Report information
The Basics
Id:
45881
Status:
open
Priority:
Low/Low
Queue:

People
Owner:
Nobody in particular
Cc:
AdminCc:

BugTracker
Version Fixed:
(no value)
Version Found:
(no value)
Versions Affected:
(no value)
Versions Planned:
(no value)
Priority:
(no value)
Severity:
(no value)
CVSS Score:
(no value)
CVE ID:
(no value)
Component:
(no value)
Area:
(no value)

Dates
Created:Tue, 29 Aug 2017 18:31:25 -0400
Updated:Wed, 08 Aug 2018 20:00:39 -0400
Closed:Not set



This bug tracker is no longer active.

Please go to our Gitlab to submit issues (both feature requests and bug reports) for active projects maintained by Internet Systems Consortium (ISC).

Due to security and confidentiality requirements, full access is limited to the primary maintainers.

Date: Tue, 29 Aug 2017 15:31:06 -0700
To: dhcp-suggest@isc.org
Subject: dhcpd patch for logging encapsulated packets from DHCPv6 relays
From: "Rob Riepel" <riepel@stanford.edu>
dhcpd doesn't log DHCPv6 encapsulated packets from relays. The solicit, request, renew, etc. data in encapsulated packets is valuable network management information, so we've patched server/dhcpv6.c to log the contents of the encapsulated packets from relays. The changes are fairly minor, just adding a call to log_packet_in() from dhcpv6_relay_forw(), and fleshing out log_packet_in() to log the encapsulated packets in a manner similar to the current logging of outgoing packets. Here are before and after log examples: Before: # relayed solicit (not logged), advert, relayed request (not logged), reply Relay-forward message from 2607:f6d0:0:a228::1 port 547, link address 2607:f6d0:0:a228::1, peer address fe80::c7c:c368:33bd:2af5 Picking pool address 2607:f6d0:0:a228:bad:c0ff:ee:69 Advertise NA: address 2607:f6d0:0:a228:bad:c0ff:ee:69 to client with duid 00:01:00:01:20:b6:0d:d6:d4:61:9d:0f:45:e2 iaid = 0 valid for 900 seconds Sending Relay-reply to 2607:f6d0:0:a228::1 port 547 Relay-forward message from 2607:f6d0:0:a228::1 port 547, link address 2607:f6d0:0:a228::1, peer address fe80::c7c:c368:33bd:2af5 Reply NA: address 2607:f6d0:0:a228:bad:c0ff:ee:69 to client with duid 00:01:00:01:20:b6:0d:d6:d4:61:9d:0f:45:e2 iaid = 0 valid for 900 seconds Sending Relay-reply to 2607:f6d0:0:a228::1 port 547 # relayed renew (not logged), reply Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::5100:7e7e:5d08:4358 Reply NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6e to client with duid 00:01:00:01:1f:37:41:82:f8:b1:56:b6:9c:a9 iaid = 1 valid for 900 seconds Sending Relay-reply to 2607:f6d0:0:a13f::a port 547 After: # relayed solicit, advert, relayed request, reply Received Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::10f0:d2f0:fa9d:7737 Solicit NA: from client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0 Picking pool address 2607:f6d0:0:a13f:bad:c0ff:ee:6c Advertise NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6c to client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0 valid for 900 seconds Sending Relay-reply to 2607:f6d0:0:a228::1 port 547 Received Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::10f0:d2f0:fa9d:7737 Request NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6c from client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0 Reply NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:6c to client with duid 00:01:00:01:21:1d:e4:63:78:7b:8a:ab:16:09 iaid = 0 valid for 900 seconds Relay-reply to 2607:f6d0:0:a13f::a port 547 # relayed renew, reply Received Relay-forward message from 2607:f6d0:0:a13f::a port 547, link address 2607:f6d0:0:a13f::a, peer address fe80::5100:7e7e:5d08:4358 Renew NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:62 from client with duid 00:01:00:01:1f:37:41:82:f8:b1:56:b6:9c:a9 iaid = 1 Reply NA: address 2607:f6d0:0:a13f:bad:c0ff:ee:62 to client with duid 00:01:00:01:1f:37:41:82:f8:b1:56:b6:9c:a9 iaid = 1 valid for 900 seconds Sending Relay-reply to 2607:f6d0:0:a13f::a port 547 As you can see, the incoming encapsulated packets are now logged in the same style as the outgoing encapsulated packets. Those messages are bracketed by "Received Relay-forward" and "Sending Relay-reply." Hopefully you'll agree that's more informative and consider accepting this patch or implementing something similar. The attached patch is relative to 4.3.6. I'm attaching the patched dhcpv6.c as well, in case patch is passé. Virtually all the changes are in log_packet_in() and I'm pretty sure it'll log a superset of what it logged before (i.e., logging should be identical to before with some new logging, and with "Received " prepended to the "Relay-forward" log message to make it consistent with the "Sending Relay-replay" message).

Message body not shown because it is not plain text.

Message body not shown because it is not plain text.

Subject: Re: [ISC-Bugs #45881] dhcpd patch for logging encapsulated packets from DHCPv6 relays
From: "Rob Riepel" <riepel@stanford.edu>
To: dhcp-public@isc.org
Date: Mon, 18 Sep 2017 16:10:51 -0700
The original patch had issues that resulted in segfaults when incoming encapsulated packets were missing particular options. Attached is a revised patch correcting that.

Message body not shown because it is not plain text.

Subject: Re: [ISC-Bugs #45881] dhcpd patch for logging encapsulated packets from DHCPv6 relays
Date: Wed, 8 Aug 2018 17:00:26 -0700
From: "Rob Riepel" <riepel@stanford.edu>
To: dhcp-public@isc.org
We just expanded DHCPv6 and started seeing PD requests. The previous patch doesn't log them as nicely as NA and TA requests. Here's a new patch with better PD logging. It's relative to 4.4.1.

Message body not shown because it is not plain text.