bugGNU GRUB - Bugs: bug #62318, Tftp module should not expect OACK...


You are not allowed to post comments on this tracker with your current authentication level.

bug #62318: Tftp module should not expect OACK packet

Submitter:  Pierre <pierrearm>
Submitted:  Fri 15 Apr 2022 10:15:05 AM UTC
Category:  Network Severity:  Major
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  Git master
Release:  Reproducibility:  None
Planned Release:  None

Fri 15 Apr 2022 10:15:05 AM UTC, original submission:  

I think there is a bug in the tftp module. Here is my setup:
Tftp server:
xinetd daemon used
It contains a file named 'file' containing the string 'salut'.

grub.efi built with the following commands (built from latest master: 37ddd9457f13f92fd176bbb2951cfc1fbc93e6f7 kern/efi/init: Log a console error during a stack check failure):
./configure --target=aarch64-linux-gnu --with-platform=efi  --prefix={path_to_grub_dir}out
make install
grub-mkstandalone -d out/lib/grub/arm64-efi/ -O arm64-efi -o grub.efi

Commands issued after launching grub (the ip of the tftp server is
insmod tftp
insmod efinet
linux (tftp,

> error: time out opening `file'.

I was trying to fetch the file 'file' from the tftp server, which resulted in an error.
In grub-core/net/tftp.c, the tftp module expects to receive an OACK packet and retries GRUB_NET_TRIES (=40) times if no OACK packet is received.

However, from RFC 2347 (https://datatracker.ietf.org/doc/html/rfc2347):
When the client appends options to the end of a Read Request packet,
three possible responses may be returned by the server:
OACK  - acknowledge of Read Request and the options;
DATA  - acknowledge of Read Request, but not the options;
ERROR - the request has been denied.
it is possible for the server to answer to a Read Request packet with a DATA packet. The xinetd daemon answers with a DATA packet (so no OACK). This results in the grub tftp module repeatedly trying to initiate a transfer and finally aborting.
When using the tftpd-hpa dameon, an OACK packet is sent, which results in a working tftp transfer.

I join to wireshark traces. The tftp server is at and the client at
- one when using the xinetd daemon. You can see that the client sends a Read Request packet, the server directly starts sending the content of file, but the client re-sends a Read Request packet (40 times)
- one when using the tftpd-hpa daemon. An OACK packet is sent from the server, and everything works as expected.


Pierre <pierrearm>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #53090:  tftp_hpa.pcapng added by pierrearm (3KiB - application/x-pcapng)
file #53091:  xinetd.pcapng added by pierrearm (68KiB - application/x-pcapng)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by pierrearm (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-04-15 pierrearm Attached File- Added tftp_hpa.pcapng, #53090
        Attached File- Added xinetd.pcapng, #53091

    Back to the top

    Powered by Savane 3.12