PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6 use Net::SSLeay;
   7 use UUID;
   8 use POSIX;
   9 use IO::Socket::IP;
  10
  11 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools qw(extract_param);
  14 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  15 use PVE::Storage;
  16 use PVE::JSONSchema qw(get_standard_option);
  17 use PVE::RESTHandler;
  18 use PVE::ReplicationConfig;
  19 use PVE::GuestHelpers;
  20 use PVE::QemuConfig;
  21 use PVE::QemuServer;
  22 use PVE::QemuMigrate;
  23 use PVE::RPCEnvironment;
  24 use PVE::AccessControl;
  25 use PVE::INotify;
  26 use PVE::Network;
  27 use PVE::Firewall;
  28 use PVE::API2::Firewall::VM;
  29
  30 BEGIN {
  31     if (!$ENV{PVE_GENERATING_DOCS}) {
  32         require PVE::HA::Env::PVE2;
  33         import PVE::HA::Env::PVE2;
  34         require PVE::HA::Config;
  35         import PVE::HA::Config;
  36     }
  37 }
  38
  39 use Data::Dumper; # fixme: remove
  40
  41 use base qw(PVE::RESTHandler);
  42
  43 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  44
  45 my $resolve_cdrom_alias = sub {
  46     my $param = shift;
  47
  48     if (my $value = $param->{cdrom}) {
  49         $value .= ",media=cdrom" if $value !~ m/media=/;
  50         $param->{ide2} = $value;
  51         delete $param->{cdrom};
  52     }
  53 };
  54
  55 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
  56 my $check_storage_access = sub {
  57    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  58
  59    PVE::QemuServer::foreach_drive($settings, sub {
  60         my ($ds, $drive) = @_;
  61
  62         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  63
  64         my $volid = $drive->{file};
  65
  66         if (!$volid || $volid eq 'none') {
  67             # nothing to check
  68         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  69             $rpcenv->check($authuser, "/", ['Sys.Console']);
  70         } elsif (!$isCDROM && ($volid =~ $NEW_DISK_RE)) {
  71             my ($storeid, $size) = ($2 || $default_storage, $3);
  72             die "no storage ID specified (and no default storage)\n" if !$storeid;
  73             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  74             my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
  75             raise_param_exc({ storage => "storage '$storeid' does not support vm images"})
  76                 if !$scfg->{content}->{images};
  77         } else {
  78             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
  79         }
  80     });
  81 };
  82
  83 my $check_storage_access_clone = sub {
  84    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  85
  86    my $sharedvm = 1;
  87
  88    PVE::QemuServer::foreach_drive($conf, sub {
  89         my ($ds, $drive) = @_;
  90
  91         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  92
  93         my $volid = $drive->{file};
  94
  95         return if !$volid || $volid eq 'none';
  96
  97         if ($isCDROM) {
  98             if ($volid eq 'cdrom') {
  99                 $rpcenv->check($authuser, "/", ['Sys.Console']);
 100             } else {
 101                 # we simply allow access
 102                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 103                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 104                 $sharedvm = 0 if !$scfg->{shared};
 105
 106             }
 107         } else {
 108             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 109             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 110             $sharedvm = 0 if !$scfg->{shared};
 111
 112             $sid = $storage if $storage;
 113             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 114         }
 115     });
 116
 117    return $sharedvm;
 118 };
 119
 120 # Note: $pool is only needed when creating a VM, because pool permissions
 121 # are automatically inherited if VM already exists inside a pool.
 122 my $create_disks = sub {
 123     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 124
 125     my $vollist = [];
 126
 127     my $res = {};
 128
 129     my $code = sub {
 130         my ($ds, $disk) = @_;
 131
 132         my $volid = $disk->{file};
 133
 134         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 135             delete $disk->{size};
 136             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 137         } elsif ($volid =~ $NEW_DISK_RE) {
 138             my ($storeid, $size) = ($2 || $default_storage, $3);
 139             die "no storage ID specified (and no default storage)\n" if !$storeid;
 140             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 141             my $fmt = $disk->{format} || $defformat;
 142
 143             $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
 144
 145             my $volid;
 146             if ($ds eq 'efidisk0') {
 147                 # handle efidisk
 148                 my $ovmfvars = '/usr/share/kvm/OVMF_VARS-pure-efi.fd';
 149                 die "uefi vars image not found\n" if ! -f $ovmfvars;
 150                 $size = PVE::Tools::convert_size(-s $ovmfvars, 'b' => 'kb');
 151                 $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
 152                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
 153                 my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
 154                 my $qemufmt = PVE::QemuServer::qemu_img_format($scfg, $volname);
 155                 my $path = PVE::Storage::path($storecfg, $volid);
 156                 my $efidiskcmd = ['/usr/bin/qemu-img', 'convert', '-n', '-f', 'raw', '-O', $qemufmt];
 157                 push @$efidiskcmd, $ovmfvars;
 158                 push @$efidiskcmd, $path;
 159
 160                 PVE::Storage::activate_volumes($storecfg, [$volid]);
 161
 162                 eval { PVE::Tools::run_command($efidiskcmd); };
 163                 my $err = $@;
 164                 die "Copying of EFI Vars image failed: $err" if $err;
 165             } else {
 166                 $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
 167             }
 168             push @$vollist, $volid;
 169             $disk->{file} = $volid;
 170             $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
 171             delete $disk->{format}; # no longer needed
 172             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 173         } else {
 174
 175             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
 176
 177             my $volid_is_new = 1;
 178
 179             if ($conf->{$ds}) {
 180                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 181                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 182             }
 183
 184             if ($volid_is_new) {
 185
 186                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 187
 188                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 189
 190                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 191
 192                 die "volume $volid does not exists\n" if !$size;
 193
 194                 $disk->{size} = $size;
 195             }
 196
 197             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 198         }
 199     };
 200
 201     eval { PVE::QemuServer::foreach_drive($settings, $code); };
 202
 203     # free allocated images on error
 204     if (my $err = $@) {
 205         syslog('err', "VM $vmid creating disks failed");
 206         foreach my $volid (@$vollist) {
 207             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 208             warn $@ if $@;
 209         }
 210         die $err;
 211     }
 212
 213     # modify vm config if everything went well
 214     foreach my $ds (keys %$res) {
 215         $conf->{$ds} = $res->{$ds};
 216     }
 217
 218     return $vollist;
 219 };
 220
 221 my $cpuoptions = {
 222     'cores' => 1,
 223     'cpu' => 1,
 224     'cpulimit' => 1,
 225     'cpuunits' => 1,
 226     'numa' => 1,
 227     'smp' => 1,
 228     'sockets' => 1,
 229     'vcpus' => 1,
 230 };
 231
 232 my $memoryoptions = {
 233     'memory' => 1,
 234     'balloon' => 1,
 235     'shares' => 1,
 236 };
 237
 238 my $hwtypeoptions = {
 239     'acpi' => 1,
 240     'hotplug' => 1,
 241     'kvm' => 1,
 242     'machine' => 1,
 243     'scsihw' => 1,
 244     'smbios1' => 1,
 245     'tablet' => 1,
 246     'vga' => 1,
 247     'watchdog' => 1,
 248 };
 249
 250 my $generaloptions = {
 251     'agent' => 1,
 252     'autostart' => 1,
 253     'bios' => 1,
 254     'description' => 1,
 255     'keyboard' => 1,
 256     'localtime' => 1,
 257     'migrate_downtime' => 1,
 258     'migrate_speed' => 1,
 259     'name' => 1,
 260     'onboot' => 1,
 261     'ostype' => 1,
 262     'protection' => 1,
 263     'reboot' => 1,
 264     'startdate' => 1,
 265     'startup' => 1,
 266     'tdf' => 1,
 267     'template' => 1,
 268 };
 269
 270 my $vmpoweroptions = {
 271     'freeze' => 1,
 272 };
 273
 274 my $diskoptions = {
 275     'boot' => 1,
 276     'bootdisk' => 1,
 277 };
 278
 279 my $check_vm_modify_config_perm = sub {
 280     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 281
 282     return 1 if $authuser eq 'root@pam';
 283
 284     foreach my $opt (@$key_list) {
 285         # disk checks need to be done somewhere else
 286         next if PVE::QemuServer::is_valid_drivename($opt);
 287         next if $opt eq 'cdrom';
 288         next if $opt =~ m/^unused\d+$/;
 289
 290         if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
 291             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 292         } elsif ($memoryoptions->{$opt}) {
 293             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 294         } elsif ($hwtypeoptions->{$opt}) {
 295             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 296         } elsif ($generaloptions->{$opt}) {
 297             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 298             # special case for startup since it changes host behaviour
 299             if ($opt eq 'startup') {
 300                 $rpcenv->check_full($authuser, "/", ['Sys.Modify']);
 301             }
 302         } elsif ($vmpoweroptions->{$opt}) {
 303             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
 304         } elsif ($diskoptions->{$opt}) {
 305             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 306         } elsif ($opt =~ m/^net\d+$/) {
 307             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 308         } else {
 309             # catches usb\d+, hostpci\d+, args, lock, etc.
 310             # new options will be checked here
 311             die "only root can set '$opt' config\n";
 312         }
 313     }
 314
 315     return 1;
 316 };
 317
 318 __PACKAGE__->register_method({
 319     name => 'vmlist',
 320     path => '',
 321     method => 'GET',
 322     description => "Virtual machine index (per node).",
 323     permissions => {
 324         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 325         user => 'all',
 326     },
 327     proxyto => 'node',
 328     protected => 1, # qemu pid files are only readable by root
 329     parameters => {
 330         additionalProperties => 0,
 331         properties => {
 332             node => get_standard_option('pve-node'),
 333             full => {
 334                 type => 'boolean',
 335                 optional => 1,
 336                 description => "Determine the full status of active VMs.",
 337             },
 338         },
 339     },
 340     returns => {
 341         type => 'array',
 342         items => {
 343             type => "object",
 344             properties => {},
 345         },
 346         links => [ { rel => 'child', href => "{vmid}" } ],
 347     },
 348     code => sub {
 349         my ($param) = @_;
 350
 351         my $rpcenv = PVE::RPCEnvironment::get();
 352         my $authuser = $rpcenv->get_user();
 353
 354         my $vmstatus = PVE::QemuServer::vmstatus(undef, $param->{full});
 355
 356         my $res = [];
 357         foreach my $vmid (keys %$vmstatus) {
 358             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 359
 360             my $data = $vmstatus->{$vmid};
 361             $data->{vmid} = int($vmid);
 362             push @$res, $data;
 363         }
 364
 365         return $res;
 366     }});
 367
 368
 369
 370 __PACKAGE__->register_method({
 371     name => 'create_vm',
 372     path => '',
 373     method => 'POST',
 374     description => "Create or restore a virtual machine.",
 375     permissions => {
 376         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 377             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 378             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 379         user => 'all', # check inside
 380     },
 381     protected => 1,
 382     proxyto => 'node',
 383     parameters => {
 384         additionalProperties => 0,
 385         properties => PVE::QemuServer::json_config_properties(
 386             {
 387                 node => get_standard_option('pve-node'),
 388                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 389                 archive => {
 390                     description => "The backup file.",
 391                     type => 'string',
 392                     optional => 1,
 393                     maxLength => 255,
 394                     completion => \&PVE::QemuServer::complete_backup_archives,
 395                 },
 396                 storage => get_standard_option('pve-storage-id', {
 397                     description => "Default storage.",
 398                     optional => 1,
 399                     completion => \&PVE::QemuServer::complete_storage,
 400                 }),
 401                 force => {
 402                     optional => 1,
 403                     type => 'boolean',
 404                     description => "Allow to overwrite existing VM.",
 405                     requires => 'archive',
 406                 },
 407                 unique => {
 408                     optional => 1,
 409                     type => 'boolean',
 410                     description => "Assign a unique random ethernet address.",
 411                     requires => 'archive',
 412                 },
 413                 pool => {
 414                     optional => 1,
 415                     type => 'string', format => 'pve-poolid',
 416                     description => "Add the VM to the specified pool.",
 417                 },
 418             }),
 419     },
 420     returns => {
 421         type => 'string',
 422     },
 423     code => sub {
 424         my ($param) = @_;
 425
 426         my $rpcenv = PVE::RPCEnvironment::get();
 427
 428         my $authuser = $rpcenv->get_user();
 429
 430         my $node = extract_param($param, 'node');
 431
 432         my $vmid = extract_param($param, 'vmid');
 433
 434         my $archive = extract_param($param, 'archive');
 435
 436         my $storage = extract_param($param, 'storage');
 437
 438         my $force = extract_param($param, 'force');
 439
 440         my $unique = extract_param($param, 'unique');
 441
 442         my $pool = extract_param($param, 'pool');
 443
 444         my $filename = PVE::QemuConfig->config_file($vmid);
 445
 446         my $storecfg = PVE::Storage::config();
 447
 448         PVE::Cluster::check_cfs_quorum();
 449
 450         if (defined($pool)) {
 451             $rpcenv->check_pool_exist($pool);
 452         }
 453
 454         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 455             if defined($storage);
 456
 457         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 458             # OK
 459         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 460             # OK
 461         } elsif ($archive && $force && (-f $filename) &&
 462                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 463             # OK: user has VM.Backup permissions, and want to restore an existing VM
