2 The implementation of IPsec.
4 Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php.
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include "IpSecImpl.h"
17 #include "IkeService.h"
18 #include "IpSecDebug.h"
19 #include "IpSecCryptIo.h"
20 #include "IpSecConfigImpl.h"
23 Check if the specified Address is the Valid Address Range.
25 This function checks if the bytes after prefixed length are all Zero in this
26 Address. This Address is supposed to point to a range address. That means it
27 should gives the correct prefixed address and the bytes outside the prefixed are
30 @param[in] IpVersion The IP version.
31 @param[in] Address Points to EFI_IP_ADDRESS to be checked.
32 @param[in] PrefixLength The PrefixeLength of this address.
34 @retval TRUE The address is a vaild address range.
35 @retval FALSE The address is not a vaild address range.
39 IpSecValidAddressRange (
41 IN EFI_IP_ADDRESS
*Address
,
50 EFI_IP_ADDRESS ZeroAddr
;
52 if (PrefixLength
== 0) {
56 AddrLen
= (UINT8
) ((IpVersion
== IP_VERSION_4
) ? 32 : 128);
58 if (AddrLen
<= PrefixLength
) {
62 Div
= (UINT8
) (PrefixLength
/ 8);
63 Mod
= (UINT8
) (PrefixLength
% 8);
64 Addr
= (UINT8
*) Address
;
65 ZeroMem (&ZeroAddr
, sizeof (EFI_IP_ADDRESS
));
68 // Check whether the mod part of host scope is zero or not.
71 Mask
= (UINT8
) (0xFF << (8 - Mod
));
73 if ((Addr
[Div
] | Mask
) != Mask
) {
80 // Check whether the div part of host scope is zero or not.
85 sizeof (EFI_IP_ADDRESS
) - Div
94 Extrct the Address Range from a Address.
96 This function keep the prefix address and zero other part address.
98 @param[in] Address Point to a specified address.
99 @param[in] PrefixLength The prefix length.
100 @param[out] Range Contain the return Address Range.
104 IpSecExtractAddressRange (
105 IN EFI_IP_ADDRESS
*Address
,
106 IN UINT8 PrefixLength
,
107 OUT EFI_IP_ADDRESS
*Range
115 if (PrefixLength
== 0) {
119 Div
= (UINT8
) (PrefixLength
/ 8);
120 Mod
= (UINT8
) (PrefixLength
% 8);
121 Addr
= (UINT8
*) Range
;
123 CopyMem (Range
, Address
, sizeof (EFI_IP_ADDRESS
));
126 // Zero the mod part of host scope.
129 Mask
= (UINT8
) (0xFF << (8 - Mod
));
130 Addr
[Div
] = (UINT8
) (Addr
[Div
] & Mask
);
134 // Zero the div part of host scope.
136 ZeroMem (&Addr
[Div
], sizeof (EFI_IP_ADDRESS
) - Div
);
141 Checks if the IP Address in the address range of AddressInfos specified.
143 @param[in] IpVersion The IP version.
144 @param[in] IpAddr Point to EFI_IP_ADDRESS to be check.
145 @param[in] AddressInfo A list of EFI_IP_ADDRESS_INFO that is used to check
146 the IP Address is matched.
147 @param[in] AddressCount The total numbers of the AddressInfo.
149 @retval TRUE If the Specified IP Address is in the range of the AddressInfos specified.
150 @retval FALSE If the Specified IP Address is not in the range of the AddressInfos specified.
154 IpSecMatchIpAddress (
156 IN EFI_IP_ADDRESS
*IpAddr
,
157 IN EFI_IP_ADDRESS_INFO
*AddressInfo
,
158 IN UINT32 AddressCount
161 EFI_IP_ADDRESS Range
;
167 for (Index
= 0; Index
< AddressCount
; Index
++) {
169 // Check whether the target address is in the address range
170 // if it's a valid range of address.
172 if (IpSecValidAddressRange (
174 &AddressInfo
[Index
].Address
,
175 AddressInfo
[Index
].PrefixLength
178 // Get the range of the target address belongs to.
180 ZeroMem (&Range
, sizeof (EFI_IP_ADDRESS
));
181 IpSecExtractAddressRange (
183 AddressInfo
[Index
].PrefixLength
,
189 &AddressInfo
[Index
].Address
,
190 sizeof (EFI_IP_ADDRESS
)
193 // The target address is in the address range.
202 &AddressInfo
[Index
].Address
,
203 sizeof (EFI_IP_ADDRESS
)
206 // The target address is exact same as the address.
216 Check if the specified Protocol and Prot is supported by the specified SPD Entry.
218 This function is the subfunction of IPsecLookUpSpdEntry() that is used to
219 check if the sent/received IKE packet has the related SPD entry support.
221 @param[in] Protocol The Protocol to be checked.
222 @param[in] IpPayload Point to IP Payload to be check.
223 @param[in] SpdProtocol The Protocol supported by SPD.
224 @param[in] SpdLocalPort The Local Port in SPD.
225 @param[in] SpdRemotePort The Remote Port in SPD.
226 @param[in] IsOutbound Flag to indicate the is for IKE Packet sending or recieving.
228 @retval TRUE The Protocol and Port are supported by the SPD Entry.
229 @retval FALSE The Protocol and Port are not supported by the SPD Entry.
233 IpSecMatchNextLayerProtocol (
236 IN UINT16 SpdProtocol
,
237 IN UINT16 SpdLocalPort
,
238 IN UINT16 SpdRemotePort
,
239 IN BOOLEAN IsOutbound
244 if (SpdProtocol
== EFI_IPSEC_ANY_PROTOCOL
) {
250 if (SpdProtocol
== Protocol
) {
252 case EFI_IP_PROTO_UDP
:
253 case EFI_IP_PROTO_TCP
:
255 // For udp and tcp, (0, 0) means no need to check local and remote
256 // port. The payload is passed from upper level, which means it should
257 // be in network order.
259 IsMatch
= (BOOLEAN
) (SpdLocalPort
== 0 && SpdRemotePort
== 0);
260 IsMatch
= (BOOLEAN
) (IsMatch
||
263 NTOHS (((EFI_UDP_HEADER
*) IpPayload
)->SrcPort
) == SpdLocalPort
&&
264 NTOHS (((EFI_UDP_HEADER
*) IpPayload
)->DstPort
) == SpdRemotePort
268 IsMatch
= (BOOLEAN
) (IsMatch
||
271 NTOHS (((EFI_UDP_HEADER
*) IpPayload
)->DstPort
) == SpdLocalPort
&&
272 NTOHS (((EFI_UDP_HEADER
*) IpPayload
)->SrcPort
) == SpdRemotePort
277 case EFI_IP_PROTO_ICMP
:
279 // For icmpv4, type code is replaced with local port and remote port,
280 // and (0, 0) means no need to check.
282 IsMatch
= (BOOLEAN
) (SpdLocalPort
== 0 && SpdRemotePort
== 0);
283 IsMatch
= (BOOLEAN
) (IsMatch
||
284 (BOOLEAN
) (((IP4_ICMP_HEAD
*) IpPayload
)->Type
== SpdLocalPort
&&
285 ((IP4_ICMP_HEAD
*) IpPayload
)->Code
== SpdRemotePort
292 // For icmpv6, type code is replaced with local port and remote port,
293 // and (0, 0) means no need to check.
295 IsMatch
= (BOOLEAN
) (SpdLocalPort
== 0 && SpdRemotePort
== 0);
297 IsMatch
= (BOOLEAN
) (IsMatch
||
298 (BOOLEAN
) (((IP6_ICMP_HEAD
*) IpPayload
)->Type
== SpdLocalPort
&&
299 ((IP6_ICMP_HEAD
*) IpPayload
)->Code
== SpdRemotePort
314 Find the SAD through a specified SPD's SAD list.
316 @param[in] SadList SAD list related to a specified SPD entry.
317 @param[in] DestAddress The destination address used to find the SAD entry.
