NetworkPkg/IpSecDxe/Ikev2/Utility.c

   1 /** @file
   2   The Common operations used by IKE Exchange Process.
   3
   4   (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
   5   Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>
   6
   7   This program and the accompanying materials
   8   are licensed and made available under the terms and conditions of the BSD License
   9   which accompanies this distribution.  The full text of the license may be found at
  10   http://opensource.org/licenses/bsd-license.php.
  11
  12   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  13   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  14
  15 **/
  16
  17 #include "Utility.h"
  18 #include "IpSecDebug.h"
  19 #include "IkeService.h"
  20 #include "IpSecConfigImpl.h"
  21
  22 UINT16 mIkev2EncryptAlgorithmList[IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM] = {
  23   IKEV2_TRANSFORM_ID_ENCR_3DES,
  24   IKEV2_TRANSFORM_ID_ENCR_AES_CBC,
  25 };
  26
  27 UINT16 mIkev2PrfAlgorithmList[IKEV2_SUPPORT_PRF_ALGORITHM_NUM] = {
  28   IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1,
  29 };
  30
  31 UINT16 mIkev2DhGroupAlgorithmList[IKEV2_SUPPORT_DH_ALGORITHM_NUM] = {
  32   IKEV2_TRANSFORM_ID_DH_1024MODP,
  33   IKEV2_TRANSFORM_ID_DH_2048MODP,
  34 };
  35
  36 UINT16 mIkev2AuthAlgorithmList[IKEV2_SUPPORT_AUTH_ALGORITHM_NUM] = {
  37   IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96,
  38 };
  39
  40 /**
  41   Allocate buffer for IKEV2_SA_SESSION and initialize it.
  42
  43   @param[in] Private        Pointer to IPSEC_PRIVATE_DATA.
  44   @param[in] UdpService     Pointer to IKE_UDP_SERVICE related to this IKE SA Session.
  45
  46   @return Pointer to IKEV2_SA_SESSION or NULL.
  47
  48 **/
  49 IKEV2_SA_SESSION *
  50 Ikev2SaSessionAlloc (
  51   IN IPSEC_PRIVATE_DATA       *Private,
  52   IN IKE_UDP_SERVICE          *UdpService
  53   )
  54 {
  55   EFI_STATUS            Status;
  56   IKEV2_SESSION_COMMON  *SessionCommon;
  57   IKEV2_SA_SESSION      *IkeSaSession;
  58
  59   IkeSaSession = AllocateZeroPool (sizeof (IKEV2_SA_SESSION));
  60   ASSERT (IkeSaSession != NULL);
  61
  62   //
  63   // Initialize the fields of IkeSaSession and its SessionCommon.
  64   //
  65   IkeSaSession->NCookie              = NULL;
  66   IkeSaSession->Signature            = IKEV2_SA_SESSION_SIGNATURE;
  67   IkeSaSession->InitiatorCookie      = IkeGenerateCookie ();
  68   IkeSaSession->ResponderCookie      = 0;
  69   //
  70   // BUGBUG: Message ID starts from 2 is to match the OpenSwan requirement, but it
  71   // might not match the IPv6 Logo. In its test specification, it mentions that
  72   // the Message ID should start from zero after the IKE_SA_INIT exchange.
  73   //
  74   IkeSaSession->MessageId            = 2;
  75   SessionCommon                      = &IkeSaSession->SessionCommon;
  76   SessionCommon->UdpService          = UdpService;
  77   SessionCommon->Private             = Private;
  78   SessionCommon->IkeSessionType      = IkeSessionTypeIkeSa;
  79   SessionCommon->IkeVer              = 2;
  80   SessionCommon->AfterEncodePayload  = NULL;
  81   SessionCommon->BeforeDecodePayload = NULL;
  82
  83   //
  84   // Create a resend notfiy event for retry.
  85   //
  86   Status = gBS->CreateEvent (
  87                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
  88                   TPL_CALLBACK,
  89                   Ikev2ResendNotify,
  90                   SessionCommon,
  91                   &SessionCommon->TimeoutEvent
  92                   );
  93
  94   if (EFI_ERROR (Status)) {
  95     FreePool (IkeSaSession);
  96     return NULL;
  97   }
  98
  99   //
 100   // Initialize the lists in IkeSaSession.
 101   //
 102   InitializeListHead (&IkeSaSession->ChildSaSessionList);
 103   InitializeListHead (&IkeSaSession->ChildSaEstablishSessionList);
 104   InitializeListHead (&IkeSaSession->InfoMIDList);
 105   InitializeListHead (&IkeSaSession->DeleteSaList);
 106
 107   return IkeSaSession;
 108 }
 109
 110 /**
 111   Register the established IKEv2 SA into Private->Ikev2EstablishedList. If there is
 112   IKEV2_SA_SESSION with same remote peer IP, remove the old one then register the
 113   new one.
 114
 115   @param[in]  IkeSaSession  Pointer to IKEV2_SA_SESSION to be registered.
 116   @param[in]  Private       Pointer to IPSEC_PRAVATE_DATA.
 117
 118 **/
 119 VOID
 120 Ikev2SaSessionReg (
 121   IN IKEV2_SA_SESSION          *IkeSaSession,
 122   IN IPSEC_PRIVATE_DATA        *Private
 123   )
 124 {
 125   IKEV2_SESSION_COMMON         *SessionCommon;
 126   IKEV2_SA_SESSION             *OldIkeSaSession;
 127   EFI_STATUS                   Status;
 128   UINT64                       Lifetime;
 129
 130   //
 131   // Keep IKE SA exclusive to remote ip address.
 132   //
 133   SessionCommon   = &IkeSaSession->SessionCommon;
 134   OldIkeSaSession = Ikev2SaSessionRemove (&Private->Ikev2EstablishedList, &SessionCommon->RemotePeerIp);
 135   if (OldIkeSaSession != NULL) {
 136     //
 137     // TODO: It should delete all child SAs if rekey the IKE SA.
 138     //
 139     Ikev2SaSessionFree (OldIkeSaSession);
 140   }
 141
 142   //
 143   // Cleanup the fields of SessionCommon for processing.
 144   //
 145   Ikev2SessionCommonRefresh (SessionCommon);
 146
 147   //
 148   // Insert the ready IKE SA session into established list.
 149   //
 150   Ikev2SaSessionInsert (&Private->Ikev2EstablishedList, IkeSaSession, &SessionCommon->RemotePeerIp);
 151
 152   //
 153   // Create a notfiy event for the IKE SA life time counting.
 154   //
 155   Status = gBS->CreateEvent (
 156                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
 157                   TPL_CALLBACK,
 158                   Ikev2LifetimeNotify,
 159                   SessionCommon,
 160                   &SessionCommon->TimeoutEvent
 161                   );
 162   if (EFI_ERROR(Status)){
 163     //
 164     // If TimerEvent creation failed, the SA will be alive untill user disable it or
 165     // receiving a Delete Payload from peer.
 166     //
 167     return;
 168   }
 169
 170   //
 171   // Start to count the lifetime of the IKE SA.
 172   //
 173   if (IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime == 0) {
 174     Lifetime = IKE_SA_DEFAULT_LIFETIME;
 175   } else {
 176     Lifetime = IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;
 177   }
 178
 179   Status = gBS->SetTimer (
 180                   SessionCommon->TimeoutEvent,
 181                   TimerRelative,
 182                   MultU64x32(Lifetime, 10000000) // ms->100ns
 183                   );
 184   if (EFI_ERROR(Status)){
 185     //
 186     // If SetTimer failed, the SA will be alive untill user disable it or
 187     // receiving a Delete Payload from peer.
 188     //
 189     return ;
 190   }
 191
 192   DEBUG ((
 193     DEBUG_INFO,
 194     "\n------IkeSa established and start to count down %d seconds lifetime\n",
 195     Lifetime
 196     ));
 197
 198   return ;
 199 }
 200
 201 /**
 202   Find a IKEV2_SA_SESSION by the remote peer IP.
 203
 204   @param[in]  SaSessionList     SaSession List to be searched.
 205   @param[in]  RemotePeerIp      Pointer to specified IP address.
 206
 207   @return Pointer to IKEV2_SA_SESSION if find one or NULL.
 208
 209 **/
 210 IKEV2_SA_SESSION *
 211 Ikev2SaSessionLookup (
 212   IN LIST_ENTRY           *SaSessionList,
 213   IN EFI_IP_ADDRESS       *RemotePeerIp
 214   )
 215 {
 216   LIST_ENTRY        *Entry;
 217   IKEV2_SA_SESSION  *IkeSaSession;
 218
 219   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 220     IkeSaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 221
 222     if (CompareMem (
 223           &IkeSaSession->SessionCommon.RemotePeerIp,
 224           RemotePeerIp,
 225           sizeof (EFI_IP_ADDRESS)
 226           ) == 0) {
 227
 228       return IkeSaSession;
 229     }
 230   }
 231
 232   return NULL;
 233 }
 234
 235 /**
 236   Insert a IKE_SA_SESSION into IkeSaSession list. The IkeSaSession list is either
 237   Private->Ikev2SaSession list or Private->Ikev2EstablishedList list.
 238
 239   @param[in]  SaSessionList   Pointer to list to be inserted into.
 240   @param[in]  IkeSaSession    Pointer to IKEV2_SA_SESSION to be inserted.
 241   @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESSS to indicate the
 242                               unique IKEV2_SA_SESSION.
 243
 244 **/
 245 VOID
 246 Ikev2SaSessionInsert (
 247   IN LIST_ENTRY           *SaSessionList,
 248   IN IKEV2_SA_SESSION     *IkeSaSession,
 249   IN EFI_IP_ADDRESS       *RemotePeerIp
 250   )
 251 {
 252   Ikev2SaSessionRemove (SaSessionList, RemotePeerIp);
 253   InsertTailList (SaSessionList, &IkeSaSession->BySessionTable);
 254 }
 255
 256 /**
 257   Remove the SA Session by Remote Peer IP.
 258
 259   @param[in]  SaSessionList   Pointer to list to be searched.
 260   @param[in]  RemotePeerIp    Pointer to EFI_IP_ADDRESS to use for SA Session search.
 261
 262   @retval Pointer to IKEV2_SA_SESSION with the specified remote IP address or NULL.
 263
 264 **/
 265 IKEV2_SA_SESSION *
 266 Ikev2SaSessionRemove (
 267   IN LIST_ENTRY           *SaSessionList,
 268   IN EFI_IP_ADDRESS       *RemotePeerIp
 269   )
 270 {
 271   LIST_ENTRY        *Entry;
 272   IKEV2_SA_SESSION  *IkeSaSession;
 273
 274   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 275     IkeSaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);
 276
 277     if (CompareMem (
 278           &IkeSaSession->SessionCommon.RemotePeerIp,
 279           RemotePeerIp,
 280           sizeof (EFI_IP_ADDRESS)
 281           ) == 0) {
 282
 283       RemoveEntryList (Entry);
 284       return IkeSaSession;
 285     }
 286   }
 287
 288   return NULL;
 289 }
 290
 291 /**
 292   Marking a SA session as on deleting.
 293
 294   @param[in]  IkeSaSession  Pointer to IKEV2_SA_SESSION.
 295
 296   @retval     EFI_SUCCESS   Find the related SA session and marked it.
 297
 298 **/
 299 EFI_STATUS
 300 Ikev2SaSessionOnDeleting (
 301   IN IKEV2_SA_SESSION          *IkeSaSession
 302   )
 303 {
 304   return EFI_SUCCESS;
 305 }
 306
 307 /**
 308   Free specified Seession Common. The session common would belong to a IKE SA or
 309   a Child SA.
 310
 311   @param[in]   SessionCommon   Pointer to a Session Common.
 312
 313 **/
 314 VOID
 315 Ikev2SaSessionCommonFree (
 316   IN IKEV2_SESSION_COMMON      *SessionCommon
 317   )
 318 {
 319
 320   ASSERT (SessionCommon != NULL);
 321
 322   if (SessionCommon->LastSentPacket != NULL) {
 323     IkePacketFree (SessionCommon->LastSentPacket);
 324   }
 325
 326   if (SessionCommon->SaParams != NULL) {
 327     FreePool (SessionCommon->SaParams);
 328   }
 329   if (SessionCommon->TimeoutEvent != NULL) {
 330     gBS->CloseEvent (SessionCommon->TimeoutEvent);
 331   }
 332 }
 333
 334 /**
 335   After IKE/Child SA is estiblished, close the time event and free sent packet.
 336
 337   @param[in]   SessionCommon   Pointer to a Session Common.
 338
 339 **/
 340 VOID
 341 Ikev2SessionCommonRefresh (
 342   IN IKEV2_SESSION_COMMON      *SessionCommon
 343   )
 344 {
 345   ASSERT (SessionCommon != NULL);
 346
 347   gBS->CloseEvent (SessionCommon->TimeoutEvent);
 348   SessionCommon->TimeoutEvent     = NULL;
 349   SessionCommon->TimeoutInterval  = 0;
 350   SessionCommon->RetryCount       = 0;
 351   if (SessionCommon->LastSentPacket != NULL) {
 352     IkePacketFree (SessionCommon->LastSentPacket);
 353     SessionCommon->LastSentPacket = NULL;
 354   }
 355
 356   return ;
 357 }
 358 /**
 359   Free specified IKEV2 SA Session.
 360
 361   @param[in]    IkeSaSession   Pointer to IKEV2_SA_SESSION to be freed.
 362
 363 **/
 364 VOID
 365 Ikev2SaSessionFree (
 366   IN IKEV2_SA_SESSION         *IkeSaSession
 367   )
 368 {
 369   IKEV2_SESSION_KEYS      *IkeKeys;
 370   LIST_ENTRY              *Entry;
 371   IKEV2_CHILD_SA_SESSION  *ChildSa;
 372   IKEV2_DH_BUFFER         *DhBuffer;
 373
 374   ASSERT (IkeSaSession != NULL);
 375
 376   //
 377   // Delete Common Session
 378   //
 379   Ikev2SaSessionCommonFree (&IkeSaSession->SessionCommon);
 380
 381   //
 382   // Delete ChildSaEstablish List and SAD
 383   //
 384   for (Entry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;
 385        Entry != &IkeSaSession->ChildSaEstablishSessionList;
 386       ) {
 387
 388     ChildSa = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 389     Entry   = Entry->ForwardLink;
 390     Ikev2ChildSaSilentDelete (ChildSa->IkeSaSession, ChildSa->LocalPeerSpi);
 391
 392   }
 393
 394   //
 395   // Delete ChildSaSessionList
 396   //
 397   for ( Entry  = IkeSaSession->ChildSaSessionList.ForwardLink;
 398         Entry != &IkeSaSession->ChildSaSessionList;
 399         ){
 400     ChildSa = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 401     Entry   = Entry->ForwardLink;
 402     RemoveEntryList (Entry->BackLink);
 403     Ikev2ChildSaSessionFree (ChildSa);
 404   }
 405
 406   //
 407   // Delete DhBuffer and Keys
 408   //
 409   if (IkeSaSession->IkeKeys != NULL) {
 410     IkeKeys  = IkeSaSession->IkeKeys;
 411     DhBuffer = IkeKeys->DhBuffer;
 412
 413     //
 414     // Delete DhBuffer
 415     //
 416     Ikev2DhBufferFree (DhBuffer);
 417
 418     //
 419     // Delete Keys
 420     //
 421     if (IkeKeys->SkAiKey != NULL) {
 422       FreePool (IkeKeys->SkAiKey);
 423     }
 424     if (IkeKeys->SkArKey != NULL) {
 425       FreePool (IkeKeys->SkArKey);
 426     }
 427     if (IkeKeys->SkdKey != NULL) {
 428       FreePool (IkeKeys->SkdKey);
 429     }
 430     if (IkeKeys->SkEiKey != NULL) {
 431       FreePool (IkeKeys->SkEiKey);
 432     }
 433     if (IkeKeys->SkErKey != NULL) {
 434       FreePool (IkeKeys->SkErKey);
 435     }
 436     if (IkeKeys->SkPiKey != NULL) {
 437       FreePool (IkeKeys->SkPiKey);
 438     }
 439     if (IkeKeys->SkPrKey != NULL) {
 440       FreePool (IkeKeys->SkPrKey);
 441     }
 442     FreePool (IkeKeys);
 443   }
 444
 445   if (IkeSaSession->SaData != NULL) {
 446     FreePool (IkeSaSession->SaData);
 447   }
 448
 449   if (IkeSaSession->NiBlock != NULL) {
 450     FreePool (IkeSaSession->NiBlock);
 451   }
 452
 453   if (IkeSaSession->NrBlock != NULL) {
 454     FreePool (IkeSaSession->NrBlock);
 455   }
 456
 457   if (IkeSaSession->NCookie != NULL) {
 458     FreePool (IkeSaSession->NCookie);
 459   }
 460
 461   if (IkeSaSession->InitPacket != NULL) {
 462     FreePool (IkeSaSession->InitPacket);
 463   }
 464
 465   if (IkeSaSession->RespPacket != NULL) {
 466     FreePool (IkeSaSession->RespPacket);
 467   }
 468
 469   FreePool (IkeSaSession);
 470
 471   return ;
 472 }
 473
 474 /**
 475   Increase the MessageID in IkeSaSession.
 476
 477   @param[in] IkeSaSession Pointer to a specified IKEV2_SA_SESSION.
 478
 479 **/
 480 VOID
 481 Ikev2SaSessionIncreaseMessageId (
 482   IN IKEV2_SA_SESSION         *IkeSaSession
 483   )
 484 {
 485   if (IkeSaSession->MessageId < 0xffffffff) {
 486     IkeSaSession->MessageId ++;
 487   } else {
 488     //
 489     // TODO: Trigger Rekey process.
 490     //
 491   }
 492 }
 493
 494 /**
 495   Allocate memory for IKEV2 Child SA Session.
 496
 497   @param[in]   UdpService     Pointer to IKE_UDP_SERVICE.
 498   @param[in]   IkeSaSession   Pointer to IKEV2_SA_SESSION related to this Child SA
 499                               Session.
 500
 501   @retval  Pointer of a new created IKEV2 Child SA Session or NULL.
 502
 503 **/
 504 IKEV2_CHILD_SA_SESSION *
 505 Ikev2ChildSaSessionAlloc (
 506   IN IKE_UDP_SERVICE          *UdpService,
 507   IN IKEV2_SA_SESSION         *IkeSaSession
 508   )
 509 {
 510   EFI_STATUS                  Status;
 511   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
 512   IKEV2_SESSION_COMMON        *ChildSaCommon;
 513   IKEV2_SESSION_COMMON        *SaCommon;
 514
 515   ChildSaSession = AllocateZeroPool (sizeof (IKEV2_CHILD_SA_SESSION));
 516   if (ChildSaSession == NULL) {
 517     return NULL;
 518   }
 519
 520   //
 521   // Initialize the fields of ChildSaSession and its SessionCommon.
 522   //
 523   ChildSaSession->Signature          = IKEV2_CHILD_SA_SESSION_SIGNATURE;
 524   ChildSaSession->IkeSaSession       = IkeSaSession;
 525   ChildSaSession->MessageId          = IkeSaSession->MessageId;
 526   ChildSaSession->LocalPeerSpi       = IkeGenerateSpi ();
 527   ChildSaCommon                      = &ChildSaSession->SessionCommon;
 528   ChildSaCommon->UdpService          = UdpService;
 529   ChildSaCommon->Private             = IkeSaSession->SessionCommon.Private;
 530   ChildSaCommon->IkeSessionType      = IkeSessionTypeChildSa;
 531   ChildSaCommon->IkeVer              = 2;
 532   ChildSaCommon->AfterEncodePayload  = Ikev2ChildSaAfterEncodePayload;
 533   ChildSaCommon->BeforeDecodePayload = Ikev2ChildSaBeforeDecodePayload;
 534   SaCommon = &ChildSaSession->IkeSaSession->SessionCommon;
 535
 536   //
 537   // Create a resend notfiy event for retry.
 538   //
 539   Status = gBS->CreateEvent (
 540                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
 541                   TPL_CALLBACK,
 542                   Ikev2ResendNotify,
 543                   ChildSaCommon,
 544                   &ChildSaCommon->TimeoutEvent
 545                   );
 546   if (EFI_ERROR (Status)) {
 547     FreePool (ChildSaSession);
 548     return NULL;
 549   }
 550
 551   CopyMem (&ChildSaCommon->LocalPeerIp, &SaCommon->LocalPeerIp, sizeof (EFI_IP_ADDRESS));
 552   CopyMem (&ChildSaCommon->RemotePeerIp, &SaCommon->RemotePeerIp, sizeof (EFI_IP_ADDRESS));
 553
 554   return ChildSaSession;
 555 }
 556
 557 /**
 558   Register a established IKEv2 Child SA into IkeSaSession->ChildSaEstablishSessionList.
 559   If the there is IKEV2_CHILD_SA_SESSION with same remote peer IP, remove the old one
 560   then register the new one.
 561
 562   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION to be registered.
 563   @param[in]  Private         Pointer to IPSEC_PRAVATE_DATA.
 564
 565 **/
 566 VOID
 567 Ikev2ChildSaSessionReg (
 568   IN IKEV2_CHILD_SA_SESSION    *ChildSaSession,
 569   IN IPSEC_PRIVATE_DATA        *Private
 570   )
 571 {
 572   IKEV2_SESSION_COMMON         *SessionCommon;
 573   IKEV2_CHILD_SA_SESSION       *OldChildSaSession;
 574   IKEV2_SA_SESSION             *IkeSaSession;
 575   EFI_STATUS                   Status;
 576   UINT64                       Lifetime;
 577
 578   //
 579   // Keep the IKE SA exclusive.
 580   //
 581   SessionCommon     = &ChildSaSession->SessionCommon;
 582   IkeSaSession      = ChildSaSession->IkeSaSession;
 583   OldChildSaSession = Ikev2ChildSaSessionRemove (
 584                         &IkeSaSession->ChildSaEstablishSessionList,
 585                         ChildSaSession->LocalPeerSpi,
 586                         IKEV2_ESTABLISHED_CHILDSA_LIST
 587                         );
 588   if (OldChildSaSession != NULL) {
 589     //
 590     // Free the old one.
 591     //
 592     Ikev2ChildSaSessionFree (OldChildSaSession);
 593   }
 594
 595   //
 596   // Store the ready child SA into SAD.
 597   //
 598   Ikev2StoreSaData (ChildSaSession);
 599
 600   //
 601   // Cleanup the fields of SessionCommon for processing.
 602   //
 603   Ikev2SessionCommonRefresh (SessionCommon);
 604
 605   //
 606   // Insert the ready child SA session into established list.
 607   //
 608   Ikev2ChildSaSessionInsert (&IkeSaSession->ChildSaEstablishSessionList, ChildSaSession);
 609
 610   //
 611   // Create a Notify event for the IKE SA life time counting.
 612   //
 613   Status = gBS->CreateEvent (
 614                   EVT_TIMER | EVT_NOTIFY_SIGNAL,
 615                   TPL_CALLBACK,
 616                   Ikev2LifetimeNotify,
 617                   SessionCommon,
 618                   &SessionCommon->TimeoutEvent
 619                   );
 620   if (EFI_ERROR(Status)){
 621     return ;
 622   }
 623
 624   //
 625   // Start to count the lifetime of the IKE SA.
 626   //
 627   if (ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime != 0){
 628     Lifetime = ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;
 629   } else {
 630     Lifetime = CHILD_SA_DEFAULT_LIFETIME;
 631   }
 632
 633   Status = gBS->SetTimer (
 634                   SessionCommon->TimeoutEvent,
 635                   TimerRelative,
 636                   MultU64x32(Lifetime, 10000000) // ms->100ns
 637                   );
 638   if (EFI_ERROR(Status)){
 639     return ;
 640   }
 641
 642   DEBUG ((
 643     DEBUG_INFO,
 644     "\n------ChildSa established and start to count down %d seconds lifetime\n",
 645     Lifetime
 646     ));
 647
 648   return ;
 649 }
 650
 651 /**
 652   Find the ChildSaSession by it's MessagId.
 653
 654   @param[in] SaSessionList  Pointer to a ChildSaSession List.
 655   @param[in] Mid            The messageId used to search ChildSaSession.
 656
 657   @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.
 658
 659 **/
 660 IKEV2_CHILD_SA_SESSION *
 661 Ikev2ChildSaSessionLookupByMid (
 662   IN LIST_ENTRY           *SaSessionList,
 663   IN UINT32               Mid
 664   )
 665 {
 666   LIST_ENTRY              *Entry;
 667   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 668
 669   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 670     ChildSaSession  = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 671
 672     if (ChildSaSession->MessageId == Mid) {
 673       return ChildSaSession;
 674     }
 675   }
 676   return NULL;
 677 }
 678
 679 /**
 680   This function find the Child SA by the specified SPI.
 681
 682   This functin find a ChildSA session by searching the ChildSaSessionlist of
 683   the input IKEV2_SA_SESSION by specified MessageID.
 684
 685   @param[in]  SaSessionList      Pointer to List to be searched.
 686   @param[in]  Spi                Specified SPI.
 687
 688   @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.
