1. Patchew
  2. EDK2
  3. View series

[edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites

Laszlo Ersek posted 9 patches 6 years ago
Failed in applying to current master (apply log)
CryptoPkg/Include/Library/TlsLib.h                    |   9 +-
CryptoPkg/Library/TlsLib/InternalTlsLib.h             |   4 +
CryptoPkg/Library/TlsLib/TlsConfig.c                  | 279 +++++++++++++++-----
CryptoPkg/Library/TlsLib/TlsLib.inf                   |   9 +-
MdePkg/Include/Protocol/Tls.h                         |  10 +
NetworkPkg/TlsDxe/TlsProtocol.c                       |  17 +-
OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c   |  98 +++++++
OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf |   3 +-
8 files changed, 353 insertions(+), 76 deletions(-)
[edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites
Posted by Laszlo Ersek 6 years ago 
Repo:   https://github.com/lersek/edk2.git
Branch: tls_ciphers_v2

This is version 2 of the series posted earlier at

  http://mid.mail-archive.com/20180403145149.8925-1-lersek@redhat.com
  https://lists.01.org/pipermail/edk2-devel/2018-April/023402.html

Changes are noted per patch. One important change cannot be highlighted
that way however, because it involves the dropping of the following two
patches from v1:

  [edk2] [PATCH 08/13] CryptoPkg/TlsLib: add the "TlsMappingTable.sh"
                       POSIX shell script

  [edk2] [PATCH 09/13] CryptoPkg/TlsLib: extend "TlsCipherMappingTable"

I retested HTTPS boot with this series; it succeeded. The TLS cipher
suite preference list came from the system-wide configuration on my
RHEL-7 laptop; basically the binary CipherId array from the command
"openssl ciphers -V". The relevant lines from the OVMF log were:

> TlsAuthConfigDxe:SetCipherSuites: stored list of cipher suites (190 byte(s))
> [...]
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC030
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02C
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC028
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC024
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC014
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A5
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A3
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A1
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009F
> TlsDxe:TlsSetCipherList: skipping CipherId=0x006A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0038
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0088
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0087
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0086
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0085
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC032
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02E
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02A
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC026
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00F
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC005
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009D
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0084
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02F
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02B
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC027
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC023
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC013
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC009
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A4
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A2
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A0
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009E
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0040
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0032
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0099
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0098
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0097
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0045
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0044
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0043
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0042
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC031
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC029
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC025
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00E
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC004
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009C
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0096
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0041
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008C
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC012
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC008
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0013
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0010
> TlsDxe:TlsSetCipherList: skipping CipherId=0x000D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC003
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0007
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008B
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0021
> TlsDxe:TlsSetCipherList: skipping CipherId=0x001F
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0025
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0023
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC011
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC007
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00C
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC002
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0020
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0024
> TlsDxe:TlsSetCipherList: CipherString={
> DHE-RSA-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:DHE-RSA-AES256-
> SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:AES256-SHA256:AES256-SHA:DHE-RSA-AES128
> -SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DH-RSA-AES
> 128-SHA:DH-DSS-AES128-SHA:AES128-SHA256:AES128-SHA:DHE-RSA-DES-CBC3-SHA:DES-CBC
> 3-SHA:RC4-SHA:RC4-MD5
> }

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Gary Ching-Pang Lin <glin@suse.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Qin Long <qin.long@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Ting Ye <ting.ye@intel.com>

Thanks,
Laszlo

Laszlo Ersek (9):
  OvmfPkg/TlsAuthConfigLib: configure trusted cipher suites for HTTPS
    boot
  MdePkg/Include/Protocol/Tls.h: pack structures from the TLS RFC
  NetworkPkg/TlsDxe: verify DataSize for EfiTlsCipherList
  NetworkPkg/TlsDxe: clean up byte order conversion for EfiTlsCipherList
  CryptoPkg/TlsLib: replace TlsGetCipherString() with
    TlsGetCipherMapping()
  CryptoPkg/TlsLib: use binary search in the TlsGetCipherMapping()
    function
  CryptoPkg/TlsLib: pre-compute OpensslCipherLength in
    TlsCipherMappingTable
  CryptoPkg/TlsLib: sanitize lib classes in internal header and INF
  CryptoPkg/TlsLib: rewrite TlsSetCipherList()

 CryptoPkg/Include/Library/TlsLib.h                    |   9 +-
 CryptoPkg/Library/TlsLib/InternalTlsLib.h             |   4 +
 CryptoPkg/Library/TlsLib/TlsConfig.c                  | 279 +++++++++++++++-----
 CryptoPkg/Library/TlsLib/TlsLib.inf                   |   9 +-
 MdePkg/Include/Protocol/Tls.h                         |  10 +
 NetworkPkg/TlsDxe/TlsProtocol.c                       |  17 +-
 OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c   |  98 +++++++
 OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf |   3 +-
 8 files changed, 353 insertions(+), 76 deletions(-)

-- 
2.14.1.3.gb7cf6e02401b

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites
Posted by Long, Qin 6 years ago 
Hi, Laszlo,

The updated patch series looks good to me.

Reviewed-by: Long Qin <qin.long@intel.com>


Best Regards & Thanks,
LONG, Qin

-----Original Message-----
From: Laszlo Ersek [mailto:lersek@redhat.com] 
Sent: Wednesday, April 11, 2018 6:43 PM
To: edk2-devel@lists.01.org
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>; Gary Ching-Pang Lin <glin@suse.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Gao, Liming <liming.gao@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Long, Qin <qin.long@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>; Ye, Ting <ting.ye@intel.com>
Subject: [PATCH v2 0/9] {Ovmf,Mde,Network,Crypto}Pkg: fixes+features for setting HTTPS cipher suites

Repo:   https://github.com/lersek/edk2.git
Branch: tls_ciphers_v2

This is version 2 of the series posted earlier at

  http://mid.mail-archive.com/20180403145149.8925-1-lersek@redhat.com
  https://lists.01.org/pipermail/edk2-devel/2018-April/023402.html

Changes are noted per patch. One important change cannot be highlighted that way however, because it involves the dropping of the following two patches from v1:

  [edk2] [PATCH 08/13] CryptoPkg/TlsLib: add the "TlsMappingTable.sh"
                       POSIX shell script

  [edk2] [PATCH 09/13] CryptoPkg/TlsLib: extend "TlsCipherMappingTable"

I retested HTTPS boot with this series; it succeeded. The TLS cipher suite preference list came from the system-wide configuration on my
RHEL-7 laptop; basically the binary CipherId array from the command "openssl ciphers -V". The relevant lines from the OVMF log were:

> TlsAuthConfigDxe:SetCipherSuites: stored list of cipher suites (190 
> byte(s)) [...]
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC030
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02C
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC028
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC024
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC014
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A5
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A3
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A1
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009F
> TlsDxe:TlsSetCipherList: skipping CipherId=0x006A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0038
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0088
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0087
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0086
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0085
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC032
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02E
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02A
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC026
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00F
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC005
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009D
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0084
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02F
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02B
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC027
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC023
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC013
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC009
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A4
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A2
> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A0
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009E
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0040
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0032
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0099
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0098
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0097
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0045
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0044
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0043
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0042
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC031
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC029
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC025
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00E
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC004
> TlsDxe:TlsSetCipherList: skipping CipherId=0x009C
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0096
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0041
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008C
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC012
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC008
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0013
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0010
> TlsDxe:TlsSetCipherList: skipping CipherId=0x000D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00D
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC003
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0007
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008B
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0021
> TlsDxe:TlsSetCipherList: skipping CipherId=0x001F
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0025
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0023
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC011
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC007
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00C
> TlsDxe:TlsSetCipherList: skipping CipherId=0xC002
> TlsDxe:TlsSetCipherList: skipping CipherId=0x008A
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0020
> TlsDxe:TlsSetCipherList: skipping CipherId=0x0024
> TlsDxe:TlsSetCipherList: CipherString={
> DHE-RSA-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:DHE-RS
> A-AES256-
> SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:AES256-SHA256:AES256-SHA:DHE-R
> SA-AES128 
> -SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:D
> H-RSA-AES 
> 128-SHA:DH-DSS-AES128-SHA:AES128-SHA256:AES128-SHA:DHE-RSA-DES-CBC3-SH
> A:DES-CBC
> 3-SHA:RC4-SHA:RC4-MD5
> }

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Gary Ching-Pang Lin <glin@suse.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Qin Long <qin.long@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Ting Ye <ting.ye@intel.com>

Thanks,
Laszlo

Laszlo Ersek (9):
  OvmfPkg/TlsAuthConfigLib: configure trusted cipher suites for HTTPS
    boot
  MdePkg/Include/Protocol/Tls.h: pack structures from the TLS RFC
  NetworkPkg/TlsDxe: verify DataSize for EfiTlsCipherList
  NetworkPkg/TlsDxe: clean up byte order conversion for EfiTlsCipherList
  CryptoPkg/TlsLib: replace TlsGetCipherString() with
    TlsGetCipherMapping()
  CryptoPkg/TlsLib: use binary search in the TlsGetCipherMapping()
    function
  CryptoPkg/TlsLib: pre-compute OpensslCipherLength in
    TlsCipherMappingTable
  CryptoPkg/TlsLib: sanitize lib classes in internal header and INF
  CryptoPkg/TlsLib: rewrite TlsSetCipherList()

 CryptoPkg/Include/Library/TlsLib.h                    |   9 +-
 CryptoPkg/Library/TlsLib/InternalTlsLib.h             |   4 +
 CryptoPkg/Library/TlsLib/TlsConfig.c                  | 279 +++++++++++++++-----
 CryptoPkg/Library/TlsLib/TlsLib.inf                   |   9 +-
 MdePkg/Include/Protocol/Tls.h                         |  10 +
 NetworkPkg/TlsDxe/TlsProtocol.c                       |  17 +-
 OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c   |  98 +++++++
 OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf |   3 +-
 8 files changed, 353 insertions(+), 76 deletions(-)

--
2.14.1.3.gb7cf6e02401b

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites
Posted by Laszlo Ersek 6 years ago 
On 04/12/18 08:32, Long, Qin wrote:
> Hi, Laszlo,
> 
> The updated patch series looks good to me.
> 
> Reviewed-by: Long Qin <qin.long@intel.com>

Many thanks; I'll fix up the commit messages as suggested by Jiaxin and
Gary, and push the series sometime later today.

Thanks!
Laszlo
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites
Posted by Laszlo Ersek 6 years ago 
On 04/11/18 12:42, Laszlo Ersek wrote:
> Repo:   https://github.com/lersek/edk2.git
> Branch: tls_ciphers_v2
> 
> This is version 2 of the series posted earlier at
> 
>   http://mid.mail-archive.com/20180403145149.8925-1-lersek@redhat.com
>   https://lists.01.org/pipermail/edk2-devel/2018-April/023402.html
> 
> Changes are noted per patch. One important change cannot be highlighted
> that way however, because it involves the dropping of the following two
> patches from v1:
> 
>   [edk2] [PATCH 08/13] CryptoPkg/TlsLib: add the "TlsMappingTable.sh"
>                        POSIX shell script
> 
>   [edk2] [PATCH 09/13] CryptoPkg/TlsLib: extend "TlsCipherMappingTable"
> 
> I retested HTTPS boot with this series; it succeeded. The TLS cipher
> suite preference list came from the system-wide configuration on my
> RHEL-7 laptop; basically the binary CipherId array from the command
> "openssl ciphers -V". The relevant lines from the OVMF log were:
> 
>> TlsAuthConfigDxe:SetCipherSuites: stored list of cipher suites (190 byte(s))
>> [...]
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC030
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02C
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC028
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC024
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC014
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00A
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A5
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A3
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A1
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009F
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x006A
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0038
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0088
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0087
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0086
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0085
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC032
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02E
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02A
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC026
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00F
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC005
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009D
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0084
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008D
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02F
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02B
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC027
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC023
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC013
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC009
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A4
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A2
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A0
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009E
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0040
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0032
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009A
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0099
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0098
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0097
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0045
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0044
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0043
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0042
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC031
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02D
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC029
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC025
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00E
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC004
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009C
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0096
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0041
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008C
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC012
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC008
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0013
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0010
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x000D
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00D
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC003
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0007
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008B
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0021
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x001F
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0025
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0023
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC011
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC007
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00C
>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC002
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008A
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0020
>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0024
>> TlsDxe:TlsSetCipherList: CipherString={
>> DHE-RSA-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-SHA256:DHE-RSA-AES256-
>> SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:AES256-SHA256:AES256-SHA:DHE-RSA-AES128
>> -SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DH-RSA-AES
>> 128-SHA:DH-DSS-AES128-SHA:AES128-SHA256:AES128-SHA:DHE-RSA-DES-CBC3-SHA:DES-CBC
>> 3-SHA:RC4-SHA:RC4-MD5
>> }
> 
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Gary Ching-Pang Lin <glin@suse.com>
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Qin Long <qin.long@intel.com>
> Cc: Siyuan Fu <siyuan.fu@intel.com>
> Cc: Ting Ye <ting.ye@intel.com>
> 
> Thanks,
> Laszlo
> 
> Laszlo Ersek (9):
>   OvmfPkg/TlsAuthConfigLib: configure trusted cipher suites for HTTPS
>     boot
>   MdePkg/Include/Protocol/Tls.h: pack structures from the TLS RFC
>   NetworkPkg/TlsDxe: verify DataSize for EfiTlsCipherList
>   NetworkPkg/TlsDxe: clean up byte order conversion for EfiTlsCipherList
>   CryptoPkg/TlsLib: replace TlsGetCipherString() with
>     TlsGetCipherMapping()
>   CryptoPkg/TlsLib: use binary search in the TlsGetCipherMapping()
>     function
>   CryptoPkg/TlsLib: pre-compute OpensslCipherLength in
>     TlsCipherMappingTable
>   CryptoPkg/TlsLib: sanitize lib classes in internal header and INF
>   CryptoPkg/TlsLib: rewrite TlsSetCipherList()
> 
>  CryptoPkg/Include/Library/TlsLib.h                    |   9 +-
>  CryptoPkg/Library/TlsLib/InternalTlsLib.h             |   4 +
>  CryptoPkg/Library/TlsLib/TlsConfig.c                  | 279 +++++++++++++++-----
>  CryptoPkg/Library/TlsLib/TlsLib.inf                   |   9 +-
>  MdePkg/Include/Protocol/Tls.h                         |  10 +
>  NetworkPkg/TlsDxe/TlsProtocol.c                       |  17 +-
>  OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c   |  98 +++++++
>  OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf |   3 +-
>  8 files changed, 353 insertions(+), 76 deletions(-)
> 

Pushed as commit range 54ec85dd2902..2167c7f7a55b.

Thanks!
Laszlo
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites
Posted by Wu, Jiaxin 6 years ago 
Hi Laszlo,

In the commit log of patch 0001,  "EFI_TLS_CA_CERTIFICATE_VARIABLE"  should be "EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE".

Others  looks good to me.

Series Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>


Thanks,
Jiaxin

> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Wednesday, April 11, 2018 6:43 PM
> To: edk2-devel@lists.01.org
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>; Gary Ching-Pang Lin
> <glin@suse.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; Justen, Jordan L
> <jordan.l.justen@intel.com>; Gao, Liming <liming.gao@intel.com>; Kinney,
> Michael D <michael.d.kinney@intel.com>; Long, Qin <qin.long@intel.com>;
> Fu, Siyuan <siyuan.fu@intel.com>; Ye, Ting <ting.ye@intel.com>
> Subject: [PATCH v2 0/9] {Ovmf,Mde,Network,Crypto}Pkg: fixes+features for
> setting HTTPS cipher suites
> 
> Repo:   https://github.com/lersek/edk2.git
> Branch: tls_ciphers_v2
> 
> This is version 2 of the series posted earlier at
> 
>   http://mid.mail-archive.com/20180403145149.8925-1-lersek@redhat.com
>   https://lists.01.org/pipermail/edk2-devel/2018-April/023402.html
> 
> Changes are noted per patch. One important change cannot be highlighted
> that way however, because it involves the dropping of the following two
> patches from v1:
> 
>   [edk2] [PATCH 08/13] CryptoPkg/TlsLib: add the "TlsMappingTable.sh"
>                        POSIX shell script
> 
>   [edk2] [PATCH 09/13] CryptoPkg/TlsLib: extend "TlsCipherMappingTable"
> 
> I retested HTTPS boot with this series; it succeeded. The TLS cipher
> suite preference list came from the system-wide configuration on my
> RHEL-7 laptop; basically the binary CipherId array from the command
> "openssl ciphers -V". The relevant lines from the OVMF log were:
> 
> > TlsAuthConfigDxe:SetCipherSuites: stored list of cipher suites (190 byte(s))
> > [...]
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC030
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC02C
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC028
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC024
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC014
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC00A
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x00A5
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x00A3
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x00A1
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x009F
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x006A
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0038
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0088
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0087
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0086
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0085
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC032
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC02E
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC02A
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC026
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC00F
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC005
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x009D
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0084
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x008D
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC02F
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC02B
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC027
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC023
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC013
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC009
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x00A4
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x00A2
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x00A0
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x009E
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0040
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0032
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x009A
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0099
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0098
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0097
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0045
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0044
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0043
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0042
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC031
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC02D
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC029
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC025
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC00E
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC004
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x009C
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0096
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0041
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x008C
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC012
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC008
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0013
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0010
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x000D
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC00D
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC003
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0007
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x008B
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0021
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x001F
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0025
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0023
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC011
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC007
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC00C
> > TlsDxe:TlsSetCipherList: skipping CipherId=0xC002
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x008A
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0020
> > TlsDxe:TlsSetCipherList: skipping CipherId=0x0024
> > TlsDxe:TlsSetCipherList: CipherString={
> > DHE-RSA-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-
> SHA256:DHE-RSA-AES256-
> > SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:AES256-SHA256:AES256-
> SHA:DHE-RSA-AES128
> > -SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-
> AES128-SHA:DH-RSA-AES
> > 128-SHA:DH-DSS-AES128-SHA:AES128-SHA256:AES128-SHA:DHE-RSA-DES-
> CBC3-SHA:DES-CBC
> > 3-SHA:RC4-SHA:RC4-MD5
> > }
> 
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Gary Ching-Pang Lin <glin@suse.com>
> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Qin Long <qin.long@intel.com>
> Cc: Siyuan Fu <siyuan.fu@intel.com>
> Cc: Ting Ye <ting.ye@intel.com>
> 
> Thanks,
> Laszlo
> 
> Laszlo Ersek (9):
>   OvmfPkg/TlsAuthConfigLib: configure trusted cipher suites for HTTPS
>     boot
>   MdePkg/Include/Protocol/Tls.h: pack structures from the TLS RFC
>   NetworkPkg/TlsDxe: verify DataSize for EfiTlsCipherList
>   NetworkPkg/TlsDxe: clean up byte order conversion for EfiTlsCipherList
>   CryptoPkg/TlsLib: replace TlsGetCipherString() with
>     TlsGetCipherMapping()
>   CryptoPkg/TlsLib: use binary search in the TlsGetCipherMapping()
>     function
>   CryptoPkg/TlsLib: pre-compute OpensslCipherLength in
>     TlsCipherMappingTable
>   CryptoPkg/TlsLib: sanitize lib classes in internal header and INF
>   CryptoPkg/TlsLib: rewrite TlsSetCipherList()
> 
>  CryptoPkg/Include/Library/TlsLib.h                    |   9 +-
>  CryptoPkg/Library/TlsLib/InternalTlsLib.h             |   4 +
>  CryptoPkg/Library/TlsLib/TlsConfig.c                  | 279 +++++++++++++++-----
>  CryptoPkg/Library/TlsLib/TlsLib.inf                   |   9 +-
>  MdePkg/Include/Protocol/Tls.h                         |  10 +
>  NetworkPkg/TlsDxe/TlsProtocol.c                       |  17 +-
>  OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c   |  98 +++++++
>  OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf |   3 +-
>  8 files changed, 353 insertions(+), 76 deletions(-)
> 
> --
> 2.14.1.3.gb7cf6e02401b

