T8243: dhcp: add RFC9463 DNR support for Kea DHCPv4/DHCPv6

interface-definitions/include/dhcp/dnr-common.xml.i

@@ -0,0 +1,24 @@
+<!-- include start from dhcp/dnr-common.xml.i -->
+<leafNode name="priority">
+  <properties>
+    <help>DNR service priority</help>
+    <valueHelp>
+      <format>u32:0-65535</format>
+      <description>Lower value means higher preference</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 0-65535"/>
+    </constraint>
+    <constraintErrorMessage>DNR priority must be between 0 and 65535</constraintErrorMessage>
+  </properties>
+</leafNode>
+<leafNode name="authentication-domain-name">
+  <properties>
+    <help>Authentication domain name (ADN) for encrypted DNS resolver</help>
+    <constraint>
+      <validator name="fqdn"/>
+    </constraint>
+    <constraintErrorMessage>Invalid authentication domain name</constraintErrorMessage>
+  </properties>
+</leafNode>
+<!-- include end -->

interface-definitions/include/dhcp/dnr-service-parameters.xml.i

@@ -0,0 +1,32 @@
+<!-- include start from dhcp/dnr-service-parameters.xml.i -->
+<node name="service-parameter">
+  <properties>
+    <help>DNR service parameter</help>
+  </properties>
+  <children>
+    <leafNode name="alpn">
+      <properties>
+        <help>Application-Layer Protocol Negotiation (ALPN)</help>
+        <completionHelp>
+          <list>dot doq h2 h3</list>
+        </completionHelp>
+        <constraint>
+          <regex>[A-Za-z0-9._-]+</regex>
+        </constraint>
+        <constraintErrorMessage>ALPN identifier may only contain letters, digits, dot, underscore, and hyphen</constraintErrorMessage>
+        <multi/>
+      </properties>
+    </leafNode>
+    #include <include/port-number.xml.i>
+    <leafNode name="dohpath">
+      <properties>
+        <help>Relative DoH URI template path (example /dns-query{?dns})</help>
+        <constraint>
+          <regex>[[:graph:]]+</regex>
+        </constraint>
+        <constraintErrorMessage>DoH path must not contain whitespace</constraintErrorMessage>
+      </properties>
+    </leafNode>
+  </children>
+</node>
+<!-- include end -->

interface-definitions/include/dhcp/dnr-v4.xml.i

@@ -0,0 +1,32 @@
+<!-- include start from dhcp/dnr-v4.xml.i -->
+<tagNode name="dnr">
+  <properties>
+    <help>Discovery of Network-designated Resolvers (DNR)</help>
+    <valueHelp>
+      <format>u32:1-9999</format>
+      <description>DNR instance identifier</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-9999"/>
+    </constraint>
+    <constraintErrorMessage>DNR instance identifier must be between 1 and 9999</constraintErrorMessage>
+  </properties>
+  <children>
+    #include <include/dhcp/dnr-common.xml.i>
+    <leafNode name="address">
+      <properties>
+        <help>IPv4 address of encrypted DNS resolver</help>
+        <valueHelp>
+          <format>ipv4</format>
+          <description>IPv4 resolver address</description>
+        </valueHelp>
+        <constraint>
+          <validator name="ipv4-address"/>
+        </constraint>
+        <multi/>
+      </properties>
+    </leafNode>
+    #include <include/dhcp/dnr-service-parameters.xml.i>
+  </children>
+</tagNode>
+<!-- include end -->

interface-definitions/include/dhcp/dnr-v6.xml.i

@@ -0,0 +1,32 @@
+<!-- include start from dhcp/dnr-v6.xml.i -->
+<tagNode name="dnr">
+  <properties>
+    <help>Discovery of Network-designated Resolvers (DNR)</help>
+    <valueHelp>
+      <format>u32:1-9999</format>
+      <description>DNR instance identifier</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-9999"/>
+    </constraint>
+    <constraintErrorMessage>DNR instance identifier must be between 1 and 9999</constraintErrorMessage>
+  </properties>
+  <children>
+    #include <include/dhcp/dnr-common.xml.i>
+    <leafNode name="address">
+      <properties>
+        <help>IPv6 address of encrypted DNS resolver</help>
+        <valueHelp>
+          <format>ipv6</format>
+          <description>IPv6 resolver address</description>
+        </valueHelp>
+        <constraint>
+          <validator name="ipv6-address"/>
+        </constraint>
+        <multi/>
+      </properties>
+    </leafNode>
+    #include <include/dhcp/dnr-service-parameters.xml.i>
+  </children>
+</tagNode>
+<!-- include end -->

