kea: T7925: Improve error handling, validate IPv6 PD prefix length

2 files changed, 19 insertions, 4 deletions

diff --git a/src/conf_mode/service_dhcp-server.py b/src/conf_mode/service_dhcp-server.py
index d92321ab8..e4730f8a8 100755
--- a/src/conf_mode/service_dhcp-server.py
+++ b/src/conf_mode/service_dhcp-server.py
@@ -25,6 +25,7 @@ from ipaddress import ip_network
 from netaddr import IPRange
 
 from vyos.config import Config
+from vyos.kea import kea_test_config
 from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
 from vyos.template import render
@@ -595,6 +596,10 @@ def apply(dhcp):
 
         return None
 
+    result, output = kea_test_config('kea-dhcp4', config_file)
+    if not result:
+        raise ConfigError(f'Unexpected error with Kea configuration:\n{output}')
+
     for service in services:
         action = 'restart'
 
diff --git a/src/conf_mode/service_dhcpv6-server.py b/src/conf_mode/service_dhcpv6-server.py
index b6a7a87c3..d7b2f2a6d 100755
--- a/src/conf_mode/service_dhcpv6-server.py
+++ b/src/conf_mode/service_dhcpv6-server.py
@@ -24,6 +24,7 @@ from ipaddress import ip_address
 from ipaddress import ip_network
 
 from vyos.config import Config
+from vyos.kea import kea_test_config
 from vyos.template import render
 from vyos.utils.process import call
 from vyos.utils.file import chmod_775
@@ -191,16 +192,21 @@ def verify(dhcpv6):
                     if 'prefix_length' not in prefix_config:
                         raise ConfigError('Length of delegated IPv6 prefix must be configured')
 
-                    if prefix_config['prefix_length'] > prefix_config['delegated_length']:
+                    prefix_len = prefix_config['prefix_length']
+                    prefix_obj = None
+
+                    if prefix_len > prefix_config['delegated_length']:
                         raise ConfigError('Length of delegated IPv6 prefix must be within parent prefix')
 
+                    try:
+                        prefix_obj = ip_network(f'{prefix}/{prefix_len}')
+                    except ValueError:
+                        raise ConfigError('Invalid prefix-length for delegated prefix')
+
                     if 'excluded_prefix' in prefix_config:
                         if 'excluded_prefix_length' not in prefix_config:
                             raise ConfigError('Length of excluded IPv6 prefix must be configured')
 
-                        prefix_len = prefix_config['prefix_length']
-                        prefix_obj = ip_network(f'{prefix}/{prefix_len}')
-
                         excluded_prefix = prefix_config['excluded_prefix']
                         excluded_len = prefix_config['excluded_prefix_length']
                         excluded_obj = ip_network(f'{excluded_prefix}/{excluded_len}')
@@ -301,6 +307,10 @@ def apply(dhcpv6):
             os.unlink(config_file)
         return None
 
+    result, output = kea_test_config('kea-dhcp6', config_file)
+    if not result:
+        raise ConfigError(f'Unexpected error with Kea configuration:\n{output}')
+
     call(f'systemctl restart {service_name}')
 
     return None