search

opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.25k stars 725 forks source link

Support advanced Kea configs via drop-ins #7822

Open mrguitar opened 2 weeks ago

mrguitar commented 2 weeks ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Is your feature request related to a problem? Please describe. The UI can't express many of the advanced Kea options. ISC gave us the ability to add configs to /usr/local/etc/dhcpd.opnsense.d/ to get around UI limitations.

A clear and concise description of what the problem is including your motivation for the request, i.e. "For the purpose of [...] I am missing a solution that will [...]."

On my network I need to include HTTPClient information to support UEFI HTTP boot for clients. I'm stuck on ISC DHCP for the time being, no worries for the short run, but I assume Kea will take over at some point.

Describe the solution you like

It would be ideal if we could source drop-in config files with Kea, similar to what was possible with ISC DHCP. My use case was looked at in https://github.com/opnsense/core/issues/6669

UEFI HTTP boot settings never made it in the opnsense UI for ISC DHCP. While that's not ideal, we had a great backstop where I could create something like this: /usr/local/etc/dhcpd.opnsense.d/httpboot.conf

class "httpclients" { option vendor-class-identifier "HTTPClient"; match if substring (option vendor-class-identifier, 0, 10) = "HTTPClient"; filename "http://blahblahblha/file.EFI"; }

A clear and concise description of what you want to happen. (e.g. I would like an input field in the /ui/firewall/alias which would add .... to ....)

With Kea, we're going to be in a similar situation where we can't add all the options to the UI. Ideally we could supply our own config, or better yet, add drop-in configs that get appended to the config generated by the UI.

Describe alternatives you considered I haven't found one. Obviously as long as ISC is around it's not an immediate problem. I haven't check on pfsense in a while, but I suspect they'll have it in the UI as they added it to ISC a couple years ago.

AdSchellevis commented 2 weeks ago

Unfortunately kea's config files can't be merged easily, offering an option to only use a custom configuration file (and don't use ours) is likely the best achievable. An option to skip generation is implementable, but needs proper documentation as well.

https://github.com/opnsense/core/blob/5e5cab98b451f09e3168c6eda8191553b00ab1d5/src/etc/inc/plugins.inc.d/kea.inc#L118

mrguitar commented 2 weeks ago

I think that's a great idea. Imagine a noob user (hey, that's me!) could use the UI to generate ~98% of the necessary config, flip on the option to stop generating the config, and edit or replace the config. Something like this feels like getting the best of both worlds. Use the UI where it excels, VI for the rest! ;) It may not be practical for everyone, but editing the config directly in the browser would be nice too.

Cheers,

AdSchellevis commented 2 weeks ago

I'm sure we won't offer a browser edit of the file for security reasons, but having a toggle to use your custom config might be something we can discuss internally (in which case you would be able to use our generated config as a starting point, without the guarantee it will survive upgrades).

mrguitar commented 2 weeks ago

No guarantee for surviving upgrades is completely reasonable IMO. I think the value here is really in providing an escape hatch for users. Call it "manual mode" or something. Users will love it! ;) Thank you for listening to my silly needs!