Thankfully, it turns out that HTTPBoot carries the same flexibility
as PXE with respect to no-ip answer being merged with an IP answer.
As a bonus, it actually is simpler than PXE, allowing skipping of udp
port 4011. Of course, we still want to support PXE boot, so that will
need to be implemented.
filename is ignored if pxeclient anyway. This will provide a
consistent approach for boot file for dhcp-elsewhere and
fixed ip clients alike.
Also add some TODO about how to enable DHCPREQUEST
processing when the time comes, as today the code skipping
option parsing for DISCOVER packets trips up the ability
to continue. We must make sure we don't call discovery
handler again for REQUEST after doing so for DISCOVER.
It d oesn't quite work, but it looks convincing. UDP checksum may
need to be added, and beyond that explore changes to the payload since
it is likely not enough DHCP was provided.
First, IP level sendto doesn't give the freedom to send 25.255.255.255
out of the interface desired. So have to go link layer.
Second, while python can do sendto, we have the interface index number
from recvmsg (which was ctypes). python expects the name instead
(wwhich it promptly turns... back into the index we start with). I
could have added code to get the name using some syscalls which would
have been work and produced more system calls, or added the code to
directly use sendto, which would also be efficient at runtime.
So I chose to use ctypes for both recvmsg and sendto here.
Standards compliant TLS clients require
that IP addresses be compared against
IP type SAN fields.
However, some firmware ignores IP fields and only checks DNS fields.
Workaround and provide compatibility
by duplicating the IP as DNS and IP fields.
Also, clean up the temporary config file when done.
The plan is to have 'discovery'
data only on DISCOVER, but
still parse and be able to react to
REQUEST packets.
Additionally add the attributes
to control deployment state and
permissible protocols.
We have now done IP_PKTINFO, but there is a potential TODO
if wanting to properly honor unicast request.
For now, will just do always-broadcast as the options to do unicast
are more complex to do (either construct the packets or inject neigh
entry manually)
Move from a clock based expiration to a simpler 'once' versus
'continous' model. 'once' is intended to be used generally, 'continuous'
for stateless without benefit of TPM. The goal would be to use TPM
to seal a key to avoid continuous.
The password policy was incorrectly logging out in the
middle of the flow when a forced password change occurred.
Fix by externally managing the web session.
