sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-01-22 03:32:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

[image] Add the "imgdecrypt" command

Browse Source 
Add the "imgdecrypt" command that can be used to decrypt a detached
encrypted data image using a cipher key obtained from a separate CMS
envelope image.  For example:

  # Create non-detached encrypted CMS messages
  #
  openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
              -in vmlinuz -outform DER -out vmlinuz.cms
  openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
              -in initrd.img -outform DER -out initrd.img.cms

  # Detach data from envelopes (using iPXE's contrib/crypto/cmsdetach)
  #
  cmsdetach vmlinuz.cms -d vmlinuz.dat -e vmlinuz.env
  cmsdetach initrd.img.cms -d initrd.img.dat -e initrd.img.env

and then within iPXE:

  #!ipxe
  imgfetch http://192.168.0.1/vmlinuz.dat
  imgfetch http://192.168.0.1/initrd.img.dat
  imgdecrypt vmlinuz.dat    http://192.168.0.1/vmlinuz.env
  imgdecrypt initrd.img.dat http://192.168.0.1/initrd.img.env
  boot vmlinuz

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2024-08-29 14:00:34 +01:00
parent 486b15b3c1
commit 72316b820d
5 changed files with 220 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/config/config.c
View File

@@ -299,6 +299,9 @@ REQUIRE_OBJECT ( image_mem_cmd );
#ifdef SHIM_CMD
REQUIRE_OBJECT ( shim_cmd );
#endif
#ifdef IMAGE_CRYPT_CMD
REQUIRE_OBJECT ( image_crypt_cmd );
#endif
/*
* Drag in miscellaneous objects

1
src/config/general.h
View File

@@ -158,6 +158,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
//#define REBOOT_CMD /* Reboot command */
//#define POWEROFF_CMD /* Power off command */
//#define IMAGE_TRUST_CMD /* Image trust management commands */
//#define IMAGE_CRYPT_CMD /* Image encryption management commands */
//#define PCI_CMD /* PCI commands */
//#define PARAM_CMD /* Request parameter commands */
//#define NEIGHBOUR_CMD /* Neighbour management commands */