NetworkPkg/TlsDxe: Handle the multiple TLS record messages encryption/decryption.

Cc: Karunakar P <karunakarp@amiindia.co.in>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Karunakar p <karunakarp@amiindia.co.in>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>

diff --git a/NetworkPkg/TlsDxe/TlsImpl.c b/NetworkPkg/TlsDxe/TlsImpl.c
index 8e1238216b4d31096e40fc6766adc10551a781c5..a026075f362d1580f543cfaacec8d7ecdd4f2b7c 100644 (file)
--- a/NetworkPkg/TlsDxe/TlsImpl.c
+++ b/NetworkPkg/TlsDxe/TlsImpl.c
@@ -1,7 +1,7 @@
 /** @file\r
   The Miscellaneous Routines for TlsDxe driver.\r
 \r
-Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
 \r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
@@ -50,6 +50,7 @@ TlsEncryptPacket (
   UINT16              ThisMessageSize;\r
   UINT32              BufferOutSize;\r
   UINT8               *BufferOut;\r
+  UINT32              RecordCount;\r
   INTN                Ret;\r
 \r
   Status           = EFI_SUCCESS;\r
@@ -61,6 +62,7 @@ TlsEncryptPacket (
   TempRecordHeader = NULL;\r
   BufferOutSize    = 0;\r
   BufferOut        = NULL;\r
+  RecordCount      = 0;\r
   Ret              = 0;\r
 \r
   //\r
@@ -91,30 +93,42 @@ TlsEncryptPacket (
     BytesCopied += (*FragmentTable)[Index].FragmentLength;\r
   }\r
 \r
-  BufferOut = AllocateZeroPool (MAX_BUFFER_SIZE);\r
+  //\r
+  // Count TLS record number.\r
+  //\r
+  BufferInPtr = BufferIn;\r
+  while ((UINTN) BufferInPtr < (UINTN) BufferIn + BufferInSize) {\r
+    RecordHeaderIn = (TLS_RECORD_HEADER *) BufferInPtr;\r
+    if (RecordHeaderIn->ContentType != TlsContentTypeApplicationData || RecordHeaderIn->Length > TLS_PLAINTEXT_RECORD_MAX_PAYLOAD_LENGTH) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ERROR;\r
+    }\r
+    BufferInPtr += TLS_RECORD_HEADER_LENGTH + RecordHeaderIn->Length;\r
+    RecordCount ++;\r
+  }\r
+  \r
+  //\r
+  // Allocate enough buffer to hold TLS Ciphertext.\r
+  //\r
+  BufferOut = AllocateZeroPool (RecordCount * (TLS_RECORD_HEADER_LENGTH + TLS_CIPHERTEXT_RECORD_MAX_PAYLOAD_LENGTH));\r
   if (BufferOut == NULL) {\r
     Status = EFI_OUT_OF_RESOURCES;\r
     goto ERROR;\r
   }\r
 \r
   //\r
-  // Parsing buffer.\r
+  // Parsing buffer. Received packet may have multiple TLS record messages.\r
   //\r
   BufferInPtr = BufferIn;\r
   TempRecordHeader = (TLS_RECORD_HEADER *) BufferOut;\r
   while ((UINTN) BufferInPtr < (UINTN) BufferIn + BufferInSize) {\r
     RecordHeaderIn = (TLS_RECORD_HEADER *) BufferInPtr;\r
 \r
-    if (RecordHeaderIn->ContentType != TlsContentTypeApplicationData) {\r
-      Status = EFI_INVALID_PARAMETER;\r
-      goto ERROR;\r
-    }\r
-\r
     ThisPlainMessageSize = RecordHeaderIn->Length;\r
 \r
     TlsWrite (TlsInstance->TlsConn, (UINT8 *) (RecordHeaderIn + 1), ThisPlainMessageSize);\r
 \r
-    Ret = TlsCtrlTrafficOut (TlsInstance->TlsConn, (UINT8 *)(TempRecordHeader), MAX_BUFFER_SIZE - BufferOutSize);\r
+    Ret = TlsCtrlTrafficOut (TlsInstance->TlsConn, (UINT8 *)(TempRecordHeader), TLS_RECORD_HEADER_LENGTH + TLS_CIPHERTEXT_RECORD_MAX_PAYLOAD_LENGTH);\r
 \r
     if (Ret > 0) {\r
       ThisMessageSize = (UINT16) Ret;\r
@@ -129,7 +143,7 @@ TlsEncryptPacket (
 \r
     BufferOutSize += ThisMessageSize;\r
 \r
-    BufferInPtr += RECORD_HEADER_LEN + ThisPlainMessageSize;\r
+    BufferInPtr += TLS_RECORD_HEADER_LENGTH + ThisPlainMessageSize;\r
     TempRecordHeader += ThisMessageSize;\r
   }\r
 \r
@@ -201,6 +215,7 @@ TlsDecryptPacket (
   UINT16              ThisPlainMessageSize;\r
   UINT8               *BufferOut;\r
   UINT32              BufferOutSize;\r
+  UINT32              RecordCount;\r
   INTN                Ret;\r
 \r
   Status           = EFI_SUCCESS;\r
@@ -212,6 +227,7 @@ TlsDecryptPacket (
   TempRecordHeader = NULL;\r
   BufferOut        = NULL;\r
   BufferOutSize    = 0;\r
+  RecordCount      = 0;\r
