Respond to DHCP Lease Query requests using rlm_cache
Hi Everyone I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple. The aformentioned server is working well, but I would also like it to be able to respond to Lease Query requests, and wondered if it would be possible to make it work in a similar way using rlm_cache. I would envisage that configuration might look something like this: dhcp DHCP-Lease-Query { # look in the cache to see if there is an active lease cache # check to see if we know about this IP ...some unlang lookup the IP from our usual auth source/DB ... ... some unlang to figure out if the lease(s) are valid, etc. ... # work out which type of reply packet is requred and add the relevant options if (result of above says lease is active) { update reply { DHCP-Message-Type := DHCP-Lease-Active ... add some other stuff to the reply... } } elsif (result of above says lease is unassigned) { update reply { DHCP-Message-Type := DHCP-Lease-Unassigned ... add some other stuff to the reply... } } elsif (result of above says lease is unknown) { update reply { DHCP-Message-Type := DHCP-Lease-Unknown ... add some other stuff to the reply... } } } I am guessing that the source code would need to be modified, and if so, it may be too much for me as I am not a skilled C programmer. I would be able to test it however. If it is possible without editing the code I would be grateful to find out how. Thanks Ben
On Aug 27, 2015, at 2:40 PM, Бен Томпсон <b.thompson@latera.ru> wrote:
Hi Everyone
I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple.
The aformentioned server is working well, but I would also like it to be able to respond to Lease Query requests, and wondered if it would be possible to make it work in a similar way using rlm_cache. I would envisage that configuration might look something like this:
dhcp DHCP-Lease-Query { # look in the cache to see if there is an active lease
update control { Cache-Status-Only := yes }
cache
if (notfound) {
# check to see if we know about this IP ...some unlang lookup the IP from our usual auth source/DB
cache }
... ... some unlang to figure out if the lease(s) are valid, etc. ...
# work out which type of reply packet is requred and add the relevant options if (result of above says lease is active) { update reply { DHCP-Message-Type := DHCP-Lease-Active ... add some other stuff to the reply... } } elsif (result of above says lease is unassigned) { update reply { DHCP-Message-Type := DHCP-Lease-Unassigned ... add some other stuff to the reply... } } elsif (result of above says lease is unknown) { update reply { DHCP-Message-Type := DHCP-Lease-Unknown ... add some other stuff to the reply... } } }
I am guessing that the source code would need to be modified, and if so, it may be too much for me as I am not a skilled C programmer. I would be able to test it however.
I don't *think* code modifications are required. Did you just need to right control attributes for the cache module? Or something else... If you need the cache to persist you should setup a memcached instance (or use v3.1.x and setup a Redis instance). -Arran
Hi Arran Thanks for your reply. The problem is that when the server recives a LEASEQUERY packet I get the following error: Error: DHCP can only receive ethernet requests, not type 00 Thanks Ben On 28 August 2015 at 00:06, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Aug 27, 2015, at 2:40 PM, Бен Томпсон <b.thompson@latera.ru> wrote:
Hi Everyone
I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple.
The aformentioned server is working well, but I would also like it to be able to respond to Lease Query requests, and wondered if it would be possible to make it work in a similar way using rlm_cache. I would envisage that configuration might look something like this:
dhcp DHCP-Lease-Query { # look in the cache to see if there is an active lease
update control { Cache-Status-Only := yes }
cache
if (notfound) {
# check to see if we know about this IP ...some unlang lookup the IP from our usual auth
source/DB
cache }
... ... some unlang to figure out if the lease(s) are valid, etc. ...
# work out which type of reply packet is requred and add the relevant options if (result of above says lease is active) { update reply { DHCP-Message-Type := DHCP-Lease-Active ... add some other stuff to the reply... } } elsif (result of above says lease is unassigned) { update reply { DHCP-Message-Type := DHCP-Lease-Unassigned ... add some other stuff to the reply... } } elsif (result of above says lease is unknown) { update reply { DHCP-Message-Type := DHCP-Lease-Unknown ... add some other stuff to the reply... } } }
I am guessing that the source code would need to be modified, and if so,
it
may be too much for me as I am not a skilled C programmer. I would be able to test it however.
I don't *think* code modifications are required.
Did you just need to right control attributes for the cache module? Or something else...
If you need the cache to persist you should setup a memcached instance (or use v3.1.x and setup a Redis instance).
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Бен Томпсон, инженер отдела внедрения и техподдержки, компания "Латера" | www.latera.ru тел.: +7 (499) 940-95-05, доб. 221 E-mail: b.thompson@latera.ru Присоединяйтесь к нам в социальных сетях [image: Встроенное изображение 1] <https://www.facebook.com/pages/%D0%91%D0%B8%D0%BB%D0%BB%D0%B8%D0%BD%D0%B3-%D0%93%D0%B8%D0%B4%D1%80%D0%B0/622692344514207> [image: Встроенное изображение 2] <https://twitter.com/Hydra_billing_> [image: Встроенное изображение 3] <http://www.youtube.com/channel/UC0SHZ4fnWJ443xUwYEAbT5g?spfreload=10> [image: Встроенное изображение 5] <https://www.linkedin.com/company/9347770?trk=hp-feed-company-name>
On Aug 29, 2015, at 1:58 PM, Бен Томпсон <b.thompson@latera.ru> wrote:
Thanks for your reply. The problem is that when the server recives a LEASEQUERY packet I get the following error:
Error: DHCP can only receive ethernet requests, not type 00
Please send a pcap file containing the DHCP lease query request. Alan DeKok.
