PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6 use Net::SSLeay;
   7 use UUID;
   8 use POSIX;
   9 use IO::Socket::IP;
  10
  11 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools qw(extract_param);
  14 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  15 use PVE::Storage;
  16 use PVE::JSONSchema qw(get_standard_option);
  17 use PVE::RESTHandler;
  18 use PVE::ReplicationConfig;
  19 use PVE::GuestHelpers;
  20 use PVE::QemuConfig;
  21 use PVE::QemuServer;
  22 use PVE::QemuMigrate;
  23 use PVE::RPCEnvironment;
  24 use PVE::AccessControl;
  25 use PVE::INotify;
  26 use PVE::Network;
  27 use PVE::Firewall;
  28 use PVE::API2::Firewall::VM;
  29
  30 BEGIN {
  31     if (!$ENV{PVE_GENERATING_DOCS}) {
  32         require PVE::HA::Env::PVE2;
  33         import PVE::HA::Env::PVE2;
  34         require PVE::HA::Config;
  35         import PVE::HA::Config;
  36     }
  37 }
  38
  39 use Data::Dumper; # fixme: remove
  40
  41 use base qw(PVE::RESTHandler);
  42
  43 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  44
  45 my $resolve_cdrom_alias = sub {
  46     my $param = shift;
  47
  48     if (my $value = $param->{cdrom}) {
  49         $value .= ",media=cdrom" if $value !~ m/media=/;
  50         $param->{ide2} = $value;
  51         delete $param->{cdrom};
  52     }
  53 };
  54
  55 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
  56 my $check_storage_access = sub {
  57    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  58
  59    PVE::QemuServer::foreach_drive($settings, sub {
  60         my ($ds, $drive) = @_;
  61
  62         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  63
  64         my $volid = $drive->{file};
  65
  66         if (!$volid || $volid eq 'none') {
  67             # nothing to check
  68         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  69             $rpcenv->check($authuser, "/", ['Sys.Console']);
  70         } elsif (!$isCDROM && ($volid =~ $NEW_DISK_RE)) {
  71             my ($storeid, $size) = ($2 || $default_storage, $3);
  72             die "no storage ID specified (and no default storage)\n" if !$storeid;
  73             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  74             my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
  75             raise_param_exc({ storage => "storage '$storeid' does not support vm images"})
  76                 if !$scfg->{content}->{images};
  77         } else {
  78             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
  79         }
  80     });
  81
  82    $rpcenv->check($authuser, "/storage/$settings->{vmstatestorage}", ['Datastore.AllocateSpace'])
  83        if defined($settings->{vmstatestorage});
  84 };
  85
  86 my $check_storage_access_clone = sub {
  87    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  88
  89    my $sharedvm = 1;
  90
  91    PVE::QemuServer::foreach_drive($conf, sub {
  92         my ($ds, $drive) = @_;
  93
  94         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  95
  96         my $volid = $drive->{file};
  97
  98         return if !$volid || $volid eq 'none';
  99
 100         if ($isCDROM) {
 101             if ($volid eq 'cdrom') {
 102                 $rpcenv->check($authuser, "/", ['Sys.Console']);
 103             } else {
 104                 # we simply allow access
 105                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 106                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 107                 $sharedvm = 0 if !$scfg->{shared};
 108
 109             }
 110         } else {
 111             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 112             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 113             $sharedvm = 0 if !$scfg->{shared};
 114
 115             $sid = $storage if $storage;
 116             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 117         }
 118     });
 119
 120    $rpcenv->check($authuser, "/storage/$conf->{vmstatestorage}", ['Datastore.AllocateSpace'])
 121        if defined($conf->{vmstatestorage});
 122
 123    return $sharedvm;
 124 };
 125
 126 # Note: $pool is only needed when creating a VM, because pool permissions
 127 # are automatically inherited if VM already exists inside a pool.
 128 my $create_disks = sub {
 129     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 130
 131     my $vollist = [];
 132
 133     my $res = {};
 134
 135     my $code = sub {
 136         my ($ds, $disk) = @_;
 137
 138         my $volid = $disk->{file};
 139
 140         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 141             delete $disk->{size};
 142             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 143         } elsif ($volid =~ $NEW_DISK_RE) {
 144             my ($storeid, $size) = ($2 || $default_storage, $3);
 145             die "no storage ID specified (and no default storage)\n" if !$storeid;
 146             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 147             my $fmt = $disk->{format} || $defformat;
 148
 149             $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
 150
 151             my $volid;
 152             if ($ds eq 'efidisk0') {
 153                 ($volid, $size) = PVE::QemuServer::create_efidisk($storecfg, $storeid, $vmid, $fmt);
 154             } else {
 155                 $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
 156             }
 157             push @$vollist, $volid;
 158             $disk->{file} = $volid;
 159             $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
 160             delete $disk->{format}; # no longer needed
 161             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 162         } else {
 163
 164             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
 165
 166             my $volid_is_new = 1;
 167
 168             if ($conf->{$ds}) {
 169                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 170                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 171             }
 172
 173             if ($volid_is_new) {
 174
 175                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 176
 177                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 178
 179                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 180
 181                 die "volume $volid does not exists\n" if !$size;
 182
 183                 $disk->{size} = $size;
 184             }
 185
 186             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 187         }
 188     };
 189
 190     eval { PVE::QemuServer::foreach_drive($settings, $code); };
 191
 192     # free allocated images on error
 193     if (my $err = $@) {
 194         syslog('err', "VM $vmid creating disks failed");
 195         foreach my $volid (@$vollist) {
 196             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 197             warn $@ if $@;
 198         }
 199         die $err;
 200     }
 201
 202     # modify vm config if everything went well
 203     foreach my $ds (keys %$res) {
 204         $conf->{$ds} = $res->{$ds};
 205     }
 206
 207     return $vollist;
 208 };
 209
 210 my $cpuoptions = {
 211     'cores' => 1,
 212     'cpu' => 1,
 213     'cpulimit' => 1,
 214     'cpuunits' => 1,
 215     'numa' => 1,
 216     'smp' => 1,
 217     'sockets' => 1,
 218     'vcpus' => 1,
 219 };
 220
 221 my $memoryoptions = {
 222     'memory' => 1,
 223     'balloon' => 1,
 224     'shares' => 1,
 225 };
 226
 227 my $hwtypeoptions = {
 228     'acpi' => 1,
 229     'hotplug' => 1,
 230     'kvm' => 1,
 231     'machine' => 1,
 232     'scsihw' => 1,
 233     'smbios1' => 1,
 234     'tablet' => 1,
 235     'vga' => 1,
 236     'watchdog' => 1,
 237 };
 238
 239 my $generaloptions = {
 240     'agent' => 1,
 241     'autostart' => 1,
 242     'bios' => 1,
 243     'description' => 1,
 244     'keyboard' => 1,
 245     'localtime' => 1,
 246     'migrate_downtime' => 1,
 247     'migrate_speed' => 1,
 248     'name' => 1,
 249     'onboot' => 1,
 250     'ostype' => 1,
 251     'protection' => 1,
 252     'reboot' => 1,
 253     'startdate' => 1,
 254     'startup' => 1,
 255     'tdf' => 1,
 256     'template' => 1,
 257 };
 258
 259 my $vmpoweroptions = {
 260     'freeze' => 1,
 261 };
 262
 263 my $diskoptions = {
 264     'boot' => 1,
 265     'bootdisk' => 1,
 266     'vmstatestorage' => 1,
 267 };
 268
 269 my $check_vm_modify_config_perm = sub {
 270     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 271
 272     return 1 if $authuser eq 'root@pam';
 273
 274     foreach my $opt (@$key_list) {
 275         # disk checks need to be done somewhere else
 276         next if PVE::QemuServer::is_valid_drivename($opt);
 277         next if $opt eq 'cdrom';
 278         next if $opt =~ m/^unused\d+$/;
 279
 280         if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
 281             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 282         } elsif ($memoryoptions->{$opt}) {
 283             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 284         } elsif ($hwtypeoptions->{$opt}) {
 285             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 286         } elsif ($generaloptions->{$opt}) {
 287             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 288             # special case for startup since it changes host behaviour
 289             if ($opt eq 'startup') {
 290                 $rpcenv->check_full($authuser, "/", ['Sys.Modify']);
 291             }
 292         } elsif ($vmpoweroptions->{$opt}) {
 293             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
 294         } elsif ($diskoptions->{$opt}) {
 295             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 296         } elsif ($opt =~ m/^net\d+$/) {
 297             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 298         } else {
 299             # catches usb\d+, hostpci\d+, args, lock, etc.
 300             # new options will be checked here
 301             die "only root can set '$opt' config\n";
 302         }
 303     }
 304
 305     return 1;
 306 };
 307
 308 __PACKAGE__->register_method({
 309     name => 'vmlist',
 310     path => '',
 311     method => 'GET',
 312     description => "Virtual machine index (per node).",
 313     permissions => {
 314         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 315         user => 'all',
 316     },
 317     proxyto => 'node',
 318     protected => 1, # qemu pid files are only readable by root
 319     parameters => {
 320         additionalProperties => 0,
 321         properties => {
 322             node => get_standard_option('pve-node'),
 323             full => {
 324                 type => 'boolean',
 325                 optional => 1,
 326                 description => "Determine the full status of active VMs.",
 327             },
 328         },
 329     },
 330     returns => {
 331         type => 'array',
 332         items => {
 333             type => "object",
 334             properties => {},
 335         },
 336         links => [ { rel => 'child', href => "{vmid}" } ],
 337     },
 338     code => sub {
 339         my ($param) = @_;
 340
 341         my $rpcenv = PVE::RPCEnvironment::get();
 342         my $authuser = $rpcenv->get_user();
 343
 344         my $vmstatus = PVE::QemuServer::vmstatus(undef, $param->{full});
 345
 346         my $res = [];
 347         foreach my $vmid (keys %$vmstatus) {
 348             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 349
 350             my $data = $vmstatus->{$vmid};
 351             $data->{vmid} = int($vmid);
 352             push @$res, $data;
 353         }
 354
 355         return $res;
 356     }});
 357
 358
 359
 360 __PACKAGE__->register_method({
 361     name => 'create_vm',
 362     path => '',
 363     method => 'POST',
 364     description => "Create or restore a virtual machine.",
 365     permissions => {
 366         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 367             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 368             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 369         user => 'all', # check inside
 370     },
 371     protected => 1,
 372     proxyto => 'node',
 373     parameters => {
 374         additionalProperties => 0,
 375         properties => PVE::QemuServer::json_config_properties(
 376             {
 377                 node => get_standard_option('pve-node'),
 378                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 379                 archive => {
 380                     description => "The backup file.",
 381                     type => 'string',
 382                     optional => 1,
 383                     maxLength => 255,
 384                     completion => \&PVE::QemuServer::complete_backup_archives,
 385                 },
 386                 storage => get_standard_option('pve-storage-id', {
 387                     description => "Default storage.",
 388                     optional => 1,
 389                     completion => \&PVE::QemuServer::complete_storage,
 390                 }),
 391                 force => {
 392                     optional => 1,
 393                     type => 'boolean',
 394                     description => "Allow to overwrite existing VM.",
 395                     requires => 'archive',
 396                 },
 397                 unique => {
 398                     optional => 1,
 399                     type => 'boolean',
 400                     description => "Assign a unique random ethernet address.",
 401                     requires => 'archive',
 402                 },
 403                 pool => {
 404                     optional => 1,
 405                     type => 'string', format => 'pve-poolid',
 406                     description => "Add the VM to the specified pool.",
 407                 },
 408             }),
 409     },
 410     returns => {
 411         type => 'string',
 412     },
 413     code => sub {
 414         my ($param) = @_;
 415
 416         my $rpcenv = PVE::RPCEnvironment::get();
 417
 418         my $authuser = $rpcenv->get_user();
 419
 420         my $node = extract_param($param, 'node');
 421
 422         my $vmid = extract_param($param, 'vmid');
 423
 424         my $archive = extract_param($param, 'archive');
 425
 426         my $storage = extract_param($param, 'storage');
 427
 428         my $force = extract_param($param, 'force');
 429
 430         my $unique = extract_param($param, 'unique');
 431
 432         my $pool = extract_param($param, 'pool');
 433
 434         my $filename = PVE::QemuConfig->config_file($vmid);
 435
 436         my $storecfg = PVE::Storage::config();
 437
 438         PVE::Cluster::check_cfs_quorum();
 439
 440         if (defined($pool)) {
 441             $rpcenv->check_pool_exist($pool);
 442         }
 443
 444         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 445             if defined($storage);
 446
 447         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 448             # OK
 449         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 450             # OK
 451         } elsif ($archive && $force && (-f $filename) &&
 452                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 453             # OK: user has VM.Backup permissions, and want to restore an existing VM
 454         } else {
 455             raise_perm_exc();
 456         }
 457
 458         if (!$archive) {
 459             &$resolve_cdrom_alias($param);
 460
 461             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 462
 463             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 464
 465             foreach my $opt (keys %$param) {
 466                 if (PVE::QemuServer::is_valid_drivename($opt)) {
 467                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 468                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 469
 470                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 471                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 472                 }
 473             }
 474
 475             PVE::QemuServer::add_random_macs($param);
