GRUB uses a static source TCP port and increments for each new connection. When rapidly restarting GRUB this can cause issues with some firewalls that suspect that a reply attack is happening. In addition GRUB does not ACK the last FIN,ACK when booting the kernel and initrd from HTTP for example. This cause the remote HTTP server to keep the TCP session in TIME_WAIT and reject new connections from the same port combination when restarted quickly. This helps to work around both problems by shifting the source port by a small amount based on time.
The missing final ACK should also be addressed, but I'm not sure how to resolve that. Signed-off-by: Robert LeBlanc <rob...@leblancnet.us> --- grub-core/net/tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/grub-core/net/tcp.c b/grub-core/net/tcp.c index 93dee0caa..2eefd3168 100644 --- a/grub-core/net/tcp.c +++ b/grub-core/net/tcp.c @@ -569,7 +569,7 @@ grub_net_tcp_open (char *server, struct grub_net_network_level_interface *inf; grub_net_network_level_address_t gateway; grub_net_tcp_socket_t socket; - static grub_uint16_t in_port = 21550; + grub_uint16_t in_port = 21550 + grub_get_time_ms () % 256; struct grub_net_buff *nb; struct tcphdr *tcph; int i; @@ -603,7 +603,7 @@ grub_net_tcp_open (char *server, socket->inf = inf; socket->out_nla = addr; socket->ll_target_addr = ll_target_addr; - socket->in_port = in_port++; + socket->in_port = in_port; socket->recv_hook = recv_hook; socket->error_hook = error_hook; socket->fin_hook = fin_hook; -- 2.35.1 _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel