KEA reservations bug

[jameskimmel]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

KEA loses its previously working IPv4 DHCPv4 reservation when a DHCPv6 reservation is added.

To Reproduce

Steps to reproduce the behavior:

1. Create a fresh Ubuntu 26.04 VM on Proxmox and boot it
2. Have RA set to "assisted"
3. VM will get DHCP assigned IPv4 and three IPv6
4. Go to IPv4 leases and add a static reservation based on MAC
5. Reconnect VM network
6. VM gets static IPv4
7. Go to IPv6 leases and add a static reservation based on MAC
8. Reconnect VM network
9. VM gets static IPv6, but now loses the static IPv4 lease and get a dynamic instead

Expected behavior
Have working IPv4 and IPv6 reservations.

Environment
OPNsense 26.1.7_3-amd64

[Monviech]

https://kb.isc.org/docs/what-are-host-reservations-how-to-use-them

Since the configuration files for dhcpv4 and dhcpv6 generate reservations inside the subnet level scope
Subnet-level: .Dhcp[46].subnet[46][].reservations it should serve both reservations.

If it does not, and there is no explanation inside the generated configuration files, it sounds like an upstream bug.

Also, that DUID does not exist in a DHCPv6 lease right now was a small regression that was fixed here:
#10203

[dseven]

Just to check - for the IPv4 subnet in question, you have unchecked "Match client-id" (advanced options)?

A look at /usr/local/etc/kea/kea-dhcp4.conf and the output from the following command (substitute the MAC address in question) might be enlightening:

echo '{ "command": "lease4-get-by-hw-address", "arguments": { "hw-address": "aa:bb:cc:dd:ee:ff" } }' | socat - UNIX-CONNECT:/var/run/kea/kea4-ctrl-socket | jq

What exactly does "reconnect the VM network" mean? i.e. what specific steps are you doing to effect that?

I suspect that it's not the addition of the v6 reservation, but the second request for a v4 lease that's triggering the issue.

[dseven]

Also, that DUID does not exist in a DHCPv6 lease right now was a small regression that was fixed here:
#10203

Along these lines, I would suggest that you also collect and display the client-id for v4 leases, since it does matter, and can lead to confusion like this issue (Kea won't offer a lease for a reserved address if there's already a lease for it using a different client-id even though the hw-address matches).

[Monviech]

I want a ticket for client-id reservation handling.

[jameskimmel]

This is way above my paygrade, but I will try to help as good as I can.
Tell me if you need more output from me please.

So, I really don't know what has changed in the meantime, but today when I booted the VM up to run the tests for you, all of a sudden the IPv4 and & IPv6 reservations are working perfectly fine. Only thing I can imagine that has changed, is that a lease disaspeared because it got invalid.

Just to check - for the IPv4 subnet in question, you have unchecked "Match client-id" (advanced options)?

Where is that option? I can't find it.

A look at /usr/local/etc/kea/kea-dhcp4.conf and the output from the following command (substitute the MAC address in question) might be enlightening:

Sure:

{
  "arguments": {
    "leases": [
      {
        "client-id": "01:bc...",
        "cltt": 1778...,
        "fqdn-fwd": false,
        "fqdn-rev": false,
        "hostname": "openproject",
        "hw-address": "bc:24...",
        "ip-address": "10.0.60.3",
        "state": 0,
        "subnet-id": 1,
        "valid-lft": 86400
      }
    ]
  },
  "result": 0,
  "text": "1 IPv4 lease(s) found."`

What exactly does "reconnect the VM network" mean? i.e. what specific steps are you doing to effect that?

On proxmox, change the NIC to disconnected, then back to connected. Basically like unplugging and reinserting a real cable.

I want a ticket for client-id reservation handling.

Sorry, I don't understand.

[dseven]

Where is that option? I can't find it.

If you turn that off, MAC-based reservations should work more consistently for you.

[dseven]

I want a ticket for client-id reservation handling.

I'll work on this. I have some other ideas too.

[Monviech]

@dseven Sure, I would just do feature parity to dnsmasq in that regard where this issue has already been solved (also by me xD)