 476         } else {
 477             my $keystr = join(' ', keys %$param);
 478             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 479
 480             if ($archive eq '-') {
 481                 die "pipe requires cli environment\n"
 482                     if $rpcenv->{type} ne 'cli';
 483             } else {
 484                 PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
 485                 $archive = PVE::Storage::abs_filesystem_path($storecfg, $archive);
 486             }
 487         }
 488
 489         my $restorefn = sub {
 490             my $vmlist = PVE::Cluster::get_vmlist();
 491             if ($vmlist->{ids}->{$vmid}) {
 492                 my $current_node = $vmlist->{ids}->{$vmid}->{node};
 493                 if ($current_node eq $node) {
 494                     my $conf = PVE::QemuConfig->load_config($vmid);
 495
 496                     PVE::QemuConfig->check_protection($conf, "unable to restore VM $vmid");
 497
 498                     die "unable to restore vm $vmid - config file already exists\n"
 499                         if !$force;
 500
 501                     die "unable to restore vm $vmid - vm is running\n"
 502                         if PVE::QemuServer::check_running($vmid);
 503
 504                     die "unable to restore vm $vmid - vm is a template\n"
 505                         if PVE::QemuConfig->is_template($conf);
 506
 507                 } else {
 508                     die "unable to restore vm $vmid - already existing on cluster node '$current_node'\n";
 509                 }
 510             }
 511
 512             my $realcmd = sub {
 513                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 514                     storage => $storage,
 515                     pool => $pool,
 516                     unique => $unique });
 517
 518                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 519             };
 520
 521             # ensure no old replication state are exists
 522             PVE::ReplicationState::delete_guest_states($vmid);
 523
 524             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 525         };
 526
 527         my $createfn = sub {
 528
 529             # test after locking
 530             PVE::Cluster::check_vmid_unused($vmid);
 531
 532             # ensure no old replication state are exists
 533             PVE::ReplicationState::delete_guest_states($vmid);
 534
 535             my $realcmd = sub {
 536
 537                 my $vollist = [];
 538
 539                 my $conf = $param;
 540
 541                 eval {
 542
 543                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 544
 545                     if (!$conf->{bootdisk}) {
 546                         my $firstdisk = PVE::QemuServer::resolve_first_disk($conf);
 547                         $conf->{bootdisk} = $firstdisk if $firstdisk;
 548                     }
 549
 550                     # auto generate uuid if user did not specify smbios1 option
 551                     if (!$conf->{smbios1}) {
 552                         $conf->{smbios1} = PVE::QemuServer::generate_smbios1_uuid();
 553                     }
 554
 555                     PVE::QemuConfig->write_config($vmid, $conf);
 556
 557                 };
 558                 my $err = $@;
 559
 560                 if ($err) {
 561                     foreach my $volid (@$vollist) {
 562                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 563                         warn $@ if $@;
 564                     }
 565                     die "create failed - $err";
 566                 }
 567
 568                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 569             };
 570
 571             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 572         };
 573
 574         return PVE::QemuConfig->lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 575     }});
 576
 577 __PACKAGE__->register_method({
 578     name => 'vmdiridx',
 579     path => '{vmid}',
 580     method => 'GET',
 581     proxyto => 'node',
 582     description => "Directory index",
 583     permissions => {
 584         user => 'all',
 585     },
 586     parameters => {
 587         additionalProperties => 0,
 588         properties => {
 589             node => get_standard_option('pve-node'),
 590             vmid => get_standard_option('pve-vmid'),
 591         },
 592     },
 593     returns => {
 594         type => 'array',
 595         items => {
 596             type => "object",
 597             properties => {
 598                 subdir => { type => 'string' },
 599             },
 600         },
 601         links => [ { rel => 'child', href => "{subdir}" } ],
 602     },
 603     code => sub {
 604         my ($param) = @_;
 605
 606         my $res = [
 607             { subdir => 'config' },
 608             { subdir => 'pending' },
 609             { subdir => 'status' },
 610             { subdir => 'unlink' },
 611             { subdir => 'vncproxy' },
 612             { subdir => 'termproxy' },
 613             { subdir => 'migrate' },
 614             { subdir => 'resize' },
 615             { subdir => 'move' },
 616             { subdir => 'rrd' },
 617             { subdir => 'rrddata' },
 618             { subdir => 'monitor' },
 619             { subdir => 'agent' },
 620             { subdir => 'snapshot' },
 621             { subdir => 'spiceproxy' },
 622             { subdir => 'sendkey' },
 623             { subdir => 'firewall' },
 624             ];
 625
 626         return $res;
 627     }});
 628
 629 __PACKAGE__->register_method ({
 630     subclass => "PVE::API2::Firewall::VM",
 631     path => '{vmid}/firewall',
 632 });
 633
 634 __PACKAGE__->register_method({
 635     name => 'rrd',
 636     path => '{vmid}/rrd',
 637     method => 'GET',
 638     protected => 1, # fixme: can we avoid that?
 639     permissions => {
 640         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 641     },
 642     description => "Read VM RRD statistics (returns PNG)",
 643     parameters => {
 644         additionalProperties => 0,
 645         properties => {
 646             node => get_standard_option('pve-node'),
 647             vmid => get_standard_option('pve-vmid'),
 648             timeframe => {
 649                 description => "Specify the time frame you are interested in.",
 650                 type => 'string',
 651                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 652             },
 653             ds => {
 654                 description => "The list of datasources you want to display.",
 655                 type => 'string', format => 'pve-configid-list',
 656             },
 657             cf => {
 658                 description => "The RRD consolidation function",
 659                 type => 'string',
 660                 enum => [ 'AVERAGE', 'MAX' ],
 661                 optional => 1,
 662             },
 663         },
 664     },
 665     returns => {
 666         type => "object",
 667         properties => {
 668             filename => { type => 'string' },
 669         },
 670     },
 671     code => sub {
 672         my ($param) = @_;
 673
 674         return PVE::Cluster::create_rrd_graph(
 675             "pve2-vm/$param->{vmid}", $param->{timeframe},
 676             $param->{ds}, $param->{cf});
 677
 678     }});
 679
 680 __PACKAGE__->register_method({
 681     name => 'rrddata',
 682     path => '{vmid}/rrddata',
 683     method => 'GET',
 684     protected => 1, # fixme: can we avoid that?
 685     permissions => {
 686         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 687     },
 688     description => "Read VM RRD statistics",
 689     parameters => {
 690         additionalProperties => 0,
 691         properties => {
 692             node => get_standard_option('pve-node'),
 693             vmid => get_standard_option('pve-vmid'),
 694             timeframe => {
 695                 description => "Specify the time frame you are interested in.",
 696                 type => 'string',
 697                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 698             },
 699             cf => {
 700                 description => "The RRD consolidation function",
 701                 type => 'string',
 702                 enum => [ 'AVERAGE', 'MAX' ],
 703                 optional => 1,
 704             },
 705         },
 706     },
 707     returns => {
 708         type => "array",
 709         items => {
 710             type => "object",
 711             properties => {},
 712         },
 713     },
 714     code => sub {
 715         my ($param) = @_;
 716
 717         return PVE::Cluster::create_rrd_data(
 718             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 719     }});
 720
 721
 722 __PACKAGE__->register_method({
 723     name => 'vm_config',
 724     path => '{vmid}/config',
 725     method => 'GET',
 726     proxyto => 'node',
 727     description => "Get current virtual machine configuration. This does not include pending configuration changes (see 'pending' API).",
 728     permissions => {
 729         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 730     },
 731     parameters => {
 732         additionalProperties => 0,
 733         properties => {
 734             node => get_standard_option('pve-node'),
 735             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 736             current => {
 737                 description => "Get current values (instead of pending values).",
 738                 optional => 1,
 739                 default => 0,
 740                 type => 'boolean',
 741             },
 742         },
 743     },
 744     returns => {
 745         type => "object",
 746         properties => {
 747             digest => {
 748                 type => 'string',
 749                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 750             }
 751         },
 752     },
 753     code => sub {
 754         my ($param) = @_;
 755
 756         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 757
 758         delete $conf->{snapshots};
 759
 760         if (!$param->{current}) {
 761             foreach my $opt (keys %{$conf->{pending}}) {
 762                 next if $opt eq 'delete';
 763                 my $value = $conf->{pending}->{$opt};
 764                 next if ref($value); # just to be sure
 765                 $conf->{$opt} = $value;
 766             }
 767             my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 768             foreach my $opt (keys %$pending_delete_hash) {
 769                 delete $conf->{$opt} if $conf->{$opt};
 770             }
 771         }
 772
 773         delete $conf->{pending};
 774
 775         return $conf;
 776     }});
 777
 778 __PACKAGE__->register_method({
 779     name => 'vm_pending',
 780     path => '{vmid}/pending',
 781     method => 'GET',
 782     proxyto => 'node',
 783     description => "Get virtual machine configuration, including pending changes.",
 784     permissions => {
 785         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 786     },
 787     parameters => {
 788         additionalProperties => 0,
 789         properties => {
 790             node => get_standard_option('pve-node'),
 791             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 792         },
 793     },
 794     returns => {
 795         type => "array",
 796         items => {
 797             type => "object",
 798             properties => {
 799                 key => {
 800                     description => "Configuration option name.",
 801                     type => 'string',
 802                 },
 803                 value => {
 804                     description => "Current value.",
 805                     type => 'string',
 806                     optional => 1,
 807                 },
 808                 pending => {
 809                     description => "Pending value.",
 810                     type => 'string',
 811                     optional => 1,
 812                 },
 813                 delete => {
 814                     description => "Indicates a pending delete request if present and not 0. " .
 815                                    "The value 2 indicates a force-delete request.",
 816                     type => 'integer',
 817                     minimum => 0,
 818                     maximum => 2,
 819                     optional => 1,
 820                 },
 821             },
 822         },
 823     },
 824     code => sub {
 825         my ($param) = @_;
 826
 827         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 828
 829         my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 830
 831         my $res = [];
 832
 833         foreach my $opt (keys %$conf) {
 834             next if ref($conf->{$opt});
 835             my $item = { key => $opt };
 836             $item->{value} = $conf->{$opt} if defined($conf->{$opt});
 837             $item->{pending} = $conf->{pending}->{$opt} if defined($conf->{pending}->{$opt});
 838             $item->{delete} = ($pending_delete_hash->{$opt} ? 2 : 1) if exists $pending_delete_hash->{$opt};
 839             push @$res, $item;
 840         }
 841
 842         foreach my $opt (keys %{$conf->{pending}}) {
 843             next if $opt eq 'delete';
 844             next if ref($conf->{pending}->{$opt}); # just to be sure
 845             next if defined($conf->{$opt});
 846             my $item = { key => $opt };
 847             $item->{pending} = $conf->{pending}->{$opt};
 848             push @$res, $item;
 849         }
 850
 851         while (my ($opt, $force) = each %$pending_delete_hash) {
 852             next if $conf->{pending}->{$opt}; # just to be sure
 853             next if $conf->{$opt};
 854             my $item = { key => $opt, delete => ($force ? 2 : 1)};
 855             push @$res, $item;
 856         }
 857
 858         return $res;
 859     }});
 860
 861 # POST/PUT {vmid}/config implementation
 862 #
 863 # The original API used PUT (idempotent) an we assumed that all operations
 864 # are fast. But it turned out that almost any configuration change can
 865 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 866 # time to complete and have side effects (not idempotent).
 867 #
 868 # The new implementation uses POST and forks a worker process. We added
 869 # a new option 'background_delay'. If specified we wait up to
 870 # 'background_delay' second for the worker task to complete. It returns null
 871 # if the task is finished within that time, else we return the UPID.
 872
 873 my $update_vm_api  = sub {
 874     my ($param, $sync) = @_;
 875
 876     my $rpcenv = PVE::RPCEnvironment::get();
 877
 878     my $authuser = $rpcenv->get_user();
 879
 880     my $node = extract_param($param, 'node');
 881
 882     my $vmid = extract_param($param, 'vmid');
 883
 884     my $digest = extract_param($param, 'digest');
 885
 886     my $background_delay = extract_param($param, 'background_delay');
 887
 888     my @paramarr = (); # used for log message
 889     foreach my $key (sort keys %$param) {
 890         push @paramarr, "-$key", $param->{$key};
 891     }
 892
 893     my $skiplock = extract_param($param, 'skiplock');
 894     raise_param_exc({ skiplock => "Only root may use this option." })
 895         if $skiplock && $authuser ne 'root@pam';
 896
 897     my $delete_str = extract_param($param, 'delete');
 898
 899     my $revert_str = extract_param($param, 'revert');
 900
 901     my $force = extract_param($param, 'force');
 902
 903     die "no options specified\n" if !$delete_str && !$revert_str && !scalar(keys %$param);
 904
 905     my $storecfg = PVE::Storage::config();
 906
 907     my $defaults = PVE::QemuServer::load_defaults();
 908
 909     &$resolve_cdrom_alias($param);
 910
 911     # now try to verify all parameters
 912
 913     my $revert = {};
 914     foreach my $opt (PVE::Tools::split_list($revert_str)) {
 915         if (!PVE::QemuServer::option_exists($opt)) {
 916             raise_param_exc({ revert => "unknown option '$opt'" });
 917         }
 918
 919         raise_param_exc({ delete => "you can't use '-$opt' and " .
