summaryrefslogtreecommitdiffstats
path: root/src/net
Commit message (Collapse)AuthorAgeFilesLines
...
* [tcp] Defer sending ACKs until all received packets have been processedMichael Brown2014-05-121-8/+25
| | | | | | | | | | | | | | | | | | | | | When running inside a virtual machine (or when using the UNDI driver), transmitting packets can be expensive. When we receive several packets in one poll (e.g. because a slow BIOS timer interrupt routine has caused us to fall behind in processing), we can safely send just a single ACK to cover all of the received packets. This reduces the time spent transmitting and allows us to clear the backlog much faster. Various RFCs (starting with RFC1122) state that there should be an ACK for at least every second segment. We choose not to enforce this rule. Under normal operation each poll should find at most one received packet, and we will then not delay any ACKs. We delay (i.e. omit) ACKs only when under sufficiently heavy load that we are finding multiple packets per poll; under these conditions it is important to clear the backlog quickly since any delay may lead to dropped packets. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [nfs] Fix an invalid free() when loading a symlinkMarin Hannache2014-05-121-0/+11
| | | | | Signed-off-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Profile receive datapathMichael Brown2014-04-281-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Profile transmit and receive datapathsMichael Brown2014-04-281-0/+20
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Profile transmit and receive datapathsMichael Brown2014-04-281-0/+15
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Profile common operationsMichael Brown2014-04-281-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 cache to a full certificate storeMichael Brown2014-03-282-41/+35Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove dynamically-allocated storage for certificate OCSP URIMichael Brown2014-03-251-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove dynamically-allocated storage for certificate nameMichael Brown2014-03-252-11/+5Star
| | | | | | | | | | | | | | iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Accept Content-Length header with trailing whitespaceMichael Brown2014-03-251-1/+2
| | | | | | | At least one HTTP server (Google's OCSP responder) has been observed to generate a Content-Length header with trailing whitespace. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Notify upper-layer drivers when RX processing is (un)frozenMichael Brown2014-03-141-0/+28
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Automatically retry request on a 503 Service UnavailableMichael Brown2014-03-071-1/+45
| | | | | | | | | | | | | | | | | | A web server may return a 503 Service Unavailable response along with a Retry-After header to direct the client to retry the request at a later time. The Retry-After header may be a number of seconds, or a full HTTP timestamp (e.g. "Fri, 7 Mar 2014 17:22:14 GMT"). We have no reasonable way of parsing a full HTTP timestamp; if the server chooses to use this format then we simply retry after a fixed 5-second delay. As per RFC 2616, in the absence of a Retry-After header we treat a status code of 503 Service Unavailable as being equivalent to 500 Internal Server Error, and immediately fail the request. Requested-by: Suresh Sundriyal <ssundriy@vmware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Use a retry timer to trigger retried requestsMichael Brown2014-03-071-15/+44
| | | | | | | Use a retry timer to allow for the possibility of deferring a retried request. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Update window even if ACK does not acknowledge new dataMichael Brown2014-03-071-2/+4
| | | | | | | | | | | | | | | | | iPXE currently ignores ACKs which do not acknowledge any new data. (In particular, it does not stop the retransmission timer; this is done to prevent an immediate retransmission if a duplicate ACK is received while the transmit queue is non-empty.) If a peer provides a window size of zero and later sends a duplicate ACK to update the window size, this update will therefore be ignored and iPXE will never be able to transmit data. Fix by updating the window size even for ACKs which do not acknowledge new data. Reported-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Mark devices as open before calling open() methodMichael Brown2014-03-051-4/+8
| | | | | | | | | | | | | | | | | | | | | When opening a VLAN device, vlan_open() will call netdev_open() on the trunk device. This will result in a call to netdev_notify(), which will cause vlan_notify() to call vlan_sync() on the original VLAN device, which will see that the trunk device is now open but the VLAN device apparently isn't (since it has not yet been flagged as open by netdev_open()). The upshot is a second attempt to open the VLAN device, which will result in an erroneous second call to vlan_open(). This convoluted chain of events then terminates harmlessly since vlan_open() calls netdev_open() on the trunk device, which just returns immediately since the trunk device is by now flagged as being already open. Prevent this from happening by having netdev_open() flag the device as open prior to calling the device's open() method, and reflagging it as closed if the open() method fails. Originally-fixed-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Calculate correct MSS from peer addressMichael Brown2014-03-041-1/+14