   Ret              = 0;\r
 \r
   //\r
@@ -242,7 +258,24 @@ TlsDecryptPacket (
     BytesCopied += (*FragmentTable)[Index].FragmentLength;\r
   }\r
 \r
-  BufferOut = AllocateZeroPool (MAX_BUFFER_SIZE);\r
+  //\r
+  // Count TLS record number.\r
+  //\r
+  BufferInPtr = BufferIn;\r
+  while ((UINTN) BufferInPtr < (UINTN) BufferIn + BufferInSize) {\r
+    RecordHeaderIn = (TLS_RECORD_HEADER *) BufferInPtr;\r
+    if (RecordHeaderIn->ContentType != TlsContentTypeApplicationData || NTOHS (RecordHeaderIn->Length) > TLS_CIPHERTEXT_RECORD_MAX_PAYLOAD_LENGTH) {\r
+      Status = EFI_INVALID_PARAMETER;\r
+      goto ERROR;\r
+    }\r
+    BufferInPtr += TLS_RECORD_HEADER_LENGTH + NTOHS (RecordHeaderIn->Length);\r
+    RecordCount ++;\r
+  }\r
+\r
+  //\r
+  // Allocate enough buffer to hold TLS Plaintext.\r
+  //\r
+  BufferOut = AllocateZeroPool (RecordCount * (TLS_RECORD_HEADER_LENGTH + TLS_PLAINTEXT_RECORD_MAX_PAYLOAD_LENGTH));\r
   if (BufferOut == NULL) {\r
     Status = EFI_OUT_OF_RESOURCES;\r
     goto ERROR;\r
@@ -256,22 +289,17 @@ TlsDecryptPacket (
   while ((UINTN) BufferInPtr < (UINTN) BufferIn + BufferInSize) {\r
     RecordHeaderIn = (TLS_RECORD_HEADER *) BufferInPtr;\r
 \r
-    if (RecordHeaderIn->ContentType != TlsContentTypeApplicationData) {\r
-      Status = EFI_INVALID_PARAMETER;\r
-      goto ERROR;\r
-    }\r
-\r
     ThisCipherMessageSize = NTOHS (RecordHeaderIn->Length);\r
 \r
-    Ret = TlsCtrlTrafficIn (TlsInstance->TlsConn, (UINT8 *) (RecordHeaderIn), RECORD_HEADER_LEN + ThisCipherMessageSize);\r
-    if (Ret != RECORD_HEADER_LEN + ThisCipherMessageSize) {\r
+    Ret = TlsCtrlTrafficIn (TlsInstance->TlsConn, (UINT8 *) (RecordHeaderIn), TLS_RECORD_HEADER_LENGTH + ThisCipherMessageSize);\r
+    if (Ret != TLS_RECORD_HEADER_LENGTH + ThisCipherMessageSize) {\r
       TlsInstance->TlsSessionState = EfiTlsSessionError;\r
       Status = EFI_ABORTED;\r
       goto ERROR;\r
     }\r
 \r
     Ret = 0;\r
-    Ret = TlsRead (TlsInstance->TlsConn, (UINT8 *) (TempRecordHeader + 1), MAX_BUFFER_SIZE - BufferOutSize);\r
+    Ret = TlsRead (TlsInstance->TlsConn, (UINT8 *) (TempRecordHeader + 1), TLS_PLAINTEXT_RECORD_MAX_PAYLOAD_LENGTH);\r
 \r
     if (Ret > 0) {\r
       ThisPlainMessageSize = (UINT16) Ret;\r
@@ -284,12 +312,12 @@ TlsDecryptPacket (
       ThisPlainMessageSize = 0;\r
     }\r
 \r
-    CopyMem (TempRecordHeader, RecordHeaderIn, RECORD_HEADER_LEN);\r
+    CopyMem (TempRecordHeader, RecordHeaderIn, TLS_RECORD_HEADER_LENGTH);\r
     TempRecordHeader->Length = ThisPlainMessageSize;\r
-    BufferOutSize += RECORD_HEADER_LEN + ThisPlainMessageSize;\r
+    BufferOutSize += TLS_RECORD_HEADER_LENGTH + ThisPlainMessageSize;\r
 \r
-    BufferInPtr += RECORD_HEADER_LEN + ThisCipherMessageSize;\r
-    TempRecordHeader += RECORD_HEADER_LEN + ThisPlainMessageSize;\r
+    BufferInPtr += TLS_RECORD_HEADER_LENGTH + ThisCipherMessageSize;\r
+    TempRecordHeader += TLS_RECORD_HEADER_LENGTH + ThisPlainMessageSize;\r
   }\r
 \r
   FreePool (BufferIn);\r

diff --git a/NetworkPkg/TlsDxe/TlsImpl.h b/NetworkPkg/TlsDxe/TlsImpl.h
index 3ae9d0d546ebf0abdaf2f980f5231a74ffc0df14..e04b312c199079a30cd9f166f3859bcc950f022f 100644 (file)
--- a/NetworkPkg/TlsDxe/TlsImpl.h
+++ b/NetworkPkg/TlsDxe/TlsImpl.h
@@ -1,7 +1,7 @@
 /** @file\r
   Header file of Miscellaneous Routines for TlsDxe driver.\r
 \r
-Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
 \r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
@@ -46,10 +46,6 @@ extern EFI_SERVICE_BINDING_PROTOCOL    mTlsServiceBinding;
 extern EFI_TLS_PROTOCOL                mTlsProtocol;\r
 extern EFI_TLS_CONFIGURATION_PROTOCOL  mTlsConfigurationProtocol;\r
 \r
-#define RECORD_HEADER_LEN 5 /// ContentType(1) + Version(2) + Length(2)\r
-\r
-#define MAX_BUFFER_SIZE   32768\r
-\r
 /**\r
   Encrypt the message listed in fragment.\r
 \r