9 ms·

Dora: A open-source Rust DHCP Server

126 points by ckdarby 4y ago

ckdarby 4y ago
Hey, I'm from BlueCat (though my opinions are my own). Will lurk the comments if there are any questions around the project or general DHCP.
- jarym 4y ago
  Looks cool, what was the motivation for writing another DHCP server - just for learning Rust or something else?
  - ckdarby 4y ago
    FYI /u/leshow is the core contributor of this project. We've been doing Rust before this. We've rewritten some of our core components over to Rust. Discussed a bit in this post: https://medium.techatscale.com/open-heart-surgery-from-java-to-rust-88d042ad43e7 https://medium.techatscale.com/open-heart-surgery-from-java-... In terms of writing a DHCP server there was research looking through Github, and the conclusion was that there is a gap in the DHCP space. DHCPd was approaching EOL (and now is EOL). Others in the DHCP industry were calling for options, and it looked like Dora could potentially fill some of those asks: https://ns1.com/blog/isc-dhcp-is-eol-what-will-replace-it https://ns1.com/blog/isc-dhcp-is-eol-what-will-replace-it
  - formerly_proven 4y ago
    I dunno about "another". After some issues with dnsmasq I went looking and there aren't actually a lot of open source DHCP servers. There's like dhcpd, dnsmasq and kea. (I actually contemplated writing my own dhcp server in Rust while debugging dnsmasq but felt like it's one of those real PITA kinds of projects. Managed to workaround whatever the dnsmasq problem was after a few hours.)
    - wyuenho 4y ago
      Depending on your use case CoreDNS may also be an option.
      - Already__Taken 4y ago
        is there a plugin to serve DHCP I've missed?
        wyuenho 4y ago
        https://github.com/nextdhcp/nextdhcp https://github.com/nextdhcp/nextdhcp
    - Already__Taken 4y ago
      was currently writing a rust cli that's called by an incantation of dnsmasq --script my_bin but it's a nightmare to debug.
- justsomehnguy 4y ago
  A couple of notes: If you can, add the support for CIDR style netmask (/8, /24 etc). Nothing wrong without it, but when you hop between them constantly mistakes happen. In the example.yaml you state what option 3 is required - but it's not. It is absolutely a valid way to run some network without providing a default router.[0] If this is somehow is really a requirement anywhere than that requirement should be removed. One of the things what I often use in MS DHCP is the server wide options, so some basic option values are configured on the server level and I add/override the needed ones on the scope level. PS while the name is amusing, it is a possible IP conflict there, especially since you clearly state you know about Dora. [0] And you can still provide the routign info through the option 121. Even for 0/0
  - leshow 4y ago
    > One of the things what I often use in MS DHCP is the server wide options The config format was created primarily to be easy to generate & consume programmatically, so the format is fully 'flattened' with no real abstraction. But this may be something we add later. It's also why the option format is the way it is. I'm sure we could make some improvements there to make hand writing easier. I appreciate your other suggestions, thanks for taking the time to look through things. I will have a look at both the router option and the CIDR input.
maltris 4y ago
Whats the motivation behind this and how does it compete with ISC DHCPd and Kea? I am operating a mid sized infrastructure using ISC DHCPd and plan on the long run to migrate to Kea for its API, Stork interface and convenience tools.
- jsiepkes 4y ago
  ISC DHCPD is end of life [1] and unlike Kea this server is written in a memory safe language (Rust). So from a security perspective alone that's enough motivation to start a project. [1] https://www.isc.org/dhcp/ https://www.isc.org/dhcp/
- ckdarby 4y ago
  I touch on this below: https://news.ycombinator.com/item?id=33895978 https://news.ycombinator.com/item?id=33895978 Wouldn't say Dora is competing. The project is in the early days and isn't feature parity to either. Some in the industry have voiced gaps & concerns that I reference in my comment.
WirelessGigabit 4y ago
I didn't look at the source code. I like dnsmasq for its flexibility. I understand it. It's great. But the learning curve is very steep. Which might be because of the options I wanted in a certain way. I'll look at this and see if it's more consistent. Also, if anyone knows a good device to use at home with router and switch (>4 ports) and ap that runs open source firmware... let me know. I don't like SRM on the Synology, and UniFi has gone the Apple way.
- ArchOversight 4y ago
  I use pfSense on a small firewall appliance that has 6 intel ethernet ports and then a AP from TP-Link that is only an AP (no dual function).
- hedgehog 4y ago
  Several people have recommended GL iNet routers (OpenWRT) but I haven't tried their gear myself yet.
  - m-p-3 4y ago
    I looked into it some time again and the shipping to Canada was at a significant premium, like half the cost of the device itself, and the models which were available on Amazon was a small sliver of their product range :(
- 0x0000000 4y ago
  Hard to go wrong with opnSense, it's open and very powerful and configurable. I run multiple VLANs, wireguard and OpenVPN, DHCP with some static IP mappings, dynamic DNS for my on-prem services, LACP for link aggregation to my core switch, multiple ISP connections with policy based routing (it's not as good as SD-WAN here but it's the best I've found that's open). Worth checking out, at the least.
sirjaz 4y ago
Anyone try this on Windows Server?
- ckdarby 4y ago
  I haven't, but I am currently running this on a raspberry pi using Ubuntu.
Go0the0gophers 4y ago
dora is for: Discover: first request broacasted by client in order to get lease (@ip and others configurations) Offer: response bradcasted by server with the lease (@ip and others configurations) Request: broacasted by the client in order to confirm the usage of this lease(from this server, others server can release other lease) Ack: ack from server
- leshow 4y ago
  Yup. Although, to be pedantic, the offer/ack is often unicast. Here's the relevant bit from the RFC. > If the 'giaddr' field in a DHCP message from a client is non-zero, the server sends any return messages to the 'DHCP server' port on the BOOTP relay agent whose address appears in 'giaddr'. If the 'giaddr' field is zero and the 'ciaddr' field is nonzero, then the server unicasts DHCPOFFER and DHCPACK messages to the address in 'ciaddr'. If 'giaddr' is zero and 'ciaddr' is zero, and the broadcast bit is set, then the server broadcasts DHCPOFFER and DHCPACK messages to 0xffffffff. If the broadcast bit is not set and 'giaddr' is zero and 'ciaddr' is zero, then the server unicasts DHCPOFFER and DHCPACK messages to the client's hardware address and 'yiaddr' address. In all cases, when 'giaddr' is zero, the server broadcasts any DHCPNAK messages to 0xffffffff.
agrabil 4y ago
[dead]
chaz6 4y ago
Something that is sorely missing from the FOSS world is a DHCPv6 server that supports RADIUS. The only one I am aware of that is considered production ready is Kea ($$$). FreeRADIUS has one in development but I do not know when it will be complete.
latchkey 4y ago
I have a datacenter with so many machines (blade computers) in it that dnsmasq couldn't keep up and we ended up having really bad UDP storms. That wasn't fun to debug at all since we had no idea that dnsmasq would have scaling issues like that. Even worse is that the logging output is abysmal and made things even harder to diagnose. Switched to another DHCP server and the storms went away, but I am not entirely happy with it because of the way it handles leases, it doesn't guarantee that each MAC keeps the same IP over time. Now, I'm always on the lookout for a good DHCP server... tried another one that was golang, but it wasn't working on my network for some weird spec reason, I didn't have time to debug it and the authors didn't seem that interested in helping out.
- ckdarby 4y ago
  We've done some basic benchmarking at +5k leases/second. If you want to go down the rabbit hole with us of looking at using Dora and giving us feedback I'd be glad to chat further cdarby[at]bluecatnetworks[dot]com
  - latchkey 4y ago
    Thanks. I've saved your project and if we are ever in the mood to switch, we will definitely give you a try first. Keep up the good work, you're solving a real problem.
- binkHN 4y ago
  If you don’t mind sharing/are able to share, what are your lease times?
  - latchkey 4y ago
    We don't expire.
- StreamBright 4y ago
  It would be great to have a better dnsmasq with sane config file, better logging, a simple statistics page and some more.
Already__Taken 4y ago
nice, there's definitely a space for some stateless DHCP server backed by netbox or something with a local cache for speed. selfishly hope to see it move. That way or at least facilitate. my gut says DHCP<>netbox<>coredns backed by vault for x509 could be pretty sweet

126 points by ckdarby 4y ago

Hey, I'm from BlueCat (though my opinions are my own). Will lurk the comments if there are any questions around the project or general DHCP.

jarym 4y ago
Looks cool, what was the motivation for writing another DHCP server - just for learning Rust or something else?
- ckdarby 4y ago
  FYI /u/leshow is the core contributor of this project. We've been doing Rust before this. We've rewritten some of our core components over to Rust. Discussed a bit in this post: https://medium.techatscale.com/open-heart-surgery-from-java-to-rust-88d042ad43e7 https://medium.techatscale.com/open-heart-surgery-from-java-... In terms of writing a DHCP server there was research looking through Github, and the conclusion was that there is a gap in the DHCP space. DHCPd was approaching EOL (and now is EOL). Others in the DHCP industry were calling for options, and it looked like Dora could potentially fill some of those asks: https://ns1.com/blog/isc-dhcp-is-eol-what-will-replace-it https://ns1.com/blog/isc-dhcp-is-eol-what-will-replace-it
- formerly_proven 4y ago
  I dunno about "another". After some issues with dnsmasq I went looking and there aren't actually a lot of open source DHCP servers. There's like dhcpd, dnsmasq and kea. (I actually contemplated writing my own dhcp server in Rust while debugging dnsmasq but felt like it's one of those real PITA kinds of projects. Managed to workaround whatever the dnsmasq problem was after a few hours.)
  - wyuenho 4y ago
    Depending on your use case CoreDNS may also be an option.
    - Already__Taken 4y ago
      is there a plugin to serve DHCP I've missed?
      - wyuenho 4y ago
        https://github.com/nextdhcp/nextdhcp https://github.com/nextdhcp/nextdhcp
  - Already__Taken 4y ago
    was currently writing a rust cli that's called by an incantation of dnsmasq --script my_bin but it's a nightmare to debug.
justsomehnguy 4y ago
A couple of notes: If you can, add the support for CIDR style netmask (/8, /24 etc). Nothing wrong without it, but when you hop between them constantly mistakes happen. In the example.yaml you state what option 3 is required - but it's not. It is absolutely a valid way to run some network without providing a default router.[0] If this is somehow is really a requirement anywhere than that requirement should be removed. One of the things what I often use in MS DHCP is the server wide options, so some basic option values are configured on the server level and I add/override the needed ones on the scope level. PS while the name is amusing, it is a possible IP conflict there, especially since you clearly state you know about Dora. [0] And you can still provide the routign info through the option 121. Even for 0/0
- leshow 4y ago
  > One of the things what I often use in MS DHCP is the server wide options The config format was created primarily to be easy to generate & consume programmatically, so the format is fully 'flattened' with no real abstraction. But this may be something we add later. It's also why the option format is the way it is. I'm sure we could make some improvements there to make hand writing easier. I appreciate your other suggestions, thanks for taking the time to look through things. I will have a look at both the router option and the CIDR input.

maltris 4y ago

Whats the motivation behind this and how does it compete with ISC DHCPd and Kea? I am operating a mid sized infrastructure using ISC DHCPd and plan on the long run to migrate to Kea for its API, Stork interface and convenience tools.

jsiepkes 4y ago
ISC DHCPD is end of life [1] and unlike Kea this server is written in a memory safe language (Rust). So from a security perspective alone that's enough motivation to start a project. [1] https://www.isc.org/dhcp/ https://www.isc.org/dhcp/
ckdarby 4y ago
I touch on this below: https://news.ycombinator.com/item?id=33895978 https://news.ycombinator.com/item?id=33895978 Wouldn't say Dora is competing. The project is in the early days and isn't feature parity to either. Some in the industry have voiced gaps & concerns that I reference in my comment.

WirelessGigabit 4y ago

I didn't look at the source code. I like dnsmasq for its flexibility. I understand it. It's great. But the learning curve is very steep. Which might be because of the options I wanted in a certain way. I'll look at this and see if it's more consistent. Also, if anyone knows a good device to use at home with router and switch (>4 ports) and ap that runs open source firmware... let me know. I don't like SRM on the Synology, and UniFi has gone the Apple way.

ArchOversight 4y ago
I use pfSense on a small firewall appliance that has 6 intel ethernet ports and then a AP from TP-Link that is only an AP (no dual function).
hedgehog 4y ago
Several people have recommended GL iNet routers (OpenWRT) but I haven't tried their gear myself yet.
- m-p-3 4y ago
  I looked into it some time again and the shipping to Canada was at a significant premium, like half the cost of the device itself, and the models which were available on Amazon was a small sliver of their product range :(
0x0000000 4y ago
Hard to go wrong with opnSense, it's open and very powerful and configurable. I run multiple VLANs, wireguard and OpenVPN, DHCP with some static IP mappings, dynamic DNS for my on-prem services, LACP for link aggregation to my core switch, multiple ISP connections with policy based routing (it's not as good as SD-WAN here but it's the best I've found that's open). Worth checking out, at the least.

sirjaz 4y ago

Anyone try this on Windows Server?

ckdarby 4y ago
I haven't, but I am currently running this on a raspberry pi using Ubuntu.

Go0the0gophers 4y ago

dora is for: Discover: first request broacasted by client in order to get lease (@ip and others configurations) Offer: response bradcasted by server with the lease (@ip and others configurations) Request: broacasted by the client in order to confirm the usage of this lease(from this server, others server can release other lease) Ack: ack from server

leshow 4y ago
Yup. Although, to be pedantic, the offer/ack is often unicast. Here's the relevant bit from the RFC. > If the 'giaddr' field in a DHCP message from a client is non-zero, the server sends any return messages to the 'DHCP server' port on the BOOTP relay agent whose address appears in 'giaddr'. If the 'giaddr' field is zero and the 'ciaddr' field is nonzero, then the server unicasts DHCPOFFER and DHCPACK messages to the address in 'ciaddr'. If 'giaddr' is zero and 'ciaddr' is zero, and the broadcast bit is set, then the server broadcasts DHCPOFFER and DHCPACK messages to 0xffffffff. If the broadcast bit is not set and 'giaddr' is zero and 'ciaddr' is zero, then the server unicasts DHCPOFFER and DHCPACK messages to the client's hardware address and 'yiaddr' address. In all cases, when 'giaddr' is zero, the server broadcasts any DHCPNAK messages to 0xffffffff.

agrabil 4y ago

[dead]

chaz6 4y ago

Something that is sorely missing from the FOSS world is a DHCPv6 server that supports RADIUS. The only one I am aware of that is considered production ready is Kea ($$$). FreeRADIUS has one in development but I do not know when it will be complete.

latchkey 4y ago

I have a datacenter with so many machines (blade computers) in it that dnsmasq couldn't keep up and we ended up having really bad UDP storms. That wasn't fun to debug at all since we had no idea that dnsmasq would have scaling issues like that. Even worse is that the logging output is abysmal and made things even harder to diagnose. Switched to another DHCP server and the storms went away, but I am not entirely happy with it because of the way it handles leases, it doesn't guarantee that each MAC keeps the same IP over time. Now, I'm always on the lookout for a good DHCP server... tried another one that was golang, but it wasn't working on my network for some weird spec reason, I didn't have time to debug it and the authors didn't seem that interested in helping out.

ckdarby 4y ago
We've done some basic benchmarking at +5k leases/second. If you want to go down the rabbit hole with us of looking at using Dora and giving us feedback I'd be glad to chat further cdarby[at]bluecatnetworks[dot]com
- latchkey 4y ago
  Thanks. I've saved your project and if we are ever in the mood to switch, we will definitely give you a try first. Keep up the good work, you're solving a real problem.
binkHN 4y ago
If you don’t mind sharing/are able to share, what are your lease times?
- latchkey 4y ago
  We don't expire.
StreamBright 4y ago
It would be great to have a better dnsmasq with sane config file, better logging, a simple statistics page and some more.

Already__Taken 4y ago

nice, there's definitely a space for some stateless DHCP server backed by netbox or something with a local cache for speed. selfishly hope to see it move. That way or at least facilitate. my gut says DHCP<>netbox<>coredns backed by vault for x509 could be pretty sweet