2 The main process for IpSecConfig application.
4 Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include <Library/UefiRuntimeServicesTableLib.h>
17 #include <Library/HiiLib.h>
19 #include <Protocol/IpSec.h>
21 #include "IpSecConfig.h"
24 #include "PolicyEntryOperation.h"
29 // Used for ShellCommandLineParseEx only
30 // and to ensure user inputs are in valid format
32 SHELL_PARAM_ITEM mIpSecConfigParamList
[] = {
40 { L
"-enable", TypeFlag
},
41 { L
"-disable", TypeFlag
},
42 { L
"-status", TypeFlag
},
48 { L
"--local", TypeValue
},
49 { L
"--remote", TypeValue
},
50 { L
"--proto", TypeValue
},
51 { L
"--local-port", TypeValue
},
52 { L
"--remote-port", TypeValue
},
53 { L
"--icmp-type", TypeValue
},
54 { L
"--icmp-code", TypeValue
},
59 { L
"--name", TypeValue
},
60 { L
"--packet-flag", TypeValue
},
61 { L
"--action", TypeValue
},
62 { L
"--lifebyte", TypeValue
},
63 { L
"--lifetime-soft", TypeValue
},
64 { L
"--lifetime", TypeValue
},
65 { L
"--mode", TypeValue
},
66 { L
"--tunnel-local", TypeValue
},
67 { L
"--tunnel-remote", TypeValue
},
68 { L
"--dont-fragment", TypeValue
},
69 { L
"--ipsec-proto", TypeValue
},
70 { L
"--auth-algo", TypeValue
},
71 { L
"--encrypt-algo", TypeValue
},
73 { L
"--ext-sequence", TypeFlag
},
74 { L
"--sequence-overflow", TypeFlag
},
75 { L
"--fragment-check", TypeFlag
},
76 { L
"--ext-sequence-", TypeFlag
},
77 { L
"--sequence-overflow-", TypeFlag
},
78 { L
"--fragment-check-", TypeFlag
},
84 { L
"--spi", TypeValue
},
85 { L
"--tunnel-dest", TypeValue
},
86 { L
"--tunnel-source", TypeValue
},
87 { L
"--lookup-spi", TypeValue
},
88 { L
"--lookup-ipsec-proto", TypeValue
},
89 { L
"--lookup-dest", TypeValue
},
97 { L
"--sequence-number", TypeValue
},
98 { L
"--antireplay-window", TypeValue
},
99 { L
"--auth-key", TypeValue
},
100 { L
"--encrypt-key", TypeValue
},
101 { L
"--path-mtu", TypeValue
},
106 { L
"--peer-id", TypeValue
},
107 { L
"--peer-address", TypeValue
},
108 { L
"--auth-proto", TypeValue
},
109 { L
"--auth-method", TypeValue
},
110 { L
"--ike-id", TypeValue
},
111 { L
"--ike-id-", TypeValue
},
112 { L
"--auth-data", TypeValue
},
113 { L
"--revocation-data", TypeValue
},
114 { L
"--lookup-peer-id", TypeValue
},
115 { L
"--lookup-peer-address", TypeValue
},
123 STR2INT mMapPolicy
[] = {
124 { L
"SPD", IPsecConfigDataTypeSpd
},
125 { L
"SAD", IPsecConfigDataTypeSad
},
126 { L
"PAD", IPsecConfigDataTypePad
},
133 STR2INT mMapIpProtocol
[] = {
134 { L
"TCP", EFI_IP4_PROTO_TCP
},
135 { L
"UDP", EFI_IP4_PROTO_UDP
},
136 { L
"ICMP", EFI_IP4_PROTO_ICMP
},
143 STR2INT mMapIpSecAction
[] = {
144 { L
"Bypass", EfiIPsecActionBypass
},
145 { L
"Discard", EfiIPsecActionDiscard
},
146 { L
"Protect", EfiIPsecActionProtect
},
153 STR2INT mMapIpSecMode
[] = {
154 { L
"Transport", EfiIPsecTransport
},
155 { L
"Tunnel", EfiIPsecTunnel
},
162 STR2INT mMapDfOption
