From 77acf6b41f705384593a057c2bea057283bf429b Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 26 Jun 2024 04:29:38 -0700 Subject: [ipv4] Support small subnets with no directed broadcast address In a small subnet (with a /31 or /32 subnet mask), all addresses within the subnet are valid host addresses: there is no separate network address or directed broadcast address. The logic used in iPXE to determine whether or not to use a link-layer broadcast address will currently fail in these subnets. In a /31 subnet, the higher of the two host addresses (i.e. the address with all host bits set) will be treated as a broadcast address. In a /32 subnet, the single valid host address will be treated as a broadcast address. Fix by adding the concept of a host mask, defined such that an address in the local subnet with all of the mask bits set to zero represents the network address, and an address in the local subnet with all of the mask bits set to one represents the directed broadcast address. For most subnets, this is simply the inverse of the subnet mask. For small subnets (/31 or /32) we can obtain the desired behaviour by setting the host mask to all ones, so that only the local broadcast address 255.255.255.255 will be treated as a broadcast address. Originally-fixed-by: Lukas Stockner Signed-off-by: Michael Brown --- src/net/ipv4.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) (limited to 'src/net') diff --git a/src/net/ipv4.c b/src/net/ipv4.c index b91fa2ad0..5d0cb0f9a 100644 --- a/src/net/ipv4.c +++ b/src/net/ipv4.c @@ -85,9 +85,18 @@ static int add_ipv4_miniroute ( struct net_device *netdev, struct in_addr address, struct in_addr netmask, struct in_addr gateway ) { struct ipv4_miniroute *miniroute; + struct in_addr hostmask; + struct in_addr broadcast; + /* Calculate host mask */ + hostmask.s_addr = ( IN_IS_SMALL ( netmask.s_addr ) ? + INADDR_NONE : ~netmask.s_addr ); + broadcast.s_addr = ( address.s_addr | hostmask.s_addr ); + + /* Print debugging information */ DBGC ( netdev, "IPv4 add %s", inet_ntoa ( address ) ); DBGC ( netdev, "/%s ", inet_ntoa ( netmask ) ); + DBGC ( netdev, "bc %s ", inet_ntoa ( broadcast ) ); if ( gateway.s_addr ) DBGC ( netdev, "gw %s ", inet_ntoa ( gateway ) ); DBGC ( netdev, "via %s\n", netdev->name ); @@ -103,8 +112,9 @@ static int add_ipv4_miniroute ( struct net_device *netdev, miniroute->netdev = netdev_get ( netdev ); miniroute->address = address; miniroute->netmask = netmask; + miniroute->hostmask = hostmask; miniroute->gateway = gateway; - + /* Add to end of list if we have a gateway, otherwise * to start of list. */ @@ -310,7 +320,7 @@ static int ipv4_tx ( struct io_buffer *iobuf, struct sockaddr_in *sin_dest = ( ( struct sockaddr_in * ) st_dest ); struct ipv4_miniroute *miniroute; struct in_addr next_hop; - struct in_addr netmask = { .s_addr = 0 }; + struct in_addr hostmask = { .s_addr = INADDR_NONE }; uint8_t ll_dest_buf[MAX_LL_ADDR_LEN]; const void *ll_dest; int rc; @@ -338,7 +348,7 @@ static int ipv4_tx ( struct io_buffer *iobuf, ( ( miniroute = ipv4_route ( sin_dest->sin_scope_id, &next_hop ) ) != NULL ) ) { iphdr->src = miniroute->address; - netmask = miniroute->netmask; + hostmask = miniroute->hostmask; netdev = miniroute->netdev; } if ( ! netdev ) { @@ -373,7 +383,7 @@ static int ipv4_tx ( struct io_buffer *iobuf, ntohs ( iphdr->chksum ) ); /* Calculate link-layer destination address, if possible */ - if ( ( ( next_hop.s_addr ^ INADDR_BROADCAST ) & ~netmask.s_addr ) == 0){ + if ( ( ( ~next_hop.s_addr ) & hostmask.s_addr ) == 0 ) { /* Broadcast address */ ipv4_stats.out_bcast_pkts++; ll_dest = netdev->ll_broadcast; -- cgit v1.2.3-55-g7522 From b66e27d9b29a172a097c737ab4d378d60fe01b05 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 27 Jun 2024 13:26:39 +0100 Subject: [ipv6] Expose router address for DHCPv6 leased addresses The DHCPv6 protocol does not itself provide a router address or a prefix length. This information is instead obtained from the router advertisements. Our IPv6 minirouting table construction logic will first construct an entry for each advertised prefix, and later update the entry to include an address assigned within that prefix via stateful DHCPv6 (if applicable). This logic fails if the address assigned via stateful DHCPv6 does not fall within any of the advertised prefixes (e.g. if the network is configured to use DHCPv6-assigned /128 addresses with no advertised on-link prefixes). We will currently treat this situation as equivalent to having a manually assigned address with no corresponding router address or prefix length: the routing table entry will use the default /64 prefix length and will not include the router address. DHCPv6 is triggered only in response to a router advertisement with the "Managed Address Configuration (M)" or "Other Configuration (O)" flags set, and a router address is therefore available at the point that we initiate DHCPv6. Record the router address when initiating DHCPv6, and expose this router address as part of the DHCPv6 settings block. This allows the routing table entry for any address assigned via stateful DHCPv6 to correctly include the router address, even if the assigned address does not fall within an advertised prefix. Also provide a fixed /128 prefix length as part of the DHCPv6 settings block. When an address assigned via stateful DHCPv6 does not fall within an advertised prefix, this will cause the routing table entry to have a /128 prefix length as expected. (When such an address does fall within an advertised prefix, it will continue to use the advertised prefix length.) Originally-fixed-by: Guvenc Gulce Signed-off-by: Michael Brown --- src/include/ipxe/dhcpv6.h | 2 +- src/net/ndp.c | 2 +- src/net/udp/dhcpv6.c | 111 +++++++++++++++++++++++++++++++++++++++------- 3 files changed, 97 insertions(+), 18 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/dhcpv6.h b/src/include/ipxe/dhcpv6.h index 6e70f7e63..065e9c376 100644 --- a/src/include/ipxe/dhcpv6.h +++ b/src/include/ipxe/dhcpv6.h @@ -276,6 +276,6 @@ static inline void ipv6_all_dhcp_relay_and_servers ( struct in6_addr *addr ) { } extern int start_dhcpv6 ( struct interface *job, struct net_device *netdev, - int stateful ); + struct in6_addr *router, int stateful ); #endif /* _IPXE_DHCPV6_H */ diff --git a/src/net/ndp.c b/src/net/ndp.c index 373a9360b..3c555f4a3 100644 --- a/src/net/ndp.c +++ b/src/net/ndp.c @@ -1221,7 +1221,7 @@ ipv6conf_rx_router_advertisement ( struct net_device *netdev, /* Start DHCPv6 if required */ if ( radv->flags & ( NDP_ROUTER_MANAGED | NDP_ROUTER_OTHER ) ) { stateful = ( radv->flags & NDP_ROUTER_MANAGED ); - if ( ( rc = start_dhcpv6 ( &ipv6conf->dhcp, netdev, + if ( ( rc = start_dhcpv6 ( &ipv6conf->dhcp, netdev, router, stateful ) ) != 0 ) { DBGC ( netdev, "NDP %s could not start state%s DHCPv6: " "%s\n", netdev->name, diff --git a/src/net/udp/dhcpv6.c b/src/net/udp/dhcpv6.c index 9e27dec6f..a49109894 100644 --- a/src/net/udp/dhcpv6.c +++ b/src/net/udp/dhcpv6.c @@ -268,6 +268,8 @@ struct dhcpv6_settings { struct settings settings; /** Leased address */ struct in6_addr lease; + /** Router address */ + struct in6_addr router; /** Option list */ struct dhcpv6_option_list options; }; @@ -283,25 +285,21 @@ static int dhcpv6_applies ( struct settings *settings __unused, const struct setting *setting ) { return ( ( setting->scope == &dhcpv6_scope ) || - ( setting_cmp ( setting, &ip6_setting ) == 0 ) ); + ( setting->scope == &ipv6_settings_scope ) ); } /** * Fetch value of DHCPv6 leased address * - * @v dhcpset DHCPv6 settings + * @v dhcpv6set DHCPv6 settings * @v data Buffer to fill with setting data * @v len Length of buffer * @ret len Length of setting data, or negative error */ -static int dhcpv6_fetch_lease ( struct dhcpv6_settings *dhcpv6set, - void *data, size_t len ) { +static int dhcpv6_fetch_ip6 ( struct dhcpv6_settings *dhcpv6set, + void *data, size_t len ) { struct in6_addr *lease = &dhcpv6set->lease; - /* Do nothing unless a leased address exists */ - if ( IN6_IS_ADDR_UNSPECIFIED ( lease ) ) - return -ENOENT; - /* Copy leased address */ if ( len > sizeof ( *lease ) ) len = sizeof ( *lease ); @@ -310,6 +308,72 @@ static int dhcpv6_fetch_lease ( struct dhcpv6_settings *dhcpv6set, return sizeof ( *lease ); } +/** + * Fetch value of DHCPv6 implicit address prefix length + * + * @v dhcpv6set DHCPv6 settings + * @v data Buffer to fill with setting data + * @v len Length of buffer + * @ret len Length of setting data, or negative error + */ +static int dhcpv6_fetch_len6 ( struct dhcpv6_settings *dhcpv6set __unused, + void *data, size_t len ) { + uint8_t *len6 = data; + + /* Default to assuming this is the only address on the link. + * If the address falls within a known prefix, then the IPv6 + * routing table construction logic will match it against that + * prefix. + */ + if ( len ) + *len6 = IPV6_MAX_PREFIX_LEN; + + return sizeof ( *len6 ); +} + +/** + * Fetch value of DHCPv6 router address + * + * @v dhcpv6set DHCPv6 settings + * @v data Buffer to fill with setting data + * @v len Length of buffer + * @ret len Length of setting data, or negative error + */ +static int dhcpv6_fetch_gateway6 ( struct dhcpv6_settings *dhcpv6set, + void *data, size_t len ) { + struct in6_addr *router = &dhcpv6set->router; + + /* Copy router address */ + if ( len > sizeof ( *router ) ) + len = sizeof ( *router ); + memcpy ( data, router, len ); + + return sizeof ( *router ); +} + +/** A DHCPv6 address setting operation */ +struct dhcpv6_address_operation { + /** Generic setting */ + const struct setting *setting; + /** + * Fetch value of setting + * + * @v dhcpv6set DHCPv6 settings + * @v data Buffer to fill with setting data + * @v len Length of buffer + * @ret len Length of setting data, or negative error + */ + int ( * fetch ) ( struct dhcpv6_settings *dhcpv6set, + void *data, size_t len ); +}; + +/** DHCPv6 address settings operations */ +static struct dhcpv6_address_operation dhcpv6_address_operations[] = { + { &ip6_setting, dhcpv6_fetch_ip6 }, + { &len6_setting, dhcpv6_fetch_len6 }, + { &gateway6_setting, dhcpv6_fetch_gateway6 }, +}; + /** * Fetch value of DHCPv6 setting * @@ -325,11 +389,20 @@ static int dhcpv6_fetch ( struct settings *settings, struct dhcpv6_settings *dhcpv6set = container_of ( settings, struct dhcpv6_settings, settings ); const union dhcpv6_any_option *option; + struct dhcpv6_address_operation *op; size_t option_len; - - /* Handle leased address */ - if ( setting_cmp ( setting, &ip6_setting ) == 0 ) - return dhcpv6_fetch_lease ( dhcpv6set, data, len ); + unsigned int i; + + /* Handle address settings */ + for ( i = 0 ; i < ( sizeof ( dhcpv6_address_operations ) / + sizeof ( dhcpv6_address_operations[0] ) ) ; i++ ) { + op = &dhcpv6_address_operations[i]; + if ( setting_cmp ( setting, op->setting ) != 0 ) + continue; + if ( IN6_IS_ADDR_UNSPECIFIED ( &dhcpv6set->lease ) ) + return -ENOENT; + return op->fetch ( dhcpv6set, data, len ); + } /* Find option */ option = dhcpv6_option ( &dhcpv6set->options, setting->tag ); @@ -354,11 +427,12 @@ static struct settings_operations dhcpv6_settings_operations = { * Register DHCPv6 options as network device settings * * @v lease DHCPv6 leased address + * @v router DHCPv6 router address * @v options DHCPv6 option list * @v parent Parent settings block * @ret rc Return status code */ -static int dhcpv6_register ( struct in6_addr *lease, +static int dhcpv6_register ( struct in6_addr *lease, struct in6_addr *router, struct dhcpv6_option_list *options, struct settings *parent ) { struct dhcpv6_settings *dhcpv6set; @@ -382,6 +456,7 @@ static int dhcpv6_register ( struct in6_addr *lease, dhcpv6set->options.data = data; dhcpv6set->options.len = len; memcpy ( &dhcpv6set->lease, lease, sizeof ( dhcpv6set->lease ) ); + memcpy ( &dhcpv6set->router, router, sizeof ( dhcpv6set->router ) ); /* Register settings */ if ( ( rc = register_settings ( &dhcpv6set->settings, parent, @@ -501,6 +576,8 @@ struct dhcpv6_session { /** Network device being configured */ struct net_device *netdev; + /** Router address */ + struct in6_addr router; /** Transaction ID */ uint8_t xid[3]; /** Identity association ID */ @@ -876,8 +953,8 @@ static int dhcpv6_rx ( struct dhcpv6_session *dhcpv6, } /* Register settings */ - if ( ( rc = dhcpv6_register ( &dhcpv6->lease, &options, - parent ) ) != 0 ) { + if ( ( rc = dhcpv6_register ( &dhcpv6->lease, &dhcpv6->router, + &options, parent ) ) != 0 ) { DBGC ( dhcpv6, "DHCPv6 %s could not register settings: %s\n", dhcpv6->netdev->name, strerror ( rc ) ); goto done; @@ -915,11 +992,12 @@ static struct interface_descriptor dhcpv6_xfer_desc = * * @v job Job control interface * @v netdev Network device + * @v router Router address * @v stateful Perform stateful address autoconfiguration * @ret rc Return status code */ int start_dhcpv6 ( struct interface *job, struct net_device *netdev, - int stateful ) { + struct in6_addr *router, int stateful ) { struct ll_protocol *ll_protocol = netdev->ll_protocol; struct dhcpv6_session *dhcpv6; struct { @@ -944,6 +1022,7 @@ int start_dhcpv6 ( struct interface *job, struct net_device *netdev, intf_init ( &dhcpv6->job, &dhcpv6_job_desc, &dhcpv6->refcnt ); intf_init ( &dhcpv6->xfer, &dhcpv6_xfer_desc, &dhcpv6->refcnt ); dhcpv6->netdev = netdev_get ( netdev ); + memcpy ( &dhcpv6->router, router, sizeof ( dhcpv6->router ) ); xid = random(); memcpy ( dhcpv6->xid, &xid, sizeof ( dhcpv6->xid ) ); dhcpv6->start = currticks(); -- cgit v1.2.3-55-g7522 From d85590b6584499569c19f7ee4a1e0c10d5132f70 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 12 Aug 2024 12:26:52 +0100 Subject: [crypto] Centralise mechanisms for identifying X.509 certificates Centralise all current mechanisms for identifying an X.509 certificate (by raw content, by subject, by issuer and serial number, and by matching public key), and remove the certstore-specific and CMS-specific variants of these functions. Signed-off-by: Michael Brown --- src/crypto/certstore.c | 62 +++++--------------------- src/crypto/cms.c | 30 +------------ src/crypto/x509.c | 103 +++++++++++++++++++++++++++++++++++++++++-- src/include/ipxe/certstore.h | 4 -- src/include/ipxe/x509.h | 19 ++++++++ src/net/tls.c | 2 +- 6 files changed, 133 insertions(+), 87 deletions(-) (limited to 'src/net') diff --git a/src/crypto/certstore.c b/src/crypto/certstore.c index 2676c7e1e..f8ddbd3d7 100644 --- a/src/crypto/certstore.c +++ b/src/crypto/certstore.c @@ -69,66 +69,28 @@ static struct asn1_cursor certstore_raw[] = { static struct x509_certificate certstore_certs[ sizeof ( certstore_raw ) / sizeof ( certstore_raw[0] ) ]; -/** Certificate store */ -struct x509_chain certstore = { - .refcnt = REF_INIT ( ref_no_free ), - .links = LIST_HEAD_INIT ( certstore.links ), -}; - /** * Mark stored certificate as most recently used * + * @v certs X.509 certificate list * @v cert X.509 certificate - * @ret cert X.509 certificate */ -static struct x509_certificate * -certstore_found ( struct x509_certificate *cert ) { +static void certstore_found ( struct x509_chain *certs, + struct x509_certificate *cert ) { /* Mark as most recently used */ list_del ( &cert->store.list ); - list_add ( &cert->store.list, &certstore.links ); - DBGC2 ( &certstore, "CERTSTORE found certificate %s\n", + list_add ( &cert->store.list, &certs->links ); + DBGC2 ( certs, "CERTSTORE found certificate %s\n", x509_name ( cert ) ); - - return cert; -} - -/** - * Find certificate in store - * - * @v raw Raw certificate data - * @ret cert X.509 certificate, or NULL if not found - */ -struct x509_certificate * certstore_find ( struct asn1_cursor *raw ) { - struct x509_certificate *cert; - - /* Search for certificate within store */ - list_for_each_entry ( cert, &certstore.links, store.list ) { - if ( asn1_compare ( raw, &cert->raw ) == 0 ) - return certstore_found ( cert ); - } - return NULL; } -/** - * Find certificate in store corresponding to a private key - * - * @v key Private key - * @ret cert X.509 certificate, or NULL if not found - */ -struct x509_certificate * certstore_find_key ( struct private_key *key ) { - struct x509_certificate *cert; - - /* Search for certificate within store */ - list_for_each_entry ( cert, &certstore.links, store.list ) { - if ( pubkey_match ( cert->signature_algorithm->pubkey, - key->builder.data, key->builder.len, - cert->subject.public_key.raw.data, - cert->subject.public_key.raw.len ) == 0 ) - return certstore_found ( cert ); - } - return NULL; -} +/** Certificate store */ +struct x509_chain certstore = { + .refcnt = REF_INIT ( ref_no_free ), + .links = LIST_HEAD_INIT ( certstore.links ), + .found = certstore_found, +}; /** * Add certificate to store @@ -219,7 +181,7 @@ static void certstore_init ( void ) { /* Skip if certificate already present in store */ raw = &certstore_raw[i]; - if ( ( cert = certstore_find ( raw ) ) != NULL ) { + if ( ( cert = x509_find ( &certstore, raw ) ) != NULL ) { DBGC ( &certstore, "CERTSTORE permanent certificate %d " "is a duplicate of %s\n", i, x509_name ( cert )); continue; diff --git a/src/crypto/cms.c b/src/crypto/cms.c index 9511cec8a..19a0ce7ad 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -143,34 +143,6 @@ static int cms_parse_certificates ( struct cms_signature *sig, return 0; } -/** - * Identify CMS signature certificate by issuer and serial number - * - * @v sig CMS signature - * @v issuer Issuer - * @v serial Serial number - * @ret cert X.509 certificate, or NULL if not found - */ -static struct x509_certificate * -cms_find_issuer_serial ( struct cms_signature *sig, - const struct asn1_cursor *issuer, - const struct asn1_cursor *serial ) { - struct x509_link *link; - struct x509_certificate *cert; - - /* Scan through certificate list */ - list_for_each_entry ( link, &sig->certificates->links, list ) { - - /* Check issuer and serial number */ - cert = link->cert; - if ( ( asn1_compare ( issuer, &cert->issuer.raw ) == 0 ) && - ( asn1_compare ( serial, &cert->serial.raw ) == 0 ) ) - return cert; - } - - return NULL; -} - /** * Parse CMS signature signer identifier * @@ -216,7 +188,7 @@ static int cms_parse_signer_identifier ( struct cms_signature *sig, DBGC_HDA ( sig, 0, serial.data, serial.len ); /* Identify certificate */ - cert = cms_find_issuer_serial ( sig, &issuer, &serial ); + cert = x509_find_issuer_serial ( sig->certificates, &issuer, &serial ); if ( ! cert ) { DBGC ( sig, "CMS %p/%p could not identify signer's " "certificate\n", sig, info ); diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 92318093e..341b91449 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -38,6 +38,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include @@ -1078,7 +1079,7 @@ int x509_certificate ( const void *data, size_t len, asn1_shrink_any ( &cursor ); /* Return stored certificate, if present */ - if ( ( *cert = certstore_find ( &cursor ) ) != NULL ) { + if ( ( *cert = x509_find ( &certstore, &cursor ) ) != NULL ) { /* Add caller's reference */ x509_get ( *cert ); @@ -1710,6 +1711,47 @@ void x509_truncate ( struct x509_chain *chain, struct x509_link *link ) { } } +/** + * Mark X.509 certificate as found + * + * @v certs X.509 certificate list + * @v cert X.509 certificate + * @ret cert X.509 certificate + */ +static struct x509_certificate * x509_found ( struct x509_chain *certs, + struct x509_certificate *cert ) { + + /* Mark as found, if applicable */ + if ( certs->found ) + certs->found ( certs, cert ); + + return cert; +} + +/** + * Identify X.509 certificate by raw certificate data + * + * @v certs X.509 certificate list + * @v raw Raw certificate data + * @ret cert X.509 certificate, or NULL if not found + */ +struct x509_certificate * x509_find ( struct x509_chain *certs, + const struct asn1_cursor *raw ) { + struct x509_link *link; + struct x509_certificate *cert; + + /* Search for certificate within store */ + list_for_each_entry ( link, &certs->links, list ) { + + /* Check raw certificate data */ + cert = link->cert; + if ( asn1_compare ( raw, &cert->raw ) == 0 ) + return x509_found ( certs, cert ); + } + + return NULL; +} + /** * Identify X.509 certificate by subject * @@ -1717,7 +1759,7 @@ void x509_truncate ( struct x509_chain *chain, struct x509_link *link ) { * @v subject Subject * @ret cert X.509 certificate, or NULL if not found */ -static struct x509_certificate * +struct x509_certificate * x509_find_subject ( struct x509_chain *certs, const struct asn1_cursor *subject ) { struct x509_link *link; @@ -1729,7 +1771,62 @@ x509_find_subject ( struct x509_chain *certs, /* Check subject */ cert = link->cert; if ( asn1_compare ( subject, &cert->subject.raw ) == 0 ) - return cert; + return x509_found ( certs, cert ); + } + + return NULL; +} + +/** + * Identify X.509 certificate by issuer and serial number + * + * @v certs X.509 certificate list + * @v issuer Issuer + * @v serial Serial number + * @ret cert X.509 certificate, or NULL if not found + */ +struct x509_certificate * +x509_find_issuer_serial ( struct x509_chain *certs, + const struct asn1_cursor *issuer, + const struct asn1_cursor *serial ) { + struct x509_link *link; + struct x509_certificate *cert; + + /* Scan through certificate list */ + list_for_each_entry ( link, &certs->links, list ) { + + /* Check issuer and serial number */ + cert = link->cert; + if ( ( asn1_compare ( issuer, &cert->issuer.raw ) == 0 ) && + ( asn1_compare ( serial, &cert->serial.raw ) == 0 ) ) + return x509_found ( certs, cert ); + } + + return NULL; +} + +/** + * Identify X.509 certificate by corresponding public key + * + * @v certs X.509 certificate list + * @v key Private key + * @ret cert X.509 certificate, or NULL if not found + */ +struct x509_certificate * x509_find_key ( struct x509_chain *certs, + struct private_key *key ) { + struct x509_link *link; + struct x509_certificate *cert; + + /* Scan through certificate list */ + list_for_each_entry ( link, &certs->links, list ) { + + /* Check public key */ + cert = link->cert; + if ( pubkey_match ( cert->signature_algorithm->pubkey, + key->builder.data, key->builder.len, + cert->subject.public_key.raw.data, + cert->subject.public_key.raw.len ) == 0 ) + return x509_found ( certs, cert ); } return NULL; diff --git a/src/include/ipxe/certstore.h b/src/include/ipxe/certstore.h index ce96666cf..e276d6792 100644 --- a/src/include/ipxe/certstore.h +++ b/src/include/ipxe/certstore.h @@ -9,14 +9,10 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); -#include #include -#include extern struct x509_chain certstore; -extern struct x509_certificate * certstore_find ( struct asn1_cursor *raw ); -extern struct x509_certificate * certstore_find_key ( struct private_key *key ); extern void certstore_add ( struct x509_certificate *cert ); extern void certstore_del ( struct x509_certificate *cert ); diff --git a/src/include/ipxe/x509.h b/src/include/ipxe/x509.h index 87323cec0..612743a77 100644 --- a/src/include/ipxe/x509.h +++ b/src/include/ipxe/x509.h @@ -17,6 +17,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include struct image; +struct private_key; /** An X.509 serial number */ struct x509_serial { @@ -201,6 +202,13 @@ struct x509_chain { struct refcnt refcnt; /** List of links */ struct list_head links; + /** Mark certificate as found + * + * @v certs X.509 certificate list + * @v cert X.509 certificate + */ + void ( * found ) ( struct x509_chain *certs, + struct x509_certificate *cert ); }; /** An X.509 certificate */ @@ -424,6 +432,17 @@ extern int x509_append ( struct x509_chain *chain, extern int x509_append_raw ( struct x509_chain *chain, const void *data, size_t len ); extern void x509_truncate ( struct x509_chain *chain, struct x509_link *link ); +extern struct x509_certificate * x509_find ( struct x509_chain *certs, + const struct asn1_cursor *raw ); +extern struct x509_certificate * +x509_find_subject ( struct x509_chain *certs, + const struct asn1_cursor *subject ); +extern struct x509_certificate * +x509_find_issuer_serial ( struct x509_chain *certs, + const struct asn1_cursor *issuer, + const struct asn1_cursor *serial ); +extern struct x509_certificate * x509_find_key ( struct x509_chain *certs, + struct private_key *key ); extern int x509_auto_append ( struct x509_chain *chain, struct x509_chain *certs ); extern int x509_validate_chain ( struct x509_chain *chain, time_t time, diff --git a/src/net/tls.c b/src/net/tls.c index 5f89be452..98414e2b1 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -2467,7 +2467,7 @@ static int tls_new_certificate_request ( struct tls_connection *tls, tls->certs = NULL; /* Determine client certificate to be sent */ - cert = certstore_find_key ( tls->key ); + cert = x509_find_key ( &certstore, tls->key ); if ( ! cert ) { DBGC ( tls, "TLS %p could not find certificate corresponding " "to private key\n", tls ); -- cgit v1.2.3-55-g7522 From 96fb7a0a9395cec423a58069e1b49535e8ceceef Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 13 Aug 2024 12:25:25 +0100 Subject: [crypto] Allow passing a NULL certificate store to x509_find() et al Allow passing a NULL value for the certificate list to all functions used for identifying an X.509 certificate from an existing set of certificates, and rename function parameters to indicate that this certificate list represents an unordered certificate store (rather than an ordered certificate chain). Signed-off-by: Michael Brown --- src/crypto/certstore.c | 8 +++--- src/crypto/x509.c | 71 ++++++++++++++++++++++++++++++------------------- src/include/ipxe/x509.h | 14 +++++----- src/net/tls.c | 2 +- 4 files changed, 55 insertions(+), 40 deletions(-) (limited to 'src/net') diff --git a/src/crypto/certstore.c b/src/crypto/certstore.c index f8ddbd3d7..31797c4cd 100644 --- a/src/crypto/certstore.c +++ b/src/crypto/certstore.c @@ -72,16 +72,16 @@ static struct x509_certificate certstore_certs[ sizeof ( certstore_raw ) / /** * Mark stored certificate as most recently used * - * @v certs X.509 certificate list + * @v store Certificate store * @v cert X.509 certificate */ -static void certstore_found ( struct x509_chain *certs, +static void certstore_found ( struct x509_chain *store, struct x509_certificate *cert ) { /* Mark as most recently used */ list_del ( &cert->store.list ); - list_add ( &cert->store.list, &certs->links ); - DBGC2 ( certs, "CERTSTORE found certificate %s\n", + list_add ( &cert->store.list, &store->links ); + DBGC2 ( store, "CERTSTORE found certificate %s\n", x509_name ( cert ) ); } diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 341b91449..acb85620f 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1079,7 +1079,7 @@ int x509_certificate ( const void *data, size_t len, asn1_shrink_any ( &cursor ); /* Return stored certificate, if present */ - if ( ( *cert = x509_find ( &certstore, &cursor ) ) != NULL ) { + if ( ( *cert = x509_find ( NULL, &cursor ) ) != NULL ) { /* Add caller's reference */ x509_get ( *cert ); @@ -1714,16 +1714,19 @@ void x509_truncate ( struct x509_chain *chain, struct x509_link *link ) { /** * Mark X.509 certificate as found * - * @v certs X.509 certificate list + * @v store Certificate store * @v cert X.509 certificate * @ret cert X.509 certificate */ -static struct x509_certificate * x509_found ( struct x509_chain *certs, +static struct x509_certificate * x509_found ( struct x509_chain *store, struct x509_certificate *cert ) { + /* Sanity check */ + assert ( store != NULL ); + /* Mark as found, if applicable */ - if ( certs->found ) - certs->found ( certs, cert ); + if ( store->found ) + store->found ( store, cert ); return cert; } @@ -1731,22 +1734,26 @@ static struct x509_certificate * x509_found ( struct x509_chain *certs, /** * Identify X.509 certificate by raw certificate data * - * @v certs X.509 certificate list + * @v store Certificate store, or NULL to use default * @v raw Raw certificate data * @ret cert X.509 certificate, or NULL if not found */ -struct x509_certificate * x509_find ( struct x509_chain *certs, +struct x509_certificate * x509_find ( struct x509_chain *store, const struct asn1_cursor *raw ) { struct x509_link *link; struct x509_certificate *cert; + /* Use default certificate store if none specified */ + if ( ! store ) + store = &certstore; + /* Search for certificate within store */ - list_for_each_entry ( link, &certs->links, list ) { + list_for_each_entry ( link, &store->links, list ) { /* Check raw certificate data */ cert = link->cert; if ( asn1_compare ( raw, &cert->raw ) == 0 ) - return x509_found ( certs, cert ); + return x509_found ( store, cert ); } return NULL; @@ -1755,23 +1762,27 @@ struct x509_certificate * x509_find ( struct x509_chain *certs, /** * Identify X.509 certificate by subject * - * @v certs X.509 certificate list + * @v store Certificate store, or NULL to use default * @v subject Subject * @ret cert X.509 certificate, or NULL if not found */ struct x509_certificate * -x509_find_subject ( struct x509_chain *certs, +x509_find_subject ( struct x509_chain *store, const struct asn1_cursor *subject ) { struct x509_link *link; struct x509_certificate *cert; + /* Use default certificate store if none specified */ + if ( ! store ) + store = &certstore; + /* Scan through certificate list */ - list_for_each_entry ( link, &certs->links, list ) { + list_for_each_entry ( link, &store->links, list ) { /* Check subject */ cert = link->cert; if ( asn1_compare ( subject, &cert->subject.raw ) == 0 ) - return x509_found ( certs, cert ); + return x509_found ( store, cert ); } return NULL; @@ -1780,26 +1791,30 @@ x509_find_subject ( struct x509_chain *certs, /** * Identify X.509 certificate by issuer and serial number * - * @v certs X.509 certificate list + * @v store Certificate store, or NULL to use default * @v issuer Issuer * @v serial Serial number * @ret cert X.509 certificate, or NULL if not found */ struct x509_certificate * -x509_find_issuer_serial ( struct x509_chain *certs, +x509_find_issuer_serial ( struct x509_chain *store, const struct asn1_cursor *issuer, const struct asn1_cursor *serial ) { struct x509_link *link; struct x509_certificate *cert; + /* Use default certificate store if none specified */ + if ( ! store ) + store = &certstore; + /* Scan through certificate list */ - list_for_each_entry ( link, &certs->links, list ) { + list_for_each_entry ( link, &store->links, list ) { /* Check issuer and serial number */ cert = link->cert; if ( ( asn1_compare ( issuer, &cert->issuer.raw ) == 0 ) && ( asn1_compare ( serial, &cert->serial.raw ) == 0 ) ) - return x509_found ( certs, cert ); + return x509_found ( store, cert ); } return NULL; @@ -1808,17 +1823,21 @@ x509_find_issuer_serial ( struct x509_chain *certs, /** * Identify X.509 certificate by corresponding public key * - * @v certs X.509 certificate list + * @v store Certificate store, or NULL to use default * @v key Private key * @ret cert X.509 certificate, or NULL if not found */ -struct x509_certificate * x509_find_key ( struct x509_chain *certs, +struct x509_certificate * x509_find_key ( struct x509_chain *store, struct private_key *key ) { struct x509_link *link; struct x509_certificate *cert; + /* Use default certificate store if none specified */ + if ( ! store ) + store = &certstore; + /* Scan through certificate list */ - list_for_each_entry ( link, &certs->links, list ) { + list_for_each_entry ( link, &store->links, list ) { /* Check public key */ cert = link->cert; @@ -1826,7 +1845,7 @@ struct x509_certificate * x509_find_key ( struct x509_chain *certs, key->builder.data, key->builder.len, cert->subject.public_key.raw.data, cert->subject.public_key.raw.len ) == 0 ) - return x509_found ( certs, cert ); + return x509_found ( store, cert ); } return NULL; @@ -1836,13 +1855,13 @@ struct x509_certificate * x509_find_key ( struct x509_chain *certs, * Append X.509 certificates to X.509 certificate chain * * @v chain X.509 certificate chain - * @v certs X.509 certificate list + * @v store Certificate store, or NULL to use default * @ret rc Return status code * * Certificates will be automatically appended to the chain based upon * the subject and issuer names. */ -int x509_auto_append ( struct x509_chain *chain, struct x509_chain *certs ) { +int x509_auto_append ( struct x509_chain *chain, struct x509_chain *store ) { struct x509_certificate *cert; struct x509_certificate *previous; int rc; @@ -1859,7 +1878,7 @@ int x509_auto_append ( struct x509_chain *chain, struct x509_chain *certs ) { /* Find issuing certificate */ previous = cert; - cert = x509_find_subject ( certs, &cert->issuer.raw ); + cert = x509_find_subject ( store, &cert->issuer.raw ); if ( ! cert ) break; if ( cert == previous ) @@ -1888,10 +1907,6 @@ int x509_validate_chain ( struct x509_chain *chain, time_t time, struct x509_link *link; int rc; - /* Use default certificate store if none specified */ - if ( ! store ) - store = &certstore; - /* Append any applicable certificates from the certificate store */ if ( ( rc = x509_auto_append ( chain, store ) ) != 0 ) return rc; diff --git a/src/include/ipxe/x509.h b/src/include/ipxe/x509.h index 612743a77..e71cee8a3 100644 --- a/src/include/ipxe/x509.h +++ b/src/include/ipxe/x509.h @@ -204,10 +204,10 @@ struct x509_chain { struct list_head links; /** Mark certificate as found * - * @v certs X.509 certificate list + * @v store Certificate store * @v cert X.509 certificate */ - void ( * found ) ( struct x509_chain *certs, + void ( * found ) ( struct x509_chain *store, struct x509_certificate *cert ); }; @@ -432,19 +432,19 @@ extern int x509_append ( struct x509_chain *chain, extern int x509_append_raw ( struct x509_chain *chain, const void *data, size_t len ); extern void x509_truncate ( struct x509_chain *chain, struct x509_link *link ); -extern struct x509_certificate * x509_find ( struct x509_chain *certs, +extern struct x509_certificate * x509_find ( struct x509_chain *store, const struct asn1_cursor *raw ); extern struct x509_certificate * -x509_find_subject ( struct x509_chain *certs, +x509_find_subject ( struct x509_chain *store, const struct asn1_cursor *subject ); extern struct x509_certificate * -x509_find_issuer_serial ( struct x509_chain *certs, +x509_find_issuer_serial ( struct x509_chain *store, const struct asn1_cursor *issuer, const struct asn1_cursor *serial ); -extern struct x509_certificate * x509_find_key ( struct x509_chain *certs, +extern struct x509_certificate * x509_find_key ( struct x509_chain *store, struct private_key *key ); extern int x509_auto_append ( struct x509_chain *chain, - struct x509_chain *certs ); + struct x509_chain *store ); extern int x509_validate_chain ( struct x509_chain *chain, time_t time, struct x509_chain *store, struct x509_root *root ); diff --git a/src/net/tls.c b/src/net/tls.c index 98414e2b1..c08057103 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -2467,7 +2467,7 @@ static int tls_new_certificate_request ( struct tls_connection *tls, tls->certs = NULL; /* Determine client certificate to be sent */ - cert = x509_find_key ( &certstore, tls->key ); + cert = x509_find_key ( NULL, tls->key ); if ( ! cert ) { DBGC ( tls, "TLS %p could not find certificate corresponding " "to private key\n", tls ); -- cgit v1.2.3-55-g7522 From 9d9465b140cf59750f97995c501d054d2543c29a Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 14 Aug 2024 14:00:48 +0100 Subject: [crypto] Fix debug name for empty certificate chain validators An attempt to use a validator for an empty certificate chain will correctly fail the overall validation with the "empty certificate chain" error propagated from x509_auto_append(). In a debug build, the call to validator_name() will attempt to call x509_name() on a non-existent certificate, resulting in garbage in the debug message. Fix by checking for the special case of an empty certificate chain. This issue does not affect non-debug builds, since validator_name() is (as per its description) called only for debug messages. Signed-off-by: Michael Brown --- src/net/validator.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/net') diff --git a/src/net/validator.c b/src/net/validator.c index 69c0df333..e1371d2e6 100644 --- a/src/net/validator.c +++ b/src/net/validator.c @@ -135,9 +135,11 @@ struct validator { * @ret name Validator name */ static const char * validator_name ( struct validator *validator ) { + struct x509_certificate *cert; - /* Use name of first certificate in chain */ - return x509_name ( x509_first ( validator->chain ) ); + /* Use name of first certificate in chain, if present */ + cert = x509_first ( validator->chain ); + return ( cert ? x509_name ( cert ) : "" ); } /** -- cgit v1.2.3-55-g7522 From 53f089b723e16eecb4fd2e2a59b74b3932431b30 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 18 Aug 2024 10:43:52 +0100 Subject: [crypto] Pass asymmetric keys as ASN.1 cursors Asymmetric keys are invariably encountered within ASN.1 structures such as X.509 certificates, and the various large integers within an RSA key are themselves encoded using ASN.1. Simplify all code handling asymmetric keys by passing keys as a single ASN.1 cursor, rather than separate data and length pointers. Signed-off-by: Michael Brown --- src/crypto/cms.c | 3 +-- src/crypto/crypto_null.c | 4 +-- src/crypto/ocsp.c | 4 +-- src/crypto/rsa.c | 30 +++++---------------- src/crypto/x509.c | 9 +++---- src/drivers/net/iphone.c | 3 +-- src/include/ipxe/crypto.h | 23 +++++++--------- src/net/tls.c | 5 ++-- src/tests/pubkey_test.h | 37 ++++++++++---------------- src/tests/rsa_test.c | 68 +++++++++++++++++++++-------------------------- 10 files changed, 74 insertions(+), 112 deletions(-) (limited to 'src/net') diff --git a/src/crypto/cms.c b/src/crypto/cms.c index 1f33613f4..0b772f1cf 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -621,8 +621,7 @@ static int cms_verify_digest ( struct cms_message *cms, cms_digest ( cms, part, data, len, digest_out ); /* Initialise public-key algorithm */ - if ( ( rc = pubkey_init ( pubkey, ctx, public_key->raw.data, - public_key->raw.len ) ) != 0 ) { + if ( ( rc = pubkey_init ( pubkey, ctx, &public_key->raw ) ) != 0 ) { DBGC ( cms, "CMS %p/%p could not initialise public key: %s\n", cms, part, strerror ( rc ) ); goto err_init; diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c index 0ad463c3e..b4169382b 100644 --- a/src/crypto/crypto_null.c +++ b/src/crypto/crypto_null.c @@ -93,8 +93,8 @@ struct cipher_algorithm cipher_null = { .auth = cipher_null_auth, }; -int pubkey_null_init ( void *ctx __unused, const void *key __unused, - size_t key_len __unused ) { +int pubkey_null_init ( void *ctx __unused, + const struct asn1_cursor *key __unused ) { return 0; } diff --git a/src/crypto/ocsp.c b/src/crypto/ocsp.c index cc957b40c..f35593454 100644 --- a/src/crypto/ocsp.c +++ b/src/crypto/ocsp.c @@ -857,8 +857,8 @@ static int ocsp_check_signature ( struct ocsp_check *ocsp, digest_final ( digest, digest_ctx, digest_out ); /* Initialise public-key algorithm */ - if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, public_key->raw.data, - public_key->raw.len ) ) != 0 ) { + if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, + &public_key->raw ) ) != 0 ) { DBGC ( ocsp, "OCSP %p \"%s\" could not initialise public key: " "%s\n", ocsp, x509_name ( ocsp->cert ), strerror ( rc )); goto err_init; diff --git a/src/crypto/rsa.c b/src/crypto/rsa.c index 16c67d822..2d288a953 100644 --- a/src/crypto/rsa.c +++ b/src/crypto/rsa.c @@ -233,27 +233,21 @@ static int rsa_parse_mod_exp ( struct asn1_cursor *modulus, * * @v ctx RSA context * @v key Key - * @v key_len Length of key * @ret rc Return status code */ -static int rsa_init ( void *ctx, const void *key, size_t key_len ) { +static int rsa_init ( void *ctx, const struct asn1_cursor *key ) { struct rsa_context *context = ctx; struct asn1_cursor modulus; struct asn1_cursor exponent; - struct asn1_cursor cursor; int rc; /* Initialise context */ memset ( context, 0, sizeof ( *context ) ); - /* Initialise cursor */ - cursor.data = key; - cursor.len = key_len; - /* Parse modulus and exponent */ - if ( ( rc = rsa_parse_mod_exp ( &modulus, &exponent, &cursor ) ) != 0 ){ + if ( ( rc = rsa_parse_mod_exp ( &modulus, &exponent, key ) ) != 0 ){ DBGC ( context, "RSA %p invalid modulus/exponent:\n", context ); - DBGC_HDA ( context, 0, cursor.data, cursor.len ); + DBGC_HDA ( context, 0, key->data, key->len ); goto err_parse; } @@ -592,33 +586,23 @@ static void rsa_final ( void *ctx ) { * Check for matching RSA public/private key pair * * @v private_key Private key - * @v private_key_len Private key length * @v public_key Public key - * @v public_key_len Public key length * @ret rc Return status code */ -static int rsa_match ( const void *private_key, size_t private_key_len, - const void *public_key, size_t public_key_len ) { +static int rsa_match ( const struct asn1_cursor *private_key, + const struct asn1_cursor *public_key ) { struct asn1_cursor private_modulus; struct asn1_cursor private_exponent; - struct asn1_cursor private_cursor; struct asn1_cursor public_modulus; struct asn1_cursor public_exponent; - struct asn1_cursor public_cursor; int rc; - /* Initialise cursors */ - private_cursor.data = private_key; - private_cursor.len = private_key_len; - public_cursor.data = public_key; - public_cursor.len = public_key_len; - /* Parse moduli and exponents */ if ( ( rc = rsa_parse_mod_exp ( &private_modulus, &private_exponent, - &private_cursor ) ) != 0 ) + private_key ) ) != 0 ) return rc; if ( ( rc = rsa_parse_mod_exp ( &public_modulus, &public_exponent, - &public_cursor ) ) != 0 ) + public_key ) ) != 0 ) return rc; /* Compare moduli */ diff --git a/src/crypto/x509.c b/src/crypto/x509.c index acb85620f..c0762740e 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1149,8 +1149,8 @@ static int x509_check_signature ( struct x509_certificate *cert, } /* Verify signature using signer's public key */ - if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, public_key->raw.data, - public_key->raw.len ) ) != 0 ) { + if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, + &public_key->raw ) ) != 0 ) { DBGC ( cert, "X509 %p \"%s\" cannot initialise public key: " "%s\n", cert, x509_name ( cert ), strerror ( rc ) ); goto err_pubkey_init; @@ -1842,9 +1842,8 @@ struct x509_certificate * x509_find_key ( struct x509_chain *store, /* Check public key */ cert = link->cert; if ( pubkey_match ( cert->signature_algorithm->pubkey, - key->builder.data, key->builder.len, - cert->subject.public_key.raw.data, - cert->subject.public_key.raw.len ) == 0 ) + privkey_cursor ( key ), + &cert->subject.public_key.raw ) == 0 ) return x509_found ( store, cert ); } diff --git a/src/drivers/net/iphone.c b/src/drivers/net/iphone.c index bbac527bd..96eb0952b 100644 --- a/src/drivers/net/iphone.c +++ b/src/drivers/net/iphone.c @@ -367,8 +367,7 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, int rc; /* Initialise "private" key */ - if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, private->data, - private->len ) ) != 0 ) { + if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, private ) ) != 0 ) { DBGC ( icert, "ICERT %p could not initialise private key: " "%s\n", icert, strerror ( rc ) ); goto err_pubkey_init; diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index a6f437655..8b6eb94f6 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -12,6 +12,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include /** A message digest algorithm */ struct digest_algorithm { @@ -126,10 +127,9 @@ struct pubkey_algorithm { * * @v ctx Context * @v key Key - * @v key_len Length of key * @ret rc Return status code */ - int ( * init ) ( void *ctx, const void *key, size_t key_len ); + int ( * init ) ( void *ctx, const struct asn1_cursor *key ); /** Calculate maximum output length * * @v ctx Context @@ -186,13 +186,11 @@ struct pubkey_algorithm { /** Check that public key matches private key * * @v private_key Private key - * @v private_key_len Private key length * @v public_key Public key - * @v public_key_len Public key length * @ret rc Return status code */ - int ( * match ) ( const void *private_key, size_t private_key_len, - const void *public_key, size_t public_key_len ); + int ( * match ) ( const struct asn1_cursor *private_key, + const struct asn1_cursor *public_key ); }; /** An elliptic curve */ @@ -282,8 +280,8 @@ is_auth_cipher ( struct cipher_algorithm *cipher ) { static inline __attribute__ (( always_inline )) int pubkey_init ( struct pubkey_algorithm *pubkey, void *ctx, - const void *key, size_t key_len ) { - return pubkey->init ( ctx, key, key_len ); + const struct asn1_cursor *key ) { + return pubkey->init ( ctx, key ); } static inline __attribute__ (( always_inline )) size_t @@ -324,10 +322,9 @@ pubkey_final ( struct pubkey_algorithm *pubkey, void *ctx ) { static inline __attribute__ (( always_inline )) int pubkey_match ( struct pubkey_algorithm *pubkey, - const void *private_key, size_t private_key_len, - const void *public_key, size_t public_key_len ) { - return pubkey->match ( private_key, private_key_len, public_key, - public_key_len ); + const struct asn1_cursor *private_key, + const struct asn1_cursor *public_key ) { + return pubkey->match ( private_key, public_key ); } static inline __attribute__ (( always_inline )) int @@ -348,7 +345,7 @@ extern void cipher_null_decrypt ( void *ctx, const void *src, void *dst, size_t len ); extern void cipher_null_auth ( void *ctx, void *auth ); -extern int pubkey_null_init ( void *ctx, const void *key, size_t key_len ); +extern int pubkey_null_init ( void *ctx, const struct asn1_cursor *key ); extern size_t pubkey_null_max_len ( void *ctx ); extern int pubkey_null_encrypt ( void *ctx, const void *plaintext, size_t plaintext_len, void *ciphertext ); diff --git a/src/net/tls.c b/src/net/tls.c index c08057103..a22626f41 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1824,7 +1824,7 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { tls_verify_handshake ( tls, digest_out ); /* Initialise public-key algorithm */ - if ( ( rc = pubkey_init ( pubkey, ctx, key->data, key->len ) ) != 0 ) { + if ( ( rc = pubkey_init ( pubkey, ctx, key ) ) != 0 ) { DBGC ( tls, "TLS %p could not initialise %s client private " "key: %s\n", tls, pubkey->name, strerror ( rc ) ); goto err_pubkey_init; @@ -3581,8 +3581,7 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { /* Initialise public key algorithm */ if ( ( rc = pubkey_init ( pubkey, cipherspec->pubkey_ctx, - cert->subject.public_key.raw.data, - cert->subject.public_key.raw.len ) ) != 0 ) { + &cert->subject.public_key.raw ) ) != 0 ) { DBGC ( tls, "TLS %p cannot initialise public key: %s\n", tls, strerror ( rc ) ); goto err; diff --git a/src/tests/pubkey_test.h b/src/tests/pubkey_test.h index cd65b8703..214992238 100644 --- a/src/tests/pubkey_test.h +++ b/src/tests/pubkey_test.h @@ -12,17 +12,16 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * * @v pubkey Public key algorithm * @v key Key - * @v key_len Key length * @v ciphertext Ciphertext * @v ciphertext_len Ciphertext length * @v expected Expected plaintext * @v expected_len Expected plaintext length */ -#define pubkey_decrypt_ok( pubkey, key, key_len, ciphertext, \ - ciphertext_len, expected, expected_len ) do {\ +#define pubkey_decrypt_ok( pubkey, key, ciphertext, ciphertext_len, \ + expected, expected_len ) do { \ uint8_t ctx[ (pubkey)->ctxsize ]; \ \ - ok ( pubkey_init ( (pubkey), ctx, (key), (key_len) ) == 0 ); \ + ok ( pubkey_init ( (pubkey), ctx, (key) ) == 0 ); \ { \ size_t max_len = pubkey_max_len ( (pubkey), ctx ); \ uint8_t decrypted[ max_len ]; \ @@ -44,19 +43,15 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * * @v pubkey Public key algorithm * @v encrypt_key Encryption key - * @v encrypt_key_len Encryption key length * @v decrypt_key Decryption key - * @v decrypt_key_len Decryption key length * @v plaintext Plaintext * @v plaintext_len Plaintext length */ -#define pubkey_encrypt_ok( pubkey, encrypt_key, encrypt_key_len, \ - decrypt_key, decrypt_key_len, plaintext, \ +#define pubkey_encrypt_ok( pubkey, encrypt_key, decrypt_key, plaintext, \ plaintext_len ) do { \ uint8_t ctx[ (pubkey)->ctxsize ]; \ \ - ok ( pubkey_init ( (pubkey), ctx, (encrypt_key), \ - (encrypt_key_len) ) == 0 ); \ + ok ( pubkey_init ( (pubkey), ctx, (encrypt_key) ) == 0 ); \ { \ size_t max_len = pubkey_max_len ( (pubkey), ctx ); \ uint8_t encrypted[ max_len ]; \ @@ -68,9 +63,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); encrypted ); \ ok ( encrypted_len >= 0 ); \ pubkey_decrypt_ok ( (pubkey), (decrypt_key), \ - (decrypt_key_len), encrypted, \ - encrypted_len, (plaintext), \ - (plaintext_len) ); \ + encrypted, encrypted_len, \ + (plaintext), (plaintext_len) ); \ } \ pubkey_final ( (pubkey), ctx ); \ } while ( 0 ) @@ -80,15 +74,14 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * * @v pubkey Public key algorithm * @v key Key - * @v key_len Key length * @v digest Digest algorithm * @v plaintext Plaintext * @v plaintext_len Plaintext length * @v expected Expected signature * @v expected_len Expected signature length */ -#define pubkey_sign_ok( pubkey, key, key_len, digest, plaintext, \ - plaintext_len, expected, expected_len ) do { \ +#define pubkey_sign_ok( pubkey, key, digest, plaintext, plaintext_len, \ + expected, expected_len ) do { \ uint8_t ctx[ (pubkey)->ctxsize ]; \ uint8_t digestctx[ (digest)->ctxsize ]; \ uint8_t digestout[ (digest)->digestsize ]; \ @@ -98,7 +91,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); (plaintext_len) ); \ digest_final ( (digest), digestctx, digestout ); \ \ - ok ( pubkey_init ( (pubkey), ctx, (key), (key_len) ) == 0 ); \ + ok ( pubkey_init ( (pubkey), ctx, (key) ) == 0 ); \ { \ size_t max_len = pubkey_max_len ( (pubkey), ctx ); \ uint8_t signature[ max_len ]; \ @@ -118,14 +111,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * * @v pubkey Public key algorithm * @v key Key - * @v key_len Key length * @v digest Digest algorithm * @v plaintext Plaintext * @v plaintext_len Plaintext length * @v signature Signature * @v signature_len Signature length */ -#define pubkey_verify_ok( pubkey, key, key_len, digest, plaintext, \ +#define pubkey_verify_ok( pubkey, key, digest, plaintext, \ plaintext_len, signature, signature_len ) do {\ uint8_t ctx[ (pubkey)->ctxsize ]; \ uint8_t digestctx[ (digest)->ctxsize ]; \ @@ -136,7 +128,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); (plaintext_len) ); \ digest_final ( (digest), digestctx, digestout ); \ \ - ok ( pubkey_init ( (pubkey), ctx, (key), (key_len) ) == 0 ); \ + ok ( pubkey_init ( (pubkey), ctx, (key) ) == 0 ); \ ok ( pubkey_verify ( (pubkey), ctx, (digest), digestout, \ (signature), (signature_len) ) == 0 ); \ pubkey_final ( (pubkey), ctx ); \ @@ -147,14 +139,13 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * * @v pubkey Public key algorithm * @v key Key - * @v key_len Key length * @v digest Digest algorithm * @v plaintext Plaintext * @v plaintext_len Plaintext length * @v signature Signature * @v signature_len Signature length */ -#define pubkey_verify_fail_ok( pubkey, key, key_len, digest, plaintext, \ +#define pubkey_verify_fail_ok( pubkey, key, digest, plaintext, \ plaintext_len, signature, \ signature_len ) do { \ uint8_t ctx[ (pubkey)->ctxsize ]; \ @@ -166,7 +157,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); (plaintext_len) ); \ digest_final ( (digest), digestctx, digestout ); \ \ - ok ( pubkey_init ( (pubkey), ctx, (key), (key_len) ) == 0 ); \ + ok ( pubkey_init ( (pubkey), ctx, (key) ) == 0 ); \ ok ( pubkey_verify ( (pubkey), ctx, (digest), digestout, \ (signature), (signature_len) ) != 0 ); \ pubkey_final ( (pubkey), ctx ); \ diff --git a/src/tests/rsa_test.c b/src/tests/rsa_test.c index 46894f603..b1d522bc0 100644 --- a/src/tests/rsa_test.c +++ b/src/tests/rsa_test.c @@ -61,13 +61,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** An RSA encryption and decryption self-test */ struct rsa_encrypt_decrypt_test { /** Private key */ - const void *private; - /** Private key length */ - size_t private_len; + const struct asn1_cursor private; /** Public key */ - const void *public; - /** Public key length */ - size_t public_len; + const struct asn1_cursor public; /** Plaintext */ const void *plaintext; /** Plaintext length */ @@ -100,10 +96,14 @@ struct rsa_encrypt_decrypt_test { static const uint8_t name ## _plaintext[] = PLAINTEXT; \ static const uint8_t name ## _ciphertext[] = CIPHERTEXT; \ static struct rsa_encrypt_decrypt_test name = { \ - .private = name ## _private, \ - .private_len = sizeof ( name ## _private ), \ - .public = name ## _public, \ - .public_len = sizeof ( name ## _public ), \ + .private = { \ + .data = name ## _private, \ + .len = sizeof ( name ## _private ), \ + }, \ + .public = { \ + .data = name ## _public, \ + .len = sizeof ( name ## _public ), \ + }, \ .plaintext = name ## _plaintext, \ .plaintext_len = sizeof ( name ## _plaintext ), \ .ciphertext = name ## _ciphertext, \ @@ -113,13 +113,9 @@ struct rsa_encrypt_decrypt_test { /** An RSA signature self-test */ struct rsa_signature_test { /** Private key */ - const void *private; - /** Private key length */ - size_t private_len; + const struct asn1_cursor private; /** Public key */ - const void *public; - /** Public key length */ - size_t public_len; + const struct asn1_cursor public; /** Plaintext */ const void *plaintext; /** Plaintext length */ @@ -150,10 +146,14 @@ struct rsa_signature_test { static const uint8_t name ## _plaintext[] = PLAINTEXT; \ static const uint8_t name ## _signature[] = SIGNATURE; \ static struct rsa_signature_test name = { \ - .private = name ## _private, \ - .private_len = sizeof ( name ## _private ), \ - .public = name ## _public, \ - .public_len = sizeof ( name ## _public ), \ + .private = { \ + .data = name ## _private, \ + .len = sizeof ( name ## _private ), \ + }, \ + .public = { \ + .data = name ## _public, \ + .len = sizeof ( name ## _public ), \ + }, \ .plaintext = name ## _plaintext, \ .plaintext_len = sizeof ( name ## _plaintext ), \ .algorithm = ALGORITHM, \ @@ -167,17 +167,14 @@ struct rsa_signature_test { * @v test RSA encryption and decryption test */ #define rsa_encrypt_decrypt_ok( test ) do { \ - pubkey_decrypt_ok ( &rsa_algorithm, (test)->private, \ - (test)->private_len, (test)->ciphertext, \ - (test)->ciphertext_len, (test)->plaintext, \ + pubkey_decrypt_ok ( &rsa_algorithm, &(test)->private, \ + (test)->ciphertext, (test)->ciphertext_len, \ + (test)->plaintext, (test)->plaintext_len );\ + pubkey_encrypt_ok ( &rsa_algorithm, &(test)->private, \ + &(test)->public, (test)->plaintext, \ (test)->plaintext_len ); \ - pubkey_encrypt_ok ( &rsa_algorithm, (test)->private, \ - (test)->private_len, (test)->public, \ - (test)->public_len, (test)->plaintext, \ - (test)->plaintext_len ); \ - pubkey_encrypt_ok ( &rsa_algorithm, (test)->public, \ - (test)->public_len, (test)->private, \ - (test)->private_len, (test)->plaintext, \ + pubkey_encrypt_ok ( &rsa_algorithm, &(test)->public, \ + &(test)->private, (test)->plaintext, \ (test)->plaintext_len ); \ } while ( 0 ) @@ -190,18 +187,15 @@ struct rsa_signature_test { #define rsa_signature_ok( test ) do { \ struct digest_algorithm *digest = (test)->algorithm->digest; \ uint8_t bad_signature[ (test)->signature_len ]; \ - pubkey_sign_ok ( &rsa_algorithm, (test)->private, \ - (test)->private_len, digest, \ + pubkey_sign_ok ( &rsa_algorithm, &(test)->private, digest, \ (test)->plaintext, (test)->plaintext_len, \ (test)->signature, (test)->signature_len ); \ - pubkey_verify_ok ( &rsa_algorithm, (test)->public, \ - (test)->public_len, digest, \ + pubkey_verify_ok ( &rsa_algorithm, &(test)->public, digest, \ (test)->plaintext, (test)->plaintext_len, \ (test)->signature, (test)->signature_len ); \ memset ( bad_signature, 0, sizeof ( bad_signature ) ); \ - pubkey_verify_fail_ok ( &rsa_algorithm, (test)->public, \ - (test)->public_len, digest, \ - (test)->plaintext, \ + pubkey_verify_fail_ok ( &rsa_algorithm, &(test)->public, \ + digest, (test)->plaintext, \ (test)->plaintext_len, bad_signature, \ sizeof ( bad_signature ) ); \ } while ( 0 ) -- cgit v1.2.3-55-g7522 From c9cac76a5c07536a466bdcbb15c69e090f0bb9f7 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 21 Aug 2024 11:45:36 +0100 Subject: [tls] Group transmit and receive state in TLS connection structure The TLS connection structure has grown to become unmanageably large as new features and support for new TLS protocol versions have been added over time. Split out the portions of struct tls_connection that are specific to transmit and receive operations into separate structures, and simplify some structure field names. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 69 ++++++++++++--------- src/net/tls.c | 158 ++++++++++++++++++++++++------------------------- 2 files changed, 119 insertions(+), 108 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index cf3277820..b4e41ccc2 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -250,6 +250,14 @@ struct tls_cipherspec { void *fixed_iv; }; +/** A TLS cipher specification pair */ +struct tls_cipherspec_pair { + /** Current cipher specification */ + struct tls_cipherspec active; + /** Next cipher specification */ + struct tls_cipherspec pending; +}; + /** A TLS signature and hash algorithm identifier */ struct tls_signature_hash_id { /** Hash algorithm */ @@ -340,6 +348,36 @@ struct tls_session { struct list_head conn; }; +/** TLS transmit state */ +struct tls_tx { + /** Cipher specifications */ + struct tls_cipherspec_pair cipherspec; + /** Sequence number */ + uint64_t seq; + /** Pending transmissions */ + unsigned int pending; + /** Transmit process */ + struct process process; +}; + +/** TLS receive state */ +struct tls_rx { + /** Cipher specifications */ + struct tls_cipherspec_pair cipherspec; + /** Sequence number */ + uint64_t seq; + /** State machine current state */ + enum tls_rx_state state; + /** Current received record header */ + struct tls_header header; + /** Current received record header (static I/O buffer) */ + struct io_buffer iobuf; + /** List of received data buffers */ + struct list_head data; + /** Received handshake fragment */ + struct io_buffer *handshake; +}; + /** A TLS connection */ struct tls_connection { /** Reference counter */ @@ -365,14 +403,6 @@ struct tls_connection { /** Protocol version */ uint16_t version; - /** Current TX cipher specification */ - struct tls_cipherspec tx_cipherspec; - /** Next TX cipher specification */ - struct tls_cipherspec tx_cipherspec_pending; - /** Current RX cipher specification */ - struct tls_cipherspec rx_cipherspec; - /** Next RX cipher specification */ - struct tls_cipherspec rx_cipherspec_pending; /** Master secret */ uint8_t master_secret[48]; /** Server random bytes */ @@ -410,25 +440,10 @@ struct tls_connection { /** Certificate validation pending operation */ struct pending_operation validation; - /** TX sequence number */ - uint64_t tx_seq; - /** TX pending transmissions */ - unsigned int tx_pending; - /** TX process */ - struct process process; - - /** RX sequence number */ - uint64_t rx_seq; - /** RX state */ - enum tls_rx_state rx_state; - /** Current received record header */ - struct tls_header rx_header; - /** Current received record header (static I/O buffer) */ - struct io_buffer rx_header_iobuf; - /** List of received data buffers */ - struct list_head rx_data; - /** Received handshake fragment */ - struct io_buffer *rx_handshake; + /** Transmit state */ + struct tls_tx tx; + /** Receive state */ + struct tls_rx rx; }; /** RX I/O buffer size diff --git a/src/net/tls.c b/src/net/tls.c index a22626f41..ec985e332 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -382,17 +382,17 @@ static void free_tls ( struct refcnt *refcnt ) { /* Free dynamically-allocated resources */ free ( tls->new_session_ticket ); - tls_clear_cipher ( tls, &tls->tx_cipherspec ); - tls_clear_cipher ( tls, &tls->tx_cipherspec_pending ); - tls_clear_cipher ( tls, &tls->rx_cipherspec ); - tls_clear_cipher ( tls, &tls->rx_cipherspec_pending ); + tls_clear_cipher ( tls, &tls->tx.cipherspec.active ); + tls_clear_cipher ( tls, &tls->tx.cipherspec.pending ); + tls_clear_cipher ( tls, &tls->rx.cipherspec.active ); + tls_clear_cipher ( tls, &tls->rx.cipherspec.pending ); free ( tls->server_key ); free ( tls->handshake_ctx ); - list_for_each_entry_safe ( iobuf, tmp, &tls->rx_data, list ) { + list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) { list_del ( &iobuf->list ); free_iob ( iobuf ); } - free_iob ( tls->rx_handshake ); + free_iob ( tls->rx.handshake ); x509_chain_put ( tls->certs ); x509_chain_put ( tls->chain ); x509_root_put ( tls->root ); @@ -420,7 +420,7 @@ static void tls_close ( struct tls_connection *tls, int rc ) { pending_put ( &tls->validation ); /* Remove process */ - process_del ( &tls->process ); + process_del ( &tls->tx.process ); /* Close all interfaces */ intf_shutdown ( &tls->cipherstream, rc ); @@ -662,8 +662,8 @@ static void tls_generate_master_secret ( struct tls_connection *tls, * The master secret must already be known. */ static int tls_generate_keys ( struct tls_connection *tls ) { - struct tls_cipherspec *tx_cipherspec = &tls->tx_cipherspec_pending; - struct tls_cipherspec *rx_cipherspec = &tls->rx_cipherspec_pending; + struct tls_cipherspec *tx_cipherspec = &tls->tx.cipherspec.pending; + struct tls_cipherspec *rx_cipherspec = &tls->rx.cipherspec.pending; size_t hash_size = tx_cipherspec->suite->mac_len; size_t key_size = tx_cipherspec->suite->key_len; size_t iv_size = tx_cipherspec->suite->fixed_iv_len; @@ -936,10 +936,10 @@ static int tls_select_cipher ( struct tls_connection *tls, return rc; /* Set ciphers */ - if ( ( rc = tls_set_cipher ( tls, &tls->tx_cipherspec_pending, + if ( ( rc = tls_set_cipher ( tls, &tls->tx.cipherspec.pending, suite ) ) != 0 ) return rc; - if ( ( rc = tls_set_cipher ( tls, &tls->rx_cipherspec_pending, + if ( ( rc = tls_set_cipher ( tls, &tls->rx.cipherspec.pending, suite ) ) != 0 ) return rc; @@ -955,22 +955,20 @@ static int tls_select_cipher ( struct tls_connection *tls, * Activate next cipher suite * * @v tls TLS connection - * @v pending Pending cipher specification - * @v active Active cipher specification to replace + * @v pair Cipher specification pair * @ret rc Return status code */ static int tls_change_cipher ( struct tls_connection *tls, - struct tls_cipherspec *pending, - struct tls_cipherspec *active ) { + struct tls_cipherspec_pair *pair ) { /* Sanity check */ - if ( pending->suite == &tls_cipher_suite_null ) { + if ( pair->pending.suite == &tls_cipher_suite_null ) { DBGC ( tls, "TLS %p refusing to use null cipher\n", tls ); return -ENOTSUP_NULL; } - tls_clear_cipher ( tls, active ); - memswap ( active, pending, sizeof ( *active ) ); + tls_clear_cipher ( tls, &pair->active ); + memswap ( &pair->active, &pair->pending, sizeof ( pair->active ) ); return 0; } @@ -1088,7 +1086,7 @@ tls_find_named_curve ( unsigned int named_curve ) { * @v tls TLS connection */ static void tls_tx_resume ( struct tls_connection *tls ) { - process_add ( &tls->process ); + process_add ( &tls->tx.process ); } /** @@ -1111,13 +1109,13 @@ static void tls_tx_resume_all ( struct tls_session *session ) { static void tls_restart ( struct tls_connection *tls ) { /* Sanity check */ - assert ( ! tls->tx_pending ); + assert ( ! tls->tx.pending ); assert ( ! is_pending ( &tls->client_negotiation ) ); assert ( ! is_pending ( &tls->server_negotiation ) ); assert ( ! is_pending ( &tls->validation ) ); /* (Re)start negotiation */ - tls->tx_pending = TLS_TX_CLIENT_HELLO; + tls->tx.pending = TLS_TX_CLIENT_HELLO; tls_tx_resume ( tls ); pending_get ( &tls->client_negotiation ); pending_get ( &tls->server_negotiation ); @@ -1392,7 +1390,7 @@ static int tls_send_certificate ( struct tls_connection *tls ) { * @ret rc Return status code */ static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) { - struct tls_cipherspec *cipherspec = &tls->tx_cipherspec_pending; + struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey; size_t max_len = pubkey_max_len ( pubkey, cipherspec->pubkey_ctx ); struct { @@ -1458,7 +1456,7 @@ struct tls_key_exchange_algorithm tls_pubkey_exchange_algorithm = { */ static int tls_verify_dh_params ( struct tls_connection *tls, size_t param_len ) { - struct tls_cipherspec *cipherspec = &tls->tx_cipherspec_pending; + struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; struct pubkey_algorithm *pubkey; struct digest_algorithm *digest; int use_sig_hash = tls_version ( tls, TLS_VERSION_TLS_1_2 ); @@ -1783,7 +1781,7 @@ struct tls_key_exchange_algorithm tls_ecdhe_exchange_algorithm = { * @ret rc Return status code */ static int tls_send_client_key_exchange ( struct tls_connection *tls ) { - struct tls_cipherspec *cipherspec = &tls->tx_cipherspec_pending; + struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; struct tls_cipher_suite *suite = cipherspec->suite; int rc; @@ -1976,13 +1974,12 @@ static int tls_new_change_cipher ( struct tls_connection *tls, iob_pull ( iobuf, sizeof ( *change_cipher ) ); /* Change receive cipher spec */ - if ( ( rc = tls_change_cipher ( tls, &tls->rx_cipherspec_pending, - &tls->rx_cipherspec ) ) != 0 ) { + if ( ( rc = tls_change_cipher ( tls, &tls->rx.cipherspec ) ) != 0 ) { DBGC ( tls, "TLS %p could not activate RX cipher: %s\n", tls, strerror ( rc ) ); return rc; } - tls->rx_seq = ~( ( uint64_t ) 0 ); + tls->rx.seq = ~( ( uint64_t ) 0 ); return 0; } @@ -2587,7 +2584,7 @@ static int tls_new_finished ( struct tls_connection *tls, * transmission of Change Cipher and Finished. */ if ( is_pending ( &tls->client_negotiation ) ) { - tls->tx_pending |= ( TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED ); + tls->tx.pending |= ( TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED ); tls_tx_resume ( tls ); } @@ -2788,7 +2785,7 @@ static int tls_new_record ( struct tls_connection *tls, unsigned int type, break; case TLS_TYPE_HANDSHAKE: handler = tls_new_handshake; - iobuf = &tls->rx_handshake; + iobuf = &tls->rx.handshake; break; default: DBGC ( tls, "TLS %p unknown record type %d\n", tls, type ); @@ -2935,7 +2932,7 @@ static void tls_hmac_list ( struct tls_cipherspec *cipherspec, */ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, const void *data, size_t len ) { - struct tls_cipherspec *cipherspec = &tls->tx_cipherspec; + struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active; struct tls_cipher_suite *suite = cipherspec->suite; struct cipher_algorithm *cipher = suite->cipher; struct digest_algorithm *digest = suite->digest; @@ -2962,7 +2959,7 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, } /* Construct authentication data */ - authhdr.seq = cpu_to_be64 ( tls->tx_seq ); + authhdr.seq = cpu_to_be64 ( tls->tx.seq ); authhdr.header.type = type; authhdr.header.version = htons ( tls->version ); authhdr.header.length = htons ( len ); @@ -3046,7 +3043,7 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, } /* Update TX state machine to next record */ - tls->tx_seq += 1; + tls->tx.seq += 1; assert ( plaintext == NULL ); assert ( ciphertext == NULL ); @@ -3107,7 +3104,7 @@ static int tls_verify_padding ( struct tls_connection *tls, static int tls_new_ciphertext ( struct tls_connection *tls, struct tls_header *tlshdr, struct list_head *rx_data ) { - struct tls_cipherspec *cipherspec = &tls->rx_cipherspec; + struct tls_cipherspec *cipherspec = &tls->rx.cipherspec.active; struct tls_cipher_suite *suite = cipherspec->suite; struct cipher_algorithm *cipher = suite->cipher; struct digest_algorithm *digest = suite->digest; @@ -3156,7 +3153,7 @@ static int tls_new_ciphertext ( struct tls_connection *tls, auth = last->tail; /* Construct authentication data */ - authhdr.seq = cpu_to_be64 ( tls->rx_seq ); + authhdr.seq = cpu_to_be64 ( tls->rx.seq ); authhdr.header.type = tlshdr->type; authhdr.header.version = tlshdr->version; authhdr.header.length = htons ( len ); @@ -3172,7 +3169,7 @@ static int tls_new_ciphertext ( struct tls_connection *tls, /* Decrypt the received data */ check_len = 0; - list_for_each_entry ( iobuf, &tls->rx_data, list ) { + list_for_each_entry ( iobuf, &tls->rx.data, list ) { cipher_decrypt ( cipher, cipherspec->cipher_ctx, iobuf->data, iobuf->data, iob_len ( iobuf ) ); check_len += iob_len ( iobuf ); @@ -3334,10 +3331,10 @@ static struct interface_descriptor tls_plainstream_desc = * @ret rc Returned status code */ static int tls_newdata_process_header ( struct tls_connection *tls ) { - struct tls_cipherspec *cipherspec = &tls->rx_cipherspec; + struct tls_cipherspec *cipherspec = &tls->rx.cipherspec.active; struct cipher_algorithm *cipher = cipherspec->suite->cipher; size_t iv_len = cipherspec->suite->record_iv_len; - size_t data_len = ntohs ( tls->rx_header.length ); + size_t data_len = ntohs ( tls->rx.header.length ); size_t remaining = data_len; size_t frag_len; size_t reserve; @@ -3353,7 +3350,7 @@ static int tls_newdata_process_header ( struct tls_connection *tls ) { remaining += reserve; /* Allocate data buffers now that we know the length */ - assert ( list_empty ( &tls->rx_data ) ); + assert ( list_empty ( &tls->rx.data ) ); while ( remaining ) { /* Calculate fragment length. Ensure that no block is @@ -3394,16 +3391,16 @@ static int tls_newdata_process_header ( struct tls_connection *tls ) { reserve = 0; /* Add I/O buffer to list */ - list_add_tail ( &iobuf->list, &tls->rx_data ); + list_add_tail ( &iobuf->list, &tls->rx.data ); } /* Move to data state */ - tls->rx_state = TLS_RX_DATA; + tls->rx.state = TLS_RX_DATA; return 0; err: - list_for_each_entry_safe ( iobuf, tmp, &tls->rx_data, list ) { + list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) { list_del ( &iobuf->list ); free_iob ( iobuf ); } @@ -3421,27 +3418,27 @@ static int tls_newdata_process_data ( struct tls_connection *tls ) { int rc; /* Move current buffer to end of list */ - iobuf = list_first_entry ( &tls->rx_data, struct io_buffer, list ); + iobuf = list_first_entry ( &tls->rx.data, struct io_buffer, list ); list_del ( &iobuf->list ); - list_add_tail ( &iobuf->list, &tls->rx_data ); + list_add_tail ( &iobuf->list, &tls->rx.data ); /* Continue receiving data if any space remains */ - iobuf = list_first_entry ( &tls->rx_data, struct io_buffer, list ); + iobuf = list_first_entry ( &tls->rx.data, struct io_buffer, list ); if ( iob_tailroom ( iobuf ) ) return 0; /* Process record */ - if ( ( rc = tls_new_ciphertext ( tls, &tls->rx_header, - &tls->rx_data ) ) != 0 ) + if ( ( rc = tls_new_ciphertext ( tls, &tls->rx.header, + &tls->rx.data ) ) != 0 ) return rc; /* Increment RX sequence number */ - tls->rx_seq += 1; + tls->rx.seq += 1; /* Return to header state */ - assert ( list_empty ( &tls->rx_data ) ); - tls->rx_state = TLS_RX_HEADER; - iob_unput ( &tls->rx_header_iobuf, sizeof ( tls->rx_header ) ); + assert ( list_empty ( &tls->rx.data ) ); + tls->rx.state = TLS_RX_HEADER; + iob_unput ( &tls->rx.iobuf, sizeof ( tls->rx.header ) ); return 0; } @@ -3480,13 +3477,13 @@ static int tls_cipherstream_deliver ( struct tls_connection *tls, while ( iob_len ( iobuf ) ) { /* Select buffer according to current state */ - switch ( tls->rx_state ) { + switch ( tls->rx.state ) { case TLS_RX_HEADER: - dest = &tls->rx_header_iobuf; + dest = &tls->rx.iobuf; process = tls_newdata_process_header; break; case TLS_RX_DATA: - dest = list_first_entry ( &tls->rx_data, + dest = list_first_entry ( &tls->rx.data, struct io_buffer, list ); assert ( dest != NULL ); process = tls_newdata_process_data; @@ -3550,7 +3547,7 @@ static struct interface_descriptor tls_cipherstream_desc = */ static void tls_validator_done ( struct tls_connection *tls, int rc ) { struct tls_session *session = tls->session; - struct tls_cipherspec *cipherspec = &tls->tx_cipherspec_pending; + struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey; struct x509_certificate *cert; @@ -3588,11 +3585,11 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { } /* Schedule Client Key Exchange, Change Cipher, and Finished */ - tls->tx_pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE | + tls->tx.pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE | TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED ); if ( tls->certs ) { - tls->tx_pending |= ( TLS_TX_CERTIFICATE | + tls->tx.pending |= ( TLS_TX_CERTIFICATE | TLS_TX_CERTIFICATE_VERIFY ); } tls_tx_resume ( tls ); @@ -3635,7 +3632,7 @@ static void tls_tx_step ( struct tls_connection *tls ) { return; /* Send first pending transmission */ - if ( tls->tx_pending & TLS_TX_CLIENT_HELLO ) { + if ( tls->tx.pending & TLS_TX_CLIENT_HELLO ) { /* Serialise server negotiations within a session, to * provide a consistent view of session IDs and * session tickets. @@ -3668,32 +3665,32 @@ static void tls_tx_step ( struct tls_connection *tls ) { tls, strerror ( rc ) ); goto err; } - tls->tx_pending &= ~TLS_TX_CLIENT_HELLO; - } else if ( tls->tx_pending & TLS_TX_CERTIFICATE ) { + tls->tx.pending &= ~TLS_TX_CLIENT_HELLO; + } else if ( tls->tx.pending & TLS_TX_CERTIFICATE ) { /* Send Certificate */ if ( ( rc = tls_send_certificate ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p cold not send Certificate: %s\n", tls, strerror ( rc ) ); goto err; } - tls->tx_pending &= ~TLS_TX_CERTIFICATE; - } else if ( tls->tx_pending & TLS_TX_CLIENT_KEY_EXCHANGE ) { + tls->tx.pending &= ~TLS_TX_CERTIFICATE; + } else if ( tls->tx.pending & TLS_TX_CLIENT_KEY_EXCHANGE ) { /* Send Client Key Exchange */ if ( ( rc = tls_send_client_key_exchange ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Client Key " "Exchange: %s\n", tls, strerror ( rc ) ); goto err; } - tls->tx_pending &= ~TLS_TX_CLIENT_KEY_EXCHANGE; - } else if ( tls->tx_pending & TLS_TX_CERTIFICATE_VERIFY ) { + tls->tx.pending &= ~TLS_TX_CLIENT_KEY_EXCHANGE; + } else if ( tls->tx.pending & TLS_TX_CERTIFICATE_VERIFY ) { /* Send Certificate Verify */ if ( ( rc = tls_send_certificate_verify ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Certificate " "Verify: %s\n", tls, strerror ( rc ) ); goto err; } - tls->tx_pending &= ~TLS_TX_CERTIFICATE_VERIFY; - } else if ( tls->tx_pending & TLS_TX_CHANGE_CIPHER ) { + tls->tx.pending &= ~TLS_TX_CERTIFICATE_VERIFY; + } else if ( tls->tx.pending & TLS_TX_CHANGE_CIPHER ) { /* Send Change Cipher, and then change the cipher in use */ if ( ( rc = tls_send_change_cipher ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Change Cipher: " @@ -3701,28 +3698,27 @@ static void tls_tx_step ( struct tls_connection *tls ) { goto err; } if ( ( rc = tls_change_cipher ( tls, - &tls->tx_cipherspec_pending, - &tls->tx_cipherspec )) != 0 ){ + &tls->tx.cipherspec ) ) != 0 ){ DBGC ( tls, "TLS %p could not activate TX cipher: " "%s\n", tls, strerror ( rc ) ); goto err; } - tls->tx_seq = 0; - tls->tx_pending &= ~TLS_TX_CHANGE_CIPHER; - } else if ( tls->tx_pending & TLS_TX_FINISHED ) { + tls->tx.seq = 0; + tls->tx.pending &= ~TLS_TX_CHANGE_CIPHER; + } else if ( tls->tx.pending & TLS_TX_FINISHED ) { /* Send Finished */ if ( ( rc = tls_send_finished ( tls ) ) != 0 ) { DBGC ( tls, "TLS %p could not send Finished: %s\n", tls, strerror ( rc ) ); goto err; } - tls->tx_pending &= ~TLS_TX_FINISHED; + tls->tx.pending &= ~TLS_TX_FINISHED; } /* Reschedule process if pending transmissions remain, * otherwise send notification of a window change. */ - if ( tls->tx_pending ) { + if ( tls->tx.pending ) { tls_tx_resume ( tls ); } else { xfer_window_changed ( &tls->plainstream ); @@ -3736,7 +3732,7 @@ static void tls_tx_step ( struct tls_connection *tls ) { /** TLS TX process descriptor */ static struct process_descriptor tls_process_desc = - PROC_DESC_ONCE ( struct tls_connection, process, tls_tx_step ); + PROC_DESC_ONCE ( struct tls_connection, tx.process, tls_tx_step ); /****************************************************************************** * @@ -3829,20 +3825,20 @@ int add_tls ( struct interface *xfer, const char *name, intf_init ( &tls->plainstream, &tls_plainstream_desc, &tls->refcnt ); intf_init ( &tls->cipherstream, &tls_cipherstream_desc, &tls->refcnt ); intf_init ( &tls->validator, &tls_validator_desc, &tls->refcnt ); - process_init_stopped ( &tls->process, &tls_process_desc, + process_init_stopped ( &tls->tx.process, &tls_process_desc, &tls->refcnt ); tls->key = privkey_get ( key ? key : &private_key ); tls->root = x509_root_get ( root ? root : &root_certificates ); tls->version = TLS_VERSION_MAX; - tls_clear_cipher ( tls, &tls->tx_cipherspec ); - tls_clear_cipher ( tls, &tls->tx_cipherspec_pending ); - tls_clear_cipher ( tls, &tls->rx_cipherspec ); - tls_clear_cipher ( tls, &tls->rx_cipherspec_pending ); + tls_clear_cipher ( tls, &tls->tx.cipherspec.active ); + tls_clear_cipher ( tls, &tls->tx.cipherspec.pending ); + tls_clear_cipher ( tls, &tls->rx.cipherspec.active ); + tls_clear_cipher ( tls, &tls->rx.cipherspec.pending ); tls_clear_handshake ( tls ); tls->client_random.gmt_unix_time = time ( NULL ); - iob_populate ( &tls->rx_header_iobuf, &tls->rx_header, 0, - sizeof ( tls->rx_header ) ); - INIT_LIST_HEAD ( &tls->rx_data ); + iob_populate ( &tls->rx.iobuf, &tls->rx.header, 0, + sizeof ( tls->rx.header ) ); + INIT_LIST_HEAD ( &tls->rx.data ); if ( ( rc = tls_generate_random ( tls, &tls->client_random.random, ( sizeof ( tls->client_random.random ) ) ) ) != 0 ) { goto err_random; -- cgit v1.2.3-55-g7522 From acbabdb335f47eb8246188a23ed7e3997da6e8ba Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 21 Aug 2024 12:15:24 +0100 Subject: [tls] Group client and server state in TLS connection structure The TLS connection structure has grown to become unmanageably large as new features and support for new TLS protocol versions have been added over time. Split out the portions of struct tls_connection that are specific to client and server operations into separate structures, and simplify some structure field names. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 62 ++++++++------ src/net/tls.c | 213 ++++++++++++++++++++++++++----------------------- 2 files changed, 147 insertions(+), 128 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index b4e41ccc2..9494eaa05 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -378,6 +378,38 @@ struct tls_rx { struct io_buffer *handshake; }; +/** TLS client state */ +struct tls_client { + /** Random bytes */ + struct tls_client_random random; + /** Private key (if used) */ + struct private_key *key; + /** Certificate chain (if used) */ + struct x509_chain *chain; + /** Security negotiation pending operation */ + struct pending_operation negotiation; +}; + +/** TLS server state */ +struct tls_server { + /** Random bytes */ + uint8_t random[32]; + /** Server Key Exchange record (if any) */ + void *exchange; + /** Server Key Exchange record length */ + size_t exchange_len; + /** Root of trust */ + struct x509_root *root; + /** Certificate chain */ + struct x509_chain *chain; + /** Certificate validator */ + struct interface validator; + /** Certificate validation pending operation */ + struct pending_operation validation; + /** Security negotiation pending operation */ + struct pending_operation negotiation; +}; + /** A TLS connection */ struct tls_connection { /** Reference counter */ @@ -405,45 +437,23 @@ struct tls_connection { uint16_t version; /** Master secret */ uint8_t master_secret[48]; - /** Server random bytes */ - uint8_t server_random[32]; - /** Client random bytes */ - struct tls_client_random client_random; - /** Server Key Exchange record (if any) */ - void *server_key; - /** Server Key Exchange record length */ - size_t server_key_len; /** Digest algorithm used for handshake verification */ struct digest_algorithm *handshake_digest; /** Digest algorithm context used for handshake verification */ uint8_t *handshake_ctx; - /** Private key */ - struct private_key *key; - /** Client certificate chain (if used) */ - struct x509_chain *certs; /** Secure renegotiation flag */ int secure_renegotiation; /** Verification data */ struct tls_verify_data verify; - /** Root of trust */ - struct x509_root *root; - /** Server certificate chain */ - struct x509_chain *chain; - /** Certificate validator */ - struct interface validator; - - /** Client security negotiation pending operation */ - struct pending_operation client_negotiation; - /** Server security negotiation pending operation */ - struct pending_operation server_negotiation; - /** Certificate validation pending operation */ - struct pending_operation validation; - /** Transmit state */ struct tls_tx tx; /** Receive state */ struct tls_rx rx; + /** Client state */ + struct tls_client client; + /** Server state */ + struct tls_server server; }; /** RX I/O buffer size diff --git a/src/net/tls.c b/src/net/tls.c index ec985e332..ec503e43d 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -251,8 +251,8 @@ static void tls_set_uint24 ( tls24_t *field24, unsigned long value ) { * @ret is_ready TLS connection is ready */ static int tls_ready ( struct tls_connection *tls ) { - return ( ( ! is_pending ( &tls->client_negotiation ) ) && - ( ! is_pending ( &tls->server_negotiation ) ) ); + return ( ( ! is_pending ( &tls->client.negotiation ) ) && + ( ! is_pending ( &tls->server.negotiation ) ) ); } /** @@ -386,17 +386,17 @@ static void free_tls ( struct refcnt *refcnt ) { tls_clear_cipher ( tls, &tls->tx.cipherspec.pending ); tls_clear_cipher ( tls, &tls->rx.cipherspec.active ); tls_clear_cipher ( tls, &tls->rx.cipherspec.pending ); - free ( tls->server_key ); + free ( tls->server.exchange ); free ( tls->handshake_ctx ); list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) { list_del ( &iobuf->list ); free_iob ( iobuf ); } free_iob ( tls->rx.handshake ); - x509_chain_put ( tls->certs ); - x509_chain_put ( tls->chain ); - x509_root_put ( tls->root ); - privkey_put ( tls->key ); + privkey_put ( tls->client.key ); + x509_chain_put ( tls->client.chain ); + x509_chain_put ( tls->server.chain ); + x509_root_put ( tls->server.root ); /* Drop reference to session */ assert ( list_empty ( &tls->list ) ); @@ -415,9 +415,9 @@ static void free_tls ( struct refcnt *refcnt ) { static void tls_close ( struct tls_connection *tls, int rc ) { /* Remove pending operations, if applicable */ - pending_put ( &tls->client_negotiation ); - pending_put ( &tls->server_negotiation ); - pending_put ( &tls->validation ); + pending_put ( &tls->client.negotiation ); + pending_put ( &tls->server.negotiation ); + pending_put ( &tls->server.validation ); /* Remove process */ process_del ( &tls->tx.process ); @@ -425,7 +425,7 @@ static void tls_close ( struct tls_connection *tls, int rc ) { /* Close all interfaces */ intf_shutdown ( &tls->cipherstream, rc ); intf_shutdown ( &tls->plainstream, rc ); - intf_shutdown ( &tls->validator, rc ); + intf_shutdown ( &tls->server.validator, rc ); /* Remove from session */ list_del ( &tls->list ); @@ -640,15 +640,15 @@ static void tls_generate_master_secret ( struct tls_connection *tls, DBGC ( tls, "TLS %p pre-master-secret:\n", tls ); DBGC_HD ( tls, pre_master_secret, pre_master_secret_len ); DBGC ( tls, "TLS %p client random bytes:\n", tls ); - DBGC_HD ( tls, &tls->client_random, sizeof ( tls->client_random ) ); + DBGC_HD ( tls, &tls->client.random, sizeof ( tls->client.random ) ); DBGC ( tls, "TLS %p server random bytes:\n", tls ); - DBGC_HD ( tls, &tls->server_random, sizeof ( tls->server_random ) ); + DBGC_HD ( tls, &tls->server.random, sizeof ( tls->server.random ) ); tls_prf_label ( tls, pre_master_secret, pre_master_secret_len, &tls->master_secret, sizeof ( tls->master_secret ), "master secret", - &tls->client_random, sizeof ( tls->client_random ), - &tls->server_random, sizeof ( tls->server_random ) ); + &tls->client.random, sizeof ( tls->client.random ), + &tls->server.random, sizeof ( tls->server.random ) ); DBGC ( tls, "TLS %p generated master secret:\n", tls ); DBGC_HD ( tls, &tls->master_secret, sizeof ( tls->master_secret ) ); @@ -675,8 +675,8 @@ static int tls_generate_keys ( struct tls_connection *tls ) { /* Generate key block */ tls_prf_label ( tls, &tls->master_secret, sizeof ( tls->master_secret ), key_block, sizeof ( key_block ), "key expansion", - &tls->server_random, sizeof ( tls->server_random ), - &tls->client_random, sizeof ( tls->client_random ) ); + &tls->server.random, sizeof ( tls->server.random ), + &tls->client.random, sizeof ( tls->client.random ) ); /* Split key block into portions */ key = key_block; @@ -1110,15 +1110,15 @@ static void tls_restart ( struct tls_connection *tls ) { /* Sanity check */ assert ( ! tls->tx.pending ); - assert ( ! is_pending ( &tls->client_negotiation ) ); - assert ( ! is_pending ( &tls->server_negotiation ) ); - assert ( ! is_pending ( &tls->validation ) ); + assert ( ! is_pending ( &tls->client.negotiation ) ); + assert ( ! is_pending ( &tls->server.negotiation ) ); + assert ( ! is_pending ( &tls->server.validation ) ); /* (Re)start negotiation */ tls->tx.pending = TLS_TX_CLIENT_HELLO; tls_tx_resume ( tls ); - pending_get ( &tls->client_negotiation ); - pending_get ( &tls->server_negotiation ); + pending_get ( &tls->client.negotiation ); + pending_get ( &tls->server.negotiation ); } /** @@ -1237,7 +1237,7 @@ static int tls_client_hello ( struct tls_connection *tls, htonl ( sizeof ( hello ) - sizeof ( hello.type_length ) ) ); hello.version = htons ( TLS_VERSION_MAX ); - memcpy ( &hello.random, &tls->client_random, sizeof ( hello.random ) ); + memcpy ( &hello.random, &tls->client.random, sizeof ( hello.random ) ); hello.session_id_len = tls->session_id_len; memcpy ( hello.session_id, tls->session_id, sizeof ( hello.session_id ) ); @@ -1344,7 +1344,7 @@ static int tls_send_certificate ( struct tls_connection *tls ) { /* Calculate length of client certificates */ len = 0; - list_for_each_entry ( link, &tls->certs->links, list ) { + list_for_each_entry ( link, &tls->client.chain->links, list ) { cert = link->cert; len += ( sizeof ( *certificate ) + cert->raw.len ); DBGC ( tls, "TLS %p sending client certificate %s\n", @@ -1365,7 +1365,7 @@ static int tls_send_certificate ( struct tls_connection *tls ) { sizeof ( certificates->type_length ) ) ); tls_set_uint24 ( &certificates->length, len ); certificate = &certificates->certificates[0]; - list_for_each_entry ( link, &tls->certs->links, list ) { + list_for_each_entry ( link, &tls->client.chain->links, list ) { cert = link->cert; tls_set_uint24 ( &certificate->length, cert->raw.len ); memcpy ( certificate->data, cert->raw.data, cert->raw.len ); @@ -1470,9 +1470,9 @@ static int tls_verify_dh_params ( struct tls_connection *tls, int rc; /* Signature follows parameters */ - assert ( param_len <= tls->server_key_len ); - data = ( tls->server_key + param_len ); - remaining = ( tls->server_key_len - param_len ); + assert ( param_len <= tls->server.exchange_len ); + data = ( tls->server.exchange + param_len ); + remaining = ( tls->server.exchange_len - param_len ); /* Parse signature from ServerKeyExchange */ sig = data; @@ -1481,7 +1481,8 @@ static int tls_verify_dh_params ( struct tls_connection *tls, sizeof ( *sig ) ) ) ) { DBGC ( tls, "TLS %p received underlength ServerKeyExchange\n", tls ); - DBGC_HDA ( tls, 0, tls->server_key, tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); return -EINVAL_KEY_EXCHANGE; } @@ -1514,11 +1515,11 @@ static int tls_verify_dh_params ( struct tls_connection *tls, /* Calculate digest */ digest_init ( digest, ctx ); - digest_update ( digest, ctx, &tls->client_random, - sizeof ( tls->client_random ) ); - digest_update ( digest, ctx, tls->server_random, - sizeof ( tls->server_random ) ); - digest_update ( digest, ctx, tls->server_key, param_len ); + digest_update ( digest, ctx, &tls->client.random, + sizeof ( tls->client.random ) ); + digest_update ( digest, ctx, tls->server.random, + sizeof ( tls->server.random ) ); + digest_update ( digest, ctx, tls->server.exchange, param_len ); digest_final ( digest, ctx, hash ); /* Verify signature */ @@ -1527,8 +1528,8 @@ static int tls_verify_dh_params ( struct tls_connection *tls, signature_len ) ) != 0 ) { DBGC ( tls, "TLS %p ServerKeyExchange failed " "verification\n", tls ); - DBGC_HDA ( tls, 0, tls->server_key, - tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); return -EPERM_KEY_EXCHANGE; } } @@ -1543,7 +1544,7 @@ static int tls_verify_dh_params ( struct tls_connection *tls, * @ret rc Return status code */ static int tls_send_client_key_exchange_dhe ( struct tls_connection *tls ) { - uint8_t private[ sizeof ( tls->client_random.random ) ]; + uint8_t private[ sizeof ( tls->client.random.random ) ]; const struct { uint16_t len; uint8_t data[0]; @@ -1556,8 +1557,8 @@ static int tls_send_client_key_exchange_dhe ( struct tls_connection *tls ) { int rc; /* Parse ServerKeyExchange */ - data = tls->server_key; - remaining = tls->server_key_len; + data = tls->server.exchange; + remaining = tls->server.exchange_len; for ( i = 0 ; i < ( sizeof ( dh_val ) / sizeof ( dh_val[0] ) ) ; i++ ){ dh_val[i] = data; if ( ( sizeof ( *dh_val[i] ) > remaining ) || @@ -1565,8 +1566,8 @@ static int tls_send_client_key_exchange_dhe ( struct tls_connection *tls ) { sizeof ( *dh_val[i] ) ) )){ DBGC ( tls, "TLS %p received underlength " "ServerKeyExchange\n", tls ); - DBGC_HDA ( tls, 0, tls->server_key, - tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); rc = -EINVAL_KEY_EXCHANGE; goto err_header; } @@ -1574,7 +1575,7 @@ static int tls_send_client_key_exchange_dhe ( struct tls_connection *tls ) { data += frag_len; remaining -= frag_len; } - param_len = ( tls->server_key_len - remaining ); + param_len = ( tls->server.exchange_len - remaining ); /* Verify parameter signature */ if ( ( rc = tls_verify_dh_params ( tls, param_len ) ) != 0 ) @@ -1679,12 +1680,14 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { int rc; /* Parse ServerKeyExchange record */ - ecdh = tls->server_key; - if ( ( sizeof ( *ecdh ) > tls->server_key_len ) || - ( ecdh->public_len > ( tls->server_key_len - sizeof ( *ecdh ) ))){ + ecdh = tls->server.exchange; + if ( ( sizeof ( *ecdh ) > tls->server.exchange_len ) || + ( ecdh->public_len > ( tls->server.exchange_len - + sizeof ( *ecdh ) ) ) ) { DBGC ( tls, "TLS %p received underlength ServerKeyExchange\n", tls ); - DBGC_HDA ( tls, 0, tls->server_key, tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); return -EINVAL_KEY_EXCHANGE; } param_len = ( sizeof ( *ecdh ) + ecdh->public_len ); @@ -1697,14 +1700,16 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { if ( ecdh->curve_type != TLS_NAMED_CURVE_TYPE ) { DBGC ( tls, "TLS %p unsupported curve type %d\n", tls, ecdh->curve_type ); - DBGC_HDA ( tls, 0, tls->server_key, tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); return -ENOTSUP_CURVE; } curve = tls_find_named_curve ( ecdh->named_curve ); if ( ! curve ) { DBGC ( tls, "TLS %p unsupported named curve %d\n", tls, ntohs ( ecdh->named_curve ) ); - DBGC_HDA ( tls, 0, tls->server_key, tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); return -ENOTSUP_CURVE; } @@ -1712,7 +1717,8 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { if ( ecdh->public_len != curve->curve->keysize ) { DBGC ( tls, "TLS %p invalid %s key\n", tls, curve->curve->name ); - DBGC_HDA ( tls, 0, tls->server_key, tls->server_key_len ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); return -EINVAL_KEY_EXCHANGE; } @@ -1810,9 +1816,9 @@ static int tls_send_client_key_exchange ( struct tls_connection *tls ) { */ static int tls_send_certificate_verify ( struct tls_connection *tls ) { struct digest_algorithm *digest = tls->handshake_digest; - struct x509_certificate *cert = x509_first ( tls->certs ); + struct x509_certificate *cert = x509_first ( tls->client.chain ); struct pubkey_algorithm *pubkey = cert->signature_algorithm->pubkey; - struct asn1_cursor *key = privkey_cursor ( tls->key ); + struct asn1_cursor *key = privkey_cursor ( tls->client.key ); uint8_t digest_out[ digest->digestsize ]; uint8_t ctx[ pubkey->ctxsize ]; struct tls_signature_hash_algorithm *sig_hash = NULL; @@ -1944,7 +1950,7 @@ static int tls_send_finished ( struct tls_connection *tls ) { return rc; /* Mark client as finished */ - pending_put ( &tls->client_negotiation ); + pending_put ( &tls->client.negotiation ); return 0; } @@ -2185,8 +2191,8 @@ static int tls_new_server_hello ( struct tls_connection *tls, return rc; /* Copy out server random bytes */ - memcpy ( &tls->server_random, &hello_a->random, - sizeof ( tls->server_random ) ); + memcpy ( &tls->server.random, &hello_a->random, + sizeof ( tls->server.random ) ); /* Check session ID */ if ( hello_a->session_id_len && @@ -2306,12 +2312,12 @@ static int tls_parse_chain ( struct tls_connection *tls, int rc; /* Free any existing certificate chain */ - x509_chain_put ( tls->chain ); - tls->chain = NULL; + x509_chain_put ( tls->server.chain ); + tls->server.chain = NULL; /* Create certificate chain */ - tls->chain = x509_alloc_chain(); - if ( ! tls->chain ) { + tls->server.chain = x509_alloc_chain(); + if ( ! tls->server.chain ) { rc = -ENOMEM_CHAIN; goto err_alloc_chain; } @@ -2343,14 +2349,15 @@ static int tls_parse_chain ( struct tls_connection *tls, record_len = ( sizeof ( *certificate ) + certificate_len ); /* Add certificate to chain */ - if ( ( rc = x509_append_raw ( tls->chain, certificate->data, + if ( ( rc = x509_append_raw ( tls->server.chain, + certificate->data, certificate_len ) ) != 0 ) { DBGC ( tls, "TLS %p could not append certificate: %s\n", tls, strerror ( rc ) ); DBGC_HDA ( tls, 0, data, remaining ); goto err_parse; } - cert = x509_last ( tls->chain ); + cert = x509_last ( tls->server.chain ); DBGC ( tls, "TLS %p found certificate %s\n", tls, x509_name ( cert ) ); @@ -2364,8 +2371,8 @@ static int tls_parse_chain ( struct tls_connection *tls, err_parse: err_overlength: err_underlength: - x509_chain_put ( tls->chain ); - tls->chain = NULL; + x509_chain_put ( tls->server.chain ); + tls->server.chain = NULL; err_alloc_chain: return rc; } @@ -2422,12 +2429,12 @@ static int tls_new_server_key_exchange ( struct tls_connection *tls, const void *data, size_t len ) { /* Free any existing server key exchange record */ - free ( tls->server_key ); - tls->server_key_len = 0; + free ( tls->server.exchange ); + tls->server.exchange_len = 0; /* Allocate copy of server key exchange record */ - tls->server_key = malloc ( len ); - if ( ! tls->server_key ) + tls->server.exchange = malloc ( len ); + if ( ! tls->server.exchange ) return -ENOMEM; /* Store copy of server key exchange record for later @@ -2435,8 +2442,8 @@ static int tls_new_server_key_exchange ( struct tls_connection *tls, * since the certificate validation will not yet have * completed. */ - memcpy ( tls->server_key, data, len ); - tls->server_key_len = len; + memcpy ( tls->server.exchange, data, len ); + tls->server.exchange_len = len; return 0; } @@ -2460,11 +2467,11 @@ static int tls_new_certificate_request ( struct tls_connection *tls, */ /* Free any existing client certificate chain */ - x509_chain_put ( tls->certs ); - tls->certs = NULL; + x509_chain_put ( tls->client.chain ); + tls->client.chain = NULL; /* Determine client certificate to be sent */ - cert = x509_find_key ( NULL, tls->key ); + cert = x509_find_key ( NULL, tls->client.key ); if ( ! cert ) { DBGC ( tls, "TLS %p could not find certificate corresponding " "to private key\n", tls ); @@ -2476,18 +2483,18 @@ static int tls_new_certificate_request ( struct tls_connection *tls, tls, x509_name ( cert ) ); /* Create client certificate chain */ - tls->certs = x509_alloc_chain(); - if ( ! tls->certs ) { + tls->client.chain = x509_alloc_chain(); + if ( ! tls->client.chain ) { rc = -ENOMEM; goto err_alloc; } /* Append client certificate to chain */ - if ( ( rc = x509_append ( tls->certs, cert ) ) != 0 ) + if ( ( rc = x509_append ( tls->client.chain, cert ) ) != 0 ) goto err_append; /* Append any relevant issuer certificates */ - if ( ( rc = x509_auto_append ( tls->certs, &certstore ) ) != 0 ) + if ( ( rc = x509_auto_append ( tls->client.chain, &certstore ) ) != 0 ) goto err_auto_append; /* Drop local reference to client certificate */ @@ -2497,8 +2504,8 @@ static int tls_new_certificate_request ( struct tls_connection *tls, err_auto_append: err_append: - x509_chain_put ( tls->certs ); - tls->certs = NULL; + x509_chain_put ( tls->client.chain ); + tls->client.chain = NULL; err_alloc: x509_put ( cert ); err_find: @@ -2529,13 +2536,14 @@ static int tls_new_server_hello_done ( struct tls_connection *tls, } /* Begin certificate validation */ - if ( ( rc = create_validator ( &tls->validator, tls->chain, - tls->root ) ) != 0 ) { + if ( ( rc = create_validator ( &tls->server.validator, + tls->server.chain, + tls->server.root ) ) != 0 ) { DBGC ( tls, "TLS %p could not start certificate validation: " "%s\n", tls, strerror ( rc ) ); return rc; } - pending_get ( &tls->validation ); + pending_get ( &tls->server.validation ); return 0; } @@ -2577,13 +2585,13 @@ static int tls_new_finished ( struct tls_connection *tls, } /* Mark server as finished */ - pending_put ( &tls->server_negotiation ); + pending_put ( &tls->server.negotiation ); /* If we are resuming a session (i.e. if the server Finished * arrives before the client Finished is sent), then schedule * transmission of Change Cipher and Finished. */ - if ( is_pending ( &tls->client_negotiation ) ) { + if ( is_pending ( &tls->client.negotiation ) ) { tls->tx.pending |= ( TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED ); tls_tx_resume ( tls ); } @@ -3295,8 +3303,8 @@ static int tls_progress ( struct tls_connection *tls, struct job_progress *progress ) { /* Return cipherstream or validator progress as applicable */ - if ( is_pending ( &tls->validation ) ) { - return job_progress ( &tls->validator, progress ); + if ( is_pending ( &tls->server.validation ) ) { + return job_progress ( &tls->server.validator, progress ); } else { return job_progress ( &tls->cipherstream, progress ); } @@ -3552,10 +3560,10 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { struct x509_certificate *cert; /* Mark validation as complete */ - pending_put ( &tls->validation ); + pending_put ( &tls->server.validation ); /* Close validator interface */ - intf_restart ( &tls->validator, rc ); + intf_restart ( &tls->server.validator, rc ); /* Check for validation failure */ if ( rc != 0 ) { @@ -3566,7 +3574,7 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { DBGC ( tls, "TLS %p certificate validation succeeded\n", tls ); /* Extract first certificate */ - cert = x509_first ( tls->chain ); + cert = x509_first ( tls->server.chain ); assert ( cert != NULL ); /* Verify server name */ @@ -3588,7 +3596,7 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { tls->tx.pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE | TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED ); - if ( tls->certs ) { + if ( tls->client.chain ) { tls->tx.pending |= ( TLS_TX_CERTIFICATE | TLS_TX_CERTIFICATE_VERIFY ); } @@ -3608,7 +3616,8 @@ static struct interface_operation tls_validator_ops[] = { /** TLS certificate validator interface descriptor */ static struct interface_descriptor tls_validator_desc = - INTF_DESC ( struct tls_connection, validator, tls_validator_ops ); + INTF_DESC ( struct tls_connection, server.validator, + tls_validator_ops ); /****************************************************************************** * @@ -3640,7 +3649,7 @@ static void tls_tx_step ( struct tls_connection *tls ) { list_for_each_entry ( conn, &session->conn, list ) { if ( conn == tls ) break; - if ( is_pending ( &conn->server_negotiation ) ) + if ( is_pending ( &conn->server.negotiation ) ) return; } /* Record or generate session ID and associated master secret */ @@ -3654,8 +3663,8 @@ static void tls_tx_step ( struct tls_connection *tls ) { } else { /* No existing session: use a random session ID */ assert ( sizeof ( tls->session_id ) == - sizeof ( tls->client_random ) ); - memcpy ( tls->session_id, &tls->client_random, + sizeof ( tls->client.random ) ); + memcpy ( tls->session_id, &tls->client.random, sizeof ( tls->session_id ) ); tls->session_id_len = sizeof ( tls->session_id ); } @@ -3756,8 +3765,8 @@ static int tls_session ( struct tls_connection *tls, const char *name ) { /* Find existing matching session, if any */ list_for_each_entry ( session, &tls_sessions, list ) { if ( ( strcmp ( name, session->name ) == 0 ) && - ( tls->root == session->root ) && - ( tls->key == session->key ) ) { + ( tls->server.root == session->root ) && + ( tls->client.key == session->key ) ) { ref_get ( &session->refcnt ); tls->session = session; DBGC ( tls, "TLS %p joining session %s\n", tls, name ); @@ -3776,8 +3785,8 @@ static int tls_session ( struct tls_connection *tls, const char *name ) { name_copy = ( ( ( void * ) session ) + sizeof ( *session ) ); strcpy ( name_copy, name ); session->name = name_copy; - session->root = x509_root_get ( tls->root ); - session->key = privkey_get ( tls->key ); + session->root = x509_root_get ( tls->server.root ); + session->key = privkey_get ( tls->client.key ); INIT_LIST_HEAD ( &session->conn ); list_add ( &session->list, &tls_sessions ); @@ -3824,23 +3833,23 @@ int add_tls ( struct interface *xfer, const char *name, INIT_LIST_HEAD ( &tls->list ); intf_init ( &tls->plainstream, &tls_plainstream_desc, &tls->refcnt ); intf_init ( &tls->cipherstream, &tls_cipherstream_desc, &tls->refcnt ); - intf_init ( &tls->validator, &tls_validator_desc, &tls->refcnt ); + intf_init ( &tls->server.validator, &tls_validator_desc, &tls->refcnt ); process_init_stopped ( &tls->tx.process, &tls_process_desc, &tls->refcnt ); - tls->key = privkey_get ( key ? key : &private_key ); - tls->root = x509_root_get ( root ? root : &root_certificates ); + tls->client.key = privkey_get ( key ? key : &private_key ); + tls->server.root = x509_root_get ( root ? root : &root_certificates ); tls->version = TLS_VERSION_MAX; tls_clear_cipher ( tls, &tls->tx.cipherspec.active ); tls_clear_cipher ( tls, &tls->tx.cipherspec.pending ); tls_clear_cipher ( tls, &tls->rx.cipherspec.active ); tls_clear_cipher ( tls, &tls->rx.cipherspec.pending ); tls_clear_handshake ( tls ); - tls->client_random.gmt_unix_time = time ( NULL ); + tls->client.random.gmt_unix_time = time ( NULL ); iob_populate ( &tls->rx.iobuf, &tls->rx.header, 0, sizeof ( tls->rx.header ) ); INIT_LIST_HEAD ( &tls->rx.data ); - if ( ( rc = tls_generate_random ( tls, &tls->client_random.random, - ( sizeof ( tls->client_random.random ) ) ) ) != 0 ) { + if ( ( rc = tls_generate_random ( tls, &tls->client.random.random, + ( sizeof ( tls->client.random.random ) ) ) ) != 0 ) { goto err_random; } if ( ( rc = tls_session ( tls, name ) ) != 0 ) -- cgit v1.2.3-55-g7522 From 46937a9df622d1e9fb5b1e926a04176b8855fdce Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 21 Aug 2024 16:25:10 +0100 Subject: [crypto] Remove the concept of a public-key algorithm reusable context Instances of cipher and digest algorithms tend to get called repeatedly to process substantial amounts of data. This is not true for public-key algorithms, which tend to get called only once or twice for a given key. Simplify the public-key algorithm API so that there is no reusable algorithm context. In particular, this allows callers to omit the error handling currently required to handle memory allocation (or key parsing) errors from pubkey_init(), and to omit the cleanup calls to pubkey_final(). This change does remove the ability for a caller to distinguish between a verification failure due to a memory allocation failure and a verification failure due to a bad signature. This difference is not material in practice: in both cases, for whatever reason, the caller was unable to verify the signature and so cannot proceed further, and the cause of the error will be visible to the user via the return status code. Signed-off-by: Michael Brown --- src/crypto/cms.c | 19 +-- src/crypto/crypto_null.c | 24 ++-- src/crypto/ocsp.c | 21 +--- src/crypto/rsa.c | 295 +++++++++++++++++++++++++++++----------------- src/crypto/x509.c | 13 +- src/drivers/net/iphone.c | 18 +-- src/include/ipxe/crypto.h | 96 ++++++--------- src/include/ipxe/rsa.h | 25 ---- src/include/ipxe/tls.h | 4 +- src/net/tls.c | 45 ++----- src/tests/pubkey_test.c | 142 +++++++--------------- 11 files changed, 304 insertions(+), 398 deletions(-) (limited to 'src/net') diff --git a/src/crypto/cms.c b/src/crypto/cms.c index 0b772f1cf..2e153d819 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -612,33 +612,22 @@ static int cms_verify_digest ( struct cms_message *cms, userptr_t data, size_t len ) { struct digest_algorithm *digest = part->digest; struct pubkey_algorithm *pubkey = part->pubkey; - struct x509_public_key *public_key = &cert->subject.public_key; + struct asn1_cursor *key = &cert->subject.public_key.raw; uint8_t digest_out[ digest->digestsize ]; - uint8_t ctx[ pubkey->ctxsize ]; int rc; /* Generate digest */ cms_digest ( cms, part, data, len, digest_out ); - /* Initialise public-key algorithm */ - if ( ( rc = pubkey_init ( pubkey, ctx, &public_key->raw ) ) != 0 ) { - DBGC ( cms, "CMS %p/%p could not initialise public key: %s\n", - cms, part, strerror ( rc ) ); - goto err_init; - } - /* Verify digest */ - if ( ( rc = pubkey_verify ( pubkey, ctx, digest, digest_out, + if ( ( rc = pubkey_verify ( pubkey, key, digest, digest_out, part->value, part->len ) ) != 0 ) { DBGC ( cms, "CMS %p/%p signature verification failed: %s\n", cms, part, strerror ( rc ) ); - goto err_verify; + return rc; } - err_verify: - pubkey_final ( pubkey, ctx ); - err_init: - return rc; + return 0; } /** diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c index b4169382b..d5863f958 100644 --- a/src/crypto/crypto_null.c +++ b/src/crypto/crypto_null.c @@ -93,34 +93,31 @@ struct cipher_algorithm cipher_null = { .auth = cipher_null_auth, }; -int pubkey_null_init ( void *ctx __unused, - const struct asn1_cursor *key __unused ) { +size_t pubkey_null_max_len ( const struct asn1_cursor *key __unused ) { return 0; } -size_t pubkey_null_max_len ( void *ctx __unused ) { - return 0; -} - -int pubkey_null_encrypt ( void *ctx __unused, const void *plaintext __unused, +int pubkey_null_encrypt ( const struct asn1_cursor *key __unused, + const void *plaintext __unused, size_t plaintext_len __unused, void *ciphertext __unused ) { return 0; } -int pubkey_null_decrypt ( void *ctx __unused, const void *ciphertext __unused, +int pubkey_null_decrypt ( const struct asn1_cursor *key __unused, + const void *ciphertext __unused, size_t ciphertext_len __unused, void *plaintext __unused ) { return 0; } -int pubkey_null_sign ( void *ctx __unused, +int pubkey_null_sign ( const struct asn1_cursor *key __unused, struct digest_algorithm *digest __unused, const void *value __unused, void *signature __unused ) { return 0; } -int pubkey_null_verify ( void *ctx __unused, +int pubkey_null_verify ( const struct asn1_cursor *key __unused, struct digest_algorithm *digest __unused, const void *value __unused, const void *signature __unused , @@ -128,18 +125,11 @@ int pubkey_null_verify ( void *ctx __unused, return 0; } -void pubkey_null_final ( void *ctx __unused ) { - /* Do nothing */ -} - struct pubkey_algorithm pubkey_null = { .name = "null", - .ctxsize = 0, - .init = pubkey_null_init, .max_len = pubkey_null_max_len, .encrypt = pubkey_null_encrypt, .decrypt = pubkey_null_decrypt, .sign = pubkey_null_sign, .verify = pubkey_null_verify, - .final = pubkey_null_final, }; diff --git a/src/crypto/ocsp.c b/src/crypto/ocsp.c index f35593454..e65f7180a 100644 --- a/src/crypto/ocsp.c +++ b/src/crypto/ocsp.c @@ -844,10 +844,9 @@ static int ocsp_check_signature ( struct ocsp_check *ocsp, struct ocsp_response *response = &ocsp->response; struct digest_algorithm *digest = response->algorithm->digest; struct pubkey_algorithm *pubkey = response->algorithm->pubkey; - struct x509_public_key *public_key = &signer->subject.public_key; + struct asn1_cursor *key = &signer->subject.public_key.raw; uint8_t digest_ctx[ digest->ctxsize ]; uint8_t digest_out[ digest->digestsize ]; - uint8_t pubkey_ctx[ pubkey->ctxsize ]; int rc; /* Generate digest */ @@ -856,30 +855,18 @@ static int ocsp_check_signature ( struct ocsp_check *ocsp, response->tbs.len ); digest_final ( digest, digest_ctx, digest_out ); - /* Initialise public-key algorithm */ - if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, - &public_key->raw ) ) != 0 ) { - DBGC ( ocsp, "OCSP %p \"%s\" could not initialise public key: " - "%s\n", ocsp, x509_name ( ocsp->cert ), strerror ( rc )); - goto err_init; - } - /* Verify digest */ - if ( ( rc = pubkey_verify ( pubkey, pubkey_ctx, digest, digest_out, + if ( ( rc = pubkey_verify ( pubkey, key, digest, digest_out, response->signature.data, response->signature.len ) ) != 0 ) { DBGC ( ocsp, "OCSP %p \"%s\" signature verification failed: " "%s\n", ocsp, x509_name ( ocsp->cert ), strerror ( rc )); - goto err_verify; + return rc; } DBGC2 ( ocsp, "OCSP %p \"%s\" signature is correct\n", ocsp, x509_name ( ocsp->cert ) ); - - err_verify: - pubkey_final ( pubkey, pubkey_ctx ); - err_init: - return rc; + return 0; } /** diff --git a/src/crypto/rsa.c b/src/crypto/rsa.c index 2d288a953..19472c121 100644 --- a/src/crypto/rsa.c +++ b/src/crypto/rsa.c @@ -47,6 +47,28 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #define EINFO_EACCES_VERIFY \ __einfo_uniqify ( EINFO_EACCES, 0x01, "RSA signature incorrect" ) +/** An RSA context */ +struct rsa_context { + /** Allocated memory */ + void *dynamic; + /** Modulus */ + bigint_element_t *modulus0; + /** Modulus size */ + unsigned int size; + /** Modulus length */ + size_t max_len; + /** Exponent */ + bigint_element_t *exponent0; + /** Exponent size */ + unsigned int exponent_size; + /** Input buffer */ + bigint_element_t *input0; + /** Output buffer */ + bigint_element_t *output0; + /** Temporary working space for modular exponentiation */ + void *tmp; +}; + /** * Identify RSA prefix * @@ -69,10 +91,9 @@ rsa_find_prefix ( struct digest_algorithm *digest ) { * * @v context RSA context */ -static void rsa_free ( struct rsa_context *context ) { +static inline void rsa_free ( struct rsa_context *context ) { free ( context->dynamic ); - context->dynamic = NULL; } /** @@ -98,9 +119,6 @@ static int rsa_alloc ( struct rsa_context *context, size_t modulus_len, uint8_t tmp[tmp_len]; } __attribute__ (( packed )) *dynamic; - /* Free any existing dynamic storage */ - rsa_free ( context ); - /* Allocate dynamic storage */ dynamic = malloc ( sizeof ( *dynamic ) ); if ( ! dynamic ) @@ -231,12 +249,12 @@ static int rsa_parse_mod_exp ( struct asn1_cursor *modulus, /** * Initialise RSA cipher * - * @v ctx RSA context + * @v context RSA context * @v key Key * @ret rc Return status code */ -static int rsa_init ( void *ctx, const struct asn1_cursor *key ) { - struct rsa_context *context = ctx; +static int rsa_init ( struct rsa_context *context, + const struct asn1_cursor *key ) { struct asn1_cursor modulus; struct asn1_cursor exponent; int rc; @@ -277,13 +295,22 @@ static int rsa_init ( void *ctx, const struct asn1_cursor *key ) { /** * Calculate RSA maximum output length * - * @v ctx RSA context + * @v key Key * @ret max_len Maximum output length */ -static size_t rsa_max_len ( void *ctx ) { - struct rsa_context *context = ctx; +static size_t rsa_max_len ( const struct asn1_cursor *key ) { + struct asn1_cursor modulus; + struct asn1_cursor exponent; + int rc; - return context->max_len; + /* Parse moduli and exponents */ + if ( ( rc = rsa_parse_mod_exp ( &modulus, &exponent, key ) ) != 0 ) { + /* Return a zero maximum length on error */ + return 0; + } + + /* Output length can never exceed modulus length */ + return modulus.len; } /** @@ -314,111 +341,147 @@ static void rsa_cipher ( struct rsa_context *context, /** * Encrypt using RSA * - * @v ctx RSA context + * @v key Key * @v plaintext Plaintext * @v plaintext_len Length of plaintext * @v ciphertext Ciphertext * @ret ciphertext_len Length of ciphertext, or negative error */ -static int rsa_encrypt ( void *ctx, const void *plaintext, +static int rsa_encrypt ( const struct asn1_cursor *key, const void *plaintext, size_t plaintext_len, void *ciphertext ) { - struct rsa_context *context = ctx; + struct rsa_context context; void *temp; uint8_t *encoded; - size_t max_len = ( context->max_len - 11 ); - size_t random_nz_len = ( max_len - plaintext_len + 8 ); + size_t max_len; + size_t random_nz_len; int rc; + DBGC ( &context, "RSA %p encrypting:\n", &context ); + DBGC_HDA ( &context, 0, plaintext, plaintext_len ); + + /* Initialise context */ + if ( ( rc = rsa_init ( &context, key ) ) != 0 ) + goto err_init; + + /* Calculate lengths */ + max_len = ( context.max_len - 11 ); + random_nz_len = ( max_len - plaintext_len + 8 ); + /* Sanity check */ if ( plaintext_len > max_len ) { - DBGC ( context, "RSA %p plaintext too long (%zd bytes, max " - "%zd)\n", context, plaintext_len, max_len ); - return -ERANGE; + DBGC ( &context, "RSA %p plaintext too long (%zd bytes, max " + "%zd)\n", &context, plaintext_len, max_len ); + rc = -ERANGE; + goto err_sanity; } - DBGC ( context, "RSA %p encrypting:\n", context ); - DBGC_HDA ( context, 0, plaintext, plaintext_len ); /* Construct encoded message (using the big integer output * buffer as temporary storage) */ - temp = context->output0; + temp = context.output0; encoded = temp; encoded[0] = 0x00; encoded[1] = 0x02; if ( ( rc = get_random_nz ( &encoded[2], random_nz_len ) ) != 0 ) { - DBGC ( context, "RSA %p could not generate random data: %s\n", - context, strerror ( rc ) ); - return rc; + DBGC ( &context, "RSA %p could not generate random data: %s\n", + &context, strerror ( rc ) ); + goto err_random; } encoded[ 2 + random_nz_len ] = 0x00; - memcpy ( &encoded[ context->max_len - plaintext_len ], + memcpy ( &encoded[ context.max_len - plaintext_len ], plaintext, plaintext_len ); /* Encipher the encoded message */ - rsa_cipher ( context, encoded, ciphertext ); - DBGC ( context, "RSA %p encrypted:\n", context ); - DBGC_HDA ( context, 0, ciphertext, context->max_len ); + rsa_cipher ( &context, encoded, ciphertext ); + DBGC ( &context, "RSA %p encrypted:\n", &context ); + DBGC_HDA ( &context, 0, ciphertext, context.max_len ); + + /* Free context */ + rsa_free ( &context ); - return context->max_len; + return context.max_len; + + err_random: + err_sanity: + rsa_free ( &context ); + err_init: + return rc; } /** * Decrypt using RSA * - * @v ctx RSA context + * @v key Key * @v ciphertext Ciphertext * @v ciphertext_len Ciphertext length * @v plaintext Plaintext * @ret plaintext_len Plaintext length, or negative error */ -static int rsa_decrypt ( void *ctx, const void *ciphertext, +static int rsa_decrypt ( const struct asn1_cursor *key, const void *ciphertext, size_t ciphertext_len, void *plaintext ) { - struct rsa_context *context = ctx; + struct rsa_context context; void *temp; uint8_t *encoded; uint8_t *end; uint8_t *zero; uint8_t *start; size_t plaintext_len; + int rc; + + DBGC ( &context, "RSA %p decrypting:\n", &context ); + DBGC_HDA ( &context, 0, ciphertext, ciphertext_len ); + + /* Initialise context */ + if ( ( rc = rsa_init ( &context, key ) ) != 0 ) + goto err_init; /* Sanity check */ - if ( ciphertext_len != context->max_len ) { - DBGC ( context, "RSA %p ciphertext incorrect length (%zd " + if ( ciphertext_len != context.max_len ) { + DBGC ( &context, "RSA %p ciphertext incorrect length (%zd " "bytes, should be %zd)\n", - context, ciphertext_len, context->max_len ); - return -ERANGE; + &context, ciphertext_len, context.max_len ); + rc = -ERANGE; + goto err_sanity; } - DBGC ( context, "RSA %p decrypting:\n", context ); - DBGC_HDA ( context, 0, ciphertext, ciphertext_len ); /* Decipher the message (using the big integer input buffer as * temporary storage) */ - temp = context->input0; + temp = context.input0; encoded = temp; - rsa_cipher ( context, ciphertext, encoded ); + rsa_cipher ( &context, ciphertext, encoded ); /* Parse the message */ - end = ( encoded + context->max_len ); - if ( ( encoded[0] != 0x00 ) || ( encoded[1] != 0x02 ) ) - goto invalid; + end = ( encoded + context.max_len ); + if ( ( encoded[0] != 0x00 ) || ( encoded[1] != 0x02 ) ) { + rc = -EINVAL; + goto err_invalid; + } zero = memchr ( &encoded[2], 0, ( end - &encoded[2] ) ); - if ( ! zero ) - goto invalid; + if ( ! zero ) { + rc = -EINVAL; + goto err_invalid; + } start = ( zero + 1 ); plaintext_len = ( end - start ); /* Copy out message */ memcpy ( plaintext, start, plaintext_len ); - DBGC ( context, "RSA %p decrypted:\n", context ); - DBGC_HDA ( context, 0, plaintext, plaintext_len ); + DBGC ( &context, "RSA %p decrypted:\n", &context ); + DBGC_HDA ( &context, 0, plaintext, plaintext_len ); + + /* Free context */ + rsa_free ( &context ); return plaintext_len; - invalid: - DBGC ( context, "RSA %p invalid decrypted message:\n", context ); - DBGC_HDA ( context, 0, encoded, context->max_len ); - return -EINVAL; + err_invalid: + DBGC ( &context, "RSA %p invalid decrypted message:\n", &context ); + DBGC_HDA ( &context, 0, encoded, context.max_len ); + err_sanity: + rsa_free ( &context ); + err_init: + return rc; } /** @@ -452,9 +515,9 @@ static int rsa_encode_digest ( struct rsa_context *context, /* Sanity check */ max_len = ( context->max_len - 11 ); if ( digestinfo_len > max_len ) { - DBGC ( context, "RSA %p %s digestInfo too long (%zd bytes, max" - "%zd)\n", - context, digest->name, digestinfo_len, max_len ); + DBGC ( context, "RSA %p %s digestInfo too long (%zd bytes, " + "max %zd)\n", context, digest->name, digestinfo_len, + max_len ); return -ERANGE; } DBGC ( context, "RSA %p encoding %s digest:\n", @@ -482,104 +545,125 @@ static int rsa_encode_digest ( struct rsa_context *context, /** * Sign digest value using RSA * - * @v ctx RSA context + * @v key Key * @v digest Digest algorithm * @v value Digest value * @v signature Signature * @ret signature_len Signature length, or negative error */ -static int rsa_sign ( void *ctx, struct digest_algorithm *digest, - const void *value, void *signature ) { - struct rsa_context *context = ctx; +static int rsa_sign ( const struct asn1_cursor *key, + struct digest_algorithm *digest, const void *value, + void *signature ) { + struct rsa_context context; void *temp; int rc; - DBGC ( context, "RSA %p signing %s digest:\n", context, digest->name ); - DBGC_HDA ( context, 0, value, digest->digestsize ); + DBGC ( &context, "RSA %p signing %s digest:\n", + &context, digest->name ); + DBGC_HDA ( &context, 0, value, digest->digestsize ); + + /* Initialise context */ + if ( ( rc = rsa_init ( &context, key ) ) != 0 ) + goto err_init; /* Encode digest (using the big integer output buffer as * temporary storage) */ - temp = context->output0; - if ( ( rc = rsa_encode_digest ( context, digest, value, temp ) ) != 0 ) - return rc; + temp = context.output0; + if ( ( rc = rsa_encode_digest ( &context, digest, value, temp ) ) != 0 ) + goto err_encode; /* Encipher the encoded digest */ - rsa_cipher ( context, temp, signature ); - DBGC ( context, "RSA %p signed %s digest:\n", context, digest->name ); - DBGC_HDA ( context, 0, signature, context->max_len ); + rsa_cipher ( &context, temp, signature ); + DBGC ( &context, "RSA %p signed %s digest:\n", &context, digest->name ); + DBGC_HDA ( &context, 0, signature, context.max_len ); + + /* Free context */ + rsa_free ( &context ); - return context->max_len; + return context.max_len; + + err_encode: + rsa_free ( &context ); + err_init: + return rc; } /** * Verify signed digest value using RSA * - * @v ctx RSA context + * @v key Key * @v digest Digest algorithm * @v value Digest value * @v signature Signature * @v signature_len Signature length * @ret rc Return status code */ -static int rsa_verify ( void *ctx, struct digest_algorithm *digest, - const void *value, const void *signature, - size_t signature_len ) { - struct rsa_context *context = ctx; +static int rsa_verify ( const struct asn1_cursor *key, + struct digest_algorithm *digest, const void *value, + const void *signature, size_t signature_len ) { + struct rsa_context context; void *temp; void *expected; void *actual; int rc; + DBGC ( &context, "RSA %p verifying %s digest:\n", + &context, digest->name ); + DBGC_HDA ( &context, 0, value, digest->digestsize ); + DBGC_HDA ( &context, 0, signature, signature_len ); + + /* Initialise context */ + if ( ( rc = rsa_init ( &context, key ) ) != 0 ) + goto err_init; + /* Sanity check */ - if ( signature_len != context->max_len ) { - DBGC ( context, "RSA %p signature incorrect length (%zd " + if ( signature_len != context.max_len ) { + DBGC ( &context, "RSA %p signature incorrect length (%zd " "bytes, should be %zd)\n", - context, signature_len, context->max_len ); - return -ERANGE; + &context, signature_len, context.max_len ); + rc = -ERANGE; + goto err_sanity; } - DBGC ( context, "RSA %p verifying %s digest:\n", - context, digest->name ); - DBGC_HDA ( context, 0, value, digest->digestsize ); - DBGC_HDA ( context, 0, signature, signature_len ); /* Decipher the signature (using the big integer input buffer * as temporary storage) */ - temp = context->input0; + temp = context.input0; expected = temp; - rsa_cipher ( context, signature, expected ); - DBGC ( context, "RSA %p deciphered signature:\n", context ); - DBGC_HDA ( context, 0, expected, context->max_len ); + rsa_cipher ( &context, signature, expected ); + DBGC ( &context, "RSA %p deciphered signature:\n", &context ); + DBGC_HDA ( &context, 0, expected, context.max_len ); /* Encode digest (using the big integer output buffer as * temporary storage) */ - temp = context->output0; + temp = context.output0; actual = temp; - if ( ( rc = rsa_encode_digest ( context, digest, value, actual ) ) !=0 ) - return rc; + if ( ( rc = rsa_encode_digest ( &context, digest, value, + actual ) ) != 0 ) + goto err_encode; /* Verify the signature */ - if ( memcmp ( actual, expected, context->max_len ) != 0 ) { - DBGC ( context, "RSA %p signature verification failed\n", - context ); - return -EACCES_VERIFY; + if ( memcmp ( actual, expected, context.max_len ) != 0 ) { + DBGC ( &context, "RSA %p signature verification failed\n", + &context ); + rc = -EACCES_VERIFY; + goto err_verify; } - DBGC ( context, "RSA %p signature verified successfully\n", context ); - return 0; -} + /* Free context */ + rsa_free ( &context ); -/** - * Finalise RSA cipher - * - * @v ctx RSA context - */ -static void rsa_final ( void *ctx ) { - struct rsa_context *context = ctx; + DBGC ( &context, "RSA %p signature verified successfully\n", &context ); + return 0; - rsa_free ( context ); + err_verify: + err_encode: + err_sanity: + rsa_free ( &context ); + err_init: + return rc; } /** @@ -615,14 +699,11 @@ static int rsa_match ( const struct asn1_cursor *private_key, /** RSA public-key algorithm */ struct pubkey_algorithm rsa_algorithm = { .name = "rsa", - .ctxsize = RSA_CTX_SIZE, - .init = rsa_init, .max_len = rsa_max_len, .encrypt = rsa_encrypt, .decrypt = rsa_decrypt, .sign = rsa_sign, .verify = rsa_verify, - .final = rsa_final, .match = rsa_match, }; diff --git a/src/crypto/x509.c b/src/crypto/x509.c index c0762740e..4101c8094 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1125,7 +1125,6 @@ static int x509_check_signature ( struct x509_certificate *cert, struct pubkey_algorithm *pubkey = algorithm->pubkey; uint8_t digest_ctx[ digest->ctxsize ]; uint8_t digest_out[ digest->digestsize ]; - uint8_t pubkey_ctx[ pubkey->ctxsize ]; int rc; /* Sanity check */ @@ -1149,14 +1148,8 @@ static int x509_check_signature ( struct x509_certificate *cert, } /* Verify signature using signer's public key */ - if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, - &public_key->raw ) ) != 0 ) { - DBGC ( cert, "X509 %p \"%s\" cannot initialise public key: " - "%s\n", cert, x509_name ( cert ), strerror ( rc ) ); - goto err_pubkey_init; - } - if ( ( rc = pubkey_verify ( pubkey, pubkey_ctx, digest, digest_out, - signature->value.data, + if ( ( rc = pubkey_verify ( pubkey, &public_key->raw, digest, + digest_out, signature->value.data, signature->value.len ) ) != 0 ) { DBGC ( cert, "X509 %p \"%s\" signature verification failed: " "%s\n", cert, x509_name ( cert ), strerror ( rc ) ); @@ -1167,8 +1160,6 @@ static int x509_check_signature ( struct x509_certificate *cert, rc = 0; err_pubkey_verify: - pubkey_final ( pubkey, pubkey_ctx ); - err_pubkey_init: err_mismatch: return rc; } diff --git a/src/drivers/net/iphone.c b/src/drivers/net/iphone.c index 96eb0952b..08459a6e2 100644 --- a/src/drivers/net/iphone.c +++ b/src/drivers/net/iphone.c @@ -362,17 +362,9 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, struct asn1_builder raw = { NULL, 0 }; uint8_t digest_ctx[SHA256_CTX_SIZE]; uint8_t digest_out[SHA256_DIGEST_SIZE]; - uint8_t pubkey_ctx[RSA_CTX_SIZE]; int len; int rc; - /* Initialise "private" key */ - if ( ( rc = pubkey_init ( pubkey, pubkey_ctx, private ) ) != 0 ) { - DBGC ( icert, "ICERT %p could not initialise private key: " - "%s\n", icert, strerror ( rc ) ); - goto err_pubkey_init; - } - /* Construct subjectPublicKeyInfo */ if ( ( rc = ( asn1_prepend_raw ( &spki, public->data, public->len ), asn1_prepend_raw ( &spki, icert_nul, @@ -406,14 +398,14 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, digest_update ( digest, digest_ctx, tbs.data, tbs.len ); digest_final ( digest, digest_ctx, digest_out ); - /* Construct signature */ - if ( ( rc = asn1_grow ( &raw, pubkey_max_len ( pubkey, - pubkey_ctx ) ) ) != 0 ) { + /* Construct signature using "private" key */ + if ( ( rc = asn1_grow ( &raw, + pubkey_max_len ( pubkey, private ) ) ) != 0 ) { DBGC ( icert, "ICERT %p could not build signature: %s\n", icert, strerror ( rc ) ); goto err_grow; } - if ( ( len = pubkey_sign ( pubkey, pubkey_ctx, digest, digest_out, + if ( ( len = pubkey_sign ( pubkey, private, digest, digest_out, raw.data ) ) < 0 ) { rc = len; DBGC ( icert, "ICERT %p could not sign: %s\n", @@ -452,8 +444,6 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, err_tbs: free ( spki.data ); err_spki: - pubkey_final ( pubkey, pubkey_ctx ); - err_pubkey_init: return rc; } diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index 8b6eb94f6..dcc73f3ef 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -121,68 +121,55 @@ struct cipher_algorithm { struct pubkey_algorithm { /** Algorithm name */ const char *name; - /** Context size */ - size_t ctxsize; - /** Initialise algorithm - * - * @v ctx Context - * @v key Key - * @ret rc Return status code - */ - int ( * init ) ( void *ctx, const struct asn1_cursor *key ); /** Calculate maximum output length * - * @v ctx Context + * @v key Key * @ret max_len Maximum output length */ - size_t ( * max_len ) ( void *ctx ); + size_t ( * max_len ) ( const struct asn1_cursor *key ); /** Encrypt * - * @v ctx Context + * @v key Key * @v plaintext Plaintext * @v plaintext_len Length of plaintext * @v ciphertext Ciphertext * @ret ciphertext_len Length of ciphertext, or negative error */ - int ( * encrypt ) ( void *ctx, const void *data, size_t len, - void *out ); + int ( * encrypt ) ( const struct asn1_cursor *key, const void *data, + size_t len, void *out ); /** Decrypt * - * @v ctx Context + * @v key Key * @v ciphertext Ciphertext * @v ciphertext_len Ciphertext length * @v plaintext Plaintext * @ret plaintext_len Plaintext length, or negative error */ - int ( * decrypt ) ( void *ctx, const void *data, size_t len, - void *out ); + int ( * decrypt ) ( const struct asn1_cursor *key, const void *data, + size_t len, void *out ); /** Sign digest value * - * @v ctx Context + * @v key Key * @v digest Digest algorithm * @v value Digest value * @v signature Signature * @ret signature_len Signature length, or negative error */ - int ( * sign ) ( void *ctx, struct digest_algorithm *digest, - const void *value, void *signature ); + int ( * sign ) ( const struct asn1_cursor *key, + struct digest_algorithm *digest, const void *value, + void *signature ); /** Verify signed digest value * - * @v ctx Context + * @v key Key * @v digest Digest algorithm * @v value Digest value * @v signature Signature * @v signature_len Signature length * @ret rc Return status code */ - int ( * verify ) ( void *ctx, struct digest_algorithm *digest, - const void *value, const void *signature, - size_t signature_len ); - /** Finalise algorithm - * - * @v ctx Context - */ - void ( * final ) ( void *ctx ); + int ( * verify ) ( const struct asn1_cursor *key, + struct digest_algorithm *digest, const void *value, + const void *signature, size_t signature_len ); /** Check that public key matches private key * * @v private_key Private key @@ -278,46 +265,36 @@ is_auth_cipher ( struct cipher_algorithm *cipher ) { return cipher->authsize; } -static inline __attribute__ (( always_inline )) int -pubkey_init ( struct pubkey_algorithm *pubkey, void *ctx, - const struct asn1_cursor *key ) { - return pubkey->init ( ctx, key ); -} - static inline __attribute__ (( always_inline )) size_t -pubkey_max_len ( struct pubkey_algorithm *pubkey, void *ctx ) { - return pubkey->max_len ( ctx ); +pubkey_max_len ( struct pubkey_algorithm *pubkey, + const struct asn1_cursor *key ) { + return pubkey->max_len ( key ); } static inline __attribute__ (( always_inline )) int -pubkey_encrypt ( struct pubkey_algorithm *pubkey, void *ctx, +pubkey_encrypt ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, const void *data, size_t len, void *out ) { - return pubkey->encrypt ( ctx, data, len, out ); + return pubkey->encrypt ( key, data, len, out ); } static inline __attribute__ (( always_inline )) int -pubkey_decrypt ( struct pubkey_algorithm *pubkey, void *ctx, +pubkey_decrypt ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, const void *data, size_t len, void *out ) { - return pubkey->decrypt ( ctx, data, len, out ); + return pubkey->decrypt ( key, data, len, out ); } static inline __attribute__ (( always_inline )) int -pubkey_sign ( struct pubkey_algorithm *pubkey, void *ctx, +pubkey_sign ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, void *signature ) { - return pubkey->sign ( ctx, digest, value, signature ); + return pubkey->sign ( key, digest, value, signature ); } static inline __attribute__ (( always_inline )) int -pubkey_verify ( struct pubkey_algorithm *pubkey, void *ctx, +pubkey_verify ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, const void *signature, size_t signature_len ) { - return pubkey->verify ( ctx, digest, value, signature, signature_len ); -} - -static inline __attribute__ (( always_inline )) void -pubkey_final ( struct pubkey_algorithm *pubkey, void *ctx ) { - pubkey->final ( ctx ); + return pubkey->verify ( key, digest, value, signature, signature_len ); } static inline __attribute__ (( always_inline )) int @@ -345,15 +322,18 @@ extern void cipher_null_decrypt ( void *ctx, const void *src, void *dst, size_t len ); extern void cipher_null_auth ( void *ctx, void *auth ); -extern int pubkey_null_init ( void *ctx, const struct asn1_cursor *key ); -extern size_t pubkey_null_max_len ( void *ctx ); -extern int pubkey_null_encrypt ( void *ctx, const void *plaintext, - size_t plaintext_len, void *ciphertext ); -extern int pubkey_null_decrypt ( void *ctx, const void *ciphertext, - size_t ciphertext_len, void *plaintext ); -extern int pubkey_null_sign ( void *ctx, struct digest_algorithm *digest, +extern size_t pubkey_null_max_len ( const struct asn1_cursor *key ); +extern int pubkey_null_encrypt ( const struct asn1_cursor *key, + const void *plaintext, size_t plaintext_len, + void *ciphertext ); +extern int pubkey_null_decrypt ( const struct asn1_cursor *key, + const void *ciphertext, size_t ciphertext_len, + void *plaintext ); +extern int pubkey_null_sign ( const struct asn1_cursor *key, + struct digest_algorithm *digest, const void *value, void *signature ); -extern int pubkey_null_verify ( void *ctx, struct digest_algorithm *digest, +extern int pubkey_null_verify ( const struct asn1_cursor *key, + struct digest_algorithm *digest, const void *value, const void *signature , size_t signature_len ); diff --git a/src/include/ipxe/rsa.h b/src/include/ipxe/rsa.h index a1b5e0c03..e36a75edf 100644 --- a/src/include/ipxe/rsa.h +++ b/src/include/ipxe/rsa.h @@ -55,31 +55,6 @@ struct rsa_digestinfo_prefix { /** Declare an RSA digestInfo prefix */ #define __rsa_digestinfo_prefix __table_entry ( RSA_DIGESTINFO_PREFIXES, 01 ) -/** An RSA context */ -struct rsa_context { - /** Allocated memory */ - void *dynamic; - /** Modulus */ - bigint_element_t *modulus0; - /** Modulus size */ - unsigned int size; - /** Modulus length */ - size_t max_len; - /** Exponent */ - bigint_element_t *exponent0; - /** Exponent size */ - unsigned int exponent_size; - /** Input buffer */ - bigint_element_t *input0; - /** Output buffer */ - bigint_element_t *output0; - /** Temporary working space for modular exponentiation */ - void *tmp; -}; - -/** RSA context size */ -#define RSA_CTX_SIZE sizeof ( struct rsa_context ) - extern struct pubkey_algorithm rsa_algorithm; #endif /* _IPXE_RSA_H */ diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 9494eaa05..08d58689e 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -240,8 +240,6 @@ struct tls_cipherspec { struct tls_cipher_suite *suite; /** Dynamically-allocated storage */ void *dynamic; - /** Public key encryption context */ - void *pubkey_ctx; /** Bulk encryption cipher context */ void *cipher_ctx; /** MAC secret */ @@ -402,6 +400,8 @@ struct tls_server { struct x509_root *root; /** Certificate chain */ struct x509_chain *chain; + /** Public key (within server certificate) */ + struct asn1_cursor key; /** Certificate validator */ struct interface validator; /** Certificate validation pending operation */ diff --git a/src/net/tls.c b/src/net/tls.c index ec503e43d..ded100d0e 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -856,10 +856,6 @@ tls_find_cipher_suite ( unsigned int cipher_suite ) { static void tls_clear_cipher ( struct tls_connection *tls __unused, struct tls_cipherspec *cipherspec ) { - if ( cipherspec->suite ) { - pubkey_final ( cipherspec->suite->pubkey, - cipherspec->pubkey_ctx ); - } free ( cipherspec->dynamic ); memset ( cipherspec, 0, sizeof ( *cipherspec ) ); cipherspec->suite = &tls_cipher_suite_null; @@ -876,7 +872,6 @@ static void tls_clear_cipher ( struct tls_connection *tls __unused, static int tls_set_cipher ( struct tls_connection *tls, struct tls_cipherspec *cipherspec, struct tls_cipher_suite *suite ) { - struct pubkey_algorithm *pubkey = suite->pubkey; struct cipher_algorithm *cipher = suite->cipher; size_t total; void *dynamic; @@ -885,8 +880,7 @@ static int tls_set_cipher ( struct tls_connection *tls, tls_clear_cipher ( tls, cipherspec ); /* Allocate dynamic storage */ - total = ( pubkey->ctxsize + cipher->ctxsize + suite->mac_len + - suite->fixed_iv_len ); + total = ( cipher->ctxsize + suite->mac_len + suite->fixed_iv_len ); dynamic = zalloc ( total ); if ( ! dynamic ) { DBGC ( tls, "TLS %p could not allocate %zd bytes for crypto " @@ -896,7 +890,6 @@ static int tls_set_cipher ( struct tls_connection *tls, /* Assign storage */ cipherspec->dynamic = dynamic; - cipherspec->pubkey_ctx = dynamic; dynamic += pubkey->ctxsize; cipherspec->cipher_ctx = dynamic; dynamic += cipher->ctxsize; cipherspec->mac_secret = dynamic; dynamic += suite->mac_len; cipherspec->fixed_iv = dynamic; dynamic += suite->fixed_iv_len; @@ -1392,7 +1385,7 @@ static int tls_send_certificate ( struct tls_connection *tls ) { static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) { struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey; - size_t max_len = pubkey_max_len ( pubkey, cipherspec->pubkey_ctx ); + size_t max_len = pubkey_max_len ( pubkey, &tls->server.key ); struct { uint16_t version; uint8_t random[46]; @@ -1419,8 +1412,8 @@ static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) { /* Encrypt pre-master secret using server's public key */ memset ( &key_xchg, 0, sizeof ( key_xchg ) ); - len = pubkey_encrypt ( pubkey, cipherspec->pubkey_ctx, - &pre_master_secret, sizeof ( pre_master_secret ), + len = pubkey_encrypt ( pubkey, &tls->server.key, &pre_master_secret, + sizeof ( pre_master_secret ), key_xchg.encrypted_pre_master_secret ); if ( len < 0 ) { rc = len; @@ -1523,7 +1516,7 @@ static int tls_verify_dh_params ( struct tls_connection *tls, digest_final ( digest, ctx, hash ); /* Verify signature */ - if ( ( rc = pubkey_verify ( pubkey, cipherspec->pubkey_ctx, + if ( ( rc = pubkey_verify ( pubkey, &tls->server.key, digest, hash, signature, signature_len ) ) != 0 ) { DBGC ( tls, "TLS %p ServerKeyExchange failed " @@ -1820,20 +1813,12 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { struct pubkey_algorithm *pubkey = cert->signature_algorithm->pubkey; struct asn1_cursor *key = privkey_cursor ( tls->client.key ); uint8_t digest_out[ digest->digestsize ]; - uint8_t ctx[ pubkey->ctxsize ]; struct tls_signature_hash_algorithm *sig_hash = NULL; int rc; /* Generate digest to be signed */ tls_verify_handshake ( tls, digest_out ); - /* Initialise public-key algorithm */ - if ( ( rc = pubkey_init ( pubkey, ctx, key ) ) != 0 ) { - DBGC ( tls, "TLS %p could not initialise %s client private " - "key: %s\n", tls, pubkey->name, strerror ( rc ) ); - goto err_pubkey_init; - } - /* TLSv1.2 and later use explicit algorithm identifiers */ if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) { sig_hash = tls_signature_hash_algorithm ( pubkey, digest ); @@ -1848,7 +1833,7 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { /* Generate and transmit record */ { - size_t max_len = pubkey_max_len ( pubkey, ctx ); + size_t max_len = pubkey_max_len ( pubkey, key ); int use_sig_hash = ( ( sig_hash == NULL ) ? 0 : 1 ); struct { uint32_t type_length; @@ -1860,7 +1845,7 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { int len; /* Sign digest */ - len = pubkey_sign ( pubkey, ctx, digest, digest_out, + len = pubkey_sign ( pubkey, key, digest, digest_out, certificate_verify.signature ); if ( len < 0 ) { rc = len; @@ -1893,8 +1878,6 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { err_pubkey_sign: err_sig_hash: - pubkey_final ( pubkey, ctx ); - err_pubkey_init: return rc; } @@ -2312,6 +2295,7 @@ static int tls_parse_chain ( struct tls_connection *tls, int rc; /* Free any existing certificate chain */ + memset ( &tls->server.key, 0, sizeof ( tls->server.key ) ); x509_chain_put ( tls->server.chain ); tls->server.chain = NULL; @@ -2371,6 +2355,7 @@ static int tls_parse_chain ( struct tls_connection *tls, err_parse: err_overlength: err_underlength: + memset ( &tls->server.key, 0, sizeof ( tls->server.key ) ); x509_chain_put ( tls->server.chain ); tls->server.chain = NULL; err_alloc_chain: @@ -3555,8 +3540,6 @@ static struct interface_descriptor tls_cipherstream_desc = */ static void tls_validator_done ( struct tls_connection *tls, int rc ) { struct tls_session *session = tls->session; - struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; - struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey; struct x509_certificate *cert; /* Mark validation as complete */ @@ -3584,13 +3567,9 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { goto err; } - /* Initialise public key algorithm */ - if ( ( rc = pubkey_init ( pubkey, cipherspec->pubkey_ctx, - &cert->subject.public_key.raw ) ) != 0 ) { - DBGC ( tls, "TLS %p cannot initialise public key: %s\n", - tls, strerror ( rc ) ); - goto err; - } + /* Extract the now trusted server public key */ + memcpy ( &tls->server.key, &cert->subject.public_key.raw, + sizeof ( tls->server.key ) ); /* Schedule Client Key Exchange, Change Cipher, and Finished */ tls->tx.pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE | diff --git a/src/tests/pubkey_test.c b/src/tests/pubkey_test.c index 93962516a..ff318bfb7 100644 --- a/src/tests/pubkey_test.c +++ b/src/tests/pubkey_test.c @@ -50,77 +50,41 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); void pubkey_okx ( struct pubkey_test *test, const char *file, unsigned int line ) { struct pubkey_algorithm *pubkey = test->pubkey; - uint8_t private_ctx[pubkey->ctxsize]; - uint8_t public_ctx[pubkey->ctxsize]; - size_t max_len; - - /* Initialize contexts */ - okx ( pubkey_init ( pubkey, private_ctx, &test->private ) == 0, - file, line ); - okx ( pubkey_init ( pubkey, public_ctx, &test->public ) == 0, - file, line ); - max_len = pubkey_max_len ( pubkey, private_ctx ); + size_t max_len = pubkey_max_len ( pubkey, &test->private ); + uint8_t encrypted[max_len]; + uint8_t decrypted[max_len]; + int encrypted_len; + int decrypted_len; /* Test decrypting with private key to obtain known plaintext */ - { - uint8_t decrypted[max_len]; - int decrypted_len; - - decrypted_len = pubkey_decrypt ( pubkey, private_ctx, - test->ciphertext, - test->ciphertext_len, - decrypted ); - okx ( decrypted_len == ( ( int ) test->plaintext_len ), - file, line ); - okx ( memcmp ( decrypted, test->plaintext, - test->plaintext_len ) == 0, file, line ); - } + decrypted_len = pubkey_decrypt ( pubkey, &test->private, + test->ciphertext, test->ciphertext_len, + decrypted ); + okx ( decrypted_len == ( ( int ) test->plaintext_len ), file, line ); + okx ( memcmp ( decrypted, test->plaintext, test->plaintext_len ) == 0, + file, line ); /* Test encrypting with private key and decrypting with public key */ - { - uint8_t encrypted[max_len]; - uint8_t decrypted[max_len]; - int encrypted_len; - int decrypted_len; - - encrypted_len = pubkey_encrypt ( pubkey, private_ctx, - test->plaintext, - test->plaintext_len, - encrypted ); - okx ( encrypted_len >= 0, file, line ); - decrypted_len = pubkey_decrypt ( pubkey, public_ctx, - encrypted, encrypted_len, - decrypted ); - okx ( decrypted_len == ( ( int ) test->plaintext_len ), - file, line ); - okx ( memcmp ( decrypted, test->plaintext, - test->plaintext_len ) == 0, file, line ); - } + encrypted_len = pubkey_encrypt ( pubkey, &test->private, + test->plaintext, test->plaintext_len, + encrypted ); + okx ( encrypted_len >= 0, file, line ); + decrypted_len = pubkey_decrypt ( pubkey, &test->public, encrypted, + encrypted_len, decrypted ); + okx ( decrypted_len == ( ( int ) test->plaintext_len ), file, line ); + okx ( memcmp ( decrypted, test->plaintext, test->plaintext_len ) == 0, + file, line ); /* Test encrypting with public key and decrypting with private key */ - { - uint8_t encrypted[max_len]; - uint8_t decrypted[max_len]; - int encrypted_len; - int decrypted_len; - - encrypted_len = pubkey_encrypt ( pubkey, public_ctx, - test->plaintext, - test->plaintext_len, - encrypted ); - okx ( encrypted_len >= 0, file, line ); - decrypted_len = pubkey_decrypt ( pubkey, private_ctx, - encrypted, encrypted_len, - decrypted ); - okx ( decrypted_len == ( ( int ) test->plaintext_len ), - file, line ); - okx ( memcmp ( decrypted, test->plaintext, - test->plaintext_len ) == 0, file, line ); - } - - /* Free contexts */ - pubkey_final ( pubkey, public_ctx ); - pubkey_final ( pubkey, private_ctx ); + encrypted_len = pubkey_encrypt ( pubkey, &test->public, + test->plaintext, test->plaintext_len, + encrypted ); + okx ( encrypted_len >= 0, file, line ); + decrypted_len = pubkey_decrypt ( pubkey, &test->private, encrypted, + encrypted_len, decrypted ); + okx ( decrypted_len == ( ( int ) test->plaintext_len ), file, line ); + okx ( memcmp ( decrypted, test->plaintext, test->plaintext_len ) == 0, + file, line ); } /** @@ -134,18 +98,12 @@ void pubkey_sign_okx ( struct pubkey_sign_test *test, const char *file, unsigned int line ) { struct pubkey_algorithm *pubkey = test->pubkey; struct digest_algorithm *digest = test->digest; - uint8_t private_ctx[pubkey->ctxsize]; - uint8_t public_ctx[pubkey->ctxsize]; + size_t max_len = pubkey_max_len ( pubkey, &test->private ); + uint8_t bad[test->signature_len]; uint8_t digestctx[digest->ctxsize ]; uint8_t digestout[digest->digestsize]; - size_t max_len; - - /* Initialize contexts */ - okx ( pubkey_init ( pubkey, private_ctx, &test->private ) == 0, - file, line ); - okx ( pubkey_init ( pubkey, public_ctx, &test->public ) == 0, - file, line ); - max_len = pubkey_max_len ( pubkey, private_ctx ); + uint8_t signature[max_len]; + int signature_len; /* Construct digest over plaintext */ digest_init ( digest, digestctx ); @@ -154,34 +112,20 @@ void pubkey_sign_okx ( struct pubkey_sign_test *test, const char *file, digest_final ( digest, digestctx, digestout ); /* Test signing using private key */ - { - uint8_t signature[max_len]; - int signature_len; - - signature_len = pubkey_sign ( pubkey, private_ctx, digest, - digestout, signature ); - okx ( signature_len == ( ( int ) test->signature_len ), - file, line ); - okx ( memcmp ( signature, test->signature, - test->signature_len ) == 0, file, line ); - } + signature_len = pubkey_sign ( pubkey, &test->private, digest, + digestout, signature ); + okx ( signature_len == ( ( int ) test->signature_len ), file, line ); + okx ( memcmp ( signature, test->signature, test->signature_len ) == 0, + file, line ); /* Test verification using public key */ - okx ( pubkey_verify ( pubkey, public_ctx, digest, digestout, + okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, test->signature, test->signature_len ) == 0, file, line ); /* Test verification failure of modified signature */ - { - uint8_t bad[test->signature_len]; - - memcpy ( bad, test->signature, test->signature_len ); - bad[ test->signature_len / 2 ] ^= 0x40; - okx ( pubkey_verify ( pubkey, public_ctx, digest, digestout, - bad, sizeof ( bad ) ) != 0, file, line ); - } - - /* Free contexts */ - pubkey_final ( pubkey, public_ctx ); - pubkey_final ( pubkey, private_ctx ); + memcpy ( bad, test->signature, test->signature_len ); + bad[ test->signature_len / 2 ] ^= 0x40; + okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, + bad, sizeof ( bad ) ) != 0, file, line ); } -- cgit v1.2.3-55-g7522 From df7ec31766cd08eb1e01d59afc79198f5411517e Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 21 Jan 2025 15:13:20 +0000 Subject: [crypto] Generalise elliptic curve key exchange to ecdhe_key() Split out the portion of tls_send_client_key_exchange_ecdhe() that actually performs the elliptic curve key exchange into a separate function ecdhe_key(). Signed-off-by: Michael Brown --- src/crypto/ecdhe.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++ src/include/ipxe/ecdhe.h | 17 +++++++++++++ src/net/tls.c | 13 +++------- 3 files changed, 87 insertions(+), 9 deletions(-) create mode 100644 src/crypto/ecdhe.c create mode 100644 src/include/ipxe/ecdhe.h (limited to 'src/net') diff --git a/src/crypto/ecdhe.c b/src/crypto/ecdhe.c new file mode 100644 index 000000000..5481b02eb --- /dev/null +++ b/src/crypto/ecdhe.c @@ -0,0 +1,66 @@ +/* + * Copyright (C) 2025 Michael Brown . + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + * + * You can also choose to distribute this program under the terms of + * the Unmodified Binary Distribution Licence (as given in the file + * COPYING.UBDL), provided that you have satisfied its requirements. + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +/** @file + * + * Elliptic Curve Ephemeral Diffie-Hellman (ECDHE) key exchange + * + */ + +#include +#include + +/** + * Calculate ECDHE key + * + * @v curve Elliptic curve + * @v partner Partner public curve point + * @v private Private key + * @v public Public curve point to fill in (may overlap partner key) + * @v shared Shared secret curve point to fill in + * @ret rc Return status code + */ +int ecdhe_key ( struct elliptic_curve *curve, const void *partner, + const void *private, void *public, void *shared ) { + int rc; + + /* Construct shared key */ + if ( ( rc = elliptic_multiply ( curve, partner, private, + shared ) ) != 0 ) { + DBGC ( curve, "CURVE %s could not generate shared key: %s\n", + curve->name, strerror ( rc ) ); + return rc; + } + + /* Construct public key */ + if ( ( rc = elliptic_multiply ( curve, NULL, private, + public ) ) != 0 ) { + DBGC ( curve, "CURVE %s could not generate public key: %s\n", + curve->name, strerror ( rc ) ); + return rc; + } + + return 0; +} diff --git a/src/include/ipxe/ecdhe.h b/src/include/ipxe/ecdhe.h new file mode 100644 index 000000000..36fc0a1ee --- /dev/null +++ b/src/include/ipxe/ecdhe.h @@ -0,0 +1,17 @@ +#ifndef _IPXE_ECDHE_H +#define _IPXE_ECDHE_H + +/** @file + * + * Elliptic Curve Ephemeral Diffie-Hellman (ECDHE) key exchange + * + */ + +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); + +#include + +extern int ecdhe_key ( struct elliptic_curve *curve, const void *partner, + const void *private, void *public, void *shared ); + +#endif /* _IPXE_ECDHE_H */ diff --git a/src/net/tls.c b/src/net/tls.c index ded100d0e..286d2cc9f 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -50,6 +50,7 @@ FILE_LICENCE ( GPL2_OR_LATER ); #include #include #include +#include #include #include @@ -1733,9 +1734,9 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { } /* Calculate pre-master secret */ - if ( ( rc = elliptic_multiply ( curve->curve, - ecdh->public, private, - pre_master_secret ) ) != 0 ) { + if ( ( rc = ecdhe_key ( curve->curve, ecdh->public, + private, key_xchg.public, + pre_master_secret ) ) != 0 ) { DBGC ( tls, "TLS %p could not exchange ECDHE key: %s\n", tls, strerror ( rc ) ); return rc; @@ -1750,12 +1751,6 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { htonl ( sizeof ( key_xchg ) - sizeof ( key_xchg.type_length ) ) ); key_xchg.public_len = len; - if ( ( rc = elliptic_multiply ( curve->curve, NULL, private, - key_xchg.public ) ) != 0 ) { - DBGC ( tls, "TLS %p could not generate ECDHE key: %s\n", - tls, strerror ( rc ) ); - return rc; - } /* Transmit Client Key Exchange record */ if ( ( rc = tls_send_handshake ( tls, &key_xchg, -- cgit v1.2.3-55-g7522 From c9291bc5c7adfa9aa05e94aded90ba49d3dc8179 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 21 Jan 2025 15:29:05 +0000 Subject: [tls] Allow for NIST elliptic curve point formats The elliptic curve point representation for the x25519 curve includes only the X value, since the curve is designed such that the Montgomery ladder does not need to ever know or calculate a Y value. There is no curve point format byte: the public key data is simply the X value. The pre-master secret is also simply the X value of the shared secret curve point. The point representation for the NIST curves includes both X and Y values, and a single curve point format byte that must indicate that the format is uncompressed. The pre-master secret for the NIST curves does not include both X and Y values: only the X value is used. Extend the definition of an elliptic curve to allow the point size to be specified separately from the key size, and extend the definition of a TLS named curve to include an optional curve point format byte and a pre-master secret length. Signed-off-by: Michael Brown --- src/crypto/mishmash/oid_x25519.c | 1 + src/crypto/x25519.c | 1 + src/include/ipxe/crypto.h | 4 +++- src/include/ipxe/tls.h | 7 +++++++ src/net/tls.c | 38 ++++++++++++++++++++++++++++---------- 5 files changed, 40 insertions(+), 11 deletions(-) (limited to 'src/net') diff --git a/src/crypto/mishmash/oid_x25519.c b/src/crypto/mishmash/oid_x25519.c index 2f8aa065b..30b7905ea 100644 --- a/src/crypto/mishmash/oid_x25519.c +++ b/src/crypto/mishmash/oid_x25519.c @@ -42,4 +42,5 @@ struct asn1_algorithm x25519_algorithm __asn1_algorithm = { struct tls_named_curve tls_x25519_named_curve __tls_named_curve ( 01 ) = { .curve = &x25519_curve, .code = htons ( TLS_NAMED_CURVE_X25519 ), + .pre_master_secret_len = sizeof ( struct x25519_value ), }; diff --git a/src/crypto/x25519.c b/src/crypto/x25519.c index ab5d2e8b0..995cfa352 100644 --- a/src/crypto/x25519.c +++ b/src/crypto/x25519.c @@ -839,6 +839,7 @@ static int x25519_curve_multiply ( const void *base, const void *scalar, /** X25519 elliptic curve */ struct elliptic_curve x25519_curve = { .name = "x25519", + .pointsize = sizeof ( struct x25519_value ), .keysize = sizeof ( struct x25519_value ), .multiply = x25519_curve_multiply, }; diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index dcc73f3ef..4bd543ae2 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -184,7 +184,9 @@ struct pubkey_algorithm { struct elliptic_curve { /** Curve name */ const char *name; - /** Key size */ + /** Point (and public key) size */ + size_t pointsize; + /** Scalar (and private key) size */ size_t keysize; /** Multiply scalar by curve point * diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 08d58689e..bf9807230 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -218,12 +218,19 @@ struct tls_cipher_suite { /** TLS named curved type */ #define TLS_NAMED_CURVE_TYPE 3 +/** TLS uncompressed curve point format */ +#define TLS_POINT_FORMAT_UNCOMPRESSED 4 + /** A TLS named curve */ struct tls_named_curve { /** Elliptic curve */ struct elliptic_curve *curve; /** Numeric code (in network-endian order) */ uint16_t code; + /** Curve point format byte (if any) */ + uint8_t format; + /** Pre-master secret length */ + uint8_t pre_master_secret_len; }; /** TLS named curve table */ diff --git a/src/net/tls.c b/src/net/tls.c index 286d2cc9f..a94e71c8a 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1671,6 +1671,9 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { uint8_t public[0]; } __attribute__ (( packed )) *ecdh; size_t param_len; + size_t pointsize; + size_t keysize; + size_t offset; int rc; /* Parse ServerKeyExchange record */ @@ -1706,9 +1709,13 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { tls->server.exchange_len ); return -ENOTSUP_CURVE; } + DBGC ( tls, "TLS %p using named curve %s\n", tls, curve->curve->name ); + pointsize = curve->curve->pointsize; + keysize = curve->curve->keysize; + offset = ( curve->format ? 1 : 0 ); /* Check key length */ - if ( ecdh->public_len != curve->curve->keysize ) { + if ( ecdh->public_len != ( offset + pointsize ) ) { DBGC ( tls, "TLS %p invalid %s key\n", tls, curve->curve->name ); DBGC_HDA ( tls, 0, tls->server.exchange, @@ -1716,15 +1723,23 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { return -EINVAL_KEY_EXCHANGE; } + /* Check curve point format byte (if present) */ + if ( curve->format && ( ecdh->public[0] != curve->format ) ) { + DBGC ( tls, "TLS %p invalid %s curve point format\n", + tls, curve->curve->name ); + DBGC_HDA ( tls, 0, tls->server.exchange, + tls->server.exchange_len ); + return -EINVAL_KEY_EXCHANGE; + } + /* Construct pre-master secret and ClientKeyExchange record */ { - size_t len = curve->curve->keysize; - uint8_t private[len]; - uint8_t pre_master_secret[len]; + uint8_t private[keysize]; + uint8_t pre_master_secret[pointsize]; struct { uint32_t type_length; uint8_t public_len; - uint8_t public[len]; + uint8_t public[ecdh->public_len]; } __attribute__ (( packed )) key_xchg; /* Generate ephemeral private key */ @@ -1733,9 +1748,9 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { return rc; } - /* Calculate pre-master secret */ - if ( ( rc = ecdhe_key ( curve->curve, ecdh->public, - private, key_xchg.public, + /* Exchange keys */ + if ( ( rc = ecdhe_key ( curve->curve, ( ecdh->public + offset ), + private, ( key_xchg.public + offset ), pre_master_secret ) ) != 0 ) { DBGC ( tls, "TLS %p could not exchange ECDHE key: %s\n", tls, strerror ( rc ) ); @@ -1743,14 +1758,17 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { } /* Generate master secret */ - tls_generate_master_secret ( tls, pre_master_secret, len ); + tls_generate_master_secret ( tls, pre_master_secret, + curve->pre_master_secret_len ); /* Generate Client Key Exchange record */ key_xchg.type_length = ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) | htonl ( sizeof ( key_xchg ) - sizeof ( key_xchg.type_length ) ) ); - key_xchg.public_len = len; + key_xchg.public_len = sizeof ( key_xchg.public ); + if ( curve->format ) + key_xchg.public[0] = curve->format; /* Transmit Client Key Exchange record */ if ( ( rc = tls_send_handshake ( tls, &key_xchg, -- cgit v1.2.3-55-g7522 From d92551a320f32fa5d8fc8b2d2f02b174aa6fab66 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 30 Mar 2025 21:47:34 +0100 Subject: [xfer] Use xfer_alloc_iob() for transmit I/O buffers on stream sockets Datagram sockets such as UDP, ICMP, and fibre channel tend to provide a custom xfer_alloc_iob() handler to ensure that transmit I/O buffers contain sufficient headroom to accommodate any required protocol headers. Stream sockets such as TCP and TLS do not typically provide a custom xfer_alloc_iob() handler at present. The default handler simply calls alloc_iob(), and so stream socket consumers can therefore get away with using alloc_iob() rather than xfer_alloc_iob(). Fix the HTTP and ONC RPC protocols to use xfer_alloc_iob() where relevant, in order to operate correctly if the underlying stream socket chooses to provide a custom xfer_alloc_iob() handler. Signed-off-by: Michael Brown --- src/net/tcp/httpcore.c | 3 ++- src/net/tcp/oncrpc.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) (limited to 'src/net') diff --git a/src/net/tcp/httpcore.c b/src/net/tcp/httpcore.c index af2a237cf..7052bbbad 100644 --- a/src/net/tcp/httpcore.c +++ b/src/net/tcp/httpcore.c @@ -1090,7 +1090,8 @@ static int http_tx_request ( struct http_transaction *http ) { } /* Allocate I/O buffer */ - iobuf = alloc_iob ( len + 1 /* NUL */ + http->request.content.len ); + iobuf = xfer_alloc_iob ( &http->conn, ( len + 1 /* NUL */ + + http->request.content.len ) ); if ( ! iobuf ) { rc = -ENOMEM; goto err_alloc; diff --git a/src/net/tcp/oncrpc.c b/src/net/tcp/oncrpc.c index cb66aeb85..64734a808 100644 --- a/src/net/tcp/oncrpc.c +++ b/src/net/tcp/oncrpc.c @@ -150,7 +150,7 @@ int oncrpc_call ( struct interface *intf, struct oncrpc_session *session, frame_size = oncrpc_compute_size ( header ); frame_size += oncrpc_compute_size ( fields ); - io_buf = alloc_iob ( frame_size ); + io_buf = xfer_alloc_iob ( intf, frame_size ); if ( ! io_buf ) return -ENOBUFS; -- cgit v1.2.3-55-g7522 From 7fe467a46db6bb989c82f55119a6b302d85f8bc6 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 31 Mar 2025 00:15:27 +0100 Subject: [tls] Encrypt data in place to reduce memory usage Provide a custom xfer_alloc_iob() handler to ensure that transmit I/O buffers contain sufficient headroom for the TLS record header and record initialisation vector, and sufficient tailroom for the MAC, block cipher padding, and authentication tag. This allows us to use in-place encryption for the actual data within the I/O buffer, which essentially halves the amount of memory that needs to be allocated for a TLS data transmission. Signed-off-by: Michael Brown --- src/net/tls.c | 210 +++++++++++++++++++++++++++++++++------------------------- 1 file changed, 121 insertions(+), 89 deletions(-) (limited to 'src/net') diff --git a/src/net/tls.c b/src/net/tls.c index a94e71c8a..fc4662007 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -196,6 +196,10 @@ FILE_LICENCE ( GPL2_OR_LATER ); static LIST_HEAD ( tls_sessions ); static void tls_tx_resume_all ( struct tls_session *session ); +static struct io_buffer * tls_alloc_iob ( struct tls_connection *tls, + size_t len ); +static int tls_send_record ( struct tls_connection *tls, unsigned int type, + struct io_buffer *iobuf ); static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, const void *data, size_t len ); static void tls_clear_cipher ( struct tls_connection *tls, @@ -1126,9 +1130,6 @@ static void tls_restart ( struct tls_connection *tls ) { static int tls_send_handshake ( struct tls_connection *tls, const void *data, size_t len ) { - /* Add to handshake digest */ - tls_add_handshake ( tls, data, len ); - /* Send record */ return tls_send_plaintext ( tls, TLS_TYPE_HANDSHAKE, data, len ); } @@ -1333,8 +1334,8 @@ static int tls_send_certificate ( struct tls_connection *tls ) { } __attribute__ (( packed )) *certificates; struct x509_link *link; struct x509_certificate *cert; + struct io_buffer *iobuf; size_t len; - int rc; /* Calculate length of client certificates */ len = 0; @@ -1348,33 +1349,28 @@ static int tls_send_certificate ( struct tls_connection *tls ) { /* Allocate storage for Certificate record (which may be too * large for the stack). */ - certificates = zalloc ( sizeof ( *certificates ) + len ); - if ( ! certificates ) + iobuf = tls_alloc_iob ( tls, ( sizeof ( *certificates ) + len ) ); + if ( ! iobuf ) return -ENOMEM_CERTIFICATE; /* Populate record */ + certificates = iob_put ( iobuf, sizeof ( *certificates ) ); certificates->type_length = ( cpu_to_le32 ( TLS_CERTIFICATE ) | htonl ( sizeof ( *certificates ) + len - sizeof ( certificates->type_length ) ) ); tls_set_uint24 ( &certificates->length, len ); - certificate = &certificates->certificates[0]; list_for_each_entry ( link, &tls->client.chain->links, list ) { cert = link->cert; + certificate = iob_put ( iobuf, sizeof ( *certificate ) ); tls_set_uint24 ( &certificate->length, cert->raw.len ); - memcpy ( certificate->data, cert->raw.data, cert->raw.len ); - certificate = ( ( ( void * ) certificate->data ) + - cert->raw.len ); + memcpy ( iob_put ( iobuf, cert->raw.len ), cert->raw.data, + cert->raw.len ); } /* Transmit record */ - rc = tls_send_handshake ( tls, certificates, - ( sizeof ( *certificates ) + len ) ); - - /* Free record */ - free ( certificates ); - - return rc; + return tls_send_record ( tls, TLS_TYPE_HANDSHAKE, + iob_disown ( iobuf ) ); } /** @@ -2927,17 +2923,58 @@ static void tls_hmac_list ( struct tls_cipherspec *cipherspec, tls_hmac_final ( cipherspec, ctx, hmac ); } +/** + * Allocate I/O buffer for transmitted record + * + * @v tls TLS connection + * @v len I/O buffer payload length + * @ret iobuf I/O buffer + */ +static struct io_buffer * tls_alloc_iob ( struct tls_connection *tls, + size_t len ) { + struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active; + struct tls_cipher_suite *suite = cipherspec->suite; + struct cipher_algorithm *cipher = suite->cipher; + struct tls_header *tlshdr; + struct io_buffer *iobuf; + size_t pre_len; + size_t padded_len; + size_t post_len; + + /* Calculate length of padded data */ + padded_len = ( len + suite->mac_len ); + if ( is_block_cipher ( cipher ) ) { + padded_len = ( ( padded_len + 1 + cipher->blocksize - 1 ) & + ~( cipher->blocksize - 1 ) ); + assert ( padded_len > ( len + suite->mac_len ) ); + } + + /* Calculate lengths before and after padded data */ + pre_len = ( sizeof ( *tlshdr ) + suite->record_iv_len ); + post_len = cipher->authsize; + + /* Allocate I/O buffer */ + iobuf = xfer_alloc_iob ( &tls->cipherstream, + ( pre_len + padded_len + post_len ) ); + if ( ! iobuf ) + return NULL; + + /* Reserve space */ + iob_reserve ( iobuf, pre_len ); + + return iobuf; +} + /** * Send plaintext record * * @v tls TLS connection * @v type Record type - * @v data Plaintext record - * @v len Length of plaintext record + * @v iobuf I/O buffer * @ret rc Return status code */ -static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, - const void *data, size_t len ) { +static int tls_send_record ( struct tls_connection *tls, unsigned int type, + struct io_buffer *iobuf ) { struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active; struct tls_cipher_suite *suite = cipherspec->suite; struct cipher_algorithm *cipher = suite->cipher; @@ -2948,15 +2985,14 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, } __attribute__ (( packed )) iv; struct tls_auth_header authhdr; struct tls_header *tlshdr; - void *plaintext; - size_t plaintext_len; - struct io_buffer *ciphertext; - size_t ciphertext_len; - size_t padding_len; uint8_t mac[digest->digestsize]; - void *tmp; + size_t pad_len; int rc; + /* Add to handshake digest if applicable */ + if ( type == TLS_TYPE_HANDSHAKE ) + tls_add_handshake ( tls, iobuf->data, iob_len ( iobuf ) ); + /* Construct initialisation vector */ memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) ); if ( ( rc = tls_generate_random ( tls, iv.record, @@ -2968,40 +3004,25 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, authhdr.seq = cpu_to_be64 ( tls->tx.seq ); authhdr.header.type = type; authhdr.header.version = htons ( tls->version ); - authhdr.header.length = htons ( len ); + authhdr.header.length = htons ( iob_len ( iobuf ) ); - /* Calculate padding length */ - plaintext_len = ( len + suite->mac_len ); - if ( is_block_cipher ( cipher ) ) { - padding_len = ( ( ( cipher->blocksize - 1 ) & - -( plaintext_len + 1 ) ) + 1 ); - } else { - padding_len = 0; + /* Append MAC, if applicable */ + if ( suite->mac_len ) { + tls_hmac ( cipherspec, &authhdr, iobuf->data, + iob_len ( iobuf ), mac ); + memcpy ( iob_put ( iobuf, suite->mac_len ), mac, + suite->mac_len ); } - plaintext_len += padding_len; - /* Allocate plaintext */ - plaintext = malloc ( plaintext_len ); - if ( ! plaintext ) { - DBGC ( tls, "TLS %p could not allocate %zd bytes for " - "plaintext\n", tls, plaintext_len ); - rc = -ENOMEM_TX_PLAINTEXT; - goto err_plaintext; + /* Append padding, if applicable */ + if ( is_block_cipher ( cipher ) ) { + pad_len = ( ( ( cipher->blocksize - 1 ) & + -( iob_len ( iobuf ) + 1 ) ) + 1 ); + memset ( iob_put ( iobuf, pad_len ), ( pad_len - 1 ), pad_len ); + assert ( ! ( iob_len ( iobuf ) & ( cipher->blocksize - 1 ) ) ); } - - /* Assemble plaintext */ - tmp = plaintext; - memcpy ( tmp, data, len ); - tmp += len; - if ( suite->mac_len ) - tls_hmac ( cipherspec, &authhdr, data, len, mac ); - memcpy ( tmp, mac, suite->mac_len ); - tmp += suite->mac_len; - memset ( tmp, ( padding_len - 1 ), padding_len ); - tmp += padding_len; - assert ( tmp == ( plaintext + plaintext_len ) ); DBGC2 ( tls, "Sending plaintext data:\n" ); - DBGC2_HD ( tls, plaintext, plaintext_len ); + DBGC2_HDA ( tls, 0, iobuf->data, iob_len ( iobuf ) ); /* Set initialisation vector */ cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv, sizeof ( iv ) ); @@ -3012,37 +3033,23 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, NULL, sizeof ( authhdr ) ); } - /* Allocate ciphertext */ - ciphertext_len = ( sizeof ( *tlshdr ) + sizeof ( iv.record ) + - plaintext_len + cipher->authsize ); - ciphertext = xfer_alloc_iob ( &tls->cipherstream, ciphertext_len ); - if ( ! ciphertext ) { - DBGC ( tls, "TLS %p could not allocate %zd bytes for " - "ciphertext\n", tls, ciphertext_len ); - rc = -ENOMEM_TX_CIPHERTEXT; - goto err_ciphertext; - } + /* Encrypt data to be transmitted and append authentication tag */ + cipher_encrypt ( cipher, cipherspec->cipher_ctx, iobuf->data, + iobuf->data, iob_len ( iobuf ) ); + cipher_auth ( cipher, cipherspec->cipher_ctx, + iob_put ( iobuf, cipher->authsize ) ); - /* Assemble ciphertext */ - tlshdr = iob_put ( ciphertext, sizeof ( *tlshdr ) ); + /* Prepend record header and initialisation vector */ + memcpy ( iob_push ( iobuf, sizeof ( iv.record ) ), iv.record, + sizeof ( iv.record ) ); + tlshdr = iob_push ( iobuf, sizeof ( *tlshdr ) ); tlshdr->type = type; tlshdr->version = htons ( tls->version ); - tlshdr->length = htons ( ciphertext_len - sizeof ( *tlshdr ) ); - memcpy ( iob_put ( ciphertext, sizeof ( iv.record ) ), iv.record, - sizeof ( iv.record ) ); - cipher_encrypt ( cipher, cipherspec->cipher_ctx, plaintext, - iob_put ( ciphertext, plaintext_len ), plaintext_len ); - cipher_auth ( cipher, cipherspec->cipher_ctx, - iob_put ( ciphertext, cipher->authsize ) ); - assert ( iob_len ( ciphertext ) == ciphertext_len ); - - /* Free plaintext as soon as possible to conserve memory */ - free ( plaintext ); - plaintext = NULL; + tlshdr->length = htons ( iob_len ( iobuf ) - sizeof ( *tlshdr ) ); /* Send ciphertext */ if ( ( rc = xfer_deliver_iob ( &tls->cipherstream, - iob_disown ( ciphertext ) ) ) != 0 ) { + iob_disown ( iobuf ) ) ) != 0 ) { DBGC ( tls, "TLS %p could not deliver ciphertext: %s\n", tls, strerror ( rc ) ); goto err_deliver; @@ -3051,19 +3058,42 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, /* Update TX state machine to next record */ tls->tx.seq += 1; - assert ( plaintext == NULL ); - assert ( ciphertext == NULL ); + assert ( iobuf == NULL ); return 0; err_deliver: - free_iob ( ciphertext ); - err_ciphertext: - free ( plaintext ); - err_plaintext: err_random: + free_iob ( iobuf ); return rc; } +/** + * Send plaintext record + * + * @v tls TLS connection + * @v type Record type + * @v data Plaintext record + * @v len Length of plaintext record + * @ret rc Return status code + */ +static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, + const void *data, size_t len ) { + struct io_buffer *iobuf; + int rc; + + /* Allocate I/O buffer */ + iobuf = tls_alloc_iob ( tls, len ); + if ( ! iobuf ) + return -ENOMEM_TX_PLAINTEXT; + memcpy ( iob_put ( iobuf, len ), data, len ); + + /* Transmit I/O buffer */ + if ( ( rc = tls_send_record ( tls, type, iob_disown ( iobuf ) ) ) != 0 ) + return rc; + + return 0; +} + /** * Verify block padding * @@ -3281,8 +3311,9 @@ static int tls_plainstream_deliver ( struct tls_connection *tls, goto done; } - if ( ( rc = tls_send_plaintext ( tls, TLS_TYPE_DATA, iobuf->data, - iob_len ( iobuf ) ) ) != 0 ) + /* Send data record */ + if ( ( rc = tls_send_record ( tls, TLS_TYPE_DATA, + iob_disown ( iobuf ) ) ) != 0 ) goto done; done: @@ -3310,6 +3341,7 @@ static int tls_progress ( struct tls_connection *tls, /** TLS plaintext stream interface operations */ static struct interface_operation tls_plainstream_ops[] = { + INTF_OP ( xfer_alloc_iob, struct tls_connection *, tls_alloc_iob ), INTF_OP ( xfer_deliver, struct tls_connection *, tls_plainstream_deliver ), INTF_OP ( xfer_window, struct tls_connection *, -- cgit v1.2.3-55-g7522 From f115cfcf994e0141eb1f9c0a3684c8d1b6260719 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 31 Mar 2025 14:25:41 +0100 Subject: [tls] Send an empty client certificate chain if we have no certificate RFC5246 states that "a client MAY send no certificates if it does not have an appropriate certificate to send in response to the server's authentication request". This use case may arise when the server is using optional client certificate verification and iPXE has not been provided with a client certificate to use. Treat the absence of a suitable client certificate as a non-fatal condition and send a Certificate message containing no certificates as permitted by RFC5246. Reported-by: Alexandre Ravey Originally-implemented-by: Alexandre Ravey Signed-off-by: Michael Brown --- src/net/tls.c | 56 ++++++++++++++++++++++++++++---------------------------- 1 file changed, 28 insertions(+), 28 deletions(-) (limited to 'src/net') diff --git a/src/net/tls.c b/src/net/tls.c index fc4662007..5ad20fff4 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -171,10 +171,6 @@ FILE_LICENCE ( GPL2_OR_LATER ); #define EINFO_EPERM_VERIFY \ __einfo_uniqify ( EINFO_EPERM, 0x02, \ "Handshake verification failed" ) -#define EPERM_CLIENT_CERT __einfo_error ( EINFO_EPERM_CLIENT_CERT ) -#define EINFO_EPERM_CLIENT_CERT \ - __einfo_uniqify ( EINFO_EPERM, 0x03, \ - "No suitable client certificate available" ) #define EPERM_RENEG_INSECURE __einfo_error ( EINFO_EPERM_RENEG_INSECURE ) #define EINFO_EPERM_RENEG_INSECURE \ __einfo_uniqify ( EINFO_EPERM, 0x04, \ @@ -2464,18 +2460,6 @@ static int tls_new_certificate_request ( struct tls_connection *tls, x509_chain_put ( tls->client.chain ); tls->client.chain = NULL; - /* Determine client certificate to be sent */ - cert = x509_find_key ( NULL, tls->client.key ); - if ( ! cert ) { - DBGC ( tls, "TLS %p could not find certificate corresponding " - "to private key\n", tls ); - rc = -EPERM_CLIENT_CERT; - goto err_find; - } - x509_get ( cert ); - DBGC ( tls, "TLS %p selected client certificate %s\n", - tls, x509_name ( cert ) ); - /* Create client certificate chain */ tls->client.chain = x509_alloc_chain(); if ( ! tls->client.chain ) { @@ -2483,26 +2467,41 @@ static int tls_new_certificate_request ( struct tls_connection *tls, goto err_alloc; } - /* Append client certificate to chain */ - if ( ( rc = x509_append ( tls->client.chain, cert ) ) != 0 ) - goto err_append; + /* Determine client certificate to be sent, if any */ + cert = x509_find_key ( NULL, tls->client.key ); + if ( cert ) { + + /* Get temporary reference to certificate */ + x509_get ( cert ); + DBGC ( tls, "TLS %p selected client certificate %s\n", + tls, x509_name ( cert ) ); + + /* Append client certificate to chain */ + if ( ( rc = x509_append ( tls->client.chain, cert ) ) != 0 ) + goto err_append; + + /* Append any relevant issuer certificates */ + if ( ( rc = x509_auto_append ( tls->client.chain, + &certstore ) ) != 0 ) + goto err_auto_append; + } else { - /* Append any relevant issuer certificates */ - if ( ( rc = x509_auto_append ( tls->client.chain, &certstore ) ) != 0 ) - goto err_auto_append; + /* Send an empty certificate chain */ + DBGC ( tls, "TLS %p could not find certificate corresponding " + "to private key\n", tls ); + } - /* Drop local reference to client certificate */ + /* Drop local reference (if any) to client certificate */ x509_put ( cert ); return 0; err_auto_append: err_append: + x509_put ( cert ); x509_chain_put ( tls->client.chain ); tls->client.chain = NULL; err_alloc: - x509_put ( cert ); - err_find: return rc; } @@ -3616,13 +3615,14 @@ static void tls_validator_done ( struct tls_connection *tls, int rc ) { memcpy ( &tls->server.key, &cert->subject.public_key.raw, sizeof ( tls->server.key ) ); - /* Schedule Client Key Exchange, Change Cipher, and Finished */ + /* Schedule transmission of applicable handshake messages */ tls->tx.pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE | TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED ); if ( tls->client.chain ) { - tls->tx.pending |= ( TLS_TX_CERTIFICATE | - TLS_TX_CERTIFICATE_VERIFY ); + tls->tx.pending |= TLS_TX_CERTIFICATE; + if ( ! list_empty ( &tls->client.chain->links ) ) + tls->tx.pending |= TLS_TX_CERTIFICATE_VERIFY; } tls_tx_resume ( tls ); -- cgit v1.2.3-55-g7522 From a289b4b8c2eb06d013a48088e25e11a3390006ca Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 31 Mar 2025 16:36:33 +0100 Subject: [tls] Support fragmentation of transmitted records Large transmitted records may arise if we have long client certificate chains or if a client sends a large block of data (such as a large HTTP POST payload). Fragment records as needed to comply with the value that we advertise via the max_fragment_length extension. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 11 +++ src/net/tls.c | 197 +++++++++++++++++++++++++++++++------------------ 2 files changed, 135 insertions(+), 73 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 7abbe4ff9..3b46543bb 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -465,6 +465,17 @@ struct tls_connection { struct tls_server server; }; +/** Advertised maximum fragment length */ +#define TLS_MAX_FRAGMENT_LENGTH_VALUE TLS_MAX_FRAGMENT_LENGTH_4096 + +/** TX maximum fragment length + * + * TLS requires us to limit our transmitted records to the maximum + * fragment length that we attempt to negotiate, even if the server + * does not respect this choice. + */ +#define TLS_TX_BUFSIZE 4096 + /** RX I/O buffer size * * The maximum fragment length extension is optional, and many common diff --git a/src/net/tls.c b/src/net/tls.c index 5ad20fff4..4c135f090 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1256,7 +1256,7 @@ static int tls_client_hello ( struct tls_connection *tls, max_fragment_length_ext->type = htons ( TLS_MAX_FRAGMENT_LENGTH ); max_fragment_length_ext->len = htons ( sizeof ( max_fragment_length_ext->data ) ); - max_fragment_length_ext->data.max = TLS_MAX_FRAGMENT_LENGTH_4096; + max_fragment_length_ext->data.max = TLS_MAX_FRAGMENT_LENGTH_VALUE; /* Construct supported signature algorithms extension */ signature_algorithms_ext = &extensions->signature_algorithms; @@ -2923,49 +2923,60 @@ static void tls_hmac_list ( struct tls_cipherspec *cipherspec, } /** - * Allocate I/O buffer for transmitted record + * Calculate maximum additional length required for transmitted record(s) * * @v tls TLS connection * @v len I/O buffer payload length - * @ret iobuf I/O buffer + * @ret reserve Maximum additional length to reserve */ -static struct io_buffer * tls_alloc_iob ( struct tls_connection *tls, - size_t len ) { +static size_t tls_iob_reserved ( struct tls_connection *tls, size_t len ) { struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active; struct tls_cipher_suite *suite = cipherspec->suite; struct cipher_algorithm *cipher = suite->cipher; struct tls_header *tlshdr; - struct io_buffer *iobuf; - size_t pre_len; - size_t padded_len; - size_t post_len; + unsigned int count; + size_t each; - /* Calculate length of padded data */ - padded_len = ( len + suite->mac_len ); - if ( is_block_cipher ( cipher ) ) { - padded_len = ( ( padded_len + 1 + cipher->blocksize - 1 ) & - ~( cipher->blocksize - 1 ) ); - assert ( padded_len > ( len + suite->mac_len ) ); - } + /* Calculate number of records (allowing for zero-length records) */ + count = ( len ? ( ( len + TLS_TX_BUFSIZE - 1 ) / TLS_TX_BUFSIZE ) : 1 ); + + /* Calculate maximum additional length per record */ + each = ( sizeof ( *tlshdr ) + suite->record_iv_len + suite->mac_len + + ( is_block_cipher ( cipher ) ? cipher->blocksize : 0 ) + + cipher->authsize ); + + /* Calculate maximum total additional length */ + return ( count * each ); +} + +/** + * Allocate I/O buffer for transmitted record(s) + * + * @v tls TLS connection + * @v len I/O buffer payload length + * @ret iobuf I/O buffer + */ +static struct io_buffer * tls_alloc_iob ( struct tls_connection *tls, + size_t len ) { + struct io_buffer *iobuf; + size_t reserve; - /* Calculate lengths before and after padded data */ - pre_len = ( sizeof ( *tlshdr ) + suite->record_iv_len ); - post_len = cipher->authsize; + /* Calculate maximum additional length to reserve */ + reserve = tls_iob_reserved ( tls, len ); /* Allocate I/O buffer */ - iobuf = xfer_alloc_iob ( &tls->cipherstream, - ( pre_len + padded_len + post_len ) ); + iobuf = xfer_alloc_iob ( &tls->cipherstream, ( reserve + len ) ); if ( ! iobuf ) return NULL; /* Reserve space */ - iob_reserve ( iobuf, pre_len ); + iob_reserve ( iobuf, reserve ); return iobuf; } /** - * Send plaintext record + * Send plaintext record(s) * * @v tls TLS connection * @v type Record type @@ -2980,71 +2991,114 @@ static int tls_send_record ( struct tls_connection *tls, unsigned int type, struct digest_algorithm *digest = suite->digest; struct { uint8_t fixed[suite->fixed_iv_len]; - uint8_t record[suite->record_iv_len]; + uint8_t rec[suite->record_iv_len]; } __attribute__ (( packed )) iv; struct tls_auth_header authhdr; struct tls_header *tlshdr; uint8_t mac[digest->digestsize]; + const void *plaintext; + const void *encrypt; + void *ciphertext; + size_t record_len; + size_t encrypt_len; size_t pad_len; + size_t len; int rc; + /* Record plaintext pointer and length */ + plaintext = iobuf->data; + len = iob_len ( iobuf ); + /* Add to handshake digest if applicable */ if ( type == TLS_TYPE_HANDSHAKE ) - tls_add_handshake ( tls, iobuf->data, iob_len ( iobuf ) ); + tls_add_handshake ( tls, plaintext, len ); + + /* Start constructing ciphertext at start of reserved space */ + iob_push ( iobuf, tls_iob_reserved ( tls, len ) ); + iob_unput ( iobuf, iob_len ( iobuf ) ); + + /* Construct records */ + do { + /* Limit length of this record (may be zero) */ + record_len = len; + if ( record_len > TLS_TX_BUFSIZE ) + record_len = TLS_TX_BUFSIZE; + + /* Construct and set initialisation vector */ + memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) ); + if ( ( rc = tls_generate_random ( tls, iv.rec, + sizeof ( iv.rec ) ) ) != 0 ) { + goto err_random; + } + cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv, + sizeof ( iv ) ); + + /* Construct and process authentication data */ + authhdr.seq = cpu_to_be64 ( tls->tx.seq ); + authhdr.header.type = type; + authhdr.header.version = htons ( tls->version ); + authhdr.header.length = htons ( record_len ); + if ( suite->mac_len ) { + tls_hmac ( cipherspec, &authhdr, plaintext, record_len, + mac ); + } + if ( is_auth_cipher ( cipher ) ) { + cipher_encrypt ( cipher, cipherspec->cipher_ctx, + &authhdr, NULL, sizeof ( authhdr ) ); + } - /* Construct initialisation vector */ - memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) ); - if ( ( rc = tls_generate_random ( tls, iv.record, - sizeof ( iv.record ) ) ) != 0 ) { - goto err_random; - } + /* Calculate encryption length */ + encrypt_len = ( record_len + suite->mac_len ); + if ( is_block_cipher ( cipher ) ) { + pad_len = ( ( ( cipher->blocksize - 1 ) & + -( encrypt_len + 1 ) ) + 1 ); + } else { + pad_len = 0; + } + encrypt_len += pad_len; + + /* Add record header */ + tlshdr = iob_put ( iobuf, sizeof ( *tlshdr ) ); + tlshdr->type = type; + tlshdr->version = htons ( tls->version ); + tlshdr->length = htons ( sizeof ( iv.rec ) + encrypt_len + + cipher->authsize ); + + /* Add record initialisation vector, if applicable */ + memcpy ( iob_put ( iobuf, sizeof ( iv.rec ) ), iv.rec, + sizeof ( iv.rec ) ); + + /* Copy plaintext data if necessary */ + ciphertext = iob_put ( iobuf, record_len ); + assert ( ciphertext <= plaintext ); + if ( encrypt_len > record_len ) { + memmove ( ciphertext, plaintext, record_len ); + encrypt = ciphertext; + } else { + encrypt = plaintext; + } - /* Construct authentication data */ - authhdr.seq = cpu_to_be64 ( tls->tx.seq ); - authhdr.header.type = type; - authhdr.header.version = htons ( tls->version ); - authhdr.header.length = htons ( iob_len ( iobuf ) ); - - /* Append MAC, if applicable */ - if ( suite->mac_len ) { - tls_hmac ( cipherspec, &authhdr, iobuf->data, - iob_len ( iobuf ), mac ); + /* Add MAC, if applicable */ memcpy ( iob_put ( iobuf, suite->mac_len ), mac, suite->mac_len ); - } - /* Append padding, if applicable */ - if ( is_block_cipher ( cipher ) ) { - pad_len = ( ( ( cipher->blocksize - 1 ) & - -( iob_len ( iobuf ) + 1 ) ) + 1 ); + /* Add padding, if applicable */ memset ( iob_put ( iobuf, pad_len ), ( pad_len - 1 ), pad_len ); - assert ( ! ( iob_len ( iobuf ) & ( cipher->blocksize - 1 ) ) ); - } - DBGC2 ( tls, "Sending plaintext data:\n" ); - DBGC2_HDA ( tls, 0, iobuf->data, iob_len ( iobuf ) ); - /* Set initialisation vector */ - cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv, sizeof ( iv ) ); + /* Encrypt data and append authentication tag */ + DBGC2 ( tls, "Sending plaintext data:\n" ); + DBGC2_HDA ( tls, 0, encrypt, encrypt_len ); + cipher_encrypt ( cipher, cipherspec->cipher_ctx, encrypt, + ciphertext, encrypt_len ); + cipher_auth ( cipher, cipherspec->cipher_ctx, + iob_put ( iobuf, cipher->authsize ) ); - /* Process authentication data, if applicable */ - if ( is_auth_cipher ( cipher ) ) { - cipher_encrypt ( cipher, cipherspec->cipher_ctx, &authhdr, - NULL, sizeof ( authhdr ) ); - } + /* Move to next record */ + tls->tx.seq += 1; + plaintext += record_len; + len -= record_len; - /* Encrypt data to be transmitted and append authentication tag */ - cipher_encrypt ( cipher, cipherspec->cipher_ctx, iobuf->data, - iobuf->data, iob_len ( iobuf ) ); - cipher_auth ( cipher, cipherspec->cipher_ctx, - iob_put ( iobuf, cipher->authsize ) ); - - /* Prepend record header and initialisation vector */ - memcpy ( iob_push ( iobuf, sizeof ( iv.record ) ), iv.record, - sizeof ( iv.record ) ); - tlshdr = iob_push ( iobuf, sizeof ( *tlshdr ) ); - tlshdr->type = type; - tlshdr->version = htons ( tls->version ); - tlshdr->length = htons ( iob_len ( iobuf ) - sizeof ( *tlshdr ) ); + } while ( len ); /* Send ciphertext */ if ( ( rc = xfer_deliver_iob ( &tls->cipherstream, @@ -3054,9 +3108,6 @@ static int tls_send_record ( struct tls_connection *tls, unsigned int type, goto err_deliver; } - /* Update TX state machine to next record */ - tls->tx.seq += 1; - assert ( iobuf == NULL ); return 0; -- cgit v1.2.3-55-g7522 From 0a48bb32145ce14b11d5d1e2a537d3d567489385 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 31 Mar 2025 17:44:59 +0100 Subject: [x509] Ensure certificate remains valid during x509_append() The allocation of memory for the certificate chain link may cause the certificate itself to be freed by the cache discarder, if the only current reference to the certificate is held by the certificate store and the system runs out of memory during the call to malloc(). Ensure that this cannot happen by taking out a temporary additional reference to the certificate within x509_append(), rather than requiring the caller to do so. Signed-off-by: Michael Brown --- src/crypto/x509.c | 17 ++++++++++++++--- src/net/tls.c | 7 ------- 2 files changed, 14 insertions(+), 10 deletions(-) (limited to 'src/net') diff --git a/src/crypto/x509.c b/src/crypto/x509.c index acb27411a..10bc6369a 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1634,11 +1634,17 @@ struct x509_chain * x509_alloc_chain ( void ) { */ int x509_append ( struct x509_chain *chain, struct x509_certificate *cert ) { struct x509_link *link; + int rc; + + /* Ensure allocation of link cannot invalidate certificate */ + x509_get ( cert ); /* Allocate link */ link = zalloc ( sizeof ( *link ) ); - if ( ! link ) - return -ENOMEM; + if ( ! link ) { + rc = -ENOMEM; + goto err_alloc; + } /* Add link to chain */ link->cert = x509_get ( cert ); @@ -1646,7 +1652,12 @@ int x509_append ( struct x509_chain *chain, struct x509_certificate *cert ) { DBGC ( chain, "X509 chain %p added X509 %p \"%s\"\n", chain, cert, x509_name ( cert ) ); - return 0; + /* Success */ + rc = 0; + + x509_put ( cert ); + err_alloc: + return rc; } /** diff --git a/src/net/tls.c b/src/net/tls.c index 4c135f090..643b9292d 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -2470,9 +2470,6 @@ static int tls_new_certificate_request ( struct tls_connection *tls, /* Determine client certificate to be sent, if any */ cert = x509_find_key ( NULL, tls->client.key ); if ( cert ) { - - /* Get temporary reference to certificate */ - x509_get ( cert ); DBGC ( tls, "TLS %p selected client certificate %s\n", tls, x509_name ( cert ) ); @@ -2491,14 +2488,10 @@ static int tls_new_certificate_request ( struct tls_connection *tls, "to private key\n", tls ); } - /* Drop local reference (if any) to client certificate */ - x509_put ( cert ); - return 0; err_auto_append: err_append: - x509_put ( cert ); x509_chain_put ( tls->client.chain ); tls->client.chain = NULL; err_alloc: -- cgit v1.2.3-55-g7522 From 2c406ec0b1bb2e8b858bdb43e2922a7adee3917e Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 15 Apr 2025 14:02:14 +0100 Subject: [netdevice] Add missing bus type identifier for devicetree devices Signed-off-by: Michael Brown --- src/net/netdev_settings.c | 1 + 1 file changed, 1 insertion(+) (limited to 'src/net') diff --git a/src/net/netdev_settings.c b/src/net/netdev_settings.c index 080b6d2a5..9432dc2fa 100644 --- a/src/net/netdev_settings.c +++ b/src/net/netdev_settings.c @@ -169,6 +169,7 @@ static int netdev_fetch_bustype ( struct net_device *netdev, void *data, [BUS_TYPE_XEN] = "XEN", [BUS_TYPE_HV] = "HV", [BUS_TYPE_USB] = "USB", + [BUS_TYPE_DT] = "DT", }; struct device_description *desc = &netdev->dev->desc; const char *bustype; -- cgit v1.2.3-55-g7522 From b07cc851f0ad424e36c8f2c3a9673e634560b020 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 17 Apr 2025 00:27:13 +0100 Subject: [netdevice] Add the concept of an insomniac network device Some network devices (observed with the SNP interface to the wireless network card on an HP Elitebook 840 G10) will stop working if they are left for too long without being polled. Add the concept of an insomniac network device, that must continue to be polled even when closed. Note that drivers are already permitted to call netdev_rx() et al even when closed: this will already be happening for USB devices since polling operates at the level of the whole USB bus, rather than at the level of individual USB devices. Signed-off-by: Michael Brown --- src/include/ipxe/netdevice.h | 14 ++++++++++++++ src/net/netdevice.c | 4 ++-- 2 files changed, 16 insertions(+), 2 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/netdevice.h b/src/include/ipxe/netdevice.h index caa83b44b..17695d5b6 100644 --- a/src/include/ipxe/netdevice.h +++ b/src/include/ipxe/netdevice.h @@ -457,6 +457,9 @@ struct net_device { /** Network device poll is in progress */ #define NETDEV_POLL_IN_PROGRESS 0x0020 +/** Network device must be polled even when closed */ +#define NETDEV_INSOMNIAC 0x0040 + /** Link-layer protocol table */ #define LL_PROTOCOLS __table ( struct ll_protocol, "ll_protocols" ) @@ -693,6 +696,17 @@ netdev_rx_frozen ( struct net_device *netdev ) { return ( netdev->state & NETDEV_RX_FROZEN ); } +/** + * Check whether or not network device must be polled even while closed + * + * @v netdev Network device + * @ret insomniac Network device must be polled even while closed + */ +static inline __attribute__ (( always_inline )) int +netdev_insomniac ( struct net_device *netdev ) { + return ( netdev->state & NETDEV_INSOMNIAC ); +} + extern void * netdev_priv ( struct net_device *netdev, struct net_driver *driver ); extern void netdev_rx_freeze ( struct net_device *netdev ); diff --git a/src/net/netdevice.c b/src/net/netdevice.c index a9ed18134..c89585708 100644 --- a/src/net/netdevice.c +++ b/src/net/netdevice.c @@ -611,8 +611,8 @@ void netdev_rx_err ( struct net_device *netdev, */ void netdev_poll ( struct net_device *netdev ) { - /* Avoid calling poll() on unopened network devices */ - if ( ! netdev_is_open ( netdev ) ) + /* Call poll() only on open (or insomniac) network devices */ + if ( ! ( netdev->state & ( NETDEV_OPEN | NETDEV_INSOMNIAC ) ) ) return; /* Guard against re-entry */ -- cgit v1.2.3-55-g7522 From 2f11f466e6b6cb47ac3b703b145e01f87bf8092e Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 24 Apr 2025 17:11:30 +0100 Subject: [block] Remove userptr_t from block device abstraction Simplify the block device code by assuming that all read/write buffers are directly accessible via pointer dereferences. Signed-off-by: Michael Brown --- src/arch/x86/interface/pcbios/int13.c | 17 ++++++++--------- src/core/blockdev.c | 8 ++++---- src/core/blocktrans.c | 8 ++++---- src/core/dummy_sanboot.c | 1 + src/core/sanboot.c | 23 ++++++++++++----------- src/drivers/block/ata.c | 30 +++++++++++++++--------------- src/drivers/block/scsi.c | 16 ++++++++-------- src/drivers/usb/usbblk.c | 10 +++++----- src/include/ipxe/ata.h | 5 ++--- src/include/ipxe/blockdev.h | 13 ++++++------- src/include/ipxe/blocktrans.h | 7 +++---- src/include/ipxe/sanboot.h | 4 ++-- src/include/ipxe/scsi.h | 5 ++--- src/interface/efi/efi_block.c | 5 +++-- src/net/aoe.c | 7 ++----- src/net/fcp.c | 6 +++--- src/net/tcp/httpblock.c | 5 ++--- src/net/tcp/httpcore.c | 2 +- src/net/tcp/iscsi.c | 7 +++---- 19 files changed, 86 insertions(+), 93 deletions(-) (limited to 'src/net') diff --git a/src/arch/x86/interface/pcbios/int13.c b/src/arch/x86/interface/pcbios/int13.c index 498676b70..73fdfebd3 100644 --- a/src/arch/x86/interface/pcbios/int13.c +++ b/src/arch/x86/interface/pcbios/int13.c @@ -181,8 +181,7 @@ static int int13_parse_eltorito ( struct san_device *sandev, void *scratch ) { int rc; /* Read boot record volume descriptor */ - if ( ( rc = sandev_read ( sandev, ELTORITO_LBA, 1, - virt_to_user ( boot ) ) ) != 0 ) { + if ( ( rc = sandev_read ( sandev, ELTORITO_LBA, 1, boot ) ) != 0 ) { DBGC ( sandev->drive, "INT13 drive %02x could not read El " "Torito boot record volume descriptor: %s\n", sandev->drive, strerror ( rc ) ); @@ -228,7 +227,7 @@ static int int13_guess_geometry_hdd ( struct san_device *sandev, void *scratch, int rc; /* Read partition table */ - if ( ( rc = sandev_read ( sandev, 0, 1, virt_to_user ( mbr ) ) ) != 0 ) { + if ( ( rc = sandev_read ( sandev, 0, 1, mbr ) ) != 0 ) { DBGC ( sandev->drive, "INT13 drive %02x could not read " "partition table to guess geometry: %s\n", sandev->drive, strerror ( rc ) ); @@ -517,12 +516,12 @@ static int int13_rw_sectors ( struct san_device *sandev, int ( * sandev_rw ) ( struct san_device *sandev, uint64_t lba, unsigned int count, - userptr_t buffer ) ) { + void *buffer ) ) { struct int13_data *int13 = sandev->priv; unsigned int cylinder, head, sector; unsigned long lba; unsigned int count; - userptr_t buffer; + void *buffer; int rc; /* Validate blocksize */ @@ -710,12 +709,12 @@ static int int13_extended_rw ( struct san_device *sandev, int ( * sandev_rw ) ( struct san_device *sandev, uint64_t lba, unsigned int count, - userptr_t buffer ) ) { + void *buffer ) ) { struct int13_disk_address addr; uint8_t bufsize; uint64_t lba; unsigned long count; - userptr_t buffer; + void *buffer; int rc; /* Extended reads are not allowed on floppy drives. @@ -1455,8 +1454,8 @@ static int int13_load_eltorito ( unsigned int drive, struct segoff *address ) { "catalog (status %04x)\n", drive, status ); return -EIO; } - copy_from_user ( &catalog, phys_to_virt ( eltorito_cmd.buffer ), 0, - sizeof ( catalog ) ); + memcpy ( &catalog, phys_to_virt ( eltorito_cmd.buffer ), + sizeof ( catalog ) ); /* Sanity checks */ if ( catalog.valid.platform_id != ELTORITO_PLATFORM_X86 ) { diff --git a/src/core/blockdev.c b/src/core/blockdev.c index c219d9673..3513caafa 100644 --- a/src/core/blockdev.c +++ b/src/core/blockdev.c @@ -45,8 +45,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * @ret rc Return status code */ int block_read ( struct interface *control, struct interface *data, - uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + uint64_t lba, unsigned int count, void *buffer, + size_t len ) { struct interface *dest; block_read_TYPE ( void * ) *op = intf_get_dest_op ( control, block_read, &dest ); @@ -76,8 +76,8 @@ int block_read ( struct interface *control, struct interface *data, * @ret rc Return status code */ int block_write ( struct interface *control, struct interface *data, - uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + uint64_t lba, unsigned int count, void *buffer, + size_t len ) { struct interface *dest; block_write_TYPE ( void * ) *op = intf_get_dest_op ( control, block_write, &dest ); diff --git a/src/core/blocktrans.c b/src/core/blocktrans.c index f3be2ba2b..ba70462f2 100644 --- a/src/core/blocktrans.c +++ b/src/core/blocktrans.c @@ -81,7 +81,7 @@ static void blktrans_xferbuf_write ( struct xfer_buffer *xferbuf, size_t offset, if ( blktrans->buffer ) { /* Write data to buffer */ - copy_to_user ( blktrans->buffer, offset, data, len ); + memcpy ( ( blktrans->buffer + offset ), data, len ); } else { @@ -107,7 +107,7 @@ static void blktrans_xferbuf_read ( struct xfer_buffer *xferbuf, size_t offset, if ( blktrans->buffer ) { /* Read data from buffer */ - copy_from_user ( data, blktrans->buffer, offset, len ); + memcpy ( data, ( blktrans->buffer + offset ), len ); } else { @@ -216,11 +216,11 @@ static struct interface_descriptor blktrans_xfer_desc = * Insert block device translator * * @v block Block device interface - * @v buffer Data buffer (or UNULL) + * @v buffer Data buffer (or NULL) * @v size Length of data buffer, or block size * @ret rc Return status code */ -int block_translate ( struct interface *block, userptr_t buffer, size_t size ) { +int block_translate ( struct interface *block, void *buffer, size_t size ) { struct block_translator *blktrans; int rc; diff --git a/src/core/dummy_sanboot.c b/src/core/dummy_sanboot.c index e22998da5..5ca120aac 100644 --- a/src/core/dummy_sanboot.c +++ b/src/core/dummy_sanboot.c @@ -29,6 +29,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ +#include #include #include diff --git a/src/core/sanboot.c b/src/core/sanboot.c index 4facf86b8..bdac813ff 100644 --- a/src/core/sanboot.c +++ b/src/core/sanboot.c @@ -424,10 +424,10 @@ int sandev_reopen ( struct san_device *sandev ) { struct san_command_rw_params { /** SAN device read/write operation */ int ( * block_rw ) ( struct interface *control, struct interface *data, - uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ); + uint64_t lba, unsigned int count, void *buffer, + size_t len ); /** Data buffer */ - userptr_t buffer; + void *buffer; /** Starting LBA */ uint64_t lba; /** Block count */ @@ -594,11 +594,11 @@ int sandev_reset ( struct san_device *sandev ) { * @ret rc Return status code */ static int sandev_rw ( struct san_device *sandev, uint64_t lba, - unsigned int count, userptr_t buffer, + unsigned int count, void *buffer, int ( * block_rw ) ( struct interface *control, struct interface *data, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) ) { + void *buffer, size_t len ) ) { union san_command_params params; unsigned int remaining; size_t frag_len; @@ -643,11 +643,12 @@ static int sandev_rw ( struct san_device *sandev, uint64_t lba, * @ret rc Return status code */ int sandev_read ( struct san_device *sandev, uint64_t lba, - unsigned int count, userptr_t buffer ) { + unsigned int count, void *buffer ) { int rc; /* Read from device */ - if ( ( rc = sandev_rw ( sandev, lba, count, buffer, block_read ) ) != 0 ) + if ( ( rc = sandev_rw ( sandev, lba, count, buffer, + block_read ) ) != 0 ) return rc; return 0; @@ -663,11 +664,12 @@ int sandev_read ( struct san_device *sandev, uint64_t lba, * @ret rc Return status code */ int sandev_write ( struct san_device *sandev, uint64_t lba, - unsigned int count, userptr_t buffer ) { + unsigned int count, void *buffer ) { int rc; /* Write to device */ - if ( ( rc = sandev_rw ( sandev, lba, count, buffer, block_write ) ) != 0 ) + if ( ( rc = sandev_rw ( sandev, lba, count, buffer, + block_write ) ) != 0 ) return rc; /* Quiesce system. This is a heuristic designed to ensure @@ -799,8 +801,7 @@ static int sandev_parse_iso9660 ( struct san_device *sandev ) { } /* Read primary volume descriptor */ - if ( ( rc = sandev_read ( sandev, lba, count, - virt_to_user ( scratch ) ) ) != 0 ) { + if ( ( rc = sandev_read ( sandev, lba, count, scratch ) ) != 0 ) { DBGC ( sandev->drive, "SAN %#02x could not read ISO9660 " "primary volume descriptor: %s\n", sandev->drive, strerror ( rc ) ); diff --git a/src/drivers/block/ata.c b/src/drivers/block/ata.c index b1c6855a0..cf98d7c9f 100644 --- a/src/drivers/block/ata.c +++ b/src/drivers/block/ata.c @@ -147,8 +147,8 @@ struct ata_command_type { * @ret data_in Data-in buffer * @ret data_in_len Data-in buffer length */ - void ( * data_in ) ( struct ata_command *atacmd, userptr_t buffer, - size_t len, userptr_t *data_in, + void ( * data_in ) ( struct ata_command *atacmd, void *buffer, + size_t len, void **data_in, size_t *data_in_len ); /** * Calculate data-out buffer @@ -160,8 +160,8 @@ struct ata_command_type { * @ret data_out Data-out buffer * @ret data_out_len Data-out buffer length */ - void ( * data_out ) ( struct ata_command *atacmd, userptr_t buffer, - size_t len, userptr_t *data_out, + void ( * data_out ) ( struct ata_command *atacmd, void *buffer, + size_t len, void **data_out, size_t *data_out_len ); /** * Handle ATA command completion @@ -285,8 +285,8 @@ static void atacmd_done ( struct ata_command *atacmd, int rc ) { * @ret data_len Data buffer length */ static void atacmd_data_buffer ( struct ata_command *atacmd __unused, - userptr_t buffer, size_t len, - userptr_t *data, size_t *data_len ) { + void *buffer, size_t len, + void **data, size_t *data_len ) { *data = buffer; *data_len = len; } @@ -301,8 +301,8 @@ static void atacmd_data_buffer ( struct ata_command *atacmd __unused, * @ret data_len Data buffer length */ static void atacmd_data_none ( struct ata_command *atacmd __unused, - userptr_t buffer __unused, size_t len __unused, - userptr_t *data __unused, + void *buffer __unused, size_t len __unused, + void **data __unused, size_t *data_len __unused ) { /* Nothing to do */ } @@ -317,9 +317,9 @@ static void atacmd_data_none ( struct ata_command *atacmd __unused, * @ret data_len Data buffer length */ static void atacmd_data_priv ( struct ata_command *atacmd, - userptr_t buffer __unused, size_t len __unused, - userptr_t *data, size_t *data_len ) { - *data = virt_to_user ( atacmd_priv ( atacmd ) ); + void *buffer __unused, size_t len __unused, + void **data, size_t *data_len ) { + *data = atacmd_priv ( atacmd ); *data_len = atacmd->type->priv_len; } @@ -455,7 +455,7 @@ static int atadev_command ( struct ata_device *atadev, struct interface *block, struct ata_command_type *type, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + void *buffer, size_t len ) { struct ata_command *atacmd; struct ata_cmd command; int tag; @@ -543,7 +543,7 @@ static int atadev_command ( struct ata_device *atadev, static int atadev_read ( struct ata_device *atadev, struct interface *block, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + void *buffer, size_t len ) { return atadev_command ( atadev, block, &atacmd_read, lba, count, buffer, len ); } @@ -562,7 +562,7 @@ static int atadev_read ( struct ata_device *atadev, static int atadev_write ( struct ata_device *atadev, struct interface *block, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + void *buffer, size_t len ) { return atadev_command ( atadev, block, &atacmd_write, lba, count, buffer, len ); } @@ -581,7 +581,7 @@ static int atadev_read_capacity ( struct ata_device *atadev, assert ( atacmd_identify.priv_len == sizeof ( *identity ) ); assert ( atacmd_identify.priv_len == ATA_SECTOR_SIZE ); return atadev_command ( atadev, block, &atacmd_identify, - 0, 1, UNULL, ATA_SECTOR_SIZE ); + 0, 1, NULL, ATA_SECTOR_SIZE ); } /** diff --git a/src/drivers/block/scsi.c b/src/drivers/block/scsi.c index ff415f5c6..251210d4f 100644 --- a/src/drivers/block/scsi.c +++ b/src/drivers/block/scsi.c @@ -279,7 +279,7 @@ struct scsi_command { /** Number of blocks */ unsigned int count; /** Data buffer */ - userptr_t buffer; + void *buffer; /** Length of data buffer */ size_t len; /** Command tag */ @@ -591,12 +591,12 @@ static void scsicmd_read_capacity_cmd ( struct scsi_command *scsicmd, readcap16->service_action = SCSI_SERVICE_ACTION_READ_CAPACITY_16; readcap16->len = cpu_to_be32 ( sizeof ( *capacity16 ) ); - command->data_in = virt_to_user ( capacity16 ); + command->data_in = capacity16; command->data_in_len = sizeof ( *capacity16 ); } else { /* Use READ CAPACITY (10) */ readcap10->opcode = SCSI_OPCODE_READ_CAPACITY_10; - command->data_in = virt_to_user ( capacity10 ); + command->data_in = capacity10; command->data_in_len = sizeof ( *capacity10 ); } } @@ -721,7 +721,7 @@ static int scsidev_command ( struct scsi_device *scsidev, struct interface *block, struct scsi_command_type *type, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + void *buffer, size_t len ) { struct scsi_command *scsicmd; int rc; @@ -773,7 +773,7 @@ static int scsidev_command ( struct scsi_device *scsidev, static int scsidev_read ( struct scsi_device *scsidev, struct interface *block, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + void *buffer, size_t len ) { return scsidev_command ( scsidev, block, &scsicmd_read, lba, count, buffer, len ); } @@ -792,7 +792,7 @@ static int scsidev_read ( struct scsi_device *scsidev, static int scsidev_write ( struct scsi_device *scsidev, struct interface *block, uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ) { + void *buffer, size_t len ) { return scsidev_command ( scsidev, block, &scsicmd_write, lba, count, buffer, len ); } @@ -807,7 +807,7 @@ static int scsidev_write ( struct scsi_device *scsidev, static int scsidev_read_capacity ( struct scsi_device *scsidev, struct interface *block ) { return scsidev_command ( scsidev, block, &scsicmd_read_capacity, - 0, 0, UNULL, 0 ); + 0, 0, NULL, 0 ); } /** @@ -820,7 +820,7 @@ static int scsidev_read_capacity ( struct scsi_device *scsidev, static int scsidev_test_unit_ready ( struct scsi_device *scsidev, struct interface *block ) { return scsidev_command ( scsidev, block, &scsicmd_test_unit_ready, - 0, 0, UNULL, 0 ); + 0, 0, NULL, 0 ); } /** diff --git a/src/drivers/usb/usbblk.c b/src/drivers/usb/usbblk.c index 5a086d3f8..39adc012f 100644 --- a/src/drivers/usb/usbblk.c +++ b/src/drivers/usb/usbblk.c @@ -205,7 +205,7 @@ static int usbblk_out_data ( struct usbblk_device *usbblk ) { /* Calculate length */ assert ( cmd->tag ); - assert ( cmd->scsi.data_out != UNULL ); + assert ( cmd->scsi.data_out != NULL ); assert ( cmd->offset < cmd->scsi.data_out_len ); len = ( cmd->scsi.data_out_len - cmd->offset ); if ( len > USBBLK_MAX_LEN ) @@ -220,8 +220,8 @@ static int usbblk_out_data ( struct usbblk_device *usbblk ) { } /* Populate I/O buffer */ - copy_from_user ( iob_put ( iobuf, len ), cmd->scsi.data_out, - cmd->offset, len ); + memcpy ( iob_put ( iobuf, len ), + ( cmd->scsi.data_out + cmd->offset ), len ); /* Send data */ if ( ( rc = usb_stream ( &usbblk->out, iobuf, 0 ) ) != 0 ) { @@ -332,12 +332,12 @@ static int usbblk_in_data ( struct usbblk_device *usbblk, const void *data, /* Sanity checks */ assert ( cmd->tag ); - assert ( cmd->scsi.data_in != UNULL ); + assert ( cmd->scsi.data_in != NULL ); assert ( cmd->offset <= cmd->scsi.data_in_len ); assert ( len <= ( cmd->scsi.data_in_len - cmd->offset ) ); /* Store data */ - copy_to_user ( cmd->scsi.data_in, cmd->offset, data, len ); + memcpy ( ( cmd->scsi.data_in + cmd->offset ), data, len ); cmd->offset += len; return 0; diff --git a/src/include/ipxe/ata.h b/src/include/ipxe/ata.h index a10cfafcc..cd78cd795 100644 --- a/src/include/ipxe/ata.h +++ b/src/include/ipxe/ata.h @@ -2,7 +2,6 @@ #define _IPXE_ATA_H #include -#include #include /** @file @@ -173,7 +172,7 @@ struct ata_cmd { * If non-NULL, this buffer must be ata_command::cb::count * sectors in size. */ - userptr_t data_out; + void *data_out; /** Data-out buffer length * * Must be zero if @c data_out is NULL @@ -184,7 +183,7 @@ struct ata_cmd { * If non-NULL, this buffer must be ata_command::cb::count * sectors in size. */ - userptr_t data_in; + void *data_in; /** Data-in buffer length * * Must be zero if @c data_in is NULL diff --git a/src/include/ipxe/blockdev.h b/src/include/ipxe/blockdev.h index 418c43004..ef6fc8d5a 100644 --- a/src/include/ipxe/blockdev.h +++ b/src/include/ipxe/blockdev.h @@ -11,7 +11,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include -#include #include /** Block device capacity */ @@ -25,20 +24,20 @@ struct block_device_capacity { }; extern int block_read ( struct interface *control, struct interface *data, - uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ); + uint64_t lba, unsigned int count, void *buffer, + size_t len ); #define block_read_TYPE( object_type ) \ typeof ( int ( object_type, struct interface *data, \ uint64_t lba, unsigned int count, \ - userptr_t buffer, size_t len ) ) + void *buffer, size_t len ) ) extern int block_write ( struct interface *control, struct interface *data, - uint64_t lba, unsigned int count, - userptr_t buffer, size_t len ); + uint64_t lba, unsigned int count, void *buffer, + size_t len ); #define block_write_TYPE( object_type ) \ typeof ( int ( object_type, struct interface *data, \ uint64_t lba, unsigned int count, \ - userptr_t buffer, size_t len ) ) + void *buffer, size_t len ) ) extern int block_read_capacity ( struct interface *control, struct interface *data ); diff --git a/src/include/ipxe/blocktrans.h b/src/include/ipxe/blocktrans.h index fee71b96c..1167a256e 100644 --- a/src/include/ipxe/blocktrans.h +++ b/src/include/ipxe/blocktrans.h @@ -13,7 +13,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include /** A block device translator */ struct block_translator { @@ -27,12 +26,12 @@ struct block_translator { /** Data transfer buffer */ struct xfer_buffer xferbuf; /** Data buffer */ - userptr_t buffer; + void *buffer; /** Block size */ size_t blksize; }; -extern int block_translate ( struct interface *block, - userptr_t buffer, size_t size ); +extern int block_translate ( struct interface *block, void *buffer, + size_t size ); #endif /* _IPXE_BLOCKTRANS_H */ diff --git a/src/include/ipxe/sanboot.h b/src/include/ipxe/sanboot.h index e44367cdb..9d5fceee0 100644 --- a/src/include/ipxe/sanboot.h +++ b/src/include/ipxe/sanboot.h @@ -261,9 +261,9 @@ extern struct san_device * sandev_next ( unsigned int drive ); extern int sandev_reopen ( struct san_device *sandev ); extern int sandev_reset ( struct san_device *sandev ); extern int sandev_read ( struct san_device *sandev, uint64_t lba, - unsigned int count, userptr_t buffer ); + unsigned int count, void *buffer ); extern int sandev_write ( struct san_device *sandev, uint64_t lba, - unsigned int count, userptr_t buffer ); + unsigned int count, void *buffer ); extern struct san_device * alloc_sandev ( struct uri **uris, unsigned int count, size_t priv_size ); extern int register_sandev ( struct san_device *sandev, unsigned int drive, diff --git a/src/include/ipxe/scsi.h b/src/include/ipxe/scsi.h index 28b55b2d5..9bb38a059 100644 --- a/src/include/ipxe/scsi.h +++ b/src/include/ipxe/scsi.h @@ -2,7 +2,6 @@ #define _IPXE_SCSI_H #include -#include #include /** @file @@ -252,14 +251,14 @@ struct scsi_cmd { /** CDB for this command */ union scsi_cdb cdb; /** Data-out buffer (may be NULL) */ - userptr_t data_out; + void *data_out; /** Data-out buffer length * * Must be zero if @c data_out is NULL */ size_t data_out_len; /** Data-in buffer (may be NULL) */ - userptr_t data_in; + void *data_in; /** Data-in buffer length * * Must be zero if @c data_in is NULL diff --git a/src/interface/efi/efi_block.c b/src/interface/efi/efi_block.c index 94e2aae06..aa5ec4e0f 100644 --- a/src/interface/efi/efi_block.c +++ b/src/interface/efi/efi_block.c @@ -95,8 +95,9 @@ struct efi_block_data { static int efi_block_rw ( struct san_device *sandev, uint64_t lba, void *data, size_t len, int ( * sandev_rw ) ( struct san_device *sandev, - uint64_t lba, unsigned int count, - userptr_t buffer ) ) { + uint64_t lba, + unsigned int count, + void *buffer ) ) { struct efi_block_data *block = sandev->priv; unsigned int count; int rc; diff --git a/src/net/aoe.c b/src/net/aoe.c index dba4f51b5..b484bdd33 100644 --- a/src/net/aoe.c +++ b/src/net/aoe.c @@ -33,7 +33,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include #include @@ -391,8 +390,7 @@ static void aoecmd_ata_cmd ( struct aoe_command *aoecmd, if ( ! command->cb.lba48 ) aoeata->lba.bytes[3] |= ( command->cb.device & ATA_DEV_MASK ); - copy_from_user ( aoeata->data, command->data_out, 0, - command->data_out_len ); + memcpy ( aoeata->data, command->data_out, command->data_out_len ); DBGC2 ( aoedev, "AoE %s/%08x ATA cmd %02x:%02x:%02x:%02x:%08llx", aoedev_name ( aoedev ), aoecmd->tag, aoeata->aflags, @@ -452,8 +450,7 @@ static int aoecmd_ata_rsp ( struct aoe_command *aoecmd, const void *data, } /* Copy out data payload */ - copy_to_user ( command->data_in, 0, aoeata->data, - command->data_in_len ); + memcpy ( command->data_in, aoeata->data, command->data_in_len ); return 0; } diff --git a/src/net/fcp.c b/src/net/fcp.c index f78f7bd9b..9701b5d54 100644 --- a/src/net/fcp.c +++ b/src/net/fcp.c @@ -413,7 +413,7 @@ static int fcpcmd_recv_rddata ( struct fcp_command *fcpcmd, fcpdev, fcpcmd->xchg_id, offset, ( offset + len ) ); /* Copy to user buffer */ - copy_to_user ( command->data_in, offset, iobuf->data, len ); + memcpy ( ( command->data_in + offset ), iobuf->data, len ); fcpcmd->offset += len; assert ( fcpcmd->offset <= command->data_in_len ); @@ -464,8 +464,8 @@ static int fcpcmd_send_wrdata ( struct fcp_command *fcpcmd ) { } /* Construct data IU frame */ - copy_from_user ( iob_put ( iobuf, len ), command->data_out, - fcpcmd->offset, len ); + memcpy ( iob_put ( iobuf, len ), + ( command->data_out + fcpcmd->offset ), len ); memset ( &meta, 0, sizeof ( meta ) ); meta.flags = ( XFER_FL_RESPONSE | XFER_FL_ABS_OFFSET ); meta.offset = fcpcmd->offset; diff --git a/src/net/tcp/httpblock.c b/src/net/tcp/httpblock.c index 1abd6b34d..156f11e47 100644 --- a/src/net/tcp/httpblock.c +++ b/src/net/tcp/httpblock.c @@ -31,7 +31,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include -#include #include #include #include @@ -52,7 +51,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * @ret rc Return status code */ int http_block_read ( struct http_transaction *http, struct interface *data, - uint64_t lba, unsigned int count, userptr_t buffer, + uint64_t lba, unsigned int count, void *buffer, size_t len ) { struct http_request_range range; int rc; @@ -101,7 +100,7 @@ int http_block_read_capacity ( struct http_transaction *http, goto err_open; /* Insert block device translator */ - if ( ( rc = block_translate ( data, UNULL, HTTP_BLKSIZE ) ) != 0 ) { + if ( ( rc = block_translate ( data, NULL, HTTP_BLKSIZE ) ) != 0 ) { DBGC ( http, "HTTP %p could not insert block translator: %s\n", http, strerror ( rc ) ); goto err_translate; diff --git a/src/net/tcp/httpcore.c b/src/net/tcp/httpcore.c index 7052bbbad..57c31ac26 100644 --- a/src/net/tcp/httpcore.c +++ b/src/net/tcp/httpcore.c @@ -503,7 +503,7 @@ http_content_buffer ( struct http_transaction *http ) { __weak int http_block_read ( struct http_transaction *http __unused, struct interface *data __unused, uint64_t lba __unused, unsigned int count __unused, - userptr_t buffer __unused, size_t len __unused ) { + void *buffer __unused, size_t len __unused ) { return -ENOTSUP; } diff --git a/src/net/tcp/iscsi.c b/src/net/tcp/iscsi.c index dd20849ce..b7b33a51a 100644 --- a/src/net/tcp/iscsi.c +++ b/src/net/tcp/iscsi.c @@ -39,7 +39,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include #include @@ -478,7 +477,7 @@ static int iscsi_rx_data_in ( struct iscsi_session *iscsi, assert ( iscsi->command != NULL ); assert ( iscsi->command->data_in ); assert ( ( offset + len ) <= iscsi->command->data_in_len ); - copy_to_user ( iscsi->command->data_in, offset, data, len ); + memcpy ( ( iscsi->command->data_in + offset ), data, len ); /* Wait for whole SCSI response to arrive */ if ( remaining ) @@ -598,8 +597,8 @@ static int iscsi_tx_data_out ( struct iscsi_session *iscsi ) { if ( ! iobuf ) return -ENOMEM; - copy_from_user ( iob_put ( iobuf, len ), - iscsi->command->data_out, offset, len ); + memcpy ( iob_put ( iobuf, len ), + ( iscsi->command->data_out + offset ), len ); memset ( iob_put ( iobuf, pad_len ), 0, pad_len ); return xfer_deliver_iob ( &iscsi->socket, iobuf ); -- cgit v1.2.3-55-g7522 From 837b77293beafa15f8a125a484a0d17453b021f8 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 29 Apr 2025 09:16:41 +0100 Subject: [xferbuf] Simplify and generalise data transfer buffers Since all data transfer buffer contents are now accessible via direct pointer dereferences, remove the unnecessary abstractions for read and write operations and create two new data transfer buffer types: a fixed-size buffer, and a void buffer that records its size but can never receive non-zero lengths of data. These replace the custom data buffer types currently implemented for EFI PXE TFTP downloads and for block device translations. A new operation xferbuf_detach() is required to take ownership of the data accumulated in the data transfer buffer, since we no longer rely on the existence of an independently owned external data pointer for data transfer buffers allocated via umalloc(). Signed-off-by: Michael Brown --- src/core/blocktrans.c | 90 +----------------------------- src/core/downloader.c | 16 ++++-- src/core/xferbuf.c | 124 ++++++++++++++++++++++-------------------- src/include/ipxe/blocktrans.h | 2 - src/include/ipxe/xferbuf.h | 67 +++++++++++++---------- src/interface/efi/efi_pxe.c | 47 +--------------- src/net/peermux.c | 7 +-- 7 files changed, 119 insertions(+), 234 deletions(-) (limited to 'src/net') diff --git a/src/core/blocktrans.c b/src/core/blocktrans.c index ba70462f2..362721747 100644 --- a/src/core/blocktrans.c +++ b/src/core/blocktrans.c @@ -38,91 +38,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include -/** - * Reallocate block device translator data buffer - * - * @v xferbuf Data transfer buffer - * @v len New length (or zero to free buffer) - * @ret rc Return status code - */ -static int blktrans_xferbuf_realloc ( struct xfer_buffer *xferbuf, - size_t len ) { - struct block_translator *blktrans = - container_of ( xferbuf, struct block_translator, xferbuf ); - - /* Record length, if applicable */ - if ( blktrans->buffer ) { - - /* We have a (non-reallocatable) data buffer */ - return -ENOTSUP; - - } else { - - /* Record length (for block device capacity) */ - xferbuf->len = len; - return 0; - } -} - -/** - * Write data to block device translator data buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to copy - * @v len Length of data - */ -static void blktrans_xferbuf_write ( struct xfer_buffer *xferbuf, size_t offset, - const void *data, size_t len ) { - struct block_translator *blktrans = - container_of ( xferbuf, struct block_translator, xferbuf ); - - /* Write data to buffer, if applicable */ - if ( blktrans->buffer ) { - - /* Write data to buffer */ - memcpy ( ( blktrans->buffer + offset ), data, len ); - - } else { - - /* Sanity check */ - assert ( len == 0 ); - } -} - -/** - * Read data from block device translator data buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to read - * @v len Length of data - */ -static void blktrans_xferbuf_read ( struct xfer_buffer *xferbuf, size_t offset, - void *data, size_t len ) { - struct block_translator *blktrans = - container_of ( xferbuf, struct block_translator, xferbuf ); - - /* Read data from buffer, if applicable */ - if ( blktrans->buffer ) { - - /* Read data from buffer */ - memcpy ( data, ( blktrans->buffer + offset ), len ); - - } else { - - /* Sanity check */ - assert ( len == 0 ); - } -} - -/** Block device translator data transfer buffer operations */ -static struct xfer_buffer_operations blktrans_xferbuf_operations = { - .realloc = blktrans_xferbuf_realloc, - .write = blktrans_xferbuf_write, - .read = blktrans_xferbuf_read, -}; - /** * Close block device translator * @@ -233,11 +148,10 @@ int block_translate ( struct interface *block, void *buffer, size_t size ) { ref_init ( &blktrans->refcnt, NULL ); intf_init ( &blktrans->block, &blktrans_block_desc, &blktrans->refcnt ); intf_init ( &blktrans->xfer, &blktrans_xfer_desc, &blktrans->refcnt ); - blktrans->xferbuf.op = &blktrans_xferbuf_operations; - blktrans->buffer = buffer; if ( buffer ) { - blktrans->xferbuf.len = size; + xferbuf_fixed_init ( &blktrans->xferbuf, buffer, size ); } else { + xferbuf_void_init ( &blktrans->xferbuf ); blktrans->blksize = size; } diff --git a/src/core/downloader.c b/src/core/downloader.c index 33737bfac..449761836 100644 --- a/src/core/downloader.c +++ b/src/core/downloader.c @@ -67,6 +67,7 @@ static void downloader_free ( struct refcnt *refcnt ) { struct downloader *downloader = container_of ( refcnt, struct downloader, refcnt ); + xferbuf_free ( &downloader->buffer ); image_put ( downloader->image ); free ( downloader ); } @@ -78,18 +79,21 @@ static void downloader_free ( struct refcnt *refcnt ) { * @v rc Reason for termination */ static void downloader_finished ( struct downloader *downloader, int rc ) { + struct xfer_buffer *buffer = &downloader->buffer; + struct image *image = downloader->image; /* Log download status */ if ( rc == 0 ) { - syslog ( LOG_NOTICE, "Downloaded \"%s\"\n", - downloader->image->name ); + syslog ( LOG_NOTICE, "Downloaded \"%s\"\n", image->name ); } else { syslog ( LOG_ERR, "Download of \"%s\" failed: %s\n", - downloader->image->name, strerror ( rc ) ); + image->name, strerror ( rc ) ); } - /* Update image length */ - downloader->image->len = downloader->buffer.len; + /* Transfer ownership from data transfer buffer to image */ + image->data = buffer->data; + image->len = buffer->len; + xferbuf_detach ( buffer ); /* Shut down interfaces */ intf_shutdown ( &downloader->xfer, rc ); @@ -269,7 +273,7 @@ int create_downloader ( struct interface *job, struct image *image ) { intf_init ( &downloader->xfer, &downloader_xfer_desc, &downloader->refcnt ); downloader->image = image_get ( image ); - xferbuf_umalloc_init ( &downloader->buffer, &image->data ); + xferbuf_umalloc_init ( &downloader->buffer ); /* Instantiate child objects and attach to our interfaces */ if ( ( rc = xfer_open_uri ( &downloader->xfer, image->uri ) ) != 0 ) diff --git a/src/core/xferbuf.c b/src/core/xferbuf.c index 1c08f8bc3..d93526577 100644 --- a/src/core/xferbuf.c +++ b/src/core/xferbuf.c @@ -50,6 +50,21 @@ static struct profiler xferbuf_write_profiler __profiler = static struct profiler xferbuf_read_profiler __profiler = { .name = "xferbuf.read" }; +/** + * Detach data from data transfer buffer + * + * @v xferbuf Data transfer buffer + * + * The caller assumes responsibility for eventually freeing the data + * previously owned by the data transfer buffer. + */ +void xferbuf_detach ( struct xfer_buffer *xferbuf ) { + + xferbuf->data = NULL; + xferbuf->len = 0; + xferbuf->pos = 0; +} + /** * Free data transfer buffer * @@ -58,8 +73,7 @@ static struct profiler xferbuf_read_profiler __profiler = void xferbuf_free ( struct xfer_buffer *xferbuf ) { xferbuf->op->realloc ( xferbuf, 0 ); - xferbuf->len = 0; - xferbuf->pos = 0; + xferbuf_detach ( xferbuf ); } /** @@ -109,9 +123,13 @@ int xferbuf_write ( struct xfer_buffer *xferbuf, size_t offset, if ( ( rc = xferbuf_ensure_size ( xferbuf, max_len ) ) != 0 ) return rc; + /* Check that buffer is non-void */ + if ( len && ( ! xferbuf->data ) ) + return -ENOTTY; + /* Copy data to buffer */ profile_start ( &xferbuf_write_profiler ); - xferbuf->op->write ( xferbuf, offset, data, len ); + memcpy ( ( xferbuf->data + offset ), data, len ); profile_stop ( &xferbuf_write_profiler ); return 0; @@ -133,9 +151,13 @@ int xferbuf_read ( struct xfer_buffer *xferbuf, size_t offset, ( len > ( xferbuf->len - offset ) ) ) return -ENOENT; + /* Check that buffer is non-void */ + if ( len && ( ! xferbuf->data ) ) + return -ENOTTY; + /* Copy data from buffer */ profile_start ( &xferbuf_read_profiler ); - xferbuf->op->read ( xferbuf, offset, data, len ); + memcpy ( data, ( xferbuf->data + offset ), len ); profile_stop ( &xferbuf_read_profiler ); return 0; @@ -178,7 +200,7 @@ int xferbuf_deliver ( struct xfer_buffer *xferbuf, struct io_buffer *iobuf, } /** - * Reallocate malloc()-based data buffer + * Reallocate malloc()-based data transfer buffer * * @v xferbuf Data transfer buffer * @v len New length (or zero to free buffer) @@ -194,94 +216,76 @@ static int xferbuf_malloc_realloc ( struct xfer_buffer *xferbuf, size_t len ) { return 0; } -/** - * Write data to malloc()-based data buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to copy - * @v len Length of data - */ -static void xferbuf_malloc_write ( struct xfer_buffer *xferbuf, size_t offset, - const void *data, size_t len ) { - - memcpy ( ( xferbuf->data + offset ), data, len ); -} - -/** - * Read data from malloc()-based data buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to read - * @v len Length of data - */ -static void xferbuf_malloc_read ( struct xfer_buffer *xferbuf, size_t offset, - void *data, size_t len ) { - - memcpy ( data, ( xferbuf->data + offset ), len ); -} - /** malloc()-based data buffer operations */ struct xfer_buffer_operations xferbuf_malloc_operations = { .realloc = xferbuf_malloc_realloc, - .write = xferbuf_malloc_write, - .read = xferbuf_malloc_read, }; /** - * Reallocate umalloc()-based data buffer + * Reallocate umalloc()-based data transfer buffer * * @v xferbuf Data transfer buffer * @v len New length (or zero to free buffer) * @ret rc Return status code */ static int xferbuf_umalloc_realloc ( struct xfer_buffer *xferbuf, size_t len ) { - void **udata = xferbuf->data; void *new_udata; - new_udata = urealloc ( *udata, len ); + new_udata = urealloc ( xferbuf->data, len ); if ( ! new_udata ) return -ENOSPC; - *udata = new_udata; + xferbuf->data = new_udata; return 0; } +/** umalloc()-based data buffer operations */ +struct xfer_buffer_operations xferbuf_umalloc_operations = { + .realloc = xferbuf_umalloc_realloc, +}; + /** - * Write data to umalloc()-based data buffer + * Reallocate fixed-size data transfer buffer * * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to copy - * @v len Length of data + * @v len New length (or zero to free buffer) + * @ret rc Return status code */ -static void xferbuf_umalloc_write ( struct xfer_buffer *xferbuf, size_t offset, - const void *data, size_t len ) { - void **udata = xferbuf->data; +static int xferbuf_fixed_realloc ( struct xfer_buffer *xferbuf, size_t len ) { + + /* Refuse to allocate extra space */ + if ( len > xferbuf->len ) { + /* Note that EFI relies upon this error mapping to + * EFI_BUFFER_TOO_SMALL. + */ + return -ERANGE; + } - memcpy ( ( *udata + offset ), data, len ); + return 0; } +/** Fixed-size data buffer operations */ +struct xfer_buffer_operations xferbuf_fixed_operations = { + .realloc = xferbuf_fixed_realloc, +}; + /** - * Read data from umalloc()-based data buffer + * Reallocate void data transfer buffer * * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to read - * @v len Length of data + * @v len New length (or zero to free buffer) + * @ret rc Return status code */ -static void xferbuf_umalloc_read ( struct xfer_buffer *xferbuf, size_t offset, - void *data, size_t len ) { - void **udata = xferbuf->data; +static int xferbuf_void_realloc ( struct xfer_buffer *xferbuf, + size_t len __unused ) { - memcpy ( data, ( *udata + offset ), len ); + /* Succeed without ever allocating data */ + assert ( xferbuf->data == NULL ); + return 0; } -/** umalloc()-based data buffer operations */ -struct xfer_buffer_operations xferbuf_umalloc_operations = { - .realloc = xferbuf_umalloc_realloc, - .write = xferbuf_umalloc_write, - .read = xferbuf_umalloc_read, +/** Void data buffer operations */ +struct xfer_buffer_operations xferbuf_void_operations = { + .realloc = xferbuf_void_realloc, }; /** diff --git a/src/include/ipxe/blocktrans.h b/src/include/ipxe/blocktrans.h index 1167a256e..1eb388854 100644 --- a/src/include/ipxe/blocktrans.h +++ b/src/include/ipxe/blocktrans.h @@ -25,8 +25,6 @@ struct block_translator { /** Data transfer buffer */ struct xfer_buffer xferbuf; - /** Data buffer */ - void *buffer; /** Block size */ size_t blksize; }; diff --git a/src/include/ipxe/xferbuf.h b/src/include/ipxe/xferbuf.h index 04635999d..04fcf2286 100644 --- a/src/include/ipxe/xferbuf.h +++ b/src/include/ipxe/xferbuf.h @@ -35,41 +35,19 @@ struct xfer_buffer_operations { * @ret rc Return status code */ int ( * realloc ) ( struct xfer_buffer *xferbuf, size_t len ); - /** Write data to buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to write - * @v len Length of data - * - * This call is simply a wrapper for the appropriate - * memcpy()-like operation: the caller is responsible for - * ensuring that the write does not exceed the buffer length. - */ - void ( * write ) ( struct xfer_buffer *xferbuf, size_t offset, - const void *data, size_t len ); - /** Read data from buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to read - * @v len Length of data - * - * This call is simply a wrapper for the appropriate - * memcpy()-like operation: the caller is responsible for - * ensuring that the read does not exceed the buffer length. - */ - void ( * read ) ( struct xfer_buffer *xferbuf, size_t offset, - void *data, size_t len ); }; extern struct xfer_buffer_operations xferbuf_malloc_operations; extern struct xfer_buffer_operations xferbuf_umalloc_operations; +extern struct xfer_buffer_operations xferbuf_fixed_operations; +extern struct xfer_buffer_operations xferbuf_void_operations; /** * Initialise malloc()-based data transfer buffer * * @v xferbuf Data transfer buffer + * + * Data will be automatically allocated using malloc(). */ static inline __attribute__ (( always_inline )) void xferbuf_malloc_init ( struct xfer_buffer *xferbuf ) { @@ -80,14 +58,45 @@ xferbuf_malloc_init ( struct xfer_buffer *xferbuf ) { * Initialise umalloc()-based data transfer buffer * * @v xferbuf Data transfer buffer - * @v data User pointer + * + * Data will be automatically allocated using umalloc() (and may + * therefore alter the system memory map). */ static inline __attribute__ (( always_inline )) void -xferbuf_umalloc_init ( struct xfer_buffer *xferbuf, void **data ) { - xferbuf->data = data; +xferbuf_umalloc_init ( struct xfer_buffer *xferbuf ) { xferbuf->op = &xferbuf_umalloc_operations; } +/** + * Initialise fixed-size data transfer buffer + * + * @v xferbuf Data transfer buffer + * @v data Data buffer + * @v len Length of data buffer + * + * Data will be never be automatically allocated. + */ +static inline __attribute__ (( always_inline )) void +xferbuf_fixed_init ( struct xfer_buffer *xferbuf, void *data, size_t len ) { + xferbuf->data = data; + xferbuf->len = len; + xferbuf->op = &xferbuf_fixed_operations; +} + +/** + * Initialise void data transfer buffer + * + * @v xferbuf Data transfer buffer + * + * No data will be allocated, but the length will be recorded. This + * can be used to capture xfer_seek() results. + */ +static inline __attribute__ (( always_inline )) void +xferbuf_void_init ( struct xfer_buffer *xferbuf ) { + xferbuf->op = &xferbuf_void_operations; +} + +extern void xferbuf_detach ( struct xfer_buffer *xferbuf ); extern void xferbuf_free ( struct xfer_buffer *xferbuf ); extern int xferbuf_write ( struct xfer_buffer *xferbuf, size_t offset, const void *data, size_t len ); diff --git a/src/interface/efi/efi_pxe.c b/src/interface/efi/efi_pxe.c index 732ccdcdf..4ba057019 100644 --- a/src/interface/efi/efi_pxe.c +++ b/src/interface/efi/efi_pxe.c @@ -303,48 +303,6 @@ static int efi_pxe_ip_filter ( struct efi_pxe *pxe, EFI_IP_ADDRESS *ip ) { return 0; } -/****************************************************************************** - * - * Data transfer buffer - * - ****************************************************************************** - */ - -/** - * Reallocate PXE data transfer buffer - * - * @v xferbuf Data transfer buffer - * @v len New length (or zero to free buffer) - * @ret rc Return status code - */ -static int efi_pxe_buf_realloc ( struct xfer_buffer *xferbuf __unused, - size_t len __unused ) { - - /* Can never reallocate: return EFI_BUFFER_TOO_SMALL */ - return -ERANGE; -} - -/** - * Write data to PXE data transfer buffer - * - * @v xferbuf Data transfer buffer - * @v offset Starting offset - * @v data Data to copy - * @v len Length of data - */ -static void efi_pxe_buf_write ( struct xfer_buffer *xferbuf, size_t offset, - const void *data, size_t len ) { - - /* Copy data to buffer */ - memcpy ( ( xferbuf->data + offset ), data, len ); -} - -/** PXE data transfer buffer operations */ -static struct xfer_buffer_operations efi_pxe_buf_operations = { - .realloc = efi_pxe_buf_realloc, - .write = efi_pxe_buf_write, -}; - /****************************************************************************** * * (M)TFTP download interface @@ -966,8 +924,7 @@ efi_pxe_mtftp ( EFI_PXE_BASE_CODE_PROTOCOL *base, pxe->blksize = ( ( callback && blksize ) ? *blksize : -1UL ); /* Initialise data transfer buffer */ - pxe->buf.data = data; - pxe->buf.len = *len; + xferbuf_fixed_init ( &pxe->buf, data, *len ); /* Open download */ if ( ( rc = efi_pxe_tftp_open ( pxe, ip, @@ -987,6 +944,7 @@ efi_pxe_mtftp ( EFI_PXE_BASE_CODE_PROTOCOL *base, err_download: efi_pxe_tftp_close ( pxe, rc ); err_open: + xferbuf_fixed_init ( &pxe->buf, NULL, 0 ); efi_snp_release(); err_opcode: return EFIRC ( rc ); @@ -1611,7 +1569,6 @@ int efi_pxe_install ( EFI_HANDLE handle, struct net_device *netdev ) { pxe->base.Mode = &pxe->mode; memcpy ( &pxe->apple, &efi_apple_net_boot_protocol, sizeof ( pxe->apple ) ); - pxe->buf.op = &efi_pxe_buf_operations; intf_init ( &pxe->tftp, &efi_pxe_tftp_desc, &pxe->refcnt ); intf_init ( &pxe->udp, &efi_pxe_udp_desc, &pxe->refcnt ); INIT_LIST_HEAD ( &pxe->queue ); diff --git a/src/net/peermux.c b/src/net/peermux.c index a391ed373..431ca76e0 100644 --- a/src/net/peermux.c +++ b/src/net/peermux.c @@ -129,6 +129,7 @@ static int peermux_info_deliver ( struct peerdist_multiplexer *peermux, * @v rc Reason for close */ static void peermux_info_close ( struct peerdist_multiplexer *peermux, int rc ){ + struct xfer_buffer *buffer = &peermux->buffer; struct peerdist_info *info = &peermux->cache.info; size_t len; @@ -145,8 +146,7 @@ static void peermux_info_close ( struct peerdist_multiplexer *peermux, int rc ){ intf_shutdown ( &peermux->info, rc ); /* Parse content information */ - if ( ( rc = peerdist_info ( info->raw.data, peermux->buffer.len, - info ) ) != 0 ) { + if ( ( rc = peerdist_info ( buffer->data, buffer->len, info ) ) != 0 ) { DBGC ( peermux, "PEERMUX %p could not parse content info: %s\n", peermux, strerror ( rc ) ); goto err; @@ -422,8 +422,7 @@ int peermux_filter ( struct interface *xfer, struct interface *info, intf_init ( &peermux->xfer, &peermux_xfer_desc, &peermux->refcnt ); intf_init ( &peermux->info, &peermux_info_desc, &peermux->refcnt ); peermux->uri = uri_get ( uri ); - xferbuf_umalloc_init ( &peermux->buffer, - &peermux->cache.info.raw.data ); + xferbuf_umalloc_init ( &peermux->buffer ); process_init_stopped ( &peermux->process, &peermux_process_desc, &peermux->refcnt ); INIT_LIST_HEAD ( &peermux->busy ); -- cgit v1.2.3-55-g7522 From 54c4217bdd403c85af03c944b1b5d18a0655da5c Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 29 Apr 2025 09:17:14 +0100 Subject: [peerdist] Remove userptr_t from PeerDist content information parsing Signed-off-by: Michael Brown --- src/include/ipxe/pccrc.h | 5 ++--- src/net/pccrc.c | 5 +++-- src/tests/pccrc_test.c | 6 ++---- 3 files changed, 7 insertions(+), 9 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/pccrc.h b/src/include/ipxe/pccrc.h index 7f0963428..bec2b271a 100644 --- a/src/include/ipxe/pccrc.h +++ b/src/include/ipxe/pccrc.h @@ -11,7 +11,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include -#include #include /****************************************************************************** @@ -300,7 +299,7 @@ struct peerdist_info_v2_segment { /** Raw content information */ struct peerdist_raw { /** Data buffer */ - userptr_t data; + const void *data; /** Length of data buffer */ size_t len; }; @@ -435,7 +434,7 @@ struct peerdist_info_operations { extern struct digest_algorithm sha512_trunc_algorithm; -extern int peerdist_info ( userptr_t data, size_t len, +extern int peerdist_info ( const void *data, size_t len, struct peerdist_info *info ); extern int peerdist_info_segment ( const struct peerdist_info *info, struct peerdist_info_segment *segment, diff --git a/src/net/pccrc.c b/src/net/pccrc.c index a94bc0e11..29adc4b16 100644 --- a/src/net/pccrc.c +++ b/src/net/pccrc.c @@ -88,7 +88,7 @@ static int peerdist_info_get ( const struct peerdist_info *info, void *data, } /* Copy data */ - copy_from_user ( data, info->raw.data, offset, len ); + memcpy ( data, ( info->raw.data + offset ), len ); return 0; } @@ -667,7 +667,8 @@ static struct peerdist_info_operations peerdist_info_v2_operations = { * @v info Content information to fill in * @ret rc Return status code */ -int peerdist_info ( userptr_t data, size_t len, struct peerdist_info *info ) { +int peerdist_info ( const void *data, size_t len, + struct peerdist_info *info ) { union peerdist_info_version version; int rc; diff --git a/src/tests/pccrc_test.c b/src/tests/pccrc_test.c index e69493202..f3f38d360 100644 --- a/src/tests/pccrc_test.c +++ b/src/tests/pccrc_test.c @@ -35,7 +35,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include #include @@ -362,11 +361,10 @@ static void peerdist_info_okx ( struct peerdist_info_test *test, const char *file, unsigned int line ) { /* Parse content information */ - okx ( peerdist_info ( virt_to_user ( test->data ), test->len, - info ) == 0, file, line ); + okx ( peerdist_info ( test->data, test->len, info ) == 0, file, line ); /* Verify content information */ - okx ( info->raw.data == virt_to_user ( test->data ), file, line ); + okx ( info->raw.data == test->data, file, line ); okx ( info->raw.len == test->len, file, line ); okx ( info->digest == test->expected_digest, file, line ); okx ( info->digestsize == test->expected_digestsize, file, line ); -- cgit v1.2.3-55-g7522 From b6f9e4bab082c3b7a9b587ef64109069fba59baa Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 30 Apr 2025 15:18:34 +0100 Subject: [uaccess] Remove redundant copy_from_user() and copy_to_user() Remove the now-redundant copy_from_user() and copy_to_user() wrapper functions. Signed-off-by: Michael Brown --- src/arch/x86/core/runtime.c | 1 + src/arch/x86/drivers/xen/hvm.c | 1 + src/arch/x86/image/elfboot.c | 1 + src/arch/x86/image/initrd.c | 1 + src/arch/x86/image/multiboot.c | 1 + src/arch/x86/image/nbi.c | 1 + src/arch/x86/image/pxe_image.c | 1 + src/arch/x86/image/ucode.c | 1 + src/arch/x86/include/realmode.h | 1 + src/arch/x86/interface/pcbios/acpipwr.c | 1 + src/arch/x86/interface/pcbios/bios_cachedhcp.c | 1 + src/arch/x86/interface/pcbios/bios_reboot.c | 1 + src/arch/x86/interface/pcbios/biosint.c | 1 + src/arch/x86/interface/pcbios/hidemem.c | 1 + src/arch/x86/interface/pcbios/int13.c | 1 + src/arch/x86/interface/pcbios/memmap.c | 1 + src/arch/x86/interface/pcbios/memtop_umalloc.c | 1 + src/arch/x86/interface/pcbios/rsdp.c | 1 + src/core/blocktrans.c | 1 + src/core/cachedhcp.c | 1 + src/core/downloader.c | 1 + src/core/pixbuf.c | 1 + src/core/sanboot.c | 1 + src/drivers/bus/devtree.c | 1 + src/drivers/bus/ecam.c | 1 + src/drivers/bus/pci_settings.c | 1 + src/drivers/bus/usb_settings.c | 1 + src/drivers/infiniband/flexboot_nodnic.c | 1 + src/drivers/infiniband/linda.c | 1 + .../mlx_utils_flexboot/src/mlx_memory_priv.c | 1 + src/drivers/infiniband/qib7322.c | 1 + src/drivers/linux/slirp.c | 1 + src/drivers/net/ath/ath.h | 1 + src/drivers/net/ath/ath5k/ath5k.h | 1 + src/drivers/net/b44.c | 1 + src/drivers/net/bnxt/bnxt.c | 1 + src/drivers/net/eepro100.c | 1 + src/drivers/net/etherfabric.c | 1 + src/drivers/net/marvell/atl2_hw.c | 1 + src/drivers/net/marvell/atl_hw.c | 1 + src/drivers/net/myri10ge.c | 2 +- src/drivers/net/netvsc.c | 1 + src/drivers/net/rtl818x/rtl818x.c | 1 + src/drivers/net/sfc/efx_hunt.c | 1 + src/drivers/net/sfc/sfc_hunt.c | 1 + src/drivers/net/skge.c | 1 + src/drivers/net/sky2.c | 1 + src/drivers/net/tg3/tg3.c | 1 + src/drivers/net/tg3/tg3_hw.c | 1 + src/drivers/net/tg3/tg3_phy.c | 1 + src/drivers/net/vmxnet3.c | 1 + src/drivers/net/vxge/vxge_config.c | 1 + src/drivers/net/vxge/vxge_traffic.c | 1 + src/drivers/nvs/nvsvpd.c | 1 + src/drivers/usb/usbblk.c | 1 + src/hci/commands/cert_cmd.c | 1 + src/hci/commands/image_cmd.c | 1 + src/hci/commands/image_crypt_cmd.c | 1 + src/hci/commands/image_trust_cmd.c | 1 + src/hci/commands/pci_cmd.c | 1 + src/hci/commands/usb_cmd.c | 1 + src/image/der.c | 1 + src/image/efi_image.c | 1 + src/image/efi_siglist.c | 1 + src/image/elf.c | 1 + src/image/pnm.c | 1 + src/image/segment.c | 1 + src/include/ipxe/dummy_pio.h | 2 ++ src/include/ipxe/iomap_virt.h | 2 ++ src/include/ipxe/uaccess.h | 27 ---------------------- src/interface/efi/efi_bofm.c | 1 + src/interface/efi/efi_cmdline.c | 1 + src/interface/efi/efi_pci.c | 1 + src/interface/xen/xenbus.c | 1 + src/net/eapol.c | 1 + src/net/fcoe.c | 1 + src/net/lldp.c | 1 + src/net/peerblk.c | 1 + src/net/peermux.c | 1 + src/net/tcp/httpblock.c | 1 + src/net/tcp/syslogs.c | 1 + src/net/udp/syslog.c | 1 + src/tests/asn1_test.c | 1 + src/tests/cpio_test.c | 1 + src/tests/pixbuf_test.c | 1 + src/tests/test.c | 1 + src/usr/imgarchive.c | 1 + src/usr/imgmgmt.c | 1 + src/usr/imgtrust.c | 1 + 89 files changed, 90 insertions(+), 28 deletions(-) (limited to 'src/net') diff --git a/src/arch/x86/core/runtime.c b/src/arch/x86/core/runtime.c index 1fdf80497..461188d04 100644 --- a/src/arch/x86/core/runtime.c +++ b/src/arch/x86/core/runtime.c @@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include diff --git a/src/arch/x86/drivers/xen/hvm.c b/src/arch/x86/drivers/xen/hvm.c index b77cdd14c..cf41cc955 100644 --- a/src/arch/x86/drivers/xen/hvm.c +++ b/src/arch/x86/drivers/xen/hvm.