2 The general interfaces of the IKEv2.
4 Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>
6 SPDX-License-Identifier: BSD-2-Clause-Patent
11 #include "IpSecDebug.h"
12 #include "IkeService.h"
13 #include "IpSecConfigImpl.h"
16 General interface to intialize a IKEv2 negotiation.
18 @param[in] UdpService Point to Udp Servcie used for the IKE packet sending.
19 @param[in] SpdEntry Point to SPD entry related to this IKE negotiation.
20 @param[in] PadEntry Point to PAD entry related to this IKE negotiation.
21 @param[in] RemoteIp Point to IP Address which the remote peer to negnotiate.
23 @retval EFI_SUCCESS The operation is successful.
24 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
25 @retval EFI_INVALID_PARAMETER If UdpService or RemoteIp is NULL.
26 @return Others The operation is failed.
31 IN IKE_UDP_SERVICE
*UdpService
,
32 IN IPSEC_SPD_ENTRY
*SpdEntry
,
33 IN IPSEC_PAD_ENTRY
*PadEntry
,
34 IN EFI_IP_ADDRESS
*RemoteIp
37 IPSEC_PRIVATE_DATA
*Private
;
38 IKEV2_SA_SESSION
*IkeSaSession
;
39 IKEV2_SESSION_COMMON
*SessionCommon
;
40 IKEV2_PACKET_HANDLER Handler
;
41 IKE_PACKET
*IkePacket
;
44 if (UdpService
== NULL
|| RemoteIp
== NULL
) {
45 return EFI_INVALID_PARAMETER
;
49 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
50 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
51 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
54 // Lookup the remote ip address in the processing IKE SA session list.
56 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2SessionList
, RemoteIp
);
57 if (IkeSaSession
!= NULL
) {
59 // Drop the packet if already in process.
65 // Create a new IkeSaSession and initiate the common parameters.
67 IkeSaSession
= Ikev2SaSessionAlloc (Private
, UdpService
);
68 if (IkeSaSession
== NULL
) {
69 return EFI_OUT_OF_RESOURCES
;
73 // Set the specific parameters and state(IKE_STATE_INIT).
75 IkeSaSession
->Spd
= SpdEntry
;
76 IkeSaSession
->Pad
= PadEntry
;
77 SessionCommon
= &IkeSaSession
->SessionCommon
;
78 SessionCommon
->IsInitiator
= TRUE
;
79 SessionCommon
->State
= IkeStateInit
;
81 // TODO: Get the prefer DH Group from the IPsec Configuration, after the IPsecconfig application update
84 SessionCommon
->PreferDhGroup
= IKEV2_TRANSFORM_ID_DH_1024MODP
;
87 &SessionCommon
->RemotePeerIp
,
89 sizeof (EFI_IP_ADDRESS
)
93 &SessionCommon
->LocalPeerIp
,
94 &UdpService
->DefaultAddress
,
95 sizeof (EFI_IP_ADDRESS
)
98 IKEV2_DUMP_STATE (SessionCommon
->State
, IkeStateInit
);
101 // Initiate the SAD data of the IkeSaSession.
103 IkeSaSession
->SaData
= Ikev2InitializeSaData (SessionCommon
);
104 if (IkeSaSession
->SaData
== NULL
) {
105 Status
= EFI_OUT_OF_RESOURCES
;
110 // Generate an IKE request packet and send it out.
112 Handler
= mIkev2Initial
[IkeSaSession
->Pad
->Data
->AuthMethod
][SessionCommon
->State
];
113 IkePacket
= Handler
.Generator ((UINT8
*) IkeSaSession
, NULL
);
114 if (IkePacket
== NULL
) {
115 Status
= EFI_OUT_OF_RESOURCES
;
119 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) SessionCommon
, IkePacket
, 0);
121 if (EFI_ERROR (Status
)) {
126 // Insert the current IkeSaSession into the processing IKE SA list.
