rogue client no subnet
is selected. For pools it makes only resources (i.e addresses) not
available for the rogue client (of course I suppose it has no reservations).
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.i
"Ambauen Daniel (ID NET)" writes:
> From my point of view the network access control is definitely not a
> task of the DHCP service.
=> I agree: it is clearly too late and DHCP is more than poor about security.
Regards
Francis Dupont
__
e
available to it. You can also write a hook to filter out messages
but it requires to write some code (vs a config update).
Regards
Francis Dupont
PS: I cited the hook because it is the standard way to plug an
authentication/authorization service to Kea.
___
yes if you have no address (nor prefix in IPv6) you need a hostname.
Note here a host reservation is perhaps not the best feature: what you
want is some kind of access list and for a negative access list a client
class is better. Host reservations and KNO
nt) relay
- old Sun boxes interpreted the loose IEEE spec as the mac address
can be a box (vs a NIC) property so with some Sun servers you have
multiple NICs sharing the same mac address... pretty find to find
some bugs in interop testing, less in production.
Regards
Francis Dupont
PS: in Kea
e and black lists are large it will be better to use
a hook to do the same thing but with all the resources from a full
programming language, e.g. C++ sets. List updates will be far easier too.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-user
My immediate idea is to simply not define a pool for such subnets?
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
> How can I achieve something similar using KEA?
=> not yet (this feature is on the TODO list) or only with a hook.
Regards
Francis Dupont
PS: the missing feature is to compute an option value from an expression.
___
Kea-users mailing list
Kea
starting from the subnet which pools are not
// exhausted.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
ion: it does the same without possible ambiguity.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Francis Dupont
> First I tried to add the class to the host:
>
> "client-classes": [
> {
> "name": "cl-test",
> "test": "member('cl-test')"
=> note this does not make sense. If
subnet": "172.21.151.0/24",
> "require-client-classes": [ "cl-test" ]
=> require-client-classes makes listed classes to be added when the
subnet was selected. Obviously it is not what you want. IMHO you need
a guard ("client-class" clause) but as the localization (aka subnet
/ shared-network selection) is done first you need to apply the guard
to the pool.
> },
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
> 1. How can I specify a ddns-domainname per subnet
=> you can't (I am sure because it is in the top list of features we want
to add to Kea).
Thanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.
oyama writes:
> I would like to assign IP address given by other domain name system (bind9)
> in the address reservation mechanism, instead of writing IP address itself.
=> this feature is not supported by Kea and IMHO it will never be as
there are too many ways to get it wrong.
Regards
Note it uses a host cache to not
do the host reservation lookup twice at some cost: shared subnets are
not supported.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
ier so just
before the host reservation lookup.
Regards.
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
A priori it is not possible because the host reservation lookup is done
after the subnet selection.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
lanned for a fea days) so the number of not translated items
should go closer to 0. The references are for gitlab Kea issues
so you can look at them (they are locked so if you have comments
please send them to us, e.g. using this list).
Regards
Francis Dupont
PS: if you'd like I can add
> pool {
> allow members of "APPLE";
> allow members of "BELKIN";
> }
=> create a class with for instance name "APPLE-or-BELKIN" and with
"test": "member('APPLE') or member('BELKIN'
constraint is in the order of classes: you can check class
membership only in a class which is known i.e. in the general case
is defined before.
Regards
Francis Dupont
PS: note this can't be backported to ISC DHCP because it has a hard
limit to 5 classes for a packet and of course if th
t;,
"test": "substring(pkt4.mac,0,3) == 0xb019c6) or
(substring(pkt4.mac,0,3) == 0xd8a25e)) or
(substring(pkt4.mac,0,3) == 0xb8c75d)) or
(substring(pkt4.mac,0,3) == 0x6c709f)) or
(substring(pkt4.mac,0
START i've get the following error:
>
> /Anterius Server> Bootup complete
> CA Error: unable to forward command to the dhcp4 service: No such file or
> directory. The server is likely to be offline
=> did you put a control-socket entry i
t;pool": "2001:db8:1:05::/80" }
> ],
> ...
> }
> ]
> }
=> pools must be in the subnet. Here I believe there is a typo:
the second pool is not in the subnet, perhaps it should be:
"pool": "2001:db8:1:0:5::/80"
Regards
Fran
subnet in Kea).
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
you use
a tool to launch Kea you should configure the tool to remove local domain
socket files.
About #262 it is a trivial typo in the example which will be fixed as
soon as the Kea master branch code will be unfrozen.
