summaryrefslogtreecommitdiffstats
path: root/src/include/ipxe/tls.h
Commit message (Collapse)AuthorAgeFilesLines
* [tls] Display validator messages only while validation is in progressMichael Brown2019-03-101-0/+2
| | | | | | | Allow the cipherstream to report progress status messages during connection establishment. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support stateless session resumptionMichael Brown2019-03-061-0/+12
| | | | | | | Add support for RFC5077 session ticket extensions to allow for stateless TLS session resumption. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support stateful session resumptionMichael Brown2019-02-211-2/+29
| | | | | | | | | | | | | Record the session ID (if any) provided by the server and attempt to reuse it for any concurrent connections to the same server. If multiple connections are initiated concurrently (e.g. when using PeerDist) then defer sending the ClientHello for all but the first connection, to allow time for the first connection to potentially obtain a session ID (and thereby speed up the negotiation for all remaining connections). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Rename tls_session to tls_connectionMichael Brown2018-03-241-2/+2
| | | | | | | | | | | | In TLS terminology a session conceptually spans multiple individual connections, and essentially represents the stored cryptographic state (master secret and cipher suite) required to establish communication without going through the certificate and key exchange handshakes. Rename tls_session to tls_connection in order to make the name tls_session available to represent the session state. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support RFC5746 secure renegotiationMichael Brown2017-07-041-0/+15
| | | | | | | Support renegotiation with servers supporting RFC5746. This allows for the use of per-directory client certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Support SHA-{224,384,512} in X.509 certificatesMichael Brown2015-08-021-0/+25
| | | | | | | | | Add support for SHA-224, SHA-384, and SHA-512 as digest algorithms in X.509 certificates, and allow the choice of public-key, cipher, and digest algorithms to be configured at build time via config/crypto.h. Originally-implemented-by: Tufan Karadere <tufank@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Report supported signature algorithms in ClientHelloMichael Brown2015-08-021-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-021-1/+1
| | | | | | | Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 cache to a full certificate storeMichael Brown2014-03-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Expand the concept of the X.509 cache to provide the functionality of a certificate store. Certificates in the store will be automatically used to complete certificate chains where applicable. The certificate store may be prepopulated at build time using the CERT=... build command line option. For example: make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt Certificates within the certificate store are not implicitly trusted; the trust list is specified using TRUST=... as before. For example: make bin/ipxe.usb CERT=root.crt TRUST=root.crt This can be used to embed the full trusted root certificate within the iPXE binary, which is potentially useful in an HTTPS-only environment in which there is no HTTP server from which to automatically download cross-signed certificates or other certificate chain fragments. This usage of CERT= extends the existing use of CERT= to specify the client certificate. The client certificate is now identified automatically by checking for a match against the private key. For example: make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Split received records over multiple I/O buffersMichael Brown2012-09-271-4/+26
| | | | | | | | | | | | | | | TLS servers are not obliged to implement the RFC3546 maximum fragment length extension, and many common servers (including OpenSSL, as used in Apache's mod_ssl) do not do so. iPXE may therefore have to cope with TLS records of up to 16kB. Allocations for 16kB have a non-negligible chance of failing, causing the TLS connection to abort. Fix by maintaining the received record as a linked list of I/O buffers, rather than a single contiguous buffer. To reduce memory pressure, we also decrypt in situ, and deliver the decrypted data via xfer_deliver_iob() rather than xfer_deliver_raw(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Request a maximum fragment length of 2048 bytesMichael Brown2012-06-291-1/+8
| | | | | | | | | | | The default maximum plaintext fragment length for TLS is 16kB, which is a substantial amount of memory for iPXE to have to allocate for a temporary decryption buffer. Reduce the memory footprint of TLS connections by requesting a maximum fragment length of 2kB. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Mark security negotiation as a pending operationMichael Brown2012-06-091-4/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use asynchronous certificate validatorMichael Brown2012-05-081-2/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificate chains to be long-lived data structuresMichael Brown2012-05-041-0/+3
| | | | | | | | | | | | | | | | | At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support sending a client certificateMichael Brown2012-03-201-2/+31
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Treat handshake digest algorithm as a session parameterMichael Brown2012-03-201-0/+4
| | | | | | | | | Simplify code by recording the active handshake digest algorithm as a session parameter. (Note that we must still accumulate digests for all supported algorithms, since we don't know which digest will eventually be used until we receive the Server Hello.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use hybrid MD5+SHA1 algorithmMichael Brown2012-03-201-4/+24
| | | | | | | | TLSv1.1 and earlier use a hybrid of MD5 and SHA-1 to generate digests over the handshake messages. Formalise this as a separate digest algorithm "md5+sha1". Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use iPXE native RSA algorithmMichael Brown2012-03-181-3/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Formalise the definition of a TLS cipher suiteMichael Brown2012-03-061-3/+11
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support (and prefer) SHA-256 variants of existing cipher suitesMichael Brown2012-03-051-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support TLS version 1.2Michael Brown2012-03-051-0/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Send empty Certificate record if requested by serverMichael Brown2012-03-031-3/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow transmitted records to be scheduled independentlyMichael Brown2012-03-031-10/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add support for Server Name Indication (SNI)Michael Brown2012-03-031-1/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support TLS version 1.1Michael Brown2012-03-031-0/+2
| | | | | | | | Advertise support for TLS version 1.1, and be prepared to downgrade to TLS version 1.0. Tested against Apache with mod_gnutls, using the GnuTLSPriorities directive to force specific protocol versions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [interface] Convert all data-xfer interfaces to generic interfacesMichael Brown2010-06-221-5/+5
| | | | | | | | | | | | | | Remove data-xfer as an interface type, and replace data-xfer interfaces with generic interfaces supporting the data-xfer methods. Filter interfaces (as used by the TLS layer) are handled using the generic pass-through interface capability. A side-effect of this is that deliver_raw() no longer exists as a data-xfer method. (In practice this doesn't lose any efficiency, since there are no instances within the current codebase where xfer_deliver_raw() is used to pass data to an interface supporting the deliver_raw() method.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Rename gPXE to iPXEMichael Brown2010-04-201-0/+187
Access to the gpxe.org and etherboot.org domains and associated resources has been revoked by the registrant of the domain. Work around this problem by renaming project from gPXE to iPXE, and updating URLs to match. Also update README, LOG and COPYRIGHTS to remove obsolete information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-05-31 06:20:57 +0200