 689
 690 **/
 691 IKEV2_CHILD_SA_SESSION *
 692 Ikev2ChildSaSessionLookupBySpi (
 693   IN LIST_ENTRY           *SaSessionList,
 694   IN UINT32               Spi
 695   )
 696 {
 697   LIST_ENTRY              *Entry;
 698   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 699
 700   NET_LIST_FOR_EACH (Entry, SaSessionList) {
 701     ChildSaSession  = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 702
 703     if (ChildSaSession->RemotePeerSpi == Spi || ChildSaSession->LocalPeerSpi == Spi) {
 704       return ChildSaSession;
 705     }
 706   }
 707
 708   return NULL;
 709 }
 710
 711 /**
 712   Insert a Child SA Session into the specified ChildSa list.
 713
 714   @param[in]  SaSessionList   Pointer to list to be inserted in.
 715   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION to be inserted.
 716
 717 **/
 718 VOID
 719 Ikev2ChildSaSessionInsert (
 720   IN LIST_ENTRY               *SaSessionList,
 721   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
 722   )
 723 {
 724  InsertTailList (SaSessionList, &ChildSaSession->ByIkeSa);
 725 }
 726
 727 /**
 728   Remove the IKEV2_CHILD_SA_SESSION from IkeSaSessionList.
 729
 730   @param[in]  SaSessionList      The SA Session List to be iterated.
 731   @param[in]  Spi                Spi used to identified the IKEV2_CHILD_SA_SESSION.
 732   @param[in]  ListType           The type of the List to indicate whether it is a
 733                                  Established.
 734
 735   @return The point to IKEV2_CHILD_SA_SESSION or NULL.
 736
 737 **/
 738 IKEV2_CHILD_SA_SESSION *
 739 Ikev2ChildSaSessionRemove (
 740   IN LIST_ENTRY           *SaSessionList,
 741   IN UINT32               Spi,
 742   IN UINT8                ListType
 743   )
 744 {
 745   LIST_ENTRY              *Entry;
 746   LIST_ENTRY              *NextEntry;
 747   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
 748
 749   NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, SaSessionList) {
 750
 751     if (ListType == IKEV2_ESTABLISHED_CHILDSA_LIST || ListType == IKEV2_ESTABLISHING_CHILDSA_LIST) {
 752       ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);
 753     } else if (ListType == IKEV2_DELET_CHILDSA_LIST) {
 754       ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_DEL_SA (Entry);
 755     } else {
 756       return NULL;
 757     }
 758
 759     if (ChildSaSession->RemotePeerSpi == Spi || ChildSaSession->LocalPeerSpi == Spi) {
 760       RemoveEntryList (Entry);
 761       return ChildSaSession;
 762     }
 763   }
 764
 765   return NULL;
 766 }
 767
 768 /**
 769   Mark a specified Child SA Session as on deleting.
 770
 771   @param[in]  ChildSaSession   Pointer to IKEV2_CHILD_SA_SESSION.
 772
 773   @retval     EFI_SUCCESS      Operation is successful.
 774
 775 **/
 776 EFI_STATUS
 777 Ikev2ChildSaSessionOnDeleting (
 778   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
 779   )
 780 {
 781   return EFI_SUCCESS;
 782 }
 783
 784 /**
 785   Free the memory located for the specified IKEV2_CHILD_SA_SESSION.
 786
 787   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION.
 788
 789 **/
 790 VOID
 791 Ikev2ChildSaSessionFree (
 792   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
 793   )
 794 {
 795   IKEV2_SESSION_COMMON  *SessionCommon;
 796
 797   SessionCommon = &ChildSaSession->SessionCommon;
 798   if (ChildSaSession->SaData != NULL) {
 799     FreePool (ChildSaSession->SaData);
 800   }
 801
 802   if (ChildSaSession->NiBlock != NULL) {
 803     FreePool (ChildSaSession->NiBlock);
 804   }
 805
 806   if (ChildSaSession->NrBlock != NULL) {
 807     FreePool (ChildSaSession->NrBlock);
 808   }
 809
 810   if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey != NULL) {
 811     FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey);
 812   }
 813
 814   if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey != NULL) {
 815     FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey);
 816   }
 817
 818   if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey != NULL) {
 819     FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey);
 820   }
 821
 822   if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey != NULL) {
 823     FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey);
 824   }
 825
 826   //
 827   // Delete DhBuffer
 828   //
 829   Ikev2DhBufferFree (ChildSaSession->DhBuffer);
 830
 831   //
 832   // Delete SpdSelector
 833   //
 834   if (ChildSaSession->SpdSelector != NULL) {
 835     if (ChildSaSession->SpdSelector->LocalAddress != NULL) {
 836       FreePool (ChildSaSession->SpdSelector->LocalAddress);
 837     }
 838     if (ChildSaSession->SpdSelector->RemoteAddress != NULL) {
 839       FreePool (ChildSaSession->SpdSelector->RemoteAddress);
 840     }
 841     FreePool (ChildSaSession->SpdSelector);
 842   }
 843   Ikev2SaSessionCommonFree (SessionCommon);
 844   FreePool (ChildSaSession);
 845
 846   return ;
 847 }
 848
 849 /**
 850   Delete the specified established Child SA.
 851
 852   This function delete the Child SA directly and don't send the Information Packet to
 853   remote peer.
 854
 855   @param[in]  IkeSaSession   Pointer to a IKE SA Session used to be searched for.
 856   @param[in]  Spi            SPI used to find the Child SA.
 857
 858   @retval     EFI_NOT_FOUND  Pointer of IKE SA Session is NULL.
 859   @retval     EFI_NOT_FOUND  There is no specified Child SA related with the input
 860                              SPI under this IKE SA Session.
 861   @retval     EFI_SUCCESS    Delete the Child SA successfully.
 862
 863 **/
 864 EFI_STATUS
 865 Ikev2ChildSaSilentDelete (
 866   IN IKEV2_SA_SESSION       *IkeSaSession,
 867   IN UINT32                 Spi
 868   )
 869 {
 870   EFI_STATUS                Status;
 871   EFI_IPSEC_CONFIG_SELECTOR *Selector;
 872   UINTN                     SelectorSize;
 873   BOOLEAN                   IsLocalFound;
 874   BOOLEAN                   IsRemoteFound;
 875   UINT32                    LocalSpi;
 876   UINT32                    RemoteSpi;
 877   IKEV2_CHILD_SA_SESSION    *ChildSession;
 878   EFI_IPSEC_CONFIG_SELECTOR *LocalSelector;
 879   EFI_IPSEC_CONFIG_SELECTOR *RemoteSelector;
 880   IPSEC_PRIVATE_DATA        *Private;
 881
 882   if (IkeSaSession == NULL) {
 883     return EFI_NOT_FOUND;
 884   }
 885
 886   IsLocalFound    = FALSE;
 887   IsRemoteFound   = FALSE;
 888   ChildSession    = NULL;
 889   LocalSelector   = NULL;
 890   RemoteSelector  = NULL;
 891
 892   Private = IkeSaSession->SessionCommon.Private;
 893
 894   //
 895   // Remove the Established SA from ChildSaEstablishlist.
 896   //
 897   ChildSession = Ikev2ChildSaSessionRemove(
 898                    &(IkeSaSession->ChildSaEstablishSessionList),
 899                    Spi,
 900                    IKEV2_ESTABLISHED_CHILDSA_LIST
 901                    );
 902   if (ChildSession == NULL) {
 903     return EFI_NOT_FOUND;
 904   }
 905
 906   LocalSpi  = ChildSession->LocalPeerSpi;
 907   RemoteSpi = ChildSession->RemotePeerSpi;
 908
 909   SelectorSize  = sizeof (EFI_IPSEC_CONFIG_SELECTOR);
 910   Selector      = AllocateZeroPool (SelectorSize);
 911   ASSERT (Selector != NULL);
 912
 913
 914
 915   while (1) {
 916     Status = EfiIpSecConfigGetNextSelector (
 917                &Private->IpSecConfig,
 918                IPsecConfigDataTypeSad,
 919                &SelectorSize,
 920                Selector
 921                );
 922     if (Status == EFI_BUFFER_TOO_SMALL) {
 923       FreePool (Selector);
 924
 925       Selector = AllocateZeroPool (SelectorSize);
 926       ASSERT (Selector != NULL);
 927       Status   = EfiIpSecConfigGetNextSelector (
 928                    &Private->IpSecConfig,
 929                    IPsecConfigDataTypeSad,
 930                    &SelectorSize,
 931                    Selector
 932                    );
 933     }
 934
 935     if (EFI_ERROR (Status)) {
 936       break;
 937     }
 938
 939     if (Selector->SaId.Spi == RemoteSpi) {
 940       //
 941       // SPI is unique. There is only one SAD whose SPI is
 942       // same with RemoteSpi.
 943       //
 944       IsRemoteFound   = TRUE;
 945       RemoteSelector  = AllocateZeroPool (SelectorSize);
 946       ASSERT (RemoteSelector != NULL);
 947       CopyMem (RemoteSelector, Selector, SelectorSize);
 948     }
 949
 950     if (Selector->SaId.Spi == LocalSpi) {
 951       //
 952       // SPI is unique. There is only one SAD whose SPI is
 953       // same with LocalSpi.
 954       //
 955       IsLocalFound  = TRUE;
 956       LocalSelector = AllocateZeroPool (SelectorSize);
 957       ASSERT (LocalSelector != NULL);
 958       CopyMem (LocalSelector, Selector, SelectorSize);
 959     }
 960   }
 961   //
 962   // Delete SA from the Variable.
 963   //
 964   if (IsLocalFound) {
 965     Status = EfiIpSecConfigSetData (
 966                &Private->IpSecConfig,
 967                IPsecConfigDataTypeSad,
 968                LocalSelector,
 969                NULL,
 970                NULL
 971                );
 972   }
 973
 974   if (IsRemoteFound) {
 975     Status = EfiIpSecConfigSetData (
 976                &Private->IpSecConfig,
 977                IPsecConfigDataTypeSad,
 978                RemoteSelector,
 979                NULL,
 980                NULL
 981                );
 982
 983   }
 984
 985   DEBUG (
 986     (DEBUG_INFO,
 987     "\n------IKEV2 deleted ChildSa(local spi, remote spi):(0x%x, 0x%x)------\n",
 988     LocalSpi,
 989     RemoteSpi)
 990     );
 991   Ikev2ChildSaSessionFree (ChildSession);
 992
 993   if (RemoteSelector != NULL) {
 994     FreePool (RemoteSelector);
 995   }
 996
 997   if (LocalSelector != NULL) {
 998     FreePool (LocalSelector);
 999   }
1000
1001   if (Selector != NULL) {
1002     FreePool (Selector);
1003   }
1004
1005   return Status;
1006 }
1007
1008 /**
1009   Free the specified DhBuffer.
1010
1011   @param[in] DhBuffer   Pointer to IKEV2_DH_BUFFER to be freed.
1012
1013 **/
1014 VOID
1015 Ikev2DhBufferFree (
1016   IKEV2_DH_BUFFER *DhBuffer
1017 )
1018 {
1019   if (DhBuffer != NULL) {
1020     if (DhBuffer->GxBuffer != NULL) {
1021       FreePool (DhBuffer->GxBuffer);
1022     }
1023     if (DhBuffer->GyBuffer != NULL) {
1024       FreePool (DhBuffer->GyBuffer);
1025     }
1026     if (DhBuffer->GxyBuffer != NULL) {
1027       FreePool (DhBuffer->GxyBuffer);
1028     }
1029     if (DhBuffer->DhContext != NULL) {
1030       IpSecCryptoIoFreeDh (&DhBuffer->DhContext);
1031     }
1032     FreePool (DhBuffer);
1033   }
1034 }
1035
1036 /**
1037   This function is to parse a request IKE packet and return its request type.
1038   The request type is one of IKE CHILD SA creation, IKE SA rekeying and
1039   IKE CHILD SA rekeying.
1040
1041   @param[in] IkePacket  IKE packet to be prased.
1042
1043   return the type of the IKE packet.
1044
1045 **/
1046 IKEV2_CREATE_CHILD_REQUEST_TYPE
1047 Ikev2ChildExchangeRequestType(
1048   IN IKE_PACKET               *IkePacket
1049   )
1050 {
1051   BOOLEAN       Flag;
1052   LIST_ENTRY    *Entry;
1053   IKE_PAYLOAD   *IkePayload;
1054
1055   Flag            = FALSE;
1056
1057   NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {
1058     IkePayload  = IKE_PAYLOAD_BY_PACKET (Entry);
1059     if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_INIT) {
1060       //
1061       // Packet with Ts Payload means it is for either CHILD_SA_CREATE or CHILD_SA_REKEY.