128 Ikev2SaSessionInsert (&Private
->Ikev2SessionList
, IkeSaSession
, RemoteIp
);
134 if (IkePacket
!= NULL
) {
135 IkePacketFree (IkePacket
);
137 Ikev2SaSessionFree (IkeSaSession
);
142 It is general interface to negotiate the Child SA.
144 There are three situations which will invoke this function. First, create a CHILD
145 SA if the input Context is NULL. Second, rekeying the existing IKE SA if the Context
146 is a IKEv2_SA_SESSION. Third, rekeying the existing CHILD SA if the context is a
147 IKEv2_CHILD_SA_SESSION.
149 @param[in] IkeSaSession Pointer to IKEv2_SA_SESSION related to this operation.
150 @param[in] SpdEntry Pointer to IPSEC_SPD_ENTRY related to this operation.
151 @param[in] Context The data pass from the caller.
153 @retval EFI_SUCCESS The operation is successful.
154 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
155 @retval EFI_UNSUPPORTED The condition is not support yet.
156 @return Others The operation is failed.
160 Ikev2NegotiateChildSa (
161 IN UINT8
*IkeSaSession
,
162 IN IPSEC_SPD_ENTRY
*SpdEntry
,
167 IKEV2_SA_SESSION
*SaSession
;
168 IKEV2_CHILD_SA_SESSION
*ChildSaSession
;
169 IKEV2_SESSION_COMMON
*ChildSaCommon
;
170 IKE_PACKET
*IkePacket
;
171 IKE_UDP_SERVICE
*UdpService
;
173 SaSession
= (IKEV2_SA_SESSION
*) IkeSaSession
;
174 UdpService
= SaSession
->SessionCommon
.UdpService
;
178 // 1. Create another child SA session if context is null.
179 // 2. Rekeying the IKE SA session if the context is IKE SA session.
180 // 3. Rekeying the child SA session if the context is child SA session.
182 if (Context
== NULL
) {
184 // Create a new ChildSaSession and initiate the common parameters.
186 ChildSaSession
= Ikev2ChildSaSessionAlloc (UdpService
, SaSession
);
188 if (ChildSaSession
== NULL
) {
189 return EFI_OUT_OF_RESOURCES
;
193 // Set the specific parameters and state as IKE_STATE_CREATE_CHILD.
195 ChildSaSession
->Spd
= SpdEntry
;
196 ChildSaCommon
= &ChildSaSession
->SessionCommon
;
197 ChildSaCommon
->IsInitiator
= TRUE
;
198 ChildSaCommon
->State
= IkeStateCreateChild
;
200 IKEV2_DUMP_STATE (ChildSaCommon
->State
, IkeStateCreateChild
);
202 if (SpdEntry
->Selector
->NextLayerProtocol
!= EFI_IPSEC_ANY_PROTOCOL
) {
203 ChildSaSession
->ProtoId
= SpdEntry
->Selector
->NextLayerProtocol
;
206 if (SpdEntry
->Selector
->LocalPort
!= EFI_IPSEC_ANY_PORT
) {
207 ChildSaSession
->LocalPort
= SpdEntry
->Selector
->LocalPort
;
210 if (SpdEntry
->Selector
->RemotePort
!= EFI_IPSEC_ANY_PORT
) {
211 ChildSaSession
->RemotePort
= SpdEntry
->Selector
->RemotePort
;
214 // Initiate the SAD data parameters of the ChildSaSession.
216 ChildSaSession
->SaData
= Ikev2InitializeSaData (ChildSaCommon
);
217 if (ChildSaSession
->SaData
== NULL
) {
218 Status
= EFI_OUT_OF_RESOURCES
;
222 // Generate an IKE request packet and send it out.
224 IkePacket
= mIkev2CreateChild
.Generator ((UINT8
*) ChildSaSession
, NULL
);
226 if (IkePacket
== NULL
) {
227 Status
= EFI_OUT_OF_RESOURCES
;
231 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) ChildSaCommon
, IkePacket
, 0);
233 if (EFI_ERROR (Status
)) {
238 // Insert the ChildSaSession into processing child SA list.
240 Ikev2ChildSaSessionInsert (&SaSession
->ChildSaSessionList
, ChildSaSession
);
243 // TODO: Rekeying IkeSaSession or ChildSaSession, NOT support yet.
