aboutsummaryrefslogtreecommitdiff
path: root/src/crypto
AgeCommit message (Collapse)AuthorFilesLines
2020-12-28[x509] Clarify debug message for an untrusted X.509 issuerJosh McSavaney1-1/+1
We surface this debugging information in cases where a cert actually lacks an issuer, but also in cases where it *has* an issuer, but we cannot trust it (e.g. due to issues in establishing a trust chain). Signed-off-by: Josh McSavaney <me@mcsau.cc> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-15[crypto] Allow private key to be specified as a TLS connection parameterMichael Brown2-11/+28
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-09[x509] Make root of trust a reference-counted structureMichael Brown2-11/+46
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-08[x509] Record root of trust used when validating a certificateMichael Brown2-7/+22
Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-08[ocsp] Remove dummy OCSP certificate rootMichael Brown1-14/+2
OCSP currently calls x509_validate() with an empty root certificate list, on the basis that the OCSP signer certificate (if existent) must be signed directly by the issuer certificate. Using an empty root certificate list is not required to achieve this goal, since x509_validate() already accepts an explicit issuer certificate parameter. The explicit empty root certificate list merely prevents the signer certificate from being evaluated as a potential trusted root certificate. Remove the dummy OCSP root certificate list and use the default root certificate list when calling x509_validate(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-12-08[asn1] Rename ASN1_OID_CURSOR to ASN1_CURSORMichael Brown19-27/+27
There is nothing OID-specific about the ASN1_OID_CURSOR macro. Rename to allow it to be used for constructing ASN.1 cursors with arbitrary contents. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-07-21[deflate] Fix typo in comment describing length codesDaniel Johnson1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-06-25[ocsp] Accept SHA1 certID responses even if SHA1 is not enabledMichael Brown1-15/+25
Various implementation quirks in OCSP servers make it impractical to use anything other than SHA1 to construct the issuerNameHash and issuerKeyHash identifiers in the request certID. For example: both the OpenCA OCSP responder used by ipxe.org and the Boulder OCSP responder used by LetsEncrypt will fail if SHA256 is used in the request certID. As of commit 6ffe28a ("[ocsp] Accept response certID with missing hashAlgorithm parameters") we rely on asn1_digest_algorithm() to parse the algorithm identifier in the response certID. This will fail if SHA1 is disabled via config/crypto.h. Fix by using a direct ASN.1 object comparison on the OID within the algorithm identifier. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2020-06-16[crypto] Allow algorithms to be included without being OID-identifiableMichael Brown20-110/+371
There are many ways in which the object for a cryptographic algorithm may be included, even if not explicitly enabled in config/crypto.h. For example: the MD5 algorithm is required by TLSv1.1 or earlier, by iSCSI CHAP authentication, by HTTP digest authentication, and by NTLM authentication. In the current implementation, inclusion of an algorithm for any reason will result in the algorithm's ASN.1 object identifier being included in the "asn1_algorithms" table, which consequently allows the algorithm to be used for any ASN1-identified purpose. For example: if the MD5 algorithm is included in order to support HTTP digest authentication, then iPXE would accept a (validly signed) TLS certificate using an MD5 digest. Split the ASN.1 object identifiers into separate files that are required only if explicitly enabled in config/crypto.h. This allows an algorithm to be omitted from the "asn1_algorithms" table even if the algorithm implementation is dragged in for some other purpose. The end result is that only the algorithms that are explicitly enabled in config/crypto.h can be used for ASN1-identified purposes such as signature verification. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2019-08-17[crypto] Profile the various stages of modular multiplicationMichael Brown1-0/+29
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2019-08-17[crypto] Drag in configured digestInfo prefixes for any use of RSAMichael Brown1-0/+6
Ensure that the configured RSA digestInfo prefixes are included in any build that includes rsa.o (rather than relying on x509.o or tls.o also being present in the final binary). This allows the RSA self-tests to be run in isolation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2019-03-10[ocsp] Accept response certID with missing hashAlgorithm parametersMichael Brown1-12/+30
One of the design goals of ASN.1 DER is to provide a canonical serialization of a data structure, thereby allowing for equality of values to be tested by simply comparing the serialized bytes. Some OCSP servers will modify the request certID to omit the optional (and null) "parameters" portion of the hashAlgorithm. This is arguably legal but breaks the ability to perform a straightforward bitwise comparison on the entire certID field between request and response. Fix by comparing the OID-identified hashAlgorithm separately from the remaining certID fields. Originally-fixed-by: Thilo Fromm <Thilo@kinvolk.io> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2019-01-25[init] Show startup and shutdown function names in debug messagesMichael Brown2-0/+2
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2018-03-20[rng] Use fixed-point calculations for min-entropy quantitiesMichael Brown1-2/+3
We currently perform various min-entropy calculations using build-time floating-point arithmetic. No floating-point code ends up in the final binary, since the results are eventually converted to integers and asserted to be compile-time constants. Though this mechanism is undoubtedly cute, it inhibits us from using "-mno-sse" to prevent the use of SSE registers by the compiler. Fix by using fixed-point arithmetic instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2018-03-18[ocsp] Centralise test for whether or not an OCSP check is requiredMichael Brown1-2/+2
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-11-12[ntlm] Add support for NTLM authentication mechanismMichael Brown1-0/+334
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-11-12[crypto] Add MD4 message digest algorithmMichael Brown1-0/+280
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-11-12[crypto] Eliminate repetitions in MD5 round constant tableMichael Brown1-7/+10
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-11-11[crypto] Fix endianness typo in commentMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-06-20[crypto] Expose asn1_grow()Michael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2017-06-20[crypto] Expose RSA_CTX_SIZE constantMichael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-31[crypto] Mark permanent certificates as permanentMichael Brown1-0/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-31[crypto] Add certstat() to display basic certificate informationMichael Brown1-2/+2
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-31[crypto] Allow certificates to be marked as having been added explicitlyMichael Brown1-4/+19
Allow certificates to be marked as having been added explicitly at run time. Such certificates will not be discarded via the certificate store cache discarder. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-31[crypto] Expose certstore_del() to explicitly remove stored certificatesMichael Brown1-4/+15
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-25[crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown2-5/+5
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-08-25[crypto] Add image_x509() to extract X.509 certificates from imageMichael Brown1-0/+42
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-07-29[crypto] Enable both DER and PEM formats by defaultMichael Brown1-0/+42
Enable both IMAGE_DER and IMAGE_PEM by default, and drag in the relevant objects only when image_asn1() is present in the binary. This allows "imgverify" to transparently use either DER or PEM signature files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-07-28[crypto] Allow for parsing of partial ASN.1 cursorsMichael Brown1-6/+7
Allow code to create a partial ASN.1 cursor containing only the type and length bytes, so that asn1_start() may be used to determine the length of a large ASN.1 blob without first allocating memory to hold the entire blob. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-05-08[arm] Avoid instruction references to symbols defined via ".equ"Michael Brown1-2/+8
When building for 64-bit ARM, some symbol references may be resolved via an "adrp" instruction (to obtain the start of the 4kB page containing the symbol) and a separate 12-bit offset. For example (taken from the GNU assembler documentation): adrp x0, foo ldr x0, [x0, #:lo12:foo] We occasionally refer to symbols defined via mechanisms that are not directly visible to gcc. For example: extern char some_magic_symbol[]; __asm__ ( ".equ some_magic_symbol, some_magic_expression" ); The subsequent use of the ":lo12:" prefix on such magically-defined symbols triggers an assertion failure in the assembler. This problem seems to affect only "private_key_len" in the current codebase. Fix by storing this value as static data; this avoids the need to provide the value as a literal within the instruction stream, and so avoids the problematic use of the ":lo12:" prefix. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-20[crypto] Allow trusted certificates to be stored in non-volatile optionsMichael Brown1-3/+7
The intention of the existing code (as documented in its own comments) is that it should be possible to override the list of trusted root certificates using a "trust" setting held in non-volatile stored options. However, the rootcert_init() function currently executes before any devices have been probed, and so will not be able to retrieve any such non-volatile stored options. Fix by executing rootcert_init() only after devices have been probed. Since startup functions may be executed multiple times (unlike initialisation functions), add an explicit flag to preserve the property that rootcert_init() should run only once. As before, if an explicit root of trust is specified at build time, then any runtime "trust" setting will be ignored. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-13[build] Allow assembler section type character to vary by architectureMichael Brown2-2/+2
On some architectures (such as ARM) the "@" character is used as a comment delimiter. A section type argument such as "@progbits" therefore becomes "%progbits". This is further complicated by the fact that the "%" character has special meaning for inline assembly when input or output operands are used, in which cases "@progbits" becomes "%%progbits". Allow the section type character(s) to be defined via Makefile variables. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-03-11[crypto] Allow for zero-length ASN.1 cursorsMichael Brown1-12/+0
The assumption in asn1_type() that an ASN.1 cursor will always contain a type byte is incorrect. A cursor that has been cleanly invalidated via asn1_invalidate_cursor() will contain a type byte, but there are other ways in which to arrive at a zero-length cursor. Fix by explicitly checking the cursor length in asn1_type(). This allows asn1_invalidate_cursor() to be reduced to simply zeroing the length field. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-01-21[ocsp] Avoid including a double path separator in request URIMichael Brown1-28/+26
