[crypto] Parse X.509 raw public key bit string

OCSP requires direct access to the bit string portion of the subject
public key information.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Generalise x509_parse_time() to asn1_generalized_time()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Generalise asn1_{digest,pubkey,signature}_algorithm()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Generalise x509_parse_bit_string() to asn1_bit_string()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Parse OCSPSigning key purpose, if present

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add functions for constructing ASN.1 objects

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add framework for OCSP

Add support for constructing OCSP queries and parsing OCSP responses.
(There is no support yet for actually issuing an OCSP query via an
HTTP POST.)

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Add self-tests for OCSP

Add self-tests for OCSP using test vectors generated with the openssl
tools.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[iscsi] Report SCSI response only when applicable

iSCSI generally includes a full SCSI response only when an error
occurs.  iscsi_scsi_done() currently passes the NULL response through
to scsi_response(), which ends up causing scsicmd_response() to
dereference a NULL pointer.

Fix by calling scsi_response() only if we have a non-NULL response.

Reported-by: Brendon Walsh <brendonwalsh@niamu.com>
Tested-by: Brendon Walsh <brendonwalsh@niamu.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[efi] Work around platforms which choke on EFI_PCI_DEVICE_ENABLE

EFI_PCI_DEVICE_ENABLE is a list of the standard attributes that must
be enabled for a PCI device to function: I/O cycles, memory cycles,
and bus-mastering.  We currently call EFI_PCI_IO_PROTOCOL::Attribute()
with the parameter EFI_PCI_DEVICE_ENABLE to enable a PCI device.  This
should translate to a single write to PCI configuration space.

Simplicity is not a virtue within the UEFI world.  Some platforms will
'helpfully' report an error if EFI_PCI_DEVICE_ENABLE is used on a
device that doesn't actually support all three of the relevant
attributes.  For example, if a PCI device provides only memory-mapped
accesses (and so hardwires the I/O enable bit to zero), then using
EFI_PCI_DEVICE_ENABLE on such a platform will result in an
EFI_UNSUPPORTED error.

There is no plausible use case in which it is useful for the platform
to return an error in this way, and doing so makes it impossible to
distinguish genuine errors from noise.

Work around this broken behaviour by attempting to enable the three
attributes individually, and ignoring any errors.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[base64] Avoid overrunning input data buffer

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Add self-tests for base64

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Accept UTCTime/GeneralizedTime with no "seconds" field

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Return a NULL X.509 certificate if construction fails

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Return a NULL OCSP check if construction fails

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Fix margin of error for OCSP checks

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Construct OCSP check URI

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[monojob] Allow monojob to be completely silent

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[image] Allow "imgtrust" to automatically download cross-signed certificates

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Automatically perform OCSP checks when applicable

Signed-off-by: Michael Brown <mcb30@ipxe.org>