Add the handling of NC-SI ethernet frames, and add a check at the start
of net_loop() to configure NC-SI before starting other network commands.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
to adjust the root path length.
Eg to 256 from Linux Kernel
Signed-off-by: Andre Kalb <andre.kalb@sma.de>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
[trini: Guard extern so that !CONFIG_NET platforms will build]
Signed-off-by: Tom Rini <trini@konsulko.com>
Nicolas Bidron and Nicolas Guigo reported the two bugs below:
"
----------BUG 1----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.
This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).
Also note that `offset8` here is `0` which leads to `thisfrag = payload`.
```C
} else if (h >= thisfrag) {
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
*newh = *h;
h = newh;
if (h->next_hole)
payload[h->next_hole].prev_hole = (h - payload);
if (h->prev_hole)
payload[h->prev_hole].next_hole = (h - payload);
else
first_hole = (h - payload);
} else {
```
Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.
Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.
### Recommendation
Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).
----------BUG 2----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.
This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.
### Recommendation
Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."
Add a check for ip_len lesser than 28 and stop processing the packet
in this case.
Such a check covers the two reported bugs.
Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
Signed-off-by: Fabio Estevam <festevam@denx.de>
Enabling promiscuous mode can be useful for DSA switches where each port
has its own MAC address.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
DSA stands for Distributed Switch Architecture and it covers switches that
are connected to the CPU through an Ethernet link and generally use frame
tags to pass information about the source/destination ports to/from CPU.
Front panel ports are presented as regular ethernet devices in U-Boot and
they are expected to support the typical networking commands.
DSA switches may be cascaded, DSA class code does not currently support
this.
Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
We use 'priv' for private data but often use 'platdata' for platform data.
We can't really use 'pdata' since that is ambiguous (it could mean private
or platform data).
Rename some of the latter variables to end with 'plat' for consistency.
Signed-off-by: Simon Glass <sjg@chromium.org>
With a define for the magic number of packets received as batch
we can make sure that the EFI network stack caches the same amount
of packets.
Signed-off-by: Patrick Wildt <patrick@blueri.se>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
net_init does not always succeed, and there is no existing mechanism to
discover errors. This patch allows callers of net_init (such as net_init)
to handle errors. The root issue is that eth_get_dev can fail, but
net_init_loop doesn't expose that. The ideal way to fix eth_get_dev would
be to return an error with ERR_PTR, but there are a lot of callers, and all
of them just check if it's NULL. Another approach would be to change the
signature to something like
int eth_get_dev(struct udevice **pdev)
but that would require rewriting all of the many callers.
Signed-off-by: Sean Anderson <seanga2@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit adds a generic udp protocol framework in the
network loop. So protocol based on udp may be implemented
without modifying the network loop (for example custom
wait magic packet).
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
The random_port() routine is not used anywhere else. Make it local to
dns.c to reduce code clutter, and shrink generated code a little.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
We should not use typedefs in U-Boot. They cannot be used as forward
declarations which means that header files must include the full header to
access them.
Drop the typedef and rename the struct to remove the _s suffix which is
now not useful.
This requires quite a few header-file additions.
Signed-off-by: Simon Glass <sjg@chromium.org>
Move this header out of the common header. Network support is used in
quite a few places but it still does not warrant blanket inclusion.
Note that this net.h header itself has quite a lot in it. It could be
split into the driver-mode support, functions, structures, checksumming,
etc.
Signed-off-by: Simon Glass <sjg@chromium.org>
It is bad practice to include common.h in other header files since it can
bring in any number of superfluous definitions. It implies that some C
files don't include it and thus may be missing CONFIG options that are set
up by that file. The C files should include these themselves.
Update some header files in arch/arm to drop this.
Signed-off-by: Simon Glass <sjg@chromium.org>
This introduces support for the NC-SI protocol, modelled as a phy driver
for other ethernet drivers to consume.
NC-SI (Network Controller Sideband Interface) is a protocol to manage a
sideband connection to a proper network interface, for example a BMC
(Baseboard Management Controller) sharing the NIC of the host system.
Probing and configuration occurs by communicating with the "remote" NIC
via NC-SI control frames (Ethernet header 0x88f8).
This implementation is roughly based on the upstream Linux
implementation[0], with a reduced feature set and an emphasis on getting
a link up as fast as possible rather than probing the full possible
topology of the bus.
