NetworkPkg/TlsDxe: Add the support of host validation to TlsDxe driver (CVE-2019...

[mirror_edk2.git] / NetworkPkg / TlsDxe / TlsProtocol.c

diff --git a/NetworkPkg/TlsDxe/TlsProtocol.c b/NetworkPkg/TlsDxe/TlsProtocol.c
index a7a993fc6fc5fb002f6d34559e1407257a48eebd..001e5400d00faaab9c0434413bca79582f57e670 100644 (file)
--- a/NetworkPkg/TlsDxe/TlsProtocol.c
+++ b/NetworkPkg/TlsDxe/TlsProtocol.c
@@ -1,7 +1,7 @@
 /** @file\r
   Implementation of EFI TLS Protocol Interfaces.\r
 \r
-  Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
 \r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
@@ -56,12 +56,16 @@ TlsSetSessionData (
   UINT16                    *CipherId;\r
   CONST EFI_TLS_CIPHER      *TlsCipherList;\r
   UINTN                     CipherCount;\r
+  CONST EFI_TLS_VERIFY_HOST *TlsVerifyHost;\r
+  EFI_TLS_VERIFY            VerifyMethod;\r
+  UINTN                     VerifyMethodSize;\r
   UINTN                     Index;\r
 \r
   EFI_TPL                   OldTpl;\r
 \r
-  Status = EFI_SUCCESS;\r
-  CipherId = NULL;\r
+  Status           = EFI_SUCCESS;\r
+  CipherId         = NULL;\r
+  VerifyMethodSize = sizeof (EFI_TLS_VERIFY);\r
 \r
   if (This == NULL || Data == NULL || DataSize == 0) {\r
     return EFI_INVALID_PARAMETER;\r
@@ -148,6 +152,40 @@ TlsSetSessionData (
     }\r
 \r
     TlsSetVerify (Instance->TlsConn, *((UINT32 *) Data));\r
+    break;\r
+  case EfiTlsVerifyHost:\r
+    if (DataSize != sizeof (EFI_TLS_VERIFY_HOST)) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ON_EXIT;\r
+    }\r
+\r
+    TlsVerifyHost = (CONST EFI_TLS_VERIFY_HOST *) Data;\r
+\r
+    if ((TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_ALWAYS_CHECK_SUBJECT) != 0 &&\r
+        (TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_NEVER_CHECK_SUBJECT) != 0) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ON_EXIT;\r
+    }\r
+\r
+    if ((TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_NO_WILDCARDS) != 0 &&\r
+        ((TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_NO_PARTIAL_WILDCARDS) != 0 ||\r
+         (TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_MULTI_LABEL_WILDCARDS) != 0)) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ON_EXIT;\r
+    }\r
+\r
+    Status = This->GetSessionData (This, EfiTlsVerifyMethod, &VerifyMethod, &VerifyMethodSize);\r
+    if (EFI_ERROR (Status)) {\r
+      goto ON_EXIT;\r
+    }\r
+\r
+    if ((VerifyMethod & EFI_TLS_VERIFY_PEER) == 0) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ON_EXIT;\r
+    }\r
+\r
+    Status = TlsSetVerifyHost (Instance->TlsConn, TlsVerifyHost->Flags, TlsVerifyHost->HostName);\r
+\r
     break;\r
   case EfiTlsSessionID:\r
     if (DataSize != sizeof (EFI_TLS_SESSION_ID)) {\r