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/arch/x86/image/elfboot.c b/src/arch/x86/image/elfboot.c index 63a3460d3..f662e366f 100644 --- a/src/arch/x86/image/elfboot.c +++ b/src/arch/x86/image/elfboot.c @@ -23,6 +23,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/arch/x86/image/initrd.c b/src/arch/x86/image/initrd.c index 8acdd95f7..cb4879036 100644 --- a/src/arch/x86/image/initrd.c +++ b/src/arch/x86/image/initrd.c @@ -23,6 +23,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/arch/x86/image/multiboot.c b/src/arch/x86/image/multiboot.c index 7c8963475..9444c4047 100644 --- a/src/arch/x86/image/multiboot.c +++ b/src/arch/x86/image/multiboot.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/arch/x86/image/nbi.c b/src/arch/x86/image/nbi.c index 0a60283fb..0f57bdfcd 100644 --- a/src/arch/x86/image/nbi.c +++ b/src/arch/x86/image/nbi.c @@ -1,3 +1,4 @@ +#include #include #include #include diff --git a/src/arch/x86/image/pxe_image.c b/src/arch/x86/image/pxe_image.c index d7acd0084..3e6cf7268 100644 --- a/src/arch/x86/image/pxe_image.c +++ b/src/arch/x86/image/pxe_image.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ +#include #include #include #include diff --git a/src/arch/x86/image/ucode.c b/src/arch/x86/image/ucode.c index 0ae3863cb..fd4689e00 100644 --- a/src/arch/x86/image/ucode.c +++ b/src/arch/x86/image/ucode.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/arch/x86/include/realmode.h b/src/arch/x86/include/realmode.h index 75f7d16e7..5cf644a23 100644 --- a/src/arch/x86/include/realmode.h +++ b/src/arch/x86/include/realmode.h @@ -2,6 +2,7 @@ #define REALMODE_H #include +#include #include #include diff --git a/src/arch/x86/interface/pcbios/acpipwr.c b/src/arch/x86/interface/pcbios/acpipwr.c index bff53806b..cb82ef1b4 100644 --- a/src/arch/x86/interface/pcbios/acpipwr.c +++ b/src/arch/x86/interface/pcbios/acpipwr.c @@ -23,6 +23,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/bios_cachedhcp.c b/src/arch/x86/interface/pcbios/bios_cachedhcp.c index 05d89b3b7..897858143 100644 --- a/src/arch/x86/interface/pcbios/bios_cachedhcp.c +++ b/src/arch/x86/interface/pcbios/bios_cachedhcp.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/bios_reboot.c b/src/arch/x86/interface/pcbios/bios_reboot.c index 463470245..c7f25405f 100644 --- a/src/arch/x86/interface/pcbios/bios_reboot.c +++ b/src/arch/x86/interface/pcbios/bios_reboot.c @@ -29,6 +29,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/biosint.c b/src/arch/x86/interface/pcbios/biosint.c index 667e9ed81..f5e54ede8 100644 --- a/src/arch/x86/interface/pcbios/biosint.c +++ b/src/arch/x86/interface/pcbios/biosint.c @@ -1,3 +1,4 @@ +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/hidemem.c b/src/arch/x86/interface/pcbios/hidemem.c index 1a3022c5d..6983c1f4a 100644 --- a/src/arch/x86/interface/pcbios/hidemem.c +++ b/src/arch/x86/interface/pcbios/hidemem.c @@ -22,6 +22,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/int13.c b/src/arch/x86/interface/pcbios/int13.c index 73fdfebd3..045d78e8d 100644 --- a/src/arch/x86/interface/pcbios/int13.c +++ b/src/arch/x86/interface/pcbios/int13.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/memmap.c b/src/arch/x86/interface/pcbios/memmap.c index daae382b8..3bc1229aa 100644 --- a/src/arch/x86/interface/pcbios/memmap.c +++ b/src/arch/x86/interface/pcbios/memmap.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/memtop_umalloc.c b/src/arch/x86/interface/pcbios/memtop_umalloc.c index d4489fb01..bfaffc4bb 100644 --- a/src/arch/x86/interface/pcbios/memtop_umalloc.c +++ b/src/arch/x86/interface/pcbios/memtop_umalloc.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/arch/x86/interface/pcbios/rsdp.c b/src/arch/x86/interface/pcbios/rsdp.c index 6bcf19b18..6913be552 100644 --- a/src/arch/x86/interface/pcbios/rsdp.c +++ b/src/arch/x86/interface/pcbios/rsdp.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/core/blocktrans.c b/src/core/blocktrans.c index 362721747..b793185fe 100644 --- a/src/core/blocktrans.c +++ b/src/core/blocktrans.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/core/cachedhcp.c b/src/core/cachedhcp.c index 0d400db16..1510f3321 100644 --- a/src/core/cachedhcp.c +++ b/src/core/cachedhcp.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/core/downloader.c b/src/core/downloader.c index 449761836..9950fe5e4 100644 --- a/src/core/downloader.c +++ b/src/core/downloader.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/core/pixbuf.c b/src/core/pixbuf.c index d0b80b2a9..506a28c38 100644 --- a/src/core/pixbuf.c +++ b/src/core/pixbuf.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/core/sanboot.c b/src/core/sanboot.c index bdac813ff..e90c5ef1d 100644 --- a/src/core/sanboot.c +++ b/src/core/sanboot.c @@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/drivers/bus/devtree.c b/src/drivers/bus/devtree.c index cbd8ea8fa..654f8d14f 100644 --- a/src/drivers/bus/devtree.c +++ b/src/drivers/bus/devtree.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/drivers/bus/ecam.c b/src/drivers/bus/ecam.c index 58d513e88..35556a8d9 100644 --- a/src/drivers/bus/ecam.c +++ b/src/drivers/bus/ecam.c @@ -23,6 +23,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/drivers/bus/pci_settings.c b/src/drivers/bus/pci_settings.c index 98005559d..84aa76827 100644 --- a/src/drivers/bus/pci_settings.c +++ b/src/drivers/bus/pci_settings.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/drivers/bus/usb_settings.c b/src/drivers/bus/usb_settings.c index db6f94d8a..4fd190d83 100644 --- a/src/drivers/bus/usb_settings.c +++ b/src/drivers/bus/usb_settings.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/drivers/infiniband/flexboot_nodnic.c b/src/drivers/infiniband/flexboot_nodnic.c index c6e19b955..a9e6fdd71 100644 --- a/src/drivers/infiniband/flexboot_nodnic.c +++ b/src/drivers/infiniband/flexboot_nodnic.c @@ -20,6 +20,7 @@ FILE_LICENCE ( GPL2_OR_LATER ); #include +#include #include #include #include diff --git a/src/drivers/infiniband/linda.c b/src/drivers/infiniband/linda.c index 0c8a043a1..2e2b469e4 100644 --- a/src/drivers/infiniband/linda.c +++ b/src/drivers/infiniband/linda.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/drivers/infiniband/mlx_utils_flexboot/src/mlx_memory_priv.c b/src/drivers/infiniband/mlx_utils_flexboot/src/mlx_memory_priv.c index e368d459b..b35c30dee 100644 --- a/src/drivers/infiniband/mlx_utils_flexboot/src/mlx_memory_priv.c +++ b/src/drivers/infiniband/mlx_utils_flexboot/src/mlx_memory_priv.c @@ -7,6 +7,7 @@ #include #include +#include #include #include #include "../../mlx_utils/include/private/mlx_memory_priv.h" diff --git a/src/drivers/infiniband/qib7322.c b/src/drivers/infiniband/qib7322.c index a011dafc1..a9e4566dc 100644 --- a/src/drivers/infiniband/qib7322.c +++ b/src/drivers/infiniband/qib7322.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/drivers/linux/slirp.c b/src/drivers/linux/slirp.c index 8341c9676..d7ab6419e 100644 --- a/src/drivers/linux/slirp.c +++ b/src/drivers/linux/slirp.c @@ -18,6 +18,7 @@ */ #include +#include #include #include #include diff --git a/src/drivers/net/ath/ath.h b/src/drivers/net/ath/ath.h index 589bb5634..21f795b70 100644 --- a/src/drivers/net/ath/ath.h +++ b/src/drivers/net/ath/ath.h @@ -23,6 +23,7 @@ FILE_LICENCE ( BSD2 ); #include +#include #include /* This block of functions are from kernel.h v3.0.1 */ diff --git a/src/drivers/net/ath/ath5k/ath5k.h b/src/drivers/net/ath/ath5k/ath5k.h index fa62e8ce5..727d41279 100644 --- a/src/drivers/net/ath/ath5k/ath5k.h +++ b/src/drivers/net/ath/ath5k/ath5k.h @@ -24,6 +24,7 @@ FILE_LICENCE ( MIT ); #include +#include #include #include #include diff --git a/src/drivers/net/b44.c b/src/drivers/net/b44.c index 30ece5574..c6ca99865 100644 --- a/src/drivers/net/b44.c +++ b/src/drivers/net/b44.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER ); +#include #include #include #include diff --git a/src/drivers/net/bnxt/bnxt.c b/src/drivers/net/bnxt/bnxt.c index 5de8d094e..402439eef 100644 --- a/src/drivers/net/bnxt/bnxt.c +++ b/src/drivers/net/bnxt/bnxt.c @@ -3,6 +3,7 @@ FILE_LICENCE ( GPL2_ONLY ); #include #include +#include #include #include #include diff --git a/src/drivers/net/eepro100.c b/src/drivers/net/eepro100.c index 49b00d443..318db1883 100644 --- a/src/drivers/net/eepro100.c +++ b/src/drivers/net/eepro100.c @@ -101,6 +101,7 @@ FILE_LICENCE ( GPL2_OR_LATER ); */ #include +#include #include #include #include diff --git a/src/drivers/net/etherfabric.c b/src/drivers/net/etherfabric.c index be30b71f7..a58b71568 100644 --- a/src/drivers/net/etherfabric.c +++ b/src/drivers/net/etherfabric.c @@ -21,6 +21,7 @@ FILE_LICENCE ( GPL_ANY ); #include #include #include +#include #include #include #include diff --git a/src/drivers/net/marvell/atl2_hw.c b/src/drivers/net/marvell/atl2_hw.c index 805820709..07822a9c2 100644 --- a/src/drivers/net/marvell/atl2_hw.c +++ b/src/drivers/net/marvell/atl2_hw.c @@ -31,6 +31,7 @@ FILE_LICENCE ( BSD2 ); +#include #include #include #include diff --git a/src/drivers/net/marvell/atl_hw.c b/src/drivers/net/marvell/atl_hw.c index e0843e6f4..fa7f2a9b8 100644 --- a/src/drivers/net/marvell/atl_hw.c +++ b/src/drivers/net/marvell/atl_hw.c @@ -31,6 +31,7 @@ FILE_LICENCE ( BSD2 ); +#include #include #include #include diff --git a/src/drivers/net/myri10ge.c b/src/drivers/net/myri10ge.c index 6d0f723f2..fb9dc01b2 100644 --- a/src/drivers/net/myri10ge.c +++ b/src/drivers/net/myri10ge.c @@ -74,7 +74,7 @@ FILE_LICENCE ( GPL2_ONLY ); */ #include - +#include #include #include #include diff --git a/src/drivers/net/netvsc.c b/src/drivers/net/netvsc.c index 4bdf7b517..9b6ee88b4 100644 --- a/src/drivers/net/netvsc.c +++ b/src/drivers/net/netvsc.c @@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * bus (VMBus). It provides a transport layer for RNDIS packets. */ +#include #include #include #include diff --git a/src/drivers/net/rtl818x/rtl818x.c b/src/drivers/net/rtl818x/rtl818x.c index 599d36fad..3bae8a797 100644 --- a/src/drivers/net/rtl818x/rtl818x.c +++ b/src/drivers/net/rtl818x/rtl818x.c @@ -20,6 +20,7 @@ FILE_LICENCE(GPL2_ONLY); #include +#include #include #include #include diff --git a/src/drivers/net/sfc/efx_hunt.c b/src/drivers/net/sfc/efx_hunt.c index abe3e8320..92c0fda62 100644 --- a/src/drivers/net/sfc/efx_hunt.c +++ b/src/drivers/net/sfc/efx_hunt.c @@ -21,6 +21,7 @@ #include #include #include +#include #include #include #include diff --git a/src/drivers/net/sfc/sfc_hunt.c b/src/drivers/net/sfc/sfc_hunt.c index 43ac229ab..f763fc9d0 100644 --- a/src/drivers/net/sfc/sfc_hunt.c +++ b/src/drivers/net/sfc/sfc_hunt.c @@ -19,6 +19,7 @@ ***************************************************************************/ #include #include +#include #include #include #include diff --git a/src/drivers/net/skge.c b/src/drivers/net/skge.c index cc7f0b91b..828a2a4c9 100755 --- a/src/drivers/net/skge.c +++ b/src/drivers/net/skge.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_ONLY ); #include +#include #include #include #include diff --git a/src/drivers/net/sky2.c b/src/drivers/net/sky2.c index 4f8ec3e42..db3f6aaa1 100644 --- a/src/drivers/net/sky2.c +++ b/src/drivers/net/sky2.c @@ -28,6 +28,7 @@ FILE_LICENCE ( GPL2_ONLY ); #include +#include #include #include #include diff --git a/src/drivers/net/tg3/tg3.c b/src/drivers/net/tg3/tg3.c index 05af22d61..a6736305c 100644 --- a/src/drivers/net/tg3/tg3.c +++ b/src/drivers/net/tg3/tg3.c @@ -3,6 +3,7 @@ FILE_LICENCE ( GPL2_ONLY ); #include #include +#include #include #include #include diff --git a/src/drivers/net/tg3/tg3_hw.c b/src/drivers/net/tg3/tg3_hw.c index 9a70413b6..5c9506dce 100644 --- a/src/drivers/net/tg3/tg3_hw.c +++ b/src/drivers/net/tg3/tg3_hw.c @@ -18,6 +18,7 @@ FILE_LICENCE ( GPL2_ONLY ); #include +#include #include #include #include diff --git a/src/drivers/net/tg3/tg3_phy.c b/src/drivers/net/tg3/tg3_phy.c index e88b0be0f..a2322329e 100644 --- a/src/drivers/net/tg3/tg3_phy.c +++ b/src/drivers/net/tg3/tg3_phy.c @@ -1,6 +1,7 @@ #include #include +#include #include #include #include diff --git a/src/drivers/net/vmxnet3.c b/src/drivers/net/vmxnet3.c index 3800d6b72..2cc6738f2 100644 --- a/src/drivers/net/vmxnet3.c +++ b/src/drivers/net/vmxnet3.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/drivers/net/vxge/vxge_config.c b/src/drivers/net/vxge/vxge_config.c index f4d217097..8c6ee9e96 100644 --- a/src/drivers/net/vxge/vxge_config.c +++ b/src/drivers/net/vxge/vxge_config.c @@ -16,6 +16,7 @@ FILE_LICENCE(GPL2_ONLY); #include #include +#include #include #include #include diff --git a/src/drivers/net/vxge/vxge_traffic.c b/src/drivers/net/vxge/vxge_traffic.c index dbd799015..0adaea2aa 100644 --- a/src/drivers/net/vxge/vxge_traffic.c +++ b/src/drivers/net/vxge/vxge_traffic.c @@ -15,6 +15,7 @@ FILE_LICENCE(GPL2_ONLY); #include +#include #include #include "vxge_traffic.h" diff --git a/src/drivers/nvs/nvsvpd.c b/src/drivers/nvs/nvsvpd.c index 3e88531c7..195973319 100644 --- a/src/drivers/nvs/nvsvpd.c +++ b/src/drivers/nvs/nvsvpd.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/drivers/usb/usbblk.c b/src/drivers/usb/usbblk.c index 39adc012f..cb377efb0 100644 --- a/src/drivers/usb/usbblk.c +++ b/src/drivers/usb/usbblk.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/hci/commands/cert_cmd.c b/src/hci/commands/cert_cmd.c index 24b18bf5c..75d2ccbed 100644 --- a/src/hci/commands/cert_cmd.c +++ b/src/hci/commands/cert_cmd.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/hci/commands/image_cmd.c b/src/hci/commands/image_cmd.c index bf97b4deb..4b42695c4 100644 --- a/src/hci/commands/image_cmd.c +++ b/src/hci/commands/image_cmd.c @@ -26,6 +26,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include diff --git a/src/hci/commands/image_crypt_cmd.c b/src/hci/commands/image_crypt_cmd.c index 26e9d79f8..4dfb5b131 100644 --- a/src/hci/commands/image_crypt_cmd.c +++ b/src/hci/commands/image_crypt_cmd.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/hci/commands/image_trust_cmd.c b/src/hci/commands/image_trust_cmd.c index b34378f93..9b9e3f859 100644 --- a/src/hci/commands/image_trust_cmd.c +++ b/src/hci/commands/image_trust_cmd.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/hci/commands/pci_cmd.c b/src/hci/commands/pci_cmd.c index 5bae66fbe..fa1fa5ece 100644 --- a/src/hci/commands/pci_cmd.c +++ b/src/hci/commands/pci_cmd.c @@ -22,6 +22,7 @@ */ #include +#include #include #include #include diff --git a/src/hci/commands/usb_cmd.c b/src/hci/commands/usb_cmd.c index d1086fd7e..4ee2f2ddb 100644 --- a/src/hci/commands/usb_cmd.c +++ b/src/hci/commands/usb_cmd.c @@ -22,6 +22,7 @@ */ #include +#include #include #include #include diff --git a/src/image/der.c b/src/image/der.c index 600e163c9..67117d43b 100644 --- a/src/image/der.c +++ b/src/image/der.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/image/efi_image.c b/src/image/efi_image.c index f71630f4a..f7ee7ff50 100644 --- a/src/image/efi_image.c +++ b/src/image/efi_image.c @@ -21,6 +21,7 @@ FILE_LICENCE ( GPL2_OR_LATER ); #include #include +#include #include #include #include diff --git a/src/image/efi_siglist.c b/src/image/efi_siglist.c index 2bd273dbd..b264ac558 100644 --- a/src/image/efi_siglist.c +++ b/src/image/efi_siglist.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/image/elf.c b/src/image/elf.c index 83712c3b0..97e07f37f 100644 --- a/src/image/elf.c +++ b/src/image/elf.c @@ -33,6 +33,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * common ELF-related functionality. */ +#include #include #include #include diff --git a/src/image/pnm.c b/src/image/pnm.c index 4b5020b64..489a43304 100644 --- a/src/image/pnm.c +++ b/src/image/pnm.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/image/segment.c b/src/image/segment.c index 2cb637dc2..52272170a 100644 --- a/src/image/segment.c +++ b/src/image/segment.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * */ +#include #include #include #include diff --git a/src/include/ipxe/dummy_pio.h b/src/include/ipxe/dummy_pio.h index 1cdabba14..e7a4cabef 100644 --- a/src/include/ipxe/dummy_pio.h +++ b/src/include/ipxe/dummy_pio.h @@ -13,6 +13,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include + #define DUMMY_INX( _prefix, _suffix, _type ) \ static inline __always_inline _type \ IOAPI_INLINE ( _prefix, in ## _suffix ) ( volatile _type *io_addr __unused) { \ diff --git a/src/include/ipxe/iomap_virt.h b/src/include/ipxe/iomap_virt.h index 4962b7c37..731d083d5 100644 --- a/src/include/ipxe/iomap_virt.h +++ b/src/include/ipxe/iomap_virt.h @@ -9,6 +9,8 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include + #ifdef IOMAP_VIRT #define IOMAP_PREFIX_virt #else diff --git a/src/include/ipxe/uaccess.h b/src/include/ipxe/uaccess.h index 948ef1fa2..82f29f793 100644 --- a/src/include/ipxe/uaccess.h +++ b/src/include/ipxe/uaccess.h @@ -11,7 +11,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include -#include #include #include @@ -127,30 +126,4 @@ virt_to_phys ( volatile const void *virt ); */ void * __attribute__ (( const )) phys_to_virt ( physaddr_t phys ); -/** - * Copy data to user buffer - * - * @v dest Destination - * @v dest_off Destination offset - * @v src Source - * @v len Length - */ -static inline __always_inline void -copy_to_user ( userptr_t dest, off_t dest_off, const void *src, size_t len ) { - memcpy ( ( dest + dest_off ), src, len ); -} - -/** - * Copy data from user buffer - * - * @v dest Destination - * @v src Source - * @v src_off Source offset - * @v len Length - */ -static inline __always_inline void -copy_from_user ( void *dest, userptr_t src, off_t src_off, size_t len ) { - memcpy ( dest, ( src + src_off ), len ); -} - #endif /* _IPXE_UACCESS_H */ diff --git a/src/interface/efi/efi_bofm.c b/src/interface/efi/efi_bofm.c index 7d1d3619f..3d956800e 100644 --- a/src/interface/efi/efi_bofm.c +++ b/src/interface/efi/efi_bofm.c @@ -23,6 +23,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/interface/efi/efi_cmdline.c b/src/interface/efi/efi_cmdline.c index b33bebd8c..13ad0fc35 100644 --- a/src/interface/efi/efi_cmdline.c +++ b/src/interface/efi/efi_cmdline.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/interface/efi/efi_pci.c b/src/interface/efi/efi_pci.c index b8c7df38d..1b1f05816 100644 --- a/src/interface/efi/efi_pci.c +++ b/src/interface/efi/efi_pci.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/interface/xen/xenbus.c b/src/interface/xen/xenbus.c index 5dd01dfa3..8b5ee0a0d 100644 --- a/src/interface/xen/xenbus.c +++ b/src/interface/xen/xenbus.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/net/eapol.c b/src/net/eapol.c index 8b09ca231..0c573d198 100644 --- a/src/net/eapol.c +++ b/src/net/eapol.c @@ -23,6 +23,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +#include #include #include #include diff --git a/src/net/fcoe.c b/src/net/fcoe.c index 9f3ddf88b..d54f1d431 100644 --- a/src/net/fcoe.c +++ b/src/net/fcoe.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/net/lldp.c b/src/net/lldp.c index a854d0ace..2b707c874 100644 --- a/src/net/lldp.c +++ b/src/net/lldp.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/net/peerblk.c b/src/net/peerblk.c index bbd5f16ed..58b185102 100644 --- a/src/net/peerblk.c +++ b/src/net/peerblk.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/net/peermux.c b/src/net/peermux.c index 431ca76e0..5c814b03e 100644 --- a/src/net/peermux.c +++ b/src/net/peermux.c @@ -25,6 +25,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/net/tcp/httpblock.c b/src/net/tcp/httpblock.c index 156f11e47..8eff1942c 100644 --- a/src/net/tcp/httpblock.c +++ b/src/net/tcp/httpblock.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ #include +#include #include #include #include diff --git a/src/net/tcp/syslogs.c b/src/net/tcp/syslogs.c index f1f70d59e..5676f3e3e 100644 --- a/src/net/tcp/syslogs.c +++ b/src/net/tcp/syslogs.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/net/udp/syslog.c b/src/net/udp/syslog.c index a45fc459d..198c86ef7 100644 --- a/src/net/udp/syslog.c +++ b/src/net/udp/syslog.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/tests/asn1_test.c b/src/tests/asn1_test.c index df3f01b63..b522b85d7 100644 --- a/src/tests/asn1_test.c +++ b/src/tests/asn1_test.c @@ -33,6 +33,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #undef NDEBUG #include +#include #include #include #include diff --git a/src/tests/cpio_test.c b/src/tests/cpio_test.c index 7eb8b2c74..24baf947b 100644 --- a/src/tests/cpio_test.c +++ b/src/tests/cpio_test.c @@ -33,6 +33,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #undef NDEBUG #include +#include #include #include diff --git a/src/tests/pixbuf_test.c b/src/tests/pixbuf_test.c index 1f82e0018..a8ea1151e 100644 --- a/src/tests/pixbuf_test.c +++ b/src/tests/pixbuf_test.c @@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /* Forcibly enable assertions */ #undef NDEBUG +#include #include #include #include diff --git a/src/tests/test.c b/src/tests/test.c index 4c49d4c16..1ec4b21ef 100644 --- a/src/tests/test.c +++ b/src/tests/test.c @@ -34,6 +34,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include #include diff --git a/src/usr/imgarchive.c b/src/usr/imgarchive.c index 6849dd510..91600760e 100644 --- a/src/usr/imgarchive.c +++ b/src/usr/imgarchive.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include diff --git a/src/usr/imgmgmt.c b/src/usr/imgmgmt.c index 054137696..65b52fd3a 100644 --- a/src/usr/imgmgmt.c +++ b/src/usr/imgmgmt.c @@ -26,6 +26,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include diff --git a/src/usr/imgtrust.c b/src/usr/imgtrust.c index 7f7e7ed14..4eb631e79 100644 --- a/src/usr/imgtrust.c +++ b/src/usr/imgtrust.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include -- cgit v1.2.3-55-g7522 From a169d73593f6c471857a694edc22809608c7d9c0 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 30 Apr 2025 14:33:57 +0100 Subject: [uaccess] Reduce scope of included uaccess.h header The uaccess.h header is no longer required for any code that touches external ("user") memory, since such memory accesses are now performed through pointer dereferences. Reduce the number of files including this header. Signed-off-by: Michael Brown --- src/arch/x86/image/elfboot.c | 1 + src/arch/x86/image/pxe_image.c | 1 - src/arch/x86/interface/pxe/pxe_file.c | 1 - src/core/cachedhcp.c | 1 + src/core/downloader.c | 1 - src/core/fbcon.c | 1 + src/core/image.c | 1 + src/drivers/bus/ecam.c | 1 - src/hci/commands/image_mem_cmd.c | 1 + src/image/elf.c | 1 + src/include/ipxe/dhcp.h | 1 - src/include/ipxe/image.h | 1 - src/include/ipxe/iomap.h | 1 - src/include/ipxe/iomap_virt.h | 1 + src/include/ipxe/xen.h | 1 - src/interface/efi/efi_cmdline.c | 1 + src/net/pccrc.c | 1 - src/usr/imgtrust.c | 1 - 18 files changed, 8 insertions(+), 10 deletions(-) (limited to 'src/net') diff --git a/src/arch/x86/image/elfboot.c b/src/arch/x86/image/elfboot.c index f662e366f..7f89e8b65 100644 --- a/src/arch/x86/image/elfboot.c +++ b/src/arch/x86/image/elfboot.c @@ -30,6 +30,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include /** * @file diff --git a/src/arch/x86/image/pxe_image.c b/src/arch/x86/image/pxe_image.c index 3e6cf7268..ccb3a7d9d 100644 --- a/src/arch/x86/image/pxe_image.c +++ b/src/arch/x86/image/pxe_image.c @@ -34,7 +34,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include #include diff --git a/src/arch/x86/interface/pxe/pxe_file.c b/src/arch/x86/interface/pxe/pxe_file.c index b934e8fef..997667ccf 100644 --- a/src/arch/x86/interface/pxe/pxe_file.c +++ b/src/arch/x86/interface/pxe/pxe_file.c @@ -8,7 +8,6 @@ #include #include #include -#include #include #include #include diff --git a/src/core/cachedhcp.c b/src/core/cachedhcp.c index 1510f3321..eeb2fca58 100644 --- a/src/core/cachedhcp.c +++ b/src/core/cachedhcp.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include /** @file diff --git a/src/core/downloader.c b/src/core/downloader.c index 9950fe5e4..1c638f502 100644 --- a/src/core/downloader.c +++ b/src/core/downloader.c @@ -31,7 +31,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include #include diff --git a/src/core/fbcon.c b/src/core/fbcon.c index 43f73fbac..ef158aec7 100644 --- a/src/core/fbcon.c +++ b/src/core/fbcon.c @@ -36,6 +36,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include diff --git a/src/core/image.c b/src/core/image.c index a06466b72..b2bd0956b 100644 --- a/src/core/image.c +++ b/src/core/image.c @@ -33,6 +33,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include #include diff --git a/src/drivers/bus/ecam.c b/src/drivers/bus/ecam.c index 35556a8d9..976254c18 100644 --- a/src/drivers/bus/ecam.c +++ b/src/drivers/bus/ecam.c @@ -25,7 +25,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include -#include #include /** @file diff --git a/src/hci/commands/image_mem_cmd.c b/src/hci/commands/image_mem_cmd.c index 5f8363461..fcd766627 100644 --- a/src/hci/commands/image_mem_cmd.c +++ b/src/hci/commands/image_mem_cmd.c @@ -24,6 +24,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include #include diff --git a/src/image/elf.c b/src/image/elf.c index 97e07f37f..8cbb610a6 100644 --- a/src/image/elf.c +++ b/src/image/elf.c @@ -38,6 +38,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include /** diff --git a/src/include/ipxe/dhcp.h b/src/include/ipxe/dhcp.h index 51349efd9..4d68d3ca5 100644 --- a/src/include/ipxe/dhcp.h +++ b/src/include/ipxe/dhcp.h @@ -17,7 +17,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include struct interface; struct dhcp_options; diff --git a/src/include/ipxe/image.h b/src/include/ipxe/image.h index fbf2b63b9..e0e70f360 100644 --- a/src/include/ipxe/image.h +++ b/src/include/ipxe/image.h @@ -12,7 +12,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include -#include #include struct uri; diff --git a/src/include/ipxe/iomap.h b/src/include/ipxe/iomap.h index b8ded38ef..7d1547d9c 100644 --- a/src/include/ipxe/iomap.h +++ b/src/include/ipxe/iomap.h @@ -14,7 +14,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include /** * Calculate static inline I/O mapping API function name diff --git a/src/include/ipxe/iomap_virt.h b/src/include/ipxe/iomap_virt.h index 731d083d5..3dd66bd75 100644 --- a/src/include/ipxe/iomap_virt.h +++ b/src/include/ipxe/iomap_virt.h @@ -10,6 +10,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #ifdef IOMAP_VIRT #define IOMAP_PREFIX_virt diff --git a/src/include/ipxe/xen.h b/src/include/ipxe/xen.h index 0fb8b7625..382901ff3 100644 --- a/src/include/ipxe/xen.h +++ b/src/include/ipxe/xen.h @@ -14,7 +14,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include -#include #include #include diff --git a/src/interface/efi/efi_cmdline.c b/src/interface/efi/efi_cmdline.c index d5ec6cee3..8b9d8efde 100644 --- a/src/interface/efi/efi_cmdline.c +++ b/src/interface/efi/efi_cmdline.c @@ -37,6 +37,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include diff --git a/src/net/pccrc.c b/src/net/pccrc.c index 29adc4b16..0db6e3cb5 100644 --- a/src/net/pccrc.c +++ b/src/net/pccrc.c @@ -25,7 +25,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include -#include #include #include #include diff --git a/src/usr/imgtrust.c b/src/usr/imgtrust.c index 4eb631e79..e60854c9f 100644 --- a/src/usr/imgtrust.c +++ b/src/usr/imgtrust.c @@ -28,7 +28,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include -#include #include #include #include -- cgit v1.2.3-55-g7522 From 96f58646607f554b05e1c4f32e1cefe85f0346e6 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 10 Jun 2025 13:37:31 +0100 Subject: [ipv4] Add self-tests for IPv4 routing Signed-off-by: Michael Brown --- src/include/ipxe/ip.h | 2 + src/net/ipv4.c | 4 +- src/tests/ipv4_test.c | 152 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 156 insertions(+), 2 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/ip.h b/src/include/ipxe/ip.h index b1b5cb2e7..a2c5d4265 100644 --- a/src/include/ipxe/ip.h +++ b/src/include/ipxe/ip.h @@ -92,6 +92,8 @@ extern struct list_head ipv4_miniroutes; extern struct net_protocol ipv4_protocol __net_protocol; +extern struct ipv4_miniroute * ipv4_route ( unsigned int scope_id, + struct in_addr *dest ); extern int ipv4_has_any_addr ( struct net_device *netdev ); extern int parse_ipv4_setting ( const struct setting_type *type, const char *value, void *buf, size_t len ); diff --git a/src/net/ipv4.c b/src/net/ipv4.c index 5d0cb0f9a..425656f6c 100644 --- a/src/net/ipv4.c +++ b/src/net/ipv4.c @@ -157,8 +157,8 @@ static void del_ipv4_miniroute ( struct ipv4_miniroute *miniroute ) { * If the route requires use of a gateway, the next hop destination * address will be overwritten with the gateway address. */ -static struct ipv4_miniroute * ipv4_route ( unsigned int scope_id, - struct in_addr *dest ) { +struct ipv4_miniroute * ipv4_route ( unsigned int scope_id, + struct in_addr *dest ) { struct ipv4_miniroute *miniroute; /* Find first usable route in routing table */ diff --git a/src/tests/ipv4_test.c b/src/tests/ipv4_test.c index f84a8b81f..a5aa4a4b1 100644 --- a/src/tests/ipv4_test.c +++ b/src/tests/ipv4_test.c @@ -34,9 +34,12 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include +#include #include #include +#include #include +#include "netdev_test.h" /** Define inline IPv4 address */ #define IPV4(a,b,c,d) \ @@ -104,6 +107,113 @@ static void inet_aton_fail_okx ( const char *text, const char *file, #define inet_aton_fail_ok( text ) \ inet_aton_fail_okx ( text, __FILE__, __LINE__ ) +/** + * Report an ipv4_route() test result + * + * @v dest Destination address + * @v scope Destination scope test network device, or NULL + * @v next Expected next hop address (on success) + * @v egress Expected egress device, or NULL to expect failure + * @v src Expected source address (on success) + * @v bcast Expected broadcast packet (on success) + * @v file Test code file + * @v line Test code line + */ +static void ipv4_route_okx ( const char *dest, struct testnet *scope, + const char *next, struct testnet *egress, + const char *src, int bcast, + const char *file, unsigned int line ) { + struct ipv4_miniroute *miniroute; + struct in_addr in_dest; + struct in_addr in_src; + struct in_addr in_next; + struct in_addr actual; + unsigned int scope_id; + + /* Sanity checks */ + assert ( ( scope == NULL ) || ( scope->netdev != NULL ) ); + assert ( ( egress == NULL ) == ( src == NULL ) ); + + /* Parse addresses */ + okx ( inet_aton ( dest, &in_dest ) != 0, file, line ); + if ( src ) + okx ( inet_aton ( src, &in_src ) != 0, file, line ); + if ( next ) { + okx ( inet_aton ( next, &in_next ) != 0, file, line ); + } else { + in_next.s_addr = in_dest.s_addr; + } + + /* Perform routing */ + actual.s_addr = in_dest.s_addr; + scope_id = ( scope ? scope->netdev->scope_id : 0 ); + miniroute = ipv4_route ( scope_id, &actual ); + + /* Validate result */ + if ( src ) { + + /* Check that a route was found */ + okx ( miniroute != NULL, file, line ); + DBG ( "ipv4_route ( %s, %s ) = %s", + ( scope ? scope->dev.name : "" ), dest, + inet_ntoa ( actual ) ); + DBG ( " from %s via %s\n", + inet_ntoa ( miniroute->address ), egress->dev.name ); + + /* Check that expected network device was used */ + okx ( miniroute->netdev == egress->netdev, file, line ); + + /* Check that expected source address was used */ + okx ( miniroute->address.s_addr == in_src.s_addr, file, line ); + + /* Check that expected next hop address was used */ + okx ( actual.s_addr == in_next.s_addr, file, line ); + + /* Check that expected broadcast choice was used */ + okx ( ( ! ( ( ~actual.s_addr ) & miniroute->hostmask.s_addr ) ) + == ( !! bcast ), file, line ); + + } else { + + /* Routing is expected to fail */ + okx ( miniroute == NULL, file, line ); + DBG ( "ipv4_route ( %s, %s ) = \n", + ( scope ? scope->dev.name : "" ), dest ); + } +} +#define ipv4_route_ok( dest, scope, next, egress, src, bcast ) \ + ipv4_route_okx ( dest, scope, next, egress, src, bcast, \ + __FILE__, __LINE__ ) + +/** net0: Single address and gateway (DHCP assignment) */ +TESTNET ( net0, + { "dhcp/ip", "192.168.0.1" }, + { "dhcp/netmask", "255.255.255.0" }, + { "dhcp/gateway", "192.168.0.254" } ); + +/** net1: Single address and gateway (DHCP assignment) */ +TESTNET ( net1, + { "dhcp/ip", "192.168.0.2" }, + { "dhcp/netmask", "255.255.255.0" }, + { "dhcp/gateway", "192.168.0.254" } ); + +/** net2: Small /31 subnet mask */ +TESTNET ( net2, + { "ip", "10.31.31.0" }, + { "netmask", "255.255.255.254" }, + { "gateway", "10.31.31.1" } ); + +/** net3: Small /32 subnet mask */ +TESTNET ( net3, + { "ip", "10.32.32.32" }, + { "netmask", "255.255.255.255" }, + { "gateway", "192.168.32.254" } ); + +/** net4: Local subnet with no gateway */ +TESTNET ( net4, + { "ip", "192.168.86.1" }, + { "netmask", "255.255.240.0" } ); + /** * Perform IPv4 self-tests * @@ -145,6 +255,48 @@ static void ipv4_test_exec ( void ) { inet_aton_fail_ok ( "127.0.0" ); /* Too short */ inet_aton_fail_ok ( "1.2.3.a" ); /* Invalid characters */ inet_aton_fail_ok ( "127.0..1" ); /* Missing bytes */ + + /* Single address and gateway */ + testnet_ok ( &net0 ); + ipv4_route_ok ( "192.168.0.10", NULL, + "192.168.0.10", &net0, "192.168.0.1", 0 ); + ipv4_route_ok ( "10.0.0.6", NULL, + "192.168.0.254", &net0, "192.168.0.1", 0 ); + ipv4_route_ok ( "192.168.0.255", NULL, + "192.168.0.255", &net0, "192.168.0.1", 1 ); + testnet_remove_ok ( &net0 ); + + /* Overridden DHCP-assigned address */ + testnet_ok ( &net1 ); + ipv4_route_ok ( "192.168.1.3", NULL, + "192.168.0.254", &net1, "192.168.0.2", 0 ); + testnet_set_ok ( &net1, "ip", "192.168.1.2" ); + ipv4_route_ok ( "192.168.1.3", NULL, + "192.168.1.3", &net1, "192.168.1.2", 0 ); + testnet_remove_ok ( &net1 ); + + /* Small /31 subnet */ + testnet_ok ( &net2 ); + ipv4_route_ok ( "10.31.31.1", NULL, + "10.31.31.1", &net2, "10.31.31.0", 0 ); + ipv4_route_ok ( "212.13.204.60", NULL, + "10.31.31.1", &net2, "10.31.31.0", 0 ); + testnet_remove_ok ( &net2 ); + + /* Small /32 subnet */ + testnet_ok ( &net3 ); + ipv4_route_ok ( "10.32.32.31", NULL, + "192.168.32.254", &net3, "10.32.32.32", 0 ); + ipv4_route_ok ( "8.8.8.8", NULL, + "192.168.32.254", &net3, "10.32.32.32", 0 ); + testnet_remove_ok ( &net3 ); + + /* No gateway */ + testnet_ok ( &net4 ); + ipv4_route_ok ( "192.168.87.1", NULL, + "192.168.87.1", &net4, "192.168.86.1", 0 ); + ipv4_route_ok ( "192.168.96.1", NULL, NULL, NULL, NULL, 0 ); + testnet_remove_ok ( &net4 ); } /** IPv4 self-test */ -- cgit v1.2.3-55-g7522 From e648d23fba09c7e0c50e205448448b132a5711b5 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 5 Jun 2025 16:49:42 +0100 Subject: [ipv4] Extend routing mechanism to handle non-default routes Extend the definition of an IPv4 routing table entry to allow for the expression of non-default gateways for specified off-link subnets, and of on-link secondary subnets (where we can send directly to the destination address even though our source address is not within the subnet). This more precise definition also allows us to correctly handle routing in the (uncommon for iPXE) case when multiple network interfaces are open concurrently and more than one interface has a default gateway. The common case of a single IPv4 address/netmask and a default gateway now results in two routing table entries. To retain backwards compatibility with existing documentation (and to avoid on-screen clutter), the "route" command prints default gateways on the same line as the locally assigned address. There is therefore no change in output from the "route" command unless explicit additional (off-link or on-link) routes are present. Signed-off-by: Michael Brown --- src/include/ipxe/ip.h | 77 ++++++++++++++++++++++++++------- src/net/ipv4.c | 116 +++++++++++++++++++++++++++++++++++--------------- src/tests/ipv4_test.c | 30 +++++++++++++ src/usr/route_ipv4.c | 47 +++++++++++++++++--- 4 files changed, 213 insertions(+), 57 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/ip.h b/src/include/ipxe/ip.h index a2c5d4265..e2cd512ac 100644 --- a/src/include/ipxe/ip.h +++ b/src/include/ipxe/ip.h @@ -54,38 +54,83 @@ struct ipv4_pseudo_header { uint16_t len; }; -/** An IPv4 address/routing table entry */ +/** An IPv4 address/routing table entry + * + * Routing table entries are maintained in order of specificity. For + * a given destination address, the first matching table entry will be + * used as the egress route. + */ struct ipv4_miniroute { /** List of miniroutes */ struct list_head list; - /** Network device */ + /** Network device + * + * When this routing table entry is matched, this is the + * egress network device to be used. + */ struct net_device *netdev; - /** IPv4 address */ + /** IPv4 address + * + * When this routing table entry is matched, this is the + * source address to be used. + * + * The presence of this routing table entry also indicates + * that this address is a valid local destination address for + * the matching network device. + */ struct in_addr address; + /** Subnet network address + * + * A subnet is a range of addresses defined by a network + * address and subnet mask. A destination address with all of + * the subnet mask bits in common with the network address is + * within the subnet and therefore matches this routing table + * entry. + */ + struct in_addr network; /** Subnet mask * - * An address with all of these bits in common with our IPv4 - * address is in the local subnet. + * An address with all of these bits in common with the + * network address matches this routing table entry. */ struct in_addr netmask; + /** Gateway address, or zero + * + * When this routing table entry is matched and this address + * is non-zero, it will be used as the next-hop address. + * + * When this routing table entry is matched and this address + * is zero, the subnet is local (on-link) and the next-hop + * address will be the original destination address. + */ + struct in_addr gateway; /** Host mask * - * An address in the local subnet with all of these bits set - * to zero represents the network address, and an address in - * the local subnet with all of these bits set to one - * represents the directed broadcast address. All other - * addresses in the local subnet are valid host addresses. + * An address in a local subnet with all of these bits set to + * zero represents the network address, and an address in a + * local subnet with all of these bits set to one represents + * the local directed broadcast address. All other addresses + * in a local subnet are valid host addresses. + * + * For most local subnets, this is the inverse of the subnet + * mask. In a small subnet (/31 or /32) there is no network + * address or directed broadcast address, and all addresses in + * the subnet are valid host addresses. * - * For most subnets, this is the inverse of the subnet mask. - * In a small subnet (/31 or /32) there is no network address - * or directed broadcast address, and all addresses in the - * subnet are valid host addresses. + * When this routing table entry is matched and the subnet is + * local, a next-hop address with all of these bits set to one + * will be treated as a local broadcast address. All other + * next-hop addresses will be treated as unicast addresses. + * + * When this routing table entry is matched and the subnet is + * non-local, the next-hop address is always a unicast + * address. The host mask for non-local subnets is therefore + * set to @c INADDR_NONE to allow the same logic to be used as + * for local subnets. */ struct in_addr hostmask; - /** Gateway address, or zero for no gateway */ - struct in_addr gateway; }; extern struct list_head ipv4_miniroutes; diff --git a/src/net/ipv4.c b/src/net/ipv4.c index 425656f6c..ec96e4242 100644 --- a/src/net/ipv4.c +++ b/src/net/ipv4.c @@ -77,24 +77,32 @@ static struct profiler ipv4_rx_profiler __profiler = { .name = "ipv4.rx" }; * * @v netdev Network device * @v address IPv4 address + * @v network Subnet address * @v netmask Subnet mask * @v gateway Gateway address (if any) * @ret rc Return status code */ -static int add_ipv4_miniroute ( struct net_device *netdev, - struct in_addr address, struct in_addr netmask, +static int ipv4_add_miniroute ( struct net_device *netdev, + struct in_addr address, + struct in_addr network, + struct in_addr netmask, struct in_addr gateway ) { struct ipv4_miniroute *miniroute; + struct ipv4_miniroute *before; struct in_addr hostmask; struct in_addr broadcast; /* Calculate host mask */ - hostmask.s_addr = ( IN_IS_SMALL ( netmask.s_addr ) ? - INADDR_NONE : ~netmask.s_addr ); - broadcast.s_addr = ( address.s_addr | hostmask.s_addr ); + if ( gateway.s_addr || IN_IS_SMALL ( netmask.s_addr ) ) { + hostmask.s_addr = INADDR_NONE; + } else { + hostmask.s_addr = ~netmask.s_addr; + } + broadcast.s_addr = ( network.s_addr | hostmask.s_addr ); /* Print debugging information */ DBGC ( netdev, "IPv4 add %s", inet_ntoa ( address ) ); + DBGC ( netdev, " for %s", inet_ntoa ( network ) ); DBGC ( netdev, "/%s ", inet_ntoa ( netmask ) ); DBGC ( netdev, "bc %s ", inet_ntoa ( broadcast ) ); if ( gateway.s_addr ) @@ -111,18 +119,49 @@ static int add_ipv4_miniroute ( struct net_device *netdev, /* Record routing information */ miniroute->netdev = netdev_get ( netdev ); miniroute->address = address; + miniroute->network = network; miniroute->netmask = netmask; miniroute->hostmask = hostmask; miniroute->gateway = gateway; - /* Add to end of list if we have a gateway, otherwise - * to start of list. - */ - if ( gateway.s_addr ) { - list_add_tail ( &miniroute->list, &ipv4_miniroutes ); - } else { - list_add ( &miniroute->list, &ipv4_miniroutes ); + /* Add to routing table ahead of any less specific routes */ + list_for_each_entry ( before, &ipv4_miniroutes, list ) { + if ( netmask.s_addr & ~before->netmask.s_addr ) + break; } + list_add_tail ( &miniroute->list, &before->list ); + + return 0; +} + +/** + * Add IPv4 minirouting table entries + * + * @v netdev Network device + * @v address IPv4 address + * @v netmask Subnet mask + * @v gateway Gateway address (if any) + * @ret rc Return status code + */ +static int ipv4_add_miniroutes ( struct net_device *netdev, + struct in_addr address, + struct in_addr netmask, + struct in_addr gateway ) { + struct in_addr none = { 0 }; + struct in_addr network; + int rc; + + /* Add local address */ + network.s_addr = ( address.s_addr & netmask.s_addr ); + if ( ( rc = ipv4_add_miniroute ( netdev, address, network, netmask, + none ) ) != 0 ) + return rc; + + /* Add default gateway, if applicable */ + if ( gateway.s_addr && + ( ( rc = ipv4_add_miniroute ( netdev, address, none, none, + gateway ) ) != 0 ) ) + return rc; return 0; } @@ -132,10 +171,11 @@ static int add_ipv4_miniroute ( struct net_device *netdev, * * @v miniroute Routing table entry */ -static void del_ipv4_miniroute ( struct ipv4_miniroute *miniroute ) { +static void ipv4_del_miniroute ( struct ipv4_miniroute *miniroute ) { struct net_device *netdev = miniroute->netdev; DBGC ( netdev, "IPv4 del %s", inet_ntoa ( miniroute->address ) ); + DBGC ( netdev, " for %s", inet_ntoa ( miniroute->network ) ); DBGC ( netdev, "/%s ", inet_ntoa ( miniroute->netmask ) ); if ( miniroute->gateway.s_addr ) DBGC ( netdev, "gw %s ", inet_ntoa ( miniroute->gateway ) ); @@ -146,6 +186,19 @@ static void del_ipv4_miniroute ( struct ipv4_miniroute *miniroute ) { free ( miniroute ); } +/** + * Delete IPv4 minirouting table entries + * + */ +static void ipv4_del_miniroutes ( void ) { + struct ipv4_miniroute *miniroute; + struct ipv4_miniroute *tmp; + + /* Delete all existing routes */ + list_for_each_entry_safe ( miniroute, tmp, &ipv4_miniroutes, list ) + ipv4_del_miniroute ( miniroute ); +} + /** * Perform IPv4 routing * @@ -170,27 +223,23 @@ struct ipv4_miniroute * ipv4_route ( unsigned int scope_id, if ( IN_IS_MULTICAST ( dest->s_addr ) ) { - /* If destination is non-global, and the scope ID - * matches this network device, then use this route. + /* If destination is non-global, and the scope + * ID matches this network device, then use + * the first matching route. */ if ( miniroute->netdev->scope_id == scope_id ) return miniroute; } else { - /* If destination is an on-link global - * address, then use this route. + /* If destination is global, then use the + * first matching route (via its gateway if + * specified). */ - if ( ( ( dest->s_addr ^ miniroute->address.s_addr ) - & miniroute->netmask.s_addr ) == 0 ) - return miniroute; - - /* If destination is an off-link global - * address, and we have a default gateway, - * then use this route. - */ - if ( miniroute->gateway.s_addr ) { - *dest = miniroute->gateway; + if ( ( ( dest->s_addr ^ miniroute->network.s_addr ) + & miniroute->netmask.s_addr ) == 0 ) { + if ( miniroute->gateway.s_addr ) + *dest = miniroute->gateway; return miniroute; } } @@ -913,20 +962,17 @@ static int ipv4_settings ( int ( * apply ) ( struct net_device *netdev, * * @ret rc Return status code */ -static int ipv4_create_routes ( void ) { - struct ipv4_miniroute *miniroute; - struct ipv4_miniroute *tmp; +static int ipv4_apply_routes ( void ) { int rc; /* Send gratuitous ARPs for any new IPv4 addresses */ ipv4_settings ( ipv4_gratuitous_arp ); /* Delete all existing routes */ - list_for_each_entry_safe ( miniroute, tmp, &ipv4_miniroutes, list ) - del_ipv4_miniroute ( miniroute ); + ipv4_del_miniroutes(); - /* Create a route for each configured network device */ - if ( ( rc = ipv4_settings ( add_ipv4_miniroute ) ) != 0 ) + /* Create routes for each configured network device */ + if ( ( rc = ipv4_settings ( ipv4_add_miniroutes ) ) != 0 ) return rc; return 0; @@ -934,7 +980,7 @@ static int ipv4_create_routes ( void ) { /** IPv4 settings applicator */ struct settings_applicator ipv4_settings_applicator __settings_applicator = { - .apply = ipv4_create_routes, + .apply = ipv4_apply_routes, }; /* Drag in objects via ipv4_protocol */ diff --git a/src/tests/ipv4_test.c b/src/tests/ipv4_test.c index a5aa4a4b1..63e1e1dc5 100644 --- a/src/tests/ipv4_test.c +++ b/src/tests/ipv4_test.c @@ -297,6 +297,36 @@ static void ipv4_test_exec ( void ) { "192.168.87.1", &net4, "192.168.86.1", 0 ); ipv4_route_ok ( "192.168.96.1", NULL, NULL, NULL, NULL, 0 ); testnet_remove_ok ( &net4 ); + + /* Multiple interfaces */ + testnet_ok ( &net0 ); + testnet_ok ( &net1 ); + testnet_ok ( &net2 ); + testnet_close_ok ( &net1 ); + ipv4_route_ok ( "192.168.0.9", NULL, + "192.168.0.9", &net0, "192.168.0.1", 0 ); + ipv4_route_ok ( "10.31.31.1", NULL, + "10.31.31.1", &net2, "10.31.31.0", 0 ); + testnet_close_ok ( &net0 ); + testnet_open_ok ( &net1 ); + ipv4_route_ok ( "192.168.0.9", NULL, + "192.168.0.9", &net1, "192.168.0.2", 0 ); + ipv4_route_ok ( "10.31.31.1", NULL, + "10.31.31.1", &net2, "10.31.31.0", 0 ); + testnet_close_ok ( &net2 ); + ipv4_route_ok ( "8.8.8.8", NULL, + "192.168.0.254", &net1, "192.168.0.2", 0 ); + testnet_close_ok ( &net1 ); + testnet_open_ok ( &net0 ); + ipv4_route_ok ( "8.8.8.8", NULL, + "192.168.0.254", &net0, "192.168.0.1", 0 ); + testnet_close_ok ( &net0 ); + testnet_open_ok ( &net2 ); + ipv4_route_ok ( "8.8.8.8", NULL, + "10.31.31.1", &net2, "10.31.31.0", 0 ); + testnet_remove_ok ( &net2 ); + testnet_remove_ok ( &net1 ); + testnet_remove_ok ( &net0 ); } /** IPv4 self-test */ diff --git a/src/usr/route_ipv4.c b/src/usr/route_ipv4.c index 6260335ac..f79c0ad8f 100644 --- a/src/usr/route_ipv4.c +++ b/src/usr/route_ipv4.c @@ -41,16 +41,51 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ static void route_ipv4_print ( struct net_device *netdev ) { struct ipv4_miniroute *miniroute; + struct ipv4_miniroute *defroute; + struct in_addr address; + struct in_addr network; + struct in_addr netmask; + struct in_addr gateway; + int remote; + /* Print routing table */ list_for_each_entry ( miniroute, &ipv4_miniroutes, list ) { + + /* Skip non-matching network devices */ if ( miniroute->netdev != netdev ) continue; - printf ( "%s: %s/", netdev->name, - inet_ntoa ( miniroute->address ) ); - printf ( "%s", inet_ntoa ( miniroute->netmask ) ); - if ( miniroute->gateway.s_addr ) - printf ( " gw %s", inet_ntoa ( miniroute->gateway ) ); - if ( ! netdev_is_open ( miniroute->netdev ) ) + address = miniroute->address; + network = miniroute->network; + netmask = miniroute->netmask; + gateway = miniroute->gateway; + assert ( ( network.s_addr & ~netmask.s_addr ) == 0 ); + + /* Defer default routes to be printed with local addresses */ + if ( ! netmask.s_addr ) + continue; + + /* Print local address and destination subnet */ + remote = ( ( address.s_addr ^ network.s_addr ) & + netmask.s_addr ); + printf ( "%s: %s", netdev->name, inet_ntoa ( address ) ); + if ( remote ) + printf ( " for %s", inet_ntoa ( network ) ); + printf ( "/%s", inet_ntoa ( netmask ) ); + if ( gateway.s_addr ) + printf ( " gw %s", inet_ntoa ( gateway ) ); + + /* Print default routes with local subnets */ + list_for_each_entry ( defroute, &ipv4_miniroutes, list ) { + if ( ( defroute->netdev == netdev ) && + ( defroute->address.s_addr = address.s_addr ) && + ( ! defroute->netmask.s_addr ) && ( ! remote ) ) { + printf ( " gw %s", + inet_ntoa ( defroute->gateway ) ); + } + } + + /* Print trailer */ + if ( ! netdev_is_open ( netdev ) ) printf ( " (inaccessible)" ); printf ( "\n" ); } -- cgit v1.2.3-55-g7522 From b5fb7353fa3856cee7e0a6760c2341ca617d6ef4 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 10 Jun 2025 16:55:18 +0100 Subject: [ipv4] Add support for classless static routes Add support for RFC 3442 classless static routes provided via DHCP option 121. Originally-implemented-by: Hazel Smith Originally-implemented-by: Raphael Pour Signed-off-by: Michael Brown --- src/include/ipxe/dhcp.h | 3 + src/include/ipxe/settings.h | 2 + src/net/ipv4.c | 165 ++++++++++++++++++++++++++++++++------------ src/net/udp/dhcp.c | 2 +- src/tests/ipv4_test.c | 29 ++++++++ 5 files changed, 157 insertions(+), 44 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/dhcp.h b/src/include/ipxe/dhcp.h index 4d68d3ca5..43729d0c5 100644 --- a/src/include/ipxe/dhcp.h +++ b/src/include/ipxe/dhcp.h @@ -344,6 +344,9 @@ struct dhcp_client_uuid { /** DNS domain search list */ #define DHCP_DOMAIN_SEARCH 119 +/** Classless static routes */ +#define DHCP_STATIC_ROUTES 121 + /** Etherboot-specific encapsulated options * * This encapsulated options field is used to contain all options diff --git a/src/include/ipxe/settings.h b/src/include/ipxe/settings.h index 0301da12e..689e011d3 100644 --- a/src/include/ipxe/settings.h +++ b/src/include/ipxe/settings.h @@ -437,6 +437,8 @@ netmask_setting __setting ( SETTING_IP4, netmask ); extern const struct setting gateway_setting __setting ( SETTING_IP4, gateway ); extern const struct setting +static_route_setting __setting ( SETTING_IP4, static_routes ); +extern const struct setting dns_setting __setting ( SETTING_IP4_EXTRA, dns ); extern const struct setting ip6_setting __setting ( SETTING_IP6, ip6 ); diff --git a/src/net/ipv4.c b/src/net/ipv4.c index ec96e4242..03517840b 100644 --- a/src/net/ipv4.c +++ b/src/net/ipv4.c @@ -134,36 +134,132 @@ static int ipv4_add_miniroute ( struct net_device *netdev, return 0; } +/** + * Add static route minirouting table entries + * + * @v netdev Network device + * @v address IPv4 address + * @v routes Static routes + * @v len Length of static routes + * @ret rc Return status code + */ +static int ipv4_add_static ( struct net_device *netdev, struct in_addr address, + const void *routes, size_t len ) { + const struct { + struct in_addr address; + } __attribute__ (( packed )) *encoded; + struct in_addr netmask; + struct in_addr network; + struct in_addr gateway; + unsigned int width; + unsigned int masklen; + size_t remaining; + const void *data; + int rc; + + /* Parse and add static routes */ + for ( data = routes, remaining = len ; remaining ; ) { + + /* Extract subnet mask width */ + width = *( ( uint8_t * ) data ); + data++; + remaining--; + masklen = ( ( width + 7 ) / 8 ); + + /* Check remaining length */ + if ( ( masklen + sizeof ( gateway ) ) > remaining ) { + DBGC ( netdev, "IPv4 invalid static route:\n" ); + DBGC_HDA ( netdev, 0, routes, len ); + return -EINVAL; + } + + /* Calculate subnet mask */ + if ( width ) { + netmask.s_addr = htonl ( -1UL << ( 32 - width ) ); + } else { + netmask.s_addr = 0; + } + + /* Extract network address */ + encoded = data; + network.s_addr = ( encoded->address.s_addr & netmask.s_addr ); + data += masklen; + remaining -= masklen; + + /* Extract gateway address */ + encoded = data; + gateway.s_addr = encoded->address.s_addr; + data += sizeof ( gateway ); + remaining -= sizeof ( gateway ); + + /* Add route */ + if ( ( rc = ipv4_add_miniroute ( netdev, address, network, + netmask, gateway ) ) != 0 ) + return rc; + } + + return 0; +} + /** * Add IPv4 minirouting table entries * * @v netdev Network device * @v address IPv4 address - * @v netmask Subnet mask - * @v gateway Gateway address (if any) * @ret rc Return status code */ static int ipv4_add_miniroutes ( struct net_device *netdev, - struct in_addr address, - struct in_addr netmask, - struct in_addr gateway ) { + struct in_addr address ) { + struct settings *settings = netdev_settings ( netdev ); struct in_addr none = { 0 }; + struct in_addr netmask; + struct in_addr gateway; struct in_addr network; + void *routes; + int len; int rc; + /* Get subnet mask */ + fetch_ipv4_setting ( settings, &netmask_setting, &netmask ); + + /* Calculate default netmask, if necessary */ + if ( ! netmask.s_addr ) { + if ( IN_IS_CLASSA ( address.s_addr ) ) { + netmask.s_addr = INADDR_NET_CLASSA; + } else if ( IN_IS_CLASSB ( address.s_addr ) ) { + netmask.s_addr = INADDR_NET_CLASSB; + } else if ( IN_IS_CLASSC ( address.s_addr ) ) { + netmask.s_addr = INADDR_NET_CLASSC; + } + } + + /* Get default gateway, if present */ + fetch_ipv4_setting ( settings, &gateway_setting, &gateway ); + + /* Get static routes, if present */ + len = fetch_raw_setting_copy ( settings, &static_route_setting, + &routes ); + /* Add local address */ network.s_addr = ( address.s_addr & netmask.s_addr ); if ( ( rc = ipv4_add_miniroute ( netdev, address, network, netmask, none ) ) != 0 ) - return rc; - - /* Add default gateway, if applicable */ - if ( gateway.s_addr && - ( ( rc = ipv4_add_miniroute ( netdev, address, none, none, - gateway ) ) != 0 ) ) - return rc; + goto done; + + /* Add static routes or default gateway, as applicable */ + if ( len >= 0 ) { + if ( ( rc = ipv4_add_static ( netdev, address, routes, + len ) ) != 0 ) + goto done; + } else if ( gateway.s_addr ) { + if ( ( rc = ipv4_add_miniroute ( netdev, address, none, none, + gateway ) ) != 0 ) + goto done; + } - return 0; + done: + free ( routes ); + return rc; } /** @@ -871,19 +967,24 @@ const struct setting gateway_setting __setting ( SETTING_IP4, gateway ) = { .type = &setting_type_ipv4, }; +/** Classless static routes setting */ +const struct setting static_route_setting __setting ( SETTING_IP4, + static_routes ) = { + .name = "static-routes", + .description = "Static routes", + .tag = DHCP_STATIC_ROUTES, + .type = &setting_type_hex, +}; + /** * Send gratuitous ARP, if applicable * * @v netdev Network device * @v address IPv4 address - * @v netmask Subnet mask - * @v gateway Gateway address (if any) * @ret rc Return status code */ static int ipv4_gratuitous_arp ( struct net_device *netdev, - struct in_addr address, - struct in_addr netmask __unused, - struct in_addr gateway __unused ) { + struct in_addr address ) { int rc; /* Do nothing if network device already has this IPv4 address */ @@ -910,14 +1011,10 @@ static int ipv4_gratuitous_arp ( struct net_device *netdev, * @ret rc Return status code */ static int ipv4_settings ( int ( * apply ) ( struct net_device *netdev, - struct in_addr address, - struct in_addr netmask, - struct in_addr gateway ) ) { + struct in_addr address ) ) { struct net_device *netdev; struct settings *settings; - struct in_addr address = { 0 }; - struct in_addr netmask = { 0 }; - struct in_addr gateway = { 0 }; + struct in_addr address; int rc; /* Process settings for each network device */ @@ -927,30 +1024,12 @@ static int ipv4_settings ( int ( * apply ) ( struct net_device *netdev, settings = netdev_settings ( netdev ); /* Get IPv4 address */ - address.s_addr = 0; fetch_ipv4_setting ( settings, &ip_setting, &address ); if ( ! address.s_addr ) continue; - /* Get subnet mask */ - fetch_ipv4_setting ( settings, &netmask_setting, &netmask ); - - /* Calculate default netmask, if necessary */ - if ( ! netmask.s_addr ) { - if ( IN_IS_CLASSA ( address.s_addr ) ) { - netmask.s_addr = INADDR_NET_CLASSA; - } else if ( IN_IS_CLASSB ( address.s_addr ) ) { - netmask.s_addr = INADDR_NET_CLASSB; - } else if ( IN_IS_CLASSC ( address.s_addr ) ) { - netmask.s_addr = INADDR_NET_CLASSC; - } - } - - /* Get default gateway, if present */ - fetch_ipv4_setting ( settings, &gateway_setting, &gateway ); - /* Apply settings */ - if ( ( rc = apply ( netdev, address, netmask, gateway ) ) != 0 ) + if ( ( rc = apply ( netdev, address ) ) != 0 ) return rc; } diff --git a/src/net/udp/dhcp.c b/src/net/udp/dhcp.c index 8e2e97f10..daa37b96b 100644 --- a/src/net/udp/dhcp.c +++ b/src/net/udp/dhcp.c @@ -94,7 +94,7 @@ static uint8_t dhcp_request_options_data[] = { DHCP_ROOT_PATH, DHCP_MTU, DHCP_NTP_SERVERS, DHCP_VENDOR_ENCAP, DHCP_VENDOR_CLASS_ID, DHCP_TFTP_SERVER_NAME, DHCP_BOOTFILE_NAME, - DHCP_DOMAIN_SEARCH, + DHCP_DOMAIN_SEARCH, DHCP_STATIC_ROUTES, 128, 129, 130, 131, 132, 133, 134, 135, /* for PXE */ DHCP_EB_ENCAP, DHCP_ISCSI_INITIATOR_IQN ), DHCP_END diff --git a/src/tests/ipv4_test.c b/src/tests/ipv4_test.c index 63e1e1dc5..be2760027 100644 --- a/src/tests/ipv4_test.c +++ b/src/tests/ipv4_test.c @@ -214,6 +214,17 @@ TESTNET ( net4, { "ip", "192.168.86.1" }, { "netmask", "255.255.240.0" } ); +/** net5: Static routes */ +TESTNET ( net5, + { "ip", "10.42.0.1" }, + { "netmask", "255.255.0.0" }, + { "gateway", "10.42.0.254" /* should be ignored */ }, + { "static-routes", + "19:0a:2b:2b:80:0a:2a:2b:2b:" /* 10.43.43.128/25 via 10.42.43.43 */ + "10:c0:a8:0a:2a:c0:a8:" /* 192.168.0.0/16 via 10.42.192.168 */ + "18:c0:a8:00:00:00:00:00:" /* 192.168.0.0/24 on-link */ + "00:0a:2a:01:01" /* default via 10.42.1.1 */ } ); + /** * Perform IPv4 self-tests * @@ -327,6 +338,24 @@ static void ipv4_test_exec ( void ) { testnet_remove_ok ( &net2 ); testnet_remove_ok ( &net1 ); testnet_remove_ok ( &net0 ); + + /* Static routes */ + testnet_ok ( &net5 ); + ipv4_route_ok ( "10.42.99.0", NULL, + "10.42.99.0", &net5, "10.42.0.1", 0 ); + ipv4_route_ok ( "8.8.8.8", NULL, + "10.42.1.1", &net5, "10.42.0.1", 0 ); + ipv4_route_ok ( "10.43.43.1", NULL, + "10.42.1.1", &net5, "10.42.0.1", 0 ); + ipv4_route_ok ( "10.43.43.129", NULL, + "10.42.43.43", &net5, "10.42.0.1", 0 ); + ipv4_route_ok ( "192.168.54.8", NULL, + "10.42.192.168", &net5, "10.42.0.1", 0 ); + ipv4_route_ok ( "192.168.0.8", NULL, + "192.168.0.8", &net5, "10.42.0.1", 0 ); + ipv4_route_ok ( "192.168.0.255", NULL, + "192.168.0.255", &net5, "10.42.0.1", 1 ); + testnet_remove_ok ( &net5 ); } /** IPv4 self-test */ -- cgit v1.2.3-55-g7522 From 1e3fb1b37e16cd7cd30f6b20b9eee929568f35a9 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 15 Jul 2025 14:08:15 +0100 Subject: [init] Show initialisation function names in debug messages Signed-off-by: Michael Brown --- src/arch/x86/core/cpuid_settings.c | 1 + src/arch/x86/core/debugcon.c | 1 + src/arch/x86/core/pci_autoboot.c | 1 + src/arch/x86/core/video_subr.c | 1 + src/arch/x86/interface/pcbios/bios_cachedhcp.c | 1 + src/arch/x86/interface/pcbios/int13con.c | 1 + src/arch/x86/interface/pcbios/pcicloud.c | 1 + src/arch/x86/interface/pxe/pxe_call.c | 1 + src/arch/x86/interface/vmware/guestinfo.c | 1 + src/arch/x86/interface/vmware/vmconsole.c | 1 + src/core/acpi_settings.c | 1 + src/core/fnrec.c | 1 + src/core/init.c | 4 +++- src/core/malloc.c | 1 + src/core/memmap_settings.c | 1 + src/core/process.c | 1 + src/core/serial.c | 1 + src/core/settings.c | 1 + src/core/timer.c | 1 + src/crypto/certstore.c | 1 + src/crypto/des.c | 1 + src/crypto/x25519.c | 1 + src/drivers/bus/pci_settings.c | 1 + src/drivers/bus/usb_settings.c | 1 + src/drivers/net/efi/snponly.c | 1 + src/image/embedded.c | 1 + src/include/ipxe/init.h | 1 + src/interface/efi/efi_cacert.c | 1 + src/interface/efi/efi_console.c | 1 + src/interface/efi/efi_fdt.c | 1 + src/interface/efi/efi_settings.c | 1 + src/interface/efi/efiprefix.c | 1 + src/interface/smbios/smbios_settings.c | 1 + src/net/netdev_settings.c | 1 + src/tests/bofm_test.c | 1 + src/tests/test.c | 1 + 36 files changed, 38 insertions(+), 1 deletion(-) (limited to 'src/net') diff --git a/src/arch/x86/core/cpuid_settings.c b/src/arch/x86/core/cpuid_settings.c index 9bc69f477..44d38debc 100644 --- a/src/arch/x86/core/cpuid_settings.c +++ b/src/arch/x86/core/cpuid_settings.c @@ -250,6 +250,7 @@ static void cpuid_settings_init ( void ) { /** CPUID settings initialiser */ struct init_fn cpuid_settings_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "cpuid", .initialise = cpuid_settings_init, }; diff --git a/src/arch/x86/core/debugcon.c b/src/arch/x86/core/debugcon.c index 60de61f55..0e3a5dfc7 100644 --- a/src/arch/x86/core/debugcon.c +++ b/src/arch/x86/core/debugcon.c @@ -86,5 +86,6 @@ static void debugcon_init ( void ) { * Debug port console initialisation function */ struct init_fn debugcon_init_fn __init_fn ( INIT_EARLY ) = { + .name = "debugcon", .initialise = debugcon_init, }; diff --git a/src/arch/x86/core/pci_autoboot.c b/src/arch/x86/core/pci_autoboot.c index 337598091..243e45026 100644 --- a/src/arch/x86/core/pci_autoboot.c +++ b/src/arch/x86/core/pci_autoboot.c @@ -44,5 +44,6 @@ static void pci_autoboot_init ( void ) { /** PCI autoboot device initialisation function */ struct init_fn pci_autoboot_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "autoboot", .initialise = pci_autoboot_init, }; diff --git a/src/arch/x86/core/video_subr.c b/src/arch/x86/core/video_subr.c index f5cc4cdd4..4e9ef466f 100644 --- a/src/arch/x86/core/video_subr.c +++ b/src/arch/x86/core/video_subr.c @@ -109,5 +109,6 @@ struct console_driver vga_console __console_driver = { }; struct init_fn video_init_fn __init_fn ( INIT_EARLY ) = { + .name = "video", .initialise = video_init, }; diff --git a/src/arch/x86/interface/pcbios/bios_cachedhcp.c b/src/arch/x86/interface/pcbios/bios_cachedhcp.c index 897858143..60191c9c5 100644 --- a/src/arch/x86/interface/pcbios/bios_cachedhcp.c +++ b/src/arch/x86/interface/pcbios/bios_cachedhcp.c @@ -74,5 +74,6 @@ static void cachedhcp_init ( void ) { /** Cached DHCPACK initialisation function */ struct init_fn cachedhcp_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "cachedhcp", .initialise = cachedhcp_init, }; diff --git a/src/arch/x86/interface/pcbios/int13con.c b/src/arch/x86/interface/pcbios/int13con.c index 8106cd153..925228874 100644 --- a/src/arch/x86/interface/pcbios/int13con.c +++ b/src/arch/x86/interface/pcbios/int13con.c @@ -288,6 +288,7 @@ static void int13con_init ( void ) { * INT13 console initialisation function */ struct init_fn int13con_init_fn __init_fn ( INIT_CONSOLE ) = { + .name = "int13con", .initialise = int13con_init, }; diff --git a/src/arch/x86/interface/pcbios/pcicloud.c b/src/arch/x86/interface/pcbios/pcicloud.c index f7d4a2da1..5d4d02ac4 100644 --- a/src/arch/x86/interface/pcbios/pcicloud.c +++ b/src/arch/x86/interface/pcbios/pcicloud.c @@ -191,5 +191,6 @@ static void pcicloud_init ( void ) { /** Cloud VM PCI configuration space access initialisation function */ struct init_fn pcicloud_init_fn __init_fn ( INIT_EARLY ) = { + .name = "pcicloud", .initialise = pcicloud_init, }; diff --git a/src/arch/x86/interface/pxe/pxe_call.c b/src/arch/x86/interface/pxe/pxe_call.c index a530f919f..9a6a20dd3 100644 --- a/src/arch/x86/interface/pxe/pxe_call.c +++ b/src/arch/x86/interface/pxe/pxe_call.c @@ -257,6 +257,7 @@ static void pxe_init_structures ( void ) { /** PXE structure initialiser */ struct init_fn pxe_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "pxe", .initialise = pxe_init_structures, }; diff --git a/src/arch/x86/interface/vmware/guestinfo.c b/src/arch/x86/interface/vmware/guestinfo.c index 4134515c1..c181d96e9 100644 --- a/src/arch/x86/interface/vmware/guestinfo.c +++ b/src/arch/x86/interface/vmware/guestinfo.c @@ -200,6 +200,7 @@ static void guestinfo_init ( void ) { /** GuestInfo settings initialiser */ struct init_fn guestinfo_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "guestinfo", .initialise = guestinfo_init, }; diff --git a/src/arch/x86/interface/vmware/vmconsole.c b/src/arch/x86/interface/vmware/vmconsole.c index f7df4f75b..3b892c837 100644 --- a/src/arch/x86/interface/vmware/vmconsole.c +++ b/src/arch/x86/interface/vmware/vmconsole.c @@ -134,5 +134,6 @@ static void vmconsole_init ( void ) { * VMware logfile console initialisation function */ struct init_fn vmconsole_init_fn __init_fn ( INIT_CONSOLE ) = { + .name = "vmconsole", .initialise = vmconsole_init, }; diff --git a/src/core/acpi_settings.c b/src/core/acpi_settings.c index cdee1f865..63f271855 100644 --- a/src/core/acpi_settings.c +++ b/src/core/acpi_settings.c @@ -156,5 +156,6 @@ static void acpi_settings_init ( void ) { /** ACPI settings initialiser */ struct init_fn acpi_settings_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "acpi", .initialise = acpi_settings_init, }; diff --git a/src/core/fnrec.c b/src/core/fnrec.c index 0430817f8..b63ffc1f5 100644 --- a/src/core/fnrec.c +++ b/src/core/fnrec.c @@ -177,6 +177,7 @@ static void fnrec_init ( void ) { } struct init_fn fnrec_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "fnrec", .initialise = fnrec_init, }; diff --git a/src/core/init.c b/src/core/init.c index c13fd1667..406d22d7b 100644 --- a/src/core/init.c +++ b/src/core/init.c @@ -53,8 +53,10 @@ void initialise ( void ) { struct init_fn *init_fn; /* Call registered initialisation functions */ - for_each_table_entry ( init_fn, INIT_FNS ) + for_each_table_entry ( init_fn, INIT_FNS ) { + DBGC ( colour, "INIT initialising %s...\n", init_fn->name ); init_fn->initialise (); + } } /** diff --git a/src/core/malloc.c b/src/core/malloc.c index 545927a30..a05871085 100644 --- a/src/core/malloc.c +++ b/src/core/malloc.c @@ -765,6 +765,7 @@ static void init_heap ( void ) { /** Memory allocator initialisation function */ struct init_fn heap_init_fn __init_fn ( INIT_EARLY ) = { + .name = "heap", .initialise = init_heap, }; diff --git a/src/core/memmap_settings.c b/src/core/memmap_settings.c index d07e9747e..f54de9150 100644 --- a/src/core/memmap_settings.c +++ b/src/core/memmap_settings.c @@ -243,6 +243,7 @@ static void memmap_settings_init ( void ) { /** Memory map settings initialiser */ struct init_fn memmap_settings_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "memmap", .initialise = memmap_settings_init, }; diff --git a/src/core/process.c b/src/core/process.c index 69852c416..c944b6f50 100644 --- a/src/core/process.c +++ b/src/core/process.c @@ -133,5 +133,6 @@ static void init_processes ( void ) { /** Process initialiser */ struct init_fn process_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "process", .initialise = init_processes, }; diff --git a/src/core/serial.c b/src/core/serial.c index 4b569ffad..0883ad051 100644 --- a/src/core/serial.c +++ b/src/core/serial.c @@ -180,6 +180,7 @@ static void serial_shutdown ( int flags __unused ) { /** Serial console initialisation function */ struct init_fn serial_console_init_fn __init_fn ( INIT_CONSOLE ) = { + .name = "serial", .initialise = serial_init, }; diff --git a/src/core/settings.c b/src/core/settings.c index 9fbf753ab..05e495dcf 100644 --- a/src/core/settings.c +++ b/src/core/settings.c @@ -2819,5 +2819,6 @@ static void builtin_init ( void ) { /** Built-in settings initialiser */ struct init_fn builtin_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "builtin", .initialise = builtin_init, }; diff --git a/src/core/timer.c b/src/core/timer.c index 24745cef7..d45797adb 100644 --- a/src/core/timer.c +++ b/src/core/timer.c @@ -170,6 +170,7 @@ static void timer_probe ( void ) { /** Timer initialisation function */ struct init_fn timer_init_fn __init_fn ( INIT_EARLY ) = { + .name = "timer", .initialise = timer_probe, }; diff --git a/src/crypto/certstore.c b/src/crypto/certstore.c index 81179f9cc..aad874297 100644 --- a/src/crypto/certstore.c +++ b/src/crypto/certstore.c @@ -210,6 +210,7 @@ static void certstore_init ( void ) { /** Certificate store initialisation function */ struct init_fn certstore_init_fn __init_fn ( INIT_LATE ) = { + .name = "certstore", .initialise = certstore_init, }; diff --git a/src/crypto/des.c b/src/crypto/des.c index 6918bec3e..206f78d50 100644 --- a/src/crypto/des.c +++ b/src/crypto/des.c @@ -369,6 +369,7 @@ static void des_init ( void ) { /** Initialisation function */ struct init_fn des_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "des", .initialise = des_init, }; diff --git a/src/crypto/x25519.c b/src/crypto/x25519.c index 995cfa352..41bc5fc5e 100644 --- a/src/crypto/x25519.c +++ b/src/crypto/x25519.c @@ -334,6 +334,7 @@ static void x25519_init_constants ( void ) { /** Initialisation function */ struct init_fn x25519_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "x25519", .initialise = x25519_init_constants, }; diff --git a/src/drivers/bus/pci_settings.c b/src/drivers/bus/pci_settings.c index 84aa76827..fc73c651e 100644 --- a/src/drivers/bus/pci_settings.c +++ b/src/drivers/bus/pci_settings.c @@ -125,5 +125,6 @@ static void pci_settings_init ( void ) { /** PCI device settings initialiser */ struct init_fn pci_settings_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "pci", .initialise = pci_settings_init, }; diff --git a/src/drivers/bus/usb_settings.c b/src/drivers/bus/usb_settings.c index 4fd190d83..bb01f34d5 100644 --- a/src/drivers/bus/usb_settings.c +++ b/src/drivers/bus/usb_settings.c @@ -173,5 +173,6 @@ static void usb_settings_init ( void ) { /** USB device settings initialiser */ struct init_fn usb_settings_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "usb", .initialise = usb_settings_init, }; diff --git a/src/drivers/net/efi/snponly.c b/src/drivers/net/efi/snponly.c index f0a5277a2..876479133 100644 --- a/src/drivers/net/efi/snponly.c +++ b/src/drivers/net/efi/snponly.c @@ -259,5 +259,6 @@ static void chained_init ( void ) { /** EFI chainloaded-device-only initialisation function */ struct init_fn chained_init_fn __init_fn ( INIT_LATE ) = { + .name = "chained", .initialise = chained_init, }; diff --git a/src/image/embedded.c b/src/image/embedded.c index 2934d4ee7..652cfc85f 100644 --- a/src/image/embedded.c +++ b/src/image/embedded.c @@ -80,5 +80,6 @@ static void embedded_init ( void ) { /** Embedded image initialisation function */ struct init_fn embedded_init_fn __init_fn ( INIT_LATE ) = { + .name = "embedded", .initialise = embedded_init, }; diff --git a/src/include/ipxe/init.h b/src/include/ipxe/init.h index 32927e3a6..da01b2953 100644 --- a/src/include/ipxe/init.h +++ b/src/include/ipxe/init.h @@ -12,6 +12,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); * call to initialise(). */ struct init_fn { + const char *name; void ( * initialise ) ( void ); }; diff --git a/src/interface/efi/efi_cacert.c b/src/interface/efi/efi_cacert.c index 2b6c5c343..64bb0bae2 100644 --- a/src/interface/efi/efi_cacert.c +++ b/src/interface/efi/efi_cacert.c @@ -178,6 +178,7 @@ static void efi_cacert_init ( void ) { /** EFI CA certificates initialisation function */ struct init_fn efi_cacert_init_fn __init_fn ( INIT_LATE ) = { + .name = "eficacert", .initialise = efi_cacert_init, }; diff --git a/src/interface/efi/efi_console.c b/src/interface/efi/efi_console.c index 9fc3c65c0..4557671a0 100644 --- a/src/interface/efi/efi_console.c +++ b/src/interface/efi/efi_console.c @@ -448,5 +448,6 @@ static void efi_console_init ( void ) { * EFI console initialisation function */ struct init_fn efi_console_init_fn __init_fn ( INIT_EARLY ) = { + .name = "eficonsole", .initialise = efi_console_init, }; diff --git a/src/interface/efi/efi_fdt.c b/src/interface/efi/efi_fdt.c index 3a90fd7ce..3c249693e 100644 --- a/src/interface/efi/efi_fdt.c +++ b/src/interface/efi/efi_fdt.c @@ -77,6 +77,7 @@ static void efi_fdt_init ( void ) { /** EFI Flattened Device Tree initialisation function */ struct init_fn efi_fdt_init_fn __init_fn ( INIT_EARLY ) = { + .name = "efifdt", .initialise = efi_fdt_init, }; diff --git a/src/interface/efi/efi_settings.c b/src/interface/efi/efi_settings.c index cde0ff8d1..5ddbe12f1 100644 --- a/src/interface/efi/efi_settings.c +++ b/src/interface/efi/efi_settings.c @@ -232,5 +232,6 @@ static void efivars_init ( void ) { /** EFI variable settings initialiser */ struct init_fn efivars_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "efivars", .initialise = efivars_init, }; diff --git a/src/interface/efi/efiprefix.c b/src/interface/efi/efiprefix.c index 10d8f0bf6..ddce6aa60 100644 --- a/src/interface/efi/efiprefix.c +++ b/src/interface/efi/efiprefix.c @@ -98,6 +98,7 @@ static void efi_init_application ( void ) { /** EFI application initialisation function */ struct init_fn efi_init_application_fn __init_fn ( INIT_NORMAL ) = { + .name = "efi", .initialise = efi_init_application, }; diff --git a/src/interface/smbios/smbios_settings.c b/src/interface/smbios/smbios_settings.c index 1fe545f38..6358a4709 100644 --- a/src/interface/smbios/smbios_settings.c +++ b/src/interface/smbios/smbios_settings.c @@ -200,6 +200,7 @@ static void smbios_init ( void ) { /** SMBIOS settings initialiser */ struct init_fn smbios_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "smbios", .initialise = smbios_init, }; diff --git a/src/net/netdev_settings.c b/src/net/netdev_settings.c index 9432dc2fa..90b804c6c 100644 --- a/src/net/netdev_settings.c +++ b/src/net/netdev_settings.c @@ -429,6 +429,7 @@ static void netdev_redirect_settings_init ( void ) { /** "netX" settings initialiser */ struct init_fn netdev_redirect_settings_init_fn __init_fn ( INIT_LATE ) = { + .name = "netX", .initialise = netdev_redirect_settings_init, }; diff --git a/src/tests/bofm_test.c b/src/tests/bofm_test.c index 6d472bc7e..bc400284f 100644 --- a/src/tests/bofm_test.c +++ b/src/tests/bofm_test.c @@ -278,5 +278,6 @@ static void bofm_test_init ( void ) { /** BOFM test initialisation function */ struct init_fn bofm_test_init_fn __init_fn ( INIT_NORMAL ) = { + .name = "bofm", .initialise = bofm_test_init, }; diff --git a/src/tests/test.c b/src/tests/test.c index 9fa12e27a..e4f5eb838 100644 --- a/src/tests/test.c +++ b/src/tests/test.c @@ -180,5 +180,6 @@ static void test_init ( void ) { /** Self-test initialisation function */ struct init_fn test_init_fn __init_fn ( INIT_EARLY ) = { + .name = "test", .initialise = test_init, }; -- cgit v1.2.3-55-g7522 From d6656106e9a9a08642ab24700c0554273d917510 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 12 Oct 2025 22:20:13 +0100 Subject: [tls] Generate master secret only after sending Client Key Exchange The calculation for the extended master secret as defined in RFC 7627 relies upon the digest of all handshake messages up to and including the Client Key Exchange. Facilitate this calculation by generating the master secret only after sending the Client Key Exchange message. Signed-off-by: Michael Brown --- src/net/tls.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) (limited to 'src/net') diff --git a/src/net/tls.c b/src/net/tls.c index 643b9292d..cc463214f 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1399,10 +1399,6 @@ static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) { return rc; } - /* Generate master secret */ - tls_generate_master_secret ( tls, &pre_master_secret, - sizeof ( pre_master_secret ) ); - /* Encrypt pre-master secret using server's public key */ memset ( &key_xchg, 0, sizeof ( key_xchg ) ); len = pubkey_encrypt ( pubkey, &tls->server.key, &pre_master_secret, @@ -1423,8 +1419,18 @@ static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) { htons ( sizeof ( key_xchg.encrypted_pre_master_secret ) - unused ); - return tls_send_handshake ( tls, &key_xchg, - ( sizeof ( key_xchg ) - unused ) ); + /* Transmit Client Key Exchange record */ + if ( ( rc = tls_send_handshake ( tls, &key_xchg, + ( sizeof ( key_xchg ) - + unused ) ) ) != 0 ) { + return rc; + } + + /* Generate master secret */ + tls_generate_master_secret ( tls, &pre_master_secret, + sizeof ( pre_master_secret ) ); + + return 0; } /** Public key exchange algorithm */ @@ -1622,15 +1628,15 @@ static int tls_send_client_key_exchange_dhe ( struct tls_connection *tls ) { len--; } - /* Generate master secret */ - tls_generate_master_secret ( tls, pre_master_secret, len ); - /* Transmit Client Key Exchange record */ if ( ( rc = tls_send_handshake ( tls, key_xchg, sizeof ( *key_xchg ) ) ) !=0){ goto err_send_handshake; } + /* Generate master secret */ + tls_generate_master_secret ( tls, pre_master_secret, len ); + err_send_handshake: err_dhe_key: free ( dynamic ); @@ -1749,10 +1755,6 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { return rc; } - /* Generate master secret */ - tls_generate_master_secret ( tls, pre_master_secret, - curve->pre_master_secret_len ); - /* Generate Client Key Exchange record */ key_xchg.type_length = ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) | @@ -1767,6 +1769,10 @@ static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) { sizeof ( key_xchg ) ) ) !=0){ return rc; } + + /* Generate master secret */ + tls_generate_master_secret ( tls, pre_master_secret, + curve->pre_master_secret_len ); } return 0; -- cgit v1.2.3-55-g7522 From ab64bc5b8d2335294ce2d967fc1f0c32322bbf40 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 12 Oct 2025 22:26:49 +0100 Subject: [tls] Add support for the Extended Master Secret RFC 7627 defines the Extended Master Secret (EMS) as an alternative calculation that uses the digest of all handshake messages rather than just the client and server random bytes. Add support for negotiating the Extended Master Secret extension and performing the relevant calculation of the master secret. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 5 +++++ src/net/tls.c | 57 +++++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 55 insertions(+), 7 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 3b46543bb..658a008f8 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -134,6 +134,9 @@ struct tls_header { /* TLS signature algorithms extension */ #define TLS_SIGNATURE_ALGORITHMS 13 +/* TLS extended master secret extension */ +#define TLS_EXTENDED_MASTER_SECRET 23 + /* TLS session ticket extension */ #define TLS_SESSION_TICKET 35 @@ -452,6 +455,8 @@ struct tls_connection { uint8_t *handshake_ctx; /** Secure renegotiation flag */ int secure_renegotiation; + /** Extended master secret flag */ + int extended_master_secret; /** Verification data */ struct tls_verify_data verify; diff --git a/src/net/tls.c b/src/net/tls.c index cc463214f..8f91da018 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -200,6 +200,7 @@ static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type, const void *data, size_t len ); static void tls_clear_cipher ( struct tls_connection *tls, struct tls_cipherspec *cipherspec ); +static void tls_verify_handshake ( struct tls_connection *tls, void *out ); /****************************************************************************** * @@ -637,21 +638,43 @@ static void tls_prf ( struct tls_connection *tls, const void *secret, static void tls_generate_master_secret ( struct tls_connection *tls, const void *pre_master_secret, size_t pre_master_secret_len ) { + struct digest_algorithm *digest = tls->handshake_digest; + uint8_t digest_out[ digest->digestsize ]; + + /* Generate handshake digest */ + tls_verify_handshake ( tls, digest_out ); - DBGC ( tls, "TLS %p pre-master-secret:\n", tls ); + /* Show inputs */ + DBGC ( tls, "TLS %p pre-master secret:\n", tls ); DBGC_HD ( tls, pre_master_secret, pre_master_secret_len ); DBGC ( tls, "TLS %p client random bytes:\n", tls ); DBGC_HD ( tls, &tls->client.random, sizeof ( tls->client.random ) ); DBGC ( tls, "TLS %p server random bytes:\n", tls ); DBGC_HD ( tls, &tls->server.random, sizeof ( tls->server.random ) ); + DBGC ( tls, "TLS %p session hash:\n", tls ); + DBGC_HD ( tls, digest_out, sizeof ( digest_out ) ); - tls_prf_label ( tls, pre_master_secret, pre_master_secret_len, - &tls->master_secret, sizeof ( tls->master_secret ), - "master secret", - &tls->client.random, sizeof ( tls->client.random ), - &tls->server.random, sizeof ( tls->server.random ) ); + /* Generate master secret */ + if ( tls->extended_master_secret ) { + tls_prf_label ( tls, pre_master_secret, pre_master_secret_len, + &tls->master_secret, + sizeof ( tls->master_secret ), + "extended master secret", + digest_out, sizeof ( digest_out ) ); + } else { + tls_prf_label ( tls, pre_master_secret, pre_master_secret_len, + &tls->master_secret, + sizeof ( tls->master_secret ), + "master secret", + &tls->client.random, + sizeof ( tls->client.random ), + &tls->server.random, + sizeof ( tls->server.random ) ); + } - DBGC ( tls, "TLS %p generated master secret:\n", tls ); + /* Show output */ + DBGC ( tls, "TLS %p generated %smaster secret:\n", tls, + ( tls->extended_master_secret ? "extended ": "" ) ); DBGC_HD ( tls, &tls->master_secret, sizeof ( tls->master_secret ) ); } @@ -1195,12 +1218,17 @@ static int tls_client_hello ( struct tls_connection *tls, uint16_t code[TLS_NUM_NAMED_CURVES]; } __attribute__ (( packed )) data; } __attribute__ (( packed )) *named_curve_ext; + struct { + uint16_t type; + uint16_t len; + } __attribute__ (( packed )) *extended_master_secret_ext; struct { typeof ( *server_name_ext ) server_name; typeof ( *max_fragment_length_ext ) max_fragment_length; typeof ( *signature_algorithms_ext ) signature_algorithms; typeof ( *renegotiation_info_ext ) renegotiation_info; typeof ( *session_ticket_ext ) session_ticket; + typeof ( *extended_master_secret_ext ) extended_master_secret; typeof ( *named_curve_ext ) named_curve[TLS_NUM_NAMED_CURVES ? 1 : 0]; } __attribute__ (( packed )) *extensions; @@ -1286,6 +1314,12 @@ static int tls_client_hello ( struct tls_connection *tls, memcpy ( session_ticket_ext->data.data, session->ticket, sizeof ( session_ticket_ext->data.data ) ); + /* Construct extended master secret extension */ + extended_master_secret_ext = &extensions->extended_master_secret; + extended_master_secret_ext->type + = htons ( TLS_EXTENDED_MASTER_SECRET ); + extended_master_secret_ext->len = 0; + /* Construct named curves extension, if applicable */ if ( sizeof ( extensions->named_curve ) ) { named_curve_ext = &extensions->named_curve[0]; @@ -2091,6 +2125,9 @@ static int tls_new_server_hello ( struct tls_connection *tls, uint8_t len; uint8_t data[0]; } __attribute__ (( packed )) *reneg = NULL; + const struct { + uint8_t data[0]; + } __attribute__ (( packed )) *ems = NULL; uint16_t version; size_t exts_len; size_t ext_len; @@ -2155,6 +2192,9 @@ static int tls_new_server_hello ( struct tls_connection *tls, return -EINVAL_HELLO; } break; + case htons ( TLS_EXTENDED_MASTER_SECRET ) : + ems = ( ( void * ) ext->data ); + break; } } } @@ -2188,6 +2228,9 @@ static int tls_new_server_hello ( struct tls_connection *tls, memcpy ( &tls->server.random, &hello_a->random, sizeof ( tls->server.random ) ); + /* Handle extended master secret */ + tls->extended_master_secret = ( !! ems ); + /* Check session ID */ if ( hello_a->session_id_len && ( hello_a->session_id_len == tls->session_id_len ) && -- cgit v1.2.3-55-g7522 From 57504353febc61533e637f16ec6f933870b68ec9 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 12 Oct 2025 22:29:33 +0100 Subject: [tls] Refuse to resume sessions with mismatched master secret methods RFC 7627 section 5.3 states that the client must abort the handshake if the server attempts to resume a session where the master secret calculation method stored in the session does not match the method used for the connection being resumed. Signed-off-by: Michael Brown --- src/include/ipxe/tls.h | 2 ++ src/net/tls.c | 13 +++++++++++++ 2 files changed, 15 insertions(+) (limited to 'src/net') diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 658a008f8..8ddc9c1be 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -353,6 +353,8 @@ struct tls_session { size_t ticket_len; /** Master secret */ uint8_t master_secret[48]; + /** Extended master secret flag */ + int extended_master_secret; /** List of connections */ struct list_head conn; diff --git a/src/net/tls.c b/src/net/tls.c index 8f91da018..efecf368c 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -183,6 +183,10 @@ FILE_LICENCE ( GPL2_OR_LATER ); #define EINFO_EPERM_KEY_EXCHANGE \ __einfo_uniqify ( EINFO_EPERM, 0x06, \ "ServerKeyExchange verification failed" ) +#define EPERM_EMS __einfo_error ( EINFO_EPERM_EMS ) +#define EINFO_EPERM_EMS \ + __einfo_uniqify ( EINFO_EPERM, 0x07, \ + "Extended master secret extension mismatch" ) #define EPROTO_VERSION __einfo_error ( EINFO_EPROTO_VERSION ) #define EINFO_EPROTO_VERSION \ __einfo_uniqify ( EINFO_EPROTO, 0x01, \ @@ -2243,6 +2247,14 @@ static int tls_new_server_hello ( struct tls_connection *tls, if ( ( rc = tls_generate_keys ( tls ) ) != 0 ) return rc; + /* Ensure master secret generation method matches */ + if ( tls->extended_master_secret != + tls->session->extended_master_secret ) { + DBGC ( tls, "TLS %p mismatched extended master secret " + "extension\n", tls ); + return -EPERM_EMS; + } + } else { /* Record new session ID, if present */ @@ -2635,6 +2647,7 @@ static int tls_new_finished ( struct tls_connection *tls, if ( tls->session_id_len || tls->new_session_ticket_len ) { memcpy ( session->master_secret, tls->master_secret, sizeof ( session->master_secret ) ); + session->extended_master_secret = tls->extended_master_secret; } if ( tls->session_id_len ) { session->id_len = tls->session_id_len; -- cgit v1.2.3-55-g7522 From e80818e4f6e3791ec8240bda0a72eef999e4bf26 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sun, 12 Oct 2025 22:37:49 +0100 Subject: [tls] Disable renegotiation unless extended master secret is used RFC 7627 states that renegotiation becomes no longer secure under various circumstances when the non-extended master secret is used. The description of the precise set of circumstances is spread across various points within the document and is not entirely clear. Avoid a superset of the circumstances in which renegotiation apparently becomes insecure by refusing renegotiation completely unless the extended master secret is used. Signed-off-by: Michael Brown --- src/net/tls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/net') diff --git a/src/net/tls.c b/src/net/tls.c index efecf368c..1d5a6c6d8 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -2082,7 +2082,7 @@ static int tls_new_hello_request ( struct tls_connection *tls, } /* Fail unless server supports secure renegotiation */ - if ( ! tls->secure_renegotiation ) { + if ( ! ( tls->secure_renegotiation && tls->extended_master_secret ) ) { DBGC ( tls, "TLS %p refusing to renegotiate insecurely\n", tls ); return -EPERM_RENEG_INSECURE; -- cgit v1.2.3-55-g7522 From 8cd963ab9657d3b14ad36a37a73522fc91415c90 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 1 Dec 2025 14:47:51 +0000 Subject: [crypto] Pass signatures for verification as ASN.1 cursors Signed-off-by: Michael Brown --- src/crypto/cms.c | 2 +- src/crypto/crypto_null.c | 3 +-- src/crypto/ocsp.c | 3 +-- src/crypto/rsa.c | 11 +++++------ src/crypto/x509.c | 3 +-- src/include/ipxe/crypto.h | 11 +++++------ src/net/tls.c | 10 +++++----- src/tests/pubkey_test.c | 20 +++++++++++--------- src/tests/pubkey_test.h | 10 +++++----- 9 files changed, 35 insertions(+), 38 deletions(-) (limited to 'src/net') diff --git a/src/crypto/cms.c b/src/crypto/cms.c index e3571f330..a3c03a9b4 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -757,7 +757,7 @@ static int cms_verify_digest ( struct cms_message *cms, /* Verify digest */ if ( ( rc = pubkey_verify ( pubkey, key, digest, digest_out, - value->data, value->len ) ) != 0 ) { + value ) ) != 0 ) { DBGC ( cms, "CMS %p/%p signature verification failed: %s\n", cms, part, strerror ( rc ) ); return rc; diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c index d5863f958..ca4e1b134 100644 --- a/src/crypto/crypto_null.c +++ b/src/crypto/crypto_null.c @@ -120,8 +120,7 @@ int pubkey_null_sign ( const struct asn1_cursor *key __unused, int pubkey_null_verify ( const struct asn1_cursor *key __unused, struct digest_algorithm *digest __unused, const void *value __unused, - const void *signature __unused , - size_t signature_len __unused ) { + const struct asn1_cursor *signature __unused ) { return 0; } diff --git a/src/crypto/ocsp.c b/src/crypto/ocsp.c index ae70f320c..1712d614e 100644 --- a/src/crypto/ocsp.c +++ b/src/crypto/ocsp.c @@ -858,8 +858,7 @@ static int ocsp_check_signature ( struct ocsp_check *ocsp, /* Verify digest */ if ( ( rc = pubkey_verify ( pubkey, key, digest, digest_out, - response->signature.data, - response->signature.len ) ) != 0 ) { + &response->signature ) ) != 0 ) { DBGC ( ocsp, "OCSP %p \"%s\" signature verification failed: " "%s\n", ocsp, x509_name ( ocsp->cert ), strerror ( rc )); return rc; diff --git a/src/crypto/rsa.c b/src/crypto/rsa.c index f9041eede..b93437518 100644 --- a/src/crypto/rsa.c +++ b/src/crypto/rsa.c @@ -591,12 +591,11 @@ static int rsa_sign ( const struct asn1_cursor *key, * @v digest Digest algorithm * @v value Digest value * @v signature Signature - * @v signature_len Signature length * @ret rc Return status code */ static int rsa_verify ( const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, - const void *signature, size_t signature_len ) { + const struct asn1_cursor *signature ) { struct rsa_context context; void *temp; void *expected; @@ -606,17 +605,17 @@ static int rsa_verify ( const struct asn1_cursor *key, DBGC ( &context, "RSA %p verifying %s digest:\n", &context, digest->name ); DBGC_HDA ( &context, 0, value, digest->digestsize ); - DBGC_HDA ( &context, 0, signature, signature_len ); + DBGC_HDA ( &context, 0, signature->data, signature->len ); /* Initialise context */ if ( ( rc = rsa_init ( &context, key ) ) != 0 ) goto err_init; /* Sanity check */ - if ( signature_len != context.max_len ) { + if ( signature->len != context.max_len ) { DBGC ( &context, "RSA %p signature incorrect length (%zd " "bytes, should be %zd)\n", - &context, signature_len, context.max_len ); + &context, signature->len, context.max_len ); rc = -ERANGE; goto err_sanity; } @@ -626,7 +625,7 @@ static int rsa_verify ( const struct asn1_cursor *key, */ temp = context.input0; expected = temp; - rsa_cipher ( &context, signature, expected ); + rsa_cipher ( &context, signature->data, expected ); DBGC ( &context, "RSA %p deciphered signature:\n", &context ); DBGC_HDA ( &context, 0, expected, context.max_len ); diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 0b01171b6..5d39a1dd8 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1152,8 +1152,7 @@ static int x509_check_signature ( struct x509_certificate *cert, /* Verify signature using signer's public key */ if ( ( rc = pubkey_verify ( pubkey, &public_key->raw, digest, - digest_out, signature->value.data, - signature->value.len ) ) != 0 ) { + digest_out, &signature->value ) ) != 0 ) { DBGC ( cert, "X509 %p \"%s\" signature verification failed: " "%s\n", cert, x509_name ( cert ), strerror ( rc ) ); goto err_pubkey_verify; diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index 4bd543ae2..5b87d1a47 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -164,12 +164,11 @@ struct pubkey_algorithm { * @v digest Digest algorithm * @v value Digest value * @v signature Signature - * @v signature_len Signature length * @ret rc Return status code */ int ( * verify ) ( const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, - const void *signature, size_t signature_len ); + const struct asn1_cursor *signature ); /** Check that public key matches private key * * @v private_key Private key @@ -295,8 +294,8 @@ pubkey_sign ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, static inline __attribute__ (( always_inline )) int pubkey_verify ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, - const void *signature, size_t signature_len ) { - return pubkey->verify ( key, digest, value, signature, signature_len ); + const struct asn1_cursor *signature ) { + return pubkey->verify ( key, digest, value, signature ); } static inline __attribute__ (( always_inline )) int @@ -336,8 +335,8 @@ extern int pubkey_null_sign ( const struct asn1_cursor *key, const void *value, void *signature ); extern int pubkey_null_verify ( const struct asn1_cursor *key, struct digest_algorithm *digest, - const void *value, const void *signature , - size_t signature_len ); + const void *value, + const struct asn1_cursor *signature ); extern struct digest_algorithm digest_null; extern struct cipher_algorithm cipher_null; diff --git a/src/net/tls.c b/src/net/tls.c index 1d5a6c6d8..1bcb5c027 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1495,6 +1495,7 @@ static int tls_verify_dh_params ( struct tls_connection *tls, uint16_t signature_len; uint8_t signature[0]; } __attribute__ (( packed )) *sig; + struct asn1_cursor signature; const void *data; size_t remaining; int rc; @@ -1515,6 +1516,8 @@ static int tls_verify_dh_params ( struct tls_connection *tls, tls->server.exchange_len ); return -EINVAL_KEY_EXCHANGE; } + signature.data = sig->signature; + signature.len = ntohs ( sig->signature_len ); /* Identify signature and hash algorithm */ if ( use_sig_hash ) { @@ -1538,8 +1541,6 @@ static int tls_verify_dh_params ( struct tls_connection *tls, /* Verify signature */ { - const void *signature = sig->signature; - size_t signature_len = ntohs ( sig->signature_len ); uint8_t ctx[digest->ctxsize]; uint8_t hash[digest->digestsize]; @@ -1553,9 +1554,8 @@ static int tls_verify_dh_params ( struct tls_connection *tls, digest_final ( digest, ctx, hash ); /* Verify signature */ - if ( ( rc = pubkey_verify ( pubkey, &tls->server.key, - digest, hash, signature, - signature_len ) ) != 0 ) { + if ( ( rc = pubkey_verify ( pubkey, &tls->server.key, digest, + hash, &signature ) ) != 0 ) { DBGC ( tls, "TLS %p ServerKeyExchange failed " "verification\n", tls ); DBGC_HDA ( tls, 0, tls->server.exchange, diff --git a/src/tests/pubkey_test.c b/src/tests/pubkey_test.c index ff318bfb7..2e0eeb116 100644 --- a/src/tests/pubkey_test.c +++ b/src/tests/pubkey_test.c @@ -99,10 +99,11 @@ void pubkey_sign_okx ( struct pubkey_sign_test *test, const char *file, struct pubkey_algorithm *pubkey = test->pubkey; struct digest_algorithm *digest = test->digest; size_t max_len = pubkey_max_len ( pubkey, &test->private ); - uint8_t bad[test->signature_len]; + uint8_t bad[test->signature.len]; uint8_t digestctx[digest->ctxsize ]; uint8_t digestout[digest->digestsize]; uint8_t signature[max_len]; + struct asn1_cursor cursor; int signature_len; /* Construct digest over plaintext */ @@ -114,18 +115,19 @@ void pubkey_sign_okx ( struct pubkey_sign_test *test, const char *file, /* Test signing using private key */ signature_len = pubkey_sign ( pubkey, &test->private, digest, digestout, signature ); - okx ( signature_len == ( ( int ) test->signature_len ), file, line ); - okx ( memcmp ( signature, test->signature, test->signature_len ) == 0, - file, line ); + okx ( signature_len == ( ( int ) test->signature.len ), file, line ); + okx ( memcmp ( signature, test->signature.data, + test->signature.len ) == 0, file, line ); /* Test verification using public key */ okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, - test->signature, test->signature_len ) == 0, - file, line ); + &test->signature ) == 0, file, line ); /* Test verification failure of modified signature */ - memcpy ( bad, test->signature, test->signature_len ); - bad[ test->signature_len / 2 ] ^= 0x40; + memcpy ( bad, test->signature.data, test->signature.len ); + bad[ test->signature.len / 2 ] ^= 0x40; + cursor.data = bad; + cursor.len = test->signature.len; okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, - bad, sizeof ( bad ) ) != 0, file, line ); + &cursor ) != 0, file, line ); } diff --git a/src/tests/pubkey_test.h b/src/tests/pubkey_test.h index 20bb94355..1bb6caf51 100644 --- a/src/tests/pubkey_test.h +++ b/src/tests/pubkey_test.h @@ -45,9 +45,7 @@ struct pubkey_sign_test { /** Signature algorithm */ struct digest_algorithm *digest; /** Signature */ - const void *signature; - /** Signature length */ - size_t signature_len; + const struct asn1_cursor signature; }; /** Define inline private key data */ @@ -129,8 +127,10 @@ struct pubkey_sign_test { .plaintext = name ## _plaintext, \ .plaintext_len = sizeof ( name ## _plaintext ), \ .digest = DIGEST, \ - .signature = name ## _signature, \ - .signature_len = sizeof ( name ## _signature ), \ + .signature = { \ + .data = name ## _signature, \ + .len = sizeof ( name ## _signature ), \ + }, \ } extern void pubkey_okx ( struct pubkey_test *test, -- cgit v1.2.3-55-g7522 From d4258272c679c8bd42430fc2df57402cdc03d711 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 1 Dec 2025 16:02:54 +0000 Subject: [crypto] Construct signatures using ASN.1 builders Signed-off-by: Michael Brown --- src/crypto/crypto_null.c | 3 ++- src/crypto/rsa.c | 24 +++++++++-------- src/drivers/net/iphone.c | 18 +++---------- src/include/ipxe/crypto.h | 9 ++++--- src/net/tls.c | 69 ++++++++++++++++++++++++----------------------- src/tests/pubkey_test.c | 30 ++++++++++----------- 6 files changed, 74 insertions(+), 79 deletions(-) (limited to 'src/net') diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c index ca4e1b134..ee948e00d 100644 --- a/src/crypto/crypto_null.c +++ b/src/crypto/crypto_null.c @@ -113,7 +113,8 @@ int pubkey_null_decrypt ( const struct asn1_cursor *key __unused, int pubkey_null_sign ( const struct asn1_cursor *key __unused, struct digest_algorithm *digest __unused, - const void *value __unused, void *signature __unused ) { + const void *value __unused, + struct asn1_builder *signature __unused ) { return 0; } diff --git a/src/crypto/rsa.c b/src/crypto/rsa.c index b93437518..fd6a1ef39 100644 --- a/src/crypto/rsa.c +++ b/src/crypto/rsa.c @@ -544,13 +544,12 @@ static int rsa_encode_digest ( struct rsa_context *context, * @v digest Digest algorithm * @v value Digest value * @v signature Signature - * @ret signature_len Signature length, or negative error + * @ret rc Return status code */ static int rsa_sign ( const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, - void *signature ) { + struct asn1_builder *signature ) { struct rsa_context context; - void *temp; int rc; DBGC ( &context, "RSA %p signing %s digest:\n", @@ -561,24 +560,27 @@ static int rsa_sign ( const struct asn1_cursor *key, if ( ( rc = rsa_init ( &context, key ) ) != 0 ) goto err_init; - /* Encode digest (using the big integer output buffer as - * temporary storage) - */ - temp = context.output0; - if ( ( rc = rsa_encode_digest ( &context, digest, value, temp ) ) != 0 ) + /* Create space for encoded digest and signature */ + if ( ( rc = asn1_grow ( signature, context.max_len ) ) != 0 ) + goto err_grow; + + /* Encode digest */ + if ( ( rc = rsa_encode_digest ( &context, digest, value, + signature->data ) ) != 0 ) goto err_encode; /* Encipher the encoded digest */ - rsa_cipher ( &context, temp, signature ); + rsa_cipher ( &context, signature->data, signature->data ); DBGC ( &context, "RSA %p signed %s digest:\n", &context, digest->name ); - DBGC_HDA ( &context, 0, signature, context.max_len ); + DBGC_HDA ( &context, 0, signature->data, signature->len ); /* Free context */ rsa_free ( &context ); - return context.max_len; + return 0; err_encode: + err_grow: rsa_free ( &context ); err_init: return rc; diff --git a/src/drivers/net/iphone.c b/src/drivers/net/iphone.c index bcc9949fe..11f763553 100644 --- a/src/drivers/net/iphone.c +++ b/src/drivers/net/iphone.c @@ -362,7 +362,6 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, struct asn1_builder raw = { NULL, 0 }; uint8_t digest_ctx[SHA256_CTX_SIZE]; uint8_t digest_out[SHA256_DIGEST_SIZE]; - int len; int rc; /* Construct subjectPublicKeyInfo */ @@ -399,20 +398,12 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, digest_final ( digest, digest_ctx, digest_out ); /* Construct signature using "private" key */ - if ( ( rc = asn1_grow ( &raw, - pubkey_max_len ( pubkey, private ) ) ) != 0 ) { - DBGC ( icert, "ICERT %p could not build signature: %s\n", - icert, strerror ( rc ) ); - goto err_grow; - } - if ( ( len = pubkey_sign ( pubkey, private, digest, digest_out, - raw.data ) ) < 0 ) { - rc = len; + if ( ( rc = pubkey_sign ( pubkey, private, digest, digest_out, + &raw ) ) != 0 ) { DBGC ( icert, "ICERT %p could not sign: %s\n", icert, strerror ( rc ) ); goto err_pubkey_sign; } - assert ( ( ( size_t ) len ) == raw.len ); /* Construct raw certificate data */ if ( ( rc = ( asn1_prepend_raw ( &raw, icert_nul, @@ -438,12 +429,11 @@ static int icert_cert ( struct icert *icert, struct asn1_cursor *subject, err_x509: err_raw: err_pubkey_sign: + err_tbs: + err_spki: free ( raw.data ); - err_grow: free ( tbs.data ); - err_tbs: free ( spki.data ); - err_spki: return rc; } diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index 5b87d1a47..c457a74b1 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -153,11 +153,11 @@ struct pubkey_algorithm { * @v digest Digest algorithm * @v value Digest value * @v signature Signature - * @ret signature_len Signature length, or negative error + * @ret rc Return status code */ int ( * sign ) ( const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, - void *signature ); + struct asn1_builder *builder ); /** Verify signed digest value * * @v key Key @@ -287,7 +287,7 @@ pubkey_decrypt ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, static inline __attribute__ (( always_inline )) int pubkey_sign ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, - void *signature ) { + struct asn1_builder *signature ) { return pubkey->sign ( key, digest, value, signature ); } @@ -332,7 +332,8 @@ extern int pubkey_null_decrypt ( const struct asn1_cursor *key, void *plaintext ); extern int pubkey_null_sign ( const struct asn1_cursor *key, struct digest_algorithm *digest, - const void *value, void *signature ); + const void *value, + struct asn1_builder *signature ); extern int pubkey_null_verify ( const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, diff --git a/src/net/tls.c b/src/net/tls.c index 1bcb5c027..c01ce9515 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1863,6 +1863,7 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { struct asn1_cursor *key = privkey_cursor ( tls->client.key ); uint8_t digest_out[ digest->digestsize ]; struct tls_signature_hash_algorithm *sig_hash = NULL; + struct asn1_builder builder = { NULL, 0 }; int rc; /* Generate digest to be signed */ @@ -1880,53 +1881,53 @@ static int tls_send_certificate_verify ( struct tls_connection *tls ) { } } - /* Generate and transmit record */ + /* Sign digest */ + if ( ( rc = pubkey_sign ( pubkey, key, digest, digest_out, + &builder ) ) != 0 ) { + DBGC ( tls, "TLS %p could not sign %s digest using %s client " + "private key: %s\n", tls, digest->name, pubkey->name, + strerror ( rc ) ); + goto err_pubkey_sign; + } + + /* Construct Certificate Verify record */ { - size_t max_len = pubkey_max_len ( pubkey, key ); int use_sig_hash = ( ( sig_hash == NULL ) ? 0 : 1 ); struct { uint32_t type_length; struct tls_signature_hash_id sig_hash[use_sig_hash]; uint16_t signature_len; - uint8_t signature[max_len]; - } __attribute__ (( packed )) certificate_verify; - size_t unused; - int len; - - /* Sign digest */ - len = pubkey_sign ( pubkey, key, digest, digest_out, - certificate_verify.signature ); - if ( len < 0 ) { - rc = len; - DBGC ( tls, "TLS %p could not sign %s digest using %s " - "client private key: %s\n", tls, digest->name, - pubkey->name, strerror ( rc ) ); - goto err_pubkey_sign; - } - unused = ( max_len - len ); - - /* Construct Certificate Verify record */ - certificate_verify.type_length = - ( cpu_to_le32 ( TLS_CERTIFICATE_VERIFY ) | - htonl ( sizeof ( certificate_verify ) - - sizeof ( certificate_verify.type_length ) - - unused ) ); + } __attribute__ (( packed )) header; + + header.type_length = ( cpu_to_le32 ( TLS_CERTIFICATE_VERIFY ) | + htonl ( builder.len + + sizeof ( header ) - + sizeof ( header.type_length ))); if ( use_sig_hash ) { - memcpy ( &certificate_verify.sig_hash[0], - &sig_hash->code, - sizeof ( certificate_verify.sig_hash[0] ) ); + memcpy ( &header.sig_hash[0], &sig_hash->code, + sizeof ( header.sig_hash[0] ) ); } - certificate_verify.signature_len = - htons ( sizeof ( certificate_verify.signature ) - - unused ); + header.signature_len = htons ( builder.len ); - /* Transmit record */ - rc = tls_send_handshake ( tls, &certificate_verify, - ( sizeof ( certificate_verify ) - unused ) ); + if ( ( rc = asn1_prepend_raw ( &builder, &header, + sizeof ( header ) ) ) != 0 ) { + DBGC ( tls, "TLS %p could not construct Certificate " + "Verify: %s\n", tls, strerror ( rc ) ); + goto err_prepend; + } + } + + /* Transmit record */ + if ( ( rc = tls_send_handshake ( tls, builder.data, + builder.len ) ) != 0 ) { + goto err_send; } + err_send: + err_prepend: err_pubkey_sign: err_sig_hash: + free ( builder.data ); return rc; } diff --git a/src/tests/pubkey_test.c b/src/tests/pubkey_test.c index 2e0eeb116..e3fbc3b3f 100644 --- a/src/tests/pubkey_test.c +++ b/src/tests/pubkey_test.c @@ -98,13 +98,10 @@ void pubkey_sign_okx ( struct pubkey_sign_test *test, const char *file, unsigned int line ) { struct pubkey_algorithm *pubkey = test->pubkey; struct digest_algorithm *digest = test->digest; - size_t max_len = pubkey_max_len ( pubkey, &test->private ); - uint8_t bad[test->signature.len]; uint8_t digestctx[digest->ctxsize ]; uint8_t digestout[digest->digestsize]; - uint8_t signature[max_len]; - struct asn1_cursor cursor; - int signature_len; + struct asn1_builder signature = { NULL, 0 }; + uint8_t *bad; /* Construct digest over plaintext */ digest_init ( digest, digestctx ); @@ -113,21 +110,24 @@ void pubkey_sign_okx ( struct pubkey_sign_test *test, const char *file, digest_final ( digest, digestctx, digestout ); /* Test signing using private key */ - signature_len = pubkey_sign ( pubkey, &test->private, digest, - digestout, signature ); - okx ( signature_len == ( ( int ) test->signature.len ), file, line ); - okx ( memcmp ( signature, test->signature.data, - test->signature.len ) == 0, file, line ); + okx ( pubkey_sign ( pubkey, &test->private, digest, digestout, + &signature ) == 0, file, line ); + okx ( signature.len != 0, file, line ); + okx ( asn1_compare ( asn1_built ( &signature ), + &test->signature ) == 0, file, line ); /* Test verification using public key */ okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, &test->signature ) == 0, file, line ); /* Test verification failure of modified signature */ - memcpy ( bad, test->signature.data, test->signature.len ); - bad[ test->signature.len / 2 ] ^= 0x40; - cursor.data = bad; - cursor.len = test->signature.len; + bad = ( signature.data + ( test->signature.len / 2 ) ); + okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, + asn1_built ( &signature ) ) == 0, file, line ); + *bad ^= 0x40; okx ( pubkey_verify ( pubkey, &test->public, digest, digestout, - &cursor ) != 0, file, line ); + asn1_built ( &signature ) ) != 0, file, line ); + + /* Free signature */ + free ( signature.data ); } -- cgit v1.2.3-55-g7522 From 1ccc320ee99651622ced9b33764d5e7890ca3f57 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 2 Dec 2025 13:12:25 +0000 Subject: [crypto] Construct asymmetric ciphered data using ASN.1 builders Signed-off-by: Michael Brown --- src/crypto/cms.c | 24 ++++++++--------- src/crypto/crypto_null.c | 10 +++---- src/crypto/rsa.c | 65 +++++++++++++++++++++++++------------------- src/include/ipxe/crypto.h | 34 +++++++++++++----------- src/net/tls.c | 68 +++++++++++++++++++++++++++-------------------- src/tests/pubkey_test.c | 64 ++++++++++++++++++++++++-------------------- src/tests/pubkey_test.h | 20 +++++++------- 7 files changed, 156 insertions(+), 129 deletions(-) (limited to 'src/net') diff --git a/src/crypto/cms.c b/src/crypto/cms.c index a3c03a9b4..7775e581b 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -917,29 +917,26 @@ static int cms_cipher_key ( struct cms_message *cms, struct pubkey_algorithm *pubkey = part->pubkey; const struct asn1_cursor *key = privkey_cursor ( private_key ); const struct asn1_cursor *value = &part->value; - size_t max_len = pubkey_max_len ( pubkey, key ); - uint8_t cipher_key[max_len]; - int len; + struct asn1_builder cipher_key = { NULL, 0 }; int rc; /* Decrypt cipher key */ - len = pubkey_decrypt ( pubkey, key, value->data, value->len, - cipher_key ); - if ( len < 0 ) { - rc = len; + if ( ( rc = pubkey_decrypt ( pubkey, key, value, + &cipher_key ) ) != 0 ) { DBGC ( cms, "CMS %p/%p could not decrypt cipher key: %s\n", cms, part, strerror ( rc ) ); DBGC_HDA ( cms, 0, value->data, value->len ); - return rc; + goto err_decrypt; } DBGC ( cms, "CMS %p/%p cipher key:\n", cms, part ); - DBGC_HDA ( cms, 0, cipher_key, len ); + DBGC_HDA ( cms, 0, cipher_key.data, cipher_key.len ); /* Set cipher key */ - if ( ( rc = cipher_setkey ( cipher, ctx, cipher_key, len ) ) != 0 ) { + if ( ( rc = cipher_setkey ( cipher, ctx, cipher_key.data, + cipher_key.len ) ) != 0 ) { DBGC ( cms, "CMS %p could not set cipher key: %s\n", cms, strerror ( rc ) ); - return rc; + goto err_setkey; } /* Set cipher initialization vector */ @@ -949,7 +946,10 @@ static int cms_cipher_key ( struct cms_message *cms, DBGC_HDA ( cms, 0, cms->iv.data, cms->iv.len ); } - return 0; + err_setkey: + err_decrypt: + free ( cipher_key.data ); + return rc; } /** diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c index ee948e00d..e8f8cbde8 100644 --- a/src/crypto/crypto_null.c +++ b/src/crypto/crypto_null.c @@ -98,16 +98,14 @@ size_t pubkey_null_max_len ( const struct asn1_cursor *key __unused ) { } int pubkey_null_encrypt ( const struct asn1_cursor *key __unused, - const void *plaintext __unused, - size_t plaintext_len __unused, - void *ciphertext __unused ) { + const struct asn1_cursor *plaintext __unused, + struct asn1_builder *ciphertext __unused ) { return 0; } int pubkey_null_decrypt ( const struct asn1_cursor *key __unused, - const void *ciphertext __unused, - size_t ciphertext_len __unused, - void *plaintext __unused ) { + const struct asn1_cursor *ciphertext __unused, + struct asn1_builder *plaintext __unused ) { return 0; } diff --git a/src/crypto/rsa.c b/src/crypto/rsa.c index fd6a1ef39..18b2b1c14 100644 --- a/src/crypto/rsa.c +++ b/src/crypto/rsa.c @@ -338,12 +338,12 @@ static void rsa_cipher ( struct rsa_context *context, * * @v key Key * @v plaintext Plaintext - * @v plaintext_len Length of plaintext * @v ciphertext Ciphertext * @ret ciphertext_len Length of ciphertext, or negative error */ -static int rsa_encrypt ( const struct asn1_cursor *key, const void *plaintext, - size_t plaintext_len, void *ciphertext ) { +static int rsa_encrypt ( const struct asn1_cursor *key, + const struct asn1_cursor *plaintext, + struct asn1_builder *ciphertext ) { struct rsa_context context; void *temp; uint8_t *encoded; @@ -352,7 +352,7 @@ static int rsa_encrypt ( const struct asn1_cursor *key, const void *plaintext, int rc; DBGC ( &context, "RSA %p encrypting:\n", &context ); - DBGC_HDA ( &context, 0, plaintext, plaintext_len ); + DBGC_HDA ( &context, 0, plaintext->data, plaintext->len ); /* Initialise context */ if ( ( rc = rsa_init ( &context, key ) ) != 0 ) @@ -360,12 +360,12 @@ static int rsa_encrypt ( const struct asn1_cursor *key, const void *plaintext, /* Calculate lengths */ max_len = ( context.max_len - 11 ); - random_nz_len = ( max_len - plaintext_len + 8 ); + random_nz_len = ( max_len - plaintext->len + 8 ); /* Sanity check */ - if ( plaintext_len > max_len ) { + if ( plaintext->len > max_len ) { DBGC ( &context, "RSA %p plaintext too long (%zd bytes, max " - "%zd)\n", &context, plaintext_len, max_len ); + "%zd)\n", &context, plaintext->len, max_len ); rc = -ERANGE; goto err_sanity; } @@ -383,19 +383,24 @@ static int rsa_encrypt ( const struct asn1_cursor *key, const void *plaintext, goto err_random; } encoded[ 2 + random_nz_len ] = 0x00; - memcpy ( &encoded[ context.max_len - plaintext_len ], - plaintext, plaintext_len ); + memcpy ( &encoded[ context.max_len - plaintext->len ], + plaintext->data, plaintext->len ); + + /* Create space for ciphertext */ + if ( ( rc = asn1_grow ( ciphertext, context.max_len ) ) != 0 ) + goto err_grow; /* Encipher the encoded message */ - rsa_cipher ( &context, encoded, ciphertext ); + rsa_cipher ( &context, encoded, ciphertext->data ); DBGC ( &context, "RSA %p encrypted:\n", &context ); - DBGC_HDA ( &context, 0, ciphertext, context.max_len ); + DBGC_HDA ( &context, 0, ciphertext->data, context.max_len ); /* Free context */ rsa_free ( &context ); - return context.max_len; + return 0; + err_grow: err_random: err_sanity: rsa_free ( &context ); @@ -408,33 +413,33 @@ static int rsa_encrypt ( const struct asn1_cursor *key, const void *plaintext, * * @v key Key * @v ciphertext Ciphertext - * @v ciphertext_len Ciphertext length * @v plaintext Plaintext - * @ret plaintext_len Plaintext length, or negative error + * @ret rc Return status code */ -static int rsa_decrypt ( const struct asn1_cursor *key, const void *ciphertext, - size_t ciphertext_len, void *plaintext ) { +static int rsa_decrypt ( const struct asn1_cursor *key, + const struct asn1_cursor *ciphertext, + struct asn1_builder *plaintext ) { struct rsa_context context; void *temp; uint8_t *encoded; uint8_t *end; uint8_t *zero; uint8_t *start; - size_t plaintext_len; + size_t len; int rc; DBGC ( &context, "RSA %p decrypting:\n", &context ); - DBGC_HDA ( &context, 0, ciphertext, ciphertext_len ); + DBGC_HDA ( &context, 0, ciphertext->data, ciphertext->len ); /* Initialise context */ if ( ( rc = rsa_init ( &context, key ) ) != 0 ) goto err_init; /* Sanity check */ - if ( ciphertext_len != context.max_len ) { + if ( ciphertext->len != context.max_len ) { DBGC ( &context, "RSA %p ciphertext incorrect length (%zd " "bytes, should be %zd)\n", - &context, ciphertext_len, context.max_len ); + &context, ciphertext->len, context.max_len ); rc = -ERANGE; goto err_sanity; } @@ -444,7 +449,7 @@ static int rsa_decrypt ( const struct asn1_cursor *key, const void *ciphertext, */ temp = context.input0; encoded = temp; - rsa_cipher ( &context, ciphertext, encoded ); + rsa_cipher ( &context, ciphertext->data, encoded ); /* Parse the message */ end = ( encoded + context.max_len ); @@ -454,25 +459,31 @@ static int rsa_decrypt ( const struct asn1_cursor *key, const void *ciphertext, } zero = memchr ( &encoded[2], 0, ( end - &encoded[2] ) ); if ( ! zero ) { + DBGC ( &context, "RSA %p invalid decrypted message:\n", + &context ); + DBGC_HDA ( &context, 0, encoded, context.max_len ); rc = -EINVAL; goto err_invalid; } start = ( zero + 1 ); - plaintext_len = ( end - start ); + len = ( end - start ); + + /* Create space for plaintext */ + if ( ( rc = asn1_grow ( plaintext, len ) ) != 0 ) + goto err_grow; /* Copy out message */ - memcpy ( plaintext, start, plaintext_len ); + memcpy ( plaintext->data, start, len ); DBGC ( &context, "RSA %p decrypted:\n", &context ); - DBGC_HDA ( &context, 0, plaintext, plaintext_len ); + DBGC_HDA ( &context, 0, plaintext->data, len ); /* Free context */ rsa_free ( &context ); - return plaintext_len; + return 0; + err_grow: err_invalid: - DBGC ( &context, "RSA %p invalid decrypted message:\n", &context ); - DBGC_HDA ( &context, 0, encoded, context.max_len ); err_sanity: rsa_free ( &context ); err_init: diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index c457a74b1..68bd23048 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -131,22 +131,22 @@ struct pubkey_algorithm { * * @v key Key * @v plaintext Plaintext - * @v plaintext_len Length of plaintext * @v ciphertext Ciphertext - * @ret ciphertext_len Length of ciphertext, or negative error + * @ret rc Return status code */ - int ( * encrypt ) ( const struct asn1_cursor *key, const void *data, - size_t len, void *out ); + int ( * encrypt ) ( const struct asn1_cursor *key, + const struct asn1_cursor *plaintext, + struct asn1_builder *ciphertext ); /** Decrypt * * @v key Key * @v ciphertext Ciphertext - * @v ciphertext_len Ciphertext length * @v plaintext Plaintext - * @ret plaintext_len Plaintext length, or negative error + * @ret rc Return status code */ - int ( * decrypt ) ( const struct asn1_cursor *key, const void *data, - size_t len, void *out ); + int ( * decrypt ) ( const struct asn1_cursor *key, + const struct asn1_cursor *ciphertext, + struct asn1_builder *plaintext ); /** Sign digest value * * @v key Key @@ -274,14 +274,16 @@ pubkey_max_len ( struct pubkey_algorithm *pubkey, static inline __attribute__ (( always_inline )) int pubkey_encrypt ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, - const void *data, size_t len, void *out ) { - return pubkey->encrypt ( key, data, len, out ); + const struct asn1_cursor *plaintext, + struct asn1_builder *ciphertext ) { + return pubkey->encrypt ( key, plaintext, ciphertext ); } static inline __attribute__ (( always_inline )) int pubkey_decrypt ( struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, - const void *data, size_t len, void *out ) { - return pubkey->decrypt ( key, data, len, out ); + const struct asn1_cursor *ciphertext, + struct asn1_builder *plaintext ) { + return pubkey->decrypt ( key, ciphertext, plaintext ); } static inline __attribute__ (( always_inline )) int @@ -325,11 +327,11 @@ extern void cipher_null_auth ( void *ctx, void *auth ); extern size_t pubkey_null_max_len ( const struct asn1_cursor *key ); extern int pubkey_null_encrypt ( const struct asn1_cursor *key, - const void *plaintext, size_t plaintext_len, - void *ciphertext ); + const struct asn1_cursor *plaintext, + struct asn1_builder *ciphertext ); extern int pubkey_null_decrypt ( const struct asn1_cursor *key, - const void *ciphertext, size_t ciphertext_len, - void *plaintext ); + const struct asn1_cursor *ciphertext, + struct asn1_builder *plaintext ); extern int pubkey_null_sign ( const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, diff --git a/src/net/tls.c b/src/net/tls.c index c01ce9515..6140ca58a 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -1416,59 +1416,69 @@ static int tls_send_certificate ( struct tls_connection *tls ) { static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) { struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending; struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey; - size_t max_len = pubkey_max_len ( pubkey, &tls->server.key ); struct { uint16_t version; uint8_t random[46]; } __attribute__ (( packed )) pre_master_secret; - struct { - uint32_t type_length; - uint16_t encrypted_pre_master_secret_len; - uint8_t encrypted_pre_master_secret[max_len]; - } __attribute__ (( packed )) key_xchg; - size_t unused; - int len; + struct asn1_cursor cursor = { + .data = &pre_master_secret, + .len = sizeof ( pre_master_secret ), + }; + struct asn1_builder builder = { NULL, 0 }; int rc; /* Generate pre-master secret */ pre_master_secret.version = htons ( TLS_VERSION_MAX ); if ( ( rc = tls_generate_random ( tls, &pre_master_secret.random, ( sizeof ( pre_master_secret.random ) ) ) ) != 0 ) { - return rc; + goto err_random; } /* Encrypt pre-master secret using server's public key */ - memset ( &key_xchg, 0, sizeof ( key_xchg ) ); - len = pubkey_encrypt ( pubkey, &tls->server.key, &pre_master_secret, - sizeof ( pre_master_secret ), - key_xchg.encrypted_pre_master_secret ); - if ( len < 0 ) { - rc = len; + if ( ( rc = pubkey_encrypt ( pubkey, &tls->server.key, &cursor, + &builder ) ) != 0 ) { DBGC ( tls, "TLS %p could not encrypt pre-master secret: %s\n", tls, strerror ( rc ) ); - return rc; + goto err_encrypt; + } + + /* Construct Client Key Exchange record */ + { + struct { + uint32_t type_length; + uint16_t encrypted_pre_master_secret_len; + } __attribute__ (( packed )) header; + + header.type_length = + ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) | + htonl ( builder.len + sizeof ( header ) - + sizeof ( header.type_length ) ) ); + header.encrypted_pre_master_secret_len = htons ( builder.len ); + + if ( ( rc = asn1_prepend_raw ( &builder, &header, + sizeof ( header ) ) ) != 0 ) { + DBGC ( tls, "TLS %p could not construct Client Key " + "Exchange: %s\n", tls, strerror ( rc ) ); + goto err_prepend; + } } - unused = ( max_len - len ); - key_xchg.type_length = - ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) | - htonl ( sizeof ( key_xchg ) - - sizeof ( key_xchg.type_length ) - unused ) ); - key_xchg.encrypted_pre_master_secret_len = - htons ( sizeof ( key_xchg.encrypted_pre_master_secret ) - - unused ); /* Transmit Client Key Exchange record */ - if ( ( rc = tls_send_handshake ( tls, &key_xchg, - ( sizeof ( key_xchg ) - - unused ) ) ) != 0 ) { - return rc; + if ( ( rc = tls_send_handshake ( tls, builder.data, + builder.len ) ) != 0 ) { + goto err_send; } /* Generate master secret */ tls_generate_master_secret ( tls, &pre_master_secret, sizeof ( pre_master_secret ) ); - return 0; + err_random: + err_encrypt: + err_prepend: + err_send: + free ( builder.data ); + return rc; } /** Public key exchange algorithm */ diff --git a/src/tests/pubkey_test.c b/src/tests/pubkey_test.c index e3fbc3b3f..d110b2946 100644 --- a/src/tests/pubkey_test.c +++ b/src/tests/pubkey_test.c @@ -50,41 +50,47 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); void pubkey_okx ( struct pubkey_test *test, const char *file, unsigned int line ) { struct pubkey_algorithm *pubkey = test->pubkey; - size_t max_len = pubkey_max_len ( pubkey, &test->private ); - uint8_t encrypted[max_len]; - uint8_t decrypted[max_len]; - int encrypted_len; - int decrypted_len; + struct asn1_builder plaintext; + struct asn1_builder ciphertext; /* Test decrypting with private key to obtain known plaintext */ - decrypted_len = pubkey_decrypt ( pubkey, &test->private, - test->ciphertext, test->ciphertext_len, - decrypted ); - okx ( decrypted_len == ( ( int ) test->plaintext_len ), file, line ); - okx ( memcmp ( decrypted, test->plaintext, test->plaintext_len ) == 0, - file, line ); + plaintext.data = NULL; + plaintext.len = 0; + okx ( pubkey_decrypt ( pubkey, &test->private, &test->ciphertext, + &plaintext ) == 0, file, line ); + okx ( asn1_compare ( asn1_built ( &plaintext ), + &test->plaintext ) == 0, file, line ); + free ( plaintext.data ); /* Test encrypting with private key and decrypting with public key */ - encrypted_len = pubkey_encrypt ( pubkey, &test->private, - test->plaintext, test->plaintext_len, - encrypted ); - okx ( encrypted_len >= 0, file, line ); - decrypted_len = pubkey_decrypt ( pubkey, &test->public, encrypted, - encrypted_len, decrypted ); - okx ( decrypted_len == ( ( int ) test->plaintext_len ), file, line ); - okx ( memcmp ( decrypted, test->plaintext, test->plaintext_len ) == 0, - file, line ); + ciphertext.data = NULL; + ciphertext.len = 0; + plaintext.data = NULL; + plaintext.len = 0; + okx ( pubkey_encrypt ( pubkey, &test->private, &test->plaintext, + &ciphertext ) == 0, file, line ); + okx ( pubkey_decrypt ( pubkey, &test->public, + asn1_built ( &ciphertext ), + &plaintext ) == 0, file, line ); + okx ( asn1_compare ( asn1_built ( &plaintext ), + &test->plaintext ) == 0, file, line ); + free ( ciphertext.data ); + free ( plaintext.data ); /* Test encrypting with public key and decrypting with private key */ - encrypted_len = pubkey_encrypt ( pubkey, &test->public, - test->plaintext, test->plaintext_len, - encrypted ); - okx ( encrypted_len >= 0, file, line ); - decrypted_len = pubkey_decrypt ( pubkey, &test->private, encrypted, - encrypted_len, decrypted ); - okx ( decrypted_len == ( ( int ) test->plaintext_len ), file, line ); - okx ( memcmp ( decrypted, test->plaintext, test->plaintext_len ) == 0, - file, line ); + ciphertext.data = NULL; + ciphertext.len = 0; + plaintext.data = NULL; + plaintext.len = 0; + okx ( pubkey_encrypt ( pubkey, &test->public, &test->plaintext, + &ciphertext ) == 0, file, line ); + okx ( pubkey_decrypt ( pubkey, &test->private, + asn1_built ( &ciphertext ), + &plaintext ) == 0, file, line ); + okx ( asn1_compare ( asn1_built ( &plaintext ), + &test->plaintext ) == 0, file, line ); + free ( ciphertext.data ); + free ( plaintext.data ); } /** diff --git a/src/tests/pubkey_test.h b/src/tests/pubkey_test.h index 1bb6caf51..33b301a6e 100644 --- a/src/tests/pubkey_test.h +++ b/src/tests/pubkey_test.h @@ -16,18 +16,14 @@ struct pubkey_test { /** Public key */ const struct asn1_cursor public; /** Plaintext */ - const void *plaintext; - /** Length of plaintext */ - size_t plaintext_len; + const struct asn1_cursor plaintext; /** Ciphertext * * Note that the encryption process may include some random * padding, so a given plaintext will encrypt to multiple * different ciphertexts. */ - const void *ciphertext; - /** Length of ciphertext */ - size_t ciphertext_len; + const struct asn1_cursor ciphertext; }; /** A public-key signature test */ @@ -90,10 +86,14 @@ struct pubkey_sign_test { .data = name ## _public, \ .len = sizeof ( name ## _public ), \ }, \ - .plaintext = name ## _plaintext, \ - .plaintext_len = sizeof ( name ## _plaintext ), \ - .ciphertext = name ## _ciphertext, \ - .ciphertext_len = sizeof ( name ## _ciphertext ), \ + .plaintext = { \ + .data = name ## _plaintext, \ + .len = sizeof ( name ## _plaintext ), \ + }, \ + .ciphertext = { \ + .data = name ## _ciphertext, \ + .len = sizeof ( name ## _ciphertext ), \ + }, \ } /** -- cgit v1.2.3-55-g7522 From 1a789c1daa48212dfa76704c102e182d8e5b7342 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 4 Dec 2025 13:47:30 +0000 Subject: [http] Rename connection retry timer Signed-off-by: Michael Brown --- src/include/ipxe/http.h | 2 +- src/net/tcp/httpcore.c | 15 ++++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/http.h b/src/include/ipxe/http.h index 5a9baddcb..f5416042a 100644 --- a/src/include/ipxe/http.h +++ b/src/include/ipxe/http.h @@ -426,7 +426,7 @@ struct http_transaction { /** Transmit process */ struct process process; /** Reconnection timer */ - struct retry_timer timer; + struct retry_timer retry; /** Request URI */ struct uri *uri; diff --git a/src/net/tcp/httpcore.c b/src/net/tcp/httpcore.c index 57c31ac26..42512cda4 100644 --- a/src/net/tcp/httpcore.c +++ b/src/net/tcp/httpcore.c @@ -282,7 +282,7 @@ static void http_close ( struct http_transaction *http, int rc ) { process_del ( &http->process ); /* Stop timer */ - stop_timer ( &http->timer ); + stop_timer ( &http->retry ); /* Close all interfaces */ intfs_shutdown ( rc, &http->conn, &http->transfer, &http->content, @@ -332,14 +332,15 @@ static void http_reopen ( struct http_transaction *http ) { } /** - * Handle retry timer expiry + * Handle connection retry timer expiry * - * @v timer Retry timer + * @v retry Retry timer * @v over Failure indicator */ -static void http_expired ( struct retry_timer *timer, int over __unused ) { +static void http_retry_expired ( struct retry_timer *retry, + int over __unused ) { struct http_transaction *http = - container_of ( timer, struct http_transaction, timer ); + container_of ( retry, struct http_transaction, retry ); /* Reopen connection */ http_reopen ( http ); @@ -649,7 +650,7 @@ int http_open ( struct interface *xfer, struct http_method *method, intf_init ( &http->conn, &http_conn_desc, &http->refcnt ); intf_plug_plug ( &http->transfer, &http->content ); process_init ( &http->process, &http_process_desc, &http->refcnt ); - timer_init ( &http->timer, http_expired, &http->refcnt ); + timer_init ( &http->retry, http_retry_expired, &http->refcnt ); http->uri = uri_get ( uri ); http->request.method = method; http->request.uri = request_uri_string; @@ -809,7 +810,7 @@ static int http_transfer_complete ( struct http_transaction *http ) { /* Start timer to initiate retry */ DBGC2 ( http, "HTTP %p retrying after %d seconds\n", http, http->response.retry_after ); - start_timer_fixed ( &http->timer, + start_timer_fixed ( &http->retry, ( http->response.retry_after * TICKS_PER_SEC ) ); return 0; } -- cgit v1.2.3-55-g7522 From 88c3e68dfb2f1a3d5c2ada29b4eeef600c94c5ac Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 4 Dec 2025 13:52:08 +0000 Subject: [http] Abort connections after a long period of inactivity Once an HTTP download has started (i.e. once all request headers have been sent), we generally have no more data to transmit. If an HTTP connection dies silently (e.g. due to a network failure, a NIC driver bug, or a server crash) then there is no mechanism that will currently detect this situation by default. We do send TCP keep-alives (to maintain state in intermediate routers and firewalls), but we do not attempt to elicit a response from the server. RFC 9293 explicitly states that the absence of a response to a TCP keep-alive probe must not be interpreted as indicating a dead connection, since TCP cannot guarantee reliable delivery of packets that do not advance the sequence number. Scripts may use the "--timeout" option to impose an overall time limit on downloads, but this mechanism is off by default and requires additional thought and configuration by the user (which goes against iPXE's general philosophy of being as automatic as possible). Add an idle connection watchdog timer which will cause the HTTP download to abort after 120 seconds of inactivity. Activity is defined as an I/O buffer being delivered to the HTTP transaction's upstream data transfer interface. Downloads over HTTPS may experience a substantial delay until the first recorded activity, since all TLS negotiation (including cross-chained certificate downloads and OCSP checks) must complete before any application data can be sent. We choose to not reset the watchdog timer during TLS negotiation, on the basis that 120 seconds is already an unreasonably long time for a TLS negotiation to take to complete. If necessary, resetting the watchdog timer could be accomplished by having the TLS layer deliver zero-length I/O buffers (via xfer_seek()) to indicate forward progress being made. When using PeerDist content encoding, the downloaded content information is not passed through to the content-decoded interface and so will not be classed as activity. Any activity in the individual PeerDist block downloads (either from peers or as range requests from the origin server) will be classed as activity in the overall download, since individual block downloads do not buffer data but instead pass it through directly via the PeerDist download multiplexer. Signed-off-by: Michael Brown --- src/include/ipxe/http.h | 2 ++ src/net/tcp/httpcore.c | 45 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 46 insertions(+), 1 deletion(-) (limited to 'src/net') diff --git a/src/include/ipxe/http.h b/src/include/ipxe/http.h index f5416042a..fc3e7b7a1 100644 --- a/src/include/ipxe/http.h +++ b/src/include/ipxe/http.h @@ -427,6 +427,8 @@ struct http_transaction { struct process process; /** Reconnection timer */ struct retry_timer retry; + /** Idle connection watchdog timer */ + struct retry_timer watchdog; /** Request URI */ struct uri *uri; diff --git a/src/net/tcp/httpcore.c b/src/net/tcp/httpcore.c index 42512cda4..8fee0421c 100644 --- a/src/net/tcp/httpcore.c +++ b/src/net/tcp/httpcore.c @@ -106,6 +106,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** Retry delay used when we cannot understand the Retry-After header */ #define HTTP_RETRY_SECONDS 5 +/** Idle connection watchdog timeout */ +#define HTTP_WATCHDOG_SECONDS 120 + /** Receive profiler */ static struct profiler http_rx_profiler __profiler = { .name = "http.rx" }; @@ -281,8 +284,9 @@ static void http_close ( struct http_transaction *http, int rc ) { /* Stop process */ process_del ( &http->process ); - /* Stop timer */ + /* Stop timers */ stop_timer ( &http->retry ); + stop_timer ( &http->watchdog ); /* Close all interfaces */ intfs_shutdown ( rc, &http->conn, &http->transfer, &http->content, @@ -301,6 +305,18 @@ static void http_close_error ( struct http_transaction *http, int rc ) { http_close ( http, ( rc ? rc : -EPIPE ) ); } +/** + * Hold off HTTP idle connection watchdog timer + * + * @v http HTTP transaction + */ +static inline void http_watchdog ( struct http_transaction *http ) { + + /* (Re)start watchdog timer */ + start_timer_fixed ( &http->watchdog, + ( HTTP_WATCHDOG_SECONDS * TICKS_PER_SEC ) ); +} + /** * Reopen stale HTTP connection * @@ -322,6 +338,9 @@ static void http_reopen ( struct http_transaction *http ) { /* Reset state */ http->state = &http_request; + /* Restart idle connection watchdog timer */ + http_watchdog ( http ); + /* Reschedule transmission process */ process_add ( &http->process ); @@ -346,6 +365,22 @@ static void http_retry_expired ( struct retry_timer *retry, http_reopen ( http ); } +/** + * Handle idle connection watchdog timer expiry + * + * @v watchdog Idle connection watchdog timer + * @v over Failure indicator + */ +static void http_watchdog_expired ( struct retry_timer *watchdog, + int over __unused ) { + struct http_transaction *http = + container_of ( watchdog, struct http_transaction, watchdog ); + + /* Abort connection */ + DBGC ( http, "HTTP %p aborting idle connection\n", http ); + http_close ( http, -ETIMEDOUT ); +} + /** * HTTP transmit process * @@ -461,6 +496,9 @@ static int http_content_deliver ( struct http_transaction *http, return 0; } + /* Hold off idle connection watchdog timer */ + http_watchdog ( http ); + /* Deliver to data transfer interface */ profile_start ( &http_xfer_profiler ); if ( ( rc = xfer_deliver ( &http->xfer, iob_disown ( iobuf ), @@ -651,6 +689,7 @@ int http_open ( struct interface *xfer, struct http_method *method, intf_plug_plug ( &http->transfer, &http->content ); process_init ( &http->process, &http_process_desc, &http->refcnt ); timer_init ( &http->retry, http_retry_expired, &http->refcnt ); + timer_init ( &http->watchdog, http_watchdog_expired, &http->refcnt ); http->uri = uri_get ( uri ); http->request.method = method; http->request.uri = request_uri_string; @@ -676,6 +715,9 @@ int http_open ( struct interface *xfer, struct http_method *method, goto err_connect; } + /* Start watchdog timer */ + http_watchdog ( http ); + /* Attach to parent interface, mortalise self, and return */ intf_plug_plug ( &http->xfer, xfer ); ref_put ( &http->refcnt ); @@ -812,6 +854,7 @@ static int http_transfer_complete ( struct http_transaction *http ) { http, http->response.retry_after ); start_timer_fixed ( &http->retry, ( http->response.retry_after * TICKS_PER_SEC ) ); + stop_timer ( &http->watchdog ); return 0; } -- cgit v1.2.3-55-g7522 From d0e01bb3fcf434abc7b20c399cfab6d8a2d36986 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 5 Jan 2026 14:22:16 +0000 Subject: [neighbour] Always use network device's own link-layer address The API for neighbour_tx() allows for an explicit source link-layer address, but this will be ignored if the packet is deferred for transmission after completion of neighbour discovery. The network device's own link-layer address will always be used when sending neighbour discovery packets, and when sending any deferred packets after discovery completes. All callers pass in the network device's own link-layer address as the source address anyway, and so this explicit source link-layer address is never used for any meaningful purpose. Simplify the neighbour_tx() API by removing the ability to pass in an explicit source link-layer address. Signed-off-by: Michael Brown --- src/include/ipxe/arp.h | 6 ++---- src/include/ipxe/ndp.h | 6 ++---- src/include/ipxe/neighbour.h | 2 +- src/net/ipv4.c | 2 +- src/net/ipv6.c | 4 ++-- src/net/neighbour.c | 5 ++--- 6 files changed, 10 insertions(+), 15 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/arp.h b/src/include/ipxe/arp.h index 5822fa095..674423c54 100644 --- a/src/include/ipxe/arp.h +++ b/src/include/ipxe/arp.h @@ -45,16 +45,14 @@ extern struct neighbour_discovery arp_discovery; * @v net_protocol Network-layer protocol * @v net_dest Destination network-layer address * @v net_source Source network-layer address - * @v ll_source Source link-layer address * @ret rc Return status code */ static inline int arp_tx ( struct io_buffer *iobuf, struct net_device *netdev, struct net_protocol *net_protocol, - const void *net_dest, const void *net_source, - const void *ll_source ) { + const void *net_dest, const void *net_source ) { return neighbour_tx ( iobuf, netdev, net_protocol, net_dest, - &arp_discovery, net_source, ll_source ); + &arp_discovery, net_source ); } extern int arp_tx_request ( struct net_device *netdev, diff --git a/src/include/ipxe/ndp.h b/src/include/ipxe/ndp.h index 1815236f5..d06672ec1 100644 --- a/src/include/ipxe/ndp.h +++ b/src/include/ipxe/ndp.h @@ -189,15 +189,13 @@ extern struct neighbour_discovery ndp_discovery; * @v netdev Network device * @v net_dest Destination network-layer address * @v net_source Source network-layer address - * @v ll_source Source link-layer address * @ret rc Return status code */ static inline int ndp_tx ( struct io_buffer *iobuf, struct net_device *netdev, - const void *net_dest, const void *net_source, - const void *ll_source ) { + const void *net_dest, const void *net_source ) { return neighbour_tx ( iobuf, netdev, &ipv6_protocol, net_dest, - &ndp_discovery, net_source, ll_source ); + &ndp_discovery, net_source ); } /** NDP settings block name */ diff --git a/src/include/ipxe/neighbour.h b/src/include/ipxe/neighbour.h index 1c1d1b6ca..1ca0ee333 100644 --- a/src/include/ipxe/neighbour.h +++ b/src/include/ipxe/neighbour.h @@ -77,7 +77,7 @@ extern int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, struct net_protocol *net_protocol, const void *net_dest, struct neighbour_discovery *discovery, - const void *net_source, const void *ll_source ); + const void *net_source ); extern int neighbour_update ( struct net_device *netdev, struct net_protocol *net_protocol, const void *net_dest, const void *ll_dest ); diff --git a/src/net/ipv4.c b/src/net/ipv4.c index 03517840b..21abfccec 100644 --- a/src/net/ipv4.c +++ b/src/net/ipv4.c @@ -563,7 +563,7 @@ static int ipv4_tx ( struct io_buffer *iobuf, } } else { if ( ( rc = arp_tx ( iobuf, netdev, &ipv4_protocol, &next_hop, - &iphdr->src, netdev->ll_addr ) ) != 0 ) { + &iphdr->src ) ) != 0 ) { DBGC ( sin_dest->sin_addr, "IPv4 could not transmit " "packet via %s: %s\n", netdev->name, strerror ( rc ) ); diff --git a/src/net/ipv6.c b/src/net/ipv6.c index 8ee0804d3..b12d6577e 100644 --- a/src/net/ipv6.c +++ b/src/net/ipv6.c @@ -617,8 +617,8 @@ static int ipv6_tx ( struct io_buffer *iobuf, return rc; } } else { - if ( ( rc = ndp_tx ( iobuf, netdev, next_hop, &iphdr->src, - netdev->ll_addr ) ) != 0 ) { + if ( ( rc = ndp_tx ( iobuf, netdev, next_hop, + &iphdr->src ) ) != 0 ) { DBGC ( ipv6col ( &iphdr->dest ), "IPv6 could not " "transmit packet via %s: %s\n", netdev->name, strerror ( rc ) ); diff --git a/src/net/neighbour.c b/src/net/neighbour.c index 13a8bc3ba..253cdc0e6 100644 --- a/src/net/neighbour.c +++ b/src/net/neighbour.c @@ -293,13 +293,12 @@ static void neighbour_expired ( struct retry_timer *timer, int fail ) { * @v net_protocol Network-layer protocol * @v net_dest Destination network-layer address * @v net_source Source network-layer address - * @v ll_source Source link-layer address * @ret rc Return status code */ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, struct net_protocol *net_protocol, const void *net_dest, struct neighbour_discovery *discovery, - const void *net_source, const void *ll_source ) { + const void *net_source ) { struct neighbour *neighbour; /* Find or create neighbour cache entry */ @@ -316,7 +315,7 @@ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, */ if ( neighbour_has_ll_dest ( neighbour ) ) { return net_tx ( iobuf, netdev, net_protocol, neighbour->ll_dest, - ll_source ); + netdev->ll_addr ); } else { DBGC2 ( neighbour, "NEIGHBOUR %s %s %s deferring packet\n", netdev->name, net_protocol->name, -- cgit v1.2.3-55-g7522 From aabfb8a94dafb361af8b2d093471958f19250813 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 5 Jan 2026 15:46:52 +0000 Subject: [neighbour] Use discovery protocol field to identify incomplete neighbours Use the discovery protocol pointer field (rather than the running state of the discovery timer) to determine whether or not neighbour discovery is ongoing, as a precursor to allowing the timer to be (ab)used for adding deliberate latency to transmitted packets. Signed-off-by: Michael Brown --- src/include/ipxe/neighbour.h | 15 ++------------- src/net/neighbour.c | 21 +++++++++++++++------ src/usr/neighmgmt.c | 5 ++--- 3 files changed, 19 insertions(+), 22 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/neighbour.h b/src/include/ipxe/neighbour.h index 1ca0ee333..7e7fac277 100644 --- a/src/include/ipxe/neighbour.h +++ b/src/include/ipxe/neighbour.h @@ -49,9 +49,9 @@ struct neighbour { /** Link-layer destination address */ uint8_t ll_dest[MAX_LL_ADDR_LEN]; - /** Neighbour discovery protocol (if any) */ + /** Neighbour discovery protocol (if discovery is ongoing) */ struct neighbour_discovery *discovery; - /** Network-layer source address (if any) */ + /** Network-layer source address (for discovery requests) */ uint8_t net_source[MAX_NET_ADDR_LEN]; /** Retransmission timer */ struct retry_timer timer; @@ -60,17 +60,6 @@ struct neighbour { struct list_head tx_queue; }; -/** - * Test if neighbour cache entry has a valid link-layer address - * - * @v neighbour Neighbour cache entry - * @ret has_ll_dest Neighbour cache entry has a valid link-layer address - */ -static inline __attribute__ (( always_inline )) int -neighbour_has_ll_dest ( struct neighbour *neighbour ) { - return ( ! timer_running ( &neighbour->timer ) ); -} - extern struct list_head neighbours; extern int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, diff --git a/src/net/neighbour.c b/src/net/neighbour.c index 253cdc0e6..908f8e4b2 100644 --- a/src/net/neighbour.c +++ b/src/net/neighbour.c @@ -186,6 +186,9 @@ static void neighbour_discovered ( struct neighbour *neighbour, /* Stop retransmission timer */ stop_timer ( &neighbour->timer ); + /* Mark discovery as complete */ + neighbour->discovery = NULL; + /* Transmit any packets in queue. Take out a temporary * reference on the entry to prevent it from going out of * scope during the call to net_tx(). @@ -300,6 +303,7 @@ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, struct neighbour_discovery *discovery, const void *net_source ) { struct neighbour *neighbour; + int rc; /* Find or create neighbour cache entry */ neighbour = neighbour_find ( netdev, net_protocol, net_dest ); @@ -310,19 +314,24 @@ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, neighbour_discover ( neighbour, discovery, net_source ); } - /* If a link-layer address is available then transmit - * immediately, otherwise queue for later transmission. + /* If discovery is still in progress then queue for later + * transmission. */ - if ( neighbour_has_ll_dest ( neighbour ) ) { - return net_tx ( iobuf, netdev, net_protocol, neighbour->ll_dest, - netdev->ll_addr ); - } else { + if ( neighbour->discovery ) { DBGC2 ( neighbour, "NEIGHBOUR %s %s %s deferring packet\n", netdev->name, net_protocol->name, net_protocol->ntoa ( net_dest ) ); list_add_tail ( &iobuf->list, &neighbour->tx_queue ); return 0; } + + /* Otherwise, transmit immediately */ + if ( ( rc = net_tx ( iobuf, netdev, net_protocol, neighbour->ll_dest, + netdev->ll_addr ) ) != 0 ) { + return rc; + } + + return 0; } /** diff --git a/src/usr/neighmgmt.c b/src/usr/neighmgmt.c index 9fd88f82b..fcdcbbfbb 100644 --- a/src/usr/neighmgmt.c +++ b/src/usr/neighmgmt.c @@ -50,9 +50,8 @@ void nstat ( void ) { printf ( "%s %s %s is %s %s", netdev->name, net_protocol->name, net_protocol->ntoa ( neighbour->net_dest ), ll_protocol->name, - ( neighbour_has_ll_dest ( neighbour ) ? - ll_protocol->ntoa ( neighbour->ll_dest ) : - "(incomplete)" ) ); + ( neighbour->discovery ? "(incomplete)" : + ll_protocol->ntoa ( neighbour->ll_dest ) ) ); if ( neighbour->discovery ) printf ( " (%s)", neighbour->discovery->name ); printf ( "\n" ); -- cgit v1.2.3-55-g7522 From 33c832b0d900b16fb8816cc5f135d3156463256d Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 5 Jan 2026 15:53:20 +0000 Subject: [neighbour] Split out deferred transmission from discovery completion Split out the logic for transmitting any deferred packets as a separate function, as a precursor to supporting the ability to add deliberate latency to transmitted packets. Signed-off-by: Michael Brown --- src/net/neighbour.c | 42 ++++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-) (limited to 'src/net') diff --git a/src/net/neighbour.c b/src/net/neighbour.c index 908f8e4b2..d7d8a6147 100644 --- a/src/net/neighbour.c +++ b/src/net/neighbour.c @@ -164,31 +164,20 @@ static void neighbour_discover ( struct neighbour *neighbour, } /** - * Complete neighbour discovery + * Transmit deferred packets * * @v neighbour Neighbour cache entry - * @v ll_dest Destination link-layer address */ -static void neighbour_discovered ( struct neighbour *neighbour, - const void *ll_dest ) { +static void neighbour_tx_queue ( struct neighbour *neighbour ) { struct net_device *netdev = neighbour->netdev; - struct ll_protocol *ll_protocol = netdev->ll_protocol; struct net_protocol *net_protocol = neighbour->net_protocol; + const void *ll_dest = neighbour->ll_dest; struct io_buffer *iobuf; int rc; - /* Fill in link-layer address */ - memcpy ( neighbour->ll_dest, ll_dest, ll_protocol->ll_addr_len ); - DBGC ( neighbour, "NEIGHBOUR %s %s %s is %s %s\n", netdev->name, - net_protocol->name, net_protocol->ntoa ( neighbour->net_dest ), - ll_protocol->name, ll_protocol->ntoa ( neighbour->ll_dest ) ); - /* Stop retransmission timer */ stop_timer ( &neighbour->timer ); - /* Mark discovery as complete */ - neighbour->discovery = NULL; - /* Transmit any packets in queue. Take out a temporary * reference on the entry to prevent it from going out of * scope during the call to net_tx(). @@ -213,6 +202,31 @@ static void neighbour_discovered ( struct neighbour *neighbour, ref_put ( &neighbour->refcnt ); } +/** + * Complete neighbour discovery + * + * @v neighbour Neighbour cache entry + * @v ll_dest Destination link-layer address + */ +static void neighbour_discovered ( struct neighbour *neighbour, + const void *ll_dest ) { + struct net_device *netdev = neighbour->netdev; + struct ll_protocol *ll_protocol = netdev->ll_protocol; + struct net_protocol *net_protocol = neighbour->net_protocol; + + /* Fill in link-layer address */ + memcpy ( neighbour->ll_dest, ll_dest, ll_protocol->ll_addr_len ); + DBGC ( neighbour, "NEIGHBOUR %s %s %s is %s %s\n", netdev->name, + net_protocol->name, net_protocol->ntoa ( neighbour->net_dest ), + ll_protocol->name, ll_protocol->ntoa ( neighbour->ll_dest ) ); + + /* Mark discovery as complete */ + neighbour->discovery = NULL; + + /* Transmit any deferred packets */ + neighbour_tx_queue ( neighbour ); +} + /** * Destroy neighbour cache entry * -- cgit v1.2.3-55-g7522 From ff6d612e7250b7d791b7451f8787ddf303c30453 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 6 Jan 2026 14:04:00 +0000 Subject: [neighbour] Add the ability to artificially delay outbound packets Add a fault-injection mechanism that allows an arbitrary delay (configured via config/fault.h) to be added to any packets transmitted via the neighbour resolution mechanism, as a way of reproducing symptoms that occur only on high-latency connections such as a satellite uplink. The neighbour discovery mechanism is not a natural conceptual fit for this artficial delay, since neighbour discovery has nothing to do with transmit latency. However, the neighbour discovery mechanism happens to already include a deferred transmission queue that can be (ab)used to implement this artifical delay in a minimally intrusive way. In particular, there is zero code size impact on a standard build with no artificial delay configured. Implementing the delay only for packets transmitted via neighbour resolution has the side effect that broadcast packets (such as DHCP and ARP) are unaffected. This is likely in practice to produce a better emulation of a high-latency uplink scenario, where local network traffic such as DHCP and ARP will complete quickly and only the subsequent TCP/UDP traffic will experience delays. Signed-off-by: Michael Brown --- src/config/fault.h | 3 ++ src/include/ipxe/neighbour.h | 6 ++++ src/net/neighbour.c | 74 ++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 80 insertions(+), 3 deletions(-) (limited to 'src/net') diff --git a/src/config/fault.h b/src/config/fault.h index 188876e03..5912ae1a6 100644 --- a/src/config/fault.h +++ b/src/config/fault.h @@ -14,6 +14,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /* Drop every N transmitted or received network packets */ #define NETDEV_DISCARD_RATE 0 +/* Delay transmissions to neighbour-resolved destinations (in ms) */ +#define NEIGHBOUR_DELAY_MS 0 + /* Drop every N transmitted or received PeerDist discovery packets */ #define PEERDISC_DISCARD_RATE 0 diff --git a/src/include/ipxe/neighbour.h b/src/include/ipxe/neighbour.h index 7e7fac277..e0701f6e3 100644 --- a/src/include/ipxe/neighbour.h +++ b/src/include/ipxe/neighbour.h @@ -60,6 +60,12 @@ struct neighbour { struct list_head tx_queue; }; +/** A neighbour transmission delay pseudo-header */ +struct neighbour_delay { + /** Original transmission time (in ticks) */ + unsigned long start; +}; + extern struct list_head neighbours; extern int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, diff --git a/src/net/neighbour.c b/src/net/neighbour.c index d7d8a6147..9d926a485 100644 --- a/src/net/neighbour.c +++ b/src/net/neighbour.c @@ -32,6 +32,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include /** @file * @@ -48,6 +49,18 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** Neighbour discovery maximum timeout */ #define NEIGHBOUR_MAX_TIMEOUT ( TICKS_PER_SEC * 3 ) +/** Neighbour discovery maximum burst count for delayed transmissions + * + * When using delay injection, timer quantisation can cause a large + * number of delayed packets to be scheduled at the same time. This + * can quickly exhaust available transmit descriptors, leading to + * packets that are dropped completely (not just delayed). + * + * Limit the number of delayed packets that we will attempt to + * transmit at once, to allow time for transmit completions to occur. + */ +#define NEIGHBOUR_DELAY_MAX_BURST 2 + /** The neighbour cache */ struct list_head neighbours = LIST_HEAD_INIT ( neighbours ); @@ -172,7 +185,11 @@ static void neighbour_tx_queue ( struct neighbour *neighbour ) { struct net_device *netdev = neighbour->netdev; struct net_protocol *net_protocol = neighbour->net_protocol; const void *ll_dest = neighbour->ll_dest; + struct neighbour_delay *delay; struct io_buffer *iobuf; + unsigned long elapsed; + unsigned long threshold; + unsigned int count = 0; int rc; /* Stop retransmission timer */ @@ -185,6 +202,33 @@ static void neighbour_tx_queue ( struct neighbour *neighbour ) { ref_get ( &neighbour->refcnt ); while ( ( iobuf = list_first_entry ( &neighbour->tx_queue, struct io_buffer, list )) != NULL){ + + /* Handle delay injection */ + if ( NEIGHBOUR_DELAY_MS ) { + + /* Determine elapsed time since transmission attempt */ + delay = iobuf->data; + elapsed = ( currticks() - delay->start ); + threshold = ( NEIGHBOUR_DELAY_MS * TICKS_PER_MS ); + + /* Defer transmission if not yet scheduled */ + if ( elapsed < threshold ) { + start_timer_fixed ( &neighbour->timer, + ( threshold - elapsed ) ); + break; + } + + /* Defer transmission if maximum burst count reached */ + if ( ++count >= NEIGHBOUR_DELAY_MAX_BURST ) { + start_timer_nodelay ( &neighbour->timer ); + break; + } + + /* Strip pseudo-header */ + iob_pull ( iobuf, sizeof ( *delay ) ); + } + + /* Transmit deferred packet */ DBGC2 ( neighbour, "NEIGHBOUR %s %s %s transmitting deferred " "packet\n", netdev->name, net_protocol->name, net_protocol->ntoa ( neighbour->net_dest ) ); @@ -280,6 +324,14 @@ static void neighbour_expired ( struct retry_timer *timer, int fail ) { const void *net_source = neighbour->net_source; int rc; + /* If the timer is being (ab)used for delay injection, then + * transmit the deferred packet queue. + */ + if ( NEIGHBOUR_DELAY_MS && ( ! neighbour->discovery ) ) { + neighbour_tx_queue ( neighbour ); + return; + } + /* If we have failed, destroy the cache entry */ if ( fail ) { neighbour_destroy ( neighbour, -ETIMEDOUT ); @@ -317,6 +369,7 @@ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, struct neighbour_discovery *discovery, const void *net_source ) { struct neighbour *neighbour; + struct neighbour_delay *delay; int rc; /* Find or create neighbour cache entry */ @@ -328,14 +381,29 @@ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, neighbour_discover ( neighbour, discovery, net_source ); } - /* If discovery is still in progress then queue for later - * transmission. + /* If discovery is still in progress or if delay injection is + * in use, then queue for later transmission. */ - if ( neighbour->discovery ) { + if ( NEIGHBOUR_DELAY_MS || neighbour->discovery ) { + + /* Add to deferred packet queue */ DBGC2 ( neighbour, "NEIGHBOUR %s %s %s deferring packet\n", netdev->name, net_protocol->name, net_protocol->ntoa ( net_dest ) ); list_add_tail ( &iobuf->list, &neighbour->tx_queue ); + + /* Handle delay injection, if applicable */ + if ( NEIGHBOUR_DELAY_MS ) { + + /* Record original transmission time */ + delay = iob_push ( iobuf, sizeof ( *delay ) ); + delay->start = currticks(); + + /* Process deferred packet queue, if possible */ + if ( ! neighbour->discovery ) + neighbour_tx_queue ( neighbour ); + } + return 0; } -- cgit v1.2.3-55-g7522 From 8e557f1ab0e0153cae43391f051947bf06629d2c Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Fri, 9 Jan 2026 13:18:20 +0000 Subject: [tcp] Discard packets that lie immediately before the receive window We will currently enqueue (rather than discard) retransmitted packets that lie immediately before the current receive window. These packets will be harmlessly discarded when the receive queue is processed immediately afterwards, but cause confusion when attempting to debug TCP performance issues. Fix by adjusting the comparison so that packets that lie immediately before the receive window will be discarded immediately and never enqueued. Signed-off-by: Michael Brown --- src/net/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/net') diff --git a/src/net/tcp.c b/src/net/tcp.c index 2a98221f6..d47196ba5 100644 --- a/src/net/tcp.c +++ b/src/net/tcp.c @@ -1317,7 +1317,7 @@ static void tcp_rx_enqueue ( struct tcp_connection *tcp, uint32_t seq, */ if ( ( ! ( tcp->tcp_state & TCP_STATE_RCVD ( TCP_SYN ) ) ) || ( tcp_cmp ( seq, tcp->rcv_ack + tcp->rcv_win ) >= 0 ) || - ( tcp_cmp ( nxt, tcp->rcv_ack ) < 0 ) || + ( tcp_cmp ( nxt, tcp->rcv_ack ) <= 0 ) || ( seq_len == 0 ) ) { free_iob ( iobuf ); return; -- cgit v1.2.3-55-g7522 From 2110afb351789257ed2821f13a1fbd0ece2fd7c8 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Fri, 9 Jan 2026 16:36:52 +0000 Subject: [tcp] Report TCP statistics via the "ipstat" command Gather some basic statistics on TCP connections to allow out-of-order packets and duplicate packets to be observed even in non-debug builds. Report these statistics via the existing "ipstat" command, rather than introducing a separate "tcpstat" command, on the basis that we do not need the additional overhead of a separate command. Signed-off-by: Michael Brown --- src/include/ipxe/tcp.h | 17 +++++++++++++++++ src/net/tcp.c | 20 ++++++++++++++++++++ src/usr/ipstat.c | 14 ++++++++++++-- 3 files changed, 49 insertions(+), 2 deletions(-) (limited to 'src/net') diff --git a/src/include/ipxe/tcp.h b/src/include/ipxe/tcp.h index 1f65a3d92..a1e89f718 100644 --- a/src/include/ipxe/tcp.h +++ b/src/include/ipxe/tcp.h @@ -439,6 +439,23 @@ static inline int tcp_in_window ( uint32_t seq, uint32_t start, */ #define TCP_FINISH_TIMEOUT ( 1 * TICKS_PER_SEC ) +/** TCP statistics */ +struct tcp_statistics { + /** Number of packets received */ + unsigned long in_segs; + /** Total number of packets discarded due to lack of memory */ + unsigned long in_discards; + /** Total number of packets received out of order */ + unsigned long in_out_of_order; + + /** Number of octets received (including duplicate data) */ + unsigned long in_octets; + /** Number of octets processed and passed to upper layer */ + unsigned long in_octets_good; +}; + extern struct tcpip_protocol tcp_protocol __tcpip_protocol; +extern struct tcp_statistics tcp_stats; + #endif /* _IPXE_TCP_H */ diff --git a/src/net/tcp.c b/src/net/tcp.c index d47196ba5..2e52cf480 100644 --- a/src/net/tcp.c +++ b/src/net/tcp.c @@ -167,6 +167,9 @@ struct tcp_rx_queued_header { */ static LIST_HEAD ( tcp_conns ); +/** TCP statistics */ +struct tcp_statistics tcp_stats; + /** Transmit profiler */ static struct profiler tcp_tx_profiler __profiler = { .name = "tcp.tx" }; @@ -1216,6 +1219,9 @@ static int tcp_rx_data ( struct tcp_connection *tcp, uint32_t seq, /* Acknowledge new data */ tcp_rx_seq ( tcp, len ); + /* Update statistics */ + tcp_stats.in_octets_good += len; + /* Deliver data to application */ profile_start ( &tcp_xfer_profiler ); if ( ( rc = xfer_deliver_iob ( &tcp->xfer, iobuf ) ) != 0 ) { @@ -1299,6 +1305,7 @@ static void tcp_rx_enqueue ( struct tcp_connection *tcp, uint32_t seq, size_t len; uint32_t seq_len; uint32_t nxt; + uint32_t gap; /* Calculate remaining flags and sequence length. Note that * SYN, if present, has already been processed by this point. @@ -1330,12 +1337,18 @@ static void tcp_rx_enqueue ( struct tcp_connection *tcp, uint32_t seq, tcpqhdr->flags = flags; /* Add to RX queue */ + gap = tcp->rcv_ack; list_for_each_entry ( queued, &tcp->rx_queue, list ) { tcpqhdr = queued->data; if ( tcp_cmp ( seq, tcpqhdr->seq ) < 0 ) break; + gap = tcpqhdr->nxt; } list_add_tail ( &iobuf->list, &queued->list ); + + /* Update statistics */ + if ( seq != gap ) + tcp_stats.in_out_of_order++; } /** @@ -1459,6 +1472,10 @@ static int tcp_rx ( struct io_buffer *iobuf, seq_len = ( len + ( ( flags & TCP_SYN ) ? 1 : 0 ) + ( ( flags & TCP_FIN ) ? 1 : 0 ) ); + /* Update statistics */ + tcp_stats.in_segs++; + tcp_stats.in_octets += len; + /* Dump header */ DBGC2 ( tcp, "TCP %p RX %d<-%d %08x %08x..%08x %4zd", tcp, ntohs ( tcphdr->dest ), ntohs ( tcphdr->src ), @@ -1569,6 +1586,9 @@ static unsigned int tcp_discard ( void ) { list_del ( &iobuf->list ); free_iob ( iobuf ); + /* Update statistics */ + tcp_stats.in_discards++; + /* Report discard */ discarded++; break; diff --git a/src/usr/ipstat.c b/src/usr/ipstat.c index 0f09cc2ff..b9c5e02a7 100644 --- a/src/usr/ipstat.c +++ b/src/usr/ipstat.c @@ -24,23 +24,25 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include +#include #include #include /** @file * - * IP statistics + * TCP/IP statistics * */ /** - * Print IP statistics + * Print TCP/IP statistics * */ void ipstat ( void ) { struct ip_statistics_family *family; struct ip_statistics *stats; + /* Print per-family statistics */ for_each_table_entry ( family, IP_STATISTICS_FAMILIES ) { stats = family->stats; printf ( "IP version %d:\n", family->version ); @@ -63,4 +65,12 @@ void ipstat ( void ) { stats->out_mcast_pkts, stats->out_bcast_pkts, stats->out_octets ); } + + /* Print TCP statistics */ + printf ( "TCP:\n" ); + printf ( " InSegs:%ld InOctets:%ld InOctetsGood:%ld\n", + tcp_stats.in_segs, tcp_stats.in_octets, + tcp_stats.in_octets_good ); + printf ( " InDiscards:%ld InOutOfOrder:%ld\n", + tcp_stats.in_discards, tcp_stats.in_out_of_order ); } -- cgit v1.2.3-55-g7522 From 9c01c5a5dacb54167132d9a27259b23acdf091d6 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Fri, 9 Jan 2026 18:29:53 +0000 Subject: [neighbour] Treat delayed transmissions as pending operations Treat each delayed transmission as a pending operation, so that the "sync" command can be used to ensure that all delayed packets have been transmitted. Signed-off-by: Michael Brown --- src/net/neighbour.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src/net') diff --git a/src/net/neighbour.c b/src/net/neighbour.c index 9d926a485..ac79041e3 100644 --- a/src/net/neighbour.c +++ b/src/net/neighbour.c @@ -31,6 +31,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); #include #include #include +#include #include #include @@ -64,6 +65,9 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** The neighbour cache */ struct list_head neighbours = LIST_HEAD_INIT ( neighbours ); +/** Pending operation for delayed transmissions */ +static struct pending_operation neighbour_delayed; + static void neighbour_expired ( struct retry_timer *timer, int over ); /** @@ -226,6 +230,9 @@ static void neighbour_tx_queue ( struct neighbour *neighbour ) { /* Strip pseudo-header */ iob_pull ( iobuf, sizeof ( *delay ) ); + + /* Remove pending operation */ + pending_put ( &neighbour_delayed ); } /* Transmit deferred packet */ @@ -296,6 +303,8 @@ static void neighbour_destroy ( struct neighbour *neighbour, int rc ) { net_protocol->ntoa ( neighbour->net_dest ), strerror ( rc ) ); list_del ( &iobuf->list ); + if ( NEIGHBOUR_DELAY_MS ) + pending_put ( &neighbour_delayed ); netdev_tx_err ( neighbour->netdev, iobuf, rc ); } @@ -399,6 +408,9 @@ int neighbour_tx ( struct io_buffer *iobuf, struct net_device *netdev, delay = iob_push ( iobuf, sizeof ( *delay ) ); delay->start = currticks(); + /* Add pending operation */ + pending_get ( &neighbour_delayed ); + /* Process deferred packet queue, if possible */ if ( ! neighbour->discovery ) neighbour_tx_queue ( neighbour ); -- cgit v1.2.3-55-g7522 From 30948987fda56e55d172cc3b66b291064724624d Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Tue, 13 Jan 2026 14:38:37 +0000 Subject: [build] Mark existing files as explicitly forbidden for Secure Boot The third-party 802.11 stack and NFS protocol code are known to include multiple potential vulnerabilities and are explicitly forbidden from being included in Secure Boot signed builds. This is currently handled at the per-directory level by defining a list of source directories (SRCDIRS_INSEC) that are to be excluded from Secure Boot builds. Annotate all files in these directories with FILE_SECBOOT() to convey this information to the new per-file Secure Boot permissibility check, and remove the old separation between SRCDIRS and SRCDIRS_INSEC. Signed-off-by: Michael Brown --- src/Makefile | 16 ++++++---------- src/Makefile.housekeeping | 5 ----- src/drivers/net/ath/ath.h | 1 + src/drivers/net/ath/ath5k/ath5k.c | 1 + src/drivers/net/ath/ath5k/ath5k.h | 1 + src/drivers/net/ath/ath5k/ath5k_attach.c | 1 + src/drivers/net/ath/ath5k/ath5k_caps.c | 1 + src/drivers/net/ath/ath5k/ath5k_desc.c | 1 + src/drivers/net/ath/ath5k/ath5k_dma.c | 1 + src/drivers/net/ath/ath5k/ath5k_eeprom.c | 1 + src/drivers/net/ath/ath5k/ath5k_gpio.c | 1 + src/drivers/net/ath/ath5k/ath5k_initvals.c | 1 + src/drivers/net/ath/ath5k/ath5k_pcu.c | 1 + src/drivers/net/ath/ath5k/ath5k_phy.c | 1 + src/drivers/net/ath/ath5k/ath5k_qcu.c | 1 + src/drivers/net/ath/ath5k/ath5k_reset.c | 1 + src/drivers/net/ath/ath5k/ath5k_rfkill.c | 1 + src/drivers/net/ath/ath5k/base.h | 1 + src/drivers/net/ath/ath5k/desc.h | 2 ++ src/drivers/net/ath/ath5k/eeprom.h | 2 ++ src/drivers/net/ath/ath5k/reg.h | 2 ++ src/drivers/net/ath/ath5k/rfbuffer.h | 1 + src/drivers/net/ath/ath5k/rfgain.h | 2 ++ src/drivers/net/ath/ath9k/ani.h | 1 + src/drivers/net/ath/ath9k/ar5008_initvals.h | 1 + src/drivers/net/ath/ath9k/ar9001_initvals.h | 1 + src/drivers/net/ath/ath9k/ar9002_initvals.h | 1 + src/drivers/net/ath/ath9k/ar9002_phy.h | 1 + src/drivers/net/ath/ath9k/ar9003_2p2_initvals.h | 2 ++ src/drivers/net/ath/ath9k/ar9003_eeprom.h | 1 + src/drivers/net/ath/ath9k/ar9003_mac.h | 2 ++ src/drivers/net/ath/ath9k/ar9003_phy.h | 2 ++ src/drivers/net/ath/ath9k/ar9340_initvals.h | 2 ++ src/drivers/net/ath/ath9k/ar9485_initvals.h | 2 ++ src/drivers/net/ath/ath9k/ath9k.c | 2 ++ src/drivers/net/ath/ath9k/ath9k.h | 1 + src/drivers/net/ath/ath9k/ath9k_ani.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9002_calib.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9002_hw.c | 1 + src/drivers/net/ath/ath9k/ath9k_ar9002_mac.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9003_calib.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9003_eeprom.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9003_hw.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_ar9003_mac.c | 3 +++ src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_calib.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_common.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_eeprom.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_eeprom_def.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_hw.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_init.c | 1 + src/drivers/net/ath/ath9k/ath9k_mac.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_main.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_recv.c | 2 ++ src/drivers/net/ath/ath9k/ath9k_xmit.c | 2 ++ src/drivers/net/ath/ath9k/calib.h | 1 + src/drivers/net/ath/ath9k/common.h | 1 + src/drivers/net/ath/ath9k/eeprom.h | 1 + src/drivers/net/ath/ath9k/hw-ops.h | 1 + src/drivers/net/ath/ath9k/hw.h | 1 + src/drivers/net/ath/ath9k/mac.h | 1 + src/drivers/net/ath/ath9k/phy.h | 1 + src/drivers/net/ath/ath9k/reg.h | 1 + src/drivers/net/ath/ath_hw.c | 2 ++ src/drivers/net/ath/ath_key.c | 2 ++ src/drivers/net/ath/ath_regd.c | 2 ++ src/drivers/net/ath/reg.h | 1 + src/drivers/net/ath/regd.h | 1 + src/drivers/net/ath/regd_common.h | 2 ++ src/drivers/net/rtl818x/rtl8180.c | 1 + src/drivers/net/rtl818x/rtl8180_grf5101.c | 1 + src/drivers/net/rtl818x/rtl8180_max2820.c | 1 + src/drivers/net/rtl818x/rtl8180_sa2400.c | 1 + src/drivers/net/rtl818x/rtl8185.c | 1 + src/drivers/net/rtl818x/rtl8185_rtl8225.c | 1 + src/drivers/net/rtl818x/rtl818x.c | 1 + src/drivers/net/rtl818x/rtl818x.h | 1 + src/net/80211/net80211.c | 1 + src/net/80211/rc80211.c | 1 + src/net/80211/sec80211.c | 1 + src/net/80211/wep.c | 1 + src/net/80211/wpa.c | 1 + src/net/80211/wpa_ccmp.c | 1 + src/net/80211/wpa_psk.c | 1 + src/net/80211/wpa_tkip.c | 1 + src/net/oncrpc/mount.c | 2 ++ src/net/oncrpc/nfs.c | 2 ++ src/net/oncrpc/nfs_open.c | 2 ++ src/net/oncrpc/nfs_uri.c | 2 ++ src/net/oncrpc/oncrpc_iob.c | 2 ++ src/net/oncrpc/portmap.c | 2 ++ 95 files changed, 141 insertions(+), 15 deletions(-) (limited to 'src/net') diff --git a/src/Makefile b/src/Makefile index 22f413d25..f9d782f97 100644 --- a/src/Makefile +++ b/src/Makefile @@ -107,16 +107,12 @@ SRCDIRS += hci/mucurses hci/mucurses/widgets SRCDIRS += hci/keymap SRCDIRS += usr SRCDIRS += config - -# These directories contain code that is not eligible for UEFI Secure -# Boot signing. -# -SRCDIRS_INSEC += net/oncrpc -SRCDIRS_INSEC += net/80211 -SRCDIRS_INSEC += drivers/net/rtl818x -SRCDIRS_INSEC += drivers/net/ath -SRCDIRS_INSEC += drivers/net/ath/ath5k -SRCDIRS_INSEC += drivers/net/ath/ath9k +SRCDIRS += net/oncrpc +SRCDIRS += net/80211 +SRCDIRS += drivers/net/rtl818x +SRCDIRS += drivers/net/ath +SRCDIRS += drivers/net/ath/ath5k +SRCDIRS += drivers/net/ath/ath9k # NON_AUTO_SRCS lists files that are excluded from the normal # automatic build system. diff --git a/src/Makefile.housekeeping b/src/Makefile.housekeeping index f56766cd6..d2a23c48a 100644 --- a/src/Makefile.housekeeping +++ b/src/Makefile.housekeeping @@ -436,11 +436,6 @@ endif # # Source file handling -# Exclude known-insecure files from Secure Boot builds -ifeq ($(SECUREBOOT),0) -SRCDIRS += $(SRCDIRS_INSEC) -endif - # SRCDIRS lists all directories containing source files. srcdirs : @$(ECHO) $(SRCDIRS) diff --git a/src/drivers/net/ath/ath.h b/src/drivers/net/ath/ath.h index 21f795b70..60d2ee021 100644 --- a/src/drivers/net/ath/ath.h +++ b/src/drivers/net/ath/ath.h @@ -21,6 +21,7 @@ #define ATH_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/drivers/net/ath/ath5k/ath5k.c b/src/drivers/net/ath/ath5k/ath5k.c index 643884d46..09510d3d2 100644 --- a/src/drivers/net/ath/ath5k/ath5k.c +++ b/src/drivers/net/ath/ath5k/ath5k.c @@ -44,6 +44,7 @@ */ FILE_LICENCE ( BSD3 ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/drivers/net/ath/ath5k/ath5k.h b/src/drivers/net/ath/ath5k/ath5k.h index 727d41279..612926f17 100644 --- a/src/drivers/net/ath/ath5k/ath5k.h +++ b/src/drivers/net/ath/ath5k/ath5k.h @@ -22,6 +22,7 @@ #define _ATH5K_H FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/drivers/net/ath/ath5k/ath5k_attach.c b/src/drivers/net/ath/ath5k/ath5k_attach.c index 302536dbd..fb3382943 100644 --- a/src/drivers/net/ath/ath5k/ath5k_attach.c +++ b/src/drivers/net/ath/ath5k/ath5k_attach.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /*************************************\ * Attach/Detach Functions and helpers * diff --git a/src/drivers/net/ath/ath5k/ath5k_caps.c b/src/drivers/net/ath/ath5k/ath5k_caps.c index 9c00d15d7..bc5abc58c 100644 --- a/src/drivers/net/ath/ath5k/ath5k_caps.c +++ b/src/drivers/net/ath/ath5k/ath5k_caps.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /**************\ * Capabilities * diff --git a/src/drivers/net/ath/ath5k/ath5k_desc.c b/src/drivers/net/ath/ath5k/ath5k_desc.c index 816d26ede..a3ac340df 100644 --- a/src/drivers/net/ath/ath5k/ath5k_desc.c +++ b/src/drivers/net/ath/ath5k/ath5k_desc.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /******************************\ Hardware Descriptor Functions diff --git a/src/drivers/net/ath/ath5k/ath5k_dma.c b/src/drivers/net/ath/ath5k/ath5k_dma.c index fa1e0d013..f27ea8fd2 100644 --- a/src/drivers/net/ath/ath5k/ath5k_dma.c +++ b/src/drivers/net/ath/ath5k/ath5k_dma.c @@ -19,6 +19,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /*************************************\ * DMA and interrupt masking functions * diff --git a/src/drivers/net/ath/ath5k/ath5k_eeprom.c b/src/drivers/net/ath/ath5k/ath5k_eeprom.c index 46f33d1e8..5219ef148 100644 --- a/src/drivers/net/ath/ath5k/ath5k_eeprom.c +++ b/src/drivers/net/ath/ath5k/ath5k_eeprom.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /*************************************\ * EEPROM access functions and helpers * diff --git a/src/drivers/net/ath/ath5k/ath5k_gpio.c b/src/drivers/net/ath/ath5k/ath5k_gpio.c index 2301ec70b..7f9652b1e 100644 --- a/src/drivers/net/ath/ath5k/ath5k_gpio.c +++ b/src/drivers/net/ath/ath5k/ath5k_gpio.c @@ -19,6 +19,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /****************\ GPIO Functions diff --git a/src/drivers/net/ath/ath5k/ath5k_initvals.c b/src/drivers/net/ath/ath5k/ath5k_initvals.c index 8f3bd2034..f2fd23bb4 100644 --- a/src/drivers/net/ath/ath5k/ath5k_initvals.c +++ b/src/drivers/net/ath/ath5k/ath5k_initvals.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); #include diff --git a/src/drivers/net/ath/ath5k/ath5k_pcu.c b/src/drivers/net/ath/ath5k/ath5k_pcu.c index c8165da79..6821a01d5 100644 --- a/src/drivers/net/ath/ath5k/ath5k_pcu.c +++ b/src/drivers/net/ath/ath5k/ath5k_pcu.c @@ -23,6 +23,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /*********************************\ * Protocol Control Unit Functions * diff --git a/src/drivers/net/ath/ath5k/ath5k_phy.c b/src/drivers/net/ath/ath5k/ath5k_phy.c index c2a66a4d3..d220b255b 100644 --- a/src/drivers/net/ath/ath5k/ath5k_phy.c +++ b/src/drivers/net/ath/ath5k/ath5k_phy.c @@ -23,6 +23,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); #define _ATH5K_PHY diff --git a/src/drivers/net/ath/ath5k/ath5k_qcu.c b/src/drivers/net/ath/ath5k/ath5k_qcu.c index e38dba9e2..ff4b9e5e3 100644 --- a/src/drivers/net/ath/ath5k/ath5k_qcu.c +++ b/src/drivers/net/ath/ath5k/ath5k_qcu.c @@ -19,6 +19,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); /********************************************\ Queue Control Unit, DFS Control Unit Functions diff --git a/src/drivers/net/ath/ath5k/ath5k_reset.c b/src/drivers/net/ath/ath5k/ath5k_reset.c index 73765a7b0..98c729cf0 100644 --- a/src/drivers/net/ath/ath5k/ath5k_reset.c +++ b/src/drivers/net/ath/ath5k/ath5k_reset.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); #define _ATH5K_RESET diff --git a/src/drivers/net/ath/ath5k/ath5k_rfkill.c b/src/drivers/net/ath/ath5k/ath5k_rfkill.c index 752ef70b9..74708af9e 100644 --- a/src/drivers/net/ath/ath5k/ath5k_rfkill.c +++ b/src/drivers/net/ath/ath5k/ath5k_rfkill.c @@ -35,6 +35,7 @@ */ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( FORBIDDEN ); #include "base.h" diff --git a/src/drivers/net/ath/ath5k/base.h b/src/drivers/net/ath/ath5k/base.h index 976a3f306..1155da68e 100644 --- a/src/drivers/net/ath/ath5k/base.h +++ b/src/drivers/net/ath/ath5k/base.h @@ -45,6 +45,7 @@ #define _DEV_ATH_ATHVAR_H FILE_LICENCE ( BSD3 ); +FILE_SECBOOT ( FORBIDDEN ); #include "ath5k.h" #include diff --git a/src/drivers/net/ath/ath5k/desc.h b/src/drivers/net/ath/ath5k/desc.h index 6e11b0d43..bcbd291f4 100644 --- a/src/drivers/net/ath/ath5k/desc.h +++ b/src/drivers/net/ath/ath5k/desc.h @@ -16,6 +16,8 @@ * */ +FILE_SECBOOT ( FORBIDDEN ); + /* * Internal RX/TX descriptor structures * (rX: reserved fields possibily used by future versions of the ar5k chipset) diff --git a/src/drivers/net/ath/ath5k/eeprom.h b/src/drivers/net/ath/ath5k/eeprom.h index da4543393..e7b25b09f 100644 --- a/src/drivers/net/ath/ath5k/eeprom.h +++ b/src/drivers/net/ath/ath5k/eeprom.h @@ -16,6 +16,8 @@ * */ +FILE_SECBOOT ( FORBIDDEN ); + /* * Common ar5xxx EEPROM data offsets (set these on AR5K_EEPROM_BASE) */ diff --git a/src/drivers/net/ath/ath5k/reg.h b/src/drivers/net/ath/ath5k/reg.h index 7070d1543..fd9aa7c8e 100644 --- a/src/drivers/net/ath/ath5k/reg.h +++ b/src/drivers/net/ath/ath5k/reg.h @@ -17,6 +17,8 @@ * */ +FILE_SECBOOT ( FORBIDDEN ); + /* * Register values for Atheros 5210/5211/5212 cards from OpenBSD's ar5k * maintained by Reyk Floeter diff --git a/src/drivers/net/ath/ath5k/rfbuffer.h b/src/drivers/net/ath/ath5k/rfbuffer.h index e50baff66..bcbaf1db9 100644 --- a/src/drivers/net/ath/ath5k/rfbuffer.h +++ b/src/drivers/net/ath/ath5k/rfbuffer.h @@ -17,6 +17,7 @@ * */ +FILE_SECBOOT ( FORBIDDEN ); /* * There are some special registers on the RF chip diff --git a/src/drivers/net/ath/ath5k/rfgain.h b/src/drivers/net/ath/ath5k/rfgain.h index 1354d8c39..a220d8661 100644 --- a/src/drivers/net/ath/ath5k/rfgain.h +++ b/src/drivers/net/ath/ath5k/rfgain.h @@ -18,6 +18,8 @@ * */ +FILE_SECBOOT ( FORBIDDEN ); + /* * Mode-specific RF Gain table (64bytes) for RF5111/5112 * (RF5110 only comes with AR5210 and only supports a/turbo a mode so initial diff --git a/src/drivers/net/ath/ath9k/ani.h b/src/drivers/net/ath/ath9k/ani.h index ba87ba0fd..2aeb5654d 100644 --- a/src/drivers/net/ath/ath9k/ani.h +++ b/src/drivers/net/ath/ath9k/ani.h @@ -21,6 +21,7 @@ #define ANI_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #define HAL_PROCESS_ANI 0x00000001 diff --git a/src/drivers/net/ath/ath9k/ar5008_initvals.h b/src/drivers/net/ath/ath9k/ar5008_initvals.h index fcc155654..a4466b286 100644 --- a/src/drivers/net/ath/ath9k/ar5008_initvals.h +++ b/src/drivers/net/ath/ath9k/ar5008_initvals.h @@ -15,6 +15,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); static const u32 ar5416Modes[][6] = { {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0}, diff --git a/src/drivers/net/ath/ath9k/ar9001_initvals.h b/src/drivers/net/ath/ath9k/ar9001_initvals.h index 6c1ccd50e..5bf2d5dd4 100644 --- a/src/drivers/net/ath/ath9k/ar9001_initvals.h +++ b/src/drivers/net/ath/ath9k/ar9001_initvals.h @@ -15,6 +15,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); static const u32 ar5416Modes_9100[][6] = { {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0}, diff --git a/src/drivers/net/ath/ath9k/ar9002_initvals.h b/src/drivers/net/ath/ath9k/ar9002_initvals.h index f9a92c9b7..82bd94a5e 100644 --- a/src/drivers/net/ath/ath9k/ar9002_initvals.h +++ b/src/drivers/net/ath/ath9k/ar9002_initvals.h @@ -15,6 +15,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); static __unused const u32 ar9280Modes_9280_2[][6] = { {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0}, diff --git a/src/drivers/net/ath/ath9k/ar9002_phy.h b/src/drivers/net/ath/ath9k/ar9002_phy.h index 71d9162c9..a6f5db97a 100644 --- a/src/drivers/net/ath/ath9k/ar9002_phy.h +++ b/src/drivers/net/ath/ath9k/ar9002_phy.h @@ -17,6 +17,7 @@ #define AR9002_PHY_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #define AR_PHY_TEST 0x9800 #define PHY_AGC_CLR 0x10000000 diff --git a/src/drivers/net/ath/ath9k/ar9003_2p2_initvals.h b/src/drivers/net/ath/ath9k/ar9003_2p2_initvals.h index b1303bbaa..b2d30fff5 100644 --- a/src/drivers/net/ath/ath9k/ar9003_2p2_initvals.h +++ b/src/drivers/net/ath/ath9k/ar9003_2p2_initvals.h @@ -17,6 +17,8 @@ #ifndef INITVALS_9003_2P2_H #define INITVALS_9003_2P2_H +FILE_SECBOOT ( FORBIDDEN ); + /* AR9003 2.2 */ static __unused const u32 ar9300_2p2_radio_postamble[][5] = { diff --git a/src/drivers/net/ath/ath9k/ar9003_eeprom.h b/src/drivers/net/ath/ath9k/ar9003_eeprom.h index f03879236..092227564 100644 --- a/src/drivers/net/ath/ath9k/ar9003_eeprom.h +++ b/src/drivers/net/ath/ath9k/ar9003_eeprom.h @@ -21,6 +21,7 @@ #define AR9003_EEPROM_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #define AR9300_EEP_VER 0xD000 #define AR9300_EEP_VER_MINOR_MASK 0xFFF diff --git a/src/drivers/net/ath/ath9k/ar9003_mac.h b/src/drivers/net/ath/ath9k/ar9003_mac.h index 6442bb779..a5f7e0432 100644 --- a/src/drivers/net/ath/ath9k/ar9003_mac.h +++ b/src/drivers/net/ath/ath9k/ar9003_mac.h @@ -20,6 +20,8 @@ #ifndef AR9003_MAC_H #define AR9003_MAC_H +FILE_SECBOOT ( FORBIDDEN ); + #define AR_DescId 0xffff0000 #define AR_DescId_S 16 #define AR_CtrlStat 0x00004000 diff --git a/src/drivers/net/ath/ath9k/ar9003_phy.h b/src/drivers/net/ath/ath9k/ar9003_phy.h index 443090d27..130b5c65b 100644 --- a/src/drivers/net/ath/ath9k/ar9003_phy.h +++ b/src/drivers/net/ath/ath9k/ar9003_phy.h @@ -17,6 +17,8 @@ #ifndef AR9003_PHY_H #define AR9003_PHY_H +FILE_SECBOOT ( FORBIDDEN ); + /* * Channel Register Map */ diff --git a/src/drivers/net/ath/ath9k/ar9340_initvals.h b/src/drivers/net/ath/ath9k/ar9340_initvals.h index 784080b16..5ee400050 100644 --- a/src/drivers/net/ath/ath9k/ar9340_initvals.h +++ b/src/drivers/net/ath/ath9k/ar9340_initvals.h @@ -17,6 +17,8 @@ #ifndef INITVALS_9340_H #define INITVALS_9340_H +FILE_SECBOOT ( FORBIDDEN ); + static __unused const u32 ar9340_1p0_radio_postamble[][5] = { /* Addr 5G_HT20 5G_HT40 2G_HT40 2G_HT20 */ {0x000160ac, 0xa4646800, 0xa4646800, 0xa4646800, 0xa4646800}, diff --git a/src/drivers/net/ath/ath9k/ar9485_initvals.h b/src/drivers/net/ath/ath9k/ar9485_initvals.h index c854398aa..8892bb1b7 100644 --- a/src/drivers/net/ath/ath9k/ar9485_initvals.h +++ b/src/drivers/net/ath/ath9k/ar9485_initvals.h @@ -17,6 +17,8 @@ #ifndef INITVALS_9485_H #define INITVALS_9485_H +FILE_SECBOOT ( FORBIDDEN ); + static __unused const u32 ar9485_1_1_mac_core[][2] = { /* Addr allmodes */ {0x00000008, 0x00000000}, diff --git a/src/drivers/net/ath/ath9k/ath9k.c b/src/drivers/net/ath/ath9k/ath9k.c index 98b7ecd5a..a3020bc65 100644 --- a/src/drivers/net/ath/ath9k/ath9k.c +++ b/src/drivers/net/ath/ath9k/ath9k.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "ath9k.h" diff --git a/src/drivers/net/ath/ath9k/ath9k.h b/src/drivers/net/ath/ath9k/ath9k.h index 36dc97e99..9d62d9b82 100644 --- a/src/drivers/net/ath/ath9k/ath9k.h +++ b/src/drivers/net/ath/ath9k/ath9k.h @@ -21,6 +21,7 @@ #define ATH9K_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "common.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ani.c b/src/drivers/net/ath/ath9k/ath9k_ani.c index 76ca79cba..2b0f11c3f 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ani.c +++ b/src/drivers/net/ath/ath9k/ath9k_ani.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include "hw.h" #include "hw-ops.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c b/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c index a98e4bb66..622955368 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar5008_phy.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9002_calib.c b/src/drivers/net/ath/ath9k/ath9k_ar9002_calib.c index f8978a558..b03da98b3 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9002_calib.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9002_calib.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include "hw.h" #include "hw-ops.h" #include "ar9002_phy.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9002_hw.c b/src/drivers/net/ath/ath9k/ath9k_ar9002_hw.c index 85d0c7de6..0477af4d1 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9002_hw.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9002_hw.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "hw.h" #include "ar5008_initvals.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9002_mac.c b/src/drivers/net/ath/ath9k/ath9k_ar9002_mac.c index 057756b2e..b6308ffc4 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9002_mac.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9002_mac.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c b/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c index 65cfad597..396763533 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9002_phy.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + /** * DOC: Programming Atheros 802.11n analog front end radios * diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9003_calib.c b/src/drivers/net/ath/ath9k/ath9k_ar9003_calib.c index c37168bd2..4b6b7f907 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9003_calib.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9003_calib.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9003_eeprom.c b/src/drivers/net/ath/ath9k/ath9k_ar9003_eeprom.c index 95e54b9b2..96aa9ef2b 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9003_eeprom.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9003_eeprom.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9003_hw.c b/src/drivers/net/ath/ath9k/ath9k_ar9003_hw.c index f3020fd7e..2276ded25 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9003_hw.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9003_hw.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include "hw.h" #include "ar9003_mac.h" #include "ar9003_2p2_initvals.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9003_mac.c b/src/drivers/net/ath/ath9k/ath9k_ar9003_mac.c index 1fa4039cc..7f1b26182 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9003_mac.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9003_mac.c @@ -16,6 +16,9 @@ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ + +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c b/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c index b66358b92..ebc10c50f 100644 --- a/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c +++ b/src/drivers/net/ath/ath9k/ath9k_ar9003_phy.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_calib.c b/src/drivers/net/ath/ath9k/ath9k_calib.c index 6f3e07e6d..5da8a5ba0 100644 --- a/src/drivers/net/ath/ath9k/ath9k_calib.c +++ b/src/drivers/net/ath/ath9k/ath9k_calib.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include "hw.h" #include "hw-ops.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_common.c b/src/drivers/net/ath/ath9k/ath9k_common.c index ce33afbd4..474ff6a0c 100644 --- a/src/drivers/net/ath/ath9k/ath9k_common.c +++ b/src/drivers/net/ath/ath9k/ath9k_common.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + /* * Module for common driver code between ath9k and ath9k_htc */ diff --git a/src/drivers/net/ath/ath9k/ath9k_eeprom.c b/src/drivers/net/ath/ath9k/ath9k_eeprom.c index a20423790..95e677591 100644 --- a/src/drivers/net/ath/ath9k/ath9k_eeprom.c +++ b/src/drivers/net/ath/ath9k/ath9k_eeprom.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c b/src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c index a42ad3d97..a0ba897aa 100644 --- a/src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c +++ b/src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c b/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c index ee16a6f18..323a6307e 100644 --- a/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c +++ b/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_eeprom_def.c b/src/drivers/net/ath/ath9k/ath9k_eeprom_def.c index 9b144d70b..e4941188f 100644 --- a/src/drivers/net/ath/ath9k/ath9k_eeprom_def.c +++ b/src/drivers/net/ath/ath9k/ath9k_eeprom_def.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_hw.c b/src/drivers/net/ath/ath9k/ath9k_hw.c index 554e9be3c..8f123add6 100644 --- a/src/drivers/net/ath/ath9k/ath9k_hw.c +++ b/src/drivers/net/ath/ath9k/ath9k_hw.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include diff --git a/src/drivers/net/ath/ath9k/ath9k_init.c b/src/drivers/net/ath/ath9k/ath9k_init.c index 05ed3336a..2350f724e 100644 --- a/src/drivers/net/ath/ath9k/ath9k_init.c +++ b/src/drivers/net/ath/ath9k/ath9k_init.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/drivers/net/ath/ath9k/ath9k_mac.c b/src/drivers/net/ath/ath9k/ath9k_mac.c index c2f6d630a..d8ef0682f 100644 --- a/src/drivers/net/ath/ath9k/ath9k_mac.c +++ b/src/drivers/net/ath/ath9k/ath9k_mac.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_main.c b/src/drivers/net/ath/ath9k/ath9k_main.c index 0a17b9bcb..81562c87d 100644 --- a/src/drivers/net/ath/ath9k/ath9k_main.c +++ b/src/drivers/net/ath/ath9k/ath9k_main.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "ath9k.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_recv.c b/src/drivers/net/ath/ath9k/ath9k_recv.c index 0ffe9d45a..245e1390a 100644 --- a/src/drivers/net/ath/ath9k/ath9k_recv.c +++ b/src/drivers/net/ath/ath9k/ath9k_recv.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "ath9k.h" diff --git a/src/drivers/net/ath/ath9k/ath9k_xmit.c b/src/drivers/net/ath/ath9k/ath9k_xmit.c index 7f4f28ab8..354cb37a8 100644 --- a/src/drivers/net/ath/ath9k/ath9k_xmit.c +++ b/src/drivers/net/ath/ath9k/ath9k_xmit.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "ath9k.h" diff --git a/src/drivers/net/ath/ath9k/calib.h b/src/drivers/net/ath/ath9k/calib.h index b811accf0..955721d63 100644 --- a/src/drivers/net/ath/ath9k/calib.h +++ b/src/drivers/net/ath/ath9k/calib.h @@ -21,6 +21,7 @@ #define CALIB_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/common.h b/src/drivers/net/ath/ath9k/common.h index 0fe3b5be6..b3d4fa481 100644 --- a/src/drivers/net/ath/ath9k/common.h +++ b/src/drivers/net/ath/ath9k/common.h @@ -18,6 +18,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "../ath.h" diff --git a/src/drivers/net/ath/ath9k/eeprom.h b/src/drivers/net/ath/ath9k/eeprom.h index 8a48d6e5f..86521bccf 100644 --- a/src/drivers/net/ath/ath9k/eeprom.h +++ b/src/drivers/net/ath/ath9k/eeprom.h @@ -21,6 +21,7 @@ #define EEPROM_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #define AR_EEPROM_MODAL_SPURS 5 diff --git a/src/drivers/net/ath/ath9k/hw-ops.h b/src/drivers/net/ath/ath9k/hw-ops.h index 51c7b08e4..c35be7dd0 100644 --- a/src/drivers/net/ath/ath9k/hw-ops.h +++ b/src/drivers/net/ath/ath9k/hw-ops.h @@ -18,6 +18,7 @@ #define ATH9K_HW_OPS_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "hw.h" diff --git a/src/drivers/net/ath/ath9k/hw.h b/src/drivers/net/ath/ath9k/hw.h index 051074691..02e9fc346 100644 --- a/src/drivers/net/ath/ath9k/hw.h +++ b/src/drivers/net/ath/ath9k/hw.h @@ -21,6 +21,7 @@ #define HW_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include diff --git a/src/drivers/net/ath/ath9k/mac.h b/src/drivers/net/ath/ath9k/mac.h index 0c0a75948..be0429169 100644 --- a/src/drivers/net/ath/ath9k/mac.h +++ b/src/drivers/net/ath/ath9k/mac.h @@ -21,6 +21,7 @@ #define MAC_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include diff --git a/src/drivers/net/ath/ath9k/phy.h b/src/drivers/net/ath/ath9k/phy.h index 28f59ecd9..69adbb1a5 100644 --- a/src/drivers/net/ath/ath9k/phy.h +++ b/src/drivers/net/ath/ath9k/phy.h @@ -18,6 +18,7 @@ #define PHY_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #define CHANSEL_DIV 15 #define CHANSEL_2G(_freq) (((_freq) * 0x10000) / CHANSEL_DIV) diff --git a/src/drivers/net/ath/ath9k/reg.h b/src/drivers/net/ath/ath9k/reg.h index 67762b6d1..8e81f4787 100644 --- a/src/drivers/net/ath/ath9k/reg.h +++ b/src/drivers/net/ath/ath9k/reg.h @@ -18,6 +18,7 @@ #define REG_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "../reg.h" diff --git a/src/drivers/net/ath/ath_hw.c b/src/drivers/net/ath/ath_hw.c index 8e3128868..0a044ea50 100644 --- a/src/drivers/net/ath/ath_hw.c +++ b/src/drivers/net/ath/ath_hw.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include "ath.h" diff --git a/src/drivers/net/ath/ath_key.c b/src/drivers/net/ath/ath_key.c index d269a45ac..217e98ef4 100644 --- a/src/drivers/net/ath/ath_key.c +++ b/src/drivers/net/ath/ath_key.c @@ -18,6 +18,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include "ath.h" #include "reg.h" diff --git a/src/drivers/net/ath/ath_regd.c b/src/drivers/net/ath/ath_regd.c index 190b1f9f5..0dba257bc 100644 --- a/src/drivers/net/ath/ath_regd.c +++ b/src/drivers/net/ath/ath_regd.c @@ -17,6 +17,8 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +FILE_SECBOOT ( FORBIDDEN ); + #include "regd.h" #include "regd_common.h" diff --git a/src/drivers/net/ath/reg.h b/src/drivers/net/ath/reg.h index 7982f4344..c4833a515 100644 --- a/src/drivers/net/ath/reg.h +++ b/src/drivers/net/ath/reg.h @@ -21,6 +21,7 @@ #define ATH_REGISTERS_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #define AR_MIBC 0x0040 #define AR_MIBC_COW 0x00000001 diff --git a/src/drivers/net/ath/regd.h b/src/drivers/net/ath/regd.h index fd09a0c8d..a0634cd73 100644 --- a/src/drivers/net/ath/regd.h +++ b/src/drivers/net/ath/regd.h @@ -21,6 +21,7 @@ #define REGD_H FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( FORBIDDEN ); #include "ath.h" diff --git a/src/drivers/net/ath/regd_common.h b/src/drivers/net/ath/regd_common.h index ee1ac3f40..1e219c1dd 100644 --- a/src/drivers/net/ath/regd_common.h +++ b/src/drivers/net/ath/regd_common.h @@ -20,6 +20,8 @@ #ifndef REGD_COMMON_H #define REGD_COMMON_H +FILE_SECBOOT ( FORBIDDEN ); + enum EnumRd { NO_ENUMRD = 0x00, NULL1_WORLD = 0x03, diff --git a/src/drivers/net/rtl818x/rtl8180.c b/src/drivers/net/rtl818x/rtl8180.c index b3f685419..d92c8ea67 100644 --- a/src/drivers/net/rtl818x/rtl8180.c +++ b/src/drivers/net/rtl818x/rtl8180.c @@ -1,6 +1,7 @@ /* Realtek 8180 card: rtl818x driver + rtl8180 RF modules */ FILE_LICENCE(GPL2_OR_LATER); +FILE_SECBOOT(FORBIDDEN); #include #include "rtl818x.h" diff --git a/src/drivers/net/rtl818x/rtl8180_grf5101.c b/src/drivers/net/rtl818x/rtl8180_grf5101.c index 2b995030c..9e017fd4f 100644 --- a/src/drivers/net/rtl818x/rtl8180_grf5101.c +++ b/src/drivers/net/rtl818x/rtl8180_grf5101.c @@ -27,6 +27,7 @@ #include "rtl818x.h" FILE_LICENCE(GPL2_ONLY); +FILE_SECBOOT(FORBIDDEN); #define GRF5101_ANTENNA 0xA3 diff --git a/src/drivers/net/rtl818x/rtl8180_max2820.c b/src/drivers/net/rtl818x/rtl8180_max2820.c index ab380fcc7..d3cb15454 100644 --- a/src/drivers/net/rtl818x/rtl8180_max2820.c +++ b/src/drivers/net/rtl818x/rtl8180_max2820.c @@ -27,6 +27,7 @@ #include "rtl818x.h" FILE_LICENCE(GPL2_ONLY); +FILE_SECBOOT(FORBIDDEN); #define MAXIM_ANTENNA 0xb3 diff --git a/src/drivers/net/rtl818x/rtl8180_sa2400.c b/src/drivers/net/rtl818x/rtl8180_sa2400.c index 9bd62bed8..d86e52aac 100644 --- a/src/drivers/net/rtl818x/rtl8180_sa2400.c +++ b/src/drivers/net/rtl818x/rtl8180_sa2400.c @@ -27,6 +27,7 @@ #include "rtl818x.h" FILE_LICENCE(GPL2_ONLY); +FILE_SECBOOT(FORBIDDEN); #define SA2400_ANTENNA 0x91 #define SA2400_DIG_ANAPARAM_PWR1_ON 0x8 diff --git a/src/drivers/net/rtl818x/rtl8185.c b/src/drivers/net/rtl818x/rtl8185.c index 234978cea..beaf62566 100644 --- a/src/drivers/net/rtl818x/rtl8185.c +++ b/src/drivers/net/rtl818x/rtl8185.c @@ -1,6 +1,7 @@ /* Realtek 8185 card: rtl818x driver + rtl8185_rtl8225 RF module */ FILE_LICENCE(GPL2_OR_LATER); +FILE_SECBOOT(FORBIDDEN); #include #include "rtl818x.h" diff --git a/src/drivers/net/rtl818x/rtl8185_rtl8225.c b/src/drivers/net/rtl818x/rtl8185_rtl8225.c index 31a740e64..f810215ca 100644 --- a/src/drivers/net/rtl818x/rtl8185_rtl8225.c +++ b/src/drivers/net/rtl818x/rtl8185_rtl8225.c @@ -23,6 +23,7 @@ #include "rtl818x.h" FILE_LICENCE(GPL2_ONLY); +FILE_SECBOOT(FORBIDDEN); #define RTL8225_ANAPARAM_ON 0xa0000b59 #define RTL8225_ANAPARAM2_ON 0x860dec11 diff --git a/src/drivers/net/rtl818x/rtl818x.c b/src/drivers/net/rtl818x/rtl818x.c index 3bae8a797..81592a7db 100644 --- a/src/drivers/net/rtl818x/rtl818x.c +++ b/src/drivers/net/rtl818x/rtl818x.c @@ -18,6 +18,7 @@ */ FILE_LICENCE(GPL2_ONLY); +FILE_SECBOOT(FORBIDDEN); #include #include diff --git a/src/drivers/net/rtl818x/rtl818x.h b/src/drivers/net/rtl818x/rtl818x.h index ae4b8a96f..f8d19604e 100644 --- a/src/drivers/net/rtl818x/rtl818x.h +++ b/src/drivers/net/rtl818x/rtl818x.h @@ -22,6 +22,7 @@ #include FILE_LICENCE(GPL2_ONLY); +FILE_SECBOOT(FORBIDDEN); struct rtl818x_csr { u8 MAC[6]; diff --git a/src/net/80211/net80211.c b/src/net/80211/net80211.c index 482000102..4391b4296 100644 --- a/src/net/80211/net80211.c +++ b/src/net/80211/net80211.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/rc80211.c b/src/net/80211/rc80211.c index eea3bc908..d416867fa 100644 --- a/src/net/80211/rc80211.c +++ b/src/net/80211/rc80211.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/sec80211.c b/src/net/80211/sec80211.c index d1bc75e90..500dec9f5 100644 --- a/src/net/80211/sec80211.c +++ b/src/net/80211/sec80211.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/wep.c b/src/net/80211/wep.c index e22ac8998..053cf1417 100644 --- a/src/net/80211/wep.c +++ b/src/net/80211/wep.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/wpa.c b/src/net/80211/wpa.c index 17c11b8ed..33358221b 100644 --- a/src/net/80211/wpa.c +++ b/src/net/80211/wpa.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/wpa_ccmp.c b/src/net/80211/wpa_ccmp.c index 0abd217e7..f4906d473 100644 --- a/src/net/80211/wpa_ccmp.c +++ b/src/net/80211/wpa_ccmp.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/wpa_psk.c b/src/net/80211/wpa_psk.c index 71190b139..d86204026 100644 --- a/src/net/80211/wpa_psk.c +++ b/src/net/80211/wpa_psk.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/80211/wpa_tkip.c b/src/net/80211/wpa_tkip.c index 3bd651512..39a6391a8 100644 --- a/src/net/80211/wpa_tkip.c +++ b/src/net/80211/wpa_tkip.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( FORBIDDEN ); #include #include diff --git a/src/net/oncrpc/mount.c b/src/net/oncrpc/mount.c index 8838a147c..32279cc25 100644 --- a/src/net/oncrpc/mount.c +++ b/src/net/oncrpc/mount.c @@ -17,6 +17,8 @@ * 02110-1301, USA. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include #include diff --git a/src/net/oncrpc/nfs.c b/src/net/oncrpc/nfs.c index b6118f91a..3a3a894f0 100644 --- a/src/net/oncrpc/nfs.c +++ b/src/net/oncrpc/nfs.c @@ -17,6 +17,8 @@ * 02110-1301, USA. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include #include diff --git a/src/net/oncrpc/nfs_open.c b/src/net/oncrpc/nfs_open.c index c0dceb82f..d83991255 100644 --- a/src/net/oncrpc/nfs_open.c +++ b/src/net/oncrpc/nfs_open.c @@ -17,6 +17,8 @@ * 02110-1301, USA. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include #include diff --git a/src/net/oncrpc/nfs_uri.c b/src/net/oncrpc/nfs_uri.c index c4c3f21e9..b97fb91f9 100644 --- a/src/net/oncrpc/nfs_uri.c +++ b/src/net/oncrpc/nfs_uri.c @@ -17,6 +17,8 @@ * 02110-1301, USA. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include #include diff --git a/src/net/oncrpc/oncrpc_iob.c b/src/net/oncrpc/oncrpc_iob.c index be51805e7..04bb20edd 100644 --- a/src/net/oncrpc/oncrpc_iob.c +++ b/src/net/oncrpc/oncrpc_iob.c @@ -17,6 +17,8 @@ * 02110-1301, USA. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include #include diff --git a/src/net/oncrpc/portmap.c b/src/net/oncrpc/portmap.c index df62221dc..be11c42da 100644 --- a/src/net/oncrpc/portmap.c +++ b/src/net/oncrpc/portmap.c @@ -17,6 +17,8 @@ * 02110-1301, USA. */ +FILE_SECBOOT ( FORBIDDEN ); + #include #include #include -- cgit v1.2.3-55-g7522 From 6cccb3bdc00359068c07125258d71ce24db5118a Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 14 Jan 2026 13:25:34 +0000 Subject: [build] Mark core files as permitted for UEFI Secure Boot Mark all files used in a standard build of bin-x86_64-efi/snponly.efi as permitted for UEFI Secure Boot. These files represent the core functionality of iPXE that is guaranteed to have been included in every binary that was previously subject to a security review and signed by Microsoft. It is therefore legitimate to assume that at least these files have already been reviewed to the required standard multiple times. Signed-off-by: Michael Brown --- src/arch/x86/core/cpuid.c | 1 + src/arch/x86/core/x86_string.c | 1 + src/arch/x86/core/x86_tcpip.c | 1 + src/arch/x86/hci/commands/cpuid_cmd.c | 1 + src/arch/x86/include/bits/acpi.h | 1 + src/arch/x86/include/bits/endian.h | 1 + src/arch/x86/include/bits/errfile.h | 1 + src/arch/x86/include/bits/io.h | 1 + src/arch/x86/include/bits/iomap.h | 1 + src/arch/x86/include/bits/memmap.h | 1 + src/arch/x86/include/bits/nap.h | 1 + src/arch/x86/include/bits/pci_io.h | 1 + src/arch/x86/include/bits/reboot.h | 1 + src/arch/x86/include/bits/sanboot.h | 1 + src/arch/x86/include/bits/smbios.h | 1 + src/arch/x86/include/bits/string.h | 1 + src/arch/x86/include/bits/tcpip.h | 1 + src/arch/x86/include/bits/time.h | 1 + src/arch/x86/include/ipxe/bios_nap.h | 1 + src/arch/x86/include/ipxe/bios_reboot.h | 1 + src/arch/x86/include/ipxe/bios_sanboot.h | 1 + src/arch/x86/include/ipxe/bios_smbios.h | 1 + src/arch/x86/include/ipxe/cpuid.h | 1 + src/arch/x86/include/ipxe/int15.h | 1 + src/arch/x86/include/ipxe/iomap_pages.h | 1 + src/arch/x86/include/ipxe/pcibios.h | 1 + src/arch/x86/include/ipxe/pcidirect.h | 1 + src/arch/x86/include/ipxe/rsdp.h | 1 + src/arch/x86/include/ipxe/rtc_time.h | 1 + src/arch/x86/include/ipxe/x86_io.h | 1 + src/arch/x86_64/include/bits/byteswap.h | 1 + src/arch/x86_64/include/bits/compiler.h | 1 + src/arch/x86_64/include/bits/profile.h | 1 + src/arch/x86_64/include/bits/stdint.h | 1 + src/arch/x86_64/include/bits/strings.h | 1 + src/arch/x86_64/include/ipxe/efi/dhcparch.h | 1 + src/arch/x86_64/include/limits.h | 1 + src/config/branding.h | 1 + src/config/colour.h | 1 + src/config/config.c | 1 + src/config/config_eap.c | 1 + src/config/config_efi.c | 1 + src/config/config_ethernet.c | 1 + src/config/config_http.c | 1 + src/config/config_pci.c | 1 + src/config/config_route.c | 1 + src/config/config_timer.c | 1 + src/config/console.h | 1 + src/config/defaults.h | 1 + src/config/defaults/efi.h | 1 + src/config/dhcp.h | 1 + src/config/fault.h | 1 + src/config/general.h | 1 + src/config/ioapi.h | 1 + src/config/named.h | 1 + src/config/nap.h | 1 + src/config/reboot.h | 1 + src/config/sanboot.h | 1 + src/config/settings.h | 1 + src/config/sideband.h | 1 + src/config/time.h | 1 + src/config/timer.h | 1 + src/config/umalloc.h | 1 + src/core/acpi.c | 1 + src/core/ansicol.c | 1 + src/core/ansiesc.c | 1 + src/core/asprintf.c | 1 + src/core/base16.c | 1 + src/core/base64.c | 1 + src/core/basename.c | 1 + src/core/bitmap.c | 1 + src/core/blockdev.c | 1 + src/core/blocktrans.c | 1 + src/core/cachedhcp.c | 1 + src/core/console.c | 1 + src/core/cpio.c | 1 + src/core/ctype.c | 1 + src/core/cwuri.c | 1 + src/core/debug.c | 1 + src/core/device.c | 1 + src/core/dma.c | 1 + src/core/downloader.c | 1 + src/core/dynui.c | 1 + src/core/edd.c | 1 + src/core/errno.c | 1 + src/core/exec.c | 1 + src/core/getkey.c | 1 + src/core/getopt.c | 1 + src/core/image.c | 1 + src/core/init.c | 1 + src/core/interface.c | 1 + src/core/iobuf.c | 1 + src/core/job.c | 1 + src/core/keymap.c | 1 + src/core/linebuf.c | 1 + src/core/list.c | 1 + src/core/main.c | 1 + src/core/malloc.c | 1 + src/core/monojob.c | 1 + src/core/nvo.c | 1 + src/core/open.c | 1 + src/core/params.c | 1 + src/core/parseopt.c | 1 + src/core/pending.c | 1 + src/core/pool.c | 1 + src/core/process.c | 1 + src/core/quiesce.c | 1 + src/core/random.c | 1 + src/core/refcnt.c | 1 + src/core/resolv.c | 1 + src/core/sanboot.c | 1 + src/core/settings.c | 1 + src/core/string.c | 1 + src/core/time.c | 1 + src/core/timer.c | 1 + src/core/uri.c | 1 + src/core/utf8.c | 1 + src/core/uuid.c | 1 + src/core/version.c | 1 + src/core/vsprintf.c | 1 + src/core/wchar.c | 1 + src/core/xfer.c | 1 + src/core/xferbuf.c | 1 + src/crypto/chap.c | 1 + src/crypto/crc32.c | 1 + src/crypto/md5.c | 1 + src/drivers/block/ata.c | 1 + src/drivers/block/ibft.c | 1 + src/drivers/block/scsi.c | 1 + src/drivers/bus/pci.c | 1 + src/drivers/bus/pci_settings.c | 1 + src/drivers/net/efi/mnpnet.c | 1 + src/drivers/net/efi/nii.c | 1 + src/drivers/net/efi/nii.h | 1 + src/drivers/net/efi/snpnet.c | 1 + src/drivers/net/efi/snpnet.h | 1 + src/drivers/net/efi/snponly.c | 1 + src/drivers/nvs/nvs.c | 1 + src/hci/commands/autoboot_cmd.c | 1 + src/hci/commands/config_cmd.c | 1 + src/hci/commands/dhcp_cmd.c | 1 + src/hci/commands/dynui_cmd.c | 1 + src/hci/commands/ifmgmt_cmd.c | 1 + src/hci/commands/image_cmd.c | 1 + src/hci/commands/login_cmd.c | 1 + src/hci/commands/nvo_cmd.c | 1 + src/hci/commands/reboot_cmd.c | 1 + src/hci/commands/route_cmd.c | 1 + src/hci/commands/sanboot_cmd.c | 1 + src/hci/commands/shim_cmd.c | 1 + src/hci/commands/sync_cmd.c | 1 + src/hci/editstring.c | 1 + src/hci/jumpscroll.c | 1 + src/hci/mucurses/ansi_screen.c | 1 + src/hci/mucurses/clear.c | 1 + src/hci/mucurses/cursor.h | 1 + src/hci/mucurses/mucurses.c | 1 + src/hci/mucurses/mucurses.h | 1 + src/hci/mucurses/print.c | 1 + src/hci/mucurses/widgets/editbox.c | 1 + src/hci/mucurses/winattrs.c | 1 + src/hci/mucurses/wininit.c | 1 + src/hci/readline.c | 1 + src/hci/shell.c | 1 + src/hci/strerror.c | 1 + src/hci/tui/form_ui.c | 1 + src/hci/tui/login_ui.c | 1 + src/hci/tui/menu_ui.c | 1 + src/hci/tui/message.c | 1 + src/hci/tui/settings_ui.c | 1 + src/image/efi_image.c | 1 + src/image/embedded.c | 1 + src/image/script.c | 1 + src/include/assert.h | 1 + src/include/bits/dma.h | 1 + src/include/bits/uaccess.h | 1 + src/include/bits/umalloc.h | 1 + src/include/bits/virt_offset.h | 1 + src/include/byteswap.h | 1 + src/include/ctype.h | 1 + src/include/curses.h | 1 + src/include/endian.h | 1 + src/include/errno.h | 1 + src/include/getopt.h | 1 + src/include/hci/ifmgmt_cmd.h | 1 + src/include/ipxe/acpi.h | 1 + src/include/ipxe/ansicol.h | 1 + src/include/ipxe/ansiesc.h | 1 + src/include/ipxe/aoe.h | 1 + src/include/ipxe/api.h | 1 + src/include/ipxe/arp.h | 1 + src/include/ipxe/asn1.h | 1 + src/include/ipxe/ata.h | 1 + src/include/ipxe/base16.h | 1 + src/include/ipxe/base64.h | 1 + src/include/ipxe/bitmap.h | 1 + src/include/ipxe/blockdev.h | 1 + src/include/ipxe/blocktrans.h | 1 + src/include/ipxe/cachedhcp.h | 1 + src/include/ipxe/chap.h | 1 + src/include/ipxe/command.h | 1 + src/include/ipxe/console.h | 1 + src/include/ipxe/cpio.h | 1 + src/include/ipxe/crc32.h | 1 + src/include/ipxe/crypto.h | 1 + src/include/ipxe/device.h | 1 + src/include/ipxe/dhcp.h | 1 + src/include/ipxe/dhcparch.h | 1 + src/include/ipxe/dhcpopts.h | 1 + src/include/ipxe/dhcppkt.h | 1 + src/include/ipxe/dhcpv6.h | 1 + src/include/ipxe/dma.h | 1 + src/include/ipxe/dns.h | 1 + src/include/ipxe/downloader.h | 1 + src/include/ipxe/dummy_sanboot.h | 1 + src/include/ipxe/dynui.h | 1 + src/include/ipxe/eap.h | 1 + src/include/ipxe/eapol.h | 1 + src/include/ipxe/ecam_io.h | 1 + src/include/ipxe/edd.h | 1 + src/include/ipxe/editbox.h | 1 + src/include/ipxe/editstring.h | 1 + src/include/ipxe/efi/ProcessorBind.h | 1 + src/include/ipxe/efi/Protocol/AppleNetBoot.h | 1 + src/include/ipxe/efi/Protocol/ShimLock.h | 1 + src/include/ipxe/efi/efi.h | 1 + src/include/ipxe/efi/efi_acpi.h | 1 + src/include/ipxe/efi/efi_autoboot.h | 1 + src/include/ipxe/efi/efi_autoexec.h | 1 + src/include/ipxe/efi/efi_block.h | 1 + src/include/ipxe/efi/efi_cachedhcp.h | 1 + src/include/ipxe/efi/efi_cmdline.h | 1 + src/include/ipxe/efi/efi_download.h | 1 + src/include/ipxe/efi/efi_driver.h | 1 + src/include/ipxe/efi/efi_fdt.h | 1 + src/include/ipxe/efi/efi_file.h | 1 + src/include/ipxe/efi/efi_hii.h | 1 + src/include/ipxe/efi/efi_image.h | 1 + src/include/ipxe/efi/efi_nap.h | 1 + src/include/ipxe/efi/efi_null.h | 1 + src/include/ipxe/efi/efi_path.h | 1 + src/include/ipxe/efi/efi_pci.h | 1 + src/include/ipxe/efi/efi_pci_api.h | 1 + src/include/ipxe/efi/efi_pxe.h | 1 + src/include/ipxe/efi/efi_reboot.h | 1 + src/include/ipxe/efi/efi_service.h | 1 + src/include/ipxe/efi/efi_shim.h | 1 + src/include/ipxe/efi/efi_smbios.h | 1 + src/include/ipxe/efi/efi_snp.h | 1 + src/include/ipxe/efi/efi_strings.h | 1 + src/include/ipxe/efi/efi_table.h | 1 + src/include/ipxe/efi/efi_time.h | 1 + src/include/ipxe/efi/efi_umalloc.h | 1 + src/include/ipxe/efi/efi_utils.h | 1 + src/include/ipxe/efi/efi_veto.h | 1 + src/include/ipxe/efi/efi_watchdog.h | 1 + src/include/ipxe/efi/efi_wrap.h | 1 + src/include/ipxe/efi/mnpnet.h | 1 + src/include/ipxe/errfile.h | 1 + src/include/ipxe/errno/efi.h | 1 + src/include/ipxe/errortab.h | 1 + src/include/ipxe/eth_slow.h | 1 + src/include/ipxe/ethernet.h | 1 + src/include/ipxe/fakedhcp.h | 1 + src/include/ipxe/fault.h | 1 + src/include/ipxe/fc.h | 1 + src/include/ipxe/fcels.h | 1 + src/include/ipxe/fcp.h | 1 + src/include/ipxe/fdtmem.h | 1 + src/include/ipxe/features.h | 1 + src/include/ipxe/fragment.h | 1 + src/include/ipxe/http.h | 1 + src/include/ipxe/ib_mad.h | 1 + src/include/ipxe/ib_packet.h | 1 + src/include/ipxe/ib_srp.h | 1 + src/include/ipxe/ibft.h | 1 + src/include/ipxe/icmp.h | 1 + src/include/ipxe/icmpv6.h | 1 + src/include/ipxe/if_arp.h | 1 + src/include/ipxe/if_ether.h | 1 + src/include/ipxe/image.h | 1 + src/include/ipxe/in.h | 1 + src/include/ipxe/infiniband.h | 1 + src/include/ipxe/init.h | 1 + src/include/ipxe/initrd.h | 1 + src/include/ipxe/interface.h | 1 + src/include/ipxe/io.h | 1 + src/include/ipxe/iobuf.h | 1 + src/include/ipxe/iomap.h | 1 + src/include/ipxe/iomap_virt.h | 1 + src/include/ipxe/ip.h | 1 + src/include/ipxe/ipstat.h | 1 + src/include/ipxe/ipv6.h | 1 + src/include/ipxe/iscsi.h | 1 + src/include/ipxe/iso9660.h | 1 + src/include/ipxe/job.h | 1 + src/include/ipxe/jumpscroll.h | 1 + src/include/ipxe/keymap.h | 1 + src/include/ipxe/keys.h | 1 + src/include/ipxe/linebuf.h | 1 + src/include/ipxe/linux/linux_acpi.h | 1 + src/include/ipxe/linux/linux_nap.h | 1 + src/include/ipxe/linux/linux_pci.h | 1 + src/include/ipxe/linux/linux_smbios.h | 1 + src/include/ipxe/linux/linux_time.h | 1 + src/include/ipxe/linux/linux_uaccess.h | 1 + src/include/ipxe/linux/linux_umalloc.h | 1 + src/include/ipxe/list.h | 1 + src/include/ipxe/lldp.h | 1 + src/include/ipxe/login_ui.h | 1 + src/include/ipxe/malloc.h | 1 + src/include/ipxe/md5.h | 1 + src/include/ipxe/memmap.h | 1 + src/include/ipxe/message.h | 1 + src/include/ipxe/monojob.h | 1 + src/include/ipxe/nap.h | 1 + src/include/ipxe/ndp.h | 1 + src/include/ipxe/neighbour.h | 1 + src/include/ipxe/netdevice.h | 1 + src/include/ipxe/ntlm.h | 1 + src/include/ipxe/null_acpi.h | 1 + src/include/ipxe/null_memmap.h | 1 + src/include/ipxe/null_nap.h | 1 + src/include/ipxe/null_pci.h | 1 + src/include/ipxe/null_reboot.h | 1 + src/include/ipxe/null_sanboot.h | 1 + src/include/ipxe/null_smbios.h | 1 + src/include/ipxe/null_time.h | 1 + src/include/ipxe/nvo.h | 1 + src/include/ipxe/nvs.h | 1 + src/include/ipxe/open.h | 1 + src/include/ipxe/params.h | 1 + src/include/ipxe/parseopt.h | 1 + src/include/ipxe/pci.h | 1 + src/include/ipxe/pci_io.h | 1 + src/include/ipxe/pcicloud.h | 1 + src/include/ipxe/pending.h | 1 + src/include/ipxe/ping.h | 1 + src/include/ipxe/pool.h | 1 + src/include/ipxe/process.h | 1 + src/include/ipxe/profile.h | 1 + src/include/ipxe/quiesce.h | 1 + src/include/ipxe/reboot.h | 1 + src/include/ipxe/refcnt.h | 1 + src/include/ipxe/resolv.h | 1 + src/include/ipxe/retry.h | 1 + src/include/ipxe/rotate.h | 1 + src/include/ipxe/sanboot.h | 1 + src/include/ipxe/sbat.h | 1 + src/include/ipxe/script.h | 1 + src/include/ipxe/scsi.h | 1 + src/include/ipxe/settings.h | 1 + src/include/ipxe/settings_ui.h | 1 + src/include/ipxe/shell.h | 1 + src/include/ipxe/smbios.h | 1 + src/include/ipxe/socket.h | 1 + src/include/ipxe/srp.h | 1 + src/include/ipxe/stp.h | 1 + src/include/ipxe/string.h | 1 + src/include/ipxe/tables.h | 1 + src/include/ipxe/tcp.h | 1 + src/include/ipxe/tcpip.h | 1 + src/include/ipxe/tftp.h | 1 + src/include/ipxe/time.h | 1 + src/include/ipxe/timer.h | 1 + src/include/ipxe/uaccess.h | 1 + src/include/ipxe/udp.h | 1 + src/include/ipxe/uheap.h | 1 + src/include/ipxe/umalloc.h | 1 + src/include/ipxe/uri.h | 1 + src/include/ipxe/usb.h | 1 + src/include/ipxe/utf8.h | 1 + src/include/ipxe/uuid.h | 1 + src/include/ipxe/version.h | 1 + src/include/ipxe/virt_offset.h | 1 + src/include/ipxe/vlan.h | 1 + src/include/ipxe/vsprintf.h | 1 + src/include/ipxe/widget.h | 1 + src/include/ipxe/xfer.h | 1 + src/include/ipxe/xferbuf.h | 1 + src/include/libgen.h | 1 + src/include/readline/readline.h | 1 + src/include/stdarg.h | 1 + src/include/stdbool.h | 1 + src/include/stddef.h | 1 + src/include/stdint.h | 1 + src/include/stdio.h | 1 + src/include/stdlib.h | 1 + src/include/string.h | 1 + src/include/strings.h | 1 + src/include/sys/time.h | 1 + src/include/syslog.h | 1 + src/include/time.h | 1 + src/include/unistd.h | 1 + src/include/usr/autoboot.h | 1 + src/include/usr/dhcpmgmt.h | 1 + src/include/usr/ifmgmt.h | 1 + src/include/usr/imgmgmt.h | 1 + src/include/usr/prompt.h | 1 + src/include/usr/route.h | 1 + src/include/usr/shimmgmt.h | 1 + src/include/usr/sync.h | 1 + src/include/valgrind/memcheck.h | 1 + src/include/valgrind/valgrind.h | 1 + src/include/wchar.h | 1 + src/interface/efi/efi_acpi.c | 1 + src/interface/efi/efi_autoboot.c | 1 + src/interface/efi/efi_autoexec.c | 1 + src/interface/efi/efi_block.c | 1 + src/interface/efi/efi_cachedhcp.c | 1 + src/interface/efi/efi_cmdline.c | 1 + src/interface/efi/efi_connect.c | 1 + src/interface/efi/efi_console.c | 1 + src/interface/efi/efi_download.c | 1 + src/interface/efi/efi_driver.c | 1 + src/interface/efi/efi_file.c | 1 + src/interface/efi/efi_guid.c | 1 + src/interface/efi/efi_hii.c | 1 + src/interface/efi/efi_init.c | 1 + src/interface/efi/efi_local.c | 1 + src/interface/efi/efi_nap.c | 1 + src/interface/efi/efi_null.c | 1 + src/interface/efi/efi_open.c | 1 + src/interface/efi/efi_path.c | 1 + src/interface/efi/efi_pci.c | 1 + src/interface/efi/efi_pxe.c | 1 + src/interface/efi/efi_reboot.c | 1 + src/interface/efi/efi_service.c | 1 + src/interface/efi/efi_settings.c | 1 + src/interface/efi/efi_shim.c | 2 ++ src/interface/efi/efi_smbios.c | 1 + src/interface/efi/efi_snp.c | 1 + src/interface/efi/efi_snp_hii.c | 1 + src/interface/efi/efi_strings.c | 1 + src/interface/efi/efi_table.c | 1 + src/interface/efi/efi_time.c | 1 + src/interface/efi/efi_timer.c | 1 + src/interface/efi/efi_umalloc.c | 1 + src/interface/efi/efi_utils.c | 1 + src/interface/efi/efi_veto.c | 1 + src/interface/efi/efi_watchdog.c | 1 + src/interface/efi/efi_wrap.c | 1 + src/interface/efi/efiprefix.c | 1 + src/interface/smbios/smbios.c | 1 + src/interface/smbios/smbios_settings.c | 1 + src/net/aoe.c | 1 + src/net/arp.c | 1 + src/net/dhcpopts.c | 1 + src/net/dhcppkt.c | 1 + src/net/eap.c | 1 + src/net/eap_md5.c | 1 + src/net/eapol.c | 1 + src/net/eth_slow.c | 1 + src/net/ethernet.c | 1 + src/net/fakedhcp.c | 1 + src/net/fragment.c | 1 + src/net/icmp.c | 1 + src/net/icmpv4.c | 1 + src/net/icmpv6.c | 1 + src/net/iobpad.c | 1 + src/net/ipv4.c | 1 + src/net/ipv6.c | 1 + src/net/lldp.c | 1 + src/net/ndp.c | 1 + src/net/neighbour.c | 1 + src/net/netdev_settings.c | 1 + src/net/netdevice.c | 1 + src/net/nullnet.c | 1 + src/net/retry.c | 1 + src/net/socket.c | 1 + src/net/stp.c | 1 + src/net/tcp.c | 1 + src/net/tcp/http.c | 1 + src/net/tcp/httpauth.c | 1 + src/net/tcp/httpbasic.c | 1 + src/net/tcp/httpblock.c | 1 + src/net/tcp/httpconn.c | 1 + src/net/tcp/httpcore.c | 1 + src/net/tcp/httpdigest.c | 1 + src/net/tcp/iscsi.c | 1 + src/net/tcpip.c | 1 + src/net/udp.c | 1 + src/net/udp/dhcp.c | 1 + src/net/udp/dhcpv6.c | 1 + src/net/udp/dns.c | 1 + src/net/udp/tftp.c | 1 + src/net/vlan.c | 1 + src/usr/autoboot.c | 1 + src/usr/dhcpmgmt.c | 1 + src/usr/ifmgmt.c | 1 + src/usr/imgmgmt.c | 1 + src/usr/prompt.c | 1 + src/usr/route.c | 1 + src/usr/route_ipv4.c | 1 + src/usr/route_ipv6.c | 1 + src/usr/shimmgmt.c | 1 + src/usr/sync.c | 1 + 497 files changed, 498 insertions(+) (limited to 'src/net') diff --git a/src/arch/x86/core/cpuid.c b/src/arch/x86/core/cpuid.c index b7d9fb6c6..0461b846e 100644 --- a/src/arch/x86/core/cpuid.c +++ b/src/arch/x86/core/cpuid.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/core/x86_string.c b/src/arch/x86/core/x86_string.c index 1a1e79dac..923552f66 100644 --- a/src/arch/x86/core/x86_string.c +++ b/src/arch/x86/core/x86_string.c @@ -28,6 +28,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/core/x86_tcpip.c b/src/arch/x86/core/x86_tcpip.c index ed323d5d0..b3bfe2546 100644 --- a/src/arch/x86/core/x86_tcpip.c +++ b/src/arch/x86/core/x86_tcpip.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/arch/x86/hci/commands/cpuid_cmd.c b/src/arch/x86/hci/commands/cpuid_cmd.c index b1978d5f2..f4d7305e8 100644 --- a/src/arch/x86/hci/commands/cpuid_cmd.c +++ b/src/arch/x86/hci/commands/cpuid_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/include/bits/acpi.h b/src/arch/x86/include/bits/acpi.h index a6ff90804..287bdafeb 100644 --- a/src/arch/x86/include/bits/acpi.h +++ b/src/arch/x86/include/bits/acpi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/endian.h b/src/arch/x86/include/bits/endian.h index 85718cfdd..72279117d 100644 --- a/src/arch/x86/include/bits/endian.h +++ b/src/arch/x86/include/bits/endian.h @@ -2,6 +2,7 @@ #define _BITS_ENDIAN_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #define __BYTE_ORDER __LITTLE_ENDIAN diff --git a/src/arch/x86/include/bits/errfile.h b/src/arch/x86/include/bits/errfile.h index 4fa9acef6..e7aec6f39 100644 --- a/src/arch/x86/include/bits/errfile.h +++ b/src/arch/x86/include/bits/errfile.h @@ -2,6 +2,7 @@ #define _BITS_ERRFILE_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @addtogroup errfile Error file identifiers diff --git a/src/arch/x86/include/bits/io.h b/src/arch/x86/include/bits/io.h index 95673ad8d..cde0b6829 100644 --- a/src/arch/x86/include/bits/io.h +++ b/src/arch/x86/include/bits/io.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Page shift */ #define PAGE_SHIFT 12 diff --git a/src/arch/x86/include/bits/iomap.h b/src/arch/x86/include/bits/iomap.h index d6fff257e..d524bd805 100644 --- a/src/arch/x86/include/bits/iomap.h +++ b/src/arch/x86/include/bits/iomap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/memmap.h b/src/arch/x86/include/bits/memmap.h index 8f821563c..e68550fb8 100644 --- a/src/arch/x86/include/bits/memmap.h +++ b/src/arch/x86/include/bits/memmap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/nap.h b/src/arch/x86/include/bits/nap.h index b7dea736d..52c8d81ba 100644 --- a/src/arch/x86/include/bits/nap.h +++ b/src/arch/x86/include/bits/nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/pci_io.h b/src/arch/x86/include/bits/pci_io.h index b41e562ee..b6c01e5c4 100644 --- a/src/arch/x86/include/bits/pci_io.h +++ b/src/arch/x86/include/bits/pci_io.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/include/bits/reboot.h b/src/arch/x86/include/bits/reboot.h index e702dd3d0..8d8d0b40e 100644 --- a/src/arch/x86/include/bits/reboot.h +++ b/src/arch/x86/include/bits/reboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/sanboot.h b/src/arch/x86/include/bits/sanboot.h index 1b9924e64..ff7b88d14 100644 --- a/src/arch/x86/include/bits/sanboot.h +++ b/src/arch/x86/include/bits/sanboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/smbios.h b/src/arch/x86/include/bits/smbios.h index 9977c87ac..2be98d887 100644 --- a/src/arch/x86/include/bits/smbios.h +++ b/src/arch/x86/include/bits/smbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/string.h b/src/arch/x86/include/bits/string.h index c26fe30d5..8b2b3070b 100644 --- a/src/arch/x86/include/bits/string.h +++ b/src/arch/x86/include/bits/string.h @@ -25,6 +25,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/arch/x86/include/bits/tcpip.h b/src/arch/x86/include/bits/tcpip.h index 0ac55b1a0..52d032427 100644 --- a/src/arch/x86/include/bits/tcpip.h +++ b/src/arch/x86/include/bits/tcpip.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern uint16_t tcpip_continue_chksum ( uint16_t partial, const void *data, size_t len ); diff --git a/src/arch/x86/include/bits/time.h b/src/arch/x86/include/bits/time.h index 556d96f64..a4aa8cc6e 100644 --- a/src/arch/x86/include/bits/time.h +++ b/src/arch/x86/include/bits/time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/ipxe/bios_nap.h b/src/arch/x86/include/ipxe/bios_nap.h index c9b82c1e5..7d94b3c4a 100644 --- a/src/arch/x86/include/ipxe/bios_nap.h +++ b/src/arch/x86/include/ipxe/bios_nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef NAP_PCBIOS #define NAP_PREFIX_pcbios diff --git a/src/arch/x86/include/ipxe/bios_reboot.h b/src/arch/x86/include/ipxe/bios_reboot.h index 3f6df9073..bd1bb42cc 100644 --- a/src/arch/x86/include/ipxe/bios_reboot.h +++ b/src/arch/x86/include/ipxe/bios_reboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef REBOOT_PCBIOS #define REBOOT_PREFIX_pcbios diff --git a/src/arch/x86/include/ipxe/bios_sanboot.h b/src/arch/x86/include/ipxe/bios_sanboot.h index 85d698039..d28339e4e 100644 --- a/src/arch/x86/include/ipxe/bios_sanboot.h +++ b/src/arch/x86/include/ipxe/bios_sanboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SANBOOT_PCBIOS #define SANBOOT_PREFIX_pcbios diff --git a/src/arch/x86/include/ipxe/bios_smbios.h b/src/arch/x86/include/ipxe/bios_smbios.h index 9f7f9c8ff..1815e3617 100644 --- a/src/arch/x86/include/ipxe/bios_smbios.h +++ b/src/arch/x86/include/ipxe/bios_smbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SMBIOS_PCBIOS #define SMBIOS_PREFIX_pcbios diff --git a/src/arch/x86/include/ipxe/cpuid.h b/src/arch/x86/include/ipxe/cpuid.h index 99b91c5c8..1851a859b 100644 --- a/src/arch/x86/include/ipxe/cpuid.h +++ b/src/arch/x86/include/ipxe/cpuid.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/ipxe/int15.h b/src/arch/x86/include/ipxe/int15.h index e8aa9e2f5..590c0e9a7 100644 --- a/src/arch/x86/include/ipxe/int15.h +++ b/src/arch/x86/include/ipxe/int15.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef MEMMAP_INT15 #define MEMMAP_PREFIX_int15 diff --git a/src/arch/x86/include/ipxe/iomap_pages.h b/src/arch/x86/include/ipxe/iomap_pages.h index 18e0a3002..e74dabd90 100644 --- a/src/arch/x86/include/ipxe/iomap_pages.h +++ b/src/arch/x86/include/ipxe/iomap_pages.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef IOMAP_PAGES #define IOMAP_PREFIX_pages diff --git a/src/arch/x86/include/ipxe/pcibios.h b/src/arch/x86/include/ipxe/pcibios.h index b62b470f0..2fd03198e 100644 --- a/src/arch/x86/include/ipxe/pcibios.h +++ b/src/arch/x86/include/ipxe/pcibios.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef PCIAPI_PCBIOS #define PCIAPI_PREFIX_pcbios diff --git a/src/arch/x86/include/ipxe/pcidirect.h b/src/arch/x86/include/ipxe/pcidirect.h index 1515b20d4..5863b4d16 100644 --- a/src/arch/x86/include/ipxe/pcidirect.h +++ b/src/arch/x86/include/ipxe/pcidirect.h @@ -2,6 +2,7 @@ #define _PCIDIRECT_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/include/ipxe/rsdp.h b/src/arch/x86/include/ipxe/rsdp.h index daaa43077..f371d9a20 100644 --- a/src/arch/x86/include/ipxe/rsdp.h +++ b/src/arch/x86/include/ipxe/rsdp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef ACPI_RSDP #define ACPI_PREFIX_rsdp diff --git a/src/arch/x86/include/ipxe/rtc_time.h b/src/arch/x86/include/ipxe/rtc_time.h index cb8c7f49e..49c6313ed 100644 --- a/src/arch/x86/include/ipxe/rtc_time.h +++ b/src/arch/x86/include/ipxe/rtc_time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef TIME_RTC #define TIME_PREFIX_rtc diff --git a/src/arch/x86/include/ipxe/x86_io.h b/src/arch/x86/include/ipxe/x86_io.h index eeb3f8454..164b57e92 100644 --- a/src/arch/x86/include/ipxe/x86_io.h +++ b/src/arch/x86/include/ipxe/x86_io.h @@ -16,6 +16,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef IOAPI_X86 #define IOAPI_PREFIX_x86 diff --git a/src/arch/x86_64/include/bits/byteswap.h b/src/arch/x86_64/include/bits/byteswap.h index d8c5098ef..7c48a27ca 100644 --- a/src/arch/x86_64/include/bits/byteswap.h +++ b/src/arch/x86_64/include/bits/byteswap.h @@ -10,6 +10,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); static inline __attribute__ (( always_inline, const )) uint16_t __bswap_variable_16 ( uint16_t x ) { diff --git a/src/arch/x86_64/include/bits/compiler.h b/src/arch/x86_64/include/bits/compiler.h index 1c04a7b30..99185b058 100644 --- a/src/arch/x86_64/include/bits/compiler.h +++ b/src/arch/x86_64/include/bits/compiler.h @@ -2,6 +2,7 @@ #define _BITS_COMPILER_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Dummy relocation type */ #define RELOC_TYPE_NONE R_X86_64_NONE diff --git a/src/arch/x86_64/include/bits/profile.h b/src/arch/x86_64/include/bits/profile.h index c85b6fe5c..c8e0a21f1 100644 --- a/src/arch/x86_64/include/bits/profile.h +++ b/src/arch/x86_64/include/bits/profile.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86_64/include/bits/stdint.h b/src/arch/x86_64/include/bits/stdint.h index fe1f9946a..e75bed502 100644 --- a/src/arch/x86_64/include/bits/stdint.h +++ b/src/arch/x86_64/include/bits/stdint.h @@ -2,6 +2,7 @@ #define _BITS_STDINT_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); typedef __SIZE_TYPE__ size_t; typedef signed long ssize_t; diff --git a/src/arch/x86_64/include/bits/strings.h b/src/arch/x86_64/include/bits/strings.h index 3b7911f3b..6da8f1350 100644 --- a/src/arch/x86_64/include/bits/strings.h +++ b/src/arch/x86_64/include/bits/strings.h @@ -2,6 +2,7 @@ #define _BITS_STRINGS_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Find first (i.e. least significant) set bit diff --git a/src/arch/x86_64/include/ipxe/efi/dhcparch.h b/src/arch/x86_64/include/ipxe/efi/dhcparch.h index ccf0f46a0..f75bf9145 100644 --- a/src/arch/x86_64/include/ipxe/efi/dhcparch.h +++ b/src/arch/x86_64/include/ipxe/efi/dhcparch.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86_64/include/limits.h b/src/arch/x86_64/include/limits.h index a1374a17f..e75461acb 100644 --- a/src/arch/x86_64/include/limits.h +++ b/src/arch/x86_64/include/limits.h @@ -2,6 +2,7 @@ #define LIMITS_H 1 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* Number of bits in a `char' */ #define CHAR_BIT 8 diff --git a/src/config/branding.h b/src/config/branding.h index 454bf0c03..f28e1b5d2 100644 --- a/src/config/branding.h +++ b/src/config/branding.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/colour.h b/src/config/colour.h index 98198f12f..bde6f9719 100644 --- a/src/config/colour.h +++ b/src/config/colour.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #define COLOR_NORMAL_FG COLOR_WHITE #define COLOR_NORMAL_BG COLOR_BLUE diff --git a/src/config/config.c b/src/config/config.c index e49f236a3..c32bcee88 100644 --- a/src/config/config.c +++ b/src/config/config.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/config/config_eap.c b/src/config/config_eap.c index e18c48cae..0c9b7b687 100644 --- a/src/config/config_eap.c +++ b/src/config/config_eap.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_efi.c b/src/config/config_efi.c index 92678d12d..8daaa4329 100644 --- a/src/config/config_efi.c +++ b/src/config/config_efi.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/config/config_ethernet.c b/src/config/config_ethernet.c index c1b35bfe6..03ed371a7 100644 --- a/src/config/config_ethernet.c +++ b/src/config/config_ethernet.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_http.c b/src/config/config_http.c index 4373ea2c0..ee0643c91 100644 --- a/src/config/config_http.c +++ b/src/config/config_http.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_pci.c b/src/config/config_pci.c index b2adae995..c6c9b92a5 100644 --- a/src/config/config_pci.c +++ b/src/config/config_pci.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/config/config_route.c b/src/config/config_route.c index c0b4ee91d..59d8f3550 100644 --- a/src/config/config_route.c +++ b/src/config/config_route.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_timer.c b/src/config/config_timer.c index a4fe69b00..12b806129 100644 --- a/src/config/config_timer.c +++ b/src/config/config_timer.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/console.h b/src/config/console.h index 0ff328b7c..028021fa2 100644 --- a/src/config/console.h +++ b/src/config/console.h @@ -11,6 +11,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/defaults.h b/src/config/defaults.h index 32d6dbcce..767b67fdf 100644 --- a/src/config/defaults.h +++ b/src/config/defaults.h @@ -2,6 +2,7 @@ #define CONFIG_DEFAULTS_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #define CONFIG_DEFAULTS(_platform) diff --git a/src/config/defaults/efi.h b/src/config/defaults/efi.h index 4c9ba9d2a..524b2b0ea 100644 --- a/src/config/defaults/efi.h +++ b/src/config/defaults/efi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #define UACCESS_FLAT #define IOMAP_VIRT diff --git a/src/config/dhcp.h b/src/config/dhcp.h index adfa74a15..65180c38c 100644 --- a/src/config/dhcp.h +++ b/src/config/dhcp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/fault.h b/src/config/fault.h index 5912ae1a6..ab5503fa2 100644 --- a/src/config/fault.h +++ b/src/config/fault.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/general.h b/src/config/general.h index 683c02ffb..f77248836 100644 --- a/src/config/general.h +++ b/src/config/general.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/ioapi.h b/src/config/ioapi.h index a1498482d..d4ef91f76 100644 --- a/src/config/ioapi.h +++ b/src/config/ioapi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/named.h b/src/config/named.h index ddde6f0a6..f46524f81 100644 --- a/src/config/named.h +++ b/src/config/named.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* config//