 464         } else {
 465             raise_perm_exc();
 466         }
 467
 468         if (!$archive) {
 469             &$resolve_cdrom_alias($param);
 470
 471             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 472
 473             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 474
 475             foreach my $opt (keys %$param) {
 476                 if (PVE::QemuServer::is_valid_drivename($opt)) {
 477                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 478                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 479
 480                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 481                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 482                 }
 483             }
 484
 485             PVE::QemuServer::add_random_macs($param);
 486         } else {
 487             my $keystr = join(' ', keys %$param);
 488             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 489
 490             if ($archive eq '-') {
 491                 die "pipe requires cli environment\n"
 492                     if $rpcenv->{type} ne 'cli';
 493             } else {
 494                 PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
 495                 $archive = PVE::Storage::abs_filesystem_path($storecfg, $archive);
 496             }
 497         }
 498
 499         my $restorefn = sub {
 500             my $vmlist = PVE::Cluster::get_vmlist();
 501             if ($vmlist->{ids}->{$vmid}) {
 502                 my $current_node = $vmlist->{ids}->{$vmid}->{node};
 503                 if ($current_node eq $node) {
 504                     my $conf = PVE::QemuConfig->load_config($vmid);
 505
 506                     PVE::QemuConfig->check_protection($conf, "unable to restore VM $vmid");
 507
 508                     die "unable to restore vm $vmid - config file already exists\n"
 509                         if !$force;
 510
 511                     die "unable to restore vm $vmid - vm is running\n"
 512                         if PVE::QemuServer::check_running($vmid);
 513
 514                     die "unable to restore vm $vmid - vm is a template\n"
 515                         if PVE::QemuConfig->is_template($conf);
 516
 517                 } else {
 518                     die "unable to restore vm $vmid - already existing on cluster node '$current_node'\n";
 519                 }
 520             }
 521
 522             my $realcmd = sub {
 523                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 524                     storage => $storage,
 525                     pool => $pool,
 526                     unique => $unique });
 527
 528                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 529             };
 530
 531             # ensure no old replication state are exists
 532             PVE::ReplicationState::delete_guest_states($vmid);
 533
 534             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 535         };
 536
 537         my $createfn = sub {
 538
 539             # test after locking
 540             PVE::Cluster::check_vmid_unused($vmid);
 541
 542             # ensure no old replication state are exists
 543             PVE::ReplicationState::delete_guest_states($vmid);
 544
 545             my $realcmd = sub {
 546
 547                 my $vollist = [];
 548
 549                 my $conf = $param;
 550
 551                 eval {
 552
 553                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 554
 555                     # try to be smart about bootdisk
 556                     my @disks = PVE::QemuServer::valid_drive_names();
 557                     my $firstdisk;
 558                     foreach my $ds (reverse @disks) {
 559                         next if !$conf->{$ds};
 560                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 561                         next if PVE::QemuServer::drive_is_cdrom($disk);
 562                         $firstdisk = $ds;
 563                     }
 564
 565                     if (!$conf->{bootdisk} && $firstdisk) {
 566                         $conf->{bootdisk} = $firstdisk;
 567                     }
 568
 569                     # auto generate uuid if user did not specify smbios1 option
 570                     if (!$conf->{smbios1}) {
 571                         my ($uuid, $uuid_str);
 572                         UUID::generate($uuid);
 573                         UUID::unparse($uuid, $uuid_str);
 574                         $conf->{smbios1} = "uuid=$uuid_str";
 575                     }
 576
 577                     PVE::QemuConfig->write_config($vmid, $conf);
 578
 579                 };
 580                 my $err = $@;
 581
 582                 if ($err) {
 583                     foreach my $volid (@$vollist) {
 584                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 585                         warn $@ if $@;
 586                     }
 587                     die "create failed - $err";
 588                 }
 589
 590                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 591             };
 592
 593             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 594         };
 595
 596         return PVE::QemuConfig->lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 597     }});
 598
 599 __PACKAGE__->register_method({
 600     name => 'vmdiridx',
 601     path => '{vmid}',
 602     method => 'GET',
 603     proxyto => 'node',
 604     description => "Directory index",
 605     permissions => {
 606         user => 'all',
 607     },
 608     parameters => {
 609         additionalProperties => 0,
 610         properties => {
 611             node => get_standard_option('pve-node'),
 612             vmid => get_standard_option('pve-vmid'),
 613         },
 614     },
 615     returns => {
 616         type => 'array',
 617         items => {
 618             type => "object",
 619             properties => {
 620                 subdir => { type => 'string' },
 621             },
 622         },
 623         links => [ { rel => 'child', href => "{subdir}" } ],
 624     },
 625     code => sub {
 626         my ($param) = @_;
 627
 628         my $res = [
 629             { subdir => 'config' },
 630             { subdir => 'pending' },
 631             { subdir => 'status' },
 632             { subdir => 'unlink' },
 633             { subdir => 'vncproxy' },
 634             { subdir => 'migrate' },
 635             { subdir => 'resize' },
 636             { subdir => 'move' },
 637             { subdir => 'rrd' },
 638             { subdir => 'rrddata' },
 639             { subdir => 'monitor' },
 640             { subdir => 'agent' },
 641             { subdir => 'snapshot' },
 642             { subdir => 'spiceproxy' },
 643             { subdir => 'sendkey' },
 644             { subdir => 'firewall' },
 645             ];
 646
 647         return $res;
 648     }});
 649
 650 __PACKAGE__->register_method ({
 651     subclass => "PVE::API2::Firewall::VM",
 652     path => '{vmid}/firewall',
 653 });
 654
 655 __PACKAGE__->register_method({
 656     name => 'rrd',
 657     path => '{vmid}/rrd',
 658     method => 'GET',
 659     protected => 1, # fixme: can we avoid that?
 660     permissions => {
 661         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 662     },
 663     description => "Read VM RRD statistics (returns PNG)",
 664     parameters => {
 665         additionalProperties => 0,
 666         properties => {
 667             node => get_standard_option('pve-node'),
 668             vmid => get_standard_option('pve-vmid'),
 669             timeframe => {
 670                 description => "Specify the time frame you are interested in.",
 671                 type => 'string',
 672                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 673             },
 674             ds => {
 675                 description => "The list of datasources you want to display.",
 676                 type => 'string', format => 'pve-configid-list',
 677             },
 678             cf => {
 679                 description => "The RRD consolidation function",
 680                 type => 'string',
 681                 enum => [ 'AVERAGE', 'MAX' ],
 682                 optional => 1,
 683             },
 684         },
 685     },
 686     returns => {
 687         type => "object",
 688         properties => {
 689             filename => { type => 'string' },
 690         },
 691     },
 692     code => sub {
 693         my ($param) = @_;
 694
 695         return PVE::Cluster::create_rrd_graph(
 696             "pve2-vm/$param->{vmid}", $param->{timeframe},
 697             $param->{ds}, $param->{cf});
 698
 699     }});
 700
 701 __PACKAGE__->register_method({
 702     name => 'rrddata',
 703     path => '{vmid}/rrddata',
 704     method => 'GET',
 705     protected => 1, # fixme: can we avoid that?
 706     permissions => {
 707         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 708     },
 709     description => "Read VM RRD statistics",
 710     parameters => {
 711         additionalProperties => 0,
 712         properties => {
 713             node => get_standard_option('pve-node'),
 714             vmid => get_standard_option('pve-vmid'),
 715             timeframe => {
 716                 description => "Specify the time frame you are interested in.",
 717                 type => 'string',
 718                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 719             },
 720             cf => {
 721                 description => "The RRD consolidation function",
 722                 type => 'string',
 723                 enum => [ 'AVERAGE', 'MAX' ],
 724                 optional => 1,
 725             },
 726         },
 727     },
 728     returns => {
 729         type => "array",
 730         items => {
 731             type => "object",
 732             properties => {},
 733         },
 734     },
 735     code => sub {
 736         my ($param) = @_;
 737
 738         return PVE::Cluster::create_rrd_data(
 739             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 740     }});
 741
 742
 743 __PACKAGE__->register_method({
 744     name => 'vm_config',
 745     path => '{vmid}/config',
 746     method => 'GET',
 747     proxyto => 'node',
 748     description => "Get current virtual machine configuration. This does not include pending configuration changes (see 'pending' API).",
 749     permissions => {
 750         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 751     },
 752     parameters => {
 753         additionalProperties => 0,
 754         properties => {
 755             node => get_standard_option('pve-node'),
 756             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 757             current => {
 758                 description => "Get current values (instead of pending values).",
 759                 optional => 1,
 760                 default => 0,
 761                 type => 'boolean',
 762             },
 763         },
 764     },
 765     returns => {
 766         type => "object",
 767         properties => {
 768             digest => {
 769                 type => 'string',
 770                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 771             }
 772         },
 773     },
 774     code => sub {
 775         my ($param) = @_;
 776
 777         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 778
 779         delete $conf->{snapshots};
 780
 781         if (!$param->{current}) {
 782             foreach my $opt (keys %{$conf->{pending}}) {
 783                 next if $opt eq 'delete';
 784                 my $value = $conf->{pending}->{$opt};
 785                 next if ref($value); # just to be sure
 786                 $conf->{$opt} = $value;
 787             }
 788             my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 789             foreach my $opt (keys %$pending_delete_hash) {
 790                 delete $conf->{$opt} if $conf->{$opt};
 791             }
 792         }
 793
 794         delete $conf->{pending};
 795
 796         return $conf;
 797     }});
 798
 799 __PACKAGE__->register_method({
 800     name => 'vm_pending',
 801     path => '{vmid}/pending',
 802     method => 'GET',
 803     proxyto => 'node',
 804     description => "Get virtual machine configuration, including pending changes.",
 805     permissions => {
 806         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 807     },
 808     parameters => {
 809         additionalProperties => 0,
 810         properties => {
 811             node => get_standard_option('pve-node'),
 812             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 813         },
 814     },
 815     returns => {
 816         type => "array",
 817         items => {
 818             type => "object",
 819             properties => {
 820                 key => {
 821                     description => "Configuration option name.",
 822                     type => 'string',
 823                 },
 824                 value => {
 825                     description => "Current value.",
 826                     type => 'string',
 827                     optional => 1,
 828                 },
 829                 pending => {
 830                     description => "Pending value.",
 831                     type => 'string',
 832                     optional => 1,
 833                 },
 834                 delete => {
 835                     description => "Indicates a pending delete request if present and not 0. " .
 836                                    "The value 2 indicates a force-delete request.",
 837                     type => 'integer',
 838                     minimum => 0,
 839                     maximum => 2,
 840                     optional => 1,
 841                 },
 842             },
 843         },
 844     },
 845     code => sub {
 846         my ($param) = @_;
 847
 848         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 849
 850         my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 851
 852         my $res = [];
 853
 854         foreach my $opt (keys %$conf) {
 855             next if ref($conf->{$opt});
 856             my $item = { key => $opt };
 857             $item->{value} = $conf->{$opt} if defined($conf->{$opt});
 858             $item->{pending} = $conf->{pending}->{$opt} if defined($conf->{pending}->{$opt});
 859             $item->{delete} = ($pending_delete_hash->{$opt} ? 2 : 1) if exists $pending_delete_hash->{$opt};
 860             push @$res, $item;
 861         }
 862
 863         foreach my $opt (keys %{$conf->{pending}}) {
 864             next if $opt eq 'delete';
 865             next if ref($conf->{pending}->{$opt}); # just to be sure
 866             next if defined($conf->{$opt});
 867             my $item = { key => $opt };
 868             $item->{pending} = $conf->{pending}->{$opt};
 869             push @$res, $item;
 870         }
 871
 872         while (my ($opt, $force) = each %$pending_delete_hash) {
 873             next if $conf->{pending}->{$opt}; # just to be sure
 874             next if $conf->{$opt};
 875             my $item = { key => $opt, delete => ($force ? 2 : 1)};
 876             push @$res, $item;
 877         }
 878
 879         return $res;
 880     }});
 881
 882 # POST/PUT {vmid}/config implementation
 883 #
 884 # The original API used PUT (idempotent) an we assumed that all operations
 885 # are fast. But it turned out that almost any configuration change can
 886 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 887 # time to complete and have side effects (not idempotent).
 888 #
 889 # The new implementation uses POST and forks a worker process. We added
 890 # a new option 'background_delay'. If specified we wait up to
 891 # 'background_delay' second for the worker task to complete. It returns null
 892 # if the task is finished within that time, else we return the UPID.
