mirror of
https://github.com/xcat2/confluent.git
synced 2026-09-11 12:06:26 +00:00
Markus Hilger
fea71a0ce4
reply_dhcp4 declines to answer a PXE boot request unless deployment.useinsecureprotocols is set to firmware or always, but proxydhcp had no such check. A node left at the default of never was therefore still offered a TFTP bootfile and a plain http boot.ipxe URL whenever the request arrived on port 4011 rather than port 67, so the attribute silently did nothing in ProxyDHCP deployments alongside an independent DHCP server. Apply the same gate, including the UEFI HTTP boot exemption, and log the same remediation hint. The node attributes are now fetched once and passed through to get_deployment_profile instead of being looked up again there. Requests whose architecture could not be determined are ignored rather than falling through to the reply. opts_to_dict stops parsing before the client architecture option whenever the message type is not a request, and such a packet would otherwise reach the iPXE branch and be handed a plain http boot.ipxe URL without ever passing the gate.