From: Thomas Palmer <thomas.palmer@hpe.com>
To: edk2-devel@lists.01.org
Cc: joseph.shifflett@hpe.com, jiaxin.wu@intel.com
Subject: [edk2-staging/HTTPS-TLS][PATCH]: CryptoPkg/TlsLib: Version renegotiate
Date: Fri, 26 Aug 2016 14:08:43 -0500 [thread overview]
Message-ID: <1472238525-40024-1-git-send-email-thomas.palmer@hpe.com> (raw)
The TLS protocol allows for clients and servers to negotiate which
version of TLS to use. Newer versions are deemed safer, so when
they are available the client and server should opt to use them.
The EDK2 TLS code today only allows TLSv1.0 for TLS communication,
regardless of the target server's capabilities. In order to use the
newer protocols, we'll update the EDK2 TlsLib.c code to allow for
TLS version negotiation when a new TLS object is created. The TLS
version specified in TlsCtxNew will be the minimum version accepted.
Because EDK2 is not yet using OpenSSL 1.1, we use SSL_set_options to
simulate SSL_CTX_set_min_proto_version.
We'll leave the current "EfiTlsVersion" functionality intact, which
will restrict which version of TLS to use and prevent negotiation.
However, to demonstrate the TLS regotiation in this feature branch,
we'll remove the code that calls EfiTlsVersion in the HttpDxe
module.
[PATCH 1/2] [edk2-staging/HTTPS-TLS][PATCH]: CryptoPkg/TlsLib: TLS
[PATCH 2/2] [edk2-staging/HTTPS-TLS][PATCH]: NetworkPkg/HttpDxe:
next reply other threads:[~2016-08-26 19:08 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-26 19:08 Thomas Palmer [this message]
2016-08-26 19:08 ` [PATCH 1/2] [edk2-staging/HTTPS-TLS][PATCH]: CryptoPkg/TlsLib: TLS Ver negotiate Thomas Palmer
2016-09-07 8:21 ` Wu, Jiaxin
2016-08-26 19:08 ` [PATCH 2/2] [edk2-staging/HTTPS-TLS][PATCH]: NetworkPkg/HttpDxe: Unrestrict TLSv Thomas Palmer
2016-09-07 8:23 ` Wu, Jiaxin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1472238525-40024-1-git-send-email-thomas.palmer@hpe.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox