summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* [image] Avoid potential NULL pointer dereferenceMichael Brown2012-05-081-3/+5
| | | | | | Detected using Valgrind. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Automatically download cross-signed certificatesMichael Brown2012-05-082-11/+287
| | | | | | | | Automatically attempt to download any required cross-signing certificates from http://ca.ipxe.org/auto, in order to enable the use of standard SSL certificates issued by public CAs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xferbuf] Add generic data-transfer bufferMichael Brown2012-05-083-0/+140
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use asynchronous certificate validatorMichael Brown2012-05-082-48/+120
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add asynchronous certificate validatorMichael Brown2012-05-083-0/+196
| | | | | | | | | To allow for automatic download of cross-signing certificates and for OCSP, the validation of certificates must be an asynchronous process. Create a stub validator which uses a job-control interface to report the result of certificate validation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_auto_append()Michael Brown2012-05-083-41/+81
| | | | | | | | | | CMS includes an unordered certificate set, from which certificates must be extracted in order by matching up issuers with subjects. We will use the same functionality as part of the automatic download of cross-signing certificates. Generalise cms_find_subject() to x509_find_subject(), and create x509_auto_append(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_append_raw()Michael Brown2012-05-084-39/+59
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Check that common name contains no NUL charactersMichael Brown2012-05-081-0/+9
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow for X.509 certificates with no common nameMichael Brown2012-05-083-5/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_last_entry()Michael Brown2012-05-082-1/+26
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Discard all TCP connections on shutdownMichael Brown2012-05-081-0/+22
| | | | | | | Allow detection of genuine memory leaks by ensuring that all TCP connections are freed on shutdown. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Fix potential NULL pointer dereferenceMichael Brown2012-05-081-1/+1
| | | | | | Detected using Valgrind. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for crc32_le()Michael Brown2012-05-072-0/+117
| | | | | | | Add self-tests for crc32_le() using test vectors generated with Perl's Digest::CRC. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Fix compiler warning on older gcc versionsMichael Brown2012-05-041-2/+2
| | | | | Reported-by: Alex Davies <alex@davz.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificate chains to be long-lived data structuresMichael Brown2012-05-049-463/+1075
| | | | | | | | | | | | | | | | | At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Add Linux time source using gettimeofday()Michael Brown2012-05-045-2/+65
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [malloc] Allow Valgrind to be used when all assertions are enabledMichael Brown2012-05-041-11/+67
| | | | | | | | | | | | The free-memory-block traversal code triggers multiple warnings from Valgrind when assertions are enabled, since the list consistency checks performed by list_check() end up accessing areas that have been marked as inaccessible. Fix by ensuring that any memory areas that will be accessed by list_check() are marked as defined when necessary. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Fix memory leak in cms_verify_digest()Michael Brown2012-05-041-1/+2
| | | | | | Detected using Valgrind. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse OCSP responder URI from X.509 certificateMichael Brown2012-05-044-11/+194
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_for_each_entry_continue() and _continue_reverse()Michael Brown2012-05-042-14/+103
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Fix memory leak in settings self-testsMichael Brown2012-05-041-1/+2
| | | | | | Detected using Valgrind. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [malloc] Discard all cached data on shutdownMichael Brown2012-05-041-0/+25
| | | | | | | Allow detection of genuine memory leaks by ensuring that all cached data is freed on shutdown. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add "--default" option to "choose" commandMichael Brown2012-04-293-7/+16
| | | | | Suggested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [realtek] Support RTL8139 cards within generic Realtek driverMichael Brown2012-04-283-649/+400Star
| | | | | | | | | | | | | | | | RTL8139C+ cards use essentially the same datapath as RTL8169, which is zerocopy and 64-bit capable. Older RTL8139 cards use a single receive ring buffer rather than a descriptor ring, but still share substantial amounts of functionality with RTL8169. Include support for RTL8139 cards within the generic Realtek driver, since there is no way to differentiate between RTL8139 and RTL8139C+ cards based on the PCI IDs alone. Many thanks to all the people who worked on the rtl8139 driver over the years. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Fix typo in memory allocationKevin Tran2012-04-271-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [myson] Replace driver for Myson Technology NICsMichael Brown2012-04-274-1022/+869Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [natsemi] Fix test for addresses below 4GBMichael Brown2012-04-271-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [natsemi] Replace driver for National Semicondutor NICsMichael Brown2012-04-264-1682/+1108Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Do not allow build-time cryptography settings to be overriddenMichael Brown2012-04-242-63/+101
| | | | | | | | | | | | If a root certificate has been explicitly specified at build time using TRUST=/path/to/cert then do not allow this to be overridden even from a trustworthy settings source (such as VMware GuestInfo). Similarly, if a client certificate (and private key) has been explicitly specified at build time, then do not allow it to be overridden at runtime. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow client certificate to be changed without a rebuildMichael Brown2012-04-242-9/+98
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Use $(xxx_DEPS) for additional dependency informationMichael Brown2012-04-241-95/+95
| | | | | | | | | | | | | | | | | Some objects (embedded.o, rootcert.o, and clientcert.o) define additional dependencies on external files, using syntax such as: $(BIN)/clientcert.o : $(CERT_LIST) This dependency can be missed when using debug builds. For example, if DEBUG=clientcert is used, then the relevant object is $(BIN)/clientcert.dbg1.o rather than $(BIN)/clientcert.o. Fix by adding dependencies to $(clientcert_DEPS) instead: clientcert_DEPS += $(CERT_LIST) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [util] Remove obsolete Makefile rule for util/prototester.cMarin Hannache2012-04-241-8/+2Star
| | | | | | | | util/prototester.c was removed in commit a6d1815 ("Obsolete for some time now") back in 2006. Signed-off-by: Marin Hannache <mareo@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Remove non-working image loadersMarin Hannache2012-04-246-813/+0Star
| | | | | | | | | | The WinCE, a.out and FreeBSD loaders are designed to be #included by core/loader.c, which no longer exists. These old loaders are not usable anymore and cause compilation failures when enabled in config/general.h. Signed-off-by: Marin Hannache <mareo@mareo.fr> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Replace driver for Intel Gigabit NICsMichael Brown2012-04-2465-47324/+1199Star
| | | | | | Tested-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Thomas Miletich <thomas.miletich@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Avoid using stack-allocated memory in http_step()Michael Brown2012-04-241-14/+32
| | | | | | | | http_step() allocates a potentially large block of storage (since the URI can be arbitrarily long), and can be invoked as part of an already deep call stack via xfer_window_changed(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [script] Avoid using stack-allocated memory in process_line()Michael Brown2012-04-231-14/+15
| | | | | | | Script lines can be arbitrarily long; allocate on the heap rather than on the stack. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xfer] Avoid using stack-allocated memory in xfer_printf()Michael Brown2012-04-231-7/+19
| | | | | | | | | | | xfer_printf() occasionally has to deal with strings that are potentially long, such as HTTP URIs with multiple query parameters. Allocating these on the stack can lead to stack overruns and memory corruption. Fix by using vasprintf() instead of a stack allocation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [realtek] Update link state when device is openedMichael Brown2012-04-231-0/+3
| | | | | | | | | | | | | The link state is currently set at probe time, and updated only when the device is polled. This results in the user seeing a misleading stale "Link: down" message, if autonegotiation did not complete within the short timespan of the probe routine. Fix by updating the link state when the device is opened, so that the message that ends up being displayed to the user reflects the real link state at device open time. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Allow network device to update link state before checkingMichael Brown2012-04-211-0/+3
| | | | | | | | If the network interface has only just been opened (e.g. by the "dhcp" command) then we should allow at least one opportunity for the card to update the link state before testing it, to avoid false positives. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [skel] Add skeleton network driverMichael Brown2012-04-213-0/+332
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Fix compiler warning in elf2efi.cMichael Brown2012-04-211-0/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Update link state in SNP device mode dataMichael Brown2012-04-191-2/+15
| | | | | | | | | | | There is no explicit SNP API call to determine link state; the SNP interface user may check the MediaPresent field within the mode data at any time. Update the MediaPresent field whenever the link state changes. Reported-by: Michael R Turner <mikeyt@us.ibm.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow trusted root certificate to be changed without a rebuildMichael Brown2012-04-193-2/+69
| | | | | | | | | | | | | | | | | | | | Changing the trusted root certificate currently requires a rebuild of the iPXE binary, which may be inconvenient or impractical. Allow the list of trusted root certificate fingerprints to be overridden using the "trust" setting, but only at the point of iPXE initialisation. This prevents untrusted sources of settings (e.g. DHCP) from subverting the chain of trust, while allowing trustworthy sources to change the trusted root certificate without requiring a rebuild. The basic idea is that if you are able to manipulate a trustworthy source of settings (e.g. VMware GuestInfo or non-volatile stored options), then you would be able to replace the iPXE binary anyway, and so no security is lost by allowing such sources to override the list of trusted root certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Add fetch_setting_copy()Michael Brown2012-04-192-0/+42
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [multiboot] Place multiboot modules low in memoryMichael Brown2012-04-194-52/+69
| | | | | | | | | | | | | | | Solaris assumes that there is enough space above the Multiboot modules to use as a decompression and scratch area. This assumption is invalid when using iPXE, which places the Multiboot modules near the top of (32-bit) memory. Fix by copying the modules to an area of memory immediately following the loaded kernel. Debugged-by: Michael Brown <mcb30@ipxe.org> Debugged-by: Scott McWhirter <scottm@joyent.com> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [realtek] Replace driver for Realtek Gigabit NICsMichael Brown2012-04-185-2718/+985Star
| | | | | | | Tested-by: Thomas Miletich <thomas.miletich@gmail.com> Debugged-by: Thomas Miletich <thomas.miletich@gmail.com> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Add generic MII reset functionMichael Brown2012-04-183-0/+172
| | | | | | | | | iPXE provides no support for manually configuring the link speed. Provide a generic routine which should be able to reset any MII/GMII PHY and enable autonegotiation. Prototyped-by: Thomas Miletich <thomas.miletich@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Synchronise constants with current Linux include/linux/mii.hMichael Brown2012-04-182-117/+113Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Remove unused functionalityMichael Brown2012-04-182-206/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [util] Add utility to generate list of supported network cardsRobin Smidsrød2012-04-182-1/+589
| | | | | | | | | | | | | | niclist.pl recursively scans specified source folders and builds a list of supported NICs by looking for ISA_ROM and PCI_ROM lines and outputs the list in text, CSV, JSON, HTML or DokuWiki format. Sorting and column selection is possible. The pci-utils pci.ids file is fetched from SourceForge once a day to also output the "official" vendor/device names associated with the PCI device. Signed-off-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-04 11:24:39 +0100