[staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

[staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

[Jiaxin Wu]

Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Long Qin <qin.long@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>

Jiaxin Wu (2):
  Readme.MD: Clarify the feature support scope
  NetworkPkg/TlsAuthConfigDxe: TlsCaCertificate variable attribute update

 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c | 2 +-
 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h | 2 ++
 Readme.MD                                       | 8 +++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

-- 
1.9.5.msysgit.1

[staging/HTTPS-TLS][PATCH 1/2] Readme.MD: Clarify the feature support scope

[Jiaxin Wu]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 2040 bytes --]

Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Long Qin <qin.long@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
---
 Readme.MD | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Readme.MD b/Readme.MD
index 2411042..389935e 100644
--- a/Readme.MD
+++ b/Readme.MD
@@ -31,11 +31,17 @@ CryptoPkg/Library/TlsLib/TlsLib.inf
 NetworkPkg/TlsDxe/TlsDxe.inf
 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigDxe.inf
 ```
 
 #### HTTPS Authentication
-Currently, HTTPS boot feature only support server authentication with an unauthenticated client mode [RFC5246](https://tools.ietf.org/html/rfc5246). To support this mode, server CA certificate is required by Client. Private variable is used to configure this CA certificate. **EFI_SIGNATURE_LIST** format is used for this variable. In sum, the Server CA certificate must be configured first to enable HTTPS boot feature. The variable name and GUID are defined as below.
+TLS supports three authentication modes ([RFC5246](https://tools.ietf.org/html/rfc5246)):
+```
+1. Total anonymity: the server and client won’t authenticate each other.
+2. One-way authentication: server authentication with an unauthenticated client.
+3. Two-way authentication: authentication of both parties.
+```
+Currently, HTTPS boot feature only support server authentication with an unauthenticated client mode. Others are not in our current feature support scope. To support one-way authentication mode, server CA certificate is required by Client. Private variable is used to configure this CA certificate. **EFI_SIGNATURE_LIST** format is used for this variable. In sum, the Server CA certificate must be configured first to enable HTTPS boot feature. The variable name and GUID are defined as below.
 ```
 #define EFI_TLS_CA_CERTIFICATE_GUID \
   { \
     0xfd2340D0, 0x3dab, 0x4349, { 0xa6, 0xc7, 0x3b, 0x4f, 0x12, 0xb4, 0x8e, 0xae } \
   }
-- 
1.9.5.msysgit.1

[staging/HTTPS-TLS][PATCH 2/2] NetworkPkg/TlsAuthConfigDxe: TlsCaCertificate variable attribute update

[Jiaxin Wu]

Remove the RT attribute for TlsCaCertificate variable protecting. If so,
we can treat this variable as security in certain case.

Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Long Qin <qin.long@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
---
 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c | 2 +-
 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c b/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c
index f265b42..1132cac 100644
--- a/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c
+++ b/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c
@@ -999,11 +999,11 @@ EnrollX509toVariable (
   //
   // Check if signature database entry has been already existed.
   // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
   // new signature data to original variable
   //
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS;
+  Attr = TLS_AUTH_CONFIG_VAR_BASE_ATTR;
 
   Status = gRT->GetVariable(
                   VariableName,
                   &gEfiTlsCaCertificateGuid,
                   NULL,
diff --git a/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h b/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h
index dea3cda..398f7b6 100644
--- a/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h
+++ b/NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h
@@ -51,10 +51,12 @@ extern   UINT8       TlsAuthConfigDxeStrings[];
 extern   UINT8       TlsAuthConfigVfrBin[];
 
 #define TLS_AUTH_CONFIG_PRIVATE_DATA_SIGNATURE    SIGNATURE_32 ('T', 'A', 'C', 'D')
 #define TLS_AUTH_CONFIG_PRIVATE_FROM_THIS(a)      CR (a, TLS_AUTH_CONFIG_PRIVATE_DATA, ConfigAccess, TLS_AUTH_CONFIG_PRIVATE_DATA_SIGNATURE)
 
+#define TLS_AUTH_CONFIG_VAR_BASE_ATTR  (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS)
+
 typedef struct _TLS_AUTH_CONFIG_PRIVATE_DATA      TLS_AUTH_CONFIG_PRIVATE_DATA;
 typedef struct _TLS_AUTH_CONFIG_FILE_CONTEXT      TLS_AUTH_CONFIG_FILE_CONTEXT;
 
 ///
 /// HII specific Vendor Device Path definition.
-- 
1.9.5.msysgit.1

Re: [staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

[Ye, Ting]

Series reviewed by: Ye Ting <ting.ye@intel.com> 

-----Original Message-----
From: Wu, Jiaxin 
Sent: Tuesday, August 16, 2016 3:20 PM
To: edk2-devel@lists.01.org
Cc: Palmer Thomas <thomas.palmer@hpe.com>; Long, Qin <qin.long@intel.com>; Ye, Ting <ting.ye@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>
Subject: [staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Long Qin <qin.long@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>

Jiaxin Wu (2):
  Readme.MD: Clarify the feature support scope
  NetworkPkg/TlsAuthConfigDxe: TlsCaCertificate variable attribute update

 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c | 2 +-  NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h | 2 ++
 Readme.MD                                       | 8 +++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

--
1.9.5.msysgit.1

Re: [staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

[Palmer, Thomas]

Reviewed by Thomas Palmer <thomas.palmer@hpe.com>

-----Original Message-----
From: Jiaxin Wu [mailto:jiaxin.wu@intel.com] 
Sent: Tuesday, August 16, 2016 2:20 AM
To: edk2-devel@lists.01.org
Cc: Palmer, Thomas <thomas.palmer@hpe.com>; Long Qin <qin.long@intel.com>; Ye Ting <ting.ye@intel.com>; Fu Siyuan <siyuan.fu@intel.com>
Subject: [staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Long Qin <qin.long@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>

Jiaxin Wu (2):
  Readme.MD: Clarify the feature support scope
  NetworkPkg/TlsAuthConfigDxe: TlsCaCertificate variable attribute update

 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c | 2 +-  NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h | 2 ++
 Readme.MD                                       | 8 +++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

--
1.9.5.msysgit.1

Re: [staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

[Samer El Haj Mahmoud]

Series reviewed-by: Samer El-Haj-Mahmoud <smahmoud@lenovo.com>




Samer El-Haj-Mahmoud
SESM - OS / SW Architect
Systems Management Development, Data Center Group
Lenovo United States
+1.919.908.5833
+1.512.659.1523
smahmoud@lenovo.com
 

Lenovo.com /us 
Twitter | Facebook | Instagram | Blogs | Forums






-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Jiaxin Wu
Sent: Tuesday, August 16, 2016 3:20 AM
To: edk2-devel@lists.01.org
Cc: Ye Ting <ting.ye@intel.com>; Fu Siyuan <siyuan.fu@intel.com>; Long Qin <qin.long@intel.com>
Subject: [edk2] [staging/HTTPS-TLS][PATCH 0/2] Readme.MD and TlsAuthConfigDxe update

Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Long Qin <qin.long@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>

Jiaxin Wu (2):
  Readme.MD: Clarify the feature support scope
  NetworkPkg/TlsAuthConfigDxe: TlsCaCertificate variable attribute update

 NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.c | 2 +-  NetworkPkg/TlsAuthConfigDxe/TlsAuthConfigImpl.h | 2 ++
 Readme.MD                                       | 8 +++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

--
1.9.5.msysgit.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel