2018-05-07 21:02:21 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0
|
2002-10-31 22:12:35 +00:00
|
|
|
/*
|
|
|
|
* Copied from Linux Monitor (LiMon) - Networking.
|
|
|
|
*
|
|
|
|
* Copyright 1994 - 2000 Neil Russell.
|
|
|
|
* (See License)
|
|
|
|
* Copyright 2000 Roland Borde
|
|
|
|
* Copyright 2000 Paolo Scaffardi
|
|
|
|
* Copyright 2000-2002 Wolfgang Denk, wd@denx.de
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* General Desription:
|
|
|
|
*
|
|
|
|
* The user interface supports commands for BOOTP, RARP, and TFTP.
|
|
|
|
* Also, we support ARP internally. Depending on available data,
|
|
|
|
* these interact as follows:
|
|
|
|
*
|
|
|
|
* BOOTP:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* We want: - own IP address
|
|
|
|
* - TFTP server IP address
|
|
|
|
* - name of bootfile
|
|
|
|
* Next step: ARP
|
|
|
|
*
|
2012-05-23 08:00:12 +00:00
|
|
|
* LINK_LOCAL:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* We want: - own IP address
|
|
|
|
* Next step: ARP
|
|
|
|
*
|
2002-10-31 22:12:35 +00:00
|
|
|
* RARP:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* We want: - own IP address
|
|
|
|
* - TFTP server IP address
|
|
|
|
* Next step: ARP
|
|
|
|
*
|
|
|
|
* ARP:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* - own IP address
|
|
|
|
* - TFTP server IP address
|
|
|
|
* We want: - TFTP server ethernet address
|
|
|
|
* Next step: TFTP
|
|
|
|
*
|
|
|
|
* DHCP:
|
|
|
|
*
|
2005-08-12 21:43:12 +00:00
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* We want: - IP, Netmask, ServerIP, Gateway IP
|
|
|
|
* - bootfilename, lease time
|
|
|
|
* Next step: - TFTP
|
2002-10-31 22:12:35 +00:00
|
|
|
*
|
|
|
|
* TFTP:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* - own IP address
|
|
|
|
* - TFTP server IP address
|
|
|
|
* - TFTP server ethernet address
|
|
|
|
* - name of bootfile (if unknown, we use a default name
|
|
|
|
* derived from our own IP address)
|
|
|
|
* We want: - load the boot file
|
|
|
|
* Next step: none
|
2004-02-24 02:00:03 +00:00
|
|
|
*
|
|
|
|
* NFS:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* - own IP address
|
|
|
|
* - name of bootfile (if unknown, we use a default name
|
|
|
|
* derived from our own IP address)
|
|
|
|
* We want: - load the boot file
|
|
|
|
* Next step: none
|
2005-04-01 00:25:43 +00:00
|
|
|
*
|
2018-06-22 20:29:54 +00:00
|
|
|
*
|
|
|
|
* WOL:
|
|
|
|
*
|
|
|
|
* Prerequisites: - own ethernet address
|
|
|
|
* We want: - magic packet or timeout
|
|
|
|
* Next step: none
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
#include <common.h>
|
2020-05-10 17:40:00 +00:00
|
|
|
#include <bootstage.h>
|
2002-10-31 22:12:35 +00:00
|
|
|
#include <command.h>
|
2015-11-09 06:47:45 +00:00
|
|
|
#include <console.h>
|
2019-08-01 15:46:46 +00:00
|
|
|
#include <env.h>
|
2019-08-02 15:44:25 +00:00
|
|
|
#include <env_internal.h>
|
2015-03-22 22:09:24 +00:00
|
|
|
#include <errno.h>
|
2019-12-28 17:45:03 +00:00
|
|
|
#include <image.h>
|
2020-05-10 17:40:05 +00:00
|
|
|
#include <log.h>
|
2002-10-31 22:12:35 +00:00
|
|
|
#include <net.h>
|
2018-05-29 15:30:53 +00:00
|
|
|
#include <net/fastboot.h>
|
2015-08-23 22:21:43 +00:00
|
|
|
#include <net/tftp.h>
|
2022-08-08 12:16:03 +00:00
|
|
|
#include <net/ncsi.h>
|
2019-07-18 18:43:30 +00:00
|
|
|
#if defined(CONFIG_CMD_PCAP)
|
|
|
|
#include <net/pcap.h>
|
|
|
|
#endif
|
2020-09-18 12:13:00 +00:00
|
|
|
#include <net/udp.h>
|
2017-01-19 08:51:45 +00:00
|
|
|
#if defined(CONFIG_LED_STATUS)
|
2003-10-08 22:33:00 +00:00
|
|
|
#include <miiphy.h>
|
2012-05-23 07:58:15 +00:00
|
|
|
#include <status_led.h>
|
2003-10-08 22:33:00 +00:00
|
|
|
#endif
|
2012-05-23 07:58:15 +00:00
|
|
|
#include <watchdog.h>
|
|
|
|
#include <linux/compiler.h>
|
|
|
|
#include "arp.h"
|
|
|
|
#include "bootp.h"
|
2012-05-23 07:57:59 +00:00
|
|
|
#include "cdp.h"
|
2009-07-20 18:53:54 +00:00
|
|
|
#if defined(CONFIG_CMD_DNS)
|
|
|
|
#include "dns.h"
|
|
|
|
#endif
|
2012-05-23 08:00:12 +00:00
|
|
|
#include "link_local.h"
|
2012-05-23 07:58:15 +00:00
|
|
|
#include "nfs.h"
|
2012-05-23 07:58:02 +00:00
|
|
|
#include "ping.h"
|
2012-05-23 07:58:15 +00:00
|
|
|
#include "rarp.h"
|
2018-06-22 20:29:54 +00:00
|
|
|
#if defined(CONFIG_CMD_WOL)
|
|
|
|
#include "wol.h"
|
|
|
|
#endif
|
2022-11-08 06:17:28 +00:00
|
|
|
#include <net/tcp.h>
|
2022-11-08 06:17:29 +00:00
|
|
|
#include <net/wget.h>
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
/** BOOTP EXTENTIONS **/
|
|
|
|
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Our subnet mask (0=unknown) */
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr net_netmask;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Our gateways IP address */
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr net_gateway;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Our DNS IP address */
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr net_dns_server;
|
2007-07-10 03:08:34 +00:00
|
|
|
#if defined(CONFIG_BOOTP_DNS2)
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Our 2nd DNS IP address */
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr net_dns_server2;
|
2011-05-11 03:59:54 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
/** END OF BOOTP EXTENTIONS **/
|
|
|
|
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Our ethernet address */
|
2015-04-08 06:41:04 +00:00
|
|
|
u8 net_ethaddr[6];
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Boot server enet address */
|
2015-04-08 06:41:04 +00:00
|
|
|
u8 net_server_ethaddr[6];
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Our IP addr (0 = unknown) */
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr net_ip;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Server IP addr (0 = unknown) */
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr net_server_ip;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Current receive packet */
|
2015-04-08 06:41:05 +00:00
|
|
|
uchar *net_rx_packet;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Current rx packet length */
|
2015-04-08 06:41:05 +00:00
|
|
|
int net_rx_packet_len;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* IP packet ID */
|
2015-04-08 06:41:21 +00:00
|
|
|
static unsigned net_ip_id;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Ethernet bcast address */
|
2015-04-08 06:41:04 +00:00
|
|
|
const u8 net_bcast_ethaddr[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
|
|
|
|
const u8 net_null_ethaddr[6];
|
2016-05-06 19:01:01 +00:00
|
|
|
#if defined(CONFIG_API) || defined(CONFIG_EFI_LOADER)
|
2015-04-08 06:41:21 +00:00
|
|
|
void (*push_packet)(void *, int len) = 0;
|
2007-12-27 17:19:02 +00:00
|
|
|
#endif
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Network loop state */
|
2012-05-23 07:59:14 +00:00
|
|
|
enum net_loop_state net_state;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Tried all network devices */
|
2015-04-08 06:41:21 +00:00
|
|
|
int net_restart_wrap;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Network loop restarted */
|
2015-04-08 06:41:21 +00:00
|
|
|
static int net_restarted;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* At least one device configured */
|
2015-04-08 06:41:21 +00:00
|
|
|
static int net_dev_exists;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2004-04-18 17:39:38 +00:00
|
|
|
/* XXX in both little & big endian machines 0xFFFF == ntohs(-1) */
|
2011-05-11 03:59:54 +00:00
|
|
|
/* default is without VLAN */
|
2015-04-08 06:41:17 +00:00
|
|
|
ushort net_our_vlan = 0xFFFF;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* ditto */
|
2015-04-08 06:41:17 +00:00
|
|
|
ushort net_native_vlan = 0xFFFF;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Boot File name */
|
2015-09-30 14:12:05 +00:00
|
|
|
char net_boot_file_name[1024];
|
2018-06-15 08:29:27 +00:00
|
|
|
/* Indicates whether the file name was specified on the command line */
|
|
|
|
bool net_boot_file_name_explicit;
|
2015-04-08 06:41:02 +00:00
|
|
|
/* The actual transferred size of the bootfile (in bytes) */
|
|
|
|
u32 net_boot_file_size;
|
|
|
|
/* Boot file size in blocks as reported by the DHCP server */
|
|
|
|
u32 net_boot_file_expected_size_in_blocks;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2015-04-08 06:41:05 +00:00
|
|
|
static uchar net_pkt_buf[(PKTBUFSRX+1) * PKTSIZE_ALIGN + PKTALIGN];
|
2015-03-22 22:09:11 +00:00
|
|
|
/* Receive packets */
|
|
|
|
uchar *net_rx_packets[PKTBUFSRX];
|
2012-05-23 07:59:15 +00:00
|
|
|
/* Current UDP RX packet handler */
|
|
|
|
static rxhand_f *udp_packet_handler;
|
|
|
|
/* Current ARP RX packet handler */
|
|
|
|
static rxhand_f *arp_packet_handler;
|
2011-10-26 14:18:38 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPPUT
|
2012-05-23 07:59:15 +00:00
|
|
|
/* Current ICMP rx handler */
|
|
|
|
static rxhand_icmp_f *packet_icmp_handler;
|
2011-10-26 14:18:38 +00:00
|
|
|
#endif
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Current timeout handler */
|
2015-04-08 06:41:21 +00:00
|
|
|
static thand_f *time_handler;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Time base value */
|
2015-04-08 06:41:21 +00:00
|
|
|
static ulong time_start;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* Current timeout value */
|
2015-04-08 06:41:21 +00:00
|
|
|
static ulong time_delta;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* THE transmit packet */
|
2015-04-08 06:41:05 +00:00
|
|
|
uchar *net_tx_packet;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2011-10-24 18:00:02 +00:00
|
|
|
static int net_check_prereq(enum proto_t protocol);
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
static int net_try_count;
|
2009-10-28 21:13:39 +00:00
|
|
|
|
2013-08-13 11:03:05 +00:00
|
|
|
int __maybe_unused net_busy_flag;
|
|
|
|
|
2003-06-05 19:27:42 +00:00
|
|
|
/**********************************************************************/
|
|
|
|
|
2015-05-20 19:27:23 +00:00
|
|
|
static int on_ipaddr(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_ip = string_to_ip(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(ipaddr, on_ipaddr);
|
|
|
|
|
|
|
|
static int on_gatewayip(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_gateway = string_to_ip(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(gatewayip, on_gatewayip);
|
|
|
|
|
|
|
|
static int on_netmask(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_netmask = string_to_ip(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(netmask, on_netmask);
|
|
|
|
|
|
|
|
static int on_serverip(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_server_ip = string_to_ip(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(serverip, on_serverip);
|
|
|
|
|
|
|
|
static int on_nvlan(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_native_vlan = string_to_vlan(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(nvlan, on_nvlan);
|
|
|
|
|
|
|
|
static int on_vlan(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_our_vlan = string_to_vlan(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(vlan, on_vlan);
|
|
|
|
|
|
|
|
#if defined(CONFIG_CMD_DNS)
|
|
|
|
static int on_dnsip(const char *name, const char *value, enum env_op op,
|
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
if (flags & H_PROGRAMMATIC)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
net_dns_server = string_to_ip(value);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
U_BOOT_ENV_CALLBACK(dnsip, on_dnsip);
|
|
|
|
#endif
|
|
|
|
|
2011-10-27 06:24:32 +00:00
|
|
|
/*
|
|
|
|
* Check if autoload is enabled. If so, use either NFS or TFTP to download
|
|
|
|
* the boot file.
|
|
|
|
*/
|
|
|
|
void net_auto_load(void)
|
|
|
|
{
|
2019-12-06 00:35:07 +00:00
|
|
|
#if defined(CONFIG_CMD_NFS) && !defined(CONFIG_SPL_BUILD)
|
2017-08-03 18:22:12 +00:00
|
|
|
const char *s = env_get("autoload");
|
2011-10-27 06:24:32 +00:00
|
|
|
|
2012-12-12 04:16:22 +00:00
|
|
|
if (s != NULL && strcmp(s, "NFS") == 0) {
|
2018-07-04 00:36:40 +00:00
|
|
|
if (net_check_prereq(NFS)) {
|
|
|
|
/* We aren't expecting to get a serverip, so just accept the assigned IP */
|
2021-12-18 18:27:52 +00:00
|
|
|
if (IS_ENABLED(CONFIG_BOOTP_SERVERIP)) {
|
|
|
|
net_set_state(NETLOOP_SUCCESS);
|
|
|
|
} else {
|
|
|
|
printf("Cannot autoload with NFS\n");
|
|
|
|
net_set_state(NETLOOP_FAIL);
|
|
|
|
}
|
2018-07-04 00:36:40 +00:00
|
|
|
return;
|
|
|
|
}
|
2012-12-12 04:16:22 +00:00
|
|
|
/*
|
|
|
|
* Use NFS to load the bootfile.
|
|
|
|
*/
|
2015-04-08 06:41:10 +00:00
|
|
|
nfs_start();
|
2012-12-12 04:16:22 +00:00
|
|
|
return;
|
|
|
|
}
|
2011-10-27 06:24:32 +00:00
|
|
|
#endif
|
2017-08-03 18:22:13 +00:00
|
|
|
if (env_get_yesno("autoload") == 0) {
|
2012-12-12 04:16:22 +00:00
|
|
|
/*
|
|
|
|
* Just use BOOTP/RARP to configure system;
|
|
|
|
* Do not use TFTP to load the bootfile.
|
|
|
|
*/
|
|
|
|
net_set_state(NETLOOP_SUCCESS);
|
|
|
|
return;
|
2011-10-27 06:24:32 +00:00
|
|
|
}
|
2018-07-04 00:36:40 +00:00
|
|
|
if (net_check_prereq(TFTPGET)) {
|
|
|
|
/* We aren't expecting to get a serverip, so just accept the assigned IP */
|
2021-12-18 18:27:52 +00:00
|
|
|
if (IS_ENABLED(CONFIG_BOOTP_SERVERIP)) {
|
|
|
|
net_set_state(NETLOOP_SUCCESS);
|
|
|
|
} else {
|
|
|
|
printf("Cannot autoload with TFTPGET\n");
|
|
|
|
net_set_state(NETLOOP_FAIL);
|
|
|
|
}
|
2018-07-04 00:36:40 +00:00
|
|
|
return;
|
|
|
|
}
|
2015-04-08 06:41:07 +00:00
|
|
|
tftp_start(TFTPGET);
|
2011-10-27 06:24:32 +00:00
|
|
|
}
|
|
|
|
|
2020-09-12 21:45:43 +00:00
|
|
|
static int net_init_loop(void)
|
2009-02-10 08:38:52 +00:00
|
|
|
{
|
2013-05-17 09:41:03 +00:00
|
|
|
if (eth_get_dev())
|
2015-04-08 06:41:04 +00:00
|
|
|
memcpy(net_ethaddr, eth_get_ethaddr(), 6);
|
2020-09-12 21:45:43 +00:00
|
|
|
else
|
|
|
|
/*
|
|
|
|
* Not ideal, but there's no way to get the actual error, and I
|
|
|
|
* don't feel like fixing all the users of eth_get_dev to deal
|
|
|
|
* with errors.
|
|
|
|
*/
|
|
|
|
return -ENONET;
|
2009-04-03 22:43:00 +00:00
|
|
|
|
2020-09-12 21:45:43 +00:00
|
|
|
return 0;
|
2009-02-10 08:38:52 +00:00
|
|
|
}
|
|
|
|
|
2012-05-23 07:59:15 +00:00
|
|
|
static void net_clear_handlers(void)
|
|
|
|
{
|
|
|
|
net_set_udp_handler(NULL);
|
|
|
|
net_set_arp_handler(NULL);
|
2015-04-08 06:41:21 +00:00
|
|
|
net_set_timeout_handler(0, NULL);
|
2012-05-23 07:59:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void net_cleanup_loop(void)
|
|
|
|
{
|
|
|
|
net_clear_handlers();
|
|
|
|
}
|
|
|
|
|
2020-09-12 21:45:43 +00:00
|
|
|
int net_init(void)
|
2012-05-23 07:59:22 +00:00
|
|
|
{
|
|
|
|
static int first_call = 1;
|
|
|
|
|
|
|
|
if (first_call) {
|
|
|
|
/*
|
|
|
|
* Setup packet buffers, aligned correctly.
|
|
|
|
*/
|
|
|
|
int i;
|
|
|
|
|
2015-04-08 06:41:05 +00:00
|
|
|
net_tx_packet = &net_pkt_buf[0] + (PKTALIGN - 1);
|
|
|
|
net_tx_packet -= (ulong)net_tx_packet % PKTALIGN;
|
2015-03-22 22:09:11 +00:00
|
|
|
for (i = 0; i < PKTBUFSRX; i++) {
|
2015-04-08 06:41:05 +00:00
|
|
|
net_rx_packets[i] = net_tx_packet +
|
|
|
|
(i + 1) * PKTSIZE_ALIGN;
|
2015-03-22 22:09:11 +00:00
|
|
|
}
|
2015-04-08 06:41:08 +00:00
|
|
|
arp_init();
|
2012-05-23 07:59:22 +00:00
|
|
|
net_clear_handlers();
|
|
|
|
|
|
|
|
/* Only need to setup buffer pointers once. */
|
|
|
|
first_call = 0;
|
2022-11-08 06:17:28 +00:00
|
|
|
if (IS_ENABLED(CONFIG_PROT_TCP))
|
|
|
|
tcp_set_tcp_state(TCP_CLOSED);
|
2012-05-23 07:59:22 +00:00
|
|
|
}
|
|
|
|
|
2020-09-12 21:45:43 +00:00
|
|
|
return net_init_loop();
|
2012-05-23 07:59:22 +00:00
|
|
|
}
|
|
|
|
|
2002-10-31 22:12:35 +00:00
|
|
|
/**********************************************************************/
|
|
|
|
/*
|
|
|
|
* Main network processing loop.
|
|
|
|
*/
|
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
int net_loop(enum proto_t protocol)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2015-03-22 22:09:24 +00:00
|
|
|
int ret = -EINVAL;
|
2018-05-08 13:55:50 +00:00
|
|
|
enum net_loop_state prev_net_state = net_state;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2020-06-15 09:15:57 +00:00
|
|
|
#if defined(CONFIG_CMD_PING)
|
|
|
|
if (protocol != PING)
|
|
|
|
net_ping_ip.s_addr = 0;
|
|
|
|
#endif
|
2015-04-08 06:41:21 +00:00
|
|
|
net_restarted = 0;
|
|
|
|
net_dev_exists = 0;
|
|
|
|
net_try_count = 1;
|
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop Entry\n");
|
2003-06-05 19:27:42 +00:00
|
|
|
|
2022-08-08 12:16:03 +00:00
|
|
|
#ifdef CONFIG_PHY_NCSI
|
|
|
|
if (phy_interface_is_ncsi() && protocol != NCSI && !ncsi_active()) {
|
|
|
|
printf("%s: configuring NCSI first\n", __func__);
|
|
|
|
if (net_loop(NCSI) < 0)
|
|
|
|
return ret;
|
|
|
|
eth_init_state_only();
|
|
|
|
goto restart;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2011-12-10 11:08:06 +00:00
|
|
|
bootstage_mark_name(BOOTSTAGE_ID_ETH_START, "eth_start");
|
2012-05-23 07:59:22 +00:00
|
|
|
net_init();
|
2020-12-21 03:44:39 +00:00
|
|
|
if (eth_is_on_demand_init()) {
|
2005-04-03 14:52:59 +00:00
|
|
|
eth_halt();
|
2012-08-03 10:59:08 +00:00
|
|
|
eth_set_current();
|
2015-03-22 22:09:24 +00:00
|
|
|
ret = eth_init();
|
|
|
|
if (ret < 0) {
|
2012-08-03 10:59:08 +00:00
|
|
|
eth_halt();
|
2015-03-22 22:09:24 +00:00
|
|
|
return ret;
|
2012-08-03 10:59:08 +00:00
|
|
|
}
|
2015-04-08 06:41:21 +00:00
|
|
|
} else {
|
2015-03-22 22:09:06 +00:00
|
|
|
eth_init_state_only();
|
2015-04-08 06:41:21 +00:00
|
|
|
}
|
2022-08-08 12:16:04 +00:00
|
|
|
|
2002-10-31 22:12:35 +00:00
|
|
|
restart:
|
2013-08-13 11:03:05 +00:00
|
|
|
#ifdef CONFIG_USB_KEYBOARD
|
|
|
|
net_busy_flag = 0;
|
|
|
|
#endif
|
2012-05-23 07:59:14 +00:00
|
|
|
net_set_state(NETLOOP_CONTINUE);
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Start the ball rolling with the given start function. From
|
|
|
|
* here on, this code is a state machine driven by received
|
|
|
|
* packets and timer events.
|
|
|
|
*/
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop Init\n");
|
|
|
|
net_init_loop();
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2011-05-11 03:59:56 +00:00
|
|
|
switch (net_check_prereq(protocol)) {
|
2002-10-31 22:12:35 +00:00
|
|
|
case 1:
|
|
|
|
/* network not configured */
|
2005-04-03 14:52:59 +00:00
|
|
|
eth_halt();
|
2018-05-08 13:55:50 +00:00
|
|
|
net_set_state(prev_net_state);
|
2015-03-22 22:09:24 +00:00
|
|
|
return -ENODEV;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
case 2:
|
|
|
|
/* network device not configured */
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 0:
|
2015-04-08 06:41:21 +00:00
|
|
|
net_dev_exists = 1;
|
2015-04-08 06:41:02 +00:00
|
|
|
net_boot_file_size = 0;
|
2002-10-31 22:12:35 +00:00
|
|
|
switch (protocol) {
|
2020-03-09 14:27:55 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPBOOT
|
2011-10-24 18:00:02 +00:00
|
|
|
case TFTPGET:
|
2011-10-24 18:00:07 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPPUT
|
|
|
|
case TFTPPUT:
|
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
/* always use ARP to get server ethernet address */
|
2015-04-08 06:41:07 +00:00
|
|
|
tftp_start(protocol);
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2020-03-09 14:27:55 +00:00
|
|
|
#endif
|
2011-05-17 00:03:40 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPSRV
|
|
|
|
case TFTPSRV:
|
2015-04-08 06:41:07 +00:00
|
|
|
tftp_start_server();
|
2011-05-17 00:03:40 +00:00
|
|
|
break;
|
|
|
|
#endif
|
2018-05-29 15:30:53 +00:00
|
|
|
#ifdef CONFIG_UDP_FUNCTION_FASTBOOT
|
|
|
|
case FASTBOOT:
|
|
|
|
fastboot_start_server();
|
|
|
|
break;
|
|
|
|
#endif
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_DHCP)
|
2002-10-31 22:12:35 +00:00
|
|
|
case DHCP:
|
2015-04-08 06:41:09 +00:00
|
|
|
bootp_reset();
|
2015-04-08 06:41:01 +00:00
|
|
|
net_ip.s_addr = 0;
|
2015-04-08 06:41:09 +00:00
|
|
|
dhcp_request(); /* Basically same as BOOTP */
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2007-07-10 16:05:02 +00:00
|
|
|
#endif
|
2020-03-09 14:27:55 +00:00
|
|
|
#if defined(CONFIG_CMD_BOOTP)
|
2002-10-31 22:12:35 +00:00
|
|
|
case BOOTP:
|
2015-04-08 06:41:09 +00:00
|
|
|
bootp_reset();
|
2015-04-08 06:41:01 +00:00
|
|
|
net_ip.s_addr = 0;
|
2015-04-08 06:41:09 +00:00
|
|
|
bootp_request();
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2020-03-09 14:27:55 +00:00
|
|
|
#endif
|
2010-09-30 16:25:48 +00:00
|
|
|
#if defined(CONFIG_CMD_RARP)
|
2002-10-31 22:12:35 +00:00
|
|
|
case RARP:
|
2015-04-08 06:41:11 +00:00
|
|
|
rarp_try = 0;
|
2015-04-08 06:41:01 +00:00
|
|
|
net_ip.s_addr = 0;
|
2015-04-08 06:41:11 +00:00
|
|
|
rarp_request();
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2010-09-30 16:25:48 +00:00
|
|
|
#endif
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_PING)
|
2003-06-05 19:27:42 +00:00
|
|
|
case PING:
|
2012-05-23 07:58:02 +00:00
|
|
|
ping_start();
|
2003-06-05 19:27:42 +00:00
|
|
|
break;
|
2004-02-24 02:00:03 +00:00
|
|
|
#endif
|
2019-12-06 00:35:07 +00:00
|
|
|
#if defined(CONFIG_CMD_NFS) && !defined(CONFIG_SPL_BUILD)
|
2004-02-24 02:00:03 +00:00
|
|
|
case NFS:
|
2015-04-08 06:41:10 +00:00
|
|
|
nfs_start();
|
2004-02-24 02:00:03 +00:00
|
|
|
break;
|
2004-04-15 21:48:45 +00:00
|
|
|
#endif
|
2022-11-08 06:17:29 +00:00
|
|
|
#if defined(CONFIG_CMD_WGET)
|
|
|
|
case WGET:
|
|
|
|
wget_start();
|
|
|
|
break;
|
|
|
|
#endif
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_CDP)
|
2004-04-15 21:48:45 +00:00
|
|
|
case CDP:
|
2015-04-08 06:41:14 +00:00
|
|
|
cdp_start();
|
2004-04-15 21:48:45 +00:00
|
|
|
break;
|
2004-08-02 21:11:11 +00:00
|
|
|
#endif
|
2017-07-20 08:10:55 +00:00
|
|
|
#if defined(CONFIG_NETCONSOLE) && !defined(CONFIG_SPL_BUILD)
|
2004-08-02 21:11:11 +00:00
|
|
|
case NETCONS:
|
2015-04-08 06:41:16 +00:00
|
|
|
nc_start();
|
2004-08-02 21:11:11 +00:00
|
|
|
break;
|
2005-04-01 00:25:43 +00:00
|
|
|
#endif
|
2009-07-20 18:53:54 +00:00
|
|
|
#if defined(CONFIG_CMD_DNS)
|
|
|
|
case DNS:
|
2015-04-08 06:41:15 +00:00
|
|
|
dns_start();
|
2009-07-20 18:53:54 +00:00
|
|
|
break;
|
2012-05-23 08:00:12 +00:00
|
|
|
#endif
|
|
|
|
#if defined(CONFIG_CMD_LINK_LOCAL)
|
|
|
|
case LINKLOCAL:
|
|
|
|
link_local_start();
|
|
|
|
break;
|
2018-06-22 20:29:54 +00:00
|
|
|
#endif
|
|
|
|
#if defined(CONFIG_CMD_WOL)
|
|
|
|
case WOL:
|
|
|
|
wol_start();
|
|
|
|
break;
|
2022-08-08 12:16:03 +00:00
|
|
|
#endif
|
|
|
|
#if defined(CONFIG_PHY_NCSI)
|
|
|
|
case NCSI:
|
|
|
|
ncsi_probe_packages();
|
|
|
|
break;
|
2003-06-05 19:27:42 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2020-09-18 12:13:00 +00:00
|
|
|
if (IS_ENABLED(CONFIG_PROT_UDP) && protocol == UDP)
|
|
|
|
udp_start();
|
|
|
|
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_MII) || defined(CONFIG_CMD_MII)
|
2011-05-11 03:59:54 +00:00
|
|
|
#if defined(CONFIG_SYS_FAULT_ECHO_LINK_DOWN) && \
|
2017-01-19 08:51:45 +00:00
|
|
|
defined(CONFIG_LED_STATUS) && \
|
|
|
|
defined(CONFIG_LED_STATUS_RED)
|
2003-10-08 22:33:00 +00:00
|
|
|
/*
|
2003-10-15 23:53:47 +00:00
|
|
|
* Echo the inverted link state to the fault LED.
