summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* [crypto] Generalise X.509 OID-identified algorithm to asn1.cMichael Brown2012-03-225-121/+155
| | | | | | | | The concept of an OID-identified algorithm as defined in X.509 is used in some other standards (e.g. PKCS#7). Generalise this functionality and provide it as part of the ASN.1 core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add X.509 self-testsMichael Brown2012-03-223-0/+920
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Validate path length constraint in certificate chainMichael Brown2012-03-211-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Treat ASN.1 OIDs as opaqueMichael Brown2012-03-211-105/+60Star
| | | | | | | | | OIDs are theoretically part of a global hierarchy. However, the hierarchy is sufficiently disorganised as to be essentially meaningless for all purposes other than guaranteeing uniqueness. Ignore the hierarchical nature of OIDs and treat them as opaque. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Move all ASN.1 OIDs to asn1.hMichael Brown2012-03-213-91/+91
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use standard bit-rotation functionsMichael Brown2012-03-214-37/+11Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Support sending a client certificateMichael Brown2012-03-202-15/+268
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow a client certificate to be specified at build timeMichael Brown2012-03-203-6/+197
| | | | | | | | | | | | | | | | | | | Allow a client certificate and corresponding private key to be specified at build time using the syntax make CERT=/path/to/certificate KEY=/path/to/key The build process uses openssl to convert the files into DER format, and includes them within the client certificate store in clientcert.c. The build process will prompt for the private key password if applicable. Note that the private key is stored unencrypted, and so the resulting iPXE binary (and the temporary files created during the build process) should be treated as being equivalent to an unencrypted private key file. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use linker tables for RSA digestInfo prefixesMichael Brown2012-03-202-37/+44
| | | | | | | Allow external code to specify RSA digestInfo prefixes for additional digest algorithms. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Treat handshake digest algorithm as a session parameterMichael Brown2012-03-202-39/+28Star
| | | | | | | | | Simplify code by recording the active handshake digest algorithm as a session parameter. (Note that we must still accumulate digests for all supported algorithms, since we don't know which digest will eventually be used until we receive the Server Hello.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use hybrid MD5+SHA1 algorithmMichael Brown2012-03-202-17/+90
| | | | | | | | TLSv1.1 and earlier use a hybrid of MD5 and SHA-1 to generate digests over the handshake messages. Formalise this as a separate digest algorithm "md5+sha1". Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Check certificate validity period against current date and timeMichael Brown2012-03-203-11/+49
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Parse X.509 validity times into seconds since the EpochMichael Brown2012-03-202-24/+17Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Include current time within the client random bytesMichael Brown2012-03-201-1/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Add RTC-based time sourceMichael Brown2012-03-196-40/+242
| | | | | | Add a time source using the CMOS RTC to obtain the current time. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [time] Define an API for getting the current timeMichael Brown2012-03-1910-0/+169
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for mktime()Michael Brown2012-03-192-0/+183
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Add mktime() functionMichael Brown2012-03-193-25/+173
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use correct constraint for byte-addressable registerMichael Brown2012-03-191-1/+1
| | | | | Reported-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Validate server certificateMichael Brown2012-03-191-36/+93
| | | | | | | | | | Validate the server certificate against the trusted root certificate store. The server must provide a complete certificate chain, up to and including the trusted root certificate that is embedded into iPXE. Note that the date and time are not yet validated. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow trusted root certificates to be specified at build timeMichael Brown2012-03-192-0/+29
| | | | | | | | | | | | | | | | | | | | Allow trusted root certificates to be specified at build time using the syntax make TRUST=/path/to/certificate1,/path/to/certificate2,... The build process uses openssl to calculate the SHA-256 fingerprints of the specified certificates, and adds them to the root certificate store in rootcert.c. The certificates can be in any format understood by openssl. The certificates may be server certificates or (more usefully) CA certificates. If no trusted certificates are specified, then the default "iPXE root CA" certificate will be used. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add full X.509 certificate parsingMichael Brown2012-03-195-38/+1443
