dhcp: dnsmasq: untaint when deleting configuration files

[pve-network.git] / src / PVE / Network / SDN / Dhcp / Dnsmasq.pm

diff --git a/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm b/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm
index 80eb7cd76e9057fdc124df9d2d72cbf32223e1ed..2844943e66eedc168857a4357215da50b68e3c3e 100644 (file)
--- a/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm
+++ b/src/PVE/Network/SDN/Dhcp/Dnsmasq.pm
@@ -11,6 +11,8 @@ use PVE::Tools qw(file_set_contents run_command lock_file);
 use File::Copy;
 use Net::DBus;
 
+use PVE::RESTEnvironment qw(log_warn);
+
 my $DNSMASQ_CONFIG_ROOT = '/etc/dnsmasq.d';
 my $DNSMASQ_DEFAULT_ROOT = '/etc/default';
 my $DNSMASQ_LEASE_ROOT = '/var/lib/misc';
@@ -19,6 +21,18 @@ sub type {
     return 'dnsmasq';
 }
 
+my sub assert_dnsmasq_installed {
+    my ($noerr) = @_;
+
+    my $bin_path = "/usr/sbin/dnsmasq";
+    if (!-e $bin_path) {
+       return if $noerr; # just ignore, e.g., in case zone doesn't use DHCP at all
+       log_warn("please install the 'dnsmasq' package in order to use the DHCP feature!");
+       die "cannot reload with missing 'dnsmasq' package\n";
+    }
+    return 1;
+}
+
 sub add_ip_mapping {
     my ($class, $dhcpid, $macdb, $mac, $ip4, $ip6) = @_;
 
@@ -101,39 +115,29 @@ sub add_ip_mapping {
 }
 
 sub configure_subnet {
-    my ($class, $dhcpid, $subnet_config) = @_;
+    my ($class, $config, $dhcpid, $vnetid, $subnet_config) = @_;
 
     die "No gateway defined for subnet $subnet_config->{id}"
        if !$subnet_config->{gateway};
 
     my $tag = $subnet_config->{id};
 
-    my @dnsmasq_config = (
-       "listen-address=$subnet_config->{gateway}",
-    );
-
     my $option_string;
     if (ip_is_ipv6($subnet_config->{network})) {
        $option_string = 'option6';
-       push @dnsmasq_config, "enable-ra";
     } else {
        $option_string = 'option';
-       push @dnsmasq_config, "dhcp-option=tag:$tag,$option_string:router,$subnet_config->{gateway}";
+       push @{$config}, "dhcp-option=tag:$tag,$option_string:router,$subnet_config->{gateway}";
     }
 
-    push @dnsmasq_config, "dhcp-option=tag:$tag,$option_string:dns-server,$subnet_config->{'dhcp-dns-server'}"
+    push @{$config}, "dhcp-option=tag:$tag,$option_string:dns-server,$subnet_config->{'dhcp-dns-server'}"
        if $subnet_config->{'dhcp-dns-server'};
 
-    PVE::Tools::file_set_contents(
-       "$DNSMASQ_CONFIG_ROOT/$dhcpid/10-$subnet_config->{id}.conf",
-       join("\n", @dnsmasq_config) . "\n"
-    );
 }
 
 sub configure_range {
-    my ($class, $dhcpid, $subnet_config, $range_config) = @_;
+    my ($class, $config, $dhcpid, $vnetid, $subnet_config, $range_config) = @_;
 
-    my $subnet_file = "$DNSMASQ_CONFIG_ROOT/$dhcpid/10-$subnet_config->{id}.conf";
     my $tag = $subnet_config->{id};
 
     my ($zone, $network, $mask) = split(/-/, $tag);
@@ -143,9 +147,20 @@ sub configure_range {
        $mask = join( '.', unpack( "C4", pack( "N", $mask ) ) );
     }
 
-    open(my $fh, '>>', $subnet_file) or die "Could not open file '$subnet_file' $!\n";
-    print $fh "dhcp-range=set:$tag,$network,static,$mask,infinite\n";
-    close $fh;
+    push @{$config}, "dhcp-range=set:$tag,$network,static,$mask,infinite";
+}
+
+sub configure_vnet {
+    my ($class, $config, $dhcpid, $vnetid, $vnet_config) = @_;
+
+    return if @{$config} < 1;
+
+    push @{$config}, "interface=$vnetid";
+
+    PVE::Tools::file_set_contents(
+       "$DNSMASQ_CONFIG_ROOT/$dhcpid/10-$vnetid.conf",
+       join("\n", @{$config}) . "\n"
+    );
 }
 
 sub before_configure {
@@ -192,8 +207,9 @@ CFG
 
     my $default_dnsmasq_config = <<CFG;
 except-interface=lo
+enable-ra
+quiet-ra
 bind-dynamic
-no-resolv
 no-hosts
 dhcp-leasefile=$DNSMASQ_LEASE_ROOT/dnsmasq.$dhcpid.leases
 dhcp-hostsfile=$config_directory/ethers
@@ -218,11 +234,19 @@ CFG
        $default_dnsmasq_config
     );
 
-    unlink glob "$config_directory/10-*.conf";
+    my @config_files = ();
+    PVE::Tools::dir_glob_foreach($config_directory, '10-.*\.conf', sub {
+       my ($file) = @_;
+       push @config_files, "$config_directory/$file";
+    });
+
+    unlink @config_files;
 }
 
 sub after_configure {
-    my ($class, $dhcpid) = @_;
+    my ($class, $dhcpid, $noerr) = @_;
+
+    return if !assert_dnsmasq_installed($noerr);
 
     my $service_name = "dnsmasq\@$dhcpid";
 
@@ -232,7 +256,9 @@ sub after_configure {
 }
 
 sub before_regenerate {
-    my ($class) = @_;
+    my ($class, $noerr) = @_;
+
+    return if !assert_dnsmasq_installed($noerr);
 
     PVE::Tools::run_command(['systemctl', 'stop', "dnsmasq@*"]);
     PVE::Tools::run_command(['systemctl', 'disable', 'dnsmasq@']);