The current phy model relies on the network being "up", sending NC-SI
command frames via net_send_packet() and receiving them from the
net_loop() loop (added in a following patch).
The ncsi-pkt.h header[1] is copied from the Linux kernel for consistent
field definitions.
[0]: https://github.com/torvalds/linux/tree/master/net/ncsi
[1]: https://github.com/torvalds/linux/blob/master/net/ncsi/ncsi-pkt.h
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Part of the env cleanup moved this out of the environment code and into
the net code. However, this helper is sometimes needed even when the net
stack isn't included.
Move the helper to lib/net_utils.c like it's similarly-purposed
string_to_ip(). Also rename the moved function to similar naming.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reported-by: Ondrej Jirman <megous@megous.com>
This function relates to networking, so move it out of the common.h
header file.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Create a new rand.h header file and move functions into it, to reduce
the size of common.h
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
The net_random_ethaddr() tries to get some entropy from different
startup times of a board. The seed is initialized with get_timer() which
has only a granularity of milliseconds. We can do better if we use
get_ticks() which returns the raw timer ticks. Using this we have a
higher chance of getting different values at startup.
Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This function fits better with the network subsystem, so move it.
Signed-off-by: Simon Glass <sjg@chromium.org>
Suggested-by: Joe Hershberger <joe.hershberger@ni.com>
The inline functions net_read_u32() and net_copy_u32() have been created to
copy unaligned u32. But this is not obvious to the compiler. GCC 9.1
introduces a check -Werror=address-of-packed-member which leads to a build
error on Travis CI:
net/bootp.c: In function ‘dhcp_send_request_packet’:
net/bootp.c:1011:27: error: taking address of packed member of
‘struct bootp_hdr’ may result in an unaligned pointer value
[-Werror=address-of-packed-member]
1011 | net_copy_u32(&bp->bp_id, &bp_offer->bp_id);
Change the type of the function parameters to void * to avoid the build
error.
Reported-by: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
No mainline board enables CONFIG_MCAST_TFTP and there have been
compilation issues with the code for some time. Additionally, it has a
potential buffer underrun issue (reported as a side note in
CVE-2018-18439).
Remove the multicast TFTP code but keep the driver API for the future
addition of IPv6.
Cc: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Signed-off-by: Chris Packham <judge.packham@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
ether_crc was added to the core net code in commit 53a5c424bf
("multicast tftp: RFC2090") so that other drivers could use it. However
the only current user of it is tsec.c so move it there.
Signed-off-by: Chris Packham <judge.packham@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Make it possible to add TCP versions of the same, while reusing
IP portions. This patch should not change any behavior.
Signed-off-by: Duncan Hare <DH@Synoia.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Peter originally sent a fix, but it breaks a number of other things.
This addresses the original reported issue in a different way.
That report was:
> U-Boot has 1 common buffer to send Ethernet frames, pointed to by
> net_tx_packet. When sending to an IP address without knowing the MAC
> address, U-Boot makes an ARP request (using the arp_tx_packet buffer)
> to find out the MAC address of the IP addressr. When a matching ARP
> reply is received, U-Boot continues sending the frame stored in the
> net_tx_packet buffer.
>
> However, in the mean time, if U-Boot needs to send out any network
> packets (e.g. replying ping packets or ARP requests for its own IP
> address etc.), it will use the net_tx_packet buffer to prepare the
> new packet. Thus this buffer is no longer the original packet meant
> to be transmitted after the ARP reply. The original packet will be
> lost.
This instead uses the ARP tx buffer to send async replies in the case
where we are actively waiting for an ARP reply.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reported-by: Tran Tien Dat <peter.trantiendat@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
This single-sources the state of the ARP.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
There are plenty of existing drivers that have macros like ETH_ALEN
defined in their own source files. Now that we imported the kernel's
if_ether.h to U-Boot we can reduce some duplication.
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
The 16 char ethernet name size is inadequate to hold the name of ethernet
name "DPMAC17@rgmii-id", which is a valid name in LX2160AQDS/LX2160ARDB.
Therefore, increase the name string size to 20 chars.
Reported-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Suggested-by: Ioana Ciocoi Radulescu <ruxandra.radulescu@nxp.com>
Signed-off-by: Pankaj Bansal <pankaj.bansal@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
The same basic parsing was implemented in tftp and nfs, so add a helper
function to do the work once.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
For net_boot_common, we allow the serverip to be specified as part of
the boot file name. For net commands that require serverip, include that
source as a valid specification of serverip.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Alexander Graf <agraf@suse.de>
We can call commands like dhcp and bootp without arguments or with
explicit command line arguments that really should tell the code where
to look for files instead.
Unfortunately, the current code simply overwrites command line arguments
in the dhcp case with dhcp values.
This patch allows the code to preserve the command line values if they
were set on the command line. That way the semantics are slightly more
intuitive.
The reason this patch does that by introducing a new variable is that we
can not rely on net_boot_file_name[0] being unset, as today it's
completely legal to call "dhcp" and afterwards run "tftp" and expect the
latter to repeat the same query as before. I would prefer not to break
that behavior in case anyone relies on it.
Signed-off-by: Alexander Graf <agraf@suse.de>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Add a new command 'wol': Wait for an incoming Wake-on-LAN packet or
time out if no WoL packed is received.
If the WoL packet contains a password, it is saved in the environment
variable 'wolpassword' using the etherwake format (dot or colon
separated decimals).
Intended use case: a networked device should boot an alternate image.
It's attached to a network on a client site, modifying the DHCP server
configuration or setup of a tftp server is not allowed.
After power on the device waits a few seconds for a WoL packet. If a
packet is received, the device boots the alternate image. Otherwise
it boots the default image.
This method is a simple way to interact with a system via network even
if only the MAC address is known. Tools to send WoL packets are
available on all common platforms.
Some Ethernet drivers seem to pad the incoming packet. The additional
padding bytes might be recognized as Wake-on-LAN password bytes.
By default enabled in pengwyn_defconfig.
Signed-off-by: Lothar Felten <lothar.felten@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
As part of the main conversion a few files were missed. These files had
additional whitespace after the '*' and before the SPDX tag and my
previous regex was too strict. This time I did a grep for all SPDX tags
and then filtered out anything that matched the correct styles.
Fixes: 83d290c56f ("SPDX: Convert all of our single license tags to Linux Kernel style")
Reported-by: Heinrich Schuchardt <xypron.debian@gmx.de>
Signed-off-by: Tom Rini <trini@konsulko.com>
In order that we can use eth_env_* even when CONFIG_NET isn't set, move
these functions to environment code from net code.
This fixes failures such as:
board/ti/am335x/built-in.o: In function `board_late_init':
board/ti/am335x/board.c:752: undefined reference to `eth_env_set_enetaddr'
u-boot/board/ti/am335x/board.c:766: undefined reference to `eth_env_set_enetaddr'
which caters for use cases such as:
commit f411b5cca4 ("board: am335x: Always set eth/eth1addr environment
variable")
when Ethernet is required in Linux, but not U-Boot.
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
NETCONSOLE isn't compiled in with SPL, so the include file needs to recognize that.
Signed-off-by: Jason Kridner <jdk@ti.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
We are now using an env_ prefix for environment functions. Rename these
other functions as well, for consistency:
getenv_vlan()
getenv_bootm_size()
getenv_bootm_low()
getenv_bootm_mapsize()
env_get_default()
Suggested-by: Wolfgang Denk <wd@denx.de>
Signed-off-by: Simon Glass <sjg@chromium.org>
There was for long time no activity in the 8xx area.
We need to go further and convert to Kconfig, but it
turned out, nobody is interested anymore in 8xx,
so remove it (with a heavy heart, knowing that I remove
here the root of U-Boot).
Signed-off-by: Heiko Schocher <hs@denx.de>
There are various places where the ethernet device name is defined to
several different sizes. Lets add a define and start using it.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
In u-boot printf has been extended with the %pM formatter to allow
printing of MAC addresses. However buffers that want to store a MAC
address cannot safely get the size. Add a define for this case so the
string of a MAC address can be reliably obtained.
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Commit 674bb24982 ("net: cosmetic: Replace magic numbers in arp.c with
constants") introduced a nice define to replace the magic value 6 for
the ethernet hardware address. Replace more hardcoded instances of 6
which really reference the ARP_HLEN (iow the MAC/Hardware/Ethernet
address).
Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