 893
 894 my $update_vm_api  = sub {
 895     my ($param, $sync) = @_;
 896
 897     my $rpcenv = PVE::RPCEnvironment::get();
 898
 899     my $authuser = $rpcenv->get_user();
 900
 901     my $node = extract_param($param, 'node');
 902
 903     my $vmid = extract_param($param, 'vmid');
 904
 905     my $digest = extract_param($param, 'digest');
 906
 907     my $background_delay = extract_param($param, 'background_delay');
 908
 909     my @paramarr = (); # used for log message
 910     foreach my $key (sort keys %$param) {
 911         push @paramarr, "-$key", $param->{$key};
 912     }
 913
 914     my $skiplock = extract_param($param, 'skiplock');
 915     raise_param_exc({ skiplock => "Only root may use this option." })
 916         if $skiplock && $authuser ne 'root@pam';
 917
 918     my $delete_str = extract_param($param, 'delete');
 919
 920     my $revert_str = extract_param($param, 'revert');
 921
 922     my $force = extract_param($param, 'force');
 923
 924     die "no options specified\n" if !$delete_str && !$revert_str && !scalar(keys %$param);
 925
 926     my $storecfg = PVE::Storage::config();
 927
 928     my $defaults = PVE::QemuServer::load_defaults();
 929
 930     &$resolve_cdrom_alias($param);
 931
 932     # now try to verify all parameters
 933
 934     my $revert = {};
 935     foreach my $opt (PVE::Tools::split_list($revert_str)) {
 936         if (!PVE::QemuServer::option_exists($opt)) {
 937             raise_param_exc({ revert => "unknown option '$opt'" });
 938         }
 939
 940         raise_param_exc({ delete => "you can't use '-$opt' and " .
 941                               "-revert $opt' at the same time" })
 942             if defined($param->{$opt});
 943
 944         $revert->{$opt} = 1;
 945     }
 946
 947     my @delete = ();
 948     foreach my $opt (PVE::Tools::split_list($delete_str)) {
 949         $opt = 'ide2' if $opt eq 'cdrom';
 950
 951         raise_param_exc({ delete => "you can't use '-$opt' and " .
 952                               "-delete $opt' at the same time" })
 953             if defined($param->{$opt});
 954
 955         raise_param_exc({ revert => "you can't use '-delete $opt' and " .
 956                               "-revert $opt' at the same time" })
 957             if $revert->{$opt};
 958
 959         if (!PVE::QemuServer::option_exists($opt)) {
 960             raise_param_exc({ delete => "unknown option '$opt'" });
 961         }
 962
 963         push @delete, $opt;
 964     }
 965
 966     my $repl_conf = PVE::ReplicationConfig->new();
 967     my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
 968     my $check_replication = sub {
 969         my ($drive) = @_;
 970         return if !$is_replicated;
 971         my $volid = $drive->{file};
 972         return if !$volid || !($drive->{replicate}//1);
 973         return if PVE::QemuServer::drive_is_cdrom($drive);
 974         my ($storeid, $format);
 975         if ($volid =~ $NEW_DISK_RE) {
 976             $storeid = $2;
 977             $format = $drive->{format} || PVE::Storage::storage_default_format($storecfg, $storeid);
 978         } else {
 979             ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
 980             $format = (PVE::Storage::parse_volname($storecfg, $volid))[6];
 981         }
 982         return if PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
 983         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
 984         return if $scfg->{shared};
 985         die "cannot add non-replicatable volume to a replicated VM\n";
 986     };
 987
 988     foreach my $opt (keys %$param) {
 989         if (PVE::QemuServer::is_valid_drivename($opt)) {
 990             # cleanup drive path
 991             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 992             raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 993             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 994             $check_replication->($drive);
 995             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 996         } elsif ($opt =~ m/^net(\d+)$/) {
 997             # add macaddr
 998             my $net = PVE::QemuServer::parse_net($param->{$opt});
 999             $param->{$opt} = PVE::QemuServer::print_net($net);
1000         }
1001     }
1002
1003     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
1004
1005     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
1006
1007     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
1008
1009     my $updatefn =  sub {
1010
1011         my $conf = PVE::QemuConfig->load_config($vmid);
1012
1013         die "checksum missmatch (file change by other user?)\n"
1014             if $digest && $digest ne $conf->{digest};
1015
1016         PVE::QemuConfig->check_lock($conf) if !$skiplock;
1017
1018         foreach my $opt (keys %$revert) {
1019             if (defined($conf->{$opt})) {
1020                 $param->{$opt} = $conf->{$opt};
1021             } elsif (defined($conf->{pending}->{$opt})) {
1022                 push @delete, $opt;
1023             }
1024         }
1025
1026         if ($param->{memory} || defined($param->{balloon})) {
1027             my $maxmem = $param->{memory} || $conf->{pending}->{memory} || $conf->{memory} || $defaults->{memory};
1028             my $balloon = defined($param->{balloon}) ? $param->{balloon} : $conf->{pending}->{balloon} || $conf->{balloon};
1029
1030             die "balloon value too large (must be smaller than assigned memory)\n"
1031                 if $balloon && $balloon > $maxmem;
1032         }
1033
1034         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
1035
1036         my $worker = sub {
1037
1038             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
1039
1040             # write updates to pending section
1041
1042             my $modified = {}; # record what $option we modify
1043
1044             foreach my $opt (@delete) {
1045                 $modified->{$opt} = 1;
1046                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1047                 if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
1048                     warn "cannot delete '$opt' - not set in current configuration!\n";
1049                     $modified->{$opt} = 0;
1050                     next;
1051                 }
1052
1053                 if ($opt =~ m/^unused/) {
1054                     my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
1055                     PVE::QemuConfig->check_protection($conf, "can't remove unused disk '$drive->{file}'");
1056                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1057                     if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, $drive, $rpcenv, $authuser)) {
1058                         delete $conf->{$opt};
1059                         PVE::QemuConfig->write_config($vmid, $conf);
1060                     }
1061                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
1062                     PVE::QemuConfig->check_protection($conf, "can't remove drive '$opt'");
1063                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1064                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1065                         if defined($conf->{pending}->{$opt});
1066                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1067                     PVE::QemuConfig->write_config($vmid, $conf);
1068                 } else {
1069                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1070                     PVE::QemuConfig->write_config($vmid, $conf);
1071                 }
1072             }
1073
1074             foreach my $opt (keys %$param) { # add/change
1075                 $modified->{$opt} = 1;
1076                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1077                 next if defined($conf->{pending}->{$opt}) && ($param->{$opt} eq $conf->{pending}->{$opt}); # skip if nothing changed
1078
1079                 if (PVE::QemuServer::is_valid_drivename($opt)) {
1080                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1081                     if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
1082                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
1083                     } else {
1084                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1085                     }
1086                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1087                         if defined($conf->{pending}->{$opt});
1088
1089                     &$create_disks($rpcenv, $authuser, $conf->{pending}, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
1090                 } else {
1091                     $conf->{pending}->{$opt} = $param->{$opt};
1092                 }
1093                 PVE::QemuServer::vmconfig_undelete_pending_option($conf, $opt);
1094                 PVE::QemuConfig->write_config($vmid, $conf);
1095             }
1096
1097             # remove pending changes when nothing changed
1098             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1099             my $changes = PVE::QemuServer::vmconfig_cleanup_pending($conf);
1100             PVE::QemuConfig->write_config($vmid, $conf) if $changes;
1101
1102             return if !scalar(keys %{$conf->{pending}});
1103
1104             my $running = PVE::QemuServer::check_running($vmid);
1105
1106             # apply pending changes
1107
1108             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1109
1110             if ($running) {
1111                 my $errors = {};
1112                 PVE::QemuServer::vmconfig_hotplug_pending($vmid, $conf, $storecfg, $modified, $errors);
1113                 raise_param_exc($errors) if scalar(keys %$errors);
1114             } else {
1115                 PVE::QemuServer::vmconfig_apply_pending($vmid, $conf, $storecfg, $running);
1116             }
1117
1118             return;
1119         };
1120
1121         if ($sync) {
1122             &$worker();
1123             return undef;
1124         } else {
1125             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1126
1127             if ($background_delay) {
1128
1129                 # Note: It would be better to do that in the Event based HTTPServer
1130                 # to avoid blocking call to sleep.
1131
1132                 my $end_time = time() + $background_delay;
1133
1134                 my $task = PVE::Tools::upid_decode($upid);
1135
1136                 my $running = 1;
1137                 while (time() < $end_time) {
1138                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1139                     last if !$running;
1140                     sleep(1); # this gets interrupted when child process ends
1141                 }
1142
1143                 if (!$running) {
1144                     my $status = PVE::Tools::upid_read_status($upid);
1145                     return undef if $status eq 'OK';
1146                     die $status;
1147                 }
1148             }
1149
1150             return $upid;
1151         }
1152     };
1153
1154     return PVE::QemuConfig->lock_config($vmid, $updatefn);
1155 };
1156
1157 my $vm_config_perm_list = [
1158             'VM.Config.Disk',
1159             'VM.Config.CDROM',
1160             'VM.Config.CPU',
1161             'VM.Config.Memory',
1162             'VM.Config.Network',
1163             'VM.Config.HWType',
1164             'VM.Config.Options',
1165     ];
1166
1167 __PACKAGE__->register_method({
1168     name => 'update_vm_async',
1169     path => '{vmid}/config',
1170     method => 'POST',
1171     protected => 1,
1172     proxyto => 'node',
1173     description => "Set virtual machine options (asynchrounous API).",
1174     permissions => {
1175         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1176     },
1177     parameters => {
1178         additionalProperties => 0,
1179         properties => PVE::QemuServer::json_config_properties(
1180             {
1181                 node => get_standard_option('pve-node'),
1182                 vmid => get_standard_option('pve-vmid'),
1183                 skiplock => get_standard_option('skiplock'),
1184                 delete => {
1185                     type => 'string', format => 'pve-configid-list',
1186                     description => "A list of settings you want to delete.",
1187                     optional => 1,
1188                 },
1189                 revert => {
1190                     type => 'string', format => 'pve-configid-list',
1191                     description => "Revert a pending change.",
1192                     optional => 1,
1193                 },
1194                 force => {
1195                     type => 'boolean',
1196                     description => $opt_force_description,
1197                     optional => 1,
1198                     requires => 'delete',
1199                 },
1200                 digest => {
1201                     type => 'string',
1202                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1203                     maxLength => 40,
1204                     optional => 1,
1205                 },
1206                 background_delay => {
1207                     type => 'integer',
1208                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1209                     minimum => 1,
1210                     maximum => 30,
1211                     optional => 1,
1212                 },
1213             }),
1214     },
1215     returns => {
1216         type => 'string',
1217         optional => 1,
1218     },
1219     code => $update_vm_api,
1220 });
1221
1222 __PACKAGE__->register_method({
1223     name => 'update_vm',
1224     path => '{vmid}/config',
1225     method => 'PUT',
1226     protected => 1,
1227     proxyto => 'node',
1228     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1229     permissions => {
1230         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1231     },
1232     parameters => {
1233         additionalProperties => 0,
1234         properties => PVE::QemuServer::json_config_properties(
1235             {
1236                 node => get_standard_option('pve-node'),
1237                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1238                 skiplock => get_standard_option('skiplock'),
1239                 delete => {
1240                     type => 'string', format => 'pve-configid-list',
1241                     description => "A list of settings you want to delete.",
1242                     optional => 1,
1243                 },
1244                 revert => {
1245                     type => 'string', format => 'pve-configid-list',
1246                     description => "Revert a pending change.",
1247                     optional => 1,
1248                 },
1249                 force => {
1250                     type => 'boolean',
1251                     description => $opt_force_description,
1252                     optional => 1,
1253                     requires => 'delete',
1254                 },
1255                 digest => {
1256                     type => 'string',
1257                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1258                     maxLength => 40,
1259                     optional => 1,
1260                 },
1261             }),
1262     },
1263     returns => { type => 'null' },
1264     code => sub {
1265         my ($param) = @_;
1266         &$update_vm_api($param, 1);
1267         return undef;
1268     }
1269 });
1270
1271
1272 __PACKAGE__->register_method({
1273     name => 'destroy_vm',
1274     path => '{vmid}',
1275     method => 'DELETE',
1276     protected => 1,
1277     proxyto => 'node',
1278     description => "Destroy the vm (also delete all used/owned volumes).",
1279     permissions => {
1280         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1281     },
1282     parameters => {
1283         additionalProperties => 0,
1284         properties => {
1285             node => get_standard_option('pve-node'),
1286             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1287             skiplock => get_standard_option('skiplock'),
1288         },
1289     },
1290     returns => {
1291         type => 'string',
1292     },
1293     code => sub {
1294         my ($param) = @_;
1295
1296         my $rpcenv = PVE::RPCEnvironment::get();
1297
1298         my $authuser = $rpcenv->get_user();
1299
1300         my $vmid = $param->{vmid};
1301
1302         my $skiplock = $param->{skiplock};
1303         raise_param_exc({ skiplock => "Only root may use this option." })
1304             if $skiplock && $authuser ne 'root@pam';
1305
1306         # test if VM exists
1307         my $conf = PVE::QemuConfig->load_config($vmid);
1308
1309         my $storecfg = PVE::Storage::config();
1310
1311         PVE::QemuConfig->check_protection($conf, "can't remove VM $vmid");
1312
1313         die "unable to remove VM $vmid - used in HA resources\n"
1314             if PVE::HA::Config::vm_is_ha_managed($vmid);
1315
1316         # do not allow destroy if there are replication jobs
1317         my $repl_conf = PVE::ReplicationConfig->new();
1318         $repl_conf->check_for_existing_jobs($vmid);
1319
1320         # early tests (repeat after locking)
1321         die "VM $vmid is running - destroy failed\n"
1322             if PVE::QemuServer::check_running($vmid);
1323
1324         my $realcmd = sub {
1325             my $upid = shift;
1326
1327             syslog('info', "destroy VM $vmid: $upid\n");
1328
1329             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1330
1331             PVE::AccessControl::remove_vm_access($vmid);
1332
1333             PVE::Firewall::remove_vmfw_conf($vmid);
1334         };
1335
1336         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1337     }});
1338
1339 __PACKAGE__->register_method({
1340     name => 'unlink',
1341     path => '{vmid}/unlink',
1342     method => 'PUT',
1343     protected => 1,
1344     proxyto => 'node',
1345     description => "Unlink/delete disk images.",
1346     permissions => {
1347         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1348     },
1349     parameters => {
1350         additionalProperties => 0,
1351         properties => {
1352             node => get_standard_option('pve-node'),
1353             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1354             idlist => {
1355                 type => 'string', format => 'pve-configid-list',
1356                 description => "A list of disk IDs you want to delete.",
1357             },
1358             force => {
1359                 type => 'boolean',
1360                 description => $opt_force_description,
1361                 optional => 1,
1362             },
1363         },
1364     },
1365     returns => { type => 'null'},
1366     code => sub {
1367         my ($param) = @_;
1368
1369         $param->{delete} = extract_param($param, 'idlist');
1370
1371         __PACKAGE__->update_vm($param);
1372
1373         return undef;
1374     }});
1375
1376 my $sslcert;
1377
1378 __PACKAGE__->register_method({
1379     name => 'vncproxy',
1380     path => '{vmid}/vncproxy',
1381     method => 'POST',
1382     protected => 1,
1383     permissions => {
1384         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1385     },
1386     description => "Creates a TCP VNC proxy connections.",
1387     parameters => {
1388         additionalProperties => 0,
1389         properties => {
1390             node => get_standard_option('pve-node'),
1391             vmid => get_standard_option('pve-vmid'),
1392             websocket => {
1393                 optional => 1,
1394                 type => 'boolean',
1395                 description => "starts websockify instead of vncproxy",
1396             },
1397         },
1398     },
1399     returns => {
1400         additionalProperties => 0,
1401         properties => {
1402             user => { type => 'string' },
1403             ticket => { type => 'string' },
1404             cert => { type => 'string' },
1405             port => { type => 'integer' },
1406             upid => { type => 'string' },
1407         },
1408     },
1409     code => sub {
1410         my ($param) = @_;
1411
1412         my $rpcenv = PVE::RPCEnvironment::get();
1413
1414         my $authuser = $rpcenv->get_user();
1415
1416         my $vmid = $param->{vmid};
1417         my $node = $param->{node};
1418         my $websocket = $param->{websocket};
1419
1420         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1421
1422         my $authpath = "/vms/$vmid";
1423
1424         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1425
1426         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1427             if !$sslcert;
1428
1429         my ($remip, $family);
1430         my $remcmd = [];
1431
1432         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1433             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1434             # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
1435             $remcmd = ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes', $remip];
1436         } else {
1437             $family = PVE::Tools::get_host_address_family($node);
1438         }
1439
1440         my $port = PVE::Tools::next_vnc_port($family);
1441
1442         my $timeout = 10;
1443
1444         my $realcmd = sub {
1445             my $upid = shift;
1446
1447             syslog('info', "starting vnc proxy $upid\n");
1448
1449             my $cmd;
1450
1451             if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
1452
1453                 die "Websocket mode is not supported in vga serial mode!" if $websocket;
1454
1455                 my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga} ];
1456                 #my $termcmd = "/usr/bin/qm terminal -iface $conf->{vga}";
1457                 $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
1458                         '-timeout', $timeout, '-authpath', $authpath,
1459                         '-perm', 'Sys.Console', '-c', @$remcmd, @$termcmd];
1460                 PVE::Tools::run_command($cmd);
1461             } else {
1462
1463                 $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
1464
1465                 $cmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1466
1467                 my $sock = IO::Socket::IP->new(
1468                     ReuseAddr => 1,
1469                     Listen => 1,
1470                     LocalPort => $port,
1471                     Proto => 'tcp',
1472                     GetAddrInfoFlags => 0,
1473                     ) or die "failed to create socket: $!\n";
1474                 # Inside the worker we shouldn't have any previous alarms
1475                 # running anyway...:
1476                 alarm(0);
1477                 local $SIG{ALRM} = sub { die "connection timed out\n" };
1478                 alarm $timeout;
1479                 accept(my $cli, $sock) or die "connection failed: $!\n";
1480                 alarm(0);
1481                 close($sock);
1482                 if (PVE::Tools::run_command($cmd,
1483                     output => '>&'.fileno($cli),
1484                     input => '<&'.fileno($cli),
1485                     noerr => 1) != 0)
1486                 {
1487                     die "Failed to run vncproxy.\n";
1488                 }
1489             }
1490
1491             return;
1492         };
1493
1494         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1495
1496         PVE::Tools::wait_for_vnc_port($port);
1497
1498         return {
1499             user => $authuser,
1500             ticket => $ticket,
1501             port => $port,
1502             upid => $upid,
1503             cert => $sslcert,
1504         };
1505     }});
1506
1507 __PACKAGE__->register_method({
1508     name => 'vncwebsocket',
1509     path => '{vmid}/vncwebsocket',
1510     method => 'GET',
1511     permissions => {
1512         description => "You also need to pass a valid ticket (vncticket).",
1513         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1514     },
1515     description => "Opens a weksocket for VNC traffic.",
1516     parameters => {
1517         additionalProperties => 0,
1518         properties => {
1519             node => get_standard_option('pve-node'),
1520             vmid => get_standard_option('pve-vmid'),
1521             vncticket => {
1522                 description => "Ticket from previous call to vncproxy.",
1523                 type => 'string',
1524                 maxLength => 512,
1525             },
1526             port => {
1527                 description => "Port number returned by previous vncproxy call.",
1528                 type => 'integer',
1529                 minimum => 5900,
1530                 maximum => 5999,
1531             },
1532         },
1533     },
1534     returns => {
1535         type => "object",
1536         properties => {
1537             port => { type => 'string' },
1538         },
1539     },
1540     code => sub {
1541         my ($param) = @_;
1542
1543         my $rpcenv = PVE::RPCEnvironment::get();
1544
1545         my $authuser = $rpcenv->get_user();
1546
1547         my $vmid = $param->{vmid};
1548         my $node = $param->{node};
1549
1550         my $authpath = "/vms/$vmid";
1551
1552         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1553
1554         my $conf = PVE::QemuConfig->load_config($vmid, $node); # VM exists ?
1555
1556         # Note: VNC ports are acessible from outside, so we do not gain any
1557         # security if we verify that $param->{port} belongs to VM $vmid. This
1558         # check is done by verifying the VNC ticket (inside VNC protocol).
1559
1560         my $port = $param->{port};
1561
1562         return { port => $port };
1563     }});
1564
1565 __PACKAGE__->register_method({
1566     name => 'spiceproxy',
1567     path => '{vmid}/spiceproxy',
1568     method => 'POST',
1569     protected => 1,
1570     proxyto => 'node',
1571     permissions => {
1572         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1573     },
1574     description => "Returns a SPICE configuration to connect to the VM.",
1575     parameters => {
1576         additionalProperties => 0,
1577         properties => {
1578             node => get_standard_option('pve-node'),
1579             vmid => get_standard_option('pve-vmid'),
1580             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1581         },
1582     },
1583     returns => get_standard_option('remote-viewer-config'),
1584     code => sub {
1585         my ($param) = @_;
1586
1587         my $rpcenv = PVE::RPCEnvironment::get();
1588
1589         my $authuser = $rpcenv->get_user();
1590
1591         my $vmid = $param->{vmid};
1592         my $node = $param->{node};
1593         my $proxy = $param->{proxy};
1594
1595         my $conf = PVE::QemuConfig->load_config($vmid, $node);
1596         my $title = "VM $vmid";
1597         $title .= " - ". $conf->{name} if $conf->{name};
1598
1599         my $port = PVE::QemuServer::spice_port($vmid);
1600
1601         my ($ticket, undef, $remote_viewer_config) =
1602             PVE::AccessControl::remote_viewer_config($authuser, $vmid, $node, $proxy, $title, $port);
1603
1604         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1605         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1606
1607         return $remote_viewer_config;
1608     }});
1609
1610 __PACKAGE__->register_method({
1611     name => 'vmcmdidx',
1612     path => '{vmid}/status',
1613     method => 'GET',
1614     proxyto => 'node',
1615     description => "Directory index",
1616     permissions => {
1617         user => 'all',
1618     },
1619     parameters => {
1620         additionalProperties => 0,
1621         properties => {
1622             node => get_standard_option('pve-node'),
1623             vmid => get_standard_option('pve-vmid'),
1624         },
1625     },
1626     returns => {
1627         type => 'array',
1628         items => {
1629             type => "object",
1630             properties => {
1631                 subdir => { type => 'string' },
1632             },
1633         },
1634         links => [ { rel => 'child', href => "{subdir}" } ],
1635     },
1636     code => sub {
1637         my ($param) = @_;
1638
1639         # test if VM exists
1640         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1641
1642         my $res = [
1643             { subdir => 'current' },
1644             { subdir => 'start' },
1645             { subdir => 'stop' },
1646             ];
1647
1648         return $res;
1649     }});
1650
1651 __PACKAGE__->register_method({
1652     name => 'vm_status',
1653     path => '{vmid}/status/current',
1654     method => 'GET',
1655     proxyto => 'node',
1656     protected => 1, # qemu pid files are only readable by root
1657     description => "Get virtual machine status.",
1658     permissions => {
1659         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1660     },
1661     parameters => {
1662         additionalProperties => 0,
1663         properties => {
1664             node => get_standard_option('pve-node'),
1665             vmid => get_standard_option('pve-vmid'),
1666         },
1667     },
1668     returns => { type => 'object' },
1669     code => sub {
1670         my ($param) = @_;
1671
1672         # test if VM exists
1673         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1674
1675         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1676         my $status = $vmstatus->{$param->{vmid}};
1677
1678         $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
1679
1680         $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
1681
1682         return $status;
1683     }});
1684
1685 __PACKAGE__->register_method({
1686     name => 'vm_start',
1687     path => '{vmid}/status/start',
1688     method => 'POST',
1689     protected => 1,
1690     proxyto => 'node',
1691     description => "Start virtual machine.",
1692     permissions => {
1693         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1694     },
1695     parameters => {
1696         additionalProperties => 0,
1697         properties => {
1698             node => get_standard_option('pve-node'),
1699             vmid => get_standard_option('pve-vmid',
1700                                         { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1701             skiplock => get_standard_option('skiplock'),
1702             stateuri => get_standard_option('pve-qm-stateuri'),
1703             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1704             migration_type => {
1705                 type => 'string',
1706                 enum => ['secure', 'insecure'],
1707                 description => "Migration traffic is encrypted using an SSH " .
1708                   "tunnel by default. On secure, completely private networks " .
1709                   "this can be disabled to increase performance.",
1710                 optional => 1,
1711             },
1712             migration_network => {
1713                 type => 'string', format => 'CIDR',
1714                 description => "CIDR of the (sub) network that is used for migration.",
1715                 optional => 1,
1716             },
1717             machine => get_standard_option('pve-qm-machine'),
1718             targetstorage => {
1719                 description => "Target storage for the migration. (Can be '1' to use the same storage id as on the source node.)",
1720                 type => 'string',
1721                 optional => 1
1722             }
1723         },
1724     },
1725     returns => {
1726         type => 'string',
1727     },
1728     code => sub {
1729         my ($param) = @_;
1730
1731         my $rpcenv = PVE::RPCEnvironment::get();
1732
1733         my $authuser = $rpcenv->get_user();
1734
1735         my $node = extract_param($param, 'node');
1736
1737         my $vmid = extract_param($param, 'vmid');
1738
1739         my $machine = extract_param($param, 'machine');
1740
1741         my $stateuri = extract_param($param, 'stateuri');
1742         raise_param_exc({ stateuri => "Only root may use this option." })
1743             if $stateuri && $authuser ne 'root@pam';
1744
1745         my $skiplock = extract_param($param, 'skiplock');
1746         raise_param_exc({ skiplock => "Only root may use this option." })
1747             if $skiplock && $authuser ne 'root@pam';
1748
1749         my $migratedfrom = extract_param($param, 'migratedfrom');
1750         raise_param_exc({ migratedfrom => "Only root may use this option." })
1751             if $migratedfrom && $authuser ne 'root@pam';
1752
1753         my $migration_type = extract_param($param, 'migration_type');
1754         raise_param_exc({ migration_type => "Only root may use this option." })
1755             if $migration_type && $authuser ne 'root@pam';
1756
1757         my $migration_network = extract_param($param, 'migration_network');
1758         raise_param_exc({ migration_network => "Only root may use this option." })
1759             if $migration_network && $authuser ne 'root@pam';
1760
1761         my $targetstorage = extract_param($param, 'targetstorage');
1762         raise_param_exc({ targetstorage => "Only root may use this option." })
1763             if $targetstorage && $authuser ne 'root@pam';
1764
1765         raise_param_exc({ targetstorage => "targetstorage can only by used with migratedfrom." })
1766             if $targetstorage && !$migratedfrom;
1767
1768         # read spice ticket from STDIN
1769         my $spice_ticket;
1770         if ($stateuri && ($stateuri eq 'tcp') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
1771             if (defined(my $line = <>)) {
1772                 chomp $line;
1773                 $spice_ticket = $line;
1774             }
1775         }
1776
1777         PVE::Cluster::check_cfs_quorum();
1778
1779         my $storecfg = PVE::Storage::config();
1780
1781         if (PVE::HA::Config::vm_is_ha_managed($vmid) && !$stateuri &&
1782             $rpcenv->{type} ne 'ha') {
1783
1784             my $hacmd = sub {
1785                 my $upid = shift;
1786
1787                 my $service = "vm:$vmid";
1788
1789                 my $cmd = ['ha-manager', 'set', $service, '--state', 'started'];
1790
1791                 print "Requesting HA start for VM $vmid\n";
1792
1793                 PVE::Tools::run_command($cmd);
1794
1795                 return;
1796             };
1797
1798             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1799
1800         } else {
1801
1802             my $realcmd = sub {
1803                 my $upid = shift;
1804
1805                 syslog('info', "start VM $vmid: $upid\n");
1806
1807                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef,
1808                                           $machine, $spice_ticket, $migration_network, $migration_type, $targetstorage);
1809
1810                 return;
1811             };
1812
1813             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1814         }
1815     }});
1816
1817 __PACKAGE__->register_method({
1818     name => 'vm_stop',
1819     path => '{vmid}/status/stop',
1820     method => 'POST',
1821     protected => 1,
1822     proxyto => 'node',
1823     description => "Stop virtual machine. The qemu process will exit immediately. This" .
1824         "is akin to pulling the power plug of a running computer and may damage the VM data",
1825     permissions => {
1826         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1827     },
1828     parameters => {
1829         additionalProperties => 0,
1830         properties => {
1831             node => get_standard_option('pve-node'),
1832             vmid => get_standard_option('pve-vmid',
1833                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1834             skiplock => get_standard_option('skiplock'),
1835             migratedfrom => get_standard_option('pve-node', { optional => 1 }),
1836             timeout => {
1837                 description => "Wait maximal timeout seconds.",
1838                 type => 'integer',
1839                 minimum => 0,
1840                 optional => 1,
1841             },
1842             keepActive => {
1843                 description => "Do not deactivate storage volumes.",
1844                 type => 'boolean',
1845                 optional => 1,
1846                 default => 0,
1847             }
1848         },
1849     },
1850     returns => {
1851         type => 'string',
1852     },
1853     code => sub {
1854         my ($param) = @_;
1855
1856         my $rpcenv = PVE::RPCEnvironment::get();
1857
1858         my $authuser = $rpcenv->get_user();
1859
1860         my $node = extract_param($param, 'node');
1861
1862         my $vmid = extract_param($param, 'vmid');
1863
1864         my $skiplock = extract_param($param, 'skiplock');
1865         raise_param_exc({ skiplock => "Only root may use this option." })
1866             if $skiplock && $authuser ne 'root@pam';
1867
1868         my $keepActive = extract_param($param, 'keepActive');
1869         raise_param_exc({ keepActive => "Only root may use this option." })
1870             if $keepActive && $authuser ne 'root@pam';
1871
1872         my $migratedfrom = extract_param($param, 'migratedfrom');
1873         raise_param_exc({ migratedfrom => "Only root may use this option." })
1874             if $migratedfrom && $authuser ne 'root@pam';
1875
1876
1877         my $storecfg = PVE::Storage::config();
1878
1879         if (PVE::HA::Config::vm_is_ha_managed($vmid) && ($rpcenv->{type} ne 'ha') && !defined($migratedfrom)) {
1880
1881             my $hacmd = sub {
1882                 my $upid = shift;
1883
1884                 my $service = "vm:$vmid";
1885
1886                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
1887
1888                 print "Requesting HA stop for VM $vmid\n";
1889
1890                 PVE::Tools::run_command($cmd);
1891
1892                 return;
1893             };
1894
1895             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1896
1897         } else {
1898             my $realcmd = sub {
1899                 my $upid = shift;
1900
1901                 syslog('info', "stop VM $vmid: $upid\n");
1902
1903                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1904                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1905
1906                 return;
1907             };
1908
1909             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1910         }
1911     }});
1912
1913 __PACKAGE__->register_method({
1914     name => 'vm_reset',
1915     path => '{vmid}/status/reset',
1916     method => 'POST',
1917     protected => 1,
1918     proxyto => 'node',
1919     description => "Reset virtual machine.",
1920     permissions => {
1921         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1922     },
1923     parameters => {
1924         additionalProperties => 0,
1925         properties => {
1926             node => get_standard_option('pve-node'),
1927             vmid => get_standard_option('pve-vmid',
1928                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1929             skiplock => get_standard_option('skiplock'),
1930         },
1931     },
1932     returns => {
1933         type => 'string',
1934     },
1935     code => sub {
1936         my ($param) = @_;
1937
1938         my $rpcenv = PVE::RPCEnvironment::get();
1939
1940         my $authuser = $rpcenv->get_user();
1941
1942         my $node = extract_param($param, 'node');
1943
1944         my $vmid = extract_param($param, 'vmid');
1945
1946         my $skiplock = extract_param($param, 'skiplock');
1947         raise_param_exc({ skiplock => "Only root may use this option." })
1948             if $skiplock && $authuser ne 'root@pam';
1949
1950         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1951
1952         my $realcmd = sub {
1953             my $upid = shift;
1954
1955             PVE::QemuServer::vm_reset($vmid, $skiplock);
1956
1957             return;
1958         };
1959
1960         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1961     }});
1962
1963 __PACKAGE__->register_method({
1964     name => 'vm_shutdown',
1965     path => '{vmid}/status/shutdown',
1966     method => 'POST',
1967     protected => 1,
1968     proxyto => 'node',
1969     description => "Shutdown virtual machine. This is similar to pressing the power button on a physical machine." .
1970         "This will send an ACPI event for the guest OS, which should then proceed to a clean shutdown.",
1971     permissions => {
1972         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1973     },
1974     parameters => {
1975         additionalProperties => 0,
1976         properties => {
1977             node => get_standard_option('pve-node'),
1978             vmid => get_standard_option('pve-vmid',
1979                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1980             skiplock => get_standard_option('skiplock'),
1981             timeout => {
1982                 description => "Wait maximal timeout seconds.",
1983                 type => 'integer',
1984                 minimum => 0,
1985                 optional => 1,
1986             },
1987             forceStop => {
1988                 description => "Make sure the VM stops.",
1989                 type => 'boolean',
1990                 optional => 1,
1991                 default => 0,
1992             },
1993             keepActive => {
1994                 description => "Do not deactivate storage volumes.",
1995                 type => 'boolean',
1996                 optional => 1,
1997                 default => 0,
1998             }
1999         },
2000     },
2001     returns => {
2002         type => 'string',
2003     },
2004     code => sub {
2005         my ($param) = @_;
2006
2007         my $rpcenv = PVE::RPCEnvironment::get();
2008
2009         my $authuser = $rpcenv->get_user();
2010
2011         my $node = extract_param($param, 'node');
2012
2013         my $vmid = extract_param($param, 'vmid');
2014
2015         my $skiplock = extract_param($param, 'skiplock');
2016         raise_param_exc({ skiplock => "Only root may use this option." })
2017             if $skiplock && $authuser ne 'root@pam';
2018
2019         my $keepActive = extract_param($param, 'keepActive');
2020         raise_param_exc({ keepActive => "Only root may use this option." })
2021             if $keepActive && $authuser ne 'root@pam';
2022
2023         my $storecfg = PVE::Storage::config();
2024
2025         my $shutdown = 1;
2026
2027         # if vm is paused, do not shutdown (but stop if forceStop = 1)
2028         # otherwise, we will infer a shutdown command, but run into the timeout,
2029         # then when the vm is resumed, it will instantly shutdown
2030         #
2031         # checking the qmp status here to get feedback to the gui/cli/api
2032         # and the status query should not take too long
2033         my $qmpstatus;
2034         eval {
2035             $qmpstatus = PVE::QemuServer::vm_qmp_command($vmid, { execute => "query-status" }, 0);
2036         };
2037         my $err = $@ if $@;
2038
2039         if (!$err && $qmpstatus->{status} eq "paused") {
2040             if ($param->{forceStop}) {
2041                 warn "VM is paused - stop instead of shutdown\n";
2042                 $shutdown = 0;
2043             } else {
2044                 die "VM is paused - cannot shutdown\n";
2045             }
2046         }
2047
2048         if (PVE::HA::Config::vm_is_ha_managed($vmid) &&
2049             ($rpcenv->{type} ne 'ha')) {
2050
2051             my $hacmd = sub {
2052                 my $upid = shift;
2053
2054                 my $service = "vm:$vmid";
2055
2056                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
2057
2058                 print "Requesting HA stop for VM $vmid\n";
2059
2060                 PVE::Tools::run_command($cmd);
2061
2062                 return;
2063             };
2064
2065             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
2066
2067         } else {
2068
2069             my $realcmd = sub {
2070                 my $upid = shift;
2071
2072                 syslog('info', "shutdown VM $vmid: $upid\n");
2073
2074                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
2075                                          $shutdown, $param->{forceStop}, $keepActive);
2076
2077                 return;
2078             };
2079
2080             return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
2081         }
2082     }});
2083
2084 __PACKAGE__->register_method({
2085     name => 'vm_suspend',
2086     path => '{vmid}/status/suspend',
2087     method => 'POST',
2088     protected => 1,
2089     proxyto => 'node',
2090     description => "Suspend virtual machine.",
2091     permissions => {
2092         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2093     },
2094     parameters => {
2095         additionalProperties => 0,
2096         properties => {
2097             node => get_standard_option('pve-node'),
2098             vmid => get_standard_option('pve-vmid',
2099                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2100             skiplock => get_standard_option('skiplock'),
2101         },
2102     },
2103     returns => {
2104         type => 'string',
2105     },
2106     code => sub {
2107         my ($param) = @_;
2108
2109         my $rpcenv = PVE::RPCEnvironment::get();
2110
2111         my $authuser = $rpcenv->get_user();
2112
2113         my $node = extract_param($param, 'node');
2114
2115         my $vmid = extract_param($param, 'vmid');
2116
2117         my $skiplock = extract_param($param, 'skiplock');
2118         raise_param_exc({ skiplock => "Only root may use this option." })
2119             if $skiplock && $authuser ne 'root@pam';
2120
2121         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2122
2123         my $realcmd = sub {
2124             my $upid = shift;
2125
2126             syslog('info', "suspend VM $vmid: $upid\n");
2127
2128             PVE::QemuServer::vm_suspend($vmid, $skiplock);
2129
2130             return;
2131         };
2132
2133         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
2134     }});
2135
2136 __PACKAGE__->register_method({
2137     name => 'vm_resume',
2138     path => '{vmid}/status/resume',
2139     method => 'POST',
2140     protected => 1,
2141     proxyto => 'node',
2142     description => "Resume virtual machine.",
2143     permissions => {
2144         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2145     },
2146     parameters => {
2147         additionalProperties => 0,
2148         properties => {
2149             node => get_standard_option('pve-node'),
2150             vmid => get_standard_option('pve-vmid',
2151                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2152             skiplock => get_standard_option('skiplock'),
2153             nocheck => { type => 'boolean', optional => 1 },
2154
2155         },
2156     },
2157     returns => {
2158         type => 'string',
2159     },
2160     code => sub {
2161         my ($param) = @_;
2162
2163         my $rpcenv = PVE::RPCEnvironment::get();
2164
2165         my $authuser = $rpcenv->get_user();
2166
2167         my $node = extract_param($param, 'node');
2168
2169         my $vmid = extract_param($param, 'vmid');
2170
2171         my $skiplock = extract_param($param, 'skiplock');
2172         raise_param_exc({ skiplock => "Only root may use this option." })
2173             if $skiplock && $authuser ne 'root@pam';
2174
2175         my $nocheck = extract_param($param, 'nocheck');
2176
2177         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid, $nocheck);
2178
2179         my $realcmd = sub {
2180             my $upid = shift;
2181
2182             syslog('info', "resume VM $vmid: $upid\n");
2183
2184             PVE::QemuServer::vm_resume($vmid, $skiplock, $nocheck);
2185
2186             return;
2187         };
2188
2189         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
2190     }});
2191
2192 __PACKAGE__->register_method({
2193     name => 'vm_sendkey',
2194     path => '{vmid}/sendkey',
2195     method => 'PUT',
2196     protected => 1,
2197     proxyto => 'node',
2198     description => "Send key event to virtual machine.",
2199     permissions => {
2200         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
2201     },
2202     parameters => {
2203         additionalProperties => 0,
2204         properties => {
2205             node => get_standard_option('pve-node'),
2206             vmid => get_standard_option('pve-vmid',
2207                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2208             skiplock => get_standard_option('skiplock'),
2209             key => {
2210                 description => "The key (qemu monitor encoding).",
2211                 type => 'string'
2212             }
2213         },
2214     },
2215     returns => { type => 'null'},
2216     code => sub {
2217         my ($param) = @_;
2218
2219         my $rpcenv = PVE::RPCEnvironment::get();
2220
2221         my $authuser = $rpcenv->get_user();
2222
2223         my $node = extract_param($param, 'node');
2224
2225         my $vmid = extract_param($param, 'vmid');
2226
2227         my $skiplock = extract_param($param, 'skiplock');
2228         raise_param_exc({ skiplock => "Only root may use this option." })
2229             if $skiplock && $authuser ne 'root@pam';
2230
