feat(dhcp): DHCPv4-Server via Kea (kea-dhcp4-server) — v1.2.92
Verwalteter DHCPv4-Server analog Unbound/Squid/Chrony. - Migration 0041: dhcp_settings (singleton, node-lokal), dhcp_subnets, dhcp_reservations. - internal/kea: Renderer baut Kea-JSON via Go-Struct→Marshal (garantiert valide), managed /etc/edgeguard/kea/kea-dhcp4.conf (Symlink von /etc/kea), Service-Lifecycle an enabled gekoppelt (default AUS, kein rogue DHCP). Interface per NAME (cluster-sicher, kein node-lokaler FK). - internal/services/dhcp + internal/handlers/dhcp.go: Settings + Subnet/Reservation-CRUD, Validierung (CIDR/IP/MAC/interface exists). - configgen: Stop/Enable/DisableService. Firewall: AutoFWRule.Iface → udp/67 pro LAN-Interface gescopt (kein WAN). Cluster: subnets/reservations repliziert (hashSpec), dhcp_settings node-lokal (localOnlyTables). - main.go + render.go + WithAllReloaders Wiring. Packaging: kea-dhcp4-server Dependency, /etc/edgeguard/kea Dir, Symlink, disable-on-install, sudoers (restart/stop/enable/disable). - UI: DHCP-Seite (Settings + Subnets + Reservierungen pro Subnet), Route/Nav/i18n de/en, HA-Warnung 'nur auf einer Node aktivieren'. - Tests (guarded EG_FWTEST_DSN): Kea-Renderer gegen DB (valides JSON + Felder), FW-Auto-Rule-Iface inkl. nft -c. Scope v1: DHCPv4. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Debian
235
internal/kea/kea.go
Normal file
235
internal/kea/kea.go
Normal file
@@ -0,0 +1,235 @@
|
||||
// Package kea renders the Kea DHCPv4 server config from the dhcp_*
|
||||
// tables and manages the kea-dhcp4-server service lifecycle.
|
||||
//
|
||||
// The config is built as a Go struct and json-marshalled (NOT a text
|
||||
// template) so the output is always syntactically valid JSON. Managed
|
||||
// at /etc/edgeguard/kea/kea-dhcp4.conf (edgeguard-owned); postinst
|
||||
// symlinks /etc/kea/kea-dhcp4.conf to it.
|
||||
//
|
||||
// Safety: the service runs ONLY when dhcp_settings.enabled is true on
|
||||
// THIS node (a DHCP server is network-sensitive; default off). enabled
|
||||
// → enable + restart; disabled → disable + stop.
|
||||
package kea
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"strings"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
|
||||
dhcpsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/dhcp"
|
||||
)
|
||||
|
||||
const (
|
||||
ConfPath = configgen.EtcEdgeguard + "/kea/kea-dhcp4.conf"
|
||||
serviceName = "kea-dhcp4-server"
|
||||
leaseFile = "/var/lib/kea/kea-leases4.csv"
|
||||
keaBinary = "/usr/sbin/kea-dhcp4"
|
||||
)
|
||||
|
||||
type Generator struct {
|
||||
Pool *pgxpool.Pool
|
||||
Repo *dhcpsvc.Repo
|
||||
SkipReload bool
|
||||
}
|
||||
|
||||
func New(pool *pgxpool.Pool) *Generator {
|
||||
return &Generator{Pool: pool, Repo: dhcpsvc.New(pool)}
|
||||
}
|
||||
|
||||
func (g *Generator) Name() string { return "kea" }
|
||||
|
||||
// ── Kea config JSON shape ────────────────────────────────────────────
|
||||
|
||||
type keaConfig struct {
|
||||
Dhcp4 dhcp4 `json:"Dhcp4"`
|
||||
}
|
||||
type dhcp4 struct {
|
||||
InterfacesConfig ifcfg `json:"interfaces-config"`
|
||||
LeaseDatabase leaseDB `json:"lease-database"`
|
||||
ValidLifetime int `json:"valid-lifetime"`
