aboutsummaryrefslogtreecommitdiff
path: root/src/tests
AgeCommit message (Collapse)AuthorFilesLines
2023-01-31[tests] Verify ability to sleep the CPUnaptestMichael Brown2-0/+54
The self-test suite does not currently ever attempt to sleep the CPU. This is an operation that may fail (e.g. by attempting to execute a privileged instruction while running as a Linux userspace binary, or by halting the CPU with all interrupts disabled). Add a trivial self-test to exercise the ability to sleep the CPU without crashing or halting forever. Inspired-by: Xiaotian Wu <wuxiaotian@loongson.cn> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2023-01-14[netdevice] Separate concept of scope ID from network device name indexMichael Brown1-2/+2
The network device index currently serves two purposes: acting as a sequential index for network device names ("net0", "net1", etc), and acting as an opaque unique integer identifier used in socket address scope IDs. There is no particular need for these usages to be linked, and it can lead to situations in which devices are named unexpectedly. For example: if a system has two network devices "net0" and "net1", a VLAN is created as "net1-42", and then a USB NIC is connected, then the USB NIC will be named "net3" rather than the expected "net2" since the VLAN device "net1-42" will have consumed an index. Separate the usages: rename the "index" field to "scope_id" (matching its one and only use case), and assign the name without reference to the scope ID by finding the first unused name. For consistency, assign the scope ID by similarly finding the first unused scope ID. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-11-10[tests] Verify ability to perform in-place encryption and decryptionMichael Brown1-4/+6
TLS relies upon the ability of ciphers to perform in-place decryption, in order to avoid allocating additional I/O buffers for received data. Add verification of in-place encryption and decryption to the cipher self-tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-11-09[tests] Verify ability to reset cipher initialisation vectorMichael Brown1-0/+38
TLS relies upon the ability to reuse a cipher by resetting only the initialisation vector while reusing the existing key. Add verification of resetting the initialisation vector to the cipher self-tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-11-07[crypto] Add concept of cipher alignment sizeMichael Brown1-0/+10
The GCM cipher mode of operation (in common with other counter-based modes of operation) has a notion of blocksize that does not neatly fall into our current abstraction: it does operate in 16-byte blocks but allows for an arbitrary overall data length (i.e. the final block may be incomplete). Model this by adding a concept of alignment size. Each call to encrypt() or decrypt() must begin at a multiple of the alignment size from the start of the data stream. This allows us to model GCM by using a block size of 1 byte and an alignment size of 16 bytes. As a side benefit, this same concept allows us to neatly model the fact that raw AES can encrypt only a single 16-byte block, by specifying an alignment size of zero on this cipher. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-25[crypto] Add block cipher Galois/Counter mode of operationMichael Brown2-0/+402
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-25[crypto] Add concept of authentication tag to cipher algorithmsMichael Brown3-7/+32
Some ciphers (such as GCM) support the concept of a tag that can be used to authenticate the encrypted data. Add a cipher method for generating an authentication tag. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-25[crypto] Add concept of additional data to cipher algorithmsMichael Brown3-8/+32
Some ciphers (such as GCM) support the concept of additional authenticated data, which does not appear in the ciphertext but may affect the operation of the cipher. Allow cipher_encrypt() and cipher_decrypt() to be called with a NULL destination buffer in order to pass additional data. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-25[crypto] Allow initialisation vector length to vary from cipher blocksizeMichael Brown1-3/+3
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-11[crypto] Add Ephemeral Diffie-Hellman key exchange algorithmMichael Brown2-0/+783
Add an implementation of the Ephemeral Diffie-Hellman key exchange algorithm as defined in RFC2631, with test vectors taken from the NIST Cryptographic Toolkit. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-10[crypto] Simplify internal HMAC APIMichael Brown2-15/+8
Simplify the internal HMAC API so that the key is provided only at the point of calling hmac_init(), and the (potentially reduced) key is stored as part of the context for later use by hmac_final(). This simplifies the calling code, and avoids the need for callers such as TLS to allocate a potentially variable length block in order to retain a copy of the unmodified key. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-10-10[test] Add HMAC self-testsMichael Brown2-0/+212
The HMAC code is already tested indirectly via several consuming algorithms that themselves provide self-tests (e.g. HMAC-DRBG, NTLM authentication, and PeerDist content identification), but lacks any direct test vectors. Add explicit HMAC tests and ensure that corner cases such as empty keys, block-length keys, and over-length keys are all covered. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-09-06[ipv6] Fix mask calculation when prefix length is not a multiple of 8Michael Brown1-0/+37
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-09-06[test] Validate constructed IPv6 routing table entriesMichael Brown1-12/+52
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-03-25[acpi] Support the "_RTXMAC_" format for ACPI-based MAC addressesMichael Brown1-0/+19
