aboutsummaryrefslogtreecommitdiff
path: root/net
AgeCommit message (Collapse)AuthorFilesLines
2023-04-07net: phy: Only call phy_init() on systems needing manual relocationMarek Vasut1-1/+1
The phy_init() is now used only to perform manual relocation of PHY driver callbacks. Wrap it in ifdeffery and only call it on systems which still require manual relocation, i.e. m68k . Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Acked-by: Michal Simek <michal.simek@amd.com> Tested-by: Michal Simek <michal.simek@amd.com> #microblaze (MANUAL_RELOC)
2023-03-30net: Pull board_interface_eth_init() into common codeMarek Vasut1-0/+7
Move the board_interface_eth_init() into common ethernet uclass code, since this function could be shared by multiple drivers. Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Marek Vasut <marex@denx.de>
2023-03-02Correct SPL uses of PHY_FIXEDSimon Glass1-1/+1
This converts 3 usages of this option to the non-SPL form, since there is no SPL_PHY_FIXED defined in Kconfig Signed-off-by: Simon Glass <sjg@chromium.org>
2023-02-10Correct SPL use of NETDEVICESSimon Glass1-1/+1
This converts 1 usage of this option to the non-SPL form, since there is no SPL_NETDEVICES defined in Kconfig Signed-off-by: Simon Glass <sjg@chromium.org>
2023-02-09Correct SPL uses of FASTBOOT_FLASHSimon Glass1-1/+1
This converts 3 usages of this option to the non-SPL form, since there is no SPL_FASTBOOT_FLASH defined in Kconfig Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
2023-02-02net: ipv6: Fixed IPv6 string to address conversion off-by-one errorEhsan Mohandesi1-1/+1
One extra character was being checked in the IPv6 string which caused the last character of the address to be neither '\0' nor ':'. This raises an error condition and causes the function to always return an error. This issue was resolved by this fix. Signed-off-by: Ehsan Mohandesi <emohandesi@microsoft.com> Reviewed-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
2023-02-02net: ipv6: Fix IPv6 netmask parsingSean Edmond1-3/+6
It should be possible to specify a netmask when setting a static IPv6 address. For example: setenv ip6addr 2001:cafe:cafe:cafe::100/64 The net_prefix_length and net_ip6 should be updated properly. Signed-off-by: Sean Edmond <seanedmond@microsoft.com> Reviewed-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2023-02-02net: tftp: Fix for DATA ACK for block count out of orderSean Edmond1-0/+8
In rfc7440, if an ACK is not received by the server or if the last data block in a window is dropped, the server will timeout and retransmit the window. In this case, the block count received will be less than the internal block count. In this case, the client should not ACK. ACK should only be sent if the received block count is greater than the expected block count. Signed-off-by: Sean Edmond <seanedmond@linux.microsoft.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2023-02-02net: dsa: allow rcv() and xmit() to be optionalTim Harvey1-13/+15
Allow rcv() and xmit() dsa driver ops to be optional in case a driver does not care to mangle a packet as in U-Boot only one network port is enabled at a time and thus no packet mangling is necessary. Suggested-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Fabio Estevam <festevam@denx.de> Signed-off-by: Tim Harvey <tharvey@gateworks.com>
2023-02-02net: dsa: ensure dsa driver has proper opsTim Harvey1-0/+17
Add a function to sanity check a dsa driver having proper ops. Suggested-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Fabio Estevam <festevam@denx.de>
2023-02-02net: dsa: move cpu port probe to dsa_post_probeTim Harvey1-1/+10
In order to ensure that a DSA driver probe gets called before dsa_ops->port_probe move the port_probe of the cpu_port to a post-probe function. Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Fabio Estevam <festevam@denx.de>
2023-02-02net: mdio-uclass: scan for dm mdio children on post-bindTim Harvey1-0/+4
If a DM_MDIO driver is used we need to scan the subnodes as well. Signed-off-by: Tim Harvey <tharvey@gateworks.com> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Fabio Estevam <festevam@denx.de>
2023-01-23bootstd: Add a new pre-scan priority for bootdevsSimon Glass1-2/+2
