Kea: Add DHCP-DDNS Support

plist

@@ -399,6 +399,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVlan.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVxlan.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/CtrlAgentController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/DhcpddnsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/Dhcpv4Controller.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/Dhcpv6Controller.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/Leases4Controller.php
@@ -407,6 +408,10 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/ServiceController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/agentSettings.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsDnsServer.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsForwardDomain.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsReverseDomain.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsTsigKey.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogPDPool6.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogPeer4.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogPeer6.xml
@@ -416,6 +421,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettings4.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettings6.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettingsDdns.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Monit/Api/ServiceController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Monit/Api/SettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Monit/Api/StatusController.php
@@ -822,6 +828,8 @@
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/FieldTypes/KeaStaticRoutesField.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaCtrlAgent.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaCtrlAgent.xml
+/usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.php
+/usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
@@ -973,6 +981,7 @@
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vlan.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vxlan.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/ctrl_agent.volt
+/usr/local/opnsense/mvc/app/views/OPNsense/Kea/dhcp_ddns.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/dhcpv6.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/leases4.volt

src/etc/inc/plugins.inc.d/kea.inc

@@ -62,6 +62,14 @@ function kea_services()
         $services[] = $service;
     }
 
+    if (!(new \OPNsense\Kea\KeaDhcpDdns())->general->enabled->isEmpty()) {
+        $service = $template;
+        $service['pidfile'] = '/var/run/kea/kea-dhcp-ddns.kea-dhcp-ddns.pid';
+        $service['description'] = gettext('KEA DHCP DDNS server');
+        $service['id'] = 'ddns';
+        $services[] = $service;
+    }
+
     return $services;
 }
 
@@ -146,6 +154,7 @@ function kea_configure_do($verbose = false)
 {
     $keaDhcpv4 = new \OPNsense\Kea\KeaDhcpv4();
     $keaDhcpv6 = new \OPNsense\Kea\KeaDhcpv6();
+    $keaDhcpDdns = new \OPNsense\Kea\KeaDhcpDdns();
 
     killbypid('/var/run/kea_prefix_watcher.pid');
 
@@ -159,6 +168,9 @@ function kea_configure_do($verbose = false)
             /* skip kea-dhcp6.conf when configured manually */
             $keaDhcpv6->generateConfig();
         }
+        if ($keaDhcpDdns->isEnabled() && $keaDhcpDdns->general->manual_config->isEmpty()) {
+            $keaDhcpDdns->generateConfig();
+        }
         (new \OPNsense\Kea\KeaCtrlAgent())->generateConfig();
         if ($keaDhcpv6->isEnabled()) {
             mwexecfb(
@@ -175,7 +187,7 @@ function kea_configure_do($verbose = false)
 function kea_syslog()
 {
     $logfacilities = [];
-    $logfacilities['kea'] = ['facility' => ['kea-dhcp4', 'kea-dhcp6', 'kea-ctrl-agent']];
+    $logfacilities['kea'] = ['facility' => ['kea-dhcp4', 'kea-dhcp6', 'kea-ctrl-agent', 'kea-dhcp-ddns']];
     return $logfacilities;
 }
 
@@ -289,7 +301,7 @@ function kea_xmlrpc_sync()
         'description' => gettext('Kea DHCP'),
         'section' => 'OPNsense.Kea',
         'id' => 'kea',
-        'services' => ["kea-dhcpv4", "kea-dhcpv6"],
+        'services' => ["kea-dhcpv4", "kea-dhcpv6", "kea-dhcp-ddns"],
     ];
 
     return $result;

src/opnsense/mvc/app/controllers/OPNsense/Kea/Api/DhcpddnsController.php

@@ -0,0 +1,140 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Yip Rui Fung <[email protected]>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Kea\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class DhcpddnsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'dhcp_ddns';
+    protected static $internalModelClass = 'OPNsense\Kea\KeaDhcpDdns';
+
+    /* Forward DDNS domains */
+    public function searchForwardDomainAction()
+    {
+        return $this->searchBase('forward_ddns.ddns_domains', null, 'name');
+    }
+
+    public function getForwardDomainAction($uuid = null)
+    {
+        return $this->getBase('ddns_domains', 'forward_ddns.ddns_domains', $uuid);
+    }
+
+    public function addForwardDomainAction()
+    {
+        return $this->addBase('ddns_domains', 'forward_ddns.ddns_domains');
+    }
+
+    public function setForwardDomainAction($uuid)
+    {
+        return $this->setBase('ddns_domains', 'forward_ddns.ddns_domains', $uuid);
+    }
+
+    public function delForwardDomainAction($uuid)
+    {
+        return $this->delBase('forward_ddns.ddns_domains', $uuid);
+    }
+
+    /* Reverse DDNS domains */
+    public function searchReverseDomainAction()
+    {
+        return $this->searchBase('reverse_ddns.ddns_domains', null, 'name');
+    }
+
+    public function getReverseDomainAction($uuid = null)
+    {
+        return $this->getBase('ddns_domains', 'reverse_ddns.ddns_domains', $uuid);
+    }
+
+    public function addReverseDomainAction()
+    {
+        return $this->addBase('ddns_domains', 'reverse_ddns.ddns_domains');
+    }
+
+    public function setReverseDomainAction($uuid)
+    {
+        return $this->setBase('ddns_domains', 'reverse_ddns.ddns_domains', $uuid);
+    }
+
+    public function delReverseDomainAction($uuid)
+    {
+        return $this->delBase('reverse_ddns.ddns_domains', $uuid);
+    }
+
+    /* TSIG keys */
+    public function searchTsigKeyAction()
+    {
+        return $this->searchBase('tsig_keys', null, 'name');
+    }
+
+    public function getTsigKeyAction($uuid = null)
+    {
+        return $this->getBase('tsig_keys', 'tsig_keys', $uuid);
+    }
+
+    public function addTsigKeyAction()
+    {
+        return $this->addBase('tsig_keys', 'tsig_keys');
+    }
+
+    public function setTsigKeyAction($uuid)
+    {
+        return $this->setBase('tsig_keys', 'tsig_keys', $uuid);
+    }
+
+    public function delTsigKeyAction($uuid)
+    {
+        return $this->delBase('tsig_keys', $uuid);
+    }
+
+    /* Shared DNS servers */
+    public function searchDnsServerAction()
+    {
+        return $this->searchBase('dns_servers', null, 'ip_address');
+    }
+
+    public function getDnsServerAction($uuid = null)
+    {
+        return $this->getBase('dns_servers', 'dns_servers', $uuid);
+    }
+
+    public function addDnsServerAction()
+    {
+        return $this->addBase('dns_servers', 'dns_servers');
+    }
+
+    public function setDnsServerAction($uuid)
+    {
+        return $this->setBase('dns_servers', 'dns_servers', $uuid);
+    }
+
+    public function delDnsServerAction($uuid)
+    {
+        return $this->delBase('dns_servers', $uuid);
+    }
+}

src/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php

@@ -88,4 +88,26 @@ public function leases6Action()
     {
         $this->view->pick('OPNsense/Kea/leases6');
     }
+
+    public function ddnsAction()
+    {
+        $this->view->pick('OPNsense/Kea/dhcp_ddns');
+        $this->view->formGeneralSettings = $this->getForm("generalSettingsDdns");
+
+        // Forward zones (domains)
+        $this->view->formDialogForwardDomain = $this->getForm("dialogDdnsForwardDomain");
+        $this->view->formGridForwardDomain = $this->getFormGrid("dialogDdnsForwardDomain");
+
+        // Reverse zones (domains)
+        $this->view->formDialogReverseDomain = $this->getForm("dialogDdnsReverseDomain");
+        $this->view->formGridReverseDomain = $this->getFormGrid("dialogDdnsReverseDomain");
+
+        // Shared DNS servers
+        $this->view->formDialogDnsServer = $this->getForm("dialogDdnsDnsServer");
+        $this->view->formGridDnsServer = $this->getFormGrid("dialogDdnsDnsServer");
+
+        // TSIG keys
+        $this->view->formDialogTsigKey = $this->getForm("dialogDdnsTsigKey");
+        $this->view->formGridTsigKey = $this->getFormGrid("dialogDdnsTsigKey");
+    }
 }

src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsDnsServer.xml

@@ -0,0 +1,26 @@
+<form>
+    <field>
+        <id>dns_servers.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help>Description for this DNS server entry</help>
+    </field>
+    <field>
+        <id>dns_servers.ip_address</id>
+        <label>IP address</label>
+        <type>text</type>
+        <help>DNS server IP address (IPv4 or IPv6)</help>
+    </field>
+    <field>
+        <id>dns_servers.port</id>
+        <label>Port</label>
+        <type>text</type>
+        <help>DNS server port, default 53</help>
+    </field>
+    <field>
+        <id>dns_servers.key_name</id>
+        <label>TSIG key</label>
+        <type>dropdown</type>
+        <help>Select an optional TSIG key for updates sent to this server. When set, this server-specific key overrides any TSIG key configured on the domain/zone.</help>
+    </field>
+</form>

src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsForwardDomain.xml

@@ -0,0 +1,20 @@
+<form>
+    <field>
+        <id>ddns_domains.name</id>
+        <label>Forward domain</label>
+        <type>text</type>
+        <help>Forward DDNS domain (e.g. example.com.)</help>
+    </field>
+    <field>
+        <id>ddns_domains.key_name</id>
+        <label>TSIG key</label>
+        <type>dropdown</type>
+        <help>Select an optional TSIG key to authenticate updates for this domain. Note: if a DNS server has a TSIG key configured, that server-specific key takes precedence over the domain key.</help>
+    </field>
+    <field>
+        <id>ddns_domains.dns_servers</id>
+        <label>DNS servers</label>
+        <type>select_multiple</type>
+        <help>Select one or more shared DNS servers to update for this domain.</help>
+    </field>
+</form>

src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsReverseDomain.xml

@@ -0,0 +1,20 @@
+<form>
+    <field>
+        <id>ddns_domains.name</id>
+        <label>Reverse domain</label>
+        <type>text</type>
+        <help>Reverse DDNS domain (e.g. 0.168.192.in-addr.arpa. or ip6.arpa. variant)</help>
+    </field>
+    <field>
+        <id>ddns_domains.key_name</id>
+        <label>TSIG key</label>
+        <type>dropdown</type>
+        <help>Select an optional TSIG key to authenticate updates for this reverse zone. Note: if a DNS server has a TSIG key configured, that server-specific key takes precedence over the domain key.</help>
+    </field>
+    <field>
+        <id>ddns_domains.dns_servers</id>
+        <label>DNS servers</label>
+        <type>select_multiple</type>
+        <help>Select one or more shared DNS servers to update for this reverse zone.</help>
+    </field>
+</form>

src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsTsigKey.xml

@@ -0,0 +1,20 @@
+<form>
+    <field>
+        <id>tsig_keys.name</id>
+        <label>Name</label>
+        <type>text</type>
+        <help>TSIG key name.</help>
+    </field>
+    <field>
+        <id>tsig_keys.algorithm</id>
+        <label>Algorithm</label>
+        <type>dropdown</type>
+        <help>Select the TSIG hash algorithm.</help>
+    </field>
+    <field>
+        <id>tsig_keys.secret</id>
+        <label>Secret</label>
+        <type>text</type>
+        <help>Base64-encoded shared secret.</help>
+    </field>
+</form>