|
2003-10-08 22:33:00 +00:00
|
|
|
*/
|
2011-05-04 02:40:43 +00:00
|
|
|
if (miiphy_link(eth_get_dev()->name, CONFIG_SYS_FAULT_MII_ADDR))
|
2017-01-19 08:51:45 +00:00
|
|
|
status_led_set(CONFIG_LED_STATUS_RED, CONFIG_LED_STATUS_OFF);
|
2011-05-04 02:40:43 +00:00
|
|
|
else
|
2017-01-19 08:51:45 +00:00
|
|
|
status_led_set(CONFIG_LED_STATUS_RED, CONFIG_LED_STATUS_ON);
|
2008-10-16 13:01:15 +00:00
|
|
|
#endif /* CONFIG_SYS_FAULT_ECHO_LINK_DOWN, ... */
|
2003-10-08 22:33:00 +00:00
|
|
|
#endif /* CONFIG_MII, ... */
|
2013-08-13 11:03:05 +00:00
|
|
|
#ifdef CONFIG_USB_KEYBOARD
|
|
|
|
net_busy_flag = 1;
|
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Main packet reception loop. Loop receiving packets until
|
2012-05-23 07:59:14 +00:00
|
|
|
* someone sets `net_state' to a state that terminates.
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
|
|
|
for (;;) {
|
2022-09-02 12:10:46 +00:00
|
|
|
schedule();
|
2015-12-21 22:31:35 +00:00
|
|
|
if (arp_timeout_check() > 0)
|
|
|
|
time_start = get_timer(0);
|
|
|
|
|
2002-10-31 22:12:35 +00:00
|
|
|
/*
|
|
|
|
* Check the ethernet for a new packet. The ethernet
|
|
|
|
* receive routine will process it.
|
2015-03-22 22:09:24 +00:00
|
|
|
* Most drivers return the most recent packet size, but not
|
|
|
|
* errors that may have happened.
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
2008-04-03 15:04:19 +00:00
|
|
|
eth_rx();
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Abort if ctrl-c was pressed.
|
|
|
|
*/
|
|
|
|
if (ctrlc()) {
|
2012-05-23 07:59:24 +00:00
|
|
|
/* cancel any ARP that may not have completed */
|
2015-04-08 06:41:01 +00:00
|
|
|
net_arp_wait_packet_ip.s_addr = 0;
|
2012-05-23 07:59:24 +00:00
|
|
|
|
2012-05-23 07:59:15 +00:00
|
|
|
net_cleanup_loop();
|
2003-06-27 21:31:46 +00:00
|
|
|
eth_halt();
|
2012-08-03 10:59:08 +00:00
|
|
|
/* Invalidate the last protocol */
|
|
|
|
eth_set_last_protocol(BOOTP);
|
|
|
|
|
2011-05-11 03:59:56 +00:00
|
|
|
puts("\nAbort\n");
|
2012-05-23 08:01:04 +00:00
|
|
|
/* include a debug print as well incase the debug
|
|
|
|
messages are directed to stderr */
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop Abort!\n");
|
2015-08-21 06:49:48 +00:00
|
|
|
ret = -EINTR;
|
2011-10-24 18:00:01 +00:00
|
|
|
goto done;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check for a timeout, and run the timeout handler
|
|
|
|
* if we have one.
|
|
|
|
*/
|
2015-04-08 06:41:21 +00:00
|
|
|
if (time_handler &&
|
|
|
|
((get_timer(0) - time_start) > time_delta)) {
|
2002-10-31 22:12:35 +00:00
|
|
|
thand_f *x;
|
|
|
|
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_MII) || defined(CONFIG_CMD_MII)
|
2011-05-11 03:59:56 +00:00
|
|
|
#if defined(CONFIG_SYS_FAULT_ECHO_LINK_DOWN) && \
|
2017-01-19 08:51:45 +00:00
|
|
|
defined(CONFIG_LED_STATUS) && \
|
|
|
|
defined(CONFIG_LED_STATUS_RED)
|
2003-10-08 22:33:00 +00:00
|
|
|
/*
|
2003-10-15 23:53:47 +00:00
|
|
|
* Echo the inverted link state to the fault LED.
|
2003-10-08 22:33:00 +00:00
|
|
|
*/
|
2011-05-11 03:59:56 +00:00
|
|
|
if (miiphy_link(eth_get_dev()->name,
|
2015-04-08 06:41:21 +00:00
|
|
|
CONFIG_SYS_FAULT_MII_ADDR))
|
2017-01-19 08:51:45 +00:00
|
|
|
status_led_set(CONFIG_LED_STATUS_RED,
|
|
|
|
CONFIG_LED_STATUS_OFF);
|
2015-04-08 06:41:21 +00:00
|
|
|
else
|
2017-01-19 08:51:45 +00:00
|
|
|
status_led_set(CONFIG_LED_STATUS_RED,
|
|
|
|
CONFIG_LED_STATUS_ON);
|
2011-05-11 03:59:56 +00:00
|
|
|
#endif /* CONFIG_SYS_FAULT_ECHO_LINK_DOWN, ... */
|
2003-10-08 22:33:00 +00:00
|
|
|
#endif /* CONFIG_MII, ... */
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop timeout\n");
|
|
|
|
x = time_handler;
|
|
|
|
time_handler = (thand_f *)0;
|
2002-10-31 22:12:35 +00:00
|
|
|
(*x)();
|
|
|
|
}
|
|
|
|
|
2015-03-22 22:09:07 +00:00
|
|
|
if (net_state == NETLOOP_FAIL)
|
2015-04-08 06:41:21 +00:00
|
|
|
ret = net_start_again();
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2012-05-23 07:59:14 +00:00
|
|
|
switch (net_state) {
|
2002-10-31 22:12:35 +00:00
|
|
|
case NETLOOP_RESTART:
|
2015-04-08 06:41:21 +00:00
|
|
|
net_restarted = 1;
|
2002-10-31 22:12:35 +00:00
|
|
|
goto restart;
|
|
|
|
|
|
|
|
case NETLOOP_SUCCESS:
|
2012-05-23 07:59:15 +00:00
|
|
|
net_cleanup_loop();
|
2015-04-08 06:41:02 +00:00
|
|
|
if (net_boot_file_size > 0) {
|
|
|
|
printf("Bytes transferred = %d (%x hex)\n",
|
|
|
|
net_boot_file_size, net_boot_file_size);
|
2017-08-03 18:22:10 +00:00
|
|
|
env_set_hex("filesize", net_boot_file_size);
|
2019-12-28 17:45:02 +00:00
|
|
|
env_set_hex("fileaddr", image_load_addr);
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
2022-08-08 12:16:03 +00:00
|
|
|
if (protocol != NETCONS && protocol != NCSI)
|
2012-08-03 10:59:08 +00:00
|
|
|
eth_halt();
|
|
|
|
else
|
|
|
|
eth_halt_state_only();
|
|
|
|
|
|
|
|
eth_set_last_protocol(protocol);
|
|
|
|
|
2015-04-08 06:41:02 +00:00
|
|
|
ret = net_boot_file_size;
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop Success!\n");
|
2011-10-24 18:00:01 +00:00
|
|
|
goto done;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
case NETLOOP_FAIL:
|
2012-05-23 07:59:15 +00:00
|
|
|
net_cleanup_loop();
|
2012-08-03 10:59:08 +00:00
|
|
|
/* Invalidate the last protocol */
|
|
|
|
eth_set_last_protocol(BOOTP);
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop Fail!\n");
|
2018-11-21 14:56:07 +00:00
|
|
|
ret = -ENONET;
|
2011-10-24 18:00:01 +00:00
|
|
|
goto done;
|
2012-05-23 07:59:14 +00:00
|
|
|
|
|
|
|
case NETLOOP_CONTINUE:
|
|
|
|
continue;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
}
|
2011-10-24 18:00:01 +00:00
|
|
|
|
|
|
|
done:
|
2013-08-13 11:03:05 +00:00
|
|
|
#ifdef CONFIG_USB_KEYBOARD
|
|
|
|
net_busy_flag = 0;
|
|
|
|
#endif
|
2011-10-26 14:18:38 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPPUT
|
2011-10-24 18:00:01 +00:00
|
|
|
/* Clear out the handlers */
|
2012-05-23 07:59:15 +00:00
|
|
|
net_set_udp_handler(NULL);
|
2011-10-24 18:00:01 +00:00
|
|
|
net_set_icmp_handler(NULL);
|
2011-10-26 14:18:38 +00:00
|
|
|
#endif
|
2018-05-08 13:55:50 +00:00
|
|
|
net_set_state(prev_net_state);
|
2019-07-18 18:43:30 +00:00
|
|
|
|
|
|
|
#if defined(CONFIG_CMD_PCAP)
|
|
|
|
if (pcap_active())
|
|
|
|
pcap_print_status();
|
|
|
|
#endif
|
2011-10-24 18:00:01 +00:00
|
|
|
return ret;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/**********************************************************************/
|
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
static void start_again_timeout_handler(void)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2012-05-23 07:59:14 +00:00
|
|
|
net_set_state(NETLOOP_RESTART);
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
int net_start_again(void)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2004-04-18 17:39:38 +00:00
|
|
|
char *nretry;
|
2009-10-28 21:13:39 +00:00
|
|
|
int retry_forever = 0;
|
|
|
|
unsigned long retrycnt = 0;
|
2015-03-22 22:09:24 +00:00
|
|
|
int ret;
|
2009-10-28 21:13:39 +00:00
|
|
|
|
2017-08-03 18:22:12 +00:00
|
|
|
nretry = env_get("netretry");
|
2009-10-28 21:13:39 +00:00
|
|
|
if (nretry) {
|
|
|
|
if (!strcmp(nretry, "yes"))
|
|
|
|
retry_forever = 1;
|
|
|
|
else if (!strcmp(nretry, "no"))
|
|
|
|
retrycnt = 0;
|
|
|
|
else if (!strcmp(nretry, "once"))
|
|
|
|
retrycnt = 1;
|
|
|
|
else
|
|
|
|
retrycnt = simple_strtoul(nretry, NULL, 0);
|
2015-03-22 22:09:07 +00:00
|
|
|
} else {
|
|
|
|
retrycnt = 0;
|
|
|
|
retry_forever = 0;
|
|
|
|
}
|
2009-10-28 21:13:39 +00:00
|
|
|
|
2018-03-09 14:29:06 +00:00
|
|
|
if ((!retry_forever) && (net_try_count > retrycnt)) {
|
2009-10-28 21:13:39 +00:00
|
|
|
eth_halt();
|
2012-05-23 07:59:14 +00:00
|
|
|
net_set_state(NETLOOP_FAIL);
|
2015-03-22 22:09:24 +00:00
|
|
|
/*
|
|
|
|
* We don't provide a way for the protocol to return an error,
|
|
|
|
* but this is almost always the reason.
|
|
|
|
*/
|
|
|
|
return -ETIMEDOUT;
|
2004-04-15 21:48:45 +00:00
|
|
|
}
|
2009-10-28 21:13:39 +00:00
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
net_try_count++;
|
2009-10-28 21:13:39 +00:00
|
|
|
|
2011-05-11 03:59:56 +00:00
|
|
|
eth_halt();
|
2007-12-27 15:58:41 +00:00
|
|
|
#if !defined(CONFIG_NET_DO_NOT_TRY_ANOTHER)
|
2015-04-08 06:41:21 +00:00
|
|
|
eth_try_another(!net_restarted);
|
2007-12-27 15:58:41 +00:00
|
|
|
#endif
|
2015-03-22 22:09:24 +00:00
|
|
|
ret = eth_init();
|
2015-04-08 06:41:21 +00:00
|
|
|
if (net_restart_wrap) {
|
|
|
|
net_restart_wrap = 0;
|
|
|
|
if (net_dev_exists) {
|
|
|
|
net_set_timeout_handler(10000UL,
|
|
|
|
start_again_timeout_handler);
|
2012-05-23 07:59:15 +00:00
|
|
|
net_set_udp_handler(NULL);
|
2004-04-18 17:39:38 +00:00
|
|
|
} else {
|
2012-05-23 07:59:14 +00:00
|
|
|
net_set_state(NETLOOP_FAIL);
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
2004-04-18 17:39:38 +00:00
|
|
|
} else {
|
2012-05-23 07:59:14 +00:00
|
|
|
net_set_state(NETLOOP_RESTART);
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
2015-03-22 22:09:24 +00:00
|
|
|
return ret;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/**********************************************************************/
|
|
|
|
/*
|
|
|
|
* Miscelaneous bits.
|
|
|
|
*/
|
|
|
|
|
2012-05-23 07:59:15 +00:00
|
|
|
static void dummy_handler(uchar *pkt, unsigned dport,
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr sip, unsigned sport,
|
2012-05-23 07:59:15 +00:00
|
|
|
unsigned len)
|
2012-05-23 07:58:01 +00:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2012-05-23 07:59:15 +00:00
|
|
|
rxhand_f *net_get_udp_handler(void)
|
|
|
|
{
|
|
|
|
return udp_packet_handler;
|
|
|
|
}
|
2012-05-23 07:58:01 +00:00
|
|
|
|
2012-05-23 07:59:15 +00:00
|
|
|
void net_set_udp_handler(rxhand_f *f)
|
|
|
|
{
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop UDP handler set (%p)\n", f);
|
2012-05-23 07:59:15 +00:00
|
|
|
if (f == NULL)
|
|
|
|
udp_packet_handler = dummy_handler;
|
|
|
|
else
|
|
|
|
udp_packet_handler = f;
|
|
|
|
}
|
|
|
|
|
|
|
|
rxhand_f *net_get_arp_handler(void)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2012-05-23 07:59:15 +00:00
|
|
|
return arp_packet_handler;
|
|
|
|
}
|
|
|
|
|
|
|
|
void net_set_arp_handler(rxhand_f *f)
|
|
|
|
{
|
2015-04-08 06:41:21 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE, "--- net_loop ARP handler set (%p)\n", f);
|
2012-05-23 07:59:15 +00:00
|
|
|
if (f == NULL)
|
|
|
|
arp_packet_handler = dummy_handler;
|
|
|
|
else
|
|
|
|
arp_packet_handler = f;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
2011-10-26 14:18:38 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPPUT
|
2011-10-24 18:00:01 +00:00
|
|
|
void net_set_icmp_handler(rxhand_icmp_f *f)
|
|
|
|
{
|
|
|
|
packet_icmp_handler = f;
|
|
|
|
}
|
2011-10-26 14:18:38 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
void net_set_timeout_handler(ulong iv, thand_f *f)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
|
|
|
if (iv == 0) {
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE,
|
2015-04-08 06:41:21 +00:00
|
|
|
"--- net_loop timeout handler cancelled\n");
|
|
|
|
time_handler = (thand_f *)0;
|
2002-10-31 22:12:35 +00:00
|
|
|
} else {
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_INT_STATE,
|
2015-04-08 06:41:21 +00:00
|
|
|
"--- net_loop timeout handler set (%p)\n", f);
|
|
|
|
time_handler = f;
|
|
|
|
time_start = get_timer(0);
|
|
|
|
time_delta = iv * CONFIG_SYS_HZ / 1000;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-09-26 21:49:02 +00:00
|
|
|
uchar *net_get_async_tx_pkt_buf(void)
|
|
|
|
{
|
|
|
|
if (arp_is_waiting())
|
|
|
|
return arp_tx_packet; /* If we are waiting, we already sent */
|
|
|
|
else
|
|
|
|
return net_tx_packet;
|
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:05 +00:00
|
|
|
int net_send_udp_packet(uchar *ether, struct in_addr dest, int dport, int sport,
|
2012-05-23 07:58:10 +00:00
|
|
|
int payload_len)
|
2018-06-24 22:40:41 +00:00
|
|
|
{
|
|
|
|
return net_send_ip_packet(ether, dest, dport, sport, payload_len,
|
|
|
|
IPPROTO_UDP, 0, 0, 0);
|
|
|
|
}
|
|
|
|
|
2022-11-08 06:17:28 +00:00
|
|
|
#if defined(CONFIG_PROT_TCP)
|
|
|
|
int net_send_tcp_packet(int payload_len, int dport, int sport, u8 action,
|
|
|
|
u32 tcp_seq_num, u32 tcp_ack_num)
|
|
|
|
{
|
|
|
|
return net_send_ip_packet(net_server_ethaddr, net_server_ip, dport,
|
|
|
|
sport, payload_len, IPPROTO_TCP, action,
|
|
|
|
tcp_seq_num, tcp_ack_num);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2018-06-24 22:40:41 +00:00
|
|
|
int net_send_ip_packet(uchar *ether, struct in_addr dest, int dport, int sport,
|
|
|
|
int payload_len, int proto, u8 action, u32 tcp_seq_num,
|
|
|
|
u32 tcp_ack_num)
|
2003-06-05 19:27:42 +00:00
|
|
|
{
|
2004-04-15 21:48:45 +00:00
|
|
|
uchar *pkt;
|
2012-05-23 07:59:08 +00:00
|
|
|
int eth_hdr_size;
|
|
|
|
int pkt_hdr_size;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
/* make sure the net_tx_packet is initialized (net_init() was called) */
|
2015-04-08 06:41:05 +00:00
|
|
|
assert(net_tx_packet != NULL);
|
|
|
|
if (net_tx_packet == NULL)
|
2012-05-23 07:59:22 +00:00
|
|
|
return -1;
|
|
|
|
|
2003-06-05 19:27:42 +00:00
|
|
|
/* convert to new style broadcast */
|
2015-04-08 06:41:01 +00:00
|
|
|
if (dest.s_addr == 0)
|
|
|
|
dest.s_addr = 0xFFFFFFFF;
|
2003-06-05 19:27:42 +00:00
|
|
|
|
|
|
|
/* if broadcast, make the ether address a broadcast and don't do ARP */
|
2015-04-08 06:41:01 +00:00
|
|
|
if (dest.s_addr == 0xFFFFFFFF)
|
2015-04-08 06:41:04 +00:00
|
|
|
ether = (uchar *)net_bcast_ethaddr;
|
2003-06-05 19:27:42 +00:00
|
|
|
|
2015-04-08 06:41:05 +00:00
|
|
|
pkt = (uchar *)net_tx_packet;
|
2012-05-23 07:59:08 +00:00
|
|
|
|
2015-04-08 06:41:05 +00:00
|
|
|
eth_hdr_size = net_set_ether(pkt, ether, PROT_IP);
|
2018-06-24 22:40:41 +00:00
|
|
|
|
|
|
|
switch (proto) {
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
net_set_udp_header(pkt + eth_hdr_size, dest, dport, sport,
|
|
|
|
payload_len);
|
|
|
|
pkt_hdr_size = eth_hdr_size + IP_UDP_HDR_SIZE;
|
|
|
|
break;
|
2022-11-08 06:17:28 +00:00
|
|
|
#if defined(CONFIG_PROT_TCP)
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
pkt_hdr_size = eth_hdr_size
|
|
|
|
+ tcp_set_tcp_header(pkt + eth_hdr_size, dport, sport,
|
|
|
|
payload_len, action, tcp_seq_num,
|
|
|
|
tcp_ack_num);
|
|
|
|
break;
|
|
|
|
#endif
|
2018-06-24 22:40:41 +00:00
|
|
|
default:
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
2003-06-05 19:27:42 +00:00
|
|
|
|
2012-05-23 07:59:24 +00:00
|
|
|
/* if MAC address was not discovered yet, do an ARP request */
|
2015-04-08 06:41:04 +00:00
|
|
|
if (memcmp(ether, net_null_ethaddr, 6) == 0) {
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_DEV_PKT, "sending ARP for %pI4\n", &dest);
|
2009-07-23 07:01:03 +00:00
|
|
|
|
2012-05-23 07:59:08 +00:00
|
|
|
/* save the ip and eth addr for the packet to send after arp */
|
2015-04-08 06:41:01 +00:00
|
|
|
net_arp_wait_packet_ip = dest;
|
2015-04-08 06:41:08 +00:00
|
|
|
arp_wait_packet_ethaddr = ether;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2003-06-05 19:27:42 +00:00
|
|
|
/* size of the waiting packet */
|
2015-04-08 06:41:08 +00:00
|
|
|
arp_wait_tx_packet_size = pkt_hdr_size + payload_len;
|
2003-06-05 19:27:42 +00:00
|
|
|
|
|
|
|
/* and do the ARP request */
|
2015-04-08 06:41:08 +00:00
|
|
|
arp_wait_try = 1;
|
|
|
|
arp_wait_timer_start = get_timer(0);
|
|
|
|
arp_request();
|
2003-06-05 19:27:42 +00:00
|
|
|
return 1; /* waiting */
|
2012-05-23 07:59:08 +00:00
|
|
|
} else {
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_DEV_PKT, "sending UDP to %pI4/%pM\n",
|
2015-04-08 06:41:21 +00:00
|
|
|
&dest, ether);
|
2015-04-08 06:41:05 +00:00
|
|
|
net_send_packet(net_tx_packet, pkt_hdr_size + payload_len);
|
2012-05-23 07:59:08 +00:00
|
|
|
return 0; /* transmitted */
|
2003-06-05 19:27:42 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-08-07 11:58:56 +00:00
|
|
|
#ifdef CONFIG_IP_DEFRAG
|
|
|
|
/*
|
|
|
|
* This function collects fragments in a single packet, according
|
|
|
|
* to the algorithm in RFC815. It returns NULL or the pointer to
|
|
|
|
* a complete packet, in static storage
|
|
|
|
*/
|
2016-08-15 19:42:15 +00:00
|
|
|
#define IP_PKTSIZE (CONFIG_NET_MAXDEFRAG)
|
2009-08-07 11:58:56 +00:00
|
|
|
|
2012-05-23 07:58:05 +00:00
|
|
|
#define IP_MAXUDP (IP_PKTSIZE - IP_HDR_SIZE)
|
2009-08-07 11:58:56 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* this is the packet being assembled, either data or frag control.
|
|
|
|
* Fragments go by 8 bytes, so this union must be 8 bytes long
|
|
|
|
*/
|
|
|
|
struct hole {
|
|
|
|
/* first_byte is address of this structure */
|
|
|
|
u16 last_byte; /* last byte in this hole + 1 (begin of next hole) */
|
|
|
|
u16 next_hole; /* index of next (in 8-b blocks), 0 == none */
|
|
|
|
u16 prev_hole; /* index of prev, 0 == none */
|
|
|
|
u16 unused;
|
|
|
|
};
|
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
|
2009-08-07 11:58:56 +00:00
|
|
|
{
|
2012-05-15 08:59:08 +00:00
|
|
|
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
|
2009-08-07 11:58:56 +00:00
|
|
|
static u16 first_hole, total_len;
|
|
|
|
struct hole *payload, *thisfrag, *h, *newh;
|
2012-05-23 07:58:04 +00:00
|
|
|
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
|
2009-08-07 11:58:56 +00:00
|
|
|
uchar *indata = (uchar *)ip;
|
|
|
|
int offset8, start, len, done = 0;
|
|
|
|
u16 ip_off = ntohs(ip->ip_off);
|
|
|
|
|
net: (actually/better) deal with CVE-2022-{30790,30552}
I hit a strange problem with v2022.10: Sometimes my tftp transfer
would seemingly just hang. It only happened for some files. Moreover,
changing tftpblocksize from 65464 to 65460 or 65000 made it work again
for all the files I tried. So I started suspecting it had something to
do with the file sizes and in particular the way the tftp blocks get
fragmented and reassembled.
v2022.01 showed no problems with any of the files or any value of
tftpblocksize.
Looking at what had changed in net.c or tftp.c since January showed
only one remotely interesting thing, b85d130ea0ca.
So I fired up wireshark on my host to see if somehow one of the
packets would be too small. But no, with both v2022.01 and v2022.10,
the exact same sequence of packets were sent, all but the last of size
1500, and the last being 1280 bytes.
But then it struck me that 1280 is 5*256, so one of the two bytes
on-the-wire is 0 and the other is 5, and when then looking at the code
again the lack of endianness conversion becomes obvious. [ntohs is
both applied to ip->ip_off just above, as well as to ip->ip_len just a
little further down when the "len" is actually computed].
IOWs the current code would falsely reject any packet which happens to
be a multiple of 256 bytes in size, breaking tftp transfers somewhat
randomly, and if it did get one of those "malicious" packets with
ip_len set to, say, 27, it would be seen by this check as being 6912
and hence not rejected.
====
Now, just adding the missing ntohs() would make my initial problem go
away, in that I can now download the file where the last fragment ends
up being 1280 bytes. But there's another bug in the code and/or
analysis: The right-hand side is too strict, in that it is ok for the
last fragment not to have a multiple of 8 bytes as payload - it really
must be ok, because nothing in the IP spec says that IP datagrams must
have a multiple of 8 bytes as payload. And comments in the code also
mention this.
To fix that, replace the comparison with <= IP_HDR_SIZE and add
another check that len is actually a multiple of 8 when the "more
fragments" bit is set - which it necessarily is for the case where
offset8 ends up being 0, since we're only called when
(ip_off & (IP_OFFS | IP_FLAGS_MFRAG)).
====
So, does this fix CVE-2022-30790 for real? It certainly correctly
rejects the POC code which relies on sending a packet of size 27 with
the MFRAG flag set. Can the attack be carried out with a size 27
packet that doesn't set MFRAG (hence must set a non-zero fragment
offset)? I dunno. If we get a packet without MFRAG, we update
h->last_byte in the hole we've found to be start+len, hence we'd enter
one of
if ((h >= thisfrag) && (h->last_byte <= start + len)) {
or
} else if (h->last_byte <= start + len) {
and thus won't reach any of the
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
/* fragment sits in the middle: split the hole */
newh = thisfrag + (len / 8);
IOW these division are now guaranteed to be exact, and thus I think
the scenario in CVE-2022-30790 cannot happen anymore.
====
However, there's a big elephant in the room, which has always been
spelled out in the comments, and which makes me believe that one can
still cause mayhem even with packets whose payloads are all 8-byte
aligned:
This code doesn't deal with a fragment that overlaps with two
different holes (thus being a superset of a previously-received
fragment).
Suppose each character below represents 8 bytes, with D being already
received data, H being a hole descriptor (struct hole), h being
non-populated chunks, and P representing where the payload of a just
received packet should go:
DDDHhhhhDDDDHhhhDDDD
PPPPPPPPP
I'm pretty sure in this case we'd end up with h being the first hole,
enter the simple
} else if (h->last_byte <= start + len) {
/* overlaps with final part of the hole: shorten this hole */
h->last_byte = start;
case, and thus in the memcpy happily overwrite the second H with our
chosen payload. This is probably worth fixing...
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-10-14 17:43:39 +00:00
|
|
|
/*
|
|
|
|
* Calling code already rejected <, but we don't have to deal
|
|
|
|
* with an IP fragment with no payload.
|
|
|
|
*/
|
|
|
|
if (ntohs(ip->ip_len) <= IP_HDR_SIZE)
|
net: Check for the minimum IP fragmented datagram size
Nicolas Bidron and Nicolas Guigo reported the two bugs below:
"
----------BUG 1----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.
This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).
Also note that `offset8` here is `0` which leads to `thisfrag = payload`.
```C
} else if (h >= thisfrag) {
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
*newh = *h;
h = newh;
if (h->next_hole)
payload[h->next_hole].prev_hole = (h - payload);
if (h->prev_hole)
payload[h->prev_hole].next_hole = (h - payload);
else
first_hole = (h - payload);
} else {
```
Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.
Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.
### Recommendation
Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).
----------BUG 2----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.
This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.
### Recommendation
Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."
Add a check for ip_len lesser than 28 and stop processing the packet
in this case.
Such a check covers the two reported bugs.
Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
Signed-off-by: Fabio Estevam <festevam@denx.de>
2022-05-26 14:14:37 +00:00
|
|
|
return NULL;
|
|
|
|
|
2009-08-07 11:58:56 +00:00
|
|
|
/* payload starts after IP header, this fragment is in there */
|
2012-05-23 07:58:05 +00:00
|
|
|
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
|
2009-08-07 11:58:56 +00:00
|
|
|
offset8 = (ip_off & IP_OFFS);
|
|
|
|
thisfrag = payload + offset8;
|
|
|
|
start = offset8 * 8;
|
2012-05-23 07:58:05 +00:00
|
|
|
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
|
2009-08-07 11:58:56 +00:00
|
|
|
|
net: (actually/better) deal with CVE-2022-{30790,30552}
I hit a strange problem with v2022.10: Sometimes my tftp transfer
would seemingly just hang. It only happened for some files. Moreover,
changing tftpblocksize from 65464 to 65460 or 65000 made it work again
for all the files I tried. So I started suspecting it had something to
do with the file sizes and in particular the way the tftp blocks get
fragmented and reassembled.
v2022.01 showed no problems with any of the files or any value of
tftpblocksize.
Looking at what had changed in net.c or tftp.c since January showed
only one remotely interesting thing, b85d130ea0ca.
So I fired up wireshark on my host to see if somehow one of the
packets would be too small. But no, with both v2022.01 and v2022.10,
the exact same sequence of packets were sent, all but the last of size
1500, and the last being 1280 bytes.
But then it struck me that 1280 is 5*256, so one of the two bytes
on-the-wire is 0 and the other is 5, and when then looking at the code
again the lack of endianness conversion becomes obvious. [ntohs is
both applied to ip->ip_off just above, as well as to ip->ip_len just a
little further down when the "len" is actually computed].
IOWs the current code would falsely reject any packet which happens to
be a multiple of 256 bytes in size, breaking tftp transfers somewhat
randomly, and if it did get one of those "malicious" packets with
ip_len set to, say, 27, it would be seen by this check as being 6912
and hence not rejected.
====
Now, just adding the missing ntohs() would make my initial problem go
away, in that I can now download the file where the last fragment ends
up being 1280 bytes. But there's another bug in the code and/or
analysis: The right-hand side is too strict, in that it is ok for the
last fragment not to have a multiple of 8 bytes as payload - it really
must be ok, because nothing in the IP spec says that IP datagrams must
have a multiple of 8 bytes as payload. And comments in the code also
mention this.
To fix that, replace the comparison with <= IP_HDR_SIZE and add
another check that len is actually a multiple of 8 when the "more
fragments" bit is set - which it necessarily is for the case where
offset8 ends up being 0, since we're only called when
(ip_off & (IP_OFFS | IP_FLAGS_MFRAG)).
====
So, does this fix CVE-2022-30790 for real? It certainly correctly
rejects the POC code which relies on sending a packet of size 27 with
the MFRAG flag set. Can the attack be carried out with a size 27
packet that doesn't set MFRAG (hence must set a non-zero fragment
offset)? I dunno. If we get a packet without MFRAG, we update
h->last_byte in the hole we've found to be start+len, hence we'd enter
one of
if ((h >= thisfrag) && (h->last_byte <= start + len)) {
or
} else if (h->last_byte <= start + len) {
and thus won't reach any of the
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
/* fragment sits in the middle: split the hole */
newh = thisfrag + (len / 8);
IOW these division are now guaranteed to be exact, and thus I think
the scenario in CVE-2022-30790 cannot happen anymore.
====
However, there's a big elephant in the room, which has always been
spelled out in the comments, and which makes me believe that one can
still cause mayhem even with packets whose payloads are all 8-byte
aligned:
This code doesn't deal with a fragment that overlaps with two
different holes (thus being a superset of a previously-received
fragment).
Suppose each character below represents 8 bytes, with D being already
received data, H being a hole descriptor (struct hole), h being
non-populated chunks, and P representing where the payload of a just
received packet should go:
DDDHhhhhDDDDHhhhDDDD
PPPPPPPPP
I'm pretty sure in this case we'd end up with h being the first hole,
enter the simple
} else if (h->last_byte <= start + len) {
/* overlaps with final part of the hole: shorten this hole */
h->last_byte = start;
case, and thus in the memcpy happily overwrite the second H with our
chosen payload. This is probably worth fixing...
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-10-14 17:43:39 +00:00
|
|
|
/* All but last fragment must have a multiple-of-8 payload. */
|
|
|
|
if ((len & 7) && (ip_off & IP_FLAGS_MFRAG))
|
|
|
|
return NULL;
|
|
|
|
|
2009-08-07 11:58:56 +00:00
|
|
|
if (start + len > IP_MAXUDP) /* fragment extends too far */
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
if (!total_len || localip->ip_id != ip->ip_id) {
|
|
|
|
/* new (or different) packet, reset structs */
|
|
|
|
total_len = 0xffff;
|
|
|
|
payload[0].last_byte = ~0;
|
|
|
|
payload[0].next_hole = 0;
|
|
|
|
payload[0].prev_hole = 0;
|
|
|
|
first_hole = 0;
|
|
|
|
/* any IP header will work, copy the first we received */
|
2012-05-23 07:58:05 +00:00
|
|
|
memcpy(localip, ip, IP_HDR_SIZE);
|
2009-08-07 11:58:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* What follows is the reassembly algorithm. We use the payload
|
|
|
|
* array as a linked list of hole descriptors, as each hole starts
|
|
|
|
* at a multiple of 8 bytes. However, last byte can be whatever value,
|
|
|
|
* so it is represented as byte count, not as 8-byte blocks.
|
|
|
|
*/
|
|
|
|
|
|
|
|
h = payload + first_hole;
|
|
|
|
while (h->last_byte < start) {
|
|
|
|
if (!h->next_hole) {
|
|
|
|
/* no hole that far away */
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
h = payload + h->next_hole;
|
|
|
|
}
|
|
|
|
|
2010-06-11 17:26:43 +00:00
|
|
|
/* last fragment may be 1..7 bytes, the "+7" forces acceptance */
|
|
|
|
if (offset8 + ((len + 7) / 8) <= h - payload) {
|
2009-08-07 11:58:56 +00:00
|
|
|
/* no overlap with holes (dup fragment?) */
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!(ip_off & IP_FLAGS_MFRAG)) {
|
|
|
|
/* no more fragmentss: truncate this (last) hole */
|
|
|
|
total_len = start + len;
|
|
|
|
h->last_byte = start + len;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2022-10-17 07:52:51 +00:00
|
|
|
* There is some overlap: fix the hole list. This code deals
|
|
|
|
* with a fragment that overlaps with two different holes
|
|
|
|
* (thus being a superset of a previously-received fragment)
|
|
|
|
* by only using the part of the fragment that fits in the
|
|
|
|
* first hole.
|
2009-08-07 11:58:56 +00:00
|
|
|
*/
|
2022-10-17 07:52:51 +00:00
|
|
|
if (h->last_byte < start + len)
|
|
|
|
len = h->last_byte - start;
|
2009-08-07 11:58:56 +00:00
|
|
|
|
2011-05-11 03:59:56 +00:00
|
|
|
if ((h >= thisfrag) && (h->last_byte <= start + len)) {
|
2009-08-07 11:58:56 +00:00
|
|
|
/* complete overlap with hole: remove hole */
|
|
|
|
if (!h->prev_hole && !h->next_hole) {
|
|
|
|
/* last remaining hole */
|
|
|
|
done = 1;
|
|
|
|
} else if (!h->prev_hole) {
|
|
|
|
/* first hole */
|
|
|
|
first_hole = h->next_hole;
|
|
|
|
payload[h->next_hole].prev_hole = 0;
|
|
|
|
} else if (!h->next_hole) {
|
|
|
|
/* last hole */
|
|
|
|
payload[h->prev_hole].next_hole = 0;
|
|
|
|
} else {
|
|
|
|
/* in the middle of the list */
|
|
|
|
payload[h->next_hole].prev_hole = h->prev_hole;
|
|
|
|
payload[h->prev_hole].next_hole = h->next_hole;
|
|
|
|
}
|
|
|
|
|
|
|
|
} else if (h->last_byte <= start + len) {
|
|
|
|
/* overlaps with final part of the hole: shorten this hole */
|
|
|
|
h->last_byte = start;
|
|
|
|
|
|
|
|
} else if (h >= thisfrag) {
|
|
|
|
/* overlaps with initial part of the hole: move this hole */
|
|
|
|
newh = thisfrag + (len / 8);
|
|
|
|
*newh = *h;
|
|
|
|
h = newh;
|
|
|
|
if (h->next_hole)
|
|
|
|
payload[h->next_hole].prev_hole = (h - payload);
|
|
|
|
if (h->prev_hole)
|
|
|
|
payload[h->prev_hole].next_hole = (h - payload);
|
|
|
|
else
|
|
|
|
first_hole = (h - payload);
|
|
|
|
|
|
|
|
} else {
|
|
|
|
/* fragment sits in the middle: split the hole */
|
|
|
|
newh = thisfrag + (len / 8);
|
|
|
|
*newh = *h;
|
|
|
|
h->last_byte = start;
|
|
|
|
h->next_hole = (newh - payload);
|
|
|
|
newh->prev_hole = (h - payload);
|
|
|
|
if (newh->next_hole)
|
|
|
|
payload[newh->next_hole].prev_hole = (newh - payload);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* finally copy this fragment and possibly return whole packet */
|
2012-05-23 07:58:05 +00:00
|
|
|
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
|
2009-08-07 11:58:56 +00:00
|
|
|
if (!done)
|
|
|
|
return NULL;
|
|
|
|
|
2012-05-23 07:58:05 +00:00
|
|
|
*lenp = total_len + IP_HDR_SIZE;
|
2022-10-14 17:43:40 +00:00
|
|
|
localip->ip_len = htons(*lenp);
|
2009-08-07 11:58:56 +00:00
|
|
|
return localip;
|
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
static inline struct ip_udp_hdr *net_defragment(struct ip_udp_hdr *ip,
|
|
|
|
int *lenp)
|
2009-08-07 11:58:56 +00:00
|
|
|
{
|
|
|
|
u16 ip_off = ntohs(ip->ip_off);
|
|
|
|
if (!(ip_off & (IP_OFFS | IP_FLAGS_MFRAG)))
|
|
|
|
return ip; /* not a fragment */
|
2015-04-08 06:41:21 +00:00
|
|
|
return __net_defragment(ip, lenp);
|
2009-08-07 11:58:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#else /* !CONFIG_IP_DEFRAG */
|
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
static inline struct ip_udp_hdr *net_defragment(struct ip_udp_hdr *ip,
|
|
|
|
int *lenp)
|
2009-08-07 11:58:56 +00:00
|
|
|
{
|
|
|
|
u16 ip_off = ntohs(ip->ip_off);
|
|
|
|
if (!(ip_off & (IP_OFFS | IP_FLAGS_MFRAG)))
|
|
|
|
return ip; /* not a fragment */
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
#endif
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2011-10-24 18:00:00 +00:00
|
|
|
/**
|
|
|
|
* Receive an ICMP packet. We deal with REDIRECT and PING here, and silently
|
|
|
|
* drop others.
|
|
|
|
*
|
|
|
|
* @parma ip IP packet containing the ICMP
|
|
|
|
*/
|
2012-05-23 07:58:04 +00:00
|
|
|
static void receive_icmp(struct ip_udp_hdr *ip, int len,
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr src_ip, struct ethernet_hdr *et)
|
2011-10-24 18:00:00 +00:00
|
|
|
{
|
2012-05-23 07:58:09 +00:00
|
|
|
struct icmp_hdr *icmph = (struct icmp_hdr *)&ip->udp_src;
|
2011-10-24 18:00:00 +00:00
|
|
|
|
|
|
|
switch (icmph->type) {
|
|
|
|
case ICMP_REDIRECT:
|
|
|
|
if (icmph->code != ICMP_REDIR_HOST)
|
|
|
|
return;
|
|
|
|
printf(" ICMP Host Redirect to %pI4 ",
|
2015-04-08 06:41:21 +00:00
|
|
|
&icmph->un.gateway);
|
2011-10-24 18:00:00 +00:00
|
|
|
break;
|
2012-05-23 07:58:02 +00:00
|
|
|
default:
|
2011-10-24 18:00:00 +00:00
|
|
|
#if defined(CONFIG_CMD_PING)
|
2012-05-23 07:58:02 +00:00
|
|
|
ping_receive(et, ip, len);
|
2011-10-24 18:00:00 +00:00
|
|
|
#endif
|
2011-10-26 14:18:38 +00:00
|
|
|
#ifdef CONFIG_CMD_TFTPPUT
|
2011-10-24 18:00:01 +00:00
|
|
|
if (packet_icmp_handler)
|
|
|
|
packet_icmp_handler(icmph->type, icmph->code,
|
2015-04-08 06:41:21 +00:00
|
|
|
ntohs(ip->udp_dst), src_ip,
|
|
|
|
ntohs(ip->udp_src), icmph->un.data,
|
|
|
|
ntohs(ip->udp_len));
|
2011-10-26 14:18:38 +00:00
|
|
|
#endif
|
2011-10-24 18:00:00 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-03-22 22:09:11 +00:00
|
|
|
void net_process_received_packet(uchar *in_packet, int len)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2012-05-23 07:58:06 +00:00
|
|
|
struct ethernet_hdr *et;
|
2012-05-23 07:58:04 +00:00
|
|
|
struct ip_udp_hdr *ip;
|
2015-04-08 06:41:01 +00:00
|
|
|
struct in_addr dst_ip;
|
|
|
|
struct in_addr src_ip;
|
2012-05-23 07:58:12 +00:00
|
|
|
int eth_proto;
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_CDP)
|
2004-04-15 21:48:45 +00:00
|
|
|
int iscdp;
|
|
|
|
#endif
|
|
|
|
ushort cti = 0, vlanid = VLAN_NONE, myvlanid, mynvlanid;
|
|
|
|
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_NET_PKT, "packet received\n");
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2019-07-18 18:43:30 +00:00
|
|
|
#if defined(CONFIG_CMD_PCAP)
|
|
|
|
pcap_post(in_packet, len, false);
|
|
|
|
#endif
|
2015-04-08 06:41:05 +00:00
|
|
|
net_rx_packet = in_packet;
|
|
|
|
net_rx_packet_len = len;
|
2015-03-22 22:09:11 +00:00
|
|
|
et = (struct ethernet_hdr *)in_packet;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
|
|
|
/* too small packet? */
|
|
|
|
if (len < ETHER_HDR_SIZE)
|
|
|
|
return;
|
|
|
|
|
2016-05-06 19:01:01 +00:00
|
|
|
#if defined(CONFIG_API) || defined(CONFIG_EFI_LOADER)
|
2007-12-27 17:19:02 +00:00
|
|
|
if (push_packet) {
|
2015-03-22 22:09:11 +00:00
|
|
|
(*push_packet)(in_packet, len);
|
2007-12-27 17:19:02 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_CDP)
|
2004-04-15 21:48:45 +00:00
|
|
|
/* keep track if packet is CDP */
|
2012-05-23 07:58:00 +00:00
|
|
|
iscdp = is_cdp_packet(et->et_dest);
|
2004-04-15 21:48:45 +00:00
|
|
|
#endif
|
|
|
|
|
2015-04-08 06:41:17 +00:00
|
|
|
myvlanid = ntohs(net_our_vlan);
|
2004-04-15 21:48:45 +00:00
|
|
|
if (myvlanid == (ushort)-1)
|
|
|
|
myvlanid = VLAN_NONE;
|
2015-04-08 06:41:17 +00:00
|
|
|
mynvlanid = ntohs(net_native_vlan);
|
2004-04-15 21:48:45 +00:00
|
|
|
if (mynvlanid == (ushort)-1)
|
|
|
|
mynvlanid = VLAN_NONE;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2012-05-23 07:58:12 +00:00
|
|
|
eth_proto = ntohs(et->et_protlen);
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2012-05-23 07:58:12 +00:00
|
|
|
if (eth_proto < 1514) {
|
2012-05-23 07:58:06 +00:00
|
|
|
struct e802_hdr *et802 = (struct e802_hdr *)et;
|
2002-10-31 22:12:35 +00:00
|
|
|
/*
|
2012-05-23 07:58:11 +00:00
|
|
|
* Got a 802.2 packet. Check the other protocol field.
|
|
|
|
* XXX VLAN over 802.2+SNAP not implemented!
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
2012-05-23 07:58:12 +00:00
|
|
|
eth_proto = ntohs(et802->et_prot);
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2015-03-22 22:09:11 +00:00
|
|
|
ip = (struct ip_udp_hdr *)(in_packet + E802_HDR_SIZE);
|
2002-10-31 22:12:35 +00:00
|
|
|
len -= E802_HDR_SIZE;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2012-05-23 07:58:12 +00:00
|
|
|
} else if (eth_proto != PROT_VLAN) { /* normal packet */
|
2015-03-22 22:09:11 +00:00
|
|
|
ip = (struct ip_udp_hdr *)(in_packet + ETHER_HDR_SIZE);
|
2002-10-31 22:12:35 +00:00
|
|
|
len -= ETHER_HDR_SIZE;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
|
|
|
} else { /* VLAN packet */
|
2012-05-23 07:58:07 +00:00
|
|
|
struct vlan_ethernet_hdr *vet =
|
|
|
|
(struct vlan_ethernet_hdr *)et;
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_NET_PKT, "VLAN packet received\n");
|
2009-07-23 07:01:03 +00:00
|
|
|
|
2004-04-15 21:48:45 +00:00
|
|
|
/* too small packet? */
|
|
|
|
if (len < VLAN_ETHER_HDR_SIZE)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* if no VLAN active */
|
2015-04-08 06:41:17 +00:00
|
|
|
if ((ntohs(net_our_vlan) & VLAN_IDMASK) == VLAN_NONE
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_CDP)
|
2004-04-15 21:48:45 +00:00
|
|
|
&& iscdp == 0
|
|
|
|
#endif
|
|
|
|
)
|
|
|
|
return;
|
|
|
|
|
|
|
|
cti = ntohs(vet->vet_tag);
|
|
|
|
vlanid = cti & VLAN_IDMASK;
|
2012-05-23 07:58:12 +00:00
|
|
|
eth_proto = ntohs(vet->vet_type);
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2015-03-22 22:09:11 +00:00
|
|
|
ip = (struct ip_udp_hdr *)(in_packet + VLAN_ETHER_HDR_SIZE);
|
2004-04-15 21:48:45 +00:00
|
|
|
len -= VLAN_ETHER_HDR_SIZE;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_NET_PKT, "Receive from protocol 0x%x\n", eth_proto);
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_CDP)
|
2004-04-15 21:48:45 +00:00
|
|
|
if (iscdp) {
|
2012-05-23 07:58:13 +00:00
|
|
|
cdp_receive((uchar *)ip, len);
|
2004-04-15 21:48:45 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
if ((myvlanid & VLAN_IDMASK) != VLAN_NONE) {
|
|
|
|
if (vlanid == VLAN_NONE)
|
|
|
|
vlanid = (mynvlanid & VLAN_IDMASK);
|
|
|
|
/* not matched? */
|
|
|
|
if (vlanid != (myvlanid & VLAN_IDMASK))
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2012-05-23 07:58:12 +00:00
|
|
|
switch (eth_proto) {
|
2002-10-31 22:12:35 +00:00
|
|
|
case PROT_ARP:
|
2015-04-08 06:41:08 +00:00
|
|
|
arp_receive(et, ip, len);
|
2005-01-12 00:15:14 +00:00
|
|
|
break;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2010-09-30 16:25:48 +00:00
|
|
|
#ifdef CONFIG_CMD_RARP
|
2002-10-31 22:12:35 +00:00
|
|
|
case PROT_RARP:
|
2012-05-23 07:58:03 +00:00
|
|
|
rarp_receive(ip, len);
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2010-09-30 16:25:48 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
case PROT_IP:
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_NET_PKT, "Got IP\n");
|
2009-08-07 11:58:56 +00:00
|
|
|
/* Before we start poking the header, make sure it is there */
|
net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr)
While the code mostly/only handles UDP packets, it's possible for the
last fragment of a fragmented UDP packet to be smaller than 28 bytes;
it can be as small as 21 bytes (an IP header plus one byte of
payload). So until we've performed the defragmentation step and thus
know whether we're now holding a full packet, we should only check for
the existence of the fields in the ip header, i.e. that there are at
least 20 bytes present.
In practice, we always seem to be handed a "len" of minimum 60 from the
device layer, i.e. minimal ethernet frame length minus FCS, so this is
mostly theoretical.
After we've fetched the header's claimed length and used that to
update the len variable, check that the header itself claims to be the
minimal possible length.
This is probably how CVE-2022-30552 should have been dealt with in the
first place, because net_defragment() is not the only place that wants
to know the size of the IP datagram payload: If we receive a
non-fragmented ICMP packet, we pass "len" to receive_icmp() which in
turn may pass it to ping_receive() which does
compute_ip_checksum(icmph, len - IP_HDR_SIZE)
and due to the signature of compute_ip_checksum(), that would then
lead to accessing ~4G of address space, very likely leading to a
crash.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-10-14 17:43:38 +00:00
|
|
|
if (len < IP_HDR_SIZE) {
|
2012-05-23 07:58:04 +00:00
|
|
|
debug("len bad %d < %lu\n", len,
|
net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr)
While the code mostly/only handles UDP packets, it's possible for the
last fragment of a fragmented UDP packet to be smaller than 28 bytes;
it can be as small as 21 bytes (an IP header plus one byte of
payload). So until we've performed the defragmentation step and thus
know whether we're now holding a full packet, we should only check for
the existence of the fields in the ip header, i.e. that there are at
least 20 bytes present.
In practice, we always seem to be handed a "len" of minimum 60 from the
device layer, i.e. minimal ethernet frame length minus FCS, so this is
mostly theoretical.
After we've fetched the header's claimed length and used that to
update the len variable, check that the header itself claims to be the
minimal possible length.
This is probably how CVE-2022-30552 should have been dealt with in the
first place, because net_defragment() is not the only place that wants
to know the size of the IP datagram payload: If we receive a
non-fragmented ICMP packet, we pass "len" to receive_icmp() which in
turn may pass it to ping_receive() which does
compute_ip_checksum(icmph, len - IP_HDR_SIZE)
and due to the signature of compute_ip_checksum(), that would then
lead to accessing ~4G of address space, very likely leading to a
crash.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-10-14 17:43:38 +00:00
|
|
|
(ulong)IP_HDR_SIZE);
|
2002-10-31 22:12:35 +00:00
|
|
|
return;
|
|
|
|
}
|
2009-08-07 11:58:56 +00:00
|
|
|
/* Check the packet length */
|
2002-10-31 22:12:35 +00:00
|
|
|
if (len < ntohs(ip->ip_len)) {
|
2012-05-23 08:01:04 +00:00
|
|
|
debug("len bad %d < %d\n", len, ntohs(ip->ip_len));
|
2002-10-31 22:12:35 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
len = ntohs(ip->ip_len);
|
net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr)
While the code mostly/only handles UDP packets, it's possible for the
last fragment of a fragmented UDP packet to be smaller than 28 bytes;
it can be as small as 21 bytes (an IP header plus one byte of
payload). So until we've performed the defragmentation step and thus
know whether we're now holding a full packet, we should only check for
the existence of the fields in the ip header, i.e. that there are at
least 20 bytes present.
In practice, we always seem to be handed a "len" of minimum 60 from the
device layer, i.e. minimal ethernet frame length minus FCS, so this is
mostly theoretical.
After we've fetched the header's claimed length and used that to
update the len variable, check that the header itself claims to be the
minimal possible length.
