Add Networking Support to kboot
Student: Aryan Arora (aryanarora@freebsd.org)
Mentor: Warner Losh (imp@freebsd.org)
Summary
This project introduces a network abstraction layer to libkboot, enabling boot artifacts to be fetched from remote sources without disrupting the existing loading flow. On top of this abstraction, it implements a minimal, bootloader-focused HTTP/1.1 client and HTTPS support via a TLS-backed transport. This allows kboot to support network-based boot workflows through a clean, maintainable, and extensible interface for future network features.
Deliverables
A network abstraction layer in libkboot with Linux socket syscall support and reusable transport primitives.
- A minimal HTTP/1.1 client.
- HTTPS support through a TLS-backed transport.
- A generic streaming sink interface for writing fetched artifacts to memory buffers or files.
- Updated documentation covering configuration, usage, and limitations.
Progress
Done
Vendor musl libc into freebsd
Add build glue for the required musl libc subset in kboot.
Expose resolver and primitive networking ABI from musl libc to kboot.
Write a standalone HTTP/HTTPS(bearssl) client with minimal dependencies before porting it to kboot
- Write file sink implementation for the sink interface.
- Create a minimal python test suite which ports over majority of its tests from curl, to make sure it is consistent with HTTP (was done using Codex)
- Refactor resolv.conf path in musl's getaddrinfo to use the host I/O APIs in kboot rather than musl stdio
Todo
- Refactor exposed musl abi (getting there)
- Port the http client into kboot (in progress)
- Try porting the test suite for the standalone client to kboot and run it using linuxulator (experimental)
- More hardening:
- add a max size bound for line buffer
- restrict to tls1.2?
- make connect non-blocking with timeout
- handle redirects more comprehensively
- Memory sink implementation for the sink interface.
Useful links