summaryrefslogtreecommitdiffstats
path: root/src/net
Commit message (Collapse)AuthorAgeFilesLines
* [http] Work around stateful authentication schemesMichael Brown2018-06-082-2/+19
| | | | | | | | | | | | | | | | As pointedly documented in RFC7230 section 2.3, HTTP is a stateless protocol: each request message can be understood in isolation from any other requests or responses. Various authentication schemes such as NTLM break this fundamental property of HTTP and rely on the same TCP connection being reused. Work around these broken authentication schemes by ensuring that the most recently pooled connection is reused for the subsequent authentication retry. Reported-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Tested-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Ensure that window change is propagated to plainstream interfaceMichael Brown2018-03-241-2/+7
| | | | | | | | | | | | | | | | The cipherstream xfer_window_changed() message is used to retrigger the TLS transmit state machine. If the transmit state machine is idle, then the window change message will not be propagated to the plainstream interface. This can potentially cause the plainstream interface peer (e.g. httpcore) to block waiting for a window change message that will never arrive. Fix by ensuring that the window change message is propagated to the plainstream interface if the transmit state machine is idle. (If the transmit state machine is not idle then the plainstream window will be zero anyway.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Rename tls_session to tls_connectionMichael Brown2018-03-241-119/+123
| | | | | | | | | | | | In TLS terminology a session conceptually spans multiple individual connections, and essentially represents the stored cryptographic state (master secret and cipher suite) required to establish communication without going through the certificate and key exchange handshakes. Rename tls_session to tls_connection in order to make the name tls_session available to represent the session state. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Ensure received data list is initialised before calling tls_free()Michael Brown2018-03-231-3/+3
| | | | | | | | | | | A failure in tls_generate_random() will result in a call to ref_put() before the received data list has been initialised, which will cause free_tls() to attempt to traverse an uninitialised list. Fix by ensuring that all fields referenced by free_tls() are initialised before any of the potential failure paths. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Check the partner's own state when checking for blocked linksMichael Brown2018-03-191-4/+4
| | | | | | | | The blocked link test in eth_slow_lacp_rx() is performed before the actor TLV is copied to the partner TLV, and so must test the actor state field rather than the partner state field. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Centralise test for whether or not an OCSP check is requiredMichael Brown2018-03-181-2/+1Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tftp] Prevent potential division by zeroMichael Brown2018-03-181-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Fix debug message to match documentationMichael Brown2018-03-181-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Mark link as blocked if partner is not yet up and runningMichael Brown2018-03-181-0/+22
| | | | | | | | | | | | Mark the link as blocked if the LACP partner is not reporting itself as being in sync, collecting, and distributing. This matches the behaviour for STP: we mark the link as blocked if we detect that the switch is actively blocking traffic, in order to extend the DHCP discovery period and so prevent boot failures on switches that take an excessively long time to enable ports. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Parse IPv6 address in root pathHannes Reinecke2018-03-011-1/+6
| | | | | | | | | The iSCSI root path may contain a literal IPv6 address. Update the parser to handle this address format correctly. Signed-off-by: Hannes Reinecke <hare@suse.de> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow for domain names within NTLM user namesMichael Brown2018-02-191-3/+22
| | | | | | | | | Allow a NetBIOS domain name to be specified within a URL using a syntax such as: http://domain%5Cusername:password@server/path Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Make netdev_irq_enabled() independent of netdev_irq_supported()Martin Habets2018-01-141-6/+3Star
| | | | | | | | | | | | | | | | | | The UNDI layer uses the NETDEV_IRQ_ENABLED flag to choose whether to return PXENV_UNDI_ISR_OUT_OURS or PXENV_UNDI_ISR_OUT_NOT_OURS for a given interrupt. For a network device that does not support interrupts, the flag will never be set and so pxenv_undi_isr() will always return PXENV_UNDI_ISR_OUT_NOT_OURS. This causes some NBPs (such as lpxelinux.0) to hang. Redefine NETDEV_IRQ_ENABLED as a simple administrative flag which can be set even on network devices that do not support interrupts. This allows pxenv_undi_isr() (which is the sole user of NETDEV_IRQ_ENABLED) to function as expected by lpxelinux.0. Signed-off-by: Martin Habets <mhabets@solarflare.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Report unsuccessful response status lines at DBGVL_LOGMichael Brown2017-12-281-0/+2
