<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Courier New";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="CS" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">Hello and thank you very much for your help.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">I have looked into the source code dhcp6_srv.cc and the issue is most probably cased by the way how Dhcpv6Srv::setHostIdentifiers() iterates over<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">cfg->getIdentifierTypes() collection - there is a switch statement with breaks inside the loop.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">I supposed that host-reservation-identifiers config needs to be set properly for this particular scenario. The default value of host-reservation-identifiers,
which probably is "host-reservation-identifiers": [ "hw-address", "duid", "circuit-id", "client-id" ] did not work because „duid“ option is probably matched before hw-address and, of course, I was missing host-reservation-identifiers in my config.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">So this is a working config for anyone who is interested in a strict server setup with clients identifed by MAC address which is provided via a relay.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">{<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "Dhcp6": {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "client-classes": [<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "name": "DROP",<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "test": "not member('KNOWN')"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "host-reservation-identifiers": [ "hw-address" ],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "mac-sources": [ "client-link-addr-option" ],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "subnet6": [<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "reservations": [<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "hw-address": "xx:xx:xx:xx:xx:xx",<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> "ip-addresses": [ "xxxx:xxx:xxxx:xxxx:xxxx:xxxx" ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ], }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">Sincerely,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US">Jan Rovner<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Courier New";color:black">S pozdravem,<br>
Jan Rovner<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Ing. Jan Rovner, Ph.D., jednatel společnosti<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="272" valign="top" style="width:204.3pt;border-top:dashed #BFBFBF 1.0pt;border-left:none;border-bottom:dashed #BFBFBF 1.0pt;border-right:none;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal" style="line-height:115%"><b><span style="font-size:10.0pt;line-height:115%;font-family:"Courier New";color:#1F497D"><img width="159" height="36" style="width:1.6562in;height:.375in" id="Picture_x0020_1" src="cid:image001.jpg@01DBAC7B.05F663F0"><o:p></o:p></span></b></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D">e-mail:
</span><span style="font-size:11.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:internet@diadema.cz"><span style="font-size:10.0pt;line-height:115%">internet@diadema.cz</span></a></span><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D">www:
</span><span style="font-size:11.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D"><a href="http://internet.diadema.cz/"><span style="font-size:10.0pt;line-height:115%">http://internet.diadema.cz</span></a></span><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D">
<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D">telefon: +420 377 421 863, +420 603 484 742</span><span style="font-size:11.0pt;line-height:115%;font-family:"Arial",sans-serif;color:#1F497D"><o:p></o:p></span></p>
</td>
<td width="198" colspan="2" style="width:148.4pt;border-top:dashed #BFBFBF 1.0pt;border-left:none;border-bottom:dashed #BFBFBF 1.0pt;border-right:none;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal" style="line-height:115%"><span style="font-size:11.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#1F497D"> <o:p></o:p></span></p>
</td>
</tr>
<tr>
<td width="286" colspan="2" valign="top" style="width:214.25pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal" style="line-height:115%"><b><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="line-height:115%"><b><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F">Diadema Internet s.r.o.</span></b><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F"><br>
zapsaná v obchodním rejstříku vedeném u Krajského soudu v Plzni, oddíl C, vložka 24294<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F">se sídlem Morseova 1126/5, 301 00 Plzeň<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F">IČO: 29093961, DIČ CZ29093961<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Courier New";color:#1F497D"><o:p> </o:p></span></p>
</td>
<td width="185" valign="top" style="width:138.45pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal" style="line-height:115%"><b><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="line-height:115%"><b><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F">Korespondenční a dodací adresa<o:p></o:p></span></b></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F">Diadema Internet s.r.o.<br>
Provozovna Plzeň-Lochotín<br>
Alej Svobody 56, 323 00 Plzeň<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Calibri",sans-serif;color:#7F7F7F"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><span style="font-size:10.0pt;line-height:115%;font-family:"Courier New";color:#1F497D"><o:p> </o:p></span></p>
</td>
</tr>
<tr>
<td width="272" style="width:204.0pt;padding:0cm 0cm 0cm 0cm"></td>
<td width="13" style="width:9.75pt;padding:0cm 0cm 0cm 0cm"></td>
<td width="185" style="width:138.75pt;padding:0cm 0cm 0cm 0cm"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Darren Ankney <darren.ankney@gmail.com>
<br>
<b>Sent:</b> Sunday, April 13, 2025 1:07 PM<br>
<b>To:</b> Kea user's list <kea-users@lists.isc.org><br>
<b>Cc:</b> Jan Rovner <jan.rovner@diadema.cz><br>
<b>Subject:</b> Re: [Kea-users] kea-dhcp6 : KNOWN class setting vs mac-sources and DUIDs types<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Jan,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You may want to investigate your assumption that option 79 is included. From what you've shown here, it seems likely that it was not included. You can do this with `tcpdump -i <interface> -w dhcp6.pcap port 547` The resulting dhcp6.pcap
can be opened in Wireshark for inspection. I think you might find that option 79 is not included.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Darren Ankney<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Apr 8, 2025 at 12:06<span style="font-family:"Arial",sans-serif"> </span>PM Jan Rovner via Kea-users <<a href="mailto:kea-users@lists.isc.org">kea-users@lists.isc.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">Hello,<br>
<br>
I am running dhcp6 server with strict policy that KEA talks only to clients with known MACs (Reservations) and provides only a static config for them. All clients are operating via DHCPv6 relay and the relay should pass client's MAC option 79 RFC 6939 for KEA
to be used via client-link-addr-option.<br>
<br>
This is a working except from my kea-dhcp6.conf. All it works fine, if client uses DUID-LLT or DUID-LL, where MAC address can be determined from DUID.<br>
<br>
...<br>
"client-classes": [<br>
{<br>
"name": "DROP",<br>
"test": "not member('KNOWN')"<br>
}<br>
<br>
...<br>
<br>
"host-reservation-identifiers": [ "hw-address", "duid" ],<br>
"mac-sources": [ "client-link-addr-option", "remote-id", "subscriber-id", "ipv6-link-local", "duid" ],<br>
<br>
...<br>
<br>
"subnet6": [<br>
{<br>
"reservations": [<br>
{<br>
"hw-address": "xx:xx:xx:xx:xx:xx",<br>
"ip-addresses": [ "xxxx:xxxx:xxxx:1::2" ],<br>
etc.<br>
...<br>
<br>
However, if client uses another DUID type, this happens - "Expression DROP is evaluated to true" and the request is dropped.<br>
<br>
INFO DHCP6_QUERY_LABEL received query: duid=[00:02:00:00:d2:6d:8e:83:64:d4:6c:e7:26:8e], [no hwaddr info], tid=0x2621c<br>
<br>
INFO EVAL_RESULT duid=[00:02:00:00:d2:6d:8e:83:64:d4:6c:e7:26:8e], [no hwaddr info], tid=0x2621c: Expression DROP evaluated to true<br>
<br>
DEBUG DHCP6_PACKET_DROP_DROP_CLASS2 dropped as member of the special class 'DROP' after host reservation lookup: duid=[00:02:00:00:d2:6d:8e:83:64:d4:6c:e7:26:8e], [no hwaddr info] local_address=[xxxx:xxxx:xxxx:x::x]:0, remote_address=[xxxx:xxxx:xxxx:xxxx::1]:547,
msg_type=SOLICIT (1),<br>
<br>
It looks like that host reservation lookup was probably not performed with correct MAC (that was told to the KEA via option 79).<br>
<br>
Any ideas to fix it?<br>
<br>
Thank you very much.<br>
<br>
Sincerely,<br>
Jan Rovner<br>
<br>
<br>
<br>
-- <br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
To unsubscribe visit <a href="https://lists.isc.org/mailman/listinfo/kea-users" target="_blank">
https://lists.isc.org/mailman/listinfo/kea-users</a>.<br>
<br>
Kea-users mailing list<br>
<a href="mailto:Kea-users@lists.isc.org" target="_blank">Kea-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/kea-users" target="_blank">https://lists.isc.org/mailman/listinfo/kea-users</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>