245 // Rekey IkeSa, set IkeSaSession->State and pass over IkeSaSession
246 // Rekey ChildSa, set ChildSaSession->State and pass over ChildSaSession
248 return EFI_UNSUPPORTED
;
255 if (ChildSaSession
->SaData
!= NULL
) {
256 FreePool (ChildSaSession
->SaData
);
259 if (ChildSaSession
->SessionCommon
.TimeoutEvent
!= NULL
) {
260 gBS
->CloseEvent (ChildSaSession
->SessionCommon
.TimeoutEvent
);
263 if (IkePacket
!= NULL
) {
264 IkePacketFree (IkePacket
);
267 Ikev2ChildSaSessionFree (ChildSaSession
);
272 It is general interface to start the Information Exchange.
274 There are three situations which will invoke this function. First, deliver a Delete Information
275 to delete the IKE SA if the input Context is NULL and the state of related IkeSaSeesion's is on
276 deleting.Second, deliver a Notify Information without the contents if the input Context is NULL.
277 Third, deliver a Notify Information if the input Context is not NULL.
279 @param[in] IkeSaSession Pointer to IKEv2_SA_SESSION related to this operation.
280 @param[in] Context Data passed by caller.
282 @retval EFI_SUCCESS The operation is successful.
283 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
284 @retval EFI_UNSUPPORTED The condition is not support yet.
285 @return Otherwise The operation is failed.
290 IN UINT8
*IkeSaSession
,
296 IKEV2_SA_SESSION
*Ikev2SaSession
;
297 IKEV2_CHILD_SA_SESSION
*ChildSaSession
;
298 IKEV2_SESSION_COMMON
*SaCommon
;
299 IKE_PACKET
*IkePacket
;
300 IKE_UDP_SERVICE
*UdpService
;
302 LIST_ENTRY
*NextEntry
;
304 Ikev2SaSession
= (IKEV2_SA_SESSION
*) IkeSaSession
;
305 UdpService
= Ikev2SaSession
->SessionCommon
.UdpService
;
306 SaCommon
= &Ikev2SaSession
->SessionCommon
;
308 Status
= EFI_SUCCESS
;
311 // Delete the IKE SA.
313 if (Ikev2SaSession
->SessionCommon
.State
== IkeStateSaDeleting
&& Context
== NULL
) {
316 // Generate Information Packet which contains the Delete Payload.
318 IkePacket
= mIkev2Info
.Generator ((UINT8
*) Ikev2SaSession
, NULL
);
319 if (IkePacket
== NULL
) {
320 Status
= EFI_OUT_OF_RESOURCES
;
325 // Send out the Packet
327 if (UdpService
!= NULL
&& UdpService
->Output
!= NULL
) {
328 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) SaCommon
, IkePacket
, 0);
330 if (EFI_ERROR (Status
)) {
334 } else if (!IsListEmpty (&Ikev2SaSession
->DeleteSaList
)) {
336 // Iterate all Deleting Child SAs.
338 NET_LIST_FOR_EACH_SAFE (Entry
, NextEntry
, &Ikev2SaSession
->DeleteSaList
) {
339 ChildSaSession
= IKEV2_CHILD_SA_SESSION_BY_DEL_SA (Entry
);
340 ChildSaSession
->SessionCommon
.State
= IkeStateSaDeleting
;
343 // Generate Information Packet which contains the Child SA Delete Payload.
345 IkePacket
= mIkev2Info
.Generator ((UINT8
*) ChildSaSession
, NULL
);
346 if (IkePacket
== NULL
) {
347 Status
= EFI_OUT_OF_RESOURCES
;
352 // Send out the Packet
354 if (UdpService
!= NULL
&& UdpService
->Output
!= NULL
) {
355 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) &ChildSaSession
->SessionCommon
, IkePacket
, 0);
357 if (EFI_ERROR (Status
)) {
362 } else if (Context
== NULL
) {
364 // TODO: Deliver null notification message.
366 } else if (Context
!= NULL
) {
368 // TODO: Send out the Information Exchange which contains the Notify Payload.
372 if (IkePacket
!= NULL
) {
373 IkePacketFree (IkePacket
);
380 The general interface when received a IKEv2 packet for the IKE SA establishing.
382 This function first find the related IKE SA Session according to the IKE packet's
383 remote IP. Then call the corresponding function to handle this IKE packet according
384 to the related IKE SA Session's State.
386 @param[in] UdpService Pointer of related UDP Service.
387 @param[in] IkePacket Data passed by caller.
