Release notes for dhcp-forwarder, version 0.4
=============================================
This program is used to forward DHCP and BOOTP messages between two
networks with different broadcast domains.
FEATURES
========
- runs as non-root in a chroot-environment
- uses AF_INET sockets to listen for DHCP messages. Thus, packetfilters
like iptables can be used to filter incoming messages
- supports DHCP agent IDs as described in RFC 3046. These IDs can be
defined freely.
- small memory-footprint:
| $ ./dhcp-fwd -v; ls -l dhcp-fwd; file dhcp-fwd
| dhcp-forwarder 0.3.3
| -rwxrwxr-x 1 ensc ensc 29368 Aug 29 15:59 dhcp-fwd
| dhcp-fwd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
| # ps hu `pidof dhcp-fwd`
| dhcp-fwd 3227 0.0 0.1 64 64 ? S 15:58 0:00 ./dhcp-fwd -c etc/dhcp-fwd.cfg
These numbers are the result of:
| $ ./configure --enable-release --enable-dietlibc --disable-logging
| $ make DIET='diet -Os' && strip dhcp-fwd ## dietlibc-0.20, gcc-3.2
INSTALLATION
============
- build with the usual './configure && make && make install'. When
not having an actual dietlibc, you will need to call ./configure
with a '--disable-dietlibc' option. *NOT* using this flag results
in significantly smaller binaries and memory consumption.
Old dietlibc versions (<0.17) are causing strange warnings while
compiling and I am not not sure if they are harmful or not. I am
running dhcp-fwd with dietlibc-0.17 successfully.
- create an user the daemon will setuid() to. Do not use 'nobody'; it
makes no sense to have running all important services as the 'nobody'
user...
- create a directory where the daemon will chroot to. This directory
should be created in the most secure manner; the daemon does not
access this directory so I suggest to make it unreadable, unwritable
and unaccessible for the user created before
- install contrib/dhcp-fwd.conf in $(sysconfdir)/ and adapt it to your
needs; the possible settings are described in this file.
An alternative cfg-file can be given on the commandline with the
'-c' option.
- start '$(sbindir)/dhcp-fwd'
If you are a RH 7.3 user, I suggest to build an RPM with
| rpm -tb dhcp-forwarder-0.1.tar.bz2 --without dietlibc'
and install the resulting binary. The '--without dietlibc' is neccessary
since RH ships an elder dietlibc. After installation, the daemon can be
started with
| service dhcp-fwd start
and enabled permanently with
| chkconfig dhcp-fwd on
BUGS
====
- bad behavior when serverside-interface has a smaller MTU than the
MTU on the server itself. An example is
[Server]-- Ethernet --[Router]-- PPP --[Forwarder]
(example is not completely correct since the program assumes an MTU
of 1500 or greater; but when server is on a special device (IPSec
VLAN??) a similar situation can occur)
- on client-side only ethernet supported; same holds on server-side if
server is a broadcast-address
- works with Linux only; the device-binding stuff is not specified by
SUSv3 and I do not know enough about other systems to provide a
better solution
- it does not set the agent-id on large DHCP-messages although it
would be possible to enlarge the package or to use the
bootfile/sname header-fields
- untested; particularly, I would like to get feedback about success
or failures in the following areas:
* cooperation within an IPv6 network or
* running on a big-endian host (will probably fail)
* IP fragmentation
SAMPLE CONFIGURATIONS
=====================
The contributed configfile contrib/dhcp-fwd.conf contains a sample
configuration for the real-world scenario described in its header:
-------------- ---------- -------------
| DHCP Server | | | | |
| 192.168.8.66 |------<eth1>| dhcp-fwd |<eth2>------| Clients |
| | | | | |
-------------- ---------- -------------
Additionally it has been tested successfully when running in the
following environment:
-------------- ---------- -------------
| DHCP Server | | | | |
| 192.168.8.66 |------<eth1>| Firewall |<eth2>------| Clients |
| | | | | |
-------------- ---------- | ~~~~~~ |
| |dhcp- | |
| | fwd | |
| ~~~~~~ |
-------------
The clients have a netmask of 192.168.0.0/255.255.248.0; the dhcp-fwd
itself has one interface with an IP of 192.168.0.6. Then I am using
the following core-configuration:
| if eth0 true true true
| name eth0 ws-c
| server ip 192.168.8.66
