Pin iPXE to v2.0.0-fog.7 - #1187
Merged
Merged
Conversation
Makes HTTPS netboot work at all against a FOG server whose web
certificate is issued by FOG's own CA -- which is every -S install that
has not supplied a public certificate.
FOG issues its Web CA with a CRITICAL nameConstraints extension, on
purpose: it is what stops a compromised web leaf from being usable to
impersonate anything outside this server's own names. Upstream iPXE has
no parser for that extension, and a critical extension a validator
cannot parse is one it must reject. So the Web CA was rejected before
the leaf was ever considered, and every client died at the first chain
with
Operation not supported (https://ipxe.org/3c16e283)
then reboot-looped. The two available fixes were to stop constraining
the CA, or to teach iPXE the extension. v2.0.0-fog.7 does the second:
permittedSubtrees and excludedSubtrees over dNSName and iPAddress,
enforced across the whole validated path, with constraint types iPXE
cannot evaluate refused at parse time so an unenforceable constraint
fails closed rather than being skipped. Reasoning and the rejected
alternatives: docs/adr/0016-ipxe-enforces-x509-name-constraints.md.
Servers do not self-heal. /tftpboot is only rewritten when the
installer re-runs, and a server that builds iPXE with its own CA
embedded ($rebuildIpxeWithMyCA) needs that rebuild to happen before the
patched code is in its binaries -- the stamp comparison in
_needsLocalIpxeBuild() schedules it automatically off this version
change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes HTTPS netboot work at all against a FOG server whose web certificate is issued by FOG's own CA — which is every
-Sinstall that has not supplied a public certificate.FOG issues its Web CA with a critical
nameConstraintsextension, on purpose: it is what stops a compromised web leaf from being usable to impersonate anything outside this server's own names. Upstream iPXE has no parser for that extension, and a critical extension a validator cannot parse is one it must reject. So the Web CA was rejected before the leaf was ever considered, and every client died at the first chain withthen reboot-looped.
Two fixes were available: stop constraining the CA, or teach iPXE the extension. fog-ipxe#6 does the second —
permittedSubtrees/excludedSubtreesover dNSName and iPAddress, enforced across the whole validated path, with constraint types iPXE cannot evaluate refused at parse time so an unenforceable constraint fails closed rather than being silently skipped. Reasoning and the rejected alternatives are indocs/adr/0016-ipxe-enforces-x509-name-constraints.md(#1184).Verified end to end on a UEFI Secure Boot VM: the stock binary fails to parse the Web CA; the patched one validates the chain and reaches the FOG boot menu over HTTPS.
Servers do not self-heal
/tftpbootis only rewritten when the installer re-runs. A server that builds iPXE with its own CA embedded ($rebuildIpxeWithMyCA) additionally needs that rebuild before the patched code is in its binaries — the stamp comparison in_needsLocalIpxeBuild()schedules it automatically off this version change, because the stamp records the iPXE version it was built from.🤖 Generated with Claude Code