We need extensions to be set up before we start trying to boot any of the bootdevs. Add a new priority before all the others for tht sort of thing. Also add a 'none' option, so that the first one is not 0. While we are here, comment enum bootdev_prio_t fully and expand the test for the 'bootdev hunt' command. Signed-off-by: Simon Glass <sjg@chromium.org>
2023-01-23bootstd: Rename bootdev checkersSimon Glass1-1/+1
These functions return 0 if the check passes, so the names are somewhat confusing. Rename them. Signed-off-by: Simon Glass <sjg@chromium.org>
2023-01-23bootstd: Add a hunter for ethernetSimon Glass1-23/+41
Sometimes ethernet devices are attached to PCI. Since it is quick to scan, add this into the ethernet hunter. Run dhcp to establish the network connection. Drop this from the bootdev since that is not needed now. Update a log message for clarity. Signed-off-by: Simon Glass <sjg@chromium.org>
2023-01-23sandbox: Allow ethernet bootdevs to be disabled for testsSimon Glass1-1/+13
Most tests don't want these and can create a lot of noise. Add a way to disable them. Use that in tests, with a flag provided to enable them for tests that need this feature. Signed-off-by: Simon Glass <sjg@chromium.org>
2023-01-23sandbox: Allow ethernet to be disabled at runtimeSimon Glass1-0/+4
For bootstd tests it is seldom useful to have ethernet enabled. Add a way to disable it, so that ethernet operations like tftpboot do nothing. Signed-off-by: Simon Glass <sjg@chromium.org>
2023-01-20global: Finish CONFIG -> CFG migrationTom Rini1-7/+7
At this point, the remaining places where we have a symbol that is defined as CONFIG_... are in fairly odd locations. While as much dead code has been removed as possible, some of these locations are simply less obvious at first. In other cases, this code is used, but was defined in such a way as to have been missed by earlier checks. Perform a rename of all such remaining symbols to be CFG_... rather than CONFIG_... Signed-off-by: Tom Rini <trini@konsulko.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2023-01-11fastboot: remove #ifdef CONFIG when it is possiblePatrick Delaunay1-5/+3
Much of the fastboot code predates the introduction of Kconfig and has quite a few #ifdefs in it which is unnecessary now that we can use IS_ENABLED() et al. Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com> Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com> Reviewed-by: Sean Anderson <sean.anderson@seco.com> Tested-by: Mattijs Korpershoek <mkorpershoek@baylibre.com> # on vim3l
2023-01-09Merge branch 'next'Tom Rini4-437/+55
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-12-29net: wget: fix implicit declarationMichael Walle1-0/+1
The compiler complains about the missing declaration of print_size(): net/wget.c:415:3: warning: implicit declaration of function ‘print_size’ [-Wimplicit-function-declaration] Fix it. Signed-off-by: Michael Walle <michael@walle.cc>
2022-12-22net: don't memcpy to NULLHeinrich Schuchardt1-1/+1
In ndisc_receive() 7 bytes are copied from a buffer of size 6 to NULL. net_nd_packet_mac is a pointer. If it is NULL, we should set it to the address of the buffer with the MAC address. Addresses-Coverity-ID: 430974 ("Out-of-bounds access") Fixes: c6610e1d90ea ("net: ipv6: Add Neighbor Discovery Protocol (NDP)") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
2022-12-22net: ipv6: Add missing break into IPv6 protocol handlerViacheslav Mitrofanov1-0/+1
IPv6 protocol handler is not terminated with a break statment. It can lead to running unexpected code. Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
2022-12-22Convert CONFIG_HOSTNAME et al to KconfigTom Rini1-0/+52
This converts the following to Kconfig: CONFIG_GATEWAYIP CONFIG_HOSTNAME CONFIG_IPADDR CONFIG_NETMASK CONFIG_ROOTPATH CONFIG_SERVERIP CONFIG_UBOOTPATH To do this, we introduce a CONFIG_USE_ form of each of the above and change include/env_default.h to test for that to be set before setting a value. Further, we don't want to stringify the IP address related values as they are now properly strings via Kconfig. Signed-off-by: Tom Rini <trini@konsulko.com>
2022-12-07net: Remove eth_legacy.cTom Rini3-437/+3
As there are no more non-DM_ETH cases for networking, remove this legacy file and update the Makefile to match current usage. Signed-off-by: Tom Rini <trini@konsulko.com>
2022-12-05net: ping6: Add ping6 commandViacheslav Mitrofanov4-0/+136
