<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> Hi Siva,<o:p></o:p> <o:p> </o:p> I agree we should continue the next certificates configuration even the current one is invalid (since we already have the sanity check before the setting).<o:p></o:p> <o:p> </o:p> Please report one Bugzilla for the issue. <o:p></o:p> <o:p> </o:p> Maciej, can you help fix on that?<o:p></o:p> <o:p> </o:p> Thanks,<o:p></o:p> Jiaxin<o:p></o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> <a name="_____replyseparator"></a>From: Sivaraman Nainar <sivaramann@amiindia.co.in> Sent: Friday, December 20, 2019 12:16 PM To: devel@edk2.groups.io; Wu, Jiaxin <jiaxin.wu@intel.com>; Fu, Siyuan <siyuan.fu@intel.com> Cc: Madhan B. Santharam <madhans@ami.com>; Arun Subramanian B <arunsubramanianb@ami.com>; Arun Sura Soundara Pandian <arunsuras@amiindia.co.in>; Bhuvaneshwari M R <bhuvaneshwarimr@amiindia.co.in> Subject: RE: reg: HTTPS Certificate Update<o:p></o:p> </div> </div> <o:p> </o:p> Hello Jiaxin / Siyuan:<o:p></o:p> <o:p> </o:p> Would you please feedback on this.<o:p></o:p> <o:p> </o:p> -Siva<o:p></o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in"> From: Sivaraman Nainar Sent: Monday, December 16, 2019 4:42 PM To: 'devel@edk2.groups.io'; 'Wu, Jiaxin'; 'Fu, Siyuan' Cc: Madhan B. Santharam; Arun Subramanian B; Arun Sura Soundara Pandian; Bhuvaneshwari M R Subject: reg: HTTPS Certificate Update<o:p></o:p> </div> </div> <o:p> </o:p> Hello All:<o:p></o:p> <o:p> </o:p> Need clarification on the Certificate Validation Procedure used in HTTP Boot.<o:p></o:p> <o:p> </o:p> The certificate parsing done at HttpDxe in file HttpsSupport.c in the function TlsConfigCertificate().<o:p></o:p> <o:p> </o:p> The below code snippet is TlsSetSessionData call for each certificate data.<o:p></o:p> <o:p> </o:p> while ((ItemDataSize > 0) && (ItemDataSize >= CertList->SignatureListSize)) {<o:p></o:p> Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);<o:p></o:p> CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;<o:p></o:p> for (Index = 0; Index < CertCount; Index++) {<o:p></o:p> //<o:p></o:p> // EfiTlsConfigDataTypeCACertificate<o:p></o:p> //<o:p></o:p> Status = HttpInstance->TlsConfiguration->SetData (<o:p></o:p> HttpInstance->TlsConfiguration,<o:p></o:p> EfiTlsConfigDataTypeCACertificate,<o:p></o:p> Cert->SignatureData,<o:p></o:p> CertList->SignatureSize - sizeof (Cert->SignatureOwner)<o:p></o:p> );<o:p></o:p> if (EFI_ERROR (Status)) {<o:p></o:p> goto FreeCACert;<o:p></o:p> }<o:p></o:p> Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);<o:p></o:p> }<o:p></o:p> ItemDataSize -= CertList->SignatureListSize;<o:p></o:p> CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);<o:p></o:p> }<o:p></o:p> <o:p> </o:p> In the attached code, once an invalid certificate of available certificates Set via TLS, if its failed the code does not post further certificates even those could be valid certificates.<o:p></o:p> <o:p> </o:p> Is the code is purposefully done? May we know the expected behavior of the code.<o:p></o:p> <o:p> </o:p> -Siva<o:p></o:p> </div> </div> </body> </html> <div width="1" style="color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links: You receive all messages sent to this group. <a target="_blank" href="https://edk2.groups.io/g/devel/message/52458">View/Reply Online (#52458)</a> | | <a target="_blank" href="https://groups.io/mt/68724546/1813853">Mute This Topic</a> | <a href="https://edk2.groups.io/g/devel/post">New Topic</a> <a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> | <a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> | <a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a> [edk2-devel-archive@redhat.com] <div width="1" style="color:white;clear:both">_._,_._,_</div>