Report information
The Basics
Id:
43927
Status:
resolved
Priority:
Low/Low
Queue:

BugTracker
Version Fixed:
4.4.0
Version Found:
4.3.3
Versions Affected:
(no value)
Versions Planned:
4.4.0
Priority:
P2 Normal
Severity:
S2 Normal
CVSS Score:
(no value)
CVE ID:
(no value)
Component:
(no value)
Area:
feature

Dates
Created:Tue, 20 Dec 2016 09:05:31 -0500
Updated:Tue, 12 Dec 2017 07:38:33 -0500
Closed:Wed, 26 Apr 2017 14:11:57 -0400



This bug tracker is no longer active.

Please go to our Gitlab to submit issues (both feature requests and bug reports) for active projects maintained by Internet Systems Consortium (ISC).

Due to security and confidentiality requirements, full access is limited to the primary maintainers.

Subject: Add EUI-64 address assignment policy
Excerpted from support ticket 10833: Here is the description of the short-term patch we need: 1. If a host declaration exists for the DUID, the server grants the address (fixed-prefix6, fixed-address6) according to the host declaration, regardless of the DUID type of the client (even for DUID type 3 devices) 2. On a /64 subnet6/pool6 (with full range6 – it has to have the whole network available for the address space ), whenever a client with a DUID type 3, HW Type EUI-64 requests an address (IA_NA ), it will be granted an IPv6 calculated out of the EUI-64 link layer address, conforming to RFC 2373, except if there is a host declaration for this client-id. 3. On a /64 subnet6, any client with a non-conforming DUID (not type 3 or not hw type EUI-64) that is not linked to a host declaration, will be ignored and the event will be logged (I don't think there is a way to decline the request in dhcpv6 protocol definition, correct?) 4. On a /64 subnet6, any client with a DUID 3, HW Type EUI-64, requesting a solicit/renew and including IA_NA that do not match the EUI-64 policy, will have the suggested IA_NAs ignored and will receive a new address in conformance to the EUI-64 policy 5. Once the policy is in place, whenever a new device requests a lease, and even if the server has knowledge of a previously granted IPv6 address that conflicts with a new EUI-64 based address (old IPv6 calculated out of the MD5 hash), it should grant the new address to the new device. This is supposed to work with rapid commit enabled. Mid-term solution should also include: 1. EUI-64 policy configured per subnet6/ pool6 a. Should throw an error if pool is not a /64 or doesn’t have the full range 2. Option to not store the lease on lease DB when EUI-64 policy is enabled. Since this is pretty much like a reservation, there is little value in having it stored in the DB. Making it optional would be ideal
On Wed Apr 12 15:07:36 2017, fdupont wrote: > The EUI 64 idea was good 10 years ago but > not today when privacy concerns became > important... Now it is a customer request. > BTW should we port this to Kea? > That's a question for Kea dev probably. In theory it wouldn't be hard to do as Kea has an alternative allocation algorithm method mechanism, but we currently only support one algorithm (incremental). It would take a bit more work in configuration sanity checking and such. > Perhaps pin6_addr should take a pointer > (note the copied structure is on 128 bits > so the difference is not so great). > Agreed, changed it. I did it as a non-pointer initially to keep it "symmetrical" with piaddr() but that's a pretty weak argument. > Fixed a spelling error in dhcpd.conf.5 > > A question is "computed" better than "calculated" > (I got the same in a Kea review)? > They are essentially synonyms, I think either one is perfectly acceptable. > Possible missing "are" in: > "though they "outside" the subnet" > (dhcpd.conf.5) > Fixed. > Another spelling error in dhcpv6.c, > did some re-indents & co too. > > Put the star on the pointer variable side, > not on the pointer type side. > There should be a blank line between > declarations and statements, and > declarations must be first. > Fixed mdb6.c (BTW the last point > is not style, just old C standard). > > Tabulation uses was not consistent > so I tabilfied .c files. > > I noticed inconsistent use of > signed/unsigned (e.g a counter > declared as an int) but I didn't > fix them as ISC DHCP is already > full of such things...