Merge lp:~gmb/maas/backport-generate-directives-to-1.7 into lp:maas/1.7

[Graham Binns]

Using $GENERATE directives, generate DNS A and PTR records for all addresses in each managed NodeGroupInterface's dynamic range, as long as that dynamic range uses IPv4.

Previously, hosts with addresses in the dynamic range were not resolvable through DNS, which caused problems with some Juju charms.

Backported from r3308 lp:maas.

[Julian Edwards (julian-edwards)]

Approve straight backport

review: Approve

[Raphaël Badin (rvb)]

Approve. But let's look into the edge cases Julian described this morning during the standup.

review: Approve

[Graham Binns (gmb)]

On 30 October 2014 09:32, Raphaël Badin <email address hidden> wrote:
> Approve. But let's look into the edge cases Julian described this morning during the standup.

Agreed. I'll merge the fixes for those, and the UI restrictions, into
this backport — unless you'd rather I did it separately.

=== modified file 'etc/maas/templates/dns/zone.template'
--- etc/maas/templates/dns/zone.template	2012-10-04 15:59:56 +0000
+++ etc/maas/templates/dns/zone.template	2014-10-29 22:31:20 +0000
@@ -12,6 +12,12 @@
               )
 
     IN  NS  {{domain}}.
+{{for type, directive in generate_directives.items()}}
+{{for iterator_values, rdns, hostname in directive}}
+$GENERATE {{iterator_values}} {{rdns}} IN {{type}} {{hostname}}
+{{endfor}}
+{{endfor}}
+
 {{for type, mapping in mappings.items()}}
 {{for item_from, item_to in mapping}}
 {{item_from}} IN {{type}} {{item_to}}

=== modified file 'src/maasserver/dns/tests/test_config.py'
--- src/maasserver/dns/tests/test_config.py	2014-10-15 11:22:22 +0000
+++ src/maasserver/dns/tests/test_config.py	2014-10-29 22:31:20 +0000
@@ -165,15 +165,15 @@
         # A forward lookup on the hostname returns the IP address.
         fqdn = "%s.%s" % (hostname, domain)
         forward_lookup_result = self.dig_resolve(fqdn, version=version)
-        self.assertEqual(
-            [ip], forward_lookup_result,
+        self.expectThat(
+            forward_lookup_result, Contains(ip),
             "Failed to resolve '%s' (results: '%s')." % (
                 fqdn, ','.join(forward_lookup_result)))
         # A reverse lookup on the IP address returns the hostname.
         reverse_lookup_result = self.dig_reverse_resolve(
             ip, version=version)
-        self.assertEqual(
-            ["%s." % fqdn], reverse_lookup_result,
+        self.expectThat(
+            reverse_lookup_result, Contains("%s." % fqdn),
             "Failed to reverse resolve '%s' (results: '%s')." % (
                 fqdn, ','.join(reverse_lookup_result)))
 

=== modified file 'src/maasserver/dns/tests/test_zonegenerator.py'
--- src/maasserver/dns/tests/test_zonegenerator.py	2014-09-15 14:28:28 +0000
+++ src/maasserver/dns/tests/test_zonegenerator.py	2014-10-29 22:31:20 +0000
@@ -393,14 +393,28 @@
         [interface] = nodegroup.get_managed_interfaces()
         networks_dict = ZoneGenerator._get_networks()
         retrieved_interface = networks_dict[nodegroup]
-        self.assertEqual([interface.network], retrieved_interface)
+        self.assertEqual(
+            [
+                (
+                    interface.network,
+                    (interface.ip_range_low, interface.ip_range_high)
+                )
+            ],
+            retrieved_interface)
 
     def test_get_networks_returns_multiple_networks(self):
         nodegroups = [self.make_node_group() for _ in range(3)]
         networks_dict = ZoneGenerator._get_networks()
         for nodegroup in nodegroups:
             [interface] = nodegroup.get_managed_interfaces()
-            self.assertEqual([interface.network], networks_dict[nodegroup])
+            self.assertEqual(
+                [
+                    (
+                        interface.network,
+                        (interface.ip_range_low, interface.ip_range_high),
+                    ),
+                ],
+                networks_dict[nodegroup])
 
     def test_get_networks_returns_managed_networks(self):
         nodegroups = [
@@ -415,7 +429,10 @@
         self.assertEqual(
             {
                 nodegroup: [
-                    interface.network
+                    (
+                        interface.network,
+                        (interface.ip_range_low, interface.ip_range_high),
+                    )
                     for interface in nodegroup.get_managed_interfaces()
                     ]
                 for nodegroup in nodegroups

