2 Provide IPsec Key Exchange (IKE) service general interfaces.
4 Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include "IkeService.h"
17 #include "IpSecConfigImpl.h"
18 #include "Ikev2/Utility.h"
20 IKE_EXCHANGE_INTERFACE
*mIkeExchange
[] = {
25 EFI_UDP4_CONFIG_DATA mUdp4Conf
= {
46 EFI_UDP6_CONFIG_DATA mUdp6Conf
= {
58 {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
60 {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
65 Check if the NIC handle is binded to a Udp service.
67 @param[in] Private Pointer of IPSEC_PRIVATE_DATA.
68 @param[in] Handle The Handle of the NIC card.
69 @param[in] IpVersion The version of the IP stack.
71 @return a pointer of IKE_UDP_SERVICE.
76 IN IPSEC_PRIVATE_DATA
*Private
,
87 Head
= (IpVersion
== IP_VERSION_4
) ? &Private
->Udp4List
: &Private
->Udp6List
;
89 NET_LIST_FOR_EACH_SAFE (Entry
, Next
, Head
) {
91 Udp
= IPSEC_UDP_SERVICE_FROM_LIST (Entry
);
93 // Find the right udp service which installed on the appointed NIC handle.
95 if (Handle
== Udp
->NicHandle
) {
106 Configure a UDPIO's UDP4 instance.
108 This fuction is called by the UdpIoCreateIo() to configures a
111 @param[in] UdpIo The UDP_IO to be configured.
112 @param[in] Context User-defined data when calling UdpIoCreateIo().
114 @retval EFI_SUCCESS The configuration succeeded.
115 @retval Others The UDP4 instance fails to configure.
125 EFI_UDP4_CONFIG_DATA Udp4Cfg
;
126 EFI_UDP4_PROTOCOL
*Udp4
;
128 ZeroMem (&Udp4Cfg
, sizeof (EFI_UDP4_CONFIG_DATA
));
130 Udp4
= UdpIo
->Protocol
.Udp4
;
134 sizeof (EFI_UDP4_CONFIG_DATA
)
137 if (Context
!= NULL
) {
139 // Configure udp4 io with local default address.
141 Udp4Cfg
.UseDefaultAddress
= TRUE
;
144 return Udp4
->Configure (Udp4
, &Udp4Cfg
);
148 Configure a UDPIO's UDP6 instance.
150 This fuction is called by the UdpIoCreateIo()to configure a
153 @param[in] UdpIo The UDP_IO to be configured.
154 @param[in] Context User-defined data when calling UdpIoCreateIo().
156 @retval EFI_SUCCESS The configuration succeeded.
157 @retval Others The configuration fails.
167 EFI_UDP6_PROTOCOL
*Udp6
;
168 EFI_UDP6_CONFIG_DATA Udp6Cfg
;
170 ZeroMem (&Udp6Cfg
, sizeof (EFI_UDP6_CONFIG_DATA
));
172 Udp6
= UdpIo
->Protocol
.Udp6
;
176 sizeof (EFI_UDP6_CONFIG_DATA
)
179 if (Context
!= NULL
) {
181 // Configure instance with a destination address to start source address
182 // selection, and then get the configure data from the mode data to store
183 // the source address.
186 &Udp6Cfg
.RemoteAddress
,
188 sizeof (EFI_IPv6_ADDRESS
)
192 return Udp6
->Configure (Udp6
, &Udp6Cfg
);
196 Open and configure the related output UDPIO for IKE packet sending.
198 If the UdpService is not configured, this fuction calls UdpIoCreatIo() to
199 create UDPIO to bind this UdpService for IKE packet sending. If the UdpService
200 has already been configured, then return.
202 @param[in] UdpService The UDP_IO to be configured.
203 @param[in] RemoteIp User-defined data when calling UdpIoCreateIo().
205 @retval EFI_SUCCESS The configuration is successful.
206 @retval Others The configuration fails.
