Questions[dhcpd](server)

Trying to assign fixed ipv6 addresses to my coreos master and worker nodes from my Centos in order to have dual stack running on the cluster. However I am having a hard time getting it to assign the fixed ip addresses that I am hard-coding in the dhcp6.conf file as follows:

[root@ocp-svc ~]# cat /etc/dhcp/dhcpd6.conf
#
# DHCPv6 Server Configuration file.
#   see /usr/share/doc/dhcp-server/dhcpd6.conf.example
#   see dhcpd.conf(5) man page
#
authoritative;
ddns-update-style interim;
allow booting;
allow bootp;
allow unknown-clients;
ignore client-updates;
default-lease-time 14400;
max-lease-time 14400;


subnet6 fd00::/64 {
 range6 fd::1000 fd::2000
 option dhcp6.name-servers fd00::1;
 option dhcp6.domain-search "ocp.lan";
}
host otherclient {
        # This host entry is hopefully matched if the client supplies a DUID-LL
        # or DUID-LLT containing this MAC address.
        hardware ethernet 00:0c:29:5e:d2:37;
        fixed-address6 fd00::211;
}

I am using the following system:

[root@ocp-svc performanceoperator]# cat /etc/redhat-release
CentOS Linux release 8.5.2111

Have also added the following two lines in the config in order to allow SE linux to access the directory:

ausearch -c 'dhcpd' --raw | audit2allow -M my-dhcpd
semodule -X 300 -i my-dhcpd.pp
systemctl restart dhcpd

And saw this messages in the messages log facility:

Dec 13 19:52:13 ocp-svc systemd[1]: Stopping DHCPv4 Server Daemon...
Dec 13 19:52:13 ocp-svc systemd[1]: dhcpd.service: Succeeded.
Dec 13 19:52:13 ocp-svc systemd[1]: Stopped DHCPv4 Server Daemon.
Dec 13 19:52:13 ocp-svc systemd[1]: Starting DHCPv4 Server Daemon...
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Internet Systems Consortium DHCP Server 4.3.6
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Copyright 2004-2017 Internet Systems Consortium.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: All rights reserved.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: For info, please visit https://www.isc.org/software/dhcp/
Dec 13 19:52:13 ocp-svc dhcpd[199778]: ldap_gssapi_principal is not set,GSSAPI Authentication for LDAP will not be used
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file
Dec 13 19:52:13 ocp-svc dbus-daemon[1024]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.14' (uid=0 pid=1001 comm="/usr/sbin/sedispatch " label="system_u:system_r:auditd_t:s0") (using servicehelper)
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Config file: /etc/dhcp/dhcpd.conf
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Database file: /var/lib/dhcpd/dhcpd.leases
Dec 13 19:52:13 ocp-svc dhcpd[199778]: PID file: /var/run/dhcpd.pid
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Source compiled to use binary-leases
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Wrote 0 deleted host decls to leases file.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Wrote 0 new dynamic host decls to leases file.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Wrote 1 leases to leases file.
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Listening on LPF/ens224/00:0c:29:70:9c:d0/192.168.22.0/24
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Sending on   LPF/ens224/00:0c:29:70:9c:d0/192.168.22.0/24
Dec 13 19:52:13 ocp-svc dhcpd[199778]:
Dec 13 19:52:13 ocp-svc dhcpd[199778]: No subnet declaration for ens192 (192.168.0.139).
Dec 13 19:52:13 ocp-svc dhcpd[199778]: ** Ignoring requests on ens192.  If this is not what
Dec 13 19:52:13 ocp-svc dhcpd[199778]:   you want, please write a subnet declaration
Dec 13 19:52:13 ocp-svc dhcpd[199778]:   in your dhcpd.conf file for the network segment
Dec 13 19:52:13 ocp-svc dhcpd[199778]:   to which interface ens192 is attached. **
Dec 13 19:52:13 ocp-svc dhcpd[199778]:
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Sending on   Socket/fallback/fallback-net
Dec 13 19:52:13 ocp-svc dhcpd[199778]: Server starting service.
Dec 13 19:52:13 ocp-svc systemd[1]: Started DHCPv4 Server Daemon.
Dec 13 19:52:14 ocp-svc dbus-daemon[1024]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Dec 13 19:52:15 ocp-svc dbus-daemon[1024]: [system] Activating service name='org.fedoraproject.SetroubleshootPrivileged' requested by ':1.224' (uid=995 pid=199781 comm="/usr/libexec/platform-python -Es /usr/sbin/setroub" label="system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023") (using servicehelper)
Dec 13 19:52:16 ocp-svc dbus-daemon[1024]: [system] Successfully activated service 'org.fedoraproject.SetroubleshootPrivileged'