318 @param[in] IpVersion The IP version. Ip4 or Ip6.
320 @return The pointer to a certain SAD entry.
324 IpSecLookupSadBySpd (
325 IN LIST_ENTRY
*SadList
,
326 IN EFI_IP_ADDRESS
*DestAddress
,
331 IPSEC_SAD_ENTRY
*SadEntry
;
333 NET_LIST_FOR_EACH (Entry
, SadList
) {
335 SadEntry
= IPSEC_SAD_ENTRY_FROM_SPD (Entry
);
337 // Find the right SAD entry which contains the appointed dest address.
339 if (IpSecMatchIpAddress (
342 SadEntry
->Data
->SpdSelector
->RemoteAddress
,
343 SadEntry
->Data
->SpdSelector
->RemoteAddressCount
353 Find the SAD through whole SAD list.
355 @param[in] Spi The SPI used to search the SAD entry.
356 @param[in] DestAddress The destination used to search the SAD entry.
357 @param[in] IpVersion The IP version. Ip4 or Ip6.
359 @return the pointer to a certain SAD entry.
363 IpSecLookupSadBySpi (
365 IN EFI_IP_ADDRESS
*DestAddress
,
371 IPSEC_SAD_ENTRY
*SadEntry
;
373 SadList
= &mConfigData
[IPsecConfigDataTypeSad
];
375 NET_LIST_FOR_EACH (Entry
, SadList
) {
377 SadEntry
= IPSEC_SAD_ENTRY_FROM_LIST (Entry
);
380 // Find the right SAD entry which contain the appointed spi and dest addr.
382 if (SadEntry
->Id
->Spi
== Spi
) {
383 if (SadEntry
->Data
->Mode
== EfiIPsecTunnel
) {
386 &SadEntry
->Data
->TunnelDestAddress
,
387 sizeof (EFI_IP_ADDRESS
)
392 if (SadEntry
->Data
->SpdSelector
!= NULL
&&
393 IpSecMatchIpAddress (
396 SadEntry
->Data
->SpdSelector
->RemoteAddress
,
397 SadEntry
->Data
->SpdSelector
->RemoteAddressCount
409 Look up if there is existing SAD entry for specified IP packet sending.
411 This function is called by the IPsecProcess when there is some IP packet needed to
412 send out. This function checks if there is an existing SAD entry that can be serviced
413 to this IP packet sending. If no existing SAD entry could be used, this
414 function will invoke an IPsec Key Exchange Negotiation.
416 @param[in] Private Points to private data.
417 @param[in] NicHandle Points to a NIC handle.
418 @param[in] IpVersion The version of IP.
419 @param[in] IpHead The IP Header of packet to be sent out.
420 @param[in] IpPayload The IP Payload to be sent out.
421 @param[in] OldLastHead The Last protocol of the IP packet.
422 @param[in] SpdEntry Points to a related SPD entry.
423 @param[out] SadEntry Contains the Point of a related SAD entry.
425 @retval EFI_DEVICE_ERROR One of following conditions is TRUE:
426 - If don't find related UDP service.
427 - Sequence Number is used up.
428 - Extension Sequence Number is used up.
429 @retval EFI_NOT_READY No existing SAD entry could be used.
430 @retval EFI_SUCCESS Find the related SAD entry.
434 IpSecLookupSadEntry (
435 IN IPSEC_PRIVATE_DATA
*Private
,
436 IN EFI_HANDLE NicHandle
,
440 IN UINT8 OldLastHead
,
441 IN IPSEC_SPD_ENTRY
*SpdEntry
,
442 OUT IPSEC_SAD_ENTRY
**SadEntry
445 IKE_UDP_SERVICE
*UdpService
;
446 IPSEC_SAD_ENTRY
*Entry
;
447 IPSEC_SAD_DATA
*Data
;
448 EFI_IP_ADDRESS DestIp
;
452 UdpService
= IkeLookupUdp (Private
, NicHandle
, IpVersion
);
454 if (UdpService
== NULL
) {
455 return EFI_DEVICE_ERROR
;
458 // Parse the destination address from ip header.
460 ZeroMem (&DestIp
, sizeof (EFI_IP_ADDRESS
));
461 if (IpVersion
== IP_VERSION_4
) {
464 &((IP4_HEAD
*) IpHead
)->Dst
,
470 &((EFI_IP6_HEADER
*) IpHead
)->DestinationAddress
,
471 sizeof (EFI_IP_ADDRESS
)
476 // Find the SAD entry in the spd.sas list according to the dest address.
478 Entry
= IpSecLookupSadBySpd (&SpdEntry
->Data
->Sas
, &DestIp
, IpVersion
);
482 if (OldLastHead
!= IP6_ICMP
||
483 (OldLastHead
== IP6_ICMP
&& *IpPayload
== ICMP_V6_ECHO_REQUEST
)
486 // Start ike negotiation process except the request packet of ping.
488 if (SpdEntry
->Data
->ProcessingPolicy
->Mode
== EfiIPsecTunnel
) {
492 &SpdEntry
->Data
->ProcessingPolicy
->TunnelOption
->RemoteTunnelAddress
504 return EFI_NOT_READY
;
509 if (!Data
->ManualSet
) {
510 if (Data
->ESNEnabled
) {
512 // Validate the 64bit sn number if 64bit sn enabled.
514 if ((UINT64
) (Data
->SequenceNumber
+ 1) == 0) {
516 // TODO: Re-negotiate SA
518 return EFI_DEVICE_ERROR
;
522 // Validate the 32bit sn number if 64bit sn disabled.
524 SeqNum32
= (UINT32
) Data
->SequenceNumber
;
525 if ((UINT32
) (SeqNum32
+ 1) == 0) {
527 // TODO: Re-negotiate SA
529 return EFI_DEVICE_ERROR
;
540 Find a PAD entry according to a remote IP address.
542 @param[in] IpVersion The version of IP.
543 @param[in] IpAddr Points to remote IP address.
545 @return the pointer of related PAD entry.
549 IpSecLookupPadEntry (
551 IN EFI_IP_ADDRESS
*IpAddr
556 EFI_IP_ADDRESS_INFO
*IpAddrInfo
;
557 IPSEC_PAD_ENTRY
*PadEntry
;
559 PadList
= &mConfigData
[IPsecConfigDataTypePad
];
561 for (Entry
= PadList
->ForwardLink
; Entry
!= PadList
; Entry
= Entry
->ForwardLink
) {
563 PadEntry
= IPSEC_PAD_ENTRY_FROM_LIST (Entry
);
564 IpAddrInfo
= &PadEntry
->Id
->Id
.IpAddress
;
566 // Find the right pad entry which contain the appointed dest addr.
568 if (IpSecMatchIpAddress (IpVersion
, IpAddr
, IpAddrInfo
, 1)) {
577 Check if the specified IP packet can be serviced by this SPD entry.
579 @param[in] SpdEntry Point to SPD entry.
580 @param[in] IpVersion Version of IP.
581 @param[in] IpHead Point to IP header.
582 @param[in] IpPayload Point to IP payload.
583 @param[in] Protocol The Last protocol of IP packet.
584 @param[in] IsOutbound Traffic direction.
585 @param[out] Action The support action of SPD entry.
587 @retval EFI_SUCCESS Find the related SPD.
588 @retval EFI_NOT_FOUND Not find the related SPD entry;
592 IpSecLookupSpdEntry (
593 IN IPSEC_SPD_ENTRY
*SpdEntry
,
598 IN BOOLEAN IsOutbound
,
599 OUT EFI_IPSEC_ACTION
*Action
602 EFI_IPSEC_SPD_SELECTOR
*SpdSel
;
605 EFI_IP_ADDRESS SrcAddr
;
606 EFI_IP_ADDRESS DstAddr
;
609 ASSERT (SpdEntry
!= NULL
);
610 SpdSel
= SpdEntry
->Selector
;
611 Ip4
= (IP4_HEAD
*) IpHead
;
612 Ip6
= (EFI_IP6_HEADER
*) IpHead
;
614 ZeroMem (&SrcAddr
, sizeof (EFI_IP_ADDRESS
));
615 ZeroMem (&DstAddr
, sizeof (EFI_IP_ADDRESS
));
618 // Parse the source and destination address from ip header.