The OCSP responder URI included within an X.509 certificate may or may not include a trailing slash. We currently rely on the fact that format_uri() incorrectly inserts an initial slash, which we include unconditionally within the OCSP request URI. Switch to using uri_encode() directly, and insert a slash only if the X.509 certificate's OCSP responder URI does not already include a trailing slash. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2016-01-04[crypto] Dual-license more selected DRBG filesMichael Brown1-0/+12
Allow the use of the iPXE DRBG implementation in BSD-licensed projects. Requested-by: Sean Davis <dive@hq.endersgame.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-12-31[crypto] Dual-license selected DRBG filesMichael Brown4-0/+48
Allow the use of the iPXE DRBG implementation in BSD-licensed projects. Requested-by: Sean Davis <dive@hq.endersgame.net> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-08-02[crypto] Support SHA-{224,384,512} in X.509 certificatesMichael Brown10-72/+460
Add support for SHA-224, SHA-384, and SHA-512 as digest algorithms in X.509 certificates, and allow the choice of public-key, cipher, and digest algorithms to be configured at build time via config/crypto.h. Originally-implemented-by: Tufan Karadere <tufank@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-07-27[build] Fix strict-aliasing warning on older gcc versionsMichael Brown1-4/+8
Reported-by: James A. Peltier <jpeltier@sfu.ca> Reported-by: Matthew Helton <mwhelton@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-07-27[crypto] Remove AXTLS headersMichael Brown5-526/+0
Remove AXTLS headers now that no AXTLS code remains, with many thanks to the AXTLS project for use of their cryptography code over the past several years. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-07-27[crypto] Replace AES implementationMichael Brown3-622/+804
Replace the AES implementation from AXTLS with a dedicated iPXE implementation which is slightly smaller and around 1000% faster. This implementation has been verified using the existing self-tests based on the NIST AES test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-07-27[crypto] Add ECB block cipher mode (for debug and self-tests only)Michael Brown2-1/+86
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-24[base64] Add buffer size parameter to base64_encode() and base64_decode()Michael Brown1-1/+1
Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-24[base16] Add buffer size parameter to base16_encode() and base16_decode()Michael Brown1-1/+2
The current API for Base16 (and Base64) encoding requires the caller to always provide sufficient buffer space. This prevents the use of the generic encoding/decoding functionality in some situations, such as in formatting the hex setting types. Implement a generic hex_encode() (based on the existing format_hex_setting()), implement base16_encode() and base16_decode() in terms of the more generic hex_encode() and hex_decode(), and update all callers to provide the additional buffer length parameter. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-12[crypto] Add SHA-512/224 algorithmMichael Brown1-0/+83
SHA-512/224 is almost identical to SHA-512, with differing initial hash values and a truncated output length. This implementation has been verified using the NIST SHA-512/224 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-12[crypto] Add SHA-512/256 algorithmMichael Brown1-0/+83
SHA-512/256 is almost identical to SHA-512, with differing initial hash values and a truncated output length. This implementation has been verified using the NIST SHA-512/256 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-12[crypto] Add SHA-384 algorithmMichael Brown1-0/+82
SHA-384 is almost identical to SHA-512, with differing initial hash values and a truncated output length. This implementation has been verified using the NIST SHA-384 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-12[crypto] Add SHA-512 algorithmMichael Brown2-4/+307
This implementation has been verified using the NIST SHA-512 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-04-12[crypto] Add SHA-224 algorithmMichael Brown2-13/+118
SHA-224 is almost identical to SHA-256, with differing initial hash values and a truncated output length. This implementation has been verified using the NIST SHA-224 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-05[build] Fix the REQUIRE_SYMBOL mechanismMichael Brown1-0/+3
At some point in the past few years, binutils became more aggressive at removing unused symbols. To function as a symbol requirement, a relocation record must now be in a section marked with @progbits and must not be in a section which gets discarded during the link (either via --gc-sections or via /DISCARD/). Update REQUIRE_SYMBOL() to generate relocation records meeting these criteria. To minimise the impact upon the final binary size, we use existing symbols (specified via the REQUIRING_SYMBOL() macro) as the relocation targets where possible. We use R_386_NONE or R_X86_64_NONE relocation types to prevent any actual unwanted relocation taking place. Where no suitable symbol exists for REQUIRING_SYMBOL() (such as in config.c), the macro PROVIDE_REQUIRING_SYMBOL() can be used to generate a one-byte-long symbol to act as the relocation target. If there are versions of binutils for which this approach fails, then the fallback will probably involve killing off REQUEST_SYMBOL(), redefining REQUIRE_SYMBOL() to use the current definition of REQUEST_SYMBOL(), and postprocessing the linked ELF file with something along the lines of "nm -u | wc -l" to check that there are no undefined symbols remaining. Signed-off-by: Michael Brown <mcb30@ipxe.org>
2015-03-02[legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown23-23/+115
Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit v1.1 at 2025-03-13 16:29:28 +0000