[Dnsmasq-discuss] [PATCH] DHCPv6 - Multiple reservations for single host
Pali Rohár
pali.rohar at gmail.com
Mon Jan 13 18:59:43 GMT 2020
On Friday 10 January 2020 21:25:22 Simon Kelley wrote:
> On 08/01/2020 09:32, Harald Jensås wrote:
> > On Tue, 2020-01-07 at 21:51 +0000, Simon Kelley wrote:
> >> On 23/12/2019 11:24, Harald Jensas wrote:
> >>> Hi,
> >>>
> >>> The patch below is a slight alteration to a possible solution
> >>> discussed in
> >>> http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2017q1/011289.html
> >>> .
> >>>
> >>> My approach here does not require making dhcp-host conditional on a
> >>> tag. However, making dhcp-host conditional on a tag would be a nice
> >>> addition that could be introduced as a follow up to this to have a
> >>> match on the tag of the final OS to keep the provisioned system
> >>> consistently configured with a specific address can be very handy.
> >>> For
> >>> the Openstack use-case I am working in, this however is'nt
> >>> necessary.
> >>>
> >>> I have confirmed that the patch below together with a small change
> >>> in
> >>> Openstack Ironic (see: https://review.opendev.org/700002) solved
> >>> the
> >>> long standing issue when doing network booting and node
> >>> provisioning
> >>> in combination with static only dhcp configuration.
> >>>
> >>> We are looking forward to comments and feedback regarding this
> >>> approach.
> >>>
> >>> Thank you!
> >>>
> >>
> >> If I've understood correctly, this looks like it might be a viable
> >> solution. Question: how many addresses do you configure for each
> >> host,
> >> and is this fragile if the boot process changes, for instance to add
> >> new
> >> steps?
> >
> > Thank you for reviewing this!
> >
> > I have tested using 4 addresses in total, I should be able to do with 2
> > addresses with the workflow I tested with which is OVMF-UEFI->iPXE-
> >> LinuxDeployRamdisk->Final OS. OVMF-UEFI uses two addresses just to do
> > PXE, but it is kind enough to release both addresses before executing
> > the network boot program. Then iPXE uses one, and the deploy ramdisk
> > one. Depending on wheater the deploy ramdisk does a release or not
> > before rebooting a third address would be used by the final OS. (This
> > is where dhcp-host conditional on a tag would be handy to control the
> > address of the final OS.)
> >
> > In the openstack use case the dhcp-config is changed to have just a
> > single dhcp-host entry prior to booting into the final os, openstack's
> > networking service takes care of issuing a release during this step
> > making sure the leased addresses are released. (This is why the dhcp-
> > host conditional on a tag is'nt required in the openstack use case.
> >
> > The number of addresses is indeed fragile, adding another bootstep
> > could increase the number of addresses needed. Also an unexpected reset
> > of the booting system would lock up addresses that where not released,
> > mainly problem with UEFI firmware that likes to generate new IAID's
> > every time it boots ...
> >
> > As digression, Pali Rohár `honor assignment based on MAC address`
> > patch is less fragile for this use case. I recognize it breaks other
> > parts of the DHCPv6 RFC, see my comments on a previous post in this
> > thread. Should we consider his approach if the patch can be re-worked
> > to be an opt-in via configuration and a note in docs that the behaviour
> > is not following RFC?
>
> Pali has done good work on this and I appreciate it. The objection to
> that approach is both the RFC non-compliance, and also the fact that it
> absolutely depends on dnsmasq being able to determine the MAC address
> of a client.
Hi Simon! You are right. We can write into documentation that such setup
is non-RFC-compliant. But even that is is non-compliant it is useful in
such environment. Openstack is one. Another example is small home
network with dual-boot computers. Every reinstallation of OS or
rebooting computer to other OS would lead to changing of IAID and DUID.
DHCP server can identify computer only by MAC address. There is nothing
more which can be used generally. And static DHCPv6 leases is the only
way how to configure firewall for particular service on specific host.
And in the end, if dnsmasq provides a way for specifying in
configuration file assigning IPv6 address based on MAC address, it
should implement it the best possible way. Even if it is fragile or
not-RFC-compliant. All these information could be put into
documentation, so administrators can decide. If they want to use
non-compliant configuration or not.
Important is that this is optional feature and nobody is forced to use
this feature. Standard way for assigning IPv6 address based on DUID as
described in RFC is still supported, primary used and not changed.
But current implementation of IPv6 address assignment from MAC address
in dnsmasq is basically unusable. As these options are sometimes ignored
by dnsmasq and sometimes not. I think this is a bigger problem then that
behavior is non-compliant.
> Doing that is fragile, and it would be good to have a
> mechanism which didn't rely on it. Does openstack rely on identifying a
> host by MAC address, or could it be made to work if the DHCP server
> didn't know the MAC address of a client? Even if openstack relies on MAC
> addresses (and I understand the provisioning reasons for doing that), a
> mechanism to support chain-netbooting without knowing MAC addresses is a
> more generally useful thing that one which only works when the MAC
> address is determinable.
I think that there is not more reliable way to identify client as by its
MAC address.
> >
> >> Could we add new syntax to dhcp-host which allows it to configure
> >> a range of addresses, rather than having a number of dhcp-host
> >> entries
> >> for each stage of the boot process? That would be a bigger change,
> >> but
> >> might be a neater solution?
> >>
> >
> > I went for multiple dhcp-host entries because that accidentally happens
> > to be what openstack neutron already write in the dnsmasq configuration
> > when multiple ip addresses are added to a port in openstack.
> >
> > Supporting either a list of addresses or a range of addresses in the
> > dhcp-host syntax might be neater. (I am biased to keeping it to
> > multiple dhcp-host entries due to how openstack currently works, but it
> > would be reasonably small work to change|fix openstack in case ...)
> >
> > If we add dhcp-host conditional on a tag, one could use short lease
> > time, like 1m, on entries without a tag that the boot process uses. And
> > a longer lease time on the entry tagged for the final os. Doing so
> > could ease the issue of leases being held after an unexpected reset
> > during boot process. An argument to keep the multiple dhcp-host
> > entries?
>
> The best of all possible worlds might be both: a dhcp-host tagged to be
> active when the final OS is not the client, which gives out a set of
> addresses on short leases, thus removing the steps-to-boot and lost
> addresses fragilities: with IPv6 there could be a range of 128 or 256
> addresses to go at. Plus a dhcp-host tagged to be active only for the
> final OS boot, with a long lease time and fixed address.
>
> As a general principle, dnsmasq tries to not depend on the order of
> configuration lines to control behaviour - in almost all cases the
> behaviour is defined not to matter on order, and if order appears to
> matter then the behaviour is, strictly speaking, undefined. I guess that
> what you have at the moment kind of violates that principle.
>
>
> >
> >> I guess that the final adddress that the host ends up with depends on
> >> the number of addresses allocated by other parts of the boot process,
> >> but as the DNS entry ends up pointing to that final address (does it?
> >> -
> >> need to check this) that's not a problem.
> >>
> >
> > Yes, the final address of the host depend on the number of address that
> > where allocated during the boot process.
> >
> > Good point regarding DNS, I did'nt check how DNS entries are maintained
> > before you mentioned it. Your assumption that the DNS entry point to
> > the last address leased is correct. See annotated log below.
> >
> >
> > Jan 08 10:02:03 server.example.com systemd[1]: Started DNS caching server..