|
||||
MaxValidLifetime int `json:"max-valid-lifetime"`
|
||||
OptionData []optionData `json:"option-data,omitempty"`
|
||||
Subnet4 []subnet4 `json:"subnet4"`
|
||||
Loggers []logger `json:"loggers"`
|
||||
}
|
||||
type ifcfg struct {
|
||||
Interfaces []string `json:"interfaces"`
|
||||
}
|
||||
type leaseDB struct {
|
||||
Type string `json:"type"`
|
||||
Persist bool `json:"persist"`
|
||||
Name string `json:"name"`
|
||||
}
|
||||
type optionData struct {
|
||||
Name string `json:"name"`
|
||||
Data string `json:"data"`
|
||||
}
|
||||
type subnet4 struct {
|
||||
ID int64 `json:"id"`
|
||||
Subnet string `json:"subnet"`
|
||||
Pools []pool `json:"pools,omitempty"`
|
||||
OptionData []optionData `json:"option-data,omitempty"`
|
||||
Reservations []reservation `json:"reservations,omitempty"`
|
||||
}
|
||||
type pool struct {
|
||||
Pool string `json:"pool"`
|
||||
}
|
||||
type reservation struct {
|
||||
HWAddress string `json:"hw-address"`
|
||||
IPAddress string `json:"ip-address"`
|
||||
Hostname string `json:"hostname,omitempty"`
|
||||
}
|
||||
type logger struct {
|
||||
Name string `json:"name"`
|
||||
Severity string `json:"severity"`
|
||||
OutputOptions []outOpt `json:"output_options"`
|
||||
}
|
||||
type outOpt struct {
|
||||
Output string `json:"output"`
|
||||
}
|
||||
|
||||
// buildConfig assembliert die Kea-Config aus dem DB-State.
|
||||
func (g *Generator) buildConfig(ctx context.Context) (*keaConfig, *bool, error) {
|
||||
settings, err := g.Repo.GetSettings(ctx)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("get dhcp settings: %w", err)
|
||||
}
|
||||
subnets, err := g.Repo.ListSubnets(ctx)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("list subnets: %w", err)
|
||||
}
|
||||
resv, err := g.Repo.ListAllReservations(ctx)
|
||||
if err != nil {
|
||||
return nil, nil, fmt.Errorf("list reservations: %w", err)
|
||||
}
|
||||
bySubnet := map[int64][]reservation{}
|
||||
for _, r := range resv {
|
||||
if !r.Active {
|
||||
continue
|
||||
}
|
||||
bySubnet[r.SubnetID] = append(bySubnet[r.SubnetID], reservation{
|
||||
HWAddress: r.MACAddress, IPAddress: r.IPAddress, Hostname: r.Hostname,
|
||||
})
|
||||
}
|
||||
|
||||
ifaceSet := map[string]bool{}
|
||||
var ifaces []string
|
||||
var sn4 []subnet4
|
||||
|
||||
for _, s := range subnets {
|
||||
if !s.Active {
|
||||
continue
|
||||
}
|
||||
if !ifaceSet[s.InterfaceName] {
|
||||
ifaceSet[s.InterfaceName] = true
|
||||
ifaces = append(ifaces, s.InterfaceName)
|
||||
}
|
||||
sub := subnet4{ID: s.ID, Subnet: s.SubnetCIDR}
|
||||
if s.PoolStart != "" && s.PoolEnd != "" {
|
||||
sub.Pools = []pool{{Pool: s.PoolStart + " - " + s.PoolEnd}}
|
||||
}
|
||||
if s.Gateway != "" {
|
||||
sub.OptionData = append(sub.OptionData, optionData{Name: "routers", Data: s.Gateway})
|
||||
}
|
||||
dns := s.DNSServers
|
||||
if dns == "" {
|
||||
dns = settings.DNSServers
|
||||
}
|
||||
if dns != "" {
|
||||
sub.OptionData = append(sub.OptionData, optionData{Name: "domain-name-servers", Data: normalizeCSV(dns)})
|
||||
}
|
||||
sub.Reservations = bySubnet[s.ID]
|
||||
sn4 = append(sn4, sub)
|
||||
}
|
||||
|
||||
d := dhcp4{
|
||||
