summaryrefslogtreecommitdiffstats
path: root/src/crypto/x509.c
Commit message (Collapse)AuthorAgeFilesLines
* [base16] Add buffer size parameter to base16_encode() and base16_decode()Michael Brown2015-04-241-1/+2
| | | | | | | | | | | | | | The current API for Base16 (and Base64) encoding requires the caller to always provide sufficient buffer space. This prevents the use of the generic encoding/decoding functionality in some situations, such as in formatting the hex setting types. Implement a generic hex_encode() (based on the existing format_hex_setting()), implement base16_encode() and base16_decode() in terms of the more generic hex_encode() and hex_decode(), and update all callers to provide the additional buffer length parameter. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Fix the REQUIRE_SYMBOL mechanismMichael Brown2015-03-051-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | At some point in the past few years, binutils became more aggressive at removing unused symbols. To function as a symbol requirement, a relocation record must now be in a section marked with @progbits and must not be in a section which gets discarded during the link (either via --gc-sections or via /DISCARD/). Update REQUIRE_SYMBOL() to generate relocation records meeting these criteria. To minimise the impact upon the final binary size, we use existing symbols (specified via the REQUIRING_SYMBOL() macro) as the relocation targets where possible. We use R_386_NONE or R_X86_64_NONE relocation types to prevent any actual unwanted relocation taking place. Where no suitable symbol exists for REQUIRING_SYMBOL() (such as in config.c), the macro PROVIDE_REQUIRING_SYMBOL() can be used to generate a one-byte-long symbol to act as the relocation target. If there are versions of binutils for which this approach fails, then the fallback will probably involve killing off REQUEST_SYMBOL(), redefining REQUIRE_SYMBOL() to use the current definition of REQUEST_SYMBOL(), and postprocessing the linked ELF file with something along the lines of "nm -u | wc -l" to check that there are no undefined symbols remaining. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-021-1/+5
| | | | | | | Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Fix debug messageMichael Brown2014-07-121-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add support for iPAddress subject alternative namesMichael Brown2014-07-111-0/+55
| | | | | Originally-implemented-by: Jarrod Johnson <jarrod.b.johnson@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow wildcard matches on commonName as well as subjectAltNameMichael Brown2014-04-011-10/+8Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add support for subjectAltName and wildcard certificatesMichael Brown2014-03-311-8/+132
| | | | | Originally-implemented-by: Alex Chernyakhovsky <achernya@google.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow signed timestamp error margin to be configured at build timeMichael Brown2014-03-301-2/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use fingerprint when no common name is available for debug messagesMichael Brown2014-03-281-4/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 cache to a full certificate storeMichael Brown2014-03-281-61/+32Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove dynamically-allocated storage for certificate OCSP URIMichael Brown2014-03-251-26/+7Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove dynamically-allocated storage for certificate nameMichael Brown2014-03-251-50/+86
| | | | | | | | | | | | | | iPXE currently allocates a copy the certificate's common name as a string. This string is used by the TLS and CMS code to check certificate names against an expected name, and also appears in debugging messages. Provide a function x509_check_name() to centralise certificate name checking (in preparation for adding subjectAlternativeName support), and a function x509_name() to provide a name to be used in debugging messages, and remove the dynamically allocated string. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Report meaningful error when certificate chain validation failsMichael Brown2013-05-101-7/+5Star
| | | | | | | | | | | | | | | | | | If a certificate chain contains no certificate which can be validated as a standalone certificate (i.e. contains no trusted root certificates or previously-validated certificates) then iPXE will currently return a fixed error EACCES_UNTRUSTED. This masks the actual errors obtained when attempting to validate each certificate as a standalone certificate, and so makes troubleshooting difficult for the end user. Fix by instead returning the error obtained when attempting to validate the final certificate in the chain as a standalone certificate. This error is most likely (though not guaranteed) to represent the "real" problem. Reported-by: Sven Dreyer <sven@dreyer-net.de> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Update FSF mailing address in GPL licence textsMichael Brown2012-07-201-1/+2
| | | | | Suggested-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arp] Try to avoid discarding ARP cache entriesMichael Brown2012-07-091-1/+1
| | | | | | | | | Discarding the active ARP cache entry in the middle of a download will substantially disrupt the TCP stream. Try to minimise any such disruption by treating ARP cache entries as expensive, and discarding them only when nothing else is available to discard. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow an error margin on X.509 certificate validity periodsMichael Brown2012-06-201-2/+2
| | | | | | | | | | | | | iPXE has no concept of the local time zone, mainly because there is no viable way to obtain time zone information in the absence of local state. This causes potential problems with newly-issued certificates and certificates that are about to expire. Avoid such problems by allowing an error margin of around 12 hours on certificate validity periods, similar to the error margin already allowed for OCSP response timestamps. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Require OCSP check if certificate provides an OCSP URIMichael Brown2012-05-221-0/+12
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Return a NULL X.509 certificate if construction failsMichael Brown2012-05-221-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add framework for OCSPMichael Brown2012-05-151-3/+3
| | | | | | | | Add support for constructing OCSP queries and parsing OCSP responses. (There is no support yet for actually issuing an OCSP query via an HTTP POST.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse OCSPSigning key purpose, if presentMichael Brown2012-05-141-0/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise x509_parse_bit_string() to asn1_bit_string()Michael Brown2012-05-141-93/+16Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise asn1_{digest,pubkey,signature}_algorithm()Michael Brown2012-05-141-66/+13Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise x509_parse_time() to asn1_generalized_time()Michael Brown2012-05-141-116/+10Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 raw public key bit stringMichael Brown2012-05-141-2/+8
| | | | | | | OCSP requires direct access to the bit string portion of the subject public key information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Reduce standard debugging outputMichael Brown2012-05-091-47/+49
| | | | | | | | X.509 certificate processing currently produces an overwhelming amount of debugging information. Move some of this from DBGLVL_LOG to DBGLVL_EXTRA, to make the output more manageable. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_auto_append()Michael Brown2012-05-081-0/+66
| | | | | | | | | | CMS includes an unordered certificate set, from which certificates must be extracted in order by matching up issuers with subjects. We will use the same functionality as part of the automatic download of cross-signing certificates. Generalise cms_find_subject() to x509_find_subject(), and create x509_auto_append(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_append_raw()Michael Brown2012-05-081-0/+32
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Check that common name contains no NUL charactersMichael Brown2012-05-081-0/+9
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow for X.509 certificates with no common nameMichael Brown2012-05-081-3/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificate chains to be long-lived data structuresMichael Brown2012-05-041-116/+362
| | | | | | | | | | | | | | | | | At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse OCSP responder URI from X.509 certificateMichael Brown2012-05-041-6/+142
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 extended key usage extensionMichael Brown2012-03-221-0/+85
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Differentiate "untrusted root" and "incomplete chain" error casesMichael Brown2012-03-221-1/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Shrink raw certificate data to fit certificateMichael Brown2012-03-221-0/+1
| | | | | | | The certificate may be part of an ASN.1-encoded certificate chain, and so may not be the only object contained within the ASN.1 cursor. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add previous certificate in chain as a parameter to parse_next()Michael Brown2012-03-221-4/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 certificate serial numberMichael Brown2012-03-221-2/+29
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 OID-identified algorithm to asn1.cMichael Brown2012-03-221-95/+28Star
| | | | | | | | The concept of an OID-identified algorithm as defined in X.509 is used in some other standards (e.g. PKCS#7). Generalise this functionality and provide it as part of the ASN.1 core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Validate path length constraint in certificate chainMichael Brown2012-03-211-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Check certificate validity period against current date and timeMichael Brown2012-03-201-7/+41
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Parse X.509 validity times into seconds since the EpochMichael Brown2012-03-201-12/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add full X.509 certificate parsingMichael Brown2012-03-191-23/+1156
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use iPXE native RSA algorithmMichael Brown2012-03-181-142/+14Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add more ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-181-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Upgrade AES and RSA code to upstream axTLS version 1.4.5Michael Brown2012-03-091-0/+10
| | | | | | | | | All axTLS files are now vanilla versions of the upstream axTLS files, with one minor exception: the unused "ctx" parameter of bi_int_divide() has been marked with "__unused" to avoid a compilation error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Accept certificates without a version numberMichael Brown2011-08-131-1/+1
| | | | | | | The version field of an X.509 certificate appears to be optional. Reported-by: Sebastiano Manusia <Sebastiano.Manusia@chuv.ch> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Rename gPXE to iPXEMichael Brown2010-04-201-2/+2
| | | | | | | | | | | Access to the gpxe.org and etherboot.org domains and associated resources has been revoked by the registrant of the domain. Work around this problem by renaming project from gPXE to iPXE, and updating URLs to match. Also update README, LOG and COPYRIGHTS to remove obsolete information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Add a selection of FILE_LICENCE declarationsMichael Brown2009-05-181-0/+2
| | | | | Add FILE_LICENCE declarations to almost all files that make up the various standard builds of gPXE.
* [tls] Use our own ASN.1 routines for certificate parsingMichael Brown2009-02-101-0/+181
Use our own, more robust, ASN.1 parsing routines to extract the RSA public key from a server certificate. Remove the now-unused AXTLS ASN.1 parser.
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-02-27 13:53:40 +0100