summaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* lib/talloc: Fix TALLOC_ABORTGeoff Levand2018-08-141-14/+9
| | | | | | | | | | | | | | The current TALLOC_ABORT macro had a number of problems. Failures were not going to the pb log, but only to stderr. If the object passed in was not a talloc object the printing of an object name would be printing random data. The use of a macro obscured the code. To clean this up, remove all reference to TALLOC_ABORT and put the logging and abort calls directly into talloc_chunk_from_ptr. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* pb_log: Break out timestampGeoff Levand2018-08-141-2/+9
| | | | | | | Fixes double timestamp on pb_log_fn, pb_debug_fn. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/system: Add dmidecode as system appGeoff Levand2018-08-072-0/+2
| | | | | | | For use by the arm64 get_sysinfo. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover/powerpc: Switch to new param_listGeoff Levand2018-08-071-0/+1
| | | | | | Signed-off-by: Geoff Levand <geoff@infradead.org> [Name string fixup] Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/param_list: Add new parameter list routinesGeoff Levand2018-08-073-1/+169
| | | | | | | | Based on the powerpc param routines adds new generic routines to manage a name + value parameter list. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/efi: Cleanup read/write routinesGeoff Levand2018-08-072-104/+112
| | | | | | | | | | Make a new stucture struct efi_data to hold the info that describes an efi variable. Make a common routine efi_open that opens the efi variable file. Switch the efi get/set/del routines over to use efi_open. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/efi: Add new routines to access efi variablesGe Song2018-08-073-1/+240
| | | | | | | | | | Provide methods to load/store petitboot's configuration on efi-based platforms. A test case is also provided. Signed-off-by: Ge Song <ge.song@hxt-semitech.com> [Cleanup file comments, make efivarfs_path static.] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/process: Add process_get_stdoutGeoff Levand2018-08-072-18/+62
| | | | | | | | | | | | Add a new structure 'struct process_stdout' and optional parameter 'stdout' to the process_run_simple functions to allow the caller to get a buffer filled with the stdout from the child process. Rename the process_run_simple functions to process_get_stdout and add wrappers for the old process_run_simple function names. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/process: Cleanup stdout callbackGeoff Levand2018-08-072-25/+9
| | | | | | | | | | | General cleanup of async stdout processing. The process_stdout_cb and process_stdout_custom routines were doing the same thing, so rename process_stdout_custom to process_process_stdout and make process_stdout_cb a wrapper that calls process_process_stdout. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Add --debug to kexecGeoff Levand2018-08-072-0/+6
| | | | | | | | | If verbose logging is enabled then add '--debug' to the kexec command line. Adds a new routine pb_log_get_debug() that can be used to query the log debug state. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/log: Switch to pb_log_fnGeoff Levand2018-08-078-41/+41
| | | | | | | | The only functional change should be an additional '/n' to a few log messagees that seemed to be missing it. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/log: Add verbose logging routinesGeoff Levand2018-08-072-0/+41
| | | | | | | | | | Add three new logging routines pb_log_fn and pb_debug_fn, which print the calling function's name to the log, and pb_debug_fl which prints the calling function's name and the file line number to the log. Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/log: Include timestamp prefixSamuel Mendoza-Jonas2018-07-301-0/+11
| | | | | | | | The relative time between logged events is very useful during debugging, particularly when debugging autoboot failures. Prepend a short HH:MM:SS timestamp to each line logged. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/system: Add udhcpc6Samuel Mendoza-Jonas2018-07-102-0/+2
| | | | Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib: Add support and helpers for IPv6 host addressesSamuel Mendoza-Jonas2018-07-104-6/+48
| | | | | | | | Recognise IPv6 addresses and URLs, and allow an interface_info struct to have both an IPv4 and IPv6 address. The addr_scheme() helper returns the address family of a given address. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* protocol: Add definition and serialisation for temporary autobootJeremy Kerr2018-07-102-0/+76
| | | | | | | Add a new message format for a temporarily-applied autoboot setting. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/security: hard_lockdown flag to stop runtime disable of signed bootBrett Grandbois2018-06-122-1/+5
| | | | | | | | | | | | | | | Currently if signed-boot is enabled in configure the presence of the LOCKDOWN_FILE is used as a runtime determination to perform the actual verification. In some environments this may be acceptable or even the intended operation but in other environments could be a security hole since the removal of the file will then cause boot task verification. Add a 'hard_lockdown' enable flag to generate a HARD_LOCKDOWN preprocessor definition to force the system to always do a signed boot verification for each boot task, which in the case of a missing file the boot will fail. Signed-off-by: Brett Grandbois <brett.grandbois@opengear.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Rescan SCSI devices on reinitSamuel Mendoza-Jonas2018-06-122-0/+2
