<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for the response, Rick. I increased the logging of Kea and I can confirm that Kea is seeing the FQDN (81) option as partial as you suspected.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]:
options:</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=012, len=010: "win11-test"
(string)</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=050, len=004: 192.168.100.60
(ipv4-address)</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=053, len=001: 3
(uint8)</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=054, len=004: 192.168.100.50
(ipv4-address)</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=055, len=014: 1(uint8)
3(uint8) 6(uint8) 15(uint8) 31(uint8) 33(uint8) 43(uint8) 44(uint8) 46(uint8) 47(uint8) 119(uint8) 121(uint8) 249(uint8) 252(uint8)</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=060, len=008: "MSFT
5.0" (string)</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=061, len=007: 01:52:54:00:b1:c6:7d</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Jan 15 13:53:40 d1 kea-dhcp4[612798]: type=81 (CLIENT_FQDN),
flags: (N=0, E=0, O=0, S=0), domain-name='win11-test.win-domain.com' (partial)</span></div>
<div><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">Here's a summary of the DORA flow -</span></div>
<div><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">The initial DHCPDISCOVER address from the Windows client only contains the Hostname (12), in this case, "win11-test". When crafting
the DHCPOFFER, Kea updates the hostname to include the configured hostname set in Kea. The DHCPOFFER now contains a Hostname (12) of "win11-test.win-test.com". When the Windows client sends the DHCPREQUEST, the Hostname (12) is the name of the client "win11-test"
but now the FQDN (81) option is included with the active directory domain "win11-test.win-domain.com" (without a zero-length label). Kea then fully qualifies the incoming FQDN as it sees it as partial. The FQDN of the DHCPACK is now "win11-test.win-domain.com.win-test.com".</span></div>
<div><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">I was looking around for Gitlab issues and came across
<a href="https://gitlab.isc.org/isc-projects/kea/-/issues/1989" id="LPlnkOWALinkPreview" class="OWAAutoLink" style="color: rgb(0, 0, 0);">
https://gitlab.isc.org/isc-projects/kea/-/issues/1989</a>. On the issue, it states that the DDNS tuning hook should be able to violate the RFC and select a preferred option.</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">"that you can actually do now with DDNS tuning hook"</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div style="margin-right: 40px; margin-left: 0px;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Unfortunately
the DDNS tuning hook is a paid hook and I am unable to test if that is a valid </span>
<span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12px; font-weight: 400; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">workaround</span><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"> unless
I commit to purchasing the hook.</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div style="margin-right: 40px; margin-left: 40px;"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview_3 _EReadonly_1">
<div id="LPBorder_GTaHR0cHM6Ly9naXRsYWIuaXNjLm9yZy9pc2MtcHJvamVjdHMva2VhLy0vaXNzdWVzLzE5ODk." class="LPBorder483950" style="width: 100%; margin-top: 16px; margin-bottom: 16px; position: relative; max-width: 800px; min-width: 424px;">
<table id="LPContainer483950" role="presentation" style="padding: 12px 36px 12px 12px; width: 100%; border-width: 1px; border-style: solid; border-color: rgb(200, 200, 200); border-radius: 2px;">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td>
<div id="LPImageContainer483950" style="position: relative; margin-right: 12px; height: 168px; overflow: hidden; width: 240px;">
<a target="_blank" id="LPImageAnchor483950" href="https://gitlab.isc.org/isc-projects/kea/-/issues/1989"><img id="LPThumbnailImageId483950" alt="" height="168" style="display: block;" width="240" src="https://gitlab.isc.org/uploads/-/system/project/avatar/26/kea-logo-100x70.png"></a></div>
</td>
<td style="width: 100%;">
<div id="LPTitle483950" style="font-size: 21px; font-weight: 300; margin-right: 8px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px;">
<a target="_blank" id="LPUrlAnchor483950" href="https://gitlab.isc.org/isc-projects/kea/-/issues/1989" style="text-decoration: none;">Issues with qualifying suffix when clients use a combination of Hostname and Client FQDN option (#1989) · Issues · ISC Open
Source Projects / Kea · GitLab</a></div>
<div id="LPDescription483950" style="font-size: 14px; max-height: 100px; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; margin-bottom: 12px; margin-right: 8px; overflow: hidden; color: rgb(102, 102, 102);">
A client sends option 12 (Hostname) or option 81 (Client FQDN) to communicate the desired name to the server. The server assumes that the client sends one of...</div>
<div id="LPMetadata483950" style="font-size: 14px; font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; color: rgb(166, 166, 166);">
gitlab.isc.org</div>
</td>
</tr>
</tbody>
</table>
<div id="LPCloseButtonContainer483950" class="uHkAz" tabindex="0" title="Remove link preview" role="button">
<i data-icon-name="Cancel" aria-hidden="true" id="LPCloseButton483950" class="Rm9Q1 root-425"></i></div>
<div id="LPCloseButtonContainer483950" class="uHkAz" tabindex="0" title="Remove link preview" role="button">
<i data-icon-name="Cancel" aria-hidden="true" id="LPCloseButton483950" class="Rm9Q1 root-425"></i></div>
</div>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Kea-users <kea-users-bounces@lists.isc.org> on behalf of Rick Frey <gribnut@gmail.com><br>
<b>Sent:</b> Monday, January 8, 2024 10:48 PM<br>
<b>To:</b> Kea user's list <kea-users@lists.isc.org><br>
<b>Subject:</b> [External] - Re: [Kea-users] DDNS remove domain included in fqdn option</span>
<div> </div>
</div>
<div>Per Kea docs, I believe kea will prefer the FQDN (81) option over the Hostname (12) option if both are provided from client. Once name is derived from either option, Kea then determines if name is fully qualified or a partial. In your case, it seems
that Kea determines the value in FQDN (81) is a partial name so it appends the ddns-qualifying-suffix.</div>
<div><br>
</div>
<div>Per <a href="https://datatracker.ietf.org/doc/html/rfc4702#section-2.3" id="OWA5e370e8d-c335-d5f7-d8ba-a86d90ac73e7" class="OWAAutoLink" data-auth="NotApplicable">
https://datatracker.ietf.org/doc/html/rfc4702#section-2.3</a>, the domain name portion of the FQDN option can be a fully qualified domain name or a partial name that is not fully qualified. Where </div>
<div>“To send a fully qualified domain name, the Domain Name field is set</div>
<div> to the DNS-encoded domain name including the terminating zero-length</div>
<div> label. To send a partial name, the Domain Name field is set to the</div>
<div> DNS encoded domain name without the terminating zero-length label.”.</div>
<div><br>
</div>
<div>Would need a packet capture to verify, but assuming your Windows clients are not terminating the FQDN value with a terminating zero-length label since Kea looks to be determining that the value is a partial name. Guessing that the Windows clients may
be <span style="color: rgb(0, 0, 0);">misconfigured where they are not using a fully qualified domain name or Windows client is not honoring RFC4702 (or Kea not properly parsing FQDN option 81).</span></div>
<div><span style="color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="color: rgb(0, 0, 0);">With that said, I don’t see a means to configure Kea to ignore the FQDN (81) option if Hostname (12) is also provided. Others may have some ideas if there is means to configure Kea to ignore/replace the FQDN value when
processing DDNS updates.</span></div>
<div><span style="color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="color: rgb(0, 0, 0);"><br>
</span></div>
<div><br>
</div>
<blockquote>
<div>On Jan 8, 2024, at 10:58 AM, Isaac Brummel <ibrummel@xes-inc.com> wrote:</div>
<br>
<div style="text-align: left; white-space: normal; letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;">
<span style="letter-spacing: normal;">Hello,</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"><br>
</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;">I'm setting up Kea in a Test environment
and ran across an issue with DDNS domain names. I have a couple of Windows servers that are domain joined. The domain is different than the domain used by the Kea DDNS service. So when a Windows servers requests a lease an odd record is generated for the client.
The windows domain name is "<a href="http://win-domain.com/" id="OWAe2032b6c-42bb-ca39-f242-94037c74ceb9" class="OWAAutoLink" data-auth="NotApplicable">win-domain.com</a>" and the domain used by DDNS is "<a href="http://win-test.com/" id="OWAd38c3ec6-4c90-1286-8bdf-73cf79a417d0" class="OWAAutoLink" data-auth="NotApplicable">win-test.com</a>".
Here are the hostname specific options received by a tcpdump when the Windows servers requests a lease.</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"><br>
</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"> Hostname (12), length 21: "win11"</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"> FQDN (81), length 33: "<a href="http://win11.win-domain.com/" id="OWA07c724cb-eb02-c9e3-354f-42d8225428a2" class="OWAAutoLink" data-auth="NotApplicable">win11.win-domain.com</a>"</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"><br>
</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;">This combination results in the DDNS service
creating a recording containing "<a href="http://win-domain.com/" id="OWA28b9cf05-c702-cc98-88ab-902fbfd8be01" class="OWAAutoLink" data-auth="NotApplicable">win-domain.com</a>" that I assume is because it's not the Kea DDNS domain and doesn't know how to handle
it. The record that gets generated looks like this: "<a href="http://win11.win-domain.com.win-test.com/" id="OWA64959d45-b03f-97ee-2ee7-48d9680dabc5" class="OWAAutoLink" data-auth="NotApplicable">win11.win-domain.com.win-test.com</a>". In the Kea DHCP4 config,
I have the following for the DDNS suffix.</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"><br>
</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"> "ddns-qualifying-suffix": "<a href="http://win-test.com/" id="OWAddf0f95f-e5cc-0484-18bd-ded1059b20cf" class="OWAAutoLink" data-auth="NotApplicable">win-test.com</a>",</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"><br>
</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;">Looking at the documentation for DDNS there
is the "ddns-replace-client-name" option but in my testing it seems that it can't use the value from the incoming packet's option 12 (hostname) and requires statically setting something. Is there a way to work around this issue, removing "<a href="http://win-domain.com/" id="OWA5da67185-6767-9329-d517-a7ce7cd3aa86" class="OWAAutoLink" data-auth="NotApplicable">win-domain.com</a>"
from the DDNS record, or having DDNS ignore the FQDN (81) option all together? Would the "ddns-tuning" hook work for this?</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;"><br>
</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;">Thanks,</span></div>
<div style="text-align: left; white-space: normal;"><span style="letter-spacing: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; font-weight: 400;">Isaac</span></div>
<span style="letter-spacing: normal; font-family: Helvetica; font-size: 12px; font-weight: 400;">-- </span><br>
<span style="letter-spacing: normal; font-family: Helvetica; font-size: 12px; font-weight: 400;">ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/" id="OWAdf965d07-de84-55cc-1e02-831c04d05471" class="OWAAutoLink" data-auth="NotApplicable" style="text-align: left;">
https://www.isc.org/contact/</a> for more information.</span><br>
<br>
<span style="letter-spacing: normal; font-family: Helvetica; font-size: 12px; font-weight: 400;">To unsubscribe visit
<a href="https://lists.isc.org/mailman/listinfo/kea-users" id="OWA23c93b3e-fe06-dc64-2df8-1cf0fd689764" class="OWAAutoLink" data-auth="NotApplicable" style="text-align: left;">
https://lists.isc.org/mailman/listinfo/kea-users</a>.</span><br>
<br>
<span style="letter-spacing: normal; font-family: Helvetica; font-size: 12px; font-weight: 400;">Kea-users mailing list</span><br>
<span style="letter-spacing: normal; font-family: Helvetica; font-size: 12px; font-weight: 400;"><a href="mailto:Kea-users@lists.isc.org" id="OWA13d5f6f9-c9ea-02a3-fbaf-061c449c20f2" class="OWAAutoLink" style="text-align: left;">Kea-users@lists.isc.org</a></span><br>
<span style="letter-spacing: normal; font-family: Helvetica; font-size: 12px; font-weight: 400;"><a href="https://lists.isc.org/mailman/listinfo/kea-users" id="OWAcf479695-3187-df75-334f-502f93ab54e4" class="OWAAutoLink" data-auth="NotApplicable" style="text-align: left;">https://lists.isc.org/mailman/listinfo/kea-users</a></span></blockquote>
<br>
<div style="text-align: left; line-height: 12pt; padding: 2pt; border-width: 1pt; border-style: solid; border-color: rgb(156, 101, 0); width: 100%; background-color: rgb(255, 235, 156);">
<span style="font-family: Calibri; font-size: 10pt; color: rgb(156, 101, 0);"><b>CAUTION:</b></span><span style="font-family: Calibri; font-size: 10pt; color: black;"> This email originated from outside of the organization. Do not click links or open attachments
unless you recognize the sender and know the content is safe.</span></div>
<br>
</body>
</html>