=== modified file 'src/maasserver/dns/zonegenerator.py'
--- src/maasserver/dns/zonegenerator.py	2014-08-28 12:00:15 +0000
+++ src/maasserver/dns/zonegenerator.py	2014-10-29 22:31:20 +0000
@@ -29,7 +29,10 @@
 from maasserver.models.config import Config
 from maasserver.models.nodegroup import NodeGroup
 from maasserver.server_address import get_maas_facing_server_address
-from netaddr import IPAddress
+from netaddr import (
+    IPAddress,
+    IPRange,
+    )
 from provisioningserver.dns.zoneconfig import (
     DNSForwardZoneConfig,
     DNSReverseZoneConfig,
@@ -180,9 +183,18 @@
 
     @staticmethod
     def _get_networks():
-        """Return a lazily evaluated nodegroup:network dict."""
-        return lazydict(lambda ng: [
-            interface.network for interface in ng.get_managed_interfaces()])
+        """Return a lazily evaluated nodegroup:network_details dict.
+
+        network_details takes the form of a tuple of (network,
+        (network.ip_range_low, network.ip_range_high)).
+        """
+
+        def get_network(nodegroup):
+            return [
+                (iface.network, (iface.ip_range_low, iface.ip_range_high))
+                for iface in nodegroup.get_managed_interfaces()
+            ]
+        return lazydict(get_network)
 
     @staticmethod
     def _get_srv_mappings():
@@ -209,6 +221,12 @@
         forward_nodegroups = sorted(nodegroups, key=get_domain)
         for domain, nodegroups in groupby(forward_nodegroups, get_domain):
             nodegroups = list(nodegroups)
+            dynamic_ranges = [
+                interface.get_dynamic_ip_range()
+                for nodegroup in nodegroups
+                for interface in nodegroup.get_managed_interfaces()
+            ]
+
             # A forward zone encompassing all nodes in the same domain.
             yield DNSForwardZoneConfig(
                 domain, serial=serial, dns_ip=dns_ip,
@@ -217,7 +235,8 @@
                     for nodegroup in nodegroups
                     for hostname, ip in mappings[nodegroup].items()
                     },
-                srv_mapping=set(srv_mappings)
+                srv_mapping=set(srv_mappings),
+                dynamic_ranges=dynamic_ranges,
             )
 
     @staticmethod
@@ -226,11 +245,11 @@
         get_domain = lambda nodegroup: nodegroup.name
         reverse_nodegroups = sorted(nodegroups, key=networks.get)
         for nodegroup in reverse_nodegroups:
-            for network in networks[nodegroup]:
+            for network, dynamic_range in networks[nodegroup]:
                 mapping = mappings[nodegroup]
                 yield DNSReverseZoneConfig(
                     get_domain(nodegroup), serial=serial, mapping=mapping,
-                    network=network
+                    network=network, dynamic_ranges=[IPRange(*dynamic_range)]
                 )
 
     def __iter__(self):

=== modified file 'src/provisioningserver/dns/tests/test_zoneconfig.py'
--- src/provisioningserver/dns/tests/test_zoneconfig.py	2014-09-23 21:43:27 +0000
+++ src/provisioningserver/dns/tests/test_zoneconfig.py	2014-10-29 22:31:20 +0000
@@ -22,10 +22,12 @@
 import random
 