1062       //
1063       Flag = TRUE;
1064     }
1065     if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NOTIFY) {
1066       if (((IKEV2_NOTIFY*)IkePayload)->MessageType == IKEV2_NOTIFICATION_REKEY_SA) {
1067         //
1068         // If notify payload with REKEY_SA message type, the IkePacket is for
1069         // rekeying Child SA.
1070         //
1071         return IkeRequestTypeRekeyChildSa;
1072       }
1073     }
1074   };
1075
1076   if (!Flag){
1077     //
1078     // The Create Child Exchange is for IKE SA rekeying.
1079     //
1080     return IkeRequestTypeRekeyIkeSa;
1081   } else {
1082     //
1083     // If the Notify payloaad with transport mode message type, the IkePacket is
1084     // for create Child SA.
1085     //
1086     return IkeRequestTypeCreateChildSa;
1087   }
1088 }
1089
1090 /**
1091   Associate a SPD selector to the Child SA Session.
1092
1093   This function is called when the Child SA is not the first child SA of its
1094   IKE SA. It associate a SPD to this Child SA.
1095
1096   @param[in, out]  ChildSaSession     Pointer to the Child SA Session to be associated to
1097                                       a SPD selector.
1098
1099   @retval EFI_SUCCESS        Associate one SPD selector to this Child SA Session successfully.
1100   @retval EFI_NOT_FOUND      Can't find the related SPD selector.
1101
1102 **/
1103 EFI_STATUS
1104 Ikev2ChildSaAssociateSpdEntry (
1105   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession
1106   )
1107 {
1108   IpSecVisitConfigData (IPsecConfigDataTypeSpd, Ikev2MatchSpdEntry, ChildSaSession);
1109   if (ChildSaSession->Spd != NULL) {
1110     return EFI_SUCCESS;
1111   } else {
1112     return EFI_NOT_FOUND;
1113   }
1114 }
1115
1116
1117 /**
1118   This function finds the SPI from Create Child SA Exchange Packet.
1119
1120   @param[in] IkePacket       Pointer to IKE_PACKET to be searched.
1121
1122   @retval SPI number or 0 if it is not supported.
1123
1124 **/
1125 UINT32
1126 Ikev2ChildExchangeRekeySpi (
1127   IN IKE_PACKET               *IkePacket
1128   )
1129 {
1130   //
1131   // Not support yet.
1132   //
1133   return 0;
1134 }
1135
1136 /**
1137   Validate the IKE header of received IKE packet.
1138
1139   @param[in]   IkeSaSession  Pointer to IKEV2_SA_SESSION related to this IKE packet.
1140   @param[in]   IkeHdr        Pointer to IKE header of received IKE packet.
1141
1142   @retval TRUE   If the IKE header is valid.
1143   @retval FALSE  If the IKE header is invalid.
1144
1145 **/
1146 BOOLEAN
1147 Ikev2ValidateHeader (
1148   IN IKEV2_SA_SESSION         *IkeSaSession,
1149   IN IKE_HEADER               *IkeHdr
1150   )
1151 {
1152
1153   IKEV2_SESSION_STATE State;
1154
1155   State = IkeSaSession->SessionCommon.State;
1156   if (State == IkeStateInit) {
1157     //
1158     // For the IKE Initial Exchange, the MessagId should be zero.
1159     //
1160     if (IkeHdr->MessageId != 0) {
1161       return FALSE;
1162     }
1163   } else {
1164     if (State == IkeStateAuth) {
1165       if (IkeHdr->MessageId != 1) {
1166         return FALSE;
1167       }
1168     }
1169     if (IkeHdr->InitiatorCookie != IkeSaSession->InitiatorCookie ||
1170         IkeHdr->ResponderCookie != IkeSaSession->ResponderCookie
1171         ) {
1172       //
1173       // TODO: send notification INVALID-COOKIE
1174       //
1175       return FALSE;
1176     }
1177   }
1178
1179   //
1180   // Information Exchagne and Create Child Exchange can be started from each part.
1181   //
1182   if (IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_INFO &&
1183       IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_CREATE_CHILD
1184       ) {
1185     if (IkeSaSession->SessionCommon.IsInitiator) {
1186       if (IkeHdr->InitiatorCookie != IkeSaSession->InitiatorCookie) {
1187         //
1188         // TODO: send notification INVALID-COOKIE
1189         //
1190         return FALSE;
1191       }
1192       if (IkeHdr->Flags != IKE_HEADER_FLAGS_RESPOND) {
1193         return FALSE;
1194       }
1195     } else {
1196       if (IkeHdr->Flags != IKE_HEADER_FLAGS_INIT) {
1197         return FALSE;
1198       }
1199     }
1200   }
1201
1202   return TRUE;
1203 }
1204
1205 /**
1206   Create and intialize IKEV2_SA_DATA for speicifed IKEV2_SESSION_COMMON.
1207
1208   This function will be only called by the initiator. The responder's IKEV2_SA_DATA
1209   will be generated during parsed the initiator packet.
1210
1211   @param[in]  SessionCommon  Pointer to IKEV2_SESSION_COMMON related to.
1212
1213   @retval a Pointer to a new IKEV2_SA_DATA or NULL.
1214
1215 **/
1216 IKEV2_SA_DATA *
1217 Ikev2InitializeSaData (
1218   IN IKEV2_SESSION_COMMON     *SessionCommon
1219   )
1220 {
1221   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
1222   IKEV2_SA_DATA               *SaData;
1223   IKEV2_PROPOSAL_DATA         *ProposalData;
1224   IKEV2_TRANSFORM_DATA        *TransformData;
1225   IKE_SA_ATTRIBUTE            *Attribute;
1226
1227   ASSERT (SessionCommon != NULL);
1228   //
1229   // TODO: Remove the hard code of the support Alogrithm. Those data should be
1230   // get from the SPD/PAD data.
1231   //
1232   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1233     SaData = AllocateZeroPool (
1234                sizeof (IKEV2_SA_DATA) +
1235                sizeof (IKEV2_PROPOSAL_DATA) * 2 +
1236                sizeof (IKEV2_TRANSFORM_DATA) * 4 * 2
1237                );
1238   } else {
1239     SaData = AllocateZeroPool (
1240                sizeof (IKEV2_SA_DATA) +
1241                sizeof (IKEV2_PROPOSAL_DATA) * 2 +
1242                sizeof (IKEV2_TRANSFORM_DATA) * 3 * 2
1243                );
1244   }
1245   if (SaData == NULL) {
1246     return NULL;
1247   }
1248
1249   //
1250   // First proposal payload: 3DES + SHA1 + DH
1251   //
1252   SaData->NumProposals          = 2;
1253   ProposalData                  = (IKEV2_PROPOSAL_DATA *) (SaData + 1);
1254   ProposalData->ProposalIndex   = 1;
1255
1256   //
1257   // If SA data for IKE_SA_INIT exchage, contains 4 transforms. If SA data for
1258   // IKE_AUTH exchange contains 3 transforms.
1259   //
1260   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1261     ProposalData->NumTransforms   = 4;
1262   } else {
1263     ProposalData->NumTransforms   = 3;
1264   }
1265
1266
1267   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1268     ProposalData->ProtocolId    = IPSEC_PROTO_ISAKMP;
1269   } else {
1270     ChildSaSession              = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1271     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;
1272     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));
1273     ASSERT (ProposalData->Spi != NULL);
1274     CopyMem (
1275       ProposalData->Spi,
1276       &ChildSaSession->LocalPeerSpi,
1277       sizeof(ChildSaSession->LocalPeerSpi)
1278     );
1279   }
1280
1281   //
1282   // Set transform attribute for Encryption Algorithm - 3DES
1283   //
1284   TransformData                 = (IKEV2_TRANSFORM_DATA *) (ProposalData + 1);
1285   TransformData->TransformIndex = 0;
1286   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ENCR;
1287   TransformData->TransformId    = IKEV2_TRANSFORM_ID_ENCR_3DES;
1288
1289   //
1290   // Set transform attribute for Integrity Algorithm - SHA1_96
1291   //
1292   TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1293   TransformData->TransformIndex = 1;
1294   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_INTEG;
1295   TransformData->TransformId    = IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96;
1296
1297   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1298     //
1299     // Set transform attribute for Pseduo-Random Function - HAMC_SHA1
1300     //
1301     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1302     TransformData->TransformIndex = 2;
1303     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_PRF;
1304     TransformData->TransformId    = IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1;
1305   }
1306
1307   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1308     //
1309     // Set transform attribute for DH Group - DH 1024
1310     //
1311     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1312     TransformData->TransformIndex = 3;
1313     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_DH;
1314     TransformData->TransformId    = IKEV2_TRANSFORM_ID_DH_1024MODP;
1315   } else {
1316     //
1317     // Transform type for Extended Sequence Numbers. Currently not support Extended
1318     // Sequence Number.
1319     //
1320     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1321     TransformData->TransformIndex = 2;
1322     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ESN;
1323     TransformData->TransformId    = 0;
1324   }
1325
1326   //
1327   // Second proposal payload: 3DES + SHA1 + DH
1328   //
1329   ProposalData                  = (IKEV2_PROPOSAL_DATA *) (TransformData + 1);
1330   ProposalData->ProposalIndex   = 2;
1331
1332   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1333     ProposalData->ProtocolId      = IPSEC_PROTO_ISAKMP;
1334     ProposalData->NumTransforms   = 4;
1335   } else {
1336
1337     ChildSaSession              = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1338     ProposalData->ProtocolId    = IPSEC_PROTO_IPSEC_ESP;
1339     ProposalData->NumTransforms = 3;
1340     ProposalData->Spi           = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));
1341     ASSERT (ProposalData->Spi != NULL);
1342     CopyMem (
1343       ProposalData->Spi,
1344       &ChildSaSession->LocalPeerSpi,
1345       sizeof(ChildSaSession->LocalPeerSpi)
1346     );
1347   }
1348
1349   //
1350   // Set transform attribute for Encryption Algorithm - AES-CBC
1351   //
1352   TransformData                 = (IKEV2_TRANSFORM_DATA *) (ProposalData + 1);
1353   TransformData->TransformIndex = 0;
1354   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ENCR;
1355   TransformData->TransformId    = IKEV2_TRANSFORM_ID_ENCR_AES_CBC;
1356   Attribute                     = &TransformData->Attribute;
1357   Attribute->AttrType           = IKEV2_ATTRIBUTE_TYPE_KEYLEN;
1358   Attribute->Attr.AttrLength    = (UINT16) (8 * IpSecGetEncryptKeyLength (IKEV2_TRANSFORM_ID_ENCR_AES_CBC));
1359
1360   //
1361   // Set transform attribute for Integrity Algorithm - SHA1_96
1362   //
1363   TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1364   TransformData->TransformIndex = 1;
1365   TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_INTEG;
1366   TransformData->TransformId    = IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96;
1367
1368   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1369     //
1370     // Set transform attribute for Pseduo-Random Function - HAMC_SHA1
1371     //
1372     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1373     TransformData->TransformIndex = 2;
1374     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_PRF;
1375     TransformData->TransformId    = IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1;
1376   }
1377
1378   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1379     //
1380     // Set transform attrbiute for DH Group - DH-1024
1381     //
1382     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1383     TransformData->TransformIndex = 3;
1384     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_DH;
1385     TransformData->TransformId    = IKEV2_TRANSFORM_ID_DH_1024MODP;
1386   } else {
1387     //
1388     // Transform type for Extended Sequence Numbers. Currently not support Extended
1389     // Sequence Number.
1390     //
1391     TransformData                 = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);
1392     TransformData->TransformIndex = 2;
1393     TransformData->TransformType  = IKEV2_TRANSFORM_TYPE_ESN;
1394     TransformData->TransformId    = 0;
1395   }
1396
1397   return SaData;
1398 }
1399
1400 /**
1401   Store the SA into SAD.
1402
1403   @param[in]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION.
1404
1405 **/
1406 VOID
1407 Ikev2StoreSaData (
1408   IN IKEV2_CHILD_SA_SESSION   *ChildSaSession
1409   )
1410 {
1411   EFI_STATUS                  Status;
1412   EFI_IPSEC_SA_ID             SaId;
1413   EFI_IPSEC_SA_DATA2           SaData;
1414   IKEV2_SESSION_COMMON        *SessionCommon;
1415   IPSEC_PRIVATE_DATA          *Private;
1416   UINT32                      TempAddressCount;
1417   EFI_IP_ADDRESS_INFO         *TempAddressInfo;
1418
1419   SessionCommon             = &ChildSaSession->SessionCommon;
1420   Private                   = SessionCommon->Private;
1421
1422   ZeroMem (&SaId, sizeof (EFI_IPSEC_SA_ID));
1423   ZeroMem (&SaData, sizeof (EFI_IPSEC_SA_DATA2));
1424
1425   //
1426   // Create a SpdSelector. In this implementation, one SPD represents
1427   // 2 direction traffic, so in here, there needs to reverse the local address
1428   // and remote address for Remote Peer's SA, then reverse again for the locate
1429   // SA.
1430   //
1431   TempAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;
1432   TempAddressInfo  = ChildSaSession->SpdSelector->LocalAddress;
1433
1434   ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->SpdSelector->RemoteAddressCount;
1435   ChildSaSession->SpdSelector->LocalAddress      = ChildSaSession->SpdSelector->RemoteAddress;
1436
1437   ChildSaSession->SpdSelector->RemoteAddress     = TempAddressInfo;
1438   ChildSaSession->SpdSelector->RemoteAddressCount= TempAddressCount;
1439
1440   //
1441   // Set the SaId and SaData.
1442   //
1443   SaId.Spi                 = ChildSaSession->LocalPeerSpi;
1444   SaId.Proto               = EfiIPsecESP;
1445   SaData.AntiReplayWindows = 16;
1446   SaData.SNCount           = 0;
1447   SaData.Mode              = ChildSaSession->Spd->Data->ProcessingPolicy->Mode;
1448
1449   //
1450   // If it is tunnel mode, should add the TunnelDest and TunnelSource for SaData.
1451   //
1452   if (SaData.Mode == EfiIPsecTunnel) {
1453     CopyMem (
1454       &SaData.TunnelSourceAddress,
1455       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,
1456       sizeof (EFI_IP_ADDRESS)
1457       );
1458     CopyMem (
1459       &SaData.TunnelDestinationAddress,
1460       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->LocalTunnelAddress,
1461       sizeof (EFI_IP_ADDRESS)
1462       );
1463   }
1464
1465   CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.LocalPeerIp, sizeof (EFI_IP_ADDRESS));
1466   CopyMem (&SaData.AlgoInfo, &ChildSaSession->ChildKeymats.LocalPeerInfo, sizeof (EFI_IPSEC_ALGO_INFO));
1467   SaData.SpdSelector = ChildSaSession->SpdSelector;
1468
1469   //
1470   // Store the remote SA into SAD.
1471   //
1472   Status = EfiIpSecConfigSetData (
1473              &Private->IpSecConfig,
1474              IPsecConfigDataTypeSad,
1475              (EFI_IPSEC_CONFIG_SELECTOR *) &SaId,
1476              &SaData,
1477              NULL
1478              );
1479   ASSERT_EFI_ERROR (Status);
1480
1481   //
1482   // Store the local SA into SAD.
1483   //
1484   ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;
1485   ChildSaSession->SpdSelector->RemoteAddress      = ChildSaSession->SpdSelector->LocalAddress;
1486
1487   ChildSaSession->SpdSelector->LocalAddress       = TempAddressInfo;
1488   ChildSaSession->SpdSelector->LocalAddressCount  = TempAddressCount;
1489
1490   SaId.Spi = ChildSaSession->RemotePeerSpi;
1491
1492   CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.RemotePeerIp, sizeof (EFI_IP_ADDRESS));
1493   CopyMem (&SaData.AlgoInfo, &ChildSaSession->ChildKeymats.RemotePeerInfo, sizeof (EFI_IPSEC_ALGO_INFO));
1494   SaData.SpdSelector = ChildSaSession->SpdSelector;
1495
1496   //
1497   // If it is tunnel mode, should add the TunnelDest and TunnelSource for SaData.
1498   //
1499   if (SaData.Mode == EfiIPsecTunnel) {
1500     CopyMem (
1501       &SaData.TunnelSourceAddress,
1502       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->LocalTunnelAddress,
1503       sizeof (EFI_IP_ADDRESS)
1504       );
1505     CopyMem (
1506       &SaData.TunnelDestinationAddress,
1507       &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,
1508       sizeof (EFI_IP_ADDRESS)
1509       );
1510   }
1511
1512   Status = EfiIpSecConfigSetData (
1513              &Private->IpSecConfig,
1514              IPsecConfigDataTypeSad,
1515              (EFI_IPSEC_CONFIG_SELECTOR *) &SaId,
1516              &SaData,
1517              NULL
1518              );
1519
1520   ASSERT_EFI_ERROR (Status);
1521 }
1522
1523 /**
1524   Call back function of the IKE life time is over.
1525
1526   This function will mark the related IKE SA Session as deleting and trigger a
1527   Information negotiation.
1528
1529   @param[in]    Event     The signaled Event.
1530   @param[in]    Context   Pointer to data passed by caller.
1531
1532 **/
1533 VOID
1534 EFIAPI
1535 Ikev2LifetimeNotify (
1536   IN EFI_EVENT                Event,
1537   IN VOID                     *Context
1538   )
1539 {
1540   IKEV2_SA_SESSION            *IkeSaSession;
1541   IKEV2_CHILD_SA_SESSION      *ChildSaSession;
1542   IKEV2_SESSION_COMMON        *SessionCommon;
1543
1544   ASSERT (Context != NULL);
1545   SessionCommon = (IKEV2_SESSION_COMMON *) Context;
1546
1547   if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1548     IkeSaSession = IKEV2_SA_SESSION_FROM_COMMON (SessionCommon);
1549     DEBUG ((
1550       DEBUG_INFO,
1551       "\n---IkeSa Lifetime is out(cookie_i, cookie_r):(0x%lx, 0x%lx)---\n",
1552       IkeSaSession->InitiatorCookie,
1553       IkeSaSession->ResponderCookie
1554       ));
1555
1556     //
1557     // Change the  IKE SA Session's State to IKE_STATE_SA_DELETING.
1558     //
1559     IKEV2_DUMP_STATE (IkeSaSession->SessionCommon.State, IkeStateSaDeleting);
1560     IkeSaSession->SessionCommon.State = IkeStateSaDeleting;
1561
1562   } else {
1563     ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1564     IkeSaSession   = ChildSaSession->IkeSaSession;
1565
1566     //
1567     // Link the timeout child SA to the DeleteSaList.
1568     //
1569     InsertTailList (&IkeSaSession->DeleteSaList, &ChildSaSession->ByDelete);
1570
1571     //
1572     // Change the Child SA Session's State to IKE_STATE_SA_DELETING.
1573     //
1574     DEBUG ((
1575       DEBUG_INFO,
1576       "\n------ChildSa Lifetime is out(SPI):(0x%x)------\n",
1577       ChildSaSession->LocalPeerSpi
1578       ));
1579   }
1580
1581   //
1582   // TODO: Send the delete info packet or delete silently
1583   //
1584   mIkev2Exchange.NegotiateInfo ((UINT8 *) IkeSaSession, NULL);
1585 }
1586
1587 /**
1588   This function will be called if the TimeOut Event is signaled.
1589
1590   @param[in]  Event      The signaled Event.
1591   @param[in]  Context    The data passed by caller.
1592
1593 **/
1594 VOID
1595 EFIAPI
1596 Ikev2ResendNotify (
1597   IN EFI_EVENT                 Event,
1598   IN VOID                      *Context
1599   )
1600 {
1601   IPSEC_PRIVATE_DATA           *Private;
1602   IKEV2_SA_SESSION             *IkeSaSession;
1603   IKEV2_CHILD_SA_SESSION       *ChildSaSession;
1604   IKEV2_SESSION_COMMON         *SessionCommon;
1605   LIST_ENTRY                   *ChildSaEntry;
1606   UINT8                        Value;
1607   EFI_STATUS                   Status;
1608
1609   ASSERT (Context != NULL);
1610   IkeSaSession   = NULL;
1611   ChildSaSession = NULL;
1612   SessionCommon  = (IKEV2_SESSION_COMMON *) Context;
1613   Private        = SessionCommon->Private;
1614
1615   //
1616   // Remove the SA session from the processing list if exceed the max retry.
1617   //
1618   if (SessionCommon->RetryCount > IKE_MAX_RETRY) {
1619     if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {
1620       IkeSaSession = IKEV2_SA_SESSION_FROM_COMMON (SessionCommon);
1621       if (IkeSaSession->SessionCommon.State == IkeStateSaDeleting) {
1622
1623         //
1624         // If the IkeSaSession is initiator, delete all its Child SAs before removing IKE SA.
1625         // If the IkesaSession is responder, all ChildSa has been remove in Ikev2HandleInfo();
1626         //
1627         for (ChildSaEntry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;
1628              ChildSaEntry != &IkeSaSession->ChildSaEstablishSessionList;
1629         ) {
1630           ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (ChildSaEntry);
1631           //
1632           // Move to next ChildSa Entry.
1633           //
1634           ChildSaEntry = ChildSaEntry->ForwardLink;
1635           //
1636           // Delete LocalSpi & RemoteSpi and remove the ChildSaSession from the
1637           // EstablishedChildSaList.
1638           //
1639           Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);
1640         }
1641
1642         //
1643         // If the IKE SA Delete Payload wasn't sent out successfully, Delete it from the EstablishedList.
1644         //
1645         Ikev2SaSessionRemove (&Private->Ikev2EstablishedList, &SessionCommon->RemotePeerIp);
1646
1647         if (Private != NULL && Private->IsIPsecDisabling) {
1648             //
1649             // After all IKE SAs were deleted, set the IPSEC_STATUS_DISABLED value in
1650             // IPsec status variable.
1651             //
1652             if (IsListEmpty (&Private->Ikev1EstablishedList) && IsListEmpty (&Private->Ikev2EstablishedList)) {
1653               Value = IPSEC_STATUS_DISABLED;
1654               Status = gRT->SetVariable (
1655                               IPSECCONFIG_STATUS_NAME,
1656                               &gEfiIpSecConfigProtocolGuid,
1657                               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,
1658                               sizeof (Value),
1659                               &Value
1660                               );
1661               if (!EFI_ERROR (Status)) {
1662                 //
1663                 // Set the Disabled Flag in Private data.
1664                 //
1665                 Private->IpSec.DisabledFlag = TRUE;
1666                 Private->IsIPsecDisabling   = FALSE;
1667               }
1668             }
1669           }
1670       } else {
1671         Ikev2SaSessionRemove (&Private->Ikev2SessionList, &SessionCommon->RemotePeerIp);
1672       }
1673       Ikev2SaSessionFree (IkeSaSession);
1674
1675     } else {
1676
1677       //
1678       // If the packet sent by Child SA.
1679       //
1680       ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);
1681       IkeSaSession   = ChildSaSession->IkeSaSession;
1682       if (ChildSaSession->SessionCommon.State == IkeStateSaDeleting) {
1683
1684         //
1685         // Established Child SA should be remove from the SAD entry and
1686         // DeleteList. The function of Ikev2DeleteChildSaSilent() will remove
1687         // the childSA from the IkeSaSession->ChildSaEstablishedList. So there
1688         // is no need to remove it here.
1689         //
1690         Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);
1691         Ikev2ChildSaSessionRemove (
1692           &IkeSaSession->DeleteSaList,
1693           ChildSaSession->LocalPeerSpi,
1694           IKEV2_DELET_CHILDSA_LIST
1695           );
1696       } else {
1697         Ikev2ChildSaSessionRemove (
1698           &IkeSaSession->ChildSaSessionList,
1699           ChildSaSession->LocalPeerSpi,
1700           IKEV2_ESTABLISHING_CHILDSA_LIST
1701           );
1702       }
1703
1704       Ikev2ChildSaSessionFree (ChildSaSession);
1705     }
1706     return ;
1707   }
1708
1709   //
1710   // Increase the retry count.
1711   //
1712   SessionCommon->RetryCount++;
1713   DEBUG ((DEBUG_INFO, ">>>Resending the last packet ...\n"));
1714
1715   //
1716   // Resend the last packet.
1717   //
1718   Ikev2SendIkePacket (
1719     SessionCommon->UdpService,
1720     (UINT8*)SessionCommon,
1721     SessionCommon->LastSentPacket,
1722     0
1723     );
1724 }
1725
1726 /**
1727   Copy ChildSaSession->Spd->Selector to ChildSaSession->SpdSelector.
1728
1729   ChildSaSession->SpdSelector stores the real Spdselector for its SA. Sometime,
1730   the SpdSelector in ChildSaSession is more accurated or the scope is smaller
1731   than the one in ChildSaSession->Spd, especially for the tunnel mode.
1732
1733   @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to.
