summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
...
* [menu] Add menu user interfaceMichael Brown2012-03-292-0/+3
| | | | | | Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [menu] Add the abstract concept of a menuMichael Brown2012-03-291-0/+47
| | | | | | Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [parseopt] Allow "prompt" command to accept character literals for --keyMichael Brown2012-03-291-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Add LOG_ALL as a synonym for LOG_DEBUGMichael Brown2012-03-271-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Pass internal syslog() priority through to syslog consoleMichael Brown2012-03-263-12/+32
| | | | | | | Use a private ANSI escape sequence to convey the priority of an internal syslog() message through to the syslog server. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Do not share ANSI escape context between lineconsole usersMichael Brown2012-03-261-0/+3
| | | | | | | | An ANSI escape sequence context cannot be shared between multiple users. Make the ANSI escape sequence context part of the line console definition and provide individual contexts for each user. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Add "log message" console usage and an internal syslog() callMichael Brown2012-03-263-3/+92
| | | | | | | | | | | | | | | Provide an internal syslog() function (unrelated to the syslog console) which can be used to create log messages with specified priorities. The build-time constant LOG_LEVEL can be used to select the minimum required priority for log messages. Any messages that do not have a sufficient priority will be ignored (and will be optimised away at compile-time). The default LOG_LEVEL is LOG_NONE. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Exclude text-based UI output from logfile-based consolesMichael Brown2012-03-261-1/+5
| | | | | | | | The output from text-based user interfaces such as the "config" command is not generally meaningful for logfile-based consoles such as syslog and vmconsole. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Allow usage to be defined independently for each consoleMichael Brown2012-03-262-14/+53
| | | | | | | | | | | | | | | | | | | | | Add the concept of a "console usage", such as "standard output" or "debug messages". Allow usages to be associated with each console independently. For example, to send debugging output via the serial port, while preventing it from appearing on the local console: #define CONSOLE_SERIAL CONSOLE_USAGE_ALL #define CONSOLE_PCBIOS ( CONSOLE_USAGE_ALL & ~CONSOLE_USAGE_DEBUG ) If no usages are explicitly specified, then a default set of usages will be applied. For example: #define CONSOLE_SERIAL will have the same affect as #define CONSOLE_SERIAL CONSOLE_USAGE_ALL Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Remove unused "btext" consoleMichael Brown2012-03-261-62/+0Star
| | | | | | The "btext" console has been disabled by a "#if 0" since 2007. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [console] Move putchar() and getchar() declarations to stdio.hMichael Brown2012-03-263-3/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add the "imgtrust" and "imgverify" commandsMichael Brown2012-03-252-0/+18
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Simplify image management commands and internal APIMichael Brown2012-03-253-46/+13Star
| | | | | | | | | | | | | | | | | | | | | | Remove the name, cmdline, and action parameters from imgdownload() and imgdownload_string(). These functions now simply download and return an image. Add the function imgacquire(), which will interpret a "name or URI string" parameter and return either an existing image or a newly downloaded image. Use imgacquire() to merge similar image-management commands that currently differ only by whether they take the name of an existing image or the URI of a new image to download. For example, "chain" and "imgexec" can now be merged. Extend imgstat and imgfree commands to take an optional list of images. Remove the arbitrary restriction on the length of image names. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Add concept of trusted imagesMichael Brown2012-03-221-0/+22
| | | | | | | | | | | | | | | | Trusted images may always be executed. Untrusted images may be executed only if the current image trust requirement allows untrusted images. Images can be marked as trusted using image_trust(), and marked as untrusted using image_untrust(). The current image trust requirement can be changed using image_set_trust(). It is possible to make the change permanent, in which case any future attempts to change the image trust requirement will fail. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add support for Cryptographic Message Syntax (PKCS #7)Michael Brown2012-03-223-0/+57
| | | | | | | | | | | | The Cryptographic Message Syntax (PKCS#7) provides a format for encapsulating digital signatures of arbitrary binary blobs. A signature can be generated using openssl cms -sign -in <file to sign> -binary -noattr \ -signer <signer>.crt -inkey <signer>.key -certfile <CA>.crt \ -outform DER -out <signature> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 extended key usage extensionMichael Brown2012-03-222-0/+39
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add previous certificate in chain as a parameter to parse_next()Michael Brown2012-03-221-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Parse X.509 certificate serial numberMichael Brown2012-03-221-0/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 OID-identified algorithm to asn1.cMichael Brown2012-03-222-26/+26
| | | | | | | | The concept of an OID-identified algorithm as defined in X.509 is used in some other standards (e.g. PKCS#7). Generalise this functionality and provide it as part of the ASN.1 core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add X.509 self-testsMichael Brown2012-03-221-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Treat ASN.1 OIDs as opaqueMichael Brown2012-03-211-105/+60Star
| | | | | | | | | OIDs are theoretically part of a global hierarchy. However, the hierarchy is sufficiently disorganised as to be essentially meaningless for all purposes other than guaranteeing uniqueness. Ignore the hierarchical nature of OIDs and treat them as opaque. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Move all ASN.1 OIDs to asn1.hMichael Brown2012-03-213-91/+91
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use standard bit-rotation functionsMichael Brown2012-03-211-4/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support sending a client certificateMichael Brown2012-03-201-2/+31
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow a client certificate to be specified at build timeMichael Brown2012-03-201-0/+43
| | | | | | | | | | | | | | | | | | | Allow a client certificate and corresponding private key to be specified at build time using the syntax make CERT=/path/to/certificate KEY=/path/to/key The build process uses openssl to convert the files into DER format, and includes them within the client certificate store in clientcert.c. The build process will prompt for the private key password if applicable. Note that the private key is stored unencrypted, and so the resulting iPXE binary (and the temporary files created during the build process) should be treated as being equivalent to an unencrypted private key file. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use linker tables for RSA digestInfo prefixesMichael Brown2012-03-201-0/+18
| | | | | | | Allow external code to specify RSA digestInfo prefixes for additional digest algorithms. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Treat handshake digest algorithm as a session parameterMichael Brown2012-03-201-0/+4
| | | | | | | | | Simplify code by recording the active handshake digest algorithm as a session parameter. (Note that we must still accumulate digests for all supported algorithms, since we don't know which digest will eventually be used until we receive the Server Hello.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use hybrid MD5+SHA1 algorithmMichael Brown2012-03-201-4/+24
| | | | | | | | TLSv1.1 and earlier use a hybrid of MD5 and SHA-1 to generate digests over the handshake messages. Formalise this as a separate digest algorithm "md5+sha1". Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Check certificate validity period against current date and timeMichael Brown2012-03-201-3/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Parse X.509 validity times into seconds since the EpochMichael Brown2012-03-201-12/+3Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Define an API for getting the current timeMichael Brown2012-03-193-0/+97
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Add mktime() functionMichael Brown2012-03-192-25/+36
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add full X.509 certificate parsingMichael Brown2012-03-192-5/+225
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Force caller to provide temporary storage for modular calculationsMichael Brown2012-03-182-8/+43
| | | | | | | | | | | | | bigint_mod_multiply() and bigint_mod_exp() require a fixed amount of temporary storage for intermediate results. (The amount of temporary storage required depends upon the size of the integers involved.) When performing calculations for 4096-bit RSA the amount of temporary storage space required will exceed 2.5kB, which is too much to allocate on the stack. Avoid this problem by forcing the caller to allocate temporary storage. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add Linux entropy source using /dev/randomMichael Brown2012-03-183-0/+34
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow entropy_enable() to return an errorMichael Brown2012-03-182-2/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use iPXE native RSA algorithmMichael Brown2012-03-182-23/+3Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add native RSA algorithmMichael Brown2012-03-182-3/+128
| | | | | | Add an implementation of RSA that uses the iPXE big-integer support. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add abstraction for a public-key algorithmMichael Brown2012-03-181-0/+98
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add more ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-181-7/+19
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Run self-tests as an embedded imageMichael Brown2012-03-181-0/+1
| | | | | | | Allow iPXE to exit after running self-tests, rather than locking the machine. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Move VA_ARG_COUNT() macro to stdarg.hMichael Brown2012-03-182-26/+27
| | | | | | | Make the non-standard but extremely useful macro VA_ARG_COUNT() available outside of dhcp.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add big-integer library for RSA calculationsMichael Brown2012-03-141-0/+268
| | | | | | | | | | | | | | RSA requires modular exponentiation using arbitrarily large integers. Given the sizes of the modulus and exponent, all required calculations can be done without any further dynamic storage allocation. The x86 architecture allows for efficient large integer support via inline assembly using the instructions that take advantage of the carry flag (e.g. "adcl", "rcrl"). This implemention is approximately 80% smaller than the (more generic) AXTLS implementation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-131-13/+94
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Remove obsolete (and unfinished) get_random_bytes() functionMichael Brown2012-03-131-2/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use const to mark incoming data being processedMichael Brown2012-03-131-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Upgrade AES and RSA code to upstream axTLS version 1.4.5Michael Brown2012-03-091-0/+4
| | | | | | | | | All axTLS files are now vanilla versions of the upstream axTLS files, with one minor exception: the unused "ctx" parameter of bi_int_divide() has been marked with "__unused" to avoid a compilation error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [debug] Ensure debug address and colourisation fields are fully initialisedMichael Brown2012-03-061-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Choose HMAC_DRBG using SHA-256 as the DRBG algorithmMichael Brown2012-03-061-7/+6Star
| | | | | | | | | | | | Both HMAC_DRBG using SHA-1 and HMAC_DRBG using SHA-256 are Approved algorithms in ANS X9.82 for our chosen security strength of 128 bits. However, general recommendations (see e.g. NIST SP800-57) are to use a larger hash function in preference to SHA-1. Since SHA-256 is required anyway for TLSv1.2 support, there is no code size penalty for switching HMAC_DRBG to also use SHA-256. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow HMAC_DRBG to use multiple underlying hash algorithmsMichael Brown2012-03-062-37/+153
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-01 20:12:47 +0100