summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [forcedeth] Use standard random() functionMichael Brown2012-03-131-2/+1Star
| | | | | | | It seems unlikely that a network card driver requires cryptographically secure random numbers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use const to mark incoming data being processedMichael Brown2012-03-132-27/+29
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Upgrade AES and RSA code to upstream axTLS version 1.4.5Michael Brown2012-03-0912-603/+509Star
| | | | | | | | | All axTLS files are now vanilla versions of the upstream axTLS files, with one minor exception: the unused "ctx" parameter of bi_int_divide() has been marked with "__unused" to avoid a compilation error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ath9k] Fix compilation on older gcc versionsMichael Brown2012-03-092-3/+2Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Eliminate uninitialised variableMichael Brown2012-03-091-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Avoid using "static const" for test declarationsMichael Brown2012-03-073-6/+6
| | | | | | | | gcc will not warn about unused constant static variables. An unused test declaration is almost certainly a bug, so ensure that warnings are generated. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [debug] Ensure debug address and colourisation fields are fully initialisedMichael Brown2012-03-061-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add NIST self-tests for AES128 and AES256 in CBC modeMichael Brown2012-03-064-0/+330
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Choose HMAC_DRBG using SHA-256 as the DRBG algorithmMichael Brown2012-03-061-7/+6Star
| | | | | | | | | | | | Both HMAC_DRBG using SHA-1 and HMAC_DRBG using SHA-256 are Approved algorithms in ANS X9.82 for our chosen security strength of 128 bits. However, general recommendations (see e.g. NIST SP800-57) are to use a larger hash function in preference to SHA-1. Since SHA-256 is required anyway for TLSv1.2 support, there is no code size penalty for switching HMAC_DRBG to also use SHA-256. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add NIST self-tests for HMAC_DRBG using SHA-256Michael Brown2012-03-061-0/+544
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow HMAC_DRBG to use multiple underlying hash algorithmsMichael Brown2012-03-064-267/+442
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Use SHA-256 for Hash_df, and validate the hash function strengthMichael Brown2012-03-061-5/+12
| | | | | | | | | | | | | | | | ANS X9.82 Part 4 (April 2011 Draft) Section 13.3.4.2 states that "When using the derivation function based on a hash function, the output length of the hash function shall meet or exceed the security strength indicated by the min_entropy parameter in the Get_entropy_input call", although this criteria is missing from the pseudocode provided in the same section. Add a test for this condition, and upgrade from SHA-1 to SHA-256 since SHA-1 has an output length of 160 bits, which is insufficient for generating the (128 * 3/2 = 192) bits required when instantiating the 128-bit strength DRBG. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add NIST self-tests for Hash_df using SHA-256Michael Brown2012-03-061-0/+397
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow hash_df() to accept multiple underlying hash algorithmsMichael Brown2012-03-065-95/+101
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Formalise the definition of a TLS cipher suiteMichael Brown2012-03-062-84/+125
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support (and prefer) SHA-256 variants of existing cipher suitesMichael Brown2012-03-052-3/+17
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support TLS version 1.2Michael Brown2012-03-052-35/+78
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Replace MD5 implementationMichael Brown2012-03-052-190/+301
| | | | | | | Replace MD5 implementation with one which is around 20% smaller. This implementation has been verified using the existing MD5 self-tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Avoid using struct md5_ctx directlyMichael Brown2012-03-051-4/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for MD5 algorithmMichael Brown2012-03-052-0/+94
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for SHA-256 algorithmMichael Brown2012-03-052-0/+102
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add SHA-256 algorithmMichael Brown2012-03-052-0/+327
| | | | | | This implementation has been verified using the NIST SHA-256 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x86_64] Use memory address constraint in __bswap_16s()Michael Brown2012-03-041-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [i386] Use memory address constraints in __bswap_16s() and __bswap_64s()Michael Brown2012-03-041-4/+3Star
| | | | | | | | Minimise code size by forcing the use of memory addresses for __bswap_16s() and __bswap_64s(). (__bswap_32s() cannot avoid loading the value into a register.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [i386] Fix building on older versions of gccMichael Brown2012-03-041-3/+7
| | | | | | | Fix a strict-aliasing error on certain versions of gcc. Reported-by: Marko Myllynen <myllynen@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Replace SHA-1 implementationMichael Brown2012-03-044-276/+337
| | | | | | | | | Replace SHA-1 implementation from AXTLS with a dedicated iPXE implementation which is around 40% smaller. This implementation has been verified using the existing SHA-1 self-tests (including the NIST SHA-1 test vectors). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Eliminate use of AXTLS-specific SHA1_SIZE constantMichael Brown2012-03-041-16/+17