 920                               "-revert $opt' at the same time" })
 921             if defined($param->{$opt});
 922
 923         $revert->{$opt} = 1;
 924     }
 925
 926     my @delete = ();
 927     foreach my $opt (PVE::Tools::split_list($delete_str)) {
 928         $opt = 'ide2' if $opt eq 'cdrom';
 929
 930         raise_param_exc({ delete => "you can't use '-$opt' and " .
 931                               "-delete $opt' at the same time" })
 932             if defined($param->{$opt});
 933
 934         raise_param_exc({ revert => "you can't use '-delete $opt' and " .
 935                               "-revert $opt' at the same time" })
 936             if $revert->{$opt};
 937
 938         if (!PVE::QemuServer::option_exists($opt)) {
 939             raise_param_exc({ delete => "unknown option '$opt'" });
 940         }
 941
 942         push @delete, $opt;
 943     }
 944
 945     my $repl_conf = PVE::ReplicationConfig->new();
 946     my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
 947     my $check_replication = sub {
 948         my ($drive) = @_;
 949         return if !$is_replicated;
 950         my $volid = $drive->{file};
 951         return if !$volid || !($drive->{replicate}//1);
 952         return if PVE::QemuServer::drive_is_cdrom($drive);
 953         my ($storeid, $format);
 954         if ($volid =~ $NEW_DISK_RE) {
 955             $storeid = $2;
 956             $format = $drive->{format} || PVE::Storage::storage_default_format($storecfg, $storeid);
 957         } else {
 958             ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
 959             $format = (PVE::Storage::parse_volname($storecfg, $volid))[6];
 960         }
 961         return if PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
 962         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
 963         return if $scfg->{shared};
 964         die "cannot add non-replicatable volume to a replicated VM\n";
 965     };
 966
 967     foreach my $opt (keys %$param) {
 968         if (PVE::QemuServer::is_valid_drivename($opt)) {
 969             # cleanup drive path
 970             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 971             raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 972             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 973             $check_replication->($drive);
 974             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 975         } elsif ($opt =~ m/^net(\d+)$/) {
 976             # add macaddr
 977             my $net = PVE::QemuServer::parse_net($param->{$opt});
 978             $param->{$opt} = PVE::QemuServer::print_net($net);
 979         }
 980     }
 981
 982     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 983
 984     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 985
 986     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 987
 988     my $updatefn =  sub {
 989
 990         my $conf = PVE::QemuConfig->load_config($vmid);
 991
 992         die "checksum missmatch (file change by other user?)\n"
 993             if $digest && $digest ne $conf->{digest};
 994
 995         PVE::QemuConfig->check_lock($conf) if !$skiplock;
 996
 997         foreach my $opt (keys %$revert) {
 998             if (defined($conf->{$opt})) {
 999                 $param->{$opt} = $conf->{$opt};
1000             } elsif (defined($conf->{pending}->{$opt})) {
1001                 push @delete, $opt;
1002             }
1003         }
1004
1005         if ($param->{memory} || defined($param->{balloon})) {
1006             my $maxmem = $param->{memory} || $conf->{pending}->{memory} || $conf->{memory} || $defaults->{memory};
1007             my $balloon = defined($param->{balloon}) ? $param->{balloon} : $conf->{pending}->{balloon} || $conf->{balloon};
1008
1009             die "balloon value too large (must be smaller than assigned memory)\n"
1010                 if $balloon && $balloon > $maxmem;
1011         }
1012
1013         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
1014
1015         my $worker = sub {
1016
1017             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
1018
1019             # write updates to pending section
1020
1021             my $modified = {}; # record what $option we modify
1022
1023             foreach my $opt (@delete) {
1024                 $modified->{$opt} = 1;
1025                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1026                 if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
1027                     warn "cannot delete '$opt' - not set in current configuration!\n";
1028                     $modified->{$opt} = 0;
1029                     next;
1030                 }
1031
1032                 if ($opt =~ m/^unused/) {
1033                     my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
1034                     PVE::QemuConfig->check_protection($conf, "can't remove unused disk '$drive->{file}'");
1035                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1036                     if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, $drive, $rpcenv, $authuser)) {
1037                         delete $conf->{$opt};
1038                         PVE::QemuConfig->write_config($vmid, $conf);
1039                     }
1040                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
1041                     PVE::QemuConfig->check_protection($conf, "can't remove drive '$opt'");
1042                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1043                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1044                         if defined($conf->{pending}->{$opt});
1045                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1046                     PVE::QemuConfig->write_config($vmid, $conf);
1047                 } else {
1048                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1049                     PVE::QemuConfig->write_config($vmid, $conf);
1050                 }
1051             }
1052
1053             foreach my $opt (keys %$param) { # add/change
1054                 $modified->{$opt} = 1;
1055                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1056                 next if defined($conf->{pending}->{$opt}) && ($param->{$opt} eq $conf->{pending}->{$opt}); # skip if nothing changed
1057
1058                 if (PVE::QemuServer::is_valid_drivename($opt)) {
1059                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1060                     if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
1061                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
1062                     } else {
1063                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1064                     }
1065                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1066                         if defined($conf->{pending}->{$opt});
1067
1068                     &$create_disks($rpcenv, $authuser, $conf->{pending}, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
1069                 } else {
1070                     $conf->{pending}->{$opt} = $param->{$opt};
1071                 }
1072                 PVE::QemuServer::vmconfig_undelete_pending_option($conf, $opt);
1073                 PVE::QemuConfig->write_config($vmid, $conf);
1074             }
1075
1076             # remove pending changes when nothing changed
1077             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1078             my $changes = PVE::QemuServer::vmconfig_cleanup_pending($conf);
1079             PVE::QemuConfig->write_config($vmid, $conf) if $changes;
1080
1081             return if !scalar(keys %{$conf->{pending}});
1082
1083             my $running = PVE::QemuServer::check_running($vmid);
1084
1085             # apply pending changes
1086
1087             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1088
1089             if ($running) {
1090                 my $errors = {};
1091                 PVE::QemuServer::vmconfig_hotplug_pending($vmid, $conf, $storecfg, $modified, $errors);
1092                 raise_param_exc($errors) if scalar(keys %$errors);
1093             } else {
1094                 PVE::QemuServer::vmconfig_apply_pending($vmid, $conf, $storecfg, $running);
1095             }
1096
1097             return;
1098         };
1099
1100         if ($sync) {
1101             &$worker();
1102             return undef;
1103         } else {
1104             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1105
1106             if ($background_delay) {
1107
1108                 # Note: It would be better to do that in the Event based HTTPServer
1109                 # to avoid blocking call to sleep.
1110
1111                 my $end_time = time() + $background_delay;
1112
1113                 my $task = PVE::Tools::upid_decode($upid);
1114
1115                 my $running = 1;
1116                 while (time() < $end_time) {
1117                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1118                     last if !$running;
1119                     sleep(1); # this gets interrupted when child process ends
1120                 }
1121
1122                 if (!$running) {
1123                     my $status = PVE::Tools::upid_read_status($upid);
1124                     return undef if $status eq 'OK';
1125                     die $status;
1126                 }
1127             }
1128
1129             return $upid;
1130         }
1131     };
1132
1133     return PVE::QemuConfig->lock_config($vmid, $updatefn);
1134 };
1135
1136 my $vm_config_perm_list = [
1137             'VM.Config.Disk',
1138             'VM.Config.CDROM',
1139             'VM.Config.CPU',
1140             'VM.Config.Memory',
1141             'VM.Config.Network',
1142             'VM.Config.HWType',
1143             'VM.Config.Options',
1144     ];
1145
1146 __PACKAGE__->register_method({
1147     name => 'update_vm_async',
1148     path => '{vmid}/config',
1149     method => 'POST',
1150     protected => 1,
1151     proxyto => 'node',
1152     description => "Set virtual machine options (asynchrounous API).",
1153     permissions => {
1154         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1155     },
1156     parameters => {
1157         additionalProperties => 0,
1158         properties => PVE::QemuServer::json_config_properties(
1159             {
1160                 node => get_standard_option('pve-node'),
1161                 vmid => get_standard_option('pve-vmid'),
1162                 skiplock => get_standard_option('skiplock'),
1163                 delete => {
1164                     type => 'string', format => 'pve-configid-list',
1165                     description => "A list of settings you want to delete.",
1166                     optional => 1,
1167                 },
1168                 revert => {
1169                     type => 'string', format => 'pve-configid-list',
1170                     description => "Revert a pending change.",
1171                     optional => 1,
1172                 },
1173                 force => {
1174                     type => 'boolean',
1175                     description => $opt_force_description,
1176                     optional => 1,
1177                     requires => 'delete',
1178                 },
1179                 digest => {
1180                     type => 'string',
1181                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1182                     maxLength => 40,
1183                     optional => 1,
1184                 },
1185                 background_delay => {
1186                     type => 'integer',
1187                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1188                     minimum => 1,
1189                     maximum => 30,
1190                     optional => 1,
1191                 },
1192             }),
1193     },
1194     returns => {
1195         type => 'string',
1196         optional => 1,
1197     },
1198     code => $update_vm_api,
1199 });
1200
1201 __PACKAGE__->register_method({
1202     name => 'update_vm',
1203     path => '{vmid}/config',
1204     method => 'PUT',
1205     protected => 1,
1206     proxyto => 'node',
1207     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1208     permissions => {
1209         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1210     },
1211     parameters => {
1212         additionalProperties => 0,
1213         properties => PVE::QemuServer::json_config_properties(
1214             {
1215                 node => get_standard_option('pve-node'),
1216                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1217                 skiplock => get_standard_option('skiplock'),
1218                 delete => {
1219                     type => 'string', format => 'pve-configid-list',
1220                     description => "A list of settings you want to delete.",
1221                     optional => 1,
1222                 },
1223                 revert => {
1224                     type => 'string', format => 'pve-configid-list',
1225                     description => "Revert a pending change.",
1226                     optional => 1,
1227                 },
1228                 force => {
1229                     type => 'boolean',
1230                     description => $opt_force_description,
1231                     optional => 1,
1232                     requires => 'delete',
1233                 },
1234                 digest => {
1235                     type => 'string',
1236                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1237                     maxLength => 40,
1238                     optional => 1,
1239                 },
1240             }),
1241     },
1242     returns => { type => 'null' },
1243     code => sub {
1244         my ($param) = @_;
1245         &$update_vm_api($param, 1);
1246         return undef;
1247     }
1248 });
1249
1250
1251 __PACKAGE__->register_method({
1252     name => 'destroy_vm',
1253     path => '{vmid}',
1254     method => 'DELETE',
1255     protected => 1,
1256     proxyto => 'node',
1257     description => "Destroy the vm (also delete all used/owned volumes).",
1258     permissions => {
1259         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1260     },
1261     parameters => {
1262         additionalProperties => 0,
1263         properties => {
1264             node => get_standard_option('pve-node'),
1265             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1266             skiplock => get_standard_option('skiplock'),
1267         },
1268     },
1269     returns => {
1270         type => 'string',
1271     },
1272     code => sub {
1273         my ($param) = @_;
1274
1275         my $rpcenv = PVE::RPCEnvironment::get();
1276
1277         my $authuser = $rpcenv->get_user();
1278
1279         my $vmid = $param->{vmid};
1280
1281         my $skiplock = $param->{skiplock};
1282         raise_param_exc({ skiplock => "Only root may use this option." })
1283             if $skiplock && $authuser ne 'root@pam';
1284
1285         # test if VM exists
1286         my $conf = PVE::QemuConfig->load_config($vmid);
1287
1288         my $storecfg = PVE::Storage::config();
1289
1290         PVE::QemuConfig->check_protection($conf, "can't remove VM $vmid");
1291
1292         die "unable to remove VM $vmid - used in HA resources\n"
1293             if PVE::HA::Config::vm_is_ha_managed($vmid);
1294
1295         # do not allow destroy if there are replication jobs
1296         my $repl_conf = PVE::ReplicationConfig->new();
1297         $repl_conf->check_for_existing_jobs($vmid);
1298
1299         # early tests (repeat after locking)
1300         die "VM $vmid is running - destroy failed\n"
1301             if PVE::QemuServer::check_running($vmid);
1302
1303         my $realcmd = sub {
1304             my $upid = shift;
1305
1306             syslog('info', "destroy VM $vmid: $upid\n");
1307
1308             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1309
1310             PVE::AccessControl::remove_vm_access($vmid);
1311
1312             PVE::Firewall::remove_vmfw_conf($vmid);
1313         };
1314
1315         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1316     }});
1317
1318 __PACKAGE__->register_method({
1319     name => 'unlink',
