kea: T7821: Update paths for Kea v2.7.9 security changes

13 files changed, 32 insertions, 22 deletions

diff --git a/data/templates/dhcp-server/kea-dhcp-ddns.conf.j2 b/data/templates/dhcp-server/kea-dhcp-ddns.conf.j2
index e734a37f3..5393ec839 100644
--- a/data/templates/dhcp-server/kea-dhcp-ddns.conf.j2
+++ b/data/templates/dhcp-server/kea-dhcp-ddns.conf.j2
@@ -5,10 +5,10 @@
         "control-socket": {
 {% if vrf_context is vyos_defined %}
             "socket-type": "unix",
-            "socket-name": "/run/kea/kea-ddns-{{ vrf_context }}-ctrl-socket"
+            "socket-name": "/var/run/kea/kea-ddns-{{ vrf_context }}-ctrl-socket"
 {% else %}
             "socket-type": "unix",
-            "socket-name": "/run/kea/kea-ddns-ctrl-socket"
+            "socket-name": "/var/run/kea/kea-ddns-ctrl-socket"
 {% endif %}
         },
         "tsig-keys": {{ dynamic_dns_update | kea_dynamic_dns_update_tsig_key_json }},
diff --git a/data/templates/dhcp-server/kea-dhcp4.conf.j2 b/data/templates/dhcp-server/kea-dhcp4.conf.j2
index 60c9cf9b2..031b14137 100644
--- a/data/templates/dhcp-server/kea-dhcp4.conf.j2
+++ b/data/templates/dhcp-server/kea-dhcp4.conf.j2
@@ -17,10 +17,10 @@
         "control-socket": {
 {% if vrf_context is vyos_defined %}
             "socket-type": "unix",
-            "socket-name": "/run/kea/dhcp4-{{ vrf_context }}-ctrl-socket"
+            "socket-name": "/var/run/kea/dhcp4-{{ vrf_context }}-ctrl-socket"
 {% else %}
             "socket-type": "unix",
-            "socket-name": "/run/kea/dhcp4-ctrl-socket"
+            "socket-name": "/var/run/kea/dhcp4-ctrl-socket"
 {% endif %}
         },
         "lease-database": {
diff --git a/data/templates/dhcp-server/kea-dhcp6.conf.j2 b/data/templates/dhcp-server/kea-dhcp6.conf.j2
index 4352bbae7..41e31d35e 100644
--- a/data/templates/dhcp-server/kea-dhcp6.conf.j2
+++ b/data/templates/dhcp-server/kea-dhcp6.conf.j2
@@ -12,10 +12,10 @@
         "control-socket": {
 {% if vrf_context is vyos_defined %}
             "socket-type": "unix",
-            "socket-name": "/run/kea/dhcp6-{{ vrf_context }}-ctrl-socket"
+            "socket-name": "/var/run/kea/dhcp6-{{ vrf_context }}-ctrl-socket"
 {% else %}
             "socket-type": "unix",
-            "socket-name": "/run/kea/dhcp6-ctrl-socket"
+            "socket-name": "/var/run/kea/dhcp6-ctrl-socket"
 {% endif %}
         },
         "lease-database": {
diff --git a/python/vyos/kea.py b/python/vyos/kea.py
index c7ae94b14..b2b92ef21 100644
--- a/python/vyos/kea.py
+++ b/python/vyos/kea.py
@@ -60,7 +60,7 @@ kea6_options = {
     'capwap_controller': 'capwap-ac-v6',
 }
 
-kea_ctrl_socket = '/run/kea/dhcp{inet}{vrf_append}-ctrl-socket'
+kea_ctrl_socket = '/var/run/kea/dhcp{inet}{vrf_append}-ctrl-socket'
 
 
 def _format_hex_string(in_str):
diff --git a/smoketest/scripts/cli/test_service_dhcp-server.py b/smoketest/scripts/cli/test_service_dhcp-server.py
index f1abc5216..f32a8796b 100755
--- a/smoketest/scripts/cli/test_service_dhcp-server.py
+++ b/smoketest/scripts/cli/test_service_dhcp-server.py
@@ -33,9 +33,9 @@ from vyos.template import dec_ip
 
 PROCESS_NAME = 'kea-dhcp4'
 D2_PROCESS_NAME = 'kea-dhcp-ddns'
-KEA4_CONF = '/run/kea/kea-dhcp4.conf'
-KEA4_D2_CONF = '/run/kea/kea-dhcp-ddns.conf'
-KEA4_CTRL = '/run/kea/dhcp4-ctrl-socket'
+KEA4_CONF = '/var/run/kea/kea-dhcp4.conf'
+KEA4_D2_CONF = '/var/run/kea/kea-dhcp-ddns.conf'
+KEA4_CTRL = '/var/run/kea/dhcp4-ctrl-socket'
 HOSTSD_CLIENT = '/usr/bin/vyos-hostsd-client'
 base_path = ['service', 'dhcp-server']
 interface = 'dum8765'
diff --git a/smoketest/scripts/cli/test_service_dhcpv6-server.py b/smoketest/scripts/cli/test_service_dhcpv6-server.py
index ab4604165..39142c720 100755
--- a/smoketest/scripts/cli/test_service_dhcpv6-server.py
+++ b/smoketest/scripts/cli/test_service_dhcpv6-server.py
@@ -26,7 +26,7 @@ from vyos.utils.process import process_named_running
 from vyos.utils.file import read_file
 
 PROCESS_NAME = 'kea-dhcp6'
-KEA6_CONF = '/run/kea/kea-dhcp6.conf'
+KEA6_CONF = '/var/run/kea/kea-dhcp6.conf'
 base_path = ['service', 'dhcpv6-server']
 
 subnet = '2001:db8:f00::/64'
diff --git a/smoketest/scripts/cli/test_vrf.py b/smoketest/scripts/cli/test_vrf.py
index 66a95cd02..59b0b7254 100755
--- a/smoketest/scripts/cli/test_vrf.py
+++ b/smoketest/scripts/cli/test_vrf.py
@@ -652,7 +652,7 @@ class VRFTest(VyOSUnitTestSHIM.TestCase):
 
         # declare fiels
         process_name = 'kea-dhcp4'
-        kea4_conf = f'/run/kea/kea-{vrf}-dhcp4.conf'
+        kea4_conf = f'/var/run/kea/kea-{vrf}-dhcp4.conf'
 
         # create interface
         cidr_mask = subnet.split('/')[-1]
@@ -791,7 +791,7 @@ class VRFTest(VyOSUnitTestSHIM.TestCase):
 
         # declare fiels
         process_name = 'kea-dhcp6'
-        kea6_conf = f'/run/kea/kea-{vrf}-dhcp6.conf'
+        kea6_conf = f'/var/run/kea/kea-{vrf}-dhcp6.conf'
 
         # create interface
         self.cli_set(['interfaces', 'dummy', interface, 'address', f'{interface_addr}'])
diff --git a/src/etc/systemd/system/isc-kea-dhcp-ddns-server.service.d/override.conf b/src/etc/systemd/system/isc-kea-dhcp-ddns-server.service.d/override.conf
index cdfdea8eb..0afaacd71 100644
--- a/src/etc/systemd/system/isc-kea-dhcp-ddns-server.service.d/override.conf
+++ b/src/etc/systemd/system/isc-kea-dhcp-ddns-server.service.d/override.conf
@@ -4,4 +4,4 @@ After=vyos-router.service
 
