Merge pull request #452 from jjakob/T2486-dns-hostsd-fixes

T2486: DNS, vyos-hostsd fixes

2 files changed, 159 insertions, 139 deletions

diff --git a/src/conf_mode/dns_forwarding.py b/src/conf_mode/dns_forwarding.py
index 692ac2456..51631dc16 100755
--- a/src/conf_mode/dns_forwarding.py
+++ b/src/conf_mode/dns_forwarding.py
@@ -15,49 +15,45 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
-import argparse
 
 from sys import exit
 from copy import deepcopy
 
 from vyos.config import Config
 from vyos.hostsd_client import Client as hostsd_client
-from vyos.util import wait_for_commit_lock
 from vyos import ConfigError
-from vyos.util import call
+from vyos.util import call, chown
 from vyos.template import render
 
 from vyos import airbag
 airbag.enable()
 
-parser = argparse.ArgumentParser()
-parser.add_argument("--dhclient", action="store_true",
-                    help="Started from dhclient-script")
-
-config_file = r'/run/powerdns/recursor.conf'
+pdns_rec_user = pdns_rec_group = 'pdns'
+pdns_rec_run_dir = '/run/powerdns'
+pdns_rec_lua_conf_file = f'{pdns_rec_run_dir}/recursor.conf.lua'
+pdns_rec_hostsd_lua_conf_file = f'{pdns_rec_run_dir}/recursor.vyos-hostsd.conf.lua'
+pdns_rec_hostsd_zones_file = f'{pdns_rec_run_dir}/recursor.forward-zones.conf'
+pdns_rec_config_file = f'{pdns_rec_run_dir}/recursor.conf'
 
 default_config_data = {
     'allow_from': [],
     'cache_size': 10000,
     'export_hosts_file': 'yes',
-    'listen_on': [],
+    'listen_address': [],
     'name_servers': [],
     'negative_ttl': 3600,
-    'domains': [],
-    'dnssec': 'process-no-validate'
+    'system': False,
+    'domains': {},
+    'dnssec': 'process-no-validate',
+    'dhcp_interfaces': []
 }
 
+hostsd_tag = 'static'
 
-def get_config(arguments):
+def get_config(conf):
     dns = deepcopy(default_config_data)
-    conf = Config()
     base = ['service', 'dns', 'forwarding']
 
-    if arguments.dhclient:
-        conf.exists = conf.exists_effective
-        conf.return_value = conf.return_effective_value
-        conf.return_values = conf.return_effective_values
-
     if not conf.exists(base):
         return None
 
@@ -75,53 +71,35 @@ def get_config(arguments):
         dns['negative_ttl'] = negative_ttl
 
     if conf.exists(['domain']):
-        for node in conf.list_nodes(['domain']):
-            servers = conf.return_values(['domain', node, 'server'])
-            domain = {
-                "name": node,
-                "servers": bracketize_ipv6_addrs(servers)
+        for domain in conf.list_nodes(['domain']):
+            conf.set_level(base + ['domain', domain])
+            entry = {
+                'nslist': bracketize_ipv6_addrs(conf.return_values(['server'])),
+                'addNTA': conf.exists(['addnta']),
+                'recursion-desired': conf.exists(['recursion-desired'])
             }
-            dns['domains'].append(domain)
+            dns['domains'][domain] = entry
+
+        conf.set_level(base)
 
     if conf.exists(['ignore-hosts-file']):
         dns['export_hosts_file'] = "no"
 
     if conf.exists(['name-server']):
-        name_servers = conf.return_values(['name-server'])
-        dns['name_servers'] = dns['name_servers'] + name_servers
+        dns['name_servers'] = bracketize_ipv6_addrs(
+                conf.return_values(['name-server']))
 
     if conf.exists(['system']):
-        conf.set_level(['system'])
-        system_name_servers = []
-        system_name_servers = conf.return_values(['name-server'])
-        if not system_name_servers:
-            print("DNS forwarding warning: No name-servers set under 'system name-server'\n")
-        else:
-            dns['name_servers'] = dns['name_servers'] + system_name_servers
-        conf.set_level(base)
-
-    dns['name_servers'] = bracketize_ipv6_addrs(dns['name_servers'])
+        dns['system'] = True
 
     if conf.exists(['listen-address']):
-        dns['listen_on'] = conf.return_values(['listen-address'])
+        dns['listen_address'] = conf.return_values(['listen-address'])
 
     if conf.exists(['dnssec']):
         dns['dnssec'] = conf.return_value(['dnssec'])
 
-    # Add name servers received from DHCP
     if conf.exists(['dhcp']):
-        interfaces = []
-        interfaces = conf.return_values(['dhcp'])
-        hc = hostsd_client()
-
-        for interface in interfaces:
-            dhcp_resolvers = hc.get_name_servers(f'dhcp-{interface}')
-            dhcpv6_resolvers = hc.get_name_servers(f'dhcpv6-{interface}')
-
-            if dhcp_resolvers:
-                dns['name_servers'] = dns['name_servers'] + dhcp_resolvers
-            if dhcpv6_resolvers:
-                dns['name_servers'] = dns['name_servers'] + dhcpv6_resolvers
+        dns['dhcp_interfaces'] = conf.return_values(['dhcp'])
 
     return dns
 
@@ -129,14 +107,14 @@ def bracketize_ipv6_addrs(addrs):
     """Wraps each IPv6 addr in addrs in [], leaving IPv4 addrs untouched."""
     return ['[{0}]'.format(a) if a.count(':') > 1 else a for a in addrs]
 
-def verify(dns):
+def verify(conf, dns):
     # bail out early - looks like removal from running config
     if dns is None:
         return None
 
-    if not dns['listen_on']:
+    if not dns['listen_address']:
         raise ConfigError(
-            "Error: DNS forwarding requires either a listen-address (preferred) or a listen-on option")
+            "Error: DNS forwarding requires a listen-address")
 
     if not dns['allow_from']:
         raise ConfigError(
@@ -144,9 +122,22 @@ def verify(dns):
 
     if dns['domains']:
         for domain in dns['domains']:
-            if not domain['servers']:
-                raise ConfigError(
-                    'Error: No server configured for domain {0}'.format(domain['name']))
+            if not dns['domains'][domain]['nslist']:
+                raise ConfigError((
+                    f'Error: No server configured for domain {domain}'))
+
+    no_system_nameservers = False
+    if dns['system'] and not (
+            conf.exists(['system', 'name-server']) or
+            conf.exists(['system', 'name-servers-dhcp']) ):
+        no_system_nameservers = True
+        print(("DNS forwarding warning: No 'system name-server' or "
+                "'system name-servers-dhcp' set\n"))
+
+    if (no_system_nameservers or not dns['system']) and not (
+            dns['name_servers'] or dns['dhcp_interfaces']):
+        print(("DNS forwarding warning: No 'dhcp', 'name-server' or 'system' "
+            "nameservers set. Forwarding will operate as a recursor.\n"))
 
     return None
 
@@ -155,29 +146,69 @@ def generate(dns):
     if dns is None:
         return None
 
-    render(config_file, 'dns-forwarding/recursor.conf.tmpl', dns, trim_blocks=True, user='pdns', group='pdns')
+    render(pdns_rec_config_file, 'dns-forwarding/recursor.conf.tmpl',
+            dns, user=pdns_rec_user, group=pdns_rec_group)
+
+    render(pdns_rec_lua_conf_file, 'dns-forwarding/recursor.conf.lua.tmpl',
+            dns, user=pdns_rec_user, group=pdns_rec_group)
+
+    # if vyos-hostsd didn't create its files yet, create them (empty)
+    for f in [pdns_rec_hostsd_lua_conf_file, pdns_rec_hostsd_zones_file]:
+        with open(f, 'a'):
+            pass
+        chown(f, user=pdns_rec_user, group=pdns_rec_group)
+
     return None
 
 def apply(dns):
     if dns is None:
         # DNS forwarding is removed in the commit
         call("systemctl stop pdns-recursor.service")
-        if os.path.isfile(config_file):
-            os.unlink(config_file)
+        if os.path.isfile(pdns_rec_config_file):
+            os.unlink(pdns_rec_config_file)
     else:
-        call("systemctl restart pdns-recursor.service")
+        ### first apply vyos-hostsd config
+        hc = hostsd_client()
 
-if __name__ == '__main__':
-    args = parser.parse_args()
+        # add static nameservers to hostsd so they can be joined with other
+        # sources
+        hc.delete_name_servers([hostsd_tag])
+        if dns['name_servers']:
+            hc.add_name_servers({hostsd_tag: dns['name_servers']})
+
+        # delete all nameserver tags
+        hc.delete_name_server_tags_recursor(hc.get_name_server_tags_recursor())
+
+        ## add nameserver tags - the order determines the nameserver order!
+        # our own tag (static)
+        hc.add_name_server_tags_recursor([hostsd_tag])
+
+        if dns['system']:
+            hc.add_name_server_tags_recursor(['system'])
+        else:
+            hc.delete_name_server_tags_recursor(['system'])
+
+        # add dhcp nameserver tags for configured interfaces
+        for intf in dns['dhcp_interfaces']:
+            hc.add_name_server_tags_recursor(['dhcp-' + intf, 'dhcpv6-' + intf ])
+
+        # hostsd will generate the forward-zones file
+        # the list and keys() are required as get returns a dict, not list
+        hc.delete_forward_zones(list(hc.get_forward_zones().keys()))
+        if dns['domains']:
+            hc.add_forward_zones(dns['domains'])
 