.h */ #ifdef CONFIG diff --git a/src/config/nap.h b/src/config/nap.h index e4fe97964..55ff64116 100644 --- a/src/config/nap.h +++ b/src/config/nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/reboot.h b/src/config/reboot.h index 2d1648e7b..a7f90ead1 100644 --- a/src/config/reboot.h +++ b/src/config/reboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/sanboot.h b/src/config/sanboot.h index ccc4bda1f..962caec40 100644 --- a/src/config/sanboot.h +++ b/src/config/sanboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/settings.h b/src/config/settings.h index 7b4af4fdf..bba8c631a 100644 --- a/src/config/settings.h +++ b/src/config/settings.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/sideband.h b/src/config/sideband.h index dd704f9bb..039d28df0 100644 --- a/src/config/sideband.h +++ b/src/config/sideband.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); //#define CONFIG_BOFM /* IBM's BladeCenter Open Fabric Manager */ diff --git a/src/config/time.h b/src/config/time.h index 678f6f864..f938f3aa7 100644 --- a/src/config/time.h +++ b/src/config/time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/timer.h b/src/config/timer.h index 5a54d398c..d2368a13a 100644 --- a/src/config/timer.h +++ b/src/config/timer.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/umalloc.h b/src/config/umalloc.h index 832dd21d1..87fb34527 100644 --- a/src/config/umalloc.h +++ b/src/config/umalloc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/core/acpi.c b/src/core/acpi.c index 3fbf25bd1..d8c1903f3 100644 --- a/src/core/acpi.c +++ b/src/core/acpi.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/ansicol.c b/src/core/ansicol.c index ddf9ba77c..d53ebeeb6 100644 --- a/src/core/ansicol.c +++ b/src/core/ansicol.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/ansiesc.c b/src/core/ansiesc.c index 7f545db0e..57a2345d7 100644 --- a/src/core/ansiesc.c +++ b/src/core/ansiesc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/asprintf.c b/src/core/asprintf.c index 00edf8e11..17a65c715 100644 --- a/src/core/asprintf.c +++ b/src/core/asprintf.c @@ -5,6 +5,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Write a formatted string to newly allocated memory. diff --git a/src/core/base16.c b/src/core/base16.c index 47e35f414..0c597480f 100644 --- a/src/core/base16.c +++ b/src/core/base16.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/base64.c b/src/core/base64.c index ec11be261..fe7198c42 100644 --- a/src/core/base64.c +++ b/src/core/base64.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/basename.c b/src/core/basename.c index f4f929517..7a903c25f 100644 --- a/src/core/basename.c +++ b/src/core/basename.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/bitmap.c b/src/core/bitmap.c index 2aac33870..e3570c629 100644 --- a/src/core/bitmap.c +++ b/src/core/bitmap.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/blockdev.c b/src/core/blockdev.c index 3513caafa..ff0f3b68b 100644 --- a/src/core/blockdev.c +++ b/src/core/blockdev.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/blocktrans.c b/src/core/blocktrans.c index b793185fe..d9c24582c 100644 --- a/src/core/blocktrans.c +++ b/src/core/blocktrans.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/cachedhcp.c b/src/core/cachedhcp.c index eeb2fca58..3f6564efd 100644 --- a/src/core/cachedhcp.c +++ b/src/core/cachedhcp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/console.c b/src/core/console.c index 2b90809bf..240dde3d6 100644 --- a/src/core/console.c +++ b/src/core/console.c @@ -6,6 +6,7 @@ /** @file */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Current console usage */ int console_usage = CONSOLE_USAGE_STDOUT; diff --git a/src/core/cpio.c b/src/core/cpio.c index 15e33d206..d2f9d0c2d 100644 --- a/src/core/cpio.c +++ b/src/core/cpio.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/ctype.c b/src/core/ctype.c index 891af71ea..d7de060e3 100644 --- a/src/core/ctype.c +++ b/src/core/ctype.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/cwuri.c b/src/core/cwuri.c index 612f0b179..36475b159 100644 --- a/src/core/cwuri.c +++ b/src/core/cwuri.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/debug.c b/src/core/debug.c index 9b2a823f5..3f7661dda 100644 --- a/src/core/debug.c +++ b/src/core/debug.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/device.c b/src/core/device.c index efe4eb687..2ab5fa117 100644 --- a/src/core/device.c +++ b/src/core/device.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/dma.c b/src/core/dma.c index 3f3023c4d..dc266545b 100644 --- a/src/core/dma.c +++ b/src/core/dma.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/downloader.c b/src/core/downloader.c index 1c638f502..aa81e7365 100644 --- a/src/core/downloader.c +++ b/src/core/downloader.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/dynui.c b/src/core/dynui.c index 3d139c02a..c2af95f86 100644 --- a/src/core/dynui.c +++ b/src/core/dynui.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/edd.c b/src/core/edd.c index a50b74ab1..4fcccf117 100644 --- a/src/core/edd.c +++ b/src/core/edd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/errno.c b/src/core/errno.c index 5de15bb92..7afa40859 100644 --- a/src/core/errno.c +++ b/src/core/errno.c @@ -1,6 +1,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/exec.c b/src/core/exec.c index 534fb9993..4db1248b0 100644 --- a/src/core/exec.c +++ b/src/core/exec.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/getkey.c b/src/core/getkey.c index 0c280d23b..c952e0aea 100644 --- a/src/core/getkey.c +++ b/src/core/getkey.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/getopt.c b/src/core/getopt.c index e6c3948d1..cb4cbf118 100644 --- a/src/core/getopt.c +++ b/src/core/getopt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/image.c b/src/core/image.c index b2bd0956b..7df125971 100644 --- a/src/core/image.c +++ b/src/core/image.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/init.c b/src/core/init.c index 406d22d7b..2a32f5795 100644 --- a/src/core/init.c +++ b/src/core/init.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/interface.c b/src/core/interface.c index ea0606893..0ebcc8e51 100644 --- a/src/core/interface.c +++ b/src/core/interface.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/iobuf.c b/src/core/iobuf.c index 78fa23924..7e9a4156d 100644 --- a/src/core/iobuf.c +++ b/src/core/iobuf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/job.c b/src/core/job.c index 65df80056..f83ce0552 100644 --- a/src/core/job.c +++ b/src/core/job.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/keymap.c b/src/core/keymap.c index 36db7bd4c..e2244fdcb 100644 --- a/src/core/keymap.c +++ b/src/core/keymap.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/linebuf.c b/src/core/linebuf.c index c197e383c..8995dca66 100644 --- a/src/core/linebuf.c +++ b/src/core/linebuf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/list.c b/src/core/list.c index 5175c84ec..8d38d690a 100644 --- a/src/core/list.c +++ b/src/core/list.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/main.c b/src/core/main.c index 3db836491..95e16132f 100644 --- a/src/core/main.c +++ b/src/core/main.c @@ -13,6 +13,7 @@ Literature dealing with the network protocols: **************************************************************************/ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/malloc.c b/src/core/malloc.c index 877687d81..3a9f23ee4 100644 --- a/src/core/malloc.c +++ b/src/core/malloc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/monojob.c b/src/core/monojob.c index 2f066331c..ff22b4ac8 100644 --- a/src/core/monojob.c +++ b/src/core/monojob.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/nvo.c b/src/core/nvo.c index d2c9b5e73..8e500f816 100644 --- a/src/core/nvo.c +++ b/src/core/nvo.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/open.c b/src/core/open.c index f9198c9d9..8daa90f55 100644 --- a/src/core/open.c +++ b/src/core/open.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/params.c b/src/core/params.c index 58c829f62..d3fffc312 100644 --- a/src/core/params.c +++ b/src/core/params.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/parseopt.c b/src/core/parseopt.c index b657c3fce..b920a7d84 100644 --- a/src/core/parseopt.c +++ b/src/core/parseopt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/pending.c b/src/core/pending.c index 96d0cf197..4a1dd6a34 100644 --- a/src/core/pending.c +++ b/src/core/pending.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/pool.c b/src/core/pool.c index 0163405f7..daf761aa3 100644 --- a/src/core/pool.c +++ b/src/core/pool.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/process.c b/src/core/process.c index c944b6f50..883469dc5 100644 --- a/src/core/process.c +++ b/src/core/process.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/quiesce.c b/src/core/quiesce.c index 5d2a919d0..9c4e37849 100644 --- a/src/core/quiesce.c +++ b/src/core/quiesce.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/random.c b/src/core/random.c index e3251964b..e8fbe6966 100644 --- a/src/core/random.c +++ b/src/core/random.c @@ -5,6 +5,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/refcnt.c b/src/core/refcnt.c index 47c975a0b..a66511291 100644 --- a/src/core/refcnt.c +++ b/src/core/refcnt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/resolv.c b/src/core/resolv.c index fab8def4b..0fc02ccf4 100644 --- a/src/core/resolv.c +++ b/src/core/resolv.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/sanboot.c b/src/core/sanboot.c index e90c5ef1d..45cd5eff3 100644 --- a/src/core/sanboot.c +++ b/src/core/sanboot.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/settings.c b/src/core/settings.c index 05e495dcf..129620e00 100644 --- a/src/core/settings.c +++ b/src/core/settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/string.c b/src/core/string.c index 364c4cf0e..2af19b7fe 100644 --- a/src/core/string.c +++ b/src/core/string.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/time.c b/src/core/time.c index c353ac5bd..6d33f6caf 100644 --- a/src/core/time.c +++ b/src/core/time.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/core/timer.c b/src/core/timer.c index d45797adb..db0f32cf1 100644 --- a/src/core/timer.c +++ b/src/core/timer.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/uri.c b/src/core/uri.c index b82472ef0..9da5e298b 100644 --- a/src/core/uri.c +++ b/src/core/uri.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/utf8.c b/src/core/utf8.c index 4ee01baf9..871044fec 100644 --- a/src/core/utf8.c +++ b/src/core/utf8.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/uuid.c b/src/core/uuid.c index b6600af71..0f93e9f8f 100644 --- a/src/core/uuid.c +++ b/src/core/uuid.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/version.c b/src/core/version.c index cd69a8762..75f3160db 100644 --- a/src/core/version.c +++ b/src/core/version.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/vsprintf.c b/src/core/vsprintf.c index 9d3a97c2d..f6032014a 100644 --- a/src/core/vsprintf.c +++ b/src/core/vsprintf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/wchar.c b/src/core/wchar.c index b06cf452a..27a608bf4 100644 --- a/src/core/wchar.c +++ b/src/core/wchar.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/xfer.c b/src/core/xfer.c index 269359e15..5ab303bc7 100644 --- a/src/core/xfer.c +++ b/src/core/xfer.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/xferbuf.c b/src/core/xferbuf.c index d93526577..ca3baaab5 100644 --- a/src/core/xferbuf.c +++ b/src/core/xferbuf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/chap.c b/src/crypto/chap.c index c90c16def..008229133 100644 --- a/src/crypto/chap.c +++ b/src/crypto/chap.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/crc32.c b/src/crypto/crc32.c index cfef68c02..9ab4899c6 100644 --- a/src/crypto/crc32.c +++ b/src/crypto/crc32.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/crypto/md5.c b/src/crypto/md5.c index 5c62513e2..9418b006c 100644 --- a/src/crypto/md5.c +++ b/src/crypto/md5.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/drivers/block/ata.c b/src/drivers/block/ata.c index cf98d7c9f..ee2acdebb 100644 --- a/src/drivers/block/ata.c +++ b/src/drivers/block/ata.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/block/ibft.c b/src/drivers/block/ibft.c index ca5fad9ff..6120b37dd 100644 --- a/src/drivers/block/ibft.c +++ b/src/drivers/block/ibft.c @@ -26,6 +26,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/block/scsi.c b/src/drivers/block/scsi.c index 251210d4f..67bf48201 100644 --- a/src/drivers/block/scsi.c +++ b/src/drivers/block/scsi.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/pci.c b/src/drivers/bus/pci.c index 3908871b8..30163300a 100644 --- a/src/drivers/bus/pci.c +++ b/src/drivers/bus/pci.c @@ -25,6 +25,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/pci_settings.c b/src/drivers/bus/pci_settings.c index fc73c651e..3e320da43 100644 --- a/src/drivers/bus/pci_settings.c +++ b/src/drivers/bus/pci_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/efi/mnpnet.c b/src/drivers/net/efi/mnpnet.c index 902eb91f3..fe0ebaadb 100644 --- a/src/drivers/net/efi/mnpnet.c +++ b/src/drivers/net/efi/mnpnet.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/drivers/net/efi/nii.c b/src/drivers/net/efi/nii.c index c60d4ca18..d1adf3d44 100644 --- a/src/drivers/net/efi/nii.c +++ b/src/drivers/net/efi/nii.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/efi/nii.h b/src/drivers/net/efi/nii.h index df7ab7dbe..e0b07f0a5 100644 --- a/src/drivers/net/efi/nii.h +++ b/src/drivers/net/efi/nii.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct efi_device; diff --git a/src/drivers/net/efi/snpnet.c b/src/drivers/net/efi/snpnet.c index 8427b6ce3..6046f0a1e 100644 --- a/src/drivers/net/efi/snpnet.c +++ b/src/drivers/net/efi/snpnet.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/efi/snpnet.h b/src/drivers/net/efi/snpnet.h index 507350210..a361a99c0 100644 --- a/src/drivers/net/efi/snpnet.h +++ b/src/drivers/net/efi/snpnet.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); struct efi_device; diff --git a/src/drivers/net/efi/snponly.c b/src/drivers/net/efi/snponly.c index 876479133..b7231ce01 100644 --- a/src/drivers/net/efi/snponly.c +++ b/src/drivers/net/efi/snponly.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/nvs/nvs.c b/src/drivers/nvs/nvs.c index af7c466c4..42b54123e 100644 --- a/src/drivers/nvs/nvs.c +++ b/src/drivers/nvs/nvs.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/autoboot_cmd.c b/src/hci/commands/autoboot_cmd.c index 010c6fcb0..a61333a9d 100644 --- a/src/hci/commands/autoboot_cmd.c +++ b/src/hci/commands/autoboot_cmd.c @@ -30,6 +30,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/config_cmd.c b/src/hci/commands/config_cmd.c index 39272196a..cc21ad3fe 100644 --- a/src/hci/commands/config_cmd.c +++ b/src/hci/commands/config_cmd.c @@ -31,6 +31,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/dhcp_cmd.c b/src/hci/commands/dhcp_cmd.c index 33c23fc6e..ccc115b87 100644 --- a/src/hci/commands/dhcp_cmd.c +++ b/src/hci/commands/dhcp_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/dynui_cmd.c b/src/hci/commands/dynui_cmd.c index 56a4acd06..9d1ea0e93 100644 --- a/src/hci/commands/dynui_cmd.c +++ b/src/hci/commands/dynui_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/ifmgmt_cmd.c b/src/hci/commands/ifmgmt_cmd.c index 2906d1d45..f4b9fef3a 100644 --- a/src/hci/commands/ifmgmt_cmd.c +++ b/src/hci/commands/ifmgmt_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/image_cmd.c b/src/hci/commands/image_cmd.c index 179256862..aaed0ea9b 100644 --- a/src/hci/commands/image_cmd.c +++ b/src/hci/commands/image_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/login_cmd.c b/src/hci/commands/login_cmd.c index 005d40342..f8cd73f23 100644 --- a/src/hci/commands/login_cmd.c +++ b/src/hci/commands/login_cmd.c @@ -28,6 +28,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/nvo_cmd.c b/src/hci/commands/nvo_cmd.c index 69ab97dca..70086afce 100644 --- a/src/hci/commands/nvo_cmd.c +++ b/src/hci/commands/nvo_cmd.c @@ -34,6 +34,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/reboot_cmd.c b/src/hci/commands/reboot_cmd.c index c5b71c045..daef92dc0 100644 --- a/src/hci/commands/reboot_cmd.c +++ b/src/hci/commands/reboot_cmd.c @@ -27,6 +27,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/route_cmd.c b/src/hci/commands/route_cmd.c index a33754399..ff841ec15 100644 --- a/src/hci/commands/route_cmd.c +++ b/src/hci/commands/route_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/sanboot_cmd.c b/src/hci/commands/sanboot_cmd.c index 122bee527..7bc60e641 100644 --- a/src/hci/commands/sanboot_cmd.c +++ b/src/hci/commands/sanboot_cmd.c @@ -32,6 +32,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/shim_cmd.c b/src/hci/commands/shim_cmd.c index a53bb3fde..1566af4e9 100644 --- a/src/hci/commands/shim_cmd.c +++ b/src/hci/commands/shim_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/sync_cmd.c b/src/hci/commands/sync_cmd.c index 9d6e6a284..e3b97298c 100644 --- a/src/hci/commands/sync_cmd.c +++ b/src/hci/commands/sync_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/editstring.c b/src/hci/editstring.c index be9ca06a5..f88b81f7f 100644 --- a/src/hci/editstring.c +++ b/src/hci/editstring.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/jumpscroll.c b/src/hci/jumpscroll.c index 641f781a0..c6ee5bda0 100644 --- a/src/hci/jumpscroll.c +++ b/src/hci/jumpscroll.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Jump scrolling diff --git a/src/hci/mucurses/ansi_screen.c b/src/hci/mucurses/ansi_screen.c index 1cf3309dd..7c607b5cc 100644 --- a/src/hci/mucurses/ansi_screen.c +++ b/src/hci/mucurses/ansi_screen.c @@ -4,6 +4,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); static void ansiscr_reset(struct _curses_screen *scr) __nonnull; static void ansiscr_movetoyx(struct _curses_screen *scr, diff --git a/src/hci/mucurses/clear.c b/src/hci/mucurses/clear.c index 2054f72cc..d93e9630e 100644 --- a/src/hci/mucurses/clear.c +++ b/src/hci/mucurses/clear.c @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Clear a window to the bottom from current cursor position diff --git a/src/hci/mucurses/cursor.h b/src/hci/mucurses/cursor.h index 2e0c896a6..6f47becae 100644 --- a/src/hci/mucurses/cursor.h +++ b/src/hci/mucurses/cursor.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct cursor_pos { unsigned int y, x; diff --git a/src/hci/mucurses/mucurses.c b/src/hci/mucurses/mucurses.c index 98a8a2c59..7f1779e8f 100644 --- a/src/hci/mucurses/mucurses.c +++ b/src/hci/mucurses/mucurses.c @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); static void _wupdcurs ( WINDOW *win ) __nonnull; void _wputch ( WINDOW *win, chtype ch, int wrap ) __nonnull; diff --git a/src/hci/mucurses/mucurses.h b/src/hci/mucurses/mucurses.h index 270394787..dc6187741 100644 --- a/src/hci/mucurses/mucurses.h +++ b/src/hci/mucurses/mucurses.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #define WRAP 0 #define NOWRAP 1 diff --git a/src/hci/mucurses/print.c b/src/hci/mucurses/print.c index e8831c58f..f7e0c8483 100644 --- a/src/hci/mucurses/print.c +++ b/src/hci/mucurses/print.c @@ -11,6 +11,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Add a single-byte character and rendition to a window and advance diff --git a/src/hci/mucurses/widgets/editbox.c b/src/hci/mucurses/widgets/editbox.c index c024688ab..5dab3ac5c 100644 --- a/src/hci/mucurses/widgets/editbox.c +++ b/src/hci/mucurses/widgets/editbox.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/mucurses/winattrs.c b/src/hci/mucurses/winattrs.c index 97a5a18b3..e78025543 100644 --- a/src/hci/mucurses/winattrs.c +++ b/src/hci/mucurses/winattrs.c @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Get the background rendition attributes for a window diff --git a/src/hci/mucurses/wininit.c b/src/hci/mucurses/wininit.c index dd84d2f1d..1b651123e 100644 --- a/src/hci/mucurses/wininit.c +++ b/src/hci/mucurses/wininit.c @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Initialise console environment diff --git a/src/hci/readline.c b/src/hci/readline.c index 5b46413e9..3d0330a62 100644 --- a/src/hci/readline.c +++ b/src/hci/readline.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/shell.c b/src/hci/shell.c index 7e2ecaab6..cc7910eb8 100644 --- a/src/hci/shell.c +++ b/src/hci/shell.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/strerror.c b/src/hci/strerror.c index 1bba8c620..48091b413 100644 --- a/src/hci/strerror.c +++ b/src/hci/strerror.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Find error description diff --git a/src/hci/tui/form_ui.c b/src/hci/tui/form_ui.c index 6cc28c369..2bce952fa 100644 --- a/src/hci/tui/form_ui.c +++ b/src/hci/tui/form_ui.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/tui/login_ui.c b/src/hci/tui/login_ui.c index 02552f0d2..31069b154 100644 --- a/src/hci/tui/login_ui.c +++ b/src/hci/tui/login_ui.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/tui/menu_ui.c b/src/hci/tui/menu_ui.c index c7fad4a6b..f789a298f 100644 --- a/src/hci/tui/menu_ui.c +++ b/src/hci/tui/menu_ui.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/tui/message.c b/src/hci/tui/message.c index e3331d655..89c6f7703 100644 --- a/src/hci/tui/message.c +++ b/src/hci/tui/message.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/tui/settings_ui.c b/src/hci/tui/settings_ui.c index 57ff9e9a0..a069c527d 100644 --- a/src/hci/tui/settings_ui.c +++ b/src/hci/tui/settings_ui.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/image/efi_image.c b/src/image/efi_image.c index e7b19c4ce..2631530e7 100644 --- a/src/image/efi_image.c +++ b/src/image/efi_image.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/image/embedded.c b/src/image/embedded.c index 652cfc85f..22d3738cc 100644 --- a/src/image/embedded.c +++ b/src/image/embedded.c @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/image/script.c b/src/image/script.c index 257e59a09..57662b788 100644 --- a/src/image/script.c +++ b/src/image/script.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/include/assert.h b/src/include/assert.h index 5affab2db..30277f9a9 100644 --- a/src/include/assert.h +++ b/src/include/assert.h @@ -11,6 +11,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifndef ASSERTING #ifdef NDEBUG diff --git a/src/include/bits/dma.h b/src/include/bits/dma.h index e9cb84942..c44b3e456 100644 --- a/src/include/bits/dma.h +++ b/src/include/bits/dma.h @@ -11,5 +11,6 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #endif /* _BITS_DMA_H */ diff --git a/src/include/bits/uaccess.h b/src/include/bits/uaccess.h index 09f5f46c8..e3f8b1412 100644 --- a/src/include/bits/uaccess.h +++ b/src/include/bits/uaccess.h @@ -11,5 +11,6 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #endif /* _BITS_UACCESS_H */ diff --git a/src/include/bits/umalloc.h b/src/include/bits/umalloc.h index 4927f0d00..689755b00 100644 --- a/src/include/bits/umalloc.h +++ b/src/include/bits/umalloc.h @@ -11,5 +11,6 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #endif /* _BITS_UMALLOC_H */ diff --git a/src/include/bits/virt_offset.h b/src/include/bits/virt_offset.h index 5f026284c..a67b6941e 100644 --- a/src/include/bits/virt_offset.h +++ b/src/include/bits/virt_offset.h @@ -11,5 +11,6 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #endif /* _BITS_VIRT_OFFSET_H */ diff --git a/src/include/byteswap.h b/src/include/byteswap.h index d1028c579..0910e4e2c 100644 --- a/src/include/byteswap.h +++ b/src/include/byteswap.h @@ -2,6 +2,7 @@ #define BYTESWAP_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ctype.h b/src/include/ctype.h index 6fefd5d77..15109ff9d 100644 --- a/src/include/ctype.h +++ b/src/include/ctype.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Check if character is ASCII diff --git a/src/include/curses.h b/src/include/curses.h index cf8cc53c9..bbc437a4e 100644 --- a/src/include/curses.h +++ b/src/include/curses.h @@ -13,6 +13,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #undef ERR #define ERR (-1) diff --git a/src/include/endian.h b/src/include/endian.h index bdae9de45..5565673ca 100644 --- a/src/include/endian.h +++ b/src/include/endian.h @@ -2,6 +2,7 @@ #define _ENDIAN_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Constant representing little-endian byte order * diff --git a/src/include/errno.h b/src/include/errno.h index ac012a691..8900cdb34 100644 --- a/src/include/errno.h +++ b/src/include/errno.h @@ -25,6 +25,7 @@ #define ERRNO_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/include/getopt.h b/src/include/getopt.h index db3de1786..4087c332f 100644 --- a/src/include/getopt.h +++ b/src/include/getopt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/hci/ifmgmt_cmd.h b/src/include/hci/ifmgmt_cmd.h index 5debf85c2..f1008e14f 100644 --- a/src/include/hci/ifmgmt_cmd.h +++ b/src/include/hci/ifmgmt_cmd.h @@ -25,6 +25,7 @@ #define _IFMGMT_CMD_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/acpi.h b/src/include/ipxe/acpi.h index 5e9fb5eba..c423aa584 100644 --- a/src/include/ipxe/acpi.h +++ b/src/include/ipxe/acpi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ansicol.h b/src/include/ipxe/ansicol.h index 2b54ecaca..9c34d596b 100644 --- a/src/include/ipxe/ansicol.h +++ b/src/include/ipxe/ansicol.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include /* For COLOR_RED etc. */ diff --git a/src/include/ipxe/ansiesc.h b/src/include/ipxe/ansiesc.h index 80bc83308..280f51066 100644 --- a/src/include/ipxe/ansiesc.h +++ b/src/include/ipxe/ansiesc.h @@ -27,6 +27,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct ansiesc_context; diff --git a/src/include/ipxe/aoe.h b/src/include/ipxe/aoe.h index 14d11c5cb..c548f42a2 100644 --- a/src/include/ipxe/aoe.h +++ b/src/include/ipxe/aoe.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/api.h b/src/include/ipxe/api.h index d05d3b07a..ab61f4f14 100644 --- a/src/include/ipxe/api.h +++ b/src/include/ipxe/api.h @@ -12,6 +12,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @defgroup Single-implementation APIs * diff --git a/src/include/ipxe/arp.h b/src/include/ipxe/arp.h index 674423c54..c70ea7eff 100644 --- a/src/include/ipxe/arp.h +++ b/src/include/ipxe/arp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/asn1.h b/src/include/ipxe/asn1.h index 86ebb890f..c5dcccb99 100644 --- a/src/include/ipxe/asn1.h +++ b/src/include/ipxe/asn1.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ata.h b/src/include/ipxe/ata.h index cd78cd795..eea086c13 100644 --- a/src/include/ipxe/ata.h +++ b/src/include/ipxe/ata.h @@ -11,6 +11,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * An ATA Logical Block Address diff --git a/src/include/ipxe/base16.h b/src/include/ipxe/base16.h index c9e430e7e..b2cf42eb4 100644 --- a/src/include/ipxe/base16.h +++ b/src/include/ipxe/base16.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/base64.h b/src/include/ipxe/base64.h index 0c70d8382..f93039901 100644 --- a/src/include/ipxe/base64.h +++ b/src/include/ipxe/base64.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/bitmap.h b/src/include/ipxe/bitmap.h index 38aca694b..7533d1bf9 100644 --- a/src/include/ipxe/bitmap.h +++ b/src/include/ipxe/bitmap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/blockdev.h b/src/include/ipxe/blockdev.h index ef6fc8d5a..7e4d48ce4 100644 --- a/src/include/ipxe/blockdev.h +++ b/src/include/ipxe/blockdev.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/blocktrans.h b/src/include/ipxe/blocktrans.h index 1eb388854..66a7e353c 100644 --- a/src/include/ipxe/blocktrans.h +++ b/src/include/ipxe/blocktrans.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/cachedhcp.h b/src/include/ipxe/cachedhcp.h index 5b19bc59e..100e5e098 100644 --- a/src/include/ipxe/cachedhcp.h +++ b/src/include/ipxe/cachedhcp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/chap.h b/src/include/ipxe/chap.h index 7c693e29d..965143095 100644 --- a/src/include/ipxe/chap.h +++ b/src/include/ipxe/chap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/command.h b/src/include/ipxe/command.h index 331536313..cbd5fb665 100644 --- a/src/include/ipxe/command.h +++ b/src/include/ipxe/command.h @@ -2,6 +2,7 @@ #define _IPXE_COMMAND_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/console.h b/src/include/ipxe/console.h index 1b764aaca..5e652a974 100644 --- a/src/include/ipxe/console.h +++ b/src/include/ipxe/console.h @@ -17,6 +17,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct pixel_buffer; diff --git a/src/include/ipxe/cpio.h b/src/include/ipxe/cpio.h index 744dbd269..f1752ab0a 100644 --- a/src/include/ipxe/cpio.h +++ b/src/include/ipxe/cpio.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/crc32.h b/src/include/ipxe/crc32.h index 30d2fe66c..7fe7ec88e 100644 --- a/src/include/ipxe/crc32.h +++ b/src/include/ipxe/crc32.h @@ -2,6 +2,7 @@ #define _IPXE_CRC32_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/crypto.h b/src/include/ipxe/crypto.h index dd567fb2c..f458d7f30 100644 --- a/src/include/ipxe/crypto.h +++ b/src/include/ipxe/crypto.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/device.h b/src/include/ipxe/device.h index 89e6e4f31..ca12d2c07 100644 --- a/src/include/ipxe/device.h +++ b/src/include/ipxe/device.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/dhcp.h b/src/include/ipxe/dhcp.h index 43729d0c5..bdbe3b741 100644 --- a/src/include/ipxe/dhcp.h +++ b/src/include/ipxe/dhcp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/dhcparch.h b/src/include/ipxe/dhcparch.h index 89ecfb31e..ff611331c 100644 --- a/src/include/ipxe/dhcparch.h +++ b/src/include/ipxe/dhcparch.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* Include platform-specific client architecture definitions */ #define PLATFORM_DHCPARCH(_platform) diff --git a/src/include/ipxe/dhcpopts.h b/src/include/ipxe/dhcpopts.h index 707fda4a8..9fe7bb110 100644 --- a/src/include/ipxe/dhcpopts.h +++ b/src/include/ipxe/dhcpopts.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/dhcppkt.h b/src/include/ipxe/dhcppkt.h index 86075960a..7d0153107 100644 --- a/src/include/ipxe/dhcppkt.h +++ b/src/include/ipxe/dhcppkt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/dhcpv6.h b/src/include/ipxe/dhcpv6.h index 065e9c376..45b36724a 100644 --- a/src/include/ipxe/dhcpv6.h +++ b/src/include/ipxe/dhcpv6.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/dma.h b/src/include/ipxe/dma.h index a6e41c1ab..e6e7a4793 100644 --- a/src/include/ipxe/dma.h +++ b/src/include/ipxe/dma.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/dns.h b/src/include/ipxe/dns.h index 738dea6e4..e7fc32c25 100644 --- a/src/include/ipxe/dns.h +++ b/src/include/ipxe/dns.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/downloader.h b/src/include/ipxe/downloader.h index ccb1abfef..f87a8ea78 100644 --- a/src/include/ipxe/downloader.h +++ b/src/include/ipxe/downloader.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct interface; struct image; diff --git a/src/include/ipxe/dummy_sanboot.h b/src/include/ipxe/dummy_sanboot.h index 9c9d942aa..991a2545a 100644 --- a/src/include/ipxe/dummy_sanboot.h +++ b/src/include/ipxe/dummy_sanboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SANBOOT_DUMMY #define SANBOOT_PREFIX_dummy diff --git a/src/include/ipxe/dynui.h b/src/include/ipxe/dynui.h index f47f5cb36..e50c6ab49 100644 --- a/src/include/ipxe/dynui.h +++ b/src/include/ipxe/dynui.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/eap.h b/src/include/ipxe/eap.h index a44f01e0a..2b3770138 100644 --- a/src/include/ipxe/eap.h +++ b/src/include/ipxe/eap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/eapol.h b/src/include/ipxe/eapol.h index dcf392946..2d44750ec 100644 --- a/src/include/ipxe/eapol.h +++ b/src/include/ipxe/eapol.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ecam_io.h b/src/include/ipxe/ecam_io.h index b2c232013..f31ccdc53 100644 --- a/src/include/ipxe/ecam_io.h +++ b/src/include/ipxe/ecam_io.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/edd.h b/src/include/ipxe/edd.h index 1914fd0b0..9529da475 100644 --- a/src/include/ipxe/edd.h +++ b/src/include/ipxe/edd.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/editbox.h b/src/include/ipxe/editbox.h index 1f62485fe..85d5919c9 100644 --- a/src/include/ipxe/editbox.h +++ b/src/include/ipxe/editbox.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/editstring.h b/src/include/ipxe/editstring.h index 7ad8fb304..48dc34f18 100644 --- a/src/include/ipxe/editstring.h +++ b/src/include/ipxe/editstring.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** An editable string */ struct edit_string { diff --git a/src/include/ipxe/efi/ProcessorBind.h b/src/include/ipxe/efi/ProcessorBind.h index 21b873163..9fb8012f7 100644 --- a/src/include/ipxe/efi/ProcessorBind.h +++ b/src/include/ipxe/efi/ProcessorBind.h @@ -2,6 +2,7 @@ #define _IPXE_EFI_PROCESSOR_BIND_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* * EFI header files rely on having the CPU architecture directory diff --git a/src/include/ipxe/efi/Protocol/AppleNetBoot.h b/src/include/ipxe/efi/Protocol/AppleNetBoot.h index 5946524fd..417730bc3 100644 --- a/src/include/ipxe/efi/Protocol/AppleNetBoot.h +++ b/src/include/ipxe/efi/Protocol/AppleNetBoot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( BSD3 ); +FILE_SECBOOT ( PERMITTED ); #define EFI_APPLE_NET_BOOT_PROTOCOL_GUID \ { 0x78ee99fb, 0x6a5e, 0x4186, \ diff --git a/src/include/ipxe/efi/Protocol/ShimLock.h b/src/include/ipxe/efi/Protocol/ShimLock.h index b31365173..8fd3c3bc8 100644 --- a/src/include/ipxe/efi/Protocol/ShimLock.h +++ b/src/include/ipxe/efi/Protocol/ShimLock.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( BSD3 ); +FILE_SECBOOT ( PERMITTED ); #define EFI_SHIM_LOCK_PROTOCOL_GUID \ { 0x605dab50, 0xe046, 0x4300, \ diff --git a/src/include/ipxe/efi/efi.h b/src/include/ipxe/efi/efi.h index 3085704b0..9554a6ad7 100644 --- a/src/include/ipxe/efi/efi.h +++ b/src/include/ipxe/efi/efi.h @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); /* EFI headers rudely redefine NULL */ #undef NULL diff --git a/src/include/ipxe/efi/efi_acpi.h b/src/include/ipxe/efi/efi_acpi.h index 68f9c5be7..d11ae95b1 100644 --- a/src/include/ipxe/efi/efi_acpi.h +++ b/src/include/ipxe/efi/efi_acpi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef ACPI_EFI #define ACPI_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_autoboot.h b/src/include/ipxe/efi/efi_autoboot.h index 94fd2d766..29b80fd86 100644 --- a/src/include/ipxe/efi/efi_autoboot.h +++ b/src/include/ipxe/efi/efi_autoboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_autoexec.h b/src/include/ipxe/efi/efi_autoexec.h index 18bc4200c..1e68daeee 100644 --- a/src/include/ipxe/efi/efi_autoexec.h +++ b/src/include/ipxe/efi/efi_autoexec.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int efi_autoexec_load ( void ); diff --git a/src/include/ipxe/efi/efi_block.h b/src/include/ipxe/efi/efi_block.h index f8cf7fc13..b010d71a3 100644 --- a/src/include/ipxe/efi/efi_block.h +++ b/src/include/ipxe/efi/efi_block.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SANBOOT_EFI #define SANBOOT_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_cachedhcp.h b/src/include/ipxe/efi/efi_cachedhcp.h index 5968a1ea2..86164f463 100644 --- a/src/include/ipxe/efi/efi_cachedhcp.h +++ b/src/include/ipxe/efi/efi_cachedhcp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_cmdline.h b/src/include/ipxe/efi/efi_cmdline.h index 45abd5493..ed43d71a7 100644 --- a/src/include/ipxe/efi/efi_cmdline.h +++ b/src/include/ipxe/efi/efi_cmdline.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_download.h b/src/include/ipxe/efi/efi_download.h index 740fcadf5..ca96efae2 100644 --- a/src/include/ipxe/efi/efi_download.h +++ b/src/include/ipxe/efi/efi_download.h @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/include/ipxe/efi/efi_driver.h b/src/include/ipxe/efi/efi_driver.h index 5ab2d011a..f373e47d3 100644 --- a/src/include/ipxe/efi/efi_driver.h +++ b/src/include/ipxe/efi/efi_driver.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_fdt.h b/src/include/ipxe/efi/efi_fdt.h index d18676d7e..644e6ddf9 100644 --- a/src/include/ipxe/efi/efi_fdt.h +++ b/src/include/ipxe/efi/efi_fdt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_file.h b/src/include/ipxe/efi/efi_file.h index 79c073cf1..bf14297a1 100644 --- a/src/include/ipxe/efi/efi_file.h +++ b/src/include/ipxe/efi/efi_file.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int efi_file_install ( EFI_HANDLE handle ); extern void efi_file_uninstall ( EFI_HANDLE handle ); diff --git a/src/include/ipxe/efi/efi_hii.h b/src/include/ipxe/efi/efi_hii.h index bbec31194..8a001723f 100644 --- a/src/include/ipxe/efi/efi_hii.h +++ b/src/include/ipxe/efi/efi_hii.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_image.h b/src/include/ipxe/efi/efi_image.h index 0fc0402b1..7fd2e2894 100644 --- a/src/include/ipxe/efi/efi_image.h +++ b/src/include/ipxe/efi/efi_image.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_nap.h b/src/include/ipxe/efi/efi_nap.h index 1ffb05569..6c01072c3 100644 --- a/src/include/ipxe/efi/efi_nap.h +++ b/src/include/ipxe/efi/efi_nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef NAP_EFI #define NAP_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_null.h b/src/include/ipxe/efi/efi_null.h index d23d36349..e81545485 100644 --- a/src/include/ipxe/efi/efi_null.h +++ b/src/include/ipxe/efi/efi_null.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_path.h b/src/include/ipxe/efi/efi_path.h index a37d7b9d7..f68d782fb 100644 --- a/src/include/ipxe/efi/efi_path.h +++ b/src/include/ipxe/efi/efi_path.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_pci.h b/src/include/ipxe/efi/efi_pci.h index f8d1e3e40..670fb7d7a 100644 --- a/src/include/ipxe/efi/efi_pci.h +++ b/src/include/ipxe/efi/efi_pci.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_pci_api.h b/src/include/ipxe/efi/efi_pci_api.h index 956795254..474555871 100644 --- a/src/include/ipxe/efi/efi_pci_api.h +++ b/src/include/ipxe/efi/efi_pci_api.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef PCIAPI_EFI #define PCIAPI_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_pxe.h b/src/include/ipxe/efi/efi_pxe.h index b356f3789..d9aac455c 100644 --- a/src/include/ipxe/efi/efi_pxe.h +++ b/src/include/ipxe/efi/efi_pxe.h @@ -10,6 +10,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int efi_pxe_install ( EFI_HANDLE handle, struct net_device *netdev ); extern void efi_pxe_uninstall ( EFI_HANDLE handle ); diff --git a/src/include/ipxe/efi/efi_reboot.h b/src/include/ipxe/efi/efi_reboot.h index 249cae8c5..8eb38f271 100644 --- a/src/include/ipxe/efi/efi_reboot.h +++ b/src/include/ipxe/efi/efi_reboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef REBOOT_EFI #define REBOOT_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_service.h b/src/include/ipxe/efi/efi_service.h index ca4c7b2a4..2c5bc8fe9 100644 --- a/src/include/ipxe/efi/efi_service.h +++ b/src/include/ipxe/efi/efi_service.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_shim.h b/src/include/ipxe/efi/efi_shim.h index 21f24315a..d205dec6d 100644 --- a/src/include/ipxe/efi/efi_shim.h +++ b/src/include/ipxe/efi/efi_shim.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_smbios.h b/src/include/ipxe/efi/efi_smbios.h index d890d5460..23af651a8 100644 --- a/src/include/ipxe/efi/efi_smbios.h +++ b/src/include/ipxe/efi/efi_smbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SMBIOS_EFI #define SMBIOS_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_snp.h b/src/include/ipxe/efi/efi_snp.h index 1095b19e3..0822466db 100644 --- a/src/include/ipxe/efi/efi_snp.h +++ b/src/include/ipxe/efi/efi_snp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_strings.h b/src/include/ipxe/efi/efi_strings.h index a7adff827..36f5a7eb0 100644 --- a/src/include/ipxe/efi/efi_strings.h +++ b/src/include/ipxe/efi/efi_strings.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_table.h b/src/include/ipxe/efi/efi_table.h index 9a41d8723..714069e15 100644 --- a/src/include/ipxe/efi/efi_table.h +++ b/src/include/ipxe/efi/efi_table.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_time.h b/src/include/ipxe/efi/efi_time.h index 099994b57..8b2addc0f 100644 --- a/src/include/ipxe/efi/efi_time.h +++ b/src/include/ipxe/efi/efi_time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_umalloc.h b/src/include/ipxe/efi/efi_umalloc.h index 4eb2a5f9b..4d5c706ca 100644 --- a/src/include/ipxe/efi/efi_umalloc.h +++ b/src/include/ipxe/efi/efi_umalloc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef UMALLOC_EFI #define UMALLOC_PREFIX_efi diff --git a/src/include/ipxe/efi/efi_utils.h b/src/include/ipxe/efi/efi_utils.h index 98659b150..29dc171d2 100644 --- a/src/include/ipxe/efi/efi_utils.h +++ b/src/include/ipxe/efi/efi_utils.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_veto.h b/src/include/ipxe/efi/efi_veto.h index c9ecbb05c..be48441ad 100644 --- a/src/include/ipxe/efi/efi_veto.h +++ b/src/include/ipxe/efi/efi_veto.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern void efi_veto ( void ); diff --git a/src/include/ipxe/efi/efi_watchdog.h b/src/include/ipxe/efi/efi_watchdog.h index 4a56b9a29..1801c6d6c 100644 --- a/src/include/ipxe/efi/efi_watchdog.h +++ b/src/include/ipxe/efi/efi_watchdog.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern struct retry_timer efi_watchdog; diff --git a/src/include/ipxe/efi/efi_wrap.h b/src/include/ipxe/efi/efi_wrap.h index 1cae3d2db..7801c77d0 100644 --- a/src/include/ipxe/efi/efi_wrap.h +++ b/src/include/ipxe/efi/efi_wrap.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/mnpnet.h b/src/include/ipxe/efi/mnpnet.h index 99d6cf083..1f2d0d1f6 100644 --- a/src/include/ipxe/efi/mnpnet.h +++ b/src/include/ipxe/efi/mnpnet.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct efi_device; struct net_device; diff --git a/src/include/ipxe/errfile.h b/src/include/ipxe/errfile.h index d97c5eca6..8379adb13 100644 --- a/src/include/ipxe/errfile.h +++ b/src/include/ipxe/errfile.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/errno/efi.h b/src/include/ipxe/errno/efi.h index 9f010f5fb..2db2d5cb6 100644 --- a/src/include/ipxe/errno/efi.h +++ b/src/include/ipxe/errno/efi.h @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/errortab.h b/src/include/ipxe/errortab.h index 4fe81a6be..6c63bb6d1 100644 --- a/src/include/ipxe/errortab.h +++ b/src/include/ipxe/errortab.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/eth_slow.h b/src/include/ipxe/eth_slow.h index 754ea6e1f..757bb83f0 100644 --- a/src/include/ipxe/eth_slow.h +++ b/src/include/ipxe/eth_slow.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Slow protocols header */ struct eth_slow_header { diff --git a/src/include/ipxe/ethernet.h b/src/include/ipxe/ethernet.h index dd04e00ce..f1eb21dd0 100644 --- a/src/include/ipxe/ethernet.h +++ b/src/include/ipxe/ethernet.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fakedhcp.h b/src/include/ipxe/fakedhcp.h index d016b5237..f23a98f2d 100644 --- a/src/include/ipxe/fakedhcp.h +++ b/src/include/ipxe/fakedhcp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/fault.h b/src/include/ipxe/fault.h index 356296c35..251567226 100644 --- a/src/include/ipxe/fault.h +++ b/src/include/ipxe/fault.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fc.h b/src/include/ipxe/fc.h index 840d11f62..8c2bbe5e5 100644 --- a/src/include/ipxe/fc.h +++ b/src/include/ipxe/fc.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fcels.h b/src/include/ipxe/fcels.h index 02f755115..8aa086106 100644 --- a/src/include/ipxe/fcels.h +++ b/src/include/ipxe/fcels.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fcp.h b/src/include/ipxe/fcp.h index d86afab42..96aae37db 100644 --- a/src/include/ipxe/fcp.h +++ b/src/include/ipxe/fcp.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fdtmem.h b/src/include/ipxe/fdtmem.h index 8d7ebfe7e..1bbc38ff9 100644 --- a/src/include/ipxe/fdtmem.h +++ b/src/include/ipxe/fdtmem.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/features.h b/src/include/ipxe/features.h index e86a2d226..2d1ef3b7b 100644 --- a/src/include/ipxe/features.h +++ b/src/include/ipxe/features.h @@ -12,6 +12,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @defgroup featurecat Feature categories diff --git a/src/include/ipxe/fragment.h b/src/include/ipxe/fragment.h index 0069e5e08..474ad5e1c 100644 --- a/src/include/ipxe/fragment.h +++ b/src/include/ipxe/fragment.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/http.h b/src/include/ipxe/http.h index fc3e7b7a1..e84a75237 100644 --- a/src/include/ipxe/http.h +++ b/src/include/ipxe/http.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ib_mad.h b/src/include/ipxe/ib_mad.h index 134274026..dcc432558 100644 --- a/src/include/ipxe/ib_mad.h +++ b/src/include/ipxe/ib_mad.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ib_packet.h b/src/include/ipxe/ib_packet.h index 747f96399..087e86d5a 100644 --- a/src/include/ipxe/ib_packet.h +++ b/src/include/ipxe/ib_packet.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct ib_device; struct ib_queue_pair; diff --git a/src/include/ipxe/ib_srp.h b/src/include/ipxe/ib_srp.h index 4b6df8d3b..9bd272a3b 100644 --- a/src/include/ipxe/ib_srp.h +++ b/src/include/ipxe/ib_srp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ibft.h b/src/include/ipxe/ibft.h index 51ce781a6..9534c1e8a 100644 --- a/src/include/ipxe/ibft.h +++ b/src/include/ipxe/ibft.h @@ -29,6 +29,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/include/ipxe/icmp.h b/src/include/ipxe/icmp.h index 803f8e019..a62e63ee8 100644 --- a/src/include/ipxe/icmp.h +++ b/src/include/ipxe/icmp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/icmpv6.h b/src/include/ipxe/icmpv6.h index 0474ddca8..7d0c5ba14 100644 --- a/src/include/ipxe/icmpv6.h +++ b/src/include/ipxe/icmpv6.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/if_arp.h b/src/include/ipxe/if_arp.h index 9d7b03fe8..31d7d8b73 100644 --- a/src/include/ipxe/if_arp.h +++ b/src/include/ipxe/if_arp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/if_ether.h b/src/include/ipxe/if_ether.h index c1168b10e..a7d0e55f9 100644 --- a/src/include/ipxe/if_ether.h +++ b/src/include/ipxe/if_ether.h @@ -2,6 +2,7 @@ #define _IPXE_IF_ETHER_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/image.h b/src/include/ipxe/image.h index e0e70f360..d9abe11ec 100644 --- a/src/include/ipxe/image.h +++ b/src/include/ipxe/image.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/in.h b/src/include/ipxe/in.h index 05a8122ef..f91ab306a 100644 --- a/src/include/ipxe/in.h +++ b/src/include/ipxe/in.h @@ -2,6 +2,7 @@ #define _IPXE_IN_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/infiniband.h b/src/include/ipxe/infiniband.h index 379bc109e..8022ab606 100644 --- a/src/include/ipxe/infiniband.h +++ b/src/include/ipxe/infiniband.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/init.h b/src/include/ipxe/init.h index da01b2953..00946fe83 100644 --- a/src/include/ipxe/init.h +++ b/src/include/ipxe/init.h @@ -2,6 +2,7 @@ #define _IPXE_INIT_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/initrd.h b/src/include/ipxe/initrd.h index 0b955a381..50788597b 100644 --- a/src/include/ipxe/initrd.h +++ b/src/include/ipxe/initrd.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/interface.h b/src/include/ipxe/interface.h index d2fa8190c..87fd3c62f 100644 --- a/src/include/ipxe/interface.h +++ b/src/include/ipxe/interface.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/io.h b/src/include/ipxe/io.h index ee2b7e156..1bb49370c 100644 --- a/src/include/ipxe/io.h +++ b/src/include/ipxe/io.h @@ -17,6 +17,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/iobuf.h b/src/include/ipxe/iobuf.h index 46b350458..2ff24e50f 100644 --- a/src/include/ipxe/iobuf.h +++ b/src/include/ipxe/iobuf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/iomap.h b/src/include/ipxe/iomap.h index 7d1547d9c..23153641e 100644 --- a/src/include/ipxe/iomap.h +++ b/src/include/ipxe/iomap.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/iomap_virt.h b/src/include/ipxe/iomap_virt.h index 3dd66bd75..a2564ec76 100644 --- a/src/include/ipxe/iomap_virt.h +++ b/src/include/ipxe/iomap_virt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ip.h b/src/include/ipxe/ip.h index e2cd512ac..3a5c3e175 100644 --- a/src/include/ipxe/ip.h +++ b/src/include/ipxe/ip.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ipstat.h b/src/include/ipxe/ipstat.h index b34ed5fcf..b02673dcd 100644 --- a/src/include/ipxe/ipstat.h +++ b/src/include/ipxe/ipstat.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/ipv6.h b/src/include/ipxe/ipv6.h index 4dd43f16d..bd7181e69 100644 --- a/src/include/ipxe/ipv6.h +++ b/src/include/ipxe/ipv6.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/iscsi.h b/src/include/ipxe/iscsi.h index a25eec257..e890e62ad 100644 --- a/src/include/ipxe/iscsi.h +++ b/src/include/ipxe/iscsi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/iso9660.h b/src/include/ipxe/iso9660.h index 34cb8f0a1..6727c7721 100644 --- a/src/include/ipxe/iso9660.h +++ b/src/include/ipxe/iso9660.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/job.h b/src/include/ipxe/job.h index c01bd1740..088012ba7 100644 --- a/src/include/ipxe/job.h +++ b/src/include/ipxe/job.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/jumpscroll.h b/src/include/ipxe/jumpscroll.h index 470f08e71..0eec1b47b 100644 --- a/src/include/ipxe/jumpscroll.h +++ b/src/include/ipxe/jumpscroll.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/keymap.h b/src/include/ipxe/keymap.h index 49a8915ef..cdb83e03b 100644 --- a/src/include/ipxe/keymap.h +++ b/src/include/ipxe/keymap.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/keys.h b/src/include/ipxe/keys.h index 38ebd7d1a..b2a62744e 100644 --- a/src/include/ipxe/keys.h +++ b/src/include/ipxe/keys.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* * Symbolic names for some standard ASCII characters diff --git a/src/include/ipxe/linebuf.h b/src/include/ipxe/linebuf.h index 630278a04..b46168415 100644 --- a/src/include/ipxe/linebuf.h +++ b/src/include/ipxe/linebuf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/linux/linux_acpi.h b/src/include/ipxe/linux/linux_acpi.h index a2c33ce2c..f6dbc9252 100644 --- a/src/include/ipxe/linux/linux_acpi.h +++ b/src/include/ipxe/linux/linux_acpi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef ACPI_LINUX #define ACPI_PREFIX_linux diff --git a/src/include/ipxe/linux/linux_nap.h b/src/include/ipxe/linux/linux_nap.h index d072886c7..329124e52 100644 --- a/src/include/ipxe/linux/linux_nap.h +++ b/src/include/ipxe/linux/linux_nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef NAP_LINUX #define NAP_PREFIX_linux diff --git a/src/include/ipxe/linux/linux_pci.h b/src/include/ipxe/linux/linux_pci.h index f9cd98819..b0fddc41a 100644 --- a/src/include/ipxe/linux/linux_pci.h +++ b/src/include/ipxe/linux/linux_pci.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef PCIAPI_LINUX #define PCIAPI_PREFIX_linux diff --git a/src/include/ipxe/linux/linux_smbios.h b/src/include/ipxe/linux/linux_smbios.h index 16c6d8acd..32f006b66 100644 --- a/src/include/ipxe/linux/linux_smbios.h +++ b/src/include/ipxe/linux/linux_smbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SMBIOS_LINUX #define SMBIOS_PREFIX_linux diff --git a/src/include/ipxe/linux/linux_time.h b/src/include/ipxe/linux/linux_time.h index 872ef5ade..cf02452d7 100644 --- a/src/include/ipxe/linux/linux_time.h +++ b/src/include/ipxe/linux/linux_time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef TIME_LINUX #define TIME_PREFIX_linux diff --git a/src/include/ipxe/linux/linux_uaccess.h b/src/include/ipxe/linux/linux_uaccess.h index 7770ea90e..c3119a60e 100644 --- a/src/include/ipxe/linux/linux_uaccess.h +++ b/src/include/ipxe/linux/linux_uaccess.h @@ -13,6 +13,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef UACCESS_LINUX #define UACCESS_PREFIX_linux diff --git a/src/include/ipxe/linux/linux_umalloc.h b/src/include/ipxe/linux/linux_umalloc.h index 1811d0bc6..c1669b42a 100644 --- a/src/include/ipxe/linux/linux_umalloc.h +++ b/src/include/ipxe/linux/linux_umalloc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef UMALLOC_LINUX #define UMALLOC_PREFIX_linux diff --git a/src/include/ipxe/list.h b/src/include/ipxe/list.h index 2f02e71f0..4282d8455 100644 --- a/src/include/ipxe/list.h +++ b/src/include/ipxe/list.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/lldp.h b/src/include/ipxe/lldp.h index 9951d3b8f..7d4e7f6cf 100644 --- a/src/include/ipxe/lldp.h +++ b/src/include/ipxe/lldp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/login_ui.h b/src/include/ipxe/login_ui.h index 313e07349..2924a2f63 100644 --- a/src/include/ipxe/login_ui.h +++ b/src/include/ipxe/login_ui.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int login_ui ( void ); diff --git a/src/include/ipxe/malloc.h b/src/include/ipxe/malloc.h index d3f056c15..fac46bd00 100644 --- a/src/include/ipxe/malloc.h +++ b/src/include/ipxe/malloc.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* * Prototypes for the standard functions (malloc() et al) are in diff --git a/src/include/ipxe/md5.h b/src/include/ipxe/md5.h index 527ad3658..275e63824 100644 --- a/src/include/ipxe/md5.h +++ b/src/include/ipxe/md5.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/memmap.h b/src/include/ipxe/memmap.h index c16e25daa..4a768f867 100644 --- a/src/include/ipxe/memmap.h +++ b/src/include/ipxe/memmap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/message.h b/src/include/ipxe/message.h index e2e783740..997135d70 100644 --- a/src/include/ipxe/message.h +++ b/src/include/ipxe/message.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern void msg ( unsigned int row, const char *fmt, ... ); extern void clearmsg ( unsigned int row ); diff --git a/src/include/ipxe/monojob.h b/src/include/ipxe/monojob.h index 1661d91c2..cda27616a 100644 --- a/src/include/ipxe/monojob.h +++ b/src/include/ipxe/monojob.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct interface; diff --git a/src/include/ipxe/nap.h b/src/include/ipxe/nap.h index 8d5d8e3df..eff5ad5b9 100644 --- a/src/include/ipxe/nap.h +++ b/src/include/ipxe/nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ndp.h b/src/include/ipxe/ndp.h index d06672ec1..0c8a9a27d 100644 --- a/src/include/ipxe/ndp.h +++ b/src/include/ipxe/ndp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/neighbour.h b/src/include/ipxe/neighbour.h index e0701f6e3..d400bb93a 100644 --- a/src/include/ipxe/neighbour.h +++ b/src/include/ipxe/neighbour.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/netdevice.h b/src/include/ipxe/netdevice.h index 17695d5b6..62f0dd1f7 100644 --- a/src/include/ipxe/netdevice.h +++ b/src/include/ipxe/netdevice.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ntlm.h b/src/include/ipxe/ntlm.h index b0436c9ac..867f5ddc3 100644 --- a/src/include/ipxe/ntlm.h +++ b/src/include/ipxe/ntlm.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/null_acpi.h b/src/include/ipxe/null_acpi.h index 18f059964..dd3992630 100644 --- a/src/include/ipxe/null_acpi.h +++ b/src/include/ipxe/null_acpi.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/null_memmap.h b/src/include/ipxe/null_memmap.h index 0933d45be..122280d14 100644 --- a/src/include/ipxe/null_memmap.h +++ b/src/include/ipxe/null_memmap.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef MEMMAP_NULL #define MEMMAP_PREFIX_null diff --git a/src/include/ipxe/null_nap.h b/src/include/ipxe/null_nap.h index 17145b48b..3f4fc13ae 100644 --- a/src/include/ipxe/null_nap.h +++ b/src/include/ipxe/null_nap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef NAP_NULL #define NAP_PREFIX_null diff --git a/src/include/ipxe/null_pci.h b/src/include/ipxe/null_pci.h index 0cdcdc109..1e7b4da60 100644 --- a/src/include/ipxe/null_pci.h +++ b/src/include/ipxe/null_pci.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef PCIAPI_NULL #define PCIAPI_PREFIX_null diff --git a/src/include/ipxe/null_reboot.h b/src/include/ipxe/null_reboot.h index 5de38afc0..47539300a 100644 --- a/src/include/ipxe/null_reboot.h +++ b/src/include/ipxe/null_reboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef REBOOT_NULL #define REBOOT_PREFIX_null diff --git a/src/include/ipxe/null_sanboot.h b/src/include/ipxe/null_sanboot.h index b0e36b8b0..d455edbd6 100644 --- a/src/include/ipxe/null_sanboot.h +++ b/src/include/ipxe/null_sanboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SANBOOT_NULL #define SANBOOT_PREFIX_null diff --git a/src/include/ipxe/null_smbios.h b/src/include/ipxe/null_smbios.h index c430dd089..474398b3c 100644 --- a/src/include/ipxe/null_smbios.h +++ b/src/include/ipxe/null_smbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef SMBIOS_NULL #define SMBIOS_PREFIX_null diff --git a/src/include/ipxe/null_time.h b/src/include/ipxe/null_time.h index c670a5fce..db85769f7 100644 --- a/src/include/ipxe/null_time.h +++ b/src/include/ipxe/null_time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef TIME_NULL #define TIME_PREFIX_null diff --git a/src/include/ipxe/nvo.h b/src/include/ipxe/nvo.h index 7a3c7a3db..39e3a707d 100644 --- a/src/include/ipxe/nvo.h +++ b/src/include/ipxe/nvo.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/nvs.h b/src/include/ipxe/nvs.h index 5789f4c0d..1b02acea6 100644 --- a/src/include/ipxe/nvs.h +++ b/src/include/ipxe/nvs.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/open.h b/src/include/ipxe/open.h index 64e12d177..f429cadbe 100644 --- a/src/include/ipxe/open.h +++ b/src/include/ipxe/open.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/params.h b/src/include/ipxe/params.h index 61e46e029..64008380e 100644 --- a/src/include/ipxe/params.h +++ b/src/include/ipxe/params.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/parseopt.h b/src/include/ipxe/parseopt.h index 5c449cd42..dec230b0f 100644 --- a/src/include/ipxe/parseopt.h +++ b/src/include/ipxe/parseopt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pci.h b/src/include/ipxe/pci.h index 2728cbd45..44095afe2 100644 --- a/src/include/ipxe/pci.h +++ b/src/include/ipxe/pci.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pci_io.h b/src/include/ipxe/pci_io.h index 7ac09efb0..e67832fec 100644 --- a/src/include/ipxe/pci_io.h +++ b/src/include/ipxe/pci_io.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pcicloud.h b/src/include/ipxe/pcicloud.h index 52268908c..19d5147be 100644 --- a/src/include/ipxe/pcicloud.h +++ b/src/include/ipxe/pcicloud.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef PCIAPI_CLOUD #define PCIAPI_PREFIX_cloud diff --git a/src/include/ipxe/pending.h b/src/include/ipxe/pending.h index be6ed05a1..1ed10df18 100644 --- a/src/include/ipxe/pending.h +++ b/src/include/ipxe/pending.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** A pending operation */ struct pending_operation { diff --git a/src/include/ipxe/ping.h b/src/include/ipxe/ping.h index c55bd1ab2..7a45f1ab7 100644 --- a/src/include/ipxe/ping.h +++ b/src/include/ipxe/ping.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pool.h b/src/include/ipxe/pool.h index 81ff57d75..fbd8567a9 100644 --- a/src/include/ipxe/pool.h +++ b/src/include/ipxe/pool.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/process.h b/src/include/ipxe/process.h index d5e13aa04..0ec94f9bc 100644 --- a/src/include/ipxe/process.h +++ b/src/include/ipxe/process.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/profile.h b/src/include/ipxe/profile.h index fd45b3cdc..c7e6d54f2 100644 --- a/src/include/ipxe/profile.h +++ b/src/include/ipxe/profile.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/quiesce.h b/src/include/ipxe/quiesce.h index 00b530b83..a43628de0 100644 --- a/src/include/ipxe/quiesce.h +++ b/src/include/ipxe/quiesce.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/reboot.h b/src/include/ipxe/reboot.h index cfd5b546d..361988ff1 100644 --- a/src/include/ipxe/reboot.h +++ b/src/include/ipxe/reboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/refcnt.h b/src/include/ipxe/refcnt.h index 7f489abc9..dff67bf58 100644 --- a/src/include/ipxe/refcnt.h +++ b/src/include/ipxe/refcnt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/resolv.h b/src/include/ipxe/resolv.h index ff48d35ca..3f26577c6 100644 --- a/src/include/ipxe/resolv.h +++ b/src/include/ipxe/resolv.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/retry.h b/src/include/ipxe/retry.h index 76d45fbd0..6817bf4c9 100644 --- a/src/include/ipxe/retry.h +++ b/src/include/ipxe/retry.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/rotate.h b/src/include/ipxe/rotate.h index 4dea09aeb..77a87dffd 100644 --- a/src/include/ipxe/rotate.h +++ b/src/include/ipxe/rotate.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/sanboot.h b/src/include/ipxe/sanboot.h index 9d5fceee0..ea44191c2 100644 --- a/src/include/ipxe/sanboot.h +++ b/src/include/ipxe/sanboot.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/sbat.h b/src/include/ipxe/sbat.h index 4b74670ed..b708215c1 100644 --- a/src/include/ipxe/sbat.h +++ b/src/include/ipxe/sbat.h @@ -19,6 +19,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * A single line within an SBAT CSV file diff --git a/src/include/ipxe/script.h b/src/include/ipxe/script.h index 7e7a9a3a4..59a42c66f 100644 --- a/src/include/ipxe/script.h +++ b/src/include/ipxe/script.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/scsi.h b/src/include/ipxe/scsi.h index 9bb38a059..858f63547 100644 --- a/src/include/ipxe/scsi.h +++ b/src/include/ipxe/scsi.h @@ -11,6 +11,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Maximum block for READ/WRITE (10) commands */ #define SCSI_MAX_BLOCK_10 0xffffffffULL diff --git a/src/include/ipxe/settings.h b/src/include/ipxe/settings.h index 689e011d3..1582aaa8f 100644 --- a/src/include/ipxe/settings.h +++ b/src/include/ipxe/settings.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/settings_ui.h b/src/include/ipxe/settings_ui.h index 0bf21935d..41e3351bc 100644 --- a/src/include/ipxe/settings_ui.h +++ b/src/include/ipxe/settings_ui.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct settings; diff --git a/src/include/ipxe/shell.h b/src/include/ipxe/shell.h index 0d574e028..cbea7b319 100644 --- a/src/include/ipxe/shell.h +++ b/src/include/ipxe/shell.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Shell stop states */ enum shell_stop_state { diff --git a/src/include/ipxe/smbios.h b/src/include/ipxe/smbios.h index d9e2c38ed..5e431504a 100644 --- a/src/include/ipxe/smbios.h +++ b/src/include/ipxe/smbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/socket.h b/src/include/ipxe/socket.h index 8c70ea4c0..f0e80a712 100644 --- a/src/include/ipxe/socket.h +++ b/src/include/ipxe/socket.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/srp.h b/src/include/ipxe/srp.h index 1f66a22b2..c2450038f 100644 --- a/src/include/ipxe/srp.h +++ b/src/include/ipxe/srp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( BSD2 ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/stp.h b/src/include/ipxe/stp.h index 3d85e5ba4..b30e09d20 100644 --- a/src/include/ipxe/stp.h +++ b/src/include/ipxe/stp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/string.h b/src/include/ipxe/string.h index a8cbe8faa..593ced230 100644 --- a/src/include/ipxe/string.h +++ b/src/include/ipxe/string.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern unsigned int digit_value ( unsigned int digit ); diff --git a/src/include/ipxe/tables.h b/src/include/ipxe/tables.h index ac17f4b4b..d0f88cf56 100644 --- a/src/include/ipxe/tables.h +++ b/src/include/ipxe/tables.h @@ -2,6 +2,7 @@ #define _IPXE_TABLES_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @page ifdef_harmful #ifdef considered harmful * diff --git a/src/include/ipxe/tcp.h b/src/include/ipxe/tcp.h index a1e89f718..14e8169e0 100644 --- a/src/include/ipxe/tcp.h +++ b/src/include/ipxe/tcp.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/tcpip.h b/src/include/ipxe/tcpip.h index 414daad53..cfee7aa1e 100644 --- a/src/include/ipxe/tcpip.h +++ b/src/include/ipxe/tcpip.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/tftp.h b/src/include/ipxe/tftp.h index e3661e1ac..fa029e234 100644 --- a/src/include/ipxe/tftp.h +++ b/src/include/ipxe/tftp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/time.h b/src/include/ipxe/time.h index 89bf90e03..1b6f5daff 100644 --- a/src/include/ipxe/time.h +++ b/src/include/ipxe/time.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/timer.h b/src/include/ipxe/timer.h index a6dffaf1c..72ddc9d28 100644 --- a/src/include/ipxe/timer.h +++ b/src/include/ipxe/timer.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/uaccess.h b/src/include/ipxe/uaccess.h index d97db95be..1b0dc9de7 100644 --- a/src/include/ipxe/uaccess.h +++ b/src/include/ipxe/uaccess.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/udp.h b/src/include/ipxe/udp.h index 7b0de4dc0..693b2a422 100644 --- a/src/include/ipxe/udp.h +++ b/src/include/ipxe/udp.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/uheap.h b/src/include/ipxe/uheap.h index d356786d3..0d37a649a 100644 --- a/src/include/ipxe/uheap.h +++ b/src/include/ipxe/uheap.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef UMALLOC_UHEAP #define UMALLOC_PREFIX_uheap diff --git a/src/include/ipxe/umalloc.h b/src/include/ipxe/umalloc.h index da6c34143..c2a13dfdf 100644 --- a/src/include/ipxe/umalloc.h +++ b/src/include/ipxe/umalloc.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/uri.h b/src/include/ipxe/uri.h index a94b525e1..0de0135e4 100644 --- a/src/include/ipxe/uri.h +++ b/src/include/ipxe/uri.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/usb.h b/src/include/ipxe/usb.h index d9891b757..9b8c7ae00 100644 --- a/src/include/ipxe/usb.h +++ b/src/include/ipxe/usb.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/utf8.h b/src/include/ipxe/utf8.h index 299c25511..10b2fcbd6 100644 --- a/src/include/ipxe/utf8.h +++ b/src/include/ipxe/utf8.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/uuid.h b/src/include/ipxe/uuid.h index 4874b7382..d0120741d 100644 --- a/src/include/ipxe/uuid.h +++ b/src/include/ipxe/uuid.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/version.h b/src/include/ipxe/version.h index a43a33425..6be6096dc 100644 --- a/src/include/ipxe/version.h +++ b/src/include/ipxe/version.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/virt_offset.h b/src/include/ipxe/virt_offset.h index 2762acb40..31c434fc5 100644 --- a/src/include/ipxe/virt_offset.h +++ b/src/include/ipxe/virt_offset.h @@ -47,6 +47,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #ifdef UACCESS_OFFSET #define UACCESS_PREFIX_offset diff --git a/src/include/ipxe/vlan.h b/src/include/ipxe/vlan.h index 20bbc891d..a1cd76182 100644 --- a/src/include/ipxe/vlan.h +++ b/src/include/ipxe/vlan.h @@ -9,6 +9,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/vsprintf.h b/src/include/ipxe/vsprintf.h index 9e6297715..8b25422d8 100644 --- a/src/include/ipxe/vsprintf.h +++ b/src/include/ipxe/vsprintf.h @@ -32,6 +32,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/widget.h b/src/include/ipxe/widget.h index 945b4672a..6e61a8ca8 100644 --- a/src/include/ipxe/widget.h +++ b/src/include/ipxe/widget.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/xfer.h b/src/include/ipxe/xfer.h index 3a35fa924..c35be31d9 100644 --- a/src/include/ipxe/xfer.h +++ b/src/include/ipxe/xfer.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/xferbuf.h b/src/include/ipxe/xferbuf.h index 04fcf2286..aa0b2471f 100644 --- a/src/include/ipxe/xferbuf.h +++ b/src/include/ipxe/xferbuf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/libgen.h b/src/include/libgen.h index ae0861270..b686b15ac 100644 --- a/src/include/libgen.h +++ b/src/include/libgen.h @@ -2,6 +2,7 @@ #define _LIBGEN_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern char * basename ( char *path ); extern char * dirname ( char *path ); diff --git a/src/include/readline/readline.h b/src/include/readline/readline.h index 3caf28b47..a2a1d950a 100644 --- a/src/include/readline/readline.h +++ b/src/include/readline/readline.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** A readline history entry */ struct readline_history_entry { diff --git a/src/include/stdarg.h b/src/include/stdarg.h index 89e94ce22..a981ea24a 100644 --- a/src/include/stdarg.h +++ b/src/include/stdarg.h @@ -2,6 +2,7 @@ #define _STDARG_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); typedef __builtin_va_list va_list; #define va_start( ap, last ) __builtin_va_start ( ap, last ) diff --git a/src/include/stdbool.h b/src/include/stdbool.h index c49a7f192..6afd038db 100644 --- a/src/include/stdbool.h +++ b/src/include/stdbool.h @@ -2,6 +2,7 @@ #define _STDBOOL_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #define bool _Bool #define true 1 diff --git a/src/include/stddef.h b/src/include/stddef.h index fb01c489d..7f46a7729 100644 --- a/src/include/stddef.h +++ b/src/include/stddef.h @@ -2,6 +2,7 @@ #define STDDEF_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/stdint.h b/src/include/stdint.h index 0a239a517..2fcd184fa 100644 --- a/src/include/stdint.h +++ b/src/include/stdint.h @@ -2,6 +2,7 @@ #define _STDINT_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* * This is a standard predefined macro on all gcc's I've seen. It's diff --git a/src/include/stdio.h b/src/include/stdio.h index ac17da83d..5dfa67865 100644 --- a/src/include/stdio.h +++ b/src/include/stdio.h @@ -2,6 +2,7 @@ #define _STDIO_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/stdlib.h b/src/include/stdlib.h index d7748a07e..8a531110e 100644 --- a/src/include/stdlib.h +++ b/src/include/stdlib.h @@ -2,6 +2,7 @@ #define STDLIB_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/string.h b/src/include/string.h index 4ee9c7344..3affe8e86 100644 --- a/src/include/string.h +++ b/src/include/string.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/strings.h b/src/include/strings.h index d7e9d6971..8eac3e5e4 100644 --- a/src/include/strings.h +++ b/src/include/strings.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/sys/time.h b/src/include/sys/time.h index 6e2a24447..e49df570f 100644 --- a/src/include/sys/time.h +++ b/src/include/sys/time.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/syslog.h b/src/include/syslog.h index 748a4faec..09c0112fd 100644 --- a/src/include/syslog.h +++ b/src/include/syslog.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/time.h b/src/include/time.h index ab93a3dbb..5ef67ece2 100644 --- a/src/include/time.h +++ b/src/include/time.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/unistd.h b/src/include/unistd.h index 6c31c0601..56431d15e 100644 --- a/src/include/unistd.h +++ b/src/include/unistd.h @@ -2,6 +2,7 @@ #define _UNISTD_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/usr/autoboot.h b/src/include/usr/autoboot.h index a081a70df..fbc8b10e9 100644 --- a/src/include/usr/autoboot.h +++ b/src/include/usr/autoboot.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/dhcpmgmt.h b/src/include/usr/dhcpmgmt.h index ed669eb9d..2440b1713 100644 --- a/src/include/usr/dhcpmgmt.h +++ b/src/include/usr/dhcpmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct net_device; diff --git a/src/include/usr/ifmgmt.h b/src/include/usr/ifmgmt.h index 8d8a6bb56..3b489c02a 100644 --- a/src/include/usr/ifmgmt.h +++ b/src/include/usr/ifmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); struct net_device; struct net_device_configurator; diff --git a/src/include/usr/imgmgmt.h b/src/include/usr/imgmgmt.h index 506c3eb14..f98af7984 100644 --- a/src/include/usr/imgmgmt.h +++ b/src/include/usr/imgmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/prompt.h b/src/include/usr/prompt.h index 8d3eeee3c..22c39105f 100644 --- a/src/include/usr/prompt.h +++ b/src/include/usr/prompt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int prompt ( const char *text, unsigned long timeout, int key ); diff --git a/src/include/usr/route.h b/src/include/usr/route.h index 7ec4a3509..7503c8c55 100644 --- a/src/include/usr/route.h +++ b/src/include/usr/route.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/shimmgmt.h b/src/include/usr/shimmgmt.h index 0c59f54a8..0ed85c468 100644 --- a/src/include/usr/shimmgmt.h +++ b/src/include/usr/shimmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/sync.h b/src/include/usr/sync.h index b6f12ad6e..b24ab32fb 100644 --- a/src/include/usr/sync.h +++ b/src/include/usr/sync.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int sync ( unsigned long timeout ); diff --git a/src/include/valgrind/memcheck.h b/src/include/valgrind/memcheck.h index 7d4b56d31..e7fae01ed 100644 --- a/src/include/valgrind/memcheck.h +++ b/src/include/valgrind/memcheck.h @@ -61,6 +61,7 @@ #define __MEMCHECK_H FILE_LICENCE ( BSD3 ); +FILE_SECBOOT ( PERMITTED ); /* This file is for inclusion into client (your!) code. diff --git a/src/include/valgrind/valgrind.h b/src/include/valgrind/valgrind.h index d48bbccae..1a907cbbf 100644 --- a/src/include/valgrind/valgrind.h +++ b/src/include/valgrind/valgrind.h @@ -74,6 +74,7 @@ #define __VALGRIND_H FILE_LICENCE ( BSD3 ); +FILE_SECBOOT ( PERMITTED ); /* ------------------------------------------------------------------ */ diff --git a/src/include/wchar.h b/src/include/wchar.h index a7e9de4f2..427bfff7a 100644 --- a/src/include/wchar.h +++ b/src/include/wchar.h @@ -2,6 +2,7 @@ #define WCHAR_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/interface/efi/efi_acpi.c b/src/interface/efi/efi_acpi.c index a2021a4f6..cb8b4a5d0 100644 --- a/src/interface/efi/efi_acpi.c +++ b/src/interface/efi/efi_acpi.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_autoboot.c b/src/interface/efi/efi_autoboot.c index e52c857d8..9e0c3e42e 100644 --- a/src/interface/efi/efi_autoboot.c +++ b/src/interface/efi/efi_autoboot.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_autoexec.c b/src/interface/efi/efi_autoexec.c index 73ba5df33..b63ac1602 100644 --- a/src/interface/efi/efi_autoexec.c +++ b/src/interface/efi/efi_autoexec.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_block.c b/src/interface/efi/efi_block.c index 10952ef8a..0da92307b 100644 --- a/src/interface/efi/efi_block.c +++ b/src/interface/efi/efi_block.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_cachedhcp.c b/src/interface/efi/efi_cachedhcp.c index 6bba4173a..2f33fcefb 100644 --- a/src/interface/efi/efi_cachedhcp.c +++ b/src/interface/efi/efi_cachedhcp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_cmdline.c b/src/interface/efi/efi_cmdline.c index 8b9d8efde..f5844f2ad 100644 --- a/src/interface/efi/efi_cmdline.c +++ b/src/interface/efi/efi_cmdline.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/interface/efi/efi_connect.c b/src/interface/efi/efi_connect.c index 5aa8dc689..f4747cf6b 100644 --- a/src/interface/efi/efi_connect.c +++ b/src/interface/efi/efi_connect.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/interface/efi/efi_console.c b/src/interface/efi/efi_console.c index e896c5d88..afbd722ab 100644 --- a/src/interface/efi/efi_console.c +++ b/src/interface/efi/efi_console.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_download.c b/src/interface/efi/efi_download.c index 8d12bd57c..1c2f13573 100644 --- a/src/interface/efi/efi_download.c +++ b/src/interface/efi/efi_download.c @@ -17,6 +17,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_driver.c b/src/interface/efi/efi_driver.c index b1ff404be..cb07af401 100644 --- a/src/interface/efi/efi_driver.c +++ b/src/interface/efi/efi_driver.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_file.c b/src/interface/efi/efi_file.c index 1909dea10..2f49b1a99 100644 --- a/src/interface/efi/efi_file.c +++ b/src/interface/efi/efi_file.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_guid.c b/src/interface/efi/efi_guid.c index 135eeb881..c989aebfe 100644 --- a/src/interface/efi/efi_guid.c +++ b/src/interface/efi/efi_guid.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_hii.c b/src/interface/efi/efi_hii.c index 66f58affe..fd65ae122 100644 --- a/src/interface/efi/efi_hii.c +++ b/src/interface/efi/efi_hii.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_init.c b/src/interface/efi/efi_init.c index 69aea0d50..ac62ea747 100644 --- a/src/interface/efi/efi_init.c +++ b/src/interface/efi/efi_init.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_local.c b/src/interface/efi/efi_local.c index 4564470fc..58a5f689f 100644 --- a/src/interface/efi/efi_local.c +++ b/src/interface/efi/efi_local.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_nap.c b/src/interface/efi/efi_nap.c index 2bb47627f..9d97dae6e 100644 --- a/src/interface/efi/efi_nap.c +++ b/src/interface/efi/efi_nap.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_null.c b/src/interface/efi/efi_null.c index d0f0428cc..fb9ee1780 100644 --- a/src/interface/efi/efi_null.c +++ b/src/interface/efi/efi_null.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_open.c b/src/interface/efi/efi_open.c index 8f8af4ea0..679d1946e 100644 --- a/src/interface/efi/efi_open.c +++ b/src/interface/efi/efi_open.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/interface/efi/efi_path.c b/src/interface/efi/efi_path.c index dd0df67e5..37558c36e 100644 --- a/src/interface/efi/efi_path.c +++ b/src/interface/efi/efi_path.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_pci.c b/src/interface/efi/efi_pci.c index f4853c234..4bf3977c5 100644 --- a/src/interface/efi/efi_pci.c +++ b/src/interface/efi/efi_pci.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_pxe.c b/src/interface/efi/efi_pxe.c index 4ba057019..2d1a6fd73 100644 --- a/src/interface/efi/efi_pxe.c +++ b/src/interface/efi/efi_pxe.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_reboot.c b/src/interface/efi/efi_reboot.c index 7ed9f5c84..cc35ef7ad 100644 --- a/src/interface/efi/efi_reboot.c +++ b/src/interface/efi/efi_reboot.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_service.c b/src/interface/efi/efi_service.c index f10733b24..4e2f2e951 100644 --- a/src/interface/efi/efi_service.c +++ b/src/interface/efi/efi_service.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/interface/efi/efi_settings.c b/src/interface/efi/efi_settings.c index 5ddbe12f1..95fe2c03c 100644 --- a/src/interface/efi/efi_settings.c +++ b/src/interface/efi/efi_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_shim.c b/src/interface/efi/efi_shim.c index 4bb6df79f..553cb2721 100644 --- a/src/interface/efi/efi_shim.c +++ b/src/interface/efi/efi_shim.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include @@ -40,6 +41,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Require use of a third party loader binary diff --git a/src/interface/efi/efi_smbios.c b/src/interface/efi/efi_smbios.c index 5d0e69d6b..c10ba1440 100644 --- a/src/interface/efi/efi_smbios.c +++ b/src/interface/efi/efi_smbios.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_snp.c b/src/interface/efi/efi_snp.c index 86ad87bde..dad8b33df 100644 --- a/src/interface/efi/efi_snp.c +++ b/src/interface/efi/efi_snp.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_snp_hii.c b/src/interface/efi/efi_snp_hii.c index 8b65c8a78..25287673a 100644 --- a/src/interface/efi/efi_snp_hii.c +++ b/src/interface/efi/efi_snp_hii.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_strings.c b/src/interface/efi/efi_strings.c index 765b23ca6..3dae22e41 100644 --- a/src/interface/efi/efi_strings.c +++ b/src/interface/efi/efi_strings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_table.c b/src/interface/efi/efi_table.c index 3c3f35a4b..da5966a13 100644 --- a/src/interface/efi/efi_table.c +++ b/src/interface/efi/efi_table.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_time.c b/src/interface/efi/efi_time.c index 983a0ef5c..a4c77da20 100644 --- a/src/interface/efi/efi_time.c +++ b/src/interface/efi/efi_time.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_timer.c b/src/interface/efi/efi_timer.c index 6427eb1d8..ffb899c86 100644 --- a/src/interface/efi/efi_timer.c +++ b/src/interface/efi/efi_timer.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_umalloc.c b/src/interface/efi/efi_umalloc.c index 419d9b294..257b27bec 100644 --- a/src/interface/efi/efi_umalloc.c +++ b/src/interface/efi/efi_umalloc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_utils.c b/src/interface/efi/efi_utils.c index 51da06172..a7008afd4 100644 --- a/src/interface/efi/efi_utils.c +++ b/src/interface/efi/efi_utils.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_veto.c b/src/interface/efi/efi_veto.c index da585db60..788515dd1 100644 --- a/src/interface/efi/efi_veto.c +++ b/src/interface/efi/efi_veto.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_watchdog.c b/src/interface/efi/efi_watchdog.c index dcc9a5668..5e4eb626c 100644 --- a/src/interface/efi/efi_watchdog.c +++ b/src/interface/efi/efi_watchdog.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_wrap.c b/src/interface/efi/efi_wrap.c index 320a32f02..572d05aac 100644 --- a/src/interface/efi/efi_wrap.c +++ b/src/interface/efi/efi_wrap.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efiprefix.c b/src/interface/efi/efiprefix.c index 64122185a..3c095afdc 100644 --- a/src/interface/efi/efiprefix.c +++ b/src/interface/efi/efiprefix.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/smbios/smbios.c b/src/interface/smbios/smbios.c index 3a1a98b17..a23d9bfa2 100644 --- a/src/interface/smbios/smbios.c +++ b/src/interface/smbios/smbios.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/smbios/smbios_settings.c b/src/interface/smbios/smbios_settings.c index 6358a4709..d0ef49d5f 100644 --- a/src/interface/smbios/smbios_settings.c +++ b/src/interface/smbios/smbios_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/aoe.c b/src/net/aoe.c index b484bdd33..edeb81867 100644 --- a/src/net/aoe.c +++ b/src/net/aoe.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/arp.c b/src/net/arp.c index c9b4109a9..2bf3c12ec 100644 --- a/src/net/arp.c +++ b/src/net/arp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/dhcpopts.c b/src/net/dhcpopts.c index cdb632b46..844a94d62 100644 --- a/src/net/dhcpopts.c +++ b/src/net/dhcpopts.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/dhcppkt.c b/src/net/dhcppkt.c index 4e64f85e4..a9b454695 100644 --- a/src/net/dhcppkt.c +++ b/src/net/dhcppkt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/eap.c b/src/net/eap.c index 87327d723..040566b57 100644 --- a/src/net/eap.c +++ b/src/net/eap.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/eap_md5.c b/src/net/eap_md5.c index 0664174f9..1e263c8ec 100644 --- a/src/net/eap_md5.c +++ b/src/net/eap_md5.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/eapol.c b/src/net/eapol.c index 0c573d198..d83d63386 100644 --- a/src/net/eapol.c +++ b/src/net/eapol.