dhcp-server: T8524: Validate DDNS key-name references defined tsig-key

When a key-name is set under dynamic-dns-update forward-domain or
reverse-domain, validate that the referenced TSIG key is defined under
dynamic-dns-update tsig-key. Previously the missing key was only caught
at runtime, causing kea-dhcp-ddns to fail to start with a fatal error.
Also fix a pre-existing bug in `verify_ddns_domain` (formerly
`verify_ddns_domain_servers`) where the function was called with the full
tagNode dict but iterated as if it received a single domain config,
causing the DNS server address check to never actually run.

1 files changed, 47 insertions, 33 deletions

diff --git a/smoketest/scripts/cli/test_service_dhcp-server.py b/smoketest/scripts/cli/test_service_dhcp-server.py
index a4def234c..4a1e5ff64 100755
--- a/smoketest/scripts/cli/test_service_dhcp-server.py
+++ b/smoketest/scripts/cli/test_service_dhcp-server.py
@@ -1356,16 +1356,6 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
                 'SXQncyBXZWRuZXNkYXkgbWFoIGR1ZGVzIQ==',
             ]
         )
-        self.cli_set(ddns + ['tsig-key', 'reverse-0-168-192', 'algorithm', 'sha256'])
-        self.cli_set(
-            ddns
-            + [
-                'tsig-key',
-                'reverse-0-168-192',
-                'secret',
-                'VGhhbmsgR29kIGl0J3MgRnJpZGF5IQ==',
-            ]
-        )
         self.cli_set(
             ddns
             + [
@@ -1413,6 +1403,31 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
                 '1053',
             ]
         )
+
+        shared = base_path + ['shared-network-name', shared_net_name]
+
+        self.cli_set(shared + ['dynamic-dns-update', 'send-updates', 'enable'])
+        self.cli_set(shared + ['dynamic-dns-update', 'conflict-resolution', 'enable'])
+        self.cli_set(shared + ['dynamic-dns-update', 'ttl-percent', '75'])
+
+        pool = shared + ['subnet', subnet]
+
+        self.cli_set(pool + ['subnet-id', '1'])
+
+        self.cli_set(pool + ['range', '0', 'start', range_0_start])
+        self.cli_set(pool + ['range', '0', 'stop', range_0_stop])
+
+        self.cli_set(pool + ['dynamic-dns-update', 'send-updates', 'enable'])
+        self.cli_set(pool + ['dynamic-dns-update', 'generated-prefix', 'myfunnyprefix'])
+        self.cli_set(pool + ['dynamic-dns-update', 'qualifying-suffix', 'suffix.lan'])
+        self.cli_set(pool + ['dynamic-dns-update', 'hostname-char-set', 'xXyYzZ'])
+        self.cli_set(
+            pool + ['dynamic-dns-update', 'hostname-char-replacement', '_xXx_']
+        )
+
+        self.cli_commit()
+
+        # DNS server without an IP address must be rejected
         self.cli_set(
             ddns
             + [
@@ -1420,10 +1435,14 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
                 '0.168.192.in-addr.arpa',
                 'dns-server',
                 '2',
-                'address',
-                '100.100.0.1',
+                'port',
+                '1153',
             ]
         )
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        # Fix missing address — commit must now succeed
         self.cli_set(
             ddns
             + [
@@ -1431,10 +1450,13 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
                 '0.168.192.in-addr.arpa',
                 'dns-server',
                 '2',
-                'port',
-                '1153',
+                'address',
+                '100.100.0.1',
             ]
         )
+        self.cli_commit()
+
+        # key-name referencing a non-existent tsig-key must be rejected
         self.cli_set(
             ddns
             + [
@@ -1444,28 +1466,20 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
                 'reverse-0-168-192',
             ]
         )
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
 
-        shared = base_path + ['shared-network-name', shared_net_name]
-
-        self.cli_set(shared + ['dynamic-dns-update', 'send-updates', 'enable'])
-        self.cli_set(shared + ['dynamic-dns-update', 'conflict-resolution', 'enable'])
-        self.cli_set(shared + ['dynamic-dns-update', 'ttl-percent', '75'])
-
-        pool = shared + ['subnet', subnet]
-
-        self.cli_set(pool + ['subnet-id', '1'])
-
-        self.cli_set(pool + ['range', '0', 'start', range_0_start])
-        self.cli_set(pool + ['range', '0', 'stop', range_0_stop])
-
-        self.cli_set(pool + ['dynamic-dns-update', 'send-updates', 'enable'])
-        self.cli_set(pool + ['dynamic-dns-update', 'generated-prefix', 'myfunnyprefix'])
-        self.cli_set(pool + ['dynamic-dns-update', 'qualifying-suffix', 'suffix.lan'])
-        self.cli_set(pool + ['dynamic-dns-update', 'hostname-char-set', 'xXyYzZ'])
+        # Define the missing tsig-key — commit must now succeed
+        self.cli_set(ddns + ['tsig-key', 'reverse-0-168-192', 'algorithm', 'sha256'])
         self.cli_set(
-            pool + ['dynamic-dns-update', 'hostname-char-replacement', '_xXx_']
+            ddns
+            + [
+                'tsig-key',
+                'reverse-0-168-192',
+                'secret',
+                'VGhhbmsgR29kIGl0J3MgRnJpZGF5IQ==',
+            ]
         )
-
         self.cli_commit()
 
         config = read_file(KEA4_CONF)