diff options
| author | Michael Brown <mcb30@ipxe.org> | 2024-08-29 14:00:34 +0100 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2024-08-29 15:11:30 +0100 |
| commit | 72316b820d4bdbf3d75a0ae7e13f1c3bc8e6ac29 (patch) | |
| tree | 111872793eecfcd754e93491c8d352bfb4e0e627 /src/config/config.c | |
| parent | 486b15b3c11692af4325cd7d0220cdb72ec27586 (diff) | |
| download | ipxe-72316b820d4bdbf3d75a0ae7e13f1c3bc8e6ac29.tar.gz | |
[image] Add the "imgdecrypt" command
Add the "imgdecrypt" command that can be used to decrypt a detached
encrypted data image using a cipher key obtained from a separate CMS
envelope image. For example:
# Create non-detached encrypted CMS messages
#
openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
-in vmlinuz -outform DER -out vmlinuz.cms
openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
-in initrd.img -outform DER -out initrd.img.cms
# Detach data from envelopes (using iPXE's contrib/crypto/cmsdetach)
#
cmsdetach vmlinuz.cms -d vmlinuz.dat -e vmlinuz.env
cmsdetach initrd.img.cms -d initrd.img.dat -e initrd.img.env
and then within iPXE:
#!ipxe
imgfetch http://192.168.0.1/vmlinuz.dat
imgfetch http://192.168.0.1/initrd.img.dat
imgdecrypt vmlinuz.dat http://192.168.0.1/vmlinuz.env
imgdecrypt initrd.img.dat http://192.168.0.1/initrd.img.env
boot vmlinuz
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/config/config.c')
| -rw-r--r-- | src/config/config.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/config/config.c b/src/config/config.c index 6bcd3c1ca..f532c1d2d 100644 --- a/src/config/config.c +++ b/src/config/config.c @@ -299,6 +299,9 @@ REQUIRE_OBJECT ( image_mem_cmd ); #ifdef SHIM_CMD REQUIRE_OBJECT ( shim_cmd ); #endif +#ifdef IMAGE_CRYPT_CMD +REQUIRE_OBJECT ( image_crypt_cmd ); +#endif /* * Drag in miscellaneous objects |