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rsa] Actually check the unused-bits byte in the public key bit stringMichael Brown2012-03-181-3/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Force caller to provide temporary storage for modular calculationsMichael Brown2012-03-185-40/+99
| | | | | | | | | | | | | bigint_mod_multiply() and bigint_mod_exp() require a fixed amount of temporary storage for intermediate results. (The amount of temporary storage required depends upon the size of the integers involved.) When performing calculations for 4096-bit RSA the amount of temporary storage space required will exceed 2.5kB, which is too much to allocate on the stack. Avoid this problem by forcing the caller to allocate temporary storage. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add Linux entropy source using /dev/randomMichael Brown2012-03-185-1/+131
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow entropy_enable() to return an errorMichael Brown2012-03-185-5/+12
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove obsolete AXTLS RSA algorithmMichael Brown2012-03-182-1782/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use iPXE native RSA algorithmMichael Brown2012-03-184-202/+68Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add self-tests for RSAMichael Brown2012-03-183-0/+667
| | | | | | | Add self-tests for the RSA algorithm using test vectors generated with the openssl tools. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add native RSA algorithmMichael Brown2012-03-184-3/+728
| | | | | | Add an implementation of RSA that uses the iPXE big-integer support. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add abstraction for a public-key algorithmMichael Brown2012-03-182-0/+147
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add more ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-183-9/+125
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Run self-tests as an embedded imageMichael Brown2012-03-182-4/+43
| | | | | | | Allow iPXE to exit after running self-tests, rather than locking the machine. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Fix build error when assertions are enabledMichael Brown2012-03-181-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [libc] Move VA_ARG_COUNT() macro to stdarg.hMichael Brown2012-03-182-26/+27
| | | | | | | Make the non-standard but extremely useful macro VA_ARG_COUNT() available outside of dhcp.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [myri10ge] Fix compilation error in myri10ge_command() with gcc 4.7Olaf Hering2012-03-162-4/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use real prototypes for AXTLS' AES_encrypt() and AES_decrypt()Michael Brown2012-03-141-3/+3
| | | | | | | | Avoid a compiler warning on some versions of gcc by using real function prototypes. Reported-by: Rob Shelley <Rob@cirris.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [eepro100] Add PCI ID 8086:10fe1d 2k2012-03-141-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Add big integer self-testsMichael Brown2012-03-142-0/+2430
| | | | | | These test vectors are generated using Perl's Math::BigInt. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add big-integer library for RSA calculationsMichael Brown2012-03-145-0/+798
| | | | | | | | | | | | | | RSA requires modular exponentiation using arbitrarily large integers. Given the sizes of the modulus and exponent, all required calculations can be done without any further dynamic storage allocation. The x86 architecture allows for efficient large integer support via inline assembly using the instructions that take advantage of the carry flag (e.g. "adcl", "rcrl"). This implemention is approximately 80% smaller than the (more generic) AXTLS implementation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-132-18/+151
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Remove obsolete (and unfinished) get_random_bytes() functionMichael Brown2012-03-132-57/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Use rbg_generate() for secure random numbersMichael Brown2012-03-131-1/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [forcedeth] Use standard random() functionMichael Brown2012-03-131-2/+1Star
| | | | | | | It seems unlikely that a network card driver requires cryptographically secure random numbers. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use const to mark incoming data being processedMichael Brown2012-03-132-27/+29
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Upgrade AES and RSA code to upstream axTLS version 1.4.5Michael Brown2012-03-0912-603/+509Star
| | | | | | | | | All axTLS files are now vanilla versions of the upstream axTLS files, with one minor exception: the unused "ctx" parameter of bi_int_divide() has been marked with "__unused" to avoid a compilation error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ath9k] Fix compilation on older gcc versionsMichael Brown2012-03-092-3/+2Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [prefix] Eliminate uninitialised variableMichael Brown2012-03-091-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [test] Avoid using "static const" for test declarationsMichael Brown2012-03-073-6/+6
| | | | | | | | gcc will not warn about unused constant static variables. An unused test declaration is almost certainly a bug, so ensure that warnings are generated. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [debug] Ensure debug address and colourisation fields are fully initialisedMichael Brown2012-03-061-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-03-06 01:14:26 +0100