InterfacesConfig: ifcfg{Interfaces: ifaces},
|
||||
LeaseDatabase: leaseDB{Type: "memfile", Persist: true, Name: leaseFile},
|
||||
ValidLifetime: settings.DefaultLease,
|
||||
MaxValidLifetime: settings.MaxLease,
|
||||
Subnet4: sn4,
|
||||
Loggers: []logger{{
|
||||
Name: "kea-dhcp4", Severity: "INFO",
|
||||
OutputOptions: []outOpt{{Output: "stdout"}},
|
||||
}},
|
||||
}
|
||||
if settings.DNSServers != "" {
|
||||
d.OptionData = append(d.OptionData, optionData{Name: "domain-name-servers", Data: normalizeCSV(settings.DNSServers)})
|
||||
}
|
||||
if settings.DomainName != "" {
|
||||
d.OptionData = append(d.OptionData, optionData{Name: "domain-name", Data: settings.DomainName})
|
||||
}
|
||||
if d.Subnet4 == nil {
|
||||
d.Subnet4 = []subnet4{}
|
||||
}
|
||||
return &keaConfig{Dhcp4: d}, &settings.Enabled, nil
|
||||
}
|
||||
|
||||
func (g *Generator) RenderToString(ctx context.Context) (string, error) {
|
||||
cfg, _, err := g.buildConfig(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
b, err := json.MarshalIndent(cfg, "", " ")
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(b) + "\n", nil
|
||||
}
|
||||
|
||||
func (g *Generator) Render(ctx context.Context) error {
|
||||
cfg, enabled, err := g.buildConfig(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Default-off / disabled: Service stoppen + disablen, nichts weiter.
|
||||
if enabled == nil || !*enabled {
|
||||
if g.SkipReload {
|
||||
return nil
|
||||
}
|
||||
_ = configgen.DisableService(serviceName)
|
||||
_ = configgen.StopService(serviceName)
|
||||
return nil
|
||||
}
|
||||
|
||||
b, err := json.MarshalIndent(cfg, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := configgen.AtomicWrite(ConfPath, append(b, '\n'), 0o644); err != nil {
|
||||
return fmt.Errorf("write kea config: %w", err)
|
||||
}
|
||||
if g.SkipReload {
|
||||
return nil
|
||||
}
|
||||
// Best-effort Config-Test (verhindert Restart mit kaputter Semantik).
|
||||
if _, statErr := os.Stat(keaBinary); statErr == nil {
|
||||
if out, terr := exec.Command(keaBinary, "-t", ConfPath).CombinedOutput(); terr != nil {
|
||||
return fmt.Errorf("kea-dhcp4 -t rejected config: %w (output: %s)", terr, strings.TrimSpace(string(out)))
|
||||
}
|
||||
}
|
||||
if err := configgen.EnableService(serviceName); err != nil {
|
||||
return err
|
||||
}
|
||||
return configgen.RestartService(serviceName)
|
||||
}
|
||||
|
||||
// normalizeCSV trimmt Whitespace um Komma-getrennte Werte (Kea will
|
||||
// "a,b,c" ohne Leerzeichen-Toleranz-Probleme).
|
||||
func normalizeCSV(s string) string {
|
||||
parts := strings.Split(s, ",")
|
||||
out := make([]string, 0, len(parts))
|
||||
for _, p := range parts {
|
||||
if t := strings.TrimSpace(p); t != "" {
|
||||
out = append(out, t)
|
||||
}
|
||||
}
|
||||
return strings.Join(out, ",")
|
||||
}
|
||||
89
internal/kea/kea_test.go
Normal file
89
internal/kea/kea_test.go
Normal file
@@ -0,0 +1,89 @@
|
||||
package kea
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"os/exec"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.netcell-it.de/projekte/edgeguard-native/internal/database"
|
||||
)
|
||||
|
||||
// Guarded integration test: set EG_FWTEST_DSN (sonst skip).
|
||||
func TestRender_DHCPConfig(t *testing.T) {
|
||||
dsn := os.Getenv("EG_FWTEST_DSN")
|
||||
if dsn == "" {
|
||||
t.Skip("set EG_FWTEST_DSN to run the kea renderer test")
|
||||
}
|
||||
ctx := context.Background()
|
||||
var mErr error
|
||||
for i := 0; i < 3; i++ {
|
||||
if mErr = database.Migrate(ctx, dsn); mErr == nil {
|
||||
break
|
||||
}
|
||||
time.Sleep(700 * time.Millisecond)
|
||||
}
|
||||
if mErr != nil {
|
||||
t.Fatalf("migrate: %v", mErr)
|
||||
}
|
||||
pool, err := database.Open(ctx, dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("open: %v", err)
|
||||
}
|
||||
defer pool.Close()
|
||||
|
||||
for _, q := range []string{
|
||||
`DELETE FROM dhcp_reservations`,
|
||||
`DELETE FROM dhcp_subnets`,
|
||||
`UPDATE dhcp_settings SET enabled=true, default_lease=3600, max_lease=7200, domain_name='lan', dns_servers='1.1.1.1, 8.8.8.8' WHERE id=1`,
|
||||
} {
|
||||
if _, err := pool.Exec(ctx, q); err != nil {
|
||||
t.Fatalf("seed (%s): %v", q, err)
|
||||
}
|
||||
}
|
||||
var subID int64
|
||||
if err := pool.QueryRow(ctx, `
|
||||
INSERT INTO dhcp_subnets (name, interface_name, subnet_cidr, pool_start, pool_end, gateway, dns_servers, active)
|
||||
VALUES ('lan','eth1','10.0.0.0/24','10.0.0.100','10.0.0.200','10.0.0.1','',true) RETURNING id`).Scan(&subID); err != nil {
|
||||
t.Fatalf("seed subnet: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
INSERT INTO dhcp_reservations (subnet_id, mac_address, ip_address, hostname, active)
|
||||
VALUES ($1,'aa:bb:cc:dd:ee:ff','10.0.0.50','printer',true)`, subID); err != nil {
|
||||
t.Fatalf("seed reservation: %v", err)
|
||||
}
|
||||
|
||||
out, err := New(pool).RenderToString(ctx)
|
||||
if err != nil {
|
||||
t.Fatalf("render: %v", err)
|
||||
}
|
||||
if !json.Valid([]byte(out)) {
|
||||
t.Fatalf("rendered config is not valid JSON:\n%s", out)
|
||||
}
|
||||
for _, want := range []string{
|
||||
`"10.0.0.0/24"`,
|
||||
`"10.0.0.100 - 10.0.0.200"`,
|
||||
`"aa:bb:cc:dd:ee:ff"`,
|
||||
`"routers"`,
|
||||
`"eth1"`,
|
||||
`"hw-address"`,
|
||||
`"valid-lifetime": 3600`,
|
||||
} {
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("rendered config missing %q\n----\n%s", want, out)
|
||||
}
|
||||
}
|
||||
|
||||
// Best-effort: echte Kea-Validierung, falls die Binary da ist.
|
||||
if _, statErr := os.Stat(keaBinary); statErr == nil {
|
||||
f, _ := os.CreateTemp(t.TempDir(), "kea-*.conf")
|
||||
_, _ = f.WriteString(out)
|
||||
f.Close()
|
||||
if combined, err := exec.Command(keaBinary, "-t", f.Name()).CombinedOutput(); err != nil {
|
||||
t.Fatalf("kea-dhcp4 -t rejected rendered config: %v\n%s", err, combined)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user