1320     path => '{vmid}/unlink',
1321     method => 'PUT',
1322     protected => 1,
1323     proxyto => 'node',
1324     description => "Unlink/delete disk images.",
1325     permissions => {
1326         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1327     },
1328     parameters => {
1329         additionalProperties => 0,
1330         properties => {
1331             node => get_standard_option('pve-node'),
1332             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1333             idlist => {
1334                 type => 'string', format => 'pve-configid-list',
1335                 description => "A list of disk IDs you want to delete.",
1336             },
1337             force => {
1338                 type => 'boolean',
1339                 description => $opt_force_description,
1340                 optional => 1,
1341             },
1342         },
1343     },
1344     returns => { type => 'null'},
1345     code => sub {
1346         my ($param) = @_;
1347
1348         $param->{delete} = extract_param($param, 'idlist');
1349
1350         __PACKAGE__->update_vm($param);
1351
1352         return undef;
1353     }});
1354
1355 my $sslcert;
1356
1357 __PACKAGE__->register_method({
1358     name => 'vncproxy',
1359     path => '{vmid}/vncproxy',
1360     method => 'POST',
1361     protected => 1,
1362     permissions => {
1363         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1364     },
1365     description => "Creates a TCP VNC proxy connections.",
1366     parameters => {
1367         additionalProperties => 0,
1368         properties => {
1369             node => get_standard_option('pve-node'),
1370             vmid => get_standard_option('pve-vmid'),
1371             websocket => {
1372                 optional => 1,
1373                 type => 'boolean',
1374                 description => "starts websockify instead of vncproxy",
1375             },
1376         },
1377     },
1378     returns => {
1379         additionalProperties => 0,
1380         properties => {
1381             user => { type => 'string' },
1382             ticket => { type => 'string' },
1383             cert => { type => 'string' },
1384             port => { type => 'integer' },
1385             upid => { type => 'string' },
1386         },
1387     },
1388     code => sub {
1389         my ($param) = @_;
1390
1391         my $rpcenv = PVE::RPCEnvironment::get();
1392
1393         my $authuser = $rpcenv->get_user();
1394
1395         my $vmid = $param->{vmid};
1396         my $node = $param->{node};
1397         my $websocket = $param->{websocket};
1398
1399         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1400
1401         my $authpath = "/vms/$vmid";
1402
1403         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1404
1405         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1406             if !$sslcert;
1407
1408         my ($remip, $family);
1409         my $remcmd = [];
1410
1411         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1412             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1413             # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
1414             $remcmd = ['/usr/bin/ssh', '-e', 'none', '-T', '-o', 'BatchMode=yes', $remip];
1415         } else {
1416             $family = PVE::Tools::get_host_address_family($node);
1417         }
1418
1419         my $port = PVE::Tools::next_vnc_port($family);
1420
1421         my $timeout = 10;
1422
1423         my $realcmd = sub {
1424             my $upid = shift;
1425
1426             syslog('info', "starting vnc proxy $upid\n");
1427
1428             my $cmd;
1429
1430             if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
1431
1432
1433                 my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga} ];
1434
1435                 $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
1436                         '-timeout', $timeout, '-authpath', $authpath,
1437                         '-perm', 'Sys.Console'];
1438
1439                 if ($param->{websocket}) {
1440                     $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
1441                     push @$cmd, '-notls', '-listen', 'localhost';
1442                 }
1443
1444                 push @$cmd, '-c', @$remcmd, @$termcmd;
1445
1446                 PVE::Tools::run_command($cmd);
1447
1448             } else {
1449
1450                 $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
1451
1452                 $cmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1453
1454                 my $sock = IO::Socket::IP->new(
1455                     ReuseAddr => 1,
1456                     Listen => 1,
1457                     LocalPort => $port,
1458                     Proto => 'tcp',
1459                     GetAddrInfoFlags => 0,
1460                     ) or die "failed to create socket: $!\n";
1461                 # Inside the worker we shouldn't have any previous alarms
1462                 # running anyway...:
1463                 alarm(0);
1464                 local $SIG{ALRM} = sub { die "connection timed out\n" };
1465                 alarm $timeout;
1466                 accept(my $cli, $sock) or die "connection failed: $!\n";
1467                 alarm(0);
1468                 close($sock);
1469                 if (PVE::Tools::run_command($cmd,
1470                     output => '>&'.fileno($cli),
1471                     input => '<&'.fileno($cli),
1472                     noerr => 1) != 0)
1473                 {
1474                     die "Failed to run vncproxy.\n";
1475                 }
1476             }
1477
1478             return;
1479         };
1480
1481         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1482
1483         PVE::Tools::wait_for_vnc_port($port);
1484
1485         return {
1486             user => $authuser,
1487             ticket => $ticket,
1488             port => $port,
1489             upid => $upid,
1490             cert => $sslcert,
1491         };
1492     }});
1493
1494 __PACKAGE__->register_method({
1495     name => 'termproxy',
1496     path => '{vmid}/termproxy',
1497     method => 'POST',
1498     protected => 1,
1499     permissions => {
1500         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1501     },
1502     description => "Creates a TCP proxy connections.",
1503     parameters => {
1504         additionalProperties => 0,
1505         properties => {
1506             node => get_standard_option('pve-node'),
1507             vmid => get_standard_option('pve-vmid'),
1508             serial=> {
1509                 optional => 1,
1510                 type => 'string',
1511                 enum => [qw(serial0 serial1 serial2 serial3)],
1512                 description => "opens a serial terminal (defaults to display)",
1513             },
1514         },
1515     },
1516     returns => {
1517         additionalProperties => 0,
1518         properties => {
1519             user => { type => 'string' },
1520             ticket => { type => 'string' },
1521             port => { type => 'integer' },
1522             upid => { type => 'string' },
1523         },
1524     },
1525     code => sub {
1526         my ($param) = @_;
1527
1528         my $rpcenv = PVE::RPCEnvironment::get();
1529
1530         my $authuser = $rpcenv->get_user();
1531
1532         my $vmid = $param->{vmid};
1533         my $node = $param->{node};
1534         my $serial = $param->{serial};
1535
1536         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1537
1538         if (!defined($serial)) {
1539             if ($conf->{vga} && $conf->{vga} =~ m/^serial\d+$/) {
1540                 $serial = $conf->{vga};
1541             }
1542         }
1543
1544         my $authpath = "/vms/$vmid";
1545
1546         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1547
1548         my ($remip, $family);
1549
1550         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1551             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1552         } else {
1553             $family = PVE::Tools::get_host_address_family($node);
1554         }
1555
1556         my $port = PVE::Tools::next_vnc_port($family);
1557
1558         my $remcmd = $remip ?
1559             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
1560
1561         my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid];
1562         push @$termcmd, '-iface', $serial if $serial;
1563
1564         my $realcmd = sub {
1565             my $upid = shift;
1566
1567             syslog('info', "starting qemu termproxy $upid\n");
1568
1569             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
1570                        '--perm', 'VM.Console', '--'];
1571             push @$cmd, @$remcmd, @$termcmd;
1572
1573             PVE::Tools::run_command($cmd);
1574         };
1575
1576         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1577
1578         PVE::Tools::wait_for_vnc_port($port);
1579
1580         return {
1581             user => $authuser,
1582             ticket => $ticket,
1583             port => $port,
1584             upid => $upid,
1585         };
1586     }});
1587
1588 __PACKAGE__->register_method({
1589     name => 'vncwebsocket',
1590     path => '{vmid}/vncwebsocket',
1591     method => 'GET',
1592     permissions => {
1593         description => "You also need to pass a valid ticket (vncticket).",
1594         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1595     },
1596     description => "Opens a weksocket for VNC traffic.",
1597     parameters => {
1598         additionalProperties => 0,
1599         properties => {
1600             node => get_standard_option('pve-node'),
1601             vmid => get_standard_option('pve-vmid'),
1602             vncticket => {
1603                 description => "Ticket from previous call to vncproxy.",
1604                 type => 'string',
1605                 maxLength => 512,
1606             },
1607             port => {
1608                 description => "Port number returned by previous vncproxy call.",
1609                 type => 'integer',
1610                 minimum => 5900,
1611                 maximum => 5999,
1612             },
1613         },
1614     },
1615     returns => {
1616         type => "object",
1617         properties => {
1618             port => { type => 'string' },
1619         },
1620     },
1621     code => sub {
1622         my ($param) = @_;
1623
1624         my $rpcenv = PVE::RPCEnvironment::get();
1625
1626         my $authuser = $rpcenv->get_user();
1627
1628         my $vmid = $param->{vmid};
1629         my $node = $param->{node};
1630
1631         my $authpath = "/vms/$vmid";
1632
1633         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1634
1635         my $conf = PVE::QemuConfig->load_config($vmid, $node); # VM exists ?
1636
1637         # Note: VNC ports are acessible from outside, so we do not gain any
1638         # security if we verify that $param->{port} belongs to VM $vmid. This
1639         # check is done by verifying the VNC ticket (inside VNC protocol).
1640
1641         my $port = $param->{port};
1642
1643         return { port => $port };
1644     }});
1645
1646 __PACKAGE__->register_method({
1647     name => 'spiceproxy',
1648     path => '{vmid}/spiceproxy',
1649     method => 'POST',
1650     protected => 1,
1651     proxyto => 'node',
1652     permissions => {
1653         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1654     },
1655     description => "Returns a SPICE configuration to connect to the VM.",
1656     parameters => {
1657         additionalProperties => 0,
1658         properties => {
1659             node => get_standard_option('pve-node'),
1660             vmid => get_standard_option('pve-vmid'),
1661             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1662         },
1663     },
1664     returns => get_standard_option('remote-viewer-config'),
1665     code => sub {
1666         my ($param) = @_;
1667
1668         my $rpcenv = PVE::RPCEnvironment::get();
1669
1670         my $authuser = $rpcenv->get_user();
1671
1672         my $vmid = $param->{vmid};
1673         my $node = $param->{node};
1674         my $proxy = $param->{proxy};
1675
1676         my $conf = PVE::QemuConfig->load_config($vmid, $node);
1677         my $title = "VM $vmid";
1678         $title .= " - ". $conf->{name} if $conf->{name};
1679
1680         my $port = PVE::QemuServer::spice_port($vmid);
1681
1682         my ($ticket, undef, $remote_viewer_config) =
1683             PVE::AccessControl::remote_viewer_config($authuser, $vmid, $node, $proxy, $title, $port);
1684
1685         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1686         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1687
1688         return $remote_viewer_config;
1689     }});
1690
1691 __PACKAGE__->register_method({
1692     name => 'vmcmdidx',
1693     path => '{vmid}/status',
1694     method => 'GET',
1695     proxyto => 'node',
1696     description => "Directory index",
1697     permissions => {
1698         user => 'all',
1699     },
1700     parameters => {
1701         additionalProperties => 0,
1702         properties => {
1703             node => get_standard_option('pve-node'),
1704             vmid => get_standard_option('pve-vmid'),
1705         },
1706     },
1707     returns => {
1708         type => 'array',
1709         items => {
1710             type => "object",
1711             properties => {
1712                 subdir => { type => 'string' },
1713             },
1714         },
1715         links => [ { rel => 'child', href => "{subdir}" } ],
1716     },
1717     code => sub {
1718         my ($param) = @_;
1719
1720         # test if VM exists
1721         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1722
1723         my $res = [
1724             { subdir => 'current' },
1725             { subdir => 'start' },
1726             { subdir => 'stop' },
1727             ];
1728
1729         return $res;
1730     }});
1731
1732 __PACKAGE__->register_method({
1733     name => 'vm_status',
1734     path => '{vmid}/status/current',
1735     method => 'GET',
1736     proxyto => 'node',
1737     protected => 1, # qemu pid files are only readable by root
1738     description => "Get virtual machine status.",
1739     permissions => {
1740         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1741     },
1742     parameters => {
1743         additionalProperties => 0,
1744         properties => {
1745             node => get_standard_option('pve-node'),
1746             vmid => get_standard_option('pve-vmid'),
1747         },
1748     },
1749     returns => { type => 'object' },
1750     code => sub {
1751         my ($param) = @_;
1752
1753         # test if VM exists
1754         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1755
1756         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1757         my $status = $vmstatus->{$param->{vmid}};
1758
1759         $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
1760
1761         $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
1762
1763         return $status;
1764     }});
1765
1766 __PACKAGE__->register_method({
1767     name => 'vm_start',
1768     path => '{vmid}/status/start',
1769     method => 'POST',
1770     protected => 1,
1771     proxyto => 'node',
1772     description => "Start virtual machine.",
1773     permissions => {
1774         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1775     },
1776     parameters => {
1777         additionalProperties => 0,
1778         properties => {
1779             node => get_standard_option('pve-node'),
1780             vmid => get_standard_option('pve-vmid',
1781                                         { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1782             skiplock => get_standard_option('skiplock'),
1783             stateuri => get_standard_option('pve-qm-stateuri'),
1784             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1785             migration_type => {
1786                 type => 'string',
1787                 enum => ['secure', 'insecure'],
1788                 description => "Migration traffic is encrypted using an SSH " .
1789                   "tunnel by default. On secure, completely private networks " .