 from maastesting.factory import factory
+from maastesting.matchers import MockNotCalled
 from maastesting.testcase import MAASTestCase
 from netaddr import (
     IPAddress,
     IPNetwork,
+    IPRange,
     )
 from provisioningserver.dns.config import (
     get_dns_config_dir,
@@ -35,11 +37,14 @@
 from provisioningserver.dns.zoneconfig import (
     DNSForwardZoneConfig,
     DNSReverseZoneConfig,
+    intersect_iprange,
     )
 from testtools.matchers import (
     Contains,
     ContainsAll,
+    Equals,
     FileContains,
+    HasLength,
     IsInstance,
     MatchesAll,
     MatchesStructure,
@@ -187,10 +192,13 @@
             ipv4_hostname: [ipv4_ip],
             ipv6_hostname: [ipv6_ip],
         }
+        expected_generate_directives = (
+            DNSForwardZoneConfig.get_GENERATE_directives(network))
         srv = self.make_srv_record()
         dns_zone_config = DNSForwardZoneConfig(
             domain, serial=random.randint(1, 100),
-            mapping=mapping, dns_ip=dns_ip, srv_mapping=[srv])
+            mapping=mapping, dns_ip=dns_ip, srv_mapping=[srv],
+            dynamic_ranges=[IPRange(network.first, network.last)])
         dns_zone_config.write_config()
         self.assertThat(
             os.path.join(target_dir, 'zone.%s' % domain),
@@ -201,6 +209,12 @@
                             srv.service, self.get_srv_item_output(srv)),
                         '%s IN A %s' % (ipv4_hostname, ipv4_ip),
                         '%s IN AAAA %s' % (ipv6_hostname, ipv6_ip),
+                    ] +
+                    [
+                        '$GENERATE %s %s IN A %s' % (
+                            iterator_values, reverse_dns, hostname)
+                        for iterator_values, reverse_dns, hostname in
+                        expected_generate_directives
                     ]
                 )
             )
@@ -222,6 +236,31 @@
                         '%s. IN A %s' % (dns_zone_config.domain, dns_ip),
                     ])))
 
+    def test_ignores_generate_directives_for_v6_dynamic_ranges(self):
+        patch_dns_config_path(self)
+        domain = factory.make_string()
+        network = factory.make_ipv4_network()
+        dns_ip = factory.pick_ip_in_network(network)
+        ipv4_hostname = factory.make_name('host')
+        ipv4_ip = factory.pick_ip_in_network(network)
+        ipv6_hostname = factory.make_name('host')
+        ipv6_ip = factory.make_ipv6_address()
+        ipv6_network = factory.make_ipv6_network()
+        dynamic_range = IPRange(ipv6_network.first, ipv6_network.last)
+        mapping = {
+            ipv4_hostname: [ipv4_ip],
+            ipv6_hostname: [ipv6_ip],
+        }
+        srv = self.make_srv_record()
+        dns_zone_config = DNSForwardZoneConfig(
+            domain, serial=random.randint(1, 100),
+            mapping=mapping, dns_ip=dns_ip, srv_mapping=[srv],
+            dynamic_ranges=[dynamic_range])
+        get_generate_directives = self.patch(
+            dns_zone_config, 'get_GENERATE_directives')
+        dns_zone_config.write_config()
+        self.assertThat(get_generate_directives, MockNotCalled())
+
     def test_config_file_is_world_readable(self):
         patch_dns_config_path(self)
         dns_zone_config = DNSForwardZoneConfig(
@@ -350,16 +389,43 @@
         target_dir = patch_dns_config_path(self)
         domain = factory.make_string()
         network = IPNetwork('192.168.0.1/22')
+        dynamic_network = IPNetwork('192.168.0.1/28')
         dns_zone_config = DNSReverseZoneConfig(
-            domain, serial=random.randint(1, 100), network=network)
+            domain, serial=random.randint(1, 100), network=network,
+            dynamic_ranges=[
+                IPRange(dynamic_network.first, dynamic_network.last)])
         dns_zone_config.write_config()
         reverse_file_name = 'zone.168.192.in-addr.arpa'
-        expected = Contains(
-            'IN  NS  %s' % domain)
+        expected_generate_directives = dns_zone_config.get_GENERATE_directives(
+            dynamic_network, domain)
+        expected = ContainsAll(
+            [
+                'IN  NS  %s' % domain
+            ] +
+            [
+                '$GENERATE %s %s IN PTR %s' % (
+                    iterator_values, reverse_dns, hostname)
+                for iterator_values, reverse_dns, hostname in
+                expected_generate_directives
+            ])
         self.assertThat(
             os.path.join(target_dir, reverse_file_name),
             FileContains(matcher=expected))
 
