PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6 use Net::SSLeay;
   7 use UUID;
   8 use POSIX;
   9 use IO::Socket::IP;
  10
  11 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools qw(extract_param);
  14 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  15 use PVE::Storage;
  16 use PVE::JSONSchema qw(get_standard_option);
  17 use PVE::RESTHandler;
  18 use PVE::ReplicationConfig;
  19 use PVE::GuestHelpers;
  20 use PVE::QemuConfig;
  21 use PVE::QemuServer;
  22 use PVE::QemuMigrate;
  23 use PVE::RPCEnvironment;
  24 use PVE::AccessControl;
  25 use PVE::INotify;
  26 use PVE::Network;
  27 use PVE::Firewall;
  28 use PVE::API2::Firewall::VM;
  29
  30 BEGIN {
  31     if (!$ENV{PVE_GENERATING_DOCS}) {
  32         require PVE::HA::Env::PVE2;
  33         import PVE::HA::Env::PVE2;
  34         require PVE::HA::Config;
  35         import PVE::HA::Config;
  36     }
  37 }
  38
  39 use Data::Dumper; # fixme: remove
  40
  41 use base qw(PVE::RESTHandler);
  42
  43 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  44
  45 my $resolve_cdrom_alias = sub {
  46     my $param = shift;
  47
  48     if (my $value = $param->{cdrom}) {
  49         $value .= ",media=cdrom" if $value !~ m/media=/;
  50         $param->{ide2} = $value;
  51         delete $param->{cdrom};
  52     }
  53 };
  54
  55 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
  56 my $check_storage_access = sub {
  57    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  58
  59    PVE::QemuServer::foreach_drive($settings, sub {
  60         my ($ds, $drive) = @_;
  61
  62         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  63
  64         my $volid = $drive->{file};
  65
  66         if (!$volid || $volid eq 'none') {
  67             # nothing to check
  68         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  69             $rpcenv->check($authuser, "/", ['Sys.Console']);
  70         } elsif (!$isCDROM && ($volid =~ $NEW_DISK_RE)) {
  71             my ($storeid, $size) = ($2 || $default_storage, $3);
  72             die "no storage ID specified (and no default storage)\n" if !$storeid;
  73             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  74             my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
  75             raise_param_exc({ storage => "storage '$storeid' does not support vm images"})
  76                 if !$scfg->{content}->{images};
  77         } else {
  78             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
  79         }
  80     });
  81
  82    $rpcenv->check($authuser, "/storage/$settings->{vmstatestorage}", ['Datastore.AllocateSpace'])
  83        if defined($settings->{vmstatestorage});
  84 };
  85
  86 my $check_storage_access_clone = sub {
  87    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  88
  89    my $sharedvm = 1;
  90
  91    PVE::QemuServer::foreach_drive($conf, sub {
  92         my ($ds, $drive) = @_;
  93
  94         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  95
  96         my $volid = $drive->{file};
  97
  98         return if !$volid || $volid eq 'none';
  99
 100         if ($isCDROM) {
 101             if ($volid eq 'cdrom') {
 102                 $rpcenv->check($authuser, "/", ['Sys.Console']);
 103             } else {
 104                 # we simply allow access
 105                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 106                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 107                 $sharedvm = 0 if !$scfg->{shared};
 108
 109             }
 110         } else {
 111             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 112             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 113             $sharedvm = 0 if !$scfg->{shared};
 114
 115             $sid = $storage if $storage;
 116             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 117         }
 118     });
 119
 120    $rpcenv->check($authuser, "/storage/$conf->{vmstatestorage}", ['Datastore.AllocateSpace'])
 121        if defined($conf->{vmstatestorage});
 122
 123    return $sharedvm;
 124 };
 125
 126 # Note: $pool is only needed when creating a VM, because pool permissions
 127 # are automatically inherited if VM already exists inside a pool.
 128 my $create_disks = sub {
 129     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 130
 131     my $vollist = [];
 132
 133     my $res = {};
 134
 135     my $code = sub {
 136         my ($ds, $disk) = @_;
 137
 138         my $volid = $disk->{file};
 139
 140         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 141             delete $disk->{size};
 142             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 143         } elsif ($volid =~ $NEW_DISK_RE) {
 144             my ($storeid, $size) = ($2 || $default_storage, $3);
 145             die "no storage ID specified (and no default storage)\n" if !$storeid;
 146             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 147             my $fmt = $disk->{format} || $defformat;
 148
 149             $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
 150
 151             my $volid;
 152             if ($ds eq 'efidisk0') {
 153                 ($volid, $size) = PVE::QemuServer::create_efidisk($storecfg, $storeid, $vmid, $fmt);
 154             } else {
 155                 $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
 156             }
 157             push @$vollist, $volid;
 158             $disk->{file} = $volid;
 159             $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
 160             delete $disk->{format}; # no longer needed
 161             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 162         } else {
 163
 164             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
 165
 166             my $volid_is_new = 1;
 167
 168             if ($conf->{$ds}) {
 169                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 170                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 171             }
 172
 173             if ($volid_is_new) {
 174
 175                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 176
 177                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 178
 179                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 180
 181                 die "volume $volid does not exists\n" if !$size;
 182
 183                 $disk->{size} = $size;
 184             }
 185
 186             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 187         }
 188     };
 189
 190     eval { PVE::QemuServer::foreach_drive($settings, $code); };
 191
 192     # free allocated images on error
 193     if (my $err = $@) {
 194         syslog('err', "VM $vmid creating disks failed");
 195         foreach my $volid (@$vollist) {
 196             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 197             warn $@ if $@;
 198         }
 199         die $err;
 200     }
 201
 202     # modify vm config if everything went well
 203     foreach my $ds (keys %$res) {
 204         $conf->{$ds} = $res->{$ds};
 205     }
 206
 207     return $vollist;
 208 };
 209
 210 my $cpuoptions = {
 211     'cores' => 1,
 212     'cpu' => 1,
 213     'cpulimit' => 1,
 214     'cpuunits' => 1,
 215     'numa' => 1,
 216     'smp' => 1,
 217     'sockets' => 1,
 218     'vcpus' => 1,
 219 };
 220
 221 my $memoryoptions = {
 222     'memory' => 1,
 223     'balloon' => 1,
 224     'shares' => 1,
 225 };
 226
 227 my $hwtypeoptions = {
 228     'acpi' => 1,
 229     'hotplug' => 1,
 230     'kvm' => 1,
 231     'machine' => 1,
 232     'scsihw' => 1,
 233     'smbios1' => 1,
 234     'tablet' => 1,
 235     'vga' => 1,
 236     'watchdog' => 1,
 237 };
 238
 239 my $generaloptions = {
 240     'agent' => 1,
 241     'autostart' => 1,
 242     'bios' => 1,
 243     'description' => 1,
 244     'keyboard' => 1,
 245     'localtime' => 1,
 246     'migrate_downtime' => 1,
 247     'migrate_speed' => 1,
 248     'name' => 1,
 249     'onboot' => 1,
 250     'ostype' => 1,
 251     'protection' => 1,
 252     'reboot' => 1,
 253     'startdate' => 1,
 254     'startup' => 1,
 255     'tdf' => 1,
 256     'template' => 1,
 257 };
 258
 259 my $vmpoweroptions = {
 260     'freeze' => 1,
 261 };
 262
 263 my $diskoptions = {
 264     'boot' => 1,
 265     'bootdisk' => 1,
 266     'vmstatestorage' => 1,
 267 };
 268
 269 my $check_vm_modify_config_perm = sub {
 270     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 271
 272     return 1 if $authuser eq 'root@pam';
 273
 274     foreach my $opt (@$key_list) {
 275         # disk checks need to be done somewhere else
 276         next if PVE::QemuServer::is_valid_drivename($opt);
 277         next if $opt eq 'cdrom';
 278         next if $opt =~ m/^unused\d+$/;
 279
 280         if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
 281             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 282         } elsif ($memoryoptions->{$opt}) {
 283             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 284         } elsif ($hwtypeoptions->{$opt}) {
 285             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 286         } elsif ($generaloptions->{$opt}) {
 287             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 288             # special case for startup since it changes host behaviour
 289             if ($opt eq 'startup') {
 290                 $rpcenv->check_full($authuser, "/", ['Sys.Modify']);
 291             }
 292         } elsif ($vmpoweroptions->{$opt}) {
 293             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
 294         } elsif ($diskoptions->{$opt}) {
 295             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 296         } elsif ($opt =~ m/^net\d+$/) {
 297             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 298         } else {
 299             # catches usb\d+, hostpci\d+, args, lock, etc.
 300             # new options will be checked here
 301             die "only root can set '$opt' config\n";
 302         }
 303     }
 304
 305     return 1;
 306 };
 307
 308 __PACKAGE__->register_method({
 309     name => 'vmlist',
 310     path => '',
 311     method => 'GET',
 312     description => "Virtual machine index (per node).",
 313     permissions => {
 314         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 315         user => 'all',
 316     },
 317     proxyto => 'node',
 318     protected => 1, # qemu pid files are only readable by root
 319     parameters => {
 320         additionalProperties => 0,
 321         properties => {
 322             node => get_standard_option('pve-node'),
 323             full => {
 324                 type => 'boolean',
 325                 optional => 1,
 326                 description => "Determine the full status of active VMs.",
 327             },
 328         },
 329     },
 330     returns => {
 331         type => 'array',
 332         items => {
 333             type => "object",
 334             properties => {},
 335         },
 336         links => [ { rel => 'child', href => "{vmid}" } ],
 337     },
 338     code => sub {
 339         my ($param) = @_;
 340
 341         my $rpcenv = PVE::RPCEnvironment::get();
 342         my $authuser = $rpcenv->get_user();
 343
 344         my $vmstatus = PVE::QemuServer::vmstatus(undef, $param->{full});
 345
 346         my $res = [];
 347         foreach my $vmid (keys %$vmstatus) {
 348             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 349
 350             my $data = $vmstatus->{$vmid};
 351             $data->{vmid} = int($vmid);
 352             push @$res, $data;
 353         }
 354
 355         return $res;
 356     }});
 357
 358
 359
 360 __PACKAGE__->register_method({
 361     name => 'create_vm',
 362     path => '',
 363     method => 'POST',
 364     description => "Create or restore a virtual machine.",
 365     permissions => {
 366         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 367             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 368             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 369         user => 'all', # check inside
 370     },
 371     protected => 1,
 372     proxyto => 'node',
 373     parameters => {
 374         additionalProperties => 0,
 375         properties => PVE::QemuServer::json_config_properties(
 376             {
 377                 node => get_standard_option('pve-node'),
 378                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 379                 archive => {
 380                     description => "The backup file.",
 381                     type => 'string',
 382                     optional => 1,
 383                     maxLength => 255,
 384                     completion => \&PVE::QemuServer::complete_backup_archives,
 385                 },
 386                 storage => get_standard_option('pve-storage-id', {
 387                     description => "Default storage.",
 388                     optional => 1,
 389                     completion => \&PVE::QemuServer::complete_storage,
 390                 }),
 391                 force => {
 392                     optional => 1,
 393                     type => 'boolean',
 394                     description => "Allow to overwrite existing VM.",
 395                     requires => 'archive',
 396                 },
 397                 unique => {
 398                     optional => 1,
 399                     type => 'boolean',
 400                     description => "Assign a unique random ethernet address.",
 401                     requires => 'archive',
 402                 },
 403                 pool => {
 404                     optional => 1,
 405                     type => 'string', format => 'pve-poolid',
 406                     description => "Add the VM to the specified pool.",
 407                 },
 408             }),
 409     },
 410     returns => {
 411         type => 'string',
 412     },
 413     code => sub {
 414         my ($param) = @_;
 415
 416         my $rpcenv = PVE::RPCEnvironment::get();
 417
 418         my $authuser = $rpcenv->get_user();
 419
 420         my $node = extract_param($param, 'node');
 421
 422         my $vmid = extract_param($param, 'vmid');
 423
 424         my $archive = extract_param($param, 'archive');
 425
 426         my $storage = extract_param($param, 'storage');
 427
 428         my $force = extract_param($param, 'force');
 429
 430         my $unique = extract_param($param, 'unique');
 431
 432         my $pool = extract_param($param, 'pool');
 433
 434         my $filename = PVE::QemuConfig->config_file($vmid);
 435
 436         my $storecfg = PVE::Storage::config();
 437
 438         PVE::Cluster::check_cfs_quorum();
 439
 440         if (defined($pool)) {
 441             $rpcenv->check_pool_exist($pool);
 442         }
 443
 444         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 445             if defined($storage);
 446
 447         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 448             # OK
 449         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 450             # OK
 451         } elsif ($archive && $force && (-f $filename) &&
 452                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 453             # OK: user has VM.Backup permissions, and want to restore an existing VM
 454         } else {
 455             raise_perm_exc();
 456         }
 457
 458         if (!$archive) {
 459             &$resolve_cdrom_alias($param);
 460
 461             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 462
 463             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 464
 465             foreach my $opt (keys %$param) {
 466                 if (PVE::QemuServer::is_valid_drivename($opt)) {
 467                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 468                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 469
 470                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 471                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 472                 }
 473             }
 474
 475             PVE::QemuServer::add_random_macs($param);
