summaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAgeFilesLines
...
* [rng] Use SHA-256 for Hash_df, and validate the hash function strengthMichael Brown2012-03-061-5/+12
| | | | | | | | | | | | | | | | ANS X9.82 Part 4 (April 2011 Draft) Section 13.3.4.2 states that "When using the derivation function based on a hash function, the output length of the hash function shall meet or exceed the security strength indicated by the min_entropy parameter in the Get_entropy_input call", although this criteria is missing from the pseudocode provided in the same section. Add a test for this condition, and upgrade from SHA-1 to SHA-256 since SHA-1 has an output length of 160 bits, which is insufficient for generating the (128 * 3/2 = 192) bits required when instantiating the 128-bit strength DRBG. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow hash_df() to accept multiple underlying hash algorithmsMichael Brown2012-03-062-16/+15Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Formalise the definition of a TLS cipher suiteMichael Brown2012-03-061-3/+11
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support (and prefer) SHA-256 variants of existing cipher suitesMichael Brown2012-03-051-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support TLS version 1.2Michael Brown2012-03-051-0/+6
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Replace MD5 implementationMichael Brown2012-03-051-10/+59
| | | | | | | Replace MD5 implementation with one which is around 20% smaller. This implementation has been verified using the existing MD5 self-tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add SHA-256 algorithmMichael Brown2012-03-051-0/+73
| | | | | | This implementation has been verified using the NIST SHA-256 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Replace SHA-1 implementationMichael Brown2012-03-041-11/+67
| | | | | | | | | Replace SHA-1 implementation from AXTLS with a dedicated iPXE implementation which is around 40% smaller. This implementation has been verified using the existing SHA-1 self-tests (including the NIST SHA-1 test vectors). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add missing #include <stdlib.h>Michael Brown2012-03-041-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Send empty Certificate record if requested by serverMichael Brown2012-03-031-3/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow transmitted records to be scheduled independentlyMichael Brown2012-03-031-10/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add support for Server Name Indication (SNI)Michael Brown2012-03-032-1/+8
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support TLS version 1.1Michael Brown2012-03-031-0/+2
| | | | | | | | Advertise support for TLS version 1.1, and be prepared to downgrade to TLS version 1.0. Tested against Apache with mod_gnutls, using the GnuTLSPriorities directive to force specific protocol versions. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arp] Maintain an ARP transmission queueMichael Brown2012-03-031-5/+3Star
| | | | | | | | Allow packet transmission to be deferred pending successful ARP resolution. This avoids the time spent waiting for a higher-level protocol (e.g. TCP or TFTP) to attempt retransmission. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [undi] Allow underlying PXE stack to construct link-layer headerMichael Brown2012-03-021-0/+8
| | | | | | | | | | | | | | Some PXE stacks (observed with a QLogic 8242) will always try to prepend a link-layer header, even if the caller uses P_UNKNOWN to indicate that the link-layer header has already been filled in. This results in an invalid packet being transmitted. Work around these faulty PXE stacks where possible by stripping the existing link-layer header and allowing the PXE stack to (re)construct the link-layer header itself. Originally-fixed-by: Buck Huppmann <buckh@pobox.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [iscsi] Send any padding inline with the data segmentMichael Brown2012-03-011-2/+0Star
| | | | | | | | | | | | | Some iSCSI targets respond to a PDU before receiving the padding bytes. If the target responds quickly enough, this can cause iPXE to start processing a new TX PDU before the padding bytes have been sent, which results in a protocol violation. Fix by always transmitting the padding bytes along with the data segment. Originally-fixed-by: Shyam Iyer <shyam_iyer@dell.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [syslog] Separate out generic line-based console functionalityMichael Brown2012-02-291-0/+33
| | | | | | | Abstract out the generic line-handling portions of the syslog putchar() routine, to allow use by other console types. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [http] Allow for HTTPS-only buildsMichael Brown2012-02-281-1/+1
