Tianocore/edk2.git/CryptoPkg/Library/TlsLib, branch dependabot/github_actions/github/codeql-action-4

CryptoPkg: Fix coverity warnings in CryptoPkg.

2025-10-27T03:14:56+00:00

Fix the coverity warnings reported in the CryptoPkg. Signed-off-by: Kanagavel S

CryptoPkg: Drop ARM32 Support

2025-09-25T22:04:10+00:00

edk2 is dropping support for the ARM32 architecture. This commit removes ARM32 code from CryptoPkg. This also drops irrelevant VALID_ARCHITECTURES comments from infs that are not arch specific. Signed-off-by: Oliver Smith-Denny

CryptoPkg: Add support to set TLS security level.

2025-09-23T03:08:14+00:00

Add Edkiicrypto protocol API to set TLS set security level. Signed-off-by: Kanagavel S

CryptoPkg: Add SNI support

2025-09-04T08:32:34+00:00

Add Server Name Indication support. Signed-off-by: Kanagavel S

CryptoPkg: Enable the time check flag.

2025-07-05T14:23:01+00:00

REF:https://github.com/tianocore/edk2/issues/11245 Enable the time check flag to verify the current time during the TLS certificate validation. Signed-off-by: Kanagavel S

CryptoPkg: Extend TLS handshake debug output

2024-06-25T23:18:36+00:00

The error codes during TLS handshake errors are sometimes not enough to understand the root cause of the problem. Extending the debug output by the function and optional data helps in some cases. Signed-off-by: Sebastian Witt

CryptoPkg: Add SNI extension to TLS ClientHello

2024-06-25T21:46:50+00:00

Webservers hosting multiple websites require the TLS SNI (Server Name Indication) in the ClientHello to know which certificate to return. The current TLS code does not include the server name in the ClientHello handshake, which leads to failed HTTPS boots when the server does not return the correct certificate. This sets the host name for SNI in TlsSetVerifyHost which receives the host name also for verification against the certificates. Signed-off-by: Sebastian Witt

CryptoPkg/TlsLib: fix tls cipher configuration

2023-10-08T10:46:45+00:00

Trying to configure the TLS ciphers can lead to TLS handshake failures because TlsCipherMappingTable is not in line with the ciphers actually supported by OpensslLib. Fix that by removing TlsCipherMappingTable altogether. Use SSL_get_ciphers() instead to get the stack of ciphers supported by openssl. Name and ID of the ciphers can be queried using the SSL_CIPHER_get_name() and SSL_CIPHER_get_protocol_id() functions, which allows us to map IDs to names without a hard-code table. Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=2541 Signed-off-by: Gerd Hoffmann Message-Id: <20231004092003.3809321-1-kraxel@redhat.com> Reviewed-by: Laszlo Ersek Reviewed-by: Yi Li

CryptoPkg/TlsLib: use unsigned long for ErrorCode

2023-08-09T07:10:31+00:00

Signed-off-by: Gerd Hoffmann Cc: Jiewen Yao Cc: Xiaoyu Lu Cc: Guomin Jiang Reviewed-by: Jiewen Yao Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel Tested-by: Brian J. Johnson Tested-by: Kenneth Lautner

CryptoPkg/TlsLib: ERR_GET_FUNC is gone

2023-08-09T07:10:31+00:00