Regards
Francis Dupont
___
Kea
To set an option-data using an expression is not supported (I should say
not yet even I don't know when it will be implemented: only it won't be
in 1.5). To do this you need to write a hook code...
Regards
Francis Dupont
___
Kea-users mailin
mend in the case the port is supposed to be free to find which
process is bound to it with for instance lsof.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Tim Weippert writes:
> Hi list,
>
> i configured two dns-servers within a forward-ddns domain in kea-dhcp-ddns:
>
> "forward-ddns" : {
> "ddns-domains": [
> {
> "name": ".",
> "key-name": "DHCP-Update-Key",
>
ed to Kea. The last kind is for references in the ISC DHCP
to Kea Migration Assistant (not publicly available as it is based on
ISC DHCP).
Regards
Francis Dupont
> On 10/25/18 12:10 PM, Victoria Risk wrote:
> > Kea-users,
> >
> > We decided last week to reorganize the co
t; host-reservation for the corresponding CableModem.
>
> Since this is an essential feature for us it would be very very nice if
> you could assist finding a working code for this.
=> I am afraid you need to write a hook as each time the expression feature
is not enough to classify a
You defer a null shared pointer. The only way to understand what happens
is to use a debugger (if you run from build directory add "libtool
--mode=execute " before so Kea libraries can be found).
Regards
Francis Dupont
___
Kea-users mailin
look at this later...
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Does the client request them? If it does not and you want Kea to send
them anyway please set the always-send flag to true in option data.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo
(the bug described in it was fixed)
> As these reports are quite a bit old, is there anything new to know? If
> not, is there any other way to set a TTL? Maybe through a hook?
=> the DHCP DDNS server does not support hooks and I am afraid it is
more than hairy to do at the D
Not a script but a program. Unfortunately it is not finished (ISC DHCP and
kea are both moving targets) and we found nobody to write a Web interface
to it so there is only one (human) interface: me (in fact you should get
more (and more usable) answers too in this list).
Regards
Francis Dupont
Please contact support to get a version of the premium distrib which
includes last changes (database code has been moved since 1.5 release
and premium code updated but privately).
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users
Radius hooks do not support shared networks. But it supports subnet re-select
even it is a bit late when the allocation returns a pool full error.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman
Are your two subnets in a shared network? (if there are not pools are not
shared)
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Your config does not provide any information to localize the client
(or with other words to select the subnet). Please add a relay in the
subnet config and retry.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https
d lifetime is a lease property, T1 and T2
belong to the address info/IA. Second I looked at the code and the subnet
values are used, i.e. it seems the values in the lease are for info only...
Of course you can change them at a later hook point.
Regards
Francis Dupont
___
d some programming.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
address in host reservation is optional.
Note that without a fixed address a resource (usually a hostname
but it can be option or next server or ...) is required, i.e.,
empty host reservations are not allowed.
Regards
Francis Dupont
___
Kea-users mailing
To add a host reservation is not a silly idea: it is the way the RADIUS
hook works: it adds a host cache entry at the select subnet hook point
so when the host reservation is looked for the required information can
be returned. Of course this requires to code a bit...
Regards
Francis Dupont
PS
e known and should get a dynamic IP
> from the public pool.
>
> I need to prevent known MACs from getting RFC 1918 IPs.
=> I think by "known" you mean have a host reservation. BTW it is required
for a host reservation to provide at least an address or a hostname
For any class which inherits from UserContext simply use the getContext()
method, cf src/lib/cc/user_context.h
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Flex-id should be a better (easier to use and scales) than one member
classes and associated pools.
Regards
Francis Dupont
Phoebe Lee writes:
> --65328a0571c58502
> Content-Type: text/plain; charset="UTF-8"
>
> Sorry for bad wording!
> I'd like to have
dress from the pool.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
I can just confirm the persistent flag is the internal name for always-send.
Francis Dupont
Owen Dunn writes:
> Hi, I have a postgres reservation database with kea 1.3. My
> dhcp.dhcp4_options table works but I don't seem able to force kea always
> to send an option even if no
k the number of your preferred enterprise (if it is no longer
exist and was not in networking business it could help).
- you get an official number for your enterprise (take time but is 100% safe
forever)...
Regards
Francis Dupont
PS: ISC uses its enterprise-number but as far as I know
bug...
> Can I extend KEA ISC DHCPv6 (open source) ?
