Support multiple DHCP ranges from UI

[cotosso]

Brief description

• The UI is currently designed to manage only one DHCP range per interface.
• It is possible to manually add additional DHCP ranges at configuration level (outside the UI).
• However, when multiple DHCP ranges exist, the UI behaves inconsistently, so it will be very useful to support this feature also directly from the UI.

Current behavior and issues

• Card view:
  The card always displays the first DHCP range, which is correct and expected.

• Edit view:
  The UI loads and edits the last DHCP range found in the configuration file, regardless of naming or logical order.
  Example: if the configuration contains:

  config dhcp 'lan'
  .
  .
  config dhcp 'lan_3'
  .
  .
  config dhcp 'lan_2'
  .
  .
  

(in this order), the edit form will always show and modify dhcp 'lan_2'.

• Edit behavior:
  The modification is internally consistent (the range shown is the one modified), but it is not the same range displayed in the card view.

• Other DHCP ranges:
  All other DHCP ranges remain unchanged.

Problem

This creates a UI inconsistency and configuration ambiguity:

• The user sees one DHCP range in the overview card.
• The user edits a different DHCP range in the edit form.
• This can lead to misconfiguration without any visible warning.

Expected behavior / fix proposal

I propose to allow managing multiple DHCP ranges natively from the UI, providing the ability to define mutiple ranges.
As a suggestion we could use the same logic and components used for the DHCP options:

This way we can easily manage the ability to add and remove ranges, leaving only the first range as mandatory.

Version : NethSecurity 8.7.1

[m-dilorenzi]

QA

Image: image

MAC Binding and DHCP disabled

1. Log in to NethSecurity.
2. Configure the firewall to have at least one green interface.
3. Navigate to Network > DNS and DHCP.
4. Disable the MAC binding and DHCP options on the interfaces, and verify that no information is visible on each card except for the icons indicating that both services are disabled.

MAC Binding enabled and DHCP disabled

1. Log in to NethSecurity.
2. Configure the firewall to have at least one green interface.
3. Navigate to Network > DNS and DHCP.
4. Disable DHCP and enable MAC binding. Verify that no information is visible on the relevant card except for the icon indicating that DHCP is disabled and that MAC binding is enabled with the selected mode.

MAC Binding and DHCP enabled

1. Log in to NethSecurity.
2. Configure the firewall to have at least one green interface.
3. Navigate to Network > DNS and DHCP.
4. Enable both DHCP and MAC binding. Verify that both service sections are visible on the relevant card and that the services appear as enabled with all related information (MAC binding mode, lease time, ranges, and optional DHCP options).

Multiple DHCP ranges

1. Log in to NethSecurity.
2. Configure the firewall to have at least two green interfaces (e.g. green and green2).
3. Navigate to Network > DNS and DHCP.
4. Enable the DHCP service.
5. Edit the DHCP options and add at least one IP range so that the selected interface has more than one range.
6. Verify that all IP ranges are visible on the interface card.

7. Check the firewall configuration to verify that all ranges have been configured correctly.

root@NethSec:~# cat /etc/config/dhcp
...
config dhcp 'green_ns_8247d8ad'
	option dhcpv4 'server'
	option limit '11'
	option start '200'
	option leasetime '12h'
	option interface 'green'
	option force '1'
	option instance 'ns_dnsmasq'
	option ns_binding '0'
	option ignore '0'

config dhcp 'green_ns_f0676447'
	option dhcpv4 'server'
	option limit '11'
	option start '60'
	option leasetime '12h'
	option interface 'green'
	option force '1'
	option instance 'ns_dnsmasq'
	option ns_binding '0'
	option ignore '0'

config dhcp 'green_ns_3f5de206'
	option dhcpv4 'server'
	option limit '11'
	option start '80'
	option leasetime '12h'
	option interface 'green'
	option force '1'
	option instance 'ns_dnsmasq'
	option ns_binding '0'
	option ignore '0'

The IP ranges related to the modified interface are named {interface_name}_{ns_id123456}. For interface green, the IP ranges are named green_{ns_id123456}, while for the second interface green2, they are named green2_{ns_id123456}.

The configuration can also be viewed using the uci command:

root@NethSec:~# uci show dhcp | grep "dhcp.green_ns"
dhcp.green_ns_8247d8ad=dhcp
dhcp.green_ns_8247d8ad.dhcpv4='server'
dhcp.green_ns_8247d8ad.limit='11'
dhcp.green_ns_8247d8ad.start='200'
dhcp.green_ns_8247d8ad.leasetime='12h'
dhcp.green_ns_8247d8ad.interface='green'
dhcp.green_ns_8247d8ad.force='1'
dhcp.green_ns_8247d8ad.instance='ns_dnsmasq'
dhcp.green_ns_8247d8ad.ns_binding='0'
dhcp.green_ns_8247d8ad.ignore='0'
dhcp.green_ns_f0676447=dhcp
dhcp.green_ns_f0676447.dhcpv4='server'
dhcp.green_ns_f0676447.limit='11'
dhcp.green_ns_f0676447.start='60'
dhcp.green_ns_f0676447.leasetime='12h'
dhcp.green_ns_f0676447.interface='green'
dhcp.green_ns_f0676447.force='1'
dhcp.green_ns_f0676447.instance='ns_dnsmasq'
dhcp.green_ns_f0676447.ns_binding='0'
dhcp.green_ns_f0676447.ignore='0'
dhcp.green_ns_3f5de206=dhcp
dhcp.green_ns_3f5de206.dhcpv4='server'
dhcp.green_ns_3f5de206.limit='11'
dhcp.green_ns_3f5de206.start='80'
dhcp.green_ns_3f5de206.leasetime='12h'
dhcp.green_ns_3f5de206.interface='green'
dhcp.green_ns_3f5de206.force='1'
dhcp.green_ns_3f5de206.instance='ns_dnsmasq'
dhcp.green_ns_3f5de206.ns_binding='0'
dhcp.green_ns_3f5de206.ignore='0'

8. Edit the two interfaces by adding or deleting multiple IP ranges, and verify that everything works correctly (for example, no configuration from the first interface is modified when updating the configuration of the second one).

IP ranges validation

1. Log in to NethSecurity.
2. Configure the firewall to have at least one green interface.
3. Navigate to Network > DNS and DHCP.
4. Enable the DHCP service.
5. Verify that validation occurs when entering an invalid IP range configuration, such as:

• invalid IP address

• last IP smaller than the first IP in the range

• one of the two IPs left empty

• IP out of the class range

[cotosso]

All test cases passed successfully