workaround<\/a> somebody else discovered — plus it doesn’t destory the ‘option agent.*’ information that’s used for the ‘stash-agent-option’ config flag.<\/p>\nUsing ‘option agent.unknown-9’, I was able to grab the vendor ID (what Wireshark decoded as 161 — Motorola) in dhcpd.conf:<\/p>\n
[code]set myvendor = binary-to-ascii(10, 16, “,”, substring(option agent.unknown-9,2,2));[\/code]<\/p>\n
Putting it all together:<\/p>\n
[shell]
\n# when the DHCP server gets an initial request, it contains Option 82 information
\n# that is added by a network element (i.e. from the AP, OLT, CMTS, DSLAM, switch, etc).
\n# however, subsequent renewals are unicasted from the subscriber to the DHCP server.
\n# those unicasted requests don’t get Option 82 values added by the network element.
\n# because we will match on agent options, we need to stash this info so that renewals
\n# will work as expected. basically, this will create a database linking the hardware address
\n# to the Option 82 values that were found in the initial DHCP DISCOVER packet
\nstash-agent-option;<\/p>\n
# DHCP Option 82 *may* contain a vendor subtype (code 9)
\n# ISC-DHCPD knows it’s there, but doesn’t know how to decode it
\nif exists agent.unknown-9
\n{<\/p>\n
# VENDOR definition
\nset myvendor = binary-to-ascii(10, 16, “,”, substring(option agent.unknown-9,2,2));<\/p>\n
# For customers behind Motorola (i.e. Cambium SM), format ciruit-id and remote-id as MAC’s
\nif myvendor = “161” # Motorola
\n{
\n# SM definition
\n# we want to restore the leading zero’s that get stripped when converting binary to ascii
\nset mysm = concat (
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,0,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,1,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,2,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,3,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,4,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,5,1))),2)
\n);<\/p>\n
# AP definition
\n# we want to restore the leading zero’s that get stripped when converting binary to ascii
\nset myap = concat (
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.circuit-id,0,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.circuit-id,1,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.circuit-id,2,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.circuit-id,3,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.circuit-id,4,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.circuit-id,5,1))),2)
\n);<\/p>\n
# add a line to syslog showing the IP -> SM -> AP mapping
\nlog ( info, concat (
\n“WISP IPv4 “, binary-to-ascii (10, 8, “.”, leased-address),
\n” SM ” , mysm,
\n” AP “, myap,
\n” VENDOR “, myvendor));
\n}<\/p>\n
}<\/p>\n
# to simplify later ‘deny’ rules, track all static customers here
\nclass “static-sm” {
\n# unfortunately, I can’t just do a “match mysm” here, so I have to redo my string manipulation on the “option agent.remote-id”
\nmatch concat (
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,0,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,1,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,2,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,3,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,4,1))),2), “:”,
\nsuffix (concat (“0”, binary-to-ascii (16, 8, “”, substring(option agent.remote-id,5,1))),2)
\n);
\n}<\/p>\n
# each static-IP subscriber gets a “static-sm” subclass entry like this
\nsubclass “static-sm” “0a:00:3e:38:5a:e0”;<\/p>\n
# each static-IP subscriber gets a unique class with just their SM’s MAC
\nclass “alk-static” {
\nmatch if mysm = “0a:00:3e:38:5a:e0”;
\n}<\/p>\n
# BRAS\/BNG Testing Subnets
\nshared-network brastest-default {
\nsubnet 192.168.1.0 netmask 255.255.255.0 {
\noption routers 192.168.1.254;
\n}
\npool {
\n# this is the static IP assignment for “alk-static”
\n# each static IP customer gets a pool definition like this one
\nallow members of “alk-static”;
\nallow known-clients;
\nrange 192.168.1.200;
\n}
\npool {
\n# this is the default pool for dynamic customers
\ndeny dynamic bootp clients; # DHCP is OK, BOOTP is not…
\ndeny members of “static-sm”; # List of all static assignments (subclasses)
\nrange 192.168.1.1 192.168.1.199;
\n}
\n}
\n[\/shell]<\/p>\n","protected":false},"excerpt":{"rendered":"
The broadband access network I work with relies on DHCP Option-82 to manage DHCP leases, among other things. The primary access equipment vendor (Cambium — a spinoff of Motorola) is unfriendly, in that the Option-82 circuit-id (i.e. Access Point) and remote-id (i.e. Subscriber Module) fields are binary representations of the respective network element’s MAC addresses. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[25,24,29,28,26,27,30],"class_list":["post-198","post","type-post","status-publish","format-standard","hentry","category-networking-tools","tag-bng","tag-bras","tag-cambium","tag-canopy","tag-dhcp","tag-dhcpd","tag-ipoe"],"_links":{"self":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts\/198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/comments?post=198"}],"version-history":[{"count":19,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts\/198\/revisions"}],"predecessor-version":[{"id":314,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/posts\/198\/revisions\/314"}],"wp:attachment":[{"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/media?parent=198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/categories?post=198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adamkuj.net\/blog\/wp-json\/wp\/v2\/tags?post=198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}