f-46: dhcpd: build dhcp replies over insomniacslk/dhcp #46

internal/dhcpd décide quelles options partent vers quelle MAC, sans I/O ni
état. L'encodage RFC 3442 de l'option 121 est délégué à la bibliothèque, qui le
teste elle-même.

L'option 3 est omise plutôt qu'envoyée vide : la dhcp-option=3 nue n'existait
que pour empêcher dnsmasq d'annoncer sa propre adresse. La route par défaut est
conditionnée au subnet (DefaultGateway) et à l'interface (Host.DefaultRoute),
ce qui remplace le mécanisme de tags.

24 tests plus un fuzz sur BuildReply. Les assertions d'encodage sont validées
par mutation.

Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>

internal/dhcpd/dhcpd.go

@@ -0,0 +1,29 @@
+package dhcpd
+
+import (
+	"net"
+	"time"
+)
+
+const LeaseTime = 12 * time.Hour
+
+func DNSServers() []net.IP {
+	return []net.IP{
+		net.IPv4(1, 1, 1, 1),
+		net.IPv4(8, 8, 8, 8),
+	}
+}
+
+type SubnetConfig struct {
+	Network        *net.IPNet
+	InterfaceIP    net.IP
+	VPCRoute       *net.IPNet
+	DefaultGateway net.IP
+}
+
+type Host struct {
+	MAC          net.HardwareAddr
+	IP           net.IP
+	VM           string
+	DefaultRoute bool
+}

internal/dhcpd/fuzz_test.go

@@ -0,0 +1,59 @@
+package dhcpd
+
+import (
+	"net"
+	"testing"
+
+	"github.com/insomniacslk/dhcp/dhcpv4"
+)
+
+func FuzzBuildReply(f *testing.F) {
+	mac, err := net.ParseMAC("00:22:33:00:00:0a")
+	if err != nil {
+		f.Fatalf("ParseMAC: %v", err)
+	}
+	for _, kind := range []dhcpv4.MessageType{
+		dhcpv4.MessageTypeDiscover,
+		dhcpv4.MessageTypeRequest,
+		dhcpv4.MessageTypeRelease,
+		dhcpv4.MessageTypeDecline,
+	} {
+		req, err := dhcpv4.New(dhcpv4.WithMessageType(kind), dhcpv4.WithHwAddr(mac))
+		if err != nil {
+			f.Fatalf("New request: %v", err)
+		}
+		f.Add(req.ToBytes())
+	}
+
+	_, network, err := net.ParseCIDR("10.0.5.0/24")
+	if err != nil {
+		f.Fatalf("ParseCIDR: %v", err)
+	}
+	_, vpcRoute, err := net.ParseCIDR("10.0.0.0/16")
+	if err != nil {
+		f.Fatalf("ParseCIDR: %v", err)
+	}
+
+	c := SubnetConfig{
+		Network:        network,
+		InterfaceIP:    net.ParseIP("10.0.5.1"),
+		VPCRoute:       vpcRoute,
+		DefaultGateway: net.ParseIP("10.0.5.254"),
+	}
+	h := Host{MAC: mac, IP: net.ParseIP("10.0.5.10"), VM: "vm-fuzz", DefaultRoute: true}
+
+	f.Fuzz(func(t *testing.T, raw []byte) {
+		req, err := dhcpv4.FromBytes(raw)
+		if err != nil {
+			return
+		}
+		reply, err := BuildReply(c, h, req)
+		if err != nil {
+			return
+		}
+		if reply == nil {
+			t.Fatal("nil reply without an error")
+		}
+		reply.ToBytes()
+	})
+}