interface-definitions/include/dhcp/option-v4.xml.i

@@ -7,6 +7,7 @@
     #include <include/dhcp/captive-portal.xml.i>
     #include <include/dhcp/domain-name.xml.i>
     #include <include/dhcp/domain-search.xml.i>
+    #include <include/dhcp/dnr-v4.xml.i>
     #include <include/dhcp/ntp-server.xml.i>
     #include <include/name-server-ipv4.xml.i>
     <leafNode name="bootfile-name">

interface-definitions/include/dhcp/option-v6.xml.i

@@ -6,6 +6,7 @@
   <children>
     #include <include/dhcp/captive-portal.xml.i>
     #include <include/dhcp/domain-search.xml.i>
+    #include <include/dhcp/dnr-v6.xml.i>
     #include <include/name-server-ipv6.xml.i>
     <leafNode name="capwap-controller">
       <properties>

python/vyos/kea.py

@@ -96,6 +96,94 @@ def kea_test_config(process: str, config_path: str) -> tuple[bool, str]:
     find = re.search(r'Error encountered:\s([^\n$]+)', output)
     return (False, find[1] if find else None)
 
+
+def _kea_dnr_sort_key(instance_id):
+    value = str(instance_id)
+    if value.isdigit():
+        return (0, int(value))
+    return (1, value)
+
+
+def _kea_dnr_normalize_list(value):
+    if value is None:
+        return []
+
+    if isinstance(value, list):
+        return value
+
+    return [value]
+
+
+def _kea_dnr_parse_service_parameters(service_parameter):
+    if not service_parameter:
+        return ''
+
+    params = []
+
+    alpn = _kea_dnr_normalize_list(service_parameter.get('alpn'))
+    if alpn:
+        params.append('alpn=' + r'\,'.join(alpn))
+
+    if 'port' in service_parameter:
+        params.append(f'port={int(service_parameter["port"])}')
+
+    if 'dohpath' in service_parameter:
+        dohpath = service_parameter['dohpath']
+        # Kea expects "{?dns}" in dohpath. To keep CLI ergonomic, append it for
+        # plain paths (e.g. "/dns-query"), but reject custom templates that
+        # do not include "{?dns}".
+        if '{?dns}' not in dohpath:
+            if '{' in dohpath or '}' in dohpath:
+                raise ConfigError(
+                    'DNR service-parameter "dohpath" URI template must include "{?dns}"'
+                )
+            dohpath = f'{dohpath}{{?dns}}'
+
+        # RFC 9463 allows pipe in dohpath, it must be escaped for Kea parser.
+        dohpath = dohpath.replace('|', r'\|')
+        params.append(f'dohpath={dohpath}')
+
+    return ' '.join(params)
+
+
+def _kea_parse_dnr_instances(dnr_config):
+    if not dnr_config:
+        return []
+
+    entries = []
+
+    for instance_id, instance_config in sorted(
+        dnr_config.items(), key=lambda entry: _kea_dnr_sort_key(entry[0])
+    ):
+        if 'priority' not in instance_config:
+            raise ConfigError(
+                f'DNR instance "{instance_id}" requires "priority" to be configured'
+            )
+
+        if 'authentication_domain_name' not in instance_config:
+            raise ConfigError(
+                f'DNR instance "{instance_id}" requires '
+                '"authentication-domain-name" to be configured'
+            )
+
+        priority = int(instance_config['priority'])
+        data_fields = [str(priority), instance_config['authentication_domain_name']]
+
+        address = _kea_dnr_normalize_list(instance_config.get('address'))
+        service_parameter = _kea_dnr_parse_service_parameters(
+            instance_config.get('service_parameter')
+        )
+
+        if address or service_parameter:
+            data_fields.append(' '.join(address))
+
+        if service_parameter:
+            data_fields.append(service_parameter)
+
+        entries.append(', '.join(data_fields))
+
+    return entries
+
 def kea_parse_options(config):
     options = []
 
@@ -154,6 +242,10 @@ def kea_parse_options(config):
             {'name': 'unifi-controller', 'data': unifi_controller, 'space': 'ubnt'}
         )
 
