abrown38andClaude Opus 5.5
3ad2f981d4
- A subnet is a deny-list subnet (the default: everyone not denied) or
an allow-list subnet (only clients allowed or with a reservation);
the deny list counts in both. Entries are MAC addresses, prefixes
(aa:bb:cc:*) or client IDs. A refused client gets no answer (DENIED
in the activity log, with an Allow button) or a NAK on renewal.
steward access, the subnet's Access tab. Schema migration 7.
- The activity log keeps each message's header fields and options,
decoded into words (dhcp4.Describe): the parameter request list by
name, client IDs, lease times. ▸ on an Activity row, steward
activity show N / --details, GET /events/{id}.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
84 lines
4.8 KiB
Markdown
84 lines
4.8 KiB
Markdown
# Validation
|
|
|
|
Every change is checked as a whole configuration before it is saved. An
|
|
**error** stops the change; a **warning** is reported with it, and stays
|
|
on the dashboard and in `steward status` until fixed. Each problem has a
|
|
stable code, shown by the CLI as `[code]` and in the API as
|
|
`problems[].code`. `stewardd check` runs the checks on the saved
|
|
configuration.
|
|
|
|
The warnings marked *host* compare the configuration with this machine's
|
|
interfaces. They come from stewardd, not from a configuration on its own.
|
|
|
|
## Settings
|
|
|
|
| Code | | When |
|
|
|---|---|---|
|
|
| `lease_time_range` | error | a lease time (settings or subnet) under 1 minute or over 365 days |
|
|
| `ping_timeout_range` | error | the ping timeout isn't 50 to 5000 ms |
|
|
| `decline_hold_range` | error | the decline hold isn't 1 minute to 30 days |
|
|
| `address_order` | error | an address order (settings, subnet or pool) that isn't `sequential`, `reverse` or `random` |
|
|
|
|
## Options
|
|
|
|
These apply to options anywhere (settings, subnets, reservations).
|
|
|
|
| Code | | When |
|
|
|---|---|---|
|
|
| `option_code` | error | a number outside 1 to 254 |
|
|
| `option_reserved` | error | an option Steward sets itself, such as the lease time or the subnet mask ([options.md](options.md#options-steward-sets-itself)) |
|
|
| `option_duplicate` | error | the same option twice in one place |
|
|
| `option_invalid` | error | a value that doesn't fit the option's type (`dns.example` for `domain-name-servers`) |
|
|
|
|
## Subnets
|
|
|
|
| Code | | When |
|
|
|---|---|---|
|
|
| `subnet_prefix` | error | not an IPv4 network, or host bits set (`10.0.10.5/24`; the message gives the network) |
|
|
| `subnet_size` | error | shorter than /8 or longer than /30 |
|
|
| `subnet_overlap` | error | it overlaps another subnet |
|
|
| `subnet_name` | error | the name has spaces, slashes or commas |
|
|
| `subnet_name_taken` | error | another subnet has the name (names are compared without case) |
|
|
| `subnet_interface_missing` | error | no interface given |
|
|
| `subnet_interface_name` | error | not an interface name (over 15 characters, or spaces, `/` or `:`) |
|
|
| `subnet_no_pools` | warning | no pools: only clients with a reservation get addresses |
|
|
| `pool_invalid` | error | a pool that ends before it starts |
|
|
| `pool_outside_subnet` | error | a pool not inside the subnet |
|
|
| `pool_network_address` | error | a pool with the network or broadcast address |
|
|
| `pool_overlap` | error | two pools overlap |
|
|
| `pool_order` | error | a pool order that isn't `listed` or `random` |
|
|
| `router_outside_subnet` | warning | a `routers` address outside the subnet: clients can't reach it |
|
|
| `router_in_pool` | warning | a `routers` address inside a pool. The ping check keeps it from being handed out while it answers, but take it out of the pool |
|
|
| `interface_unknown` | warning, host | the interface doesn't exist on this machine. It is served once it appears |
|
|
| `interface_no_address` | warning, host | the interface has no address in the subnet. Clients renew with that address, so give it one |
|
|
| `pool_includes_server` | warning, host | a pool has the server's own address. It is never handed out, but take it out of the pool |
|
|
|
|
## Reservations
|
|
|
|
| Code | | When |
|
|
|---|---|---|
|
|
| `reservation_no_client` | error | neither a MAC address nor a client identifier |
|
|
| `reservation_ip` | error | not an IPv4 address |
|
|
| `reservation_no_subnet` | error | the address is in no subnet; add the subnet first |
|
|
| `reservation_network_address` | error | the network or broadcast address of its subnet |
|
|
| `reservation_ip_taken` | error | the address is reserved already |
|
|
| `reservation_client_taken` | error | the client has a reservation in this subnet already (one per subnet; a device on two VLANs may have one in each) |
|
|
| `reservation_denied` | warning | a reservation's client is on its subnet's deny list, so it gets no address |
|
|
| `access_mode` | error | a subnet's access is not `deny-list` or `allow-list` |
|
|
| `access_entry` | error | an allow or deny list entry that isn't a MAC address, a prefix (`aa:bb:cc:*`) or `id HEX` |
|
|
| `access_entry_duplicate` | error | an entry is on the same list twice |
|
|
| `allow_list_empty` | warning | an allow-list subnet with no allow list entries and no reservations: nobody gets an address |
|
|
| `reservation_hostname` | error | not a host name (letters, digits and `-`, labels up to 63 characters) |
|
|
| `reservation_server_address` | warning, host | the server's own address |
|
|
|
|
## Certificate
|
|
|
|
Not configuration problems, but shown with them on the dashboard and in
|
|
`steward status`, to administrators ([certificates.md](certificates.md)):
|
|
|
|
| Code | | When |
|
|
|---|---|---|
|
|
| `certificate_failed` | warning | the last attempt to get the web UI's certificate failed (the message says where) |
|
|
| `certificate_expiring` | warning | the certificate ends in less than 14 days and hasn't been renewed |
|
|
| `certificate_staging` | warning | the certificate is from Let's Encrypt's staging service, which browsers don't trust |
|