2231         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
2232
2233         return;
2234     }});
2235
2236 __PACKAGE__->register_method({
2237     name => 'vm_feature',
2238     path => '{vmid}/feature',
2239     method => 'GET',
2240     proxyto => 'node',
2241     protected => 1,
2242     description => "Check if feature for virtual machine is available.",
2243     permissions => {
2244         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2245     },
2246     parameters => {
2247         additionalProperties => 0,
2248         properties => {
2249             node => get_standard_option('pve-node'),
2250             vmid => get_standard_option('pve-vmid'),
2251             feature => {
2252                 description => "Feature to check.",
2253                 type => 'string',
2254                 enum => [ 'snapshot', 'clone', 'copy' ],
2255             },
2256             snapname => get_standard_option('pve-snapshot-name', {
2257                 optional => 1,
2258             }),
2259         },
2260     },
2261     returns => {
2262         type => "object",
2263         properties => {
2264             hasFeature => { type => 'boolean' },
2265             nodes => {
2266                 type => 'array',
2267                 items => { type => 'string' },
2268             }
2269         },
2270     },
2271     code => sub {
2272         my ($param) = @_;
2273
2274         my $node = extract_param($param, 'node');
2275
2276         my $vmid = extract_param($param, 'vmid');
2277
2278         my $snapname = extract_param($param, 'snapname');
2279
2280         my $feature = extract_param($param, 'feature');
2281
2282         my $running = PVE::QemuServer::check_running($vmid);
2283
2284         my $conf = PVE::QemuConfig->load_config($vmid);
2285
2286         if($snapname){
2287             my $snap = $conf->{snapshots}->{$snapname};
2288             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2289             $conf = $snap;
2290         }
2291         my $storecfg = PVE::Storage::config();
2292
2293         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
2294         my $hasFeature = PVE::QemuConfig->has_feature($feature, $conf, $storecfg, $snapname, $running);
2295
2296         return {
2297             hasFeature => $hasFeature,
2298             nodes => [ keys %$nodelist ],
2299         };
2300     }});
2301
2302 __PACKAGE__->register_method({
2303     name => 'clone_vm',
2304     path => '{vmid}/clone',
2305     method => 'POST',
2306     protected => 1,
2307     proxyto => 'node',
2308     description => "Create a copy of virtual machine/template.",
2309     permissions => {
2310         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2311             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2312             "'Datastore.AllocateSpace' on any used storage.",
2313         check =>
2314         [ 'and',
2315           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2316           [ 'or',
2317             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2318             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2319           ],
2320         ]
2321     },
2322     parameters => {
2323         additionalProperties => 0,
2324         properties => {
2325             node => get_standard_option('pve-node'),
2326             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2327             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
2328             name => {
2329                 optional => 1,
2330                 type => 'string', format => 'dns-name',
2331                 description => "Set a name for the new VM.",
2332             },
2333             description => {
2334                 optional => 1,
2335                 type => 'string',
2336                 description => "Description for the new VM.",
2337             },
2338             pool => {
2339                 optional => 1,
2340                 type => 'string', format => 'pve-poolid',
2341                 description => "Add the new VM to the specified pool.",
2342             },
2343             snapname => get_standard_option('pve-snapshot-name', {
2344                 optional => 1,
2345             }),
2346             storage => get_standard_option('pve-storage-id', {
2347                 description => "Target storage for full clone.",
2348                 requires => 'full',
2349                 optional => 1,
2350             }),
2351             'format' => {
2352                 description => "Target format for file storage.",
2353                 requires => 'full',
2354                 type => 'string',
2355                 optional => 1,
2356                 enum => [ 'raw', 'qcow2', 'vmdk'],
2357             },
2358             full => {
2359                 optional => 1,
2360                 type => 'boolean',
2361                 description => "Create a full copy of all disk. This is always done when " .
2362                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2363                 default => 0,
2364             },
2365             target => get_standard_option('pve-node', {
2366                 description => "Target node. Only allowed if the original VM is on shared storage.",
2367                 optional => 1,
2368             }),
2369         },
2370     },
2371     returns => {
2372         type => 'string',
2373     },
2374     code => sub {
2375         my ($param) = @_;
2376
2377         my $rpcenv = PVE::RPCEnvironment::get();
2378
2379         my $authuser = $rpcenv->get_user();
2380
2381         my $node = extract_param($param, 'node');
2382
2383         my $vmid = extract_param($param, 'vmid');
2384
2385         my $newid = extract_param($param, 'newid');
2386
2387         my $pool = extract_param($param, 'pool');
2388
2389         if (defined($pool)) {
2390             $rpcenv->check_pool_exist($pool);
2391         }
2392
2393         my $snapname = extract_param($param, 'snapname');
2394
2395         my $storage = extract_param($param, 'storage');
2396
2397         my $format = extract_param($param, 'format');
2398
2399         my $target = extract_param($param, 'target');
2400
2401         my $localnode = PVE::INotify::nodename();
2402
2403         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2404
2405         PVE::Cluster::check_node_exists($target) if $target;
2406
2407         my $storecfg = PVE::Storage::config();
2408
2409         if ($storage) {
2410             # check if storage is enabled on local node
2411             PVE::Storage::storage_check_enabled($storecfg, $storage);
2412             if ($target) {
2413                 # check if storage is available on target node
2414                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2415                 # clone only works if target storage is shared
2416                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2417                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2418             }
2419         }
2420
2421         PVE::Cluster::check_cfs_quorum();
2422
2423         my $running = PVE::QemuServer::check_running($vmid) || 0;
2424
2425         # exclusive lock if VM is running - else shared lock is enough;
2426         my $shared_lock = $running ? 0 : 1;
2427
2428         my $clonefn = sub {
2429
2430             # do all tests after lock
2431             # we also try to do all tests before we fork the worker
2432
2433             my $conf = PVE::QemuConfig->load_config($vmid);
2434
2435             PVE::QemuConfig->check_lock($conf);
2436
2437             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2438
2439             die "unexpected state change\n" if $verify_running != $running;
2440
2441             die "snapshot '$snapname' does not exist\n"
2442                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2443
2444             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2445
2446             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2447
2448             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2449
2450             my $conffile = PVE::QemuConfig->config_file($newid);
2451
2452             die "unable to create VM $newid: config file already exists\n"
2453                 if -f $conffile;
2454
2455             my $newconf = { lock => 'clone' };
2456             my $drives = {};
2457             my $fullclone = {};
2458             my $vollist = [];
2459
2460             foreach my $opt (keys %$oldconf) {
2461                 my $value = $oldconf->{$opt};
2462
2463                 # do not copy snapshot related info
2464                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2465                     $opt eq 'vmstate' || $opt eq 'snapstate';
2466
2467                 # no need to copy unused images, because VMID(owner) changes anyways
2468                 next if $opt =~ m/^unused\d+$/;
2469
2470                 # always change MAC! address
2471                 if ($opt =~ m/^net(\d+)$/) {
2472                     my $net = PVE::QemuServer::parse_net($value);
2473                     my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
2474                     $net->{macaddr} =  PVE::Tools::random_ether_addr($dc->{mac_prefix});
2475                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2476                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
2477                     my $drive = PVE::QemuServer::parse_drive($opt, $value);
2478                     die "unable to parse drive options for '$opt'\n" if !$drive;
2479                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
2480                         $newconf->{$opt} = $value; # simply copy configuration
2481                     } else {
2482                         if ($param->{full}) {
2483                             die "Full clone feature is not supported for drive '$opt'\n"
2484                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2485                             $fullclone->{$opt} = 1;
2486                         } else {
2487                             # not full means clone instead of copy
2488                             die "Linked clone feature is not supported for drive '$opt'\n"
2489                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $drive->{file}, $snapname, $running);
2490                         }
2491                         $drives->{$opt} = $drive;
2492                         push @$vollist, $drive->{file};
2493                     }
2494                 } else {
2495                     # copy everything else
2496                     $newconf->{$opt} = $value;
2497                 }
2498             }
2499
2500             # auto generate a new uuid
2501             my ($uuid, $uuid_str);
2502             UUID::generate($uuid);
2503             UUID::unparse($uuid, $uuid_str);
2504             my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
2505             $smbios1->{uuid} = $uuid_str;
2506             $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
2507
2508             delete $newconf->{template};
2509
2510             if ($param->{name}) {
2511                 $newconf->{name} = $param->{name};
2512             } else {
2513                 if ($oldconf->{name}) {
2514                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2515                 } else {
2516                     $newconf->{name} = "Copy-of-VM-$vmid";
2517                 }
2518             }
2519
2520             if ($param->{description}) {
2521                 $newconf->{description} = $param->{description};
2522             }
2523
2524             # create empty/temp config - this fails if VM already exists on other node
2525             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2526
2527             my $realcmd = sub {
2528                 my $upid = shift;
2529
2530                 my $newvollist = [];
2531                 my $jobs = {};
2532
2533                 eval {
2534                     local $SIG{INT} =
2535                         local $SIG{TERM} =
2536                         local $SIG{QUIT} =
2537                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2538
2539                     PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
2540
2541                     my $total_jobs = scalar(keys %{$drives});
2542                     my $i = 1;
2543
2544                     foreach my $opt (keys %$drives) {
2545                         my $drive = $drives->{$opt};
2546                         my $skipcomplete = ($total_jobs != $i); # finish after last drive
2547
2548                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2549                                                                    $newid, $storage, $format, $fullclone->{$opt}, $newvollist,
2550                                                                    $jobs, $skipcomplete, $oldconf->{agent});
2551
2552                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2553
2554                         PVE::QemuConfig->write_config($newid, $newconf);
2555                         $i++;
2556                     }
2557
2558                     delete $newconf->{lock};
2559                     PVE::QemuConfig->write_config($newid, $newconf);
2560
2561                     if ($target) {
2562                         # always deactivate volumes - avoid lvm LVs to be active on several nodes
2563                         PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
2564                         PVE::Storage::deactivate_volumes($storecfg, $newvollist);
2565
2566                         my $newconffile = PVE::QemuConfig->config_file($newid, $target);
2567                         die "Failed to move config to node '$target' - rename failed: $!\n"
2568                             if !rename($conffile, $newconffile);
2569                     }
2570
2571                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2572                 };
2573                 if (my $err = $@) {
2574                     unlink $conffile;
2575
2576                     eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
2577
2578                     sleep 1; # some storage like rbd need to wait before release volume - really?
2579
2580                     foreach my $volid (@$newvollist) {
2581                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2582                         warn $@ if $@;
2583                     }
2584                     die "clone failed: $err";
2585                 }
2586
2587                 return;
2588             };
2589
2590             PVE::Firewall::clone_vmfw_conf($vmid, $newid);
2591
2592             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2593         };
2594
2595         return PVE::QemuConfig->lock_config_mode($vmid, 1, $shared_lock, sub {
2596             # Aquire exclusive lock lock for $newid
2597             return PVE::QemuConfig->lock_config_full($newid, 1, $clonefn);
2598         });
2599
2600     }});
2601
2602 __PACKAGE__->register_method({
2603     name => 'move_vm_disk',
2604     path => '{vmid}/move_disk',
2605     method => 'POST',
2606     protected => 1,
2607     proxyto => 'node',
2608     description => "Move volume to different storage.",
2609     permissions => {
2610         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, and 'Datastore.AllocateSpace' permissions on the storage.",
2611         check => [ 'and',
2612                    ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2613                    ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2614             ],
2615     },
2616     parameters => {
2617         additionalProperties => 0,
2618         properties => {
2619             node => get_standard_option('pve-node'),
2620             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2621             disk => {
2622                 type => 'string',
2623                 description => "The disk you want to move.",
2624                 enum => [ PVE::QemuServer::valid_drive_names() ],
2625             },
2626             storage => get_standard_option('pve-storage-id', {
2627                 description => "Target storage.",
2628                 completion => \&PVE::QemuServer::complete_storage,
2629             }),
2630             'format' => {
2631                 type => 'string',
2632                 description => "Target Format.",
2633                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2634                 optional => 1,
2635             },
2636             delete => {
2637                 type => 'boolean',
2638                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2639                 optional => 1,
2640                 default => 0,
2641             },
2642             digest => {
2643                 type => 'string',
2644                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2645                 maxLength => 40,
2646                 optional => 1,
2647             },
2648         },
2649     },
2650     returns => {
2651         type => 'string',
2652         description => "the task ID.",
2653     },
2654     code => sub {
2655         my ($param) = @_;
2656
2657         my $rpcenv = PVE::RPCEnvironment::get();
2658
2659         my $authuser = $rpcenv->get_user();
2660
2661         my $node = extract_param($param, 'node');
2662
2663         my $vmid = extract_param($param, 'vmid');
2664
2665         my $digest = extract_param($param, 'digest');
2666
2667         my $disk = extract_param($param, 'disk');
2668
2669         my $storeid = extract_param($param, 'storage');
2670
2671         my $format = extract_param($param, 'format');
2672
2673         my $storecfg = PVE::Storage::config();
2674
2675         my $updatefn =  sub {
2676
2677             my $conf = PVE::QemuConfig->load_config($vmid);
2678
2679             PVE::QemuConfig->check_lock($conf);
2680
2681             die "checksum missmatch (file change by other user?)\n"
2682                 if $digest && $digest ne $conf->{digest};
2683
2684             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2685
2686             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2687
2688             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2689
2690             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2691
2692             my $oldfmt;
2693             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2694             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2695                 $oldfmt = $1;
2696             }
2697
2698             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2699                 (!$format || !$oldfmt || $oldfmt eq $format);
2700
2701             # this only checks snapshots because $disk is passed!
