From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 0B6BB81C1C for ; Thu, 12 Jan 2017 08:52:45 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx16.intmail.prod.int.phx2.redhat.com [10.5.11.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D62243B716; Thu, 12 Jan 2017 16:52:45 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-116-42.phx2.redhat.com [10.3.116.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id EA6C5685C1; Thu, 12 Jan 2017 16:52:43 +0000 (UTC) To: "Kinney, Michael D" , "Fu, Siyuan" , "Wu, Jiaxin" , "edk2-devel@ml01.01.org" References: <1484211156-94292-1-git-send-email-jiaxin.wu@intel.com> <1a233b47-2901-ac44-5898-8bea1b43a904@redhat.com> Cc: "Ye, Ting" , "Ni, Ruiyu" , Gary Ching-Pang Lin From: Laszlo Ersek Message-ID: <3b06dcf4-b377-7350-abf7-bbcecbe4a0c0@redhat.com> Date: Thu, 12 Jan 2017 17:52:41 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.74 on 10.5.11.28 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 12 Jan 2017 16:52:45 +0000 (UTC) Subject: Re: [Patch 0/2] Enable the HTTP switch X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Jan 2017 16:52:45 -0000 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit On 01/12/17 17:46, Kinney, Michael D wrote: > Maybe we should also consider a slight PCD name change so > this PCD is not confused with -D HTTP_BOOT_ENABLE. > > PcdAllowHttpConnections Good point! Laszlo > > Mike > >> -----Original Message----- >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Laszlo >> Ersek >> Sent: Thursday, January 12, 2017 8:22 AM >> To: Fu, Siyuan ; Wu, Jiaxin ; edk2- >> devel@ml01.01.org >> Cc: Ye, Ting ; Ni, Ruiyu ; Gary Ching-Pang >> Lin >> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch >> >> On 01/12/17 12:45, Fu, Siyuan wrote: >>> Hi, Laszlo >>> >> >>> This PCD is introduced for security consideration, it's not to >>> include/exclude the whole HTTP boot feature, but to allow/deny >>> unsecured HTTP connection. So >>> If this PCD is true, both HTTP(http://...) and HTTPS(https://...) are >> allowed. >>> If this PCD is false, only HTTPS connection is allowed, HTTP is forbidden. >>> The default is false (HTTPS) only. >>> >>> For you question, if the new PCD is set to false, and OVFM is built >>> with -D HTTP_BOOT_ENABLE. All these drivers will still be included in >>> the FD image, but only HTTPS connection could be establishment. In >>> other words, attempt to boot from a URL like "http://server/boot.efi" >>> will be failed. >> >> Thank you, this makes perfect sense. >> >> But, in this case, I think the PCD description in the .DEC file is not clear >> enough: >> >> + ## Indicates whether the HTTP is enabled or not. >> + # TRUE - HTTP is enabled. The "http://" scheme is acceptable. >> + # FALSE - HTTP is disabled. The "http://" scheme will be denied. >> + # @Prompt Indicates whether the HTTP is enabled or not. >> + gEfiNetworkPkgTokenSpaceGuid.PcdHttpEnable|FALSE|BOOLEAN|0x00000008 >> >> I suggest the following wording instead: >> >> ## Indicates whether HTTP (i.e., unsecured) connections are permitted or not. >> # HTTPS connections are always permitted. >> # TRUE - Both the "https://" and "http://" URI schemes are permitted. >> # FALSE - Only the "https://" URI scheme is permitted. >> gEfiNetworkPkgTokenSpaceGuid.PcdHttpEnable|FALSE|BOOLEAN|0x00000008 >> >> Can you please consider this? I think it's clearer. >> >> Thanks! >> Laszlo >> >>> >>> Siyuan >>> >>> -----Original Message----- >>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Laszlo >> Ersek >>> Sent: 2017年1月12日 18:23 >>> To: Wu, Jiaxin ; edk2-devel@ml01.01.org >>> Cc: Ye, Ting ; Ni, Ruiyu ; Fu, Siyuan >> ; Gary Ching-Pang Lin >>> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch >>> >>> On 01/12/17 09:52, Jiaxin Wu wrote: >>>> If the value of PcdHttpEnable is TRUE, HTTP is enabled. Both the >>>> "http://" and "https://" schemes are acceptable. Otherwise, HTTP is >>>> disabled. The "http://" scheme will be denied. >>>> >>>> Cc: Ye Ting >>>> Cc: Fu Siyuan >>>> Cc: Ruiyu Ni >>>> Contributed-under: TianoCore Contribution Agreement 1.0 >>>> Signed-off-by: Wu Jiaxin >>>> >>>> Jiaxin Wu (2): >>>> NetworkPkg: Add PCD to enable the HTTP switch >>>> Nt32Pkg.dsc: Add HTTP_ENABLE flag >>>> >>>> NetworkPkg/HttpBootDxe/HttpBootClient.c | 20 +++++++- >>>> NetworkPkg/HttpBootDxe/HttpBootConfig.c | 81 ++++++++++++++++++++------------ >>>> NetworkPkg/HttpBootDxe/HttpBootDxe.inf | 5 +- >>>> NetworkPkg/HttpBootDxe/HttpBootSupport.c | 53 ++++++++++++++++++++- >>>> NetworkPkg/HttpBootDxe/HttpBootSupport.h | 17 ++++++- >>>> NetworkPkg/HttpDxe/HttpDxe.inf | 5 +- >>>> NetworkPkg/HttpDxe/HttpImpl.c | 12 ++++- >>>> NetworkPkg/NetworkPkg.dec | 8 +++- >>>> Nt32Pkg/Nt32Pkg.dsc | 9 ++++ >>>> 9 files changed, 173 insertions(+), 37 deletions(-) >>>> >>> >>> What is the reasoning behind this change? If a platform doesn't want to support >> HTTP booting, it can just exclude the drivers from the build. >>> >>> Put differently, what use do HttpBootDxe and HttpDxe have if the PCD is set to >> FALSE (which is the default)? >>> >>> I'm asking because OVMF already has a HTTP_BOOT_ENABLE build flag, and it >> controls the inclusion of all of: >>> >>> NetworkPkg/DnsDxe/DnsDxe.inf >>> NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesDxe.inf >>> NetworkPkg/HttpDxe/HttpDxe.inf >>> NetworkPkg/HttpBootDxe/HttpBootDxe.inf >>> >>> So what will this NetworkPkg change mean for OVMF, if OVMF is built with -D >> HTTP_BOOT_ENABLE? >>> >>> Thanks >>> Laszlo >>> _______________________________________________ >>> edk2-devel mailing list >>> edk2-devel@lists.01.org >>> https://lists.01.org/mailman/listinfo/edk2-devel >>> >> >> _______________________________________________ >> edk2-devel mailing list >> edk2-devel@lists.01.org >> https://lists.01.org/mailman/listinfo/edk2-devel