392 IN IKE_UDP_SERVICE
*UdpService
,
393 IN IKE_PACKET
*IkePacket
397 IKEV2_SA_SESSION
*IkeSaSession
;
398 IKEV2_CHILD_SA_SESSION
*ChildSaSession
;
399 IKEV2_SESSION_COMMON
*IkeSaCommon
;
400 IKEV2_SESSION_COMMON
*ChildSaCommon
;
401 IKEV2_PACKET_HANDLER Handler
;
403 IPSEC_PAD_ENTRY
*PadEntry
;
404 IPSEC_PRIVATE_DATA
*Private
;
405 BOOLEAN IsNewSession
;
407 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
408 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
409 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
411 ChildSaSession
= NULL
;
412 ChildSaCommon
= NULL
;
415 // Lookup the remote ip address in the processing IKE SA session list.
417 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2SessionList
, &IkePacket
->RemotePeerIp
);
418 IsNewSession
= FALSE
;
420 if (IkeSaSession
== NULL
) {
422 // Lookup the remote ip address in the pad.
424 PadEntry
= IpSecLookupPadEntry (UdpService
->IpVersion
, &IkePacket
->RemotePeerIp
);
425 if (PadEntry
== NULL
) {
427 // Drop the packet if no pad entry matched, this is the request from RFC 4301.
433 // Create a new IkeSaSession and initiate the common parameters.
435 IkeSaSession
= Ikev2SaSessionAlloc (Private
, UdpService
);
436 if (IkeSaSession
== NULL
) {
439 IkeSaSession
->Pad
= PadEntry
;
440 IkeSaCommon
= &IkeSaSession
->SessionCommon
;
441 IkeSaCommon
->IsInitiator
= FALSE
;
442 IkeSaCommon
->State
= IkeStateInit
;
444 IKEV2_DUMP_STATE (IkeSaCommon
->State
, IkeStateInit
);
447 &IkeSaCommon
->RemotePeerIp
,
448 &IkePacket
->RemotePeerIp
,
449 sizeof (EFI_IP_ADDRESS
)
453 &IkeSaCommon
->LocalPeerIp
,
454 &UdpService
->DefaultAddress
,
455 sizeof (EFI_IP_ADDRESS
)
462 // Validate the IKE packet header.
464 if (!Ikev2ValidateHeader (IkeSaSession
, IkePacket
->Header
)) {
466 // Drop the packet if invalid IKE header.
472 // Decode all the payloads in the IKE packet.
474 IkeSaCommon
= &IkeSaSession
->SessionCommon
;
475 Status
= Ikev2DecodePacket (IkeSaCommon
, IkePacket
, IkeSessionTypeIkeSa
);
476 if (EFI_ERROR (Status
)) {
481 // Try to reate the first ChildSa Session of that IkeSaSession.
482 // If the IkeSaSession is responder, here will create the first ChildSaSession.
484 if (IkeSaCommon
->State
== IkeStateAuth
&& IsListEmpty(&IkeSaSession
->ChildSaSessionList
)) {
486 // Generate a piggyback child SA in IKE_STATE_AUTH state.
488 ASSERT (IsListEmpty (&IkeSaSession
->ChildSaSessionList
) &&
489 IsListEmpty (&IkeSaSession
->ChildSaEstablishSessionList
));
491 ChildSaSession
= Ikev2ChildSaSessionCreate (IkeSaSession
, UdpService
);
492 if (ChildSaSession
== NULL
) {
496 ChildSaCommon
= &ChildSaSession
->SessionCommon
;
500 // Parse the IKE request packet according to the auth method and current state.
502 Handler
= mIkev2Initial
[IkeSaSession
->Pad
->Data
->AuthMethod
][IkeSaCommon
->State
];
503 Status
= Handler
.Parser ((UINT8
*)IkeSaSession
, IkePacket
);
504 if (EFI_ERROR (Status
)) {
509 // Try to reate the first ChildSa Session of that IkeSaSession.
510 // If the IkeSaSession is initiator, here will create the first ChildSaSession.
512 if (IkeSaCommon
->State
== IkeStateAuth
&& IsListEmpty(&IkeSaSession
->ChildSaSessionList
)) {
514 // Generate a piggyback child SA in IKE_STATE_AUTH state.
