}'\n";
1936                         }
1937
1938                         my $task = PVE::Tools::upid_decode($upid);
1939                         while (PVE::ProcFSTools::check_process_running($task->{pid})) {
1940                             sleep(1);
1941                         }
1942
1943                         my $status = PVE::Tools::upid_read_status($upid);
1944                         if (!PVE::Tools::upid_status_is_error($status)) {
1945                             # use default delay to reduce load
1946                             my $delay = defined($d->{up}) ? int($d->{up}) : $default_delay;
1947                             if ($delay > 0) {
1948                                 print STDERR "Waiting for $delay seconds (startup delay)\n" if $d->{up};
1949                                 for (my $i = 0; $i < $delay; $i++) {
1950                                     sleep(1);
1951                                 }
1952                             }
1953                         } else {
1954                             my $rendered_type = $d->{type} eq 'lxc' ? 'CT' : 'VM';
1955                             print STDERR "Starting $rendered_type $vmid failed: $status\n";
1956                         }
1957                     };
1958                     warn $@ if $@;
1959                 }
1960             }
1961             return;
1962         };
1963
1964         return $rpcenv->fork_worker('startall', undef, $authuser, $code);
1965     }});
1966
1967 my $create_stop_worker = sub {
1968     my ($nodename, $type, $vmid, $timeout, $force_stop) = @_;
1969
1970     if ($type eq 'lxc') {
1971         return if !PVE::LXC::check_running($vmid);
1972         print STDERR "Stopping CT $vmid (timeout = $timeout seconds)\n";
1973         return PVE::API2::LXC::Status->vm_shutdown(
1974             { node => $nodename, vmid => $vmid, timeout => $timeout, forceStop => $force_stop }
1975         );
1976     } elsif ($type eq 'qemu') {
1977         return if !PVE::QemuServer::check_running($vmid, 1);
1978         print STDERR "Stopping VM $vmid (timeout = $timeout seconds)\n";
1979         return PVE::API2::Qemu->vm_shutdown(
1980             { node => $nodename, vmid => $vmid, timeout => $timeout, forceStop => $force_stop }
1981         );
1982     } else {
1983         die "unknown VM type '$type'\n";
1984     }
1985 };
1986
1987 __PACKAGE__->register_method ({
1988     name => 'stopall',
1989     path => 'stopall',
1990     method => 'POST',
1991     protected => 1,
1992     permissions => {
1993         description => "The 'VM.PowerMgmt' permission is required on '/' or on '/vms/<ID>' for "
1994             ."each ID passed via the 'vms' parameter.",
1995         user => 'all',
1996     },
1997     proxyto => 'node',
1998     description => "Stop all VMs and Containers.",
1999     parameters => {
2000         additionalProperties => 0,
2001         properties => {
2002             node => get_standard_option('pve-node'),
2003             vms => {
2004                 description => "Only consider Guests with these IDs.",
2005                 type => 'string',  format => 'pve-vmid-list',
2006                 optional => 1,
2007             },
2008             'force-stop' => {
2009                 description => 'Force a hard-stop after the timeout.',
2010                 type => 'boolean',
2011                 default => 1,
2012                 optional => 1,
2013             },
2014             'timeout' => {
2015                 description => 'Timeout for each guest shutdown task. Depending on `force-stop`,'
2016                     .' the shutdown gets then simply aborted or a hard-stop is forced.',
2017                 type => 'integer',
2018                 optional => 1,
2019                 default => 180,
2020                 minimum => 0,
2021                 maximum => 2 * 3600, # mostly arbitrary, but we do not want to high timeouts
2022             },
2023         },
2024     },
2025     returns => {
2026         type => 'string',
2027     },
2028     code => sub {
2029         my ($param) = @_;
2030
2031         my $rpcenv = PVE::RPCEnvironment::get();
2032         my $authuser = $rpcenv->get_user();
2033
2034         if (!$rpcenv->check($authuser, "/", [ 'VM.PowerMgmt' ], 1)) {
2035             my @vms = PVE::Tools::split_list($param->{vms});
2036             if (scalar(@vms) > 0) {
2037                 $rpcenv->check($authuser, "/vms/$_", [ 'VM.PowerMgmt' ]) for @vms;
2038             } else {
2039                 raise_perm_exc("/, VM.PowerMgmt");
2040             }
2041         }
2042
2043         my $nodename = $param->{node};