1790                   "this can be disabled to increase performance.",
1791                 optional => 1,
1792             },
1793             migration_network => {
1794                 type => 'string', format => 'CIDR',
1795                 description => "CIDR of the (sub) network that is used for migration.",
1796                 optional => 1,
1797             },
1798             machine => get_standard_option('pve-qm-machine'),
1799             targetstorage => {
1800                 description => "Target storage for the migration. (Can be '1' to use the same storage id as on the source node.)",
1801                 type => 'string',
1802                 optional => 1
1803             }
1804         },
1805     },
1806     returns => {
1807         type => 'string',
1808     },
1809     code => sub {
1810         my ($param) = @_;
1811
1812         my $rpcenv = PVE::RPCEnvironment::get();
1813
1814         my $authuser = $rpcenv->get_user();
1815
1816         my $node = extract_param($param, 'node');
1817
1818         my $vmid = extract_param($param, 'vmid');
1819
1820         my $machine = extract_param($param, 'machine');
1821
1822         my $stateuri = extract_param($param, 'stateuri');
1823         raise_param_exc({ stateuri => "Only root may use this option." })
1824             if $stateuri && $authuser ne 'root@pam';
1825
1826         my $skiplock = extract_param($param, 'skiplock');
1827         raise_param_exc({ skiplock => "Only root may use this option." })
1828             if $skiplock && $authuser ne 'root@pam';
1829
1830         my $migratedfrom = extract_param($param, 'migratedfrom');
1831         raise_param_exc({ migratedfrom => "Only root may use this option." })
1832             if $migratedfrom && $authuser ne 'root@pam';
1833
1834         my $migration_type = extract_param($param, 'migration_type');
1835         raise_param_exc({ migration_type => "Only root may use this option." })
1836             if $migration_type && $authuser ne 'root@pam';
1837
1838         my $migration_network = extract_param($param, 'migration_network');
1839         raise_param_exc({ migration_network => "Only root may use this option." })
1840             if $migration_network && $authuser ne 'root@pam';
1841
1842         my $targetstorage = extract_param($param, 'targetstorage');
1843         raise_param_exc({ targetstorage => "Only root may use this option." })
1844             if $targetstorage && $authuser ne 'root@pam';
1845
1846         raise_param_exc({ targetstorage => "targetstorage can only by used with migratedfrom." })
1847             if $targetstorage && !$migratedfrom;
1848
1849         # read spice ticket from STDIN
1850         my $spice_ticket;
1851         if ($stateuri && ($stateuri eq 'tcp') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
1852             if (defined(my $line = <>)) {
1853                 chomp $line;
1854                 $spice_ticket = $line;
1855             }
1856         }
1857
1858         PVE::Cluster::check_cfs_quorum();
1859
1860         my $storecfg = PVE::Storage::config();
1861
1862         if (PVE::HA::Config::vm_is_ha_managed($vmid) && !$stateuri &&
1863             $rpcenv->{type} ne 'ha') {
1864
1865             my $hacmd = sub {
1866                 my $upid = shift;
1867
1868                 my $service = "vm:$vmid";
1869
1870                 my $cmd = ['ha-manager', 'set', $service, '--state', 'started'];
1871
1872                 print "Requesting HA start for VM $vmid\n";
1873
1874                 PVE::Tools::run_command($cmd);
1875
1876                 return;
1877             };
1878
1879             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1880
1881         } else {
1882
1883             my $realcmd = sub {
1884                 my $upid = shift;
1885
1886                 syslog('info', "start VM $vmid: $upid\n");
1887
1888                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef,
1889                                           $machine, $spice_ticket, $migration_network, $migration_type, $targetstorage);
1890
1891                 return;
1892             };
1893
1894             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1895         }
1896     }});
1897
1898 __PACKAGE__->register_method({
1899     name => 'vm_stop',
1900     path => '{vmid}/status/stop',
1901     method => 'POST',
1902     protected => 1,
1903     proxyto => 'node',
1904     description => "Stop virtual machine. The qemu process will exit immediately. This" .
1905         "is akin to pulling the power plug of a running computer and may damage the VM data",
1906     permissions => {
1907         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1908     },
1909     parameters => {
1910         additionalProperties => 0,
1911         properties => {
1912             node => get_standard_option('pve-node'),
1913             vmid => get_standard_option('pve-vmid',
1914                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1915             skiplock => get_standard_option('skiplock'),
1916             migratedfrom => get_standard_option('pve-node', { optional => 1 }),
1917             timeout => {
1918                 description => "Wait maximal timeout seconds.",
1919                 type => 'integer',
1920                 minimum => 0,
1921                 optional => 1,
1922             },
1923             keepActive => {
1924                 description => "Do not deactivate storage volumes.",
1925                 type => 'boolean',
1926                 optional => 1,
1927                 default => 0,
1928             }
1929         },
1930     },
1931     returns => {
1932         type => 'string',
1933     },
1934     code => sub {
1935         my ($param) = @_;
1936
1937         my $rpcenv = PVE::RPCEnvironment::get();
1938
1939         my $authuser = $rpcenv->get_user();
1940
1941         my $node = extract_param($param, 'node');
1942
1943         my $vmid = extract_param($param, 'vmid');
1944
1945         my $skiplock = extract_param($param, 'skiplock');
1946         raise_param_exc({ skiplock => "Only root may use this option." })
1947             if $skiplock && $authuser ne 'root@pam';
1948
1949         my $keepActive = extract_param($param, 'keepActive');
1950         raise_param_exc({ keepActive => "Only root may use this option." })
1951             if $keepActive && $authuser ne 'root@pam';
1952
1953         my $migratedfrom = extract_param($param, 'migratedfrom');
1954         raise_param_exc({ migratedfrom => "Only root may use this option." })
1955             if $migratedfrom && $authuser ne 'root@pam';
1956
1957
1958         my $storecfg = PVE::Storage::config();
1959
1960         if (PVE::HA::Config::vm_is_ha_managed($vmid) && ($rpcenv->{type} ne 'ha') && !defined($migratedfrom)) {
1961
1962             my $hacmd = sub {
1963                 my $upid = shift;
1964
1965                 my $service = "vm:$vmid";
1966
1967                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
1968
1969                 print "Requesting HA stop for VM $vmid\n";
1970
1971                 PVE::Tools::run_command($cmd);
1972
1973                 return;
1974             };
1975
1976             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1977
1978         } else {
1979             my $realcmd = sub {
1980                 my $upid = shift;
1981
1982                 syslog('info', "stop VM $vmid: $upid\n");
1983
1984                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1985                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1986
1987                 return;
1988             };
1989
1990             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1991         }
1992     }});
1993
1994 __PACKAGE__->register_method({
1995     name => 'vm_reset',
1996     path => '{vmid}/status/reset',
1997     method => 'POST',
1998     protected => 1,
1999     proxyto => 'node',
2000     description => "Reset virtual machine.",
2001     permissions => {
2002         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2003     },
2004     parameters => {
2005         additionalProperties => 0,
2006         properties => {
2007             node => get_standard_option('pve-node'),
2008             vmid => get_standard_option('pve-vmid',
2009                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2010             skiplock => get_standard_option('skiplock'),
2011         },
2012     },
2013     returns => {
2014         type => 'string',
2015     },
2016     code => sub {
2017         my ($param) = @_;
2018
2019         my $rpcenv = PVE::RPCEnvironment::get();
2020
2021         my $authuser = $rpcenv->get_user();
2022
2023         my $node = extract_param($param, 'node');
2024
2025         my $vmid = extract_param($param, 'vmid');
2026
2027         my $skiplock = extract_param($param, 'skiplock');
2028         raise_param_exc({ skiplock => "Only root may use this option." })
2029             if $skiplock && $authuser ne 'root@pam';
2030
2031         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2032
2033         my $realcmd = sub {
2034             my $upid = shift;
2035
2036             PVE::QemuServer::vm_reset($vmid, $skiplock);
2037
2038             return;
2039         };
2040
2041         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
2042     }});
2043
2044 __PACKAGE__->register_method({
2045     name => 'vm_shutdown',
2046     path => '{vmid}/status/shutdown',
2047     method => 'POST',
2048     protected => 1,
2049     proxyto => 'node',
2050     description => "Shutdown virtual machine. This is similar to pressing the power button on a physical machine." .
2051         "This will send an ACPI event for the guest OS, which should then proceed to a clean shutdown.",
2052     permissions => {
2053         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2054     },
2055     parameters => {
2056         additionalProperties => 0,
2057         properties => {
2058             node => get_standard_option('pve-node'),
2059             vmid => get_standard_option('pve-vmid',
2060                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2061             skiplock => get_standard_option('skiplock'),
2062             timeout => {
2063                 description => "Wait maximal timeout seconds.",
2064                 type => 'integer',
2065                 minimum => 0,
2066                 optional => 1,
2067             },
2068             forceStop => {
2069                 description => "Make sure the VM stops.",
2070                 type => 'boolean',
2071                 optional => 1,
2072                 default => 0,
2073             },
2074             keepActive => {
2075                 description => "Do not deactivate storage volumes.",
2076                 type => 'boolean',
2077                 optional => 1,
2078                 default => 0,
2079             }
2080         },
2081     },
2082     returns => {
2083         type => 'string',
2084     },
2085     code => sub {
2086         my ($param) = @_;
2087
2088         my $rpcenv = PVE::RPCEnvironment::get();
2089
2090         my $authuser = $rpcenv->get_user();
2091
2092         my $node = extract_param($param, 'node');
2093
2094         my $vmid = extract_param($param, 'vmid');
2095
2096         my $skiplock = extract_param($param, 'skiplock');
2097         raise_param_exc({ skiplock => "Only root may use this option." })
2098             if $skiplock && $authuser ne 'root@pam';
2099
2100         my $keepActive = extract_param($param, 'keepActive');
2101         raise_param_exc({ keepActive => "Only root may use this option." })
2102             if $keepActive && $authuser ne 'root@pam';
2103
2104         my $storecfg = PVE::Storage::config();
2105
2106         my $shutdown = 1;
2107
2108         # if vm is paused, do not shutdown (but stop if forceStop = 1)
2109         # otherwise, we will infer a shutdown command, but run into the timeout,
2110         # then when the vm is resumed, it will instantly shutdown
2111         #
2112         # checking the qmp status here to get feedback to the gui/cli/api
2113         # and the status query should not take too long
2114         my $qmpstatus;
2115         eval {
2116             $qmpstatus = PVE::QemuServer::vm_qmp_command($vmid, { execute => "query-status" }, 0);
2117         };
2118         my $err = $@ if $@;
2119
2120         if (!$err && $qmpstatus->{status} eq "paused") {
2121             if ($param->{forceStop}) {
2122                 warn "VM is paused - stop instead of shutdown\n";
2123                 $shutdown = 0;
2124             } else {
2125                 die "VM is paused - cannot shutdown\n";
2126             }
2127         }
2128
2129         if (PVE::HA::Config::vm_is_ha_managed($vmid) &&
2130             ($rpcenv->{type} ne 'ha')) {
2131
2132             my $hacmd = sub {
2133                 my $upid = shift;
2134
2135                 my $service = "vm:$vmid";
2136
2137                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
2138
2139                 print "Requesting HA stop for VM $vmid\n";
2140
2141                 PVE::Tools::run_command($cmd);
2142
2143                 return;
2144             };
2145
2146             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
2147
2148         } else {
2149
2150             my $realcmd = sub {
2151                 my $upid = shift;
2152
2153                 syslog('info', "shutdown VM $vmid: $upid\n");
2154
2155                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
2156                                          $shutdown, $param->{forceStop}, $keepActive);
2157
2158                 return;
2159             };
2160
2161             return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
2162         }
2163     }});
2164
2165 __PACKAGE__->register_method({
2166     name => 'vm_suspend',
2167     path => '{vmid}/status/suspend',
2168     method => 'POST',
2169     protected => 1,
2170     proxyto => 'node',
2171     description => "Suspend virtual machine.",
2172     permissions => {
2173         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2174     },
2175     parameters => {
2176         additionalProperties => 0,
2177         properties => {
2178             node => get_standard_option('pve-node'),
2179             vmid => get_standard_option('pve-vmid',
2180                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2181             skiplock => get_standard_option('skiplock'),
2182         },
2183     },
2184     returns => {
2185         type => 'string',
2186     },
2187     code => sub {
2188         my ($param) = @_;
2189
2190         my $rpcenv = PVE::RPCEnvironment::get();
2191
2192         my $authuser = $rpcenv->get_user();
2193
2194         my $node = extract_param($param, 'node');
2195
2196         my $vmid = extract_param($param, 'vmid');
2197
2198         my $skiplock = extract_param($param, 'skiplock');
2199         raise_param_exc({ skiplock => "Only root may use this option." })
2200             if $skiplock && $authuser ne 'root@pam';
2201
2202         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2203
2204         my $realcmd = sub {
2205             my $upid = shift;
2206
2207             syslog('info', "suspend VM $vmid: $upid\n");
2208
2209             PVE::QemuServer::vm_suspend($vmid, $skiplock);
2210
2211             return;
2212         };
2213
2214         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
2215     }});
2216
2217 __PACKAGE__->register_method({
2218     name => 'vm_resume',
2219     path => '{vmid}/status/resume',
2220     method => 'POST',
2221     protected => 1,
2222     proxyto => 'node',
2223     description => "Resume virtual machine.",
2224     permissions => {
2225         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2226     },
2227     parameters => {
2228         additionalProperties => 0,
2229         properties => {
2230             node => get_standard_option('pve-node'),
2231             vmid => get_standard_option('pve-vmid',
2232                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2233             skiplock => get_standard_option('skiplock'),
2234             nocheck => { type => 'boolean', optional => 1 },
2235
2236         },
2237     },
2238     returns => {
2239         type => 'string',
2240     },
2241     code => sub {
2242         my ($param) = @_;
2243
2244         my $rpcenv = PVE::RPCEnvironment::get();
2245
2246         my $authuser = $rpcenv->get_user();
