summaryrefslogtreecommitdiffstats
path: root/NetworkPkg
Commit message (Collapse)AuthorAgeFilesLines
...
* NetworkPkg: Change use of EFI_D_* to DEBUG_*Michael D Kinney2021-12-0742-286/+274
| | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3739 Update all use of EFI_D_* defines in DEBUG() macros to DEBUG_* defines. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg: Fix invalid pointer for DNS response token on erroredk2-stable202111Liming Gao2021-11-261-0/+2
| | | | | | | | | | | Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3719 This issue is introduced by the commit 43d7e607. Token->RspData.H2AData is de-allocated on error but it is not set to NULL. HTTP module attempts to free again and cause assert. Signed-off-by: Baraneedharan Anbazhagan <anbazhagan@hp.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
* NetworkPkg: Reproduce builds across source format changesMichael D Kinney2021-11-082-5/+5
| | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3688 Use DEBUG_LINE_NUMBER instead of __LINE__. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Michael Kubacki <michael.kubacki@microsoft.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Tested-by: Michael Kubacki <michael.kubacki@microsoft.com>
* NetworkPkg/NetworkPkg.dsc: Add RngLib mapping for ARM and RISCV64Michael D Kinney2021-11-051-0/+6
| | | | | | | | | | | | | | | | Fix NetworkPkg build breaks for ARM and RISCV64 by adding RngLib mapping. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Abner Chang <abner.chang@hpe.com> Cc: Daniel Schaefer <daniel.schaefer@hpe.com> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Daniel Schaefer <daniel.schaefer@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Acked-by: Abner Chang <abner.chang@hpe.com>
* NetworkPkg/HttpDxe: Enable wildcard host name matching for HTTP+TLS.Vineel Kovvuri2021-11-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current UEFI implementation of HTTPS during its TLS configuration uses EFI_TLS_VERIFY_FLAG_NO_WILDCARDS for host name verification. As per the spec this flag does is "to disable the match of any wildcards in the host name". So, certificates which are issued with wildcards(*.dm.corp.net etc) in it will fail the TLS host name matching. On the other hand, EFI_TLS_VERIFY_FLAG_NONE(misnomer) means "no additional flags set for hostname validation. Wildcards are supported and they match only in the left-most label." this behavior/definition is coming from openssl's X509_check_host() api https://www.openssl.org/docs/man1.1.0/man3/X509_check_host.html Without EFI_TLS_VERIFY_FLAG_NONE any UEFI application using certificates issued with wildcards in them would fail to match while trying to communicate with HTTPS endpoint. BugZilla: https://bugzilla.tianocore.org/show_bug.cgi?id=3691 Signed-off-by: Vineel Kovvuri <vineelko@microsoft.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/HttpBootDxe: make file extension check case-insensitiveLin, Gary (HPS OE-Linux)2021-10-221-3/+3
| | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=3694 HttpBootCheckImageType() was using the case-sensitive AsciiStrCmp() to check the file extensions and this could reject the images with upper-case file names. Using the case-insensitive AsciiStriCmp() to avoid the issue. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Gary Lin <gary.lin@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg: Add HTTP Additional Event NotificationsHeng Luo2021-07-287-2/+163
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3496 Add new EDKII_HTTP_CALLBACK_PROTOCOL in NetworkPkg, Send HTTP Events via EDKII_HTTP_CALLBACK_PROTOCOL when Dns/ConnectTcp/TlsConnectSession/InitSession occurs. Signed-off-by: Heng Luo <heng.luo@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* NetworkPkg: Making the HTTP IO timeout value programmable with PCDZachary Clark-Williams2021-07-289-21/+43
| | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3507 HTTP boot has a default set forced timeout value of 5 seconds for getting the recovery image from a remote source. This change allows the HTTP boot flow to get the IO timeout value from the PcdHttpIoTimeout. PcdHttpIoTimeout value is set in platform code. Signed-off-by: Zachary Clark-Williams <zachary.clark-williams@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
* NetworkPkg: introduce the NETWORK_ISCSI_MD5_ENABLE feature test macroLaszlo Ersek2021-06-303-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the NETWORK_ISCSI_MD5_ENABLE feature test macro for NetworkPkg. When explicitly set to FALSE, remove MD5 from IScsiDxe's CHAP algorithm list. Set NETWORK_ISCSI_MD5_ENABLE to TRUE by default, for compatibility reasons. Not just to minimize the disruption for platforms that currently include IScsiDxe, but also because RFC 7143 mandates MD5 for CHAP, and some vendors' iSCSI targets support MD5 only. With MD5 enabled, IScsiDxe will suggest SHA256, and then fall back to MD5 if the target requests it. With MD5 disabled, IScsiDxe will suggest SHA256, and break off the connection (and session) if the target doesn't support SHA256. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210629163337.14120-7-lersek@redhat.com>
* NetworkPkg/IScsiDxe: support SHA256 in CHAPLaszlo Ersek2021-06-302-1/+14
| | | | | | | | | | | | | | | | | | | Insert a SHA256 CHAP_HASH structure at the start of "mChapHash". Update ISCSI_CHAP_MAX_DIGEST_SIZE to SHA256_DIGEST_SIZE (32). This enables the initiator and the target to negotiate SHA256 for CHAP, in preference to MD5. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210629163337.14120-6-lersek@redhat.com>
* NetworkPkg/IScsiDxe: support multiple hash algorithms for CHAPLaszlo Ersek2021-06-304-23/+207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce the "mChapHash" table, containing the hash algorithms supported for CHAP. Hash algos listed at the beginning of the table are preferred by the initiator. In ISCSI_CHAP_STEP_ONE, send such a CHAP_A value that is the comma-separated, ordered list of algorithm identifiers from "mChapHash". Pre-format this value string at driver startup, in the new function IScsiCHAPInitHashList(). (In IScsiCHAPInitHashList(), also enforce that every hash algo's digest size fit into ISCSI_CHAP_MAX_DIGEST_SIZE, as the latter controls the digest, outgoing challenge, and hex *allocations*.) In ISCSI_CHAP_STEP_TWO, allow the target to select one of the offered hash algorithms, and remember the selection for the later steps. For ISCSI_CHAP_STEP_THREE, hash the challenge from the target with the selected hash algo. In ISCSI_CHAP_STEP_THREE, send the correctly sized digest to the target. If the initiator wants mutual authentication, then generate a challenge with as many bytes as the target's digest will have, in ISCSI_CHAP_STEP_FOUR. In ISCSI_CHAP_STEP_FOUR (i.e., when mutual authentication is required by the initiator), verify the target's response (digest) with the selected algorithm. Clear the selected hash algorithm before every login (remember that in IScsiDxe, every login is a leading login). There is no peer-observable change from this patch, as it only reworks the current MD5 support into the new internal representation. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20210629163337.14120-5-lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/IScsiDxe: distinguish "maximum" and "selected" CHAP digest sizesLaszlo Ersek2021-06-302-17/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IScsiDxe uses the ISCSI_CHAP_RSP_LEN macro for expressing the size of the digest (16) that it solely supports at this point (MD5). ISCSI_CHAP_RSP_LEN is used for both (a) *allocating* digest-related buffers (binary buffers and hex encodings alike), and (b) *processing* binary digest buffers (comparing them, filling them, reading them). In preparation for adding other hash algorithms, split purpose (a) from purpose (b). For purpose (a) -- buffer allocation --, introduce ISCSI_CHAP_MAX_DIGEST_SIZE. For purpose (b) -- processing --, rely on MD5_DIGEST_SIZE from <BaseCryptLib.h>. Distinguishing these purposes is justified because purpose (b) -- processing -- must depend on the hashing algorithm negotiated between initiator and target, while for purpose (a) -- allocation --, using the maximum supported digest size is suitable. For now, because only MD5 is supported, introduce ISCSI_CHAP_MAX_DIGEST_SIZE *as* MD5_DIGEST_SIZE. Note that the argument for using the digest size as the size of the outgoing challenge (in case mutual authentication is desired by the initiator) remains in place. Because of this, the above two purposes are distinguished for the "ISCSI_CHAP_AUTH_DATA.OutChallenge" field as well. This patch is functionally a no-op, just yet. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210629163337.14120-4-lersek@redhat.com>
* NetworkPkg/IScsiDxe: add horizontal whitespace to IScsiCHAP filesLaszlo Ersek2021-06-302-18/+18
| | | | | | | | | | | | | | | | | In the next patches, we'll need more room for various macro and parameter names. For maintaining the current visual alignments, insert some horizontal whitespace in preparation. "git show -b" produces no output for this patch; the patch introduces no functional changes. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210629163337.14120-3-lersek@redhat.com>
* NetworkPkg/IScsiDxe: re-set session-level authentication state before loginLaszlo Ersek2021-06-301-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 7143 explains that a single iSCSI session may use multiple TCP connections. The first connection established is called the leading connection. The login performed on the leading connection is called the leading login. Before the session is considered full-featured, the leading login must succeed. Further (non-leading) connections can be associated with the session later. (It's unclear to me from RFC 7143 whether the non-leading connections require individual (non-leading) logins as well, but that particular question is irrelevant from the perspective of this patch; see below.) The data model in IScsiDxe exhibits some confusion, regarding connection / session association: - On one hand, the "ISCSI_SESSION.Conns" field is a *set* (it has type LIST_ENTRY), and accordingly, connections can be added to, and removed from, a session, with the IScsiAttatchConnection() and IScsiDetatchConnection() functions. - On the other hand, ISCSI_MAX_CONNS_PER_SESSION has value 1, therefore no session will ever use more than 1 connection at a time (refer to instances of "Session->MaxConnections" in "NetworkPkg/IScsiDxe/IScsiProto.c"). This one-to-many confusion between ISCSI_SESSION and ISCSI_CONNECTION is very visible in the CHAP logic, where the progress of the authentication is maintained *per connection*, in the "ISCSI_CONNECTION.AuthStep" field (with values such as ISCSI_AUTH_INITIAL, ISCSI_CHAP_STEP_ONE, etc), but the *data* for the authentication are maintained *per session*, in the "AuthType" and "AuthData" fields of ISCSI_SESSION. Clearly, this makes no sense if multiple connections are eligible for logging in. Knowing that IScsiDxe uses only one connection per session (put differently: knowing that any connection is a leading connection, and any login is a leading login), there is no functionality bug. But the data model is still broken: "AuthType", "AuthData", and "AuthStep" should be maintained at the *same* level -- be it "session-level" or "(leading) connection-level". Fixing this data model bug is more than what I'm signing up for. However, I do need to add one function, in preparation for multi-hash support: whenever a new login is attempted (put differently: whenever the leading login is re-attempted), which always happens with a fresh connection, the session-level authentication data needs to be rewound to a sane initial state. Introduce the IScsiSessionResetAuthData() function. Call it from the central -- session-level -- IScsiSessionLogin() function, just before the latter calls the -- connection-level -- IScsiConnLogin() function. Right now, do nothing in IScsiSessionResetAuthData(); so functionally speaking, the patch is a no-op. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3355 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210629163337.14120-2-lersek@redhat.com>
* NetworkPkg/IScsiDxe: check IScsiHexToBin() return valuesLaszlo Ersek2021-06-091-6/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IScsiDxe (that is, the initiator) receives two hex-encoded strings from the iSCSI target: - CHAP_C, where the target challenges the initiator, - CHAP_R, where the target answers the challenge from the initiator (in case the initiator wants mutual authentication). Accordingly, we have two IScsiHexToBin() call sites: - At the CHAP_C decoding site, check whether the decoding succeeds. The decoded buffer ("AuthData->InChallenge") can accommodate 1024 bytes, which is a permissible restriction on the target, per <https://tools.ietf.org/html/rfc7143#section-12.1.3>. Shorter challenges from the target are acceptable. - At the CHAP_R decoding site, enforce that the decoding both succeed, and provide exactly ISCSI_CHAP_RSP_LEN bytes. CHAP_R contains the digest calculated by the target, therefore it must be of fixed size. We may only call IScsiCHAPAuthTarget() if "TargetRsp" has been fully populated. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210608121259.32451-11-lersek@redhat.com>
* NetworkPkg/IScsiDxe: fix IScsiHexToBin() buffer overflowLaszlo Ersek2021-06-092-3/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | The IScsiHexToBin() function documents the EFI_BUFFER_TOO_SMALL return condition, but never actually checks whether the decoded buffer fits into the caller-provided room (i.e., the input value of "BinLength"), and EFI_BUFFER_TOO_SMALL is never returned. The decoding of "HexStr" can overflow "BinBuffer". This is remotely exploitable, as shown in a subsequent patch, which adds error checking to the IScsiHexToBin() call sites. This issue allows the target to compromise the initiator. Introduce EFI_BAD_BUFFER_SIZE, in addition to the existent EFI_BUFFER_TOO_SMALL, for reporting a special case of the buffer overflow, plus actually catch the buffer overflow. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-10-lersek@redhat.com>
* NetworkPkg/IScsiDxe: fix IScsiHexToBin() hex parsingLaszlo Ersek2021-06-092-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The IScsiHexToBin() function has the following parser issues: (1) If the *subject sequence* in "HexStr" is empty, the function returns EFI_SUCCESS (with "BinLength" set to 0 on output). Such inputs should be rejected. (2) The function mis-handles a "HexStr" that ends with a stray nibble. For example, if "HexStr" is "0xABC", the function decodes it to the bytes {0xAB, 0x0C}, sets "BinLength" to 2 on output, and returns EFI_SUCCESS. Such inputs should be rejected. (3) If an invalid hex char is found in "HexStr", the function treats it as end-of-hex-string, and returns EFI_SUCCESS. Such inputs should be rejected. All of the above cases are remotely triggerable, as shown in a subsequent patch, which adds error checking to the IScsiHexToBin() call sites. While the initiator is not immediately compromised, incorrectly parsing CHAP_R from the target, in case of mutual authentication, is not great. Extend the interface contract of IScsiHexToBin() with EFI_INVALID_PARAMETER, for reporting issues (1) through (3), and implement the new checks. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-9-lersek@redhat.com>
* NetworkPkg/IScsiDxe: reformat IScsiHexToBin() leading comment blockLaszlo Ersek2021-06-092-16/+16
| | | | | | | | | | | | | | | | | | We'll need further return values for IScsiHexToBin() in a subsequent patch; make room for them in the leading comment block of the function. While at it, rewrap the comment block to 80 characters width. No functional changes. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-8-lersek@redhat.com>
* NetworkPkg/IScsiDxe: assert that IScsiBinToHex() always succeedsLaszlo Ersek2021-06-091-12/+15
| | | | | | | | | | | | | | | | | | | | | | | IScsiBinToHex() is called for encoding: - the answer to the target's challenge; that is, CHAP_R; - the challenge for the target, in case mutual authentication is enabled; that is, CHAP_C. The initiator controls the size of both blobs, the sizes of their hex encodings are correctly calculated in "RspLen" and "ChallengeLen". Therefore the IScsiBinToHex() calls never fail; assert that. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210608121259.32451-7-lersek@redhat.com>
* NetworkPkg/IScsiDxe: fix potential integer overflow in IScsiBinToHex()Laszlo Ersek2021-06-094-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Considering IScsiBinToHex(): > if (((*HexLength) - 3) < BinLength * 2) { > *HexLength = BinLength * 2 + 3; > } the following subexpressions are problematic: (*HexLength) - 3 BinLength * 2 BinLength * 2 + 3 The first one may wrap under zero, the latter two may wrap over MAX_UINT32. Rewrite the calculation using SafeIntLib. While at it, change the type of the "Index" variable from UINTN to UINT32. The largest "Index"-based value that we calculate is Index * 2 + 2 (with (Index == BinLength)) Because the patch makes BinLength * 2 + 3 safe to calculate in UINT32, using UINT32 for Index * 2 + 2 (with (Index == BinLength)) is safe too. Consistently using UINT32 improves readability. This patch is best reviewed with "git show -W". The integer overflows that this patch fixes are theoretical; a subsequent patch in the series will audit the IScsiBinToHex() call sites, and show that none of them can fail. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-6-lersek@redhat.com>
* NetworkPkg/IScsiDxe: clean up library class dependenciesLaszlo Ersek2021-06-092-12/+11
| | | | | | | | | | | | | | | | | Sort the library class dependencies in the #include directives and in the INF file. Remove the DpcLib class from the #include directives -- it is not listed in the INF file, and IScsiDxe doesn't call either DpcLib API (QueueDpc(), DispatchDpc()). No functional changes. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210608121259.32451-5-lersek@redhat.com>
* NetworkPkg/IScsiDxe: clean up "ISCSI_CHAP_AUTH_DATA.OutChallengeLength"Laszlo Ersek2021-06-092-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "ISCSI_CHAP_AUTH_DATA.OutChallenge" field is declared as a UINT8 array with ISCSI_CHAP_AUTH_MAX_LEN (1024) elements. However, when the challenge is generated and formatted, only ISCSI_CHAP_RSP_LEN (16) octets are used in the array. Change the array size to ISCSI_CHAP_RSP_LEN, and remove the (now unused) ISCSI_CHAP_AUTH_MAX_LEN macro. Remove the "ISCSI_CHAP_AUTH_DATA.OutChallengeLength" field, which is superfluous too. Most importantly, explain in a new comment *why* tying the challenge size to the digest size (ISCSI_CHAP_RSP_LEN) has always made sense. (See also Linux kernel commit 19f5f88ed779, "scsi: target: iscsi: tie the challenge length to the hash digest size", 2019-11-06.) For sure, the motivation that the new comment now explains has always been there, and has always been the same, for IScsiDxe; it's just that now we spell it out too. No change in peer-visible behavior. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210608121259.32451-4-lersek@redhat.com>
* NetworkPkg/IScsiDxe: simplify "ISCSI_CHAP_AUTH_DATA.InChallenge" sizeLaszlo Ersek2021-06-092-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The ISCSI_CHAP_AUTH_MAX_LEN macro is defined with value 1024. The usage of this macro currently involves a semantic (not functional) bug, which we're going to fix in a subsequent patch, eliminating ISCSI_CHAP_AUTH_MAX_LEN altogether. For now, remove the macro's usage from all "ISCSI_CHAP_AUTH_DATA.InChallenge" contexts. This is doable without duplicating open-coded constants. No changes in functionality. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Message-Id: <20210608121259.32451-3-lersek@redhat.com>
* NetworkPkg/IScsiDxe: wrap IScsiCHAP source files to 80 charactersLaszlo Ersek2021-06-092-22/+71
| | | | | | | | | | | | | | | Working with overlong lines is difficult for me; rewrap the CHAP-related source files in IScsiDxe to 80 characters width. No functional changes. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210608121259.32451-2-lersek@redhat.com>
* NetworkPkg: Consume MdeLibs.dsc.inc for RegisterFilterLibDandan Bi2021-03-311-1/+3
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3246 MdeLibs.dsc.inc was added for some basic/default library instances provided by MdePkg and RegisterFilterLibNull Library was also added into it as the first version of MdeLibs.dsc.inc. So update platform dsc to consume MdeLibs.dsc.inc for RegisterFilterLibNull which will be consumed by IoLib and BaseLib. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Dandan Bi <dandan.bi@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com> Acked-by: Ard Biesheuvel <ardb@kernel.org>
* DxeHttpIoLib: Http boot failure with no initializes timeout value.GregX Yeh2021-01-203-1/+7
| | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=3170 Using PcdHttpIoTimeout to set default timeout value to HttpIoLib. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: GregX Yeh <gregx.yeh@intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/DxeHttpLib: Migrate HTTP header manipulation APIsAbner Chang2021-01-145-189/+191
| | | | | | | | | | | | | | | | Move HTTP header manipulation functions to DxeHttpLib from HttpBootSupport.c. These general functions are used by both Http BOOT and RedfishLib (patches will be sent later). Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Fan Wang <fan.wang@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Nickle Wang <nickle.wang@hpe.com> Cc: Peter O'Hanley <peter.ohanley@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/DnsDxe: cosmetic fixupswenyi,xie via groups.io2021-01-055-11/+11
| | | | | | | | | add whitespace according to coding style. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Wenyi Xie <xiewenyi2@huawei.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/HttpBootDxe: Utilize HttpIoLibAbner Chang2020-12-044-619/+6
| | | | | | | | | | | | | Remove HTTP IO realted funcitons from HttpBootDxe and use HttpIoLib instead. Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Nickle Wang <nickle.wang@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg: Add Http IO Helper Library to NetworkPkgAbner Chang2020-12-043-2/+14
| | | | | | | | | | | | This library provides HTTP IO helper functions. Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Nickle Wang <nickle.wang@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/Library: Implementation of Http IO Helper LibraryAbner Chang2020-12-044-0/+1238
| | | | | | | | | | | | | Add HTTP IO helper library which could be used by HTTP applications such as HTTP Boot, Redfish HTTP REST EX driver instance and etc. Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Nickle Wang <nickle.wang@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg: Add NETWORK_HTTP_ENABLE macroAbner Chang2020-12-034-4/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2917 Add NETWORK_HTTP_ENABLE macro and separate HttpDxe and HttpUtilitiesDxe drivers from HTTP_NETWORK_HTTP_BOOT_ENABLE macro. Current NETWORK_HTTP_BOOT_ENABLE macro is defined to enable HTTP boot feature in POST, this macro is not only enabling HTTP Boot related modules but also enabling other generic HTTP modules such as HttpDxe, HttpUtilitiesDxe and DnsDxe. These HTTP base drivers would not be only used by HTTP boot when we introduce the use case of Redfish implementation over HTTP to edk2. We should have a dedicate macro to enable generic HTTP functions on Network stack and additionally provide NETWORK_HTTP_BOOT_ENABLE for HTTP boot functionality for the use case that platform doesn't require HTTP boot. Signed-off-by: Abner Chang <abner.chang@hpe.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Nickle Wang <nickle.wang@hpe.com> Cc: Peter O'Hanley <peter.ohanley@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* NetworkPkg/Defines: Make iSCSI disable as defaultGao, Zhichao2020-11-172-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 iSCSI is using the deprecated function MD5. It is better to make the default setting secure. If the platforms want to use the iSCSI, they should enable it in the platforms' dsc file and be aware they are using an function with weak cryptography. Enable iSCSI in NetworkPkg.dsc for build. Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Xiaoyu Lu <xiaoyux.lu@intel.com> Cc: Guomin Jiang <guomin.jiang@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Kelly Steele <kelly.steele@intel.com> Cc: Zailiang Sun <zailiang.sun@intel.com> Cc: Yi Qian <yi.qian@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Message-Id: <20201112055558.2348-13-zhichao.gao@intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg: Enable MD5 while enable iSCSIGao, Zhichao2020-11-172-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3003 There is a plan to make MD5 disable as default. The new MACRO ENABLE_MD5_DEPRECATED_INTERFACES would be introduced to enable MD5. Make the definition ahead of the change to avoid build error after the MACRO changed. 1. Add the NetworkBuildOptions.dsc.inc to define the MACRO for build (support: GCC, INTEL, MSFT and RVCT) 2. Add the BuildOption file to Network.dsc.inc Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Zhichao Gao <zhichao.gao@intel.com> Message-Id: <20201112055558.2348-5-zhichao.gao@intel.com> [lersek@redhat.com: clean up comments in "NetworkBuildOptions.dsc.inc"] [lersek@redhat.com: hoist "BuildOptions" above "Components" in "Network.dsc.inc" for bug compat with edk2-platforms] Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* NetworkPkg: Fix possible infinite loop in HTTP msg body parserVladimir Olovyannikov via groups.io2020-10-091-3/+16