+    dnr_entries = _kea_parse_dnr_instances(config.get('dnr'))
+    if dnr_entries:
+        options.append({'name': 'v4-dnr', 'data': ' | '.join(dnr_entries)})
+
     return options
 
 
@@ -280,6 +372,11 @@ def kea6_parse_options(config):
             {'name': 'tftp-servers', 'code': 2, 'space': 'cisco', 'data': cisco_tftp}
         )
 
+    dnr_entries = _kea_parse_dnr_instances(config.get('dnr'))
+    if dnr_entries:
+        for dnr_entry in dnr_entries:
+            options.append({'name': 'v6-dnr', 'data': dnr_entry})
+
     return options
 
 

smoketest/scripts/cli/test_service_dhcp-server.py

@@ -482,6 +482,100 @@ def test_dhcp_single_pool_options(self):
         # Check for running process
         self.verify_service_running()
 
+    def test_dhcp_single_pool_dnr_option(self):
+        shared_net_name = 'SMOKE-DNR'
+        range_0_start = inc_ip(subnet, 10)
+        range_0_stop = inc_ip(subnet, 20)
+        dnr_ipv4 = inc_ip(subnet, 100)
+
+        pool = base_path + ['shared-network-name', shared_net_name, 'subnet', subnet]
+        self.cli_set(pool + ['subnet-id', '1'])
+        self.cli_set(pool + ['range', '0', 'start', range_0_start])
+        self.cli_set(pool + ['range', '0', 'stop', range_0_stop])
+
+        self.cli_set(pool + ['option', 'dnr', '10', 'priority', '100'])
+        self.cli_set(
+            pool
+            + [
+                'option',
+                'dnr',
+                '10',
+                'authentication-domain-name',
+                'resolver1.example',
+            ]
+        )
+        self.cli_set(pool + ['option', 'dnr', '10', 'address', dnr_ipv4])
+        self.cli_set(pool + ['option', 'dnr', '10', 'service-parameter', 'alpn', 'dot'])
+        self.cli_set(pool + ['option', 'dnr', '10', 'service-parameter', 'alpn', 'doq'])
+        self.cli_set(pool + ['option', 'dnr', '10', 'service-parameter', 'port', '853'])
+        self.cli_set(
+            pool
+            + [
+                'option',
+                'dnr',
+                '10',
+                'service-parameter',
+                'dohpath',
+                '/dns-query',
+            ]
+        )
+
+        self.cli_set(pool + ['option', 'dnr', '20', 'priority', '200'])
+        self.cli_set(
+            pool
+            + [
+                'option',
+                'dnr',
+                '20',
+                'authentication-domain-name',
+                'resolver2.example',
+            ]
+        )
+
+        self.cli_commit()
+
+        config = read_file(KEA4_CONF)
+        obj = loads(config)
+
+        dnr_data = (
+            f'100, resolver1.example, {dnr_ipv4}, '
+            'alpn=dot\\,doq port=853 dohpath=/dns-query{?dns} | '
+            '200, resolver2.example'
+        )
+        self.verify_config_object(
+            obj,
+            ['Dhcp4', 'shared-networks', 0, 'subnet4', 0, 'option-data'],
+            {'name': 'v4-dnr', 'data': dnr_data},
+        )
+
+        self.verify_service_running()
+
+    def test_dhcp_dnr_http_alpn_requires_dohpath(self):
+        shared_net_name = 'SMOKE-DNR-VERIFY'
+        range_0_start = inc_ip(subnet, 10)
+        range_0_stop = inc_ip(subnet, 20)
+
+        pool = base_path + ['shared-network-name', shared_net_name, 'subnet', subnet]
+        self.cli_set(pool + ['subnet-id', '1'])
+        self.cli_set(pool + ['range', '0', 'start', range_0_start])
+        self.cli_set(pool + ['range', '0', 'stop', range_0_stop])
+
+        self.cli_set(pool + ['option', 'dnr', '10', 'priority', '100'])
+        self.cli_set(
+            pool
+            + [
+                'option',
+                'dnr',
+                '10',
+                'authentication-domain-name',
+                'resolver.example',
+            ]
+        )
+        self.cli_set(pool + ['option', 'dnr', '10', 'service-parameter', 'alpn', 'h2'])
+
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
     def test_dhcp_single_pool_options_scoped(self):
         shared_net_name = 'SMOKE-2'