Implement ping6 command to ping hosts using IPv6. It works the same way as an ordinary ping command. There is no ICMP request so it is not possible to ping our host. This patch adds options in Kconfig and Makefile to build ping6 command. Series-changes: 3 - Added structures and functions descriptions - Added to ping6_receive() return value instead of void Series-changes: 4 - Fixed structures and functions description style Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: tftp: Add IPv6 support for tftpbootViacheslav Mitrofanov2-7/+68
The command tftpboot uses IPv4 by default. Add the possibility to use IPv6 instead. If an address in the command is an IPv6 address it will use IPv6 to boot or if there is a suffix -ipv6 in the end of the command it also force using IPv6. All other tftpboot features and parameters are left the same. Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: ipv6: Incorporate IPv6 support into u-boot net subsystemViacheslav Mitrofanov1-1/+22
Add net_ip6_handler (an IPv6 packet handler) into net_loop. Add neighbor discovery mechanism into network init process. That is the main step to run IPv6 in u-boot. Now u-boot is capable to use NDP and handle IPv6 packets. Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: ipv6: Add implementation of main IPv6 functionsViacheslav Mitrofanov1-0/+362
Functions that were exposed in "net: ipv6: Add IPv6 basic primitives" had only empty implementations and were exposed as API for futher patches. This patch add implementation of these functions. Main functions are: net_ip6_handler() - IPv6 packet handler for incoming packets; net_send_udp_packet6() - make up and send an UDP packet; csum_ipv6_magic() - compute checksum of IPv6 "psuedo-header" per RFC2460 section 8.1; ip6_addr_in_subnet() - check if an address is in our subnet. Other functions are auxiliary. Series-changes: 3 - Added comments - Fixed style problems - Fixed return codes instead of -1 Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: ipv6: Add ip6addr, gatewayip6, serverip6 variables callbacksViacheslav Mitrofanov1-0/+48
Implement actions on ip6addr, gatewayip6, serverip6 varaibles. on_ip6addr - convert IPv6 string addr to struct ip6_addr on_gatewayip6 - convert IPv6 string addr to struct ip6_addr on_serverip6 - convert IPv6 string addr to struct ip6_addr Series-changes: 3 - Removed memory allocation - Substituted -1 for error code Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: ipv6: Add Neighbor Discovery Protocol (NDP)Viacheslav Mitrofanov2-0/+290
Implement basic of NDP. It doesn't include such things as Router Solicitation, Router Advertisement and Redirect. It just has Neighbor Solicitation and Neighbor Advertisement. Only these two features are used in u-boot IPv6. Implementation of some NDP functions uses API that was exposed in "net: ipv6: Add IPv6 basic primitives". Also this patch inlcudes update in Makefile to build NDP. Series-changes: 3 - Added structures and functions descriptions - Fixed style problems Series-changes: 4 - Fixed structures and functions description style Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: ipv6: Add IPv6 build optionsViacheslav Mitrofanov2-0/+11
Add options to Makefile and Kconfig file to build IPv6 Series-changes: 3 - Added help for IPv6 support Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05net: ipv6: Add IPv6 basic primitivesViacheslav Mitrofanov1-0/+31
This patch is a collection of basic primitives that are prerequisite for further IPv6 implementation. There are structures definition such as IPv6 header, UDP header (for TFTP), ICMPv6 header. There are auxiliary defines such as protocol codes, padding, struct size and etc. Also here are functions prototypes and its empty implementation that will be used as API for further patches. Here are variables declaration such as IPv6 address of our host, gateway, ipv6 server. Series-changes: 3 - Added functions and structures descriptions - Removed enums ND_OPT_*. It will be moved into further patches - Substituted -1 for error codes Series-changes: 4 - Changed functions and structures description style Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-02net: CONFIG_NET_DEVICES in dhcp_handler()Heinrich Schuchardt1-1/+1
The symbol CONFIG_NET_DEVICES does not exist. The correct name is CONFIG_NETDEVICES. Fixes: 77b5c4a5b1dc ("efi_loader: Let networking support depend on NETDEVICES") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-11-28net: Add wget applicationYing-Chun Liu (PaulLiu)3-0/+445
This commit adds a simple wget command that can download files from http server. The command syntax is wget ${loadaddr} <path of the file from server> Signed-off-by: Duncan Hare <DuncanCHare@yahoo.com> Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org> Cc: Christian Gmeiner <christian.gmeiner@gmail.com> Cc: Joe Hershberger <joe.hershberger@ni.com> Cc: Michal Simek <michal.simek@xilinx.com> Cc: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28net: Add TCP protocolYing-Chun Liu (PaulLiu)4-0/+767
Currently file transfers are done using tftp or NFS both over udp. This requires a request to be sent from client (u-boot) to the boot server. The current standard is TCP with selective acknowledgment. Signed-off-by: Duncan Hare <DH@Synoia.com> Signed-off-by: Duncan Hare <DuncanCHare@yahoo.com> Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org> Cc: Christian Gmeiner <christian.gmeiner@gmail.com> Cc: Joe Hershberger <joe.hershberger@ni.com> Cc: Michal Simek <michal.simek@xilinx.com> Cc: Ramon Fried <rfried.dev@gmail.com> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28net: deal with fragment-overlapping-two-holes caseRasmus Villemoes1-3/+7
With a suitable sequence of malicious packets, it's currently possible to get a hole descriptor to contain arbitrary attacker-controlled contents, and then with one more packet to use that as an arbitrary write vector. While one could possibly change the algorithm so we instead loop over all holes, and in each hole puts as much of the current fragment as belongs there (taking care to carefully update the hole list as appropriate), it's not worth the complexity: In real, non-malicious scenarios, one never gets overlapping fragments, and certainly not fragments that would be supersets of one another. So instead opt for this simple protection: Simply don't allow the eventual memcpy() to write beyond the last_byte of the current hole. Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28net: tftp: sanitize tftp block size, especially for TXRasmus Villemoes1-0/+47
U-Boot does not support IP fragmentation on TX (and unless CONFIG_IP_DEFRAG is set, neither on RX). So the blocks we send must fit in a single ethernet packet. Currently, if tftpblocksize is set to something like 5000 and I tftpput a large enough file, U-Boot crashes because we overflow net_tx_packet (which only has room for 1500 bytes plus change). Similarly, if tftpblocksize is set to something larger than what we can actually receive (e.g. 50000, with NET_MAXDEFRAG being 16384), any tftp get just hangs because we never receive any packets. Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28net: tftp: use IS_ENABLED(CONFIG_NET_TFTP_VARS) instead of #ifRasmus Villemoes1-28/+28
Nothing inside this block depends on NET_TFTP_VARS to be set to parse correctly. Switch to C if() in preparation for adding code before this (to avoid a declaration-after-statement warning). Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> [trini: Update to cover CONFIG_TFTP_PORT case as well] Signed-off-by: Tom Rini <trini@konsulko.com>
2022-11-28net: fix ip_len in reassembled IP datagramRasmus Villemoes1-2/+2
For some reason, the ip_len field in a reassembled IP datagram is set to just the size of the payload, but it should be set to the value it would have had if the datagram had never been fragmented in the first place, i.e. size of payload plus size of IP header. That latter value is currently returned correctly via the "len" variable. And before entering net_defragment(), len does have the value ntohs(ip->ip_len), so if we're not dealing with a fragment (so net_defragment leaves *len alone), that relationship of course also holds after the net_defragment() call. The only use I can find of ip->ip_len after the net_defragment call is the ntohs(ip->udp_len) > ntohs(ip->ip_len) sanity check - none of the functions that are passed the "ip" pointer themselves inspect ->ip_len but instead use the passed len. But that sanity check is a bit odd, since the RHS really should be "ntohs(ip->ip_len) - 20", i.e. the IP payload size. Now that we've fixed things so that len == ntohs(ip->ip_len) in all cases, change that sanity check to use len-20 as the RHS. Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28net: (actually/better) deal with CVE-2022-{30790,30552}Rasmus Villemoes1-1/+9
I hit a strange problem with v2022.10: Sometimes my tftp transfer would seemingly just hang. It only happened for some files. Moreover, changing tftpblocksize from 65464 to 65460 or 65000 made it work again for all the files I tried. So I started suspecting it had something to do with the file sizes and in particular the way the tftp blocks get fragmented and reassembled. v2022.01 showed no problems with any of the files or any value of tftpblocksize. Looking at what had changed in net.c or tftp.c since January showed only one remotely interesting thing, b85d130ea0ca. So I fired up wireshark on my host to see if somehow one of the packets would be too small. But no, with both v2022.01 and v2022.10, the exact same sequence of packets were sent, all but the last of size 1500, and the last being 1280 bytes. But then it struck me that 1280 is 5*256, so one of the two bytes on-the-wire is 0 and the other is 5, and when then looking at the code again the lack of endianness conversion becomes obvious. [ntohs is both applied to ip->ip_off just above, as well as to ip->ip_len just a little further down when the "len" is actually computed]. IOWs the current code would falsely reject any packet which happens to be a multiple of 256 bytes in size, breaking tftp transfers somewhat randomly, and if it did get one of those "malicious" packets with ip_len set to, say, 27, it would be seen by this check as being 6912 and hence not rejected. ==== Now, just adding the missing ntohs() would make my initial problem go away, in that I can now download the file where the last fragment ends up being 1280 bytes. But there's another bug in the code and/or analysis: The right-hand side is too strict, in that it is ok for the last fragment not to have a multiple of 8 bytes as payload - it really must be ok, because nothing in the IP spec says that IP datagrams must have a multiple of 8 bytes as payload. And comments in the code also mention this. To fix that, replace the comparison with <= IP_HDR_SIZE and add another check that len is actually a multiple of 8 when the "more fragments" bit is set - which it necessarily is for the case where offset8 ends up being 0, since we're only called when (ip_off & (IP_OFFS | IP_FLAGS_MFRAG)). ==== So, does this fix CVE-2022-30790 for real? It certainly correctly rejects the POC code which relies on sending a packet of size 27 with the MFRAG flag set. Can the attack be carried out with a size 27 packet that doesn't set MFRAG (hence must set a non-zero fragment offset)? I dunno. If we get a packet without MFRAG, we update h->last_byte in the hole we've found to be start+len, hence we'd enter one of if ((h >= thisfrag) && (h->last_byte <= start + len)) { or } else if (h->last_byte <= start + len) { and thus won't reach any of the /* overlaps with initial part of the hole: move this hole */ newh = thisfrag + (len / 8); /* fragment sits in the middle: split the hole */ newh = thisfrag + (len / 8); IOW these division are now guaranteed to be exact, and thus I think the scenario in CVE-2022-30790 cannot happen anymore. ==== However, there's a big elephant in the room, which has always been spelled out in the comments, and which makes me believe that one can still cause mayhem even with packets whose payloads are all 8-byte aligned: This code doesn't deal with a fragment that overlaps with two different holes (thus being a superset of a previously-received fragment). Suppose each character below represents 8 bytes, with D being already received data, H being a hole descriptor (struct hole), h being non-populated chunks, and P representing where the payload of a just received packet should go: DDDHhhhhDDDDHhhhDDDD PPPPPPPPP I'm pretty sure in this case we'd end up with h being the first hole, enter the simple } else if (h->last_byte <= start + len) { /* overlaps with final part of the hole: shorten this hole */ h->last_byte = start; case, and thus in the memcpy happily overwrite the second H with our chosen payload. This is probably worth fixing... Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr)Rasmus Villemoes1-2/+6
While the code mostly/only handles UDP packets, it's possible for the last fragment of a fragmented UDP packet to be smaller than 28 bytes; it can be as small as 21 bytes (an IP header plus one byte of payload). So until we've performed the defragmentation step and thus know whether we're now holding a full packet, we should only check for the existence of the fields in the ip header, i.e. that there are at least 20 bytes present. In practice, we always seem to be handed a "len" of minimum 60 from the device layer, i.e. minimal ethernet frame length minus FCS, so this is mostly theoretical. After we've fetched the header's claimed length and used that to update the len variable, check that the header itself claims to be the minimal possible length. This is probably how CVE-2022-30552 should have been dealt with in the first place, because net_defragment() is not the only place that wants to know the size of the IP datagram payload: If we receive a non-fragmented ICMP packet, we pass "len" to receive_icmp() which in turn may pass it to ping_receive() which does compute_ip_checksum(icmph, len - IP_HDR_SIZE) and due to the signature of compute_ip_checksum(), that would then lead to accessing ~4G of address space, very likely leading to a crash. Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28net: improve check for no IP optionsRasmus Villemoes1-1/+1
There's no reason we should accept an IP packet with a malformed IHL field. So ensure that it is exactly 5, not just <= 5. Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-06efi_loader: Let networking support depend on NETDEVICESJan Kiszka1-1/+3
CONFIG_NET does not imply that there are actually network devices available, only CONFIG_NETDEVICES does. Changing to this dependency obsoletes the check in Kconfig because NETDEVICES means DM_ETH. Fixes: 0efe1bcf5c2c ("efi_loader: Add network access support") Suggested-by: Tom Rini <trini@konsulko.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2022-10-21cmd: Add ncsi commandSamuel Mendoza-Jonas1-0/+1
Adds an "ncsi" command to manually start NC-SI configuration. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org>
2022-10-21net: NC-SI setup and handlingSamuel Mendoza-Jonas1-1/+25
Add the handling of NC-SI ethernet frames, and add a check at the start of net_loop() to configure NC-SI before starting other network commands. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-10-17net: eth-uclass: Do not set device on errorMichal Suchanek1-0/+2
eth_get_dev relies on the broken behavior that returns an error but not the device on which the error happened which gives the caller no reasonable way to report or handle the error. In a later patch uclass_first_device_err will be changed to return the device on error but eth_get_dev stores the returned device pointer directly in a global state without checking the return value. Unset the pointer again in the error case. Signed-off-by: Michal Suchanek <msuchanek@suse.de> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-10-17dm: treewide: Use uclass_first_device_err when accessing one deviceMichal Suchanek1-2/+2
There is a number of users that use uclass_first_device to access the first and (assumed) only device in uclass. Some check the return value of uclass_first_device and also that a device was returned which is exactly what uclass_first_device_err does. Some are not checking that a device was returned and can potentially crash if no device exists in the uclass. Finally there is one that returns NULL on error either way. Convert all of these to use uclass_first_device_err instead, the return value will be removed from uclass_first_device in a later patch. Signed-off-by: Michal Suchanek <msuchanek@suse.de> Reviewed-by: Simon Glass <sjg@chromium.org>
2022-09-29dm: core: Drop ofnode_is_available()Simon Glass1-1/+1
This function is also available as ofnode_is_enabled(), so use that instead. Signed-off-by: Simon Glass <sjg@chromium.org>
2022-09-18cyclic: Use schedule() instead of WATCHDOG_RESET()Stefan Roese1-1/+1
Globally replace all occurances of WATCHDOG_RESET() with schedule(), which handles the HW_WATCHDOG functionality and the cyclic infrastructure. Signed-off-by: Stefan Roese <sr@denx.de> Reviewed-by: Simon Glass <sjg@chromium.org> Tested-by: Tom Rini <trini@konsulko.com> [am335x_evm, mx6cuboxi, rpi_3,dra7xx_evm, pine64_plus, am65x_evm, j721e_evm]
generated by cgit v1.1 at 2024-08-11 13:29:41 +0000