2702             my $snapshotted = PVE::QemuServer::is_volume_in_use($storecfg, $conf, $disk, $old_volid);
2703             die "you can't move a disk with snapshots and delete the source\n"
2704                 if $snapshotted && $param->{delete};
2705
2706             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2707
2708             my $running = PVE::QemuServer::check_running($vmid);
2709
2710             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2711
2712             my $realcmd = sub {
2713
2714                 my $newvollist = [];
2715
2716                 eval {
2717                     local $SIG{INT} = $SIG{TERM} = $SIG{QUIT} = $SIG{HUP} = sub { die "interrupted by signal\n"; };
2718
2719                     warn "moving disk with snapshots, snapshots will not be moved!\n"
2720                         if $snapshotted;
2721
2722                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2723                                                                $vmid, $storeid, $format, 1, $newvollist);
2724
2725                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2726
2727                     PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
2728
2729                     # convert moved disk to base if part of template
2730                     PVE::QemuServer::template_create($vmid, $conf, $disk)
2731                         if PVE::QemuConfig->is_template($conf);
2732
2733                     PVE::QemuConfig->write_config($vmid, $conf);
2734
2735                     eval {
2736                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
2737                         PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
2738                             if !$running;
2739                     };
2740                     warn $@ if $@;
2741                 };
2742                 if (my $err = $@) {
2743
2744                    foreach my $volid (@$newvollist) {
2745                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2746                         warn $@ if $@;
2747                     }
2748                     die "storage migration failed: $err";
2749                 }
2750
2751                 if ($param->{delete}) {
2752                     eval {
2753                         PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
2754                         PVE::Storage::vdisk_free($storecfg, $old_volid);
2755                     };
2756                     warn $@ if $@;
2757                 }
2758             };
2759
2760             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2761         };
2762
2763         return PVE::QemuConfig->lock_config($vmid, $updatefn);
2764     }});
2765
2766 __PACKAGE__->register_method({
2767     name => 'migrate_vm',
2768     path => '{vmid}/migrate',
2769     method => 'POST',
2770     protected => 1,
2771     proxyto => 'node',
2772     description => "Migrate virtual machine. Creates a new migration task.",
2773     permissions => {
2774         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2775     },
2776     parameters => {
2777         additionalProperties => 0,
2778         properties => {
2779             node => get_standard_option('pve-node'),
2780             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2781             target => get_standard_option('pve-node', {
2782                 description => "Target node.",
2783                 completion =>  \&PVE::Cluster::complete_migration_target,
2784             }),
2785             online => {
2786                 type => 'boolean',
2787                 description => "Use online/live migration.",
2788                 optional => 1,
2789             },
2790             force => {
2791                 type => 'boolean',
2792                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2793                 optional => 1,
2794             },
2795             migration_type => {
2796                 type => 'string',
2797                 enum => ['secure', 'insecure'],
2798                 description => "Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance.",
2799                 optional => 1,
2800             },
2801             migration_network => {
2802                 type => 'string', format => 'CIDR',
2803                 description => "CIDR of the (sub) network that is used for migration.",
2804                 optional => 1,
2805             },
2806             "with-local-disks" => {
2807                 type => 'boolean',
2808                 description => "Enable live storage migration for local disk",
2809                 optional => 1,
2810             },
2811             targetstorage => get_standard_option('pve-storage-id', {
2812                 description => "Default target storage.",
2813                 optional => 1,
2814                 completion => \&PVE::QemuServer::complete_storage,
2815             }),
2816         },
2817     },
2818     returns => {
2819         type => 'string',
2820         description => "the task ID.",
2821     },
2822     code => sub {
2823         my ($param) = @_;
2824
2825         my $rpcenv = PVE::RPCEnvironment::get();
2826
2827         my $authuser = $rpcenv->get_user();
2828
2829         my $target = extract_param($param, 'target');
2830
2831         my $localnode = PVE::INotify::nodename();
2832         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2833
2834         PVE::Cluster::check_cfs_quorum();
2835
2836         PVE::Cluster::check_node_exists($target);
2837
2838         my $targetip = PVE::Cluster::remote_node_ip($target);
2839
2840         my $vmid = extract_param($param, 'vmid');
2841
2842         raise_param_exc({ targetstorage => "Live storage migration can only be done online." })
2843             if !$param->{online} && $param->{targetstorage};
2844
2845         raise_param_exc({ force => "Only root may use this option." })
2846             if $param->{force} && $authuser ne 'root@pam';
2847
2848         raise_param_exc({ migration_type => "Only root may use this option." })
2849             if $param->{migration_type} && $authuser ne 'root@pam';
2850
2851         # allow root only until better network permissions are available
2852         raise_param_exc({ migration_network => "Only root may use this option." })
2853             if $param->{migration_network} && $authuser ne 'root@pam';
2854
2855         # test if VM exists
2856         my $conf = PVE::QemuConfig->load_config($vmid);
2857
2858         # try to detect errors early
2859
2860         PVE::QemuConfig->check_lock($conf);
2861
2862         if (PVE::QemuServer::check_running($vmid)) {
2863             die "cant migrate running VM without --online\n"
2864                 if !$param->{online};
2865         }
2866
2867         my $storecfg = PVE::Storage::config();
2868
2869         if( $param->{targetstorage}) {
2870             PVE::Storage::storage_check_node($storecfg, $param->{targetstorage}, $target);
2871         } else {
2872             PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2873         }
2874
2875         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2876
2877             my $hacmd = sub {
2878                 my $upid = shift;
2879
2880                 my $service = "vm:$vmid";
2881
2882                 my $cmd = ['ha-manager', 'migrate', $service, $target];
2883
2884                 print "Requesting HA migration for VM $vmid to node $target\n";
2885
2886                 PVE::Tools::run_command($cmd);
2887
2888                 return;
2889             };
2890
2891             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2892
2893         } else {
2894
2895             my $realcmd = sub {
2896                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2897             };
2898
2899             my $worker = sub {
2900                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
2901             };
2902
2903             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $worker);
2904         }
2905
2906     }});
2907
2908 __PACKAGE__->register_method({
2909     name => 'monitor',
2910     path => '{vmid}/monitor',
2911     method => 'POST',
2912     protected => 1,
2913     proxyto => 'node',
2914     description => "Execute Qemu monitor commands.",
2915     permissions => {
2916         description => "Sys.Modify is required for (sub)commands which are not read-only ('info *' and 'help')",
2917         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
2918     },
2919     parameters => {
2920         additionalProperties => 0,
2921         properties => {
2922             node => get_standard_option('pve-node'),
2923             vmid => get_standard_option('pve-vmid'),
2924             command => {
2925                 type => 'string',
2926                 description => "The monitor command.",
2927             }
2928         },
2929     },
2930     returns => { type => 'string'},
2931     code => sub {
2932         my ($param) = @_;
2933
2934         my $rpcenv = PVE::RPCEnvironment::get();
2935         my $authuser = $rpcenv->get_user();
2936
2937         my $is_ro = sub {
2938             my $command = shift;
2939             return $command =~ m/^\s*info(\s+|$)/
2940                 || $command =~ m/^\s*help\s*$/;
2941         };
2942
2943         $rpcenv->check_full($authuser, "/", ['Sys.Modify'])
2944             if !&$is_ro($param->{command});
2945
2946         my $vmid = $param->{vmid};
2947
2948         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
2949
2950         my $res = '';
2951         eval {
2952             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
2953         };
2954         $res = "ERROR: $@" if $@;
2955
2956         return $res;
2957     }});
2958
2959 my $guest_agent_commands = [
2960     'ping',
2961     'get-time',
2962     'info',
2963     'fsfreeze-status',
2964     'fsfreeze-freeze',
2965     'fsfreeze-thaw',
2966     'fstrim',
2967     'network-get-interfaces',
2968     'get-vcpus',
2969     'get-fsinfo',
2970     'get-memory-blocks',
2971     'get-memory-block-info',
2972     'suspend-hybrid',
2973     'suspend-ram',
2974     'suspend-disk',
2975     'shutdown',
2976     ];
2977
2978 __PACKAGE__->register_method({
2979     name => 'agent',
2980     path => '{vmid}/agent',
2981     method => 'POST',
2982     protected => 1,
2983     proxyto => 'node',
2984     description => "Execute Qemu Guest Agent commands.",
2985     permissions => {
2986         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
2987     },
2988     parameters => {
2989         additionalProperties => 0,
2990         properties => {
2991             node => get_standard_option('pve-node'),
2992             vmid => get_standard_option('pve-vmid', {
2993                    completion => \&PVE::QemuServer::complete_vmid_running }),
2994             command => {
2995                 type => 'string',
2996                 description => "The QGA command.",
2997                 enum => $guest_agent_commands,
2998             },
2999         },
3000     },
3001     returns => {
3002         type => 'object',
3003         description => "Returns an object with a single `result` property. The type of that
3004 property depends on the executed command.",
3005     },
3006     code => sub {
3007         my ($param) = @_;
3008
3009         my $vmid = $param->{vmid};
3010
3011         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3012
3013         die "No Qemu Guest Agent\n" if !defined($conf->{agent});
3014         die "VM $vmid is not running\n" if !PVE::QemuServer::check_running($vmid);
3015
3016         my $cmd = $param->{command};
3017
3018         my $res = PVE::QemuServer::vm_mon_cmd($vmid, "guest-$cmd");
3019
3020         return { result => $res };
3021     }});
3022
3023 __PACKAGE__->register_method({
3024     name => 'resize_vm',
3025     path => '{vmid}/resize',
3026     method => 'PUT',
3027     protected => 1,
3028     proxyto => 'node',
3029     description => "Extend volume size.",
3030     permissions => {
3031         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
3032     },
3033     parameters => {
3034         additionalProperties => 0,
3035         properties => {
3036             node => get_standard_option('pve-node'),
3037             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3038             skiplock => get_standard_option('skiplock'),
3039             disk => {
3040                 type => 'string',
3041                 description => "The disk you want to resize.",
3042                 enum => [PVE::QemuServer::valid_drive_names()],
3043             },
3044             size => {
3045                 type => 'string',
3046                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
3047                 description => "The new size. With the `+` sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
3048             },
3049             digest => {
3050                 type => 'string',
3051                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
3052                 maxLength => 40,
3053                 optional => 1,
3054             },
3055         },
3056     },
3057     returns => { type => 'null'},
3058     code => sub {
3059         my ($param) = @_;
3060
3061         my $rpcenv = PVE::RPCEnvironment::get();
3062
3063         my $authuser = $rpcenv->get_user();
3064
3065         my $node = extract_param($param, 'node');
3066
3067         my $vmid = extract_param($param, 'vmid');
3068
3069         my $digest = extract_param($param, 'digest');
3070
3071         my $disk = extract_param($param, 'disk');
3072
3073         my $sizestr = extract_param($param, 'size');
3074
3075         my $skiplock = extract_param($param, 'skiplock');
3076         raise_param_exc({ skiplock => "Only root may use this option." })
3077             if $skiplock && $authuser ne 'root@pam';
3078
3079         my $storecfg = PVE::Storage::config();
3080
3081         my $updatefn =  sub {
3082
3083             my $conf = PVE::QemuConfig->load_config($vmid);
3084
3085             die "checksum missmatch (file change by other user?)\n"
3086                 if $digest && $digest ne $conf->{digest};
3087             PVE::QemuConfig->check_lock($conf) if !$skiplock;
3088
3089             die "disk '$disk' does not exist\n" if !$conf->{$disk};
3090
3091             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
3092
3093             my (undef, undef, undef, undef, undef, undef, $format) =
3094                 PVE::Storage::parse_volname($storecfg, $drive->{file});
3095
3096             die "can't resize volume: $disk if snapshot exists\n"
3097                 if %{$conf->{snapshots}} && $format eq 'qcow2';
3098
3099             my $volid = $drive->{file};
3100
3101             die "disk '$disk' has no associated volume\n" if !$volid;
3102
3103             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
3104
3105             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
3106
3107             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
3108
3109             PVE::Storage::activate_volumes($storecfg, [$volid]);
3110             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
