efi-boot-shim.git/httpboot.c, branch rolling

reject message with different values in multiple Content-Length header field

2025-02-26T14:38:43+00:00

If multiple headers occur, usually the last header would have authority; however the section 3.3.3 of RFC 7230 states that: If a message is received without Transfer-Encoding and with either multiple Content-Length header fields having differing field-values or ..., then the message framing is invalid and the recipient MUST treat it as an unrecoverable error. For example: If there are 2 headers, for example, "Content-Length: 42" and "Content-Length: 52", then current shim httpboot.c will accept the last one which is "Content-Length": 52". This is not correct. This patch allows multiple values if they are the same, but rejects message if any different value is found. In function receive_http_response() of httpboot.c, each received duplicate Content-Length field must be checked whether its value is different. If it is, then this message is invalid. Signed-off-by: Dennis Tseng

httpboot: Convert HTTP status codes to EFI status codes

2025-01-15T21:03:55+00:00

This allows the caller to make a more informed decision about how to handle the error. In particular, by mapping HTTP errors to EFI_INVALID_PARAMETER and EFI_NOT_FOUND, shim will try to fetch the default second stage image like it does when loading images from disk. Note that this also changes the default to return EFI_HTTP_ERROR instead of EFI_ABORTED. This should not change any behavior as EFI_ABORTED wasn't being handled before, but letting the caller decide what to do with an unknown HTTP error is more appropriate. Signed-off-by: Dan Nicholson

netboot read_image() should not hardcode DEFAULT_LOADER

2024-01-22T19:17:20+00:00

The netboot path up until now hardcodes DEFAULT_LOADER as the only possible filename to load. This is pretty limiting and needs to be fixed. Signed-off-by: Jan Setje-Eilers

CVE-2023-40547 - avoid incorrectly trusting HTTP headers

2023-12-05T18:20:00+00:00

When retrieving files via HTTP or related protocols, shim attempts to allocate a buffer to store the received data. Unfortunately, this means getting the size from an HTTP header, which can be manipulated to specify a size that's smaller than the received data. In this case, the code accidentally uses the header for the allocation but the protocol metadata to copy it from the rx buffer, resulting in an out-of-bounds write. This patch adds an additional check to test that the rx buffer is not larger than the allocation. Resolves: CVE-2023-40547 Reported-by: Bill Demirkapi, Microsoft Security Response Center Signed-off-by: Peter Jones

cleanup: always use BS and RT, not gBS and gRT

2021-09-07T21:05:04+00:00

This just makes one less thing we have to make sure is the same between the test harnesses and the runtime code. Signed-off-by: Peter Jones

Make CopyMem() work with EFI's declaration

2021-09-07T21:05:04+00:00

EFI_BOOT_SERVICES includes CopyMem() and SetMem() functions which are marked EFIAPI, and in the case of CopyMem() does not mark the source argument as CONST. This patch makes all our invocations work with that, so (once gnu-efi's implementation is fixed to match) we can use the existing implementation as the implementation in a mock EFI_BOOT_SERVICES. Signed-off-by: Peter Jones

httpboot: Ignore case when checking HTTP headers

2021-09-01T15:10:32+00:00

Some servers (HAProxy) yield Content-Length in lowercase, and shim would fail to find it. Signed-off-by: Robbie Harwood

Consolidate most of our standard lib functions to lib

2021-03-10T20:54:20+00:00

Signed-off-by: Peter Jones

Restructure our includes.

2021-03-10T20:54:20+00:00

This re-structures our includes so we can be sure everything is always including all the system headers in a uniform, predictable way. Temporarily it also adds a bunch of junk at all the places we use variadic functions to specifically pick either the MS (cdecl) or ELF ABIs. I'm not 100% sure that's all correct (see later patch) but it's enough to allow this to build. Signed-off-by: Peter Jones

Fix all the places we need UNUSED on arguments.

2021-02-25T15:15:14+00:00

Signed-off-by: Peter Jones