PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6 use Net::SSLeay;
   7 use UUID;
   8 use POSIX;
   9 use IO::Socket::IP;
  10 use URI::Escape;
  11
  12 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
  13 use PVE::SafeSyslog;
  14 use PVE::Tools qw(extract_param);
  15 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  16 use PVE::Storage;
  17 use PVE::JSONSchema qw(get_standard_option);
  18 use PVE::RESTHandler;
  19 use PVE::ReplicationConfig;
  20 use PVE::GuestHelpers;
  21 use PVE::QemuConfig;
  22 use PVE::QemuServer;
  23 use PVE::QemuMigrate;
  24 use PVE::RPCEnvironment;
  25 use PVE::AccessControl;
  26 use PVE::INotify;
  27 use PVE::Network;
  28 use PVE::Firewall;
  29 use PVE::API2::Firewall::VM;
  30 use PVE::API2::Qemu::Agent;
  31
  32 BEGIN {
  33     if (!$ENV{PVE_GENERATING_DOCS}) {
  34         require PVE::HA::Env::PVE2;
  35         import PVE::HA::Env::PVE2;
  36         require PVE::HA::Config;
  37         import PVE::HA::Config;
  38     }
  39 }
  40
  41 use Data::Dumper; # fixme: remove
  42
  43 use base qw(PVE::RESTHandler);
  44
  45 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  46
  47 my $resolve_cdrom_alias = sub {
  48     my $param = shift;
  49
  50     if (my $value = $param->{cdrom}) {
  51         $value .= ",media=cdrom" if $value !~ m/media=/;
  52         $param->{ide2} = $value;
  53         delete $param->{cdrom};
  54     }
  55 };
  56
  57 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
  58 my $check_storage_access = sub {
  59    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  60
  61    PVE::QemuServer::foreach_drive($settings, sub {
  62         my ($ds, $drive) = @_;
  63
  64         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  65
  66         my $volid = $drive->{file};
  67
  68         if (!$volid || ($volid eq 'none' || $volid eq 'cloudinit')) {
  69             # nothing to check
  70         } elsif ($volid =~ m/^(([^:\s]+):)?(cloudinit)$/) {
  71             # nothing to check
  72         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  73             $rpcenv->check($authuser, "/", ['Sys.Console']);
  74         } elsif (!$isCDROM && ($volid =~ $NEW_DISK_RE)) {
  75             my ($storeid, $size) = ($2 || $default_storage, $3);
  76             die "no storage ID specified (and no default storage)\n" if !$storeid;
  77             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  78             my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
  79             raise_param_exc({ storage => "storage '$storeid' does not support vm images"})
  80                 if !$scfg->{content}->{images};
  81         } else {
  82             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
  83         }
  84     });
  85
  86    $rpcenv->check($authuser, "/storage/$settings->{vmstatestorage}", ['Datastore.AllocateSpace'])
  87        if defined($settings->{vmstatestorage});
  88 };
  89
  90 my $check_storage_access_clone = sub {
  91    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  92
  93    my $sharedvm = 1;
  94
  95    PVE::QemuServer::foreach_drive($conf, sub {
  96         my ($ds, $drive) = @_;
  97
  98         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  99
 100         my $volid = $drive->{file};
 101
 102         return if !$volid || $volid eq 'none';
 103
 104         if ($isCDROM) {
 105             if ($volid eq 'cdrom') {
 106                 $rpcenv->check($authuser, "/", ['Sys.Console']);
 107             } else {
 108                 # we simply allow access
 109                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 110                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 111                 $sharedvm = 0 if !$scfg->{shared};
 112
 113             }
 114         } else {
 115             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 116             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 117             $sharedvm = 0 if !$scfg->{shared};
 118
 119             $sid = $storage if $storage;
 120             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 121         }
 122     });
 123
 124    $rpcenv->check($authuser, "/storage/$conf->{vmstatestorage}", ['Datastore.AllocateSpace'])
 125        if defined($conf->{vmstatestorage});
 126
 127    return $sharedvm;
 128 };
 129
 130 # Note: $pool is only needed when creating a VM, because pool permissions
 131 # are automatically inherited if VM already exists inside a pool.
 132 my $create_disks = sub {
 133     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 134
 135     my $vollist = [];
 136
 137     my $res = {};
 138
 139     my $code = sub {
 140         my ($ds, $disk) = @_;
 141
 142         my $volid = $disk->{file};
 143
 144         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 145             delete $disk->{size};
 146             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 147         } elsif ($volid =~ m!^(?:([^/:\s]+):)?cloudinit$!) {
 148             my $storeid = $1 || $default_storage;
 149             die "no storage ID specified (and no default storage)\n" if !$storeid;
 150             my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
 151             my $name = "vm-$vmid-cloudinit";
 152             my $fmt = undef;
 153             if ($scfg->{path}) {
 154                 $name .= ".qcow2";
 155                 $fmt = 'qcow2';
 156             }else{
 157                 $fmt = 'raw';
 158             }
 159             # FIXME: Reasonable size? qcow2 shouldn't grow if the space isn't used anyway?
 160             my $cloudinit_iso_size = 5; # in MB
 161             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
 162                                                   $fmt, $name, $cloudinit_iso_size*1024);
 163             $disk->{file} = $volid;
 164             $disk->{media} = 'cdrom';
 165             push @$vollist, $volid;
 166             delete $disk->{format}; # no longer needed
 167             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 168         } elsif ($volid =~ $NEW_DISK_RE) {
 169             my ($storeid, $size) = ($2 || $default_storage, $3);
 170             die "no storage ID specified (and no default storage)\n" if !$storeid;
 171             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 172             my $fmt = $disk->{format} || $defformat;
 173
 174             $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
 175
 176             my $volid;
 177             if ($ds eq 'efidisk0') {
 178                 ($volid, $size) = PVE::QemuServer::create_efidisk($storecfg, $storeid, $vmid, $fmt);
 179             } else {
 180                 $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
 181             }
 182             push @$vollist, $volid;
 183             $disk->{file} = $volid;
 184             $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
 185             delete $disk->{format}; # no longer needed
 186             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 187         } else {
 188
 189             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
 190
 191             my $volid_is_new = 1;
 192
 193             if ($conf->{$ds}) {
 194                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 195                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 196             }
 197
 198             if ($volid_is_new) {
 199
 200                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 201
 202                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 203
 204                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 205
 206                 die "volume $volid does not exists\n" if !$size;
 207
 208                 $disk->{size} = $size;
 209             }
 210
 211             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 212         }
 213     };
 214
 215     eval { PVE::QemuServer::foreach_drive($settings, $code); };
 216
 217     # free allocated images on error
 218     if (my $err = $@) {
 219         syslog('err', "VM $vmid creating disks failed");
 220         foreach my $volid (@$vollist) {
 221             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 222             warn $@ if $@;
 223         }
 224         die $err;
 225     }
 226
 227     # modify vm config if everything went well
 228     foreach my $ds (keys %$res) {
 229         $conf->{$ds} = $res->{$ds};
 230     }
 231
 232     return $vollist;
 233 };
 234
 235 my $cpuoptions = {
 236     'cores' => 1,
 237     'cpu' => 1,
 238     'cpulimit' => 1,
 239     'cpuunits' => 1,
 240     'numa' => 1,
 241     'smp' => 1,
 242     'sockets' => 1,
 243     'vcpus' => 1,
 244 };
 245
 246 my $memoryoptions = {
 247     'memory' => 1,
 248     'balloon' => 1,
 249     'shares' => 1,
 250 };
 251
 252 my $hwtypeoptions = {
 253     'acpi' => 1,
 254     'hotplug' => 1,
 255     'kvm' => 1,
 256     'machine' => 1,
 257     'scsihw' => 1,
 258     'smbios1' => 1,
 259     'tablet' => 1,
 260     'vga' => 1,
 261     'watchdog' => 1,
 262 };
 263
 264 my $generaloptions = {
 265     'agent' => 1,
 266     'autostart' => 1,
 267     'bios' => 1,
 268     'description' => 1,
 269     'keyboard' => 1,
 270     'localtime' => 1,
 271     'migrate_downtime' => 1,
 272     'migrate_speed' => 1,
 273     'name' => 1,
 274     'onboot' => 1,
 275     'ostype' => 1,
 276     'protection' => 1,
 277     'reboot' => 1,
 278     'startdate' => 1,
 279     'startup' => 1,
 280     'tdf' => 1,
 281     'template' => 1,
 282 };
 283
 284 my $vmpoweroptions = {
 285     'freeze' => 1,
 286 };
 287
 288 my $diskoptions = {
 289     'boot' => 1,
 290     'bootdisk' => 1,
 291     'vmstatestorage' => 1,
 292 };
 293
 294 my $check_vm_modify_config_perm = sub {
 295     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 296
 297     return 1 if $authuser eq 'root@pam';
 298
 299     foreach my $opt (@$key_list) {
 300         # disk checks need to be done somewhere else
 301         next if PVE::QemuServer::is_valid_drivename($opt);
 302         next if $opt eq 'cdrom';
 303         next if $opt =~ m/^unused\d+$/;
 304
 305         if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
 306             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 307         } elsif ($memoryoptions->{$opt}) {
 308             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 309         } elsif ($hwtypeoptions->{$opt}) {
 310             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 311         } elsif ($generaloptions->{$opt}) {
 312             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 313             # special case for startup since it changes host behaviour
 314             if ($opt eq 'startup') {
 315                 $rpcenv->check_full($authuser, "/", ['Sys.Modify']);
 316             }
 317         } elsif ($vmpoweroptions->{$opt}) {
 318             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
 319         } elsif ($diskoptions->{$opt}) {
 320             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 321         } elsif ($opt =~ m/^(?:net|ipconfig)\d+$/) {
 322             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 323         } else {
 324             # catches usb\d+, hostpci\d+, args, lock, etc.
