From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.88; helo=mga01.intel.com; envelope-from=ting.ye@intel.com; receiver=edk2-devel@lists.01.org Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 5CD58222DE132 for ; Sun, 11 Feb 2018 19:00:08 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Feb 2018 19:05:57 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,499,1511856000"; d="scan'208";a="17381142" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by orsmga008.jf.intel.com with ESMTP; 11 Feb 2018 19:05:57 -0800 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.319.2; Sun, 11 Feb 2018 19:05:56 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.116]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.125]) with mapi id 14.03.0319.002; Mon, 12 Feb 2018 11:05:54 +0800 From: "Ye, Ting" To: "Wu, Jiaxin" , "edk2-devel@lists.01.org" CC: Laszlo Ersek , "Kinney, Michael D" , "Zimmer, Vincent" , "Yao, Jiewen" , "Fu, Siyuan" Thread-Topic: [PATCH v2 2/2] NetworkPkg: Read HttpTlsCipherList variable and configure it for HTTPS session. Thread-Index: AQHTouaRIAadlNPCYEqFKVXkh5d0MKOgFZUQ Date: Mon, 12 Feb 2018 03:05:54 +0000 Message-ID: References: <1518318916-12816-1-git-send-email-jiaxin.wu@intel.com> <1518318916-12816-3-git-send-email-jiaxin.wu@intel.com> In-Reply-To: <1518318916-12816-3-git-send-email-jiaxin.wu@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH v2 2/2] NetworkPkg: Read HttpTlsCipherList variable and configure it for HTTPS session. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Feb 2018 03:00:10 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Jiaxin, In following code, how about use "gEdkiiHttpTlsCipherListGuid" as the varia= ble GUID as to make it consistent with the variable name? + Status =3D gRT->GetVariable ( + EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE, + &gHttpTlsCipherListGuid, + NULL, + &CipherListSize, + NULL + ); Others are good to me.=20 Reviewed-by: Ye Ting Best Regards, Ting -----Original Message----- From: Wu, Jiaxin=20 Sent: Sunday, February 11, 2018 11:15 AM To: edk2-devel@lists.01.org Cc: Laszlo Ersek ; Kinney, Michael D ; Zimmer, Vincent ; Yao, Jiewen ; Ye, Ting ; Fu, Siyuan ; Wu, Jiaxin Subject: [PATCH v2 2/2] NetworkPkg: Read HttpTlsCipherList variable and con= figure it for HTTPS session. v2: * Refine the error handling returned from GetVariable. This patch is to read the HttpTlsCipherList variable and configure it for t= he later HTTPS session. If the variable is not set by any platform, EFI_NOT_FOUND will be returned = from GetVariable service. In such a case, the default CipherList created in= TlsDxe driver will be used. Cc: Laszlo Ersek Cc: Kinney Michael D Cc: Zimmer Vincent Cc: Yao Jiewen Cc: Ye Ting Cc: Fu Siyuan Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Wu Jiaxin --- NetworkPkg/HttpDxe/HttpDriver.h | 3 +- NetworkPkg/HttpDxe/HttpDxe.inf | 3 +- NetworkPkg/HttpDxe/HttpsSupport.c | 92 +++++++++++++++++++++++++++++++++++= +++- 3 files changed, 95 insertions(+), 3 deletions(-) diff --git a/NetworkPkg/HttpDxe/HttpDriver.h b/NetworkPkg/HttpDxe/HttpDrive= r.h index 93a412a..3b7a7a2 100644 --- a/NetworkPkg/HttpDxe/HttpDriver.h +++ b/NetworkPkg/HttpDxe/HttpDriver.h @@ -1,9 +1,9 @@ /** @file The header files of the driver binding and service binding protocol for = HttpDxe driver. =20 - Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.
+ Copyright (c) 2015 - 2018, Intel Corporation. All rights=20 + reserved.
(C) Copyright 2016 Hewlett Packard Enterprise Development LP
=20 This program and the accompanying materials are licensed and made available under the terms and conditions of the BS= D License which accompanies this distribution. The full text of the license may b= e found at @@ -59,10 +59,11 @@ // Produced Protocols // #include =20 #include +#include =20 #include =20 // // Driver Version diff --git a/NetworkPkg/HttpDxe/HttpDxe.inf b/NetworkPkg/HttpDxe/HttpDxe.in= f index 20075f5..56a2472 100644 --- a/NetworkPkg/HttpDxe/HttpDxe.inf +++ b/NetworkPkg/HttpDxe/HttpDxe.inf @@ -1,9 +1,9 @@ ## @file # Implementation of EFI HTTP protocol interfaces. # -# Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.
+# Copyright (c) 2015 - 2018, Intel Corporation. All rights=20 +reserved.
# # This program and the accompanying materials # are licensed and made a= vailable under the terms and conditions of the BSD License # which accomp= anies this distribution. The full text of the license may be found at # h= ttp://opensource.org/licenses/bsd-license.php. @@ -72,10 +72,11 @@ gEfiTlsProtocolGuid ## SOMETIMES_CONSUMES gEfiTlsConfigurationProtocolGuid ## SOMETIMES_CONSUMES =20 [Guids] gEfiTlsCaCertificateGuid ## SOMETIMES_CONSUMES = ## Variable:L"TlsCaCertificate" + gHttpTlsCipherListGuid ## SOMETIMES_CONSUMES = ## Variable:L"HttpTlsCipherList" =20 [Pcd] gEfiNetworkPkgTokenSpaceGuid.PcdAllowHttpConnections ## CONSUMES gEfiNetworkPkgTokenSpaceGuid.PcdHttpsAuthenticationMode ## SOMETIMES_= CONSUMES gEfiNetworkPkgTokenSpaceGuid.PcdHttpsHostPublicCert ## SOMETIMES_= CONSUMES diff --git a/NetworkPkg/HttpDxe/HttpsSupport.c b/NetworkPkg/HttpDxe/HttpsSu= pport.c index 288082a..fbe4087 100644 --- a/NetworkPkg/HttpDxe/HttpsSupport.c +++ b/NetworkPkg/HttpDxe/HttpsSupport.c @@ -1,9 +1,9 @@ /** @file Miscellaneous routines specific to Https for HttpDxe driver. =20 -Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.
+Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.
(C) Copyright 2016 Hewlett Packard Enterprise Development LP
This pro= gram and the accompanying materials are licensed and made available under = the terms and conditions of the BSD License which accompanies this distrib= ution. The full text of the license may be found at http://opensource.org= /licenses/bsd-license.php @@ -492,10 +492,91 @@ TlsConfigCertificate ( =20 return Status; } =20 /** + Read the HttpTlsCipherList variable and configure it for HTTPS session. + + @param[in, out] HttpInstance The HTTP instance private data. + + @retval EFI_SUCCESS The prefered HTTP TLS CipherList is confi= gured. + @retval EFI_NOT_FOUND Fail to get 'HttpTlsCipherList' variable. + @retval EFI_INVALID_PARAMETER The contents of variable are invalid. + @retval EFI_OUT_OF_RESOURCES Can't allocate memory resources. + + @retval Others Other error as indicated. + +**/ +EFI_STATUS +TlsConfigCipherList ( + IN OUT HTTP_PROTOCOL *HttpInstance + ) +{ + EFI_STATUS Status; + UINT8 *CipherList; + UINTN CipherListSize; + + CipherList =3D NULL; + CipherListSize =3D 0; + + // + // Try to read the HttpTlsCipherList variable. + // + Status =3D gRT->GetVariable ( + EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE, + &gHttpTlsCipherListGuid, + NULL, + &CipherListSize, + NULL + ); + ASSERT (EFI_ERROR (Status)); + if (Status !=3D EFI_BUFFER_TOO_SMALL) { + return Status; + } + + if (CipherListSize % sizeof (EFI_TLS_CIPHER) !=3D 0) { + return EFI_INVALID_PARAMETER; + } + + // + // Allocate buffer and read the config variable. + // + CipherList =3D AllocatePool (CipherListSize); if (CipherList =3D=3D NUL= L)=20 + { + return EFI_OUT_OF_RESOURCES; + } + + Status =3D gRT->GetVariable ( + EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE, + &gHttpTlsCipherListGuid, + NULL, + &CipherListSize, + CipherList + ); + if (EFI_ERROR (Status)) { + // + // GetVariable still error or the variable is corrupted. + // + goto ON_EXIT; + } + + ASSERT (CipherList !=3D NULL); + + Status =3D HttpInstance->Tls->SetSessionData ( + HttpInstance->Tls, + EfiTlsCipherList, + CipherList, + CipherListSize + ); + +ON_EXIT: =20 + FreePool (CipherList); + =20 + return Status; +} + +/** Configure TLS session data. =20 @param[in, out] HttpInstance The HTTP instance private data. =20 @retval EFI_SUCCESS TLS session data is configured. @@ -551,10 +632,19 @@ TlsConfigureSession ( if (EFI_ERROR (Status)) { return Status; } =20 // + // Tls Cipher List + // + Status =3D TlsConfigCipherList (HttpInstance); if (EFI_ERROR (Status)=20 + && Status !=3D EFI_NOT_FOUND) { + DEBUG ((EFI_D_ERROR, "TlsConfigCipherList: return %r error.\n", Status= )); + return Status; + } + + // // Tls Config Certificate // Status =3D TlsConfigCertificate (HttpInstance); if (EFI_ERROR (Status)) { DEBUG ((EFI_D_ERROR, "TlsConfigCertificate: return %r error.\n", Statu= s)); -- 1.9.5.msysgit.1