| | | | | | | Explicitly rescan SCSI devices on reinit rather than just remounting them in case a device did not init properly on boot. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/security: add in openssl supportBrett Grandbois2018-05-307-291/+849
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactor to export a generic API rather than specific gpg_ prefixes by changing gpg.h to security.h and renaming some of the exports. Break out the common and specific functionality into common.c and none.c/gpg.c/openssl.c for no/gpgme/openssl modes respectively. gpgme should work as before OpenSSL support works like this: The pb-lockdown file is a PKCS12 file or X509 certificate or PEM-encoded raw public key. To follow the current conventions the presence of a PKCS12 file as a lockdown signals decrypt mode because of the presence of the private key, anything else signals signature verification mode. The keyring path is currently ignored but in the future could be used to point to an X509 certificate chain for validity checking. Because of this self-signed certificates are currently supported and really just used as a public key container. Signature verification mode supports: * Cryptographic Message Syntax (CMS) as detached S/MIME, this is really more for consistency for the encryption mode (see below). This mode requires the lockdown file to be an X509 certificate. A sample creation command would be: openssl cms -sign -in (infile) -out (outfile) -binary -nocerts \ -inkey (private key) -signer (recipient certificate) * Raw signature digest as output from openssl dgst -sign command. This mode can have the lockdown file be an X509 certificate or a PEM raw public key but the digest algorithm must be pre-defined by the VERIFY_DIGEST configure argument. The default is SHA256. A sample creation command would be: openssl dgst -sign (private key) -out (outfile) -(digest mode) \ (infile) Decryption mode supports: * CMS signed-envelope as attached S/MIME. This is for consistency with the current expectation of no external file for decryption. Some future enhancement could be to come up with some proprietary external file format containing the cipher used, the encrypted cipher key, and the IV (if necessary). A sample creation command would be: openssl cms -sign -in (infile) -signer (recipient certificate) \ -binary -nocerts -nodetach -inkey (private key) | \ openssl cms -encrypt -(cipher mode) -out (outfile) \ (recipient certificate) The PKCS12 file is expecting the private key to have password of NULL or "" as there is currently no mechanism to supply a custom one. Signed-off-by: Brett Grandbois <brett.grandbois@opengear.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/file: remove mkstemp umask in copy_file_secure_destBrett Grandbois2018-05-041-3/+0
| | | | | | | | | mkstemp will generate the temp file with permissions 0600 so the umask(0644) is causing the file to have permissions of 0000, making signature files unreadable Signed-off-by: Brett Grandbois <brett.grandbois@opengear.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/security: Fix broken if statements in gpg_validate_boot_files()Samuel Mendoza-Jonas2018-03-231-2/+4
| | | | | | | | | | | | | | The patch ccb478ac "Add encrypted file support" removes two result = KEXEC_LOAD_SIGNATURE_FAILURE; statements from after the `if (verify_file_signature)` lines for the kernel and cmdline signatures. This appears to have been a mistake that snuck through testing, and would allow incorrect signatures to pass validation. Also fix up some confusing indenting in the decryption section. Reported-by: Brett Grandbois <brett.grandbois@opengear.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/file: Avoid off-by-one error in arraySamuel Mendoza-Jonas2018-03-231-1/+1
| | | | | | Fixes Coverity defect CIDs 143606, 143610 Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Minor fixes for make distcheckSamuel Mendoza-Jonas2018-03-231-0/+1
| | | | | | | | Include the CCAN endian.h header in build sources and change the --with-twin-foo options to default off - most users are not building with libtwin so avoid having configure fail for them. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib: Fix gpg.h pathSamuel Mendoza-Jonas2018-03-071-1/+1
| | | | Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* ui/ncurses: Spawn shell in exit handlerSamuel Mendoza-Jonas2017-10-042-0/+2
| | | | | | | | | In cui_on_exit()_ instead of exiting the program spawn a sh instance. This allows the user to drop to the shell and return without losing any custom boot options, for example. SIGINT still calls cui_abort() to properly exit Petitboot. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/flash: Update type of size fieldSamuel Mendoza-Jonas2017-08-231-2/+2
| | | | | | | | Skiboot commit c043065 "flash: Make size 64 bit safe" updated the prototype of blocklevel_get_info() to use a uint64_t for the size parameter. Update our usage to reflect this. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Handle plugin install requestSamuel Mendoza-Jonas2017-08-151-0/+1
