Re: [Patch 0/2] Enable the HTTP switch

["Wu, Jiaxin" <jiaxin.wu@intel.com>]

Hi Laszlo and Mike,

Thanks for your comments, I agree to refine the PCD name and description, another patch will be set out later. 

Thanks,
Jiaxin

> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Friday, January 13, 2017 12:53 AM
> To: Kinney, Michael D <michael.d.kinney@intel.com>; Fu, Siyuan
> <siyuan.fu@intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; edk2-
> devel@ml01.01.org
> Cc: Ye, Ting <ting.ye@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Gary Ching-
> Pang Lin <glin@suse.com>
> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch
> 
> On 01/12/17 17:46, Kinney, Michael D wrote:
> > Maybe we should also consider a slight PCD name change so
> > this PCD is not confused with -D HTTP_BOOT_ENABLE.
> >
> >   PcdAllowHttpConnections
> 
> Good point!
> Laszlo
> 
> >
> > Mike
> >
> >> -----Original Message-----
> >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Laszlo
> >> Ersek
> >> Sent: Thursday, January 12, 2017 8:22 AM
> >> To: Fu, Siyuan <siyuan.fu@intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>;
> edk2-
> >> devel@ml01.01.org
> >> Cc: Ye, Ting <ting.ye@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Gary
> Ching-Pang
> >> Lin <glin@suse.com>
> >> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch
> >>
> >> On 01/12/17 12:45, Fu, Siyuan wrote:
> >>> Hi, Laszlo
> >>>
> >>
> >>> This PCD is introduced for security consideration, it's not to
> >>> include/exclude the whole HTTP boot feature, but to allow/deny
> >>> unsecured HTTP connection. So
> >>> 	If this PCD is true, both HTTP(http://...) and HTTPS(https://...) are
> >> allowed.
> >>> 	If this PCD is false, only HTTPS connection is allowed, HTTP is forbidden.
> >>> The default is false (HTTPS) only.
> >>>
> >>> For you question, if the new PCD is set to false, and OVFM is built
> >>> with -D HTTP_BOOT_ENABLE. All these drivers will still be included in
> >>> the FD image, but only HTTPS connection could be establishment. In
> >>> other words, attempt to boot from a URL like "http://server/boot.efi"
> >>> will be failed.
> >>
> >> Thank you, this makes perfect sense.
> >>
> >> But, in this case, I think the PCD description in the .DEC file is not clear
> >> enough:
> >>
> >> +  ## Indicates whether the HTTP is enabled or not.
> >> +  # TRUE  - HTTP is enabled. The "http://" scheme is acceptable.
> >> +  # FALSE - HTTP is disabled. The "http://" scheme will be denied.
> >> +  # @Prompt Indicates whether the HTTP is enabled or not.
> >> +
> gEfiNetworkPkgTokenSpaceGuid.PcdHttpEnable|FALSE|BOOLEAN|0x00000008
> >>
> >> I suggest the following wording instead:
> >>
> >>   ## Indicates whether HTTP (i.e., unsecured) connections are permitted or
> not.
> >>   #  HTTPS connections are always permitted.
> >>   #   TRUE -  Both the "https://" and "http://" URI schemes are permitted.
> >>   #   FALSE - Only the "https://" URI scheme is permitted.
> >>
> gEfiNetworkPkgTokenSpaceGuid.PcdHttpEnable|FALSE|BOOLEAN|0x00000008
> >>
> >> Can you please consider this? I think it's clearer.
> >>
> >> Thanks!
> >> Laszlo
> >>
> >>>
> >>> Siyuan
> >>>
> >>> -----Original Message-----
> >>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Laszlo
> >> Ersek
> >>> Sent: 2017年1月12日 18:23
> >>> To: Wu, Jiaxin <jiaxin.wu@intel.com>; edk2-devel@ml01.01.org
> >>> Cc: Ye, Ting <ting.ye@intel.com>; Ni, Ruiyu <ruiyu.ni@intel.com>; Fu,
> Siyuan
> >> <siyuan.fu@intel.com>; Gary Ching-Pang Lin <glin@suse.com>
> >>> Subject: Re: [edk2] [Patch 0/2] Enable the HTTP switch
> >>>
> >>> On 01/12/17 09:52, Jiaxin Wu wrote:
> >>>> If the value of PcdHttpEnable is TRUE, HTTP is enabled. Both the
> >>>> "http://" and "https://" schemes are acceptable. Otherwise, HTTP is
> >>>> disabled. The "http://" scheme will be denied.
> >>>>
> >>>> Cc: Ye Ting <ting.ye@intel.com>
> >>>> Cc: Fu Siyuan <siyuan.fu@intel.com>
> >>>> Cc: Ruiyu Ni <ruiyu.ni@intel.com>
> >>>> Contributed-under: TianoCore Contribution Agreement 1.0
> >>>> Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
> >>>>
> >>>> Jiaxin Wu (2):
> >>>>   NetworkPkg: Add PCD to enable the HTTP switch
> >>>>   Nt32Pkg.dsc: Add HTTP_ENABLE flag
> >>>>
> >>>>  NetworkPkg/HttpBootDxe/HttpBootClient.c  | 20 +++++++-
> >>>> NetworkPkg/HttpBootDxe/HttpBootConfig.c  | 81
> ++++++++++++++++++++------------
> >>>>  NetworkPkg/HttpBootDxe/HttpBootDxe.inf   |  5 +-
> >>>>  NetworkPkg/HttpBootDxe/HttpBootSupport.c | 53
> ++++++++++++++++++++-
> >>>> NetworkPkg/HttpBootDxe/HttpBootSupport.h | 17 ++++++-
> >>>>  NetworkPkg/HttpDxe/HttpDxe.inf           |  5 +-
> >>>>  NetworkPkg/HttpDxe/HttpImpl.c            | 12 ++++-
> >>>>  NetworkPkg/NetworkPkg.dec                |  8 +++-
> >>>>  Nt32Pkg/Nt32Pkg.dsc                      |  9 ++++
> >>>>  9 files changed, 173 insertions(+), 37 deletions(-)
> >>>>
> >>>
> >>> What is the reasoning behind this change? If a platform doesn't want to
> support
> >> HTTP booting, it can just exclude the drivers from the build.
> >>>
> >>> Put differently, what use do HttpBootDxe and HttpDxe have if the PCD is
> set to
> >> FALSE (which is the default)?
> >>>
> >>> I'm asking because OVMF already has a HTTP_BOOT_ENABLE build flag,
> and it
> >> controls the inclusion of all of:
> >>>
> >>>   NetworkPkg/DnsDxe/DnsDxe.inf
> >>>   NetworkPkg/HttpUtilitiesDxe/HttpUtilitiesDxe.inf
> >>>   NetworkPkg/HttpDxe/HttpDxe.inf
> >>>   NetworkPkg/HttpBootDxe/HttpBootDxe.inf
> >>>
> >>> So what will this NetworkPkg change mean for OVMF, if OVMF is built with
> -D
> >> HTTP_BOOT_ENABLE?
> >>>
> >>> Thanks
> >>> Laszlo
> >>> _______________________________________________
> >>> edk2-devel mailing list
> >>> edk2-devel@lists.01.org
> >>> https://lists.01.org/mailman/listinfo/edk2-devel
> >>>
> >>
> >> _______________________________________________
> >> edk2-devel mailing list
> >> edk2-devel@lists.01.org
> >> https://lists.01.org/mailman/listinfo/edk2-devel