 476         } else {
 477             my $keystr = join(' ', keys %$param);
 478             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 479
 480             if ($archive eq '-') {
 481                 die "pipe requires cli environment\n"
 482                     if $rpcenv->{type} ne 'cli';
 483             } else {
 484                 PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
 485                 $archive = PVE::Storage::abs_filesystem_path($storecfg, $archive);
 486             }
 487         }
 488
 489         my $restorefn = sub {
 490             my $vmlist = PVE::Cluster::get_vmlist();
 491             if ($vmlist->{ids}->{$vmid}) {
 492                 my $current_node = $vmlist->{ids}->{$vmid}->{node};
 493                 if ($current_node eq $node) {
 494                     my $conf = PVE::QemuConfig->load_config($vmid);
 495
 496                     PVE::QemuConfig->check_protection($conf, "unable to restore VM $vmid");
 497
 498                     die "unable to restore vm $vmid - config file already exists\n"
 499                         if !$force;
 500
 501                     die "unable to restore vm $vmid - vm is running\n"
 502                         if PVE::QemuServer::check_running($vmid);
 503
 504                     die "unable to restore vm $vmid - vm is a template\n"
 505                         if PVE::QemuConfig->is_template($conf);
 506
 507                 } else {
 508                     die "unable to restore vm $vmid - already existing on cluster node '$current_node'\n";
 509                 }
 510             }
 511
 512             my $realcmd = sub {
 513                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 514                     storage => $storage,
 515                     pool => $pool,
 516                     unique => $unique });
 517
 518                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 519             };
 520
 521             # ensure no old replication state are exists
 522             PVE::ReplicationState::delete_guest_states($vmid);
 523
 524             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 525         };
 526
 527         my $createfn = sub {
 528
 529             # test after locking
 530             PVE::Cluster::check_vmid_unused($vmid);
 531
 532             # ensure no old replication state are exists
 533             PVE::ReplicationState::delete_guest_states($vmid);
 534
 535             my $realcmd = sub {
 536
 537                 my $vollist = [];
 538
 539                 my $conf = $param;
 540
 541                 eval {
 542
 543                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 544
 545                     if (!$conf->{bootdisk}) {
 546                         my $firstdisk = PVE::QemuServer::resolve_first_disk($conf);
 547                         $conf->{bootdisk} = $firstdisk if $firstdisk;
 548                     }
 549
 550                     # auto generate uuid if user did not specify smbios1 option
 551                     if (!$conf->{smbios1}) {
 552                         $conf->{smbios1} = PVE::QemuServer::generate_smbios1_uuid();
 553                     }
 554
 555                     PVE::QemuConfig->write_config($vmid, $conf);
 556
 557                 };
 558                 my $err = $@;
 559
 560                 if ($err) {
 561                     foreach my $volid (@$vollist) {
 562                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 563                         warn $@ if $@;
 564                     }
 565                     die "create failed - $err";
 566                 }
 567
 568                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 569             };
 570
 571             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 572         };
 573
 574         return PVE::QemuConfig->lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 575     }});
 576
 577 __PACKAGE__->register_method({
 578     name => 'vmdiridx',
 579     path => '{vmid}',
 580     method => 'GET',
 581     proxyto => 'node',
 582     description => "Directory index",
 583     permissions => {
 584         user => 'all',
 585     },
 586     parameters => {
 587         additionalProperties => 0,
 588         properties => {
 589             node => get_standard_option('pve-node'),
 590             vmid => get_standard_option('pve-vmid'),
 591         },
 592     },
 593     returns => {
 594         type => 'array',
 595         items => {
 596             type => "object",
 597             properties => {
 598                 subdir => { type => 'string' },
 599             },
 600         },
 601         links => [ { rel => 'child', href => "{subdir}" } ],
 602     },
 603     code => sub {
 604         my ($param) = @_;
 605
 606         my $res = [
 607             { subdir => 'config' },
 608             { subdir => 'pending' },
 609             { subdir => 'status' },
 610             { subdir => 'unlink' },
 611             { subdir => 'vncproxy' },
 612             { subdir => 'termproxy' },
 613             { subdir => 'migrate' },
 614             { subdir => 'resize' },
 615             { subdir => 'move' },
 616             { subdir => 'rrd' },
 617             { subdir => 'rrddata' },
 618             { subdir => 'monitor' },
 619             { subdir => 'agent' },
 620             { subdir => 'snapshot' },
 621             { subdir => 'spiceproxy' },
 622             { subdir => 'sendkey' },
 623             { subdir => 'firewall' },
 624             ];
 625
 626         return $res;
 627     }});
 628
 629 __PACKAGE__->register_method ({
 630     subclass => "PVE::API2::Firewall::VM",
 631     path => '{vmid}/firewall',
 632 });
 633
 634 __PACKAGE__->register_method({
 635     name => 'rrd',
 636     path => '{vmid}/rrd',
 637     method => 'GET',
 638     protected => 1, # fixme: can we avoid that?
 639     permissions => {
 640         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 641     },
 642     description => "Read VM RRD statistics (returns PNG)",
 643     parameters => {
 644         additionalProperties => 0,
 645         properties => {
 646             node => get_standard_option('pve-node'),
 647             vmid => get_standard_option('pve-vmid'),
 648             timeframe => {
 649                 description => "Specify the time frame you are interested in.",
 650                 type => 'string',
 651                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 652             },
 653             ds => {
 654                 description => "The list of datasources you want to display.",
 655                 type => 'string', format => 'pve-configid-list',
 656             },
 657             cf => {
 658                 description => "The RRD consolidation function",
 659                 type => 'string',
 660                 enum => [ 'AVERAGE', 'MAX' ],
 661                 optional => 1,
 662             },
 663         },
 664     },
 665     returns => {
 666         type => "object",
 667         properties => {
 668             filename => { type => 'string' },
 669         },
 670     },
 671     code => sub {
 672         my ($param) = @_;
 673
 674         return PVE::Cluster::create_rrd_graph(
 675             "pve2-vm/$param->{vmid}", $param->{timeframe},
 676             $param->{ds}, $param->{cf});
 677
 678     }});
 679
 680 __PACKAGE__->register_method({
 681     name => 'rrddata',
 682     path => '{vmid}/rrddata',
 683     method => 'GET',
 684     protected => 1, # fixme: can we avoid that?
 685     permissions => {
 686         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 687     },
 688     description => "Read VM RRD statistics",
 689     parameters => {
 690         additionalProperties => 0,
 691         properties => {
 692             node => get_standard_option('pve-node'),
 693             vmid => get_standard_option('pve-vmid'),
 694             timeframe => {
 695                 description => "Specify the time frame you are interested in.",
 696                 type => 'string',
 697                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 698             },
 699             cf => {
 700                 description => "The RRD consolidation function",
 701                 type => 'string',
 702                 enum => [ 'AVERAGE', 'MAX' ],
 703                 optional => 1,
 704             },
 705         },
 706     },
 707     returns => {
 708         type => "array",
 709         items => {
 710             type => "object",
 711             properties => {},
 712         },
 713     },
 714     code => sub {
 715         my ($param) = @_;
 716
 717         return PVE::Cluster::create_rrd_data(
 718             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 719     }});
 720
 721
 722 __PACKAGE__->register_method({
 723     name => 'vm_config',
 724     path => '{vmid}/config',
 725     method => 'GET',
 726     proxyto => 'node',
 727     description => "Get current virtual machine configuration. This does not include pending configuration changes (see 'pending' API).",
 728     permissions => {
 729         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 730     },
 731     parameters => {
 732         additionalProperties => 0,
 733         properties => {
 734             node => get_standard_option('pve-node'),
 735             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 736             current => {
 737                 description => "Get current values (instead of pending values).",
 738                 optional => 1,
 739                 default => 0,
 740                 type => 'boolean',
 741             },
 742         },
 743     },
 744     returns => {
 745         type => "object",
 746         properties => {
 747             digest => {
 748                 type => 'string',
 749                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 750             }
 751         },
 752     },
 753     code => sub {
 754         my ($param) = @_;
 755
 756         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 757
 758         delete $conf->{snapshots};
 759
 760         if (!$param->{current}) {
 761             foreach my $opt (keys %{$conf->{pending}}) {
 762                 next if $opt eq 'delete';
 763                 my $value = $conf->{pending}->{$opt};
 764                 next if ref($value); # just to be sure
 765                 $conf->{$opt} = $value;
 766             }
 767             my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 768             foreach my $opt (keys %$pending_delete_hash) {
 769                 delete $conf->{$opt} if $conf->{$opt};
 770             }
 771         }
 772
 773         delete $conf->{pending};
 774
 775         return $conf;
 776     }});
 777
 778 __PACKAGE__->register_method({
 779     name => 'vm_pending',
 780     path => '{vmid}/pending',
 781     method => 'GET',
 782     proxyto => 'node',
 783     description => "Get virtual machine configuration, including pending changes.",
 784     permissions => {
 785         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 786     },
 787     parameters => {
 788         additionalProperties => 0,
 789         properties => {
 790             node => get_standard_option('pve-node'),
 791             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 792         },
 793     },
 794     returns => {
 795         type => "array",
 796         items => {
 797             type => "object",
 798             properties => {
 799                 key => {
 800                     description => "Configuration option name.",
 801                     type => 'string',
 802                 },
 803                 value => {
 804                     description => "Current value.",
 805                     type => 'string',
 806                     optional => 1,
 807                 },
 808                 pending => {
 809                     description => "Pending value.",
 810                     type => 'string',
 811                     optional => 1,
 812                 },
 813                 delete => {
 814                     description => "Indicates a pending delete request if present and not 0. " .
 815                                    "The value 2 indicates a force-delete request.",
 816                     type => 'integer',
 817                     minimum => 0,
 818                     maximum => 2,
 819                     optional => 1,
 820                 },
 821             },
 822         },
 823     },
 824     code => sub {
 825         my ($param) = @_;
 826
 827         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 828
 829         my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 830
 831         my $res = [];
 832
 833         foreach my $opt (keys %$conf) {
 834             next if ref($conf->{$opt});
 835             my $item = { key => $opt };
 836             $item->{value} = $conf->{$opt} if defined($conf->{$opt});
 837             $item->{pending} = $conf->{pending}->{$opt} if defined($conf->{pending}->{$opt});
 838             $item->{delete} = ($pending_delete_hash->{$opt} ? 2 : 1) if exists $pending_delete_hash->{$opt};
 839             push @$res, $item;
 840         }
 841
 842         foreach my $opt (keys %{$conf->{pending}}) {
 843             next if $opt eq 'delete';
 844             next if ref($conf->{pending}->{$opt}); # just to be sure
 845             next if defined($conf->{$opt});
 846             my $item = { key => $opt };
 847             $item->{pending} = $conf->{pending}->{$opt};
 848             push @$res, $item;
 849         }
 850
 851         while (my ($opt, $force) = each %$pending_delete_hash) {
 852             next if $conf->{pending}->{$opt}; # just to be sure
 853             next if $conf->{$opt};
 854             my $item = { key => $opt, delete => ($force ? 2 : 1)};
 855             push @$res, $item;
 856         }
 857
 858         return $res;
 859     }});
 860
 861 # POST/PUT {vmid}/config implementation
 862 #
 863 # The original API used PUT (idempotent) an we assumed that all operations
 864 # are fast. But it turned out that almost any configuration change can
 865 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 866 # time to complete and have side effects (not idempotent).
 867 #
 868 # The new implementation uses POST and forks a worker process. We added
 869 # a new option 'background_delay'. If specified we wait up to
 870 # 'background_delay' second for the worker task to complete. It returns null
 871 # if the task is finished within that time, else we return the UPID.
 872
 873 my $update_vm_api  = sub {
 874     my ($param, $sync) = @_;
 875
 876     my $rpcenv = PVE::RPCEnvironment::get();
 877
 878     my $authuser = $rpcenv->get_user();
 879
 880     my $node = extract_param($param, 'node');
 881
 882     my $vmid = extract_param($param, 'vmid');
 883
 884     my $digest = extract_param($param, 'digest');
 885
 886     my $background_delay = extract_param($param, 'background_delay');
 887
 888     my @paramarr = (); # used for log message
 889     foreach my $key (sort keys %$param) {
 890         push @paramarr, "-$key", $param->{$key};
 891     }
 892
 893     my $skiplock = extract_param($param, 'skiplock');
 894     raise_param_exc({ skiplock => "Only root may use this option." })
 895         if $skiplock && $authuser ne 'root@pam';
 896
 897     my $delete_str = extract_param($param, 'delete');
 898
 899     my $revert_str = extract_param($param, 'revert');
 900
 901     my $force = extract_param($param, 'force');
 902
 903     die "no options specified\n" if !$delete_str && !$revert_str && !scalar(keys %$param);
 904
 905     my $storecfg = PVE::Storage::config();
 906
 907     my $defaults = PVE::QemuServer::load_defaults();
 908
 909     &$resolve_cdrom_alias($param);
 910
 911     # now try to verify all parameters
 912
 913     my $revert = {};
 914     foreach my $opt (PVE::Tools::split_list($revert_str)) {
 915         if (!PVE::QemuServer::option_exists($opt)) {
 916             raise_param_exc({ revert => "unknown option '$opt'" });
 917         }
 918
 919         raise_param_exc({ delete => "you can't use '-$opt' and " .
 920                               "-revert $opt' at the same time" })
 921             if defined($param->{$opt});
 922
 923         $revert->{$opt} = 1;
 924     }
 925
 926     my @delete = ();
 927     foreach my $opt (PVE::Tools::split_list($delete_str)) {
 928         $opt = 'ide2' if $opt eq 'cdrom';
 929
 930         raise_param_exc({ delete => "you can't use '-$opt' and " .
 931                               "-delete $opt' at the same time" })
 932             if defined($param->{$opt});
 933
 934         raise_param_exc({ revert => "you can't use '-delete $opt' and " .
 935                               "-revert $opt' at the same time" })
 936             if $revert->{$opt};
 937
 938         if (!PVE::QemuServer::option_exists($opt)) {
 939             raise_param_exc({ delete => "unknown option '$opt'" });
 940         }
 941
 942         push @delete, $opt;
 943     }
 944
 945     my $repl_conf = PVE::ReplicationConfig->new();
 946     my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
 947     my $check_replication = sub {
 948         my ($drive) = @_;
 949         return if !$is_replicated;
 950         my $volid = $drive->{file};
 951         return if !$volid || !($drive->{replicate}//1);
 952         return if PVE::QemuServer::drive_is_cdrom($drive);
 953         my ($storeid, $format);
 954         if ($volid =~ $NEW_DISK_RE) {
 955             $storeid = $2;
 956             $format = $drive->{format} || PVE::Storage::storage_default_format($storecfg, $storeid);
 957         } else {
 958             ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
 959             $format = (PVE::Storage::parse_volname($storecfg, $volid))[6];
 960         }
 961         return if PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
 962         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
 963         return if $scfg->{shared};
 964         die "cannot add non-replicatable volume to a replicated VM\n";
 965     };
 966
 967     foreach my $opt (keys %$param) {
 968         if (PVE::QemuServer::is_valid_drivename($opt)) {
 969             # cleanup drive path
 970             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 971             raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 972             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 973             $check_replication->($drive);
 974             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 975         } elsif ($opt =~ m/^net(\d+)$/) {
 976             # add macaddr
 977             my $net = PVE::QemuServer::parse_net($param->{$opt});
 978             $param->{$opt} = PVE::QemuServer::print_net($net);
 979         }
 980     }
 981
 982     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 983
 984     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 985
 986     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 987
 988     my $updatefn =  sub {
 989
 990         my $conf = PVE::QemuConfig->load_config($vmid);
 991
 992         die "checksum missmatch (file change by other user?)\n"
 993             if $digest && $digest ne $conf->{digest};
 994
 995         PVE::QemuConfig->check_lock($conf) if !$skiplock;
 996
 997         foreach my $opt (keys %$revert) {
 998             if (defined($conf->{$opt})) {
 999                 $param->{$opt} = $conf->{$opt};
1000             } elsif (defined($conf->{pending}->{$opt})) {
1001                 push @delete, $opt;
1002             }
1003         }
1004
1005         if ($param->{memory} || defined($param->{balloon})) {
1006             my $maxmem = $param->{memory} || $conf->{pending}->{memory} || $conf->{memory} || $defaults->{memory};
1007             my $balloon = defined($param->{balloon}) ? $param->{balloon} : $conf->{pending}->{balloon} || $conf->{balloon};
1008
1009             die "balloon value too large (must be smaller than assigned memory)\n"
1010                 if $balloon && $balloon > $maxmem;
1011         }
1012
1013         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
1014
1015         my $worker = sub {
1016
1017             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
1018
1019             # write updates to pending section
1020
1021             my $modified = {}; # record what $option we modify
1022
1023             foreach my $opt (@delete) {
1024                 $modified->{$opt} = 1;
1025                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1026                 if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
1027                     warn "cannot delete '$opt' - not set in current configuration!\n";
1028                     $modified->{$opt} = 0;
1029                     next;
1030                 }
1031
1032                 if ($opt =~ m/^unused/) {
1033                     my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
1034                     PVE::QemuConfig->check_protection($conf, "can't remove unused disk '$drive->{file}'");
1035                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1036                     if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, $drive, $rpcenv, $authuser)) {
1037                         delete $conf->{$opt};
1038                         PVE::QemuConfig->write_config($vmid, $conf);
1039                     }
1040                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
1041                     PVE::QemuConfig->check_protection($conf, "can't remove drive '$opt'");
1042                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1043                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1044                         if defined($conf->{pending}->{$opt});
1045                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1046                     PVE::QemuConfig->write_config($vmid, $conf);
1047                 } else {
1048                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1049                     PVE::QemuConfig->write_config($vmid, $conf);
1050                 }
1051             }
1052
1053             foreach my $opt (keys %$param) { # add/change
1054                 $modified->{$opt} = 1;
1055                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1056                 next if defined($conf->{pending}->{$opt}) && ($param->{$opt} eq $conf->{pending}->{$opt}); # skip if nothing changed
1057
1058                 if (PVE::QemuServer::is_valid_drivename($opt)) {
1059                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1060                     if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
1061                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
1062                     } else {
1063                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1064                     }
1065                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1066                         if defined($conf->{pending}->{$opt});
1067
1068                     &$create_disks($rpcenv, $authuser, $conf->{pending}, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
1069                 } else {
1070                     $conf->{pending}->{$opt} = $param->{$opt};
1071                 }
1072                 PVE::QemuServer::vmconfig_undelete_pending_option($conf, $opt);
1073                 PVE::QemuConfig->write_config($vmid, $conf);
1074             }
1075
1076             # remove pending changes when nothing changed
1077             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1078             my $changes = PVE::QemuServer::vmconfig_cleanup_pending($conf);
1079             PVE::QemuConfig->write_config($vmid, $conf) if $changes;
1080
1081             return if !scalar(keys %{$conf->{pending}});
1082
1083             my $running = PVE::QemuServer::check_running($vmid);
1084
1085             # apply pending changes
1086
1087             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1088
1089             if ($running) {
1090                 my $errors = {};
1091                 PVE::QemuServer::vmconfig_hotplug_pending($vmid, $conf, $storecfg, $modified, $errors);
1092                 raise_param_exc($errors) if scalar(keys %$errors);
1093             } else {
1094                 PVE::QemuServer::vmconfig_apply_pending($vmid, $conf, $storecfg, $running);
1095             }
1096
1097             return;
1098         };
1099
1100         if ($sync) {
1101             &$worker();
1102             return undef;
1103         } else {
1104             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1105
1106             if ($background_delay) {
1107
1108                 # Note: It would be better to do that in the Event based HTTPServer
1109                 # to avoid blocking call to sleep.
1110
1111                 my $end_time = time() + $background_delay;
1112
1113                 my $task = PVE::Tools::upid_decode($upid);
1114
1115                 my $running = 1;
1116                 while (time() < $end_time) {
1117                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1118                     last if !$running;
1119                     sleep(1); # this gets interrupted when child process ends
1120                 }
1121
1122                 if (!$running) {
1123                     my $status = PVE::Tools::upid_read_status($upid);
1124                     return undef if $status eq 'OK';
1125                     die $status;
1126                 }
1127             }
1128
1129             return $upid;
1130         }
1131     };
1132
1133     return PVE::QemuConfig->lock_config($vmid, $updatefn);
1134 };
1135
1136 my $vm_config_perm_list = [
1137             'VM.Config.Disk',
1138             'VM.Config.CDROM',
1139             'VM.Config.CPU',
1140             'VM.Config.Memory',
1141             'VM.Config.Network',
1142             'VM.Config.HWType',
1143             'VM.Config.Options',
1144     ];
1145
1146 __PACKAGE__->register_method({
1147     name => 'update_vm_async',
1148     path => '{vmid}/config',
1149     method => 'POST',
1150     protected => 1,
1151     proxyto => 'node',
1152     description => "Set virtual machine options (asynchrounous API).",
1153     permissions => {
1154         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1155     },
1156     parameters => {
1157         additionalProperties => 0,
1158         properties => PVE::QemuServer::json_config_properties(
1159             {
1160                 node => get_standard_option('pve-node'),
1161                 vmid => get_standard_option('pve-vmid'),
1162                 skiplock => get_standard_option('skiplock'),
1163                 delete => {
1164                     type => 'string', format => 'pve-configid-list',
1165                     description => "A list of settings you want to delete.",
1166                     optional => 1,
1167                 },
1168                 revert => {
1169                     type => 'string', format => 'pve-configid-list',
1170                     description => "Revert a pending change.",
1171                     optional => 1,
1172                 },
1173                 force => {
1174                     type => 'boolean',
1175                     description => $opt_force_description,
1176                     optional => 1,
1177                     requires => 'delete',
1178                 },
1179                 digest => {
1180                     type => 'string',
1181                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1182                     maxLength => 40,
1183                     optional => 1,
1184                 },
1185                 background_delay => {
1186                     type => 'integer',
1187                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1188                     minimum => 1,
1189                     maximum => 30,
1190                     optional => 1,
1191                 },
1192             }),
1193     },
1194     returns => {
1195         type => 'string',
1196         optional => 1,
1197     },
1198     code => $update_vm_api,
1199 });
1200
1201 __PACKAGE__->register_method({
1202     name => 'update_vm',
1203     path => '{vmid}/config',
1204     method => 'PUT',
1205     protected => 1,
1206     proxyto => 'node',
1207     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1208     permissions => {
1209         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1210     },
1211     parameters => {
1212         additionalProperties => 0,
1213         properties => PVE::QemuServer::json_config_properties(
1214             {
1215                 node => get_standard_option('pve-node'),
1216                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1217                 skiplock => get_standard_option('skiplock'),
1218                 delete => {
1219                     type => 'string', format => 'pve-configid-list',
1220                     description => "A list of settings you want to delete.",
1221                     optional => 1,
1222                 },
1223                 revert => {
1224                     type => 'string', format => 'pve-configid-list',
1225                     description => "Revert a pending change.",
1226                     optional => 1,
1227                 },
1228                 force => {
1229                     type => 'boolean',
1230                     description => $opt_force_description,
1231                     optional => 1,
1232                     requires => 'delete',
1233                 },
1234                 digest => {
1235                     type => 'string',
1236                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1237                     maxLength => 40,
1238                     optional => 1,
1239                 },
1240             }),
1241     },
1242     returns => { type => 'null' },
1243     code => sub {
1244         my ($param) = @_;
1245         &$update_vm_api($param, 1);
1246         return undef;
1247     }
1248 });
1249
1250
1251 __PACKAGE__->register_method({
1252     name => 'destroy_vm',
1253     path => '{vmid}',
1254     method => 'DELETE',
1255     protected => 1,
1256     proxyto => 'node',
1257     description => "Destroy the vm (also delete all used/owned volumes).",
1258     permissions => {
1259         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1260     },
1261     parameters => {
1262         additionalProperties => 0,
1263         properties => {
1264             node => get_standard_option('pve-node'),
1265             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1266             skiplock => get_standard_option('skiplock'),
1267         },
1268     },
1269     returns => {
1270         type => 'string',
1271     },
1272     code => sub {
1273         my ($param) = @_;
1274
1275         my $rpcenv = PVE::RPCEnvironment::get();
1276
1277         my $authuser = $rpcenv->get_user();
1278
1279         my $vmid = $param->{vmid};
1280
1281         my $skiplock = $param->{skiplock};
1282         raise_param_exc({ skiplock => "Only root may use this option." })
1283             if $skiplock && $authuser ne 'root@pam';
1284
1285         # test if VM exists
1286         my $conf = PVE::QemuConfig->load_config($vmid);
1287
1288         my $storecfg = PVE::Storage::config();
1289
1290         PVE::QemuConfig->check_protection($conf, "can't remove VM $vmid");
1291
1292         die "unable to remove VM $vmid - used in HA resources\n"
1293             if PVE::HA::Config::vm_is_ha_managed($vmid);
1294
1295         # do not allow destroy if there are replication jobs
1296         my $repl_conf = PVE::ReplicationConfig->new();
1297         $repl_conf->check_for_existing_jobs($vmid);
1298
1299         # early tests (repeat after locking)
1300         die "VM $vmid is running - destroy failed\n"
1301             if PVE::QemuServer::check_running($vmid);
1302
1303         my $realcmd = sub {
1304             my $upid = shift;
1305
1306             syslog('info', "destroy VM $vmid: $upid\n");
1307
1308             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1309
1310             PVE::AccessControl::remove_vm_access($vmid);
1311
1312             PVE::Firewall::remove_vmfw_conf($vmid);
1313         };
1314
1315         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1316     }});
1317
1318 __PACKAGE__->register_method({
1319     name => 'unlink',
1320     path => '{vmid}/unlink',
1321     method => 'PUT',
1322     protected => 1,
1323     proxyto => 'node',
1324     description => "Unlink/delete disk images.",
1325     permissions => {
1326         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1327     },
1328     parameters => {
1329         additionalProperties => 0,
1330         properties => {
1331             node => get_standard_option('pve-node'),
1332             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1333             idlist => {
1334                 type => 'string', format => 'pve-configid-list',
1335                 description => "A list of disk IDs you want to delete.",
1336             },
1337             force => {
1338                 type => 'boolean',
1339                 description => $opt_force_description,
1340                 optional => 1,
1341             },
1342         },
1343     },
1344     returns => { type => 'null'},
1345     code => sub {
1346         my ($param) = @_;
1347
1348         $param->{delete} = extract_param($param, 'idlist');
1349
1350         __PACKAGE__->update_vm($param);
1351
1352         return undef;
1353     }});
1354
1355 my $sslcert;
1356
1357 __PACKAGE__->register_method({
1358     name => 'vncproxy',
1359     path => '{vmid}/vncproxy',
1360     method => 'POST',
1361     protected => 1,
1362     permissions => {
1363         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1364     },
1365     description => "Creates a TCP VNC proxy connections.",
1366     parameters => {
1367         additionalProperties => 0,
1368         properties => {
1369             node => get_standard_option('pve-node'),
1370             vmid => get_standard_option('pve-vmid'),
1371             websocket => {
1372                 optional => 1,
1373                 type => 'boolean',
1374                 description => "starts websockify instead of vncproxy",
1375             },
1376         },
1377     },
1378     returns => {
1379         additionalProperties => 0,
1380         properties => {
1381             user => { type => 'string' },
1382             ticket => { type => 'string' },
1383             cert => { type => 'string' },
1384             port => { type => 'integer' },
1385             upid => { type => 'string' },
1386         },
1387     },
1388     code => sub {
1389         my ($param) = @_;
1390
1391         my $rpcenv = PVE::RPCEnvironment::get();
1392
1393         my $authuser = $rpcenv->get_user();
1394
1395         my $vmid = $param->{vmid};
1396         my $node = $param->{node};
1397         my $websocket = $param->{websocket};
1398
1399         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1400
1401         my $authpath = "/vms/$vmid";
1402
1403         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1404
1405         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1406             if !$sslcert;
1407
1408         my ($remip, $family);
1409         my $remcmd = [];
1410
1411         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1412             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1413             # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
1414             $remcmd = ['/usr/bin/ssh', '-e', 'none', '-T', '-o', 'BatchMode=yes', $remip];
1415         } else {
1416             $family = PVE::Tools::get_host_address_family($node);
1417         }
1418
1419         my $port = PVE::Tools::next_vnc_port($family);
1420
1421         my $timeout = 10;
1422
1423         my $realcmd = sub {
1424             my $upid = shift;
1425
1426             syslog('info', "starting vnc proxy $upid\n");
1427
1428             my $cmd;
1429
1430             if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
1431
1432
1433                 my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga}, '-escape', '0' ];
1434
1435                 $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
1436                         '-timeout', $timeout, '-authpath', $authpath,
1437                         '-perm', 'Sys.Console'];
1438
1439                 if ($param->{websocket}) {
1440                     $ENV{PVE_VNC_TICKET} = $ticket; # pass ticket to vncterm
1441                     push @$cmd, '-notls', '-listen', 'localhost';
1442                 }
1443
1444                 push @$cmd, '-c', @$remcmd, @$termcmd;
1445
1446                 PVE::Tools::run_command($cmd);
1447
1448             } else {
1449
1450                 $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
1451
1452                 $cmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1453
1454                 my $sock = IO::Socket::IP->new(
1455                     ReuseAddr => 1,
1456                     Listen => 1,
1457                     LocalPort => $port,
1458                     Proto => 'tcp',
1459                     GetAddrInfoFlags => 0,
1460                     ) or die "failed to create socket: $!\n";
1461                 # Inside the worker we shouldn't have any previous alarms
1462                 # running anyway...:
1463                 alarm(0);
1464                 local $SIG{ALRM} = sub { die "connection timed out\n" };
1465                 alarm $timeout;
1466                 accept(my $cli, $sock) or die "connection failed: $!\n";
1467                 alarm(0);
1468                 close($sock);
1469                 if (PVE::Tools::run_command($cmd,
1470                     output => '>&'.fileno($cli),
1471                     input => '<&'.fileno($cli),
1472                     noerr => 1) != 0)
1473                 {
1474                     die "Failed to run vncproxy.\n";
1475                 }
1476             }
1477
1478             return;
1479         };
1480
1481         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1482
1483         PVE::Tools::wait_for_vnc_port($port);
1484
1485         return {
1486             user => $authuser,
1487             ticket => $ticket,
1488             port => $port,
1489             upid => $upid,
1490             cert => $sslcert,
1491         };
1492     }});
1493
1494 __PACKAGE__->register_method({
1495     name => 'termproxy',
1496     path => '{vmid}/termproxy',
1497     method => 'POST',
1498     protected => 1,
1499     permissions => {
1500         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1501     },
1502     description => "Creates a TCP proxy connections.",
1503     parameters => {
1504         additionalProperties => 0,
1505         properties => {
1506             node => get_standard_option('pve-node'),
1507             vmid => get_standard_option('pve-vmid'),
1508             serial=> {
1509                 optional => 1,
1510                 type => 'string',
1511                 enum => [qw(serial0 serial1 serial2 serial3)],
1512                 description => "opens a serial terminal (defaults to display)",
1513             },
1514         },
1515     },
1516     returns => {
1517         additionalProperties => 0,
1518         properties => {
1519             user => { type => 'string' },
1520             ticket => { type => 'string' },
1521             port => { type => 'integer' },
1522             upid => { type => 'string' },
1523         },
1524     },
1525     code => sub {
1526         my ($param) = @_;
1527
1528         my $rpcenv = PVE::RPCEnvironment::get();
1529
1530         my $authuser = $rpcenv->get_user();
1531
1532         my $vmid = $param->{vmid};
1533         my $node = $param->{node};
1534         my $serial = $param->{serial};
1535
1536         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1537
1538         if (!defined($serial)) {
1539             if ($conf->{vga} && $conf->{vga} =~ m/^serial\d+$/) {
1540                 $serial = $conf->{vga};
1541             }
1542         }
1543
1544         my $authpath = "/vms/$vmid";
1545
1546         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1547
1548         my ($remip, $family);
1549
1550         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1551             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1552         } else {
1553             $family = PVE::Tools::get_host_address_family($node);
1554         }
1555
1556         my $port = PVE::Tools::next_vnc_port($family);
1557
1558         my $remcmd = $remip ?
1559             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
1560
1561         my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-escape', '0'];
1562         push @$termcmd, '-iface', $serial if $serial;
1563
1564         my $realcmd = sub {
1565             my $upid = shift;
1566
1567             syslog('info', "starting qemu termproxy $upid\n");
1568
1569             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
1570                        '--perm', 'VM.Console', '--'];
1571             push @$cmd, @$remcmd, @$termcmd;
1572
1573             PVE::Tools::run_command($cmd);
1574         };
1575
1576         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1577
1578         PVE::Tools::wait_for_vnc_port($port);
1579
1580         return {
1581             user => $authuser,
1582             ticket => $ticket,
1583             port => $port,
1584             upid => $upid,
1585         };
1586     }});
1587
1588 __PACKAGE__->register_method({
1589     name => 'vncwebsocket',
1590     path => '{vmid}/vncwebsocket',
1591     method => 'GET',
1592     permissions => {
1593         description => "You also need to pass a valid ticket (vncticket).",
1594         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1595     },
1596     description => "Opens a weksocket for VNC traffic.",
1597     parameters => {
1598         additionalProperties => 0,
1599         properties => {
1600             node => get_standard_option('pve-node'),
1601             vmid => get_standard_option('pve-vmid'),
1602             vncticket => {
1603                 description => "Ticket from previous call to vncproxy.",
1604                 type => 'string',
1605                 maxLength => 512,
1606             },
1607             port => {
1608                 description => "Port number returned by previous vncproxy call.",
1609                 type => 'integer',
1610                 minimum => 5900,
1611                 maximum => 5999,
1612             },
1613         },
1614     },
1615     returns => {
1616         type => "object",
1617         properties => {
1618             port => { type => 'string' },
1619         },
1620     },
1621     code => sub {
1622         my ($param) = @_;
1623
1624         my $rpcenv = PVE::RPCEnvironment::get();
1625
1626         my $authuser = $rpcenv->get_user();
1627
1628         my $vmid = $param->{vmid};
1629         my $node = $param->{node};
1630
1631         my $authpath = "/vms/$vmid";
1632
1633         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1634
1635         my $conf = PVE::QemuConfig->load_config($vmid, $node); # VM exists ?
1636
1637         # Note: VNC ports are acessible from outside, so we do not gain any
1638         # security if we verify that $param->{port} belongs to VM $vmid. This
1639         # check is done by verifying the VNC ticket (inside VNC protocol).
1640
1641         my $port = $param->{port};
1642
1643         return { port => $port };
1644     }});
1645
1646 __PACKAGE__->register_method({
1647     name => 'spiceproxy',
1648     path => '{vmid}/spiceproxy',
1649     method => 'POST',
1650     protected => 1,
1651     proxyto => 'node',
1652     permissions => {
1653         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1654     },
1655     description => "Returns a SPICE configuration to connect to the VM.",
1656     parameters => {
1657         additionalProperties => 0,
1658         properties => {
1659             node => get_standard_option('pve-node'),
1660             vmid => get_standard_option('pve-vmid'),
1661             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1662         },
1663     },
1664     returns => get_standard_option('remote-viewer-config'),
1665     code => sub {
1666         my ($param) = @_;
1667
1668         my $rpcenv = PVE::RPCEnvironment::get();
1669
1670         my $authuser = $rpcenv->get_user();
1671
1672         my $vmid = $param->{vmid};
1673         my $node = $param->{node};
1674         my $proxy = $param->{proxy};
1675
1676         my $conf = PVE::QemuConfig->load_config($vmid, $node);
1677         my $title = "VM $vmid";
1678         $title .= " - ". $conf->{name} if $conf->{name};
1679
1680         my $port = PVE::QemuServer::spice_port($vmid);
1681
1682         my ($ticket, undef, $remote_viewer_config) =
1683             PVE::AccessControl::remote_viewer_config($authuser, $vmid, $node, $proxy, $title, $port);
1684
1685         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1686         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1687
1688         return $remote_viewer_config;
1689     }});
1690
1691 __PACKAGE__->register_method({
1692     name => 'vmcmdidx',
1693     path => '{vmid}/status',
1694     method => 'GET',
1695     proxyto => 'node',
1696     description => "Directory index",
1697     permissions => {
1698         user => 'all',
1699     },
1700     parameters => {
1701         additionalProperties => 0,
1702         properties => {
1703             node => get_standard_option('pve-node'),
1704             vmid => get_standard_option('pve-vmid'),
1705         },
1706     },
1707     returns => {
1708         type => 'array',
1709         items => {
1710             type => "object",
1711             properties => {
1712                 subdir => { type => 'string' },
1713             },
1714         },
1715         links => [ { rel => 'child', href => "{subdir}" } ],
1716     },
1717     code => sub {
1718         my ($param) = @_;
1719
1720         # test if VM exists
1721         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1722
1723         my $res = [
1724             { subdir => 'current' },
1725             { subdir => 'start' },
1726             { subdir => 'stop' },
1727             ];
1728
1729         return $res;
1730     }});
1731
1732 __PACKAGE__->register_method({
1733     name => 'vm_status',
1734     path => '{vmid}/status/current',
1735     method => 'GET',
1736     proxyto => 'node',
1737     protected => 1, # qemu pid files are only readable by root
1738     description => "Get virtual machine status.",
1739     permissions => {
1740         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1741     },
1742     parameters => {
1743         additionalProperties => 0,
1744         properties => {
1745             node => get_standard_option('pve-node'),
1746             vmid => get_standard_option('pve-vmid'),
1747         },
1748     },
1749     returns => { type => 'object' },
1750     code => sub {
1751         my ($param) = @_;
1752
1753         # test if VM exists
1754         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1755
1756         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1757         my $status = $vmstatus->{$param->{vmid}};
1758
1759         $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
1760
1761         $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
1762
1763         $status->{agent} = 1 if $conf->{agent};
1764
1765         return $status;
1766     }});
1767
1768 __PACKAGE__->register_method({
1769     name => 'vm_start',
1770     path => '{vmid}/status/start',
1771     method => 'POST',
1772     protected => 1,
1773     proxyto => 'node',
1774     description => "Start virtual machine.",
1775     permissions => {
1776         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1777     },
1778     parameters => {
1779         additionalProperties => 0,
1780         properties => {
1781             node => get_standard_option('pve-node'),
1782             vmid => get_standard_option('pve-vmid',
1783                                         { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1784             skiplock => get_standard_option('skiplock'),
1785             stateuri => get_standard_option('pve-qm-stateuri'),
1786             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1787             migration_type => {
1788                 type => 'string',
1789                 enum => ['secure', 'insecure'],
1790                 description => "Migration traffic is encrypted using an SSH " .
1791                   "tunnel by default. On secure, completely private networks " .
1792                   "this can be disabled to increase performance.",
1793                 optional => 1,
1794             },
1795             migration_network => {
1796                 type => 'string', format => 'CIDR',
1797                 description => "CIDR of the (sub) network that is used for migration.",
1798                 optional => 1,
1799             },
1800             machine => get_standard_option('pve-qm-machine'),
1801             targetstorage => {
1802                 description => "Target storage for the migration. (Can be '1' to use the same storage id as on the source node.)",
1803                 type => 'string',
1804                 optional => 1
1805             }
1806         },
1807     },
1808     returns => {
1809         type => 'string',
1810     },
1811     code => sub {
1812         my ($param) = @_;
1813
1814         my $rpcenv = PVE::RPCEnvironment::get();
1815
1816         my $authuser = $rpcenv->get_user();
1817
1818         my $node = extract_param($param, 'node');
1819
1820         my $vmid = extract_param($param, 'vmid');
1821
1822         my $machine = extract_param($param, 'machine');
1823
1824         my $stateuri = extract_param($param, 'stateuri');
1825         raise_param_exc({ stateuri => "Only root may use this option." })
1826             if $stateuri && $authuser ne 'root@pam';
1827
1828         my $skiplock = extract_param($param, 'skiplock');
1829         raise_param_exc({ skiplock => "Only root may use this option." })
1830             if $skiplock && $authuser ne 'root@pam';
1831
1832         my $migratedfrom = extract_param($param, 'migratedfrom');
1833         raise_param_exc({ migratedfrom => "Only root may use this option." })
1834             if $migratedfrom && $authuser ne 'root@pam';
1835
1836         my $migration_type = extract_param($param, 'migration_type');
1837         raise_param_exc({ migration_type => "Only root may use this option." })
1838             if $migration_type && $authuser ne 'root@pam';
1839
1840         my $migration_network = extract_param($param, 'migration_network');
1841         raise_param_exc({ migration_network => "Only root may use this option." })
1842             if $migration_network && $authuser ne 'root@pam';
1843
1844         my $targetstorage = extract_param($param, 'targetstorage');
1845         raise_param_exc({ targetstorage => "Only root may use this option." })
1846             if $targetstorage && $authuser ne 'root@pam';
1847
1848         raise_param_exc({ targetstorage => "targetstorage can only by used with migratedfrom." })
1849             if $targetstorage && !$migratedfrom;
1850
1851         # read spice ticket from STDIN
1852         my $spice_ticket;
1853         if ($stateuri && ($stateuri eq 'tcp') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
1854             if (defined(my $line = <STDIN>)) {
1855                 chomp $line;
1856                 $spice_ticket = $line;
1857             }
1858         }
1859
1860         PVE::Cluster::check_cfs_quorum();
1861
1862         my $storecfg = PVE::Storage::config();
1863
1864         if (PVE::HA::Config::vm_is_ha_managed($vmid) && !$stateuri &&
1865             $rpcenv->{type} ne 'ha') {
1866
1867             my $hacmd = sub {
1868                 my $upid = shift;
1869
1870                 my $service = "vm:$vmid";
1871
1872                 my $cmd = ['ha-manager', 'set', $service, '--state', 'started'];
1873
1874                 print "Requesting HA start for VM $vmid\n";
1875
1876                 PVE::Tools::run_command($cmd);
1877
1878                 return;
1879             };
1880
1881             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1882
1883         } else {
1884
1885             my $realcmd = sub {
1886                 my $upid = shift;
1887
1888                 syslog('info', "start VM $vmid: $upid\n");
1889
1890                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef,
1891                                           $machine, $spice_ticket, $migration_network, $migration_type, $targetstorage);
1892
1893                 return;
1894             };
1895
1896             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1897         }
1898     }});
1899
1900 __PACKAGE__->register_method({
1901     name => 'vm_stop',
1902     path => '{vmid}/status/stop',
1903     method => 'POST',
1904     protected => 1,
1905     proxyto => 'node',
1906     description => "Stop virtual machine. The qemu process will exit immediately. This" .
1907         "is akin to pulling the power plug of a running computer and may damage the VM data",
1908     permissions => {
1909         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1910     },
1911     parameters => {
1912         additionalProperties => 0,
1913         properties => {
1914             node => get_standard_option('pve-node'),
1915             vmid => get_standard_option('pve-vmid',
1916                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1917             skiplock => get_standard_option('skiplock'),
1918             migratedfrom => get_standard_option('pve-node', { optional => 1 }),
1919             timeout => {
1920                 description => "Wait maximal timeout seconds.",
1921                 type => 'integer',
1922                 minimum => 0,
1923                 optional => 1,
1924             },
1925             keepActive => {
1926                 description => "Do not deactivate storage volumes.",
1927                 type => 'boolean',
1928                 optional => 1,
1929                 default => 0,
1930             }
1931         },
1932     },
1933     returns => {
1934         type => 'string',
1935     },
1936     code => sub {
1937         my ($param) = @_;
1938
1939         my $rpcenv = PVE::RPCEnvironment::get();
1940
1941         my $authuser = $rpcenv->get_user();
1942
1943         my $node = extract_param($param, 'node');
1944
1945         my $vmid = extract_param($param, 'vmid');
1946
1947         my $skiplock = extract_param($param, 'skiplock');
1948         raise_param_exc({ skiplock => "Only root may use this option." })
1949             if $skiplock && $authuser ne 'root@pam';
1950
1951         my $keepActive = extract_param($param, 'keepActive');
1952         raise_param_exc({ keepActive => "Only root may use this option." })
1953             if $keepActive && $authuser ne 'root@pam';
1954
1955         my $migratedfrom = extract_param($param, 'migratedfrom');
1956         raise_param_exc({ migratedfrom => "Only root may use this option." })
1957             if $migratedfrom && $authuser ne 'root@pam';
1958
1959
1960         my $storecfg = PVE::Storage::config();
1961
1962         if (PVE::HA::Config::vm_is_ha_managed($vmid) && ($rpcenv->{type} ne 'ha') && !defined($migratedfrom)) {
1963
1964             my $hacmd = sub {
1965                 my $upid = shift;
1966
1967                 my $service = "vm:$vmid";
1968
1969                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
1970
1971                 print "Requesting HA stop for VM $vmid\n";
1972
1973                 PVE::Tools::run_command($cmd);
1974
1975                 return;
1976             };
1977
1978             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1979
1980         } else {
1981             my $realcmd = sub {
1982                 my $upid = shift;
1983
1984                 syslog('info', "stop VM $vmid: $upid\n");
1985
1986                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1987                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1988
1989                 return;
1990             };
1991
1992             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1993         }
1994     }});
1995
1996 __PACKAGE__->register_method({
1997     name => 'vm_reset',
1998     path => '{vmid}/status/reset',
1999     method => 'POST',
2000     protected => 1,
2001     proxyto => 'node',
2002     description => "Reset virtual machine.",
2003     permissions => {
2004         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2005     },
2006     parameters => {
2007         additionalProperties => 0,
2008         properties => {
2009             node => get_standard_option('pve-node'),
2010             vmid => get_standard_option('pve-vmid',
2011                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2012             skiplock => get_standard_option('skiplock'),
2013         },
2014     },
2015     returns => {
2016         type => 'string',
2017     },
2018     code => sub {
2019         my ($param) = @_;
2020
2021         my $rpcenv = PVE::RPCEnvironment::get();
2022
2023         my $authuser = $rpcenv->get_user();
2024
2025         my $node = extract_param($param, 'node');
2026
2027         my $vmid = extract_param($param, 'vmid');
2028
2029         my $skiplock = extract_param($param, 'skiplock');
2030         raise_param_exc({ skiplock => "Only root may use this option." })
2031             if $skiplock && $authuser ne 'root@pam';
2032
2033         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2034
2035         my $realcmd = sub {
2036             my $upid = shift;
2037
2038             PVE::QemuServer::vm_reset($vmid, $skiplock);
2039
2040             return;
2041         };
2042
2043         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
2044     }});
2045
2046 __PACKAGE__->register_method({
2047     name => 'vm_shutdown',
2048     path => '{vmid}/status/shutdown',
2049     method => 'POST',
2050     protected => 1,
2051     proxyto => 'node',
2052     description => "Shutdown virtual machine. This is similar to pressing the power button on a physical machine." .
2053         "This will send an ACPI event for the guest OS, which should then proceed to a clean shutdown.",
2054     permissions => {
2055         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2056     },
2057     parameters => {
2058         additionalProperties => 0,
2059         properties => {
2060             node => get_standard_option('pve-node'),
2061             vmid => get_standard_option('pve-vmid',
2062                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2063             skiplock => get_standard_option('skiplock'),
2064             timeout => {
2065                 description => "Wait maximal timeout seconds.",
2066                 type => 'integer',
2067                 minimum => 0,
2068                 optional => 1,
2069             },
2070             forceStop => {
2071                 description => "Make sure the VM stops.",
2072                 type => 'boolean',
2073                 optional => 1,
2074                 default => 0,
2075             },
2076             keepActive => {
2077                 description => "Do not deactivate storage volumes.",
2078                 type => 'boolean',
2079                 optional => 1,
2080                 default => 0,
2081             }
2082         },
2083     },
2084     returns => {
2085         type => 'string',
2086     },
2087     code => sub {
2088         my ($param) = @_;
2089
2090         my $rpcenv = PVE::RPCEnvironment::get();
2091
2092         my $authuser = $rpcenv->get_user();
2093
2094         my $node = extract_param($param, 'node');
2095
2096         my $vmid = extract_param($param, 'vmid');
2097
2098         my $skiplock = extract_param($param, 'skiplock');
2099         raise_param_exc({ skiplock => "Only root may use this option." })
2100             if $skiplock && $authuser ne 'root@pam';
2101
2102         my $keepActive = extract_param($param, 'keepActive');
2103         raise_param_exc({ keepActive => "Only root may use this option." })
2104             if $keepActive && $authuser ne 'root@pam';
2105
2106         my $storecfg = PVE::Storage::config();
2107
2108         my $shutdown = 1;
2109
2110         # if vm is paused, do not shutdown (but stop if forceStop = 1)
2111         # otherwise, we will infer a shutdown command, but run into the timeout,
2112         # then when the vm is resumed, it will instantly shutdown
2113         #
2114         # checking the qmp status here to get feedback to the gui/cli/api
2115         # and the status query should not take too long
2116         my $qmpstatus;
2117         eval {
2118             $qmpstatus = PVE::QemuServer::vm_qmp_command($vmid, { execute => "query-status" }, 0);
2119         };
2120         my $err = $@ if $@;
2121
2122         if (!$err && $qmpstatus->{status} eq "paused") {
2123             if ($param->{forceStop}) {
2124                 warn "VM is paused - stop instead of shutdown\n";
2125                 $shutdown = 0;
2126             } else {
2127                 die "VM is paused - cannot shutdown\n";
2128             }
2129         }
2130
2131         if (PVE::HA::Config::vm_is_ha_managed($vmid) &&
2132             ($rpcenv->{type} ne 'ha')) {
2133
2134             my $hacmd = sub {
2135                 my $upid = shift;
2136
2137                 my $service = "vm:$vmid";
2138
2139                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
2140
2141                 print "Requesting HA stop for VM $vmid\n";
2142
2143                 PVE::Tools::run_command($cmd);
2144
2145                 return;
2146             };
2147
2148             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
2149
2150         } else {
2151
2152             my $realcmd = sub {
2153                 my $upid = shift;
2154
2155                 syslog('info', "shutdown VM $vmid: $upid\n");
2156
2157                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
2158                                          $shutdown, $param->{forceStop}, $keepActive);
2159
2160                 return;
2161             };
2162
2163             return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
2164         }
2165     }});
2166
2167 __PACKAGE__->register_method({
2168     name => 'vm_suspend',
2169     path => '{vmid}/status/suspend',
2170     method => 'POST',
2171     protected => 1,
2172     proxyto => 'node',
2173     description => "Suspend virtual machine.",
2174     permissions => {
2175         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2176     },
2177     parameters => {
2178         additionalProperties => 0,
2179         properties => {
2180             node => get_standard_option('pve-node'),
2181             vmid => get_standard_option('pve-vmid',
2182                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2183             skiplock => get_standard_option('skiplock'),
2184         },
2185     },
2186     returns => {
2187         type => 'string',
2188     },
2189     code => sub {
2190         my ($param) = @_;
2191
2192         my $rpcenv = PVE::RPCEnvironment::get();
2193
2194         my $authuser = $rpcenv->get_user();
2195
2196         my $node = extract_param($param, 'node');
2197
2198         my $vmid = extract_param($param, 'vmid');
2199
2200         my $skiplock = extract_param($param, 'skiplock');
2201         raise_param_exc({ skiplock => "Only root may use this option." })
2202             if $skiplock && $authuser ne 'root@pam';
2203
2204         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2205
2206         my $realcmd = sub {
2207             my $upid = shift;
2208
2209             syslog('info', "suspend VM $vmid: $upid\n");
2210
2211             PVE::QemuServer::vm_suspend($vmid, $skiplock);
2212
2213             return;
2214         };
2215
2216         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
2217     }});
2218
2219 __PACKAGE__->register_method({
2220     name => 'vm_resume',
2221     path => '{vmid}/status/resume',
2222     method => 'POST',
2223     protected => 1,
2224     proxyto => 'node',
2225     description => "Resume virtual machine.",
2226     permissions => {
2227         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2228     },
2229     parameters => {
2230         additionalProperties => 0,
2231         properties => {
2232             node => get_standard_option('pve-node'),
2233             vmid => get_standard_option('pve-vmid',
2234                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2235             skiplock => get_standard_option('skiplock'),
2236             nocheck => { type => 'boolean', optional => 1 },
2237
2238         },
2239     },
2240     returns => {
2241         type => 'string',
2242     },
2243     code => sub {
2244         my ($param) = @_;
2245
2246         my $rpcenv = PVE::RPCEnvironment::get();
2247
2248         my $authuser = $rpcenv->get_user();
