Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use correct Openssl inf for SBSA #625

Merged
merged 4 commits into from
Jul 7, 2023

Conversation

kenlautner
Copy link
Contributor

@kenlautner kenlautner commented Jul 5, 2023

Description

Changed the openssl inf version used to be the full version to match expected functionality. Additionally disabled NETWORK_ISCSI_ENABLE as we weren't using it.

Extra crypto functionality include:

  1. Every SHA hash function. The default openssl version support SHA256 only.
  2. X509 full functionality (this is connected with item 3)
  3. ECC for TLS and other crypto features (item Enable markdownlint plugin #2)
  • Impacts functionality?
    • Functionality - Does the change ultimately impact how firmware functions?
    • Examples: Add a new library, publish a new PPI, update an algorithm, ...
  • Impacts security?
    • Security - Does the change have a direct security impact on an application,
      flow, or firmware?
    • Examples: Crypto algorithm change, buffer overflow fix, parameter
      validation improvement, ...
  • Breaking change?
    • Breaking change - Will anyone consuming this change experience a break
      in build or boot behavior?
    • Examples: Add a new library class, move a module to a different repo, call
      a function in a new library class in a pre-existing module, ...
  • Includes tests?
    • Tests - Does the change include any explicit test code?
    • Examples: Unit tests, integration tests, robot tests, ...
  • Includes documentation?
    • Documentation - Does the change contain explicit documentation additions
      outside direct code modifications (and comments)?
    • Examples: Update readme file, add feature readme file, link to documentation
      on an a separate Web page, ...

How This Was Tested

Passed BaseCryptLib Unit Tests.

Integration Instructions

N/A

@github-actions github-actions bot added the impact:security Has a security impact label Jul 5, 2023
@makubacki
Copy link
Member

@kenlautner, I know this might be obvious, but can you list the additional functionality brought in by the change to the PR description?

Copy link
Contributor

@TaylorBeebe TaylorBeebe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this change also supposed to resolve the BaseCryptLibUnitTest failure?

@kenlautner kenlautner closed this Jul 6, 2023
@kenlautner kenlautner reopened this Jul 6, 2023
@kenlautner
Copy link
Contributor Author

Is this change also supposed to resolve the BaseCryptLibUnitTest failure?

Yes it is. I see that it's still failing for Md5 Hashing which was removed from support. We should probably discuss if we want to allow the use of Md5 hashing again or update the test. It's legacy so we should probably add support in special cases such as this.

@kuqin12
Copy link
Contributor

kuqin12 commented Jul 6, 2023

Is this change also supposed to resolve the BaseCryptLibUnitTest failure?

Yes it is. I see that it's still failing for Md5 Hashing which was removed from support. We should probably discuss if we want to allow the use of Md5 hashing again or update the test. It's legacy so we should probably add support in special cases such as this.

So Q35 is not failing this test? Is it because Q35 disabled the deprecated test, or because it is also failing but still in grace period?

@kenlautner
Copy link
Contributor Author

kenlautner commented Jul 6, 2023

Is this change also supposed to resolve the BaseCryptLibUnitTest failure?

Yes it is. I see that it's still failing for Md5 Hashing which was removed from support. We should probably discuss if we want to allow the use of Md5 hashing again or update the test. It's legacy so we should probably add support in special cases such as this.

So Q35 is not failing this test? Is it because Q35 disabled the deprecated test, or because it is also failing but still in grace period?

Q35 doesn't use MD5 and it is disabled by default in MU. SBSA enables it by including NetworkBuildOptions.dsc.inc and setting NETWORK_ISCSI_ENABLE to TRUE.

@kenlautner kenlautner merged commit bf423a3 into main Jul 7, 2023
25 checks passed
@kenlautner kenlautner deleted the personal/klautner/use_correct_openssl_version branch July 7, 2023 19:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
impact:security Has a security impact
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants