aboutsummaryrefslogtreecommitdiffstats
path: root/src/net
Commit message (Collapse)AuthorAgeFilesLines
...
* [netdevice] Do not attempt to unmap a null I/O bufferMichael Brown2020-11-291-1/+1
| | | | | | | | netdev_tx_err() may be called with a null I/O buffer (e.g. to record a transmit error with no associated buffer). Avoid a potential null pointer dereference in the DMA unmapping code path. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dma] Move I/O buffer DMA operations to iobuf.hMichael Brown2020-11-281-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Include a potential DMA mapping within the definition of an I/O buffer, and move all I/O buffer DMA mapping functions from dma.h to iobuf.h. This avoids the need for drivers to maintain a separate list of DMA mappings for each I/O buffer that they may handle. Network device drivers typically do not keep track of transmit I/O buffers, since the network device core already maintains a transmit queue. Drivers will typically call netdev_tx_complete_next() to complete a transmission without first obtaining the relevant I/O buffer pointer (and will rely on the network device core automatically cancelling any pending transmissions when the device is closed). To allow this driver design approach to be retained, update the netdev_tx_complete() family of functions to automatically perform the DMA unmapping operation if required. For symmetry, also update the netdev_rx() family of functions to behave the same way. As a further convenience for drivers, allow the network device core to automatically perform DMA mapping on the transmit datapath before calling the driver's transmit() method. This avoids the need to introduce a mapping error handling code path into the typically error-free transmit methods. With these changes, the modifications required to update a typical network device driver to use the new DMA API are fairly minimal: - Allocate and free descriptor rings and similar coherent structures using dma_alloc()/dma_free() rather than malloc_phys()/free_phys() - Allocate and free receive buffers using alloc_rx_iob()/free_rx_iob() rather than alloc_iob()/free_iob() - Calculate DMA addresses using dma() or iob_dma() rather than virt_to_bus() - Set a 64-bit DMA mask if needed using dma_set_mask_64bit() and thereafter eliminate checks on DMA address ranges - Either record the DMA device in netdev->dma, or call iob_map_tx() as part of the transmit() method - Ensure that debug messages use virt_to_phys() when displaying "hardware" addresses Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Allow SRP device to be described using an EFI device pathMichael Brown2020-10-231-33/+2
| | | | | | | | | The UEFI specification provides a partial definition of an Infiniband device path structure. Use this structure to construct what may be a plausible path containing at least some of the information required to identify an SRP target device. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fcp] Allow Fibre Channel device to be described using an EFI device pathMichael Brown2020-10-221-8/+20
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Allow iSCSI device to be described using an EFI device pathMichael Brown2020-10-201-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [aoe] Allow AoE device to be described using an EFI device pathMichael Brown2020-10-191-29/+2
| | | | | | | | | | | | | There is no standard defined for AoE device paths in the UEFI specification, and it seems unlikely that any standard will be adopted in future. Choose to construct an AoE device path using a concatenation of the network device path and a SATA device path, treating the AoE major and minor numbers as the HBA port number and port multiplier port number respectively. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow HTTP connection to be described using an EFI device pathMichael Brown2020-10-191-0/+15
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv6] Reduce time spent waiting for router discoveryMichael Brown2020-10-141-0/+9
| | | | | | | | | | | Now that IPv6 is enabled by default for UEFI builds, it is important that iPXE does not delay unnecessarily in the (still relatively common) case of a network that lacks IPv6 routers. Apply the timeout values used for neighbour discovery to the router discovery process. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Ignore (and do not echo) trailing padding on received packetsMichael Brown2020-10-141-0/+3
| | | | | | | | | | | | | The LACP responder reuses the received I/O buffer to construct the response LACP (or marker) packet. Any received padding will therefore be unintentionally included within the response. Truncate the received I/O buffer to the expected length (which is already defined in a way to allow for future protocol expansion) before reusing it to construct the response. Reported-by: Tore Anderson <tore@fud.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Detect and ignore erroneously looped back LACP packetsMichael Brown2020-10-141-0/+8