2247
2248         my $node = extract_param($param, 'node');
2249
2250         my $vmid = extract_param($param, 'vmid');
2251
2252         my $skiplock = extract_param($param, 'skiplock');
2253         raise_param_exc({ skiplock => "Only root may use this option." })
2254             if $skiplock && $authuser ne 'root@pam';
2255
2256         my $nocheck = extract_param($param, 'nocheck');
2257
2258         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid, $nocheck);
2259
2260         my $realcmd = sub {
2261             my $upid = shift;
2262
2263             syslog('info', "resume VM $vmid: $upid\n");
2264
2265             PVE::QemuServer::vm_resume($vmid, $skiplock, $nocheck);
2266
2267             return;
2268         };
2269
2270         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
2271     }});
2272
2273 __PACKAGE__->register_method({
2274     name => 'vm_sendkey',
2275     path => '{vmid}/sendkey',
2276     method => 'PUT',
2277     protected => 1,
2278     proxyto => 'node',
2279     description => "Send key event to virtual machine.",
2280     permissions => {
2281         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
2282     },
2283     parameters => {
2284         additionalProperties => 0,
2285         properties => {
2286             node => get_standard_option('pve-node'),
2287             vmid => get_standard_option('pve-vmid',
2288                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2289             skiplock => get_standard_option('skiplock'),
2290             key => {
2291                 description => "The key (qemu monitor encoding).",
2292                 type => 'string'
2293             }
2294         },
2295     },
2296     returns => { type => 'null'},
2297     code => sub {
2298         my ($param) = @_;
2299
2300         my $rpcenv = PVE::RPCEnvironment::get();
2301
2302         my $authuser = $rpcenv->get_user();
2303
2304         my $node = extract_param($param, 'node');
2305
2306         my $vmid = extract_param($param, 'vmid');
2307
2308         my $skiplock = extract_param($param, 'skiplock');
2309         raise_param_exc({ skiplock => "Only root may use this option." })
2310             if $skiplock && $authuser ne 'root@pam';
2311
2312         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
2313
2314         return;
2315     }});
2316
2317 __PACKAGE__->register_method({
2318     name => 'vm_feature',
2319     path => '{vmid}/feature',
2320     method => 'GET',
2321     proxyto => 'node',
2322     protected => 1,
2323     description => "Check if feature for virtual machine is available.",
2324     permissions => {
2325         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2326     },
2327     parameters => {
2328         additionalProperties => 0,
2329         properties => {
2330             node => get_standard_option('pve-node'),
2331             vmid => get_standard_option('pve-vmid'),
2332             feature => {
2333                 description => "Feature to check.",
2334                 type => 'string',
2335                 enum => [ 'snapshot', 'clone', 'copy' ],
2336             },
2337             snapname => get_standard_option('pve-snapshot-name', {
2338                 optional => 1,
2339             }),
2340         },
2341     },
2342     returns => {
2343         type => "object",
2344         properties => {
2345             hasFeature => { type => 'boolean' },
2346             nodes => {
2347                 type => 'array',
2348                 items => { type => 'string' },
2349             }
2350         },
2351     },
2352     code => sub {
2353         my ($param) = @_;
2354
2355         my $node = extract_param($param, 'node');
2356
2357         my $vmid = extract_param($param, 'vmid');
2358
2359         my $snapname = extract_param($param, 'snapname');
2360
2361         my $feature = extract_param($param, 'feature');
2362
2363         my $running = PVE::QemuServer::check_running($vmid);
2364
2365         my $conf = PVE::QemuConfig->load_config($vmid);
2366
2367         if($snapname){
2368             my $snap = $conf->{snapshots}->{$snapname};
2369             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2370             $conf = $snap;
2371         }
2372         my $storecfg = PVE::Storage::config();
2373
2374         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
2375         my $hasFeature = PVE::QemuConfig->has_feature($feature, $conf, $storecfg, $snapname, $running);
2376
2377         return {
2378             hasFeature => $hasFeature,
2379             nodes => [ keys %$nodelist ],
2380         };
2381     }});
2382
2383 __PACKAGE__->register_method({
2384     name => 'clone_vm',
2385     path => '{vmid}/clone',
2386     method => 'POST',
2387     protected => 1,
2388     proxyto => 'node',
2389     description => "Create a copy of virtual machine/template.",
2390     permissions => {
2391         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2392             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2393             "'Datastore.AllocateSpace' on any used storage.",
2394         check =>
2395         [ 'and',
2396           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2397           [ 'or',
2398             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2399             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2400           ],
2401         ]
2402     },
2403     parameters => {
2404         additionalProperties => 0,
2405         properties => {
2406             node => get_standard_option('pve-node'),
2407             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2408             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
2409             name => {
2410                 optional => 1,
2411                 type => 'string', format => 'dns-name',
2412                 description => "Set a name for the new VM.",
2413             },
2414             description => {
2415                 optional => 1,
2416                 type => 'string',
2417                 description => "Description for the new VM.",
2418             },
2419             pool => {
2420                 optional => 1,
2421                 type => 'string', format => 'pve-poolid',
2422                 description => "Add the new VM to the specified pool.",
2423             },
2424             snapname => get_standard_option('pve-snapshot-name', {
2425                 optional => 1,
2426             }),
2427             storage => get_standard_option('pve-storage-id', {
2428                 description => "Target storage for full clone.",
2429                 requires => 'full',
2430                 optional => 1,
2431             }),
2432             'format' => {
2433                 description => "Target format for file storage.",
2434                 requires => 'full',
2435                 type => 'string',
2436                 optional => 1,
2437                 enum => [ 'raw', 'qcow2', 'vmdk'],
2438             },
2439             full => {
2440                 optional => 1,
2441                 type => 'boolean',
2442                 description => "Create a full copy of all disk. This is always done when " .
2443                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2444                 default => 0,
2445             },
2446             target => get_standard_option('pve-node', {
2447                 description => "Target node. Only allowed if the original VM is on shared storage.",
2448                 optional => 1,
2449             }),
2450         },
2451     },
2452     returns => {
2453         type => 'string',
2454     },
2455     code => sub {
2456         my ($param) = @_;
2457
2458         my $rpcenv = PVE::RPCEnvironment::get();
2459
2460         my $authuser = $rpcenv->get_user();
2461
2462         my $node = extract_param($param, 'node');
2463
2464         my $vmid = extract_param($param, 'vmid');
2465
2466         my $newid = extract_param($param, 'newid');
2467
2468         my $pool = extract_param($param, 'pool');
2469
2470         if (defined($pool)) {
2471             $rpcenv->check_pool_exist($pool);
2472         }
2473
2474         my $snapname = extract_param($param, 'snapname');
2475
2476         my $storage = extract_param($param, 'storage');
2477
2478         my $format = extract_param($param, 'format');
2479
2480         my $target = extract_param($param, 'target');
2481
2482         my $localnode = PVE::INotify::nodename();
2483
2484         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2485
2486         PVE::Cluster::check_node_exists($target) if $target;
2487
2488         my $storecfg = PVE::Storage::config();
2489
2490         if ($storage) {
2491             # check if storage is enabled on local node
2492             PVE::Storage::storage_check_enabled($storecfg, $storage);
2493             if ($target) {
2494                 # check if storage is available on target node
2495                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2496                 # clone only works if target storage is shared
2497                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2498                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2499             }
2500         }
2501
2502         PVE::Cluster::check_cfs_quorum();
2503
2504         my $running = PVE::QemuServer::check_running($vmid) || 0;
2505
2506         # exclusive lock if VM is running - else shared lock is enough;
2507         my $shared_lock = $running ? 0 : 1;
2508
2509         my $clonefn = sub {
2510
2511             # do all tests after lock
2512             # we also try to do all tests before we fork the worker
2513
2514             my $conf = PVE::QemuConfig->load_config($vmid);
2515
2516             PVE::QemuConfig->check_lock($conf);
2517
2518             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2519
2520             die "unexpected state change\n" if $verify_running != $running;
2521
2522             die "snapshot '$snapname' does not exist\n"
2523                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2524
2525             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2526
2527             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2528
2529             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2530
2531             my $conffile = PVE::QemuConfig->config_file($newid);
2532
2533             die "unable to create VM $newid: config file already exists\n"
2534                 if -f $conffile;
2535
2536             my $newconf = { lock => 'clone' };
2537             my $drives = {};
2538             my $fullclone = {};
2539             my $vollist = [];
2540
2541             foreach my $opt (keys %$oldconf) {
2542                 my $value = $oldconf->{$opt};
2543
2544                 # do not copy snapshot related info
2545                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2546                     $opt eq 'vmstate' || $opt eq 'snapstate';
2547
2548                 # no need to copy unused images, because VMID(owner) changes anyways
2549                 next if $opt =~ m/^unused\d+$/;
2550
2551                 # always change MAC! address
2552                 if ($opt =~ m/^net(\d+)$/) {
2553                     my $net = PVE::QemuServer::parse_net($value);
2554                     my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
2555                     $net->{macaddr} =  PVE::Tools::random_ether_addr($dc->{mac_prefix});
2556                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2557                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
2558                     my $drive = PVE::QemuServer::parse_drive($opt, $value);
2559                     die "unable to parse drive options for '$opt'\n" if !$drive;
2560                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
2561                         $newconf->{$opt} = $value; # simply copy configuration
2562                     } else {
2563                         if ($param->{full}) {
2564                             die "Full clone feature is not supported for drive '$opt'\n"
2565                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2566                             $fullclone->{$opt} = 1;
2567                         } else {
2568                             # not full means clone instead of copy
2569                             die "Linked clone feature is not supported for drive '$opt'\n"
2570                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $drive->{file}, $snapname, $running);
2571                         }
2572                         $drives->{$opt} = $drive;
2573                         push @$vollist, $drive->{file};
2574                     }
2575                 } else {
2576                     # copy everything else
2577                     $newconf->{$opt} = $value;
2578                 }
2579             }
2580
2581             # auto generate a new uuid
2582             my ($uuid, $uuid_str);
2583             UUID::generate($uuid);
2584             UUID::unparse($uuid, $uuid_str);
2585             my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
2586             $smbios1->{uuid} = $uuid_str;
2587             $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
2588
2589             delete $newconf->{template};
2590
2591             if ($param->{name}) {
2592                 $newconf->{name} = $param->{name};
2593             } else {
2594                 if ($oldconf->{name}) {
2595                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2596                 } else {
2597                     $newconf->{name} = "Copy-of-VM-$vmid";
2598                 }
2599             }
2600
2601             if ($param->{description}) {
2602                 $newconf->{description} = $param->{description};
2603             }
2604
2605             # create empty/temp config - this fails if VM already exists on other node
2606             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2607
2608             my $realcmd = sub {
2609                 my $upid = shift;
2610
2611                 my $newvollist = [];
2612                 my $jobs = {};
2613
2614                 eval {
2615                     local $SIG{INT} =
2616                         local $SIG{TERM} =
2617                         local $SIG{QUIT} =
2618                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2619
2620                     PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
2621
2622                     my $total_jobs = scalar(keys %{$drives});
2623                     my $i = 1;
2624
2625                     foreach my $opt (keys %$drives) {
2626                         my $drive = $drives->{$opt};
2627                         my $skipcomplete = ($total_jobs != $i); # finish after last drive
2628
2629                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2630                                                                    $newid, $storage, $format, $fullclone->{$opt}, $newvollist,
2631                                                                    $jobs, $skipcomplete, $oldconf->{agent});
2632
2633                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2634
2635                         PVE::QemuConfig->write_config($newid, $newconf);
2636                         $i++;
2637                     }
2638
2639                     delete $newconf->{lock};
2640                     PVE::QemuConfig->write_config($newid, $newconf);
2641
2642                     if ($target) {
2643                         # always deactivate volumes - avoid lvm LVs to be active on several nodes
2644                         PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
2645                         PVE::Storage::deactivate_volumes($storecfg, $newvollist);
2646
2647                         my $newconffile = PVE::QemuConfig->config_file($newid, $target);
2648                         die "Failed to move config to node '$target' - rename failed: $!\n"
2649                             if !rename($conffile, $newconffile);
2650                     }
2651
2652                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2653                 };
2654                 if (my $err = $@) {
2655                     unlink $conffile;
2656
2657                     eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
2658
2659                     sleep 1; # some storage like rbd need to wait before release volume - really?