Some newer HP products expose the host-based MAC (HBMAC) address using an ACPI method named "RTMA" returning a part-binary string of the form "_RTXMAC_#<mac>#", where "<mac>" comprises the raw MAC address bytes. Extend the existing support to handle this format alongside the older "_AUXMAC_" format (which uses a base16-encoded MAC address). Reported-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Tested-by: Andreas Hammarskjöld <junior@2PintSoftware.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-03-24[acpi] Add MAC address extraction self-testsMichael Brown2-0/+239
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-03-15[utf8] Add UTF-8 accumulation self-testsMichael Brown2-0/+165
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-01-13[uri] Allow for relative URIs that include colons within the pathuricolonMichael Brown1-0/+10
RFC3986 allows for colons to appear within the path component of a relative URI, but iPXE will currently parse such URIs incorrectly by interpreting the text before the colon as the URI scheme. Fix by checking for valid characters when identifying the URI scheme. Deliberately deviate from the RFC3986 definition of valid characters by accepting "_" (which was incorrectly used in the iPXE-specific "ib_srp" URI scheme and so must be accepted for compatibility with existing deployments), and by omitting the code to check for characters that are not used in any URI scheme supported by iPXE. Reported-by: Ignat Korchagin <ignat@cloudflare.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2022-01-04[settings] Support formatting UUIDs as little-endian GUIDsguidMichael Brown1-0/+10
The RFC4122 specification defines UUIDs as being in network byte order, but an unfortunately significant amount of (mostly Microsoft) software treats them as having the first three fields in little-endian byte order. In an ideal world, any server-side software that compares UUIDs for equality would perform an endian-insensitive comparison (analogous to comparing strings for equality using a case-insensitive comparison), and would therefore not care about byte order differences. Define a setting type name ":guid" to allow a UUID setting to be formatted in little-endian order, to simplify interoperability with server-side software that expects such a formatting. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2021-11-12[uri] Retain original encodings for path, query, and fragment fieldsuriMichael Brown1-13/+40
iPXE decodes any percent-encoded characters during the URI parsing stage, thereby allowing protocol implementations to consume the raw field values directly without further decoding. When reconstructing a URI string for use in an HTTP request line, the percent-encoding is currently reapplied in a reversible way: we guarantee that our reconstructed URI string could be decoded to give the same raw field values. This technically violates RFC3986, which states that "URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent". Experiments show that several HTTP server applications will attach meaning to the choice of whether or not a particular character was percent-encoded, even when the percent-encoding is unnecessary from the perspective of parsing the URI into its component fields. Fix by storing the originally encoded substrings for the path, query, and fragment fields and using these original encoded versions when reconstructing a URI string. The path field is also stored as a decoded string, for use by protocols such as TFTP that communicate using raw strings rather than URI-encoded strings. All other fields (such as the username and password) continue to be stored only in their decoded versions since nothing ever needs to know the originally encoded versions of these fields. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2021-05-18[x509] Use case-insensitive comparison for certificate namesMichael Brown1-0/+1
DNS names are case-insensitive, and RFC 5280 (unlike RFC 3280) mandates support for case-insensitive name comparison in X.509 certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2021-05-18[libc] Add strncasecmp()Michael Brown1-0/+8
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2021-05-08[gzip] Add support for gzip archive imagesimgextractMichael Brown2-0/+161
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2021-05-08[zlib] Add support for zlib archive imagesMichael Brown2-0/+134
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-09[x509] Make root of trust a reference-counted structureMichael Brown2-0/+5
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-08[x509] Record root of trust used when validating a certificateMichael Brown2-1/+6
Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-07-21[libc] Fix memcmp() to return proper valuesMichael J. Bazzinotti1-0/+1
Fix memcmp() to return proper standard positive/negative values for unequal comparisons. Current implementation is backwards (i.e. the functions are returning negative when should be positive and vice-versa). Currently most consumers of these functions only check the return value for ==0 or !=0 and so we can safely change the implementation without breaking things. However, there is one call that checks the polarity of this function, and that is prf_sha1() for wireless WPA 4-way handshake. Due to the incorrect memcmp() polarity, the WPA handshake creates an incorrect PTK, and the handshake would fail after step 2. Undoubtedly, the AP noticed the supplicant failed the mic check. This commit fixes that issue. Similar to commit 3946aa9 ("[libc] Fix strcmp()/strncmp() to return proper values"). Signed-off-by: Michael Bazzinotti <bazz@bazz1.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-06-16[crypto] Ensure that test code drags in required ASN.1 object identifiersMichael Brown1-12/+13
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2019-01-15[libc] Fix strcmp()/strncmp() to return proper valuesAaron Young1-0/+1