3111
3112             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
3113             my ($ext, $newsize, $unit) = ($1, $2, $4);
3114             if ($unit) {
3115                 if ($unit eq 'K') {
3116                     $newsize = $newsize * 1024;
3117                 } elsif ($unit eq 'M') {
3118                     $newsize = $newsize * 1024 * 1024;
3119                 } elsif ($unit eq 'G') {
3120                     $newsize = $newsize * 1024 * 1024 * 1024;
3121                 } elsif ($unit eq 'T') {
3122                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
3123                 }
3124             }
3125             $newsize += $size if $ext;
3126             $newsize = int($newsize);
3127
3128             die "shrinking disks is not supported\n" if $newsize < $size;
3129
3130             return if $size == $newsize;
3131
3132             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
3133
3134             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
3135
3136             $drive->{size} = $newsize;
3137             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
3138
3139             PVE::QemuConfig->write_config($vmid, $conf);
3140         };
3141
3142         PVE::QemuConfig->lock_config($vmid, $updatefn);
3143         return undef;
3144     }});
3145
3146 __PACKAGE__->register_method({
3147     name => 'snapshot_list',
3148     path => '{vmid}/snapshot',
3149     method => 'GET',
3150     description => "List all snapshots.",
3151     permissions => {
3152         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
3153     },
3154     proxyto => 'node',
3155     protected => 1, # qemu pid files are only readable by root
3156     parameters => {
3157         additionalProperties => 0,
3158         properties => {
3159             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3160             node => get_standard_option('pve-node'),
3161         },
3162     },
3163     returns => {
3164         type => 'array',
3165         items => {
3166             type => "object",
3167             properties => {},
3168         },
3169         links => [ { rel => 'child', href => "{name}" } ],
3170     },
3171     code => sub {
3172         my ($param) = @_;
3173
3174         my $vmid = $param->{vmid};
3175
3176         my $conf = PVE::QemuConfig->load_config($vmid);
3177         my $snaphash = $conf->{snapshots} || {};
3178
3179         my $res = [];
3180
3181         foreach my $name (keys %$snaphash) {
3182             my $d = $snaphash->{$name};
3183             my $item = {
3184                 name => $name,
3185                 snaptime => $d->{snaptime} || 0,
3186                 vmstate => $d->{vmstate} ? 1 : 0,
3187                 description => $d->{description} || '',
3188             };
3189             $item->{parent} = $d->{parent} if $d->{parent};
3190             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
3191             push @$res, $item;
3192         }
3193
3194         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
3195         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
3196         $current->{parent} = $conf->{parent} if $conf->{parent};
3197
3198         push @$res, $current;
3199
3200         return $res;
3201     }});
3202
3203 __PACKAGE__->register_method({
3204     name => 'snapshot',
3205     path => '{vmid}/snapshot',
3206     method => 'POST',
3207     protected => 1,
3208     proxyto => 'node',
3209     description => "Snapshot a VM.",
3210     permissions => {
3211         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3212     },
3213     parameters => {
3214         additionalProperties => 0,
3215         properties => {
3216             node => get_standard_option('pve-node'),
3217             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3218             snapname => get_standard_option('pve-snapshot-name'),
3219             vmstate => {
3220                 optional => 1,
3221                 type => 'boolean',
3222                 description => "Save the vmstate",
3223             },
3224             description => {
3225                 optional => 1,
3226                 type => 'string',
3227                 description => "A textual description or comment.",
3228             },
3229         },
3230     },
3231     returns => {
3232         type => 'string',
3233         description => "the task ID.",
3234     },
3235     code => sub {
3236         my ($param) = @_;
3237
3238         my $rpcenv = PVE::RPCEnvironment::get();
3239
3240         my $authuser = $rpcenv->get_user();
3241
3242         my $node = extract_param($param, 'node');
3243
3244         my $vmid = extract_param($param, 'vmid');
3245
3246         my $snapname = extract_param($param, 'snapname');
3247
3248         die "unable to use snapshot name 'current' (reserved name)\n"
3249             if $snapname eq 'current';
3250
3251         my $realcmd = sub {
3252             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
3253             PVE::QemuConfig->snapshot_create($vmid, $snapname, $param->{vmstate},
3254                                              $param->{description});
3255         };
3256
3257         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
3258     }});
3259
3260 __PACKAGE__->register_method({
3261     name => 'snapshot_cmd_idx',
3262     path => '{vmid}/snapshot/{snapname}',
3263     description => '',
3264     method => 'GET',
3265     permissions => {
3266         user => 'all',
3267     },
3268     parameters => {
3269         additionalProperties => 0,
3270         properties => {
3271             vmid => get_standard_option('pve-vmid'),
3272             node => get_standard_option('pve-node'),
3273             snapname => get_standard_option('pve-snapshot-name'),
3274         },
3275     },
3276     returns => {
3277         type => 'array',
3278         items => {
3279             type => "object",
3280             properties => {},
3281         },
3282         links => [ { rel => 'child', href => "{cmd}" } ],
3283     },
3284     code => sub {
3285         my ($param) = @_;
3286
3287         my $res = [];
3288
3289         push @$res, { cmd => 'rollback' };
3290         push @$res, { cmd => 'config' };
3291
3292         return $res;
3293     }});
3294
3295 __PACKAGE__->register_method({
3296     name => 'update_snapshot_config',
3297     path => '{vmid}/snapshot/{snapname}/config',
3298     method => 'PUT',
3299     protected => 1,
3300     proxyto => 'node',
3301     description => "Update snapshot metadata.",
3302     permissions => {
3303         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3304     },
3305     parameters => {
3306         additionalProperties => 0,
3307         properties => {
3308             node => get_standard_option('pve-node'),
3309             vmid => get_standard_option('pve-vmid'),
3310             snapname => get_standard_option('pve-snapshot-name'),
3311             description => {
3312                 optional => 1,
3313                 type => 'string',
3314                 description => "A textual description or comment.",
3315             },
3316         },
3317     },
3318     returns => { type => 'null' },
3319     code => sub {
3320         my ($param) = @_;
3321
3322         my $rpcenv = PVE::RPCEnvironment::get();
3323
3324         my $authuser = $rpcenv->get_user();
3325
3326         my $vmid = extract_param($param, 'vmid');
3327
3328         my $snapname = extract_param($param, 'snapname');
3329
3330         return undef if !defined($param->{description});
3331
3332         my $updatefn =  sub {
3333
3334             my $conf = PVE::QemuConfig->load_config($vmid);
3335
3336             PVE::QemuConfig->check_lock($conf);
3337
3338             my $snap = $conf->{snapshots}->{$snapname};
3339
3340             die "snapshot '$snapname' does not exist\n" if !defined($snap);
3341
3342             $snap->{description} = $param->{description} if defined($param->{description});
3343
3344              PVE::QemuConfig->write_config($vmid, $conf);
3345         };
3346
3347         PVE::QemuConfig->lock_config($vmid, $updatefn);
3348
3349         return undef;
3350     }});
3351
3352 __PACKAGE__->register_method({
3353     name => 'get_snapshot_config',
3354     path => '{vmid}/snapshot/{snapname}/config',
3355     method => 'GET',
3356     proxyto => 'node',
3357     description => "Get snapshot configuration",
3358     permissions => {
3359         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3360     },
3361     parameters => {
3362         additionalProperties => 0,
3363         properties => {
3364             node => get_standard_option('pve-node'),
3365             vmid => get_standard_option('pve-vmid'),
3366             snapname => get_standard_option('pve-snapshot-name'),
3367         },
3368     },
3369     returns => { type => "object" },
3370     code => sub {
3371         my ($param) = @_;
3372
3373         my $rpcenv = PVE::RPCEnvironment::get();
3374
3375         my $authuser = $rpcenv->get_user();
3376
3377         my $vmid = extract_param($param, 'vmid');
3378
3379         my $snapname = extract_param($param, 'snapname');
3380
3381         my $conf = PVE::QemuConfig->load_config($vmid);
3382
3383         my $snap = $conf->{snapshots}->{$snapname};
3384
3385         die "snapshot '$snapname' does not exist\n" if !defined($snap);
3386
3387         return $snap;
3388     }});
3389
3390 __PACKAGE__->register_method({
3391     name => 'rollback',
3392     path => '{vmid}/snapshot/{snapname}/rollback',
3393     method => 'POST',
3394     protected => 1,
3395     proxyto => 'node',
3396     description => "Rollback VM state to specified snapshot.",
3397     permissions => {
3398         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3399     },
3400     parameters => {
3401         additionalProperties => 0,
3402         properties => {
3403             node => get_standard_option('pve-node'),
3404             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3405             snapname => get_standard_option('pve-snapshot-name'),
3406         },
3407     },
3408     returns => {
3409         type => 'string',
3410         description => "the task ID.",
3411     },
3412     code => sub {
3413         my ($param) = @_;
3414
3415         my $rpcenv = PVE::RPCEnvironment::get();
3416
3417         my $authuser = $rpcenv->get_user();
3418
3419         my $node = extract_param($param, 'node');
3420
3421         my $vmid = extract_param($param, 'vmid');
3422
3423         my $snapname = extract_param($param, 'snapname');
3424
3425         my $realcmd = sub {
3426             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
3427             PVE::QemuConfig->snapshot_rollback($vmid, $snapname);
3428         };
3429
3430         my $worker = sub {
3431             # hold migration lock, this makes sure that nobody create replication snapshots
3432             return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
3433         };
3434
3435         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $worker);
3436     }});
3437
3438 __PACKAGE__->register_method({
3439     name => 'delsnapshot',
3440     path => '{vmid}/snapshot/{snapname}',
3441     method => 'DELETE',
3442     protected => 1,
3443     proxyto => 'node',
3444     description => "Delete a VM snapshot.",
3445     permissions => {
3446         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3447     },
3448     parameters => {
3449         additionalProperties => 0,
3450         properties => {
3451             node => get_standard_option('pve-node'),
3452             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3453             snapname => get_standard_option('pve-snapshot-name'),
3454             force => {
3455                 optional => 1,
3456                 type => 'boolean',
3457                 description => "For removal from config file, even if removing disk snapshots fails.",
3458             },
3459         },
3460     },
3461     returns => {
3462         type => 'string',
3463         description => "the task ID.",
3464     },
3465     code => sub {
3466         my ($param) = @_;
3467
3468         my $rpcenv = PVE::RPCEnvironment::get();
3469
3470         my $authuser = $rpcenv->get_user();
3471
3472         my $node = extract_param($param, 'node');
3473
3474         my $vmid = extract_param($param, 'vmid');
3475
3476         my $snapname = extract_param($param, 'snapname');
3477
3478         my $realcmd = sub {
3479             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
3480             PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
3481         };
3482
3483         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
3484     }});
3485
3486 __PACKAGE__->register_method({
3487     name => 'template',
3488     path => '{vmid}/template',
3489     method => 'POST',
3490     protected => 1,
3491     proxyto => 'node',
3492     description => "Create a Template.",
3493     permissions => {
3494         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3495         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3496     },
3497     parameters => {
3498         additionalProperties => 0,
3499         properties => {
3500             node => get_standard_option('pve-node'),
3501             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
3502             disk => {
3503                 optional => 1,
3504                 type => 'string',
3505                 description => "If you want to convert only 1 disk to base image.",
3506                 enum => [PVE::QemuServer::valid_drive_names()],
3507             },
3508
3509         },
3510     },
3511     returns => { type => 'null'},
3512     code => sub {
3513         my ($param) = @_;
3514
3515         my $rpcenv = PVE::RPCEnvironment::get();
3516
3517         my $authuser = $rpcenv->get_user();
3518
3519         my $node = extract_param($param, 'node');
3520
3521         my $vmid = extract_param($param, 'vmid');
3522
3523         my $disk = extract_param($param, 'disk');
3524
3525         my $updatefn =  sub {
3526
3527             my $conf = PVE::QemuConfig->load_config($vmid);
3528
3529             PVE::QemuConfig->check_lock($conf);
3530
3531             die "unable to create template, because VM contains snapshots\n"
3532                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3533
3534             die "you can't convert a template to a template\n"
3535                 if PVE::QemuConfig->is_template($conf) && !$disk;
3536
3537             die "you can't convert a VM to template if VM is running\n"
3538                 if PVE::QemuServer::check_running($vmid);
3539
3540             my $realcmd = sub {
3541                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3542             };
3543
3544             $conf->{template} = 1;
3545             PVE::QemuConfig->write_config($vmid, $conf);
3546
3547             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3548         };
3549
3550         PVE::QemuConfig->lock_config($vmid, $updatefn);
3551         return undef;
3552     }});
3553
3554 1;