summaryrefslogtreecommitdiffstats
path: root/src/net/tcp
Commit message (Collapse)AuthorAgeFilesLines
* [build] Mark known reviewed files as permitted for UEFI Secure BootMichael Brown2026-01-143-0/+3
| | | | | | | | | Some past security reviews carried out for UEFI Secure Boot signing submissions have covered specific drivers or functional areas of iPXE. Mark all of the files comprising these areas as permitted for UEFI Secure Boot. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Mark core files as permitted for UEFI Secure BootMichael Brown2026-01-148-0/+8
| | | | | | | | | | | | Mark all files used in a standard build of bin-x86_64-efi/snponly.efi as permitted for UEFI Secure Boot. These files represent the core functionality of iPXE that is guaranteed to have been included in every binary that was previously subject to a security review and signed by Microsoft. It is therefore legitimate to assume that at least these files have already been reviewed to the required standard multiple times. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Abort connections after a long period of inactivityMichael Brown2025-12-041-1/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once an HTTP download has started (i.e. once all request headers have been sent), we generally have no more data to transmit. If an HTTP connection dies silently (e.g. due to a network failure, a NIC driver bug, or a server crash) then there is no mechanism that will currently detect this situation by default. We do send TCP keep-alives (to maintain state in intermediate routers and firewalls), but we do not attempt to elicit a response from the server. RFC 9293 explicitly states that the absence of a response to a TCP keep-alive probe must not be interpreted as indicating a dead connection, since TCP cannot guarantee reliable delivery of packets that do not advance the sequence number. Scripts may use the "--timeout" option to impose an overall time limit on downloads, but this mechanism is off by default and requires additional thought and configuration by the user (which goes against iPXE's general philosophy of being as automatic as possible). Add an idle connection watchdog timer which will cause the HTTP download to abort after 120 seconds of inactivity. Activity is defined as an I/O buffer being delivered to the HTTP transaction's upstream data transfer interface. Downloads over HTTPS may experience a substantial delay until the first recorded activity, since all TLS negotiation (including cross-chained certificate downloads and OCSP checks) must complete before any application data can be sent. We choose to not reset the watchdog timer during TLS negotiation, on the basis that 120 seconds is already an unreasonably long time for a TLS negotiation to take to complete. If necessary, resetting the watchdog timer could be accomplished by having the TLS layer deliver zero-length I/O buffers (via xfer_seek()) to indicate forward progress being made. When using PeerDist content encoding, the downloaded content information is not passed through to the content-decoded interface and so will not be classed as activity. Any activity in the individual PeerDist block downloads (either from peers or as range requests from the origin server) will be classed as activity in the overall download, since individual block downloads do not buffer data but instead pass it through directly via the PeerDist download multiplexer. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Rename connection retry timerMichael Brown2025-12-041-7/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uaccess] Remove redundant copy_from_user() and copy_to_user()Michael Brown2025-04-302-0/+2
| | | | | | | Remove the now-redundant copy_from_user() and copy_to_user() wrapper functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Remove userptr_t from block device abstractionMichael Brown2025-04-243-8/+6Star
| | | | | | | Simplify the block device code by assuming that all read/write buffers are directly accessible via pointer dereferences. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xfer] Use xfer_alloc_iob() for transmit I/O buffers on stream socketsMichael Brown2025-03-302-2/+3
| | | | | | | | | | | | | | | | | | Datagram sockets such as UDP, ICMP, and fibre channel tend to provide a custom xfer_alloc_iob() handler to ensure that transmit I/O buffers contain sufficient headroom to accommodate any required protocol headers. Stream sockets such as TCP and TLS do not typically provide a custom xfer_alloc_iob() handler at present. The default handler simply calls alloc_iob(), and so stream socket consumers can therefore get away with using alloc_iob() rather than xfer_alloc_iob(). Fix the HTTP and ONC RPC protocols to use xfer_alloc_iob() where relevant, in order to operate correctly if the underlying stream socket chooses to provide a custom xfer_alloc_iob() handler. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add error table entry for HTTP 404 Not Found errorMichael Brown2024-03-291-1/+2
| | | | | | | | Add an abbreviated "Not found" error message for an HTTP 404 status code, so that any automatic attempt to download a non-existent autoexec.ipxe script produces only a minimal error message. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [params] Allow for arbitrary HTTP request headers to be specifiedMichael Brown2023-03-011-9/+34
| | | | | | | | | | | Extend the request parameter mechanism to allow for arbitrary HTTP headers to be specified via e.g.: params param --header Referer http://www.example.com imgfetch http://192.168.0.1/script.ipxe##params Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Use POST method only if the form parameter list is non-emptyMichael Brown2023-03-011-44/+32Star