-    if args.dhclient:
-        # There's a big chance it was triggered by a commit still in progress
-        # so we need to wait until the new values are in the running config
-        wait_for_commit_lock()
+        # call hostsd to generate forward-zones and its lua-config-file
+        hc.apply()
 
+        ### finally (re)start pdns-recursor
+        call("systemctl restart pdns-recursor.service")
+
+if __name__ == '__main__':
     try:
-        c = get_config(args)
-        verify(c)
+        conf = Config()
+        c = get_config(conf)
+        verify(conf, c)
         generate(c)
         apply(c)
     except ConfigError as e:
diff --git a/src/conf_mode/host_name.py b/src/conf_mode/host_name.py
index dbc587d7d..3e301477d 100755
--- a/src/conf_mode/host_name.py
+++ b/src/conf_mode/host_name.py
@@ -41,19 +41,21 @@ default_config_data = {
     'domain_name': '',
     'domain_search': [],
     'nameserver': [],
-    'no_dhcp_ns': False
+    'nameservers_dhcp_interfaces': [],
+    'static_host_mapping': {}
 }
 
-def get_config():
-    conf = Config()
+hostsd_tag = 'system'
+
+def get_config(conf):
     hosts = copy.deepcopy(default_config_data)
 
-    if conf.exists("system host-name"):
-        hosts['hostname'] = conf.return_value("system host-name")
-        # This may happen if the config is not loaded yet,
-        # e.g. if run by cloud-init
-        if not hosts['hostname']:
-            hosts['hostname'] = default_config_data['hostname']
+    hosts['hostname'] = conf.return_value("system host-name")
+
+    # This may happen if the config is not loaded yet,
+    # e.g. if run by cloud-init
+    if not hosts['hostname']:
+        hosts['hostname'] = default_config_data['hostname']
 
     if conf.exists("system domain-name"):
         hosts['domain_name'] = conf.return_value("system domain-name")
@@ -62,60 +64,50 @@ def get_config():
     for search in conf.return_values("system domain-search domain"):
         hosts['domain_search'].append(search)
 
-    if conf.exists("system name-server"):
-        hosts['nameserver'] = conf.return_values("system name-server")
+    hosts['nameserver'] = conf.return_values("system name-server")
 
-    if conf.exists("system disable-dhcp-nameservers"):
-        hosts['no_dhcp_ns'] = True
+    hosts['nameservers_dhcp_interfaces'] = conf.return_values("system name-servers-dhcp")
 
     # system static-host-mapping
-    hosts['static_host_mapping'] = []
-
-    if conf.exists('system static-host-mapping host-name'):
-        for hn in conf.list_nodes('system static-host-mapping host-name'):
-            mapping = {}
-            mapping['host'] = hn
-            mapping['address'] = conf.return_value('system static-host-mapping host-name {0} inet'.format(hn))
-            mapping['aliases'] = conf.return_values('system static-host-mapping host-name {0} alias'.format(hn))
-            hosts['static_host_mapping'].append(mapping)
+    for hn in conf.list_nodes('system static-host-mapping host-name'):
+        hosts['static_host_mapping'][hn] = {}
+        hosts['static_host_mapping'][hn]['address'] = conf.return_value(f'system static-host-mapping host-name {hn} inet')
+        hosts['static_host_mapping'][hn]['aliases'] = conf.return_values(f'system static-host-mapping host-name {hn} alias')
 
     return hosts
 
 
-def verify(config):
-    if config is None:
+def verify(conf, hosts):
+    if hosts is None:
         return None
 
     # pattern $VAR(@) "^[[:alnum:]][-.[:alnum:]]*[[:alnum:]]$" ; "invalid host name $VAR(@)"
     hostname_regex = re.compile("^[A-Za-z0-9][-.A-Za-z0-9]*[A-Za-z0-9]$")
-    if not hostname_regex.match(config['hostname']):
-        raise ConfigError('Invalid host name ' + config["hostname"])
+    if not hostname_regex.match(hosts['hostname']):
+        raise ConfigError('Invalid host name ' + hosts["hostname"])
 
     # pattern $VAR(@) "^.{1,63}$" ; "invalid host-name length"
-    length = len(config['hostname'])
+    length = len(hosts['hostname'])
     if length < 1 or length > 63:
         raise ConfigError(
             'Invalid host-name length, must be less than 63 characters')
 