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/eth_slow.c b/src/net/eth_slow.c index 1103a49f3..fb4e0d972 100644 --- a/src/net/eth_slow.c +++ b/src/net/eth_slow.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/ethernet.c b/src/net/ethernet.c index 3fcdafe6d..60219b98f 100644 --- a/src/net/ethernet.c +++ b/src/net/ethernet.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/fakedhcp.c b/src/net/fakedhcp.c index 009b12c56..0020d8225 100644 --- a/src/net/fakedhcp.c +++ b/src/net/fakedhcp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/fragment.c b/src/net/fragment.c index 781b9bc60..4976167ed 100644 --- a/src/net/fragment.c +++ b/src/net/fragment.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/icmp.c b/src/net/icmp.c index 5371277e4..740b42440 100644 --- a/src/net/icmp.c +++ b/src/net/icmp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/icmpv4.c b/src/net/icmpv4.c index 0858ff37f..ffcc4b375 100644 --- a/src/net/icmpv4.c +++ b/src/net/icmpv4.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/icmpv6.c b/src/net/icmpv6.c index 8555aaf0b..5331b81e8 100644 --- a/src/net/icmpv6.c +++ b/src/net/icmpv6.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/iobpad.c b/src/net/iobpad.c index 936b4bde4..6366efb5e 100644 --- a/src/net/iobpad.c +++ b/src/net/iobpad.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/ipv4.c b/src/net/ipv4.c index 21abfccec..f3dd44384 100644 --- a/src/net/ipv4.c +++ b/src/net/ipv4.c @@ -49,6 +49,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* Unique IP datagram identification number (high byte) */ static uint8_t next_ident_high = 0; diff --git a/src/net/ipv6.c b/src/net/ipv6.c index b12d6577e..7e908dd2a 100644 --- a/src/net/ipv6.c +++ b/src/net/ipv6.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/lldp.c b/src/net/lldp.c index 2b707c874..d0e990f23 100644 --- a/src/net/lldp.c +++ b/src/net/lldp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/net/ndp.c b/src/net/ndp.c index 3c555f4a3..6d96270c1 100644 --- a/src/net/ndp.c +++ b/src/net/ndp.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/neighbour.c b/src/net/neighbour.c index ac79041e3..fa8fba5cd 100644 --- a/src/net/neighbour.c +++ b/src/net/neighbour.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/netdev_settings.c b/src/net/netdev_settings.c index 90b804c6c..8bc8ce57b 100644 --- a/src/net/netdev_settings.c +++ b/src/net/netdev_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/netdevice.c b/src/net/netdevice.c index c89585708..0af916ff5 100644 --- a/src/net/netdevice.c +++ b/src/net/netdevice.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/nullnet.c b/src/net/nullnet.c index 2948b38c0..c665b203a 100644 --- a/src/net/nullnet.c +++ b/src/net/nullnet.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/retry.c b/src/net/retry.c index 734567be5..c13ecb6b1 100644 --- a/src/net/retry.c +++ b/src/net/retry.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/socket.c b/src/net/socket.c index 2009ab237..6fed73128 100644 --- a/src/net/socket.c +++ b/src/net/socket.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/stp.c b/src/net/stp.c index 3d78400af..d1b0d4862 100644 --- a/src/net/stp.c +++ b/src/net/stp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/tcp.c b/src/net/tcp.c index 2e52cf480..f08db5250 100644 --- a/src/net/tcp.c +++ b/src/net/tcp.c @@ -28,6 +28,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** A TCP connection */ struct tcp_connection { diff --git a/src/net/tcp/http.c b/src/net/tcp/http.c index b000ed80f..16cfd035e 100644 --- a/src/net/tcp/http.c +++ b/src/net/tcp/http.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/httpauth.c b/src/net/tcp/httpauth.c index 2c57e3d48..d682c5f8f 100644 --- a/src/net/tcp/httpauth.c +++ b/src/net/tcp/httpauth.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/httpbasic.c b/src/net/tcp/httpbasic.c index 52a67063d..4dffc7e0f 100644 --- a/src/net/tcp/httpbasic.c +++ b/src/net/tcp/httpbasic.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/httpblock.c b/src/net/tcp/httpblock.c index 8eff1942c..14398869e 100644 --- a/src/net/tcp/httpblock.c +++ b/src/net/tcp/httpblock.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/httpconn.c b/src/net/tcp/httpconn.c index 538c4dcf6..4b99209f0 100644 --- a/src/net/tcp/httpconn.c +++ b/src/net/tcp/httpconn.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/httpcore.c b/src/net/tcp/httpcore.c index 8fee0421c..912bea407 100644 --- a/src/net/tcp/httpcore.c +++ b/src/net/tcp/httpcore.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/httpdigest.c b/src/net/tcp/httpdigest.c index 4074078c7..8ff6dbfa5 100644 --- a/src/net/tcp/httpdigest.c +++ b/src/net/tcp/httpdigest.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/iscsi.c b/src/net/tcp/iscsi.c index b7b33a51a..0d1f0f645 100644 --- a/src/net/tcp/iscsi.c +++ b/src/net/tcp/iscsi.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/tcpip.c b/src/net/tcpip.c index cc7d02005..5ed3d68a9 100644 --- a/src/net/tcpip.c +++ b/src/net/tcpip.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * Process a received TCP/IP packet diff --git a/src/net/udp.c b/src/net/udp.c index 2c0b343dc..41aba2fca 100644 --- a/src/net/udp.c +++ b/src/net/udp.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * A UDP connection diff --git a/src/net/udp/dhcp.c b/src/net/udp/dhcp.c index daa37b96b..59b7c663d 100644 --- a/src/net/udp/dhcp.c +++ b/src/net/udp/dhcp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/udp/dhcpv6.c b/src/net/udp/dhcpv6.c index a49109894..43a569d6e 100644 --- a/src/net/udp/dhcpv6.c +++ b/src/net/udp/dhcpv6.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/udp/dns.c b/src/net/udp/dns.c index f46eeb5c8..3f534b99f 100644 --- a/src/net/udp/dns.c +++ b/src/net/udp/dns.c @@ -25,6 +25,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/udp/tftp.c b/src/net/udp/tftp.c index 2ee01862a..760af10e9 100644 --- a/src/net/udp/tftp.c +++ b/src/net/udp/tftp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/vlan.c b/src/net/vlan.c index c61bb850e..f7697a9be 100644 --- a/src/net/vlan.c +++ b/src/net/vlan.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/autoboot.c b/src/usr/autoboot.c index 4b64ca82b..3d46e65e0 100644 --- a/src/usr/autoboot.c +++ b/src/usr/autoboot.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/dhcpmgmt.c b/src/usr/dhcpmgmt.c index dcb360b23..2a0a8c718 100644 --- a/src/usr/dhcpmgmt.c +++ b/src/usr/dhcpmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/ifmgmt.c b/src/usr/ifmgmt.c index d87ffff27..80f350ee4 100644 --- a/src/usr/ifmgmt.c +++ b/src/usr/ifmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/imgmgmt.c b/src/usr/imgmgmt.c index 65b52fd3a..bad056f0e 100644 --- a/src/usr/imgmgmt.c +++ b/src/usr/imgmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/prompt.c b/src/usr/prompt.c index fca0a157c..ea233e2ed 100644 --- a/src/usr/prompt.c +++ b/src/usr/prompt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/usr/route.c b/src/usr/route.c index 690ba3b6b..77c68eeb3 100644 --- a/src/usr/route.c +++ b/src/usr/route.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/route_ipv4.c b/src/usr/route_ipv4.c index f79c0ad8f..21b0820da 100644 --- a/src/usr/route_ipv4.c +++ b/src/usr/route_ipv4.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/route_ipv6.c b/src/usr/route_ipv6.c index 9e94b4a15..9d773ec60 100644 --- a/src/usr/route_ipv6.c +++ b/src/usr/route_ipv6.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/shimmgmt.c b/src/usr/shimmgmt.c index 6ac1ac35e..fb063ad51 100644 --- a/src/usr/shimmgmt.c +++ b/src/usr/shimmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/sync.c b/src/usr/sync.c index f599588ae..1e740bd4c 100644 --- a/src/usr/sync.c +++ b/src/usr/sync.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include -- cgit v1.2.3-55-g7522 From adcaaf9b93f9de14ba93bea54aecef103fe16b5f Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 14 Jan 2026 14:36:49 +0000 Subject: [build] Mark known reviewed files as permitted for UEFI Secure Boot Some past security reviews carried out for UEFI Secure Boot signing submissions have covered specific drivers or functional areas of iPXE. Mark all of the files comprising these areas as permitted for UEFI Secure Boot. Signed-off-by: Michael Brown --- src/arch/x86/core/cpuid_settings.c | 1 + src/arch/x86/core/rdrand.c | 1 + src/arch/x86/include/bits/bigint.h | 1 + src/arch/x86/include/bits/bitops.h | 1 + src/arch/x86/include/bits/xen.h | 1 + src/config/config_archive.c | 1 + src/config/config_asn1.c | 1 + src/config/config_certs.c | 1 + src/config/config_crypto.c | 1 + src/config/config_digest_cmd.c | 1 + src/config/config_entropy.c | 1 + src/config/config_fc.c | 1 + src/config/config_fdt.c | 1 + src/config/config_infiniband.c | 1 + src/config/config_pixbuf.c | 1 + src/config/config_usb.c | 1 + src/config/crypto.h | 1 + src/config/entropy.h | 1 + src/config/fdt.h | 1 + src/config/usb.h | 1 + src/core/acpi_settings.c | 1 + src/core/acpimac.c | 1 + src/core/ansicoldef.c | 1 + src/core/fbcon.c | 1 + src/core/fdt.c | 1 + src/core/isqrt.c | 1 + src/core/lineconsole.c | 1 + src/core/netbios.c | 1 + src/core/pinger.c | 1 + src/core/pixbuf.c | 1 + src/core/profile.c | 1 + src/crypto/aes.c | 1 + src/crypto/asn1.c | 1 + src/crypto/bigint.c | 1 + src/crypto/cbc.c | 1 + src/crypto/certstore.c | 1 + src/crypto/cms.c | 1 + src/crypto/crypto_null.c | 1 + src/crypto/deflate.c | 1 + src/crypto/dhe.c | 1 + src/crypto/drbg.c | 1 + src/crypto/ecb.c | 1 + src/crypto/ecdhe.c | 1 + src/crypto/ecdsa.c | 1 + src/crypto/entropy.c | 1 + src/crypto/gcm.c | 1 + src/crypto/hash_df.c | 1 + src/crypto/hmac.c | 1 + src/crypto/hmac_drbg.c | 1 + src/crypto/md4.c | 1 + src/crypto/mishmash/cmd_sha224.c | 1 + src/crypto/mishmash/cmd_sha256.c | 1 + src/crypto/mishmash/cmd_sha384.c | 1 + src/crypto/mishmash/cmd_sha512.c | 1 + src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c | 1 + src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c | 1 + src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c | 1 + src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c | 1 + src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c | 1 + src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c | 1 + src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c | 1 + src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c | 1 + src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c | 1 + src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c | 1 + src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c | 1 + src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c | 1 + src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c | 1 + src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c | 1 + src/crypto/mishmash/ecdsa_sha224.c | 1 + src/crypto/mishmash/ecdsa_sha256.c | 1 + src/crypto/mishmash/ecdsa_sha384.c | 1 + src/crypto/mishmash/ecdsa_sha512.c | 1 + src/crypto/mishmash/oid_aes_cbc.c | 1 + src/crypto/mishmash/oid_aes_gcm.c | 1 + src/crypto/mishmash/oid_p256.c | 1 + src/crypto/mishmash/oid_p384.c | 1 + src/crypto/mishmash/oid_rsa.c | 1 + src/crypto/mishmash/oid_sha1.c | 1 + src/crypto/mishmash/oid_sha224.c | 1 + src/crypto/mishmash/oid_sha256.c | 1 + src/crypto/mishmash/oid_sha384.c | 1 + src/crypto/mishmash/oid_sha512.c | 1 + src/crypto/mishmash/oid_sha512_224.c | 1 + src/crypto/mishmash/oid_sha512_256.c | 1 + src/crypto/mishmash/oid_x25519.c | 1 + src/crypto/mishmash/rsa_aes_cbc_sha1.c | 1 + src/crypto/mishmash/rsa_aes_cbc_sha256.c | 1 + src/crypto/mishmash/rsa_aes_gcm_sha256.c | 1 + src/crypto/mishmash/rsa_aes_gcm_sha384.c | 1 + src/crypto/mishmash/rsa_sha1.c | 1 + src/crypto/mishmash/rsa_sha224.c | 1 + src/crypto/mishmash/rsa_sha256.c | 1 + src/crypto/mishmash/rsa_sha384.c | 1 + src/crypto/mishmash/rsa_sha512.c | 1 + src/crypto/ntlm.c | 1 + src/crypto/ocsp.c | 1 + src/crypto/p256.c | 1 + src/crypto/p384.c | 1 + src/crypto/privkey.c | 1 + src/crypto/random_nz.c | 1 + src/crypto/rbg.c | 1 + src/crypto/rootcert.c | 1 + src/crypto/rsa.c | 1 + src/crypto/sha1.c | 1 + src/crypto/sha224.c | 1 + src/crypto/sha256.c | 1 + src/crypto/sha384.c | 1 + src/crypto/sha512.c | 1 + src/crypto/sha512_224.c | 1 + src/crypto/sha512_256.c | 1 + src/crypto/weierstrass.c | 1 + src/crypto/x25519.c | 1 + src/crypto/x509.c | 1 + src/drivers/bus/cdc.c | 1 + src/drivers/bus/pcibackup.c | 1 + src/drivers/bus/pciextra.c | 1 + src/drivers/bus/pcimsix.c | 1 + src/drivers/bus/usb.c | 1 + src/drivers/bus/usb_settings.c | 1 + src/drivers/net/acm.c | 1 + src/drivers/net/acm.h | 1 + src/drivers/net/axge.c | 1 + src/drivers/net/axge.h | 1 + src/drivers/net/dm96xx.c | 1 + src/drivers/net/dm96xx.h | 1 + src/drivers/net/ecm.c | 1 + src/drivers/net/ecm.h | 1 + src/drivers/net/ice.c | 1 + src/drivers/net/ice.h | 1 + src/drivers/net/intel.c | 1 + src/drivers/net/intel.h | 1 + src/drivers/net/intelvf.c | 1 + src/drivers/net/intelvf.h | 1 + src/drivers/net/intelx.c | 1 + src/drivers/net/intelx.h | 1 + src/drivers/net/intelxl.c | 1 + src/drivers/net/intelxl.h | 1 + src/drivers/net/intelxlvf.c | 1 + src/drivers/net/intelxlvf.h | 1 + src/drivers/net/intelxvf.c | 1 + src/drivers/net/intelxvf.h | 1 + src/drivers/net/iphone.c | 1 + src/drivers/net/iphone.h | 1 + src/drivers/net/lan78xx.c | 1 + src/drivers/net/lan78xx.h | 1 + src/drivers/net/mii.c | 1 + src/drivers/net/ncm.c | 1 + src/drivers/net/ncm.h | 1 + src/drivers/net/netfront.c | 1 + src/drivers/net/netfront.h | 1 + src/drivers/net/smsc75xx.c | 1 + src/drivers/net/smsc75xx.h | 1 + src/drivers/net/smsc95xx.c | 1 + src/drivers/net/smsc95xx.h | 1 + src/drivers/net/smscusb.c | 1 + src/drivers/net/smscusb.h | 1 + src/drivers/net/vmxnet3.c | 1 + src/drivers/net/vmxnet3.h | 1 + src/drivers/usb/ehci.c | 1 + src/drivers/usb/ehci.h | 1 + src/drivers/usb/uhci.c | 1 + src/drivers/usb/uhci.h | 1 + src/drivers/usb/usbblk.c | 1 + src/drivers/usb/usbblk.h | 1 + src/drivers/usb/usbhub.c | 1 + src/drivers/usb/usbhub.h | 1 + src/drivers/usb/usbnet.c | 1 + src/drivers/usb/xhci.c | 1 + src/hci/commands/cert_cmd.c | 1 + src/hci/commands/console_cmd.c | 1 + src/hci/commands/digest_cmd.c | 1 + src/hci/commands/image_trust_cmd.c | 1 + src/hci/commands/ipstat_cmd.c | 1 + src/hci/commands/neighbour_cmd.c | 1 + src/hci/commands/nslookup_cmd.c | 1 + src/hci/commands/ntp_cmd.c | 1 + src/hci/commands/param_cmd.c | 1 + src/hci/commands/ping_cmd.c | 1 + src/hci/commands/poweroff_cmd.c | 1 + src/hci/commands/profstat_cmd.c | 1 + src/hci/commands/vlan_cmd.c | 1 + src/image/der.c | 1 + src/image/efi_siglist.c | 1 + src/image/pem.c | 1 + src/image/png.c | 1 + src/include/hci/digest_cmd.h | 1 + src/include/ipxe/acpimac.h | 1 + src/include/ipxe/aes.h | 1 + src/include/ipxe/bigint.h | 1 + src/include/ipxe/bitops.h | 1 + src/include/ipxe/cbc.h | 1 + src/include/ipxe/cdc.h | 1 + src/include/ipxe/certstore.h | 1 + src/include/ipxe/cms.h | 1 + src/include/ipxe/deflate.h | 1 + src/include/ipxe/der.h | 1 + src/include/ipxe/dhe.h | 1 + src/include/ipxe/drbg.h | 1 + src/include/ipxe/ecb.h | 1 + src/include/ipxe/ecdhe.h | 1 + src/include/ipxe/ecdsa.h | 1 + src/include/ipxe/efi/efi_siglist.h | 1 + src/include/ipxe/efi/efi_usb.h | 3 +++ src/include/ipxe/entropy.h | 1 + src/include/ipxe/fbcon.h | 1 + src/include/ipxe/fdt.h | 1 + src/include/ipxe/gcm.h | 1 + src/include/ipxe/hash_df.h | 1 + src/include/ipxe/hmac.h | 1 + src/include/ipxe/hmac_drbg.h | 1 + src/include/ipxe/isqrt.h | 1 + src/include/ipxe/lineconsole.h | 1 + src/include/ipxe/md4.h | 1 + src/include/ipxe/mii.h | 1 + src/include/ipxe/netbios.h | 1 + src/include/ipxe/ntp.h | 1 + src/include/ipxe/ocsp.h | 1 + src/include/ipxe/p256.h | 1 + src/include/ipxe/p384.h | 1 + src/include/ipxe/pccrc.h | 1 + src/include/ipxe/pccrd.h | 1 + src/include/ipxe/pccrr.h | 1 + src/include/ipxe/pcibackup.h | 1 + src/include/ipxe/pcimsix.h | 1 + src/include/ipxe/peerblk.h | 1 + src/include/ipxe/peerdisc.h | 1 + src/include/ipxe/peermux.h | 1 + src/include/ipxe/pem.h | 1 + src/include/ipxe/pinger.h | 1 + src/include/ipxe/pixbuf.h | 1 + src/include/ipxe/png.h | 1 + src/include/ipxe/privkey.h | 1 + src/include/ipxe/random_nz.h | 1 + src/include/ipxe/rbg.h | 1 + src/include/ipxe/rndis.h | 1 + src/include/ipxe/rootcert.h | 1 + src/include/ipxe/rsa.h | 1 + src/include/ipxe/sha1.h | 1 + src/include/ipxe/sha256.h | 1 + src/include/ipxe/sha512.h | 1 + src/include/ipxe/syslog.h | 1 + src/include/ipxe/tls.h | 1 + src/include/ipxe/usbnet.h | 1 + src/include/ipxe/validator.h | 1 + src/include/ipxe/weierstrass.h | 1 + src/include/ipxe/x25519.h | 1 + src/include/ipxe/x509.h | 1 + src/include/ipxe/xen.h | 1 + src/include/ipxe/xenbus.h | 1 + src/include/ipxe/xenevent.h | 1 + src/include/ipxe/xengrant.h | 1 + src/include/ipxe/xenstore.h | 1 + src/include/ipxe/xhci.h | 1 + src/include/mii.h | 1 + src/include/usr/certmgmt.h | 1 + src/include/usr/imgtrust.h | 1 + src/include/usr/ipstat.h | 1 + src/include/usr/neighmgmt.h | 1 + src/include/usr/nslookup.h | 1 + src/include/usr/ntpmgmt.h | 1 + src/include/usr/pingmgmt.h | 1 + src/include/usr/profstat.h | 1 + src/include/xen/arch-x86/xen-x86_64.h | 1 + src/include/xen/arch-x86/xen.h | 1 + src/include/xen/event_channel.h | 1 + src/include/xen/grant_table.h | 1 + src/include/xen/io/netif.h | 1 + src/include/xen/io/ring.h | 1 + src/include/xen/io/xenbus.h | 1 + src/include/xen/io/xs_wire.h | 1 + src/include/xen/xen-compat.h | 1 + src/include/xen/xen.h | 1 + src/interface/efi/efi_cacert.c | 1 + src/interface/efi/efi_entropy.c | 1 + src/interface/efi/efi_fbcon.c | 1 + src/interface/efi/efi_fdt.c | 1 + src/interface/efi/efi_rng.c | 1 + src/interface/efi/efi_usb.c | 1 + src/interface/xen/xenbus.c | 1 + src/interface/xen/xengrant.c | 1 + src/interface/xen/xenstore.c | 1 + src/net/pccrc.c | 1 + src/net/pccrd.c | 1 + src/net/peerblk.c | 1 + src/net/peerdisc.c | 1 + src/net/peerdist.c | 1 + src/net/peermux.c | 1 + src/net/ping.c | 1 + src/net/rndis.c | 1 + src/net/tcp/httpntlm.c | 1 + src/net/tcp/https.c | 1 + src/net/tcp/syslogs.c | 1 + src/net/tls.c | 1 + src/net/udp/ntp.c | 1 + src/net/udp/syslog.c | 1 + src/net/validator.c | 1 + src/usr/certmgmt.c | 1 + src/usr/imgtrust.c | 1 + src/usr/ipstat.c | 1 + src/usr/neighmgmt.c | 1 + src/usr/nslookup.c | 1 + src/usr/ntpmgmt.c | 1 + src/usr/pingmgmt.c | 1 + src/usr/profstat.c | 1 + 304 files changed, 306 insertions(+) (limited to 'src/net') diff --git a/src/arch/x86/core/cpuid_settings.c b/src/arch/x86/core/cpuid_settings.c index 44d38debc..ef0164069 100644 --- a/src/arch/x86/core/cpuid_settings.c +++ b/src/arch/x86/core/cpuid_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/core/rdrand.c b/src/arch/x86/core/rdrand.c index 850ab1f11..05fc3cd23 100644 --- a/src/arch/x86/core/rdrand.c +++ b/src/arch/x86/core/rdrand.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/arch/x86/include/bits/bigint.h b/src/arch/x86/include/bits/bigint.h index c6f097a34..21cffa0cf 100644 --- a/src/arch/x86/include/bits/bigint.h +++ b/src/arch/x86/include/bits/bigint.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/arch/x86/include/bits/bitops.h b/src/arch/x86/include/bits/bitops.h index f697b8c8f..cdbc3b0a2 100644 --- a/src/arch/x86/include/bits/bitops.h +++ b/src/arch/x86/include/bits/bitops.h @@ -14,6 +14,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/arch/x86/include/bits/xen.h b/src/arch/x86/include/bits/xen.h index 3433cea1f..313bec254 100644 --- a/src/arch/x86/include/bits/xen.h +++ b/src/arch/x86/include/bits/xen.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* Hypercall registers */ #ifdef __x86_64__ diff --git a/src/config/config_archive.c b/src/config/config_archive.c index 746fc7e44..71c883dcc 100644 --- a/src/config/config_archive.c +++ b/src/config/config_archive.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_asn1.c b/src/config/config_asn1.c index 107f99c1d..ad3e95b96 100644 --- a/src/config/config_asn1.c +++ b/src/config/config_asn1.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_certs.c b/src/config/config_certs.c index a325d132c..ad5a2f708 100644 --- a/src/config/config_certs.c +++ b/src/config/config_certs.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_crypto.c b/src/config/config_crypto.c index 4bba147e5..724b95d02 100644 --- a/src/config/config_crypto.c +++ b/src/config/config_crypto.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_digest_cmd.c b/src/config/config_digest_cmd.c index 5a8752ae1..1c4d8dca1 100644 --- a/src/config/config_digest_cmd.c +++ b/src/config/config_digest_cmd.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_entropy.c b/src/config/config_entropy.c index 92aa97884..494b19f20 100644 --- a/src/config/config_entropy.c +++ b/src/config/config_entropy.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_fc.c b/src/config/config_fc.c index 33fc9462a..3aea9b080 100644 --- a/src/config/config_fc.c +++ b/src/config/config_fc.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_fdt.c b/src/config/config_fdt.c index e8d425933..a6fb6f332 100644 --- a/src/config/config_fdt.c +++ b/src/config/config_fdt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_infiniband.c b/src/config/config_infiniband.c index 4da8fe219..9e0826169 100644 --- a/src/config/config_infiniband.c +++ b/src/config/config_infiniband.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_pixbuf.c b/src/config/config_pixbuf.c index f8ff59daf..b2dbd869a 100644 --- a/src/config/config_pixbuf.c +++ b/src/config/config_pixbuf.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/config_usb.c b/src/config/config_usb.c index 10dec221a..b3fd412e9 100644 --- a/src/config/config_usb.c +++ b/src/config/config_usb.c @@ -20,6 +20,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/config/crypto.h b/src/config/crypto.h index a0774390b..e28ba2777 100644 --- a/src/config/crypto.h +++ b/src/config/crypto.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** Minimum TLS version */ #define TLS_VERSION_MIN TLS_VERSION_TLS_1_1 diff --git a/src/config/entropy.h b/src/config/entropy.h index c79060fd5..db180c61a 100644 --- a/src/config/entropy.h +++ b/src/config/entropy.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/fdt.h b/src/config/fdt.h index 4d13e0535..7f3d39768 100644 --- a/src/config/fdt.h +++ b/src/config/fdt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/config/usb.h b/src/config/usb.h index 4252ec229..09e0b82e6 100644 --- a/src/config/usb.h +++ b/src/config/usb.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/core/acpi_settings.c b/src/core/acpi_settings.c index 63f271855..8dc2a7fd8 100644 --- a/src/core/acpi_settings.c +++ b/src/core/acpi_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/core/acpimac.c b/src/core/acpimac.c index 11ac3243e..04fd98836 100644 --- a/src/core/acpimac.c +++ b/src/core/acpimac.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/ansicoldef.c b/src/core/ansicoldef.c index 6d8598e11..4555c4e36 100644 --- a/src/core/ansicoldef.c +++ b/src/core/ansicoldef.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/fbcon.c b/src/core/fbcon.c index ef158aec7..e07605470 100644 --- a/src/core/fbcon.c +++ b/src/core/fbcon.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/fdt.c b/src/core/fdt.c index 08adb166e..8ac781b05 100644 --- a/src/core/fdt.c +++ b/src/core/fdt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/isqrt.c b/src/core/isqrt.c index c4d0571e7..b553c0935 100644 --- a/src/core/isqrt.c +++ b/src/core/isqrt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/lineconsole.c b/src/core/lineconsole.c index 0a72d1434..25eae39dd 100644 --- a/src/core/lineconsole.c +++ b/src/core/lineconsole.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/netbios.c b/src/core/netbios.c index 0d4e2086f..299e0d599 100644 --- a/src/core/netbios.c +++ b/src/core/netbios.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/pinger.c b/src/core/pinger.c index 0ff7bb9f2..bbfa83f8d 100644 --- a/src/core/pinger.c +++ b/src/core/pinger.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/core/pixbuf.c b/src/core/pixbuf.c index 506a28c38..df187f93d 100644 --- a/src/core/pixbuf.c +++ b/src/core/pixbuf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/core/profile.c b/src/core/profile.c index 3655108ea..27d481d45 100644 --- a/src/core/profile.c +++ b/src/core/profile.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/aes.c b/src/crypto/aes.c index 5200e7760..fe6ccb222 100644 --- a/src/crypto/aes.c +++ b/src/crypto/aes.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/asn1.c b/src/crypto/asn1.c index dd0b954e1..98d5b638f 100644 --- a/src/crypto/asn1.c +++ b/src/crypto/asn1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/bigint.c b/src/crypto/bigint.c index 9ccd9ff88..5d2f7b560 100644 --- a/src/crypto/bigint.c +++ b/src/crypto/bigint.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/cbc.c b/src/crypto/cbc.c index 0ba17ee48..ddba7abd9 100644 --- a/src/crypto/cbc.c +++ b/src/crypto/cbc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/certstore.c b/src/crypto/certstore.c index aad874297..8472a2eed 100644 --- a/src/crypto/certstore.c +++ b/src/crypto/certstore.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/cms.c b/src/crypto/cms.c index 7775e581b..4c0f3f5a6 100644 --- a/src/crypto/cms.c +++ b/src/crypto/cms.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/crypto_null.c b/src/crypto/crypto_null.c index e80f2707f..8637987b1 100644 --- a/src/crypto/crypto_null.c +++ b/src/crypto/crypto_null.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/crypto/deflate.c b/src/crypto/deflate.c index 5d0101184..1d54749e0 100644 --- a/src/crypto/deflate.c +++ b/src/crypto/deflate.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/dhe.c b/src/crypto/dhe.c index a249f9b40..2785a500b 100644 --- a/src/crypto/dhe.c +++ b/src/crypto/dhe.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/drbg.c b/src/crypto/drbg.c index a3366e806..c4dc7646d 100644 --- a/src/crypto/drbg.c +++ b/src/crypto/drbg.c @@ -34,6 +34,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/ecb.c b/src/crypto/ecb.c index 3c9cf340c..73eef09c2 100644 --- a/src/crypto/ecb.c +++ b/src/crypto/ecb.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/ecdhe.c b/src/crypto/ecdhe.c index 6c86b1c90..016253457 100644 --- a/src/crypto/ecdhe.c +++ b/src/crypto/ecdhe.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/ecdsa.c b/src/crypto/ecdsa.c index cd06d5578..6f10a1a0f 100644 --- a/src/crypto/ecdsa.c +++ b/src/crypto/ecdsa.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/entropy.c b/src/crypto/entropy.c index 419007159..ac0e92c42 100644 --- a/src/crypto/entropy.c +++ b/src/crypto/entropy.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/gcm.c b/src/crypto/gcm.c index b93925d07..b9c9d3a39 100644 --- a/src/crypto/gcm.c +++ b/src/crypto/gcm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/hash_df.c b/src/crypto/hash_df.c index dc0dc0ce8..ec4bcaebc 100644 --- a/src/crypto/hash_df.c +++ b/src/crypto/hash_df.c @@ -34,6 +34,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/hmac.c b/src/crypto/hmac.c index 7109bbf6a..ed4cefaad 100644 --- a/src/crypto/hmac.c +++ b/src/crypto/hmac.c @@ -34,6 +34,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/crypto/hmac_drbg.c b/src/crypto/hmac_drbg.c index 57bde4d1d..bd831e239 100644 --- a/src/crypto/hmac_drbg.c +++ b/src/crypto/hmac_drbg.c @@ -34,6 +34,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/md4.c b/src/crypto/md4.c index dcd86a428..a9184aa57 100644 --- a/src/crypto/md4.c +++ b/src/crypto/md4.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/mishmash/cmd_sha224.c b/src/crypto/mishmash/cmd_sha224.c index 3975a37c5..fd8095937 100644 --- a/src/crypto/mishmash/cmd_sha224.c +++ b/src/crypto/mishmash/cmd_sha224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/cmd_sha256.c b/src/crypto/mishmash/cmd_sha256.c index 8076e8dbf..259ae3eac 100644 --- a/src/crypto/mishmash/cmd_sha256.c +++ b/src/crypto/mishmash/cmd_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/cmd_sha384.c b/src/crypto/mishmash/cmd_sha384.c index ed7265ab9..c31154d24 100644 --- a/src/crypto/mishmash/cmd_sha384.c +++ b/src/crypto/mishmash/cmd_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/cmd_sha512.c b/src/crypto/mishmash/cmd_sha512.c index 96b8ade88..b6207f86d 100644 --- a/src/crypto/mishmash/cmd_sha512.c +++ b/src/crypto/mishmash/cmd_sha512.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c b/src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c index 05e409f7a..ec2155001 100644 --- a/src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c +++ b/src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c b/src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c index 6ce428642..4e6226e87 100644 --- a/src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c +++ b/src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c b/src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c index dc5cad9f8..6bbe4d00d 100644 --- a/src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c +++ b/src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c b/src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c index 0448255f3..336feb195 100644 --- a/src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c +++ b/src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c b/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c index d6eaf8b0a..0d9fcd15d 100644 --- a/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c +++ b/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c b/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c index 0fc486fbd..4b7cf1620 100644 --- a/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c +++ b/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c b/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c index 5106c18ce..85373911a 100644 --- a/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c +++ b/src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c b/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c index 2b118e7a5..5aeb2f3d9 100644 --- a/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c +++ b/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c b/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c index b4946df88..3dc6149d7 100644 --- a/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c +++ b/src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c b/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c index c23f65cc0..46b42ac1e 100644 --- a/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c +++ b/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c b/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c index 431e2e304..dd524ec78 100644 --- a/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c +++ b/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c b/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c index c52976809..7524d1ccc 100644 --- a/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c +++ b/src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c b/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c index 4f4e38c69..978be2a4c 100644 --- a/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c +++ b/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c b/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c index 0bc7c305f..5ca6f0457 100644 --- a/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c +++ b/src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdsa_sha224.c b/src/crypto/mishmash/ecdsa_sha224.c index ab42658cb..92aa881cd 100644 --- a/src/crypto/mishmash/ecdsa_sha224.c +++ b/src/crypto/mishmash/ecdsa_sha224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdsa_sha256.c b/src/crypto/mishmash/ecdsa_sha256.c index 12cbec80c..025d6ec73 100644 --- a/src/crypto/mishmash/ecdsa_sha256.c +++ b/src/crypto/mishmash/ecdsa_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdsa_sha384.c b/src/crypto/mishmash/ecdsa_sha384.c index b52621311..d7a0ca5d6 100644 --- a/src/crypto/mishmash/ecdsa_sha384.c +++ b/src/crypto/mishmash/ecdsa_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/ecdsa_sha512.c b/src/crypto/mishmash/ecdsa_sha512.c index 420c685e7..15391abf2 100644 --- a/src/crypto/mishmash/ecdsa_sha512.c +++ b/src/crypto/mishmash/ecdsa_sha512.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_aes_cbc.c b/src/crypto/mishmash/oid_aes_cbc.c index b5f716574..d5b81541a 100644 --- a/src/crypto/mishmash/oid_aes_cbc.c +++ b/src/crypto/mishmash/oid_aes_cbc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_aes_gcm.c b/src/crypto/mishmash/oid_aes_gcm.c index af1432d8e..6be1a132d 100644 --- a/src/crypto/mishmash/oid_aes_gcm.c +++ b/src/crypto/mishmash/oid_aes_gcm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_p256.c b/src/crypto/mishmash/oid_p256.c index d473df09f..81ae1d11e 100644 --- a/src/crypto/mishmash/oid_p256.c +++ b/src/crypto/mishmash/oid_p256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_p384.c b/src/crypto/mishmash/oid_p384.c index 968fb45c1..a7d36aee4 100644 --- a/src/crypto/mishmash/oid_p384.c +++ b/src/crypto/mishmash/oid_p384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_rsa.c b/src/crypto/mishmash/oid_rsa.c index 582022628..02bb59edb 100644 --- a/src/crypto/mishmash/oid_rsa.c +++ b/src/crypto/mishmash/oid_rsa.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha1.c b/src/crypto/mishmash/oid_sha1.c index 5dae6d27c..5ddd2aba8 100644 --- a/src/crypto/mishmash/oid_sha1.c +++ b/src/crypto/mishmash/oid_sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha224.c b/src/crypto/mishmash/oid_sha224.c index ee7ed22e4..6658bda56 100644 --- a/src/crypto/mishmash/oid_sha224.c +++ b/src/crypto/mishmash/oid_sha224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha256.c b/src/crypto/mishmash/oid_sha256.c index 963fddb63..8da40a70b 100644 --- a/src/crypto/mishmash/oid_sha256.c +++ b/src/crypto/mishmash/oid_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha384.c b/src/crypto/mishmash/oid_sha384.c index 81ff48bbf..57c1ab53b 100644 --- a/src/crypto/mishmash/oid_sha384.c +++ b/src/crypto/mishmash/oid_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha512.c b/src/crypto/mishmash/oid_sha512.c index 78bae48b4..73d7cb78f 100644 --- a/src/crypto/mishmash/oid_sha512.c +++ b/src/crypto/mishmash/oid_sha512.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha512_224.c b/src/crypto/mishmash/oid_sha512_224.c index 6f61f9cac..a6291097b 100644 --- a/src/crypto/mishmash/oid_sha512_224.c +++ b/src/crypto/mishmash/oid_sha512_224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_sha512_256.c b/src/crypto/mishmash/oid_sha512_256.c index bce4762e4..d36199372 100644 --- a/src/crypto/mishmash/oid_sha512_256.c +++ b/src/crypto/mishmash/oid_sha512_256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/oid_x25519.c b/src/crypto/mishmash/oid_x25519.c index 30b7905ea..2907eb461 100644 --- a/src/crypto/mishmash/oid_x25519.c +++ b/src/crypto/mishmash/oid_x25519.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_aes_cbc_sha1.c b/src/crypto/mishmash/rsa_aes_cbc_sha1.c index 0862fb5ac..35f5f6eb7 100644 --- a/src/crypto/mishmash/rsa_aes_cbc_sha1.c +++ b/src/crypto/mishmash/rsa_aes_cbc_sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_aes_cbc_sha256.c b/src/crypto/mishmash/rsa_aes_cbc_sha256.c index e5928db82..22705df7e 100644 --- a/src/crypto/mishmash/rsa_aes_cbc_sha256.c +++ b/src/crypto/mishmash/rsa_aes_cbc_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_aes_gcm_sha256.c b/src/crypto/mishmash/rsa_aes_gcm_sha256.c index b18bbd844..d3fd00f1e 100644 --- a/src/crypto/mishmash/rsa_aes_gcm_sha256.c +++ b/src/crypto/mishmash/rsa_aes_gcm_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_aes_gcm_sha384.c b/src/crypto/mishmash/rsa_aes_gcm_sha384.c index 06558aaed..908db086a 100644 --- a/src/crypto/mishmash/rsa_aes_gcm_sha384.c +++ b/src/crypto/mishmash/rsa_aes_gcm_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_sha1.c b/src/crypto/mishmash/rsa_sha1.c index 264f871f1..8907ac08a 100644 --- a/src/crypto/mishmash/rsa_sha1.c +++ b/src/crypto/mishmash/rsa_sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_sha224.c b/src/crypto/mishmash/rsa_sha224.c index 1465a033d..b676d41f3 100644 --- a/src/crypto/mishmash/rsa_sha224.c +++ b/src/crypto/mishmash/rsa_sha224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_sha256.c b/src/crypto/mishmash/rsa_sha256.c index 7283c3e29..8a6a7a5cf 100644 --- a/src/crypto/mishmash/rsa_sha256.c +++ b/src/crypto/mishmash/rsa_sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_sha384.c b/src/crypto/mishmash/rsa_sha384.c index 6f8c29b29..cc1878bd4 100644 --- a/src/crypto/mishmash/rsa_sha384.c +++ b/src/crypto/mishmash/rsa_sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/mishmash/rsa_sha512.c b/src/crypto/mishmash/rsa_sha512.c index bb4463a5a..9c995e1c8 100644 --- a/src/crypto/mishmash/rsa_sha512.c +++ b/src/crypto/mishmash/rsa_sha512.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/ntlm.c b/src/crypto/ntlm.c index fb120f8db..f9ce51bde 100644 --- a/src/crypto/ntlm.c +++ b/src/crypto/ntlm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/ocsp.c b/src/crypto/ocsp.c index 1712d614e..5d6acb605 100644 --- a/src/crypto/ocsp.c +++ b/src/crypto/ocsp.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/p256.c b/src/crypto/p256.c index 2ba66e72c..a513555b3 100644 --- a/src/crypto/p256.c +++ b/src/crypto/p256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/p384.c b/src/crypto/p384.c index a53a9ce9d..bdd23d460 100644 --- a/src/crypto/p384.c +++ b/src/crypto/p384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/privkey.c b/src/crypto/privkey.c index cbe8deff3..c67a4400b 100644 --- a/src/crypto/privkey.c +++ b/src/crypto/privkey.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/random_nz.c b/src/crypto/random_nz.c index 5fe576e05..96b12359c 100644 --- a/src/crypto/random_nz.c +++ b/src/crypto/random_nz.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/rbg.c b/src/crypto/rbg.c index 5e1c25f53..17914542e 100644 --- a/src/crypto/rbg.c +++ b/src/crypto/rbg.c @@ -34,6 +34,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/rootcert.c b/src/crypto/rootcert.c index b198c1d95..6eb08256a 100644 --- a/src/crypto/rootcert.c +++ b/src/crypto/rootcert.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/rsa.c b/src/crypto/rsa.c index 9c0982cf6..be055d881 100644 --- a/src/crypto/rsa.c +++ b/src/crypto/rsa.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/crypto/sha1.c b/src/crypto/sha1.c index 8eecc75b3..023becec6 100644 --- a/src/crypto/sha1.c +++ b/src/crypto/sha1.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/sha224.c b/src/crypto/sha224.c index e54a0abb0..7e0cfd34e 100644 --- a/src/crypto/sha224.c +++ b/src/crypto/sha224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/sha256.c b/src/crypto/sha256.c index c30300eb4..742393612 100644 --- a/src/crypto/sha256.c +++ b/src/crypto/sha256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/sha384.c b/src/crypto/sha384.c index f1af6fc6f..3e5e98a31 100644 --- a/src/crypto/sha384.c +++ b/src/crypto/sha384.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/sha512.c b/src/crypto/sha512.c index d7d44b284..724cb71a5 100644 --- a/src/crypto/sha512.c +++ b/src/crypto/sha512.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/sha512_224.c b/src/crypto/sha512_224.c index b6728726c..3b256a3b9 100644 --- a/src/crypto/sha512_224.c +++ b/src/crypto/sha512_224.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/sha512_256.c b/src/crypto/sha512_256.c index 8163631e0..04df3f5bc 100644 --- a/src/crypto/sha512_256.c +++ b/src/crypto/sha512_256.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/weierstrass.c b/src/crypto/weierstrass.c index bb9b50bf8..a64626c85 100644 --- a/src/crypto/weierstrass.c +++ b/src/crypto/weierstrass.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/x25519.c b/src/crypto/x25519.c index 4b4c489da..95c42ea13 100644 --- a/src/crypto/x25519.c +++ b/src/crypto/x25519.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 1206e4023..6a3fe423b 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/cdc.c b/src/drivers/bus/cdc.c index 373a03072..c3a2a450b 100644 --- a/src/drivers/bus/cdc.c +++ b/src/drivers/bus/cdc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/pcibackup.c b/src/drivers/bus/pcibackup.c index 4cf126f83..81fcb7e05 100644 --- a/src/drivers/bus/pcibackup.c +++ b/src/drivers/bus/pcibackup.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/pciextra.c b/src/drivers/bus/pciextra.c index 3654a2d1c..f769a3172 100644 --- a/src/drivers/bus/pciextra.c +++ b/src/drivers/bus/pciextra.c @@ -1,4 +1,5 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/pcimsix.c b/src/drivers/bus/pcimsix.c index f55488ad7..008c1c22f 100644 --- a/src/drivers/bus/pcimsix.c +++ b/src/drivers/bus/pcimsix.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/usb.c b/src/drivers/bus/usb.c index b3b361b0d..30c288df9 100644 --- a/src/drivers/bus/usb.c +++ b/src/drivers/bus/usb.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/bus/usb_settings.c b/src/drivers/bus/usb_settings.c index bb01f34d5..e34c79126 100644 --- a/src/drivers/bus/usb_settings.c +++ b/src/drivers/bus/usb_settings.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/acm.c b/src/drivers/net/acm.c index 16dab4be8..0cb2713b2 100644 --- a/src/drivers/net/acm.c +++ b/src/drivers/net/acm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/acm.h b/src/drivers/net/acm.h index d4944967b..3f10f0fa2 100644 --- a/src/drivers/net/acm.h +++ b/src/drivers/net/acm.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/axge.c b/src/drivers/net/axge.c index fb274d24f..922c94d91 100644 --- a/src/drivers/net/axge.c +++ b/src/drivers/net/axge.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/axge.h b/src/drivers/net/axge.h index e22e0ec47..c30ca5950 100644 --- a/src/drivers/net/axge.h +++ b/src/drivers/net/axge.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/dm96xx.c b/src/drivers/net/dm96xx.c index 61b957be9..193980a40 100644 --- a/src/drivers/net/dm96xx.c +++ b/src/drivers/net/dm96xx.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/dm96xx.h b/src/drivers/net/dm96xx.h index 43a1a4e30..33e404e17 100644 --- a/src/drivers/net/dm96xx.h +++ b/src/drivers/net/dm96xx.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/ecm.c b/src/drivers/net/ecm.c index 7b3e92b9b..9a13b68a5 100644 --- a/src/drivers/net/ecm.c +++ b/src/drivers/net/ecm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/ecm.h b/src/drivers/net/ecm.h index a7d03cf94..d77b0c64f 100644 --- a/src/drivers/net/ecm.h +++ b/src/drivers/net/ecm.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/ice.c b/src/drivers/net/ice.c index b5d66f1bb..1abc8ecd0 100644 --- a/src/drivers/net/ice.c +++ b/src/drivers/net/ice.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/ice.h b/src/drivers/net/ice.h index 26291a7a1..c4b7b95be 100644 --- a/src/drivers/net/ice.h +++ b/src/drivers/net/ice.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include "intelxl.h" diff --git a/src/drivers/net/intel.c b/src/drivers/net/intel.c index 845ba3e7f..57c0151a4 100644 --- a/src/drivers/net/intel.c +++ b/src/drivers/net/intel.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intel.h b/src/drivers/net/intel.h index 29cf3a7d8..bfd250f00 100644 --- a/src/drivers/net/intel.h +++ b/src/drivers/net/intel.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelvf.c b/src/drivers/net/intelvf.c index 0d48b4178..e99b67626 100644 --- a/src/drivers/net/intelvf.c +++ b/src/drivers/net/intelvf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelvf.h b/src/drivers/net/intelvf.h index ffb18e040..378f9b075 100644 --- a/src/drivers/net/intelvf.h +++ b/src/drivers/net/intelvf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include "intel.h" diff --git a/src/drivers/net/intelx.c b/src/drivers/net/intelx.c index 343d01374..ceb687e4f 100644 --- a/src/drivers/net/intelx.c +++ b/src/drivers/net/intelx.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelx.h b/src/drivers/net/intelx.h index d7f3b78e8..d68f50082 100644 --- a/src/drivers/net/intelx.h +++ b/src/drivers/net/intelx.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelxl.c b/src/drivers/net/intelxl.c index 76b9ff48f..f8d325ead 100644 --- a/src/drivers/net/intelxl.c +++ b/src/drivers/net/intelxl.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelxl.h b/src/drivers/net/intelxl.h index d23acf96e..4481300d3 100644 --- a/src/drivers/net/intelxl.h +++ b/src/drivers/net/intelxl.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelxlvf.c b/src/drivers/net/intelxlvf.c index 083195513..ab4df4c47 100644 --- a/src/drivers/net/intelxlvf.c +++ b/src/drivers/net/intelxlvf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelxlvf.h b/src/drivers/net/intelxlvf.h index 95ddf9474..63ed0b202 100644 --- a/src/drivers/net/intelxlvf.h +++ b/src/drivers/net/intelxlvf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include "intelxl.h" diff --git a/src/drivers/net/intelxvf.c b/src/drivers/net/intelxvf.c index d50bac698..70ed8efe3 100644 --- a/src/drivers/net/intelxvf.c +++ b/src/drivers/net/intelxvf.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/intelxvf.h b/src/drivers/net/intelxvf.h index 4663272aa..1dac98699 100644 --- a/src/drivers/net/intelxvf.h +++ b/src/drivers/net/intelxvf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include "intelvf.h" diff --git a/src/drivers/net/iphone.c b/src/drivers/net/iphone.c index 11f763553..b58017560 100644 --- a/src/drivers/net/iphone.c +++ b/src/drivers/net/iphone.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/iphone.h b/src/drivers/net/iphone.h index 2db6da7bd..3448af37f 100644 --- a/src/drivers/net/iphone.h +++ b/src/drivers/net/iphone.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/lan78xx.c b/src/drivers/net/lan78xx.c index 3f4f21b60..32333e787 100644 --- a/src/drivers/net/lan78xx.c +++ b/src/drivers/net/lan78xx.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/lan78xx.h b/src/drivers/net/lan78xx.h index 39422aec0..ea6d7ce52 100644 --- a/src/drivers/net/lan78xx.h +++ b/src/drivers/net/lan78xx.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include "smscusb.h" #include "smsc75xx.h" diff --git a/src/drivers/net/mii.c b/src/drivers/net/mii.c index 87605f0cb..85749b941 100644 --- a/src/drivers/net/mii.c +++ b/src/drivers/net/mii.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/ncm.c b/src/drivers/net/ncm.c index 2c0f91e21..48f9856b0 100644 --- a/src/drivers/net/ncm.c +++ b/src/drivers/net/ncm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/ncm.h b/src/drivers/net/ncm.h index 6b0d21cdb..53e96cf72 100644 --- a/src/drivers/net/ncm.h +++ b/src/drivers/net/ncm.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/netfront.c b/src/drivers/net/netfront.c index 12713c5b4..ba6a20002 100644 --- a/src/drivers/net/netfront.c +++ b/src/drivers/net/netfront.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/netfront.h b/src/drivers/net/netfront.h index de16d5291..0520a0b2a 100644 --- a/src/drivers/net/netfront.h +++ b/src/drivers/net/netfront.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/smsc75xx.c b/src/drivers/net/smsc75xx.c index 861669edf..8ae65e42a 100644 --- a/src/drivers/net/smsc75xx.c +++ b/src/drivers/net/smsc75xx.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/smsc75xx.h b/src/drivers/net/smsc75xx.h index 72339df03..51330993d 100644 --- a/src/drivers/net/smsc75xx.h +++ b/src/drivers/net/smsc75xx.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include "smscusb.h" diff --git a/src/drivers/net/smsc95xx.c b/src/drivers/net/smsc95xx.c index 0210e9240..16086b33e 100644 --- a/src/drivers/net/smsc95xx.c +++ b/src/drivers/net/smsc95xx.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/smsc95xx.h b/src/drivers/net/smsc95xx.h index 0cdf38248..0cb6ab4c7 100644 --- a/src/drivers/net/smsc95xx.h +++ b/src/drivers/net/smsc95xx.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include "smscusb.h" diff --git a/src/drivers/net/smscusb.c b/src/drivers/net/smscusb.c index 93007e386..486b5953b 100644 --- a/src/drivers/net/smscusb.c +++ b/src/drivers/net/smscusb.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/smscusb.h b/src/drivers/net/smscusb.h index e866bb747..e4ad61915 100644 --- a/src/drivers/net/smscusb.h +++ b/src/drivers/net/smscusb.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/vmxnet3.c b/src/drivers/net/vmxnet3.c index 2cc6738f2..95e4f79c2 100644 --- a/src/drivers/net/vmxnet3.c +++ b/src/drivers/net/vmxnet3.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/net/vmxnet3.h b/src/drivers/net/vmxnet3.h index 5e1e0cb6e..b6c3bc50d 100644 --- a/src/drivers/net/vmxnet3.h +++ b/src/drivers/net/vmxnet3.h @@ -25,6 +25,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/drivers/usb/ehci.c b/src/drivers/usb/ehci.c index 77022a47d..9f9d94175 100644 --- a/src/drivers/usb/ehci.c +++ b/src/drivers/usb/ehci.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/ehci.h b/src/drivers/usb/ehci.h index 42e282e92..a0166bc63 100644 --- a/src/drivers/usb/ehci.h +++ b/src/drivers/usb/ehci.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/uhci.c b/src/drivers/usb/uhci.c index 47474bdc7..2c70a11bd 100644 --- a/src/drivers/usb/uhci.c +++ b/src/drivers/usb/uhci.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/uhci.h b/src/drivers/usb/uhci.h index ba4c28f7e..629f6ae3b 100644 --- a/src/drivers/usb/uhci.h +++ b/src/drivers/usb/uhci.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/usbblk.c b/src/drivers/usb/usbblk.c index cb377efb0..b42c70645 100644 --- a/src/drivers/usb/usbblk.c +++ b/src/drivers/usb/usbblk.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/usbblk.h b/src/drivers/usb/usbblk.h index 65d0705e3..1fa0ebad8 100644 --- a/src/drivers/usb/usbblk.h +++ b/src/drivers/usb/usbblk.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/usbhub.c b/src/drivers/usb/usbhub.c index 28d6cb33d..1d7b03e77 100644 --- a/src/drivers/usb/usbhub.c +++ b/src/drivers/usb/usbhub.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/usbhub.h b/src/drivers/usb/usbhub.h index a5f123acc..9768b81a9 100644 --- a/src/drivers/usb/usbhub.h +++ b/src/drivers/usb/usbhub.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/usbnet.c b/src/drivers/usb/usbnet.c index 0fac00b56..e773ab882 100644 --- a/src/drivers/usb/usbnet.c +++ b/src/drivers/usb/usbnet.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c index 440c347c8..f812ed338 100644 --- a/src/drivers/usb/xhci.c +++ b/src/drivers/usb/xhci.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/cert_cmd.c b/src/hci/commands/cert_cmd.c index efa4c3c12..ebd9a25cd 100644 --- a/src/hci/commands/cert_cmd.c +++ b/src/hci/commands/cert_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/console_cmd.c b/src/hci/commands/console_cmd.c index 19d19ef1b..29347bbba 100644 --- a/src/hci/commands/console_cmd.c +++ b/src/hci/commands/console_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/digest_cmd.c b/src/hci/commands/digest_cmd.c index a7f43f69e..4d7da0385 100644 --- a/src/hci/commands/digest_cmd.c +++ b/src/hci/commands/digest_cmd.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/image_trust_cmd.c b/src/hci/commands/image_trust_cmd.c index 314aa0998..a8ec5784e 100644 --- a/src/hci/commands/image_trust_cmd.c +++ b/src/hci/commands/image_trust_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/ipstat_cmd.c b/src/hci/commands/ipstat_cmd.c index 488016e3a..fc454c57d 100644 --- a/src/hci/commands/ipstat_cmd.c +++ b/src/hci/commands/ipstat_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/neighbour_cmd.c b/src/hci/commands/neighbour_cmd.c index 520d5aa06..870024ee0 100644 --- a/src/hci/commands/neighbour_cmd.c +++ b/src/hci/commands/neighbour_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/nslookup_cmd.c b/src/hci/commands/nslookup_cmd.c index dc9d61704..b13127dd4 100644 --- a/src/hci/commands/nslookup_cmd.c +++ b/src/hci/commands/nslookup_cmd.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/ntp_cmd.c b/src/hci/commands/ntp_cmd.c index fed126f4c..d7604227a 100644 --- a/src/hci/commands/ntp_cmd.c +++ b/src/hci/commands/ntp_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/param_cmd.c b/src/hci/commands/param_cmd.c index 0924df597..ed57c5eaa 100644 --- a/src/hci/commands/param_cmd.c +++ b/src/hci/commands/param_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/ping_cmd.c b/src/hci/commands/ping_cmd.c index 4e86ae1c0..e132fb457 100644 --- a/src/hci/commands/ping_cmd.c +++ b/src/hci/commands/ping_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/poweroff_cmd.c b/src/hci/commands/poweroff_cmd.c index 2c6f1369a..63aeb3d5b 100644 --- a/src/hci/commands/poweroff_cmd.c +++ b/src/hci/commands/poweroff_cmd.c @@ -29,6 +29,7 @@ #include FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/hci/commands/profstat_cmd.c b/src/hci/commands/profstat_cmd.c index da01068b2..3303ebcf3 100644 --- a/src/hci/commands/profstat_cmd.c +++ b/src/hci/commands/profstat_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/hci/commands/vlan_cmd.c b/src/hci/commands/vlan_cmd.c index 636e5927f..69aef9f3c 100644 --- a/src/hci/commands/vlan_cmd.c +++ b/src/hci/commands/vlan_cmd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/image/der.c b/src/image/der.c index 67117d43b..ace106b84 100644 --- a/src/image/der.c +++ b/src/image/der.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/image/efi_siglist.c b/src/image/efi_siglist.c index b264ac558..71d597006 100644 --- a/src/image/efi_siglist.c +++ b/src/image/efi_siglist.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/image/pem.c b/src/image/pem.c index caff822ad..0fea5fbea 100644 --- a/src/image/pem.c +++ b/src/image/pem.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/image/png.c b/src/image/png.c index b7864f770..ab279eae5 100644 --- a/src/image/png.c +++ b/src/image/png.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/hci/digest_cmd.h b/src/include/hci/digest_cmd.h index 0986f775e..9cb4fde1a 100644 --- a/src/include/hci/digest_cmd.h +++ b/src/include/hci/digest_cmd.h @@ -25,6 +25,7 @@ #define _DIGEST_CMD_H FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/acpimac.h b/src/include/ipxe/acpimac.h index de673eb28..074165a92 100644 --- a/src/include/ipxe/acpimac.h +++ b/src/include/ipxe/acpimac.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int acpi_mac ( uint8_t *hw_addr ); diff --git a/src/include/ipxe/aes.h b/src/include/ipxe/aes.h index 8731de6ba..1c0024ccb 100644 --- a/src/include/ipxe/aes.h +++ b/src/include/ipxe/aes.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/bigint.h b/src/include/ipxe/bigint.h index 9eab89d25..9c31f4540 100644 --- a/src/include/ipxe/bigint.h +++ b/src/include/ipxe/bigint.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/bitops.h b/src/include/ipxe/bitops.h index 7366cd9f1..59a4fb442 100644 --- a/src/include/ipxe/bitops.h +++ b/src/include/ipxe/bitops.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/cbc.h b/src/include/ipxe/cbc.h index f02e51937..154fc5666 100644 --- a/src/include/ipxe/cbc.h +++ b/src/include/ipxe/cbc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/cdc.h b/src/include/ipxe/cdc.h index b8b4a59d9..a61fe61ea 100644 --- a/src/include/ipxe/cdc.h +++ b/src/include/ipxe/cdc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/certstore.h b/src/include/ipxe/certstore.h index e276d6792..293f6dec7 100644 --- a/src/include/ipxe/certstore.h +++ b/src/include/ipxe/certstore.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/cms.h b/src/include/ipxe/cms.h index 084cd81f8..d2e426c5c 100644 --- a/src/include/ipxe/cms.h +++ b/src/include/ipxe/cms.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/deflate.h b/src/include/ipxe/deflate.h index 67292d77e..7e5ae01b9 100644 --- a/src/include/ipxe/deflate.h +++ b/src/include/ipxe/deflate.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/der.h b/src/include/ipxe/der.h index 512bc0853..17e96405e 100644 --- a/src/include/ipxe/der.h +++ b/src/include/ipxe/der.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/dhe.h b/src/include/ipxe/dhe.h index 3cd24a880..f89e7bd02 100644 --- a/src/include/ipxe/dhe.h +++ b/src/include/ipxe/dhe.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/drbg.h b/src/include/ipxe/drbg.h index ed2b3757a..0512f0833 100644 --- a/src/include/ipxe/drbg.h +++ b/src/include/ipxe/drbg.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ecb.h b/src/include/ipxe/ecb.h index db22d996d..c29602fca 100644 --- a/src/include/ipxe/ecb.h +++ b/src/include/ipxe/ecb.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/ecdhe.h b/src/include/ipxe/ecdhe.h index 36fc0a1ee..c6575678c 100644 --- a/src/include/ipxe/ecdhe.h +++ b/src/include/ipxe/ecdhe.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/ecdsa.h b/src/include/ipxe/ecdsa.h index f55af3973..fdf8c6159 100644 --- a/src/include/ipxe/ecdsa.h +++ b/src/include/ipxe/ecdsa.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/efi/efi_siglist.h b/src/include/ipxe/efi/efi_siglist.h index cbc835dc0..f2a2fcfd0 100644 --- a/src/include/ipxe/efi/efi_siglist.h +++ b/src/include/ipxe/efi/efi_siglist.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/efi/efi_usb.h b/src/include/ipxe/efi/efi_usb.h index 06baff529..cbcef0e52 100644 --- a/src/include/ipxe/efi/efi_usb.h +++ b/src/include/ipxe/efi/efi_usb.h @@ -7,6 +7,9 @@ * */ +FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); + #include #include #include diff --git a/src/include/ipxe/entropy.h b/src/include/ipxe/entropy.h index 82bb11826..8ec8f1047 100644 --- a/src/include/ipxe/entropy.h +++ b/src/include/ipxe/entropy.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fbcon.h b/src/include/ipxe/fbcon.h index 5233b4d0e..75cda3390 100644 --- a/src/include/ipxe/fbcon.h +++ b/src/include/ipxe/fbcon.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/fdt.h b/src/include/ipxe/fdt.h index e951aea59..6aa078ff6 100644 --- a/src/include/ipxe/fdt.h +++ b/src/include/ipxe/fdt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/gcm.h b/src/include/ipxe/gcm.h index 2c785a977..5635a1031 100644 --- a/src/include/ipxe/gcm.h +++ b/src/include/ipxe/gcm.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/hash_df.h b/src/include/ipxe/hash_df.h index e57682446..61c3420ce 100644 --- a/src/include/ipxe/hash_df.h +++ b/src/include/ipxe/hash_df.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/hmac.h b/src/include/ipxe/hmac.h index cf9d08677..12312c540 100644 --- a/src/include/ipxe/hmac.h +++ b/src/include/ipxe/hmac.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/hmac_drbg.h b/src/include/ipxe/hmac_drbg.h index a0f22da75..e9113807c 100644 --- a/src/include/ipxe/hmac_drbg.h +++ b/src/include/ipxe/hmac_drbg.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/isqrt.h b/src/include/ipxe/isqrt.h index 68255d1bc..4308cebd2 100644 --- a/src/include/ipxe/isqrt.h +++ b/src/include/ipxe/isqrt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern unsigned long isqrt ( unsigned long value ); diff --git a/src/include/ipxe/lineconsole.h b/src/include/ipxe/lineconsole.h index 31117e73c..b02822dcf 100644 --- a/src/include/ipxe/lineconsole.h +++ b/src/include/ipxe/lineconsole.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/md4.h b/src/include/ipxe/md4.h index 9f6cb8a5f..60512993b 100644 --- a/src/include/ipxe/md4.h +++ b/src/include/ipxe/md4.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/mii.h b/src/include/ipxe/mii.h index 89fc92a4a..061aeb24e 100644 --- a/src/include/ipxe/mii.h +++ b/src/include/ipxe/mii.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/netbios.h b/src/include/ipxe/netbios.h index c11552556..80f791738 100644 --- a/src/include/ipxe/netbios.h +++ b/src/include/ipxe/netbios.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern const char * netbios_domain ( char **username ); diff --git a/src/include/ipxe/ntp.h b/src/include/ipxe/ntp.h index f5b3d2326..7f83c6d4f 100644 --- a/src/include/ipxe/ntp.h +++ b/src/include/ipxe/ntp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/ocsp.h b/src/include/ipxe/ocsp.h index a973f6f5e..9302506f8 100644 --- a/src/include/ipxe/ocsp.h +++ b/src/include/ipxe/ocsp.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/p256.h b/src/include/ipxe/p256.h index 0c4e81665..14d429cd9 100644 --- a/src/include/ipxe/p256.h +++ b/src/include/ipxe/p256.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/p384.h b/src/include/ipxe/p384.h index f4631b5f2..2fdd8d13c 100644 --- a/src/include/ipxe/p384.h +++ b/src/include/ipxe/p384.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/pccrc.h b/src/include/ipxe/pccrc.h index bec2b271a..6d0e3f194 100644 --- a/src/include/ipxe/pccrc.h +++ b/src/include/ipxe/pccrc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pccrd.h b/src/include/ipxe/pccrd.h index 3daa92f29..453ef666d 100644 --- a/src/include/ipxe/pccrd.h +++ b/src/include/ipxe/pccrd.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** PeerDist discovery port */ #define PEERDIST_DISCOVERY_PORT 3702 diff --git a/src/include/ipxe/pccrr.h b/src/include/ipxe/pccrr.h index 4de94fda3..92522d0b7 100644 --- a/src/include/ipxe/pccrr.h +++ b/src/include/ipxe/pccrr.h @@ -10,6 +10,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/pcibackup.h b/src/include/ipxe/pcibackup.h index e5249df99..a25421d7d 100644 --- a/src/include/ipxe/pcibackup.h +++ b/src/include/ipxe/pcibackup.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/pcimsix.h b/src/include/ipxe/pcimsix.h index b40c6c357..a7a6899a9 100644 --- a/src/include/ipxe/pcimsix.h +++ b/src/include/ipxe/pcimsix.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/peerblk.h b/src/include/ipxe/peerblk.h index f16f207b0..596c78b57 100644 --- a/src/include/ipxe/peerblk.h +++ b/src/include/ipxe/peerblk.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/peerdisc.h b/src/include/ipxe/peerdisc.h index 45d592e76..9a8f13ecf 100644 --- a/src/include/ipxe/peerdisc.h +++ b/src/include/ipxe/peerdisc.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/peermux.h b/src/include/ipxe/peermux.h index 54acbfec9..849488d0a 100644 --- a/src/include/ipxe/peermux.h +++ b/src/include/ipxe/peermux.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pem.h b/src/include/ipxe/pem.h index d9ca017d5..95c55408b 100644 --- a/src/include/ipxe/pem.h +++ b/src/include/ipxe/pem.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pinger.h b/src/include/ipxe/pinger.h index 227f002dc..ade12ec12 100644 --- a/src/include/ipxe/pinger.h +++ b/src/include/ipxe/pinger.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/pixbuf.h b/src/include/ipxe/pixbuf.h index 47ea0065e..e2cbcdca7 100644 --- a/src/include/ipxe/pixbuf.h +++ b/src/include/ipxe/pixbuf.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/png.h b/src/include/ipxe/png.h index 3505eefc8..31cac0534 100644 --- a/src/include/ipxe/png.h +++ b/src/include/ipxe/png.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/privkey.h b/src/include/ipxe/privkey.h index a65cf6106..56f23143e 100644 --- a/src/include/ipxe/privkey.h +++ b/src/include/ipxe/privkey.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/random_nz.h b/src/include/ipxe/random_nz.h index 4c433fa38..2de1a1a33 100644 --- a/src/include/ipxe/random_nz.h +++ b/src/include/ipxe/random_nz.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/rbg.h b/src/include/ipxe/rbg.h index 4bf3055d1..0b65a408c 100644 --- a/src/include/ipxe/rbg.h +++ b/src/include/ipxe/rbg.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/rndis.h b/src/include/ipxe/rndis.h index e8ece1e85..bd64eddfe 100644 --- a/src/include/ipxe/rndis.h +++ b/src/include/ipxe/rndis.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/rootcert.h b/src/include/ipxe/rootcert.h index d1a69723d..f07c612ff 100644 --- a/src/include/ipxe/rootcert.h +++ b/src/include/ipxe/rootcert.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/rsa.h b/src/include/ipxe/rsa.h index e36a75edf..c5ae919ae 100644 --- a/src/include/ipxe/rsa.h +++ b/src/include/ipxe/rsa.h @@ -7,6 +7,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/sha1.h b/src/include/ipxe/sha1.h index 9cbbebdee..33b07ecc3 100644 --- a/src/include/ipxe/sha1.h +++ b/src/include/ipxe/sha1.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/sha256.h b/src/include/ipxe/sha256.h index f226ad07b..e8a81b889 100644 --- a/src/include/ipxe/sha256.h +++ b/src/include/ipxe/sha256.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/sha512.h b/src/include/ipxe/sha512.h index 82a9e4e69..74cdb413c 100644 --- a/src/include/ipxe/sha512.h +++ b/src/include/ipxe/sha512.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/syslog.h b/src/include/ipxe/syslog.h index 138440d66..67f45fdb4 100644 --- a/src/include/ipxe/syslog.h +++ b/src/include/ipxe/syslog.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 1a1d9c982..b4a92a044 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/usbnet.h b/src/include/ipxe/usbnet.h index a7276eba5..937a26d9a 100644 --- a/src/include/ipxe/usbnet.h +++ b/src/include/ipxe/usbnet.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/validator.h b/src/include/ipxe/validator.h index 367e4045d..4d95766fa 100644 --- a/src/include/ipxe/validator.h +++ b/src/include/ipxe/validator.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/weierstrass.h b/src/include/ipxe/weierstrass.h index 15dd9ce03..ced99b4fc 100644 --- a/src/include/ipxe/weierstrass.h +++ b/src/include/ipxe/weierstrass.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/x25519.h b/src/include/ipxe/x25519.h index d570282c5..ef294f7b2 100644 --- a/src/include/ipxe/x25519.h +++ b/src/include/ipxe/x25519.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/x509.h b/src/include/ipxe/x509.h index 4903eb656..360e2b19a 100644 --- a/src/include/ipxe/x509.h +++ b/src/include/ipxe/x509.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/xen.h b/src/include/ipxe/xen.h index 382901ff3..9ddfcdf81 100644 --- a/src/include/ipxe/xen.h +++ b/src/include/ipxe/xen.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /* Define Xen interface version before including any Xen header files */ #define __XEN_INTERFACE_VERSION__ 0x00040400 diff --git a/src/include/ipxe/xenbus.h b/src/include/ipxe/xenbus.h index ec5782eed..d73f29781 100644 --- a/src/include/ipxe/xenbus.h +++ b/src/include/ipxe/xenbus.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/xenevent.h b/src/include/ipxe/xenevent.h index f0bd3465e..8be9e2b2f 100644 --- a/src/include/ipxe/xenevent.h +++ b/src/include/ipxe/xenevent.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/xengrant.h b/src/include/ipxe/xengrant.h index fcb7a7157..8af27f3e3 100644 --- a/src/include/ipxe/xengrant.h +++ b/src/include/ipxe/xengrant.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/ipxe/xenstore.h b/src/include/ipxe/xenstore.h index 892640755..c2079cec5 100644 --- a/src/include/ipxe/xenstore.h +++ b/src/include/ipxe/xenstore.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/ipxe/xhci.h b/src/include/ipxe/xhci.h index 586d5d320..2f5c256a0 100644 --- a/src/include/ipxe/xhci.h +++ b/src/include/ipxe/xhci.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/include/mii.h b/src/include/mii.h index 515ba224d..9d6b2b3b7 100644 --- a/src/include/mii.h +++ b/src/include/mii.h @@ -12,6 +12,7 @@ */ FILE_LICENCE ( GPL2_ONLY ); +FILE_SECBOOT ( PERMITTED ); /* Generic MII registers. */ #define MII_BMCR 0x00 /* Basic mode control register */ diff --git a/src/include/usr/certmgmt.h b/src/include/usr/certmgmt.h index 4363b03e1..ff646236b 100644 --- a/src/include/usr/certmgmt.h +++ b/src/include/usr/certmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/imgtrust.h b/src/include/usr/imgtrust.h index 414e07a80..1e43f5d3d 100644 --- a/src/include/usr/imgtrust.h +++ b/src/include/usr/imgtrust.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/ipstat.h b/src/include/usr/ipstat.h index 803254bcb..2399446eb 100644 --- a/src/include/usr/ipstat.h +++ b/src/include/usr/ipstat.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern void ipstat ( void ); diff --git a/src/include/usr/neighmgmt.h b/src/include/usr/neighmgmt.h index 06f03716e..5ed5829c4 100644 --- a/src/include/usr/neighmgmt.h +++ b/src/include/usr/neighmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern void nstat ( void ); diff --git a/src/include/usr/nslookup.h b/src/include/usr/nslookup.h index d34649e9f..3b2bb504d 100644 --- a/src/include/usr/nslookup.h +++ b/src/include/usr/nslookup.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); extern int nslookup ( const char *name, const char *setting_name ); diff --git a/src/include/usr/ntpmgmt.h b/src/include/usr/ntpmgmt.h index 284e668e6..6d90ec749 100644 --- a/src/include/usr/ntpmgmt.h +++ b/src/include/usr/ntpmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern int ntp ( const char *hostname ); diff --git a/src/include/usr/pingmgmt.h b/src/include/usr/pingmgmt.h index c7a8434be..d15a748d8 100644 --- a/src/include/usr/pingmgmt.h +++ b/src/include/usr/pingmgmt.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include diff --git a/src/include/usr/profstat.h b/src/include/usr/profstat.h index b7812ca7f..c5d545a86 100644 --- a/src/include/usr/profstat.h +++ b/src/include/usr/profstat.h @@ -8,6 +8,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); extern void profstat ( void ); diff --git a/src/include/xen/arch-x86/xen-x86_64.h b/src/include/xen/arch-x86/xen-x86_64.h index 8287fd20f..618bf07d7 100644 --- a/src/include/xen/arch-x86/xen-x86_64.h +++ b/src/include/xen/arch-x86/xen-x86_64.h @@ -11,6 +11,7 @@ #define __XEN_PUBLIC_ARCH_X86_XEN_X86_64_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); /* * Hypercall interface: diff --git a/src/include/xen/arch-x86/xen.h b/src/include/xen/arch-x86/xen.h index 2b7afb2f4..7df850650 100644 --- a/src/include/xen/arch-x86/xen.h +++ b/src/include/xen/arch-x86/xen.h @@ -13,6 +13,7 @@ #define __XEN_PUBLIC_ARCH_X86_XEN_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); /* Structural guest handles introduced in 0x00030201. */ #if __XEN_INTERFACE_VERSION__ >= 0x00030201 diff --git a/src/include/xen/event_channel.h b/src/include/xen/event_channel.h index 0c3752723..a3145d76f 100644 --- a/src/include/xen/event_channel.h +++ b/src/include/xen/event_channel.h @@ -11,6 +11,7 @@ #define __XEN_PUBLIC_EVENT_CHANNEL_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); #include "xen.h" diff --git a/src/include/xen/grant_table.h b/src/include/xen/grant_table.h index f0ae17c41..141a17f56 100644 --- a/src/include/xen/grant_table.h +++ b/src/include/xen/grant_table.h @@ -12,6 +12,7 @@ #define __XEN_PUBLIC_GRANT_TABLE_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); #include "xen.h" diff --git a/src/include/xen/io/netif.h b/src/include/xen/io/netif.h index bec61ab3e..59887a80f 100644 --- a/src/include/xen/io/netif.h +++ b/src/include/xen/io/netif.h @@ -11,6 +11,7 @@ #define __XEN_PUBLIC_IO_NETIF_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); #include "ring.h" #include "../grant_table.h" diff --git a/src/include/xen/io/ring.h b/src/include/xen/io/ring.h index 41b50e2cf..3451bbb52 100644 --- a/src/include/xen/io/ring.h +++ b/src/include/xen/io/ring.h @@ -11,6 +11,7 @@ #define __XEN_PUBLIC_IO_RING_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); /* * When #include'ing this header, you need to provide the following diff --git a/src/include/xen/io/xenbus.h b/src/include/xen/io/xenbus.h index 473f538b8..3bf417c3a 100644 --- a/src/include/xen/io/xenbus.h +++ b/src/include/xen/io/xenbus.h @@ -11,6 +11,7 @@ #define _XEN_PUBLIC_IO_XENBUS_H FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); /* * The state of either end of the Xenbus, i.e. the current communication diff --git a/src/include/xen/io/xs_wire.h b/src/include/xen/io/xs_wire.h index cffd75cde..99dc91781 100644 --- a/src/include/xen/io/xs_wire.h +++ b/src/include/xen/io/xs_wire.h @@ -10,6 +10,7 @@ #define _XS_WIRE_H FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); enum xsd_sockmsg_type { diff --git a/src/include/xen/xen-compat.h b/src/include/xen/xen-compat.h index 8b2361807..8e4ed2434 100644 --- a/src/include/xen/xen-compat.h +++ b/src/include/xen/xen-compat.h @@ -11,6 +11,7 @@ #define __XEN_PUBLIC_XEN_COMPAT_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); #define __XEN_LATEST_INTERFACE_VERSION__ 0x00040e00 diff --git a/src/include/xen/xen.h b/src/include/xen/xen.h index c35008aa0..6d8192f8d 100644 --- a/src/include/xen/xen.h +++ b/src/include/xen/xen.h @@ -11,6 +11,7 @@ #define __XEN_PUBLIC_XEN_H__ FILE_LICENCE ( MIT ); +FILE_SECBOOT ( PERMITTED ); #include "xen-compat.h" diff --git a/src/interface/efi/efi_cacert.c b/src/interface/efi/efi_cacert.c index 64bb0bae2..3e941ddc5 100644 --- a/src/interface/efi/efi_cacert.c +++ b/src/interface/efi/efi_cacert.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/interface/efi/efi_entropy.c b/src/interface/efi/efi_entropy.c index cda1c3640..b6bd12ccc 100644 --- a/src/interface/efi/efi_entropy.c +++ b/src/interface/efi/efi_entropy.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_fbcon.c b/src/interface/efi/efi_fbcon.c index 9c5d7063d..3896fd4d1 100644 --- a/src/interface/efi/efi_fbcon.c +++ b/src/interface/efi/efi_fbcon.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/interface/efi/efi_fdt.c b/src/interface/efi/efi_fdt.c index 3c249693e..cd8580fcb 100644 --- a/src/interface/efi/efi_fdt.c +++ b/src/interface/efi/efi_fdt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_rng.c b/src/interface/efi/efi_rng.c index 058f0ee7d..66b37fe89 100644 --- a/src/interface/efi/efi_rng.c +++ b/src/interface/efi/efi_rng.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/efi/efi_usb.c b/src/interface/efi/efi_usb.c index b09272f58..a3b153c88 100644 --- a/src/interface/efi/efi_usb.c +++ b/src/interface/efi/efi_usb.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/xen/xenbus.c b/src/interface/xen/xenbus.c index 8b5ee0a0d..95bfdf7da 100644 --- a/src/interface/xen/xenbus.c +++ b/src/interface/xen/xenbus.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/xen/xengrant.c b/src/interface/xen/xengrant.c index 269cd5836..b0a15010b 100644 --- a/src/interface/xen/xengrant.c +++ b/src/interface/xen/xengrant.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/interface/xen/xenstore.c b/src/interface/xen/xenstore.c index caeb4e934..a076cd046 100644 --- a/src/interface/xen/xenstore.c +++ b/src/interface/xen/xenstore.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/pccrc.c b/src/net/pccrc.c index 0db6e3cb5..4bf2f441e 100644 --- a/src/net/pccrc.c +++ b/src/net/pccrc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/pccrd.c b/src/net/pccrd.c index 04b5dd86c..a7182c8ee 100644 --- a/src/net/pccrd.c +++ b/src/net/pccrd.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/peerblk.c b/src/net/peerblk.c index 58b185102..6efd4ebf6 100644 --- a/src/net/peerblk.c +++ b/src/net/peerblk.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/peerdisc.c b/src/net/peerdisc.c index 86ff94a87..2ba733697 100644 --- a/src/net/peerdisc.c +++ b/src/net/peerdisc.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/peerdist.c b/src/net/peerdist.c index 3210ac0ec..8e0f5dc13 100644 --- a/src/net/peerdist.c +++ b/src/net/peerdist.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/peermux.c b/src/net/peermux.c index 5c814b03e..7160d1c43 100644 --- a/src/net/peermux.c +++ b/src/net/peermux.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/ping.c b/src/net/ping.c index f0729e159..5782813e1 100644 --- a/src/net/ping.c +++ b/src/net/ping.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/rndis.c b/src/net/rndis.c index a3b562bc2..f04bc775f 100644 --- a/src/net/rndis.c +++ b/src/net/rndis.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/net/tcp/httpntlm.c b/src/net/tcp/httpntlm.c index 25187bd19..a7e44d5f6 100644 --- a/src/net/tcp/httpntlm.c +++ b/src/net/tcp/httpntlm.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/https.c b/src/net/tcp/https.c index 85f1f124f..bccfafe15 100644 --- a/src/net/tcp/https.c +++ b/src/net/tcp/https.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/tcp/syslogs.c b/src/net/tcp/syslogs.c index 5676f3e3e..eff53ea94 100644 --- a/src/net/tcp/syslogs.c +++ b/src/net/tcp/syslogs.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/net/tls.c b/src/net/tls.c index 6140ca58a..4f8ea2692 100644 --- a/src/net/tls.c +++ b/src/net/tls.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); /** * @file diff --git a/src/net/udp/ntp.c b/src/net/udp/ntp.c index 559233575..b3056184d 100644 --- a/src/net/udp/ntp.c +++ b/src/net/udp/ntp.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/net/udp/syslog.c b/src/net/udp/syslog.c index 198c86ef7..07ab3ed0c 100644 --- a/src/net/udp/syslog.c +++ b/src/net/udp/syslog.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); /** @file * diff --git a/src/net/validator.c b/src/net/validator.c index e1371d2e6..c1f353b2a 100644 --- a/src/net/validator.c +++ b/src/net/validator.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/certmgmt.c b/src/usr/certmgmt.c index e6bf51fd8..9056a917c 100644 --- a/src/usr/certmgmt.c +++ b/src/usr/certmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/imgtrust.c b/src/usr/imgtrust.c index e60854c9f..fa8282da0 100644 --- a/src/usr/imgtrust.c +++ b/src/usr/imgtrust.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/ipstat.c b/src/usr/ipstat.c index b9c5e02a7..c0d9739fa 100644 --- a/src/usr/ipstat.c +++ b/src/usr/ipstat.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/neighmgmt.c b/src/usr/neighmgmt.c index fcdcbbfbb..79f62e6d3 100644 --- a/src/usr/neighmgmt.c +++ b/src/usr/neighmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/nslookup.c b/src/usr/nslookup.c index eb2b08b42..e4386e2c0 100644 --- a/src/usr/nslookup.c +++ b/src/usr/nslookup.c @@ -18,6 +18,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/ntpmgmt.c b/src/usr/ntpmgmt.c index 765c6dc9e..8b61662a0 100644 --- a/src/usr/ntpmgmt.c +++ b/src/usr/ntpmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/pingmgmt.c b/src/usr/pingmgmt.c index bb33c5d47..fee6b438b 100644 --- a/src/usr/pingmgmt.c +++ b/src/usr/pingmgmt.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include diff --git a/src/usr/profstat.c b/src/usr/profstat.c index d80fa26b2..7fafd7b5f 100644 --- a/src/usr/profstat.c +++ b/src/usr/profstat.c @@ -22,6 +22,7 @@ */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); +FILE_SECBOOT ( PERMITTED ); #include #include -- cgit v1.2.3-55-g7522