Skip to content

Natolumin/dhcpsnoopd

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

21 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Pluggable DHCPv6 snooping for linux

This is a dhcp snooping daemon for linux, which makes use of nflog

You need to intercept DHCPv6 traffic and redirect it to nflog in your firewall, for example :

nft add rule inet filter meta nfproto ipv6 udp sport 547 log group 8

Then, you run dhcpsnoopd with the nflog group number and the path to a hook library: dhcpsnoopd 2 routehook.so

Requirements

  • Kernel > 3.8 (There were some changes to nfnetlink and I don't have one anymore to try to support that)
  • Kernel >= 4.4 if you want to use the default rt hook, which uses the ipv6 expiry option for routes

Libraries

(It might work with older versions, but I haven't tested it)

  • libmnl >= 1.0.4
  • libkea-dhcp++ >= 5.0.0 (kea 1.2)
  • Boost >= 1.44 (for Kea)

Provided hooks

  • print_hook: Simply prints the packet out using the standard kea representation
  • route_hook: Parses prefix delegation responses and adds routes in the kernel to allow routing to the prefixes that are delegated
  • duid_hook: Records a mapping between mac address and DUID, for example to use in reservations. When using dhcp with a relay, this should be more reliable than the builtin detections in kea when privacy link-level addresses are used.

About

A pluggable DHCPv6 snooping daemon

Resources

License

Stars

Watchers

Forks

Packages

No packages published