aboutsummaryrefslogtreecommitdiff
path: root/src/net
AgeCommit message (Collapse)AuthorFilesLines
2015-03-05[build] Fix the REQUIRE_SYMBOL mechanismMichael Brown7-0/+19
At some point in the past few years, binutils became more aggressive at removing unused symbols. To function as a symbol requirement, a relocation record must now be in a section marked with @progbits and must not be in a section which gets discarded during the link (either via --gc-sections or via /DISCARD/). Update REQUIRE_SYMBOL() to generate relocation records meeting these criteria. To minimise the impact upon the final binary size, we use existing symbols (specified via the REQUIRING_SYMBOL() macro) as the relocation targets where possible. We use R_386_NONE or R_X86_64_NONE relocation types to prevent any actual unwanted relocation taking place. Where no suitable symbol exists for REQUIRING_SYMBOL() (such as in config.c), the macro PROVIDE_REQUIRING_SYMBOL() can be used to generate a one-byte-long symbol to act as the relocation target. If there are versions of binutils for which this approach fails, then the fallback will probably involve killing off REQUEST_SYMBOL(), redefining REQUIRE_SYMBOL() to use the current definition of REQUEST_SYMBOL(), and postprocessing the linked ELF file with something along the lines of "nm -u | wc -l" to check that there are no undefined symbols remaining. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-05[build] Use REQUIRE_OBJECT() to drag in per-object configurationMichael Brown4-0/+12
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[iscsi] Rewrite unrelicensable portions of iscsi.cMichael Brown1-36/+28
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[libc] Rewrite byte-swapping codeMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown13-13/+53
These files cannot be automatically relicensed by util/relicense.pl since they either contain unusual but trivial contributions (such as the addition of __nonnull function attributes), or contain lines dating back to the initial git revision (and so require manual knowledge of the code's origin). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown3-3/+15
Relicence files with kind permission from the following contributors: Alex Williamson <alex.williamson@redhat.com> Eduardo Habkost <ehabkost@redhat.com> Greg Jednaszewski <jednaszewski@gmail.com> H. Peter Anvin <hpa@zytor.com> Marin Hannache <git@mareo.fr> Robin Smidsrød <robin@smidsrod.no> Shao Miller <sha0.miller@gmail.com> Thomas Horsten <thomas@horsten.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown32-32/+160
Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-02-25[dhcp] Extract timing parameters out to config/dhcp.hAlex Williamson1-13/+19
iPXE uses DHCP timeouts loosely based on values recommended by the specification, but often abbreviated to reduce timeouts for reliable and/or simple network topologies. Extract the DHCP timing parameters to config/dhcp.h and document them. The resulting default iPXE behavior is exactly the same, but downstreams are now afforded the opportunity to implement spec-compliant behavior via config file overrides. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-02-19[ipv4] Rewrite inet_aton()Michael Brown1-5/+37
The implementation of inet_aton() has an unknown provenance. Rewrite this code to avoid potential licensing uncertainty. Also move the code from core/misc.c to its logical home in net/ipv4.c, and add a few extra test cases. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-02-18[legal] Add missing copyright header to net/ipv4.cMichael Brown1-0/+20
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-02-11[rndis] Add rndis_rx_err()Michael Brown1-0/+15
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-02-06[tftp] Explicitly abort connection whenever parent interface is closedMichael Brown1-38/+16
Fetching the TFTP file size is currently implemented via a custom "tftpsize://" protocol hack. Generalise this approach to instead close the TFTP connection whenever the parent data-transfer interface is closed. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-20[rndis] Ignore start-of-day RNDIS_INDICATE_STATUS_MSG with status 0x40020006Michael Brown1-0/+4
Windows Server 2012 R2 generates an RNDIS_INDICATE_STATUS_MSG with a status code of 0x4002006. This status code does not appear to be documented anywhere within the sphere of human knowledge. Explicitly ignore this status code in order to avoid unnecessarily cluttering the display when RNDIS debugging is enabled. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-20[hyperv] Assume that VMBus xfer page ranges correspond to RNDIS messagesMichael Brown1-50/+13
