From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from g2t2354.austin.hpe.com (g2t2354.austin.hpe.com [15.233.44.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id EB5021A1E5B for ; Fri, 26 Aug 2016 12:09:03 -0700 (PDT) Received: from arm-build-server.us.rdlabs.hpecorp.net (arm-build-server.us.rdlabs.hpecorp.net [16.84.24.54]) by g2t2354.austin.hpe.com (Postfix) with ESMTP id 4917651; Fri, 26 Aug 2016 19:09:03 +0000 (UTC) From: Thomas Palmer To: edk2-devel@lists.01.org Cc: joseph.shifflett@hpe.com, jiaxin.wu@intel.com, Thomas Palmer Date: Fri, 26 Aug 2016 14:08:44 -0500 Message-Id: <1472238525-40024-2-git-send-email-thomas.palmer@hpe.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1472238525-40024-1-git-send-email-thomas.palmer@hpe.com> References: <1472238525-40024-1-git-send-email-thomas.palmer@hpe.com> Subject: [PATCH 1/2] [edk2-staging/HTTPS-TLS][PATCH]: CryptoPkg/TlsLib: TLS Ver negotiate X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 19:09:04 -0000 The TLS protocol allows for clients and servers to negotiate which version of TLS to use. Newer versions are deemed safer, so when they are available the client and server should opt to use them. The EDK2 TLS code today only allows TLSv1.0 for TLS communication, regardless of the target server's capabilities. In order to use the newer protocols, we'll update the EDK2 TlsLib.c code to allow for TLS version negotiation when a new TLS object is created. The TLS version specified in TlsCtxNew will be the minimum version accepted. Because EDK2 is not yet using OpenSSL 1.1, we use SSL_set_options to simulate SSL_CTX_set_min_proto_version. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Thomas Palmer --- CryptoPkg/Library/TlsLib/TlsLib.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/CryptoPkg/Library/TlsLib/TlsLib.c b/CryptoPkg/Library/TlsLib/TlsLib.c index aa08595..0ff699b 100644 --- a/CryptoPkg/Library/TlsLib/TlsLib.c +++ b/CryptoPkg/Library/TlsLib/TlsLib.c @@ -195,26 +195,39 @@ TlsCtxNew ( ProtoVersion = (MajorVer << 8) | MinorVer; - TlsCtx = NULL; + TlsCtx = SSL_CTX_new (SSLv23_client_method ()); + if (TlsCtx == NULL) { + ASSERT (TlsCtx != NULL); + return NULL; + } + + // + // Ensure SSLv3 is disabled + // + SSL_CTX_set_options (TlsCtx, SSL_OP_NO_SSLv3); + // + // Treat as minimum accepted versions. Client can use higher + // TLS version if server supports it + // switch (ProtoVersion) { case TLS1_VERSION: // // TLS 1.0 // - TlsCtx = SSL_CTX_new (TLSv1_method ()); break; case TLS1_1_VERSION: // // TLS 1.1 // - TlsCtx = SSL_CTX_new (TLSv1_1_method ()); + SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1); break; case TLS1_2_VERSION: // // TLS 1.2 // - TlsCtx = SSL_CTX_new (TLSv1_2_method ()); + SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1); + SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1_1); break; default: // -- 2.7.4