[malloc] Discard all cached data on shutdown

Allow detection of genuine memory leaks by ensuring that all cached
data is freed on shutdown.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Fix memory leak in settings self-tests

Detected using Valgrind.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[list] Add list_for_each_entry_continue() and _continue_reverse()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Parse OCSP responder URI from X.509 certificate

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Fix memory leak in cms_verify_digest()

Detected using Valgrind.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[malloc] Allow Valgrind to be used when all assertions are enabled

The free-memory-block traversal code triggers multiple warnings from
Valgrind when assertions are enabled, since the list consistency
checks performed by list_check() end up accessing areas that have been
marked as inaccessible.

Fix by ensuring that any memory areas that will be accessed by
list_check() are marked as defined when necessary.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[time] Add Linux time source using gettimeofday()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Allow certificate chains to be long-lived data structures

At present, certificate chain validation is treated as an
instantaneous process that can be carried out using only data that is
already in memory.  This model does not allow for validation to
include non-instantaneous steps, such as downloading a cross-signing
certificate, or determining certificate revocation status via OCSP.

Redesign the internal representation of certificate chains to allow
chains to outlive the scope of the original source of certificates
(such as a TLS Certificate record).

Allow for certificates to be cached, so that each certificate needs to
be validated only once.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Fix compiler warning on older gcc versions

Reported-by: Alex Davies <alex@davz.net>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Add self-tests for crc32_le()

Add self-tests for crc32_le() using test vectors generated with Perl's
Digest::CRC.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[tcp] Fix potential NULL pointer dereference

Detected using Valgrind.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[tcp] Discard all TCP connections on shutdown

Allow detection of genuine memory leaks by ensuring that all TCP
connections are freed on shutdown.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[list] Add list_last_entry()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Allow for X.509 certificates with no common name

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Check that common name contains no NUL characters

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add x509_append_raw()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add x509_auto_append()

CMS includes an unordered certificate set, from which certificates
must be extracted in order by matching up issuers with subjects.  We
will use the same functionality as part of the automatic download of
cross-signing certificates.  Generalise cms_find_subject() to
x509_find_subject(), and create x509_auto_append().

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add asynchronous certificate validator

To allow for automatic download of cross-signing certificates and for
OCSP, the validation of certificates must be an asynchronous process.
Create a stub validator which uses a job-control interface to report
the result of certificate validation.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[tls] Use asynchronous certificate validator

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[xferbuf] Add generic data-transfer buffer

Signed-off-by: Michael Brown <mcb30@ipxe.org>