| | | | | | | | | | | | | | | Some external drivers (observed with the UEFI NII driver provided by an HPE-branded Mellanox ConnectX-3 Pro) seem to cause LACP packets transmitted by iPXE to be looped back as received packets. Since iPXE's trivial LACP responder will send one response per received packet, this results in an immediate LACP packet storm. Detect looped back LACP packets (based on the received LACP actor MAC address), and refuse to respond to such packets. Reported-by: Tore Anderson <tore@fud.no> Tested-by: Tore Anderson <tore@fud.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [wpa] Fix erroneous debug message in wpa_derive_ptkMichael Brown2020-07-211-2/+3
| | | | | | | Split debug message since eth_ntoa() uses a static result buffer. Originally-fixed-by: Michael Bazzinotti <bazz@bazz1.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dns] Use all configured DNS serversMichael Brown2020-07-151-49/+130
| | | | | | | When no response is obtained from the first configured DNS server, fall back to attempting the other configured servers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xfer] Remove address family from definition of a socket openerMichael Brown2020-07-153-30/+6
| | | | | | | | All implemented socket openers provide definitions for both IPv4 and IPv6 using exactly the same opener method. Simplify the logic by omitting the address family from the definition. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow a minimum TLS protocol version to be specifiedMichael Brown2020-06-121-6/+24
| | | | | | | | The supported ciphers and digest algorithms may already be specified via config/crypto.h. Extend this to allow a minimum TLS protocol version to be specified. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Eliminate variable-length stack allocation in URI parsingMichael Brown2020-02-161-10/+28
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Eliminate variable-length stack allocations in CHAP handlersMichael Brown2020-02-161-11/+41
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [slam] Allow for the possibility of IPv6 multicast addressesMichael Brown2020-02-161-4/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [slam] Eliminate variable-length stack allocationMichael Brown2020-02-161-5/+19
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [infiniband] Eliminate variable-length stack allocationMichael Brown2020-02-161-6/+18
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tftp] Eliminate unnecessary variable-length stack allocationMichael Brown2020-02-161-11/+6
| | | | | | | | Eliminate an unnecessary variable-length stack allocation and memory copy by allowing TFTP option processors to modify the option string in-place. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Allow for the use of a hosted cache serverMichael Brown2019-12-151-4/+65
| | | | | | | | | | | | | Allow a PeerDist hosted cache server to be specified via the ${peerhost} setting, e.g.: # Use 192.168.0.1 as hosted cache server set peerhost 192.168.0.1 Note that this simply treats the hosted cache server as a permanently discovered peer for all segments. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Allow PeerDist to be globally enabled or disabledMichael Brown2019-12-131-0/+38
| | | | | | | | | | Allow the use of PeerDist content encoding to be enabled or disabled via the ${peerdist} setting, e.g.: # Disable PeerDist set peerdist 0 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ethernet] Avoid false positive Coverity warningMichael Brown2019-08-171-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add missing call to tls_tx_resume() when restarting negotiationMichael Brown2019-08-161-22/+24
| | | | | | | | | | | | The restart of negotiation triggered by a HelloRequest currently does not call tls_tx_resume() and so may end up leaving the connection in an idle state in which the pending ClientHello is never sent. Fix by calling tls_tx_resume() as part of tls_restart(), since the call to tls_tx_resume() logically belongs alongside the code that sets bits in tls->tx_pending. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Limit number of concurrent raw block downloadsMichael Brown2019-08-161-3/+131
| | | | | | | | | | | | | | | | | Raw block downloads are expensive if the origin server uses HTTPS, since each concurrent download will require local TLS resources (including potentially large received encrypted data buffers). Raw block downloads may also be prohibitively slow to initiate when the origin server is using HTTPS and client certificates. Origin servers for PeerDist downloads are likely to be running IIS, which has a bug that breaks session resumption and requires each connection to go through the full client certificate verification. Limit the total number of concurrent raw block downloads to ameliorate these problems. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [peerdist] Start block download timers from within opener methodsMichael Brown2019-08-161-7/+9
| | | | | | | | | Move the responsibility for starting the block download timers from peerblk_expired() to peerblk_raw_open() and peerblk_retrieval_open(), in preparation for adding the ability to defer calls to peerblk_raw_open() via a block download queue. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [vlan] Provide vlan_netdev_rx() and vlan_netdev_rx_err()Michael Brown2019-04-272-8/+73
| | | | | | | | | The Hermon driver uses vlan_find() to identify the appropriate VLAN device for packets that are received with the VLAN tag already stripped out by the hardware. Generalise this capability and expose it for use by other network card drivers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Display "connecting" status until connection is establishedMichael Brown2019-03-101-0/+21
| | | | | | | | Provide increased visibility into the progress of TCP connections by displaying an explicit "connecting" status message while waiting for the TCP handshake to complete. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Display validator messages only while validation is in progressMichael Brown2019-03-101-3/+9
| | | | | | | Allow the cipherstream to report progress status messages during connection establishment. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Display cross-certificate and OCSP status messagesMichael Brown2019-03-072-8/+82
| | | | | | | | | | | | | TLS connections will almost always create background connections to perform cross-signed certificate downloads and OCSP checks. There is currently no direct visibility into which checks are taking place, which makes troubleshooting difficult in the absence of either a packet capture or a debug build. Use the job progress message buffer to report the current cross-signed certificate download or OCSP status check, where applicable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use x509_name() in validator debug messagesMichael Brown2019-03-071-37/+68
| | | | | | | Display a human-readable certificate name in validator debug messages wherever possible. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support stateless session resumptionMichael Brown2019-03-061-19/+110
| | | | | | | Add support for RFC5077 session ticket extensions to allow for stateless TLS session resumption. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Fix incorrectly duplicated error numberMichael Brown2019-03-061-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support stateful session resumptionMichael Brown2019-02-211-8/+191
| | | | | | | | | | | | | Record the session ID (if any) provided by the server and attempt to reuse it for any concurrent connections to the same server. If multiple connections are initiated concurrently (e.g. when using PeerDist) then defer sending the ClientHello for all but the first connection, to allow time for the first connection to potentially obtain a session ID (and thereby speed up the negotiation for all remaining connections). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [init] Show startup and shutdown function names in debug messagesMichael Brown2019-01-251-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ethernet] Use standard 1500 byte MTU unless explicitly overriddenMichael Brown2018-07-171-0/+1
| | | | | | | | | | | | | Devices that support jumbo frames will currently default to the largest possible MTU. This assumption is valid for virtual adapters such as virtio-net, where the MTU must have been configured by a system administrator, but is unsafe in the general case of a physical adapter. Default to the standard Ethernet MTU, unless explicitly overridden either by the driver or via the ${netX/mtu} setting. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rndis] Clean up error handling path in register_rndis()Michael Brown2018-07-091-41/+61
| | | | | | | | Avoid calling rndis_halt() and rndis->op->close() twice if the call to register_netdev() fails. Reported-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rndis] Register netdev with MAC filledRoman Kagan2018-07-071-9/+9
| | | | | | | | | | register_netdev expects ->hw_addr and ->ll_addr to be already filled, so move it towards the end of register_rndis, after the respective fields have been successfully queried from the underlying device. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Work around stateful authentication schemesMichael Brown2018-06-082-2/+19
| | | | | | | | | | | | | | | | As pointedly documented in RFC7230 section 2.3, HTTP is a stateless protocol: each request message can be understood in isolation from any other requests or responses. Various authentication schemes such as NTLM break this fundamental property of HTTP and rely on the same TCP connection being reused. Work around these broken authentication schemes by ensuring that the most recently pooled connection is reused for the subsequent authentication retry. Reported-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Tested-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Ensure that window change is propagated to plainstream interfaceMichael Brown2018-03-241-2/+7
| | | | | | | | | | | | | | | | The cipherstream xfer_window_changed() message is used to retrigger the TLS transmit state machine. If the transmit state machine is idle, then the window change message will not be propagated to the plainstream interface. This can potentially cause the plainstream interface peer (e.g. httpcore) to block waiting for a window change message that will never arrive. Fix by ensuring that the window change message is propagated to the plainstream interface if the transmit state machine is idle. (If the transmit state machine is not idle then the plainstream window will be zero anyway.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Rename tls_session to tls_connectionMichael Brown2018-03-241-119/+123
| | | | | | | | | | | | In TLS terminology a session conceptually spans multiple individual connections, and essentially represents the stored cryptographic state (master secret and cipher suite) required to establish communication without going through the certificate and key exchange handshakes. Rename tls_session to tls_connection in order to make the name tls_session available to represent the session state. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Ensure received data list is initialised before calling tls_free()Michael Brown2018-03-231-3/+3
| | | | | | | | | | | A failure in tls_generate_random() will result in a call to ref_put() before the received data list has been initialised, which will cause free_tls() to attempt to traverse an uninitialised list. Fix by ensuring that all fields referenced by free_tls() are initialised before any of the potential failure paths. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Check the partner's own state when checking for blocked linksMichael Brown2018-03-191-4/+4
| | | | | | | | The blocked link test in eth_slow_lacp_rx() is performed before the actor TLV is copied to the partner TLV, and so must test the actor state field rather than the partner state field. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Centralise test for whether or not an OCSP check is requiredMichael Brown2018-03-181-2/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tftp] Prevent potential division by zeroMichael Brown2018-03-181-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Fix debug message to match documentationMichael Brown2018-03-181-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [lacp] Mark link as blocked if partner is not yet up and runningMichael Brown2018-03-181-0/+22
| | | | | | | | | | | | Mark the link as blocked if the LACP partner is not reporting itself as being in sync, collecting, and distributing. This matches the behaviour for STP: we mark the link as blocked if we detect that the switch is actively blocking traffic, in order to extend the DHCP discovery period and so prevent boot failures on switches that take an excessively long time to enable ports. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Parse IPv6 address in root pathHannes Reinecke2018-03-011-1/+6
| | | | | | | | | The iSCSI root path may contain a literal IPv6 address. Update the parser to handle this address format correctly. Signed-off-by: Hannes Reinecke <hare@suse.de> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow for domain names within NTLM user namesMichael Brown2018-02-191-3/+22
| | | | | | | | | Allow a NetBIOS domain name to be specified within a URL using a syntax such as: http://domain%5Cusername:password@server/path Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Make netdev_irq_enabled() independent of netdev_irq_supported()Martin Habets2018-01-141-6/+3
| | | | | | | | | | | | | | | | | | The UNDI layer uses the NETDEV_IRQ_ENABLED flag to choose whether to return PXENV_UNDI_ISR_OUT_OURS or PXENV_UNDI_ISR_OUT_NOT_OURS for a given interrupt. For a network device that does not support interrupts, the flag will never be set and so pxenv_undi_isr() will always return PXENV_UNDI_ISR_OUT_NOT_OURS. This causes some NBPs (such as lpxelinux.0) to hang. Redefine NETDEV_IRQ_ENABLED as a simple administrative flag which can be set even on network devices that do not support interrupts. This allows pxenv_undi_isr() (which is the sole user of NETDEV_IRQ_ENABLED) to function as expected by lpxelinux.0. Signed-off-by: Martin Habets <mhabets@solarflare.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit (git 2.34.1) at 2025-02-24 04:16:22 +0000