Checked the dhcpd service status which also looks good:

[root@ocp-svc ~]# systemctl status dhcpd
● dhcpd.service - DHCPv4 Server Daemon
   Loaded: loaded (/usr/lib/systemd/system/dhcpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2021-12-13 20:05:21 CST; 8s ago
     Docs: man:dhcpd(8)
           man:dhcpd.conf(5)
 Main PID: 213030 (dhcpd)
   Status: "Dispatching packets..."
    Tasks: 1 (limit: 101086)
   Memory: 10.2M
   CGroup: /system.slice/dhcpd.service
           └─213030 /usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid

Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: No subnet declaration for ens192 (192.168.0.139).
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: ** Ignoring requests on ens192.  If this is not what
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:    you want, please write a subnet declaration
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:    in your dhcpd.conf file for the network segment
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:    to which interface ens192 is attached. **
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]:
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: Sending on   Socket/fallback/fallback-net
Dec 13 20:05:21 ocp-svc.lab.ocp.lan dhcpd[213030]: Server starting service.
Dec 13 20:05:21 ocp-svc.lab.ocp.lan systemd[1]: Started DHCPv4 Server Daemon.

Could anyone shed some light here on what else I could be missing here? Any help is tremendously appreciated.

I added the following now to comply with SElinux (dhcpd6) after some research....but still didn't do much...argh...

[root@ocp-svc etc]# ausearch -c 'dhcpd6' --raw | audit2allow -M my-dhcpd6
Nothing to do
[root@ocp-svc etc]# semodule -i my-dhcpd6.pp

I know there are three kinds of events we can use for scripting in ISC dhcpd -- commit, expire and lease. My problem is, I am having a little problem in understanding the "commit" event. I know "commit" event means when the server has made a commitment of a certain lease to a client. But it would be easier to understand this in DORA context.

That means, when the "commit" event will trigger in ISC DHCP server? Is it when the dhcpd is ready to offer a lease to a client? or after it has leased IP to a client?

For example, in the following configuration -

on commit {
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    set ClientMac = binary-to-ascii(16, 8, ":", substring(hardware, 1, 6));
    execute("/usr/sbin/test.py", "commit", ClientIP, ClientMac);
}

when exactly will the test.py script will execute? Before the DHCP ACK packet exits from DHCP server or after DHCP OFFER packet exits from DHCP server?

Thanks in advance. Cheers :)

I have a Cent0S 7 miniPC with a wireless and wired network ports. The wireless port (wlp3s0) is connected as a DHCP client with 192.168.10.X addressing and has DNS resolution.

I'm trying to setup the wired port (enp2s0) as a DHCP server for a private subnet with 192.168.100.X addressing. The miniPC will be attached to a network switch which will have other client devices connected for testing.

I followed the directions from RedHat here to a tee.

My /etc/systemd/system/dhcpd.service is as follows:

[Unit]
Description=DHCPv4 Server Daemon
Documentation=man:dhcpd(8) man:dhcpd.conf(5)
Wants=network-online.target
After=network-online.target
After=time-sync.target

[Service]
Type=notify
ExecStart=/usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcpd -group dhcpd --no-pid enp2s0

[Install]
WantedBy=multi-user.target

And my /etc/dhcp/dhcpd.conf is as follows:

default-lease-time 600;
max-lease-time 7200;
authoritative;

subnet 192.168.100.0 netmask 255.255.255.0 {
    option routers                  192.168.100.1;
    option subnet-mask              255.255.255.0;
    option broadcast-address        192.168.100.255;
    range 192.168.100.10 192.168.100.100;
}

When I go to configure and start the service:

sudo systemctl --system daemon-reload
sudo systemctl restart dhcpd.service

I get this in /var/log/messages:

localhost systemd: Starting DHCPv4 Server Daemon...
localhost dhcpd: Internet Systems Consortium DHCP Server 4.2.5
localhost dhcpd: Copyright 2004-2013 Internet Systems Consortium.
localhost dhcpd: All rights reserved.
localhost dhcpd: For info, please visit https://www.isc.org/software/dhcp/
localhost dhcpd: Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file
localhost dhcpd: Wrote 0 leases to leases file.
localhost dhcpd: 
localhost dhcpd: No subnet declaration for enp2s0 (no IPv4 addresses).
localhost dhcpd: ** Ignoring requests on enp2s0.  If this is not what
localhost dhcpd:   you want, please write a subnet declaration
localhost dhcpd:   in your dhcpd.conf file for the network segment
localhost dhcpd:   to which interface enp2s0 is attached. **
localhost dhcpd: 
localhost dhcpd: 
localhost dhcpd: Not configured to listen on any interfaces!
localhost dhcpd: 
localhost dhcpd: This version of ISC DHCP is based on the release available
localhost dhcpd: on ftp.isc.org.  Features have been added and other changes
localhost dhcpd: have been made to the base software release in order to make
localhost dhcpd: it work better with this distribution.
localhost dhcpd: 
localhost dhcpd: Please report for this software via the CentOS Bugs Database:
localhost dhcpd:    http://bugs.centos.org/
localhost dhcpd: 
localhost dhcpd: exiting.
localhost systemd: dhcpd.service: main process exited, code=exited, status=1/FAILURE
localhost systemd: Failed to start DHCPv4 Server Daemon.
localhost systemd: Unit dhcpd.service entered failed state.
localhost systemd: dhcpd.service failed.

Any idea what's going wrong here?

Thanks.

Actually I want to dinamically assign bootfile-name based on clients MAC.

I have tried this config:

option bootfile-name concat( binary-to-ascii(16, 8, "", substring (hardware, 1, 6)), ".cfg");

But this is wrong config (as dhcp server isn't starting at all). If instead of concat(...) I put just real filename (e.g. "000102030405.cfg") everything is ok. But this is not what I need. Is there any way to dynamically set bootfile-name?

We are looking for a way to do something along these lines in the dhcpd.conf file:

subnet ... {
    #couple of options for the subnet here
    pool {
        allow members of "class-name1";
        allow members of "class-name2";

        range ip1 ip2;
    }

    if is member of class "class-name1" {
        option ...;
    }
}

The part in question is if is member of class "class-name" - no idea how to verify this condition.

Here is how the class itself is defined:

class "class name" {
    match if some_condition_here;
}

Of course an obvious solution would be just repeating the same condition in the subnet section, but would be a repetition - not a very good way to go. I also believe this goes somewhat against the essence of a class.

Another idea we had was to use separate pool for this without specifying the range. Like this:

pool {
    allow members of "class-name1";
    option ...;
}

That did not work though - config is not accepted as invalid. Apparently pool section requires a range inside, although I am not able to find this requirement in the spec.

We had one more guess - specify two identical pools, one for other classes and one for "class-name1". However that means that the same range appears twice, which is again an invalid config.

So, is there a good way to verify if a device was classified as a member of particular class?