2660
2661                     foreach my $volid (@$newvollist) {
2662                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2663                         warn $@ if $@;
2664                     }
2665                     die "clone failed: $err";
2666                 }
2667
2668                 return;
2669             };
2670
2671             PVE::Firewall::clone_vmfw_conf($vmid, $newid);
2672
2673             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2674         };
2675
2676         return PVE::QemuConfig->lock_config_mode($vmid, 1, $shared_lock, sub {
2677             # Aquire exclusive lock lock for $newid
2678             return PVE::QemuConfig->lock_config_full($newid, 1, $clonefn);
2679         });
2680
2681     }});
2682
2683 __PACKAGE__->register_method({
2684     name => 'move_vm_disk',
2685     path => '{vmid}/move_disk',
2686     method => 'POST',
2687     protected => 1,
2688     proxyto => 'node',
2689     description => "Move volume to different storage.",
2690     permissions => {
2691         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, and 'Datastore.AllocateSpace' permissions on the storage.",
2692         check => [ 'and',
2693                    ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2694                    ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2695             ],
2696     },
2697     parameters => {
2698         additionalProperties => 0,
2699         properties => {
2700             node => get_standard_option('pve-node'),
2701             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2702             disk => {
2703                 type => 'string',
2704                 description => "The disk you want to move.",
2705                 enum => [ PVE::QemuServer::valid_drive_names() ],
2706             },
2707             storage => get_standard_option('pve-storage-id', {
2708                 description => "Target storage.",
2709                 completion => \&PVE::QemuServer::complete_storage,
2710             }),
2711             'format' => {
2712                 type => 'string',
2713                 description => "Target Format.",
2714                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2715                 optional => 1,
2716             },
2717             delete => {
2718                 type => 'boolean',
2719                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2720                 optional => 1,
2721                 default => 0,
2722             },
2723             digest => {
2724                 type => 'string',
2725                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2726                 maxLength => 40,
2727                 optional => 1,
2728             },
2729         },
2730     },
2731     returns => {
2732         type => 'string',
2733         description => "the task ID.",
2734     },
2735     code => sub {
2736         my ($param) = @_;
2737
2738         my $rpcenv = PVE::RPCEnvironment::get();
2739
2740         my $authuser = $rpcenv->get_user();
2741
2742         my $node = extract_param($param, 'node');
2743
2744         my $vmid = extract_param($param, 'vmid');
2745
2746         my $digest = extract_param($param, 'digest');
2747
2748         my $disk = extract_param($param, 'disk');
2749
2750         my $storeid = extract_param($param, 'storage');
2751
2752         my $format = extract_param($param, 'format');
2753
2754         my $storecfg = PVE::Storage::config();
2755
2756         my $updatefn =  sub {
2757
2758             my $conf = PVE::QemuConfig->load_config($vmid);
2759
2760             PVE::QemuConfig->check_lock($conf);
2761
2762             die "checksum missmatch (file change by other user?)\n"
2763                 if $digest && $digest ne $conf->{digest};
2764
2765             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2766
2767             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2768
2769             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2770
2771             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2772
2773             my $oldfmt;
2774             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2775             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2776                 $oldfmt = $1;
2777             }
2778
2779             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2780                 (!$format || !$oldfmt || $oldfmt eq $format);
2781
2782             # this only checks snapshots because $disk is passed!
2783             my $snapshotted = PVE::QemuServer::is_volume_in_use($storecfg, $conf, $disk, $old_volid);
2784             die "you can't move a disk with snapshots and delete the source\n"
2785                 if $snapshotted && $param->{delete};
2786
2787             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2788
2789             my $running = PVE::QemuServer::check_running($vmid);
2790
2791             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2792
2793             my $realcmd = sub {
2794
2795                 my $newvollist = [];
2796
2797                 eval {
2798                     local $SIG{INT} =
2799                         local $SIG{TERM} =
2800                         local $SIG{QUIT} =
2801                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2802
2803                     warn "moving disk with snapshots, snapshots will not be moved!\n"
2804                         if $snapshotted;
2805
2806                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2807                                                                $vmid, $storeid, $format, 1, $newvollist);
2808
2809                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2810
2811                     PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
2812
2813                     # convert moved disk to base if part of template
2814                     PVE::QemuServer::template_create($vmid, $conf, $disk)
2815                         if PVE::QemuConfig->is_template($conf);
2816
2817                     PVE::QemuConfig->write_config($vmid, $conf);
2818
2819                     eval {
2820                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
2821                         PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
2822                             if !$running;
2823                     };
2824                     warn $@ if $@;
2825                 };
2826                 if (my $err = $@) {
2827
2828                    foreach my $volid (@$newvollist) {
2829                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2830                         warn $@ if $@;
2831                     }
2832                     die "storage migration failed: $err";
2833                 }
2834
2835                 if ($param->{delete}) {
2836                     eval {
2837                         PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
2838                         PVE::Storage::vdisk_free($storecfg, $old_volid);
2839                     };
2840                     warn $@ if $@;
2841                 }
2842             };
2843
2844             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2845         };
2846
2847         return PVE::QemuConfig->lock_config($vmid, $updatefn);
2848     }});
2849
2850 __PACKAGE__->register_method({
2851     name => 'migrate_vm',
2852     path => '{vmid}/migrate',
2853     method => 'POST',
2854     protected => 1,
2855     proxyto => 'node',
2856     description => "Migrate virtual machine. Creates a new migration task.",
2857     permissions => {
2858         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2859     },
2860     parameters => {
2861         additionalProperties => 0,
2862         properties => {
2863             node => get_standard_option('pve-node'),
2864             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2865             target => get_standard_option('pve-node', {
2866                 description => "Target node.",
2867                 completion =>  \&PVE::Cluster::complete_migration_target,
2868             }),
2869             online => {
2870                 type => 'boolean',
2871                 description => "Use online/live migration.",
2872                 optional => 1,
2873             },
2874             force => {
2875                 type => 'boolean',
2876                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2877                 optional => 1,
2878             },
2879             migration_type => {
2880                 type => 'string',
2881                 enum => ['secure', 'insecure'],
2882                 description => "Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance.",
2883                 optional => 1,
2884             },
2885             migration_network => {
2886                 type => 'string', format => 'CIDR',
2887                 description => "CIDR of the (sub) network that is used for migration.",
2888                 optional => 1,
2889             },
2890             "with-local-disks" => {
2891                 type => 'boolean',
2892                 description => "Enable live storage migration for local disk",
2893                 optional => 1,
2894             },
2895             targetstorage => get_standard_option('pve-storage-id', {
2896                 description => "Default target storage.",
2897                 optional => 1,
2898                 completion => \&PVE::QemuServer::complete_storage,
2899             }),
2900         },
2901     },
2902     returns => {
2903         type => 'string',
2904         description => "the task ID.",
2905     },
2906     code => sub {
2907         my ($param) = @_;
2908
2909         my $rpcenv = PVE::RPCEnvironment::get();
2910
2911         my $authuser = $rpcenv->get_user();
2912
2913         my $target = extract_param($param, 'target');
2914
2915         my $localnode = PVE::INotify::nodename();
2916         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2917
2918         PVE::Cluster::check_cfs_quorum();
2919
2920         PVE::Cluster::check_node_exists($target);
2921
2922         my $targetip = PVE::Cluster::remote_node_ip($target);
2923
2924         my $vmid = extract_param($param, 'vmid');
2925
2926         raise_param_exc({ targetstorage => "Live storage migration can only be done online." })
2927             if !$param->{online} && $param->{targetstorage};
2928
2929         raise_param_exc({ force => "Only root may use this option." })
2930             if $param->{force} && $authuser ne 'root@pam';
2931
2932         raise_param_exc({ migration_type => "Only root may use this option." })
2933             if $param->{migration_type} && $authuser ne 'root@pam';
2934
2935         # allow root only until better network permissions are available
2936         raise_param_exc({ migration_network => "Only root may use this option." })
2937             if $param->{migration_network} && $authuser ne 'root@pam';
2938
2939         # test if VM exists
2940         my $conf = PVE::QemuConfig->load_config($vmid);
2941
2942         # try to detect errors early
2943
2944         PVE::QemuConfig->check_lock($conf);
2945
2946         if (PVE::QemuServer::check_running($vmid)) {
2947             die "cant migrate running VM without --online\n"
2948                 if !$param->{online};
2949         }
2950
2951         my $storecfg = PVE::Storage::config();
2952
2953         if( $param->{targetstorage}) {
2954             PVE::Storage::storage_check_node($storecfg, $param->{targetstorage}, $target);
2955         } else {
2956             PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2957         }
2958
2959         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2960
2961             my $hacmd = sub {
2962                 my $upid = shift;
2963
2964                 my $service = "vm:$vmid";
2965
2966                 my $cmd = ['ha-manager', 'migrate', $service, $target];
2967
2968                 print "Requesting HA migration for VM $vmid to node $target\n";
2969
2970                 PVE::Tools::run_command($cmd);
2971
2972                 return;
2973             };
2974
2975             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2976
2977         } else {
2978
2979             my $realcmd = sub {
2980                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2981             };
2982
2983             my $worker = sub {
2984                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
2985             };
2986
2987             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $worker);
2988         }
2989
2990     }});
2991
2992 __PACKAGE__->register_method({
2993     name => 'monitor',
2994     path => '{vmid}/monitor',
2995     method => 'POST',
2996     protected => 1,
2997     proxyto => 'node',
2998     description => "Execute Qemu monitor commands.",
2999     permissions => {
3000         description => "Sys.Modify is required for (sub)commands which are not read-only ('info *' and 'help')",
3001         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
3002     },
3003     parameters => {
3004         additionalProperties => 0,
3005         properties => {
3006             node => get_standard_option('pve-node'),
3007             vmid => get_standard_option('pve-vmid'),
3008             command => {
3009                 type => 'string',
3010                 description => "The monitor command.",
3011             }
3012         },
3013     },
3014     returns => { type => 'string'},
3015     code => sub {
3016         my ($param) = @_;
3017
3018         my $rpcenv = PVE::RPCEnvironment::get();
3019         my $authuser = $rpcenv->get_user();
3020
3021         my $is_ro = sub {
3022             my $command = shift;
3023             return $command =~ m/^\s*info(\s+|$)/
3024                 || $command =~ m/^\s*help\s*$/;
3025         };
3026
3027         $rpcenv->check_full($authuser, "/", ['Sys.Modify'])
3028             if !&$is_ro($param->{command});
3029
3030         my $vmid = $param->{vmid};
3031
3032         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3033
3034         my $res = '';
3035         eval {
3036             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
3037         };
3038         $res = "ERROR: $@" if $@;
3039
3040         return $res;
3041     }});
3042
3043 my $guest_agent_commands = [
3044     'ping',
3045     'get-time',
3046     'info',
3047     'fsfreeze-status',
3048     'fsfreeze-freeze',
3049     'fsfreeze-thaw',
3050     'fstrim',
3051     'network-get-interfaces',
3052     'get-vcpus',
3053     'get-fsinfo',
3054     'get-memory-blocks',
3055     'get-memory-block-info',
3056     'suspend-hybrid',
3057     'suspend-ram',
3058     'suspend-disk',
3059     'shutdown',
3060     ];
3061
3062 __PACKAGE__->register_method({
3063     name => 'agent',
3064     path => '{vmid}/agent',
3065     method => 'POST',
3066     protected => 1,
3067     proxyto => 'node',
3068     description => "Execute Qemu Guest Agent commands.",
3069     permissions => {
3070         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
3071     },
3072     parameters => {
3073         additionalProperties => 0,
3074         properties => {
3075             node => get_standard_option('pve-node'),
3076             vmid => get_standard_option('pve-vmid', {
3077                    completion => \&PVE::QemuServer::complete_vmid_running }),
3078             command => {
3079                 type => 'string',
3080                 description => "The QGA command.",
3081                 enum => $guest_agent_commands,
3082             },
3083         },
3084     },
3085     returns => {
3086         type => 'object',
3087         description => "Returns an object with a single `result` property. The type of that
3088 property depends on the executed command.",
3089     },
3090     code => sub {
3091         my ($param) = @_;
3092
3093         my $vmid = $param->{vmid};
3094
3095         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3096
3097         die "No Qemu Guest Agent\n" if !defined($conf->{agent});
3098         die "VM $vmid is not running\n" if !PVE::QemuServer::check_running($vmid);
3099
3100         my $cmd = $param->{command};
3101
3102         my $res = PVE::QemuServer::vm_mon_cmd($vmid, "guest-$cmd");
3103
3104         return { result => $res };
3105     }});
3106
3107 __PACKAGE__->register_method({
3108     name => 'resize_vm',
3109     path => '{vmid}/resize',
3110     method => 'PUT',
3111     protected => 1,
3112     proxyto => 'node',
3113     description => "Extend volume size.",
3114     permissions => {
3115         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
3116     },
3117     parameters => {
3118         additionalProperties => 0,
3119         properties => {
3120             node => get_standard_option('pve-node'),
3121             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3122             skiplock => get_standard_option('skiplock'),
3123             disk => {
3124                 type => 'string',
3125                 description => "The disk you want to resize.",
3126                 enum => [PVE::QemuServer::valid_drive_names()],
3127             },
3128             size => {
3129                 type => 'string',
3130                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
3131                 description => "The new size. With the `+` sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