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH v2 0/9] {Ovmf, Mde, Network, Crypto}Pkg: fixes+features for setting HTTPS cipher suites
Posted by Laszlo Ersek 6 years ago 
On 04/12/18 09:28, Wu, Jiaxin wrote:
> Hi Laszlo,
> 
> In the commit log of patch 0001,  "EFI_TLS_CA_CERTIFICATE_VARIABLE"  should be "EDKII_HTTP_TLS_CIPHER_LIST_VARIABLE".

Good catch, thanks!

> Others  looks good to me.
> 
> Series Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>

Thank you,
Laszlo

> 
> 
> Thanks,
> Jiaxin
> 
>> -----Original Message-----
>> From: Laszlo Ersek [mailto:lersek@redhat.com]
>> Sent: Wednesday, April 11, 2018 6:43 PM
>> To: edk2-devel@lists.01.org
>> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>; Gary Ching-Pang Lin
>> <glin@suse.com>; Wu, Jiaxin <jiaxin.wu@intel.com>; Justen, Jordan L
>> <jordan.l.justen@intel.com>; Gao, Liming <liming.gao@intel.com>; Kinney,
>> Michael D <michael.d.kinney@intel.com>; Long, Qin <qin.long@intel.com>;
>> Fu, Siyuan <siyuan.fu@intel.com>; Ye, Ting <ting.ye@intel.com>
>> Subject: [PATCH v2 0/9] {Ovmf,Mde,Network,Crypto}Pkg: fixes+features for
>> setting HTTPS cipher suites
>>
>> Repo:   https://github.com/lersek/edk2.git
>> Branch: tls_ciphers_v2
>>
>> This is version 2 of the series posted earlier at
>>
>>   http://mid.mail-archive.com/20180403145149.8925-1-lersek@redhat.com
>>   https://lists.01.org/pipermail/edk2-devel/2018-April/023402.html
>>
>> Changes are noted per patch. One important change cannot be highlighted
>> that way however, because it involves the dropping of the following two
>> patches from v1:
>>
>>   [edk2] [PATCH 08/13] CryptoPkg/TlsLib: add the "TlsMappingTable.sh"
>>                        POSIX shell script
>>
>>   [edk2] [PATCH 09/13] CryptoPkg/TlsLib: extend "TlsCipherMappingTable"
>>
>> I retested HTTPS boot with this series; it succeeded. The TLS cipher
>> suite preference list came from the system-wide configuration on my
>> RHEL-7 laptop; basically the binary CipherId array from the command
>> "openssl ciphers -V". The relevant lines from the OVMF log were:
>>
>>> TlsAuthConfigDxe:SetCipherSuites: stored list of cipher suites (190 byte(s))
>>> [...]
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC030
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02C
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC028
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC024
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC014
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00A
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A5
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A3
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A1
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009F
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x006A
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0038
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0088
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0087
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0086
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0085
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC032
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02E
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02A
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC026
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00F
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC005
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009D
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0084
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008D
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02F
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02B
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC027
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC023
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC013
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC009
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A4
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A2
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x00A0
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009E
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0040
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0032
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009A
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0099
