[FFe] Include HTTP support in pre-built GRUB module

Needs to be New for the release team to approve (process is to set to Triaged)

I have reviewed the HTTP code in grub, it looks sane .. no obvious issues that would break Secure Boot validation.

Thank you for the FFe! It's really late for a feature freeze exception though, especially that we're now in Final Freeze. This means we shouldn't risk with anything 'risky' that isn't directly a release blocker for cosmic - which doesn't seem to be the case here. So for now, both me and Laney think that this should go rather as an SRU instead.

I've had another look; it still looks sane to me; but given that it's network code we're importing in the bootloader, it feels like a potential source of vulnerabilities and would be better to have it checked by the Security team.

I've assigned it to ~ubuntu-security...

Please have a look at grub-code/net/http.c; which seems to be the only real source file involved (from grub2 source) into providing the module.

http.c generally looks okay - errors are usually checked and handled, care is taken to ensure buffers are not overrun etc, sizes are handled well etc. From what I can see it appears to also appropriately check input to ensure it doesn't blindly trust it as well.

Also the upstream history of this file looks pretty stable too http://git.savannah.gnu.org/gitweb/?p=grub.git;a=history;f=grub-core/net/http.c

So nothing in particular stands out as a red-flag security wise that I can see.

This bug was fixed in the package grub2 - 2.02+dfsg1-12ubuntu2

---------------
grub2 (2.02+dfsg1-12ubuntu2) disco; urgency=medium

  * debian/patches/efi-console-set-text-mode-as-needed.patch: in EFI console,
    only set text-mode when we're actually going to need it.
  * debian/build-efi-images: add http module to NET_MODULES. (LP: #1787630)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 11 Mar 2019 17:48:49 -0400

Hello Lee, or anyone else affected,

Accepted grub2 into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02+dfsg1-5ubuntu8.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Lee, or anyone else affected,

Accepted grub2-signed into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.110.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Lee, or anyone else affected,

Accepted grub2 into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02-2ubuntu8.13 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Lee, or anyone else affected,

Accepted grub2-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.93.14 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

I have verified that the proposed package in bionic works as expected. I performed the following steps with MAAS.

0) Provide kernel and initrd on an HTTP server on the network.
1) Boot from the network in UEFI mode using grub's grubnet<arch>.efi binary.
2) Provided the following config:

linuxefi http://<ip of http server>/<path to kernel> <kernel command-line parameters>
initrdefi http://<ip of http server>/<path to initrd>
boot

Grub successfully loaded the kernel and initrd from the HTTP server and booted the kernel with attached initrd.

I have verified that the proposed package in cosmic works as expected. I performed the following steps with MAAS.

0) Provide kernel and initrd on an HTTP server on the network.
1) Boot from the network in UEFI mode using grub's grubnet<arch>.efi binary.
2) Provided the following config:

linuxefi http://<ip of http server>/<path to kernel> <kernel command-line parameters>
initrdefi http://<ip of http server>/<path to initrd>
boot

Grub successfully loaded the kernel and initrd from the HTTP server and booted the kernel with attached initrd.

Thanks Blake!

The verification of the Stable Release Update for grub2 has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package grub2 - 2.02+dfsg1-5ubuntu8.3

---------------
grub2 (2.02+dfsg1-5ubuntu8.3) cosmic; urgency=medium

   * debian/build-efi-images: add HTTP to generated UEFI images. (LP: #1787630)
   * debian/config.in, debian/grub-common.dirs, debian/postinst.in,
     debian/postrm.in: cherry-pick Colin's changes to ucf handling from
     2.02+dfsg1-11 to avoid unnecessarily prompting about grub.cfg changes.
     (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 12:01:26 -0400

This bug was fixed in the package grub2 - 2.02-2ubuntu8.13

---------------
grub2 (2.02-2ubuntu8.13) bionic; urgency=medium

   * debian/build-efi-images: add HTTP to generated UEFI images. (LP: #1787630)
   * debian/config.in, debian/grub-common.dirs, debian/postinst.in,
     debian/postrm.in: cherry-pick Colin's changes to ucf handling from
     2.02+dfsg1-11 to avoid unnecessarily prompting about grub.cfg changes.
     (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 12:11:57 -0400

This bug was fixed in the package grub2-signed - 1.93.14

---------------
grub2-signed (1.93.14) bionic; urgency=medium

  * Rebuild against grub2 2.02-2ubuntu8.13. (LP: #1787630) (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 14:24:36 -0400