Hi Alan Thanks for your reply. Here is a pcap file containging one lease query request. Thanks Ben On 29 August 2015 at 23:01, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 29, 2015, at 1:58 PM, Бен Томпсон <b.thompson@latera.ru> wrote:
Thanks for your reply. The problem is that when the server recives a LEASEQUERY packet I get the following error:
Error: DHCP can only receive ethernet requests, not type 00
Please send a pcap file containing the DHCP lease query request.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 29 Aug 2015, at 15:17, Бен Томпсон <b.thompson@latera.ru> wrote:
Hi Alan
Thanks for your reply.
Here is a pcap file containging one lease query request.
Got stripped. Either gzip it, or let me know what content type your email client set for it and i'll add it to the white list. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi I am using Gmail. Here is gzipped version. Thanks Ben On 29 August 2015 at 23:30, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 29 Aug 2015, at 15:17, Бен Томпсон <b.thompson@latera.ru> wrote:
Hi Alan
Thanks for your reply.
Here is a pcap file containging one lease query request.
Got stripped. Either gzip it, or let me know what content type your email client set for it and i'll add it to the white list.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
For info, I found the content type too for the previous message: Content-Type: application/vnd.tcpdump.pcap; On 30 August 2015 at 09:16, Бен Томпсон <b.thompson@latera.ru> wrote:
Hi
I am using Gmail. Here is gzipped version.
Thanks
Ben
On 29 August 2015 at 23:30, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 29 Aug 2015, at 15:17, Бен Томпсон <b.thompson@latera.ru> wrote:
Hi Alan
Thanks for your reply.
Here is a pcap file containging one lease query request.
Got stripped. Either gzip it, or let me know what content type your email client set for it and i'll add it to the white list.
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 27, 2015, at 2:40 PM, Бен Томпсон <b.thompson@latera.ru> wrote:
I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple.
I've pushed changes to the v3.0.x branch which should help. They allow the server to encode and decode lease query packets. You will need to: - add a "dhcp DHCP-Lease-Query {...}" section to raddb/sites-available/dhcp - have the section return "ok" - have the section do: update reply { DHCP-Message-Type := DHCP-Lease-Assigned # or whatever you want to return DHCP-Hardware-Address-Length := 0 } I think that should now work. Alan DeKok.
On 30 Aug 2015, at 09:42, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 27, 2015, at 2:40 PM, Бен Томпсон <b.thompson@latera.ru> wrote:
I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple.
I've pushed changes to the v3.0.x
and v3.1.x?
branch which should help. They allow the server to encode and decode lease query packets.
You will need to:
- add a "dhcp DHCP-Lease-Query {...}" section to raddb/sites-available/dhcp
- have the section return "ok"
- have the section do:
update reply { DHCP-Message-Type := DHCP-Lease-Assigned # or whatever you want to return DHCP-Hardware-Address-Length := 0 }
I think that should now work.
Neat. I'll add a Pool-Action Status to the new rlm_redis_ippool (which will become the new rlm_ippool), then we can abstract getting the lease information back. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Aug 30, 2015, at 11:14 AM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
I've pushed changes to the v3.0.x
and v3.1.x?
Once I clean up my v3.1.x branch.
I think that should now work.
Neat.
After testing (and a few more patches), it works.
I'll add a Pool-Action Status to the new rlm_redis_ippool (which will become the new rlm_ippool), then we can abstract getting the lease information back.
Nice. The DHCP lease query allows querying by MAC, client IP, or by client identifier. Which one is being used in the packet? <laughs> You've got to look for the non-empty field, and use that. What if there are two non-empty fields? The DHCP people laugh at you... that's not supposed to happen, so we'll ignore it! Alan DeKok.
Hi Alan Many thanks for the patches. It seems to generally work, although I noticed that in Tshark/Wireshark is not displaying the client MAC address in the reply. I also noticed that FreeRADIUS is not displaying the DHCP-Relay-Remote-Id option in the debug: FreeRADIUS debug output: ########################## Encoding DHCP-Lease-Active of id 7474793f from 10.200.0.1:67 to 10.211.0.1:67 DHCP-Opcode = Server-Message DHCP-Hardware-Type = 0 DHCP-Hardware-Address-Length = 0 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1953790271 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 10.211.0.2 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.211.0.1 DHCP-Client-Hardware-Address = 4c:00:10:74:94:7e <--- MAC address here DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-IP-Address-Lease-Time := 300 DHCP-Relay-Circuit-Id := 0x00000012 <--- No Remote ID here DHCP Sending 300 bytes 0: 02 00 00 00 74 74 79 3f 00 00 00 00 0a d3 00 02 16: 00 00 00 00 00 00 00 00 0a d3 00 01 4c 00 10 74 <-- MAC address here 32: 94 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 0d 33 04 00 00 01 2c 52 0e 01 04 00 00 00 256: 12 02 06 00 26 24 95 bc be ff 00 00 00 00 00 00 <--- Remote ID here (00262495bcbe) 272: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 ########################## Tshark capture output: ########################## Bootstrap Protocol Message type: Boot Reply (2) Hardware type: NET/ROM pseudo Hardware address length: 0 Hops: 0 Transaction ID: 0x7474793f Seconds elapsed: 0 Bootp flags: 0x0000 (Unicast) 0... .... .... .... = Broadcast flag: Unicast .000 0000 0000 0000 = Reserved flags: 0x0000 Client IP address: 10.211.0.2 (10.211.0.2) Your (client) IP address: 0.0.0.0 (0.0.0.0) Next server IP address: 0.0.0.0 (0.0.0.0) Relay agent IP address: 10.211.0.1 (10.211.0.1) Client address not given <---- No MAC address here Server host name not given Boot file name not given Magic cookie: DHCP Option: (53) DHCP Message Type Length: 1 DHCP: Lease Active (13) Option: (51) IP Address Lease Time Length: 4 IP Address Lease Time: (300s) 5 minutes Option: (82) Agent Information Option Length: 14 Option 82 Suboption: (1) Agent Circuit ID Length: 4 Agent Circuit ID: 00000012 Option 82 Suboption: (2) Agent Remote ID Length: 6 Agent Remote ID: 00262495bcbe <---- Remote ID here Option: (255) End Option End: 255 Padding 0000 00 13 11 e9 c6 36 00 0c 29 bc 73 a9 08 00 45 00 .....6..).s...E. 0010 01 48 94 2b 00 00 40 11 cf dd 0a c8 00 01 0a d3 .H.+..@......... 0020 00 01 00 43 00 43 01 34 16 e2 02 00 00 00 74 74 ...C.C.4......tt 0030 79 3f 00 00 00 00 0a d3 00 02 00 00 00 00 00 00 y?.............. 0040 00 00 0a d3 00 01 4c 00 10 74 94 7e 00 00 00 00 ......L..t.~.... <---- MAC address here 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0110 00 00 00 00 00 00 63 82 53 63 35 01 0d 33 04 00 ......c.Sc5..3.. 0120 00 01 2c 52 0e 01 04 00 00 00 12 02 06 00 26 24 ..,R..........&$ 0130 95 bc be ff 00 00 00 00 00 00 00 00 00 00 00 00 ................ <---- Remote ID here 0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0150 00 00 00 00 00 00 ...... ########################## Thanks Ben On 30 August 2015 at 19:22, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 30, 2015, at 11:14 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:
I've pushed changes to the v3.0.x
and v3.1.x?
Once I clean up my v3.1.x branch.
I think that should now work.
Neat.
After testing (and a few more patches), it works.
I'll add a Pool-Action Status to the new rlm_redis_ippool (which will become the new rlm_ippool), then we can abstract getting the lease information back.
Nice.
The DHCP lease query allows querying by MAC, client IP, or by client identifier. Which one is being used in the packet? <laughs> You've got to look for the non-empty field, and use that. What if there are two non-empty fields? The DHCP people laugh at you... that's not supposed to happen, so we'll ignore it!
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 31, 2015, at 2:48 AM, Бен Томпсон <b.thompson@latera.ru> wrote:
Many thanks for the patches. It seems to generally work, although I noticed that in Tshark/Wireshark is not displaying the client MAC address in the reply.
That's because it's not setting hardware type and hardware address length. I've pushed a fix for that.
I also noticed that FreeRADIUS is not displaying the DHCP-Relay-Remote-Id option in the debug:
Hmm... I think that's just cosmetic. I'll see if I can track that down today. Alan DeKok.
On 31 August 2015 at 21:21, Бен Томпсон <b.thompson@latera.ru> wrote:
I also noticed that FreeRADIUS is not displaying the
DHCP-Relay-Remote-Id option in the debug:
I've pushed a fix for that, too.
Many thanks. I will do some tests.
Alan, many thanks, Lease Query is working. I just thought I would mention though that DHCP-Relay-Remote-Id is still not printed in debug mode: Encoding DHCP-Lease-Active of id 7474793f from 10.200.0.1:67 to 10.211.0.1:67 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1953790271 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 10.211.0.2 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.211.0.1 DHCP-Client-Hardware-Address = 4c:00:10:74:94:7e DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-IP-Address-Lease-Time := 300 DHCP-Relay-Circuit-Id := 0x00000012 DHCP Sending 300 bytes 0: 02 01 06 00 74 74 79 3f 00 00 00 00 0a d3 00 02 16: 00 00 00 00 00 00 00 00 0a d3 00 01 4c 00 10 74 32: 94 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 0d 33 04 00 00 01 2c 52 0e 01 04 00 00 00 256: 12 02 06 00 26 24 95 bc be ff 00 00 00 00 00 00 272: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 As you say it is only cosmetic.
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Бен Томпсон