From 745b9ea8f0df58ccd68215360b0375e89c0632a8 Mon Sep 17 00:00:00 2001 From: Indrajit Raychaudhuri Date: Wed, 27 Dec 2023 01:51:35 -0600 Subject: dhcp: T3316: Adjust kea lease files' location and permissions Move the kea lease file to a separate directory `/config/dhcp` that `kea` process can write to so that subprocesses spawned by `kea` process can operate on the lease files. To allow `kea` process to write to `/config/dhcp`, add `_kea` user to `vyattacfg` group. And the lease files are owned completely by `_kea` user to play well with `kea-lfc` process. Specifically, this is necessary for `kea-lfc` which is spawned by `kea` process to clean up expired leases. Since `kea-lfc` creates additional backup lease files, it needs write access to the lease file directory. Additionally, change the extension of the lease file from `.leases` to `.csv` to reflect the actual file format. --- src/conf_mode/dhcp_server.py | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) (limited to 'src/conf_mode/dhcp_server.py') diff --git a/src/conf_mode/dhcp_server.py b/src/conf_mode/dhcp_server.py index c1308cda7..7ebc560ba 100755 --- a/src/conf_mode/dhcp_server.py +++ b/src/conf_mode/dhcp_server.py @@ -27,9 +27,10 @@ from vyos.pki import wrap_private_key from vyos.template import render from vyos.utils.dict import dict_search from vyos.utils.dict import dict_search_args +from vyos.utils.file import chmod_775 +from vyos.utils.file import makedir from vyos.utils.file import write_file from vyos.utils.process import call -from vyos.utils.process import run from vyos.utils.network import is_subnet_connected from vyos.utils.network import is_addr_assigned from vyos import ConfigError @@ -39,8 +40,9 @@ airbag.enable() ctrl_config_file = '/run/kea/kea-ctrl-agent.conf' ctrl_socket = '/run/kea/dhcp4-ctrl-socket' config_file = '/run/kea/kea-dhcp4.conf' -lease_file = '/config/dhcp4.leases' +lease_file = '/config/dhcp/dhcp4-leases.csv' systemd_override = r'/run/systemd/system/kea-ctrl-agent.service.d/10-override.conf' +user_group = '_kea' ca_cert_file = '/run/kea/kea-failover-ca.pem' cert_file = '/run/kea/kea-failover.pem' @@ -308,8 +310,15 @@ def generate(dhcp): dhcp['lease_file'] = lease_file dhcp['machine'] = os.uname().machine + # Create directory for lease file if necessary + lease_dir = os.path.dirname(lease_file) + if not os.path.isdir(lease_dir): + makedir(lease_dir, group='vyattacfg') + chmod_775(lease_dir) + + # Create lease file if necessary and let kea own it - 'kea-lfc' expects it that way if not os.path.exists(lease_file): - write_file(lease_file, '', user='_kea', group='vyattacfg', mode=0o755) + write_file(lease_file, '', user=user_group, group=user_group, mode=0o644) for f in [cert_file, cert_key_file, ca_cert_file]: if os.path.exists(f): @@ -320,8 +329,8 @@ def generate(dhcp): cert_name = dhcp['failover']['certificate'] cert_data = dhcp['pki']['certificate'][cert_name]['certificate'] key_data = dhcp['pki']['certificate'][cert_name]['private']['key'] - write_file(cert_file, wrap_certificate(cert_data), user='_kea', mode=0o600) - write_file(cert_key_file, wrap_private_key(key_data), user='_kea', mode=0o600) + write_file(cert_file, wrap_certificate(cert_data), user=user_group, mode=0o600) + write_file(cert_key_file, wrap_private_key(key_data), user=user_group, mode=0o600) dhcp['failover']['cert_file'] = cert_file dhcp['failover']['cert_key_file'] = cert_key_file @@ -329,14 +338,14 @@ def generate(dhcp): if 'ca_certificate' in dhcp['failover']: ca_cert_name = dhcp['failover']['ca_certificate'] ca_cert_data = dhcp['pki']['ca'][ca_cert_name]['certificate'] - write_file(ca_cert_file, wrap_certificate(ca_cert_data), user='_kea', mode=0o600) + write_file(ca_cert_file, wrap_certificate(ca_cert_data), user=user_group, mode=0o600) dhcp['failover']['ca_cert_file'] = ca_cert_file render(systemd_override, 'dhcp-server/10-override.conf.j2', dhcp) - render(ctrl_config_file, 'dhcp-server/kea-ctrl-agent.conf.j2', dhcp) - render(config_file, 'dhcp-server/kea-dhcp4.conf.j2', dhcp) + render(ctrl_config_file, 'dhcp-server/kea-ctrl-agent.conf.j2', dhcp, user=user_group, group=user_group) + render(config_file, 'dhcp-server/kea-dhcp4.conf.j2', dhcp, user=user_group, group=user_group) return None -- cgit v1.2.3