UefiCpuPkg/MpInitLib: Not use disabled AP when call StartAllAPs.

[mirror_edk2.git] / NetworkPkg / IpSecDxe / IkeCommon.c

diff --git a/NetworkPkg/IpSecDxe/IkeCommon.c b/NetworkPkg/IpSecDxe/IkeCommon.c
index 96e0d7930b5a530176d060062a69c0bfc6e0daee..67fc2f4084a5856bc23f30863a6a204b0dea9e1c 100644 (file)
--- a/NetworkPkg/IpSecDxe/IkeCommon.c
+++ b/NetworkPkg/IpSecDxe/IkeCommon.c
@@ -1,7 +1,7 @@
 /** @file\r
   Common operation of the IKE\r
-  \r
-  Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>\r
+\r
+  Copyright (c) 2010 - 2018, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -18,15 +18,56 @@
 #include "IpSecConfigImpl.h"\r
 #include "IpSecDebug.h"\r
 \r
-//\r
-// Initial the SPI\r
-//\r
-UINT32            mNextSpi  = IKE_SPI_BASE;\r
-EFI_GUID          mZeroGuid = { 0, 0, 0, { 0, 0, 0, 0, 0, 0, 0, 0 } };\r
+/**\r
+  Check whether the new generated Spi has existed.\r
+\r
+  @param[in]   IkeSaSession   Pointer to the Child SA Session.\r
+  @param[in]   SpiValue       SPI Value.\r
+\r
+  @retval  TRUE    This SpiValue has existed in the Child SA Session\r
+  @retval  FALSE   This SpiValue doesn't exist in the Child SA Session.\r
+\r
+**/\r
+BOOLEAN\r
+IkeSpiValueExisted (\r
+  IN IKEV2_SA_SESSION      *IkeSaSession,\r
+  IN UINT32                SpiValue\r
+  )\r
+{\r
+  LIST_ENTRY              *Entry;\r
+  LIST_ENTRY              *Next;\r
+  IKEV2_CHILD_SA_SESSION  *SaSession;\r
+\r
+  Entry     = NULL;\r
+  Next      = NULL;\r
+  SaSession = NULL;\r
+\r
+  //\r
+  // Check whether the SPI value has existed in ChildSaEstablishSessionList.\r
+  //\r
+  NET_LIST_FOR_EACH_SAFE (Entry, Next, &IkeSaSession->ChildSaEstablishSessionList) {\r
+    SaSession= IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
+    if (SaSession->LocalPeerSpi == SpiValue) {\r
+      return TRUE;\r
+    }\r
+  }\r
+\r
+  //\r
+  // Check whether the SPI value has existed in ChildSaSessionList.\r
+  //\r
+  NET_LIST_FOR_EACH_SAFE (Entry, Next, &IkeSaSession->ChildSaSessionList) {\r
+    SaSession= IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
+    if (SaSession->LocalPeerSpi == SpiValue) {\r
+      return TRUE;\r
+    }\r
+  }\r
+\r
+  return FALSE;\r
+}\r
 \r
 /**\r
   Call Crypto Lib to generate a random value with eight-octet length.\r
-  \r
+\r
   @return the 64 byte vaule.\r
 \r
 **/\r
@@ -50,8 +91,8 @@ IkeGenerateCookie (
   Generate the random data for Nonce payload.\r
 \r
   @param[in]  NonceSize      Size of the data in bytes.\r
-  \r
-  @return Buffer which contains the random data of the spcified size. \r
+\r
+  @return Buffer which contains the random data of the spcified size.\r
 \r
 **/\r
 UINT8 *\r
@@ -127,7 +168,7 @@ IkePayloadAlloc (
   if (IkePayload == NULL) {\r
     return NULL;\r
   }\r
-  \r
+\r
   IkePayload->Signature = IKE_PAYLOAD_SIGNATURE;\r
 \r
   return IkePayload;\r
@@ -160,18 +201,52 @@ IkePayloadFree (
 /**\r
   Generate an new SPI.\r
 \r
-  @return a SPI in 4 bytes.\r
+  @param[in]       IkeSaSession   Pointer to IKEV2_SA_SESSION related to this Child SA\r
+                                  Session.\r
+  @param[in, out]  SpiValue       Pointer to the new generated SPI value.\r
+\r
+  @retval EFI_SUCCESS         The operation performs successfully.\r
+  @retval Otherwise           The operation is failed.\r
 \r
 **/\r
-UINT32\r
+EFI_STATUS\r
 IkeGenerateSpi (\r
-  VOID\r
+  IN     IKEV2_SA_SESSION         *IkeSaSession,\r
+  IN OUT UINT32                   *SpiValue\r
   )\r
 {\r
-  //\r
-  // TODO: should generate SPI randomly to avoid security issue\r
-  //\r
-  return mNextSpi++;\r
+  EFI_STATUS   Status;\r
+\r
+  Status = EFI_SUCCESS;\r
+\r
+  while (TRUE) {\r
+    //\r
+    // Generate SPI randomly\r
+    //\r
+    Status = IpSecCryptoIoGenerateRandomBytes ((UINT8 *)SpiValue, sizeof (UINT32));\r
+    if (EFI_ERROR (Status)) {\r
+      break;\r
+    }\r
+\r
+    //\r
+    // The set of SPI values in the range 1 through 255 are reserved by the\r
+    // Internet Assigned Numbers Authority (IANA) for future use; a reserved\r
+    // SPI value will not normally be assigned by IANA unless the use of the\r
+    // assigned SPI value is specified in an RFC.\r
+    //\r
+    if (*SpiValue < IKE_SPI_BASE) {\r
+      *SpiValue += IKE_SPI_BASE;\r
+    }\r
+\r
+    //\r
+    // Check whether the new generated SPI has existed.\r
+    //\r
+    if (!IkeSpiValueExisted (IkeSaSession, *SpiValue)) {\r
+      break;\r
+    }\r
+  }\r
+\r
+  return Status;\r
 }\r
 \r
 /**\r