[] = {
163 { L
"clear", EfiIPsecTunnelClearDf
},
164 { L
"set", EfiIPsecTunnelSetDf
},
165 { L
"copy", EfiIPsecTunnelCopyDf
},
172 STR2INT mMapIpSecProtocol
[] = {
173 { L
"AH", EfiIPsecAH
},
174 { L
"ESP", EfiIPsecESP
},
181 STR2INT mMapAuthAlgo
[] = {
182 { L
"NONE", IPSEC_AALG_NONE
},
183 { L
"MD5HMAC", IPSEC_AALG_MD5HMAC
},
184 { L
"SHA1HMAC", IPSEC_AALG_SHA1HMAC
},
185 { L
"SHA2-256HMAC", IPSEC_AALG_SHA2_256HMAC
},
186 { L
"SHA2-384HMAC", IPSEC_AALG_SHA2_384HMAC
},
187 { L
"SHA2-512HMAC", IPSEC_AALG_SHA2_512HMAC
},
188 { L
"AES-XCBC-MAC", IPSEC_AALG_AES_XCBC_MAC
},
189 { L
"NULL", IPSEC_AALG_NULL
},
196 STR2INT mMapEncAlgo
[] = {
197 { L
"NONE", IPSEC_EALG_NONE
},
198 { L
"DESCBC", IPSEC_EALG_DESCBC
},
199 { L
"3DESCBC", IPSEC_EALG_3DESCBC
},
200 { L
"CASTCBC", IPSEC_EALG_CASTCBC
},
201 { L
"BLOWFISHCBC", IPSEC_EALG_BLOWFISHCBC
},
202 { L
"NULL", IPSEC_EALG_NULL
},
203 { L
"AESCBC", IPSEC_EALG_AESCBC
},
204 { L
"AESCTR", IPSEC_EALG_AESCTR
},
205 { L
"AES-CCM-ICV8", IPSEC_EALG_AES_CCM_ICV8
},
206 { L
"AES-CCM-ICV12",IPSEC_EALG_AES_CCM_ICV12
},
207 { L
"AES-CCM-ICV16",IPSEC_EALG_AES_CCM_ICV16
},
208 { L
"AES-GCM-ICV8", IPSEC_EALG_AES_GCM_ICV8
},
209 { L
"AES-GCM-ICV12",IPSEC_EALG_AES_GCM_ICV12
},
210 { L
"AES-GCM-ICV16",IPSEC_EALG_AES_GCM_ICV16
},
217 STR2INT mMapAuthProto
[] = {
218 { L
"IKEv1", EfiIPsecAuthProtocolIKEv1
},
219 { L
"IKEv2", EfiIPsecAuthProtocolIKEv2
},
226 STR2INT mMapAuthMethod
[] = {
227 { L
"PreSharedSecret", EfiIPsecAuthMethodPreSharedSecret
},
228 { L
"Certificates", EfiIPsecAuthMethodCertificates
},
232 EFI_IPSEC2_PROTOCOL
*mIpSec
;
233 EFI_IPSEC_CONFIG_PROTOCOL
*mIpSecConfig
;
234 EFI_HII_HANDLE mHiiHandle
;
235 EFI_GUID mEfiIpSecConfigGuid
= EFI_IPSEC_CONFIG_GUID
;
236 CHAR16 mAppName
[] = L
"IpSecConfig";
239 // Used for IpSecConfigRetriveCheckListByName only to check the validation of user input
241 VAR_CHECK_ITEM mIpSecConfigVarCheckList
[] = {
242 { L
"-enable", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
243 { L
"-disable", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
244 { L
"-status", BIT(1)|BIT(0), BIT(1), BIT(2)|BIT(1)|BIT(0), 0 },
245 { L
"-p", BIT(1), 0, BIT(2)|BIT(1)|BIT(0), 0 },
247 { L
"-a", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
248 { L
"-i", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
249 { L
"-d", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
250 { L
"-e", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
251 { L
"-l", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
252 { L
"-f", BIT(0), 0, BIT(2)|BIT(1)|BIT(0), 0 },
254 { L
"-?", BIT(0), BIT(0), BIT(2)|BIT(1)|BIT(0), 0 },
259 { L
"--local", 0, 0, BIT(2)|BIT(1), 0 },
260 { L
"--remote", 0, 0, BIT(2)|BIT(1), 0 },
261 { L
"--proto", 0, 0, BIT(2)|BIT(1), 0 },
262 { L
"--local-port", 0, 0, BIT(2)|BIT(1), BIT(0) },
263 { L