-    # The search list is currently limited to six domains with a total of 256 characters.
-    # https://linux.die.net/man/5/resolv.conf
-    if len(config['domain_search']) > 6:
-        raise ConfigError(
-            'The search list is currently limited to six domains')
-
-    tmp = ' '.join(config['domain_search'])
-    if len(tmp) > 256:
-        raise ConfigError(
-            'The search list is currently limited to 256 characters')
-
+    all_static_host_mapping_addresses = []
     # static mappings alias hostname
-    if config['static_host_mapping']:
-        for m in config['static_host_mapping']:
-            if not m['address']:
-                raise ConfigError('IP address required for ' + m['host'])
-            for a in m['aliases']:
-                if not hostname_regex.match(a) and len(a) != 0:
-                    raise ConfigError('Invalid alias \'{0}\' in mapping {1}'.format(a, m['host']))
+    for host, hostprops in hosts['static_host_mapping'].items():
+        if not hostprops['address']:
+            raise ConfigError(f'IP address required for static-host-mapping "{host}"')
+        if hostprops['address'] in all_static_host_mapping_addresses:
+            raise ConfigError((
+                f'static-host-mapping "{host}" address "{hostprops["address"]}"'
+                f'already used in another static-host-mapping'))
+        all_static_host_mapping_addresses.append(hostprops['address'])
+        for a in hostprops['aliases']:
+            if not hostname_regex.match(a) and len(a) != 0:
+                raise ConfigError(f'Invalid alias "{a}" in static-host-mapping "{host}"')
+
+    # TODO: add warnings for nameservers_dhcp_interfaces if interface doesn't
+    # exist or doesn't have address dhcp(v6)
 
     return None
 
@@ -128,24 +120,32 @@ def apply(config):
         return None
 
     ## Send the updated data to vyos-hostsd
+    try:
+        hc = vyos.hostsd_client.Client()
 
-    # vyos-hostsd uses "tags" to identify data sources
-    tag = "static"
+        hc.set_host_name(config['hostname'], config['domain_name'])
 
-    try:
-        client = vyos.hostsd_client.Client()
+        hc.delete_search_domains([hostsd_tag])
+        if config['domain_search']:
+            hc.add_search_domains({hostsd_tag: config['domain_search']})
+
+        hc.delete_name_servers([hostsd_tag])
+        if config['nameserver']:
+            hc.add_name_servers({hostsd_tag: config['nameserver']})
 
-        # Check if disable-dhcp-nameservers is configured, and if yes - delete DNS servers added by DHCP
-        if config['no_dhcp_ns']:
-            client.delete_name_servers('dhcp-.+')
+        # add our own tag's (system) nameservers and search to resolv.conf
+        hc.delete_name_server_tags_system(hc.get_name_server_tags_system())
+        hc.add_name_server_tags_system([hostsd_tag])
 
-        client.set_host_name(config['hostname'], config['domain_name'], config['domain_search'])
+        # this will add the dhcp client nameservers to resolv.conf
+        for intf in config['nameservers_dhcp_interfaces']:
+            hc.add_name_server_tags_system([f'dhcp-{intf}', f'dhcpv6-{intf}'])
 
-        client.delete_name_servers(tag)
-        client.add_name_servers(tag, config['nameserver'])
+        hc.delete_hosts([hostsd_tag])
+        if config['static_host_mapping']:
+            hc.add_hosts({hostsd_tag: config['static_host_mapping']})
 
-        client.delete_hosts(tag)
-        client.add_hosts(tag, config['static_host_mapping'])
+        hc.apply()
     except vyos.hostsd_client.VyOSHostsdError as e:
         raise ConfigError(str(e))
 
@@ -167,25 +167,14 @@ def apply(config):
     if process_named_running('snmpd'):
         call('systemctl restart snmpd.service')
 
-    # restart pdns if it is used - we check for the control dir to not raise
-    # an exception on system startup
-    #
-    #   File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 128, in __run_command
-    #     raise ConfigSessionError(output)
-    # vyos.configsession.ConfigSessionError: [ system domain-name vyos.io ]
-    # Fatal: Unable to generate local temporary file in directory '/run/powerdns': No such file or directory
-    if os.path.isdir('/run/powerdns'):
-        ret = run('/usr/bin/rec_control --socket-dir=/run/powerdns ping')
-        if ret == 0:
-            call('systemctl restart pdns-recursor.service')
-
     return None
 
 
 if __name__ == '__main__':
     try:
-        c = get_config()
-        verify(c)
+        conf = Config()
+        c = get_config(conf)
+        verify(conf, c)
         generate(c)
         apply(c)
     except ConfigError as e: