]> git.proxmox.com Git - mirror_edk2.git/blame - NetworkPkg/IpSecDxe/Ikev2/Utility.c
projects / mirror_edk2.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
NetworkPkg: Remove unused variables from IpSecDxe to fix GCC build.
[mirror_edk2.git] / NetworkPkg / IpSecDxe / Ikev2 / Utility.c
CommitLineData
9166f840 1/** @file\r
2 The Common operations used by IKE Exchange Process.\r
3\r
e8837edd 4 (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>\r
393a3169 5 Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>\r
9166f840 6\r
7 This program and the accompanying materials\r
8 are licensed and made available under the terms and conditions of the BSD License\r
9 which accompanies this distribution. The full text of the license may be found at\r
10 http://opensource.org/licenses/bsd-license.php.\r
11\r
12 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
13 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
14\r
15**/\r
16\r
17#include "Utility.h"\r
18#include "IpSecDebug.h"\r
19#include "IkeService.h"\r
20#include "IpSecConfigImpl.h"\r
21\r
22UINT16 mIkev2EncryptAlgorithmList[IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM] = {\r
23 IKEV2_TRANSFORM_ID_ENCR_3DES,\r
24 IKEV2_TRANSFORM_ID_ENCR_AES_CBC, \r
25};\r
26\r
27UINT16 mIkev2PrfAlgorithmList[IKEV2_SUPPORT_PRF_ALGORITHM_NUM] = {\r
28 IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1,\r
29};\r
30\r
31UINT16 mIkev2DhGroupAlgorithmList[IKEV2_SUPPORT_DH_ALGORITHM_NUM] = {\r
32 IKEV2_TRANSFORM_ID_DH_1024MODP,\r
33 IKEV2_TRANSFORM_ID_DH_2048MODP,\r
34};\r
35\r
36UINT16 mIkev2AuthAlgorithmList[IKEV2_SUPPORT_AUTH_ALGORITHM_NUM] = {\r
37 IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96,\r
38};\r
39\r
40/**\r
41 Allocate buffer for IKEV2_SA_SESSION and initialize it.\r
42\r
43 @param[in] Private Pointer to IPSEC_PRIVATE_DATA.\r
44 @param[in] UdpService Pointer to IKE_UDP_SERVICE related to this IKE SA Session.\r
45\r
46 @return Pointer to IKEV2_SA_SESSION or NULL.\r
47\r
48**/\r
49IKEV2_SA_SESSION *\r
50Ikev2SaSessionAlloc (\r
51 IN IPSEC_PRIVATE_DATA *Private,\r
52 IN IKE_UDP_SERVICE *UdpService\r
53 )\r
54{\r
55 EFI_STATUS Status;\r
56 IKEV2_SESSION_COMMON *SessionCommon;\r
57 IKEV2_SA_SESSION *IkeSaSession;\r
58\r
59 IkeSaSession = AllocateZeroPool (sizeof (IKEV2_SA_SESSION));\r
60 ASSERT (IkeSaSession != NULL);\r
61\r
62 //\r
63 // Initialize the fields of IkeSaSession and its SessionCommon.\r
64 //\r
65 IkeSaSession->NCookie = NULL;\r
66 IkeSaSession->Signature = IKEV2_SA_SESSION_SIGNATURE;\r
67 IkeSaSession->InitiatorCookie = IkeGenerateCookie ();\r
68 IkeSaSession->ResponderCookie = 0;\r
69 //\r
70 // BUGBUG: Message ID starts from 2 is to match the OpenSwan requirement, but it \r
71 // might not match the IPv6 Logo. In its test specification, it mentions that\r
72 // the Message ID should start from zero after the IKE_SA_INIT exchange.\r
73 //\r
74 IkeSaSession->MessageId = 2;\r
75 SessionCommon = &IkeSaSession->SessionCommon;\r
76 SessionCommon->UdpService = UdpService;\r
77 SessionCommon->Private = Private;\r
78 SessionCommon->IkeSessionType = IkeSessionTypeIkeSa;\r
79 SessionCommon->IkeVer = 2;\r
80 SessionCommon->AfterEncodePayload = NULL;\r
81 SessionCommon->BeforeDecodePayload = NULL;\r
82\r
83 //\r
84 // Create a resend notfiy event for retry.\r
85 //\r
86 Status = gBS->CreateEvent (\r
87 EVT_TIMER | EVT_NOTIFY_SIGNAL,\r
88 TPL_CALLBACK,\r
89 Ikev2ResendNotify,\r
90 SessionCommon,\r
91 &SessionCommon->TimeoutEvent\r
92 );\r
93\r
94 if (EFI_ERROR (Status)) {\r
95 FreePool (IkeSaSession);\r
96 return NULL;\r
97 }\r
98\r
99 //\r
100 // Initialize the lists in IkeSaSession.\r
101 //\r
102 InitializeListHead (&IkeSaSession->ChildSaSessionList);\r
103 InitializeListHead (&IkeSaSession->ChildSaEstablishSessionList);\r
104 InitializeListHead (&IkeSaSession->InfoMIDList);\r
105 InitializeListHead (&IkeSaSession->DeleteSaList);\r
106\r
107 return IkeSaSession;\r
108}\r
109\r
110/**\r
111 Register the established IKEv2 SA into Private->Ikev2EstablishedList. If there is\r
112 IKEV2_SA_SESSION with same remote peer IP, remove the old one then register the\r
113 new one.\r
114\r
115 @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION to be registered.\r
116 @param[in] Private Pointer to IPSEC_PRAVATE_DATA.\r
117\r
118**/\r
119VOID\r
120Ikev2SaSessionReg (\r
121 IN IKEV2_SA_SESSION *IkeSaSession,\r
122 IN IPSEC_PRIVATE_DATA *Private\r
123 )\r
124{\r
125 IKEV2_SESSION_COMMON *SessionCommon;\r
126 IKEV2_SA_SESSION *OldIkeSaSession;\r
127 EFI_STATUS Status;\r
128 UINT64 Lifetime;\r
129\r
130 //\r
131 // Keep IKE SA exclusive to remote ip address.\r
132 //\r
133 SessionCommon = &IkeSaSession->SessionCommon;\r
134 OldIkeSaSession = Ikev2SaSessionRemove (&Private->Ikev2EstablishedList, &SessionCommon->RemotePeerIp);\r
135 if (OldIkeSaSession != NULL) {\r
136 //\r
137 // TODO: It should delete all child SAs if rekey the IKE SA.\r
138 //\r
139 Ikev2SaSessionFree (OldIkeSaSession);\r
140 }\r
141\r
142 //\r
143 // Cleanup the fields of SessionCommon for processing.\r
144 // \r
145 Ikev2SessionCommonRefresh (SessionCommon);\r
146\r
147 //\r
148 // Insert the ready IKE SA session into established list.\r
149 //\r
150 Ikev2SaSessionInsert (&Private->Ikev2EstablishedList, IkeSaSession, &SessionCommon->RemotePeerIp);\r
151\r
152 //\r
153 // Create a notfiy event for the IKE SA life time counting.\r
154 //\r
155 Status = gBS->CreateEvent (\r
156 EVT_TIMER | EVT_NOTIFY_SIGNAL,\r
157 TPL_CALLBACK,\r
158 Ikev2LifetimeNotify,\r
159 SessionCommon,\r
160 &SessionCommon->TimeoutEvent\r
161 );\r
162 if (EFI_ERROR(Status)){\r
163 //\r
164 // If TimerEvent creation failed, the SA will be alive untill user disable it or \r
165 // receiving a Delete Payload from peer. \r
166 //\r
167 return;\r
168 }\r
169\r
170 //\r
171 // Start to count the lifetime of the IKE SA.\r
172 //\r
173 if (IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime == 0) {\r
174 Lifetime = IKE_SA_DEFAULT_LIFETIME;\r
175 } else {\r
176 Lifetime = IkeSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;\r
177 }\r
178 \r
179 Status = gBS->SetTimer (\r
180 SessionCommon->TimeoutEvent,\r
181 TimerRelative,\r
182 MultU64x32(Lifetime, 10000000) // ms->100ns\r
183 );\r
184 if (EFI_ERROR(Status)){\r
185 //\r
186 // If SetTimer failed, the SA will be alive untill user disable it or \r
187 // receiving a Delete Payload from peer. \r
188 //\r
189 return ;\r
190 }\r
191\r
192 DEBUG ((\r
193 DEBUG_INFO,\r
194 "\n------IkeSa established and start to count down %d seconds lifetime\n",\r
195 Lifetime\r
196 ));\r
197\r
198 return ;\r
199}\r
200\r
201/**\r
202 Find a IKEV2_SA_SESSION by the remote peer IP.\r
203\r
204 @param[in] SaSessionList SaSession List to be searched.\r
205 @param[in] RemotePeerIp Pointer to specified IP address.\r
206\r
207 @return Pointer to IKEV2_SA_SESSION if find one or NULL.\r
208\r
209**/\r
210IKEV2_SA_SESSION *\r
211Ikev2SaSessionLookup (\r
212 IN LIST_ENTRY *SaSessionList,\r
213 IN EFI_IP_ADDRESS *RemotePeerIp\r
214 )\r
215{\r
216 LIST_ENTRY *Entry;\r
217 IKEV2_SA_SESSION *IkeSaSession;\r
218\r
219 NET_LIST_FOR_EACH (Entry, SaSessionList) {\r
220 IkeSaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);\r
221\r
222 if (CompareMem (\r
223 &IkeSaSession->SessionCommon.RemotePeerIp,\r
224 RemotePeerIp,\r
225 sizeof (EFI_IP_ADDRESS)\r
226 ) == 0) {\r
227\r
228 return IkeSaSession;\r
229 }\r
230 }\r
231\r
232 return NULL;\r
233}\r
234\r
235/**\r
236 Insert a IKE_SA_SESSION into IkeSaSession list. The IkeSaSession list is either\r
237 Private->Ikev2SaSession list or Private->Ikev2EstablishedList list.\r
238\r
239 @param[in] SaSessionList Pointer to list to be inserted into.\r
240 @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION to be inserted. \r
241 @param[in] RemotePeerIp Pointer to EFI_IP_ADDRESSS to indicate the \r
242 unique IKEV2_SA_SESSION.\r
243\r
244**/\r
245VOID\r
246Ikev2SaSessionInsert (\r
247 IN LIST_ENTRY *SaSessionList,\r
248 IN IKEV2_SA_SESSION *IkeSaSession,\r
249 IN EFI_IP_ADDRESS *RemotePeerIp\r
250 )\r
251{\r
252 Ikev2SaSessionRemove (SaSessionList, RemotePeerIp);\r
253 InsertTailList (SaSessionList, &IkeSaSession->BySessionTable);\r
254}\r
255\r
256/**\r
257 Remove the SA Session by Remote Peer IP.\r
258\r
259 @param[in] SaSessionList Pointer to list to be searched.\r
260 @param[in] RemotePeerIp Pointer to EFI_IP_ADDRESS to use for SA Session search.\r
261\r
262 @retval Pointer to IKEV2_SA_SESSION with the specified remote IP address or NULL. \r
263\r
264**/\r
265IKEV2_SA_SESSION *\r
266Ikev2SaSessionRemove (\r
267 IN LIST_ENTRY *SaSessionList,\r
268 IN EFI_IP_ADDRESS *RemotePeerIp\r
269 )\r
270{\r
271 LIST_ENTRY *Entry;\r
272 IKEV2_SA_SESSION *IkeSaSession;\r
273\r
274 NET_LIST_FOR_EACH (Entry, SaSessionList) {\r
275 IkeSaSession = IKEV2_SA_SESSION_BY_SESSION (Entry);\r
276\r
277 if (CompareMem (\r
278 &IkeSaSession->SessionCommon.RemotePeerIp,\r
279 RemotePeerIp,\r
280 sizeof (EFI_IP_ADDRESS)\r
281 ) == 0) {\r
282\r
283 RemoveEntryList (Entry);\r
284 return IkeSaSession;\r
285 }\r
286 }\r
287\r
288 return NULL;\r
289}\r
290\r
291/**\r
292 Marking a SA session as on deleting.\r
293\r
294 @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION.\r
295\r
296 @retval EFI_SUCCESS Find the related SA session and marked it.\r
297\r
298**/\r
299EFI_STATUS\r
300Ikev2SaSessionOnDeleting (\r
301 IN IKEV2_SA_SESSION *IkeSaSession\r
302 )\r
303{\r
304 return EFI_SUCCESS;\r
305}\r
306\r
307/**\r
308 Free specified Seession Common. The session common would belong to a IKE SA or \r
309 a Child SA.\r
310\r
311 @param[in] SessionCommon Pointer to a Session Common.\r
312\r
313**/\r
314VOID\r
315Ikev2SaSessionCommonFree (\r
316 IN IKEV2_SESSION_COMMON *SessionCommon\r
317 )\r
318{\r
319\r
320 ASSERT (SessionCommon != NULL);\r
321\r
322 if (SessionCommon->LastSentPacket != NULL) {\r
323 IkePacketFree (SessionCommon->LastSentPacket);\r
324 }\r
325\r
326 if (SessionCommon->SaParams != NULL) {\r
327 FreePool (SessionCommon->SaParams);\r
328 }\r
329 if (SessionCommon->TimeoutEvent != NULL) {\r
330 gBS->CloseEvent (SessionCommon->TimeoutEvent);\r
331 }\r
332}\r
333\r
334/**\r
335 After IKE/Child SA is estiblished, close the time event and free sent packet.\r
336\r
337 @param[in] SessionCommon Pointer to a Session Common.\r
338\r
339**/\r
340VOID\r
341Ikev2SessionCommonRefresh (\r
342 IN IKEV2_SESSION_COMMON *SessionCommon\r
343 )\r
344{\r
345 ASSERT (SessionCommon != NULL);\r
346\r
347 gBS->CloseEvent (SessionCommon->TimeoutEvent);\r
348 SessionCommon->TimeoutEvent = NULL;\r
349 SessionCommon->TimeoutInterval = 0;\r
350 SessionCommon->RetryCount = 0;\r
351 if (SessionCommon->LastSentPacket != NULL) {\r
352 IkePacketFree (SessionCommon->LastSentPacket);\r
353 SessionCommon->LastSentPacket = NULL;\r
354 }\r
355\r
356 return ;\r
357}\r
358/**\r
359 Free specified IKEV2 SA Session. \r
360\r
361 @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION to be freed.\r
362\r
363**/\r
364VOID\r
365Ikev2SaSessionFree (\r
366 IN IKEV2_SA_SESSION *IkeSaSession\r
367 )\r
368{\r
369 IKEV2_SESSION_KEYS *IkeKeys;\r
370 LIST_ENTRY *Entry;\r
371 IKEV2_CHILD_SA_SESSION *ChildSa;\r
372 IKEV2_DH_BUFFER *DhBuffer;\r
373\r
374 ASSERT (IkeSaSession != NULL);\r
375 \r
376 //\r
377 // Delete Common Session\r
378 //\r
379 Ikev2SaSessionCommonFree (&IkeSaSession->SessionCommon);\r
380\r
381 //\r
382 // Delete ChildSaEstablish List and SAD\r
383 //\r
384 for (Entry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;\r
385 Entry != &IkeSaSession->ChildSaEstablishSessionList;\r
386 ) {\r
387\r
388 ChildSa = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
389 Entry = Entry->ForwardLink;\r
390 Ikev2ChildSaSilentDelete (ChildSa->IkeSaSession, ChildSa->LocalPeerSpi);\r
391\r
392 }\r
393\r
394 //\r
395 // Delete ChildSaSessionList\r
396 //\r
397 for ( Entry = IkeSaSession->ChildSaSessionList.ForwardLink;\r
398 Entry != &IkeSaSession->ChildSaSessionList;\r
399 ){\r
400 ChildSa = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
401 Entry = Entry->ForwardLink;\r
402 RemoveEntryList (Entry->BackLink);\r
403 Ikev2ChildSaSessionFree (ChildSa);\r
404 }\r
405\r
406 //\r
407 // Delete DhBuffer and Keys\r
408 //\r
409 if (IkeSaSession->IkeKeys != NULL) {\r
410 IkeKeys = IkeSaSession->IkeKeys;\r
411 DhBuffer = IkeKeys->DhBuffer;\r
412\r
413 //\r
414 // Delete DhBuffer\r
415 //\r
416 Ikev2DhBufferFree (DhBuffer);\r
417\r
418 //\r
419 // Delete Keys\r
420 // \r
421 if (IkeKeys->SkAiKey != NULL) {\r
422 FreePool (IkeKeys->SkAiKey);\r
423 }\r
424 if (IkeKeys->SkArKey != NULL) {\r
425 FreePool (IkeKeys->SkArKey);\r
426 }\r
427 if (IkeKeys->SkdKey != NULL) {\r
428 FreePool (IkeKeys->SkdKey);\r
429 }\r
430 if (IkeKeys->SkEiKey != NULL) {\r
431 FreePool (IkeKeys->SkEiKey);\r
432 }\r
433 if (IkeKeys->SkErKey != NULL) {\r
434 FreePool (IkeKeys->SkErKey);\r
435 }\r
436 if (IkeKeys->SkPiKey != NULL) {\r
437 FreePool (IkeKeys->SkPiKey);\r
438 }\r
439 if (IkeKeys->SkPrKey != NULL) {\r
440 FreePool (IkeKeys->SkPrKey);\r
441 }\r
442 FreePool (IkeKeys);\r
443 }\r
444\r
445 if (IkeSaSession->SaData != NULL) {\r
446 FreePool (IkeSaSession->SaData);\r
447 }\r
448\r
449 if (IkeSaSession->NiBlock != NULL) {\r
450 FreePool (IkeSaSession->NiBlock);\r
451 }\r
452\r
453 if (IkeSaSession->NrBlock != NULL) {\r
454 FreePool (IkeSaSession->NrBlock);\r
455 }\r
456\r
457 if (IkeSaSession->NCookie != NULL) {\r
458 FreePool (IkeSaSession->NCookie);\r
459 }\r
460\r
461 if (IkeSaSession->InitPacket != NULL) {\r
462 FreePool (IkeSaSession->InitPacket);\r
463 }\r
464\r
465 if (IkeSaSession->RespPacket != NULL) {\r
466 FreePool (IkeSaSession->RespPacket);\r
467 }\r
468\r
469 FreePool (IkeSaSession);\r
470\r
471 return ;\r
472}\r
473\r
474/**\r
475 Increase the MessageID in IkeSaSession.\r
476\r
477 @param[in] IkeSaSession Pointer to a specified IKEV2_SA_SESSION.\r
478\r
479**/\r
480VOID\r
481Ikev2SaSessionIncreaseMessageId (\r
482 IN IKEV2_SA_SESSION *IkeSaSession\r
483 )\r
484{\r
485 if (IkeSaSession->MessageId < 0xffffffff) {\r
486 IkeSaSession->MessageId ++;\r
487 } else {\r
488 //\r
489 // TODO: Trigger Rekey process.\r
490 //\r
491 }\r
492}\r
493\r
494/**\r
495 Allocate memory for IKEV2 Child SA Session.\r
496 \r
497 @param[in] UdpService Pointer to IKE_UDP_SERVICE.\r
498 @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION related to this Child SA \r
499 Session.\r
500\r
501 @retval Pointer of a new created IKEV2 Child SA Session or NULL.\r
502\r
503**/\r
504IKEV2_CHILD_SA_SESSION *\r
505Ikev2ChildSaSessionAlloc (\r
506 IN IKE_UDP_SERVICE *UdpService,\r
507 IN IKEV2_SA_SESSION *IkeSaSession\r
508 )\r
509{\r
510 EFI_STATUS Status;\r
511 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
512 IKEV2_SESSION_COMMON *ChildSaCommon;\r
513 IKEV2_SESSION_COMMON *SaCommon;\r
514\r
515 ChildSaSession = AllocateZeroPool (sizeof (IKEV2_CHILD_SA_SESSION));\r
516 if (ChildSaSession == NULL) {\r
517 return NULL;\r
518 }\r
519\r
520 //\r
521 // Initialize the fields of ChildSaSession and its SessionCommon.\r
522 //\r
523 ChildSaSession->Signature = IKEV2_CHILD_SA_SESSION_SIGNATURE;\r
524 ChildSaSession->IkeSaSession = IkeSaSession;\r
525 ChildSaSession->MessageId = IkeSaSession->MessageId;\r
526 ChildSaSession->LocalPeerSpi = IkeGenerateSpi ();\r
527 ChildSaCommon = &ChildSaSession->SessionCommon;\r
528 ChildSaCommon->UdpService = UdpService;\r
529 ChildSaCommon->Private = IkeSaSession->SessionCommon.Private;\r
530 ChildSaCommon->IkeSessionType = IkeSessionTypeChildSa;\r
531 ChildSaCommon->IkeVer = 2;\r
532 ChildSaCommon->AfterEncodePayload = Ikev2ChildSaAfterEncodePayload;\r
533 ChildSaCommon->BeforeDecodePayload = Ikev2ChildSaBeforeDecodePayload;\r
534 SaCommon = &ChildSaSession->IkeSaSession->SessionCommon;\r
535\r
536 //\r
537 // Create a resend notfiy event for retry.\r
538 //\r
539 Status = gBS->CreateEvent (\r
540 EVT_TIMER | EVT_NOTIFY_SIGNAL,\r
541 TPL_CALLBACK,\r
542 Ikev2ResendNotify,\r
543 ChildSaCommon,\r
544 &ChildSaCommon->TimeoutEvent\r
545 );\r
546 if (EFI_ERROR (Status)) {\r
547 FreePool (ChildSaSession);\r
548 return NULL;\r
549 }\r
550\r
551 CopyMem (&ChildSaCommon->LocalPeerIp, &SaCommon->LocalPeerIp, sizeof (EFI_IP_ADDRESS));\r
552 CopyMem (&ChildSaCommon->RemotePeerIp, &SaCommon->RemotePeerIp, sizeof (EFI_IP_ADDRESS));\r
553\r
554 return ChildSaSession;\r
555}\r
556\r
557/**\r
558 Register a established IKEv2 Child SA into IkeSaSession->ChildSaEstablishSessionList. \r
559 If the there is IKEV2_CHILD_SA_SESSION with same remote peer IP, remove the old one \r
560 then register the new one.\r
561\r
562 @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION to be registered.\r
563 @param[in] Private Pointer to IPSEC_PRAVATE_DATA.\r
564\r
565**/\r
566VOID\r
567Ikev2ChildSaSessionReg (\r
568 IN IKEV2_CHILD_SA_SESSION *ChildSaSession,\r
569 IN IPSEC_PRIVATE_DATA *Private\r
570 )\r
571{\r
572 IKEV2_SESSION_COMMON *SessionCommon;\r
573 IKEV2_CHILD_SA_SESSION *OldChildSaSession;\r
574 IKEV2_SA_SESSION *IkeSaSession;\r
9166f840 575 EFI_STATUS Status;\r
576 UINT64 Lifetime;\r
577\r
578 //\r
579 // Keep the IKE SA exclusive.\r
580 //\r
581 SessionCommon = &ChildSaSession->SessionCommon;\r
582 IkeSaSession = ChildSaSession->IkeSaSession;\r
583 OldChildSaSession = Ikev2ChildSaSessionRemove (\r
584 &IkeSaSession->ChildSaEstablishSessionList,\r
585 ChildSaSession->LocalPeerSpi,\r
586 IKEV2_ESTABLISHED_CHILDSA_LIST\r
587 );\r
588 if (OldChildSaSession != NULL) {\r
589 //\r
590 // Free the old one.\r
591 //\r
592 Ikev2ChildSaSessionFree (OldChildSaSession);\r
593 }\r
594\r
595 //\r
596 // Store the ready child SA into SAD.\r
597 //\r
598 Ikev2StoreSaData (ChildSaSession);\r
599\r
600 //\r
601 // Cleanup the fields of SessionCommon for processing.\r
602 // \r
603 Ikev2SessionCommonRefresh (SessionCommon);\r
604 \r
605 //\r
606 // Insert the ready child SA session into established list.\r
607 //\r
608 Ikev2ChildSaSessionInsert (&IkeSaSession->ChildSaEstablishSessionList, ChildSaSession);\r
609\r
610 //\r
611 // Create a Notify event for the IKE SA life time counting.\r
612 //\r
613 Status = gBS->CreateEvent (\r
614 EVT_TIMER | EVT_NOTIFY_SIGNAL,\r
615 TPL_CALLBACK,\r
616 Ikev2LifetimeNotify,\r
617 SessionCommon,\r
618 &SessionCommon->TimeoutEvent\r
619 );\r
620 if (EFI_ERROR(Status)){\r
621 return ;\r
622 }\r
623\r
624 //\r
625 // Start to count the lifetime of the IKE SA.\r
626 //\r
9166f840 627 if (ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime != 0){\r
628 Lifetime = ChildSaSession->Spd->Data->ProcessingPolicy->SaLifetime.HardLifetime;\r
629 } else {\r
630 Lifetime = CHILD_SA_DEFAULT_LIFETIME;\r
631 }\r
632\r
633 Status = gBS->SetTimer (\r
634 SessionCommon->TimeoutEvent,\r
635 TimerRelative,\r
636 MultU64x32(Lifetime, 10000000) // ms->100ns\r
637 );\r
638 if (EFI_ERROR(Status)){\r
639 return ;\r
640 }\r
641\r
642 DEBUG ((\r
643 DEBUG_INFO,\r
644 "\n------ChildSa established and start to count down %d seconds lifetime\n",\r
645 Lifetime\r
646 ));\r
647\r
648 return ;\r
649}\r
650\r
651/**\r
652 Find the ChildSaSession by it's MessagId.\r
653\r
654 @param[in] SaSessionList Pointer to a ChildSaSession List.\r
655 @param[in] Mid The messageId used to search ChildSaSession.\r
656\r
657 @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.\r
658\r
659**/\r
660IKEV2_CHILD_SA_SESSION *\r
661Ikev2ChildSaSessionLookupByMid (\r
662 IN LIST_ENTRY *SaSessionList,\r
663 IN UINT32 Mid\r
664 )\r
665{\r
666 LIST_ENTRY *Entry;\r
667 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
44de1013 668\r
9166f840 669 NET_LIST_FOR_EACH (Entry, SaSessionList) {\r
670 ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
44de1013 671\r
9166f840 672 if (ChildSaSession->MessageId == Mid) {\r
44de1013
HT		 673 return ChildSaSession;\r
674 }\r
9166f840 675 }\r
676 return NULL;\r
677}\r
678\r
679/**\r
680 This function find the Child SA by the specified SPI.\r
44de1013
HT		 681\r
682 This functin find a ChildSA session by searching the ChildSaSessionlist of\r
9166f840 683 the input IKEV2_SA_SESSION by specified MessageID.\r
44de1013 684 \r
9166f840 685 @param[in] SaSessionList Pointer to List to be searched.\r
686 @param[in] Spi Specified SPI.\r
44de1013 687\r
9166f840 688 @return Pointer to IKEV2_CHILD_SA_SESSION or NULL.\r
689\r
690**/\r
691IKEV2_CHILD_SA_SESSION *\r
692Ikev2ChildSaSessionLookupBySpi (\r
693 IN LIST_ENTRY *SaSessionList,\r
694 IN UINT32 Spi\r
695 )\r
696{\r
697 LIST_ENTRY *Entry;\r
698 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
44de1013 699\r
9166f840 700 NET_LIST_FOR_EACH (Entry, SaSessionList) {\r
701 ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
44de1013 702\r
9166f840 703 if (ChildSaSession->RemotePeerSpi == Spi || ChildSaSession->LocalPeerSpi == Spi) {\r
44de1013
HT		 704 return ChildSaSession;\r
705 }\r
706 }\r
9166f840 707\r
708 return NULL;\r
709}\r
710\r
711/**\r
712 Insert a Child SA Session into the specified ChildSa list.\r
713\r
714 @param[in] SaSessionList Pointer to list to be inserted in.\r
715 @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION to be inserted.\r
716\r
717**/\r
718VOID\r
719Ikev2ChildSaSessionInsert (\r
720 IN LIST_ENTRY *SaSessionList,\r
721 IN IKEV2_CHILD_SA_SESSION *ChildSaSession\r
722 )\r
723{\r
724 InsertTailList (SaSessionList, &ChildSaSession->ByIkeSa);\r
725}\r
726\r
727/**\r
728 Remove the IKEV2_CHILD_SA_SESSION from IkeSaSessionList.\r
729 \r
730 @param[in] SaSessionList The SA Session List to be iterated.\r
731 @param[in] Spi Spi used to identified the IKEV2_CHILD_SA_SESSION.\r
732 @param[in] ListType The type of the List to indicate whether it is a \r
733 Established. \r
734\r
735 @return The point to IKEV2_CHILD_SA_SESSION or NULL.\r
736 \r
737**/\r
738IKEV2_CHILD_SA_SESSION *\r
739Ikev2ChildSaSessionRemove (\r
740 IN LIST_ENTRY *SaSessionList,\r
741 IN UINT32 Spi, \r
742 IN UINT8 ListType\r
743 )\r
744{\r
745 LIST_ENTRY *Entry;\r
746 LIST_ENTRY *NextEntry;\r
747 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
748\r
749 NET_LIST_FOR_EACH_SAFE (Entry, NextEntry, SaSessionList) {\r
750 \r
751 if (ListType == IKEV2_ESTABLISHED_CHILDSA_LIST || ListType == IKEV2_ESTABLISHING_CHILDSA_LIST) {\r
752 ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (Entry);\r
753 } else if (ListType == IKEV2_DELET_CHILDSA_LIST) {\r
754 ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_DEL_SA (Entry);\r
755 } else {\r
756 return NULL;\r
757 }\r
758\r
759 if (ChildSaSession->RemotePeerSpi == Spi || ChildSaSession->LocalPeerSpi == Spi) {\r
760 RemoveEntryList (Entry);\r
761 return ChildSaSession;\r
762 }\r
763 }\r
764\r
765 return NULL;\r
766}\r
767\r
768/**\r
769 Mark a specified Child SA Session as on deleting.\r
770\r
771 @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION.\r
772\r
773 @retval EFI_SUCCESS Operation is successful.\r
774\r
775**/\r
776EFI_STATUS\r
777Ikev2ChildSaSessionOnDeleting (\r
778 IN IKEV2_CHILD_SA_SESSION *ChildSaSession\r
779 )\r
780{\r
781 return EFI_SUCCESS;\r
782}\r
783\r
784/**\r
785 Free the memory located for the specified IKEV2_CHILD_SA_SESSION. \r
786\r
787 @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION.\r
788\r
789**/\r
790VOID\r
791Ikev2ChildSaSessionFree (\r
792 IN IKEV2_CHILD_SA_SESSION *ChildSaSession\r
793 )\r
794{\r
795 IKEV2_SESSION_COMMON *SessionCommon;\r
796\r
797 SessionCommon = &ChildSaSession->SessionCommon;\r
798 if (ChildSaSession->SaData != NULL) {\r
799 FreePool (ChildSaSession->SaData);\r
800 }\r
801\r
802 if (ChildSaSession->NiBlock != NULL) {\r
803 FreePool (ChildSaSession->NiBlock);\r
804 }\r
805\r
806 if (ChildSaSession->NrBlock != NULL) {\r
807 FreePool (ChildSaSession->NrBlock);\r
808 }\r
809\r
810 if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey != NULL) {\r
811 FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.AuthKey);\r
812 }\r
813\r
814 if (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey != NULL) {\r
815 FreePool (ChildSaSession->ChildKeymats.LocalPeerInfo.EspAlgoInfo.EncKey);\r
816 }\r
817\r
818 if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey != NULL) {\r
819 FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.AuthKey);\r
820 }\r
821\r
822 if (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey != NULL) {\r
823 FreePool (ChildSaSession->ChildKeymats.RemotePeerInfo.EspAlgoInfo.EncKey);\r
824 }\r
825\r
826 //\r
827 // Delete DhBuffer\r
828 //\r
829 Ikev2DhBufferFree (ChildSaSession->DhBuffer);\r
830\r
831 //\r
832 // Delete SpdSelector\r
833 //\r
834 if (ChildSaSession->SpdSelector != NULL) {\r
835 if (ChildSaSession->SpdSelector->LocalAddress != NULL) {\r
836 FreePool (ChildSaSession->SpdSelector->LocalAddress);\r
837 }\r
838 if (ChildSaSession->SpdSelector->RemoteAddress != NULL) {\r
839 FreePool (ChildSaSession->SpdSelector->RemoteAddress);\r
840 }\r
841 FreePool (ChildSaSession->SpdSelector);\r
842 }\r
843 Ikev2SaSessionCommonFree (SessionCommon);\r
844 FreePool (ChildSaSession);\r
845\r
846 return ;\r
847}\r
848\r
849/**\r
850 Delete the specified established Child SA.\r
851\r
852 This function delete the Child SA directly and don't send the Information Packet to\r
853 remote peer.\r
854\r
855 @param[in] IkeSaSession Pointer to a IKE SA Session used to be searched for.\r
856 @param[in] Spi SPI used to find the Child SA.\r
857\r
858 @retval EFI_NOT_FOUND Pointer of IKE SA Session is NULL.\r
859 @retval EFI_NOT_FOUND There is no specified Child SA related with the input\r
860 SPI under this IKE SA Session.\r
861 @retval EFI_SUCCESS Delete the Child SA successfully.\r
862\r
863**/\r
864EFI_STATUS\r
865Ikev2ChildSaSilentDelete (\r
866 IN IKEV2_SA_SESSION *IkeSaSession,\r
867 IN UINT32 Spi\r
868 )\r
869{\r
870 EFI_STATUS Status;\r
871 EFI_IPSEC_CONFIG_SELECTOR *Selector;\r
872 UINTN SelectorSize;\r
873 BOOLEAN IsLocalFound;\r
874 BOOLEAN IsRemoteFound;\r
875 UINT32 LocalSpi;\r
876 UINT32 RemoteSpi;\r
877 IKEV2_CHILD_SA_SESSION *ChildSession;\r
878 EFI_IPSEC_CONFIG_SELECTOR *LocalSelector;\r
879 EFI_IPSEC_CONFIG_SELECTOR *RemoteSelector;\r
880 IKE_UDP_SERVICE *UdpService;\r
881 IPSEC_PRIVATE_DATA *Private;\r
882\r
883 if (IkeSaSession == NULL) {\r
884 return EFI_NOT_FOUND;\r
885 }\r
886\r
887 IsLocalFound = FALSE;\r
888 IsRemoteFound = FALSE;\r
889 ChildSession = NULL;\r
890 LocalSelector = NULL;\r
891 RemoteSelector = NULL;\r
892 UdpService = IkeSaSession->SessionCommon.UdpService;\r
893\r
894 Private = (UdpService->IpVersion == IP_VERSION_4) ?\r
895 IPSEC_PRIVATE_DATA_FROM_UDP4LIST(UdpService->ListHead) :\r
896 IPSEC_PRIVATE_DATA_FROM_UDP6LIST(UdpService->ListHead);\r
897\r
898 //\r
899 // Remove the Established SA from ChildSaEstablishlist.\r
900 //\r
901 ChildSession = Ikev2ChildSaSessionRemove(\r
902 &(IkeSaSession->ChildSaEstablishSessionList),\r
903 Spi, \r
904 IKEV2_ESTABLISHED_CHILDSA_LIST\r
905 );\r
906 if (ChildSession == NULL) {\r
907 return EFI_NOT_FOUND;\r
908 }\r
909\r
910 LocalSpi = ChildSession->LocalPeerSpi;\r
911 RemoteSpi = ChildSession->RemotePeerSpi;\r
912 \r
913 SelectorSize = sizeof (EFI_IPSEC_CONFIG_SELECTOR);\r
914 Selector = AllocateZeroPool (SelectorSize);\r
915 ASSERT (Selector != NULL);\r
916\r
917 \r
918\r
919 while (1) {\r
920 Status = EfiIpSecConfigGetNextSelector (\r
921 &Private->IpSecConfig,\r
922 IPsecConfigDataTypeSad,\r
923 &SelectorSize,\r
924 Selector\r
925 );\r
926 if (Status == EFI_BUFFER_TOO_SMALL) {\r
927 FreePool (Selector);\r
928\r
929 Selector = AllocateZeroPool (SelectorSize);\r
393a3169 930 ASSERT (Selector != NULL);\r
9166f840 931 Status = EfiIpSecConfigGetNextSelector (\r
932 &Private->IpSecConfig,\r
933 IPsecConfigDataTypeSad,\r
934 &SelectorSize,\r
935 Selector\r
936 );\r
937 }\r
938\r
939 if (EFI_ERROR (Status)) {\r
940 break;\r
941 }\r
942\r
943 if (Selector->SaId.Spi == RemoteSpi) {\r
944 //\r
945 // SPI is unique. There is only one SAD whose SPI is\r
946 // same with RemoteSpi.\r
947 //\r
948 IsRemoteFound = TRUE;\r
949 RemoteSelector = AllocateZeroPool (SelectorSize);\r
02a758cb 950 ASSERT (RemoteSelector != NULL);\r
9166f840 951 CopyMem (RemoteSelector, Selector, SelectorSize);\r
952 }\r
953\r
954 if (Selector->SaId.Spi == LocalSpi) {\r
955 //\r
956 // SPI is unique. There is only one SAD whose SPI is\r
957 // same with LocalSpi.\r
958 //\r
959 IsLocalFound = TRUE;\r
960 LocalSelector = AllocateZeroPool (SelectorSize);\r
02a758cb 961 ASSERT (LocalSelector != NULL);\r
9166f840 962 CopyMem (LocalSelector, Selector, SelectorSize);\r
963 }\r
964 }\r
965 //\r
966 // Delete SA from the Variable.\r
967 //\r
968 if (IsLocalFound) {\r
969 Status = EfiIpSecConfigSetData (\r
970 &Private->IpSecConfig,\r
971 IPsecConfigDataTypeSad,\r
972 LocalSelector,\r
973 NULL,\r
974 NULL\r
975 );\r
976 }\r
977\r
978 if (IsRemoteFound) {\r
979 Status = EfiIpSecConfigSetData (\r
980 &Private->IpSecConfig,\r
981 IPsecConfigDataTypeSad,\r
982 RemoteSelector,\r
983 NULL,\r
984 NULL\r
985 );\r
986\r
987 }\r
988\r
989 DEBUG (\r
990 (DEBUG_INFO,\r
991 "\n------IKEV2 deleted ChildSa(local spi, remote spi):(0x%x, 0x%x)------\n",\r
992 LocalSpi,\r
993 RemoteSpi)\r
994 );\r
995 Ikev2ChildSaSessionFree (ChildSession);\r
996\r
997 if (RemoteSelector != NULL) {\r
998 FreePool (RemoteSelector);\r
999 }\r
1000\r
1001 if (LocalSelector != NULL) {\r
1002 FreePool (LocalSelector);\r
1003 }\r
1004\r
1005 if (Selector != NULL) {\r
1006 FreePool (Selector);\r
1007 }\r
1008\r
1009 return Status;\r
1010}\r
1011\r
1012/**\r
1013 Free the specified DhBuffer.\r
1014\r
1015 @param[in] DhBuffer Pointer to IKEV2_DH_BUFFER to be freed.\r
1016 \r
1017**/\r
1018VOID\r
1019Ikev2DhBufferFree (\r
1020 IKEV2_DH_BUFFER *DhBuffer\r
1021) \r
1022{\r
1023 if (DhBuffer != NULL) {\r
1024 if (DhBuffer->GxBuffer != NULL) {\r
1025 FreePool (DhBuffer->GxBuffer);\r
1026 }\r
1027 if (DhBuffer->GyBuffer != NULL) {\r
1028 FreePool (DhBuffer->GyBuffer);\r
1029 }\r
1030 if (DhBuffer->GxyBuffer != NULL) {\r
1031 FreePool (DhBuffer->GxyBuffer);\r
1032 }\r
1033 if (DhBuffer->DhContext != NULL) {\r
1034 IpSecCryptoIoFreeDh (&DhBuffer->DhContext);\r
1035 }\r
1036 FreePool (DhBuffer);\r
1037 }\r
1038}\r
1039\r
1040/**\r
1041 This function is to parse a request IKE packet and return its request type.\r
1042 The request type is one of IKE CHILD SA creation, IKE SA rekeying and \r
1043 IKE CHILD SA rekeying.\r
1044\r
1045 @param[in] IkePacket IKE packet to be prased.\r
1046\r
1047 return the type of the IKE packet.\r
1048\r
1049**/\r
1050IKEV2_CREATE_CHILD_REQUEST_TYPE\r
1051Ikev2ChildExchangeRequestType(\r
1052 IN IKE_PACKET *IkePacket\r
1053 )\r
1054{\r
1055 BOOLEAN Flag;\r
1056 LIST_ENTRY *Entry;\r
1057 IKE_PAYLOAD *IkePayload;\r
1058\r
1059 Flag = FALSE;\r
1060\r
1061 NET_LIST_FOR_EACH (Entry, &(IkePacket)->PayloadList) {\r
1062 IkePayload = IKE_PAYLOAD_BY_PACKET (Entry);\r
1063 if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_TS_INIT) {\r
1064 //\r
1065 // Packet with Ts Payload means it is for either CHILD_SA_CREATE or CHILD_SA_REKEY.\r
1066 //\r
1067 Flag = TRUE;\r
1068 }\r
1069 if (IkePayload->PayloadType == IKEV2_PAYLOAD_TYPE_NOTIFY) { \r
1070 if (((IKEV2_NOTIFY*)IkePayload)->MessageType == IKEV2_NOTIFICATION_REKEY_SA) {\r
1071 //\r
1072 // If notify payload with REKEY_SA message type, the IkePacket is for \r
1073 // rekeying Child SA.\r
1074 //\r
1075 return IkeRequestTypeRekeyChildSa;\r
1076 }\r
1077 }\r
1078 };\r
1079\r
1080 if (!Flag){\r
1081 //\r
1082 // The Create Child Exchange is for IKE SA rekeying.\r
1083 //\r
1084 return IkeRequestTypeRekeyIkeSa;\r
1085 } else {\r
1086 //\r
1087 // If the Notify payloaad with transport mode message type, the IkePacket is \r
1088 // for create Child SA.\r
1089 //\r
1090 return IkeRequestTypeCreateChildSa;\r
1091 }\r
1092}\r
1093\r
1094/**\r
1095 Associate a SPD selector to the Child SA Session.\r
1096\r
1097 This function is called when the Child SA is not the first child SA of its \r
1098 IKE SA. It associate a SPD to this Child SA.\r
1099\r
1100 @param[in, out] ChildSaSession Pointer to the Child SA Session to be associated to \r
1101 a SPD selector.\r
1102\r
1103 @retval EFI_SUCCESS Associate one SPD selector to this Child SA Session successfully.\r
1104 @retval EFI_NOT_FOUND Can't find the related SPD selector.\r
1105\r
1106**/\r
1107EFI_STATUS\r
1108Ikev2ChildSaAssociateSpdEntry (\r
1109 IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession\r
1110 )\r
1111{\r
1112 IpSecVisitConfigData (IPsecConfigDataTypeSpd, Ikev2MatchSpdEntry, ChildSaSession);\r
1113 if (ChildSaSession->Spd != NULL) {\r
1114 return EFI_SUCCESS;\r
1115 } else {\r
1116 return EFI_NOT_FOUND;\r
1117 }\r
1118}\r
1119\r
1120\r
1121/**\r
1122 This function finds the SPI from Create Child SA Exchange Packet.\r
1123 \r
1124 @param[in] IkePacket Pointer to IKE_PACKET to be searched.\r
1125\r
1126 @retval SPI number or 0 if it is not supported.\r
1127\r
1128**/\r
1129UINT32\r
1130Ikev2ChildExchangeRekeySpi (\r
1131 IN IKE_PACKET *IkePacket\r
1132 )\r
1133{\r
1134 //\r
1135 // Not support yet.\r
1136 // \r
1137 return 0;\r
1138}\r
1139\r
1140/**\r
1141 Validate the IKE header of received IKE packet.\r
1142\r
1143 @param[in] IkeSaSession Pointer to IKEV2_SA_SESSION related to this IKE packet.\r
1144 @param[in] IkeHdr Pointer to IKE header of received IKE packet.\r
1145\r
1146 @retval TRUE If the IKE header is valid.\r
1147 @retval FALSE If the IKE header is invalid.\r
1148\r
1149**/\r
1150BOOLEAN\r
1151Ikev2ValidateHeader (\r
1152 IN IKEV2_SA_SESSION *IkeSaSession,\r
1153 IN IKE_HEADER *IkeHdr\r
1154 )\r
1155{\r
1156\r
1157 IKEV2_SESSION_STATE State;\r
1158\r
1159 State = IkeSaSession->SessionCommon.State;\r
1160 if (State == IkeStateInit) {\r
1161 //\r
1162 // For the IKE Initial Exchange, the MessagId should be zero.\r
1163 //\r
1164 if (IkeHdr->MessageId != 0) {\r
1165 return FALSE;\r
1166 }\r
1167 } else {\r
1168 if (State == IkeStateAuth) {\r
1169 if (IkeHdr->MessageId != 1) {\r
1170 return FALSE;\r
1171 }\r
1172 }\r
1173 if (IkeHdr->InitiatorCookie != IkeSaSession->InitiatorCookie ||\r
1174 IkeHdr->ResponderCookie != IkeSaSession->ResponderCookie\r
1175 ) {\r
1176 //\r
1177 // TODO: send notification INVALID-COOKIE\r
1178 //\r
1179 return FALSE;\r
1180 }\r
1181 }\r
1182\r
1183 //\r
1184 // Information Exchagne and Create Child Exchange can be started from each part.\r
1185 //\r
1186 if (IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_INFO && \r
1187 IkeHdr->ExchangeType != IKEV2_EXCHANGE_TYPE_CREATE_CHILD\r
1188 ) {\r
1189 if (IkeSaSession->SessionCommon.IsInitiator) {\r
1190 if (IkeHdr->InitiatorCookie != IkeSaSession->InitiatorCookie) {\r
1191 //\r
1192 // TODO: send notification INVALID-COOKIE\r
1193 //\r
1194 return FALSE;\r
1195 }\r
1196 if (IkeHdr->Flags != IKE_HEADER_FLAGS_RESPOND) {\r
1197 return FALSE;\r
1198 }\r
1199 } else {\r
1200 if (IkeHdr->Flags != IKE_HEADER_FLAGS_INIT) {\r
1201 return FALSE;\r
1202 }\r
1203 }\r
1204 }\r
1205\r
1206 return TRUE;\r
1207}\r
1208\r
1209/**\r
1210 Create and intialize IKEV2_SA_DATA for speicifed IKEV2_SESSION_COMMON.\r
1211\r
1212 This function will be only called by the initiator. The responder's IKEV2_SA_DATA\r
1213 will be generated during parsed the initiator packet.\r
1214\r
1215 @param[in] SessionCommon Pointer to IKEV2_SESSION_COMMON related to.\r
1216\r
1217 @retval a Pointer to a new IKEV2_SA_DATA or NULL.\r
1218\r
1219**/\r
1220IKEV2_SA_DATA *\r
1221Ikev2InitializeSaData (\r
1222 IN IKEV2_SESSION_COMMON *SessionCommon\r
1223 )\r
1224{\r
1225 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
1226 IKEV2_SA_DATA *SaData;\r
1227 IKEV2_PROPOSAL_DATA *ProposalData;\r
1228 IKEV2_TRANSFORM_DATA *TransformData;\r
1229 IKE_SA_ATTRIBUTE *Attribute;\r
1230\r
1231 ASSERT (SessionCommon != NULL);\r
1232 //\r
1233 // TODO: Remove the hard code of the support Alogrithm. Those data should be\r
1234 // get from the SPD/PAD data.\r
1235 //\r
1236 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1237 SaData = AllocateZeroPool (\r
1238 sizeof (IKEV2_SA_DATA) +\r
1239 sizeof (IKEV2_PROPOSAL_DATA) * 2 +\r
1240 sizeof (IKEV2_TRANSFORM_DATA) * 4 * 2\r
1241 );\r
1242 } else {\r
1243 SaData = AllocateZeroPool (\r
1244 sizeof (IKEV2_SA_DATA) +\r
1245 sizeof (IKEV2_PROPOSAL_DATA) * 2 +\r
1246 sizeof (IKEV2_TRANSFORM_DATA) * 3 * 2\r
1247 );\r
1248 }\r
1249 if (SaData == NULL) {\r
1250 return NULL;\r
1251 }\r
1252\r
1253 //\r
1254 // First proposal payload: 3DES + SHA1 + DH\r
1255 //\r
1256 SaData->NumProposals = 2;\r
1257 ProposalData = (IKEV2_PROPOSAL_DATA *) (SaData + 1);\r
1258 ProposalData->ProposalIndex = 1;\r
1259\r
1260 //\r
1261 // If SA data for IKE_SA_INIT exchage, contains 4 transforms. If SA data for \r
1262 // IKE_AUTH exchange contains 3 transforms.\r
1263 //\r
1264 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1265 ProposalData->NumTransforms = 4;\r
1266 } else {\r
1267 ProposalData->NumTransforms = 3;\r
1268 }\r
1269\r
1270\r
1271 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1272 ProposalData->ProtocolId = IPSEC_PROTO_ISAKMP;\r
1273 } else {\r
1274 ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);\r
1275 ProposalData->ProtocolId = IPSEC_PROTO_IPSEC_ESP;\r
1276 ProposalData->Spi = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));\r
1277 ASSERT (ProposalData->Spi != NULL);\r
1278 CopyMem (\r
1279 ProposalData->Spi,\r
1280 &ChildSaSession->LocalPeerSpi,\r
1281 sizeof(ChildSaSession->LocalPeerSpi)\r
1282 );\r
1283 }\r
1284\r
1285 //\r
1286 // Set transform attribute for Encryption Algorithm - 3DES\r
1287 //\r
1288 TransformData = (IKEV2_TRANSFORM_DATA *) (ProposalData + 1);\r
1289 TransformData->TransformIndex = 0;\r
1290 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_ENCR;\r
1291 TransformData->TransformId = IKEV2_TRANSFORM_ID_ENCR_3DES;\r
1292\r
1293 //\r
1294 // Set transform attribute for Integrity Algorithm - SHA1_96\r
1295 //\r
1296 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1297 TransformData->TransformIndex = 1;\r
1298 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_INTEG;\r
1299 TransformData->TransformId = IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96;\r
1300\r
1301 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1302 //\r
1303 // Set transform attribute for Pseduo-Random Function - HAMC_SHA1\r
1304 //\r
1305 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1306 TransformData->TransformIndex = 2;\r
1307 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_PRF;\r
1308 TransformData->TransformId = IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1;\r
1309 }\r
1310\r
1311 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1312 //\r
1313 // Set transform attribute for DH Group - DH 1024\r
1314 //\r
1315 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1316 TransformData->TransformIndex = 3;\r
1317 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_DH;\r
1318 TransformData->TransformId = IKEV2_TRANSFORM_ID_DH_1024MODP;\r
1319 } else {\r
1320 //\r
1321 // Transform type for Extended Sequence Numbers. Currently not support Extended\r
1322 // Sequence Number.\r
1323 //\r
1324 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1325 TransformData->TransformIndex = 2;\r
1326 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_ESN;\r
1327 TransformData->TransformId = 0;\r
1328 }\r
1329\r
1330 //\r
1331 // Second proposal payload: 3DES + SHA1 + DH\r
1332 //\r
1333 ProposalData = (IKEV2_PROPOSAL_DATA *) (TransformData + 1);\r
1334 ProposalData->ProposalIndex = 2;\r
1335\r
1336 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1337 ProposalData->ProtocolId = IPSEC_PROTO_ISAKMP;\r
1338 ProposalData->NumTransforms = 4;\r
1339 } else {\r
1340\r
1341 ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);\r
1342 ProposalData->ProtocolId = IPSEC_PROTO_IPSEC_ESP;\r
1343 ProposalData->NumTransforms = 3;\r
1344 ProposalData->Spi = AllocateZeroPool (sizeof (ChildSaSession->LocalPeerSpi));\r
1345 ASSERT (ProposalData->Spi != NULL);\r
1346 CopyMem (\r
1347 ProposalData->Spi,\r
1348 &ChildSaSession->LocalPeerSpi,\r
1349 sizeof(ChildSaSession->LocalPeerSpi)\r
1350 );\r
1351 }\r
1352\r
1353 //\r
1354 // Set transform attribute for Encryption Algorithm - AES-CBC\r
1355 //\r
1356 TransformData = (IKEV2_TRANSFORM_DATA *) (ProposalData + 1);\r
1357 TransformData->TransformIndex = 0;\r
1358 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_ENCR;\r
1359 TransformData->TransformId = IKEV2_TRANSFORM_ID_ENCR_AES_CBC;\r
1360 Attribute = &TransformData->Attribute;\r
1361 Attribute->AttrType = IKEV2_ATTRIBUTE_TYPE_KEYLEN;\r
1362 Attribute->Attr.AttrLength = (UINT16) (8 * IpSecGetEncryptKeyLength (IKEV2_TRANSFORM_ID_ENCR_AES_CBC));\r
1363\r
1364 //\r
1365 // Set transform attribute for Integrity Algorithm - SHA1_96\r
1366 //\r
1367 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1368 TransformData->TransformIndex = 1;\r
1369 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_INTEG;\r
1370 TransformData->TransformId = IKEV2_TRANSFORM_ID_AUTH_HMAC_SHA1_96;\r
1371\r
1372 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1373 //\r
1374 // Set transform attribute for Pseduo-Random Function - HAMC_SHA1\r
1375 //\r
1376 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1377 TransformData->TransformIndex = 2;\r
1378 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_PRF;\r
1379 TransformData->TransformId = IKEV2_TRANSFORM_ID_PRF_HMAC_SHA1;\r
1380 }\r
1381\r
1382 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1383 //\r
1384 // Set transform attrbiute for DH Group - DH-1024\r
1385 //\r
1386 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1387 TransformData->TransformIndex = 3;\r
1388 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_DH;\r
1389 TransformData->TransformId = IKEV2_TRANSFORM_ID_DH_1024MODP;\r
1390 } else {\r
1391 //\r
1392 // Transform type for Extended Sequence Numbers. Currently not support Extended\r
1393 // Sequence Number.\r
1394 //\r
1395 TransformData = (IKEV2_TRANSFORM_DATA *) (TransformData + 1);\r
1396 TransformData->TransformIndex = 2;\r
1397 TransformData->TransformType = IKEV2_TRANSFORM_TYPE_ESN;\r
1398 TransformData->TransformId = 0;\r
1399 }\r
1400\r
1401 return SaData;\r
1402}\r
1403\r
1404/**\r
1405 Store the SA into SAD.\r
1406\r
1407 @param[in] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION.\r
1408\r
1409**/\r
1410VOID\r
1411Ikev2StoreSaData (\r
1412 IN IKEV2_CHILD_SA_SESSION *ChildSaSession\r
1413 )\r
1414{\r
1415 EFI_STATUS Status;\r
1416 EFI_IPSEC_SA_ID SaId;\r
1417 EFI_IPSEC_SA_DATA2 SaData;\r
1418 IKEV2_SESSION_COMMON *SessionCommon;\r
1419 IPSEC_PRIVATE_DATA *Private;\r
1420 UINT32 TempAddressCount;\r
1421 EFI_IP_ADDRESS_INFO *TempAddressInfo;\r
1422\r
1423 SessionCommon = &ChildSaSession->SessionCommon;\r
1424 Private = SessionCommon->Private;\r
1425\r
1426 ZeroMem (&SaId, sizeof (EFI_IPSEC_SA_ID));\r
1427 ZeroMem (&SaData, sizeof (EFI_IPSEC_SA_DATA2));\r
1428\r
1429 //\r
1430 // Create a SpdSelector. In this implementation, one SPD represents\r
1431 // 2 direction traffic, so in here, there needs to reverse the local address \r
1432 // and remote address for Remote Peer's SA, then reverse again for the locate\r
1433 // SA. \r
1434 //\r
1435 TempAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;\r
1436 TempAddressInfo = ChildSaSession->SpdSelector->LocalAddress;\r
1437\r
1438 ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->SpdSelector->RemoteAddressCount;\r
1439 ChildSaSession->SpdSelector->LocalAddress = ChildSaSession->SpdSelector->RemoteAddress;\r
1440\r
1441 ChildSaSession->SpdSelector->RemoteAddress = TempAddressInfo;\r
1442 ChildSaSession->SpdSelector->RemoteAddressCount= TempAddressCount;\r
1443\r
1444 //\r
1445 // Set the SaId and SaData.\r
1446 //\r
1447 SaId.Spi = ChildSaSession->LocalPeerSpi;\r
1448 SaId.Proto = EfiIPsecESP;\r
1449 SaData.AntiReplayWindows = 16;\r
1450 SaData.SNCount = 0;\r
1451 SaData.Mode = ChildSaSession->Spd->Data->ProcessingPolicy->Mode;\r
1452\r
1453 //\r
1454 // If it is tunnel mode, should add the TunnelDest and TunnelSource for SaData.\r
1455 //\r
1456 if (SaData.Mode == EfiIPsecTunnel) {\r
1457 CopyMem (\r
1458 &SaData.TunnelSourceAddress, \r
1459 &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,\r
1460 sizeof (EFI_IP_ADDRESS)\r
1461 );\r
1462 CopyMem (\r
1463 &SaData.TunnelDestinationAddress,\r
1464 &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->LocalTunnelAddress,\r
1465 sizeof (EFI_IP_ADDRESS)\r
1466 );\r
1467 }\r
1468\r
1469 CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.LocalPeerIp, sizeof (EFI_IP_ADDRESS));\r
1470 CopyMem (&SaData.AlgoInfo, &ChildSaSession->ChildKeymats.LocalPeerInfo, sizeof (EFI_IPSEC_ALGO_INFO));\r
1471 SaData.SpdSelector = ChildSaSession->SpdSelector;\r
1472\r
1473 //\r
1474 // Store the remote SA into SAD.\r
1475 //\r
1476 Status = EfiIpSecConfigSetData (\r
1477 &Private->IpSecConfig,\r
1478 IPsecConfigDataTypeSad,\r
1479 (EFI_IPSEC_CONFIG_SELECTOR *) &SaId,\r
1480 &SaData,\r
1481 NULL\r
1482 );\r
1483 ASSERT_EFI_ERROR (Status);\r
1484\r
1485 //\r
1486 // Store the local SA into SAD.\r
1487 // \r
1488 ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->SpdSelector->LocalAddressCount;\r
1489 ChildSaSession->SpdSelector->RemoteAddress = ChildSaSession->SpdSelector->LocalAddress;\r
1490\r
1491 ChildSaSession->SpdSelector->LocalAddress = TempAddressInfo;\r
1492 ChildSaSession->SpdSelector->LocalAddressCount = TempAddressCount;\r
1493 \r
1494 SaId.Spi = ChildSaSession->RemotePeerSpi;\r
1495\r
1496 CopyMem (&SaId.DestAddress, &ChildSaSession->SessionCommon.RemotePeerIp, sizeof (EFI_IP_ADDRESS));\r
1497 CopyMem (&SaData.AlgoInfo, &ChildSaSession->ChildKeymats.RemotePeerInfo, sizeof (EFI_IPSEC_ALGO_INFO));\r
1498 SaData.SpdSelector = ChildSaSession->SpdSelector;\r
1499\r
1500 //\r
1501 // If it is tunnel mode, should add the TunnelDest and TunnelSource for SaData.\r
1502 //\r
1503 if (SaData.Mode == EfiIPsecTunnel) {\r
1504 CopyMem (\r
1505 &SaData.TunnelSourceAddress,\r
1506 &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->LocalTunnelAddress,\r
1507 sizeof (EFI_IP_ADDRESS)\r
1508 );\r
1509 CopyMem (\r
1510 &SaData.TunnelDestinationAddress,\r
1511 &ChildSaSession->Spd->Data->ProcessingPolicy->TunnelOption->RemoteTunnelAddress,\r
1512 sizeof (EFI_IP_ADDRESS)\r
1513 );\r
1514 }\r
1515\r
1516 Status = EfiIpSecConfigSetData (\r
1517 &Private->IpSecConfig,\r
1518 IPsecConfigDataTypeSad,\r
1519 (EFI_IPSEC_CONFIG_SELECTOR *) &SaId,\r
1520 &SaData,\r
1521 NULL\r
1522 );\r
1523\r
1524 ASSERT_EFI_ERROR (Status);\r
1525}\r
1526\r
1527/**\r
1528 Call back function of the IKE life time is over.\r
1529\r
1530 This function will mark the related IKE SA Session as deleting and trigger a \r
1531 Information negotiation.\r
1532\r
1533 @param[in] Event The signaled Event.\r
1534 @param[in] Context Pointer to data passed by caller.\r
1535 \r
1536**/\r
1537VOID\r
1538EFIAPI\r
1539Ikev2LifetimeNotify (\r
1540 IN EFI_EVENT Event,\r
1541 IN VOID *Context\r
1542 )\r
1543{\r
1544 IKEV2_SA_SESSION *IkeSaSession;\r
1545 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
1546 IKEV2_SESSION_COMMON *SessionCommon;\r
1547\r
1548 ASSERT (Context != NULL);\r
1549 SessionCommon = (IKEV2_SESSION_COMMON *) Context;\r
1550\r
1551 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1552 IkeSaSession = IKEV2_SA_SESSION_FROM_COMMON (SessionCommon);\r
1553 DEBUG ((\r
1554 DEBUG_INFO,\r
1555 "\n---IkeSa Lifetime is out(cookie_i, cookie_r):(0x%lx, 0x%lx)---\n",\r
1556 IkeSaSession->InitiatorCookie,\r
1557 IkeSaSession->ResponderCookie\r
1558 ));\r
1559\r
1560 //\r
1561 // Change the IKE SA Session's State to IKE_STATE_SA_DELETING.\r
1562 //\r
1563 IKEV2_DUMP_STATE (IkeSaSession->SessionCommon.State, IkeStateSaDeleting);\r
1564 IkeSaSession->SessionCommon.State = IkeStateSaDeleting;\r
1565\r
1566 } else {\r
1567 ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);\r
1568 IkeSaSession = ChildSaSession->IkeSaSession;\r
1569\r
1570 //\r
1571 // Link the timeout child SA to the DeleteSaList.\r
1572 //\r
1573 InsertTailList (&IkeSaSession->DeleteSaList, &ChildSaSession->ByDelete);\r
1574\r
1575 //\r
1576 // Change the Child SA Session's State to IKE_STATE_SA_DELETING.\r
1577 // \r
1578 DEBUG ((\r
1579 DEBUG_INFO,\r
1580 "\n------ChildSa Lifetime is out(SPI):(0x%x)------\n",\r
1581 ChildSaSession->LocalPeerSpi\r
1582 ));\r
1583 }\r
1584\r
1585 //\r
1586 // TODO: Send the delete info packet or delete silently\r
1587 //\r
1588 mIkev2Exchange.NegotiateInfo ((UINT8 *) IkeSaSession, NULL);\r
1589}\r
1590\r
1591/**\r
1592 This function will be called if the TimeOut Event is signaled.\r
1593\r
1594 @param[in] Event The signaled Event.\r
1595 @param[in] Context The data passed by caller.\r
1596\r
1597**/\r
1598VOID\r
1599EFIAPI\r
1600Ikev2ResendNotify (\r
1601 IN EFI_EVENT Event,\r
1602 IN VOID *Context\r
1603 )\r
1604{\r
1605 IPSEC_PRIVATE_DATA *Private;\r
1606 IKEV2_SA_SESSION *IkeSaSession;\r
1607 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
1608 IKEV2_SESSION_COMMON *SessionCommon;\r
1609 LIST_ENTRY *ChildSaEntry;\r
1610 UINT8 Value;\r
1611 EFI_STATUS Status;\r
1612\r
1613 ASSERT (Context != NULL); \r
1614 IkeSaSession = NULL;\r
1615 ChildSaSession = NULL;\r
1616 SessionCommon = (IKEV2_SESSION_COMMON *) Context;\r
1617 Private = SessionCommon->Private;\r
1618\r
1619 //\r
1620 // Remove the SA session from the processing list if exceed the max retry.\r
1621 //\r
1622 if (SessionCommon->RetryCount > IKE_MAX_RETRY) {\r
1623 if (SessionCommon->IkeSessionType == IkeSessionTypeIkeSa) {\r
1624 IkeSaSession = IKEV2_SA_SESSION_FROM_COMMON (SessionCommon);\r
1625 if (IkeSaSession->SessionCommon.State == IkeStateSaDeleting) {\r
1626\r
1627 //\r
1628 // If the IkeSaSession is initiator, delete all its Child SAs before removing IKE SA.\r
1629 // If the IkesaSession is responder, all ChildSa has been remove in Ikev2HandleInfo();\r
1630 //\r
1631 for (ChildSaEntry = IkeSaSession->ChildSaEstablishSessionList.ForwardLink;\r
1632 ChildSaEntry != &IkeSaSession->ChildSaEstablishSessionList;\r
1633 ) {\r
1634 ChildSaSession = IKEV2_CHILD_SA_SESSION_BY_IKE_SA (ChildSaEntry);\r
1635 //\r
1636 // Move to next ChildSa Entry.\r
1637 //\r
1638 ChildSaEntry = ChildSaEntry->ForwardLink;\r
1639 //\r
1640 // Delete LocalSpi & RemoteSpi and remove the ChildSaSession from the\r
1641 // EstablishedChildSaList.\r
1642 //\r
1643 Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);\r
1644 }\r
1645\r
1646 //\r
1647 // If the IKE SA Delete Payload wasn't sent out successfully, Delete it from the EstablishedList.\r
1648 //\r
1649 Ikev2SaSessionRemove (&Private->Ikev2EstablishedList, &SessionCommon->RemotePeerIp);\r
1650\r
1651 if (Private != NULL && Private->IsIPsecDisabling) {\r
1652 //\r
1653 // After all IKE SAs were deleted, set the IPSEC_STATUS_DISABLED value in\r
1654 // IPsec status variable.\r
1655 //\r
1656 if (IsListEmpty (&Private->Ikev1EstablishedList) && IsListEmpty (&Private->Ikev2EstablishedList)) {\r
1657 Value = IPSEC_STATUS_DISABLED;\r
1658 Status = gRT->SetVariable (\r
1659 IPSECCONFIG_STATUS_NAME,\r
1660 &gEfiIpSecConfigProtocolGuid,\r
1661 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,\r
1662 sizeof (Value),\r
1663 &Value\r
1664 );\r
1665 if (!EFI_ERROR (Status)) {\r
1666 //\r
1667 // Set the Disabled Flag in Private data.\r
1668 //\r
1669 Private->IpSec.DisabledFlag = TRUE;\r
1670 Private->IsIPsecDisabling = FALSE;\r
1671 }\r
1672 }\r
1673 }\r
1674 } else {\r
1675 Ikev2SaSessionRemove (&Private->Ikev2SessionList, &SessionCommon->RemotePeerIp);\r
1676 }\r
1677 Ikev2SaSessionFree (IkeSaSession);\r
1678\r
1679 } else {\r
1680\r
1681 //\r
1682 // If the packet sent by Child SA.\r
1683 //\r
1684 ChildSaSession = IKEV2_CHILD_SA_SESSION_FROM_COMMON (SessionCommon);\r
1685 IkeSaSession = ChildSaSession->IkeSaSession;\r
1686 if (ChildSaSession->SessionCommon.State == IkeStateSaDeleting) {\r
1687\r
1688 //\r
1689 // Established Child SA should be remove from the SAD entry and \r
1690 // DeleteList. The function of Ikev2DeleteChildSaSilent() will remove \r
1691 // the childSA from the IkeSaSession->ChildSaEstablishedList. So there \r
1692 // is no need to remove it here.\r
1693 //\r
1694 Ikev2ChildSaSilentDelete (IkeSaSession, ChildSaSession->LocalPeerSpi);\r
1695 Ikev2ChildSaSessionRemove (\r
1696 &IkeSaSession->DeleteSaList,\r
1697 ChildSaSession->LocalPeerSpi,\r
1698 IKEV2_DELET_CHILDSA_LIST\r
1699 );\r
1700 } else {\r
1701 Ikev2ChildSaSessionRemove (\r
1702 &IkeSaSession->ChildSaSessionList,\r
1703 ChildSaSession->LocalPeerSpi,\r
1704 IKEV2_ESTABLISHING_CHILDSA_LIST\r
1705 );\r
1706 }\r
1707\r
1708 Ikev2ChildSaSessionFree (ChildSaSession);\r
1709 }\r
1710 return ;\r
1711 }\r
1712\r
1713 //\r
1714 // Increase the retry count.\r
1715 //\r
1716 SessionCommon->RetryCount++;\r
1717 DEBUG ((DEBUG_INFO, ">>>Resending the last packet ...\n"));\r
1718\r
1719 //\r
1720 // Resend the last packet.\r
1721 //\r
1722 Ikev2SendIkePacket (\r
1723 SessionCommon->UdpService,\r
1724 (UINT8*)SessionCommon,\r
1725 SessionCommon->LastSentPacket,\r
1726 0\r
1727 );\r
1728}\r
1729\r
1730/**\r
1731 Copy ChildSaSession->Spd->Selector to ChildSaSession->SpdSelector.\r
1732\r
1733 ChildSaSession->SpdSelector stores the real Spdselector for its SA. Sometime,\r
1734 the SpdSelector in ChildSaSession is more accurated or the scope is smaller \r
1735 than the one in ChildSaSession->Spd, especially for the tunnel mode.\r
1736 \r
1737 @param[in, out] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION related to.\r
1738 \r
1739**/\r
1740VOID\r
1741Ikev2ChildSaSessionSpdSelectorCreate (\r
1742 IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession\r
1743 ) \r
1744{\r
1745 if (ChildSaSession->Spd != NULL && ChildSaSession->Spd->Selector != NULL) {\r
1746 if (ChildSaSession->SpdSelector == NULL) {\r
1747 ChildSaSession->SpdSelector = AllocateZeroPool (sizeof (EFI_IPSEC_SPD_SELECTOR));\r
1748 ASSERT (ChildSaSession->SpdSelector != NULL);\r
1749 }\r
1750 CopyMem (\r
1751 ChildSaSession->SpdSelector, \r
1752 ChildSaSession->Spd->Selector, \r
1753 sizeof (EFI_IPSEC_SPD_SELECTOR)\r
1754 );\r
1755 ChildSaSession->SpdSelector->RemoteAddress = AllocateCopyPool (\r
1756 ChildSaSession->Spd->Selector->RemoteAddressCount * \r
1757 sizeof (EFI_IP_ADDRESS_INFO), \r
1758 ChildSaSession->Spd->Selector->RemoteAddress\r
1759 );\r
1760 ChildSaSession->SpdSelector->LocalAddress = AllocateCopyPool (\r
1761 ChildSaSession->Spd->Selector->LocalAddressCount * \r
1762 sizeof (EFI_IP_ADDRESS_INFO), \r
1763 ChildSaSession->Spd->Selector->LocalAddress\r
1764 );\r
1765\r
1766 ASSERT (ChildSaSession->SpdSelector->LocalAddress != NULL);\r
1767 ASSERT (ChildSaSession->SpdSelector->RemoteAddress != NULL);\r
1768\r
1769 ChildSaSession->SpdSelector->RemoteAddressCount = ChildSaSession->Spd->Selector->RemoteAddressCount;\r
1770 ChildSaSession->SpdSelector->LocalAddressCount = ChildSaSession->Spd->Selector->LocalAddressCount; \r
1771 }\r
1772}\r
1773\r
1774/**\r
1775 Generate a ChildSa Session and insert it into related IkeSaSession.\r
1776\r
1777 @param[in] IkeSaSession Pointer to related IKEV2_SA_SESSION.\r
1778 @param[in] UdpService Pointer to related IKE_UDP_SERVICE.\r
1779\r
1780 @return pointer of IKEV2_CHILD_SA_SESSION.\r
1781\r
1782**/\r
1783IKEV2_CHILD_SA_SESSION *\r
1784Ikev2ChildSaSessionCreate (\r
1785 IN IKEV2_SA_SESSION *IkeSaSession,\r
1786 IN IKE_UDP_SERVICE *UdpService\r
1787 )\r
1788{\r
1789 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
1790 IKEV2_SESSION_COMMON *ChildSaCommon;\r
1791\r
1792 //\r
1793 // Create a new ChildSaSession.Insert it into processing list and initiate the common parameters.\r
1794 //\r
1795 ChildSaSession = Ikev2ChildSaSessionAlloc (UdpService, IkeSaSession);\r
1796 ASSERT (ChildSaSession != NULL);\r
1797\r
1798 //\r
1799 // Set the specific parameters.\r
1800 // \r
1801 ChildSaSession->Spd = IkeSaSession->Spd;\r
1802 ChildSaCommon = &ChildSaSession->SessionCommon;\r
1803 ChildSaCommon->IsInitiator = IkeSaSession->SessionCommon.IsInitiator;\r
1804 if (IkeSaSession->SessionCommon.State == IkeStateAuth) {\r
1805 ChildSaCommon->State = IkeStateAuth;\r
1806 IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateAuth);\r
1807 } else {\r
1808 ChildSaCommon->State = IkeStateCreateChild;\r
1809 IKEV2_DUMP_STATE (ChildSaCommon->State, IkeStateCreateChild);\r
1810 }\r
1811\r
1812 //\r
1813 // If SPD->Selector is not NULL, copy it to the ChildSaSession->SpdSelector.\r
1814 // The ChildSaSession->SpdSelector might be changed after the traffic selector\r
1815 // negoniation and it will be copied into the SAData after ChildSA established.\r
1816 //\r
1817 Ikev2ChildSaSessionSpdSelectorCreate (ChildSaSession);\r
1818\r
1819 //\r
1820 // Copy first NiBlock and NrBlock to ChildSa Session\r
1821 //\r
1822 ChildSaSession->NiBlock = AllocateZeroPool (IkeSaSession->NiBlkSize);\r
1823 ASSERT (ChildSaSession->NiBlock != NULL);\r
1824 ChildSaSession->NiBlkSize = IkeSaSession->NiBlkSize;\r
1825 CopyMem (ChildSaSession->NiBlock, IkeSaSession->NiBlock, IkeSaSession->NiBlkSize);\r
1826\r
1827 ChildSaSession->NrBlock = AllocateZeroPool (IkeSaSession->NrBlkSize);\r
1828 ASSERT (ChildSaSession->NrBlock != NULL);\r
1829 ChildSaSession->NrBlkSize = IkeSaSession->NrBlkSize;\r
1830 CopyMem (ChildSaSession->NrBlock, IkeSaSession->NrBlock, IkeSaSession->NrBlkSize);\r
1831\r
1832 //\r
1833 // Only if the Create Child SA is called for the IKE_INIT Exchange and \r
1834 // IkeSaSession is initiator (Only Initiator's SPD is not NULL), Set the \r
1835 // Traffic Selectors related information here.\r
1836 //\r
1837 if (IkeSaSession->SessionCommon.State == IkeStateAuth && IkeSaSession->Spd != NULL) {\r
1838 ChildSaSession->ProtoId = IkeSaSession->Spd->Selector->NextLayerProtocol;\r
1839 ChildSaSession->LocalPort = IkeSaSession->Spd->Selector->LocalPort;\r
1840 ChildSaSession->RemotePort = IkeSaSession->Spd->Selector->RemotePort;\r
1841 }\r
1842\r
1843 //\r
1844 // Insert the new ChildSaSession into processing child SA list.\r
1845 //\r
1846 Ikev2ChildSaSessionInsert (&IkeSaSession->ChildSaSessionList, ChildSaSession);\r
1847 return ChildSaSession;\r
1848}\r
1849\r
1850/**\r
1851 Check if the SPD is related to the input Child SA Session.\r
1852\r
1853 This function is the subfunction of Ikev1AssociateSpdEntry(). It is the call\r
1854 back function of IpSecVisitConfigData(). \r
1855 \r
1856\r
1857 @param[in] Type Type of the input Config Selector.\r
1858 @param[in] Selector Pointer to the Configure Selector to be checked. \r
1859 @param[in] Data Pointer to the Configure Selector's Data passed \r
1860 from the caller.\r
1861 @param[in] SelectorSize The buffer size of Selector.\r
1862 @param[in] DataSize The buffer size of the Data.\r
1863 @param[in] Context The data passed from the caller. It is a Child\r
1864 SA Session in this context.\r
1865\r
1866 @retval EFI_SUCCESS The SPD Selector is not related to the Child SA Session. \r
1867 @retval EFI_ABORTED The SPD Selector is related to the Child SA session and \r
1868 set the ChildSaSession->Spd to point to this SPD Selector.\r
1869\r
1870**/\r
1871EFI_STATUS\r
1872Ikev2MatchSpdEntry (\r
1873 IN EFI_IPSEC_CONFIG_DATA_TYPE Type,\r
1874 IN EFI_IPSEC_CONFIG_SELECTOR *Selector,\r
1875 IN VOID *Data,\r
1876 IN UINTN SelectorSize,\r
1877 IN UINTN DataSize,\r
1878 IN VOID *Context\r
1879 )\r
1880{\r
1881 IKEV2_CHILD_SA_SESSION *ChildSaSession;\r
1882 EFI_IPSEC_SPD_SELECTOR *SpdSelector;\r
1883 EFI_IPSEC_SPD_DATA *SpdData;\r
1884 BOOLEAN IsMatch;\r
1885 UINT8 IpVersion;\r
1886\r
1887 ASSERT (Type == IPsecConfigDataTypeSpd);\r
1888 SpdData = (EFI_IPSEC_SPD_DATA *) Data;\r
1889 //\r
1890 // Bypass all non-protect SPD entry first\r
1891 //\r
1892 if (SpdData->Action != EfiIPsecActionProtect) {\r
1893 return EFI_SUCCESS;\r
1894 }\r
1895\r
1896 ChildSaSession = (IKEV2_CHILD_SA_SESSION *) Context;\r
1897 IpVersion = ChildSaSession->SessionCommon.UdpService->IpVersion;\r
1898 SpdSelector = (EFI_IPSEC_SPD_SELECTOR *) Selector; \r
1899 IsMatch = TRUE;\r
1900\r
1901 if (SpdSelector->NextLayerProtocol == EFI_IP_PROTO_UDP &&\r
1902 SpdSelector->LocalPort == IKE_DEFAULT_PORT &&\r
1903 SpdSelector->LocalPortRange == 0 &&\r
1904 SpdSelector->RemotePort == IKE_DEFAULT_PORT &&\r
1905 SpdSelector->RemotePortRange == 0\r
1906 ) {\r
1907 //\r
1908 // TODO: Skip IKE Policy here or set a SPD entry?\r
1909 //\r
1910 return EFI_SUCCESS;\r
1911 }\r
1912\r
1913 if (SpdSelector->NextLayerProtocol != EFI_IPSEC_ANY_PROTOCOL &&\r
1914 SpdSelector->NextLayerProtocol != ChildSaSession->ProtoId\r
1915 ) {\r
1916 IsMatch = FALSE;\r
1917 }\r
1918\r
1919 if (SpdSelector->LocalPort != EFI_IPSEC_ANY_PORT && SpdSelector->LocalPort != ChildSaSession->LocalPort) {\r
1920 IsMatch = FALSE;\r
1921 }\r
1922\r
1923 if (SpdSelector->RemotePort != EFI_IPSEC_ANY_PORT && SpdSelector->RemotePort != ChildSaSession->RemotePort) {\r
1924 IsMatch = FALSE;\r
1925 }\r
1926\r
1927 IsMatch = (BOOLEAN) (IsMatch && \r
1928 IpSecMatchIpAddress (\r
1929 IpVersion,\r
1930 &ChildSaSession->SessionCommon.LocalPeerIp,\r
1931 SpdSelector->LocalAddress,\r
1932 SpdSelector->LocalAddressCount\r
1933 ));\r
1934\r
1935 IsMatch = (BOOLEAN) (IsMatch && \r
1936 IpSecMatchIpAddress (\r
1937 IpVersion,\r
1938 &ChildSaSession->SessionCommon.RemotePeerIp,\r
1939 SpdSelector->RemoteAddress,\r
1940 SpdSelector->RemoteAddressCount\r
1941 ));\r
1942\r
1943 if (IsMatch) {\r
1944 ChildSaSession->Spd = IkeSearchSpdEntry (SpdSelector);\r
1945 return EFI_ABORTED;\r
1946 } else {\r
1947 return EFI_SUCCESS;\r
1948 }\r
1949}\r
1950\r
1951/**\r
1952 Check if the Algorithm ID is supported.\r
1953\r
1954 @param[in] AlgorithmId The specified Algorithm ID.\r
1955 @param[in] Type The type used to indicate the Algorithm is for Encrypt or\r
1956 Authentication.\r
1957\r
1958 @retval TRUE If the Algorithm ID is supported.\r
1959 @retval FALSE If the Algorithm ID is not supported.\r
1960\r
1961**/\r
1962BOOLEAN\r
1963Ikev2IsSupportAlg (\r
1964 IN UINT16 AlgorithmId,\r
1965 IN UINT8 Type\r
1966 )\r
1967{\r
1968 UINT8 Index;\r
1969 switch (Type) {\r
1970 case IKE_ENCRYPT_TYPE :\r
1971 for (Index = 0; Index < IKEV2_SUPPORT_ENCRYPT_ALGORITHM_NUM; Index++) {\r
1972 if (mIkev2EncryptAlgorithmList[Index] == AlgorithmId) {\r
1973 return TRUE;\r
1974 }\r
1975 }\r
1976 break;\r
1977\r
1978 case IKE_AUTH_TYPE :\r
1979 for (Index = 0; Index < IKEV2_SUPPORT_AUTH_ALGORITHM_NUM; Index++) {\r
1980 if (mIkev2AuthAlgorithmList[Index] == AlgorithmId) {\r
1981 return TRUE;\r
1982 }\r
1983 }\r
1984 break;\r
1985\r
1986 case IKE_DH_TYPE :\r
1987 for (Index = 0; Index < IKEV2_SUPPORT_DH_ALGORITHM_NUM; Index++) {\r
1988 if (mIkev2DhGroupAlgorithmList[Index] == AlgorithmId) {\r
1989 return TRUE;\r
1990 }\r
1991 }\r
1992 break;\r
1993\r
1994 case IKE_PRF_TYPE :\r
1995 for (Index = 0; Index < IKEV2_SUPPORT_PRF_ALGORITHM_NUM; Index++) {\r
1996 if (mIkev2PrfAlgorithmList[Index] == AlgorithmId) {\r
1997 return TRUE;\r
1998 }\r
1999 }\r
2000 }\r
2001 return FALSE;\r
2002}\r
2003\r
2004/**\r
2005 Get the preferred algorithm types from ProposalData.\r
2006\r
2007 @param[in] ProposalData Pointer to related IKEV2_PROPOSAL_DATA.\r
2008 @param[out] PreferEncryptAlgorithm Output of preferred encrypt algorithm.\r
2009 @param[out] PreferIntegrityAlgorithm Output of preferred integrity algorithm. \r
2010 @param[out] PreferPrfAlgorithm Output of preferred PRF algorithm. Only \r
2011 for IKE SA.\r
2012 @param[out] PreferDhGroup Output of preferred DH group. Only for \r
2013 IKE SA.\r
2014 @param[out] PreferEncryptKeylength Output of preferred encrypt key length \r
2015 in bytes.\r
2016 @param[out] IsSupportEsn Output of value about the Extented Sequence\r
2017 Number is support or not. Only for Child SA.\r
2018 @param[in] IsChildSa If it is ture, the ProposalData is for IKE\r
2019 SA. Otherwise the proposalData is for Child SA.\r
2020\r
2021**/\r
2022VOID\r
2023Ikev2ParseProposalData (\r
2024 IN IKEV2_PROPOSAL_DATA *ProposalData, \r
2025 OUT UINT16 *PreferEncryptAlgorithm,\r
2026 OUT UINT16 *PreferIntegrityAlgorithm,\r
2027 OUT UINT16 *PreferPrfAlgorithm,\r
2028 OUT UINT16 *PreferDhGroup,\r
2029 OUT UINTN *PreferEncryptKeylength,\r
2030 OUT BOOLEAN *IsSupportEsn,\r
2031 IN BOOLEAN IsChildSa\r
2032) \r
2033{\r
2034 IKEV2_TRANSFORM_DATA *TransformData;\r
2035 UINT8 TransformIndex;\r
2036\r
2037 //\r
2038 // Check input parameters.\r
2039 //\r
2040 if (ProposalData == NULL ||\r
2041 PreferEncryptAlgorithm == NULL || \r
2042 PreferIntegrityAlgorithm == NULL ||\r
2043 PreferEncryptKeylength == NULL\r
2044 ) {\r
2045 return;\r
2046 }\r
2047\r
2048 if (IsChildSa) {\r
2049 if (IsSupportEsn == NULL) {\r
2050 return;\r
2051 }\r
2052 } else {\r
2053 if (PreferPrfAlgorithm == NULL || PreferDhGroup == NULL) {\r
2054 return;\r
2055 }\r
2056 } \r
2057\r
2058 TransformData = (IKEV2_TRANSFORM_DATA *)(ProposalData + 1);\r
2059 for (TransformIndex = 0; TransformIndex < ProposalData->NumTransforms; TransformIndex++) {\r
2060 switch (TransformData->TransformType) { \r
2061 //\r
2062 // For IKE SA there are four algorithm types. Encryption Algorithm, Pseudo-random Function, \r
2063 // Integrity Algorithm, Diffie-Hellman Group. For Child SA, there are three algorithm types. \r
2064 // Encryption Algorithm, Integrity Algorithm, Extended Sequence Number.\r
2065 //\r
2066 case IKEV2_TRANSFORM_TYPE_ENCR:\r
2067 if (*PreferEncryptAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_ENCRYPT_TYPE)) {\r
2068 //\r
2069 // Check the attribute value. According to RFC, only Keylength is support.\r
2070 //\r
2071 if (TransformData->Attribute.AttrType == IKEV2_ATTRIBUTE_TYPE_KEYLEN) {\r
2072 //\r
2073 // If the Keylength is not support, continue to check the next one.\r
2074 //\r
2075 if (IpSecGetEncryptKeyLength ((UINT8)TransformData->TransformId) != (UINTN)(TransformData->Attribute.Attr.AttrValue >> 3)){\r
2076 break;\r
2077 } else {\r
2078 *PreferEncryptKeylength = TransformData->Attribute.Attr.AttrValue;\r
2079 }\r
2080 }\r
2081 *PreferEncryptAlgorithm = TransformData->TransformId;\r
2082 }\r
2083 break;\r
2084\r
2085 case IKEV2_TRANSFORM_TYPE_PRF :\r
2086 if (!IsChildSa) {\r
2087 if (*PreferPrfAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_PRF_TYPE)) {\r
2088 *PreferPrfAlgorithm = TransformData->TransformId;\r
2089 }\r
2090 } \r
2091 break;\r
2092\r
2093 case IKEV2_TRANSFORM_TYPE_INTEG :\r
2094 if (*PreferIntegrityAlgorithm == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_AUTH_TYPE)) {\r
2095 *PreferIntegrityAlgorithm = TransformData->TransformId;\r
2096 }\r
2097 break;\r
2098 \r
2099 case IKEV2_TRANSFORM_TYPE_DH :\r
2100 if (!IsChildSa) {\r
2101 if (*PreferDhGroup == 0 && Ikev2IsSupportAlg (TransformData->TransformId, IKE_DH_TYPE)) {\r
2102 *PreferDhGroup = TransformData->TransformId;\r
2103 }\r
2104 } \r
2105 break;\r
2106 \r
2107 case IKEV2_TRANSFORM_TYPE_ESN :\r
2108 if (IsChildSa) {\r
2109 if (TransformData->TransformId != 0) {\r
2110 *IsSupportEsn = TRUE;\r
2111 }\r
2112 } \r
2113 break;\r
2114\r
2115 default:\r
2116 break;\r
2117 }\r
2118 TransformData = (IKEV2_TRANSFORM_DATA *)(TransformData + 1);\r
2119 }\r
2120}\r
2121\r
2122/**\r
2123 Parse the received Initial Exchange Packet.\r
2124 \r
2125 This function parse the SA Payload and Key Payload to find out the cryptographic \r
2126 suite for the further IKE negotiation and fill it into the IKE SA Session's \r
2127 CommonSession->SaParams.\r
2128\r
2129 @param[in, out] IkeSaSession Pointer to related IKEV2_SA_SESSION.\r
2130 @param[in] SaPayload The received packet.\r
2131 @param[in] Type The received packet IKE header flag. \r
2132\r
2133 @retval TRUE If the SA proposal in Packet is acceptable.\r
2134 @retval FALSE If the SA proposal in Packet is not acceptable.\r
2135\r
2136**/\r
2137BOOLEAN\r
2138Ikev2SaParseSaPayload (\r
2139 IN OUT IKEV2_SA_SESSION *IkeSaSession,\r
2140 IN IKE_PAYLOAD *SaPayload,\r
2141 IN UINT8 Type\r
2142 )\r
2143{\r
2144 IKEV2_PROPOSAL_DATA *ProposalData;\r
2145 UINT8 ProposalIndex;\r
2146 UINT16 PreferEncryptAlgorithm;\r
2147 UINT16 PreferIntegrityAlgorithm;\r
2148 UINT16 PreferPrfAlgorithm;\r
2149 UINT16 PreferDhGroup;\r
2150 UINTN PreferEncryptKeylength;\r
2151 UINT16 EncryptAlgorithm;\r
2152 UINT16 IntegrityAlgorithm;\r
2153 UINT16 PrfAlgorithm;\r
2154 UINT16 DhGroup;\r
2155 UINTN EncryptKeylength;\r
2156 BOOLEAN IsMatch;\r
2157 UINTN SaDataSize;\r
2158\r
2159 PreferPrfAlgorithm = 0;\r
2160 PreferIntegrityAlgorithm = 0;\r
2161 PreferDhGroup = 0;\r
2162 PreferEncryptAlgorithm = 0;\r
2163 PreferEncryptKeylength = 0;\r
2164 PrfAlgorithm = 0;\r
2165 IntegrityAlgorithm = 0;\r
2166 DhGroup = 0;\r
2167 EncryptAlgorithm = 0;\r
2168 EncryptKeylength = 0;\r
2169 IsMatch = FALSE;\r
2170\r
2171 if (Type == IKE_HEADER_FLAGS_INIT) {\r
2172 ProposalData = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
2173 for (ProposalIndex = 0; ProposalIndex < ((IKEV2_SA_DATA *)SaPayload->PayloadBuf)->NumProposals; ProposalIndex++) {\r
2174 //\r
2175 // Iterate each proposal to find the perfered one.\r
2176 //\r
2177 if (ProposalData->ProtocolId == IPSEC_PROTO_ISAKMP && ProposalData->NumTransforms >= 4) {\r
2178 //\r
2179 // Get the preferred algorithms.\r
2180 //\r
2181 Ikev2ParseProposalData (\r
2182 ProposalData, \r
2183 &PreferEncryptAlgorithm,\r
2184 &PreferIntegrityAlgorithm,\r
2185 &PreferPrfAlgorithm,\r
2186 &PreferDhGroup,\r
2187 &PreferEncryptKeylength,\r
2188 NULL,\r
2189 FALSE\r
2190 );\r
2191\r
2192 if (PreferEncryptAlgorithm != 0 &&\r
2193 PreferIntegrityAlgorithm != 0 &&\r
2194 PreferPrfAlgorithm != 0 && \r
2195 PreferDhGroup != 0\r
2196 ) {\r
2197 //\r
2198 // Find the matched one. \r
2199 //\r
2200 IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
2201 ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);\r
2202 IkeSaSession->SessionCommon.SaParams->EncAlgId = PreferEncryptAlgorithm;\r
2203 IkeSaSession->SessionCommon.SaParams->EnckeyLen = PreferEncryptKeylength;\r
2204 IkeSaSession->SessionCommon.SaParams->DhGroup = PreferDhGroup;\r
2205 IkeSaSession->SessionCommon.SaParams->Prf = PreferPrfAlgorithm;\r
2206 IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
2207 IkeSaSession->SessionCommon.PreferDhGroup = PreferDhGroup;\r
2208\r
2209 //\r
2210 // Save the matched one in IKEV2_SA_DATA for furthure calculation.\r
2211 //\r
2212 SaDataSize = sizeof (IKEV2_SA_DATA) +\r
2213 sizeof (IKEV2_PROPOSAL_DATA) +\r
2214 sizeof (IKEV2_TRANSFORM_DATA) * 4;\r
2215 IkeSaSession->SaData = AllocateZeroPool (SaDataSize);\r
2216 ASSERT (IkeSaSession->SaData != NULL);\r
2217\r
2218 IkeSaSession->SaData->NumProposals = 1;\r
2219\r
2220 //\r
2221 // BUGBUG: Suppose the matched proposal only has 4 transforms. If\r
2222 // The matched Proposal has more than 4 transforms means it contains\r
2223 // one than one transform with same type.\r
2224 //\r
2225 CopyMem (\r
2226 (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1), \r
2227 ProposalData, \r
2228 SaDataSize - sizeof (IKEV2_SA_DATA)\r
2229 );\r
2230\r
2231 ((IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1))->ProposalIndex = 1;\r
2232 return TRUE;\r
2233 } else {\r
2234 PreferEncryptAlgorithm = 0;\r
2235 PreferIntegrityAlgorithm = 0;\r
2236 PreferPrfAlgorithm = 0;\r
2237 PreferDhGroup = 0;\r
2238 PreferEncryptKeylength = 0;\r
2239 }\r
2240 }\r
2241 //\r
2242 // Point to next Proposal.\r
2243 //\r
2244 ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) + \r
2245 ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r
2246 }\r
2247 } else if (Type == IKE_HEADER_FLAGS_RESPOND) {\r
2248 //\r
2249 // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is \r
2250 // the responded SA proposal, suppose it only has one proposal and the transform Numbers \r
2251 // is 4. \r
2252 //\r
2253 ProposalData = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);\r
2254 if (ProposalData->ProtocolId != IPSEC_PROTO_ISAKMP || ProposalData->NumTransforms != 4) {\r
2255 return FALSE;\r
2256 }\r
2257 //\r
2258 // Get the preferred algorithms. \r
2259 //\r
2260 Ikev2ParseProposalData (\r
2261 ProposalData,\r
2262 &PreferEncryptAlgorithm,\r
2263 &PreferIntegrityAlgorithm,\r
2264 &PreferPrfAlgorithm,\r
2265 &PreferDhGroup,\r
2266 &PreferEncryptKeylength,\r
2267 NULL, \r
2268 FALSE\r
2269 );\r
2270 // \r
2271 // Check if the Sa proposal data from received packet is in the IkeSaSession->SaData.\r
2272 //\r
2273 ProposalData = (IKEV2_PROPOSAL_DATA *) (IkeSaSession->SaData + 1);\r
2274\r
2275 for (ProposalIndex = 0; ProposalIndex < IkeSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {\r
2276 Ikev2ParseProposalData (\r
2277 ProposalData, \r
2278 &EncryptAlgorithm,\r
2279 &IntegrityAlgorithm,\r
2280 &PrfAlgorithm,\r
2281 &DhGroup,\r
2282 &EncryptKeylength,\r
2283 NULL,\r
2284 FALSE\r
2285 );\r
2286 if (EncryptAlgorithm == PreferEncryptAlgorithm &&\r
2287 EncryptKeylength == PreferEncryptKeylength &&\r
2288 IntegrityAlgorithm == PreferIntegrityAlgorithm &&\r
2289 PrfAlgorithm == PreferPrfAlgorithm &&\r
2290 DhGroup == PreferDhGroup\r
2291 ) {\r
2292 IsMatch = TRUE;\r
2293 } else {\r
2294 EncryptAlgorithm = 0;\r
2295 IntegrityAlgorithm = 0;\r
2296 PrfAlgorithm = 0;\r
2297 DhGroup = 0;\r
2298 EncryptKeylength = 0; \r
2299 }\r
2300\r
2301 ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) + \r
2302 ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA)); \r
2303 }\r
2304\r
2305 if (IsMatch) {\r
2306 IkeSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
2307 ASSERT (IkeSaSession->SessionCommon.SaParams != NULL);\r
2308 IkeSaSession->SessionCommon.SaParams->EncAlgId = PreferEncryptAlgorithm;\r
2309 IkeSaSession->SessionCommon.SaParams->EnckeyLen = PreferEncryptKeylength;\r
2310 IkeSaSession->SessionCommon.SaParams->DhGroup = PreferDhGroup;\r
2311 IkeSaSession->SessionCommon.SaParams->Prf = PreferPrfAlgorithm;\r
2312 IkeSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
2313 IkeSaSession->SessionCommon.PreferDhGroup = PreferDhGroup;\r
2314 \r
2315 return TRUE;\r
2316 }\r
2317 }\r
2318 return FALSE;\r
2319}\r
2320\r
2321/**\r
2322 Parse the received Authentication Exchange Packet.\r
2323 \r
2324 This function parse the SA Payload and Key Payload to find out the cryptographic\r
2325 suite for the ESP and fill it into the Child SA Session's CommonSession->SaParams.\r
2326 \r
2327 @param[in, out] ChildSaSession Pointer to IKEV2_CHILD_SA_SESSION related to \r
2328 this Authentication Exchange.\r
2329 @param[in] SaPayload The received packet.\r
2330 @param[in] Type The IKE header's flag of received packet . \r
2331 \r
2332 @retval TRUE If the SA proposal in Packet is acceptable.\r
2333 @retval FALSE If the SA proposal in Packet is not acceptable.\r
2334\r
2335**/\r
2336BOOLEAN\r
2337Ikev2ChildSaParseSaPayload (\r
2338 IN OUT IKEV2_CHILD_SA_SESSION *ChildSaSession,\r
2339 IN IKE_PAYLOAD *SaPayload,\r
2340 IN UINT8 Type\r
2341 )\r
2342{\r
2343 IKEV2_PROPOSAL_DATA *ProposalData;\r
2344 UINT8 ProposalIndex;\r
2345 UINT16 PreferEncryptAlgorithm;\r
2346 UINT16 PreferIntegrityAlgorithm;\r
2347 UINTN PreferEncryptKeylength;\r
2348 BOOLEAN PreferIsSupportEsn;\r
2349 UINT16 EncryptAlgorithm;\r
2350 UINT16 IntegrityAlgorithm;\r
2351 UINTN EncryptKeylength;\r
2352 BOOLEAN IsSupportEsn;\r
2353 BOOLEAN IsMatch;\r
2354 UINTN SaDataSize;\r
2355\r
2356\r
2357 PreferIntegrityAlgorithm = 0;\r
2358 PreferEncryptAlgorithm = 0;\r
2359 PreferEncryptKeylength = 0;\r
2360 IntegrityAlgorithm = 0;\r
2361 EncryptAlgorithm = 0;\r
2362 EncryptKeylength = 0;\r
2363 IsMatch = TRUE;\r
2364 IsSupportEsn = FALSE;\r
2365 PreferIsSupportEsn = FALSE;\r
2366\r
2367 if (Type == IKE_HEADER_FLAGS_INIT) {\r
2368 ProposalData = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *) SaPayload->PayloadBuf + 1);\r
2369 for (ProposalIndex = 0; ProposalIndex < ((IKEV2_SA_DATA *) SaPayload->PayloadBuf)->NumProposals; ProposalIndex++) {\r
2370 //\r
2371 // Iterate each proposal to find the preferred one.\r
2372 //\r
2373 if (ProposalData->ProtocolId == IPSEC_PROTO_IPSEC_ESP && ProposalData->NumTransforms >= 3) {\r
2374 //\r
2375 // Get the preferred algorithm.\r
2376 //\r
2377 Ikev2ParseProposalData (\r
2378 ProposalData,\r
2379 &PreferEncryptAlgorithm,\r
2380 &PreferIntegrityAlgorithm,\r
2381 NULL,\r
2382 NULL,\r
2383 &PreferEncryptKeylength,\r
2384 &IsSupportEsn,\r
2385 TRUE\r
2386 );\r
2387 //\r
2388 // Don't support the ESN now.\r
2389 //\r
2390 if (PreferEncryptAlgorithm != 0 && \r
2391 PreferIntegrityAlgorithm != 0 &&\r
2392 !IsSupportEsn\r
2393 ) {\r
2394 //\r
2395 // Find the matched one. \r
2396 //\r
2397 ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
2398 ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);\r
2399 ChildSaSession->SessionCommon.SaParams->EncAlgId = PreferEncryptAlgorithm;\r
2400 ChildSaSession->SessionCommon.SaParams->EnckeyLen = PreferEncryptKeylength;\r
2401 ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
2402 CopyMem (&ChildSaSession->RemotePeerSpi, ProposalData->Spi, sizeof (ChildSaSession->RemotePeerSpi));\r
2403\r
2404 //\r
2405 // Save the matched one in IKEV2_SA_DATA for furthure calculation.\r
2406 //\r
2407 SaDataSize = sizeof (IKEV2_SA_DATA) +\r
2408 sizeof (IKEV2_PROPOSAL_DATA) +\r
2409 sizeof (IKEV2_TRANSFORM_DATA) * 4;\r
2410\r
2411 ChildSaSession->SaData = AllocateZeroPool (SaDataSize);\r
2412 ASSERT (ChildSaSession->SaData != NULL);\r
2413\r
2414 ChildSaSession->SaData->NumProposals = 1;\r
2415\r
2416 //\r
2417 // BUGBUG: Suppose there are 4 transforms in the matched proposal. If\r
2418 // the matched Proposal has more than 4 transforms that means there \r
2419 // are more than one transform with same type.\r
2420 //\r
2421 CopyMem (\r
2422 (IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1),\r
2423 ProposalData,\r
2424 SaDataSize - sizeof (IKEV2_SA_DATA)\r
2425 );\r
2426\r
2427 ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->ProposalIndex = 1;\r
2428\r
2429 ((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi = AllocateCopyPool (\r
2430 sizeof (ChildSaSession->LocalPeerSpi), \r
2431 &ChildSaSession->LocalPeerSpi\r
2432 );\r
2433 ASSERT (((IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1))->Spi != NULL);\r
2434 return TRUE;\r
2435\r
2436 } else {\r
2437 PreferEncryptAlgorithm = 0;\r
2438 PreferIntegrityAlgorithm = 0;\r
2439 IsSupportEsn = TRUE;\r
2440 }\r
2441 }\r
2442 //\r
2443 // Point to next Proposal\r
2444 //\r
2445 ProposalData = (IKEV2_PROPOSAL_DATA *)((UINT8 *)(ProposalData + 1) + \r
2446 ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA));\r
2447 }\r
2448 } else if (Type == IKE_HEADER_FLAGS_RESPOND) {\r
2449 //\r
2450 // First check the SA proposal's ProtoctolID and Transform Numbers. Since it is \r
2451 // the responded SA proposal, suppose it only has one proposal and the transform Numbers \r
2452 // is 3. \r
2453 //\r
2454 ProposalData = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
2455 if (ProposalData->ProtocolId != IPSEC_PROTO_IPSEC_ESP || ProposalData->NumTransforms != 3) {\r
2456 return FALSE;\r
2457 }\r
2458 //\r
2459 // Get the preferred algorithms.\r
2460 //\r
2461 Ikev2ParseProposalData (\r
2462 ProposalData,\r
2463 &PreferEncryptAlgorithm,\r
2464 &PreferIntegrityAlgorithm,\r
2465 NULL,\r
2466 NULL,\r
2467 &PreferEncryptKeylength,\r
2468 &PreferIsSupportEsn,\r
2469 TRUE\r
2470 );\r
2471\r
2472 ProposalData = (IKEV2_PROPOSAL_DATA *) (ChildSaSession->SaData + 1);\r
2473\r
2474 for (ProposalIndex = 0; ProposalIndex < ChildSaSession->SaData->NumProposals && (!IsMatch); ProposalIndex++) {\r
2475 Ikev2ParseProposalData (\r
2476 ProposalData, \r
2477 &EncryptAlgorithm,\r
2478 &IntegrityAlgorithm,\r
2479 NULL,\r
2480 NULL,\r
2481 &EncryptKeylength,\r
2482 &IsSupportEsn,\r
2483 TRUE\r
2484 );\r
2485 if (EncryptAlgorithm == PreferEncryptAlgorithm &&\r
2486 EncryptKeylength == PreferEncryptKeylength &&\r
2487 IntegrityAlgorithm == PreferIntegrityAlgorithm &&\r
2488 IsSupportEsn == PreferIsSupportEsn \r
2489 ) {\r
2490 IsMatch = TRUE;\r
2491 } else {\r
2492 PreferEncryptAlgorithm = 0;\r
2493 PreferIntegrityAlgorithm = 0;\r
2494 IsSupportEsn = TRUE;\r
2495 }\r
2496 ProposalData = (IKEV2_PROPOSAL_DATA*)((UINT8*)(ProposalData + 1) + \r
2497 ProposalData->NumTransforms * sizeof (IKEV2_TRANSFORM_DATA)); \r
2498 }\r
2499 \r
2500 ProposalData = (IKEV2_PROPOSAL_DATA *)((IKEV2_SA_DATA *)SaPayload->PayloadBuf + 1);\r
2501 if (IsMatch) {\r
2502 ChildSaSession->SessionCommon.SaParams = AllocateZeroPool (sizeof (IKEV2_SA_PARAMS));\r
2503 ASSERT (ChildSaSession->SessionCommon.SaParams != NULL);\r
2504 ChildSaSession->SessionCommon.SaParams->EncAlgId = PreferEncryptAlgorithm;\r
2505 ChildSaSession->SessionCommon.SaParams->EnckeyLen = PreferEncryptKeylength;\r
2506 ChildSaSession->SessionCommon.SaParams->IntegAlgId = PreferIntegrityAlgorithm;\r
2507 CopyMem (&ChildSaSession->RemotePeerSpi, ProposalData->Spi, sizeof (ChildSaSession->RemotePeerSpi));\r
2508\r
2509 return TRUE;\r
2510 }\r
2511 }\r
2512 return FALSE;\r
2513}\r
2514\r
2515/**\r
2516 Generate Key buffer from fragments.\r
2517\r
2518 If the digest length of specified HashAlgId is larger than or equal with the \r
2519 required output key length, derive the key directly. Otherwise, Key Material \r
2520 needs to be PRF-based concatenation according to 2.13 of RFC 4306: \r
2521 prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),\r
2522 T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)\r
2523 then derive the key from this key material.\r
2524 \r
2525 @param[in] HashAlgId The Hash Algorithm ID used to generate key.\r
2526 @param[in] HashKey Pointer to a key buffer which contains hash key.\r
2527 @param[in] HashKeyLength The length of HashKey in bytes.\r
2528 @param[in, out] OutputKey Pointer to buffer which is used to receive the \r
2529 output key.\r
2530 @param[in] OutputKeyLength The length of OutPutKey buffer.\r
2531 @param[in] Fragments Pointer to the data to be used to generate key.\r
2532 @param[in] NumFragments The numbers of the Fragement.\r
2533\r
2534 @retval EFI_SUCCESS The operation complete successfully.\r
2535 @retval EFI_INVALID_PARAMETER If NumFragments is zero.\r
2536 @retval EFI_OUT_OF_RESOURCES If the required resource can't be allocated.\r
2537 @retval Others The operation is failed.\r
2538\r
2539**/\r
2540EFI_STATUS\r
2541Ikev2SaGenerateKey (\r
2542 IN UINT8 HashAlgId,\r
2543 IN UINT8 *HashKey,\r
2544 IN UINTN HashKeyLength,\r
2545 IN OUT UINT8 *OutputKey,\r
2546 IN UINTN OutputKeyLength,\r
2547 IN PRF_DATA_FRAGMENT *Fragments,\r
2548 IN UINTN NumFragments\r
2549 )\r
2550{\r
2551 EFI_STATUS Status;\r
2552 PRF_DATA_FRAGMENT LocalFragments[3];\r
2553 UINT8 *Digest;\r
2554 UINTN DigestSize;\r
2555 UINTN Round;\r
2556 UINTN Index;\r
2557 UINTN AuthKeyLength;\r
2558 UINTN FragmentsSize;\r
2559 UINT8 TailData;\r
2560\r
2561 Status = EFI_SUCCESS;\r
2562\r
2563 if (NumFragments == 0) {\r
2564 return EFI_INVALID_PARAMETER;\r
2565 }\r
2566\r
2567 LocalFragments[0].Data = NULL;\r
2568 LocalFragments[1].Data = NULL;\r
2569 LocalFragments[2].Data = NULL;\r
2570\r
2571 AuthKeyLength = IpSecGetHmacDigestLength (HashAlgId);\r
2572 DigestSize = AuthKeyLength;\r
2573 Digest = AllocateZeroPool (AuthKeyLength);\r
2574\r
2575 if (Digest == NULL) {\r
2576 return EFI_OUT_OF_RESOURCES;\r
2577 }\r
2578 //\r
2579 // If the required output key length is less than the digest size,\r
2580 // copy the digest into OutputKey.\r
2581 //\r
2582 if (OutputKeyLength <= DigestSize) {\r
2583 Status = IpSecCryptoIoHmac (\r
2584 HashAlgId,\r
2585 HashKey, \r
2586 HashKeyLength, \r
2587 (HASH_DATA_FRAGMENT *) Fragments, \r
2588 NumFragments, \r
2589 Digest, \r
2590 DigestSize\r
2591 );\r
2592 if (EFI_ERROR (Status)) {\r
2593 goto Exit;\r
2594 }\r
2595\r
2596 CopyMem (OutputKey, Digest, OutputKeyLength);\r
2597 goto Exit;\r
2598 }\r
2599\r
2600 //\r
2601 //Otherwise, Key Material need to be PRF-based concatenation according to 2.13\r
2602 //of RFC 4306: prf+ (K,S) = T1 | T2 | T3 | T4 | ..., T1 = prf (K, S | 0x01),\r
2603 //T2 = prf (K, T1 | S | 0x02), T3 = prf (K, T2 | S | 0x03),T4 = prf (K, T3 | S | 0x04)\r
2604 //then derive the key from this key material.\r
2605 //\r
2606 FragmentsSize = 0;\r
2607 for (Index = 0; Index < NumFragments; Index++) {\r
2608 FragmentsSize = FragmentsSize + Fragments[Index].DataSize;\r
2609 }\r
2610\r
2611 LocalFragments[1].Data = AllocateZeroPool (FragmentsSize);\r
2612 ASSERT (LocalFragments[1].Data != NULL);\r
2613 LocalFragments[1].DataSize = FragmentsSize;\r
2614\r
2615 //\r
2616 // Copy all input fragments into LocalFragments[1];\r
2617 //\r
2618 FragmentsSize = 0;\r
2619 for (Index = 0; Index < NumFragments; Index++) {\r
2620 CopyMem (\r
2621 LocalFragments[1].Data + FragmentsSize, \r
2622 Fragments[Index].Data,\r
2623 Fragments[Index].DataSize\r
2624 );\r
2625 FragmentsSize = FragmentsSize + Fragments[Index].DataSize;\r
2626 }\r
2627\r
2628 //\r
2629 // Prepare 0x01 as the first tail data.\r
2630 //\r
2631 TailData = 0x01;\r
2632 LocalFragments[2].Data = &TailData;\r
2633 LocalFragments[2].DataSize = sizeof (TailData);\r
2634 //\r
2635 // Allocate buffer for the first fragment\r
2636 //\r
2637 LocalFragments[0].Data = AllocateZeroPool (AuthKeyLength);\r
2638 ASSERT (LocalFragments[0].Data != NULL);\r
2639 LocalFragments[0].DataSize = AuthKeyLength;\r
2640\r
2641 Round = (OutputKeyLength - 1) / AuthKeyLength + 1;\r
2642 for (Index = 0; Index < Round; Index++) {\r
2643 Status = IpSecCryptoIoHmac (\r
2644 HashAlgId, \r
2645 HashKey, \r
2646 HashKeyLength, \r
2647 (HASH_DATA_FRAGMENT *)(Index == 0 ? &LocalFragments[1] : LocalFragments),\r
2648 Index == 0 ? 2 : 3, \r
2649 Digest,\r
2650 DigestSize\r
2651 );\r
2652 if (EFI_ERROR(Status)) {\r
2653 goto Exit;\r
2654 }\r
2655 CopyMem (\r
2656 LocalFragments[0].Data, \r
2657 Digest, \r
2658 DigestSize\r
2659 );\r
2660 if (OutputKeyLength > DigestSize * (Index + 1)) {\r
2661 CopyMem (\r
2662 OutputKey + Index * DigestSize, \r
2663 Digest, \r
2664 DigestSize\r
2665 );\r
2666 LocalFragments[0].DataSize = DigestSize;\r
2667 TailData ++;\r
2668 } else {\r
2669 // \r
2670 // The last round\r
2671 //\r
2672 CopyMem (\r
2673 OutputKey + Index * DigestSize, \r
2674 Digest, \r
2675 OutputKeyLength - Index * DigestSize\r
2676 );\r
2677 }\r
2678 }\r
2679\r
2680Exit:\r
2681 //\r
2682 // Only First and second Framgement Data need to be freed.\r
2683 //\r
2684 for (Index = 0 ; Index < 2; Index++) {\r
2685 if (LocalFragments[Index].Data != NULL) {\r
2686 FreePool (LocalFragments[Index].Data);\r
2687 }\r
2688 }\r
2689 if (Digest != NULL) {\r
2690 FreePool (Digest);\r
2691 }\r
2692 return Status;\r
2693}\r
2694\r
EFI Development Kit II mirror for PVE