+    def test_ignores_generate_directives_for_v6_dynamic_ranges(self):
+        patch_dns_config_path(self)
+        domain = factory.make_string()
+        network = IPNetwork('192.168.0.1/22')
+        dynamic_network = IPNetwork("%s/64" % factory.make_ipv6_address())
+        dns_zone_config = DNSReverseZoneConfig(
+            domain, serial=random.randint(1, 100), network=network,
+            dynamic_ranges=[
+                IPRange(dynamic_network.first, dynamic_network.last)])
+        get_generate_directives = self.patch(
+            dns_zone_config, 'get_GENERATE_directives')
+        dns_zone_config.write_config()
+        self.assertThat(get_generate_directives, MockNotCalled())
+
     def test_reverse_config_file_is_world_readable(self):
         patch_dns_config_path(self)
         dns_zone_config = DNSReverseZoneConfig(
@@ -368,3 +434,286 @@
         dns_zone_config.write_config()
         filepath = FilePath(dns_zone_config.target_path)
         self.assertTrue(filepath.getPermissions().other.read)
+
+
+class TestDNSReverseZoneConfig_GetGenerateDirectives(MAASTestCase):
+    """Tests for `DNSReverseZoneConfig.get_GENERATE_directives()`."""
+
+    def test_excplicitly(self):
+        # The other tests in this TestCase rely on
+        # get_expected_generate_directives(), which is quite dense. Here
+        # we test get_GENERATE_directives() explicitly.
+        ip_range = IPRange('192.168.0.1', '192.168.2.128')
+        expected_directives = [
+            ("1-255", "$.0.168.192.in-addr.arpa.", "192-168-0-$.domain."),
+            ("0-255", "$.1.168.192.in-addr.arpa.", "192-168-1-$.domain."),
+            ("0-128", "$.2.168.192.in-addr.arpa.", "192-168-2-$.domain."),
+            ]
+        self.assertItemsEqual(
+            expected_directives,
+            DNSReverseZoneConfig.get_GENERATE_directives(
+                ip_range, domain="domain"))
+
+    def get_expected_generate_directives(self, network, domain):
+        ip_parts = network.network.format().split('.')
+        relevant_ip_parts = ip_parts[:-2]
+
+        first_address = IPAddress(network.first).format()
+        first_address_parts = first_address.split(".")
+
+        if network.size < 256:
+            last_address = IPAddress(network.last).format()
+            iterator_low = int(first_address_parts[-1])
+            iterator_high = last_address.split('.')[-1]
+        else:
+            iterator_low = 0
+            iterator_high = 255
+
+        second_octet_offset = int(first_address_parts[-2])
+        expected_generate_directives = []
+        directives_needed = network.size / 256
+
+        if directives_needed == 0:
+            directives_needed = 1
+        for num in range(directives_needed):
+            expected_address_base = "%s-%s" % tuple(relevant_ip_parts)
+            expected_address = "%s-%s-$" % (
+                expected_address_base, num + second_octet_offset)
+            relevant_ip_parts.reverse()
+            expected_rdns_base = (
+                "%s.%s.in-addr.arpa." % tuple(relevant_ip_parts))
+            expected_rdns_template = "$.%s.%s" % (
+                num + second_octet_offset, expected_rdns_base)
+            expected_generate_directives.append(
+                (
+                    "%s-%s" % (iterator_low, iterator_high),
+                    expected_rdns_template,
+                    "%s.%s." % (expected_address, domain)
+                ))
+            relevant_ip_parts.reverse()
+        return expected_generate_directives
+
+    def test_returns_single_entry_for_slash_24_network(self):
+        network = IPNetwork("%s/24" % factory.make_ipv4_address())
+        domain = factory.make_string()
+        expected_generate_directives = self.get_expected_generate_directives(
+            network, domain)
+        directives = DNSReverseZoneConfig.get_GENERATE_directives(
+            network, domain)
+        self.expectThat(directives, HasLength(1))
+        self.assertItemsEqual(expected_generate_directives, directives)
+
+    def test_returns_single_entry_for_tiny_network(self):
+        network = IPNetwork("%s/28" % factory.make_ipv4_address())
+        domain = factory.make_string()
+
+        expected_generate_directives = self.get_expected_generate_directives(
+            network, domain)
+        directives = DNSReverseZoneConfig.get_GENERATE_directives(
+            network, domain)