620 if (IpVersion
== IP_VERSION_4
) {
621 CopyMem (&SrcAddr
, &Ip4
->Src
, sizeof (IP4_ADDR
));
622 CopyMem (&DstAddr
, &Ip4
->Dst
, sizeof (IP4_ADDR
));
624 CopyMem (&SrcAddr
, &Ip6
->SourceAddress
, sizeof (EFI_IPv6_ADDRESS
));
625 CopyMem (&DstAddr
, &Ip6
->DestinationAddress
, sizeof (EFI_IPv6_ADDRESS
));
628 // Check the local and remote addresses for outbound traffic
630 SpdMatch
= (BOOLEAN
)(IsOutbound
&&
631 IpSecMatchIpAddress (
634 SpdSel
->LocalAddress
,
635 SpdSel
->LocalAddressCount
637 IpSecMatchIpAddress (
640 SpdSel
->RemoteAddress
,
641 SpdSel
->RemoteAddressCount
646 // Check the local and remote addresses for inbound traffic
648 SpdMatch
= (BOOLEAN
) (SpdMatch
||
650 IpSecMatchIpAddress (
653 SpdSel
->LocalAddress
,
654 SpdSel
->LocalAddressCount
656 IpSecMatchIpAddress (
659 SpdSel
->RemoteAddress
,
660 SpdSel
->RemoteAddressCount
665 // Check the next layer protocol and local and remote ports.
667 SpdMatch
= (BOOLEAN
) (SpdMatch
&&
668 IpSecMatchNextLayerProtocol (
671 SpdSel
->NextLayerProtocol
,
680 // Find the right SPD entry if match the 5 key elements.
682 *Action
= SpdEntry
->Data
->Action
;
686 return EFI_NOT_FOUND
;
690 The call back function of NetbufFromExt.
692 @param[in] Arg The argument passed from the caller.
697 IpSecOnRecyclePacket (
704 This is a Notification function. It is called when the related IP6_TXTOKEN_WRAP
707 @param[in] Event The related event.
708 @param[in] Context The data passed by the caller.
713 IpSecRecycleCallback (
718 IPSEC_RECYCLE_CONTEXT
*RecycleContext
;
720 RecycleContext
= (IPSEC_RECYCLE_CONTEXT
*) Context
;
722 if (RecycleContext
->FragmentTable
!= NULL
) {
723 FreePool (RecycleContext
->FragmentTable
);
726 if (RecycleContext
->PayloadBuffer
!= NULL
) {
727 FreePool (RecycleContext
->PayloadBuffer
);
730 FreePool (RecycleContext
);
731 gBS
->CloseEvent (Event
);
736 Calculate the extension hader of IP. The return length only doesn't contain
737 the fixed IP header length.
739 @param[in] IpHead Points to an IP head to be calculated.
740 @param[in] LastHead Points to the last header of the IP header.
742 @return The length of the extension header.
746 IpSecGetPlainExtHeadSize (
753 Size
= (UINT16
) (LastHead
- (UINT8
*) IpHead
);
755 if (Size
> sizeof (EFI_IP6_HEADER
)) {
757 // * (LastHead+1) point the last header's length but not include the first
758 // 8 octers, so this formluation add 8 at the end.
760 Size
= (UINT16
) (Size
- sizeof (EFI_IP6_HEADER
) + *(LastHead
+ 1) + 8);
769 Verify if the Authentication payload is correct.
771 @param[in] EspBuffer Points to the ESP wrapped buffer.
772 @param[in] EspSize The size of the ESP wrapped buffer.
773 @param[in] SadEntry The related SAD entry to store the authentication
775 @param[in] IcvSize The length of ICV.
777 @retval EFI_SUCCESS The authentication data is correct.
778 @retval EFI_ACCESS_DENIED The authentication data is not correct.
782 IpSecEspAuthVerifyPayload (
785 IN IPSEC_SAD_ENTRY
*SadEntry
,
792 HASH_DATA_FRAGMENT HashFragment
[1];
795 // Calculate the size of authentication payload.
797 *IcvSize
= IpSecGetIcvLength (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
);
798 AuthSize
= EspSize
- *IcvSize
;
801 // Calculate the icv buffer and size of the payload.
803 HashFragment
[0].Data
= EspBuffer
;
804 HashFragment
[0].DataSize
= AuthSize
;
806 Status
= IpSecCryptoIoHmac (
807 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
,
808 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
,
809 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
,
815 if (EFI_ERROR (Status
)) {
820 // Compare the calculated icv and the appended original icv.
822 if (CompareMem (EspBuffer
+ AuthSize
, IcvBuffer
, *IcvSize
) == 0) {
826 DEBUG ((DEBUG_ERROR
, "Error auth verify payload\n"));
827 return EFI_ACCESS_DENIED
;
831 Search the related SAD entry by the input .
833 @param[in] IpHead The pointer to IP header.
834 @param[in] IpVersion The version of IP (IP4 or IP6).
835 @param[in] Spi The SPI used to search the related SAD entry.
838 @retval NULL Not find the related SAD entry.
839 @retval IPSEC_SAD_ENTRY Return the related SAD entry.
843 IpSecFoundSadFromInboundPacket (
849 EFI_IP_ADDRESS DestIp
;
852 // Parse destination address from ip header.
854 ZeroMem (&DestIp
, sizeof (EFI_IP_ADDRESS
));
855 if (IpVersion
== IP_VERSION_4
) {
858 &((IP4_HEAD
*) IpHead
)->Dst
,
864 &((EFI_IP6_HEADER
*) IpHead
)->DestinationAddress
,
865 sizeof (EFI_IPv6_ADDRESS
)
870 // Lookup SAD entry according to the spi and dest address.
872 return IpSecLookupSadBySpi (Spi
, &DestIp
, IpVersion
);
876 Validate the IP6 extension header format for both the packets we received
877 and that we will transmit.
879 @param[in] NextHeader The next header field in IPv6 basic header.
880 @param[in] ExtHdrs The first bye of the option.
881 @param[in] ExtHdrsLen The length of the whole option.
882 @param[out] LastHeader The pointer of NextHeader of the last extension
883 header processed by IP6.
884 @param[out] RealExtsLen The length of extension headers processed by IP6 layer.
885 This is an optional parameter that may be NULL.
887 @retval TRUE The option is properly formated.
888 @retval FALSE The option is malformated.
892 IpSecIsIp6ExtsValid (
893 IN UINT8
*NextHeader
,
895 IN UINT32 ExtHdrsLen
,
896 OUT UINT8
**LastHeader
,
897 OUT UINT32
*RealExtsLen OPTIONAL
908 if (RealExtsLen
!= NULL
) {
912 *LastHeader
= NextHeader
;
914 if (ExtHdrs
== NULL
&& ExtHdrsLen
== 0) {
918 if ((ExtHdrs
== NULL
&& ExtHdrsLen
!= 0) || (ExtHdrs
!= NULL
&& ExtHdrsLen
== 0)) {
928 while (Pointer
<= ExtHdrsLen
) {
930 switch (*NextHeader
) {
941 case IP6_DESTINATION
:
942 if (*NextHeader
== IP6_DESTINATION
) {
950 NextHeader
= ExtHdrs
+ Pointer
;
953 Option
= ExtHdrs
+ Pointer
;
954 OptionLen
= (UINT8
) ((*Option
+ 1) * 8 - 2);
958 Pointer
= Pointer
+ OptionLen
;
966 // RFC2402, AH header should after fragment header.
972 NextHeader
= ExtHdrs
+ Pointer
;
973 Pointer
= Pointer
+ 8;
981 Option
= ExtHdrs
+ Pointer
;
985 // RFC2402, Payload length is specified in 32-bit words, minus "2".