| | | | | | | | | | | | | An attempt to use an existent but empty form parameter list will currently result in an invalid POST request since the Content-Length header will be missing. Fix by using GET instead of POST if the form parameter list is empty. This is a non-breaking change (since the current behaviour produces an invalid request), and simplifies the imminent generalisation of the parameter list concept to handle both header and form parameters. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Limit maximum transfer size to MaxBurstLengthMichael Brown2023-02-161-4/+61
| | | | | | | | | | | | | | | | | We currently specify only the iSCSI default value for MaxBurstLength and ignore any negotiated value, since our internal block device API allows only for receiving directly into caller-allocated buffers and so we have no intrinsic limit on burst length. A conscientious target may however refuse to attempt a transfer that we request for a number of blocks that would exceed the negotiated maximum burst length. Fix by recording the negotiated maximum burst length and using it to limit the maximum number of blocks per transfer as reported by the SCSI layer. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uri] Retain original encodings for path, query, and fragment fieldsMichael Brown2021-11-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iPXE decodes any percent-encoded characters during the URI parsing stage, thereby allowing protocol implementations to consume the raw field values directly without further decoding. When reconstructing a URI string for use in an HTTP request line, the percent-encoding is currently reapplied in a reversible way: we guarantee that our reconstructed URI string could be decoded to give the same raw field values. This technically violates RFC3986, which states that "URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent". Experiments show that several HTTP server applications will attach meaning to the choice of whether or not a particular character was percent-encoded, even when the percent-encoding is unnecessary from the perspective of parsing the URI into its component fields. Fix by storing the originally encoded substrings for the path, query, and fragment fields and using these original encoded versions when reconstructing a URI string. The path field is also stored as a decoded string, for use by protocols such as TFTP that communicate using raw strings rather than URI-encoded strings. All other fields (such as the username and password) continue to be stored only in their decoded versions since nothing ever needs to know the originally encoded versions of these fields. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uri] Make URI schemes case-insensitiveMichael Brown2021-07-011-1/+2
| | | | | | | | | | | RFC 3986 section 3.1 defines URI schemes as case-insensitive (though the canonical form is always lowercase). Use strcasecmp() rather than strcmp() to allow for case insensitivity in URI schemes. Requested-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow private key to be specified as a TLS connection parameterMichael Brown2020-12-152-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x509] Record root of trust used when validating a certificateMichael Brown2020-12-082-2/+2
| | | | | | | | | | | | | Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Hide HTTP transport-layer filter implementation detailsMichael Brown2020-12-082-3/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use intf_insert() to add TLS to an interfaceMichael Brown2020-12-072-22/+21Star
| | | | | | | | | | Restructure the use of add_tls() to insert a TLS filter onto an existing interface. This allows for the possibility of using add_tls() to start TLS on an existing connection (as used in several protocols which will negotiate the choice to use TLS before the ClientHello is sent). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Allow iSCSI device to be described using an EFI device pathMichael Brown2020-10-201-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow HTTP connection to be described using an EFI device pathMichael Brown2020-10-191-0/+15
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Eliminate variable-length stack allocation in URI parsingMichael Brown2020-02-171-10/+28
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Eliminate variable-length stack allocations in CHAP handlersMichael Brown2020-02-171-11/+41
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Work around stateful authentication schemesMichael Brown2018-06-082-2/+19
| | | | | | | | | | | | | | | | As pointedly documented in RFC7230 section 2.3, HTTP is a stateless protocol: each request message can be understood in isolation from any other requests or responses. Various authentication schemes such as NTLM break this fundamental property of HTTP and rely on the same TCP connection being reused. Work around these broken authentication schemes by ensuring that the most recently pooled connection is reused for the subsequent authentication retry. Reported-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Tested-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Parse IPv6 address in root pathHannes Reinecke2018-03-011-1/+6
| | | | | | | | | The iSCSI root path may contain a literal IPv6 address. Update the parser to handle this address format correctly. Signed-off-by: Hannes Reinecke <hare@suse.de> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow for domain names within NTLM user namesMichael Brown2018-02-191-3/+22
| | | | | | | | | Allow a NetBIOS domain name to be specified within a URL using a syntax such as: http://domain%5Cusername:password@server/path Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Report unsuccessful response status lines at DBGVL_LOGMichael Brown2017-12-281-0/+2
| | | | | | | | The precise HTTP response status code is currently visible only at DBGLVL_EXTRA. Allow for easier debugging by reporting the whole status line at DBGLVL_LOG for any unsuccessful responses. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Include error messages for 4xx and 5xx response codesMichael Brown2017-12-281-0/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add support for NTLM authenticationMichael Brown2017-11-121-0/+201