516 ASSERT (IsListEmpty (&IkeSaSession
->ChildSaSessionList
) &&
517 IsListEmpty (&IkeSaSession
->ChildSaEstablishSessionList
));
519 ChildSaSession
= Ikev2ChildSaSessionCreate (IkeSaSession
, UdpService
);
520 if (ChildSaSession
== NULL
) {
524 ChildSaCommon
= &ChildSaSession
->SessionCommon
;
527 // Initialize the SA data for Child SA.
529 ChildSaSession
->SaData
= Ikev2InitializeSaData (ChildSaCommon
);
533 // Generate the IKE response packet and send it out if not established.
535 if (IkeSaCommon
->State
!= IkeStateIkeSaEstablished
) {
536 Handler
= mIkev2Initial
[IkeSaSession
->Pad
->Data
->AuthMethod
][IkeSaCommon
->State
];
537 Reply
= Handler
.Generator ((UINT8
*) IkeSaSession
, NULL
);
542 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) IkeSaCommon
, Reply
, 0);
543 if (EFI_ERROR (Status
)) {
546 if (!IkeSaCommon
->IsInitiator
) {
547 IkeSaCommon
->State
++;
548 IKEV2_DUMP_STATE (IkeSaCommon
->State
- 1, IkeSaCommon
->State
);
553 // Insert the new IkeSaSession into the Private processing IkeSaSession List.
556 Ikev2SaSessionInsert (&Private
->Ikev2SessionList
, IkeSaSession
, &IkePacket
->RemotePeerIp
);
560 // Register the IkeSaSession and remove it from processing list.
562 if (IkeSaCommon
->State
== IkeStateIkeSaEstablished
) {
565 // Remove the Established IKE SA Session from the IKE SA Session Negotiating list
566 // and insert it into IKE SA Session Established list.
568 Ikev2SaSessionRemove (&Private
->Ikev2SessionList
, &IkePacket
->RemotePeerIp
);
569 Ikev2SaSessionReg (IkeSaSession
, Private
);
572 // Remove the Established Child SA Session from the IkeSaSession->ChildSaSessionList
573 // ,insert it into IkeSaSession->ChildSaEstablishSessionList and save this Child SA
576 ChildSaSession
= IKEV2_CHILD_SA_SESSION_BY_IKE_SA (IkeSaSession
->ChildSaSessionList
.BackLink
);
577 Ikev2ChildSaSessionRemove (
578 &IkeSaSession
->ChildSaSessionList
,
579 ChildSaSession
->LocalPeerSpi
,
580 IKEV2_ESTABLISHING_CHILDSA_LIST
582 Ikev2ChildSaSessionReg (ChildSaSession
, Private
);
588 if (ChildSaSession
!= NULL
) {
590 // Remove the ChildSa from the list (Established list or Negotiating list).
592 RemoveEntryList (&ChildSaSession
->ByIkeSa
);
593 Ikev2ChildSaSessionFree (ChildSaSession
);
596 if (IsNewSession
&& IkeSaSession
!= NULL
) {
598 // Remove the IkeSa from the list (Established list or Negotiating list).
600 if ((&IkeSaSession
->BySessionTable
)->ForwardLink
!= NULL
&&
601 !IsListEmpty (&IkeSaSession
->BySessionTable
603 RemoveEntryList (&IkeSaSession
->BySessionTable
);
605 Ikev2SaSessionFree (IkeSaSession
);
613 The general interface when received a IKEv2 packet for the IKE Child SA establishing
614 or IKE SA/CHILD SA rekeying.
616 This function first find the related IKE SA Session according to the IKE packet's
617 remote IP. Then call the corresponding function to handle this IKE packet according
618 to the related IKE Child Session's State.
620 @param[in] UdpService Pointer of related UDP Service.
621 @param[in] IkePacket Data passed by caller.
626 IN IKE_UDP_SERVICE
*UdpService
,
627 IN IKE_PACKET
*IkePacket
631 IKEV2_SA_SESSION
*IkeSaSession
;
632 IKEV2_CREATE_CHILD_REQUEST_TYPE RequestType
;
634 IPSEC_PRIVATE_DATA
*Private
;
636 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
637 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
638 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
643 // Lookup the remote ip address in the processing IKE SA session list.