 325             # new options will be checked here
 326             die "only root can set '$opt' config\n";
 327         }
 328     }
 329
 330     return 1;
 331 };
 332
 333 __PACKAGE__->register_method({
 334     name => 'vmlist',
 335     path => '',
 336     method => 'GET',
 337     description => "Virtual machine index (per node).",
 338     permissions => {
 339         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 340         user => 'all',
 341     },
 342     proxyto => 'node',
 343     protected => 1, # qemu pid files are only readable by root
 344     parameters => {
 345         additionalProperties => 0,
 346         properties => {
 347             node => get_standard_option('pve-node'),
 348             full => {
 349                 type => 'boolean',
 350                 optional => 1,
 351                 description => "Determine the full status of active VMs.",
 352             },
 353         },
 354     },
 355     returns => {
 356         type => 'array',
 357         items => {
 358             type => "object",
 359             properties => {},
 360         },
 361         links => [ { rel => 'child', href => "{vmid}" } ],
 362     },
 363     code => sub {
 364         my ($param) = @_;
 365
 366         my $rpcenv = PVE::RPCEnvironment::get();
 367         my $authuser = $rpcenv->get_user();
 368
 369         my $vmstatus = PVE::QemuServer::vmstatus(undef, $param->{full});
 370
 371         my $res = [];
 372         foreach my $vmid (keys %$vmstatus) {
 373             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 374
 375             my $data = $vmstatus->{$vmid};
 376             $data->{vmid} = int($vmid);
 377             push @$res, $data;
 378         }
 379
 380         return $res;
 381     }});
 382
 383
 384
 385 __PACKAGE__->register_method({
 386     name => 'create_vm',
 387     path => '',
 388     method => 'POST',
 389     description => "Create or restore a virtual machine.",
 390     permissions => {
 391         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 392             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 393             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 394         user => 'all', # check inside
 395     },
 396     protected => 1,
 397     proxyto => 'node',
 398     parameters => {
 399         additionalProperties => 0,
 400         properties => PVE::QemuServer::json_config_properties(
 401             {
 402                 node => get_standard_option('pve-node'),
 403                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 404                 archive => {
 405                     description => "The backup file.",
 406                     type => 'string',
 407                     optional => 1,
 408                     maxLength => 255,
 409                     completion => \&PVE::QemuServer::complete_backup_archives,
 410                 },
 411                 storage => get_standard_option('pve-storage-id', {
 412                     description => "Default storage.",
 413                     optional => 1,
 414                     completion => \&PVE::QemuServer::complete_storage,
 415                 }),
 416                 force => {
 417                     optional => 1,
 418                     type => 'boolean',
 419                     description => "Allow to overwrite existing VM.",
 420                     requires => 'archive',
 421                 },
 422                 unique => {
 423                     optional => 1,
 424                     type => 'boolean',
 425                     description => "Assign a unique random ethernet address.",
 426                     requires => 'archive',
 427                 },
 428                 pool => {
 429                     optional => 1,
 430                     type => 'string', format => 'pve-poolid',
 431                     description => "Add the VM to the specified pool.",
 432                 },
 433                 bwlimit => {
 434                     description => "Override i/o bandwidth limit (in KiB/s).",
 435                     optional => 1,
 436                     type => 'integer',
 437                     minimum => '0',
 438                 }
 439             }),
 440     },
 441     returns => {
 442         type => 'string',
 443     },
 444     code => sub {
 445         my ($param) = @_;
 446
 447         my $rpcenv = PVE::RPCEnvironment::get();
 448
 449         my $authuser = $rpcenv->get_user();
 450
 451         my $node = extract_param($param, 'node');
 452
 453         my $vmid = extract_param($param, 'vmid');
 454
 455         my $archive = extract_param($param, 'archive');
 456
 457         my $storage = extract_param($param, 'storage');
 458
 459         my $force = extract_param($param, 'force');
 460
 461         my $unique = extract_param($param, 'unique');
 462
 463         my $pool = extract_param($param, 'pool');
 464
 465         my $bwlimit = extract_param($param, 'bwlimit');
 466
 467         my $filename = PVE::QemuConfig->config_file($vmid);
 468
 469         my $storecfg = PVE::Storage::config();
 470
 471         if (defined(my $ssh_keys = $param->{sshkeys})) {
 472                 $ssh_keys = URI::Escape::uri_unescape($ssh_keys);
 473                 PVE::Tools::validate_ssh_public_keys($ssh_keys);
 474         }
 475
 476         PVE::Cluster::check_cfs_quorum();
 477
 478         if (defined($pool)) {
 479             $rpcenv->check_pool_exist($pool);
 480         }
 481
 482         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 483             if defined($storage);
 484
 485         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 486             # OK
 487         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 488             # OK
 489         } elsif ($archive && $force && (-f $filename) &&
 490                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 491             # OK: user has VM.Backup permissions, and want to restore an existing VM
 492         } else {
 493             raise_perm_exc();
 494         }
 495
 496         if (!$archive) {
 497             &$resolve_cdrom_alias($param);
 498
 499             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 500
 501             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 502
 503             foreach my $opt (keys %$param) {
 504                 if (PVE::QemuServer::is_valid_drivename($opt)) {
 505                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 506                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 507
 508                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 509                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 510                 }
 511             }
 512
 513             PVE::QemuServer::add_random_macs($param);
 514         } else {
 515             my $keystr = join(' ', keys %$param);
 516             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 517
 518             if ($archive eq '-') {
 519                 die "pipe requires cli environment\n"
 520                     if $rpcenv->{type} ne 'cli';
 521             } else {
 522                 PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
 523                 $archive = PVE::Storage::abs_filesystem_path($storecfg, $archive);
 524             }
 525         }
 526
 527         my $restorefn = sub {
 528             my $vmlist = PVE::Cluster::get_vmlist();
 529             if ($vmlist->{ids}->{$vmid}) {
 530                 my $current_node = $vmlist->{ids}->{$vmid}->{node};
 531                 if ($current_node eq $node) {
 532                     my $conf = PVE::QemuConfig->load_config($vmid);
 533
 534                     PVE::QemuConfig->check_protection($conf, "unable to restore VM $vmid");
 535
 536                     die "unable to restore vm $vmid - config file already exists\n"
 537                         if !$force;
 538
 539                     die "unable to restore vm $vmid - vm is running\n"
 540                         if PVE::QemuServer::check_running($vmid);
 541
 542                     die "unable to restore vm $vmid - vm is a template\n"
 543                         if PVE::QemuConfig->is_template($conf);
 544
 545                 } else {
 546                     die "unable to restore vm $vmid - already existing on cluster node '$current_node'\n";
 547                 }
 548             }
 549
 550             my $realcmd = sub {
 551                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 552                     storage => $storage,
 553                     pool => $pool,
 554                     unique => $unique,
 555                     bwlimit => $bwlimit, });
 556
 557                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 558             };
 559
 560             # ensure no old replication state are exists
 561             PVE::ReplicationState::delete_guest_states($vmid);
 562
 563             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 564         };
 565
 566         my $createfn = sub {
 567
 568             # test after locking
 569             PVE::Cluster::check_vmid_unused($vmid);
 570
 571             # ensure no old replication state are exists
 572             PVE::ReplicationState::delete_guest_states($vmid);
 573
 574             my $realcmd = sub {
 575
 576                 my $vollist = [];
 577
 578                 my $conf = $param;
 579
 580                 eval {
 581
 582                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 583
 584                     if (!$conf->{bootdisk}) {
 585                         my $firstdisk = PVE::QemuServer::resolve_first_disk($conf);
 586                         $conf->{bootdisk} = $firstdisk if $firstdisk;
 587                     }
 588
 589                     # auto generate uuid if user did not specify smbios1 option
 590                     if (!$conf->{smbios1}) {
 591                         $conf->{smbios1} = PVE::QemuServer::generate_smbios1_uuid();
 592                     }
 593
 594                     PVE::QemuConfig->write_config($vmid, $conf);
 595
 596                 };
 597                 my $err = $@;
 598
 599                 if ($err) {
 600                     foreach my $volid (@$vollist) {
 601                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 602                         warn $@ if $@;
 603                     }
 604                     die "create failed - $err";
 605                 }
 606
 607                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 608             };
 609
 610             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 611         };
 612
 613         return PVE::QemuConfig->lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 614     }});
 615
 616 __PACKAGE__->register_method({
 617     name => 'vmdiridx',
 618     path => '{vmid}',
 619     method => 'GET',
 620     proxyto => 'node',
 621     description => "Directory index",
 622     permissions => {
 623         user => 'all',
 624     },
 625     parameters => {
 626         additionalProperties => 0,
 627         properties => {
 628             node => get_standard_option('pve-node'),
 629             vmid => get_standard_option('pve-vmid'),
 630         },
 631     },
 632     returns => {
 633         type => 'array',
 634         items => {
 635             type => "object",
 636             properties => {
 637                 subdir => { type => 'string' },
 638             },
 639         },
 640         links => [ { rel => 'child', href => "{subdir}" } ],
 641     },
 642     code => sub {
 643         my ($param) = @_;
 644
 645         my $res = [
 646             { subdir => 'config' },
 647             { subdir => 'pending' },
 648             { subdir => 'status' },
 649             { subdir => 'unlink' },
 650             { subdir => 'vncproxy' },
 651             { subdir => 'termproxy' },
 652             { subdir => 'migrate' },
 653             { subdir => 'resize' },
 654             { subdir => 'move' },
 655             { subdir => 'rrd' },
 656             { subdir => 'rrddata' },
 657             { subdir => 'monitor' },
 658             { subdir => 'agent' },
 659             { subdir => 'snapshot' },
 660             { subdir => 'spiceproxy' },
 661             { subdir => 'sendkey' },
 662             { subdir => 'firewall' },
 663             ];
 664
 665         return $res;
 666     }});
 667
 668 __PACKAGE__->register_method ({
 669     subclass => "PVE::API2::Firewall::VM",
 670     path => '{vmid}/firewall',
 671 });
 672
 673 __PACKAGE__->register_method ({
 674     subclass => "PVE::API2::Qemu::Agent",
 675     path => '{vmid}/agent',
 676 });
 677
 678 __PACKAGE__->register_method({
 679     name => 'rrd',
 680     path => '{vmid}/rrd',
 681     method => 'GET',
 682     protected => 1, # fixme: can we avoid that?
 683     permissions => {
 684         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 685     },
 686     description => "Read VM RRD statistics (returns PNG)",
 687     parameters => {
 688         additionalProperties => 0,
 689         properties => {
 690             node => get_standard_option('pve-node'),
 691             vmid => get_standard_option('pve-vmid'),
 692             timeframe => {
 693                 description => "Specify the time frame you are interested in.",
 694                 type => 'string',
 695                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 696             },
 697             ds => {
 698                 description => "The list of datasources you want to display.",
 699                 type => 'string', format => 'pve-configid-list',
 700             },
 701             cf => {
 702                 description => "The RRD consolidation function",
 703                 type => 'string',
 704                 enum => [ 'AVERAGE', 'MAX' ],
 705                 optional => 1,
 706             },
 707         },
 708     },
 709     returns => {
 710         type => "object",
 711         properties => {
 712             filename => { type => 'string' },
 713         },
 714     },
 715     code => sub {
 716         my ($param) = @_;
 717
 718         return PVE::Cluster::create_rrd_graph(
 719             "pve2-vm/$param->{vmid}", $param->{timeframe},
 720             $param->{ds}, $param->{cf});
 721
 722     }});
 723
 724 __PACKAGE__->register_method({
 725     name => 'rrddata',
 726     path => '{vmid}/rrddata',
 727     method => 'GET',
 728     protected => 1, # fixme: can we avoid that?
 729     permissions => {
 730         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 731     },
 732     description => "Read VM RRD statistics",
 733     parameters => {
 734         additionalProperties => 0,
 735         properties => {
 736             node => get_standard_option('pve-node'),
 737             vmid => get_standard_option('pve-vmid'),
 738             timeframe => {
 739                 description => "Specify the time frame you are interested in.",
 740                 type => 'string',
 741                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 742             },
 743             cf => {
 744                 description => "The RRD consolidation function",
 745                 type => 'string',
 746                 enum => [ 'AVERAGE', 'MAX' ],
 747                 optional => 1,
 748             },
 749         },
 750     },
 751     returns => {
 752         type => "array",
 753         items => {
 754             type => "object",
 755             properties => {},
 756         },
 757     },
 758     code => sub {
 759         my ($param) = @_;
 760
 761         return PVE::Cluster::create_rrd_data(
 762             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 763     }});
 764
 765
 766 __PACKAGE__->register_method({
 767     name => 'vm_config',
 768     path => '{vmid}/config',
 769     method => 'GET',
 770     proxyto => 'node',
 771     description => "Get current virtual machine configuration. This does not include pending configuration changes (see 'pending' API).",
 772     permissions => {
 773         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 774     },
 775     parameters => {
 776         additionalProperties => 0,
 777         properties => {
 778             node => get_standard_option('pve-node'),
 779             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 780             current => {
 781                 description => "Get current values (instead of pending values).",
 782                 optional => 1,
 783                 default => 0,
 784                 type => 'boolean',
 785             },
 786         },
 787     },
 788     returns => {
 789         type => "object",
 790         properties => {
 791             digest => {
 792                 type => 'string',
 793                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 794             }
 795         },
 796     },
 797     code => sub {
 798         my ($param) = @_;
 799
 800         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 801
 802         delete $conf->{snapshots};
 803
 804         if (!$param->{current}) {
 805             foreach my $opt (keys %{$conf->{pending}}) {
 806                 next if $opt eq 'delete';
 807                 my $value = $conf->{pending}->{$opt};
 808                 next if ref($value); # just to be sure
 809                 $conf->{$opt} = $value;
 810             }
 811             my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 812             foreach my $opt (keys %$pending_delete_hash) {
 813                 delete $conf->{$opt} if $conf->{$opt};
 814             }
 815         }
 816
 817         delete $conf->{pending};
 818
 819         # hide cloudinit password
 820         if ($conf->{cipassword}) {
 821             $conf->{cipassword} = '**********';
 822         }
 823
 824         return $conf;
 825     }});
 826
 827 __PACKAGE__->register_method({
 828     name => 'vm_pending',
 829     path => '{vmid}/pending',
 830     method => 'GET',
 831     proxyto => 'node',
 832     description => "Get virtual machine configuration, including pending changes.",
 833     permissions => {
 834         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 835     },
 836     parameters => {
 837         additionalProperties => 0,
 838         properties => {
 839             node => get_standard_option('pve-node'),
 840             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 841         },
 842     },
 843     returns => {
 844         type => "array",
 845         items => {
 846             type => "object",
 847             properties => {
 848                 key => {
 849                     description => "Configuration option name.",
 850                     type => 'string',
 851                 },
 852                 value => {
 853                     description => "Current value.",
 854                     type => 'string',
 855                     optional => 1,
 856                 },
 857                 pending => {
 858                     description => "Pending value.",
 859                     type => 'string',
 860                     optional => 1,
 861                 },
 862                 delete => {
 863                     description => "Indicates a pending delete request if present and not 0. " .
 864                                    "The value 2 indicates a force-delete request.",
 865                     type => 'integer',
 866                     minimum => 0,
 867                     maximum => 2,
 868                     optional => 1,
 869                 },
 870             },
 871         },
 872     },
 873     code => sub {
 874         my ($param) = @_;
 875
 876         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 877
 878         my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 879
 880         my $res = [];
 881
 882         foreach my $opt (keys %$conf) {
 883             next if ref($conf->{$opt});
 884             my $item = { key => $opt };
 885             $item->{value} = $conf->{$opt} if defined($conf->{$opt});
 886             $item->{pending} = $conf->{pending}->{$opt} if defined($conf->{pending}->{$opt});
 887             $item->{delete} = ($pending_delete_hash->{$opt} ? 2 : 1) if exists $pending_delete_hash->{$opt};
 888
 889             # hide cloudinit password
 890             if ($opt eq 'cipassword') {
 891                 $item->{value} = '**********' if defined($item->{value});
 892                 # the trailing space so that the pending string is different
 893                 $item->{pending} = '********** ' if defined($item->{pending});
 894             }
 895             push @$res, $item;
 896         }
 897
 898         foreach my $opt (keys %{$conf->{pending}}) {
 899             next if $opt eq 'delete';
 900             next if ref($conf->{pending}->{$opt}); # just to be sure
 901             next if defined($conf->{$opt});
 902             my $item = { key => $opt };
 903             $item->{pending} = $conf->{pending}->{$opt};
 904
 905             # hide cloudinit password
 906             if ($opt eq 'cipassword') {
 907                 $item->{pending} = '**********' if defined($item->{pending});
 908             }
 909             push @$res, $item;
 910         }
 911
 912         while (my ($opt, $force) = each %$pending_delete_hash) {
 913             next if $conf->{pending}->{$opt}; # just to be sure
 914             next if $conf->{$opt};
 915             my $item = { key => $opt, delete => ($force ? 2 : 1)};
 916             push @$res, $item;
 917         }
 918
 919         return $res;
 920     }});
 921
 922 # POST/PUT {vmid}/config implementation
 923 #
 924 # The original API used PUT (idempotent) an we assumed that all operations
 925 # are fast. But it turned out that almost any configuration change can
 926 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 927 # time to complete and have side effects (not idempotent).
