diff options
| author | Michael Brown <mcb30@ipxe.org> | 2021-01-19 12:37:50 +0000 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2021-01-19 13:01:46 +0000 |
| commit | 9c2e8bad1143e1095205d67dbe6b3032d39af0ab (patch) | |
| tree | 484f4fab39cd546fad64fdd764f3ba3828b5880b /src/config | |
| parent | 274ad690120620df718144556687a05e2f371e66 (diff) | |
| download | ipxe-9c2e8bad1143e1095205d67dbe6b3032d39af0ab.tar.gz | |
[eap] Treat an EAP Request-Identity as indicating a blocked link
A switch port using 802.1x authentication will send EAP
Request-Identity packets once the physical link is up, and will not be
forwarding packets until the port identity has been established.
We do not currently support 802.1x authentication. However, a
reasonably common configuration involves using a preset list of
permitted MAC addresses, with the "authentication" taking place
between the switch and a RADIUS server. In this configuration, the
end device does not need to perform any authentication step, but does
need to be prepared for the switch port to fail to forward packets for
a substantial time after physical link-up. This exactly matches the
"blocked link" semantics already used when detecting a non-forwarding
switch port via LACP or STP.
Treat a received EAP Request-Identity as indicating a blocked link.
Unlike LACP or STP, there is no way to determine the expected time
until the next EAP packet and so we must choose a fixed timeout.
Erroneously assuming that the link is blocked is relatively harmless
since we will still attempt to transmit and receive data even over a
link that is marked as blocked, and so the net effect is merely to
prolong DHCP attempts. In contrast, erroneously assuming that the
link is unblocked will potentially cause DHCP to time out and give up,
resulting in a failed boot.
The default EAP Request-Identity interval in Cisco switches (where
this is most likely to be encountered in practice) is 30 seconds, so
choose 45 seconds as a timeout that is likely to avoid gaps during
which we falsely assume that the link is unblocked.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/config')
| -rw-r--r-- | src/config/config_ethernet.c | 3 | ||||
| -rw-r--r-- | src/config/general.h | 1 |
2 files changed, 4 insertions, 0 deletions
diff --git a/src/config/config_ethernet.c b/src/config/config_ethernet.c index b5f7ddc9d..8a663c923 100644 --- a/src/config/config_ethernet.c +++ b/src/config/config_ethernet.c @@ -46,3 +46,6 @@ REQUIRE_OBJECT ( stp ); #ifdef NET_PROTO_LACP REQUIRE_OBJECT ( eth_slow ); #endif +#ifdef NET_PROTO_EAPOL +REQUIRE_OBJECT ( eapol ); +#endif diff --git a/src/config/general.h b/src/config/general.h index 0c99bcbb6..9edf93b5a 100644 --- a/src/config/general.h +++ b/src/config/general.h @@ -39,6 +39,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #undef NET_PROTO_FCOE /* Fibre Channel over Ethernet protocol */ #define NET_PROTO_STP /* Spanning Tree protocol */ #define NET_PROTO_LACP /* Link Aggregation control protocol */ +#define NET_PROTO_EAPOL /* EAP over LAN protocol */ /* * PXE support |