| | | | | | | | | Handle "_PLUGIN_INSTALL" requests from clients. Calling the pb-plugin script from pb-discover ensures different clients don't trip over each other. Successfully installed plugins are automatically communicated back to clients once pb-plugin sends a 'plugin' user event. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Add pb-plugin and pb-exec to pb_system_appsSamuel Mendoza-Jonas2017-08-152-0/+4
| | | | Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/process: Add raw stdout modeSamuel Mendoza-Jonas2017-08-152-2/+6
| | | | | | | Allow process users to set 'raw_stdout', which if set skips redirecting and saving output from processes. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover/pxe-parser: Recognise plugin sourcesSamuel Mendoza-Jonas2017-08-152-1/+17
| | | | | | | | | | | | | Extend the pxe-parser to recognise 'PLUGIN' as well as the usual 'LABEL' when parsing a config file. 'PLUGIN' will be used to specify an option that provides the location of an installable pb-plugin file, named by the 'TARBALL' label. Since plugin options are discovered via the same mechanism as boot options treat them the same as boot options and at the 'type' field to the boot_option struct to differentiate between them. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib: Add plugin_option type and protocolSamuel Mendoza-Jonas2017-08-153-0/+127
| | | | | | | | | | Add a new struct 'plugin_option' to represent pb-plugins that are installed on the system. This consists of plugin metadata and an array of installed executables. This also adds two new pb-protocol actions to advertise the addition of a new plugin_option, and to remove known plugin_options. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/system: Add vgscan, vgchange utilitiesSamuel Mendoza-Jonas2017-07-112-0/+4
| | | | Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Track both configured and current autoboot settingsSamuel Mendoza-Jonas2017-03-152-0/+14
| | | | | | | | | | | | | | | If autoboot is enabled but later disabled or cancelled by, for example, an IPMI override then the nc-config screen will set the autoboot widget as disabled. If the user then makes and saves a change in nc-config, autoboot will also be saved as disabled. This accidental change is particularly awkward if the user is attempting to remove an IPMI override. Instead only ever change the autoboot setting if the user explicitly changes it. Use a new helper function 'config_autoboot_active()' to determine the current autoboot status where needed. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* process: Cancel all asynchronous jobs on reinitv1.4.1Samuel Mendoza-Jonas2017-01-312-0/+23
| | | | | | | | | | | If an asynchronous job is running over a reinit, the process can return and run its callback function after the reinit. This becomes a problem if the callback function accesses pointers that were only valid before the reinit (eg. device structs). If a reinit is requested explicitly stop all active asynchronous jobs and clear their callback functions before the reinit. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Record IP address of network interfacesSamuel Mendoza-Jonas2016-12-202-1/+8
| | | | | | | | If an interface has a valid IP address (either via DHCP or static config) store it in the interface_info struct so it can be referenced later. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Maintain a backlog of status updatesSamuel Mendoza-Jonas2016-12-202-1/+15
| | | | | | | | | Add status updates to a persistent list in the discover_server struct, and send each client the backlog on connect. This avoids clients missing useful messages from early init. Clients will only show this in the backlog screen to avoid flooding the client's status line. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/process: Allow process output to be retrieved on each eventSamuel Mendoza-Jonas2016-12-202-5/+43
| | | | | | | | | | | | | | | | Allow a custom callback function to be set when registering the IO waiter for asynchronous processes. To allow output from processes to be parsed as it is received, add process_stdout_custom() which passes a new "line" parameter to process_read_stdout_once() in order to consume output as it appears. Users of a custom IO callback will only have access to the process_info struct which is internal to lib/process; the function procinfo_get_process() is added to allow these callers to access process information. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* types: Remove detail and progress from struct statusJeremy Kerr2016-12-202-21/+1
| | | | | | | Nothing used these, and the serialisation was buggy anyway. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* types: shorten boot_status definitionsJeremy Kerr2016-12-203-12/+12
| | | | | | | | | | | struct boot_status is a bit misnamed; we report status on things that aren't just the boot status (eg, discovery). This change refactors struct boot_status into just struct status. We give the type enum a name, and shorten the enum values to suit. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Support HTTP(S) proxies when downloading resourcesSamuel Mendoza-Jonas2016-11-243-0/+19
| | | | | | | | Allow the user to specify a HTTP and HTTPS proxy server. The discover server will set the http_proxy and https_proxy environment variables, enabling the proxy servers for any further HTTP(S) requests. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/file: Fix errors found by Coverity scanSamuel Mendoza-Jonas2016-10-111-34/+51