 928 #
 929 # The new implementation uses POST and forks a worker process. We added
 930 # a new option 'background_delay'. If specified we wait up to
 931 # 'background_delay' second for the worker task to complete. It returns null
 932 # if the task is finished within that time, else we return the UPID.
 933
 934 my $update_vm_api  = sub {
 935     my ($param, $sync) = @_;
 936
 937     my $rpcenv = PVE::RPCEnvironment::get();
 938
 939     my $authuser = $rpcenv->get_user();
 940
 941     my $node = extract_param($param, 'node');
 942
 943     my $vmid = extract_param($param, 'vmid');
 944
 945     my $digest = extract_param($param, 'digest');
 946
 947     my $background_delay = extract_param($param, 'background_delay');
 948
 949     if (defined(my $cipassword = $param->{cipassword})) {
 950         # Same logic as in cloud-init (but with the regex fixed...)
 951         $param->{cipassword} = PVE::Tools::encrypt_pw($cipassword)
 952             if $cipassword !~ /^\$(?:[156]|2[ay])(\$.+){2}/;
 953     }
 954
 955     my @paramarr = (); # used for log message
 956     foreach my $key (sort keys %$param) {
 957         my $value = $key eq 'cipassword' ? '<hidden>' : $param->{$key};
 958         push @paramarr, "-$key", $value;
 959     }
 960
 961     my $skiplock = extract_param($param, 'skiplock');
 962     raise_param_exc({ skiplock => "Only root may use this option." })
 963         if $skiplock && $authuser ne 'root@pam';
 964
 965     my $delete_str = extract_param($param, 'delete');
 966
 967     my $revert_str = extract_param($param, 'revert');
 968
 969     my $force = extract_param($param, 'force');
 970
 971     if (defined(my $ssh_keys = $param->{sshkeys})) {
 972         $ssh_keys = URI::Escape::uri_unescape($ssh_keys);
 973         PVE::Tools::validate_ssh_public_keys($ssh_keys);
 974     }
 975
 976     die "no options specified\n" if !$delete_str && !$revert_str && !scalar(keys %$param);
 977
 978     my $storecfg = PVE::Storage::config();
 979
 980     my $defaults = PVE::QemuServer::load_defaults();
 981
 982     &$resolve_cdrom_alias($param);
 983
 984     # now try to verify all parameters
 985
 986     my $revert = {};
 987     foreach my $opt (PVE::Tools::split_list($revert_str)) {
 988         if (!PVE::QemuServer::option_exists($opt)) {
 989             raise_param_exc({ revert => "unknown option '$opt'" });
 990         }
 991
 992         raise_param_exc({ delete => "you can't use '-$opt' and " .
 993                               "-revert $opt' at the same time" })
 994             if defined($param->{$opt});
 995
 996         $revert->{$opt} = 1;
 997     }
 998
 999     my @delete = ();
1000     foreach my $opt (PVE::Tools::split_list($delete_str)) {
1001         $opt = 'ide2' if $opt eq 'cdrom';
1002
1003         raise_param_exc({ delete => "you can't use '-$opt' and " .
1004                               "-delete $opt' at the same time" })
1005             if defined($param->{$opt});
1006
1007         raise_param_exc({ revert => "you can't use '-delete $opt' and " .
1008                               "-revert $opt' at the same time" })
1009             if $revert->{$opt};
1010
1011         if (!PVE::QemuServer::option_exists($opt)) {
1012             raise_param_exc({ delete => "unknown option '$opt'" });
1013         }
1014
1015         push @delete, $opt;
1016     }
1017
1018     my $repl_conf = PVE::ReplicationConfig->new();
1019     my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
1020     my $check_replication = sub {
1021         my ($drive) = @_;
1022         return if !$is_replicated;
1023         my $volid = $drive->{file};
1024         return if !$volid || !($drive->{replicate}//1);
1025         return if PVE::QemuServer::drive_is_cdrom($drive);
1026         my ($storeid, $format);
1027         if ($volid =~ $NEW_DISK_RE) {
1028             $storeid = $2;
1029             $format = $drive->{format} || PVE::Storage::storage_default_format($storecfg, $storeid);
1030         } else {
1031             ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
1032             $format = (PVE::Storage::parse_volname($storecfg, $volid))[6];
1033         }
1034         return if PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
1035         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
1036         return if $scfg->{shared};
1037         die "cannot add non-replicatable volume to a replicated VM\n";
1038     };
1039
1040     foreach my $opt (keys %$param) {
1041         if (PVE::QemuServer::is_valid_drivename($opt)) {
1042             # cleanup drive path
1043             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1044             raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
1045             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
1046             $check_replication->($drive);
1047             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
1048         } elsif ($opt =~ m/^net(\d+)$/) {
1049             # add macaddr
1050             my $net = PVE::QemuServer::parse_net($param->{$opt});
1051             $param->{$opt} = PVE::QemuServer::print_net($net);
1052         }
1053     }
1054
1055     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
1056
1057     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
1058
1059     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
1060
1061     my $updatefn =  sub {
1062
1063         my $conf = PVE::QemuConfig->load_config($vmid);
1064
1065         die "checksum missmatch (file change by other user?)\n"
1066             if $digest && $digest ne $conf->{digest};
1067
1068         PVE::QemuConfig->check_lock($conf) if !$skiplock;
1069
1070         foreach my $opt (keys %$revert) {
1071             if (defined($conf->{$opt})) {
1072                 $param->{$opt} = $conf->{$opt};
1073             } elsif (defined($conf->{pending}->{$opt})) {
1074                 push @delete, $opt;
1075             }
1076         }
1077
1078         if ($param->{memory} || defined($param->{balloon})) {
1079             my $maxmem = $param->{memory} || $conf->{pending}->{memory} || $conf->{memory} || $defaults->{memory};
1080             my $balloon = defined($param->{balloon}) ? $param->{balloon} : $conf->{pending}->{balloon} || $conf->{balloon};
1081
1082             die "balloon value too large (must be smaller than assigned memory)\n"
1083                 if $balloon && $balloon > $maxmem;
1084         }
1085
1086         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
1087
1088         my $worker = sub {
1089
1090             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
1091
1092             # write updates to pending section
1093
1094             my $modified = {}; # record what $option we modify
1095
1096             foreach my $opt (@delete) {
1097                 $modified->{$opt} = 1;
1098                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1099                 if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
1100                     warn "cannot delete '$opt' - not set in current configuration!\n";
1101                     $modified->{$opt} = 0;
1102                     next;
1103                 }
1104
1105                 if ($opt =~ m/^unused/) {
1106                     my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
1107                     PVE::QemuConfig->check_protection($conf, "can't remove unused disk '$drive->{file}'");
1108                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1109                     if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, $drive, $rpcenv, $authuser)) {
1110                         delete $conf->{$opt};
1111                         PVE::QemuConfig->write_config($vmid, $conf);
1112                     }
1113                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
1114                     PVE::QemuConfig->check_protection($conf, "can't remove drive '$opt'");
1115                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1116                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1117                         if defined($conf->{pending}->{$opt});
1118                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1119                     PVE::QemuConfig->write_config($vmid, $conf);
1120                 } else {
1121                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1122                     PVE::QemuConfig->write_config($vmid, $conf);
1123                 }
1124             }
1125
1126             foreach my $opt (keys %$param) { # add/change
1127                 $modified->{$opt} = 1;
1128                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1129                 next if defined($conf->{pending}->{$opt}) && ($param->{$opt} eq $conf->{pending}->{$opt}); # skip if nothing changed
1130
1131                 if (PVE::QemuServer::is_valid_drivename($opt)) {
1132                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1133                     # FIXME: cloudinit: CDROM or Disk?
1134                     if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
1135                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
1136                     } else {
1137                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1138                     }
1139                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1140                         if defined($conf->{pending}->{$opt});
1141
1142                     &$create_disks($rpcenv, $authuser, $conf->{pending}, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
1143                 } else {
1144                     $conf->{pending}->{$opt} = $param->{$opt};
1145                 }
1146                 PVE::QemuServer::vmconfig_undelete_pending_option($conf, $opt);
1147                 PVE::QemuConfig->write_config($vmid, $conf);
1148             }
1149
1150             # remove pending changes when nothing changed
1151             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1152             my $changes = PVE::QemuServer::vmconfig_cleanup_pending($conf);
1153             PVE::QemuConfig->write_config($vmid, $conf) if $changes;
1154
1155             return if !scalar(keys %{$conf->{pending}});
1156
1157             my $running = PVE::QemuServer::check_running($vmid);
1158
1159             # apply pending changes
1160
1161             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1162
1163             if ($running) {
1164                 my $errors = {};
1165                 PVE::QemuServer::vmconfig_hotplug_pending($vmid, $conf, $storecfg, $modified, $errors);
1166                 raise_param_exc($errors) if scalar(keys %$errors);
1167             } else {
1168                 PVE::QemuServer::vmconfig_apply_pending($vmid, $conf, $storecfg, $running);
1169             }
1170
1171             return;
1172         };
1173
1174         if ($sync) {
1175             &$worker();
1176             return undef;
1177         } else {
1178             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1179
1180             if ($background_delay) {
1181
1182                 # Note: It would be better to do that in the Event based HTTPServer
1183                 # to avoid blocking call to sleep.
1184
1185                 my $end_time = time() + $background_delay;
1186
1187                 my $task = PVE::Tools::upid_decode($upid);
1188
1189                 my $running = 1;
1190                 while (time() < $end_time) {
1191                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1192                     last if !$running;
1193                     sleep(1); # this gets interrupted when child process ends
1194                 }
1195
1196                 if (!$running) {
1197                     my $status = PVE::Tools::upid_read_status($upid);
1198                     return undef if $status eq 'OK';
1199                     die $status;
1200                 }
1201             }
1202
1203             return $upid;
1204         }
1205     };
1206
1207     return PVE::QemuConfig->lock_config($vmid, $updatefn);
1208 };
1209
1210 my $vm_config_perm_list = [
1211             'VM.Config.Disk',
1212             'VM.Config.CDROM',
1213             'VM.Config.CPU',
1214             'VM.Config.Memory',
1215             'VM.Config.Network',
1216             'VM.Config.HWType',
1217             'VM.Config.Options',
1218     ];
1219
1220 __PACKAGE__->register_method({
1221     name => 'update_vm_async',
1222     path => '{vmid}/config',
1223     method => 'POST',
1224     protected => 1,
1225     proxyto => 'node',
1226     description => "Set virtual machine options (asynchrounous API).",
1227     permissions => {
1228         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1229     },
1230     parameters => {
1231         additionalProperties => 0,
1232         properties => PVE::QemuServer::json_config_properties(
1233             {
1234                 node => get_standard_option('pve-node'),
1235                 vmid => get_standard_option('pve-vmid'),
1236                 skiplock => get_standard_option('skiplock'),
1237                 delete => {
1238                     type => 'string', format => 'pve-configid-list',
1239                     description => "A list of settings you want to delete.",
1240                     optional => 1,
1241                 },
1242                 revert => {
1243                     type => 'string', format => 'pve-configid-list',
1244                     description => "Revert a pending change.",
1245                     optional => 1,
1246                 },
1247                 force => {
1248                     type => 'boolean',
1249                     description => $opt_force_description,
1250                     optional => 1,
1251                     requires => 'delete',
1252                 },
1253                 digest => {
1254                     type => 'string',
1255                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1256                     maxLength => 40,
1257                     optional => 1,
1258                 },
1259                 background_delay => {
1260                     type => 'integer',
1261                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1262                     minimum => 1,
1263                     maximum => 30,
1264                     optional => 1,
1265                 },
1266             }),
1267     },
1268     returns => {
1269         type => 'string',
1270         optional => 1,
1271     },
1272     code => $update_vm_api,
1273 });
1274
1275 __PACKAGE__->register_method({
1276     name => 'update_vm',
1277     path => '{vmid}/config',
1278     method => 'PUT',
1279     protected => 1,
1280     proxyto => 'node',
1281     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1282     permissions => {
1283         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1284     },
1285     parameters => {
1286         additionalProperties => 0,
1287         properties => PVE::QemuServer::json_config_properties(
1288             {
1289                 node => get_standard_option('pve-node'),
1290                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1291                 skiplock => get_standard_option('skiplock'),
1292                 delete => {
1293                     type => 'string', format => 'pve-configid-list',
1294                     description => "A list of settings you want to delete.",
1295                     optional => 1,
1296                 },
1297                 revert => {
1298                     type => 'string', format => 'pve-configid-list',
1299                     description => "Revert a pending change.",
1300                     optional => 1,
1301                 },
1302                 force => {
1303                     type => 'boolean',
1304                     description => $opt_force_description,
1305                     optional => 1,
1306                     requires => 'delete',
1307                 },
1308                 digest => {
1309                     type => 'string',
1310                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1311                     maxLength => 40,
1312                     optional => 1,
1313                 },
1314             }),
1315     },
1316     returns => { type => 'null' },
1317     code => sub {
1318         my ($param) = @_;
1319         &$update_vm_api($param, 1);
1320         return undef;
1321     }
1322 });
1323
1324
1325 __PACKAGE__->register_method({
1326     name => 'destroy_vm',
1327     path => '{vmid}',
1328     method => 'DELETE',
1329     protected => 1,
1330     proxyto => 'node',
1331     description => "Destroy the vm (also delete all used/owned volumes).",
1332     permissions => {
1333         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1334     },
1335     parameters => {
1336         additionalProperties => 0,
1337         properties => {
1338             node => get_standard_option('pve-node'),
1339             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1340             skiplock => get_standard_option('skiplock'),
1341         },
1342     },
1343     returns => {
1344         type => 'string',
1345     },
1346     code => sub {
1347         my ($param) = @_;
1348
1349         my $rpcenv = PVE::RPCEnvironment::get();
1350
1351         my $authuser = $rpcenv->get_user();
1352
1353         my $vmid = $param->{vmid};
1354
1355         my $skiplock = $param->{skiplock};
1356         raise_param_exc({ skiplock => "Only root may use this option." })
1357             if $skiplock && $authuser ne 'root@pam';
1358
1359         # test if VM exists
1360         my $conf = PVE::QemuConfig->load_config($vmid);
1361
1362         my $storecfg = PVE::Storage::config();
1363
1364         PVE::QemuConfig->check_protection($conf, "can't remove VM $vmid");
1365
1366         die "unable to remove VM $vmid - used in HA resources\n"
1367             if PVE::HA::Config::vm_is_ha_managed($vmid);
1368
1369         # do not allow destroy if there are replication jobs
1370         my $repl_conf = PVE::ReplicationConfig->new();
1371         $repl_conf->check_for_existing_jobs($vmid);
1372
1373         # early tests (repeat after locking)
1374         die "VM $vmid is running - destroy failed\n"
1375             if PVE::QemuServer::check_running($vmid);
1376
1377         my $realcmd = sub {
1378             my $upid = shift;
1379
1380             syslog('info', "destroy VM $vmid: $upid\n");
1381
1382             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1383
1384             PVE::AccessControl::remove_vm_access($vmid);
1385
1386             PVE::Firewall::remove_vmfw_conf($vmid);
1387         };
1388
1389         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1390     }});
1391
1392 __PACKAGE__->register_method({
1393     name => 'unlink',
1394     path => '{vmid}/unlink',
1395     method => 'PUT',
1396     protected => 1,
1397     proxyto => 'node',
1398     description => "Unlink/delete disk images.",
1399     permissions => {
1400         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1401     },
1402     parameters => {
1403         additionalProperties => 0,
1404         properties => {
1405             node => get_standard_option('pve-node'),
1406             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1407             idlist => {
1408                 type => 'string', format => 'pve-configid-list',
1409                 description => "A list of disk IDs you want to delete.",
1410             },
1411             force => {
1412                 type => 'boolean',
1413                 description => $opt_force_description,
1414                 optional => 1,
1415             },
1416         },
1417     },
1418     returns => { type => 'null'},
1419     code => sub {
1420         my ($param) = @_;
1421
1422         $param->{delete} = extract_param($param, 'idlist');
1423
1424         __PACKAGE__->update_vm($param);
1425
1426         return undef;
1427     }});
1428
1429 my $sslcert;
1430
1431 __PACKAGE__->register_method({
1432     name => 'vncproxy',
1433     path => '{vmid}/vncproxy',
1434     method => 'POST',
1435     protected => 1,
1436     permissions => {
1437         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1438     },
1439     description => "Creates a TCP VNC proxy connections.",
1440     parameters => {
1441         additionalProperties => 0,
1442         properties => {
1443             node => get_standard_option('pve-node'),
1444             vmid => get_standard_option('pve-vmid'),
1445             websocket => {
1446                 optional => 1,
1447                 type => 'boolean',
1448                 description => "starts websockify instead of vncproxy",
1449             },
1450         },
1451     },
1452     returns => {
1453         additionalProperties => 0,
1454         properties => {
1455             user => { type => 'string' },
1456             ticket => { type => 'string' },
1457             cert => { type => 'string' },
1458             port => { type => 'integer' },
1459             upid => { type => 'string' },
1460         },
1461     },
1462     code => sub {
1463         my ($param) = @_;
1464
1465         my $rpcenv = PVE::RPCEnvironment::get();
1466
1467         my $authuser = $rpcenv->get_user();
1468
1469         my $vmid = $param->{vmid};
1470         my $node = $param->{node};
1471         my $websocket = $param->{websocket};
1472
1473         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1474
1475         my $authpath = "/vms/$vmid";
1476
1477         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1478
1479         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1480             if !$sslcert;
1481
1482         my ($remip, $family);
1483         my $remcmd = [];
1484
1485         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1486             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1487             # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
1488             $remcmd = ['/usr/bin/ssh', '-e', 'none', '-T', '-o', 'BatchMode=yes', $remip];
1489         } else {
1490             $family = PVE::Tools::get_host_address_family($node);
1491         }
1492
1493         my $port = PVE::Tools::next_vnc_port($family);
1494
1495         my $timeout = 10;
1496
1497         my $realcmd = sub {
1498             my $upid = shift;
1499
1500             syslog('info', "starting vnc proxy $upid\n");
1501
1502             my $cmd;
1503
1504             if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
1505
1506
1507                 my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga}, '-escape', '0' ];
1508
1509                 $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
1510                         '-timeout', $timeout, '-authpath', $authpath,
1511                         '-perm', 'Sys.Console'];
1512
1513                 if ($param->{websocket}) {
1514                     $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
1515                     push @$cmd, '-notls', '-listen', 'localhost';
1516                 }
1517
1518                 push @$cmd, '-c', @$remcmd, @$termcmd;
1519
1520                 PVE::Tools::run_command($cmd);
1521
1522             } else {
1523
1524                 $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
1525
1526                 $cmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1527
1528                 my $sock = IO::Socket::IP->new(
1529                     ReuseAddr => 1,
1530                     Listen => 1,
1531                     LocalPort => $port,
1532                     Proto => 'tcp',
1533                     GetAddrInfoFlags => 0,
1534                     ) or die "failed to create socket: $!\n";
1535                 # Inside the worker we shouldn't have any previous alarms
1536                 # running anyway...:
1537                 alarm(0);
1538                 local $SIG{ALRM} = sub { die "connection timed out\n" };
1539                 alarm $timeout;
1540                 accept(my $cli, $sock) or die "connection failed: $!\n";
1541                 alarm(0);
1542                 close($sock);
1543                 if (PVE::Tools::run_command($cmd,
1544                     output => '>&'.fileno($cli),
1545                     input => '<&'.fileno($cli),
1546                     noerr => 1) != 0)
1547                 {
1548                     die "Failed to run vncproxy.\n";
1549                 }
1550             }
1551
1552             return;
1553         };
1554
1555         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1556
1557         PVE::Tools::wait_for_vnc_port($port);
1558
1559         return {
1560             user => $authuser,
1561             ticket => $ticket,
1562             port => $port,
1563             upid => $upid,
1564             cert => $sslcert,
1565         };
1566     }});
1567
1568 __PACKAGE__->register_method({
1569     name => 'termproxy',
1570     path => '{vmid}/termproxy',
1571     method => 'POST',
1572     protected => 1,
1573     permissions => {
1574         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1575     },
1576     description => "Creates a TCP proxy connections.",
1577     parameters => {
1578         additionalProperties => 0,
1579         properties => {
1580             node => get_standard_option('pve-node'),
1581             vmid => get_standard_option('pve-vmid'),
1582             serial=> {
1583                 optional => 1,
1584                 type => 'string',
1585                 enum => [qw(serial0 serial1 serial2 serial3)],
1586                 description => "opens a serial terminal (defaults to display)",
1587             },
1588         },
1589     },
1590     returns => {
1591         additionalProperties => 0,
1592         properties => {
1593             user => { type => 'string' },
1594             ticket => { type => 'string' },
1595             port => { type => 'integer' },
1596             upid => { type => 'string' },
1597         },
1598     },
1599     code => sub {
1600         my ($param) = @_;
1601
1602         my $rpcenv = PVE::RPCEnvironment::get();
1603
1604         my $authuser = $rpcenv->get_user();
1605
1606         my $vmid = $param->{vmid};
1607         my $node = $param->{node};
1608         my $serial = $param->{serial};
1609
1610         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1611
1612         if (!defined($serial)) {
1613             if ($conf->{vga} && $conf->{vga} =~ m/^serial\d+$/) {
1614                 $serial = $conf->{vga};
1615             }
1616         }
1617
1618         my $authpath = "/vms/$vmid";
1619
1620         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1621
1622         my ($remip, $family);
1623
1624         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1625             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1626         } else {
1627             $family = PVE::Tools::get_host_address_family($node);
1628         }
1629
1630         my $port = PVE::Tools::next_vnc_port($family);
1631
1632         my $remcmd = $remip ?
1633             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
1634
1635         my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-escape', '0'];
1636         push @$termcmd, '-iface', $serial if $serial;
1637
1638         my $realcmd = sub {
1639             my $upid = shift;
1640
1641             syslog('info', "starting qemu termproxy $upid\n");
1642
1643             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
1644                        '--perm', 'VM.Console', '--'];
1645             push @$cmd, @$remcmd, @$termcmd;
1646
1647             PVE::Tools::run_command($cmd);
1648         };
1649
1650         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1651
1652         PVE::Tools::wait_for_vnc_port($port);
1653
1654         return {
1655             user => $authuser,
1656             ticket => $ticket,
1657             port => $port,
1658             upid => $upid,
1659         };
1660     }});
1661
1662 __PACKAGE__->register_method({
1663     name => 'vncwebsocket',
1664     path => '{vmid}/vncwebsocket',
1665     method => 'GET',
1666     permissions => {
1667         description => "You also need to pass a valid ticket (vncticket).",
1668         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1669     },
1670     description => "Opens a weksocket for VNC traffic.",
1671     parameters => {
1672         additionalProperties => 0,
1673         properties => {
1674             node => get_standard_option('pve-node'),
1675             vmid => get_standard_option('pve-vmid'),
1676             vncticket => {
1677                 description => "Ticket from previous call to vncproxy.",
1678                 type => 'string',
1679                 maxLength => 512,
1680             },
1681             port => {
1682                 description => "Port number returned by previous vncproxy call.",
1683                 type => 'integer',
1684                 minimum => 5900,
1685                 maximum => 5999,
1686             },
1687         },
1688     },
1689     returns => {
1690         type => "object",
1691         properties => {
1692             port => { type => 'string' },
1693         },
1694     },
1695     code => sub {
1696         my ($param) = @_;
1697
1698         my $rpcenv = PVE::RPCEnvironment::get();
1699
1700         my $authuser = $rpcenv->get_user();
1701
1702         my $vmid = $param->{vmid};
1703         my $node = $param->{node};
1704
1705         my $authpath = "/vms/$vmid";
1706
1707         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1708
1709         my $conf = PVE::QemuConfig->load_config($vmid, $node); # VM exists ?
1710
1711         # Note: VNC ports are acessible from outside, so we do not gain any
1712         # security if we verify that $param->{port} belongs to VM $vmid. This
1713         # check is done by verifying the VNC ticket (inside VNC protocol).
1714
1715         my $port = $param->{port};
1716
1717         return { port => $port };
1718     }});
1719
1720 __PACKAGE__->register_method({
1721     name => 'spiceproxy',
1722     path => '{vmid}/spiceproxy',
1723     method => 'POST',
1724     protected => 1,
1725     proxyto => 'node',
1726     permissions => {
1727         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1728     },
1729     description => "Returns a SPICE configuration to connect to the VM.",
1730     parameters => {
1731         additionalProperties => 0,
1732         properties => {
1733             node => get_standard_option('pve-node'),
1734             vmid => get_standard_option('pve-vmid'),
1735             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1736         },
1737     },
1738     returns => get_standard_option('remote-viewer-config'),
1739     code => sub {
1740         my ($param) = @_;
1741
1742         my $rpcenv = PVE::RPCEnvironment::get();
1743
1744         my $authuser = $rpcenv->get_user();
1745
1746         my $vmid = $param->{vmid};
1747         my $node = $param->{node};
1748         my $proxy = $param->{proxy};
1749
1750         my $conf = PVE::QemuConfig->load_config($vmid, $node);
1751         my $title = "VM $vmid";
1752         $title .= " - ". $conf->{name} if $conf->{name};
1753
1754         my $port = PVE::QemuServer::spice_port($vmid);
1755
1756         my ($ticket, undef, $remote_viewer_config) =
1757             PVE::AccessControl::remote_viewer_config($authuser, $vmid, $node, $proxy, $title, $port);
1758
1759         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1760         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1761
1762         return $remote_viewer_config;
1763     }});
1764
1765 __PACKAGE__->register_method({
1766     name => 'vmcmdidx',
1767     path => '{vmid}/status',
1768     method => 'GET',
1769     proxyto => 'node',
1770     description => "Directory index",
1771     permissions => {
1772         user => 'all',
1773     },
1774     parameters => {
1775         additionalProperties => 0,
1776         properties => {
1777             node => get_standard_option('pve-node'),
1778             vmid => get_standard_option('pve-vmid'),
1779         },
1780     },
1781     returns => {
1782         type => 'array',
1783         items => {
1784             type => "object",
1785             properties => {
1786                 subdir => { type => 'string' },
1787             },
1788         },
1789         links => [ { rel => 'child', href => "{subdir}" } ],
1790     },
1791     code => sub {
1792         my ($param) = @_;
1793
1794         # test if VM exists
1795         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1796
1797         my $res = [
1798             { subdir => 'current' },
1799             { subdir => 'start' },
1800             { subdir => 'stop' },
1801             ];
1802
1803         return $res;
1804     }});
1805
1806 __PACKAGE__->register_method({
1807     name => 'vm_status',
1808     path => '{vmid}/status/current',
1809     method => 'GET',
1810     proxyto => 'node',
1811     protected => 1, # qemu pid files are only readable by root
1812     description => "Get virtual machine status.",
1813     permissions => {
1814         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1815     },
1816     parameters => {
1817         additionalProperties => 0,
1818         properties => {
1819             node => get_standard_option('pve-node'),
1820             vmid => get_standard_option('pve-vmid'),
1821         },
1822     },
1823     returns => { type => 'object' },
1824     code => sub {
1825         my ($param) = @_;
1826
1827         # test if VM exists
1828         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1829
1830         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1831         my $status = $vmstatus->{$param->{vmid}};
1832
1833         $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
1834
1835         $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
1836
1837         $status->{agent} = 1 if $conf->{agent};
1838
1839         return $status;
1840     }});
1841
1842 __PACKAGE__->register_method({
1843     name => 'vm_start',
1844     path => '{vmid}/status/start',
1845     method => 'POST',
1846     protected => 1,
1847     proxyto => 'node',
1848     description => "Start virtual machine.",
1849     permissions => {
1850         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1851     },
1852     parameters => {
1853         additionalProperties => 0,
1854         properties => {
1855             node => get_standard_option('pve-node'),
1856             vmid => get_standard_option('pve-vmid',
1857                                         { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1858             skiplock => get_standard_option('skiplock'),
1859             stateuri => get_standard_option('pve-qm-stateuri'),
1860             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1861             migration_type => {
1862                 type => 'string',
1863                 enum => ['secure', 'insecure'],
1864                 description => "Migration traffic is encrypted using an SSH " .