211 IN IKE_UDP_SERVICE
*UdpService
,
212 IN EFI_IP_ADDRESS
*RemoteIp
216 EFI_IP4_CONFIG_PROTOCOL
*Ip4Cfg
;
217 EFI_IP4_IPCONFIG_DATA
*Ip4CfgData
;
219 EFI_IP6_MODE_DATA Ip6ModeData
;
220 EFI_UDP6_PROTOCOL
*Udp6
;
222 Status
= EFI_SUCCESS
;
227 // Check whether the input and output udp io are both configured.
229 if (UdpService
->IsConfigured
) {
233 if (UdpService
->IpVersion
== UDP_IO_UDP4_VERSION
) {
235 // Handle ip4config protocol to get local default address.
237 Status
= gBS
->HandleProtocol (
238 UdpService
->NicHandle
,
239 &gEfiIp4ConfigProtocolGuid
,
243 if (EFI_ERROR (Status
)) {
247 Status
= Ip4Cfg
->GetData (Ip4Cfg
, &BufSize
, NULL
);
249 if (EFI_ERROR (Status
) && Status
!= EFI_BUFFER_TOO_SMALL
) {
253 Ip4CfgData
= AllocateZeroPool (BufSize
);
255 if (Ip4CfgData
== NULL
) {
256 Status
= EFI_OUT_OF_RESOURCES
;
260 Status
= Ip4Cfg
->GetData (Ip4Cfg
, &BufSize
, Ip4CfgData
);
261 if (EFI_ERROR (Status
)) {
266 &UdpService
->DefaultAddress
.v4
,
267 &Ip4CfgData
->StationAddress
,
268 sizeof (EFI_IPv4_ADDRESS
)
272 // Create udp4 io for output with local default address.
274 UdpService
->Output
= UdpIoCreateIo (
275 UdpService
->NicHandle
,
276 UdpService
->ImageHandle
,
279 &UdpService
->DefaultAddress
282 if (UdpService
->Output
== NULL
) {
283 Status
= EFI_OUT_OF_RESOURCES
;
289 // Create udp6 io for output with remote address.
291 UdpService
->Output
= UdpIoCreateIo (
292 UdpService
->NicHandle
,
293 UdpService
->ImageHandle
,
299 if (UdpService
->Output
== NULL
) {
300 Status
= EFI_OUT_OF_RESOURCES
;
304 // Get ip6 mode data to get the result of source address selection.
306 ZeroMem (&Ip6ModeData
, sizeof (EFI_IP6_MODE_DATA
));
308 Udp6
= UdpService
->Output
->Protocol
.Udp6
;
309 Status
= Udp6
->GetModeData (Udp6
, NULL
, &Ip6ModeData
, NULL
, NULL
);
311 if (EFI_ERROR (Status
)) {
312 UdpIoFreeIo (UdpService
->Output
);
316 // Reconfigure udp6 io without remote address.
318 Udp6
->Configure (Udp6
, NULL
);
319 Status
= IkeConfigUdp6 (UdpService
->Output
, NULL
);
322 // Record the selected source address for ipsec process later.
325 &UdpService
->DefaultAddress
.v6
,
326 &Ip6ModeData
.ConfigData
.StationAddress
,
327 sizeof (EFI_IPv6_ADDRESS
)
331 UdpService
->IsConfigured
= TRUE
;
334 if (Ip4CfgData
!= NULL
) {
335 FreePool (Ip4CfgData
);
342 Open and configure a UDPIO of Udp4 for IKE packet receiving.
344 This function is called at the IPsecDriverBinding start. IPsec create a UDP4 and
345 UDP4 IO for each NIC handle.
347 @param[in] Private Point to IPSEC_PRIVATE_DATA
348 @param[in] Controller Handler for NIC card.
349 @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
351 @retval EFI_SUCCESS The Operation is successful.
352 @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.
357 IN IPSEC_PRIVATE_DATA
*Private
,
358 IN EFI_HANDLE Controller
,
359 IN EFI_HANDLE ImageHandle
362 IKE_UDP_SERVICE
*Udp4Srv
;
365 // Check whether udp4 io of the controller has already been opened.
