openslx-ng/ipxe.git/src/net/validator.c, branch v1.20.1

[tls] Display cross-certificate and OCSP status messages

2019-03-07T15:23:19+00:00

TLS connections will almost always create background connections to perform cross-signed certificate downloads and OCSP checks. There is currently no direct visibility into which checks are taking place, which makes troubleshooting difficult in the absence of either a packet capture or a debug build. Use the job progress message buffer to report the current cross-signed certificate download or OCSP status check, where applicable. Signed-off-by: Michael Brown

[crypto] Use x509_name() in validator debug messages

2019-03-07T13:47:30+00:00

Display a human-readable certificate name in validator debug messages wherever possible. Signed-off-by: Michael Brown

[ocsp] Centralise test for whether or not an OCSP check is required

2018-03-18T20:25:01+00:00

Signed-off-by: Michael Brown

[crypto] Fail fast if cross-certificate source is empty

2017-09-24T16:56:04+00:00

In fully self-contained deployments it may be desirable to build iPXE with an empty CROSSCERT source to avoid talking to external services. Add an explicit check for this case and make validator_start_download fail immediately if the base URI is empty. Signed-off-by: Ladi Prosek Modified-by: Michael Brown Signed-off-by: Michael Brown

[crypto] Generalise X.509 "valid" field to a "flags" field

2016-08-25T14:41:57+00:00

Signed-off-by: Michael Brown

[crypto] Allow cross-certificate source to be configured at build time

2016-03-24T19:25:03+00:00

Provide a build option CROSSCERT in config/crypto.h to allow the default cross-signed certificate source to be configured at build time. The ${crosscert} setting may still be used to reconfigure the cross-signed certificate source at runtime. Signed-off-by: Michael Brown

[xferbuf] Generalise to handle umalloc()-based buffers

2015-07-22T20:17:47+00:00

Signed-off-by: Michael Brown

[base64] Add buffer size parameter to base64_encode() and base64_decode()

2015-04-24T14:32:04+00:00

Signed-off-by: Michael Brown

[legal] Relicense files under GPL2_OR_LATER_OR_UBDL

2015-03-02T14:17:31+00:00

Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown

[crypto] Generalise X.509 cache to a full certificate store

2014-03-28T17:09:40+00:00

Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown