setting the TLS cipher list for HTTPS booting

[Laszlo Ersek <lersek@redhat.com>]

Hello Jiaxin, Siyuan,

it seems that the "preferred set of ciphers" can be controlled at the
TLS session level.

With regard to HTTPS booting, "NetworkPkg/HttpDxe" makes several calls
to EFI_TLS_PROTOCOL.SetSessionData() -- in the file
"NetworkPkg/HttpDxe/HttpsSupport.c", -- but it never passes
"EfiTlsCipherList" as argument for the "DataType" parameter.

Is there a way for platform code to control the list of ciphers?

This is different from other "global" TLS aspects, such as
EFI_TLS_CONFIGURATION_PROTOCOL, because the latter is a singleton
"service" protocol, while EFI_TLS_PROTOCOL instances are created by
clients as-needed, via TLS service binding. So, I think if a platform
wanted to control this on the session level, then it would have to "ask"
HttpDxe somehow.

If you agree -- do you suggest a dynamic PCD, or an extension to the
UEFI spec (at the HTTP level)?

Thanks!
Laszlo