NetworkPkg/IpSecDxe: Fix wrong IKE header "FLAG" update

*v2: update the commit log and refine the code comments.

There are three kinds of IKE Exchange process:
#1. Initial Exchange
#2. CREATE_CHILD_SA_Exchange
#3. Information Exchange

The IKE header "FLAG" update is incorrect in #2 and #3 exchange,
which may cause the continue session failure. This patch is used
to correct the updates of IKE header "FLAG" according the RFC4306
section 3.1.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>

diff --git a/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c b/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c
index 1f0199b22d90314599ca3b6c371157dbf5e29035..eaccad20862fe36de6ab56f12bfb43d2bde38a2a 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/ChildSa.c
@@ -76,9 +76,7 @@ Ikev2CreateChildGenerator (
     }    \r
     \r
     if (ChildSaSession->SessionCommon.IsInitiator) {\r
-      IkePacket->Header->Flags = IKE_HEADER_FLAGS_CHILD_INIT;\r
-    } else {\r
-      IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;\r
+      IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;\r
     }\r
       \r
   } else {\r
@@ -96,11 +94,13 @@ Ikev2CreateChildGenerator (
     }    \r
     \r
     if (IkeSaSession->SessionCommon.IsInitiator) {\r
-      IkePacket->Header->Flags = IKE_HEADER_FLAGS_CHILD_INIT;\r
-    } else {\r
-      IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;\r
+      IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;\r
     }\r
-  } \r
+  }\r
+\r
+  if (MessageId != NULL) {\r
+    IkePacket->Header->Flags |= IKE_HEADER_FLAGS_RESPOND;\r
+  }\r
    \r
   //\r
   // According to RFC4306, Chapter 4.\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Exchange.c b/NetworkPkg/IpSecDxe/Ikev2/Exchange.c
index 1eddbfbcf10432efba87fb17fec87a68057d98d6..5609964fa4ab33d7b01711cabb4bc002a546f459 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Exchange.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Exchange.c
@@ -705,7 +705,7 @@ ON_REPLY:
   //\r
   // Generate the reply packet if needed and send it out.\r
   //\r
-  if (IkePacket->Header->Flags != IKE_HEADER_FLAGS_RESPOND) {\r
+  if (!(IkePacket->Header->Flags & IKE_HEADER_FLAGS_RESPOND)) {\r
     Reply = mIkev2CreateChild.Generator ((UINT8 *) IkeSaSession, &IkePacket->Header->MessageId);\r
     if (Reply != NULL) {\r
       Status = Ikev2SendIkePacket (UdpService, (UINT8 *) &(IkeSaSession->SessionCommon), Reply, 0);\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Info.c b/NetworkPkg/IpSecDxe/Ikev2/Info.c
index 23e47ceea8a652658d836530375c2f64565088c2..0d2b29081758d6341444d53066cf615137244acf 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Info.c
+++ b/NetworkPkg/IpSecDxe/Ikev2/Info.c
@@ -128,7 +128,11 @@ Ikev2InfoGenerator (
       // The input parameter is not correct.\r
       //\r
       goto ERROR_EXIT;\r
-    } \r
+    }\r
+\r
+    if (IkeSaSession->SessionCommon.IsInitiator) {\r
+      IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT ;\r
+    }  \r
   } else {\r
     //\r
     // Delete the Child SA Information Exchagne\r
@@ -180,13 +184,16 @@ Ikev2InfoGenerator (
     // Change the IsOnDeleting Flag\r
     //\r
     ChildSaSession->SessionCommon.IsOnDeleting = TRUE;\r
+\r
+    if (ChildSaSession->SessionCommon.IsInitiator) {\r
+      IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT ;\r
+    }\r
   }\r
 \r
-  if (InfoContext == NULL) {\r
-    IkePacket->Header->Flags = IKE_HEADER_FLAGS_INIT;\r
-  } else {\r
-    IkePacket->Header->Flags = IKE_HEADER_FLAGS_RESPOND;\r
+  if (InfoContext != NULL) {\r
+    IkePacket->Header->Flags |= IKE_HEADER_FLAGS_RESPOND;\r
   }\r
+  \r
   return IkePacket;\r
 \r
 ERROR_EXIT:\r

diff --git a/NetworkPkg/IpSecDxe/Ikev2/Payload.h b/NetworkPkg/IpSecDxe/Ikev2/Payload.h
index 6096a3ba77b6ca93b1936aadb2824781fe78e275..7a85792ed7fe567a52ecfdbe07111b395f999e65 100644 (file)
--- a/NetworkPkg/IpSecDxe/Ikev2/Payload.h
+++ b/NetworkPkg/IpSecDxe/Ikev2/Payload.h
@@ -1,7 +1,7 @@
 /** @file\r
   The Definitions related to IKEv2 payload.\r
 \r
-  Copyright (c) 2010, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.<BR>\r
 \r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
@@ -37,11 +37,16 @@
 #define IKEV2_PAYLOAD_TYPE_EAP      48\r
 \r
 //\r
-// IKE header Flag for IKEv2\r
+// IKE header Flag (1 octet) for IKEv2, defined in RFC 4306 section 3.1 \r
+//\r
+// I(nitiator) (bit 3 of Flags, 0x08) - This bit MUST be set in messages sent by the \r
+//                                      original initiator of the IKE_SA\r
+//\r
+// R(esponse) (bit 5 of Flags, 0x20)  - This bit indicates that this message is a response to \r
+//                                      a message containing the same message ID.\r
 //\r
 #define IKE_HEADER_FLAGS_INIT       0x08\r
 #define IKE_HEADER_FLAGS_RESPOND    0x20\r
-#define IKE_HEADER_FLAGS_CHILD_INIT 0\r
 \r
 //\r
 // IKE Header Exchange Type for IKEv2\r