1865                   "tunnel by default. On secure, completely private networks " .
1866                   "this can be disabled to increase performance.",
1867                 optional => 1,
1868             },
1869             migration_network => {
1870                 type => 'string', format => 'CIDR',
1871                 description => "CIDR of the (sub) network that is used for migration.",
1872                 optional => 1,
1873             },
1874             machine => get_standard_option('pve-qm-machine'),
1875             targetstorage => {
1876                 description => "Target storage for the migration. (Can be '1' to use the same storage id as on the source node.)",
1877                 type => 'string',
1878                 optional => 1
1879             }
1880         },
1881     },
1882     returns => {
1883         type => 'string',
1884     },
1885     code => sub {
1886         my ($param) = @_;
1887
1888         my $rpcenv = PVE::RPCEnvironment::get();
1889
1890         my $authuser = $rpcenv->get_user();
1891
1892         my $node = extract_param($param, 'node');
1893
1894         my $vmid = extract_param($param, 'vmid');
1895
1896         my $machine = extract_param($param, 'machine');
1897
1898         my $stateuri = extract_param($param, 'stateuri');
1899         raise_param_exc({ stateuri => "Only root may use this option." })
1900             if $stateuri && $authuser ne 'root@pam';
1901
1902         my $skiplock = extract_param($param, 'skiplock');
1903         raise_param_exc({ skiplock => "Only root may use this option." })
1904             if $skiplock && $authuser ne 'root@pam';
1905
1906         my $migratedfrom = extract_param($param, 'migratedfrom');
1907         raise_param_exc({ migratedfrom => "Only root may use this option." })
1908             if $migratedfrom && $authuser ne 'root@pam';
1909
1910         my $migration_type = extract_param($param, 'migration_type');
1911         raise_param_exc({ migration_type => "Only root may use this option." })
1912             if $migration_type && $authuser ne 'root@pam';
1913
1914         my $migration_network = extract_param($param, 'migration_network');
1915         raise_param_exc({ migration_network => "Only root may use this option." })
1916             if $migration_network && $authuser ne 'root@pam';
1917
1918         my $targetstorage = extract_param($param, 'targetstorage');
1919         raise_param_exc({ targetstorage => "Only root may use this option." })
1920             if $targetstorage && $authuser ne 'root@pam';
1921
1922         raise_param_exc({ targetstorage => "targetstorage can only by used with migratedfrom." })
1923             if $targetstorage && !$migratedfrom;
1924
1925         # read spice ticket from STDIN
1926         my $spice_ticket;
1927         if ($stateuri && ($stateuri eq 'tcp') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
1928             if (defined(my $line = <STDIN>)) {
1929                 chomp $line;
1930                 $spice_ticket = $line;
1931             }
1932         }
1933
1934         PVE::Cluster::check_cfs_quorum();
1935
1936         my $storecfg = PVE::Storage::config();
1937
1938         if (PVE::HA::Config::vm_is_ha_managed($vmid) && !$stateuri &&
1939             $rpcenv->{type} ne 'ha') {
1940
1941             my $hacmd = sub {
1942                 my $upid = shift;
1943
1944                 my $service = "vm:$vmid";
1945
1946                 my $cmd = ['ha-manager', 'set', $service, '--state', 'started'];
1947
1948                 print "Requesting HA start for VM $vmid\n";
1949
1950                 PVE::Tools::run_command($cmd);
1951
1952                 return;
1953             };
1954
1955             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1956
1957         } else {
1958
1959             my $realcmd = sub {
1960                 my $upid = shift;
1961
1962                 syslog('info', "start VM $vmid: $upid\n");
1963
1964                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef,
1965                                           $machine, $spice_ticket, $migration_network, $migration_type, $targetstorage);
1966
1967                 return;
1968             };
1969
1970             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1971         }
1972     }});
1973
1974 __PACKAGE__->register_method({
1975     name => 'vm_stop',
1976     path => '{vmid}/status/stop',
1977     method => 'POST',
1978     protected => 1,
1979     proxyto => 'node',
1980     description => "Stop virtual machine. The qemu process will exit immediately. This" .
1981         "is akin to pulling the power plug of a running computer and may damage the VM data",
1982     permissions => {
1983         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1984     },
1985     parameters => {
1986         additionalProperties => 0,
1987         properties => {
1988             node => get_standard_option('pve-node'),
1989             vmid => get_standard_option('pve-vmid',
1990                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1991             skiplock => get_standard_option('skiplock'),
1992             migratedfrom => get_standard_option('pve-node', { optional => 1 }),
1993             timeout => {
1994                 description => "Wait maximal timeout seconds.",
1995                 type => 'integer',
1996                 minimum => 0,
1997                 optional => 1,
1998             },
1999             keepActive => {
2000                 description => "Do not deactivate storage volumes.",
2001                 type => 'boolean',
2002                 optional => 1,
2003                 default => 0,
2004             }
2005         },
2006     },
2007     returns => {
2008         type => 'string',
2009     },
2010     code => sub {
2011         my ($param) = @_;
2012
2013         my $rpcenv = PVE::RPCEnvironment::get();
2014
2015         my $authuser = $rpcenv->get_user();
2016
2017         my $node = extract_param($param, 'node');
2018
2019         my $vmid = extract_param($param, 'vmid');
2020
2021         my $skiplock = extract_param($param, 'skiplock');
2022         raise_param_exc({ skiplock => "Only root may use this option." })
2023             if $skiplock && $authuser ne 'root@pam';
2024
2025         my $keepActive = extract_param($param, 'keepActive');
2026         raise_param_exc({ keepActive => "Only root may use this option." })
2027             if $keepActive && $authuser ne 'root@pam';
2028
2029         my $migratedfrom = extract_param($param, 'migratedfrom');
2030         raise_param_exc({ migratedfrom => "Only root may use this option." })
2031             if $migratedfrom && $authuser ne 'root@pam';
2032
2033
2034         my $storecfg = PVE::Storage::config();
2035
2036         if (PVE::HA::Config::vm_is_ha_managed($vmid) && ($rpcenv->{type} ne 'ha') && !defined($migratedfrom)) {
2037
2038             my $hacmd = sub {
2039                 my $upid = shift;
2040
2041                 my $service = "vm:$vmid";
2042
2043                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
2044
2045                 print "Requesting HA stop for VM $vmid\n";
2046
2047                 PVE::Tools::run_command($cmd);
2048
2049                 return;
2050             };
2051
2052             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
2053
2054         } else {
2055             my $realcmd = sub {
2056                 my $upid = shift;
2057
2058                 syslog('info', "stop VM $vmid: $upid\n");
2059
2060                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
2061                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
2062
2063                 return;
2064             };
2065
2066             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
2067         }
2068     }});
2069
2070 __PACKAGE__->register_method({
2071     name => 'vm_reset',
2072     path => '{vmid}/status/reset',
2073     method => 'POST',
2074     protected => 1,
2075     proxyto => 'node',
2076     description => "Reset virtual machine.",
2077     permissions => {
2078         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2079     },
2080     parameters => {
2081         additionalProperties => 0,
2082         properties => {
2083             node => get_standard_option('pve-node'),
2084             vmid => get_standard_option('pve-vmid',
2085                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2086             skiplock => get_standard_option('skiplock'),
2087         },
2088     },
2089     returns => {
2090         type => 'string',
2091     },
2092     code => sub {
2093         my ($param) = @_;
2094
2095         my $rpcenv = PVE::RPCEnvironment::get();
2096
2097         my $authuser = $rpcenv->get_user();
2098
2099         my $node = extract_param($param, 'node');
2100
2101         my $vmid = extract_param($param, 'vmid');
2102
2103         my $skiplock = extract_param($param, 'skiplock');
2104         raise_param_exc({ skiplock => "Only root may use this option." })
2105             if $skiplock && $authuser ne 'root@pam';
2106
2107         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2108
2109         my $realcmd = sub {
2110             my $upid = shift;
2111
2112             PVE::QemuServer::vm_reset($vmid, $skiplock);
2113
2114             return;
2115         };
2116
2117         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
2118     }});
2119
2120 __PACKAGE__->register_method({
2121     name => 'vm_shutdown',
2122     path => '{vmid}/status/shutdown',
2123     method => 'POST',
2124     protected => 1,
2125     proxyto => 'node',
2126     description => "Shutdown virtual machine. This is similar to pressing the power button on a physical machine." .