"--remote-port", 0, 0, BIT(2)|BIT(1), BIT(0) },
264 { L
"--icmp-type", 0, 0, BIT(2)|BIT(1), BIT(1) },
265 { L
"--icmp-code", 0, 0, BIT(2)|BIT(1), BIT(1) },
270 { L
"--name", 0, 0, BIT(2), 0 },
271 { L
"--packet-flag", 0, 0, BIT(2), 0 },
272 { L
"--action", 0, 0, BIT(2)|BIT(1), 0 },
273 { L
"--lifebyte", 0, 0, BIT(2)|BIT(1), 0 },
274 { L
"--lifetime-soft", 0, 0, BIT(2)|BIT(1), 0 },
275 { L
"--lifetime", 0, 0, BIT(2)|BIT(1), 0 },
276 { L
"--mode", 0, 0, BIT(2)|BIT(1), 0 },
277 { L
"--tunnel-local", 0, 0, BIT(2), 0 },
278 { L
"--tunnel-remote", 0, 0, BIT(2), 0 },
279 { L
"--dont-fragment", 0, 0, BIT(2), 0 },
280 { L
"--ipsec-proto", 0, 0, BIT(2)|BIT(1), 0 },
281 { L
"--auth-algo", 0, 0, BIT(2)|BIT(1), 0 },
282 { L
"--encrypt-algo", 0, 0, BIT(2)|BIT(1), 0 },
284 { L
"--ext-sequence", 0, 0, BIT(2), BIT(2) },
285 { L
"--sequence-overflow", 0, 0, BIT(2), BIT(2) },
286 { L
"--fragment-check", 0, 0, BIT(2), BIT(2) },
287 { L
"--ext-sequence-", 0, 0, BIT(2), BIT(3) },
288 { L
"--sequence-overflow-", 0, 0, BIT(2), BIT(3) },
289 { L
"--fragment-check-", 0, 0, BIT(2), BIT(3) },
295 { L
"--spi", 0, 0, BIT(1), 0 },
296 { L
"--tunnel-dest", 0, 0, BIT(1), 0 },
297 { L
"--tunnel-source", 0, 0, BIT(1), 0 },
298 { L
"--lookup-spi", 0, 0, BIT(1), 0 },
299 { L
"--lookup-ipsec-proto", 0, 0, BIT(1), 0 },
300 { L
"--lookup-dest", 0, 0, BIT(1), 0 },
308 { L
"--sequence-number", 0, 0, BIT(1), 0 },
309 { L
"--antireplay-window", 0, 0, BIT(1), 0 },
310 { L
"--auth-key", 0, 0, BIT(1), 0 },
311 { L
"--encrypt-key", 0, 0, BIT(1), 0 },
312 { L
"--path-mtu", 0, 0, BIT(1), 0 },
315 // The example to add a PAD:
316 // "-A --peer-id Mike [--peer-address 10.23.2.2] --auth-proto IKE1/IKE2
317 // --auth-method PreSharedSeceret/Certificate --ike-id
318 // --auth-data 343343 --revocation-data 2342432"
319 // The example to delete a PAD:
320 // "-D * --lookup-peer-id Mike [--lookup-peer-address 10.23.2.2]"
322 // The example to edit a PAD:
323 // "-E * --lookup-peer-id Mike --auth-method Certificate"
328 { L
"--peer-id", 0, 0, BIT(0), BIT(4) },
329 { L
"--peer-address", 0, 0, BIT(0), BIT(5) },
330 { L
"--auth-proto", 0, 0, BIT(0), 0 },
331 { L
"--auth-method", 0, 0, BIT(0), 0 },
332 { L
"--IKE-ID", 0, 0, BIT(0), BIT(6) },
333 { L
"--IKE-ID-", 0, 0, BIT(0), BIT(7) },
334 { L
"--auth-data", 0, 0, BIT(0), 0 },
335 { L
"--revocation-data", 0, 0, BIT(0), 0 },
336 { L
"--lookup-peer-id", 0, 0, BIT(0), BIT(4) },
337 { L
"--lookup-peer-address",0, 0, BIT(0), BIT(5) },
339 { NULL
, 0, 0, 0, 0 },
343 The function to allocate the proper sized buffer for various
346 @param[in, out] Status Current status.
347 @param[in, out] Buffer Current allocated buffer, or NULL.
348 @param[in] BufferSize Current buffer size needed
350 @retval TRUE If the buffer was reallocated and the caller should try the API again.
351 @retval FALSE If the buffer was not reallocated successfully.
355 IN OUT EFI_STATUS
*Status
,
356 IN OUT VOID
**Buffer
,
362 ASSERT (Status
!= NULL
);
363 ASSERT (Buffer
!= NULL
);
366 // If this is an initial request, buffer will be null with a new buffer size.
368 if ((NULL
== *Buffer
) && (BufferSize
!= 0)) {
369 *Status
= EFI_BUFFER_TOO_SMALL
;
373 // If the status code is "buffer too small", resize the buffer.
376 if (*Status
== EFI_BUFFER_TOO_SMALL
) {
378 if (*Buffer
!= NULL
) {
382 *Buffer
= AllocateZeroPool (BufferSize
);
384 if (*Buffer
!= NULL
) {
387 *Status
= EFI_OUT_OF_RESOURCES
;
392 // If there's an error, free the buffer.
394 if (!TryAgain
&& EFI_ERROR (*Status
) && (*Buffer
!= NULL
)) {
403 Function returns an array of handles that support the requested protocol
404 in a buffer allocated from a pool.
406 @param[in] SearchType Specifies which handle(s) are to be returned.
407 @param[in] Protocol Provides the protocol to search by.
408 This parameter is only valid for SearchType ByProtocol.
410 @param[in] SearchKey Supplies the search key depending on the SearchType.
411 @param[in, out] NoHandles The number of handles returned in Buffer.
412 @param[out] Buffer A pointer to the buffer to return the requested array of
413 handles that support Protocol.
415 @retval EFI_SUCCESS The resulting array of handles was returned.
416 @retval Others Other mistake case.
420 IN EFI_LOCATE_SEARCH_TYPE SearchType
,
421 IN EFI_GUID
*Protocol OPTIONAL
,
422 IN VOID
*SearchKey OPTIONAL
,
423 IN OUT UINTN
*NoHandles
,
424 OUT EFI_HANDLE
**Buffer
430 ASSERT (NoHandles
!= NULL
);
431 ASSERT (Buffer
!= NULL
);
434 // Initialize for GrowBuffer loop.
436 Status
= EFI_SUCCESS
;
438 BufferSize
= 50 * sizeof (EFI_HANDLE
);
441 // Call the real function.
443 while (GrowBuffer (&Status
, (VOID
**) Buffer
, BufferSize
)) {
444 Status
= gBS
->LocateHandle (
453 *NoHandles
= BufferSize
/ sizeof (EFI_HANDLE
);
454 if (EFI_ERROR (Status
)) {
462 Find the first instance of this protocol in the system and return its interface.
464 @param[in] ProtocolGuid The guid of the protocol.
465 @param[out] Interface The pointer to the first instance of the protocol.
467 @retval EFI_SUCCESS A protocol instance matching ProtocolGuid was found.
468 @retval Others A protocol instance matching ProtocolGuid was not found.
472 IN EFI_GUID
*ProtocolGuid
,
486 Status
= LocateHandle (ByProtocol
, ProtocolGuid
, NULL
, &NumberHandles
, &Handles
);
487 if (EFI_ERROR (Status
)) {
488 DEBUG ((EFI_D_INFO
, "LibLocateProtocol: Handle not found\n"));
492 for (Index
= 0; Index
< NumberHandles
; Index
++) {
493 ASSERT (Handles
!= NULL
);
494 Status
= gBS
->HandleProtocol (
500 if (!EFI_ERROR (Status
)) {
505 if (Handles
!= NULL
) {
513 Helper function called to check the conflicted flags.
515 @param[in] CheckList The pointer to the VAR_CHECK_ITEM table.
516 @param[in] ParamPackage The pointer to the ParamPackage list.
518 @retval EFI_SUCCESS No conflicted flags.
519 @retval EFI_INVALID_PARAMETER The input parameter is erroroneous or there are some conflicted flags.
522 IpSecConfigRetriveCheckListByName (
523 IN VAR_CHECK_ITEM
*CheckList
,
524 IN LIST_ENTRY
*ParamPackage
529 VAR_CHECK_ITEM
*Item
;
541 Item
= mIpSecConfigVarCheckList
;
543 if ((ParamPackage
== NULL
) || (CheckList
== NULL
)) {
544 return EFI_INVALID_PARAMETER
;
548 // Enumerate through the list of parameters that are input by user.
550 for (Node
= GetFirstNode (ParamPackage
); !IsNull (ParamPackage
, Node
); Node
= GetNextNode (ParamPackage
, Node
)) {
551 if (((SHELL_PARAM_PACKAGE
*) Node
)->Name
!= NULL
) {
553 // Enumerate the check list that defines the conflicted attributes of each flag.
555 for (; Item
->VarName
!= NULL
; Item
++) {
556 if (StrCmp (((SHELL_PARAM_PACKAGE
*) Node
)->Name
, Item
->VarName
) == 0) {
559 Attribute1
= Item
->Attribute1
;
560 Attribute2
= Item
->Attribute2
;
561 Attribute3
= Item
->Attribute3
;
562 Attribute4
= Item
->Attribute4
;
564 Attribute1
&= Item
->Attribute1
;
565 Attribute2
|= Item
->Attribute2
;
566 Attribute3
&= Item
->Attribute3
;
567 Attribute4
|= Item
->Attribute4
;
568 if (Attribute1
!= 0) {
569 return EFI_INVALID_PARAMETER
;
572 if (Attribute2
!= 0) {
573 if ((Index
== 2) && (StrCmp (Item
->VarName
, L
"-p") == 0)) {
577 return EFI_INVALID_PARAMETER
;
580 if (Attribute3
== 0) {
581 return EFI_INVALID_PARAMETER
;
583 if (((Attribute4
& 0xFF) == 0x03) || ((Attribute4
& 0xFF) == 0x0C) ||
584 ((Attribute4
& 0xFF) == 0x30) || ((Attribute4
& 0xFF) == 0xC0)) {
585 return EFI_INVALID_PARAMETER
;
592 Item
= mIpSecConfigVarCheckList
;
600 This is the declaration of an EFI image entry point. This entry point is
601 the same for UEFI Applications, UEFI OS Loaders, and UEFI Drivers, including
602 both device drivers and bus drivers.
604 The entry point for IpSecConfig application that parse the command line input and call an IpSecConfig process.
606 @param[in] ImageHandle The image handle of this application.
607 @param[in] SystemTable The pointer to the EFI System Table.
609 @retval EFI_SUCCESS The operation completed successfully.
614 InitializeIpSecConfig (
615 IN EFI_HANDLE ImageHandle
,
616 IN EFI_SYSTEM_TABLE
*SystemTable
620 EFI_IPSEC_CONFIG_DATA_TYPE DataType
;
622 LIST_ENTRY
*ParamPackage
;
623 CONST CHAR16
*ValueStr
;
624 CHAR16
*ProblemParam
;
625 UINTN NonOptionCount
;
628 // Register our string package with HII and return the handle to it.
630 mHiiHandle
= HiiAddPackages (&gEfiCallerIdGuid
, ImageHandle
, IpSecConfigStrings
, NULL
);
631 ASSERT (mHiiHandle
!= NULL
);
633 Status
= ShellCommandLineParseEx (mIpSecConfigParamList
, &ParamPackage
, &ProblemParam
, TRUE
, FALSE
);
634 if (EFI_ERROR (Status
)) {
635 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION
), mHiiHandle
, ProblemParam
);
639 Status
= IpSecConfigRetriveCheckListByName (mIpSecConfigVarCheckList
, ParamPackage
);
640 if (EFI_ERROR (Status
)) {
641 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_MISTAKEN_OPTIONS
), mHiiHandle
);
645 Status
= LocateProtocol (&gEfiIpSecConfigProtocolGuid
, (VOID
**) &mIpSecConfig
);
646 if (EFI_ERROR (Status
) || mIpSecConfig
== NULL
) {
647 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT
), mHiiHandle
, mAppName
);
651 Status
= LocateProtocol (&gEfiIpSecProtocolGuid
, (VOID
**) &mIpSec
);
652 if (EFI_ERROR (Status
) || mIpSec
== NULL
) {
653 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_PROTOCOL_INEXISTENT
), mHiiHandle
, mAppName
);
660 if (ShellCommandLineGetFlag (ParamPackage
, L
"-enable")) {
661 if (!(mIpSec
->DisabledFlag
)) {
662 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_ENABLE
), mHiiHandle
, mAppName
);
667 Value
= IPSEC_STATUS_ENABLED
;
668 Status
= gRT
->SetVariable (
669 IPSECCONFIG_STATUS_NAME
,
670 &gEfiIpSecConfigProtocolGuid
,
671 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_NON_VOLATILE
,
675 if (!EFI_ERROR (Status
)) {
676 mIpSec
->DisabledFlag
= FALSE
;
677 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_SUCCESS
), mHiiHandle
, mAppName
);
679 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_ENABLE_FAILED
), mHiiHandle
, mAppName
);
689 if (ShellCommandLineGetFlag (ParamPackage
, L
"-disable")) {
690 if (mIpSec
->DisabledFlag
) {
691 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_ALREADY_DISABLE
), mHiiHandle
, mAppName
);
694 // Set disable flag; however, leave it to be disabled in the callback function of DisabledEvent.
696 gBS
->SignalEvent (mIpSec
->DisabledEvent
);
697 if (mIpSec
->DisabledFlag
) {
698 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_SUCCESS
), mHiiHandle
, mAppName
);
700 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_DISABLE_FAILED
), mHiiHandle
, mAppName
);
710 if (ShellCommandLineGetFlag (ParamPackage
, L
"-status")) {
711 if (mIpSec
->DisabledFlag
) {
712 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_DISABLE
), mHiiHandle
, mAppName
);
714 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_STATUS_ENABLE
), mHiiHandle
, mAppName
);
720 // Try to get policy database type.
722 DataType
= (EFI_IPSEC_CONFIG_DATA_TYPE
) -1;
723 ValueStr
= ShellCommandLineGetValue (ParamPackage
, L
"-p");
724 if (ValueStr
!= NULL
) {
725 DataType
= (EFI_IPSEC_CONFIG_DATA_TYPE
) MapStringToInteger (ValueStr
, mMapPolicy
);
726 if (DataType
== -1) {
727 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_DB
), mHiiHandle
, mAppName
, ValueStr
);
732 if (ShellCommandLineGetFlag (ParamPackage
, L
"-?")) {
734 case (EFI_IPSEC_CONFIG_DATA_TYPE
) -1:
735 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_HELP
), mHiiHandle
);
738 case IPsecConfigDataTypeSpd
:
739 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_SPD_HELP
), mHiiHandle
);
742 case IPsecConfigDataTypeSad
:
743 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_SAD_HELP
), mHiiHandle
);
746 case IPsecConfigDataTypePad
:
747 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_PAD_HELP
), mHiiHandle
);
751 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_INCORRECT_DB
), mHiiHandle
);
758 NonOptionCount
= ShellCommandLineGetCount (ParamPackage
);
759 if ((NonOptionCount
- 1) > 0) {
760 ValueStr
= ShellCommandLineGetRawValue (ParamPackage
, (UINT32
) (NonOptionCount
- 1));
761 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_REDUNDANCY_MANY
), mHiiHandle
, mAppName
, ValueStr
);
765 if (DataType
== -1) {
766 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_MISSING_DB
), mHiiHandle
, mAppName
);
770 if (ShellCommandLineGetFlag (ParamPackage
, L
"-a")) {
771 Status
= AddOrInsertPolicyEntry (DataType
, ParamPackage
);
772 if (EFI_ERROR (Status
)) {
775 } else if (ShellCommandLineGetFlag (ParamPackage
, L
"-i")) {
776 Status
= AddOrInsertPolicyEntry (DataType
, ParamPackage
);
777 if (EFI_ERROR (Status
)) {
780 } else if (ShellCommandLineGetFlag (ParamPackage
, L
"-e")) {
781 Status
= EditPolicyEntry (DataType
, ParamPackage
);
782 if (EFI_ERROR (Status
)) {
785 } else if (ShellCommandLineGetFlag (ParamPackage
, L
"-d")) {
786 Status
= FlushOrDeletePolicyEntry (DataType
, ParamPackage
);
787 if (EFI_ERROR (Status
)) {
790 } else if (ShellCommandLineGetFlag (ParamPackage
, L
"-f")) {
791 Status
= FlushOrDeletePolicyEntry (DataType
, ParamPackage
);
792 if (EFI_ERROR (Status
)) {
795 } else if (ShellCommandLineGetFlag (ParamPackage
, L
"-l")) {
796 Status
= ListPolicyEntry (DataType
, ParamPackage
);
797 if (EFI_ERROR (Status
)) {
801 ShellPrintHiiEx (-1, -1, NULL
, STRING_TOKEN (STR_IPSEC_CONFIG_UNKNOWN_OPERATION
), mHiiHandle
, mAppName
);
806 ShellCommandLineFreeVarList (ParamPackage
);
807 HiiRemovePackages (mHiiHandle
);