367 Udp4Srv
= IkeLookupUdp (Private
, Controller
, IP_VERSION_4
);
369 if (Udp4Srv
!= NULL
) {
370 return EFI_ALREADY_STARTED
;
373 Udp4Srv
= AllocateZeroPool (sizeof (IKE_UDP_SERVICE
));
375 if (Udp4Srv
== NULL
) {
376 return EFI_OUT_OF_RESOURCES
;
379 // Create udp4 io for iutput.
381 Udp4Srv
->Input
= UdpIoCreateIo (
389 if (Udp4Srv
->Input
== NULL
) {
391 return EFI_OUT_OF_RESOURCES
;
394 Udp4Srv
->NicHandle
= Controller
;
395 Udp4Srv
->ImageHandle
= ImageHandle
;
396 Udp4Srv
->ListHead
= &(Private
->Udp4List
);
397 Udp4Srv
->IpVersion
= UDP_IO_UDP4_VERSION
;
398 Udp4Srv
->IsConfigured
= FALSE
;
400 ZeroMem (&Udp4Srv
->DefaultAddress
, sizeof (EFI_IP_ADDRESS
));
403 // Insert the udp4 io into the list and increase the count.
405 InsertTailList (&Private
->Udp4List
, &Udp4Srv
->List
);
409 UdpIoRecvDatagram (Udp4Srv
->Input
, IkeDispatch
, Udp4Srv
, 0);
415 Open and configure a UDPIO of Udp6 for IKE packet receiving.
417 This function is called at the IPsecDriverBinding start. IPsec create a UDP6 and UDP6
418 IO for each NIC handle.
420 @param[in] Private Point to IPSEC_PRIVATE_DATA
421 @param[in] Controller Handler for NIC card.
422 @param[in] ImageHandle The handle that contains the EFI_DRIVER_BINDING_PROTOCOL instance.
424 @retval EFI_SUCCESS The Operation is successful.
425 @retval EFI_OUT_OF_RESOURCE The required system resource can't be allocated.
430 IN IPSEC_PRIVATE_DATA
*Private
,
431 IN EFI_HANDLE Controller
,
432 IN EFI_HANDLE ImageHandle
435 IKE_UDP_SERVICE
*Udp6Srv
;
437 Udp6Srv
= IkeLookupUdp (Private
, Controller
, IP_VERSION_6
);
439 if (Udp6Srv
!= NULL
) {
440 return EFI_ALREADY_STARTED
;
443 Udp6Srv
= AllocateZeroPool (sizeof (IKE_UDP_SERVICE
));
445 if (Udp6Srv
== NULL
) {
446 return EFI_OUT_OF_RESOURCES
;
449 // Create udp6 io for input.
451 Udp6Srv
->Input
= UdpIoCreateIo (
459 if (Udp6Srv
->Input
== NULL
) {
461 return EFI_OUT_OF_RESOURCES
;
464 Udp6Srv
->NicHandle
= Controller
;
465 Udp6Srv
->ImageHandle
= ImageHandle
;
466 Udp6Srv
->ListHead
= &(Private
->Udp6List
);
467 Udp6Srv
->IpVersion
= UDP_IO_UDP6_VERSION
;
468 Udp6Srv
->IsConfigured
= FALSE
;
470 ZeroMem (&Udp6Srv
->DefaultAddress
, sizeof (EFI_IP_ADDRESS
));
473 // Insert the udp6 io into the list and increase the count.
475 InsertTailList (&Private
->Udp6List
, &Udp6Srv
->List
);
479 UdpIoRecvDatagram (Udp6Srv
->Input
, IkeDispatch
, Udp6Srv
, 0);
485 The general interface of starting IPsec Key Exchange.
487 This function is called when a IKE negotiation to start getting a Key.
489 @param[in] UdpService Point to IKE_UDP_SERVICE which will be used for
491 @param[in] SpdEntry Point to the SPD entry related to the IKE negotiation.
492 @param[in] RemoteIp Point to EFI_IP_ADDRESS related to the IKE negotiation.
494 @retval EFI_SUCCESS The Operation is successful.
495 @retval EFI_ACCESS_DENIED No related PAD entry was found.
496 @retval EFI_INVALID_PARAMETER The IKE version is not supported.
