reg: EDK2 - HTTP Boot Image Validation

reg: EDK2 - HTTP Boot Image Validation

[Sivaraman Nainar]

Hello all,
When HTTP Boot performed the code checking if the Image type as EFI ISO and IMG. If not the boot not proceeding when the content type is as "Content-type: text/plain".
https://github.com/tianocore/edk2/blob/master/NetworkPkg/HttpBootDxe/HttpBootSupport.c (HttpBootCheckImageType())

But as per RFC it described below. https://tools.ietf.org/html/rfc2616#section-7.2.1:
"If and only if the media type is not given by a Content-Type field, the
recipient MAY attempt to guess the media type via inspection of its
content and/or the name extension(s) of the URI used to identify the
resource."
Can you please comment if this need to be addressed such a way we can skip the validation of image types.
-Siva

Re: reg: EDK2 - HTTP Boot Image Validation

[Fu, Siyuan]

Hi, Siva

What do you mean by "skip the validation of image types"? Do you want to skip the "Content-type" HTTP header check, or name extension check, or both of them?


BestRegards
Fu Siyuan

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Sivaraman Nainar
> Sent: Friday, May 18, 2018 5:17 PM
> To: edk2-devel@lists.01.org
> Subject: [edk2] reg: EDK2 - HTTP Boot Image Validation
> 
> Hello all,
> When HTTP Boot performed the code checking if the Image type as EFI ISO
> and IMG. If not the boot not when the content type is as
> "Content-type: text/plain".
> https://github.com/tianocore/edk2/blob/master/NetworkPkg/HttpBootDxe/HttpB
> ootSupport.c (HttpBootCheckImageType())
> 
> But as per RFC it described below.
> https://tools.ietf.org/html/rfc2616#section-7.2.1:
> "If and only if the media type is not given by a Content-Type field, the
> recipient MAY attempt to guess the media type via inspection of its
> content and/or the name extension(s) of the URI used to identify the
> resource."
> Can you please comment if this need to be addressed such a way we can skip
> the validation of image types.
> -Siva
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: reg: EDK2 - HTTP Boot Image Validation

[Sivaraman Nainar]

Hello Fu Siyuan,

We can skip the header check if we know the image type. That should be enough.

-Siva
-----Original Message-----
From: Fu, Siyuan [mailto:siyuan.fu@intel.com] 
Sent: Wednesday, May 23, 2018 11:14 AM
To: Sivaraman Nainar; edk2-devel@lists.01.org
Subject: RE: reg: EDK2 - HTTP Boot Image Validation

Hi, Siva

What do you mean by "skip the validation of image types"? Do you want to skip the "Content-type" HTTP header check, or name extension check, or both of them?


BestRegards
Fu Siyuan

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of 
> Sivaraman Nainar
> Sent: Friday, May 18, 2018 5:17 PM
> To: edk2-devel@lists.01.org
> Subject: [edk2] reg: EDK2 - HTTP Boot Image Validation
> 
> Hello all,
> When HTTP Boot performed the code checking if the Image type as EFI 
> ISO and IMG. If not the boot not when the content type is as
> "Content-type: text/plain".
> https://github.com/tianocore/edk2/blob/master/NetworkPkg/HttpBootDxe/H
> ttpB ootSupport.c (HttpBootCheckImageType())
> 
> But as per RFC it described below.
> https://tools.ietf.org/html/rfc2616#section-7.2.1:
> "If and only if the media type is not given by a Content-Type field, 
> the recipient MAY attempt to guess the media type via inspection of 
> its content and/or the name extension(s) of the URI used to identify 
> the resource."
> Can you please comment if this need to be addressed such a way we can 
> skip the validation of image types.
> -Siva
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: reg: EDK2 - HTTP Boot Image Validation

[Fu, Siyuan]

Using standardized HTTP header is high priority, you also mentioned that RFC says " If and only if the media type is not given by a Content-Type field..."

BestRegards
Fu Siyuan


> -----Original Message-----
> From: Sivaraman Nainar [mailto:sivaramann@amiindia.co.in]
> Sent: Wednesday, May 23, 2018 2:00 PM
> To: Fu, Siyuan <siyuan.fu@intel.com>; edk2-devel@lists.01.org
> Subject: RE: reg: EDK2 - HTTP Boot Image Validation
> 
> Hello Fu Siyuan,
> 
> We can skip the header check if we know the image type. That should be
> enough.
> 
> -Siva
> -----Original Message-----
> From: Fu, Siyuan [mailto:siyuan.fu@intel.com]
> Sent: Wednesday, May 23, 2018 11:14 AM
> To: Sivaraman Nainar; edk2-devel@lists.01.org
> Subject: RE: reg: EDK2 - HTTP Boot Image Validation
> 
> Hi, Siva
> 
> What do you mean by "skip the validation of image types"? Do you want to
> skip the "Content-type" HTTP header check, or name extension check, or
> both of them?
> 
> 
> BestRegards
> Fu Siyuan
> 
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> > Sivaraman Nainar
> > Sent: Friday, May 18, 2018 5:17 PM
> > To: edk2-devel@lists.01.org
> > Subject: [edk2] reg: EDK2 - HTTP Boot Image Validation
> >
> > Hello all,
> > When HTTP Boot performed the code checking if the Image type as EFI
> > ISO and IMG. If not the boot not when the content type is as
> > "Content-type: text/plain".
> > https://github.com/tianocore/edk2/blob/master/NetworkPkg/HttpBootDxe/H
> > ttpB ootSupport.c (HttpBootCheckImageType())
> >
> > But as per RFC it described below.
> > https://tools.ietf.org/html/rfc2616#section-7.2.1:
> > "If and only if the media type is not given by a Content-Type field,
> > the recipient MAY attempt to guess the media type via inspection of
> > its content and/or the name extension(s) of the URI used to identify
> > the resource."
> > Can you please comment if this need to be addressed such a way we can
> > skip the validation of image types.
> > -Siva
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel