Add KEA DHCP provider

Ref: theforeman/foremanctl#531 (comment)

ISC DHCP reached end-of-life in October 2022 and is no longer maintained.
ISC officially recommends migrating to KEA DHCP as the replacement.

This commit adds Smart Proxy DHCP provider for ISC KEA DHCP server using
the KEA Control Agent API, providing a migration path for users currently
using the deprecated dhcp_isc provider.

Based on the `smart_proxy_dhcp_kea_api` gem by Sam McCarthy
with author's permission to integrate into Smart Proxy core.
https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api/-/issues/3

Fixes: https://redhat.atlassian.net/browse/SAT-27739

Author: archanaserver

README.md

@@ -9,7 +9,7 @@
 # Supported Modules
 Currently Supported modules:
  * BMC - BMC management of devices supported by freeipmi and ipmitool
- * DHCP - ISC DHCP and MS DHCP Servers
+ * DHCP - ISC KEA, MS DHCP, and ISC DHCP (legacy, EOL 2022) Servers
  * DNS - Bind and MS DNS Servers
  * Puppet - Puppetserver 6 or 7
  * Puppet CA - Manage certificate signing, cleaning and autosign on a Puppet CA server

config/settings.d/dhcp.yml.example

@@ -3,10 +3,14 @@
 :enabled: false
 
 # valid providers:
-#   - dhcp_isc (ISC dhcp server)
+#   - dhcp_kea (ISC KEA dhcp server)
 #   - dhcp_native_ms (Microsoft native implementation)
 #   - dhcp_libvirt
-#:use_provider: dhcp_isc
+#   - dhcp_isc (ISC dhcp server - DEPRECATED)
+#
+# NOTE: ISC DHCP reached end-of-life in October 2022. ISC recommends
+# migrating to KEA DHCP. Use `dhcp_kea` for new deployments.
+#:use_provider: dhcp_kea
 #:server: 127.0.0.1
 # subnets restricts the subnets queried to a subset, to reduce the query time.
 #:subnets: [192.168.205.0/255.255.255.128, 192.168.205.128/255.255.255.128]

config/settings.d/dhcp_kea.yml.example

@@ -0,0 +1,16 @@
+---
+# KEA DHCP provider configuration
+# Requires ISC KEA DHCP server with Control Agent API enabled
+
+# URL of the KEA Control Agent
+#:dhcp_kea_url: http://127.0.0.1:8000/
+
+# Optional HTTP Basic Authentication credentials
+#:dhcp_kea_username: ~
+#:dhcp_kea_password: ~
+
+# SSL certificate verification (set to false for self-signed certificates)
+#:dhcp_kea_verify_ssl: true
+
+# Timeout for lease operations in seconds
+#:dhcp_kea_lease_timeout: 60

modules/dhcp_kea/dhcp_kea.rb

@@ -0,0 +1,3 @@
+require 'dhcp_common/dhcp_common'
+require 'dhcp_kea/plugin_configuration'
+require 'dhcp_kea/dhcp_kea_plugin'