internal/dhcpd/reply.go

@@ -0,0 +1,97 @@
+package dhcpd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+
+	"git.g3e.fr/syonad/two/internal/metadata"
+
+	"github.com/insomniacslk/dhcp/dhcpv4"
+)
+
+var (
+	ErrNoInterfaceIP = errors.New("interface ip is required: guests would have no route to the metadata server")
+	ErrNoNetwork     = errors.New("subnet network is required")
+	ErrNoHostIP      = errors.New("host ip is required")
+	ErrNoRequest     = errors.New("request is nil")
+)
+
+func metadataRoute() *net.IPNet {
+	return &net.IPNet{
+		IP:   net.ParseIP(metadata.ServiceIP).To4(),
+		Mask: net.CIDRMask(32, 32),
+	}
+}
+
+func defaultRoute() *net.IPNet {
+	return &net.IPNet{
+		IP:   net.IPv4zero.To4(),
+		Mask: net.CIDRMask(0, 32),
+	}
+}
+
+func Routes(c SubnetConfig, h Host) (dhcpv4.Routes, error) {
+	if c.InterfaceIP == nil {
+		return nil, ErrNoInterfaceIP
+	}
+
+	routes := dhcpv4.Routes{{Dest: metadataRoute(), Router: c.InterfaceIP}}
+
+	if c.VPCRoute != nil {
+		routes = append(routes, &dhcpv4.Route{Dest: c.VPCRoute, Router: c.InterfaceIP})
+	}
+	if h.DefaultRoute && c.DefaultGateway != nil {
+		routes = append(routes, &dhcpv4.Route{Dest: defaultRoute(), Router: c.DefaultGateway})
+	}
+	return routes, nil
+}
+
+func replyType(req *dhcpv4.DHCPv4) (dhcpv4.MessageType, error) {
+	switch req.MessageType() {
+	case dhcpv4.MessageTypeDiscover:
+		return dhcpv4.MessageTypeOffer, nil
+	case dhcpv4.MessageTypeRequest:
+		return dhcpv4.MessageTypeAck, nil
+	default:
+		return 0, fmt.Errorf("no reply built for message type %s", req.MessageType())
+	}
+}
+
+func BuildReply(c SubnetConfig, h Host, req *dhcpv4.DHCPv4) (*dhcpv4.DHCPv4, error) {
+	if req == nil {
+		return nil, ErrNoRequest
+	}
+	if c.Network == nil {
+		return nil, ErrNoNetwork
+	}
+	if h.IP == nil {
+		return nil, ErrNoHostIP
+	}
+
+	kind, err := replyType(req)
+	if err != nil {
+		return nil, err
+	}
+
+	routes, err := Routes(c, h)
+	if err != nil {
+		return nil, err
+	}
+
+	mods := []dhcpv4.Modifier{
+		dhcpv4.WithMessageType(kind),
+		dhcpv4.WithServerIP(c.InterfaceIP),
+		dhcpv4.WithYourIP(h.IP),
+		dhcpv4.WithNetmask(c.Network.Mask),
+		dhcpv4.WithLeaseTime(uint32(LeaseTime.Seconds())),
+		dhcpv4.WithOption(dhcpv4.OptServerIdentifier(c.InterfaceIP)),
+		dhcpv4.WithOption(dhcpv4.OptDNS(DNSServers()...)),
+		dhcpv4.WithOption(dhcpv4.OptClasslessStaticRoute(routes...)),
+	}
+	if h.DefaultRoute && c.DefaultGateway != nil {
+		mods = append(mods, dhcpv4.WithOption(dhcpv4.OptRouter(c.DefaultGateway)))
+	}
+
+	return dhcpv4.NewReplyFromRequest(req, mods...)
+}