987 OptionLen
= (UINT8
) ((*Option
+ 2) * 4);
988 Pointer
= Pointer
+ OptionLen
;
992 *LastHeader
= NextHeader
;
993 if (RealExtsLen
!= NULL
) {
994 *RealExtsLen
= Pointer
;
1001 *LastHeader
= NextHeader
;
1003 if (RealExtsLen
!= NULL
) {
1004 *RealExtsLen
= Pointer
;
1011 The actual entry to process the tunnel header and inner header for tunnel mode
1014 This function is the subfunction of IpSecEspInboundPacket(). It change the destination
1015 Ip address to the station address and recalculate the uplayyer's checksum.
1018 @param[in, out] IpHead Points to the IP header containing the ESP header
1019 to be trimed on input, and without ESP header
1021 @param[in] IpPayload The decrypted Ip payload. It start from the inner
1023 @param[in] IpVersion The version of IP.
1024 @param[in] SadData Pointer of the relevant SAD.
1025 @param[in, out] LastHead The Last Header in IP header on return.
1029 IpSecTunnelInboundPacket (
1030 IN OUT UINT8
*IpHead
,
1031 IN UINT8
*IpPayload
,
1033 IN IPSEC_SAD_DATA
*SadData
,
1034 IN OUT UINT8
*LastHead
1037 EFI_UDP_HEADER
*UdpHeader
;
1038 TCP_HEAD
*TcpHeader
;
1040 UINT16 PseudoChecksum
;
1041 UINT16 PacketChecksum
;
1043 IP6_ICMP_HEAD
*Icmp6Head
;
1047 if (IpVersion
== IP_VERSION_4
) {
1049 // Zero OutIP header use this to indicate the input packet is under
1050 // IPsec Tunnel protected.
1057 &((IP4_HEAD
*)IpPayload
)->Dst
,
1058 &SadData
->TunnelDestAddress
.v4
,
1059 sizeof (EFI_IPv4_ADDRESS
)
1063 // Recalculate IpHeader Checksum
1065 if (((IP4_HEAD
*)(IpPayload
))->Checksum
!= 0 ) {
1066 ((IP4_HEAD
*)(IpPayload
))->Checksum
= 0;
1067 ((IP4_HEAD
*)(IpPayload
))->Checksum
= (UINT16
) (~NetblockChecksum (
1069 ((IP4_HEAD
*)IpPayload
)->HeadLen
<< 2
1076 // Recalcualte PseudoChecksum
1078 switch (((IP4_HEAD
*)IpPayload
)->Protocol
) {
1079 case EFI_IP_PROTO_UDP
:
1080 UdpHeader
= (EFI_UDP_HEADER
*)((UINT8
*)IpPayload
+ (((IP4_HEAD
*)IpPayload
)->HeadLen
<< 2));
1081 Checksum
= & UdpHeader
->Checksum
;
1085 case EFI_IP_PROTO_TCP
:
1086 TcpHeader
= (TCP_HEAD
*) ((UINT8
*)IpPayload
+ (((IP4_HEAD
*)IpPayload
)->HeadLen
<< 2));
1087 Checksum
= &TcpHeader
->Checksum
;
1094 PacketChecksum
= NetblockChecksum (
1095 (UINT8
*)IpPayload
+ (((IP4_HEAD
*)IpPayload
)->HeadLen
<< 2),
1096 NTOHS (((IP4_HEAD
*)IpPayload
)->TotalLen
) - (((IP4_HEAD
*)IpPayload
)->HeadLen
<< 2)
1098 PseudoChecksum
= NetPseudoHeadChecksum (
1099 ((IP4_HEAD
*)IpPayload
)->Src
,
1100 ((IP4_HEAD
*)IpPayload
)->Dst
,
1101 ((IP4_HEAD
*)IpPayload
)->Protocol
,
1105 if (Checksum
!= NULL
) {
1106 *Checksum
= NetAddChecksum (PacketChecksum
, PseudoChecksum
);
1107 *Checksum
= (UINT16
) ~(NetAddChecksum (*Checksum
, HTONS((UINT16
)(NTOHS (((IP4_HEAD
*)IpPayload
)->TotalLen
) - (((IP4_HEAD
*)IpPayload
)->HeadLen
<< 2)))));
1111 // Zero OutIP header use this to indicate the input packet is under
1112 // IPsec Tunnel protected.
1116 sizeof (EFI_IP6_HEADER
)
1119 &((EFI_IP6_HEADER
*)IpPayload
)->DestinationAddress
,
1120 &SadData
->TunnelDestAddress
.v6
,
1121 sizeof (EFI_IPv6_ADDRESS
)
1125 // Get the Extension Header and Header length.
1127 IpSecIsIp6ExtsValid (
1128 &((EFI_IP6_HEADER
*)IpPayload
)->NextHeader
,
1129 IpPayload
+ sizeof (EFI_IP6_HEADER
),
1130 ((EFI_IP6_HEADER
*)IpPayload
)->PayloadLength
,
1136 // Recalcualte PseudoChecksum
1138 switch (*LastHead
) {
1139 case EFI_IP_PROTO_UDP
:
1140 UdpHeader
= (EFI_UDP_HEADER
*)((UINT8
*)IpPayload
+ sizeof (EFI_IP6_HEADER
) + OptionLen
);
1141 Checksum
= &UdpHeader
->Checksum
;
1145 case EFI_IP_PROTO_TCP
:
1146 TcpHeader
= (TCP_HEAD
*)(IpPayload
+ sizeof (EFI_IP6_HEADER
) + OptionLen
);
1147 Checksum
= &TcpHeader
->Checksum
;
1152 Icmp6Head
= (IP6_ICMP_HEAD
*) (IpPayload
+ sizeof (EFI_IP6_HEADER
) + OptionLen
);
1153 Checksum
= &Icmp6Head
->Checksum
;
1157 PacketChecksum
= NetblockChecksum (
1158 IpPayload
+ sizeof (EFI_IP6_HEADER
) + OptionLen
,
1159 NTOHS(((EFI_IP6_HEADER
*)IpPayload
)->PayloadLength
) - OptionLen
1161 PseudoChecksum
= NetIp6PseudoHeadChecksum (
1162 &((EFI_IP6_HEADER
*)IpPayload
)->SourceAddress
,
1163 &((EFI_IP6_HEADER
*)IpPayload
)->DestinationAddress
,
1168 if (Checksum
!= NULL
) {
1169 *Checksum
= NetAddChecksum (PacketChecksum
, PseudoChecksum
);
1170 *Checksum
= (UINT16
) ~(NetAddChecksum (
1172 HTONS ((UINT16
)((NTOHS (((EFI_IP6_HEADER
*)(IpPayload
))->PayloadLength
)) - OptionLen
))
1179 The actual entry to create inner header for tunnel mode inbound traffic.
1181 This function is the subfunction of IpSecEspOutboundPacket(). It create
1182 the sending packet by encrypting its payload and inserting ESP header in the orginal
1183 IP header, then return the IpHeader and IPsec protected Fragmentable.
1185 @param[in, out] IpHead Points to IP header containing the orginal IP header
1186 to be processed on input, and inserted ESP header
1188 @param[in] IpVersion The version of IP.
1189 @param[in] SadData The related SAD data.
1190 @param[in, out] LastHead The Last Header in IP header.
1191 @param[in] OptionsBuffer Pointer to the options buffer. It is optional.
1192 @param[in] OptionsLength Length of the options buffer. It is optional.
1193 @param[in, out] FragmentTable Pointer to a list of fragments to be protected by
1194 IPsec on input, and with IPsec protected
1196 @param[in] FragmentCount The number of fragments.
1198 @retval EFI_SUCCESS The operation was successful.
1199 @retval EFI_OUT_OF_RESOURCES The required system resources can't be allocated.