 [Service]
 ExecStart=
-ExecStart=/usr/sbin/kea-dhcp-ddns -c /run/kea/kea-dhcp-ddns.conf
+ExecStart=/usr/sbin/kea-dhcp-ddns -c /var/run/kea/kea-dhcp-ddns.conf
diff --git a/src/etc/systemd/system/isc-kea-dhcp-ddns-server@.service b/src/etc/systemd/system/isc-kea-dhcp-ddns-server@.service
index b6360e573..9451addd4 100644
--- a/src/etc/systemd/system/isc-kea-dhcp-ddns-server@.service
+++ b/src/etc/systemd/system/isc-kea-dhcp-ddns-server@.service
@@ -14,8 +14,8 @@ RuntimeDirectoryPreserve=yes
 LogsDirectory=kea
 LogsDirectoryMode=0750
 StateDirectory=kea
-ExecStart=sudo /bin/ip vrf exec %i /usr/sbin/kea-dhcp-ddns -c /run/kea/kea-%i-dhcp-ddns.conf
-ExecStartPost=/bin/sh -c 'sleep 10 && sudo /usr/bin/chown _kea:_kea /run/kea/kea-%i-dhcp-ddns* && sudo /usr/bin/chown _kea:_kea /run/kea/logger_lockfile'
+ExecStart=sudo /bin/ip vrf exec %i /usr/sbin/kea-dhcp-ddns -c /var/run/kea/kea-%i-dhcp-ddns.conf
+ExecStartPost=/bin/sh -c 'sleep 10 && sudo /usr/bin/chown _kea:_kea /var/run/kea/kea-%i-dhcp-ddns* && sudo /usr/bin/chown _kea:_kea /run/kea/logger_lockfile'
 Restart=on-failure
 
 [Install]
diff --git a/src/etc/systemd/system/isc-kea-dhcp4-server.service.d/override.conf b/src/etc/systemd/system/isc-kea-dhcp4-server.service.d/override.conf
index 4a04892c0..f315e197b 100644
--- a/src/etc/systemd/system/isc-kea-dhcp4-server.service.d/override.conf
+++ b/src/etc/systemd/system/isc-kea-dhcp4-server.service.d/override.conf
@@ -3,7 +3,9 @@ After=
 After=vyos-router.service
 
 [Service]
+Environment="KEA_DHCP_DATA_DIR=/config/dhcp"
+Environment="KEA_HOOK_SCRIPTS_PATH=/usr/libexec/vyos/system"
 ExecStart=
-ExecStart=/usr/sbin/kea-dhcp4 -c /run/kea/kea-dhcp4.conf
+ExecStart=/usr/sbin/kea-dhcp4 -c /var/run/kea/kea-dhcp4.conf
 ExecStartPost=!/usr/bin/python3 /usr/libexec/vyos/system/sync-dhcp-lease-to-hosts.py --inet
 Restart=on-failure
diff --git a/src/etc/systemd/system/isc-kea-dhcp4-server@.service b/src/etc/systemd/system/isc-kea-dhcp4-server@.service
index f63364275..155333359 100644
--- a/src/etc/systemd/system/isc-kea-dhcp4-server@.service
+++ b/src/etc/systemd/system/isc-kea-dhcp4-server@.service
@@ -7,15 +7,18 @@ After=vyos-router.service
 [Service]
 User=_kea
 AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
+Environment="KEA_DHCP_DATA_DIR=/config/dhcp"
+Environment="KEA_HOOK_SCRIPTS_PATH=/usr/libexec/vyos/system"
 Environment="KEA_LOCKFILE_DIR=/run/lock/kea"
 ConfigurationDirectory=kea
+ConfigurationDirectoryMode=0750
 RuntimeDirectory=kea lock/kea
 RuntimeDirectoryPreserve=yes
 LogsDirectory=kea
 LogsDirectoryMode=0750
 StateDirectory=kea
-ExecStart=sudo /bin/ip vrf exec %i /usr/sbin/kea-dhcp4 -c /run/kea/kea-%i-dhcp4.conf
-ExecStartPost=/bin/sh -c 'sleep 10 && sudo /usr/bin/chown _kea:_kea /run/kea/dhcp4-%i-ctrl* && sudo /usr/bin/chown _kea:_kea /run/kea/kea-%i-dhcp4* && sudo /usr/bin/chown _kea:_kea /run/kea/logger_lockfile'
+ExecStart=sudo /bin/ip vrf exec %i /usr/sbin/kea-dhcp4 -c /var/run/kea/kea-%i-dhcp4.conf
+ExecStartPost=/bin/sh -c 'sleep 10 && sudo /usr/bin/chown _kea:_kea /var/run/kea/dhcp4-%i-ctrl* && sudo /usr/bin/chown _kea:_kea /var/run/kea/kea-%i-dhcp4* && sudo /usr/bin/chown _kea:_kea /run/kea/logger_lockfile'
 Restart=on-failure
 
 [Install]
diff --git a/src/etc/systemd/system/isc-kea-dhcp6-server.service.d/override.conf b/src/etc/systemd/system/isc-kea-dhcp6-server.service.d/override.conf
index cb33fc057..cc1885877 100644
--- a/src/etc/systemd/system/isc-kea-dhcp6-server.service.d/override.conf
+++ b/src/etc/systemd/system/isc-kea-dhcp6-server.service.d/override.conf
@@ -3,5 +3,7 @@ After=
 After=vyos-router.service
 
 [Service]
+Environment="KEA_DHCP_DATA_DIR=/config/dhcp"
+Environment="KEA_HOOK_SCRIPTS_PATH=/usr/libexec/vyos/system"
 ExecStart=
-ExecStart=/usr/sbin/kea-dhcp6 -c /run/kea/kea-dhcp6.conf
+ExecStart=/usr/sbin/kea-dhcp6 -c /var/run/kea/kea-dhcp6.conf
diff --git a/src/etc/systemd/system/isc-kea-dhcp6-server@.service b/src/etc/systemd/system/isc-kea-dhcp6-server@.service
index 1d2330f74..8e71b51ee 100644
--- a/src/etc/systemd/system/isc-kea-dhcp6-server@.service
+++ b/src/etc/systemd/system/isc-kea-dhcp6-server@.service
@@ -7,15 +7,18 @@ After=vyos-router.service
 [Service]
 User=_kea
 AmbientCapabilities=CAP_NET_BIND_SERVICE
+Environment="KEA_DHCP_DATA_DIR=/config/dhcp"
+Environment="KEA_HOOK_SCRIPTS_PATH=/usr/libexec/vyos/system"
 Environment="KEA_LOCKFILE_DIR=/run/lock/kea"
 ConfigurationDirectory=kea
+ConfigurationDirectoryMode=0750
 RuntimeDirectory=kea lock/kea
 RuntimeDirectoryPreserve=yes
 LogsDirectory=kea
 LogsDirectoryMode=0750
 StateDirectory=kea
-ExecStart=sudo /bin/ip vrf exec %i /usr/sbin/kea-dhcp6 -c /run/kea/kea-%i-dhcp6.conf
-ExecStartPost=/bin/sh -c 'sleep 10 && sudo /usr/bin/chown _kea:_kea /run/kea/dhcp6-%i-ctrl* && sudo /usr/bin/chown _kea:_kea /run/kea/kea-%i-dhcp6* && sudo /usr/bin/chown _kea:_kea /run/kea/logger_lockfile'
+ExecStart=sudo /bin/ip vrf exec %i /usr/sbin/kea-dhcp6 -c /var/run/kea/kea-%i-dhcp6.conf
+ExecStartPost=/bin/sh -c 'sleep 10 && sudo /usr/bin/chown _kea:_kea /var/run/kea/dhcp6-%i-ctrl* && sudo /usr/bin/chown _kea:_kea /var/run/kea/kea-%i-dhcp6* && sudo /usr/bin/chown _kea:_kea /run/kea/logger_lockfile'
 Restart=on-failure
 
 [Install]