dhcp/kea: Install prefix delegation routes targeting IA_NA address

plist

@@ -1239,6 +1239,8 @@
 /usr/local/opnsense/scripts/ipsec/saddelete.py
 /usr/local/opnsense/scripts/ipsec/spddelete.py
 /usr/local/opnsense/scripts/ipsec/updown_event.py
+/usr/local/opnsense/scripts/kea/prefixes.php
+/usr/local/opnsense/scripts/kea/prefixes.sh
 /usr/local/opnsense/scripts/monit/carp_status.php
 /usr/local/opnsense/scripts/monit/gateway_alert.php
 /usr/local/opnsense/scripts/monit/setup.sh

src/etc/inc/plugins.inc.d/kea.inc

@@ -146,6 +146,9 @@ function kea_configure_do($verbose = false)
 {
     $keaDhcpv4 = new \OPNsense\Kea\KeaDhcpv4();
     $keaDhcpv6 = new \OPNsense\Kea\KeaDhcpv6();
+
+    killbypid('/var/run/kea-pd-routes.pid');
+
     if ($keaDhcpv4->isEnabled() || $keaDhcpv6->isEnabled()) {
         service_log('Sync KEA DHCP config...', $verbose);
         if ($keaDhcpv4->isEnabled() && $keaDhcpv4->general->manual_config->isEmpty()) {
@@ -157,6 +160,12 @@ function kea_configure_do($verbose = false)
             $keaDhcpv6->generateConfig();
         }
         (new \OPNsense\Kea\KeaCtrlAgent())->generateConfig();
+        if ($keaDhcpv6->isEnabled()) {
+            mwexecf(
+                '/usr/sbin/daemon -m0 -f -p %s %s',
+                ['/var/run/kea-pd-routes.pid', '/usr/local/opnsense/scripts/kea/prefixes.sh']
+            );
+        }
         service_log("done.\n", $verbose);
     }
 }

src/opnsense/scripts/kea/prefixes.php

@@ -0,0 +1,99 @@
+#!/usr/local/bin/php
+<?php
+
+/*
+ * Copyright (C) 2025 Deciso B.V.
+ * Copyright (C) 2022-2024 Franco Fichtner <[email protected]>
+ * Copyright (C) 2012 Seth Mos <[email protected]>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+require_once 'config.inc';
+require_once 'interfaces.inc';
+require_once 'util.inc';
+
+$leases_file = '/var/db/kea/kea-leases6.csv';
+if (!file_exists($leases_file)) {
+    exit(1);
+}
+
+$duid_arr = [];
+$now = time();
+$fh = new SplFileObject($leases_file, 'r');
+$header = $fh->fgetcsv();
+
+while (!$fh->eof() && ($row = $fh->fgetcsv()) !== false) {
+    if ($row === [null] || count($row) < count($header)) {
+        continue;
+    }
+
+    $lease = @array_combine($header, $row);
+    if (!isset($lease['duid']) || !isset($lease['lease_type']) || !isset($lease['address']) ||
+        $lease['duid'] === '' || $lease['lease_type'] === '' || $lease['address'] === '') {
+        continue;
+    }
+
+    $type = trim($lease['lease_type']);
+    $prefix_len = (int)$lease['prefix_len'];
+    $expire = (int)$lease['expire'];
+    $duid = strtolower(trim($lease['duid']));
+    $address = trim($lease['address']);
+
+    /* Skip expired leases */
+    if ($expire <= $now) {
+        continue;
+    }
+
+    if (!isset($duid_arr[$duid])) {
+        $duid_arr[$duid] = [];
+    }
+
+    /* IA_NA: type 0, prefix_len 128 - used as gateway */
+    if ($type === '0' && $prefix_len === 128) {
+        $duid_arr[$duid]['address'] = $address;
+    }
+    /* IA_PD: type 2, prefix_len <= 64 - the delegated prefix */
+    elseif ($type === '2' && $prefix_len <= 64) {
+        $prefix = "{$address}/{$prefix_len}";
+        $duid_arr[$duid]['prefix'][] = $prefix;
+    }
+}
+
+$routes = [];
+
+/* collect active leases */
+foreach ($duid_arr as $entry) {
+    if (!empty($entry['prefix']) && !empty($entry['address'])) {
+        foreach ($entry['prefix'] as $prefix) {
+            /* new or reassigned takes priority */
+            $routes[$prefix] = $entry['address'];
+        }
+    }
+}
+
+/* delete and re-add routes */
+foreach ($routes as $prefix => $address) {
+    mwexecf('/sbin/route delete -inet6 %s', [$prefix], true);
+    mwexecf('/sbin/route add -inet6 %s %s', [$prefix, $address]);
+}

src/opnsense/scripts/kea/prefixes.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# Copyright (c) 2025 Deciso B.V.
+# Copyright (C) 2022 Franco Fichtner <[email protected]>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# 1. Redistributions of source code must retain the above copyright notice,
+#    this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+CHECKSUM="md5 -q"
+INTERVAL=${1:-20}
+LEASES="/var/db/kea/kea-leases6.csv"
+PREVIOUS=
+
+while :; do
+	CURRENT=$(${CHECKSUM} ${LEASES})
+	if [ "${CURRENT}" != "${PREVIOUS}" ]; then
+		configctl kea update prefixes
+		PREVIOUS=${CURRENT}
+	fi
+	sleep "${INTERVAL}"
+done

src/opnsense/service/conf/actions.d/actions_kea.conf

@@ -34,3 +34,9 @@ command:/usr/local/opnsense/scripts/dhcp/get_kea_leases.py
 parameters:--proto inet6
 type:script_output
 message:list kea inet dhcp leases
+
+[update.prefixes]
+command:/usr/local/opnsense/scripts/kea/prefixes.php
+parameters:
+type:script
+message:update kea IPv6 prefix routes