=> no need to extend something.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Remove the '' in:
"test": "/substring(pkt4.mac, 0, 6) = '0x00d0550b6076'",
so you should use:
"test": "/substring(pkt4.mac, 0, 6) = 0x00d0550b6076",
Regards
Francis Dupont
___
Kea-user
't solve the problem but just try in the case I am wrong)
- Kea 1.4 reconnects databases so the error should be transient
(vs fatal) in the new 1.4 release.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://list
You need either a PRL option (code 55) to list requested options in
the discover or request, or to set always-send to true in option data
entries of a recent enough Kea config.
Regards
Francis Dupont
PS: always-send adds the option code to the PRL option which is BTW
the way to do the same
flict text in the doc).
Note you do not need to use an existing MAC in a host reservation,
the only constraint is to use a different MAC (or identifier in general)
between host reservations.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-
itay cohen writes:
> i'm trying to get user-context from a selected subnet on lease4_select api
> with a hook,
=> what are you trying to do? lease4_select is a REST API, hooks are
linked DSO using a programming language (typically C++ but it is not
required).
Regards
I looked at for possible candidates fro client-architecture options.
One is the option 93 (client-system in Kea which BTW does not allow
to redefine options). The value 16 is not in RFC 4578 table but it is
11 year old...
Regards
Francis Dupont
uot;encode-int ( 16, 16 )" is a literal (0x0010).
option vendor-class-identifier "HTTPClient" is an option-data.
filename is boot-file-name in Kea.
BTW I'd like to keep this example for the Kea migration assistant
(when I'll add the code to translate this kind of if expre
n you double check you are running Kea 1.4-beta? This feature
was added after 1.3 release.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
it is option[].hex ...
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
lease_cmds hook (in Kea core code)?
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
so it is not for the long term...
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
ht
place to ask for some examples.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
e to
"g++ --std=c++11" in the shell before calling autoreconf and ./configure.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Gokulakrishnan Gopalakrishnan writes:
> Currently, I'm hardcoding 'next-server' in kea.conf. Is it possible to do
> it via hook code?
=> yes of course. BTW the way to set the next server address field
(aka siaddr) in BOOTP/DHCP packet is the Pkt4 setSiaddr() method.
Add next server option to packet.
> opt = response->getOption(DHO_HOME_AGENT_ADDRS);
=> This option gives a list (vs one) of addresses of the Mobile IP
home agent. So it is something different (but if it makes the client
happy...).
Regards
Francis Dupont
means that you want a class which matches only clients
which belong to a particular subnet this is in 1.4-beta.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Mathias Aichinger writes:
> How can I realize this with KEA?
=> you'll get more detailed answer but at the first look you need flex-id.
> Does it work with the Premium API?
=> yes.
Regards
Francis Dupont
___
Kea-users maili
.
Of course if all reserved addresses are outside pools (common but not
mandatory) it is enough to check if the address is in a pool.
Thanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
s in
a hook but IMHO this does not enter in the "easy one".
Regards
Francis Dupont
PS: different subnets is in fact IA_NA and IA_PD in different messages:
when both are in the same message this message is localized (i.e. a subnet
selected) atomically
I can't see any problem other than a /32 *network* is useless because
it has no available address: the broadcast address is reserved.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinf
Oops, I messed the PS. Here is the corrected version.
> PS: if you get a cryptic error message please signal it so we can
> improve it.
BTW the last ticket (5600) is a perfect example of that...
___
Kea-users mailing list
Kea-users@lists.isc.org
https://
l fail with
a message explaining there is only one spelling: true.
Note the parser is typed so when you put a string at the place of a
boolean it fails. More, keywords (e.g., "subnet4") are known and
recognized according to the context so most typing errors are caught
during parsing...
Tha
I don't fully understand your question but DHCPv4 messages have a field
to carry the relay address (aka giaddr).
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Francis Dupont
PS: look at src/lib/dhcp/std_option_defs.h for definitions of standard
options. getData works only on unknown options or options which are not
defined to a specific content type (i.e, binary).
___
Kea-users mailing list
Kea-users
hanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
Using Client Identifier and Hardware Address
BTW there is an explicit reference about PXE in this.
Thanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
). If you find what did not work as you expected and how
to solve it please post your conclusion here so we can aliment FAQs and
knowledge bases... Of course this applies to anyone who got the same
problem (it is the whole principle of this list :-).
Thanks
Francis Dupont
m afraid MySQL does not work at all in your setup and its very long
default timeout hides that. There were recent works to improve this
(better timeouts, reconnect, etc) so I leave my colleagues who worked
on it to give better answers.
Regards
Francis Dupont
___
by subnets where they are not specified...