| | | | | | | | | | | | | | | | | | | iPXE currently advertises a fixed MSS of 1460, which is correct only for IPv4 over Ethernet. For IPv6 over Ethernet, the value should be 1440 (allowing for the larger IPv6 header). For non-Ethernet link layers, the value should reflect the MTU of the underlying network device. Use tcpip_mtu() to calculate the transport-layer MTU associated with the peer address, and calculate the MSS to allow for an optionless TCP header as per RFC 6691. As a side benefit, we can now fail a connection immediately with a meaningful error message if we have no route to the destination address. Reported-by: Anton D. Kachalov <mouse@yandex-team.ru> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcpip] Provide tcpip_mtu() to determine the maximum transmission unitMichael Brown2014-03-043-0/+31
| | | | | | | | Provide the function tcpip_mtu() to allow external code to determine the (transport-layer) maximum transmission unit for a given socket address. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcpip] Provide tcpip_netdev() to determine the transmitting network deviceMichael Brown2014-03-043-10/+86
| | | | | | | Provide the function tcpip_netdev() to allow external code to determine the transmitting network device for a given socket address. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcpip] Add IP statistics collection as per RFC 4293Michael Brown2014-03-024-21/+102
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [uri] Refactor URI parsing and formattingMichael Brown2014-02-274-44/+65
| | | | | | | | | | | | | | | | | | | | | | | | Add support for parsing of URIs containing literal IPv6 addresses (e.g. "http://[fe80::69ff:fe50:5845%25net0]/boot.ipxe"). Duplicate URIs by directly copying the relevant fields, rather than by formatting and reparsing a URI string. This relaxes the requirements on the URI formatting code and allows it to focus on generating human-readable URIs (e.g. by not escaping ':' characters within literal IPv6 addresses). As a side-effect, this allows relative URIs containing parameter lists (e.g. "../boot.php##params") to function as expected. Add validity check for FTP paths to ensure that only printable characters are accepted (since FTP is a human-readable line-based protocol with no support for character escaping). Construct TFTP next-server+filename URIs directly, rather than parsing a constructed "tftp://..." string, Add self-tests for URI functions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Copy exactly the required length when resizing DHCP optionsMichael Brown2014-02-261-3/+1Star
| | | | | | | | | | | When resizing DHCP options, iPXE currently calculates the length to be copied by subtracting the destination pointer from the end of buffer pointer. This works and guarantees not to write beyond the end of the buffer, but may end up reading beyond the end of the buffer. Fix by calculating the required length exactly. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dns] Update end-of-name pointer after processing CNAME recordMichael Brown2014-02-261-2/+12
| | | | | | | | | | | | | | | | | | | | | Commit d4c0226 ("[dns] Support DNS search lists") introduced a regression when handling CNAME records resolving to names longer than the original name. The "end of name" offset stored in dns->offset was not updated to reflect the length of the new name, causing dns_question() to append the (empty) search suffix at an incorrect offset within the name buffer, resulting in a mangled DNS name. In the case of a CNAME record resolving to a name shorter than or equal in length to the original name, then the mangling would occur in an unused portion of the name buffer. In the common case of a name server returning the A (or AAAA) record along with the CNAME record, this would cause name resolution to succeed despite the mangling. (If the name server did not return the A or AAAA record along with the CNAME record, then the mangling would be revealed by the subsequent invalid query packet.) Reported-by: Nicolas Sylvain <nsylvain@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dns] Support DNS search listsMichael Brown2014-02-054-265/+723
| | | | | | | | | | | Update the DNS resolver to support DNS search lists (as provided by DHCP option 119, DHCPv6 option 24, or NDP option 31). Add validation code to ensure that parsing of DNS packets does not overrun the input, get stuck in infinite loops, or (worse) write beyond the end of allocated buffers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Expose NDP-provided settings (including the DNS server)Michael Brown2013-12-051-9/+197
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcpv6] Add DHCPv6 "filename" settingMichael Brown2013-12-051-0/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Merge SETTING_IPv4 and SETTING_IPv6Michael Brown2013-12-052-5/+5
| | | | | | | Allow for equivalent IPv4 and IPv6 settings (which requires equivalent settings to be adjacent within the settings list). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Force settings into alphabetical order within sectionsMichael Brown2013-12-0510-23/+30
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcpv6] Use DUID-UUID form of client DUIDMichael Brown2013-12-051-20/+21
| | | | | | Use the system UUID to generate the client DUID-UUID as per RFC 6355. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Add support for IPv6 syslog serverMichael Brown2013-12-052-17/+35
| | | | | | | | | | | Note that IANA has not yet assigned a DHCPv6 option code for the syslog server. When a code is assigned, the definition of DHCPV6_LOG_SERVERS should be updated. Until then, an IPv6 address of a syslog server can be configured manually using e.g. set syslog6 3ffe:302:11:2::8309 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dns] Add support for resolving IPv6 addresses via AAAA recordsMichael Brown2013-12-052-34/+103
