Date: | Tue, 29 Aug 2017 15:31:06 -0700 |
To: | dhcp-suggest@isc.org |
Subject: | dhcpd patch for logging encapsulated packets from DHCPv6 relays |
From: | "Rob Riepel" <riepel@stanford.edu> |
dhcpd doesn't log DHCPv6 encapsulated packets from relays. The solicit, request, renew, etc. data in encapsulated packets is valuable network management information, so we've patched server/dhcpv6.c to log the contents of the encapsulated packets from relays. The changes are fairly minor, just adding a call to log_packet_in() from dhcpv6_relay_forw(), and fleshing out log_packet_in() to log the encapsulated packets in a manner similar to the current logging of outgoing packets. Here are before and after log examples:
Before:
# relayed solicit (not logged), advert, relayed request (not logged), reply
Relay-forward message from 2607:f6d0:0:a228::1 port 547, link address 2607:f6d0:0:a228::1, peer address fe80::c7c:c368:33bd:2af5
Picking pool address 2607:f6d0:0:a228:bad:c0ff:ee:69
Advertise NA: address 2607:f6d0:0:a228:bad:c0ff:ee:69 to client with duid 00:01:00:01:20:b6:0d:d6:d4:61:9d:0f:45:e2 iaid = 0 valid for 900 seconds
Sending Relay-reply to 2607:f6d0:0:a228::1 port 547
Relay-forward message from 2607:f6d0:0:a228::1 port 547, link address 2607:f6d0:0:a228::1, peer address fe80::c7c:c368:33bd:2af5
Reply NA: address 2607:f6d0:0:a228:bad:c0ff:ee:69 to client with duid 00:01:00:01:20:b6:0d:d6:d4:61:9d:0f:45:e2 iaid = 0 valid for 900 seconds
Sending Relay-reply to 2607:f6d0:0:a228::1 port 547
# relayed renew (not logged), reply
Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::5100:7e7e:5d08:4358
Reply NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6e to client with duid 00:01:00:01:1f:37:41:82:f8:b1:56:b6:9c:a9 iaid = 1 valid for 900 seconds
Sending Relay-reply to 2607:f6d0:0:a13f::a port 547
After:
# relayed solicit, advert, relayed request, reply
Received Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::10f0:d2f0:fa9d:7737
Solicit NA: from client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0
Picking pool address 2607:f6d0:0:a13f:bad:c0ff:ee:6c
Advertise NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6c to client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0 valid for 900 seconds
Sending Relay-reply to 2607:f6d0:0:a228::1 port 547
Received Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::10f0:d2f0:fa9d:7737
Request NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6c from client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0
Reply NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6c to client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0 valid for 900 seconds
Relay-reply to 2607:f6d0:0:a13f::a port 547
# relayed renew, reply
Received Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::5100:7e7e:5d08:4358
Renew NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:62 from client with duid 00:01:00:01:1f:37:41:82:f8:b1:56:b6:9c:a9 iaid = 1
Reply NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:62 to client with duid 00:01:00:01:1f:37:41:82:f8:b1:56:b6:9c:a9 iaid = 1 valid for 900 seconds
Sending Relay-reply to 2607:f6d0:0:a13f::a port 547
As you can see, the incoming encapsulated packets are now logged in the same style as the outgoing encapsulated packets. Those messages are bracketed by "Received Relay-forward" and "Sending Relay-reply." Hopefully you'll agree that's more informative and consider accepting this patch or implementing something similar.
The attached patch is relative to 4.3.6. I'm attaching the patched dhcpv6.c as well, in case patch is passé. Virtually all the changes are in log_packet_in() and I'm pretty sure it'll log a superset of what it logged before (i.e., logging should be identical to before with some new logging, and with "Received " prepended to the "Relay-forward" log message to make it consistent with the "Sending Relay-replay" message).
Message body not shown because it is not plain text.
Message body not shown because it is not plain text.