Re: [Patch 0/2] Enable the HTTP switch

[Laszlo Ersek <lersek@redhat.com>]

On 01/12/17 17:46, Kinney, Michael D wrote:
> Maybe we should also consider a slight PCD name change so
> this PCD is not confused with -D HTTP_BOOT_ENABLE.
> 
>   PcdAllowHttpConnections

Good point!
Laszlo

> 
> Mike
> 
>> -----Original Message-----
>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Laszlo
>> Ersek
>> Sent: Thursday, January 12, 2017 8:22 AM
>> To: Fu, Siyuan <siyuan.fu@intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; edk2-
>> devel@ml01.01.org
>> Cc: Ye, Ting <ting.ye@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Gary Ching-Pang
>> Lin <glin@suse.com>
>> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch
>>
>> On 01/12/17 12:45, Fu, Siyuan wrote:
>>> Hi, Laszlo
>>>
>>
>>> This PCD is introduced for security consideration, it's not to
>>> include/exclude the whole HTTP boot feature, but to allow/deny
>>> unsecured HTTP connection. So
>>> 	If this PCD is true, both HTTP(http://...) and HTTPS(https://...) are
>> allowed.
>>> 	If this PCD is false, only HTTPS connection is allowed, HTTP is forbidden.
>>> The default is false (HTTPS) only.
>>>
>>> For you question, if the new PCD is set to false, and OVFM is built
>>> with -D HTTP_BOOT_ENABLE. All these drivers will still be included in
>>> the FD image, but only HTTPS connection could be establishment. In
>>> other words, attempt to boot from a URL like "http://server/boot.efi"
>>> will be failed.
>>
>> Thank you, this makes perfect sense.
>>
>> But, in this case, I think the PCD description in the .DEC file is not clear
>> enough:
>>
>> +  ## Indicates whether the HTTP is enabled or not.
>> +  # TRUE  - HTTP is enabled. The "http://" scheme is acceptable.
>> +  # FALSE - HTTP is disabled. The "http://" scheme will be denied.
>> +  # @Prompt Indicates whether the HTTP is enabled or not.
>> +  gEfiNetworkPkgTokenSpaceGuid.PcdHttpEnable|FALSE|BOOLEAN|0x00000008
>>
>> I suggest the following wording instead:
>>
>>   ## Indicates whether HTTP (i.e., unsecured) connections are permitted or not.
>>   #  HTTPS connections are always permitted.
>>   #   TRUE -  Both the "https://" and "http://" URI schemes are permitted.
>>   #   FALSE - Only the "https://" URI scheme is permitted.
>>   gEfiNetworkPkgTokenSpaceGuid.PcdHttpEnable|FALSE|BOOLEAN|0x00000008
>>
>> Can you please consider this? I think it's clearer.
>>
>> Thanks!
>> Laszlo
>>
>>>
>>> Siyuan
>>>
>>> -----Original Message-----
>>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Laszlo
>> Ersek
>>> Sent: 2017年1月12日 18:23
>>> To: Wu, Jiaxin <jiaxin.wu@intel.com>; edk2-devel@ml01.01.org
>>> Cc: Ye, Ting <ting.ye@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Fu, Siyuan
>> <siyuan.fu@intel.com>; Gary Ching-Pang Lin <glin@suse.com>
>>> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch
>>>
>>> On 01/12/17 09:52, Jiaxin Wu wrote:
>>>> If the value of PcdHttpEnable is TRUE, HTTP is enabled. Both the
>>>> "http://" and "https://" schemes are acceptable. Otherwise, HTTP is
>>>> disabled. The "http://" scheme will be denied.
>>>>
>>>> Cc: Ye Ting <ting.ye@intel.com>
>>>> Cc: Fu Siyuan <siyuan.fu@intel.com>
>>>> Cc: Ruiyu Ni <ruiyu.ni@intel.com>
>>>> Contributed-under: TianoCore Contribution Agreement 1.0
>>>> Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
>>>>
>>>> Jiaxin Wu (2):
>>>>   NetworkPkg: Add PCD to enable the HTTP switch
>>>>   Nt32Pkg.dsc: Add HTTP_ENABLE flag
>>>>
>>>>  NetworkPkg/HttpBootDxe/HttpBootClient.c  | 20 +++++++-
>>>> NetworkPkg/HttpBootDxe/HttpBootConfig.c  | 81 ++++++++++++++++++++------------
>>>>  NetworkPkg/HttpBootDxe/HttpBootDxe.inf   |  5 +-
>>>>  NetworkPkg/HttpBootDxe/HttpBootSupport.c | 53 ++++++++++++++++++++-
>>>> NetworkPkg/HttpBootDxe/HttpBootSupport.h | 17 ++++++-
>>>>  NetworkPkg/HttpDxe/HttpDxe.inf           |  5 +-
>>>>  NetworkPkg/HttpDxe/HttpImpl.c            | 12 ++++-
>>>>  NetworkPkg/NetworkPkg.dec                |  8 +++-
>>>>  Nt32Pkg/Nt32Pkg.dsc                      |  9 ++++
>>>>  9 files changed, 173 insertions(+), 37 deletions(-)
>>>>
>>>
>>> What is the reasoning behind this change? If a platform doesn't want to support
>> HTTP booting, it can just exclude the drivers from the build.
>>>
>>> Put differently, what use do HttpBootDxe and HttpDxe have if the PCD is set to
>> FALSE (which is the default)?
>>>
>>> I'm asking because OVMF already has a HTTP_BOOT_ENABLE build flag, and it
>> controls the inclusion of all of:
>>>
>>>   NetworkPkg/DnsDxe/DnsDxe.inf
>>>   NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesDxe.inf
>>>   NetworkPkg/HttpDxe/HttpDxe.inf
>>>   NetworkPkg/HttpBootDxe/HttpBootDxe.inf
>>>
>>> So what will this NetworkPkg change mean for OVMF, if OVMF is built with -D
>> HTTP_BOOT_ENABLE?
>>>
>>> Thanks
>>> Laszlo
>>> _______________________________________________
>>> edk2-devel mailing list
>>> edk2-devel@lists.01.org
>>> https://lists.01.org/mailman/listinfo/edk2-devel
>>>
>>
>> _______________________________________________
>> edk2-devel mailing list
>> edk2-devel@lists.01.org
>> https://lists.01.org/mailman/listinfo/edk2-devel