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for byte-order swapping functionsMichael Brown2012-03-042-0/+92
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x86_64] Provide __bswap_{16,32,64}s()Michael Brown2012-03-041-0/+25
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [i386] Optimise byte-swapping functions and provide __bswap_{16,32,64}s()Michael Brown2012-03-041-32/+56
| | | | | | | | | | | Use the "bswap" instruction to shrink the size of byte-swapping code, and provide the in-place variants __bswap_{16,32,64}s. "bswap" is available only on 486 and later processors. (We already assume the presence of "cpuid" and "rdtsc", which are available only on Pentium and later processors.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add missing #include <stdlib.h>Michael Brown2012-03-041-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add missing #include <assert.h>Michael Brown2012-03-042-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Add missing #include <byteswap.h>Michael Brown2012-03-041-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Send empty Certificate record if requested by serverMichael Brown2012-03-032-3/+61
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Verify the contents of the Finished recordMichael Brown2012-03-031-3/+24
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow transmitted records to be scheduled independentlyMichael Brown2012-03-032-93/+39Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add support for Server Name Indication (SNI)Michael Brown2012-03-034-5/+39
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support TLS version 1.1Michael Brown2012-03-032-16/+30
| | | | | | | | Advertise support for TLS version 1.1, and be prepared to downgrade to TLS version 1.0. Tested against Apache with mod_gnutls, using the GnuTLSPriorities directive to force specific protocol versions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arp] Maintain an ARP transmission queueMichael Brown2012-03-033-152/+354
| | | | | | | | Allow packet transmission to be deferred pending successful ARP resolution. This avoids the time spent waiting for a higher-level protocol (e.g. TCP or TFTP) to attempt retransmission. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [undi] Allow underlying PXE stack to construct link-layer headerMichael Brown2012-03-023-9/+61
| | | | | | | | | | | | | | Some PXE stacks (observed with a QLogic 8242) will always try to prepend a link-layer header, even if the caller uses P_UNKNOWN to indicate that the link-layer header has already been filled in. This results in an invalid packet being transmitted. Work around these faulty PXE stacks where possible by stripping the existing link-layer header and allowing the PXE stack to (re)construct the link-layer header itself. Originally-fixed-by: Buck Huppmann <buckh@pobox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Send any padding inline with the data segmentMichael Brown2012-03-012-30/+9Star
| | | | | | | | | | | | | Some iSCSI targets respond to a PDU before receiving the padding bytes. If the target responds quickly enough, this can cause iPXE to start processing a new TX PDU before the padding bytes have been sent, which results in a protocol violation. Fix by always transmitting the padding bytes along with the data segment. Originally-fixed-by: Shyam Iyer <shyam_iyer@dell.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Recognise status code 303 as validJason Lunz2012-03-011-0/+1
| | | | | | | | As RFC 2616 10.3.4 explains, a 303 status is the proper HTTP 1.1 behavior for what most HTTP 1.0 clients did with code 302. Signed-off-by: Jason Lunz <lunz@acm.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [vmware] Fix length returned by guestrpc_command()Michael Brown2012-03-011-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [vmware] Add VMware logfile console (CONSOLE_VMWARE)Michael Brown2012-02-293-0/+121
| | | | | | | Allow iPXE console output to be sent to the VMware logfile via the GuestRPC mechanism. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [vmware] Add GuestRPC mechanismMichael Brown2012-02-296-0/+535
| | | | | | Use the VMware backdoor I/O port to access the GuestRPC mechanism. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Separate out generic line-based console functionalityMichael Brown2012-02-293-36/+117
| | | | | | | Abstract out the generic line-handling portions of the syslog putchar() routine, to allow use by other console types. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Disable console when no syslog server is definedMichael Brown2012-02-291-7/+5Star
| | | | | | | | Explicitly disable the syslog console when no syslog server is defined, rather than (ab)using the socket family address as an equivalent console-enabled flag. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow for HTTPS-only buildsMichael Brown2012-02-283-859/+889
| | | | | | | | Separate out the core HTTP functionality (which is shared by both HTTP and HTTPS) from the provision of the "http://" URI opener. This allows for builds that support only "https://" URIs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add RTC-based entropy sourceMichael Brown2012-02-284-1/+298
| | | | | | | | | | | The RTC-based entropy source uses the nanosecond-scale CPU TSC to measure the time between two 1kHz interrupts generated by the CMOS RTC. In a physical machine these clocks are driven from independent crystals, resulting in some observable clock drift. In a virtual machine, the CMOS RTC is typically emulated using host-OS constructions such as SIGALRM. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add entropy sample generatorMichael Brown2012-02-281-0/+70
| | | | | | | Allow a list of raw noise samples to be generated for offline analysis. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-04 11:55:10 +0200