[#3448] Revert HTTP control socket in DHCPv4

diff --git a/hammer.py b/hammer.py
index a0e5435a7fcc76ee50ebee2a6e9b87be7a00c3e5..082fd7dd6f20e12e24955d3ed657fd5059a6dd74 100755 (executable)
--- a/hammer.py
+++ b/hammer.py
@@ -2508,21 +2508,6 @@ def _build_rpm(system, revision, features, env, check_times, dry_run,
                 raise_error=False)
         execute(f'sudo rpm -i {rpm_root_path}/RPMS/{arch.strip()}/*rpm', check_times=check_times, dry_run=dry_run)
 
-        _check_installed_rpm_or_debs(
-            ['kea-dhcp4.service'],
-            "Expected a file at path '/etc/kea/kea-api-user'",
-            expect_success_on_start=False,
-        )
-
-        # Wait for systemd's rate limit period to pass to avoid "Start request repeated too quickly" after the failed
-        # implicit start from the installation of isc-kea-dhcp4 above.
-        time.sleep(10)
-        # Reset systemd's rate limit period. Redundant, but just to be safe.
-        execute('sudo systemctl reset-failed kea-dhcp4.service', raise_error=False)
-
-        execute('echo kea-api-user | sudo tee /etc/kea/kea-api-user > /dev/null')
-        execute('sudo touch /etc/kea/kea-api-password')
-
         # check if kea services can be started
         services_list = ['kea-dhcp4.service', 'kea-dhcp6.service', 'kea-dhcp-ddns.service']
         _check_installed_rpm_or_debs(services_list, '_STARTED Kea')
@@ -2593,21 +2578,6 @@ def _build_deb(system, revision, features, env, check_times, dry_run,
         # install packages
         execute('sudo dpkg -i *deb', check_times=check_times, dry_run=dry_run)
 
-        _check_installed_rpm_or_debs(
-            ['isc-kea-dhcp4-server.service'],
-            "Expected a file at path '/etc/kea/kea-api-user'",
-            expect_success_on_start=False,
-        )
-
-        # Wait for systemd's rate limit period to pass to avoid "Start request repeated too quickly" after the failed
-        # explicit start above.
-        time.sleep(10)
-        # Reset systemd's rate limit period. Redundant, but just to be safe.
-        execute('sudo systemctl reset-failed isc-kea-dhcp4-server.service')
-
-        execute('echo kea-api-user | sudo tee /etc/kea/kea-api-user > /dev/null')
-        execute('sudo touch /etc/kea/kea-api-password')
-
         # check if kea services can be started
         services_list = ['isc-kea-dhcp4-server.service', 'isc-kea-dhcp6-server.service',
                          'isc-kea-dhcp-ddns-server.service']
@@ -2639,18 +2609,6 @@ def _build_alpine_apk(features, check_times, dry_run, pkg_version, pkg_isc_versi
         # install packages
         execute('sudo apk add *.apk', cwd='kea-pkg', check_times=check_times, dry_run=dry_run)
 
-        exitcode, _ = execute('sudo rc-service kea-dhcp4 start', capture=True, raise_error=False)
-        assert exitcode == 1
-        _, logs = execute('sudo cat /var/log/kea/kea-dhcp4.log', capture=True)
-        assert "Expected a file at path '/etc/kea/kea-api-user'" in logs
-
-        execute('echo kea-api-user | sudo tee /etc/kea/kea-api-user > /dev/null')
-        execute('sudo touch /etc/kea/kea-api-password')
-
-        execute('sudo rc-service kea-dhcp4 stop')
-
-        time.sleep(10)
-
         # check if kea services can be started
         for svc in ['kea-dhcp4', 'kea-dhcp6', 'kea-dhcp-ddns']:
             execute(f'sudo rc-service {svc} start')

diff --git a/src/bin/keactrl/kea-dhcp4.conf.pre b/src/bin/keactrl/kea-dhcp4.conf.pre
index c1e9daa9ef36a58c2b4dd3c0f431db6def25fae7..a6030eb4e3aaf4a80c0ed5e5d878a53ace4c2484 100644 (file)
--- a/src/bin/keactrl/kea-dhcp4.conf.pre
+++ b/src/bin/keactrl/kea-dhcp4.conf.pre
@@ -47,67 +47,10 @@
     // configuration), config-reload (which tells Kea to reload its
     // configuration from file), statistic-get (to retrieve statistics) and many
     // more. For detailed description, see Sections 8.8, 16 and 15.
-    "control-sockets": [
-        {
-            "socket-type": "unix",
-            "socket-name": "kea4-ctrl-socket"
-        },
-        {
-            // HTTP control channel.
-            "socket-type": "http",
-
-            "socket-address": "127.0.0.1",
-
-            // If enabling HA and multi-threading, the 8000 port is used
-            // by the HA hook library http listener. When using HA hook
-            // library with multi-threading to function, make sure
-            // the port used by dedicate d listener is different
-            // (e.g. 8001) than the one used here. Note the commands
-            // should still be sent via the control socket. The dedicated
-            // listener is specifically for HA updates only.
-            "socket-port": 8000,
-
-
-            // Allow access only to kea-api user.
-
-            // To make it work, please store your user name in
-            // kea-api-user file.  and store your password in the
-            // kea-api-password file.
-            // Make sure the user and password files have sufficiently
-            // restrictive access permissions, in particular that they
-            // are not world-readable.
-            // The basic HTTP auth offers poor security for
-            // unencrypted channels.  If possible, a better, stronger
-            // HTTPS mechanism should be deployed, in particular when the
-            // client authentication is enabled by setting the
-            // cert-required to true (the default). See trust-anchor,
-            // cert-file, key-file and cert-required below. For more
-            // details read the Kea Secu rity section in the ARM.
-            "authentication": {
-                "type": "basic",
-                "realm": "Kea Control Agent",
-                "directory": "/etc/kea",
-                "clients": [
-                    {
-                        "user-file": "kea-api-user",
-                        "password-file": "kea-api-password"
-                    }
-                ]
-            }
-
-            // Configuration section containing HTTPS parameters:
-            // TLS trust anchor (Certificate Authority). This is a file
-            // name or a directory path.
-            // "trust-anchor": "kea-server-ca",
-            // TLS server certificate file name.
-            // "cert-file": "kea-server-cert",
-            // TLS server private key file name.
-            // "key-file": "kea-server-key",
-            // TLS require client certificates flag. Default is true and means
-            // require client certificates. False means they are optional.
-            // "cert-required": true
-        }
-    ],
+    "control-socket": {
+        "socket-type": "unix",
+        "socket-name": "kea4-ctrl-socket"
+    },
 
     // Use Memfile lease database backend to store leases in a CSV file.
     // Depending on how Kea was compiled, it may also support SQL databases