| | | | | | | | Separate out the core HTTP functionality (which is shared by both HTTP and HTTPS) from the provision of the "http://" URI opener. This allows for builds that support only "https://" URIs. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add get_random_nz() function required by RSA algorithmMichael Brown2012-02-211-0/+16
| | | | | | | | | RSA requires the generation of random non-zero bytes (i.e. a sequence of random numbers in the range [0x01,0xff]). ANS X9.82 provides various Approved methods for converting random bits into random numbers. The simplest such method is the Simple Discard Method. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 RBG wrapper functionsMichael Brown2012-02-211-0/+43
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 mandatory continuous testsMichael Brown2012-02-211-0/+1
| | | | | | | ANS X9.82 specifies two mandatory continuous tests to be performed upon the noise source. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved Source of Entropy InputMichael Brown2012-02-213-49/+214
| | | | | | | | | | | | | | | | ANS X9.82 specifies several Approved Sources of Entropy Input (SEI). One such SEI uses an entropy source as the Source of Entropy Input, condensing each entropy source output after each GetEntropy call. This can be implemented relatively cheaply in iPXE and avoids the need to allocate potentially very large buffers. (Note that the terms "entropy source" and "Source of Entropy Input" are not synonyms within the context of ANS X9.82.) Use the iPXE API mechanism to allow entropy sources to be selected at compilation time. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Record validity within DRBG stateMichael Brown2012-02-211-0/+2
| | | | | | | | Treat an empty (zeroed) DRBG as invalid. This ensures that a DRBG that has not yet been instantiated (or that has been uninstantiated) will refuse to attempt to generate random bits. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved Hash_df derivation functionMichael Brown2012-02-191-0/+30
| | | | | | | | | ANS X9.82 specifies several Approved derivation functions for use in distributing entropy throughout a buffer. One such derivation function is Hash_df, which can be implemented using the existing iPXE SHA-1 functionality. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [efi] Add iPXE download protocolJarrod Johnson2012-02-152-0/+156
| | | | | | | | | | | | | iPXE exposes some extended capabilities via the PXE FILE API to allow NBPs such as pxelinux to use protocols other than TFTP. Provide an equivalent interface as a UEFI protocol so that EFI binaries may also take advantage of iPXE's extended capabilities. This can be used with a patched version of elilo, for example: http://comments.gmane.org/gmane.comp.boot-loaders.elilo.general/147 Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved DRBG mechanismMichael Brown2012-01-232-0/+119
| | | | | | | | | ANS X9.82 specifies that an Approved DRBG must consist of an Approved algorithm wrapped inside an envelope which handles entropy gathering, prediction resistance, automatic reseeding and other housekeeping tasks. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add dummy entropy sourceMichael Brown2012-01-231-0/+90
| | | | | | | | | | | Cryptographic random number generation requires an entropy source, which is used as the input to a Deterministic Random Bit Generator (DRBG). iPXE does not currently have a suitable entropy source. Provide a dummy source to allow the DRBG code to be implemented. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved HMAC_DRBG algorithmMichael Brown2012-01-232-0/+154
| | | | | | | | | | ANS X9.82 specifies several Approved algorithms for use in a Deterministic Random Bit Generator (DRBG). One such algorithm is HMAC_DRBG, which can be implemented using the existing iPXE SHA-1 and HMAC functionality. This algorithm provides a maximum security strength of 128 bits. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [vmxnet3] Add VMware vmxnet3 driverMichael Brown2012-01-071-0/+1
| | | | | Reviewed-by: Pete Holland <pholland27@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [undi] Ensure that native drivers are tried before the UNDI PCI driverMichael Brown2011-11-111-0/+3
| | | | | Suggested-by: Alessandro Salvatori <sandr8@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [image] Eliminate the register_and_xxx_image() functionsMichael Brown2011-10-251-5/+0Star
| | | | | | | | All users of imgdownload() require registration of the image, so make registration an integral part of imgdownload() itself and simplify the "action" parameter to be one of image_select(), image_exec() et al. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ath9k] Add ath9k driverScott K Logan2011-10-142-1/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list functions required by ath9k driverMichael Brown2011-10-141-0/+154
| | | | | Originally-implemented-by: Scott K Logan <logans@cottsay.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add a basic infrastructure for running self-testsMichael Brown2011-10-141-0/+45
| | | | | | | | This self-test mechanism is inspired by Perl's Test::Simple and similar modules. The aim is to encourage the use of self-tests by making it as easy as possible to create self-test code Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Allow assertion failures to be countedMichael Brown2011-10-141-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Tidy up naming convention for list_contains() and friendsMichael Brown2011-10-141-10/+46
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Use a random DHCP transaction identifier (xid)Michael Brown2011-09-191-3/+6
| | | | | | | | | iPXE currently uses the last four bytes of the MAC address as the DHCP transaction identifier. Reduce the probability of collisions by generating a random transaction identifier. Originally-implemented-by: Amos Kong <akong@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tcp] Allow sufficient headroom for TCP headersMichael Brown2011-09-191-0/+10
| | | | | | | | | | | | | | | TCP currently neglects to allow sufficient space for its own headers when allocating I/O buffers. This problem is masked by the fact that the maximum link-layer header size (802.11) is substantially larger than the common Ethernet link-layer header. Fix by allowing sufficient space for any TCP headers, as well as the network-layer and link-layer headers. Reported-by: Scott K Logan <logans@cottsay.net> Debugged-by: Scott K Logan <logans@cottsay.net> Tested-by: Scott K Logan <logans@cottsay.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Accept certificates without a version numberMichael Brown2011-08-131-0/+12
| | | | | | | The version field of an X.509 certificate appears to be optional. Reported-by: Sebastiano Manusia <Sebastiano.Manusia@chuv.ch> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ipv4] Fix fragment reassemblyMichael Brown2011-07-161-15/+8Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Allow link layer to report broadcast/multicast packets via pull()Michael Brown2011-07-151-9/+19
| | | | | | | | Allow the link layer to directly report whether or not a packet is multicast or broadcast at the time of calling pull(), rather than relying on heuristics to determine this at a later stage. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [dhcp] Add symbolic definitions for DHCP client architecture valuesMichael Brown2011-07-061-0/+33
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [process] Add support for one-shot processesMichael Brown2011-06-281-0/+18
| | | | | | | | | Some processes execute only once, and exist solely in order to defer execution until after the relevant instantiator method has returned. Such processes do not need to be automatically rescheduled when executing. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [process] Pass containing object pointer to process step() methodsMichael Brown2011-06-281-13/+109
| | | | | | | | | Give the step() method a pointer to the containing object, rather than a pointer to the process. This is consistent with the operation of interface methods, and allows a single function to serve as both an interface method and a process step() method. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fc] Send xfer_window_changed() when FCP link is establishedMichael Brown2011-06-281-0/+44
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [fc] Maintain a list of Fibre Channel upper-layer protocol usersMichael Brown2011-06-281-5/+28
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [netdevice] Allow non-completion TX errors to be recordedMichael Brown2011-06-281-0/+2
| | | | | | | | Allow TX errors to be recorded against a network device even when the packet didn't make it as far as netdev_tx(). Inspired-by: Dominik Russenberger <dominik.russenberger@terreactive.ch> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [list] Add list_check_contains()Michael Brown2011-05-031-0/+19
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [sanboot] Add "sanhook" and "sanunhook" commandsMichael Brown2011-04-243-3/+27
| | | | | | | Expose the multiple-SAN-drive capability of the iPXE core via the iPXE command line by adding commands to hook and unhook additional drives. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [parseopt] Allow for pre-initialised option setsMichael Brown2011-04-241-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-01 21:38:55 +0100