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Handle parsing of WWW-Authenticate header within authentication schemeMichael Brown2017-11-123-67/+110
| | | | | | | Allow individual authentication schemes to parse WWW-Authenticate headers that do not comply with RFC2617. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Gracefully handle offers of multiple authentication schemesMichael Brown2017-11-121-3/+10
| | | | | | | | | | | | | | | | Servers may provide multiple WWW-Authenticate headers, each offering a different authentication scheme. We currently fail the request as soon as we encounter an unrecognised scheme, which prevents subsequent offers from succeeding. Fix by silently ignoring headers for schemes that we do not recognise. If no schemes are recognised then the request will eventually fail anyway due to the 401 response code. If multiple schemes are supported, arbitrarily choose the scheme appearing first within the response headers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Always send FirstBurstLength parameterMichael Brown2017-05-031-4/+10
| | | | | | | | | | | | | | | | | | | | As of kernel 4.11, the LIO target will propose a value for FirstBurstLength if the initiator did not do so. This is entirely redundant in our case, since FirstBurstLength is defined by RFC 3720 to be "Irrelevant when: ( InitialR2T=Yes and ImmediateData=No )" and we already enforce both InitialR2T=Yes and ImmediateData=No in our initial proposal. However, LIO (arguably correctly) complains when we do not respond to its redundant proposal of an already-irrelevant value. Fix by always proposing the default value for FirstBurstLength. Debugged-by: Patrick Seeburger <info@8bit.de> Tested-by: Patrick Seeburger <info@8bit.de> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Notify data transfer interface when underlying connection is readyMichael Brown2017-03-281-0/+3
| | | | | | | | | | | | | | HTTP implements xfer_window_changed() on the underlying server connection using http_step(), which does not propagate the window change notification to the data transfer interface. This breaks the multipath-capable SAN boot code, which relies on the window change notification to discover that the HTTP block device is ready for commands to be issued. Fix by sending xfer_window_changed() in http_step() once the underlying connection has been determined to be ready. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Describe all SAN devices via ACPI tablesMichael Brown2017-03-283-36/+13Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Describe all SAN devices via ACPI tables such as the iBFT. For tables that can describe only a single device (i.e. the aBFT and sBFT), one table is installed per device. For multi-device tables (i.e. the iBFT), all devices are described in a single table. An underlying SAN device connection may be closed at the time that we need to construct an ACPI table. We therefore introduce the concept of an "ACPI descriptor" which enables the SAN boot code to maintain an opaque pointer to the underlying object, and an "ACPI model" which can build tables from a list of such descriptors. This separates the lifecycles of ACPI descriptions from the lifecycles of the block device interfaces, and allows for construction of the ACPI tables even if the block device interface has been closed. For a multipath SAN device, iPXE will wait until sufficient information is available to describe all devices but will not wait for all paths to connect successfully. For example: with a multipath iSCSI boot iPXE will wait until at least one path has become available and name resolution has completed on all other paths. We do this since the iBFT has to include IP addresses rather than DNS names. We will commence booting without waiting for the inactive paths to either become available or close; this avoids unnecessary boot delays. Note that the Linux kernel will refuse to accept an iBFT with more than two NIC or target structures. We therefore describe only the NICs that are actually required in order to reach the described targets. Any iBFT with at most two targets is therefore guaranteed to describe at most two NICs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add missing check for memory allocation failureMichael Brown2017-03-211-0/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [nfs] Fix double free bug on error pathMichael Brown2017-03-211-6/+1Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Don't close when receiving NOP-InVishvananda Ishaya Abrams2017-03-091-9/+8Star
| | | | | | | | | | | Some iSCSI targets send NOP-In. Rather than closing the connection when we receive one, it is more user friendly to log a debug message and keep the connection open. Eventually, it would be nice if iPXE supported replying to NOP-Ins, but we might as well keep the connection open until the target disconnects us. Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Use intfs_shutdown() when shutting down multiple interfacesMichael Brown2017-03-091-4/+2Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Cleanly shut down potentially looped interfacesMichael Brown2017-02-021-15/+6Star
| | | | | | | | | | | | | Use intfs_shutdown() and intfs_restart() to cleanly shut down multiple interfaces that may loop back to the same object. This fixes a regression introduced by commit daa8ed9 ("[interface] Provide intf_reinit() to reinitialise nullified interfaces") which broke the use of HTTP Basic and Digest authentication. Reported-by: murmansk <murmansk@hotmail.com> Reported-by: Brett Waldo <brettwaldo@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Add ability to retrieve Google Compute Engine metadataMichael Brown2017-01-231-0/+72
| | | | | | | | | | | | | | | | | | | | | | | For some unspecified "security" reason, the Google Compute Engine metadata server will refuse any requests that do not include the non-standard HTTP header "Metadata-Flavor: Google". Attempt to autodetect such requests (by comparing the hostname against "metadata.google.internal"), and add the "Metadata-Flavor: Google" header if applicable. Enable this feature in the CONFIG=cloud build, and include a sample embedded script allowing iPXE to boot from a script configured as metadata via e.g. # Create shared boot image make bin/ipxe.usb CONFIG=cloud EMBED=config/cloud/gce.ipxe # Configure per-instance boot script gcloud compute instances add-metadata <instance> \ --metadata-from-file ipxeboot=boot.ipxe Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Avoid potential infinite loops during shutdownMichael Brown2016-11-171-0/+1
| | | | | | | | The command and data interfaces may be connected to the same object. Nullify the data interface before shutting down the control interface to avoid potential infinite loops. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Provide intf_reinit() to reinitialise nullified interfacesMichael Brown2016-11-161-4/+1Star
| | | | | | | Provide an abstraction intf_reinit() to restore the descriptor of a previously nullified interface. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Treat redirection failures as fatalMichael Brown2016-07-041-1/+10
| | | | | Debugged-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Accept headers with no whitespace following the colonMichael Brown2016-06-091-2/+6
| | | | | Reported-by: Raphael Cohn <raphael.cohn@stormmq.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Ignore unrecognised "Connection" header tokensMichael Brown2016-05-251-13/+11Star
| | | | | | | | | | Some HTTP/2 servers send the header "Connection: upgrade, close". This currently causes iPXE to fail due to the unrecognised "upgrade" token. Fix by ignoring any unrecognised tokens in the "Connection" header. Reported-by: Ján ONDREJ (SAL) <ondrejj@salstar.sk> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Handle relative redirection URIsMichael Brown2016-01-091-7/+46
| | | | | | | | Resolve redirection URIs as being relative to the original HTTP request URI, rather than treating them as being implicitly relative to the current working URI. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Verify server port when reusing a pooled connectionMichael Brown2015-10-021-7/+12
| | | | | | Reported-by: Allen <allen@gtf.org> Reported-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Re-add "uristring" setting typeMichael Brown2015-08-251-2/+2
| | | | | | | | | | | | | | | | | | | | Commit 09b057c ("[settings] Remove "uristring" setting type") removed support for URI-encoded settings via the "uristring" setting type, on the basis that such encoding was no longer necessary to avoid problems with the command line parser. Other valid use cases for the "uristring" setting type do exist: for example, a password containing a '/' character expanded via chain http://username:${password:uristring}@server.name/boot.php Restore the existence of the "uristring" setting, avoiding the potentially large stack allocations that were used in the old code prior to commit 09b057c ("[settings] Remove "uristring" setting type"). Requested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Rewrite HTTP core to support content encodingsMichael Brown2015-08-178-1241/+2480
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite the HTTP core to allow for the addition of arbitrary content encoding mechanisms, such as PeerDist and gzip. The core now exposes http_open() which can be used to create requests with an explicitly selected HTTP method, an optional requested content range, and an optional request body. A simple wrapper provides the preexisting behaviour of creating either a GET request or an application/x-www-form-urlencoded POST request (if the URI includes parameters). The HTTP SAN interface is now implemented using the generic block device translator. Individual blocks are requested using http_open() to create a range request. Server connections are now managed via a connection pool; this allows for multiple requests to the same server (e.g. for SAN blocks) to be completely unaware of each other. Repeated HTTPS connections to the same server can reuse a pooled connection, avoiding the per-connection overhead of establishing a TLS session (which can take several seconds if using a client certificate). Support for HTTP SAN booting and for the Basic and Digest authentication schemes is now optional and can be controlled via the SANBOOT_PROTO_HTTP, HTTP_AUTH_BASIC, and HTTP_AUTH_DIGEST build configuration options in config/general.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Add missing "break" statementsMichael Brown2015-07-281-0/+2
| | | | | | | | | | iscsi_tx_done() is missing "break" statements at the end of each case. (Fortunately, this happens not to cause a bug in practice, since iscsi_login_request_done() is effectively a no-op when completing a data-out PDU.) Reported-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [base64] Add buffer size parameter to base64_encode() and base64_decode()Michael Brown2015-04-242-2/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [base16] Add buffer size parameter to base16_encode() and base16_decode()Michael Brown2015-04-242-12/+16
| | | | | | | | | | | | | | The current API for Base16 (and Base64) encoding requires the caller to always provide sufficient buffer space. This prevents the use of the generic encoding/decoding functionality in some situations, such as in formatting the hex setting types. Implement a generic hex_encode() (based on the existing format_hex_setting()), implement base16_encode() and base16_decode() in terms of the more generic hex_encode() and hex_decode(), and update all callers to provide the additional buffer length parameter. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-06 02:39:18 +0100