|
| 1 | +--- |
| 2 | +id: tftp-filename-issues |
| 3 | +title: "TFTP Filename Interpretation Issues with Older PXE Clients" |
| 4 | +description: Troubleshooting TFTP filename issues caused by older PXE clients appending extra characters |
| 5 | +hide_table_of_contents: false |
| 6 | +--- |
| 7 | + |
| 8 | +## Problem Description |
| 9 | + |
| 10 | +Older PXE clients (typically 10+ years old) may append extra characters to TFTP filenames, causing "File not found" errors. The issue manifests as Unicode replacement characters (�) or hex bytes (often 0xFF) being added to the end of requested filenames. |
| 11 | + |
| 12 | +## Root Cause |
| 13 | + |
| 14 | +This is a UEFI PXE implementation bug related to DHCP filename handling: |
| 15 | + |
| 16 | +- **Technical Issue**: UEFI PXE clients incorrectly handle DHCP Option 67 (boot filename) |
| 17 | +- **Expected Behavior**: Option 67 should be treated as a variable-length field |
| 18 | +- **Actual Behavior**: Some implementations treat it as a null-terminated string, reading beyond the specified length |
| 19 | +- **Result**: Extra bytes from the DHCP packet get appended to the TFTP filename request |
| 20 | + |
| 21 | +## Affected Hardware/Software |
| 22 | + |
| 23 | +### Hardware |
| 24 | + |
| 25 | +- Jetway J7F4K1G5DS-LF and similar older boards |
| 26 | +- Lenovo T460 laptops |
| 27 | +- Z77X-UD3H motherboards with Atheros NICs |
| 28 | +- Kontron VX3040 Intel CPU boards |
| 29 | +- Generally affects Intel UNDI PXE-2.1 implementations from ~2000 era |
| 30 | + |
| 31 | +### DHCP Servers |
| 32 | + |
| 33 | +**Problematic:** |
| 34 | +- Kea DHCP |
| 35 | +- UniFi USG devices (limited configuration options) |
| 36 | +- pfSense with Kea DHCP |
| 37 | + |
| 38 | +**Working Combinations:** |
| 39 | +- pfSense with deprecated isc-dhcp |
| 40 | +- Properly configured OpnSense/isc-dhcp setups |
| 41 | + |
| 42 | +## Workarounds and Solutions |
| 43 | + |
| 44 | +### 1. Server-Side File Naming (Recommended) |
| 45 | + |
| 46 | +Create boot files with the extra 0xFF byte in the filename: |
| 47 | + |
| 48 | +```bash |
| 49 | +# Rename files to include the extra byte |
| 50 | +mv netboot.xyz.kpxe $(echo -en 'netboot.xyz.kpxe\xFF') |
| 51 | +mv netboot.xyz.efi $(echo -en 'netboot.xyz.efi\xFF') |
| 52 | + |
| 53 | +# Or create symlinks (cleaner approach) |
| 54 | +ln -s netboot.xyz.kpxe $(echo -en 'netboot.xyz.kpxe\xFF') |
| 55 | +ln -s netboot.xyz.efi $(echo -en 'netboot.xyz.efi\xFF') |
| 56 | +``` |
| 57 | + |
| 58 | +### 2. DHCP Configuration Changes |
| 59 | + |
| 60 | +For isc-dhcp servers, use the `boot-file-name` directive instead of Option 67: |
| 61 | + |
| 62 | +```bash |
| 63 | +# In dhcp4 config, use boot-file-name at the top level |
| 64 | +boot-file-name "netboot.xyz.kpxe"; |
| 65 | + |
| 66 | +# Instead of in option-data |
| 67 | +``` |
| 68 | + |
| 69 | +For pfSense users: Switch from Kea to the deprecated isc-dhcp service in System > Advanced > Networking. |
| 70 | + |
| 71 | +### 3. Remove DHCP boot-filename Option |
| 72 | + |
| 73 | +Some users report success by removing the `option bootfile-name` directive entirely, though this may break other clients. |
| 74 | + |
| 75 | +## Technical Details |
| 76 | + |
| 77 | +- The issue specifically affects DHCPv4 Option 67 handling |
| 78 | +- DHCPv6 does not have this problem due to its variable-length field design |
| 79 | +- RFC 2132 does not guarantee null termination of Option 67 filenames |
| 80 | +- UEFI 2.6 spec leaves line termination as an implementation detail |
| 81 | + |
| 82 | +## Troubleshooting Steps |
| 83 | + |
| 84 | +1. **Identify the issue**: Look for replacement characters (�) or extra bytes in TFTP server logs |
| 85 | +2. **Packet capture**: Use tcpdump to verify extra bytes in TFTP requests |
| 86 | +3. **Test workarounds**: Try the server-side filename solution first |
| 87 | +4. **DHCP server evaluation**: Consider switching from Kea to isc-dhcp if possible |
| 88 | + |
| 89 | +## Prevention |
| 90 | + |
| 91 | +- Use the `boot-file-name` directive in DHCP configuration instead of Option 67 |
| 92 | +- Test with known problematic hardware before deployment |
| 93 | +- Document affected clients in your environment |
| 94 | + |
| 95 | +## References |
| 96 | + |
| 97 | +- [Issue discussion](https://github.com/netbootxyz/netboot.xyz/issues/1198) |
| 98 | +- [Technical analysis](https://binaryfury.wann.net/2024/12/pxe-two-tftp-filenames-one-dhcp-offer-plus-weird-filenames/) |
| 99 | +- UEFI Specification 2.6+ |
| 100 | +- RFC 2132 (DHCP Options) |
0 commit comments