1734
1735 **/
1736 VOID
1737 Ikev2ChildSaSessionSpdSelectorCreate (
1738   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession
1739   )
1740 {
1741   if (ChildSaSession->Spd != NULL && ChildSaSession->Spd->Selector != NULL) {
1742     if (ChildSaSession->SpdSelector == NULL) {
1743       ChildSaSession->SpdSelector = AllocateZeroPool (sizeof (EFI_IPSEC_SPD_SELECTOR));
1744       ASSERT (ChildSaSession->SpdSelector != NULL);
1745     }
1746     CopyMem (
1747       ChildSaSession->SpdSelector,
1748       ChildSaSession->Spd->Selector,
1749       sizeof (EFI_IPSEC_SPD_SELECTOR)
1750       );
1751     ChildSaSession->SpdSelector->RemoteAddress = AllocateCopyPool (
1752                                                    ChildSaSession->Spd->Selector->RemoteAddressCount *
1753                                                    sizeof (EFI_IP_ADDRESS_INFO),
1754                                                    ChildSaSession->Spd->Selector->RemoteAddress
1755                                                    );
1756     ChildSaSession->SpdSelector->LocalAddress = AllocateCopyPool (
1757                                                   ChildSaSession->Spd->Selector->LocalAddressCount *
1758                                                   sizeof (EFI_IP_ADDRESS_INFO),
1759                                                   ChildSaSession->Spd->Selector->LocalAddress
1760                                                   );
1761
1762     ASSERT (ChildSaSession->SpdSelector->LocalAddress != NULL);
1763     ASSERT (ChildSaSession->SpdSelector->RemoteAddress != NULL);
1764
1765     ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->Spd->Selector->RemoteAddressCount;
1766     ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->Spd->Selector->LocalAddressCount;
1767   }
1768 }
1769
1770 /**
1771   Generate a ChildSa Session and insert it into related IkeSaSession.
1772
1773   @param[in]  IkeSaSession    Pointer to related IKEV2_SA_SESSION.
1774   @param[in]  UdpService      Pointer to related IKE_UDP_SERVICE.
1775
1776   @return pointer of IKEV2_CHILD_SA_SESSION.
1777
1778 **/
1779 IKEV2_CHILD_SA_SESSION *
1780 Ikev2ChildSaSessionCreate (
1781   IN IKEV2_SA_SESSION   *IkeSaSession,
1782   IN IKE_UDP_SERVICE     *UdpService
1783   )
1784 {
1785   IKEV2_CHILD_SA_SESSION    *ChildSaSession;
1786   IKEV2_SESSION_COMMON      *ChildSaCommon;
1787
1788   //
1789   // Create a new ChildSaSession.Insert it into processing list and initiate the common parameters.
1790   //
1791   ChildSaSession = Ikev2ChildSaSessionAlloc (UdpService, IkeSaSession);
1792   ASSERT (ChildSaSession != NULL);
1793
1794   //
1795   // Set the specific parameters.
1796   //
1797   ChildSaSession->Spd        = IkeSaSession->Spd;
1798   ChildSaCommon              = &ChildSaSession->SessionCommon;
1799   ChildSaCommon->IsInitiator = IkeSaSession->SessionCommon.IsInitiator;
1800   if (IkeSaSession->SessionCommon.State == IkeStateAuth) {
1801     ChildSaCommon->State     = IkeStateAuth;
1802     IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateAuth);
1803   } else {
1804     ChildSaCommon->State     = IkeStateCreateChild;
1805     IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateCreateChild);
1806   }
1807
1808   //
1809   // If SPD->Selector is not NULL, copy it to the ChildSaSession->SpdSelector.
1810   // The ChildSaSession->SpdSelector might be changed after the traffic selector
1811   // negoniation and it will be copied into the SAData after ChildSA established.
1812   //
1813   Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession);
1814
1815   //
1816   // Copy first NiBlock and NrBlock to ChildSa Session
1817   //
1818   ChildSaSession->NiBlock   = AllocateZeroPool (IkeSaSession->NiBlkSize);
1819   ASSERT (ChildSaSession->NiBlock != NULL);
1820   ChildSaSession->NiBlkSize = IkeSaSession->NiBlkSize;
1821   CopyMem (ChildSaSession->NiBlock, IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);
1822
1823   ChildSaSession->NrBlock   = AllocateZeroPool (IkeSaSession->NrBlkSize);
1824   ASSERT (ChildSaSession->NrBlock != NULL);
1825   ChildSaSession->NrBlkSize = IkeSaSession->NrBlkSize;
1826   CopyMem (ChildSaSession->NrBlock, IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);
1827
1828   //
1829   //  Only if the Create Child SA is called for the IKE_INIT Exchange and
1830   //  IkeSaSession is initiator (Only Initiator's SPD is not NULL), Set the
1831   //  Traffic Selectors related information here.
1832   //
1833   if (IkeSaSession->SessionCommon.State == IkeStateAuth && IkeSaSession->Spd != NULL) {
1834     ChildSaSession->ProtoId = IkeSaSession->Spd->Selector->NextLayerProtocol;
1835     ChildSaSession->LocalPort = IkeSaSession->Spd->Selector->LocalPort;
1836     ChildSaSession->RemotePort = IkeSaSession->Spd->Selector->RemotePort;
1837   }
1838
1839   //
1840   // Insert the new ChildSaSession into processing child SA list.
1841   //
1842   Ikev2ChildSaSessionInsert (&IkeSaSession->ChildSaSessionList, ChildSaSession);
1843   return ChildSaSession;
1844 }
1845
1846 /**
1847   Check if the SPD is related to the input Child SA Session.
1848
1849   This function is the subfunction of Ikev1AssociateSpdEntry(). It is the call
1850   back function of IpSecVisitConfigData().
1851
1852
1853   @param[in]  Type               Type of the input Config Selector.
1854   @param[in]  Selector           Pointer to the Configure Selector to be checked.
1855   @param[in]  Data               Pointer to the Configure Selector's Data passed
1856                                  from the caller.
1857   @param[in]  SelectorSize       The buffer size of Selector.
1858   @param[in]  DataSize           The buffer size of the Data.
1859   @param[in]  Context            The data passed from the caller. It is a Child
1860                                  SA Session in this context.
1861
1862   @retval EFI_SUCCESS        The SPD Selector is not related to the Child SA Session.
1863   @retval EFI_ABORTED        The SPD Selector is related to the Child SA session and
1864                              set the ChildSaSession->Spd to point to this SPD Selector.
1865
1866 **/
1867 EFI_STATUS
1868 Ikev2MatchSpdEntry (
1869   IN EFI_IPSEC_CONFIG_DATA_TYPE     Type,
1870   IN EFI_IPSEC_CONFIG_SELECTOR      *Selector,
1871   IN VOID                           *Data,
1872   IN UINTN                          SelectorSize,
1873   IN UINTN                          DataSize,
1874   IN VOID                           *Context
1875   )
1876 {
1877   IKEV2_CHILD_SA_SESSION  *ChildSaSession;
1878   EFI_IPSEC_SPD_SELECTOR  *SpdSelector;
1879   EFI_IPSEC_SPD_DATA      *SpdData;
1880   BOOLEAN                 IsMatch;
1881   UINT8                   IpVersion;
1882
1883   ASSERT (Type == IPsecConfigDataTypeSpd);
1884   SpdData = (EFI_IPSEC_SPD_DATA *) Data;
1885   //
1886   // Bypass all non-protect SPD entry first
1887   //
1888   if (SpdData->Action != EfiIPsecActionProtect) {
1889     return EFI_SUCCESS;
1890   }
1891
1892   ChildSaSession  = (IKEV2_CHILD_SA_SESSION *) Context;
1893   IpVersion       = ChildSaSession->SessionCommon.UdpService->IpVersion;
1894   SpdSelector     = (EFI_IPSEC_SPD_SELECTOR *) Selector;
1895   IsMatch         = TRUE;
1896
1897   if (SpdSelector->NextLayerProtocol == EFI_IP_PROTO_UDP &&
1898       SpdSelector->LocalPort == IKE_DEFAULT_PORT &&
1899       SpdSelector->LocalPortRange == 0 &&
1900       SpdSelector->RemotePort == IKE_DEFAULT_PORT &&
1901       SpdSelector->RemotePortRange == 0
1902       ) {
1903     //
1904     // TODO: Skip IKE Policy here or set a SPD entry?
1905     //
1906     return EFI_SUCCESS;
1907   }
1908
1909   if (SpdSelector->NextLayerProtocol != EFI_IPSEC_ANY_PROTOCOL &&
1910       SpdSelector->NextLayerProtocol != ChildSaSession->ProtoId
1911       ) {
1912     IsMatch = FALSE;
1913   }
1914
1915   if (SpdSelector->LocalPort != EFI_IPSEC_ANY_PORT && SpdSelector->LocalPort != ChildSaSession->LocalPort) {
1916     IsMatch = FALSE;
1917   }
1918
1919   if (SpdSelector->RemotePort != EFI_IPSEC_ANY_PORT && SpdSelector->RemotePort != ChildSaSession->RemotePort) {
1920     IsMatch = FALSE;
1921   }
1922
1923   IsMatch = (BOOLEAN) (IsMatch &&
1924                        IpSecMatchIpAddress (
1925                          IpVersion,
1926                          &ChildSaSession->SessionCommon.LocalPeerIp,
1927                          SpdSelector->LocalAddress,
1928                          SpdSelector->LocalAddressCount
1929                          ));
1930
1931   IsMatch = (BOOLEAN) (IsMatch &&
1932                        IpSecMatchIpAddress (
1933                          IpVersion,
1934                          &ChildSaSession->SessionCommon.RemotePeerIp,
1935                          SpdSelector->RemoteAddress,
1936                          SpdSelector->RemoteAddressCount
1937                          ));
1938
1939   if (IsMatch) {
1940     ChildSaSession->Spd = IkeSearchSpdEntry (SpdSelector);
1941     return EFI_ABORTED;
1942   } else {
1943     return EFI_SUCCESS;
1944   }
1945 }
1946
1947 /**
1948   Check if the Algorithm ID is supported.
1949
1950   @param[in]  AlgorithmId The specified Algorithm ID.
1951   @param[in]  Type        The type used to indicate the Algorithm is for Encrypt or
1952                           Authentication.
1953
1954   @retval     TRUE        If the Algorithm ID is supported.
1955   @retval     FALSE       If the Algorithm ID is not supported.
1956
1957 **/
1958 BOOLEAN
1959 Ikev2IsSupportAlg (
1960   IN UINT16 AlgorithmId,
1961   IN UINT8  Type
1962   )
1963 {
1964   UINT8 Index;
1965   switch (Type) {
1966   case IKE_ENCRYPT_TYPE :
1967     for (Index = 0; Index < IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM; Index++) {
1968       if (mIkev2EncryptAlgorithmList[Index] == AlgorithmId) {
1969         return TRUE;
1970       }
1971     }
1972     break;
1973
1974   case IKE_AUTH_TYPE :
1975     for (Index = 0; Index < IKEV2_SUPPORT_AUTH_ALGORITHM_NUM; Index++) {
1976       if (mIkev2AuthAlgorithmList[Index] == AlgorithmId) {
1977         return TRUE;
1978       }
1979     }
1980     break;
1981
1982   case IKE_DH_TYPE :
1983     for (Index = 0; Index < IKEV2_SUPPORT_DH_ALGORITHM_NUM; Index++) {
1984       if (mIkev2DhGroupAlgorithmList[Index] == AlgorithmId) {
1985         return TRUE;
1986       }
1987     }
1988     break;
1989
1990   case IKE_PRF_TYPE :
1991     for (Index = 0; Index < IKEV2_SUPPORT_PRF_ALGORITHM_NUM; Index++) {
1992       if (mIkev2PrfAlgorithmList[Index] == AlgorithmId) {
1993         return TRUE;
1994       }
1995     }
1996   }
1997   return FALSE;
1998 }
1999
2000 /**
2001   Get the preferred algorithm types from ProposalData.
2002
2003   @param[in]  ProposalData              Pointer to related IKEV2_PROPOSAL_DATA.
2004   @param[out] PreferEncryptAlgorithm    Output of preferred encrypt algorithm.
2005   @param[out] PreferIntegrityAlgorithm  Output of preferred integrity algorithm.
2006   @param[out] PreferPrfAlgorithm        Output of preferred PRF algorithm. Only
2007                                         for IKE SA.
2008   @param[out] PreferDhGroup             Output of preferred DH group. Only for
2009                                         IKE SA.
2010   @param[out] PreferEncryptKeylength    Output of preferred encrypt key length
2011                                         in bytes.