+        self.expectThat(directives, HasLength(1))
+        self.assertItemsEqual(expected_generate_directives, directives)
+
+    def test_returns_single_entry_for_weird_small_range(self):
+        ip_range = IPRange('10.0.0.1', '10.0.0.255')
+        domain = factory.make_string()
+        directives = DNSReverseZoneConfig.get_GENERATE_directives(
+            ip_range, domain)
+        self.expectThat(directives, HasLength(1))
+
+    def test_dtrt_for_larger_networks(self):
+        # For every other network size that we're not explicitly
+        # testing here,
+        # DNSReverseZoneConfig.get_GENERATE_directives() will return
+        # one GENERATE directive for every 255 addresses in the network.
+        for prefixlen in range(23, 17):
+            network = IPNetwork(
+                "%s/%s" % (factory.make_ipv4_address(), prefixlen))
+            domain = factory.make_string()
+            directives = DNSReverseZoneConfig.get_GENERATE_directives(
+                network, domain)
+            self.expectThat(directives, HasLength(network.size / 256))
+
+    def test_returns_two_entries_for_slash_23_network(self):
+        network = IPNetwork(factory.make_ipv4_network(slash=23))
+        domain = factory.make_string()
+
+        expected_generate_directives = self.get_expected_generate_directives(
+            network, domain)
+        directives = DNSReverseZoneConfig.get_GENERATE_directives(
+            network, domain)
+        self.expectThat(directives, HasLength(2))
+        self.assertItemsEqual(expected_generate_directives, directives)
+
+    def test_rejects_network_larger_than_slash_16(self):
+        network = IPNetwork("%s/15" % factory.make_ipv4_address())
+        error = self.assertRaises(
+            AssertionError, DNSReverseZoneConfig.get_GENERATE_directives,
+            network, None)
+        self.assertEqual(
+            "Cannot generate reverse zone mapping for any network larger "
+            "than /16.",
+            unicode(error))
+
+    def test_sorts_output_by_hostname(self):
+        network = IPNetwork("10.0.0.1/23")
+        domain = factory.make_string()
+
+        expected_hostname = "10-0-%s-$." + domain + "."
+        expected_rdns = "$.%s.0.10.in-addr.arpa."
+
+        directives = list(DNSReverseZoneConfig.get_GENERATE_directives(
+            network, domain))
+        self.expectThat(
+            directives[0], Equals(
+                ("0-255", expected_rdns % "0", expected_hostname % "0")))
+        self.expectThat(
+            directives[1], Equals(
+                ("0-255", expected_rdns % "1", expected_hostname % "1")))
+
+
+class TestDNSForwardZoneConfig_GetGenerateDirectives(MAASTestCase):
+    """Tests for `DNSForwardZoneConfig.get_GENERATE_directives()`."""
+
+    def test_excplicitly(self):
+        # The other tests in this TestCase rely on
+        # get_expected_generate_directives(), which is quite dense. Here
+        # we test get_GENERATE_directives() explicitly.
+        ip_range = IPRange('192.168.0.1', '192.168.2.128')
+        expected_directives = [
+            ("1-255", "192-168-0-$", "192.168.0.$"),
+            ("0-255", "192-168-1-$", "192.168.1.$"),
+            ("0-128", "192-168-2-$", "192.168.2.$"),
+            ]
+        self.assertItemsEqual(
+            expected_directives,
+            DNSForwardZoneConfig.get_GENERATE_directives(ip_range))
+
+    def get_expected_generate_directives(self, network):
+        ip_parts = network.network.format().split('.')
+        ip_parts[-1] = "$"
+        expected_hostname = "%s" % "-".join(ip_parts)
+        expected_address = ".".join(ip_parts)
+
+        first_address = IPAddress(network.first).format()
+        first_address_parts = first_address.split(".")
+        last_address = IPAddress(network.last).format()
+        last_address_parts = last_address.split(".")
+
+        if network.size < 256:
+            iterator_low = int(first_address_parts[-1])
+            if iterator_low == 0:
+                iterator_low = 1
+            iterator_high = last_address_parts[-1]
+        else:
+            iterator_low = 0
+            iterator_high = 255
+
+        expected_iterator_values = "%s-%s" % (iterator_low, iterator_high)
+
+        directives_needed = network.size / 256
+        if directives_needed == 0:
+            directives_needed = 1
+        expected_directives = []
+        for num in range(directives_needed):