The (undocumented) VMBus protocol seems to allow for transfer page-based packets where the data payload is split into an arbitrary set of ranges within the transfer page set. The RNDIS protocol includes a length field within the header of each message, and it is known from observation that multiple RNDIS messages can be concatenated into a single VMBus message. iPXE currently assumes that the transfer page range boundaries are entirely arbitrary, and uses the RNDIS header length to determine the RNDIS message boundaries. Windows Server 2012 R2 generates an RNDIS_INDICATE_STATUS_MSG for an undocumented and unknown status code (0x40020006) with a malformed RNDIS header length: the length does not cover the StatusBuffer portion of the message. This causes iPXE to report a malformed RNDIS message and to discard any further RNDIS messages within the same VMBus message. The Linux Hyper-V driver assumes that the transfer page range boundaries correspond to RNDIS message boundaries, and so does not notice the malformed length field in the RNDIS header. Match the behaviour of the Linux Hyper-V driver: assume that the transfer page range boundaries correspond to the RNDIS message boundaries and ignore the RNDIS header length. This avoids triggering the "malformed packet" error and also avoids unnecessary data copying: since we now have one I/O buffer per RNDIS message, there is no longer any need to use iob_split(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-20[rndis] Clear receive filter when closing the deviceMichael Brown1-11/+30
On Windows Server 2012 R2, closing and reopening the device will sometimes result in a non-functional RX datapath. The root cause is unknown. Clearing the receive filter before closing the device seems to fix the problem. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-19[rndis] Send RNDIS_HALT_MSGMichael Brown1-0/+58
The RNDIS specification requires that we send RNDIS_HALT_MSG. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-19[rndis] Send RNDIS_INITIALISE_MSGMichael Brown1-22/+161
The Hyper-V RNDIS implementation on Windows Server 2012 R2 requires that we send an explicit RNDIS initialisation message in order to get a working RX datapath. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-18[rndis] Add generic RNDIS device abstractionMichael Brown1-0/+850
RNDIS provides an abstraction of a network device on top of a generic packet transmission mechanism. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-12-12[netdevice] Fix erroneous use of free(iobuf) instead of free_iob(iobuf)Michael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-09-22[dhcp] Remove obsolete dhcp_chaddr() functionMichael Brown1-75/+5
As of commit 03f0c23 ("[ipoib] Expose Ethernet-compatible eIPoIB link-layer addresses and headers"), all link layers have used addresses which fit within the DHCP chaddr field. The dhcp_chaddr() function was therefore made obsolete by this commit, but was accidentally left present (though unused) in the source code. Remove the dhcp_chaddr() function and the only remaining use of it, unnecessarily introduced in commit 08bcc0f ("[dhcp] Check for matching chaddr in received DHCP packets"). Reported-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-09-22[dhcp] Check for matching chaddr in received DHCP packetsMichael Brown1-0/+37
On large networks a DHCP XID collision is possible. Fix by explicitly checking the chaddr in received DHCP packets. Originally-fixed-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-07-30[netdevice] Avoid registering duplicate network devicesMichael Brown1-5/+40
Reject network devices which appear to be duplicates of those already available via a different underlying hardware device. On a Xen PV-HVM system, this allows us to filter out the emulated PCI NICs (which would otherwise appear alongside the netfront NICs). Note that we cannot use the Xen facility to "unplug" the emulated PCI NICs, since there is no guarantee that the OS we subsequently load will have a native netfront driver. We permit devices with the same MAC address if they are attached to the same underlying hardware device (e.g. VLAN devices). Inspired-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-07-23[lacp] Set "aggregatable" flag in response LACPDUSven Ulland1-1/+2
Some switches do not allow an individual link (as defined in IEEE Std 802.3ad-2000 section 43.3.5) to work alone in a link aggregation group as described in section 43.3.6. This is verified on Dell's PowerConnect M6220, based on the Broadcom Strata XGS-IV chipset. Set the LACP_STATE_AGGREGATABLE flag in the actor.state field to announce link aggregation in the response LACPDU, which will have the switch enable the link aggregation group and allow frames to pass. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-07-14[netdevice] Reset network device index when last device is unregisteredMichael Brown1-2/+8