645 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2EstablishedList
, &IkePacket
->RemotePeerIp
);
647 if (IkeSaSession
== NULL
) {
649 // Drop the packet if no IKE SA associated.
655 // Validate the IKE packet header.
657 if (!Ikev2ValidateHeader (IkeSaSession
, IkePacket
->Header
)) {
659 // Drop the packet if invalid IKE header.
665 // Decode all the payloads in the IKE packet.
667 Status
= Ikev2DecodePacket (&IkeSaSession
->SessionCommon
, IkePacket
, IkeSessionTypeIkeSa
);
668 if (EFI_ERROR (Status
)) {
673 // Get the request type: CreateChildSa/RekeyChildSa/RekeyIkeSa.
675 RequestType
= Ikev2ChildExchangeRequestType (IkePacket
);
677 switch (RequestType
) {
678 case IkeRequestTypeCreateChildSa
:
679 case IkeRequestTypeRekeyChildSa
:
680 case IkeRequestTypeRekeyIkeSa
:
682 // Parse the IKE request packet. Not support CREATE_CHILD_SA exchange yet, so
683 // only EFI_UNSUPPORTED will be returned and that will trigger a reply with a
684 // Notify payload of type NO_ADDITIONAL_SAS.
686 Status
= mIkev2CreateChild
.Parser ((UINT8
*) IkeSaSession
, IkePacket
);
687 if (EFI_ERROR (Status
)) {
700 // Generate the reply packet if needed and send it out.
702 if (!(IkePacket
->Header
->Flags
& IKE_HEADER_FLAGS_RESPOND
)) {
703 Reply
= mIkev2CreateChild
.Generator ((UINT8
*) IkeSaSession
, &IkePacket
->Header
->MessageId
);
705 Status
= Ikev2SendIkePacket (UdpService
, (UINT8
*) &(IkeSaSession
->SessionCommon
), Reply
, 0);
706 if (EFI_ERROR (Status
)) {
708 // Delete Reply payload.
711 IkePacketFree (Reply
);
721 It is general interface to handle IKEv2 information Exchange.
723 @param[in] UdpService Point to IKE UPD Service related to this information exchange.
724 @param[in] IkePacket The IKE packet to be parsed.
729 IN IKE_UDP_SERVICE
*UdpService
,
730 IN IKE_PACKET
*IkePacket
734 IKEV2_SESSION_COMMON
*SessionCommon
;
735 IKEV2_SA_SESSION
*IkeSaSession
;
736 IPSEC_PRIVATE_DATA
*Private
;
738 Private
= (UdpService
->IpVersion
== IP_VERSION_4
) ?
739 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService
->ListHead
) :
740 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService
->ListHead
);
743 // Lookup the remote ip address in the processing IKE SA session list.
745 IkeSaSession
= Ikev2SaSessionLookup (&Private
->Ikev2EstablishedList
, &IkePacket
->RemotePeerIp
);
747 if (IkeSaSession
== NULL
) {
749 // Drop the packet if no IKE SA associated.
754 // Validate the IKE packet header.
756 if (!Ikev2ValidateHeader (IkeSaSession
, IkePacket
->Header
)) {
759 // Drop the packet if invalid IKE header.
764 SessionCommon
= &IkeSaSession
->SessionCommon
;
767 // Decode all the payloads in the IKE packet.
769 Status
= Ikev2DecodePacket (SessionCommon
, IkePacket
, IkeSessionTypeIkeSa
);
770 if (EFI_ERROR (Status
)) {
774 Status
= mIkev2Info
.Parser ((UINT8
*)IkeSaSession
, IkePacket
);
776 if (EFI_ERROR (Status
)) {
778 // Drop the packet if fail to parse.
784 IKE_EXCHANGE_INTERFACE mIkev1Exchange
= {
786 NULL
, //Ikev1NegotiateSa
787 NULL
, //Ikev1NegotiateChildSa
789 NULL
, //Ikev1HandleSa,
790 NULL
, //Ikev1HandleChildSa
791 NULL
, //Ikev1HandleInfo
794 IKE_EXCHANGE_INTERFACE mIkev2Exchange
= {
797 Ikev2NegotiateChildSa
,