iPXE fails to download kernel from image factory

[lion7]

I'm trying to run this provider on my router and I am getting to the point where iPXE boots.
It subsequentially chains to the iPXE script hosted by image factory.
When iPXE tries to download the kernel however, I get this error: https://ipxe.org/err/0216eb
Any thoughts on what causes this?

[smira]

From your description, it sounds like you're using your own iPXE, not the one from the bare metal provider (which does DHCP proxy, and you don't need to touch your router).

So probably you don't have your iPXE complied properly with HTTPS support (you should see it from the version line it prints on boot).

[lion7]

Screenshot of the error:

And logs from the provider:

{"level":"info","ts":1737730723.1223135,"caller":"dhcp/proxy.go:140","msg":"offering boot response","component":"dhcp_proxy","source":"68:05:ca:83:d0:d9","boot_filename":"snp.efi"}
{"level":"info","ts":1737730726.1878405,"caller":"tftp/tftp_server.go:103","msg":"file requested","component":"tftp_server","filename":"snp.efi"}
{"level":"error","ts":1737730726.1895988,"caller":"tftp/tftp_server.go:118","msg":"failed to read from file","component":"tftp_server","filename":"/var/lib/tftp/snp.efi","error":"sending block 0: code=8, error: User aborted the transfer\u0000"}
{"level":"info","ts":1737730726.2721875,"caller":"tftp/tftp_server.go:103","msg":"file requested","component":"tftp_server","filename":"snp.efi"}
{"level":"info","ts":1737730726.6008356,"caller":"tftp/tftp_server.go:123","msg":"file sent","component":"tftp_server","filename":"/var/lib/tftp/snp.efi","bytes":255488}
{"level":"info","ts":1737730735.6779897,"caller":"dhcp/proxy.go:140","msg":"offering boot response","component":"dhcp_proxy","source":"68:05:ca:83:d0:d9","boot_filename":"snp.efi"}
{"level":"info","ts":1737730736.0450501,"caller":"ipxe/handler.go:97","msg":"handle iPXE request","component":"ipxe_handler","uuid":"fdc5f7a3-4204-a91a-c69e-04421aa9c69d","mac":"68-05-ca-83-d0-d9","arch":"x86_64"}
{"level":"info","ts":1737730736.0679579,"caller":"ipxe/handler.go:266","msg":"boot agent mode using image factory","component":"ipxe_handler"}
{"level":"info","ts":1737730736.0680208,"caller":"imagefactory/client.go:62","msg":"generate schematic iPXE URL","component":"image_factory_client","talos_version":"","arch":"amd64","extensions":[],"extra_kernel_args":["talos.config=http://10.192.0.1:50042/config?u=${uuid}","metal.provider.address=10.192.0.1:50042","console=tty0","console=ttyS0"]}
{"level":"info","ts":1737730736.4083502,"caller":"server/server.go:110","msg":"request","component":"server","method":"GET","path":"/ipxe","duration":0.363344177}

[smira]

IPXE version scrolled away in your screenshot

[lion7]

I can assure you it is the Sidero-built iPXE. I also retried my own build snp.efi binary with HTTPS enabled and https://raw.githubusercontent.com/siderolabs/pkgs/refs/heads/main/ipxe/files/ipxe.script as the embed script, but that resulted in the same.

In the end, it seems that enabling IPv6 Router Advertisements on the network caused the issue:

Long story short: iPXE tries to download https://ca.ipxe.org/ca.crt over IPv6 for which there was no connectivity in place. It actually did the same for the kernel it tries to download, but there it did do a fallback to IPv4. I don't understand yet why that fallback didn't work for the CA bundle, but disabling IPv6 RA solved it for now.

[smira]

Ok, so this is iPXE issue in this case, but thanks for digging into that.