When functioning as an EFI driver, drivers can be disconnected and reconnected multiple times (e.g. via the EFI shell "connect" command, or by running an executable such as ipxe.efi which will temporarily disconnect existing drivers). Minimise surprise by resetting the network device index to zero whenever the last device is unregistered. This is not foolproof, but it does handle the common case of having all devices unregistered and then reregistered in the original order. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-06-24[build] Expose build timestamp, build name, and product namesMichael Brown1-2/+2
Expose the build timestamp (measured in seconds since the Epoch) and the build name (e.g. "rtl8139.rom" or "ipxe.efi"), and provide the product name and product short name in a single centralised location. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-06-03[scsi] Improve sense code parsingMichael Brown2-7/+9
Parse the sense data to extract the reponse code, the sense key, the additional sense code, and the additional sense code qualifier. Originally-implemented-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-06-01[ethernet] Provide eth_random_addr() to generate random Ethernet addressesHannes Reinecke1-0/+16
Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-23[ipv6] Avoid potentially copying from a NULL pointer in ipv6_tx()Michael Brown1-1/+2
If ipv6_tx() is called with a non-NULL network device, a NULL or unspecified source address, and a destination address which does not match any routing table entry, then it will attempt to copy the source address from a NULL pointer. I don't think that there is currently any code path which could trigger this behaviour, but we should probably ensure that it can never happen. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-23[ipv6] Include network device when transcribing multicast addressesMichael Brown1-1/+1
Destination multicast addresses require a sin6_scope_id, which should therefore be transcribed to a network device name by ipv6_sock_ntoa(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-23[ipv6] Do not set sin6_scope_id on source addressMichael Brown1-1/+0
The transmitting network device is specified via the destination address, not the source address. There is no reason to set sin6_scope_id on the source address. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-23[dhcpv6] Do not set sin6_scope_id on the unspecified client socket addressMichael Brown1-1/+0
Setting sin6_scope_id to a non-zero value will cause the check against the "empty socket address" in udp_demux() to fail, and incoming DHCPv6 responses on interfaces other than net0 will be rejected with a spurious "No UDP connection listening on port 546" error. The transmitting network device is specified via the destination address, not the source address. Fix by simply not setting sin6_scope_id on the client socket address. Reported-by: Anton D. Kachalov <mouse@yandex-team.ru> Tested-by: Anton D. Kachalov <mouse@yandex-team.ru> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-18[nfs] Rewrite NFS URI handlingMarin Hannache2-90/+198
Get the NFS URI manipulation code out of nfs_open.c. The resulting code is now much more readable. Signed-off-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-16[syslog] Strip invalid characters from hostnameMichael Brown1-6/+31
Avoid generating syntactically invalid log messages by ensuring that invalid characters are not present in the hostname. In particular, ensure that any whitespace is stripped, since whitespace functions as a field separator for syslog messages. Reported-by: Alex Davies <adavies@jumptrading.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-16[nfs] Fix an invalid free() when loading a regular (non-symlink) fileMarin Hannache1-3/+4
An invalid free() was ironically introduced by fixing another invalid free in commit 7aa69c4 ("[nfs] Fix an invalid free() when loading a symlink"). Signed-off-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-12[tcp] Defer sending ACKs until all received packets have been processedMichael Brown1-8/+25
When running inside a virtual machine (or when using the UNDI driver), transmitting packets can be expensive. When we receive several packets in one poll (e.g. because a slow BIOS timer interrupt routine has caused us to fall behind in processing), we can safely send just a single ACK to cover all of the received packets. This reduces the time spent transmitting and allows us to clear the backlog much faster. Various RFCs (starting with RFC1122) state that there should be an ACK for at least every second segment. We choose not to enforce this rule. Under normal operation each poll should find at most one received packet, and we will then not delay any ACKs. We delay (i.e. omit) ACKs only when under sufficiently heavy load that we are finding multiple packets per poll; under these conditions it is important to clear the backlog quickly since any delay may lead to dropped packets. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-05-12[nfs] Fix an invalid free() when loading a symlinkMarin Hannache1-0/+11
Signed-off-by: Marin Hannache <git@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-04-28[http] Profile receive datapathMichael Brown1-0/+13
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-04-28[tcp] Profile transmit and receive datapathsMichael Brown1-0/+20
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-04-28[ipv4] Profile transmit and receive datapathsMichael Brown1-0/+15
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-04-27[netdevice] Profile common operationsMichael Brown1-0/+16
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-28[crypto] Generalise X.509 cache to a full certificate storeMichael Brown2-41/+35
Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-25[crypto] Remove dynamically-allocated storage for certificate OCSP URIMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-25[crypto] Remove dynamically-allocated storage for certificate nameMichael Brown2-11/+5
iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-25[http] Accept Content-Length header with trailing whitespaceMichael Brown1-1/+2
At least one HTTP server (Google's OCSP responder) has been observed to generate a Content-Length header with trailing whitespace. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-14[netdevice] Notify upper-layer drivers when RX processing is (un)frozenMichael Brown1-0/+28
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-07[http] Automatically retry request on a 503 Service UnavailableMichael Brown1-1/+45
A web server may return a 503 Service Unavailable response along with a Retry-After header to direct the client to retry the request at a later time. The Retry-After header may be a number of seconds, or a full HTTP timestamp (e.g. "Fri, 7 Mar 2014 17:22:14 GMT"). We have no reasonable way of parsing a full HTTP timestamp; if the server chooses to use this format then we simply retry after a fixed 5-second delay. As per RFC 2616, in the absence of a Retry-After header we treat a status code of 503 Service Unavailable as being equivalent to 500 Internal Server Error, and immediately fail the request. Requested-by: Suresh Sundriyal <ssundriy@vmware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-07[http] Use a retry timer to trigger retried requestsMichael Brown1-15/+44
Use a retry timer to allow for the possibility of deferring a retried request. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-07[tcp] Update window even if ACK does not acknowledge new dataMichael Brown1-2/+4
iPXE currently ignores ACKs which do not acknowledge any new data. (In particular, it does not stop the retransmission timer; this is done to prevent an immediate retransmission if a duplicate ACK is received while the transmit queue is non-empty.) If a peer provides a window size of zero and later sends a duplicate ACK to update the window size, this update will therefore be ignored and iPXE will never be able to transmit data. Fix by updating the window size even for ACKs which do not acknowledge new data. Reported-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-05[netdevice] Mark devices as open before calling open() methodMichael Brown1-4/+8
When opening a VLAN device, vlan_open() will call netdev_open() on the trunk device. This will result in a call to netdev_notify(), which will cause vlan_notify() to call vlan_sync() on the original VLAN device, which will see that the trunk device is now open but the VLAN device apparently isn't (since it has not yet been flagged as open by netdev_open()). The upshot is a second attempt to open the VLAN device, which will result in an erroneous second call to vlan_open(). This convoluted chain of events then terminates harmlessly since vlan_open() calls netdev_open() on the trunk device, which just returns immediately since the trunk device is by now flagged as being already open. Prevent this from happening by having netdev_open() flag the device as open prior to calling the device's open() method, and reflagging it as closed if the open() method fails. Originally-fixed-by: Wissam Shoukair <wissams@mellanox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2014-03-04[tcp] Calculate correct MSS from peer addressMichael Brown1-1/+14
iPXE currently advertises a fixed MSS of 1460, which is correct only for IPv4 over Ethernet. For IPv6 over Ethernet, the value should be 1440 (allowing for the larger IPv6 header). For non-Ethernet link layers, the value should reflect the MTU of the underlying network device. Use tcpip_mtu() to calculate the transport-layer MTU associated with the peer address, and calculate the MSS to allow for an optionless TCP header as per RFC 6691. As a side benefit, we can now fail a connection immediately with a meaningful error message if we have no route to the destination address. Reported-by: Anton D. Kachalov <mouse@yandex-team.ru> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.1 at 2024-08-20 00:34:26 +0000