+            ip_parts[-2] = unicode(num + int(ip_parts[-2]))
+            expected_address = ".".join(ip_parts)
+            expected_hostname = "%s" % "-".join(ip_parts)
+            expected_directives.append(
+                (
+                    expected_iterator_values,
+                    expected_hostname,
+                    expected_address
+                ))
+        return expected_directives
+
+    def test_returns_single_entry_for_slash_24_network(self):
+        network = IPNetwork("%s/24" % factory.make_ipv4_address())
+        expected_directives = self.get_expected_generate_directives(network)
+        directives = DNSForwardZoneConfig.get_GENERATE_directives(
+            network)
+        self.expectThat(directives, HasLength(1))
+        self.assertItemsEqual(expected_directives, directives)
+
+    def test_returns_single_entry_for_tiny_network(self):
+        network = IPNetwork("%s/31" % factory.make_ipv4_address())
+
+        expected_directives = self.get_expected_generate_directives(network)
+        directives = DNSForwardZoneConfig.get_GENERATE_directives(
+            network)
+        self.assertEqual(1, len(expected_directives))
+        self.assertItemsEqual(expected_directives, directives)
+
+    def test_returns_two_entries_for_slash_23_network(self):
+        network = IPNetwork("%s/23" % factory.make_ipv4_address())
+
+        expected_directives = self.get_expected_generate_directives(network)
+        directives = DNSForwardZoneConfig.get_GENERATE_directives(
+            network)
+        self.assertEqual(2, len(expected_directives))
+        self.assertItemsEqual(expected_directives, directives)
+
+    def test_dtrt_for_larger_networks(self):
+        # For every other network size that we're not explicitly
+        # testing here,
+        # DNSForwardZoneConfig.get_GENERATE_directives() will return
+        # one GENERATE directive for every 255 addresses in the network.
+        for prefixlen in range(23, 16):
+            network = IPNetwork(
+                "%s/%s" % (factory.make_ipv4_address(), prefixlen))
+            directives = DNSForwardZoneConfig.get_GENERATE_directives(
+                network)
+            self.assertIsEqual(network.size / 256, len(directives))
+
+    def test_rejects_network_larger_than_slash_16(self):
+        network = IPNetwork("%s/15" % factory.make_ipv4_address())
+        error = self.assertRaises(
+            AssertionError, DNSForwardZoneConfig.get_GENERATE_directives,
+            network)
+        self.assertEqual(
+            "Cannot generate reverse zone mapping for any network larger "
+            "than /16.",
+            unicode(error))
+
+    def test_sorts_output(self):
+        network = IPNetwork("10.0.0.0/23")
+
+        expected_hostname = "10-0-%s-$"
+        expected_address = "10.0.%s.$"
+
+        directives = list(DNSForwardZoneConfig.get_GENERATE_directives(
+            network))
+        self.expectThat(len(directives), Equals(2))
+        self.expectThat(
+            directives[0], Equals(
+                ("0-255", expected_hostname % "0", expected_address % "0")))
+        self.expectThat(
+            directives[1], Equals(
+                ("0-255", expected_hostname % "1", expected_address % "1")))
+
+
+class TestIntersectIPRange(MAASTestCase):
+    """Tests for `intersect_iprange()`."""
+
+    def test_finds_intersection_between_two_ranges(self):
+        range_1 = IPRange('10.0.0.1', '10.0.0.255')
+        range_2 = IPRange('10.0.0.128', '10.0.0.200')
+        intersect = intersect_iprange(range_1, range_2)
+        self.expectThat(
+            IPAddress(intersect.first), Equals(IPAddress('10.0.0.128')))
+        self.expectThat(
+            IPAddress(intersect.last), Equals(IPAddress('10.0.0.200')))
+
+    def test_ignores_non_intersecting_ranges(self):
+        range_1 = IPRange('10.0.0.1', '10.0.0.255')
+        range_2 = IPRange('10.0.1.128', '10.0.1.200')
+        self.assertIsNone(intersect_iprange(range_1, range_2))
+
+    def test_finds_partial_intersection(self):
+        range_1 = IPRange('10.0.0.1', '10.0.0.128')
+        range_2 = IPRange('10.0.0.64', '10.0.0.200')
+        intersect = intersect_iprange(range_1, range_2)
+        self.expectThat(
+            IPAddress(intersect.first), Equals(IPAddress('10.0.0.64')))
+        self.expectThat(
+            IPAddress(intersect.last), Equals(IPAddress('10.0.0.128')))

=== modified file 'src/provisioningserver/dns/zoneconfig.py'
--- src/provisioningserver/dns/zoneconfig.py	2014-08-15 11:10:09 +0000
+++ src/provisioningserver/dns/zoneconfig.py	2014-10-29 22:31:20 +0000
@@ -23,7 +23,11 @@
 from itertools import chain
 import math
 
-from netaddr import IPAddress
+from netaddr import (
+    IPAddress,
+    IPRange,
+    spanning_cidr,
+    )
 from netaddr.core import AddrFormatError
 from provisioningserver.dns.config import (
     compose_config_path,
@@ -33,6 +37,19 @@
 from provisioningserver.utils.fs import incremental_write
 
 
+def intersect_iprange(network, iprange):
+    """Return the intersection between two IPNetworks or IPRanges.
+
+    IPSet is notoriously inefficient so we intersect ourselves here.
+    """
+    if network.last >= iprange.first and network.first <= iprange.last:
+        first = max(network.first, iprange.first)
+        last = min(network.last, iprange.last)
+        return IPRange(first, last)
+    else:
+        return None
+
+
 def get_fqdn_or_ip_address(target):
     """Returns the ip address is target is a valid ip address, otherwise
     returns the target with appended '.' if missing."""
@@ -52,6 +69,52 @@
             yield hostname, ip
 
 
+def get_details_for_ip_range(ip_range):
+    """For a given IPRange, return all subnets, a useable prefix and the
+    reverse DNS suffix calculated from that IP range.
+
+    :return: A tuple of:
+        All subnets of /24 (or smaller if there is no /24 subnet to be
+        found) in `ip_range`.
+        A prefix made from the first two octets in the range.
+        A RDNS suffix calculated from the first two octets in the range.
+    """
+    # Calculate a spanning network for the range above. There are
+    # 256 /24 networks in a /16, so that's the most /24s we're going
+    # to have to deal with; this matters later on when we iterate
+    # through the /24s within this network.
+    cidr = spanning_cidr(ip_range)
+    subnets = cidr.subnet(max(24, cidr.prefixlen))
+
+    # Split the spanning network into /24 subnets, then see if they fall
+    # entirely within the original network range, partially, or not at
+    # all.
+    intersecting_subnets = []
+    for subnet in subnets:
+        intersect = intersect_iprange(subnet, ip_range)
+        if intersect is None:
+            # The subnet does not fall within the original network.
+            pass
+        else:
+            # The subnet falls partially within the original network, so print
+            # out a $GENERATE expression for a subset of the /24.
+            intersecting_subnets.append(intersect)
+
+    octet_one = (cidr.value & 0xff000000) >> 24
+    octet_two = (cidr.value & 0x00ff0000) >> 16
+
+    # The first two octets of the network range formatted in the
+    # usual dotted-quad style. We can precalculate the start of any IP
+    # address in the range because we're only ever dealing with /16
+    # networks and smaller.
+    prefix = "%d.%d" % (octet_one, octet_two)
+
+    # Similarly, we can calculate what the reverse DNS suffix is going
+    # to look like.
+    rdns_suffix = "%d.%d.in-addr.arpa." % (octet_two, octet_one)
+    return intersecting_subnets, prefix, rdns_suffix
+
+
 class DNSZoneConfigBase:
     """Base class for zone writers."""
 
@@ -117,7 +180,8 @@
         """
         self._dns_ip = kwargs.pop('dns_ip', None)
         self._mapping = kwargs.pop('mapping', {})
-        self._network = None
+        self._network = kwargs.pop('network', None)
+        self._dynamic_ranges = kwargs.pop('dynamic_ranges', [])
         self._srv_mapping = kwargs.pop('srv_mapping', [])
         super(DNSForwardZoneConfig, self).__init__(
             domain, zone_name=domain, **kwargs)
@@ -187,8 +251,45 @@
                 target)
             yield (record.service, item)
 
+    @classmethod
+    def get_GENERATE_directives(cls, dynamic_range):
+        """Return the GENERATE directives for the forward zone of a network.
+        """
+        assert dynamic_range.size <= 256 ** 2, (
+            "Cannot generate reverse zone mapping for any network larger than "
+            "/16.")
+
+        generate_directives = set()
+        subnets, prefix, _ = get_details_for_ip_range(dynamic_range)
+        for subnet in subnets:
+            iterator = "%d-%d" % (
+                (subnet.first & 0x000000ff),
+                (subnet.last & 0x000000ff))
+
+            hostname = "%s-%d-$" % (
+                prefix.replace('.', '-'),
+                # Calculate what the third quad (i.e. 10.0.X.1) value should
+                # be for this subnet.
+                (subnet.first & 0x0000ff00) >> 8,
+                )
+
+            ip_address = "%s.%d.$" % (
+                prefix,
+                (subnet.first & 0x0000ff00) >> 8)
+            generate_directives.add((iterator, hostname, ip_address))
+
+        return sorted(
+            generate_directives, key=lambda directive: directive[2])
+
     def write_config(self):
         """Write the zone file."""
+        # Create GENERATE directives for IPv4 ranges.
+        generate_directives = list(
+            chain.from_iterable(
+                self.get_GENERATE_directives(dynamic_range)
+                for dynamic_range in self._dynamic_ranges
+                if dynamic_range.version == 4
+            ))
         self.write_zone_file(
             self.target_path, self.make_parameters(),
             {
@@ -200,6 +301,9 @@
                     'AAAA': self.get_AAAA_mapping(
                         self._mapping, self.domain, self._dns_ip),
                 },
+                'generate_directives': {
+                    'A': generate_directives,
+                }
             })
 
 
@@ -225,6 +329,7 @@
         """
         self._mapping = kwargs.pop('mapping', {})
         self._network = kwargs.pop("network", None)
+        self._dynamic_ranges = kwargs.pop('dynamic_ranges', [])
         zone_name = self.compose_zone_name(self._network)
         super(DNSReverseZoneConfig, self).__init__(
             domain, zone_name=zone_name, **kwargs)
@@ -279,8 +384,40 @@
             if IPAddress(ip) in network
         )
 
+    @classmethod
+    def get_GENERATE_directives(cls, dynamic_range, domain):
+        """Return the GENERATE directives for the reverse zone of a network."""
+        assert dynamic_range.size <= 256 ** 2, (
+            "Cannot generate reverse zone mapping for any network larger than "
+            "/16.")
+
+        generate_directives = set()
+        subnets, prefix, rdns_suffix = get_details_for_ip_range(dynamic_range)
+        for subnet in subnets:
+            iterator = "%d-%d" % (
+                (subnet.first & 0x000000ff),
+                (subnet.last & 0x000000ff))
+            hostname = "%s-%d-$" % (
+                prefix.replace('.', '-'),
+                (subnet.first & 0x0000ff00) >> 8)
+            rdns = "$.%d.%s" % (
+                (subnet.first & 0x0000ff00) >> 8,
+                rdns_suffix)
+            generate_directives.add(
+                (iterator, rdns, "%s.%s." % (hostname, domain)))
+
+        return sorted(
+            generate_directives, key=lambda directive: directive[2])
+
     def write_config(self):
         """Write the zone file."""
+        # Create GENERATE directives for IPv4 ranges.
+        generate_directives = list(
+            chain.from_iterable(
+                self.get_GENERATE_directives(dynamic_range, self.domain)
+                for dynamic_range in self._dynamic_ranges
+                if dynamic_range.version == 4
+            ))
         self.write_zone_file(
             self.target_path, self.make_parameters(),
             {
@@ -288,5 +425,8 @@
                     'PTR': self.get_PTR_mapping(
                         self._mapping, self.domain, self._network),
                 },
+                'generate_directives': {
+                    'PTR': generate_directives,
+                }
             }
         )