| | | | | | | | | | | | | | Fix several errors in copy_file_secure_dest() found by Coverity and some minor formatting issues: 143603: Correctly handle mkstemp() return value 143605: Avoid accessing dest_filename[-1] on readlink() error 143606, 143610: Avoid accessing dest_filename[sizeof(dest_filename)] 143607: Fix incorrectly passing sizeof(pointer) to fread() 143608, 143611: Cleanup resources on early exit 143609: Explicitly set umask before calling mkstemp() Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Consolidate petitboot,tty and petitboot,consoleSamuel Mendoza-Jonas2016-09-083-0/+9
| | | | | | | | | | | | | | | | | | | | Commit ce54f86 "Add petitboot,tty and track available consoles" added the petitboot,tty parameter, but the petitboot,console parameter is also recognised by Petitboot. These are ultimately handled by the 30-add-offb and 80-set-stdout hooks respectively, but exist for mostly the same purpose. We consolidate these down to just the original petitboot,console parameter. If the contents of petitboot,console have been configured by Petitboot (ie. it is of the form /dev/dev# [ Description ]) we behave as normal, otherwise we assume that petitboot,console contains a full OF path to the intended console device and do not allow it to be modified. This follows petitboot,console's original intent to be a debug aid, and takes precedence over any other use. The 80-set-stdout hook is removed as 30-add-offb now accounts for both use cases. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Use 'consoles' instead of 'tty' to refer to interfacesSamuel Mendoza-Jonas2016-09-083-30/+30
| | | | | | | 'Console' is more readily understandable and technically more correct than 'tty' for referring to the interfaces that Petitboot starts a UI on. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover: Avoid writing network overrides to NVRAMSamuel Mendoza-Jonas2016-09-083-0/+11
| | | | | | | | Explicitly keep track of whether the current interface config was set by an IPMI network override, and avoid overwriting any saved config unless the override was marked persistent. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Add encrypted file supporttpearson@raptorengineering.com2016-08-262-28/+275
| | | | | | | | | | | | In certain cases, such as network booting over an untrusted connection, it may be useful to fully encrypt and sign the kernel files. Enable fully encrypted boot using builtin keyring via the addition of the string "ENCRYPTED" to the first line of the /etc/pb-lockdown file. This disables detached (plaintext) signature verification. Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* Add support for GPG signature enforcement on bootedtpearson@raptorengineering.com2016-08-267-1/+513
| | | | | | | | | | | | | kernels and related blobs This can be used to implement a form of organization-controlled secure boot, whereby kernels may be loaded from a variety of sources but they will only boot if a valid signature file is found for each component, and only if the signature is listed in the /etc/pb-lockdown file. Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com> (Minor build fixes and gpgme.m4, comment on secure boot in gpg.c)
* lib: Add support for tracking boot consolesSamuel Mendoza-Jonas2016-06-283-2/+49
| | | | | | | | | | Add tty_list and boot_tty to the config struct to keep track of available console interfaces and the default console to set as primary respectively. Also add a tty field to the boot_command struct so that the current console can be sent to the discover server during a manual boot command. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* discover/pxe-parser: Retrieve configs asynchronouslySamuel Mendoza-Jonas2016-06-284-2/+4
| | | | | | | | | | | | | | | | | | Depending on the configuration of the DHCP server and the network, tftp requests made by the pxe parser can timeout. The pxe parser makes these requests synchronously so several timeouts can block the server completely for several minutes, leaving the server unresponsive to UI requests. Rework the pxe parser such that it handles the result of each tftp request in a callback, which can complete after iterate_parsers() has returned. Each callback is allocated its own conf_context which takes a talloc reference on the discover_context so that each callback can commit new boot options after the initial iterate loop has completed. This also means talloc_unlink must be used instead by the original parent of the discover_context. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/pb-config: Properly initialise interface_configSamuel Mendoza-Jonas2016-06-271-1/+4
| | | | | | | | | | | The addition of the "url" field is not reflected in config_copy_interface() which leaves the pointer uninitialised, causing a potential segfault later on. Copy the field from the source config, and use talloc_zero() for the interface_config struct to prevent this more generally. Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
* lib/flash: fix resource leak in flash_setup_buffer() error pathsAndrew Donnellan2016-05-061-5/+8
| | | | | | | | | | | Some error paths in flash_setup_buffer() fail to free the flash_info struct or close the open ffs before they return. Change them to goto the cleanup code at the end. Separate the cleanup code into separate labels depending on whether we need to call ffs_close(), arch_flash_close() and talloc_free(). Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
OpenPOWER on IntegriCloud