2044         $nodename = PVE::INotify::nodename() if $nodename eq 'localhost';
2045
2046         my $code = sub {
2047
2048             $rpcenv->{type} = 'priv'; # to start tasks in background
2049
2050             my $stopList = $get_start_stop_list->($nodename, undef, $param->{vms});
2051
2052             my $cpuinfo = PVE::ProcFSTools::read_cpuinfo();
2053             my $datacenterconfig = cfs_read_file('datacenter.cfg');
2054             # if not set by user spawn max cpu count number of workers
2055             my $maxWorkers =  $datacenterconfig->{max_workers} || $cpuinfo->{cpus};
2056
2057             for my $order (sort {$b <=> $a} keys %$stopList) {
2058                 my $vmlist = $stopList->{$order};
2059                 my $workers = {};
2060
2061                 my $finish_worker = sub {
2062                     my $pid = shift;
2063                     my $worker = delete $workers->{$pid} || return;
2064
2065                     syslog('info', "end task $worker->{upid}");
2066                 };
2067
2068                 for my $vmid (sort {$b <=> $a} keys %$vmlist) {
2069                     my $d = $vmlist->{$vmid};
2070                     my $timeout = int($d->{down} // $param->{timeout} // 180);
2071                     my $upid = eval {
2072                         $create_stop_worker->(
2073                             $nodename, $d->{type}, $vmid, $timeout, $param->{'force-stop'} // 1)
2074                     };
2075                     warn $@ if $@;
2076                     next if !$upid;
2077
2078                     my $task = PVE::Tools::upid_decode($upid, 1);
2079                     next if !$task;
2080
2081                     my $pid = $task->{pid};
2082
2083                     $workers->{$pid} = { type => $d->{type}, upid => $upid, vmid => $vmid };
2084                     while (scalar(keys %$workers) >= $maxWorkers) {
2085                         foreach my $p (keys %$workers) {
2086                             if (!PVE::ProcFSTools::check_process_running($p)) {
2087                                 $finish_worker->($p);
2088                             }
2089                         }
2090                         sleep(1);
2091                     }
2092                 }
2093                 while (scalar(keys %$workers)) {
2094                     for my $p (keys %$workers) {
2095                         if (!PVE::ProcFSTools::check_process_running($p)) {
2096                             $finish_worker->($p);
2097                         }
2098                     }
2099                     sleep(1);
2100                 }
2101             }
2102
2103             syslog('info', "all VMs and CTs stopped");
2104
2105             return;
2106         };
2107
2108         return $rpcenv->fork_worker('stopall', undef, $authuser, $code);
2109     }});
2110
2111 my $create_suspend_worker = sub {
2112     my ($nodename, $vmid) = @_;
2113     if (!PVE::QemuServer::check_running($vmid, 1)) {
2114         print "VM $vmid not running, skipping suspension\n";
2115         return;
2116     }
2117     print STDERR "Suspending VM $vmid\n";
2118     return PVE::API2::Qemu->vm_suspend(
2119         { node => $nodename, vmid => $vmid, todisk => 1 }
2120     );
2121 };
2122
2123 __PACKAGE__->register_method ({
2124     name => 'suspendall',
2125     path => 'suspendall',
2126     method => 'POST',
2127     protected => 1,
2128     permissions => {
2129         description => "The 'VM.PowerMgmt' permission is required on '/' or on '/vms/<ID>' for each"
2130             ." ID passed via the 'vms' parameter. Additionally, you need 'VM.Config.Disk' on the"
2131             ." '/vms/{vmid}' path and 'Datastore.AllocateSpace' for the configured state-storage(s)",
2132         user => 'all',
2133     },
2134     proxyto => 'node',
2135     description => "Suspend all VMs.",
2136     parameters => {
2137         additionalProperties => 0,
2138         properties => {
2139             node => get_standard_option('pve-node'),
2140             vms => {
2141                 description => "Only consider Guests with these IDs.",
2142                 type => 'string',  format => 'pve-vmid-list',
2143                 optional => 1,
2144             },
2145         },
2146     },
2147     returns => {
2148         type => 'string',
2149     },
2150     code => sub {
2151         my ($param) = @_;
2152
2153         my $rpcenv = PVE::RPCEnvironment::get();
2154         my $authuser = $rpcenv->get_user();
2155
2156         # we cannot really check access to the state-storage here, that's happening per worker.
2157         if (!$rpcenv->check($authuser, "/", [ 'VM.PowerMgmt', 'VM.Config.Disk' ], 1)) {
2158             my @vms = PVE::Tools::split_list($param->{vms});
2159             if (scalar(@vms) > 0) {
2160                 $rpcenv->check($authuser, "/vms/$_", [ 'VM.PowerMgmt' ]) for @vms;
2161             } else {
2162                 raise_perm_exc("/, VM.PowerMgmt && VM.Config.Disk");
2163             }
2164         }
2165
2166         my $nodename = $param->{node};
2167         $nodename = PVE::INotify::nodename() if $nodename eq 'localhost';
2168
2169         my $code = sub {
2170
2171             $rpcenv->{type} = 'priv'; # to start tasks in background
2172
2173             my $toSuspendList = $get_start_stop_list->($nodename, undef, $param->{vms});
2174
2175             my $cpuinfo = PVE::ProcFSTools::read_cpuinfo();
2176             my $datacenterconfig = cfs_read_file('datacenter.cfg');
2177             # if not set by user spawn max cpu count number of workers
2178             my $maxWorkers =  $datacenterconfig->{max_workers} || $cpuinfo->{cpus};
2179
2180             for my $order (sort {$b <=> $a} keys %$toSuspendList) {
2181                 my $vmlist = $toSuspendList->{$order};
2182                 my $workers = {};
2183
2184                 my $finish_worker = sub {
2185                     my $pid = shift;
2186                     my $worker = delete $workers->{$pid} || return;
2187
2188                     syslog('info', "end task $worker->{upid}");
2189                 };
2190
2191                 for my $vmid (sort {$b <=> $a} keys %$vmlist) {
2192                     my $d = $vmlist->{$vmid};
2193                     if ($d->{type} ne 'qemu') {
2194                         log_warn("skipping $vmid, only VMs can be suspended");
2195                         next;
2196                     }
2197                     my $upid = eval {
2198                         $create_suspend_worker->($nodename, $vmid)
2199                     };
2200                     warn $@ if $@;
2201                     next if !$upid;
2202
2203                     my $task = PVE::Tools::upid_decode($upid, 1);
2204                     next if !$task;
2205
2206                     my $pid = $task->{pid};
2207                     $workers->{$pid} = { type => $d->{type}, upid => $upid, vmid => $vmid };
2208
2209                     while (scalar(keys %$workers) >= $maxWorkers) {
2210                         for my $p (keys %$workers) {
2211                             if (!PVE::ProcFSTools::check_process_running($p)) {
2212                                 $finish_worker->($p);
2213                             }
2214                         }
2215                         sleep(1);
2216                     }
2217                 }
2218                 while (scalar(keys %$workers)) {
2219                     for my $p (keys %$workers) {
2220                         if (!PVE::ProcFSTools::check_process_running($p)) {
2221                             $finish_worker->($p);
2222                         }
2223                     }
2224                     sleep(1);
2225                 }
2226             }
2227
2228             syslog('info', "all VMs suspended");
2229
2230             return;
2231         };
2232
2233         return $rpcenv->fork_worker('suspendall', undef, $authuser, $code);
2234     }});
2235
2236
2237 my $create_migrate_worker = sub {
2238     my ($nodename, $type, $vmid, $target, $with_local_disks) = @_;
2239
2240     my $upid;
2241     if ($type eq 'lxc') {
2242         my $online = PVE::LXC::check_running($vmid) ? 1 : 0;
2243         print STDERR "Migrating CT $vmid\n";
2244         $upid = PVE::API2::LXC->migrate_vm(
2245            { node => $nodename, vmid => $vmid, target => $target, restart => $online });
2246     } elsif ($type eq 'qemu') {
2247         print STDERR "Check VM $vmid: ";
2248         *STDERR->flush();
2249         my $online = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
2250         my $preconditions = PVE::API2::Qemu->migrate_vm_precondition(
2251             {node => $nodename, vmid => $vmid, target => $target});
2252         my $invalidConditions = '';
2253         if ($online && !$with_local_disks && scalar @{$preconditions->{local_disks}}) {
2254             $invalidConditions .= "\n  Has local disks: ";
2255             $invalidConditions .= join(', ', map { $_->{volid} } @{$preconditions->{local_disks}});
2256         }
2257
2258         if (@{$preconditions->{local_resources}}) {
2259             $invalidConditions .= "\n  Has local resources: ";
2260             $invalidConditions .= join(', ', @{$preconditions->{local_resources}});
2261         }
2262
2263         if ($invalidConditions && $invalidConditions ne '') {
2264             print STDERR "skip VM $vmid - precondition check failed:";
2265             die "$invalidConditions\n";
2266         }
2267         print STDERR "precondition check passed\n";
2268         print STDERR "Migrating VM $vmid\n";
2269
2270         my $params = {
2271             node => $nodename,
2272             vmid => $vmid,
2273             target => $target,
2274             online => $online,
2275         };
2276         $params->{'with-local-disks'} = $with_local_disks if defined($with_local_disks);
2277
2278         $upid = PVE::API2::Qemu->migrate_vm($params);
2279     } else {
2280         die "unknown VM type '$type'\n";
2281     }
2282
2283     my $task = PVE::Tools::upid_decode($upid);
2284
2285     return $task->{pid};
2286 };
2287
2288 __PACKAGE__->register_method ({
2289     name => 'migrateall',
2290     path => 'migrateall',
2291     method => 'POST',
2292     proxyto => 'node',
2293     protected => 1,
2294     permissions => {
2295         description => "The 'VM.Migrate' permission is required on '/' or on '/vms/<ID>' for each "
2296             ."ID passed via the 'vms' parameter.",
2297         user => 'all',
2298     },
2299     description => "Migrate all VMs and Containers.",
2300     parameters => {
2301         additionalProperties => 0,
2302         properties => {
2303             node => get_standard_option('pve-node'),
2304             target => get_standard_option('pve-node', { description => "Target node." }),
2305             maxworkers => {
2306                 description => "Maximal number of parallel migration job. If not set, uses"
2307                     ."'max_workers' from datacenter.cfg. One of both must be set!",
2308                 optional => 1,
2309                 type => 'integer',
2310                 minimum => 1
2311             },
2312             vms => {
2313                 description => "Only consider Guests with these IDs.",
2314                 type => 'string',  format => 'pve-vmid-list',
2315                 optional => 1,
2316             },
2317             "with-local-disks" => {
2318                 type => 'boolean',
2319                 description => "Enable live storage migration for local disk",
2320                 optional => 1,
2321             },
2322         },
2323     },
2324     returns => {
2325         type => 'string',
2326     },
2327     code => sub {
2328         my ($param) = @_;
2329
2330         my $rpcenv = PVE::RPCEnvironment::get();
2331         my $authuser = $rpcenv->get_user();
2332
2333         if (!$rpcenv->check($authuser, "/", [ 'VM.Migrate' ], 1)) {
2334             my @vms = PVE::Tools::split_list($param->{vms});
2335             if (scalar(@vms) > 0) {
2336                 $rpcenv->check($authuser, "/vms/$_", [ 'VM.Migrate' ]) for @vms;
2337             } else {
2338                 raise_perm_exc("/, VM.Migrate");
2339             }
2340         }
2341
2342         my $nodename = $param->{node};
2343         $nodename = PVE::INotify::nodename() if $nodename eq 'localhost';
2344
2345         my $target = $param->{target};
2346         my $with_local_disks = $param->{'with-local-disks'};
2347         raise_param_exc({ target => "target is local node."}) if $target eq $nodename;
2348
2349         PVE::Cluster::check_cfs_quorum();
2350
2351         PVE::Cluster::check_node_exists($target);
2352
2353         my $datacenterconfig = cfs_read_file('datacenter.cfg');
2354         # prefer parameter over datacenter cfg settings
2355         my $maxWorkers = $param->{maxworkers} || $datacenterconfig->{max_workers} ||
2356             die "either 'maxworkers' parameter or max_workers in datacenter.cfg must be set!\n";
2357
2358         my $code = sub {
2359             $rpcenv->{type} = 'priv'; # to start tasks in background
2360
2361             my $vmlist = &$get_filtered_vmlist($nodename, $param->{vms}, 1, 1);
2362             if (!scalar(keys %$vmlist)) {
2363                 warn "no virtual guests matched, nothing to do..\n";
2364                 return;
2365             }
2366
2367             my $workers = {};
2368             my $workers_started = 0;
2369             foreach my $vmid (sort keys %$vmlist) {
2370                 my $d = $vmlist->{$vmid};
2371                 my $pid;
2372                 eval { $pid = &$create_migrate_worker($nodename, $d->{type}, $vmid, $target, $with_local_disks); };
2373                 warn $@ if $@;
2374                 next if !$pid;
2375
2376                 $workers_started++;
2377                 $workers->{$pid} = 1;
2378                 while (scalar(keys %$workers) >= $maxWorkers) {
2379                     foreach my $p (keys %$workers) {
2380                         if (!PVE::ProcFSTools::check_process_running($p)) {
2381                             delete $workers->{$p};
2382                         }
2383                     }
2384                     sleep(1);
2385                 }
2386             }
2387             while (scalar(keys %$workers)) {
2388                 foreach my $p (keys %$workers) {
2389                     # FIXME: what about PID re-use ?!?!
2390                     if (!PVE::ProcFSTools::check_process_running($p)) {
2391                         delete $workers->{$p};
2392                     }
2393                 }
2394                 sleep(1);
2395             }
2396             if ($workers_started <= 0) {
2397                 die "no migrations worker started...\n";
2398             }
2399             print STDERR "All jobs finished, used $workers_started workers in total.\n";
2400             return;
2401         };
2402
2403         return $rpcenv->fork_worker('migrateall', undef, $authuser, $code);
2404
2405     }});
2406
2407 __PACKAGE__->register_method ({
2408     name => 'get_etc_hosts',
2409     path => 'hosts',
2410     method => 'GET',
2411     proxyto => 'node',
2412     protected => 1,
2413     permissions => {
2414         check => ['perm', '/', [ 'Sys.Audit' ]],
2415     },
2416     description => "Get the content of /etc/hosts.",
2417     parameters => {
2418         additionalProperties => 0,
2419         properties => {
2420             node => get_standard_option('pve-node'),
2421         },
2422     },
2423     returns => {
2424         type => 'object',
2425         properties => {
2426             digest => get_standard_option('pve-config-digest'),
2427             data => {
2428                 type => 'string',
2429                 description => 'The content of /etc/hosts.'
2430             },
2431         },
2432     },
2433     code => sub {
2434         my ($param) = @_;
2435
2436         return PVE::INotify::read_file('etchosts');
2437
2438     }});
2439
2440 __PACKAGE__->register_method ({
2441     name => 'write_etc_hosts',
2442     path => 'hosts',
2443     method => 'POST',
2444     proxyto => 'node',
2445     protected => 1,
2446     permissions => {
2447         check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
2448     },
2449     description => "Write /etc/hosts.",
2450     parameters => {
2451         additionalProperties => 0,
2452         properties => {
2453             node => get_standard_option('pve-node'),
2454             digest => get_standard_option('pve-config-digest'),
2455             data => {
2456                 type => 'string',
2457                 description =>  'The target content of /etc/hosts.'
2458             },
2459         },
2460     },
2461     returns => {
2462         type => 'null',
2463     },
2464     code => sub {
2465         my ($param) = @_;
2466
2467         PVE::Tools::lock_file('/var/lock/pve-etchosts.lck', undef, sub {
2468             if ($param->{digest}) {
2469                 my $hosts = PVE::INotify::read_file('etchosts');
2470                 PVE::Tools::assert_if_modified($hosts->{digest}, $param->{digest});
2471             }
2472             PVE::INotify::write_file('etchosts', $param->{data});
2473         });
2474         die $@ if $@;
2475
2476         return;
2477     }});
2478
2479 # bash completion helper
2480
2481 sub complete_templet_repo {
2482     my ($cmdname, $pname, $cvalue) = @_;
2483
2484     my $repo = PVE::APLInfo::load_data();
2485     my $res = [];
2486     foreach my $templ (keys %{$repo->{all}}) {
2487         next if $templ !~ m/^$cvalue/;
2488         push @$res, $templ;
2489     }
2490
2491     return $res;
2492 }
2493
2494 package PVE::API2::Nodes;
2495
2496 use strict;
2497 use warnings;
2498
2499 use PVE::SafeSyslog;
2500 use PVE::Cluster;
2501 use PVE::RESTHandler;
2502 use PVE::RPCEnvironment;
2503 use PVE::API2Tools;
2504 use PVE::JSONSchema qw(get_standard_option);
2505
2506 use base qw(PVE::RESTHandler);
2507
2508 __PACKAGE__->register_method ({
2509     subclass => "PVE::API2::Nodes::Nodeinfo",
2510     path => '{node}',
2511 });
2512
2513 __PACKAGE__->register_method ({
2514     name => 'index',
2515     path => '',
2516     method => 'GET',
2517     permissions => { user => 'all' },
2518     description => "Cluster node index.",
2519     parameters => {
2520         additionalProperties => 0,
2521         properties => {},
2522     },
2523     returns => {
2524         type => 'array',
2525         items => {
2526             type => "object",
2527             properties => {
2528                 node => get_standard_option('pve-node'),
2529                 status => {
2530                     description => "Node status.",
2531                     type => 'string',
2532                     enum => ['unknown', 'online', 'offline'],
2533                 },
2534                 cpu => {
2535                     description => "CPU utilization.",
2536                     type => 'number',
2537                     optional => 1,
2538                     renderer => 'fraction_as_percentage',
2539                 },
2540                 maxcpu => {
2541                     description => "Number of available CPUs.",
2542                     type => 'integer',
2543                     optional => 1,
2544                 },
2545                 mem => {
2546                     description => "Used memory in bytes.",
2547                     type => 'integer',
2548                     optional => 1,
2549                     renderer => 'bytes',
2550                 },
2551                 maxmem => {
2552                     description => "Number of available memory in bytes.",
2553                     type => 'integer',
2554                     optional => 1,
2555                     renderer => 'bytes',
2556                 },
2557                 level => {
2558                     description => "Support level.",
2559                     type => 'string',
2560                     optional => 1,
2561                 },
2562                 uptime => {
2563                     description => "Node uptime in seconds.",
2564                     type => 'integer',
2565                     optional => 1,
2566                     renderer => 'duration',
2567                 },
2568                 ssl_fingerprint => {
2569                     description => "The SSL fingerprint for the node certificate.",
2570                     type => 'string',
2571                     optional => 1,
2572                 },
2573             },
2574         },
2575         links => [ { rel => 'child', href => "{node}" } ],
2576     },
2577     code => sub {
2578         my ($param) = @_;
2579
2580         my $rpcenv = PVE::RPCEnvironment::get();
2581         my $authuser = $rpcenv->get_user();
2582
2583         my $clinfo = PVE::Cluster::get_clinfo();
2584         my $res = [];
2585
2586         my $nodelist = PVE::Cluster::get_nodelist();
2587         my $members = PVE::Cluster::get_members();
2588         my $rrd = PVE::Cluster::rrd_dump();
2589
2590         foreach my $node (@$nodelist) {
2591             my $can_audit = $rpcenv->check($authuser, "/nodes/$node", [ 'Sys.Audit' ], 1);
2592             my $entry = PVE::API2Tools::extract_node_stats($node, $members, $rrd, !$can_audit);
2593
2594             $entry->{ssl_fingerprint} = eval { PVE::Cluster::get_node_fingerprint($node) };
2595             warn "$@" if $@;
2596
2597             push @$res, $entry;
2598         }
2599
2600         return $res;
2601     }});
2602
2603 1;