2127         "This will send an ACPI event for the guest OS, which should then proceed to a clean shutdown.",
2128     permissions => {
2129         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2130     },
2131     parameters => {
2132         additionalProperties => 0,
2133         properties => {
2134             node => get_standard_option('pve-node'),
2135             vmid => get_standard_option('pve-vmid',
2136                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2137             skiplock => get_standard_option('skiplock'),
2138             timeout => {
2139                 description => "Wait maximal timeout seconds.",
2140                 type => 'integer',
2141                 minimum => 0,
2142                 optional => 1,
2143             },
2144             forceStop => {
2145                 description => "Make sure the VM stops.",
2146                 type => 'boolean',
2147                 optional => 1,
2148                 default => 0,
2149             },
2150             keepActive => {
2151                 description => "Do not deactivate storage volumes.",
2152                 type => 'boolean',
2153                 optional => 1,
2154                 default => 0,
2155             }
2156         },
2157     },
2158     returns => {
2159         type => 'string',
2160     },
2161     code => sub {
2162         my ($param) = @_;
2163
2164         my $rpcenv = PVE::RPCEnvironment::get();
2165
2166         my $authuser = $rpcenv->get_user();
2167
2168         my $node = extract_param($param, 'node');
2169
2170         my $vmid = extract_param($param, 'vmid');
2171
2172         my $skiplock = extract_param($param, 'skiplock');
2173         raise_param_exc({ skiplock => "Only root may use this option." })
2174             if $skiplock && $authuser ne 'root@pam';
2175
2176         my $keepActive = extract_param($param, 'keepActive');
2177         raise_param_exc({ keepActive => "Only root may use this option." })
2178             if $keepActive && $authuser ne 'root@pam';
2179
2180         my $storecfg = PVE::Storage::config();
2181
2182         my $shutdown = 1;
2183
2184         # if vm is paused, do not shutdown (but stop if forceStop = 1)
2185         # otherwise, we will infer a shutdown command, but run into the timeout,
2186         # then when the vm is resumed, it will instantly shutdown
2187         #
2188         # checking the qmp status here to get feedback to the gui/cli/api
2189         # and the status query should not take too long
2190         my $qmpstatus;
2191         eval {
2192             $qmpstatus = PVE::QemuServer::vm_qmp_command($vmid, { execute => "query-status" }, 0);
2193         };
2194         my $err = $@ if $@;
2195
2196         if (!$err && $qmpstatus->{status} eq "paused") {
2197             if ($param->{forceStop}) {
2198                 warn "VM is paused - stop instead of shutdown\n";
2199                 $shutdown = 0;
2200             } else {
2201                 die "VM is paused - cannot shutdown\n";
2202             }
2203         }
2204
2205         if (PVE::HA::Config::vm_is_ha_managed($vmid) &&
2206             ($rpcenv->{type} ne 'ha')) {
2207
2208             my $hacmd = sub {
2209                 my $upid = shift;
2210
2211                 my $service = "vm:$vmid";
2212
2213                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
2214
2215                 print "Requesting HA stop for VM $vmid\n";
2216
2217                 PVE::Tools::run_command($cmd);
2218
2219                 return;
2220             };
2221
2222             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
2223
2224         } else {
2225
2226             my $realcmd = sub {
2227                 my $upid = shift;
2228
2229                 syslog('info', "shutdown VM $vmid: $upid\n");
2230
2231                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
2232                                          $shutdown, $param->{forceStop}, $keepActive);
2233
2234                 return;
2235             };
2236
2237             return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
2238         }
2239     }});
2240
2241 __PACKAGE__->register_method({
2242     name => 'vm_suspend',
2243     path => '{vmid}/status/suspend',
2244     method => 'POST',
2245     protected => 1,
2246     proxyto => 'node',
2247     description => "Suspend virtual machine.",
2248     permissions => {
2249         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2250     },
2251     parameters => {
2252         additionalProperties => 0,
2253         properties => {
2254             node => get_standard_option('pve-node'),
2255             vmid => get_standard_option('pve-vmid',
2256                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2257             skiplock => get_standard_option('skiplock'),
2258         },
2259     },
2260     returns => {
2261         type => 'string',
2262     },
2263     code => sub {
2264         my ($param) = @_;
2265
2266         my $rpcenv = PVE::RPCEnvironment::get();
2267
2268         my $authuser = $rpcenv->get_user();
2269
2270         my $node = extract_param($param, 'node');
2271
2272         my $vmid = extract_param($param, 'vmid');
2273
2274         my $skiplock = extract_param($param, 'skiplock');
2275         raise_param_exc({ skiplock => "Only root may use this option." })
2276             if $skiplock && $authuser ne 'root@pam';
2277
2278         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2279
2280         my $realcmd = sub {
2281             my $upid = shift;
2282
2283             syslog('info', "suspend VM $vmid: $upid\n");
2284
2285             PVE::QemuServer::vm_suspend($vmid, $skiplock);
2286
2287             return;
2288         };
2289
2290         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
2291     }});
2292
2293 __PACKAGE__->register_method({
2294     name => 'vm_resume',
2295     path => '{vmid}/status/resume',
2296     method => 'POST',
2297     protected => 1,
2298     proxyto => 'node',
2299     description => "Resume virtual machine.",
2300     permissions => {
2301         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2302     },
2303     parameters => {
2304         additionalProperties => 0,
2305         properties => {
2306             node => get_standard_option('pve-node'),
2307             vmid => get_standard_option('pve-vmid',
2308                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2309             skiplock => get_standard_option('skiplock'),
2310             nocheck => { type => 'boolean', optional => 1 },
2311
2312         },
2313     },
2314     returns => {
2315         type => 'string',
2316     },
2317     code => sub {
2318         my ($param) = @_;
2319
2320         my $rpcenv = PVE::RPCEnvironment::get();
2321
2322         my $authuser = $rpcenv->get_user();
2323
2324         my $node = extract_param($param, 'node');
2325
2326         my $vmid = extract_param($param, 'vmid');
2327
2328         my $skiplock = extract_param($param, 'skiplock');
2329         raise_param_exc({ skiplock => "Only root may use this option." })
2330             if $skiplock && $authuser ne 'root@pam';
2331
2332         my $nocheck = extract_param($param, 'nocheck');
2333
2334         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid, $nocheck);
2335
2336         my $realcmd = sub {
2337             my $upid = shift;
2338
2339             syslog('info', "resume VM $vmid: $upid\n");
2340
2341             PVE::QemuServer::vm_resume($vmid, $skiplock, $nocheck);
2342
2343             return;
2344         };
2345
2346         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
2347     }});
2348
2349 __PACKAGE__->register_method({
2350     name => 'vm_sendkey',
2351     path => '{vmid}/sendkey',
2352     method => 'PUT',
2353     protected => 1,
2354     proxyto => 'node',
2355     description => "Send key event to virtual machine.",
2356     permissions => {
2357         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
2358     },
2359     parameters => {
2360         additionalProperties => 0,
2361         properties => {
2362             node => get_standard_option('pve-node'),
2363             vmid => get_standard_option('pve-vmid',
2364                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2365             skiplock => get_standard_option('skiplock'),
2366             key => {
2367                 description => "The key (qemu monitor encoding).",
2368                 type => 'string'
2369             }
2370         },
2371     },
2372     returns => { type => 'null'},
2373     code => sub {
2374         my ($param) = @_;
2375
2376         my $rpcenv = PVE::RPCEnvironment::get();
2377
2378         my $authuser = $rpcenv->get_user();
2379
2380         my $node = extract_param($param, 'node');
2381
2382         my $vmid = extract_param($param, 'vmid');
2383
2384         my $skiplock = extract_param($param, 'skiplock');
2385         raise_param_exc({ skiplock => "Only root may use this option." })
2386             if $skiplock && $authuser ne 'root@pam';
2387
2388         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
2389
2390         return;
2391     }});
2392
2393 __PACKAGE__->register_method({
2394     name => 'vm_feature',
2395     path => '{vmid}/feature',
2396     method => 'GET',
2397     proxyto => 'node',
2398     protected => 1,
2399     description => "Check if feature for virtual machine is available.",
2400     permissions => {
2401         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2402     },
2403     parameters => {
2404         additionalProperties => 0,
2405         properties => {
2406             node => get_standard_option('pve-node'),
2407             vmid => get_standard_option('pve-vmid'),
2408             feature => {
2409                 description => "Feature to check.",
2410                 type => 'string',
2411                 enum => [ 'snapshot', 'clone', 'copy' ],
2412             },
2413             snapname => get_standard_option('pve-snapshot-name', {
2414                 optional => 1,
2415             }),
2416         },
2417     },
2418     returns => {
2419         type => "object",
2420         properties => {
2421             hasFeature => { type => 'boolean' },
2422             nodes => {
2423                 type => 'array',
2424                 items => { type => 'string' },
2425             }
2426         },
2427     },
2428     code => sub {
2429         my ($param) = @_;
2430
2431         my $node = extract_param($param, 'node');
2432
2433         my $vmid = extract_param($param, 'vmid');
2434
2435         my $snapname = extract_param($param, 'snapname');
2436
2437         my $feature = extract_param($param, 'feature');
2438
2439         my $running = PVE::QemuServer::check_running($vmid);
2440
2441         my $conf = PVE::QemuConfig->load_config($vmid);
2442
2443         if($snapname){
2444             my $snap = $conf->{snapshots}->{$snapname};
2445             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2446             $conf = $snap;
2447         }
2448         my $storecfg = PVE::Storage::config();
2449
2450         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
2451         my $hasFeature = PVE::QemuConfig->has_feature($feature, $conf, $storecfg, $snapname, $running);
2452
2453         return {
2454             hasFeature => $hasFeature,
2455             nodes => [ keys %$nodelist ],
2456         };
2457     }});
2458
2459 __PACKAGE__->register_method({
2460     name => 'clone_vm',
2461     path => '{vmid}/clone',
2462     method => 'POST',
2463     protected => 1,
2464     proxyto => 'node',
2465     description => "Create a copy of virtual machine/template.",
2466     permissions => {
2467         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2468             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2469             "'Datastore.AllocateSpace' on any used storage.",
2470         check =>
2471         [ 'and',
2472           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2473           [ 'or',
2474             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2475             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2476           ],
2477         ]
2478     },
2479     parameters => {
2480         additionalProperties => 0,
2481         properties => {
2482             node => get_standard_option('pve-node'),
2483             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2484             newid => get_standard_option('pve-vmid', {
2485                 completion => \&PVE::Cluster::complete_next_vmid,
2486                 description => 'VMID for the clone.' }),
2487             name => {
2488                 optional => 1,
2489                 type => 'string', format => 'dns-name',
2490                 description => "Set a name for the new VM.",
2491             },
2492             description => {
2493                 optional => 1,
2494                 type => 'string',
2495                 description => "Description for the new VM.",
2496             },
2497             pool => {
2498                 optional => 1,
2499                 type => 'string', format => 'pve-poolid',
2500                 description => "Add the new VM to the specified pool.",
2501             },
2502             snapname => get_standard_option('pve-snapshot-name', {
2503                 optional => 1,
2504             }),
2505             storage => get_standard_option('pve-storage-id', {
2506                 description => "Target storage for full clone.",
2507                 optional => 1,
2508             }),
2509             'format' => {
2510                 description => "Target format for file storage. Only valid for full clone.",
2511                 type => 'string',
2512                 optional => 1,
2513                 enum => [ 'raw', 'qcow2', 'vmdk'],
2514             },
2515             full => {
2516                 optional => 1,
2517                 type => 'boolean',
2518                 description => "Create a full copy of all disks. This is always done when " .
2519                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2520             },
2521             target => get_standard_option('pve-node', {
2522                 description => "Target node. Only allowed if the original VM is on shared storage.",
2523                 optional => 1,
2524             }),
2525         },
2526     },
2527     returns => {
2528         type => 'string',
2529     },
2530     code => sub {
2531         my ($param) = @_;
2532
2533         my $rpcenv = PVE::RPCEnvironment::get();
2534
2535         my $authuser = $rpcenv->get_user();
2536
2537         my $node = extract_param($param, 'node');
2538
2539         my $vmid = extract_param($param, 'vmid');
2540
2541         my $newid = extract_param($param, 'newid');
2542
2543         my $pool = extract_param($param, 'pool');
2544
2545         if (defined($pool)) {
2546             $rpcenv->check_pool_exist($pool);
2547         }
2548
2549         my $snapname = extract_param($param, 'snapname');
2550
2551         my $storage = extract_param($param, 'storage');
2552
2553         my $format = extract_param($param, 'format');
2554
2555         my $target = extract_param($param, 'target');
2556
2557         my $localnode = PVE::INotify::nodename();
2558
2559         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2560
2561         PVE::Cluster::check_node_exists($target) if $target;
2562
2563         my $storecfg = PVE::Storage::config();
2564
2565         if ($storage) {
2566             # check if storage is enabled on local node
2567             PVE::Storage::storage_check_enabled($storecfg, $storage);
2568             if ($target) {
2569                 # check if storage is available on target node
2570                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2571                 # clone only works if target storage is shared
2572                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2573                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2574             }
2575         }
2576
2577         PVE::Cluster::check_cfs_quorum();
2578
2579         my $running = PVE::QemuServer::check_running($vmid) || 0;
2580
2581         # exclusive lock if VM is running - else shared lock is enough;
2582         my $shared_lock = $running ? 0 : 1;
2583
2584         my $clonefn = sub {
2585
2586             # do all tests after lock
2587             # we also try to do all tests before we fork the worker
2588
2589             my $conf = PVE::QemuConfig->load_config($vmid);
2590
2591             PVE::QemuConfig->check_lock($conf);
2592
2593             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2594
2595             die "unexpected state change\n" if $verify_running != $running;
2596
2597             die "snapshot '$snapname' does not exist\n"
2598                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2599
2600             my $full = extract_param($param, 'full');
2601             if (!defined($full)) {
2602                 $full = !PVE::QemuConfig->is_template($conf);
2603             }
2604
2605             die "parameter 'storage' not allowed for linked clones\n"
2606                 if defined($storage) && !$full;
2607
2608             die "parameter 'format' not allowed for linked clones\n"
2609                 if defined($format) && !$full;
2610
2611             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2612
2613             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2614
2615             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2616
2617             my $conffile = PVE::QemuConfig->config_file($newid);
2618
2619             die "unable to create VM $newid: config file already exists\n"
2620                 if -f $conffile;
2621
2622             my $newconf = { lock => 'clone' };
2623             my $drives = {};
2624             my $fullclone = {};
2625             my $vollist = [];
2626
2627             foreach my $opt (keys %$oldconf) {
2628                 my $value = $oldconf->{$opt};
2629
2630                 # do not copy snapshot related info
2631                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2632                     $opt eq 'vmstate' || $opt eq 'snapstate';
2633
2634                 # no need to copy unused images, because VMID(owner) changes anyways
2635                 next if $opt =~ m/^unused\d+$/;
2636
2637                 # always change MAC! address
2638                 if ($opt =~ m/^net(\d+)$/) {
2639                     my $net = PVE::QemuServer::parse_net($value);
2640                     my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
2641                     $net->{macaddr} =  PVE::Tools::random_ether_addr($dc->{mac_prefix});
2642                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2643                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
2644                     my $drive = PVE::QemuServer::parse_drive($opt, $value);
2645                     die "unable to parse drive options for '$opt'\n" if !$drive;
2646                     if (PVE::QemuServer::drive_is_cdrom($drive, 1)) {
2647                         $newconf->{$opt} = $value; # simply copy configuration
2648                     } else {
2649                         if ($full || PVE::QemuServer::drive_is_cloudinit($drive)) {
2650                             die "Full clone feature is not supported for drive '$opt'\n"
2651                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2652                             $fullclone->{$opt} = 1;
2653                         } else {
2654                             # not full means clone instead of copy
2655                             die "Linked clone feature is not supported for drive '$opt'\n"
2656                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $drive->{file}, $snapname, $running);
2657                         }
2658                         $drives->{$opt} = $drive;
2659                         push @$vollist, $drive->{file};
2660                     }
2661                 } else {
2662                     # copy everything else
2663                     $newconf->{$opt} = $value;
2664                 }
2665             }
2666
2667             # auto generate a new uuid
2668             my ($uuid, $uuid_str);
2669             UUID::generate($uuid);
2670             UUID::unparse($uuid, $uuid_str);
2671             my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
2672             $smbios1->{uuid} = $uuid_str;
2673             $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
2674
2675             delete $newconf->{template};
2676
2677             if ($param->{name}) {
2678                 $newconf->{name} = $param->{name};
2679             } else {
2680                 if ($oldconf->{name}) {
2681                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2682                 } else {
2683                     $newconf->{name} = "Copy-of-VM-$vmid";
2684                 }
2685             }
2686
2687             if ($param->{description}) {
2688                 $newconf->{description} = $param->{description};
2689             }
2690
2691             # create empty/temp config - this fails if VM already exists on other node
2692             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2693
2694             my $realcmd = sub {
2695                 my $upid = shift;
2696
2697                 my $newvollist = [];
2698                 my $jobs = {};
2699
2700                 eval {
2701                     local $SIG{INT} =
2702                         local $SIG{TERM} =
2703                         local $SIG{QUIT} =
2704                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2705
2706                     PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
2707
2708                     my $total_jobs = scalar(keys %{$drives});
2709                     my $i = 1;
2710
2711                     foreach my $opt (keys %$drives) {
2712                         my $drive = $drives->{$opt};
2713                         my $skipcomplete = ($total_jobs != $i); # finish after last drive
2714
2715                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2716                                                                    $newid, $storage, $format, $fullclone->{$opt}, $newvollist,
2717                                                                    $jobs, $skipcomplete, $oldconf->{agent});
2718
2719                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2720
2721                         PVE::QemuConfig->write_config($newid, $newconf);
2722                         $i++;
2723                     }
2724
2725                     delete $newconf->{lock};
2726
2727                     # do not write pending changes
2728                     if ($newconf->{pending}) {
2729                         warn "found pending changes, discarding for clone\n";
2730                         delete $newconf->{pending};
2731                     }
2732
2733                     PVE::QemuConfig->write_config($newid, $newconf);
2734
2735                     if ($target) {
2736                         # always deactivate volumes - avoid lvm LVs to be active on several nodes
2737                         PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
2738                         PVE::Storage::deactivate_volumes($storecfg, $newvollist);
2739
2740                         my $newconffile = PVE::QemuConfig->config_file($newid, $target);
2741                         die "Failed to move config to node '$target' - rename failed: $!\n"
2742                             if !rename($conffile, $newconffile);
2743                     }
2744
2745                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2746                 };
2747                 if (my $err = $@) {
2748                     unlink $conffile;
2749
2750                     eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
2751
2752                     sleep 1; # some storage like rbd need to wait before release volume - really?