2249
2250         my $node = extract_param($param, 'node');
2251
2252         my $vmid = extract_param($param, 'vmid');
2253
2254         my $skiplock = extract_param($param, 'skiplock');
2255         raise_param_exc({ skiplock => "Only root may use this option." })
2256             if $skiplock && $authuser ne 'root@pam';
2257
2258         my $nocheck = extract_param($param, 'nocheck');
2259
2260         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid, $nocheck);
2261
2262         my $realcmd = sub {
2263             my $upid = shift;
2264
2265             syslog('info', "resume VM $vmid: $upid\n");
2266
2267             PVE::QemuServer::vm_resume($vmid, $skiplock, $nocheck);
2268
2269             return;
2270         };
2271
2272         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
2273     }});
2274
2275 __PACKAGE__->register_method({
2276     name => 'vm_sendkey',
2277     path => '{vmid}/sendkey',
2278     method => 'PUT',
2279     protected => 1,
2280     proxyto => 'node',
2281     description => "Send key event to virtual machine.",
2282     permissions => {
2283         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
2284     },
2285     parameters => {
2286         additionalProperties => 0,
2287         properties => {
2288             node => get_standard_option('pve-node'),
2289             vmid => get_standard_option('pve-vmid',
2290                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2291             skiplock => get_standard_option('skiplock'),
2292             key => {
2293                 description => "The key (qemu monitor encoding).",
2294                 type => 'string'
2295             }
2296         },
2297     },
2298     returns => { type => 'null'},
2299     code => sub {
2300         my ($param) = @_;
2301
2302         my $rpcenv = PVE::RPCEnvironment::get();
2303
2304         my $authuser = $rpcenv->get_user();
2305
2306         my $node = extract_param($param, 'node');
2307
2308         my $vmid = extract_param($param, 'vmid');
2309
2310         my $skiplock = extract_param($param, 'skiplock');
2311         raise_param_exc({ skiplock => "Only root may use this option." })
2312             if $skiplock && $authuser ne 'root@pam';
2313
2314         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
2315
2316         return;
2317     }});
2318
2319 __PACKAGE__->register_method({
2320     name => 'vm_feature',
2321     path => '{vmid}/feature',
2322     method => 'GET',
2323     proxyto => 'node',
2324     protected => 1,
2325     description => "Check if feature for virtual machine is available.",
2326     permissions => {
2327         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2328     },
2329     parameters => {
2330         additionalProperties => 0,
2331         properties => {
2332             node => get_standard_option('pve-node'),
2333             vmid => get_standard_option('pve-vmid'),
2334             feature => {
2335                 description => "Feature to check.",
2336                 type => 'string',
2337                 enum => [ 'snapshot', 'clone', 'copy' ],
2338             },
2339             snapname => get_standard_option('pve-snapshot-name', {
2340                 optional => 1,
2341             }),
2342         },
2343     },
2344     returns => {
2345         type => "object",
2346         properties => {
2347             hasFeature => { type => 'boolean' },
2348             nodes => {
2349                 type => 'array',
2350                 items => { type => 'string' },
2351             }
2352         },
2353     },
2354     code => sub {
2355         my ($param) = @_;
2356
2357         my $node = extract_param($param, 'node');
2358
2359         my $vmid = extract_param($param, 'vmid');
2360
2361         my $snapname = extract_param($param, 'snapname');
2362
2363         my $feature = extract_param($param, 'feature');
2364
2365         my $running = PVE::QemuServer::check_running($vmid);
2366
2367         my $conf = PVE::QemuConfig->load_config($vmid);
2368
2369         if($snapname){
2370             my $snap = $conf->{snapshots}->{$snapname};
2371             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2372             $conf = $snap;
2373         }
2374         my $storecfg = PVE::Storage::config();
2375
2376         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
2377         my $hasFeature = PVE::QemuConfig->has_feature($feature, $conf, $storecfg, $snapname, $running);
2378
2379         return {
2380             hasFeature => $hasFeature,
2381             nodes => [ keys %$nodelist ],
2382         };
2383     }});
2384
2385 __PACKAGE__->register_method({
2386     name => 'clone_vm',
2387     path => '{vmid}/clone',
2388     method => 'POST',
2389     protected => 1,
2390     proxyto => 'node',
2391     description => "Create a copy of virtual machine/template.",
2392     permissions => {
2393         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2394             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2395             "'Datastore.AllocateSpace' on any used storage.",
2396         check =>
2397         [ 'and',
2398           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2399           [ 'or',
2400             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2401             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2402           ],
2403         ]
2404     },
2405     parameters => {
2406         additionalProperties => 0,
2407         properties => {
2408             node => get_standard_option('pve-node'),
2409             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2410             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
2411             name => {
2412                 optional => 1,
2413                 type => 'string', format => 'dns-name',
2414                 description => "Set a name for the new VM.",
2415             },
2416             description => {
2417                 optional => 1,
2418                 type => 'string',
2419                 description => "Description for the new VM.",
2420             },
2421             pool => {
2422                 optional => 1,
2423                 type => 'string', format => 'pve-poolid',
2424                 description => "Add the new VM to the specified pool.",
2425             },
2426             snapname => get_standard_option('pve-snapshot-name', {
2427                 optional => 1,
2428             }),
2429             storage => get_standard_option('pve-storage-id', {
2430                 description => "Target storage for full clone.",
2431                 requires => 'full',
2432                 optional => 1,
2433             }),
2434             'format' => {
2435                 description => "Target format for file storage.",
2436                 requires => 'full',
2437                 type => 'string',
2438                 optional => 1,
2439                 enum => [ 'raw', 'qcow2', 'vmdk'],
2440             },
2441             full => {
2442                 optional => 1,
2443                 type => 'boolean',
2444                 description => "Create a full copy of all disk. This is always done when " .
2445                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2446                 default => 0,
2447             },
2448             target => get_standard_option('pve-node', {
2449                 description => "Target node. Only allowed if the original VM is on shared storage.",
2450                 optional => 1,
2451             }),
2452         },
2453     },
2454     returns => {
2455         type => 'string',
2456     },
2457     code => sub {
2458         my ($param) = @_;
2459
2460         my $rpcenv = PVE::RPCEnvironment::get();
2461
2462         my $authuser = $rpcenv->get_user();
2463
2464         my $node = extract_param($param, 'node');
2465
2466         my $vmid = extract_param($param, 'vmid');
2467
2468         my $newid = extract_param($param, 'newid');
2469
2470         my $pool = extract_param($param, 'pool');
2471
2472         if (defined($pool)) {
2473             $rpcenv->check_pool_exist($pool);
2474         }
2475
2476         my $snapname = extract_param($param, 'snapname');
2477
2478         my $storage = extract_param($param, 'storage');
2479
2480         my $format = extract_param($param, 'format');
2481
2482         my $target = extract_param($param, 'target');
2483
2484         my $localnode = PVE::INotify::nodename();
2485
2486         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2487
2488         PVE::Cluster::check_node_exists($target) if $target;
2489
2490         my $storecfg = PVE::Storage::config();
2491
2492         if ($storage) {
2493             # check if storage is enabled on local node
2494             PVE::Storage::storage_check_enabled($storecfg, $storage);
2495             if ($target) {
2496                 # check if storage is available on target node
2497                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2498                 # clone only works if target storage is shared
2499                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2500                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2501             }
2502         }
2503
2504         PVE::Cluster::check_cfs_quorum();
2505
2506         my $running = PVE::QemuServer::check_running($vmid) || 0;
2507
2508         # exclusive lock if VM is running - else shared lock is enough;
2509         my $shared_lock = $running ? 0 : 1;
2510
2511         my $clonefn = sub {
2512
2513             # do all tests after lock
2514             # we also try to do all tests before we fork the worker
2515
2516             my $conf = PVE::QemuConfig->load_config($vmid);
2517
2518             PVE::QemuConfig->check_lock($conf);
2519
2520             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2521
2522             die "unexpected state change\n" if $verify_running != $running;
2523
2524             die "snapshot '$snapname' does not exist\n"
2525                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2526
2527             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2528
2529             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2530
2531             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2532
2533             my $conffile = PVE::QemuConfig->config_file($newid);
2534
2535             die "unable to create VM $newid: config file already exists\n"
2536                 if -f $conffile;
2537
2538             my $newconf = { lock => 'clone' };
2539             my $drives = {};
2540             my $fullclone = {};
2541             my $vollist = [];
2542
2543             foreach my $opt (keys %$oldconf) {
2544                 my $value = $oldconf->{$opt};
2545
2546                 # do not copy snapshot related info
2547                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2548                     $opt eq 'vmstate' || $opt eq 'snapstate';
2549
2550                 # no need to copy unused images, because VMID(owner) changes anyways
2551                 next if $opt =~ m/^unused\d+$/;
2552
2553                 # always change MAC! address
2554                 if ($opt =~ m/^net(\d+)$/) {
2555                     my $net = PVE::QemuServer::parse_net($value);
2556                     my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
2557                     $net->{macaddr} =  PVE::Tools::random_ether_addr($dc->{mac_prefix});
2558                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2559                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
2560                     my $drive = PVE::QemuServer::parse_drive($opt, $value);
2561                     die "unable to parse drive options for '$opt'\n" if !$drive;
2562                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
2563                         $newconf->{$opt} = $value; # simply copy configuration
2564                     } else {
2565                         if ($param->{full}) {
2566                             die "Full clone feature is not supported for drive '$opt'\n"
2567                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2568                             $fullclone->{$opt} = 1;
2569                         } else {
2570                             # not full means clone instead of copy
2571                             die "Linked clone feature is not supported for drive '$opt'\n"
2572                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $drive->{file}, $snapname, $running);
2573                         }
2574                         $drives->{$opt} = $drive;
2575                         push @$vollist, $drive->{file};
2576                     }
2577                 } else {
2578                     # copy everything else
2579                     $newconf->{$opt} = $value;
2580                 }
2581             }
2582
2583             # auto generate a new uuid
2584             my ($uuid, $uuid_str);
2585             UUID::generate($uuid);
2586             UUID::unparse($uuid, $uuid_str);
2587             my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
2588             $smbios1->{uuid} = $uuid_str;
2589             $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
2590
2591             delete $newconf->{template};
2592
2593             if ($param->{name}) {
2594                 $newconf->{name} = $param->{name};
2595             } else {
2596                 if ($oldconf->{name}) {
2597                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2598                 } else {
2599                     $newconf->{name} = "Copy-of-VM-$vmid";
2600                 }
2601             }
2602
2603             if ($param->{description}) {
2604                 $newconf->{description} = $param->{description};
2605             }
2606
2607             # create empty/temp config - this fails if VM already exists on other node
2608             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2609
2610             my $realcmd = sub {
2611                 my $upid = shift;
2612
2613                 my $newvollist = [];
2614                 my $jobs = {};
2615
2616                 eval {
2617                     local $SIG{INT} =
2618                         local $SIG{TERM} =
2619                         local $SIG{QUIT} =
2620                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2621
2622                     PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
2623
2624                     my $total_jobs = scalar(keys %{$drives});
2625                     my $i = 1;
2626
2627                     foreach my $opt (keys %$drives) {
2628                         my $drive = $drives->{$opt};
2629                         my $skipcomplete = ($total_jobs != $i); # finish after last drive
2630
2631                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2632                                                                    $newid, $storage, $format, $fullclone->{$opt}, $newvollist,
2633                                                                    $jobs, $skipcomplete, $oldconf->{agent});
2634
2635                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2636
2637                         PVE::QemuConfig->write_config($newid, $newconf);
2638                         $i++;
2639                     }
2640
2641                     delete $newconf->{lock};
2642                     PVE::QemuConfig->write_config($newid, $newconf);
2643
2644                     if ($target) {
2645                         # always deactivate volumes - avoid lvm LVs to be active on several nodes
2646                         PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
2647                         PVE::Storage::deactivate_volumes($storecfg, $newvollist);
2648
2649                         my $newconffile = PVE::QemuConfig->config_file($newid, $target);
2650                         die "Failed to move config to node '$target' - rename failed: $!\n"
2651                             if !rename($conffile, $newconffile);
2652                     }
2653
2654                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2655                 };
2656                 if (my $err = $@) {
2657                     unlink $conffile;
2658
2659                     eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
2660
2661                     sleep 1; # some storage like rbd need to wait before release volume - really?
2662
2663                     foreach my $volid (@$newvollist) {
2664                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2665                         warn $@ if $@;
2666                     }
2667                     die "clone failed: $err";
2668                 }
2669
2670                 return;
2671             };
2672
2673             PVE::Firewall::clone_vmfw_conf($vmid, $newid);
2674
2675             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2676         };
2677
2678         return PVE::QemuConfig->lock_config_mode($vmid, 1, $shared_lock, sub {
2679             # Aquire exclusive lock lock for $newid
2680             return PVE::QemuConfig->lock_config_full($newid, 1, $clonefn);
2681         });
2682
2683     }});
2684
2685 __PACKAGE__->register_method({
2686     name => 'move_vm_disk',
2687     path => '{vmid}/move_disk',
2688     method => 'POST',
2689     protected => 1,
2690     proxyto => 'node',
2691     description => "Move volume to different storage.",
2692     permissions => {
2693         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, and 'Datastore.AllocateSpace' permissions on the storage.",
2694         check => [ 'and',
2695                    ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2696                    ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2697             ],
2698     },
2699     parameters => {
2700         additionalProperties => 0,
2701         properties => {
2702             node => get_standard_option('pve-node'),
2703             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2704             disk => {
2705                 type => 'string',
2706                 description => "The disk you want to move.",
2707                 enum => [ PVE::QemuServer::valid_drive_names() ],
2708             },
2709             storage => get_standard_option('pve-storage-id', {
2710                 description => "Target storage.",
2711                 completion => \&PVE::QemuServer::complete_storage,
2712             }),
2713             'format' => {
2714                 type => 'string',
2715                 description => "Target Format.",
2716                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2717                 optional => 1,
2718             },
2719             delete => {
2720                 type => 'boolean',
2721                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2722                 optional => 1,
2723                 default => 0,
2724             },
2725             digest => {
2726                 type => 'string',
2727                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2728                 maxLength => 40,
2729                 optional => 1,
2730             },
2731         },
2732     },
2733     returns => {
2734         type => 'string',
2735         description => "the task ID.",
2736     },
2737     code => sub {
2738         my ($param) = @_;
2739
2740         my $rpcenv = PVE::RPCEnvironment::get();
2741
2742         my $authuser = $rpcenv->get_user();
2743
2744         my $node = extract_param($param, 'node');
2745
2746         my $vmid = extract_param($param, 'vmid');
2747
2748         my $digest = extract_param($param, 'digest');
2749
2750         my $disk = extract_param($param, 'disk');
2751
2752         my $storeid = extract_param($param, 'storage');
2753
2754         my $format = extract_param($param, 'format');
2755
2756         my $storecfg = PVE::Storage::config();
2757
2758         my $updatefn =  sub {
2759
2760             my $conf = PVE::QemuConfig->load_config($vmid);
2761
2762             PVE::QemuConfig->check_lock($conf);
2763
2764             die "checksum missmatch (file change by other user?)\n"
2765                 if $digest && $digest ne $conf->{digest};
2766
2767             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2768
2769             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2770
2771             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2772
2773             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2774
2775             my $oldfmt;
2776             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2777             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2778                 $oldfmt = $1;
2779             }
2780
2781             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2782                 (!$format || !$oldfmt || $oldfmt eq $format);
2783
2784             # this only checks snapshots because $disk is passed!
2785             my $snapshotted = PVE::QemuServer::is_volume_in_use($storecfg, $conf, $disk, $old_volid);
2786             die "you can't move a disk with snapshots and delete the source\n"
2787                 if $snapshotted && $param->{delete};
2788
2789             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2790
2791             my $running = PVE::QemuServer::check_running($vmid);
2792
2793             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2794
2795             my $realcmd = sub {
2796
2797                 my $newvollist = [];
2798
2799                 eval {
2800                     local $SIG{INT} =
2801                         local $SIG{TERM} =
2802                         local $SIG{QUIT} =
2803                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2804
2805                     warn "moving disk with snapshots, snapshots will not be moved!\n"
2806                         if $snapshotted;
2807
2808                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2809                                                                $vmid, $storeid, $format, 1, $newvollist);
2810
2811                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2812
2813                     PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
2814
2815                     # convert moved disk to base if part of template
2816                     PVE::QemuServer::template_create($vmid, $conf, $disk)
2817                         if PVE::QemuConfig->is_template($conf);
2818
2819                     PVE::QemuConfig->write_config($vmid, $conf);
2820
2821                     eval {
2822                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
2823                         PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
2824                             if !$running;
2825                     };
2826                     warn $@ if $@;
2827                 };
2828                 if (my $err = $@) {
2829
2830                    foreach my $volid (@$newvollist) {
2831                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2832                         warn $@ if $@;
2833                     }
2834                     die "storage migration failed: $err";
2835                 }
2836
2837                 if ($param->{delete}) {
2838                     eval {
2839                         PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
2840                         PVE::Storage::vdisk_free($storecfg, $old_volid);
2841                     };
2842                     warn $@ if $@;
2843                 }
2844             };
2845
2846             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2847         };
2848
2849         return PVE::QemuConfig->lock_config($vmid, $updatefn);
2850     }});
2851
2852 __PACKAGE__->register_method({
2853     name => 'migrate_vm',
2854     path => '{vmid}/migrate',
2855     method => 'POST',
2856     protected => 1,
2857     proxyto => 'node',
2858     description => "Migrate virtual machine. Creates a new migration task.",
2859     permissions => {
2860         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2861     },
2862     parameters => {
2863         additionalProperties => 0,
2864         properties => {
2865             node => get_standard_option('pve-node'),
2866             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2867             target => get_standard_option('pve-node', {
2868                 description => "Target node.",
2869                 completion =>  \&PVE::Cluster::complete_migration_target,
2870             }),
2871             online => {
2872                 type => 'boolean',
2873                 description => "Use online/live migration.",
2874                 optional => 1,
2875             },
2876             force => {
2877                 type => 'boolean',
2878                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2879                 optional => 1,
2880             },
2881             migration_type => {
2882                 type => 'string',
2883                 enum => ['secure', 'insecure'],
2884                 description => "Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance.",
2885                 optional => 1,
2886             },
2887             migration_network => {
2888                 type => 'string', format => 'CIDR',
2889                 description => "CIDR of the (sub) network that is used for migration.",
2890                 optional => 1,
2891             },
2892             "with-local-disks" => {
2893                 type => 'boolean',
2894                 description => "Enable live storage migration for local disk",
2895                 optional => 1,
2896             },
2897             targetstorage => get_standard_option('pve-storage-id', {
2898                 description => "Default target storage.",
2899                 optional => 1,
2900                 completion => \&PVE::QemuServer::complete_storage,
2901             }),
2902         },
2903     },
2904     returns => {
2905         type => 'string',
2906         description => "the task ID.",
2907     },
2908     code => sub {
2909         my ($param) = @_;
2910
2911         my $rpcenv = PVE::RPCEnvironment::get();
2912
2913         my $authuser = $rpcenv->get_user();
2914
2915         my $target = extract_param($param, 'target');
2916
2917         my $localnode = PVE::INotify::nodename();
2918         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2919
2920         PVE::Cluster::check_cfs_quorum();
2921
2922         PVE::Cluster::check_node_exists($target);
2923
2924         my $targetip = PVE::Cluster::remote_node_ip($target);
2925
2926         my $vmid = extract_param($param, 'vmid');
2927
2928         raise_param_exc({ targetstorage => "Live storage migration can only be done online." })
2929             if !$param->{online} && $param->{targetstorage};
2930
2931         raise_param_exc({ force => "Only root may use this option." })
2932             if $param->{force} && $authuser ne 'root@pam';
2933
2934         raise_param_exc({ migration_type => "Only root may use this option." })
2935             if $param->{migration_type} && $authuser ne 'root@pam';
2936
2937         # allow root only until better network permissions are available
2938         raise_param_exc({ migration_network => "Only root may use this option." })
2939             if $param->{migration_network} && $authuser ne 'root@pam';
2940
2941         # test if VM exists
2942         my $conf = PVE::QemuConfig->load_config($vmid);
2943
2944         # try to detect errors early
2945
2946         PVE::QemuConfig->check_lock($conf);
2947
2948         if (PVE::QemuServer::check_running($vmid)) {
2949             die "cant migrate running VM without --online\n"
2950                 if !$param->{online};
2951         }
2952
2953         my $storecfg = PVE::Storage::config();
2954
2955         if( $param->{targetstorage}) {
2956             PVE::Storage::storage_check_node($storecfg, $param->{targetstorage}, $target);
2957         } else {
2958             PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2959         }
2960
2961         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2962
2963             my $hacmd = sub {
2964                 my $upid = shift;
2965
2966                 my $service = "vm:$vmid";
2967
2968                 my $cmd = ['ha-manager', 'migrate', $service, $target];
2969
2970                 print "Requesting HA migration for VM $vmid to node $target\n";
2971
2972                 PVE::Tools::run_command($cmd);
2973
2974                 return;
2975             };
2976
2977             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2978
2979         } else {
2980
2981             my $realcmd = sub {
2982                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2983             };
2984
2985             my $worker = sub {
2986                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
2987             };
2988
2989             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $worker);
2990         }
2991
2992     }});
2993
2994 __PACKAGE__->register_method({
2995     name => 'monitor',
2996     path => '{vmid}/monitor',
2997     method => 'POST',
2998     protected => 1,
2999     proxyto => 'node',
3000     description => "Execute Qemu monitor commands.",
3001     permissions => {
3002         description => "Sys.Modify is required for (sub)commands which are not read-only ('info *' and 'help')",
3003         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
3004     },
3005     parameters => {
3006         additionalProperties => 0,
3007         properties => {
3008             node => get_standard_option('pve-node'),
3009             vmid => get_standard_option('pve-vmid'),
3010             command => {
3011                 type => 'string',
3012                 description => "The monitor command.",
3013             }
3014         },
3015     },
3016     returns => { type => 'string'},
3017     code => sub {
3018         my ($param) = @_;
3019
3020         my $rpcenv = PVE::RPCEnvironment::get();
3021         my $authuser = $rpcenv->get_user();
3022
3023         my $is_ro = sub {
3024             my $command = shift;
3025             return $command =~ m/^\s*info(\s+|$)/
3026                 || $command =~ m/^\s*help\s*$/;
3027         };
3028
3029         $rpcenv->check_full($authuser, "/", ['Sys.Modify'])
3030             if !&$is_ro($param->{command});
3031
3032         my $vmid = $param->{vmid};
3033
3034         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3035
3036         my $res = '';
3037         eval {
3038             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
3039         };
3040         $res = "ERROR: $@" if $@;
3041
3042         return $res;
3043     }});
3044
3045 my $guest_agent_commands = [
3046     'ping',
3047     'get-time',
3048     'info',
3049     'fsfreeze-status',
3050     'fsfreeze-freeze',
3051     'fsfreeze-thaw',
3052     'fstrim',
3053     'network-get-interfaces',
3054     'get-vcpus',
3055     'get-fsinfo',
3056     'get-memory-blocks',
3057     'get-memory-block-info',
3058     'suspend-hybrid',
3059     'suspend-ram',
3060     'suspend-disk',
3061     'shutdown',
3062     ];
3063
3064 __PACKAGE__->register_method({
3065     name => 'agent',
3066     path => '{vmid}/agent',
3067     method => 'POST',
3068     protected => 1,
3069     proxyto => 'node',
3070     description => "Execute Qemu Guest Agent commands.",
3071     permissions => {
3072         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
3073     },
3074     parameters => {
3075         additionalProperties => 0,
3076         properties => {
3077             node => get_standard_option('pve-node'),
3078             vmid => get_standard_option('pve-vmid', {
3079                    completion => \&PVE::QemuServer::complete_vmid_running }),
3080             command => {
3081                 type => 'string',
3082                 description => "The QGA command.",
3083                 enum => $guest_agent_commands,
3084             },
3085         },
3086     },
3087     returns => {
3088         type => 'object',
3089         description => "Returns an object with a single `result` property. The type of that
3090 property depends on the executed command.",
3091     },
3092     code => sub {
3093         my ($param) = @_;
3094
3095         my $vmid = $param->{vmid};
3096
3097         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3098
3099         die "No Qemu Guest Agent\n" if !defined($conf->{agent});
3100         die "VM $vmid is not running\n" if !PVE::QemuServer::check_running($vmid);
3101
3102         my $cmd = $param->{command};
3103
3104         my $res = PVE::QemuServer::vm_mon_cmd($vmid, "guest-$cmd");
3105
3106         return { result => $res };
3107     }});
3108
3109 __PACKAGE__->register_method({
3110     name => 'resize_vm',
3111     path => '{vmid}/resize',
3112     method => 'PUT',
3113     protected => 1,
3114     proxyto => 'node',
3115     description => "Extend volume size.",
3116     permissions => {
3117         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
3118     },
3119     parameters => {
3120         additionalProperties => 0,
3121         properties => {
3122             node => get_standard_option('pve-node'),
3123             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3124             skiplock => get_standard_option('skiplock'),
3125             disk => {
3126                 type => 'string',
3127                 description => "The disk you want to resize.",
3128                 enum => [PVE::QemuServer::valid_drive_names()],
3129             },
3130             size => {
3131                 type => 'string',
3132                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
3133                 description => "The new size. With the `+` sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