Fix strcmp() and strncmp() to return proper standard positive/negative values for unequal strings. Current implementation is backwards (i.e. the functions are returning negative when should be positive and vice-versa). Currently all consumers of these functions only check the return value for ==0 or !=0 and so we can safely change the implementation without breaking things. Signed-off-by: Aaron Young <Aaron.Young@oracle.com> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2018-03-24[list] Add list_is_first_entry() and list_is_last_entry()Michael Brown1-0/+21
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-11-12[ntlm] Add support for NTLM authentication mechanismMichael Brown2-0/+313
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-11-12[crypto] Add MD4 message digest algorithmMichael Brown2-0/+77
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-03-29[build] Avoid implicit-fallthrough warnings on GCC 7Michael Brown1-2/+3
Reported-by: Vinson Lee <vlee@freedesktop.org> Reported-by: Liang Yan <lyan@suse.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-31[list] Add list_next_entry() and list_prev_entry()Michael Brown1-0/+23
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-25[crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-07-29[crypto] Add PEM image formatMichael Brown2-0/+108
Add PEM-encoded ASN.1 as an image format. We accept as PEM any image containing a line starting with a "-----BEGIN" boundary marker. We allow for PEM files containing multiple ASN.1 objects, such as a certificate chain produced by concatenating individual certificate files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-07-29[crypto] Add DER image formatMichael Brown4-0/+255
Add DER-encoded ASN.1 as an image format. There is no fixed signature for DER files. We treat an image as DER if it comprises a single valid SEQUENCE object covering the entire length of the image. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-07-25[ipv6] Allow for multiple routersMichael Brown1-0/+281
Select the IPv6 source address and corresponding router (if any) using a very simplified version of the algorithm from RFC6724: - Ignore any source address that has a smaller scope than the destination address. For example, do not use a link-local source address when sending to a global destination address. - If we have a source address which is on the same link as the destination address, then use that source address. - If we are left with multiple possible source addresses, then choose the address with the smallest scope. For example, if we are sending to a site-local destination address and we have both a global source address and a site-local source address, then use the site-local source address. - If we are still left with multiple possible source addresses, then choose the address with the longest matching prefix. For the purposes of this algorithm, we treat RFC4193 Unique Local Addresses as having organisation-local scope. Since we use only link-local scope for our multicast transmissions, this approximation should remain valid in all practical situations. Originally-implemented-by: Thomas Bächler <thomas@archlinux.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-07-25[test] Update IPv6 tests to use okx()Michael Brown1-25/+39
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-06-09[pci] Support systems with multiple PCI root bridgesMichael Brown1-1/+3
Extend the 16-bit PCI bus:dev.fn address to a 32-bit seg:bus:dev.fn address, assuming a segment value of zero in contexts where multiple segments are unsupported by the underlying data structures (e.g. in the iBFT or BOFM tables). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-05-05[bitops] Fix typo in test caseMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-04-12[libc] Print "<NULL>" for wide-character NULL stringsMichael Brown1-0/+4
The existing code intends to print NULL strings as "<NULL>" (for the sake of debug messages), but the logic is incorrect when handling wide-character strings. Fix the logic and add applicable unit tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-04-12[test] Update snprintf_ok() to use okx()Michael Brown1-14/+25
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-17[test] Move i386-specific tests to arch/i386/testsMichael Brown4-346/+0
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-16[bitops] Add generic atomic bit test, set, and clear functionsMichael Brown2-0/+103
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-14[uri] Support "file:" URIs describing relative pathsMichael Brown1-2/+2
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-13[uri] Support URIs containing only scheme and path componentsMichael Brown1-0/+31
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-12[test] Add missing #include <string.h>Michael Brown1-0/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-02-11[iobuf] Improve robustness of I/O buffer allocationMichael Brown2-0/+137
Guard against various corner cases (such as zero-length buffers, zero alignments, and integer overflow when rounding up allocation lengths and alignments) and ensure that the struct io_buffer is correctly aligned even when the caller requests a non-zero alignment for the I/O buffer itself. Add self-tests to verify that the resulting alignments and lengths are correct for a range of allocations. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-01-26[uri] Apply URI decoding for all parsed URIsMichael Brown1-0/+14
The various early-exit paths in parse_uri() accidentally bypass the URI field decoding. The result is that opaque or relative URIs do not undergo URI field decoding, resulting in double-encoding when the URIs are subsequently used. For example: #!ipxe set mac ${macstring} imgfetch /boot/by-mac/${mac:uristring} would result in an HTTP GET such as GET /boot/by-mac/00%253A0c%253A29%253Ac5%253A39%253Aa1 HTTP/1.1 rather than the expected GET /boot/by-mac/00%3A0c%3A29%3Ac5%3A39%3Aa1 HTTP/1.1 Fix by ensuring that URI decoding is always applied regardless of the URI format. Reported-by: Andrew Widdersheim <awiddersheim@inetu.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.1 at 2024-09-11 15:04:23 +0000