internal/dhcpd/reply_test.go

@@ -0,0 +1,326 @@
+package dhcpd
+
+import (
+	"bytes"
+	"errors"
+	"net"
+	"testing"
+
+	"git.g3e.fr/syonad/two/internal/metadata"
+
+	"github.com/insomniacslk/dhcp/dhcpv4"
+)
+
+func cidr(t *testing.T, s string) *net.IPNet {
+	t.Helper()
+	_, n, err := net.ParseCIDR(s)
+	if err != nil {
+		t.Fatalf("ParseCIDR(%q): %v", s, err)
+	}
+	return n
+}
+
+func testConfig(t *testing.T) SubnetConfig {
+	t.Helper()
+	return SubnetConfig{
+		Network:     cidr(t, "10.0.5.0/24"),
+		InterfaceIP: net.ParseIP("10.0.5.1"),
+	}
+}
+
+func testHost(t *testing.T) Host {
+	t.Helper()
+	mac, err := net.ParseMAC("00:22:33:00:00:0a")
+	if err != nil {
+		t.Fatalf("ParseMAC: %v", err)
+	}
+	return Host{MAC: mac, IP: net.ParseIP("10.0.5.10"), VM: "vm-test", DefaultRoute: true}
+}
+
+func request(t *testing.T, kind dhcpv4.MessageType, mac net.HardwareAddr) *dhcpv4.DHCPv4 {
+	t.Helper()
+	req, err := dhcpv4.New(dhcpv4.WithMessageType(kind), dhcpv4.WithHwAddr(mac))
+	if err != nil {
+		t.Fatalf("New request: %v", err)
+	}
+	return req
+}
+
+func encodedRoute(t *testing.T, routes dhcpv4.Routes, dest string) []byte {
+	t.Helper()
+	for _, r := range routes {
+		if r.Dest.String() == dest {
+			return dhcpv4.Routes{r}.ToBytes()
+		}
+	}
+	t.Fatalf("no route to %s in %s", dest, routes)
+	return nil
+}
+
+func TestRoutes_AlwaysCarriesTheMetadataRoute(t *testing.T) {
+	c := testConfig(t)
+	routes, err := Routes(c, Host{IP: net.ParseIP("10.0.5.10")})
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+	if len(routes) != 1 {
+		t.Fatalf("expected the metadata route alone, got %s", routes)
+	}
+	if got := routes[0].Dest.String(); got != metadata.ServiceIP+"/32" {
+		t.Errorf("destination = %s, want %s/32", got, metadata.ServiceIP)
+	}
+	if !routes[0].Router.Equal(c.InterfaceIP) {
+		t.Errorf("next-hop = %s, want the subnet interface ip %s", routes[0].Router, c.InterfaceIP)
+	}
+}
+
+func TestRoutes_WithoutInterfaceIPIsRejected(t *testing.T) {
+	_, err := Routes(SubnetConfig{Network: cidr(t, "10.0.5.0/24")}, testHost(t))
+	if !errors.Is(err, ErrNoInterfaceIP) {
+		t.Fatalf("error = %v, want ErrNoInterfaceIP", err)
+	}
+}
+
+func TestRoutes_VPCRouteUsesTheInterfaceIPAsNextHop(t *testing.T) {
+	c := testConfig(t)
+	c.VPCRoute = cidr(t, "10.0.0.0/16")
+	c.DefaultGateway = net.ParseIP("192.0.2.1")
+
+	routes, err := Routes(c, testHost(t))
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+	for _, r := range routes {
+		if r.Dest.String() != "10.0.0.0/16" {
+			continue
+		}
+		if !r.Router.Equal(c.InterfaceIP) {
+			t.Fatalf("vpc route next-hop = %s, want %s", r.Router, c.InterfaceIP)
+		}
+		return
+	}
+	t.Fatalf("no vpc route in %s", routes)
+}
+
+func TestRoutes_NoDefaultRouteWithoutDefaultGateway(t *testing.T) {
+	routes, err := Routes(testConfig(t), testHost(t))
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+	for _, r := range routes {
+		if ones, _ := r.Dest.Mask.Size(); ones == 0 {
+			t.Fatalf("unexpected default route in %s", routes)
+		}
+	}
+}
+
+func TestRoutes_NoDefaultRouteWhenTheInterfaceDoesNotReceiveIt(t *testing.T) {
+	c := testConfig(t)
+	c.DefaultGateway = net.ParseIP("10.0.5.254")
+
+	h := testHost(t)
+	h.DefaultRoute = false
+
+	routes, err := Routes(c, h)
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+	for _, r := range routes {
+		if ones, _ := r.Dest.Mask.Size(); ones == 0 {
+			t.Fatalf("a secondary interface must not receive the default route, got %s", routes)
+		}
+	}
+}
+
+func TestRoutes_DefaultRouteEncodesZeroDestinationOctets(t *testing.T) {
+	c := testConfig(t)
+	c.DefaultGateway = net.ParseIP("10.0.5.254")
+
+	routes, err := Routes(c, testHost(t))
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+
+	want := []byte{0x00, 10, 0, 5, 254}
+	if got := encodedRoute(t, routes, "0.0.0.0/0"); !bytes.Equal(got, want) {
+		t.Errorf("default route encoding = % x, want % x", got, want)
+	}
+}
+
+func TestRoutes_UnalignedPrefixEncodesOnlyItsSignificantOctets(t *testing.T) {
+	c := testConfig(t)
+	c.VPCRoute = cidr(t, "10.16.0.0/12")
+
+	routes, err := Routes(c, testHost(t))
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+
+	want := []byte{0x0c, 10, 16, 10, 0, 5, 1}
+	if got := encodedRoute(t, routes, "10.16.0.0/12"); !bytes.Equal(got, want) {
+		t.Errorf("/12 encoding = % x, want % x", got, want)
+	}
+}
+
+func TestRoutes_MetadataRouteEncodesOnFourDestinationOctets(t *testing.T) {
+	routes, err := Routes(testConfig(t), testHost(t))
+	if err != nil {
+		t.Fatalf("Routes: %v", err)
+	}
+
+	want := []byte{0x20, 169, 254, 169, 254, 10, 0, 5, 1}
+	if got := encodedRoute(t, routes, metadata.ServiceIP+"/32"); !bytes.Equal(got, want) {
+		t.Errorf("metadata route encoding = % x, want % x", got, want)
+	}
+}
+
+func TestBuildReply_DiscoverIsAnsweredWithAnOffer(t *testing.T) {
+	h := testHost(t)
+	reply, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeDiscover, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+	if reply.MessageType() != dhcpv4.MessageTypeOffer {
+		t.Errorf("message type = %s, want OFFER", reply.MessageType())
+	}
+}
+
+func TestBuildReply_RequestIsAnsweredWithAnAck(t *testing.T) {
+	h := testHost(t)
+	reply, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeRequest, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+	if reply.MessageType() != dhcpv4.MessageTypeAck {
+		t.Errorf("message type = %s, want ACK", reply.MessageType())
+	}
+}
+
+func TestBuildReply_ReleaseGetsNoReply(t *testing.T) {
+	h := testHost(t)
+	if _, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeRelease, h.MAC)); err == nil {
+		t.Fatal("a RELEASE must not produce a reply")
+	}
+}
+
+func TestBuildReply_DeclineGetsNoReply(t *testing.T) {
+	h := testHost(t)
+	if _, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeDecline, h.MAC)); err == nil {
+		t.Fatal("a DECLINE must not produce a reply")
+	}
+}
+
+func TestBuildReply_CarriesAddressMaskLeaseAndServerIdentifier(t *testing.T) {
+	c := testConfig(t)
+	h := testHost(t)
+
+	reply, err := BuildReply(c, h, request(t, dhcpv4.MessageTypeRequest, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+
+	if !reply.YourIPAddr.Equal(h.IP) {
+		t.Errorf("yiaddr = %s, want %s", reply.YourIPAddr, h.IP)
+	}
+	if got := net.IP(reply.SubnetMask()).String(); got != net.IP(c.Network.Mask).String() {
+		t.Errorf("netmask = %s, want %s", got, net.IP(c.Network.Mask))
+	}
+	if got := reply.IPAddressLeaseTime(0); got != LeaseTime {
+		t.Errorf("lease time = %s, want %s", got, LeaseTime)
+	}
+	if got := reply.ServerIdentifier(); !got.Equal(c.InterfaceIP) {
+		t.Errorf("server identifier = %s, want %s", got, c.InterfaceIP)
+	}
+	if got := reply.DNS(); len(got) != 2 || !got[0].Equal(net.IPv4(1, 1, 1, 1)) || !got[1].Equal(net.IPv4(8, 8, 8, 8)) {
+		t.Errorf("dns = %v, want 1.1.1.1 and 8.8.8.8", got)
+	}
+}
+
+func TestBuildReply_NoRouterOptionWithoutDefaultRoute(t *testing.T) {
+	h := testHost(t)
+	reply, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeRequest, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+	if got := reply.Router(); len(got) != 0 {
+		t.Errorf("router option = %v, want none: the guest would use the server as its gateway", got)
+	}
+}
+
+func TestBuildReply_RouterOptionCarriesTheDefaultGateway(t *testing.T) {
+	c := testConfig(t)
+	c.DefaultGateway = net.ParseIP("10.0.5.254")
+
+	h := testHost(t)
+	reply, err := BuildReply(c, h, request(t, dhcpv4.MessageTypeRequest, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+
+	got := reply.Router()
+	if len(got) != 1 || !got[0].Equal(c.DefaultGateway) {
+		t.Errorf("router option = %v, want [%s]", got, c.DefaultGateway)
+	}
+}
+
+func TestBuildReply_SecondaryInterfaceGetsNoRouterOption(t *testing.T) {
+	c := testConfig(t)
+	c.DefaultGateway = net.ParseIP("10.0.5.254")
+
+	h := testHost(t)
+	h.DefaultRoute = false
+
+	reply, err := BuildReply(c, h, request(t, dhcpv4.MessageTypeRequest, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+	if got := reply.Router(); len(got) != 0 {
+		t.Errorf("router option = %v, want none on a secondary interface", got)
+	}
+}
+
+func TestBuildReply_ClasslessStaticRouteIsPresent(t *testing.T) {
+	h := testHost(t)
+	reply, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeRequest, h.MAC))
+	if err != nil {
+		t.Fatalf("BuildReply: %v", err)
+	}
+	if got := reply.ClasslessStaticRoute(); len(got) == 0 {
+		t.Fatal("option 121 missing: cloud-init would have no route to the metadata server")
+	}
+}
+
+func TestBuildReply_WithoutInterfaceIPIsRejected(t *testing.T) {
+	c := testConfig(t)
+	c.InterfaceIP = nil
+
+	h := testHost(t)
+	if _, err := BuildReply(c, h, request(t, dhcpv4.MessageTypeRequest, h.MAC)); !errors.Is(err, ErrNoInterfaceIP) {
+		t.Fatalf("error = %v, want ErrNoInterfaceIP", err)
+	}
+}
+
+func TestBuildReply_WithoutNetworkIsRejected(t *testing.T) {
+	c := testConfig(t)
+	c.Network = nil
+
+	h := testHost(t)
+	if _, err := BuildReply(c, h, request(t, dhcpv4.MessageTypeRequest, h.MAC)); !errors.Is(err, ErrNoNetwork) {
+		t.Fatalf("error = %v, want ErrNoNetwork", err)
+	}
+}
+
+func TestBuildReply_WithoutHostIPIsRejected(t *testing.T) {
+	h := testHost(t)
+	h.IP = nil
+
+	if _, err := BuildReply(testConfig(t), h, request(t, dhcpv4.MessageTypeRequest, testHost(t).MAC)); !errors.Is(err, ErrNoHostIP) {
+		t.Fatalf("error = %v, want ErrNoHostIP", err)
+	}
+}
+
+func TestBuildReply_NilRequestIsRejected(t *testing.T) {
+	if _, err := BuildReply(testConfig(t), testHost(t), nil); !errors.Is(err, ErrNoRequest) {
+		t.Fatalf("error = %v, want ErrNoRequest", err)
+	}
+}