3134             },
3135             digest => {
3136                 type => 'string',
3137                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
3138                 maxLength => 40,
3139                 optional => 1,
3140             },
3141         },
3142     },
3143     returns => { type => 'null'},
3144     code => sub {
3145         my ($param) = @_;
3146
3147         my $rpcenv = PVE::RPCEnvironment::get();
3148
3149         my $authuser = $rpcenv->get_user();
3150
3151         my $node = extract_param($param, 'node');
3152
3153         my $vmid = extract_param($param, 'vmid');
3154
3155         my $digest = extract_param($param, 'digest');
3156
3157         my $disk = extract_param($param, 'disk');
3158
3159         my $sizestr = extract_param($param, 'size');
3160
3161         my $skiplock = extract_param($param, 'skiplock');
3162         raise_param_exc({ skiplock => "Only root may use this option." })
3163             if $skiplock && $authuser ne 'root@pam';
3164
3165         my $storecfg = PVE::Storage::config();
3166
3167         my $updatefn =  sub {
3168
3169             my $conf = PVE::QemuConfig->load_config($vmid);
3170
3171             die "checksum missmatch (file change by other user?)\n"
3172                 if $digest && $digest ne $conf->{digest};
3173             PVE::QemuConfig->check_lock($conf) if !$skiplock;
3174
3175             die "disk '$disk' does not exist\n" if !$conf->{$disk};
3176
3177             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
3178
3179             my (undef, undef, undef, undef, undef, undef, $format) =
3180                 PVE::Storage::parse_volname($storecfg, $drive->{file});
3181
3182             die "can't resize volume: $disk if snapshot exists\n"
3183                 if %{$conf->{snapshots}} && $format eq 'qcow2';
3184
3185             my $volid = $drive->{file};
3186
3187             die "disk '$disk' has no associated volume\n" if !$volid;
3188
3189             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
3190
3191             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
3192
3193             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
3194
3195             PVE::Storage::activate_volumes($storecfg, [$volid]);
3196             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
3197
3198             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
3199             my ($ext, $newsize, $unit) = ($1, $2, $4);
3200             if ($unit) {
3201                 if ($unit eq 'K') {
3202                     $newsize = $newsize * 1024;
3203                 } elsif ($unit eq 'M') {
3204                     $newsize = $newsize * 1024 * 1024;
3205                 } elsif ($unit eq 'G') {
3206                     $newsize = $newsize * 1024 * 1024 * 1024;
3207                 } elsif ($unit eq 'T') {
3208                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
3209                 }
3210             }
3211             $newsize += $size if $ext;
3212             $newsize = int($newsize);
3213
3214             die "shrinking disks is not supported\n" if $newsize < $size;
3215
3216             return if $size == $newsize;
3217
3218             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
3219
3220             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
3221
3222             $drive->{size} = $newsize;
3223             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
3224
3225             PVE::QemuConfig->write_config($vmid, $conf);
3226         };
3227
3228         PVE::QemuConfig->lock_config($vmid, $updatefn);
3229         return undef;
3230     }});
3231
3232 __PACKAGE__->register_method({
3233     name => 'snapshot_list',
3234     path => '{vmid}/snapshot',
3235     method => 'GET',
3236     description => "List all snapshots.",
3237     permissions => {
3238         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
3239     },
3240     proxyto => 'node',
3241     protected => 1, # qemu pid files are only readable by root
3242     parameters => {
3243         additionalProperties => 0,
3244         properties => {
3245             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3246             node => get_standard_option('pve-node'),
3247         },
3248     },
3249     returns => {
3250         type => 'array',
3251         items => {
3252             type => "object",
3253             properties => {},
3254         },
3255         links => [ { rel => 'child', href => "{name}" } ],
3256     },
3257     code => sub {
3258         my ($param) = @_;
3259
3260         my $vmid = $param->{vmid};
3261
3262         my $conf = PVE::QemuConfig->load_config($vmid);
3263         my $snaphash = $conf->{snapshots} || {};
3264
3265         my $res = [];
3266
3267         foreach my $name (keys %$snaphash) {
3268             my $d = $snaphash->{$name};
3269             my $item = {
3270                 name => $name,
3271                 snaptime => $d->{snaptime} || 0,
3272                 vmstate => $d->{vmstate} ? 1 : 0,
3273                 description => $d->{description} || '',
3274             };
3275             $item->{parent} = $d->{parent} if $d->{parent};
3276             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
3277             push @$res, $item;
3278         }
3279
3280         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
3281         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
3282         $current->{parent} = $conf->{parent} if $conf->{parent};
3283
3284         push @$res, $current;
3285
3286         return $res;
3287     }});
3288
3289 __PACKAGE__->register_method({
3290     name => 'snapshot',
3291     path => '{vmid}/snapshot',
3292     method => 'POST',
3293     protected => 1,
3294     proxyto => 'node',
3295     description => "Snapshot a VM.",
3296     permissions => {
3297         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3298     },
3299     parameters => {
3300         additionalProperties => 0,
3301         properties => {
3302             node => get_standard_option('pve-node'),
3303             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3304             snapname => get_standard_option('pve-snapshot-name'),
3305             vmstate => {
3306                 optional => 1,
3307                 type => 'boolean',
3308                 description => "Save the vmstate",
3309             },
3310             description => {
3311                 optional => 1,
3312                 type => 'string',
3313                 description => "A textual description or comment.",
3314             },
3315         },
3316     },
3317     returns => {
3318         type => 'string',
3319         description => "the task ID.",
3320     },
3321     code => sub {
3322         my ($param) = @_;
3323
3324         my $rpcenv = PVE::RPCEnvironment::get();
3325
3326         my $authuser = $rpcenv->get_user();
3327
3328         my $node = extract_param($param, 'node');
3329
3330         my $vmid = extract_param($param, 'vmid');
3331
3332         my $snapname = extract_param($param, 'snapname');
3333
3334         die "unable to use snapshot name 'current' (reserved name)\n"
3335             if $snapname eq 'current';
3336
3337         my $realcmd = sub {
3338             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
3339             PVE::QemuConfig->snapshot_create($vmid, $snapname, $param->{vmstate},
3340                                              $param->{description});
3341         };
3342
3343         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
3344     }});
3345
3346 __PACKAGE__->register_method({
3347     name => 'snapshot_cmd_idx',
3348     path => '{vmid}/snapshot/{snapname}',
3349     description => '',
3350     method => 'GET',
3351     permissions => {
3352         user => 'all',
3353     },
3354     parameters => {
3355         additionalProperties => 0,
3356         properties => {
3357             vmid => get_standard_option('pve-vmid'),
3358             node => get_standard_option('pve-node'),
3359             snapname => get_standard_option('pve-snapshot-name'),
3360         },
3361     },
3362     returns => {
3363         type => 'array',
3364         items => {
3365             type => "object",
3366             properties => {},
3367         },
3368         links => [ { rel => 'child', href => "{cmd}" } ],
3369     },
3370     code => sub {
3371         my ($param) = @_;
3372
3373         my $res = [];
3374
3375         push @$res, { cmd => 'rollback' };
3376         push @$res, { cmd => 'config' };
3377
3378         return $res;
3379     }});
3380
3381 __PACKAGE__->register_method({
3382     name => 'update_snapshot_config',
3383     path => '{vmid}/snapshot/{snapname}/config',
3384     method => 'PUT',
3385     protected => 1,
3386     proxyto => 'node',
3387     description => "Update snapshot metadata.",
3388     permissions => {
3389         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3390     },
3391     parameters => {
3392         additionalProperties => 0,
3393         properties => {
3394             node => get_standard_option('pve-node'),
3395             vmid => get_standard_option('pve-vmid'),
3396             snapname => get_standard_option('pve-snapshot-name'),
3397             description => {
3398                 optional => 1,
3399                 type => 'string',
3400                 description => "A textual description or comment.",
3401             },
3402         },
3403     },
3404     returns => { type => 'null' },
3405     code => sub {
3406         my ($param) = @_;
3407
3408         my $rpcenv = PVE::RPCEnvironment::get();
3409
3410         my $authuser = $rpcenv->get_user();
3411
3412         my $vmid = extract_param($param, 'vmid');
3413
3414         my $snapname = extract_param($param, 'snapname');
3415
3416         return undef if !defined($param->{description});
3417
3418         my $updatefn =  sub {
3419
3420             my $conf = PVE::QemuConfig->load_config($vmid);
3421
3422             PVE::QemuConfig->check_lock($conf);
3423
3424             my $snap = $conf->{snapshots}->{$snapname};
3425
3426             die "snapshot '$snapname' does not exist\n" if !defined($snap);
3427
3428             $snap->{description} = $param->{description} if defined($param->{description});
3429
3430              PVE::QemuConfig->write_config($vmid, $conf);
3431         };
3432
3433         PVE::QemuConfig->lock_config($vmid, $updatefn);
3434
3435         return undef;
3436     }});
3437
3438 __PACKAGE__->register_method({
3439     name => 'get_snapshot_config',
3440     path => '{vmid}/snapshot/{snapname}/config',
3441     method => 'GET',
3442     proxyto => 'node',
3443     description => "Get snapshot configuration",
3444     permissions => {
3445         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3446     },
3447     parameters => {
3448         additionalProperties => 0,
3449         properties => {
3450             node => get_standard_option('pve-node'),
3451             vmid => get_standard_option('pve-vmid'),
3452             snapname => get_standard_option('pve-snapshot-name'),
3453         },
3454     },
3455     returns => { type => "object" },
3456     code => sub {
3457         my ($param) = @_;
3458
3459         my $rpcenv = PVE::RPCEnvironment::get();
3460
3461         my $authuser = $rpcenv->get_user();
3462
3463         my $vmid = extract_param($param, 'vmid');
3464
3465         my $snapname = extract_param($param, 'snapname');
3466
3467         my $conf = PVE::QemuConfig->load_config($vmid);
3468
3469         my $snap = $conf->{snapshots}->{$snapname};
3470
3471         die "snapshot '$snapname' does not exist\n" if !defined($snap);
3472
3473         return $snap;
3474     }});
3475
3476 __PACKAGE__->register_method({
3477     name => 'rollback',
3478     path => '{vmid}/snapshot/{snapname}/rollback',
3479     method => 'POST',
3480     protected => 1,
3481     proxyto => 'node',
3482     description => "Rollback VM state to specified snapshot.",
3483     permissions => {
3484         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3485     },
3486     parameters => {
3487         additionalProperties => 0,
3488         properties => {
3489             node => get_standard_option('pve-node'),
3490             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3491             snapname => get_standard_option('pve-snapshot-name'),
3492         },
3493     },
3494     returns => {
3495         type => 'string',
3496         description => "the task ID.",
3497     },
3498     code => sub {
3499         my ($param) = @_;
3500
3501         my $rpcenv = PVE::RPCEnvironment::get();
3502
3503         my $authuser = $rpcenv->get_user();
3504
3505         my $node = extract_param($param, 'node');
3506
3507         my $vmid = extract_param($param, 'vmid');
3508
3509         my $snapname = extract_param($param, 'snapname');
3510
3511         my $realcmd = sub {
3512             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
3513             PVE::QemuConfig->snapshot_rollback($vmid, $snapname);
3514         };
3515
3516         my $worker = sub {
3517             # hold migration lock, this makes sure that nobody create replication snapshots
3518             return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
3519         };
3520
3521         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $worker);
3522     }});
3523
3524 __PACKAGE__->register_method({
3525     name => 'delsnapshot',
3526     path => '{vmid}/snapshot/{snapname}',
3527     method => 'DELETE',
3528     protected => 1,
3529     proxyto => 'node',
3530     description => "Delete a VM snapshot.",
3531     permissions => {
3532         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3533     },
3534     parameters => {
3535         additionalProperties => 0,
3536         properties => {
3537             node => get_standard_option('pve-node'),
3538             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3539             snapname => get_standard_option('pve-snapshot-name'),
3540             force => {
3541                 optional => 1,
3542                 type => 'boolean',
3543                 description => "For removal from config file, even if removing disk snapshots fails.",
3544             },
3545         },
3546     },
3547     returns => {
3548         type => 'string',
3549         description => "the task ID.",
3550     },
3551     code => sub {
3552         my ($param) = @_;
3553
3554         my $rpcenv = PVE::RPCEnvironment::get();
3555
3556         my $authuser = $rpcenv->get_user();
3557
3558         my $node = extract_param($param, 'node');
3559
3560         my $vmid = extract_param($param, 'vmid');
3561
3562         my $snapname = extract_param($param, 'snapname');
3563
3564         my $realcmd = sub {
3565             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
3566             PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
3567         };
3568
3569         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
3570     }});
3571
3572 __PACKAGE__->register_method({
3573     name => 'template',
3574     path => '{vmid}/template',
3575     method => 'POST',
3576     protected => 1,
3577     proxyto => 'node',
3578     description => "Create a Template.",
3579     permissions => {
3580         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3581         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3582     },
3583     parameters => {
3584         additionalProperties => 0,
3585         properties => {
3586             node => get_standard_option('pve-node'),
3587             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
3588             disk => {
3589                 optional => 1,
3590                 type => 'string',
3591                 description => "If you want to convert only 1 disk to base image.",
3592                 enum => [PVE::QemuServer::valid_drive_names()],
3593             },
3594
3595         },
3596     },
3597     returns => { type => 'null'},
3598     code => sub {
3599         my ($param) = @_;
3600
3601         my $rpcenv = PVE::RPCEnvironment::get();
3602
3603         my $authuser = $rpcenv->get_user();
3604
3605         my $node = extract_param($param, 'node');
3606
3607         my $vmid = extract_param($param, 'vmid');
3608
3609         my $disk = extract_param($param, 'disk');
3610
3611         my $updatefn =  sub {
3612
3613             my $conf = PVE::QemuConfig->load_config($vmid);
3614
3615             PVE::QemuConfig->check_lock($conf);
3616
3617             die "unable to create template, because VM contains snapshots\n"
3618                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3619
3620             die "you can't convert a template to a template\n"
3621                 if PVE::QemuConfig->is_template($conf) && !$disk;
3622
3623             die "you can't convert a VM to template if VM is running\n"
3624                 if PVE::QemuServer::check_running($vmid);
3625
3626             my $realcmd = sub {
3627                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3628             };
3629
3630             $conf->{template} = 1;
3631             PVE::QemuConfig->write_config($vmid, $conf);
3632
3633             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3634         };
3635
3636         PVE::QemuConfig->lock_config($vmid, $updatefn);
3637         return undef;
3638     }});
3639
3640 1;