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0098
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0097
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0045
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0044
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0043
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0042
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC031
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC02D
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC029
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC025
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00E
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC004
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x009C
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0096
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0041
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008C
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC012
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC008
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0013
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0010
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x000D
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00D
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC003
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0007
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008B
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0021
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x001F
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0025
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0023
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC011
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC007
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC00C
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0xC002
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x008A
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0020
>>> TlsDxe:TlsSetCipherList: skipping CipherId=0x0024
>>> TlsDxe:TlsSetCipherList: CipherString={
>>> DHE-RSA-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-AES256-
>> SHA256:DHE-RSA-AES256-
>>> SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:AES256-SHA256:AES256-
>> SHA:DHE-RSA-AES128
>>> -SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-SHA256:DHE-RSA-
>> AES128-SHA:DH-RSA-AES
>>> 128-SHA:DH-DSS-AES128-SHA:AES128-SHA256:AES128-SHA:DHE-RSA-DES-
>> CBC3-SHA:DES-CBC
>>> 3-SHA:RC4-SHA:RC4-MD5
>>> }
>>
>> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> Cc: Gary Ching-Pang Lin <glin@suse.com>
>> Cc: Jiaxin Wu <jiaxin.wu@intel.com>
>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>> Cc: Liming Gao <liming.gao@intel.com>
>> Cc: Michael D Kinney <michael.d.kinney@intel.com>
>> Cc: Qin Long <qin.long@intel.com>
>> Cc: Siyuan Fu <siyuan.fu@intel.com>
>> Cc: Ting Ye <ting.ye@intel.com>
>>
>> Thanks,
>> Laszlo
>>
>> Laszlo Ersek (9):
>>   OvmfPkg/TlsAuthConfigLib: configure trusted cipher suites for HTTPS
>>     boot
>>   MdePkg/Include/Protocol/Tls.h: pack structures from the TLS RFC
>>   NetworkPkg/TlsDxe: verify DataSize for EfiTlsCipherList
>>   NetworkPkg/TlsDxe: clean up byte order conversion for EfiTlsCipherList
>>   CryptoPkg/TlsLib: replace TlsGetCipherString() with
>>     TlsGetCipherMapping()
>>   CryptoPkg/TlsLib: use binary search in the TlsGetCipherMapping()
>>     function
>>   CryptoPkg/TlsLib: pre-compute OpensslCipherLength in
>>     TlsCipherMappingTable
>>   CryptoPkg/TlsLib: sanitize lib classes in internal header and INF
>>   CryptoPkg/TlsLib: rewrite TlsSetCipherList()
>>
>>  CryptoPkg/Include/Library/TlsLib.h                    |   9 +-
>>  CryptoPkg/Library/TlsLib/InternalTlsLib.h             |   4 +
>>  CryptoPkg/Library/TlsLib/TlsConfig.c                  | 279 +++++++++++++++-----
>>  CryptoPkg/Library/TlsLib/TlsLib.inf                   |   9 +-
>>  MdePkg/Include/Protocol/Tls.h                         |  10 +
>>  NetworkPkg/TlsDxe/TlsProtocol.c                       |  17 +-
>>  OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.c   |  98 +++++++
>>  OvmfPkg/Library/TlsAuthConfigLib/TlsAuthConfigLib.inf |   3 +-
>>  8 files changed, 353 insertions(+), 76 deletions(-)
>>
>> --
>> 2.14.1.3.gb7cf6e02401b
> 

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.