subnet: dhcp: do not allow overlapping dhcp ranges

Check for overlapping DHCP ranges and reject them if there are any
overlaps. If we can be certain that there are no overlapping DHCP
ranges this saves us from running into errors later in IPAM modules
where overlapping DHCP ranges are not allowed.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Hannes Duerr <h.duerr@proxmox.com>
Link: https://lore.proxmox.com/20250307125056.169575-4-s.hanreich@proxmox.com
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/Network/SDN/SubnetPlugin.pm b/src/PVE/Network/SDN/SubnetPlugin.pm
index 81adc885ed63f7ace2ac161a37b83919bddada19..8a79eaea75307eac9d823fab4a89bc402e94892f 100644 (file)
--- a/src/PVE/Network/SDN/SubnetPlugin.pm
+++ b/src/PVE/Network/SDN/SubnetPlugin.pm
@@ -3,7 +3,7 @@ package PVE::Network::SDN::SubnetPlugin;
 use strict;
 use warnings;
 
-use Net::IP;
+use Net::IP qw($IP_NO_OVERLAP);
 use Net::Subnet qw(subnet_matcher);
 
 use PVE::Cluster qw(cfs_read_file cfs_write_file cfs_lock_file);
@@ -82,6 +82,8 @@ sub validate_dhcp_ranges {
 
     my $dhcp_ranges = PVE::Network::SDN::Subnets::get_dhcp_ranges($subnet);
 
+    my $validated_ranges = [];
+
     foreach my $dhcp_range (@$dhcp_ranges) {
        my $dhcp_start = $dhcp_range->{'start-address'};
        my $dhcp_end = $dhcp_range->{'end-address'};
@@ -102,6 +104,15 @@ sub validate_dhcp_ranges {
 
        raise_param_exc({ 'dhcp-range' => "start-address $dhcp_start is not in subnet $cidr" }) if !$subnet_matcher->($dhcp_start);
        raise_param_exc({ 'dhcp-range' => "end-address $dhcp_end is not in subnet $cidr" }) if !$subnet_matcher->($dhcp_end);
+
+       my $ip_range = Net::IP->new("$dhcp_range->{'start-address'} - $dhcp_range->{'end-address'}");
+       for my $other_range (@$validated_ranges) {
+           if ($ip_range->overlaps($other_range) != $Net::IP::IP_NO_OVERLAP) {
+               raise_param_exc({ 'dhcp-range' => "dhcp ranges must not overlap" });
+           }
+       }
+
+       push @$validated_ranges, $ip_range;
     }
 }