| | | | | | | | Our policy is to prefer IPv6 addreses to IPv4 addresses, but to request IPv6 addresses only if we have an IPv6 address for the name server itself. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Allow for IPv6 setting types in non-IPv6 buildsMichael Brown2013-12-053-17/+52
| | | | | | | | | Allow for the existence of references to IPv6 setting types without dragging in the whole IPv6 stack, by placing the definition of setting_type_ipv6 in core/settings.c and providing weak stub methods for parse_ipv6_setting() and format_ipv6_setting(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Explicitly separate the concept of a completed fetched settingMichael Brown2013-12-0515-134/+88Star
| | | | | | | | | | The fetch_setting() family of functions may currently modify the definition of the specified setting (e.g. to add missing type information). Clean up this interface by requiring callers to provide an explicit buffer to contain the completed definition of the fetched setting, if required. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Allow console input and output to be disabled independentlyMichael Brown2013-11-282-4/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Pass escape sequence context to ANSI escape sequence handlersMichael Brown2013-11-272-2/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcpv6] Allow stateful DHCPv6 to apply obtained IPv6 addressesMichael Brown2013-11-151-6/+24
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Separate the concepts of prefix and address creationMichael Brown2013-11-152-118/+183
| | | | | | | | Allow for IPv6 routing table entries to be created for an on-link prefix where a local address has not yet been assigned to the network device. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcpv6] Add basic support for stateful and stateless DHCPv6Michael Brown2013-11-142-5/+991
| | | | | | | | | | | | Add support for the stateful and stateless variants of the DHCPv6 protocol. The resulting settings block is registered as "net<x>.dhcpv6", and DHCPv6 options can be obtained using e.g. "${net0.dhcpv6/23:ipv6}" to obtain the IPv6 DNS server address. IPv6 addresses obtained via stateful DHCPv6 are not yet applied to the network device. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Add "ipv6" setting typeMichael Brown2013-11-141-0/+53
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Use given source address only if it is not the unspecified addressMichael Brown2013-11-141-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Move user-class setting from dhcp.c to settings.cMichael Brown2013-11-141-8/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Add IPv6 network device configuratorMichael Brown2013-11-071-26/+217
| | | | | | | | | | Include IPv6 within the generic network device configurator mechanism. The IPv6 configurator will send a router solicitation and wait for a router advertisement to be received. (As per RFC4861 section 6.3.7, we do this even if advertisements have been received prior to sending the router solicitation.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Add DHCP network device configuratorMichael Brown2013-11-051-0/+6
| | | | | | | Provide an interface to DHCP via the generic network device configurator mechanism. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Add generic concept of a network device configuratorMichael Brown2013-11-051-5/+203
| | | | | | | | | | | | | | iPXE supports multiple mechanisms for network device configuration: DHCPv4 for IPv4, FIP for FCoE, and SLAAC for IPv6. At present, DHCPv4 requires an explicit action (e.g. a "dhcp" command), FIP is initiated implicitly upon opening a network device, and SLAAC takes place whenever a RA happens to be received. Add a generic concept of a network device configurator, which provides a common interface to triggering configuration and to reporting the result of the configuration process. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Make all net_driver methods optionalMichael Brown2013-11-014-40/+13Star
| | | | | | | | Most network upper-layer drivers do not implement all three methods (probe, notify, and remove). Save code by making all methods optional. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Add ndp_tx_router_solicitation() to send router solicitationsMichael Brown2013-10-252-33/+66
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pxe] Always retrieve cached DHCPACK and apply to relevant network deviceMichael Brown2013-10-252-104/+1Star
| | | | | | | | | | | | When chainloading, always retrieve the cached DHCPACK packet from the underlying PXE stack, and apply it as the original contents of the "net<X>.dhcp" settings block. This allows cached DHCP settings to be used for any chainloaded iPXE binary (not just undionly.kkpxe). This change eliminates the undocumented "use-cached" setting. Issuing the "dhcp" command will now always result in a fresh DHCP request. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Automatically choose source for link-local and multicast destinationsMichael Brown2013-10-251-30/+34
| | | | | | | | When transmitting to a link-local or multicast destination address, use the network device's link-local address as the source address if no explicit source address has been specified. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Treat sin6_scope_id consistentlyMichael Brown2013-10-252-5/+5
| | | | | | | sin6_scope_id is never exposed outside of the local system, and so should be a native-endian quantity. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Support stateless address autoconfiguration (SLAAC)Michael Brown2013-10-232-52/+159
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Extract link layer addresses from router advertisementsMichael Brown2013-10-231-47/+144
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-02-28 18:14:20 +0100