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: started, version 2.80-102-g7d04e17 cachesize 150
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: compile time options: IPv6 GNU-getopt no-DBus no-UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect inotify dumpfile
> > Jan 08 10:02:03 server.example.com dnsmasq-dhcp[1444]: DHCPv6, static leases only on fd12:3456:789a:1::afff, lease time 10m
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: using only locally-known addresses for domain mydomain.net
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: reading /etc/resolv.dnsmasq
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: using only locally-known addresses for domain mydomain.net
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: using nameserver 192.168.122.1#53
> > Jan 08 10:02:03 server.example.com dnsmasq[1444]: cleared cache
> >
> > /** No entries in the cache */
> >
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: time 1578474136
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: cache size 150, 0/0 cache insertions re-used unexpired cache entries.
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: queries forwarded 0, queries answered locally 0
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: queries for authoritative zones 0
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: pool memory in use 0, max 0, allocated 0
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: server 192.168.122.1#53: queries sent 0, retried or failed 0
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: Host Address Flags Expires
> > Jan 08 10:02:16 server.example.com dnsmasq[1444]: bind F I
> >
> > /** Initial DHCPv6 request from OVMF UEFI is serviced, fd12:3456:789a:1::bacc is leased. */
> >
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 available DHCPv6 subnet: fd12:3456:789a:1::aaaa/64
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 client MAC address: 52:54:00:3f:5c:c0
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 DHCPSOLICIT(eth1) 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 DHCPADVERTISE(eth1) fd12:3456:789a:1::bacc 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c host1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 requested options: 23:dns-server
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 tags: ctlplane-subnet, known, dhcpv6, eth1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 18 option: 1 client-id 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0...
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 14 option: 2 server-id 00:01:00:01:25:a8:56:f2:52:54:00:b5:b2:8f
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 40 option: 3 ia-na IAID=1073085951 T1=300 T2=525
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 nest size: 24 option: 5 iaaddr fd12:3456:789a:1::bacc PL=600 VL=600
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 9 option: 13 status 0 success
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 1 option: 7 preference 0
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 16 option: 23 dns-server fd12:3456:789a:1::1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14233087 sent size: 7 option: 39 FQDN host1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 available DHCPv6 subnet: fd12:3456:789a:1::aaaa/64
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 client MAC address: 52:54:00:3f:5c:c0
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 DHCPREQUEST(eth1) 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 DHCPREPLY(eth1) fd12:3456:789a:1::bacc 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c host1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 requested options: 23:dns-server
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 tags: ctlplane-subnet, known, dhcpv6, eth1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 sent size: 18 option: 1 client-id 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0...
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 sent size: 14 option: 2 server-id 00:01:00:01:25:a8:56:f2:52:54:00:b5:b2:8f
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 sent size: 40 option: 3 ia-na IAID=1073085951 T1=300 T2=525
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 nest size: 24 option: 5 iaaddr fd12:3456:789a:1::bacc PL=600 VL=600
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 sent size: 9 option: 13 status 0 success
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 sent size: 16 option: 23 dns-server fd12:3456:789a:1::1
> > Jan 08 10:02:27 server.example.com dnsmasq-dhcp[1444]: 14298623 sent size: 21 option: 39 FQDN host1.mydomain.net
> >
> > /** DNS entry points to fd12:3456:789a:1::bacc */
> >
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: time 1578474152
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: cache size 150, 0/0 cache insertions re-used unexpired cache entries.
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: queries forwarded 0, queries answered locally 0
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: queries for authoritative zones 0
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: pool memory in use 0, max 0, allocated 0
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: server 192.168.122.1#53: queries sent 0, retried or failed 0
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: Host Address Flags Expires
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: net F D Wed Jan 8 10:12:27 2020
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: host1.mydomain.net fd12:3456:789a:1::bacc 6FR D Wed Jan 8 10:12:27 2020
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: bind F I
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: host1 fd12:3456:789a:1::bacc 6F D Wed Jan 8 10:12:27 2020
> > Jan 08 10:02:32 server.example.com dnsmasq[1444]: mydomain.net F D Wed Jan 8 10:12:27 2020
> >
> > /** DHCPv6 request from OVMF UEFI PXE boot is serviced, fd12:3456:789a:1::aacc is leased. */
> >
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 available DHCPv6 subnet: fd12:3456:789a:1::aaaa/64
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 vendor class: 343
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 client MAC address: 52:54:00:3f:5c:c0
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 DHCPSOLICIT(eth1) 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 DHCPADVERTISE(eth1) fd12:3456:789a:1::aacc 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c host1
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 requested options: 59:bootfile-url, 60:bootfile-param, 23:dns-server,
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 requested options: 16:vendor-class
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 tags: ctlplane-subnet, known, efi6, dhcpv6, eth1
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 18 option: 1 client-id 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0...
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 14 option: 2 server-id 00:01:00:01:25:a8:56:f2:52:54:00:b5:b2:8f
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 40 option: 3 ia-na IAID=3217423454 T1=300 T2=525
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 nest size: 24 option: 5 iaaddr fd12:3456:789a:1::aacc PL=600 VL=600
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 9 option: 13 status 0 success
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 1 option: 7 preference 0
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 37 option: 59 bootfile-url tftp://[fd12:3456:789a:1::1]/ipxe.efi
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 16 option: 23 dns-server fd12:3456:789a:1::1
> > Jan 08 10:03:33 server.example.com dnsmasq-dhcp[1444]: 14364159 sent size: 7 option: 39 FQDN host1
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 available DHCPv6 subnet: fd12:3456:789a:1::aaaa/64
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 vendor class: 343
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 client MAC address: 52:54:00:3f:5c:c0
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 DHCPREQUEST(eth1) 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 DHCPREPLY(eth1) fd12:3456:789a:1::aacc 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0:4f:57:ed:5c host1
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 requested options: 59:bootfile-url, 60:bootfile-param, 23:dns-server,
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 requested options: 16:vendor-class
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 tags: ctlplane-subnet, known, efi6, dhcpv6, eth1
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 18 option: 1 client-id 00:04:90:b3:fe:05:c8:ed:73:42:a5:7d:55:a0...
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 14 option: 2 server-id 00:01:00:01:25:a8:56:f2:52:54:00:b5:b2:8f
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 40 option: 3 ia-na IAID=3217423454 T1=300 T2=525
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 nest size: 24 option: 5 iaaddr fd12:3456:789a:1::aacc PL=600 VL=600
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 9 option: 13 status 0 success
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 37 option: 59 bootfile-url tftp://[fd12:3456:789a:1::1]/ipxe.efi
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 16 option: 23 dns-server fd12:3456:789a:1::1
> > Jan 08 10:03:38 server.example.com dnsmasq-dhcp[1444]: 14429695 sent size: 21 option: 39 FQDN host1.mydomain.net
> >
> > /** DNS entry now points to fd12:3456:789a:1::aacc */
> >
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: time 1578474219
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: cache size 150, 0/0 cache insertions re-used unexpired cache entries.
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: queries forwarded 0, queries answered locally 0
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: queries for authoritative zones 0
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: pool memory in use 0, max 0, allocated 0
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: server 192.168.122.1#53: queries sent 0, retried or failed 0
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: Host Address Flags Expires
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: net F D Wed Jan 8 10:13:38 2020
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: host1.mydomain.net fd12:3456:789a:1::aacc 6FR D Wed Jan 8 10:13:38 2020
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: bind F I
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: host1 fd12:3456:789a:1::aacc 6F D Wed Jan 8 10:13:38 2020
> > Jan 08 10:03:39 server.example.com dnsmasq[1444]: mydomain.net F D Wed Jan 8 10:13:38 2020
> >
> >
>
> Good, that solves that question.
>
>
> Cheers,
>
> Simon.
>
>
> _______________________________________________
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss at lists.thekelleys.org.uk
> http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
--
Pali Rohár
pali.rohar at gmail.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/attachments/20200113/cf95d456/attachment-0001.sig>
More information about the Dnsmasq-discuss
mailing list