1203 IpSecTunnelOutboundPacket (
1204 IN OUT UINT8
*IpHead
,
1206 IN IPSEC_SAD_DATA
*SadData
,
1207 IN OUT UINT8
*LastHead
,
1208 IN VOID
**OptionsBuffer
,
1209 IN UINT32
*OptionsLength
,
1210 IN OUT EFI_IPSEC_FRAGMENT_DATA
**FragmentTable
,
1211 IN UINT32
*FragmentCount
1216 UINT16 PacketChecksum
;
1218 UINT16 PseudoChecksum
;
1219 IP6_ICMP_HEAD
*IcmpHead
;
1222 if (OptionsLength
== NULL
) {
1226 if (IpVersion
== IP_VERSION_4
) {
1227 InnerHead
= AllocateZeroPool (sizeof (IP4_HEAD
) + *OptionsLength
);
1228 ASSERT (InnerHead
!= NULL
);
1235 InnerHead
+ sizeof (IP4_HEAD
),
1240 InnerHead
= AllocateZeroPool (sizeof (EFI_IP6_HEADER
) + *OptionsLength
);
1244 sizeof (EFI_IP6_HEADER
)
1247 InnerHead
+ sizeof (EFI_IP6_HEADER
),
1252 if (OptionsBuffer
!= NULL
) {
1253 if (*OptionsLength
!= 0) {
1255 *OptionsBuffer
= NULL
;
1261 // 2. Reassamlbe Fragment into Packet
1263 Packet
= NetbufFromExt (
1264 (NET_FRAGMENT
*)(*FragmentTable
),
1268 IpSecOnRecyclePacket
,
1271 ASSERT (Packet
!= NULL
);
1273 // 3. Check the Last Header, if it is TCP, UDP or ICMP recalcualate its pesudo
1276 switch (*LastHead
) {
1277 case EFI_IP_PROTO_UDP
:
1278 Packet
->Udp
= (EFI_UDP_HEADER
*) NetbufGetByte (Packet
, 0, 0);
1279 ASSERT (Packet
->Udp
!= NULL
);
1280 Checksum
= &Packet
->Udp
->Checksum
;
1284 case EFI_IP_PROTO_TCP
:
1285 Packet
->Tcp
= (TCP_HEAD
*) NetbufGetByte (Packet
, 0, 0);
1286 ASSERT (Packet
->Tcp
!= NULL
);
1287 Checksum
= &Packet
->Tcp
->Checksum
;
1292 IcmpHead
= (IP6_ICMP_HEAD
*) NetbufGetByte (Packet
, 0, NULL
);
1293 ASSERT (IcmpHead
!= NULL
);
1294 Checksum
= &IcmpHead
->Checksum
;
1302 PacketChecksum
= NetbufChecksum (Packet
);
1304 if (IpVersion
== IP_VERSION_4
) {
1306 // Replace the source address of Inner Header.
1309 &((IP4_HEAD
*)InnerHead
)->Src
,
1310 &SadData
->SpdSelector
->LocalAddress
[0].Address
.v4
,
1311 sizeof (EFI_IPv4_ADDRESS
)
1314 PacketChecksum
= NetbufChecksum (Packet
);
1315 PseudoChecksum
= NetPseudoHeadChecksum (
1316 ((IP4_HEAD
*)InnerHead
)->Src
,
1317 ((IP4_HEAD
*)InnerHead
)->Dst
,
1324 // Replace the source address of Inner Header.
1327 &((EFI_IP6_HEADER
*)InnerHead
)->SourceAddress
,
1328 &(SadData
->SpdSelector
->LocalAddress
[0].Address
.v6
),
1329 sizeof (EFI_IPv6_ADDRESS
)
1331 PacketChecksum
= NetbufChecksum (Packet
);
1332 PseudoChecksum
= NetIp6PseudoHeadChecksum (
1333 &((EFI_IP6_HEADER
*)InnerHead
)->SourceAddress
,
1334 &((EFI_IP6_HEADER
*)InnerHead
)->DestinationAddress
,
1340 if (Checksum
!= NULL
) {
1341 *Checksum
= NetAddChecksum (PacketChecksum
, PseudoChecksum
);
1342 *Checksum
= (UINT16
) ~(NetAddChecksum ((UINT16
)*Checksum
, HTONS ((UINT16
) Packet
->TotalSize
)));
1345 if (Packet
!= NULL
) {
1346 NetbufFree (Packet
);
1352 The actual entry to relative function processes the inbound traffic of ESP header.
1354 This function is the subfunction of IpSecProtectInboundPacket(). It checks the
1355 received packet security property and trim the ESP header and then returns without
1356 an IPsec protected IP Header and FramgmentTable.
1358 @param[in] IpVersion The version of IP.
1359 @param[in, out] IpHead Points to the IP header containing the ESP header
1360 to be trimed on input, and without ESP header
1362 @param[out] LastHead The Last Header in IP header on return.
1363 @param[in, out] OptionsBuffer Pointer to the options buffer. It is optional.
1364 @param[in, out] OptionsLength Length of the options buffer. It is optional.
1365 @param[in, out] FragmentTable Pointer to a list of fragments in the form of IPsec
1366 protected on input, and without IPsec protected
1368 @param[in, out] FragmentCount The number of fragments.
1369 @param[out] SpdSelector Pointer to contain the address of SPD selector on return.
1370 @param[out] RecycleEvent The event for recycling of resources.
1372 @retval EFI_SUCCESS The operation was successful.
1373 @retval EFI_ACCESS_DENIED One or more following conditions is TRUE:
1374 - ESP header was not found.
1375 - The related SAD entry was not found.
1376 - The related SAD entry does not support the ESP protocol.
1377 @retval EFI_OUT_OF_RESOURCES The required system resource can't be allocated.
1381 IpSecEspInboundPacket (
1383 IN OUT VOID
*IpHead
,
1384 OUT UINT8
*LastHead
,
1385 IN OUT VOID
**OptionsBuffer
, OPTIONAL
1386 IN OUT UINT32
*OptionsLength
, OPTIONAL
1387 IN OUT EFI_IPSEC_FRAGMENT_DATA
**FragmentTable
,
1388 IN OUT UINT32
*FragmentCount
,
1389 OUT EFI_IPSEC_SPD_SELECTOR
**SpdSelector
,
1390 OUT EFI_EVENT
*RecycleEvent
1397 UINTN PlainPayloadSize
;
1400 UINT8
*ProcessBuffer
;
1401 EFI_ESP_HEADER
*EspHeader
;
1402 EFI_ESP_TAIL
*EspTail
;
1403 EFI_IPSEC_SA_ID
*SaId
;
1404 IPSEC_SAD_DATA
*SadData
;
1405 IPSEC_SAD_ENTRY
*SadEntry
;
1406 IPSEC_RECYCLE_CONTEXT
*RecycleContext
;
1408 UINT16 IpSecHeadSize
;
1411 Status
= EFI_SUCCESS
;
1413 ProcessBuffer
= NULL
;
1414 RecycleContext
= NULL
;
1415 *RecycleEvent
= NULL
;
1416 PlainPayloadSize
= 0;
1420 // Build netbuf from fragment table first.
1422 Payload
= NetbufFromExt (
1423 (NET_FRAGMENT
*) *FragmentTable
,
1426 sizeof (EFI_ESP_HEADER
),
1427 IpSecOnRecyclePacket
,
1430 if (Payload
== NULL
) {
1431 Status
= EFI_OUT_OF_RESOURCES
;
1436 // Get the esp size and esp header from netbuf.
1438 EspSize
= Payload
->TotalSize
;
1439 EspHeader
= (EFI_ESP_HEADER
*) NetbufGetByte (Payload
, 0, NULL
);
1441 if (EspHeader
== NULL
) {
1442 Status
= EFI_ACCESS_DENIED
;
1447 // Parse destination address from ip header and found the related SAD Entry.