501 IN IKE_UDP_SERVICE
*UdpService
,
502 IN IPSEC_SPD_ENTRY
*SpdEntry
,
503 IN EFI_IP_ADDRESS
*RemoteIp
508 IKE_EXCHANGE_INTERFACE
*Exchange
;
509 IPSEC_PRIVATE_DATA
*Private
;
510 IPSEC_PAD_ENTRY
*PadEntry
;
513 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
514 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
515 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
518 // Try to open udp io for output if it hasn't.
520 Status
= IkeOpenOutputUdp (UdpService
, RemoteIp
);
521 if (EFI_ERROR (Status
)) {
525 // Try to find the IKE SA session in the IKEv1 and IKEv2 established SA session list.
527 IkeSaSession
= (UINT8
*) Ikev2SaSessionLookup (&Private
->Ikev2EstablishedList
, RemoteIp
);
530 if (IkeSaSession
== NULL
) {
532 // Find the pad entry by the remote ip address.
534 PadEntry
= IpSecLookupPadEntry (UdpService
->IpVersion
, RemoteIp
);
535 if (PadEntry
== NULL
) {
536 return EFI_ACCESS_DENIED
;
539 // Determine the IKE exchange instance by the auth protocol in pad entry.
541 ASSERT (PadEntry
->Data
->AuthProtocol
< EfiIPsecAuthProtocolMaximum
);
542 if (PadEntry
->Data
->AuthProtocol
== EfiIPsecAuthProtocolIKEv1
) {
543 return EFI_INVALID_PARAMETER
;
545 Exchange
= mIkeExchange
[PadEntry
->Data
->AuthProtocol
];
547 // Start the main mode stage to negotiate IKE SA.
549 Status
= Exchange
->NegotiateSa (UdpService
, SpdEntry
, PadEntry
, RemoteIp
);
552 // Determine the IKE exchange instance by the IKE version in IKE SA session.
554 IkeVersion
= IkeGetVersionFromSession (IkeSaSession
);
555 if (IkeVersion
!= 2) {
556 return EFI_INVALID_PARAMETER
;
559 Exchange
= mIkeExchange
[IkeVersion
- 1];
561 // Start the quick mode stage to negotiate child SA.
563 Status
= Exchange
->NegotiateChildSa (IkeSaSession
, SpdEntry
, NULL
);
570 The generic interface when receive a IKE packet.
572 This function is called when UDP IO receives a IKE packet.
574 @param[in] Packet Point to received IKE packet.
575 @param[in] EndPoint Point to UDP_END_POINT which contains the information of
577 @param[in] IoStatus The Status of Recieve Token.
578 @param[in] Context Point to data passed from the caller.
585 IN UDP_END_POINT
*EndPoint
,
586 IN EFI_STATUS IoStatus
,
590 IPSEC_PRIVATE_DATA
*Private
;
591 IKE_PACKET
*IkePacket
;
593 IKE_UDP_SERVICE
*UdpService
;
594 IKE_EXCHANGE_INTERFACE
*Exchange
;
597 UdpService
= (IKE_UDP_SERVICE
*) Context
;
599 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
600 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
601 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
603 if (EFI_ERROR (IoStatus
)) {
607 // Check whether the ipsec is enabled or not.
609 if (Private
->IpSec
.DisabledFlag
== TRUE
) {
613 if (EndPoint
->RemotePort
!= IKE_DEFAULT_PORT
) {
618 // Build IKE packet from the received netbuf.
620 IkePacket
= IkePacketFromNetbuf (Packet
);
622 if (IkePacket
== NULL
) {
626 // Get the remote address from the IKE packet.
628 if (UdpService
->IpVersion
== IP_VERSION_4
) {
629 *(UINT32
*) IkePacket
->RemotePeerIp
.Addr
= HTONL ((*(UINT32
*) EndPoint
->RemoteAddr
.Addr
));
632 &IkePacket
->RemotePeerIp
,
633 NTOHLLL (&EndPoint
->RemoteAddr
.v6
),
634 sizeof (EFI_IPv6_ADDRESS
)
638 // Try to open udp io for output if hasn't.