2012   @param[out] IsSupportEsn              Output of value about the Extented Sequence
2013                                         Number is support or not. Only for Child SA.
2014   @param[in]  IsChildSa                 If it is ture, the ProposalData is for IKE
2015                                         SA. Otherwise the proposalData is for Child SA.
2016
2017 **/
2018 VOID
2019 Ikev2ParseProposalData (
2020   IN     IKEV2_PROPOSAL_DATA  *ProposalData,
2021      OUT UINT16               *PreferEncryptAlgorithm,
2022      OUT UINT16               *PreferIntegrityAlgorithm,
2023      OUT UINT16               *PreferPrfAlgorithm,
2024      OUT UINT16               *PreferDhGroup,
2025      OUT UINTN                *PreferEncryptKeylength,
2026      OUT BOOLEAN              *IsSupportEsn,
2027   IN     BOOLEAN              IsChildSa
2028 )
2029 {
2030   IKEV2_TRANSFORM_DATA *TransformData;
2031   UINT8                TransformIndex;
2032
2033   //
2034   // Check input parameters.
2035   //
2036   if (ProposalData == NULL ||
2037       PreferEncryptAlgorithm == NULL ||
2038       PreferIntegrityAlgorithm == NULL ||
2039       PreferEncryptKeylength == NULL
2040       ) {
2041     return;
2042   }
2043
2044   if (IsChildSa) {
2045     if (IsSupportEsn == NULL) {
2046       return;
2047     }
2048   } else {
2049     if (PreferPrfAlgorithm == NULL || PreferDhGroup == NULL) {
2050       return;
2051     }
2052   }
2053
2054   TransformData = (IKEV2_TRANSFORM_DATA *)(ProposalData + 1);
2055   for (TransformIndex = 0; TransformIndex < ProposalData->NumTransforms; TransformIndex++) {
2056     switch (TransformData->TransformType) {
2057     //
2058     // For IKE SA there are four algorithm types. Encryption Algorithm, Pseudo-random Function,
2059     // Integrity Algorithm, Diffie-Hellman Group. For Child SA, there are three algorithm types.
2060     // Encryption Algorithm, Integrity Algorithm, Extended Sequence Number.
2061     //
2062     case IKEV2_TRANSFORM_TYPE_ENCR:
2063       if (*PreferEncryptAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_ENCRYPT_TYPE)) {
2064         //
2065         // Check the attribute value. According to RFC, only Keylength is support.
2066         //
2067         if (TransformData->Attribute.AttrType == IKEV2_ATTRIBUTE_TYPE_KEYLEN) {
2068           //
2069           // If the Keylength is not support, continue to check the next one.
2070           //
2071           if (IpSecGetEncryptKeyLength ((UINT8)TransformData->TransformId) != (UINTN)(TransformData->Attribute.Attr.AttrValue >> 3)){
2072             break;
2073           } else {
2074             *PreferEncryptKeylength = TransformData->Attribute.Attr.AttrValue;
2075           }
2076         }
2077         *PreferEncryptAlgorithm = TransformData->TransformId;
2078       }
2079       break;
2080
2081     case IKEV2_TRANSFORM_TYPE_PRF :
2082       if (!IsChildSa) {
2083         if (*PreferPrfAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_PRF_TYPE)) {
2084           *PreferPrfAlgorithm = TransformData->TransformId;
2085         }
2086       }
2087       break;
2088
2089     case IKEV2_TRANSFORM_TYPE_INTEG :
2090       if (*PreferIntegrityAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_AUTH_TYPE)) {
2091         *PreferIntegrityAlgorithm = TransformData->TransformId;
2092       }
2093       break;
2094
2095     case IKEV2_TRANSFORM_TYPE_DH :
2096       if (!IsChildSa) {
2097         if (*PreferDhGroup == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_DH_TYPE)) {
2098           *PreferDhGroup = TransformData->TransformId;
2099         }
2100       }
2101       break;
2102
2103     case IKEV2_TRANSFORM_TYPE_ESN :
2104       if (IsChildSa) {
2105         if (TransformData->TransformId != 0) {
2106           *IsSupportEsn = TRUE;
2107         }
2108       }
2109       break;
2110
2111     default:
2112       break;
2113     }
2114     TransformData = (IKEV2_TRANSFORM_DATA *)(TransformData + 1);
2115   }
2116 }
2117
2118 /**
2119   Parse the received Initial Exchange Packet.
2120
2121   This function parse the SA Payload and Key Payload to find out the cryptographic
2122   suite for the further IKE negotiation and fill it into the IKE SA Session's
2123   CommonSession->SaParams.
2124
2125   @param[in, out]  IkeSaSession  Pointer to related IKEV2_SA_SESSION.
2126   @param[in]       SaPayload     The received packet.
2127   @param[in]       Type          The received packet IKE header flag.
2128
2129   @retval          TRUE          If the SA proposal in Packet is acceptable.
2130   @retval          FALSE         If the SA proposal in Packet is not acceptable.
2131
2132 **/
2133 BOOLEAN
2134 Ikev2SaParseSaPayload (
2135   IN OUT IKEV2_SA_SESSION *IkeSaSession,
2136   IN     IKE_PAYLOAD      *SaPayload,
2137   IN     UINT8            Type
2138   )
2139 {
2140   IKEV2_PROPOSAL_DATA  *ProposalData;
2141   UINT8                ProposalIndex;
2142   UINT16               PreferEncryptAlgorithm;
2143   UINT16               PreferIntegrityAlgorithm;
2144   UINT16               PreferPrfAlgorithm;
2145   UINT16               PreferDhGroup;
2146   UINTN                PreferEncryptKeylength;
2147   UINT16               EncryptAlgorithm;
2148   UINT16               IntegrityAlgorithm;
2149   UINT16               PrfAlgorithm;
2150   UINT16               DhGroup;
2151   UINTN                EncryptKeylength;
2152   BOOLEAN              IsMatch;
2153   UINTN                SaDataSize;
2154
2155   PreferPrfAlgorithm       = 0;
2156   PreferIntegrityAlgorithm = 0;
2157   PreferDhGroup            = 0;
2158   PreferEncryptAlgorithm   = 0;
2159   PreferEncryptKeylength   = 0;
2160   PrfAlgorithm             = 0;
2161   IntegrityAlgorithm       = 0;
2162   DhGroup                  = 0;
2163   EncryptAlgorithm         = 0;
2164   EncryptKeylength         = 0;
2165   IsMatch                  = FALSE;
2166
2167   if (Type == IKE_HEADER_FLAGS_INIT) {
2168     ProposalData   = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);
2169     for (ProposalIndex = 0; ProposalIndex < ((IKEV2_SA_DATA *)SaPayload->PayloadBuf)->NumProposals; ProposalIndex++) {
2170       //
2171       // Iterate each proposal to find the perfered one.
2172       //
2173       if (ProposalData->ProtocolId == IPSEC_PROTO_ISAKMP && ProposalData->NumTransforms >= 4) {
2174         //
2175         // Get the preferred algorithms.
2176         //
2177         Ikev2ParseProposalData (
2178           ProposalData,
2179           &PreferEncryptAlgorithm,
2180           &PreferIntegrityAlgorithm,
2181           &PreferPrfAlgorithm,
2182           &PreferDhGroup,
2183           &PreferEncryptKeylength,
2184           NULL,
2185           FALSE
2186           );
2187
2188         if (PreferEncryptAlgorithm != 0 &&
2189               PreferIntegrityAlgorithm != 0 &&
2190               PreferPrfAlgorithm != 0 &&
2191               PreferDhGroup != 0
2192               ) {
2193             //
2194             // Find the matched one.
2195             //
2196             IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2197             ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);
2198             IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2199             IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2200             IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;
2201             IkeSaSession->SessionCommon.SaParams->Prf        = PreferPrfAlgorithm;
2202             IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2203             IkeSaSession->SessionCommon.PreferDhGroup        = PreferDhGroup;
2204
2205             //
2206             // Save the matched one in IKEV2_SA_DATA for furthure calculation.
2207             //
2208             SaDataSize           = sizeof (IKEV2_SA_DATA) +
2209                                    sizeof (IKEV2_PROPOSAL_DATA) +
2210                                    sizeof (IKEV2_TRANSFORM_DATA) * 4;
2211             IkeSaSession->SaData = AllocateZeroPool (SaDataSize);
2212             ASSERT (IkeSaSession->SaData != NULL);
2213
2214             IkeSaSession->SaData->NumProposals  = 1;
2215
2216             //
2217             // BUGBUG: Suppose the matched proposal only has 4 transforms. If
2218             // The matched Proposal has more than 4 transforms means it contains
2219             // one than one transform with same type.
2220             //
2221             CopyMem (
2222               (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1),
2223                ProposalData,
2224                SaDataSize - sizeof (IKEV2_SA_DATA)
2225               );
2226
2227             ((IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1))->ProposalIndex = 1;
2228             return TRUE;
2229           } else {
2230             PreferEncryptAlgorithm   = 0;
2231             PreferIntegrityAlgorithm = 0;
2232             PreferPrfAlgorithm       = 0;
2233             PreferDhGroup            = 0;
2234             PreferEncryptKeylength   = 0;
2235           }
2236       }
2237       //
2238       // Point to next Proposal.
2239       //
2240       ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +
2241                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2242     }
2243   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {
2244     //
2245     // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is
2246     // the responded SA proposal, suppose it only has one proposal and the transform Numbers
2247     // is 4.
2248     //
2249     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);
2250     if (ProposalData->ProtocolId != IPSEC_PROTO_ISAKMP || ProposalData->NumTransforms != 4) {
2251       return FALSE;
2252     }
2253     //
2254     // Get the preferred algorithms.
2255     //
2256     Ikev2ParseProposalData (
2257       ProposalData,
2258       &PreferEncryptAlgorithm,
2259       &PreferIntegrityAlgorithm,
2260       &PreferPrfAlgorithm,
2261       &PreferDhGroup,
2262       &PreferEncryptKeylength,
2263       NULL,
2264       FALSE
2265       );
2266     //
2267     // Check if the Sa proposal data from received packet is in the IkeSaSession->SaData.
2268     //
2269     ProposalData = (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1);
2270
2271     for (ProposalIndex = 0; ProposalIndex < IkeSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {
2272       Ikev2ParseProposalData (
2273           ProposalData,
2274           &EncryptAlgorithm,
2275           &IntegrityAlgorithm,
2276           &PrfAlgorithm,
2277           &DhGroup,
2278           &EncryptKeylength,
2279           NULL,
2280           FALSE
2281           );
2282       if (EncryptAlgorithm == PreferEncryptAlgorithm &&
2283           EncryptKeylength == PreferEncryptKeylength &&
2284           IntegrityAlgorithm == PreferIntegrityAlgorithm &&
2285           PrfAlgorithm == PreferPrfAlgorithm &&
2286           DhGroup      == PreferDhGroup
2287           ) {
2288         IsMatch = TRUE;
2289       } else {
2290         EncryptAlgorithm   = 0;
2291         IntegrityAlgorithm = 0;
2292         PrfAlgorithm       = 0;
2293         DhGroup            = 0;
2294         EncryptKeylength   = 0;
2295       }
2296
2297       ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +
2298                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2299     }
2300
2301     if (IsMatch) {
2302         IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2303         ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);
2304         IkeSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2305         IkeSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2306         IkeSaSession->SessionCommon.SaParams->DhGroup    = PreferDhGroup;
2307         IkeSaSession->SessionCommon.SaParams->Prf        = PreferPrfAlgorithm;
2308         IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2309         IkeSaSession->SessionCommon.PreferDhGroup        = PreferDhGroup;
2310
2311         return TRUE;
2312     }
2313   }
2314   return FALSE;
2315 }
2316
2317 /**
2318   Parse the received Authentication Exchange Packet.
2319
2320   This function parse the SA Payload and Key Payload to find out the cryptographic
2321   suite for the ESP and fill it into the Child SA Session's CommonSession->SaParams.
2322
2323   @param[in, out]  ChildSaSession  Pointer to IKEV2_CHILD_SA_SESSION related to
2324                                    this Authentication Exchange.
2325   @param[in]       SaPayload       The received packet.
2326   @param[in]       Type            The IKE header's flag of received packet .
2327
2328   @retval          TRUE            If the SA proposal in Packet is acceptable.
2329   @retval          FALSE           If the SA proposal in Packet is not acceptable.
2330
2331 **/
2332 BOOLEAN
2333 Ikev2ChildSaParseSaPayload (
2334   IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession,
2335   IN     IKE_PAYLOAD            *SaPayload,
2336   IN     UINT8                  Type
2337   )
2338 {
2339   IKEV2_PROPOSAL_DATA  *ProposalData;
2340   UINT8                ProposalIndex;
2341   UINT16               PreferEncryptAlgorithm;
2342   UINT16               PreferIntegrityAlgorithm;
2343   UINTN                PreferEncryptKeylength;
2344   BOOLEAN              PreferIsSupportEsn;
2345   UINT16               EncryptAlgorithm;
2346   UINT16               IntegrityAlgorithm;
2347   UINTN                EncryptKeylength;
2348   BOOLEAN              IsSupportEsn;
2349   BOOLEAN              IsMatch;
2350   UINTN                SaDataSize;
2351
2352
2353   PreferIntegrityAlgorithm = 0;
2354   PreferEncryptAlgorithm   = 0;
2355   PreferEncryptKeylength   = 0;
2356   IntegrityAlgorithm       = 0;
2357   EncryptAlgorithm         = 0;
2358   EncryptKeylength         = 0;
2359   IsMatch                  = TRUE;
2360   IsSupportEsn             = FALSE;
2361   PreferIsSupportEsn       = FALSE;
2362
2363   if (Type == IKE_HEADER_FLAGS_INIT) {
2364     ProposalData   = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);
2365     for (ProposalIndex = 0; ProposalIndex < ((IKEV2_SA_DATA *) SaPayload->PayloadBuf)->NumProposals; ProposalIndex++) {
2366       //
2367       // Iterate each proposal to find the preferred one.
2368       //
2369       if (ProposalData->ProtocolId == IPSEC_PROTO_IPSEC_ESP && ProposalData->NumTransforms >= 3) {
2370         //
2371         // Get the preferred algorithm.
2372         //
2373         Ikev2ParseProposalData (
2374           ProposalData,
2375           &PreferEncryptAlgorithm,
2376           &PreferIntegrityAlgorithm,
2377           NULL,
2378           NULL,
2379           &PreferEncryptKeylength,
2380           &IsSupportEsn,
2381           TRUE
2382           );
2383         //
2384         // Don't support the ESN now.
2385         //
2386         if (PreferEncryptAlgorithm != 0 &&
2387             PreferIntegrityAlgorithm != 0 &&
2388             !IsSupportEsn
2389             ) {
2390           //
2391           // Find the matched one.
2392           //
2393           ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2394           ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);
2395           ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2396           ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2397           ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2398           CopyMem (&ChildSaSession->RemotePeerSpi, ProposalData->Spi, sizeof (ChildSaSession->RemotePeerSpi));
2399
2400           //
2401           // Save the matched one in IKEV2_SA_DATA for furthure calculation.
2402           //
2403           SaDataSize           = sizeof (IKEV2_SA_DATA) +
2404                                  sizeof (IKEV2_PROPOSAL_DATA) +
2405                                  sizeof (IKEV2_TRANSFORM_DATA) * 4;
2406
2407           ChildSaSession->SaData = AllocateZeroPool (SaDataSize);
2408           ASSERT (ChildSaSession->SaData != NULL);
2409
2410           ChildSaSession->SaData->NumProposals  = 1;
2411
2412           //
2413           // BUGBUG: Suppose there are 4 transforms in the matched proposal. If
2414           // the matched Proposal has more than 4 transforms that means there
2415           // are more than one transform with same type.
2416           //
2417           CopyMem (
2418             (IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1),
2419              ProposalData,
2420              SaDataSize - sizeof (IKEV2_SA_DATA)
2421             );
2422
2423           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->ProposalIndex = 1;
2424
2425           ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi = AllocateCopyPool (
2426                                                                           sizeof (ChildSaSession->LocalPeerSpi),
2427                                                                           &ChildSaSession->LocalPeerSpi
2428                                                                           );
2429           ASSERT (((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi != NULL);
2430           return TRUE;
2431
2432         } else {
2433           PreferEncryptAlgorithm   = 0;
2434           PreferIntegrityAlgorithm = 0;
2435           IsSupportEsn             = TRUE;
2436         }
2437       }
2438       //
2439       // Point to next Proposal
2440       //
2441       ProposalData = (IKEV2_PROPOSAL_DATA *)((UINT8 *)(ProposalData + 1) +
2442                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2443     }
2444   } else if (Type == IKE_HEADER_FLAGS_RESPOND) {
2445     //
2446     // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is
2447     // the responded SA proposal, suppose it only has one proposal and the transform Numbers
2448     // is 3.
2449     //
2450     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);
2451     if (ProposalData->ProtocolId != IPSEC_PROTO_IPSEC_ESP || ProposalData->NumTransforms != 3) {
2452       return FALSE;
2453     }
2454     //
2455     // Get the preferred algorithms.
2456     //
2457     Ikev2ParseProposalData (
2458       ProposalData,
2459       &PreferEncryptAlgorithm,
2460       &PreferIntegrityAlgorithm,
2461       NULL,
2462       NULL,
2463       &PreferEncryptKeylength,
2464       &PreferIsSupportEsn,
2465       TRUE
2466       );
2467
2468     ProposalData = (IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1);
2469
2470     for (ProposalIndex = 0; ProposalIndex < ChildSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {
2471       Ikev2ParseProposalData (
2472           ProposalData,
2473           &EncryptAlgorithm,
2474           &IntegrityAlgorithm,
2475           NULL,
2476           NULL,
2477           &EncryptKeylength,
2478           &IsSupportEsn,
2479           TRUE
2480           );
2481       if (EncryptAlgorithm == PreferEncryptAlgorithm &&
2482           EncryptKeylength == PreferEncryptKeylength &&
2483           IntegrityAlgorithm == PreferIntegrityAlgorithm &&
2484           IsSupportEsn == PreferIsSupportEsn
2485           ) {
2486         IsMatch = TRUE;
2487       } else {
2488         PreferEncryptAlgorithm   = 0;
2489         PreferIntegrityAlgorithm = 0;
2490         IsSupportEsn             = TRUE;
2491       }
2492        ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) +
2493                      ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));
2494     }
2495
2496     ProposalData  = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);
2497     if (IsMatch) {
2498         ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));
2499         ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);
2500         ChildSaSession->SessionCommon.SaParams->EncAlgId   = PreferEncryptAlgorithm;
2501         ChildSaSession->SessionCommon.SaParams->EnckeyLen  = PreferEncryptKeylength;
2502         ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;
2503         CopyMem (&ChildSaSession->RemotePeerSpi, ProposalData->Spi, sizeof (ChildSaSession->RemotePeerSpi));
2504
2505         return TRUE;
2506     }
2507   }
2508   return FALSE;
2509 }
2510
2511 /**
2512   Generate Key buffer from fragments.
2513
2514   If the digest length of specified HashAlgId is larger than or equal with the
2515   required output key length, derive the key directly. Otherwise, Key Material
2516   needs to be PRF-based concatenation according to 2.13 of RFC 4306:
2517   prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),
2518   T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)
2519   then derive the key from this key material.
2520
2521   @param[in]       HashAlgId        The Hash Algorithm ID used to generate key.
2522   @param[in]       HashKey          Pointer to a key buffer which contains hash key.
2523   @param[in]       HashKeyLength    The length of HashKey in bytes.
2524   @param[in, out]  OutputKey        Pointer to buffer which is used to receive the
2525                                     output key.
2526   @param[in]       OutputKeyLength  The length of OutPutKey buffer.
2527   @param[in]       Fragments        Pointer to the data to be used to generate key.
2528   @param[in]       NumFragments     The numbers of the Fragement.
2529
2530   @retval EFI_SUCCESS            The operation complete successfully.
2531   @retval EFI_INVALID_PARAMETER  If NumFragments is zero.
2532   @retval EFI_OUT_OF_RESOURCES   If the required resource can't be allocated.
2533   @retval Others                 The operation is failed.
2534
2535 **/
2536 EFI_STATUS
2537 Ikev2SaGenerateKey (
2538   IN     UINT8                 HashAlgId,
2539   IN     UINT8                 *HashKey,
2540   IN     UINTN                 HashKeyLength,
2541   IN OUT UINT8                 *OutputKey,
2542   IN     UINTN                 OutputKeyLength,
2543   IN     PRF_DATA_FRAGMENT    *Fragments,
2544   IN     UINTN                 NumFragments
2545   )
2546 {
2547   EFI_STATUS          Status;
2548   PRF_DATA_FRAGMENT   LocalFragments[3];
2549   UINT8               *Digest;
2550   UINTN               DigestSize;
2551   UINTN               Round;
2552   UINTN               Index;
2553   UINTN               AuthKeyLength;
2554   UINTN               FragmentsSize;
2555   UINT8               TailData;
2556
2557   Status = EFI_SUCCESS;
2558
2559   if (NumFragments == 0) {
2560     return EFI_INVALID_PARAMETER;
2561   }
2562
2563   LocalFragments[0].Data = NULL;
2564   LocalFragments[1].Data = NULL;
2565   LocalFragments[2].Data = NULL;
2566
2567   AuthKeyLength = IpSecGetHmacDigestLength (HashAlgId);
2568   DigestSize    = AuthKeyLength;
2569   Digest        = AllocateZeroPool (AuthKeyLength);
2570
2571   if (Digest == NULL) {
2572     return EFI_OUT_OF_RESOURCES;
2573   }
2574   //
2575   // If the required output key length is less than the digest size,
2576   // copy the digest into OutputKey.
2577   //
2578   if (OutputKeyLength <=  DigestSize) {
2579     Status = IpSecCryptoIoHmac (
2580                HashAlgId,
2581                HashKey,
2582                HashKeyLength,
2583                (HASH_DATA_FRAGMENT *) Fragments,
2584                NumFragments,
2585                Digest,
2586                DigestSize
2587                );
2588     if (EFI_ERROR (Status)) {
2589       goto Exit;
2590     }
2591
2592     CopyMem (OutputKey, Digest, OutputKeyLength);
2593     goto Exit;
2594   }
2595
2596   //
2597   //Otherwise, Key Material need to be PRF-based concatenation according to 2.13
2598   //of RFC 4306: prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),
2599   //T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)
2600   //then derive the key from this key material.
2601   //
2602   FragmentsSize = 0;
2603   for (Index = 0; Index < NumFragments; Index++) {
2604     FragmentsSize = FragmentsSize + Fragments[Index].DataSize;
2605   }
2606
2607   LocalFragments[1].Data     = AllocateZeroPool (FragmentsSize);
2608   ASSERT (LocalFragments[1].Data != NULL);
2609   LocalFragments[1].DataSize = FragmentsSize;
2610
2611   //
2612   // Copy all input fragments into LocalFragments[1];
2613   //
2614   FragmentsSize = 0;
2615   for (Index = 0; Index < NumFragments; Index++) {
2616     CopyMem (
2617       LocalFragments[1].Data + FragmentsSize,
2618       Fragments[Index].Data,
2619       Fragments[Index].DataSize
2620       );
2621     FragmentsSize = FragmentsSize + Fragments[Index].DataSize;
2622   }
2623
2624   //
2625   // Prepare 0x01 as the first tail data.
2626   //
2627   TailData                   = 0x01;
2628   LocalFragments[2].Data     = &TailData;
2629   LocalFragments[2].DataSize = sizeof (TailData);
2630   //
2631   // Allocate buffer for the first fragment
2632   //
2633   LocalFragments[0].Data     = AllocateZeroPool (AuthKeyLength);
2634   ASSERT (LocalFragments[0].Data != NULL);
2635   LocalFragments[0].DataSize = AuthKeyLength;
2636
2637   Round = (OutputKeyLength - 1) / AuthKeyLength + 1;
2638   for (Index = 0; Index < Round; Index++) {
2639     Status = IpSecCryptoIoHmac (
2640                HashAlgId,
2641                HashKey,
2642                HashKeyLength,
2643                (HASH_DATA_FRAGMENT *)(Index == 0 ? &LocalFragments[1] : LocalFragments),
2644                Index == 0 ? 2 : 3,
2645                Digest,
2646                DigestSize
2647                );
2648     if (EFI_ERROR(Status)) {
2649       goto Exit;
2650     }
2651     CopyMem (
2652       LocalFragments[0].Data,
2653       Digest,
2654       DigestSize
2655       );
2656     if (OutputKeyLength > DigestSize * (Index + 1)) {
2657       CopyMem (
2658         OutputKey + Index * DigestSize,
2659         Digest,
2660         DigestSize
2661         );
2662       LocalFragments[0].DataSize = DigestSize;
2663       TailData ++;
2664     } else {
2665       //
2666       // The last round
2667       //
2668       CopyMem (
2669         OutputKey + Index * DigestSize,
2670         Digest,
2671         OutputKeyLength - Index * DigestSize
2672       );
2673     }
2674   }
2675
2676 Exit:
2677   //
2678   // Only First and second Framgement Data need to be freed.
2679   //
2680   for (Index = 0 ; Index < 2; Index++) {
2681     if (LocalFragments[Index].Data != NULL) {
2682       FreePool (LocalFragments[Index].Data);
2683     }
2684   }
2685   if (Digest != NULL) {
2686     FreePool (Digest);
2687   }
2688   return Status;
2689 }
2690