1449 SadEntry
= IpSecFoundSadFromInboundPacket (
1452 NTOHL (EspHeader
->Spi
)
1455 if (SadEntry
== NULL
) {
1456 Status
= EFI_ACCESS_DENIED
;
1460 SaId
= SadEntry
->Id
;
1461 SadData
= SadEntry
->Data
;
1464 // Only support esp protocol currently.
1466 if (SaId
->Proto
!= EfiIPsecESP
) {
1467 Status
= EFI_ACCESS_DENIED
;
1471 if (!SadData
->ManualSet
) {
1473 // TODO: Check SA lifetime and sequence number
1478 // Allocate buffer for decryption and authentication.
1480 ProcessBuffer
= AllocateZeroPool (EspSize
);
1481 if (ProcessBuffer
== NULL
) {
1482 Status
= EFI_OUT_OF_RESOURCES
;
1486 NetbufCopy (Payload
, 0, (UINT32
) EspSize
, ProcessBuffer
);
1489 // Authenticate the esp wrapped buffer by the auth keys which is from SAD entry.
1492 if (SadData
->AlgoInfo
.EspAlgoInfo
.AuthKey
!= NULL
) {
1493 Status
= IpSecEspAuthVerifyPayload (
1499 if (EFI_ERROR (Status
)) {
1504 // Decrypt the payload by the SAD entry if it has decrypt key.
1506 IvSize
= IpSecGetEncryptIvLength (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
);
1507 if (SadData
->AlgoInfo
.EspAlgoInfo
.EncKey
!= NULL
) {
1508 Status
= IpSecCryptoIoDecrypt (
1509 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
,
1510 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKey
,
1511 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
<< 3,
1512 ProcessBuffer
+ sizeof (EFI_ESP_HEADER
),
1513 ProcessBuffer
+ sizeof (EFI_ESP_HEADER
) + IvSize
,
1514 EspSize
- sizeof (EFI_ESP_HEADER
) - IvSize
- IcvSize
,
1515 ProcessBuffer
+ sizeof (EFI_ESP_HEADER
) + IvSize
1517 if (EFI_ERROR (Status
)) {
1523 // Parse EspTail and compute the plain payload size.
1525 EspTail
= (EFI_ESP_TAIL
*) (ProcessBuffer
+ EspSize
- IcvSize
- sizeof (EFI_ESP_TAIL
));
1526 PaddingSize
= EspTail
->PaddingLength
;
1527 NextHeader
= EspTail
->NextHeader
;
1528 PlainPayloadSize
= EspSize
- sizeof (EFI_ESP_HEADER
) - IvSize
- IcvSize
- sizeof (EFI_ESP_TAIL
) - PaddingSize
;
1531 // TODO: handle anti-replay window
1534 // Decryption and authentication with esp has been done, so it's time to
1535 // reload the new packet, create recycle event and fixup ip header.
1537 RecycleContext
= AllocateZeroPool (sizeof (IPSEC_RECYCLE_CONTEXT
));
1538 if (RecycleContext
== NULL
) {
1539 Status
= EFI_OUT_OF_RESOURCES
;
1543 Status
= gBS
->CreateEvent (
1546 IpSecRecycleCallback
,
1550 if (EFI_ERROR (Status
)) {
1555 // The caller will take responsible to handle the original fragment table
1557 *FragmentTable
= AllocateZeroPool (sizeof (EFI_IPSEC_FRAGMENT_DATA
));
1558 if (*FragmentTable
== NULL
) {
1559 Status
= EFI_OUT_OF_RESOURCES
;
1563 RecycleContext
->PayloadBuffer
= ProcessBuffer
;
1564 RecycleContext
->FragmentTable
= *FragmentTable
;
1567 // If Tunnel, recalculate upper-layyer PesudoCheckSum and trim the out
1569 if (SadData
->Mode
== EfiIPsecTunnel
) {
1570 InnerHead
= ProcessBuffer
+ sizeof (EFI_ESP_HEADER
) + IvSize
;
1571 IpSecTunnelInboundPacket (
1579 if (IpVersion
== IP_VERSION_4
) {
1580 (*FragmentTable
)[0].FragmentBuffer
= InnerHead
;
1581 (*FragmentTable
)[0].FragmentLength
= (UINT32
) PlainPayloadSize
;
1584 (*FragmentTable
)[0].FragmentBuffer
= InnerHead
;
1585 (*FragmentTable
)[0].FragmentLength
= (UINT32
) PlainPayloadSize
;
1588 (*FragmentTable
)[0].FragmentBuffer
= ProcessBuffer
+ sizeof (EFI_ESP_HEADER
) + IvSize
;
1589 (*FragmentTable
)[0].FragmentLength
= (UINT32
) PlainPayloadSize
;
1595 // Update the total length field in ip header since processed by esp.
1597 if (!SadData
->Mode
== EfiIPsecTunnel
) {
1598 if (IpVersion
== IP_VERSION_4
) {
1599 ((IP4_HEAD
*) IpHead
)->TotalLen
= HTONS ((UINT16
) (((IP4_HEAD
*) IpHead
)->HeadLen
+ PlainPayloadSize
));
1601 IpSecHeadSize
= IpSecGetPlainExtHeadSize (IpHead
, LastHead
);
1602 ((EFI_IP6_HEADER
*) IpHead
)->PayloadLength
= HTONS ((UINT16
)(IpSecHeadSize
+ PlainPayloadSize
));
1605 // Update the next layer field in ip header since esp header inserted.
1607 *LastHead
= NextHeader
;
1612 // Update the SPD association of the SAD entry.
1614 *SpdSelector
= SadData
->SpdSelector
;
1617 if (Payload
!= NULL
) {
1618 NetbufFree (Payload
);
1621 if (EFI_ERROR (Status
)) {
1622 if (ProcessBuffer
!= NULL
) {
1623 FreePool (ProcessBuffer
);
1626 if (RecycleContext
!= NULL
) {
1627 FreePool (RecycleContext
);
1630 if (*RecycleEvent
!= NULL
) {
1631 gBS
->CloseEvent (*RecycleEvent
);
1639 The actual entry to the relative function processes the output traffic using the ESP protocol.
1641 This function is the subfunction of IpSecProtectOutboundPacket(). It protected
1642 the sending packet by encrypting its payload and inserting ESP header in the orginal
1643 IP header, then return the IpHeader and IPsec protected Fragmentable.
1645 @param[in] IpVersion The version of IP.
1646 @param[in, out] IpHead Points to IP header containing the orginal IP header
1647 to be processed on input, and inserted ESP header
1649 @param[in, out] LastHead The Last Header in IP header.
1650 @param[in, out] OptionsBuffer Pointer to the options buffer. It is optional.
1651 @param[in, out] OptionsLength Length of the options buffer. It is optional.
1652 @param[in, out] FragmentTable Pointer to a list of fragments to be protected by
1653 IPsec on input, and with IPsec protected
1655 @param[in, out] FragmentCount The number of fragments.
1656 @param[in] SadEntry The related SAD entry.
1657 @param[out] RecycleEvent The event for recycling of resources.
1659 @retval EFI_SUCCESS The operation was successful.
1660 @retval EFI_OUT_OF_RESOURCES The required system resources can't be allocated.
1664 IpSecEspOutboundPacket (
1666 IN OUT VOID
*IpHead
,
1667 IN OUT UINT8
*LastHead
,
1668 IN OUT VOID
**OptionsBuffer
, OPTIONAL
1669 IN OUT UINT32
*OptionsLength
, OPTIONAL
1670 IN OUT EFI_IPSEC_FRAGMENT_DATA
**FragmentTable
,
1671 IN OUT UINT32
*FragmentCount
,
1672 IN IPSEC_SAD_ENTRY
*SadEntry
,
1673 OUT EFI_EVENT
*RecycleEvent
1678 EFI_IPSEC_SA_ID
*SaId
;
1679 IPSEC_SAD_DATA
*SadData
;
1680 IPSEC_RECYCLE_CONTEXT
*RecycleContext
;
1681 UINT8
*ProcessBuffer
;
1683 INTN EncryptBlockSize
;// Size of encryption block, 4 bytes aligned and >= 4
1684 UINTN EspSize
; // Total size of esp wrapped ip payload
1685 UINTN IvSize
; // Size of IV, optional, might be 0
1686 UINTN PlainPayloadSize
;// Original IP payload size
1687 UINTN PaddingSize
; // Size of padding
1688 UINTN EncryptSize
; // Size of data to be encrypted, start after IV and
1690 UINTN IcvSize
; // Size of ICV, optional, might be 0
1691 UINT8
*RestOfPayload
; // Start of Payload after IV
1692 UINT8
*Padding
; // Start address of padding
1693 EFI_ESP_HEADER
*EspHeader
; // Start address of ESP frame
1694 EFI_ESP_TAIL
*EspTail
; // Address behind padding
1696 HASH_DATA_FRAGMENT HashFragment
[1];
1698 Status
= EFI_ACCESS_DENIED
;
1699 SaId
= SadEntry
->Id
;
1700 SadData
= SadEntry
->Data
;
1701 ProcessBuffer
= NULL
;
1702 RecycleContext
= NULL
;
1703 *RecycleEvent
= NULL
;
1706 if (!SadData
->ManualSet
&&
1707 SadData
->AlgoInfo
.EspAlgoInfo
.EncKey
== NULL
&&
1708 SadData
->AlgoInfo
.EspAlgoInfo
.AuthKey
== NULL
1711 // Invalid manual SAD entry configuration.
1717 // Create OutHeader according to Inner Header
1719 if (SadData
->Mode
== EfiIPsecTunnel
) {
1720 InnerHead
= IpSecTunnelOutboundPacket (
1731 if (InnerHead
== NULL
) {
1732 return EFI_INVALID_PARAMETER
;
1738 // Calculate enctrypt block size, need iv by default and 4 bytes alignment.
1740 EncryptBlockSize
= 4;
1742 if (SadData
->AlgoInfo
.EspAlgoInfo
.EncKey
!= NULL
) {
1743 EncryptBlockSize
= IpSecGetEncryptBlockSize (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
);
1745 if (EncryptBlockSize
< 0 || (EncryptBlockSize
!= 1 && EncryptBlockSize
% 4 != 0)) {
1751 // Calculate the plain payload size accroding to the fragment table.
1753 PlainPayloadSize
= 0;
1754 for (Index
= 0; Index
< *FragmentCount
; Index
++) {
1755 PlainPayloadSize
+= (*FragmentTable
)[Index
].FragmentLength
;
1759 // Add IPHeader size for Tunnel Mode
1761 if (SadData
->Mode
== EfiIPsecTunnel
) {
1762 if (IpVersion
== IP_VERSION_4
) {
1763 PlainPayloadSize
+= sizeof (IP4_HEAD
);
1765 PlainPayloadSize
+= sizeof (EFI_IP6_HEADER
);
1768 // OPtions should be encryption into it
1770 PlainPayloadSize
+= *OptionsLength
;
1775 // Calculate icv size, optional by default and 4 bytes alignment.
1778 if (SadData
->AlgoInfo
.EspAlgoInfo
.AuthKey
!= NULL
) {
1779 IcvSize
= IpSecGetIcvLength (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
);
1780 if (IcvSize
% 4 != 0) {
1786 // Calcuate the total size of esp wrapped ip payload.
1788 IvSize
= IpSecGetEncryptIvLength (SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
);
1789 EncryptSize
= (PlainPayloadSize
+ sizeof (EFI_ESP_TAIL
) + EncryptBlockSize
- 1) / EncryptBlockSize
* EncryptBlockSize
;
1790 PaddingSize
= EncryptSize
- PlainPayloadSize
- sizeof (EFI_ESP_TAIL
);
1791 EspSize
= sizeof (EFI_ESP_HEADER
) + IvSize
+ EncryptSize
+ IcvSize
;
1793 ProcessBuffer
= AllocateZeroPool (EspSize
);
1794 if (ProcessBuffer
== NULL
) {
1795 Status
= EFI_OUT_OF_RESOURCES
;
1800 // Calculate esp header and esp tail including header, payload and padding.
1802 EspHeader
= (EFI_ESP_HEADER
*) ProcessBuffer
;
1803 RestOfPayload
= (UINT8
*) (EspHeader
+ 1) + IvSize
;
1804 Padding
= RestOfPayload
+ PlainPayloadSize
;
1805 EspTail
= (EFI_ESP_TAIL
*) (Padding
+ PaddingSize
);
1808 // Fill the sn and spi fields in esp header.
1810 EspHeader
->SequenceNumber
= HTONL ((UINT32
) SadData
->SequenceNumber
+ 1);
1811 //EspHeader->SequenceNumber = HTONL ((UINT32) SadData->SequenceNumber);
1812 EspHeader
->Spi
= HTONL (SaId
->Spi
);
1815 // Copy the rest of payload (after iv) from the original fragment buffer.
1822 if (SadData
->Mode
== EfiIPsecTunnel
) {
1823 if (IpVersion
== IP_VERSION_4
) {
1825 // HeadLen, Total Length
1827 ((IP4_HEAD
*)InnerHead
)->HeadLen
= (UINT8
) ((sizeof (IP4_HEAD
) + *OptionsLength
) >> 2);
1828 ((IP4_HEAD
*)InnerHead
)->TotalLen
= HTONS ((UINT16
) PlainPayloadSize
);
1829 ((IP4_HEAD
*)InnerHead
)->Checksum
= 0;
1830 ((IP4_HEAD
*)InnerHead
)->Checksum
= (UINT16
) (~NetblockChecksum (
1835 RestOfPayload
+ BytesCopied
,
1837 sizeof (IP4_HEAD
) + *OptionsLength
1839 BytesCopied
+= sizeof (IP4_HEAD
) + *OptionsLength
;
1842 ((EFI_IP6_HEADER
*)InnerHead
)->PayloadLength
= HTONS ((UINT16
) (PlainPayloadSize
- sizeof (EFI_IP6_HEADER
)));
1844 RestOfPayload
+ BytesCopied
,
1846 sizeof (EFI_IP6_HEADER
) + *OptionsLength
1848 BytesCopied
+= sizeof (EFI_IP6_HEADER
) + *OptionsLength
;
1852 for (Index
= 0; Index
< *FragmentCount
; Index
++) {
1854 (RestOfPayload
+ BytesCopied
),
1855 (*FragmentTable
)[Index
].FragmentBuffer
,
1856 (*FragmentTable
)[Index
].FragmentLength
1858 BytesCopied
+= (*FragmentTable
)[Index
].FragmentLength
;
1861 // Fill the padding buffer by natural number sequence.
1863 for (Index
= 0; Index
< PaddingSize
; Index
++) {
1864 Padding
[Index
] = (UINT8
) (Index
+ 1);
1867 // Fill the padding length and next header fields in esp tail.
1869 EspTail
->PaddingLength
= (UINT8
) PaddingSize
;
1870 EspTail
->NextHeader
= *LastHead
;
1873 // Fill the next header for Tunnel mode.
1875 if (SadData
->Mode
== EfiIPsecTunnel
) {
1876 if (IpVersion
== IP_VERSION_4
) {
1877 EspTail
->NextHeader
= 4;
1879 EspTail
->NextHeader
= 41;
1884 // Generate iv at random by crypt library.
1886 Status
= IpSecGenerateIv (
1887 (UINT8
*) (EspHeader
+ 1),
1892 if (EFI_ERROR (Status
)) {
1897 // Encryption the payload (after iv) by the SAD entry if has encrypt key.
1899 if (SadData
->AlgoInfo
.EspAlgoInfo
.EncKey
!= NULL
) {
1900 Status
= IpSecCryptoIoEncrypt (
1901 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncAlgoId
,
1902 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKey
,
1903 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.EncKeyLength
<< 3,
1904 (UINT8
*)(EspHeader
+ 1),
1910 if (EFI_ERROR (Status
)) {
1916 // Authenticate the esp wrapped buffer by the SAD entry if it has auth key.
1918 if (SadData
->AlgoInfo
.EspAlgoInfo
.AuthKey
!= NULL
) {
1920 HashFragment
[0].Data
= ProcessBuffer
;
1921 HashFragment
[0].DataSize
= EspSize
- IcvSize
;
1922 Status
= IpSecCryptoIoHmac (
1923 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthAlgoId
,
1924 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKey
,
1925 SadEntry
->Data
->AlgoInfo
.EspAlgoInfo
.AuthKeyLength
,
1928 ProcessBuffer
+ EspSize
- IcvSize
,
1931 if (EFI_ERROR (Status
)) {
1937 // Encryption and authentication with esp has been done, so it's time to
1938 // reload the new packet, create recycle event and fixup ip header.
1940 RecycleContext
= AllocateZeroPool (sizeof (IPSEC_RECYCLE_CONTEXT
));
1941 if (RecycleContext
== NULL
) {
1942 Status
= EFI_OUT_OF_RESOURCES
;
1946 Status
= gBS
->CreateEvent (
1949 IpSecRecycleCallback
,
1953 if (EFI_ERROR (Status
)) {
1957 // Caller take responsible to handle the original fragment table.
1959 *FragmentTable
= AllocateZeroPool (sizeof (EFI_IPSEC_FRAGMENT_DATA
));
1960 if (*FragmentTable
== NULL
) {
1961 Status
= EFI_OUT_OF_RESOURCES
;
1965 RecycleContext
->FragmentTable
= *FragmentTable
;
1966 RecycleContext
->PayloadBuffer
= ProcessBuffer
;
1967 (*FragmentTable
)[0].FragmentBuffer
= ProcessBuffer
;
1968 (*FragmentTable
)[0].FragmentLength
= (UINT32
) EspSize
;
1972 // Update the total length field in ip header since processed by esp.
1974 if (IpVersion
== IP_VERSION_4
) {
1975 ((IP4_HEAD
*) IpHead
)->TotalLen
= HTONS ((UINT16
) ((((IP4_HEAD
*) IpHead
)->HeadLen
<< 2) + EspSize
));
1977 ((EFI_IP6_HEADER
*) IpHead
)->PayloadLength
= (UINT16
) (IpSecGetPlainExtHeadSize (IpHead
, LastHead
) + EspSize
);
1981 // If tunnel mode, it should change the outer Ip header with tunnel source address
1982 // and destination tunnel address.
1984 if (SadData
->Mode
== EfiIPsecTunnel
) {
1985 if (IpVersion
== IP_VERSION_4
) {
1987 &((IP4_HEAD
*) IpHead
)->Src
,
1988 &SadData
->TunnelSourceAddress
.v4
,
1989 sizeof (EFI_IPv4_ADDRESS
)
1992 &((IP4_HEAD
*) IpHead
)->Dst
,
1993 &SadData
->TunnelDestAddress
.v4
,
1994 sizeof (EFI_IPv4_ADDRESS
)
1998 &((EFI_IP6_HEADER
*) IpHead
)->SourceAddress
,
1999 &SadData
->TunnelSourceAddress
.v6
,
2000 sizeof (EFI_IPv6_ADDRESS
)
2003 &((EFI_IP6_HEADER
*) IpHead
)->DestinationAddress
,
2004 &SadData
->TunnelDestAddress
.v6
,
2005 sizeof (EFI_IPv6_ADDRESS
)
2011 // Update the next layer field in ip header since esp header inserted.
2013 *LastHead
= IPSEC_ESP_PROTOCOL
;
2016 // Increase the sn number in SAD entry according to rfc4303.
2018 SadData
->SequenceNumber
++;
2021 if (EFI_ERROR (Status
)) {
2022 if (ProcessBuffer
!= NULL
) {
2023 FreePool (ProcessBuffer
);
2026 if (RecycleContext
!= NULL
) {
2027 FreePool (RecycleContext
);
2030 if (*RecycleEvent
!= NULL
) {
2031 gBS
->CloseEvent (*RecycleEvent
);
2039 This function processes the inbound traffic with IPsec.
2041 It checks the received packet security property, trims the ESP/AH header, and then
2042 returns without an IPsec protected IP Header and FragmentTable.
2044 @param[in] IpVersion The version of IP.
2045 @param[in, out] IpHead Points to IP header containing the ESP/AH header
2046 to be trimed on input, and without ESP/AH header
2048 @param[in, out] LastHead The Last Header in IP header on return.
2049 @param[in, out] OptionsBuffer Pointer to the options buffer. It is optional.
2050 @param[in, out] OptionsLength Length of the options buffer. It is optional.
2051 @param[in, out] FragmentTable Pointer to a list of fragments in form of IPsec
2052 protected on input, and without IPsec protected
2054 @param[in, out] FragmentCount The number of fragments.
2055 @param[out] SpdEntry Pointer to contain the address of SPD entry on return.
2056 @param[out] RecycleEvent The event for recycling of resources.
2058 @retval EFI_SUCCESS The operation was successful.
2059 @retval EFI_UNSUPPORTED The IPSEC protocol is not supported.
2063 IpSecProtectInboundPacket (
2065 IN OUT VOID
*IpHead
,
2066 IN OUT UINT8
*LastHead
,
2067 IN OUT VOID
**OptionsBuffer
, OPTIONAL
2068 IN OUT UINT32
*OptionsLength
, OPTIONAL
2069 IN OUT EFI_IPSEC_FRAGMENT_DATA
**FragmentTable
,
2070 IN OUT UINT32
*FragmentCount
,
2071 OUT EFI_IPSEC_SPD_SELECTOR
**SpdEntry
,
2072 OUT EFI_EVENT
*RecycleEvent
2075 if (*LastHead
== IPSEC_ESP_PROTOCOL
) {
2077 // Process the esp ipsec header of the inbound traffic.
2079 return IpSecEspInboundPacket (
2092 // The other protocols are not supported.
2094 return EFI_UNSUPPORTED
;
2098 This fucntion processes the output traffic with IPsec.
2100 It protected the sending packet by encrypting it payload and inserting ESP/AH header
2101 in the orginal IP header, then return the IpHeader and IPsec protected Fragmentable.
2103 @param[in] IpVersion The version of IP.
2104 @param[in, out] IpHead Point to IP header containing the orginal IP header
2105 to be processed on input, and inserted ESP/AH header
2107 @param[in, out] LastHead The Last Header in IP header.
2108 @param[in, out] OptionsBuffer Pointer to the options buffer. It is optional.
2109 @param[in, out] OptionsLength Length of the options buffer. It is optional.
2110 @param[in, out] FragmentTable Pointer to a list of fragments to be protected by
2111 IPsec on input, and with IPsec protected
2113 @param[in, out] FragmentCount Number of fragments.
2114 @param[in] SadEntry Related SAD entry.
2115 @param[out] RecycleEvent Event for recycling of resources.
2117 @retval EFI_SUCCESS The operation is successful.
2118 @retval EFI_UNSUPPORTED If the IPSEC protocol is not supported.
2122 IpSecProtectOutboundPacket (
2124 IN OUT VOID
*IpHead
,
2125 IN OUT UINT8
*LastHead
,
2126 IN OUT VOID
**OptionsBuffer
, OPTIONAL
2127 IN OUT UINT32
*OptionsLength
, OPTIONAL
2128 IN OUT EFI_IPSEC_FRAGMENT_DATA
**FragmentTable
,
2129 IN OUT UINT32
*FragmentCount
,
2130 IN IPSEC_SAD_ENTRY
*SadEntry
,
2131 OUT EFI_EVENT
*RecycleEvent
2134 if (SadEntry
->Id
->Proto
== EfiIPsecESP
) {
2136 // Process the esp ipsec header of the outbound traffic.
2138 return IpSecEspOutboundPacket (
2151 // The other protocols are not supported.
2153 return EFI_UNSUPPORTED
;