640 Status
= IkeOpenOutputUdp (UdpService
, &IkePacket
->RemotePeerIp
);
642 if (EFI_ERROR (Status
)) {
646 IkeHdr
= IkePacket
->Header
;
649 // Determine the IKE exchange instance by the IKE version in IKE header.
651 if (IKE_MAJOR_VERSION (IkeHdr
->Version
) == 2) {
652 Exchange
= mIkeExchange
[IKE_MAJOR_VERSION (IkeHdr
->Version
) - 1];
657 switch (IkeHdr
->ExchangeType
) {
658 case IKE_XCG_TYPE_IDENTITY_PROTECT
:
659 case IKE_XCG_TYPE_SA_INIT
:
660 case IKE_XCG_TYPE_AUTH
:
661 Exchange
->HandleSa (UdpService
, IkePacket
);
664 case IKE_XCG_TYPE_QM
:
665 case IKE_XCG_TYPE_CREATE_CHILD_SA
:
666 Exchange
->HandleChildSa (UdpService
, IkePacket
);
669 case IKE_XCG_TYPE_INFO
:
670 case IKE_XCG_TYPE_INFO2
:
671 Exchange
->HandleInfo (UdpService
, IkePacket
);
679 if (IkePacket
!= NULL
) {
680 IkePacketFree (IkePacket
);
683 if (Packet
!= NULL
) {
687 UdpIoRecvDatagram (UdpService
->Input
, IkeDispatch
, UdpService
, 0);
693 Delete all established IKE SAs and related Child SAs.
695 This function is the subfunction of the IpSecCleanupAllSa(). It first calls
696 IkeDeleteChildSa() to delete all Child SAs then send out the related
699 @param[in] Private Pointer of the IPSEC_PRIVATE_DATA
700 @param[in] IsDisableIpsec Indicate whether needs to disable IPsec.
705 IN IPSEC_PRIVATE_DATA
*Private
,
706 IN BOOLEAN IsDisableIpsec
710 LIST_ENTRY
*NextEntry
;
711 IKEV2_SA_SESSION
*Ikev2SaSession
;
714 IKE_EXCHANGE_INTERFACE
*Exchange
;
720 // If the IKEv1 is supported, first deal with the Ikev1Estatblished list.
724 // If IKEv2 SAs are under establishing, delete it directly.
726 if (!IsListEmpty (&Private
->Ikev2SessionList
)) {
727 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, &Private
->Ikev2SessionList
) {
728 Ikev2SaSession
= IKEV2_SA_SESSION_BY_SESSION (Entry
);
729 RemoveEntryList (Entry
);
730 Ikev2SaSessionFree (Ikev2SaSession
);
735 // If there is no existing established IKE SA, set the Ipsec DisableFlag to TRUE
736 // and turn off the IsIPsecDisabling flag.
738 if (IsListEmpty (&Private
->Ikev2EstablishedList
) && IsDisableIpsec
) {
739 Value
= IPSEC_STATUS_DISABLED
;
740 Status
= gRT
->SetVariable (
741 IPSECCONFIG_STATUS_NAME
,
742 &gEfiIpSecConfigProtocolGuid
,
743 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_NON_VOLATILE
,
747 if (!EFI_ERROR (Status
)) {
748 Private
->IpSec
.DisabledFlag
= TRUE
;
749 Private
->IsIPsecDisabling
= FALSE
;
755 // Delete established IKEv2 SAs.
757 if (!IsListEmpty (&Private
->Ikev2EstablishedList
)) {
758 for (Entry
= Private
->Ikev2EstablishedList
.ForwardLink
; Entry
!= &Private
->Ikev2EstablishedList
;) {
759 Ikev2SaSession
= IKEV2_SA_SESSION_BY_SESSION (Entry
);
760 Entry
= Entry
->ForwardLink
;
762 Ikev2SaSession
->SessionCommon
.State
= IkeStateSaDeleting
;
765 // Call for Information Exchange.
767 IkeVersion
= IkeGetVersionFromSession ((UINT8
*)Ikev2SaSession
);
768 if (IkeVersion
== 2) {
769 Exchange
= mIkeExchange
[IkeVersion
- 1];
770 Exchange
->NegotiateInfo((UINT8
*)Ikev2SaSession
, NULL
);