summaryrefslogtreecommitdiffstats
path: root/src/include/ipxe
Commit message (Collapse)AuthorAgeFilesLines
...
* [crypto] Parse OCSPSigning key purpose, if presentMichael Brown2012-05-142-0/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise x509_parse_bit_string() to asn1_bit_string()Michael Brown2012-05-142-21/+11Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise asn1_{digest,pubkey,signature}_algorithm()Michael Brown2012-05-141-2/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise x509_parse_time() to asn1_generalized_time()Michael Brown2012-05-141-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 raw public key bit stringMichael Brown2012-05-141-1/+3
| | | | | | | OCSP requires direct access to the bit string portion of the subject public key information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Automatically download cross-signed certificatesMichael Brown2012-05-081-0/+3
| | | | | | | | Automatically attempt to download any required cross-signing certificates from http://ca.ipxe.org/auto, in order to enable the use of standard SSL certificates issued by public CAs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xferbuf] Add generic data-transfer bufferMichael Brown2012-05-082-0/+32
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use asynchronous certificate validatorMichael Brown2012-05-081-2/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add asynchronous certificate validatorMichael Brown2012-05-082-0/+18
| | | | | | | | | To allow for automatic download of cross-signing certificates and for OCSP, the validation of certificates must be an asynchronous process. Create a stub validator which uses a job-control interface to report the result of certificate validation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_auto_append()Michael Brown2012-05-081-0/+2
| | | | | | | | | | CMS includes an unordered certificate set, from which certificates must be extracted in order by matching up issuers with subjects. We will use the same functionality as part of the automatic download of cross-signing certificates. Generalise cms_find_subject() to x509_find_subject(), and create x509_auto_append(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_append_raw()Michael Brown2012-05-081-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_last_entry()Michael Brown2012-05-081-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificate chains to be long-lived data structuresMichael Brown2012-05-043-38/+174
| | | | | | | | | | | | | | | | | At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Add Linux time source using gettimeofday()Michael Brown2012-05-042-0/+19
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse OCSP responder URI from X.509 certificateMichael Brown2012-05-042-4/+51
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_for_each_entry_continue() and _continue_reverse()Michael Brown2012-05-041-0/+26
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add "--default" option to "choose" commandMichael Brown2012-04-291-1/+1
| | | | | Suggested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [myson] Replace driver for Myson Technology NICsMichael Brown2012-04-271-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [natsemi] Replace driver for National Semicondutor NICsMichael Brown2012-04-261-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow client certificate to be changed without a rebuildMichael Brown2012-04-241-0/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Replace driver for Intel Gigabit NICsMichael Brown2012-04-241-0/+1
| | | | | | Tested-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Thomas Miletich <thomas.miletich@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [skel] Add skeleton network driverMichael Brown2012-04-211-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow trusted root certificate to be changed without a rebuildMichael Brown2012-04-192-1/+5
| | | | | | | | | | | | | | | | | | | | Changing the trusted root certificate currently requires a rebuild of the iPXE binary, which may be inconvenient or impractical. Allow the list of trusted root certificate fingerprints to be overridden using the "trust" setting, but only at the point of iPXE initialisation. This prevents untrusted sources of settings (e.g. DHCP) from subverting the chain of trust, while allowing trustworthy sources to change the trusted root certificate without requiring a rebuild. The basic idea is that if you are able to manipulate a trustworthy source of settings (e.g. VMware GuestInfo or non-volatile stored options), then you would be able to replace the iPXE binary anyway, and so no security is lost by allowing such sources to override the list of trusted root certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Add fetch_setting_copy()Michael Brown2012-04-191-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [multiboot] Place multiboot modules low in memoryMichael Brown2012-04-191-1/+1
| | | | | | | | | | | | | | | Solaris assumes that there is enough space above the Multiboot modules to use as a decompression and scratch area. This assumption is invalid when using iPXE, which places the Multiboot modules near the top of (32-bit) memory. Fix by copying the modules to an area of memory immediately following the loaded kernel. Debugged-by: Michael Brown <mcb30@ipxe.org> Debugged-by: Scott McWhirter <scottm@joyent.com> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [realtek] Replace driver for Realtek Gigabit NICsMichael Brown2012-04-181-0/+1
| | | | | | | Tested-by: Thomas Miletich <thomas.miletich@gmail.com> Debugged-by: Thomas Miletich <thomas.miletich@gmail.com> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Add generic MII reset functionMichael Brown2012-04-182-0/+87
| | | | | | | | | iPXE provides no support for manually configuring the link speed. Provide a generic routine which should be able to reset any MII/GMII PHY and enable autonegotiation. Prototyped-by: Thomas Miletich <thomas.miletich@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Split fetching and storing out of setting type handlersMichael Brown2012-04-172-29/+14Star
| | | | | | | Refactor setting type handlers to parse and format values, rather than storing and fetching formatted values. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for setting typesMichael Brown2012-04-171-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Add basic support for encrypted syslog via TLSMichael Brown2012-04-101-0/+3
| | | | | | | Encrypted syslog seems not yet to be standardised, but is supported by some existing syslog servers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add menu commandsMichael Brown2012-03-293-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow iPXE scripts to create menus. For example: #!ipxe menu iSCSI boot demonstration item install Install Fedora to ${root-path} item --default boot Boot from ${root-path} item shell Enter iPXE shell item exit Exit to BIOS choose label && goto ${label} :boot sanboot ${root-path} :install sanhook ${root-path} chain http://${next-server}/fedora.ipxe :shell shell :exit Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add menu user interfaceMichael Brown2012-03-292-0/+3
| | | | | | Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add the abstract concept of a menuMichael Brown2012-03-291-0/+47
| | | | | | Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [parseopt] Allow "prompt" command to accept character literals for --keyMichael Brown2012-03-291-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Pass internal syslog() priority through to syslog consoleMichael Brown2012-03-262-4/+11
| | | | | | | Use a private ANSI escape sequence to convey the priority of an internal syslog() message through to the syslog server. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Do not share ANSI escape context between lineconsole usersMichael Brown2012-03-261-0/+3
| | | | | | | | An ANSI escape sequence context cannot be shared between multiple users. Make the ANSI escape sequence context part of the line console definition and provide individual contexts for each user. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Add "log message" console usage and an internal syslog() callMichael Brown2012-03-262-3/+8
| | | | | | | | | | | | | | | Provide an internal syslog() function (unrelated to the syslog console) which can be used to create log messages with specified priorities. The build-time constant LOG_LEVEL can be used to select the minimum required priority for log messages. Any messages that do not have a sufficient priority will be ignored (and will be optimised away at compile-time). The default LOG_LEVEL is LOG_NONE. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Exclude text-based UI output from logfile-based consolesMichael Brown2012-03-261-1/+5
| | | | | | | | The output from text-based user interfaces such as the "config" command is not generally meaningful for logfile-based consoles such as syslog and vmconsole. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Allow usage to be defined independently for each consoleMichael Brown2012-03-261-1/+50
| | | | | | | | | | | | | | | | | | | | | Add the concept of a "console usage", such as "standard output" or "debug messages". Allow usages to be associated with each console independently. For example, to send debugging output via the serial port, while preventing it from appearing on the local console: #define CONSOLE_SERIAL CONSOLE_USAGE_ALL #define CONSOLE_PCBIOS ( CONSOLE_USAGE_ALL & ~CONSOLE_USAGE_DEBUG ) If no usages are explicitly specified, then a default set of usages will be applied. For example: #define CONSOLE_SERIAL will have the same affect as #define CONSOLE_SERIAL CONSOLE_USAGE_ALL Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Move putchar() and getchar() declarations to stdio.hMichael Brown2012-03-261-2/+1Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgtrust" and "imgverify" commandsMichael Brown2012-03-251-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Simplify image management commands and internal APIMichael Brown2012-03-252-11/+10Star
| | | | | | | | | | | | | | | | | | | | | | Remove the name, cmdline, and action parameters from imgdownload() and imgdownload_string(). These functions now simply download and return an image. Add the function imgacquire(), which will interpret a "name or URI string" parameter and return either an existing image or a newly downloaded image. Use imgacquire() to merge similar image-management commands that currently differ only by whether they take the name of an existing image or the URI of a new image to download. For example, "chain" and "imgexec" can now be merged. Extend imgstat and imgfree commands to take an optional list of images. Remove the arbitrary restriction on the length of image names. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add concept of trusted imagesMichael Brown2012-03-221-0/+22
| | | | | | | | | | | | | | | | Trusted images may always be executed. Untrusted images may be executed only if the current image trust requirement allows untrusted images. Images can be marked as trusted using image_trust(), and marked as untrusted using image_untrust(). The current image trust requirement can be changed using image_set_trust(). It is possible to make the change permanent, in which case any future attempts to change the image trust requirement will fail. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add support for Cryptographic Message Syntax (PKCS #7)Michael Brown2012-03-223-0/+57
| | | | | | | | | | | | The Cryptographic Message Syntax (PKCS#7) provides a format for encapsulating digital signatures of arbitrary binary blobs. A signature can be generated using openssl cms -sign -in <file to sign> -binary -noattr \ -signer <signer>.crt -inkey <signer>.key -certfile <CA>.crt \ -outform DER -out <signature> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 extended key usage extensionMichael Brown2012-03-222-0/+39
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add previous certificate in chain as a parameter to parse_next()Michael Brown2012-03-221-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 certificate serial numberMichael Brown2012-03-221-0/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 OID-identified algorithm to asn1.cMichael Brown2012-03-222-26/+26
| | | | | | | | The concept of an OID-identified algorithm as defined in X.509 is used in some other standards (e.g. PKCS#7). Generalise this functionality and provide it as part of the ASN.1 core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add X.509 self-testsMichael Brown2012-03-221-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Treat ASN.1 OIDs as opaqueMichael Brown2012-03-211-105/+60Star
| | | | | | | | | OIDs are theoretically part of a global hierarchy. However, the hierarchy is sufficiently disorganised as to be essentially meaningless for all purposes other than guaranteeing uniqueness. Ignore the hierarchical nature of OIDs and treat them as opaque. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-01 15:40:31 +0100