From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.43, mailfrom: jiaxin.wu@intel.com) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by groups.io with SMTP; Thu, 26 Sep 2019 20:44:47 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2019 20:44:47 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,553,1559545200"; d="scan'208";a="204074796" Received: from jiaxinwu-mobl.ccr.corp.intel.com ([10.239.192.205]) by fmsmga001.fm.intel.com with ESMTP; 26 Sep 2019 20:44:46 -0700 From: "Wu, Jiaxin" To: devel@edk2.groups.io Cc: Wu Jiaxin Subject: [PATCH v1 0/4] Support HTTPS HostName validation feature(CVE-2019-14553) Date: Fri, 27 Sep 2019 11:44:37 +0800 Message-Id: <20190927034441.3096-1-Jiaxin.wu@intel.com> X-Mailer: git-send-email 2.17.1.windows.2 REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960 CVE: CVE-2019-14553 The series patches are to support HTTPS hostname validation feature. It fixes the issue exposed @ https://bugzilla.tianocore.org/show_bug.cgi?id=960. In the patches, we add the new data type named "EfiTlsVerifyHost" and the EFI_TLS_VERIFY_HOST_FLAG for the TLS protocol consumer (HTTP) to enable the host name check so as to avoid the potential Man-In-The-Middle attack. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Wu Jiaxin Reviewed-by: Ye Ting Reviewed-by: Long Qin Reviewed-by: Fu Siyuan Acked-by: Laszlo Ersek Jiaxin Wu (4): MdePkg/Include/Protocol/Tls.h: Add the data type of EfiTlsVerifyHost(CVE-2019-14553) CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost"(CVE-2019-14553) NetworkPkg/TlsDxe: Add the support of host validation to TlsDxe driver(CVE-2019-14553) NetworkPkg/HttpDxe: Set the HostName for the verification(CVE-2019-14553) CryptoPkg/Include/Library/TlsLib.h | 20 ++++++++ CryptoPkg/Library/TlsLib/TlsConfig.c | 38 +++++++++++++++- MdePkg/Include/Protocol/Tls.h | 68 +++++++++++++++++++++++----- NetworkPkg/HttpDxe/HttpProto.h | 1 + NetworkPkg/HttpDxe/HttpsSupport.c | 21 +++++++-- NetworkPkg/TlsDxe/TlsProtocol.c | 44 ++++++++++++++++-- 6 files changed, 173 insertions(+), 19 deletions(-) -- 2.17.1.windows.2