modules/dhcp_kea/dhcp_kea_main.rb

@@ -0,0 +1,130 @@
+require 'dhcp_common/server'
+
+module Proxy::DHCP::Kea
+  class Provider < ::Proxy::DHCP::Server
+    include Proxy::Log
+
+    attr_reader :kea_client, :lease_timeout
+
+    def initialize(kea_client, subnet_service, free_ips_service, lease_timeout = 60)
+      @kea_client = kea_client
+      @lease_timeout = lease_timeout
+
+      super('kea-dhcp-server', nil, subnet_service, free_ips_service)
+
+      load_subnets
+    end
+
+    def load_subnets
+      logger.info "Loading subnets from KEA DHCP server"
+
+      begin
+        subnets = kea_client.list_subnets
+      rescue => e
+        logger.error "Failed to load subnets from KEA: #{e.message}"
+        raise Proxy::DHCP::Error, "Cannot connect to KEA DHCP server: #{e.message}"
+      end
+
+      if subnets.empty?
+        logger.warn "No subnets configured in KEA DHCP server"
+        return
+      end
+
+      subnets.each do |subnet_config|
+        network = subnet_config['subnet']
+        subnet_id = subnet_config['id']
+
+        logger.debug "Loading subnet: #{network} (KEA ID: #{subnet_id})"
+
+        netmask = netmask_from_cidr(network)
+
+        subnet = ::Proxy::DHCP::Subnet.new(network, netmask)
+
+        subnet.options[:kea_subnet_id] = subnet_id
+
+        service.add_subnet(subnet)
+
+        logger.debug "Added subnet #{network} with KEA ID #{subnet_id}"
+      end
+
+      logger.info "Loaded #{subnets.size} subnet(s) from KEA"
+    end
+
+    def add_record(options = {})
+      logger.debug "Adding DHCP reservation with options: #{options.inspect}"
+
+      record = super(options)
+
+      subnet = find_subnet(record.network)
+      unless subnet
+        raise Proxy::DHCP::Error, "Subnet not found for network: #{record.network}"
+      end
+
+      subnet_id = subnet.options[:kea_subnet_id]
+      unless subnet_id
+        raise Proxy::DHCP::Error, "KEA subnet ID not found for #{record.network}"
+      end
+
+      kea_options = {}
+      kea_options[:next_server] = record.nextServer if record.nextServer
+      kea_options[:boot_file_name] = record.filename if record.filename
+
+      begin
+        kea_client.add_reservation(
+          subnet_id,
+          record.ip,
+          record.mac,
+          record.name,
+          kea_options
+        )
+      rescue => e
+        logger.error "Failed to create KEA reservation: #{e.message}"
+        raise Proxy::DHCP::Error, "Failed to create reservation in KEA: #{e.message}"
+      end
+
+      service.add_host(subnet.network, record)
+
+      logger.info "Successfully created KEA DHCP reservation: #{record.ip} for #{record.mac}"
+      record
+    end
+
+    def del_record(record)
+      logger.debug "Deleting DHCP record: #{record.inspect}"
+
+      subnet = find_subnet(record.network)
+      unless subnet
+        raise Proxy::DHCP::Error, "Subnet not found for network: #{record.network}"
+      end
+
+      subnet_id = subnet.options[:kea_subnet_id]
+      unless subnet_id
+        raise Proxy::DHCP::Error, "KEA subnet ID not found for #{record.network}"
+      end
+
+      begin
+        kea_client.delete_reservation_by_ip(subnet_id, record.ip)
+      rescue => e
+        logger.error "Failed to delete KEA reservation: #{e.message}"
+        raise Proxy::DHCP::Error, "Failed to delete reservation from KEA: #{e.message}"
+      end
+
+      if record.is_a?(::Proxy::DHCP::Reservation)
+        service.delete_host(subnet.network, record)
+      elsif record.is_a?(::Proxy::DHCP::Lease)
+        service.delete_lease(subnet.network, record)
+      end
+
+      logger.info "Successfully deleted KEA DHCP reservation: #{record.ip}"
+    end
+
+    def load_subnet_options(subnet)
+      logger.debug "Loading subnet options for #{subnet.network}"
+    end
+
+    private
+
+    def netmask_from_cidr(cidr)
+      IPAddr.new(cidr).netmask.to_s
+    end
+  end
+end

modules/dhcp_kea/dhcp_kea_plugin.rb

@@ -0,0 +1,20 @@
+module Proxy::DHCP::Kea
+  class Plugin < ::Proxy::Provider
+    plugin :dhcp_kea, ::Proxy::VERSION
+
+    capability 'dhcp_filename_ipv4'
+    capability 'dhcp_filename_hostname'
+
+    default_settings :dhcp_kea_url => 'http://127.0.0.1:8000/',
+                     :dhcp_kea_username => nil,
+                     :dhcp_kea_password => nil,
+                     :dhcp_kea_verify_ssl => true,
+                     :dhcp_kea_lease_timeout => 60
+
+    requires :dhcp, ::Proxy::VERSION
+
+    load_classes ::Proxy::DHCP::Kea::PluginConfiguration
+    load_programmable_settings ::Proxy::DHCP::Kea::PluginConfiguration
+    load_dependency_injection_wirings ::Proxy::DHCP::Kea::PluginConfiguration
+  end
+end

modules/dhcp_kea/kea_api_client.rb

@@ -0,0 +1,137 @@
+require 'net/http'
+require 'uri'
+require 'json'
+
+module Proxy::DHCP::Kea
+  class KeaApiClient
+    include Proxy::Log
+
+    attr_reader :api_url, :username, :password, :verify_ssl
+
+    def initialize(api_url, username = nil, password = nil, verify_ssl = true)
+      @api_url = api_url.chomp('/')
+      @username = username
+      @password = password
+      @verify_ssl = verify_ssl
+    end
+
+    def send_command(service, command, arguments = {})
+      payload = {
+        'command' => command,
+        'service' => [service],
+        'arguments' => arguments
+      }
+
+      logger.debug "Sending KEA command: #{command} to service: #{service}"
+      logger.debug "Arguments: #{arguments.inspect}"
+
+      response = http_post('/', payload)
+
+      result = response.first
+
+      if result['result'] != 0
+        error_msg = "KEA command '#{command}' failed: #{result['text']}"
+        logger.error error_msg
+        raise error_msg
+      end
+
+      logger.debug "KEA command successful: #{result['text']}"
+      result['arguments'] || {}
+    end
+
+    def get_config
+      send_command('dhcp4', 'config-get')
+    end
+
+    def list_subnets
+      config = get_config
+      config.dig('Dhcp4', 'subnet4') || []
+    end
+
+    def add_reservation(subnet_id, ip_address, hw_address, hostname = nil, options = {})
+      reservation = {
+        'subnet-id' => subnet_id.to_i,
+        'ip-address' => ip_address,
+        'hw-address' => hw_address
+      }
+
+      reservation['hostname'] = hostname if hostname
+
+      if options[:next_server]
+        reservation['next-server'] = options[:next_server]
+      end
+
+      if options[:boot_file_name]
+        reservation['boot-file-name'] = options[:boot_file_name]
+      end
+
+      logger.info "Adding KEA reservation: #{ip_address} for #{hw_address} in subnet #{subnet_id}"
+      send_command('dhcp4', 'reservation-add', reservation)
+    end
+
+    def delete_reservation_by_ip(subnet_id, ip_address)
+      logger.info "Deleting KEA reservation: #{ip_address} from subnet #{subnet_id}"
+      send_command('dhcp4', 'reservation-del', {
+        'subnet-id' => subnet_id.to_i,
+        'ip-address' => ip_address
+      })
+    end
+
+    def get_reservation_by_ip(subnet_id, ip_address)
+      send_command('dhcp4', 'reservation-get', {
+        'subnet-id' => subnet_id.to_i,
+        'ip-address' => ip_address
+      })
+    rescue => e
+      logger.debug "Reservation not found for #{ip_address}: #{e.message}"
+      nil
+    end
+
+    def list_leases
+      send_command('dhcp4', 'lease4-get-all')
+    end
+
+
+    def get_lease_by_ip(ip_address)
+      result = send_command('dhcp4', 'lease4-get', {
+        'ip-address' => ip_address
+      })
+      result['leases']&.first
+    rescue => e
+      logger.debug "Lease not found for #{ip_address}: #{e.message}"
+      nil
+    end
+
+    private
+
+    def http_post(path, payload)
+      uri = URI.parse("#{@api_url}#{path}")
+
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = (uri.scheme == 'https')
+      http.verify_mode = @verify_ssl ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+
+      request = Net::HTTP::Post.new(uri.path, {'Content-Type' => 'application/json'})
+      request.body = payload.to_json
+
+      if @username && @password
+        request.basic_auth(@username, @password)
+      end
+
+      logger.debug "HTTP POST to #{uri}"
+      response = http.request(request)
+
+      unless response.is_a?(Net::HTTPSuccess)
+        error_msg = "HTTP request failed: #{response.code} #{response.message}"
+        logger.error error_msg
+        raise error_msg
+      end
+
+      JSON.parse(response.body)
+    rescue JSON::ParserError => e
+      error_msg = "Failed to parse KEA response: #{e.message}"
+      logger.error error_msg
+      raise error_msg
+    end
+  end
+end

modules/dhcp_kea/plugin_configuration.rb

@@ -0,0 +1,55 @@
+module Proxy::DHCP::Kea
+  class PluginConfiguration
+    def load_classes
+      require 'dhcp_common/server'
+      require 'dhcp_common/subnet_service'
+      require 'dhcp_common/free_ips'
+      require 'dhcp_kea/kea_api_client'
+      require 'dhcp_kea/dhcp_kea_main'
+    end
+
+    def load_programmable_settings(settings)
+      # Nothing to modify for KEA
+    end
+
+    def load_dependency_injection_wirings(container_instance, settings)
+      container_instance.dependency :memory_store, ::Proxy::MemoryStore
+
+      container_instance.singleton_dependency :kea_api_client, (lambda do
+        ::Proxy::DHCP::Kea::KeaApiClient.new(
+          settings[:dhcp_kea_url],
+          settings[:dhcp_kea_username],
+          settings[:dhcp_kea_password],
+          settings[:dhcp_kea_verify_ssl]
+        )
+      end)
+
+      container_instance.singleton_dependency :subnet_service, (lambda do
+        ::Proxy::DHCP::SubnetService.new(
+          container_instance.get_dependency(:memory_store),
+          container_instance.get_dependency(:memory_store),
+          container_instance.get_dependency(:memory_store),
+          container_instance.get_dependency(:memory_store),
+          container_instance.get_dependency(:memory_store)
+        )
+      end)
+
+      container_instance.singleton_dependency :free_ips, (lambda do
+        ::Proxy::DHCP::FreeIps.new(
+          container_instance.get_dependency(:subnet_service),
+          container_instance.get_dependency(:memory_store),
+          false
+        )
+      end)
+
+      container_instance.dependency :dhcp_provider, (lambda do
+        ::Proxy::DHCP::Kea::Provider.new(
+          container_instance.get_dependency(:kea_api_client),
+          container_instance.get_dependency(:subnet_service),
+          container_instance.get_dependency(:free_ips),
+          settings[:dhcp_kea_lease_timeout]
+        )
+      end)
+    end
+  end
+end