From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by mx.groups.io with SMTP id smtpd.web10.2600.1572240540522624731 for ; Sun, 27 Oct 2019 22:29:00 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.65, mailfrom: jian.j.wang@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Oct 2019 22:29:00 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,238,1569308400"; d="scan'208";a="350595424" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by orsmga004.jf.intel.com with ESMTP; 27 Oct 2019 22:28:59 -0700 Received: from fmsmsx111.amr.corp.intel.com (10.18.116.5) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 27 Oct 2019 22:28:59 -0700 Received: from shsmsx154.ccr.corp.intel.com (10.239.6.54) by fmsmsx111.amr.corp.intel.com (10.18.116.5) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 27 Oct 2019 22:28:59 -0700 Received: from shsmsx107.ccr.corp.intel.com ([169.254.9.63]) by SHSMSX154.ccr.corp.intel.com ([169.254.7.200]) with mapi id 14.03.0439.000; Mon, 28 Oct 2019 13:28:57 +0800 From: "Wang, Jian J" To: "devel@edk2.groups.io" , "lersek@redhat.com" CC: David Woodhouse , "Wu, Jiaxin" , Sivaraman Nainar , "Lu, XiaoyuX" Subject: Re: [edk2-devel] [PATCH v2 2/8] CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost" (CVE-2019-14553) Thread-Topic: [edk2-devel] [PATCH v2 2/8] CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost" (CVE-2019-14553) Thread-Index: AQHVi799CrI/PSwWO0iy2yb2phQwiadvhlEA Date: Mon, 28 Oct 2019 05:28:56 +0000 Message-ID: References: <20191026053719.10453-1-lersek@redhat.com> <20191026053719.10453-3-lersek@redhat.com> In-Reply-To: <20191026053719.10453-3-lersek@redhat.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMjRlNzFiNWItOTU0Zi00YjUxLTg2M2UtYmUyYzhlMDkyZGNmIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoibHpsc2FoSFFuRHdia1ZmcFRQUmc0TFFUMlphd3BXQ3dNUThQMk1Ya0dwK2VEOFBiTGo1dFlmTklENFFWYW1mZCJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jian.j.wang@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Jian J Wang Regards, Jian > -----Original Message----- > From: devel@edk2.groups.io On Behalf Of Laszlo Er= sek > Sent: Saturday, October 26, 2019 1:37 PM > To: edk2-devel-groups-io > Cc: David Woodhouse ; Wang, Jian J > ; Wu, Jiaxin ; Sivaraman Nai= nar > ; Lu, XiaoyuX > Subject: [edk2-devel] [PATCH v2 2/8] CryptoPkg/TlsLib: Add the new API > "TlsSetVerifyHost" (CVE-2019-14553) >=20 > From: "Wu, Jiaxin" >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D960 > CVE: CVE-2019-14553 > In the patch, we add the new API "TlsSetVerifyHost" for the TLS > protocol to set the specified host name that need to be verified. >=20 > Signed-off-by: Wu Jiaxin > Reviewed-by: Ye Ting > Reviewed-by: Long Qin > Reviewed-by: Fu Siyuan > Acked-by: Laszlo Ersek > Message-Id: <20190927034441.3096-3-Jiaxin.wu@intel.com> > Cc: David Woodhouse > Cc: Jian J Wang > Cc: Jiaxin Wu > Cc: Sivaraman Nainar > Cc: Xiaoyu Lu > Signed-off-by: Laszlo Ersek > --- >=20 > Notes: > v2: > - fix whitespace in subject line > - drop Contributed-under line per BZ#1373 >=20 > CryptoPkg/Include/Library/TlsLib.h | 20 +++++++++++ > CryptoPkg/Library/TlsLib/TlsConfig.c | 38 +++++++++++++++++++- > 2 files changed, 57 insertions(+), 1 deletion(-) >=20 > diff --git a/CryptoPkg/Include/Library/TlsLib.h > b/CryptoPkg/Include/Library/TlsLib.h > index 9875cb6e746b..3af7d4bc095e 100644 > --- a/CryptoPkg/Include/Library/TlsLib.h > +++ b/CryptoPkg/Include/Library/TlsLib.h > @@ -395,8 +395,28 @@ TlsSetVerify ( > IN VOID *Tls, > IN UINT32 VerifyMode > ); >=20 > +/** > + Set the specified host name to be verified. > + > + @param[in] Tls Pointer to the TLS object. > + @param[in] Flags The setting flags during the validation. > + @param[in] HostName The specified host name to be verified. > + > + @retval EFI_SUCCESS The HostName setting was set successfu= lly. > + @retval EFI_INVALID_PARAMETER The parameter is invalid. > + @retval EFI_ABORTED Invalid HostName setting. > + > +**/ > +EFI_STATUS > +EFIAPI > +TlsSetVerifyHost ( > + IN VOID *Tls, > + IN UINT32 Flags, > + IN CHAR8 *HostName > + ); > + > /** > Sets a TLS/SSL session ID to be used during TLS/SSL connect. >=20 > This function sets a session ID to be used when the TLS/SSL connectio= n is > diff --git a/CryptoPkg/Library/TlsLib/TlsConfig.c > b/CryptoPkg/Library/TlsLib/TlsConfig.c > index 74b577d60ee3..2bf5aee7c093 100644 > --- a/CryptoPkg/Library/TlsLib/TlsConfig.c > +++ b/CryptoPkg/Library/TlsLib/TlsConfig.c > @@ -1,8 +1,8 @@ > /** @file > SSL/TLS Configuration Library Wrapper Implementation over OpenSSL. >=20 > -Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.
> +Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.
> (C) Copyright 2016 Hewlett Packard Enterprise Development LP
> SPDX-License-Identifier: BSD-2-Clause-Patent >=20 > **/ > @@ -496,8 +496,44 @@ TlsSetVerify ( > // > SSL_set_verify (TlsConn->Ssl, VerifyMode, NULL); > } >=20 > +/** > + Set the specified host name to be verified. > + > + @param[in] Tls Pointer to the TLS object. > + @param[in] Flags The setting flags during the validation. > + @param[in] HostName The specified host name to be verified. > + > + @retval EFI_SUCCESS The HostName setting was set successfu= lly. > + @retval EFI_INVALID_PARAMETER The parameter is invalid. > + @retval EFI_ABORTED Invalid HostName setting. > + > +**/ > +EFI_STATUS > +EFIAPI > +TlsSetVerifyHost ( > + IN VOID *Tls, > + IN UINT32 Flags, > + IN CHAR8 *HostName > + ) > +{ > + TLS_CONNECTION *TlsConn; > + > + TlsConn =3D (TLS_CONNECTION *) Tls; > + if (TlsConn =3D=3D NULL || TlsConn->Ssl =3D=3D NULL || HostName =3D= =3D NULL) { > + return EFI_INVALID_PARAMETER; > + } > + > + SSL_set_hostflags(TlsConn->Ssl, Flags); > + > + if (SSL_set1_host(TlsConn->Ssl, HostName) =3D=3D 0) { > + return EFI_ABORTED; > + } > + > + return EFI_SUCCESS; > +} > + > /** > Sets a TLS/SSL session ID to be used during TLS/SSL connect. >=20 > This function sets a session ID to be used when the TLS/SSL connectio= n is > -- > 2.19.1.3.g30247aa5d201 >=20 >=20 >=20 >=20