This is probably how CVE-2022-30552 should have been dealt with in the
first place, because net_defragment() is not the only place that wants
to know the size of the IP datagram payload: If we receive a
non-fragmented ICMP packet, we pass "len" to receive_icmp() which in
turn may pass it to ping_receive() which does
compute_ip_checksum(icmph, len - IP_HDR_SIZE)
and due to the signature of compute_ip_checksum(), that would then
lead to accessing ~4G of address space, very likely leading to a
crash.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-10-14 17:43:38 +00:00
|
|
|
if (len < IP_HDR_SIZE) {
|
|
|
|
debug("bad ip->ip_len %d < %d\n", len, (int)IP_HDR_SIZE);
|
|
|
|
return;
|
|
|
|
}
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_NET_PKT, "len=%d, v=%02x\n",
|
2015-04-08 06:41:21 +00:00
|
|
|
len, ip->ip_hl_v & 0xff);
|
2009-07-23 07:01:03 +00:00
|
|
|
|
2009-08-07 11:58:56 +00:00
|
|
|
/* Can't deal with anything except IPv4 */
|
2011-05-04 02:40:43 +00:00
|
|
|
if ((ip->ip_hl_v & 0xf0) != 0x40)
|
2002-10-31 22:12:35 +00:00
|
|
|
return;
|
2009-08-07 11:58:56 +00:00
|
|
|
/* Can't deal with IP options (headers != 20 bytes) */
|
2022-10-14 17:43:37 +00:00
|
|
|
if ((ip->ip_hl_v & 0x0f) != 0x05)
|
2008-06-03 13:48:17 +00:00
|
|
|
return;
|
2009-08-07 11:58:56 +00:00
|
|
|
/* Check the Checksum of the header */
|
2015-01-20 05:16:08 +00:00
|
|
|
if (!ip_checksum_ok((uchar *)ip, IP_HDR_SIZE)) {
|
2012-05-23 08:01:04 +00:00
|
|
|
debug("checksum bad\n");
|
2002-10-31 22:12:35 +00:00
|
|
|
return;
|
|
|
|
}
|
2009-08-07 11:58:56 +00:00
|
|
|
/* If it is not for us, ignore it */
|
2015-04-08 06:41:01 +00:00
|
|
|
dst_ip = net_read_ip(&ip->ip_dst);
|
|
|
|
if (net_ip.s_addr && dst_ip.s_addr != net_ip.s_addr &&
|
|
|
|
dst_ip.s_addr != 0xFFFFFFFF) {
|
2011-05-04 02:40:46 +00:00
|
|
|
return;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
2011-04-18 06:19:50 +00:00
|
|
|
/* Read source IP address for later use */
|
2015-04-08 06:41:01 +00:00
|
|
|
src_ip = net_read_ip(&ip->ip_src);
|
2009-08-07 11:58:56 +00:00
|
|
|
/*
|
|
|
|
* The function returns the unchanged packet if it's not
|
|
|
|
* a fragment, and either the complete packet or NULL if
|
|
|
|
* it is a fragment (if !CONFIG_IP_DEFRAG, it returns NULL)
|
|
|
|
*/
|
2015-04-08 06:41:21 +00:00
|
|
|
ip = net_defragment(ip, &len);
|
2011-05-04 02:40:47 +00:00
|
|
|
if (!ip)
|
2009-08-07 11:58:56 +00:00
|
|
|
return;
|
2002-10-31 22:12:35 +00:00
|
|
|
/*
|
|
|
|
* watch for ICMP host redirects
|
|
|
|
*
|
2003-06-27 21:31:46 +00:00
|
|
|
* There is no real handler code (yet). We just watch
|
|
|
|
* for ICMP host redirect messages. In case anybody
|
|
|
|
* sees these messages: please contact me
|
|
|
|
* (wd@denx.de), or - even better - send me the
|
|
|
|
* necessary fixes :-)
|
2002-10-31 22:12:35 +00:00
|
|
|
*
|
2003-06-27 21:31:46 +00:00
|
|
|
* Note: in all cases where I have seen this so far
|
|
|
|
* it was a problem with the router configuration,
|
|
|
|
* for instance when a router was configured in the
|
|
|
|
* BOOTP reply, but the TFTP server was on the same
|
|
|
|
* subnet. So this is probably a warning that your
|
|
|
|
* configuration might be wrong. But I'm not really
|
|
|
|
* sure if there aren't any other situations.
|
2011-10-24 18:00:01 +00:00
|
|
|
*
|
|
|
|
* Simon Glass <sjg@chromium.org>: We get an ICMP when
|
|
|
|
* we send a tftp packet to a dead connection, or when
|
|
|
|
* there is no server at the other end.
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
|
|
|
if (ip->ip_p == IPPROTO_ICMP) {
|
2011-10-24 18:00:00 +00:00
|
|
|
receive_icmp(ip, len, src_ip, et);
|
|
|
|
return;
|
2022-11-08 06:17:28 +00:00
|
|
|
#if defined(CONFIG_PROT_TCP)
|
|
|
|
} else if (ip->ip_p == IPPROTO_TCP) {
|
|
|
|
debug_cond(DEBUG_DEV_PKT,
|
|
|
|
"TCP PH (to=%pI4, from=%pI4, len=%d)\n",
|
|
|
|
&dst_ip, &src_ip, len);
|
|
|
|
|
|
|
|
rxhand_tcp_f((union tcp_build_pkt *)ip, len);
|
|
|
|
return;
|
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
} else if (ip->ip_p != IPPROTO_UDP) { /* Only UDP packets */
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2022-10-14 17:43:40 +00:00
|
|
|
if (ntohs(ip->udp_len) < UDP_HDR_SIZE || ntohs(ip->udp_len) > len - IP_HDR_SIZE)
|
2019-08-29 13:47:33 +00:00
|
|
|
return;
|
|
|
|
|
2012-05-23 08:01:04 +00:00
|
|
|
debug_cond(DEBUG_DEV_PKT,
|
2015-04-08 06:41:21 +00:00
|
|
|
"received UDP (to=%pI4, from=%pI4, len=%d)\n",
|
|
|
|
&dst_ip, &src_ip, len);
|
2012-05-23 08:01:04 +00:00
|
|
|
|
2021-12-18 18:27:49 +00:00
|
|
|
if (IS_ENABLED(CONFIG_UDP_CHECKSUM) && ip->udp_xsum != 0) {
|
2005-08-12 21:43:12 +00:00
|
|
|
ulong xsum;
|
2019-11-05 11:48:19 +00:00
|
|
|
u8 *sumptr;
|
2005-08-12 18:06:52 +00:00
|
|
|
ushort sumlen;
|
|
|
|
|
|
|
|
xsum = ip->ip_p;
|
|
|
|
xsum += (ntohs(ip->udp_len));
|
2015-04-08 06:41:01 +00:00
|
|
|
xsum += (ntohl(ip->ip_src.s_addr) >> 16) & 0x0000ffff;
|
|
|
|
xsum += (ntohl(ip->ip_src.s_addr) >> 0) & 0x0000ffff;
|
|
|
|
xsum += (ntohl(ip->ip_dst.s_addr) >> 16) & 0x0000ffff;
|
|
|
|
xsum += (ntohl(ip->ip_dst.s_addr) >> 0) & 0x0000ffff;
|
2005-08-12 18:06:52 +00:00
|
|
|
|
|
|
|
sumlen = ntohs(ip->udp_len);
|
2019-11-05 11:48:19 +00:00
|
|
|
sumptr = (u8 *)&ip->udp_src;
|
2005-08-12 18:06:52 +00:00
|
|
|
|
|
|
|
while (sumlen > 1) {
|
2019-11-05 11:48:19 +00:00
|
|
|
/* inlined ntohs() to avoid alignment errors */
|
|
|
|
xsum += (sumptr[0] << 8) + sumptr[1];
|
|
|
|
sumptr += 2;
|
2005-08-12 18:06:52 +00:00
|
|
|
sumlen -= 2;
|
|
|
|
}
|
2019-11-05 11:48:19 +00:00
|
|
|
if (sumlen > 0)
|
|
|
|
xsum += (sumptr[0] << 8) + sumptr[0];
|
2005-08-12 18:06:52 +00:00
|
|
|
while ((xsum >> 16) != 0) {
|
2011-05-11 03:59:54 +00:00
|
|
|
xsum = (xsum & 0x0000ffff) +
|
|
|
|
((xsum >> 16) & 0x0000ffff);
|
2005-08-12 18:06:52 +00:00
|
|
|
}
|
|
|
|
if ((xsum != 0x00000000) && (xsum != 0x0000ffff)) {
|
2008-07-10 23:16:00 +00:00
|
|
|
printf(" UDP wrong checksum %08lx %08x\n",
|
2015-04-08 06:41:21 +00:00
|
|
|
xsum, ntohs(ip->udp_xsum));
|
2005-08-12 18:06:52 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-07-20 08:10:55 +00:00
|
|
|
#if defined(CONFIG_NETCONSOLE) && !defined(CONFIG_SPL_BUILD)
|
2012-05-23 07:58:04 +00:00
|
|
|
nc_input_packet((uchar *)ip + IP_UDP_HDR_SIZE,
|
2015-04-08 06:41:21 +00:00
|
|
|
src_ip,
|
|
|
|
ntohs(ip->udp_dst),
|
|
|
|
ntohs(ip->udp_src),
|
|
|
|
ntohs(ip->udp_len) - UDP_HDR_SIZE);
|
2004-08-02 21:11:11 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
/*
|
2015-04-08 06:41:21 +00:00
|
|
|
* IP header OK. Pass the packet to the current handler.
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
2012-05-23 07:59:15 +00:00
|
|
|
(*udp_packet_handler)((uchar *)ip + IP_UDP_HDR_SIZE,
|
2015-04-08 06:41:21 +00:00
|
|
|
ntohs(ip->udp_dst),
|
|
|
|
src_ip,
|
|
|
|
ntohs(ip->udp_src),
|
|
|
|
ntohs(ip->udp_len) - UDP_HDR_SIZE);
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2018-06-22 20:29:54 +00:00
|
|
|
#ifdef CONFIG_CMD_WOL
|
|
|
|
case PROT_WOL:
|
|
|
|
wol_receive(ip, len);
|
|
|
|
break;
|
2022-08-08 12:16:03 +00:00
|
|
|
#endif
|
|
|
|
#ifdef CONFIG_PHY_NCSI
|
|
|
|
case PROT_NCSI:
|
|
|
|
ncsi_receive(et, ip, len);
|
|
|
|
break;
|
2018-06-22 20:29:54 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/**********************************************************************/
|
|
|
|
|
2011-10-24 18:00:02 +00:00
|
|
|
static int net_check_prereq(enum proto_t protocol)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
|
|
|
switch (protocol) {
|
2004-04-18 17:39:38 +00:00
|
|
|
/* Fall through */
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_PING)
|
2003-06-05 19:27:42 +00:00
|
|
|
case PING:
|
2015-04-08 06:41:01 +00:00
|
|
|
if (net_ping_ip.s_addr == 0) {
|
2011-05-11 03:59:56 +00:00
|
|
|
puts("*** ERROR: ping address not given\n");
|
2011-05-04 02:40:45 +00:00
|
|
|
return 1;
|
2004-04-18 17:39:38 +00:00
|
|
|
}
|
|
|
|
goto common;
|
2004-02-24 02:00:03 +00:00
|
|
|
#endif
|
2009-07-20 18:53:54 +00:00
|
|
|
#if defined(CONFIG_CMD_DNS)
|
|
|
|
case DNS:
|
2015-04-08 06:41:01 +00:00
|
|
|
if (net_dns_server.s_addr == 0) {
|
2009-07-20 18:53:54 +00:00
|
|
|
puts("*** ERROR: DNS server address not given\n");
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
goto common;
|
|
|
|
#endif
|
2020-09-18 12:13:00 +00:00
|
|
|
#if defined(CONFIG_PROT_UDP)
|
|
|
|
case UDP:
|
|
|
|
if (udp_prereq())
|
|
|
|
return 1;
|
|
|
|
goto common;
|
|
|
|
#endif
|
|
|
|
|
2007-07-09 22:45:14 +00:00
|
|
|
#if defined(CONFIG_CMD_NFS)
|
2004-02-24 02:00:03 +00:00
|
|
|
case NFS:
|
2003-06-05 19:27:42 +00:00
|
|
|
#endif
|
2015-04-08 06:41:21 +00:00
|
|
|
/* Fall through */
|
2011-10-24 18:00:02 +00:00
|
|
|
case TFTPGET:
|
2011-10-24 18:00:07 +00:00
|
|
|
case TFTPPUT:
|
2018-07-04 00:36:39 +00:00
|
|
|
if (net_server_ip.s_addr == 0 && !is_serverip_in_cmd()) {
|
2011-05-11 03:59:56 +00:00
|
|
|
puts("*** ERROR: `serverip' not set\n");
|
2011-05-04 02:40:45 +00:00
|
|
|
return 1;
|
2004-04-18 17:39:38 +00:00
|
|
|
}
|
2020-09-18 12:13:02 +00:00
|
|
|
#if defined(CONFIG_CMD_PING) || \
|
2020-09-18 12:13:00 +00:00
|
|
|
defined(CONFIG_CMD_DNS) || defined(CONFIG_PROT_UDP)
|
2011-05-11 03:59:56 +00:00
|
|
|
common:
|
2003-06-05 19:27:42 +00:00
|
|
|
#endif
|
2011-05-01 23:38:40 +00:00
|
|
|
/* Fall through */
|
2003-06-05 19:27:42 +00:00
|
|
|
|
2011-05-01 23:38:40 +00:00
|
|
|
case NETCONS:
|
2018-05-29 15:30:53 +00:00
|
|
|
case FASTBOOT:
|
2011-05-17 00:03:40 +00:00
|
|
|
case TFTPSRV:
|
2015-04-08 06:41:01 +00:00
|
|
|
if (net_ip.s_addr == 0) {
|
2011-05-11 03:59:56 +00:00
|
|
|
puts("*** ERROR: `ipaddr' not set\n");
|
2011-05-04 02:40:45 +00:00
|
|
|
return 1;
|
2004-04-18 17:39:38 +00:00
|
|
|
}
|
|
|
|
/* Fall through */
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2010-09-30 16:25:48 +00:00
|
|
|
#ifdef CONFIG_CMD_RARP
|
2002-10-31 22:12:35 +00:00
|
|
|
case RARP:
|
2022-08-08 12:16:03 +00:00
|
|
|
#endif
|
|
|
|
#ifdef CONFIG_PHY_NCSI
|
|
|
|
case NCSI:
|
2010-09-30 16:25:48 +00:00
|
|
|
#endif
|
2002-10-31 22:12:35 +00:00
|
|
|
case BOOTP:
|
2004-04-15 21:48:45 +00:00
|
|
|
case CDP:
|
2010-09-30 16:25:48 +00:00
|
|
|
case DHCP:
|
2012-05-23 08:00:12 +00:00
|
|
|
case LINKLOCAL:
|
2015-04-08 06:41:04 +00:00
|
|
|
if (memcmp(net_ethaddr, "\0\0\0\0\0\0", 6) == 0) {
|
2011-05-11 03:59:56 +00:00
|
|
|
int num = eth_get_dev_index();
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2004-04-18 17:39:38 +00:00
|
|
|
switch (num) {
|
|
|
|
case -1:
|
2011-05-11 03:59:56 +00:00
|
|
|
puts("*** ERROR: No ethernet found.\n");
|
2011-05-04 02:40:45 +00:00
|
|
|
return 1;
|
2004-04-18 17:39:38 +00:00
|
|
|
case 0:
|
2011-05-11 03:59:56 +00:00
|
|
|
puts("*** ERROR: `ethaddr' not set\n");
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2004-04-18 17:39:38 +00:00
|
|
|
default:
|
2011-05-11 03:59:56 +00:00
|
|
|
printf("*** ERROR: `eth%daddr' not set\n",
|
2015-04-08 06:41:21 +00:00
|
|
|
num);
|
2002-10-31 22:12:35 +00:00
|
|
|
break;
|
2004-04-18 17:39:38 +00:00
|
|
|
}
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2015-04-08 06:41:21 +00:00
|
|
|
net_start_again();
|
2011-05-04 02:40:45 +00:00
|
|
|
return 2;
|
2004-04-18 17:39:38 +00:00
|
|
|
}
|
|
|
|
/* Fall through */
|
|
|
|
default:
|
2011-05-04 02:40:45 +00:00
|
|
|
return 0;
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
2011-05-04 02:40:45 +00:00
|
|
|
return 0; /* OK */
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
/**********************************************************************/
|
|
|
|
|
2004-04-15 21:48:45 +00:00
|
|
|
int
|
2015-04-08 06:41:05 +00:00
|
|
|
net_eth_hdr_size(void)
|
2004-04-15 21:48:45 +00:00
|
|
|
{
|
|
|
|
ushort myvlanid;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2015-04-08 06:41:17 +00:00
|
|
|
myvlanid = ntohs(net_our_vlan);
|
2004-04-15 21:48:45 +00:00
|
|
|
if (myvlanid == (ushort)-1)
|
|
|
|
myvlanid = VLAN_NONE;
|
|
|
|
|
2011-05-11 03:59:54 +00:00
|
|
|
return ((myvlanid & VLAN_IDMASK) == VLAN_NONE) ? ETHER_HDR_SIZE :
|
|
|
|
VLAN_ETHER_HDR_SIZE;
|
2004-04-15 21:48:45 +00:00
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:05 +00:00
|
|
|
int net_set_ether(uchar *xet, const uchar *dest_ethaddr, uint prot)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2012-05-23 07:58:06 +00:00
|
|
|
struct ethernet_hdr *et = (struct ethernet_hdr *)xet;
|
2004-04-15 21:48:45 +00:00
|
|
|
ushort myvlanid;
|
|
|
|
|
2015-04-08 06:41:17 +00:00
|
|
|
myvlanid = ntohs(net_our_vlan);
|
2004-04-15 21:48:45 +00:00
|
|
|
if (myvlanid == (ushort)-1)
|
|
|
|
myvlanid = VLAN_NONE;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2015-04-08 06:41:04 +00:00
|
|
|
memcpy(et->et_dest, dest_ethaddr, 6);
|
|
|
|
memcpy(et->et_src, net_ethaddr, 6);
|
2004-04-15 21:48:45 +00:00
|
|
|
if ((myvlanid & VLAN_IDMASK) == VLAN_NONE) {
|
2011-05-04 02:40:46 +00:00
|
|
|
et->et_protlen = htons(prot);
|
2004-04-15 21:48:45 +00:00
|
|
|
return ETHER_HDR_SIZE;
|
|
|
|
} else {
|
2012-05-23 07:58:07 +00:00
|
|
|
struct vlan_ethernet_hdr *vet =
|
|
|
|
(struct vlan_ethernet_hdr *)xet;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2004-04-15 21:48:45 +00:00
|
|
|
vet->vet_vlan_type = htons(PROT_VLAN);
|
|
|
|
vet->vet_tag = htons((0 << 5) | (myvlanid & VLAN_IDMASK));
|
|
|
|
vet->vet_type = htons(prot);
|
|
|
|
return VLAN_ETHER_HDR_SIZE;
|
|
|
|
}
|
|
|
|
}
|
2002-10-31 22:12:35 +00:00
|
|
|
|
2012-05-23 07:59:16 +00:00
|
|
|
int net_update_ether(struct ethernet_hdr *et, uchar *addr, uint prot)
|
|
|
|
{
|
|
|
|
ushort protlen;
|
|
|
|
|
|
|
|
memcpy(et->et_dest, addr, 6);
|
2015-04-08 06:41:04 +00:00
|
|
|
memcpy(et->et_src, net_ethaddr, 6);
|
2012-05-23 07:59:16 +00:00
|
|
|
protlen = ntohs(et->et_protlen);
|
|
|
|
if (protlen == PROT_VLAN) {
|
|
|
|
struct vlan_ethernet_hdr *vet =
|
|
|
|
(struct vlan_ethernet_hdr *)et;
|
|
|
|
vet->vet_type = htons(prot);
|
|
|
|
return VLAN_ETHER_HDR_SIZE;
|
|
|
|
} else if (protlen > 1514) {
|
|
|
|
et->et_protlen = htons(prot);
|
|
|
|
return ETHER_HDR_SIZE;
|
|
|
|
} else {
|
|
|
|
/* 802.2 + SNAP */
|
|
|
|
struct e802_hdr *et802 = (struct e802_hdr *)et;
|
|
|
|
et802->et_prot = htons(prot);
|
|
|
|
return E802_HDR_SIZE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-06-24 22:40:41 +00:00
|
|
|
void net_set_ip_header(uchar *pkt, struct in_addr dest, struct in_addr source,
|
|
|
|
u16 pkt_len, u8 proto)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2012-05-23 07:59:07 +00:00
|
|
|
struct ip_udp_hdr *ip = (struct ip_udp_hdr *)pkt;
|
2002-10-31 22:12:35 +00:00
|
|
|
|
|
|
|
/*
|
2012-05-23 07:59:07 +00:00
|
|
|
* Construct an IP header.
|
2002-10-31 22:12:35 +00:00
|
|
|
*/
|
2011-05-11 03:59:54 +00:00
|
|
|
/* IP_HDR_SIZE / 4 (not including UDP) */
|
|
|
|
ip->ip_hl_v = 0x45;
|
2002-10-31 22:12:35 +00:00
|
|
|
ip->ip_tos = 0;
|
2018-06-24 22:40:41 +00:00
|
|
|
ip->ip_len = htons(pkt_len);
|
|
|
|
ip->ip_p = proto;
|
2015-04-08 06:41:21 +00:00
|
|
|
ip->ip_id = htons(net_ip_id++);
|
2008-12-01 22:26:20 +00:00
|
|
|
ip->ip_off = htons(IP_FLAGS_DFRAG); /* Don't fragment */
|
2002-10-31 22:12:35 +00:00
|
|
|
ip->ip_ttl = 255;
|
|
|
|
ip->ip_sum = 0;
|
2011-05-11 03:59:54 +00:00
|
|
|
/* already in network byte order */
|
2015-04-08 06:41:01 +00:00
|
|
|
net_copy_ip((void *)&ip->ip_src, &source);
|
2012-05-23 07:59:07 +00:00
|
|
|
/* already in network byte order */
|
2015-04-08 06:41:01 +00:00
|
|
|
net_copy_ip((void *)&ip->ip_dst, &dest);
|
2018-06-24 22:40:41 +00:00
|
|
|
|
|
|
|
ip->ip_sum = compute_ip_checksum(ip, IP_HDR_SIZE);
|
2012-05-23 07:59:07 +00:00
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:01 +00:00
|
|
|
void net_set_udp_header(uchar *pkt, struct in_addr dest, int dport, int sport,
|
2012-05-23 07:59:07 +00:00
|
|
|
int len)
|
|
|
|
{
|
|
|
|
struct ip_udp_hdr *ip = (struct ip_udp_hdr *)pkt;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the data is an odd number of bytes, zero the
|
|
|
|
* byte after the last byte so that the checksum
|
|
|
|
* will work.
|
|
|
|
*/
|
|
|
|
if (len & 1)
|
|
|
|
pkt[IP_UDP_HDR_SIZE + len] = 0;
|
|
|
|
|
2018-06-24 22:40:41 +00:00
|
|
|
net_set_ip_header(pkt, dest, net_ip, IP_UDP_HDR_SIZE + len,
|
|
|
|
IPPROTO_UDP);
|
2012-05-23 07:59:07 +00:00
|
|
|
|
2002-10-31 22:12:35 +00:00
|
|
|
ip->udp_src = htons(sport);
|
|
|
|
ip->udp_dst = htons(dport);
|
2012-05-23 07:58:04 +00:00
|
|
|
ip->udp_len = htons(UDP_HDR_SIZE + len);
|
2002-10-31 22:12:35 +00:00
|
|
|
ip->udp_xsum = 0;
|
|
|
|
}
|
|
|
|
|
2011-05-11 03:59:56 +00:00
|
|
|
void copy_filename(char *dst, const char *src, int size)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2018-07-04 00:36:41 +00:00
|
|
|
if (src && *src && (*src == '"')) {
|
2002-10-31 22:12:35 +00:00
|
|
|
++src;
|
|
|
|
--size;
|
|
|
|
}
|
|
|
|
|
2018-07-04 00:36:41 +00:00
|
|
|
while ((--size > 0) && src && *src && (*src != '"'))
|
2002-10-31 22:12:35 +00:00
|
|
|
*dst++ = *src++;
|
|
|
|
*dst = '\0';
|
|
|
|
}
|
|
|
|
|
2018-07-04 00:36:39 +00:00
|
|
|
int is_serverip_in_cmd(void)
|
|
|
|
{
|
|
|
|
return !!strchr(net_boot_file_name, ':');
|
|
|
|
}
|
|
|
|
|
2018-07-04 00:36:43 +00:00
|
|
|
int net_parse_bootfile(struct in_addr *ipaddr, char *filename, int max_len)
|
|
|
|
{
|
|
|
|
char *colon;
|
2022-04-16 15:36:43 +00:00
|
|
|
struct in_addr ip;
|
|
|
|
ip.s_addr = 0;
|
2018-07-04 00:36:43 +00:00
|
|
|
|
|
|
|
if (net_boot_file_name[0] == '\0')
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
colon = strchr(net_boot_file_name, ':');
|
|
|
|
if (colon) {
|
2022-04-16 15:36:43 +00:00
|
|
|
ip = string_to_ip(net_boot_file_name);
|
|
|
|
if (ipaddr && ip.s_addr)
|
|
|
|
*ipaddr = ip;
|
|
|
|
}
|
|
|
|
if (ip.s_addr) {
|
2018-07-04 00:36:43 +00:00
|
|
|
strncpy(filename, colon + 1, max_len);
|
|
|
|
} else {
|
|
|
|
strncpy(filename, net_boot_file_name, max_len);
|
|
|
|
}
|
|
|
|
filename[max_len - 1] = '\0';
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:01 +00:00
|
|
|
void ip_to_string(struct in_addr x, char *s)
|
2002-10-31 22:12:35 +00:00
|
|
|
{
|
2015-04-08 06:41:01 +00:00
|
|
|
x.s_addr = ntohl(x.s_addr);
|
2011-05-11 03:59:56 +00:00
|
|
|
sprintf(s, "%d.%d.%d.%d",
|
2015-04-08 06:41:01 +00:00
|
|
|
(int) ((x.s_addr >> 24) & 0xff),
|
|
|
|
(int) ((x.s_addr >> 16) & 0xff),
|
|
|
|
(int) ((x.s_addr >> 8) & 0xff),
|
|
|
|
(int) ((x.s_addr >> 0) & 0xff)
|
2004-04-18 17:39:38 +00:00
|
|
|
);
|
2002-10-31 22:12:35 +00:00
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:17 +00:00
|
|
|
void vlan_to_string(ushort x, char *s)
|
2004-04-15 21:48:45 +00:00
|
|
|
{
|
|
|
|
x = ntohs(x);
|
|
|
|
|
|
|
|
if (x == (ushort)-1)
|
|
|
|
x = VLAN_NONE;
|
|
|
|
|
|
|
|
if (x == VLAN_NONE)
|
|
|
|
strcpy(s, "none");
|
|
|
|
else
|
|
|
|
sprintf(s, "%d", x & VLAN_IDMASK);
|
|
|
|
}
|
|
|
|
|
2015-04-08 06:41:17 +00:00
|
|
|
ushort string_to_vlan(const char *s)
|
2004-04-15 21:48:45 +00:00
|
|
|
{
|
|
|
|
ushort id;
|
|
|
|
|
|
|
|
if (s == NULL)
|
2004-04-25 13:18:40 +00:00
|
|
|
return htons(VLAN_NONE);
|
2004-04-15 21:48:45 +00:00
|
|
|
|
|
|
|
if (*s < '0' || *s > '9')
|
|
|
|
id = VLAN_NONE;
|
|
|
|
else
|
2021-07-24 15:03:30 +00:00
|
|
|
id = (ushort)dectoul(s, NULL);
|
2004-04-15 21:48:45 +00:00
|
|
|
|
2004-04-25 13:18:40 +00:00
|
|
|
return htons(id);
|
2004-04-15 21:48:45 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 18:22:15 +00:00
|
|
|
ushort env_get_vlan(char *var)
|
2004-04-15 21:48:45 +00:00
|
|
|
{
|
2017-08-03 18:22:12 +00:00
|
|
|
return string_to_vlan(env_get(var));
|
2004-04-15 21:48:45 +00:00
|
|
|
}
|