From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <shanreich@lana.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id 257379B325
for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 15:55:15 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 6D59334365
for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 15:55:14 +0200 (CEST)
Received: from lana.proxmox.com (unknown [94.136.29.99])
by firstgate.proxmox.com (Proxmox) with ESMTP
for <pve-devel@lists.proxmox.com>; Tue, 17 Oct 2023 15:55:11 +0200 (CEST)
Received: by lana.proxmox.com (Postfix, from userid 10043)
id 012A92C251D; Tue, 17 Oct 2023 15:55:09 +0200 (CEST)
From: Stefan Hanreich <s.hanreich@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Tue, 17 Oct 2023 15:55:02 +0200
Message-Id: <20231017135507.2220948-6-s.hanreich@proxmox.com>
X-Mailer: git-send-email 2.39.2
In-Reply-To: <20231017135507.2220948-1-s.hanreich@proxmox.com>
References: <20231017135507.2220948-1-s.hanreich@proxmox.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.454 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery
methods
RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_NONE 0.001 SPF: sender does not publish an SPF Record
Subject: [pve-devel] [WIP v2 pve-network 05/10] dhcp: add DHCP plugin for
dnsmasq
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 17 Oct 2023 13:55:15 -0000
The plugin generates several dnsmasq configuration files from the SDN
configuration.
/etc/default/dnsmasq.<dhcp_id>
This file specifies the configuration directory for the dnsmasq
instance (/etc/dnsmasq.d/<dhcp_id>). It also sets the configuration
file to /dev/null so the default configuration from the package has
no influence on the dnsmasq configuration.
/etc/dnsmasq.d/<dhcp_id>/00-default.conf
The default configration does several things:
* disable DNS functionality.
* make dnsmasq listen only on the interfaces where it should provide
DHCP (contrary to the default configuration, which listens on all
interfaces). This is particularly important when running multiple
instances of dnsmasq.
* Set the lease file to /var/lib/misc/dnsmasq.<dhcp_id>.leases
* add some security-related settings
* add some platform-specific settings
* set dnsmasq to only hand out IP addresses to known hosts
/etc/dnsmasq.d/<dhcp_id>/10-<subnet_id>.conf
This file contains the subnet specific settings, which usually
includes:
* Listen address
* Default gateway (for IPv4)
* DNS server
/etc/dnsmasq.d/<dhcp_id>/10-<subnet_id>-ranges.conf
This file contains the DHCP ranges configured for the subnet
<subnet_id>.
/etc/dnsmasq.d/<dhcp_id>/ethers
This file contains the MAC address to IP mappings for all VMs and CTs
that should be used by dnsmasq DHCP. There is no need to split them on
a subnet level, since the MAC <-> IP mappings should always be unique.
Currently regenerating and reloading dnsmasq is very sledgehammery. It
deletes all existing subnet configuration files and disables + stops
all currently running dnsmasq instances. Then it enables + starts all
dnsmasq instances that have been recreated. I intend to improve this
behaviour in the future either by getting access to the old
configuration or using systemd targets.
Adding new MAC address mappings is done with a simple reload that does
not disrupt the dnsmasq daemon in any way.
This plugin currently only works for simple Zones with subnets that
have a gateway configured, since I use the gateway as listening
address for dnsmasq.
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
debian/control | 1 +
src/PVE/Network/SDN/Dhcp/Dnsmasq.pm | 186 ++++++++++++++++++++++++++++
src/PVE/Network/SDN/Dhcp/Makefile | 2 +-
3 files changed, 188 insertions(+), 1 deletion(-)
create mode 100644 src/PVE/Network/SDN/Dhcp/Dnsmasq.pm
diff --git a/debian/control b/debian/control
index 8b720c3..4424096 100644
--- a/debian/control
+++ b/debian/control
@@ -24,6 +24,7 @@ Depends: libpve-common-perl (>= 5.0-45),
${misc:Depends},
${perl:Depends},
Recommends: frr-pythontools (>= 8.5.1~), ifupdown2
+Suggests: dnsmasq
Description: Proxmox VE's SDN (Software Defined Network) stack
This package contains the Software Defined Network (tech preview) for
Proxmox VE.
diff --git a/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm b/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm
new file mode 100644
index 0000000..af109b8
--- /dev/null
+++ b/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm
@@ -0,0 +1,186 @@
+package PVE::Network::SDN::Dhcp::Dnsmasq;
+
+use strict;
+use warnings;
+
+use base qw(PVE::Network::SDN::Dhcp::Plugin);
+
+use Net::IP qw(:PROC);
+use PVE::Tools qw(file_set_contents run_command lock_file);
+
+use File::Copy;
+
+my $DNSMASQ_CONFIG_ROOT = '/etc/dnsmasq.d';
+my $DNSMASQ_DEFAULT_ROOT = '/etc/default';
+my $DNSMASQ_LEASE_ROOT = '/var/lib/misc';
+
+sub type {
+ return 'dnsmasq';
+}
+
+sub del_ip_mapping {
+ my ($class, $dhcp_config, $mac) = @_;
+
+ my $ethers_file = "$DNSMASQ_CONFIG_ROOT/$dhcp_config->{id}/ethers";
+ my $ethers_tmp_file = "$ethers_file.tmp";
+
+ my $removeFn = sub {
+ open(my $in, '<', $ethers_file) or die "Could not open file '$ethers_file' $!\n";
+ open(my $out, '>', $ethers_tmp_file) or die "Could not open file '$ethers_tmp_file' $!\n";
+
+ while (my $line = <$in>) {
+ next if $line =~ m/^$mac/;
+ print $out $line;
+ }
+
+ close $in;
+ close $out;
+
+ move $ethers_tmp_file, $ethers_file;
+
+ chmod 0644, $ethers_file;
+ };
+
+ PVE::Tools::lock_file($ethers_file, 10, $removeFn);
+
+ if ($@) {
+ warn "Unable to remove $mac from the dnsmasq configuration: $@\n";
+ return;
+ }
+
+ my $service_name = "dnsmasq\@$dhcp_config->{id}";
+ PVE::Tools::run_command(['systemctl', 'reload', $service_name]);
+}
+
+sub add_ip_mapping {
+ my ($class, $dhcp_config, $mac, $ip) = @_;
+ my $ethers_file = "$DNSMASQ_CONFIG_ROOT/$dhcp_config->{id}/ethers";
+
+ my $appendFn = sub {
+ open(my $fh, '>>', $ethers_file) or die "Could not open file '$ethers_file' $!\n";
+ print $fh "$mac,$ip\n";
+ close $fh;
+ };
+
+ PVE::Tools::lock_file($ethers_file, 10, $appendFn);
+
+ if ($@) {
+ warn "Unable to add $mac/$ip to the dnsmasq configuration: $@\n";
+ return;
+ }
+
+ my $service_name = "dnsmasq\@$dhcp_config->{id}";
+ PVE::Tools::run_command(['systemctl', 'reload', $service_name]);
+}
+
+sub configure_subnet {
+ my ($class, $dhcp_config, $subnet_config) = @_;
+
+ die "No gateway defined for subnet $subnet_config->{id}"
+ if !$subnet_config->{gateway};
+
+ my $tag = $subnet_config->{id};
+
+ my @dnsmasq_config = (
+ "listen-address=$subnet_config->{gateway}",
+ );
+
+ my $option_string;
+ if (ip_is_ipv6($subnet_config->{network})) {
+ $option_string = 'option6';
+ push @dnsmasq_config, "enable-ra";
+ } else {
+ $option_string = 'option';
+ push @dnsmasq_config, "dhcp-option=tag:$tag,$option_string:router,$subnet_config->{gateway}";
+ }
+
+ push @dnsmasq_config, "dhcp-option=tag:$tag,$option_string:dns-server,$subnet_config->{'dhcp-dns-server'}"
+ if $subnet_config->{'dhcp-dns-server'};
+
+ PVE::Tools::file_set_contents(
+ "$DNSMASQ_CONFIG_ROOT/$dhcp_config->{id}/10-$subnet_config->{id}.conf",
+ join("\n", @dnsmasq_config) . "\n"
+ );
+}
+
+sub configure_range {
+ my ($class, $dhcp_config, $subnet_config, $range_config) = @_;
+
+ my $range_file = "$DNSMASQ_CONFIG_ROOT/$dhcp_config->{id}/10-$subnet_config->{id}.ranges.conf",
+ my $tag = $subnet_config->{id};
+
+ open(my $fh, '>>', $range_file) or die "Could not open file '$range_file' $!\n";
+ print $fh "dhcp-range=set:$tag,$range_config->{'start-address'},$range_config->{'end-address'}\n";
+ close $fh;
+}
+
+sub before_configure {
+ my ($class, $dhcp_config) = @_;
+
+ my $config_directory = "$DNSMASQ_CONFIG_ROOT/$dhcp_config->{id}";
+
+ mkdir($config_directory, 755) if !-d $config_directory;
+
+ my $default_config = <<CFG;
+CONFIG_DIR='$config_directory,\*.conf'
+DNSMASQ_OPTS="--conf-file=/dev/null"
+CFG
+
+ PVE::Tools::file_set_contents(
+ "$DNSMASQ_DEFAULT_ROOT/dnsmasq.$dhcp_config->{id}",
+ $default_config
+ );
+
+ my $default_dnsmasq_config = <<CFG;
+except-interface=lo
+bind-dynamic
+no-resolv
+no-hosts
+dhcp-leasefile=$DNSMASQ_LEASE_ROOT/dnsmasq.$dhcp_config->{id}.leases
+dhcp-hostsfile=$config_directory/ethers
+dhcp-ignore=tag:!known
+
+# Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.
+dhcp-option=252,"\\n"
+
+# Send microsoft-specific option to tell windows to release the DHCP lease
+# when it shuts down. Note the "i" flag, to tell dnsmasq to send the
+# value as a four-byte integer - that's what microsoft wants.
+dhcp-option=vendor:MSFT,2,1i
+
+# If a DHCP client claims that its name is "wpad", ignore that.
+# This fixes a security hole. see CERT Vulnerability VU#598349
+dhcp-name-match=set:wpad-ignore,wpad
+dhcp-ignore-names=tag:wpad-ignore
+CFG
+
+ PVE::Tools::file_set_contents(
+ "$config_directory/00-default.conf",
+ $default_dnsmasq_config
+ );
+
+ unlink glob "$config_directory/10-*.conf";
+}
+
+sub after_configure {
+ my ($class, $dhcp_config) = @_;
+
+ my $service_name = "dnsmasq\@$dhcp_config->{id}";
+
+ PVE::Tools::run_command(['systemctl', 'enable', $service_name]);
+ PVE::Tools::run_command(['systemctl', 'restart', $service_name]);
+}
+
+sub before_regenerate {
+ my ($class) = @_;
+
+ PVE::Tools::run_command(['systemctl', 'stop', "dnsmasq@*"]);
+ PVE::Tools::run_command(['systemctl', 'disable', 'dnsmasq@']);
+}
+
+sub after_regenerate {
+ my ($class) = @_;
+ # noop
+}
+
+1;
diff --git a/src/PVE/Network/SDN/Dhcp/Makefile b/src/PVE/Network/SDN/Dhcp/Makefile
index 1e9b6d3..6546513 100644
--- a/src/PVE/Network/SDN/Dhcp/Makefile
+++ b/src/PVE/Network/SDN/Dhcp/Makefile
@@ -1,4 +1,4 @@
-SOURCES=Plugin.pm
+SOURCES=Plugin.pm Dnsmasq.pm
PERL5DIR=${DESTDIR}/usr/share/perl5
--
2.39.2