summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
...
* [efi] Standardise #include guard in ipxe_download.hMichael Brown2012-07-191-4/+4
| | | | | | | | The script include/ipxe/efi/import.pl relies on a particular format for the #include guard in order to detect EFI headers that are not imported. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Increase maximum window size to 256kBMichael Brown2012-07-091-22/+24
| | | | | | | | A window size of 256kB should be sufficient to allow for full-bandwidth transfers over a Gigabit LAN, and for acceptable transfer speeds over other typical links. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arp] Try to avoid discarding ARP cache entriesMichael Brown2012-07-091-1/+12
| | | | | | | | | Discarding the active ARP cache entry in the middle of a download will substantially disrupt the TCP stream. Try to minimise any such disruption by treating ARP cache entries as expensive, and discarding them only when nothing else is available to discard. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iobuf] Relax alignment requirement for small I/O buffersMichael Brown2012-06-291-11/+0Star
| | | | | | | | | | | | | iPXE currently aligns all I/O buffers on a 2kB boundary. This is overkill for transmitted packets, which are typically much smaller than 2kB. Align I/O buffers on their own size. This reduces the alignment requirement for small buffers, while preserving the guarantee that I/O buffers will never cross boundaries that might cause problems for some DMA engines. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Request a maximum fragment length of 2048 bytesMichael Brown2012-06-291-1/+8
| | | | | | | | | | | The default maximum plaintext fragment length for TLS is 16kB, which is a substantial amount of memory for iPXE to have to allocate for a temporary decryption buffer. Reduce the memory footprint of TLS connections by requesting a maximum fragment length of 2kB. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Add support for TCP window scalingMichael Brown2012-06-291-1/+29
| | | | | | | | The maximum unscaled TCP window (64kB) implies a maximum bandwidth of around 300kB/s on a WAN link with an RTT of 200ms. Add support for the TCP window scaling option to remove this upper limit. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcpip] Allow for architecture-specific TCP/IP checksum routinesMichael Brown2012-06-271-2/+10
| | | | | | | Calculating the TCP/IP checksum on received packets accounts for a substantial fraction of the response latency. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Include hostname within syslog messages where possibleMichael Brown2012-06-201-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Move "domain" setting from dns.c to settings.cMichael Brown2012-06-201-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow an error margin on X.509 certificate validity periodsMichael Brown2012-06-202-8/+8
| | | | | | | | | | | | | iPXE has no concept of the local time zone, mainly because there is no viable way to obtain time zone information in the absence of local state. This causes potential problems with newly-issued certificates and certificates that are about to expire. Avoid such problems by allowing an error margin of around 12 hours on certificate validity periods, similar to the error margin already allowed for OCSP response timestamps. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Request broadcast responses when we already have an IPv4 addressMichael Brown2012-06-201-0/+2
| | | | | | | | | | | | | | | | | FCoE requires the use of multiple local unicast link-layer addresses. To avoid the complexity of managing multiple addresses, iPXE operates in promiscuous mode. As a consequence, any unicast packets with non-matching IPv4 addresses are rejected at the IPv4 layer (rather than at the link layer). This can cause problems when issuing a second DHCP request: if the address chosen by the DHCP server does not match the existing address, then the DHCP response will itself be rejected. Fix by requesting a broadcast response from the DHCP server if the network interface already has any IPv4 addresses. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Mark security negotiation as a pending operationMichael Brown2012-06-091-4/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [pending] Add concept of "pending operations"Michael Brown2012-06-092-0/+35
| | | | | | | | | | iPXE is fundamentally asynchronous in operation: some operations continue in the background even after the foreground has continued to a new task. For example, the closing FIN/ACK exchanges of a TCP connection will take place in the background after an HTTP download has completed. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Construct OCSP check URIMichael Brown2012-05-221-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add framework for OCSPMichael Brown2012-05-154-0/+125
| | | | | | | | Add support for constructing OCSP queries and parsing OCSP responses. (There is no support yet for actually issuing an OCSP query via an HTTP POST.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add functions for constructing ASN.1 objectsMichael Brown2012-05-141-0/+33
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse OCSPSigning key purpose, if presentMichael Brown2012-05-142-0/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise x509_parse_bit_string() to asn1_bit_string()Michael Brown2012-05-142-21/+11Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise asn1_{digest,pubkey,signature}_algorithm()Michael Brown2012-05-141-2/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise x509_parse_time() to asn1_generalized_time()Michael Brown2012-05-141-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 raw public key bit stringMichael Brown2012-05-141-1/+3
| | | | | | | OCSP requires direct access to the bit string portion of the subject public key information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Automatically download cross-signed certificatesMichael Brown2012-05-081-0/+3
| | | | | | | | Automatically attempt to download any required cross-signing certificates from http://ca.ipxe.org/auto, in order to enable the use of standard SSL certificates issued by public CAs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [xferbuf] Add generic data-transfer bufferMichael Brown2012-05-082-0/+32
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use asynchronous certificate validatorMichael Brown2012-05-081-2/+7
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add asynchronous certificate validatorMichael Brown2012-05-082-0/+18
| | | | | | | | | To allow for automatic download of cross-signing certificates and for OCSP, the validation of certificates must be an asynchronous process. Create a stub validator which uses a job-control interface to report the result of certificate validation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_auto_append()Michael Brown2012-05-081-0/+2
| | | | | | | | | | CMS includes an unordered certificate set, from which certificates must be extracted in order by matching up issuers with subjects. We will use the same functionality as part of the automatic download of cross-signing certificates. Generalise cms_find_subject() to x509_find_subject(), and create x509_auto_append(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add x509_append_raw()Michael Brown2012-05-081-0/+16
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_last_entry()Michael Brown2012-05-081-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificate chains to be long-lived data structuresMichael Brown2012-05-043-38/+174
| | | | | | | | | | | | | | | | | At present, certificate chain validation is treated as an instantaneous process that can be carried out using only data that is already in memory. This model does not allow for validation to include non-instantaneous steps, such as downloading a cross-signing certificate, or determining certificate revocation status via OCSP. Redesign the internal representation of certificate chains to allow chains to outlive the scope of the original source of certificates (such as a TLS Certificate record). Allow for certificates to be cached, so that each certificate needs to be validated only once. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Add Linux time source using gettimeofday()Michael Brown2012-05-043-1/+19
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse OCSP responder URI from X.509 certificateMichael Brown2012-05-042-4/+51
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_for_each_entry_continue() and _continue_reverse()Michael Brown2012-05-041-0/+26
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add "--default" option to "choose" commandMichael Brown2012-04-291-1/+1
| | | | | Suggested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [myson] Replace driver for Myson Technology NICsMichael Brown2012-04-271-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [natsemi] Replace driver for National Semicondutor NICsMichael Brown2012-04-261-0/+13
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow client certificate to be changed without a rebuildMichael Brown2012-04-241-0/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [intel] Replace driver for Intel Gigabit NICsMichael Brown2012-04-241-0/+1
| | | | | | Tested-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Thomas Miletich <thomas.miletich@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [skel] Add skeleton network driverMichael Brown2012-04-211-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow trusted root certificate to be changed without a rebuildMichael Brown2012-04-192-1/+5
| | | | | | | | | | | | | | | | | | | | Changing the trusted root certificate currently requires a rebuild of the iPXE binary, which may be inconvenient or impractical. Allow the list of trusted root certificate fingerprints to be overridden using the "trust" setting, but only at the point of iPXE initialisation. This prevents untrusted sources of settings (e.g. DHCP) from subverting the chain of trust, while allowing trustworthy sources to change the trusted root certificate without requiring a rebuild. The basic idea is that if you are able to manipulate a trustworthy source of settings (e.g. VMware GuestInfo or non-volatile stored options), then you would be able to replace the iPXE binary anyway, and so no security is lost by allowing such sources to override the list of trusted root certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Add fetch_setting_copy()Michael Brown2012-04-191-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [multiboot] Place multiboot modules low in memoryMichael Brown2012-04-191-1/+1
| | | | | | | | | | | | | | | Solaris assumes that there is enough space above the Multiboot modules to use as a decompression and scratch area. This assumption is invalid when using iPXE, which places the Multiboot modules near the top of (32-bit) memory. Fix by copying the modules to an area of memory immediately following the loaded kernel. Debugged-by: Michael Brown <mcb30@ipxe.org> Debugged-by: Scott McWhirter <scottm@joyent.com> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [realtek] Replace driver for Realtek Gigabit NICsMichael Brown2012-04-181-0/+1
| | | | | | | Tested-by: Thomas Miletich <thomas.miletich@gmail.com> Debugged-by: Thomas Miletich <thomas.miletich@gmail.com> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Add generic MII reset functionMichael Brown2012-04-182-0/+87
| | | | | | | | | iPXE provides no support for manually configuring the link speed. Provide a generic routine which should be able to reset any MII/GMII PHY and enable autonegotiation. Prototyped-by: Thomas Miletich <thomas.miletich@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Synchronise constants with current Linux include/linux/mii.hMichael Brown2012-04-181-116/+113Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [mii] Remove unused functionalityMichael Brown2012-04-181-59/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [settings] Split fetching and storing out of setting type handlersMichael Brown2012-04-172-29/+14Star
| | | | | | | Refactor setting type handlers to parse and format values, rather than storing and fetching formatted values. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for setting typesMichael Brown2012-04-171-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Allow strtoul() to interpret negative numbersMichael Brown2012-04-171-4/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Add basic support for encrypted syslog via TLSMichael Brown2012-04-101-0/+3
| | | | | | | Encrypted syslog seems not yet to be standardised, but is supported by some existing syslog servers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add menu commandsMichael Brown2012-03-293-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow iPXE scripts to create menus. For example: #!ipxe menu iSCSI boot demonstration item install Install Fedora to ${root-path} item --default boot Boot from ${root-path} item shell Enter iPXE shell item exit Exit to BIOS choose label && goto ${label} :boot sanboot ${root-path} :install sanhook ${root-path} chain http://${next-server}/fedora.ipxe :shell shell :exit Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-01 18:31:05 +0100