| | | | | | | | The precise HTTP response status code is currently visible only at DBGLVL_EXTRA. Allow for easier debugging by reporting the whole status line at DBGLVL_LOG for any unsuccessful responses. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Include error messages for 4xx and 5xx response codesMichael Brown2017-12-281-0/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add support for NTLM authenticationMichael Brown2017-11-121-0/+201
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Handle parsing of WWW-Authenticate header within authentication schemeMichael Brown2017-11-123-67/+110
| | | | | | | Allow individual authentication schemes to parse WWW-Authenticate headers that do not comply with RFC2617. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Gracefully handle offers of multiple authentication schemesMichael Brown2017-11-121-3/+10
| | | | | | | | | | | | | | | | Servers may provide multiple WWW-Authenticate headers, each offering a different authentication scheme. We currently fail the request as soon as we encounter an unrecognised scheme, which prevents subsequent offers from succeeding. Fix by silently ignoring headers for schemes that we do not recognise. If no schemes are recognised then the request will eventually fail anyway due to the 401 response code. If multiple schemes are supported, arbitrarily choose the scheme appearing first within the response headers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Fail fast if cross-certificate source is emptyLadi Prosek2017-09-241-0/+5
| | | | | | | | | | | | In fully self-contained deployments it may be desirable to build iPXE with an empty CROSSCERT source to avoid talking to external services. Add an explicit check for this case and make validator_start_download fail immediately if the base URI is empty. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dns] Ensure DNS names are NUL-terminated when used as diagnostic stringsMichael Brown2017-09-071-3/+9
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dns] Report current DNS query as job progress status messageMichael Brown2017-09-061-0/+18
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Add "hwaddr" settingMichael Brown2017-09-061-5/+30
| | | | | | | | Expose the underlying hardware address as a setting. For IPoIB devices, this provides scripts with access to the Infiniband GUID. Requested-by: Allen, Benjamin S. <bsallen@alcf.anl.gov> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Gather and report peer statistics during downloadMichael Brown2017-09-063-0/+95
| | | | | | | | | Record and report the number of peers (calculated as the maximum number of peers discovered for a block's segment at the time that the block download is complete), and the percentage of blocks retrieved from peers rather than from the origin server. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Cancel all pending transmissions on any transmit errorMichael Brown2017-09-051-3/+16
| | | | | | | | | | | | | | | | | | | | | Some external code (such as the UEFI UNDI driver for the Realtek USB NIC on a Microsoft Surface Book) will block during transmission attempts and can take several seconds to report a transmit error. If there is a large queue of pending transmissions, then the accumulated time from a series of such failures can easily exceed the EFI watchdog timeout, resulting in what appears to be a system lockup followed by a reboot. Work around this problem by immediately cancelling any pending transmissions as soon as any transmit error occurs. The only expected transmit error under normal operation is ENOBUFS arising when the hardware transmit queue is full. By definition, this can happen only for drivers that do not utilise deferred transmissions, and so this new behaviour will not affect these drivers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support RFC5746 secure renegotiationMichael Brown2017-07-041-19/+188
| | | | | | | Support renegotiation with servers supporting RFC5746. This allows for the use of per-directory client certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Keep cipherstream window open until TLS negotiation is completeMichael Brown2017-05-221-0/+16
| | | | | | | | | | | | | | | | When performing a SAN boot, the plainstream window size will be zero (since this is the mechanism used internally to indicate that no data should be fetched via the initial request). This zero value currently propagates to the advertised TCP window size, which prevents the TLS negotiation from completing. Fix by ensuring that the cipherstream window is held open until TLS negotiation is complete, and only then falling back to passing through the plainstream window size. Reported-by: John Wigley <johnwigley#ipxe@acorna.co.uk> Tested-by: John Wigley <johnwigley#ipxe@acorna.co.uk> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Always send FirstBurstLength parameterMichael Brown2017-05-031-4/+10
| | | | | | | | | | | | | | | | | | | | As of kernel 4.11, the LIO target will propose a value for FirstBurstLength if the initiator did not do so. This is entirely redundant in our case, since FirstBurstLength is defined by RFC 3720 to be "Irrelevant when: ( InitialR2T=Yes and ImmediateData=No )" and we already enforce both InitialR2T=Yes and ImmediateData=No in our initial proposal. However, LIO (arguably correctly) complains when we do not respond to its redundant proposal of an already-irrelevant value. Fix by always proposing the default value for FirstBurstLength. Debugged-by: Patrick Seeburger <info@8bit.de> Tested-by: Patrick Seeburger <info@8bit.de> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Notify data transfer interface when underlying connection is readyMichael Brown2017-03-281-0/+3
| | | | | | | | | | | | | | HTTP implements xfer_window_changed() on the underlying server connection using http_step(), which does not propagate the window change notification to the data transfer interface. This breaks the multipath-capable SAN boot code, which relies on the window change notification to discover that the HTTP block device is ready for commands to be issued. Fix by sending xfer_window_changed() in http_step() once the underlying connection has been determined to be ready. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [block] Describe all SAN devices via ACPI tablesMichael Brown2017-03-286-120/+180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Describe all SAN devices via ACPI tables such as the iBFT. For tables that can describe only a single device (i.e. the aBFT and sBFT), one table is installed per device. For multi-device tables (i.e. the iBFT), all devices are described in a single table. An underlying SAN device connection may be closed at the time that we need to construct an ACPI table. We therefore introduce the concept of an "ACPI descriptor" which enables the SAN boot code to maintain an opaque pointer to the underlying object, and an "ACPI model" which can build tables from a list of such descriptors. This separates the lifecycles of ACPI descriptions from the lifecycles of the block device interfaces, and allows for construction of the ACPI tables even if the block device interface has been closed. For a multipath SAN device, iPXE will wait until sufficient information is available to describe all devices but will not wait for all paths to connect successfully. For example: with a multipath iSCSI boot iPXE will wait until at least one path has become available and name resolution has completed on all other paths. We do this since the iBFT has to include IP addresses rather than DNS names. We will commence booting without waiting for the inactive paths to either become available or close; this avoids unnecessary boot delays. Note that the Linux kernel will refuse to accept an iBFT with more than two NIC or target structures. We therefore describe only the NICs that are actually required in order to reach the described targets. Any iBFT with at most two targets is therefore guaranteed to describe at most two NICs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Use correct length for memset()Michael Brown2017-03-221-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Return status code from ib_create_mi()Michael Brown2017-03-222-14/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Return status code from ib_create_cq() and ib_create_qp()Michael Brown2017-03-223-40/+45
| | | | | | | | | | | | Any underlying errors arising during ib_create_cq() or ib_create_qp() are lost since the functions simply return NULL on error. This makes debugging harder, since a debug-enabled build is required to discover the root cause of the error. Fix by returning a status code from these functions, thereby allowing any underlying errors to be propagated. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Add missing check for memory allocation failureMichael Brown2017-03-211-0/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [slam] Avoid NULL pointer dereference in slam_pull_value()Michael Brown2017-03-211-5/+9
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [slam] Fix resource leak on error pathMichael Brown2017-03-211-4/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Remove redundant NULL pointer check after dereferenceMichael Brown2017-03-211-3/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [nfs] Fix double free bug on error pathMichael Brown2017-03-211-6/+1Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Allow vendor class to be changed in DHCP requestsMichael Brown2017-03-201-11/+23
| | | | | | | Allow the DHCPv4 vendor class to be specified via the "vendor-class" setting. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Don't close when receiving NOP-InVishvananda Ishaya Abrams2017-03-091-9/+8Star
| | | | | | | | | | | Some iSCSI targets send NOP-In. Rather than closing the connection when we receive one, it is more user friendly to log a debug message and keep the connection open. Eventually, it would be nice if iPXE supported replying to NOP-Ins, but we might as well keep the connection open until the target disconnects us. Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Use intfs_shutdown() when shutting down multiple interfacesMichael Brown2017-03-091-4/+2Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Cleanly shut down potentially looped interfacesMichael Brown2017-02-021-15/+6Star
| | | | | | | | | | | | | Use intfs_shutdown() and intfs_restart() to cleanly shut down multiple interfaces that may loop back to the same object. This fixes a regression introduced by commit daa8ed9 ("[interface] Provide intf_reinit() to reinitialise nullified interfaces") which broke the use of HTTP Basic and Digest authentication. Reported-by: murmansk <murmansk@hotmail.com> Reported-by: Brett Waldo <brettwaldo@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Allow timer to be selected at runtimeMichael Brown2017-01-263-6/+6
| | | | | | | | | | | | | | | | | | | | | | Allow the active timer (providing udelay() and currticks()) to be selected at runtime based on probing during the INIT_EARLY stage of initialisation. TICKS_PER_SEC is now a fixed compile-time constant for all builds, and is independent of the underlying clock tick rate. We choose the value 1024 to allow multiplications and divisions on seconds to be converted to bit shifts. TICKS_PER_MS is defined as 1, allowing multiplications and divisions on milliseconds to be omitted entirely. The 2% inaccuracy in this definition is negligible when using the standard BIOS timer (running at around 18.2Hz). TIMER_RDTSC now checks for a constant TSC before claiming to be a usable timer. (This timer can be tested in KVM via the command-line option "-cpu host,+invtsc".) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Limit MTU by hardware maximum frame lengthMichael Brown2017-01-254-9/+23
| | | | | | | | | | | | | | | | Separate out the concept of "hardware maximum supported frame length" and "configured link MTU", and limit the latter according to the former. In networks where the DHCP-supplied link MTU is inconsistent with the hardware or driver capabilities (e.g. a network using jumbo frames), this will result in iPXE advertising a TCP MSS consistent with a size that can actually be received. Note that the term "MTU" is typically used to refer to the maximum length excluding the link-layer headers; we adopt this usage. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Allow MTU to be changed at runtimeMichael Brown2017-01-232-3/+64
| | | | | | | | | | | | Provide a settings applicator to modify netdev->max_pkt_len in response to changes to the "mtu" setting (DHCP option 26). Note that as with MAC address changes, drivers are permitted to completely ignore any changes in the MTU value. The net result will be that iPXE effectively uses the smaller of either the hardware default MTU or the software configured MTU. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [cloud] Add ability to retrieve Google Compute Engine metadataMichael Brown2017-01-231-0/+72
| | | | | | | | | | | | | | | | | | | | | | | For some unspecified "security" reason, the Google Compute Engine metadata server will refuse any requests that do not include the non-standard HTTP header "Metadata-Flavor: Google". Attempt to autodetect such requests (by comparing the hostname against "metadata.google.internal"), and add the "Metadata-Flavor: Google" header if applicable. Enable this feature in the CONFIG=cloud build, and include a sample embedded script allowing iPXE to boot from a script configured as metadata via e.g. # Create shared boot image make bin/ipxe.usb CONFIG=cloud EMBED=config/cloud/gce.ipxe # Configure per-instance boot script gcloud compute instances add-metadata <instance> \ --metadata-from-file ipxeboot=boot.ipxe Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Return const char * from uuid_ntoa()David Decotigny2017-01-221-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Accept unicast packets for the local network broadcast addressMichael Brown2017-01-221-0/+1
| | | | | | | | | | | | | The ISC Kea DHCP server transmits its DHCPOFFER as a unicast packet with a broadcast IPv4 destination address (255.255.255.255). This combination is currently rejected by iPXE. Fix by explicitly accepting the local network broadcast address (255.255.255.255) as a valid unicast destination address. Reported-by: Roy Ledochowski <roy.ledochowski@hpe.com> Tested-by: Roy Ledochowski <roy.ledochowski@hpe.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Avoid potential infinite loops during shutdownMichael Brown2016-11-171-0/+1
| | | | | | | | The command and data interfaces may be connected to the same object. Nullify the data interface before shutting down the control interface to avoid potential infinite loops. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Provide intf_reinit() to reinitialise nullified interfacesMichael Brown2016-11-161-4/+1Star
| | | | | | | Provide an abstraction intf_reinit() to restore the descriptor of a previously nullified interface. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown2016-08-251-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Allow for multiple routersMichael Brown2016-07-251-49/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Select the IPv6 source address and corresponding router (if any) using a very simplified version of the algorithm from RFC6724: - Ignore any source address that has a smaller scope than the destination address. For example, do not use a link-local source address when sending to a global destination address. - If we have a source address which is on the same link as the destination address, then use that source address. - If we are left with multiple possible source addresses, then choose the address with the smallest scope. For example, if we are sending to a site-local destination address and we have both a global source address and a site-local source address, then use the site-local source address. - If we are still left with multiple possible source addresses, then choose the address with the longest matching prefix. For the purposes of this algorithm, we treat RFC4193 Unique Local Addresses as having organisation-local scope. Since we use only link-local scope for our multicast transmissions, this approximation should remain valid in all practical situations. Originally-implemented-by: Thomas Bächler <thomas@archlinux.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-06-15 21:06:35 +0200