3132             },
3133             digest => {
3134                 type => 'string',
3135                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
3136                 maxLength => 40,
3137                 optional => 1,
3138             },
3139         },
3140     },
3141     returns => { type => 'null'},
3142     code => sub {
3143         my ($param) = @_;
3144
3145         my $rpcenv = PVE::RPCEnvironment::get();
3146
3147         my $authuser = $rpcenv->get_user();
3148
3149         my $node = extract_param($param, 'node');
3150
3151         my $vmid = extract_param($param, 'vmid');
3152
3153         my $digest = extract_param($param, 'digest');
3154
3155         my $disk = extract_param($param, 'disk');
3156
3157         my $sizestr = extract_param($param, 'size');
3158
3159         my $skiplock = extract_param($param, 'skiplock');
3160         raise_param_exc({ skiplock => "Only root may use this option." })
3161             if $skiplock && $authuser ne 'root@pam';
3162
3163         my $storecfg = PVE::Storage::config();
3164
3165         my $updatefn =  sub {
3166
3167             my $conf = PVE::QemuConfig->load_config($vmid);
3168
3169             die "checksum missmatch (file change by other user?)\n"
3170                 if $digest && $digest ne $conf->{digest};
3171             PVE::QemuConfig->check_lock($conf) if !$skiplock;
3172
3173             die "disk '$disk' does not exist\n" if !$conf->{$disk};
3174
3175             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
3176
3177             my (undef, undef, undef, undef, undef, undef, $format) =
3178                 PVE::Storage::parse_volname($storecfg, $drive->{file});
3179
3180             die "can't resize volume: $disk if snapshot exists\n"
3181                 if %{$conf->{snapshots}} && $format eq 'qcow2';
3182
3183             my $volid = $drive->{file};
3184
3185             die "disk '$disk' has no associated volume\n" if !$volid;
3186
3187             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
3188
3189             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
3190
3191             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
3192
3193             PVE::Storage::activate_volumes($storecfg, [$volid]);
3194             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
3195
3196             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
3197             my ($ext, $newsize, $unit) = ($1, $2, $4);
3198             if ($unit) {
3199                 if ($unit eq 'K') {
3200                     $newsize = $newsize * 1024;
3201                 } elsif ($unit eq 'M') {
3202                     $newsize = $newsize * 1024 * 1024;
3203                 } elsif ($unit eq 'G') {
3204                     $newsize = $newsize * 1024 * 1024 * 1024;
3205                 } elsif ($unit eq 'T') {
3206                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
3207                 }
3208             }
3209             $newsize += $size if $ext;
3210             $newsize = int($newsize);
3211
3212             die "shrinking disks is not supported\n" if $newsize < $size;
3213
3214             return if $size == $newsize;
3215
3216             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
3217
3218             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
3219
3220             $drive->{size} = $newsize;
3221             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
3222
3223             PVE::QemuConfig->write_config($vmid, $conf);
3224         };
3225
3226         PVE::QemuConfig->lock_config($vmid, $updatefn);
3227         return undef;
3228     }});
3229
3230 __PACKAGE__->register_method({
3231     name => 'snapshot_list',
3232     path => '{vmid}/snapshot',
3233     method => 'GET',
3234     description => "List all snapshots.",
3235     permissions => {
3236         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
3237     },
3238     proxyto => 'node',
3239     protected => 1, # qemu pid files are only readable by root
3240     parameters => {
3241         additionalProperties => 0,
3242         properties => {
3243             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3244             node => get_standard_option('pve-node'),
3245         },
3246     },
3247     returns => {
3248         type => 'array',
3249         items => {
3250             type => "object",
3251             properties => {},
3252         },
3253         links => [ { rel => 'child', href => "{name}" } ],
3254     },
3255     code => sub {
3256         my ($param) = @_;
3257
3258         my $vmid = $param->{vmid};
3259
3260         my $conf = PVE::QemuConfig->load_config($vmid);
3261         my $snaphash = $conf->{snapshots} || {};
3262
3263         my $res = [];
3264
3265         foreach my $name (keys %$snaphash) {
3266             my $d = $snaphash->{$name};
3267             my $item = {
3268                 name => $name,
3269                 snaptime => $d->{snaptime} || 0,
3270                 vmstate => $d->{vmstate} ? 1 : 0,
3271                 description => $d->{description} || '',
3272             };
3273             $item->{parent} = $d->{parent} if $d->{parent};
3274             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
3275             push @$res, $item;
3276         }
3277
3278         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
3279         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
3280         $current->{parent} = $conf->{parent} if $conf->{parent};
3281
3282         push @$res, $current;
3283
3284         return $res;
3285     }});
3286
3287 __PACKAGE__->register_method({
3288     name => 'snapshot',
3289     path => '{vmid}/snapshot',
3290     method => 'POST',
3291     protected => 1,
3292     proxyto => 'node',
3293     description => "Snapshot a VM.",
3294     permissions => {
3295         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3296     },
3297     parameters => {
3298         additionalProperties => 0,
3299         properties => {
3300             node => get_standard_option('pve-node'),
3301             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3302             snapname => get_standard_option('pve-snapshot-name'),
3303             vmstate => {
3304                 optional => 1,
3305                 type => 'boolean',
3306                 description => "Save the vmstate",
3307             },
3308             description => {
3309                 optional => 1,
3310                 type => 'string',
3311                 description => "A textual description or comment.",
3312             },
3313         },
3314     },
3315     returns => {
3316         type => 'string',
3317         description => "the task ID.",
3318     },
3319     code => sub {
3320         my ($param) = @_;
3321
3322         my $rpcenv = PVE::RPCEnvironment::get();
3323
3324         my $authuser = $rpcenv->get_user();
3325
3326         my $node = extract_param($param, 'node');
3327
3328         my $vmid = extract_param($param, 'vmid');
3329
3330         my $snapname = extract_param($param, 'snapname');
3331
3332         die "unable to use snapshot name 'current' (reserved name)\n"
3333             if $snapname eq 'current';
3334
3335         my $realcmd = sub {
3336             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
3337             PVE::QemuConfig->snapshot_create($vmid, $snapname, $param->{vmstate},
3338                                              $param->{description});
3339         };
3340
3341         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
3342     }});
3343
3344 __PACKAGE__->register_method({
3345     name => 'snapshot_cmd_idx',
3346     path => '{vmid}/snapshot/{snapname}',
3347     description => '',
3348     method => 'GET',
3349     permissions => {
3350         user => 'all',
3351     },
3352     parameters => {
3353         additionalProperties => 0,
3354         properties => {
3355             vmid => get_standard_option('pve-vmid'),
3356             node => get_standard_option('pve-node'),
3357             snapname => get_standard_option('pve-snapshot-name'),
3358         },
3359     },
3360     returns => {
3361         type => 'array',
3362         items => {
3363             type => "object",
3364             properties => {},
3365         },
3366         links => [ { rel => 'child', href => "{cmd}" } ],
3367     },
3368     code => sub {
3369         my ($param) = @_;
3370
3371         my $res = [];
3372
3373         push @$res, { cmd => 'rollback' };
3374         push @$res, { cmd => 'config' };
3375
3376         return $res;
3377     }});
3378
3379 __PACKAGE__->register_method({
3380     name => 'update_snapshot_config',
3381     path => '{vmid}/snapshot/{snapname}/config',
3382     method => 'PUT',
3383     protected => 1,
3384     proxyto => 'node',
3385     description => "Update snapshot metadata.",
3386     permissions => {
3387         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3388     },
3389     parameters => {
3390         additionalProperties => 0,
3391         properties => {
3392             node => get_standard_option('pve-node'),
3393             vmid => get_standard_option('pve-vmid'),
3394             snapname => get_standard_option('pve-snapshot-name'),
3395             description => {
3396                 optional => 1,
3397                 type => 'string',
3398                 description => "A textual description or comment.",
3399             },
3400         },
3401     },
3402     returns => { type => 'null' },
3403     code => sub {
3404         my ($param) = @_;
3405
3406         my $rpcenv = PVE::RPCEnvironment::get();
3407
3408         my $authuser = $rpcenv->get_user();
3409
3410         my $vmid = extract_param($param, 'vmid');
3411
3412         my $snapname = extract_param($param, 'snapname');
3413
3414         return undef if !defined($param->{description});
3415
3416         my $updatefn =  sub {
3417
3418             my $conf = PVE::QemuConfig->load_config($vmid);
3419
3420             PVE::QemuConfig->check_lock($conf);
3421
3422             my $snap = $conf->{snapshots}->{$snapname};
3423
3424             die "snapshot '$snapname' does not exist\n" if !defined($snap);
3425
3426             $snap->{description} = $param->{description} if defined($param->{description});
3427
3428              PVE::QemuConfig->write_config($vmid, $conf);
3429         };
3430
3431         PVE::QemuConfig->lock_config($vmid, $updatefn);
3432
3433         return undef;
3434     }});
3435
3436 __PACKAGE__->register_method({
3437     name => 'get_snapshot_config',
3438     path => '{vmid}/snapshot/{snapname}/config',
3439     method => 'GET',
3440     proxyto => 'node',
3441     description => "Get snapshot configuration",
3442     permissions => {
3443         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3444     },
3445     parameters => {
3446         additionalProperties => 0,
3447         properties => {
3448             node => get_standard_option('pve-node'),
3449             vmid => get_standard_option('pve-vmid'),
3450             snapname => get_standard_option('pve-snapshot-name'),
3451         },
3452     },
3453     returns => { type => "object" },
3454     code => sub {
3455         my ($param) = @_;
3456
3457         my $rpcenv = PVE::RPCEnvironment::get();
3458
3459         my $authuser = $rpcenv->get_user();
3460
3461         my $vmid = extract_param($param, 'vmid');
3462
3463         my $snapname = extract_param($param, 'snapname');
3464
3465         my $conf = PVE::QemuConfig->load_config($vmid);
3466
3467         my $snap = $conf->{snapshots}->{$snapname};
3468
3469         die "snapshot '$snapname' does not exist\n" if !defined($snap);
3470
3471         return $snap;
3472     }});
3473
3474 __PACKAGE__->register_method({
3475     name => 'rollback',
3476     path => '{vmid}/snapshot/{snapname}/rollback',
3477     method => 'POST',
3478     protected => 1,
3479     proxyto => 'node',
3480     description => "Rollback VM state to specified snapshot.",
3481     permissions => {
3482         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3483     },
3484     parameters => {
3485         additionalProperties => 0,
3486         properties => {
3487             node => get_standard_option('pve-node'),
3488             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3489             snapname => get_standard_option('pve-snapshot-name'),
3490         },
3491     },
3492     returns => {
3493         type => 'string',
3494         description => "the task ID.",
3495     },
3496     code => sub {
3497         my ($param) = @_;
3498
3499         my $rpcenv = PVE::RPCEnvironment::get();
3500
3501         my $authuser = $rpcenv->get_user();
3502
3503         my $node = extract_param($param, 'node');
3504
3505         my $vmid = extract_param($param, 'vmid');
3506
3507         my $snapname = extract_param($param, 'snapname');
3508
3509         my $realcmd = sub {
3510             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
3511             PVE::QemuConfig->snapshot_rollback($vmid, $snapname);
3512         };
3513
3514         my $worker = sub {
3515             # hold migration lock, this makes sure that nobody create replication snapshots
3516             return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
3517         };
3518
3519         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $worker);
3520     }});
3521
3522 __PACKAGE__->register_method({
3523     name => 'delsnapshot',
3524     path => '{vmid}/snapshot/{snapname}',
3525     method => 'DELETE',
3526     protected => 1,
3527     proxyto => 'node',
3528     description => "Delete a VM snapshot.",
3529     permissions => {
3530         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3531     },
3532     parameters => {
3533         additionalProperties => 0,
3534         properties => {
3535             node => get_standard_option('pve-node'),
3536             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3537             snapname => get_standard_option('pve-snapshot-name'),
3538             force => {
3539                 optional => 1,
3540                 type => 'boolean',
3541                 description => "For removal from config file, even if removing disk snapshots fails.",
3542             },
3543         },
3544     },
3545     returns => {
3546         type => 'string',
3547         description => "the task ID.",
3548     },
3549     code => sub {
3550         my ($param) = @_;
3551
3552         my $rpcenv = PVE::RPCEnvironment::get();
3553
3554         my $authuser = $rpcenv->get_user();
3555
3556         my $node = extract_param($param, 'node');
3557
3558         my $vmid = extract_param($param, 'vmid');
3559
3560         my $snapname = extract_param($param, 'snapname');
3561
3562         my $realcmd = sub {
3563             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
3564             PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
3565         };
3566
3567         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
3568     }});
3569
3570 __PACKAGE__->register_method({
3571     name => 'template',
3572     path => '{vmid}/template',
3573     method => 'POST',
3574     protected => 1,
3575     proxyto => 'node',
3576     description => "Create a Template.",
3577     permissions => {
3578         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3579         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3580     },
3581     parameters => {
3582         additionalProperties => 0,
3583         properties => {
3584             node => get_standard_option('pve-node'),
3585             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
3586             disk => {
3587                 optional => 1,
3588                 type => 'string',
3589                 description => "If you want to convert only 1 disk to base image.",
3590                 enum => [PVE::QemuServer::valid_drive_names()],
3591             },
3592
3593         },
3594     },
3595     returns => { type => 'null'},
3596     code => sub {
3597         my ($param) = @_;
3598
3599         my $rpcenv = PVE::RPCEnvironment::get();
3600
3601         my $authuser = $rpcenv->get_user();
3602
3603         my $node = extract_param($param, 'node');
3604
3605         my $vmid = extract_param($param, 'vmid');
3606
3607         my $disk = extract_param($param, 'disk');
3608
3609         my $updatefn =  sub {
3610
3611             my $conf = PVE::QemuConfig->load_config($vmid);
3612
3613             PVE::QemuConfig->check_lock($conf);
3614
3615             die "unable to create template, because VM contains snapshots\n"
3616                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3617
3618             die "you can't convert a template to a template\n"
3619                 if PVE::QemuConfig->is_template($conf) && !$disk;
3620
3621             die "you can't convert a VM to template if VM is running\n"
3622                 if PVE::QemuServer::check_running($vmid);
3623
3624             my $realcmd = sub {
3625                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3626             };
3627
3628             $conf->{template} = 1;
3629             PVE::QemuConfig->write_config($vmid, $conf);
3630
3631             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3632         };
3633
3634         PVE::QemuConfig->lock_config($vmid, $updatefn);
3635         return undef;
3636     }});
3637
3638 1;