| | | | | | | | | | | | | | | | | When an HTTP server sends a non-chunked body data with no Content-Length header, the HttpParserMessageBody in DxeHttpLib gets confused and never sets the Char pointer beyond the body start. This causes "for" loop to never break because the condition of "Char >= Body + BodyLength" is never satisfied. Use BodyLength as the ContentLength for the parser when ContentLength is absent in HTTP response headers. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=2941 Signed-off-by: Vladimir Olovyannikov <vladimir.olovyannikov@broadcom.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/HttpDxe: TlsChildHandle is not cleared when resetAbner Chang2020-10-091-0/+1
| | | | | | | | | | | | | | | | | | | | | BZ #2909, https://bugzilla.tianocore.org/show_bug.cgi?id=2909 When Http->Configure() is invoked with HttpConfigData set to NULL to reset the EFI HTTP instance, TLS child instance is destroyed but HttpInstance->TlsChildHandle is not set to NULL. After reconfiguring HTTP through Http->Configure() and sending the HTTP request to HTTPS URL, TLS child instance is not recreated because HttpInstance->TlsChildHandle is not NULL. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Wu Jiaxin <jiaxin.wu@intel.com> Cc: Fu Siyuan <siyuan.fu@intel.com> Cc: Nickle Wang <nickle.wang@hpe.com> Signed-off-by: Abner Chang <abner.chang@hpe.com> Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg: Add RngLib entry to .dsc file.Maciej Rabeda2020-10-091-0/+1
| | | | | | | | | | | Recent change to OpensslLib (b5701a4c7a0fb185e0c5b9db9525939c78664bfd) causes NetworkPkg build to fail due to lack of RngLib entry in NetworkPkg's .dsc file. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* NetworkPkg/NetworkPkg.ci.yaml: Add configuration for Ecc checkShenglei Zhang2020-08-171-0/+12
| | | | | | | | | | | | Add configuration ExceptionList and IgnoreFiles for package config files. So users can rely on this to ignore some Ecc issues. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
* NetworkPkg/NetworkPkg.ci.yaml: Add configuration for LicenseCheckShenglei Zhang2020-07-311-0/+3
| | | | | | | | | | | | Add configuration IgnoreFiles for package config files. So users can rely on this to skip license conflict for some generated files. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/DxeNetLib: Change the order of conditions in IF statementZhang, Shenglei2020-05-201-1/+1
| | | | | | | | | | | | The condition, NET_HEADSPACE(&(Nbuf->BlockOp[Index])) < Len, is meaningless if Index = 0. So checking 'Index != 0' should be performed first in the if statement. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
* NetworkPkg: Add RISCV64 architectureAbner Chang2020-05-071-1/+2
| | | | | | | | | | | | | | | | | Add RISCV64 Arch in NetworkPkg. REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2672 Signed-off-by: Abner Chang <abner.chang@hpe.com> Co-authored-by: Gilbert Chen <gilbert.chen@hpe.com> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Acked-by: Siyuan Fu <siyuan.fu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Leif Lindholm <leif.lindholm@linaro.org> Cc: Gilbert Chen <gilbert.chen@hpe.com>
* NetworkPkg/IScsiDxe: Enhance the check for array boundaryShenglei Zhang2020-04-262-2/+2
| | | | | | | | | | | Array 'TargetUrl' of size 255 may use index value(s) 255 and 256. So enhance the boundary check to ensure the index is valid. Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* NetworkPkg/TlsAuthConfigDxe: Use HiiPopUp() instead of CreatePopUp()Keysound Chang2020-04-174-6/+18
| | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2635 According to EDK2 Driver Writer's Guide For UEFI 2.3.1, 4.2.18 Offer alternatives to function keys. Configuration of drivers should be accomplished via HII and via OS-present interfaces. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/Ip6Dxe: Validate source data record lengthMichael Kubacki2020-04-171-17/+30
| | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2273 Ip6ConfigReadConfigData() reads configuration data from a UEFI variable and copies the data to another buffer. This change checks that the length of the data record being copied does not exceed the size of the source UEFI variable data buffer. If the size is exceeded, this change follows existing logic to treat the variable as corrupted and deletes the variable so it will be set again. Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/SnpDxe: Prevent invalid PCI BAR accessMichael Kubacki2020-04-172-34/+47
| | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1563 SnpDxe initializes values for MemoryBarIndex and IoBarIndex to 0 and 1 respectively even if calls to PciIo->GetBarAttributes never return success. Later, if the BAR is used to perform IO/Mem reads/writes, a potentially non-existent BAR index may be accessed. This change initializes the values to an invalid BAR index (PCI_MAX_BAR) so the condition can be explicitly checked to avoid an invalid BAR access. Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* NetworkPkg/SnpDxe: Register SnpNotifyExitBootServices at TPL_CALLBACKMichael Kubacki2020-04-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1562 The current SnpDxe implementation registers its ExitBootServices event notification function (SnpNotifyExitBootServices ()) at TPL_NOTIFY. This function calls PxeShutdown() which issues an UNDI shutdown operation. Ultimately, this may invoke Shutdown() in EFI_SIMPLE_NETWORK_PROTOCOL. The UEFI specification 2.8A Table 27 "TPL Restrictions" restricts the TPL for Simple Network Protocol to <= TPL_CALLBACK. In addition, it has been observed in some 3rd party UNDI drivers to cause an issue further down the call stack if the TPL is higher than TPL_CALLBACK on invocation. Therefore, this commit changes the TPL of SnpNotifyExitBootServices() to TPL_CALLBACK. Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
* Revert "TlsAuthConfigDxe: fix TlsCaCertificate attributes retrieval"Michael Kubacki2020-04-071-26/+1
| | | | | | | | | | | | | | | | | | | This reverts commit 6896efdec2709e530b23c688cf0f31706709a0c5. REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2062 GetVariable() now returns attributes when it fails with EFI_BUFFER_TOO_SMALL. Therefore, commit 6896efdec270 is reverted since it is no longer relevant. Cc: Laszlo Ersek <lersek@redhat.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
* NetworkPkg/HttpBootDxe: Add RISC-V architecture for EDK2 CI.Abner Chang2020-04-031-0/+3
| | | | | | | | | | | | | | | | Add RISC-V architecture for EDK2 CI testing. BZ:2562: https://bugzilla.tianocore.org/show_bug.cgi?id=2562 Signed-off-by: Abner Chang <abner.chang@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Gilbert Chen <gilbert.chen@hpe.com> Cc: Daniel Schaefer <daniel.schaefer@hpe.com>
* NetworkPkg: Add RISC-V architecture for EDK2 CI.Abner Chang2020-04-031-2/+2
| | | | | | | | | | | | | | | | Add RISC-V architecture for EDK2 CI testing. BZ:2562: https://bugzilla.tianocore.org/show_bug.cgi?id=2562 Signed-off-by: Abner Chang <abner.chang@hpe.com> Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Cc: Leif Lindholm <leif@nuviainc.com> Cc: Gilbert Chen <gilbert.chen@hpe.com> Cc: Daniel Schaefer <daniel.schaefer@hpe.com>
* NetworkPkg/Ip6Dxe: Fix ASSERT logic in Ip6ProcessRouterAdvertise()Maciej Rabeda2020-04-021-3/+3
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2655 This patch fixes reversed logic of recently added ASSERTs which should ensure that Ip6IsNDOptionValid() implementation properly reacts to invalid packets. Cc: Jiaxin Wu <jiaxin.wu@intel.com> Cc: Siyuan Fu <siyuan.fu@intel.com> Signed-off-by: Maciej Rabeda <maciej.rabeda@linux.intel.com> Reviewed-by: Siyuan Fu <siyuan.fu@intel.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Fixes: 9c20342eed70ec99ec50cd73cb81804299f05403
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-20 12:03:23 +0000