Unfortunately I am afraid the only solution is to attach a piece of code
on the pkt4_send hook point which simply removes these options
(bool delOption(uint16_t type); which is a Pkt method is your friend)
from the response4 parameter... Should take be
A lease database backend is for the whole server. If you have
specific subnet / options setting they go into the configuration
inside subnet entries independently of backends.
Regards
Francis Dupont
PS: BTW there must be at least one subnet because incoming packets are
localized (aka subnet
(I know because I
copied this code). Now it is not a system test... I'll check when
I'll get some free time (tomorrow? surely before Monday if it is not
solved before).
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
libdhcp_legal_log.la
libdhcp_flex_id.so libdhcp_host_cache.so libdhcp_legal_log.so
libdhcp_ha.alibdhcp_host_cmds.a libdhcp_subnet_cmds.a
libdhcp_ha.la libdhcp_host_cmds.lalibdhcp_subnet_cmds.la
libdhcp_ha.so libdhcp_host_cmds.solibdhcp_subnet_cmds.
d it will
be reconsidered and if still useless removed... BTW it has no impact
as anything using the hook really requires the library so it is just
an extra entry in a table.
Thanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.i
> fully Debian specific (and internal). IMHO this should be ignored.
Thanks
Francis Dupont
PS: I noted we should look at the Debian tool which detects useless
dependencies.
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
when set to 1 it simply disables conflict detection.
- I saw the word NAT in your message: if dnsmasq is run behind a NAT the
best solution is to translate the DHCP server port and to use for
dnsmasq this alternate port.
Regards
Francis Dupont
__
good reasons,
and reading the DHCPv4 code I don't think it works. So I created a ticket
to get DHCPv4 fixed and DHCPv6 code added. Unfortunately I have no
idea about when the ticket will be addressed...
Regards
Francis Dupont
___
Kea-users maili
e table
(use-routing).
Thanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
nks
Francis Dupont
PS: of course when clients know their name and provide it things are
simpler (:-)!
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
on hostname. If you use only host reservations you simply
have to make the qualifying-suffix empty and put fqdns in hostnames.
Of course it won't work for a client which has no host reservations...
Thanks
Francis Dupont
___
Kea-users mailing
a 1.3 perhaps you should try a shared network
as pools and host reservations in a shared network are for the whole
shared network as soon as they are not under a subnet with a class guard.
Pools with class could help too but they are not yet available.
Thanks
Francis Dupont
I've been unable to find anything that works so=
> I'm still stuck only having DDNS for the first subnet.
=> Unfortunately it is not yet supported (it was recognized as an useful
feature to add but no milestone was selected for this
alues are applied per subnet.
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
ances (Raspberry Pi 3) that are running
> DNS (Bind), how many servers, or whether I should split them to dedicated
> servers (likely also Raspberry Pi 3).
=> you have another choice: use a file or a database for leases and
in the second case where to put the database server (same
omma
hostname: i.e. the string as it
next_server: or NULL (same than the ip-address)
dhcp4_server_hostname and dhcp4_boot_file_name: strings
You have some constraints in length so I recommend to read the schema
(SQL is supposed to be user friendly and you have "shells" to play with).
s far easier to use in particular when migrating
from ISC DHCP...
Of course you can write a hook to set the link address in received packets...
Regards
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailm
lse than ASCII even it is just an opaque vector of bytes...
> I am running Kea 1.2.0 still, is this by any chance a known bug
> I can fix by upgrading? (been waiting for FreeBSD port to get
> refreshed).
=> I am afraid that upgrading Kea won't help.
Regards
Francis Dupont
quirement to define classes but it does not
make sense to not define them...
Thanks
Francis Dupont
___
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
relay.
> Now I'm back to needing different subnets for each subscriber
> again whereas they can share the same vlan with v4.
=> no, a vlan should map to a subnet (link in IPv6 terms).
Thanks
Francis Dupont
PS: the interfaces-config global clause specifies interfaces Kea i
ddns-rev-domainname is marked as not translatable in the migration
assistant...
In the Kea code (d2_cfg_mgr.*) the constant has a @todo saying it should
be configurable so you should ask for this. Now we have a lot of things
to do for the current release and limited man-power...
Regards
Francis
se in your subnet6 (I assume clients are
directly connected as you didn't mention relays). Without it
no subnet is selected or with other words the server has no idea
about where is the client...
Regards
Francis Dupont
PS: a /80 pool is not a problem.
__
101 - 200 of 347 matches
Mail list logo