2753
2754                     foreach my $volid (@$newvollist) {
2755                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2756                         warn $@ if $@;
2757                     }
2758                     die "clone failed: $err";
2759                 }
2760
2761                 return;
2762             };
2763
2764             PVE::Firewall::clone_vmfw_conf($vmid, $newid);
2765
2766             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2767         };
2768
2769         return PVE::QemuConfig->lock_config_mode($vmid, 1, $shared_lock, sub {
2770             # Aquire exclusive lock lock for $newid
2771             return PVE::QemuConfig->lock_config_full($newid, 1, $clonefn);
2772         });
2773
2774     }});
2775
2776 __PACKAGE__->register_method({
2777     name => 'move_vm_disk',
2778     path => '{vmid}/move_disk',
2779     method => 'POST',
2780     protected => 1,
2781     proxyto => 'node',
2782     description => "Move volume to different storage.",
2783     permissions => {
2784         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, and 'Datastore.AllocateSpace' permissions on the storage.",
2785         check => [ 'and',
2786                    ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2787                    ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2788             ],
2789     },
2790     parameters => {
2791         additionalProperties => 0,
2792         properties => {
2793             node => get_standard_option('pve-node'),
2794             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2795             disk => {
2796                 type => 'string',
2797                 description => "The disk you want to move.",
2798                 enum => [ PVE::QemuServer::valid_drive_names() ],
2799             },
2800             storage => get_standard_option('pve-storage-id', {
2801                 description => "Target storage.",
2802                 completion => \&PVE::QemuServer::complete_storage,
2803             }),
2804             'format' => {
2805                 type => 'string',
2806                 description => "Target Format.",
2807                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2808                 optional => 1,
2809             },
2810             delete => {
2811                 type => 'boolean',
2812                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2813                 optional => 1,
2814                 default => 0,
2815             },
2816             digest => {
2817                 type => 'string',
2818                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2819                 maxLength => 40,
2820                 optional => 1,
2821             },
2822         },
2823     },
2824     returns => {
2825         type => 'string',
2826         description => "the task ID.",
2827     },
2828     code => sub {
2829         my ($param) = @_;
2830
2831         my $rpcenv = PVE::RPCEnvironment::get();
2832
2833         my $authuser = $rpcenv->get_user();
2834
2835         my $node = extract_param($param, 'node');
2836
2837         my $vmid = extract_param($param, 'vmid');
2838
2839         my $digest = extract_param($param, 'digest');
2840
2841         my $disk = extract_param($param, 'disk');
2842
2843         my $storeid = extract_param($param, 'storage');
2844
2845         my $format = extract_param($param, 'format');
2846
2847         my $storecfg = PVE::Storage::config();
2848
2849         my $updatefn =  sub {
2850
2851             my $conf = PVE::QemuConfig->load_config($vmid);
2852
2853             PVE::QemuConfig->check_lock($conf);
2854
2855             die "checksum missmatch (file change by other user?)\n"
2856                 if $digest && $digest ne $conf->{digest};
2857
2858             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2859
2860             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2861
2862             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2863
2864             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive, 1);
2865
2866             my $oldfmt;
2867             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2868             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2869                 $oldfmt = $1;
2870             }
2871
2872             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2873                 (!$format || !$oldfmt || $oldfmt eq $format);
2874
2875             # this only checks snapshots because $disk is passed!
2876             my $snapshotted = PVE::QemuServer::is_volume_in_use($storecfg, $conf, $disk, $old_volid);
2877             die "you can't move a disk with snapshots and delete the source\n"
2878                 if $snapshotted && $param->{delete};
2879
2880             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2881
2882             my $running = PVE::QemuServer::check_running($vmid);
2883
2884             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2885
2886             my $realcmd = sub {
2887
2888                 my $newvollist = [];
2889
2890                 eval {
2891                     local $SIG{INT} =
2892                         local $SIG{TERM} =
2893                         local $SIG{QUIT} =
2894                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2895
2896                     warn "moving disk with snapshots, snapshots will not be moved!\n"
2897                         if $snapshotted;
2898
2899                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2900                                                                $vmid, $storeid, $format, 1, $newvollist);
2901
2902                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2903
2904                     PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
2905
2906                     # convert moved disk to base if part of template
2907                     PVE::QemuServer::template_create($vmid, $conf, $disk)
2908                         if PVE::QemuConfig->is_template($conf);
2909
2910                     PVE::QemuConfig->write_config($vmid, $conf);
2911
2912                     eval {
2913                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
2914                         PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
2915                             if !$running;
2916                     };
2917                     warn $@ if $@;
2918                 };
2919                 if (my $err = $@) {
2920
2921                    foreach my $volid (@$newvollist) {
2922                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2923                         warn $@ if $@;
2924                     }
2925                     die "storage migration failed: $err";
2926                 }
2927
2928                 if ($param->{delete}) {
2929                     eval {
2930                         PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
2931                         PVE::Storage::vdisk_free($storecfg, $old_volid);
2932                     };
2933                     warn $@ if $@;
2934                 }
2935             };
2936
2937             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2938         };
2939
2940         return PVE::QemuConfig->lock_config($vmid, $updatefn);
2941     }});
2942
2943 __PACKAGE__->register_method({
2944     name => 'migrate_vm',
2945     path => '{vmid}/migrate',
2946     method => 'POST',
2947     protected => 1,
2948     proxyto => 'node',
2949     description => "Migrate virtual machine. Creates a new migration task.",
2950     permissions => {
2951         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2952     },
2953     parameters => {
2954         additionalProperties => 0,
2955         properties => {
2956             node => get_standard_option('pve-node'),
2957             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2958             target => get_standard_option('pve-node', {
2959                 description => "Target node.",
2960                 completion =>  \&PVE::Cluster::complete_migration_target,
2961             }),
2962             online => {
2963                 type => 'boolean',
2964                 description => "Use online/live migration.",
2965                 optional => 1,
2966             },
2967             force => {
2968                 type => 'boolean',
2969                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2970                 optional => 1,
2971             },
2972             migration_type => {
2973                 type => 'string',
2974                 enum => ['secure', 'insecure'],
2975                 description => "Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance.",
2976                 optional => 1,
2977             },
2978             migration_network => {
2979                 type => 'string', format => 'CIDR',
2980                 description => "CIDR of the (sub) network that is used for migration.",
2981                 optional => 1,
2982             },
2983             "with-local-disks" => {
2984                 type => 'boolean',
2985                 description => "Enable live storage migration for local disk",
2986                 optional => 1,
2987             },
2988             targetstorage => get_standard_option('pve-storage-id', {
2989                 description => "Default target storage.",
2990                 optional => 1,
2991                 completion => \&PVE::QemuServer::complete_storage,
2992             }),
2993         },
2994     },
2995     returns => {
2996         type => 'string',
2997         description => "the task ID.",
2998     },
2999     code => sub {
3000         my ($param) = @_;
3001
3002         my $rpcenv = PVE::RPCEnvironment::get();
3003
3004         my $authuser = $rpcenv->get_user();
3005
3006         my $target = extract_param($param, 'target');
3007
3008         my $localnode = PVE::INotify::nodename();
3009         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
3010
3011         PVE::Cluster::check_cfs_quorum();
3012
3013         PVE::Cluster::check_node_exists($target);
3014
3015         my $targetip = PVE::Cluster::remote_node_ip($target);
3016
3017         my $vmid = extract_param($param, 'vmid');
3018
3019         raise_param_exc({ targetstorage => "Live storage migration can only be done online." })
3020             if !$param->{online} && $param->{targetstorage};
3021
3022         raise_param_exc({ force => "Only root may use this option." })
3023             if $param->{force} && $authuser ne 'root@pam';
3024
3025         raise_param_exc({ migration_type => "Only root may use this option." })
3026             if $param->{migration_type} && $authuser ne 'root@pam';
3027
3028         # allow root only until better network permissions are available
3029         raise_param_exc({ migration_network => "Only root may use this option." })
3030             if $param->{migration_network} && $authuser ne 'root@pam';
3031
3032         # test if VM exists
3033         my $conf = PVE::QemuConfig->load_config($vmid);
3034
3035         # try to detect errors early
3036
3037         PVE::QemuConfig->check_lock($conf);
3038
3039         if (PVE::QemuServer::check_running($vmid)) {
3040             die "cant migrate running VM without --online\n"
3041                 if !$param->{online};
3042         }
3043
3044         my $storecfg = PVE::Storage::config();
3045
3046         if( $param->{targetstorage}) {
3047             PVE::Storage::storage_check_node($storecfg, $param->{targetstorage}, $target);
3048         } else {
3049             PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
3050         }
3051
3052         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
3053
3054             my $hacmd = sub {
3055                 my $upid = shift;
3056
3057                 my $service = "vm:$vmid";
3058
3059                 my $cmd = ['ha-manager', 'migrate', $service, $target];
3060
3061                 print "Requesting HA migration for VM $vmid to node $target\n";
3062
3063                 PVE::Tools::run_command($cmd);
3064
3065                 return;
3066             };
3067
3068             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
3069
3070         } else {
3071
3072             my $realcmd = sub {
3073                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
3074             };
3075
3076             my $worker = sub {
3077                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
3078             };
3079
3080             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $worker);
3081         }
3082
3083     }});
3084
3085 __PACKAGE__->register_method({
3086     name => 'monitor',
3087     path => '{vmid}/monitor',
3088     method => 'POST',
3089     protected => 1,
3090     proxyto => 'node',
3091     description => "Execute Qemu monitor commands.",
3092     permissions => {
3093         description => "Sys.Modify is required for (sub)commands which are not read-only ('info *' and 'help')",
3094         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
3095     },
3096     parameters => {
3097         additionalProperties => 0,
3098         properties => {
3099             node => get_standard_option('pve-node'),
3100             vmid => get_standard_option('pve-vmid'),
3101             command => {
3102                 type => 'string',
3103                 description => "The monitor command.",
3104             }
3105         },
3106     },
3107     returns => { type => 'string'},
3108     code => sub {
3109         my ($param) = @_;
3110
3111         my $rpcenv = PVE::RPCEnvironment::get();
3112         my $authuser = $rpcenv->get_user();
3113
3114         my $is_ro = sub {
3115             my $command = shift;
3116             return $command =~ m/^\s*info(\s+|$)/
3117                 || $command =~ m/^\s*help\s*$/;
3118         };
3119
3120         $rpcenv->check_full($authuser, "/", ['Sys.Modify'])
3121             if !&$is_ro($param->{command});
3122
3123         my $vmid = $param->{vmid};
3124
3125         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3126
3127         my $res = '';
3128         eval {
3129             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
3130         };
3131         $res = "ERROR: $@" if $@;
3132
3133         return $res;
3134     }});
3135
3136 __PACKAGE__->register_method({
3137     name => 'resize_vm',
3138     path => '{vmid}/resize',
3139     method => 'PUT',
3140     protected => 1,
3141     proxyto => 'node',
3142     description => "Extend volume size.",
3143     permissions => {
3144         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
3145     },
3146     parameters => {
3147         additionalProperties => 0,
3148         properties => {
3149             node => get_standard_option('pve-node'),
3150             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3151             skiplock => get_standard_option('skiplock'),
3152             disk => {
3153                 type => 'string',
3154                 description => "The disk you want to resize.",
3155                 enum => [PVE::QemuServer::valid_drive_names()],
3156             },
3157             size => {
3158                 type => 'string',
3159                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
3160                 description => "The new size. With the `+` sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
3161             },
3162             digest => {
3163                 type => 'string',
3164                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
3165                 maxLength => 40,
3166                 optional => 1,
3167             },
3168         },
3169     },
3170     returns => { type => 'null'},
3171     code => sub {
3172         my ($param) = @_;
3173
3174         my $rpcenv = PVE::RPCEnvironment::get();
3175
3176         my $authuser = $rpcenv->get_user();
3177
3178         my $node = extract_param($param, 'node');
3179
3180         my $vmid = extract_param($param, 'vmid');
3181
3182         my $digest = extract_param($param, 'digest');
3183
3184         my $disk = extract_param($param, 'disk');
3185
3186         my $sizestr = extract_param($param, 'size');
3187
3188         my $skiplock = extract_param($param, 'skiplock');
3189         raise_param_exc({ skiplock => "Only root may use this option." })
3190             if $skiplock && $authuser ne 'root@pam';
3191
3192         my $storecfg = PVE::Storage::config();
3193
3194         my $updatefn =  sub {
3195
3196             my $conf = PVE::QemuConfig->load_config($vmid);
3197
3198             die "checksum missmatch (file change by other user?)\n"
3199                 if $digest && $digest ne $conf->{digest};
3200             PVE::QemuConfig->check_lock($conf) if !$skiplock;
3201
3202             die "disk '$disk' does not exist\n" if !$conf->{$disk};
3203
3204             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
3205
3206             my (undef, undef, undef, undef, undef, undef, $format) =
3207                 PVE::Storage::parse_volname($storecfg, $drive->{file});
3208
3209             die "can't resize volume: $disk if snapshot exists\n"
3210                 if %{$conf->{snapshots}} && $format eq 'qcow2';
3211
3212             my $volid = $drive->{file};
3213
3214             die "disk '$disk' has no associated volume\n" if !$volid;
3215
3216             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
3217
3218             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
3219
3220             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
3221
3222             PVE::Storage::activate_volumes($storecfg, [$volid]);
3223             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
3224
3225             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
3226             my ($ext, $newsize, $unit) = ($1, $2, $4);
3227             if ($unit) {
3228                 if ($unit eq 'K') {
3229                     $newsize = $newsize * 1024;
3230                 } elsif ($unit eq 'M') {
3231                     $newsize = $newsize * 1024 * 1024;
3232                 } elsif ($unit eq 'G') {
3233                     $newsize = $newsize * 1024 * 1024 * 1024;
3234                 } elsif ($unit eq 'T') {
3235                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
3236                 }
3237             }
3238             $newsize += $size if $ext;
3239             $newsize = int($newsize);
3240
3241             die "shrinking disks is not supported\n" if $newsize < $size;
3242
3243             return if $size == $newsize;
3244
3245             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
3246
3247             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
3248
3249             $drive->{size} = $newsize;
3250             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
3251
3252             PVE::QemuConfig->write_config($vmid, $conf);
3253         };
3254
3255         PVE::QemuConfig->lock_config($vmid, $updatefn);
3256         return undef;
3257     }});
3258
3259 __PACKAGE__->register_method({
3260     name => 'snapshot_list',
3261     path => '{vmid}/snapshot',
3262     method => 'GET',
3263     description => "List all snapshots.",
3264     permissions => {
3265         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
3266     },
3267     proxyto => 'node',
3268     protected => 1, # qemu pid files are only readable by root
3269     parameters => {
3270         additionalProperties => 0,
3271         properties => {
3272             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3273             node => get_standard_option('pve-node'),
3274         },
3275     },
3276     returns => {
3277         type => 'array',
3278         items => {
3279             type => "object",
3280             properties => {},
3281         },
3282         links => [ { rel => 'child', href => "{name}" } ],
3283     },
3284     code => sub {
3285         my ($param) = @_;
3286
3287         my $vmid = $param->{vmid};
3288
3289         my $conf = PVE::QemuConfig->load_config($vmid);
3290         my $snaphash = $conf->{snapshots} || {};
3291
3292         my $res = [];
3293
3294         foreach my $name (keys %$snaphash) {
3295             my $d = $snaphash->{$name};
3296             my $item = {
3297                 name => $name,
3298                 snaptime => $d->{snaptime} || 0,
3299                 vmstate => $d->{vmstate} ? 1 : 0,
3300                 description => $d->{description} || '',
3301             };
3302             $item->{parent} = $d->{parent} if $d->{parent};
3303             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
3304             push @$res, $item;
3305         }
3306
3307         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
3308         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
3309         $current->{parent} = $conf->{parent} if $conf->{parent};
3310
3311         push @$res, $current;
3312
3313         return $res;
3314     }});
3315
3316 __PACKAGE__->register_method({
3317     name => 'snapshot',
3318     path => '{vmid}/snapshot',
3319     method => 'POST',
3320     protected => 1,
3321     proxyto => 'node',
3322     description => "Snapshot a VM.",
3323     permissions => {
3324         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3325     },
3326     parameters => {
3327         additionalProperties => 0,
3328         properties => {
3329             node => get_standard_option('pve-node'),
3330             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3331             snapname => get_standard_option('pve-snapshot-name'),
3332             vmstate => {
3333                 optional => 1,
3334                 type => 'boolean',
3335                 description => "Save the vmstate",
3336             },
3337             description => {
3338                 optional => 1,
3339                 type => 'string',
3340                 description => "A textual description or comment.",
3341             },
3342         },
3343     },
3344     returns => {
3345         type => 'string',
3346         description => "the task ID.",
3347     },
3348     code => sub {
3349         my ($param) = @_;
3350
3351         my $rpcenv = PVE::RPCEnvironment::get();
3352
3353         my $authuser = $rpcenv->get_user();
3354
3355         my $node = extract_param($param, 'node');
3356
3357         my $vmid = extract_param($param, 'vmid');
3358
3359         my $snapname = extract_param($param, 'snapname');
3360
3361         die "unable to use snapshot name 'current' (reserved name)\n"
3362             if $snapname eq 'current';
3363
3364         my $realcmd = sub {
3365             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
3366             PVE::QemuConfig->snapshot_create($vmid, $snapname, $param->{vmstate},
3367                                              $param->{description});
3368         };
3369
3370         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
3371     }});
3372
3373 __PACKAGE__->register_method({
3374     name => 'snapshot_cmd_idx',
3375     path => '{vmid}/snapshot/{snapname}',
3376     description => '',
3377     method => 'GET',
3378     permissions => {
3379         user => 'all',
3380     },
3381     parameters => {
3382         additionalProperties => 0,
3383         properties => {
3384             vmid => get_standard_option('pve-vmid'),
3385             node => get_standard_option('pve-node'),
3386             snapname => get_standard_option('pve-snapshot-name'),
3387         },
3388     },
3389     returns => {
3390         type => 'array',
3391         items => {
3392             type => "object",
3393             properties => {},
3394         },
3395         links => [ { rel => 'child', href => "{cmd}" } ],
3396     },
3397     code => sub {
3398         my ($param) = @_;
3399
3400         my $res = [];
3401
3402         push @$res, { cmd => 'rollback' };
3403         push @$res, { cmd => 'config' };
3404
3405         return $res;
3406     }});
3407
3408 __PACKAGE__->register_method({
3409     name => 'update_snapshot_config',
3410     path => '{vmid}/snapshot/{snapname}/config',
3411     method => 'PUT',
3412     protected => 1,
3413     proxyto => 'node',
3414     description => "Update snapshot metadata.",
3415     permissions => {
3416         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3417     },
3418     parameters => {
3419         additionalProperties => 0,
3420         properties => {
3421             node => get_standard_option('pve-node'),
3422             vmid => get_standard_option('pve-vmid'),
3423             snapname => get_standard_option('pve-snapshot-name'),
3424             description => {
3425                 optional => 1,
3426                 type => 'string',
3427                 description => "A textual description or comment.",
3428             },
3429         },
3430     },
3431     returns => { type => 'null' },
3432     code => sub {
3433         my ($param) = @_;
3434
3435         my $rpcenv = PVE::RPCEnvironment::get();
3436
3437         my $authuser = $rpcenv->get_user();
3438
3439         my $vmid = extract_param($param, 'vmid');
3440
3441         my $snapname = extract_param($param, 'snapname');
3442
3443         return undef if !defined($param->{description});
3444
3445         my $updatefn =  sub {
3446
3447             my $conf = PVE::QemuConfig->load_config($vmid);
3448
3449             PVE::QemuConfig->check_lock($conf);
3450
3451             my $snap = $conf->{snapshots}->{$snapname};
3452
3453             die "snapshot '$snapname' does not exist\n" if !defined($snap);
3454
3455             $snap->{description} = $param->{description} if defined($param->{description});
3456
3457              PVE::QemuConfig->write_config($vmid, $conf);
3458         };
3459
3460         PVE::QemuConfig->lock_config($vmid, $updatefn);
3461
3462         return undef;
3463     }});
3464
3465 __PACKAGE__->register_method({
3466     name => 'get_snapshot_config',
3467     path => '{vmid}/snapshot/{snapname}/config',
3468     method => 'GET',
3469     proxyto => 'node',
3470     description => "Get snapshot configuration",
3471     permissions => {
3472         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3473     },
3474     parameters => {
3475         additionalProperties => 0,
3476         properties => {
3477             node => get_standard_option('pve-node'),
3478             vmid => get_standard_option('pve-vmid'),
3479             snapname => get_standard_option('pve-snapshot-name'),
3480         },
3481     },
3482     returns => { type => "object" },
3483     code => sub {
3484         my ($param) = @_;
3485
3486         my $rpcenv = PVE::RPCEnvironment::get();
3487
3488         my $authuser = $rpcenv->get_user();
3489
3490         my $vmid = extract_param($param, 'vmid');
3491
3492         my $snapname = extract_param($param, 'snapname');
3493
3494         my $conf = PVE::QemuConfig->load_config($vmid);
3495
3496         my $snap = $conf->{snapshots}->{$snapname};
3497
3498         die "snapshot '$snapname' does not exist\n" if !defined($snap);
3499
3500         return $snap;
3501     }});
3502
3503 __PACKAGE__->register_method({
3504     name => 'rollback',
3505     path => '{vmid}/snapshot/{snapname}/rollback',
3506     method => 'POST',
3507     protected => 1,
3508     proxyto => 'node',
3509     description => "Rollback VM state to specified snapshot.",
3510     permissions => {
3511         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3512     },
3513     parameters => {
3514         additionalProperties => 0,
3515         properties => {
3516             node => get_standard_option('pve-node'),
3517             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3518             snapname => get_standard_option('pve-snapshot-name'),
3519         },
3520     },
3521     returns => {
3522         type => 'string',
3523         description => "the task ID.",
3524     },
3525     code => sub {
3526         my ($param) = @_;
3527
3528         my $rpcenv = PVE::RPCEnvironment::get();
3529
3530         my $authuser = $rpcenv->get_user();
3531
3532         my $node = extract_param($param, 'node');
3533
3534         my $vmid = extract_param($param, 'vmid');
3535
3536         my $snapname = extract_param($param, 'snapname');
3537
3538         my $realcmd = sub {
3539             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
3540             PVE::QemuConfig->snapshot_rollback($vmid, $snapname);
3541         };
3542
3543         my $worker = sub {
3544             # hold migration lock, this makes sure that nobody create replication snapshots
3545             return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
3546         };
3547
3548         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $worker);
3549     }});
3550
3551 __PACKAGE__->register_method({
3552     name => 'delsnapshot',
3553     path => '{vmid}/snapshot/{snapname}',
3554     method => 'DELETE',
3555     protected => 1,
3556     proxyto => 'node',
3557     description => "Delete a VM snapshot.",
3558     permissions => {
3559         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3560     },
3561     parameters => {
3562         additionalProperties => 0,
3563         properties => {
3564             node => get_standard_option('pve-node'),
3565             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3566             snapname => get_standard_option('pve-snapshot-name'),
3567             force => {
3568                 optional => 1,
3569                 type => 'boolean',
3570                 description => "For removal from config file, even if removing disk snapshots fails.",
3571             },
3572         },
3573     },
3574     returns => {
3575         type => 'string',
3576         description => "the task ID.",
3577     },
3578     code => sub {
3579         my ($param) = @_;
3580
3581         my $rpcenv = PVE::RPCEnvironment::get();
3582
3583         my $authuser = $rpcenv->get_user();
3584
3585         my $node = extract_param($param, 'node');
3586
3587         my $vmid = extract_param($param, 'vmid');
3588
3589         my $snapname = extract_param($param, 'snapname');
3590
3591         my $realcmd = sub {
3592             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
3593             PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
3594         };
3595
3596         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
3597     }});
3598
3599 __PACKAGE__->register_method({
3600     name => 'template',
3601     path => '{vmid}/template',
3602     method => 'POST',
3603     protected => 1,
3604     proxyto => 'node',
3605     description => "Create a Template.",
3606     permissions => {
3607         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3608         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3609     },
3610     parameters => {
3611         additionalProperties => 0,
3612         properties => {
3613             node => get_standard_option('pve-node'),
3614             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
3615             disk => {
3616                 optional => 1,
3617                 type => 'string',
3618                 description => "If you want to convert only 1 disk to base image.",
3619                 enum => [PVE::QemuServer::valid_drive_names()],
3620             },
3621
3622         },
3623     },
3624     returns => { type => 'null'},
3625     code => sub {
3626         my ($param) = @_;
3627
3628         my $rpcenv = PVE::RPCEnvironment::get();
3629
3630         my $authuser = $rpcenv->get_user();
3631
3632         my $node = extract_param($param, 'node');
3633
3634         my $vmid = extract_param($param, 'vmid');
3635
3636         my $disk = extract_param($param, 'disk');
3637
3638         my $updatefn =  sub {
3639
3640             my $conf = PVE::QemuConfig->load_config($vmid);
3641
3642             PVE::QemuConfig->check_lock($conf);
3643
3644             die "unable to create template, because VM contains snapshots\n"
3645                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3646
3647             die "you can't convert a template to a template\n"
3648                 if PVE::QemuConfig->is_template($conf) && !$disk;
3649
3650             die "you can't convert a VM to template if VM is running\n"
3651                 if PVE::QemuServer::check_running($vmid);
3652
3653             my $realcmd = sub {
3654                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3655             };
3656
3657             $conf->{template} = 1;
3658             PVE::QemuConfig->write_config($vmid, $conf);
3659
3660             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3661         };
3662
3663         PVE::QemuConfig->lock_config($vmid, $updatefn);
3664         return undef;
3665     }});
3666
3667 1;